Disassembly of File: Ekd5.exe
Code Offset = 00000400, Code Size = 00084E00
Data Offset = 00089A00, Data Size = 00006800

Number of Objects = 0005 (dec), Imagebase = 00400000h

   Object01: .text    RVA: 00001000 Offset: 00000400 Size: 00084E00 Flags: E0000020
   Object02: .rdata   RVA: 00086000 Offset: 00085200 Size: 00004800 Flags: C0000040
   Object03: .data    RVA: 0008B000 Offset: 00089A00 Size: 00006800 Flags: C0000040
   Object04: .rsrc    RVA: 000BE000 Offset: 00090200 Size: 0000E800 Flags: 40000040
   Object05: .Silvana RVA: 000CD000 Offset: 0009EA00 Size: 000000BC Flags: C0000040


+++++++++++++++++++ MENU INFORMATION ++++++++++++++++++

Number of Menus =    1 (decimal)


APPMENU

       {Popup}
                  [ID=0066h]
           X       [ID=0065h]
           _8     [ID=0068h]

       {Popup}
                [ID=006Bh]
           "*gL  [ID=006Eh]
           _      [ID=006Dh]

      ť {Popup}
           f       [ID=0069h]
              Sw   [ID=9CD3h]
           0bť     [ID=9CD6h]
           it     [ID=9CD7h]
           )a     [ID=006Ah]
           :)    [ID=006Ch]
           H,ť     [ID=9C89h]

+++++++++++++++++ DIALOG INFORMATION ++++++++++++++++++

Number of Dialogs =   32 (decimal)

Name:       KANKYOU, # of Controls=000, Caption:"", ClassName:""
Name: DialogID_00A6, # of Controls=000, Caption:"fť", ClassName:""
Name: DialogID_00A7, # of Controls=000, Caption:"", ClassName:""
Name: DialogID_00B2, # of Controls=012, Caption:"", ClassName:""
     001 - ControlID:0566, Control Class:"STATIC" Control Text:"" 
     002 - ControlID:FFFF, Control Class:"BUTTON" Control Text:";" 
     003 - ControlID:0567, Control Class:"STATIC" Control Text:"" 
     004 - ControlID:FFFF, Control Class:"BUTTON" Control Text:"" 
     005 - ControlID:0568, Control Class:"STATIC" Control Text:"" 
     006 - ControlID:FFFF, Control Class:"BUTTON" Control Text:"2" 
     007 - ControlID:0569, Control Class:"STATIC" Control Text:"" 
     008 - ControlID:FFFF, Control Class:"BUTTON" Control Text:"ћ" 
     009 - ControlID:056A, Control Class:"STATIC" Control Text:"" 
     010 - ControlID:FFFF, Control Class:"BUTTON" Control Text:"" 
     011 - ControlID:03F0, Control Class:"STATIC" Control Text:"99" 
     012 - ControlID:FFFF, Control Class:"BUTTON" Control Text:"" 
Name: DialogID_00B3, # of Controls=019, Caption:"", ClassName:""
     001 - ControlID:0584, Control Class:"STATIC" Control Text:"" 
     002 - ControlID:0583, Control Class:"STATIC" Control Text:"" 
     003 - ControlID:0582, Control Class:"STATIC" Control Text:"" 
     004 - ControlID:056F, Control Class:"STATIC" Control Text:"Wepon:" 
     005 - ControlID:0570, Control Class:"STATIC" Control Text:"99" 
     006 - ControlID:058A, Control Class:"STATIC" Control Text:"Lv" 
     007 - ControlID:058E, Control Class:"STATIC" Control Text:"" 
     008 - ControlID:058B, Control Class:"STATIC" Control Text:"Exp" 
     009 - ControlID:0579, Control Class:"STATIC" Control Text:"Effect" 
     010 - ControlID:0572, Control Class:"STATIC" Control Text:"Armor:" 
     011 - ControlID:0573, Control Class:"STATIC" Control Text:"99" 
     012 - ControlID:058C, Control Class:"STATIC" Control Text:"Lv" 
     013 - ControlID:058F, Control Class:"STATIC" Control Text:"" 
     014 - ControlID:058D, Control Class:"STATIC" Control Text:"Exp" 
     015 - ControlID:0578, Control Class:"STATIC" Control Text:"Effect" 
     016 - ControlID:05A4, Control Class:"STATIC" Control Text:"" 
     017 - ControlID:05A5, Control Class:"STATIC" Control Text:"" 
     018 - ControlID:0575, Control Class:"STATIC" Control Text:"Sub Item:" 
     019 - ControlID:057A, Control Class:"STATIC" Control Text:"Effect" 
Name: DialogID_00BA, # of Controls=000, Caption:"", ClassName:""
Name: DialogID_00C1, # of Controls=004, Caption:"	 ", ClassName:""
     001 - ControlID:0403, Control Class:"BUTTON" Control Text:"" 
     002 - ControlID:0404, Control Class:"BUTTON" Control Text:"" 
     003 - ControlID:0422, Control Class:"BUTTON" Control Text:"" 
     004 - ControlID:0423, Control Class:"BUTTON" Control Text:"" 
Name: DialogID_00C8, # of Controls=001, Caption:"", ClassName:""
     001 - ControlID:0001, Control Class:"˰8" Control Text:"" 
Name: DialogID_00CD, # of Controls=000, Caption:"", ClassName:""
Name: DialogID_00EC, # of Controls=000, Caption:"/", ClassName:""
Name: DialogID_00F2, # of Controls=002, Caption:"", ClassName:""
     001 - ControlID:0002, Control Class:"BUTTON" Control Text:"" 
     002 - ControlID:0002, Control Class:"BUTTON" Control Text:"" 
Name: DialogID_0117, # of Controls=005, Caption:"", ClassName:""
     001 - ControlID:0002, Control Class:"BUTTON" Control Text:"" 
     002 - ControlID:0507, Control Class:"BUTTON" Control Text:";" 
     003 - ControlID:0508, Control Class:"BUTTON" Control Text:"Ve" 
     004 - ControlID:0509, Control Class:"BUTTON" Control Text:"Sw" 
     005 - ControlID:050B, Control Class:"BUTTON" Control Text:"" 
Name: DialogID_011A, # of Controls=005, Caption:"", ClassName:""
     001 - ControlID:0002, Control Class:"BUTTON" Control Text:"" 
     002 - ControlID:0564, Control Class:"STATIC" Control Text:"" 
     003 - ControlID:05CD, Control Class:"STATIC" Control Text:"MP" 
     004 - ControlID:03EA, Control Class:"STATIC" Control Text:"Name" 
     005 - ControlID:03FA, Control Class:"STATIC" Control Text:"" 
Name: DialogID_011C, # of Controls=021, Caption:"", ClassName:""
     001 - ControlID:03FA, Control Class:"STATIC" Control Text:"" 
     002 - ControlID:03F8, Control Class:"STATIC" Control Text:"Attribute" 
     003 - ControlID:05A8, Control Class:"STATIC" Control Text:"Sword" 
     004 - ControlID:FFFF, Control Class:"STATIC" Control Text:"fh:" 
     005 - ControlID:05A7, Control Class:"STATIC" Control Text:"Armor" 
     006 - ControlID:FFFF, Control Class:"STATIC" Control Text:"" 
     007 - ControlID:0474, Control Class:"STATIC" Control Text:"A" 
     008 - ControlID:FFFF, Control Class:"STATIC" Control Text:";" 
     009 - ControlID:0561, Control Class:"STATIC" Control Text:"A" 
     010 - ControlID:FFFF, Control Class:"STATIC" Control Text:"" 
     011 - ControlID:03F1, Control Class:"STATIC" Control Text:"A" 
     012 - ControlID:FFFF, Control Class:"STATIC" Control Text:"2" 
     013 - ControlID:0562, Control Class:"STATIC" Control Text:"A" 
     014 - ControlID:FFFF, Control Class:"STATIC" Control Text:"ћ" 
     015 - ControlID:0563, Control Class:"STATIC" Control Text:"A" 
     016 - ControlID:FFFF, Control Class:"STATIC" Control Text:"" 
     017 - ControlID:0564, Control Class:"STATIC" Control Text:"A" 
     018 - ControlID:FFFF, Control Class:"STATIC" Control Text:"" 
     019 - ControlID:05A9, Control Class:"STATIC" Control Text:"" 
     020 - ControlID:FFFF, Control Class:"STATIC" Control Text:";" 
     021 - ControlID:05A6, Control Class:"STATIC" Control Text:"" 
Name: DialogID_011D, # of Controls=000, Caption:"", ClassName:""
Name: DialogID_0129, # of Controls=001, Caption:"", ClassName:""
     001 - ControlID:056B, Control Class:"BUTTON" Control Text:"" 
Name: DialogID_0140, # of Controls=000, Caption:"ep<", ClassName:""
Name: DialogID_0145, # of Controls=004, Caption:"Sw", ClassName:""
     001 - ControlID:0002, Control Class:"BUTTON" Control Text:"n" 
     002 - ControlID:0001, Control Class:"" Control Text:"" 
     003 - ControlID:0000, Control Class:"BUTTON" Control Text:"" 
     004 - ControlID:0000, Control Class:"STATIC" Control Text:"999999" 
Name: DialogID_0147, # of Controls=000, Caption:"", ClassName:""
Name: DialogID_0148, # of Controls=000, Caption:"", ClassName:""
Name: DialogID_0149, # of Controls=000, Caption:"=", ClassName:""
Name: DialogID_014D, # of Controls=002, Caption:"it", ClassName:""
     001 - ControlID:0002, Control Class:"BUTTON" Control Text:"n" 
     002 - ControlID:059D, Control Class:"STATIC" Control Text:"Find: 50 / 50" 
Name: DialogID_014E, # of Controls=003, Caption:"", ClassName:""
     001 - ControlID:03F8, Control Class:"STATIC" Control Text:"No.99: Item Name" 
     002 - ControlID:0415, Control Class:"STATIC" Control Text:"" 
     003 - ControlID:05AF, Control Class:"STATIC" Control Text:"" 
Name: DialogID_014F, # of Controls=004, Caption:"0bť", ClassName:""
     001 - ControlID:0002, Control Class:"BUTTON" Control Text:"n" 
     002 - ControlID:0002, Control Class:"BUTTON" Control Text:"" 
     003 - ControlID:FFFF, Control Class:"STATIC" Control Text:"" 
     004 - ControlID:0002, Control Class:"BUTTON" Control Text:"" 
Name: DialogID_0151, # of Controls=003, Caption:"ۦ", ClassName:""
     001 - ControlID:0002, Control Class:"BUTTON" Control Text:"" 
     002 - ControlID:FFFF, Control Class:"STATIC" Control Text:"" 
     003 - ControlID:0002, Control Class:"BUTTON" Control Text:"" 
Name: DialogID_0152, # of Controls=003, Caption:"Xۦ", ClassName:""
     001 - ControlID:0002, Control Class:"BUTTON" Control Text:"" 
     002 - ControlID:FFFF, Control Class:"STATIC" Control Text:"" 
     003 - ControlID:0001, Control Class:"BUTTON" Control Text:"OK" 
Name: DialogID_0153, # of Controls=003, Caption:"n", ClassName:""
     001 - ControlID:0001, Control Class:"BUTTON" Control Text:"OK" 
     002 - ControlID:FFFF, Control Class:"STATIC" Control Text:"" 
     003 - ControlID:0534, Control Class:"STATIC" Control Text:"" 
Name: DialogID_0154, # of Controls=004, Caption:"	 ", ClassName:""
     001 - ControlID:0006, Control Class:"BUTTON" Control Text:"/" 
     002 - ControlID:0007, Control Class:"BUTTON" Control Text:"&" 
     003 - ControlID:FFFF, Control Class:"STATIC" Control Text:"" 
     004 - ControlID:0534, Control Class:"STATIC" Control Text:"" 
Name: DialogID_0159, # of Controls=000, Caption:"", ClassName:""
Name: DialogID_015A, # of Controls=002, Caption:"n", ClassName:""
     001 - ControlID:0001, Control Class:"BUTTON" Control Text:"/" 
     002 - ControlID:0002, Control Class:"BUTTON" Control Text:"&" 
Name: DialogID_015B, # of Controls=000, Caption:"^", ClassName:""
Name: DialogID_015C, # of Controls=004, Caption:"H,ť", ClassName:""
     001 - ControlID:0002, Control Class:"BUTTON" Control Text:"n" 
     002 - ControlID:FFFF, Control Class:"STATIC" Control Text:"" 
     003 - ControlID:FFFF, Control Class:"STATIC" Control Text:"	     Ver. 1.0" 
     004 - ControlID:FFFF, Control Class:"STATIC" Control Text:"Copyright (C)  *> Ic 1998,1999" 

+++++++++++++++++++ IMPORTED FUNCTIONS ++++++++++++++++++
Number of Imported Modules =    0 (decimal)


+++++++++++++++++++ IMPORT MODULE DETAILS +++++++++++++++

+++++++++++++++++++ EXPORTED FUNCTIONS ++++++++++++++++++
Number of Exported Functions = 0000 (decimal)




+++++++++++++++++++ ASSEMBLY CODE LISTING ++++++++++++++++++
//********************** Start of Code in Object .text **************
Program Entry Point = 004817E0 (Ekd5.exe File Offset:001069E0)


:00401000 55                      push ebp
:00401001 8BEC                    mov ebp, esp
:00401003 83EC0C                  sub esp, 0000000C
:00401006 894DF4                  mov dword ptr [ebp-0C], ecx
:00401009 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040100C 83B89402000000          cmp dword ptr [eax+00000294], 00000000
:00401013 7407                    je 0040101C
:00401015 33C0                    xor eax, eax
:00401017 E9D0010000              jmp 004011EC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401013(C)
|
:0040101C 6A14                    push 00000014
:0040101E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00401021 51                      push ecx
:00401022 8B55F4                  mov edx, dword ptr [ebp-0C]
:00401025 52                      push edx
:00401026 E8C5F70700              call 004807F0
:0040102B 83C40C                  add esp, 0000000C
:0040102E 8B45F4                  mov eax, dword ptr [ebp-0C]
:00401031 C7809402000014000000    mov dword ptr [ebx+00000294], 00000014
:0040103B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040103E 83C114                  add ecx, 00000014
:00401041 894D08                  mov dword ptr [ebp+08], ecx
:00401044 C645F800                mov [ebp-08], 00
:00401048 EB09                    jmp 00401053

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401081(U)
|
:0040104A 8A55F8                  mov dl, byte ptr [ebp-08]
:0040104D 80C201                  add dl, 01
:00401050 8855F8                  mov byte ptr [ebp-08], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401048(U)
|
:00401053 8B45F8                  mov eax, dword ptr [ebp-08]
:00401056 25FF000000              and eax, 000000FF
:0040105B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040105E 33D2                    xor edx, edx
:00401060 8A11                    mov dl, byte ptr [ecx]
:00401062 3BC2                    cmp eax, edx
:00401064 7D1D                    jge 00401083
:00401066 8B45F8                  mov eax, dword ptr [ebp-08]
:00401069 25FF000000              and eax, 000000FF
:0040106E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00401071 8B5508                  mov edx, dword ptr [ebp+08]
:00401074 89548114                mov dword ptr [ecx+4*eax+14], edx
:00401078 8B4508                  mov eax, dword ptr [ebp+08]
:0040107B 83C014                  add eax, 00000014
:0040107E 894508                  mov dword ptr [ebp+08], eax
:00401081 EBC7                    jmp 0040104A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401064(C)
|
:00401083 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00401086 81E1FF000000            and ecx, 000000FF
:0040108C 6BC914                  imul ecx, 00000014
:0040108F 8B55F4                  mov edx, dword ptr [ebp-0C]
:00401092 8B8294020000            mov eax, dword ptr [edx+00000294]
:00401098 03C1                    add eax, ecx
:0040109A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040109D 898194020000            mov dword ptr [ecx+00000294], eax
:004010A3 8B55F4                  mov edx, dword ptr [ebp-0C]
:004010A6 8B45F4                  mov eax, dword ptr [ebp-0C]
:004010A9 8B4A08                  mov ecx, dword ptr [edx+08]
:004010AC 0FAF480C                imul ecx, dword ptr [eax+0C]
:004010B0 894DFC                  mov dword ptr [ebp-04], ecx
:004010B3 C645F800                mov [ebp-08], 00
:004010B7 EB09                    jmp 004010C2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004010F4(U)
|
:004010B9 8A55F8                  mov dl, byte ptr [ebp-08]
:004010BC 80C201                  add dl, 01
:004010BF 8855F8                  mov byte ptr [ebp-08], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004010B7(U)
|
:004010C2 8B45F8                  mov eax, dword ptr [ebp-08]
:004010C5 25FF000000              and eax, 000000FF
:004010CA 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004010CD 33D2                    xor edx, edx
:004010CF 8A5101                  mov dl, byte ptr [ecx+01]
:004010D2 3BC2                    cmp eax, edx
:004010D4 7D20                    jge 004010F6
:004010D6 8B45F8                  mov eax, dword ptr [ebp-08]
:004010D9 25FF000000              and eax, 000000FF
:004010DE 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004010E1 8B5508                  mov edx, dword ptr [ebp+08]
:004010E4 899481B4000000          mov dword ptr [ecx+4*eax+000000B4], edx
:004010EB 8B4508                  mov eax, dword ptr [ebp+08]
:004010EE 0345FC                  add eax, dword ptr [ebp-04]
:004010F1 894508                  mov dword ptr [ebp+08], eax
:004010F4 EBC3                    jmp 004010B9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004010D4(C)
|
:004010F6 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004010F9 81E1FF000000            and ecx, 000000FF
:004010FF 0FAF4DFC                imul ecx, dword ptr [ebp-04]
:00401103 8B55F4                  mov edx, dword ptr [ebp-0C]
:00401106 8B8294020000            mov eax, dword ptr [edx+00000294]
:0040110C 03C1                    add eax, ecx
:0040110E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00401111 898194020000            mov dword ptr [ecx+00000294], eax
:00401117 C645F800                mov [ebp-08], 00
:0040111B EB09                    jmp 00401126

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401158(U)
|
:0040111D 8A55F8                  mov dl, byte ptr [ebp-08]
:00401120 80C201                  add dl, 01
:00401123 8855F8                  mov byte ptr [ebp-08], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040111B(U)
|
:00401126 8B45F8                  mov eax, dword ptr [ebp-08]
:00401129 25FF000000              and eax, 000000FF
:0040112E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00401131 33D2                    xor edx, edx
:00401133 8A5102                  mov dl, byte ptr [ecx+02]
:00401136 3BC2                    cmp eax, edx
:00401138 7D20                    jge 0040115A
:0040113A 8B45F8                  mov eax, dword ptr [ebp-08]
:0040113D 25FF000000              and eax, 000000FF
:00401142 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00401145 8B5508                  mov edx, dword ptr [ebp+08]
:00401148 89948154010000          mov dword ptr [ecx+4*eax+00000154], edx
:0040114F 8B4508                  mov eax, dword ptr [ebp+08]
:00401152 0345FC                  add eax, dword ptr [ebp-04]
:00401155 894508                  mov dword ptr [ebp+08], eax
:00401158 EBC3                    jmp 0040111D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401138(C)
|
:0040115A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040115D 81E1FF000000            and ecx, 000000FF
:00401163 0FAF4DFC                imul ecx, dword ptr [ebp-04]
:00401167 8B55F4                  mov edx, dword ptr [ebp-0C]
:0040116A 8B8294020000            mov eax, dword ptr [edx+00000294]
:00401170 03C1                    add eax, ecx
:00401172 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00401175 898194020000            mov dword ptr [ecx+00000294], eax
:0040117B C645F800                mov [ebp-08], 00
:0040117F EB09                    jmp 0040118A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004011BE(U)
|
:00401181 8A55F8                  mov dl, byte ptr [ebp-08]
:00401184 80C201                  add dl, 01
:00401187 8855F8                  mov byte ptr [ebp-08], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040117F(U)
|
:0040118A 8B45F8                  mov eax, dword ptr [ebp-08]
:0040118D 25FF000000              and eax, 000000FF
:00401192 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00401195 33D2                    xor edx, edx
:00401197 8A5103                  mov dl, byte ptr [ecx+03]
:0040119A 3BC2                    cmp eax, edx
:0040119C 7D22                    jge 004011C0
:0040119E 8B45F8                  mov eax, dword ptr [ebp-08]
:004011A1 25FF000000              and eax, 000000FF
:004011A6 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004011A9 8B5508                  mov edx, dword ptr [ebp+08]
:004011AC 899481F4010000          mov dword ptr [ecx+4*eax+000001F4], edx
:004011B3 8B4508                  mov eax, dword ptr [ebp+08]
:004011B6 0500030000              add eax, 00000300
:004011BB 894508                  mov dword ptr [ebp+08], eax
:004011BE EBC1                    jmp 00401181

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040119C(C)
|
:004011C0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004011C3 81E1FF000000            and ecx, 000000FF
:004011C9 69C900030000            imul ecx, 00000300
:004011CF 8B55F4                  mov edx, dword ptr [ebp-0C]
:004011D2 8B8294020000            mov eax, dword ptr [edx+00000294]
:004011D8 03C1                    add eax, ecx
:004011DA 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004011DD 898194020000            mov dword ptr [ecx+00000294], eax
:004011E3 8B55F4                  mov edx, dword ptr [ebp-0C]
:004011E6 8B8294020000            mov eax, dword ptr [edx+00000294]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401017(U)
|
:004011EC 8BE5                    mov esp, ebp
:004011EE 5D                      pop ebp
:004011EF C20400                  ret 0004



* Referenced by a CALL at Address:
|:004016B7   
|
:004011F2 55                      push ebp
:004011F3 8BEC                    mov ebp, esp
:004011F5 83EC08                  sub esp, 00000008
:004011F8 894DF8                  mov dword ptr [ebp-08], ecx
:004011FB 8B45F8                  mov eax, dword ptr [ebp-08]
:004011FE 8B8894020000            mov ecx, dword ptr [eax+00000294]
:00401204 894DFC                  mov dword ptr [ebp-04], ecx
:00401207 68A0000000              push 000000A0
:0040120C 6A00                    push 00000000
:0040120E 8B55F8                  mov edx, dword ptr [ebp-08]
:00401211 81C2B4000000            add edx, 000000B4
:00401217 52                      push edx
:00401218 E813F90700              call 00480B30
:0040121D 83C40C                  add esp, 0000000C
:00401220 68A0000000              push 000000A0
:00401225 6A00                    push 00000000
:00401227 8B45F8                  mov eax, dword ptr [ebp-08]
:0040122A 0554010000              add eax, 00000154
:0040122F 50                      push eax
:00401230 E8FBF80700              call 00480B30
:00401235 83C40C                  add esp, 0000000C
:00401238 68A0000000              push 000000A0
:0040123D 6A00                    push 00000000
:0040123F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00401242 81C1F4010000            add ecx, 000001F4
:00401248 51                      push ecx
:00401249 E8E2F80700              call 00480B30
:0040124E 83C40C                  add esp, 0000000C
:00401251 8B55F8                  mov edx, dword ptr [ebp-08]
:00401254 C7829402000000000000    mov dword ptr [ebx+00000294], 00000000
:0040125E 8B45FC                  mov eax, dword ptr [ebp-04]
:00401261 8BE5                    mov esp, ebp
:00401263 5D                      pop ebp
:00401264 C3                      ret



* Referenced by a CALL at Address:
|:00403181   
|
:00401265 55                      push ebp
:00401266 8BEC                    mov ebp, esp
:00401268 51                      push ecx
:00401269 894DFC                  mov dword ptr [ebp-04], ecx
:0040126C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040126F E83C210000              call 004033B0
:00401274 8B45FC                  mov eax, dword ptr [ebp-04]
:00401277 C7809802000000000000    mov dword ptr [ebx+00000298], 00000000
:00401281 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00401284 C7819C02000000000000    mov dword ptr [ebx+0000029C], 00000000
:0040128E 8B55FC                  mov edx, dword ptr [ebp-04]
:00401291 C782A002000000000000    mov dword ptr [ebx+000002A0], 00000000
:0040129B 8B45FC                  mov eax, dword ptr [ebp-04]
:0040129E C680A402000000          mov byte ptr [eax+000002A4], 00
:004012A5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004012A8 C6811903000000          mov byte ptr [ecx+00000319], 00
:004012AF 68A0030000              push 000003A0
:004012B4 6A00                    push 00000000
:004012B6 8B55FC                  mov edx, dword ptr [ebp-04]
:004012B9 81C21C030000            add edx, 0000031C
:004012BF 52                      push edx
:004012C0 E86BF80700              call 00480B30
:004012C5 83C40C                  add esp, 0000000C
:004012C8 68A0030000              push 000003A0
:004012CD 6A00                    push 00000000
:004012CF 8B45FC                  mov eax, dword ptr [ebp-04]
:004012D2 05BC060000              add eax, 000006BC
:004012D7 50                      push eax
:004012D8 E853F80700              call 00480B30
:004012DD 83C40C                  add esp, 0000000C
:004012E0 68D0010000              push 000001D0
:004012E5 6A00                    push 00000000
:004012E7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004012EA 81C15C0A0000            add ecx, 00000A5C
:004012F0 51                      push ecx
:004012F1 E83AF80700              call 00480B30
:004012F6 83C40C                  add esp, 0000000C
:004012F9 68D0010000              push 000001D0
:004012FE 6A00                    push 00000000
:00401300 8B55FC                  mov edx, dword ptr [ebp-04]
:00401303 81C22C0C0000            add edx, 00000C2C
:00401309 52                      push edx
:0040130A E821F80700              call 00480B30
:0040130F 83C40C                  add esp, 0000000C
:00401312 68D4010000              push 000001D4
:00401317 6A00                    push 00000000
:00401319 8B45FC                  mov eax, dword ptr [ebp-04]
:0040131C 05FC0D0000              add eax, 00000DFC
:00401321 50                      push eax
:00401322 E809F80700              call 00480B30
:00401327 83C40C                  add esp, 0000000C
:0040132A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040132D C781D00F000000000000    mov dword ptr [ebx+00000FD0], 00000000
:00401337 8B45FC                  mov eax, dword ptr [ebp-04]
:0040133A 8BE5                    mov esp, ebp
:0040133C 5D                      pop ebp
:0040133D C3                      ret



* Referenced by a CALL at Address:
|:004031A2   
|
:0040133E 55                      push ebp
:0040133F 8BEC                    mov ebp, esp
:00401341 6AFF                    push FFFFFFFF
:00401343 68E94E4800              push 00484EE9
:00401348 64A100000000            mov eax, dword ptr fs:[00000000]
:0040134E 50                      push eax
:0040134F 64892500000000          mov dword ptr fs:[00000000], esp
:00401356 51                      push ecx
:00401357 894DF0                  mov dword ptr [ebp-10], ecx
:0040135A C745FC00000000          mov [ebp-04], 00000000
:00401361 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00401364 E842030000              call 004016AB
:00401369 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00401370 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00401373 E898A10200              call 0042B510
:00401378 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040137B 64890D00000000          mov dword ptr fs:[00000000], ecx
:00401382 8BE5                    mov esp, ebp
:00401384 5D                      pop ebp
:00401385 C3                      ret



* Referenced by a CALL at Address:
|:00401B6C   
|
:00401386 55                      push ebp
:00401387 8BEC                    mov ebp, esp
:00401389 83EC08                  sub esp, 00000008
:0040138C 894DF8                  mov dword ptr [ebp-08], ecx
:0040138F 8B45F8                  mov eax, dword ptr [ebp-08]
:00401392 33C9                    xor ecx, ecx
:00401394 8A8819030000            mov cl, byte ptr [eax+00000319]
:0040139A 83F975                  cmp ecx, 00000075
:0040139D 7D7E                    jge 0040141D
:0040139F 6A00                    push 00000000
:004013A1 E84AFC0700              call 00480FF0
:004013A6 83C404                  add esp, 00000004
:004013A9 8945FC                  mov dword ptr [ebp-04], eax
:004013AC 8B5508                  mov edx, dword ptr [ebp+08]
:004013AF 52                      push edx
:004013B0 E82BFC0700              call 00480FE0
:004013B5 83C404                  add esp, 00000004
:004013B8 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004013BB 33D2                    xor edx, edx
:004013BD 8A9119030000            mov dl, byte ptr [ecx+00000319]
:004013C3 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004013C6 898491FC0D0000          mov dword ptr [ecx+4*edx+00000DFC], eax
:004013CD 8B55FC                  mov edx, dword ptr [ebp-04]
:004013D0 52                      push edx
:004013D1 E81AFC0700              call 00480FF0
:004013D6 83C404                  add esp, 00000004
:004013D9 8B45F8                  mov eax, dword ptr [ebp-08]
:004013DC 33C9                    xor ecx, ecx
:004013DE 8A8819030000            mov cl, byte ptr [eax+00000319]
:004013E4 8B55F8                  mov edx, dword ptr [ebp-08]
:004013E7 83BC8AFC0D000000        cmp dword ptr [edx+4*ecx+00000DFC], 00000000
:004013EF 742C                    je 0040141D
:004013F1 8B45F8                  mov eax, dword ptr [ebp-08]
:004013F4 33C9                    xor ecx, ecx
:004013F6 8A8819030000            mov cl, byte ptr [eax+00000319]
:004013FC 8B55F8                  mov edx, dword ptr [ebp-08]
:004013FF 8B848AFC0D0000          mov eax, dword ptr [edx+4*ecx+00000DFC]
:00401406 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00401409 8A9119030000            mov dl, byte ptr [ecx+00000319]
:0040140F 80C201                  add dl, 01
:00401412 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00401415 889119030000            mov byte ptr [ecx+00000319], dl
:0040141B EB02                    jmp 0040141F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040139D(C), :004013EF(C)
|
:0040141D 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040141B(U)
|
:0040141F 8BE5                    mov esp, ebp
:00401421 5D                      pop ebp
:00401422 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0040179A   
|
:00401425 55                      push ebp
:00401426 8BEC                    mov ebp, esp
:00401428 83EC0C                  sub esp, 0000000C
:0040142B 56                      push esi
:0040142C 894DF4                  mov dword ptr [ebp-0C], ecx
:0040142F 837D0800                cmp dword ptr [ebp+08], 00000000
:00401433 0F84B6000000            je 004014EF
:00401439 C645FC00                mov [ebp-04], 00
:0040143D EB08                    jmp 00401447

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004014EA(U)
|
:0040143F 8A45FC                  mov al, byte ptr [ebp-04]
:00401442 0401                    add al, 01
:00401444 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040143D(U)
|
:00401447 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040144A 81E1FF000000            and ecx, 000000FF
:00401450 8B55F4                  mov edx, dword ptr [ebp-0C]
:00401453 33C0                    xor eax, eax
:00401455 8A8219030000            mov al, byte ptr [edx+00000319]
:0040145B 3BC8                    cmp ecx, eax
:0040145D 0F8D8C000000            jnl 004014EF
:00401463 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00401466 81E1FF000000            and ecx, 000000FF
:0040146C 8B55F4                  mov edx, dword ptr [ebp-0C]
:0040146F 8B4508                  mov eax, dword ptr [ebp+08]
:00401472 3B848AFC0D0000          cmp eax, dword ptr [edx+4*ecx+00000DFC]
:00401479 756F                    jne 004014EA
:0040147B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040147E 894DF8                  mov dword ptr [ebp-08], ecx
:00401481 8B55F8                  mov edx, dword ptr [ebp-08]
:00401484 52                      push edx
:00401485 E896FB0700              call 00481020
:0040148A 83C404                  add esp, 00000004
:0040148D 8B45F4                  mov eax, dword ptr [ebp-0C]
:00401490 8A8819030000            mov cl, byte ptr [eax+00000319]
:00401496 80E901                  sub cl, 01
:00401499 8B55F4                  mov edx, dword ptr [ebp-0C]
:0040149C 888A19030000            mov byte ptr [edx+00000319], cl
:004014A2 8B45F4                  mov eax, dword ptr [ebp-0C]
:004014A5 33C9                    xor ecx, ecx
:004014A7 8A8819030000            mov cl, byte ptr [eax+00000319]
:004014AD 8B55FC                  mov edx, dword ptr [ebp-04]
:004014B0 81E2FF000000            and edx, 000000FF
:004014B6 8B45F4                  mov eax, dword ptr [ebp-0C]
:004014B9 8B75F4                  mov esi, dword ptr [ebp-0C]
:004014BC 8B8C8EFC0D0000          mov ecx, dword ptr [esi+4*ecx+00000DFC]
:004014C3 898C90FC0D0000          mov dword ptr [eax+4*edx+00000DFC], ecx
:004014CA 8B55F4                  mov edx, dword ptr [ebp-0C]
:004014CD 33C0                    xor eax, eax
:004014CF 8A8219030000            mov al, byte ptr [edx+00000319]
:004014D5 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004014D8 C78481FC0D000000000000  mov dword ptr [ecx+4*eax+00000DFC], 00000000
:004014E3 B801000000              mov eax, 00000001
:004014E8 EB07                    jmp 004014F1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401479(C)
|
:004014EA E950FFFFFF              jmp 0040143F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00401433(C), :0040145D(C)
|
:004014EF 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004014E8(U)
|
:004014F1 5E                      pop esi
:004014F2 8BE5                    mov esp, ebp
:004014F4 5D                      pop ebp
:004014F5 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00414218   , :0041CC7B   , :004216BC   , :00421DAD   , :004229EA   
|:00423C59   , :0043EAB0   , :0044A12A   
|
:004014F8 55                      push ebp
:004014F9 8BEC                    mov ebp, esp
:004014FB 6AFF                    push FFFFFFFF
:004014FD 68FF4E4800              push 00484EFF
:00401502 64A100000000            mov eax, dword ptr fs:[00000000]
:00401508 50                      push eax
:00401509 64892500000000          mov dword ptr fs:[00000000], esp
:00401510 81EC14010000            sub esp, 00000114
:00401516 898DE0FEFFFF            mov dword ptr [ebp+FFFFFEE0], ecx
:0040151C 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:00401522 E884010000              call 004016AB
:00401527 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:0040152D 8B4D10                  mov ecx, dword ptr [ebp+10]
:00401530 898898020000            mov dword ptr [eax+00000298], ecx
:00401536 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:0040153C 8B4514                  mov eax, dword ptr [ebp+14]
:0040153F 89829C020000            mov dword ptr [edx+0000029C], eax
:00401545 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0040154B E8601D0000              call 004032B0
:00401550 C745FC00000000          mov [ebp-04], 00000000
:00401557 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040155A 51                      push ecx
:0040155B 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:00401561 E8CFE50100              call 0041FB35
:00401566 85C0                    test eax, eax
:00401568 0F840B010000            je 00401679
:0040156E 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:00401574 8B8298020000            mov eax, dword ptr [edx+00000298]
:0040157A 50                      push eax
:0040157B 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0040157E 81E1FF000000            and ecx, 000000FF
:00401584 51                      push ecx
:00401585 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0040158B E8F9E60100              call 0041FC89
:00401590 8985ECFEFFFF            mov dword ptr [ebp+FFFFFEEC], eax
:00401596 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:0040159C 8B82A0020000            mov eax, dword ptr [edx+000002A0]
:004015A2 0385ECFEFFFF            add eax, dword ptr [ebp+FFFFFEEC]
:004015A8 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:004015AE 8981A0020000            mov dword ptr [ecx+000002A0], eax
:004015B4 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:004015BA E8067D0100              call 004192C5
:004015BF 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:004015C5 8B8298020000            mov eax, dword ptr [edx+00000298]
:004015CB 50                      push eax
:004015CC 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:004015D2 E829FAFFFF              call 00401000
:004015D7 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:004015DD 8B4104                  mov eax, dword ptr [ecx+04]
:004015E0 33D2                    xor edx, edx
:004015E2 B932000000              mov ecx, 00000032
:004015E7 F7F1                    div ecx
:004015E9 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:004015EF 894204                  mov dword ptr [edx+04], eax
:004015F2 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:004015F8 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:004015FE 8B5008                  mov edx, dword ptr [eax+08]
:00401601 0FAF510C                imul edx, dword ptr [ecx+0C]
:00401605 8995ECFEFFFF            mov dword ptr [ebp+FFFFFEEC], edx
:0040160B 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:00401611 8B8898020000            mov ecx, dword ptr [eax+00000298]
:00401617 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:0040161D 038AA0020000            add ecx, dword ptr [edx+000002A0]
:00401623 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:00401629 8988D00F0000            mov dword ptr [eax+00000FD0], ecx
:0040162F 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:00401635 8B91A0020000            mov edx, dword ptr [ecx+000002A0]
:0040163B 0395ECFEFFFF            add edx, dword ptr [ebp+FFFFFEEC]
:00401641 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:00401647 8990A0020000            mov dword ptr [eax+000002A0], edx
:0040164D 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:00401653 8B91A0020000            mov edx, dword ptr [ecx+000002A0]
:00401659 8995E8FEFFFF            mov dword ptr [ebp+FFFFFEE8], edx
:0040165F C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00401666 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0040166C E85F1C0000              call 004032D0
:00401671 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:00401677 EB22                    jmp 0040169B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401568(C)
|
:00401679 C785E4FEFFFF00000000    mov dword ptr [ebp+FFFFFEE4], 00000000
:00401683 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0040168A 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:00401690 E83B1C0000              call 004032D0
:00401695 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401677(U)
|
:0040169B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040169E 64890D00000000          mov dword ptr fs:[00000000], ecx
:004016A5 8BE5                    mov esp, ebp
:004016A7 5D                      pop ebp
:004016A8 C21000                  ret 0010



* Referenced by a CALL at Addresses:
|:00401364   , :00401522   , :00402019   , :00414249   , :0041CCAB   
|:004216F2   , :00421E62   , :00422A20   , :00423C86   , :0043EADA   
|:0044A189   
|
:004016AB 55                      push ebp
:004016AC 8BEC                    mov ebp, esp
:004016AE 83EC08                  sub esp, 00000008
:004016B1 894DF8                  mov dword ptr [ebp-08], ecx
:004016B4 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004016B7 E836FBFFFF              call 004011F2
:004016BC 8B45F8                  mov eax, dword ptr [ebp-08]
:004016BF C7809802000000000000    mov dword ptr [ebx+00000298], 00000000
:004016C9 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004016CC C7819C02000000000000    mov dword ptr [ebx+0000029C], 00000000
:004016D6 8B55F8                  mov edx, dword ptr [ebp-08]
:004016D9 C782A002000000000000    mov dword ptr [ebx+000002A0], 00000000
:004016E3 8B45F8                  mov eax, dword ptr [ebp-08]
:004016E6 C680A402000000          mov byte ptr [eax+000002A4], 00
:004016ED 68A0030000              push 000003A0
:004016F2 6A00                    push 00000000
:004016F4 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004016F7 81C11C030000            add ecx, 0000031C
:004016FD 51                      push ecx
:004016FE E82DF40700              call 00480B30
:00401703 83C40C                  add esp, 0000000C
:00401706 68A0030000              push 000003A0
:0040170B 6A00                    push 00000000
:0040170D 8B55F8                  mov edx, dword ptr [ebp-08]
:00401710 81C2BC060000            add edx, 000006BC
:00401716 52                      push edx
:00401717 E814F40700              call 00480B30
:0040171C 83C40C                  add esp, 0000000C
:0040171F 68D0010000              push 000001D0
:00401724 6A00                    push 00000000
:00401726 8B45F8                  mov eax, dword ptr [ebp-08]
:00401729 055C0A0000              add eax, 00000A5C
:0040172E 50                      push eax
:0040172F E8FCF30700              call 00480B30
:00401734 83C40C                  add esp, 0000000C
:00401737 68D0010000              push 000001D0
:0040173C 6A00                    push 00000000
:0040173E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00401741 81C12C0C0000            add ecx, 00000C2C
:00401747 51                      push ecx
:00401748 E8E3F30700              call 00480B30
:0040174D 83C40C                  add esp, 0000000C
:00401750 8B55F8                  mov edx, dword ptr [ebp-08]
:00401753 C782D00F000000000000    mov dword ptr [ebx+00000FD0], 00000000
:0040175D C645FC00                mov [ebp-04], 00
:00401761 EB08                    jmp 0040176B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040179F(U)
|
:00401763 8A45FC                  mov al, byte ptr [ebp-04]
:00401766 0401                    add al, 01
:00401768 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401761(U)
|
:0040176B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040176E 81E1FF000000            and ecx, 000000FF
:00401774 8B55F8                  mov edx, dword ptr [ebp-08]
:00401777 33C0                    xor eax, eax
:00401779 8A8219030000            mov al, byte ptr [edx+00000319]
:0040177F 3BC8                    cmp ecx, eax
:00401781 7D1E                    jge 004017A1
:00401783 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00401786 81E1FF000000            and ecx, 000000FF
:0040178C 8B55F8                  mov edx, dword ptr [ebp-08]
:0040178F 8B848AFC0D0000          mov eax, dword ptr [edx+4*ecx+00000DFC]
:00401796 50                      push eax
:00401797 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040179A E886FCFFFF              call 00401425
:0040179F EBC2                    jmp 00401763

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401781(C)
|
:004017A1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004017A4 C6811903000000          mov byte ptr [ecx+00000319], 00
:004017AB 8BE5                    mov esp, ebp
:004017AD 5D                      pop ebp
:004017AE C3                      ret



* Referenced by a CALL at Address:
|:00401E95   
|
:004017AF 55                      push ebp
:004017B0 8BEC                    mov ebp, esp
:004017B2 83EC14                  sub esp, 00000014
:004017B5 56                      push esi
:004017B6 894DEC                  mov dword ptr [ebp-14], ecx
:004017B9 C745F401000000          mov [ebp-0C], 00000001
:004017C0 EB09                    jmp 004017CB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004018B3(U)
|
:004017C2 8B45F4                  mov eax, dword ptr [ebp-0C]
:004017C5 83C001                  add eax, 00000001
:004017C8 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004017C0(U)
|
:004017CB 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004017CE 33D2                    xor edx, edx
:004017D0 8A91A4020000            mov dl, byte ptr [ecx+000002A4]
:004017D6 3955F4                  cmp dword ptr [ebp-0C], edx
:004017D9 0F8DD9000000            jnl 004018B8
:004017DF 8B45F4                  mov eax, dword ptr [ebp-0C]
:004017E2 8945F0                  mov dword ptr [ebp-10], eax
:004017E5 EB09                    jmp 004017F0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004018AE(U)
|
:004017E7 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004017EA 83E901                  sub ecx, 00000001
:004017ED 894DF0                  mov dword ptr [ebp-10], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004017E5(U)
|
:004017F0 837DF000                cmp dword ptr [ebp-10], 00000000
:004017F4 0F8EB9000000            jle 004018B3
:004017FA 8B55F0                  mov edx, dword ptr [ebp-10]
:004017FD 8B45EC                  mov eax, dword ptr [ebp-14]
:00401800 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00401803 8B75EC                  mov esi, dword ptr [ebp-14]
:00401806 8B94D020030000          mov edx, dword ptr [eax+8*edx+00000320]
:0040180D 3B94CE18030000          cmp edx, dword ptr [esi+8*ecx+00000318]
:00401814 7C38                    jl 0040184E
:00401816 8B45F0                  mov eax, dword ptr [ebp-10]
:00401819 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040181C 8B55F0                  mov edx, dword ptr [ebp-10]
:0040181F 8B75EC                  mov esi, dword ptr [ebp-14]
:00401822 8B84C120030000          mov eax, dword ptr [ecx+8*eax+00000320]
:00401829 3B84D618030000          cmp eax, dword ptr [esi+8*edx+00000318]
:00401830 757A                    jne 004018AC
:00401832 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00401835 8B55EC                  mov edx, dword ptr [ebp-14]
:00401838 8B45F0                  mov eax, dword ptr [ebp-10]
:0040183B 8B75EC                  mov esi, dword ptr [ebp-14]
:0040183E 8B8CCA1C030000          mov ecx, dword ptr [edx+8*ecx+0000031C]
:00401845 3B8CC614030000          cmp ecx, dword ptr [esi+8*eax+00000314]
:0040184C 7D5E                    jge 004018AC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401814(C)
|
:0040184E 8B55F0                  mov edx, dword ptr [ebp-10]
:00401851 8B45EC                  mov eax, dword ptr [ebp-14]
:00401854 8B8CD014030000          mov ecx, dword ptr [eax+8*edx+00000314]
:0040185B 8B94D018030000          mov edx, dword ptr [eax+8*edx+00000318]
:00401862 894DF8                  mov dword ptr [ebp-08], ecx
:00401865 8955FC                  mov dword ptr [ebp-04], edx
:00401868 8B45F0                  mov eax, dword ptr [ebp-10]
:0040186B 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040186E 8B94C11C030000          mov edx, dword ptr [ecx+8*eax+0000031C]
:00401875 8B84C120030000          mov eax, dword ptr [ecx+8*eax+00000320]
:0040187C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040187F 8B75EC                  mov esi, dword ptr [ebp-14]
:00401882 8994CE14030000          mov dword ptr [esi+8*ecx+00000314], edx
:00401889 8984CE18030000          mov dword ptr [esi+8*ecx+00000318], eax
:00401890 8B55F0                  mov edx, dword ptr [ebp-10]
:00401893 8B45EC                  mov eax, dword ptr [ebp-14]
:00401896 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00401899 898CD01C030000          mov dword ptr [eax+8*edx+0000031C], ecx
:004018A0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004018A3 898CD020030000          mov dword ptr [eax+8*edx+00000320], ecx
:004018AA EB02                    jmp 004018AE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00401830(C), :0040184C(C)
|
:004018AC EB05                    jmp 004018B3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004018AA(U)
|
:004018AE E934FFFFFF              jmp 004017E7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004017F4(C), :004018AC(U)
|
:004018B3 E90AFFFFFF              jmp 004017C2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004017D9(C)
|
:004018B8 5E                      pop esi
:004018B9 8BE5                    mov esp, ebp
:004018BB 5D                      pop ebp
:004018BC C3                      ret



* Referenced by a CALL at Address:
|:00401E9D   
|
:004018BD 55                      push ebp
:004018BE 8BEC                    mov ebp, esp
:004018C0 83EC14                  sub esp, 00000014
:004018C3 894DEC                  mov dword ptr [ebp-14], ecx
:004018C6 8B45EC                  mov eax, dword ptr [ebp-14]
:004018C9 8B4808                  mov ecx, dword ptr [eax+08]
:004018CC 894DFC                  mov dword ptr [ebp-04], ecx
:004018CF 8B55EC                  mov edx, dword ptr [ebp-14]
:004018D2 8B420C                  mov eax, dword ptr [edx+0C]
:004018D5 8945F8                  mov dword ptr [ebp-08], eax
:004018D8 C745F400000000          mov [ebp-0C], 00000000
:004018DF EB09                    jmp 004018EA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040199B(U)
|
:004018E1 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004018E4 83C101                  add ecx, 00000001
:004018E7 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004018DF(U)
|
:004018EA 8B55EC                  mov edx, dword ptr [ebp-14]
:004018ED 33C0                    xor eax, eax
:004018EF 8A82A4020000            mov al, byte ptr [edx+000002A4]
:004018F5 3945F4                  cmp dword ptr [ebp-0C], eax
:004018F8 0F8DA2000000            jnl 004019A0
:004018FE 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00401901 8B55EC                  mov edx, dword ptr [ebp-14]
:00401904 C7848A5C0A000000000000  mov dword ptr [edx+4*ecx+00000A5C], 00000000
:0040190F 8B45F4                  mov eax, dword ptr [ebp-0C]
:00401912 8945F0                  mov dword ptr [ebp-10], eax
:00401915 EB09                    jmp 00401920

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401996(U)
|
:00401917 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040191A 83E901                  sub ecx, 00000001
:0040191D 894DF0                  mov dword ptr [ebp-10], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401915(U)
|
:00401920 837DF000                cmp dword ptr [ebp-10], 00000000
:00401924 7C75                    jl 0040199B
:00401926 8B55F0                  mov edx, dword ptr [ebp-10]
:00401929 8B45EC                  mov eax, dword ptr [ebp-14]
:0040192C 8B8CD020030000          mov ecx, dword ptr [eax+8*edx+00000320]
:00401933 034DF8                  add ecx, dword ptr [ebp-08]
:00401936 8B55F4                  mov edx, dword ptr [ebp-0C]
:00401939 8B45EC                  mov eax, dword ptr [ebp-14]
:0040193C 398CD020030000          cmp dword ptr [eax+8*edx+00000320], ecx
:00401943 7D51                    jge 00401996
:00401945 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00401948 8B55EC                  mov edx, dword ptr [ebp-14]
:0040194B 8B84CA1C030000          mov eax, dword ptr [edx+8*ecx+0000031C]
:00401952 0345FC                  add eax, dword ptr [ebp-04]
:00401955 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00401958 8B55EC                  mov edx, dword ptr [ebp-14]
:0040195B 3984CA1C030000          cmp dword ptr [edx+8*ecx+0000031C], eax
:00401962 7D32                    jge 00401996
:00401964 8B45F4                  mov eax, dword ptr [ebp-0C]
:00401967 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040196A 8B94C11C030000          mov edx, dword ptr [ecx+8*eax+0000031C]
:00401971 0355FC                  add edx, dword ptr [ebp-04]
:00401974 8B45F0                  mov eax, dword ptr [ebp-10]
:00401977 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040197A 3994C11C030000          cmp dword ptr [ecx+8*eax+0000031C], edx
:00401981 7D13                    jge 00401996
:00401983 8B55F4                  mov edx, dword ptr [ebp-0C]
:00401986 8B45EC                  mov eax, dword ptr [ebp-14]
:00401989 C784905C0A000001000000  mov dword ptr [eax+4*edx+00000A5C], 00000001
:00401994 EB05                    jmp 0040199B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00401943(C), :00401962(C), :00401981(C)
|
:00401996 E97CFFFFFF              jmp 00401917

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00401924(C), :00401994(U)
|
:0040199B E941FFFFFF              jmp 004018E1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004018F8(C)
|
:004019A0 8BE5                    mov esp, ebp
:004019A2 5D                      pop ebp
:004019A3 C3                      ret



* Referenced by a CALL at Addresses:
|:00401E30   , :00414228   , :0044A15D   
|
:004019A4 55                      push ebp
:004019A5 8BEC                    mov ebp, esp
:004019A7 83EC14                  sub esp, 00000014
:004019AA 894DEC                  mov dword ptr [ebp-14], ecx
:004019AD 8B45EC                  mov eax, dword ptr [ebp-14]
:004019B0 33C9                    xor ecx, ecx
:004019B2 8A88A4020000            mov cl, byte ptr [eax+000002A4]
:004019B8 8B5508                  mov edx, dword ptr [ebp+08]
:004019BB 81E2FF000000            and edx, 000000FF
:004019C1 03CA                    add ecx, edx
:004019C3 83F974                  cmp ecx, 00000074
:004019C6 7615                    jbe 004019DD
:004019C8 8B45EC                  mov eax, dword ptr [ebp-14]
:004019CB 33C9                    xor ecx, ecx
:004019CD 8A88A4020000            mov cl, byte ptr [eax+000002A4]
:004019D3 BA74000000              mov edx, 00000074
:004019D8 2BD1                    sub edx, ecx
:004019DA 885508                  mov byte ptr [ebp+08], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004019C6(C)
|
:004019DD 8B45EC                  mov eax, dword ptr [ebp-14]
:004019E0 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004019E3 8B5008                  mov edx, dword ptr [eax+08]
:004019E6 0FAF510C                imul edx, dword ptr [ecx+0C]
:004019EA 8955FC                  mov dword ptr [ebp-04], edx
:004019ED 8B45EC                  mov eax, dword ptr [ebp-14]
:004019F0 8B4008                  mov eax, dword ptr [eax+08]
:004019F3 99                      cdq
:004019F4 2BC2                    sub eax, edx
:004019F6 D1F8                    sar eax, 1
:004019F8 8945F8                  mov dword ptr [ebp-08], eax
:004019FB 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004019FE 8B410C                  mov eax, dword ptr [ecx+0C]
:00401A01 99                      cdq
:00401A02 2BC2                    sub eax, edx
:00401A04 D1F8                    sar eax, 1
:00401A06 8945F4                  mov dword ptr [ebp-0C], eax
:00401A09 C645F000                mov [ebp-10], 00
:00401A0D EB1E                    jmp 00401A2D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401B3C(U)
|
:00401A0F 8A55F0                  mov dl, byte ptr [ebp-10]
:00401A12 80C201                  add dl, 01
:00401A15 8855F0                  mov byte ptr [ebp-10], dl
:00401A18 8B45EC                  mov eax, dword ptr [ebp-14]
:00401A1B 8B88A0020000            mov ecx, dword ptr [eax+000002A0]
:00401A21 034DFC                  add ecx, dword ptr [ebp-04]
:00401A24 8B55EC                  mov edx, dword ptr [ebp-14]
:00401A27 898AA0020000            mov dword ptr [edx+000002A0], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401A0D(U)
|
:00401A2D 8B45F0                  mov eax, dword ptr [ebp-10]
:00401A30 25FF000000              and eax, 000000FF
:00401A35 8B4D08                  mov ecx, dword ptr [ebp+08]
:00401A38 81E1FF000000            and ecx, 000000FF
:00401A3E 3BC1                    cmp eax, ecx
:00401A40 0F8DFB000000            jnl 00401B41
:00401A46 8B55EC                  mov edx, dword ptr [ebp-14]
:00401A49 8B82A0020000            mov eax, dword ptr [edx+000002A0]
:00401A4F 0345FC                  add eax, dword ptr [ebp-04]
:00401A52 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00401A55 3B819C020000            cmp eax, dword ptr [ecx+0000029C]
:00401A5B 0F8DE0000000            jnl 00401B41
:00401A61 8B55F0                  mov edx, dword ptr [ebp-10]
:00401A64 81E2FF000000            and edx, 000000FF
:00401A6A 8B450C                  mov eax, dword ptr [ebp+0C]
:00401A6D 8B0CD0                  mov ecx, dword ptr [eax+8*edx]
:00401A70 2B4DF8                  sub ecx, dword ptr [ebp-08]
:00401A73 8B55EC                  mov edx, dword ptr [ebp-14]
:00401A76 33C0                    xor eax, eax
:00401A78 8A82A4020000            mov al, byte ptr [edx+000002A4]
:00401A7E 8B55F0                  mov edx, dword ptr [ebp-10]
:00401A81 81E2FF000000            and edx, 000000FF
:00401A87 03C2                    add eax, edx
:00401A89 8B55EC                  mov edx, dword ptr [ebp-14]
:00401A8C 898CC21C030000          mov dword ptr [edx+8*eax+0000031C], ecx
:00401A93 8B45F0                  mov eax, dword ptr [ebp-10]
:00401A96 25FF000000              and eax, 000000FF
:00401A9B 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00401A9E 8B54C104                mov edx, dword ptr [ecx+8*eax+04]
:00401AA2 2B55F4                  sub edx, dword ptr [ebp-0C]
:00401AA5 8B45EC                  mov eax, dword ptr [ebp-14]
:00401AA8 33C9                    xor ecx, ecx
:00401AAA 8A88A4020000            mov cl, byte ptr [eax+000002A4]
:00401AB0 8B45F0                  mov eax, dword ptr [ebp-10]
:00401AB3 25FF000000              and eax, 000000FF
:00401AB8 03C8                    add ecx, eax
:00401ABA 8B45EC                  mov eax, dword ptr [ebp-14]
:00401ABD 8994C820030000          mov dword ptr [eax+8*ecx+00000320], edx
:00401AC4 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00401AC7 33D2                    xor edx, edx
:00401AC9 8A91A4020000            mov dl, byte ptr [ecx+000002A4]
:00401ACF 8B45F0                  mov eax, dword ptr [ebp-10]
:00401AD2 25FF000000              and eax, 000000FF
:00401AD7 03D0                    add edx, eax
:00401AD9 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00401ADC C784D1C006000018FCFFFF  mov dword ptr [ecx+8*edx+000006C0], FFFFFC18
:00401AE7 8B55EC                  mov edx, dword ptr [ebp-14]
:00401AEA 33C0                    xor eax, eax
:00401AEC 8A82A4020000            mov al, byte ptr [edx+000002A4]
:00401AF2 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00401AF5 81E1FF000000            and ecx, 000000FF
:00401AFB 03C1                    add eax, ecx
:00401AFD 8B55EC                  mov edx, dword ptr [ebp-14]
:00401B00 C784C2BC06000018FCFFFF  mov dword ptr [edx+8*eax+000006BC], FFFFFC18
:00401B0B 8B45EC                  mov eax, dword ptr [ebp-14]
:00401B0E 8B8898020000            mov ecx, dword ptr [eax+00000298]
:00401B14 8B55EC                  mov edx, dword ptr [ebp-14]
:00401B17 038AA0020000            add ecx, dword ptr [edx+000002A0]
:00401B1D 8B45EC                  mov eax, dword ptr [ebp-14]
:00401B20 33D2                    xor edx, edx
:00401B22 8A90A4020000            mov dl, byte ptr [eax+000002A4]
:00401B28 8B45F0                  mov eax, dword ptr [ebp-10]
:00401B2B 25FF000000              and eax, 000000FF
:00401B30 03D0                    add edx, eax
:00401B32 8B45EC                  mov eax, dword ptr [ebp-14]
:00401B35 898C902C0C0000          mov dword ptr [eax+4*edx+00000C2C], ecx
:00401B3C E9CEFEFFFF              jmp 00401A0F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00401A40(C), :00401A5B(C)
|
:00401B41 EB09                    jmp 00401B4C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401C65(U)
|
:00401B43 8A4DF0                  mov cl, byte ptr [ebp-10]
:00401B46 80C101                  add cl, 01
:00401B49 884DF0                  mov byte ptr [ebp-10], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401B41(U)
|
:00401B4C 8B55F0                  mov edx, dword ptr [ebp-10]
:00401B4F 81E2FF000000            and edx, 000000FF
:00401B55 8B4508                  mov eax, dword ptr [ebp+08]
:00401B58 25FF000000              and eax, 000000FF
:00401B5D 3BD0                    cmp edx, eax
:00401B5F 0F8D05010000            jnl 00401C6A
:00401B65 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00401B68 51                      push ecx
:00401B69 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00401B6C E815F8FFFF              call 00401386
:00401B71 8B55EC                  mov edx, dword ptr [ebp-14]
:00401B74 33C9                    xor ecx, ecx
:00401B76 8A8AA4020000            mov cl, byte ptr [edx+000002A4]
:00401B7C 8B55F0                  mov edx, dword ptr [ebp-10]
:00401B7F 81E2FF000000            and edx, 000000FF
:00401B85 03CA                    add ecx, edx
:00401B87 8B55EC                  mov edx, dword ptr [ebp-14]
:00401B8A 89848A2C0C0000          mov dword ptr [edx+4*ecx+00000C2C], eax
:00401B91 8B45EC                  mov eax, dword ptr [ebp-14]
:00401B94 33C9                    xor ecx, ecx
:00401B96 8A88A4020000            mov cl, byte ptr [eax+000002A4]
:00401B9C 8B55F0                  mov edx, dword ptr [ebp-10]
:00401B9F 81E2FF000000            and edx, 000000FF
:00401BA5 03CA                    add ecx, edx
:00401BA7 8B45EC                  mov eax, dword ptr [ebp-14]
:00401BAA 83BC882C0C000000        cmp dword ptr [eax+4*ecx+00000C2C], 00000000
:00401BB2 7505                    jne 00401BB9
:00401BB4 E9B1000000              jmp 00401C6A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401BB2(C)
|
:00401BB9 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00401BBC 81E1FF000000            and ecx, 000000FF
:00401BC2 8B550C                  mov edx, dword ptr [ebp+0C]
:00401BC5 8B04CA                  mov eax, dword ptr [edx+8*ecx]
:00401BC8 2B45F8                  sub eax, dword ptr [ebp-08]
:00401BCB 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00401BCE 33D2                    xor edx, edx
:00401BD0 8A91A4020000            mov dl, byte ptr [ecx+000002A4]
:00401BD6 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00401BD9 81E1FF000000            and ecx, 000000FF
:00401BDF 03D1                    add edx, ecx
:00401BE1 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00401BE4 8984D11C030000          mov dword ptr [ecx+8*edx+0000031C], eax
:00401BEB 8B55F0                  mov edx, dword ptr [ebp-10]
:00401BEE 81E2FF000000            and edx, 000000FF
:00401BF4 8B450C                  mov eax, dword ptr [ebp+0C]
:00401BF7 8B4CD004                mov ecx, dword ptr [eax+8*edx+04]
:00401BFB 2B4DF4                  sub ecx, dword ptr [ebp-0C]
:00401BFE 8B55EC                  mov edx, dword ptr [ebp-14]
:00401C01 33C0                    xor eax, eax
:00401C03 8A82A4020000            mov al, byte ptr [edx+000002A4]
:00401C09 8B55F0                  mov edx, dword ptr [ebp-10]
:00401C0C 81E2FF000000            and edx, 000000FF
:00401C12 03C2                    add eax, edx
:00401C14 8B55EC                  mov edx, dword ptr [ebp-14]
:00401C17 898CC220030000          mov dword ptr [edx+8*eax+00000320], ecx
:00401C1E 8B45EC                  mov eax, dword ptr [ebp-14]
:00401C21 33C9                    xor ecx, ecx
:00401C23 8A88A4020000            mov cl, byte ptr [eax+000002A4]
:00401C29 8B55F0                  mov edx, dword ptr [ebp-10]
:00401C2C 81E2FF000000            and edx, 000000FF
:00401C32 03CA                    add ecx, edx
:00401C34 8B45EC                  mov eax, dword ptr [ebp-14]
:00401C37 C784C8C006000018FCFFFF  mov dword ptr [eax+8*ecx+000006C0], FFFFFC18
:00401C42 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00401C45 33D2                    xor edx, edx
:00401C47 8A91A4020000            mov dl, byte ptr [ecx+000002A4]
:00401C4D 8B45F0                  mov eax, dword ptr [ebp-10]
:00401C50 25FF000000              and eax, 000000FF
:00401C55 03D0                    add edx, eax
:00401C57 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00401C5A C784D1BC06000018FCFFFF  mov dword ptr [ecx+8*edx+000006BC], FFFFFC18
:00401C65 E9D9FEFFFF              jmp 00401B43

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00401B5F(C), :00401BB4(U)
|
:00401C6A 8B55EC                  mov edx, dword ptr [ebp-14]
:00401C6D 8A82A4020000            mov al, byte ptr [edx+000002A4]
:00401C73 0245F0                  add al, byte ptr [ebp-10]
:00401C76 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00401C79 8881A4020000            mov byte ptr [ecx+000002A4], al
:00401C7F 8A45F0                  mov al, byte ptr [ebp-10]
:00401C82 8BE5                    mov esp, ebp
:00401C84 5D                      pop ebp
:00401C85 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:00401E4C   , :004216CF   
|
:00401C88 55                      push ebp
:00401C89 8BEC                    mov ebp, esp
:00401C8B 81ECB4030000            sub esp, 000003B4
:00401C91 56                      push esi
:00401C92 898D4CFCFFFF            mov dword ptr [ebp+FFFFFC4C], ecx
:00401C98 C68558FCFFFF00          mov byte ptr [ebp+FFFFFC58], 00
:00401C9F C645FC00                mov [ebp-04], 00
:00401CA3 EB0E                    jmp 00401CB3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401E1A(U)
|
:00401CA5 8A8558FCFFFF            mov al, byte ptr [ebp+FFFFFC58]
:00401CAB 0401                    add al, 01
:00401CAD 888558FCFFFF            mov byte ptr [ebp+FFFFFC58], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401CA3(U)
|
:00401CB3 8B8D58FCFFFF            mov ecx, dword ptr [ebp+FFFFFC58]
:00401CB9 81E1FF000000            and ecx, 000000FF
:00401CBF 8B5508                  mov edx, dword ptr [ebp+08]
:00401CC2 81E2FF000000            and edx, 000000FF
:00401CC8 3BCA                    cmp ecx, edx
:00401CCA 0F8D4F010000            jnl 00401E1F
:00401CD0 8B8558FCFFFF            mov eax, dword ptr [ebp+FFFFFC58]
:00401CD6 25FF000000              and eax, 000000FF
:00401CDB 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00401CDE 33D2                    xor edx, edx
:00401CE0 8A1401                  mov dl, byte ptr [ecx+eax]
:00401CE3 81FAFF000000            cmp edx, 000000FF
:00401CE9 0F8430010000            je 00401E1F
:00401CEF 8B8558FCFFFF            mov eax, dword ptr [ebp+FFFFFC58]
:00401CF5 25FF000000              and eax, 000000FF
:00401CFA 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00401CFD 33D2                    xor edx, edx
:00401CFF 8A1401                  mov dl, byte ptr [ecx+eax]
:00401D02 8BCA                    mov ecx, edx
:00401D04 6BC924                  imul ecx, 00000024
:00401D07 81C1502C4B00            add ecx, 004B2C50
:00401D0D E84E160000              call 00403360
:00401D12 668B00                  mov ax, word ptr [eax]
:00401D15 50                      push eax
:00401D16 E863DD0400              call 0044FA7E
:00401D1B 83C404                  add esp, 00000004
:00401D1E 898550FCFFFF            mov dword ptr [ebp+FFFFFC50], eax
:00401D24 899554FCFFFF            mov dword ptr [ebp+FFFFFC54], edx
:00401D2A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00401D2D 81E1FF000000            and ecx, 000000FF
:00401D33 8B9550FCFFFF            mov edx, dword ptr [ebp+FFFFFC50]
:00401D39 8994CD5CFCFFFF          mov dword ptr [ebp+8*ecx-000003A4], edx
:00401D40 8B8554FCFFFF            mov eax, dword ptr [ebp+FFFFFC54]
:00401D46 8984CD60FCFFFF          mov dword ptr [ebp+8*ecx-000003A0], eax
:00401D4D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00401D50 81E1FF000000            and ecx, 000000FF
:00401D56 8B94CD5CFCFFFF          mov edx, dword ptr [ebp+8*ecx-000003A4]
:00401D5D 83C218                  add edx, 00000018
:00401D60 8B45FC                  mov eax, dword ptr [ebp-04]
:00401D63 25FF000000              and eax, 000000FF
:00401D68 8994C55CFCFFFF          mov dword ptr [ebp+8*eax-000003A4], edx
:00401D6F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00401D72 81E1FF000000            and ecx, 000000FF
:00401D78 8B94CD60FCFFFF          mov edx, dword ptr [ebp+8*ecx-000003A0]
:00401D7F 83C218                  add edx, 00000018
:00401D82 8B45FC                  mov eax, dword ptr [ebp-04]
:00401D85 25FF000000              and eax, 000000FF
:00401D8A 8994C560FCFFFF          mov dword ptr [ebp+8*eax-000003A0], edx
:00401D91 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00401D94 81E1FF000000            and ecx, 000000FF
:00401D9A 83BCCD5CFCFFFF00        cmp dword ptr [ebp+8*ecx-000003A4], 00000000
:00401DA2 7C76                    jl 00401E1A
:00401DA4 8B75FC                  mov esi, dword ptr [ebp-04]
:00401DA7 81E6FF000000            and esi, 000000FF
:00401DAD B950424B00              mov ecx, 004B4250
:00401DB2 E88D400500              call 00455E44
:00401DB7 3984F55CFCFFFF          cmp dword ptr [ebp+8*esi-000003A4], eax
:00401DBE 7D5A                    jge 00401E1A
:00401DC0 8B55FC                  mov edx, dword ptr [ebp-04]
:00401DC3 81E2FF000000            and edx, 000000FF
:00401DC9 83BCD560FCFFFF38        cmp dword ptr [ebp+8*edx-000003A0], 00000038
:00401DD1 7C47                    jl 00401E1A
:00401DD3 8B75FC                  mov esi, dword ptr [ebp-04]
:00401DD6 81E6FF000000            and esi, 000000FF
:00401DDC B950424B00              mov ecx, 004B4250
:00401DE1 E885400500              call 00455E6B
:00401DE6 83C038                  add eax, 00000038
:00401DE9 3984F560FCFFFF          cmp dword ptr [ebp+8*esi-000003A0], eax
:00401DF0 7D28                    jge 00401E1A
:00401DF2 8A45FC                  mov al, byte ptr [ebp-04]
:00401DF5 0401                    add al, 01
:00401DF7 8845FC                  mov byte ptr [ebp-04], al
:00401DFA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00401DFD 81E1FF000000            and ecx, 000000FF
:00401E03 8B954CFCFFFF            mov edx, dword ptr [ebp+FFFFFC4C]
:00401E09 33C0                    xor eax, eax
:00401E0B 8A82A4020000            mov al, byte ptr [edx+000002A4]
:00401E11 03C8                    add ecx, eax
:00401E13 83F974                  cmp ecx, 00000074
:00401E16 7502                    jne 00401E1A
:00401E18 EB05                    jmp 00401E1F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00401DA2(C), :00401DBE(C), :00401DD1(C), :00401DF0(C), :00401E16(C)
|
:00401E1A E986FEFFFF              jmp 00401CA5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00401CCA(C), :00401CE9(C), :00401E18(U)
|
:00401E1F 8D8D5CFCFFFF            lea ecx, dword ptr [ebp+FFFFFC5C]
:00401E25 51                      push ecx
:00401E26 8A55FC                  mov dl, byte ptr [ebp-04]
:00401E29 52                      push edx
:00401E2A 8B8D4CFCFFFF            mov ecx, dword ptr [ebp+FFFFFC4C]
:00401E30 E86FFBFFFF              call 004019A4
:00401E35 5E                      pop esi
:00401E36 8BE5                    mov esp, ebp
:00401E38 5D                      pop ebp
:00401E39 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0041CC8F   , :00421E2A   , :00422A04   , :00423C6A   , :0043EABE   
|
:00401E3C 55                      push ebp
:00401E3D 8BEC                    mov ebp, esp
:00401E3F 51                      push ecx
:00401E40 894DFC                  mov dword ptr [ebp-04], ecx
:00401E43 8D4508                  lea eax, dword ptr [ebp+08]
:00401E46 50                      push eax
:00401E47 6A01                    push 00000001
:00401E49 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00401E4C E837FEFFFF              call 00401C88
:00401E51 25FF000000              and eax, 000000FF
:00401E56 8BE5                    mov esp, ebp
:00401E58 5D                      pop ebp
:00401E59 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0041423F   , :0041CCA1   , :004216E8   , :00421E58   , :00422A16   
|:00423C7C   , :0043EAD0   , :0044A175   
|
:00401E5C 55                      push ebp
:00401E5D 8BEC                    mov ebp, esp
:00401E5F 6AFF                    push FFFFFFFF
:00401E61 68094F4800              push 00484F09
:00401E66 64A100000000            mov eax, dword ptr fs:[00000000]
:00401E6C 50                      push eax
:00401E6D 64892500000000          mov dword ptr fs:[00000000], esp
:00401E74 51                      push ecx
:00401E75 83EC14                  sub esp, 00000014
:00401E78 53                      push ebx
:00401E79 56                      push esi
:00401E7A 57                      push edi
:00401E7B 8965F0                  mov dword ptr [ebp-10], esp
:00401E7E 894DDC                  mov dword ptr [ebp-24], ecx
:00401E81 8B45DC                  mov eax, dword ptr [ebp-24]
:00401E84 83B8D00F000000          cmp dword ptr [eax+00000FD0], 00000000
:00401E8B 7505                    jne 00401E92
:00401E8D E9B9010000              jmp 0040204B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401E8B(C)
|
:00401E92 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00401E95 E815F9FFFF              call 004017AF
:00401E9A 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00401E9D E81BFAFFFF              call 004018BD
:00401EA2 C745EC01000000          mov [ebp-14], 00000001
:00401EA9 6A00                    push 00000000
:00401EAB 6A00                    push 00000000
:00401EAD 6802020000              push 00000202
:00401EB2 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:00401EB8 51                      push ecx
:00401EB9 FF15F4624800            call dword ptr [004862F4]
:00401EBF C745FC00000000          mov [ebp-04], 00000000
:00401EC6 C645E400                mov [ebp-1C], 00
:00401ECA EB09                    jmp 00401ED5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040200F(U)
|
:00401ECC 8A55E4                  mov dl, byte ptr [ebp-1C]
:00401ECF 80C201                  add dl, 01
:00401ED2 8855E4                  mov byte ptr [ebp-1C], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401ECA(U)
|
:00401ED5 8B45E4                  mov eax, dword ptr [ebp-1C]
:00401ED8 25FF000000              and eax, 000000FF
:00401EDD 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00401EE0 33D2                    xor edx, edx
:00401EE2 8A11                    mov dl, byte ptr [ecx]
:00401EE4 3BC2                    cmp eax, edx
:00401EE6 0F8D28010000            jnl 00402014
:00401EEC E8EAC60100              call 0041E5DB
:00401EF1 8B45E4                  mov eax, dword ptr [ebp-1C]
:00401EF4 25FF000000              and eax, 000000FF
:00401EF9 F7D8                    neg eax
:00401EFB 1BC0                    sbb eax, eax
:00401EFD 40                      inc eax
:00401EFE 50                      push eax
:00401EFF 8A4DE4                  mov cl, byte ptr [ebp-1C]
:00401F02 51                      push ecx
:00401F03 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00401F06 E880010000              call 0040208B
:00401F0B 8945E8                  mov dword ptr [ebp-18], eax
:00401F0E 837D0800                cmp dword ptr [ebp+08], 00000000
:00401F12 7452                    je 00401F66
:00401F14 8B55E4                  mov edx, dword ptr [ebp-1C]
:00401F17 81E2FF000000            and edx, 000000FF
:00401F1D 8B45DC                  mov eax, dword ptr [ebp-24]
:00401F20 8B4C9014                mov ecx, dword ptr [eax+4*edx+14]
:00401F24 33D2                    xor edx, edx
:00401F26 8A5110                  mov dl, byte ptr [ecx+10]
:00401F29 85D2                    test edx, edx
:00401F2B 7439                    je 00401F66
:00401F2D 8B45DC                  mov eax, dword ptr [ebp-24]
:00401F30 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00401F33 8B909C020000            mov edx, dword ptr [eax+0000029C]
:00401F39 2B9194020000            sub edx, dword ptr [ecx+00000294]
:00401F3F 52                      push edx
:00401F40 8B45DC                  mov eax, dword ptr [ebp-24]
:00401F43 8B88D00F0000            mov ecx, dword ptr [eax+00000FD0]
:00401F49 51                      push ecx
:00401F4A 8B55E4                  mov edx, dword ptr [ebp-1C]
:00401F4D 81E2FF000000            and edx, 000000FF
:00401F53 8B45DC                  mov eax, dword ptr [ebp-24]
:00401F56 8B4C9014                mov ecx, dword ptr [eax+4*edx+14]
:00401F5A 8A5110                  mov dl, byte ptr [ecx+10]
:00401F5D 52                      push edx
:00401F5E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00401F61 E89EFF0100              call 00421F04

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00401F12(C), :00401F2B(C)
|
:00401F66 C645E000                mov [ebp-20], 00
:00401F6A EB08                    jmp 00401F74

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401FC4(U)
|
:00401F6C 8A45E0                  mov al, byte ptr [ebp-20]
:00401F6F 0401                    add al, 01
:00401F71 8845E0                  mov byte ptr [ebp-20], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401F6A(U)
|
:00401F74 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00401F77 81E1FF000000            and ecx, 000000FF
:00401F7D 8B55DC                  mov edx, dword ptr [ebp-24]
:00401F80 33C0                    xor eax, eax
:00401F82 8A82A4020000            mov al, byte ptr [edx+000002A4]
:00401F88 3BC8                    cmp ecx, eax
:00401F8A 7D3A                    jge 00401FC6
:00401F8C 837DE800                cmp dword ptr [ebp-18], 00000000
:00401F90 7516                    jne 00401FA8
:00401F92 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00401F95 81E1FF000000            and ecx, 000000FF
:00401F9B 8B55DC                  mov edx, dword ptr [ebp-24]
:00401F9E 83BC8A5C0A000000        cmp dword ptr [edx+4*ecx+00000A5C], 00000000
:00401FA6 740C                    je 00401FB4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401F90(C)
|
:00401FA8 8A45E0                  mov al, byte ptr [ebp-20]
:00401FAB 50                      push eax
:00401FAC 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00401FAF E86D020000              call 00402221

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401FA6(C)
|
:00401FB4 8A4DE0                  mov cl, byte ptr [ebp-20]
:00401FB7 51                      push ecx
:00401FB8 8A55E4                  mov dl, byte ptr [ebp-1C]
:00401FBB 52                      push edx
:00401FBC 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00401FBF E8BB020000              call 0040227F
:00401FC4 EBA6                    jmp 00401F6C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401F8A(C)
|
:00401FC6 E8A0A50200              call 0042C56B
:00401FCB 85C0                    test eax, eax
:00401FCD 7407                    je 00401FD6
:00401FCF C745EC00000000          mov [ebp-14], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401FCD(C)
|
:00401FD6 837DEC00                cmp dword ptr [ebp-14], 00000000
:00401FDA 7405                    je 00401FE1
:00401FDC E8FFA40200              call 0042C4E0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401FDA(C)
|
:00401FE1 8A45E4                  mov al, byte ptr [ebp-1C]
:00401FE4 50                      push eax
:00401FE5 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00401FE8 E8FB110000              call 004031E8
:00401FED 85C0                    test eax, eax
:00401FEF 7408                    je 00401FF9
:00401FF1 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00401FF4 E865000000              call 0040205E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401FEF(C)
|
:00401FF9 E8F8C50100              call 0041E5F6
:00401FFE 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00402001 8B5104                  mov edx, dword ptr [ecx+04]
:00402004 52                      push edx
:00402005 B9181B4B00              mov ecx, 004B1B18
:0040200A E831130000              call 00403340
:0040200F E9B8FEFFFF              jmp 00401ECC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401EE6(C)
|
:00402014 EB17                    jmp 0040202D
:00402016 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00402019 E88DF6FFFF              call 004016AB
:0040201E 6A00                    push 00000000
:00402020 6A00                    push 00000000
:00402022 E809F00700              call 00481030
:00402027 B82D204000              mov eax, 0040202D
:0040202C C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402014(U)
|
:0040202D C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00402034 837D0C00                cmp dword ptr [ebp+0C], 00000000
:00402038 7411                    je 0040204B
:0040203A E8A1A40200              call 0042C4E0
:0040203F 6A00                    push 00000000
:00402041 6A00                    push 00000000
:00402043 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00402046 E840000000              call 0040208B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00401E8D(U), :00402038(C)
|
:0040204B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040204E 64890D00000000          mov dword ptr fs:[00000000], ecx
:00402055 5F                      pop edi
:00402056 5E                      pop esi
:00402057 5B                      pop ebx
:00402058 8BE5                    mov esp, ebp
:0040205A 5D                      pop ebp
:0040205B C20800                  ret 0008



* Referenced by a CALL at Address:
|:00401FF4   
|
:0040205E 55                      push ebp
:0040205F 8BEC                    mov ebp, esp
:00402061 51                      push ecx
:00402062 894DFC                  mov dword ptr [ebp-04], ecx
:00402065 B9B0694B00              mov ecx, 004B69B0
:0040206A E8E3250700              call 00474652
:0040206F 6A01                    push 00000001
:00402071 8B45FC                  mov eax, dword ptr [ebp-04]
:00402074 33C9                    xor ecx, ecx
:00402076 8A4810                  mov cl, byte ptr [eax+10]
:00402079 83C164                  add ecx, 00000064
:0040207C 51                      push ecx
:0040207D B9B0694B00              mov ecx, 004B69B0
:00402082 E8F3250700              call 0047467A
:00402087 8BE5                    mov esp, ebp
:00402089 5D                      pop ebp
:0040208A C3                      ret



* Referenced by a CALL at Addresses:
|:00401F06   , :00402046   
|
:0040208B 55                      push ebp
:0040208C 8BEC                    mov ebp, esp
:0040208E 83EC0C                  sub esp, 0000000C
:00402091 894DF4                  mov dword ptr [ebp-0C], ecx
:00402094 C745FC00000000          mov [ebp-04], 00000000
:0040209B 6A00                    push 00000000
:0040209D 6A00                    push 00000000
:0040209F 6A00                    push 00000000
:004020A1 E84BB10700              call 0047D1F1
:004020A6 83C40C                  add esp, 0000000C
:004020A9 8B4508                  mov eax, dword ptr [ebp+08]
:004020AC 25FF000000              and eax, 000000FF
:004020B1 85C0                    test eax, eax
:004020B3 7469                    je 0040211E
:004020B5 8B4D08                  mov ecx, dword ptr [ebp+08]
:004020B8 81E1FF000000            and ecx, 000000FF
:004020BE 8B55F4                  mov edx, dword ptr [ebp-0C]
:004020C1 8B448A14                mov eax, dword ptr [edx+4*ecx+14]
:004020C5 33C9                    xor ecx, ecx
:004020C7 8A4810                  mov cl, byte ptr [eax+10]
:004020CA 85C9                    test ecx, ecx
:004020CC 7550                    jne 0040211E
:004020CE 8B5508                  mov edx, dword ptr [ebp+08]
:004020D1 81E2FF000000            and edx, 000000FF
:004020D7 8B45F4                  mov eax, dword ptr [ebp-0C]
:004020DA 8B4C9014                mov ecx, dword ptr [eax+4*edx+14]
:004020DE 8B5508                  mov edx, dword ptr [ebp+08]
:004020E1 81E2FF000000            and edx, 000000FF
:004020E7 8B45F4                  mov eax, dword ptr [ebp-0C]
:004020EA 8B549010                mov edx, dword ptr [eax+4*edx+10]
:004020EE 8B4108                  mov eax, dword ptr [ecx+08]
:004020F1 3B4208                  cmp eax, dword ptr [edx+08]
:004020F4 7528                    jne 0040211E
:004020F6 8B4D08                  mov ecx, dword ptr [ebp+08]
:004020F9 81E1FF000000            and ecx, 000000FF
:004020FF 8B55F4                  mov edx, dword ptr [ebp-0C]
:00402102 8B448A14                mov eax, dword ptr [edx+4*ecx+14]
:00402106 8B4D08                  mov ecx, dword ptr [ebp+08]
:00402109 81E1FF000000            and ecx, 000000FF
:0040210F 8B55F4                  mov edx, dword ptr [ebp-0C]
:00402112 8B4C8A10                mov ecx, dword ptr [edx+4*ecx+10]
:00402116 8B500C                  mov edx, dword ptr [eax+0C]
:00402119 3B510C                  cmp edx, dword ptr [ecx+0C]
:0040211C 7407                    je 00402125

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004020B3(C), :004020CC(C), :004020F4(C)
|
:0040211E C745FC01000000          mov [ebp-04], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040211C(C)
|
:00402125 E8B1C40100              call 0041E5DB
:0040212A 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040212D 33C9                    xor ecx, ecx
:0040212F 8A88A4020000            mov cl, byte ptr [eax+000002A4]
:00402135 83E901                  sub ecx, 00000001
:00402138 894DF8                  mov dword ptr [ebp-08], ecx
:0040213B EB09                    jmp 00402146

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040220E(U)
|
:0040213D 8B55F8                  mov edx, dword ptr [ebp-08]
:00402140 83EA01                  sub edx, 00000001
:00402143 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040213B(U)
|
:00402146 837DF800                cmp dword ptr [ebp-08], 00000000
:0040214A 0F8CC3000000            jl 00402213
:00402150 837DFC00                cmp dword ptr [ebp-04], 00000000
:00402154 7514                    jne 0040216A
:00402156 8B45F8                  mov eax, dword ptr [ebp-08]
:00402159 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040215C 83BC815C0A000000        cmp dword ptr [ecx+4*eax+00000A5C], 00000000
:00402164 0F84A4000000            je 0040220E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402154(C)
|
:0040216A 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0040216E 7540                    jne 004021B0
:00402170 8B55F8                  mov edx, dword ptr [ebp-08]
:00402173 8B45F4                  mov eax, dword ptr [ebp-0C]
:00402176 8B8C902C0C0000          mov ecx, dword ptr [eax+4*edx+00000C2C]
:0040217D 51                      push ecx
:0040217E 8B55F4                  mov edx, dword ptr [ebp-0C]
:00402181 8B420C                  mov eax, dword ptr [edx+0C]
:00402184 50                      push eax
:00402185 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00402188 8B5108                  mov edx, dword ptr [ecx+08]
:0040218B 52                      push edx
:0040218C 8B45F8                  mov eax, dword ptr [ebp-08]
:0040218F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00402192 8B94C1C0060000          mov edx, dword ptr [ecx+8*eax+000006C0]
:00402199 52                      push edx
:0040219A 8B45F8                  mov eax, dword ptr [ebp-08]
:0040219D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004021A0 8B94C1BC060000          mov edx, dword ptr [ecx+8*eax+000006BC]
:004021A7 52                      push edx
:004021A8 E8EEBE0700              call 0047E09B
:004021AD 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040216E(C)
|
:004021B0 837DFC00                cmp dword ptr [ebp-04], 00000000
:004021B4 7458                    je 0040220E
:004021B6 8B4508                  mov eax, dword ptr [ebp+08]
:004021B9 25FF000000              and eax, 000000FF
:004021BE 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004021C1 8B548114                mov edx, dword ptr [ecx+4*eax+14]
:004021C5 8B45F8                  mov eax, dword ptr [ebp-08]
:004021C8 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004021CB 8B84C11C030000          mov eax, dword ptr [ecx+8*eax+0000031C]
:004021D2 034208                  add eax, dword ptr [edx+08]
:004021D5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004021D8 8B55F4                  mov edx, dword ptr [ebp-0C]
:004021DB 8984CABC060000          mov dword ptr [edx+8*ecx+000006BC], eax
:004021E2 8B4508                  mov eax, dword ptr [ebp+08]
:004021E5 25FF000000              and eax, 000000FF
:004021EA 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004021ED 8B548114                mov edx, dword ptr [ecx+4*eax+14]
:004021F1 8B45F8                  mov eax, dword ptr [ebp-08]
:004021F4 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004021F7 8B84C120030000          mov eax, dword ptr [ecx+8*eax+00000320]
:004021FE 03420C                  add eax, dword ptr [edx+0C]
:00402201 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00402204 8B55F4                  mov edx, dword ptr [ebp-0C]
:00402207 8984CAC0060000          mov dword ptr [edx+8*ecx+000006C0], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00402164(C), :004021B4(C)
|
:0040220E E92AFFFFFF              jmp 0040213D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040214A(C)
|
:00402213 E8DEC30100              call 0041E5F6
:00402218 8B45FC                  mov eax, dword ptr [ebp-04]
:0040221B 8BE5                    mov esp, ebp
:0040221D 5D                      pop ebp
:0040221E C20800                  ret 0008



* Referenced by a CALL at Address:
|:00401FAF   
|
:00402221 55                      push ebp
:00402222 8BEC                    mov ebp, esp
:00402224 51                      push ecx
:00402225 894DFC                  mov dword ptr [ebp-04], ecx
:00402228 8B4508                  mov eax, dword ptr [ebp+08]
:0040222B 25FF000000              and eax, 000000FF
:00402230 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00402233 8B94812C0C0000          mov edx, dword ptr [ecx+4*eax+00000C2C]
:0040223A 52                      push edx
:0040223B 8B45FC                  mov eax, dword ptr [ebp-04]
:0040223E 8B480C                  mov ecx, dword ptr [eax+0C]
:00402241 51                      push ecx
:00402242 8B55FC                  mov edx, dword ptr [ebp-04]
:00402245 8B4208                  mov eax, dword ptr [edx+08]
:00402248 50                      push eax
:00402249 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040224C 81E1FF000000            and ecx, 000000FF
:00402252 8B55FC                  mov edx, dword ptr [ebp-04]
:00402255 8B84CAC0060000          mov eax, dword ptr [edx+8*ecx+000006C0]
:0040225C 50                      push eax
:0040225D 8B4D08                  mov ecx, dword ptr [ebp+08]
:00402260 81E1FF000000            and ecx, 000000FF
:00402266 8B55FC                  mov edx, dword ptr [ebp-04]
:00402269 8B84CABC060000          mov eax, dword ptr [edx+8*ecx+000006BC]
:00402270 50                      push eax
:00402271 E8DBBF0700              call 0047E251
:00402276 83C414                  add esp, 00000014
:00402279 8BE5                    mov esp, ebp
:0040227B 5D                      pop ebp
:0040227C C20400                  ret 0004



* Referenced by a CALL at Address:
|:00401FBF   
|
:0040227F 55                      push ebp
:00402280 8BEC                    mov ebp, esp
:00402282 83EC08                  sub esp, 00000008
:00402285 894DF8                  mov dword ptr [ebp-08], ecx
:00402288 C745FC00000000          mov [ebp-04], 00000000
:0040228F 8B4508                  mov eax, dword ptr [ebp+08]
:00402292 25FF000000              and eax, 000000FF
:00402297 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040229A 8B548114                mov edx, dword ptr [ecx+4*eax+14]
:0040229E 33C0                    xor eax, eax
:004022A0 8A4201                  mov al, byte ptr [edx+01]
:004022A3 83F828                  cmp eax, 00000028
:004022A6 7D22                    jge 004022CA
:004022A8 8B4D08                  mov ecx, dword ptr [ebp+08]
:004022AB 81E1FF000000            and ecx, 000000FF
:004022B1 8B55F8                  mov edx, dword ptr [ebp-08]
:004022B4 8B448A14                mov eax, dword ptr [edx+4*ecx+14]
:004022B8 33C9                    xor ecx, ecx
:004022BA 8A4801                  mov cl, byte ptr [eax+01]
:004022BD 8B55F8                  mov edx, dword ptr [ebp-08]
:004022C0 8B848AF4010000          mov eax, dword ptr [edx+4*ecx+000001F4]
:004022C7 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004022A6(C)
|
:004022CA 8B4D08                  mov ecx, dword ptr [ebp+08]
:004022CD 81E1FF000000            and ecx, 000000FF
:004022D3 8B55F8                  mov edx, dword ptr [ebp-08]
:004022D6 8B448A14                mov eax, dword ptr [edx+4*ecx+14]
:004022DA 83780400                cmp dword ptr [eax+04], 00000000
:004022DE 0F84B8000000            je 0040239C
:004022E4 8B4D08                  mov ecx, dword ptr [ebp+08]
:004022E7 81E1FF000000            and ecx, 000000FF
:004022ED 8B55F8                  mov edx, dword ptr [ebp-08]
:004022F0 8B448A14                mov eax, dword ptr [edx+4*ecx+14]
:004022F4 8A4803                  mov cl, byte ptr [eax+03]
:004022F7 51                      push ecx
:004022F8 8B55FC                  mov edx, dword ptr [ebp-04]
:004022FB 52                      push edx
:004022FC 6A04                    push 00000004
:004022FE 8B45F8                  mov eax, dword ptr [ebp-08]
:00402301 8B88D00F0000            mov ecx, dword ptr [eax+00000FD0]
:00402307 51                      push ecx
:00402308 8B550C                  mov edx, dword ptr [ebp+0C]
:0040230B 81E2FF000000            and edx, 000000FF
:00402311 8B45F8                  mov eax, dword ptr [ebp-08]
:00402314 8B8C902C0C0000          mov ecx, dword ptr [eax+4*edx+00000C2C]
:0040231B 51                      push ecx
:0040231C 8B5508                  mov edx, dword ptr [ebp+08]
:0040231F 81E2FF000000            and edx, 000000FF
:00402325 8B45F8                  mov eax, dword ptr [ebp-08]
:00402328 8B4C9014                mov ecx, dword ptr [eax+4*edx+14]
:0040232C 33D2                    xor edx, edx
:0040232E 8A5102                  mov dl, byte ptr [ecx+02]
:00402331 8B45F8                  mov eax, dword ptr [ebp-08]
:00402334 8B8C9054010000          mov ecx, dword ptr [eax+4*edx+00000154]
:0040233B 51                      push ecx
:0040233C 8B5508                  mov edx, dword ptr [ebp+08]
:0040233F 81E2FF000000            and edx, 000000FF
:00402345 8B45F8                  mov eax, dword ptr [ebp-08]
:00402348 8B4C9014                mov ecx, dword ptr [eax+4*edx+14]
:0040234C 33D2                    xor edx, edx
:0040234E 8A11                    mov dl, byte ptr [ecx]
:00402350 8B45F8                  mov eax, dword ptr [ebp-08]
:00402353 8B8C90B4000000          mov ecx, dword ptr [eax+4*edx+000000B4]
:0040235A 51                      push ecx
:0040235B 8B55F8                  mov edx, dword ptr [ebp-08]
:0040235E 8B420C                  mov eax, dword ptr [edx+0C]
:00402361 50                      push eax
:00402362 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00402365 8B5108                  mov edx, dword ptr [ecx+08]
:00402368 52                      push edx
:00402369 8B450C                  mov eax, dword ptr [ebp+0C]
:0040236C 25FF000000              and eax, 000000FF
:00402371 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00402374 8B94C1C0060000          mov edx, dword ptr [ecx+8*eax+000006C0]
:0040237B 52                      push edx
:0040237C 8B450C                  mov eax, dword ptr [ebp+0C]
:0040237F 25FF000000              and eax, 000000FF
:00402384 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00402387 8B94C1BC060000          mov edx, dword ptr [ecx+8*eax+000006BC]
:0040238E 52                      push edx
:0040238F E8D5DF0200              call 00430369
:00402394 83C42C                  add esp, 0000002C
:00402397 E9A2010000              jmp 0040253E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004022DE(C)
|
:0040239C 8B4508                  mov eax, dword ptr [ebp+08]
:0040239F 25FF000000              and eax, 000000FF
:004023A4 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004023A7 8B548114                mov edx, dword ptr [ecx+4*eax+14]
:004023AB 33C0                    xor eax, eax
:004023AD 8A4202                  mov al, byte ptr [edx+02]
:004023B0 85C0                    test eax, eax
:004023B2 750A                    jne 004023BE
:004023B4 837DFC00                cmp dword ptr [ebp-04], 00000000
:004023B8 0F84AD000000            je 0040246B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004023B2(C)
|
:004023BE 8B4D08                  mov ecx, dword ptr [ebp+08]
:004023C1 81E1FF000000            and ecx, 000000FF
:004023C7 8B55F8                  mov edx, dword ptr [ebp-08]
:004023CA 8B448A14                mov eax, dword ptr [edx+4*ecx+14]
:004023CE 8A4803                  mov cl, byte ptr [eax+03]
:004023D1 51                      push ecx
:004023D2 8B55FC                  mov edx, dword ptr [ebp-04]
:004023D5 52                      push edx
:004023D6 6A00                    push 00000000
:004023D8 8B4508                  mov eax, dword ptr [ebp+08]
:004023DB 25FF000000              and eax, 000000FF
:004023E0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004023E3 8B548114                mov edx, dword ptr [ecx+4*eax+14]
:004023E7 8A4202                  mov al, byte ptr [edx+02]
:004023EA 50                      push eax
:004023EB 6A04                    push 00000004
:004023ED 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004023F0 8B91D00F0000            mov edx, dword ptr [ecx+00000FD0]
:004023F6 52                      push edx
:004023F7 8B450C                  mov eax, dword ptr [ebp+0C]
:004023FA 25FF000000              and eax, 000000FF
:004023FF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00402402 8B94812C0C0000          mov edx, dword ptr [ecx+4*eax+00000C2C]
:00402409 52                      push edx
:0040240A 8B4508                  mov eax, dword ptr [ebp+08]
:0040240D 25FF000000              and eax, 000000FF
:00402412 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00402415 8B548114                mov edx, dword ptr [ecx+4*eax+14]
:00402419 33C0                    xor eax, eax
:0040241B 8A02                    mov al, byte ptr [edx]
:0040241D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00402420 8B9481B4000000          mov edx, dword ptr [ecx+4*eax+000000B4]
:00402427 52                      push edx
:00402428 8B45F8                  mov eax, dword ptr [ebp-08]
:0040242B 8B480C                  mov ecx, dword ptr [eax+0C]
:0040242E 51                      push ecx
:0040242F 8B55F8                  mov edx, dword ptr [ebp-08]
:00402432 8B4208                  mov eax, dword ptr [edx+08]
:00402435 50                      push eax
:00402436 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00402439 81E1FF000000            and ecx, 000000FF
:0040243F 8B55F8                  mov edx, dword ptr [ebp-08]
:00402442 8B84CAC0060000          mov eax, dword ptr [edx+8*ecx+000006C0]
:00402449 50                      push eax
:0040244A 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0040244D 81E1FF000000            and ecx, 000000FF
:00402453 8B55F8                  mov edx, dword ptr [ebp-08]
:00402456 8B84CABC060000          mov eax, dword ptr [edx+8*ecx+000006BC]
:0040245D 50                      push eax
:0040245E E8ABDE0200              call 0043030E
:00402463 83C430                  add esp, 00000030
:00402466 E9D3000000              jmp 0040253E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004023B8(C)
|
:0040246B E86BC10100              call 0041E5DB
:00402470 6A00                    push 00000000
:00402472 6A00                    push 00000000
:00402474 6A00                    push 00000000
:00402476 E876AD0700              call 0047D1F1
:0040247B 83C40C                  add esp, 0000000C
:0040247E 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00402481 81E1FF000000            and ecx, 000000FF
:00402487 8B55F8                  mov edx, dword ptr [ebp-08]
:0040248A 8B848A2C0C0000          mov eax, dword ptr [edx+4*ecx+00000C2C]
:00402491 50                      push eax
:00402492 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00402495 8B510C                  mov edx, dword ptr [ecx+0C]
:00402498 52                      push edx
:00402499 8B45F8                  mov eax, dword ptr [ebp-08]
:0040249C 8B4808                  mov ecx, dword ptr [eax+08]
:0040249F 51                      push ecx
:004024A0 8B550C                  mov edx, dword ptr [ebp+0C]
:004024A3 81E2FF000000            and edx, 000000FF
:004024A9 8B45F8                  mov eax, dword ptr [ebp-08]
:004024AC 8B8CD0C0060000          mov ecx, dword ptr [eax+8*edx+000006C0]
:004024B3 51                      push ecx
:004024B4 8B550C                  mov edx, dword ptr [ebp+0C]
:004024B7 81E2FF000000            and edx, 000000FF
:004024BD 8B45F8                  mov eax, dword ptr [ebp-08]
:004024C0 8B8CD0BC060000          mov ecx, dword ptr [eax+8*edx+000006BC]
:004024C7 51                      push ecx
:004024C8 E8CEBB0700              call 0047E09B
:004024CD 83C414                  add esp, 00000014
:004024D0 6A00                    push 00000000
:004024D2 6A00                    push 00000000
:004024D4 6A04                    push 00000004
:004024D6 E816AD0700              call 0047D1F1
:004024DB 83C40C                  add esp, 0000000C
:004024DE 8B5508                  mov edx, dword ptr [ebp+08]
:004024E1 81E2FF000000            and edx, 000000FF
:004024E7 8B45F8                  mov eax, dword ptr [ebp-08]
:004024EA 8B4C9014                mov ecx, dword ptr [eax+4*edx+14]
:004024EE 33D2                    xor edx, edx
:004024F0 8A11                    mov dl, byte ptr [ecx]
:004024F2 8B45F8                  mov eax, dword ptr [ebp-08]
:004024F5 8B8C90B4000000          mov ecx, dword ptr [eax+4*edx+000000B4]
:004024FC 51                      push ecx
:004024FD 8B55F8                  mov edx, dword ptr [ebp-08]
:00402500 8B420C                  mov eax, dword ptr [edx+0C]
:00402503 50                      push eax
:00402504 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00402507 8B5108                  mov edx, dword ptr [ecx+08]
:0040250A 52                      push edx
:0040250B 8B450C                  mov eax, dword ptr [ebp+0C]
:0040250E 25FF000000              and eax, 000000FF
:00402513 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00402516 8B94C1C0060000          mov edx, dword ptr [ecx+8*eax+000006C0]
:0040251D 52                      push edx
:0040251E 8B450C                  mov eax, dword ptr [ebp+0C]
:00402521 25FF000000              and eax, 000000FF
:00402526 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00402529 8B94C1BC060000          mov edx, dword ptr [ecx+8*eax+000006BC]
:00402530 52                      push edx
:00402531 E865BB0700              call 0047E09B
:00402536 83C414                  add esp, 00000014
:00402539 E8B8C00100              call 0041E5F6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00402397(U), :00402466(U)
|
:0040253E 8BE5                    mov esp, ebp
:00402540 5D                      pop ebp
:00402541 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:004026F4   , :00402AC3   , :00402B89   , :00402C49   , :00402DC7   
|
:00402544 55                      push ebp
:00402545 8BEC                    mov ebp, esp
:00402547 83EC08                  sub esp, 00000008
:0040254A 894DF8                  mov dword ptr [ebp-08], ecx
:0040254D 8B45F8                  mov eax, dword ptr [ebp-08]
:00402550 8B4810                  mov ecx, dword ptr [eax+10]
:00402553 8B55F8                  mov edx, dword ptr [ebp-08]
:00402556 034A18                  add ecx, dword ptr [edx+18]
:00402559 894DFC                  mov dword ptr [ebp-04], ecx
:0040255C 8B45F8                  mov eax, dword ptr [ebp-08]
:0040255F 8B4818                  mov ecx, dword ptr [eax+18]
:00402562 034D08                  add ecx, dword ptr [ebp+08]
:00402565 8B55F8                  mov edx, dword ptr [ebp-08]
:00402568 894A18                  mov dword ptr [edx+18], ecx
:0040256B 8B45FC                  mov eax, dword ptr [ebp-04]
:0040256E 8BE5                    mov esp, ebp
:00402570 5D                      pop ebp
:00402571 C20400                  ret 0004


:00402574 55                      push ebp
:00402575 8BEC                    mov ebp, esp
:00402577 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040257A E83B010000              call 004026BA
:0040257F 85C0                    test eax, eax
:00402581 740C                    je 0040258F
:00402583 6A02                    push 00000002
:00402585 8B4D08                  mov ecx, dword ptr [ebp+08]
:00402588 E813110000              call 004036A0
:0040258D EB0A                    jmp 00402599

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402581(C)
|
:0040258F 6A00                    push 00000000
:00402591 8B4D08                  mov ecx, dword ptr [ebp+08]
:00402594 E815000000              call 004025AE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040258D(U)
|
:00402599 8B4508                  mov eax, dword ptr [ebp+08]
:0040259C 8B08                    mov ecx, dword ptr [eax]
:0040259E 51                      push ecx
:0040259F FF1540614800            call dword ptr [00486140]
:004025A5 8B5508                  mov edx, dword ptr [ebp+08]
:004025A8 8B02                    mov eax, dword ptr [edx]
:004025AA 5D                      pop ebp
:004025AB C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00402594   , :004026B1   , :00402F8D   , :0040310F   , :0040312F   
|:00403678   
|
:004025AE 55                      push ebp
:004025AF 8BEC                    mov ebp, esp
:004025B1 83EC10                  sub esp, 00000010
:004025B4 894DF4                  mov dword ptr [ebp-0C], ecx
:004025B7 837D0800                cmp dword ptr [ebp+08], 00000000
:004025BB 7408                    je 004025C5
:004025BD 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004025C0 E88A020000              call 0040284F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004025BB(C)
|
:004025C5 6A14                    push 00000014
:004025C7 6A00                    push 00000000
:004025C9 8B45F4                  mov eax, dword ptr [ebp-0C]
:004025CC 83C01C                  add eax, 0000001C
:004025CF 50                      push eax
:004025D0 E85BE50700              call 00480B30
:004025D5 83C40C                  add esp, 0000000C
:004025D8 6A14                    push 00000014
:004025DA 6A00                    push 00000000
:004025DC 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004025DF 83C130                  add ecx, 00000030
:004025E2 51                      push ecx
:004025E3 E848E50700              call 00480B30
:004025E8 83C40C                  add esp, 0000000C
:004025EB 6A00                    push 00000000
:004025ED 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004025F0 E8AB100000              call 004036A0
:004025F5 8B55F4                  mov edx, dword ptr [ebp-0C]
:004025F8 C7424400000000          mov [edx+44], 00000000
:004025FF 8B45F4                  mov eax, dword ptr [ebp-0C]
:00402602 C7404800000000          mov [eax+48], 00000000
:00402609 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040260C C7414C00000000          mov [ecx+4C], 00000000
:00402613 8B55F4                  mov edx, dword ptr [ebp-0C]
:00402616 C7425000000000          mov [edx+50], 00000000
:0040261D 8B45F4                  mov eax, dword ptr [ebp-0C]
:00402620 C7405400000000          mov [eax+54], 00000000
:00402627 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040262A C7411800000000          mov [ecx+18], 00000000
:00402631 8B55F4                  mov edx, dword ptr [ebp-0C]
:00402634 C6425800                mov [edx+58], 00
:00402638 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040263B 83780C00                cmp dword ptr [eax+0C], 00000000
:0040263F 7435                    je 00402676
:00402641 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00402644 8B510C                  mov edx, dword ptr [ecx+0C]
:00402647 8955F8                  mov dword ptr [ebp-08], edx
:0040264A 8B45F8                  mov eax, dword ptr [ebp-08]
:0040264D 8945FC                  mov dword ptr [ebp-04], eax
:00402650 837DFC00                cmp dword ptr [ebp-04], 00000000
:00402654 740F                    je 00402665
:00402656 6A01                    push 00000001
:00402658 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040265B E8900C0000              call 004032F0
:00402660 8945F0                  mov dword ptr [ebp-10], eax
:00402663 EB07                    jmp 0040266C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402654(C)
|
:00402665 C745F000000000          mov [ebp-10], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402663(U)
|
:0040266C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040266F C7410C00000000          mov [ecx+0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040263F(C)
|
:00402676 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00402679 83C108                  add ecx, 00000008
:0040267C E8446C0100              call 004192C5
:00402681 8B55F4                  mov edx, dword ptr [ebp-0C]
:00402684 C7425C18FCFFFF          mov [edx+5C], FFFFFC18
:0040268B 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040268E C7406018FCFFFF          mov [eax+60], FFFFFC18
:00402695 8BE5                    mov esp, ebp
:00402697 5D                      pop ebp
:00402698 C20400                  ret 0004



* Referenced by a CALL at Address:
|:004259A7   
|
:0040269B 55                      push ebp
:0040269C 8BEC                    mov ebp, esp
:0040269E 51                      push ecx
:0040269F 894DFC                  mov dword ptr [ebp-04], ecx
:004026A2 6A03                    push 00000003
:004026A4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004026A7 E8F40F0000              call 004036A0
:004026AC 6A01                    push 00000001
:004026AE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004026B1 E8F8FEFFFF              call 004025AE
:004026B6 8BE5                    mov esp, ebp
:004026B8 5D                      pop ebp
:004026B9 C3                      ret



* Referenced by a CALL at Address:
|:0040257A   
|
:004026BA 55                      push ebp
:004026BB 8BEC                    mov ebp, esp
:004026BD 6AFF                    push FFFFFFFF
:004026BF 681E4F4800              push 00484F1E
:004026C4 64A100000000            mov eax, dword ptr fs:[00000000]
:004026CA 50                      push eax
:004026CB 64892500000000          mov dword ptr fs:[00000000], esp
:004026D2 83EC2C                  sub esp, 0000002C
:004026D5 894DD4                  mov dword ptr [ebp-2C], ecx
:004026D8 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:004026DB E825010000              call 00402805
:004026E0 85C0                    test eax, eax
:004026E2 0F840D010000            je 004027F5
:004026E8 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:004026EB E8D00F0000              call 004036C0
:004026F0 50                      push eax
:004026F1 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:004026F4 E84BFEFFFF              call 00402544
:004026F9 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:004026FC 894150                  mov dword ptr [ecx+50], eax
:004026FF 8B55D4                  mov edx, dword ptr [ebp-2C]
:00402702 837A0C00                cmp dword ptr [edx+0C], 00000000
:00402706 7435                    je 0040273D
:00402708 8B45D4                  mov eax, dword ptr [ebp-2C]
:0040270B 8B480C                  mov ecx, dword ptr [eax+0C]
:0040270E 894DE8                  mov dword ptr [ebp-18], ecx
:00402711 8B55E8                  mov edx, dword ptr [ebp-18]
:00402714 8955EC                  mov dword ptr [ebp-14], edx
:00402717 837DEC00                cmp dword ptr [ebp-14], 00000000
:0040271B 740F                    je 0040272C
:0040271D 6A01                    push 00000001
:0040271F 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00402722 E8C90B0000              call 004032F0
:00402727 8945D0                  mov dword ptr [ebp-30], eax
:0040272A EB07                    jmp 00402733

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040271B(C)
|
:0040272C C745D000000000          mov [ebp-30], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040272A(U)
|
:00402733 8B45D4                  mov eax, dword ptr [ebp-2C]
:00402736 C7400C00000000          mov [eax+0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402706(C)
|
:0040273D 6A00                    push 00000000
:0040273F E8ACE80700              call 00480FF0
:00402744 83C404                  add esp, 00000004
:00402747 8945F0                  mov dword ptr [ebp-10], eax

* Possible Reference to Dialog: DialogID_0140 
                                  |
:0040274A 6840010000              push 00000140
:0040274F E88CE80700              call 00480FE0
:00402754 83C404                  add esp, 00000004
:00402757 8945E4                  mov dword ptr [ebp-1C], eax
:0040275A C745FC00000000          mov [ebp-04], 00000000
:00402761 837DE400                cmp dword ptr [ebp-1C], 00000000
:00402765 740D                    je 00402774
:00402767 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0040276A E8010D0000              call 00403470
:0040276F 8945CC                  mov dword ptr [ebp-34], eax
:00402772 EB07                    jmp 0040277B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402765(C)
|
:00402774 C745CC00000000          mov [ebp-34], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402772(U)
|
:0040277B 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0040277E 894DE0                  mov dword ptr [ebp-20], ecx
:00402781 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00402788 8B55D4                  mov edx, dword ptr [ebp-2C]
:0040278B 8B45E0                  mov eax, dword ptr [ebp-20]
:0040278E 89420C                  mov dword ptr [edx+0C], eax
:00402791 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00402794 51                      push ecx
:00402795 E856E80700              call 00480FF0
:0040279A 83C404                  add esp, 00000004
:0040279D 8B55D4                  mov edx, dword ptr [ebp-2C]
:004027A0 837A0C00                cmp dword ptr [edx+0C], 00000000
:004027A4 7448                    je 004027EE
:004027A6 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:004027A9 E8F8000000              call 004028A6
:004027AE 85C0                    test eax, eax
:004027B0 7407                    je 004027B9
:004027B2 B801000000              mov eax, 00000001
:004027B7 EB3E                    jmp 004027F7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004027B0(C)
|
:004027B9 8B45D4                  mov eax, dword ptr [ebp-2C]
:004027BC 8B480C                  mov ecx, dword ptr [eax+0C]
:004027BF 894DD8                  mov dword ptr [ebp-28], ecx
:004027C2 8B55D8                  mov edx, dword ptr [ebp-28]
:004027C5 8955DC                  mov dword ptr [ebp-24], edx
:004027C8 837DDC00                cmp dword ptr [ebp-24], 00000000
:004027CC 740F                    je 004027DD
:004027CE 6A01                    push 00000001
:004027D0 8B4DDC                  mov ecx, dword ptr [ebp-24]
:004027D3 E8180B0000              call 004032F0
:004027D8 8945C8                  mov dword ptr [ebp-38], eax
:004027DB EB07                    jmp 004027E4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004027CC(C)
|
:004027DD C745C800000000          mov [ebp-38], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004027DB(U)
|
:004027E4 8B45D4                  mov eax, dword ptr [ebp-2C]
:004027E7 C7400C00000000          mov [eax+0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004027A4(C)
|
:004027EE B801000000              mov eax, 00000001
:004027F3 EB02                    jmp 004027F7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004026E2(C)
|
:004027F5 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004027B7(U), :004027F3(U)
|
:004027F7 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004027FA 64890D00000000          mov dword ptr fs:[00000000], ecx
:00402801 8BE5                    mov esp, ebp
:00402803 5D                      pop ebp
:00402804 C3                      ret



* Referenced by a CALL at Address:
|:004026DB   
|
:00402805 55                      push ebp
:00402806 8BEC                    mov ebp, esp
:00402808 83EC08                  sub esp, 00000008
:0040280B 894DF8                  mov dword ptr [ebp-08], ecx
:0040280E 6A14                    push 00000014
:00402810 8B45F8                  mov eax, dword ptr [ebp-08]
:00402813 83C01C                  add eax, 0000001C
:00402816 50                      push eax
:00402817 6A00                    push 00000000
:00402819 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040281C 83C108                  add ecx, 00000008
:0040281F E860690100              call 00419184
:00402824 8945FC                  mov dword ptr [ebp-04], eax
:00402827 837DFC14                cmp dword ptr [ebp-04], 00000014
:0040282B 751C                    jne 00402849
:0040282D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00402830 8B4120                  mov eax, dword ptr [ecx+20]
:00402833 33D2                    xor edx, edx
:00402835 B932000000              mov ecx, 00000032
:0040283A F7F1                    div ecx
:0040283C 8B55F8                  mov edx, dword ptr [ebp-08]
:0040283F 894220                  mov dword ptr [edx+20], eax
:00402842 B801000000              mov eax, 00000001
:00402847 EB02                    jmp 0040284B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040282B(C)
|
:00402849 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402847(U)
|
:0040284B 8BE5                    mov esp, ebp
:0040284D 5D                      pop ebp
:0040284E C3                      ret



* Referenced by a CALL at Addresses:
|:004025C0   , :0040303C   
|
:0040284F 55                      push ebp
:00402850 8BEC                    mov ebp, esp
:00402852 83EC08                  sub esp, 00000008
:00402855 894DF8                  mov dword ptr [ebp-08], ecx
:00402858 8B45F8                  mov eax, dword ptr [ebp-08]
:0040285B 83780400                cmp dword ptr [eax+04], 00000000
:0040285F 743F                    je 004028A0
:00402861 C745FC03010000          mov [ebp-04], 00000103

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040288F(U)
|
:00402868 817DFC03010000          cmp dword ptr [ebp-04], 00000103
:0040286F 7520                    jne 00402891
:00402871 E84EC20700              call 0047EAC4
:00402876 6A32                    push 00000032
:00402878 FF1544614800            call dword ptr [00486144]
:0040287E 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00402881 51                      push ecx
:00402882 8B55F8                  mov edx, dword ptr [ebp-08]
:00402885 8B4204                  mov eax, dword ptr [edx+04]
:00402888 50                      push eax
:00402889 FF1548614800            call dword ptr [00486148]
:0040288F EBD7                    jmp 00402868

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040286F(C)
|
:00402891 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00402894 C7410400000000          mov [ecx+04], 00000000
:0040289B 8B45FC                  mov eax, dword ptr [ebp-04]
:0040289E EB02                    jmp 004028A2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040285F(C)
|
:004028A0 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040289E(U)
|
:004028A2 8BE5                    mov esp, ebp
:004028A4 5D                      pop ebp
:004028A5 C3                      ret



* Referenced by a CALL at Address:
|:004027A9   
|
:004028A6 55                      push ebp
:004028A7 8BEC                    mov ebp, esp
:004028A9 83EC10                  sub esp, 00000010
:004028AC 894DF0                  mov dword ptr [ebp-10], ecx
:004028AF 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004028B2 E8090E0000              call 004036C0
:004028B7 8945F8                  mov dword ptr [ebp-08], eax
:004028BA 6A00                    push 00000000
:004028BC 8B45F0                  mov eax, dword ptr [ebp-10]
:004028BF 33C9                    xor ecx, ecx
:004028C1 8A481C                  mov cl, byte ptr [eax+1C]
:004028C4 6BC914                  imul ecx, 00000014
:004028C7 83C114                  add ecx, 00000014
:004028CA 51                      push ecx
:004028CB 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004028CE 83C108                  add ecx, 00000008
:004028D1 E849690100              call 0041921F
:004028D6 C745F400000000          mov [ebp-0C], 00000000
:004028DD EB09                    jmp 004028E8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402977(U)
|
:004028DF 8B55F4                  mov edx, dword ptr [ebp-0C]
:004028E2 83C201                  add edx, 00000001
:004028E5 8955F4                  mov dword ptr [ebp-0C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004028DD(U)
|
:004028E8 8B45F0                  mov eax, dword ptr [ebp-10]
:004028EB 33C9                    xor ecx, ecx
:004028ED 8A481D                  mov cl, byte ptr [eax+1D]
:004028F0 394DF4                  cmp dword ptr [ebp-0C], ecx
:004028F3 0F8D83000000            jnl 0040297C
:004028F9 8B55F0                  mov edx, dword ptr [ebp-10]
:004028FC 833A01                  cmp dword ptr [edx], 00000001
:004028FF 7407                    je 00402908
:00402901 33C0                    xor eax, eax
:00402903 E922010000              jmp 00402A2A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004028FF(C)
|
:00402908 6A00                    push 00000000
:0040290A E8E1E60700              call 00480FF0
:0040290F 83C404                  add esp, 00000004
:00402912 8945FC                  mov dword ptr [ebp-04], eax
:00402915 8B45F8                  mov eax, dword ptr [ebp-08]
:00402918 50                      push eax
:00402919 E8C2E60700              call 00480FE0
:0040291E 83C404                  add esp, 00000004
:00402921 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00402924 8B510C                  mov edx, dword ptr [ecx+0C]
:00402927 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040292A 89048A                  mov dword ptr [edx+4*ecx], eax
:0040292D 8B55FC                  mov edx, dword ptr [ebp-04]
:00402930 52                      push edx
:00402931 E8BAE60700              call 00480FF0
:00402936 83C404                  add esp, 00000004
:00402939 8B45F0                  mov eax, dword ptr [ebp-10]
:0040293C 8B480C                  mov ecx, dword ptr [eax+0C]
:0040293F 8B55F4                  mov edx, dword ptr [ebp-0C]
:00402942 833C9100                cmp dword ptr [ecx+4*edx], 00000000
:00402946 7507                    jne 0040294F
:00402948 33C0                    xor eax, eax
:0040294A E9DB000000              jmp 00402A2A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402946(C)
|
:0040294F 8B45F8                  mov eax, dword ptr [ebp-08]
:00402952 50                      push eax
:00402953 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00402956 8B510C                  mov edx, dword ptr [ecx+0C]
:00402959 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040295C 8B0C82                  mov ecx, dword ptr [edx+4*eax]
:0040295F 51                      push ecx
:00402960 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00402963 83C108                  add ecx, 00000008
:00402966 E8FC670100              call 00419167
:0040296B 3945F8                  cmp dword ptr [ebp-08], eax
:0040296E 7407                    je 00402977
:00402970 33C0                    xor eax, eax
:00402972 E9B3000000              jmp 00402A2A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040296E(C)
|
:00402977 E963FFFFFF              jmp 004028DF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004028F3(C)
|
:0040297C C745F400000000          mov [ebp-0C], 00000000
:00402983 EB09                    jmp 0040298E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402A20(U)
|
:00402985 8B55F4                  mov edx, dword ptr [ebp-0C]
:00402988 83C201                  add edx, 00000001
:0040298B 8955F4                  mov dword ptr [ebp-0C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402983(U)
|
:0040298E 8B45F0                  mov eax, dword ptr [ebp-10]
:00402991 33C9                    xor ecx, ecx
:00402993 8A481E                  mov cl, byte ptr [eax+1E]
:00402996 394DF4                  cmp dword ptr [ebp-0C], ecx
:00402999 0F8D86000000            jnl 00402A25
:0040299F 8B55F0                  mov edx, dword ptr [ebp-10]
:004029A2 833A01                  cmp dword ptr [edx], 00000001
:004029A5 7404                    je 004029AB
:004029A7 33C0                    xor eax, eax
:004029A9 EB7F                    jmp 00402A2A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004029A5(C)
|
:004029AB 6A00                    push 00000000
:004029AD E83EE60700              call 00480FF0
:004029B2 83C404                  add esp, 00000004
:004029B5 8945FC                  mov dword ptr [ebp-04], eax
:004029B8 8B45F8                  mov eax, dword ptr [ebp-08]
:004029BB 50                      push eax
:004029BC E81FE60700              call 00480FE0
:004029C1 83C404                  add esp, 00000004
:004029C4 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004029C7 8B510C                  mov edx, dword ptr [ecx+0C]
:004029CA 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004029CD 89848AA0000000          mov dword ptr [edx+4*ecx+000000A0], eax
:004029D4 8B55FC                  mov edx, dword ptr [ebp-04]
:004029D7 52                      push edx
:004029D8 E813E60700              call 00480FF0
:004029DD 83C404                  add esp, 00000004
:004029E0 8B45F0                  mov eax, dword ptr [ebp-10]
:004029E3 8B480C                  mov ecx, dword ptr [eax+0C]
:004029E6 8B55F4                  mov edx, dword ptr [ebp-0C]
:004029E9 83BC91A000000000        cmp dword ptr [ecx+4*edx+000000A0], 00000000
:004029F1 7504                    jne 004029F7
:004029F3 33C0                    xor eax, eax
:004029F5 EB33                    jmp 00402A2A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004029F1(C)
|
:004029F7 8B45F8                  mov eax, dword ptr [ebp-08]
:004029FA 50                      push eax
:004029FB 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004029FE 8B510C                  mov edx, dword ptr [ecx+0C]
:00402A01 8B45F4                  mov eax, dword ptr [ebp-0C]
:00402A04 8B8C82A0000000          mov ecx, dword ptr [edx+4*eax+000000A0]
:00402A0B 51                      push ecx
:00402A0C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00402A0F 83C108                  add ecx, 00000008
:00402A12 E850670100              call 00419167
:00402A17 3945F8                  cmp dword ptr [ebp-08], eax
:00402A1A 7404                    je 00402A20
:00402A1C 33C0                    xor eax, eax
:00402A1E EB0A                    jmp 00402A2A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402A1A(C)
|
:00402A20 E960FFFFFF              jmp 00402985

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402999(C)
|
:00402A25 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00402903(U), :0040294A(U), :00402972(U), :004029A9(U), :004029F5(U)
|:00402A1E(U)
|
:00402A2A 8BE5                    mov esp, ebp
:00402A2C 5D                      pop ebp
:00402A2D C3                      ret



* Referenced by a CALL at Address:
|:00403084   
|
:00402A2E 55                      push ebp
:00402A2F 8BEC                    mov ebp, esp
:00402A31 83EC0C                  sub esp, 0000000C
:00402A34 56                      push esi
:00402A35 894DF4                  mov dword ptr [ebp-0C], ecx
:00402A38 8B4508                  mov eax, dword ptr [ebp+08]
:00402A3B 25FF000000              and eax, 000000FF
:00402A40 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00402A43 33D2                    xor edx, edx
:00402A45 8A511C                  mov dl, byte ptr [ecx+1C]
:00402A48 8BCA                    mov ecx, edx
:00402A4A 99                      cdq
:00402A4B F7F9                    idiv ecx
:00402A4D 885508                  mov byte ptr [ebp+08], dl
:00402A50 8B5508                  mov edx, dword ptr [ebp+08]
:00402A53 81E2FF000000            and edx, 000000FF
:00402A59 6BD214                  imul edx, 00000014
:00402A5C 83C214                  add edx, 00000014
:00402A5F 8955FC                  mov dword ptr [ebp-04], edx
:00402A62 6A00                    push 00000000
:00402A64 8B45FC                  mov eax, dword ptr [ebp-04]
:00402A67 50                      push eax
:00402A68 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00402A6B 83C108                  add ecx, 00000008
:00402A6E E8AC670100              call 0041921F
:00402A73 6A14                    push 00000014
:00402A75 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00402A78 83C130                  add ecx, 00000030
:00402A7B 51                      push ecx
:00402A7C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00402A7F 83C108                  add ecx, 00000008
:00402A82 E8E0660100              call 00419167
:00402A87 8945F8                  mov dword ptr [ebp-08], eax
:00402A8A 837DF814                cmp dword ptr [ebp-08], 00000014
:00402A8E 0F8518020000            jne 00402CAC
:00402A94 8B55F4                  mov edx, dword ptr [ebp-0C]
:00402A97 33C0                    xor eax, eax
:00402A99 8A421C                  mov al, byte ptr [edx+1C]
:00402A9C 6BC014                  imul eax, 00000014
:00402A9F 83C014                  add eax, 00000014
:00402AA2 8945FC                  mov dword ptr [ebp-04], eax
:00402AA5 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00402AA8 83790C00                cmp dword ptr [ecx+0C], 00000000
:00402AAC 757C                    jne 00402B2A
:00402AAE 8B55F4                  mov edx, dword ptr [ebp-0C]
:00402AB1 837A4400                cmp dword ptr [edx+44], 00000000
:00402AB5 7517                    jne 00402ACE
:00402AB7 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00402ABA E8010C0000              call 004036C0
:00402ABF 50                      push eax
:00402AC0 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00402AC3 E87CFAFFFF              call 00402544
:00402AC8 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00402ACB 894144                  mov dword ptr [ecx+44], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402AB5(C)
|
:00402ACE 6A00                    push 00000000
:00402AD0 8B55F4                  mov edx, dword ptr [ebp-0C]
:00402AD3 33C0                    xor eax, eax
:00402AD5 8A4230                  mov al, byte ptr [edx+30]
:00402AD8 8BF0                    mov esi, eax
:00402ADA 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00402ADD E8DE0B0000              call 004036C0
:00402AE2 0FAFF0                  imul esi, eax
:00402AE5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00402AE8 03CE                    add ecx, esi
:00402AEA 51                      push ecx
:00402AEB 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00402AEE 83C108                  add ecx, 00000008
:00402AF1 E829670100              call 0041921F
:00402AF6 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00402AF9 E8C20B0000              call 004036C0
:00402AFE 50                      push eax
:00402AFF 8B55F4                  mov edx, dword ptr [ebp-0C]
:00402B02 8B4244                  mov eax, dword ptr [edx+44]
:00402B05 50                      push eax
:00402B06 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00402B09 83C108                  add ecx, 00000008
:00402B0C E856660100              call 00419167
:00402B11 8945F8                  mov dword ptr [ebp-08], eax
:00402B14 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00402B17 E8A40B0000              call 004036C0
:00402B1C 3945F8                  cmp dword ptr [ebp-08], eax
:00402B1F 7407                    je 00402B28
:00402B21 33C0                    xor eax, eax
:00402B23 E986010000              jmp 00402CAE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402B1F(C)
|
:00402B28 EB17                    jmp 00402B41

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402AAC(C)
|
:00402B2A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00402B2D 33D2                    xor edx, edx
:00402B2F 8A5130                  mov dl, byte ptr [ecx+30]
:00402B32 8B45F4                  mov eax, dword ptr [ebp-0C]
:00402B35 8B480C                  mov ecx, dword ptr [eax+0C]
:00402B38 8B45F4                  mov eax, dword ptr [ebp-0C]
:00402B3B 8B0C91                  mov ecx, dword ptr [ecx+4*edx]
:00402B3E 894844                  mov dword ptr [eax+44], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402B28(U)
|
:00402B41 8B55F4                  mov edx, dword ptr [ebp-0C]
:00402B44 33C0                    xor eax, eax
:00402B46 8A421D                  mov al, byte ptr [edx+1D]
:00402B49 8BF0                    mov esi, eax
:00402B4B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00402B4E E86D0B0000              call 004036C0
:00402B53 0FAFF0                  imul esi, eax
:00402B56 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00402B59 03CE                    add ecx, esi
:00402B5B 894DFC                  mov dword ptr [ebp-04], ecx
:00402B5E 8B55F4                  mov edx, dword ptr [ebp-0C]
:00402B61 837A3400                cmp dword ptr [edx+34], 00000000
:00402B65 0F84A0000000            je 00402C0B
:00402B6B 8B45F4                  mov eax, dword ptr [ebp-0C]
:00402B6E 83780C00                cmp dword ptr [eax+0C], 00000000
:00402B72 757C                    jne 00402BF0
:00402B74 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00402B77 83794800                cmp dword ptr [ecx+48], 00000000
:00402B7B 7517                    jne 00402B94
:00402B7D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00402B80 E83B0B0000              call 004036C0
:00402B85 50                      push eax
:00402B86 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00402B89 E8B6F9FFFF              call 00402544
:00402B8E 8B55F4                  mov edx, dword ptr [ebp-0C]
:00402B91 894248                  mov dword ptr [edx+48], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402B7B(C)
|
:00402B94 6A00                    push 00000000
:00402B96 8B45F4                  mov eax, dword ptr [ebp-0C]
:00402B99 33C9                    xor ecx, ecx
:00402B9B 8A4832                  mov cl, byte ptr [eax+32]
:00402B9E 8BF1                    mov esi, ecx
:00402BA0 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00402BA3 E8180B0000              call 004036C0
:00402BA8 0FAFF0                  imul esi, eax
:00402BAB 8B55FC                  mov edx, dword ptr [ebp-04]
:00402BAE 03D6                    add edx, esi
:00402BB0 52                      push edx
:00402BB1 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00402BB4 83C108                  add ecx, 00000008
:00402BB7 E863660100              call 0041921F
:00402BBC 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00402BBF E8FC0A0000              call 004036C0
:00402BC4 50                      push eax
:00402BC5 8B45F4                  mov eax, dword ptr [ebp-0C]
:00402BC8 8B4848                  mov ecx, dword ptr [eax+48]
:00402BCB 51                      push ecx
:00402BCC 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00402BCF 83C108                  add ecx, 00000008
:00402BD2 E890650100              call 00419167
:00402BD7 8945F8                  mov dword ptr [ebp-08], eax
:00402BDA 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00402BDD E8DE0A0000              call 004036C0
:00402BE2 3945F8                  cmp dword ptr [ebp-08], eax
:00402BE5 7407                    je 00402BEE
:00402BE7 33C0                    xor eax, eax
:00402BE9 E9C0000000              jmp 00402CAE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402BE5(C)
|
:00402BEE EB1B                    jmp 00402C0B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402B72(C)
|
:00402BF0 8B55F4                  mov edx, dword ptr [ebp-0C]
:00402BF3 8B420C                  mov eax, dword ptr [edx+0C]
:00402BF6 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00402BF9 33D2                    xor edx, edx
:00402BFB 8A5132                  mov dl, byte ptr [ecx+32]
:00402BFE 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00402C01 8B9490A0000000          mov edx, dword ptr [eax+4*edx+000000A0]
:00402C08 895148                  mov dword ptr [ecx+48], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00402B65(C), :00402BEE(U)
|
:00402C0B 8B45F4                  mov eax, dword ptr [ebp-0C]
:00402C0E 33C9                    xor ecx, ecx
:00402C10 8A481E                  mov cl, byte ptr [eax+1E]
:00402C13 8BF1                    mov esi, ecx
:00402C15 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00402C18 E8A30A0000              call 004036C0
:00402C1D 0FAFF0                  imul esi, eax
:00402C20 8B55FC                  mov edx, dword ptr [ebp-04]
:00402C23 03D6                    add edx, esi
:00402C25 8955FC                  mov dword ptr [ebp-04], edx
:00402C28 8B45F4                  mov eax, dword ptr [ebp-0C]
:00402C2B 33C9                    xor ecx, ecx
:00402C2D 8A4831                  mov cl, byte ptr [eax+31]
:00402C30 81F9FF000000            cmp ecx, 000000FF
:00402C36 7464                    je 00402C9C
:00402C38 8B55F4                  mov edx, dword ptr [ebp-0C]
:00402C3B 837A4C00                cmp dword ptr [edx+4C], 00000000
:00402C3F 7513                    jne 00402C54
:00402C41 6800030000              push 00000300
:00402C46 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00402C49 E8F6F8FFFF              call 00402544
:00402C4E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00402C51 89414C                  mov dword ptr [ecx+4C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402C3F(C)
|
:00402C54 6A00                    push 00000000
:00402C56 8B55F4                  mov edx, dword ptr [ebp-0C]
:00402C59 33C0                    xor eax, eax
:00402C5B 8A4231                  mov al, byte ptr [edx+31]
:00402C5E 69C000030000            imul eax, 00000300
:00402C64 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00402C67 03C8                    add ecx, eax
:00402C69 51                      push ecx
:00402C6A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00402C6D 83C108                  add ecx, 00000008
:00402C70 E8AA650100              call 0041921F
:00402C75 6800030000              push 00000300
:00402C7A 8B55F4                  mov edx, dword ptr [ebp-0C]
:00402C7D 8B424C                  mov eax, dword ptr [edx+4C]
:00402C80 50                      push eax
:00402C81 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00402C84 83C108                  add ecx, 00000008
:00402C87 E8DB640100              call 00419167
:00402C8C 8945F8                  mov dword ptr [ebp-08], eax
:00402C8F 817DF800030000          cmp dword ptr [ebp-08], 00000300
:00402C96 7404                    je 00402C9C
:00402C98 33C0                    xor eax, eax
:00402C9A EB12                    jmp 00402CAE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00402C36(C), :00402C96(C)
|
:00402C9C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00402C9F 8A5508                  mov dl, byte ptr [ebp+08]
:00402CA2 885158                  mov byte ptr [ecx+58], dl
:00402CA5 B801000000              mov eax, 00000001
:00402CAA EB02                    jmp 00402CAE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402A8E(C)
|
:00402CAC 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00402B23(U), :00402BE9(U), :00402C9A(U), :00402CAA(U)
|
:00402CAE 5E                      pop esi
:00402CAF 8BE5                    mov esp, ebp
:00402CB1 5D                      pop ebp
:00402CB2 C20400                  ret 0004



* Referenced by a CALL at Address:
|:004030A2   
|
:00402CB5 55                      push ebp
:00402CB6 8BEC                    mov ebp, esp
:00402CB8 83EC08                  sub esp, 00000008
:00402CBB 894DF8                  mov dword ptr [ebp-08], ecx
:00402CBE 8B45F8                  mov eax, dword ptr [ebp-08]
:00402CC1 8B4024                  mov eax, dword ptr [eax+24]
:00402CC4 99                      cdq
:00402CC5 2BC2                    sub eax, edx
:00402CC7 D1F8                    sar eax, 1
:00402CC9 8B4D08                  mov ecx, dword ptr [ebp+08]
:00402CCC 2BC8                    sub ecx, eax
:00402CCE 894D08                  mov dword ptr [ebp+08], ecx
:00402CD1 8B55F8                  mov edx, dword ptr [ebp-08]
:00402CD4 8B4228                  mov eax, dword ptr [edx+28]
:00402CD7 99                      cdq
:00402CD8 2BC2                    sub eax, edx
:00402CDA D1F8                    sar eax, 1
:00402CDC 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00402CDF 2BC8                    sub ecx, eax
:00402CE1 894D0C                  mov dword ptr [ebp+0C], ecx
:00402CE4 6A00                    push 00000000
:00402CE6 6A00                    push 00000000
:00402CE8 6A00                    push 00000000
:00402CEA E802A50700              call 0047D1F1
:00402CEF 83C40C                  add esp, 0000000C
:00402CF2 6A00                    push 00000000
:00402CF4 E8ACBE0700              call 0047EBA5
:00402CF9 83C404                  add esp, 00000004
:00402CFC 837D1000                cmp dword ptr [ebp+10], 00000000
:00402D00 751F                    jne 00402D21
:00402D02 8B55F8                  mov edx, dword ptr [ebp-08]
:00402D05 8B4508                  mov eax, dword ptr [ebp+08]
:00402D08 034238                  add eax, dword ptr [edx+38]
:00402D0B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00402D0E 39415C                  cmp dword ptr [ecx+5C], eax
:00402D11 750E                    jne 00402D21
:00402D13 8B55F8                  mov edx, dword ptr [ebp-08]
:00402D16 8B45F8                  mov eax, dword ptr [ebp-08]
:00402D19 8B4A60                  mov ecx, dword ptr [edx+60]
:00402D1C 3B483C                  cmp ecx, dword ptr [eax+3C]
:00402D1F 747A                    je 00402D9B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00402D00(C), :00402D11(C)
|
:00402D21 837D1000                cmp dword ptr [ebp+10], 00000000
:00402D25 752B                    jne 00402D52
:00402D27 8B55F8                  mov edx, dword ptr [ebp-08]
:00402D2A 8B4250                  mov eax, dword ptr [edx+50]
:00402D2D 50                      push eax
:00402D2E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00402D31 8B5128                  mov edx, dword ptr [ecx+28]
:00402D34 52                      push edx
:00402D35 8B45F8                  mov eax, dword ptr [ebp-08]
:00402D38 8B4824                  mov ecx, dword ptr [eax+24]
:00402D3B 51                      push ecx
:00402D3C 8B55F8                  mov edx, dword ptr [ebp-08]
:00402D3F 8B4260                  mov eax, dword ptr [edx+60]
:00402D42 50                      push eax
:00402D43 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00402D46 8B515C                  mov edx, dword ptr [ecx+5C]
:00402D49 52                      push edx
:00402D4A E84CB30700              call 0047E09B
:00402D4F 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402D25(C)
|
:00402D52 8B45F8                  mov eax, dword ptr [ebp-08]
:00402D55 8B4D08                  mov ecx, dword ptr [ebp+08]
:00402D58 034838                  add ecx, dword ptr [eax+38]
:00402D5B 8B55F8                  mov edx, dword ptr [ebp-08]
:00402D5E 894A5C                  mov dword ptr [edx+5C], ecx
:00402D61 8B45F8                  mov eax, dword ptr [ebp-08]
:00402D64 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00402D67 03483C                  add ecx, dword ptr [eax+3C]
:00402D6A 8B55F8                  mov edx, dword ptr [ebp-08]
:00402D6D 894A60                  mov dword ptr [edx+60], ecx
:00402D70 8B45F8                  mov eax, dword ptr [ebp-08]
:00402D73 8B4850                  mov ecx, dword ptr [eax+50]
:00402D76 51                      push ecx
:00402D77 8B55F8                  mov edx, dword ptr [ebp-08]
:00402D7A 8B4228                  mov eax, dword ptr [edx+28]
:00402D7D 50                      push eax
:00402D7E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00402D81 8B5124                  mov edx, dword ptr [ecx+24]
:00402D84 52                      push edx
:00402D85 8B45F8                  mov eax, dword ptr [ebp-08]
:00402D88 8B4860                  mov ecx, dword ptr [eax+60]
:00402D8B 51                      push ecx
:00402D8C 8B55F8                  mov edx, dword ptr [ebp-08]
:00402D8F 8B425C                  mov eax, dword ptr [edx+5C]
:00402D92 50                      push eax
:00402D93 E8B9B40700              call 0047E251
:00402D98 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402D1F(C)
|
:00402D9B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00402D9E 83790C00                cmp dword ptr [ecx+0C], 00000000
:00402DA2 750E                    jne 00402DB2
:00402DA4 8B55F8                  mov edx, dword ptr [ebp-08]
:00402DA7 8B45F8                  mov eax, dword ptr [ebp-08]
:00402DAA 8B4844                  mov ecx, dword ptr [eax+44]
:00402DAD 894A54                  mov dword ptr [edx+54], ecx
:00402DB0 EB20                    jmp 00402DD2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402DA2(C)
|
:00402DB2 8B55F8                  mov edx, dword ptr [ebp-08]
:00402DB5 837A5400                cmp dword ptr [edx+54], 00000000
:00402DB9 7517                    jne 00402DD2
:00402DBB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00402DBE E8FD080000              call 004036C0
:00402DC3 50                      push eax
:00402DC4 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00402DC7 E878F7FFFF              call 00402544
:00402DCC 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00402DCF 894154                  mov dword ptr [ecx+54], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00402DB0(U), :00402DB9(C)
|
:00402DD2 C745FC00000000          mov [ebp-04], 00000000
:00402DD9 8B55F8                  mov edx, dword ptr [ebp-08]
:00402DDC 33C0                    xor eax, eax
:00402DDE 8A4231                  mov al, byte ptr [edx+31]
:00402DE1 83F828                  cmp eax, 00000028
:00402DE4 7D09                    jge 00402DEF
:00402DE6 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00402DE9 8B514C                  mov edx, dword ptr [ecx+4C]
:00402DEC 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402DE4(C)
|
:00402DEF 8B45F8                  mov eax, dword ptr [ebp-08]
:00402DF2 83783400                cmp dword ptr [eax+34], 00000000
:00402DF6 7452                    je 00402E4A
:00402DF8 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00402DFB 8A5133                  mov dl, byte ptr [ecx+33]
:00402DFE 52                      push edx
:00402DFF 8B45FC                  mov eax, dword ptr [ebp-04]
:00402E02 50                      push eax
:00402E03 6A04                    push 00000004
:00402E05 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00402E08 8B5154                  mov edx, dword ptr [ecx+54]
:00402E0B 52                      push edx
:00402E0C 8B45F8                  mov eax, dword ptr [ebp-08]
:00402E0F 8B4850                  mov ecx, dword ptr [eax+50]
:00402E12 51                      push ecx
:00402E13 8B55F8                  mov edx, dword ptr [ebp-08]
:00402E16 8B4248                  mov eax, dword ptr [edx+48]
:00402E19 50                      push eax
:00402E1A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00402E1D 8B5144                  mov edx, dword ptr [ecx+44]
:00402E20 52                      push edx
:00402E21 8B45F8                  mov eax, dword ptr [ebp-08]
:00402E24 8B4828                  mov ecx, dword ptr [eax+28]
:00402E27 51                      push ecx
:00402E28 8B55F8                  mov edx, dword ptr [ebp-08]
:00402E2B 8B4224                  mov eax, dword ptr [edx+24]
:00402E2E 50                      push eax
:00402E2F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00402E32 8B5160                  mov edx, dword ptr [ecx+60]
:00402E35 52                      push edx
:00402E36 8B45F8                  mov eax, dword ptr [ebp-08]
:00402E39 8B485C                  mov ecx, dword ptr [eax+5C]
:00402E3C 51                      push ecx
:00402E3D E827D50200              call 00430369
:00402E42 83C42C                  add esp, 0000002C
:00402E45 E9C7000000              jmp 00402F11

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402DF6(C)
|
:00402E4A 8B55F8                  mov edx, dword ptr [ebp-08]
:00402E4D 33C0                    xor eax, eax
:00402E4F 8A4232                  mov al, byte ptr [edx+32]
:00402E52 85C0                    test eax, eax
:00402E54 7506                    jne 00402E5C
:00402E56 837DFC00                cmp dword ptr [ebp-04], 00000000
:00402E5A 7451                    je 00402EAD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402E54(C)
|
:00402E5C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00402E5F 8A5133                  mov dl, byte ptr [ecx+33]
:00402E62 52                      push edx
:00402E63 8B45FC                  mov eax, dword ptr [ebp-04]
:00402E66 50                      push eax
:00402E67 6A00                    push 00000000
:00402E69 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00402E6C 8A5132                  mov dl, byte ptr [ecx+32]
:00402E6F 52                      push edx
:00402E70 6A04                    push 00000004
:00402E72 8B45F8                  mov eax, dword ptr [ebp-08]
:00402E75 8B4854                  mov ecx, dword ptr [eax+54]
:00402E78 51                      push ecx
:00402E79 8B55F8                  mov edx, dword ptr [ebp-08]
:00402E7C 8B4250                  mov eax, dword ptr [edx+50]
:00402E7F 50                      push eax
:00402E80 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00402E83 8B5144                  mov edx, dword ptr [ecx+44]
:00402E86 52                      push edx
:00402E87 8B45F8                  mov eax, dword ptr [ebp-08]
:00402E8A 8B4828                  mov ecx, dword ptr [eax+28]
:00402E8D 51                      push ecx
:00402E8E 8B55F8                  mov edx, dword ptr [ebp-08]
:00402E91 8B4224                  mov eax, dword ptr [edx+24]
:00402E94 50                      push eax
:00402E95 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00402E98 8B5160                  mov edx, dword ptr [ecx+60]
:00402E9B 52                      push edx
:00402E9C 8B45F8                  mov eax, dword ptr [ebp-08]
:00402E9F 8B485C                  mov ecx, dword ptr [eax+5C]
:00402EA2 51                      push ecx
:00402EA3 E866D40200              call 0043030E
:00402EA8 83C430                  add esp, 00000030
:00402EAB EB64                    jmp 00402F11

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402E5A(C)
|
:00402EAD 8B55F8                  mov edx, dword ptr [ebp-08]
:00402EB0 8B4250                  mov eax, dword ptr [edx+50]
:00402EB3 50                      push eax
:00402EB4 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00402EB7 8B5128                  mov edx, dword ptr [ecx+28]
:00402EBA 52                      push edx
:00402EBB 8B45F8                  mov eax, dword ptr [ebp-08]
:00402EBE 8B4824                  mov ecx, dword ptr [eax+24]
:00402EC1 51                      push ecx
:00402EC2 8B55F8                  mov edx, dword ptr [ebp-08]
:00402EC5 8B4260                  mov eax, dword ptr [edx+60]
:00402EC8 50                      push eax
:00402EC9 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00402ECC 8B515C                  mov edx, dword ptr [ecx+5C]
:00402ECF 52                      push edx
:00402ED0 E8C6B10700              call 0047E09B
:00402ED5 83C414                  add esp, 00000014
:00402ED8 6A00                    push 00000000
:00402EDA 6A00                    push 00000000
:00402EDC 6A04                    push 00000004
:00402EDE E80EA30700              call 0047D1F1
:00402EE3 83C40C                  add esp, 0000000C
:00402EE6 8B45F8                  mov eax, dword ptr [ebp-08]
:00402EE9 8B4844                  mov ecx, dword ptr [eax+44]
:00402EEC 51                      push ecx
:00402EED 8B55F8                  mov edx, dword ptr [ebp-08]
:00402EF0 8B4228                  mov eax, dword ptr [edx+28]
:00402EF3 50                      push eax
:00402EF4 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00402EF7 8B5124                  mov edx, dword ptr [ecx+24]
:00402EFA 52                      push edx
:00402EFB 8B45F8                  mov eax, dword ptr [ebp-08]
:00402EFE 8B4860                  mov ecx, dword ptr [eax+60]
:00402F01 51                      push ecx
:00402F02 8B55F8                  mov edx, dword ptr [ebp-08]
:00402F05 8B425C                  mov eax, dword ptr [edx+5C]
:00402F08 50                      push eax
:00402F09 E88DB10700              call 0047E09B
:00402F0E 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00402E45(U), :00402EAB(U)
|
:00402F11 6A01                    push 00000001
:00402F13 E88DBC0700              call 0047EBA5
:00402F18 83C404                  add esp, 00000004
:00402F1B 8BE5                    mov esp, ebp
:00402F1D 5D                      pop ebp
:00402F1E C20C00                  ret 000C


:00402F21 55                      push ebp
:00402F22 8BEC                    mov ebp, esp
:00402F24 51                      push ecx
:00402F25 56                      push esi
:00402F26 57                      push edi
:00402F27 894DFC                  mov dword ptr [ebp-04], ecx
:00402F2A 8B45FC                  mov eax, dword ptr [ebp-04]
:00402F2D 33C9                    xor ecx, ecx
:00402F2F 8A481C                  mov cl, byte ptr [eax+1C]
:00402F32 8BF1                    mov esi, ecx
:00402F34 6BF614                  imul esi, 00000014
:00402F37 8B55FC                  mov edx, dword ptr [ebp-04]
:00402F3A 33C0                    xor eax, eax
:00402F3C 8A421D                  mov al, byte ptr [edx+1D]
:00402F3F 8BF8                    mov edi, eax
:00402F41 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00402F44 E877070000              call 004036C0
:00402F49 0FAFF8                  imul edi, eax
:00402F4C 8D743E14                lea esi, dword ptr [esi+edi+14]
:00402F50 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00402F53 33D2                    xor edx, edx
:00402F55 8A511E                  mov dl, byte ptr [ecx+1E]
:00402F58 8BFA                    mov edi, edx
:00402F5A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00402F5D E85E070000              call 004036C0
:00402F62 0FAFF8                  imul edi, eax
:00402F65 03F7                    add esi, edi
:00402F67 8B45FC                  mov eax, dword ptr [ebp-04]
:00402F6A 33C9                    xor ecx, ecx
:00402F6C 8A481F                  mov cl, byte ptr [eax+1F]
:00402F6F 69C900030000            imul ecx, 00000300
:00402F75 03F1                    add esi, ecx
:00402F77 8BC6                    mov eax, esi
:00402F79 5F                      pop edi
:00402F7A 5E                      pop esi
:00402F7B 8BE5                    mov esp, ebp
:00402F7D 5D                      pop ebp
:00402F7E C3                      ret



* Referenced by a CALL at Address:
|:0042186E   
|
:00402F7F 55                      push ebp
:00402F80 8BEC                    mov ebp, esp
:00402F82 83EC08                  sub esp, 00000008
:00402F85 894DF8                  mov dword ptr [ebp-08], ecx
:00402F88 6A01                    push 00000001
:00402F8A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00402F8D E81CF6FFFF              call 004025AE
:00402F92 8B45F8                  mov eax, dword ptr [ebp-08]
:00402F95 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00402F98 894810                  mov dword ptr [eax+10], ecx
:00402F9B 8B55F8                  mov edx, dword ptr [ebp-08]
:00402F9E 8B4510                  mov eax, dword ptr [ebp+10]
:00402FA1 894214                  mov dword ptr [edx+14], eax
:00402FA4 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00402FA7 83C108                  add ecx, 00000008
:00402FAA E816630100              call 004192C5
:00402FAF 6A00                    push 00000000
:00402FB1 8B4D08                  mov ecx, dword ptr [ebp+08]
:00402FB4 51                      push ecx
:00402FB5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00402FB8 83C108                  add ecx, 00000008
:00402FBB E89C5F0100              call 00418F5C
:00402FC0 85C0                    test eax, eax
:00402FC2 7448                    je 0040300C
:00402FC4 6A01                    push 00000001
:00402FC6 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00402FC9 E8D2060000              call 004036A0
:00402FCE 8D55FC                  lea edx, dword ptr [ebp-04]
:00402FD1 52                      push edx
:00402FD2 6A00                    push 00000000
:00402FD4 8B45F8                  mov eax, dword ptr [ebp-08]
:00402FD7 50                      push eax

* Possible StringData Ref from Code Obj ->"UM;"
                                  |
:00402FD8 6874254000              push 00402574
:00402FDD 6A00                    push 00000000
:00402FDF 6A00                    push 00000000
:00402FE1 FF153C614800            call dword ptr [0048613C]
:00402FE7 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00402FEA 894104                  mov dword ptr [ecx+04], eax
:00402FED 8B55F8                  mov edx, dword ptr [ebp-08]
:00402FF0 837A0400                cmp dword ptr [edx+04], 00000000
:00402FF4 740F                    je 00403005
:00402FF6 6A02                    push 00000002
:00402FF8 8B45F8                  mov eax, dword ptr [ebp-08]
:00402FFB 8B4804                  mov ecx, dword ptr [eax+04]
:00402FFE 51                      push ecx
:00402FFF FF1534614800            call dword ptr [00486134]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402FF4(C)
|
:00403005 B801000000              mov eax, 00000001
:0040300A EB02                    jmp 0040300E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402FC2(C)
|
:0040300C 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040300A(U)
|
:0040300E 8BE5                    mov esp, ebp
:00403010 5D                      pop ebp
:00403011 C20C00                  ret 000C



* Referenced by a CALL at Address:
|:0042188D   
|
:00403014 55                      push ebp
:00403015 8BEC                    mov ebp, esp
:00403017 6AFF                    push FFFFFFFF
:00403019 68284F4800              push 00484F28
:0040301E 64A100000000            mov eax, dword ptr fs:[00000000]
:00403024 50                      push eax
:00403025 64892500000000          mov dword ptr fs:[00000000], esp
:0040302C 51                      push ecx
:0040302D 83EC08                  sub esp, 00000008
:00403030 53                      push ebx
:00403031 56                      push esi
:00403032 57                      push edi
:00403033 8965F0                  mov dword ptr [ebp-10], esp
:00403036 894DE8                  mov dword ptr [ebp-18], ecx
:00403039 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0040303C E80EF8FFFF              call 0040284F
:00403041 8B45E8                  mov eax, dword ptr [ebp-18]
:00403044 833802                  cmp dword ptr [eax], 00000002
:00403047 0F85DD000000            jne 0040312A
:0040304D C745FC00000000          mov [ebp-04], 00000000
:00403054 C645EC00                mov [ebp-14], 00
:00403058 EB09                    jmp 00403063

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004030D6(U)
|
:0040305A 8A4DEC                  mov cl, byte ptr [ebp-14]
:0040305D 80C101                  add cl, 01
:00403060 884DEC                  mov byte ptr [ebp-14], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403058(U)
|
:00403063 8B55EC                  mov edx, dword ptr [ebp-14]
:00403066 81E2FF000000            and edx, 000000FF
:0040306C 8B45E8                  mov eax, dword ptr [ebp-18]
:0040306F 33C9                    xor ecx, ecx
:00403071 8A481C                  mov cl, byte ptr [eax+1C]
:00403074 3BD1                    cmp edx, ecx
:00403076 7D60                    jge 004030D8
:00403078 E85EB50100              call 0041E5DB
:0040307D 8A55EC                  mov dl, byte ptr [ebp-14]
:00403080 52                      push edx
:00403081 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00403084 E8A5F9FFFF              call 00402A2E
:00403089 8B45EC                  mov eax, dword ptr [ebp-14]
:0040308C 25FF000000              and eax, 000000FF
:00403091 F7D8                    neg eax
:00403093 1BC0                    sbb eax, eax
:00403095 40                      inc eax
:00403096 50                      push eax
:00403097 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0040309A 51                      push ecx
:0040309B 8B5508                  mov edx, dword ptr [ebp+08]
:0040309E 52                      push edx
:0040309F 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004030A2 E80EFCFFFF              call 00402CB5
:004030A7 E834940200              call 0042C4E0
:004030AC 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004030AF E8AE010000              call 00403262
:004030B4 85C0                    test eax, eax
:004030B6 7408                    je 004030C0
:004030B8 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004030BB E887000000              call 00403147

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004030B6(C)
|
:004030C0 E831B50100              call 0041E5F6
:004030C5 8B45E8                  mov eax, dword ptr [ebp-18]
:004030C8 8B4820                  mov ecx, dword ptr [eax+20]
:004030CB 51                      push ecx
:004030CC B9181B4B00              mov ecx, 004B1B18
:004030D1 E86A020000              call 00403340
:004030D6 EB82                    jmp 0040305A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403076(C)
|
:004030D8 E803940200              call 0042C4E0
:004030DD 8B55E8                  mov edx, dword ptr [ebp-18]
:004030E0 8B4250                  mov eax, dword ptr [edx+50]
:004030E3 50                      push eax
:004030E4 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004030E7 8B5128                  mov edx, dword ptr [ecx+28]
:004030EA 52                      push edx
:004030EB 8B45E8                  mov eax, dword ptr [ebp-18]
:004030EE 8B4824                  mov ecx, dword ptr [eax+24]
:004030F1 51                      push ecx
:004030F2 8B55E8                  mov edx, dword ptr [ebp-18]
:004030F5 8B4260                  mov eax, dword ptr [edx+60]
:004030F8 50                      push eax
:004030F9 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004030FC 8B515C                  mov edx, dword ptr [ecx+5C]
:004030FF 52                      push edx
:00403100 E896AF0700              call 0047E09B
:00403105 83C414                  add esp, 00000014
:00403108 EB19                    jmp 00403123
:0040310A 6A01                    push 00000001
:0040310C 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0040310F E89AF4FFFF              call 004025AE
:00403114 6A00                    push 00000000
:00403116 6A00                    push 00000000
:00403118 E813DF0700              call 00481030
:0040311D B823314000              mov eax, 00403123
:00403122 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403108(U)
|
:00403123 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403047(C)
|
:0040312A 6A01                    push 00000001
:0040312C 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0040312F E87AF4FFFF              call 004025AE
:00403134 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00403137 64890D00000000          mov dword ptr fs:[00000000], ecx
:0040313E 5F                      pop edi
:0040313F 5E                      pop esi
:00403140 5B                      pop ebx
:00403141 8BE5                    mov esp, ebp
:00403143 5D                      pop ebp
:00403144 C20800                  ret 0008



* Referenced by a CALL at Address:
|:004030BB   
|
:00403147 55                      push ebp
:00403148 8BEC                    mov ebp, esp
:0040314A 51                      push ecx
:0040314B 894DFC                  mov dword ptr [ebp-04], ecx
:0040314E 6A01                    push 00000001
:00403150 8B45FC                  mov eax, dword ptr [ebp-04]
:00403153 33C9                    xor ecx, ecx
:00403155 8A482C                  mov cl, byte ptr [eax+2C]
:00403158 83C164                  add ecx, 00000064
:0040315B 51                      push ecx
:0040315C B9B0694B00              mov ecx, 004B69B0
:00403161 E814150700              call 0047467A
:00403166 8BE5                    mov esp, ebp
:00403168 5D                      pop ebp
:00403169 C3                      ret


:0040316A 55                      push ebp
:0040316B 8BEC                    mov ebp, esp
:0040316D E807000000              call 00403179
:00403172 E811000000              call 00403188
:00403177 5D                      pop ebp
:00403178 C3                      ret



* Referenced by a CALL at Address:
|:0040316D   
|
:00403179 55                      push ebp
:0040317A 8BEC                    mov ebp, esp
:0040317C B9B0174900              mov ecx, 004917B0
:00403181 E8DFE0FFFF              call 00401265
:00403186 5D                      pop ebp
:00403187 C3                      ret



* Referenced by a CALL at Address:
|:00403172   
|
:00403188 55                      push ebp
:00403189 8BEC                    mov ebp, esp
:0040318B 689A314000              push 0040319A
:00403190 E86BDF0700              call 00481100
:00403195 83C404                  add esp, 00000004
:00403198 5D                      pop ebp
:00403199 C3                      ret


:0040319A 55                      push ebp
:0040319B 8BEC                    mov ebp, esp
:0040319D B9B0174900              mov ecx, 004917B0
:004031A2 E897E1FFFF              call 0040133E
:004031A7 5D                      pop ebp
:004031A8 C3                      ret


:004031A9 55                      push ebp
:004031AA 8BEC                    mov ebp, esp
:004031AC E807000000              call 004031B8
:004031B1 E811000000              call 004031C7
:004031B6 5D                      pop ebp
:004031B7 C3                      ret



* Referenced by a CALL at Address:
|:004031AC   
|
:004031B8 55                      push ebp
:004031B9 8BEC                    mov ebp, esp
:004031BB B988274900              mov ecx, 00492788
:004031C0 E84B030000              call 00403510
:004031C5 5D                      pop ebp
:004031C6 C3                      ret



* Referenced by a CALL at Address:
|:004031B1   
|
:004031C7 55                      push ebp
:004031C8 8BEC                    mov ebp, esp
:004031CA 68D9314000              push 004031D9
:004031CF E82CDF0700              call 00481100
:004031D4 83C404                  add esp, 00000004
:004031D7 5D                      pop ebp
:004031D8 C3                      ret


:004031D9 55                      push ebp
:004031DA 8BEC                    mov ebp, esp
:004031DC B988274900              mov ecx, 00492788
:004031E1 E86A040000              call 00403650
:004031E6 5D                      pop ebp
:004031E7 C3                      ret



* Referenced by a CALL at Address:
|:00401FE8   
|
:004031E8 55                      push ebp
:004031E9 8BEC                    mov ebp, esp
:004031EB 83EC08                  sub esp, 00000008
:004031EE 894DFC                  mov dword ptr [ebp-04], ecx
:004031F1 8B45FC                  mov eax, dword ptr [ebp-04]
:004031F4 33C9                    xor ecx, ecx
:004031F6 8A08                    mov cl, byte ptr [eax]
:004031F8 8B5508                  mov edx, dword ptr [ebp+08]
:004031FB 81E2FF000000            and edx, 000000FF
:00403201 3BCA                    cmp ecx, edx
:00403203 7F04                    jg 00403209
:00403205 33C0                    xor eax, eax
:00403207 EB53                    jmp 0040325C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403203(C)
|
:00403209 8B4508                  mov eax, dword ptr [ebp+08]
:0040320C 25FF000000              and eax, 000000FF
:00403211 85C0                    test eax, eax
:00403213 751A                    jne 0040322F
:00403215 8B4D08                  mov ecx, dword ptr [ebp+08]
:00403218 81E1FF000000            and ecx, 000000FF
:0040321E 8B55FC                  mov edx, dword ptr [ebp-04]
:00403221 8B448A14                mov eax, dword ptr [edx+4*ecx+14]
:00403225 33C9                    xor ecx, ecx
:00403227 8A4810                  mov cl, byte ptr [eax+10]
:0040322A 83F902                  cmp ecx, 00000002
:0040322D 7523                    jne 00403252

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403213(C)
|
:0040322F 8B5508                  mov edx, dword ptr [ebp+08]
:00403232 81E2FF000000            and edx, 000000FF
:00403238 8B45FC                  mov eax, dword ptr [ebp-04]
:0040323B 8B4C9014                mov ecx, dword ptr [eax+4*edx+14]
:0040323F 33D2                    xor edx, edx
:00403241 8A5110                  mov dl, byte ptr [ecx+10]
:00403244 83FA03                  cmp edx, 00000003
:00403247 7409                    je 00403252
:00403249 C745F800000000          mov [ebp-08], 00000000
:00403250 EB07                    jmp 00403259

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040322D(C), :00403247(C)
|
:00403252 C745F801000000          mov [ebp-08], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403250(U)
|
:00403259 8B45F8                  mov eax, dword ptr [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403207(U)
|
:0040325C 8BE5                    mov esp, ebp
:0040325E 5D                      pop ebp
:0040325F C20400                  ret 0004



* Referenced by a CALL at Address:
|:004030AF   
|
:00403262 55                      push ebp
:00403263 8BEC                    mov ebp, esp
:00403265 83EC08                  sub esp, 00000008
:00403268 894DFC                  mov dword ptr [ebp-04], ecx
:0040326B 8B45FC                  mov eax, dword ptr [ebp-04]
:0040326E 33C9                    xor ecx, ecx
:00403270 8A4858                  mov cl, byte ptr [eax+58]
:00403273 85C9                    test ecx, ecx
:00403275 750D                    jne 00403284
:00403277 8B55FC                  mov edx, dword ptr [ebp-04]
:0040327A 33C0                    xor eax, eax
:0040327C 8A4240                  mov al, byte ptr [edx+40]
:0040327F 83F802                  cmp eax, 00000002
:00403282 7516                    jne 0040329A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403275(C)
|
:00403284 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00403287 33D2                    xor edx, edx
:00403289 8A5140                  mov dl, byte ptr [ecx+40]
:0040328C 83FA03                  cmp edx, 00000003
:0040328F 7409                    je 0040329A
:00403291 C745F800000000          mov [ebp-08], 00000000
:00403298 EB07                    jmp 004032A1

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00403282(C), :0040328F(C)
|
:0040329A C745F801000000          mov [ebp-08], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403298(U)
|
:004032A1 8B45F8                  mov eax, dword ptr [ebp-08]
:004032A4 8BE5                    mov esp, ebp
:004032A6 5D                      pop ebp
:004032A7 C3                      ret


:004032A8 CC                      int 03
:004032A9 CC                      int 03
:004032AA CC                      int 03
:004032AB CC                      int 03
:004032AC CC                      int 03
:004032AD CC                      int 03
:004032AE CC                      int 03
:004032AF CC                      int 03

* Referenced by a CALL at Addresses:
|:0040154B   , :00403C04   , :00403E18   , :0040858C   , :0040AFE0   
|:0041B542   , :0041C78C   , :0041D506   , :0041E074   , :00421907   
|:00421F45   , :00426C8E   , :0042887B   , :0042B409   , :0042B448   
|:0042B6EA   , :0042BA4D   , :0042BC83   , :0042BD84   , :0042C0D0   
|:004312B4   , :00431AB7   , :0043D167   , :0043FE56   , :00441A4B   
|:00443E29   , :00443F7B   , :0044411B   , :00444314   , :004444C0   
|:004446FB   , :00444F14   , :00445CC2   , :00446267   , :0044666F   
|:00446A5E   , :00446E18   , :00447195   , :00447634   , :0044871E   
|:00449F1A   , :00449FBB   , :0044A326   , :0044A99C   , :0044B070   
|:0044C1F5   , :0044D0BC   , :0044D451   , :00456507   , :0045694A   
|:00456ED6   , :004577CC   , :0045994F   , :0045C19A   , :0045EC1E   
|:0046FC6A   , :0046FD99   , :00477F65   
|
:004032B0 55                      push ebp
:004032B1 8BEC                    mov ebp, esp
:004032B3 51                      push ecx
:004032B4 894DFC                  mov dword ptr [ebp-04], ecx
:004032B7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004032BA E861000000              call 00403320
:004032BF 8B45FC                  mov eax, dword ptr [ebp-04]
:004032C2 8BE5                    mov esp, ebp
:004032C4 5D                      pop ebp
:004032C5 C3                      ret


:004032C6 CC                      int 03
:004032C7 CC                      int 03
:004032C8 CC                      int 03
:004032C9 CC                      int 03
:004032CA CC                      int 03
:004032CB CC                      int 03
:004032CC CC                      int 03
:004032CD CC                      int 03
:004032CE CC                      int 03
:004032CF CC                      int 03

* Referenced by a CALL at Addresses:
|:0040166C   , :00401690   , :00403D62   , :00404151   , :0040893C   
|:0040B03F   , :0041B578   , :0041B5BE   , :0041B5ED   , :0041CCCA   
|:0041D563   , :0041D5D7   , :0041DBA8   , :0041E0D4   , :0041E101   
|:0041E12E   , :0041E147   , :0041E1D6   , :00421CC2   , :00422483   
|:00426D9F   , :00428957   , :0042B42A   , :0042B469   , :0042B7A4   
|:0042BAB5   , :0042BD4D   , :0042BF0B   , :0042C20A   , :004314F1   
|:00431E00   , :0043D51E   , :0043FF41   , :00442006   , :00443F3C   
|:004440DC   , :0044422E   , :00444481   , :004446BC   , :00444924   
|:0044592E   , :00445DFF   , :004465E6   , :004469BE   , :00446D89   
|:004470F2   , :00447591   , :00447FCF   , :00448FE2   , :00449F7E   
|:0044A1BF   , :0044A3E3   , :0044AC14   , :0044B593   , :0044C2D0   
|:0044D40E   , :0044DA67   , :004567AB   , :00456D23   , :0045708D   
|:004577EE   , :00459117   , :00459D76   , :0045C513   , :0045F0CD   
|:0046FD5C   , :0046FE83   , :004782D1   , :00484EF9   , :00484F86   
|:00484F9C   , :00484FB6   , :00484FE9   , :00485211   , :00485236   
|:0048524C   , :00485266   , :00485286   , :0048529C   , :004852B6   
|:004852CC   , :004852E6   , :004852FC   , :0048531B   , :00485331   
|:00485347   , :00485386   , :004853A5   , :004853C6   , :00485436   
|:0048544C   , :00485466   , :0048547C   , :00485492   , :004854A8   
|:004854BE   , :004854D4   , :004854EA   , :00485500   , :00485516   
|:0048552C   , :00485542   , :00485558   , :0048556E   , :00485584   
|:0048559A   , :004855B6   , :004855CC   , :004855E2   , :004855F8   
|:0048560E   , :00485624   , :0048563A   , :00485650   , :00485666   
|:0048567C   , :00485692   , :004856A8   , :004856BE   , :004856D6   
|:00485701   , :0048598A   , :004859A0   , :00485D46   
|
:004032D0 55                      push ebp
:004032D1 8BEC                    mov ebp, esp
:004032D3 51                      push ecx
:004032D4 894DFC                  mov dword ptr [ebp-04], ecx
:004032D7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004032DA E86A5C0100              call 00418F49
:004032DF 8BE5                    mov esp, ebp
:004032E1 5D                      pop ebp
:004032E2 C3                      ret


:004032E3 CC                      int 03
:004032E4 CC                      int 03
:004032E5 CC                      int 03
:004032E6 CC                      int 03
:004032E7 CC                      int 03
:004032E8 CC                      int 03
:004032E9 CC                      int 03
:004032EA CC                      int 03
:004032EB CC                      int 03
:004032EC CC                      int 03
:004032ED CC                      int 03
:004032EE CC                      int 03
:004032EF CC                      int 03

* Referenced by a CALL at Addresses:
|:0040265B   , :00402722   , :004027D3   
|
:004032F0 55                      push ebp
:004032F1 8BEC                    mov ebp, esp
:004032F3 51                      push ecx
:004032F4 894DFC                  mov dword ptr [ebp-04], ecx
:004032F7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004032FA E8B1010000              call 004034B0
:004032FF 8B4508                  mov eax, dword ptr [ebp+08]
:00403302 83E001                  and eax, 00000001
:00403305 85C0                    test eax, eax
:00403307 740C                    je 00403315
:00403309 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040330C 51                      push ecx
:0040330D E80EDD0700              call 00481020
:00403312 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403307(C)
|
:00403315 8B45FC                  mov eax, dword ptr [ebp-04]
:00403318 8BE5                    mov esp, ebp
:0040331A 5D                      pop ebp
:0040331B C20400                  ret 0004


:0040331E CC                      int 03
:0040331F CC                      int 03

* Referenced by a CALL at Addresses:
|:004032BA   , :00403532   , :00417A75   , :00417CA5   , :00417EF3   
|:0041A1CE   , :0041A2A2   , :0041A6D7   , :0041AD40   , :0041B191   
|:0042B487   , :0042BA5C   , :004312C3   , :0047C689   
|
:00403320 55                      push ebp
:00403321 8BEC                    mov ebp, esp
:00403323 51                      push ecx
:00403324 894DFC                  mov dword ptr [ebp-04], ecx
:00403327 8B45FC                  mov eax, dword ptr [ebp-04]
:0040332A C70000000000            mov dword ptr [eax], 00000000
:00403330 8B45FC                  mov eax, dword ptr [ebp-04]
:00403333 8BE5                    mov esp, ebp
:00403335 5D                      pop ebp
:00403336 C3                      ret


:00403337 CC                      int 03
:00403338 CC                      int 03
:00403339 CC                      int 03
:0040333A CC                      int 03
:0040333B CC                      int 03
:0040333C CC                      int 03
:0040333D CC                      int 03
:0040333E CC                      int 03
:0040333F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040200A   , :004030D1   , :00404281   , :00404315   , :00404494   
|:00404A92   , :00404B4D   , :00404C06   , :004056EE   , :00408523   
|:00408911   , :0040BA85   , :0040BB30   , :0040D33B   , :0040D39E   
|:0040D434   , :0040D497   , :004150D4   , :00416F7F   , :00416FB6   
|:00419EA6   , :0041C9AF   , :0041CA62   , :0041CC37   , :0041D92D   
|:0041DA36   , :0041E3DA   , :0041E57E   , :0041E5AA   , :00421783   
|:00421899   , :0042197E   , :00421C84   , :00422D58   , :00423C17   
|:00424D28   , :00429932   , :0042C1C8   , :0042C4D9   , :0042C916   
|:0042C9FC   , :0042CA3F   , :0042CA63   , :0042DFC9   , :0042E191   
|:0042E3FF   , :00431364   , :004313A6   , :004313D5   , :004313ED   
|:004314B7   , :00431ACA   , :00431DBA   , :00431DD3   , :00431DE9   
|:00431F40   , :00432022   , :0043222A   , :00432238   , :0043235D   
|:00432450   , :004325E3   , :0043269E   , :004328E0   , :00432E0C   
|:00433017   , :00433176   , :0043364F   , :00433893   , :00433C56   
|:00433E25   , :0043432E   , :00434602   , :00434659   , :004348E6   
|:00434A8B   , :00434C4B   , :00434E7D   , :0043D4E7   , :00441ACE   
|:00441AF5   , :00441BD5   , :00441C97   , :00441D93   , :00441DCE   
|:00441EC8   , :00441FEA   , :00442465   , :004446A0   , :00444903   
|:00444A67   , :00444BAA   , :00444CBD   , :00444ED5   , :0044514F   
|:00445165   , :004451C5   , :0044526A   , :00445280   , :004452E0   
|:00445385   , :0044539B   , :004453FB   , :00445557   , :004455BC   
|:0044564E   , :00445664   , :0044583A   , :00445850   , :00445901   
|:00445917   , :004459DE   , :00445A7D   , :00445A8B   , :00445ACB   
|:00445C1E   , :00445C2C   , :00445C6C   , :00445EBD   , :00445FBC   
|:00446017   , :0044612C   , :0044618A   , :004461F6   , :004465CA   
|:004469A2   , :00446D6D   , :004470D6   , :00447575   , :00447FB3   
|:0044836E   , :00448384   , :00448ACA   , :00448B03   , :00448B1F   
|:00448B58   , :00449017   , :00449095   , :004490CC   , :004490FC   
|:00449470   , :004495A6   , :004495B9   , :0044AE5B   , :0044AF5C   
|:0044B27E   , :0044B572   , :0044B7D4   , :0044B89A   , :0044B969   
|:0044BA3E   , :0044BCC4   , :0044BECD   , :0044C02F   , :0044C119   
|:0044D3CD   , :0044D83B   , :00450693   , :004507AA   , :0045081D   
|:00450961   , :00450DB7   , :00450EB2   , :00454B52   , :004564F2   
|:0045670B   , :00456794   , :00456C9D   , :00456D0C   , :0045730C   
|:00457395   , :0045751F   , :004575A8   , :00457686   , :0045776F   
|:0045796D   , :0045828C   , :00458556   , :00458746   , :0045888D   
|:004589DD   , :00458ADA   , :00458B36   , :00458E49   , :004590CA   
|:00459100   , :004593EB   , :00459BEF   , :00459C0A   , :0045A3FD   
|:0045A459   , :0045E995   , :0046DD13   , :0046E345   
|
:00403340 55                      push ebp
:00403341 8BEC                    mov ebp, esp
:00403343 51                      push ecx
:00403344 894DFC                  mov dword ptr [ebp-04], ecx
:00403347 8B4508                  mov eax, dword ptr [ebp+08]
:0040334A 50                      push eax
:0040334B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040334E E80C910200              call 0042C45F
:00403353 8BE5                    mov esp, ebp
:00403355 5D                      pop ebp
:00403356 C20400                  ret 0004


:00403359 CC                      int 03
:0040335A CC                      int 03
:0040335B CC                      int 03
:0040335C CC                      int 03
:0040335D CC                      int 03
:0040335E CC                      int 03
:0040335F CC                      int 03

* Referenced by a CALL at Addresses:
|:00401D0D   , :004041EE   , :00404506   , :0040452B   , :004057F3   
|:00406264   , :0040640D   , :00416F01   , :0041C8A7   , :0041C8E5   
|:0041CAD5   , :0041CB13   , :0041CDC7   , :0041CEE0   , :0041D811   
|:0041D84F   , :004204B8   , :00420506   , :00420554   , :004205A2   
|:004209C0   , :004209F9   , :00420A2F   , :00420A65   , :004214FF   
|:00421595   , :004219C1   , :00421B45   , :00422229   , :00422A41   
|:00422A80   , :00424D49   , :00424D98   , :00424DC5   , :00424FD4   
|:004254C6   , :004254EA   , :0042CCAB   , :00433829   , :00433A07   
|:00433A38   , :00433B1C   , :00433BDC   , :00433CEC   , :00433D1D   
|:00433E5E   , :00433E81   , :00433FC5   , :00433FF6   , :00434077   
|:00434522   , :00434FF3   , :0043529C   , :004352B8   , :004352D5   
|:004352F1   , :00436551   , :00438223   , :00438CC6   , :0043960C   
|:0043A349   , :0043A881   , :0043ABFD   , :0043AE56   , :0043AE7F   
|:0043AFFA   , :0043D133   , :0043E2C8   , :0043E6B7   , :0043F86F   
|:00440314   , :0044A4F7   , :0044A523   , :0044A54E   , :0044A575   
|:0044A606   , :0044A632   , :0044A65D   , :0044A686   , :0044C403   
|:0044C483   , :0044C4EF   , :0044C56B   , :0044C5D7   , :0044DB42   
|:0044E04F   , :0044FB0A   , :0044FD02   , :00450071   , :00450A2A   
|:004513B7   , :00453AA5   , :00454F2C   , :00455160   , :004552EE   
|:004553D7   , :004571DE   , :0045733C   , :004574CC   , :00457888   
|:004592BE   , :004596E1   , :00459864   , :00459ABE   , :0045B07E   
|:0045B1E5   , :0045B2C4   , :0045B67A   , :00465B57   , :0046620A   
|
:00403360 55                      push ebp
:00403361 8BEC                    mov ebp, esp
:00403363 51                      push ecx
:00403364 894DFC                  mov dword ptr [ebp-04], ecx
:00403367 8B45FC                  mov eax, dword ptr [ebp-04]
:0040336A 83C006                  add eax, 00000006
:0040336D 8BE5                    mov esp, ebp
:0040336F 5D                      pop ebp
:00403370 C3                      ret


:00403371 CC                      int 03
:00403372 CC                      int 03
:00403373 CC                      int 03
:00403374 CC                      int 03
:00403375 CC                      int 03
:00403376 CC                      int 03
:00403377 CC                      int 03
:00403378 CC                      int 03
:00403379 CC                      int 03
:0040337A CC                      int 03
:0040337B CC                      int 03
:0040337C CC                      int 03
:0040337D CC                      int 03
:0040337E CC                      int 03
:0040337F CC                      int 03

* Referenced by a CALL at Addresses:
|:00418A6D   , :0044F8BA   , :00472F67   
|
:00403380 55                      push ebp
:00403381 8BEC                    mov ebp, esp

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004033A1(U)
|
:00403383 8B4510                  mov eax, dword ptr [ebp+10]
:00403386 83E801                  sub eax, 00000001
:00403389 894510                  mov dword ptr [ebp+10], eax
:0040338C 837D1000                cmp dword ptr [ebp+10], 00000000
:00403390 7C11                    jl 004033A3
:00403392 8B4D08                  mov ecx, dword ptr [ebp+08]
:00403395 FF5514                  call [ebp+14]
:00403398 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040339B 034D0C                  add ecx, dword ptr [ebp+0C]
:0040339E 894D08                  mov dword ptr [ebp+08], ecx
:004033A1 EBE0                    jmp 00403383

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403390(C)
|
:004033A3 5D                      pop ebp
:004033A4 C21000                  ret 0010


:004033A7 CC                      int 03
:004033A8 CC                      int 03
:004033A9 CC                      int 03
:004033AA CC                      int 03
:004033AB CC                      int 03
:004033AC CC                      int 03
:004033AD CC                      int 03
:004033AE CC                      int 03
:004033AF CC                      int 03

* Referenced by a CALL at Address:
|:0040126F   
|
:004033B0 55                      push ebp
:004033B1 8BEC                    mov ebp, esp
:004033B3 51                      push ecx
:004033B4 894DFC                  mov dword ptr [ebp-04], ecx
:004033B7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004033BA E861000000              call 00403420
:004033BF 68A0000000              push 000000A0
:004033C4 6A00                    push 00000000
:004033C6 8B45FC                  mov eax, dword ptr [ebp-04]
:004033C9 05B4000000              add eax, 000000B4
:004033CE 50                      push eax
:004033CF E85CD70700              call 00480B30
:004033D4 83C40C                  add esp, 0000000C
:004033D7 68A0000000              push 000000A0
:004033DC 6A00                    push 00000000
:004033DE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004033E1 81C154010000            add ecx, 00000154
:004033E7 51                      push ecx
:004033E8 E843D70700              call 00480B30
:004033ED 83C40C                  add esp, 0000000C
:004033F0 68A0000000              push 000000A0
:004033F5 6A00                    push 00000000
:004033F7 8B55FC                  mov edx, dword ptr [ebp-04]
:004033FA 81C2F4010000            add edx, 000001F4
:00403400 52                      push edx
:00403401 E82AD70700              call 00480B30
:00403406 83C40C                  add esp, 0000000C
:00403409 8B45FC                  mov eax, dword ptr [ebp-04]
:0040340C C7809402000000000000    mov dword ptr [ebx+00000294], 00000000
:00403416 8B45FC                  mov eax, dword ptr [ebp-04]
:00403419 8BE5                    mov esp, ebp
:0040341B 5D                      pop ebp
:0040341C C3                      ret


:0040341D CC                      int 03
:0040341E CC                      int 03
:0040341F CC                      int 03

* Referenced by a CALL at Addresses:
|:004033BA   , :00403544   
|
:00403420 55                      push ebp
:00403421 8BEC                    mov ebp, esp
:00403423 51                      push ecx
:00403424 894DFC                  mov dword ptr [ebp-04], ecx
:00403427 8B45FC                  mov eax, dword ptr [ebp-04]
:0040342A C60000                  mov byte ptr [eax], 00
:0040342D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00403430 C7410432000000          mov [ecx+04], 00000032
:00403437 8B55FC                  mov edx, dword ptr [ebp-04]
:0040343A C6421000                mov [edx+10], 00
:0040343E 8B45FC                  mov eax, dword ptr [ebp-04]
:00403441 C7400800000000          mov [eax+08], 00000000
:00403448 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040344B C7410C00000000          mov [ecx+0C], 00000000
:00403452 8B55FC                  mov edx, dword ptr [ebp-04]
:00403455 C6420100                mov [edx+01], 00
:00403459 8B45FC                  mov eax, dword ptr [ebp-04]
:0040345C C6400200                mov [eax+02], 00
:00403460 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00403463 C6410300                mov [ecx+03], 00
:00403467 8B45FC                  mov eax, dword ptr [ebp-04]
:0040346A 8BE5                    mov esp, ebp
:0040346C 5D                      pop ebp
:0040346D C3                      ret


:0040346E CC                      int 03
:0040346F CC                      int 03

* Referenced by a CALL at Address:
|:0040276A   
|
:00403470 55                      push ebp
:00403471 8BEC                    mov ebp, esp
:00403473 51                      push ecx
:00403474 894DFC                  mov dword ptr [ebp-04], ecx
:00403477 68A0000000              push 000000A0
:0040347C 6A00                    push 00000000
:0040347E 8B45FC                  mov eax, dword ptr [ebp-04]
:00403481 50                      push eax
:00403482 E8A9D60700              call 00480B30
:00403487 83C40C                  add esp, 0000000C
:0040348A 68A0000000              push 000000A0
:0040348F 6A00                    push 00000000
:00403491 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00403494 81C1A0000000            add ecx, 000000A0
:0040349A 51                      push ecx
:0040349B E890D60700              call 00480B30
:004034A0 83C40C                  add esp, 0000000C
:004034A3 8B45FC                  mov eax, dword ptr [ebp-04]
:004034A6 8BE5                    mov esp, ebp
:004034A8 5D                      pop ebp
:004034A9 C3                      ret


:004034AA CC                      int 03
:004034AB CC                      int 03
:004034AC CC                      int 03
:004034AD CC                      int 03
:004034AE CC                      int 03
:004034AF CC                      int 03

* Referenced by a CALL at Address:
|:004032FA   
|
:004034B0 55                      push ebp
:004034B1 8BEC                    mov ebp, esp
:004034B3 83EC10                  sub esp, 00000010
:004034B6 894DF0                  mov dword ptr [ebp-10], ecx
:004034B9 C745FC00000000          mov [ebp-04], 00000000
:004034C0 EB09                    jmp 004034CB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403505(U)
|
:004034C2 8B45FC                  mov eax, dword ptr [ebp-04]
:004034C5 83C001                  add eax, 00000001
:004034C8 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004034C0(U)
|
:004034CB 837DFC28                cmp dword ptr [ebp-04], 00000028
:004034CF 7D36                    jge 00403507
:004034D1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004034D4 8B55F0                  mov edx, dword ptr [ebp-10]
:004034D7 8B048A                  mov eax, dword ptr [edx+4*ecx]
:004034DA 8945F8                  mov dword ptr [ebp-08], eax
:004034DD 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004034E0 51                      push ecx
:004034E1 E83ADB0700              call 00481020
:004034E6 83C404                  add esp, 00000004
:004034E9 8B55FC                  mov edx, dword ptr [ebp-04]
:004034EC 8B45F0                  mov eax, dword ptr [ebp-10]
:004034EF 8B8C90A0000000          mov ecx, dword ptr [eax+4*edx+000000A0]
:004034F6 894DF4                  mov dword ptr [ebp-0C], ecx
:004034F9 8B55F4                  mov edx, dword ptr [ebp-0C]
:004034FC 52                      push edx
:004034FD E81EDB0700              call 00481020
:00403502 83C404                  add esp, 00000004
:00403505 EBBB                    jmp 004034C2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004034CF(C)
|
:00403507 8BE5                    mov esp, ebp
:00403509 5D                      pop ebp
:0040350A C3                      ret


:0040350B CC                      int 03
:0040350C CC                      int 03
:0040350D CC                      int 03
:0040350E CC                      int 03
:0040350F CC                      int 03

* Referenced by a CALL at Address:
|:004031C0   
|
:00403510 55                      push ebp
:00403511 8BEC                    mov ebp, esp
:00403513 6AFF                    push FFFFFFFF
:00403515 684C4F4800              push 00484F4C
:0040351A 64A100000000            mov eax, dword ptr fs:[00000000]
:00403520 50                      push eax
:00403521 64892500000000          mov dword ptr fs:[00000000], esp
:00403528 51                      push ecx
:00403529 894DF0                  mov dword ptr [ebp-10], ecx
:0040352C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040352F 83C108                  add ecx, 00000008
:00403532 E8E9FDFFFF              call 00403320
:00403537 C745FC00000000          mov [ebp-04], 00000000
:0040353E 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00403541 83C11C                  add ecx, 0000001C
:00403544 E8D7FEFFFF              call 00403420
:00403549 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040354C 83C130                  add ecx, 00000030
:0040354F E8AC000000              call 00403600
:00403554 8B45F0                  mov eax, dword ptr [ebp-10]
:00403557 C6405800                mov [eax+58], 00
:0040355B 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040355E C7415400000000          mov [ecx+54], 00000000
:00403565 8B55F0                  mov edx, dword ptr [ebp-10]
:00403568 C7425000000000          mov [edx+50], 00000000
:0040356F 8B45F0                  mov eax, dword ptr [ebp-10]
:00403572 C7404C00000000          mov [eax+4C], 00000000
:00403579 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040357C C7414800000000          mov [ecx+48], 00000000
:00403583 8B55F0                  mov edx, dword ptr [ebp-10]
:00403586 C7424400000000          mov [edx+44], 00000000
:0040358D 8B45F0                  mov eax, dword ptr [ebp-10]
:00403590 C7405C18FCFFFF          mov [eax+5C], FFFFFC18
:00403597 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040359A C7416018FCFFFF          mov [ecx+60], FFFFFC18
:004035A1 8B55F0                  mov edx, dword ptr [ebp-10]
:004035A4 C70200000000            mov dword ptr [edx], 00000000
:004035AA 8B45F0                  mov eax, dword ptr [ebp-10]
:004035AD C7400400000000          mov [eax+04], 00000000
:004035B4 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004035B7 C7410C00000000          mov [ecx+0C], 00000000
:004035BE 8B55F0                  mov edx, dword ptr [ebp-10]
:004035C1 C7421000000000          mov [edx+10], 00000000
:004035C8 8B45F0                  mov eax, dword ptr [ebp-10]
:004035CB C7401400000000          mov [eax+14], 00000000
:004035D2 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004035D5 C7411800000000          mov [ecx+18], 00000000
:004035DC C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:004035E3 8B45F0                  mov eax, dword ptr [ebp-10]
:004035E6 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004035E9 64890D00000000          mov dword ptr fs:[00000000], ecx
:004035F0 8BE5                    mov esp, ebp
:004035F2 5D                      pop ebp
:004035F3 C3                      ret


:004035F4 CC                      int 03
:004035F5 CC                      int 03
:004035F6 CC                      int 03
:004035F7 CC                      int 03
:004035F8 CC                      int 03
:004035F9 CC                      int 03
:004035FA CC                      int 03
:004035FB CC                      int 03
:004035FC CC                      int 03
:004035FD CC                      int 03
:004035FE CC                      int 03
:004035FF CC                      int 03

* Referenced by a CALL at Address:
|:0040354F   
|
:00403600 55                      push ebp
:00403601 8BEC                    mov ebp, esp
:00403603 51                      push ecx
:00403604 894DFC                  mov dword ptr [ebp-04], ecx
:00403607 8B45FC                  mov eax, dword ptr [ebp-04]
:0040360A C600FF                  mov byte ptr [eax], FF
:0040360D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00403610 C64101FF                mov [ecx+01], FF
:00403614 8B55FC                  mov edx, dword ptr [ebp-04]
:00403617 C6420210                mov [edx+02], 10
:0040361B 8B45FC                  mov eax, dword ptr [ebp-04]
:0040361E C6400310                mov [eax+03], 10
:00403622 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00403625 C7410400000000          mov [ecx+04], 00000000
:0040362C 8B55FC                  mov edx, dword ptr [ebp-04]
:0040362F C7420800000000          mov [edx+08], 00000000
:00403636 8B45FC                  mov eax, dword ptr [ebp-04]
:00403639 C7400C00000000          mov [eax+0C], 00000000
:00403640 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00403643 C6411000                mov [ecx+10], 00
:00403647 8B45FC                  mov eax, dword ptr [ebp-04]
:0040364A 8BE5                    mov esp, ebp
:0040364C 5D                      pop ebp
:0040364D C3                      ret


:0040364E CC                      int 03
:0040364F CC                      int 03

* Referenced by a CALL at Address:
|:004031E1   
|
:00403650 55                      push ebp
:00403651 8BEC                    mov ebp, esp
:00403653 6AFF                    push FFFFFFFF
:00403655 686C4F4800              push 00484F6C
:0040365A 64A100000000            mov eax, dword ptr fs:[00000000]
:00403660 50                      push eax
:00403661 64892500000000          mov dword ptr fs:[00000000], esp
:00403668 51                      push ecx
:00403669 894DF0                  mov dword ptr [ebp-10], ecx
:0040366C C745FC00000000          mov [ebp-04], 00000000
:00403673 6A01                    push 00000001
:00403675 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00403678 E831EFFFFF              call 004025AE
:0040367D C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00403684 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00403687 83C108                  add ecx, 00000008
:0040368A E8BA580100              call 00418F49
:0040368F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00403692 64890D00000000          mov dword ptr fs:[00000000], ecx
:00403699 8BE5                    mov esp, ebp
:0040369B 5D                      pop ebp
:0040369C C3                      ret


:0040369D CC                      int 03
:0040369E CC                      int 03
:0040369F CC                      int 03

* Referenced by a CALL at Addresses:
|:00402588   , :004025F0   , :004026A7   , :00402FC9   
|
:004036A0 55                      push ebp
:004036A1 8BEC                    mov ebp, esp
:004036A3 51                      push ecx
:004036A4 894DFC                  mov dword ptr [ebp-04], ecx
:004036A7 8B4508                  mov eax, dword ptr [ebp+08]
:004036AA 50                      push eax
:004036AB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004036AE 51                      push ecx
:004036AF FF1538614800            call dword ptr [00486138]
:004036B5 8BE5                    mov esp, ebp
:004036B7 5D                      pop ebp
:004036B8 C20400                  ret 0004


:004036BB CC                      int 03
:004036BC CC                      int 03
:004036BD CC                      int 03
:004036BE CC                      int 03
:004036BF CC                      int 03

* Referenced by a CALL at Addresses:
|:004026EB   , :004028B2   , :00402ABA   , :00402ADD   , :00402AF9   
|:00402B17   , :00402B4E   , :00402B80   , :00402BA3   , :00402BBF   
|:00402BDD   , :00402C18   , :00402DBE   , :00402F44   , :00402F5D   
|
:004036C0 55                      push ebp
:004036C1 8BEC                    mov ebp, esp
:004036C3 51                      push ecx
:004036C4 894DFC                  mov dword ptr [ebp-04], ecx
:004036C7 8B45FC                  mov eax, dword ptr [ebp-04]
:004036CA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004036CD 8B4024                  mov eax, dword ptr [eax+24]
:004036D0 0FAF4128                imul eax, dword ptr [ecx+28]
:004036D4 8BE5                    mov esp, ebp
:004036D6 5D                      pop ebp
:004036D7 C3                      ret


:004036D8 CC                      int 03
:004036D9 CC                      int 03
:004036DA CC                      int 03
:004036DB CC                      int 03
:004036DC CC                      int 03
:004036DD CC                      int 03
:004036DE CC                      int 03
:004036DF CC                      int 03
:004036E0 55                      push ebp
:004036E1 8BEC                    mov ebp, esp
:004036E3 E802000000              call 004036EA
:004036E8 5D                      pop ebp
:004036E9 C3                      ret



* Referenced by a CALL at Address:
|:004036E3   
|
:004036EA 55                      push ebp
:004036EB 8BEC                    mov ebp, esp
:004036ED B9F0274900              mov ecx, 004927F0
:004036F2 E8892E0000              call 00406580
:004036F7 5D                      pop ebp
:004036F8 C3                      ret



* Referenced by a CALL at Addresses:
|:00404298   , :004044AB   , :0040467D   , :00404693   , :004055E5   
|:0041C91B   , :0041C9E6   , :0041CA8A   , :0041D8BB   , :0041D9C2   
|:00421BE0   , :004222A9   , :00422AAD   , :0043D490   , :00441B76   
|:00441C37   , :00441E48   , :00441F21   , :00442483   , :004572BF   
|:00457A88   , :00457C44   , :00457D2F   , :00457E1A   , :00457FD2   
|:004581CF   , :00458499   , :004586C9   , :00458810   , :0045897F   
|:00458AA3   , :00458AF7   , :00458DE5   , :00458E6B   , :00459066   
|:0045939E   
|
:004036F9 55                      push ebp
:004036FA 8BEC                    mov ebp, esp
:004036FC 83EC14                  sub esp, 00000014
:004036FF B950424B00              mov ecx, 004B4250
:00403704 E88AE30400              call 00451A93
:00403709 99                      cdq
:0040370A B930000000              mov ecx, 00000030
:0040370F F7F9                    idiv ecx
:00403711 8B5508                  mov edx, dword ptr [ebp+08]
:00403714 03D0                    add edx, eax
:00403716 8955F0                  mov dword ptr [ebp-10], edx
:00403719 B950424B00              mov ecx, 004B4250
:0040371E E881E30400              call 00451AA4
:00403723 99                      cdq
:00403724 B930000000              mov ecx, 00000030
:00403729 F7F9                    idiv ecx
:0040372B 8B550C                  mov edx, dword ptr [ebp+0C]
:0040372E 03D0                    add edx, eax
:00403730 8955EC                  mov dword ptr [ebp-14], edx
:00403733 8B4508                  mov eax, dword ptr [ebp+08]
:00403736 6BC030                  imul eax, 00000030
:00403739 8945F4                  mov dword ptr [ebp-0C], eax
:0040373C 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0040373F 6BC930                  imul ecx, 00000030
:00403742 83C138                  add ecx, 00000038
:00403745 894DFC                  mov dword ptr [ebp-04], ecx
:00403748 33D2                    xor edx, edx
:0040374A 8A152C424B00            mov dl, byte ptr [004B422C]
:00403750 8B45EC                  mov eax, dword ptr [ebp-14]
:00403753 0FAFC2                  imul eax, edx
:00403756 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00403759 03C8                    add ecx, eax
:0040375B 69C900090000            imul ecx, 00000900
:00403761 894DF8                  mov dword ptr [ebp-08], ecx
:00403764 E872AE0100              call 0041E5DB
:00403769 6A00                    push 00000000
:0040376B 6A04                    push 00000004
:0040376D 6A00                    push 00000000
:0040376F 8B55F8                  mov edx, dword ptr [ebp-08]
:00403772 52                      push edx
:00403773 B9A8E44A00              mov ecx, 004AE4A8
:00403778 E8C3C20700              call 0047FA40
:0040377D 50                      push eax
:0040377E 6A30                    push 00000030
:00403780 6A30                    push 00000030
:00403782 8B45FC                  mov eax, dword ptr [ebp-04]
:00403785 50                      push eax
:00403786 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00403789 51                      push ecx
:0040378A E884E10400              call 00451913
:0040378F 83C418                  add esp, 00000018
:00403792 E85FAE0100              call 0041E5F6
:00403797 8BE5                    mov esp, ebp
:00403799 5D                      pop ebp
:0040379A C3                      ret



* Referenced by a CALL at Addresses:
|:004060E0   , :004060F7   
|
:0040379B 55                      push ebp
:0040379C 8BEC                    mov ebp, esp
:0040379E 83EC20                  sub esp, 00000020
:004037A1 56                      push esi
:004037A2 894DF0                  mov dword ptr [ebp-10], ecx
:004037A5 C745F400000000          mov [ebp-0C], 00000000
:004037AC 8B45F0                  mov eax, dword ptr [ebp-10]
:004037AF 8B4808                  mov ecx, dword ptr [eax+08]
:004037B2 E8192E0000              call 004065D0
:004037B7 25FF000000              and eax, 000000FF
:004037BC 8945FC                  mov dword ptr [ebp-04], eax
:004037BF 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004037C2 33D2                    xor edx, edx
:004037C4 8A5101                  mov dl, byte ptr [ecx+01]
:004037C7 8BCA                    mov ecx, edx
:004037C9 6BC924                  imul ecx, 00000024
:004037CC 81C1502C4B00            add ecx, 004B2C50
:004037D2 E899BE0500              call 0045F670
:004037D7 8BC8                    mov ecx, eax
:004037D9 6BC948                  imul ecx, 00000048
:004037DC 81C1681B4A00            add ecx, 004A1B68
:004037E2 E8E92D0000              call 004065D0
:004037E7 25FF000000              and eax, 000000FF
:004037EC 8945F8                  mov dword ptr [ebp-08], eax
:004037EF 8B45F0                  mov eax, dword ptr [ebp-10]
:004037F2 83B80006000000          cmp dword ptr [eax+00000600], 00000000
:004037F9 7508                    jne 00403803
:004037FB 8B45F4                  mov eax, dword ptr [ebp-0C]
:004037FE E973010000              jmp 00403976

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004037F9(C)
|
:00403803 8B7508                  mov esi, dword ptr [ebp+08]
:00403806 81E6FF000000            and esi, 000000FF
:0040380C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040380F 33D2                    xor edx, edx
:00403811 8A5101                  mov dl, byte ptr [ecx+01]
:00403814 8BCA                    mov ecx, edx
:00403816 6BC924                  imul ecx, 00000024
:00403819 81C1502C4B00            add ecx, 004B2C50
:0040381F E86CF40600              call 00472C90
:00403824 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00403827 3984B184000000          cmp dword ptr [ecx+4*esi+00000084], eax
:0040382E 0F82AF000000            jb 004038E3
:00403834 8B55FC                  mov edx, dword ptr [ebp-04]
:00403837 3B55F8                  cmp edx, dword ptr [ebp-08]
:0040383A 7336                    jnb 00403872
:0040383C 8B45F8                  mov eax, dword ptr [ebp-08]
:0040383F 2B45FC                  sub eax, dword ptr [ebp-04]
:00403842 8D0CC520000000          lea ecx, dword ptr [8*eax+00000020]
:00403849 81F9C8000000            cmp ecx, 000000C8
:0040384F 7609                    jbe 0040385A

* Possible Reference to Dialog: DialogID_00C8 
                                  |
:00403851 C745ECC8000000          mov [ebp-14], 000000C8
:00403858 EB10                    jmp 0040386A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040384F(C)
|
:0040385A 8B55F8                  mov edx, dword ptr [ebp-08]
:0040385D 2B55FC                  sub edx, dword ptr [ebp-04]
:00403860 8D04D520000000          lea eax, dword ptr [8*edx+00000020]
:00403867 8945EC                  mov dword ptr [ebp-14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403858(U)
|
:0040386A 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040386D 894DF4                  mov dword ptr [ebp-0C], ecx
:00403870 EB3F                    jmp 004038B1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040383A(C)
|
:00403872 8B55FC                  mov edx, dword ptr [ebp-04]
:00403875 2B55F8                  sub edx, dword ptr [ebp-08]
:00403878 C1E202                  shl edx, 02
:0040387B 52                      push edx
:0040387C 6A20                    push 00000020
:0040387E E81BC20700              call 0047FA9E
:00403883 83C408                  add esp, 00000008
:00403886 83F80A                  cmp eax, 0000000A
:00403889 7309                    jnb 00403894
:0040388B C745E80A000000          mov [ebp-18], 0000000A
:00403892 EB17                    jmp 004038AB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403889(C)
|
:00403894 8B45FC                  mov eax, dword ptr [ebp-04]
:00403897 2B45F8                  sub eax, dword ptr [ebp-08]
:0040389A C1E002                  shl eax, 02
:0040389D 50                      push eax
:0040389E 6A20                    push 00000020
:004038A0 E8F9C10700              call 0047FA9E
:004038A5 83C408                  add esp, 00000008
:004038A8 8945E8                  mov dword ptr [ebp-18], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403892(U)
|
:004038AB 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004038AE 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403870(U)
|
:004038B1 8B55F0                  mov edx, dword ptr [ebp-10]
:004038B4 33C0                    xor eax, eax
:004038B6 8A4201                  mov al, byte ptr [edx+01]
:004038B9 8BC8                    mov ecx, eax
:004038BB 6BC924                  imul ecx, 00000024
:004038BE 81C1502C4B00            add ecx, 004B2C50
:004038C4 E8A7BD0500              call 0045F670
:004038C9 8BF0                    mov esi, eax
:004038CB B9902F4900              mov ecx, 00492F90
:004038D0 E85B2D0000              call 00406630
:004038D5 3BF0                    cmp esi, eax
:004038D7 7508                    jne 004038E1
:004038D9 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004038DC D1E1                    shl ecx, 1
:004038DE 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004038D7(C)
|
:004038E1 EB6E                    jmp 00403951

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040382E(C)
|
:004038E3 8B55FC                  mov edx, dword ptr [ebp-04]
:004038E6 3B55F8                  cmp edx, dword ptr [ebp-08]
:004038E9 732D                    jnb 00403918
:004038EB 8B45F8                  mov eax, dword ptr [ebp-08]
:004038EE 2B45FC                  sub eax, dword ptr [ebp-04]
:004038F1 8D4C0008                lea ecx, dword ptr [eax+eax+08]
:004038F5 83F964                  cmp ecx, 00000064
:004038F8 7609                    jbe 00403903
:004038FA C745E464000000          mov [ebp-1C], 00000064
:00403901 EB0D                    jmp 00403910

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004038F8(C)
|
:00403903 8B55F8                  mov edx, dword ptr [ebp-08]
:00403906 2B55FC                  sub edx, dword ptr [ebp-04]
:00403909 8D441208                lea eax, dword ptr [edx+edx+08]
:0040390D 8945E4                  mov dword ptr [ebp-1C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403901(U)
|
:00403910 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00403913 894DF4                  mov dword ptr [ebp-0C], ecx
:00403916 EB39                    jmp 00403951

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004038E9(C)
|
:00403918 8B55FC                  mov edx, dword ptr [ebp-04]
:0040391B 2B55F8                  sub edx, dword ptr [ebp-08]
:0040391E 52                      push edx
:0040391F 6A08                    push 00000008
:00403921 E878C10700              call 0047FA9E
:00403926 83C408                  add esp, 00000008
:00403929 83F801                  cmp eax, 00000001
:0040392C 7309                    jnb 00403937
:0040392E C745E001000000          mov [ebp-20], 00000001
:00403935 EB14                    jmp 0040394B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040392C(C)
|
:00403937 8B45FC                  mov eax, dword ptr [ebp-04]
:0040393A 2B45F8                  sub eax, dword ptr [ebp-08]
:0040393D 50                      push eax
:0040393E 6A08                    push 00000008
:00403940 E859C10700              call 0047FA9E
:00403945 83C408                  add esp, 00000008
:00403948 8945E0                  mov dword ptr [ebp-20], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403935(U)
|
:0040394B 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0040394E 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004038E1(U), :00403916(U)
|
:00403951 8B55F0                  mov edx, dword ptr [ebp-10]
:00403954 8B4A08                  mov ecx, dword ptr [edx+08]
:00403957 E861390000              call 004072BD
:0040395C 25FF000000              and eax, 000000FF
:00403961 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00403964 0FAFC1                  imul eax, ecx
:00403967 33D2                    xor edx, edx
:00403969 B90A000000              mov ecx, 0000000A
:0040396E F7F1                    div ecx
:00403970 8945F4                  mov dword ptr [ebp-0C], eax
:00403973 8B45F4                  mov eax, dword ptr [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004037FE(U)
|
:00403976 5E                      pop esi
:00403977 8BE5                    mov esp, ebp
:00403979 5D                      pop ebp
:0040397A C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00406120   , :00406137   
|
:0040397D 55                      push ebp
:0040397E 8BEC                    mov ebp, esp
:00403980 83EC10                  sub esp, 00000010
:00403983 894DF0                  mov dword ptr [ebp-10], ecx
:00403986 C745F400000000          mov [ebp-0C], 00000000
:0040398D 8B45F0                  mov eax, dword ptr [ebp-10]
:00403990 8B4808                  mov ecx, dword ptr [eax+08]
:00403993 E8382C0000              call 004065D0
:00403998 25FF000000              and eax, 000000FF
:0040399D 8945FC                  mov dword ptr [ebp-04], eax
:004039A0 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004039A3 33D2                    xor edx, edx
:004039A5 8A5101                  mov dl, byte ptr [ecx+01]
:004039A8 8BCA                    mov ecx, edx
:004039AA 6BC924                  imul ecx, 00000024
:004039AD 81C1502C4B00            add ecx, 004B2C50
:004039B3 E8B8BC0500              call 0045F670
:004039B8 8BC8                    mov ecx, eax
:004039BA 6BC948                  imul ecx, 00000048
:004039BD 81C1681B4A00            add ecx, 004A1B68
:004039C3 E8082C0000              call 004065D0
:004039C8 25FF000000              and eax, 000000FF
:004039CD 8945F8                  mov dword ptr [ebp-08], eax
:004039D0 8B45F0                  mov eax, dword ptr [ebp-10]
:004039D3 83B80006000000          cmp dword ptr [eax+00000600], 00000000
:004039DA 7508                    jne 004039E4
:004039DC 8B45F4                  mov eax, dword ptr [ebp-0C]
:004039DF E99B000000              jmp 00403A7F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004039DA(C)
|
:004039E4 6A00                    push 00000000
:004039E6 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004039E9 8B4908                  mov ecx, dword ptr [ecx+08]
:004039EC E8FF2B0000              call 004065F0
:004039F1 25FF000000              and eax, 000000FF
:004039F6 50                      push eax
:004039F7 E81E2E0000              call 0040681A
:004039FC 83C404                  add esp, 00000004
:004039FF 25FF000000              and eax, 000000FF
:00403A04 85C0                    test eax, eax
:00403A06 7405                    je 00403A0D
:00403A08 8B45F4                  mov eax, dword ptr [ebp-0C]
:00403A0B EB72                    jmp 00403A7F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403A06(C)
|
:00403A0D 8B5508                  mov edx, dword ptr [ebp+08]
:00403A10 81E2FF000000            and edx, 000000FF
:00403A16 8B45F0                  mov eax, dword ptr [ebp-10]
:00403A19 83BC908400000000        cmp dword ptr [eax+4*edx+00000084], 00000000
:00403A21 7516                    jne 00403A39
:00403A23 8B4D08                  mov ecx, dword ptr [ebp+08]
:00403A26 81E1FF000000            and ecx, 000000FF
:00403A2C 8B55F0                  mov edx, dword ptr [ebp-10]
:00403A2F 83BC8A5402000000        cmp dword ptr [edx+4*ecx+00000254], 00000000
:00403A37 741A                    je 00403A53

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403A21(C)
|
:00403A39 C745F403000000          mov [ebp-0C], 00000003
:00403A40 8B45FC                  mov eax, dword ptr [ebp-04]
:00403A43 3B45F8                  cmp eax, dword ptr [ebp-08]
:00403A46 7609                    jbe 00403A51
:00403A48 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00403A4B 83E901                  sub ecx, 00000001
:00403A4E 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403A46(C)
|
:00403A51 EB07                    jmp 00403A5A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403A37(C)
|
:00403A53 C745F401000000          mov [ebp-0C], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403A51(U)
|
:00403A5A 8B55F0                  mov edx, dword ptr [ebp-10]
:00403A5D 8B4A08                  mov ecx, dword ptr [edx+08]
:00403A60 E858380000              call 004072BD
:00403A65 25FF000000              and eax, 000000FF
:00403A6A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00403A6D 0FAFC1                  imul eax, ecx
:00403A70 33D2                    xor edx, edx
:00403A72 B90A000000              mov ecx, 0000000A
:00403A77 F7F1                    div ecx
:00403A79 8945F4                  mov dword ptr [ebp-0C], eax
:00403A7C 8B45F4                  mov eax, dword ptr [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004039DF(U), :00403A0B(U)
|
:00403A7F 8BE5                    mov esp, ebp
:00403A81 5D                      pop ebp
:00403A82 C20400                  ret 0004



* Referenced by a CALL at Address:
|:00406160   
|
:00403A85 55                      push ebp
:00403A86 8BEC                    mov ebp, esp
:00403A88 83EC10                  sub esp, 00000010
:00403A8B 894DF0                  mov dword ptr [ebp-10], ecx
:00403A8E C745F400000000          mov [ebp-0C], 00000000
:00403A95 8B45F0                  mov eax, dword ptr [ebp-10]
:00403A98 8B4808                  mov ecx, dword ptr [eax+08]
:00403A9B E8302B0000              call 004065D0
:00403AA0 25FF000000              and eax, 000000FF
:00403AA5 8945FC                  mov dword ptr [ebp-04], eax
:00403AA8 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00403AAB 33D2                    xor edx, edx
:00403AAD 8A5101                  mov dl, byte ptr [ecx+01]
:00403AB0 8BCA                    mov ecx, edx
:00403AB2 6BC924                  imul ecx, 00000024
:00403AB5 81C1502C4B00            add ecx, 004B2C50
:00403ABB E8B0BB0500              call 0045F670
:00403AC0 8BC8                    mov ecx, eax
:00403AC2 6BC948                  imul ecx, 00000048
:00403AC5 81C1681B4A00            add ecx, 004A1B68
:00403ACB E8002B0000              call 004065D0
:00403AD0 25FF000000              and eax, 000000FF
:00403AD5 8945F8                  mov dword ptr [ebp-08], eax
:00403AD8 8B45F0                  mov eax, dword ptr [ebp-10]
:00403ADB 33C9                    xor ecx, ecx
:00403ADD 8A4801                  mov cl, byte ptr [eax+01]
:00403AE0 6BC924                  imul ecx, 00000024
:00403AE3 81C1502C4B00            add ecx, 004B2C50
:00403AE9 E866C40300              call 0043FF54
:00403AEE 85C0                    test eax, eax
:00403AF0 7508                    jne 00403AFA
:00403AF2 8B45F4                  mov eax, dword ptr [ebp-0C]
:00403AF5 E98F000000              jmp 00403B89

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403AF0(C)
|
:00403AFA 8B5508                  mov edx, dword ptr [ebp+08]
:00403AFD 81E2FF000000            and edx, 000000FF
:00403B03 8B45F0                  mov eax, dword ptr [ebp-10]
:00403B06 83BC908400000000        cmp dword ptr [eax+4*edx+00000084], 00000000
:00403B0E 7516                    jne 00403B26
:00403B10 8B4D08                  mov ecx, dword ptr [ebp+08]
:00403B13 81E1FF000000            and ecx, 000000FF
:00403B19 8B55F0                  mov edx, dword ptr [ebp-10]
:00403B1C 83BC8A5402000000        cmp dword ptr [edx+4*ecx+00000254], 00000000
:00403B24 741A                    je 00403B40

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403B0E(C)
|
:00403B26 C745F404000000          mov [ebp-0C], 00000004
:00403B2D 8B45FC                  mov eax, dword ptr [ebp-04]
:00403B30 3B45F8                  cmp eax, dword ptr [ebp-08]
:00403B33 7309                    jnb 00403B3E
:00403B35 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00403B38 83E901                  sub ecx, 00000001
:00403B3B 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403B33(C)
|
:00403B3E EB07                    jmp 00403B47

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403B24(C)
|
:00403B40 C745F401000000          mov [ebp-0C], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403B3E(U)
|
:00403B47 8B55F0                  mov edx, dword ptr [ebp-10]
:00403B4A 33C0                    xor eax, eax
:00403B4C 8A4201                  mov al, byte ptr [edx+01]
:00403B4F 8BC8                    mov ecx, eax
:00403B51 6BC924                  imul ecx, 00000024
:00403B54 81C1502C4B00            add ecx, 004B2C50
:00403B5A E811BB0500              call 0045F670
:00403B5F 8BC8                    mov ecx, eax
:00403B61 6BC948                  imul ecx, 00000048
:00403B64 81C1681B4A00            add ecx, 004A1B68
:00403B6A E84E370000              call 004072BD
:00403B6F 25FF000000              and eax, 000000FF
:00403B74 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00403B77 0FAFC1                  imul eax, ecx
:00403B7A 33D2                    xor edx, edx
:00403B7C B90A000000              mov ecx, 0000000A
:00403B81 F7F1                    div ecx
:00403B83 8945F4                  mov dword ptr [ebp-0C], eax
:00403B86 8B45F4                  mov eax, dword ptr [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403AF5(U)
|
:00403B89 8BE5                    mov esp, ebp
:00403B8B 5D                      pop ebp
:00403B8C C20400                  ret 0004



* Referenced by a CALL at Address:
|:0040576B   
|
:00403B8F 55                      push ebp
:00403B90 8BEC                    mov ebp, esp
:00403B92 6AFF                    push FFFFFFFF
:00403B94 688C4F4800              push 00484F8C
:00403B99 64A100000000            mov eax, dword ptr fs:[00000000]
:00403B9F 50                      push eax
:00403BA0 64892500000000          mov dword ptr fs:[00000000], esp
:00403BA7 81EC1C010000            sub esp, 0000011C
:00403BAD 898DDCFEFFFF            mov dword ptr [ebp+FFFFFEDC], ecx
:00403BB3 8B85DCFEFFFF            mov eax, dword ptr [ebp+FFFFFEDC]
:00403BB9 33C9                    xor ecx, ecx
:00403BBB 8A08                    mov cl, byte ptr [eax]
:00403BBD 51                      push ecx
:00403BBE 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:00403BC4 8B4A0C                  mov ecx, dword ptr [edx+0C]
:00403BC7 E87CC00300              call 0043FC48
:00403BCC 8845F0                  mov byte ptr [ebp-10], al
:00403BCF 8B85DCFEFFFF            mov eax, dword ptr [ebp+FFFFFEDC]
:00403BD5 8B480C                  mov ecx, dword ptr [eax+0C]
:00403BD8 E843A70300              call 0043E320
:00403BDD 25FF000000              and eax, 000000FF
:00403BE2 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:00403BE8 6A04                    push 00000004
:00403BEA 6A00                    push 00000000
:00403BEC 6A00                    push 00000000
:00403BEE B9C8E44A00              mov ecx, 004AE4C8
:00403BF3 E848BE0700              call 0047FA40
:00403BF8 8985E4FEFFFF            mov dword ptr [ebp+FFFFFEE4], eax
:00403BFE 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00403C04 E8A7F6FFFF              call 004032B0
:00403C09 C745FC00000000          mov [ebp-04], 00000000

* Possible StringData Ref from Data Obj ->"UNIT_ATK.E5"
                                  |
:00403C10 68C0BB4800              push 0048BBC0
:00403C15 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00403C1B E815BF0100              call 0041FB35
:00403C20 6A04                    push 00000004
:00403C22 6A00                    push 00000000
:00403C24 6800690000              push 00006900
:00403C29 B9C8E44A00              mov ecx, 004AE4C8
:00403C2E E80DBE0700              call 0047FA40
:00403C33 50                      push eax
:00403C34 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00403C37 81E1FF000000            and ecx, 000000FF
:00403C3D 51                      push ecx
:00403C3E 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00403C44 E840C00100              call 0041FC89
:00403C49 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00403C4F E871560100              call 004192C5
:00403C54 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:00403C5A 8995D8FEFFFF            mov dword ptr [ebp+FFFFFED8], edx
:00403C60 83BDD8FEFFFF03          cmp dword ptr [ebp+FFFFFED8], 00000003
:00403C67 0F87E8000000            ja 00403D55
:00403C6D 8B85D8FEFFFF            mov eax, dword ptr [ebp+FFFFFED8]
:00403C73 FF2485753D4000          jmp dword ptr [4*eax+00403D75]
:00403C7A 6A04                    push 00000004
:00403C7C 6A00                    push 00000000
:00403C7E 6800A90000              push 0000A900
:00403C83 B9C8E44A00              mov ecx, 004AE4C8
:00403C88 E8B3BD0700              call 0047FA40
:00403C8D 8985E8FEFFFF            mov dword ptr [ebp+FFFFFEE8], eax
:00403C93 6800400000              push 00004000
:00403C98 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:00403C9E 51                      push ecx
:00403C9F 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:00403CA5 52                      push edx
:00403CA6 E852C00700              call 0047FCFD
:00403CAB 83C40C                  add esp, 0000000C
:00403CAE E9A2000000              jmp 00403D55
:00403CB3 6A04                    push 00000004
:00403CB5 6A00                    push 00000000
:00403CB7 6800E90000              push 0000E900
:00403CBC B9C8E44A00              mov ecx, 004AE4C8
:00403CC1 E87ABD0700              call 0047FA40
:00403CC6 8985E8FEFFFF            mov dword ptr [ebp+FFFFFEE8], eax
:00403CCC 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:00403CD2 50                      push eax
:00403CD3 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00403CD9 51                      push ecx
:00403CDA 6800010000              push 00000100
:00403CDF 6A40                    push 00000040
:00403CE1 E86DB10100              call 0041EE53
:00403CE6 83C410                  add esp, 00000010
:00403CE9 EB6A                    jmp 00403D55
:00403CEB 6A04                    push 00000004
:00403CED 6A00                    push 00000000
:00403CEF 6800E90000              push 0000E900
:00403CF4 B9C8E44A00              mov ecx, 004AE4C8
:00403CF9 E842BD0700              call 0047FA40
:00403CFE 8985E8FEFFFF            mov dword ptr [ebp+FFFFFEE8], eax
:00403D04 6800400000              push 00004000
:00403D09 8B95E4FEFFFF            mov edx, dword ptr [ebp+FFFFFEE4]
:00403D0F 52                      push edx
:00403D10 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:00403D16 50                      push eax
:00403D17 E8E1BF0700              call 0047FCFD
:00403D1C 83C40C                  add esp, 0000000C
:00403D1F EB34                    jmp 00403D55
:00403D21 6A04                    push 00000004
:00403D23 6A00                    push 00000000
:00403D25 6800690000              push 00006900
:00403D2A B9C8E44A00              mov ecx, 004AE4C8
:00403D2F E80CBD0700              call 0047FA40
:00403D34 8985E8FEFFFF            mov dword ptr [ebp+FFFFFEE8], eax
:00403D3A 6800400000              push 00004000
:00403D3F 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:00403D45 51                      push ecx
:00403D46 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:00403D4C 52                      push edx
:00403D4D E8ABBF0700              call 0047FCFD
:00403D52 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00403C67(C), :00403CAE(U), :00403CE9(U), :00403D1F(U)
|
:00403D55 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00403D5C 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00403D62 E869F5FFFF              call 004032D0
:00403D67 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00403D6A 64890D00000000          mov dword ptr fs:[00000000], ecx
:00403D71 8BE5                    mov esp, ebp
:00403D73 5D                      pop ebp
:00403D74 C3                      ret



:00403D75 7A3C4000                DWORD 00403C7A
:00403D79 B33C4000                DWORD 00403CB3
:00403D7D 213D4000                DWORD 00403D21
:00403D81 EB3C4000                DWORD 00403CEB



* Referenced by a CALL at Addresses:
|:004041D8   , :004057AF   
|
:00403D85 55                      push ebp
:00403D86 8BEC                    mov ebp, esp
:00403D88 6AFF                    push FFFFFFFF
:00403D8A 68A24F4800              push 00484FA2
:00403D8F 64A100000000            mov eax, dword ptr fs:[00000000]
:00403D95 50                      push eax
:00403D96 64892500000000          mov dword ptr fs:[00000000], esp
:00403D9D 81EC24010000            sub esp, 00000124
:00403DA3 898DD8FEFFFF            mov dword ptr [ebp+FFFFFED8], ecx
:00403DA9 8B85D8FEFFFF            mov eax, dword ptr [ebp+FFFFFED8]
:00403DAF 33C9                    xor ecx, ecx
:00403DB1 8A4801                  mov cl, byte ptr [eax+01]
:00403DB4 51                      push ecx
:00403DB5 8B95D8FEFFFF            mov edx, dword ptr [ebp+FFFFFED8]
:00403DBB 33C0                    xor eax, eax
:00403DBD 8A4201                  mov al, byte ptr [edx+01]
:00403DC0 8BC8                    mov ecx, eax
:00403DC2 6BC924                  imul ecx, 00000024
:00403DC5 81C1502C4B00            add ecx, 004B2C50
:00403DCB E878BE0300              call 0043FC48
:00403DD0 8845F0                  mov byte ptr [ebp-10], al
:00403DD3 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:00403DD9 33D2                    xor edx, edx
:00403DDB 8A5101                  mov dl, byte ptr [ecx+01]
:00403DDE 8BCA                    mov ecx, edx
:00403DE0 6BC924                  imul ecx, 00000024
:00403DE3 81C1502C4B00            add ecx, 004B2C50
:00403DE9 E832A50300              call 0043E320
:00403DEE 25FF000000              and eax, 000000FF
:00403DF3 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:00403DF9 6A04                    push 00000004
:00403DFB 6A00                    push 00000000
:00403DFD 6800400000              push 00004000
:00403E02 B9C8E44A00              mov ecx, 004AE4C8
:00403E07 E834BC0700              call 0047FA40
:00403E0C 8985E4FEFFFF            mov dword ptr [ebp+FFFFFEE4], eax
:00403E12 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00403E18 E893F4FFFF              call 004032B0
:00403E1D C745FC00000000          mov [ebp-04], 00000000

* Possible StringData Ref from Data Obj ->"UNIT_SPC.E5"
                                  |
:00403E24 68D0BB4800              push 0048BBD0
:00403E29 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00403E2F E801BD0100              call 0041FB35
:00403E34 6A04                    push 00000004
:00403E36 6A00                    push 00000000
:00403E38 6800690000              push 00006900
:00403E3D B9C8E44A00              mov ecx, 004AE4C8
:00403E42 E8F9BB0700              call 0047FA40
:00403E47 50                      push eax
:00403E48 8B45F0                  mov eax, dword ptr [ebp-10]
:00403E4B 25FF000000              and eax, 000000FF
:00403E50 50                      push eax
:00403E51 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00403E57 E82DBE0100              call 0041FC89
:00403E5C 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00403E62 E85E540100              call 004192C5
:00403E67 8B4D08                  mov ecx, dword ptr [ebp+08]
:00403E6A 81E1FF000000            and ecx, 000000FF
:00403E70 8B95D8FEFFFF            mov edx, dword ptr [ebp+FFFFFED8]
:00403E76 83BC8A8400000000        cmp dword ptr [edx+4*ecx+00000084], 00000000
:00403E7E 0F85B8010000            jne 0040403C
:00403E84 8B4508                  mov eax, dword ptr [ebp+08]
:00403E87 25FF000000              and eax, 000000FF
:00403E8C 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:00403E92 83BC815402000000        cmp dword ptr [ecx+4*eax+00000254], 00000000
:00403E9A 0F859C010000            jne 0040403C
:00403EA0 C785DCFEFFFF08000000    mov dword ptr [ebp+FFFFFEDC], 00000008
:00403EAA 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:00403EB0 8995D4FEFFFF            mov dword ptr [ebp+FFFFFED4], edx
:00403EB6 83BDD4FEFFFF03          cmp dword ptr [ebp+FFFFFED4], 00000003
:00403EBD 0F8774010000            ja 00404037
:00403EC3 8B85D4FEFFFF            mov eax, dword ptr [ebp+FFFFFED4]
:00403EC9 FF248566414000          jmp dword ptr [4*eax+00404166]
:00403ED0 6A04                    push 00000004
:00403ED2 6A00                    push 00000000
:00403ED4 6800720000              push 00007200
:00403ED9 B9C8E44A00              mov ecx, 004AE4C8
:00403EDE E85DBB0700              call 0047FA40
:00403EE3 8985E8FEFFFF            mov dword ptr [ebp+FFFFFEE8], eax
:00403EE9 6800090000              push 00000900
:00403EEE 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:00403EF4 51                      push ecx
:00403EF5 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:00403EFB 52                      push edx
:00403EFC E8FCBD0700              call 0047FCFD
:00403F01 83C40C                  add esp, 0000000C
:00403F04 8B85D8FEFFFF            mov eax, dword ptr [ebp+FFFFFED8]
:00403F0A C7800C06000000000000    mov dword ptr [ebx+0000060C], 00000000
:00403F14 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:00403F1A 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:00403F20 899110060000            mov dword ptr [ecx+00000610], edx
:00403F26 E90C010000              jmp 00404037
:00403F2B 6A04                    push 00000004
:00403F2D 6A00                    push 00000000
:00403F2F 68007B0000              push 00007B00
:00403F34 B9C8E44A00              mov ecx, 004AE4C8
:00403F39 E802BB0700              call 0047FA40
:00403F3E 8985E8FEFFFF            mov dword ptr [ebp+FFFFFEE8], eax
:00403F44 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:00403F4A 50                      push eax
:00403F4B 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00403F51 51                      push ecx
:00403F52 6A30                    push 00000030
:00403F54 6A30                    push 00000030
:00403F56 E8F8AE0100              call 0041EE53
:00403F5B 83C410                  add esp, 00000010
:00403F5E 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:00403F64 F7DA                    neg edx
:00403F66 8B85D8FEFFFF            mov eax, dword ptr [ebp+FFFFFED8]
:00403F6C 89900C060000            mov dword ptr [eax+0000060C], edx
:00403F72 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:00403F78 C7811006000000000000    mov dword ptr [ebx+00000610], 00000000
:00403F82 E9B0000000              jmp 00404037
:00403F87 6A04                    push 00000004
:00403F89 6A00                    push 00000000
:00403F8B 68007B0000              push 00007B00
:00403F90 B9C8E44A00              mov ecx, 004AE4C8
:00403F95 E8A6BA0700              call 0047FA40
:00403F9A 8985E8FEFFFF            mov dword ptr [ebp+FFFFFEE8], eax
:00403FA0 6800090000              push 00000900
:00403FA5 8B95E4FEFFFF            mov edx, dword ptr [ebp+FFFFFEE4]
:00403FAB 52                      push edx
:00403FAC 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:00403FB2 50                      push eax
:00403FB3 E845BD0700              call 0047FCFD
:00403FB8 83C40C                  add esp, 0000000C
:00403FBB 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:00403FC1 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:00403FC7 89910C060000            mov dword ptr [ecx+0000060C], edx
:00403FCD 8B85D8FEFFFF            mov eax, dword ptr [ebp+FFFFFED8]
:00403FD3 C7801006000000000000    mov dword ptr [ebx+00000610], 00000000
:00403FDD EB58                    jmp 00404037
:00403FDF 6A04                    push 00000004
:00403FE1 6A00                    push 00000000
:00403FE3 6800690000              push 00006900
:00403FE8 B9C8E44A00              mov ecx, 004AE4C8
:00403FED E84EBA0700              call 0047FA40
:00403FF2 8985E8FEFFFF            mov dword ptr [ebp+FFFFFEE8], eax
:00403FF8 6800090000              push 00000900
:00403FFD 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:00404003 51                      push ecx
:00404004 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:0040400A 52                      push edx
:0040400B E8EDBC0700              call 0047FCFD
:00404010 83C40C                  add esp, 0000000C
:00404013 8B85D8FEFFFF            mov eax, dword ptr [ebp+FFFFFED8]
:00404019 C7800C06000000000000    mov dword ptr [ebx+0000060C], 00000000
:00404023 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:00404029 F7D9                    neg ecx
:0040402B 8B95D8FEFFFF            mov edx, dword ptr [ebp+FFFFFED8]
:00404031 898A10060000            mov dword ptr [edx+00000610], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00403EBD(C), :00403F26(U), :00403F82(U), :00403FDD(U)
|
:00404037 E908010000              jmp 00404144

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00403E7E(C), :00403E9A(C)
|
:0040403C 8B85D8FEFFFF            mov eax, dword ptr [ebp+FFFFFED8]
:00404042 8B8804060000            mov ecx, dword ptr [eax+00000604]
:00404048 F7D9                    neg ecx
:0040404A 1BC9                    sbb ecx, ecx
:0040404C 83E104                  and ecx, 00000004
:0040404F 83C104                  add ecx, 00000004
:00404052 898DDCFEFFFF            mov dword ptr [ebp+FFFFFEDC], ecx
:00404058 6A04                    push 00000004
:0040405A 6A00                    push 00000000
:0040405C 6800840000              push 00008400
:00404061 B9C8E44A00              mov ecx, 004AE4C8
:00404066 E8D5B90700              call 0047FA40
:0040406B 8985E8FEFFFF            mov dword ptr [ebp+FFFFFEE8], eax
:00404071 6800090000              push 00000900
:00404076 8B95E4FEFFFF            mov edx, dword ptr [ebp+FFFFFEE4]
:0040407C 52                      push edx
:0040407D 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:00404083 50                      push eax
:00404084 E874BC0700              call 0047FCFD
:00404089 83C40C                  add esp, 0000000C
:0040408C 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:00404092 898DD0FEFFFF            mov dword ptr [ebp+FFFFFED0], ecx
:00404098 83BDD0FEFFFF03          cmp dword ptr [ebp+FFFFFED0], 00000003
:0040409F 0F879F000000            ja 00404144
:004040A5 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:004040AB FF249576414000          jmp dword ptr [4*edx+00404176]
:004040B2 8B85D8FEFFFF            mov eax, dword ptr [ebp+FFFFFED8]
:004040B8 C7800C06000000000000    mov dword ptr [ebx+0000060C], 00000000
:004040C2 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:004040C8 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:004040CE 899110060000            mov dword ptr [ecx+00000610], edx
:004040D4 EB6E                    jmp 00404144
:004040D6 8B85DCFEFFFF            mov eax, dword ptr [ebp+FFFFFEDC]
:004040DC F7D8                    neg eax
:004040DE 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:004040E4 89810C060000            mov dword ptr [ecx+0000060C], eax
:004040EA 8B95D8FEFFFF            mov edx, dword ptr [ebp+FFFFFED8]
:004040F0 C7821006000000000000    mov dword ptr [ebx+00000610], 00000000
:004040FA EB48                    jmp 00404144
:004040FC 8B85D8FEFFFF            mov eax, dword ptr [ebp+FFFFFED8]
:00404102 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:00404108 89880C060000            mov dword ptr [eax+0000060C], ecx
:0040410E 8B95D8FEFFFF            mov edx, dword ptr [ebp+FFFFFED8]
:00404114 C7821006000000000000    mov dword ptr [ebx+00000610], 00000000
:0040411E EB24                    jmp 00404144
:00404120 8B85D8FEFFFF            mov eax, dword ptr [ebp+FFFFFED8]
:00404126 C7800C06000000000000    mov dword ptr [ebx+0000060C], 00000000
:00404130 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:00404136 F7D9                    neg ecx
:00404138 8B95D8FEFFFF            mov edx, dword ptr [ebp+FFFFFED8]
:0040413E 898A10060000            mov dword ptr [edx+00000610], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00404037(U), :0040409F(C), :004040D4(U), :004040FA(U), :0040411E(U)
|
:00404144 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0040414B 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00404151 E87AF1FFFF              call 004032D0
:00404156 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00404159 64890D00000000          mov dword ptr fs:[00000000], ecx
:00404160 8BE5                    mov esp, ebp
:00404162 5D                      pop ebp
:00404163 C20400                  ret 0004



:00404166 D03E4000                DWORD 00403ED0
:0040416A 2B3F4000                DWORD 00403F2B
:0040416E DF3F4000                DWORD 00403FDF
:00404172 873F4000                DWORD 00403F87
:00404176 B2404000                DWORD 004040B2
:0040417A D6404000                DWORD 004040D6
:0040417E 20414000                DWORD 00404120
:00404182 FC404000                DWORD 004040FC



* Referenced by a CALL at Addresses:
|:00405540   , :004056E2   
|
:00404186 55                      push ebp
:00404187 8BEC                    mov ebp, esp
:00404189 83EC1C                  sub esp, 0000001C
:0040418C 56                      push esi
:0040418D 894DE8                  mov dword ptr [ebp-18], ecx
:00404190 C645F401                mov [ebp-0C], 01
:00404194 EB08                    jmp 0040419E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004044D1(U)
|
:00404196 8A45F4                  mov al, byte ptr [ebp-0C]
:00404199 0401                    add al, 01
:0040419B 8845F4                  mov byte ptr [ebp-0C], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404194(U)
|
:0040419E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004041A1 81E1FF000000            and ecx, 000000FF
:004041A7 8B55E8                  mov edx, dword ptr [ebp-18]
:004041AA 33C0                    xor eax, eax
:004041AC 8A440A10                mov al, byte ptr [edx+ecx+10]
:004041B0 3DFF000000              cmp eax, 000000FF
:004041B5 0F841B030000            je 004044D6
:004041BB 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004041BE 81E1FF000000            and ecx, 000000FF
:004041C4 8B55E8                  mov edx, dword ptr [ebp-18]
:004041C7 8B45E8                  mov eax, dword ptr [ebp-18]
:004041CA 8A4C0810                mov cl, byte ptr [eax+ecx+10]
:004041CE 884A01                  mov byte ptr [edx+01], cl
:004041D1 8A55F4                  mov dl, byte ptr [ebp-0C]
:004041D4 52                      push edx
:004041D5 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004041D8 E8A8FBFFFF              call 00403D85
:004041DD 8B45E8                  mov eax, dword ptr [ebp-18]
:004041E0 33C9                    xor ecx, ecx
:004041E2 8A4801                  mov cl, byte ptr [eax+01]
:004041E5 6BC924                  imul ecx, 00000024
:004041E8 81C1502C4B00            add ecx, 004B2C50
:004041EE E86DF1FFFF              call 00403360
:004041F3 50                      push eax
:004041F4 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004041F7 81C125040000            add ecx, 00000425
:004041FD E89E230000              call 004065A0
:00404202 8B55E8                  mov edx, dword ptr [ebp-18]
:00404205 33C0                    xor eax, eax
:00404207 8A8225040000            mov al, byte ptr [edx+00000425]
:0040420D 8BF0                    mov esi, eax
:0040420F B950424B00              mov ecx, 004B4250
:00404214 E87AD80400              call 00451A93
:00404219 99                      cdq
:0040421A B930000000              mov ecx, 00000030
:0040421F F7F9                    idiv ecx
:00404221 2BF0                    sub esi, eax
:00404223 8975FC                  mov dword ptr [ebp-04], esi
:00404226 8B55E8                  mov edx, dword ptr [ebp-18]
:00404229 33C0                    xor eax, eax
:0040422B 8A8226040000            mov al, byte ptr [edx+00000426]
:00404231 8BF0                    mov esi, eax
:00404233 B950424B00              mov ecx, 004B4250
:00404238 E867D80400              call 00451AA4
:0040423D 99                      cdq
:0040423E B930000000              mov ecx, 00000030
:00404243 F7F9                    idiv ecx
:00404245 2BF0                    sub esi, eax
:00404247 8975F8                  mov dword ptr [ebp-08], esi
:0040424A 8B55FC                  mov edx, dword ptr [ebp-04]
:0040424D 6BD230                  imul edx, 00000030
:00404250 8955F0                  mov dword ptr [ebp-10], edx
:00404253 8B45F8                  mov eax, dword ptr [ebp-08]
:00404256 6BC030                  imul eax, 00000030
:00404259 83C038                  add eax, 00000038
:0040425C 8945EC                  mov dword ptr [ebp-14], eax
:0040425F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00404262 894DE4                  mov dword ptr [ebp-1C], ecx
:00404265 837DE411                cmp dword ptr [ebp-1C], 00000011
:00404269 740F                    je 0040427A
:0040426B 837DE419                cmp dword ptr [ebp-1C], 00000019
:0040426F 0F8494010000            je 00404409
:00404275 E957020000              jmp 004044D1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404269(C)
|
:0040427A 6A04                    push 00000004
:0040427C B9181B4B00              mov ecx, 004B1B18
:00404281 E8BAF0FFFF              call 00403340
:00404286 E855820200              call 0042C4E0
:0040428B E84BA30100              call 0041E5DB
:00404290 8B55F8                  mov edx, dword ptr [ebp-08]
:00404293 52                      push edx
:00404294 8B45FC                  mov eax, dword ptr [ebp-04]
:00404297 50                      push eax
:00404298 E85CF4FFFF              call 004036F9
:0040429D 83C408                  add esp, 00000008
:004042A0 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004042A3 33D2                    xor edx, edx
:004042A5 8A5101                  mov dl, byte ptr [ecx+01]
:004042A8 8BCA                    mov ecx, edx
:004042AA 6BC924                  imul ecx, 00000024
:004042AD 81C1502C4B00            add ecx, 004B2C50
:004042B3 E8D8E90600              call 00472C90
:004042B8 85C0                    test eax, eax
:004042BA 751E                    jne 004042DA
:004042BC 8B45E8                  mov eax, dword ptr [ebp-18]
:004042BF 33C9                    xor ecx, ecx
:004042C1 8A4801                  mov cl, byte ptr [eax+01]
:004042C4 51                      push ecx
:004042C5 8B55EC                  mov edx, dword ptr [ebp-14]
:004042C8 52                      push edx
:004042C9 8B45F0                  mov eax, dword ptr [ebp-10]
:004042CC 50                      push eax
:004042CD E84DA80300              call 0043EB1F
:004042D2 83C40C                  add esp, 0000000C
:004042D5 E925010000              jmp 004043FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004042BA(C)
|
:004042DA 6A04                    push 00000004
:004042DC 6A00                    push 00000000
:004042DE 6800400000              push 00004000
:004042E3 B9C8E44A00              mov ecx, 004AE4C8
:004042E8 E853B70700              call 0047FA40
:004042ED 50                      push eax
:004042EE 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004042F1 8A5101                  mov dl, byte ptr [ecx+01]
:004042F4 52                      push edx
:004042F5 6A30                    push 00000030
:004042F7 6A30                    push 00000030
:004042F9 8B45EC                  mov eax, dword ptr [ebp-14]
:004042FC 50                      push eax
:004042FD 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00404300 51                      push ecx
:00404301 E876D00400              call 0045137C
:00404306 83C418                  add esp, 00000018
:00404309 E8E8A20100              call 0041E5F6
:0040430E 6A02                    push 00000002
:00404310 B9181B4B00              mov ecx, 004B1B18
:00404315 E826F0FFFF              call 00403340
:0040431A E8C1810200              call 0042C4E0
:0040431F E8B7A20100              call 0041E5DB
:00404324 8B55F4                  mov edx, dword ptr [ebp-0C]
:00404327 81E2FF000000            and edx, 000000FF
:0040432D 8B45E8                  mov eax, dword ptr [ebp-18]
:00404330 83BC908400000000        cmp dword ptr [eax+4*edx+00000084], 00000000
:00404338 7448                    je 00404382
:0040433A 6A18                    push 00000018
:0040433C 6A12                    push 00000012
:0040433E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00404341 81E1FF000000            and ecx, 000000FF
:00404347 8B55E8                  mov edx, dword ptr [ebp-18]
:0040434A 8B848A84000000          mov eax, dword ptr [edx+4*ecx+00000084]
:00404351 50                      push eax
:00404352 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00404355 8A5101                  mov dl, byte ptr [ecx+01]
:00404358 52                      push edx
:00404359 E893B70400              call 0044FAF1
:0040435E 83C410                  add esp, 00000010
:00404361 6A01                    push 00000001
:00404363 8B45E8                  mov eax, dword ptr [ebp-18]
:00404366 33C9                    xor ecx, ecx
:00404368 83B80406000000          cmp dword ptr [eax+00000604], 00000000
:0040436F 0F95C1                  setne cl
:00404372 83C123                  add ecx, 00000023
:00404375 51                      push ecx
:00404376 B9B0694B00              mov ecx, 004B69B0
:0040437B E8FA020700              call 0047467A
:00404380 EB7D                    jmp 004043FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404338(C)
|
:00404382 8B55F4                  mov edx, dword ptr [ebp-0C]
:00404385 81E2FF000000            and edx, 000000FF
:0040438B 8B45E8                  mov eax, dword ptr [ebp-18]
:0040438E 83BC905402000000        cmp dword ptr [eax+4*edx+00000254], 00000000
:00404396 7448                    je 004043E0
:00404398 6A18                    push 00000018
:0040439A 6A45                    push 00000045
:0040439C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040439F 81E1FF000000            and ecx, 000000FF
:004043A5 8B55E8                  mov edx, dword ptr [ebp-18]
:004043A8 8B848A54020000          mov eax, dword ptr [edx+4*ecx+00000254]
:004043AF 50                      push eax
:004043B0 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004043B3 8A5101                  mov dl, byte ptr [ecx+01]
:004043B6 52                      push edx
:004043B7 E835B70400              call 0044FAF1
:004043BC 83C410                  add esp, 00000010
:004043BF 6A01                    push 00000001
:004043C1 8B45E8                  mov eax, dword ptr [ebp-18]
:004043C4 33C9                    xor ecx, ecx
:004043C6 83B80406000000          cmp dword ptr [eax+00000604], 00000000
:004043CD 0F95C1                  setne cl
:004043D0 83C123                  add ecx, 00000023
:004043D3 51                      push ecx
:004043D4 B9B0694B00              mov ecx, 004B69B0
:004043D9 E89C020700              call 0047467A
:004043DE EB1F                    jmp 004043FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404396(C)
|
:004043E0 6A01                    push 00000001
:004043E2 8B55E8                  mov edx, dword ptr [ebp-18]
:004043E5 33C0                    xor eax, eax
:004043E7 83BA0406000000          cmp dword ptr [edx+00000604], 00000000
:004043EE 0F95C0                  setne al
:004043F1 83C01E                  add eax, 0000001E
:004043F4 50                      push eax
:004043F5 B9B0694B00              mov ecx, 004B69B0
:004043FA E87B020700              call 0047467A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004042D5(U), :00404380(U), :004043DE(U)
|
:004043FF E8F2A10100              call 0041E5F6
:00404404 E9C8000000              jmp 004044D1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040426F(C)
|
:00404409 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040440C 81E1FF000000            and ecx, 000000FF
:00404412 8B55E8                  mov edx, dword ptr [ebp-18]
:00404415 8B848A84000000          mov eax, dword ptr [edx+4*ecx+00000084]
:0040441C 50                      push eax
:0040441D 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00404420 33D2                    xor edx, edx
:00404422 8A5101                  mov dl, byte ptr [ecx+01]
:00404425 8BCA                    mov ecx, edx
:00404427 6BC924                  imul ecx, 00000024
:0040442A 81C1502C4B00            add ecx, 004B2C50
:00404430 E85BE80600              call 00472C90
:00404435 50                      push eax
:00404436 E863B60700              call 0047FA9E
:0040443B 83C408                  add esp, 00000008
:0040443E 8BF0                    mov esi, eax
:00404440 8B45E8                  mov eax, dword ptr [ebp-18]
:00404443 33C9                    xor ecx, ecx
:00404445 8A4801                  mov cl, byte ptr [eax+01]
:00404448 6BC924                  imul ecx, 00000024
:0040444B 81C1502C4B00            add ecx, 004B2C50
:00404451 E81AB20500              call 0045F670
:00404456 8BC8                    mov ecx, eax
:00404458 6BC948                  imul ecx, 00000048
:0040445B 81C1681B4A00            add ecx, 004A1B68
:00404461 E8B52D0000              call 0040721B
:00404466 33D2                    xor edx, edx
:00404468 B905000000              mov ecx, 00000005
:0040446D F7F1                    div ecx
:0040446F 3BF0                    cmp esi, eax
:00404471 731A                    jnb 0040448D
:00404473 6A20                    push 00000020
:00404475 8B55E8                  mov edx, dword ptr [ebp-18]
:00404478 33C0                    xor eax, eax
:0040447A 8A4201                  mov al, byte ptr [edx+01]
:0040447D 8BC8                    mov ecx, eax
:0040447F 6BC924                  imul ecx, 00000024
:00404482 81C1502C4B00            add ecx, 004B2C50
:00404488 E88BE20300              call 00442718

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404471(C)
|
:0040448D 6A04                    push 00000004
:0040448F B9181B4B00              mov ecx, 004B1B18
:00404494 E8A7EEFFFF              call 00403340
:00404499 E842800200              call 0042C4E0
:0040449E E838A10100              call 0041E5DB
:004044A3 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004044A6 51                      push ecx
:004044A7 8B55FC                  mov edx, dword ptr [ebp-04]
:004044AA 52                      push edx
:004044AB E849F2FFFF              call 004036F9
:004044B0 83C408                  add esp, 00000008
:004044B3 8B45E8                  mov eax, dword ptr [ebp-18]
:004044B6 33C9                    xor ecx, ecx
:004044B8 8A4801                  mov cl, byte ptr [eax+01]
:004044BB 51                      push ecx
:004044BC 8B55EC                  mov edx, dword ptr [ebp-14]
:004044BF 52                      push edx
:004044C0 8B45F0                  mov eax, dword ptr [ebp-10]
:004044C3 50                      push eax
:004044C4 E856A60300              call 0043EB1F
:004044C9 83C40C                  add esp, 0000000C
:004044CC E825A10100              call 0041E5F6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00404275(U), :00404404(U)
|
:004044D1 E9C0FCFFFF              jmp 00404196

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004041B5(C)
|
:004044D6 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004044D9 8B55E8                  mov edx, dword ptr [ebp-18]
:004044DC 8A4210                  mov al, byte ptr [edx+10]
:004044DF 884101                  mov byte ptr [ecx+01], al
:004044E2 5E                      pop esi
:004044E3 8BE5                    mov esp, ebp
:004044E5 5D                      pop ebp
:004044E6 C20400                  ret 0004



* Referenced by a CALL at Address:
|:00405880   
|
:004044E9 55                      push ebp
:004044EA 8BEC                    mov ebp, esp
:004044EC B838100000              mov eax, 00001038
:004044F1 E86ACC0700              call 00481160
:004044F6 56                      push esi
:004044F7 898DCCEFFFFF            mov dword ptr [ebp+FFFFEFCC], ecx
:004044FD 8B85CCEFFFFF            mov eax, dword ptr [ebp+FFFFEFCC]
:00404503 8B480C                  mov ecx, dword ptr [eax+0C]
:00404506 E855EEFFFF              call 00403360
:0040450B 668B08                  mov cx, word ptr [eax]
:0040450E 66898DE8EFFFFF          mov word ptr [ebp+FFFFEFE8], cx
:00404515 8B95CCEFFFFF            mov edx, dword ptr [ebp+FFFFEFCC]
:0040451B 33C0                    xor eax, eax
:0040451D 8A4201                  mov al, byte ptr [edx+01]
:00404520 8BC8                    mov ecx, eax
:00404522 6BC924                  imul ecx, 00000024
:00404525 81C1502C4B00            add ecx, 004B2C50
:0040452B E830EEFFFF              call 00403360
:00404530 668B08                  mov cx, word ptr [eax]
:00404533 66898DE0EFFFFF          mov word ptr [ebp+FFFFEFE0], cx
:0040453A 8BB5E8EFFFFF            mov esi, dword ptr [ebp+FFFFEFE8]
:00404540 81E6FF000000            and esi, 000000FF
:00404546 B950424B00              mov ecx, 004B4250
:0040454B E843D50400              call 00451A93
:00404550 99                      cdq
:00404551 B930000000              mov ecx, 00000030
:00404556 F7F9                    idiv ecx
:00404558 2BF0                    sub esi, eax
:0040455A 89B5F4EFFFFF            mov dword ptr [ebp+FFFFEFF4], esi
:00404560 8BB5E9EFFFFF            mov esi, dword ptr [ebp+FFFFEFE9]
:00404566 81E6FF000000            and esi, 000000FF
:0040456C B950424B00              mov ecx, 004B4250
:00404571 E82ED50400              call 00451AA4
:00404576 99                      cdq
:00404577 B930000000              mov ecx, 00000030
:0040457C F7F9                    idiv ecx
:0040457E 2BF0                    sub esi, eax
:00404580 89B5ECEFFFFF            mov dword ptr [ebp+FFFFEFEC], esi
:00404586 8BB5E0EFFFFF            mov esi, dword ptr [ebp+FFFFEFE0]
:0040458C 81E6FF000000            and esi, 000000FF
:00404592 B950424B00              mov ecx, 004B4250
:00404597 E8F7D40400              call 00451A93
:0040459C 99                      cdq
:0040459D B930000000              mov ecx, 00000030
:004045A2 F7F9                    idiv ecx
:004045A4 2BF0                    sub esi, eax
:004045A6 89B5F8EFFFFF            mov dword ptr [ebp+FFFFEFF8], esi
:004045AC 8BB5E1EFFFFF            mov esi, dword ptr [ebp+FFFFEFE1]
:004045B2 81E6FF000000            and esi, 000000FF
:004045B8 B950424B00              mov ecx, 004B4250
:004045BD E8E2D40400              call 00451AA4
:004045C2 99                      cdq
:004045C3 B930000000              mov ecx, 00000030
:004045C8 F7F9                    idiv ecx
:004045CA 2BF0                    sub esi, eax
:004045CC 89B5FCEFFFFF            mov dword ptr [ebp+FFFFEFFC], esi
:004045D2 8B95F4EFFFFF            mov edx, dword ptr [ebp+FFFFEFF4]
:004045D8 6BD230                  imul edx, 00000030
:004045DB 8995DCEFFFFF            mov dword ptr [ebp+FFFFEFDC], edx
:004045E1 8B85ECEFFFFF            mov eax, dword ptr [ebp+FFFFEFEC]
:004045E7 6BC030                  imul eax, 00000030
:004045EA 83C038                  add eax, 00000038
:004045ED 8985D8EFFFFF            mov dword ptr [ebp+FFFFEFD8], eax
:004045F3 8B8DF8EFFFFF            mov ecx, dword ptr [ebp+FFFFEFF8]
:004045F9 6BC930                  imul ecx, 00000030
:004045FC 898DD4EFFFFF            mov dword ptr [ebp+FFFFEFD4], ecx
:00404602 8B95FCEFFFFF            mov edx, dword ptr [ebp+FFFFEFFC]
:00404608 6BD230                  imul edx, 00000030
:0040460B 83C238                  add edx, 00000038
:0040460E 8995D0EFFFFF            mov dword ptr [ebp+FFFFEFD0], edx
:00404614 C785F0EFFFFF00000000    mov dword ptr [ebp+FFFFEFF0], 00000000
:0040461E EB0F                    jmp 0040462F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004056F8(U)
|
:00404620 8B85F0EFFFFF            mov eax, dword ptr [ebp+FFFFEFF0]
:00404626 83C001                  add eax, 00000001
:00404629 8985F0EFFFFF            mov dword ptr [ebp+FFFFEFF0], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040461E(U)
|
:0040462F 83BDF0EFFFFF1B          cmp dword ptr [ebp+FFFFEFF0], 0000001B
:00404636 0F83C1100000            jnb 004056FD
:0040463C 8B8DF0EFFFFF            mov ecx, dword ptr [ebp+FFFFEFF0]
:00404642 898DC8EFFFFF            mov dword ptr [ebp+FFFFEFC8], ecx
:00404648 83BDC8EFFFFF19          cmp dword ptr [ebp+FFFFEFC8], 00000019
:0040464F 0F8792100000            ja 004056E7
:00404655 8B85C8EFFFFF            mov eax, dword ptr [ebp+FFFFEFC8]
:0040465B 33D2                    xor edx, edx
:0040465D 8A902A574000            mov dl, byte ptr [eax+0040572A]
:00404663 FF249502574000          jmp dword ptr [4*edx+00405702]
:0040466A E86C9F0100              call 0041E5DB
:0040466F 8B8DECEFFFFF            mov ecx, dword ptr [ebp+FFFFEFEC]
:00404675 51                      push ecx
:00404676 8B95F4EFFFFF            mov edx, dword ptr [ebp+FFFFEFF4]
:0040467C 52                      push edx
:0040467D E877F0FFFF              call 004036F9
:00404682 83C408                  add esp, 00000008
:00404685 8B85FCEFFFFF            mov eax, dword ptr [ebp+FFFFEFFC]
:0040468B 50                      push eax
:0040468C 8B8DF8EFFFFF            mov ecx, dword ptr [ebp+FFFFEFF8]
:00404692 51                      push ecx
:00404693 E861F0FFFF              call 004036F9
:00404698 83C408                  add esp, 00000008
:0040469B 6A04                    push 00000004
:0040469D 6A00                    push 00000000
:0040469F 6800490000              push 00004900
:004046A4 B9C8E44A00              mov ecx, 004AE4C8
:004046A9 E892B30700              call 0047FA40
:004046AE 50                      push eax
:004046AF 6A40                    push 00000040
:004046B1 6A40                    push 00000040
:004046B3 8B95D8EFFFFF            mov edx, dword ptr [ebp+FFFFEFD8]
:004046B9 83EA08                  sub edx, 00000008
:004046BC 52                      push edx
:004046BD 8B85DCEFFFFF            mov eax, dword ptr [ebp+FFFFEFDC]
:004046C3 83E808                  sub eax, 00000008
:004046C6 50                      push eax
:004046C7 E81AD30400              call 004519E6
:004046CC 83C414                  add esp, 00000014
:004046CF 6A04                    push 00000004
:004046D1 6A00                    push 00000000
:004046D3 6800590000              push 00005900
:004046D8 B9C8E44A00              mov ecx, 004AE4C8
:004046DD E85EB30700              call 0047FA40
:004046E2 50                      push eax
:004046E3 6A40                    push 00000040
:004046E5 6A40                    push 00000040
:004046E7 8B8DD0EFFFFF            mov ecx, dword ptr [ebp+FFFFEFD0]
:004046ED 83E908                  sub ecx, 00000008
:004046F0 51                      push ecx
:004046F1 8B95D4EFFFFF            mov edx, dword ptr [ebp+FFFFEFD4]
:004046F7 83EA08                  sub edx, 00000008
:004046FA 52                      push edx
:004046FB E8E6D20400              call 004519E6
:00404700 83C414                  add esp, 00000014
:00404703 B9083D4B00              mov ecx, 004B3D08
:00404708 E823200000              call 00406730
:0040470D 6A00                    push 00000000
:0040470F 6A04                    push 00000004
:00404711 6A00                    push 00000000
:00404713 6800590000              push 00005900
:00404718 B9C8E44A00              mov ecx, 004AE4C8
:0040471D E81EB30700              call 0047FA40
:00404722 50                      push eax
:00404723 6A40                    push 00000040
:00404725 6A40                    push 00000040
:00404727 8B85D0EFFFFF            mov eax, dword ptr [ebp+FFFFEFD0]
:0040472D 83E808                  sub eax, 00000008
:00404730 50                      push eax
:00404731 8B8DD4EFFFFF            mov ecx, dword ptr [ebp+FFFFEFD4]
:00404737 83E908                  sub ecx, 00000008
:0040473A 51                      push ecx
:0040473B E8D3D10400              call 00451913
:00404740 83C418                  add esp, 00000018
:00404743 6A00                    push 00000000
:00404745 6A04                    push 00000004
:00404747 6A00                    push 00000000
:00404749 6800490000              push 00004900
:0040474E B9C8E44A00              mov ecx, 004AE4C8
:00404753 E8E8B20700              call 0047FA40
:00404758 50                      push eax
:00404759 6A40                    push 00000040
:0040475B 6A40                    push 00000040
:0040475D 8B95D8EFFFFF            mov edx, dword ptr [ebp+FFFFEFD8]
:00404763 83EA08                  sub edx, 00000008
:00404766 52                      push edx
:00404767 8B85DCEFFFFF            mov eax, dword ptr [ebp+FFFFEFDC]
:0040476D 83E808                  sub eax, 00000008
:00404770 50                      push eax
:00404771 E89DD10400              call 00451913
:00404776 83C418                  add esp, 00000018
:00404779 8B8DCCEFFFFF            mov ecx, dword ptr [ebp+FFFFEFCC]
:0040477F 33D2                    xor edx, edx
:00404781 8A5101                  mov dl, byte ptr [ecx+01]
:00404784 52                      push edx
:00404785 8B85D0EFFFFF            mov eax, dword ptr [ebp+FFFFEFD0]
:0040478B 50                      push eax
:0040478C 8B8DD4EFFFFF            mov ecx, dword ptr [ebp+FFFFEFD4]
:00404792 51                      push ecx
:00404793 E887A30300              call 0043EB1F
:00404798 83C40C                  add esp, 0000000C
:0040479B 6A04                    push 00000004
:0040479D 6A00                    push 00000000
:0040479F 8B95CCEFFFFF            mov edx, dword ptr [ebp+FFFFEFCC]
:004047A5 33C0                    xor eax, eax
:004047A7 8A02                    mov al, byte ptr [edx]
:004047A9 8BF0                    mov esi, eax
:004047AB 69F600630000            imul esi, 00006300
:004047B1 8B8DCCEFFFFF            mov ecx, dword ptr [ebp+FFFFEFCC]
:004047B7 33D2                    xor edx, edx
:004047B9 8A11                    mov dl, byte ptr [ecx]
:004047BB 52                      push edx
:004047BC E8549D0300              call 0043E515
:004047C1 83C404                  add esp, 00000004
:004047C4 83C006                  add eax, 00000006
:004047C7 69C000090000            imul eax, 00000900
:004047CD 03F0                    add esi, eax
:004047CF 56                      push esi
:004047D0 B980AB4A00              mov ecx, 004AAB80
:004047D5 E866B20700              call 0047FA40
:004047DA 50                      push eax
:004047DB 8B85CCEFFFFF            mov eax, dword ptr [ebp+FFFFEFCC]
:004047E1 8A08                    mov cl, byte ptr [eax]
:004047E3 51                      push ecx
:004047E4 6A30                    push 00000030
:004047E6 6A30                    push 00000030
:004047E8 8B95D8EFFFFF            mov edx, dword ptr [ebp+FFFFEFD8]
:004047EE 52                      push edx
:004047EF 8B85DCEFFFFF            mov eax, dword ptr [ebp+FFFFEFDC]
:004047F5 50                      push eax
:004047F6 E881CB0400              call 0045137C
:004047FB 83C418                  add esp, 00000018
:004047FE E8F39D0100              call 0041E5F6
:00404803 E9DF0E0000              jmp 004056E7
:00404808 E8CE9D0100              call 0041E5DB
:0040480D 6A00                    push 00000000
:0040480F 6A04                    push 00000004
:00404811 6A00                    push 00000000
:00404813 6800590000              push 00005900
:00404818 B9C8E44A00              mov ecx, 004AE4C8
:0040481D E81EB20700              call 0047FA40
:00404822 50                      push eax
:00404823 6A40                    push 00000040
:00404825 6A40                    push 00000040
:00404827 8B8DD0EFFFFF            mov ecx, dword ptr [ebp+FFFFEFD0]
:0040482D 83E908                  sub ecx, 00000008
:00404830 51                      push ecx
:00404831 8B95D4EFFFFF            mov edx, dword ptr [ebp+FFFFEFD4]
:00404837 83EA08                  sub edx, 00000008
:0040483A 52                      push edx
:0040483B E8D3D00400              call 00451913
:00404840 83C418                  add esp, 00000018
:00404843 6A00                    push 00000000
:00404845 6A04                    push 00000004
:00404847 6A00                    push 00000000
:00404849 6800490000              push 00004900
:0040484E B9C8E44A00              mov ecx, 004AE4C8
:00404853 E8E8B10700              call 0047FA40
:00404858 50                      push eax
:00404859 6A40                    push 00000040
:0040485B 6A40                    push 00000040
:0040485D 8B85D8EFFFFF            mov eax, dword ptr [ebp+FFFFEFD8]
:00404863 83E808                  sub eax, 00000008
:00404866 50                      push eax
:00404867 8B8DDCEFFFFF            mov ecx, dword ptr [ebp+FFFFEFDC]
:0040486D 83E908                  sub ecx, 00000008
:00404870 51                      push ecx
:00404871 E89DD00400              call 00451913
:00404876 83C418                  add esp, 00000018
:00404879 8B95CCEFFFFF            mov edx, dword ptr [ebp+FFFFEFCC]
:0040487F 33C0                    xor eax, eax
:00404881 8A4201                  mov al, byte ptr [edx+01]
:00404884 50                      push eax
:00404885 8B8DD0EFFFFF            mov ecx, dword ptr [ebp+FFFFEFD0]
:0040488B 51                      push ecx
:0040488C 8B95D4EFFFFF            mov edx, dword ptr [ebp+FFFFEFD4]
:00404892 52                      push edx
:00404893 E887A20300              call 0043EB1F
:00404898 83C40C                  add esp, 0000000C
:0040489B 6A04                    push 00000004
:0040489D 6A00                    push 00000000
:0040489F 6A00                    push 00000000
:004048A1 B9C8E44A00              mov ecx, 004AE4C8
:004048A6 E895B10700              call 0047FA40
:004048AB 50                      push eax
:004048AC 8B85CCEFFFFF            mov eax, dword ptr [ebp+FFFFEFCC]
:004048B2 8A08                    mov cl, byte ptr [eax]
:004048B4 51                      push ecx
:004048B5 6A40                    push 00000040
:004048B7 6A40                    push 00000040
:004048B9 8B95D8EFFFFF            mov edx, dword ptr [ebp+FFFFEFD8]
:004048BF 83EA08                  sub edx, 00000008
:004048C2 52                      push edx
:004048C3 8B85DCEFFFFF            mov eax, dword ptr [ebp+FFFFEFDC]
:004048C9 83E808                  sub eax, 00000008
:004048CC 50                      push eax
:004048CD E8AACA0400              call 0045137C
:004048D2 83C418                  add esp, 00000018
:004048D5 E81C9D0100              call 0041E5F6
:004048DA 8B8DCCEFFFFF            mov ecx, dword ptr [ebp+FFFFEFCC]
:004048E0 8B490C                  mov ecx, dword ptr [ecx+0C]
:004048E3 E8F9B70300              call 004400E1
:004048E8 85C0                    test eax, eax
:004048EA 7410                    je 004048FC
:004048EC 6A01                    push 00000001
:004048EE 6A22                    push 00000022
:004048F0 B9B0694B00              mov ecx, 004B69B0
:004048F5 E880FD0600              call 0047467A
:004048FA EB30                    jmp 0040492C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004048EA(C)
|
:004048FC 8B95CCEFFFFF            mov edx, dword ptr [ebp+FFFFEFCC]
:00404902 8B4A0C                  mov ecx, dword ptr [edx+0C]
:00404905 E898B70300              call 004400A2
:0040490A 85C0                    test eax, eax
:0040490C 7410                    je 0040491E
:0040490E 6A01                    push 00000001
:00404910 6A25                    push 00000025
:00404912 B9B0694B00              mov ecx, 004B69B0
:00404917 E85EFD0600              call 0047467A
:0040491C EB0E                    jmp 0040492C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040490C(C)
|
:0040491E 6A01                    push 00000001
:00404920 6A20                    push 00000020
:00404922 B9B0694B00              mov ecx, 004B69B0
:00404927 E84EFD0600              call 0047467A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004048FA(U), :0040491C(U)
|
:0040492C E9B60D0000              jmp 004056E7
:00404931 E8A59C0100              call 0041E5DB
:00404936 B9083D4B00              mov ecx, 004B3D08
:0040493B E8F01D0000              call 00406730
:00404940 6A00                    push 00000000
:00404942 6A04                    push 00000004
:00404944 6A00                    push 00000000
:00404946 6800590000              push 00005900
:0040494B B9C8E44A00              mov ecx, 004AE4C8
:00404950 E8EBB00700              call 0047FA40
:00404955 50                      push eax
:00404956 6A40                    push 00000040
:00404958 6A40                    push 00000040
:0040495A 8B85D0EFFFFF            mov eax, dword ptr [ebp+FFFFEFD0]
:00404960 83E808                  sub eax, 00000008
:00404963 50                      push eax
:00404964 8B8DD4EFFFFF            mov ecx, dword ptr [ebp+FFFFEFD4]
:0040496A 83E908                  sub ecx, 00000008
:0040496D 51                      push ecx
:0040496E E8A0CF0400              call 00451913
:00404973 83C418                  add esp, 00000018
:00404976 6A00                    push 00000000
:00404978 6A04                    push 00000004
:0040497A 6A00                    push 00000000
:0040497C 6800490000              push 00004900
:00404981 B9C8E44A00              mov ecx, 004AE4C8
:00404986 E8B5B00700              call 0047FA40
:0040498B 50                      push eax
:0040498C 6A40                    push 00000040
:0040498E 6A40                    push 00000040
:00404990 8B95D8EFFFFF            mov edx, dword ptr [ebp+FFFFEFD8]
:00404996 83EA08                  sub edx, 00000008
:00404999 52                      push edx
:0040499A 8B85DCEFFFFF            mov eax, dword ptr [ebp+FFFFEFDC]
:004049A0 83E808                  sub eax, 00000008
:004049A3 50                      push eax
:004049A4 E86ACF0400              call 00451913
:004049A9 83C418                  add esp, 00000018
:004049AC 8B8DCCEFFFFF            mov ecx, dword ptr [ebp+FFFFEFCC]
:004049B2 33D2                    xor edx, edx
:004049B4 8A5101                  mov dl, byte ptr [ecx+01]
:004049B7 52                      push edx
:004049B8 8B85D0EFFFFF            mov eax, dword ptr [ebp+FFFFEFD0]
:004049BE 50                      push eax
:004049BF 8B8DD4EFFFFF            mov ecx, dword ptr [ebp+FFFFEFD4]
:004049C5 51                      push ecx
:004049C6 E854A10300              call 0043EB1F
:004049CB 83C40C                  add esp, 0000000C
:004049CE 8B95CCEFFFFF            mov edx, dword ptr [ebp+FFFFEFCC]
:004049D4 8B4A0C                  mov ecx, dword ptr [edx+0C]
:004049D7 E8C6B60300              call 004400A2
:004049DC 85C0                    test eax, eax
:004049DE 0F8478010000            je 00404B5C
:004049E4 8B85CCEFFFFF            mov eax, dword ptr [ebp+FFFFEFCC]
:004049EA 83B80406000000          cmp dword ptr [eax+00000604], 00000000
:004049F1 0F840D010000            je 00404B04
:004049F7 6800100000              push 00001000
:004049FC 8D8D00F0FFFF            lea ecx, dword ptr [ebp+FFFFF000]
:00404A02 51                      push ecx
:00404A03 6A04                    push 00000004
:00404A05 6A00                    push 00000000
:00404A07 6800100000              push 00001000
:00404A0C B9C8E44A00              mov ecx, 004AE4C8
:00404A11 E82AB00700              call 0047FA40
:00404A16 50                      push eax
:00404A17 E8E1B20700              call 0047FCFD
:00404A1C 83C40C                  add esp, 0000000C
:00404A1F 8D9500F0FFFF            lea edx, dword ptr [ebp+FFFFF000]
:00404A25 52                      push edx
:00404A26 8B85CCEFFFFF            mov eax, dword ptr [ebp+FFFFEFCC]
:00404A2C 8A08                    mov cl, byte ptr [eax]
:00404A2E 51                      push ecx
:00404A2F 6A40                    push 00000040
:00404A31 6A40                    push 00000040
:00404A33 8B95D8EFFFFF            mov edx, dword ptr [ebp+FFFFEFD8]
:00404A39 83EA08                  sub edx, 00000008
:00404A3C 52                      push edx
:00404A3D 8B85DCEFFFFF            mov eax, dword ptr [ebp+FFFFEFDC]
:00404A43 83E808                  sub eax, 00000008
:00404A46 50                      push eax
:00404A47 E830C90400              call 0045137C
:00404A4C 83C418                  add esp, 00000018
:00404A4F E8A29B0100              call 0041E5F6
:00404A54 6A01                    push 00000001
:00404A56 6A21                    push 00000021
:00404A58 B9B0694B00              mov ecx, 004B69B0
:00404A5D E818FC0600              call 0047467A
:00404A62 C685E4EFFFFF00          mov byte ptr [ebp+FFFFEFE4], 00
:00404A69 EB0F                    jmp 00404A7A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404AFD(U)
|
:00404A6B 8A8DE4EFFFFF            mov cl, byte ptr [ebp+FFFFEFE4]
:00404A71 80C101                  add cl, 01
:00404A74 888DE4EFFFFF            mov byte ptr [ebp+FFFFEFE4], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404A69(U)
|
:00404A7A 8B95E4EFFFFF            mov edx, dword ptr [ebp+FFFFEFE4]
:00404A80 81E2FF000000            and edx, 000000FF
:00404A86 83FA06                  cmp edx, 00000006
:00404A89 7D77                    jge 00404B02
:00404A8B 6A01                    push 00000001
:00404A8D B9181B4B00              mov ecx, 004B1B18
:00404A92 E8A9E8FFFF              call 00403340
:00404A97 E8447A0200              call 0042C4E0
:00404A9C E83A9B0100              call 0041E5DB
:00404AA1 8B85E4EFFFFF            mov eax, dword ptr [ebp+FFFFEFE4]
:00404AA7 25FF000000              and eax, 000000FF
:00404AAC 99                      cdq
:00404AAD 2BC2                    sub eax, edx
:00404AAF D1F8                    sar eax, 1
:00404AB1 83C001                  add eax, 00000001
:00404AB4 50                      push eax
:00404AB5 6A40                    push 00000040
:00404AB7 6A40                    push 00000040
:00404AB9 8D8500F0FFFF            lea eax, dword ptr [ebp+FFFFF000]
:00404ABF 50                      push eax
:00404AC0 E8FBB80200              call 004303C0
:00404AC5 83C410                  add esp, 00000010
:00404AC8 8D8D00F0FFFF            lea ecx, dword ptr [ebp+FFFFF000]
:00404ACE 51                      push ecx
:00404ACF 8B95CCEFFFFF            mov edx, dword ptr [ebp+FFFFEFCC]
:00404AD5 8A02                    mov al, byte ptr [edx]
:00404AD7 50                      push eax
:00404AD8 6A40                    push 00000040
:00404ADA 6A40                    push 00000040
:00404ADC 8B8DD8EFFFFF            mov ecx, dword ptr [ebp+FFFFEFD8]
:00404AE2 83E908                  sub ecx, 00000008
:00404AE5 51                      push ecx
:00404AE6 8B95DCEFFFFF            mov edx, dword ptr [ebp+FFFFEFDC]
:00404AEC 83EA08                  sub edx, 00000008
:00404AEF 52                      push edx
:00404AF0 E887C80400              call 0045137C
:00404AF5 83C418                  add esp, 00000018
:00404AF8 E8F99A0100              call 0041E5F6
:00404AFD E969FFFFFF              jmp 00404A6B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404A89(C)
|
:00404B02 EB3D                    jmp 00404B41

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004049F1(C)
|
:00404B04 6A04                    push 00000004
:00404B06 6A00                    push 00000000
:00404B08 6800100000              push 00001000
:00404B0D B9C8E44A00              mov ecx, 004AE4C8
:00404B12 E829AF0700              call 0047FA40
:00404B17 50                      push eax
:00404B18 8B85CCEFFFFF            mov eax, dword ptr [ebp+FFFFEFCC]
:00404B1E 8A08                    mov cl, byte ptr [eax]
:00404B20 51                      push ecx
:00404B21 6A40                    push 00000040
:00404B23 6A40                    push 00000040
:00404B25 8B95D8EFFFFF            mov edx, dword ptr [ebp+FFFFEFD8]
:00404B2B 83EA08                  sub edx, 00000008
:00404B2E 52                      push edx
:00404B2F 8B85DCEFFFFF            mov eax, dword ptr [ebp+FFFFEFDC]
:00404B35 83E808                  sub eax, 00000008
:00404B38 50                      push eax
:00404B39 E83EC80400              call 0045137C
:00404B3E 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404B02(U)
|
:00404B41 E8B09A0100              call 0041E5F6
:00404B46 6A08                    push 00000008
:00404B48 B9181B4B00              mov ecx, 004B1B18
:00404B4D E8EEE7FFFF              call 00403340
:00404B52 E889790200              call 0042C4E0
:00404B57 E95B010000              jmp 00404CB7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004049DE(C)
|
:00404B5C 8B8DCCEFFFFF            mov ecx, dword ptr [ebp+FFFFEFCC]
:00404B62 83B90406000000          cmp dword ptr [ecx+00000604], 00000000
:00404B69 0F8409010000            je 00404C78
:00404B6F 6800100000              push 00001000
:00404B74 8D9500F0FFFF            lea edx, dword ptr [ebp+FFFFF000]
:00404B7A 52                      push edx
:00404B7B 6A04                    push 00000004
:00404B7D 6A00                    push 00000000
:00404B7F 6A00                    push 00000000
:00404B81 B9C8E44A00              mov ecx, 004AE4C8
:00404B86 E8B5AE0700              call 0047FA40
:00404B8B 50                      push eax
:00404B8C E86CB10700              call 0047FCFD
:00404B91 83C40C                  add esp, 0000000C
:00404B94 8D8500F0FFFF            lea eax, dword ptr [ebp+FFFFF000]
:00404B9A 50                      push eax
:00404B9B 8B8DCCEFFFFF            mov ecx, dword ptr [ebp+FFFFEFCC]
:00404BA1 8A11                    mov dl, byte ptr [ecx]
:00404BA3 52                      push edx
:00404BA4 6A40                    push 00000040
:00404BA6 6A40                    push 00000040
:00404BA8 8B85D8EFFFFF            mov eax, dword ptr [ebp+FFFFEFD8]
:00404BAE 83E808                  sub eax, 00000008
:00404BB1 50                      push eax
:00404BB2 8B8DDCEFFFFF            mov ecx, dword ptr [ebp+FFFFEFDC]
:00404BB8 83E908                  sub ecx, 00000008
:00404BBB 51                      push ecx
:00404BBC E8BBC70400              call 0045137C
:00404BC1 83C418                  add esp, 00000018
:00404BC4 E82D9A0100              call 0041E5F6
:00404BC9 6A01                    push 00000001
:00404BCB 6A21                    push 00000021
:00404BCD B9B0694B00              mov ecx, 004B69B0
:00404BD2 E8A3FA0600              call 0047467A
:00404BD7 C685E4EFFFFF00          mov byte ptr [ebp+FFFFEFE4], 00
:00404BDE EB0F                    jmp 00404BEF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404C71(U)
|
:00404BE0 8A95E4EFFFFF            mov dl, byte ptr [ebp+FFFFEFE4]
:00404BE6 80C201                  add dl, 01
:00404BE9 8895E4EFFFFF            mov byte ptr [ebp+FFFFEFE4], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404BDE(U)
|
:00404BEF 8B85E4EFFFFF            mov eax, dword ptr [ebp+FFFFEFE4]
:00404BF5 25FF000000              and eax, 000000FF
:00404BFA 83F806                  cmp eax, 00000006
:00404BFD 7D77                    jge 00404C76
:00404BFF 6A01                    push 00000001
:00404C01 B9181B4B00              mov ecx, 004B1B18
:00404C06 E835E7FFFF              call 00403340
:00404C0B E8D0780200              call 0042C4E0
:00404C10 E8C6990100              call 0041E5DB
:00404C15 8B85E4EFFFFF            mov eax, dword ptr [ebp+FFFFEFE4]
:00404C1B 25FF000000              and eax, 000000FF
:00404C20 99                      cdq
:00404C21 2BC2                    sub eax, edx
:00404C23 D1F8                    sar eax, 1
:00404C25 83C001                  add eax, 00000001
:00404C28 50                      push eax
:00404C29 6A40                    push 00000040
:00404C2B 6A40                    push 00000040
:00404C2D 8D8D00F0FFFF            lea ecx, dword ptr [ebp+FFFFF000]
:00404C33 51                      push ecx
:00404C34 E887B70200              call 004303C0
:00404C39 83C410                  add esp, 00000010
:00404C3C 8D9500F0FFFF            lea edx, dword ptr [ebp+FFFFF000]
:00404C42 52                      push edx
:00404C43 8B85CCEFFFFF            mov eax, dword ptr [ebp+FFFFEFCC]
:00404C49 8A08                    mov cl, byte ptr [eax]
:00404C4B 51                      push ecx
:00404C4C 6A40                    push 00000040
:00404C4E 6A40                    push 00000040
:00404C50 8B95D8EFFFFF            mov edx, dword ptr [ebp+FFFFEFD8]
:00404C56 83EA08                  sub edx, 00000008
:00404C59 52                      push edx
:00404C5A 8B85DCEFFFFF            mov eax, dword ptr [ebp+FFFFEFDC]
:00404C60 83E808                  sub eax, 00000008
:00404C63 50                      push eax
:00404C64 E813C70400              call 0045137C
:00404C69 83C418                  add esp, 00000018
:00404C6C E885990100              call 0041E5F6
:00404C71 E96AFFFFFF              jmp 00404BE0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404BFD(C)
|
:00404C76 EB3A                    jmp 00404CB2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404B69(C)
|
:00404C78 6A04                    push 00000004
:00404C7A 6A00                    push 00000000
:00404C7C 6A00                    push 00000000
:00404C7E B9C8E44A00              mov ecx, 004AE4C8
:00404C83 E8B8AD0700              call 0047FA40
:00404C88 50                      push eax
:00404C89 8B8DCCEFFFFF            mov ecx, dword ptr [ebp+FFFFEFCC]
:00404C8F 8A11                    mov dl, byte ptr [ecx]
:00404C91 52                      push edx
:00404C92 6A40                    push 00000040
:00404C94 6A40                    push 00000040
:00404C96 8B85D8EFFFFF            mov eax, dword ptr [ebp+FFFFEFD8]
:00404C9C 83E808                  sub eax, 00000008
:00404C9F 50                      push eax
:00404CA0 8B8DDCEFFFFF            mov ecx, dword ptr [ebp+FFFFEFDC]
:00404CA6 83E908                  sub ecx, 00000008
:00404CA9 51                      push ecx
:00404CAA E8CDC60400              call 0045137C
:00404CAF 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404C76(U)
|
:00404CB2 E83F990100              call 0041E5F6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404B57(U)
|
:00404CB7 E92B0A0000              jmp 004056E7
:00404CBC E81A990100              call 0041E5DB
:00404CC1 6A00                    push 00000000
:00404CC3 6A04                    push 00000004
:00404CC5 6A00                    push 00000000
:00404CC7 6800590000              push 00005900
:00404CCC B9C8E44A00              mov ecx, 004AE4C8
:00404CD1 E86AAD0700              call 0047FA40
:00404CD6 50                      push eax
:00404CD7 6A40                    push 00000040
:00404CD9 6A40                    push 00000040
:00404CDB 8B95D0EFFFFF            mov edx, dword ptr [ebp+FFFFEFD0]
:00404CE1 83EA08                  sub edx, 00000008
:00404CE4 52                      push edx
:00404CE5 8B85D4EFFFFF            mov eax, dword ptr [ebp+FFFFEFD4]
:00404CEB 83E808                  sub eax, 00000008
:00404CEE 50                      push eax
:00404CEF E81FCC0400              call 00451913
:00404CF4 83C418                  add esp, 00000018
:00404CF7 6A00                    push 00000000
:00404CF9 6A04                    push 00000004
:00404CFB 6A00                    push 00000000
:00404CFD 6800490000              push 00004900
:00404D02 B9C8E44A00              mov ecx, 004AE4C8
:00404D07 E834AD0700              call 0047FA40
:00404D0C 50                      push eax
:00404D0D 6A40                    push 00000040
:00404D0F 6A40                    push 00000040
:00404D11 8B8DD8EFFFFF            mov ecx, dword ptr [ebp+FFFFEFD8]
:00404D17 83E908                  sub ecx, 00000008
:00404D1A 51                      push ecx
:00404D1B 8B95DCEFFFFF            mov edx, dword ptr [ebp+FFFFEFDC]
:00404D21 83EA08                  sub edx, 00000008
:00404D24 52                      push edx
:00404D25 E8E9CB0400              call 00451913
:00404D2A 83C418                  add esp, 00000018
:00404D2D 8B85CCEFFFFF            mov eax, dword ptr [ebp+FFFFEFCC]
:00404D33 33C9                    xor ecx, ecx
:00404D35 8A4801                  mov cl, byte ptr [eax+01]
:00404D38 51                      push ecx
:00404D39 8B95D0EFFFFF            mov edx, dword ptr [ebp+FFFFEFD0]
:00404D3F 52                      push edx
:00404D40 8B85D4EFFFFF            mov eax, dword ptr [ebp+FFFFEFD4]
:00404D46 50                      push eax
:00404D47 E8D39D0300              call 0043EB1F
:00404D4C 83C40C                  add esp, 0000000C
:00404D4F 6A04                    push 00000004
:00404D51 6A00                    push 00000000
:00404D53 6800100000              push 00001000
:00404D58 B9C8E44A00              mov ecx, 004AE4C8
:00404D5D E8DEAC0700              call 0047FA40
:00404D62 50                      push eax
:00404D63 8B8DCCEFFFFF            mov ecx, dword ptr [ebp+FFFFEFCC]
:00404D69 8A11                    mov dl, byte ptr [ecx]
:00404D6B 52                      push edx
:00404D6C 6A40                    push 00000040
:00404D6E 6A40                    push 00000040
:00404D70 8B85D8EFFFFF            mov eax, dword ptr [ebp+FFFFEFD8]
:00404D76 83E808                  sub eax, 00000008
:00404D79 50                      push eax
:00404D7A 8B8DDCEFFFFF            mov ecx, dword ptr [ebp+FFFFEFDC]
:00404D80 83E908                  sub ecx, 00000008
:00404D83 51                      push ecx
:00404D84 E8F3C50400              call 0045137C
:00404D89 83C418                  add esp, 00000018
:00404D8C E865980100              call 0041E5F6
:00404D91 E951090000              jmp 004056E7
:00404D96 E840980100              call 0041E5DB
:00404D9B 6A00                    push 00000000
:00404D9D 6A04                    push 00000004
:00404D9F 6A00                    push 00000000
:00404DA1 6800590000              push 00005900
:00404DA6 B9C8E44A00              mov ecx, 004AE4C8
:00404DAB E890AC0700              call 0047FA40
:00404DB0 50                      push eax
:00404DB1 6A40                    push 00000040
:00404DB3 6A40                    push 00000040
:00404DB5 8B95D0EFFFFF            mov edx, dword ptr [ebp+FFFFEFD0]
:00404DBB 83EA08                  sub edx, 00000008
:00404DBE 52                      push edx
:00404DBF 8B85D4EFFFFF            mov eax, dword ptr [ebp+FFFFEFD4]
:00404DC5 83E808                  sub eax, 00000008
:00404DC8 50                      push eax
:00404DC9 E845CB0400              call 00451913
:00404DCE 83C418                  add esp, 00000018
:00404DD1 6A00                    push 00000000
:00404DD3 6A04                    push 00000004
:00404DD5 6A00                    push 00000000
:00404DD7 6800490000              push 00004900
:00404DDC B9C8E44A00              mov ecx, 004AE4C8
:00404DE1 E85AAC0700              call 0047FA40
:00404DE6 50                      push eax
:00404DE7 6A40                    push 00000040
:00404DE9 6A40                    push 00000040
:00404DEB 8B8DD8EFFFFF            mov ecx, dword ptr [ebp+FFFFEFD8]
:00404DF1 83E908                  sub ecx, 00000008
:00404DF4 51                      push ecx
:00404DF5 8B95DCEFFFFF            mov edx, dword ptr [ebp+FFFFEFDC]
:00404DFB 83EA08                  sub edx, 00000008
:00404DFE 52                      push edx
:00404DFF E80FCB0400              call 00451913
:00404E04 83C418                  add esp, 00000018
:00404E07 8B85CCEFFFFF            mov eax, dword ptr [ebp+FFFFEFCC]
:00404E0D 33C9                    xor ecx, ecx
:00404E0F 8A4801                  mov cl, byte ptr [eax+01]
:00404E12 6BC924                  imul ecx, 00000024
:00404E15 81C1502C4B00            add ecx, 004B2C50
:00404E1B E870DE0600              call 00472C90
:00404E20 85C0                    test eax, eax
:00404E22 7535                    jne 00404E59
:00404E24 8B95CCEFFFFF            mov edx, dword ptr [ebp+FFFFEFCC]
:00404E2A 33C0                    xor eax, eax
:00404E2C 8A4201                  mov al, byte ptr [edx+01]
:00404E2F 50                      push eax
:00404E30 8B8DD0EFFFFF            mov ecx, dword ptr [ebp+FFFFEFD0]
:00404E36 51                      push ecx
:00404E37 8B95D4EFFFFF            mov edx, dword ptr [ebp+FFFFEFD4]
:00404E3D 52                      push edx
:00404E3E E8DC9C0300              call 0043EB1F
:00404E43 83C40C                  add esp, 0000000C
:00404E46 6A01                    push 00000001

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:00404E48 6A07                    push 00000007
:00404E4A B9B0694B00              mov ecx, 004B69B0
:00404E4F E826F80600              call 0047467A
:00404E54 E95A010000              jmp 00404FB3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404E22(C)
|
:00404E59 8B85CCEFFFFF            mov eax, dword ptr [ebp+FFFFEFCC]
:00404E5F 83B88400000000          cmp dword ptr [eax+00000084], 00000000
:00404E66 0F85A5000000            jne 00404F11
:00404E6C 8B8DCCEFFFFF            mov ecx, dword ptr [ebp+FFFFEFCC]
:00404E72 83B95402000000          cmp dword ptr [ecx+00000254], 00000000
:00404E79 0F8592000000            jne 00404F11
:00404E7F 6A04                    push 00000004
:00404E81 6A00                    push 00000000
:00404E83 6800400000              push 00004000
:00404E88 B9C8E44A00              mov ecx, 004AE4C8
:00404E8D E8AEAB0700              call 0047FA40
:00404E92 50                      push eax
:00404E93 8B95CCEFFFFF            mov edx, dword ptr [ebp+FFFFEFCC]
:00404E99 8A4201                  mov al, byte ptr [edx+01]
:00404E9C 50                      push eax
:00404E9D 6A30                    push 00000030
:00404E9F 6A30                    push 00000030
:00404EA1 8B8DCCEFFFFF            mov ecx, dword ptr [ebp+FFFFEFCC]
:00404EA7 8B95D0EFFFFF            mov edx, dword ptr [ebp+FFFFEFD0]
:00404EAD 039110060000            add edx, dword ptr [ecx+00000610]
:00404EB3 52                      push edx
:00404EB4 8B85CCEFFFFF            mov eax, dword ptr [ebp+FFFFEFCC]
:00404EBA 8B8DD4EFFFFF            mov ecx, dword ptr [ebp+FFFFEFD4]
:00404EC0 03880C060000            add ecx, dword ptr [eax+0000060C]
:00404EC6 51                      push ecx
:00404EC7 E8B0C40400              call 0045137C
:00404ECC 83C418                  add esp, 00000018
:00404ECF 8B95CCEFFFFF            mov edx, dword ptr [ebp+FFFFEFCC]
:00404ED5 8A02                    mov al, byte ptr [edx]
:00404ED7 50                      push eax
:00404ED8 8B8DCCEFFFFF            mov ecx, dword ptr [ebp+FFFFEFCC]
:00404EDE 8A5101                  mov dl, byte ptr [ecx+01]
:00404EE1 52                      push edx
:00404EE2 E842090300              call 00435829
:00404EE7 83C408                  add esp, 00000008
:00404EEA 6A01                    push 00000001
:00404EEC 8B85CCEFFFFF            mov eax, dword ptr [ebp+FFFFEFCC]
:00404EF2 33C9                    xor ecx, ecx
:00404EF4 83B80406000000          cmp dword ptr [eax+00000604], 00000000
:00404EFB 0F95C1                  setne cl
:00404EFE 83C11E                  add ecx, 0000001E
:00404F01 51                      push ecx
:00404F02 B9B0694B00              mov ecx, 004B69B0
:00404F07 E86EF70600              call 0047467A
:00404F0C E9A2000000              jmp 00404FB3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00404E66(C), :00404E79(C)
|
:00404F11 6800090000              push 00000900
:00404F16 8D9500F0FFFF            lea edx, dword ptr [ebp+FFFFF000]
:00404F1C 52                      push edx
:00404F1D 6A04                    push 00000004
:00404F1F 6A00                    push 00000000
:00404F21 6800400000              push 00004000
:00404F26 B9C8E44A00              mov ecx, 004AE4C8
:00404F2B E810AB0700              call 0047FA40
:00404F30 50                      push eax
:00404F31 E8C7AD0700              call 0047FCFD
:00404F36 83C40C                  add esp, 0000000C
:00404F39 6A0C                    push 0000000C
:00404F3B 6A30                    push 00000030
:00404F3D 6A30                    push 00000030
:00404F3F 8D8500F0FFFF            lea eax, dword ptr [ebp+FFFFF000]
:00404F45 50                      push eax
:00404F46 E875B40200              call 004303C0
:00404F4B 83C410                  add esp, 00000010
:00404F4E 8D8D00F0FFFF            lea ecx, dword ptr [ebp+FFFFF000]
:00404F54 51                      push ecx
:00404F55 8B95CCEFFFFF            mov edx, dword ptr [ebp+FFFFEFCC]
:00404F5B 8A4201                  mov al, byte ptr [edx+01]
:00404F5E 50                      push eax
:00404F5F 6A30                    push 00000030
:00404F61 6A30                    push 00000030
:00404F63 8B8DCCEFFFFF            mov ecx, dword ptr [ebp+FFFFEFCC]
:00404F69 8B95D0EFFFFF            mov edx, dword ptr [ebp+FFFFEFD0]
:00404F6F 039110060000            add edx, dword ptr [ecx+00000610]
:00404F75 52                      push edx
:00404F76 8B85CCEFFFFF            mov eax, dword ptr [ebp+FFFFEFCC]
:00404F7C 8B8DD4EFFFFF            mov ecx, dword ptr [ebp+FFFFEFD4]
:00404F82 03880C060000            add ecx, dword ptr [eax+0000060C]
:00404F88 51                      push ecx
:00404F89 E8EEC30400              call 0045137C
:00404F8E 83C418                  add esp, 00000018
:00404F91 6A01                    push 00000001
:00404F93 8B95CCEFFFFF            mov edx, dword ptr [ebp+FFFFEFCC]
:00404F99 33C0                    xor eax, eax
:00404F9B 83BA0406000000          cmp dword ptr [edx+00000604], 00000000
:00404FA2 0F95C0                  setne al
:00404FA5 83C023                  add eax, 00000023
:00404FA8 50                      push eax
:00404FA9 B9B0694B00              mov ecx, 004B69B0
:00404FAE E8C7F60600              call 0047467A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00404E54(U), :00404F0C(U)
|
:00404FB3 6A04                    push 00000004
:00404FB5 6A00                    push 00000000
:00404FB7 6800200000              push 00002000
:00404FBC B9C8E44A00              mov ecx, 004AE4C8
:00404FC1 E87AAA0700              call 0047FA40
:00404FC6 50                      push eax
:00404FC7 8B8DCCEFFFFF            mov ecx, dword ptr [ebp+FFFFEFCC]
:00404FCD 8A11                    mov dl, byte ptr [ecx]
:00404FCF 52                      push edx
:00404FD0 6A40                    push 00000040
:00404FD2 6A40                    push 00000040
:00404FD4 8B85D8EFFFFF            mov eax, dword ptr [ebp+FFFFEFD8]
:00404FDA 83E808                  sub eax, 00000008
:00404FDD 50                      push eax
:00404FDE 8B8DDCEFFFFF            mov ecx, dword ptr [ebp+FFFFEFDC]
:00404FE4 83E908                  sub ecx, 00000008
:00404FE7 51                      push ecx
:00404FE8 E88FC30400              call 0045137C
:00404FED 83C418                  add esp, 00000018
:00404FF0 E801960100              call 0041E5F6
:00404FF5 E9ED060000              jmp 004056E7
:00404FFA E8DC950100              call 0041E5DB
:00404FFF 6A00                    push 00000000
:00405001 6A04                    push 00000004
:00405003 6A00                    push 00000000
:00405005 6800590000              push 00005900
:0040500A B9C8E44A00              mov ecx, 004AE4C8
:0040500F E82CAA0700              call 0047FA40
:00405014 50                      push eax
:00405015 6A40                    push 00000040
:00405017 6A40                    push 00000040
:00405019 8B95D0EFFFFF            mov edx, dword ptr [ebp+FFFFEFD0]
:0040501F 83EA08                  sub edx, 00000008
:00405022 52                      push edx
:00405023 8B85D4EFFFFF            mov eax, dword ptr [ebp+FFFFEFD4]
:00405029 83E808                  sub eax, 00000008
:0040502C 50                      push eax
:0040502D E8E1C80400              call 00451913
:00405032 83C418                  add esp, 00000018
:00405035 6A00                    push 00000000
:00405037 6A04                    push 00000004
:00405039 6A00                    push 00000000
:0040503B 6800490000              push 00004900
:00405040 B9C8E44A00              mov ecx, 004AE4C8
:00405045 E8F6A90700              call 0047FA40
:0040504A 50                      push eax
:0040504B 6A40                    push 00000040
:0040504D 6A40                    push 00000040
:0040504F 8B8DD8EFFFFF            mov ecx, dword ptr [ebp+FFFFEFD8]
:00405055 83E908                  sub ecx, 00000008
:00405058 51                      push ecx
:00405059 8B95DCEFFFFF            mov edx, dword ptr [ebp+FFFFEFDC]
:0040505F 83EA08                  sub edx, 00000008
:00405062 52                      push edx
:00405063 E8ABC80400              call 00451913
:00405068 83C418                  add esp, 00000018
:0040506B 8B85CCEFFFFF            mov eax, dword ptr [ebp+FFFFEFCC]
:00405071 33C9                    xor ecx, ecx
:00405073 8A4801                  mov cl, byte ptr [eax+01]
:00405076 6BC924                  imul ecx, 00000024
:00405079 81C1502C4B00            add ecx, 004B2C50
:0040507F E80CDC0600              call 00472C90
:00405084 85C0                    test eax, eax
:00405086 7527                    jne 004050AF
:00405088 8B95CCEFFFFF            mov edx, dword ptr [ebp+FFFFEFCC]
:0040508E 33C0                    xor eax, eax
:00405090 8A4201                  mov al, byte ptr [edx+01]
:00405093 50                      push eax
:00405094 8B8DD0EFFFFF            mov ecx, dword ptr [ebp+FFFFEFD0]
:0040509A 51                      push ecx
:0040509B 8B95D4EFFFFF            mov edx, dword ptr [ebp+FFFFEFD4]
:004050A1 52                      push edx
:004050A2 E8789A0300              call 0043EB1F
:004050A7 83C40C                  add esp, 0000000C
:004050AA E936010000              jmp 004051E5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405086(C)
|
:004050AF 8B85CCEFFFFF            mov eax, dword ptr [ebp+FFFFEFCC]
:004050B5 83B88400000000          cmp dword ptr [eax+00000084], 00000000
:004050BC 757F                    jne 0040513D
:004050BE 8B8DCCEFFFFF            mov ecx, dword ptr [ebp+FFFFEFCC]
:004050C4 83B95402000000          cmp dword ptr [ecx+00000254], 00000000
:004050CB 7570                    jne 0040513D
:004050CD 6A04                    push 00000004
:004050CF 6A00                    push 00000000
:004050D1 6800400000              push 00004000
:004050D6 B9C8E44A00              mov ecx, 004AE4C8
:004050DB E860A90700              call 0047FA40
:004050E0 50                      push eax
:004050E1 8B95CCEFFFFF            mov edx, dword ptr [ebp+FFFFEFCC]
:004050E7 8A4201                  mov al, byte ptr [edx+01]
:004050EA 50                      push eax
:004050EB 6A30                    push 00000030
:004050ED 6A30                    push 00000030
:004050EF 8B8DCCEFFFFF            mov ecx, dword ptr [ebp+FFFFEFCC]
:004050F5 8B95D0EFFFFF            mov edx, dword ptr [ebp+FFFFEFD0]
:004050FB 039110060000            add edx, dword ptr [ecx+00000610]
:00405101 52                      push edx
:00405102 8B85CCEFFFFF            mov eax, dword ptr [ebp+FFFFEFCC]
:00405108 8B8DD4EFFFFF            mov ecx, dword ptr [ebp+FFFFEFD4]
:0040510E 03880C060000            add ecx, dword ptr [eax+0000060C]
:00405114 51                      push ecx
:00405115 E862C20400              call 0045137C
:0040511A 83C418                  add esp, 00000018
:0040511D 8B95CCEFFFFF            mov edx, dword ptr [ebp+FFFFEFCC]
:00405123 8A02                    mov al, byte ptr [edx]
:00405125 50                      push eax
:00405126 8B8DCCEFFFFF            mov ecx, dword ptr [ebp+FFFFEFCC]
:0040512C 8A5101                  mov dl, byte ptr [ecx+01]
:0040512F 52                      push edx
:00405130 E8F4060300              call 00435829
:00405135 83C408                  add esp, 00000008
:00405138 E9A8000000              jmp 004051E5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004050BC(C), :004050CB(C)
|
:0040513D 6800090000              push 00000900
:00405142 8D8500F0FFFF            lea eax, dword ptr [ebp+FFFFF000]
:00405148 50                      push eax
:00405149 6A04                    push 00000004
:0040514B 6A00                    push 00000000
:0040514D 6800400000              push 00004000
:00405152 B9C8E44A00              mov ecx, 004AE4C8
:00405157 E8E4A80700              call 0047FA40
:0040515C 50                      push eax
:0040515D E89BAB0700              call 0047FCFD
:00405162 83C40C                  add esp, 0000000C
:00405165 6A0C                    push 0000000C
:00405167 6A30                    push 00000030
:00405169 6A30                    push 00000030
:0040516B 8D8D00F0FFFF            lea ecx, dword ptr [ebp+FFFFF000]
:00405171 51                      push ecx
:00405172 E849B20200              call 004303C0
:00405177 83C410                  add esp, 00000010
:0040517A 8B95CCEFFFFF            mov edx, dword ptr [ebp+FFFFEFCC]
:00405180 83BA0406000000          cmp dword ptr [edx+00000604], 00000000
:00405187 7419                    je 004051A2
:00405189 6A04                    push 00000004
:0040518B 6A0F                    push 0000000F
:0040518D 6A0F                    push 0000000F
:0040518F 6A30                    push 00000030
:00405191 6A30                    push 00000030
:00405193 8D8500F0FFFF            lea eax, dword ptr [ebp+FFFFF000]
:00405199 50                      push eax
:0040519A E89FB30200              call 0043053E
:0040519F 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405187(C)
|
:004051A2 8D8D00F0FFFF            lea ecx, dword ptr [ebp+FFFFF000]
:004051A8 51                      push ecx
:004051A9 8B95CCEFFFFF            mov edx, dword ptr [ebp+FFFFEFCC]
:004051AF 8A4201                  mov al, byte ptr [edx+01]
:004051B2 50                      push eax
:004051B3 6A30                    push 00000030
:004051B5 6A30                    push 00000030
:004051B7 8B8DCCEFFFFF            mov ecx, dword ptr [ebp+FFFFEFCC]
:004051BD 8B95D0EFFFFF            mov edx, dword ptr [ebp+FFFFEFD0]
:004051C3 039110060000            add edx, dword ptr [ecx+00000610]
:004051C9 52                      push edx
:004051CA 8B85CCEFFFFF            mov eax, dword ptr [ebp+FFFFEFCC]
:004051D0 8B8DD4EFFFFF            mov ecx, dword ptr [ebp+FFFFEFD4]
:004051D6 03880C060000            add ecx, dword ptr [eax+0000060C]
:004051DC 51                      push ecx
:004051DD E89AC10400              call 0045137C
:004051E2 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004050AA(U), :00405138(U)
|
:004051E5 6A04                    push 00000004
:004051E7 6A00                    push 00000000
:004051E9 6800300000              push 00003000
:004051EE B9C8E44A00              mov ecx, 004AE4C8
:004051F3 E848A80700              call 0047FA40
:004051F8 50                      push eax
:004051F9 8B95CCEFFFFF            mov edx, dword ptr [ebp+FFFFEFCC]
:004051FF 8A02                    mov al, byte ptr [edx]
:00405201 50                      push eax
:00405202 6A40                    push 00000040
:00405204 6A40                    push 00000040
:00405206 8B8DD8EFFFFF            mov ecx, dword ptr [ebp+FFFFEFD8]
:0040520C 83E908                  sub ecx, 00000008
:0040520F 51                      push ecx
:00405210 8B95DCEFFFFF            mov edx, dword ptr [ebp+FFFFEFDC]
:00405216 83EA08                  sub edx, 00000008
:00405219 52                      push edx
:0040521A E85DC10400              call 0045137C
:0040521F 83C418                  add esp, 00000018
:00405222 E8CF930100              call 0041E5F6
:00405227 E9BB040000              jmp 004056E7
:0040522C E8AA930100              call 0041E5DB
:00405231 6A00                    push 00000000
:00405233 6A04                    push 00000004
:00405235 6A00                    push 00000000
:00405237 6800590000              push 00005900
:0040523C B9C8E44A00              mov ecx, 004AE4C8
:00405241 E8FAA70700              call 0047FA40
:00405246 50                      push eax
:00405247 6A40                    push 00000040
:00405249 6A40                    push 00000040
:0040524B 8B85D0EFFFFF            mov eax, dword ptr [ebp+FFFFEFD0]
:00405251 83E808                  sub eax, 00000008
:00405254 50                      push eax
:00405255 8B8DD4EFFFFF            mov ecx, dword ptr [ebp+FFFFEFD4]
:0040525B 83E908                  sub ecx, 00000008
:0040525E 51                      push ecx
:0040525F E8AFC60400              call 00451913
:00405264 83C418                  add esp, 00000018
:00405267 6A00                    push 00000000
:00405269 6A04                    push 00000004
:0040526B 6A00                    push 00000000
:0040526D 6800490000              push 00004900
:00405272 B9C8E44A00              mov ecx, 004AE4C8
:00405277 E8C4A70700              call 0047FA40
:0040527C 50                      push eax
:0040527D 6A40                    push 00000040
:0040527F 6A40                    push 00000040
:00405281 8B95D8EFFFFF            mov edx, dword ptr [ebp+FFFFEFD8]
:00405287 83EA08                  sub edx, 00000008
:0040528A 52                      push edx
:0040528B 8B85DCEFFFFF            mov eax, dword ptr [ebp+FFFFEFDC]
:00405291 83E808                  sub eax, 00000008
:00405294 50                      push eax
:00405295 E879C60400              call 00451913
:0040529A 83C418                  add esp, 00000018
:0040529D 8B8DCCEFFFFF            mov ecx, dword ptr [ebp+FFFFEFCC]
:004052A3 33D2                    xor edx, edx
:004052A5 8A5101                  mov dl, byte ptr [ecx+01]
:004052A8 8BCA                    mov ecx, edx
:004052AA 6BC924                  imul ecx, 00000024
:004052AD 81C1502C4B00            add ecx, 004B2C50
:004052B3 E8D8D90600              call 00472C90
:004052B8 85C0                    test eax, eax
:004052BA 7524                    jne 004052E0
:004052BC 8B85CCEFFFFF            mov eax, dword ptr [ebp+FFFFEFCC]
:004052C2 33C9                    xor ecx, ecx
:004052C4 8A4801                  mov cl, byte ptr [eax+01]
:004052C7 51                      push ecx
:004052C8 8B95D0EFFFFF            mov edx, dword ptr [ebp+FFFFEFD0]
:004052CE 52                      push edx
:004052CF 8B85D4EFFFFF            mov eax, dword ptr [ebp+FFFFEFD4]
:004052D5 50                      push eax
:004052D6 E844980300              call 0043EB1F
:004052DB 83C40C                  add esp, 0000000C
:004052DE EB38                    jmp 00405318

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004052BA(C)
|
:004052E0 6A04                    push 00000004
:004052E2 6A00                    push 00000000
:004052E4 6800400000              push 00004000
:004052E9 B9C8E44A00              mov ecx, 004AE4C8
:004052EE E84DA70700              call 0047FA40
:004052F3 50                      push eax
:004052F4 8B8DCCEFFFFF            mov ecx, dword ptr [ebp+FFFFEFCC]
:004052FA 8A5101                  mov dl, byte ptr [ecx+01]
:004052FD 52                      push edx
:004052FE 6A30                    push 00000030
:00405300 6A30                    push 00000030
:00405302 8B85D0EFFFFF            mov eax, dword ptr [ebp+FFFFEFD0]
:00405308 50                      push eax
:00405309 8B8DD4EFFFFF            mov ecx, dword ptr [ebp+FFFFEFD4]
:0040530F 51                      push ecx
:00405310 E867C00400              call 0045137C
:00405315 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004052DE(U)
|
:00405318 6A04                    push 00000004
:0040531A 6A00                    push 00000000
:0040531C 6800300000              push 00003000
:00405321 B9C8E44A00              mov ecx, 004AE4C8
:00405326 E815A70700              call 0047FA40
:0040532B 50                      push eax
:0040532C 8B95CCEFFFFF            mov edx, dword ptr [ebp+FFFFEFCC]
:00405332 8A02                    mov al, byte ptr [edx]
:00405334 50                      push eax
:00405335 6A40                    push 00000040
:00405337 6A40                    push 00000040
:00405339 8B8DD8EFFFFF            mov ecx, dword ptr [ebp+FFFFEFD8]
:0040533F 83E908                  sub ecx, 00000008
:00405342 51                      push ecx
:00405343 8B95DCEFFFFF            mov edx, dword ptr [ebp+FFFFEFDC]
:00405349 83EA08                  sub edx, 00000008
:0040534C 52                      push edx
:0040534D E82AC00400              call 0045137C
:00405352 83C418                  add esp, 00000018
:00405355 E89C920100              call 0041E5F6
:0040535A E988030000              jmp 004056E7
:0040535F E877920100              call 0041E5DB
:00405364 6A00                    push 00000000
:00405366 6A04                    push 00000004
:00405368 6A00                    push 00000000
:0040536A 6800590000              push 00005900
:0040536F B9C8E44A00              mov ecx, 004AE4C8
:00405374 E8C7A60700              call 0047FA40
:00405379 50                      push eax
:0040537A 6A40                    push 00000040
:0040537C 6A40                    push 00000040
:0040537E 8B85D0EFFFFF            mov eax, dword ptr [ebp+FFFFEFD0]
:00405384 83E808                  sub eax, 00000008
:00405387 50                      push eax
:00405388 8B8DD4EFFFFF            mov ecx, dword ptr [ebp+FFFFEFD4]
:0040538E 83E908                  sub ecx, 00000008
:00405391 51                      push ecx
:00405392 E87CC50400              call 00451913
:00405397 83C418                  add esp, 00000018
:0040539A 6A00                    push 00000000
:0040539C 6A04                    push 00000004
:0040539E 6A00                    push 00000000
:004053A0 6800490000              push 00004900
:004053A5 B9C8E44A00              mov ecx, 004AE4C8
:004053AA E891A60700              call 0047FA40
:004053AF 50                      push eax
:004053B0 6A40                    push 00000040
:004053B2 6A40                    push 00000040
:004053B4 8B95D8EFFFFF            mov edx, dword ptr [ebp+FFFFEFD8]
:004053BA 83EA08                  sub edx, 00000008
:004053BD 52                      push edx
:004053BE 8B85DCEFFFFF            mov eax, dword ptr [ebp+FFFFEFDC]
:004053C4 83E808                  sub eax, 00000008
:004053C7 50                      push eax
:004053C8 E846C50400              call 00451913
:004053CD 83C418                  add esp, 00000018
:004053D0 8B8DCCEFFFFF            mov ecx, dword ptr [ebp+FFFFEFCC]
:004053D6 33D2                    xor edx, edx
:004053D8 8A5101                  mov dl, byte ptr [ecx+01]
:004053DB 8BCA                    mov ecx, edx
:004053DD 6BC924                  imul ecx, 00000024
:004053E0 81C1502C4B00            add ecx, 004B2C50
:004053E6 E8A5D80600              call 00472C90
:004053EB 85C0                    test eax, eax
:004053ED 7564                    jne 00405453
:004053EF 8B85CCEFFFFF            mov eax, dword ptr [ebp+FFFFEFCC]
:004053F5 33C9                    xor ecx, ecx
:004053F7 8A4801                  mov cl, byte ptr [eax+01]
:004053FA 51                      push ecx
:004053FB 8B95D0EFFFFF            mov edx, dword ptr [ebp+FFFFEFD0]
:00405401 52                      push edx
:00405402 8B85D4EFFFFF            mov eax, dword ptr [ebp+FFFFEFD4]
:00405408 50                      push eax
:00405409 E811970300              call 0043EB1F
:0040540E 83C40C                  add esp, 0000000C
:00405411 6A04                    push 00000004
:00405413 6A00                    push 00000000
:00405415 6800300000              push 00003000
:0040541A B9C8E44A00              mov ecx, 004AE4C8
:0040541F E81CA60700              call 0047FA40
:00405424 50                      push eax
:00405425 8B8DCCEFFFFF            mov ecx, dword ptr [ebp+FFFFEFCC]
:0040542B 8A11                    mov dl, byte ptr [ecx]
:0040542D 52                      push edx
:0040542E 6A40                    push 00000040
:00405430 6A40                    push 00000040
:00405432 8B85D8EFFFFF            mov eax, dword ptr [ebp+FFFFEFD8]
:00405438 83E808                  sub eax, 00000008
:0040543B 50                      push eax
:0040543C 8B8DDCEFFFFF            mov ecx, dword ptr [ebp+FFFFEFDC]
:00405442 83E908                  sub ecx, 00000008
:00405445 51                      push ecx
:00405446 E831BF0400              call 0045137C
:0040544B 83C418                  add esp, 00000018
:0040544E E9DB000000              jmp 0040552E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004053ED(C)
|
:00405453 6A04                    push 00000004
:00405455 6A00                    push 00000000
:00405457 6800400000              push 00004000
:0040545C B9C8E44A00              mov ecx, 004AE4C8
:00405461 E8DAA50700              call 0047FA40
:00405466 50                      push eax
:00405467 8B95CCEFFFFF            mov edx, dword ptr [ebp+FFFFEFCC]
:0040546D 8A4201                  mov al, byte ptr [edx+01]
:00405470 50                      push eax
:00405471 6A30                    push 00000030
:00405473 6A30                    push 00000030
:00405475 8B8DD0EFFFFF            mov ecx, dword ptr [ebp+FFFFEFD0]
:0040547B 51                      push ecx
:0040547C 8B95D4EFFFFF            mov edx, dword ptr [ebp+FFFFEFD4]
:00405482 52                      push edx
:00405483 E8F4BE0400              call 0045137C
:00405488 83C418                  add esp, 00000018
:0040548B 6A04                    push 00000004
:0040548D 6A00                    push 00000000
:0040548F 6800300000              push 00003000
:00405494 B9C8E44A00              mov ecx, 004AE4C8
:00405499 E8A2A50700              call 0047FA40
:0040549E 50                      push eax
:0040549F 8B85CCEFFFFF            mov eax, dword ptr [ebp+FFFFEFCC]
:004054A5 8A08                    mov cl, byte ptr [eax]
:004054A7 51                      push ecx
:004054A8 6A40                    push 00000040
:004054AA 6A40                    push 00000040
:004054AC 8B95D8EFFFFF            mov edx, dword ptr [ebp+FFFFEFD8]
:004054B2 83EA08                  sub edx, 00000008
:004054B5 52                      push edx
:004054B6 8B85DCEFFFFF            mov eax, dword ptr [ebp+FFFFEFDC]
:004054BC 83E808                  sub eax, 00000008
:004054BF 50                      push eax
:004054C0 E8B7BE0400              call 0045137C
:004054C5 83C418                  add esp, 00000018
:004054C8 8B8DCCEFFFFF            mov ecx, dword ptr [ebp+FFFFEFCC]
:004054CE 83B98400000000          cmp dword ptr [ecx+00000084], 00000000
:004054D5 7425                    je 004054FC
:004054D7 6A18                    push 00000018
:004054D9 6A12                    push 00000012
:004054DB 8B95CCEFFFFF            mov edx, dword ptr [ebp+FFFFEFCC]
:004054E1 8B8284000000            mov eax, dword ptr [edx+00000084]
:004054E7 50                      push eax
:004054E8 8B8DCCEFFFFF            mov ecx, dword ptr [ebp+FFFFEFCC]
:004054EE 8A5101                  mov dl, byte ptr [ecx+01]
:004054F1 52                      push edx
:004054F2 E8FAA50400              call 0044FAF1
:004054F7 83C410                  add esp, 00000010
:004054FA EB32                    jmp 0040552E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004054D5(C)
|
:004054FC 8B85CCEFFFFF            mov eax, dword ptr [ebp+FFFFEFCC]
:00405502 83B85402000000          cmp dword ptr [eax+00000254], 00000000
:00405509 7423                    je 0040552E
:0040550B 6A18                    push 00000018
:0040550D 6A45                    push 00000045
:0040550F 8B8DCCEFFFFF            mov ecx, dword ptr [ebp+FFFFEFCC]
:00405515 8B9154020000            mov edx, dword ptr [ecx+00000254]
:0040551B 52                      push edx
:0040551C 8B85CCEFFFFF            mov eax, dword ptr [ebp+FFFFEFCC]
:00405522 8A4801                  mov cl, byte ptr [eax+01]
:00405525 51                      push ecx
:00405526 E8C6A50400              call 0044FAF1
:0040552B 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040544E(U), :004054FA(U), :00405509(C)
|
:0040552E E8C3900100              call 0041E5F6
:00405533 8B95F0EFFFFF            mov edx, dword ptr [ebp+FFFFEFF0]
:00405539 52                      push edx
:0040553A 8B8DCCEFFFFF            mov ecx, dword ptr [ebp+FFFFEFCC]
:00405540 E841ECFFFF              call 00404186
:00405545 E99D010000              jmp 004056E7
:0040554A 8B85CCEFFFFF            mov eax, dword ptr [ebp+FFFFEFCC]
:00405550 8B8884000000            mov ecx, dword ptr [eax+00000084]
:00405556 51                      push ecx
:00405557 8B95CCEFFFFF            mov edx, dword ptr [ebp+FFFFEFCC]
:0040555D 33C0                    xor eax, eax
:0040555F 8A4201                  mov al, byte ptr [edx+01]
:00405562 8BC8                    mov ecx, eax
:00405564 6BC924                  imul ecx, 00000024
:00405567 81C1502C4B00            add ecx, 004B2C50
:0040556D E81ED70600              call 00472C90
:00405572 50                      push eax
:00405573 E826A50700              call 0047FA9E
:00405578 83C408                  add esp, 00000008
:0040557B 8BF0                    mov esi, eax
:0040557D 8B8DCCEFFFFF            mov ecx, dword ptr [ebp+FFFFEFCC]
:00405583 33D2                    xor edx, edx
:00405585 8A5101                  mov dl, byte ptr [ecx+01]
:00405588 8BCA                    mov ecx, edx
:0040558A 6BC924                  imul ecx, 00000024
:0040558D 81C1502C4B00            add ecx, 004B2C50
:00405593 E8D8A00500              call 0045F670
:00405598 8BC8                    mov ecx, eax
:0040559A 6BC948                  imul ecx, 00000048
:0040559D 81C1681B4A00            add ecx, 004A1B68
:004055A3 E8731C0000              call 0040721B
:004055A8 33D2                    xor edx, edx
:004055AA B905000000              mov ecx, 00000005
:004055AF F7F1                    div ecx
:004055B1 3BF0                    cmp esi, eax
:004055B3 731D                    jnb 004055D2
:004055B5 6A20                    push 00000020
:004055B7 8B95CCEFFFFF            mov edx, dword ptr [ebp+FFFFEFCC]
:004055BD 33C0                    xor eax, eax
:004055BF 8A4201                  mov al, byte ptr [edx+01]
:004055C2 8BC8                    mov ecx, eax
:004055C4 6BC924                  imul ecx, 00000024
:004055C7 81C1502C4B00            add ecx, 004B2C50
:004055CD E846D10300              call 00442718

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004055B3(C)
|
:004055D2 E804900100              call 0041E5DB
:004055D7 8B8DFCEFFFFF            mov ecx, dword ptr [ebp+FFFFEFFC]
:004055DD 51                      push ecx
:004055DE 8B95F8EFFFFF            mov edx, dword ptr [ebp+FFFFEFF8]
:004055E4 52                      push edx
:004055E5 E80FE1FFFF              call 004036F9
:004055EA 83C408                  add esp, 00000008
:004055ED 6A04                    push 00000004
:004055EF 6A00                    push 00000000
:004055F1 6800590000              push 00005900
:004055F6 B9C8E44A00              mov ecx, 004AE4C8
:004055FB E840A40700              call 0047FA40
:00405600 50                      push eax
:00405601 6A40                    push 00000040
:00405603 6A40                    push 00000040
:00405605 8B85D0EFFFFF            mov eax, dword ptr [ebp+FFFFEFD0]
:0040560B 83E808                  sub eax, 00000008
:0040560E 50                      push eax
:0040560F 8B8DD4EFFFFF            mov ecx, dword ptr [ebp+FFFFEFD4]
:00405615 83E908                  sub ecx, 00000008
:00405618 51                      push ecx
:00405619 E8C8C30400              call 004519E6
:0040561E 83C414                  add esp, 00000014
:00405621 6A00                    push 00000000
:00405623 6A04                    push 00000004
:00405625 6A00                    push 00000000
:00405627 6800590000              push 00005900
:0040562C B9C8E44A00              mov ecx, 004AE4C8
:00405631 E80AA40700              call 0047FA40
:00405636 50                      push eax
:00405637 6A40                    push 00000040
:00405639 6A40                    push 00000040
:0040563B 8B95D0EFFFFF            mov edx, dword ptr [ebp+FFFFEFD0]
:00405641 83EA08                  sub edx, 00000008
:00405644 52                      push edx
:00405645 8B85D4EFFFFF            mov eax, dword ptr [ebp+FFFFEFD4]
:0040564B 83E808                  sub eax, 00000008
:0040564E 50                      push eax
:0040564F E8BFC20400              call 00451913
:00405654 83C418                  add esp, 00000018
:00405657 6A00                    push 00000000
:00405659 6A04                    push 00000004
:0040565B 6A00                    push 00000000
:0040565D 6800490000              push 00004900
:00405662 B9C8E44A00              mov ecx, 004AE4C8
:00405667 E8D4A30700              call 0047FA40
:0040566C 50                      push eax
:0040566D 6A40                    push 00000040
:0040566F 6A40                    push 00000040
:00405671 8B8DD8EFFFFF            mov ecx, dword ptr [ebp+FFFFEFD8]
:00405677 83E908                  sub ecx, 00000008
:0040567A 51                      push ecx
:0040567B 8B95DCEFFFFF            mov edx, dword ptr [ebp+FFFFEFDC]
:00405681 83EA08                  sub edx, 00000008
:00405684 52                      push edx
:00405685 E889C20400              call 00451913
:0040568A 83C418                  add esp, 00000018
:0040568D 8B85CCEFFFFF            mov eax, dword ptr [ebp+FFFFEFCC]
:00405693 33C9                    xor ecx, ecx
:00405695 8A4801                  mov cl, byte ptr [eax+01]
:00405698 51                      push ecx
:00405699 8B95D0EFFFFF            mov edx, dword ptr [ebp+FFFFEFD0]
:0040569F 52                      push edx
:004056A0 8B85D4EFFFFF            mov eax, dword ptr [ebp+FFFFEFD4]
:004056A6 50                      push eax
:004056A7 E873940300              call 0043EB1F
:004056AC 83C40C                  add esp, 0000000C
:004056AF 8B8DCCEFFFFF            mov ecx, dword ptr [ebp+FFFFEFCC]
:004056B5 33D2                    xor edx, edx
:004056B7 8A11                    mov dl, byte ptr [ecx]
:004056B9 52                      push edx
:004056BA 8B85D8EFFFFF            mov eax, dword ptr [ebp+FFFFEFD8]
:004056C0 50                      push eax
:004056C1 8B8DDCEFFFFF            mov ecx, dword ptr [ebp+FFFFEFDC]
:004056C7 51                      push ecx
:004056C8 E852940300              call 0043EB1F
:004056CD 83C40C                  add esp, 0000000C
:004056D0 E8218F0100              call 0041E5F6
:004056D5 8B95F0EFFFFF            mov edx, dword ptr [ebp+FFFFEFF0]
:004056DB 52                      push edx
:004056DC 8B8DCCEFFFFF            mov ecx, dword ptr [ebp+FFFFEFCC]
:004056E2 E89FEAFFFF              call 00404186

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040464F(C), :00404803(U), :0040492C(U), :00404CB7(U), :00404D91(U)
|:00404FF5(U), :00405227(U), :0040535A(U), :00405545(U)
|
:004056E7 6A01                    push 00000001
:004056E9 B9181B4B00              mov ecx, 004B1B18
:004056EE E84DDCFFFF              call 00403340
:004056F3 E8E86D0200              call 0042C4E0
:004056F8 E923EFFFFF              jmp 00404620

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404636(C)
|
:004056FD 5E                      pop esi
:004056FE 8BE5                    mov esp, ebp
:00405700 5D                      pop ebp
:00405701 C3                      ret



:00405702 6A464000                DWORD 0040466A
:00405706 08484000                DWORD 00404808
:0040570A 31494000                DWORD 00404931
:0040570E BC4C4000                DWORD 00404CBC
:00405712 964D4000                DWORD 00404D96
:00405716 FA4F4000                DWORD 00404FFA
:0040571A 2C524000                DWORD 0040522C
:0040571E 5F534000                DWORD 0040535F
:00405722 4A554000                DWORD 0040554A
:00405726 E7564000                DWORD 004056E7


:0040572A 0009                    add byte ptr [ecx], cl
:0040572C 0109                    add dword ptr [ecx], ecx
:0040572E 0909                    or dword ptr [ecx], ecx
:00405730 0909                    or dword ptr [ecx], ecx
:00405732 0209                    add cl, byte ptr [ecx]
:00405734 0909                    or dword ptr [ecx], ecx
:00405736 03040506090709          add eax, dword ptr [eax+09070906]
:0040573D 0909                    or dword ptr [ecx], ecx
:0040573F 0909                    or dword ptr [ecx], ecx
:00405741 0909                    or dword ptr [ecx], ecx
:00405743 08                      BYTE 08h


* Referenced by a CALL at Address:
|:00406544   
|
:00405744 55                      push ebp
:00405745 8BEC                    mov ebp, esp
:00405747 81ECD8000000            sub esp, 000000D8
:0040574D 898D28FFFFFF            mov dword ptr [ebp+FFFFFF28], ecx
:00405753 8B8528FFFFFF            mov eax, dword ptr [ebp+FFFFFF28]
:00405759 8B8D28FFFFFF            mov ecx, dword ptr [ebp+FFFFFF28]
:0040575F 8A5110                  mov dl, byte ptr [ecx+10]
:00405762 885001                  mov byte ptr [eax+01], dl
:00405765 8B8D28FFFFFF            mov ecx, dword ptr [ebp+FFFFFF28]
:0040576B E81FE4FFFF              call 00403B8F
:00405770 8B8528FFFFFF            mov eax, dword ptr [ebp+FFFFFF28]
:00405776 33C9                    xor ecx, ecx
:00405778 8A4801                  mov cl, byte ptr [eax+01]
:0040577B 6BC924                  imul ecx, 00000024
:0040577E 81C1502C4B00            add ecx, 004B2C50
:00405784 E8978B0300              call 0043E320
:00405789 8845FC                  mov byte ptr [ebp-04], al
:0040578C 8B9528FFFFFF            mov edx, dword ptr [ebp+FFFFFF28]
:00405792 8A02                    mov al, byte ptr [edx]
:00405794 50                      push eax
:00405795 8B8D28FFFFFF            mov ecx, dword ptr [ebp+FFFFFF28]
:0040579B 8A5101                  mov dl, byte ptr [ecx+01]
:0040579E 52                      push edx
:0040579F E885000300              call 00435829
:004057A4 83C408                  add esp, 00000008
:004057A7 6A00                    push 00000000
:004057A9 8B8D28FFFFFF            mov ecx, dword ptr [ebp+FFFFFF28]
:004057AF E8D1E5FFFF              call 00403D85
:004057B4 8A45FC                  mov al, byte ptr [ebp-04]
:004057B7 50                      push eax
:004057B8 8B8D28FFFFFF            mov ecx, dword ptr [ebp+FFFFFF28]
:004057BE 33D2                    xor edx, edx
:004057C0 8A5101                  mov dl, byte ptr [ecx+01]
:004057C3 8BCA                    mov ecx, edx
:004057C5 6BC924                  imul ecx, 00000024
:004057C8 81C1502C4B00            add ecx, 004B2C50
:004057CE E89D0E0000              call 00406670
:004057D3 68FF000000              push 000000FF
:004057D8 8B8528FFFFFF            mov eax, dword ptr [ebp+FFFFFF28]
:004057DE 8A4801                  mov cl, byte ptr [eax+01]
:004057E1 51                      push ecx
:004057E2 E842000300              call 00435829
:004057E7 83C408                  add esp, 00000008
:004057EA 8B9528FFFFFF            mov edx, dword ptr [ebp+FFFFFF28]
:004057F0 8B4A0C                  mov ecx, dword ptr [edx+0C]
:004057F3 E868DBFFFF              call 00403360
:004057F8 668B00                  mov ax, word ptr [eax]
:004057FB 668945F8                mov word ptr [ebp-08], ax
:004057FF 8B8D28FFFFFF            mov ecx, dword ptr [ebp+FFFFFF28]
:00405805 8A5101                  mov dl, byte ptr [ecx+01]
:00405808 52                      push edx
:00405809 8A45F9                  mov al, byte ptr [ebp-07]
:0040580C 50                      push eax
:0040580D 8A4DF8                  mov cl, byte ptr [ebp-08]
:00405810 51                      push ecx
:00405811 B950424B00              mov ecx, 004B4250
:00405816 E808F90400              call 00455123
:0040581B 8B9528FFFFFF            mov edx, dword ptr [ebp+FFFFFF28]
:00405821 83BA0406000000          cmp dword ptr [edx+00000604], 00000000
:00405828 7450                    je 0040587A
:0040582A 6A19                    push 00000019
:0040582C E801A30700              call 0047FB32
:00405831 83C404                  add esp, 00000004
:00405834 85C0                    test eax, eax
:00405836 7442                    je 0040587A
:00405838 8B8528FFFFFF            mov eax, dword ptr [ebp+FFFFFF28]
:0040583E 8B4804                  mov ecx, dword ptr [eax+04]
:00405841 51                      push ecx
:00405842 8D952CFFFFFF            lea edx, dword ptr [ebp+FFFFFF2C]
:00405848 52                      push edx
:00405849 E8E1670000              call 0040C02F
:0040584E 83C408                  add esp, 00000008
:00405851 8B8528FFFFFF            mov eax, dword ptr [ebp+FFFFFF28]
:00405857 8B480C                  mov ecx, dword ptr [eax+0C]
:0040585A E86AA40300              call 0043FCC9
:0040585F 8B8D28FFFFFF            mov ecx, dword ptr [ebp+FFFFFF28]
:00405865 8B5104                  mov edx, dword ptr [ecx+04]
:00405868 52                      push edx
:00405869 8D852CFFFFFF            lea eax, dword ptr [ebp+FFFFFF2C]
:0040586F 50                      push eax
:00405870 B9F05D4B00              mov ecx, 004B5DF0
:00405875 E8E33D0500              call 0045965D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00405828(C), :00405836(C)
|
:0040587A 8B8D28FFFFFF            mov ecx, dword ptr [ebp+FFFFFF28]
:00405880 E864ECFFFF              call 004044E9
:00405885 8BE5                    mov esp, ebp
:00405887 5D                      pop ebp
:00405888 C3                      ret



* Referenced by a CALL at Address:
|:0040654C   
|
:00405889 55                      push ebp
:0040588A 8BEC                    mov ebp, esp
:0040588C 83EC0C                  sub esp, 0000000C
:0040588F 894DF4                  mov dword ptr [ebp-0C], ecx
:00405892 8B45F4                  mov eax, dword ptr [ebp-0C]
:00405895 33C9                    xor ecx, ecx
:00405897 8A8824040000            mov cl, byte ptr [eax+00000424]
:0040589D F7D9                    neg ecx
:0040589F 1BC9                    sbb ecx, ecx
:004058A1 41                      inc ecx
:004058A2 894DFC                  mov dword ptr [ebp-04], ecx
:004058A5 C645F800                mov [ebp-08], 00
:004058A9 EB09                    jmp 004058B4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405C63(U)
|
:004058AB 8A55F8                  mov dl, byte ptr [ebp-08]
:004058AE 80C201                  add dl, 01
:004058B1 8855F8                  mov byte ptr [ebp-08], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004058A9(U)
|
:004058B4 8B45F8                  mov eax, dword ptr [ebp-08]
:004058B7 25FF000000              and eax, 000000FF
:004058BC 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004058BF 33D2                    xor edx, edx
:004058C1 8A540110                mov dl, byte ptr [ecx+eax+10]
:004058C5 81FAFF000000            cmp edx, 000000FF
:004058CB 0F8497030000            je 00405C68
:004058D1 8B45F8                  mov eax, dword ptr [ebp-08]
:004058D4 25FF000000              and eax, 000000FF
:004058D9 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004058DC 8B55F4                  mov edx, dword ptr [ebp-0C]
:004058DF 8A440210                mov al, byte ptr [edx+eax+10]
:004058E3 884101                  mov byte ptr [ecx+01], al
:004058E6 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004058E9 81E1FF000000            and ecx, 000000FF
:004058EF 8B55F4                  mov edx, dword ptr [ebp-0C]
:004058F2 83BC8A8400000000        cmp dword ptr [edx+4*ecx+00000084], 00000000
:004058FA 7519                    jne 00405915
:004058FC 8B45F8                  mov eax, dword ptr [ebp-08]
:004058FF 25FF000000              and eax, 000000FF
:00405904 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00405907 83BC815402000000        cmp dword ptr [ecx+4*eax+00000254], 00000000
:0040590F 0F8455010000            je 00405A6A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004058FA(C)
|
:00405915 6A23                    push 00000023
:00405917 8B55F4                  mov edx, dword ptr [ebp-0C]
:0040591A 8B4A08                  mov ecx, dword ptr [edx+08]
:0040591D E8E7200000              call 00407A09
:00405922 85C0                    test eax, eax
:00405924 7418                    je 0040593E
:00405926 6A08                    push 00000008
:00405928 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040592B 33C9                    xor ecx, ecx
:0040592D 8A4801                  mov cl, byte ptr [eax+01]
:00405930 6BC924                  imul ecx, 00000024
:00405933 81C1502C4B00            add ecx, 004B2C50
:00405939 E8820D0000              call 004066C0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405924(C)
|
:0040593E 8B55F4                  mov edx, dword ptr [ebp-0C]
:00405941 8B4A08                  mov ecx, dword ptr [edx+08]
:00405944 E8C70C0000              call 00406610
:00405949 25FF000000              and eax, 000000FF
:0040594E 83F832                  cmp eax, 00000032
:00405951 7526                    jne 00405979
:00405953 6A3C                    push 0000003C
:00405955 E8D8A10700              call 0047FB32
:0040595A 83C404                  add esp, 00000004
:0040595D 85C0                    test eax, eax
:0040595F 7418                    je 00405979
:00405961 6A08                    push 00000008
:00405963 8B45F4                  mov eax, dword ptr [ebp-0C]
:00405966 33C9                    xor ecx, ecx
:00405968 8A4801                  mov cl, byte ptr [eax+01]
:0040596B 6BC924                  imul ecx, 00000024
:0040596E 81C1502C4B00            add ecx, 004B2C50
:00405974 E8470D0000              call 004066C0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00405951(C), :0040595F(C)
|
:00405979 6A24                    push 00000024
:0040597B 8B55F4                  mov edx, dword ptr [ebp-0C]
:0040597E 8B4A08                  mov ecx, dword ptr [edx+08]
:00405981 E883200000              call 00407A09
:00405986 85C0                    test eax, eax
:00405988 7418                    je 004059A2
:0040598A 6A10                    push 00000010
:0040598C 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040598F 33C9                    xor ecx, ecx
:00405991 8A4801                  mov cl, byte ptr [eax+01]
:00405994 6BC924                  imul ecx, 00000024
:00405997 81C1502C4B00            add ecx, 004B2C50
:0040599D E81E0D0000              call 004066C0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405988(C)
|
:004059A2 8B55F4                  mov edx, dword ptr [ebp-0C]
:004059A5 8B4A08                  mov ecx, dword ptr [edx+08]
:004059A8 E8630C0000              call 00406610
:004059AD 25FF000000              and eax, 000000FF
:004059B2 83F831                  cmp eax, 00000031
:004059B5 7526                    jne 004059DD
:004059B7 6A3C                    push 0000003C
:004059B9 E874A10700              call 0047FB32
:004059BE 83C404                  add esp, 00000004
:004059C1 85C0                    test eax, eax
:004059C3 7418                    je 004059DD
:004059C5 6A10                    push 00000010
:004059C7 8B45F4                  mov eax, dword ptr [ebp-0C]
:004059CA 33C9                    xor ecx, ecx
:004059CC 8A4801                  mov cl, byte ptr [eax+01]
:004059CF 6BC924                  imul ecx, 00000024
:004059D2 81C1502C4B00            add ecx, 004B2C50
:004059D8 E8E30C0000              call 004066C0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004059B5(C), :004059C3(C)
|
:004059DD 6A25                    push 00000025
:004059DF 8B55F4                  mov edx, dword ptr [ebp-0C]
:004059E2 8B4A08                  mov ecx, dword ptr [edx+08]
:004059E5 E81F200000              call 00407A09
:004059EA 85C0                    test eax, eax
:004059EC 7418                    je 00405A06
:004059EE 6A02                    push 00000002
:004059F0 8B45F4                  mov eax, dword ptr [ebp-0C]
:004059F3 33C9                    xor ecx, ecx
:004059F5 8A4801                  mov cl, byte ptr [eax+01]
:004059F8 6BC924                  imul ecx, 00000024
:004059FB 81C1502C4B00            add ecx, 004B2C50
:00405A01 E8BA0C0000              call 004066C0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004059EC(C)
|
:00405A06 8B55F4                  mov edx, dword ptr [ebp-0C]
:00405A09 8B4A08                  mov ecx, dword ptr [edx+08]
:00405A0C E8FF0B0000              call 00406610
:00405A11 25FF000000              and eax, 000000FF
:00405A16 83F82A                  cmp eax, 0000002A
:00405A19 7526                    jne 00405A41
:00405A1B 6A3C                    push 0000003C
:00405A1D E810A10700              call 0047FB32
:00405A22 83C404                  add esp, 00000004
:00405A25 85C0                    test eax, eax
:00405A27 7418                    je 00405A41
:00405A29 6A02                    push 00000002
:00405A2B 8B45F4                  mov eax, dword ptr [ebp-0C]
:00405A2E 33C9                    xor ecx, ecx
:00405A30 8A4801                  mov cl, byte ptr [eax+01]
:00405A33 6BC924                  imul ecx, 00000024
:00405A36 81C1502C4B00            add ecx, 004B2C50
:00405A3C E87F0C0000              call 004066C0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00405A19(C), :00405A27(C)
|
:00405A41 6A26                    push 00000026
:00405A43 8B55F4                  mov edx, dword ptr [ebp-0C]
:00405A46 8B4A08                  mov ecx, dword ptr [edx+08]
:00405A49 E8BB1F0000              call 00407A09
:00405A4E 85C0                    test eax, eax
:00405A50 7418                    je 00405A6A
:00405A52 6A04                    push 00000004
:00405A54 8B45F4                  mov eax, dword ptr [ebp-0C]
:00405A57 33C9                    xor ecx, ecx
:00405A59 8A4801                  mov cl, byte ptr [eax+01]
:00405A5C 6BC924                  imul ecx, 00000024
:00405A5F 81C1502C4B00            add ecx, 004B2C50
:00405A65 E8560C0000              call 004066C0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040590F(C), :00405A50(C)
|
:00405A6A 8B55FC                  mov edx, dword ptr [ebp-04]
:00405A6D 52                      push edx
:00405A6E 8B45F8                  mov eax, dword ptr [ebp-08]
:00405A71 25FF000000              and eax, 000000FF
:00405A76 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00405A79 8B948130040000          mov edx, dword ptr [ecx+4*eax+00000430]
:00405A80 52                      push edx
:00405A81 6A00                    push 00000000
:00405A83 6A00                    push 00000000
:00405A85 8B45F8                  mov eax, dword ptr [ebp-08]
:00405A88 25FF000000              and eax, 000000FF
:00405A8D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00405A90 8B948154020000          mov edx, dword ptr [ecx+4*eax+00000254]
:00405A97 52                      push edx
:00405A98 8B45F8                  mov eax, dword ptr [ebp-08]
:00405A9B 25FF000000              and eax, 000000FF
:00405AA0 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00405AA3 8B948184000000          mov edx, dword ptr [ecx+4*eax+00000084]
:00405AAA 52                      push edx
:00405AAB 8B45F4                  mov eax, dword ptr [ebp-0C]
:00405AAE 8A08                    mov cl, byte ptr [eax]
:00405AB0 51                      push ecx
:00405AB1 8B55F4                  mov edx, dword ptr [ebp-0C]
:00405AB4 8A4201                  mov al, byte ptr [edx+01]
:00405AB7 50                      push eax
:00405AB8 E8C7AE0400              call 00450984
:00405ABD 83C420                  add esp, 00000020
:00405AC0 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00405AC3 33D2                    xor edx, edx
:00405AC5 8A5101                  mov dl, byte ptr [ecx+01]
:00405AC8 8BCA                    mov ecx, edx
:00405ACA 6BC924                  imul ecx, 00000024
:00405ACD 81C1502C4B00            add ecx, 004B2C50
:00405AD3 E8B8D10600              call 00472C90
:00405AD8 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00405ADB 81E1FF000000            and ecx, 000000FF
:00405AE1 8B55F4                  mov edx, dword ptr [ebp-0C]
:00405AE4 2B848A84000000          sub eax, dword ptr [edx+4*ecx+00000084]
:00405AEB 50                      push eax
:00405AEC 8B45F4                  mov eax, dword ptr [ebp-0C]
:00405AEF 33C9                    xor ecx, ecx
:00405AF1 8A4801                  mov cl, byte ptr [eax+01]
:00405AF4 6BC924                  imul ecx, 00000024
:00405AF7 81C1502C4B00            add ecx, 004B2C50
:00405AFD E8CB9B0300              call 0043F6CD
:00405B02 8B55F4                  mov edx, dword ptr [ebp-0C]
:00405B05 33C0                    xor eax, eax
:00405B07 8A4201                  mov al, byte ptr [edx+01]
:00405B0A 8BC8                    mov ecx, eax
:00405B0C 6BC924                  imul ecx, 00000024
:00405B0F 81C1502C4B00            add ecx, 004B2C50
:00405B15 E826CD0600              call 00472840
:00405B1A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00405B1D 81E1FF000000            and ecx, 000000FF
:00405B23 8B55F4                  mov edx, dword ptr [ebp-0C]
:00405B26 2B848A54020000          sub eax, dword ptr [edx+4*ecx+00000254]
:00405B2D 50                      push eax
:00405B2E 8B45F4                  mov eax, dword ptr [ebp-0C]
:00405B31 33C9                    xor ecx, ecx
:00405B33 8A4801                  mov cl, byte ptr [eax+01]
:00405B36 6BC924                  imul ecx, 00000024
:00405B39 81C1502C4B00            add ecx, 004B2C50
:00405B3F E8CA9B0300              call 0043F70E
:00405B44 8B55F8                  mov edx, dword ptr [ebp-08]
:00405B47 81E2FF000000            and edx, 000000FF
:00405B4D 8B45F4                  mov eax, dword ptr [ebp-0C]
:00405B50 8B8C9030040000          mov ecx, dword ptr [eax+4*edx+00000430]
:00405B57 51                      push ecx
:00405B58 6A01                    push 00000001
:00405B5A 8B55F4                  mov edx, dword ptr [ebp-0C]
:00405B5D 33C0                    xor eax, eax
:00405B5F 8A4201                  mov al, byte ptr [edx+01]
:00405B62 8BC8                    mov ecx, eax
:00405B64 6BC924                  imul ecx, 00000024
:00405B67 81C1502C4B00            add ecx, 004B2C50
:00405B6D E8FE9A0500              call 0045F670
:00405B72 8BC8                    mov ecx, eax
:00405B74 6BC948                  imul ecx, 00000048
:00405B77 81C1681B4A00            add ecx, 004A1B68
:00405B7D E854270000              call 004082D6
:00405B82 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00405B85 81E1FF000000            and ecx, 000000FF
:00405B8B 8B55F4                  mov edx, dword ptr [ebp-0C]
:00405B8E 83BC8A8400000000        cmp dword ptr [edx+4*ecx+00000084], 00000000
:00405B96 0F8EAD000000            jle 00405C49
:00405B9C 8B45F4                  mov eax, dword ptr [ebp-0C]
:00405B9F 33C9                    xor ecx, ecx
:00405BA1 8A4801                  mov cl, byte ptr [eax+01]
:00405BA4 6BC924                  imul ecx, 00000024
:00405BA7 81C1502C4B00            add ecx, 004B2C50
:00405BAD E8DED00600              call 00472C90
:00405BB2 85C0                    test eax, eax
:00405BB4 0F868F000000            jbe 00405C49
:00405BBA 6A3E                    push 0000003E
:00405BBC 8B55F4                  mov edx, dword ptr [ebp-0C]
:00405BBF 33C0                    xor eax, eax
:00405BC1 8A4201                  mov al, byte ptr [edx+01]
:00405BC4 8BC8                    mov ecx, eax
:00405BC6 6BC924                  imul ecx, 00000024
:00405BC9 81C1502C4B00            add ecx, 004B2C50
:00405BCF E89C9A0500              call 0045F670
:00405BD4 8BC8                    mov ecx, eax
:00405BD6 6BC948                  imul ecx, 00000048
:00405BD9 81C1681B4A00            add ecx, 004A1B68
:00405BDF E8251E0000              call 00407A09
:00405BE4 85C0                    test eax, eax
:00405BE6 7461                    je 00405C49
:00405BE8 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00405BEB 33D2                    xor edx, edx
:00405BED 8A5101                  mov dl, byte ptr [ecx+01]
:00405BF0 8BCA                    mov ecx, edx
:00405BF2 6BC924                  imul ecx, 00000024
:00405BF5 81C1502C4B00            add ecx, 004B2C50
:00405BFB E854A30300              call 0043FF54
:00405C00 85C0                    test eax, eax
:00405C02 742E                    je 00405C32
:00405C04 6A57                    push 00000057
:00405C06 B970074B00              mov ecx, 004B0770
:00405C0B E82E7F0000              call 0040DB3E
:00405C10 25FF000000              and eax, 000000FF
:00405C15 85C0                    test eax, eax
:00405C17 7E17                    jle 00405C30
:00405C19 6A00                    push 00000000
:00405C1B 6A00                    push 00000000
:00405C1D 8B45F4                  mov eax, dword ptr [ebp-0C]
:00405C20 8A4801                  mov cl, byte ptr [eax+01]
:00405C23 51                      push ecx
:00405C24 6A57                    push 00000057
:00405C26 B950774900              mov ecx, 00497750
:00405C2B E813800100              call 0041DC43

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405C17(C)
|
:00405C30 EB17                    jmp 00405C49

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405C02(C)
|
:00405C32 6A01                    push 00000001
:00405C34 6A00                    push 00000000
:00405C36 8B55F4                  mov edx, dword ptr [ebp-0C]
:00405C39 8A4201                  mov al, byte ptr [edx+01]
:00405C3C 50                      push eax
:00405C3D 6A57                    push 00000057
:00405C3F B950774900              mov ecx, 00497750
:00405C44 E8FA7F0100              call 0041DC43

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00405B96(C), :00405BB4(C), :00405BE6(C), :00405C30(U)
|
:00405C49 6A20                    push 00000020
:00405C4B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00405C4E 33D2                    xor edx, edx
:00405C50 8A5101                  mov dl, byte ptr [ecx+01]
:00405C53 8BCA                    mov ecx, edx
:00405C55 6BC924                  imul ecx, 00000024
:00405C58 81C1502C4B00            add ecx, 004B2C50
:00405C5E E82D0A0000              call 00406690
:00405C63 E943FCFFFF              jmp 004058AB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004058CB(C)
|
:00405C68 8BE5                    mov esp, ebp
:00405C6A 5D                      pop ebp
:00405C6B C3                      ret



* Referenced by a CALL at Address:
|:00406564   
|
:00405C6C 55                      push ebp
:00405C6D 8BEC                    mov ebp, esp
:00405C6F 51                      push ecx
:00405C70 894DFC                  mov dword ptr [ebp-04], ecx
:00405C73 6A01                    push 00000001
:00405C75 6A00                    push 00000000
:00405C77 8B45FC                  mov eax, dword ptr [ebp-04]
:00405C7A 8B882C040000            mov ecx, dword ptr [eax+0000042C]
:00405C80 51                      push ecx
:00405C81 8B55FC                  mov edx, dword ptr [ebp-04]
:00405C84 8B8228040000            mov eax, dword ptr [edx+00000428]
:00405C8A 50                      push eax
:00405C8B 6A00                    push 00000000
:00405C8D 6A00                    push 00000000
:00405C8F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00405C92 8A5101                  mov dl, byte ptr [ecx+01]
:00405C95 52                      push edx
:00405C96 8B45FC                  mov eax, dword ptr [ebp-04]
:00405C99 8A08                    mov cl, byte ptr [eax]
:00405C9B 51                      push ecx
:00405C9C E8E3AC0400              call 00450984
:00405CA1 83C420                  add esp, 00000020
:00405CA4 6A01                    push 00000001
:00405CA6 8B55FC                  mov edx, dword ptr [ebp-04]
:00405CA9 8B4A08                  mov ecx, dword ptr [edx+08]
:00405CAC E89F090000              call 00406650
:00405CB1 25FF000000              and eax, 000000FF
:00405CB6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00405CB9 038128040000            add eax, dword ptr [ecx+00000428]
:00405CBF 50                      push eax
:00405CC0 8B55FC                  mov edx, dword ptr [ebp-04]
:00405CC3 8B4A08                  mov ecx, dword ptr [edx+08]
:00405CC6 E8852C0000              call 00408950
:00405CCB 8B45FC                  mov eax, dword ptr [ebp-04]
:00405CCE 8B882C040000            mov ecx, dword ptr [eax+0000042C]
:00405CD4 51                      push ecx
:00405CD5 6A00                    push 00000000
:00405CD7 8B55FC                  mov edx, dword ptr [ebp-04]
:00405CDA 8B4A08                  mov ecx, dword ptr [edx+08]
:00405CDD E8F4250000              call 004082D6
:00405CE2 8BE5                    mov esp, ebp
:00405CE4 5D                      pop ebp
:00405CE5 C3                      ret



* Referenced by a CALL at Address:
|:004061CA   
|
:00405CE6 55                      push ebp
:00405CE7 8BEC                    mov ebp, esp
:00405CE9 83EC0C                  sub esp, 0000000C
:00405CEC 894DF4                  mov dword ptr [ebp-0C], ecx
:00405CEF 8B45F4                  mov eax, dword ptr [ebp-0C]
:00405CF2 8B480C                  mov ecx, dword ptr [eax+0C]
:00405CF5 E837990300              call 0043F631
:00405CFA 8945F8                  mov dword ptr [ebp-08], eax
:00405CFD 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00405D00 33D2                    xor edx, edx
:00405D02 8A5101                  mov dl, byte ptr [ecx+01]
:00405D05 8BCA                    mov ecx, edx
:00405D07 6BC924                  imul ecx, 00000024
:00405D0A 81C1502C4B00            add ecx, 004B2C50
:00405D10 E81C990300              call 0043F631
:00405D15 8945FC                  mov dword ptr [ebp-04], eax
:00405D18 8B45FC                  mov eax, dword ptr [ebp-04]
:00405D1B 6BC003                  imul eax, 00000003
:00405D1E 3945F8                  cmp dword ptr [ebp-08], eax
:00405D21 7204                    jb 00405D27
:00405D23 B064                    mov al, 64
:00405D25 EB3E                    jmp 00405D65

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405D21(C)
|
:00405D27 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00405D2A D1E1                    shl ecx, 1
:00405D2C 394DF8                  cmp dword ptr [ebp-08], ecx
:00405D2F 7217                    jb 00405D48
:00405D31 8B55FC                  mov edx, dword ptr [ebp-04]
:00405D34 D1E2                    shl edx, 1
:00405D36 8B45F8                  mov eax, dword ptr [ebp-08]
:00405D39 2BC2                    sub eax, edx
:00405D3B 6BC050                  imul eax, 00000050
:00405D3E 33D2                    xor edx, edx
:00405D40 F775FC                  div [ebp-04]
:00405D43 83C014                  add eax, 00000014
:00405D46 EB1D                    jmp 00405D65

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405D2F(C)
|
:00405D48 8B45F8                  mov eax, dword ptr [ebp-08]
:00405D4B 3B45FC                  cmp eax, dword ptr [ebp-04]
:00405D4E 7213                    jb 00405D63
:00405D50 8B45F8                  mov eax, dword ptr [ebp-08]
:00405D53 2B45FC                  sub eax, dword ptr [ebp-04]
:00405D56 6BC012                  imul eax, 00000012
:00405D59 33D2                    xor edx, edx
:00405D5B F775FC                  div [ebp-04]
:00405D5E 83C002                  add eax, 00000002
:00405D61 EB02                    jmp 00405D65

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405D4E(C)
|
:00405D63 B001                    mov al, 01

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00405D25(U), :00405D46(U), :00405D61(U)
|
:00405D65 8BE5                    mov esp, ebp
:00405D67 5D                      pop ebp
:00405D68 C3                      ret



* Referenced by a CALL at Address:
|:00405EFB   
|
:00405D69 55                      push ebp
:00405D6A 8BEC                    mov ebp, esp
:00405D6C 83EC0C                  sub esp, 0000000C
:00405D6F 894DF4                  mov dword ptr [ebp-0C], ecx
:00405D72 8B45F4                  mov eax, dword ptr [ebp-0C]
:00405D75 8B480C                  mov ecx, dword ptr [eax+0C]
:00405D78 E802990300              call 0043F67F
:00405D7D 8945FC                  mov dword ptr [ebp-04], eax
:00405D80 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00405D83 33D2                    xor edx, edx
:00405D85 8A5101                  mov dl, byte ptr [ecx+01]
:00405D88 8BCA                    mov ecx, edx
:00405D8A 6BC924                  imul ecx, 00000024
:00405D8D 81C1502C4B00            add ecx, 004B2C50
:00405D93 E8E7980300              call 0043F67F
:00405D98 8945F8                  mov dword ptr [ebp-08], eax
:00405D9B 6A29                    push 00000029
:00405D9D 8B45F4                  mov eax, dword ptr [ebp-0C]
:00405DA0 8B4808                  mov ecx, dword ptr [eax+08]
:00405DA3 E8611C0000              call 00407A09
:00405DA8 85C0                    test eax, eax
:00405DAA 7404                    je 00405DB0
:00405DAC B064                    mov al, 64
:00405DAE EB4F                    jmp 00405DFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405DAA(C)
|
:00405DB0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00405DB3 6BC903                  imul ecx, 00000003
:00405DB6 394DFC                  cmp dword ptr [ebp-04], ecx
:00405DB9 7204                    jb 00405DBF
:00405DBB B064                    mov al, 64
:00405DBD EB40                    jmp 00405DFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405DB9(C)
|
:00405DBF 8B55F8                  mov edx, dword ptr [ebp-08]
:00405DC2 D1E2                    shl edx, 1
:00405DC4 3955FC                  cmp dword ptr [ebp-04], edx
:00405DC7 7219                    jb 00405DE2
:00405DC9 8B45F8                  mov eax, dword ptr [ebp-08]
:00405DCC D1E0                    shl eax, 1
:00405DCE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00405DD1 2BC8                    sub ecx, eax
:00405DD3 6BC950                  imul ecx, 00000050
:00405DD6 8BC1                    mov eax, ecx
:00405DD8 33D2                    xor edx, edx
:00405DDA F775F8                  div [ebp-08]
:00405DDD 83C014                  add eax, 00000014
:00405DE0 EB1D                    jmp 00405DFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405DC7(C)
|
:00405DE2 8B55FC                  mov edx, dword ptr [ebp-04]
:00405DE5 3B55F8                  cmp edx, dword ptr [ebp-08]
:00405DE8 7213                    jb 00405DFD
:00405DEA 8B45FC                  mov eax, dword ptr [ebp-04]
:00405DED 2B45F8                  sub eax, dword ptr [ebp-08]
:00405DF0 6BC012                  imul eax, 00000012
:00405DF3 33D2                    xor edx, edx
:00405DF5 F775F8                  div [ebp-08]
:00405DF8 83C002                  add eax, 00000002
:00405DFB EB02                    jmp 00405DFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405DE8(C)
|
:00405DFD B001                    mov al, 01

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00405DAE(U), :00405DBD(U), :00405DE0(U), :00405DFB(U)
|
:00405DFF 8BE5                    mov esp, ebp
:00405E01 5D                      pop ebp
:00405E02 C3                      ret



* Referenced by a CALL at Address:
|:0040653C   
|
:00405E03 55                      push ebp
:00405E04 8BEC                    mov ebp, esp
:00405E06 83EC1C                  sub esp, 0000001C
:00405E09 894DF4                  mov dword ptr [ebp-0C], ecx
:00405E0C 6A00                    push 00000000
:00405E0E 6A74                    push 00000074
:00405E10 8B45F4                  mov eax, dword ptr [ebp-0C]
:00405E13 0584000000              add eax, 00000084
:00405E18 50                      push eax
:00405E19 E8F59E0700              call 0047FD13
:00405E1E 83C40C                  add esp, 0000000C
:00405E21 6A00                    push 00000000
:00405E23 6A74                    push 00000074
:00405E25 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00405E28 81C154020000            add ecx, 00000254
:00405E2E 51                      push ecx
:00405E2F E8DF9E0700              call 0047FD13
:00405E34 83C40C                  add esp, 0000000C
:00405E37 C645FC00                mov [ebp-04], 00
:00405E3B EB09                    jmp 00405E46

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406178(U)
|
:00405E3D 8A55FC                  mov dl, byte ptr [ebp-04]
:00405E40 80C201                  add dl, 01
:00405E43 8855FC                  mov byte ptr [ebp-04], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405E3B(U)
|
:00405E46 8B45FC                  mov eax, dword ptr [ebp-04]
:00405E49 25FF000000              and eax, 000000FF
:00405E4E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00405E51 33D2                    xor edx, edx
:00405E53 8A540110                mov dl, byte ptr [ecx+eax+10]
:00405E57 81FAFF000000            cmp edx, 000000FF
:00405E5D 0F841A030000            je 0040617D
:00405E63 8B45FC                  mov eax, dword ptr [ebp-04]
:00405E66 25FF000000              and eax, 000000FF
:00405E6B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00405E6E 8B55F4                  mov edx, dword ptr [ebp-0C]
:00405E71 8A440210                mov al, byte ptr [edx+eax+10]
:00405E75 884101                  mov byte ptr [ecx+01], al
:00405E78 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00405E7B 33D2                    xor edx, edx
:00405E7D 8A5101                  mov dl, byte ptr [ecx+01]
:00405E80 8BCA                    mov ecx, edx
:00405E82 6BC924                  imul ecx, 00000024
:00405E85 81C1502C4B00            add ecx, 004B2C50
:00405E8B E8E0970500              call 0045F670
:00405E90 6BC048                  imul eax, 00000048
:00405E93 05681B4A00              add eax, 004A1B68
:00405E98 8945F8                  mov dword ptr [ebp-08], eax
:00405E9B 33C0                    xor eax, eax
:00405E9D 3B05042E4900            cmp eax, dword ptr [00492E04]
:00405EA3 1BC9                    sbb ecx, ecx
:00405EA5 F7D9                    neg ecx
:00405EA7 51                      push ecx
:00405EA8 6A01                    push 00000001
:00405EAA 8B55F8                  mov edx, dword ptr [ebp-08]
:00405EAD 52                      push edx
:00405EAE 8B45F4                  mov eax, dword ptr [ebp-0C]
:00405EB1 8B480C                  mov ecx, dword ptr [eax+0C]
:00405EB4 E8925D0300              call 0043BC4B
:00405EB9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00405EBC 81E1FF000000            and ecx, 000000FF
:00405EC2 8B55F4                  mov edx, dword ptr [ebp-0C]
:00405EC5 89848A84000000          mov dword ptr [edx+4*ecx+00000084], eax
:00405ECC 8B45FC                  mov eax, dword ptr [ebp-04]
:00405ECF 25FF000000              and eax, 000000FF
:00405ED4 85C0                    test eax, eax
:00405ED6 0F8597000000            jne 00405F73
:00405EDC 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00405EDF 33D2                    xor edx, edx
:00405EE1 8A5101                  mov dl, byte ptr [ecx+01]
:00405EE4 8BCA                    mov ecx, edx
:00405EE6 6BC924                  imul ecx, 00000024
:00405EE9 81C1502C4B00            add ecx, 004B2C50
:00405EEF E89CCD0600              call 00472C90
:00405EF4 85C0                    test eax, eax
:00405EF6 767B                    jbe 00405F73
:00405EF8 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00405EFB E869FEFFFF              call 00405D69
:00405F00 25FF000000              and eax, 000000FF
:00405F05 50                      push eax
:00405F06 E8279C0700              call 0047FB32
:00405F0B 83C404                  add esp, 00000004
:00405F0E 85C0                    test eax, eax
:00405F10 7461                    je 00405F73
:00405F12 6A39                    push 00000039
:00405F14 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00405F17 E8ED1A0000              call 00407A09
:00405F1C 85C0                    test eax, eax
:00405F1E 7418                    je 00405F38
:00405F20 8B45FC                  mov eax, dword ptr [ebp-04]
:00405F23 25FF000000              and eax, 000000FF
:00405F28 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00405F2B C784818400000000000000  mov dword ptr [ecx+4*eax+00000084], 00000000
:00405F36 EB2E                    jmp 00405F66

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405F1E(C)
|
:00405F38 8B55FC                  mov edx, dword ptr [ebp-04]
:00405F3B 81E2FF000000            and edx, 000000FF
:00405F41 8B45F4                  mov eax, dword ptr [ebp-0C]
:00405F44 8B849084000000          mov eax, dword ptr [eax+4*edx+00000084]
:00405F4B 6BC003                  imul eax, 00000003
:00405F4E 99                      cdq
:00405F4F 2BC2                    sub eax, edx
:00405F51 D1F8                    sar eax, 1
:00405F53 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00405F56 81E1FF000000            and ecx, 000000FF
:00405F5C 8B55F4                  mov edx, dword ptr [ebp-0C]
:00405F5F 89848A84000000          mov dword ptr [edx+4*ecx+00000084], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405F36(U)
|
:00405F66 8B45F4                  mov eax, dword ptr [ebp-0C]
:00405F69 C7800406000001000000    mov dword ptr [ebx+00000604], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00405ED6(C), :00405EF6(C), :00405F10(C)
|
:00405F73 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00405F76 33D2                    xor edx, edx
:00405F78 8A9108060000            mov dl, byte ptr [ecx+00000608]
:00405F7E 85D2                    test edx, edx
:00405F80 7E24                    jle 00405FA6
:00405F82 6A3A                    push 0000003A
:00405F84 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00405F87 E87D1A0000              call 00407A09
:00405F8C 85C0                    test eax, eax
:00405F8E 7416                    je 00405FA6
:00405F90 8B45FC                  mov eax, dword ptr [ebp-04]
:00405F93 25FF000000              and eax, 000000FF
:00405F98 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00405F9B C784818400000000000000  mov dword ptr [ecx+4*eax+00000084], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00405F80(C), :00405F8E(C)
|
:00405FA6 6A3C                    push 0000003C
:00405FA8 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00405FAB E8591A0000              call 00407A09
:00405FB0 85C0                    test eax, eax
:00405FB2 0F84AD000000            je 00406065
:00405FB8 8B55F4                  mov edx, dword ptr [ebp-0C]
:00405FBB 33C0                    xor eax, eax
:00405FBD 8A4201                  mov al, byte ptr [edx+01]
:00405FC0 8BC8                    mov ecx, eax
:00405FC2 6BC924                  imul ecx, 00000024
:00405FC5 81C1502C4B00            add ecx, 004B2C50
:00405FCB E870C80600              call 00472840
:00405FD0 85C0                    test eax, eax
:00405FD2 0F868D000000            jbe 00406065
:00405FD8 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00405FDB 33D2                    xor edx, edx
:00405FDD 8A5101                  mov dl, byte ptr [ecx+01]
:00405FE0 8BCA                    mov ecx, edx
:00405FE2 6BC924                  imul ecx, 00000024
:00405FE5 81C1502C4B00            add ecx, 004B2C50
:00405FEB E850C80600              call 00472840
:00405FF0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00405FF3 81E1FF000000            and ecx, 000000FF
:00405FF9 8B55F4                  mov edx, dword ptr [ebp-0C]
:00405FFC 3B848A84000000          cmp eax, dword ptr [edx+4*ecx+00000084]
:00406003 731B                    jnb 00406020
:00406005 8B45F4                  mov eax, dword ptr [ebp-0C]
:00406008 33C9                    xor ecx, ecx
:0040600A 8A4801                  mov cl, byte ptr [eax+01]
:0040600D 6BC924                  imul ecx, 00000024
:00406010 81C1502C4B00            add ecx, 004B2C50
:00406016 E825C80600              call 00472840
:0040601B 8945F0                  mov dword ptr [ebp-10], eax
:0040601E EB16                    jmp 00406036

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406003(C)
|
:00406020 8B55FC                  mov edx, dword ptr [ebp-04]
:00406023 81E2FF000000            and edx, 000000FF
:00406029 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040602C 8B8C9084000000          mov ecx, dword ptr [eax+4*edx+00000084]
:00406033 894DF0                  mov dword ptr [ebp-10], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040601E(U)
|
:00406036 8B55FC                  mov edx, dword ptr [ebp-04]
:00406039 81E2FF000000            and edx, 000000FF
:0040603F 8B45F4                  mov eax, dword ptr [ebp-0C]
:00406042 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00406045 898C9054020000          mov dword ptr [eax+4*edx+00000254], ecx
:0040604C 8B55FC                  mov edx, dword ptr [ebp-04]
:0040604F 81E2FF000000            and edx, 000000FF
:00406055 8B45F4                  mov eax, dword ptr [ebp-0C]
:00406058 C784908400000000000000  mov dword ptr [eax+4*edx+00000084], 00000000
:00406063 EB74                    jmp 004060D9

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00405FB2(C), :00405FD2(C)
|
:00406065 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00406068 33D2                    xor edx, edx
:0040606A 8A5101                  mov dl, byte ptr [ecx+01]
:0040606D 8BCA                    mov ecx, edx
:0040606F 6BC924                  imul ecx, 00000024
:00406072 81C1502C4B00            add ecx, 004B2C50
:00406078 E813CC0600              call 00472C90
:0040607D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00406080 81E1FF000000            and ecx, 000000FF
:00406086 8B55F4                  mov edx, dword ptr [ebp-0C]
:00406089 3B848A84000000          cmp eax, dword ptr [edx+4*ecx+00000084]
:00406090 731B                    jnb 004060AD
:00406092 8B45F4                  mov eax, dword ptr [ebp-0C]
:00406095 33C9                    xor ecx, ecx
:00406097 8A4801                  mov cl, byte ptr [eax+01]
:0040609A 6BC924                  imul ecx, 00000024
:0040609D 81C1502C4B00            add ecx, 004B2C50
:004060A3 E8E8CB0600              call 00472C90
:004060A8 8945EC                  mov dword ptr [ebp-14], eax
:004060AB EB16                    jmp 004060C3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406090(C)
|
:004060AD 8B55FC                  mov edx, dword ptr [ebp-04]
:004060B0 81E2FF000000            and edx, 000000FF
:004060B6 8B45F4                  mov eax, dword ptr [ebp-0C]
:004060B9 8B8C9084000000          mov ecx, dword ptr [eax+4*edx+00000084]
:004060C0 894DEC                  mov dword ptr [ebp-14], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004060AB(U)
|
:004060C3 8B55FC                  mov edx, dword ptr [ebp-04]
:004060C6 81E2FF000000            and edx, 000000FF
:004060CC 8B45F4                  mov eax, dword ptr [ebp-0C]
:004060CF 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004060D2 898C9084000000          mov dword ptr [eax+4*edx+00000084], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406063(U)
|
:004060D9 8A55FC                  mov dl, byte ptr [ebp-04]
:004060DC 52                      push edx
:004060DD 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004060E0 E8B6D6FFFF              call 0040379B
:004060E5 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004060E8 3B8128040000            cmp eax, dword ptr [ecx+00000428]
:004060EE 7611                    jbe 00406101
:004060F0 8A55FC                  mov dl, byte ptr [ebp-04]
:004060F3 52                      push edx
:004060F4 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004060F7 E89FD6FFFF              call 0040379B
:004060FC 8945E8                  mov dword ptr [ebp-18], eax
:004060FF EB0C                    jmp 0040610D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004060EE(C)
|
:00406101 8B45F4                  mov eax, dword ptr [ebp-0C]
:00406104 8B8828040000            mov ecx, dword ptr [eax+00000428]
:0040610A 894DE8                  mov dword ptr [ebp-18], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004060FF(U)
|
:0040610D 8B55F4                  mov edx, dword ptr [ebp-0C]
:00406110 8B45E8                  mov eax, dword ptr [ebp-18]
:00406113 898228040000            mov dword ptr [edx+00000428], eax
:00406119 8A4DFC                  mov cl, byte ptr [ebp-04]
:0040611C 51                      push ecx
:0040611D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00406120 E858D8FFFF              call 0040397D
:00406125 8B55F4                  mov edx, dword ptr [ebp-0C]
:00406128 3B822C040000            cmp eax, dword ptr [edx+0000042C]
:0040612E 7611                    jbe 00406141
:00406130 8A45FC                  mov al, byte ptr [ebp-04]
:00406133 50                      push eax
:00406134 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00406137 E841D8FFFF              call 0040397D
:0040613C 8945E4                  mov dword ptr [ebp-1C], eax
:0040613F EB0C                    jmp 0040614D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040612E(C)
|
:00406141 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00406144 8B912C040000            mov edx, dword ptr [ecx+0000042C]
:0040614A 8955E4                  mov dword ptr [ebp-1C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040613F(U)
|
:0040614D 8B45F4                  mov eax, dword ptr [ebp-0C]
:00406150 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00406153 89882C040000            mov dword ptr [eax+0000042C], ecx
:00406159 8A55FC                  mov dl, byte ptr [ebp-04]
:0040615C 52                      push edx
:0040615D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00406160 E820D9FFFF              call 00403A85
:00406165 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00406168 81E1FF000000            and ecx, 000000FF
:0040616E 8B55F4                  mov edx, dword ptr [ebp-0C]
:00406171 89848A30040000          mov dword ptr [edx+4*ecx+00000430], eax
:00406178 E9C0FCFFFF              jmp 00405E3D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405E5D(C)
|
:0040617D 8BE5                    mov esp, ebp
:0040617F 5D                      pop ebp
:00406180 C3                      ret



* Referenced by a CALL at Address:
|:00406554   
|
:00406181 55                      push ebp
:00406182 8BEC                    mov ebp, esp
:00406184 83EC08                  sub esp, 00000008
:00406187 894DF8                  mov dword ptr [ebp-08], ecx
:0040618A C745FC01000000          mov [ebp-04], 00000001
:00406191 8B45F8                  mov eax, dword ptr [ebp-08]
:00406194 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00406197 8A5110                  mov dl, byte ptr [ecx+10]
:0040619A 885001                  mov byte ptr [eax+01], dl
:0040619D 833D042E490000          cmp dword ptr [00492E04], 00000000
:004061A4 7609                    jbe 004061AF
:004061A6 C745FC00000000          mov [ebp-04], 00000000
:004061AD EB39                    jmp 004061E8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004061A4(C)
|
:004061AF 8B45F8                  mov eax, dword ptr [ebp-08]
:004061B2 33C9                    xor ecx, ecx
:004061B4 8A8808060000            mov cl, byte ptr [eax+00000608]
:004061BA 85C9                    test ecx, ecx
:004061BC 7E09                    jle 004061C7
:004061BE C745FC00000000          mov [ebp-04], 00000000
:004061C5 EB21                    jmp 004061E8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004061BC(C)
|
:004061C7 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004061CA E817FBFFFF              call 00405CE6
:004061CF 25FF000000              and eax, 000000FF
:004061D4 50                      push eax
:004061D5 E858990700              call 0047FB32
:004061DA 83C404                  add esp, 00000004
:004061DD 85C0                    test eax, eax
:004061DF 7507                    jne 004061E8
:004061E1 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004061AD(U), :004061C5(U), :004061DF(C)
|
:004061E8 8B55F8                  mov edx, dword ptr [ebp-08]
:004061EB C7820406000000000000    mov dword ptr [ebx+00000604], 00000000
:004061F5 8B45FC                  mov eax, dword ptr [ebp-04]
:004061F8 8BE5                    mov esp, ebp
:004061FA 5D                      pop ebp
:004061FB C3                      ret



* Referenced by a CALL at Address:
|:00406503   
|
:004061FC 55                      push ebp
:004061FD 8BEC                    mov ebp, esp
:004061FF 51                      push ecx
:00406200 894DFC                  mov dword ptr [ebp-04], ecx
:00406203 8B45FC                  mov eax, dword ptr [ebp-04]
:00406206 8A4D08                  mov cl, byte ptr [ebp+08]
:00406209 8808                    mov byte ptr [eax], cl
:0040620B 8B55FC                  mov edx, dword ptr [ebp-04]
:0040620E 8A450C                  mov al, byte ptr [ebp+0C]
:00406211 884201                  mov byte ptr [edx+01], al
:00406214 8B4D08                  mov ecx, dword ptr [ebp+08]
:00406217 81E1FF000000            and ecx, 000000FF
:0040621D 6BC924                  imul ecx, 00000024
:00406220 81C1502C4B00            add ecx, 004B2C50
:00406226 8B55FC                  mov edx, dword ptr [ebp-04]
:00406229 894A0C                  mov dword ptr [edx+0C], ecx
:0040622C 8B45FC                  mov eax, dword ptr [ebp-04]
:0040622F 8B480C                  mov ecx, dword ptr [eax+0C]
:00406232 E839940500              call 0045F670
:00406237 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040623A 894104                  mov dword ptr [ecx+04], eax
:0040623D 8B55FC                  mov edx, dword ptr [ebp-04]
:00406240 8B4204                  mov eax, dword ptr [edx+04]
:00406243 6BC048                  imul eax, 00000048
:00406246 05681B4A00              add eax, 004A1B68
:0040624B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040624E 894108                  mov dword ptr [ecx+08], eax
:00406251 8B55FC                  mov edx, dword ptr [ebp-04]
:00406254 33C0                    xor eax, eax
:00406256 8A4201                  mov al, byte ptr [edx+01]
:00406259 8BC8                    mov ecx, eax
:0040625B 6BC924                  imul ecx, 00000024
:0040625E 81C1502C4B00            add ecx, 004B2C50
:00406264 E8F7D0FFFF              call 00403360
:00406269 50                      push eax
:0040626A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040626D 81C125040000            add ecx, 00000425
:00406273 E828030000              call 004065A0
:00406278 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040627B 8B4908                  mov ecx, dword ptr [ecx+08]
:0040627E E895150000              call 00407818
:00406283 8B55FC                  mov edx, dword ptr [ebp-04]
:00406286 888224040000            mov byte ptr [edx+00000424], al
:0040628C 68FF000000              push 000000FF
:00406291 6A74                    push 00000074
:00406293 8B45FC                  mov eax, dword ptr [ebp-04]
:00406296 83C010                  add eax, 00000010
:00406299 50                      push eax
:0040629A E8749A0700              call 0047FD13
:0040629F 83C40C                  add esp, 0000000C
:004062A2 6A00                    push 00000000
:004062A4 6A74                    push 00000074
:004062A6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004062A9 81C184000000            add ecx, 00000084
:004062AF 51                      push ecx
:004062B0 E85E9A0700              call 0047FD13
:004062B5 83C40C                  add esp, 0000000C
:004062B8 6A00                    push 00000000
:004062BA 6A74                    push 00000074
:004062BC 8B55FC                  mov edx, dword ptr [ebp-04]
:004062BF 81C254020000            add edx, 00000254
:004062C5 52                      push edx
:004062C6 E8489A0700              call 0047FD13
:004062CB 83C40C                  add esp, 0000000C
:004062CE 8B45FC                  mov eax, dword ptr [ebp-04]
:004062D1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004062D4 8A5101                  mov dl, byte ptr [ecx+01]
:004062D7 885010                  mov byte ptr [eax+10], dl
:004062DA 68FF000000              push 000000FF
:004062DF 68FF000000              push 000000FF
:004062E4 6A00                    push 00000000
:004062E6 8B45FC                  mov eax, dword ptr [ebp-04]
:004062E9 83C011                  add eax, 00000011
:004062EC 50                      push eax
:004062ED 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004062F0 8A9124040000            mov dl, byte ptr [ecx+00000424]
:004062F6 52                      push edx
:004062F7 8B45FC                  mov eax, dword ptr [ebp-04]
:004062FA 8A4801                  mov cl, byte ptr [eax+01]
:004062FD 51                      push ecx
:004062FE 8B55FC                  mov edx, dword ptr [ebp-04]
:00406301 8B4A0C                  mov ecx, dword ptr [edx+0C]
:00406304 E825020300              call 0043652E
:00406309 8B45FC                  mov eax, dword ptr [ebp-04]
:0040630C C7802804000000000000    mov dword ptr [ebx+00000428], 00000000
:00406316 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00406319 C7812C04000000000000    mov dword ptr [ebx+0000042C], 00000000
:00406323 6A00                    push 00000000
:00406325 6A74                    push 00000074
:00406327 8B55FC                  mov edx, dword ptr [ebp-04]
:0040632A 81C230040000            add edx, 00000430
:00406330 52                      push edx
:00406331 E8DD990700              call 0047FD13
:00406336 83C40C                  add esp, 0000000C
:00406339 8B45FC                  mov eax, dword ptr [ebp-04]
:0040633C 8B480C                  mov ecx, dword ptr [eax+0C]
:0040633F E8109C0300              call 0043FF54
:00406344 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00406347 898100060000            mov dword ptr [ecx+00000600], eax
:0040634D 8B55FC                  mov edx, dword ptr [ebp-04]
:00406350 C7820406000000000000    mov dword ptr [ebx+00000604], 00000000
:0040635A 8B45FC                  mov eax, dword ptr [ebp-04]
:0040635D C7800C06000000000000    mov dword ptr [ebx+0000060C], 00000000
:00406367 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040636A C7811006000000000000    mov dword ptr [ebx+00000610], 00000000
:00406374 8B55FC                  mov edx, dword ptr [ebp-04]
:00406377 8B4A0C                  mov ecx, dword ptr [edx+0C]
:0040637A E891030000              call 00406710
:0040637F 85C0                    test eax, eax
:00406381 7411                    je 00406394
:00406383 8B45FC                  mov eax, dword ptr [ebp-04]
:00406386 8B4804                  mov ecx, dword ptr [eax+04]
:00406389 51                      push ecx
:0040638A B9F05D4B00              mov ecx, 004B5DF0
:0040638F E8CC950400              call 0044F960

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406381(C)
|
:00406394 8BE5                    mov esp, ebp
:00406396 5D                      pop ebp
:00406397 C20800                  ret 0008



* Referenced by a CALL at Address:
|:0040656C   
|
:0040639A 55                      push ebp
:0040639B 8BEC                    mov ebp, esp
:0040639D 83EC10                  sub esp, 00000010
:004063A0 56                      push esi
:004063A1 894DF0                  mov dword ptr [ebp-10], ecx
:004063A4 8B45F0                  mov eax, dword ptr [ebp-10]
:004063A7 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004063AA 8A5110                  mov dl, byte ptr [ecx+10]
:004063AD 885001                  mov byte ptr [eax+01], dl
:004063B0 8B45F0                  mov eax, dword ptr [ebp-10]
:004063B3 33C9                    xor ecx, ecx
:004063B5 8A4801                  mov cl, byte ptr [eax+01]
:004063B8 6BC924                  imul ecx, 00000024
:004063BB 81C1502C4B00            add ecx, 004B2C50
:004063C1 894DFC                  mov dword ptr [ebp-04], ecx
:004063C4 833D042E490001          cmp dword ptr [00492E04], 00000001
:004063CB 7727                    ja 004063F4
:004063CD 833D042E490000          cmp dword ptr [00492E04], 00000000
:004063D4 762D                    jbe 00406403
:004063D6 6A28                    push 00000028
:004063D8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004063DB E890920500              call 0045F670
:004063E0 8BC8                    mov ecx, eax
:004063E2 6BC948                  imul ecx, 00000048
:004063E5 81C1681B4A00            add ecx, 004A1B68
:004063EB E819160000              call 00407A09
:004063F0 85C0                    test eax, eax
:004063F2 750F                    jne 00406403

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004063CB(C)
|
:004063F4 C705042E490000000000    mov dword ptr [00492E04], 00000000
:004063FE E9E9000000              jmp 004064EC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004063D4(C), :004063F2(C)
|
:00406403 C745F801000000          mov [ebp-08], 00000001
:0040640A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040640D E84ECFFFFF              call 00403360
:00406412 50                      push eax
:00406413 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00406416 81C125040000            add ecx, 00000425
:0040641C E87F010000              call 004065A0
:00406421 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00406424 E895940300              call 0043F8BE
:00406429 8845F4                  mov byte ptr [ebp-0C], al
:0040642C 8B55F0                  mov edx, dword ptr [ebp-10]
:0040642F 8A02                    mov al, byte ptr [edx]
:00406431 A2282C4B00              mov byte ptr [004B2C28], al
:00406436 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00406439 E852C80600              call 00472C90
:0040643E 85C0                    test eax, eax
:00406440 7509                    jne 0040644B
:00406442 C745F800000000          mov [ebp-08], 00000000
:00406449 EB64                    jmp 004064AF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406440(C)
|
:0040644B 6A08                    push 00000008
:0040644D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00406450 E88B020000              call 004066E0
:00406455 85C0                    test eax, eax
:00406457 7409                    je 00406462
:00406459 C745F800000000          mov [ebp-08], 00000000
:00406460 EB4D                    jmp 004064AF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406457(C)
|
:00406462 6A2C                    push 0000002C
:00406464 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00406467 8B4908                  mov ecx, dword ptr [ecx+08]
:0040646A E89A150000              call 00407A09
:0040646F 85C0                    test eax, eax
:00406471 7409                    je 0040647C
:00406473 C745F800000000          mov [ebp-08], 00000000
:0040647A EB33                    jmp 004064AF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406471(C)
|
:0040647C 8B55F0                  mov edx, dword ptr [ebp-10]
:0040647F 33C0                    xor eax, eax
:00406481 8A02                    mov al, byte ptr [edx]
:00406483 8BF0                    mov esi, eax
:00406485 6A00                    push 00000000
:00406487 6A00                    push 00000000
:00406489 8A4DF4                  mov cl, byte ptr [ebp-0C]
:0040648C 51                      push ecx
:0040648D 8B55F0                  mov edx, dword ptr [ebp-10]
:00406490 81C225040000            add edx, 00000425
:00406496 52                      push edx
:00406497 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040649A E8E7000300              call 00436586
:0040649F 25FF000000              and eax, 000000FF
:004064A4 3BF0                    cmp esi, eax
:004064A6 7407                    je 004064AF
:004064A8 C745F800000000          mov [ebp-08], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00406449(U), :00406460(U), :0040647A(U), :004064A6(C)
|
:004064AF 837DF800                cmp dword ptr [ebp-08], 00000000
:004064B3 7437                    je 004064EC
:004064B5 A1042E4900              mov eax, dword ptr [00492E04]
:004064BA 83C001                  add eax, 00000001
:004064BD A3042E4900              mov dword ptr [00492E04], eax
:004064C2 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004064C5 8A11                    mov dl, byte ptr [ecx]
:004064C7 52                      push edx
:004064C8 8B45F0                  mov eax, dword ptr [ebp-10]
:004064CB 8A4801                  mov cl, byte ptr [eax+01]
:004064CE 51                      push ecx
:004064CF E855F30200              call 00435829
:004064D4 83C408                  add esp, 00000008
:004064D7 8B55F0                  mov edx, dword ptr [ebp-10]
:004064DA 8A02                    mov al, byte ptr [edx]
:004064DC 50                      push eax
:004064DD 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004064E0 8A5101                  mov dl, byte ptr [ecx+01]
:004064E3 52                      push edx
:004064E4 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004064E7 E805000000              call 004064F1

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004063FE(U), :004064B3(C)
|
:004064EC 5E                      pop esi
:004064ED 8BE5                    mov esp, ebp
:004064EF 5D                      pop ebp
:004064F0 C3                      ret



* Referenced by a CALL at Addresses:
|:004064E7   , :0043AC3F   , :0043ACF5   , :0043DB4E   , :0043DC04   
|
:004064F1 55                      push ebp
:004064F2 8BEC                    mov ebp, esp
:004064F4 51                      push ecx
:004064F5 894DFC                  mov dword ptr [ebp-04], ecx
:004064F8 8A450C                  mov al, byte ptr [ebp+0C]
:004064FB 50                      push eax
:004064FC 8A4D08                  mov cl, byte ptr [ebp+08]
:004064FF 51                      push ecx
:00406500 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00406503 E8F4FCFFFF              call 004061FC
:00406508 8B55FC                  mov edx, dword ptr [ebp-04]
:0040650B C6820806000000          mov byte ptr [edx+00000608], 00
:00406512 EB15                    jmp 00406529

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040655F(U)
|
:00406514 8B45FC                  mov eax, dword ptr [ebp-04]
:00406517 8A8808060000            mov cl, byte ptr [eax+00000608]
:0040651D 80C101                  add cl, 01
:00406520 8B55FC                  mov edx, dword ptr [ebp-04]
:00406523 888A08060000            mov byte ptr [edx+00000608], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406512(U)
|
:00406529 8B45FC                  mov eax, dword ptr [ebp-04]
:0040652C 33C9                    xor ecx, ecx
:0040652E 8A8808060000            mov cl, byte ptr [eax+00000608]
:00406534 83F902                  cmp ecx, 00000002
:00406537 7D28                    jge 00406561
:00406539 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040653C E8C2F8FFFF              call 00405E03
:00406541 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00406544 E8FBF1FFFF              call 00405744
:00406549 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040654C E838F3FFFF              call 00405889
:00406551 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00406554 E828FCFFFF              call 00406181
:00406559 85C0                    test eax, eax
:0040655B 7502                    jne 0040655F
:0040655D EB02                    jmp 00406561

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040655B(C)
|
:0040655F EBB3                    jmp 00406514

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00406537(C), :0040655D(U)
|
:00406561 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00406564 E803F7FFFF              call 00405C6C
:00406569 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040656C E829FEFFFF              call 0040639A
:00406571 8BE5                    mov esp, ebp
:00406573 5D                      pop ebp
:00406574 C20800                  ret 0008


:00406577 CC                      int 03
:00406578 CC                      int 03
:00406579 CC                      int 03
:0040657A CC                      int 03
:0040657B CC                      int 03
:0040657C CC                      int 03
:0040657D CC                      int 03
:0040657E CC                      int 03
:0040657F CC                      int 03

* Referenced by a CALL at Address:
|:004036F2   
|
:00406580 55                      push ebp
:00406581 8BEC                    mov ebp, esp
:00406583 51                      push ecx
:00406584 894DFC                  mov dword ptr [ebp-04], ecx
:00406587 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040658A 81C125040000            add ecx, 00000425
:00406590 E87B910500              call 0045F710
:00406595 8B45FC                  mov eax, dword ptr [ebp-04]
:00406598 8BE5                    mov esp, ebp
:0040659A 5D                      pop ebp
:0040659B C3                      ret


:0040659C CC                      int 03
:0040659D CC                      int 03
:0040659E CC                      int 03
:0040659F CC                      int 03

* Referenced by a CALL at Addresses:
|:004041FD   , :00406273   , :0040641C   , :0041CB32   , :0041CDD3   
|:0041CEEC   , :0042150E   , :004219D3   , :00422235   , :00422286   
|:00424D58   , :004254CF   , :004254F3   , :00433832   , :00433BE5   
|:00433E8A   , :00433F5A   , :0043452B   , :00434FFE   , :00435A35   
|:00435D81   , :00435E6D   , :00435F59   , :004362CC   , :0043655A   
|:00437C42   , :00437DC0   , :00437E97   , :00437F4E   , :0043804C   
|:004386AB   , :0043A7BE   , :0043A94B   , :0043AA6D   , :0043AA99   
|:0043AE5F   , :0043AE88   , :0043B003   , :0043B06B   , :0043B07C   
|:0043B26F   , :0043B282   , :0043B294   , :0043B2A4   , :0043B312   
|:0043B352   , :0043D1B8   , :0043D694   , :0043D82F   , :0043D885   
|:0043D8EE   , :0043D93F   , :0043DA70   , :0043DA9C   , :0043DF23   
|:0043F0AC   , :0043F107   , :0043F145   , :0043F1AF   , :0043F1E2   
|:004402DF   , :00440369   , :00442B7A   , :0044C40C   , :0044C48C   
|:0044C4F8   , :0044C574   , :0044C5E0   , :0044E058   , :0044E25A   
|:00451EEF   , :004538E7   , :004539FC   , :00453AAE   , :00453FF0   
|:00454165   , :0045421B   , :004542E9   , :0045473A   , :004552F7   
|:004553E0   , :00455530   , :0045621B   , :004571E7   , :00457345   
|:00457894   , :004595B1   , :0045B087   , :0045B0BD   , :0045B1EE   
|:0045B227   , :0045B683   , :0045B720   , :0045B73E   , :00465BBB   
|
:004065A0 55                      push ebp
:004065A1 8BEC                    mov ebp, esp
:004065A3 51                      push ecx
:004065A4 894DFC                  mov dword ptr [ebp-04], ecx
:004065A7 8B45FC                  mov eax, dword ptr [ebp-04]
:004065AA 8B4D08                  mov ecx, dword ptr [ebp+08]
:004065AD 8A11                    mov dl, byte ptr [ecx]
:004065AF 8810                    mov byte ptr [eax], dl
:004065B1 8B45FC                  mov eax, dword ptr [ebp-04]
:004065B4 8B4D08                  mov ecx, dword ptr [ebp+08]
:004065B7 8A5101                  mov dl, byte ptr [ecx+01]
:004065BA 885001                  mov byte ptr [eax+01], dl
:004065BD 8B45FC                  mov eax, dword ptr [ebp-04]
:004065C0 8BE5                    mov esp, ebp
:004065C2 5D                      pop ebp
:004065C3 C20400                  ret 0004


:004065C6 CC                      int 03
:004065C7 CC                      int 03
:004065C8 CC                      int 03
:004065C9 CC                      int 03
:004065CA CC                      int 03
:004065CB CC                      int 03
:004065CC CC                      int 03
:004065CD CC                      int 03
:004065CE CC                      int 03
:004065CF CC                      int 03

* Referenced by a CALL at Addresses:
|:004037B2   , :004037E2   , :00403993   , :004039C3   , :00403A9B   
|:00403ACB   , :0040C197   , :00416A00   , :00416B2F   , :004188DF   
|:0041B23B   , :0041C608   , :0041C6C8   , :0041DB48   , :00420F63   
|:00420F93   , :004211A3   , :004211D1   , :00421314   , :00421342   
|:004213B9   , :004213E9   , :0043215A   , :004384B9   , :0043E01A   
|:0043E0C2   , :0043E405   , :004405FF   , :0044925F   , :00449271   
|:0044F5FE   , :00450317   , :00450BEC   , :0045C79A   , :0045D0BC   
|:0045DDAD   , :0045DDBD   , :004659BD   , :00465CDF   , :00465DB2   
|:00469115   , :0046A627   , :0047A01E   , :0047A02E   , :0047A7D5   
|:0047A82F   
|
:004065D0 55                      push ebp
:004065D1 8BEC                    mov ebp, esp
:004065D3 51                      push ecx
:004065D4 894DFC                  mov dword ptr [ebp-04], ecx
:004065D7 8B45FC                  mov eax, dword ptr [ebp-04]
:004065DA 8A402C                  mov al, byte ptr [eax+2C]
:004065DD 8BE5                    mov esp, ebp
:004065DF 5D                      pop ebp
:004065E0 C3                      ret


:004065E1 CC                      int 03
:004065E2 CC                      int 03
:004065E3 CC                      int 03
:004065E4 CC                      int 03
:004065E5 CC                      int 03
:004065E6 CC                      int 03
:004065E7 CC                      int 03
:004065E8 CC                      int 03
:004065E9 CC                      int 03
:004065EA CC                      int 03
:004065EB CC                      int 03
:004065EC CC                      int 03
:004065ED CC                      int 03
:004065EE CC                      int 03
:004065EF CC                      int 03

* Referenced by a CALL at Addresses:
|:004039EC   , :00407A35   , :00407AA1   , :00407B2A   , :00407BA9   
|:00407C42   , :00407D15   , :004082F3   , :00408445   , :004212CF   
|:0043AB8E   , :004500E9   , :00450105   , :00466DB0   , :004676CF   
|:00468534   , :00468CEF   , :00468D0A   , :00468EFA   , :00468F5C   
|:00469446   , :0046A8BC   , :0046A8F7   , :0046BF1D   , :00476ED1   
|:00476EEB   , :00476F89   , :00476FB8   , :00477083   , :0047709D   
|:0047713B   , :0047716A   , :00477235   , :0047724F   , :00477298   
|:004772C7   , :004775A6   
|
:004065F0 55                      push ebp
:004065F1 8BEC                    mov ebp, esp
:004065F3 51                      push ecx
:004065F4 894DFC                  mov dword ptr [ebp-04], ecx
:004065F7 8B4508                  mov eax, dword ptr [ebp+08]
:004065FA 25FF000000              and eax, 000000FF
:004065FF 6BC003                  imul eax, 00000003
:00406602 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00406605 8A44012E                mov al, byte ptr [ecx+eax+2E]
:00406609 8BE5                    mov esp, ebp
:0040660B 5D                      pop ebp
:0040660C C20400                  ret 0004


:0040660F CC                      int 03

* Referenced by a CALL at Addresses:
|:00405944   , :004059A8   , :00405A0C   , :00406A57   , :00406A9C   
|:00407828   , :0040C47D   , :0041C64B   , :0041D5FA   , :0041DF85   
|:004321F4   , :0043845E   , :0043848C   , :0043A247   , :0043C146   
|:0045C76E   , :0046593D   , :0046A630   , :0046A660   , :0047A7CA   
|:0047A7DE   , :0047A809   
|
:00406610 55                      push ebp
:00406611 8BEC                    mov ebp, esp
:00406613 51                      push ecx
:00406614 894DFC                  mov dword ptr [ebp-04], ecx
:00406617 8B45FC                  mov eax, dword ptr [ebp-04]
:0040661A 8A402B                  mov al, byte ptr [eax+2B]
:0040661D 8BE5                    mov esp, ebp
:0040661F 5D                      pop ebp
:00406620 C3                      ret


:00406621 CC                      int 03
:00406622 CC                      int 03
:00406623 CC                      int 03
:00406624 CC                      int 03
:00406625 CC                      int 03
:00406626 CC                      int 03
:00406627 CC                      int 03
:00406628 CC                      int 03
:00406629 CC                      int 03
:0040662A CC                      int 03
:0040662B CC                      int 03
:0040662C CC                      int 03
:0040662D CC                      int 03
:0040662E CC                      int 03
:0040662F CC                      int 03

* Referenced by a CALL at Addresses:
|:004038D0   , :00421093   , :00438BCE   , :0043BABF   , :0043BB02   
|:0044930C   
|
:00406630 55                      push ebp
:00406631 8BEC                    mov ebp, esp
:00406633 51                      push ecx
:00406634 894DFC                  mov dword ptr [ebp-04], ecx
:00406637 8B45FC                  mov eax, dword ptr [ebp-04]
:0040663A 33C9                    xor ecx, ecx
:0040663C 668B88063D0000          mov cx, word ptr [eax+00003D06]
:00406643 8BC1                    mov eax, ecx
:00406645 8BE5                    mov esp, ebp
:00406647 5D                      pop ebp
:00406648 C3                      ret


:00406649 CC                      int 03
:0040664A CC                      int 03
:0040664B CC                      int 03
:0040664C CC                      int 03
:0040664D CC                      int 03
:0040664E CC                      int 03
:0040664F CC                      int 03

* Referenced by a CALL at Addresses:
|:00405CAC   , :0041D47D   , :004230EF   , :0043D07A   , :00440CF1   
|:00440D19   , :0044997C   , :0045012D   , :0045014A   , :00450161   
|:00450537   , :00450762   , :0045C8FC   , :0045C942   , :0045C969   
|:004794F6   , :0047A045   , :0047A055   , :0047AD11   , :0047AD38   
|
:00406650 55                      push ebp
:00406651 8BEC                    mov ebp, esp
:00406653 51                      push ecx
:00406654 894DFC                  mov dword ptr [ebp-04], ecx
:00406657 8B45FC                  mov eax, dword ptr [ebp-04]
:0040665A 8A402D                  mov al, byte ptr [eax+2D]
:0040665D 8BE5                    mov esp, ebp
:0040665F 5D                      pop ebp
:00406660 C3                      ret


:00406661 CC                      int 03
:00406662 CC                      int 03
:00406663 CC                      int 03
:00406664 CC                      int 03
:00406665 CC                      int 03
:00406666 CC                      int 03
:00406667 CC                      int 03
:00406668 CC                      int 03
:00406669 CC                      int 03
:0040666A CC                      int 03
:0040666B CC                      int 03
:0040666C CC                      int 03
:0040666D CC                      int 03
:0040666E CC                      int 03
:0040666F CC                      int 03

* Referenced by a CALL at Addresses:
|:004057CE   , :00421A5D   , :00435362   , :00435381   , :004353F7   
|:00435416   , :00435447   , :00435466   , :004354C3   , :004354E2   
|:00435513   , :00435532   , :004355A2   , :004355C1   , :0043563A   
|:00435659   , :0043568A   , :004356A9   , :00435708   , :00435727   
|:00435758   , :00435777   , :004357B7   , :004357D6   , :004357FE   
|:0043581D   , :0044278A   , :0045753E   , :004576E3   , :004576EF   
|:004576FB   , :00457711   , :0045962A   
|
:00406670 55                      push ebp
:00406671 8BEC                    mov ebp, esp
:00406673 51                      push ecx
:00406674 894DFC                  mov dword ptr [ebp-04], ecx
:00406677 8B45FC                  mov eax, dword ptr [ebp-04]
:0040667A 8A4D08                  mov cl, byte ptr [ebp+08]
:0040667D 88480F                  mov byte ptr [eax+0F], cl
:00406680 8BE5                    mov esp, ebp
:00406682 5D                      pop ebp
:00406683 C20400                  ret 0004


:00406686 CC                      int 03
:00406687 CC                      int 03
:00406688 CC                      int 03
:00406689 CC                      int 03
:0040668A CC                      int 03
:0040668B CC                      int 03
:0040668C CC                      int 03
:0040668D CC                      int 03
:0040668E CC                      int 03
:0040668F CC                      int 03

* Referenced by a CALL at Addresses:
|:00405C5E   , :004162CA   , :00422808   , :0043E1CE   , :0043FE21   
|:0043FF1D   , :00441DEA   , :0044AF9C   , :0044D8F2   , :0045757A   
|:00457741   , :00459553   , :004595EE   , :00459720   , :004598A3   
|:00459DF1   , :0045A72C   , :0045A796   , :0045A7FF   
|
:00406690 55                      push ebp
:00406691 8BEC                    mov ebp, esp
:00406693 51                      push ecx
:00406694 894DFC                  mov dword ptr [ebp-04], ecx
:00406697 8B4508                  mov eax, dword ptr [ebp+08]
:0040669A 25FF000000              and eax, 000000FF
:0040669F F7D0                    not eax
:004066A1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004066A4 8A510D                  mov dl, byte ptr [ecx+0D]
:004066A7 22D0                    and dl, al
:004066A9 8B45FC                  mov eax, dword ptr [ebp-04]
:004066AC 88500D                  mov byte ptr [eax+0D], dl
:004066AF 8BE5                    mov esp, ebp
:004066B1 5D                      pop ebp
:004066B2 C20400                  ret 0004


:004066B5 CC                      int 03
:004066B6 CC                      int 03
:004066B7 CC                      int 03
:004066B8 CC                      int 03
:004066B9 CC                      int 03
:004066BA CC                      int 03
:004066BB CC                      int 03
:004066BC CC                      int 03
:004066BD CC                      int 03
:004066BE CC                      int 03
:004066BF CC                      int 03

* Referenced by a CALL at Addresses:
|:00405939   , :00405974   , :0040599D   , :004059D8   , :00405A01   
|:00405A3C   , :00405A65   , :00420E70   , :00420E7C   , :00420E88   
|:00420E94   , :0045AC06   
|
:004066C0 55                      push ebp
:004066C1 8BEC                    mov ebp, esp
:004066C3 51                      push ecx
:004066C4 894DFC                  mov dword ptr [ebp-04], ecx
:004066C7 8B45FC                  mov eax, dword ptr [ebp-04]
:004066CA 8A481E                  mov cl, byte ptr [eax+1E]
:004066CD 0A4D08                  or cl, byte ptr [ebp+08]
:004066D0 8B55FC                  mov edx, dword ptr [ebp-04]
:004066D3 884A1E                  mov byte ptr [edx+1E], cl
:004066D6 8BE5                    mov esp, ebp
:004066D8 5D                      pop ebp
:004066D9 C20400                  ret 0004


:004066DC CC                      int 03
:004066DD CC                      int 03
:004066DE CC                      int 03
:004066DF CC                      int 03

* Referenced by a CALL at Addresses:
|:00406450   , :0041C55D   , :0041C57D   , :0041C59D   , :0041C5BD   
|:00420674   , :004206A3   , :004206D2   , :00420701   , :00438B8F   
|:0043A632   , :0043ADF2   , :0043B5DD   , :0043B829   , :0043C843   
|:0043C880   , :0043C8BD   , :0043C939   , :0043D5C1   , :0043DC2F   
|:0043E620   , :0043EBB8   , :0043EC27   , :0043EC42   , :0043EC5D   
|:0043ECF8   , :0043ED13   , :0043EDAE   , :0043EDC9   , :0043EE64   
|:0043EE7F   , :0043EF1A   , :0043EF82   , :0043EFE7   , :0043F773   
|:0044DFC1   , :0044E661   , :0044E7B7   , :00478A56   , :00478A9B   
|:00478AE0   , :00478B25   , :00479543   , :00479567   , :0047A87B   
|:0047A912   
|
:004066E0 55                      push ebp
:004066E1 8BEC                    mov ebp, esp
:004066E3 51                      push ecx
:004066E4 894DFC                  mov dword ptr [ebp-04], ecx
:004066E7 8B45FC                  mov eax, dword ptr [ebp-04]
:004066EA 33C9                    xor ecx, ecx
:004066EC 8A481E                  mov cl, byte ptr [eax+1E]
:004066EF 8BC1                    mov eax, ecx
:004066F1 8B5508                  mov edx, dword ptr [ebp+08]
:004066F4 81E2FF000000            and edx, 000000FF
:004066FA 23C2                    and eax, edx
:004066FC 8BE5                    mov esp, ebp
:004066FE 5D                      pop ebp
:004066FF C20400                  ret 0004


:00406702 CC                      int 03
:00406703 CC                      int 03
:00406704 CC                      int 03
:00406705 CC                      int 03
:00406706 CC                      int 03
:00406707 CC                      int 03
:00406708 CC                      int 03
:00406709 CC                      int 03
:0040670A CC                      int 03
:0040670B CC                      int 03
:0040670C CC                      int 03
:0040670D CC                      int 03
:0040670E CC                      int 03
:0040670F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040637A   , :0042429B   , :004242A8   , :00424574   , :00424581   
|:00435C63   , :00435C6D   , :00435C95   , :00435C9F   , :00435DC8   
|:00435DD2   , :00435DFB   , :00435E05   , :00435EB4   , :00435EBE   
|:00435EE7   , :00435EF1   , :00435FA0   , :00435FAA   , :00435FD3   
|:00435FDD   , :00436312   , :0043631C   , :00436345   , :0043634F   
|:00437B4A   , :00437B64   , :00437E06   , :00437E10   , :00437E61   
|:0043834E   , :004387B0   , :00438A88   , :00438A95   , :00439166   
|:0043917F   , :004391A3   , :004391BC   , :0043A303   , :0043A30D   
|:0043AE48   , :0043D231   , :0043D23E   , :0043D567   , :00440D59   
|:00449A10   , :004543DD   , :004543F6   , :004555D7   , :004555F0   
|:00455637   , :00455650   , :0045A4FC   , :0045A616   , :0045B461   
|:0045B476   , :0045B5B1   , :0045B5C6   , :0045B75E   , :0047987E   
|:0047989B   , :00479ABB   , :00479B1B   
|
:00406710 55                      push ebp
:00406711 8BEC                    mov ebp, esp
:00406713 51                      push ecx
:00406714 894DFC                  mov dword ptr [ebp-04], ecx
:00406717 8B45FC                  mov eax, dword ptr [ebp-04]
:0040671A 33C9                    xor ecx, ecx
:0040671C 8A4804                  mov cl, byte ptr [eax+04]
:0040671F 33C0                    xor eax, eax
:00406721 83F923                  cmp ecx, 00000023
:00406724 0F9CC0                  setl al
:00406727 8BE5                    mov esp, ebp
:00406729 5D                      pop ebp
:0040672A C3                      ret


:0040672B CC                      int 03
:0040672C CC                      int 03
:0040672D CC                      int 03
:0040672E CC                      int 03
:0040672F CC                      int 03

* Referenced by a CALL at Addresses:
|:00404708   , :0040493B   , :004224F2   , :004224FC   , :00424AA0   
|:00424AAA   , :004416AC   , :0044E23D   , :004542C4   , :00455D23   
|
:00406730 55                      push ebp
:00406731 8BEC                    mov ebp, esp
:00406733 51                      push ecx
:00406734 894DFC                  mov dword ptr [ebp-04], ecx
:00406737 8B45FC                  mov eax, dword ptr [ebp-04]
:0040673A 33C9                    xor ecx, ecx
:0040673C 8A4805                  mov cl, byte ptr [eax+05]
:0040673F 8BC1                    mov eax, ecx
:00406741 83C001                  add eax, 00000001
:00406744 99                      cdq
:00406745 33C2                    xor eax, edx
:00406747 2BC2                    sub eax, edx
:00406749 83E007                  and eax, 00000007
:0040674C 33C2                    xor eax, edx
:0040674E 2BC2                    sub eax, edx
:00406750 8B55FC                  mov edx, dword ptr [ebp-04]
:00406753 884205                  mov byte ptr [edx+05], al
:00406756 8BE5                    mov esp, ebp
:00406758 5D                      pop ebp
:00406759 C3                      ret


:0040675A CC                      int 03
:0040675B CC                      int 03
:0040675C CC                      int 03
:0040675D CC                      int 03
:0040675E CC                      int 03
:0040675F CC                      int 03

* Referenced by a CALL at Addresses:
|:004197FD   , :0041988A   , :00419917   
|
:00406760 55                      push ebp
:00406761 8BEC                    mov ebp, esp
:00406763 817D0800020000          cmp dword ptr [ebp+08], 00000200
:0040676A 7204                    jb 00406770
:0040676C 33C0                    xor eax, eax
:0040676E EB11                    jmp 00406781

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040676A(C)
|
:00406770 8B4D08                  mov ecx, dword ptr [ebp+08]
:00406773 6BC948                  imul ecx, 00000048
:00406776 81C1681B4A00            add ecx, 004A1B68
:0040677C E8D60F0000              call 00407757

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040676E(U)
|
:00406781 5D                      pop ebp
:00406782 C3                      ret



* Referenced by a CALL at Address:
|:00429C60   
|
:00406783 55                      push ebp
:00406784 8BEC                    mov ebp, esp
:00406786 8B4508                  mov eax, dword ptr [ebp+08]
:00406789 80E40F                  and ah, 0F
:0040678C 5D                      pop ebp
:0040678D C3                      ret



* Referenced by a CALL at Addresses:
|:00407CD2   , :00461EBC   
|
:0040678E 55                      push ebp
:0040678F 8BEC                    mov ebp, esp
:00406791 83EC08                  sub esp, 00000008
:00406794 8B4D08                  mov ecx, dword ptr [ebp+08]
:00406797 6BC919                  imul ecx, 00000019
:0040679A 81C140114A00            add ecx, 004A1140
:004067A0 E87B2D0000              call 00409520
:004067A5 8845FC                  mov byte ptr [ebp-04], al
:004067A8 8B45FC                  mov eax, dword ptr [ebp-04]
:004067AB 25FF000000              and eax, 000000FF
:004067B0 8945F8                  mov dword ptr [ebp-08], eax
:004067B3 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004067B6 83E918                  sub ecx, 00000018
:004067B9 894DF8                  mov dword ptr [ebp-08], ecx
:004067BC 837DF808                cmp dword ptr [ebp-08], 00000008
:004067C0 772E                    ja 004067F0
:004067C2 8B55F8                  mov edx, dword ptr [ebp-08]
:004067C5 FF2495F6674000          jmp dword ptr [4*edx+004067F6]
:004067CC 32C0                    xor al, al
:004067CE EB22                    jmp 004067F2
:004067D0 B002                    mov al, 02
:004067D2 EB1E                    jmp 004067F2
:004067D4 B001                    mov al, 01
:004067D6 EB1A                    jmp 004067F2
:004067D8 B003                    mov al, 03
:004067DA EB16                    jmp 004067F2
:004067DC B004                    mov al, 04
:004067DE EB12                    jmp 004067F2
:004067E0 B005                    mov al, 05
:004067E2 EB0E                    jmp 004067F2
:004067E4 B006                    mov al, 06
:004067E6 EB0A                    jmp 004067F2
:004067E8 B007                    mov al, 07
:004067EA EB06                    jmp 004067F2
:004067EC B008                    mov al, 08
:004067EE EB02                    jmp 004067F2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004067C0(C)
|
:004067F0 0CFF                    or al, FF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004067CE(U), :004067D2(U), :004067D6(U), :004067DA(U), :004067DE(U)
|:004067E2(U), :004067E6(U), :004067EA(U), :004067EE(U)
|
:004067F2 8BE5                    mov esp, ebp
:004067F4 5D                      pop ebp
:004067F5 C3                      ret



:004067F6 CC674000                DWORD 004067CC
:004067FA D0674000                DWORD 004067D0
:004067FE D4674000                DWORD 004067D4
:00406802 D8674000                DWORD 004067D8
:00406806 DC674000                DWORD 004067DC
:0040680A E0674000                DWORD 004067E0
:0040680E E4674000                DWORD 004067E4
:00406812 EC674000                DWORD 004067EC
:00406816 E8674000                DWORD 004067E8



* Referenced by a CALL at Addresses:
|:004039F7   , :00407C67   , :00407D36   , :00408809   , :004212DA   
|:00461E3A   , :0046202D   
|
:0040681A 55                      push ebp
:0040681B 8BEC                    mov ebp, esp
:0040681D 51                      push ecx
:0040681E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00406821 6BC919                  imul ecx, 00000019
:00406824 81C140114A00            add ecx, 004A1140
:0040682A E8112D0000              call 00409540
:0040682F 8845FC                  mov byte ptr [ebp-04], al
:00406832 8B45FC                  mov eax, dword ptr [ebp-04]
:00406835 25FF000000              and eax, 000000FF
:0040683A 83F809                  cmp eax, 00000009
:0040683D 7E0E                    jle 0040684D
:0040683F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00406842 81E1FF000000            and ecx, 000000FF
:00406848 83F918                  cmp ecx, 00000018
:0040684B 7507                    jne 00406854

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040683D(C)
|
:0040684D 32C0                    xor al, al
:0040684F E9AE000000              jmp 00406902

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040684B(C)
|
:00406854 8B55FC                  mov edx, dword ptr [ebp-04]
:00406857 81E2FF000000            and edx, 000000FF
:0040685D 83FA0E                  cmp edx, 0000000E
:00406860 7C0D                    jl 0040686F
:00406862 8B45FC                  mov eax, dword ptr [ebp-04]
:00406865 25FF000000              and eax, 000000FF
:0040686A 83F819                  cmp eax, 00000019
:0040686D 7507                    jne 00406876

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406860(C)
|
:0040686F B002                    mov al, 02
:00406871 E98C000000              jmp 00406902

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040686D(C)
|
:00406876 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00406879 81E1FF000000            and ecx, 000000FF
:0040687F 83F912                  cmp ecx, 00000012
:00406882 7C0E                    jl 00406892
:00406884 8B55FC                  mov edx, dword ptr [ebp-04]
:00406887 81E2FF000000            and edx, 000000FF
:0040688D 83FA1A                  cmp edx, 0000001A
:00406890 7504                    jne 00406896

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406882(C)
|
:00406892 B001                    mov al, 01
:00406894 EB6C                    jmp 00406902

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406890(C)
|
:00406896 8B45FC                  mov eax, dword ptr [ebp-04]
:00406899 25FF000000              and eax, 000000FF
:0040689E 83F81B                  cmp eax, 0000001B
:004068A1 7504                    jne 004068A7
:004068A3 B003                    mov al, 03
:004068A5 EB5B                    jmp 00406902

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004068A1(C)
|
:004068A7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004068AA 81E1FF000000            and ecx, 000000FF
:004068B0 83F91C                  cmp ecx, 0000001C
:004068B3 7504                    jne 004068B9
:004068B5 B004                    mov al, 04
:004068B7 EB49                    jmp 00406902

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004068B3(C)
|
:004068B9 8B55FC                  mov edx, dword ptr [ebp-04]
:004068BC 81E2FF000000            and edx, 000000FF
:004068C2 83FA1D                  cmp edx, 0000001D
:004068C5 7504                    jne 004068CB
:004068C7 B005                    mov al, 05
:004068C9 EB37                    jmp 00406902

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004068C5(C)
|
:004068CB 8B45FC                  mov eax, dword ptr [ebp-04]
:004068CE 25FF000000              and eax, 000000FF
:004068D3 83F81E                  cmp eax, 0000001E
:004068D6 7504                    jne 004068DC
:004068D8 B006                    mov al, 06
:004068DA EB26                    jmp 00406902

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004068D6(C)
|
:004068DC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004068DF 81E1FF000000            and ecx, 000000FF
:004068E5 83F920                  cmp ecx, 00000020
:004068E8 7504                    jne 004068EE
:004068EA B007                    mov al, 07
:004068EC EB14                    jmp 00406902

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004068E8(C)
|
:004068EE 8B55FC                  mov edx, dword ptr [ebp-04]
:004068F1 81E2FF000000            and edx, 000000FF
:004068F7 83FA1F                  cmp edx, 0000001F
:004068FA 7504                    jne 00406900
:004068FC B008                    mov al, 08
:004068FE EB02                    jmp 00406902

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004068FA(C)
|
:00406900 0CFF                    or al, FF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040684F(U), :00406871(U), :00406894(U), :004068A5(U), :004068B7(U)
|:004068C9(U), :004068DA(U), :004068EC(U), :004068FE(U)
|
:00406902 8BE5                    mov esp, ebp
:00406904 5D                      pop ebp
:00406905 C3                      ret



* Referenced by a CALL at Addresses:
|:0040CA77   , :0040CA93   , :0044DCE9   
|
:00406906 55                      push ebp
:00406907 8BEC                    mov ebp, esp
:00406909 8B4508                  mov eax, dword ptr [ebp+08]
:0040690C 25FF000000              and eax, 000000FF
:00406911 83F826                  cmp eax, 00000026
:00406914 7F12                    jg 00406928
:00406916 8B4508                  mov eax, dword ptr [ebp+08]
:00406919 25FF000000              and eax, 000000FF
:0040691E 99                      cdq
:0040691F B903000000              mov ecx, 00000003
:00406924 F7F9                    idiv ecx
:00406926 EB1D                    jmp 00406945

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406914(C)
|
:00406928 8B5508                  mov edx, dword ptr [ebp+08]
:0040692B 81E2FF000000            and edx, 000000FF
:00406931 83FA35                  cmp edx, 00000035
:00406934 7D0D                    jge 00406943
:00406936 8B4508                  mov eax, dword ptr [ebp+08]
:00406939 25FF000000              and eax, 000000FF
:0040693E 83E81A                  sub eax, 0000001A
:00406941 EB02                    jmp 00406945

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406934(C)
|
:00406943 B01B                    mov al, 1B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00406926(U), :00406941(U)
|
:00406945 5D                      pop ebp
:00406946 C3                      ret



* Referenced by a CALL at Addresses:
|:0043FC5F   , :0045C1C7   , :00477E6F   
|
:00406947 55                      push ebp
:00406948 8BEC                    mov ebp, esp
:0040694A 83EC40                  sub esp, 00000040
:0040694D 894DC0                  mov dword ptr [ebp-40], ecx
:00406950 C645C405                mov [ebp-3C], 05
:00406954 C645C505                mov [ebp-3B], 05
:00406958 C645C605                mov [ebp-3A], 05
:0040695C C645C700                mov [ebp-39], 00
:00406960 C645C801                mov [ebp-38], 01
:00406964 C645C902                mov [ebp-37], 02
:00406968 C645CA06                mov [ebp-36], 06
:0040696C C645CB07                mov [ebp-35], 07
:00406970 C645CC08                mov [ebp-34], 08
:00406974 C645CD03                mov [ebp-33], 03
:00406978 C645CE04                mov [ebp-32], 04
:0040697C C645CF05                mov [ebp-31], 05
:00406980 C645D009                mov [ebp-30], 09
:00406984 C645D10A                mov [ebp-2F], 0A
:00406988 C645D20B                mov [ebp-2E], 0B
:0040698C C645D312                mov [ebp-2D], 12
:00406990 C645D413                mov [ebp-2C], 13
:00406994 C645D514                mov [ebp-2B], 14
:00406998 C645D60C                mov [ebp-2A], 0C
:0040699C C645D70D                mov [ebp-29], 0D
:004069A0 C645D80E                mov [ebp-28], 0E
:004069A4 C645D90F                mov [ebp-27], 0F
:004069A8 C645DA10                mov [ebp-26], 10
:004069AC C645DB11                mov [ebp-25], 11
:004069B0 C645DC15                mov [ebp-24], 15
:004069B4 C645DD16                mov [ebp-23], 16
:004069B8 C645DE17                mov [ebp-22], 17
:004069BC C645DF18                mov [ebp-21], 18
:004069C0 C645E019                mov [ebp-20], 19
:004069C4 C645E11A                mov [ebp-1F], 1A
:004069C8 C645E21B                mov [ebp-1E], 1B
:004069CC C645E31C                mov [ebp-1D], 1C
:004069D0 C645E41D                mov [ebp-1C], 1D
:004069D4 C645E517                mov [ebp-1B], 17
:004069D8 C645E617                mov [ebp-1A], 17
:004069DC C645E717                mov [ebp-19], 17
:004069E0 C645E80E                mov [ebp-18], 0E
:004069E4 C645E90E                mov [ebp-17], 0E
:004069E8 C645EA0E                mov [ebp-16], 0E
:004069EC C645EB21                mov [ebp-15], 21
:004069F0 C645EC22                mov [ebp-14], 22
:004069F4 C645ED20                mov [ebp-13], 20
:004069F8 C645EE1F                mov [ebp-12], 1F
:004069FC C645EF1E                mov [ebp-11], 1E
:00406A00 C645F017                mov [ebp-10], 17
:00406A04 C645F117                mov [ebp-0F], 17
:00406A08 C645F227                mov [ebp-0E], 27
:00406A0C C645F323                mov [ebp-0D], 23
:00406A10 C645F424                mov [ebp-0C], 24
:00406A14 C645F525                mov [ebp-0B], 25
:00406A18 C645F626                mov [ebp-0A], 26
:00406A1C C645F744                mov [ebp-09], 44
:00406A20 C645F845                mov [ebp-08], 45
:00406A24 8B4DC0                  mov ecx, dword ptr [ebp-40]
:00406A27 E8D42A0000              call 00409500
:00406A2C 50                      push eax
:00406A2D E843000000              call 00406A75
:00406A32 83C404                  add esp, 00000004
:00406A35 8845FC                  mov byte ptr [ebp-04], al
:00406A38 8B45FC                  mov eax, dword ptr [ebp-04]
:00406A3B 25FF000000              and eax, 000000FF
:00406A40 3DFF000000              cmp eax, 000000FF
:00406A45 7527                    jne 00406A6E
:00406A47 8B4DC0                  mov ecx, dword ptr [ebp-40]
:00406A4A 33D2                    xor edx, edx
:00406A4C 8A512B                  mov dl, byte ptr [ecx+2B]
:00406A4F 83FA35                  cmp edx, 00000035
:00406A52 7D16                    jge 00406A6A
:00406A54 8B4DC0                  mov ecx, dword ptr [ebp-40]
:00406A57 E8B4FBFFFF              call 00406610
:00406A5C 25FF000000              and eax, 000000FF
:00406A61 8A4405C4                mov al, byte ptr [ebp+eax-3C]
:00406A65 8845FC                  mov byte ptr [ebp-04], al
:00406A68 EB04                    jmp 00406A6E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406A52(C)
|
:00406A6A C645FC45                mov [ebp-04], 45

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00406A45(C), :00406A68(U)
|
:00406A6E 8A45FC                  mov al, byte ptr [ebp-04]
:00406A71 8BE5                    mov esp, ebp
:00406A73 5D                      pop ebp
:00406A74 C3                      ret



* Referenced by a CALL at Address:
|:00406A2D   
|
:00406A75 55                      push ebp
:00406A76 8BEC                    mov ebp, esp
:00406A78 83EC0C                  sub esp, 0000000C
:00406A7B C645F8FF                mov [ebp-08], FF
:00406A7F 817D0800020000          cmp dword ptr [ebp+08], 00000200
:00406A86 7208                    jb 00406A90
:00406A88 8A45F8                  mov al, byte ptr [ebp-08]
:00406A8B E9C9010000              jmp 00406C59

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406A86(C)
|
:00406A90 8B4D08                  mov ecx, dword ptr [ebp+08]
:00406A93 6BC948                  imul ecx, 00000048
:00406A96 81C1681B4A00            add ecx, 004A1B68
:00406A9C E86FFBFFFF              call 00406610
:00406AA1 8845FC                  mov byte ptr [ebp-04], al
:00406AA4 8B4508                  mov eax, dword ptr [ebp+08]
:00406AA7 8945F4                  mov dword ptr [ebp-0C], eax
:00406AAA 817DF4AD000000          cmp dword ptr [ebp-0C], 000000AD
:00406AB1 0F879F010000            ja 00406C56
:00406AB7 8B55F4                  mov edx, dword ptr [ebp-0C]
:00406ABA 33C9                    xor ecx, ecx
:00406ABC 8A8AD96C4000            mov cl, byte ptr [edx+00406CD9]
:00406AC2 FF248D5D6C4000          jmp dword ptr [4*ecx+00406C5D]
:00406AC9 8B45FC                  mov eax, dword ptr [ebp-04]
:00406ACC 25FF000000              and eax, 000000FF
:00406AD1 99                      cdq
:00406AD2 B903000000              mov ecx, 00000003
:00406AD7 F7F9                    idiv ecx
:00406AD9 83C228                  add edx, 00000028
:00406ADC 8855F8                  mov byte ptr [ebp-08], dl
:00406ADF E972010000              jmp 00406C56
:00406AE4 8B45FC                  mov eax, dword ptr [ebp-04]
:00406AE7 25FF000000              and eax, 000000FF
:00406AEC 99                      cdq
:00406AED B903000000              mov ecx, 00000003
:00406AF2 F7F9                    idiv ecx
:00406AF4 83C22B                  add edx, 0000002B
:00406AF7 8855F8                  mov byte ptr [ebp-08], dl
:00406AFA E957010000              jmp 00406C56
:00406AFF 8B45FC                  mov eax, dword ptr [ebp-04]
:00406B02 25FF000000              and eax, 000000FF
:00406B07 99                      cdq
:00406B08 B903000000              mov ecx, 00000003
:00406B0D F7F9                    idiv ecx
:00406B0F 83C22E                  add edx, 0000002E
:00406B12 8855F8                  mov byte ptr [ebp-08], dl
:00406B15 E93C010000              jmp 00406C56
:00406B1A 8B45FC                  mov eax, dword ptr [ebp-04]
:00406B1D 25FF000000              and eax, 000000FF
:00406B22 99                      cdq
:00406B23 B903000000              mov ecx, 00000003
:00406B28 F7F9                    idiv ecx
:00406B2A 83C246                  add edx, 00000046
:00406B2D 8855F8                  mov byte ptr [ebp-08], dl
:00406B30 E921010000              jmp 00406C56
:00406B35 8B45FC                  mov eax, dword ptr [ebp-04]
:00406B38 25FF000000              and eax, 000000FF
:00406B3D 99                      cdq
:00406B3E B903000000              mov ecx, 00000003
:00406B43 F7F9                    idiv ecx
:00406B45 83C249                  add edx, 00000049
:00406B48 8855F8                  mov byte ptr [ebp-08], dl
:00406B4B E906010000              jmp 00406C56
:00406B50 8B45FC                  mov eax, dword ptr [ebp-04]
:00406B53 25FF000000              and eax, 000000FF
:00406B58 99                      cdq
:00406B59 B903000000              mov ecx, 00000003
:00406B5E F7F9                    idiv ecx
:00406B60 83C231                  add edx, 00000031
:00406B63 8855F8                  mov byte ptr [ebp-08], dl
:00406B66 E9EB000000              jmp 00406C56
:00406B6B 8B45FC                  mov eax, dword ptr [ebp-04]
:00406B6E 25FF000000              and eax, 000000FF
:00406B73 99                      cdq
:00406B74 B903000000              mov ecx, 00000003
:00406B79 F7F9                    idiv ecx
:00406B7B 83C234                  add edx, 00000034
:00406B7E 8855F8                  mov byte ptr [ebp-08], dl
:00406B81 E9D0000000              jmp 00406C56
:00406B86 8B45FC                  mov eax, dword ptr [ebp-04]
:00406B89 25FF000000              and eax, 000000FF
:00406B8E 99                      cdq
:00406B8F B903000000              mov ecx, 00000003
:00406B94 F7F9                    idiv ecx
:00406B96 F7DA                    neg edx
:00406B98 1BD2                    sbb edx, edx
:00406B9A 83E2EB                  and edx, FFFFFFEB
:00406B9D 83C24C                  add edx, 0000004C
:00406BA0 8855F8                  mov byte ptr [ebp-08], dl
:00406BA3 E9AE000000              jmp 00406C56
:00406BA8 C645F838                mov [ebp-08], 38
:00406BAC E9A5000000              jmp 00406C56
:00406BB1 8B45FC                  mov eax, dword ptr [ebp-04]
:00406BB4 25FF000000              and eax, 000000FF
:00406BB9 99                      cdq
:00406BBA B903000000              mov ecx, 00000003
:00406BBF F7F9                    idiv ecx
:00406BC1 F7DA                    neg edx
:00406BC3 1BD2                    sbb edx, edx
:00406BC5 83E214                  and edx, 00000014
:00406BC8 83C239                  add edx, 00000039
:00406BCB 8855F8                  mov byte ptr [ebp-08], dl
:00406BCE E983000000              jmp 00406C56
:00406BD3 8B45FC                  mov eax, dword ptr [ebp-04]
:00406BD6 25FF000000              and eax, 000000FF
:00406BDB 99                      cdq
:00406BDC B903000000              mov ecx, 00000003
:00406BE1 F7F9                    idiv ecx
:00406BE3 F7DA                    neg edx
:00406BE5 1BD2                    sbb edx, edx
:00406BE7 83E214                  and edx, 00000014
:00406BEA 83C23A                  add edx, 0000003A
:00406BED 8855F8                  mov byte ptr [ebp-08], dl
:00406BF0 EB64                    jmp 00406C56
:00406BF2 C645F83B                mov [ebp-08], 3B
:00406BF6 EB5E                    jmp 00406C56
:00406BF8 C645F83C                mov [ebp-08], 3C
:00406BFC EB58                    jmp 00406C56
:00406BFE C645F83C                mov [ebp-08], 3C
:00406C02 EB52                    jmp 00406C56
:00406C04 C645F83C                mov [ebp-08], 3C
:00406C08 EB4C                    jmp 00406C56
:00406C0A C645F83F                mov [ebp-08], 3F
:00406C0E EB46                    jmp 00406C56
:00406C10 C645F841                mov [ebp-08], 41
:00406C14 EB40                    jmp 00406C56
:00406C16 C645F842                mov [ebp-08], 42
:00406C1A EB3A                    jmp 00406C56
:00406C1C C645F843                mov [ebp-08], 43
:00406C20 EB34                    jmp 00406C56
:00406C22 C645F84F                mov [ebp-08], 4F
:00406C26 EB2E                    jmp 00406C56
:00406C28 C645F844                mov [ebp-08], 44
:00406C2C EB28                    jmp 00406C56
:00406C2E C645F850                mov [ebp-08], 50
:00406C32 EB22                    jmp 00406C56
:00406C34 C645F851                mov [ebp-08], 51
:00406C38 EB1C                    jmp 00406C56
:00406C3A C645F840                mov [ebp-08], 40
:00406C3E EB16                    jmp 00406C56
:00406C40 C645F83D                mov [ebp-08], 3D
:00406C44 EB10                    jmp 00406C56
:00406C46 C645F83D                mov [ebp-08], 3D
:00406C4A EB0A                    jmp 00406C56
:00406C4C C645F83D                mov [ebp-08], 3D
:00406C50 EB04                    jmp 00406C56
:00406C52 C645F852                mov [ebp-08], 52

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00406AB1(C), :00406ADF(U), :00406AFA(U), :00406B15(U), :00406B30(U)
|:00406B4B(U), :00406B66(U), :00406B81(U), :00406BA3(U), :00406BAC(U)
|:00406BCE(U), :00406BF0(U), :00406BF6(U), :00406BFC(U), :00406C02(U)
|:00406C08(U), :00406C0E(U), :00406C14(U), :00406C1A(U), :00406C20(U)
|:00406C26(U), :00406C2C(U), :00406C32(U), :00406C38(U), :00406C3E(U)
|:00406C44(U), :00406C4A(U), :00406C50(U)
|
:00406C56 8A45F8                  mov al, byte ptr [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406A8B(U)
|
:00406C59 8BE5                    mov esp, ebp
:00406C5B 5D                      pop ebp
:00406C5C C3                      ret



:00406C5D C96A4000                DWORD 00406AC9
:00406C61 E46A4000                DWORD 00406AE4
:00406C65 FF6A4000                DWORD 00406AFF
:00406C69 B16B4000                DWORD 00406BB1
:00406C6D 356B4000                DWORD 00406B35
:00406C71 1A6B4000                DWORD 00406B1A
:00406C75 506B4000                DWORD 00406B50
:00406C79 6B6B4000                DWORD 00406B6B
:00406C7D 866B4000                DWORD 00406B86
:00406C81 D36B4000                DWORD 00406BD3
:00406C85 F26B4000                DWORD 00406BF2
:00406C89 A86B4000                DWORD 00406BA8
:00406C8D 226C4000                DWORD 00406C22
:00406C91 FE6B4000                DWORD 00406BFE
:00406C95 0A6C4000                DWORD 00406C0A
:00406C99 106C4000                DWORD 00406C10
:00406C9D F86B4000                DWORD 00406BF8
:00406CA1 046C4000                DWORD 00406C04
:00406CA5 1C6C4000                DWORD 00406C1C
:00406CA9 166C4000                DWORD 00406C16
:00406CAD 286C4000                DWORD 00406C28
:00406CB1 526C4000                DWORD 00406C52
:00406CB5 2E6C4000                DWORD 00406C2E
:00406CB9 346C4000                DWORD 00406C34
:00406CBD 3A6C4000                DWORD 00406C3A
:00406CC1 406C4000                DWORD 00406C40
:00406CC5 466C4000                DWORD 00406C46
:00406CC9 4C6C4000                DWORD 00406C4C
:00406CCD 526C4000                DWORD 00406C52
:00406CD1 A86B4000                DWORD 00406BA8
:00406CD5 566C4000                DWORD 00406C56


:00406CD9 0001                    add byte ptr [ecx], al
:00406CDB 0203                    add al, byte ptr [ebx]
:00406CDD 1E                      push ds
:00406CDE 1E                      push ds
:00406CDF 1E                      push ds
:00406CE0 1E                      push ds
:00406CE1 1E                      push ds
:00406CE2 1E                      push ds
:00406CE3 1E                      push ds
:00406CE4 1E                      push ds
:00406CE5 1E                      push ds
:00406CE6 1E                      push ds
:00406CE7 1E                      push ds
:00406CE8 0405                    add al, 05
:00406CEA 06                      push es
:00406CEB 1E                      push ds
:00406CEC 07                      pop es
:00406CED 1E                      push ds
:00406CEE 1E                      push ds
:00406CEF 1E                      push ds
:00406CF0 1E                      push ds
:00406CF1 1E                      push ds
:00406CF2 1E                      push ds
:00406CF3 1E                      push ds
:00406CF4 1E                      push ds
:00406CF5 1E                      push ds
:00406CF6 1E                      push ds
:00406CF7 1E                      push ds
:00406CF8 1E                      push ds
:00406CF9 0809                    or byte ptr [ecx], cl
:00406CFB 0A0B                    or cl, byte ptr [ebx]
:00406CFD 1E                      push ds
:00406CFE 1E                      push ds
:00406CFF 1E                      push ds
:00406D00 1E                      push ds
:00406D01 1E                      push ds
:00406D02 1E                      push ds
:00406D03 1E                      push ds
:00406D04 1E                      push ds
:00406D05 1E                      push ds
:00406D06 1E                      push ds
:00406D07 1E                      push ds
:00406D08 1E                      push ds
:00406D09 1E                      push ds
:00406D0A 1E                      push ds
:00406D0B 1E                      push ds
:00406D0C 1E                      push ds
:00406D0D 1E                      push ds
:00406D0E 1E                      push ds
:00406D0F 1E                      push ds
:00406D10 1E                      push ds
:00406D11 1E                      push ds
:00406D12 1E                      push ds
:00406D13 1E                      push ds
:00406D14 1E                      push ds
:00406D15 1E                      push ds
:00406D16 1E                      push ds
:00406D17 1E                      push ds
:00406D18 1E                      push ds
:00406D19 1E                      push ds
:00406D1A 1E                      push ds
:00406D1B 1E                      push ds
:00406D1C 1E                      push ds
:00406D1D 1E                      push ds
:00406D1E 1E                      push ds
:00406D1F 1E                      push ds
:00406D20 1E                      push ds
:00406D21 0C1E                    or al, 1E
:00406D23 1E                      push ds
:00406D24 1E                      push ds
:00406D25 0D0E1E1E1E              or eax, 1E1E1E0E
:00406D2A 0F                      BYTE 0fh
:00406D2B 1E                      push ds
:00406D2C 1E                      push ds
:00406D2D 1E                      push ds
:00406D2E 1E                      push ds
:00406D2F 1E                      push ds
:00406D30 1E                      push ds
:00406D31 1E                      push ds
:00406D32 1E                      push ds
:00406D33 1E                      push ds
:00406D34 1E                      push ds
:00406D35 1E                      push ds
:00406D36 1E                      push ds
:00406D37 1E                      push ds
:00406D38 1E                      push ds
:00406D39 1E                      push ds
:00406D3A 1E                      push ds
:00406D3B 1E                      push ds
:00406D3C 1011                    adc byte ptr [ecx], dl
:00406D3E 121E                    adc bl, byte ptr [esi]
:00406D40 1E                      push ds
:00406D41 1E                      push ds
:00406D42 1E                      push ds
:00406D43 1E                      push ds
:00406D44 1E                      push ds
:00406D45 1E                      push ds
:00406D46 1E                      push ds
:00406D47 1E                      push ds
:00406D48 1E                      push ds
:00406D49 1E                      push ds
:00406D4A 1E                      push ds
:00406D4B 1E                      push ds
:00406D4C 1E                      push ds
:00406D4D 1E                      push ds
:00406D4E 1E                      push ds
:00406D4F 1E                      push ds
:00406D50 131E                    adc ebx, dword ptr [esi]
:00406D52 1E                      push ds
:00406D53 1E                      push ds
:00406D54 1E                      push ds
:00406D55 1E                      push ds
:00406D56 1E                      push ds
:00406D57 1E                      push ds
:00406D58 1E                      push ds
:00406D59 1E                      push ds
:00406D5A 1E                      push ds
:00406D5B 1E                      push ds
:00406D5C 1E                      push ds
:00406D5D 1E                      push ds
:00406D5E 1E                      push ds
:00406D5F 1E                      push ds
:00406D60 1E                      push ds
:00406D61 1E                      push ds
:00406D62 1E                      push ds
:00406D63 1E                      push ds
:00406D64 1E                      push ds
:00406D65 1E                      push ds
:00406D66 1E                      push ds
:00406D67 1E                      push ds
:00406D68 1E                      push ds
:00406D69 1E                      push ds
:00406D6A 1E                      push ds
:00406D6B 1E                      push ds
:00406D6C 1E                      push ds
:00406D6D 1E                      push ds
:00406D6E 141E                    adc al, 1E
:00406D70 1E                      push ds
:00406D71 1E                      push ds
:00406D72 1E                      push ds
:00406D73 1E                      push ds
:00406D74 1E                      push ds
:00406D75 1E                      push ds
:00406D76 1E                      push ds
:00406D77 1E                      push ds
:00406D78 1E                      push ds
:00406D79 1E                      push ds
:00406D7A 1E                      push ds
:00406D7B 1516171819              adc eax, 19181716
:00406D80 1A1B                    sbb bl, byte ptr [ebx]
:00406D82 1C1D                    sbb al, 1D
:00406D84 1D                      BYTE 1dh
:00406D85 1D                      BYTE 1dh
:00406D86 1D                      BYTE 1dh


* Referenced by a CALL at Addresses:
|:0041140A   , :00412193   
|
:00406D87 55                      push ebp
:00406D88 8BEC                    mov ebp, esp
:00406D8A 83EC08                  sub esp, 00000008
:00406D8D 894DFC                  mov dword ptr [ebp-04], ecx
:00406D90 8B4508                  mov eax, dword ptr [ebp+08]
:00406D93 25FF000000              and eax, 000000FF
:00406D98 8945F8                  mov dword ptr [ebp-08], eax
:00406D9B 837DF806                cmp dword ptr [ebp-08], 00000006
:00406D9F 7752                    ja 00406DF3
:00406DA1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00406DA4 FF248DFB6D4000          jmp dword ptr [4*ecx+00406DFB]
:00406DAB 8B55FC                  mov edx, dword ptr [ebp-04]
:00406DAE 33C0                    xor eax, eax
:00406DB0 8A4215                  mov al, byte ptr [edx+15]
:00406DB3 EB40                    jmp 00406DF5
:00406DB5 8B45FC                  mov eax, dword ptr [ebp-04]
:00406DB8 33C9                    xor ecx, ecx
:00406DBA 8A4816                  mov cl, byte ptr [eax+16]
:00406DBD 8BC1                    mov eax, ecx
:00406DBF EB34                    jmp 00406DF5
:00406DC1 8B55FC                  mov edx, dword ptr [ebp-04]
:00406DC4 33C0                    xor eax, eax
:00406DC6 8A4217                  mov al, byte ptr [edx+17]
:00406DC9 EB2A                    jmp 00406DF5
:00406DCB 8B45FC                  mov eax, dword ptr [ebp-04]
:00406DCE 33C9                    xor ecx, ecx
:00406DD0 8A4818                  mov cl, byte ptr [eax+18]
:00406DD3 8BC1                    mov eax, ecx
:00406DD5 EB1E                    jmp 00406DF5
:00406DD7 8B55FC                  mov edx, dword ptr [ebp-04]
:00406DDA 33C0                    xor eax, eax
:00406DDC 8A4219                  mov al, byte ptr [edx+19]
:00406DDF EB14                    jmp 00406DF5
:00406DE1 8B45FC                  mov eax, dword ptr [ebp-04]
:00406DE4 8B401C                  mov eax, dword ptr [eax+1C]
:00406DE7 EB0C                    jmp 00406DF5
:00406DE9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00406DEC 33C0                    xor eax, eax
:00406DEE 8A4120                  mov al, byte ptr [ecx+20]
:00406DF1 EB02                    jmp 00406DF5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406D9F(C)
|
:00406DF3 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00406DB3(U), :00406DBF(U), :00406DC9(U), :00406DD5(U), :00406DDF(U)
|:00406DE7(U), :00406DF1(U)
|
:00406DF5 8BE5                    mov esp, ebp
:00406DF7 5D                      pop ebp
:00406DF8 C20400                  ret 0004



:00406DFB AB6D4000                DWORD 00406DAB
:00406DFF B56D4000                DWORD 00406DB5
:00406E03 C16D4000                DWORD 00406DC1
:00406E07 CB6D4000                DWORD 00406DCB
:00406E0B D76D4000                DWORD 00406DD7
:00406E0F E16D4000                DWORD 00406DE1
:00406E13 E96D4000                DWORD 00406DE9



* Referenced by a CALL at Addresses:
|:004074A2   , :00412176   , :0041D66F   , :0041D68C   , :004429DC   
|
:00406E17 55                      push ebp
:00406E18 8BEC                    mov ebp, esp
:00406E1A 83EC08                  sub esp, 00000008
:00406E1D 894DFC                  mov dword ptr [ebp-04], ecx
:00406E20 8B4508                  mov eax, dword ptr [ebp+08]
:00406E23 25FF000000              and eax, 000000FF
:00406E28 8945F8                  mov dword ptr [ebp-08], eax
:00406E2B 837DF806                cmp dword ptr [ebp-08], 00000006
:00406E2F 0F87FD000000            ja 00406F32
:00406E35 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00406E38 FF248D386F4000          jmp dword ptr [4*ecx+00406F38]
:00406E3F 68FF000000              push 000000FF
:00406E44 8B550C                  mov edx, dword ptr [ebp+0C]
:00406E47 52                      push edx
:00406E48 8B45FC                  mov eax, dword ptr [ebp-04]
:00406E4B 33C9                    xor ecx, ecx
:00406E4D 8A4815                  mov cl, byte ptr [eax+15]
:00406E50 51                      push ecx
:00406E51 E8338C0700              call 0047FA89
:00406E56 83C40C                  add esp, 0000000C
:00406E59 8B55FC                  mov edx, dword ptr [ebp-04]
:00406E5C 884215                  mov byte ptr [edx+15], al
:00406E5F E9CE000000              jmp 00406F32
:00406E64 68FF000000              push 000000FF
:00406E69 8B450C                  mov eax, dword ptr [ebp+0C]
:00406E6C 50                      push eax
:00406E6D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00406E70 33D2                    xor edx, edx
:00406E72 8A5116                  mov dl, byte ptr [ecx+16]
:00406E75 52                      push edx
:00406E76 E80E8C0700              call 0047FA89
:00406E7B 83C40C                  add esp, 0000000C
:00406E7E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00406E81 884116                  mov byte ptr [ecx+16], al
:00406E84 E9A9000000              jmp 00406F32
:00406E89 68FF000000              push 000000FF
:00406E8E 8B550C                  mov edx, dword ptr [ebp+0C]
:00406E91 52                      push edx
:00406E92 8B45FC                  mov eax, dword ptr [ebp-04]
:00406E95 33C9                    xor ecx, ecx
:00406E97 8A4817                  mov cl, byte ptr [eax+17]
:00406E9A 51                      push ecx
:00406E9B E8E98B0700              call 0047FA89
:00406EA0 83C40C                  add esp, 0000000C
:00406EA3 8B55FC                  mov edx, dword ptr [ebp-04]
:00406EA6 884217                  mov byte ptr [edx+17], al
:00406EA9 E984000000              jmp 00406F32
:00406EAE 68FF000000              push 000000FF
:00406EB3 8B450C                  mov eax, dword ptr [ebp+0C]
:00406EB6 50                      push eax
:00406EB7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00406EBA 33D2                    xor edx, edx
:00406EBC 8A5118                  mov dl, byte ptr [ecx+18]
:00406EBF 52                      push edx
:00406EC0 E8C48B0700              call 0047FA89
:00406EC5 83C40C                  add esp, 0000000C
:00406EC8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00406ECB 884118                  mov byte ptr [ecx+18], al
:00406ECE EB62                    jmp 00406F32
:00406ED0 68FF000000              push 000000FF
:00406ED5 8B550C                  mov edx, dword ptr [ebp+0C]
:00406ED8 52                      push edx
:00406ED9 8B45FC                  mov eax, dword ptr [ebp-04]
:00406EDC 33C9                    xor ecx, ecx
:00406EDE 8A4819                  mov cl, byte ptr [eax+19]
:00406EE1 51                      push ecx
:00406EE2 E8A28B0700              call 0047FA89
:00406EE7 83C40C                  add esp, 0000000C
:00406EEA 8B55FC                  mov edx, dword ptr [ebp-04]
:00406EED 884219                  mov byte ptr [edx+19], al
:00406EF0 EB40                    jmp 00406F32
:00406EF2 68FFFF0000              push 0000FFFF
:00406EF7 8B450C                  mov eax, dword ptr [ebp+0C]
:00406EFA 50                      push eax
:00406EFB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00406EFE 8B511C                  mov edx, dword ptr [ecx+1C]
:00406F01 52                      push edx
:00406F02 E8828B0700              call 0047FA89
:00406F07 83C40C                  add esp, 0000000C
:00406F0A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00406F0D 89411C                  mov dword ptr [ecx+1C], eax
:00406F10 EB20                    jmp 00406F32
:00406F12 68FF000000              push 000000FF
:00406F17 8B550C                  mov edx, dword ptr [ebp+0C]
:00406F1A 52                      push edx
:00406F1B 8B45FC                  mov eax, dword ptr [ebp-04]
:00406F1E 33C9                    xor ecx, ecx
:00406F20 8A4820                  mov cl, byte ptr [eax+20]
:00406F23 51                      push ecx
:00406F24 E8608B0700              call 0047FA89
:00406F29 83C40C                  add esp, 0000000C
:00406F2C 8B55FC                  mov edx, dword ptr [ebp-04]
:00406F2F 884220                  mov byte ptr [edx+20], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00406E2F(C), :00406E5F(U), :00406E84(U), :00406EA9(U), :00406ECE(U)
|:00406EF0(U), :00406F10(U)
|
:00406F32 8BE5                    mov esp, ebp
:00406F34 5D                      pop ebp
:00406F35 C20800                  ret 0008



:00406F38 3F6E4000                DWORD 00406E3F
:00406F3C 646E4000                DWORD 00406E64
:00406F40 896E4000                DWORD 00406E89
:00406F44 AE6E4000                DWORD 00406EAE
:00406F48 D06E4000                DWORD 00406ED0
:00406F4C F26E4000                DWORD 00406EF2
:00406F50 126F4000                DWORD 00406F12



* Referenced by a CALL at Addresses:
|:00412155   , :004121C8   
|
:00406F54 55                      push ebp
:00406F55 8BEC                    mov ebp, esp
:00406F57 83EC24                  sub esp, 00000024
:00406F5A 894DFC                  mov dword ptr [ebp-04], ecx
:00406F5D 8B4508                  mov eax, dword ptr [ebp+08]
:00406F60 25FF000000              and eax, 000000FF
:00406F65 8945F8                  mov dword ptr [ebp-08], eax
:00406F68 837DF806                cmp dword ptr [ebp-08], 00000006
:00406F6C 0F8706010000            ja 00407078
:00406F72 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00406F75 FF248D7E704000          jmp dword ptr [4*ecx+0040707E]
:00406F7C 817D0CFF000000          cmp dword ptr [ebp+0C], 000000FF
:00406F83 7308                    jnb 00406F8D
:00406F85 8B550C                  mov edx, dword ptr [ebp+0C]
:00406F88 8955F4                  mov dword ptr [ebp-0C], edx
:00406F8B EB07                    jmp 00406F94

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406F83(C)
|
:00406F8D C745F4FF000000          mov [ebp-0C], 000000FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406F8B(U)
|
:00406F94 8B45FC                  mov eax, dword ptr [ebp-04]
:00406F97 8A4DF4                  mov cl, byte ptr [ebp-0C]
:00406F9A 884815                  mov byte ptr [eax+15], cl
:00406F9D E9D6000000              jmp 00407078
:00406FA2 817D0CFF000000          cmp dword ptr [ebp+0C], 000000FF
:00406FA9 7308                    jnb 00406FB3
:00406FAB 8B550C                  mov edx, dword ptr [ebp+0C]
:00406FAE 8955F0                  mov dword ptr [ebp-10], edx
:00406FB1 EB07                    jmp 00406FBA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406FA9(C)
|
:00406FB3 C745F0FF000000          mov [ebp-10], 000000FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406FB1(U)
|
:00406FBA 8B45FC                  mov eax, dword ptr [ebp-04]
:00406FBD 8A4DF0                  mov cl, byte ptr [ebp-10]
:00406FC0 884816                  mov byte ptr [eax+16], cl
:00406FC3 E9B0000000              jmp 00407078
:00406FC8 817D0CFF000000          cmp dword ptr [ebp+0C], 000000FF
:00406FCF 7308                    jnb 00406FD9
:00406FD1 8B550C                  mov edx, dword ptr [ebp+0C]
:00406FD4 8955EC                  mov dword ptr [ebp-14], edx
:00406FD7 EB07                    jmp 00406FE0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406FCF(C)
|
:00406FD9 C745ECFF000000          mov [ebp-14], 000000FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406FD7(U)
|
:00406FE0 8B45FC                  mov eax, dword ptr [ebp-04]
:00406FE3 8A4DEC                  mov cl, byte ptr [ebp-14]
:00406FE6 884817                  mov byte ptr [eax+17], cl
:00406FE9 E98A000000              jmp 00407078
:00406FEE 817D0CFF000000          cmp dword ptr [ebp+0C], 000000FF
:00406FF5 7308                    jnb 00406FFF
:00406FF7 8B550C                  mov edx, dword ptr [ebp+0C]
:00406FFA 8955E8                  mov dword ptr [ebp-18], edx
:00406FFD EB07                    jmp 00407006

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406FF5(C)
|
:00406FFF C745E8FF000000          mov [ebp-18], 000000FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406FFD(U)
|
:00407006 8B45FC                  mov eax, dword ptr [ebp-04]
:00407009 8A4DE8                  mov cl, byte ptr [ebp-18]
:0040700C 884818                  mov byte ptr [eax+18], cl
:0040700F EB67                    jmp 00407078
:00407011 817D0CFF000000          cmp dword ptr [ebp+0C], 000000FF
:00407018 7308                    jnb 00407022
:0040701A 8B550C                  mov edx, dword ptr [ebp+0C]
:0040701D 8955E4                  mov dword ptr [ebp-1C], edx
:00407020 EB07                    jmp 00407029

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407018(C)
|
:00407022 C745E4FF000000          mov [ebp-1C], 000000FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407020(U)
|
:00407029 8B45FC                  mov eax, dword ptr [ebp-04]
:0040702C 8A4DE4                  mov cl, byte ptr [ebp-1C]
:0040702F 884819                  mov byte ptr [eax+19], cl
:00407032 EB44                    jmp 00407078
:00407034 817D0CF4010000          cmp dword ptr [ebp+0C], 000001F4
:0040703B 7308                    jnb 00407045
:0040703D 8B550C                  mov edx, dword ptr [ebp+0C]
:00407040 8955E0                  mov dword ptr [ebp-20], edx
:00407043 EB07                    jmp 0040704C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040703B(C)
|
:00407045 C745E0F4010000          mov [ebp-20], 000001F4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407043(U)
|
:0040704C 8B45FC                  mov eax, dword ptr [ebp-04]
:0040704F 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00407052 89481C                  mov dword ptr [eax+1C], ecx
:00407055 EB21                    jmp 00407078
:00407057 817D0CFA000000          cmp dword ptr [ebp+0C], 000000FA
:0040705E 7308                    jnb 00407068
:00407060 8B550C                  mov edx, dword ptr [ebp+0C]
:00407063 8955DC                  mov dword ptr [ebp-24], edx
:00407066 EB07                    jmp 0040706F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040705E(C)
|
:00407068 C745DCFA000000          mov [ebp-24], 000000FA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407066(U)
|
:0040706F 8B45FC                  mov eax, dword ptr [ebp-04]
:00407072 8A4DDC                  mov cl, byte ptr [ebp-24]
:00407075 884820                  mov byte ptr [eax+20], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00406F6C(C), :00406F9D(U), :00406FC3(U), :00406FE9(U), :0040700F(U)
|:00407032(U), :00407055(U)
|
:00407078 8BE5                    mov esp, ebp
:0040707A 5D                      pop ebp
:0040707B C20800                  ret 0008



:0040707E 7C6F4000                DWORD 00406F7C
:00407082 A26F4000                DWORD 00406FA2
:00407086 C86F4000                DWORD 00406FC8
:0040708A EE6F4000                DWORD 00406FEE
:0040708E 11704000                DWORD 00407011
:00407092 34704000                DWORD 00407034
:00407096 57704000                DWORD 00407057



* Referenced by a CALL at Addresses:
|:0041DE40   , :0041DE80   , :0041DEC0   , :0041DF00   , :0041DF40   
|
:0040709A 55                      push ebp
:0040709B 8BEC                    mov ebp, esp
:0040709D 83EC0C                  sub esp, 0000000C
:004070A0 894DF8                  mov dword ptr [ebp-08], ecx
:004070A3 C645FC00                mov [ebp-04], 00
:004070A7 8B4508                  mov eax, dword ptr [ebp+08]
:004070AA 25FF000000              and eax, 000000FF
:004070AF 8945F4                  mov dword ptr [ebp-0C], eax
:004070B2 837DF404                cmp dword ptr [ebp-0C], 00000004
:004070B6 773F                    ja 004070F7
:004070B8 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004070BB FF248D12714000          jmp dword ptr [4*ecx+00407112]
:004070C2 8B55F8                  mov edx, dword ptr [ebp-08]
:004070C5 8A4221                  mov al, byte ptr [edx+21]
:004070C8 8845FC                  mov byte ptr [ebp-04], al
:004070CB EB2A                    jmp 004070F7
:004070CD 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004070D0 8A5122                  mov dl, byte ptr [ecx+22]
:004070D3 8855FC                  mov byte ptr [ebp-04], dl
:004070D6 EB1F                    jmp 004070F7
:004070D8 8B45F8                  mov eax, dword ptr [ebp-08]
:004070DB 8A4823                  mov cl, byte ptr [eax+23]
:004070DE 884DFC                  mov byte ptr [ebp-04], cl
:004070E1 EB14                    jmp 004070F7
:004070E3 8B55F8                  mov edx, dword ptr [ebp-08]
:004070E6 8A4224                  mov al, byte ptr [edx+24]
:004070E9 8845FC                  mov byte ptr [ebp-04], al
:004070EC EB09                    jmp 004070F7
:004070EE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004070F1 8A5125                  mov dl, byte ptr [ecx+25]
:004070F4 8855FC                  mov byte ptr [ebp-04], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004070B6(C), :004070CB(U), :004070D6(U), :004070E1(U), :004070EC(U)
|
:004070F7 837D0C00                cmp dword ptr [ebp+0C], 00000000
:004070FB 740C                    je 00407109
:004070FD 8B45FC                  mov eax, dword ptr [ebp-04]
:00407100 25FF000000              and eax, 000000FF
:00407105 D1E0                    shl eax, 1
:00407107 EB03                    jmp 0040710C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004070FB(C)
|
:00407109 8A45FC                  mov al, byte ptr [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407107(U)
|
:0040710C 8BE5                    mov esp, ebp
:0040710E 5D                      pop ebp
:0040710F C20800                  ret 0008



:00407112 C2704000                DWORD 004070C2
:00407116 CD704000                DWORD 004070CD
:0040711A D8704000                DWORD 004070D8
:0040711E E3704000                DWORD 004070E3
:00407122 EE704000                DWORD 004070EE



* Referenced by a CALL at Addresses:
|:0043F51C   , :0045C987   , :0045C9AC   , :0045DDFC   , :0045DE06   
|:00469186   , :00476BF6   , :0047A1AB   , :0047A1B5   , :0047AA19   
|
:00407126 55                      push ebp
:00407127 8BEC                    mov ebp, esp
:00407129 51                      push ecx
:0040712A 894DFC                  mov dword ptr [ebp-04], ecx
:0040712D 6800020000              push 00000200
:00407132 6A00                    push 00000000
:00407134 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00407137 E8D20A0000              call 00407C0E
:0040713C 25FF000000              and eax, 000000FF
:00407141 50                      push eax
:00407142 8B45FC                  mov eax, dword ptr [ebp-04]
:00407145 33C9                    xor ecx, ecx
:00407147 8A4815                  mov cl, byte ptr [eax+15]
:0040714A 51                      push ecx
:0040714B E839890700              call 0047FA89
:00407150 83C40C                  add esp, 0000000C
:00407153 8BE5                    mov esp, ebp
:00407155 5D                      pop ebp
:00407156 C3                      ret



* Referenced by a CALL at Addresses:
|:0043F5B3   , :0045CA03   , :0045CA28   , :0045DE84   , :0045DE8E   
|:004691D0   , :00476C0C   , :0047A220   , :0047A22A   , :0047AB87   
|
:00407157 55                      push ebp
:00407158 8BEC                    mov ebp, esp
:0040715A 51                      push ecx
:0040715B 894DFC                  mov dword ptr [ebp-04], ecx
:0040715E 6800020000              push 00000200
:00407163 6A01                    push 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407123(C)
|
:00407165 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00407168 E8A10A0000              call 00407C0E
:0040716D 25FF000000              and eax, 000000FF
:00407172 50                      push eax
:00407173 8B45FC                  mov eax, dword ptr [ebp-04]
:00407176 33C9                    xor ecx, ecx
:00407178 8A4816                  mov cl, byte ptr [eax+16]
:0040717B 51                      push ecx
:0040717C E808890700              call 0047FA89
:00407181 83C40C                  add esp, 0000000C
:00407184 8BE5                    mov esp, ebp
:00407186 5D                      pop ebp
:00407187 C3                      ret



* Referenced by a CALL at Addresses:
|:0043F601   , :0045C9C5   , :0045C9EA   , :0045DE40   , :0045DE4A   
|:004691AB   , :00476C01   , :0047A293   , :0047A29D   , :0047AAD0   
|
:00407188 55                      push ebp
:00407189 8BEC                    mov ebp, esp
:0040718B 51                      push ecx
:0040718C 894DFC                  mov dword ptr [ebp-04], ecx
:0040718F 6800020000              push 00000200
:00407194 6A02                    push 00000002
:00407196 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00407199 E8700A0000              call 00407C0E
:0040719E 25FF000000              and eax, 000000FF
:004071A3 50                      push eax
:004071A4 8B45FC                  mov eax, dword ptr [ebp-04]
:004071A7 33C9                    xor ecx, ecx
:004071A9 8A4817                  mov cl, byte ptr [eax+17]
:004071AC 51                      push ecx
:004071AD E8D7880700              call 0047FA89
:004071B2 83C40C                  add esp, 0000000C
:004071B5 8BE5                    mov esp, ebp
:004071B7 5D                      pop ebp
:004071B8 C3                      ret



* Referenced by a CALL at Addresses:
|:0043F64F   , :0045CA41   , :0045CA66   , :004691F5   , :00476C17   
|:0047A306   , :0047A310   , :0047AC3E   
|
:004071B9 55                      push ebp
:004071BA 8BEC                    mov ebp, esp
:004071BC 51                      push ecx
:004071BD 894DFC                  mov dword ptr [ebp-04], ecx
:004071C0 6800020000              push 00000200
:004071C5 6A03                    push 00000003
:004071C7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004071CA E83F0A0000              call 00407C0E
:004071CF 25FF000000              and eax, 000000FF
:004071D4 50                      push eax
:004071D5 8B45FC                  mov eax, dword ptr [ebp-04]
:004071D8 33C9                    xor ecx, ecx
:004071DA 8A4818                  mov cl, byte ptr [eax+18]
:004071DD 51                      push ecx
:004071DE E8A6880700              call 0047FA89
:004071E3 83C40C                  add esp, 0000000C
:004071E6 8BE5                    mov esp, ebp
:004071E8 5D                      pop ebp
:004071E9 C3                      ret



* Referenced by a CALL at Addresses:
|:0043F69D   , :0045CA7F   , :0045CAA4   , :0046921A   , :00476C22   
|:0047A378   , :0047A382   , :0047ACF5   
|
:004071EA 55                      push ebp
:004071EB 8BEC                    mov ebp, esp
:004071ED 51                      push ecx
:004071EE 894DFC                  mov dword ptr [ebp-04], ecx
:004071F1 6800020000              push 00000200
:004071F6 6A04                    push 00000004
:004071F8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004071FB E80E0A0000              call 00407C0E
:00407200 25FF000000              and eax, 000000FF
:00407205 50                      push eax
:00407206 8B45FC                  mov eax, dword ptr [ebp-04]
:00407209 33C9                    xor ecx, ecx
:0040720B 8A4819                  mov cl, byte ptr [eax+19]
:0040720E 51                      push ecx
:0040720F E875880700              call 0047FA89
:00407214 83C40C                  add esp, 0000000C
:00407217 8BE5                    mov esp, ebp
:00407219 5D                      pop ebp
:0040721A C3                      ret



* Referenced by a CALL at Addresses:
|:00404461   , :004055A3   , :00414C51   , :00414CAD   , :004162EC   
|:0041D4AE   , :0041D69A   , :004205F1   , :00420757   , :00422FBD   
|:00422FF0   , :00434918   , :00434ABD   , :00434C8F   , :00438AF8   
|:00438B3B   , :00438EF0   , :00438F66   , :004396B5   , :0043985C   
|:00439886   , :00439972   , :0043A229   , :0043A26B   , :0043C499   
|:0043C4AC   , :0043C4BF   , :0043C654   , :0043C6D2   , :0043C6DE   
|:0043CE5A   , :0043CE8D   , :0043CEC6   , :0043CED2   , :0043F6E4   
|:00440171   , :004427B9   , :0044CEA3   , :0044D00D   , :0044DFEA   
|:004510B7   , :0045113F   , :004512BB   , :0045C882   , :0045C8A7   
|:0046913C   , :004794E0   , :00479506   , :0047A0C5   , :0047A0CF   
|:0047A88E   , :0047A8C2   , :0047A8CB   
|
:0040721B 55                      push ebp
:0040721C 8BEC                    mov ebp, esp
:0040721E 51                      push ecx
:0040721F 894DFC                  mov dword ptr [ebp-04], ecx
:00407222 68FFFF0000              push 0000FFFF
:00407227 6A05                    push 00000005
:00407229 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040722C E8DD090000              call 00407C0E
:00407231 25FF000000              and eax, 000000FF
:00407236 50                      push eax
:00407237 8B45FC                  mov eax, dword ptr [ebp-04]
:0040723A 8B481C                  mov ecx, dword ptr [eax+1C]
:0040723D 51                      push ecx
:0040723E E846880700              call 0047FA89
:00407243 83C40C                  add esp, 0000000C
:00407246 8BE5                    mov esp, ebp
:00407248 5D                      pop ebp
:00407249 C3                      ret



* Referenced by a CALL at Addresses:
|:00414CDC   , :0041D4C5   , :0041D6B7   , :00420619   , :004207AD   
|:0042301D   , :00423044   , :00423E3F   , :00423E76   , :0043492E   
|:00434AD3   , :00434CA5   , :00439D72   , :00439ED0   , :0043C4FD   
|:0043C510   , :0043C523   , :0043C6AA   , :0043C6B6   , :0043CF0C   
|:0043CF18   , :0043F725   , :004427D0   , :0044CECC   , :0044D036   
|:004510F0   , :0045114C   , :004512F7   , :0045C8C0   , :0045C8E5   
|:00465E76   , :00469161   , :004794EB   , :00479511   , :0047A138   
|:0047A142   , :0047A925   , :0047A959   , :0047A962   
|
:0040724A 55                      push ebp
:0040724B 8BEC                    mov ebp, esp
:0040724D 51                      push ecx
:0040724E 894DFC                  mov dword ptr [ebp-04], ecx
:00407251 68FF000000              push 000000FF

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:00407256 6A06                    push 00000006
:00407258 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040725B E8AE090000              call 00407C0E
:00407260 25FF000000              and eax, 000000FF
:00407265 50                      push eax
:00407266 8B45FC                  mov eax, dword ptr [ebp-04]
:00407269 33C9                    xor ecx, ecx
:0040726B 8A4820                  mov cl, byte ptr [eax+20]
:0040726E 51                      push ecx
:0040726F E815880700              call 0047FA89
:00407274 83C40C                  add esp, 0000000C
:00407277 8BE5                    mov esp, ebp
:00407279 5D                      pop ebp
:0040727A C3                      ret



* Referenced by a CALL at Addresses:
|:0043F766   , :0045CABD   , :0046923F   , :004769C9   , :00476A0B   
|:00476A44   
|
:0040727B 55                      push ebp
:0040727C 8BEC                    mov ebp, esp
:0040727E 83EC08                  sub esp, 00000008
:00407281 894DF8                  mov dword ptr [ebp-08], ecx
:00407284 8B45F8                  mov eax, dword ptr [ebp-08]
:00407287 33C9                    xor ecx, ecx
:00407289 8A482B                  mov cl, byte ptr [eax+2B]
:0040728C 6BC91B                  imul ecx, 0000001B
:0040728F 81C1A0BF4A00            add ecx, 004ABFA0
:00407295 E816460000              call 0040B8B0
:0040729A 8845FC                  mov byte ptr [ebp-04], al
:0040729D 68FF000000              push 000000FF

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:004072A2 6A07                    push 00000007
:004072A4 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004072A7 E862090000              call 00407C0E
:004072AC 50                      push eax
:004072AD 8A55FC                  mov dl, byte ptr [ebp-04]
:004072B0 52                      push edx
:004072B1 E8FF870700              call 0047FAB5
:004072B6 83C40C                  add esp, 0000000C
:004072B9 8BE5                    mov esp, ebp
:004072BB 5D                      pop ebp
:004072BC C3                      ret



* Referenced by a CALL at Addresses:
|:00403957   , :00403A60   , :00403B6A   , :00421265   , :00421380   
|:0042149A   , :0043CF59   , :0043CF98   , :0043CFD7   
|
:004072BD 55                      push ebp
:004072BE 8BEC                    mov ebp, esp
:004072C0 83EC08                  sub esp, 00000008
:004072C3 894DFC                  mov dword ptr [ebp-04], ecx
:004072C6 6A08                    push 00000008
:004072C8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004072CB E83E090000              call 00407C0E
:004072D0 25FF000000              and eax, 000000FF
:004072D5 83F80A                  cmp eax, 0000000A
:004072D8 7D09                    jge 004072E3
:004072DA C745F80A000000          mov [ebp-08], 0000000A
:004072E1 EB12                    jmp 004072F5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004072D8(C)
|
:004072E3 6A08                    push 00000008
:004072E5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004072E8 E821090000              call 00407C0E
:004072ED 25FF000000              and eax, 000000FF
:004072F2 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004072E1(U)
|
:004072F5 8A45F8                  mov al, byte ptr [ebp-08]
:004072F8 8BE5                    mov esp, ebp
:004072FA 5D                      pop ebp
:004072FB C3                      ret



* Referenced by a CALL at Addresses:
|:0040745D   , :00408A82   , :00408AFE   , :00408B62   , :00408BB7   
|
:004072FC 55                      push ebp
:004072FD 8BEC                    mov ebp, esp
:004072FF 83EC0C                  sub esp, 0000000C
:00407302 894DF8                  mov dword ptr [ebp-08], ecx
:00407305 C645FC00                mov [ebp-04], 00
:00407309 837D0804                cmp dword ptr [ebp+08], 00000004
:0040730D 7607                    jbe 00407316
:0040730F 32C0                    xor al, al
:00407311 E988000000              jmp 0040739E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040730D(C)
|
:00407316 8B4508                  mov eax, dword ptr [ebp+08]
:00407319 8945F4                  mov dword ptr [ebp-0C], eax
:0040731C 837DF404                cmp dword ptr [ebp-0C], 00000004
:00407320 7741                    ja 00407363
:00407322 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00407325 FF248DA4734000          jmp dword ptr [4*ecx+004073A4]
:0040732C 8B55F8                  mov edx, dword ptr [ebp-08]
:0040732F 8A4221                  mov al, byte ptr [edx+21]
:00407332 8845FC                  mov byte ptr [ebp-04], al
:00407335 EB30                    jmp 00407367
:00407337 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040733A 8A5122                  mov dl, byte ptr [ecx+22]
:0040733D 8855FC                  mov byte ptr [ebp-04], dl
:00407340 EB25                    jmp 00407367
:00407342 8B45F8                  mov eax, dword ptr [ebp-08]
:00407345 8A4823                  mov cl, byte ptr [eax+23]
:00407348 884DFC                  mov byte ptr [ebp-04], cl
:0040734B EB1A                    jmp 00407367
:0040734D 8B55F8                  mov edx, dword ptr [ebp-08]
:00407350 8A4224                  mov al, byte ptr [edx+24]
:00407353 8845FC                  mov byte ptr [ebp-04], al
:00407356 EB0F                    jmp 00407367
:00407358 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040735B 8A5125                  mov dl, byte ptr [ecx+25]
:0040735E 8855FC                  mov byte ptr [ebp-04], dl
:00407361 EB04                    jmp 00407367

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407320(C)
|
:00407363 32C0                    xor al, al
:00407365 EB37                    jmp 0040739E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00407335(U), :00407340(U), :0040734B(U), :00407356(U), :00407361(U)
|
:00407367 8B45FC                  mov eax, dword ptr [ebp-04]
:0040736A 25FF000000              and eax, 000000FF
:0040736F 83F82D                  cmp eax, 0000002D
:00407372 7C04                    jl 00407378
:00407374 B004                    mov al, 04
:00407376 EB26                    jmp 0040739E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407372(C)
|
:00407378 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040737B 81E1FF000000            and ecx, 000000FF
:00407381 83F923                  cmp ecx, 00000023
:00407384 7C04                    jl 0040738A
:00407386 B003                    mov al, 03
:00407388 EB14                    jmp 0040739E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407384(C)
|
:0040738A 8B55FC                  mov edx, dword ptr [ebp-04]
:0040738D 81E2FF000000            and edx, 000000FF
:00407393 83FA19                  cmp edx, 00000019
:00407396 7C04                    jl 0040739C
:00407398 B002                    mov al, 02
:0040739A EB02                    jmp 0040739E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407396(C)
|
:0040739C B001                    mov al, 01

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00407311(U), :00407365(U), :00407376(U), :00407388(U), :0040739A(U)
|
:0040739E 8BE5                    mov esp, ebp
:004073A0 5D                      pop ebp
:004073A1 C20400                  ret 0004



:004073A4 2C734000                DWORD 0040732C
:004073A8 37734000                DWORD 00407337
:004073AC 42734000                DWORD 00407342
:004073B0 4D734000                DWORD 0040734D
:004073B4 58734000                DWORD 00407358



* Referenced by a CALL at Addresses:
|:00408993   , :0040C4DA   , :00414C78   , :0043490E   , :00434AB3   
|:00434C85   
|
:004073B8 55                      push ebp
:004073B9 8BEC                    mov ebp, esp
:004073BB 83EC18                  sub esp, 00000018
:004073BE 894DE8                  mov dword ptr [ebp-18], ecx
:004073C1 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004073C4 E837210000              call 00409500
:004073C9 8945F4                  mov dword ptr [ebp-0C], eax
:004073CC 8B4508                  mov eax, dword ptr [ebp+08]
:004073CF 25FF000000              and eax, 000000FF
:004073D4 B9FF000000              mov ecx, 000000FF
:004073D9 2BC8                    sub ecx, eax
:004073DB 8B55E8                  mov edx, dword ptr [ebp-18]
:004073DE 33C0                    xor eax, eax
:004073E0 8A422C                  mov al, byte ptr [edx+2C]
:004073E3 3BC8                    cmp ecx, eax
:004073E5 7312                    jnb 004073F9
:004073E7 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004073EA 33D2                    xor edx, edx
:004073EC 8A512C                  mov dl, byte ptr [ecx+2C]
:004073EF B8FF000000              mov eax, 000000FF
:004073F4 2BC2                    sub eax, edx
:004073F6 884508                  mov byte ptr [ebp+08], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004073E5(C)
|
:004073F9 C645F000                mov [ebp-10], 00
:004073FD EB09                    jmp 00407408

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004074A9(U)
|
:004073FF 8A4DF0                  mov cl, byte ptr [ebp-10]
:00407402 80C101                  add cl, 01
:00407405 884DF0                  mov byte ptr [ebp-10], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004073FD(U)
|
:00407408 8B55F0                  mov edx, dword ptr [ebp-10]
:0040740B 81E2FF000000            and edx, 000000FF
:00407411 83FA07                  cmp edx, 00000007
:00407414 0F8D94000000            jnl 004074AE
:0040741A 8B45F0                  mov eax, dword ptr [ebp-10]
:0040741D 25FF000000              and eax, 000000FF
:00407422 50                      push eax
:00407423 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00407426 33D2                    xor edx, edx
:00407428 8A512B                  mov dl, byte ptr [ecx+2B]
:0040742B 8BCA                    mov ecx, edx
:0040742D 6BC91B                  imul ecx, 0000001B
:00407430 81C1A0BF4A00            add ecx, 004ABFA0
:00407436 E865210000              call 004095A0
:0040743B 25FF000000              and eax, 000000FF
:00407440 8945FC                  mov dword ptr [ebp-04], eax
:00407443 8B45F0                  mov eax, dword ptr [ebp-10]
:00407446 25FF000000              and eax, 000000FF
:0040744B 83F804                  cmp eax, 00000004
:0040744E 7F21                    jg 00407471
:00407450 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00407453 81E1FF000000            and ecx, 000000FF
:00407459 51                      push ecx
:0040745A 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0040745D E89AFEFFFF              call 004072FC
:00407462 25FF000000              and eax, 000000FF
:00407467 8B55FC                  mov edx, dword ptr [ebp-04]
:0040746A 03D0                    add edx, eax
:0040746C D1EA                    shr edx, 1
:0040746E 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040744E(C)
|
:00407471 837DFC00                cmp dword ptr [ebp-04], 00000000
:00407475 7432                    je 004074A9
:00407477 C745EC00000000          mov [ebp-14], 00000000
:0040747E EB09                    jmp 00407489

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004074A7(U)
|
:00407480 8B45EC                  mov eax, dword ptr [ebp-14]
:00407483 83C001                  add eax, 00000001
:00407486 8945EC                  mov dword ptr [ebp-14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040747E(U)
|
:00407489 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040748C 81E1FF000000            and ecx, 000000FF
:00407492 394DEC                  cmp dword ptr [ebp-14], ecx
:00407495 7D12                    jge 004074A9
:00407497 8B55FC                  mov edx, dword ptr [ebp-04]
:0040749A 52                      push edx
:0040749B 8A45F0                  mov al, byte ptr [ebp-10]
:0040749E 50                      push eax
:0040749F 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004074A2 E870F9FFFF              call 00406E17
:004074A7 EBD7                    jmp 00407480

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00407475(C), :00407495(C)
|
:004074A9 E951FFFFFF              jmp 004073FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407414(C)
|
:004074AE 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004074B1 8A512C                  mov dl, byte ptr [ecx+2C]
:004074B4 025508                  add dl, byte ptr [ebp+08]
:004074B7 8B45E8                  mov eax, dword ptr [ebp-18]
:004074BA 88502C                  mov byte ptr [eax+2C], dl
:004074BD 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004074C0 33D2                    xor edx, edx
:004074C2 8A512C                  mov dl, byte ptr [ecx+2C]
:004074C5 83FAFF                  cmp edx, FFFFFFFF
:004074C8 7207                    jb 004074D1
:004074CA 8B45E8                  mov eax, dword ptr [ebp-18]
:004074CD C6402DFF                mov [eax+2D], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004074C8(C)
|
:004074D1 837D0C00                cmp dword ptr [ebp+0C], 00000000
:004074D5 0F84C0000000            je 0040759B
:004074DB E842440000              call 0040B922
:004074E0 85C0                    test eax, eax
:004074E2 7414                    je 004074F8
:004074E4 6A00                    push 00000000
:004074E6 6A00                    push 00000000
:004074E8 6A0B                    push 0000000B
:004074EA 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004074ED 51                      push ecx
:004074EE B9F05D4B00              mov ecx, 004B5DF0
:004074F3 E897020500              call 0045778F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004074E2(C)
|
:004074F8 6A01                    push 00000001
:004074FA 6A0B                    push 0000000B
:004074FC B9B0694B00              mov ecx, 004B69B0
:00407501 E874D10600              call 0047467A
:00407506 8B55E8                  mov edx, dword ptr [ebp-18]
:00407509 33C0                    xor eax, eax
:0040750B 8A422C                  mov al, byte ptr [edx+2C]
:0040750E 50                      push eax
:0040750F 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00407512 83C108                  add ecx, 00000008
:00407515 51                      push ecx

* Possible StringData Ref from Data Obj ->"%sΪ%u"
                                  |
:00407516 6850B14800              push 0048B150
:0040751B 6A02                    push 00000002
:0040751D E877810200              call 0042F699
:00407522 83C410                  add esp, 00000010
:00407525 C645F800                mov [ebp-08], 00
:00407529 EB09                    jmp 00407534

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407599(U)
|
:0040752B 8A55F8                  mov dl, byte ptr [ebp-08]
:0040752E 80C201                  add dl, 01
:00407531 8855F8                  mov byte ptr [ebp-08], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407529(U)
|
:00407534 8B45F8                  mov eax, dword ptr [ebp-08]
:00407537 25FF000000              and eax, 000000FF
:0040753C 83F844                  cmp eax, 00000044
:0040753F 7D5A                    jge 0040759B
:00407541 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00407544 33D2                    xor edx, edx
:00407546 8A512B                  mov dl, byte ptr [ecx+2B]
:00407549 52                      push edx
:0040754A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040754D 81E1FF000000            and ecx, 000000FF
:00407553 6BC946                  imul ecx, 00000046
:00407556 81C1C0F44A00            add ecx, 004AF4C0
:0040755C E81F200000              call 00409580
:00407561 25FF000000              and eax, 000000FF
:00407566 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00407569 33D2                    xor edx, edx
:0040756B 8A512C                  mov dl, byte ptr [ecx+2C]
:0040756E 3BC2                    cmp eax, edx
:00407570 7527                    jne 00407599
:00407572 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00407575 81E1FF000000            and ecx, 000000FF
:0040757B 6BC946                  imul ecx, 00000046
:0040757E 81C1C0F44A00            add ecx, 004AF4C0
:00407584 E887810500              call 0045F710
:00407589 50                      push eax

* Possible StringData Ref from Data Obj ->"ѧ˲ԡ%s"
                                  |
:0040758A 6860B14800              push 0048B160
:0040758F 6A02                    push 00000002
:00407591 E803810200              call 0042F699
:00407596 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407570(C)
|
:00407599 EB90                    jmp 0040752B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004074D5(C), :0040753F(C)
|
:0040759B 8B45E8                  mov eax, dword ptr [ebp-18]
:0040759E 8A402C                  mov al, byte ptr [eax+2C]
:004075A1 8BE5                    mov esp, ebp
:004075A3 5D                      pop ebp
:004075A4 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0042D1A9   , :0042D949   , :0042DEE3   , :00431E77   , :00432F38   
|:00443A44   , :0045C6ED   , :0046A053   , :0046D7B0   , :004788C0   
|
:004075A7 55                      push ebp
:004075A8 8BEC                    mov ebp, esp
:004075AA 83EC18                  sub esp, 00000018
:004075AD 894DF0                  mov dword ptr [ebp-10], ecx
:004075B0 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004075B3 E8481F0000              call 00409500
:004075B8 8945F8                  mov dword ptr [ebp-08], eax
:004075BB B970074B00              mov ecx, 004B0770
:004075C0 E87B1F0000              call 00409540
:004075C5 8845FC                  mov byte ptr [ebp-04], al
:004075C8 837DF800                cmp dword ptr [ebp-08], 00000000
:004075CC 0F85A3000000            jne 00407675
:004075D2 B970074B00              mov ecx, 004B0770
:004075D7 E8841F0000              call 00409560
:004075DC 25FF000000              and eax, 000000FF
:004075E1 83F802                  cmp eax, 00000002
:004075E4 7D45                    jge 0040762B
:004075E6 8B45FC                  mov eax, dword ptr [ebp-04]
:004075E9 25FF000000              and eax, 000000FF
:004075EE 240F                    and al, 0F
:004075F0 8945EC                  mov dword ptr [ebp-14], eax
:004075F3 837DEC01                cmp dword ptr [ebp-14], 00000001
:004075F7 740E                    je 00407607
:004075F9 837DEC02                cmp dword ptr [ebp-14], 00000002
:004075FD 7411                    je 00407610
:004075FF 837DEC03                cmp dword ptr [ebp-14], 00000003
:00407603 7414                    je 00407619
:00407605 EB1B                    jmp 00407622

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004075F7(C)
|
:00407607 C745F401000000          mov [ebp-0C], 00000001
:0040760E EB19                    jmp 00407629

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004075FD(C)
|
:00407610 C745F402000000          mov [ebp-0C], 00000002
:00407617 EB10                    jmp 00407629

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407603(C)
|
:00407619 C745F403000000          mov [ebp-0C], 00000003
:00407620 EB07                    jmp 00407629

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407605(U)
|
:00407622 C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040760E(U), :00407617(U), :00407620(U)
|
:00407629 EB45                    jmp 00407670

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004075E4(C)
|
:0040762B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040762E 81E1FF000000            and ecx, 000000FF
:00407634 80E10F                  and cl, 0F
:00407637 894DE8                  mov dword ptr [ebp-18], ecx
:0040763A 837DE801                cmp dword ptr [ebp-18], 00000001
:0040763E 740E                    je 0040764E
:00407640 837DE802                cmp dword ptr [ebp-18], 00000002
:00407644 7411                    je 00407657
:00407646 837DE803                cmp dword ptr [ebp-18], 00000003
:0040764A 7414                    je 00407660
:0040764C EB1B                    jmp 00407669

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040763E(C)
|
:0040764E C745F405000000          mov [ebp-0C], 00000005
:00407655 EB19                    jmp 00407670

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407644(C)
|

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:00407657 C745F406000000          mov [ebp-0C], 00000006
:0040765E EB10                    jmp 00407670

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040764A(C)
|

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:00407660 C745F407000000          mov [ebp-0C], 00000007
:00407667 EB07                    jmp 00407670

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040764C(U)
|
:00407669 C745F404000000          mov [ebp-0C], 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00407629(U), :00407655(U), :0040765E(U), :00407667(U)
|
:00407670 E9DB000000              jmp 00407750

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004075CC(C)
|
:00407675 837DF801                cmp dword ptr [ebp-08], 00000001
:00407679 7545                    jne 004076C0
:0040767B 8B55FC                  mov edx, dword ptr [ebp-04]
:0040767E 81E2FF000000            and edx, 000000FF
:00407684 80E20F                  and dl, 0F
:00407687 83FA04                  cmp edx, 00000004
:0040768A 7509                    jne 00407695
:0040768C C745F4E0000000          mov [ebp-0C], 000000E0
:00407693 EB26                    jmp 004076BB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040768A(C)
|
:00407695 8B45FC                  mov eax, dword ptr [ebp-04]
:00407698 25FF000000              and eax, 000000FF
:0040769D 2580000000              and eax, 00000080
:004076A2 85C0                    test eax, eax
:004076A4 7509                    jne 004076AF
:004076A6 C745F4DF000000          mov [ebp-0C], 000000DF
:004076AD EB0C                    jmp 004076BB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004076A4(C)
|
:004076AF 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004076B2 8B5104                  mov edx, dword ptr [ecx+04]
:004076B5 83C207                  add edx, 00000007
:004076B8 8955F4                  mov dword ptr [ebp-0C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00407693(U), :004076AD(U)
|
:004076BB E990000000              jmp 00407750

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407679(C)
|
:004076C0 837DF823                cmp dword ptr [ebp-08], 00000023
:004076C4 7526                    jne 004076EC
:004076C6 8B45FC                  mov eax, dword ptr [ebp-04]
:004076C9 25FF000000              and eax, 000000FF
:004076CE 83E010                  and eax, 00000010
:004076D1 85C0                    test eax, eax
:004076D3 7409                    je 004076DE
:004076D5 C745F4D6000000          mov [ebp-0C], 000000D6
:004076DC EB0C                    jmp 004076EA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004076D3(C)
|
:004076DE 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004076E1 8B5104                  mov edx, dword ptr [ecx+04]
:004076E4 83C207                  add edx, 00000007
:004076E7 8955F4                  mov dword ptr [ebp-0C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004076DC(U)
|
:004076EA EB64                    jmp 00407750

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004076C4(C)
|
:004076EC 837DF808                cmp dword ptr [ebp-08], 00000008
:004076F0 7526                    jne 00407718
:004076F2 8B45FC                  mov eax, dword ptr [ebp-04]
:004076F5 25FF000000              and eax, 000000FF
:004076FA 83E020                  and eax, 00000020
:004076FD 85C0                    test eax, eax
:004076FF 7409                    je 0040770A
:00407701 C745F4E2000000          mov [ebp-0C], 000000E2
:00407708 EB0C                    jmp 00407716

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004076FF(C)
|
:0040770A 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040770D 8B5104                  mov edx, dword ptr [ecx+04]
:00407710 83C207                  add edx, 00000007
:00407713 8955F4                  mov dword ptr [ebp-0C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407708(U)
|
:00407716 EB38                    jmp 00407750

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004076F0(C)
|
:00407718 837DF804                cmp dword ptr [ebp-08], 00000004
:0040771C 7526                    jne 00407744
:0040771E 8B45FC                  mov eax, dword ptr [ebp-04]
:00407721 25FF000000              and eax, 000000FF
:00407726 83E040                  and eax, 00000040
:00407729 85C0                    test eax, eax
:0040772B 7409                    je 00407736
:0040772D C745F4E3000000          mov [ebp-0C], 000000E3
:00407734 EB0C                    jmp 00407742

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040772B(C)
|
:00407736 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00407739 8B5104                  mov edx, dword ptr [ecx+04]
:0040773C 83C207                  add edx, 00000007
:0040773F 8955F4                  mov dword ptr [ebp-0C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407734(U)
|
:00407742 EB0C                    jmp 00407750

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040771C(C)
|
:00407744 8B45F0                  mov eax, dword ptr [ebp-10]
:00407747 8B4804                  mov ecx, dword ptr [eax+04]
:0040774A 83C107                  add ecx, 00000007
:0040774D 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00407670(U), :004076BB(U), :004076EA(U), :00407716(U), :00407742(U)
|
:00407750 8B45F4                  mov eax, dword ptr [ebp-0C]
:00407753 8BE5                    mov esp, ebp
:00407755 5D                      pop ebp
:00407756 C3                      ret



* Referenced by a CALL at Addresses:
|:0040677C   , :00408754   , :0040878C   , :0041DA69   , :00426969   
|:0042D228   , :0042D9C8   , :00431FDB   , :00432003   , :004430F5   
|:004437B0   , :00443859   , :00443888   , :004438BF   , :00443902   
|:00443945   , :0044398B   , :004439EC   , :0045C750   , :0045CBDB   
|:0045CC3E   , :0045D10D   , :0045D1BC   , :00467D68   , :0046A4D4   
|:0046D810   , :00478750   , :0047A7AA   
|
:00407757 55                      push ebp
:00407758 8BEC                    mov ebp, esp
:0040775A 83EC0C                  sub esp, 0000000C
:0040775D 894DF4                  mov dword ptr [ebp-0C], ecx
:00407760 C745FC00000000          mov [ebp-04], 00000000
:00407767 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040776A 83C008                  add eax, 00000008
:0040776D 8945F8                  mov dword ptr [ebp-08], eax
:00407770 EB09                    jmp 0040777B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004077BA(U)
|
:00407772 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00407775 83C101                  add ecx, 00000001
:00407778 894DF8                  mov dword ptr [ebp-08], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407770(U)
|
:0040777B 8B55F8                  mov edx, dword ptr [ebp-08]
:0040777E 0FBE02                  movsx eax, byte ptr [edx]
:00407781 85C0                    test eax, eax
:00407783 7437                    je 004077BC
:00407785 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00407788 0FBE11                  movsx edx, byte ptr [ecx]
:0040778B 83FA30                  cmp edx, 00000030
:0040778E 7C0B                    jl 0040779B
:00407790 8B45F8                  mov eax, dword ptr [ebp-08]
:00407793 0FBE08                  movsx ecx, byte ptr [eax]
:00407796 83F939                  cmp ecx, 00000039
:00407799 7E17                    jle 004077B2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040778E(C)
|
:0040779B 8B55F4                  mov edx, dword ptr [ebp-0C]
:0040779E 0355FC                  add edx, dword ptr [ebp-04]
:004077A1 8B45F8                  mov eax, dword ptr [ebp-08]
:004077A4 8A08                    mov cl, byte ptr [eax]
:004077A6 884A37                  mov byte ptr [edx+37], cl
:004077A9 8B55FC                  mov edx, dword ptr [ebp-04]
:004077AC 83C201                  add edx, 00000001
:004077AF 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407799(C)
|
:004077B2 837DFC0E                cmp dword ptr [ebp-04], 0000000E
:004077B6 7E02                    jle 004077BA
:004077B8 EB02                    jmp 004077BC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004077B6(C)
|
:004077BA EBB6                    jmp 00407772

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00407783(C), :004077B8(U)
|
:004077BC 8B45F4                  mov eax, dword ptr [ebp-0C]
:004077BF 0345FC                  add eax, dword ptr [ebp-04]
:004077C2 C6403700                mov [eax+37], 00
:004077C6 8B45F4                  mov eax, dword ptr [ebp-0C]
:004077C9 83C037                  add eax, 00000037
:004077CC 8BE5                    mov esp, ebp
:004077CE 5D                      pop ebp
:004077CF C3                      ret



* Referenced by a CALL at Addresses:
|:0040787E   , :004079AA   , :00439DE2   , :0043A259   , :0043B485   
|
:004077D0 55                      push ebp
:004077D1 8BEC                    mov ebp, esp
:004077D3 51                      push ecx
:004077D4 894DFC                  mov dword ptr [ebp-04], ecx
:004077D7 8B45FC                  mov eax, dword ptr [ebp-04]
:004077DA 33C9                    xor ecx, ecx
:004077DC 8A482B                  mov cl, byte ptr [eax+2B]
:004077DF 83F926                  cmp ecx, 00000026
:004077E2 7F12                    jg 004077F6
:004077E4 8B55FC                  mov edx, dword ptr [ebp-04]
:004077E7 33C0                    xor eax, eax
:004077E9 8A422B                  mov al, byte ptr [edx+2B]
:004077EC 99                      cdq
:004077ED B903000000              mov ecx, 00000003
:004077F2 F7F9                    idiv ecx
:004077F4 EB1E                    jmp 00407814

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004077E2(C)
|
:004077F6 8B55FC                  mov edx, dword ptr [ebp-04]
:004077F9 33C0                    xor eax, eax
:004077FB 8A422B                  mov al, byte ptr [edx+2B]
:004077FE 83F835                  cmp eax, 00000035
:00407801 7D0F                    jge 00407812
:00407803 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00407806 33D2                    xor edx, edx
:00407808 8A512B                  mov dl, byte ptr [ecx+2B]
:0040780B 8BC2                    mov eax, edx
:0040780D 83E81A                  sub eax, 0000001A
:00407810 EB02                    jmp 00407814

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407801(C)
|
:00407812 B01B                    mov al, 1B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004077F4(U), :00407810(U)
|
:00407814 8BE5                    mov esp, ebp
:00407816 5D                      pop ebp
:00407817 C3                      ret



* Referenced by a CALL at Addresses:
|:0040627E   , :00438C25   , :0043F92C   
|
:00407818 55                      push ebp
:00407819 8BEC                    mov ebp, esp
:0040781B 83EC0C                  sub esp, 0000000C
:0040781E 894DF8                  mov dword ptr [ebp-08], ecx
:00407821 C645FC00                mov [ebp-04], 00
:00407825 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00407828 E8E3EDFFFF              call 00406610
:0040782D 8845F4                  mov byte ptr [ebp-0C], al
:00407830 807DF410                cmp byte ptr [ebp-0C], 10
:00407834 721A                    jb 00407850
:00407836 807DF411                cmp byte ptr [ebp-0C], 11
:0040783A 7608                    jbe 00407844
:0040783C 807DF42B                cmp byte ptr [ebp-0C], 2B
:00407840 7408                    je 0040784A
:00407842 EB0C                    jmp 00407850

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040783A(C)
|
:00407844 C645FC01                mov [ebp-04], 01
:00407848 EB21                    jmp 0040786B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407840(C)
|
:0040784A C645FC04                mov [ebp-04], 04
:0040784E EB1B                    jmp 0040786B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00407834(C), :00407842(U)
|
:00407850 6A2B                    push 0000002B
:00407852 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00407855 E8AF010000              call 00407A09
:0040785A 85C0                    test eax, eax
:0040785C 740D                    je 0040786B
:0040785E 6A2B                    push 0000002B
:00407860 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00407863 E88A020000              call 00407AF2
:00407868 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00407848(U), :0040784E(U), :0040785C(C)
|
:0040786B 8A45FC                  mov al, byte ptr [ebp-04]
:0040786E 8BE5                    mov esp, ebp
:00407870 5D                      pop ebp
:00407871 C3                      ret



* Referenced by a CALL at Addresses:
|:0045DD5E   , :0045DD6E   , :00479FF7   , :0047A007   
|
:00407872 55                      push ebp
:00407873 8BEC                    mov ebp, esp
:00407875 83EC10                  sub esp, 00000010
:00407878 894DF0                  mov dword ptr [ebp-10], ecx
:0040787B 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040787E E84DFFFFFF              call 004077D0
:00407883 8845F4                  mov byte ptr [ebp-0C], al
:00407886 C645F800                mov [ebp-08], 00
:0040788A EB08                    jmp 00407894

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004078C1(U)
|
:0040788C 8A45F8                  mov al, byte ptr [ebp-08]
:0040788F 0401                    add al, 01
:00407891 8845F8                  mov byte ptr [ebp-08], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040788A(U)
|
:00407894 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00407897 81E1FF000000            and ecx, 000000FF
:0040789D 83F91B                  cmp ecx, 0000001B
:004078A0 7D21                    jge 004078C3
:004078A2 8B55F4                  mov edx, dword ptr [ebp-0C]
:004078A5 81E2FF000000            and edx, 000000FF
:004078AB 8B45F8                  mov eax, dword ptr [ebp-08]
:004078AE 25FF000000              and eax, 000000FF
:004078B3 33C9                    xor ecx, ecx
:004078B5 8A8808644800            mov cl, byte ptr [eax+00486408]
:004078BB 3BD1                    cmp edx, ecx
:004078BD 7502                    jne 004078C1
:004078BF EB02                    jmp 004078C3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004078BD(C)
|
:004078C1 EBC9                    jmp 0040788C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004078A0(C), :004078BF(U)
|
:004078C3 8B55F8                  mov edx, dword ptr [ebp-08]
:004078C6 81E2FF000000            and edx, 000000FF
:004078CC B81B000000              mov eax, 0000001B
:004078D1 2BC2                    sub eax, edx
:004078D3 6BC003                  imul eax, 00000003
:004078D6 8845FC                  mov byte ptr [ebp-04], al
:004078D9 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004078DC 33D2                    xor edx, edx
:004078DE 8A512B                  mov dl, byte ptr [ecx+2B]
:004078E1 83FA26                  cmp edx, 00000026
:004078E4 7F1A                    jg 00407900
:004078E6 8B45F0                  mov eax, dword ptr [ebp-10]
:004078E9 33C9                    xor ecx, ecx
:004078EB 8A482B                  mov cl, byte ptr [eax+2B]
:004078EE 8BC1                    mov eax, ecx
:004078F0 99                      cdq
:004078F1 B903000000              mov ecx, 00000003
:004078F6 F7F9                    idiv ecx
:004078F8 8A45FC                  mov al, byte ptr [ebp-04]
:004078FB 02C2                    add al, dl
:004078FD 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004078E4(C)
|
:00407900 8A45FC                  mov al, byte ptr [ebp-04]
:00407903 8BE5                    mov esp, ebp
:00407905 5D                      pop ebp
:00407906 C3                      ret



* Referenced by a CALL at Addresses:
|:00407E64   , :00414E23   , :0043ABA2   , :0046682D   , :004669A3   
|:00466BD6   , :00466E3E   , :0046876D   , :00468D93   , :00468F37   
|:0046BBC3   , :0046BCC3   
|
:00407907 55                      push ebp
:00407908 8BEC                    mov ebp, esp
:0040790A 83EC0C                  sub esp, 0000000C
:0040790D 56                      push esi
:0040790E 894DF4                  mov dword ptr [ebp-0C], ecx
:00407911 8B4508                  mov eax, dword ptr [ebp+08]
:00407914 25FF000000              and eax, 000000FF
:00407919 3DFF000000              cmp eax, 000000FF
:0040791E 750A                    jne 0040792A
:00407920 B801000000              mov eax, 00000001
:00407925 E9D8000000              jmp 00407A02

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040791E(C)
|
:0040792A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040792D 81E1FF000000            and ecx, 000000FF
:00407933 6BC919                  imul ecx, 00000019
:00407936 81C140114A00            add ecx, 004A1140
:0040793C E8A94D0000              call 0040C6EA
:00407941 25FF000000              and eax, 000000FF
:00407946 83F803                  cmp eax, 00000003
:00407949 7507                    jne 00407952
:0040794B 33C0                    xor eax, eax
:0040794D E9B0000000              jmp 00407A02

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407949(C)
|
:00407952 8B4D08                  mov ecx, dword ptr [ebp+08]
:00407955 81E1FF000000            and ecx, 000000FF
:0040795B 6BC919                  imul ecx, 00000019
:0040795E 81C140114A00            add ecx, 004A1140
:00407964 E8814D0000              call 0040C6EA
:00407969 25FF000000              and eax, 000000FF
:0040796E 83F802                  cmp eax, 00000002
:00407971 7550                    jne 004079C3
:00407973 8B4D08                  mov ecx, dword ptr [ebp+08]
:00407976 81E1FF000000            and ecx, 000000FF
:0040797C 6BC919                  imul ecx, 00000019
:0040797F 81C140114A00            add ecx, 004A1140
:00407985 E866640100              call 0041DDF0
:0040798A 8845F8                  mov byte ptr [ebp-08], al
:0040798D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00407990 81E1FF000000            and ecx, 000000FF
:00407996 81F9FF000000            cmp ecx, 000000FF
:0040799C 741A                    je 004079B8
:0040799E 8B75F8                  mov esi, dword ptr [ebp-08]
:004079A1 81E6FF000000            and esi, 000000FF
:004079A7 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004079AA E821FEFFFF              call 004077D0
:004079AF 25FF000000              and eax, 000000FF
:004079B4 3BF0                    cmp esi, eax
:004079B6 7507                    jne 004079BF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040799C(C)
|
:004079B8 B801000000              mov eax, 00000001
:004079BD EB43                    jmp 00407A02

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004079B6(C)
|
:004079BF 33C0                    xor eax, eax
:004079C1 EB3F                    jmp 00407A02

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407971(C)
|
:004079C3 8B4D08                  mov ecx, dword ptr [ebp+08]
:004079C6 81E1FF000000            and ecx, 000000FF
:004079CC 6BC919                  imul ecx, 00000019
:004079CF 81C140114A00            add ecx, 004A1140
:004079D5 E8661B0000              call 00409540
:004079DA 8845FC                  mov byte ptr [ebp-04], al
:004079DD 8B55FC                  mov edx, dword ptr [ebp-04]
:004079E0 81E2FF000000            and edx, 000000FF
:004079E6 52                      push edx
:004079E7 8B45F4                  mov eax, dword ptr [ebp-0C]
:004079EA 33C9                    xor ecx, ecx
:004079EC 8A482B                  mov cl, byte ptr [eax+2B]
:004079EF 6BC91B                  imul ecx, 0000001B
:004079F2 81C1A0BF4A00            add ecx, 004ABFA0
:004079F8 E8C31B0000              call 004095C0
:004079FD 25FF000000              and eax, 000000FF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00407925(U), :0040794D(U), :004079BD(U), :004079C1(U)
|
:00407A02 5E                      pop esi
:00407A03 8BE5                    mov esp, ebp
:00407A05 5D                      pop ebp
:00407A06 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0040591D   , :00405981   , :004059E5   , :00405A49   , :00405BDF   
|:00405DA3   , :00405F17   , :00405F87   , :00405FAB   , :004063EB   
|:0040646A   , :00407855   , :0041FF8C   , :004200A7   , :004201C1   
|:004202DC   , :00422CB0   , :00422F4E   , :00437D80   , :00439F7A   
|:0043AC73   , :0043B5C8   , :0043B6B1   , :0043B6E0   , :0043B70D   
|:0043B930   , :0043B95F   , :0043B98C   , :0043BDF4   , :0043BEB6   
|:0043C1F2   , :0043C25D   , :0043C29C   , :0043C75A   , :0043CE81   
|:0043CEE5   , :0043CF3B   , :0043CF7A   , :0043CFB9   , :0043DB82   
|:0043DECD   , :0043F828   , :0043F8D5   , :00465B41   , :0046648B   
|
:00407A09 55                      push ebp
:00407A0A 8BEC                    mov ebp, esp
:00407A0C 83EC0C                  sub esp, 0000000C
:00407A0F 894DF4                  mov dword ptr [ebp-0C], ecx
:00407A12 C645F800                mov [ebp-08], 00
:00407A16 EB08                    jmp 00407A20

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407A97(U)
|
:00407A18 8A45F8                  mov al, byte ptr [ebp-08]
:00407A1B 0401                    add al, 01
:00407A1D 8845F8                  mov byte ptr [ebp-08], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407A16(U)
|
:00407A20 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00407A23 81E1FF000000            and ecx, 000000FF
:00407A29 83F901                  cmp ecx, 00000001
:00407A2C 7F6E                    jg 00407A9C
:00407A2E 8A55F8                  mov dl, byte ptr [ebp-08]
:00407A31 52                      push edx
:00407A32 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00407A35 E8B6EBFFFF              call 004065F0
:00407A3A 8845FC                  mov byte ptr [ebp-04], al
:00407A3D 8B45FC                  mov eax, dword ptr [ebp-04]
:00407A40 25FF000000              and eax, 000000FF
:00407A45 3DFF000000              cmp eax, 000000FF
:00407A4A 744B                    je 00407A97
:00407A4C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00407A4F 81E1FF000000            and ecx, 000000FF
:00407A55 6BC919                  imul ecx, 00000019
:00407A58 81C140114A00            add ecx, 004A1140
:00407A5E E80B4D0000              call 0040C76E
:00407A63 85C0                    test eax, eax
:00407A65 7430                    je 00407A97
:00407A67 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00407A6A 81E1FF000000            and ecx, 000000FF
:00407A70 6BC919                  imul ecx, 00000019
:00407A73 81C140114A00            add ecx, 004A1140
:00407A79 E8A21A0000              call 00409520
:00407A7E 25FF000000              and eax, 000000FF
:00407A83 8B4D08                  mov ecx, dword ptr [ebp+08]
:00407A86 81E1FF000000            and ecx, 000000FF
:00407A8C 3BC1                    cmp eax, ecx
:00407A8E 7507                    jne 00407A97
:00407A90 B801000000              mov eax, 00000001
:00407A95 EB55                    jmp 00407AEC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00407A4A(C), :00407A65(C), :00407A8E(C)
|
:00407A97 E97CFFFFFF              jmp 00407A18

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407A2C(C)
|
:00407A9C 6A02                    push 00000002
:00407A9E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00407AA1 E84AEBFFFF              call 004065F0
:00407AA6 8845FC                  mov byte ptr [ebp-04], al
:00407AA9 8B55FC                  mov edx, dword ptr [ebp-04]
:00407AAC 81E2FF000000            and edx, 000000FF
:00407AB2 81FAFF000000            cmp edx, 000000FF
:00407AB8 7430                    je 00407AEA
:00407ABA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00407ABD 81E1FF000000            and ecx, 000000FF
:00407AC3 6BC919                  imul ecx, 00000019
:00407AC6 81C140114A00            add ecx, 004A1140
:00407ACC E86F1A0000              call 00409540
:00407AD1 25FF000000              and eax, 000000FF
:00407AD6 8B4D08                  mov ecx, dword ptr [ebp+08]
:00407AD9 81E1FF000000            and ecx, 000000FF
:00407ADF 3BC1                    cmp eax, ecx
:00407AE1 7507                    jne 00407AEA
:00407AE3 B801000000              mov eax, 00000001
:00407AE8 EB02                    jmp 00407AEC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00407AB8(C), :00407AE1(C)
|
:00407AEA 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00407A95(U), :00407AE8(U)
|
:00407AEC 8BE5                    mov esp, ebp
:00407AEE 5D                      pop ebp
:00407AEF C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00407863   , :0041FF9A   , :004200B5   , :004201CF   , :004202EA   
|:00422F5F   , :0043B6C1   , :0043B6EE   , :0043B71B   , :0043B940   
|:0043B96D   , :0043B99A   , :0043BE12   , :0043BECF   , :0043C20B   
|:0043C276   , :0043C2AA   , :0043CE99   , :0043CEF3   , :0043CF49   
|:0043CF88   , :0043CFC7   , :0043F8EE   , :004664AC   
|
:00407AF2 55                      push ebp
:00407AF3 8BEC                    mov ebp, esp
:00407AF5 83EC10                  sub esp, 00000010
:00407AF8 894DF0                  mov dword ptr [ebp-10], ecx
:00407AFB C645F800                mov [ebp-08], 00
:00407AFF C645FCFF                mov [ebp-04], FF
:00407B03 C645F400                mov [ebp-0C], 00
:00407B07 EB08                    jmp 00407B11

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407B9F(U)
|
:00407B09 8A45F4                  mov al, byte ptr [ebp-0C]
:00407B0C 0401                    add al, 01
:00407B0E 8845F4                  mov byte ptr [ebp-0C], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407B07(U)
|
:00407B11 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00407B14 81E1FF000000            and ecx, 000000FF
:00407B1A 83F901                  cmp ecx, 00000001
:00407B1D 0F8F81000000            jg 00407BA4
:00407B23 8A55F4                  mov dl, byte ptr [ebp-0C]
:00407B26 52                      push edx
:00407B27 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00407B2A E8C1EAFFFF              call 004065F0
:00407B2F 8845FC                  mov byte ptr [ebp-04], al
:00407B32 8B45FC                  mov eax, dword ptr [ebp-04]
:00407B35 25FF000000              and eax, 000000FF
:00407B3A 3DFF000000              cmp eax, 000000FF
:00407B3F 745E                    je 00407B9F
:00407B41 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00407B44 81E1FF000000            and ecx, 000000FF
:00407B4A 6BC919                  imul ecx, 00000019
:00407B4D 81C140114A00            add ecx, 004A1140
:00407B53 E8164C0000              call 0040C76E
:00407B58 85C0                    test eax, eax
:00407B5A 7443                    je 00407B9F
:00407B5C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00407B5F 81E1FF000000            and ecx, 000000FF
:00407B65 6BC919                  imul ecx, 00000019
:00407B68 81C140114A00            add ecx, 004A1140
:00407B6E E8AD190000              call 00409520
:00407B73 25FF000000              and eax, 000000FF
:00407B78 8B4D08                  mov ecx, dword ptr [ebp+08]
:00407B7B 81E1FF000000            and ecx, 000000FF
:00407B81 3BC1                    cmp eax, ecx
:00407B83 751A                    jne 00407B9F
:00407B85 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00407B88 81E1FF000000            and ecx, 000000FF
:00407B8E 6BC919                  imul ecx, 00000019
:00407B91 81C140114A00            add ecx, 004A1140
:00407B97 E814620100              call 0041DDB0
:00407B9C 8845F8                  mov byte ptr [ebp-08], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00407B3F(C), :00407B5A(C), :00407B83(C)
|
:00407B9F E965FFFFFF              jmp 00407B09

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407B1D(C)
|
:00407BA4 6A02                    push 00000002
:00407BA6 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00407BA9 E842EAFFFF              call 004065F0
:00407BAE 8845FC                  mov byte ptr [ebp-04], al
:00407BB1 8B55FC                  mov edx, dword ptr [ebp-04]
:00407BB4 81E2FF000000            and edx, 000000FF
:00407BBA 81FAFF000000            cmp edx, 000000FF
:00407BC0 7443                    je 00407C05
:00407BC2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00407BC5 81E1FF000000            and ecx, 000000FF
:00407BCB 6BC919                  imul ecx, 00000019
:00407BCE 81C140114A00            add ecx, 004A1140
:00407BD4 E867190000              call 00409540
:00407BD9 25FF000000              and eax, 000000FF
:00407BDE 8B4D08                  mov ecx, dword ptr [ebp+08]
:00407BE1 81E1FF000000            and ecx, 000000FF
:00407BE7 3BC1                    cmp eax, ecx
:00407BE9 751A                    jne 00407C05
:00407BEB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00407BEE 81E1FF000000            and ecx, 000000FF
:00407BF4 6BC919                  imul ecx, 00000019
:00407BF7 81C140114A00            add ecx, 004A1140
:00407BFD E86E610100              call 0041DD70
:00407C02 8845F8                  mov byte ptr [ebp-08], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00407BC0(C), :00407BE9(C)
|
:00407C05 8A45F8                  mov al, byte ptr [ebp-08]
:00407C08 8BE5                    mov esp, ebp
:00407C0A 5D                      pop ebp
:00407C0B C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00407137   , :00407168   , :00407199   , :004071CA   , :004071FB   
|:0040722C   , :0040725B   , :004072A7   , :004072CB   , :004072E8   
|
:00407C0E 55                      push ebp
:00407C0F 8BEC                    mov ebp, esp
:00407C11 83EC10                  sub esp, 00000010
:00407C14 894DF0                  mov dword ptr [ebp-10], ecx
:00407C17 C645F400                mov [ebp-0C], 00
:00407C1B C645F800                mov [ebp-08], 00
:00407C1F EB08                    jmp 00407C29

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407D0B(U)
|
:00407C21 8A45F8                  mov al, byte ptr [ebp-08]
:00407C24 0401                    add al, 01
:00407C26 8845F8                  mov byte ptr [ebp-08], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407C1F(U)
|
:00407C29 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00407C2C 81E1FF000000            and ecx, 000000FF
:00407C32 83F901                  cmp ecx, 00000001
:00407C35 0F8FD5000000            jg 00407D10
:00407C3B 8A55F8                  mov dl, byte ptr [ebp-08]
:00407C3E 52                      push edx
:00407C3F 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00407C42 E8A9E9FFFF              call 004065F0
:00407C47 8845FC                  mov byte ptr [ebp-04], al
:00407C4A 8B45FC                  mov eax, dword ptr [ebp-04]
:00407C4D 25FF000000              and eax, 000000FF
:00407C52 3DFF000000              cmp eax, 000000FF
:00407C57 0F84AE000000            je 00407D0B
:00407C5D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00407C60 81E1FF000000            and ecx, 000000FF
:00407C66 51                      push ecx
:00407C67 E8AEEBFFFF              call 0040681A
:00407C6C 83C404                  add esp, 00000004
:00407C6F 25FF000000              and eax, 000000FF
:00407C74 8B5508                  mov edx, dword ptr [ebp+08]
:00407C77 81E2FF000000            and edx, 000000FF
:00407C7D 3BC2                    cmp eax, edx
:00407C7F 752C                    jne 00407CAD
:00407C81 8A45F8                  mov al, byte ptr [ebp-08]
:00407C84 50                      push eax
:00407C85 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00407C88 E853190000              call 004095E0
:00407C8D 50                      push eax
:00407C8E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00407C91 81E1FF000000            and ecx, 000000FF
:00407C97 6BC919                  imul ecx, 00000019
:00407C9A 81C140114A00            add ecx, 004A1140
:00407CA0 E8CF490000              call 0040C674
:00407CA5 8A4DF4                  mov cl, byte ptr [ebp-0C]
:00407CA8 02C8                    add cl, al
:00407CAA 884DF4                  mov byte ptr [ebp-0C], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407C7F(C)
|
:00407CAD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00407CB0 81E1FF000000            and ecx, 000000FF
:00407CB6 6BC919                  imul ecx, 00000019
:00407CB9 81C140114A00            add ecx, 004A1140
:00407CBF E8AA4A0000              call 0040C76E
:00407CC4 85C0                    test eax, eax
:00407CC6 7443                    je 00407D0B
:00407CC8 8B55FC                  mov edx, dword ptr [ebp-04]
:00407CCB 81E2FF000000            and edx, 000000FF
:00407CD1 52                      push edx
:00407CD2 E8B7EAFFFF              call 0040678E
:00407CD7 83C404                  add esp, 00000004
:00407CDA 25FF000000              and eax, 000000FF
:00407CDF 8B4D08                  mov ecx, dword ptr [ebp+08]
:00407CE2 81E1FF000000            and ecx, 000000FF
:00407CE8 3BC1                    cmp eax, ecx
:00407CEA 751F                    jne 00407D0B
:00407CEC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00407CEF 81E1FF000000            and ecx, 000000FF
:00407CF5 6BC919                  imul ecx, 00000019
:00407CF8 81C140114A00            add ecx, 004A1140
:00407CFE E8AD600100              call 0041DDB0
:00407D03 8A55F4                  mov dl, byte ptr [ebp-0C]
:00407D06 02D0                    add dl, al
:00407D08 8855F4                  mov byte ptr [ebp-0C], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00407C57(C), :00407CC6(C), :00407CEA(C)
|
:00407D0B E911FFFFFF              jmp 00407C21

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407C35(C)
|
:00407D10 6A02                    push 00000002
:00407D12 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00407D15 E8D6E8FFFF              call 004065F0
:00407D1A 8845FC                  mov byte ptr [ebp-04], al
:00407D1D 8B45FC                  mov eax, dword ptr [ebp-04]
:00407D20 25FF000000              and eax, 000000FF
:00407D25 3DFF000000              cmp eax, 000000FF
:00407D2A 7443                    je 00407D6F
:00407D2C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00407D2F 81E1FF000000            and ecx, 000000FF
:00407D35 51                      push ecx
:00407D36 E8DFEAFFFF              call 0040681A
:00407D3B 83C404                  add esp, 00000004
:00407D3E 25FF000000              and eax, 000000FF
:00407D43 8B5508                  mov edx, dword ptr [ebp+08]
:00407D46 81E2FF000000            and edx, 000000FF
:00407D4C 3BC2                    cmp eax, edx
:00407D4E 751F                    jne 00407D6F
:00407D50 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00407D53 81E1FF000000            and ecx, 000000FF
:00407D59 6BC919                  imul ecx, 00000019
:00407D5C 81C140114A00            add ecx, 004A1140
:00407D62 E809600100              call 0041DD70
:00407D67 8A4DF4                  mov cl, byte ptr [ebp-0C]
:00407D6A 02C8                    add cl, al
:00407D6C 884DF4                  mov byte ptr [ebp-0C], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00407D2A(C), :00407D4E(C)
|
:00407D6F 8A45F4                  mov al, byte ptr [ebp-0C]
:00407D72 8BE5                    mov esp, ebp
:00407D74 5D                      pop ebp
:00407D75 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00407DE1   , :00407FA1   , :00468D6E   , :00468DEA   
|
:00407D78 55                      push ebp
:00407D79 8BEC                    mov ebp, esp
:00407D7B 51                      push ecx
:00407D7C 894DFC                  mov dword ptr [ebp-04], ecx
:00407D7F 8B4508                  mov eax, dword ptr [ebp+08]
:00407D82 25FF000000              and eax, 000000FF
:00407D87 6BC003                  imul eax, 00000003
:00407D8A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00407D8D 8A550C                  mov dl, byte ptr [ebp+0C]
:00407D90 8854012E                mov byte ptr [ecx+eax+2E], dl
:00407D94 8B4508                  mov eax, dword ptr [ebp+08]
:00407D97 25FF000000              and eax, 000000FF
:00407D9C 6BC003                  imul eax, 00000003
:00407D9F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00407DA2 8A5510                  mov dl, byte ptr [ebp+10]
:00407DA5 8854012F                mov byte ptr [ecx+eax+2F], dl
:00407DA9 8B4508                  mov eax, dword ptr [ebp+08]
:00407DAC 25FF000000              and eax, 000000FF
:00407DB1 6BC003                  imul eax, 00000003
:00407DB4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00407DB7 8A5514                  mov dl, byte ptr [ebp+14]
:00407DBA 88540130                mov byte ptr [ecx+eax+30], dl
:00407DBE 8BE5                    mov esp, ebp
:00407DC0 5D                      pop ebp
:00407DC1 C21000                  ret 0010



* Referenced by a CALL at Addresses:
|:0040C34F   , :00414E42   , :004164E3   , :0041653F   , :0041659B   
|:00442A7C   
|
:00407DC4 55                      push ebp
:00407DC5 8BEC                    mov ebp, esp
:00407DC7 51                      push ecx
:00407DC8 894DFC                  mov dword ptr [ebp-04], ecx
:00407DCB 68FF000000              push 000000FF
:00407DD0 68FF000000              push 000000FF
:00407DD5 68FF000000              push 000000FF
:00407DDA 8A4508                  mov al, byte ptr [ebp+08]
:00407DDD 50                      push eax
:00407DDE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00407DE1 E892FFFFFF              call 00407D78
:00407DE6 8BE5                    mov esp, ebp
:00407DE8 5D                      pop ebp
:00407DE9 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0041650C   , :00416568   , :004165C5   , :00442A9D   
|
:00407DEC 55                      push ebp
:00407DED 8BEC                    mov ebp, esp
:00407DEF 83EC18                  sub esp, 00000018
:00407DF2 894DF4                  mov dword ptr [ebp-0C], ecx
:00407DF5 8A4508                  mov al, byte ptr [ebp+08]
:00407DF8 8845F0                  mov byte ptr [ebp-10], al
:00407DFB 807DF000                cmp byte ptr [ebp-10], 00
:00407DFF 740E                    je 00407E0F
:00407E01 807DF001                cmp byte ptr [ebp-10], 01
:00407E05 7413                    je 00407E1A
:00407E07 807DF002                cmp byte ptr [ebp-10], 02
:00407E0B 7418                    je 00407E25
:00407E0D EB21                    jmp 00407E30

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407DFF(C)
|
:00407E0F 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00407E12 83E902                  sub ecx, 00000002
:00407E15 894D0C                  mov dword ptr [ebp+0C], ecx
:00407E18 EB1B                    jmp 00407E35

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407E05(C)
|
:00407E1A 8B550C                  mov edx, dword ptr [ebp+0C]
:00407E1D 83C224                  add edx, 00000024
:00407E20 89550C                  mov dword ptr [ebp+0C], edx
:00407E23 EB10                    jmp 00407E35

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407E0B(C)
|
:00407E25 8B450C                  mov eax, dword ptr [ebp+0C]
:00407E28 83C033                  add eax, 00000033
:00407E2B 89450C                  mov dword ptr [ebp+0C], eax
:00407E2E EB05                    jmp 00407E35

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407E0D(U)
|
:00407E30 E9AC010000              jmp 00407FE1

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00407E18(U), :00407E23(U), :00407E2E(U)
|
:00407E35 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00407E38 6BC919                  imul ecx, 00000019
:00407E3B 81C140114A00            add ecx, 004A1140
:00407E41 E8A4480000              call 0040C6EA
:00407E46 25FF000000              and eax, 000000FF
:00407E4B 8B4D08                  mov ecx, dword ptr [ebp+08]
:00407E4E 81E1FF000000            and ecx, 000000FF
:00407E54 3BC1                    cmp eax, ecx
:00407E56 7405                    je 00407E5D
:00407E58 E984010000              jmp 00407FE1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407E56(C)
|
:00407E5D 8A550C                  mov dl, byte ptr [ebp+0C]
:00407E60 52                      push edx
:00407E61 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00407E64 E89EFAFFFF              call 00407907
:00407E69 85C0                    test eax, eax
:00407E6B 7505                    jne 00407E72
:00407E6D E96F010000              jmp 00407FE1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407E6B(C)
|
:00407E72 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00407E75 6BC919                  imul ecx, 00000019
:00407E78 81C140114A00            add ecx, 004A1140
:00407E7E E8EB480000              call 0040C76E
:00407E83 F7D8                    neg eax
:00407E85 1BC0                    sbb eax, eax
:00407E87 83E006                  and eax, 00000006
:00407E8A 83C003                  add eax, 00000003
:00407E8D 8845F8                  mov byte ptr [ebp-08], al
:00407E90 8B4510                  mov eax, dword ptr [ebp+10]
:00407E93 25FF000000              and eax, 000000FF
:00407E98 85C0                    test eax, eax
:00407E9A 0F8587000000            jne 00407F27
:00407EA0 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00407EA3 6BC919                  imul ecx, 00000019
:00407EA6 81C140114A00            add ecx, 004A1140
:00407EAC E8BD480000              call 0040C76E
:00407EB1 85C0                    test eax, eax
:00407EB3 7441                    je 00407EF6
:00407EB5 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00407EB8 33C0                    xor eax, eax
:00407EBA 8A412C                  mov al, byte ptr [ecx+2C]
:00407EBD 99                      cdq
:00407EBE 83E203                  and edx, 00000003
:00407EC1 03C2                    add eax, edx
:00407EC3 C1F802                  sar eax, 02
:00407EC6 83C001                  add eax, 00000001
:00407EC9 83F809                  cmp eax, 00000009
:00407ECC 7609                    jbe 00407ED7
:00407ECE C745EC09000000          mov [ebp-14], 00000009
:00407ED5 EB17                    jmp 00407EEE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407ECC(C)
|
:00407ED7 8B55F4                  mov edx, dword ptr [ebp-0C]
:00407EDA 33C0                    xor eax, eax
:00407EDC 8A422C                  mov al, byte ptr [edx+2C]
:00407EDF 99                      cdq
:00407EE0 83E203                  and edx, 00000003
:00407EE3 03C2                    add eax, edx
:00407EE5 C1F802                  sar eax, 02
:00407EE8 83C001                  add eax, 00000001
:00407EEB 8945EC                  mov dword ptr [ebp-14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407ED5(U)
|
:00407EEE 8A45EC                  mov al, byte ptr [ebp-14]
:00407EF1 884510                  mov byte ptr [ebp+10], al
:00407EF4 EB2F                    jmp 00407F25

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407EB3(C)
|
:00407EF6 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00407EF9 33D2                    xor edx, edx
:00407EFB 8A512C                  mov dl, byte ptr [ecx+2C]
:00407EFE 83FA24                  cmp edx, 00000024
:00407F01 7206                    jb 00407F09
:00407F03 C6451003                mov [ebp+10], 03
:00407F07 EB1C                    jmp 00407F25

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407F01(C)
|
:00407F09 8B45F4                  mov eax, dword ptr [ebp-0C]
:00407F0C 33C9                    xor ecx, ecx
:00407F0E 8A482C                  mov cl, byte ptr [eax+2C]
:00407F11 8BC1                    mov eax, ecx
:00407F13 33D2                    xor edx, edx
:00407F15 B90C000000              mov ecx, 0000000C
:00407F1A F7F1                    div ecx
:00407F1C C1EA02                  shr edx, 02
:00407F1F 83C201                  add edx, 00000001
:00407F22 885510                  mov byte ptr [ebp+10], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00407EF4(U), :00407F07(U)
|
:00407F25 EB2C                    jmp 00407F53

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407E9A(C)
|
:00407F27 8B5510                  mov edx, dword ptr [ebp+10]
:00407F2A 81E2FF000000            and edx, 000000FF
:00407F30 81FAFF000000            cmp edx, 000000FF
:00407F36 741B                    je 00407F53
:00407F38 8B4510                  mov eax, dword ptr [ebp+10]
:00407F3B 25FF000000              and eax, 000000FF
:00407F40 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00407F43 81E1FF000000            and ecx, 000000FF
:00407F49 3BC1                    cmp eax, ecx
:00407F4B 7E06                    jle 00407F53
:00407F4D 8A55F8                  mov dl, byte ptr [ebp-08]
:00407F50 885510                  mov byte ptr [ebp+10], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00407F25(U), :00407F36(C), :00407F4B(C)
|
:00407F53 8B4510                  mov eax, dword ptr [ebp+10]
:00407F56 25FF000000              and eax, 000000FF
:00407F5B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00407F5E 81E1FF000000            and ecx, 000000FF
:00407F64 33D2                    xor edx, edx
:00407F66 3BC1                    cmp eax, ecx
:00407F68 0F9CC2                  setl dl
:00407F6B 4A                      dec edx
:00407F6C 81E2FF000000            and edx, 000000FF
:00407F72 8855FC                  mov byte ptr [ebp-04], dl
:00407F75 8B4508                  mov eax, dword ptr [ebp+08]
:00407F78 25FF000000              and eax, 000000FF
:00407F7D 83F802                  cmp eax, 00000002
:00407F80 7506                    jne 00407F88
:00407F82 C645EBFF                mov [ebp-15], FF
:00407F86 EB06                    jmp 00407F8E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407F80(C)
|
:00407F88 8A4D10                  mov cl, byte ptr [ebp+10]
:00407F8B 884DEB                  mov byte ptr [ebp-15], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407F86(U)
|
:00407F8E 8A55FC                  mov dl, byte ptr [ebp-04]
:00407F91 52                      push edx
:00407F92 8A45EB                  mov al, byte ptr [ebp-15]
:00407F95 50                      push eax
:00407F96 8A4D0C                  mov cl, byte ptr [ebp+0C]
:00407F99 51                      push ecx
:00407F9A 8A5508                  mov dl, byte ptr [ebp+08]
:00407F9D 52                      push edx
:00407F9E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00407FA1 E8D2FDFFFF              call 00407D78
:00407FA6 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00407FA9 E852150000              call 00409500
:00407FAE 50                      push eax
:00407FAF E8DC210100              call 0041A190
:00407FB4 83C404                  add esp, 00000004
:00407FB7 85C0                    test eax, eax
:00407FB9 7426                    je 00407FE1
:00407FBB 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00407FBE 6BC919                  imul ecx, 00000019
:00407FC1 81C140114A00            add ecx, 004A1140
:00407FC7 E834160000              call 00409600
:00407FCC 85C0                    test eax, eax
:00407FCE 7411                    je 00407FE1
:00407FD0 6A01                    push 00000001
:00407FD2 8B450C                  mov eax, dword ptr [ebp+0C]
:00407FD5 83C003                  add eax, 00000003
:00407FD8 50                      push eax
:00407FD9 E8D2210100              call 0041A1B0
:00407FDE 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00407E30(U), :00407E58(U), :00407E6D(U), :00407FB9(C), :00407FCE(C)
|
:00407FE1 8BE5                    mov esp, ebp
:00407FE3 5D                      pop ebp
:00407FE4 C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:0040C504   , :0040C519   , :00442A5D   
|
:00407FE7 55                      push ebp
:00407FE8 8BEC                    mov ebp, esp
:00407FEA 83EC34                  sub esp, 00000034
:00407FED 56                      push esi
:00407FEE 894DD0                  mov dword ptr [ebp-30], ecx
:00407FF1 C645D400                mov [ebp-2C], 00
:00407FF5 C645D501                mov [ebp-2B], 01
:00407FF9 C645D602                mov [ebp-2A], 02
:00407FFD C645D703                mov [ebp-29], 03
:00408001 C645D804                mov [ebp-28], 04
:00408005 C645D905                mov [ebp-27], 05
:00408009 C645DA06                mov [ebp-26], 06
:0040800D C645DB07                mov [ebp-25], 07
:00408011 C645DC08                mov [ebp-24], 08
:00408015 C645DD09                mov [ebp-23], 09
:00408019 C645DE0A                mov [ebp-22], 0A
:0040801D C645DF0B                mov [ebp-21], 0B
:00408021 C645E00C                mov [ebp-20], 0C
:00408025 C645E10D                mov [ebp-1F], 0D
:00408029 C645E20E                mov [ebp-1E], 0E
:0040802D C645E30F                mov [ebp-1D], 0F
:00408031 C645E410                mov [ebp-1C], 10
:00408035 C645E511                mov [ebp-1B], 11
:00408039 C645E612                mov [ebp-1A], 12
:0040803D C645E713                mov [ebp-19], 13
:00408041 C645E814                mov [ebp-18], 14
:00408045 C645F426                mov [ebp-0C], 26
:00408049 C645F527                mov [ebp-0B], 27
:0040804D C645F628                mov [ebp-0A], 28
:00408051 C645F729                mov [ebp-09], 29
:00408055 C645F82A                mov [ebp-08], 2A
:00408059 C645F92B                mov [ebp-07], 2B
:0040805D 8B45D0                  mov eax, dword ptr [ebp-30]
:00408060 33C9                    xor ecx, ecx
:00408062 8A482C                  mov cl, byte ptr [eax+2C]
:00408065 8BC1                    mov eax, ecx
:00408067 33D2                    xor edx, edx
:00408069 B90C000000              mov ecx, 0000000C
:0040806E F7F1                    div ecx
:00408070 83F802                  cmp eax, 00000002
:00408073 7609                    jbe 0040807E
:00408075 C745CC02000000          mov [ebp-34], 00000002
:0040807C EB14                    jmp 00408092

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408073(C)
|
:0040807E 8B55D0                  mov edx, dword ptr [ebp-30]
:00408081 33C0                    xor eax, eax
:00408083 8A422C                  mov al, byte ptr [edx+2C]
:00408086 33D2                    xor edx, edx
:00408088 B90C000000              mov ecx, 0000000C
:0040808D F7F1                    div ecx
:0040808F 8945CC                  mov dword ptr [ebp-34], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040807C(U)
|
:00408092 8A55CC                  mov dl, byte ptr [ebp-34]
:00408095 8855EC                  mov byte ptr [ebp-14], dl
:00408098 8B45D0                  mov eax, dword ptr [ebp-30]
:0040809B 33C9                    xor ecx, ecx
:0040809D 8A482C                  mov cl, byte ptr [eax+2C]
:004080A0 83F924                  cmp ecx, 00000024
:004080A3 7206                    jb 004080AB
:004080A5 C645F003                mov [ebp-10], 03
:004080A9 EB1A                    jmp 004080C5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004080A3(C)
|
:004080AB 8B55D0                  mov edx, dword ptr [ebp-30]
:004080AE 33C0                    xor eax, eax
:004080B0 8A422C                  mov al, byte ptr [edx+2C]
:004080B3 33D2                    xor edx, edx
:004080B5 B90C000000              mov ecx, 0000000C
:004080BA F7F1                    div ecx
:004080BC C1EA02                  shr edx, 02
:004080BF 83C201                  add edx, 00000001
:004080C2 8855F0                  mov byte ptr [ebp-10], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004080A9(U)
|
:004080C5 837D0C00                cmp dword ptr [ebp+0C], 00000000
:004080C9 744B                    je 00408116
:004080CB 6A01                    push 00000001
:004080CD 8A55F0                  mov dl, byte ptr [ebp-10]
:004080D0 52                      push edx
:004080D1 E8FA790700              call 0047FAD0
:004080D6 83C408                  add esp, 00000008
:004080D9 8845F0                  mov byte ptr [ebp-10], al
:004080DC 8B45F0                  mov eax, dword ptr [ebp-10]
:004080DF 25FF000000              and eax, 000000FF
:004080E4 83F801                  cmp eax, 00000001
:004080E7 7D2D                    jge 00408116
:004080E9 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004080EC 81E1FF000000            and ecx, 000000FF
:004080F2 83F901                  cmp ecx, 00000001
:004080F5 7D0A                    jge 00408101
:004080F7 C645F001                mov [ebp-10], 01
:004080FB C645EC00                mov [ebp-14], 00
:004080FF EB15                    jmp 00408116

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004080F5(C)
|
:00408101 C645F003                mov [ebp-10], 03
:00408105 6A01                    push 00000001
:00408107 8A55EC                  mov dl, byte ptr [ebp-14]
:0040810A 52                      push edx
:0040810B E8C0790700              call 0047FAD0
:00408110 83C408                  add esp, 00000008
:00408113 8845EC                  mov byte ptr [ebp-14], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004080C9(C), :004080E7(C), :004080FF(U)
|
:00408116 8B4508                  mov eax, dword ptr [ebp+08]
:00408119 25FF000000              and eax, 000000FF
:0040811E 85C0                    test eax, eax
:00408120 0F85CD000000            jne 004081F3
:00408126 C645FC00                mov [ebp-04], 00
:0040812A EB09                    jmp 00408135

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040816F(U)
|
:0040812C 8A4DFC                  mov cl, byte ptr [ebp-04]
:0040812F 80C101                  add cl, 01
:00408132 884DFC                  mov byte ptr [ebp-04], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040812A(U)
|
:00408135 8B55FC                  mov edx, dword ptr [ebp-04]
:00408138 81E2FF000000            and edx, 000000FF
:0040813E 83FA0E                  cmp edx, 0000000E
:00408141 7D2E                    jge 00408171
:00408143 8B45FC                  mov eax, dword ptr [ebp-04]
:00408146 25FF000000              and eax, 000000FF
:0040814B 50                      push eax
:0040814C 8B4DD0                  mov ecx, dword ptr [ebp-30]
:0040814F 33D2                    xor edx, edx
:00408151 8A512B                  mov dl, byte ptr [ecx+2B]
:00408154 8BCA                    mov ecx, edx
:00408156 6BC91B                  imul ecx, 0000001B
:00408159 81C1A0BF4A00            add ecx, 004ABFA0
:0040815F E85C140000              call 004095C0
:00408164 25FF000000              and eax, 000000FF
:00408169 85C0                    test eax, eax
:0040816B 7402                    je 0040816F
:0040816D EB02                    jmp 00408171

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040816B(C)
|
:0040816F EBBB                    jmp 0040812C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00408141(C), :0040816D(U)
|
:00408171 8B45FC                  mov eax, dword ptr [ebp-04]
:00408174 25FF000000              and eax, 000000FF
:00408179 83F80E                  cmp eax, 0000000E
:0040817C 7D70                    jge 004081EE
:0040817E 8B45FC                  mov eax, dword ptr [ebp-04]
:00408181 25FF000000              and eax, 000000FF
:00408186 99                      cdq
:00408187 2BC2                    sub eax, edx
:00408189 D1F8                    sar eax, 1
:0040818B 6BC003                  imul eax, 00000003
:0040818E 8D4C05D4                lea ecx, dword ptr [ebp+eax-2C]
:00408192 8B55EC                  mov edx, dword ptr [ebp-14]
:00408195 81E2FF000000            and edx, 000000FF
:0040819B 8B4508                  mov eax, dword ptr [ebp+08]
:0040819E 25FF000000              and eax, 000000FF
:004081A3 6BC003                  imul eax, 00000003
:004081A6 8B75D0                  mov esi, dword ptr [ebp-30]
:004081A9 8A0C11                  mov cl, byte ptr [ecx+edx]
:004081AC 884C062E                mov byte ptr [esi+eax+2E], cl
:004081B0 8B5508                  mov edx, dword ptr [ebp+08]
:004081B3 81E2FF000000            and edx, 000000FF
:004081B9 6BD203                  imul edx, 00000003
:004081BC 8B45D0                  mov eax, dword ptr [ebp-30]
:004081BF 8A4DF0                  mov cl, byte ptr [ebp-10]
:004081C2 884C102F                mov byte ptr [eax+edx+2F], cl
:004081C6 8B55F0                  mov edx, dword ptr [ebp-10]
:004081C9 81E2FF000000            and edx, 000000FF
:004081CF 83FA03                  cmp edx, 00000003
:004081D2 1BC0                    sbb eax, eax
:004081D4 2401                    and al, 01
:004081D6 05FF000000              add eax, 000000FF
:004081DB 8B4D08                  mov ecx, dword ptr [ebp+08]
:004081DE 81E1FF000000            and ecx, 000000FF
:004081E4 6BC903                  imul ecx, 00000003
:004081E7 8B55D0                  mov edx, dword ptr [ebp-30]
:004081EA 88440A30                mov byte ptr [edx+ecx+30], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040817C(C)
|
:004081EE E9DC000000              jmp 004082CF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408120(C)
|
:004081F3 8B4508                  mov eax, dword ptr [ebp+08]
:004081F6 25FF000000              and eax, 000000FF
:004081FB 83F801                  cmp eax, 00000001
:004081FE 0F85CB000000            jne 004082CF
:00408204 C645FC0E                mov [ebp-04], 0E
:00408208 EB09                    jmp 00408213

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040824D(U)
|
:0040820A 8A4DFC                  mov cl, byte ptr [ebp-04]
:0040820D 80C101                  add cl, 01
:00408210 884DFC                  mov byte ptr [ebp-04], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408208(U)
|
:00408213 8B55FC                  mov edx, dword ptr [ebp-04]
:00408216 81E2FF000000            and edx, 000000FF
:0040821C 83FA12                  cmp edx, 00000012
:0040821F 7D2E                    jge 0040824F
:00408221 8B45FC                  mov eax, dword ptr [ebp-04]
:00408224 25FF000000              and eax, 000000FF
:00408229 50                      push eax
:0040822A 8B4DD0                  mov ecx, dword ptr [ebp-30]
:0040822D 33D2                    xor edx, edx
:0040822F 8A512B                  mov dl, byte ptr [ecx+2B]
:00408232 8BCA                    mov ecx, edx
:00408234 6BC91B                  imul ecx, 0000001B
:00408237 81C1A0BF4A00            add ecx, 004ABFA0
:0040823D E87E130000              call 004095C0
:00408242 25FF000000              and eax, 000000FF
:00408247 85C0                    test eax, eax
:00408249 7402                    je 0040824D
:0040824B EB02                    jmp 0040824F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408249(C)
|
:0040824D EBBB                    jmp 0040820A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040821F(C), :0040824B(U)
|
:0040824F 8B45FC                  mov eax, dword ptr [ebp-04]
:00408252 25FF000000              and eax, 000000FF
:00408257 83F812                  cmp eax, 00000012
:0040825A 7D73                    jge 004082CF
:0040825C 8B45FC                  mov eax, dword ptr [ebp-04]
:0040825F 25FF000000              and eax, 000000FF
:00408264 83E80E                  sub eax, 0000000E
:00408267 99                      cdq
:00408268 2BC2                    sub eax, edx
:0040826A D1F8                    sar eax, 1
:0040826C 6BC003                  imul eax, 00000003
:0040826F 8D4C05F4                lea ecx, dword ptr [ebp+eax-0C]
:00408273 8B55EC                  mov edx, dword ptr [ebp-14]
:00408276 81E2FF000000            and edx, 000000FF
:0040827C 8B4508                  mov eax, dword ptr [ebp+08]
:0040827F 25FF000000              and eax, 000000FF
:00408284 6BC003                  imul eax, 00000003
:00408287 8B75D0                  mov esi, dword ptr [ebp-30]
:0040828A 8A0C11                  mov cl, byte ptr [ecx+edx]
:0040828D 884C062E                mov byte ptr [esi+eax+2E], cl
:00408291 8B5508                  mov edx, dword ptr [ebp+08]
:00408294 81E2FF000000            and edx, 000000FF
:0040829A 6BD203                  imul edx, 00000003
:0040829D 8B45D0                  mov eax, dword ptr [ebp-30]
:004082A0 8A4DF0                  mov cl, byte ptr [ebp-10]
:004082A3 884C102F                mov byte ptr [eax+edx+2F], cl
:004082A7 8B55F0                  mov edx, dword ptr [ebp-10]
:004082AA 81E2FF000000            and edx, 000000FF
:004082B0 83FA03                  cmp edx, 00000003
:004082B3 1BC0                    sbb eax, eax
:004082B5 2401                    and al, 01
:004082B7 05FF000000              add eax, 000000FF
:004082BC 8B4D08                  mov ecx, dword ptr [ebp+08]
:004082BF 81E1FF000000            and ecx, 000000FF
:004082C5 6BC903                  imul ecx, 00000003
:004082C8 8B55D0                  mov edx, dword ptr [ebp-30]
:004082CB 88440A30                mov byte ptr [edx+ecx+30], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004081EE(U), :004081FE(C), :0040825A(C)
|
:004082CF 5E                      pop esi
:004082D0 8BE5                    mov esp, ebp
:004082D2 5D                      pop ebp
:004082D3 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:00405B7D   , :00405CDD   , :00422D98   , :00423120   , :0043D099   
|:0043D0A7   
|
:004082D6 55                      push ebp
:004082D7 8BEC                    mov ebp, esp
:004082D9 83EC14                  sub esp, 00000014
:004082DC 894DEC                  mov dword ptr [ebp-14], ecx
:004082DF 8B4508                  mov eax, dword ptr [ebp+08]
:004082E2 25FF000000              and eax, 000000FF
:004082E7 83F801                  cmp eax, 00000001
:004082EA 7F20                    jg 0040830C
:004082EC 8A4D08                  mov cl, byte ptr [ebp+08]
:004082EF 51                      push ecx
:004082F0 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004082F3 E8F8E2FFFF              call 004065F0
:004082F8 8845F4                  mov byte ptr [ebp-0C], al
:004082FB 8B55F4                  mov edx, dword ptr [ebp-0C]
:004082FE 81E2FF000000            and edx, 000000FF
:00408304 81FAFF000000            cmp edx, 000000FF
:0040830A 7505                    jne 00408311

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004082EA(C)
|
:0040830C E9D8000000              jmp 004083E9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040830A(C)
|
:00408311 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00408314 81E1FF000000            and ecx, 000000FF
:0040831A 6BC919                  imul ecx, 00000019
:0040831D 81C140114A00            add ecx, 004A1140
:00408323 E846440000              call 0040C76E
:00408328 F7D8                    neg eax
:0040832A 1BC0                    sbb eax, eax
:0040832C 83E006                  and eax, 00000006
:0040832F 83C003                  add eax, 00000003
:00408332 8845F8                  mov byte ptr [ebp-08], al
:00408335 8A4508                  mov al, byte ptr [ebp+08]
:00408338 50                      push eax
:00408339 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040833C E89F120000              call 004095E0
:00408341 8845FC                  mov byte ptr [ebp-04], al
:00408344 8A4D08                  mov cl, byte ptr [ebp+08]
:00408347 51                      push ecx
:00408348 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040834B E830130000              call 00409680
:00408350 25FF000000              and eax, 000000FF
:00408355 03450C                  add eax, dword ptr [ebp+0C]
:00408358 8945F0                  mov dword ptr [ebp-10], eax
:0040835B EB09                    jmp 00408366

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004083AF(U)
|
:0040835D 8B55F0                  mov edx, dword ptr [ebp-10]
:00408360 83EA64                  sub edx, 00000064
:00408363 8955F0                  mov dword ptr [ebp-10], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040835B(U)
|
:00408366 837DF064                cmp dword ptr [ebp-10], 00000064
:0040836A 7245                    jb 004083B1
:0040836C 8B45FC                  mov eax, dword ptr [ebp-04]
:0040836F 25FF000000              and eax, 000000FF
:00408374 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00408377 81E1FF000000            and ecx, 000000FF
:0040837D 3BC1                    cmp eax, ecx
:0040837F 7D30                    jge 004083B1
:00408381 8A55FC                  mov dl, byte ptr [ebp-04]
:00408384 80C201                  add dl, 01
:00408387 8855FC                  mov byte ptr [ebp-04], dl
:0040838A 8A45FC                  mov al, byte ptr [ebp-04]
:0040838D 50                      push eax
:0040838E 8A4D08                  mov cl, byte ptr [ebp+08]
:00408391 51                      push ecx
:00408392 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00408395 E886120000              call 00409620
:0040839A 8A5508                  mov dl, byte ptr [ebp+08]
:0040839D 52                      push edx
:0040839E 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004083A1 E85A110000              call 00409500
:004083A6 50                      push eax
:004083A7 E843000000              call 004083EF
:004083AC 83C408                  add esp, 00000008
:004083AF EBAC                    jmp 0040835D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040836A(C), :0040837F(C)
|
:004083B1 8B45FC                  mov eax, dword ptr [ebp-04]
:004083B4 25FF000000              and eax, 000000FF
:004083B9 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004083BC 81E1FF000000            and ecx, 000000FF
:004083C2 3BC1                    cmp eax, ecx
:004083C4 7C13                    jl 004083D9
:004083C6 68FF000000              push 000000FF
:004083CB 8A5508                  mov dl, byte ptr [ebp+08]
:004083CE 52                      push edx
:004083CF 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004083D2 E879120000              call 00409650
:004083D7 EB10                    jmp 004083E9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004083C4(C)
|
:004083D9 8A45F0                  mov al, byte ptr [ebp-10]
:004083DC 50                      push eax
:004083DD 8A4D08                  mov cl, byte ptr [ebp+08]
:004083E0 51                      push ecx
:004083E1 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004083E4 E867120000              call 00409650

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040830C(U), :004083D7(U)
|
:004083E9 8BE5                    mov esp, ebp
:004083EB 5D                      pop ebp
:004083EC C20800                  ret 0008



* Referenced by a CALL at Address:
|:004083A7   
|
:004083EF 55                      push ebp
:004083F0 8BEC                    mov ebp, esp
:004083F2 6AFF                    push FFFFFFFF
:004083F4 68BC4F4800              push 00484FBC
:004083F9 64A100000000            mov eax, dword ptr fs:[00000000]
:004083FF 50                      push eax
:00408400 64892500000000          mov dword ptr fs:[00000000], esp
:00408407 81EC30010000            sub esp, 00000130
:0040840D 56                      push esi
:0040840E 817D0800020000          cmp dword ptr [ebp+08], 00000200
:00408415 730D                    jnb 00408424
:00408417 8B450C                  mov eax, dword ptr [ebp+0C]
:0040841A 25FF000000              and eax, 000000FF
:0040841F 83F801                  cmp eax, 00000001
:00408422 7E05                    jle 00408429

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408415(C)
|
:00408424 E918050000              jmp 00408941

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408422(C)
|
:00408429 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040842C 6BC948                  imul ecx, 00000048
:0040842F 81C1681B4A00            add ecx, 004A1B68
:00408435 898DC8FEFFFF            mov dword ptr [ebp+FFFFFEC8], ecx
:0040843B 8A550C                  mov dl, byte ptr [ebp+0C]
:0040843E 52                      push edx
:0040843F 8B8DC8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC8]
:00408445 E8A6E1FFFF              call 004065F0
:0040844A 8885D8FEFFFF            mov byte ptr [ebp+FFFFFED8], al
:00408450 8A450C                  mov al, byte ptr [ebp+0C]
:00408453 50                      push eax
:00408454 8B8DC8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC8]
:0040845A E881110000              call 004095E0
:0040845F 8845F0                  mov byte ptr [ebp-10], al
:00408462 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:00408468 81E1FF000000            and ecx, 000000FF
:0040846E 6BC919                  imul ecx, 00000019
:00408471 81C140114A00            add ecx, 004A1140
:00408477 898DCCFEFFFF            mov dword ptr [ebp+FFFFFECC], ecx
:0040847D E8A0340000              call 0040B922
:00408482 85C0                    test eax, eax
:00408484 0F84FC000000            je 00408586
:0040848A 6A00                    push 00000000
:0040848C 6A00                    push 00000000
:0040848E 6A0C                    push 0000000C
:00408490 8B5508                  mov edx, dword ptr [ebp+08]
:00408493 52                      push edx
:00408494 B9F05D4B00              mov ecx, 004B5DF0
:00408499 E8F1F20400              call 0045778F
:0040849E 8B450C                  mov eax, dword ptr [ebp+0C]
:004084A1 25FF000000              and eax, 000000FF
:004084A6 85C0                    test eax, eax
:004084A8 754A                    jne 004084F4
:004084AA 6A00                    push 00000000
:004084AC 6A00                    push 00000000

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:004084AE 6A07                    push 00000007
:004084B0 8B4D08                  mov ecx, dword ptr [ebp+08]
:004084B3 51                      push ecx
:004084B4 B9F05D4B00              mov ecx, 004B5DF0
:004084B9 E8D1F20400              call 0045778F
:004084BE 6A00                    push 00000000
:004084C0 6A00                    push 00000000
:004084C2 6A01                    push 00000001
:004084C4 8B5508                  mov edx, dword ptr [ebp+08]
:004084C7 52                      push edx
:004084C8 B9F05D4B00              mov ecx, 004B5DF0
:004084CD E8BDF20400              call 0045778F
:004084D2 6A01                    push 00000001
:004084D4 6A0D                    push 0000000D
:004084D6 B9B0694B00              mov ecx, 004B69B0
:004084DB E89AC10600              call 0047467A

* Possible StringData Ref from Data Obj ->"ȼ"
                                  |
:004084E0 6874B14800              push 0048B174
:004084E5 6A02                    push 00000002
:004084E7 E8AD710200              call 0042F699
:004084EC 83C408                  add esp, 00000008
:004084EF E992000000              jmp 00408586

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004084A8(C)
|
:004084F4 6A01                    push 00000001
:004084F6 6A00                    push 00000000
:004084F8 6A02                    push 00000002
:004084FA 8B4508                  mov eax, dword ptr [ebp+08]
:004084FD 50                      push eax
:004084FE B9F05D4B00              mov ecx, 004B5DF0
:00408503 E887F20400              call 0045778F
:00408508 6A00                    push 00000000
:0040850A 6A00                    push 00000000
:0040850C 6A00                    push 00000000
:0040850E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00408511 51                      push ecx
:00408512 B9F05D4B00              mov ecx, 004B5DF0
:00408517 E873F20400              call 0045778F
:0040851C 6A02                    push 00000002
:0040851E B9181B4B00              mov ecx, 004B1B18
:00408523 E818AEFFFF              call 00403340
:00408528 E8B33F0200              call 0042C4E0
:0040852D 6A01                    push 00000001
:0040852F 6A00                    push 00000000
:00408531 6A02                    push 00000002
:00408533 8B5508                  mov edx, dword ptr [ebp+08]
:00408536 52                      push edx
:00408537 B9F05D4B00              mov ecx, 004B5DF0
:0040853C E84EF20400              call 0045778F
:00408541 6A01                    push 00000001
:00408543 6A00                    push 00000000
:00408545 6A00                    push 00000000
:00408547 8B4508                  mov eax, dword ptr [ebp+08]
:0040854A 50                      push eax
:0040854B B9F05D4B00              mov ecx, 004B5DF0
:00408550 E83AF20400              call 0045778F
:00408555 6A00                    push 00000000
:00408557 6A00                    push 00000000
:00408559 6A01                    push 00000001
:0040855B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040855E 51                      push ecx
:0040855F B9F05D4B00              mov ecx, 004B5DF0
:00408564 E826F20400              call 0045778F
:00408569 6A01                    push 00000001
:0040856B 6A0D                    push 0000000D
:0040856D B9B0694B00              mov ecx, 004B69B0
:00408572 E803C10600              call 0047467A

* Possible StringData Ref from Data Obj ->"ߵȼ"
                                  |
:00408577 6884B14800              push 0048B184
:0040857C 6A02                    push 00000002
:0040857E E816710200              call 0042F699
:00408583 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00408484(C), :004084EF(U)
|
:00408586 8D8DDCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEDC]
:0040858C E81FADFFFF              call 004032B0
:00408591 C745FC00000000          mov [ebp-04], 00000000
:00408598 B950424B00              mov ecx, 004B4250
:0040859D E8A2D80400              call 00455E44
:004085A2 99                      cdq
:004085A3 2BC2                    sub eax, edx
:004085A5 D1F8                    sar eax, 1
:004085A7 83E878                  sub eax, 00000078
:004085AA 8985D0FEFFFF            mov dword ptr [ebp+FFFFFED0], eax
:004085B0 B950424B00              mov ecx, 004B4250
:004085B5 E8B1D80400              call 00455E6B
:004085BA 99                      cdq
:004085BB 2BC2                    sub eax, edx
:004085BD D1F8                    sar eax, 1
:004085BF 83E830                  sub eax, 00000030
:004085C2 8985D4FEFFFF            mov dword ptr [ebp+FFFFFED4], eax

* Possible StringData Ref from Data Obj ->"ITEM.E5"
                                  |
:004085C8 68F0BB4800              push 0048BBF0
:004085CD 8D8DDCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEDC]
:004085D3 E85D750100              call 0041FB35
:004085D8 6A04                    push 00000004
:004085DA 6A00                    push 00000000
:004085DC 6A00                    push 00000000
:004085DE B9C8E44A00              mov ecx, 004AE4C8
:004085E3 E858740700              call 0047FA40
:004085E8 50                      push eax
:004085E9 8B95D8FEFFFF            mov edx, dword ptr [ebp+FFFFFED8]
:004085EF 81E2FF000000            and edx, 000000FF
:004085F5 52                      push edx
:004085F6 8D8DDCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEDC]
:004085FC E888760100              call 0041FC89
:00408601 8D8DDCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEDC]
:00408607 E8B90C0100              call 004192C5
:0040860C E8CA5F0100              call 0041E5DB
:00408611 6A00                    push 00000000
:00408613 6A60                    push 00000060
:00408615 68F0000000              push 000000F0
:0040861A 8B85D4FEFFFF            mov eax, dword ptr [ebp+FFFFFED4]
:00408620 50                      push eax
:00408621 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00408627 51                      push ecx
:00408628 B930694B00              mov ecx, 004B6930
:0040862D E889AF0600              call 004735BB
:00408632 6A00                    push 00000000
:00408634 6A1F                    push 0000001F
:00408636 6A04                    push 00000004
:00408638 E8B44B0700              call 0047D1F1
:0040863D 83C40C                  add esp, 0000000C
:00408640 6A04                    push 00000004
:00408642 6A00                    push 00000000
:00408644 6A00                    push 00000000
:00408646 B9C8E44A00              mov ecx, 004AE4C8
:0040864B E8F0730700              call 0047FA40
:00408650 50                      push eax
:00408651 6A20                    push 00000020
:00408653 6A20                    push 00000020
:00408655 8B95D4FEFFFF            mov edx, dword ptr [ebp+FFFFFED4]
:0040865B 83C210                  add edx, 00000010
:0040865E 52                      push edx
:0040865F 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:00408665 83C010                  add eax, 00000010
:00408668 50                      push eax
:00408669 E82D5A0700              call 0047E09B
:0040866E 83C414                  add esp, 00000014
:00408671 6A04                    push 00000004
:00408673 B9382F4900              mov ecx, 00492F38
:00408678 E8B9660000              call 0040ED36
:0040867D 6A00                    push 00000000
:0040867F B9382F4900              mov ecx, 00492F38
:00408684 E881660000              call 0040ED0A
:00408689 6A1F                    push 0000001F
:0040868B B9382F4900              mov ecx, 00492F38
:00408690 E8EF650000              call 0040EC84
:00408695 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:0040869B 83C10C                  add ecx, 0000000C
:0040869E 51                      push ecx
:0040869F 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:004086A5 C1EA03                  shr edx, 03
:004086A8 83C209                  add edx, 00000009
:004086AB 52                      push edx
:004086AC B9382F4900              mov ecx, 00492F38
:004086B1 E821650000              call 0040EBD7
:004086B6 8B8DCCFEFFFF            mov ecx, dword ptr [ebp+FFFFFECC]
:004086BC E84F700500              call 0045F710
:004086C1 50                      push eax
:004086C2 68382F4900              push 00492F38
:004086C7 E8D4730000              call 0040FAA0
:004086CC 83C408                  add esp, 00000008
:004086CF 8B85D4FEFFFF            mov eax, dword ptr [ebp+FFFFFED4]
:004086D5 83C00C                  add eax, 0000000C
:004086D8 50                      push eax
:004086D9 8BB5D0FEFFFF            mov esi, dword ptr [ebp+FFFFFED0]
:004086DF C1EE03                  shr esi, 03
:004086E2 8B8DCCFEFFFF            mov ecx, dword ptr [ebp+FFFFFECC]
:004086E8 E823700500              call 0045F710
:004086ED 50                      push eax
:004086EE E867750700              call 0047FC5A
:004086F3 83C404                  add esp, 00000004
:004086F6 8D4C060B                lea ecx, dword ptr [esi+eax+0B]
:004086FA 51                      push ecx
:004086FB B9382F4900              mov ecx, 00492F38
:00408700 E8D2640000              call 0040EBD7
:00408705 8B55F0                  mov edx, dword ptr [ebp-10]
:00408708 81E2FF000000            and edx, 000000FF
:0040870E 52                      push edx

* Possible StringData Ref from Data Obj ->"Lv %u"
                                  |
:0040870F 6894B14800              push 0048B194
:00408714 68382F4900              push 00492F38
:00408719 E882730000              call 0040FAA0
:0040871E 83C40C                  add esp, 0000000C
:00408721 6A3A                    push 0000003A
:00408723 B9382F4900              mov ecx, 00492F38
:00408728 E857650000              call 0040EC84
:0040872D 8B85D4FEFFFF            mov eax, dword ptr [ebp+FFFFFED4]
:00408733 83C024                  add eax, 00000024
:00408736 50                      push eax
:00408737 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:0040873D C1E903                  shr ecx, 03
:00408740 83C109                  add ecx, 00000009
:00408743 51                      push ecx
:00408744 B9382F4900              mov ecx, 00492F38
:00408749 E889640000              call 0040EBD7
:0040874E 8B8DC8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC8]
:00408754 E8FEEFFFFF              call 00407757
:00408759 50                      push eax
:0040875A 68382F4900              push 00492F38
:0040875F E83C730000              call 0040FAA0
:00408764 83C408                  add esp, 00000008
:00408767 6A1F                    push 0000001F
:00408769 B9382F4900              mov ecx, 00492F38
:0040876E E811650000              call 0040EC84
:00408773 8B95D4FEFFFF            mov edx, dword ptr [ebp+FFFFFED4]
:00408779 83C224                  add edx, 00000024
:0040877C 52                      push edx
:0040877D 8BB5D0FEFFFF            mov esi, dword ptr [ebp+FFFFFED0]
:00408783 C1EE03                  shr esi, 03
:00408786 8B8DC8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC8]
:0040878C E8C6EFFFFF              call 00407757
:00408791 50                      push eax
:00408792 E8C3740700              call 0047FC5A
:00408797 83C404                  add esp, 00000004
:0040879A 8D44060A                lea eax, dword ptr [esi+eax+0A]
:0040879E 50                      push eax
:0040879F B9382F4900              mov ecx, 00492F38
:004087A4 E82E640000              call 0040EBD7

* Possible StringData Ref from Data Obj ->"װ"
                                  |
:004087A9 689CB14800              push 0048B19C
:004087AE 68382F4900              push 00492F38
:004087B3 E8E8720000              call 0040FAA0
:004087B8 83C408                  add esp, 00000008
:004087BB 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:004087C1 83C144                  add ecx, 00000044
:004087C4 51                      push ecx
:004087C5 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:004087CB C1EA03                  shr edx, 03
:004087CE 83C206                  add edx, 00000006
:004087D1 52                      push edx
:004087D2 B9382F4900              mov ecx, 00492F38
:004087D7 E8FB630000              call 0040EBD7
:004087DC 8B450C                  mov eax, dword ptr [ebp+0C]
:004087DF 25FF000000              and eax, 000000FF
:004087E4 83F801                  cmp eax, 00000001
:004087E7 7513                    jne 004087FC
:004087E9 68006B4800              push 00486B00
:004087EE 8D4DE0                  lea ecx, dword ptr [ebp-20]
:004087F1 51                      push ecx
:004087F2 E899890700              call 00481190
:004087F7 83C408                  add esp, 00000008
:004087FA EB53                    jmp 0040884F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004087E7(C)
|
:004087FC 8B95D8FEFFFF            mov edx, dword ptr [ebp+FFFFFED8]
:00408802 81E2FF000000            and edx, 000000FF
:00408808 52                      push edx
:00408809 E80CE0FFFF              call 0040681A
:0040880E 83C404                  add esp, 00000004
:00408811 8885C4FEFFFF            mov byte ptr [ebp+FFFFFEC4], al
:00408817 80BDC4FEFFFF00          cmp byte ptr [ebp+FFFFFEC4], 00
:0040881E 740B                    je 0040882B
:00408820 80BDC4FEFFFF02          cmp byte ptr [ebp+FFFFFEC4], 02
:00408827 7415                    je 0040883E
:00408829 EB24                    jmp 0040884F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040881E(C)
|
:0040882B 68E06A4800              push 00486AE0
:00408830 8D45E0                  lea eax, dword ptr [ebp-20]
:00408833 50                      push eax
:00408834 E857890700              call 00481190
:00408839 83C408                  add esp, 00000008
:0040883C EB11                    jmp 0040884F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408827(C)
|
:0040883E 68F06A4800              push 00486AF0
:00408843 8D4DE0                  lea ecx, dword ptr [ebp-20]
:00408846 51                      push ecx
:00408847 E844890700              call 00481190
:0040884C 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004087FA(U), :00408829(U), :0040883C(U)
|
:0040884F 8D55E0                  lea edx, dword ptr [ebp-20]
:00408852 52                      push edx
:00408853 68382F4900              push 00492F38
:00408858 E843720000              call 0040FAA0
:0040885D 83C408                  add esp, 00000008
:00408860 8B85D4FEFFFF            mov eax, dword ptr [ebp+FFFFFED4]
:00408866 83C044                  add eax, 00000044
:00408869 50                      push eax
:0040886A 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00408870 C1E903                  shr ecx, 03
:00408873 83C10E                  add ecx, 0000000E
:00408876 51                      push ecx
:00408877 B9382F4900              mov ecx, 00492F38
:0040887C E856630000              call 0040EBD7
:00408881 8B55F0                  mov edx, dword ptr [ebp-10]
:00408884 81E2FF000000            and edx, 000000FF
:0040888A 83EA01                  sub edx, 00000001
:0040888D 52                      push edx
:0040888E 8B8DCCFEFFFF            mov ecx, dword ptr [ebp+FFFFFECC]
:00408894 E8DB3D0000              call 0040C674
:00408899 25FF000000              and eax, 000000FF
:0040889E 50                      push eax

* Possible StringData Ref from Data Obj ->"+%u ->"
                                  |
:0040889F 68A4B14800              push 0048B1A4
:004088A4 68382F4900              push 00492F38
:004088A9 E8F2710000              call 0040FAA0
:004088AE 83C40C                  add esp, 0000000C
:004088B1 6A2A                    push 0000002A
:004088B3 B9382F4900              mov ecx, 00492F38
:004088B8 E8C7630000              call 0040EC84
:004088BD 8B85D4FEFFFF            mov eax, dword ptr [ebp+FFFFFED4]
:004088C3 83C044                  add eax, 00000044
:004088C6 50                      push eax
:004088C7 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:004088CD C1E903                  shr ecx, 03
:004088D0 83C115                  add ecx, 00000015
:004088D3 51                      push ecx
:004088D4 B9382F4900              mov ecx, 00492F38
:004088D9 E8F9620000              call 0040EBD7
:004088DE 8A55F0                  mov dl, byte ptr [ebp-10]
:004088E1 52                      push edx
:004088E2 8B8DCCFEFFFF            mov ecx, dword ptr [ebp+FFFFFECC]
:004088E8 E8873D0000              call 0040C674
:004088ED 25FF000000              and eax, 000000FF
:004088F2 50                      push eax

* Possible StringData Ref from Data Obj ->"+%u"
                                  |
:004088F3 68ACB14800              push 0048B1AC
:004088F8 68382F4900              push 00492F38
:004088FD E89E710000              call 0040FAA0
:00408902 83C40C                  add esp, 0000000C
:00408905 E8EC5C0100              call 0041E5F6
:0040890A 6A0A                    push 0000000A
:0040890C B9181B4B00              mov ecx, 004B1B18
:00408911 E82AAAFFFF              call 00403340
:00408916 E8C53B0200              call 0042C4E0
:0040891B 6A28                    push 00000028
:0040891D E8243D0200              call 0042C646
:00408922 83C404                  add esp, 00000004
:00408925 B930694B00              mov ecx, 004B6930
:0040892A E8F4AC0600              call 00473623
:0040892F C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00408936 8D8DDCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEDC]
:0040893C E88FA9FFFF              call 004032D0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408424(U)
|
:00408941 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00408944 64890D00000000          mov dword ptr fs:[00000000], ecx
:0040894B 5E                      pop esi
:0040894C 8BE5                    mov esp, ebp
:0040894E 5D                      pop ebp
:0040894F C3                      ret



* Referenced by a CALL at Addresses:
|:00405CC6   , :0041D4A3   , :00423109   , :0043D08B   , :00449996   
|
:00408950 55                      push ebp
:00408951 8BEC                    mov ebp, esp
:00408953 83EC08                  sub esp, 00000008
:00408956 894DF8                  mov dword ptr [ebp-08], ecx
:00408959 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040895C E89F0B0000              call 00409500
:00408961 8945FC                  mov dword ptr [ebp-04], eax
:00408964 837DFCFF                cmp dword ptr [ebp-04], FFFFFFFF
:00408968 730D                    jnb 00408977
:0040896A 8B45F8                  mov eax, dword ptr [ebp-08]
:0040896D 33C9                    xor ecx, ecx
:0040896F 8A482C                  mov cl, byte ptr [eax+2C]
:00408972 83F932                  cmp ecx, 00000032
:00408975 7202                    jb 00408979

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408968(C)
|
:00408977 EB4C                    jmp 004089C5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408975(C)
|
:00408979 EB09                    jmp 00408984

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408998(U)
|
:0040897B 8B5508                  mov edx, dword ptr [ebp+08]
:0040897E 83EA7D                  sub edx, 0000007D
:00408981 895508                  mov dword ptr [ebp+08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408979(U)
|
:00408984 837D087D                cmp dword ptr [ebp+08], 0000007D
:00408988 7210                    jb 0040899A
:0040898A 8B450C                  mov eax, dword ptr [ebp+0C]
:0040898D 50                      push eax
:0040898E 6A01                    push 00000001
:00408990 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00408993 E820EAFFFF              call 004073B8
:00408998 EBE1                    jmp 0040897B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408988(C)
|
:0040899A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040899D 33D2                    xor edx, edx
:0040899F 8A512C                  mov dl, byte ptr [ecx+2C]
:004089A2 83FA32                  cmp edx, 00000032
:004089A5 7209                    jb 004089B0
:004089A7 8B45F8                  mov eax, dword ptr [ebp-08]
:004089AA C6402DFF                mov [eax+2D], FF
:004089AE EB09                    jmp 004089B9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004089A5(C)
|
:004089B0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004089B3 8A5508                  mov dl, byte ptr [ebp+08]
:004089B6 88512D                  mov byte ptr [ecx+2D], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004089AE(U)
|
:004089B9 8B45FC                  mov eax, dword ptr [ebp-04]
:004089BC 50                      push eax
:004089BD E83F100700              call 00479A01
:004089C2 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408977(U)
|
:004089C5 8BE5                    mov esp, ebp
:004089C7 5D                      pop ebp
:004089C8 C20800                  ret 0008



* Referenced by a CALL at Address:
|:004429CF   
|
:004089CB 55                      push ebp
:004089CC 8BEC                    mov ebp, esp
:004089CE 83EC18                  sub esp, 00000018
:004089D1 894DEC                  mov dword ptr [ebp-14], ecx
:004089D4 C745FC00000000          mov [ebp-04], 00000000
:004089DB C745F800000000          mov [ebp-08], 00000000
:004089E2 8B45EC                  mov eax, dword ptr [ebp-14]
:004089E5 33C9                    xor ecx, ecx
:004089E7 8A482C                  mov cl, byte ptr [eax+2C]
:004089EA 83E901                  sub ecx, 00000001
:004089ED 894DF0                  mov dword ptr [ebp-10], ecx
:004089F0 8B55EC                  mov edx, dword ptr [ebp-14]
:004089F3 8A422B                  mov al, byte ptr [edx+2B]
:004089F6 8845F4                  mov byte ptr [ebp-0C], al
:004089F9 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004089FC 81E1FF000000            and ecx, 000000FF
:00408A02 83F926                  cmp ecx, 00000026
:00408A05 0F8F7C010000            jg 00408B87
:00408A0B 8B45F4                  mov eax, dword ptr [ebp-0C]
:00408A0E 25FF000000              and eax, 000000FF
:00408A13 99                      cdq
:00408A14 B903000000              mov ecx, 00000003
:00408A19 F7F9                    idiv ecx
:00408A1B 8955E8                  mov dword ptr [ebp-18], edx
:00408A1E 837DE800                cmp dword ptr [ebp-18], 00000000
:00408A22 0F8409010000            je 00408B31
:00408A28 837DE801                cmp dword ptr [ebp-18], 00000001
:00408A2C 0F8483000000            je 00408AB5
:00408A32 837DE802                cmp dword ptr [ebp-18], 00000002
:00408A36 7405                    je 00408A3D
:00408A38 E948010000              jmp 00408B85

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408A36(C)
|
:00408A3D 8B55F0                  mov edx, dword ptr [ebp-10]
:00408A40 83C201                  add edx, 00000001
:00408A43 83FA1E                  cmp edx, 0000001E
:00408A46 7302                    jnb 00408A4A
:00408A48 EB6B                    jmp 00408AB5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408A46(C)
|
:00408A4A 8A45F4                  mov al, byte ptr [ebp-0C]
:00408A4D 2C01                    sub al, 01
:00408A4F 8845F4                  mov byte ptr [ebp-0C], al
:00408A52 8B4D08                  mov ecx, dword ptr [ebp+08]
:00408A55 51                      push ecx
:00408A56 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00408A59 81E1FF000000            and ecx, 000000FF
:00408A5F 6BC91B                  imul ecx, 0000001B
:00408A62 81C1A0BF4A00            add ecx, 004ABFA0
:00408A68 E8330B0000              call 004095A0
:00408A6D 25FF000000              and eax, 000000FF
:00408A72 8945FC                  mov dword ptr [ebp-04], eax
:00408A75 837D0804                cmp dword ptr [ebp+08], 00000004
:00408A79 771B                    ja 00408A96
:00408A7B 8B5508                  mov edx, dword ptr [ebp+08]
:00408A7E 52                      push edx
:00408A7F 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00408A82 E875E8FFFF              call 004072FC
:00408A87 25FF000000              and eax, 000000FF
:00408A8C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00408A8F 03C8                    add ecx, eax
:00408A91 D1E9                    shr ecx, 1
:00408A93 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408A79(C)
|
:00408A96 8B55FC                  mov edx, dword ptr [ebp-04]
:00408A99 6BD20F                  imul edx, 0000000F
:00408A9C 8B45F8                  mov eax, dword ptr [ebp-08]
:00408A9F 03C2                    add eax, edx
:00408AA1 8945F8                  mov dword ptr [ebp-08], eax
:00408AA4 6A0F                    push 0000000F
:00408AA6 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00408AA9 51                      push ecx
:00408AAA E8EF6F0700              call 0047FA9E
:00408AAF 83C408                  add esp, 00000008
:00408AB2 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00408A2C(C), :00408A48(U)
|
:00408AB5 8B55F0                  mov edx, dword ptr [ebp-10]
:00408AB8 83C201                  add edx, 00000001
:00408ABB 83FA0F                  cmp edx, 0000000F
:00408ABE 7302                    jnb 00408AC2
:00408AC0 EB6F                    jmp 00408B31

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408ABE(C)
|
:00408AC2 8A45F4                  mov al, byte ptr [ebp-0C]
:00408AC5 2C01                    sub al, 01
:00408AC7 8845F4                  mov byte ptr [ebp-0C], al
:00408ACA 8B4D08                  mov ecx, dword ptr [ebp+08]
:00408ACD 51                      push ecx
:00408ACE 8B55EC                  mov edx, dword ptr [ebp-14]
:00408AD1 33C0                    xor eax, eax
:00408AD3 8A422B                  mov al, byte ptr [edx+2B]
:00408AD6 8BC8                    mov ecx, eax
:00408AD8 83E901                  sub ecx, 00000001
:00408ADB 6BC91B                  imul ecx, 0000001B
:00408ADE 81C1A0BF4A00            add ecx, 004ABFA0
:00408AE4 E8B70A0000              call 004095A0
:00408AE9 25FF000000              and eax, 000000FF
:00408AEE 8945FC                  mov dword ptr [ebp-04], eax
:00408AF1 837D0804                cmp dword ptr [ebp+08], 00000004
:00408AF5 771B                    ja 00408B12
:00408AF7 8B4D08                  mov ecx, dword ptr [ebp+08]
:00408AFA 51                      push ecx
:00408AFB 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00408AFE E8F9E7FFFF              call 004072FC
:00408B03 25FF000000              and eax, 000000FF
:00408B08 8B55FC                  mov edx, dword ptr [ebp-04]
:00408B0B 03D0                    add edx, eax
:00408B0D D1EA                    shr edx, 1
:00408B0F 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408AF5(C)
|
:00408B12 8B45FC                  mov eax, dword ptr [ebp-04]
:00408B15 6BC00F                  imul eax, 0000000F
:00408B18 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00408B1B 03C8                    add ecx, eax
:00408B1D 894DF8                  mov dword ptr [ebp-08], ecx
:00408B20 6A0F                    push 0000000F
:00408B22 8B55F0                  mov edx, dword ptr [ebp-10]
:00408B25 52                      push edx
:00408B26 E8736F0700              call 0047FA9E
:00408B2B 83C408                  add esp, 00000008
:00408B2E 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00408A22(C), :00408AC0(U)
|
:00408B31 8B4508                  mov eax, dword ptr [ebp+08]
:00408B34 50                      push eax
:00408B35 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00408B38 33D2                    xor edx, edx
:00408B3A 8A512B                  mov dl, byte ptr [ecx+2B]
:00408B3D 8BCA                    mov ecx, edx
:00408B3F 6BC91B                  imul ecx, 0000001B
:00408B42 81C1A0BF4A00            add ecx, 004ABFA0
:00408B48 E8530A0000              call 004095A0
:00408B4D 25FF000000              and eax, 000000FF
:00408B52 8945FC                  mov dword ptr [ebp-04], eax
:00408B55 837D0804                cmp dword ptr [ebp+08], 00000004
:00408B59 771B                    ja 00408B76
:00408B5B 8B4508                  mov eax, dword ptr [ebp+08]
:00408B5E 50                      push eax
:00408B5F 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00408B62 E895E7FFFF              call 004072FC
:00408B67 25FF000000              and eax, 000000FF
:00408B6C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00408B6F 03C8                    add ecx, eax
:00408B71 D1E9                    shr ecx, 1
:00408B73 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408B59(C)
|
:00408B76 8B55F0                  mov edx, dword ptr [ebp-10]
:00408B79 0FAF55FC                imul edx, dword ptr [ebp-04]
:00408B7D 8B45F8                  mov eax, dword ptr [ebp-08]
:00408B80 03C2                    add eax, edx
:00408B82 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408A38(U)
|
:00408B85 EB53                    jmp 00408BDA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408A05(C)
|
:00408B87 8B4D08                  mov ecx, dword ptr [ebp+08]
:00408B8A 51                      push ecx
:00408B8B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00408B8E 81E1FF000000            and ecx, 000000FF
:00408B94 6BC91B                  imul ecx, 0000001B
:00408B97 81C1A0BF4A00            add ecx, 004ABFA0
:00408B9D E8FE090000              call 004095A0
:00408BA2 25FF000000              and eax, 000000FF
:00408BA7 8945FC                  mov dword ptr [ebp-04], eax
:00408BAA 837D0804                cmp dword ptr [ebp+08], 00000004
:00408BAE 771B                    ja 00408BCB
:00408BB0 8B5508                  mov edx, dword ptr [ebp+08]
:00408BB3 52                      push edx
:00408BB4 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00408BB7 E840E7FFFF              call 004072FC
:00408BBC 25FF000000              and eax, 000000FF
:00408BC1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00408BC4 03C8                    add ecx, eax
:00408BC6 D1E9                    shr ecx, 1
:00408BC8 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408BAE(C)
|
:00408BCB 8B55F0                  mov edx, dword ptr [ebp-10]
:00408BCE 0FAF55FC                imul edx, dword ptr [ebp-04]
:00408BD2 8B45F8                  mov eax, dword ptr [ebp-08]
:00408BD5 03C2                    add eax, edx
:00408BD7 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408B85(U)
|
:00408BDA 8B45F8                  mov eax, dword ptr [ebp-08]
:00408BDD 8BE5                    mov esp, ebp
:00408BDF 5D                      pop ebp
:00408BE0 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0041B630   , :0041B6C1   
|
:00408BE3 55                      push ebp
:00408BE4 8BEC                    mov ebp, esp
:00408BE6 83EC18                  sub esp, 00000018
:00408BE9 894DE8                  mov dword ptr [ebp-18], ecx
:00408BEC 8B4508                  mov eax, dword ptr [ebp+08]
:00408BEF 80CC10                  or ah, 10
:00408BF2 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00408BF5 668901                  mov word ptr [ecx], ax
:00408BF8 8B550C                  mov edx, dword ptr [ebp+0C]
:00408BFB 8955FC                  mov dword ptr [ebp-04], edx
:00408BFE 8B45E8                  mov eax, dword ptr [ebp-18]
:00408C01 83C008                  add eax, 00000008
:00408C04 8945F8                  mov dword ptr [ebp-08], eax
:00408C07 C745F000000000          mov [ebp-10], 00000000
:00408C0E EB09                    jmp 00408C19

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408C3B(U)
|
:00408C10 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00408C13 83C101                  add ecx, 00000001
:00408C16 894DF0                  mov dword ptr [ebp-10], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408C0E(U)
|
:00408C19 837DF00C                cmp dword ptr [ebp-10], 0000000C
:00408C1D 731E                    jnb 00408C3D
:00408C1F 8B55F8                  mov edx, dword ptr [ebp-08]
:00408C22 8B45FC                  mov eax, dword ptr [ebp-04]
:00408C25 8A08                    mov cl, byte ptr [eax]
:00408C27 880A                    mov byte ptr [edx], cl
:00408C29 8B55F8                  mov edx, dword ptr [ebp-08]
:00408C2C 83C201                  add edx, 00000001
:00408C2F 8955F8                  mov dword ptr [ebp-08], edx
:00408C32 8B45FC                  mov eax, dword ptr [ebp-04]
:00408C35 83C001                  add eax, 00000001
:00408C38 8945FC                  mov dword ptr [ebp-04], eax
:00408C3B EBD3                    jmp 00408C10

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408C1D(C)
|
:00408C3D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00408C40 C60100                  mov byte ptr [ecx], 00
:00408C43 8B550C                  mov edx, dword ptr [ebp+0C]
:00408C46 83C20D                  add edx, 0000000D
:00408C49 89550C                  mov dword ptr [ebp+0C], edx
:00408C4C 8B450C                  mov eax, dword ptr [ebp+0C]
:00408C4F 33C9                    xor ecx, ecx
:00408C51 8A08                    mov cl, byte ptr [eax]
:00408C53 894DF4                  mov dword ptr [ebp-0C], ecx
:00408C56 8B550C                  mov edx, dword ptr [ebp+0C]
:00408C59 83C201                  add edx, 00000001
:00408C5C 89550C                  mov dword ptr [ebp+0C], edx
:00408C5F 8B450C                  mov eax, dword ptr [ebp+0C]
:00408C62 33C9                    xor ecx, ecx
:00408C64 8A08                    mov cl, byte ptr [eax]
:00408C66 C1E108                  shl ecx, 08
:00408C69 8B55F4                  mov edx, dword ptr [ebp-0C]
:00408C6C 03D1                    add edx, ecx
:00408C6E 8955F4                  mov dword ptr [ebp-0C], edx
:00408C71 8B450C                  mov eax, dword ptr [ebp+0C]
:00408C74 83C001                  add eax, 00000001
:00408C77 89450C                  mov dword ptr [ebp+0C], eax
:00408C7A 837D1000                cmp dword ptr [ebp+10], 00000000
:00408C7E 751F                    jne 00408C9F
:00408C80 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00408C83 8B55F4                  mov edx, dword ptr [ebp-0C]
:00408C86 895104                  mov dword ptr [ecx+04], edx
:00408C89 8B45E8                  mov eax, dword ptr [ebp-18]
:00408C8C 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00408C8F 8A11                    mov dl, byte ptr [ecx]
:00408C91 885002                  mov byte ptr [eax+02], dl
:00408C94 8B450C                  mov eax, dword ptr [ebp+0C]
:00408C97 83C001                  add eax, 00000001
:00408C9A 89450C                  mov dword ptr [ebp+0C], eax
:00408C9D EB09                    jmp 00408CA8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408C7E(C)
|
:00408C9F 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00408CA2 83C101                  add ecx, 00000001
:00408CA5 894D0C                  mov dword ptr [ebp+0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408C9D(U)
|
:00408CA8 8B55E8                  mov edx, dword ptr [ebp-18]
:00408CAB 8B450C                  mov eax, dword ptr [ebp+0C]
:00408CAE 8A08                    mov cl, byte ptr [eax]
:00408CB0 884A26                  mov byte ptr [edx+26], cl
:00408CB3 8B550C                  mov edx, dword ptr [ebp+0C]
:00408CB6 83C201                  add edx, 00000001
:00408CB9 89550C                  mov dword ptr [ebp+0C], edx
:00408CBC 8B45E8                  mov eax, dword ptr [ebp-18]
:00408CBF 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00408CC2 8A11                    mov dl, byte ptr [ecx]
:00408CC4 88502A                  mov byte ptr [eax+2A], dl
:00408CC7 8B450C                  mov eax, dword ptr [ebp+0C]
:00408CCA 83C001                  add eax, 00000001
:00408CCD 89450C                  mov dword ptr [ebp+0C], eax
:00408CD0 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00408CD3 8B550C                  mov edx, dword ptr [ebp+0C]
:00408CD6 8A02                    mov al, byte ptr [edx]
:00408CD8 884115                  mov byte ptr [ecx+15], al
:00408CDB 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00408CDE 83C101                  add ecx, 00000001
:00408CE1 894D0C                  mov dword ptr [ebp+0C], ecx
:00408CE4 8B55E8                  mov edx, dword ptr [ebp-18]
:00408CE7 8B450C                  mov eax, dword ptr [ebp+0C]
:00408CEA 8A08                    mov cl, byte ptr [eax]
:00408CEC 884A16                  mov byte ptr [edx+16], cl
:00408CEF 8B550C                  mov edx, dword ptr [ebp+0C]
:00408CF2 83C201                  add edx, 00000001
:00408CF5 89550C                  mov dword ptr [ebp+0C], edx
:00408CF8 8B45E8                  mov eax, dword ptr [ebp-18]
:00408CFB 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00408CFE 8A11                    mov dl, byte ptr [ecx]
:00408D00 885017                  mov byte ptr [eax+17], dl
:00408D03 8B450C                  mov eax, dword ptr [ebp+0C]
:00408D06 83C001                  add eax, 00000001
:00408D09 89450C                  mov dword ptr [ebp+0C], eax
:00408D0C 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00408D0F 8B550C                  mov edx, dword ptr [ebp+0C]
:00408D12 8A02                    mov al, byte ptr [edx]
:00408D14 884118                  mov byte ptr [ecx+18], al
:00408D17 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00408D1A 83C101                  add ecx, 00000001
:00408D1D 894D0C                  mov dword ptr [ebp+0C], ecx
:00408D20 8B55E8                  mov edx, dword ptr [ebp-18]
:00408D23 8B450C                  mov eax, dword ptr [ebp+0C]
:00408D26 8A08                    mov cl, byte ptr [eax]
:00408D28 884A19                  mov byte ptr [edx+19], cl
:00408D2B 8B550C                  mov edx, dword ptr [ebp+0C]
:00408D2E 83C201                  add edx, 00000001
:00408D31 89550C                  mov dword ptr [ebp+0C], edx
:00408D34 8B45E8                  mov eax, dword ptr [ebp-18]
:00408D37 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00408D3A 8A5115                  mov dl, byte ptr [ecx+15]
:00408D3D 885021                  mov byte ptr [eax+21], dl
:00408D40 8B45E8                  mov eax, dword ptr [ebp-18]
:00408D43 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00408D46 8A5116                  mov dl, byte ptr [ecx+16]
:00408D49 885022                  mov byte ptr [eax+22], dl
:00408D4C 8B45E8                  mov eax, dword ptr [ebp-18]
:00408D4F 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00408D52 8A5117                  mov dl, byte ptr [ecx+17]
:00408D55 885023                  mov byte ptr [eax+23], dl
:00408D58 8B45E8                  mov eax, dword ptr [ebp-18]
:00408D5B 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00408D5E 8A5118                  mov dl, byte ptr [ecx+18]
:00408D61 885024                  mov byte ptr [eax+24], dl
:00408D64 8B45E8                  mov eax, dword ptr [ebp-18]
:00408D67 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00408D6A 8A5119                  mov dl, byte ptr [ecx+19]
:00408D6D 885025                  mov byte ptr [eax+25], dl
:00408D70 8B450C                  mov eax, dword ptr [ebp+0C]
:00408D73 33C9                    xor ecx, ecx
:00408D75 8A08                    mov cl, byte ptr [eax]
:00408D77 894DF4                  mov dword ptr [ebp-0C], ecx
:00408D7A 8B550C                  mov edx, dword ptr [ebp+0C]
:00408D7D 83C201                  add edx, 00000001
:00408D80 89550C                  mov dword ptr [ebp+0C], edx
:00408D83 8B450C                  mov eax, dword ptr [ebp+0C]
:00408D86 33C9                    xor ecx, ecx
:00408D88 8A08                    mov cl, byte ptr [eax]
:00408D8A C1E108                  shl ecx, 08
:00408D8D 8B55F4                  mov edx, dword ptr [ebp-0C]
:00408D90 03D1                    add edx, ecx
:00408D92 8955F4                  mov dword ptr [ebp-0C], edx
:00408D95 8B450C                  mov eax, dword ptr [ebp+0C]
:00408D98 83C001                  add eax, 00000001
:00408D9B 89450C                  mov dword ptr [ebp+0C], eax
:00408D9E 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00408DA1 8B55F4                  mov edx, dword ptr [ebp-0C]
:00408DA4 89511C                  mov dword ptr [ecx+1C], edx
:00408DA7 8B45E8                  mov eax, dword ptr [ebp-18]
:00408DAA 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00408DAD 8A11                    mov dl, byte ptr [ecx]
:00408DAF 885020                  mov byte ptr [eax+20], dl
:00408DB2 8B450C                  mov eax, dword ptr [ebp+0C]
:00408DB5 83C001                  add eax, 00000001
:00408DB8 89450C                  mov dword ptr [ebp+0C], eax
:00408DBB 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00408DBE C6412700                mov [ecx+27], 00
:00408DC2 8B55E8                  mov edx, dword ptr [ebp-18]
:00408DC5 C6422800                mov [edx+28], 00
:00408DC9 8B45E8                  mov eax, dword ptr [ebp-18]
:00408DCC C6402900                mov [eax+29], 00
:00408DD0 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00408DD3 8B550C                  mov edx, dword ptr [ebp+0C]
:00408DD6 8A02                    mov al, byte ptr [edx]
:00408DD8 88412B                  mov byte ptr [ecx+2B], al
:00408DDB 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00408DDE 83C101                  add ecx, 00000001
:00408DE1 894D0C                  mov dword ptr [ebp+0C], ecx
:00408DE4 8B55E8                  mov edx, dword ptr [ebp-18]
:00408DE7 8B450C                  mov eax, dword ptr [ebp+0C]
:00408DEA 8A08                    mov cl, byte ptr [eax]
:00408DEC 884A2C                  mov byte ptr [edx+2C], cl
:00408DEF 8B550C                  mov edx, dword ptr [ebp+0C]
:00408DF2 83C201                  add edx, 00000001
:00408DF5 89550C                  mov dword ptr [ebp+0C], edx
:00408DF8 8B45E8                  mov eax, dword ptr [ebp-18]
:00408DFB 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00408DFE 8A11                    mov dl, byte ptr [ecx]
:00408E00 88502D                  mov byte ptr [eax+2D], dl
:00408E03 8B450C                  mov eax, dword ptr [ebp+0C]
:00408E06 83C001                  add eax, 00000001
:00408E09 89450C                  mov dword ptr [ebp+0C], eax
:00408E0C C645EC00                mov [ebp-14], 00
:00408E10 EB09                    jmp 00408E1B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408EBE(U)
|
:00408E12 8A4DEC                  mov cl, byte ptr [ebp-14]
:00408E15 80C101                  add cl, 01
:00408E18 884DEC                  mov byte ptr [ebp-14], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408E10(U)
|
:00408E1B 8B55EC                  mov edx, dword ptr [ebp-14]
:00408E1E 81E2FF000000            and edx, 000000FF
:00408E24 83FA01                  cmp edx, 00000001
:00408E27 0F8F96000000            jg 00408EC3
:00408E2D 8B45EC                  mov eax, dword ptr [ebp-14]
:00408E30 25FF000000              and eax, 000000FF
:00408E35 6BC003                  imul eax, 00000003
:00408E38 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00408E3B 8B550C                  mov edx, dword ptr [ebp+0C]
:00408E3E 8A12                    mov dl, byte ptr [edx]
:00408E40 8854012E                mov byte ptr [ecx+eax+2E], dl
:00408E44 8B450C                  mov eax, dword ptr [ebp+0C]
:00408E47 83C001                  add eax, 00000001
:00408E4A 89450C                  mov dword ptr [ebp+0C], eax
:00408E4D 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00408E50 81E1FF000000            and ecx, 000000FF
:00408E56 6BC903                  imul ecx, 00000003
:00408E59 8B55E8                  mov edx, dword ptr [ebp-18]
:00408E5C 33C0                    xor eax, eax
:00408E5E 8A440A2E                mov al, byte ptr [edx+ecx+2E]
:00408E62 2DFF000000              sub eax, 000000FF
:00408E67 F7D8                    neg eax
:00408E69 1BC0                    sbb eax, eax
:00408E6B 2402                    and al, 02
:00408E6D 05FF000000              add eax, 000000FF
:00408E72 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00408E75 81E1FF000000            and ecx, 000000FF
:00408E7B 6BC903                  imul ecx, 00000003
:00408E7E 8B55E8                  mov edx, dword ptr [ebp-18]
:00408E81 88440A2F                mov byte ptr [edx+ecx+2F], al
:00408E85 8B45EC                  mov eax, dword ptr [ebp-14]
:00408E88 25FF000000              and eax, 000000FF
:00408E8D 6BC003                  imul eax, 00000003
:00408E90 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00408E93 33D2                    xor edx, edx
:00408E95 8A54012E                mov dl, byte ptr [ecx+eax+2E]
:00408E99 81EAFF000000            sub edx, 000000FF
:00408E9F F7DA                    neg edx
:00408EA1 1BD2                    sbb edx, edx
:00408EA3 80E201                  and dl, 01
:00408EA6 81C2FF000000            add edx, 000000FF
:00408EAC 8B45EC                  mov eax, dword ptr [ebp-14]
:00408EAF 25FF000000              and eax, 000000FF
:00408EB4 6BC003                  imul eax, 00000003
:00408EB7 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00408EBA 88540130                mov byte ptr [ecx+eax+30], dl
:00408EBE E94FFFFFFF              jmp 00408E12

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408E27(C)
|
:00408EC3 8B55E8                  mov edx, dword ptr [ebp-18]
:00408EC6 8B450C                  mov eax, dword ptr [ebp+0C]
:00408EC9 8A08                    mov cl, byte ptr [eax]
:00408ECB 884A34                  mov byte ptr [edx+34], cl
:00408ECE 8B550C                  mov edx, dword ptr [ebp+0C]
:00408ED1 83C201                  add edx, 00000001
:00408ED4 89550C                  mov dword ptr [ebp+0C], edx
:00408ED7 8B45E8                  mov eax, dword ptr [ebp-18]
:00408EDA C64035FF                mov [eax+35], FF
:00408EDE 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00408EE1 C64136FF                mov [ecx+36], FF
:00408EE5 8B55E8                  mov edx, dword ptr [ebp-18]
:00408EE8 817A1CF4010000          cmp dword ptr [edx+1C], 000001F4
:00408EEF 760A                    jbe 00408EFB
:00408EF1 8B45E8                  mov eax, dword ptr [ebp-18]
:00408EF4 C7401CF4010000          mov [eax+1C], 000001F4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408EEF(C)
|
:00408EFB 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00408EFE 33D2                    xor edx, edx
:00408F00 8A5120                  mov dl, byte ptr [ecx+20]
:00408F03 81FAFA000000            cmp edx, 000000FA
:00408F09 7E07                    jle 00408F12
:00408F0B 8B45E8                  mov eax, dword ptr [ebp-18]
:00408F0E C64020FA                mov [eax+20], FA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408F09(C)
|
:00408F12 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00408F15 33D2                    xor edx, edx
:00408F17 8A512C                  mov dl, byte ptr [ecx+2C]
:00408F1A 85D2                    test edx, edx
:00408F1C 7507                    jne 00408F25
:00408F1E 8B45E8                  mov eax, dword ptr [ebp-18]
:00408F21 C6402C01                mov [eax+2C], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408F1C(C)
|
:00408F25 8B450C                  mov eax, dword ptr [ebp+0C]
:00408F28 8BE5                    mov esp, ebp
:00408F2A 5D                      pop ebp
:00408F2B C20C00                  ret 000C



* Referenced by a CALL at Address:
|:0041B3AC   
|
:00408F2E 55                      push ebp
:00408F2F 8BEC                    mov ebp, esp
:00408F31 83EC08                  sub esp, 00000008
:00408F34 894DF8                  mov dword ptr [ebp-08], ecx
:00408F37 8B45F8                  mov eax, dword ptr [ebp-08]
:00408F3A 8B4804                  mov ecx, dword ptr [eax+04]
:00408F3D 81E1FF000000            and ecx, 000000FF
:00408F43 8B5508                  mov edx, dword ptr [ebp+08]
:00408F46 880A                    mov byte ptr [edx], cl
:00408F48 8B4508                  mov eax, dword ptr [ebp+08]
:00408F4B 83C001                  add eax, 00000001
:00408F4E 894508                  mov dword ptr [ebp+08], eax
:00408F51 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00408F54 8B5104                  mov edx, dword ptr [ecx+04]
:00408F57 C1EA08                  shr edx, 08
:00408F5A 8B4508                  mov eax, dword ptr [ebp+08]
:00408F5D 8810                    mov byte ptr [eax], dl
:00408F5F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00408F62 83C101                  add ecx, 00000001
:00408F65 894D08                  mov dword ptr [ebp+08], ecx
:00408F68 8B5508                  mov edx, dword ptr [ebp+08]
:00408F6B 8B45F8                  mov eax, dword ptr [ebp-08]
:00408F6E 8A4802                  mov cl, byte ptr [eax+02]
:00408F71 880A                    mov byte ptr [edx], cl
:00408F73 8B5508                  mov edx, dword ptr [ebp+08]
:00408F76 83C201                  add edx, 00000001
:00408F79 895508                  mov dword ptr [ebp+08], edx
:00408F7C 8B4508                  mov eax, dword ptr [ebp+08]
:00408F7F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00408F82 8A512A                  mov dl, byte ptr [ecx+2A]
:00408F85 8810                    mov byte ptr [eax], dl
:00408F87 8B4508                  mov eax, dword ptr [ebp+08]
:00408F8A 83C001                  add eax, 00000001
:00408F8D 894508                  mov dword ptr [ebp+08], eax
:00408F90 8B4D08                  mov ecx, dword ptr [ebp+08]
:00408F93 8B55F8                  mov edx, dword ptr [ebp-08]
:00408F96 8A4215                  mov al, byte ptr [edx+15]
:00408F99 8801                    mov byte ptr [ecx], al
:00408F9B 8B4D08                  mov ecx, dword ptr [ebp+08]
:00408F9E 83C101                  add ecx, 00000001
:00408FA1 894D08                  mov dword ptr [ebp+08], ecx
:00408FA4 8B5508                  mov edx, dword ptr [ebp+08]
:00408FA7 8B45F8                  mov eax, dword ptr [ebp-08]
:00408FAA 8A4816                  mov cl, byte ptr [eax+16]
:00408FAD 880A                    mov byte ptr [edx], cl
:00408FAF 8B5508                  mov edx, dword ptr [ebp+08]
:00408FB2 83C201                  add edx, 00000001
:00408FB5 895508                  mov dword ptr [ebp+08], edx
:00408FB8 8B4508                  mov eax, dword ptr [ebp+08]
:00408FBB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00408FBE 8A5117                  mov dl, byte ptr [ecx+17]
:00408FC1 8810                    mov byte ptr [eax], dl
:00408FC3 8B4508                  mov eax, dword ptr [ebp+08]
:00408FC6 83C001                  add eax, 00000001
:00408FC9 894508                  mov dword ptr [ebp+08], eax
:00408FCC 8B4D08                  mov ecx, dword ptr [ebp+08]
:00408FCF 8B55F8                  mov edx, dword ptr [ebp-08]
:00408FD2 8A4218                  mov al, byte ptr [edx+18]
:00408FD5 8801                    mov byte ptr [ecx], al
:00408FD7 8B4D08                  mov ecx, dword ptr [ebp+08]
:00408FDA 83C101                  add ecx, 00000001
:00408FDD 894D08                  mov dword ptr [ebp+08], ecx
:00408FE0 8B5508                  mov edx, dword ptr [ebp+08]
:00408FE3 8B45F8                  mov eax, dword ptr [ebp-08]
:00408FE6 8A4819                  mov cl, byte ptr [eax+19]
:00408FE9 880A                    mov byte ptr [edx], cl
:00408FEB 8B5508                  mov edx, dword ptr [ebp+08]
:00408FEE 83C201                  add edx, 00000001
:00408FF1 895508                  mov dword ptr [ebp+08], edx
:00408FF4 8B4508                  mov eax, dword ptr [ebp+08]
:00408FF7 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00408FFA 8A5121                  mov dl, byte ptr [ecx+21]
:00408FFD 8810                    mov byte ptr [eax], dl
:00408FFF 8B4508                  mov eax, dword ptr [ebp+08]
:00409002 83C001                  add eax, 00000001
:00409005 894508                  mov dword ptr [ebp+08], eax
:00409008 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040900B 8B55F8                  mov edx, dword ptr [ebp-08]
:0040900E 8A4222                  mov al, byte ptr [edx+22]
:00409011 8801                    mov byte ptr [ecx], al
:00409013 8B4D08                  mov ecx, dword ptr [ebp+08]
:00409016 83C101                  add ecx, 00000001
:00409019 894D08                  mov dword ptr [ebp+08], ecx
:0040901C 8B5508                  mov edx, dword ptr [ebp+08]
:0040901F 8B45F8                  mov eax, dword ptr [ebp-08]
:00409022 8A4823                  mov cl, byte ptr [eax+23]
:00409025 880A                    mov byte ptr [edx], cl
:00409027 8B5508                  mov edx, dword ptr [ebp+08]
:0040902A 83C201                  add edx, 00000001
:0040902D 895508                  mov dword ptr [ebp+08], edx
:00409030 8B4508                  mov eax, dword ptr [ebp+08]
:00409033 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00409036 8A5124                  mov dl, byte ptr [ecx+24]
:00409039 8810                    mov byte ptr [eax], dl
:0040903B 8B4508                  mov eax, dword ptr [ebp+08]
:0040903E 83C001                  add eax, 00000001
:00409041 894508                  mov dword ptr [ebp+08], eax
:00409044 8B4D08                  mov ecx, dword ptr [ebp+08]
:00409047 8B55F8                  mov edx, dword ptr [ebp-08]
:0040904A 8A4225                  mov al, byte ptr [edx+25]
:0040904D 8801                    mov byte ptr [ecx], al
:0040904F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00409052 83C101                  add ecx, 00000001
:00409055 894D08                  mov dword ptr [ebp+08], ecx
:00409058 8B55F8                  mov edx, dword ptr [ebp-08]
:0040905B 8B421C                  mov eax, dword ptr [edx+1C]
:0040905E 25FF000000              and eax, 000000FF
:00409063 8B4D08                  mov ecx, dword ptr [ebp+08]
:00409066 8801                    mov byte ptr [ecx], al
:00409068 8B5508                  mov edx, dword ptr [ebp+08]
:0040906B 83C201                  add edx, 00000001
:0040906E 895508                  mov dword ptr [ebp+08], edx
:00409071 8B45F8                  mov eax, dword ptr [ebp-08]
:00409074 8B481C                  mov ecx, dword ptr [eax+1C]
:00409077 C1E908                  shr ecx, 08
:0040907A 8B5508                  mov edx, dword ptr [ebp+08]
:0040907D 880A                    mov byte ptr [edx], cl
:0040907F 8B4508                  mov eax, dword ptr [ebp+08]
:00409082 83C001                  add eax, 00000001
:00409085 894508                  mov dword ptr [ebp+08], eax
:00409088 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040908B 8B55F8                  mov edx, dword ptr [ebp-08]
:0040908E 8A4220                  mov al, byte ptr [edx+20]
:00409091 8801                    mov byte ptr [ecx], al
:00409093 8B4D08                  mov ecx, dword ptr [ebp+08]
:00409096 83C101                  add ecx, 00000001
:00409099 894D08                  mov dword ptr [ebp+08], ecx
:0040909C 8B5508                  mov edx, dword ptr [ebp+08]
:0040909F 8B45F8                  mov eax, dword ptr [ebp-08]
:004090A2 8A482B                  mov cl, byte ptr [eax+2B]
:004090A5 880A                    mov byte ptr [edx], cl
:004090A7 8B5508                  mov edx, dword ptr [ebp+08]
:004090AA 83C201                  add edx, 00000001
:004090AD 895508                  mov dword ptr [ebp+08], edx
:004090B0 8B4508                  mov eax, dword ptr [ebp+08]
:004090B3 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004090B6 8A512C                  mov dl, byte ptr [ecx+2C]
:004090B9 8810                    mov byte ptr [eax], dl
:004090BB 8B4508                  mov eax, dword ptr [ebp+08]
:004090BE 83C001                  add eax, 00000001
:004090C1 894508                  mov dword ptr [ebp+08], eax
:004090C4 8B4D08                  mov ecx, dword ptr [ebp+08]
:004090C7 8B55F8                  mov edx, dword ptr [ebp-08]
:004090CA 8A422D                  mov al, byte ptr [edx+2D]
:004090CD 8801                    mov byte ptr [ecx], al
:004090CF 8B4D08                  mov ecx, dword ptr [ebp+08]
:004090D2 83C101                  add ecx, 00000001
:004090D5 894D08                  mov dword ptr [ebp+08], ecx
:004090D8 C745FC00000000          mov [ebp-04], 00000000
:004090DF EB09                    jmp 004090EA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409141(U)
|
:004090E1 8B55FC                  mov edx, dword ptr [ebp-04]
:004090E4 83C201                  add edx, 00000001
:004090E7 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004090DF(U)
|
:004090EA 837DFC03                cmp dword ptr [ebp-04], 00000003
:004090EE 7353                    jnb 00409143
:004090F0 8B45FC                  mov eax, dword ptr [ebp-04]
:004090F3 6BC003                  imul eax, 00000003
:004090F6 8B4D08                  mov ecx, dword ptr [ebp+08]
:004090F9 8B55F8                  mov edx, dword ptr [ebp-08]
:004090FC 8A44022E                mov al, byte ptr [edx+eax+2E]
:00409100 8801                    mov byte ptr [ecx], al
:00409102 8B4D08                  mov ecx, dword ptr [ebp+08]
:00409105 83C101                  add ecx, 00000001
:00409108 894D08                  mov dword ptr [ebp+08], ecx
:0040910B 8B55FC                  mov edx, dword ptr [ebp-04]
:0040910E 6BD203                  imul edx, 00000003
:00409111 8B4508                  mov eax, dword ptr [ebp+08]
:00409114 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00409117 8A54112F                mov dl, byte ptr [ecx+edx+2F]
:0040911B 8810                    mov byte ptr [eax], dl
:0040911D 8B4508                  mov eax, dword ptr [ebp+08]
:00409120 83C001                  add eax, 00000001
:00409123 894508                  mov dword ptr [ebp+08], eax
:00409126 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00409129 6BC903                  imul ecx, 00000003
:0040912C 8B5508                  mov edx, dword ptr [ebp+08]
:0040912F 8B45F8                  mov eax, dword ptr [ebp-08]
:00409132 8A4C0830                mov cl, byte ptr [eax+ecx+30]
:00409136 880A                    mov byte ptr [edx], cl
:00409138 8B5508                  mov edx, dword ptr [ebp+08]
:0040913B 83C201                  add edx, 00000001
:0040913E 895508                  mov dword ptr [ebp+08], edx
:00409141 EB9E                    jmp 004090E1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004090EE(C)
|
:00409143 8B4508                  mov eax, dword ptr [ebp+08]
:00409146 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00409149 8A5127                  mov dl, byte ptr [ecx+27]
:0040914C 8810                    mov byte ptr [eax], dl
:0040914E 8B4508                  mov eax, dword ptr [ebp+08]
:00409151 83C001                  add eax, 00000001
:00409154 894508                  mov dword ptr [ebp+08], eax
:00409157 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040915A 8B55F8                  mov edx, dword ptr [ebp-08]
:0040915D 8A4228                  mov al, byte ptr [edx+28]
:00409160 8801                    mov byte ptr [ecx], al
:00409162 8B4D08                  mov ecx, dword ptr [ebp+08]
:00409165 83C101                  add ecx, 00000001
:00409168 894D08                  mov dword ptr [ebp+08], ecx
:0040916B 8B5508                  mov edx, dword ptr [ebp+08]
:0040916E 8B45F8                  mov eax, dword ptr [ebp-08]
:00409171 8A4829                  mov cl, byte ptr [eax+29]
:00409174 880A                    mov byte ptr [edx], cl
:00409176 8B5508                  mov edx, dword ptr [ebp+08]
:00409179 83C201                  add edx, 00000001
:0040917C 895508                  mov dword ptr [ebp+08], edx
:0040917F 8B4508                  mov eax, dword ptr [ebp+08]
:00409182 8BE5                    mov esp, ebp
:00409184 5D                      pop ebp
:00409185 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0041B01A   
|
:00409188 55                      push ebp
:00409189 8BEC                    mov ebp, esp
:0040918B 83EC0C                  sub esp, 0000000C
:0040918E 894DF4                  mov dword ptr [ebp-0C], ecx
:00409191 8B4508                  mov eax, dword ptr [ebp+08]
:00409194 33C9                    xor ecx, ecx
:00409196 8A08                    mov cl, byte ptr [eax]
:00409198 894DFC                  mov dword ptr [ebp-04], ecx
:0040919B 8B5508                  mov edx, dword ptr [ebp+08]
:0040919E 83C201                  add edx, 00000001
:004091A1 895508                  mov dword ptr [ebp+08], edx
:004091A4 8B4508                  mov eax, dword ptr [ebp+08]
:004091A7 33C9                    xor ecx, ecx
:004091A9 8A08                    mov cl, byte ptr [eax]
:004091AB C1E108                  shl ecx, 08
:004091AE 8B55FC                  mov edx, dword ptr [ebp-04]
:004091B1 03D1                    add edx, ecx
:004091B3 8955FC                  mov dword ptr [ebp-04], edx
:004091B6 8B4508                  mov eax, dword ptr [ebp+08]
:004091B9 83C001                  add eax, 00000001
:004091BC 894508                  mov dword ptr [ebp+08], eax
:004091BF 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004091C2 8B55FC                  mov edx, dword ptr [ebp-04]
:004091C5 895104                  mov dword ptr [ecx+04], edx
:004091C8 8B45F4                  mov eax, dword ptr [ebp-0C]
:004091CB 8B4D08                  mov ecx, dword ptr [ebp+08]
:004091CE 8A11                    mov dl, byte ptr [ecx]
:004091D0 885002                  mov byte ptr [eax+02], dl
:004091D3 8B4508                  mov eax, dword ptr [ebp+08]
:004091D6 83C001                  add eax, 00000001
:004091D9 894508                  mov dword ptr [ebp+08], eax
:004091DC 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004091DF 8B5508                  mov edx, dword ptr [ebp+08]
:004091E2 8A02                    mov al, byte ptr [edx]
:004091E4 88412A                  mov byte ptr [ecx+2A], al
:004091E7 8B4D08                  mov ecx, dword ptr [ebp+08]
:004091EA 83C101                  add ecx, 00000001
:004091ED 894D08                  mov dword ptr [ebp+08], ecx
:004091F0 8B55F4                  mov edx, dword ptr [ebp-0C]
:004091F3 8B4508                  mov eax, dword ptr [ebp+08]
:004091F6 8A08                    mov cl, byte ptr [eax]
:004091F8 884A15                  mov byte ptr [edx+15], cl
:004091FB 8B5508                  mov edx, dword ptr [ebp+08]
:004091FE 83C201                  add edx, 00000001
:00409201 895508                  mov dword ptr [ebp+08], edx
:00409204 8B45F4                  mov eax, dword ptr [ebp-0C]
:00409207 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040920A 8A11                    mov dl, byte ptr [ecx]
:0040920C 885016                  mov byte ptr [eax+16], dl
:0040920F 8B4508                  mov eax, dword ptr [ebp+08]
:00409212 83C001                  add eax, 00000001
:00409215 894508                  mov dword ptr [ebp+08], eax
:00409218 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040921B 8B5508                  mov edx, dword ptr [ebp+08]
:0040921E 8A02                    mov al, byte ptr [edx]
:00409220 884117                  mov byte ptr [ecx+17], al
:00409223 8B4D08                  mov ecx, dword ptr [ebp+08]
:00409226 83C101                  add ecx, 00000001
:00409229 894D08                  mov dword ptr [ebp+08], ecx
:0040922C 8B55F4                  mov edx, dword ptr [ebp-0C]
:0040922F 8B4508                  mov eax, dword ptr [ebp+08]
:00409232 8A08                    mov cl, byte ptr [eax]
:00409234 884A18                  mov byte ptr [edx+18], cl
:00409237 8B5508                  mov edx, dword ptr [ebp+08]
:0040923A 83C201                  add edx, 00000001
:0040923D 895508                  mov dword ptr [ebp+08], edx
:00409240 8B45F4                  mov eax, dword ptr [ebp-0C]
:00409243 8B4D08                  mov ecx, dword ptr [ebp+08]
:00409246 8A11                    mov dl, byte ptr [ecx]
:00409248 885019                  mov byte ptr [eax+19], dl
:0040924B 8B4508                  mov eax, dword ptr [ebp+08]
:0040924E 83C001                  add eax, 00000001
:00409251 894508                  mov dword ptr [ebp+08], eax
:00409254 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00409257 8B5508                  mov edx, dword ptr [ebp+08]
:0040925A 8A02                    mov al, byte ptr [edx]
:0040925C 884121                  mov byte ptr [ecx+21], al
:0040925F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00409262 83C101                  add ecx, 00000001
:00409265 894D08                  mov dword ptr [ebp+08], ecx
:00409268 8B55F4                  mov edx, dword ptr [ebp-0C]
:0040926B 8B4508                  mov eax, dword ptr [ebp+08]
:0040926E 8A08                    mov cl, byte ptr [eax]
:00409270 884A22                  mov byte ptr [edx+22], cl
:00409273 8B5508                  mov edx, dword ptr [ebp+08]
:00409276 83C201                  add edx, 00000001
:00409279 895508                  mov dword ptr [ebp+08], edx
:0040927C 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040927F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00409282 8A11                    mov dl, byte ptr [ecx]
:00409284 885023                  mov byte ptr [eax+23], dl
:00409287 8B4508                  mov eax, dword ptr [ebp+08]
:0040928A 83C001                  add eax, 00000001
:0040928D 894508                  mov dword ptr [ebp+08], eax
:00409290 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00409293 8B5508                  mov edx, dword ptr [ebp+08]
:00409296 8A02                    mov al, byte ptr [edx]
:00409298 884124                  mov byte ptr [ecx+24], al
:0040929B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040929E 83C101                  add ecx, 00000001
:004092A1 894D08                  mov dword ptr [ebp+08], ecx
:004092A4 8B55F4                  mov edx, dword ptr [ebp-0C]
:004092A7 8B4508                  mov eax, dword ptr [ebp+08]
:004092AA 8A08                    mov cl, byte ptr [eax]
:004092AC 884A25                  mov byte ptr [edx+25], cl
:004092AF 8B5508                  mov edx, dword ptr [ebp+08]
:004092B2 83C201                  add edx, 00000001
:004092B5 895508                  mov dword ptr [ebp+08], edx
:004092B8 8B4508                  mov eax, dword ptr [ebp+08]
:004092BB 33C9                    xor ecx, ecx
:004092BD 8A08                    mov cl, byte ptr [eax]
:004092BF 894DFC                  mov dword ptr [ebp-04], ecx
:004092C2 8B5508                  mov edx, dword ptr [ebp+08]
:004092C5 83C201                  add edx, 00000001
:004092C8 895508                  mov dword ptr [ebp+08], edx
:004092CB 8B4508                  mov eax, dword ptr [ebp+08]
:004092CE 33C9                    xor ecx, ecx
:004092D0 8A08                    mov cl, byte ptr [eax]
:004092D2 C1E108                  shl ecx, 08
:004092D5 8B55FC                  mov edx, dword ptr [ebp-04]
:004092D8 03D1                    add edx, ecx
:004092DA 8955FC                  mov dword ptr [ebp-04], edx
:004092DD 8B4508                  mov eax, dword ptr [ebp+08]
:004092E0 83C001                  add eax, 00000001
:004092E3 894508                  mov dword ptr [ebp+08], eax
:004092E6 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004092E9 8B55FC                  mov edx, dword ptr [ebp-04]
:004092EC 89511C                  mov dword ptr [ecx+1C], edx
:004092EF 8B45F4                  mov eax, dword ptr [ebp-0C]
:004092F2 8B4D08                  mov ecx, dword ptr [ebp+08]
:004092F5 8A11                    mov dl, byte ptr [ecx]
:004092F7 885020                  mov byte ptr [eax+20], dl
:004092FA 8B4508                  mov eax, dword ptr [ebp+08]
:004092FD 83C001                  add eax, 00000001
:00409300 894508                  mov dword ptr [ebp+08], eax
:00409303 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00409306 8B5508                  mov edx, dword ptr [ebp+08]
:00409309 8A02                    mov al, byte ptr [edx]
:0040930B 88412B                  mov byte ptr [ecx+2B], al
:0040930E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00409311 83C101                  add ecx, 00000001
:00409314 894D08                  mov dword ptr [ebp+08], ecx
:00409317 8B55F4                  mov edx, dword ptr [ebp-0C]
:0040931A 8B4508                  mov eax, dword ptr [ebp+08]
:0040931D 8A08                    mov cl, byte ptr [eax]
:0040931F 884A2C                  mov byte ptr [edx+2C], cl
:00409322 8B5508                  mov edx, dword ptr [ebp+08]
:00409325 83C201                  add edx, 00000001
:00409328 895508                  mov dword ptr [ebp+08], edx
:0040932B 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040932E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00409331 8A11                    mov dl, byte ptr [ecx]
:00409333 88502D                  mov byte ptr [eax+2D], dl
:00409336 8B4508                  mov eax, dword ptr [ebp+08]
:00409339 83C001                  add eax, 00000001
:0040933C 894508                  mov dword ptr [ebp+08], eax
:0040933F C745F800000000          mov [ebp-08], 00000000
:00409346 EB09                    jmp 00409351

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004093A8(U)
|
:00409348 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040934B 83C101                  add ecx, 00000001
:0040934E 894DF8                  mov dword ptr [ebp-08], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409346(U)
|
:00409351 837DF803                cmp dword ptr [ebp-08], 00000003
:00409355 7353                    jnb 004093AA
:00409357 8B55F8                  mov edx, dword ptr [ebp-08]
:0040935A 6BD203                  imul edx, 00000003
:0040935D 8B45F4                  mov eax, dword ptr [ebp-0C]
:00409360 8B4D08                  mov ecx, dword ptr [ebp+08]
:00409363 8A09                    mov cl, byte ptr [ecx]
:00409365 884C102E                mov byte ptr [eax+edx+2E], cl
:00409369 8B5508                  mov edx, dword ptr [ebp+08]
:0040936C 83C201                  add edx, 00000001
:0040936F 895508                  mov dword ptr [ebp+08], edx
:00409372 8B45F8                  mov eax, dword ptr [ebp-08]
:00409375 6BC003                  imul eax, 00000003
:00409378 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040937B 8B5508                  mov edx, dword ptr [ebp+08]
:0040937E 8A12                    mov dl, byte ptr [edx]
:00409380 8854012F                mov byte ptr [ecx+eax+2F], dl
:00409384 8B4508                  mov eax, dword ptr [ebp+08]
:00409387 83C001                  add eax, 00000001
:0040938A 894508                  mov dword ptr [ebp+08], eax
:0040938D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00409390 6BC903                  imul ecx, 00000003
:00409393 8B55F4                  mov edx, dword ptr [ebp-0C]
:00409396 8B4508                  mov eax, dword ptr [ebp+08]
:00409399 8A00                    mov al, byte ptr [eax]
:0040939B 88440A30                mov byte ptr [edx+ecx+30], al
:0040939F 8B4D08                  mov ecx, dword ptr [ebp+08]
:004093A2 83C101                  add ecx, 00000001
:004093A5 894D08                  mov dword ptr [ebp+08], ecx
:004093A8 EB9E                    jmp 00409348

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409355(C)
|
:004093AA 8B55F4                  mov edx, dword ptr [ebp-0C]
:004093AD 8B4508                  mov eax, dword ptr [ebp+08]
:004093B0 8A08                    mov cl, byte ptr [eax]
:004093B2 884A27                  mov byte ptr [edx+27], cl
:004093B5 8B5508                  mov edx, dword ptr [ebp+08]
:004093B8 83C201                  add edx, 00000001
:004093BB 895508                  mov dword ptr [ebp+08], edx
:004093BE 8B45F4                  mov eax, dword ptr [ebp-0C]
:004093C1 8B4D08                  mov ecx, dword ptr [ebp+08]
:004093C4 8A11                    mov dl, byte ptr [ecx]
:004093C6 885028                  mov byte ptr [eax+28], dl
:004093C9 8B4508                  mov eax, dword ptr [ebp+08]
:004093CC 83C001                  add eax, 00000001
:004093CF 894508                  mov dword ptr [ebp+08], eax
:004093D2 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004093D5 8B5508                  mov edx, dword ptr [ebp+08]
:004093D8 8A02                    mov al, byte ptr [edx]
:004093DA 884129                  mov byte ptr [ecx+29], al
:004093DD 8B4D08                  mov ecx, dword ptr [ebp+08]
:004093E0 83C101                  add ecx, 00000001
:004093E3 894D08                  mov dword ptr [ebp+08], ecx
:004093E6 8B4508                  mov eax, dword ptr [ebp+08]
:004093E9 8BE5                    mov esp, ebp
:004093EB 5D                      pop ebp
:004093EC C20400                  ret 0004



* Referenced by a CALL at Address:
|:0041B781   
|
:004093EF 55                      push ebp
:004093F0 8BEC                    mov ebp, esp
:004093F2 83EC08                  sub esp, 00000008
:004093F5 894DF8                  mov dword ptr [ebp-08], ecx
:004093F8 8B45F8                  mov eax, dword ptr [ebp-08]
:004093FB 8B4D08                  mov ecx, dword ptr [ebp+08]
:004093FE 8A11                    mov dl, byte ptr [ecx]
:00409400 8810                    mov byte ptr [eax], dl
:00409402 8B4508                  mov eax, dword ptr [ebp+08]
:00409405 83C001                  add eax, 00000001
:00409408 894508                  mov dword ptr [ebp+08], eax
:0040940B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040940E 8B5508                  mov edx, dword ptr [ebp+08]
:00409411 8A02                    mov al, byte ptr [edx]
:00409413 884101                  mov byte ptr [ecx+01], al
:00409416 8B4D08                  mov ecx, dword ptr [ebp+08]
:00409419 83C101                  add ecx, 00000001
:0040941C 894D08                  mov dword ptr [ebp+08], ecx
:0040941F C745FC00000000          mov [ebp-04], 00000000
:00409426 EB09                    jmp 00409431

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040944E(U)
|
:00409428 8B55FC                  mov edx, dword ptr [ebp-04]
:0040942B 83C201                  add edx, 00000001
:0040942E 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409426(U)
|
:00409431 837DFC07                cmp dword ptr [ebp-04], 00000007
:00409435 7319                    jnb 00409450
:00409437 8B45F8                  mov eax, dword ptr [ebp-08]
:0040943A 0345FC                  add eax, dword ptr [ebp-04]
:0040943D 8B4D08                  mov ecx, dword ptr [ebp+08]
:00409440 8A11                    mov dl, byte ptr [ecx]
:00409442 885002                  mov byte ptr [eax+02], dl
:00409445 8B4508                  mov eax, dword ptr [ebp+08]
:00409448 83C001                  add eax, 00000001
:0040944B 894508                  mov dword ptr [ebp+08], eax
:0040944E EBD8                    jmp 00409428

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409435(C)
|
:00409450 C745FC00000000          mov [ebp-04], 00000000
:00409457 EB09                    jmp 00409462

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040947F(U)
|
:00409459 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040945C 83C101                  add ecx, 00000001
:0040945F 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409457(U)
|
:00409462 837DFC12                cmp dword ptr [ebp-04], 00000012
:00409466 7319                    jnb 00409481
:00409468 8B55F8                  mov edx, dword ptr [ebp-08]
:0040946B 0355FC                  add edx, dword ptr [ebp-04]
:0040946E 8B4508                  mov eax, dword ptr [ebp+08]
:00409471 8A08                    mov cl, byte ptr [eax]
:00409473 884A09                  mov byte ptr [edx+09], cl
:00409476 8B5508                  mov edx, dword ptr [ebp+08]
:00409479 83C201                  add edx, 00000001
:0040947C 895508                  mov dword ptr [ebp+08], edx
:0040947F EBD8                    jmp 00409459

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409466(C)
|
:00409481 8B4508                  mov eax, dword ptr [ebp+08]
:00409484 8BE5                    mov esp, ebp
:00409486 5D                      pop ebp
:00409487 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0041B7E1   
|
:0040948A 55                      push ebp
:0040948B 8BEC                    mov ebp, esp
:0040948D 83EC08                  sub esp, 00000008
:00409490 894DF8                  mov dword ptr [ebp-08], ecx
:00409493 C745FC00000000          mov [ebp-04], 00000000
:0040949A EB09                    jmp 004094A5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004094C1(U)
|
:0040949C 8B45FC                  mov eax, dword ptr [ebp-04]
:0040949F 83C001                  add eax, 00000001
:004094A2 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040949A(U)
|
:004094A5 837DFC1E                cmp dword ptr [ebp-04], 0000001E
:004094A9 7318                    jnb 004094C3
:004094AB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004094AE 034DFC                  add ecx, dword ptr [ebp-04]
:004094B1 8B5508                  mov edx, dword ptr [ebp+08]
:004094B4 8A02                    mov al, byte ptr [edx]
:004094B6 8801                    mov byte ptr [ecx], al
:004094B8 8B4D08                  mov ecx, dword ptr [ebp+08]
:004094BB 83C101                  add ecx, 00000001
:004094BE 894D08                  mov dword ptr [ebp+08], ecx
:004094C1 EBD9                    jmp 0040949C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004094A9(C)
|
:004094C3 C745FC00000000          mov [ebp-04], 00000000
:004094CA EB09                    jmp 004094D5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004094F2(U)
|
:004094CC 8B55FC                  mov edx, dword ptr [ebp-04]
:004094CF 83C201                  add edx, 00000001
:004094D2 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004094CA(U)
|
:004094D5 837DFC1E                cmp dword ptr [ebp-04], 0000001E
:004094D9 7319                    jnb 004094F4
:004094DB 8B45F8                  mov eax, dword ptr [ebp-08]
:004094DE 0345FC                  add eax, dword ptr [ebp-04]
:004094E1 8B4D08                  mov ecx, dword ptr [ebp+08]
:004094E4 8A11                    mov dl, byte ptr [ecx]
:004094E6 88501E                  mov byte ptr [eax+1E], dl
:004094E9 8B4508                  mov eax, dword ptr [ebp+08]
:004094EC 83C001                  add eax, 00000001
:004094EF 894508                  mov dword ptr [ebp+08], eax
:004094F2 EBD8                    jmp 004094CC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004094D9(C)
|
:004094F4 8B4508                  mov eax, dword ptr [ebp+08]
:004094F7 8BE5                    mov esp, ebp
:004094F9 5D                      pop ebp
:004094FA C20400                  ret 0004


:004094FD CC                      int 03
:004094FE CC                      int 03
:004094FF CC                      int 03

* Referenced by a CALL at Addresses:
|:00406A27   , :004073C4   , :004075B3   , :00407FA9   , :004083A1   
|:0040895C   , :0041872B   , :0041881A   , :0041D6DA   , :0045C4B3   
|:0045D7D6   , :00468E01   , :0046BF86   , :00477B4B   , :00477E5E   
|:004784A2   , :00478972   , :00479FDB   , :00479FE5   , :0047A7F3   
|:0047AE05   
|
:00409500 55                      push ebp
:00409501 8BEC                    mov ebp, esp
:00409503 51                      push ecx
:00409504 894DFC                  mov dword ptr [ebp-04], ecx
:00409507 8B45FC                  mov eax, dword ptr [ebp-04]
:0040950A 33C9                    xor ecx, ecx
:0040950C 668B08                  mov cx, word ptr [eax]
:0040950F 8BC1                    mov eax, ecx
:00409511 80E40F                  and ah, 0F
:00409514 8BE5                    mov esp, ebp
:00409516 5D                      pop ebp
:00409517 C3                      ret


:00409518 CC                      int 03
:00409519 CC                      int 03
:0040951A CC                      int 03
:0040951B CC                      int 03
:0040951C CC                      int 03
:0040951D CC                      int 03
:0040951E CC                      int 03
:0040951F CC                      int 03

* Referenced by a CALL at Addresses:
|:004067A0   , :00407A79   , :00407B6E   
|
:00409520 55                      push ebp
:00409521 8BEC                    mov ebp, esp
:00409523 51                      push ecx
:00409524 894DFC                  mov dword ptr [ebp-04], ecx
:00409527 8B45FC                  mov eax, dword ptr [ebp-04]
:0040952A 8A4014                  mov al, byte ptr [eax+14]
:0040952D 8BE5                    mov esp, ebp
:0040952F 5D                      pop ebp
:00409530 C3                      ret


:00409531 CC                      int 03
:00409532 CC                      int 03
:00409533 CC                      int 03
:00409534 CC                      int 03
:00409535 CC                      int 03
:00409536 CC                      int 03
:00409537 CC                      int 03
:00409538 CC                      int 03
:00409539 CC                      int 03
:0040953A CC                      int 03
:0040953B CC                      int 03
:0040953C CC                      int 03
:0040953D CC                      int 03
:0040953E CC                      int 03
:0040953F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040682A   , :004075C0   , :004079D5   , :00407ACC   , :00407BD4   
|:0040D59A   , :00417007   , :0041C502   , :0041DBE9   , :0041FFE3   
|:004200FE   , :00420218   , :00420333   , :0043C460   , :004408B8   
|:00440B7B   , :00441297   , :00461F23   , :004672EF   , :0046730C   
|
:00409540 55                      push ebp
:00409541 8BEC                    mov ebp, esp
:00409543 51                      push ecx
:00409544 894DFC                  mov dword ptr [ebp-04], ecx
:00409547 8B45FC                  mov eax, dword ptr [ebp-04]
:0040954A 8A4011                  mov al, byte ptr [eax+11]
:0040954D 8BE5                    mov esp, ebp
:0040954F 5D                      pop ebp
:00409550 C3                      ret


:00409551 CC                      int 03
:00409552 CC                      int 03
:00409553 CC                      int 03
:00409554 CC                      int 03
:00409555 CC                      int 03
:00409556 CC                      int 03
:00409557 CC                      int 03
:00409558 CC                      int 03
:00409559 CC                      int 03
:0040955A CC                      int 03
:0040955B CC                      int 03
:0040955C CC                      int 03
:0040955D CC                      int 03
:0040955E CC                      int 03
:0040955F CC                      int 03

* Referenced by a CALL at Addresses:
|:004075D7   , :004428C5   
|
:00409560 55                      push ebp
:00409561 8BEC                    mov ebp, esp
:00409563 51                      push ecx
:00409564 894DFC                  mov dword ptr [ebp-04], ecx
:00409567 8B45FC                  mov eax, dword ptr [ebp-04]
:0040956A 8A4006                  mov al, byte ptr [eax+06]
:0040956D 8BE5                    mov esp, ebp
:0040956F 5D                      pop ebp
:00409570 C3                      ret


:00409571 CC                      int 03
:00409572 CC                      int 03
:00409573 CC                      int 03
:00409574 CC                      int 03
:00409575 CC                      int 03
:00409576 CC                      int 03
:00409577 CC                      int 03
:00409578 CC                      int 03
:00409579 CC                      int 03
:0040957A CC                      int 03
:0040957B CC                      int 03
:0040957C CC                      int 03
:0040957D CC                      int 03
:0040957E CC                      int 03
:0040957F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040755C   , :0041DACC   , :0041DB01   , :0041DB32   , :0043847B   
|:004384A9   , :0043DFAE   , :0043DFEB   , :0043E07D   , :0043E0A7   
|:00465977   , :0046599A   , :00465C66   , :00465CAD   , :00465D5C   
|:00465D8C   
|
:00409580 55                      push ebp
:00409581 8BEC                    mov ebp, esp
:00409583 51                      push ecx
:00409584 894DFC                  mov dword ptr [ebp-04], ecx
:00409587 8B45FC                  mov eax, dword ptr [ebp-04]
:0040958A 034508                  add eax, dword ptr [ebp+08]
:0040958D 8A4011                  mov al, byte ptr [eax+11]
:00409590 8BE5                    mov esp, ebp
:00409592 5D                      pop ebp
:00409593 C20400                  ret 0004


:00409596 CC                      int 03
:00409597 CC                      int 03
:00409598 CC                      int 03
:00409599 CC                      int 03
:0040959A CC                      int 03
:0040959B CC                      int 03
:0040959C CC                      int 03
:0040959D CC                      int 03
:0040959E CC                      int 03
:0040959F CC                      int 03

* Referenced by a CALL at Addresses:
|:00407436   , :00408A68   , :00408AE4   , :00408B48   , :00408B9D   
|:0041D61C   , :0041D645   , :00477CF2   , :00477D2B   , :00477D64   
|:00477D9B   , :00477DD4   
|
:004095A0 55                      push ebp
:004095A1 8BEC                    mov ebp, esp
:004095A3 51                      push ecx
:004095A4 894DFC                  mov dword ptr [ebp-04], ecx
:004095A7 8B45FC                  mov eax, dword ptr [ebp-04]
:004095AA 034508                  add eax, dword ptr [ebp+08]
:004095AD 8A4002                  mov al, byte ptr [eax+02]
:004095B0 8BE5                    mov esp, ebp
:004095B2 5D                      pop ebp
:004095B3 C20400                  ret 0004


:004095B6 CC                      int 03
:004095B7 CC                      int 03
:004095B8 CC                      int 03
:004095B9 CC                      int 03
:004095BA CC                      int 03
:004095BB CC                      int 03
:004095BC CC                      int 03
:004095BD CC                      int 03
:004095BE CC                      int 03
:004095BF CC                      int 03

* Referenced by a CALL at Addresses:
|:004079F8   , :0040815F   , :0040823D   , :0040CACC   , :00477C03   
|:00477C90   
|
:004095C0 55                      push ebp
:004095C1 8BEC                    mov ebp, esp
:004095C3 51                      push ecx
:004095C4 894DFC                  mov dword ptr [ebp-04], ecx
:004095C7 8B45FC                  mov eax, dword ptr [ebp-04]
:004095CA 034508                  add eax, dword ptr [ebp+08]
:004095CD 8A4009                  mov al, byte ptr [eax+09]
:004095D0 8BE5                    mov esp, ebp
:004095D2 5D                      pop ebp
:004095D3 C20400                  ret 0004


:004095D6 CC                      int 03
:004095D7 CC                      int 03
:004095D8 CC                      int 03
:004095D9 CC                      int 03
:004095DA CC                      int 03
:004095DB CC                      int 03
:004095DC CC                      int 03
:004095DD CC                      int 03
:004095DE CC                      int 03
:004095DF CC                      int 03

* Referenced by a CALL at Addresses:
|:00407C88   , :0040833C   , :0040845A   , :00466DE1   , :00468D1C   
|:00468F14   , :00468F85   , :0046951E   , :0046A8E7   , :00476F2B   
|:00476F7E   , :004770DD   , :00477130   , :0047728D   , :00477587   
|
:004095E0 55                      push ebp
:004095E1 8BEC                    mov ebp, esp
:004095E3 51                      push ecx
:004095E4 894DFC                  mov dword ptr [ebp-04], ecx
:004095E7 8B4508                  mov eax, dword ptr [ebp+08]
:004095EA 25FF000000              and eax, 000000FF
:004095EF 6BC003                  imul eax, 00000003
:004095F2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004095F5 8A44012F                mov al, byte ptr [ecx+eax+2F]
:004095F9 8BE5                    mov esp, ebp
:004095FB 5D                      pop ebp
:004095FC C20400                  ret 0004


:004095FF CC                      int 03

* Referenced by a CALL at Addresses:
|:00407FC7   , :004146B1   , :00416C69   , :00434ECA   , :00435082   
|:00470782   
|
:00409600 55                      push ebp
:00409601 8BEC                    mov ebp, esp
:00409603 51                      push ecx
:00409604 894DFC                  mov dword ptr [ebp-04], ecx
:00409607 8B45FC                  mov eax, dword ptr [ebp-04]
:0040960A 33C9                    xor ecx, ecx
:0040960C 8A4818                  mov cl, byte ptr [eax+18]
:0040960F 8BC1                    mov eax, ecx
:00409611 8BE5                    mov esp, ebp
:00409613 5D                      pop ebp
:00409614 C3                      ret


:00409615 CC                      int 03
:00409616 CC                      int 03
:00409617 CC                      int 03
:00409618 CC                      int 03
:00409619 CC                      int 03
:0040961A CC                      int 03
:0040961B CC                      int 03
:0040961C CC                      int 03
:0040961D CC                      int 03
:0040961E CC                      int 03
:0040961F CC                      int 03

* Referenced by a CALL at Address:
|:00408395   
|
:00409620 55                      push ebp
:00409621 8BEC                    mov ebp, esp
:00409623 51                      push ecx
:00409624 894DFC                  mov dword ptr [ebp-04], ecx
:00409627 8B4508                  mov eax, dword ptr [ebp+08]
:0040962A 25FF000000              and eax, 000000FF
:0040962F 6BC003                  imul eax, 00000003
:00409632 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00409635 8A550C                  mov dl, byte ptr [ebp+0C]
:00409638 8854012F                mov byte ptr [ecx+eax+2F], dl
:0040963C 8BE5                    mov esp, ebp
:0040963E 5D                      pop ebp
:0040963F C20800                  ret 0008


:00409642 CC                      int 03
:00409643 CC                      int 03
:00409644 CC                      int 03
:00409645 CC                      int 03
:00409646 CC                      int 03
:00409647 CC                      int 03
:00409648 CC                      int 03
:00409649 CC                      int 03
:0040964A CC                      int 03
:0040964B CC                      int 03
:0040964C CC                      int 03
:0040964D CC                      int 03
:0040964E CC                      int 03
:0040964F CC                      int 03

* Referenced by a CALL at Addresses:
|:004083D2   , :004083E4   
|
:00409650 55                      push ebp
:00409651 8BEC                    mov ebp, esp
:00409653 51                      push ecx
:00409654 894DFC                  mov dword ptr [ebp-04], ecx
:00409657 8B4508                  mov eax, dword ptr [ebp+08]
:0040965A 25FF000000              and eax, 000000FF
:0040965F 6BC003                  imul eax, 00000003
:00409662 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00409665 8A550C                  mov dl, byte ptr [ebp+0C]
:00409668 88540130                mov byte ptr [ecx+eax+30], dl
:0040966C 8BE5                    mov esp, ebp
:0040966E 5D                      pop ebp
:0040966F C20800                  ret 0008


:00409672 CC                      int 03
:00409673 CC                      int 03
:00409674 CC                      int 03
:00409675 CC                      int 03
:00409676 CC                      int 03
:00409677 CC                      int 03
:00409678 CC                      int 03
:00409679 CC                      int 03
:0040967A CC                      int 03
:0040967B CC                      int 03
:0040967C CC                      int 03
:0040967D CC                      int 03
:0040967E CC                      int 03
:0040967F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040834B   , :00450180   , :004501AC   , :004501C5   , :004501E4   
|:00450210   , :00450229   , :004505B7   , :00450611   , :004508A3   
|:00450909   , :00466E03   , :00468D2E   , :00469533   , :0046A8D7   
|:00477567   , :004776B0   , :004776C2   
|
:00409680 55                      push ebp
:00409681 8BEC                    mov ebp, esp
:00409683 51                      push ecx
:00409684 894DFC                  mov dword ptr [ebp-04], ecx
:00409687 8B4508                  mov eax, dword ptr [ebp+08]
:0040968A 25FF000000              and eax, 000000FF
:0040968F 6BC003                  imul eax, 00000003
:00409692 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00409695 8A440130                mov al, byte ptr [ecx+eax+30]
:00409699 8BE5                    mov esp, ebp
:0040969B 5D                      pop ebp
:0040969C C20400                  ret 0004


:0040969F CC                      int 03

* Referenced by a CALL at Addresses:
|:00409F94   , :0040A16B   , :0040A549   , :0040AAD8   , :0040B40B   
|
:004096A0 55                      push ebp
:004096A1 8BEC                    mov ebp, esp
:004096A3 83EC08                  sub esp, 00000008
:004096A6 33C0                    xor eax, eax
:004096A8 837D0800                cmp dword ptr [ebp+08], 00000000
:004096AC 0F94C0                  sete al
:004096AF 8945FC                  mov dword ptr [ebp-04], eax
:004096B2 837DFC00                cmp dword ptr [ebp-04], 00000000
:004096B6 7414                    je 004096CC
:004096B8 6A00                    push 00000000
:004096BA 6A00                    push 00000000
:004096BC 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"DISPLAY"
                                  |
:004096BE 68F4B14800              push 0048B1F4
:004096C3 FF1534604800            call dword ptr [00486034]
:004096C9 894508                  mov dword ptr [ebp+08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004096B6(C)
|
:004096CC 6A0C                    push 0000000C
:004096CE 8B4D08                  mov ecx, dword ptr [ebp+08]
:004096D1 51                      push ecx
:004096D2 FF153C604800            call dword ptr [0048603C]
:004096D8 8945F8                  mov dword ptr [ebp-08], eax
:004096DB 837DFC00                cmp dword ptr [ebp-04], 00000000
:004096DF 740A                    je 004096EB
:004096E1 8B5508                  mov edx, dword ptr [ebp+08]
:004096E4 52                      push edx
:004096E5 FF15A0604800            call dword ptr [004860A0]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004096DF(C)
|
:004096EB 8B45F8                  mov eax, dword ptr [ebp-08]
:004096EE 8BE5                    mov esp, ebp
:004096F0 5D                      pop ebp
:004096F1 C3                      ret



* Referenced by a CALL at Address:
|:00419714   
|
:004096F2 55                      push ebp
:004096F3 8BEC                    mov ebp, esp
:004096F5 83EC08                  sub esp, 00000008
:004096F8 894DF8                  mov dword ptr [ebp-08], ecx
:004096FB 8B45F8                  mov eax, dword ptr [ebp-08]
:004096FE 8B4810                  mov ecx, dword ptr [eax+10]
:00409701 894DFC                  mov dword ptr [ebp-04], ecx
:00409704 8B55F8                  mov edx, dword ptr [ebp-08]
:00409707 C7421000000000          mov [edx+10], 00000000
:0040970E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00409711 E894050000              call 00409CAA
:00409716 8B45FC                  mov eax, dword ptr [ebp-04]
:00409719 8BE5                    mov esp, ebp
:0040971B 5D                      pop ebp
:0040971C C3                      ret



* Referenced by a CALL at Addresses:
|:0040B2BD   , :00419704   , :00462F93   , :0046C6C6   
|
:0040971D 55                      push ebp
:0040971E 8BEC                    mov ebp, esp
:00409720 83EC08                  sub esp, 00000008
:00409723 894DF8                  mov dword ptr [ebp-08], ecx
:00409726 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00409729 E87C050000              call 00409CAA
:0040972E 6A02                    push 00000002
:00409730 8B450C                  mov eax, dword ptr [ebp+0C]
:00409733 25FFFF0000              and eax, 0000FFFF
:00409738 50                      push eax
:00409739 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040973C 51                      push ecx
:0040973D FF152C614800            call dword ptr [0048612C]
:00409743 50                      push eax
:00409744 8B5508                  mov edx, dword ptr [ebp+08]
:00409747 52                      push edx
:00409748 FF1530614800            call dword ptr [00486130]
:0040974E 8945FC                  mov dword ptr [ebp-04], eax
:00409751 837DFC00                cmp dword ptr [ebp-04], 00000000
:00409755 743E                    je 00409795
:00409757 8B45FC                  mov eax, dword ptr [ebp-04]
:0040975A 50                      push eax
:0040975B FF1528614800            call dword ptr [00486128]
:00409761 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00409764 8901                    mov dword ptr [ecx], eax
:00409766 8B55F8                  mov edx, dword ptr [ebp-08]
:00409769 8B45F8                  mov eax, dword ptr [ebp-08]
:0040976C 8B08                    mov ecx, dword ptr [eax]
:0040976E 894A04                  mov dword ptr [edx+04], ecx
:00409771 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00409774 E873070000              call 00409EEC
:00409779 25FFFF0000              and eax, 0000FFFF
:0040977E 8B55F8                  mov edx, dword ptr [ebp-08]
:00409781 8B4A04                  mov ecx, dword ptr [edx+04]
:00409784 8D548128                lea edx, dword ptr [ecx+4*eax+28]
:00409788 8B45F8                  mov eax, dword ptr [ebp-08]
:0040978B 895004                  mov dword ptr [eax+04], edx
:0040978E B801000000              mov eax, 00000001
:00409793 EB02                    jmp 00409797

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409755(C)
|
:00409795 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409793(U)
|
:00409797 8BE5                    mov esp, ebp
:00409799 5D                      pop ebp
:0040979A C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0040A8D3   , :004617D3   , :004618C0   , :00462C7B   
|
:0040979D 55                      push ebp
:0040979E 8BEC                    mov ebp, esp
:004097A0 83EC20                  sub esp, 00000020
:004097A3 894DE0                  mov dword ptr [ebp-20], ecx
:004097A6 8B4DE0                  mov ecx, dword ptr [ebp-20]
:004097A9 E8FC040000              call 00409CAA
:004097AE 6A00                    push 00000000
:004097B0 E83B780700              call 00480FF0
:004097B5 83C404                  add esp, 00000004
:004097B8 8945FC                  mov dword ptr [ebp-04], eax
:004097BB 6828040000              push 00000428
:004097C0 E81B780700              call 00480FE0
:004097C5 83C404                  add esp, 00000004
:004097C8 8B4DE0                  mov ecx, dword ptr [ebp-20]
:004097CB 8901                    mov dword ptr [ecx], eax
:004097CD 8B55FC                  mov edx, dword ptr [ebp-04]
:004097D0 52                      push edx
:004097D1 E81A780700              call 00480FF0
:004097D6 83C404                  add esp, 00000004
:004097D9 8B45E0                  mov eax, dword ptr [ebp-20]
:004097DC 833800                  cmp dword ptr [eax], 00000000
:004097DF 0F8429010000            je 0040990E
:004097E5 8B4DE0                  mov ecx, dword ptr [ebp-20]
:004097E8 8B11                    mov edx, dword ptr [ecx]
:004097EA 8955EC                  mov dword ptr [ebp-14], edx
:004097ED 8B45EC                  mov eax, dword ptr [ebp-14]
:004097F0 C70028000000            mov dword ptr [eax], 00000028
:004097F6 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004097F9 8B550C                  mov edx, dword ptr [ebp+0C]
:004097FC 895104                  mov dword ptr [ecx+04], edx
:004097FF 8B4510                  mov eax, dword ptr [ebp+10]
:00409802 6BC0FF                  imul eax, FFFFFFFF
:00409805 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00409808 894108                  mov dword ptr [ecx+08], eax
:0040980B 8B55EC                  mov edx, dword ptr [ebp-14]
:0040980E 66C7420C0100            mov [edx+0C], 0001
:00409814 8B45EC                  mov eax, dword ptr [ebp-14]
:00409817 66C7400E0800            mov [eax+0E], 0008
:0040981D 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00409820 C7411000000000          mov [ecx+10], 00000000
:00409827 8B450C                  mov eax, dword ptr [ebp+0C]
:0040982A 83C003                  add eax, 00000003
:0040982D 99                      cdq
:0040982E 83E203                  and edx, 00000003
:00409831 03C2                    add eax, edx
:00409833 C1F802                  sar eax, 02
:00409836 C1E002                  shl eax, 02
:00409839 0FAF4510                imul eax, dword ptr [ebp+10]
:0040983D 8B55EC                  mov edx, dword ptr [ebp-14]
:00409840 894214                  mov dword ptr [edx+14], eax
:00409843 8B45EC                  mov eax, dword ptr [ebp-14]
:00409846 C7401800000000          mov [eax+18], 00000000
:0040984D 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00409850 C7411C00000000          mov [ecx+1C], 00000000
:00409857 8B55EC                  mov edx, dword ptr [ebp-14]
:0040985A C7422000010000          mov [edx+20], 00000100
:00409861 8B45EC                  mov eax, dword ptr [ebp-14]
:00409864 C7402400000000          mov [eax+24], 00000000
:0040986B 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0040986E 8B11                    mov edx, dword ptr [ecx]
:00409870 83C228                  add edx, 00000028
:00409873 8955F8                  mov dword ptr [ebp-08], edx
:00409876 C745F470774900          mov [ebp-0C], 00497770
:0040987D C745F000000000          mov [ebp-10], 00000000
:00409884 EB12                    jmp 00409898

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004098EB(U)
|
:00409886 8B45F0                  mov eax, dword ptr [ebp-10]
:00409889 83C001                  add eax, 00000001
:0040988C 8945F0                  mov dword ptr [ebp-10], eax
:0040988F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00409892 83C104                  add ecx, 00000004
:00409895 894DF8                  mov dword ptr [ebp-08], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409884(U)
|
:00409898 817DF000010000          cmp dword ptr [ebp-10], 00000100
:0040989F 7D4C                    jge 004098ED
:004098A1 8B55F4                  mov edx, dword ptr [ebp-0C]
:004098A4 33C0                    xor eax, eax
:004098A6 8A02                    mov al, byte ptr [edx]
:004098A8 C1E004                  shl eax, 04
:004098AB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004098AE 8801                    mov byte ptr [ecx], al
:004098B0 8B55F4                  mov edx, dword ptr [ebp-0C]
:004098B3 83C201                  add edx, 00000001
:004098B6 8955F4                  mov dword ptr [ebp-0C], edx
:004098B9 8B45F4                  mov eax, dword ptr [ebp-0C]
:004098BC 33C9                    xor ecx, ecx
:004098BE 8A08                    mov cl, byte ptr [eax]
:004098C0 C1E104                  shl ecx, 04
:004098C3 8B55F8                  mov edx, dword ptr [ebp-08]
:004098C6 884A02                  mov byte ptr [edx+02], cl
:004098C9 8B45F4                  mov eax, dword ptr [ebp-0C]
:004098CC 83C001                  add eax, 00000001
:004098CF 8945F4                  mov dword ptr [ebp-0C], eax
:004098D2 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004098D5 33D2                    xor edx, edx
:004098D7 8A11                    mov dl, byte ptr [ecx]
:004098D9 C1E204                  shl edx, 04
:004098DC 8B45F8                  mov eax, dword ptr [ebp-08]
:004098DF 885001                  mov byte ptr [eax+01], dl
:004098E2 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004098E5 83C101                  add ecx, 00000001
:004098E8 894DF4                  mov dword ptr [ebp-0C], ecx
:004098EB EB99                    jmp 00409886

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040989F(C)
|
:004098ED 8B5508                  mov edx, dword ptr [ebp+08]
:004098F0 52                      push edx
:004098F1 8B4DE0                  mov ecx, dword ptr [ebp-20]
:004098F4 E8FC000000              call 004099F5
:004098F9 85C0                    test eax, eax
:004098FB 7411                    je 0040990E
:004098FD 8B45E0                  mov eax, dword ptr [ebp-20]
:00409900 C7401801000000          mov [eax+18], 00000001
:00409907 B801000000              mov eax, 00000001
:0040990C EB4B                    jmp 00409959

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004097DF(C), :004098FB(C)
|
:0040990E 68F06E4800              push 00486EF0
:00409913 E8BFB20600              call 00474BD7
:00409918 83C404                  add esp, 00000004
:0040991B 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0040991E 8B11                    mov edx, dword ptr [ecx]
:00409920 8955E8                  mov dword ptr [ebp-18], edx
:00409923 8B45E8                  mov eax, dword ptr [ebp-18]
:00409926 50                      push eax
:00409927 E8F4760700              call 00481020
:0040992C 83C404                  add esp, 00000004
:0040992F 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00409932 8B5104                  mov edx, dword ptr [ecx+04]
:00409935 8955E4                  mov dword ptr [ebp-1C], edx
:00409938 8B45E4                  mov eax, dword ptr [ebp-1C]
:0040993B 50                      push eax
:0040993C E8DF760700              call 00481020
:00409941 83C404                  add esp, 00000004
:00409944 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00409947 C70100000000            mov dword ptr [ecx], 00000000
:0040994D 8B55E0                  mov edx, dword ptr [ebp-20]
:00409950 C7420400000000          mov [edx+04], 00000000
:00409957 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040990C(U)
|
:00409959 8BE5                    mov esp, ebp
:0040995B 5D                      pop ebp
:0040995C C20C00                  ret 000C



* Referenced by a CALL at Address:
|:00462EC4   
|
:0040995F 55                      push ebp
:00409960 8BEC                    mov ebp, esp
:00409962 83EC08                  sub esp, 00000008
:00409965 894DF8                  mov dword ptr [ebp-08], ecx
:00409968 8B45F8                  mov eax, dword ptr [ebp-08]
:0040996B 83781800                cmp dword ptr [eax+18], 00000000
:0040996F 747C                    je 004099ED
:00409971 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00409974 8B11                    mov edx, dword ptr [ecx]
:00409976 8955FC                  mov dword ptr [ebp-04], edx
:00409979 8B45FC                  mov eax, dword ptr [ebp-04]
:0040997C 33C9                    xor ecx, ecx
:0040997E 668B480E                mov cx, word ptr [eax+0E]
:00409982 83F908                  cmp ecx, 00000008
:00409985 7566                    jne 004099ED
:00409987 8B55FC                  mov edx, dword ptr [ebp-04]
:0040998A 8B450C                  mov eax, dword ptr [ebp+0C]
:0040998D 894204                  mov dword ptr [edx+04], eax
:00409990 8B4D10                  mov ecx, dword ptr [ebp+10]
:00409993 6BC9FF                  imul ecx, FFFFFFFF
:00409996 8B55FC                  mov edx, dword ptr [ebp-04]
:00409999 894A08                  mov dword ptr [edx+08], ecx
:0040999C 8B450C                  mov eax, dword ptr [ebp+0C]
:0040999F 83C003                  add eax, 00000003
:004099A2 99                      cdq
:004099A3 83E203                  and edx, 00000003
:004099A6 03C2                    add eax, edx
:004099A8 C1F802                  sar eax, 02
:004099AB C1E002                  shl eax, 02
:004099AE 0FAF4510                imul eax, dword ptr [ebp+10]
:004099B2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004099B5 894114                  mov dword ptr [ecx+14], eax
:004099B8 8B5508                  mov edx, dword ptr [ebp+08]
:004099BB 52                      push edx
:004099BC 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004099BF E831000000              call 004099F5
:004099C4 85C0                    test eax, eax
:004099C6 7407                    je 004099CF
:004099C8 B801000000              mov eax, 00000001
:004099CD EB20                    jmp 004099EF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004099C6(C)
|
:004099CF 8B45FC                  mov eax, dword ptr [ebp-04]
:004099D2 C7400400000000          mov [eax+04], 00000000
:004099D9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004099DC C7410800000000          mov [ecx+08], 00000000
:004099E3 8B55FC                  mov edx, dword ptr [ebp-04]
:004099E6 C7421400000000          mov [edx+14], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040996F(C), :00409985(C)
|
:004099ED 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004099CD(U)
|
:004099EF 8BE5                    mov esp, ebp
:004099F1 5D                      pop ebp
:004099F2 C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:004098F4   , :004099BF   
|
:004099F5 55                      push ebp
:004099F6 8BEC                    mov ebp, esp
:004099F8 83EC28                  sub esp, 00000028
:004099FB 894DDC                  mov dword ptr [ebp-24], ecx
:004099FE 8B45DC                  mov eax, dword ptr [ebp-24]
:00409A01 8B08                    mov ecx, dword ptr [eax]
:00409A03 894DEC                  mov dword ptr [ebp-14], ecx
:00409A06 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00409A09 E8E4010000              call 00409BF2
:00409A0E 8945F8                  mov dword ptr [ebp-08], eax
:00409A11 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00409A14 E8F8010000              call 00409C11
:00409A19 8945F4                  mov dword ptr [ebp-0C], eax
:00409A1C 8B45F8                  mov eax, dword ptr [ebp-08]
:00409A1F 99                      cdq
:00409A20 33C2                    xor eax, edx
:00409A22 2BC2                    sub eax, edx
:00409A24 83E003                  and eax, 00000003
:00409A27 33C2                    xor eax, edx
:00409A29 2BC2                    sub eax, edx
:00409A2B 85C0                    test eax, eax
:00409A2D 741B                    je 00409A4A
:00409A2F 8B45F8                  mov eax, dword ptr [ebp-08]
:00409A32 99                      cdq
:00409A33 33C2                    xor eax, edx
:00409A35 2BC2                    sub eax, edx
:00409A37 83E003                  and eax, 00000003
:00409A3A 33C2                    xor eax, edx
:00409A3C 2BC2                    sub eax, edx
:00409A3E BA04000000              mov edx, 00000004
:00409A43 2BD0                    sub edx, eax
:00409A45 8955D8                  mov dword ptr [ebp-28], edx
:00409A48 EB07                    jmp 00409A51

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409A2D(C)
|
:00409A4A C745D800000000          mov [ebp-28], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409A48(U)
|
:00409A51 8B45D8                  mov eax, dword ptr [ebp-28]
:00409A54 8945F0                  mov dword ptr [ebp-10], eax
:00409A57 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00409A5A 83790400                cmp dword ptr [ecx+04], 00000000
:00409A5E 7415                    je 00409A75
:00409A60 8B55DC                  mov edx, dword ptr [ebp-24]
:00409A63 8B4204                  mov eax, dword ptr [edx+04]
:00409A66 8945E0                  mov dword ptr [ebp-20], eax
:00409A69 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00409A6C 51                      push ecx
:00409A6D E8AE750700              call 00481020
:00409A72 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409A5E(C)
|
:00409A75 6A00                    push 00000000
:00409A77 E874750700              call 00480FF0
:00409A7C 83C404                  add esp, 00000004
:00409A7F 8945FC                  mov dword ptr [ebp-04], eax
:00409A82 8B55EC                  mov edx, dword ptr [ebp-14]
:00409A85 8B4214                  mov eax, dword ptr [edx+14]
:00409A88 50                      push eax
:00409A89 E852750700              call 00480FE0
:00409A8E 83C404                  add esp, 00000004
:00409A91 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00409A94 894104                  mov dword ptr [ecx+04], eax
:00409A97 8B55FC                  mov edx, dword ptr [ebp-04]
:00409A9A 52                      push edx
:00409A9B E850750700              call 00480FF0
:00409AA0 83C404                  add esp, 00000004
:00409AA3 8B45DC                  mov eax, dword ptr [ebp-24]
:00409AA6 83780400                cmp dword ptr [eax+04], 00000000
:00409AAA 7450                    je 00409AFC
:00409AAC 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00409AAF 8B5104                  mov edx, dword ptr [ecx+04]
:00409AB2 8955E8                  mov dword ptr [ebp-18], edx
:00409AB5 C745E400000000          mov [ebp-1C], 00000000
:00409ABC EB20                    jmp 00409ADE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409AFA(U)
|
:00409ABE 8B45E4                  mov eax, dword ptr [ebp-1C]
:00409AC1 83C001                  add eax, 00000001
:00409AC4 8945E4                  mov dword ptr [ebp-1C], eax
:00409AC7 8B4D08                  mov ecx, dword ptr [ebp+08]
:00409ACA 034DF8                  add ecx, dword ptr [ebp-08]
:00409ACD 894D08                  mov dword ptr [ebp+08], ecx
:00409AD0 8B55F8                  mov edx, dword ptr [ebp-08]
:00409AD3 0355F0                  add edx, dword ptr [ebp-10]
:00409AD6 8B45E8                  mov eax, dword ptr [ebp-18]
:00409AD9 03C2                    add eax, edx
:00409ADB 8945E8                  mov dword ptr [ebp-18], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409ABC(U)
|
:00409ADE 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00409AE1 3B4DF4                  cmp ecx, dword ptr [ebp-0C]
:00409AE4 7D16                    jge 00409AFC
:00409AE6 8B55F8                  mov edx, dword ptr [ebp-08]
:00409AE9 52                      push edx
:00409AEA 8B4508                  mov eax, dword ptr [ebp+08]
:00409AED 50                      push eax
:00409AEE 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00409AF1 51                      push ecx
:00409AF2 E8F96C0700              call 004807F0
:00409AF7 83C40C                  add esp, 0000000C
:00409AFA EBC2                    jmp 00409ABE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00409AAA(C), :00409AE4(C)
|
:00409AFC 8B55DC                  mov edx, dword ptr [ebp-24]
:00409AFF 8B4204                  mov eax, dword ptr [edx+04]
:00409B02 8BE5                    mov esp, ebp
:00409B04 5D                      pop ebp
:00409B05 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0040A571   , :00462C9A   , :00462EE3   , :0046302C   , :004630CA   
|
:00409B08 55                      push ebp
:00409B09 8BEC                    mov ebp, esp
:00409B0B 51                      push ecx
:00409B0C 894DFC                  mov dword ptr [ebp-04], ecx
:00409B0F 8B45FC                  mov eax, dword ptr [ebp-04]
:00409B12 833800                  cmp dword ptr [eax], 00000000
:00409B15 744E                    je 00409B65
:00409B17 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00409B1A 83790400                cmp dword ptr [ecx+04], 00000000
:00409B1E 7445                    je 00409B65
:00409B20 8B55FC                  mov edx, dword ptr [ebp-04]
:00409B23 837A1000                cmp dword ptr [edx+10], 00000000
:00409B27 740D                    je 00409B36
:00409B29 8B45FC                  mov eax, dword ptr [ebp-04]
:00409B2C 8B4810                  mov ecx, dword ptr [eax+10]
:00409B2F 51                      push ecx
:00409B30 FF1548604800            call dword ptr [00486048]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409B27(C)
|
:00409B36 6A00                    push 00000000
:00409B38 8B55FC                  mov edx, dword ptr [ebp-04]
:00409B3B 8B02                    mov eax, dword ptr [edx]
:00409B3D 50                      push eax
:00409B3E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00409B41 8B5104                  mov edx, dword ptr [ecx+04]
:00409B44 52                      push edx
:00409B45 6A04                    push 00000004
:00409B47 8B45FC                  mov eax, dword ptr [ebp-04]
:00409B4A 8B08                    mov ecx, dword ptr [eax]
:00409B4C 51                      push ecx
:00409B4D 8B5508                  mov edx, dword ptr [ebp+08]
:00409B50 52                      push edx
:00409B51 FF1538604800            call dword ptr [00486038]
:00409B57 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00409B5A 894110                  mov dword ptr [ecx+10], eax
:00409B5D 8B55FC                  mov edx, dword ptr [ebp-04]
:00409B60 8B4210                  mov eax, dword ptr [edx+10]
:00409B63 EB02                    jmp 00409B67

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00409B15(C), :00409B1E(C)
|
:00409B65 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409B63(U)
|
:00409B67 8BE5                    mov esp, ebp
:00409B69 5D                      pop ebp
:00409B6A C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0040A0AA   , :0040A563   
|
:00409B6D 55                      push ebp
:00409B6E 8BEC                    mov ebp, esp
:00409B70 51                      push ecx
:00409B71 894DFC                  mov dword ptr [ebp-04], ecx
:00409B74 8B45FC                  mov eax, dword ptr [ebp-04]
:00409B77 833800                  cmp dword ptr [eax], 00000000
:00409B7A 7470                    je 00409BEC
:00409B7C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00409B7F 83790400                cmp dword ptr [ecx+04], 00000000
:00409B83 7467                    je 00409BEC
:00409B85 8B55FC                  mov edx, dword ptr [ebp-04]
:00409B88 837A1000                cmp dword ptr [edx+10], 00000000
:00409B8C 740D                    je 00409B9B
:00409B8E 8B45FC                  mov eax, dword ptr [ebp-04]
:00409B91 8B4810                  mov ecx, dword ptr [eax+10]
:00409B94 51                      push ecx
:00409B95 FF1548604800            call dword ptr [00486048]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409B8C(C)
|
:00409B9B 6A01                    push 00000001
:00409B9D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00409BA0 E8FD080000              call 0040A4A2
:00409BA5 50                      push eax
:00409BA6 8B55FC                  mov edx, dword ptr [ebp-04]
:00409BA9 8B02                    mov eax, dword ptr [edx]
:00409BAB 33C9                    xor ecx, ecx
:00409BAD 668B480E                mov cx, word ptr [eax+0E]
:00409BB1 51                      push ecx
:00409BB2 8B55FC                  mov edx, dword ptr [ebp-04]
:00409BB5 8B02                    mov eax, dword ptr [edx]
:00409BB7 33C9                    xor ecx, ecx
:00409BB9 668B480C                mov cx, word ptr [eax+0C]
:00409BBD 51                      push ecx
:00409BBE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00409BC1 E84B000000              call 00409C11
:00409BC6 50                      push eax
:00409BC7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00409BCA E823000000              call 00409BF2
:00409BCF 50                      push eax
:00409BD0 FF1540604800            call dword ptr [00486040]
:00409BD6 8B55FC                  mov edx, dword ptr [ebp-04]
:00409BD9 894210                  mov dword ptr [edx+10], eax
:00409BDC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00409BDF E80C090000              call 0040A4F0
:00409BE4 8B45FC                  mov eax, dword ptr [ebp-04]
:00409BE7 8B4010                  mov eax, dword ptr [eax+10]
:00409BEA EB02                    jmp 00409BEE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00409B7A(C), :00409B83(C)
|
:00409BEC 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409BEA(U)
|
:00409BEE 8BE5                    mov esp, ebp
:00409BF0 5D                      pop ebp
:00409BF1 C3                      ret



* Referenced by a CALL at Addresses:
|:00409A09   , :00409BCA   , :0040A011   , :0040A062   , :0040A0C3   
|:0040A117   , :0040A1E0   , :0040A2A9   , :0040A3F6   , :0040A5C7   
|:00462BBC   , :00462D51   , :00462FB9   , :004631FD   , :00463230   
|:00463263   
|
:00409BF2 55                      push ebp
:00409BF3 8BEC                    mov ebp, esp
:00409BF5 51                      push ecx
:00409BF6 894DFC                  mov dword ptr [ebp-04], ecx
:00409BF9 8B45FC                  mov eax, dword ptr [ebp-04]
:00409BFC 833800                  cmp dword ptr [eax], 00000000
:00409BFF 7504                    jne 00409C05
:00409C01 33C0                    xor eax, eax
:00409C03 EB08                    jmp 00409C0D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409BFF(C)
|
:00409C05 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00409C08 8B11                    mov edx, dword ptr [ecx]
:00409C0A 8B4204                  mov eax, dword ptr [edx+04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409C03(U)
|
:00409C0D 8BE5                    mov esp, ebp
:00409C0F 5D                      pop ebp
:00409C10 C3                      ret



* Referenced by a CALL at Addresses:
|:00409A14   , :00409BC1   , :0040A022   , :0040A059   , :0040A0D4   
|:0040A10E   , :0040A1D7   , :0040A2A0   , :0040A381   , :0040A3E3   
|:0040A42F   , :0040A45F   , :0040A5D2   , :00462BAD   , :00462D42   
|:00462FAD   , :004631F1   , :00463224   , :00463257   
|
:00409C11 55                      push ebp
:00409C12 8BEC                    mov ebp, esp
:00409C14 51                      push ecx
:00409C15 894DFC                  mov dword ptr [ebp-04], ecx
:00409C18 8B45FC                  mov eax, dword ptr [ebp-04]
:00409C1B 833800                  cmp dword ptr [eax], 00000000
:00409C1E 7504                    jne 00409C24
:00409C20 33C0                    xor eax, eax
:00409C22 EB1F                    jmp 00409C43

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409C1E(C)
|
:00409C24 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00409C27 8B11                    mov edx, dword ptr [ecx]
:00409C29 837A0800                cmp dword ptr [edx+08], 00000000
:00409C2D 7D0C                    jge 00409C3B
:00409C2F 8B45FC                  mov eax, dword ptr [ebp-04]
:00409C32 8B08                    mov ecx, dword ptr [eax]
:00409C34 8B4108                  mov eax, dword ptr [ecx+08]
:00409C37 F7D8                    neg eax
:00409C39 EB08                    jmp 00409C43

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409C2D(C)
|
:00409C3B 8B55FC                  mov edx, dword ptr [ebp-04]
:00409C3E 8B02                    mov eax, dword ptr [edx]
:00409C40 8B4008                  mov eax, dword ptr [eax+08]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00409C22(U), :00409C39(U)
|
:00409C43 8BE5                    mov esp, ebp
:00409C45 5D                      pop ebp
:00409C46 C3                      ret



* Referenced by a CALL at Addresses:
|:0040A3A9   , :0040A3D9   , :0040A5FE   
|
:00409C47 55                      push ebp
:00409C48 8BEC                    mov ebp, esp
:00409C4A 83EC08                  sub esp, 00000008
:00409C4D 894DF8                  mov dword ptr [ebp-08], ecx
:00409C50 8B45F8                  mov eax, dword ptr [ebp-08]
:00409C53 833800                  cmp dword ptr [eax], 00000000
:00409C56 7504                    jne 00409C5C
:00409C58 33C0                    xor eax, eax
:00409C5A EB4A                    jmp 00409CA6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409C56(C)
|
:00409C5C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00409C5F 8B11                    mov edx, dword ptr [ecx]
:00409C61 8955FC                  mov dword ptr [ebp-04], edx
:00409C64 8B45FC                  mov eax, dword ptr [ebp-04]
:00409C67 83781400                cmp dword ptr [eax+14], 00000000
:00409C6B 7533                    jne 00409CA0
:00409C6D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00409C70 33D2                    xor edx, edx
:00409C72 668B510E                mov dx, word ptr [ecx+0E]
:00409C76 8B45FC                  mov eax, dword ptr [ebp-04]
:00409C79 8B4004                  mov eax, dword ptr [eax+04]
:00409C7C 0FAFC2                  imul eax, edx
:00409C7F 83C01F                  add eax, 0000001F
:00409C82 99                      cdq
:00409C83 83E21F                  and edx, 0000001F
:00409C86 03C2                    add eax, edx
:00409C88 C1F805                  sar eax, 05
:00409C8B C1E005                  shl eax, 05
:00409C8E 99                      cdq
:00409C8F 83E207                  and edx, 00000007
:00409C92 03C2                    add eax, edx
:00409C94 C1F803                  sar eax, 03
:00409C97 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00409C9A 0FAF4108                imul eax, dword ptr [ecx+08]
:00409C9E EB06                    jmp 00409CA6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409C6B(C)
|
:00409CA0 8B55FC                  mov edx, dword ptr [ebp-04]
:00409CA3 8B4214                  mov eax, dword ptr [edx+14]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00409C5A(U), :00409C9E(U)
|
:00409CA6 8BE5                    mov esp, ebp
:00409CA8 5D                      pop ebp
:00409CA9 C3                      ret



* Referenced by a CALL at Addresses:
|:00409711   , :00409729   , :004097A9   , :0040A8FA   , :0040A961   
|:0040AA29   , :0040B304   , :0040B89A   , :00462D73   , :0046C6EB   
|
:00409CAA 55                      push ebp
:00409CAB 8BEC                    mov ebp, esp
:00409CAD 83EC0C                  sub esp, 0000000C
:00409CB0 894DF4                  mov dword ptr [ebp-0C], ecx
:00409CB3 8B45F4                  mov eax, dword ptr [ebp-0C]
:00409CB6 83781800                cmp dword ptr [eax+18], 00000000
:00409CBA 7429                    je 00409CE5
:00409CBC 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00409CBF 8B5104                  mov edx, dword ptr [ecx+04]
:00409CC2 8955FC                  mov dword ptr [ebp-04], edx
:00409CC5 8B45FC                  mov eax, dword ptr [ebp-04]
:00409CC8 50                      push eax
:00409CC9 E852730700              call 00481020
:00409CCE 83C404                  add esp, 00000004
:00409CD1 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00409CD4 8B11                    mov edx, dword ptr [ecx]
:00409CD6 8955F8                  mov dword ptr [ebp-08], edx
:00409CD9 8B45F8                  mov eax, dword ptr [ebp-08]
:00409CDC 50                      push eax
:00409CDD E83E730700              call 00481020
:00409CE2 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409CBA(C)
|
:00409CE5 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00409CE8 C7411800000000          mov [ecx+18], 00000000
:00409CEF 8B55F4                  mov edx, dword ptr [ebp-0C]
:00409CF2 C7420400000000          mov [edx+04], 00000000
:00409CF9 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00409CFC E8EF070000              call 0040A4F0
:00409D01 8B45F4                  mov eax, dword ptr [ebp-0C]
:00409D04 C70000000000            mov dword ptr [eax], 00000000
:00409D0A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00409D0D 83790C00                cmp dword ptr [ecx+0C], 00000000
:00409D11 7417                    je 00409D2A
:00409D13 8B55F4                  mov edx, dword ptr [ebp-0C]
:00409D16 8B420C                  mov eax, dword ptr [edx+0C]
:00409D19 50                      push eax
:00409D1A FF1548604800            call dword ptr [00486048]
:00409D20 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00409D23 C7410C00000000          mov [ecx+0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409D11(C)
|
:00409D2A 8B55F4                  mov edx, dword ptr [ebp-0C]
:00409D2D 837A1000                cmp dword ptr [edx+10], 00000000
:00409D31 7417                    je 00409D4A
:00409D33 8B45F4                  mov eax, dword ptr [ebp-0C]
:00409D36 8B4810                  mov ecx, dword ptr [eax+10]
:00409D39 51                      push ecx
:00409D3A FF1548604800            call dword ptr [00486048]
:00409D40 8B55F4                  mov edx, dword ptr [ebp-0C]
:00409D43 C7421000000000          mov [edx+10], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409D31(C)
|
:00409D4A 8B45F4                  mov eax, dword ptr [ebp-0C]
:00409D4D 83781400                cmp dword ptr [eax+14], 00000000
:00409D51 7417                    je 00409D6A
:00409D53 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00409D56 8B5114                  mov edx, dword ptr [ecx+14]
:00409D59 52                      push edx
:00409D5A FF1548604800            call dword ptr [00486048]
:00409D60 8B45F4                  mov eax, dword ptr [ebp-0C]
:00409D63 C7401400000000          mov [eax+14], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409D51(C)
|
:00409D6A 8BE5                    mov esp, ebp
:00409D6C 5D                      pop ebp
:00409D6D C3                      ret



* Referenced by a CALL at Address:
|:00409FB1   
|
:00409D6E 55                      push ebp
:00409D6F 8BEC                    mov ebp, esp
:00409D71 83EC18                  sub esp, 00000018
:00409D74 56                      push esi
:00409D75 894DE8                  mov dword ptr [ebp-18], ecx
:00409D78 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00409D7B E86C010000              call 00409EEC
:00409D80 668945FC                mov word ptr [ebp-04], ax
:00409D84 8B45FC                  mov eax, dword ptr [ebp-04]
:00409D87 25FFFF0000              and eax, 0000FFFF
:00409D8C 85C0                    test eax, eax
:00409D8E 0F8429010000            je 00409EBD
:00409D94 6A00                    push 00000000
:00409D96 E855720700              call 00480FF0
:00409D9B 83C404                  add esp, 00000004
:00409D9E 8945F4                  mov dword ptr [ebp-0C], eax
:00409DA1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00409DA4 81E1FFFF0000            and ecx, 0000FFFF
:00409DAA 8D148D04000000          lea edx, dword ptr [4*ecx+00000004]
:00409DB1 52                      push edx
:00409DB2 E829720700              call 00480FE0
:00409DB7 83C404                  add esp, 00000004
:00409DBA 8945F8                  mov dword ptr [ebp-08], eax
:00409DBD 8B45F4                  mov eax, dword ptr [ebp-0C]
:00409DC0 50                      push eax
:00409DC1 E82A720700              call 00480FF0
:00409DC6 83C404                  add esp, 00000004
:00409DC9 837DF800                cmp dword ptr [ebp-08], 00000000
:00409DCD 0F84E8000000            je 00409EBB
:00409DD3 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00409DD6 66C7010003              mov word ptr [ecx], 0300
:00409DDB 8B55F8                  mov edx, dword ptr [ebp-08]
:00409DDE 668B45FC                mov ax, word ptr [ebp-04]
:00409DE2 66894202                mov word ptr [edx+02], ax
:00409DE6 66C745F00000            mov [ebp-10], 0000
:00409DEC EB0C                    jmp 00409DFA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409E84(U)
|
:00409DEE 668B4DF0                mov cx, word ptr [ebp-10]
:00409DF2 6683C101                add cx, 0001
:00409DF6 66894DF0                mov word ptr [ebp-10], cx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409DEC(U)
|
:00409DFA 8B55F0                  mov edx, dword ptr [ebp-10]
:00409DFD 81E2FFFF0000            and edx, 0000FFFF
:00409E03 8B45FC                  mov eax, dword ptr [ebp-04]
:00409E06 25FFFF0000              and eax, 0000FFFF
:00409E0B 3BD0                    cmp edx, eax
:00409E0D 7D7A                    jge 00409E89
:00409E0F 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00409E12 8B11                    mov edx, dword ptr [ecx]
:00409E14 8B45F0                  mov eax, dword ptr [ebp-10]
:00409E17 25FFFF0000              and eax, 0000FFFF
:00409E1C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00409E1F 81E1FFFF0000            and ecx, 0000FFFF
:00409E25 8B75F8                  mov esi, dword ptr [ebp-08]
:00409E28 8A54822A                mov dl, byte ptr [edx+4*eax+2A]
:00409E2C 88548E04                mov byte ptr [esi+4*ecx+04], dl
:00409E30 8B45E8                  mov eax, dword ptr [ebp-18]
:00409E33 8B08                    mov ecx, dword ptr [eax]
:00409E35 8B55F0                  mov edx, dword ptr [ebp-10]
:00409E38 81E2FFFF0000            and edx, 0000FFFF
:00409E3E 8B45F0                  mov eax, dword ptr [ebp-10]
:00409E41 25FFFF0000              and eax, 0000FFFF
:00409E46 8B75F8                  mov esi, dword ptr [ebp-08]
:00409E49 8A4C9129                mov cl, byte ptr [ecx+4*edx+29]
:00409E4D 884C8605                mov byte ptr [esi+4*eax+05], cl
:00409E51 8B55E8                  mov edx, dword ptr [ebp-18]
:00409E54 8B02                    mov eax, dword ptr [edx]
:00409E56 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00409E59 81E1FFFF0000            and ecx, 0000FFFF
:00409E5F 8B55F0                  mov edx, dword ptr [ebp-10]
:00409E62 81E2FFFF0000            and edx, 0000FFFF
:00409E68 8B75F8                  mov esi, dword ptr [ebp-08]
:00409E6B 8A448828                mov al, byte ptr [eax+4*ecx+28]
:00409E6F 88449606                mov byte ptr [esi+4*edx+06], al
:00409E73 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00409E76 81E1FFFF0000            and ecx, 0000FFFF
:00409E7C 8B55F8                  mov edx, dword ptr [ebp-08]
:00409E7F C6448A0700              mov [edx+4*ecx+07], 00
:00409E84 E965FFFFFF              jmp 00409DEE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409E0D(C)
|
:00409E89 8B45F8                  mov eax, dword ptr [ebp-08]
:00409E8C 50                      push eax
:00409E8D FF1554604800            call dword ptr [00486054]
:00409E93 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00409E96 89410C                  mov dword ptr [ecx+0C], eax
:00409E99 8B55F8                  mov edx, dword ptr [ebp-08]
:00409E9C 8955EC                  mov dword ptr [ebp-14], edx
:00409E9F 8B45EC                  mov eax, dword ptr [ebp-14]
:00409EA2 50                      push eax
:00409EA3 E878710700              call 00481020
:00409EA8 83C404                  add esp, 00000004
:00409EAB 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00409EAE 83790C00                cmp dword ptr [ecx+0C], 00000000
:00409EB2 7407                    je 00409EBB
:00409EB4 B801000000              mov eax, 00000001
:00409EB9 EB2A                    jmp 00409EE5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00409DCD(C), :00409EB2(C)
|
:00409EBB EB26                    jmp 00409EE3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409D8E(C)
|
:00409EBD 837D0800                cmp dword ptr [ebp+08], 00000000
:00409EC1 7420                    je 00409EE3
:00409EC3 8B5508                  mov edx, dword ptr [ebp+08]
:00409EC6 52                      push edx
:00409EC7 FF1544604800            call dword ptr [00486044]
:00409ECD 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00409ED0 89410C                  mov dword ptr [ecx+0C], eax
:00409ED3 8B55E8                  mov edx, dword ptr [ebp-18]
:00409ED6 837A0C00                cmp dword ptr [edx+0C], 00000000
:00409EDA 7407                    je 00409EE3
:00409EDC B801000000              mov eax, 00000001
:00409EE1 EB02                    jmp 00409EE5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00409EBB(U), :00409EC1(C), :00409EDA(C)
|
:00409EE3 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00409EB9(U), :00409EE1(U)
|
:00409EE5 5E                      pop esi
:00409EE6 8BE5                    mov esp, ebp
:00409EE8 5D                      pop ebp
:00409EE9 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00409774   , :00409D7B   , :0040AB2D   
|
:00409EEC 55                      push ebp
:00409EED 8BEC                    mov ebp, esp
:00409EEF 83EC08                  sub esp, 00000008
:00409EF2 894DFC                  mov dword ptr [ebp-04], ecx
:00409EF5 8B45FC                  mov eax, dword ptr [ebp-04]
:00409EF8 833800                  cmp dword ptr [eax], 00000000
:00409EFB 745C                    je 00409F59
:00409EFD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00409F00 83790400                cmp dword ptr [ecx+04], 00000000
:00409F04 7453                    je 00409F59
:00409F06 8B55FC                  mov edx, dword ptr [ebp-04]
:00409F09 8B02                    mov eax, dword ptr [edx]
:00409F0B 83782000                cmp dword ptr [eax+20], 00000000
:00409F0F 753D                    jne 00409F4E
:00409F11 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00409F14 8B11                    mov edx, dword ptr [ecx]
:00409F16 33C0                    xor eax, eax
:00409F18 668B420E                mov ax, word ptr [edx+0E]
:00409F1C 8945F8                  mov dword ptr [ebp-08], eax
:00409F1F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00409F22 83E901                  sub ecx, 00000001
:00409F25 894DF8                  mov dword ptr [ebp-08], ecx
:00409F28 837DF807                cmp dword ptr [ebp-08], 00000007
:00409F2C 7720                    ja 00409F4E
:00409F2E 8B55F8                  mov edx, dword ptr [ebp-08]
:00409F31 FF2495609F4000          jmp dword ptr [4*edx+00409F60]
:00409F38 8B45FC                  mov eax, dword ptr [ebp-04]
:00409F3B 8B08                    mov ecx, dword ptr [eax]
:00409F3D 33D2                    xor edx, edx
:00409F3F 668B510E                mov dx, word ptr [ecx+0E]
:00409F43 8BCA                    mov ecx, edx
:00409F45 B801000000              mov eax, 00000001
:00409F4A D3E0                    shl eax, cl
:00409F4C EB0E                    jmp 00409F5C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00409F0F(C), :00409F2C(C)
|
:00409F4E 8B45FC                  mov eax, dword ptr [ebp-04]
:00409F51 8B08                    mov ecx, dword ptr [eax]
:00409F53 668B4120                mov ax, word ptr [ecx+20]
:00409F57 EB03                    jmp 00409F5C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00409EFB(C), :00409F04(C)
|
:00409F59 6633C0                  xor ax, ax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00409F4C(U), :00409F57(U)
|
:00409F5C 8BE5                    mov esp, ebp
:00409F5E 5D                      pop ebp
:00409F5F C3                      ret



:00409F60 389F4000                DWORD 00409F38
:00409F64 389F4000                DWORD 00409F38
:00409F68 4E9F4000                DWORD 00409F4E
:00409F6C 389F4000                DWORD 00409F38
:00409F70 4E9F4000                DWORD 00409F4E
:00409F74 4E9F4000                DWORD 00409F4E
:00409F78 4E9F4000                DWORD 00409F4E
:00409F7C 389F4000                DWORD 00409F38



* Referenced by a CALL at Address:
|:0040A031   
|
:00409F80 55                      push ebp
:00409F81 8BEC                    mov ebp, esp
:00409F83 83EC08                  sub esp, 00000008
:00409F86 894DF8                  mov dword ptr [ebp-08], ecx
:00409F89 C745FC00000000          mov [ebp-04], 00000000
:00409F90 8B4508                  mov eax, dword ptr [ebp+08]
:00409F93 50                      push eax
:00409F94 E807F7FFFF              call 004096A0
:00409F99 83C404                  add esp, 00000004
:00409F9C 83F808                  cmp eax, 00000008
:00409F9F 7F3E                    jg 00409FDF
:00409FA1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00409FA4 83790C00                cmp dword ptr [ecx+0C], 00000000
:00409FA8 750C                    jne 00409FB6
:00409FAA 8B5508                  mov edx, dword ptr [ebp+08]
:00409FAD 52                      push edx
:00409FAE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00409FB1 E8B8FDFFFF              call 00409D6E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409FA8(C)
|
:00409FB6 8B45F8                  mov eax, dword ptr [ebp-08]
:00409FB9 83780C00                cmp dword ptr [eax+0C], 00000000
:00409FBD 7420                    je 00409FDF
:00409FBF 6A00                    push 00000000
:00409FC1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00409FC4 8B510C                  mov edx, dword ptr [ecx+0C]
:00409FC7 52                      push edx
:00409FC8 8B4508                  mov eax, dword ptr [ebp+08]
:00409FCB 50                      push eax
:00409FCC FF1550604800            call dword ptr [00486050]
:00409FD2 8B4D08                  mov ecx, dword ptr [ebp+08]
:00409FD5 51                      push ecx
:00409FD6 FF154C604800            call dword ptr [0048604C]
:00409FDC 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00409F9F(C), :00409FBD(C)
|
:00409FDF 8B45FC                  mov eax, dword ptr [ebp-04]
:00409FE2 8BE5                    mov esp, ebp
:00409FE4 5D                      pop ebp
:00409FE5 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0040A1B7   
|
:00409FE8 55                      push ebp
:00409FE9 8BEC                    mov ebp, esp
:00409FEB 51                      push ecx
:00409FEC 894DFC                  mov dword ptr [ebp-04], ecx
:00409FEF 8B45FC                  mov eax, dword ptr [ebp-04]
:00409FF2 833800                  cmp dword ptr [eax], 00000000
:00409FF5 0F8492000000            je 0040A08D
:00409FFB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00409FFE 83790400                cmp dword ptr [ecx+04], 00000000
:0040A002 0F8485000000            je 0040A08D
:0040A008 837D1400                cmp dword ptr [ebp+14], 00000000
:0040A00C 7D0B                    jge 0040A019
:0040A00E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040A011 E8DCFBFFFF              call 00409BF2
:0040A016 894514                  mov dword ptr [ebp+14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A00C(C)
|
:0040A019 837D1800                cmp dword ptr [ebp+18], 00000000
:0040A01D 7D0B                    jge 0040A02A
:0040A01F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040A022 E8EAFBFFFF              call 00409C11
:0040A027 894518                  mov dword ptr [ebp+18], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A01D(C)
|
:0040A02A 8B5508                  mov edx, dword ptr [ebp+08]
:0040A02D 52                      push edx
:0040A02E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040A031 E84AFFFFFF              call 00409F80
:0040A036 6A03                    push 00000003
:0040A038 8B4508                  mov eax, dword ptr [ebp+08]
:0040A03B 50                      push eax
:0040A03C FF1558604800            call dword ptr [00486058]
:0040A042 682000CC00              push 00CC0020
:0040A047 6A00                    push 00000000
:0040A049 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040A04C 8B11                    mov edx, dword ptr [ecx]
:0040A04E 52                      push edx
:0040A04F 8B45FC                  mov eax, dword ptr [ebp-04]
:0040A052 8B4804                  mov ecx, dword ptr [eax+04]
:0040A055 51                      push ecx
:0040A056 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040A059 E8B3FBFFFF              call 00409C11
:0040A05E 50                      push eax
:0040A05F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040A062 E88BFBFFFF              call 00409BF2
:0040A067 50                      push eax
:0040A068 6A00                    push 00000000
:0040A06A 6A00                    push 00000000
:0040A06C 8B5518                  mov edx, dword ptr [ebp+18]
:0040A06F 52                      push edx
:0040A070 8B4514                  mov eax, dword ptr [ebp+14]
:0040A073 50                      push eax
:0040A074 8B4D10                  mov ecx, dword ptr [ebp+10]
:0040A077 51                      push ecx
:0040A078 8B550C                  mov edx, dword ptr [ebp+0C]
:0040A07B 52                      push edx
:0040A07C 8B4508                  mov eax, dword ptr [ebp+08]
:0040A07F 50                      push eax
:0040A080 FF1560604800            call dword ptr [00486060]
:0040A086 B801000000              mov eax, 00000001
:0040A08B EB02                    jmp 0040A08F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00409FF5(C), :0040A002(C)
|
:0040A08D 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A08B(U)
|
:0040A08F 8BE5                    mov esp, ebp
:0040A091 5D                      pop ebp
:0040A092 C21400                  ret 0014



* Referenced by a CALL at Address:
|:0040A199   
|
:0040A095 55                      push ebp
:0040A096 8BEC                    mov ebp, esp
:0040A098 83EC08                  sub esp, 00000008
:0040A09B 894DF8                  mov dword ptr [ebp-08], ecx
:0040A09E 8B45F8                  mov eax, dword ptr [ebp-08]
:0040A0A1 83781000                cmp dword ptr [eax+10], 00000000
:0040A0A5 7513                    jne 0040A0BA
:0040A0A7 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040A0AA E8BEFAFFFF              call 00409B6D
:0040A0AF 85C0                    test eax, eax
:0040A0B1 7507                    jne 0040A0BA
:0040A0B3 33C0                    xor eax, eax
:0040A0B5 E994000000              jmp 0040A14E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040A0A5(C), :0040A0B1(C)
|
:0040A0BA 837D1400                cmp dword ptr [ebp+14], 00000000
:0040A0BE 7D0B                    jge 0040A0CB
:0040A0C0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040A0C3 E82AFBFFFF              call 00409BF2
:0040A0C8 894514                  mov dword ptr [ebp+14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A0BE(C)
|
:0040A0CB 837D1800                cmp dword ptr [ebp+18], 00000000
:0040A0CF 7D0B                    jge 0040A0DC
:0040A0D1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040A0D4 E838FBFFFF              call 00409C11
:0040A0D9 894518                  mov dword ptr [ebp+18], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A0CF(C)
|
:0040A0DC 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040A0DF 51                      push ecx
:0040A0E0 FF1564604800            call dword ptr [00486064]
:0040A0E6 8945FC                  mov dword ptr [ebp-04], eax
:0040A0E9 8B55F8                  mov edx, dword ptr [ebp-08]
:0040A0EC 8B4210                  mov eax, dword ptr [edx+10]
:0040A0EF 50                      push eax
:0040A0F0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040A0F3 51                      push ecx
:0040A0F4 FF156C604800            call dword ptr [0048606C]
:0040A0FA 6A03                    push 00000003
:0040A0FC 8B5508                  mov edx, dword ptr [ebp+08]
:0040A0FF 52                      push edx
:0040A100 FF1558604800            call dword ptr [00486058]
:0040A106 682000CC00              push 00CC0020
:0040A10B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040A10E E8FEFAFFFF              call 00409C11
:0040A113 50                      push eax
:0040A114 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040A117 E8D6FAFFFF              call 00409BF2
:0040A11C 50                      push eax
:0040A11D 6A00                    push 00000000
:0040A11F 6A00                    push 00000000
:0040A121 8B45FC                  mov eax, dword ptr [ebp-04]
:0040A124 50                      push eax
:0040A125 8B4D18                  mov ecx, dword ptr [ebp+18]
:0040A128 51                      push ecx
:0040A129 8B5514                  mov edx, dword ptr [ebp+14]
:0040A12C 52                      push edx
:0040A12D 8B4510                  mov eax, dword ptr [ebp+10]
:0040A130 50                      push eax
:0040A131 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0040A134 51                      push ecx
:0040A135 8B5508                  mov edx, dword ptr [ebp+08]
:0040A138 52                      push edx
:0040A139 FF155C604800            call dword ptr [0048605C]
:0040A13F 8B45FC                  mov eax, dword ptr [ebp-04]
:0040A142 50                      push eax
:0040A143 FF15A0604800            call dword ptr [004860A0]
:0040A149 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A0B5(U)
|
:0040A14E 8BE5                    mov esp, ebp
:0040A150 5D                      pop ebp
:0040A151 C21400                  ret 0014



* Referenced by a CALL at Addresses:
|:004617F5   , :004618E2   
|
:0040A154 55                      push ebp
:0040A155 8BEC                    mov ebp, esp
:0040A157 51                      push ecx
:0040A158 894DFC                  mov dword ptr [ebp-04], ecx
:0040A15B 8B45FC                  mov eax, dword ptr [ebp-04]
:0040A15E 833800                  cmp dword ptr [eax], 00000000
:0040A161 7504                    jne 0040A167
:0040A163 33C0                    xor eax, eax
:0040A165 EB55                    jmp 0040A1BC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A161(C)
|
:0040A167 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040A16A 51                      push ecx
:0040A16B E830F5FFFF              call 004096A0
:0040A170 83C404                  add esp, 00000004
:0040A173 8B55FC                  mov edx, dword ptr [ebp-04]
:0040A176 8B0A                    mov ecx, dword ptr [edx]
:0040A178 33D2                    xor edx, edx
:0040A17A 668B510E                mov dx, word ptr [ecx+0E]
:0040A17E 3BC2                    cmp eax, edx
:0040A180 751E                    jne 0040A1A0
:0040A182 8B4518                  mov eax, dword ptr [ebp+18]
:0040A185 50                      push eax
:0040A186 8B4D14                  mov ecx, dword ptr [ebp+14]
:0040A189 51                      push ecx
:0040A18A 8B5510                  mov edx, dword ptr [ebp+10]
:0040A18D 52                      push edx
:0040A18E 8B450C                  mov eax, dword ptr [ebp+0C]
:0040A191 50                      push eax
:0040A192 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040A195 51                      push ecx
:0040A196 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040A199 E8F7FEFFFF              call 0040A095
:0040A19E EB1C                    jmp 0040A1BC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A180(C)
|
:0040A1A0 8B5518                  mov edx, dword ptr [ebp+18]
:0040A1A3 52                      push edx
:0040A1A4 8B4514                  mov eax, dword ptr [ebp+14]
:0040A1A7 50                      push eax
:0040A1A8 8B4D10                  mov ecx, dword ptr [ebp+10]
:0040A1AB 51                      push ecx
:0040A1AC 8B550C                  mov edx, dword ptr [ebp+0C]
:0040A1AF 52                      push edx
:0040A1B0 8B4508                  mov eax, dword ptr [ebp+08]
:0040A1B3 50                      push eax
:0040A1B4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040A1B7 E82CFEFFFF              call 00409FE8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040A165(U), :0040A19E(U)
|
:0040A1BC 8BE5                    mov esp, ebp
:0040A1BE 5D                      pop ebp
:0040A1BF C21400                  ret 0014



* Referenced by a CALL at Addresses:
|:0040AA13   , :00463295   , :004632EB   
|
:0040A1C2 55                      push ebp
:0040A1C3 8BEC                    mov ebp, esp
:0040A1C5 83EC08                  sub esp, 00000008
:0040A1C8 894DF8                  mov dword ptr [ebp-08], ecx
:0040A1CB 6A01                    push 00000001
:0040A1CD 6A01                    push 00000001
:0040A1CF 68FF000000              push 000000FF
:0040A1D4 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040A1D7 E835FAFFFF              call 00409C11
:0040A1DC 50                      push eax
:0040A1DD 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040A1E0 E80DFAFFFF              call 00409BF2
:0040A1E5 50                      push eax
:0040A1E6 FF1500604800            call dword ptr [00486000]
:0040A1EC 8945FC                  mov dword ptr [ebp-04], eax
:0040A1EF 837DFC00                cmp dword ptr [ebp-04], 00000000
:0040A1F3 7511                    jne 0040A206
:0040A1F5 68F06E4800              push 00486EF0
:0040A1FA E8D8A90600              call 00474BD7
:0040A1FF 83C404                  add esp, 00000004
:0040A202 33C0                    xor eax, eax
:0040A204 EB7F                    jmp 0040A285

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A1F3(C)
|
:0040A206 8B45F8                  mov eax, dword ptr [ebp-08]
:0040A209 83781000                cmp dword ptr [eax+10], 00000000
:0040A20D 7508                    jne 0040A217
:0040A20F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040A212 E805030000              call 0040A51C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A20D(C)
|
:0040A217 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040A21A 83791400                cmp dword ptr [ecx+14], 00000000
:0040A21E 750C                    jne 0040A22C
:0040A220 8A5514                  mov dl, byte ptr [ebp+14]
:0040A223 52                      push edx
:0040A224 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040A227 E85E030000              call 0040A58A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A21E(C)
|
:0040A22C 8B45F8                  mov eax, dword ptr [ebp-08]
:0040A22F 83781000                cmp dword ptr [eax+10], 00000000
:0040A233 744E                    je 0040A283
:0040A235 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040A238 83791400                cmp dword ptr [ecx+14], 00000000
:0040A23C 7445                    je 0040A283
:0040A23E 8B55F8                  mov edx, dword ptr [ebp-08]
:0040A241 8B4214                  mov eax, dword ptr [edx+14]
:0040A244 50                      push eax
:0040A245 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040A248 8B5110                  mov edx, dword ptr [ecx+10]
:0040A24B 52                      push edx
:0040A24C 8B45FC                  mov eax, dword ptr [ebp-04]
:0040A24F 50                      push eax
:0040A250 FF1510604800            call dword ptr [00486010]
:0040A256 8B4D18                  mov ecx, dword ptr [ebp+18]
:0040A259 51                      push ecx
:0040A25A 8B5510                  mov edx, dword ptr [ebp+10]
:0040A25D 52                      push edx
:0040A25E 8B450C                  mov eax, dword ptr [ebp+0C]
:0040A261 50                      push eax
:0040A262 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040A265 51                      push ecx
:0040A266 6A00                    push 00000000
:0040A268 8B55FC                  mov edx, dword ptr [ebp-04]
:0040A26B 52                      push edx
:0040A26C FF150C604800            call dword ptr [0048600C]
:0040A272 8B45FC                  mov eax, dword ptr [ebp-04]
:0040A275 50                      push eax
:0040A276 FF1508604800            call dword ptr [00486008]
:0040A27C B801000000              mov eax, 00000001
:0040A281 EB02                    jmp 0040A285

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040A233(C), :0040A23C(C)
|
:0040A283 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040A204(U), :0040A281(U)
|
:0040A285 8BE5                    mov esp, ebp
:0040A287 5D                      pop ebp
:0040A288 C21400                  ret 0014


:0040A28B 55                      push ebp
:0040A28C 8BEC                    mov ebp, esp
:0040A28E 83EC08                  sub esp, 00000008
:0040A291 894DF8                  mov dword ptr [ebp-08], ecx
:0040A294 6A01                    push 00000001
:0040A296 6A01                    push 00000001
:0040A298 68FF000000              push 000000FF
:0040A29D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040A2A0 E86CF9FFFF              call 00409C11
:0040A2A5 50                      push eax
:0040A2A6 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040A2A9 E844F9FFFF              call 00409BF2
:0040A2AE 50                      push eax
:0040A2AF FF1500604800            call dword ptr [00486000]
:0040A2B5 8945FC                  mov dword ptr [ebp-04], eax
:0040A2B8 837DFC00                cmp dword ptr [ebp-04], 00000000
:0040A2BC 7514                    jne 0040A2D2
:0040A2BE 68F06E4800              push 00486EF0
:0040A2C3 E80FA90600              call 00474BD7
:0040A2C8 83C404                  add esp, 00000004
:0040A2CB 33C0                    xor eax, eax
:0040A2CD E98B000000              jmp 0040A35D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A2BC(C)
|
:0040A2D2 8B45F8                  mov eax, dword ptr [ebp-08]
:0040A2D5 83781000                cmp dword ptr [eax+10], 00000000
:0040A2D9 7508                    jne 0040A2E3
:0040A2DB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040A2DE E839020000              call 0040A51C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A2D9(C)
|
:0040A2E3 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040A2E6 83791400                cmp dword ptr [ecx+14], 00000000
:0040A2EA 750C                    jne 0040A2F8
:0040A2EC 8A5520                  mov dl, byte ptr [ebp+20]
:0040A2EF 52                      push edx
:0040A2F0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040A2F3 E892020000              call 0040A58A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A2EA(C)
|
:0040A2F8 8B45F8                  mov eax, dword ptr [ebp-08]
:0040A2FB 83781000                cmp dword ptr [eax+10], 00000000
:0040A2FF 745A                    je 0040A35B
:0040A301 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040A304 83791400                cmp dword ptr [ecx+14], 00000000
:0040A308 7451                    je 0040A35B
:0040A30A 8B55F8                  mov edx, dword ptr [ebp-08]
:0040A30D 8B4214                  mov eax, dword ptr [edx+14]
:0040A310 50                      push eax
:0040A311 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040A314 8B5110                  mov edx, dword ptr [ecx+10]
:0040A317 52                      push edx
:0040A318 8B45FC                  mov eax, dword ptr [ebp-04]
:0040A31B 50                      push eax
:0040A31C FF1510604800            call dword ptr [00486010]
:0040A322 8B4D1C                  mov ecx, dword ptr [ebp+1C]
:0040A325 51                      push ecx
:0040A326 8B5514                  mov edx, dword ptr [ebp+14]
:0040A329 52                      push edx
:0040A32A 8B4518                  mov eax, dword ptr [ebp+18]
:0040A32D 50                      push eax
:0040A32E 6A00                    push 00000000
:0040A330 6A00                    push 00000000
:0040A332 8B4D10                  mov ecx, dword ptr [ebp+10]
:0040A335 51                      push ecx
:0040A336 8B550C                  mov edx, dword ptr [ebp+0C]
:0040A339 52                      push edx
:0040A33A 8B4508                  mov eax, dword ptr [ebp+08]
:0040A33D 50                      push eax
:0040A33E 6A00                    push 00000000
:0040A340 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040A343 51                      push ecx
:0040A344 FF1504604800            call dword ptr [00486004]
:0040A34A 8B55FC                  mov edx, dword ptr [ebp-04]
:0040A34D 52                      push edx
:0040A34E FF1508604800            call dword ptr [00486008]
:0040A354 B801000000              mov eax, 00000001
:0040A359 EB02                    jmp 0040A35D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040A2FF(C), :0040A308(C)
|
:0040A35B 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040A2CD(U), :0040A359(U)
|
:0040A35D 8BE5                    mov esp, ebp
:0040A35F 5D                      pop ebp
:0040A360 C21C00                  ret 001C



* Referenced by a CALL at Address:
|:0040A4DD   
|
:0040A363 55                      push ebp
:0040A364 8BEC                    mov ebp, esp
:0040A366 83EC18                  sub esp, 00000018
:0040A369 56                      push esi
:0040A36A 894DE8                  mov dword ptr [ebp-18], ecx
:0040A36D 8B45E8                  mov eax, dword ptr [ebp-18]
:0040A370 833800                  cmp dword ptr [eax], 00000000
:0040A373 7415                    je 0040A38A
:0040A375 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0040A378 83790400                cmp dword ptr [ecx+04], 00000000
:0040A37C 740C                    je 0040A38A
:0040A37E 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0040A381 E88BF8FFFF              call 00409C11
:0040A386 85C0                    test eax, eax
:0040A388 7507                    jne 0040A391

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040A373(C), :0040A37C(C)
|
:0040A38A 33C0                    xor eax, eax
:0040A38C E90C010000              jmp 0040A49D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A388(C)
|
:0040A391 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0040A394 E857010000              call 0040A4F0
:0040A399 6A00                    push 00000000
:0040A39B E8506C0700              call 00480FF0
:0040A3A0 83C404                  add esp, 00000004
:0040A3A3 8945FC                  mov dword ptr [ebp-04], eax
:0040A3A6 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0040A3A9 E899F8FFFF              call 00409C47
:0040A3AE 50                      push eax
:0040A3AF E82C6C0700              call 00480FE0
:0040A3B4 83C404                  add esp, 00000004
:0040A3B7 8B55E8                  mov edx, dword ptr [ebp-18]
:0040A3BA 894208                  mov dword ptr [edx+08], eax
:0040A3BD 8B45FC                  mov eax, dword ptr [ebp-04]
:0040A3C0 50                      push eax
:0040A3C1 E82A6C0700              call 00480FF0
:0040A3C6 83C404                  add esp, 00000004
:0040A3C9 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0040A3CC 83790800                cmp dword ptr [ecx+08], 00000000
:0040A3D0 0F84B4000000            je 0040A48A
:0040A3D6 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0040A3D9 E869F8FFFF              call 00409C47
:0040A3DE 8BF0                    mov esi, eax
:0040A3E0 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0040A3E3 E829F8FFFF              call 00409C11
:0040A3E8 8BC8                    mov ecx, eax
:0040A3EA 8BC6                    mov eax, esi
:0040A3EC 33D2                    xor edx, edx
:0040A3EE F7F1                    div ecx
:0040A3F0 8945F4                  mov dword ptr [ebp-0C], eax
:0040A3F3 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0040A3F6 E8F7F7FFFF              call 00409BF2
:0040A3FB 8B55E8                  mov edx, dword ptr [ebp-18]
:0040A3FE 8B0A                    mov ecx, dword ptr [edx]
:0040A400 33D2                    xor edx, edx
:0040A402 668B510E                mov dx, word ptr [ecx+0E]
:0040A406 0FAFC2                  imul eax, edx
:0040A409 83C00F                  add eax, 0000000F
:0040A40C 99                      cdq
:0040A40D 83E20F                  and edx, 0000000F
:0040A410 03C2                    add eax, edx
:0040A412 C1F804                  sar eax, 04
:0040A415 D1E0                    shl eax, 1
:0040A417 8945F8                  mov dword ptr [ebp-08], eax
:0040A41A C745F000000000          mov [ebp-10], 00000000
:0040A421 EB09                    jmp 0040A42C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A486(U)
|
:0040A423 8B45F0                  mov eax, dword ptr [ebp-10]
:0040A426 83C001                  add eax, 00000001
:0040A429 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A421(U)
|
:0040A42C 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0040A42F E8DDF7FFFF              call 00409C11
:0040A434 3945F0                  cmp dword ptr [ebp-10], eax
:0040A437 7D4F                    jge 0040A488
:0040A439 C745EC00000000          mov [ebp-14], 00000000
:0040A440 EB09                    jmp 0040A44B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A484(U)
|
:0040A442 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040A445 83C101                  add ecx, 00000001
:0040A448 894DEC                  mov dword ptr [ebp-14], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A440(U)
|
:0040A44B 8B55EC                  mov edx, dword ptr [ebp-14]
:0040A44E 3B55F4                  cmp edx, dword ptr [ebp-0C]
:0040A451 7D33                    jge 0040A486
:0040A453 8B45E8                  mov eax, dword ptr [ebp-18]
:0040A456 8B7004                  mov esi, dword ptr [eax+04]
:0040A459 0375EC                  add esi, dword ptr [ebp-14]
:0040A45C 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0040A45F E8ADF7FFFF              call 00409C11
:0040A464 2B45F0                  sub eax, dword ptr [ebp-10]
:0040A467 83E801                  sub eax, 00000001
:0040A46A 0FAF45F4                imul eax, dword ptr [ebp-0C]
:0040A46E 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0040A471 8B5108                  mov edx, dword ptr [ecx+08]
:0040A474 0355EC                  add edx, dword ptr [ebp-14]
:0040A477 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040A47A 0FAF4DF8                imul ecx, dword ptr [ebp-08]
:0040A47E 8A0406                  mov al, byte ptr [esi+eax]
:0040A481 88040A                  mov byte ptr [edx+ecx], al
:0040A484 EBBC                    jmp 0040A442

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A451(C)
|
:0040A486 EB9B                    jmp 0040A423

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A437(C)
|
:0040A488 EB0D                    jmp 0040A497

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A3D0(C)
|
:0040A48A 68F06E4800              push 00486EF0
:0040A48F E843A70600              call 00474BD7
:0040A494 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A488(U)
|
:0040A497 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0040A49A 8B4108                  mov eax, dword ptr [ecx+08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A38C(U)
|
:0040A49D 5E                      pop esi
:0040A49E 8BE5                    mov esp, ebp
:0040A4A0 5D                      pop ebp
:0040A4A1 C3                      ret



* Referenced by a CALL at Addresses:
|:00409BA0   , :0040A656   
|
:0040A4A2 55                      push ebp
:0040A4A3 8BEC                    mov ebp, esp
:0040A4A5 51                      push ecx
:0040A4A6 894DFC                  mov dword ptr [ebp-04], ecx
:0040A4A9 8B45FC                  mov eax, dword ptr [ebp-04]
:0040A4AC 83780400                cmp dword ptr [eax+04], 00000000
:0040A4B0 7504                    jne 0040A4B6
:0040A4B2 33C0                    xor eax, eax
:0040A4B4 EB34                    jmp 0040A4EA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A4B0(C)
|
:0040A4B6 837D0801                cmp dword ptr [ebp+08], 00000001
:0040A4BA 750C                    jne 0040A4C8
:0040A4BC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040A4BF E8B4020000              call 0040A778
:0040A4C4 85C0                    test eax, eax
:0040A4C6 7512                    jne 0040A4DA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A4BA(C)
|
:0040A4C8 837D0800                cmp dword ptr [ebp+08], 00000000
:0040A4CC 7516                    jne 0040A4E4
:0040A4CE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040A4D1 E8A2020000              call 0040A778
:0040A4D6 85C0                    test eax, eax
:0040A4D8 750A                    jne 0040A4E4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A4C6(C)
|
:0040A4DA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040A4DD E881FEFFFF              call 0040A363
:0040A4E2 EB06                    jmp 0040A4EA

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040A4CC(C), :0040A4D8(C)
|
:0040A4E4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040A4E7 8B4104                  mov eax, dword ptr [ecx+04]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040A4B4(U), :0040A4E2(U)
|
:0040A4EA 8BE5                    mov esp, ebp
:0040A4EC 5D                      pop ebp
:0040A4ED C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00409BDF   , :00409CFC   , :0040A394   , :0040A765   
|
:0040A4F0 55                      push ebp
:0040A4F1 8BEC                    mov ebp, esp
:0040A4F3 83EC08                  sub esp, 00000008
:0040A4F6 894DF8                  mov dword ptr [ebp-08], ecx
:0040A4F9 8B45F8                  mov eax, dword ptr [ebp-08]
:0040A4FC 8B4808                  mov ecx, dword ptr [eax+08]
:0040A4FF 894DFC                  mov dword ptr [ebp-04], ecx
:0040A502 8B55FC                  mov edx, dword ptr [ebp-04]
:0040A505 52                      push edx
:0040A506 E8156B0700              call 00481020
:0040A50B 83C404                  add esp, 00000004
:0040A50E 8B45F8                  mov eax, dword ptr [ebp-08]
:0040A511 C7400800000000          mov [eax+08], 00000000
:0040A518 8BE5                    mov esp, ebp
:0040A51A 5D                      pop ebp
:0040A51B C3                      ret



* Referenced by a CALL at Addresses:
|:0040A212   , :0040A2DE   , :0040B2D6   , :0040B2EF   , :0041970C   
|:0046300B   , :00463147   , :0046C6D3   
|
:0040A51C 55                      push ebp
:0040A51D 8BEC                    mov ebp, esp
:0040A51F 83EC08                  sub esp, 00000008
:0040A522 894DF8                  mov dword ptr [ebp-08], ecx
:0040A525 8B45F8                  mov eax, dword ptr [ebp-08]
:0040A528 833800                  cmp dword ptr [eax], 00000000
:0040A52B 7504                    jne 0040A531
:0040A52D 33C0                    xor eax, eax
:0040A52F EB55                    jmp 0040A586

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A52B(C)
|
:0040A531 6A00                    push 00000000
:0040A533 6A00                    push 00000000
:0040A535 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"DISPLAY"
                                  |
:0040A537 68FCB14800              push 0048B1FC
:0040A53C FF1534604800            call dword ptr [00486034]
:0040A542 8945FC                  mov dword ptr [ebp-04], eax
:0040A545 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040A548 51                      push ecx
:0040A549 E852F1FFFF              call 004096A0
:0040A54E 83C404                  add esp, 00000004
:0040A551 8B55F8                  mov edx, dword ptr [ebp-08]
:0040A554 8B0A                    mov ecx, dword ptr [edx]
:0040A556 33D2                    xor edx, edx
:0040A558 668B510E                mov dx, word ptr [ecx+0E]
:0040A55C 3BC2                    cmp eax, edx
:0040A55E 750A                    jne 0040A56A
:0040A560 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040A563 E805F6FFFF              call 00409B6D
:0040A568 EB0C                    jmp 0040A576

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A55E(C)
|
:0040A56A 8B45FC                  mov eax, dword ptr [ebp-04]
:0040A56D 50                      push eax
:0040A56E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040A571 E892F5FFFF              call 00409B08

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A568(U)
|
:0040A576 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040A579 51                      push ecx
:0040A57A FF15A0604800            call dword ptr [004860A0]
:0040A580 8B55F8                  mov edx, dword ptr [ebp-08]
:0040A583 8B4210                  mov eax, dword ptr [edx+10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A52F(U)
|
:0040A586 8BE5                    mov esp, ebp
:0040A588 5D                      pop ebp
:0040A589 C3                      ret



* Referenced by a CALL at Addresses:
|:0040A227   , :0040A2F3   , :0040B2CD   
|
:0040A58A 55                      push ebp
:0040A58B 8BEC                    mov ebp, esp
:0040A58D 83EC2C                  sub esp, 0000002C
:0040A590 56                      push esi
:0040A591 57                      push edi
:0040A592 894DD4                  mov dword ptr [ebp-2C], ecx
:0040A595 8B45D4                  mov eax, dword ptr [ebp-2C]
:0040A598 833800                  cmp dword ptr [eax], 00000000
:0040A59B 7409                    je 0040A5A6
:0040A59D 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0040A5A0 83790400                cmp dword ptr [ecx+04], 00000000
:0040A5A4 7507                    jne 0040A5AD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A59B(C)
|
:0040A5A6 33C0                    xor eax, eax
:0040A5A8 E9C3010000              jmp 0040A770

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A5A4(C)
|
:0040A5AD 8B55D4                  mov edx, dword ptr [ebp-2C]
:0040A5B0 8B02                    mov eax, dword ptr [edx]
:0040A5B2 33C9                    xor ecx, ecx
:0040A5B4 668B480E                mov cx, word ptr [eax+0E]
:0040A5B8 83F908                  cmp ecx, 00000008
:0040A5BB 7407                    je 0040A5C4
:0040A5BD 33C0                    xor eax, eax
:0040A5BF E9AC010000              jmp 0040A770

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A5BB(C)
|
:0040A5C4 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0040A5C7 E826F6FFFF              call 00409BF2
:0040A5CC 8945F8                  mov dword ptr [ebp-08], eax
:0040A5CF 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0040A5D2 E83AF6FFFF              call 00409C11
:0040A5D7 8945E8                  mov dword ptr [ebp-18], eax
:0040A5DA 837DE800                cmp dword ptr [ebp-18], 00000000
:0040A5DE 7507                    jne 0040A5E7
:0040A5E0 33C0                    xor eax, eax
:0040A5E2 E989010000              jmp 0040A770

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A5DE(C)
|
:0040A5E7 8B45F8                  mov eax, dword ptr [ebp-08]
:0040A5EA 83C00F                  add eax, 0000000F
:0040A5ED 99                      cdq
:0040A5EE 83E20F                  and edx, 0000000F
:0040A5F1 03C2                    add eax, edx
:0040A5F3 C1F804                  sar eax, 04
:0040A5F6 D1E0                    shl eax, 1
:0040A5F8 8945E4                  mov dword ptr [ebp-1C], eax
:0040A5FB 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0040A5FE E844F6FFFF              call 00409C47
:0040A603 33D2                    xor edx, edx
:0040A605 F775E8                  div [ebp-18]
:0040A608 8945FC                  mov dword ptr [ebp-04], eax
:0040A60B 6A00                    push 00000000
:0040A60D E8DE690700              call 00480FF0
:0040A612 83C404                  add esp, 00000004
:0040A615 8945F4                  mov dword ptr [ebp-0C], eax
:0040A618 8B55E4                  mov edx, dword ptr [ebp-1C]
:0040A61B 0FAF55E8                imul edx, dword ptr [ebp-18]
:0040A61F 52                      push edx
:0040A620 E8BB690700              call 00480FE0
:0040A625 83C404                  add esp, 00000004
:0040A628 8945EC                  mov dword ptr [ebp-14], eax
:0040A62B 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040A62E 50                      push eax
:0040A62F E8BC690700              call 00480FF0
:0040A634 83C404                  add esp, 00000004
:0040A637 837DEC00                cmp dword ptr [ebp-14], 00000000
:0040A63B 7514                    jne 0040A651
:0040A63D 68F06E4800              push 00486EF0
:0040A642 E890A50600              call 00474BD7
:0040A647 83C404                  add esp, 00000004
:0040A64A 33C0                    xor eax, eax
:0040A64C E91F010000              jmp 0040A770

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A63B(C)
|
:0040A651 6A01                    push 00000001
:0040A653 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0040A656 E847FEFFFF              call 0040A4A2
:0040A65B 8945F0                  mov dword ptr [ebp-10], eax
:0040A65E 837DF000                cmp dword ptr [ebp-10], 00000000
:0040A662 0F84FA000000            je 0040A762
:0040A668 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0040A66B 0FAF4DE8                imul ecx, dword ptr [ebp-18]
:0040A66F 51                      push ecx
:0040A670 6A00                    push 00000000
:0040A672 8B55EC                  mov edx, dword ptr [ebp-14]
:0040A675 52                      push edx
:0040A676 E8B5640700              call 00480B30
:0040A67B 83C40C                  add esp, 0000000C
:0040A67E C745E000000000          mov [ebp-20], 00000000
:0040A685 EB09                    jmp 0040A690

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A72F(U)
|
:0040A687 8B45E0                  mov eax, dword ptr [ebp-20]
:0040A68A 83C001                  add eax, 00000001
:0040A68D 8945E0                  mov dword ptr [ebp-20], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A685(U)
|
:0040A690 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0040A693 3B4DE8                  cmp ecx, dword ptr [ebp-18]
:0040A696 0F8D98000000            jnl 0040A734
:0040A69C C745DC00000000          mov [ebp-24], 00000000
:0040A6A3 EB09                    jmp 0040A6AE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A72A(U)
|
:0040A6A5 8B55DC                  mov edx, dword ptr [ebp-24]
:0040A6A8 83C201                  add edx, 00000001
:0040A6AB 8955DC                  mov dword ptr [ebp-24], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A6A3(U)
|
:0040A6AE 8B45DC                  mov eax, dword ptr [ebp-24]
:0040A6B1 3B45F8                  cmp eax, dword ptr [ebp-08]
:0040A6B4 7D79                    jge 0040A72F
:0040A6B6 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0040A6B9 0FAF4DFC                imul ecx, dword ptr [ebp-04]
:0040A6BD 8B55DC                  mov edx, dword ptr [ebp-24]
:0040A6C0 03D1                    add edx, ecx
:0040A6C2 8B45F0                  mov eax, dword ptr [ebp-10]
:0040A6C5 33C9                    xor ecx, ecx
:0040A6C7 8A0C10                  mov cl, byte ptr [eax+edx]
:0040A6CA 8B5508                  mov edx, dword ptr [ebp+08]
:0040A6CD 81E2FF000000            and edx, 000000FF
:0040A6D3 3BCA                    cmp ecx, edx
:0040A6D5 7553                    jne 0040A72A
:0040A6D7 8B75E0                  mov esi, dword ptr [ebp-20]
:0040A6DA 0FAF75E4                imul esi, dword ptr [ebp-1C]
:0040A6DE 8B45DC                  mov eax, dword ptr [ebp-24]
:0040A6E1 99                      cdq
:0040A6E2 83E207                  and edx, 00000007
:0040A6E5 03C2                    add eax, edx
:0040A6E7 8BF8                    mov edi, eax
:0040A6E9 C1FF03                  sar edi, 03
:0040A6EC 037DEC                  add edi, dword ptr [ebp-14]
:0040A6EF 8B45DC                  mov eax, dword ptr [ebp-24]
:0040A6F2 99                      cdq
:0040A6F3 33C2                    xor eax, edx
:0040A6F5 2BC2                    sub eax, edx
:0040A6F7 83E007                  and eax, 00000007
:0040A6FA 33C2                    xor eax, edx
:0040A6FC 2BC2                    sub eax, edx

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0040A6FE B907000000              mov ecx, 00000007
:0040A703 2BC8                    sub ecx, eax
:0040A705 B801000000              mov eax, 00000001
:0040A70A D3E0                    shl eax, cl
:0040A70C 8A0C37                  mov cl, byte ptr [edi+esi]
:0040A70F 0AC8                    or cl, al
:0040A711 8B45DC                  mov eax, dword ptr [ebp-24]
:0040A714 99                      cdq
:0040A715 83E207                  and edx, 00000007
:0040A718 03C2                    add eax, edx
:0040A71A C1F803                  sar eax, 03
:0040A71D 8B55E0                  mov edx, dword ptr [ebp-20]
:0040A720 0FAF55E4                imul edx, dword ptr [ebp-1C]
:0040A724 0345EC                  add eax, dword ptr [ebp-14]
:0040A727 880C10                  mov byte ptr [eax+edx], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A6D5(C)
|
:0040A72A E976FFFFFF              jmp 0040A6A5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A6B4(C)
|
:0040A72F E953FFFFFF              jmp 0040A687

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A696(C)
|
:0040A734 8B45EC                  mov eax, dword ptr [ebp-14]
:0040A737 50                      push eax
:0040A738 6A01                    push 00000001
:0040A73A 6A01                    push 00000001
:0040A73C 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0040A73F 51                      push ecx
:0040A740 8B55F8                  mov edx, dword ptr [ebp-08]
:0040A743 52                      push edx
:0040A744 FF1540604800            call dword ptr [00486040]
:0040A74A 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0040A74D 894114                  mov dword ptr [ecx+14], eax
:0040A750 8B55EC                  mov edx, dword ptr [ebp-14]
:0040A753 8955D8                  mov dword ptr [ebp-28], edx
:0040A756 8B45D8                  mov eax, dword ptr [ebp-28]
:0040A759 50                      push eax
:0040A75A E8C1680700              call 00481020
:0040A75F 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A662(C)
|
:0040A762 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0040A765 E886FDFFFF              call 0040A4F0
:0040A76A 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0040A76D 8B4114                  mov eax, dword ptr [ecx+14]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040A5A8(U), :0040A5BF(U), :0040A5E2(U), :0040A64C(U)
|
:0040A770 5F                      pop edi
:0040A771 5E                      pop esi
:0040A772 8BE5                    mov esp, ebp
:0040A774 5D                      pop ebp
:0040A775 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0040A4BF   , :0040A4D1   
|
:0040A778 55                      push ebp
:0040A779 8BEC                    mov ebp, esp
:0040A77B 51                      push ecx
:0040A77C 894DFC                  mov dword ptr [ebp-04], ecx
:0040A77F 8B45FC                  mov eax, dword ptr [ebp-04]
:0040A782 833800                  cmp dword ptr [eax], 00000000
:0040A785 7410                    je 0040A797
:0040A787 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040A78A 8B11                    mov edx, dword ptr [ecx]
:0040A78C 33C0                    xor eax, eax
:0040A78E 837A0800                cmp dword ptr [edx+08], 00000000
:0040A792 0F9FC0                  setg al
:0040A795 EB02                    jmp 0040A799

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A785(C)
|
:0040A797 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A795(U)
|
:0040A799 8BE5                    mov esp, ebp
:0040A79B 5D                      pop ebp
:0040A79C C3                      ret



* Referenced by a CALL at Address:
|:0040A879   
|
:0040A79D 55                      push ebp
:0040A79E 8BEC                    mov ebp, esp
:0040A7A0 83EC0C                  sub esp, 0000000C
:0040A7A3 894DF4                  mov dword ptr [ebp-0C], ecx
:0040A7A6 C745FC00000000          mov [ebp-04], 00000000
:0040A7AD EB09                    jmp 0040A7B8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A830(U)
|
:0040A7AF 8B45FC                  mov eax, dword ptr [ebp-04]
:0040A7B2 83C001                  add eax, 00000001
:0040A7B5 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A7AD(U)
|
:0040A7B8 837DFC48                cmp dword ptr [ebp-04], 00000048
:0040A7BC 7D77                    jge 0040A835
:0040A7BE 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0040A7C1 51                      push ecx
:0040A7C2 6A01                    push 00000001
:0040A7C4 8B55FC                  mov edx, dword ptr [ebp-04]
:0040A7C7 81C2AE000000            add edx, 000000AE
:0040A7CD 52                      push edx
:0040A7CE E81E420700              call 0047E9F1
:0040A7D3 83C40C                  add esp, 0000000C
:0040A7D6 8B45FC                  mov eax, dword ptr [ebp-04]
:0040A7D9 6BC003                  imul eax, 00000003
:0040A7DC 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040A7DF 33D2                    xor edx, edx
:0040A7E1 8A540134                mov dl, byte ptr [ecx+eax+34]
:0040A7E5 8B45F8                  mov eax, dword ptr [ebp-08]
:0040A7E8 25FF000000              and eax, 000000FF
:0040A7ED 3BD0                    cmp edx, eax
:0040A7EF 7538                    jne 0040A829
:0040A7F1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040A7F4 6BC903                  imul ecx, 00000003
:0040A7F7 8B55F4                  mov edx, dword ptr [ebp-0C]
:0040A7FA 33C0                    xor eax, eax
:0040A7FC 8A440A35                mov al, byte ptr [edx+ecx+35]
:0040A800 8B4DF9                  mov ecx, dword ptr [ebp-07]
:0040A803 81E1FF000000            and ecx, 000000FF
:0040A809 3BC1                    cmp eax, ecx
:0040A80B 751C                    jne 0040A829
:0040A80D 8B55FC                  mov edx, dword ptr [ebp-04]
:0040A810 6BD203                  imul edx, 00000003
:0040A813 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040A816 33C9                    xor ecx, ecx
:0040A818 8A4C1036                mov cl, byte ptr [eax+edx+36]
:0040A81C 8B55FA                  mov edx, dword ptr [ebp-06]
:0040A81F 81E2FF000000            and edx, 000000FF
:0040A825 3BCA                    cmp ecx, edx
:0040A827 7407                    je 0040A830

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040A7EF(C), :0040A80B(C)
|
:0040A829 B801000000              mov eax, 00000001
:0040A82E EB07                    jmp 0040A837

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A827(C)
|
:0040A830 E97AFFFFFF              jmp 0040A7AF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A7BC(C)
|
:0040A835 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A82E(U)
|
:0040A837 8BE5                    mov esp, ebp
:0040A839 5D                      pop ebp
:0040A83A C3                      ret



* Referenced by a CALL at Address:
|:0040AD79   
|
:0040A83B 55                      push ebp
:0040A83C 8BEC                    mov ebp, esp
:0040A83E 83EC20                  sub esp, 00000020
:0040A841 894DE0                  mov dword ptr [ebp-20], ecx
:0040A844 8B45E0                  mov eax, dword ptr [ebp-20]
:0040A847 83782000                cmp dword ptr [eax+20], 00000000
:0040A84B 7450                    je 0040A89D
:0040A84D 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0040A850 8B511C                  mov edx, dword ptr [ecx+1C]
:0040A853 3B550C                  cmp edx, dword ptr [ebp+0C]
:0040A856 7545                    jne 0040A89D
:0040A858 8B45E0                  mov eax, dword ptr [ebp-20]
:0040A85B 83782C00                cmp dword ptr [eax+2C], 00000000
:0040A85F 7406                    je 0040A867
:0040A861 837D1000                cmp dword ptr [ebp+10], 00000000
:0040A865 7436                    je 0040A89D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A85F(C)
|
:0040A867 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0040A86A 83792C00                cmp dword ptr [ecx+2C], 00000000
:0040A86E 7506                    jne 0040A876
:0040A870 837D1000                cmp dword ptr [ebp+10], 00000000
:0040A874 7527                    jne 0040A89D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A86E(C)
|
:0040A876 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0040A879 E81FFFFFFF              call 0040A79D
:0040A87E 85C0                    test eax, eax
:0040A880 751B                    jne 0040A89D
:0040A882 B9202E4900              mov ecx, 00492E20
:0040A887 E824100000              call 0040B8B0
:0040A88C 25FF000000              and eax, 000000FF
:0040A891 8B55E0                  mov edx, dword ptr [ebp-20]
:0040A894 394230                  cmp dword ptr [edx+30], eax
:0040A897 0F8491010000            je 0040AA2E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040A84B(C), :0040A856(C), :0040A865(C), :0040A874(C), :0040A880(C)
|
:0040A89D B9202E4900              mov ecx, 00492E20
:0040A8A2 E809100000              call 0040B8B0
:0040A8A7 25FF000000              and eax, 000000FF
:0040A8AC 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0040A8AF 894130                  mov dword ptr [ecx+30], eax
:0040A8B2 6A30                    push 00000030
:0040A8B4 6A30                    push 00000030
:0040A8B6 6A04                    push 00000004
:0040A8B8 6A00                    push 00000000
:0040A8BA B9202E4900              mov ecx, 00492E20
:0040A8BF E824080000              call 0040B0E8
:0040A8C4 50                      push eax
:0040A8C5 B950EB4A00              mov ecx, 004AEB50
:0040A8CA E871510700              call 0047FA40
:0040A8CF 50                      push eax
:0040A8D0 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0040A8D3 E8C5EEFFFF              call 0040979D
:0040A8D8 85C0                    test eax, eax
:0040A8DA 7507                    jne 0040A8E3
:0040A8DC 33C0                    xor eax, eax
:0040A8DE E950010000              jmp 0040AA33

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A8DA(C)
|
:0040A8E3 8B5510                  mov edx, dword ptr [ebp+10]
:0040A8E6 52                      push edx
:0040A8E7 8B450C                  mov eax, dword ptr [ebp+0C]
:0040A8EA 50                      push eax
:0040A8EB 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0040A8EE E846010000              call 0040AA39
:0040A8F3 85C0                    test eax, eax
:0040A8F5 750F                    jne 0040A906
:0040A8F7 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0040A8FA E8ABF3FFFF              call 00409CAA
:0040A8FF 33C0                    xor eax, eax
:0040A901 E92D010000              jmp 0040AA33

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A8F5(C)
|
:0040A906 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0040A909 8B550C                  mov edx, dword ptr [ebp+0C]
:0040A90C 89511C                  mov dword ptr [ecx+1C], edx
:0040A90F 8B45E0                  mov eax, dword ptr [ebp-20]
:0040A912 8B4D10                  mov ecx, dword ptr [ebp+10]
:0040A915 89482C                  mov dword ptr [eax+2C], ecx
:0040A918 8B55E0                  mov edx, dword ptr [ebp-20]
:0040A91B 83C234                  add edx, 00000034
:0040A91E 52                      push edx
:0040A91F 6A48                    push 00000048
:0040A921 68AE000000              push 000000AE
:0040A926 E8C6400700              call 0047E9F1
:0040A92B 83C40C                  add esp, 0000000C
:0040A92E 8B45E0                  mov eax, dword ptr [ebp-20]
:0040A931 83782000                cmp dword ptr [eax+20], 00000000
:0040A935 7536                    jne 0040A96D
:0040A937 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0040A93A 8B5128                  mov edx, dword ptr [ecx+28]
:0040A93D 52                      push edx
:0040A93E 8B45E0                  mov eax, dword ptr [ebp-20]
:0040A941 8B4824                  mov ecx, dword ptr [eax+24]
:0040A944 51                      push ecx
:0040A945 8B5508                  mov edx, dword ptr [ebp+08]
:0040A948 52                      push edx
:0040A949 FF1578604800            call dword ptr [00486078]
:0040A94F 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0040A952 894120                  mov dword ptr [ecx+20], eax
:0040A955 8B55E0                  mov edx, dword ptr [ebp-20]
:0040A958 837A2000                cmp dword ptr [edx+20], 00000000
:0040A95C 750F                    jne 0040A96D
:0040A95E 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0040A961 E844F3FFFF              call 00409CAA
:0040A966 33C0                    xor eax, eax
:0040A968 E9C6000000              jmp 0040AA33

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040A935(C), :0040A95C(C)
|
:0040A96D 8B45E0                  mov eax, dword ptr [ebp-20]
:0040A970 8B4820                  mov ecx, dword ptr [eax+20]
:0040A973 51                      push ecx
:0040A974 8B15242E4900            mov edx, dword ptr [00492E24]
:0040A97A 52                      push edx
:0040A97B FF156C604800            call dword ptr [0048606C]
:0040A981 8B450C                  mov eax, dword ptr [ebp+0C]
:0040A984 50                      push eax
:0040A985 FF1568604800            call dword ptr [00486068]
:0040A98B 8945FC                  mov dword ptr [ebp-04], eax
:0040A98E C745E800000000          mov [ebp-18], 00000000
:0040A995 C745EC00000000          mov [ebp-14], 00000000
:0040A99C 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0040A99F 8B5124                  mov edx, dword ptr [ecx+24]
:0040A9A2 8955F0                  mov dword ptr [ebp-10], edx
:0040A9A5 8B45E0                  mov eax, dword ptr [ebp-20]
:0040A9A8 8B4828                  mov ecx, dword ptr [eax+28]
:0040A9AB 894DF4                  mov dword ptr [ebp-0C], ecx
:0040A9AE 8B55FC                  mov edx, dword ptr [ebp-04]
:0040A9B1 52                      push edx
:0040A9B2 8D45E8                  lea eax, dword ptr [ebp-18]
:0040A9B5 50                      push eax
:0040A9B6 8B0D242E4900            mov ecx, dword ptr [00492E24]
:0040A9BC 51                      push ecx
:0040A9BD FF15F0624800            call dword ptr [004862F0]
:0040A9C3 C745F800000000          mov [ebp-08], 00000000
:0040A9CA EB09                    jmp 0040A9D5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040AA1A(U)
|
:0040A9CC 8B55F8                  mov edx, dword ptr [ebp-08]
:0040A9CF 83C230                  add edx, 00000030
:0040A9D2 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A9CA(U)
|
:0040A9D5 8B45E0                  mov eax, dword ptr [ebp-20]
:0040A9D8 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040A9DB 3B4828                  cmp ecx, dword ptr [eax+28]
:0040A9DE 7D3C                    jge 0040AA1C
:0040A9E0 C745E400000000          mov [ebp-1C], 00000000
:0040A9E7 EB09                    jmp 0040A9F2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040AA18(U)
|
:0040A9E9 8B55E4                  mov edx, dword ptr [ebp-1C]
:0040A9EC 83C230                  add edx, 00000030
:0040A9EF 8955E4                  mov dword ptr [ebp-1C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A9E7(U)
|
:0040A9F2 8B45E0                  mov eax, dword ptr [ebp-20]
:0040A9F5 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0040A9F8 3B4824                  cmp ecx, dword ptr [eax+24]
:0040A9FB 7D1D                    jge 0040AA1A
:0040A9FD 6A01                    push 00000001
:0040A9FF 6A00                    push 00000000
:0040AA01 8B55F8                  mov edx, dword ptr [ebp-08]
:0040AA04 52                      push edx
:0040AA05 8B45E4                  mov eax, dword ptr [ebp-1C]
:0040AA08 50                      push eax
:0040AA09 8B0D242E4900            mov ecx, dword ptr [00492E24]
:0040AA0F 51                      push ecx
:0040AA10 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0040AA13 E8AAF7FFFF              call 0040A1C2
:0040AA18 EBCF                    jmp 0040A9E9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A9FB(C)
|
:0040AA1A EBB0                    jmp 0040A9CC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A9DE(C)
|
:0040AA1C 8B55FC                  mov edx, dword ptr [ebp-04]
:0040AA1F 52                      push edx
:0040AA20 FF1548604800            call dword ptr [00486048]
:0040AA26 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0040AA29 E87CF2FFFF              call 00409CAA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A897(C)
|
:0040AA2E B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040A8DE(U), :0040A901(U), :0040A968(U)
|
:0040AA33 8BE5                    mov esp, ebp
:0040AA35 5D                      pop ebp
:0040AA36 C20C00                  ret 000C



* Referenced by a CALL at Address:
|:0040A8EE   
|
:0040AA39 55                      push ebp
:0040AA3A 8BEC                    mov ebp, esp
:0040AA3C 83EC38                  sub esp, 00000038
:0040AA3F 894DD4                  mov dword ptr [ebp-2C], ecx
:0040AA42 8D45F0                  lea eax, dword ptr [ebp-10]
:0040AA45 50                      push eax
:0040AA46 6A01                    push 00000001
:0040AA48 6A12                    push 00000012
:0040AA4A E8A23F0700              call 0047E9F1
:0040AA4F 83C40C                  add esp, 0000000C
:0040AA52 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040AA55 81E100000001            and ecx, 01000000
:0040AA5B 81F900000001            cmp ecx, 01000000
:0040AA61 7555                    jne 0040AAB8
:0040AA63 8A5508                  mov dl, byte ptr [ebp+08]
:0040AA66 8855EC                  mov byte ptr [ebp-14], dl
:0040AA69 8B45EC                  mov eax, dword ptr [ebp-14]
:0040AA6C 25FF000000              and eax, 000000FF
:0040AA71 6BC003                  imul eax, 00000003
:0040AA74 33C9                    xor ecx, ecx
:0040AA76 8A8870774900            mov cl, byte ptr [eax+00497770]
:0040AA7C C1E104                  shl ecx, 04
:0040AA7F 884DFC                  mov byte ptr [ebp-04], cl
:0040AA82 8B55EC                  mov edx, dword ptr [ebp-14]
:0040AA85 81E2FF000000            and edx, 000000FF
:0040AA8B 6BD203                  imul edx, 00000003
:0040AA8E 33C0                    xor eax, eax
:0040AA90 8A8271774900            mov al, byte ptr [edx+00497771]
:0040AA96 C1E004                  shl eax, 04
:0040AA99 8845F8                  mov byte ptr [ebp-08], al
:0040AA9C 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040AA9F 81E1FF000000            and ecx, 000000FF
:0040AAA5 6BC903                  imul ecx, 00000003
:0040AAA8 33D2                    xor edx, edx
:0040AAAA 8A9172774900            mov dl, byte ptr [ecx+00497772]
:0040AAB0 C1E204                  shl edx, 04
:0040AAB3 8855F4                  mov byte ptr [ebp-0C], dl
:0040AAB6 EB1E                    jmp 0040AAD6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040AA61(C)
|
:0040AAB8 8A4508                  mov al, byte ptr [ebp+08]
:0040AABB 8845F8                  mov byte ptr [ebp-08], al
:0040AABE 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040AAC1 81E1FFFF0000            and ecx, 0000FFFF
:0040AAC7 C1F908                  sar ecx, 08
:0040AACA 884DF4                  mov byte ptr [ebp-0C], cl
:0040AACD 8B5508                  mov edx, dword ptr [ebp+08]
:0040AAD0 C1EA10                  shr edx, 10
:0040AAD3 8855FC                  mov byte ptr [ebp-04], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040AAB6(U)
|
:0040AAD6 6A00                    push 00000000
:0040AAD8 E8C3EBFFFF              call 004096A0
:0040AADD 83C404                  add esp, 00000004
:0040AAE0 83F808                  cmp eax, 00000008
:0040AAE3 0F8E57010000            jle 0040AC40
:0040AAE9 8B45D4                  mov eax, dword ptr [ebp-2C]
:0040AAEC 83781800                cmp dword ptr [eax+18], 00000000
:0040AAF0 0F844A010000            je 0040AC40
:0040AAF6 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0040AAF9 8B11                    mov edx, dword ptr [ecx]
:0040AAFB 83C228                  add edx, 00000028
:0040AAFE 8955E4                  mov dword ptr [ebp-1C], edx
:0040AB01 8B45E4                  mov eax, dword ptr [ebp-1C]
:0040AB04 33C9                    xor ecx, ecx
:0040AB06 8A485A                  mov cl, byte ptr [eax+5A]
:0040AB09 8B55E4                  mov edx, dword ptr [ebp-1C]
:0040AB0C 33C0                    xor eax, eax
:0040AB0E 8A4259                  mov al, byte ptr [edx+59]
:0040AB11 03C8                    add ecx, eax
:0040AB13 8B55E4                  mov edx, dword ptr [ebp-1C]
:0040AB16 33C0                    xor eax, eax
:0040AB18 8A4258                  mov al, byte ptr [edx+58]
:0040AB1B 03C8                    add ecx, eax
:0040AB1D 894DE8                  mov dword ptr [ebp-18], ecx
:0040AB20 837DE800                cmp dword ptr [ebp-18], 00000000
:0040AB24 0F8E14010000            jle 0040AC3E
:0040AB2A 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0040AB2D E8BAF3FFFF              call 00409EEC
:0040AB32 25FFFF0000              and eax, 0000FFFF
:0040AB37 8945DC                  mov dword ptr [ebp-24], eax
:0040AB3A C745E000000000          mov [ebp-20], 00000000
:0040AB41 EB12                    jmp 0040AB55

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040AC32(U)
|
:0040AB43 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0040AB46 83C101                  add ecx, 00000001
:0040AB49 894DE0                  mov dword ptr [ebp-20], ecx
:0040AB4C 8B55E4                  mov edx, dword ptr [ebp-1C]
:0040AB4F 83C204                  add edx, 00000004
:0040AB52 8955E4                  mov dword ptr [ebp-1C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040AB41(U)
|
:0040AB55 8B45E0                  mov eax, dword ptr [ebp-20]
:0040AB58 3B45DC                  cmp eax, dword ptr [ebp-24]
:0040AB5B 0F8DD6000000            jnl 0040AC37
:0040AB61 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0040AB64 33D2                    xor edx, edx
:0040AB66 8A5102                  mov dl, byte ptr [ecx+02]
:0040AB69 8B45E4                  mov eax, dword ptr [ebp-1C]
:0040AB6C 33C9                    xor ecx, ecx
:0040AB6E 8A4801                  mov cl, byte ptr [eax+01]
:0040AB71 03D1                    add edx, ecx
:0040AB73 8B45E4                  mov eax, dword ptr [ebp-1C]
:0040AB76 33C9                    xor ecx, ecx
:0040AB78 8A08                    mov cl, byte ptr [eax]
:0040AB7A 03D1                    add edx, ecx
:0040AB7C 8955D8                  mov dword ptr [ebp-28], edx
:0040AB7F 8B45F8                  mov eax, dword ptr [ebp-08]
:0040AB82 25FF000000              and eax, 000000FF
:0040AB87 0FAF45D8                imul eax, dword ptr [ebp-28]
:0040AB8B 99                      cdq
:0040AB8C F77DE8                  idiv [ebp-18]
:0040AB8F 3DFF000000              cmp eax, 000000FF
:0040AB94 7E09                    jle 0040AB9F
:0040AB96 C745D0FF000000          mov [ebp-30], 000000FF
:0040AB9D EB13                    jmp 0040ABB2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040AB94(C)
|
:0040AB9F 8B45F8                  mov eax, dword ptr [ebp-08]
:0040ABA2 25FF000000              and eax, 000000FF
:0040ABA7 0FAF45D8                imul eax, dword ptr [ebp-28]
:0040ABAB 99                      cdq
:0040ABAC F77DE8                  idiv [ebp-18]
:0040ABAF 8945D0                  mov dword ptr [ebp-30], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040AB9D(U)
|
:0040ABB2 8B55E4                  mov edx, dword ptr [ebp-1C]
:0040ABB5 8A45D0                  mov al, byte ptr [ebp-30]
:0040ABB8 884202                  mov byte ptr [edx+02], al
:0040ABBB 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040ABBE 25FF000000              and eax, 000000FF
:0040ABC3 0FAF45D8                imul eax, dword ptr [ebp-28]
:0040ABC7 99                      cdq
:0040ABC8 F77DE8                  idiv [ebp-18]
:0040ABCB 3DFF000000              cmp eax, 000000FF
:0040ABD0 7E09                    jle 0040ABDB
:0040ABD2 C745CCFF000000          mov [ebp-34], 000000FF
:0040ABD9 EB13                    jmp 0040ABEE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040ABD0(C)
|
:0040ABDB 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040ABDE 25FF000000              and eax, 000000FF
:0040ABE3 0FAF45D8                imul eax, dword ptr [ebp-28]
:0040ABE7 99                      cdq
:0040ABE8 F77DE8                  idiv [ebp-18]
:0040ABEB 8945CC                  mov dword ptr [ebp-34], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040ABD9(U)
|
:0040ABEE 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0040ABF1 8A55CC                  mov dl, byte ptr [ebp-34]
:0040ABF4 885101                  mov byte ptr [ecx+01], dl
:0040ABF7 8B45FC                  mov eax, dword ptr [ebp-04]
:0040ABFA 25FF000000              and eax, 000000FF
:0040ABFF 0FAF45D8                imul eax, dword ptr [ebp-28]
:0040AC03 99                      cdq
:0040AC04 F77DE8                  idiv [ebp-18]
:0040AC07 3DFF000000              cmp eax, 000000FF
:0040AC0C 7E09                    jle 0040AC17
:0040AC0E C745C8FF000000          mov [ebp-38], 000000FF
:0040AC15 EB13                    jmp 0040AC2A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040AC0C(C)
|
:0040AC17 8B45FC                  mov eax, dword ptr [ebp-04]
:0040AC1A 25FF000000              and eax, 000000FF
:0040AC1F 0FAF45D8                imul eax, dword ptr [ebp-28]
:0040AC23 99                      cdq
:0040AC24 F77DE8                  idiv [ebp-18]
:0040AC27 8945C8                  mov dword ptr [ebp-38], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040AC15(U)
|
:0040AC2A 8B45E4                  mov eax, dword ptr [ebp-1C]
:0040AC2D 8A4DC8                  mov cl, byte ptr [ebp-38]
:0040AC30 8808                    mov byte ptr [eax], cl
:0040AC32 E90CFFFFFF              jmp 0040AB43

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040AB5B(C)
|
:0040AC37 B801000000              mov eax, 00000001
:0040AC3C EB3E                    jmp 0040AC7C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040AB24(C)
|
:0040AC3E EB3A                    jmp 0040AC7A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040AAE3(C), :0040AAF0(C)
|
:0040AC40 8B55F0                  mov edx, dword ptr [ebp-10]
:0040AC43 81E2FF000000            and edx, 000000FF
:0040AC49 83FA0F                  cmp edx, 0000000F
:0040AC4C 7C2C                    jl 0040AC7A
:0040AC4E 8B450C                  mov eax, dword ptr [ebp+0C]
:0040AC51 50                      push eax
:0040AC52 6A16                    push 00000016
:0040AC54 8A4DFC                  mov cl, byte ptr [ebp-04]
:0040AC57 51                      push ecx
:0040AC58 8A55F4                  mov dl, byte ptr [ebp-0C]
:0040AC5B 52                      push edx
:0040AC5C 8A45F8                  mov al, byte ptr [ebp-08]
:0040AC5F 50                      push eax
:0040AC60 6A30                    push 00000030
:0040AC62 6A30                    push 00000030
:0040AC64 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0040AC67 8B5104                  mov edx, dword ptr [ecx+04]
:0040AC6A 52                      push edx
:0040AC6B E83A5A0200              call 004306AA
:0040AC70 83C420                  add esp, 00000020
:0040AC73 B801000000              mov eax, 00000001
:0040AC78 EB02                    jmp 0040AC7C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040AC3E(U), :0040AC4C(C)
|
:0040AC7A 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040AC3C(U), :0040AC78(U)
|
:0040AC7C 8BE5                    mov esp, ebp
:0040AC7E 5D                      pop ebp
:0040AC7F C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:004646DE   , :004646EC   , :004646FA   , :00464708   , :0046A1D2   
|:0046A1E0   , :004711A2   , :004711DA   
|
:0040AC82 55                      push ebp
:0040AC83 8BEC                    mov ebp, esp
:0040AC85 51                      push ecx
:0040AC86 894DFC                  mov dword ptr [ebp-04], ecx
:0040AC89 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040AC8C E89F0B0000              call 0040B830
:0040AC91 8B4508                  mov eax, dword ptr [ebp+08]
:0040AC94 6BC030                  imul eax, 00000030
:0040AC97 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040AC9A 894124                  mov dword ptr [ecx+24], eax
:0040AC9D 8B550C                  mov edx, dword ptr [ebp+0C]
:0040ACA0 6BD230                  imul edx, 00000030
:0040ACA3 8B45FC                  mov eax, dword ptr [ebp-04]
:0040ACA6 895028                  mov dword ptr [eax+28], edx
:0040ACA9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040ACAC C7412000000000          mov [ecx+20], 00000000
:0040ACB3 8B45FC                  mov eax, dword ptr [ebp-04]
:0040ACB6 8BE5                    mov esp, ebp
:0040ACB8 5D                      pop ebp
:0040ACB9 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:00471275   , :00471284   
|
:0040ACBC 55                      push ebp
:0040ACBD 8BEC                    mov ebp, esp
:0040ACBF 6AFF                    push FFFFFFFF
:0040ACC1 68D94F4800              push 00484FD9
:0040ACC6 64A100000000            mov eax, dword ptr fs:[00000000]
:0040ACCC 50                      push eax
:0040ACCD 64892500000000          mov dword ptr fs:[00000000], esp
:0040ACD4 51                      push ecx
:0040ACD5 894DF0                  mov dword ptr [ebp-10], ecx
:0040ACD8 C745FC00000000          mov [ebp-04], 00000000
:0040ACDF 833D242E490000          cmp dword ptr [00492E24], 00000000
:0040ACE6 740C                    je 0040ACF4
:0040ACE8 A1242E4900              mov eax, dword ptr [00492E24]
:0040ACED 50                      push eax
:0040ACEE FF15A0604800            call dword ptr [004860A0]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040ACE6(C)
|
:0040ACF4 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040ACF7 83792000                cmp dword ptr [ecx+20], 00000000
:0040ACFB 740D                    je 0040AD0A
:0040ACFD 8B55F0                  mov edx, dword ptr [ebp-10]
:0040AD00 8B4220                  mov eax, dword ptr [edx+20]
:0040AD03 50                      push eax
:0040AD04 FF1548604800            call dword ptr [00486048]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040ACFB(C)
|
:0040AD0A C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0040AD11 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040AD14 E8770B0000              call 0040B890
:0040AD19 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040AD1C 64890D00000000          mov dword ptr fs:[00000000], ecx
:0040AD23 8BE5                    mov esp, ebp
:0040AD25 5D                      pop ebp
:0040AD26 C3                      ret



* Referenced by a CALL at Addresses:
|:0046482C   , :0046A3F6   , :00471212   , :00471232   
|
:0040AD27 55                      push ebp
:0040AD28 8BEC                    mov ebp, esp
:0040AD2A 83EC2C                  sub esp, 0000002C
:0040AD2D 894DDC                  mov dword ptr [ebp-24], ecx
:0040AD30 B9202E4900              mov ecx, 00492E20
:0040AD35 E8AE030000              call 0040B0E8
:0040AD3A 85C0                    test eax, eax
:0040AD3C 0F8CCA010000            jl 0040AF0C
:0040AD42 833D242E490000          cmp dword ptr [00492E24], 00000000
:0040AD49 751F                    jne 0040AD6A
:0040AD4B 8B4508                  mov eax, dword ptr [ebp+08]
:0040AD4E 50                      push eax
:0040AD4F FF1564604800            call dword ptr [00486064]
:0040AD55 A3242E4900              mov dword ptr [00492E24], eax
:0040AD5A 833D242E490000          cmp dword ptr [00492E24], 00000000
:0040AD61 7507                    jne 0040AD6A
:0040AD63 33C0                    xor eax, eax
:0040AD65 E9A4010000              jmp 0040AF0E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040AD49(C), :0040AD61(C)
|
:0040AD6A 8B4D18                  mov ecx, dword ptr [ebp+18]
:0040AD6D 51                      push ecx
:0040AD6E 8B550C                  mov edx, dword ptr [ebp+0C]
:0040AD71 52                      push edx
:0040AD72 8B4508                  mov eax, dword ptr [ebp+08]
:0040AD75 50                      push eax
:0040AD76 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0040AD79 E8BDFAFFFF              call 0040A83B
:0040AD7E 85C0                    test eax, eax
:0040AD80 0F8486010000            je 0040AF0C
:0040AD86 C745E400000000          mov [ebp-1C], 00000000
:0040AD8D C745E800000000          mov [ebp-18], 00000000
:0040AD94 837D1400                cmp dword ptr [ebp+14], 00000000
:0040AD98 740E                    je 0040ADA8
:0040AD9A 8B4D14                  mov ecx, dword ptr [ebp+14]
:0040AD9D 8B11                    mov edx, dword ptr [ecx]
:0040AD9F 8B4104                  mov eax, dword ptr [ecx+04]
:0040ADA2 8955E4                  mov dword ptr [ebp-1C], edx
:0040ADA5 8945E8                  mov dword ptr [ebp-18], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040AD98(C)
|
:0040ADA8 8B4D10                  mov ecx, dword ptr [ebp+10]
:0040ADAB 8B11                    mov edx, dword ptr [ecx]
:0040ADAD 8955F0                  mov dword ptr [ebp-10], edx
:0040ADB0 8B4104                  mov eax, dword ptr [ecx+04]
:0040ADB3 8945F4                  mov dword ptr [ebp-0C], eax
:0040ADB6 8B5108                  mov edx, dword ptr [ecx+08]
:0040ADB9 8955F8                  mov dword ptr [ebp-08], edx
:0040ADBC 8B410C                  mov eax, dword ptr [ecx+0C]
:0040ADBF 8945FC                  mov dword ptr [ebp-04], eax
:0040ADC2 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0040ADC5 034DF0                  add ecx, dword ptr [ebp-10]
:0040ADC8 894DE4                  mov dword ptr [ebp-1C], ecx
:0040ADCB 8B55E8                  mov edx, dword ptr [ebp-18]
:0040ADCE 0355F4                  add edx, dword ptr [ebp-0C]
:0040ADD1 8955E8                  mov dword ptr [ebp-18], edx
:0040ADD4 8B45E4                  mov eax, dword ptr [ebp-1C]
:0040ADD7 99                      cdq
:0040ADD8 B930000000              mov ecx, 00000030
:0040ADDD F7F9                    idiv ecx
:0040ADDF 8955E4                  mov dword ptr [ebp-1C], edx
:0040ADE2 837DE400                cmp dword ptr [ebp-1C], 00000000
:0040ADE6 7D09                    jge 0040ADF1
:0040ADE8 8B55E4                  mov edx, dword ptr [ebp-1C]
:0040ADEB 83C230                  add edx, 00000030
:0040ADEE 8955E4                  mov dword ptr [ebp-1C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040ADE6(C)
|
:0040ADF1 8B45E8                  mov eax, dword ptr [ebp-18]
:0040ADF4 99                      cdq
:0040ADF5 B930000000              mov ecx, 00000030
:0040ADFA F7F9                    idiv ecx
:0040ADFC 8955E8                  mov dword ptr [ebp-18], edx
:0040ADFF 837DE800                cmp dword ptr [ebp-18], 00000000
:0040AE03 7D09                    jge 0040AE0E
:0040AE05 8B55E8                  mov edx, dword ptr [ebp-18]
:0040AE08 83C230                  add edx, 00000030
:0040AE0B 8955E8                  mov dword ptr [ebp-18], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040AE03(C)
|
:0040AE0E 8B45DC                  mov eax, dword ptr [ebp-24]
:0040AE11 8B4820                  mov ecx, dword ptr [eax+20]
:0040AE14 51                      push ecx
:0040AE15 8B15242E4900            mov edx, dword ptr [00492E24]
:0040AE1B 52                      push edx
:0040AE1C FF156C604800            call dword ptr [0048606C]
:0040AE22 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040AE25 8945EC                  mov dword ptr [ebp-14], eax
:0040AE28 EB18                    jmp 0040AE42

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040AF00(U)
|
:0040AE2A 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0040AE2D 8B5128                  mov edx, dword ptr [ecx+28]
:0040AE30 2B55E8                  sub edx, dword ptr [ebp-18]
:0040AE33 8B45EC                  mov eax, dword ptr [ebp-14]
:0040AE36 03C2                    add eax, edx
:0040AE38 8945EC                  mov dword ptr [ebp-14], eax
:0040AE3B C745E800000000          mov [ebp-18], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040AE28(U)
|
:0040AE42 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040AE45 3B4DFC                  cmp ecx, dword ptr [ebp-04]
:0040AE48 0F8DB7000000            jnl 0040AF05
:0040AE4E 8B55F0                  mov edx, dword ptr [ebp-10]
:0040AE51 8955E0                  mov dword ptr [ebp-20], edx
:0040AE54 EB18                    jmp 0040AE6E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040AEFB(U)
|
:0040AE56 8B45DC                  mov eax, dword ptr [ebp-24]
:0040AE59 8B4824                  mov ecx, dword ptr [eax+24]
:0040AE5C 2B4DE4                  sub ecx, dword ptr [ebp-1C]
:0040AE5F 8B55E0                  mov edx, dword ptr [ebp-20]
:0040AE62 03D1                    add edx, ecx
:0040AE64 8955E0                  mov dword ptr [ebp-20], edx
:0040AE67 C745E400000000          mov [ebp-1C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040AE54(U)
|
:0040AE6E 8B45E0                  mov eax, dword ptr [ebp-20]
:0040AE71 3B45F8                  cmp eax, dword ptr [ebp-08]
:0040AE74 0F8D86000000            jnl 0040AF00
:0040AE7A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040AE7D 2B4DEC                  sub ecx, dword ptr [ebp-14]
:0040AE80 8B55DC                  mov edx, dword ptr [ebp-24]
:0040AE83 8B4228                  mov eax, dword ptr [edx+28]
:0040AE86 2B45E8                  sub eax, dword ptr [ebp-18]
:0040AE89 3BC8                    cmp ecx, eax
:0040AE8B 7D0B                    jge 0040AE98
:0040AE8D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040AE90 2B4DEC                  sub ecx, dword ptr [ebp-14]
:0040AE93 894DD8                  mov dword ptr [ebp-28], ecx
:0040AE96 EB0C                    jmp 0040AEA4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040AE8B(C)
|
:0040AE98 8B55DC                  mov edx, dword ptr [ebp-24]
:0040AE9B 8B4228                  mov eax, dword ptr [edx+28]
:0040AE9E 2B45E8                  sub eax, dword ptr [ebp-18]
:0040AEA1 8945D8                  mov dword ptr [ebp-28], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040AE96(U)
|
:0040AEA4 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040AEA7 2B4DE0                  sub ecx, dword ptr [ebp-20]
:0040AEAA 8B55DC                  mov edx, dword ptr [ebp-24]
:0040AEAD 8B4224                  mov eax, dword ptr [edx+24]
:0040AEB0 2B45E4                  sub eax, dword ptr [ebp-1C]
:0040AEB3 3BC8                    cmp ecx, eax
:0040AEB5 7D0B                    jge 0040AEC2
:0040AEB7 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040AEBA 2B4DE0                  sub ecx, dword ptr [ebp-20]
:0040AEBD 894DD4                  mov dword ptr [ebp-2C], ecx
:0040AEC0 EB0C                    jmp 0040AECE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040AEB5(C)
|
:0040AEC2 8B55DC                  mov edx, dword ptr [ebp-24]
:0040AEC5 8B4224                  mov eax, dword ptr [edx+24]
:0040AEC8 2B45E4                  sub eax, dword ptr [ebp-1C]
:0040AECB 8945D4                  mov dword ptr [ebp-2C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040AEC0(U)
|
:0040AECE 682000CC00              push 00CC0020
:0040AED3 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0040AED6 51                      push ecx
:0040AED7 8B55E4                  mov edx, dword ptr [ebp-1C]
:0040AEDA 52                      push edx
:0040AEDB A1242E4900              mov eax, dword ptr [00492E24]
:0040AEE0 50                      push eax
:0040AEE1 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0040AEE4 51                      push ecx
:0040AEE5 8B55D4                  mov edx, dword ptr [ebp-2C]
:0040AEE8 52                      push edx
:0040AEE9 8B45EC                  mov eax, dword ptr [ebp-14]
:0040AEEC 50                      push eax
:0040AEED 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0040AEF0 51                      push ecx
:0040AEF1 8B5508                  mov edx, dword ptr [ebp+08]
:0040AEF4 52                      push edx
:0040AEF5 FF1570604800            call dword ptr [00486070]
:0040AEFB E956FFFFFF              jmp 0040AE56

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040AE74(C)
|
:0040AF00 E925FFFFFF              jmp 0040AE2A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040AE48(C)
|
:0040AF05 B801000000              mov eax, 00000001
:0040AF0A EB02                    jmp 0040AF0E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040AD3C(C), :0040AD80(C)
|
:0040AF0C 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040AD65(U), :0040AF0A(U)
|
:0040AF0E 8BE5                    mov esp, ebp
:0040AF10 5D                      pop ebp
:0040AF11 C21400                  ret 0014



* Referenced by a CALL at Address:
|:0041BF01   
|
:0040AF14 55                      push ebp
:0040AF15 8BEC                    mov ebp, esp
:0040AF17 83EC08                  sub esp, 00000008
:0040AF1A 8B4508                  mov eax, dword ptr [ebp+08]
:0040AF1D 25FF000000              and eax, 000000FF
:0040AF22 8945F8                  mov dword ptr [ebp-08], eax
:0040AF25 837DF803                cmp dword ptr [ebp-08], 00000003
:0040AF29 772E                    ja 0040AF59
:0040AF2B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040AF2E FF248D67AF4000          jmp dword ptr [4*ecx+0040AF67]
:0040AF35 C745FC30644800          mov [ebp-04], 00486430
:0040AF3C EB22                    jmp 0040AF60
:0040AF3E C745FC38644800          mov [ebp-04], 00486438
:0040AF45 EB19                    jmp 0040AF60
:0040AF47 C745FC40644800          mov [ebp-04], 00486440
:0040AF4E EB10                    jmp 0040AF60
:0040AF50 C745FC48644800          mov [ebp-04], 00486448
:0040AF57 EB07                    jmp 0040AF60

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040AF29(C)
|
:0040AF59 C745FC50644800          mov [ebp-04], 00486450

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040AF3C(U), :0040AF45(U), :0040AF4E(U), :0040AF57(U)
|
:0040AF60 8B45FC                  mov eax, dword ptr [ebp-04]
:0040AF63 8BE5                    mov esp, ebp
:0040AF65 5D                      pop ebp
:0040AF66 C3                      ret



:0040AF67 35AF4000                DWORD 0040AF35
:0040AF6B 3EAF4000                DWORD 0040AF3E
:0040AF6F 47AF4000                DWORD 0040AF47
:0040AF73 50AF4000                DWORD 0040AF50



* Referenced by a CALL at Addresses:
|:0040B0AF   , :0041BAA5   , :0041BBB8   , :0041BBDF   , :0041BC16   
|:0041BC3F   , :0041BC76   , :0041BC9D   , :0041BCFA   , :0041BD1D   
|
:0040AF77 55                      push ebp
:0040AF78 8BEC                    mov ebp, esp
:0040AF7A 6AFF                    push FFFFFFFF
:0040AF7C 68EF4F4800              push 00484FEF
:0040AF81 64A100000000            mov eax, dword ptr fs:[00000000]
:0040AF87 50                      push eax
:0040AF88 64892500000000          mov dword ptr fs:[00000000], esp
:0040AF8F 81EC0C010000            sub esp, 0000010C
:0040AF95 56                      push esi
:0040AF96 898DE8FEFFFF            mov dword ptr [ebp+FFFFFEE8], ecx
:0040AF9C 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:0040AFA2 8A08                    mov cl, byte ptr [eax]
:0040AFA4 884DF0                  mov byte ptr [ebp-10], cl
:0040AFA7 8B5508                  mov edx, dword ptr [ebp+08]
:0040AFAA 81E2FF000000            and edx, 000000FF
:0040AFB0 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:0040AFB6 3910                    cmp dword ptr [eax], edx
:0040AFB8 0F8486000000            je 0040B044
:0040AFBE 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040AFC1 81E1FF000000            and ecx, 000000FF
:0040AFC7 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:0040AFCD 890A                    mov dword ptr [edx], ecx
:0040AFCF 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:0040AFD5 833804                  cmp dword ptr [eax], 00000004
:0040AFD8 7D6A                    jge 0040B044
:0040AFDA 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0040AFE0 E8CB82FFFF              call 004032B0
:0040AFE5 C745FC00000000          mov [ebp-04], 00000000

* Possible StringData Ref from Data Obj ->"LOGO.E5"
                                  |
:0040AFEC 68F0BA4800              push 0048BAF0
:0040AFF1 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0040AFF7 E8394B0100              call 0041FB35
:0040AFFC 6A04                    push 00000004
:0040AFFE 6A00                    push 00000000
:0040B000 68C0AB0100              push 0001ABC0
:0040B005 B950EB4A00              mov ecx, 004AEB50
:0040B00A E8314A0700              call 0047FA40
:0040B00F 50                      push eax
:0040B010 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:0040B016 8B11                    mov edx, dword ptr [ecx]
:0040B018 83C208                  add edx, 00000008
:0040B01B 52                      push edx
:0040B01C 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0040B022 E8624C0100              call 0041FC89
:0040B027 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0040B02D E893E20000              call 004192C5
:0040B032 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0040B039 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0040B03F E88C82FFFF              call 004032D0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040AFB8(C), :0040AFD8(C)
|
:0040B044 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0040B048 742A                    je 0040B074
:0040B04A 8B7508                  mov esi, dword ptr [ebp+08]
:0040B04D 81E6FF000000            and esi, 000000FF

* Possible Ref to Menu: APPMENU, Item: ""
                                  |
:0040B053 6A6B                    push 0000006B
:0040B055 E82AF20000              call 0041A284
:0040B05A 83C404                  add esp, 00000004
:0040B05D 25FF000000              and eax, 000000FF
:0040B062 3BF0                    cmp esi, eax
:0040B064 740E                    je 0040B074
:0040B066 8A4508                  mov al, byte ptr [ebp+08]
:0040B069 50                      push eax

* Possible Ref to Menu: APPMENU, Item: ""
                                  |
:0040B06A 6A6B                    push 0000006B
:0040B06C E83FF10000              call 0041A1B0
:0040B071 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040B048(C), :0040B064(C)
|
:0040B074 8A45F0                  mov al, byte ptr [ebp-10]
:0040B077 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040B07A 64890D00000000          mov dword ptr fs:[00000000], ecx
:0040B081 5E                      pop esi
:0040B082 8BE5                    mov esp, ebp
:0040B084 5D                      pop ebp
:0040B085 C20800                  ret 0008



* Referenced by a CALL at Address:
|:0041B65A   
|
:0040B088 55                      push ebp
:0040B089 8BEC                    mov ebp, esp
:0040B08B 83EC08                  sub esp, 00000008
:0040B08E 894DF8                  mov dword ptr [ebp-08], ecx

* Possible Ref to Menu: APPMENU, Item: ""
                                  |
:0040B091 6A6B                    push 0000006B
:0040B093 E8ECF10000              call 0041A284
:0040B098 83C404                  add esp, 00000004
:0040B09B 8845FC                  mov byte ptr [ebp-04], al
:0040B09E 8B45F8                  mov eax, dword ptr [ebp-08]
:0040B0A1 833804                  cmp dword ptr [eax], 00000004
:0040B0A4 7F0E                    jg 0040B0B4
:0040B0A6 6A00                    push 00000000
:0040B0A8 8A4DFC                  mov cl, byte ptr [ebp-04]
:0040B0AB 51                      push ecx
:0040B0AC 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040B0AF E8C3FEFFFF              call 0040AF77

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B0A4(C)
|
:0040B0B4 8BE5                    mov esp, ebp
:0040B0B6 5D                      pop ebp
:0040B0B7 C3                      ret



* Referenced by a CALL at Addresses:
|:00463B35   , :00464D87   , :0046A213   , :004718A0   , :00471E8A   
|:00472210   
|
:0040B0B8 55                      push ebp
:0040B0B9 8BEC                    mov ebp, esp
:0040B0BB 83EC0C                  sub esp, 0000000C
:0040B0BE 894DF8                  mov dword ptr [ebp-08], ecx
:0040B0C1 8B45F8                  mov eax, dword ptr [ebp-08]
:0040B0C4 8B08                    mov ecx, dword ptr [eax]
:0040B0C6 894DF4                  mov dword ptr [ebp-0C], ecx
:0040B0C9 837DF401                cmp dword ptr [ebp-0C], 00000001
:0040B0CD 7402                    je 0040B0D1
:0040B0CF EB09                    jmp 0040B0DA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B0CD(C)
|
:0040B0D1 C745FC01000000          mov [ebp-04], 00000001
:0040B0D8 EB07                    jmp 0040B0E1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B0CF(U)
|
:0040B0DA C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B0D8(U)
|
:0040B0E1 8B45FC                  mov eax, dword ptr [ebp-04]
:0040B0E4 8BE5                    mov esp, ebp
:0040B0E6 5D                      pop ebp
:0040B0E7 C3                      ret



* Referenced by a CALL at Addresses:
|:0040A8BF   , :0040AD35   
|
:0040B0E8 55                      push ebp
:0040B0E9 8BEC                    mov ebp, esp
:0040B0EB 83EC08                  sub esp, 00000008
:0040B0EE 894DF8                  mov dword ptr [ebp-08], ecx
:0040B0F1 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0040B0F8 8B45F8                  mov eax, dword ptr [ebp-08]
:0040B0FB 833804                  cmp dword ptr [eax], 00000004
:0040B0FE 7D07                    jge 0040B107
:0040B100 C745FCC0AB0100          mov [ebp-04], 0001ABC0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B0FE(C)
|
:0040B107 8B45FC                  mov eax, dword ptr [ebp-04]
:0040B10A 8BE5                    mov esp, ebp
:0040B10C 5D                      pop ebp
:0040B10D C3                      ret


:0040B10E 55                      push ebp
:0040B10F 8BEC                    mov ebp, esp
:0040B111 E802000000              call 0040B118
:0040B116 5D                      pop ebp
:0040B117 C3                      ret



* Referenced by a CALL at Address:
|:0040B111   
|
:0040B118 55                      push ebp
:0040B119 8BEC                    mov ebp, esp
:0040B11B B9202E4900              mov ecx, 00492E20
:0040B120 E89B070000              call 0040B8C0
:0040B125 5D                      pop ebp
:0040B126 C3                      ret


:0040B127 55                      push ebp
:0040B128 8BEC                    mov ebp, esp
:0040B12A 51                      push ecx
:0040B12B 894DFC                  mov dword ptr [ebp-04], ecx
:0040B12E 8B4518                  mov eax, dword ptr [ebp+18]
:0040B131 50                      push eax
:0040B132 8B4D14                  mov ecx, dword ptr [ebp+14]
:0040B135 51                      push ecx
:0040B136 8B5510                  mov edx, dword ptr [ebp+10]
:0040B139 52                      push edx
:0040B13A 8B450C                  mov eax, dword ptr [ebp+0C]
:0040B13D 50                      push eax
:0040B13E 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040B141 51                      push ecx
:0040B142 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040B145 E854000000              call 0040B19E
:0040B14A 8B45FC                  mov eax, dword ptr [ebp-04]
:0040B14D 8BE5                    mov esp, ebp
:0040B14F 5D                      pop ebp
:0040B150 C21400                  ret 0014



* Referenced by a CALL at Addresses:
|:0040B5E6   , :0040B632   , :0040B67E   , :0040B6CA   , :0040B716   
|
:0040B153 55                      push ebp
:0040B154 8BEC                    mov ebp, esp
:0040B156 51                      push ecx
:0040B157 894DFC                  mov dword ptr [ebp-04], ecx
:0040B15A 8B4518                  mov eax, dword ptr [ebp+18]
:0040B15D 50                      push eax
:0040B15E 8B4D14                  mov ecx, dword ptr [ebp+14]
:0040B161 51                      push ecx
:0040B162 8B5510                  mov edx, dword ptr [ebp+10]
:0040B165 52                      push edx
:0040B166 8B450C                  mov eax, dword ptr [ebp+0C]
:0040B169 50                      push eax
:0040B16A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040B16D 51                      push ecx
:0040B16E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040B171 E8C2010000              call 0040B338
:0040B176 8B45FC                  mov eax, dword ptr [ebp-04]
:0040B179 8BE5                    mov esp, ebp
:0040B17B 5D                      pop ebp
:0040B17C C21400                  ret 0014



* Referenced by a CALL at Addresses:
|:0040B607   , :0040B653   , :0040B69F   , :0040B6EB   , :0040B737   
|
:0040B17F 55                      push ebp
:0040B180 8BEC                    mov ebp, esp
:0040B182 51                      push ecx
:0040B183 894DFC                  mov dword ptr [ebp-04], ecx
:0040B186 8B45FC                  mov eax, dword ptr [ebp-04]
:0040B189 833800                  cmp dword ptr [eax], 00000000
:0040B18C 740C                    je 0040B19A
:0040B18E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040B191 8B11                    mov edx, dword ptr [ecx]
:0040B193 52                      push edx
:0040B194 FF1508604800            call dword ptr [00486008]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B18C(C)
|
:0040B19A 8BE5                    mov esp, ebp
:0040B19C 5D                      pop ebp
:0040B19D C3                      ret



* Referenced by a CALL at Addresses:
|:0040B145   , :0040B36C   
|
:0040B19E 55                      push ebp
:0040B19F 8BEC                    mov ebp, esp
:0040B1A1 6AFF                    push FFFFFFFF
:0040B1A3 6802504800              push 00485002
:0040B1A8 64A100000000            mov eax, dword ptr fs:[00000000]
:0040B1AE 50                      push eax
:0040B1AF 64892500000000          mov dword ptr fs:[00000000], esp
:0040B1B6 83EC3C                  sub esp, 0000003C
:0040B1B9 894DBC                  mov dword ptr [ebp-44], ecx
:0040B1BC C745E800000000          mov [ebp-18], 00000000
:0040B1C3 837D1400                cmp dword ptr [ebp+14], 00000000
:0040B1C7 7510                    jne 0040B1D9
:0040B1C9 C745EC10000000          mov [ebp-14], 00000010
:0040B1D0 C745E410000000          mov [ebp-1C], 00000010
:0040B1D7 EB29                    jmp 0040B202

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B1C7(C)
|
:0040B1D9 837D1401                cmp dword ptr [ebp+14], 00000001
:0040B1DD 7510                    jne 0040B1EF
:0040B1DF C745EC20000000          mov [ebp-14], 00000020
:0040B1E6 C745E420000000          mov [ebp-1C], 00000020
:0040B1ED EB13                    jmp 0040B202

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B1DD(C)
|
:0040B1EF C745E801000000          mov [ebp-18], 00000001
:0040B1F6 8B4514                  mov eax, dword ptr [ebp+14]
:0040B1F9 8945EC                  mov dword ptr [ebp-14], eax
:0040B1FC 8B4D14                  mov ecx, dword ptr [ebp+14]
:0040B1FF 894DE4                  mov dword ptr [ebp-1C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040B1D7(U), :0040B1ED(U)
|
:0040B202 8D4DC4                  lea ecx, dword ptr [ebp-3C]
:0040B205 E826060000              call 0040B830
:0040B20A C745FC00000000          mov [ebp-04], 00000000
:0040B211 C745F0FE000000          mov [ebp-10], 000000FE
:0040B218 837D1000                cmp dword ptr [ebp+10], 00000000
:0040B21C 7409                    je 0040B227
:0040B21E 8B55F0                  mov edx, dword ptr [ebp-10]
:0040B221 83CA01                  or edx, 00000001
:0040B224 8955F0                  mov dword ptr [ebp-10], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B21C(C)
|
:0040B227 8B45BC                  mov eax, dword ptr [ebp-44]
:0040B22A 833800                  cmp dword ptr [eax], 00000000
:0040B22D 740C                    je 0040B23B
:0040B22F 8B4DBC                  mov ecx, dword ptr [ebp-44]
:0040B232 8B11                    mov edx, dword ptr [ecx]
:0040B234 52                      push edx
:0040B235 FF1508604800            call dword ptr [00486008]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B22D(C)
|
:0040B23B 8B450C                  mov eax, dword ptr [ebp+0C]
:0040B23E 50                      push eax
:0040B23F 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0040B242 51                      push ecx
:0040B243 8B55F0                  mov edx, dword ptr [ebp-10]
:0040B246 52                      push edx
:0040B247 8B45EC                  mov eax, dword ptr [ebp-14]
:0040B24A 50                      push eax
:0040B24B 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040B24E 51                      push ecx
:0040B24F FF1500604800            call dword ptr [00486000]
:0040B255 8B55BC                  mov edx, dword ptr [ebp-44]
:0040B258 8902                    mov dword ptr [edx], eax
:0040B25A 8B45BC                  mov eax, dword ptr [ebp-44]
:0040B25D 833800                  cmp dword ptr [eax], 00000000
:0040B260 750D                    jne 0040B26F
:0040B262 68F06E4800              push 00486EF0
:0040B267 E86B990600              call 00474BD7
:0040B26C 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B260(C)
|
:0040B26F 8B4D18                  mov ecx, dword ptr [ebp+18]
:0040B272 83E964                  sub ecx, 00000064
:0040B275 894DE0                  mov dword ptr [ebp-20], ecx
:0040B278 8B550C                  mov edx, dword ptr [ebp+0C]
:0040B27B 0355E0                  add edx, dword ptr [ebp-20]
:0040B27E 89550C                  mov dword ptr [ebp+0C], edx
:0040B281 EB09                    jmp 0040B28C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B309(U)
|
:0040B283 8B45E0                  mov eax, dword ptr [ebp-20]
:0040B286 83C001                  add eax, 00000001
:0040B289 8945E0                  mov dword ptr [ebp-20], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B281(U)
|
:0040B28C 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0040B28F 3B4D0C                  cmp ecx, dword ptr [ebp+0C]
:0040B292 7D7A                    jge 0040B30E
:0040B294 837D1401                cmp dword ptr [ebp+14], 00000001
:0040B298 7F0F                    jg 0040B2A9
:0040B29A 8B55E0                  mov edx, dword ptr [ebp-20]
:0040B29D 8B4514                  mov eax, dword ptr [ebp+14]
:0040B2A0 8D4C5064                lea ecx, dword ptr [eax+2*edx+64]
:0040B2A4 894DB8                  mov dword ptr [ebp-48], ecx
:0040B2A7 EB09                    jmp 0040B2B2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B298(C)
|
:0040B2A9 8B55E0                  mov edx, dword ptr [ebp-20]
:0040B2AC 83C264                  add edx, 00000064
:0040B2AF 8955B8                  mov dword ptr [ebp-48], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B2A7(U)
|
:0040B2B2 8B45B8                  mov eax, dword ptr [ebp-48]
:0040B2B5 50                      push eax
:0040B2B6 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040B2B9 51                      push ecx
:0040B2BA 8D4DC4                  lea ecx, dword ptr [ebp-3C]
:0040B2BD E85BE4FFFF              call 0040971D
:0040B2C2 837D1000                cmp dword ptr [ebp+10], 00000000
:0040B2C6 7422                    je 0040B2EA
:0040B2C8 6A00                    push 00000000
:0040B2CA 8D4DC4                  lea ecx, dword ptr [ebp-3C]
:0040B2CD E8B8F2FFFF              call 0040A58A
:0040B2D2 50                      push eax
:0040B2D3 8D4DC4                  lea ecx, dword ptr [ebp-3C]
:0040B2D6 E841F2FFFF              call 0040A51C
:0040B2DB 50                      push eax
:0040B2DC 8B55BC                  mov edx, dword ptr [ebp-44]
:0040B2DF 8B02                    mov eax, dword ptr [edx]
:0040B2E1 50                      push eax
:0040B2E2 FF1510604800            call dword ptr [00486010]
:0040B2E8 EB17                    jmp 0040B301

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B2C6(C)
|
:0040B2EA 6A00                    push 00000000
:0040B2EC 8D4DC4                  lea ecx, dword ptr [ebp-3C]
:0040B2EF E828F2FFFF              call 0040A51C
:0040B2F4 50                      push eax
:0040B2F5 8B4DBC                  mov ecx, dword ptr [ebp-44]
:0040B2F8 8B11                    mov edx, dword ptr [ecx]
:0040B2FA 52                      push edx
:0040B2FB FF1510604800            call dword ptr [00486010]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B2E8(U)
|
:0040B301 8D4DC4                  lea ecx, dword ptr [ebp-3C]
:0040B304 E8A1E9FFFF              call 00409CAA
:0040B309 E975FFFFFF              jmp 0040B283

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B292(C)
|
:0040B30E 8B45BC                  mov eax, dword ptr [ebp-44]
:0040B311 8B08                    mov ecx, dword ptr [eax]
:0040B313 894DC0                  mov dword ptr [ebp-40], ecx
:0040B316 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0040B31D 8D4DC4                  lea ecx, dword ptr [ebp-3C]
:0040B320 E86B050000              call 0040B890
:0040B325 8B45C0                  mov eax, dword ptr [ebp-40]
:0040B328 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040B32B 64890D00000000          mov dword ptr fs:[00000000], ecx
:0040B332 8BE5                    mov esp, ebp
:0040B334 5D                      pop ebp
:0040B335 C21400                  ret 0014



* Referenced by a CALL at Address:
|:0040B171   
|
:0040B338 55                      push ebp
:0040B339 8BEC                    mov ebp, esp
:0040B33B 83EC08                  sub esp, 00000008
:0040B33E 894DF8                  mov dword ptr [ebp-08], ecx
:0040B341 8B4508                  mov eax, dword ptr [ebp+08]
:0040B344 50                      push eax
:0040B345 E88ADB0000              call 00418ED4
:0040B34A 83C404                  add esp, 00000004
:0040B34D 50                      push eax
:0040B34E FF1524614800            call dword ptr [00486124]
:0040B354 8945FC                  mov dword ptr [ebp-04], eax
:0040B357 6A64                    push 00000064
:0040B359 8B4D14                  mov ecx, dword ptr [ebp+14]
:0040B35C 51                      push ecx
:0040B35D 8B5510                  mov edx, dword ptr [ebp+10]
:0040B360 52                      push edx
:0040B361 8B450C                  mov eax, dword ptr [ebp+0C]
:0040B364 50                      push eax
:0040B365 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040B368 51                      push ecx
:0040B369 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040B36C E82DFEFFFF              call 0040B19E
:0040B371 8B55F8                  mov edx, dword ptr [ebp-08]
:0040B374 8902                    mov dword ptr [edx], eax
:0040B376 8B45FC                  mov eax, dword ptr [ebp-04]
:0040B379 50                      push eax
:0040B37A FF151C614800            call dword ptr [0048611C]
:0040B380 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040B383 8B01                    mov eax, dword ptr [ecx]
:0040B385 8BE5                    mov esp, ebp
:0040B387 5D                      pop ebp
:0040B388 C21400                  ret 0014


:0040B38B 55                      push ebp
:0040B38C 8BEC                    mov ebp, esp
:0040B38E 51                      push ecx
:0040B38F 894DFC                  mov dword ptr [ebp-04], ecx
:0040B392 8B450C                  mov eax, dword ptr [ebp+0C]
:0040B395 50                      push eax
:0040B396 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040B399 51                      push ecx
:0040B39A 8B55FC                  mov edx, dword ptr [ebp-04]
:0040B39D 8B02                    mov eax, dword ptr [edx]
:0040B39F 50                      push eax
:0040B3A0 FF1518604800            call dword ptr [00486018]
:0040B3A6 8BE5                    mov esp, ebp
:0040B3A8 5D                      pop ebp
:0040B3A9 C20800                  ret 0008



* Referenced by a CALL at Address:
|:0040B552   
|
:0040B3AC 55                      push ebp
:0040B3AD 8BEC                    mov ebp, esp
:0040B3AF 83EC1C                  sub esp, 0000001C
:0040B3B2 894DE4                  mov dword ptr [ebp-1C], ecx
:0040B3B5 8B45E4                  mov eax, dword ptr [ebp-1C]
:0040B3B8 833800                  cmp dword ptr [eax], 00000000
:0040B3BB 7408                    je 0040B3C5
:0040B3BD 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0040B3C0 E853010000              call 0040B518

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B3BB(C)
|
:0040B3C5 6A00                    push 00000000
:0040B3C7 E8245C0700              call 00480FF0
:0040B3CC 83C404                  add esp, 00000004
:0040B3CF 8945F8                  mov dword ptr [ebp-08], eax

* Possible Reference to Dialog: DialogID_00C1, CONTROL_ID:0404, ""
                                  |
:0040B3D2 6804040000              push 00000404
:0040B3D7 E8045C0700              call 00480FE0
:0040B3DC 83C404                  add esp, 00000004
:0040B3DF 8945FC                  mov dword ptr [ebp-04], eax
:0040B3E2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040B3E5 51                      push ecx
:0040B3E6 E8055C0700              call 00480FF0
:0040B3EB 83C404                  add esp, 00000004
:0040B3EE 837DFC00                cmp dword ptr [ebp-04], 00000000
:0040B3F2 0F8417010000            je 0040B50F
:0040B3F8 8B55FC                  mov edx, dword ptr [ebp-04]
:0040B3FB 66C7020003              mov word ptr [edx], 0300
:0040B400 8B45FC                  mov eax, dword ptr [ebp-04]
:0040B403 66C740020001            mov [eax+02], 0100
:0040B409 6A00                    push 00000000
:0040B40B E890E2FFFF              call 004096A0
:0040B410 83C404                  add esp, 00000004
:0040B413 83F808                  cmp eax, 00000008
:0040B416 7550                    jne 0040B468
:0040B418 C745F400000000          mov [ebp-0C], 00000000
:0040B41F EB09                    jmp 0040B42A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B461(U)
|
:0040B421 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040B424 83C101                  add ecx, 00000001
:0040B427 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B41F(U)
|
:0040B42A 817DF400010000          cmp dword ptr [ebp-0C], 00000100
:0040B431 7D30                    jge 0040B463
:0040B433 8B55F4                  mov edx, dword ptr [ebp-0C]
:0040B436 8B45FC                  mov eax, dword ptr [ebp-04]
:0040B439 8A4DF4                  mov cl, byte ptr [ebp-0C]
:0040B43C 884C9004                mov byte ptr [eax+4*edx+04], cl
:0040B440 8B55F4                  mov edx, dword ptr [ebp-0C]
:0040B443 8B45FC                  mov eax, dword ptr [ebp-04]
:0040B446 C644900500              mov [eax+4*edx+05], 00
:0040B44B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040B44E 8B55FC                  mov edx, dword ptr [ebp-04]
:0040B451 C6448A0600              mov [edx+4*ecx+06], 00
:0040B456 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040B459 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040B45C C644810702              mov [ecx+4*eax+07], 02
:0040B461 EBBE                    jmp 0040B421

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B431(C)
|
:0040B463 E986000000              jmp 0040B4EE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B416(C)
|
:0040B468 C745F070774900          mov [ebp-10], 00497770
:0040B46F C745EC00000000          mov [ebp-14], 00000000
:0040B476 EB09                    jmp 0040B481

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B4EC(U)
|
:0040B478 8B55EC                  mov edx, dword ptr [ebp-14]
:0040B47B 83C201                  add edx, 00000001
:0040B47E 8955EC                  mov dword ptr [ebp-14], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B476(U)
|
:0040B481 817DEC00010000          cmp dword ptr [ebp-14], 00000100
:0040B488 7D64                    jge 0040B4EE
:0040B48A 8B45F0                  mov eax, dword ptr [ebp-10]
:0040B48D 33C9                    xor ecx, ecx
:0040B48F 8A08                    mov cl, byte ptr [eax]
:0040B491 C1E104                  shl ecx, 04
:0040B494 8B55EC                  mov edx, dword ptr [ebp-14]
:0040B497 8B45FC                  mov eax, dword ptr [ebp-04]
:0040B49A 884C9006                mov byte ptr [eax+4*edx+06], cl
:0040B49E 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040B4A1 83C101                  add ecx, 00000001
:0040B4A4 894DF0                  mov dword ptr [ebp-10], ecx
:0040B4A7 8B55F0                  mov edx, dword ptr [ebp-10]
:0040B4AA 33C0                    xor eax, eax
:0040B4AC 8A02                    mov al, byte ptr [edx]
:0040B4AE C1E004                  shl eax, 04
:0040B4B1 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040B4B4 8B55FC                  mov edx, dword ptr [ebp-04]
:0040B4B7 88448A04                mov byte ptr [edx+4*ecx+04], al
:0040B4BB 8B45F0                  mov eax, dword ptr [ebp-10]
:0040B4BE 83C001                  add eax, 00000001
:0040B4C1 8945F0                  mov dword ptr [ebp-10], eax
:0040B4C4 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040B4C7 33D2                    xor edx, edx
:0040B4C9 8A11                    mov dl, byte ptr [ecx]
:0040B4CB C1E204                  shl edx, 04
:0040B4CE 8B45EC                  mov eax, dword ptr [ebp-14]
:0040B4D1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040B4D4 88548105                mov byte ptr [ecx+4*eax+05], dl
:0040B4D8 8B55F0                  mov edx, dword ptr [ebp-10]
:0040B4DB 83C201                  add edx, 00000001
:0040B4DE 8955F0                  mov dword ptr [ebp-10], edx
:0040B4E1 8B45EC                  mov eax, dword ptr [ebp-14]
:0040B4E4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040B4E7 C644810700              mov [ecx+4*eax+07], 00
:0040B4EC EB8A                    jmp 0040B478

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040B463(U), :0040B488(C)
|
:0040B4EE 8B55FC                  mov edx, dword ptr [ebp-04]
:0040B4F1 52                      push edx
:0040B4F2 FF1554604800            call dword ptr [00486054]
:0040B4F8 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0040B4FB 8901                    mov dword ptr [ecx], eax
:0040B4FD 8B55FC                  mov edx, dword ptr [ebp-04]
:0040B500 8955E8                  mov dword ptr [ebp-18], edx
:0040B503 8B45E8                  mov eax, dword ptr [ebp-18]
:0040B506 50                      push eax
:0040B507 E8145B0700              call 00481020
:0040B50C 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B3F2(C)
|
:0040B50F 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0040B512 8B01                    mov eax, dword ptr [ecx]
:0040B514 8BE5                    mov esp, ebp
:0040B516 5D                      pop ebp
:0040B517 C3                      ret



* Referenced by a CALL at Addresses:
|:0040B3C0   , :0040B8EA   
|
:0040B518 55                      push ebp
:0040B519 8BEC                    mov ebp, esp
:0040B51B 51                      push ecx
:0040B51C 894DFC                  mov dword ptr [ebp-04], ecx
:0040B51F 8B45FC                  mov eax, dword ptr [ebp-04]
:0040B522 833800                  cmp dword ptr [eax], 00000000
:0040B525 7415                    je 0040B53C
:0040B527 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040B52A 8B11                    mov edx, dword ptr [ecx]
:0040B52C 52                      push edx
:0040B52D FF1548604800            call dword ptr [00486048]
:0040B533 8B45FC                  mov eax, dword ptr [ebp-04]
:0040B536 C70000000000            mov dword ptr [eax], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B525(C)
|
:0040B53C 8BE5                    mov esp, ebp
:0040B53E 5D                      pop ebp
:0040B53F C3                      ret



* Referenced by a CALL at Addresses:
|:00464BE8   , :00465209   , :0046A320   , :004710D9   
|
:0040B540 55                      push ebp
:0040B541 8BEC                    mov ebp, esp
:0040B543 51                      push ecx
:0040B544 894DFC                  mov dword ptr [ebp-04], ecx
:0040B547 8B45FC                  mov eax, dword ptr [ebp-04]
:0040B54A 833800                  cmp dword ptr [eax], 00000000
:0040B54D 7508                    jne 0040B557
:0040B54F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040B552 E855FEFFFF              call 0040B3AC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B54D(C)
|
:0040B557 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040B55A 833900                  cmp dword ptr [ecx], 00000000
:0040B55D 741E                    je 0040B57D
:0040B55F 8B550C                  mov edx, dword ptr [ebp+0C]
:0040B562 52                      push edx
:0040B563 8B45FC                  mov eax, dword ptr [ebp-04]
:0040B566 8B08                    mov ecx, dword ptr [eax]
:0040B568 51                      push ecx
:0040B569 8B5508                  mov edx, dword ptr [ebp+08]
:0040B56C 52                      push edx
:0040B56D FF1550604800            call dword ptr [00486050]
:0040B573 8B4508                  mov eax, dword ptr [ebp+08]
:0040B576 50                      push eax
:0040B577 FF154C604800            call dword ptr [0048604C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B55D(C)
|
:0040B57D 8BE5                    mov esp, ebp
:0040B57F 5D                      pop ebp
:0040B580 C20800                  ret 0008


:0040B583 55                      push ebp
:0040B584 8BEC                    mov ebp, esp
:0040B586 E807000000              call 0040B592
:0040B58B E811000000              call 0040B5A1
:0040B590 5D                      pop ebp
:0040B591 C3                      ret



* Referenced by a CALL at Address:
|:0040B586   
|
:0040B592 55                      push ebp
:0040B593 8BEC                    mov ebp, esp
:0040B595 B9082E4900              mov ecx, 00492E08
:0040B59A E821030000              call 0040B8C0
:0040B59F 5D                      pop ebp
:0040B5A0 C3                      ret



* Referenced by a CALL at Address:
|:0040B58B   
|
:0040B5A1 55                      push ebp
:0040B5A2 8BEC                    mov ebp, esp
:0040B5A4 68B3B54000              push 0040B5B3
:0040B5A9 E8525B0700              call 00481100
:0040B5AE 83C404                  add esp, 00000004
:0040B5B1 5D                      pop ebp
:0040B5B2 C3                      ret


:0040B5B3 55                      push ebp
:0040B5B4 8BEC                    mov ebp, esp
:0040B5B6 B9082E4900              mov ecx, 00492E08
:0040B5BB E820030000              call 0040B8E0
:0040B5C0 5D                      pop ebp
:0040B5C1 C3                      ret


:0040B5C2 55                      push ebp
:0040B5C3 8BEC                    mov ebp, esp
:0040B5C5 E807000000              call 0040B5D1
:0040B5CA E81E000000              call 0040B5ED
:0040B5CF 5D                      pop ebp
:0040B5D0 C3                      ret



* Referenced by a CALL at Address:
|:0040B5C5   
|
:0040B5D1 55                      push ebp
:0040B5D2 8BEC                    mov ebp, esp
:0040B5D4 6A64                    push 00000064
:0040B5D6 6A00                    push 00000000
:0040B5D8 6A00                    push 00000000
:0040B5DA 6A1F                    push 0000001F

* Possible StringData Ref from Data Obj ->"MgcIcon.dll"
                                  |
:0040B5DC 68B0B14800              push 0048B1B0
:0040B5E1 B90C2E4900              mov ecx, 00492E0C
:0040B5E6 E868FBFFFF              call 0040B153
:0040B5EB 5D                      pop ebp
:0040B5EC C3                      ret



* Referenced by a CALL at Address:
|:0040B5CA   
|
:0040B5ED 55                      push ebp
:0040B5EE 8BEC                    mov ebp, esp
:0040B5F0 68FFB54000              push 0040B5FF
:0040B5F5 E8065B0700              call 00481100
:0040B5FA 83C404                  add esp, 00000004
:0040B5FD 5D                      pop ebp
:0040B5FE C3                      ret


:0040B5FF 55                      push ebp
:0040B600 8BEC                    mov ebp, esp
:0040B602 B90C2E4900              mov ecx, 00492E0C
:0040B607 E873FBFFFF              call 0040B17F
:0040B60C 5D                      pop ebp
:0040B60D C3                      ret


:0040B60E 55                      push ebp
:0040B60F 8BEC                    mov ebp, esp
:0040B611 E807000000              call 0040B61D
:0040B616 E81E000000              call 0040B639
:0040B61B 5D                      pop ebp
:0040B61C C3                      ret



* Referenced by a CALL at Address:
|:0040B611   
|
:0040B61D 55                      push ebp
:0040B61E 8BEC                    mov ebp, esp
:0040B620 6A64                    push 00000064
:0040B622 6A01                    push 00000001
:0040B624 6A01                    push 00000001
:0040B626 6A1F                    push 0000001F

* Possible StringData Ref from Data Obj ->"MgcIcon.dll"
                                  |
:0040B628 68BCB14800              push 0048B1BC
:0040B62D B9102E4900              mov ecx, 00492E10
:0040B632 E81CFBFFFF              call 0040B153
:0040B637 5D                      pop ebp
:0040B638 C3                      ret



* Referenced by a CALL at Address:
|:0040B616   
|
:0040B639 55                      push ebp
:0040B63A 8BEC                    mov ebp, esp
:0040B63C 684BB64000              push 0040B64B
:0040B641 E8BA5A0700              call 00481100
:0040B646 83C404                  add esp, 00000004
:0040B649 5D                      pop ebp
:0040B64A C3                      ret


:0040B64B 55                      push ebp
:0040B64C 8BEC                    mov ebp, esp
:0040B64E B9102E4900              mov ecx, 00492E10
:0040B653 E827FBFFFF              call 0040B17F
:0040B658 5D                      pop ebp
:0040B659 C3                      ret


:0040B65A 55                      push ebp
:0040B65B 8BEC                    mov ebp, esp
:0040B65D E807000000              call 0040B669
:0040B662 E81E000000              call 0040B685
:0040B667 5D                      pop ebp
:0040B668 C3                      ret



* Referenced by a CALL at Address:
|:0040B65D   
|
:0040B669 55                      push ebp
:0040B66A 8BEC                    mov ebp, esp
:0040B66C 6A64                    push 00000064
:0040B66E 6A00                    push 00000000
:0040B670 6A01                    push 00000001

* Possible Ref to Menu: APPMENU, Item: "f"
                                  |
:0040B672 6A69                    push 00000069

* Possible StringData Ref from Data Obj ->"ItemIcon.dll"
                                  |
:0040B674 68C8B14800              push 0048B1C8
:0040B679 B9182E4900              mov ecx, 00492E18
:0040B67E E8D0FAFFFF              call 0040B153
:0040B683 5D                      pop ebp
:0040B684 C3                      ret



* Referenced by a CALL at Address:
|:0040B662   
|
:0040B685 55                      push ebp
:0040B686 8BEC                    mov ebp, esp
:0040B688 6897B64000              push 0040B697
:0040B68D E86E5A0700              call 00481100
:0040B692 83C404                  add esp, 00000004
:0040B695 5D                      pop ebp
:0040B696 C3                      ret


:0040B697 55                      push ebp
:0040B698 8BEC                    mov ebp, esp
:0040B69A B9182E4900              mov ecx, 00492E18
:0040B69F E8DBFAFFFF              call 0040B17F
:0040B6A4 5D                      pop ebp
:0040B6A5 C3                      ret


:0040B6A6 55                      push ebp
:0040B6A7 8BEC                    mov ebp, esp
:0040B6A9 E807000000              call 0040B6B5
:0040B6AE E81E000000              call 0040B6D1
:0040B6B3 5D                      pop ebp
:0040B6B4 C3                      ret



* Referenced by a CALL at Address:
|:0040B6A9   
|
:0040B6B5 55                      push ebp
:0040B6B6 8BEC                    mov ebp, esp
:0040B6B8 6A64                    push 00000064
:0040B6BA 6A01                    push 00000001
:0040B6BC 6A01                    push 00000001

* Possible Ref to Menu: APPMENU, Item: "f"
                                  |
:0040B6BE 6A69                    push 00000069

* Possible StringData Ref from Data Obj ->"ItemIcon.dll"
                                  |
:0040B6C0 68D8B14800              push 0048B1D8
:0040B6C5 B9142E4900              mov ecx, 00492E14
:0040B6CA E884FAFFFF              call 0040B153
:0040B6CF 5D                      pop ebp
:0040B6D0 C3                      ret



* Referenced by a CALL at Address:
|:0040B6AE   
|
:0040B6D1 55                      push ebp
:0040B6D2 8BEC                    mov ebp, esp
:0040B6D4 68E3B64000              push 0040B6E3
:0040B6D9 E8225A0700              call 00481100
:0040B6DE 83C404                  add esp, 00000004
:0040B6E1 5D                      pop ebp
:0040B6E2 C3                      ret


:0040B6E3 55                      push ebp
:0040B6E4 8BEC                    mov ebp, esp
:0040B6E6 B9142E4900              mov ecx, 00492E14
:0040B6EB E88FFAFFFF              call 0040B17F
:0040B6F0 5D                      pop ebp
:0040B6F1 C3                      ret


:0040B6F2 55                      push ebp
:0040B6F3 8BEC                    mov ebp, esp
:0040B6F5 E807000000              call 0040B701
:0040B6FA E81E000000              call 0040B71D
:0040B6FF 5D                      pop ebp
:0040B700 C3                      ret



* Referenced by a CALL at Address:
|:0040B6F5   
|
:0040B701 55                      push ebp
:0040B702 8BEC                    mov ebp, esp
:0040B704 6A64                    push 00000064
:0040B706 6A10                    push 00000010
:0040B708 6A01                    push 00000001
:0040B70A 6A04                    push 00000004

* Possible StringData Ref from Data Obj ->"CmdIcon.dll"
                                  |
:0040B70C 68E8B14800              push 0048B1E8
:0040B711 B91C2E4900              mov ecx, 00492E1C
:0040B716 E838FAFFFF              call 0040B153
:0040B71B 5D                      pop ebp
:0040B71C C3                      ret



* Referenced by a CALL at Address:
|:0040B6FA   
|
:0040B71D 55                      push ebp
:0040B71E 8BEC                    mov ebp, esp
:0040B720 682FB74000              push 0040B72F
:0040B725 E8D6590700              call 00481100
:0040B72A 83C404                  add esp, 00000004
:0040B72D 5D                      pop ebp
:0040B72E C3                      ret


:0040B72F 55                      push ebp
:0040B730 8BEC                    mov ebp, esp
:0040B732 B91C2E4900              mov ecx, 00492E1C
:0040B737 E843FAFFFF              call 0040B17F
:0040B73C 5D                      pop ebp
:0040B73D C3                      ret



* Referenced by a CALL at Addresses:
|:0045BDA0   , :00463357   , :004721D8   
|
:0040B73E 55                      push ebp
:0040B73F 8BEC                    mov ebp, esp
:0040B741 51                      push ecx
:0040B742 894DFC                  mov dword ptr [ebp-04], ecx
:0040B745 8B45FC                  mov eax, dword ptr [ebp-04]
:0040B748 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040B74B 8908                    mov dword ptr [eax], ecx
:0040B74D 8B55FC                  mov edx, dword ptr [ebp-04]
:0040B750 8B450C                  mov eax, dword ptr [ebp+0C]
:0040B753 894204                  mov dword ptr [edx+04], eax
:0040B756 8B45FC                  mov eax, dword ptr [ebp-04]
:0040B759 8BE5                    mov esp, ebp
:0040B75B 5D                      pop ebp
:0040B75C C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:004634BB   , :0047248C   , :004724B0   
|
:0040B75F 55                      push ebp
:0040B760 8BEC                    mov ebp, esp
:0040B762 51                      push ecx
:0040B763 894DFC                  mov dword ptr [ebp-04], ecx
:0040B766 6A00                    push 00000000
:0040B768 8B4510                  mov eax, dword ptr [ebp+10]
:0040B76B 50                      push eax
:0040B76C 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0040B76F 51                      push ecx
:0040B770 8B5508                  mov edx, dword ptr [ebp+08]
:0040B773 52                      push edx
:0040B774 8B45FC                  mov eax, dword ptr [ebp-04]
:0040B777 8B4804                  mov ecx, dword ptr [eax+04]
:0040B77A 51                      push ecx
:0040B77B 8B55FC                  mov edx, dword ptr [ebp-04]
:0040B77E 8B02                    mov eax, dword ptr [edx]
:0040B780 50                      push eax
:0040B781 FF150C604800            call dword ptr [0048600C]
:0040B787 8BE5                    mov esp, ebp
:0040B789 5D                      pop ebp
:0040B78A C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:004633AD   , :004634E4   
|
:0040B78D 55                      push ebp
:0040B78E 8BEC                    mov ebp, esp
:0040B790 83EC0C                  sub esp, 0000000C
:0040B793 894DF4                  mov dword ptr [ebp-0C], ecx
:0040B796 8D45F8                  lea eax, dword ptr [ebp-08]
:0040B799 50                      push eax
:0040B79A 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0040B79D 51                      push ecx
:0040B79E 8B55F4                  mov edx, dword ptr [ebp-0C]
:0040B7A1 8B02                    mov eax, dword ptr [edx]
:0040B7A3 50                      push eax
:0040B7A4 FF151C604800            call dword ptr [0048601C]
:0040B7AA 85C0                    test eax, eax
:0040B7AC 7507                    jne 0040B7B5
:0040B7AE C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B7AC(C)
|
:0040B7B5 8B45FC                  mov eax, dword ptr [ebp-04]
:0040B7B8 8BE5                    mov esp, ebp
:0040B7BA 5D                      pop ebp
:0040B7BB C3                      ret



* Referenced by a CALL at Addresses:
|:0046339E   , :004634D8   
|
:0040B7BC 55                      push ebp
:0040B7BD 8BEC                    mov ebp, esp
:0040B7BF 83EC0C                  sub esp, 0000000C
:0040B7C2 894DF4                  mov dword ptr [ebp-0C], ecx
:0040B7C5 8D45F8                  lea eax, dword ptr [ebp-08]
:0040B7C8 50                      push eax
:0040B7C9 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0040B7CC 51                      push ecx
:0040B7CD 8B55F4                  mov edx, dword ptr [ebp-0C]
:0040B7D0 8B02                    mov eax, dword ptr [edx]
:0040B7D2 50                      push eax
:0040B7D3 FF151C604800            call dword ptr [0048601C]
:0040B7D9 85C0                    test eax, eax
:0040B7DB 7507                    jne 0040B7E4
:0040B7DD C745F800000000          mov [ebp-08], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B7DB(C)
|
:0040B7E4 8B45F8                  mov eax, dword ptr [ebp-08]
:0040B7E7 8BE5                    mov esp, ebp
:0040B7E9 5D                      pop ebp
:0040B7EA C3                      ret



* Referenced by a CALL at Address:
|:00472414   
|
:0040B7EB 55                      push ebp
:0040B7EC 8BEC                    mov ebp, esp
:0040B7EE 51                      push ecx
:0040B7EF 894DFC                  mov dword ptr [ebp-04], ecx
:0040B7F2 8B450C                  mov eax, dword ptr [ebp+0C]
:0040B7F5 50                      push eax
:0040B7F6 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040B7F9 51                      push ecx
:0040B7FA 8B55FC                  mov edx, dword ptr [ebp-04]
:0040B7FD 8B02                    mov eax, dword ptr [edx]
:0040B7FF 50                      push eax
:0040B800 FF151C604800            call dword ptr [0048601C]
:0040B806 8BE5                    mov esp, ebp
:0040B808 5D                      pop ebp
:0040B809 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:004634C8   , :004724BA   
|
:0040B80C 55                      push ebp
:0040B80D 8BEC                    mov ebp, esp
:0040B80F 51                      push ecx
:0040B810 894DFC                  mov dword ptr [ebp-04], ecx
:0040B813 6A00                    push 00000000
:0040B815 8B45FC                  mov eax, dword ptr [ebp-04]
:0040B818 8B4804                  mov ecx, dword ptr [eax+04]
:0040B81B 51                      push ecx
:0040B81C 8B55FC                  mov edx, dword ptr [ebp-04]
:0040B81F 8B02                    mov eax, dword ptr [edx]
:0040B821 50                      push eax
:0040B822 FF1518604800            call dword ptr [00486018]
:0040B828 8BE5                    mov esp, ebp
:0040B82A 5D                      pop ebp
:0040B82B C3                      ret


:0040B82C CC                      int 03
:0040B82D CC                      int 03
:0040B82E CC                      int 03
:0040B82F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040AC8C   , :0040B205   , :004196EA   , :004617A7   , :0046C691   
|:0047B301   , :0047B381   
|
:0040B830 55                      push ebp
:0040B831 8BEC                    mov ebp, esp
:0040B833 51                      push ecx
:0040B834 894DFC                  mov dword ptr [ebp-04], ecx
:0040B837 8B45FC                  mov eax, dword ptr [ebp-04]
:0040B83A C70000000000            mov dword ptr [eax], 00000000
:0040B840 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040B843 C7410400000000          mov [ecx+04], 00000000
:0040B84A 8B55FC                  mov edx, dword ptr [ebp-04]
:0040B84D C7420800000000          mov [edx+08], 00000000
:0040B854 8B45FC                  mov eax, dword ptr [ebp-04]
:0040B857 C7400C00000000          mov [eax+0C], 00000000
:0040B85E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040B861 C7411000000000          mov [ecx+10], 00000000
:0040B868 8B55FC                  mov edx, dword ptr [ebp-04]
:0040B86B C7421400000000          mov [edx+14], 00000000
:0040B872 8B45FC                  mov eax, dword ptr [ebp-04]
:0040B875 C7401800000000          mov [eax+18], 00000000
:0040B87C 8B45FC                  mov eax, dword ptr [ebp-04]
:0040B87F 8BE5                    mov esp, ebp
:0040B881 5D                      pop ebp
:0040B882 C3                      ret


:0040B883 CC                      int 03
:0040B884 CC                      int 03
:0040B885 CC                      int 03
:0040B886 CC                      int 03
:0040B887 CC                      int 03
:0040B888 CC                      int 03
:0040B889 CC                      int 03
:0040B88A CC                      int 03
:0040B88B CC                      int 03
:0040B88C CC                      int 03
:0040B88D CC                      int 03
:0040B88E CC                      int 03
:0040B88F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040AD14   , :0040B320   , :00419726   , :00461B31   , :0046C709   
|:0047B149   , :0047B199   , :00484FD3   , :00484FFC   , :00485163   
|:00485773   , :00485918   
|
:0040B890 55                      push ebp
:0040B891 8BEC                    mov ebp, esp
:0040B893 51                      push ecx
:0040B894 894DFC                  mov dword ptr [ebp-04], ecx
:0040B897 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040B89A E80BE4FFFF              call 00409CAA
:0040B89F 8BE5                    mov esp, ebp
:0040B8A1 5D                      pop ebp
:0040B8A2 C3                      ret


:0040B8A3 CC                      int 03
:0040B8A4 CC                      int 03
:0040B8A5 CC                      int 03
:0040B8A6 CC                      int 03
:0040B8A7 CC                      int 03
:0040B8A8 CC                      int 03
:0040B8A9 CC                      int 03
:0040B8AA CC                      int 03
:0040B8AB CC                      int 03
:0040B8AC CC                      int 03
:0040B8AD CC                      int 03
:0040B8AE CC                      int 03
:0040B8AF CC                      int 03

* Referenced by a CALL at Addresses:
|:00407295   , :0040A887   , :0040A8A2   , :0040B91B   , :0040B92A   
|:0040BC4F   , :0041B24E   , :0041BA8C   , :0041BF24   , :0042C249   
|:0042C86E   , :00477E0D   
|
:0040B8B0 55                      push ebp
:0040B8B1 8BEC                    mov ebp, esp
:0040B8B3 51                      push ecx
:0040B8B4 894DFC                  mov dword ptr [ebp-04], ecx
:0040B8B7 8B45FC                  mov eax, dword ptr [ebp-04]
:0040B8BA 8A00                    mov al, byte ptr [eax]
:0040B8BC 8BE5                    mov esp, ebp
:0040B8BE 5D                      pop ebp
:0040B8BF C3                      ret



* Referenced by a CALL at Addresses:
|:0040B120   , :0040B59A   , :0046284E   , :0046D14A   
|
:0040B8C0 55                      push ebp
:0040B8C1 8BEC                    mov ebp, esp
:0040B8C3 51                      push ecx
:0040B8C4 894DFC                  mov dword ptr [ebp-04], ecx
:0040B8C7 8B45FC                  mov eax, dword ptr [ebp-04]
:0040B8CA C70000000000            mov dword ptr [eax], 00000000
:0040B8D0 8B45FC                  mov eax, dword ptr [ebp-04]
:0040B8D3 8BE5                    mov esp, ebp
:0040B8D5 5D                      pop ebp
:0040B8D6 C3                      ret


:0040B8D7 CC                      int 03
:0040B8D8 CC                      int 03
:0040B8D9 CC                      int 03
:0040B8DA CC                      int 03
:0040B8DB CC                      int 03
:0040B8DC CC                      int 03
:0040B8DD CC                      int 03
:0040B8DE CC                      int 03
:0040B8DF CC                      int 03

* Referenced by a CALL at Address:
|:0040B5BB   
|
:0040B8E0 55                      push ebp
:0040B8E1 8BEC                    mov ebp, esp
:0040B8E3 51                      push ecx
:0040B8E4 894DFC                  mov dword ptr [ebp-04], ecx
:0040B8E7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040B8EA E829FCFFFF              call 0040B518
:0040B8EF 8BE5                    mov esp, ebp
:0040B8F1 5D                      pop ebp
:0040B8F2 C3                      ret


:0040B8F3 CC                      int 03
:0040B8F4 CC                      int 03
:0040B8F5 CC                      int 03
:0040B8F6 CC                      int 03
:0040B8F7 CC                      int 03
:0040B8F8 CC                      int 03
:0040B8F9 CC                      int 03
:0040B8FA CC                      int 03
:0040B8FB CC                      int 03
:0040B8FC CC                      int 03
:0040B8FD CC                      int 03
:0040B8FE CC                      int 03
:0040B8FF CC                      int 03
:0040B900 55                      push ebp
:0040B901 8BEC                    mov ebp, esp
:0040B903 8A4508                  mov al, byte ptr [ebp+08]
:0040B906 50                      push eax
:0040B907 B93CC64A00              mov ecx, 004AC63C
:0040B90C E8EF040000              call 0040BE00
:0040B911 5D                      pop ebp
:0040B912 C3                      ret



* Referenced by a CALL at Addresses:
|:00413EC0   , :0041A3FF   , :004298BC   
|
:0040B913 55                      push ebp
:0040B914 8BEC                    mov ebp, esp
:0040B916 B93CC64A00              mov ecx, 004AC63C
:0040B91B E890FFFFFF              call 0040B8B0
:0040B920 5D                      pop ebp
:0040B921 C3                      ret



* Referenced by a CALL at Addresses:
|:004074DB   , :0040847D   , :0040BBE1   , :00411388   , :00411716   
|:00411AF4   , :00411BC7   , :00411CED   , :00411F12   , :00411F72   
|:004120A5   , :004130C9   , :0041321B   , :004133C8   , :004136C0   
|:004136F4   , :00413866   , :0041399D   , :00413C2F   , :00413CA9   
|:00413FE6   , :00414581   , :0041487A   , :004149BE   , :00414BB0   
|:00414BF4   , :00414C7D   , :00414D6B   , :00414E49   , :00414FCF   
|:004152BF   , :004156B8   , :00415774   , :00415798   , :00415893   
|:00415A27   , :004164A7   , :00416D9E   , :00416DFD   , :00416E44   
|:004170B5   , :0041B07E   , :0041B483   , :0042B624   , :0042B8BF   
|:0042B904   , :0042C6D8   , :0042C7D3   , :0042D5FA   , :0042E763   
|:0042F456   , :00449CB1   , :00449CD5   , :00449CF2   , :00449D99   
|:00456004   , :0045AFEB   , :0045B381   , :0045B4B6   , :0046D9C9   
|:004750EF   , :00475A4A   , :00475ACF   , :00475C89   , :00476514   
|:00476617   , :00476719   , :00477AE6   , :00477E9D   , :00477F71   
|:00479798   , :00479A26   , :0047A3D5   
|
:0040B922 55                      push ebp
:0040B923 8BEC                    mov ebp, esp
:0040B925 B93CC64A00              mov ecx, 004AC63C
:0040B92A E881FFFFFF              call 0040B8B0
:0040B92F 25FF000000              and eax, 000000FF
:0040B934 33C9                    xor ecx, ecx
:0040B936 83F803                  cmp eax, 00000003
:0040B939 0F94C1                  sete cl
:0040B93C 8BC1                    mov eax, ecx
:0040B93E 5D                      pop ebp
:0040B93F C3                      ret



* Referenced by a CALL at Address:
|:00413BC0   
|
:0040B940 55                      push ebp
:0040B941 8BEC                    mov ebp, esp
:0040B943 83EC24                  sub esp, 00000024

* Possible StringData Ref from Data Obj ->""
                                  |
:0040B946 C745DC04B24800          mov [ebp-24], 0048B204

* Possible StringData Ref from Data Obj ->"һ"
                                  |
:0040B94D C745E00CB24800          mov [ebp-20], 0048B20C

* Possible StringData Ref from Data Obj ->"ڶ"
                                  |
:0040B954 C745E414B24800          mov [ebp-1C], 0048B214

* Possible StringData Ref from Data Obj ->""
                                  |
:0040B95B C745E81CB24800          mov [ebp-18], 0048B21C

* Possible StringData Ref from Data Obj ->""
                                  |
:0040B962 C745EC24B24800          mov [ebp-14], 0048B224
:0040B969 8B4508                  mov eax, dword ptr [ebp+08]
:0040B96C 25FF000000              and eax, 000000FF
:0040B971 83F804                  cmp eax, 00000004
:0040B974 7E05                    jle 0040B97B
:0040B976 E9C9010000              jmp 0040BB44

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B974(C)
|
:0040B97B B9986A4B00              mov ecx, 004B6A98
:0040B980 E8BB040000              call 0040BE40
:0040B985 85C0                    test eax, eax
:0040B987 740A                    je 0040B993
:0040B989 E8E2AE0600              call 00476870
:0040B98E E8EFAE0600              call 00476882

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B987(C)
|
:0040B993 6A04                    push 00000004
:0040B995 B9382F4900              mov ecx, 00492F38
:0040B99A E897330000              call 0040ED36
:0040B99F 6A00                    push 00000000
:0040B9A1 B9382F4900              mov ecx, 00492F38
:0040B9A6 E85F330000              call 0040ED0A
:0040B9AB 6A00                    push 00000000
:0040B9AD B9382F4900              mov ecx, 00492F38
:0040B9B2 E805330000              call 0040ECBC
:0040B9B7 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0040B9BA 51                      push ecx
:0040B9BB 8B15686A4B00            mov edx, dword ptr [004B6A68]
:0040B9C1 52                      push edx
:0040B9C2 FF15EC624800            call dword ptr [004862EC]
:0040B9C8 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040B9CB 83C028                  add eax, 00000028
:0040B9CE 8945F4                  mov dword ptr [ebp-0C], eax
:0040B9D1 E86A190700              call 0047D340
:0040B9D6 6A01                    push 00000001
:0040B9D8 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040B9DB 81E1FF000000            and ecx, 000000FF
:0040B9E1 8B548DDC                mov edx, dword ptr [ebp+4*ecx-24]
:0040B9E5 52                      push edx
:0040B9E6 6A18                    push 00000018
:0040B9E8 6A02                    push 00000002
:0040B9EA 6A40                    push 00000040
:0040B9EC 83EC10                  sub esp, 00000010
:0040B9EF 8BC4                    mov eax, esp
:0040B9F1 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040B9F4 8908                    mov dword ptr [eax], ecx
:0040B9F6 8B55F4                  mov edx, dword ptr [ebp-0C]
:0040B9F9 895004                  mov dword ptr [eax+04], edx
:0040B9FC 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040B9FF 894808                  mov dword ptr [eax+08], ecx
:0040BA02 8B55FC                  mov edx, dword ptr [ebp-04]
:0040BA05 89500C                  mov dword ptr [eax+0C], edx
:0040BA08 E8EB320100              call 0041ECF8
:0040BA0D 83C424                  add esp, 00000024
:0040BA10 6A01                    push 00000001
:0040BA12 8B4508                  mov eax, dword ptr [ebp+08]
:0040BA15 25FF000000              and eax, 000000FF
:0040BA1A 8B4C85DC                mov ecx, dword ptr [ebp+4*eax-24]
:0040BA1E 51                      push ecx
:0040BA1F 6A15                    push 00000015
:0040BA21 6A01                    push 00000001
:0040BA23 6A40                    push 00000040
:0040BA25 83EC10                  sub esp, 00000010
:0040BA28 8BD4                    mov edx, esp
:0040BA2A 8B45F0                  mov eax, dword ptr [ebp-10]
:0040BA2D 8902                    mov dword ptr [edx], eax
:0040BA2F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040BA32 894A04                  mov dword ptr [edx+04], ecx
:0040BA35 8B45F8                  mov eax, dword ptr [ebp-08]
:0040BA38 894208                  mov dword ptr [edx+08], eax
:0040BA3B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040BA3E 894A0C                  mov dword ptr [edx+0C], ecx
:0040BA41 E8B2320100              call 0041ECF8
:0040BA46 83C424                  add esp, 00000024
:0040BA49 6A12                    push 00000012
:0040BA4B B9382F4900              mov ecx, 00492F38
:0040BA50 E82F320000              call 0040EC84
:0040BA55 6A00                    push 00000000
:0040BA57 6A00                    push 00000000
:0040BA59 6A01                    push 00000001
:0040BA5B 8B5508                  mov edx, dword ptr [ebp+08]
:0040BA5E 81E2FF000000            and edx, 000000FF
:0040BA64 8B4495DC                mov eax, dword ptr [ebp+4*edx-24]
:0040BA68 50                      push eax
:0040BA69 6A40                    push 00000040
:0040BA6B 6A20                    push 00000020
:0040BA6D 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0040BA70 51                      push ecx
:0040BA71 E83E2F0100              call 0041E9B4
:0040BA76 83C41C                  add esp, 0000001C
:0040BA79 E887290100              call 0041E405
:0040BA7E 6A14                    push 00000014
:0040BA80 B9181B4B00              mov ecx, 004B1B18
:0040BA85 E8B678FFFF              call 00403340
:0040BA8A 6A14                    push 00000014
:0040BA8C E8B50B0200              call 0042C646
:0040BA91 83C404                  add esp, 00000004
:0040BA94 E8292B0100              call 0041E5C2
:0040BA99 E8A2180700              call 0047D340
:0040BA9E 6A01                    push 00000001
:0040BAA0 8B550C                  mov edx, dword ptr [ebp+0C]
:0040BAA3 52                      push edx
:0040BAA4 6A18                    push 00000018
:0040BAA6 6A02                    push 00000002
:0040BAA8 6A40                    push 00000040
:0040BAAA 83EC10                  sub esp, 00000010
:0040BAAD 8BC4                    mov eax, esp
:0040BAAF 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040BAB2 8908                    mov dword ptr [eax], ecx
:0040BAB4 8B55F4                  mov edx, dword ptr [ebp-0C]
:0040BAB7 895004                  mov dword ptr [eax+04], edx
:0040BABA 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040BABD 894808                  mov dword ptr [eax+08], ecx
:0040BAC0 8B55FC                  mov edx, dword ptr [ebp-04]
:0040BAC3 89500C                  mov dword ptr [eax+0C], edx
:0040BAC6 E82D320100              call 0041ECF8
:0040BACB 83C424                  add esp, 00000024
:0040BACE 6A01                    push 00000001
:0040BAD0 8B450C                  mov eax, dword ptr [ebp+0C]
:0040BAD3 50                      push eax
:0040BAD4 6A15                    push 00000015
:0040BAD6 6A01                    push 00000001
:0040BAD8 6A40                    push 00000040
:0040BADA 83EC10                  sub esp, 00000010
:0040BADD 8BCC                    mov ecx, esp
:0040BADF 8B55F0                  mov edx, dword ptr [ebp-10]
:0040BAE2 8911                    mov dword ptr [ecx], edx
:0040BAE4 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040BAE7 894104                  mov dword ptr [ecx+04], eax
:0040BAEA 8B55F8                  mov edx, dword ptr [ebp-08]
:0040BAED 895108                  mov dword ptr [ecx+08], edx
:0040BAF0 8B45FC                  mov eax, dword ptr [ebp-04]
:0040BAF3 89410C                  mov dword ptr [ecx+0C], eax
:0040BAF6 E8FD310100              call 0041ECF8
:0040BAFB 83C424                  add esp, 00000024
:0040BAFE 6A12                    push 00000012
:0040BB00 B9382F4900              mov ecx, 00492F38
:0040BB05 E87A310000              call 0040EC84
:0040BB0A 6A00                    push 00000000
:0040BB0C 6A00                    push 00000000
:0040BB0E 6A01                    push 00000001
:0040BB10 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0040BB13 51                      push ecx
:0040BB14 6A40                    push 00000040
:0040BB16 6A20                    push 00000020
:0040BB18 8D55F0                  lea edx, dword ptr [ebp-10]
:0040BB1B 52                      push edx
:0040BB1C E8932E0100              call 0041E9B4
:0040BB21 83C41C                  add esp, 0000001C
:0040BB24 E8DC280100              call 0041E405
:0040BB29 6A14                    push 00000014
:0040BB2B B9181B4B00              mov ecx, 004B1B18
:0040BB30 E80B78FFFF              call 00403340
:0040BB35 6A28                    push 00000028
:0040BB37 E80A0B0200              call 0042C646
:0040BB3C 83C404                  add esp, 00000004
:0040BB3F E87E2A0100              call 0041E5C2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B976(U)
|
:0040BB44 8BE5                    mov esp, ebp
:0040BB46 5D                      pop ebp
:0040BB47 C3                      ret



* Referenced by a CALL at Address:
|:00413B2C   
|
:0040BB48 55                      push ebp
:0040BB49 8BEC                    mov ebp, esp
:0040BB4B 8B4508                  mov eax, dword ptr [ebp+08]
:0040BB4E 50                      push eax
:0040BB4F 6828114A00              push 004A1128
:0040BB54 E824410700              call 0047FC7D
:0040BB59 83C408                  add esp, 00000008
:0040BB5C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040BB5F 51                      push ecx
:0040BB60 E8AAA90600              call 0047650F
:0040BB65 83C404                  add esp, 00000004
:0040BB68 8B5508                  mov edx, dword ptr [ebp+08]
:0040BB6B 52                      push edx
:0040BB6C 6A02                    push 00000002
:0040BB6E E8263B0200              call 0042F699
:0040BB73 83C408                  add esp, 00000008
:0040BB76 5D                      pop ebp
:0040BB77 C3                      ret



* Referenced by a CALL at Address:
|:00413AF6   
|
:0040BB78 55                      push ebp
:0040BB79 8BEC                    mov ebp, esp
:0040BB7B 8B4508                  mov eax, dword ptr [ebp+08]
:0040BB7E 50                      push eax
:0040BB7F 6858074B00              push 004B0758
:0040BB84 E8F4400700              call 0047FC7D
:0040BB89 83C408                  add esp, 00000008
:0040BB8C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040BB8F 51                      push ecx
:0040BB90 E87DAA0600              call 00476612
:0040BB95 83C404                  add esp, 00000004
:0040BB98 8B5508                  mov edx, dword ptr [ebp+08]
:0040BB9B 52                      push edx
:0040BB9C 6A02                    push 00000002
:0040BB9E E8F63A0200              call 0042F699
:0040BBA3 83C408                  add esp, 00000008
:0040BBA6 5D                      pop ebp
:0040BBA7 C3                      ret



* Referenced by a CALL at Addresses:
|:0040BDE9   , :0042C01B   , :0042C3BB   , :00433324   
|
:0040BBA8 55                      push ebp
:0040BBA9 8BEC                    mov ebp, esp

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BBCC(U)
|
:0040BBAB A19CBF4A00              mov eax, dword ptr [004ABF9C]
:0040BBB0 83E06E                  and eax, 0000006E
:0040BBB3 85C0                    test eax, eax
:0040BBB5 7517                    jne 0040BBCE
:0040BBB7 833D9CBF4A0002          cmp dword ptr [004ABF9C], 00000002
:0040BBBE 740C                    je 0040BBCC
:0040BBC0 6A00                    push 00000000
:0040BBC2 B9902F4900              mov ecx, 00492F90
:0040BBC7 E8F5C40000              call 004180C1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BBBE(C)
|
:0040BBCC EBDD                    jmp 0040BBAB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BBB5(C)
|
:0040BBCE 5D                      pop ebp
:0040BBCF C3                      ret



* Referenced by a CALL at Addresses:
|:00413E0A   , :00413E3B   , :00413E64   , :00413E8D   
|
:0040BBD0 55                      push ebp
:0040BBD1 8BEC                    mov ebp, esp
:0040BBD3 8A4508                  mov al, byte ptr [ebp+08]
:0040BBD6 50                      push eax
:0040BBD7 B93CC64A00              mov ecx, 004AC63C
:0040BBDC E81F020000              call 0040BE00
:0040BBE1 E83CFDFFFF              call 0040B922
:0040BBE6 85C0                    test eax, eax
:0040BBE8 7411                    je 0040BBFB
:0040BBEA 68FF000000              push 000000FF
:0040BBEF B93CC64A00              mov ecx, 004AC63C
:0040BBF4 E827020000              call 0040BE20
:0040BBF9 EB0E                    jmp 0040BC09

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BBE8(C)
|
:0040BBFB 8A4D0C                  mov cl, byte ptr [ebp+0C]
:0040BBFE 51                      push ecx
:0040BBFF B93CC64A00              mov ecx, 004AC63C
:0040BC04 E817020000              call 0040BE20

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BBF9(U)
|
:0040BC09 8B159CBF4A00            mov edx, dword ptr [004ABF9C]
:0040BC0F 83CA02                  or edx, 00000002
:0040BC12 89159CBF4A00            mov dword ptr [004ABF9C], edx
:0040BC18 5D                      pop ebp
:0040BC19 C3                      ret



* Referenced by a CALL at Addresses:
|:0040BCB6   , :0040BD1A   , :0040BD6F   
|
:0040BC1A 55                      push ebp
:0040BC1B 8BEC                    mov ebp, esp
:0040BC1D 837D0873                cmp dword ptr [ebp+08], 00000073
:0040BC21 7312                    jnb 0040BC35
:0040BC23 8B450C                  mov eax, dword ptr [ebp+0C]
:0040BC26 50                      push eax
:0040BC27 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040BC2A 51                      push ecx
:0040BC2B B940C64A00              mov ecx, 004AC640
:0040BC30 E854400100              call 0041FC89

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BC21(C)
|
:0040BC35 5D                      pop ebp
:0040BC36 C3                      ret



* Referenced by a CALL at Addresses:
|:0040BDE4   , :00428940   , :0043331F   
|
:0040BC37 55                      push ebp
:0040BC38 8BEC                    mov ebp, esp
:0040BC3A 83EC10                  sub esp, 00000010
:0040BC3D B93CC64A00              mov ecx, 004AC63C
:0040BC42 E8593D0400              call 0044F9A0
:0040BC47 8845F8                  mov byte ptr [ebp-08], al
:0040BC4A B93CC64A00              mov ecx, 004AC63C
:0040BC4F E85CFCFFFF              call 0040B8B0
:0040BC54 8845F4                  mov byte ptr [ebp-0C], al
:0040BC57 6A0E                    push 0000000E
:0040BC59 E8BDFB0100              call 0042B81B
:0040BC5E 83C404                  add esp, 00000004
:0040BC61 8A45F4                  mov al, byte ptr [ebp-0C]
:0040BC64 8845F0                  mov byte ptr [ebp-10], al
:0040BC67 807DF000                cmp byte ptr [ebp-10], 00
:0040BC6B 7415                    je 0040BC82
:0040BC6D 807DF001                cmp byte ptr [ebp-10], 01
:0040BC71 0F84AD000000            je 0040BD24
:0040BC77 807DF002                cmp byte ptr [ebp-10], 02
:0040BC7B 7455                    je 0040BCD2
:0040BC7D E9F5000000              jmp 0040BD77

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BC6B(C)
|
:0040BC82 6A04                    push 00000004
:0040BC84 6A00                    push 00000000
:0040BC86 6800E80300              push 0003E800
:0040BC8B B980AB4A00              mov ecx, 004AAB80
:0040BC90 E8AB3D0700              call 0047FA40
:0040BC95 8945FC                  mov dword ptr [ebp-04], eax
:0040BC98 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040BC9B 81E1FF000000            and ecx, 000000FF
:0040BCA1 390DE4BA4800            cmp dword ptr [0048BAE4], ecx
:0040BCA7 7424                    je 0040BCCD
:0040BCA9 8B55FC                  mov edx, dword ptr [ebp-04]
:0040BCAC 52                      push edx
:0040BCAD 8B45F8                  mov eax, dword ptr [ebp-08]
:0040BCB0 25FF000000              and eax, 000000FF
:0040BCB5 50                      push eax
:0040BCB6 E85FFFFFFF              call 0040BC1A
:0040BCBB 83C408                  add esp, 00000008
:0040BCBE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040BCC1 81E1FF000000            and ecx, 000000FF
:0040BCC7 890DE4BA4800            mov dword ptr [0048BAE4], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BCA7(C)
|
:0040BCCD E9A5000000              jmp 0040BD77

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BC7B(C)
|
:0040BCD2 6A04                    push 00000004
:0040BCD4 6A00                    push 00000000
:0040BCD6 6A00                    push 00000000
:0040BCD8 B980AB4A00              mov ecx, 004AAB80
:0040BCDD E85E3D0700              call 0047FA40
:0040BCE2 8945FC                  mov dword ptr [ebp-04], eax
:0040BCE5 8A55F8                  mov dl, byte ptr [ebp-08]
:0040BCE8 80C228                  add dl, 28
:0040BCEB 8855F8                  mov byte ptr [ebp-08], dl
:0040BCEE 8B45F8                  mov eax, dword ptr [ebp-08]
:0040BCF1 25FF000000              and eax, 000000FF
:0040BCF6 3905E0BA4800            cmp dword ptr [0048BAE0], eax
:0040BCFC 7424                    je 0040BD22
:0040BCFE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040BD01 81E1FF000000            and ecx, 000000FF
:0040BD07 890DE0BA4800            mov dword ptr [0048BAE0], ecx
:0040BD0D 8B55FC                  mov edx, dword ptr [ebp-04]
:0040BD10 52                      push edx
:0040BD11 8B45F8                  mov eax, dword ptr [ebp-08]
:0040BD14 25FF000000              and eax, 000000FF
:0040BD19 50                      push eax
:0040BD1A E8FBFEFFFF              call 0040BC1A
:0040BD1F 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BCFC(C)
|
:0040BD22 EB53                    jmp 0040BD77

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BC71(C)
|
:0040BD24 6A04                    push 00000004
:0040BD26 6A00                    push 00000000
:0040BD28 6800D00700              push 0007D000
:0040BD2D B980AB4A00              mov ecx, 004AAB80
:0040BD32 E8093D0700              call 0047FA40
:0040BD37 8945FC                  mov dword ptr [ebp-04], eax
:0040BD3A 8A4DF8                  mov cl, byte ptr [ebp-08]
:0040BD3D 80C172                  add cl, 72
:0040BD40 884DF8                  mov byte ptr [ebp-08], cl
:0040BD43 8B55F8                  mov edx, dword ptr [ebp-08]
:0040BD46 81E2FF000000            and edx, 000000FF
:0040BD4C 3915E8BA4800            cmp dword ptr [0048BAE8], edx
:0040BD52 7423                    je 0040BD77
:0040BD54 8B45F8                  mov eax, dword ptr [ebp-08]
:0040BD57 25FF000000              and eax, 000000FF
:0040BD5C A3E8BA4800              mov dword ptr [0048BAE8], eax
:0040BD61 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040BD64 51                      push ecx
:0040BD65 8B55F8                  mov edx, dword ptr [ebp-08]
:0040BD68 81E2FF000000            and edx, 000000FF
:0040BD6E 52                      push edx
:0040BD6F E8A6FEFFFF              call 0040BC1A
:0040BD74 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040BC7D(U), :0040BCCD(U), :0040BD22(U), :0040BD52(C)
|
:0040BD77 6A00                    push 00000000
:0040BD79 E8650D0700              call 0047CAE3
:0040BD7E 83C404                  add esp, 00000004
:0040BD81 E871F70600              call 0047B4F7
:0040BD86 E850280100              call 0041E5DB
:0040BD8B E8FF280100              call 0041E68F
:0040BD90 6A00                    push 00000000
:0040BD92 660FB645F8              movzx ax, byte ptr [ebp-08]
:0040BD97 50                      push eax
:0040BD98 E8B3220100              call 0041E050
:0040BD9D 83C408                  add esp, 00000008

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0040BDA0 6A07                    push 00000007
:0040BDA2 E823140700              call 0047D1CA
:0040BDA7 83C404                  add esp, 00000004
:0040BDAA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040BDAD 51                      push ecx
:0040BDAE 6890010000              push 00000190
:0040BDB3 6880020000              push 00000280
:0040BDB8 6A28                    push 00000028
:0040BDBA 6A00                    push 00000000
:0040BDBC E8DA220700              call 0047E09B
:0040BDC1 83C414                  add esp, 00000014
:0040BDC4 E82D280100              call 0041E5F6
:0040BDC9 6A00                    push 00000000
:0040BDCB E84BFA0100              call 0042B81B
:0040BDD0 83C404                  add esp, 00000004
:0040BDD3 8BE5                    mov esp, ebp
:0040BDD5 5D                      pop ebp
:0040BDD6 C3                      ret



* Referenced by a CALL at Address:
|:0042C2D1   
|
:0040BDD7 55                      push ebp
:0040BDD8 8BEC                    mov ebp, esp
:0040BDDA C7059CBF4A0000000000    mov dword ptr [004ABF9C], 00000000
:0040BDE4 E84EFEFFFF              call 0040BC37
:0040BDE9 E8BAFDFFFF              call 0040BBA8
:0040BDEE A19CBF4A00              mov eax, dword ptr [004ABF9C]
:0040BDF3 5D                      pop ebp
:0040BDF4 C3                      ret


:0040BDF5 CC                      int 03
:0040BDF6 CC                      int 03
:0040BDF7 CC                      int 03
:0040BDF8 CC                      int 03
:0040BDF9 CC                      int 03
:0040BDFA CC                      int 03
:0040BDFB CC                      int 03
:0040BDFC CC                      int 03
:0040BDFD CC                      int 03
:0040BDFE CC                      int 03
:0040BDFF CC                      int 03

* Referenced by a CALL at Addresses:
|:0040B90C   , :0040BBDC   , :0042B972   , :0044ED6F   
|
:0040BE00 55                      push ebp
:0040BE01 8BEC                    mov ebp, esp
:0040BE03 51                      push ecx
:0040BE04 894DFC                  mov dword ptr [ebp-04], ecx
:0040BE07 8B45FC                  mov eax, dword ptr [ebp-04]
:0040BE0A 8A4D08                  mov cl, byte ptr [ebp+08]
:0040BE0D 8808                    mov byte ptr [eax], cl
:0040BE0F 8BE5                    mov esp, ebp
:0040BE11 5D                      pop ebp
:0040BE12 C20400                  ret 0004


:0040BE15 CC                      int 03
:0040BE16 CC                      int 03
:0040BE17 CC                      int 03
:0040BE18 CC                      int 03
:0040BE19 CC                      int 03
:0040BE1A CC                      int 03
:0040BE1B CC                      int 03
:0040BE1C CC                      int 03
:0040BE1D CC                      int 03
:0040BE1E CC                      int 03
:0040BE1F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040BBF4   , :0040BC04   , :0041A45A   , :0042C35D   , :00449CC1   
|:00449CE5   , :0044E4D5   , :0044E4EA   , :0044E55A   , :0044E5B9   
|:00456016   
|
:0040BE20 55                      push ebp
:0040BE21 8BEC                    mov ebp, esp
:0040BE23 51                      push ecx
:0040BE24 894DFC                  mov dword ptr [ebp-04], ecx
:0040BE27 8B45FC                  mov eax, dword ptr [ebp-04]
:0040BE2A 8A4D08                  mov cl, byte ptr [ebp+08]
:0040BE2D 884801                  mov byte ptr [eax+01], cl
:0040BE30 8BE5                    mov esp, ebp
:0040BE32 5D                      pop ebp
:0040BE33 C20400                  ret 0004


:0040BE36 CC                      int 03
:0040BE37 CC                      int 03
:0040BE38 CC                      int 03
:0040BE39 CC                      int 03
:0040BE3A CC                      int 03
:0040BE3B CC                      int 03
:0040BE3C CC                      int 03
:0040BE3D CC                      int 03
:0040BE3E CC                      int 03
:0040BE3F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040B980   , :0042C26D   
|
:0040BE40 55                      push ebp
:0040BE41 8BEC                    mov ebp, esp
:0040BE43 51                      push ecx
:0040BE44 894DFC                  mov dword ptr [ebp-04], ecx
:0040BE47 8B45FC                  mov eax, dword ptr [ebp-04]
:0040BE4A 8B800C010000            mov eax, dword ptr [eax+0000010C]
:0040BE50 8BE5                    mov esp, ebp
:0040BE52 5D                      pop ebp
:0040BE53 C3                      ret


:0040BE54 CC                      int 03
:0040BE55 CC                      int 03
:0040BE56 CC                      int 03
:0040BE57 CC                      int 03
:0040BE58 CC                      int 03
:0040BE59 CC                      int 03
:0040BE5A CC                      int 03
:0040BE5B CC                      int 03
:0040BE5C CC                      int 03
:0040BE5D CC                      int 03
:0040BE5E CC                      int 03
:0040BE5F CC                      int 03

* Referenced by a CALL at Addresses:
|:00426911   , :0042695F   , :0042CB8C   , :0042D667   
|
:0040BE60 55                      push ebp
:0040BE61 8BEC                    mov ebp, esp
:0040BE63 817D0800020000          cmp dword ptr [ebp+08], 00000200
:0040BE6A 730D                    jnb 0040BE79
:0040BE6C 8B4508                  mov eax, dword ptr [ebp+08]
:0040BE6F 6BC048                  imul eax, 00000048
:0040BE72 05681B4A00              add eax, 004A1B68
:0040BE77 EB02                    jmp 0040BE7B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BE6A(C)
|
:0040BE79 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BE77(U)
|
:0040BE7B 5D                      pop ebp
:0040BE7C C3                      ret


:0040BE7D 55                      push ebp
:0040BE7E 8BEC                    mov ebp, esp
:0040BE80 8B4508                  mov eax, dword ptr [ebp+08]
:0040BE83 2D681B4A00              sub eax, 004A1B68
:0040BE88 99                      cdq
:0040BE89 B948000000              mov ecx, 00000048
:0040BE8E F7F9                    idiv ecx
:0040BE90 5D                      pop ebp
:0040BE91 C3                      ret


:0040BE92 55                      push ebp
:0040BE93 8BEC                    mov ebp, esp
:0040BE95 8B4508                  mov eax, dword ptr [ebp+08]
:0040BE98 25FF000000              and eax, 000000FF
:0040BE9D 83F868                  cmp eax, 00000068
:0040BEA0 7D12                    jge 0040BEB4
:0040BEA2 8B4508                  mov eax, dword ptr [ebp+08]
:0040BEA5 25FF000000              and eax, 000000FF
:0040BEAA 6BC019                  imul eax, 00000019
:0040BEAD 0540114A00              add eax, 004A1140
:0040BEB2 EB02                    jmp 0040BEB6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BEA0(C)
|
:0040BEB4 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BEB2(U)
|
:0040BEB6 5D                      pop ebp
:0040BEB7 C3                      ret



* Referenced by a CALL at Addresses:
|:004145BA   , :00459C1E   
|
:0040BEB8 55                      push ebp
:0040BEB9 8BEC                    mov ebp, esp
:0040BEBB 837D0868                cmp dword ptr [ebp+08], 00000068
:0040BEBF 7204                    jb 0040BEC5
:0040BEC1 33C0                    xor eax, eax
:0040BEC3 EB11                    jmp 0040BED6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BEBF(C)
|
:0040BEC5 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040BEC8 6BC919                  imul ecx, 00000019
:0040BECB 81C140114A00            add ecx, 004A1140
:0040BED1 E83A380500              call 0045F710

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BEC3(U)
|
:0040BED6 5D                      pop ebp
:0040BED7 C3                      ret


:0040BED8 55                      push ebp
:0040BED9 8BEC                    mov ebp, esp
:0040BEDB 8A4510                  mov al, byte ptr [ebp+10]
:0040BEDE 50                      push eax
:0040BEDF 8A4D0C                  mov cl, byte ptr [ebp+0C]
:0040BEE2 51                      push ecx
:0040BEE3 8B5508                  mov edx, dword ptr [ebp+08]
:0040BEE6 52                      push edx
:0040BEE7 A1686A4B00              mov eax, dword ptr [004B6A68]
:0040BEEC 50                      push eax
:0040BEED E805000000              call 0040BEF7
:0040BEF2 83C410                  add esp, 00000010
:0040BEF5 5D                      pop ebp
:0040BEF6 C3                      ret



* Referenced by a CALL at Addresses:
|:0040BEED   , :0046775C   , :0046A909   , :00470381   , :004775BC   
|
:0040BEF7 55                      push ebp
:0040BEF8 8BEC                    mov ebp, esp
:0040BEFA 6AFF                    push FFFFFFFF
:0040BEFC 6819504800              push 00485019
:0040BF01 64A100000000            mov eax, dword ptr fs:[00000000]
:0040BF07 50                      push eax
:0040BF08 64892500000000          mov dword ptr fs:[00000000], esp
:0040BF0F 83EC40                  sub esp, 00000040
:0040BF12 8D4DB4                  lea ecx, dword ptr [ebp-4C]
:0040BF15 E8A61F0000              call 0040DEC0
:0040BF1A C745FC00000000          mov [ebp-04], 00000000
:0040BF21 8A4514                  mov al, byte ptr [ebp+14]
:0040BF24 50                      push eax
:0040BF25 8A4D10                  mov cl, byte ptr [ebp+10]
:0040BF28 51                      push ecx
:0040BF29 8B550C                  mov edx, dword ptr [ebp+0C]
:0040BF2C 52                      push edx
:0040BF2D 8B4508                  mov eax, dword ptr [ebp+08]
:0040BF30 50                      push eax
:0040BF31 8D4DB4                  lea ecx, dword ptr [ebp-4C]
:0040BF34 E88B410600              call 004700C4
:0040BF39 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0040BF40 8D4DB4                  lea ecx, dword ptr [ebp-4C]
:0040BF43 E8D81F0000              call 0040DF20
:0040BF48 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040BF4B 64890D00000000          mov dword ptr fs:[00000000], ecx
:0040BF52 8BE5                    mov esp, ebp
:0040BF54 5D                      pop ebp
:0040BF55 C3                      ret



* Referenced by a CALL at Addresses:
|:0040BF9A   , :0040BFBC   , :0040BFDE   , :0040C003   , :0040C025   
|:0040C0BD   , :0040C85E   , :0043154E   , :004316C4   
|
:0040BF56 55                      push ebp
:0040BF57 8BEC                    mov ebp, esp

* Possible Reference to Dialog: DialogID_00C8 
                                  |
:0040BF59 68C8000000              push 000000C8
:0040BF5E 8B4508                  mov eax, dword ptr [ebp+08]
:0040BF61 50                      push eax
:0040BF62 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0040BF65 69C9C8000000            imul ecx, 000000C8
:0040BF6B 51                      push ecx
:0040BF6C B9BCE44A00              mov ecx, 004AE4BC
:0040BF71 E80ED20000              call 00419184
:0040BF76 8B5508                  mov edx, dword ptr [ebp+08]
:0040BF79 C682C800000000          mov byte ptr [edx+000000C8], 00
:0040BF80 5D                      pop ebp
:0040BF81 C3                      ret



* Referenced by a CALL at Address:
|:0046FBE6   
|
:0040BF82 55                      push ebp
:0040BF83 8BEC                    mov ebp, esp
:0040BF85 837D0C44                cmp dword ptr [ebp+0C], 00000044
:0040BF89 7202                    jb 0040BF8D
:0040BF8B EB15                    jmp 0040BFA2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BF89(C)
|
:0040BF8D 8B450C                  mov eax, dword ptr [ebp+0C]
:0040BF90 0596000000              add eax, 00000096
:0040BF95 50                      push eax
:0040BF96 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040BF99 51                      push ecx
:0040BF9A E8B7FFFFFF              call 0040BF56
:0040BF9F 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BF8B(U)
|
:0040BFA2 5D                      pop ebp
:0040BFA3 C3                      ret



* Referenced by a CALL at Addresses:
|:0041A7FC   , :0041A880   , :00449E82   
|
:0040BFA4 55                      push ebp
:0040BFA5 8BEC                    mov ebp, esp
:0040BFA7 837D0C3A                cmp dword ptr [ebp+0C], 0000003A
:0040BFAB 7602                    jbe 0040BFAF
:0040BFAD EB15                    jmp 0040BFC4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BFAB(C)
|
:0040BFAF 8B450C                  mov eax, dword ptr [ebp+0C]
:0040BFB2 05FA000000              add eax, 000000FA
:0040BFB7 50                      push eax
:0040BFB8 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040BFBB 51                      push ecx
:0040BFBC E895FFFFFF              call 0040BF56
:0040BFC1 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BFAD(U)
|
:0040BFC4 5D                      pop ebp
:0040BFC5 C3                      ret



* Referenced by a CALL at Address:
|:00477E3A   
|
:0040BFC6 55                      push ebp
:0040BFC7 8BEC                    mov ebp, esp
:0040BFC9 837D0C35                cmp dword ptr [ebp+0C], 00000035
:0040BFCD 7202                    jb 0040BFD1
:0040BFCF EB15                    jmp 0040BFE6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BFCD(C)
|
:0040BFD1 8B450C                  mov eax, dword ptr [ebp+0C]
:0040BFD4 055E010000              add eax, 0000015E
:0040BFD9 50                      push eax
:0040BFDA 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040BFDD 51                      push ecx
:0040BFDE E873FFFFFF              call 0040BF56
:0040BFE3 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BFCF(U)
|
:0040BFE6 5D                      pop ebp
:0040BFE7 C3                      ret



* Referenced by a CALL at Address:
|:004784C7   
|
:0040BFE8 55                      push ebp
:0040BFE9 8BEC                    mov ebp, esp
:0040BFEB 817D0CAE000000          cmp dword ptr [ebp+0C], 000000AE
:0040BFF2 7202                    jb 0040BFF6
:0040BFF4 EB15                    jmp 0040C00B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BFF2(C)
|
:0040BFF6 8B450C                  mov eax, dword ptr [ebp+0C]
:0040BFF9 05C2010000              add eax, 000001C2
:0040BFFE 50                      push eax
:0040BFFF 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040C002 51                      push ecx
:0040C003 E84EFFFFFF              call 0040BF56
:0040C008 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BFF4(U)
|
:0040C00B 5D                      pop ebp
:0040C00C C3                      ret



* Referenced by a CALL at Address:
|:00441995   
|
:0040C00D 55                      push ebp
:0040C00E 8BEC                    mov ebp, esp
:0040C010 837D0C1A                cmp dword ptr [ebp+0C], 0000001A
:0040C014 7202                    jb 0040C018
:0040C016 EB15                    jmp 0040C02D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C014(C)
|
:0040C018 8B450C                  mov eax, dword ptr [ebp+0C]
:0040C01B 058A020000              add eax, 0000028A
:0040C020 50                      push eax
:0040C021 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040C024 51                      push ecx
:0040C025 E82CFFFFFF              call 0040BF56
:0040C02A 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C016(U)
|
:0040C02D 5D                      pop ebp
:0040C02E C3                      ret



* Referenced by a CALL at Address:
|:00405849   
|
:0040C02F 55                      push ebp
:0040C030 8BEC                    mov ebp, esp
:0040C032 81ECD8000000            sub esp, 000000D8
:0040C038 53                      push ebx
:0040C039 C745FCFFFF0000          mov [ebp-04], 0000FFFF
:0040C040 C745F800000000          mov [ebp-08], 00000000
:0040C047 EB09                    jmp 0040C052

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C06D(U)
|
:0040C049 8B45F8                  mov eax, dword ptr [ebp-08]
:0040C04C 83C001                  add eax, 00000001
:0040C04F 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C047(U)
|
:0040C052 837DF815                cmp dword ptr [ebp-08], 00000015
:0040C056 7317                    jnb 0040C06F
:0040C058 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040C05B 8B550C                  mov edx, dword ptr [ebp+0C]
:0040C05E 3B148D30B24800          cmp edx, dword ptr [4*ecx+0048B230]
:0040C065 7506                    jne 0040C06D
:0040C067 8B45F8                  mov eax, dword ptr [ebp-08]
:0040C06A 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C065(C)
|
:0040C06D EBDA                    jmp 0040C049

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C056(C)
|
:0040C06F 817DFCFFFF0000          cmp dword ptr [ebp-04], 0000FFFF
:0040C076 7534                    jne 0040C0AC
:0040C078 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0040C07B 6BC948                  imul ecx, 00000048
:0040C07E 81C1681B4A00            add ecx, 004A1B68
:0040C084 E8471F0000              call 0040DFD0
:0040C089 8AD8                    mov bl, al
:0040C08B 81E3FF000000            and ebx, 000000FF
:0040C091 6BDB03                  imul ebx, 00000003
:0040C094 6A03                    push 00000003
:0040C096 E8783A0700              call 0047FB13
:0040C09B 83C404                  add esp, 00000004
:0040C09E 03D8                    add ebx, eax
:0040C0A0 895DFC                  mov dword ptr [ebp-04], ebx
:0040C0A3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040C0A6 83C115                  add ecx, 00000015
:0040C0A9 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C076(C)
|
:0040C0AC 8B55FC                  mov edx, dword ptr [ebp-04]
:0040C0AF 81C2BC020000            add edx, 000002BC
:0040C0B5 52                      push edx
:0040C0B6 8D8528FFFFFF            lea eax, dword ptr [ebp+FFFFFF28]
:0040C0BC 50                      push eax
:0040C0BD E894FEFFFF              call 0040BF56
:0040C0C2 83C408                  add esp, 00000008
:0040C0C5 C745F800000000          mov [ebp-08], 00000000
:0040C0CC C745F400000000          mov [ebp-0C], 00000000
:0040C0D3 EB09                    jmp 0040C0DE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C13F(U)
|
:0040C0D5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040C0D8 83C101                  add ecx, 00000001
:0040C0DB 894DF8                  mov dword ptr [ebp-08], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C0D3(U)
|
:0040C0DE 8B55F8                  mov edx, dword ptr [ebp-08]
:0040C0E1 33C0                    xor eax, eax
:0040C0E3 8A841528FFFFFF          mov al, byte ptr [ebp+edx-000000D8]
:0040C0EA 85C0                    test eax, eax
:0040C0EC 7453                    je 0040C141
:0040C0EE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040C0F1 33D2                    xor edx, edx
:0040C0F3 8A940D28FFFFFF          mov dl, byte ptr [ebp+ecx-000000D8]
:0040C0FA 83FA5C                  cmp edx, 0000005C
:0040C0FD 7525                    jne 0040C124
:0040C0FF 8B45F8                  mov eax, dword ptr [ebp-08]
:0040C102 33C9                    xor ecx, ecx
:0040C104 8A8C0529FFFFFF          mov cl, byte ptr [ebp+eax-000000D7]
:0040C10B 83F96E                  cmp ecx, 0000006E
:0040C10E 7514                    jne 0040C124
:0040C110 8B5508                  mov edx, dword ptr [ebp+08]
:0040C113 0355F4                  add edx, dword ptr [ebp-0C]
:0040C116 C6020A                  mov byte ptr [edx], 0A
:0040C119 8B45F8                  mov eax, dword ptr [ebp-08]
:0040C11C 83C001                  add eax, 00000001
:0040C11F 8945F8                  mov dword ptr [ebp-08], eax
:0040C122 EB12                    jmp 0040C136

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040C0FD(C), :0040C10E(C)
|
:0040C124 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040C127 034DF4                  add ecx, dword ptr [ebp-0C]
:0040C12A 8B55F8                  mov edx, dword ptr [ebp-08]
:0040C12D 8A841528FFFFFF          mov al, byte ptr [ebp+edx-000000D8]
:0040C134 8801                    mov byte ptr [ecx], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C122(U)
|
:0040C136 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040C139 83C101                  add ecx, 00000001
:0040C13C 894DF4                  mov dword ptr [ebp-0C], ecx
:0040C13F EB94                    jmp 0040C0D5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C0EC(C)
|
:0040C141 8B5508                  mov edx, dword ptr [ebp+08]
:0040C144 0355F4                  add edx, dword ptr [ebp-0C]
:0040C147 C60200                  mov byte ptr [edx], 00
:0040C14A 5B                      pop ebx
:0040C14B 8BE5                    mov esp, ebp
:0040C14D 5D                      pop ebp
:0040C14E C3                      ret



* Referenced by a CALL at Addresses:
|:0040C3DD   , :004144CC   
|
:0040C14F 55                      push ebp
:0040C150 8BEC                    mov ebp, esp
:0040C152 83EC7C                  sub esp, 0000007C
:0040C155 C745FC00000000          mov [ebp-04], 00000000
:0040C15C C745F800000000          mov [ebp-08], 00000000
:0040C163 C7458C00000000          mov [ebp-74], 00000000
:0040C16A EB09                    jmp 0040C175

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C1B1(U)
|
:0040C16C 8B458C                  mov eax, dword ptr [ebp-74]
:0040C16F 83C001                  add eax, 00000001
:0040C172 89458C                  mov dword ptr [ebp-74], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C16A(U)
|
:0040C175 837D8C1A                cmp dword ptr [ebp-74], 0000001A
:0040C179 7338                    jnb 0040C1B3
:0040C17B 8B4D8C                  mov ecx, dword ptr [ebp-74]
:0040C17E 51                      push ecx
:0040C17F E80CE00000              call 0041A190
:0040C184 83C404                  add esp, 00000004
:0040C187 85C0                    test eax, eax
:0040C189 7426                    je 0040C1B1
:0040C18B 8B4D8C                  mov ecx, dword ptr [ebp-74]
:0040C18E 6BC948                  imul ecx, 00000048
:0040C191 81C1681B4A00            add ecx, 004A1B68
:0040C197 E834A4FFFF              call 004065D0
:0040C19C 25FF000000              and eax, 000000FF
:0040C1A1 8B55F8                  mov edx, dword ptr [ebp-08]
:0040C1A4 89449590                mov dword ptr [ebp+4*edx-70], eax
:0040C1A8 8B45F8                  mov eax, dword ptr [ebp-08]
:0040C1AB 83C001                  add eax, 00000001
:0040C1AE 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C189(C)
|
:0040C1B1 EBB9                    jmp 0040C16C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C179(C)
|
:0040C1B3 C7458C00000000          mov [ebp-74], 00000000
:0040C1BA EB09                    jmp 0040C1C5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C21E(U)
|
:0040C1BC 8B4D8C                  mov ecx, dword ptr [ebp-74]
:0040C1BF 83C101                  add ecx, 00000001
:0040C1C2 894D8C                  mov dword ptr [ebp-74], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C1BA(U)
|
:0040C1C5 8B558C                  mov edx, dword ptr [ebp-74]
:0040C1C8 3B55F8                  cmp edx, dword ptr [ebp-08]
:0040C1CB 7353                    jnb 0040C220
:0040C1CD C7458800000000          mov [ebp-78], 00000000
:0040C1D4 EB09                    jmp 0040C1DF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C21C(U)
|
:0040C1D6 8B4588                  mov eax, dword ptr [ebp-78]
:0040C1D9 83C001                  add eax, 00000001
:0040C1DC 894588                  mov dword ptr [ebp-78], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C1D4(U)
|
:0040C1DF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040C1E2 83E901                  sub ecx, 00000001
:0040C1E5 394D88                  cmp dword ptr [ebp-78], ecx
:0040C1E8 7334                    jnb 0040C21E
:0040C1EA 8B5588                  mov edx, dword ptr [ebp-78]
:0040C1ED 8B4588                  mov eax, dword ptr [ebp-78]
:0040C1F0 8B4C9590                mov ecx, dword ptr [ebp+4*edx-70]
:0040C1F4 3B4C8594                cmp ecx, dword ptr [ebp+4*eax-6C]
:0040C1F8 7322                    jnb 0040C21C
:0040C1FA 8B5588                  mov edx, dword ptr [ebp-78]
:0040C1FD 8B449590                mov eax, dword ptr [ebp+4*edx-70]
:0040C201 894584                  mov dword ptr [ebp-7C], eax
:0040C204 8B4D88                  mov ecx, dword ptr [ebp-78]
:0040C207 8B5588                  mov edx, dword ptr [ebp-78]
:0040C20A 8B449594                mov eax, dword ptr [ebp+4*edx-6C]
:0040C20E 89448D90                mov dword ptr [ebp+4*ecx-70], eax
:0040C212 8B4D88                  mov ecx, dword ptr [ebp-78]
:0040C215 8B5584                  mov edx, dword ptr [ebp-7C]
:0040C218 89548D94                mov dword ptr [ebp+4*ecx-6C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C1F8(C)
|
:0040C21C EBB8                    jmp 0040C1D6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C1E8(C)
|
:0040C21E EB9C                    jmp 0040C1BC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C1CB(C)
|
:0040C220 C7458C00000000          mov [ebp-74], 00000000
:0040C227 EB09                    jmp 0040C232

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C24D(U)
|
:0040C229 8B458C                  mov eax, dword ptr [ebp-74]
:0040C22C 83C001                  add eax, 00000001
:0040C22F 89458C                  mov dword ptr [ebp-74], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C227(U)
|
:0040C232 8B4D8C                  mov ecx, dword ptr [ebp-74]
:0040C235 3B4DF8                  cmp ecx, dword ptr [ebp-08]
:0040C238 7315                    jnb 0040C24F
:0040C23A 837D8C0F                cmp dword ptr [ebp-74], 0000000F
:0040C23E 730F                    jnb 0040C24F
:0040C240 8B558C                  mov edx, dword ptr [ebp-74]
:0040C243 8B45FC                  mov eax, dword ptr [ebp-04]
:0040C246 03449590                add eax, dword ptr [ebp+4*edx-70]
:0040C24A 8945FC                  mov dword ptr [ebp-04], eax
:0040C24D EBDA                    jmp 0040C229

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040C238(C), :0040C23E(C)
|
:0040C24F 837D8C00                cmp dword ptr [ebp-74], 00000000
:0040C253 7429                    je 0040C27E
:0040C255 8B45FC                  mov eax, dword ptr [ebp-04]
:0040C258 33D2                    xor edx, edx
:0040C25A F7758C                  div [ebp-74]
:0040C25D 83F801                  cmp eax, 00000001
:0040C260 760D                    jbe 0040C26F
:0040C262 8B45FC                  mov eax, dword ptr [ebp-04]
:0040C265 33D2                    xor edx, edx
:0040C267 F7758C                  div [ebp-74]
:0040C26A 894584                  mov dword ptr [ebp-7C], eax
:0040C26D EB07                    jmp 0040C276

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C260(C)
|
:0040C26F C7458401000000          mov [ebp-7C], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C26D(U)
|
:0040C276 8B4D84                  mov ecx, dword ptr [ebp-7C]
:0040C279 894DFC                  mov dword ptr [ebp-04], ecx
:0040C27C EB07                    jmp 0040C285

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C253(C)
|
:0040C27E C745FC01000000          mov [ebp-04], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C27C(U)
|
:0040C285 8A45FC                  mov al, byte ptr [ebp-04]
:0040C288 8BE5                    mov esp, ebp
:0040C28A 5D                      pop ebp
:0040C28B C3                      ret



* Referenced by a CALL at Address:
|:004149E6   
|
:0040C28C 55                      push ebp
:0040C28D 8BEC                    mov ebp, esp
:0040C28F 83EC30                  sub esp, 00000030
:0040C292 C745FC00000000          mov [ebp-04], 00000000
:0040C299 817D0800020000          cmp dword ptr [ebp+08], 00000200
:0040C2A0 7205                    jb 0040C2A7
:0040C2A2 E98C020000              jmp 0040C533

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C2A0(C)
|
:0040C2A7 8B4508                  mov eax, dword ptr [ebp+08]
:0040C2AA 6BC048                  imul eax, 00000048
:0040C2AD 05681B4A00              add eax, 004A1B68
:0040C2B2 8945E4                  mov dword ptr [ebp-1C], eax
:0040C2B5 817D0CFFFF0000          cmp dword ptr [ebp+0C], 0000FFFF
:0040C2BC 740D                    je 0040C2CB
:0040C2BE 817D0CFF000000          cmp dword ptr [ebp+0C], 000000FF
:0040C2C5 0F85F4000000            jne 0040C3BF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C2BC(C)
|
:0040C2CB 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040C2CE 51                      push ecx
:0040C2CF E8BCDE0000              call 0041A190
:0040C2D4 83C404                  add esp, 00000004
:0040C2D7 85C0                    test eax, eax
:0040C2D9 0F84C5000000            je 0040C3A4
:0040C2DF 6A00                    push 00000000
:0040C2E1 8D55E0                  lea edx, dword ptr [ebp-20]
:0040C2E4 52                      push edx
:0040C2E5 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0040C2E8 E8431D0000              call 0040E030
:0040C2ED 668B08                  mov cx, word ptr [eax]
:0040C2F0 66894DE8                mov word ptr [ebp-18], cx
:0040C2F4 8A5002                  mov dl, byte ptr [eax+02]
:0040C2F7 8855EA                  mov byte ptr [ebp-16], dl
:0040C2FA 6A01                    push 00000001
:0040C2FC 8D45DC                  lea eax, dword ptr [ebp-24]
:0040C2FF 50                      push eax
:0040C300 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0040C303 E8281D0000              call 0040E030
:0040C308 668B08                  mov cx, word ptr [eax]
:0040C30B 66894DF0                mov word ptr [ebp-10], cx
:0040C30F 8A5002                  mov dl, byte ptr [eax+02]
:0040C312 8855F2                  mov byte ptr [ebp-0E], dl
:0040C315 6A02                    push 00000002
:0040C317 8D45D8                  lea eax, dword ptr [ebp-28]
:0040C31A 50                      push eax
:0040C31B 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0040C31E E80D1D0000              call 0040E030
:0040C323 668B08                  mov cx, word ptr [eax]
:0040C326 66894DF8                mov word ptr [ebp-08], cx
:0040C32A 8A5002                  mov dl, byte ptr [eax+02]
:0040C32D 8855FA                  mov byte ptr [ebp-06], dl
:0040C330 C745EC00000000          mov [ebp-14], 00000000
:0040C337 EB09                    jmp 0040C342

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C354(U)
|
:0040C339 8B45EC                  mov eax, dword ptr [ebp-14]
:0040C33C 83C001                  add eax, 00000001
:0040C33F 8945EC                  mov dword ptr [ebp-14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C337(U)
|
:0040C342 837DEC02                cmp dword ptr [ebp-14], 00000002
:0040C346 770E                    ja 0040C356
:0040C348 8A4DEC                  mov cl, byte ptr [ebp-14]
:0040C34B 51                      push ecx
:0040C34C 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0040C34F E870BAFFFF              call 00407DC4
:0040C354 EBE3                    jmp 0040C339

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C346(C)
|
:0040C356 51                      push ecx
:0040C357 8BD4                    mov edx, esp
:0040C359 668B45E8                mov ax, word ptr [ebp-18]
:0040C35D 668902                  mov word ptr [edx], ax
:0040C360 8A4DEA                  mov cl, byte ptr [ebp-16]
:0040C363 884A02                  mov byte ptr [edx+02], cl
:0040C366 B970074B00              mov ecx, 004B0770
:0040C36B E8A0150000              call 0040D910
:0040C370 51                      push ecx
:0040C371 8BD4                    mov edx, esp
:0040C373 668B45F0                mov ax, word ptr [ebp-10]
:0040C377 668902                  mov word ptr [edx], ax
:0040C37A 8A4DF2                  mov cl, byte ptr [ebp-0E]
:0040C37D 884A02                  mov byte ptr [edx+02], cl
:0040C380 B970074B00              mov ecx, 004B0770
:0040C385 E886150000              call 0040D910
:0040C38A 51                      push ecx
:0040C38B 8BD4                    mov edx, esp
:0040C38D 668B45F8                mov ax, word ptr [ebp-08]
:0040C391 668902                  mov word ptr [edx], ax
:0040C394 8A4DFA                  mov cl, byte ptr [ebp-06]
:0040C397 884A02                  mov byte ptr [edx+02], cl
:0040C39A B970074B00              mov ecx, 004B0770
:0040C39F E86C150000              call 0040D910

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C2D9(C)
|
:0040C3A4 68FF000000              push 000000FF
:0040C3A9 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040C3AC 6BC948                  imul ecx, 00000048
:0040C3AF 81C1681B4A00            add ecx, 004A1B68
:0040C3B5 E8F61B0000              call 0040DFB0
:0040C3BA E974010000              jmp 0040C533

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C2C5(C)
|
:0040C3BF 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0040C3C3 0F856A010000            jne 0040C533
:0040C3C9 8B5508                  mov edx, dword ptr [ebp+08]
:0040C3CC 52                      push edx
:0040C3CD E8BEDD0000              call 0041A190
:0040C3D2 83C404                  add esp, 00000004
:0040C3D5 85C0                    test eax, eax
:0040C3D7 0F8556010000            jne 0040C533
:0040C3DD E86DFDFFFF              call 0040C14F
:0040C3E2 25FF000000              and eax, 000000FF
:0040C3E7 8945FC                  mov dword ptr [ebp-04], eax
:0040C3EA 837D1032                cmp dword ptr [ebp+10], 00000032
:0040C3EE 7717                    ja 0040C407
:0040C3F0 6A32                    push 00000032
:0040C3F2 8B4510                  mov eax, dword ptr [ebp+10]
:0040C3F5 50                      push eax
:0040C3F6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040C3F9 51                      push ecx
:0040C3FA E88A360700              call 0047FA89
:0040C3FF 83C40C                  add esp, 0000000C
:0040C402 8945FC                  mov dword ptr [ebp-04], eax
:0040C405 EB1C                    jmp 0040C423

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C3EE(C)
|
:0040C407 8B5510                  mov edx, dword ptr [ebp+10]
:0040C40A 83EA32                  sub edx, 00000032
:0040C40D 895510                  mov dword ptr [ebp+10], edx
:0040C410 8B4510                  mov eax, dword ptr [ebp+10]
:0040C413 50                      push eax
:0040C414 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040C417 51                      push ecx
:0040C418 E881360700              call 0047FA9E
:0040C41D 83C408                  add esp, 00000008
:0040C420 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C405(U)
|
:0040C423 837DFC01                cmp dword ptr [ebp-04], 00000001
:0040C427 7309                    jnb 0040C432
:0040C429 C745D401000000          mov [ebp-2C], 00000001
:0040C430 EB06                    jmp 0040C438

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C427(C)
|
:0040C432 8B55FC                  mov edx, dword ptr [ebp-04]
:0040C435 8955D4                  mov dword ptr [ebp-2C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C430(U)
|
:0040C438 8B45D4                  mov eax, dword ptr [ebp-2C]
:0040C43B 8945FC                  mov dword ptr [ebp-04], eax
:0040C43E B9C8E44A00              mov ecx, 004AE4C8
:0040C443 E8481C0000              call 0040E090
:0040C448 50                      push eax
:0040C449 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"DATA.E5"
                                  |
:0040C44B 6860BB4800              push 0048BB60
:0040C450 E8C9F00000              call 0041B51E
:0040C455 83C40C                  add esp, 0000000C
:0040C458 6A00                    push 00000000
:0040C45A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040C45D 51                      push ecx
:0040C45E B9C8E44A00              mov ecx, 004AE4C8
:0040C463 E8281C0000              call 0040E090
:0040C468 50                      push eax
:0040C469 E898F10000              call 0041B606
:0040C46E 83C40C                  add esp, 0000000C
:0040C471 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040C474 6BC948                  imul ecx, 00000048
:0040C477 81C1681B4A00            add ecx, 004A1B68
:0040C47D E88EA1FFFF              call 00406610
:0040C482 8845F4                  mov byte ptr [ebp-0C], al
:0040C485 8B55F4                  mov edx, dword ptr [ebp-0C]
:0040C488 81E2FF000000            and edx, 000000FF
:0040C48E 83FA26                  cmp edx, 00000026
:0040C491 7F22                    jg 0040C4B5
:0040C493 837DFC1E                cmp dword ptr [ebp-04], 0000001E
:0040C497 7209                    jb 0040C4A2
:0040C499 C745D002000000          mov [ebp-30], 00000002
:0040C4A0 EB0A                    jmp 0040C4AC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C497(C)
|
:0040C4A2 837DFC0F                cmp dword ptr [ebp-04], 0000000F
:0040C4A6 1BC0                    sbb eax, eax
:0040C4A8 40                      inc eax
:0040C4A9 8945D0                  mov dword ptr [ebp-30], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C4A0(U)
|
:0040C4AC 8A4DF4                  mov cl, byte ptr [ebp-0C]
:0040C4AF 024DD0                  add cl, byte ptr [ebp-30]
:0040C4B2 884DF4                  mov byte ptr [ebp-0C], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C491(C)
|
:0040C4B5 6A00                    push 00000000
:0040C4B7 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040C4BA 6BC948                  imul ecx, 00000048
:0040C4BD 81C1681B4A00            add ecx, 004A1B68
:0040C4C3 E8481B0000              call 0040E010
:0040C4C8 6A00                    push 00000000
:0040C4CA 8A55FC                  mov dl, byte ptr [ebp-04]
:0040C4CD 52                      push edx
:0040C4CE 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040C4D1 6BC948                  imul ecx, 00000048
:0040C4D4 81C1681B4A00            add ecx, 004A1B68
:0040C4DA E8D9AEFFFF              call 004073B8
:0040C4DF 8A45F4                  mov al, byte ptr [ebp-0C]
:0040C4E2 50                      push eax
:0040C4E3 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040C4E6 6BC948                  imul ecx, 00000048
:0040C4E9 81C1681B4A00            add ecx, 004A1B68
:0040C4EF E8FC1A0000              call 0040DFF0
:0040C4F4 6A01                    push 00000001
:0040C4F6 6A00                    push 00000000
:0040C4F8 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040C4FB 6BC948                  imul ecx, 00000048
:0040C4FE 81C1681B4A00            add ecx, 004A1B68
:0040C504 E8DEBAFFFF              call 00407FE7
:0040C509 6A01                    push 00000001
:0040C50B 6A01                    push 00000001
:0040C50D 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040C510 6BC948                  imul ecx, 00000048
:0040C513 81C1681B4A00            add ecx, 004A1B68
:0040C519 E8C9BAFFFF              call 00407FE7
:0040C51E 8A4D0C                  mov cl, byte ptr [ebp+0C]
:0040C521 51                      push ecx
:0040C522 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040C525 6BC948                  imul ecx, 00000048
:0040C528 81C1681B4A00            add ecx, 004A1B68
:0040C52E E87D1A0000              call 0040DFB0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040C2A2(U), :0040C3BA(U), :0040C3C3(C), :0040C3D7(C)
|
:0040C533 8BE5                    mov esp, ebp
:0040C535 5D                      pop ebp
:0040C536 C3                      ret



* Referenced by a CALL at Address:
|:0041B721   
|
:0040C537 55                      push ebp
:0040C538 8BEC                    mov ebp, esp
:0040C53A 83EC10                  sub esp, 00000010
:0040C53D 894DF0                  mov dword ptr [ebp-10], ecx
:0040C540 8B4508                  mov eax, dword ptr [ebp+08]
:0040C543 8945FC                  mov dword ptr [ebp-04], eax
:0040C546 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040C549 894DF8                  mov dword ptr [ebp-08], ecx
:0040C54C C745F400000000          mov [ebp-0C], 00000000
:0040C553 EB09                    jmp 0040C55E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C580(U)
|
:0040C555 8B55F4                  mov edx, dword ptr [ebp-0C]
:0040C558 83C201                  add edx, 00000001
:0040C55B 8955F4                  mov dword ptr [ebp-0C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C553(U)
|
:0040C55E 837DF410                cmp dword ptr [ebp-0C], 00000010
:0040C562 731E                    jnb 0040C582
:0040C564 8B45F8                  mov eax, dword ptr [ebp-08]
:0040C567 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040C56A 8A11                    mov dl, byte ptr [ecx]
:0040C56C 8810                    mov byte ptr [eax], dl
:0040C56E 8B45F8                  mov eax, dword ptr [ebp-08]
:0040C571 83C001                  add eax, 00000001
:0040C574 8945F8                  mov dword ptr [ebp-08], eax
:0040C577 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040C57A 83C101                  add ecx, 00000001
:0040C57D 894DFC                  mov dword ptr [ebp-04], ecx
:0040C580 EBD3                    jmp 0040C555

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C562(C)
|
:0040C582 8B55F8                  mov edx, dword ptr [ebp-08]
:0040C585 C60200                  mov byte ptr [edx], 00
:0040C588 8B4508                  mov eax, dword ptr [ebp+08]
:0040C58B 83C011                  add eax, 00000011
:0040C58E 894508                  mov dword ptr [ebp+08], eax
:0040C591 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040C594 8B5508                  mov edx, dword ptr [ebp+08]
:0040C597 8A02                    mov al, byte ptr [edx]
:0040C599 884111                  mov byte ptr [ecx+11], al
:0040C59C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040C59F 83C101                  add ecx, 00000001
:0040C5A2 894D08                  mov dword ptr [ebp+08], ecx
:0040C5A5 8B55F0                  mov edx, dword ptr [ebp-10]
:0040C5A8 8B4508                  mov eax, dword ptr [ebp+08]
:0040C5AB 8A08                    mov cl, byte ptr [eax]
:0040C5AD 884A14                  mov byte ptr [edx+14], cl
:0040C5B0 8B5508                  mov edx, dword ptr [ebp+08]
:0040C5B3 83C201                  add edx, 00000001
:0040C5B6 895508                  mov dword ptr [ebp+08], edx
:0040C5B9 8B45F0                  mov eax, dword ptr [ebp-10]
:0040C5BC 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040C5BF 8A11                    mov dl, byte ptr [ecx]
:0040C5C1 885012                  mov byte ptr [eax+12], dl
:0040C5C4 8B4508                  mov eax, dword ptr [ebp+08]
:0040C5C7 83C001                  add eax, 00000001
:0040C5CA 894508                  mov dword ptr [ebp+08], eax
:0040C5CD 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040C5D0 8B5508                  mov edx, dword ptr [ebp+08]
:0040C5D3 8A02                    mov al, byte ptr [edx]
:0040C5D5 884113                  mov byte ptr [ecx+13], al
:0040C5D8 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040C5DB 83C101                  add ecx, 00000001
:0040C5DE 894D08                  mov dword ptr [ebp+08], ecx
:0040C5E1 8B55F0                  mov edx, dword ptr [ebp-10]
:0040C5E4 8B4508                  mov eax, dword ptr [ebp+08]
:0040C5E7 8A08                    mov cl, byte ptr [eax]
:0040C5E9 884A15                  mov byte ptr [edx+15], cl
:0040C5EC 8B5508                  mov edx, dword ptr [ebp+08]
:0040C5EF 83C201                  add edx, 00000001
:0040C5F2 895508                  mov dword ptr [ebp+08], edx
:0040C5F5 8B45F0                  mov eax, dword ptr [ebp-10]
:0040C5F8 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040C5FB 8A11                    mov dl, byte ptr [ecx]
:0040C5FD 885016                  mov byte ptr [eax+16], dl
:0040C600 8B4508                  mov eax, dword ptr [ebp+08]
:0040C603 83C001                  add eax, 00000001
:0040C606 894508                  mov dword ptr [ebp+08], eax
:0040C609 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040C60C 8B5508                  mov edx, dword ptr [ebp+08]
:0040C60F 8A02                    mov al, byte ptr [edx]
:0040C611 884117                  mov byte ptr [ecx+17], al
:0040C614 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040C617 83C101                  add ecx, 00000001
:0040C61A 894D08                  mov dword ptr [ebp+08], ecx
:0040C61D 8B55F0                  mov edx, dword ptr [ebp-10]
:0040C620 8B4508                  mov eax, dword ptr [ebp+08]
:0040C623 8A08                    mov cl, byte ptr [eax]
:0040C625 884A18                  mov byte ptr [edx+18], cl
:0040C628 8B5508                  mov edx, dword ptr [ebp+08]
:0040C62B 83C201                  add edx, 00000001
:0040C62E 895508                  mov dword ptr [ebp+08], edx
:0040C631 8B4508                  mov eax, dword ptr [ebp+08]
:0040C634 8BE5                    mov esp, ebp
:0040C636 5D                      pop ebp
:0040C637 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0040C96B   , :00467A2E   
|
:0040C63A 55                      push ebp
:0040C63B 8BEC                    mov ebp, esp
:0040C63D 51                      push ecx
:0040C63E 894DFC                  mov dword ptr [ebp-04], ecx
:0040C641 8B45FC                  mov eax, dword ptr [ebp-04]
:0040C644 33C9                    xor ecx, ecx
:0040C646 8A4811                  mov cl, byte ptr [eax+11]
:0040C649 83F912                  cmp ecx, 00000012
:0040C64C 7D0F                    jge 0040C65D
:0040C64E 8B55FC                  mov edx, dword ptr [ebp-04]
:0040C651 33C0                    xor eax, eax
:0040C653 8A4211                  mov al, byte ptr [edx+11]
:0040C656 99                      cdq
:0040C657 2BC2                    sub eax, edx
:0040C659 D1F8                    sar eax, 1
:0040C65B EB13                    jmp 0040C670

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C64C(C)
|
:0040C65D 8B45FC                  mov eax, dword ptr [ebp-04]
:0040C660 33C9                    xor ecx, ecx
:0040C662 8A4811                  mov cl, byte ptr [eax+11]
:0040C665 83F93F                  cmp ecx, 0000003F
:0040C668 7D04                    jge 0040C66E
:0040C66A B009                    mov al, 09
:0040C66C EB02                    jmp 0040C670

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C668(C)
|
:0040C66E B00A                    mov al, 0A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040C65B(U), :0040C66C(U)
|
:0040C670 8BE5                    mov esp, ebp
:0040C672 5D                      pop ebp
:0040C673 C3                      ret



* Referenced by a CALL at Addresses:
|:00407CA0   , :00408894   , :004088E8   , :00461E71   , :0046205F   
|:00462093   , :004620C7   , :00462143   , :00467352   , :004673AA   
|
:0040C674 55                      push ebp
:0040C675 8BEC                    mov ebp, esp
:0040C677 83EC10                  sub esp, 00000010
:0040C67A 894DF0                  mov dword ptr [ebp-10], ecx
:0040C67D 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040C680 E8EB160100              call 0041DD70
:0040C685 8845FC                  mov byte ptr [ebp-04], al
:0040C688 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040C68B E860170100              call 0041DDF0
:0040C690 8845F4                  mov byte ptr [ebp-0C], al
:0040C693 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040C696 E8B1000000              call 0040C74C
:0040C69B 85C0                    test eax, eax
:0040C69D 7505                    jne 0040C6A4
:0040C69F 8A45FC                  mov al, byte ptr [ebp-04]
:0040C6A2 EB40                    jmp 0040C6E4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C69D(C)
|
:0040C6A4 C745F800000000          mov [ebp-08], 00000000
:0040C6AB EB09                    jmp 0040C6B6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C6DF(U)
|
:0040C6AD 8B45F8                  mov eax, dword ptr [ebp-08]
:0040C6B0 83C001                  add eax, 00000001
:0040C6B3 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C6AB(U)
|
:0040C6B6 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040C6B9 81E1FF000000            and ecx, 000000FF
:0040C6BF 83E901                  sub ecx, 00000001
:0040C6C2 394DF8                  cmp dword ptr [ebp-08], ecx
:0040C6C5 7D1A                    jge 0040C6E1
:0040C6C7 68FF000000              push 000000FF
:0040C6CC 8A55F4                  mov dl, byte ptr [ebp-0C]
:0040C6CF 52                      push edx
:0040C6D0 8A45FC                  mov al, byte ptr [ebp-04]
:0040C6D3 50                      push eax
:0040C6D4 E8DC330700              call 0047FAB5
:0040C6D9 83C40C                  add esp, 0000000C
:0040C6DC 8845FC                  mov byte ptr [ebp-04], al
:0040C6DF EBCC                    jmp 0040C6AD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C6C5(C)
|
:0040C6E1 8A45FC                  mov al, byte ptr [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C6A2(U)
|
:0040C6E4 8BE5                    mov esp, ebp
:0040C6E6 5D                      pop ebp
:0040C6E7 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0040793C   , :00407964   , :00407E41   , :0040C734   , :0040C756   
|:004145DE   , :0041464D   , :00414674   , :00434EE7   , :00459C42   
|:00459CC0   , :00459CF0   , :00466885   , :00466A17   , :00466C2B   
|:00467207   , :0046723A   , :00467279   , :004672AE   , :00467688   
|:00467964   , :004679B7   , :00468521   , :00468DB0   , :00468F50   
|:00468F79   , :0046B098   , :0046F050   
|
:0040C6EA 55                      push ebp
:0040C6EB 8BEC                    mov ebp, esp
:0040C6ED 51                      push ecx
:0040C6EE 894DFC                  mov dword ptr [ebp-04], ecx
:0040C6F1 8B45FC                  mov eax, dword ptr [ebp-04]
:0040C6F4 33C9                    xor ecx, ecx
:0040C6F6 8A4811                  mov cl, byte ptr [eax+11]
:0040C6F9 83F90E                  cmp ecx, 0000000E
:0040C6FC 7D04                    jge 0040C702
:0040C6FE 32C0                    xor al, al
:0040C700 EB24                    jmp 0040C726

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C6FC(C)
|
:0040C702 8B55FC                  mov edx, dword ptr [ebp-04]
:0040C705 33C0                    xor eax, eax
:0040C707 8A4211                  mov al, byte ptr [edx+11]
:0040C70A 83F812                  cmp eax, 00000012
:0040C70D 7D04                    jge 0040C713
:0040C70F B001                    mov al, 01
:0040C711 EB13                    jmp 0040C726

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C70D(C)
|
:0040C713 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040C716 33D2                    xor edx, edx
:0040C718 8A5111                  mov dl, byte ptr [ecx+11]
:0040C71B 83FA3F                  cmp edx, 0000003F
:0040C71E 7D04                    jge 0040C724
:0040C720 B002                    mov al, 02
:0040C722 EB02                    jmp 0040C726

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C71E(C)
|
:0040C724 B003                    mov al, 03

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040C700(U), :0040C711(U), :0040C722(U)
|
:0040C726 8BE5                    mov esp, ebp
:0040C728 5D                      pop ebp
:0040C729 C3                      ret



* Referenced by a CALL at Addresses:
|:0046717F   , :0046746F   , :004674BC   , :00467518   , :0046757F   
|:00467BD6   , :00467C48   
|
:0040C72A 55                      push ebp
:0040C72B 8BEC                    mov ebp, esp
:0040C72D 51                      push ecx
:0040C72E 894DFC                  mov dword ptr [ebp-04], ecx
:0040C731 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040C734 E8B1FFFFFF              call 0040C6EA
:0040C739 25FF000000              and eax, 000000FF
:0040C73E 33C9                    xor ecx, ecx
:0040C740 83F803                  cmp eax, 00000003
:0040C743 0F95C1                  setne cl
:0040C746 8BC1                    mov eax, ecx
:0040C748 8BE5                    mov esp, ebp
:0040C74A 5D                      pop ebp
:0040C74B C3                      ret



* Referenced by a CALL at Addresses:
|:0040C696   , :0040C778   , :0040C7E9   , :0040C81C   , :0040C8AC   
|:0040C92C   , :0040D574   , :004144E0   , :00416B7B   , :00461E58   
|:0046212A   , :00467332   , :00467388   
|
:0040C74C 55                      push ebp
:0040C74D 8BEC                    mov ebp, esp
:0040C74F 51                      push ecx
:0040C750 894DFC                  mov dword ptr [ebp-04], ecx
:0040C753 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040C756 E88FFFFFFF              call 0040C6EA
:0040C75B 25FF000000              and eax, 000000FF
:0040C760 33C9                    xor ecx, ecx
:0040C762 83F801                  cmp eax, 00000001
:0040C765 0F9EC1                  setle cl
:0040C768 8BC1                    mov eax, ecx
:0040C76A 8BE5                    mov esp, ebp
:0040C76C 5D                      pop ebp
:0040C76D C3                      ret



* Referenced by a CALL at Addresses:
|:00407A5E   , :00407B53   , :00407CBF   , :00407E7E   , :00407EAC   
|:00408323   , :0040D580   , :0041450A   , :0041460C   , :00416BAD   
|:00459C70   , :00461EAF   , :00461F0E   , :0046218C   , :004621CD   
|:00467603   , :0046761C   , :00467D8D   
|
:0040C76E 55                      push ebp
:0040C76F 8BEC                    mov ebp, esp
:0040C771 51                      push ecx
:0040C772 894DFC                  mov dword ptr [ebp-04], ecx
:0040C775 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040C778 E8CFFFFFFF              call 0040C74C
:0040C77D 85C0                    test eax, eax
:0040C77F 7422                    je 0040C7A3
:0040C781 8B45FC                  mov eax, dword ptr [ebp-04]
:0040C784 33C9                    xor ecx, ecx
:0040C786 8A4811                  mov cl, byte ptr [eax+11]
:0040C789 8BC1                    mov eax, ecx
:0040C78B 99                      cdq
:0040C78C 33C2                    xor eax, edx
:0040C78E 2BC2                    sub eax, edx
:0040C790 83E001                  and eax, 00000001
:0040C793 33C2                    xor eax, edx
:0040C795 2BC2                    sub eax, edx
:0040C797 83F801                  cmp eax, 00000001
:0040C79A 7507                    jne 0040C7A3
:0040C79C B801000000              mov eax, 00000001
:0040C7A1 EB02                    jmp 0040C7A5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040C77F(C), :0040C79A(C)
|
:0040C7A3 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C7A1(U)
|
:0040C7A5 8BE5                    mov esp, ebp
:0040C7A7 5D                      pop ebp
:0040C7A8 C3                      ret



* Referenced by a CALL at Addresses:
|:0040DABD   , :00467430   , :0046744E   , :00467B3E   , :00467BA7   
|:0046B06B   , :0046B454   , :0046B4A9   , :0046B774   , :0046DE5F   
|:0046E2FC   
|
:0040C7A9 55                      push ebp
:0040C7AA 8BEC                    mov ebp, esp
:0040C7AC 83EC08                  sub esp, 00000008
:0040C7AF 894DF8                  mov dword ptr [ebp-08], ecx
:0040C7B2 8B45F8                  mov eax, dword ptr [ebp-08]
:0040C7B5 33C9                    xor ecx, ecx
:0040C7B7 8A4812                  mov cl, byte ptr [eax+12]
:0040C7BA 8BC1                    mov eax, ecx
:0040C7BC 6BC064                  imul eax, 00000064
:0040C7BF 6BC003                  imul eax, 00000003
:0040C7C2 99                      cdq
:0040C7C3 83E203                  and edx, 00000003
:0040C7C6 03C2                    add eax, edx
:0040C7C8 C1F802                  sar eax, 02
:0040C7CB 8945FC                  mov dword ptr [ebp-04], eax
:0040C7CE 8B55F8                  mov edx, dword ptr [ebp-08]
:0040C7D1 33C0                    xor eax, eax
:0040C7D3 8A4212                  mov al, byte ptr [edx+12]
:0040C7D6 3DFF000000              cmp eax, 000000FF
:0040C7DB 7509                    jne 0040C7E6
:0040C7DD C745FCFFFF0000          mov [ebp-04], 0000FFFF
:0040C7E4 EB23                    jmp 0040C809

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C7DB(C)
|
:0040C7E6 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040C7E9 E85EFFFFFF              call 0040C74C
:0040C7EE 85C0                    test eax, eax
:0040C7F0 7417                    je 0040C809
:0040C7F2 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040C7F5 81E1FF000000            and ecx, 000000FF
:0040C7FB 83C101                  add ecx, 00000001
:0040C7FE 8B55FC                  mov edx, dword ptr [ebp-04]
:0040C801 0FAFD1                  imul edx, ecx
:0040C804 D1EA                    shr edx, 1
:0040C806 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040C7E4(U), :0040C7F0(C)
|
:0040C809 8B45FC                  mov eax, dword ptr [ebp-04]
:0040C80C 8BE5                    mov esp, ebp
:0040C80E 5D                      pop ebp
:0040C80F C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00461F6D   , :00461FA7   , :00461FDD   , :00462216   , :00467A64   
|
:0040C812 55                      push ebp
:0040C813 8BEC                    mov ebp, esp
:0040C815 51                      push ecx
:0040C816 894DFC                  mov dword ptr [ebp-04], ecx
:0040C819 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040C81C E82BFFFFFF              call 0040C74C
:0040C821 85C0                    test eax, eax
:0040C823 740F                    je 0040C834
:0040C825 8B45FC                  mov eax, dword ptr [ebp-04]
:0040C828 33C9                    xor ecx, ecx
:0040C82A 8A4814                  mov cl, byte ptr [eax+14]
:0040C82D 8BC1                    mov eax, ecx
:0040C82F 83E812                  sub eax, 00000012
:0040C832 EB0B                    jmp 0040C83F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C823(C)
|
:0040C834 8B55FC                  mov edx, dword ptr [ebp-04]
:0040C837 33C0                    xor eax, eax
:0040C839 8A4211                  mov al, byte ptr [edx+11]
:0040C83C 83E812                  sub eax, 00000012

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C832(U)
|
:0040C83F 8BE5                    mov esp, ebp
:0040C841 5D                      pop ebp
:0040C842 C3                      ret



* Referenced by a CALL at Address:
|:00470183   
|
:0040C843 55                      push ebp
:0040C844 8BEC                    mov ebp, esp
:0040C846 81ECE0000000            sub esp, 000000E0
:0040C84C 56                      push esi
:0040C84D 898D24FFFFFF            mov dword ptr [ebp+FFFFFF24], ecx
:0040C853 8B450C                  mov eax, dword ptr [ebp+0C]
:0040C856 50                      push eax
:0040C857 8D8D30FFFFFF            lea ecx, dword ptr [ebp+FFFFFF30]
:0040C85D 51                      push ecx
:0040C85E E8F3F6FFFF              call 0040BF56
:0040C863 83C408                  add esp, 00000008
:0040C866 8D9530FFFFFF            lea edx, dword ptr [ebp+FFFFFF30]
:0040C86C 52                      push edx
:0040C86D 682E040000              push 0000042E
:0040C872 8B4508                  mov eax, dword ptr [ebp+08]
:0040C875 50                      push eax
:0040C876 FF15D8624800            call dword ptr [004862D8]
:0040C87C 68282E4900              push 00492E28
:0040C881 68F9030000              push 000003F9
:0040C886 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040C889 51                      push ecx
:0040C88A FF15D8624800            call dword ptr [004862D8]
:0040C890 8B9524FFFFFF            mov edx, dword ptr [ebp+FFFFFF24]
:0040C896 52                      push edx

* Possible Reference to Dialog: DialogID_011C, CONTROL_ID:03F8, "Attribute"
                                  |
:0040C897 68F8030000              push 000003F8
:0040C89C 8B4508                  mov eax, dword ptr [ebp+08]
:0040C89F 50                      push eax
:0040C8A0 FF15D8624800            call dword ptr [004862D8]
:0040C8A6 8B8D24FFFFFF            mov ecx, dword ptr [ebp+FFFFFF24]
:0040C8AC E89BFEFFFF              call 0040C74C
:0040C8B1 85C0                    test eax, eax
:0040C8B3 7445                    je 0040C8FA
:0040C8B5 8B4D10                  mov ecx, dword ptr [ebp+10]
:0040C8B8 81E1FF000000            and ecx, 000000FF
:0040C8BE 81F9FF000000            cmp ecx, 000000FF
:0040C8C4 7434                    je 0040C8FA
:0040C8C6 6A05                    push 00000005
:0040C8C8 68AB050000              push 000005AB
:0040C8CD 8B5508                  mov edx, dword ptr [ebp+08]
:0040C8D0 52                      push edx
:0040C8D1 FF15DC624800            call dword ptr [004862DC]
:0040C8D7 50                      push eax
:0040C8D8 FF15E0624800            call dword ptr [004862E0]
:0040C8DE 6A00                    push 00000000
:0040C8E0 8B4510                  mov eax, dword ptr [ebp+10]
:0040C8E3 25FF000000              and eax, 000000FF
:0040C8E8 50                      push eax
:0040C8E9 68AC050000              push 000005AC
:0040C8EE 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040C8F1 51                      push ecx
:0040C8F2 FF15E4624800            call dword ptr [004862E4]
:0040C8F8 EB2C                    jmp 0040C926

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040C8B3(C), :0040C8C4(C)
|
:0040C8FA 6A00                    push 00000000
:0040C8FC 68AB050000              push 000005AB
:0040C901 8B5508                  mov edx, dword ptr [ebp+08]
:0040C904 52                      push edx
:0040C905 FF15DC624800            call dword ptr [004862DC]
:0040C90B 50                      push eax
:0040C90C FF15E0624800            call dword ptr [004862E0]
:0040C912 682C2E4900              push 00492E2C
:0040C917 68AC050000              push 000005AC
:0040C91C 8B4508                  mov eax, dword ptr [ebp+08]
:0040C91F 50                      push eax
:0040C920 FF15D8624800            call dword ptr [004862D8]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C8F8(U)
|
:0040C926 8B8D24FFFFFF            mov ecx, dword ptr [ebp+FFFFFF24]
:0040C92C E81BFEFFFF              call 0040C74C
:0040C931 85C0                    test eax, eax
:0040C933 7530                    jne 0040C965
:0040C935 6A00                    push 00000000
:0040C937 6865050000              push 00000565
:0040C93C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040C93F 51                      push ecx
:0040C940 FF15DC624800            call dword ptr [004862DC]
:0040C946 50                      push eax
:0040C947 FF15E0624800            call dword ptr [004862E0]
:0040C94D 6A00                    push 00000000
:0040C94F 68AD050000              push 000005AD
:0040C954 8B5508                  mov edx, dword ptr [ebp+08]
:0040C957 52                      push edx
:0040C958 FF15DC624800            call dword ptr [004862DC]
:0040C95E 50                      push eax
:0040C95F FF15E0624800            call dword ptr [004862E0]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C933(C)
|
:0040C965 8B8D24FFFFFF            mov ecx, dword ptr [ebp+FFFFFF24]
:0040C96B E8CAFCFFFF              call 0040C63A
:0040C970 25FF000000              and eax, 000000FF
:0040C975 8B048520BC4800          mov eax, dword ptr [4*eax+0048BC20]
:0040C97C 50                      push eax
:0040C97D 68FF030000              push 000003FF
:0040C982 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040C985 51                      push ecx
:0040C986 FF15D8624800            call dword ptr [004862D8]
:0040C98C 8B9524FFFFFF            mov edx, dword ptr [ebp+FFFFFF24]
:0040C992 33C0                    xor eax, eax
:0040C994 8A4212                  mov al, byte ptr [edx+12]
:0040C997 3DFF000000              cmp eax, 000000FF
:0040C99C 7516                    jne 0040C9B4

* Possible StringData Ref from Data Obj ->"---"
                                  |
:0040C99E 6884B24800              push 0048B284

* Possible Reference to Dialog: DialogID_011A, CONTROL_ID:03FA, ""
                                  |
:0040C9A3 68FA030000              push 000003FA
:0040C9A8 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040C9AB 51                      push ecx
:0040C9AC FF15D8624800            call dword ptr [004862D8]
:0040C9B2 EB1D                    jmp 0040C9D1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C99C(C)
|
:0040C9B4 6A00                    push 00000000
:0040C9B6 8B8D24FFFFFF            mov ecx, dword ptr [ebp+FFFFFF24]
:0040C9BC E8AF160000              call 0040E070
:0040C9C1 50                      push eax

* Possible Reference to Dialog: DialogID_011A, CONTROL_ID:03FA, ""
                                  |
:0040C9C2 68FA030000              push 000003FA
:0040C9C7 8B5508                  mov edx, dword ptr [ebp+08]
:0040C9CA 52                      push edx
:0040C9CB FF15E4624800            call dword ptr [004862E4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C9B2(U)
|
:0040C9D1 8A4510                  mov al, byte ptr [ebp+10]
:0040C9D4 50                      push eax
:0040C9D5 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0040C9D8 51                      push ecx
:0040C9D9 8D9530FFFFFF            lea edx, dword ptr [ebp+FFFFFF30]
:0040C9DF 52                      push edx
:0040C9E0 E820560500              call 00462005
:0040C9E5 83C40C                  add esp, 0000000C
:0040C9E8 8D8530FFFFFF            lea eax, dword ptr [ebp+FFFFFF30]
:0040C9EE 50                      push eax
:0040C9EF 6801040000              push 00000401
:0040C9F4 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040C9F7 51                      push ecx
:0040C9F8 FF15D8624800            call dword ptr [004862D8]
:0040C9FE 8B550C                  mov edx, dword ptr [ebp+0C]
:0040CA01 52                      push edx
:0040CA02 8D8530FFFFFF            lea eax, dword ptr [ebp+FFFFFF30]
:0040CA08 50                      push eax
:0040CA09 E866570500              call 00462174
:0040CA0E 83C408                  add esp, 00000008
:0040CA11 8D8D30FFFFFF            lea ecx, dword ptr [ebp+FFFFFF30]
:0040CA17 51                      push ecx

* Possible Reference to Dialog: DialogID_014E, CONTROL_ID:05AF, ""
                                  |
:0040CA18 68AF050000              push 000005AF
:0040CA1D 8B5508                  mov edx, dword ptr [ebp+08]
:0040CA20 52                      push edx
:0040CA21 FF15D8624800            call dword ptr [004862D8]
:0040CA27 C68528FFFFFFFF          mov byte ptr [ebp+FFFFFF28], FF
:0040CA2E 8B8D24FFFFFF            mov ecx, dword ptr [ebp+FFFFFF24]
:0040CA34 E8B7130100              call 0041DDF0
:0040CA39 8845FC                  mov byte ptr [ebp-04], al
:0040CA3C C7852CFFFFFF00000000    mov dword ptr [ebp+FFFFFF2C], 00000000
:0040CA46 EB0F                    jmp 0040CA57

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CB75(U)
|
:0040CA48 8B852CFFFFFF            mov eax, dword ptr [ebp+FFFFFF2C]
:0040CA4E 83C001                  add eax, 00000001
:0040CA51 89852CFFFFFF            mov dword ptr [ebp+FFFFFF2C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CA46(U)
|
:0040CA57 83BD2CFFFFFF26          cmp dword ptr [ebp+FFFFFF2C], 00000026
:0040CA5E 0F8D16010000            jnl 0040CB7A
:0040CA64 8BB528FFFFFF            mov esi, dword ptr [ebp+FFFFFF28]
:0040CA6A 81E6FF000000            and esi, 000000FF
:0040CA70 8A8D2CFFFFFF            mov cl, byte ptr [ebp+FFFFFF2C]
:0040CA76 51                      push ecx
:0040CA77 E88A9EFFFF              call 00406906
:0040CA7C 83C404                  add esp, 00000004
:0040CA7F 25FF000000              and eax, 000000FF
:0040CA84 3BF0                    cmp esi, eax
:0040CA86 0F84E9000000            je 0040CB75
:0040CA8C 8A952CFFFFFF            mov dl, byte ptr [ebp+FFFFFF2C]
:0040CA92 52                      push edx
:0040CA93 E86E9EFFFF              call 00406906
:0040CA98 83C404                  add esp, 00000004
:0040CA9B 888528FFFFFF            mov byte ptr [ebp+FFFFFF28], al
:0040CAA1 8B8524FFFFFF            mov eax, dword ptr [ebp+FFFFFF24]
:0040CAA7 33C9                    xor ecx, ecx
:0040CAA9 8A4811                  mov cl, byte ptr [eax+11]
:0040CAAC 83F912                  cmp ecx, 00000012
:0040CAAF 7D4C                    jge 0040CAFD
:0040CAB1 8B9524FFFFFF            mov edx, dword ptr [ebp+FFFFFF24]
:0040CAB7 33C0                    xor eax, eax
:0040CAB9 8A4211                  mov al, byte ptr [edx+11]
:0040CABC 50                      push eax
:0040CABD 8B8D2CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF2C]
:0040CAC3 6BC91B                  imul ecx, 0000001B
:0040CAC6 81C1A0BF4A00            add ecx, 004ABFA0
:0040CACC E8EFCAFFFF              call 004095C0
:0040CAD1 25FF000000              and eax, 000000FF
:0040CAD6 50                      push eax
:0040CAD7 8B8D28FFFFFF            mov ecx, dword ptr [ebp+FFFFFF28]
:0040CADD 81E1FF000000            and ecx, 000000FF
:0040CAE3 81C1C0050000            add ecx, 000005C0
:0040CAE9 51                      push ecx
:0040CAEA 8B5508                  mov edx, dword ptr [ebp+08]
:0040CAED 52                      push edx
:0040CAEE FF15DC624800            call dword ptr [004862DC]
:0040CAF4 50                      push eax
:0040CAF5 FF15E8624800            call dword ptr [004862E8]
:0040CAFB EB78                    jmp 0040CB75

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CAAF(C)
|
:0040CAFD 8B8524FFFFFF            mov eax, dword ptr [ebp+FFFFFF24]
:0040CB03 33C9                    xor ecx, ecx
:0040CB05 8A4811                  mov cl, byte ptr [eax+11]
:0040CB08 83F93F                  cmp ecx, 0000003F
:0040CB0B 7D68                    jge 0040CB75
:0040CB0D 8B55FC                  mov edx, dword ptr [ebp-04]
:0040CB10 81E2FF000000            and edx, 000000FF
:0040CB16 8B8528FFFFFF            mov eax, dword ptr [ebp+FFFFFF28]
:0040CB1C 25FF000000              and eax, 000000FF
:0040CB21 3BD0                    cmp edx, eax
:0040CB23 741D                    je 0040CB42
:0040CB25 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040CB28 81E1FF000000            and ecx, 000000FF
:0040CB2E 81F9FF000000            cmp ecx, 000000FF
:0040CB34 740C                    je 0040CB42
:0040CB36 C78520FFFFFF00000000    mov dword ptr [ebp+FFFFFF20], 00000000
:0040CB40 EB0A                    jmp 0040CB4C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040CB23(C), :0040CB34(C)
|
:0040CB42 C78520FFFFFF01000000    mov dword ptr [ebp+FFFFFF20], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CB40(U)
|
:0040CB4C 8B9520FFFFFF            mov edx, dword ptr [ebp+FFFFFF20]
:0040CB52 52                      push edx
:0040CB53 8B8528FFFFFF            mov eax, dword ptr [ebp+FFFFFF28]
:0040CB59 25FF000000              and eax, 000000FF
:0040CB5E 05C0050000              add eax, 000005C0
:0040CB63 50                      push eax
:0040CB64 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040CB67 51                      push ecx
:0040CB68 FF15DC624800            call dword ptr [004862DC]
:0040CB6E 50                      push eax
:0040CB6F FF15E8624800            call dword ptr [004862E8]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040CA86(C), :0040CAFB(U), :0040CB0B(C)
|
:0040CB75 E9CEFEFFFF              jmp 0040CA48

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CA5E(C)
|
:0040CB7A 5E                      pop esi
:0040CB7B 8BE5                    mov esp, ebp
:0040CB7D 5D                      pop ebp
:0040CB7E C21000                  ret 0010



* Referenced by a CALL at Address:
|:0041BFA5   
|
:0040CB81 55                      push ebp
:0040CB82 8BEC                    mov ebp, esp
:0040CB84 83EC08                  sub esp, 00000008
:0040CB87 894DF8                  mov dword ptr [ebp-08], ecx
:0040CB8A 8B45F8                  mov eax, dword ptr [ebp-08]
:0040CB8D C7400C00000000          mov [eax+0C], 00000000
:0040CB94 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040CB97 C6410801                mov [ecx+08], 01
:0040CB9B 8B55F8                  mov edx, dword ptr [ebp-08]
:0040CB9E C6421001                mov [edx+10], 01
:0040CBA2 8B45F8                  mov eax, dword ptr [ebp-08]
:0040CBA5 66C70000F8              mov word ptr [eax], F800
:0040CBAA 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040CBAD 66C741020100            mov [ecx+02], 0001
:0040CBB3 8B55F8                  mov edx, dword ptr [ebp-08]
:0040CBB6 C64204FF                mov [edx+04], FF
:0040CBBA 8B45F8                  mov eax, dword ptr [ebp-08]
:0040CBBD C6400600                mov [eax+06], 00
:0040CBC1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040CBC4 C6410500                mov [ecx+05], 00
:0040CBC8 8B55F8                  mov edx, dword ptr [ebp-08]
:0040CBCB C6420700                mov [edx+07], 00
:0040CBCF 8B45F8                  mov eax, dword ptr [ebp-08]
:0040CBD2 C6401200                mov [eax+12], 00
:0040CBD6 C745FC00000000          mov [ebp-04], 00000000
:0040CBDD EB09                    jmp 0040CBE8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CBFD(U)
|
:0040CBDF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040CBE2 83C101                  add ecx, 00000001
:0040CBE5 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CBDD(U)
|
:0040CBE8 817DFCC8000000          cmp dword ptr [ebp-04], 000000C8
:0040CBEF 730E                    jnb 0040CBFF
:0040CBF1 8A55FC                  mov dl, byte ptr [ebp-04]
:0040CBF4 52                      push edx
:0040CBF5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040CBF8 E8F6080000              call 0040D4F3
:0040CBFD EBE0                    jmp 0040CBDF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CBEF(C)
|
:0040CBFF C745FC00000000          mov [ebp-04], 00000000
:0040CC06 EB09                    jmp 0040CC11

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CC24(U)
|
:0040CC08 8B45FC                  mov eax, dword ptr [ebp-04]
:0040CC0B 83C001                  add eax, 00000001
:0040CC0E 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CC06(U)
|
:0040CC11 837DFC11                cmp dword ptr [ebp-04], 00000011
:0040CC15 730F                    jnb 0040CC26
:0040CC17 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040CC1A 034DFC                  add ecx, dword ptr [ebp-04]
:0040CC1D C6816B02000000          mov byte ptr [ecx+0000026B], 00
:0040CC24 EBE2                    jmp 0040CC08

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CC15(C)
|
:0040CC26 8B55F8                  mov edx, dword ptr [ebp-08]
:0040CC29 C6827C02000001          mov byte ptr [edx+0000027C], 01
:0040CC30 6A14                    push 00000014
:0040CC32 68FFFF0000              push 0000FFFF
:0040CC37 8B45F8                  mov eax, dword ptr [ebp-08]
:0040CC3A 0580020000              add eax, 00000280
:0040CC3F 50                      push eax
:0040CC40 E8EB3E0700              call 00480B30
:0040CC45 83C40C                  add esp, 0000000C
:0040CC48 6A14                    push 00000014
:0040CC4A 68FFFF0000              push 0000FFFF
:0040CC4F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040CC52 81C194020000            add ecx, 00000294
:0040CC58 51                      push ecx
:0040CC59 E8D23E0700              call 00480B30
:0040CC5E 83C40C                  add esp, 0000000C
:0040CC61 8BE5                    mov esp, ebp
:0040CC63 5D                      pop ebp
:0040CC64 C3                      ret



* Referenced by a CALL at Address:
|:0041AF37   
|
:0040CC65 55                      push ebp
:0040CC66 8BEC                    mov ebp, esp
:0040CC68 83EC0C                  sub esp, 0000000C
:0040CC6B 894DF4                  mov dword ptr [ebp-0C], ecx
:0040CC6E 8B4508                  mov eax, dword ptr [ebp+08]
:0040CC71 33C9                    xor ecx, ecx
:0040CC73 8A08                    mov cl, byte ptr [eax]
:0040CC75 8B55F4                  mov edx, dword ptr [ebp-0C]
:0040CC78 894A0C                  mov dword ptr [edx+0C], ecx
:0040CC7B 8B4508                  mov eax, dword ptr [ebp+08]
:0040CC7E 83C001                  add eax, 00000001
:0040CC81 894508                  mov dword ptr [ebp+08], eax
:0040CC84 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040CC87 33D2                    xor edx, edx
:0040CC89 8A11                    mov dl, byte ptr [ecx]
:0040CC8B C1E208                  shl edx, 08
:0040CC8E 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040CC91 8B480C                  mov ecx, dword ptr [eax+0C]
:0040CC94 03CA                    add ecx, edx
:0040CC96 8B55F4                  mov edx, dword ptr [ebp-0C]
:0040CC99 894A0C                  mov dword ptr [edx+0C], ecx
:0040CC9C 8B4508                  mov eax, dword ptr [ebp+08]
:0040CC9F 83C001                  add eax, 00000001
:0040CCA2 894508                  mov dword ptr [ebp+08], eax
:0040CCA5 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040CCA8 33D2                    xor edx, edx
:0040CCAA 8A11                    mov dl, byte ptr [ecx]
:0040CCAC C1E210                  shl edx, 10
:0040CCAF 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040CCB2 8B480C                  mov ecx, dword ptr [eax+0C]
:0040CCB5 03CA                    add ecx, edx
:0040CCB7 8B55F4                  mov edx, dword ptr [ebp-0C]
:0040CCBA 894A0C                  mov dword ptr [edx+0C], ecx
:0040CCBD 8B4508                  mov eax, dword ptr [ebp+08]
:0040CCC0 83C001                  add eax, 00000001
:0040CCC3 894508                  mov dword ptr [ebp+08], eax
:0040CCC6 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040CCC9 33D2                    xor edx, edx
:0040CCCB 8A11                    mov dl, byte ptr [ecx]
:0040CCCD C1E218                  shl edx, 18
:0040CCD0 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040CCD3 8B480C                  mov ecx, dword ptr [eax+0C]
:0040CCD6 03CA                    add ecx, edx
:0040CCD8 8B55F4                  mov edx, dword ptr [ebp-0C]
:0040CCDB 894A0C                  mov dword ptr [edx+0C], ecx
:0040CCDE 8B4508                  mov eax, dword ptr [ebp+08]
:0040CCE1 83C001                  add eax, 00000001
:0040CCE4 894508                  mov dword ptr [ebp+08], eax
:0040CCE7 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040CCEA 8B5508                  mov edx, dword ptr [ebp+08]
:0040CCED 8A02                    mov al, byte ptr [edx]
:0040CCEF 884105                  mov byte ptr [ecx+05], al
:0040CCF2 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040CCF5 83C101                  add ecx, 00000001
:0040CCF8 894D08                  mov dword ptr [ebp+08], ecx
:0040CCFB 8B5508                  mov edx, dword ptr [ebp+08]
:0040CCFE 33C0                    xor eax, eax
:0040CD00 8A02                    mov al, byte ptr [edx]
:0040CD02 8945FC                  mov dword ptr [ebp-04], eax
:0040CD05 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040CD08 83C101                  add ecx, 00000001
:0040CD0B 894D08                  mov dword ptr [ebp+08], ecx
:0040CD0E 8B5508                  mov edx, dword ptr [ebp+08]
:0040CD11 33C0                    xor eax, eax
:0040CD13 8A02                    mov al, byte ptr [edx]
:0040CD15 C1E008                  shl eax, 08
:0040CD18 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040CD1B 03C8                    add ecx, eax
:0040CD1D 894DFC                  mov dword ptr [ebp-04], ecx
:0040CD20 8B5508                  mov edx, dword ptr [ebp+08]
:0040CD23 83C201                  add edx, 00000001
:0040CD26 895508                  mov dword ptr [ebp+08], edx
:0040CD29 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040CD2C 668B4DFC                mov cx, word ptr [ebp-04]
:0040CD30 668908                  mov word ptr [eax], cx
:0040CD33 8B5508                  mov edx, dword ptr [ebp+08]
:0040CD36 33C0                    xor eax, eax
:0040CD38 8A02                    mov al, byte ptr [edx]
:0040CD3A 8945FC                  mov dword ptr [ebp-04], eax
:0040CD3D 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040CD40 83C101                  add ecx, 00000001
:0040CD43 894D08                  mov dword ptr [ebp+08], ecx
:0040CD46 8B5508                  mov edx, dword ptr [ebp+08]
:0040CD49 33C0                    xor eax, eax
:0040CD4B 8A02                    mov al, byte ptr [edx]
:0040CD4D C1E008                  shl eax, 08
:0040CD50 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040CD53 03C8                    add ecx, eax
:0040CD55 894DFC                  mov dword ptr [ebp-04], ecx
:0040CD58 8B5508                  mov edx, dword ptr [ebp+08]
:0040CD5B 83C201                  add edx, 00000001
:0040CD5E 895508                  mov dword ptr [ebp+08], edx
:0040CD61 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040CD64 668B4DFC                mov cx, word ptr [ebp-04]
:0040CD68 66894802                mov word ptr [eax+02], cx
:0040CD6C 8B55F4                  mov edx, dword ptr [ebp-0C]
:0040CD6F 8B4508                  mov eax, dword ptr [ebp+08]
:0040CD72 8A08                    mov cl, byte ptr [eax]
:0040CD74 884A04                  mov byte ptr [edx+04], cl
:0040CD77 8B5508                  mov edx, dword ptr [ebp+08]
:0040CD7A 83C201                  add edx, 00000001
:0040CD7D 895508                  mov dword ptr [ebp+08], edx
:0040CD80 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040CD83 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040CD86 8A11                    mov dl, byte ptr [ecx]
:0040CD88 885011                  mov byte ptr [eax+11], dl
:0040CD8B 8B4508                  mov eax, dword ptr [ebp+08]
:0040CD8E 83C001                  add eax, 00000001
:0040CD91 894508                  mov dword ptr [ebp+08], eax
:0040CD94 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040CD97 8B5508                  mov edx, dword ptr [ebp+08]
:0040CD9A 8A02                    mov al, byte ptr [edx]
:0040CD9C 884106                  mov byte ptr [ecx+06], al
:0040CD9F 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040CDA2 83C101                  add ecx, 00000001
:0040CDA5 894D08                  mov dword ptr [ebp+08], ecx
:0040CDA8 8B55F4                  mov edx, dword ptr [ebp-0C]
:0040CDAB 8B4508                  mov eax, dword ptr [ebp+08]
:0040CDAE 8A08                    mov cl, byte ptr [eax]
:0040CDB0 884A07                  mov byte ptr [edx+07], cl
:0040CDB3 8B5508                  mov edx, dword ptr [ebp+08]
:0040CDB6 83C201                  add edx, 00000001
:0040CDB9 895508                  mov dword ptr [ebp+08], edx
:0040CDBC 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040CDBF 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040CDC2 8A11                    mov dl, byte ptr [ecx]
:0040CDC4 885008                  mov byte ptr [eax+08], dl
:0040CDC7 8B4508                  mov eax, dword ptr [ebp+08]
:0040CDCA 83C001                  add eax, 00000001
:0040CDCD 894508                  mov dword ptr [ebp+08], eax
:0040CDD0 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040CDD3 8B5508                  mov edx, dword ptr [ebp+08]
:0040CDD6 8A02                    mov al, byte ptr [edx]
:0040CDD8 884110                  mov byte ptr [ecx+10], al
:0040CDDB 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040CDDE 83C101                  add ecx, 00000001
:0040CDE1 894D08                  mov dword ptr [ebp+08], ecx
:0040CDE4 8B55F4                  mov edx, dword ptr [ebp-0C]
:0040CDE7 8B4508                  mov eax, dword ptr [ebp+08]
:0040CDEA 8A08                    mov cl, byte ptr [eax]
:0040CDEC 888A7C020000            mov byte ptr [edx+0000027C], cl
:0040CDF2 8B5508                  mov edx, dword ptr [ebp+08]
:0040CDF5 83C201                  add edx, 00000001
:0040CDF8 895508                  mov dword ptr [ebp+08], edx
:0040CDFB C745F800000000          mov [ebp-08], 00000000
:0040CE02 EB09                    jmp 0040CE0D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CE51(U)
|
:0040CE04 8B45F8                  mov eax, dword ptr [ebp-08]
:0040CE07 83C001                  add eax, 00000001
:0040CE0A 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CE02(U)
|
:0040CE0D 837DF805                cmp dword ptr [ebp-08], 00000005
:0040CE11 7340                    jnb 0040CE53
:0040CE13 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040CE16 33D2                    xor edx, edx
:0040CE18 8A11                    mov dl, byte ptr [ecx]
:0040CE1A 8955FC                  mov dword ptr [ebp-04], edx
:0040CE1D 8B4508                  mov eax, dword ptr [ebp+08]
:0040CE20 83C001                  add eax, 00000001
:0040CE23 894508                  mov dword ptr [ebp+08], eax
:0040CE26 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040CE29 33D2                    xor edx, edx
:0040CE2B 8A11                    mov dl, byte ptr [ecx]
:0040CE2D C1E208                  shl edx, 08
:0040CE30 8B45FC                  mov eax, dword ptr [ebp-04]
:0040CE33 03C2                    add eax, edx
:0040CE35 8945FC                  mov dword ptr [ebp-04], eax
:0040CE38 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040CE3B 83C101                  add ecx, 00000001
:0040CE3E 894D08                  mov dword ptr [ebp+08], ecx
:0040CE41 8B55F8                  mov edx, dword ptr [ebp-08]
:0040CE44 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040CE47 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040CE4A 898C9080020000          mov dword ptr [eax+4*edx+00000280], ecx
:0040CE51 EBB1                    jmp 0040CE04

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CE11(C)
|
:0040CE53 C745F800000000          mov [ebp-08], 00000000
:0040CE5A EB09                    jmp 0040CE65

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CEA9(U)
|
:0040CE5C 8B55F8                  mov edx, dword ptr [ebp-08]
:0040CE5F 83C201                  add edx, 00000001
:0040CE62 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CE5A(U)
|
:0040CE65 837DF805                cmp dword ptr [ebp-08], 00000005
:0040CE69 7340                    jnb 0040CEAB
:0040CE6B 8B4508                  mov eax, dword ptr [ebp+08]
:0040CE6E 33C9                    xor ecx, ecx
:0040CE70 8A08                    mov cl, byte ptr [eax]
:0040CE72 894DFC                  mov dword ptr [ebp-04], ecx
:0040CE75 8B5508                  mov edx, dword ptr [ebp+08]
:0040CE78 83C201                  add edx, 00000001
:0040CE7B 895508                  mov dword ptr [ebp+08], edx
:0040CE7E 8B4508                  mov eax, dword ptr [ebp+08]
:0040CE81 33C9                    xor ecx, ecx
:0040CE83 8A08                    mov cl, byte ptr [eax]
:0040CE85 C1E108                  shl ecx, 08
:0040CE88 8B55FC                  mov edx, dword ptr [ebp-04]
:0040CE8B 03D1                    add edx, ecx
:0040CE8D 8955FC                  mov dword ptr [ebp-04], edx
:0040CE90 8B4508                  mov eax, dword ptr [ebp+08]
:0040CE93 83C001                  add eax, 00000001
:0040CE96 894508                  mov dword ptr [ebp+08], eax
:0040CE99 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040CE9C 8B55F4                  mov edx, dword ptr [ebp-0C]
:0040CE9F 8B45FC                  mov eax, dword ptr [ebp-04]
:0040CEA2 89848A94020000          mov dword ptr [edx+4*ecx+00000294], eax
:0040CEA9 EBB1                    jmp 0040CE5C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CE69(C)
|
:0040CEAB 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040CEAE 8B5508                  mov edx, dword ptr [ebp+08]
:0040CEB1 8A02                    mov al, byte ptr [edx]
:0040CEB3 884112                  mov byte ptr [ecx+12], al
:0040CEB6 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040CEB9 83C101                  add ecx, 00000001
:0040CEBC 894D08                  mov dword ptr [ebp+08], ecx
:0040CEBF C745F800000000          mov [ebp-08], 00000000
:0040CEC6 EB09                    jmp 0040CED1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CF2B(U)
|
:0040CEC8 8B55F8                  mov edx, dword ptr [ebp-08]
:0040CECB 83C201                  add edx, 00000001
:0040CECE 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CEC6(U)
|
:0040CED1 817DF8C8000000          cmp dword ptr [ebp-08], 000000C8
:0040CED8 7353                    jnb 0040CF2D
:0040CEDA 8B45F8                  mov eax, dword ptr [ebp-08]
:0040CEDD 6BC003                  imul eax, 00000003
:0040CEE0 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040CEE3 8B5508                  mov edx, dword ptr [ebp+08]
:0040CEE6 8A12                    mov dl, byte ptr [edx]
:0040CEE8 88540113                mov byte ptr [ecx+eax+13], dl
:0040CEEC 8B4508                  mov eax, dword ptr [ebp+08]
:0040CEEF 83C001                  add eax, 00000001
:0040CEF2 894508                  mov dword ptr [ebp+08], eax
:0040CEF5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040CEF8 6BC903                  imul ecx, 00000003
:0040CEFB 8B55F4                  mov edx, dword ptr [ebp-0C]
:0040CEFE 8B4508                  mov eax, dword ptr [ebp+08]
:0040CF01 8A00                    mov al, byte ptr [eax]
:0040CF03 88440A14                mov byte ptr [edx+ecx+14], al
:0040CF07 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040CF0A 83C101                  add ecx, 00000001
:0040CF0D 894D08                  mov dword ptr [ebp+08], ecx
:0040CF10 8B55F8                  mov edx, dword ptr [ebp-08]
:0040CF13 6BD203                  imul edx, 00000003
:0040CF16 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040CF19 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040CF1C 8A09                    mov cl, byte ptr [ecx]
:0040CF1E 884C1015                mov byte ptr [eax+edx+15], cl
:0040CF22 8B5508                  mov edx, dword ptr [ebp+08]
:0040CF25 83C201                  add edx, 00000001
:0040CF28 895508                  mov dword ptr [ebp+08], edx
:0040CF2B EB9B                    jmp 0040CEC8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CED8(C)
|
:0040CF2D C745F800000000          mov [ebp-08], 00000000
:0040CF34 EB09                    jmp 0040CF3F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CF5F(U)
|
:0040CF36 8B45F8                  mov eax, dword ptr [ebp-08]
:0040CF39 83C001                  add eax, 00000001
:0040CF3C 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CF34(U)
|
:0040CF3F 837DF811                cmp dword ptr [ebp-08], 00000011
:0040CF43 731C                    jnb 0040CF61
:0040CF45 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040CF48 034DF8                  add ecx, dword ptr [ebp-08]
:0040CF4B 8B5508                  mov edx, dword ptr [ebp+08]
:0040CF4E 8A02                    mov al, byte ptr [edx]
:0040CF50 88816B020000            mov byte ptr [ecx+0000026B], al
:0040CF56 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040CF59 83C101                  add ecx, 00000001
:0040CF5C 894D08                  mov dword ptr [ebp+08], ecx
:0040CF5F EBD5                    jmp 0040CF36

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040CF43(C)
|
:0040CF61 8B4508                  mov eax, dword ptr [ebp+08]
:0040CF64 8BE5                    mov esp, ebp
:0040CF66 5D                      pop ebp
:0040CF67 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0041B2E9   
|
:0040CF6A 55                      push ebp
:0040CF6B 8BEC                    mov ebp, esp
:0040CF6D 83EC08                  sub esp, 00000008
:0040CF70 894DF8                  mov dword ptr [ebp-08], ecx
:0040CF73 8B45F8                  mov eax, dword ptr [ebp-08]
:0040CF76 8B480C                  mov ecx, dword ptr [eax+0C]
:0040CF79 81E1FF000000            and ecx, 000000FF
:0040CF7F 8B5508                  mov edx, dword ptr [ebp+08]
:0040CF82 880A                    mov byte ptr [edx], cl
:0040CF84 8B4508                  mov eax, dword ptr [ebp+08]
:0040CF87 83C001                  add eax, 00000001
:0040CF8A 894508                  mov dword ptr [ebp+08], eax
:0040CF8D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040CF90 8B510C                  mov edx, dword ptr [ecx+0C]
:0040CF93 C1EA08                  shr edx, 08
:0040CF96 81E2FF000000            and edx, 000000FF
:0040CF9C 8B4508                  mov eax, dword ptr [ebp+08]
:0040CF9F 8810                    mov byte ptr [eax], dl
:0040CFA1 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040CFA4 83C101                  add ecx, 00000001
:0040CFA7 894D08                  mov dword ptr [ebp+08], ecx
:0040CFAA 8B55F8                  mov edx, dword ptr [ebp-08]
:0040CFAD 8B420C                  mov eax, dword ptr [edx+0C]
:0040CFB0 C1E810                  shr eax, 10
:0040CFB3 25FF000000              and eax, 000000FF
:0040CFB8 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040CFBB 8801                    mov byte ptr [ecx], al
:0040CFBD 8B5508                  mov edx, dword ptr [ebp+08]
:0040CFC0 83C201                  add edx, 00000001
:0040CFC3 895508                  mov dword ptr [ebp+08], edx
:0040CFC6 8B45F8                  mov eax, dword ptr [ebp-08]
:0040CFC9 8B480C                  mov ecx, dword ptr [eax+0C]
:0040CFCC C1E918                  shr ecx, 18
:0040CFCF 81E1FF000000            and ecx, 000000FF
:0040CFD5 8B5508                  mov edx, dword ptr [ebp+08]
:0040CFD8 880A                    mov byte ptr [edx], cl
:0040CFDA 8B4508                  mov eax, dword ptr [ebp+08]
:0040CFDD 83C001                  add eax, 00000001
:0040CFE0 894508                  mov dword ptr [ebp+08], eax
:0040CFE3 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040CFE6 8B55F8                  mov edx, dword ptr [ebp-08]
:0040CFE9 8A4205                  mov al, byte ptr [edx+05]
:0040CFEC 8801                    mov byte ptr [ecx], al
:0040CFEE 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040CFF1 83C101                  add ecx, 00000001
:0040CFF4 894D08                  mov dword ptr [ebp+08], ecx
:0040CFF7 8B55F8                  mov edx, dword ptr [ebp-08]
:0040CFFA 33C0                    xor eax, eax
:0040CFFC 668B02                  mov ax, word ptr [edx]
:0040CFFF 25FF000000              and eax, 000000FF
:0040D004 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040D007 8801                    mov byte ptr [ecx], al
:0040D009 8B5508                  mov edx, dword ptr [ebp+08]
:0040D00C 83C201                  add edx, 00000001
:0040D00F 895508                  mov dword ptr [ebp+08], edx
:0040D012 8B45F8                  mov eax, dword ptr [ebp-08]
:0040D015 33C9                    xor ecx, ecx
:0040D017 668B08                  mov cx, word ptr [eax]
:0040D01A C1F908                  sar ecx, 08
:0040D01D 8B5508                  mov edx, dword ptr [ebp+08]
:0040D020 880A                    mov byte ptr [edx], cl
:0040D022 8B4508                  mov eax, dword ptr [ebp+08]
:0040D025 83C001                  add eax, 00000001
:0040D028 894508                  mov dword ptr [ebp+08], eax
:0040D02B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040D02E 33D2                    xor edx, edx
:0040D030 668B5102                mov dx, word ptr [ecx+02]
:0040D034 81E2FF000000            and edx, 000000FF
:0040D03A 8B4508                  mov eax, dword ptr [ebp+08]
:0040D03D 8810                    mov byte ptr [eax], dl
:0040D03F 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040D042 83C101                  add ecx, 00000001
:0040D045 894D08                  mov dword ptr [ebp+08], ecx
:0040D048 8B55F8                  mov edx, dword ptr [ebp-08]
:0040D04B 33C0                    xor eax, eax
:0040D04D 668B4202                mov ax, word ptr [edx+02]
:0040D051 C1F808                  sar eax, 08
:0040D054 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040D057 8801                    mov byte ptr [ecx], al
:0040D059 8B5508                  mov edx, dword ptr [ebp+08]
:0040D05C 83C201                  add edx, 00000001
:0040D05F 895508                  mov dword ptr [ebp+08], edx
:0040D062 8B4508                  mov eax, dword ptr [ebp+08]
:0040D065 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040D068 8A5104                  mov dl, byte ptr [ecx+04]
:0040D06B 8810                    mov byte ptr [eax], dl
:0040D06D 8B4508                  mov eax, dword ptr [ebp+08]
:0040D070 83C001                  add eax, 00000001
:0040D073 894508                  mov dword ptr [ebp+08], eax
:0040D076 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040D079 8B55F8                  mov edx, dword ptr [ebp-08]
:0040D07C 8A4211                  mov al, byte ptr [edx+11]
:0040D07F 8801                    mov byte ptr [ecx], al
:0040D081 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040D084 83C101                  add ecx, 00000001
:0040D087 894D08                  mov dword ptr [ebp+08], ecx
:0040D08A 8B5508                  mov edx, dword ptr [ebp+08]
:0040D08D 8B45F8                  mov eax, dword ptr [ebp-08]
:0040D090 8A4806                  mov cl, byte ptr [eax+06]
:0040D093 880A                    mov byte ptr [edx], cl
:0040D095 8B5508                  mov edx, dword ptr [ebp+08]
:0040D098 83C201                  add edx, 00000001
:0040D09B 895508                  mov dword ptr [ebp+08], edx
:0040D09E 8B4508                  mov eax, dword ptr [ebp+08]
:0040D0A1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040D0A4 8A5107                  mov dl, byte ptr [ecx+07]
:0040D0A7 8810                    mov byte ptr [eax], dl
:0040D0A9 8B4508                  mov eax, dword ptr [ebp+08]
:0040D0AC 83C001                  add eax, 00000001
:0040D0AF 894508                  mov dword ptr [ebp+08], eax
:0040D0B2 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040D0B5 8B55F8                  mov edx, dword ptr [ebp-08]
:0040D0B8 8A4208                  mov al, byte ptr [edx+08]
:0040D0BB 8801                    mov byte ptr [ecx], al
:0040D0BD 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040D0C0 83C101                  add ecx, 00000001
:0040D0C3 894D08                  mov dword ptr [ebp+08], ecx
:0040D0C6 8B5508                  mov edx, dword ptr [ebp+08]
:0040D0C9 8B45F8                  mov eax, dword ptr [ebp-08]
:0040D0CC 8A4810                  mov cl, byte ptr [eax+10]
:0040D0CF 880A                    mov byte ptr [edx], cl
:0040D0D1 8B5508                  mov edx, dword ptr [ebp+08]
:0040D0D4 83C201                  add edx, 00000001
:0040D0D7 895508                  mov dword ptr [ebp+08], edx
:0040D0DA 8B4508                  mov eax, dword ptr [ebp+08]
:0040D0DD 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040D0E0 8A917C020000            mov dl, byte ptr [ecx+0000027C]
:0040D0E6 8810                    mov byte ptr [eax], dl
:0040D0E8 8B4508                  mov eax, dword ptr [ebp+08]
:0040D0EB 83C001                  add eax, 00000001
:0040D0EE 894508                  mov dword ptr [ebp+08], eax
:0040D0F1 C745FC00000000          mov [ebp-04], 00000000
:0040D0F8 EB09                    jmp 0040D103

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D148(U)
|
:0040D0FA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040D0FD 83C101                  add ecx, 00000001
:0040D100 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D0F8(U)
|
:0040D103 837DFC05                cmp dword ptr [ebp-04], 00000005
:0040D107 7341                    jnb 0040D14A
:0040D109 8B55FC                  mov edx, dword ptr [ebp-04]
:0040D10C 8B45F8                  mov eax, dword ptr [ebp-08]
:0040D10F 8B8C9080020000          mov ecx, dword ptr [eax+4*edx+00000280]
:0040D116 81E1FF000000            and ecx, 000000FF
:0040D11C 8B5508                  mov edx, dword ptr [ebp+08]
:0040D11F 880A                    mov byte ptr [edx], cl
:0040D121 8B4508                  mov eax, dword ptr [ebp+08]
:0040D124 83C001                  add eax, 00000001
:0040D127 894508                  mov dword ptr [ebp+08], eax
:0040D12A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040D12D 8B55F8                  mov edx, dword ptr [ebp-08]
:0040D130 8B848A80020000          mov eax, dword ptr [edx+4*ecx+00000280]
:0040D137 C1E808                  shr eax, 08
:0040D13A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040D13D 8801                    mov byte ptr [ecx], al
:0040D13F 8B5508                  mov edx, dword ptr [ebp+08]
:0040D142 83C201                  add edx, 00000001
:0040D145 895508                  mov dword ptr [ebp+08], edx
:0040D148 EBB0                    jmp 0040D0FA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D107(C)
|
:0040D14A C745FC00000000          mov [ebp-04], 00000000
:0040D151 EB09                    jmp 0040D15C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D1A0(U)
|
:0040D153 8B45FC                  mov eax, dword ptr [ebp-04]
:0040D156 83C001                  add eax, 00000001
:0040D159 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D151(U)
|
:0040D15C 837DFC05                cmp dword ptr [ebp-04], 00000005
:0040D160 7340                    jnb 0040D1A2
:0040D162 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040D165 8B55F8                  mov edx, dword ptr [ebp-08]
:0040D168 8B848A94020000          mov eax, dword ptr [edx+4*ecx+00000294]
:0040D16F 25FF000000              and eax, 000000FF
:0040D174 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040D177 8801                    mov byte ptr [ecx], al
:0040D179 8B5508                  mov edx, dword ptr [ebp+08]
:0040D17C 83C201                  add edx, 00000001
:0040D17F 895508                  mov dword ptr [ebp+08], edx
:0040D182 8B45FC                  mov eax, dword ptr [ebp-04]
:0040D185 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040D188 8B948194020000          mov edx, dword ptr [ecx+4*eax+00000294]
:0040D18F C1EA08                  shr edx, 08
:0040D192 8B4508                  mov eax, dword ptr [ebp+08]
:0040D195 8810                    mov byte ptr [eax], dl
:0040D197 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040D19A 83C101                  add ecx, 00000001
:0040D19D 894D08                  mov dword ptr [ebp+08], ecx
:0040D1A0 EBB1                    jmp 0040D153

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D160(C)
|
:0040D1A2 8B5508                  mov edx, dword ptr [ebp+08]
:0040D1A5 8B45F8                  mov eax, dword ptr [ebp-08]
:0040D1A8 8A4812                  mov cl, byte ptr [eax+12]
:0040D1AB 880A                    mov byte ptr [edx], cl
:0040D1AD 8B5508                  mov edx, dword ptr [ebp+08]
:0040D1B0 83C201                  add edx, 00000001
:0040D1B3 895508                  mov dword ptr [ebp+08], edx
:0040D1B6 C745FC00000000          mov [ebp-04], 00000000
:0040D1BD EB09                    jmp 0040D1C8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D222(U)
|
:0040D1BF 8B45FC                  mov eax, dword ptr [ebp-04]
:0040D1C2 83C001                  add eax, 00000001
:0040D1C5 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D1BD(U)
|
:0040D1C8 817DFCC8000000          cmp dword ptr [ebp-04], 000000C8
:0040D1CF 7353                    jnb 0040D224
:0040D1D1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040D1D4 6BC903                  imul ecx, 00000003
:0040D1D7 8B5508                  mov edx, dword ptr [ebp+08]
:0040D1DA 8B45F8                  mov eax, dword ptr [ebp-08]
:0040D1DD 8A4C0813                mov cl, byte ptr [eax+ecx+13]
:0040D1E1 880A                    mov byte ptr [edx], cl
:0040D1E3 8B5508                  mov edx, dword ptr [ebp+08]
:0040D1E6 83C201                  add edx, 00000001
:0040D1E9 895508                  mov dword ptr [ebp+08], edx
:0040D1EC 8B45FC                  mov eax, dword ptr [ebp-04]
:0040D1EF 6BC003                  imul eax, 00000003
:0040D1F2 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040D1F5 8B55F8                  mov edx, dword ptr [ebp-08]
:0040D1F8 8A440214                mov al, byte ptr [edx+eax+14]
:0040D1FC 8801                    mov byte ptr [ecx], al
:0040D1FE 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040D201 83C101                  add ecx, 00000001
:0040D204 894D08                  mov dword ptr [ebp+08], ecx
:0040D207 8B55FC                  mov edx, dword ptr [ebp-04]
:0040D20A 6BD203                  imul edx, 00000003
:0040D20D 8B4508                  mov eax, dword ptr [ebp+08]
:0040D210 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040D213 8A541115                mov dl, byte ptr [ecx+edx+15]
:0040D217 8810                    mov byte ptr [eax], dl
:0040D219 8B4508                  mov eax, dword ptr [ebp+08]
:0040D21C 83C001                  add eax, 00000001
:0040D21F 894508                  mov dword ptr [ebp+08], eax
:0040D222 EB9B                    jmp 0040D1BF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D1CF(C)
|
:0040D224 C745FC00000000          mov [ebp-04], 00000000
:0040D22B EB09                    jmp 0040D236

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D256(U)
|
:0040D22D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040D230 83C101                  add ecx, 00000001
:0040D233 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D22B(U)
|
:0040D236 837DFC11                cmp dword ptr [ebp-04], 00000011
:0040D23A 731C                    jnb 0040D258
:0040D23C 8B55F8                  mov edx, dword ptr [ebp-08]
:0040D23F 0355FC                  add edx, dword ptr [ebp-04]
:0040D242 8B4508                  mov eax, dword ptr [ebp+08]
:0040D245 8A8A6B020000            mov cl, byte ptr [edx+0000026B]
:0040D24B 8808                    mov byte ptr [eax], cl
:0040D24D 8B5508                  mov edx, dword ptr [ebp+08]
:0040D250 83C201                  add edx, 00000001
:0040D253 895508                  mov dword ptr [ebp+08], edx
:0040D256 EBD5                    jmp 0040D22D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D23A(C)
|
:0040D258 8B4508                  mov eax, dword ptr [ebp+08]
:0040D25B 8BE5                    mov esp, ebp
:0040D25D 5D                      pop ebp
:0040D25E C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0042C895   , :004609AA   
|
:0040D261 55                      push ebp
:0040D262 8BEC                    mov ebp, esp
:0040D264 51                      push ecx
:0040D265 894DFC                  mov dword ptr [ebp-04], ecx
:0040D268 8B45FC                  mov eax, dword ptr [ebp-04]
:0040D26B 33C9                    xor ecx, ecx
:0040D26D 668B4802                mov cx, word ptr [eax+02]
:0040D271 8BC1                    mov eax, ecx
:0040D273 8BE5                    mov esp, ebp
:0040D275 5D                      pop ebp
:0040D276 C3                      ret



* Referenced by a CALL at Address:
|:0042C864   
|
:0040D277 55                      push ebp
:0040D278 8BEC                    mov ebp, esp
:0040D27A 51                      push ecx
:0040D27B 894DFC                  mov dword ptr [ebp-04], ecx
:0040D27E 8B45FC                  mov eax, dword ptr [ebp-04]
:0040D281 668B4D08                mov cx, word ptr [ebp+08]
:0040D285 66894802                mov word ptr [eax+02], cx
:0040D289 8BE5                    mov esp, ebp
:0040D28B 5D                      pop ebp
:0040D28C C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00411985   , :004197DB   , :00419868   , :004198F5   , :0041B261   
|:00466B42   , :00466C9C   , :00468499   , :0046856F   , :004685FE   
|:0046B12A   , :0046B25C   , :0046DC33   
|
:0040D28F 55                      push ebp
:0040D290 8BEC                    mov ebp, esp
:0040D292 51                      push ecx
:0040D293 894DFC                  mov dword ptr [ebp-04], ecx
:0040D296 8B45FC                  mov eax, dword ptr [ebp-04]
:0040D299 33C9                    xor ecx, ecx
:0040D29B 8A4807                  mov cl, byte ptr [eax+07]
:0040D29E 8BC1                    mov eax, ecx
:0040D2A0 99                      cdq
:0040D2A1 2BC2                    sub eax, edx
:0040D2A3 D1F8                    sar eax, 1
:0040D2A5 8BE5                    mov esp, ebp
:0040D2A7 5D                      pop ebp
:0040D2A8 C3                      ret



* Referenced by a CALL at Address:
|:00414B44   
|
:0040D2A9 55                      push ebp
:0040D2AA 8BEC                    mov ebp, esp
:0040D2AC 83EC0C                  sub esp, 0000000C
:0040D2AF 894DF4                  mov dword ptr [ebp-0C], ecx
:0040D2B2 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040D2B5 33C9                    xor ecx, ecx
:0040D2B7 8A4812                  mov cl, byte ptr [eax+12]
:0040D2BA 8B5508                  mov edx, dword ptr [ebp+08]
:0040D2BD 81E2FF000000            and edx, 000000FF
:0040D2C3 03CA                    add ecx, edx
:0040D2C5 83F964                  cmp ecx, 00000064
:0040D2C8 7E14                    jle 0040D2DE
:0040D2CA 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040D2CD 8A4812                  mov cl, byte ptr [eax+12]
:0040D2D0 51                      push ecx
:0040D2D1 6A64                    push 00000064
:0040D2D3 E8F8270700              call 0047FAD0
:0040D2D8 83C408                  add esp, 00000008
:0040D2DB 884508                  mov byte ptr [ebp+08], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D2C8(C)
|
:0040D2DE 8B4508                  mov eax, dword ptr [ebp+08]
:0040D2E1 25FF000000              and eax, 000000FF
:0040D2E6 99                      cdq
:0040D2E7 B905000000              mov ecx, 00000005
:0040D2EC F7F9                    idiv ecx
:0040D2EE 8845F8                  mov byte ptr [ebp-08], al
:0040D2F1 C645FC00                mov [ebp-04], 00
:0040D2F5 EB09                    jmp 0040D300

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D369(U)
|
:0040D2F7 8A55FC                  mov dl, byte ptr [ebp-04]
:0040D2FA 80C201                  add dl, 01
:0040D2FD 8855FC                  mov byte ptr [ebp-04], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D2F5(U)
|
:0040D300 8B45FC                  mov eax, dword ptr [ebp-04]
:0040D303 25FF000000              and eax, 000000FF
:0040D308 83F805                  cmp eax, 00000005
:0040D30B 7D5E                    jge 0040D36B
:0040D30D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040D310 33D2                    xor edx, edx
:0040D312 8A5112                  mov dl, byte ptr [ecx+12]
:0040D315 8B45FC                  mov eax, dword ptr [ebp-04]
:0040D318 25FF000000              and eax, 000000FF
:0040D31D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040D320 81E1FF000000            and ecx, 000000FF
:0040D326 0FAFC1                  imul eax, ecx
:0040D329 03D0                    add edx, eax
:0040D32B 52                      push edx
:0040D32C E8E4930600              call 00476715
:0040D331 83C404                  add esp, 00000004
:0040D334 6A03                    push 00000003
:0040D336 B9181B4B00              mov ecx, 004B1B18
:0040D33B E80060FFFF              call 00403340
:0040D340 8B45FC                  mov eax, dword ptr [ebp-04]
:0040D343 25FF000000              and eax, 000000FF
:0040D348 83C001                  add eax, 00000001
:0040D34B 99                      cdq
:0040D34C 33C2                    xor eax, edx
:0040D34E 2BC2                    sub eax, edx
:0040D350 83E001                  and eax, 00000001
:0040D353 33C2                    xor eax, edx
:0040D355 2BC2                    sub eax, edx
:0040D357 50                      push eax
:0040D358 6A00                    push 00000000
:0040D35A B9986A4B00              mov ecx, 004B6A98
:0040D35F E8C58C0600              call 00476029
:0040D364 E877F10100              call 0042C4E0
:0040D369 EB8C                    jmp 0040D2F7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D30B(C)
|
:0040D36B 8B55F4                  mov edx, dword ptr [ebp-0C]
:0040D36E 8A4212                  mov al, byte ptr [edx+12]
:0040D371 024508                  add al, byte ptr [ebp+08]
:0040D374 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040D377 884112                  mov byte ptr [ecx+12], al
:0040D37A 8B55F4                  mov edx, dword ptr [ebp-0C]
:0040D37D 8A4212                  mov al, byte ptr [edx+12]
:0040D380 50                      push eax
:0040D381 E88F930600              call 00476715
:0040D386 83C404                  add esp, 00000004
:0040D389 6A00                    push 00000000
:0040D38B 6A00                    push 00000000
:0040D38D B9986A4B00              mov ecx, 004B6A98
:0040D392 E8928C0600              call 00476029
:0040D397 6A01                    push 00000001
:0040D399 B9181B4B00              mov ecx, 004B1B18
:0040D39E E89D5FFFFF              call 00403340
:0040D3A3 E838F10100              call 0042C4E0
:0040D3A8 8BE5                    mov esp, ebp
:0040D3AA 5D                      pop ebp
:0040D3AB C20400                  ret 0004



* Referenced by a CALL at Address:
|:00414B54   
|
:0040D3AE 55                      push ebp
:0040D3AF 8BEC                    mov ebp, esp
:0040D3B1 83EC0C                  sub esp, 0000000C
:0040D3B4 894DF4                  mov dword ptr [ebp-0C], ecx
:0040D3B7 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040D3BA 33C9                    xor ecx, ecx
:0040D3BC 8A4812                  mov cl, byte ptr [eax+12]
:0040D3BF 8B5508                  mov edx, dword ptr [ebp+08]
:0040D3C2 81E2FF000000            and edx, 000000FF
:0040D3C8 2BCA                    sub ecx, edx
:0040D3CA 85C9                    test ecx, ecx
:0040D3CC 7D09                    jge 0040D3D7
:0040D3CE 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040D3D1 8A4812                  mov cl, byte ptr [eax+12]
:0040D3D4 884D08                  mov byte ptr [ebp+08], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D3CC(C)
|
:0040D3D7 8B4508                  mov eax, dword ptr [ebp+08]
:0040D3DA 25FF000000              and eax, 000000FF
:0040D3DF 99                      cdq
:0040D3E0 B905000000              mov ecx, 00000005
:0040D3E5 F7F9                    idiv ecx
:0040D3E7 8845FC                  mov byte ptr [ebp-04], al
:0040D3EA C645F800                mov [ebp-08], 00
:0040D3EE EB09                    jmp 0040D3F9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D462(U)
|
:0040D3F0 8A55F8                  mov dl, byte ptr [ebp-08]
:0040D3F3 80C201                  add dl, 01
:0040D3F6 8855F8                  mov byte ptr [ebp-08], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D3EE(U)
|
:0040D3F9 8B45F8                  mov eax, dword ptr [ebp-08]
:0040D3FC 25FF000000              and eax, 000000FF
:0040D401 83F805                  cmp eax, 00000005
:0040D404 7D5E                    jge 0040D464
:0040D406 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040D409 33D2                    xor edx, edx
:0040D40B 8A5112                  mov dl, byte ptr [ecx+12]
:0040D40E 8B45F8                  mov eax, dword ptr [ebp-08]
:0040D411 25FF000000              and eax, 000000FF
:0040D416 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040D419 81E1FF000000            and ecx, 000000FF
:0040D41F 0FAFC1                  imul eax, ecx
:0040D422 2BD0                    sub edx, eax
:0040D424 52                      push edx
:0040D425 E8EB920600              call 00476715
:0040D42A 83C404                  add esp, 00000004
:0040D42D 6A03                    push 00000003
:0040D42F B9181B4B00              mov ecx, 004B1B18
:0040D434 E8075FFFFF              call 00403340
:0040D439 8B45F8                  mov eax, dword ptr [ebp-08]
:0040D43C 25FF000000              and eax, 000000FF
:0040D441 83C001                  add eax, 00000001
:0040D444 99                      cdq
:0040D445 33C2                    xor eax, edx
:0040D447 2BC2                    sub eax, edx
:0040D449 83E001                  and eax, 00000001
:0040D44C 33C2                    xor eax, edx
:0040D44E 2BC2                    sub eax, edx
:0040D450 50                      push eax
:0040D451 6A01                    push 00000001
:0040D453 B9986A4B00              mov ecx, 004B6A98
:0040D458 E8CC8B0600              call 00476029
:0040D45D E87EF00100              call 0042C4E0
:0040D462 EB8C                    jmp 0040D3F0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D404(C)
|
:0040D464 8B55F4                  mov edx, dword ptr [ebp-0C]
:0040D467 8A4212                  mov al, byte ptr [edx+12]
:0040D46A 2A4508                  sub al, byte ptr [ebp+08]
:0040D46D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040D470 884112                  mov byte ptr [ecx+12], al
:0040D473 8B55F4                  mov edx, dword ptr [ebp-0C]
:0040D476 8A4212                  mov al, byte ptr [edx+12]
:0040D479 50                      push eax
:0040D47A E896920600              call 00476715
:0040D47F 83C404                  add esp, 00000004
:0040D482 6A00                    push 00000000
:0040D484 6A01                    push 00000001
:0040D486 B9986A4B00              mov ecx, 004B6A98
:0040D48B E8998B0600              call 00476029
:0040D490 6A01                    push 00000001
:0040D492 B9181B4B00              mov ecx, 004B1B18
:0040D497 E8A45EFFFF              call 00403340
:0040D49C E83FF00100              call 0042C4E0
:0040D4A1 8BE5                    mov esp, ebp
:0040D4A3 5D                      pop ebp
:0040D4A4 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0040D510   
|
:0040D4A7 55                      push ebp
:0040D4A8 8BEC                    mov ebp, esp
:0040D4AA 51                      push ecx
:0040D4AB 894DFC                  mov dword ptr [ebp-04], ecx
:0040D4AE 8B4508                  mov eax, dword ptr [ebp+08]
:0040D4B1 25FF000000              and eax, 000000FF
:0040D4B6 6BC003                  imul eax, 00000003
:0040D4B9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040D4BC 8A550C                  mov dl, byte ptr [ebp+0C]
:0040D4BF 88540113                mov byte ptr [ecx+eax+13], dl
:0040D4C3 8B4508                  mov eax, dword ptr [ebp+08]
:0040D4C6 25FF000000              and eax, 000000FF
:0040D4CB 6BC003                  imul eax, 00000003
:0040D4CE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040D4D1 8A5510                  mov dl, byte ptr [ebp+10]
:0040D4D4 88540114                mov byte ptr [ecx+eax+14], dl
:0040D4D8 8B4508                  mov eax, dword ptr [ebp+08]
:0040D4DB 25FF000000              and eax, 000000FF
:0040D4E0 6BC003                  imul eax, 00000003
:0040D4E3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040D4E6 8A5514                  mov dl, byte ptr [ebp+14]
:0040D4E9 88540115                mov byte ptr [ecx+eax+15], dl
:0040D4ED 8BE5                    mov esp, ebp
:0040D4EF 5D                      pop ebp
:0040D4F0 C21000                  ret 0010



* Referenced by a CALL at Addresses:
|:0040CBF8   , :0040D56C   , :0046BCDC   
|
:0040D4F3 55                      push ebp
:0040D4F4 8BEC                    mov ebp, esp
:0040D4F6 51                      push ecx
:0040D4F7 894DFC                  mov dword ptr [ebp-04], ecx
:0040D4FA 68FF000000              push 000000FF
:0040D4FF 68FF000000              push 000000FF
:0040D504 68FF000000              push 000000FF
:0040D509 8A4508                  mov al, byte ptr [ebp+08]
:0040D50C 50                      push eax
:0040D50D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040D510 E892FFFFFF              call 0040D4A7
:0040D515 8BE5                    mov esp, ebp
:0040D517 5D                      pop ebp
:0040D518 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0046B1E2   
|
:0040D51B 55                      push ebp
:0040D51C 8BEC                    mov ebp, esp
:0040D51E 83EC18                  sub esp, 00000018
:0040D521 894DEC                  mov dword ptr [ebp-14], ecx
:0040D524 8B4508                  mov eax, dword ptr [ebp+08]
:0040D527 25FF000000              and eax, 000000FF
:0040D52C 6BC003                  imul eax, 00000003
:0040D52F 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040D532 8A540113                mov dl, byte ptr [ecx+eax+13]
:0040D536 8855F4                  mov byte ptr [ebp-0C], dl
:0040D539 8B4508                  mov eax, dword ptr [ebp+08]
:0040D53C 25FF000000              and eax, 000000FF
:0040D541 6BC003                  imul eax, 00000003
:0040D544 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040D547 8A540114                mov dl, byte ptr [ecx+eax+14]
:0040D54B 8855FC                  mov byte ptr [ebp-04], dl
:0040D54E 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040D551 25FF000000              and eax, 000000FF
:0040D556 6BC019                  imul eax, 00000019
:0040D559 0540114A00              add eax, 004A1140
:0040D55E 8945F0                  mov dword ptr [ebp-10], eax
:0040D561 C645F8FF                mov [ebp-08], FF
:0040D565 8A4D08                  mov cl, byte ptr [ebp+08]
:0040D568 51                      push ecx
:0040D569 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040D56C E882FFFFFF              call 0040D4F3
:0040D571 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040D574 E8D3F1FFFF              call 0040C74C
:0040D579 85C0                    test eax, eax
:0040D57B 7464                    je 0040D5E1
:0040D57D 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040D580 E8E9F1FFFF              call 0040C76E
:0040D585 85C0                    test eax, eax
:0040D587 7558                    jne 0040D5E1
:0040D589 8B55FC                  mov edx, dword ptr [ebp-04]
:0040D58C 81E2FF000000            and edx, 000000FF
:0040D592 83FA03                  cmp edx, 00000003
:0040D595 754A                    jne 0040D5E1
:0040D597 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040D59A E8A1BFFFFF              call 00409540
:0040D59F 25FF000000              and eax, 000000FF
:0040D5A4 8945E8                  mov dword ptr [ebp-18], eax
:0040D5A7 837DE810                cmp dword ptr [ebp-18], 00000010
:0040D5AB 7734                    ja 0040D5E1
:0040D5AD 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0040D5B0 33C0                    xor eax, eax
:0040D5B2 8A8112D64000            mov al, byte ptr [ecx+0040D612]
:0040D5B8 FF2485EAD54000          jmp dword ptr [4*eax+0040D5EA]
:0040D5BF C645F867                mov [ebp-08], 67
:0040D5C3 EB1C                    jmp 0040D5E1
:0040D5C5 C645F862                mov [ebp-08], 62
:0040D5C9 EB16                    jmp 0040D5E1
:0040D5CB C645F866                mov [ebp-08], 66
:0040D5CF EB10                    jmp 0040D5E1
:0040D5D1 C645F863                mov [ebp-08], 63
:0040D5D5 EB0A                    jmp 0040D5E1
:0040D5D7 C645F864                mov [ebp-08], 64
:0040D5DB EB04                    jmp 0040D5E1
:0040D5DD C645F865                mov [ebp-08], 65

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040D57B(C), :0040D587(C), :0040D595(C), :0040D5AB(C), :0040D5C3(U)
|:0040D5C9(U), :0040D5CF(U), :0040D5D5(U), :0040D5DB(U)
|
:0040D5E1 8A45F8                  mov al, byte ptr [ebp-08]
:0040D5E4 8BE5                    mov esp, ebp
:0040D5E6 5D                      pop ebp
:0040D5E7 C20400                  ret 0004



:0040D5EA BFD54000                DWORD 0040D5BF
:0040D5EE C5D54000                DWORD 0040D5C5
:0040D5F2 CBD54000                DWORD 0040D5CB
:0040D5F6 CBD54000                DWORD 0040D5CB
:0040D5FA C5D54000                DWORD 0040D5C5
:0040D5FE D1D54000                DWORD 0040D5D1
:0040D602 D1D54000                DWORD 0040D5D1
:0040D606 D7D54000                DWORD 0040D5D7
:0040D60A DDD54000                DWORD 0040D5DD
:0040D60E E1D54000                DWORD 0040D5E1


:0040D612 0009                    add byte ptr [ecx], cl
:0040D614 0109                    add dword ptr [ecx], ecx
:0040D616 0209                    add cl, byte ptr [ecx]
:0040D618 0309                    add ecx, dword ptr [ecx]
:0040D61A 0409                    add al, 09
:0040D61C 0509060907              add eax, 07090609
:0040D621 0908                    or dword ptr [eax], ecx

* Referenced by a CALL at Address:
|:0040D6D5   
|
:0040D623 55                      push ebp
:0040D624 8BEC                    mov ebp, esp
:0040D626 83EC08                  sub esp, 00000008
:0040D629 894DF8                  mov dword ptr [ebp-08], ecx
:0040D62C C645FC00                mov [ebp-04], 00
:0040D630 EB08                    jmp 0040D63A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D6B1(U)
|
:0040D632 8A45FC                  mov al, byte ptr [ebp-04]
:0040D635 0401                    add al, 01
:0040D637 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D630(U)
|
:0040D63A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040D63D 81E1FF000000            and ecx, 000000FF
:0040D643 81F9C8000000            cmp ecx, 000000C8
:0040D649 7D6B                    jge 0040D6B6
:0040D64B 8B55FC                  mov edx, dword ptr [ebp-04]
:0040D64E 81E2FF000000            and edx, 000000FF
:0040D654 6BD203                  imul edx, 00000003
:0040D657 8B45F8                  mov eax, dword ptr [ebp-08]
:0040D65A 33C9                    xor ecx, ecx
:0040D65C 8A4C1013                mov cl, byte ptr [eax+edx+13]
:0040D660 8B5508                  mov edx, dword ptr [ebp+08]
:0040D663 81E2FF000000            and edx, 000000FF
:0040D669 3BCA                    cmp ecx, edx
:0040D66B 7544                    jne 0040D6B1
:0040D66D 8B45FC                  mov eax, dword ptr [ebp-04]
:0040D670 25FF000000              and eax, 000000FF
:0040D675 6BC003                  imul eax, 00000003
:0040D678 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040D67B 33D2                    xor edx, edx
:0040D67D 8A540114                mov dl, byte ptr [ecx+eax+14]
:0040D681 8B450C                  mov eax, dword ptr [ebp+0C]
:0040D684 25FF000000              and eax, 000000FF
:0040D689 3BD0                    cmp edx, eax
:0040D68B 7524                    jne 0040D6B1
:0040D68D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040D690 81E1FF000000            and ecx, 000000FF
:0040D696 6BC903                  imul ecx, 00000003
:0040D699 8B55F8                  mov edx, dword ptr [ebp-08]
:0040D69C 33C0                    xor eax, eax
:0040D69E 8A440A15                mov al, byte ptr [edx+ecx+15]
:0040D6A2 8B4D10                  mov ecx, dword ptr [ebp+10]
:0040D6A5 81E1FF000000            and ecx, 000000FF
:0040D6AB 3BC1                    cmp eax, ecx
:0040D6AD 7502                    jne 0040D6B1
:0040D6AF EB05                    jmp 0040D6B6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040D66B(C), :0040D68B(C), :0040D6AD(C)
|
:0040D6B1 E97CFFFFFF              jmp 0040D632

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040D649(C), :0040D6AF(U)
|
:0040D6B6 8A45FC                  mov al, byte ptr [ebp-04]
:0040D6B9 8BE5                    mov esp, ebp
:0040D6BB 5D                      pop ebp
:0040D6BC C20C00                  ret 000C


:0040D6BF 55                      push ebp
:0040D6C0 8BEC                    mov ebp, esp
:0040D6C2 51                      push ecx
:0040D6C3 894DFC                  mov dword ptr [ebp-04], ecx
:0040D6C6 8A450A                  mov al, byte ptr [ebp+0A]
:0040D6C9 50                      push eax
:0040D6CA 8A4D09                  mov cl, byte ptr [ebp+09]
:0040D6CD 51                      push ecx
:0040D6CE 8A5508                  mov dl, byte ptr [ebp+08]
:0040D6D1 52                      push edx
:0040D6D2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040D6D5 E849FFFFFF              call 0040D623
:0040D6DA 8BE5                    mov esp, ebp
:0040D6DC 5D                      pop ebp
:0040D6DD C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0040D93B   , :00468456   , :0046854A   , :0046BF33   
|
:0040D6E0 55                      push ebp
:0040D6E1 8BEC                    mov ebp, esp
:0040D6E3 83EC0C                  sub esp, 0000000C
:0040D6E6 894DF4                  mov dword ptr [ebp-0C], ecx
:0040D6E9 C645FC00                mov [ebp-04], 00
:0040D6ED C645F800                mov [ebp-08], 00
:0040D6F1 EB08                    jmp 0040D6FB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D732(U)
|
:0040D6F3 8A45F8                  mov al, byte ptr [ebp-08]
:0040D6F6 0401                    add al, 01
:0040D6F8 8845F8                  mov byte ptr [ebp-08], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D6F1(U)
|
:0040D6FB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040D6FE 81E1FF000000            and ecx, 000000FF
:0040D704 81F9C8000000            cmp ecx, 000000C8
:0040D70A 7D28                    jge 0040D734
:0040D70C 8B55F8                  mov edx, dword ptr [ebp-08]
:0040D70F 81E2FF000000            and edx, 000000FF
:0040D715 6BD203                  imul edx, 00000003
:0040D718 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040D71B 33C9                    xor ecx, ecx
:0040D71D 8A4C1013                mov cl, byte ptr [eax+edx+13]
:0040D721 81F9FF000000            cmp ecx, 000000FF
:0040D727 7409                    je 0040D732
:0040D729 8A55FC                  mov dl, byte ptr [ebp-04]
:0040D72C 80C201                  add dl, 01
:0040D72F 8855FC                  mov byte ptr [ebp-04], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D727(C)
|
:0040D732 EBBF                    jmp 0040D6F3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D70A(C)
|
:0040D734 8A45FC                  mov al, byte ptr [ebp-04]
:0040D737 8BE5                    mov esp, ebp
:0040D739 5D                      pop ebp
:0040D73A C3                      ret



* Referenced by a CALL at Addresses:
|:00467483   , :004674D0   , :0046752C   , :00467593   , :00467BEA   
|:00467C5C   
|
:0040D73B 55                      push ebp
:0040D73C 8BEC                    mov ebp, esp
:0040D73E 83EC0C                  sub esp, 0000000C
:0040D741 894DF4                  mov dword ptr [ebp-0C], ecx
:0040D744 C645FC00                mov [ebp-04], 00
:0040D748 C645F800                mov [ebp-08], 00
:0040D74C EB08                    jmp 0040D756

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D791(U)
|
:0040D74E 8A45F8                  mov al, byte ptr [ebp-08]
:0040D751 0401                    add al, 01
:0040D753 8845F8                  mov byte ptr [ebp-08], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D74C(U)
|
:0040D756 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040D759 81E1FF000000            and ecx, 000000FF
:0040D75F 81F9C8000000            cmp ecx, 000000C8
:0040D765 7D2C                    jge 0040D793
:0040D767 8B55F8                  mov edx, dword ptr [ebp-08]
:0040D76A 81E2FF000000            and edx, 000000FF
:0040D770 6BD203                  imul edx, 00000003
:0040D773 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040D776 33C9                    xor ecx, ecx
:0040D778 8A4C1013                mov cl, byte ptr [eax+edx+13]
:0040D77C 8B5508                  mov edx, dword ptr [ebp+08]
:0040D77F 81E2FF000000            and edx, 000000FF
:0040D785 3BCA                    cmp ecx, edx
:0040D787 7508                    jne 0040D791
:0040D789 8A45FC                  mov al, byte ptr [ebp-04]
:0040D78C 0401                    add al, 01
:0040D78E 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D787(C)
|
:0040D791 EBBB                    jmp 0040D74E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D765(C)
|
:0040D793 8A45FC                  mov al, byte ptr [ebp-04]
:0040D796 8BE5                    mov esp, ebp
:0040D798 5D                      pop ebp
:0040D799 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0040D926   , :004146A0   , :00434F09   , :00459D28   , :00468486   
|:0046F12E   
|
:0040D79C 55                      push ebp
:0040D79D 8BEC                    mov ebp, esp
:0040D79F 6AFF                    push FFFFFFFF
:0040D7A1 682F504800              push 0048502F
:0040D7A6 64A100000000            mov eax, dword ptr fs:[00000000]
:0040D7AC 50                      push eax
:0040D7AD 64892500000000          mov dword ptr fs:[00000000], esp
:0040D7B4 81ECC0060000            sub esp, 000006C0
:0040D7BA 898D34F9FFFF            mov dword ptr [ebp+FFFFF934], ecx
:0040D7C0 8D8D40F9FFFF            lea ecx, dword ptr [ebp+FFFFF940]
:0040D7C6 E8E5080000              call 0040E0B0
:0040D7CB C745FC00000000          mov [ebp-04], 00000000
:0040D7D2 C6853CF9FFFF00          mov byte ptr [ebp+FFFFF93C], 00
:0040D7D9 EB0E                    jmp 0040D7E9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D888(U)
|
:0040D7DB 8A853CF9FFFF            mov al, byte ptr [ebp+FFFFF93C]
:0040D7E1 0401                    add al, 01
:0040D7E3 88853CF9FFFF            mov byte ptr [ebp+FFFFF93C], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D7D9(U)
|
:0040D7E9 8B8D3CF9FFFF            mov ecx, dword ptr [ebp+FFFFF93C]
:0040D7EF 81E1FF000000            and ecx, 000000FF
:0040D7F5 81F9C8000000            cmp ecx, 000000C8
:0040D7FB 0F8D8C000000            jnl 0040D88D
:0040D801 8B953CF9FFFF            mov edx, dword ptr [ebp+FFFFF93C]
:0040D807 81E2FF000000            and edx, 000000FF
:0040D80D 6BD203                  imul edx, 00000003
:0040D810 8B8534F9FFFF            mov eax, dword ptr [ebp+FFFFF934]
:0040D816 33C9                    xor ecx, ecx
:0040D818 8A4C1013                mov cl, byte ptr [eax+edx+13]
:0040D81C 81F9FF000000            cmp ecx, 000000FF
:0040D822 7564                    jne 0040D888
:0040D824 8B5508                  mov edx, dword ptr [ebp+08]
:0040D827 81E2FF000000            and edx, 000000FF
:0040D82D 81FAFF000000            cmp edx, 000000FF
:0040D833 7451                    je 0040D886
:0040D835 8B853CF9FFFF            mov eax, dword ptr [ebp+FFFFF93C]
:0040D83B 25FF000000              and eax, 000000FF
:0040D840 6BC003                  imul eax, 00000003
:0040D843 8B8D34F9FFFF            mov ecx, dword ptr [ebp+FFFFF934]
:0040D849 8A5508                  mov dl, byte ptr [ebp+08]
:0040D84C 88540113                mov byte ptr [ecx+eax+13], dl
:0040D850 8B853CF9FFFF            mov eax, dword ptr [ebp+FFFFF93C]
:0040D856 25FF000000              and eax, 000000FF
:0040D85B 6BC003                  imul eax, 00000003
:0040D85E 8B8D34F9FFFF            mov ecx, dword ptr [ebp+FFFFF934]
:0040D864 8A550C                  mov dl, byte ptr [ebp+0C]
:0040D867 88540114                mov byte ptr [ecx+eax+14], dl
:0040D86B 8B853CF9FFFF            mov eax, dword ptr [ebp+FFFFF93C]
:0040D871 25FF000000              and eax, 000000FF
:0040D876 6BC003                  imul eax, 00000003
:0040D879 8B8D34F9FFFF            mov ecx, dword ptr [ebp+FFFFF934]
:0040D87F 8A5510                  mov dl, byte ptr [ebp+10]
:0040D882 88540115                mov byte ptr [ecx+eax+15], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D833(C)
|
:0040D886 EB05                    jmp 0040D88D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D822(C)
|
:0040D888 E94EFFFFFF              jmp 0040D7DB

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040D7FB(C), :0040D886(U)
|
:0040D88D 8B853CF9FFFF            mov eax, dword ptr [ebp+FFFFF93C]
:0040D893 25FF000000              and eax, 000000FF

* Possible Reference to Dialog: DialogID_00C8 
                                  |
:0040D898 3DC8000000              cmp eax, 000000C8
:0040D89D 7C3D                    jl 0040D8DC
:0040D89F 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040D8A2 81E1FF000000            and ecx, 000000FF
:0040D8A8 81F9FF000000            cmp ecx, 000000FF
:0040D8AE 742C                    je 0040D8DC

* Possible StringData Ref from Data Obj ->"ֿ
һߡ"
                                  |
:0040D8B0 6888B24800              push 0048B288
:0040D8B5 6A00                    push 00000000
:0040D8B7 E8DD1D0200              call 0042F699
:0040D8BC 83C408                  add esp, 00000008
:0040D8BF 8A5510                  mov dl, byte ptr [ebp+10]
:0040D8C2 52                      push edx
:0040D8C3 8A450C                  mov al, byte ptr [ebp+0C]
:0040D8C6 50                      push eax
:0040D8C7 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040D8CA 81E1FF000000            and ecx, 000000FF
:0040D8D0 51                      push ecx
:0040D8D1 8D8D40F9FFFF            lea ecx, dword ptr [ebp+FFFFF940]
:0040D8D7 E858170600              call 0046F034

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040D89D(C), :0040D8AE(C)
|
:0040D8DC 8A953CF9FFFF            mov dl, byte ptr [ebp+FFFFF93C]
:0040D8E2 889538F9FFFF            mov byte ptr [ebp+FFFFF938], dl
:0040D8E8 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0040D8EF 8D8D40F9FFFF            lea ecx, dword ptr [ebp+FFFFF940]
:0040D8F5 E826080000              call 0040E120
:0040D8FA 8A8538F9FFFF            mov al, byte ptr [ebp+FFFFF938]
:0040D900 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040D903 64890D00000000          mov dword ptr fs:[00000000], ecx
:0040D90A 8BE5                    mov esp, ebp
:0040D90C 5D                      pop ebp
:0040D90D C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:0040C36B   , :0040C385   , :0040C39F   
|
:0040D910 55                      push ebp
:0040D911 8BEC                    mov ebp, esp
:0040D913 51                      push ecx
:0040D914 894DFC                  mov dword ptr [ebp-04], ecx
:0040D917 8A450A                  mov al, byte ptr [ebp+0A]
:0040D91A 50                      push eax
:0040D91B 8A4D09                  mov cl, byte ptr [ebp+09]
:0040D91E 51                      push ecx
:0040D91F 8A5508                  mov dl, byte ptr [ebp+08]
:0040D922 52                      push edx
:0040D923 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040D926 E871FEFFFF              call 0040D79C
:0040D92B 8BE5                    mov esp, ebp
:0040D92D 5D                      pop ebp
:0040D92E C20400                  ret 0004


:0040D931 55                      push ebp
:0040D932 8BEC                    mov ebp, esp
:0040D934 51                      push ecx
:0040D935 894DFC                  mov dword ptr [ebp-04], ecx
:0040D938 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040D93B E8A0FDFFFF              call 0040D6E0
:0040D940 25FF000000              and eax, 000000FF
:0040D945 33C9                    xor ecx, ecx

* Possible Reference to Dialog: DialogID_00C8 
                                  |
:0040D947 3DC8000000              cmp eax, 000000C8
:0040D94C 0F95C1                  setne cl
:0040D94F 8BC1                    mov eax, ecx
:0040D951 8BE5                    mov esp, ebp
:0040D953 5D                      pop ebp
:0040D954 C3                      ret



* Referenced by a CALL at Address:
|:0041DCE0   
|
:0040D955 55                      push ebp
:0040D956 8BEC                    mov ebp, esp
:0040D958 51                      push ecx
:0040D959 894DFC                  mov dword ptr [ebp-04], ecx
:0040D95C 8A4508                  mov al, byte ptr [ebp+08]
:0040D95F 50                      push eax
:0040D960 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040D963 E85C000000              call 0040D9C4
:0040D968 884508                  mov byte ptr [ebp+08], al
:0040D96B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040D96E 81E1FF000000            and ecx, 000000FF
:0040D974 81F9FF000000            cmp ecx, 000000FF
:0040D97A 7442                    je 0040D9BE
:0040D97C 8B5508                  mov edx, dword ptr [ebp+08]
:0040D97F 81E2FF000000            and edx, 000000FF
:0040D985 8B45FC                  mov eax, dword ptr [ebp-04]
:0040D988 33C9                    xor ecx, ecx
:0040D98A 8A8C106B020000          mov cl, byte ptr [eax+edx+0000026B]
:0040D991 85C9                    test ecx, ecx
:0040D993 7E29                    jle 0040D9BE
:0040D995 8B5508                  mov edx, dword ptr [ebp+08]
:0040D998 81E2FF000000            and edx, 000000FF
:0040D99E 8B45FC                  mov eax, dword ptr [ebp-04]
:0040D9A1 8A8C106B020000          mov cl, byte ptr [eax+edx+0000026B]
:0040D9A8 80E901                  sub cl, 01
:0040D9AB 8B5508                  mov edx, dword ptr [ebp+08]
:0040D9AE 81E2FF000000            and edx, 000000FF
:0040D9B4 8B45FC                  mov eax, dword ptr [ebp-04]
:0040D9B7 888C106B020000          mov byte ptr [eax+edx+0000026B], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040D97A(C), :0040D993(C)
|
:0040D9BE 8BE5                    mov esp, ebp
:0040D9C0 5D                      pop ebp
:0040D9C1 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0040D963   , :0040DA63   , :0040DB09   , :0040DB4C   
|
:0040D9C4 55                      push ebp
:0040D9C5 8BEC                    mov ebp, esp
:0040D9C7 51                      push ecx
:0040D9C8 894DFC                  mov dword ptr [ebp-04], ecx
:0040D9CB 8B4508                  mov eax, dword ptr [ebp+08]
:0040D9CE 25FF000000              and eax, 000000FF
:0040D9D3 83F857                  cmp eax, 00000057
:0040D9D6 7D04                    jge 0040D9DC
:0040D9D8 0CFF                    or al, FF
:0040D9DA EB0C                    jmp 0040D9E8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D9D6(C)
|
:0040D9DC 8A4D08                  mov cl, byte ptr [ebp+08]
:0040D9DF 80E957                  sub cl, 57
:0040D9E2 884D08                  mov byte ptr [ebp+08], cl
:0040D9E5 8A4508                  mov al, byte ptr [ebp+08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040D9DA(U)
|
:0040D9E8 8BE5                    mov esp, ebp
:0040D9EA 5D                      pop ebp
:0040D9EB C20400                  ret 0004



* Referenced by a CALL at Address:
|:0043E0F5   
|
:0040D9EE 55                      push ebp
:0040D9EF 8BEC                    mov ebp, esp
:0040D9F1 83EC0C                  sub esp, 0000000C
:0040D9F4 894DF4                  mov dword ptr [ebp-0C], ecx
:0040D9F7 C745FC00000000          mov [ebp-04], 00000000
:0040D9FE C645F800                mov [ebp-08], 00
:0040DA02 EB08                    jmp 0040DA0C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DA3C(U)
|
:0040DA04 8A45F8                  mov al, byte ptr [ebp-08]
:0040DA07 0401                    add al, 01
:0040DA09 8845F8                  mov byte ptr [ebp-08], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DA02(U)
|
:0040DA0C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040DA0F 81E1FF000000            and ecx, 000000FF
:0040DA15 83F911                  cmp ecx, 00000011
:0040DA18 7D24                    jge 0040DA3E
:0040DA1A 8B55F8                  mov edx, dword ptr [ebp-08]
:0040DA1D 81E2FF000000            and edx, 000000FF
:0040DA23 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040DA26 33C9                    xor ecx, ecx
:0040DA28 8A8C106B020000          mov cl, byte ptr [eax+edx+0000026B]
:0040DA2F 85C9                    test ecx, ecx
:0040DA31 7409                    je 0040DA3C
:0040DA33 C745FC01000000          mov [ebp-04], 00000001
:0040DA3A EB02                    jmp 0040DA3E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DA31(C)
|
:0040DA3C EBC6                    jmp 0040DA04

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040DA18(C), :0040DA3A(U)
|
:0040DA3E 8B45FC                  mov eax, dword ptr [ebp-04]
:0040DA41 8BE5                    mov esp, ebp
:0040DA43 5D                      pop ebp
:0040DA44 C3                      ret



* Referenced by a CALL at Addresses:
|:004145F6   , :00459C5A   , :0046B296   
|
:0040DA45 55                      push ebp
:0040DA46 8BEC                    mov ebp, esp
:0040DA48 51                      push ecx
:0040DA49 894DFC                  mov dword ptr [ebp-04], ecx
:0040DA4C 8A4508                  mov al, byte ptr [ebp+08]
:0040DA4F 50                      push eax
:0040DA50 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040DA53 E87B000000              call 0040DAD3
:0040DA58 85C0                    test eax, eax
:0040DA5A 744D                    je 0040DAA9
:0040DA5C 8A4D08                  mov cl, byte ptr [ebp+08]
:0040DA5F 51                      push ecx
:0040DA60 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040DA63 E85CFFFFFF              call 0040D9C4
:0040DA68 884508                  mov byte ptr [ebp+08], al
:0040DA6B 8B5508                  mov edx, dword ptr [ebp+08]
:0040DA6E 81E2FF000000            and edx, 000000FF
:0040DA74 8B45FC                  mov eax, dword ptr [ebp-04]
:0040DA77 8A8C106B020000          mov cl, byte ptr [eax+edx+0000026B]
:0040DA7E 80C101                  add cl, 01
:0040DA81 8B5508                  mov edx, dword ptr [ebp+08]
:0040DA84 81E2FF000000            and edx, 000000FF
:0040DA8A 8B45FC                  mov eax, dword ptr [ebp-04]
:0040DA8D 888C106B020000          mov byte ptr [eax+edx+0000026B], cl
:0040DA94 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040DA97 81E1FF000000            and ecx, 000000FF
:0040DA9D 8B55FC                  mov edx, dword ptr [ebp-04]
:0040DAA0 8A840A6B020000          mov al, byte ptr [edx+ecx+0000026B]
:0040DAA7 EB24                    jmp 0040DACD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DA5A(C)
|
:0040DAA9 6A00                    push 00000000
:0040DAAB 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040DAAE 81E1FF000000            and ecx, 000000FF
:0040DAB4 6BC919                  imul ecx, 00000019
:0040DAB7 81C140114A00            add ecx, 004A1140
:0040DABD E8E7ECFFFF              call 0040C7A9
:0040DAC2 50                      push eax
:0040DAC3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040DAC6 E822010000              call 0040DBED
:0040DACB 32C0                    xor al, al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DAA7(U)
|
:0040DACD 8BE5                    mov esp, ebp
:0040DACF 5D                      pop ebp
:0040DAD0 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0040DA53   
|
:0040DAD3 55                      push ebp
:0040DAD4 8BEC                    mov ebp, esp
:0040DAD6 51                      push ecx
:0040DAD7 894DFC                  mov dword ptr [ebp-04], ecx
:0040DADA 8A4508                  mov al, byte ptr [ebp+08]
:0040DADD 50                      push eax
:0040DADE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040DAE1 E858000000              call 0040DB3E
:0040DAE6 25FF000000              and eax, 000000FF
:0040DAEB 33C9                    xor ecx, ecx
:0040DAED 83F863                  cmp eax, 00000063
:0040DAF0 0F9CC1                  setl cl
:0040DAF3 8BC1                    mov eax, ecx
:0040DAF5 8BE5                    mov esp, ebp
:0040DAF7 5D                      pop ebp
:0040DAF8 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00468A1C   , :0046B545   
|
:0040DAFB 55                      push ebp
:0040DAFC 8BEC                    mov ebp, esp
:0040DAFE 51                      push ecx
:0040DAFF 894DFC                  mov dword ptr [ebp-04], ecx
:0040DB02 8A4508                  mov al, byte ptr [ebp+08]
:0040DB05 50                      push eax
:0040DB06 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040DB09 E8B6FEFFFF              call 0040D9C4
:0040DB0E 884508                  mov byte ptr [ebp+08], al
:0040DB11 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040DB14 81E1FF000000            and ecx, 000000FF
:0040DB1A 81F9FF000000            cmp ecx, 000000FF
:0040DB20 7416                    je 0040DB38
:0040DB22 8B5508                  mov edx, dword ptr [ebp+08]
:0040DB25 81E2FF000000            and edx, 000000FF
:0040DB2B 8B45FC                  mov eax, dword ptr [ebp-04]
:0040DB2E 8A4D0C                  mov cl, byte ptr [ebp+0C]
:0040DB31 888C106B020000          mov byte ptr [eax+edx+0000026B], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DB20(C)
|
:0040DB38 8BE5                    mov esp, ebp
:0040DB3A 5D                      pop ebp
:0040DB3B C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:00405C0B   , :0040DAE1   , :00422D00   , :00466AEB   , :0046749D   
|:004674EF   , :00467560   , :004675CC   , :00467C14   , :00467CA0   
|:0046893F   , :004689FD   , :0046B4C9   , :0046B525   , :0046E0CA   
|
:0040DB3E 55                      push ebp
:0040DB3F 8BEC                    mov ebp, esp
:0040DB41 51                      push ecx
:0040DB42 894DFC                  mov dword ptr [ebp-04], ecx
:0040DB45 8A4508                  mov al, byte ptr [ebp+08]
:0040DB48 50                      push eax
:0040DB49 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040DB4C E873FEFFFF              call 0040D9C4
:0040DB51 884508                  mov byte ptr [ebp+08], al
:0040DB54 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040DB57 81E1FF000000            and ecx, 000000FF
:0040DB5D 81F9FF000000            cmp ecx, 000000FF
:0040DB63 7415                    je 0040DB7A
:0040DB65 8B5508                  mov edx, dword ptr [ebp+08]
:0040DB68 81E2FF000000            and edx, 000000FF
:0040DB6E 8B45FC                  mov eax, dword ptr [ebp-04]
:0040DB71 8A84106B020000          mov al, byte ptr [eax+edx+0000026B]
:0040DB78 EB03                    jmp 0040DB7D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DB63(C)
|
:0040DB7A 8A4508                  mov al, byte ptr [ebp+08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DB78(U)
|
:0040DB7D 8BE5                    mov esp, ebp
:0040DB7F 5D                      pop ebp
:0040DB80 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0041BDE0   
|
:0040DB83 55                      push ebp
:0040DB84 8BEC                    mov ebp, esp
:0040DB86 51                      push ecx
:0040DB87 894DFC                  mov dword ptr [ebp-04], ecx
:0040DB8A 8B45FC                  mov eax, dword ptr [ebp-04]
:0040DB8D 33C9                    xor ecx, ecx
:0040DB8F 668B08                  mov cx, word ptr [eax]
:0040DB92 8BC1                    mov eax, ecx
:0040DB94 234508                  and eax, dword ptr [ebp+08]
:0040DB97 F7D8                    neg eax
:0040DB99 1BC0                    sbb eax, eax
:0040DB9B F7D8                    neg eax
:0040DB9D 8BE5                    mov esp, ebp
:0040DB9F 5D                      pop ebp
:0040DBA0 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0041B916   
|
:0040DBA3 55                      push ebp
:0040DBA4 8BEC                    mov ebp, esp
:0040DBA6 51                      push ecx
:0040DBA7 894DFC                  mov dword ptr [ebp-04], ecx
:0040DBAA 8B45FC                  mov eax, dword ptr [ebp-04]
:0040DBAD 33C9                    xor ecx, ecx
:0040DBAF 668B08                  mov cx, word ptr [eax]
:0040DBB2 0B4D08                  or ecx, dword ptr [ebp+08]
:0040DBB5 51                      push ecx
:0040DBB6 B970074B00              mov ecx, 004B0770
:0040DBBB E8C0050000              call 0040E180
:0040DBC0 8BE5                    mov esp, ebp
:0040DBC2 5D                      pop ebp
:0040DBC3 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0041B926   
|
:0040DBC6 55                      push ebp
:0040DBC7 8BEC                    mov ebp, esp
:0040DBC9 51                      push ecx
:0040DBCA 894DFC                  mov dword ptr [ebp-04], ecx
:0040DBCD 8B45FC                  mov eax, dword ptr [ebp-04]
:0040DBD0 33C9                    xor ecx, ecx
:0040DBD2 668B08                  mov cx, word ptr [eax]
:0040DBD5 8B5508                  mov edx, dword ptr [ebp+08]
:0040DBD8 F7D2                    not edx
:0040DBDA 23CA                    and ecx, edx
:0040DBDC 51                      push ecx
:0040DBDD B970074B00              mov ecx, 004B0770
:0040DBE2 E899050000              call 0040E180
:0040DBE7 8BE5                    mov esp, ebp
:0040DBE9 5D                      pop ebp
:0040DBEA C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0040DAC6   , :00414AC8   , :00416B25   , :00434990   , :00434B35   
|:00434D07   , :00434F6C   , :0046B19C   , :0046B59D   
|
:0040DBED 55                      push ebp
:0040DBEE 8BEC                    mov ebp, esp
:0040DBF0 51                      push ecx
:0040DBF1 894DFC                  mov dword ptr [ebp-04], ecx
:0040DBF4 683F420F00              push 000F423F
:0040DBF9 8B4508                  mov eax, dword ptr [ebp+08]
:0040DBFC 50                      push eax
:0040DBFD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040DC00 E8CB050000              call 0040E1D0
:0040DC05 50                      push eax
:0040DC06 E87E1E0700              call 0047FA89
:0040DC0B 83C40C                  add esp, 0000000C
:0040DC0E 894508                  mov dword ptr [ebp+08], eax
:0040DC11 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040DC14 51                      push ecx
:0040DC15 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040DC18 E883050000              call 0040E1A0
:0040DC1D 8BE5                    mov esp, ebp
:0040DC1F 5D                      pop ebp
:0040DC20 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00414AD8   , :00468647   , :00468A44   
|
:0040DC23 55                      push ebp
:0040DC24 8BEC                    mov ebp, esp
:0040DC26 51                      push ecx
:0040DC27 894DFC                  mov dword ptr [ebp-04], ecx
:0040DC2A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040DC2D E89E050000              call 0040E1D0
:0040DC32 394508                  cmp dword ptr [ebp+08], eax
:0040DC35 7609                    jbe 0040DC40
:0040DC37 C7450800000000          mov [ebp+08], 00000000
:0040DC3E EB0E                    jmp 0040DC4E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DC35(C)
|
:0040DC40 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040DC43 E888050000              call 0040E1D0
:0040DC48 2B4508                  sub eax, dword ptr [ebp+08]
:0040DC4B 894508                  mov dword ptr [ebp+08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DC3E(U)
|
:0040DC4E 8B4508                  mov eax, dword ptr [ebp+08]
:0040DC51 50                      push eax
:0040DC52 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040DC55 E846050000              call 0040E1A0
:0040DC5A 8BE5                    mov esp, ebp
:0040DC5C 5D                      pop ebp
:0040DC5D C20400                  ret 0004



* Referenced by a CALL at Address:
|:0041AF69   
|
:0040DC60 55                      push ebp
:0040DC61 8BEC                    mov ebp, esp
:0040DC63 51                      push ecx
:0040DC64 894DFC                  mov dword ptr [ebp-04], ecx
:0040DC67 8B45FC                  mov eax, dword ptr [ebp-04]
:0040DC6A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040DC6D 8A11                    mov dl, byte ptr [ecx]
:0040DC6F 8810                    mov byte ptr [eax], dl
:0040DC71 8B4508                  mov eax, dword ptr [ebp+08]
:0040DC74 83C001                  add eax, 00000001
:0040DC77 894508                  mov dword ptr [ebp+08], eax
:0040DC7A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040DC7D 8B5508                  mov edx, dword ptr [ebp+08]
:0040DC80 8A02                    mov al, byte ptr [edx]
:0040DC82 884101                  mov byte ptr [ecx+01], al
:0040DC85 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040DC88 83C101                  add ecx, 00000001
:0040DC8B 894D08                  mov dword ptr [ebp+08], ecx
:0040DC8E 8B4508                  mov eax, dword ptr [ebp+08]
:0040DC91 8BE5                    mov esp, ebp
:0040DC93 5D                      pop ebp
:0040DC94 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0041B309   
|
:0040DC97 55                      push ebp
:0040DC98 8BEC                    mov ebp, esp
:0040DC9A 51                      push ecx
:0040DC9B 894DFC                  mov dword ptr [ebp-04], ecx
:0040DC9E 8B4508                  mov eax, dword ptr [ebp+08]
:0040DCA1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040DCA4 8A11                    mov dl, byte ptr [ecx]
:0040DCA6 8810                    mov byte ptr [eax], dl
:0040DCA8 8B4508                  mov eax, dword ptr [ebp+08]
:0040DCAB 83C001                  add eax, 00000001
:0040DCAE 894508                  mov dword ptr [ebp+08], eax
:0040DCB1 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040DCB4 8B55FC                  mov edx, dword ptr [ebp-04]
:0040DCB7 8A4201                  mov al, byte ptr [edx+01]
:0040DCBA 8801                    mov byte ptr [ecx], al
:0040DCBC 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040DCBF 83C101                  add ecx, 00000001
:0040DCC2 894D08                  mov dword ptr [ebp+08], ecx
:0040DCC5 8B4508                  mov eax, dword ptr [ebp+08]
:0040DCC8 8BE5                    mov esp, ebp
:0040DCCA 5D                      pop ebp
:0040DCCB C20400                  ret 0004



* Referenced by a CALL at Address:
|:0041B841   
|
:0040DCCE 55                      push ebp
:0040DCCF 8BEC                    mov ebp, esp
:0040DCD1 83EC08                  sub esp, 00000008
:0040DCD4 894DF8                  mov dword ptr [ebp-08], ecx
:0040DCD7 8B4508                  mov eax, dword ptr [ebp+08]
:0040DCDA 33C9                    xor ecx, ecx
:0040DCDC 8A08                    mov cl, byte ptr [eax]
:0040DCDE 894DFC                  mov dword ptr [ebp-04], ecx
:0040DCE1 8B5508                  mov edx, dword ptr [ebp+08]
:0040DCE4 83C201                  add edx, 00000001
:0040DCE7 895508                  mov dword ptr [ebp+08], edx
:0040DCEA 8B4508                  mov eax, dword ptr [ebp+08]
:0040DCED 33C9                    xor ecx, ecx
:0040DCEF 8A08                    mov cl, byte ptr [eax]
:0040DCF1 C1E108                  shl ecx, 08
:0040DCF4 8B55FC                  mov edx, dword ptr [ebp-04]
:0040DCF7 03D1                    add edx, ecx
:0040DCF9 8955FC                  mov dword ptr [ebp-04], edx
:0040DCFC 8B4508                  mov eax, dword ptr [ebp+08]
:0040DCFF 83C001                  add eax, 00000001
:0040DD02 894508                  mov dword ptr [ebp+08], eax
:0040DD05 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040DD08 8B55FC                  mov edx, dword ptr [ebp-04]
:0040DD0B 8911                    mov dword ptr [ecx], edx
:0040DD0D 8B4508                  mov eax, dword ptr [ebp+08]
:0040DD10 33C9                    xor ecx, ecx
:0040DD12 8A08                    mov cl, byte ptr [eax]
:0040DD14 894DFC                  mov dword ptr [ebp-04], ecx
:0040DD17 8B5508                  mov edx, dword ptr [ebp+08]
:0040DD1A 83C201                  add edx, 00000001
:0040DD1D 895508                  mov dword ptr [ebp+08], edx
:0040DD20 8B4508                  mov eax, dword ptr [ebp+08]
:0040DD23 33C9                    xor ecx, ecx
:0040DD25 8A08                    mov cl, byte ptr [eax]
:0040DD27 C1E108                  shl ecx, 08
:0040DD2A 8B55FC                  mov edx, dword ptr [ebp-04]
:0040DD2D 03D1                    add edx, ecx
:0040DD2F 8955FC                  mov dword ptr [ebp-04], edx
:0040DD32 8B4508                  mov eax, dword ptr [ebp+08]
:0040DD35 83C001                  add eax, 00000001
:0040DD38 894508                  mov dword ptr [ebp+08], eax
:0040DD3B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040DD3E 8B55FC                  mov edx, dword ptr [ebp-04]
:0040DD41 895104                  mov dword ptr [ecx+04], edx
:0040DD44 C745FC00000000          mov [ebp-04], 00000000
:0040DD4B EB09                    jmp 0040DD56

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DD73(U)
|
:0040DD4D 8B45FC                  mov eax, dword ptr [ebp-04]
:0040DD50 83C001                  add eax, 00000001
:0040DD53 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DD4B(U)
|
:0040DD56 837DFC10                cmp dword ptr [ebp-04], 00000010
:0040DD5A 7319                    jnb 0040DD75
:0040DD5C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040DD5F 034DFC                  add ecx, dword ptr [ebp-04]
:0040DD62 8B5508                  mov edx, dword ptr [ebp+08]
:0040DD65 8A02                    mov al, byte ptr [edx]
:0040DD67 884108                  mov byte ptr [ecx+08], al
:0040DD6A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040DD6D 83C101                  add ecx, 00000001
:0040DD70 894D08                  mov dword ptr [ebp+08], ecx
:0040DD73 EBD8                    jmp 0040DD4D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DD5A(C)
|
:0040DD75 C745FC00000000          mov [ebp-04], 00000000
:0040DD7C EB09                    jmp 0040DD87

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DDA4(U)
|
:0040DD7E 8B55FC                  mov edx, dword ptr [ebp-04]
:0040DD81 83C201                  add edx, 00000001
:0040DD84 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DD7C(U)
|
:0040DD87 837DFC10                cmp dword ptr [ebp-04], 00000010
:0040DD8B 7319                    jnb 0040DDA6
:0040DD8D 8B45F8                  mov eax, dword ptr [ebp-08]
:0040DD90 0345FC                  add eax, dword ptr [ebp-04]
:0040DD93 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040DD96 8A11                    mov dl, byte ptr [ecx]
:0040DD98 885018                  mov byte ptr [eax+18], dl
:0040DD9B 8B4508                  mov eax, dword ptr [ebp+08]
:0040DD9E 83C001                  add eax, 00000001
:0040DDA1 894508                  mov dword ptr [ebp+08], eax
:0040DDA4 EBD8                    jmp 0040DD7E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DD8B(C)
|
:0040DDA6 8B4508                  mov eax, dword ptr [ebp+08]
:0040DDA9 8BE5                    mov esp, ebp
:0040DDAB 5D                      pop ebp
:0040DDAC C20400                  ret 0004



* Referenced by a CALL at Address:
|:0041B8A1   
|
:0040DDAF 55                      push ebp
:0040DDB0 8BEC                    mov ebp, esp
:0040DDB2 83EC0C                  sub esp, 0000000C
:0040DDB5 894DF4                  mov dword ptr [ebp-0C], ecx
:0040DDB8 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040DDBB 8945FC                  mov dword ptr [ebp-04], eax
:0040DDBE C745F800000000          mov [ebp-08], 00000000
:0040DDC5 EB09                    jmp 0040DDD0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DDF2(U)
|
:0040DDC7 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040DDCA 83C101                  add ecx, 00000001
:0040DDCD 894DF8                  mov dword ptr [ebp-08], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DDC5(U)
|
:0040DDD0 837DF80A                cmp dword ptr [ebp-08], 0000000A
:0040DDD4 731E                    jnb 0040DDF4
:0040DDD6 8B55FC                  mov edx, dword ptr [ebp-04]
:0040DDD9 8B4508                  mov eax, dword ptr [ebp+08]
:0040DDDC 8A08                    mov cl, byte ptr [eax]
:0040DDDE 880A                    mov byte ptr [edx], cl
:0040DDE0 8B55FC                  mov edx, dword ptr [ebp-04]
:0040DDE3 83C201                  add edx, 00000001
:0040DDE6 8955FC                  mov dword ptr [ebp-04], edx
:0040DDE9 8B4508                  mov eax, dword ptr [ebp+08]
:0040DDEC 83C001                  add eax, 00000001
:0040DDEF 894508                  mov dword ptr [ebp+08], eax
:0040DDF2 EBD3                    jmp 0040DDC7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DDD4(C)
|
:0040DDF4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040DDF7 C60100                  mov byte ptr [ecx], 00
:0040DDFA 8B5508                  mov edx, dword ptr [ebp+08]
:0040DDFD 83C201                  add edx, 00000001
:0040DE00 895508                  mov dword ptr [ebp+08], edx
:0040DE03 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040DE06 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040DE09 8A11                    mov dl, byte ptr [ecx]
:0040DE0B 88500F                  mov byte ptr [eax+0F], dl
:0040DE0E 8B4508                  mov eax, dword ptr [ebp+08]
:0040DE11 83C001                  add eax, 00000001
:0040DE14 894508                  mov dword ptr [ebp+08], eax
:0040DE17 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040DE1A 8B5508                  mov edx, dword ptr [ebp+08]
:0040DE1D 8A02                    mov al, byte ptr [edx]
:0040DE1F 88410B                  mov byte ptr [ecx+0B], al
:0040DE22 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040DE25 83C101                  add ecx, 00000001
:0040DE28 894D08                  mov dword ptr [ebp+08], ecx
:0040DE2B 8B55F4                  mov edx, dword ptr [ebp-0C]
:0040DE2E 8B4508                  mov eax, dword ptr [ebp+08]
:0040DE31 8A08                    mov cl, byte ptr [eax]
:0040DE33 884A0C                  mov byte ptr [edx+0C], cl
:0040DE36 8B5508                  mov edx, dword ptr [ebp+08]
:0040DE39 83C201                  add edx, 00000001
:0040DE3C 895508                  mov dword ptr [ebp+08], edx
:0040DE3F 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040DE42 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040DE45 8A11                    mov dl, byte ptr [ecx]
:0040DE47 88500D                  mov byte ptr [eax+0D], dl
:0040DE4A 8B4508                  mov eax, dword ptr [ebp+08]
:0040DE4D 83C001                  add eax, 00000001
:0040DE50 894508                  mov dword ptr [ebp+08], eax
:0040DE53 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040DE56 8B5508                  mov edx, dword ptr [ebp+08]
:0040DE59 8A02                    mov al, byte ptr [edx]
:0040DE5B 88410E                  mov byte ptr [ecx+0E], al
:0040DE5E 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040DE61 83C101                  add ecx, 00000001
:0040DE64 894D08                  mov dword ptr [ebp+08], ecx
:0040DE67 8B55F4                  mov edx, dword ptr [ebp-0C]
:0040DE6A 8B4508                  mov eax, dword ptr [ebp+08]
:0040DE6D 8A08                    mov cl, byte ptr [eax]
:0040DE6F 884A10                  mov byte ptr [edx+10], cl
:0040DE72 8B5508                  mov edx, dword ptr [ebp+08]
:0040DE75 83C201                  add edx, 00000001
:0040DE78 895508                  mov dword ptr [ebp+08], edx
:0040DE7B C745F800000000          mov [ebp-08], 00000000
:0040DE82 EB09                    jmp 0040DE8D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DEAA(U)
|
:0040DE84 8B45F8                  mov eax, dword ptr [ebp-08]
:0040DE87 83C001                  add eax, 00000001
:0040DE8A 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DE82(U)
|
:0040DE8D 837DF835                cmp dword ptr [ebp-08], 00000035
:0040DE91 7319                    jnb 0040DEAC
:0040DE93 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040DE96 034DF8                  add ecx, dword ptr [ebp-08]
:0040DE99 8B5508                  mov edx, dword ptr [ebp+08]
:0040DE9C 8A02                    mov al, byte ptr [edx]
:0040DE9E 884111                  mov byte ptr [ecx+11], al
:0040DEA1 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040DEA4 83C101                  add ecx, 00000001
:0040DEA7 894D08                  mov dword ptr [ebp+08], ecx
:0040DEAA EBD8                    jmp 0040DE84

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040DE91(C)
|
:0040DEAC 8B4508                  mov eax, dword ptr [ebp+08]
:0040DEAF 8BE5                    mov esp, ebp
:0040DEB1 5D                      pop ebp
:0040DEB2 C20400                  ret 0004


:0040DEB5 CC                      int 03
:0040DEB6 CC                      int 03
:0040DEB7 CC                      int 03
:0040DEB8 CC                      int 03
:0040DEB9 CC                      int 03
:0040DEBA CC                      int 03
:0040DEBB CC                      int 03
:0040DEBC CC                      int 03
:0040DEBD CC                      int 03
:0040DEBE CC                      int 03
:0040DEBF CC                      int 03

* Referenced by a CALL at Address:
|:0040BF15   
|
:0040DEC0 55                      push ebp
:0040DEC1 8BEC                    mov ebp, esp
:0040DEC3 6AFF                    push FFFFFFFF
:0040DEC5 6849504800              push 00485049
:0040DECA 64A100000000            mov eax, dword ptr fs:[00000000]
:0040DED0 50                      push eax
:0040DED1 64892500000000          mov dword ptr fs:[00000000], esp
:0040DED8 51                      push ecx
:0040DED9 894DF0                  mov dword ptr [ebp-10], ecx
:0040DEDC 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040DEDF E88C000000              call 0040DF70
:0040DEE4 C745FC00000000          mov [ebp-04], 00000000
:0040DEEB 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040DEEE 83C12C                  add ecx, 0000002C
:0040DEF1 E82C540500              call 00463322
:0040DEF6 8B45F0                  mov eax, dword ptr [ebp-10]
:0040DEF9 C70058644800            mov dword ptr [eax], 00486458
:0040DEFF C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0040DF06 8B45F0                  mov eax, dword ptr [ebp-10]
:0040DF09 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040DF0C 64890D00000000          mov dword ptr fs:[00000000], ecx
:0040DF13 8BE5                    mov esp, ebp
:0040DF15 5D                      pop ebp
:0040DF16 C3                      ret


:0040DF17 CC                      int 03
:0040DF18 CC                      int 03
:0040DF19 CC                      int 03
:0040DF1A CC                      int 03
:0040DF1B CC                      int 03
:0040DF1C CC                      int 03
:0040DF1D CC                      int 03
:0040DF1E CC                      int 03
:0040DF1F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040BF43   , :00485013   
|
:0040DF20 55                      push ebp
:0040DF21 8BEC                    mov ebp, esp
:0040DF23 6AFF                    push FFFFFFFF
:0040DF25 6869504800              push 00485069
:0040DF2A 64A100000000            mov eax, dword ptr fs:[00000000]
:0040DF30 50                      push eax
:0040DF31 64892500000000          mov dword ptr fs:[00000000], esp
:0040DF38 51                      push ecx
:0040DF39 894DF0                  mov dword ptr [ebp-10], ecx
:0040DF3C C745FC00000000          mov [ebp-04], 00000000
:0040DF43 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040DF46 83C12C                  add ecx, 0000002C
:0040DF49 E8A2020000              call 0040E1F0
:0040DF4E C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0040DF55 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040DF58 E833000000              call 0040DF90
:0040DF5D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040DF60 64890D00000000          mov dword ptr fs:[00000000], ecx
:0040DF67 8BE5                    mov esp, ebp
:0040DF69 5D                      pop ebp
:0040DF6A C3                      ret


:0040DF6B CC                      int 03
:0040DF6C CC                      int 03
:0040DF6D CC                      int 03
:0040DF6E CC                      int 03
:0040DF6F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040DEDF   , :0047297F   
|
:0040DF70 55                      push ebp
:0040DF71 8BEC                    mov ebp, esp
:0040DF73 51                      push ecx
:0040DF74 894DFC                  mov dword ptr [ebp-04], ecx
:0040DF77 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040DF7A E861040000              call 0040E3E0
:0040DF7F 8B45FC                  mov eax, dword ptr [ebp-04]
:0040DF82 C70080644800            mov dword ptr [eax], 00486480
:0040DF88 8B45FC                  mov eax, dword ptr [ebp-04]
:0040DF8B 8BE5                    mov esp, ebp
:0040DF8D 5D                      pop ebp
:0040DF8E C3                      ret


:0040DF8F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040DF58   , :0046DA8F   , :004729FB   , :00472F1D   , :00485043   
|:00485063   , :00485940   , :00485A73   , :00485A93   
|
:0040DF90 55                      push ebp
:0040DF91 8BEC                    mov ebp, esp
:0040DF93 51                      push ecx
:0040DF94 894DFC                  mov dword ptr [ebp-04], ecx
:0040DF97 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040DF9A E8C1040000              call 0040E460
:0040DF9F 8BE5                    mov esp, ebp
:0040DFA1 5D                      pop ebp
:0040DFA2 C3                      ret


:0040DFA3 CC                      int 03
:0040DFA4 CC                      int 03
:0040DFA5 CC                      int 03
:0040DFA6 CC                      int 03
:0040DFA7 CC                      int 03
:0040DFA8 CC                      int 03
:0040DFA9 CC                      int 03
:0040DFAA CC                      int 03
:0040DFAB CC                      int 03
:0040DFAC CC                      int 03
:0040DFAD CC                      int 03
:0040DFAE CC                      int 03
:0040DFAF CC                      int 03

* Referenced by a CALL at Addresses:
|:0040C3B5   , :0040C52E   , :0043F980   , :0045A4EA   , :0045A5A8   
|:0045A5C5   
|
:0040DFB0 55                      push ebp
:0040DFB1 8BEC                    mov ebp, esp
:0040DFB3 51                      push ecx
:0040DFB4 894DFC                  mov dword ptr [ebp-04], ecx
:0040DFB7 8B45FC                  mov eax, dword ptr [ebp-04]
:0040DFBA 8A4D08                  mov cl, byte ptr [ebp+08]
:0040DFBD 88482A                  mov byte ptr [eax+2A], cl
:0040DFC0 8BE5                    mov esp, ebp
:0040DFC2 5D                      pop ebp
:0040DFC3 C20400                  ret 0004


:0040DFC6 CC                      int 03
:0040DFC7 CC                      int 03
:0040DFC8 CC                      int 03
:0040DFC9 CC                      int 03
:0040DFCA CC                      int 03
:0040DFCB CC                      int 03
:0040DFCC CC                      int 03
:0040DFCD CC                      int 03
:0040DFCE CC                      int 03
:0040DFCF CC                      int 03

* Referenced by a CALL at Address:
|:0040C084   
|
:0040DFD0 55                      push ebp
:0040DFD1 8BEC                    mov ebp, esp
:0040DFD3 51                      push ecx
:0040DFD4 894DFC                  mov dword ptr [ebp-04], ecx
:0040DFD7 8B45FC                  mov eax, dword ptr [ebp-04]
:0040DFDA 8A4026                  mov al, byte ptr [eax+26]
:0040DFDD 8BE5                    mov esp, ebp
:0040DFDF 5D                      pop ebp
:0040DFE0 C3                      ret


:0040DFE1 CC                      int 03
:0040DFE2 CC                      int 03
:0040DFE3 CC                      int 03
:0040DFE4 CC                      int 03
:0040DFE5 CC                      int 03
:0040DFE6 CC                      int 03
:0040DFE7 CC                      int 03
:0040DFE8 CC                      int 03
:0040DFE9 CC                      int 03
:0040DFEA CC                      int 03
:0040DFEB CC                      int 03
:0040DFEC CC                      int 03
:0040DFED CC                      int 03
:0040DFEE CC                      int 03
:0040DFEF CC                      int 03

* Referenced by a CALL at Addresses:
|:0040C4EF   , :00414DCD   , :0041D784   , :0044293E   , :00442970   
|:00442995   
|
:0040DFF0 55                      push ebp
:0040DFF1 8BEC                    mov ebp, esp
:0040DFF3 51                      push ecx
:0040DFF4 894DFC                  mov dword ptr [ebp-04], ecx
:0040DFF7 8B45FC                  mov eax, dword ptr [ebp-04]
:0040DFFA 8A4D08                  mov cl, byte ptr [ebp+08]
:0040DFFD 88482B                  mov byte ptr [eax+2B], cl
:0040E000 8BE5                    mov esp, ebp
:0040E002 5D                      pop ebp
:0040E003 C20400                  ret 0004


:0040E006 CC                      int 03
:0040E007 CC                      int 03
:0040E008 CC                      int 03
:0040E009 CC                      int 03
:0040E00A CC                      int 03
:0040E00B CC                      int 03
:0040E00C CC                      int 03
:0040E00D CC                      int 03
:0040E00E CC                      int 03
:0040E00F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040C4C3   , :004429A1   
|
:0040E010 55                      push ebp
:0040E011 8BEC                    mov ebp, esp
:0040E013 51                      push ecx
:0040E014 894DFC                  mov dword ptr [ebp-04], ecx
:0040E017 8B45FC                  mov eax, dword ptr [ebp-04]
:0040E01A 8A4D08                  mov cl, byte ptr [ebp+08]
:0040E01D 88482C                  mov byte ptr [eax+2C], cl
:0040E020 8BE5                    mov esp, ebp
:0040E022 5D                      pop ebp
:0040E023 C20400                  ret 0004


:0040E026 CC                      int 03
:0040E027 CC                      int 03
:0040E028 CC                      int 03
:0040E029 CC                      int 03
:0040E02A CC                      int 03
:0040E02B CC                      int 03
:0040E02C CC                      int 03
:0040E02D CC                      int 03
:0040E02E CC                      int 03
:0040E02F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040C2E8   , :0040C303   , :0040C31E   , :00414E08   
|
:0040E030 55                      push ebp
:0040E031 8BEC                    mov ebp, esp
:0040E033 51                      push ecx
:0040E034 894DFC                  mov dword ptr [ebp-04], ecx
:0040E037 8B450C                  mov eax, dword ptr [ebp+0C]
:0040E03A 25FF000000              and eax, 000000FF
:0040E03F 6BC003                  imul eax, 00000003
:0040E042 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040E045 8D54012E                lea edx, dword ptr [ecx+eax+2E]
:0040E049 8B4508                  mov eax, dword ptr [ebp+08]
:0040E04C 668B0A                  mov cx, word ptr [edx]
:0040E04F 668908                  mov word ptr [eax], cx
:0040E052 8A5202                  mov dl, byte ptr [edx+02]
:0040E055 885002                  mov byte ptr [eax+02], dl
:0040E058 8B4508                  mov eax, dword ptr [ebp+08]
:0040E05B 8BE5                    mov esp, ebp
:0040E05D 5D                      pop ebp
:0040E05E C20800                  ret 0008


:0040E061 CC                      int 03
:0040E062 CC                      int 03
:0040E063 CC                      int 03
:0040E064 CC                      int 03
:0040E065 CC                      int 03
:0040E066 CC                      int 03
:0040E067 CC                      int 03
:0040E068 CC                      int 03
:0040E069 CC                      int 03
:0040E06A CC                      int 03
:0040E06B CC                      int 03
:0040E06C CC                      int 03
:0040E06D CC                      int 03
:0040E06E CC                      int 03
:0040E06F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040C9BC   , :004673EF   , :00467408   , :00467ADA   , :00467B0A   
|:004684FC   , :004685BB   , :004686B1   , :004686CB   , :004688B8   
|:0046891F   , :00468AB7   , :00468AD4   , :00468C4A   , :0046DE0A   
|:0046E2BD   
|
:0040E070 55                      push ebp
:0040E071 8BEC                    mov ebp, esp
:0040E073 51                      push ecx
:0040E074 894DFC                  mov dword ptr [ebp-04], ecx
:0040E077 8B45FC                  mov eax, dword ptr [ebp-04]
:0040E07A 33C9                    xor ecx, ecx
:0040E07C 8A4812                  mov cl, byte ptr [eax+12]
:0040E07F 8BC1                    mov eax, ecx
:0040E081 6BC064                  imul eax, 00000064
:0040E084 8BE5                    mov esp, ebp
:0040E086 5D                      pop ebp
:0040E087 C3                      ret


:0040E088 CC                      int 03
:0040E089 CC                      int 03
:0040E08A CC                      int 03
:0040E08B CC                      int 03
:0040E08C CC                      int 03
:0040E08D CC                      int 03
:0040E08E CC                      int 03
:0040E08F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040C443   , :0040C463   , :0041AEE6   , :004288FD   , :0042BA81   
|:0042EC45   , :0042ECA4   , :0043A2C3   , :0043FD7B   , :0043FD9F   
|:0043FDD8   , :0043FDFC   , :0043FEF4   , :0044241B   , :004424C6   
|:0044A8EF   , :0044C216   , :0044C342   , :0044CCAD   , :0044CDC5   
|:0044CF2F   , :00453A0D   , :00453A5D   , :0045587A   , :00455947   
|:0045726B   , :00459349   , :0045C20D   , :0045C724   , :0046A08A   
|:0046D7C5   , :00473F19   , :0047401A   , :004788F7   
|
:0040E090 55                      push ebp
:0040E091 8BEC                    mov ebp, esp
:0040E093 51                      push ecx
:0040E094 894DFC                  mov dword ptr [ebp-04], ecx
:0040E097 6A04                    push 00000004
:0040E099 6A00                    push 00000000
:0040E09B 6A00                    push 00000000
:0040E09D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040E0A0 E89B190700              call 0047FA40
:0040E0A5 8BE5                    mov esp, ebp
:0040E0A7 5D                      pop ebp
:0040E0A8 C3                      ret


:0040E0A9 CC                      int 03
:0040E0AA CC                      int 03
:0040E0AB CC                      int 03
:0040E0AC CC                      int 03
:0040E0AD CC                      int 03
:0040E0AE CC                      int 03
:0040E0AF CC                      int 03

* Referenced by a CALL at Address:
|:0040D7C6   
|
:0040E0B0 55                      push ebp
:0040E0B1 8BEC                    mov ebp, esp
:0040E0B3 6AFF                    push FFFFFFFF
:0040E0B5 688C504800              push 0048508C
:0040E0BA 64A100000000            mov eax, dword ptr fs:[00000000]
:0040E0C0 50                      push eax
:0040E0C1 64892500000000          mov dword ptr fs:[00000000], esp
:0040E0C8 51                      push ecx
:0040E0C9 894DF0                  mov dword ptr [ebp-10], ecx
:0040E0CC 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040E0CF E8CC020000              call 0040E3A0
:0040E0D4 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040E0D7 83C114                  add ecx, 00000014
:0040E0DA E831010000              call 0040E210
:0040E0DF C745FC00000000          mov [ebp-04], 00000000
:0040E0E6 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040E0E9 81C1A8060000            add ecx, 000006A8
:0040E0EF E89C010000              call 0040E290
:0040E0F4 8B45F0                  mov eax, dword ptr [ebp-10]
:0040E0F7 C700A8644800            mov dword ptr [eax], 004864A8
:0040E0FD C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0040E104 8B45F0                  mov eax, dword ptr [ebp-10]
:0040E107 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040E10A 64890D00000000          mov dword ptr fs:[00000000], ecx
:0040E111 8BE5                    mov esp, ebp
:0040E113 5D                      pop ebp
:0040E114 C3                      ret


:0040E115 CC                      int 03
:0040E116 CC                      int 03
:0040E117 CC                      int 03
:0040E118 CC                      int 03
:0040E119 CC                      int 03
:0040E11A CC                      int 03
:0040E11B CC                      int 03
:0040E11C CC                      int 03
:0040E11D CC                      int 03
:0040E11E CC                      int 03
:0040E11F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040D8F5   , :00485029   
|
:0040E120 55                      push ebp
:0040E121 8BEC                    mov ebp, esp
:0040E123 6AFF                    push FFFFFFFF
:0040E125 68AC504800              push 004850AC
:0040E12A 64A100000000            mov eax, dword ptr fs:[00000000]
:0040E130 50                      push eax
:0040E131 64892500000000          mov dword ptr fs:[00000000], esp
:0040E138 51                      push ecx
:0040E139 894DF0                  mov dword ptr [ebp-10], ecx
:0040E13C C745FC00000000          mov [ebp-04], 00000000
:0040E143 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040E146 81C1A8060000            add ecx, 000006A8
:0040E14C E89F000000              call 0040E1F0
:0040E151 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0040E158 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040E15B 83C114                  add ecx, 00000014
:0040E15E E82D760600              call 00475790
:0040E163 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040E166 64890D00000000          mov dword ptr fs:[00000000], ecx
:0040E16D 8BE5                    mov esp, ebp
:0040E16F 5D                      pop ebp
:0040E170 C3                      ret


:0040E171 CC                      int 03
:0040E172 CC                      int 03
:0040E173 CC                      int 03
:0040E174 CC                      int 03
:0040E175 CC                      int 03
:0040E176 CC                      int 03
:0040E177 CC                      int 03
:0040E178 CC                      int 03
:0040E179 CC                      int 03
:0040E17A CC                      int 03
:0040E17B CC                      int 03
:0040E17C CC                      int 03
:0040E17D CC                      int 03
:0040E17E CC                      int 03
:0040E17F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040DBBB   , :0040DBE2   , :004181BB   , :004181FE   , :0041822B   
|:00418260   , :00418297   , :00428CCF   , :0042925B   
|
:0040E180 55                      push ebp
:0040E181 8BEC                    mov ebp, esp
:0040E183 51                      push ecx
:0040E184 894DFC                  mov dword ptr [ebp-04], ecx
:0040E187 8B45FC                  mov eax, dword ptr [ebp-04]
:0040E18A 668B4D08                mov cx, word ptr [ebp+08]
:0040E18E 668908                  mov word ptr [eax], cx
:0040E191 8BE5                    mov esp, ebp
:0040E193 5D                      pop ebp
:0040E194 C20400                  ret 0004


:0040E197 CC                      int 03
:0040E198 CC                      int 03
:0040E199 CC                      int 03
:0040E19A CC                      int 03
:0040E19B CC                      int 03
:0040E19C CC                      int 03
:0040E19D CC                      int 03
:0040E19E CC                      int 03
:0040E19F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040DC18   , :0040DC55   , :00414AB8   
|
:0040E1A0 55                      push ebp
:0040E1A1 8BEC                    mov ebp, esp
:0040E1A3 83EC08                  sub esp, 00000008
:0040E1A6 894DFC                  mov dword ptr [ebp-04], ecx
:0040E1A9 817D083F420F00          cmp dword ptr [ebp+08], 000F423F
:0040E1B0 7708                    ja 0040E1BA
:0040E1B2 8B4508                  mov eax, dword ptr [ebp+08]
:0040E1B5 8945F8                  mov dword ptr [ebp-08], eax
:0040E1B8 EB07                    jmp 0040E1C1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E1B0(C)
|
:0040E1BA C745F83F420F00          mov [ebp-08], 000F423F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E1B8(U)
|
:0040E1C1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040E1C4 8B55F8                  mov edx, dword ptr [ebp-08]
:0040E1C7 89510C                  mov dword ptr [ecx+0C], edx
:0040E1CA 8BE5                    mov esp, ebp
:0040E1CC 5D                      pop ebp
:0040E1CD C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0040DC00   , :0040DC2D   , :0040DC43   , :00411976   , :00467AC3   
|:00468509   , :00468636   , :00468651   , :004688C4   , :0046892C   
|:00468A30   , :00468A4E   , :00468C56   , :0046AEDD   , :0046B07B   
|:0046B1A8   , :0046B4B6   , :0046B5A9   , :0046B956   , :0046F171   
|:004789B2   
|
:0040E1D0 55                      push ebp
:0040E1D1 8BEC                    mov ebp, esp
:0040E1D3 51                      push ecx
:0040E1D4 894DFC                  mov dword ptr [ebp-04], ecx
:0040E1D7 8B45FC                  mov eax, dword ptr [ebp-04]
:0040E1DA 8B400C                  mov eax, dword ptr [eax+0C]
:0040E1DD 8BE5                    mov esp, ebp
:0040E1DF 5D                      pop ebp
:0040E1E0 C3                      ret


:0040E1E1 CC                      int 03
:0040E1E2 CC                      int 03
:0040E1E3 CC                      int 03
:0040E1E4 CC                      int 03
:0040E1E5 CC                      int 03
:0040E1E6 CC                      int 03
:0040E1E7 CC                      int 03
:0040E1E8 CC                      int 03
:0040E1E9 CC                      int 03
:0040E1EA CC                      int 03
:0040E1EB CC                      int 03
:0040E1EC CC                      int 03
:0040E1ED CC                      int 03
:0040E1EE CC                      int 03
:0040E1EF CC                      int 03

* Referenced by a CALL at Addresses:
|:0040DF49   , :0040E14C   , :00463CD9   , :004726FC   , :0047277C   
|:004729EC   , :00472E0C   , :004756EA   , :0047588D   , :00476E90   
|:00476E9A   , :00476EA4   , :0047915D   , :0047B06D   , :0047B219   
|:00485832   , :004858CA   , :00485BA6   , :00485BD6   , :00485C03   
|:00485C53   , :00485CE3   , :00485D13   
|
:0040E1F0 55                      push ebp
:0040E1F1 8BEC                    mov ebp, esp
:0040E1F3 51                      push ecx
:0040E1F4 894DFC                  mov dword ptr [ebp-04], ecx
:0040E1F7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040E1FA E8A0450500              call 0046279F
:0040E1FF 8BE5                    mov esp, ebp
:0040E201 5D                      pop ebp
:0040E202 C3                      ret


:0040E203 CC                      int 03
:0040E204 CC                      int 03
:0040E205 CC                      int 03
:0040E206 CC                      int 03
:0040E207 CC                      int 03
:0040E208 CC                      int 03
:0040E209 CC                      int 03
:0040E20A CC                      int 03
:0040E20B CC                      int 03
:0040E20C CC                      int 03
:0040E20D CC                      int 03
:0040E20E CC                      int 03
:0040E20F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040E0DA   , :004728E2   
|
:0040E210 55                      push ebp
:0040E211 8BEC                    mov ebp, esp
:0040E213 51                      push ecx
:0040E214 894DFC                  mov dword ptr [ebp-04], ecx
:0040E217 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040E21A E831000000              call 0040E250
:0040E21F 8B45FC                  mov eax, dword ptr [ebp-04]
:0040E222 C700D0644800            mov dword ptr [eax], 004864D0
:0040E228 8B45FC                  mov eax, dword ptr [ebp-04]
:0040E22B 8BE5                    mov esp, ebp
:0040E22D 5D                      pop ebp
:0040E22E C3                      ret


:0040E22F CC                      int 03
:0040E230 55                      push ebp
:0040E231 8BEC                    mov ebp, esp
:0040E233 51                      push ecx
:0040E234 894DFC                  mov dword ptr [ebp-04], ecx
:0040E237 B888694800              mov eax, 00486988
:0040E23C 8BE5                    mov esp, ebp
:0040E23E 5D                      pop ebp
:0040E23F C3                      ret


:0040E240 55                      push ebp
:0040E241 8BEC                    mov ebp, esp
:0040E243 51                      push ecx
:0040E244 894DFC                  mov dword ptr [ebp-04], ecx
:0040E247 8BE5                    mov esp, ebp
:0040E249 5D                      pop ebp
:0040E24A C20400                  ret 0004


:0040E24D CC                      int 03
:0040E24E CC                      int 03
:0040E24F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040E21A   , :0043E41A   , :0047294A   , :00472CCF   , :00472D4A   
|:00472D8A   , :0047303A   , :0047306A   
|
:0040E250 55                      push ebp
:0040E251 8BEC                    mov ebp, esp
:0040E253 51                      push ecx
:0040E254 894DFC                  mov dword ptr [ebp-04], ecx
:0040E257 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040E25A E84E590500              call 00463BAD
:0040E25F 8B45FC                  mov eax, dword ptr [ebp-04]
:0040E262 C70028654800            mov dword ptr [eax], 00486528
:0040E268 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040E26B 8B55FC                  mov edx, dword ptr [ebp-04]
:0040E26E 8B4228                  mov eax, dword ptr [edx+28]
:0040E271 89412C                  mov dword ptr [ecx+2C], eax
:0040E274 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040E277 8B55FC                  mov edx, dword ptr [ebp-04]
:0040E27A 8B4230                  mov eax, dword ptr [edx+30]
:0040E27D 894134                  mov dword ptr [ecx+34], eax
:0040E280 8B45FC                  mov eax, dword ptr [ebp-04]
:0040E283 8BE5                    mov esp, ebp
:0040E285 5D                      pop ebp
:0040E286 C3                      ret


:0040E287 CC                      int 03
:0040E288 CC                      int 03
:0040E289 CC                      int 03
:0040E28A CC                      int 03
:0040E28B CC                      int 03
:0040E28C CC                      int 03
:0040E28D CC                      int 03
:0040E28E CC                      int 03
:0040E28F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040E0EF   , :0046A972   , :00472909   , :00472D05   , :0047564A   
|:00478FC9   
|
:0040E290 55                      push ebp
:0040E291 8BEC                    mov ebp, esp
:0040E293 51                      push ecx
:0040E294 894DFC                  mov dword ptr [ebp-04], ecx
:0040E297 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040E29A E8C6440500              call 00462765
:0040E29F 8B45FC                  mov eax, dword ptr [ebp-04]
:0040E2A2 C70080654800            mov dword ptr [eax], 00486580
:0040E2A8 8B45FC                  mov eax, dword ptr [ebp-04]
:0040E2AB 8BE5                    mov esp, ebp
:0040E2AD 5D                      pop ebp
:0040E2AE C3                      ret


:0040E2AF CC                      int 03
:0040E2B0 55                      push ebp
:0040E2B1 8BEC                    mov ebp, esp
:0040E2B3 51                      push ecx
:0040E2B4 894DFC                  mov dword ptr [ebp-04], ecx
:0040E2B7 B878694800              mov eax, 00486978
:0040E2BC 8BE5                    mov esp, ebp
:0040E2BE 5D                      pop ebp
:0040E2BF C3                      ret


:0040E2C0 55                      push ebp
:0040E2C1 8BEC                    mov ebp, esp
:0040E2C3 51                      push ecx
:0040E2C4 894DFC                  mov dword ptr [ebp-04], ecx
:0040E2C7 8B4510                  mov eax, dword ptr [ebp+10]
:0040E2CA 50                      push eax
:0040E2CB 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0040E2CE 51                      push ecx
:0040E2CF 8B5508                  mov edx, dword ptr [ebp+08]
:0040E2D2 52                      push edx
:0040E2D3 8B45FC                  mov eax, dword ptr [ebp-04]
:0040E2D6 8B10                    mov edx, dword ptr [eax]
:0040E2D8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040E2DB FF5204                  call [edx+04]
:0040E2DE 8BE5                    mov esp, ebp
:0040E2E0 5D                      pop ebp
:0040E2E1 C20C00                  ret 000C


:0040E2E4 CC                      int 03
:0040E2E5 CC                      int 03
:0040E2E6 CC                      int 03
:0040E2E7 CC                      int 03
:0040E2E8 CC                      int 03
:0040E2E9 CC                      int 03
:0040E2EA CC                      int 03
:0040E2EB CC                      int 03
:0040E2EC CC                      int 03
:0040E2ED CC                      int 03
:0040E2EE CC                      int 03
:0040E2EF CC                      int 03
:0040E2F0 55                      push ebp
:0040E2F1 8BEC                    mov ebp, esp
:0040E2F3 51                      push ecx
:0040E2F4 894DFC                  mov dword ptr [ebp-04], ecx
:0040E2F7 68FF000000              push 000000FF
:0040E2FC 8B45FC                  mov eax, dword ptr [ebp-04]
:0040E2FF 8B4804                  mov ecx, dword ptr [eax+04]
:0040E302 51                      push ecx
:0040E303 FF15D4624800            call dword ptr [004862D4]
:0040E309 8BE5                    mov esp, ebp
:0040E30B 5D                      pop ebp
:0040E30C C3                      ret


:0040E30D CC                      int 03
:0040E30E CC                      int 03
:0040E30F CC                      int 03
:0040E310 55                      push ebp
:0040E311 8BEC                    mov ebp, esp
:0040E313 51                      push ecx
:0040E314 894DFC                  mov dword ptr [ebp-04], ecx
:0040E317 6A00                    push 00000000
:0040E319 6A01                    push 00000001
:0040E31B 8B450C                  mov eax, dword ptr [ebp+0C]
:0040E31E 50                      push eax
:0040E31F 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040E322 51                      push ecx
:0040E323 E8632F0600              call 0047128B
:0040E328 83C410                  add esp, 00000010
:0040E32B 8BE5                    mov esp, ebp
:0040E32D 5D                      pop ebp
:0040E32E C20800                  ret 0008


:0040E331 CC                      int 03
:0040E332 CC                      int 03
:0040E333 CC                      int 03
:0040E334 CC                      int 03
:0040E335 CC                      int 03
:0040E336 CC                      int 03
:0040E337 CC                      int 03
:0040E338 CC                      int 03
:0040E339 CC                      int 03
:0040E33A CC                      int 03
:0040E33B CC                      int 03
:0040E33C CC                      int 03
:0040E33D CC                      int 03
:0040E33E CC                      int 03
:0040E33F CC                      int 03

* Referenced by a CALL at Addresses:
|:0046EADE   , :004701A0   
|
:0040E340 55                      push ebp
:0040E341 8BEC                    mov ebp, esp
:0040E343 51                      push ecx
:0040E344 894DFC                  mov dword ptr [ebp-04], ecx
:0040E347 6A00                    push 00000000
:0040E349 6A01                    push 00000001
:0040E34B 8B450C                  mov eax, dword ptr [ebp+0C]
:0040E34E 50                      push eax
:0040E34F 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040E352 51                      push ecx
:0040E353 E833320600              call 0047158B
:0040E358 83C410                  add esp, 00000010
:0040E35B 8BE5                    mov esp, ebp
:0040E35D 5D                      pop ebp
:0040E35E C20800                  ret 0008


:0040E361 CC                      int 03
:0040E362 CC                      int 03
:0040E363 CC                      int 03
:0040E364 CC                      int 03
:0040E365 CC                      int 03
:0040E366 CC                      int 03
:0040E367 CC                      int 03
:0040E368 CC                      int 03
:0040E369 CC                      int 03
:0040E36A CC                      int 03
:0040E36B CC                      int 03
:0040E36C CC                      int 03
:0040E36D CC                      int 03
:0040E36E CC                      int 03
:0040E36F CC                      int 03
:0040E370 55                      push ebp
:0040E371 8BEC                    mov ebp, esp
:0040E373 51                      push ecx
:0040E374 894DFC                  mov dword ptr [ebp-04], ecx
:0040E377 6A00                    push 00000000
:0040E379 6A00                    push 00000000
:0040E37B 6A01                    push 00000001
:0040E37D 8B450C                  mov eax, dword ptr [ebp+0C]
:0040E380 50                      push eax
:0040E381 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040E384 51                      push ecx
:0040E385 E8F7350600              call 00471981
:0040E38A 83C414                  add esp, 00000014
:0040E38D 8BE5                    mov esp, ebp
:0040E38F 5D                      pop ebp
:0040E390 C20800                  ret 0008


:0040E393 CC                      int 03
:0040E394 CC                      int 03
:0040E395 CC                      int 03
:0040E396 CC                      int 03
:0040E397 CC                      int 03
:0040E398 CC                      int 03
:0040E399 CC                      int 03
:0040E39A CC                      int 03
:0040E39B CC                      int 03
:0040E39C CC                      int 03
:0040E39D CC                      int 03
:0040E39E CC                      int 03
:0040E39F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040E0CF   , :0040E3EA   , :0041C26A   , :00472E9A   , :00474E0A   
|:0047560A   , :0047563F   , :0047570A   , :004757BA   , :0047585A   
|
:0040E3A0 55                      push ebp
:0040E3A1 8BEC                    mov ebp, esp
:0040E3A3 51                      push ecx
:0040E3A4 894DFC                  mov dword ptr [ebp-04], ecx
:0040E3A7 8B45FC                  mov eax, dword ptr [ebp-04]
:0040E3AA C70090654800            mov dword ptr [eax], 00486590
:0040E3B0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040E3B3 C7410400000000          mov [ecx+04], 00000000
:0040E3BA 8B55FC                  mov edx, dword ptr [ebp-04]
:0040E3BD C7420801000000          mov [edx+08], 00000001
:0040E3C4 8B45FC                  mov eax, dword ptr [ebp-04]
:0040E3C7 8BE5                    mov esp, ebp
:0040E3C9 5D                      pop ebp
:0040E3CA C3                      ret


:0040E3CB CC                      int 03
:0040E3CC CC                      int 03
:0040E3CD CC                      int 03
:0040E3CE CC                      int 03
:0040E3CF CC                      int 03
:0040E3D0 55                      push ebp
:0040E3D1 8BEC                    mov ebp, esp
:0040E3D3 51                      push ecx
:0040E3D4 894DFC                  mov dword ptr [ebp-04], ecx
:0040E3D7 B801000000              mov eax, 00000001
:0040E3DC 8BE5                    mov esp, ebp
:0040E3DE 5D                      pop ebp
:0040E3DF C3                      ret



* Referenced by a CALL at Addresses:
|:0040DF7A   , :0043E35F   , :0045F6E1   , :00472A6F   , :00472EDA   
|
:0040E3E0 55                      push ebp
:0040E3E1 8BEC                    mov ebp, esp
:0040E3E3 51                      push ecx
:0040E3E4 894DFC                  mov dword ptr [ebp-04], ecx
:0040E3E7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040E3EA E8B1FFFFFF              call 0040E3A0
:0040E3EF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040E3F2 83C10C                  add ecx, 0000000C
:0040E3F5 E816000000              call 0040E410
:0040E3FA 8B45FC                  mov eax, dword ptr [ebp-04]
:0040E3FD C700B8654800            mov dword ptr [eax], 004865B8
:0040E403 8B45FC                  mov eax, dword ptr [ebp-04]
:0040E406 8BE5                    mov esp, ebp
:0040E408 5D                      pop ebp
:0040E409 C3                      ret


:0040E40A CC                      int 03
:0040E40B CC                      int 03
:0040E40C CC                      int 03
:0040E40D CC                      int 03
:0040E40E CC                      int 03
:0040E40F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040E3F5   , :0046E6AE   
|
:0040E410 55                      push ebp
:0040E411 8BEC                    mov ebp, esp
:0040E413 51                      push ecx
:0040E414 894DFC                  mov dword ptr [ebp-04], ecx
:0040E417 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040E41A E846430500              call 00462765
:0040E41F 8B45FC                  mov eax, dword ptr [ebp-04]
:0040E422 C700E0654800            mov dword ptr [eax], 004865E0
:0040E428 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040E42B C7410C00000000          mov [ecx+0C], 00000000
:0040E432 8B55FC                  mov edx, dword ptr [ebp-04]
:0040E435 C7421000000000          mov [edx+10], 00000000
:0040E43C 8B45FC                  mov eax, dword ptr [ebp-04]
:0040E43F C7401400000000          mov [eax+14], 00000000
:0040E446 8B45FC                  mov eax, dword ptr [ebp-04]
:0040E449 8BE5                    mov esp, ebp
:0040E44B 5D                      pop ebp
:0040E44C C3                      ret


:0040E44D CC                      int 03
:0040E44E CC                      int 03
:0040E44F CC                      int 03
:0040E450 55                      push ebp
:0040E451 8BEC                    mov ebp, esp
:0040E453 51                      push ecx
:0040E454 894DFC                  mov dword ptr [ebp-04], ecx
:0040E457 B8986A4800              mov eax, 00486A98
:0040E45C 8BE5                    mov esp, ebp
:0040E45E 5D                      pop ebp
:0040E45F C3                      ret



* Referenced by a CALL at Addresses:
|:0040DF9A   , :0043E3D8   , :0045F751   , :00472BB8   , :004853F3   
|:00485413   , :00485AB3   , :00485AF3   
|
:0040E460 55                      push ebp
:0040E461 8BEC                    mov ebp, esp
:0040E463 51                      push ecx
:0040E464 894DFC                  mov dword ptr [ebp-04], ecx
:0040E467 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040E46A 83C10C                  add ecx, 0000000C
:0040E46D E805FF0500              call 0046E377
:0040E472 8BE5                    mov esp, ebp
:0040E474 5D                      pop ebp
:0040E475 C3                      ret


:0040E476 CC                      int 03
:0040E477 CC                      int 03
:0040E478 CC                      int 03
:0040E479 CC                      int 03
:0040E47A CC                      int 03
:0040E47B CC                      int 03
:0040E47C CC                      int 03
:0040E47D CC                      int 03
:0040E47E CC                      int 03
:0040E47F CC                      int 03
:0040E480 55                      push ebp
:0040E481 8BEC                    mov ebp, esp
:0040E483 E802000000              call 0040E48A
:0040E488 5D                      pop ebp
:0040E489 C3                      ret



* Referenced by a CALL at Address:
|:0040E483   
|
:0040E48A 55                      push ebp
:0040E48B 8BEC                    mov ebp, esp
:0040E48D B9382F4900              mov ecx, 00492F38
:0040E492 E820060000              call 0040EAB7
:0040E497 5D                      pop ebp
:0040E498 C3                      ret



* Referenced by a CALL at Addresses:
|:0040E4D4   , :0040E4EF   , :0040E792   
|
:0040E499 55                      push ebp
:0040E49A 8BEC                    mov ebp, esp
:0040E49C 51                      push ecx
:0040E49D 837D0C0A                cmp dword ptr [ebp+0C], 0000000A
:0040E4A1 7D21                    jge 0040E4C4
:0040E4A3 8B450C                  mov eax, dword ptr [ebp+0C]
:0040E4A6 83C030                  add eax, 00000030
:0040E4A9 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040E4AC 8B11                    mov edx, dword ptr [ecx]
:0040E4AE 8802                    mov byte ptr [edx], al
:0040E4B0 8B4508                  mov eax, dword ptr [ebp+08]
:0040E4B3 8B08                    mov ecx, dword ptr [eax]
:0040E4B5 83C101                  add ecx, 00000001
:0040E4B8 8B5508                  mov edx, dword ptr [ebp+08]
:0040E4BB 890A                    mov dword ptr [edx], ecx
:0040E4BD B801000000              mov eax, 00000001
:0040E4C2 EB39                    jmp 0040E4FD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E4A1(C)
|
:0040E4C4 8B450C                  mov eax, dword ptr [ebp+0C]
:0040E4C7 99                      cdq
:0040E4C8 B90A000000              mov ecx, 0000000A
:0040E4CD F7F9                    idiv ecx
:0040E4CF 50                      push eax
:0040E4D0 8B5508                  mov edx, dword ptr [ebp+08]
:0040E4D3 52                      push edx
:0040E4D4 E8C0FFFFFF              call 0040E499
:0040E4D9 83C408                  add esp, 00000008
:0040E4DC 8945FC                  mov dword ptr [ebp-04], eax
:0040E4DF 8B450C                  mov eax, dword ptr [ebp+0C]
:0040E4E2 99                      cdq
:0040E4E3 B90A000000              mov ecx, 0000000A
:0040E4E8 F7F9                    idiv ecx
:0040E4EA 52                      push edx
:0040E4EB 8B5508                  mov edx, dword ptr [ebp+08]
:0040E4EE 52                      push edx
:0040E4EF E8A5FFFFFF              call 0040E499
:0040E4F4 83C408                  add esp, 00000008
:0040E4F7 8B45FC                  mov eax, dword ptr [ebp-04]
:0040E4FA 83C001                  add eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E4C2(U)
|
:0040E4FD 8BE5                    mov esp, ebp
:0040E4FF 5D                      pop ebp
:0040E500 C3                      ret



* Referenced by a CALL at Addresses:
|:0040E53D   , :0040E559   , :0040E7B8   
|
:0040E501 55                      push ebp
:0040E502 8BEC                    mov ebp, esp
:0040E504 51                      push ecx
:0040E505 837D0C0A                cmp dword ptr [ebp+0C], 0000000A
:0040E509 7321                    jnb 0040E52C
:0040E50B 8B450C                  mov eax, dword ptr [ebp+0C]
:0040E50E 83C030                  add eax, 00000030
:0040E511 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040E514 8B11                    mov edx, dword ptr [ecx]
:0040E516 8802                    mov byte ptr [edx], al
:0040E518 8B4508                  mov eax, dword ptr [ebp+08]
:0040E51B 8B08                    mov ecx, dword ptr [eax]
:0040E51D 83C101                  add ecx, 00000001
:0040E520 8B5508                  mov edx, dword ptr [ebp+08]
:0040E523 890A                    mov dword ptr [edx], ecx
:0040E525 B801000000              mov eax, 00000001
:0040E52A EB3B                    jmp 0040E567

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E509(C)
|
:0040E52C 8B450C                  mov eax, dword ptr [ebp+0C]
:0040E52F 33D2                    xor edx, edx
:0040E531 B90A000000              mov ecx, 0000000A
:0040E536 F7F1                    div ecx
:0040E538 50                      push eax
:0040E539 8B5508                  mov edx, dword ptr [ebp+08]
:0040E53C 52                      push edx
:0040E53D E8BFFFFFFF              call 0040E501
:0040E542 83C408                  add esp, 00000008
:0040E545 8945FC                  mov dword ptr [ebp-04], eax
:0040E548 8B450C                  mov eax, dword ptr [ebp+0C]
:0040E54B 33D2                    xor edx, edx
:0040E54D B90A000000              mov ecx, 0000000A
:0040E552 F7F1                    div ecx
:0040E554 52                      push edx
:0040E555 8B5508                  mov edx, dword ptr [ebp+08]
:0040E558 52                      push edx
:0040E559 E8A3FFFFFF              call 0040E501
:0040E55E 83C408                  add esp, 00000008
:0040E561 8B45FC                  mov eax, dword ptr [ebp-04]
:0040E564 83C001                  add eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E52A(U)
|
:0040E567 8BE5                    mov esp, ebp
:0040E569 5D                      pop ebp
:0040E56A C3                      ret



* Referenced by a CALL at Address:
|:0040FAAC   
|
:0040E56B 55                      push ebp
:0040E56C 8BEC                    mov ebp, esp
:0040E56E 83EC64                  sub esp, 00000064
:0040E571 C745FC302E4900          mov [ebp-04], 00492E30
:0040E578 8B4508                  mov eax, dword ptr [ebp+08]
:0040E57B 8B08                    mov ecx, dword ptr [eax]
:0040E57D 894DBC                  mov dword ptr [ebp-44], ecx
:0040E580 8B5508                  mov edx, dword ptr [ebp+08]
:0040E583 83C204                  add edx, 00000004
:0040E586 895508                  mov dword ptr [ebp+08], edx
:0040E589 8B4508                  mov eax, dword ptr [ebp+08]
:0040E58C 8945B8                  mov dword ptr [ebp-48], eax
:0040E58F C745B400000000          mov [ebp-4C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E9E5(U)
|
:0040E596 8B4DBC                  mov ecx, dword ptr [ebp-44]
:0040E599 8A11                    mov dl, byte ptr [ecx]
:0040E59B 8855D8                  mov byte ptr [ebp-28], dl
:0040E59E 8B45D8                  mov eax, dword ptr [ebp-28]
:0040E5A1 25FF000000              and eax, 000000FF
:0040E5A6 8B4DBC                  mov ecx, dword ptr [ebp-44]
:0040E5A9 83C101                  add ecx, 00000001
:0040E5AC 894DBC                  mov dword ptr [ebp-44], ecx
:0040E5AF 85C0                    test eax, eax
:0040E5B1 0F8433040000            je 0040E9EA
:0040E5B7 837DB400                cmp dword ptr [ebp-4C], 00000000
:0040E5BB 0F8529040000            jne 0040E9EA
:0040E5C1 8B55D8                  mov edx, dword ptr [ebp-28]
:0040E5C4 81E2FF000000            and edx, 000000FF
:0040E5CA 83FA25                  cmp edx, 00000025
:0040E5CD 0F85E3030000            jne 0040E9B6
:0040E5D3 8D45E0                  lea eax, dword ptr [ebp-20]
:0040E5D6 8945F4                  mov dword ptr [ebp-0C], eax

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0040E5D9 C745C406000000          mov [ebp-3C], 00000006
:0040E5E0 C745B000000000          mov [ebp-50], 00000000
:0040E5E7 8B4DB0                  mov ecx, dword ptr [ebp-50]
:0040E5EA 894DF8                  mov dword ptr [ebp-08], ecx
:0040E5ED 8B55F8                  mov edx, dword ptr [ebp-08]
:0040E5F0 8955C0                  mov dword ptr [ebp-40], edx
:0040E5F3 8B45C0                  mov eax, dword ptr [ebp-40]
:0040E5F6 8945CC                  mov dword ptr [ebp-34], eax
:0040E5F9 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0040E5FC 894DD0                  mov dword ptr [ebp-30], ecx
:0040E5FF C745D400000000          mov [ebp-2C], 00000000
:0040E606 8B55BC                  mov edx, dword ptr [ebp-44]
:0040E609 33C0                    xor eax, eax
:0040E60B 8A02                    mov al, byte ptr [edx]
:0040E60D 83F82D                  cmp eax, 0000002D
:0040E610 7510                    jne 0040E622
:0040E612 8B4DBC                  mov ecx, dword ptr [ebp-44]
:0040E615 83C101                  add ecx, 00000001
:0040E618 894DBC                  mov dword ptr [ebp-44], ecx
:0040E61B C745D001000000          mov [ebp-30], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E610(C)
|
:0040E622 8B55BC                  mov edx, dword ptr [ebp-44]
:0040E625 8A02                    mov al, byte ptr [edx]
:0040E627 8845D8                  mov byte ptr [ebp-28], al
:0040E62A 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0040E62D 81E1FF000000            and ecx, 000000FF
:0040E633 83E930                  sub ecx, 00000030
:0040E636 F7D9                    neg ecx
:0040E638 1AC9                    sbb cl, cl
:0040E63A 80E1F0                  and cl, F0
:0040E63D 80C130                  add cl, 30
:0040E640 884DC8                  mov byte ptr [ebp-38], cl
:0040E643 8A55D8                  mov dl, byte ptr [ebp-28]
:0040E646 52                      push edx
:0040E647 E874140000              call 0040FAC0
:0040E64C 83C404                  add esp, 00000004
:0040E64F 85C0                    test eax, eax
:0040E651 7411                    je 0040E664
:0040E653 8D45BC                  lea eax, dword ptr [ebp-44]
:0040E656 50                      push eax
:0040E657 E815040000              call 0040EA71
:0040E65C 83C404                  add esp, 00000004
:0040E65F 8945AC                  mov dword ptr [ebp-54], eax
:0040E662 EB07                    jmp 0040E66B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E651(C)
|
:0040E664 C745AC00000000          mov [ebp-54], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E662(U)
|
:0040E66B 8B4DAC                  mov ecx, dword ptr [ebp-54]
:0040E66E 894DDC                  mov dword ptr [ebp-24], ecx
:0040E671 8B55BC                  mov edx, dword ptr [ebp-44]
:0040E674 8A02                    mov al, byte ptr [edx]
:0040E676 8845D8                  mov byte ptr [ebp-28], al
:0040E679 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0040E67C 81E1FF000000            and ecx, 000000FF
:0040E682 8B55BC                  mov edx, dword ptr [ebp-44]
:0040E685 83C201                  add edx, 00000001
:0040E688 8955BC                  mov dword ptr [ebp-44], edx
:0040E68B 83F92E                  cmp ecx, 0000002E
:0040E68E 7527                    jne 0040E6B7
:0040E690 8D45BC                  lea eax, dword ptr [ebp-44]
:0040E693 50                      push eax
:0040E694 E8D8030000              call 0040EA71
:0040E699 83C404                  add esp, 00000004
:0040E69C 8945C4                  mov dword ptr [ebp-3C], eax
:0040E69F C745CC01000000          mov [ebp-34], 00000001
:0040E6A6 8B4DBC                  mov ecx, dword ptr [ebp-44]
:0040E6A9 8A11                    mov dl, byte ptr [ecx]
:0040E6AB 8855D8                  mov byte ptr [ebp-28], dl
:0040E6AE 8B45BC                  mov eax, dword ptr [ebp-44]
:0040E6B1 83C001                  add eax, 00000001
:0040E6B4 8945BC                  mov dword ptr [ebp-44], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E68E(C)
|
:0040E6B7 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0040E6BA 81E1FF000000            and ecx, 000000FF
:0040E6C0 83F96C                  cmp ecx, 0000006C
:0040E6C3 7518                    jne 0040E6DD
:0040E6C5 C745C001000000          mov [ebp-40], 00000001
:0040E6CC 8B55BC                  mov edx, dword ptr [ebp-44]
:0040E6CF 8A02                    mov al, byte ptr [edx]
:0040E6D1 8845D8                  mov byte ptr [ebp-28], al
:0040E6D4 8B4DBC                  mov ecx, dword ptr [ebp-44]
:0040E6D7 83C101                  add ecx, 00000001
:0040E6DA 894DBC                  mov dword ptr [ebp-44], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E6C3(C)
|
:0040E6DD 8A55D8                  mov dl, byte ptr [ebp-28]
:0040E6E0 52                      push edx
:0040E6E1 E81A140000              call 0040FB00
:0040E6E6 83C404                  add esp, 00000004
:0040E6E9 25FF000000              and eax, 000000FF
:0040E6EE 8945A8                  mov dword ptr [ebp-58], eax
:0040E6F1 837DA855                cmp dword ptr [ebp-58], 00000055
:0040E6F5 0F878A020000            ja 0040E985
:0040E6FB 8B4DA8                  mov ecx, dword ptr [ebp-58]
:0040E6FE 33C0                    xor eax, eax
:0040E700 8A811BEA4000            mov al, byte ptr [ecx+0040EA1B]
:0040E706 FF248503EA4000          jmp dword ptr [4*eax+0040EA03]
:0040E70D 837DC000                cmp dword ptr [ebp-40], 00000000
:0040E711 742E                    je 0040E741
:0040E713 8B55B8                  mov edx, dword ptr [ebp-48]
:0040E716 833A00                  cmp dword ptr [edx], 00000000
:0040E719 7D26                    jge 0040E741
:0040E71B 8B45B8                  mov eax, dword ptr [ebp-48]
:0040E71E 8B08                    mov ecx, dword ptr [eax]
:0040E720 F7D9                    neg ecx
:0040E722 8B55B8                  mov edx, dword ptr [ebp-48]
:0040E725 890A                    mov dword ptr [edx], ecx
:0040E727 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040E72A C6002D                  mov byte ptr [eax], 2D
:0040E72D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040E730 83C101                  add ecx, 00000001
:0040E733 894DF4                  mov dword ptr [ebp-0C], ecx
:0040E736 8B55DC                  mov edx, dword ptr [ebp-24]
:0040E739 83EA01                  sub edx, 00000001
:0040E73C 8955DC                  mov dword ptr [ebp-24], edx
:0040E73F EB32                    jmp 0040E773

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040E711(C), :0040E719(C)
|
:0040E741 837DC000                cmp dword ptr [ebp-40], 00000000
:0040E745 752C                    jne 0040E773
:0040E747 8B45B8                  mov eax, dword ptr [ebp-48]
:0040E74A 833800                  cmp dword ptr [eax], 00000000
:0040E74D 7D24                    jge 0040E773
:0040E74F 8B4DB8                  mov ecx, dword ptr [ebp-48]
:0040E752 8B11                    mov edx, dword ptr [ecx]
:0040E754 F7DA                    neg edx
:0040E756 8B45B8                  mov eax, dword ptr [ebp-48]
:0040E759 8910                    mov dword ptr [eax], edx
:0040E75B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040E75E C6012D                  mov byte ptr [ecx], 2D
:0040E761 8B55F4                  mov edx, dword ptr [ebp-0C]
:0040E764 83C201                  add edx, 00000001
:0040E767 8955F4                  mov dword ptr [ebp-0C], edx
:0040E76A 8B45DC                  mov eax, dword ptr [ebp-24]
:0040E76D 83E801                  sub eax, 00000001
:0040E770 8945DC                  mov dword ptr [ebp-24], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040E73F(U), :0040E745(C), :0040E74D(C)
|
:0040E773 837DC000                cmp dword ptr [ebp-40], 00000000
:0040E777 7426                    je 0040E79F
:0040E779 8B4DB8                  mov ecx, dword ptr [ebp-48]
:0040E77C 8B11                    mov edx, dword ptr [ecx]
:0040E77E 8955A4                  mov dword ptr [ebp-5C], edx
:0040E781 8B45A4                  mov eax, dword ptr [ebp-5C]
:0040E784 50                      push eax
:0040E785 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:0040E788 51                      push ecx
:0040E789 8B55B8                  mov edx, dword ptr [ebp-48]
:0040E78C 83C204                  add edx, 00000004
:0040E78F 8955B8                  mov dword ptr [ebp-48], edx
:0040E792 E802FDFFFF              call 0040E499
:0040E797 83C408                  add esp, 00000008
:0040E79A 8945A0                  mov dword ptr [ebp-60], eax
:0040E79D EB24                    jmp 0040E7C3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E777(C)
|
:0040E79F 8B45B8                  mov eax, dword ptr [ebp-48]
:0040E7A2 8B08                    mov ecx, dword ptr [eax]
:0040E7A4 894D9C                  mov dword ptr [ebp-64], ecx
:0040E7A7 8B559C                  mov edx, dword ptr [ebp-64]
:0040E7AA 52                      push edx
:0040E7AB 8D45F4                  lea eax, dword ptr [ebp-0C]
:0040E7AE 50                      push eax
:0040E7AF 8B4DB8                  mov ecx, dword ptr [ebp-48]
:0040E7B2 83C104                  add ecx, 00000004
:0040E7B5 894DB8                  mov dword ptr [ebp-48], ecx
:0040E7B8 E844FDFFFF              call 0040E501
:0040E7BD 83C408                  add esp, 00000008
:0040E7C0 8945A0                  mov dword ptr [ebp-60], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E79D(U)
|
:0040E7C3 8B55DC                  mov edx, dword ptr [ebp-24]
:0040E7C6 2B55A0                  sub edx, dword ptr [ebp-60]
:0040E7C9 8955DC                  mov dword ptr [ebp-24], edx
:0040E7CC E929020000              jmp 0040E9FA
:0040E7D1 8B45B8                  mov eax, dword ptr [ebp-48]
:0040E7D4 8B08                    mov ecx, dword ptr [eax]
:0040E7D6 894DF4                  mov dword ptr [ebp-0C], ecx
:0040E7D9 8B55B8                  mov edx, dword ptr [ebp-48]
:0040E7DC 83C204                  add edx, 00000004
:0040E7DF 8955B8                  mov dword ptr [ebp-48], edx
:0040E7E2 837DF400                cmp dword ptr [ebp-0C], 00000000
:0040E7E6 7507                    jne 0040E7EF
:0040E7E8 C745F4842F4900          mov [ebp-0C], 00492F84

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E7E6(C)
|
:0040E7EF 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040E7F2 50                      push eax
:0040E7F3 E862140700              call 0047FC5A
:0040E7F8 83C404                  add esp, 00000004
:0040E7FB 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0040E7FE 2BC8                    sub ecx, eax
:0040E800 894DDC                  mov dword ptr [ebp-24], ecx
:0040E803 E9ED010000              jmp 0040E9F5
:0040E808 8B55F4                  mov edx, dword ptr [ebp-0C]
:0040E80B 8B45B8                  mov eax, dword ptr [ebp-48]
:0040E80E 8A08                    mov cl, byte ptr [eax]
:0040E810 880A                    mov byte ptr [edx], cl
:0040E812 8B55F4                  mov edx, dword ptr [ebp-0C]
:0040E815 83C201                  add edx, 00000001
:0040E818 8955F4                  mov dword ptr [ebp-0C], edx
:0040E81B 8B45B8                  mov eax, dword ptr [ebp-48]
:0040E81E 83C004                  add eax, 00000004
:0040E821 8945B8                  mov dword ptr [ebp-48], eax
:0040E824 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0040E827 83E901                  sub ecx, 00000001
:0040E82A 894DDC                  mov dword ptr [ebp-24], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E9FA(U)
|
:0040E82D C745CC00000000          mov [ebp-34], 00000000
:0040E834 8B55F4                  mov edx, dword ptr [ebp-0C]
:0040E837 C60200                  mov byte ptr [edx], 00
:0040E83A 8D45E0                  lea eax, dword ptr [ebp-20]
:0040E83D 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E9F5(U)
|
:0040E840 837DD000                cmp dword ptr [ebp-30], 00000000
:0040E844 754D                    jne 0040E893

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E891(U)
|
:0040E846 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0040E849 8B55DC                  mov edx, dword ptr [ebp-24]
:0040E84C 83EA01                  sub edx, 00000001
:0040E84F 8955DC                  mov dword ptr [ebp-24], edx
:0040E852 85C9                    test ecx, ecx
:0040E854 7E3D                    jle 0040E893
:0040E856 837DB001                cmp dword ptr [ebp-50], 00000001
:0040E85A 7504                    jne 0040E860
:0040E85C C645C830                mov [ebp-38], 30

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E85A(C)
|
:0040E860 833D302F490001          cmp dword ptr [00492F30], 00000001
:0040E867 7513                    jne 0040E87C
:0040E869 8B45FC                  mov eax, dword ptr [ebp-04]
:0040E86C 8A4DC8                  mov cl, byte ptr [ebp-38]
:0040E86F 8808                    mov byte ptr [eax], cl
:0040E871 8B55FC                  mov edx, dword ptr [ebp-04]
:0040E874 83C201                  add edx, 00000001
:0040E877 8955FC                  mov dword ptr [ebp-04], edx
:0040E87A EB15                    jmp 0040E891

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E867(C)
|
:0040E87C 8B45D4                  mov eax, dword ptr [ebp-2C]
:0040E87F 50                      push eax
:0040E880 8A4DC8                  mov cl, byte ptr [ebp-38]
:0040E883 51                      push ecx
:0040E884 B9382F4900              mov ecx, 00492F38
:0040E889 E832050000              call 0040EDC0
:0040E88E 8945B4                  mov dword ptr [ebp-4C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E87A(U)
|
:0040E891 EBB3                    jmp 0040E846

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040E844(C), :0040E854(C), :0040E936(U)
|
:0040E893 8B55F4                  mov edx, dword ptr [ebp-0C]
:0040E896 33C0                    xor eax, eax
:0040E898 8A02                    mov al, byte ptr [edx]
:0040E89A 85C0                    test eax, eax
:0040E89C 0F8499000000            je 0040E93B
:0040E8A2 837DCC00                cmp dword ptr [ebp-34], 00000000
:0040E8A6 7406                    je 0040E8AE
:0040E8A8 837DC400                cmp dword ptr [ebp-3C], 00000000
:0040E8AC 7E7F                    jle 0040E92D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E8A6(C)
|
:0040E8AE 837DF800                cmp dword ptr [ebp-08], 00000000
:0040E8B2 740C                    je 0040E8C0
:0040E8B4 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040E8B7 33D2                    xor edx, edx
:0040E8B9 8A11                    mov dl, byte ptr [ecx]
:0040E8BB 83FA20                  cmp edx, 00000020
:0040E8BE 746D                    je 0040E92D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E8B2(C)
|
:0040E8C0 837DF800                cmp dword ptr [ebp-08], 00000000
:0040E8C4 7429                    je 0040E8EF
:0040E8C6 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040E8C9 33C9                    xor ecx, ecx
:0040E8CB 8A08                    mov cl, byte ptr [eax]
:0040E8CD 81F9A1000000            cmp ecx, 000000A1
:0040E8D3 751A                    jne 0040E8EF
:0040E8D5 8B55F4                  mov edx, dword ptr [ebp-0C]
:0040E8D8 33C0                    xor eax, eax
:0040E8DA 8A4201                  mov al, byte ptr [edx+01]
:0040E8DD 3DA1000000              cmp eax, 000000A1
:0040E8E2 750B                    jne 0040E8EF
:0040E8E4 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040E8E7 83C101                  add ecx, 00000001
:0040E8EA 894DF4                  mov dword ptr [ebp-0C], ecx
:0040E8ED EB3E                    jmp 0040E92D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040E8C4(C), :0040E8D3(C), :0040E8E2(C)
|
:0040E8EF 833D302F490001          cmp dword ptr [00492F30], 00000001
:0040E8F6 7515                    jne 0040E90D
:0040E8F8 8B55FC                  mov edx, dword ptr [ebp-04]
:0040E8FB 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040E8FE 8A08                    mov cl, byte ptr [eax]
:0040E900 880A                    mov byte ptr [edx], cl
:0040E902 8B55FC                  mov edx, dword ptr [ebp-04]
:0040E905 83C201                  add edx, 00000001
:0040E908 8955FC                  mov dword ptr [ebp-04], edx
:0040E90B EB17                    jmp 0040E924

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E8F6(C)
|
:0040E90D 8B45D4                  mov eax, dword ptr [ebp-2C]
:0040E910 50                      push eax
:0040E911 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040E914 8A11                    mov dl, byte ptr [ecx]
:0040E916 52                      push edx
:0040E917 B9382F4900              mov ecx, 00492F38
:0040E91C E89F040000              call 0040EDC0
:0040E921 8945B4                  mov dword ptr [ebp-4C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E90B(U)
|
:0040E924 8B45C4                  mov eax, dword ptr [ebp-3C]
:0040E927 83E801                  sub eax, 00000001
:0040E92A 8945C4                  mov dword ptr [ebp-3C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040E8AC(C), :0040E8BE(C), :0040E8ED(U)
|
:0040E92D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040E930 83C101                  add ecx, 00000001
:0040E933 894DF4                  mov dword ptr [ebp-0C], ecx
:0040E936 E958FFFFFF              jmp 0040E893

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E89C(C)
|
:0040E93B 837DD000                cmp dword ptr [ebp-30], 00000000
:0040E93F 743D                    je 0040E97E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E97C(U)
|
:0040E941 8B55DC                  mov edx, dword ptr [ebp-24]
:0040E944 8B45DC                  mov eax, dword ptr [ebp-24]
:0040E947 83E801                  sub eax, 00000001
:0040E94A 8945DC                  mov dword ptr [ebp-24], eax
:0040E94D 85D2                    test edx, edx
:0040E94F 7E2D                    jle 0040E97E
:0040E951 833D302F490001          cmp dword ptr [00492F30], 00000001
:0040E958 7511                    jne 0040E96B
:0040E95A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040E95D C60120                  mov byte ptr [ecx], 20
:0040E960 8B55FC                  mov edx, dword ptr [ebp-04]
:0040E963 83C201                  add edx, 00000001
:0040E966 8955FC                  mov dword ptr [ebp-04], edx
:0040E969 EB11                    jmp 0040E97C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E958(C)
|
:0040E96B 6A00                    push 00000000
:0040E96D 6A20                    push 00000020
:0040E96F B9382F4900              mov ecx, 00492F38
:0040E974 E847040000              call 0040EDC0
:0040E979 8945B4                  mov dword ptr [ebp-4C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E969(U)
|
:0040E97C EBC3                    jmp 0040E941

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040E93F(C), :0040E94F(C)
|
:0040E97E EB34                    jmp 0040E9B4
:0040E980 8B45B4                  mov eax, dword ptr [ebp-4C]
:0040E983 EB7A                    jmp 0040E9FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E6F5(C)
|
:0040E985 833D302F490001          cmp dword ptr [00492F30], 00000001
:0040E98C 7513                    jne 0040E9A1
:0040E98E 8B45FC                  mov eax, dword ptr [ebp-04]
:0040E991 8A4DD8                  mov cl, byte ptr [ebp-28]
:0040E994 8808                    mov byte ptr [eax], cl
:0040E996 8B55FC                  mov edx, dword ptr [ebp-04]
:0040E999 83C201                  add edx, 00000001
:0040E99C 8955FC                  mov dword ptr [ebp-04], edx
:0040E99F EB13                    jmp 0040E9B4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E98C(C)
|
:0040E9A1 6A00                    push 00000000
:0040E9A3 8A45D8                  mov al, byte ptr [ebp-28]
:0040E9A6 50                      push eax
:0040E9A7 B9382F4900              mov ecx, 00492F38
:0040E9AC E80F040000              call 0040EDC0
:0040E9B1 8945B4                  mov dword ptr [ebp-4C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040E97E(U), :0040E99F(U)
|
:0040E9B4 EB2F                    jmp 0040E9E5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E5CD(C)
|
:0040E9B6 833D302F490001          cmp dword ptr [00492F30], 00000001
:0040E9BD 7513                    jne 0040E9D2
:0040E9BF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040E9C2 8A55D8                  mov dl, byte ptr [ebp-28]
:0040E9C5 8811                    mov byte ptr [ecx], dl
:0040E9C7 8B45FC                  mov eax, dword ptr [ebp-04]
:0040E9CA 83C001                  add eax, 00000001
:0040E9CD 8945FC                  mov dword ptr [ebp-04], eax
:0040E9D0 EB13                    jmp 0040E9E5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E9BD(C)
|
:0040E9D2 6A00                    push 00000000
:0040E9D4 8A4DD8                  mov cl, byte ptr [ebp-28]
:0040E9D7 51                      push ecx
:0040E9D8 B9382F4900              mov ecx, 00492F38
:0040E9DD E8DE030000              call 0040EDC0
:0040E9E2 8945B4                  mov dword ptr [ebp-4C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040E9B4(U), :0040E9D0(U)
|
:0040E9E5 E9ACFBFFFF              jmp 0040E596

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040E5B1(C), :0040E5BB(C)
|
:0040E9EA 8B55FC                  mov edx, dword ptr [ebp-04]
:0040E9ED C60200                  mov byte ptr [edx], 00
:0040E9F0 8B45B4                  mov eax, dword ptr [ebp-4C]
:0040E9F3 EB0A                    jmp 0040E9FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E803(U)
|
:0040E9F5 E946FEFFFF              jmp 0040E840

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040E7CC(U)
|
:0040E9FA E92EFEFFFF              jmp 0040E82D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040E983(U), :0040E9F3(U)
|
:0040E9FF 8BE5                    mov esp, ebp
:0040EA01 5D                      pop ebp
:0040EA02 C3                      ret



:0040EA03 80E94000                DWORD 0040E980
:0040EA07 08E84000                DWORD 0040E808
:0040EA0B 0DE74000                DWORD 0040E70D
:0040EA0F D1E74000                DWORD 0040E7D1
:0040EA13 73E74000                DWORD 0040E773
:0040EA17 85E94000                DWORD 0040E985


:0040EA1B 000505050505            add byte ptr [05050505], al
:0040EA21 0505050505              add eax, 05050505
:0040EA26 0505050505              add eax, 05050505
:0040EA2B 0505050505              add eax, 05050505
:0040EA30 0505050505              add eax, 05050505
:0040EA35 0505050505              add eax, 05050505
:0040EA3A 0505050505              add eax, 05050505
:0040EA3F 0505050505              add eax, 05050505
:0040EA44 0505050505              add eax, 05050505
:0040EA49 0505050505              add eax, 05050505
:0040EA4E 0505050505              add eax, 05050505
:0040EA53 0505050505              add eax, 05050505
:0040EA58 0505050505              add eax, 05050505
:0040EA5D 0501020505              add eax, 05050201
:0040EA62 0505050505              add eax, 05050505
:0040EA67 0505050505              add eax, 05050505
:0040EA6C 0505030504              add eax, 04050305

* Referenced by a CALL at Addresses:
|:0040E657   , :0040E694   
|
:0040EA71 55                      push ebp
:0040EA72 8BEC                    mov ebp, esp
:0040EA74 83EC08                  sub esp, 00000008
:0040EA77 C745F800000000          mov [ebp-08], 00000000
:0040EA7E EB0D                    jmp 0040EA8D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040EAAE(U)
|
:0040EA80 8B4508                  mov eax, dword ptr [ebp+08]
:0040EA83 8B08                    mov ecx, dword ptr [eax]
:0040EA85 83C101                  add ecx, 00000001
:0040EA88 8B5508                  mov edx, dword ptr [ebp+08]
:0040EA8B 890A                    mov dword ptr [edx], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040EA7E(U)
|
:0040EA8D 8B4508                  mov eax, dword ptr [ebp+08]
:0040EA90 8B08                    mov ecx, dword ptr [eax]
:0040EA92 33D2                    xor edx, edx
:0040EA94 8A11                    mov dl, byte ptr [ecx]
:0040EA96 83EA30                  sub edx, 00000030
:0040EA99 8955FC                  mov dword ptr [ebp-04], edx
:0040EA9C 837DFC0A                cmp dword ptr [ebp-04], 0000000A
:0040EAA0 730E                    jnb 0040EAB0
:0040EAA2 8B45F8                  mov eax, dword ptr [ebp-08]
:0040EAA5 6BC00A                  imul eax, 0000000A
:0040EAA8 0345FC                  add eax, dword ptr [ebp-04]
:0040EAAB 8945F8                  mov dword ptr [ebp-08], eax
:0040EAAE EBD0                    jmp 0040EA80

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040EAA0(C)
|
:0040EAB0 8B45F8                  mov eax, dword ptr [ebp-08]
:0040EAB3 8BE5                    mov esp, ebp
:0040EAB5 5D                      pop ebp
:0040EAB6 C3                      ret



* Referenced by a CALL at Address:
|:0040E492   
|
:0040EAB7 55                      push ebp
:0040EAB8 8BEC                    mov ebp, esp
:0040EABA 51                      push ecx
:0040EABB 894DFC                  mov dword ptr [ebp-04], ecx
:0040EABE 8B45FC                  mov eax, dword ptr [ebp-04]
:0040EAC1 C7401400000000          mov [eax+14], 00000000
:0040EAC8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040EACB C7410C00000000          mov [ecx+0C], 00000000
:0040EAD2 8B55FC                  mov edx, dword ptr [ebp-04]
:0040EAD5 C7420800000000          mov [edx+08], 00000000
:0040EADC 8B45FC                  mov eax, dword ptr [ebp-04]
:0040EADF C7400400000000          mov [eax+04], 00000000
:0040EAE6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040EAE9 C7411C08000000          mov [ecx+1C], 00000008
:0040EAF0 8B55FC                  mov edx, dword ptr [ebp-04]
:0040EAF3 C742109F000000          mov [edx+10], 0000009F
:0040EAFA 8B45FC                  mov eax, dword ptr [ebp-04]
:0040EAFD C74018D8030000          mov [eax+18], 000003D8
:0040EB04 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040EB07 C6412500                mov [ecx+25], 00
:0040EB0B 8B55FC                  mov edx, dword ptr [ebp-04]
:0040EB0E C6422412                mov [edx+24], 12
:0040EB12 8B45FC                  mov eax, dword ptr [ebp-04]
:0040EB15 C7403C00000000          mov [eax+3C], 00000000
:0040EB1C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040EB1F C7412000000000          mov [ecx+20], 00000000
:0040EB26 6A00                    push 00000000
:0040EB28 6A0A                    push 0000000A
:0040EB2A 8B55FC                  mov edx, dword ptr [ebp-04]
:0040EB2D 83C240                  add edx, 00000040
:0040EB30 52                      push edx
:0040EB31 E8DD110700              call 0047FD13
:0040EB36 83C40C                  add esp, 0000000C
:0040EB39 8B45FC                  mov eax, dword ptr [ebp-04]
:0040EB3C C7403400000000          mov [eax+34], 00000000
:0040EB43 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040EB46 C7413800000000          mov [ecx+38], 00000000
:0040EB4D 8B45FC                  mov eax, dword ptr [ebp-04]
:0040EB50 8BE5                    mov esp, ebp
:0040EB52 5D                      pop ebp
:0040EB53 C3                      ret



* Referenced by a CALL at Addresses:
|:0040EBE5   , :0040EEC9   , :0040FA7D   
|
:0040EB54 55                      push ebp
:0040EB55 8BEC                    mov ebp, esp
:0040EB57 83EC08                  sub esp, 00000008
:0040EB5A 894DF8                  mov dword ptr [ebp-08], ecx
:0040EB5D 8B45F8                  mov eax, dword ptr [ebp-08]
:0040EB60 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040EB63 8B5010                  mov edx, dword ptr [eax+10]
:0040EB66 2B510C                  sub edx, dword ptr [ecx+0C]
:0040EB69 83C201                  add edx, 00000001
:0040EB6C 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040EB80(U)
|
:0040EB6F 8B4508                  mov eax, dword ptr [ebp+08]
:0040EB72 3B45FC                  cmp eax, dword ptr [ebp-04]
:0040EB75 720B                    jb 0040EB82
:0040EB77 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040EB7A 2B4DFC                  sub ecx, dword ptr [ebp-04]
:0040EB7D 894D08                  mov dword ptr [ebp+08], ecx
:0040EB80 EBED                    jmp 0040EB6F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040EB75(C)
|
:0040EB82 8B55F8                  mov edx, dword ptr [ebp-08]
:0040EB85 8B4508                  mov eax, dword ptr [ebp+08]
:0040EB88 03420C                  add eax, dword ptr [edx+0C]
:0040EB8B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040EB8E 894104                  mov dword ptr [ecx+04], eax
:0040EB91 8BE5                    mov esp, ebp
:0040EB93 5D                      pop ebp
:0040EB94 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0040EBF1   , :0040EEA5   
|
:0040EB97 55                      push ebp
:0040EB98 8BEC                    mov ebp, esp
:0040EB9A 83EC08                  sub esp, 00000008
:0040EB9D 894DFC                  mov dword ptr [ebp-04], ecx
:0040EBA0 8B45FC                  mov eax, dword ptr [ebp-04]
:0040EBA3 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040EBA6 034814                  add ecx, dword ptr [eax+14]
:0040EBA9 8B55FC                  mov edx, dword ptr [ebp-04]
:0040EBAC 3B4A18                  cmp ecx, dword ptr [edx+18]
:0040EBAF 730E                    jnb 0040EBBF
:0040EBB1 8B45FC                  mov eax, dword ptr [ebp-04]
:0040EBB4 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040EBB7 034814                  add ecx, dword ptr [eax+14]
:0040EBBA 894DF8                  mov dword ptr [ebp-08], ecx
:0040EBBD EB09                    jmp 0040EBC8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040EBAF(C)
|
:0040EBBF 8B55FC                  mov edx, dword ptr [ebp-04]
:0040EBC2 8B4218                  mov eax, dword ptr [edx+18]
:0040EBC5 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040EBBD(U)
|
:0040EBC8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040EBCB 8B55F8                  mov edx, dword ptr [ebp-08]
:0040EBCE 895108                  mov dword ptr [ecx+08], edx
:0040EBD1 8BE5                    mov esp, ebp
:0040EBD3 5D                      pop ebp
:0040EBD4 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:004086B1   , :00408700   , :00408749   , :004087A4   , :004087D7   
|:0040887C   , :004088D9   , :0041E7E6   , :0042C967   , :0042CA91   
|:0042D21D   , :0042D9BD   , :0042E9EB   , :0042EF46   , :0042F64D   
|:00431FB7   , :00431FFB   , :00432045   , :00432088   , :004320F5   
|:0043212C   , :0043218B   , :004321C2   , :00440581   , :004405D0   
|:00440C56   , :00440C94   , :00440CDD   , :00440D4C   , :00440D96   
|:00440DD1   , :00440EB6   , :00440EEF   , :00440F2C   , :00440F65   
|:00440FB8   , :0044100B   , :00441081   , :004410BA   , :00441127   
|:004411B1   , :0044120E   , :00441247   , :004412B5   , :00441344   
|:004413A0   , :00441401   , :0044382B   , :0044B522   , :0044FC15   
|:004502B8   , :0045030F   , :00450344   , :00450593   , :004505ED   
|:0045087F   , :004508E5   , :00450B8D   , :00450BE4   , :00450C19   
|:004510AF   , :004510E8   , :004512B3   , :004512EF   , :00451328   
|:004559AD   , :004559F3   , :0045CBFA   , :0045D020   , :0045D12C   
|:0045E2DD   , :00460BF6   , :0046D7FC   , :00473DB6   , :00473E0C   
|:004762DC   , :0047641D   , :004765C4   , :004766C7   
|
:0040EBD7 55                      push ebp
:0040EBD8 8BEC                    mov ebp, esp
:0040EBDA 51                      push ecx
:0040EBDB 894DFC                  mov dword ptr [ebp-04], ecx
:0040EBDE 8B4508                  mov eax, dword ptr [ebp+08]
:0040EBE1 50                      push eax
:0040EBE2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040EBE5 E86AFFFFFF              call 0040EB54
:0040EBEA 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0040EBED 51                      push ecx
:0040EBEE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040EBF1 E8A1FFFFFF              call 0040EB97
:0040EBF6 8BE5                    mov esp, ebp
:0040EBF8 5D                      pop ebp
:0040EBF9 C20800                  ret 0008



* Referenced by a CALL at Address:
|:0040EF3E   
|
:0040EBFC 55                      push ebp
:0040EBFD 8BEC                    mov ebp, esp
:0040EBFF 83EC08                  sub esp, 00000008
:0040EC02 894DF8                  mov dword ptr [ebp-08], ecx
:0040EC05 8B45F8                  mov eax, dword ptr [ebp-08]
:0040EC08 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040EC0B 8B5010                  mov edx, dword ptr [eax+10]
:0040EC0E 2B510C                  sub edx, dword ptr [ecx+0C]
:0040EC11 83C201                  add edx, 00000001
:0040EC14 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040EC28(U)
|
:0040EC17 8B4508                  mov eax, dword ptr [ebp+08]
:0040EC1A 3B45FC                  cmp eax, dword ptr [ebp-04]
:0040EC1D 720B                    jb 0040EC2A
:0040EC1F 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040EC22 2B4DFC                  sub ecx, dword ptr [ebp-04]
:0040EC25 894D08                  mov dword ptr [ebp+08], ecx
:0040EC28 EBED                    jmp 0040EC17

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040EC1D(C)
|
:0040EC2A 8B55F8                  mov edx, dword ptr [ebp-08]
:0040EC2D 8B4508                  mov eax, dword ptr [ebp+08]
:0040EC30 03420C                  add eax, dword ptr [edx+0C]
:0040EC33 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040EC36 89411C                  mov dword ptr [ecx+1C], eax
:0040EC39 8BE5                    mov esp, ebp
:0040EC3B 5D                      pop ebp
:0040EC3C C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0040F0C9   , :0040F143   
|
:0040EC3F 55                      push ebp
:0040EC40 8BEC                    mov ebp, esp
:0040EC42 51                      push ecx
:0040EC43 894DFC                  mov dword ptr [ebp-04], ecx
:0040EC46 8B45FC                  mov eax, dword ptr [ebp-04]
:0040EC49 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040EC4C 8B511C                  mov edx, dword ptr [ecx+1C]
:0040EC4F 895004                  mov dword ptr [eax+04], edx
:0040EC52 8B45FC                  mov eax, dword ptr [ebp-04]
:0040EC55 33C9                    xor ecx, ecx
:0040EC57 8A4824                  mov cl, byte ptr [eax+24]
:0040EC5A 8B55FC                  mov edx, dword ptr [ebp-04]
:0040EC5D 8B4208                  mov eax, dword ptr [edx+08]
:0040EC60 03C1                    add eax, ecx
:0040EC62 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040EC65 3B4118                  cmp eax, dword ptr [ecx+18]
:0040EC68 7716                    ja 0040EC80
:0040EC6A 8B55FC                  mov edx, dword ptr [ebp-04]
:0040EC6D 33C0                    xor eax, eax
:0040EC6F 8A4224                  mov al, byte ptr [edx+24]
:0040EC72 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040EC75 8B5108                  mov edx, dword ptr [ecx+08]
:0040EC78 03D0                    add edx, eax
:0040EC7A 8B45FC                  mov eax, dword ptr [ebp-04]
:0040EC7D 895008                  mov dword ptr [eax+08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040EC68(C)
|
:0040EC80 8BE5                    mov esp, ebp
:0040EC82 5D                      pop ebp
:0040EC83 C3                      ret



* Referenced by a CALL at Addresses:
|:00408690   , :00408728   , :0040876E   , :004088B8   , :0040BA50   
|:0040BB05   , :0040EF28   , :0041E7FE   , :0042D1E7   , :0042D434   
|:0042D987   , :0042DC0D   , :0042DC1E   , :0042E0F6   , :0042E92C   
|:0042EE94   , :0042F62C   , :0042F7A0   , :00431F72   , :004329B1   
|:00440430   , :0044046B   , :004405AF   , :00440CB0   , :00440CE9   
|:00440D69   , :00440DA4   , :00440DDD   , :00440E0B   , :00440EC2   
|:00440EFB   , :00440F38   , :00440F71   , :00440FC4   , :00441017   
|:0044108D   , :004410C6   , :00441133   , :004411BD   , :0044121A   
|:00441253   , :004412C1   , :00441350   , :004413AC   , :0044140D   
|:00443459   , :0044380D   , :0044B4EF   , :0044D24D   , :0044D6AE   
|:0044FBCE   , :00450291   , :00450B5E   , :00451083   , :00451272   
|:0045597D   , :00455A0F   , :00455A3F   , :00455A5D   , :0045CC1E   
|:0045D074   , :0045D08E   , :0045D0A8   , :0045D180   , :0045D19A   
|:0045D1B4   , :0045D1D6   , :0045E2A1   , :0045E2FA   , :00460C02   
|:0046D476   , :0046D7E2   , :0046D8D0   , :00473C9E   , :00473CAC   
|:004762E8   , :00476429   , :004765D0   , :004766D3   
|
:0040EC84 55                      push ebp
:0040EC85 8BEC                    mov ebp, esp
:0040EC87 51                      push ecx
:0040EC88 894DFC                  mov dword ptr [ebp-04], ecx
:0040EC8B 8B45FC                  mov eax, dword ptr [ebp-04]
:0040EC8E 8A4D08                  mov cl, byte ptr [ebp+08]
:0040EC91 884801                  mov byte ptr [eax+01], cl
:0040EC94 8B55FC                  mov edx, dword ptr [ebp-04]
:0040EC97 33C0                    xor eax, eax
:0040EC99 8A4202                  mov al, byte ptr [edx+02]
:0040EC9C 50                      push eax
:0040EC9D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040ECA0 33D2                    xor edx, edx
:0040ECA2 8A5101                  mov dl, byte ptr [ecx+01]
:0040ECA5 52                      push edx
:0040ECA6 8B45FC                  mov eax, dword ptr [ebp-04]
:0040ECA9 33C9                    xor ecx, ecx
:0040ECAB 8A08                    mov cl, byte ptr [eax]
:0040ECAD 51                      push ecx
:0040ECAE E886E50600              call 0047D239
:0040ECB3 83C40C                  add esp, 0000000C
:0040ECB6 8BE5                    mov esp, ebp
:0040ECB8 5D                      pop ebp
:0040ECB9 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0040B9B2   , :0040EFA8   , :0042D002   , :0042D810   , :0042DE6D   
|:0042E938   , :0042F638   , :00431F8A   , :004329BD   , :004405BB   
|:00443819   , :0044B4FB   , :0044FBDA   , :00450B52   , :0045106B   
|:00451266   , :00455989   , :0045CC36   , :0045D0B4   , :0045D144   
|:00460C0E   , :0046D7EE   , :00473CB8   , :004762F4   , :00476435   
|:004765DC   , :004766DF   
|
:0040ECBC 55                      push ebp
:0040ECBD 8BEC                    mov ebp, esp
:0040ECBF 51                      push ecx
:0040ECC0 894DFC                  mov dword ptr [ebp-04], ecx
:0040ECC3 8B45FC                  mov eax, dword ptr [ebp-04]
:0040ECC6 8A4D08                  mov cl, byte ptr [ebp+08]
:0040ECC9 884802                  mov byte ptr [eax+02], cl
:0040ECCC 8B55FC                  mov edx, dword ptr [ebp-04]
:0040ECCF 33C0                    xor eax, eax
:0040ECD1 8A4202                  mov al, byte ptr [edx+02]
:0040ECD4 50                      push eax
:0040ECD5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040ECD8 33D2                    xor edx, edx
:0040ECDA 8A5101                  mov dl, byte ptr [ecx+01]
:0040ECDD 52                      push edx
:0040ECDE 8B45FC                  mov eax, dword ptr [ebp-04]
:0040ECE1 33C9                    xor ecx, ecx
:0040ECE3 8A08                    mov cl, byte ptr [eax]
:0040ECE5 51                      push ecx
:0040ECE6 E84EE50600              call 0047D239
:0040ECEB 83C40C                  add esp, 0000000C
:0040ECEE 8BE5                    mov esp, ebp
:0040ECF0 5D                      pop ebp
:0040ECF1 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0040EFFD   , :0041E80A   , :00431F7E   , :0043205D   , :00440444   
|:00440477   , :0044FBFA   , :0045029D   , :004502FA   , :00450575   
|:004507C7   , :00450B72   , :00450BCF   , :00451077   , :0045127E   
|:0045CC2A   , :0045CC58   , :0045D068   , :0045D082   , :0045D09C   
|:0045D1E2   
|
:0040ECF4 55                      push ebp
:0040ECF5 8BEC                    mov ebp, esp
:0040ECF7 51                      push ecx
:0040ECF8 894DFC                  mov dword ptr [ebp-04], ecx
:0040ECFB 8B45FC                  mov eax, dword ptr [ebp-04]
:0040ECFE 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040ED01 894820                  mov dword ptr [eax+20], ecx
:0040ED04 8BE5                    mov esp, ebp
:0040ED06 5D                      pop ebp
:0040ED07 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00408684   , :0040B9A6   , :0040F016   , :0041E7F2   , :0041E860   
|:0042F61D   , :00431F66   , :00432051   , :00432094   , :00432101   
|:00432138   , :00432197   , :004321CE   , :004329A5   , :0044041C   
|:00440483   , :004405A3   , :00440C3B   , :00440E5C   , :00443801   
|:00443844   , :0044B4E0   , :0044FBE6   , :0044FC41   , :00450285   
|:004502EE   , :00450569   , :004507BB   , :00450943   , :00450B46   
|:00450BC3   , :00450E94   , :0045105F   , :00451113   , :0045125A   
|:00451373   , :0045CC12   , :0045CC64   , :0045D038   , :0045D174   
|:0045D18E   , :0045D1A8   , :0045D1EE   , :0045E28D   
|
:0040ED0A 55                      push ebp
:0040ED0B 8BEC                    mov ebp, esp
:0040ED0D 51                      push ecx
:0040ED0E 894DFC                  mov dword ptr [ebp-04], ecx
:0040ED11 8B45FC                  mov eax, dword ptr [ebp-04]
:0040ED14 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040ED17 894834                  mov dword ptr [eax+34], ecx
:0040ED1A 8BE5                    mov esp, ebp
:0040ED1C 5D                      pop ebp
:0040ED1D C20400                  ret 0004


:0040ED20 55                      push ebp
:0040ED21 8BEC                    mov ebp, esp
:0040ED23 51                      push ecx
:0040ED24 894DFC                  mov dword ptr [ebp-04], ecx
:0040ED27 8B45FC                  mov eax, dword ptr [ebp-04]
:0040ED2A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040ED2D 894838                  mov dword ptr [eax+38], ecx
:0040ED30 8BE5                    mov esp, ebp
:0040ED32 5D                      pop ebp
:0040ED33 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00408678   , :0040B99A   , :0040EF55   , :0042CFF6   , :0042D804   
|:0042DE61   , :0042E91D   , :0042F611   , :0042F794   , :00431F5A   
|:00432999   , :00440410   , :00440597   , :0044344D   , :004437F5   
|:0044B4D4   , :0044D1B8   , :0044D618   , :0044FBBB   , :00450279   
|:00450B3A   , :00451053   , :0045124E   , :00455971   , :0045CC06   
|:0045D02C   , :0045D138   , :0045E281   , :00473C83   , :004762CC   
|:0047640F   , :004765B4   , :004766B7   
|
:0040ED36 55                      push ebp
:0040ED37 8BEC                    mov ebp, esp
:0040ED39 51                      push ecx
:0040ED3A 894DFC                  mov dword ptr [ebp-04], ecx
:0040ED3D 8B45FC                  mov eax, dword ptr [ebp-04]
:0040ED40 8A4D08                  mov cl, byte ptr [ebp+08]
:0040ED43 8808                    mov byte ptr [eax], cl
:0040ED45 8B55FC                  mov edx, dword ptr [ebp-04]
:0040ED48 33C0                    xor eax, eax
:0040ED4A 8A4202                  mov al, byte ptr [edx+02]
:0040ED4D 50                      push eax
:0040ED4E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040ED51 33D2                    xor edx, edx
:0040ED53 8A5101                  mov dl, byte ptr [ecx+01]
:0040ED56 52                      push edx
:0040ED57 8B45FC                  mov eax, dword ptr [ebp-04]
:0040ED5A 33C9                    xor ecx, ecx
:0040ED5C 8A08                    mov cl, byte ptr [eax]
:0040ED5E 51                      push ecx
:0040ED5F E8D5E40600              call 0047D239
:0040ED64 83C40C                  add esp, 0000000C
:0040ED67 8BE5                    mov esp, ebp
:0040ED69 5D                      pop ebp
:0040ED6A C20400                  ret 0004


:0040ED6D 55                      push ebp
:0040ED6E 8BEC                    mov ebp, esp
:0040ED70 51                      push ecx
:0040ED71 894DFC                  mov dword ptr [ebp-04], ecx
:0040ED74 817D08C8030000          cmp dword ptr [ebp+08], 000003C8
:0040ED7B 7709                    ja 0040ED86
:0040ED7D 8B45FC                  mov eax, dword ptr [ebp-04]
:0040ED80 8A4D08                  mov cl, byte ptr [ebp+08]
:0040ED83 884824                  mov byte ptr [eax+24], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040ED7B(C)
|
:0040ED86 8BE5                    mov esp, ebp
:0040ED88 5D                      pop ebp
:0040ED89 C20400                  ret 0004


:0040ED8C 55                      push ebp
:0040ED8D 8BEC                    mov ebp, esp
:0040ED8F 51                      push ecx
:0040ED90 894DFC                  mov dword ptr [ebp-04], ecx
:0040ED93 817D089F000000          cmp dword ptr [ebp+08], 0000009F
:0040ED9A 7709                    ja 0040EDA5
:0040ED9C 8B45FC                  mov eax, dword ptr [ebp-04]
:0040ED9F 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040EDA2 894810                  mov dword ptr [eax+10], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040ED9A(C)
|
:0040EDA5 8BE5                    mov esp, ebp
:0040EDA7 5D                      pop ebp
:0040EDA8 C20400                  ret 0004


:0040EDAB 55                      push ebp
:0040EDAC 8BEC                    mov ebp, esp
:0040EDAE 51                      push ecx
:0040EDAF 894DFC                  mov dword ptr [ebp-04], ecx
:0040EDB2 8B45FC                  mov eax, dword ptr [ebp-04]
:0040EDB5 C740109F000000          mov [eax+10], 0000009F
:0040EDBC 8BE5                    mov esp, ebp
:0040EDBE 5D                      pop ebp
:0040EDBF C3                      ret



* Referenced by a CALL at Addresses:
|:0040E889   , :0040E91C   , :0040E974   , :0040E9AC   , :0040E9DD   
|:0040FA01   
|
:0040EDC0 55                      push ebp
:0040EDC1 8BEC                    mov ebp, esp
:0040EDC3 83EC2C                  sub esp, 0000002C
:0040EDC6 894DEC                  mov dword ptr [ebp-14], ecx
:0040EDC9 8B45EC                  mov eax, dword ptr [ebp-14]
:0040EDCC 8B4838                  mov ecx, dword ptr [eax+38]
:0040EDCF 894D0C                  mov dword ptr [ebp+0C], ecx
:0040EDD2 C745F000000000          mov [ebp-10], 00000000
:0040EDD9 8B55EC                  mov edx, dword ptr [ebp-14]
:0040EDDC 8B423C                  mov eax, dword ptr [edx+3C]
:0040EDDF 8945E8                  mov dword ptr [ebp-18], eax
:0040EDE2 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0040EDE5 83E901                  sub ecx, 00000001
:0040EDE8 894DE8                  mov dword ptr [ebp-18], ecx
:0040EDEB 837DE809                cmp dword ptr [ebp-18], 00000009
:0040EDEF 0F872B020000            ja 0040F020
:0040EDF5 8B55E8                  mov edx, dword ptr [ebp-18]
:0040EDF8 FF249512F24000          jmp dword ptr [4*edx+0040F212]
:0040EDFF 8B4508                  mov eax, dword ptr [ebp+08]
:0040EE02 25FF000000              and eax, 000000FF
:0040EE07 8945E4                  mov dword ptr [ebp-1C], eax
:0040EE0A 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0040EE0D 83E93D                  sub ecx, 0000003D
:0040EE10 894DE4                  mov dword ptr [ebp-1C], ecx
:0040EE13 837DE41A                cmp dword ptr [ebp-1C], 0000001A
:0040EE17 7773                    ja 0040EE8C
:0040EE19 8B45E4                  mov eax, dword ptr [ebp-1C]
:0040EE1C 33D2                    xor edx, edx
:0040EE1E 8A905EF24000            mov dl, byte ptr [eax+0040F25E]
:0040EE24 FF24953AF24000          jmp dword ptr [4*edx+0040F23A]
:0040EE2B 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040EE2E C7413C02000000          mov [ecx+3C], 00000002
:0040EE35 EB55                    jmp 0040EE8C
:0040EE37 8B55EC                  mov edx, dword ptr [ebp-14]
:0040EE3A C7423C04000000          mov [edx+3C], 00000004
:0040EE41 EB49                    jmp 0040EE8C
:0040EE43 8B45EC                  mov eax, dword ptr [ebp-14]
:0040EE46 C7403C05000000          mov [eax+3C], 00000005
:0040EE4D EB3D                    jmp 0040EE8C
:0040EE4F 8B4DEC                  mov ecx, dword ptr [ebp-14]

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0040EE52 C7413C06000000          mov [ecx+3C], 00000006
:0040EE59 EB31                    jmp 0040EE8C
:0040EE5B 6A01                    push 00000001
:0040EE5D E8DED60100              call 0042C540
:0040EE62 83C404                  add esp, 00000004
:0040EE65 E99D030000              jmp 0040F207
:0040EE6A 8B55EC                  mov edx, dword ptr [ebp-14]
:0040EE6D C7423C08000000          mov [edx+3C], 00000008
:0040EE74 EB16                    jmp 0040EE8C
:0040EE76 8B45EC                  mov eax, dword ptr [ebp-14]
:0040EE79 C7403C09000000          mov [eax+3C], 00000009
:0040EE80 EB0A                    jmp 0040EE8C
:0040EE82 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040EE85 C7413C0A000000          mov [ecx+3C], 0000000A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040EE17(C), :0040EE35(U), :0040EE41(U), :0040EE4D(U), :0040EE59(U)
|:0040EE74(U), :0040EE80(U)
|
:0040EE8C E971030000              jmp 0040F202
:0040EE91 8B5508                  mov edx, dword ptr [ebp+08]
:0040EE94 81E2FF000000            and edx, 000000FF
:0040EE9A 8D04D500FFFFFF          lea eax, dword ptr [8*edx+FFFFFF00]
:0040EEA1 50                      push eax
:0040EEA2 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040EEA5 E8EDFCFFFF              call 0040EB97
:0040EEAA 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040EEAD C7413C03000000          mov [ecx+3C], 00000003
:0040EEB4 E949030000              jmp 0040F202
:0040EEB9 8B5508                  mov edx, dword ptr [ebp+08]
:0040EEBC 81E2FF000000            and edx, 000000FF
:0040EEC2 83EA20                  sub edx, 00000020
:0040EEC5 52                      push edx
:0040EEC6 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040EEC9 E886FCFFFF              call 0040EB54

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040EF2D(U), :0040EF43(U), :0040EF5A(U), :0040EFAD(U), :0040F002(U)
|:0040F01B(U), :0040F207(U)
|
:0040EECE 8B45EC                  mov eax, dword ptr [ebp-14]
:0040EED1 C7403C00000000          mov [eax+3C], 00000000
:0040EED8 E925030000              jmp 0040F202
:0040EEDD 8A4D08                  mov cl, byte ptr [ebp+08]
:0040EEE0 51                      push ecx
:0040EEE1 E8DA0B0000              call 0040FAC0
:0040EEE6 83C404                  add esp, 00000004
:0040EEE9 85C0                    test eax, eax
:0040EEEB 7411                    je 0040EEFE
:0040EEED 8B5508                  mov edx, dword ptr [ebp+08]
:0040EEF0 81E2FF000000            and edx, 000000FF
:0040EEF6 83EA30                  sub edx, 00000030
:0040EEF9 8855E3                  mov byte ptr [ebp-1D], dl
:0040EEFC EB17                    jmp 0040EF15

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040EEEB(C)
|
:0040EEFE 8A4508                  mov al, byte ptr [ebp+08]
:0040EF01 50                      push eax
:0040EF02 E8F90B0000              call 0040FB00
:0040EF07 83C404                  add esp, 00000004
:0040EF0A 25FF000000              and eax, 000000FF
:0040EF0F 83E837                  sub eax, 00000037
:0040EF12 8845E3                  mov byte ptr [ebp-1D], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040EEFC(U)
|
:0040EF15 8A4DE3                  mov cl, byte ptr [ebp-1D]
:0040EF18 884D08                  mov byte ptr [ebp+08], cl
:0040EF1B 8B5508                  mov edx, dword ptr [ebp+08]
:0040EF1E 81E2FF000000            and edx, 000000FF
:0040EF24 52                      push edx
:0040EF25 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040EF28 E857FDFFFF              call 0040EC84
:0040EF2D EB9F                    jmp 0040EECE
:0040EF2F 8B4508                  mov eax, dword ptr [ebp+08]
:0040EF32 25FF000000              and eax, 000000FF
:0040EF37 83E820                  sub eax, 00000020
:0040EF3A 50                      push eax
:0040EF3B 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040EF3E E8B9FCFFFF              call 0040EBFC
:0040EF43 EB89                    jmp 0040EECE
:0040EF45 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040EF48 81E1FF000000            and ecx, 000000FF
:0040EF4E 83E930                  sub ecx, 00000030
:0040EF51 51                      push ecx
:0040EF52 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040EF55 E8DCFDFFFF              call 0040ED36
:0040EF5A E96FFFFFFF              jmp 0040EECE
:0040EF5F 8A5508                  mov dl, byte ptr [ebp+08]
:0040EF62 52                      push edx
:0040EF63 E8580B0000              call 0040FAC0
:0040EF68 83C404                  add esp, 00000004
:0040EF6B 85C0                    test eax, eax
:0040EF6D 7410                    je 0040EF7F
:0040EF6F 8B4508                  mov eax, dword ptr [ebp+08]
:0040EF72 25FF000000              and eax, 000000FF
:0040EF77 83E830                  sub eax, 00000030
:0040EF7A 8845E2                  mov byte ptr [ebp-1E], al
:0040EF7D EB17                    jmp 0040EF96

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040EF6D(C)
|
:0040EF7F 8A4D08                  mov cl, byte ptr [ebp+08]
:0040EF82 51                      push ecx
:0040EF83 E8780B0000              call 0040FB00
:0040EF88 83C404                  add esp, 00000004
:0040EF8B 25FF000000              and eax, 000000FF
:0040EF90 83E837                  sub eax, 00000037
:0040EF93 8845E2                  mov byte ptr [ebp-1E], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040EF7D(U)
|
:0040EF96 8A55E2                  mov dl, byte ptr [ebp-1E]
:0040EF99 885508                  mov byte ptr [ebp+08], dl
:0040EF9C 8B4508                  mov eax, dword ptr [ebp+08]
:0040EF9F 25FF000000              and eax, 000000FF
:0040EFA4 50                      push eax
:0040EFA5 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040EFA8 E80FFDFFFF              call 0040ECBC
:0040EFAD E91CFFFFFF              jmp 0040EECE
:0040EFB2 8A4D08                  mov cl, byte ptr [ebp+08]
:0040EFB5 51                      push ecx
:0040EFB6 E8050B0000              call 0040FAC0
:0040EFBB 83C404                  add esp, 00000004
:0040EFBE 85C0                    test eax, eax
:0040EFC0 7411                    je 0040EFD3
:0040EFC2 8B5508                  mov edx, dword ptr [ebp+08]
:0040EFC5 81E2FF000000            and edx, 000000FF
:0040EFCB 83EA30                  sub edx, 00000030
:0040EFCE 8855E1                  mov byte ptr [ebp-1F], dl
:0040EFD1 EB17                    jmp 0040EFEA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040EFC0(C)
|
:0040EFD3 8A4508                  mov al, byte ptr [ebp+08]
:0040EFD6 50                      push eax
:0040EFD7 E8240B0000              call 0040FB00
:0040EFDC 83C404                  add esp, 00000004
:0040EFDF 25FF000000              and eax, 000000FF
:0040EFE4 83E837                  sub eax, 00000037
:0040EFE7 8845E1                  mov byte ptr [ebp-1F], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040EFD1(U)
|
:0040EFEA 8A4DE1                  mov cl, byte ptr [ebp-1F]
:0040EFED 884D08                  mov byte ptr [ebp+08], cl
:0040EFF0 8B5508                  mov edx, dword ptr [ebp+08]
:0040EFF3 81E2FF000000            and edx, 000000FF
:0040EFF9 52                      push edx
:0040EFFA 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040EFFD E8F2FCFFFF              call 0040ECF4
:0040F002 E9C7FEFFFF              jmp 0040EECE
:0040F007 8B4508                  mov eax, dword ptr [ebp+08]
:0040F00A 25FF000000              and eax, 000000FF
:0040F00F 83E830                  sub eax, 00000030
:0040F012 50                      push eax
:0040F013 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040F016 E8EFFCFFFF              call 0040ED0A
:0040F01B E9AEFEFFFF              jmp 0040EECE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040EDEF(C)
|
:0040F020 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040F023 33D2                    xor edx, edx
:0040F025 8A5125                  mov dl, byte ptr [ecx+25]
:0040F028 85D2                    test edx, edx
:0040F02A 7425                    je 0040F051
:0040F02C 8B45EC                  mov eax, dword ptr [ebp-14]
:0040F02F 33C9                    xor ecx, ecx
:0040F031 8A4825                  mov cl, byte ptr [eax+25]
:0040F034 C1E108                  shl ecx, 08
:0040F037 8B5508                  mov edx, dword ptr [ebp+08]
:0040F03A 81E2FF000000            and edx, 000000FF
:0040F040 03CA                    add ecx, edx
:0040F042 894DFC                  mov dword ptr [ebp-04], ecx
:0040F045 8B45EC                  mov eax, dword ptr [ebp-14]
:0040F048 C6402500                mov [eax+25], 00
:0040F04C E99B000000              jmp 0040F0EC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F02A(C)
|
:0040F051 837D0C02                cmp dword ptr [ebp+0C], 00000002
:0040F055 7430                    je 0040F087
:0040F057 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040F05A 81E1FF000000            and ecx, 000000FF
:0040F060 81F980000000            cmp ecx, 00000080
:0040F066 7C1F                    jl 0040F087
:0040F068 8B5508                  mov edx, dword ptr [ebp+08]
:0040F06B 81E2FF000000            and edx, 000000FF
:0040F071 81FAFE000000            cmp edx, 000000FE
:0040F077 7F0E                    jg 0040F087
:0040F079 8B45EC                  mov eax, dword ptr [ebp-14]
:0040F07C 8A4D08                  mov cl, byte ptr [ebp+08]
:0040F07F 884825                  mov byte ptr [eax+25], cl
:0040F082 E97B010000              jmp 0040F202

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040F055(C), :0040F066(C), :0040F077(C)
|
:0040F087 8B5508                  mov edx, dword ptr [ebp+08]
:0040F08A 81E2FF000000            and edx, 000000FF
:0040F090 83FA1B                  cmp edx, 0000001B
:0040F093 750F                    jne 0040F0A4
:0040F095 8B45EC                  mov eax, dword ptr [ebp-14]
:0040F098 C7403C01000000          mov [eax+3C], 00000001
:0040F09F E95E010000              jmp 0040F202

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F093(C)
|
:0040F0A4 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040F0A7 81E1FF000000            and ecx, 000000FF
:0040F0AD 83F920                  cmp ecx, 00000020
:0040F0B0 7D2F                    jge 0040F0E1
:0040F0B2 8A5508                  mov dl, byte ptr [ebp+08]
:0040F0B5 8855DC                  mov byte ptr [ebp-24], dl
:0040F0B8 807DDC0A                cmp byte ptr [ebp-24], 0A
:0040F0BC 7408                    je 0040F0C6
:0040F0BE 807DDC0D                cmp byte ptr [ebp-24], 0D
:0040F0C2 740C                    je 0040F0D0
:0040F0C4 EB16                    jmp 0040F0DC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F0BC(C)
|
:0040F0C6 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040F0C9 E871FBFFFF              call 0040EC3F
:0040F0CE EB0C                    jmp 0040F0DC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F0C2(C)
|
:0040F0D0 8B45EC                  mov eax, dword ptr [ebp-14]
:0040F0D3 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040F0D6 8B511C                  mov edx, dword ptr [ecx+1C]
:0040F0D9 895004                  mov dword ptr [eax+04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040F0C4(U), :0040F0CE(U)
|
:0040F0DC E921010000              jmp 0040F202

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F0B0(C)
|
:0040F0E1 8B4508                  mov eax, dword ptr [ebp+08]
:0040F0E4 25FF000000              and eax, 000000FF
:0040F0E9 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F04C(U)
|
:0040F0EC 817DFC00020000          cmp dword ptr [ebp-04], 00000200
:0040F0F3 1BC9                    sbb ecx, ecx
:0040F0F5 F7D9                    neg ecx
:0040F0F7 894DF8                  mov dword ptr [ebp-08], ecx
:0040F0FA 837DF800                cmp dword ptr [ebp-08], 00000000
:0040F0FE 740B                    je 0040F10B
:0040F100 8B55EC                  mov edx, dword ptr [ebp-14]
:0040F103 8B4210                  mov eax, dword ptr [edx+10]
:0040F106 8945D8                  mov dword ptr [ebp-28], eax
:0040F109 EB0C                    jmp 0040F117

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F0FE(C)
|
:0040F10B 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040F10E 8B5110                  mov edx, dword ptr [ecx+10]
:0040F111 83EA01                  sub edx, 00000001
:0040F114 8955D8                  mov dword ptr [ebp-28], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F109(U)
|
:0040F117 8B45EC                  mov eax, dword ptr [ebp-14]
:0040F11A 8B4804                  mov ecx, dword ptr [eax+04]
:0040F11D 3B4DD8                  cmp ecx, dword ptr [ebp-28]
:0040F120 7626                    jbe 0040F148
:0040F122 8B55EC                  mov edx, dword ptr [ebp-14]
:0040F125 817A109F000000          cmp dword ptr [edx+10], 0000009F
:0040F12C 7412                    je 0040F140
:0040F12E 817DFC22210000          cmp dword ptr [ebp-04], 00002122
:0040F135 7209                    jb 0040F140
:0040F137 817DFC25210000          cmp dword ptr [ebp-04], 00002125
:0040F13E 7608                    jbe 0040F148

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040F12C(C), :0040F135(C)
|
:0040F140 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040F143 E8F7FAFFFF              call 0040EC3F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040F120(C), :0040F13E(C)
|
:0040F148 8B450C                  mov eax, dword ptr [ebp+0C]
:0040F14B 50                      push eax
:0040F14C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040F14F 51                      push ecx
:0040F150 8B55EC                  mov edx, dword ptr [ebp-14]
:0040F153 8B4208                  mov eax, dword ptr [edx+08]
:0040F156 50                      push eax
:0040F157 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040F15A 8B5104                  mov edx, dword ptr [ecx+04]
:0040F15D 52                      push edx
:0040F15E 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040F161 E8E2030000              call 0040F548
:0040F166 8945F0                  mov dword ptr [ebp-10], eax
:0040F169 8B45EC                  mov eax, dword ptr [ebp-14]
:0040F16C 33C9                    xor ecx, ecx
:0040F16E 8A08                    mov cl, byte ptr [eax]
:0040F170 83E140                  and ecx, 00000040
:0040F173 F7D9                    neg ecx
:0040F175 1BC9                    sbb ecx, ecx
:0040F177 F7D9                    neg ecx
:0040F179 83C101                  add ecx, 00000001
:0040F17C 894DF4                  mov dword ptr [ebp-0C], ecx
:0040F17F 8B55EC                  mov edx, dword ptr [ebp-14]
:0040F182 33C0                    xor eax, eax
:0040F184 8A02                    mov al, byte ptr [edx]
:0040F186 83E020                  and eax, 00000020
:0040F189 85C0                    test eax, eax
:0040F18B 7446                    je 0040F1D3
:0040F18D 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040F190 33D2                    xor edx, edx
:0040F192 8A5124                  mov dl, byte ptr [ecx+24]
:0040F195 8B45EC                  mov eax, dword ptr [ebp-14]
:0040F198 33C9                    xor ecx, ecx
:0040F19A 8A08                    mov cl, byte ptr [eax]
:0040F19C 81E1C0000000            and ecx, 000000C0
:0040F1A2 F7D9                    neg ecx
:0040F1A4 1BC9                    sbb ecx, ecx
:0040F1A6 83E110                  and ecx, 00000010
:0040F1A9 03D1                    add edx, ecx
:0040F1AB 8B45EC                  mov eax, dword ptr [ebp-14]
:0040F1AE 8B4808                  mov ecx, dword ptr [eax+08]
:0040F1B1 03CA                    add ecx, edx
:0040F1B3 8B55EC                  mov edx, dword ptr [ebp-14]
:0040F1B6 894A08                  mov dword ptr [edx+08], ecx
:0040F1B9 8B45EC                  mov eax, dword ptr [ebp-14]
:0040F1BC 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040F1BF 8B5008                  mov edx, dword ptr [eax+08]
:0040F1C2 3B5118                  cmp edx, dword ptr [ecx+18]
:0040F1C5 760A                    jbe 0040F1D1
:0040F1C7 8B45EC                  mov eax, dword ptr [ebp-14]
:0040F1CA C7400800000000          mov [eax+08], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F1C5(C)
|
:0040F1D1 EB2F                    jmp 0040F202

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F18B(C)
|
:0040F1D3 837D0C01                cmp dword ptr [ebp+0C], 00000001
:0040F1D7 7509                    jne 0040F1E2
:0040F1D9 C745D404000000          mov [ebp-2C], 00000004
:0040F1E0 EB11                    jmp 0040F1F3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F1D7(C)
|
:0040F1E2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040F1E5 F7D9                    neg ecx
:0040F1E7 1BC9                    sbb ecx, ecx
:0040F1E9 83C102                  add ecx, 00000002
:0040F1EC 0FAF4DF4                imul ecx, dword ptr [ebp-0C]
:0040F1F0 894DD4                  mov dword ptr [ebp-2C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F1E0(U)
|
:0040F1F3 8B55EC                  mov edx, dword ptr [ebp-14]
:0040F1F6 8B4204                  mov eax, dword ptr [edx+04]
:0040F1F9 0345D4                  add eax, dword ptr [ebp-2C]
:0040F1FC 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040F1FF 894104                  mov dword ptr [ecx+04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040EE8C(U), :0040EEB4(U), :0040EED8(U), :0040F082(U), :0040F09F(U)
|:0040F0DC(U), :0040F1D1(U)
|
:0040F202 8B45F0                  mov eax, dword ptr [ebp-10]
:0040F205 EB05                    jmp 0040F20C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040EE65(U)
|
:0040F207 E9C2FCFFFF              jmp 0040EECE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F205(U)
|
:0040F20C 8BE5                    mov esp, ebp
:0040F20E 5D                      pop ebp
:0040F20F C20800                  ret 0008



:0040F212 FFED4000                DWORD 0040EDFF
:0040F216 91EE4000                DWORD 0040EE91
:0040F21A B9EE4000                DWORD 0040EEB9
:0040F21E DDEE4000                DWORD 0040EEDD
:0040F222 2FEF4000                DWORD 0040EF2F
:0040F226 45EF4000                DWORD 0040EF45
:0040F22A 20F04000                DWORD 0040F020
:0040F22E 5FEF4000                DWORD 0040EF5F
:0040F232 B2EF4000                DWORD 0040EFB2
:0040F236 07F04000                DWORD 0040F007
:0040F23A 2BEE4000                DWORD 0040EE2B
:0040F23E 6AEE4000                DWORD 0040EE6A
:0040F242 37EE4000                DWORD 0040EE37
:0040F246 76EE4000                DWORD 0040EE76
:0040F24A 82EE4000                DWORD 0040EE82
:0040F24E 4FEE4000                DWORD 0040EE4F
:0040F252 43EE4000                DWORD 0040EE43
:0040F256 5BEE4000                DWORD 0040EE5B
:0040F25A 8CEE4000                DWORD 0040EE8C


:0040F25E 0008                    add byte ptr [eax], cl
:0040F260 0808                    or byte ptr [eax], cl
:0040F262 0801                    or byte ptr [ecx], al
:0040F264 0208                    add cl, byte ptr [eax]
:0040F266 0803                    or byte ptr [ebx], al
:0040F268 0408                    add al, 08
:0040F26A 0808                    or byte ptr [eax], cl
:0040F26C 0808                    or byte ptr [eax], cl
:0040F26E 0508080808              add eax, 08080808
:0040F273 06                      push es
:0040F274 0808                    or byte ptr [eax], cl
:0040F276 0808                    or byte ptr [eax], cl
:0040F278 07                      pop es

* Referenced by a CALL at Address:
|:0040F641   
|
:0040F279 55                      push ebp
:0040F27A 8BEC                    mov ebp, esp
:0040F27C 83EC18                  sub esp, 00000018
:0040F27F 8B4510                  mov eax, dword ptr [ebp+10]
:0040F282 C1E004                  shl eax, 04
:0040F285 50                      push eax
:0040F286 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0040F289 51                      push ecx
:0040F28A 8B5508                  mov edx, dword ptr [ebp+08]
:0040F28D 52                      push edx
:0040F28E E86A0A0700              call 0047FCFD
:0040F293 83C40C                  add esp, 0000000C
:0040F296 837D1001                cmp dword ptr [ebp+10], 00000001
:0040F29A 0F844B010000            je 0040F3EB
:0040F2A0 8B450C                  mov eax, dword ptr [ebp+0C]
:0040F2A3 8945FC                  mov dword ptr [ebp-04], eax
:0040F2A6 C745F800000000          mov [ebp-08], 00000000
:0040F2AD EB09                    jmp 0040F2B8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F304(U)
|
:0040F2AF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040F2B2 83C101                  add ecx, 00000001
:0040F2B5 894DF8                  mov dword ptr [ebp-08], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F2AD(U)
|
:0040F2B8 837DF810                cmp dword ptr [ebp-08], 00000010
:0040F2BC 7D48                    jge 0040F306
:0040F2BE 8B55FC                  mov edx, dword ptr [ebp-04]
:0040F2C1 668B02                  mov ax, word ptr [edx]
:0040F2C4 668945F4                mov word ptr [ebp-0C], ax
:0040F2C8 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040F2CB 81E1FFFF0000            and ecx, 0000FFFF
:0040F2D1 D1E1                    shl ecx, 1
:0040F2D3 8B55F4                  mov edx, dword ptr [ebp-0C]
:0040F2D6 81E2FFFF0000            and edx, 0000FFFF
:0040F2DC C1FA0F                  sar edx, 0F
:0040F2DF 0BCA                    or ecx, edx
:0040F2E1 81E1FEFF0000            and ecx, 0000FFFE
:0040F2E7 66894DF4                mov word ptr [ebp-0C], cx
:0040F2EB 8B45FC                  mov eax, dword ptr [ebp-04]
:0040F2EE 668B08                  mov cx, word ptr [eax]
:0040F2F1 660B4DF4                or cx, word ptr [ebp-0C]
:0040F2F5 8B55FC                  mov edx, dword ptr [ebp-04]
:0040F2F8 66890A                  mov word ptr [edx], cx
:0040F2FB 8B45FC                  mov eax, dword ptr [ebp-04]
:0040F2FE 83C002                  add eax, 00000002
:0040F301 8945FC                  mov dword ptr [ebp-04], eax
:0040F304 EBA9                    jmp 0040F2AF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F2BC(C)
|
:0040F306 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0040F309 894DFC                  mov dword ptr [ebp-04], ecx
:0040F30C C745F800000000          mov [ebp-08], 00000000
:0040F313 EB09                    jmp 0040F31E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F369(U)
|
:0040F315 8B55F8                  mov edx, dword ptr [ebp-08]
:0040F318 83C201                  add edx, 00000001
:0040F31B 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F313(U)
|
:0040F31E 837DF810                cmp dword ptr [ebp-08], 00000010
:0040F322 7D47                    jge 0040F36B
:0040F324 8B45FC                  mov eax, dword ptr [ebp-04]
:0040F327 668B08                  mov cx, word ptr [eax]
:0040F32A 66894DF0                mov word ptr [ebp-10], cx
:0040F32E 8B55F0                  mov edx, dword ptr [ebp-10]
:0040F331 81E2FFFF0000            and edx, 0000FFFF
:0040F337 D1FA                    sar edx, 1
:0040F339 8B45F0                  mov eax, dword ptr [ebp-10]
:0040F33C 25FFFF0000              and eax, 0000FFFF
:0040F341 C1E00F                  shl eax, 0F
:0040F344 0BD0                    or edx, eax
:0040F346 81E2FEFF0000            and edx, 0000FFFE
:0040F34C 668955F0                mov word ptr [ebp-10], dx
:0040F350 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040F353 668B11                  mov dx, word ptr [ecx]
:0040F356 660B55F0                or dx, word ptr [ebp-10]
:0040F35A 8B45FC                  mov eax, dword ptr [ebp-04]
:0040F35D 668910                  mov word ptr [eax], dx
:0040F360 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040F363 83C102                  add ecx, 00000002
:0040F366 894DFC                  mov dword ptr [ebp-04], ecx
:0040F369 EBAA                    jmp 0040F315

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F322(C)
|
:0040F36B 8B550C                  mov edx, dword ptr [ebp+0C]
:0040F36E 8955FC                  mov dword ptr [ebp-04], edx
:0040F371 C745F800000000          mov [ebp-08], 00000000
:0040F378 EB09                    jmp 0040F383

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F3A5(U)
|
:0040F37A 8B45F8                  mov eax, dword ptr [ebp-08]
:0040F37D 83C001                  add eax, 00000001
:0040F380 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F378(U)
|
:0040F383 837DF80F                cmp dword ptr [ebp-08], 0000000F
:0040F387 7D1E                    jge 0040F3A7
:0040F389 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040F38C 8B55FC                  mov edx, dword ptr [ebp-04]
:0040F38F 668B01                  mov ax, word ptr [ecx]
:0040F392 660B4202                or ax, word ptr [edx+02]
:0040F396 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040F399 668901                  mov word ptr [ecx], ax
:0040F39C 8B55FC                  mov edx, dword ptr [ebp-04]
:0040F39F 83C202                  add edx, 00000002
:0040F3A2 8955FC                  mov dword ptr [ebp-04], edx
:0040F3A5 EBD3                    jmp 0040F37A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F387(C)
|
:0040F3A7 8B450C                  mov eax, dword ptr [ebp+0C]
:0040F3AA 83C01E                  add eax, 0000001E
:0040F3AD 8945FC                  mov dword ptr [ebp-04], eax
:0040F3B0 C745F800000000          mov [ebp-08], 00000000
:0040F3B7 EB09                    jmp 0040F3C2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F3E4(U)
|
:0040F3B9 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040F3BC 83C101                  add ecx, 00000001
:0040F3BF 894DF8                  mov dword ptr [ebp-08], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F3B7(U)
|
:0040F3C2 837DF80F                cmp dword ptr [ebp-08], 0000000F
:0040F3C6 7D1E                    jge 0040F3E6
:0040F3C8 8B55FC                  mov edx, dword ptr [ebp-04]
:0040F3CB 8B45FC                  mov eax, dword ptr [ebp-04]
:0040F3CE 668B0A                  mov cx, word ptr [edx]
:0040F3D1 660B48FE                or cx, word ptr [eax-02]
:0040F3D5 8B55FC                  mov edx, dword ptr [ebp-04]
:0040F3D8 66890A                  mov word ptr [edx], cx
:0040F3DB 8B45FC                  mov eax, dword ptr [ebp-04]
:0040F3DE 83E802                  sub eax, 00000002
:0040F3E1 8945FC                  mov dword ptr [ebp-04], eax
:0040F3E4 EBD3                    jmp 0040F3B9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F3C6(C)
|
:0040F3E6 E912010000              jmp 0040F4FD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F29A(C)
|
:0040F3EB 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0040F3EE 894DEC                  mov dword ptr [ebp-14], ecx
:0040F3F1 C745E800000000          mov [ebp-18], 00000000
:0040F3F8 EB09                    jmp 0040F403

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F439(U)
|
:0040F3FA 8B55E8                  mov edx, dword ptr [ebp-18]
:0040F3FD 83C201                  add edx, 00000001
:0040F400 8955E8                  mov dword ptr [ebp-18], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F3F8(U)
|
:0040F403 837DE810                cmp dword ptr [ebp-18], 00000010
:0040F407 7D32                    jge 0040F43B
:0040F409 8B45EC                  mov eax, dword ptr [ebp-14]
:0040F40C 33C9                    xor ecx, ecx
:0040F40E 8A08                    mov cl, byte ptr [eax]
:0040F410 D1E1                    shl ecx, 1
:0040F412 8B55EC                  mov edx, dword ptr [ebp-14]
:0040F415 33C0                    xor eax, eax
:0040F417 8A02                    mov al, byte ptr [edx]
:0040F419 C1F807                  sar eax, 07
:0040F41C 0BC8                    or ecx, eax
:0040F41E 81E1FE000000            and ecx, 000000FE
:0040F424 8B55EC                  mov edx, dword ptr [ebp-14]
:0040F427 8A02                    mov al, byte ptr [edx]
:0040F429 0AC1                    or al, cl
:0040F42B 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040F42E 8801                    mov byte ptr [ecx], al
:0040F430 8B55EC                  mov edx, dword ptr [ebp-14]
:0040F433 83C201                  add edx, 00000001
:0040F436 8955EC                  mov dword ptr [ebp-14], edx
:0040F439 EBBF                    jmp 0040F3FA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F407(C)
|
:0040F43B 8B450C                  mov eax, dword ptr [ebp+0C]
:0040F43E 8945EC                  mov dword ptr [ebp-14], eax
:0040F441 C745E800000000          mov [ebp-18], 00000000
:0040F448 EB09                    jmp 0040F453

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F486(U)
|
:0040F44A 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0040F44D 83C101                  add ecx, 00000001
:0040F450 894DE8                  mov dword ptr [ebp-18], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F448(U)
|
:0040F453 837DE810                cmp dword ptr [ebp-18], 00000010
:0040F457 7D2F                    jge 0040F488
:0040F459 8B55EC                  mov edx, dword ptr [ebp-14]
:0040F45C 33C0                    xor eax, eax
:0040F45E 8A02                    mov al, byte ptr [edx]
:0040F460 D1F8                    sar eax, 1
:0040F462 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040F465 33D2                    xor edx, edx
:0040F467 8A11                    mov dl, byte ptr [ecx]
:0040F469 C1E207                  shl edx, 07
:0040F46C 0BC2                    or eax, edx
:0040F46E 83E07F                  and eax, 0000007F
:0040F471 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040F474 8A11                    mov dl, byte ptr [ecx]
:0040F476 0AD0                    or dl, al
:0040F478 8B45EC                  mov eax, dword ptr [ebp-14]
:0040F47B 8810                    mov byte ptr [eax], dl
:0040F47D 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040F480 83C101                  add ecx, 00000001
:0040F483 894DEC                  mov dword ptr [ebp-14], ecx
:0040F486 EBC2                    jmp 0040F44A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F457(C)
|
:0040F488 8B550C                  mov edx, dword ptr [ebp+0C]
:0040F48B 8955EC                  mov dword ptr [ebp-14], edx
:0040F48E C745E800000000          mov [ebp-18], 00000000
:0040F495 EB09                    jmp 0040F4A0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F4BF(U)
|
:0040F497 8B45E8                  mov eax, dword ptr [ebp-18]
:0040F49A 83C001                  add eax, 00000001
:0040F49D 8945E8                  mov dword ptr [ebp-18], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F495(U)
|
:0040F4A0 837DE80F                cmp dword ptr [ebp-18], 0000000F
:0040F4A4 7D1B                    jge 0040F4C1
:0040F4A6 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040F4A9 8B55EC                  mov edx, dword ptr [ebp-14]
:0040F4AC 8A01                    mov al, byte ptr [ecx]
:0040F4AE 0A4201                  or al, byte ptr [edx+01]
:0040F4B1 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040F4B4 8801                    mov byte ptr [ecx], al
:0040F4B6 8B55EC                  mov edx, dword ptr [ebp-14]
:0040F4B9 83C201                  add edx, 00000001
:0040F4BC 8955EC                  mov dword ptr [ebp-14], edx
:0040F4BF EBD6                    jmp 0040F497

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F4A4(C)
|
:0040F4C1 8B450C                  mov eax, dword ptr [ebp+0C]
:0040F4C4 83C00F                  add eax, 0000000F
:0040F4C7 8945EC                  mov dword ptr [ebp-14], eax
:0040F4CA C745E800000000          mov [ebp-18], 00000000
:0040F4D1 EB09                    jmp 0040F4DC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F4FB(U)
|
:0040F4D3 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0040F4D6 83C101                  add ecx, 00000001
:0040F4D9 894DE8                  mov dword ptr [ebp-18], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F4D1(U)
|
:0040F4DC 837DE80F                cmp dword ptr [ebp-18], 0000000F
:0040F4E0 7D1B                    jge 0040F4FD
:0040F4E2 8B55EC                  mov edx, dword ptr [ebp-14]
:0040F4E5 8B45EC                  mov eax, dword ptr [ebp-14]
:0040F4E8 8A0A                    mov cl, byte ptr [edx]
:0040F4EA 0A48FF                  or cl, byte ptr [eax-01]
:0040F4ED 8B55EC                  mov edx, dword ptr [ebp-14]
:0040F4F0 880A                    mov byte ptr [edx], cl
:0040F4F2 8B45EC                  mov eax, dword ptr [ebp-14]
:0040F4F5 83E801                  sub eax, 00000001
:0040F4F8 8945EC                  mov dword ptr [ebp-14], eax
:0040F4FB EBD6                    jmp 0040F4D3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040F3E6(U), :0040F4E0(C)
|
:0040F4FD 8BE5                    mov esp, ebp
:0040F4FF 5D                      pop ebp
:0040F500 C3                      ret


:0040F501 55                      push ebp
:0040F502 8BEC                    mov ebp, esp
:0040F504 6A00                    push 00000000
:0040F506 8B4518                  mov eax, dword ptr [ebp+18]
:0040F509 25FF000000              and eax, 000000FF
:0040F50E 50                      push eax
:0040F50F 8B4D18                  mov ecx, dword ptr [ebp+18]
:0040F512 81E100FF0000            and ecx, 0000FF00
:0040F518 C1E908                  shr ecx, 08
:0040F51B 51                      push ecx
:0040F51C E818DD0600              call 0047D239
:0040F521 83C40C                  add esp, 0000000C
:0040F524 8B551C                  mov edx, dword ptr [ebp+1C]
:0040F527 52                      push edx
:0040F528 8B4514                  mov eax, dword ptr [ebp+14]
:0040F52B 50                      push eax
:0040F52C 8B4D10                  mov ecx, dword ptr [ebp+10]
:0040F52F C1E103                  shl ecx, 03
:0040F532 51                      push ecx
:0040F533 8B550C                  mov edx, dword ptr [ebp+0C]
:0040F536 52                      push edx
:0040F537 8B4508                  mov eax, dword ptr [ebp+08]
:0040F53A C1E003                  shl eax, 03
:0040F53D 50                      push eax
:0040F53E E83FEE0600              call 0047E382
:0040F543 83C414                  add esp, 00000014
:0040F546 5D                      pop ebp
:0040F547 C3                      ret



* Referenced by a CALL at Address:
|:0040F161   
|
:0040F548 55                      push ebp
:0040F549 8BEC                    mov ebp, esp
:0040F54B 81ECA0010000            sub esp, 000001A0
:0040F551 898D60FEFFFF            mov dword ptr [ebp+FFFFFE60], ecx
:0040F557 C785F4FEFFFF01000000    mov dword ptr [ebp+FFFFFEF4], 00000001
:0040F561 837D1030                cmp dword ptr [ebp+10], 00000030
:0040F565 723A                    jb 0040F5A1
:0040F567 837D1039                cmp dword ptr [ebp+10], 00000039
:0040F56B 7734                    ja 0040F5A1
:0040F56D 6A10                    push 00000010
:0040F56F 8D4580                  lea eax, dword ptr [ebp-80]
:0040F572 50                      push eax
:0040F573 8B4D10                  mov ecx, dword ptr [ebp+10]
:0040F576 83E930                  sub ecx, 00000030
:0040F579 C1E104                  shl ecx, 04
:0040F57C 81C1A8B24800            add ecx, 0048B2A8
:0040F582 51                      push ecx
:0040F583 E875070700              call 0047FCFD
:0040F588 83C40C                  add esp, 0000000C
:0040F58B C785F4FEFFFF00000000    mov dword ptr [ebp+FFFFFEF4], 00000000
:0040F595 C785FCFEFFFF01000000    mov dword ptr [ebp+FFFFFEFC], 00000001
:0040F59F EB5C                    jmp 0040F5FD

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040F565(C), :0040F56B(C)
|
:0040F5A1 8B9560FEFFFF            mov edx, dword ptr [ebp+FFFFFE60]
:0040F5A7 33C0                    xor eax, eax
:0040F5A9 8A02                    mov al, byte ptr [edx]
:0040F5AB 83E020                  and eax, 00000020
:0040F5AE 85C0                    test eax, eax
:0040F5B0 740C                    je 0040F5BE
:0040F5B2 C785FCFEFFFF02000000    mov dword ptr [ebp+FFFFFEFC], 00000002
:0040F5BC EB3F                    jmp 0040F5FD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F5B0(C)
|
:0040F5BE 817D1000020000          cmp dword ptr [ebp+10], 00000200
:0040F5C5 731C                    jnb 0040F5E3
:0040F5C7 C785FCFEFFFF01000000    mov dword ptr [ebp+FFFFFEFC], 00000001
:0040F5D1 8D4D80                  lea ecx, dword ptr [ebp-80]
:0040F5D4 51                      push ecx
:0040F5D5 8B5510                  mov edx, dword ptr [ebp+10]
:0040F5D8 52                      push edx
:0040F5D9 E8BDF10600              call 0047E79B
:0040F5DE 83C408                  add esp, 00000008
:0040F5E1 EB1A                    jmp 0040F5FD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F5C5(C)
|
:0040F5E3 C785FCFEFFFF02000000    mov dword ptr [ebp+FFFFFEFC], 00000002
:0040F5ED 8D4580                  lea eax, dword ptr [ebp-80]
:0040F5F0 50                      push eax
:0040F5F1 8B4D10                  mov ecx, dword ptr [ebp+10]
:0040F5F4 51                      push ecx
:0040F5F5 E89EF00600              call 0047E698
:0040F5FA 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040F59F(U), :0040F5BC(U), :0040F5E1(U)
|
:0040F5FD 83BDF4FEFFFF01          cmp dword ptr [ebp+FFFFFEF4], 00000001
:0040F604 7513                    jne 0040F619
:0040F606 8B95FCFEFFFF            mov edx, dword ptr [ebp+FFFFFEFC]
:0040F60C 52                      push edx
:0040F60D 8D4580                  lea eax, dword ptr [ebp-80]
:0040F610 50                      push eax
:0040F611 E82B030000              call 0040F941
:0040F616 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F604(C)
|
:0040F619 C785F8FEFFFF10000000    mov dword ptr [ebp+FFFFFEF8], 00000010
:0040F623 8B8D60FEFFFF            mov ecx, dword ptr [ebp+FFFFFE60]
:0040F629 83793400                cmp dword ptr [ecx+34], 00000000
:0040F62D 745B                    je 0040F68A
:0040F62F 8B95FCFEFFFF            mov edx, dword ptr [ebp+FFFFFEFC]
:0040F635 52                      push edx
:0040F636 8D8500FFFFFF            lea eax, dword ptr [ebp+FFFFFF00]
:0040F63C 50                      push eax
:0040F63D 8D4D80                  lea ecx, dword ptr [ebp-80]
:0040F640 51                      push ecx
:0040F641 E833FCFFFF              call 0040F279
:0040F646 83C40C                  add esp, 0000000C
:0040F649 6A00                    push 00000000
:0040F64B 8B9560FEFFFF            mov edx, dword ptr [ebp+FFFFFE60]
:0040F651 8B4220                  mov eax, dword ptr [edx+20]
:0040F654 50                      push eax
:0040F655 6A04                    push 00000004
:0040F657 E8DDDB0600              call 0047D239
:0040F65C 83C40C                  add esp, 0000000C
:0040F65F 8D8D00FFFFFF            lea ecx, dword ptr [ebp+FFFFFF00]
:0040F665 51                      push ecx
:0040F666 8B95F8FEFFFF            mov edx, dword ptr [ebp+FFFFFEF8]
:0040F66C 52                      push edx
:0040F66D 8B85FCFEFFFF            mov eax, dword ptr [ebp+FFFFFEFC]
:0040F673 C1E003                  shl eax, 03
:0040F676 50                      push eax
:0040F677 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0040F67A 51                      push ecx
:0040F67B 8B5508                  mov edx, dword ptr [ebp+08]
:0040F67E C1E203                  shl edx, 03
:0040F681 52                      push edx
:0040F682 E8FBEC0600              call 0047E382
:0040F687 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F62D(C)
|
:0040F68A 8B8560FEFFFF            mov eax, dword ptr [ebp+FFFFFE60]
:0040F690 33C9                    xor ecx, ecx
:0040F692 8A4802                  mov cl, byte ptr [eax+02]
:0040F695 85C9                    test ecx, ecx
:0040F697 0F8527020000            jne 0040F8C4
:0040F69D 837D1400                cmp dword ptr [ebp+14], 00000000
:0040F6A1 0F8489010000            je 0040F830
:0040F6A7 C7856CFEFFFF00000000    mov dword ptr [ebp+FFFFFE6C], 00000000
:0040F6B1 EB0F                    jmp 0040F6C2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F7EA(U)
|
:0040F6B3 8B956CFEFFFF            mov edx, dword ptr [ebp+FFFFFE6C]
:0040F6B9 83C201                  add edx, 00000001
:0040F6BC 89956CFEFFFF            mov dword ptr [ebp+FFFFFE6C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F6B1(U)
|
:0040F6C2 83BD6CFEFFFF20          cmp dword ptr [ebp+FFFFFE6C], 00000020
:0040F6C9 0F8D20010000            jnl 0040F7EF
:0040F6CF C78568FEFFFF00000000    mov dword ptr [ebp+FFFFFE68], 00000000
:0040F6D9 EB0F                    jmp 0040F6EA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F7E5(U)
|
:0040F6DB 8B8568FEFFFF            mov eax, dword ptr [ebp+FFFFFE68]
:0040F6E1 83C001                  add eax, 00000001
:0040F6E4 898568FEFFFF            mov dword ptr [ebp+FFFFFE68], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F6D9(U)
|
:0040F6EA 83BD68FEFFFF02          cmp dword ptr [ebp+FFFFFE68], 00000002
:0040F6F1 0F8DF3000000            jnl 0040F7EA

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0040F6F7 C78564FEFFFF07000000    mov dword ptr [ebp+FFFFFE64], 00000007
:0040F701 EB0F                    jmp 0040F712

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F7E0(U)
|
:0040F703 8B8D64FEFFFF            mov ecx, dword ptr [ebp+FFFFFE64]
:0040F709 83E901                  sub ecx, 00000001
:0040F70C 898D64FEFFFF            mov dword ptr [ebp+FFFFFE64], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F701(U)
|
:0040F712 83BD64FEFFFF00          cmp dword ptr [ebp+FFFFFE64], 00000000
:0040F719 0F8CC6000000            jl 0040F7E5
:0040F71F 8B8564FEFFFF            mov eax, dword ptr [ebp+FFFFFE64]
:0040F725 99                      cdq
:0040F726 33C2                    xor eax, edx
:0040F728 2BC2                    sub eax, edx
:0040F72A 83E003                  and eax, 00000003
:0040F72D 33C2                    xor eax, edx
:0040F72F 2BC2                    sub eax, edx
:0040F731 83F803                  cmp eax, 00000003
:0040F734 7507                    jne 0040F73D
:0040F736 C68570FEFFFF00          mov byte ptr [ebp+FFFFFE70], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F734(C)
|
:0040F73D 8B856CFEFFFF            mov eax, dword ptr [ebp+FFFFFE6C]
:0040F743 99                      cdq
:0040F744 2BC2                    sub eax, edx
:0040F746 D1F8                    sar eax, 1
:0040F748 8B9568FEFFFF            mov edx, dword ptr [ebp+FFFFFE68]
:0040F74E 8D0442                  lea eax, dword ptr [edx+2*eax]
:0040F751 33C9                    xor ecx, ecx
:0040F753 8A4C0580                mov cl, byte ptr [ebp+eax-80]
:0040F757 8BD1                    mov edx, ecx
:0040F759 8B8D64FEFFFF            mov ecx, dword ptr [ebp+FFFFFE64]
:0040F75F D3FA                    sar edx, cl
:0040F761 83E201                  and edx, 00000001
:0040F764 85D2                    test edx, edx
:0040F766 742B                    je 0040F793
:0040F768 8B8564FEFFFF            mov eax, dword ptr [ebp+FFFFFE64]
:0040F76E 99                      cdq
:0040F76F 33C2                    xor eax, edx
:0040F771 2BC2                    sub eax, edx
:0040F773 83E003                  and eax, 00000003
:0040F776 33C2                    xor eax, edx
:0040F778 8BC8                    mov ecx, eax
:0040F77A 2BCA                    sub ecx, edx
:0040F77C D1E1                    shl ecx, 1
:0040F77E B803000000              mov eax, 00000003
:0040F783 D3E0                    shl eax, cl
:0040F785 8A8D70FEFFFF            mov cl, byte ptr [ebp+FFFFFE70]
:0040F78B 0AC8                    or cl, al
:0040F78D 888D70FEFFFF            mov byte ptr [ebp+FFFFFE70], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F766(C)
|
:0040F793 8B8564FEFFFF            mov eax, dword ptr [ebp+FFFFFE64]
:0040F799 99                      cdq
:0040F79A 33C2                    xor eax, edx
:0040F79C 2BC2                    sub eax, edx
:0040F79E 83E003                  and eax, 00000003
:0040F7A1 33C2                    xor eax, edx
:0040F7A3 2BC2                    sub eax, edx
:0040F7A5 85C0                    test eax, eax
:0040F7A7 7537                    jne 0040F7E0
:0040F7A9 8B8564FEFFFF            mov eax, dword ptr [ebp+FFFFFE64]
:0040F7AF 99                      cdq
:0040F7B0 83E203                  and edx, 00000003
:0040F7B3 03C2                    add eax, edx
:0040F7B5 C1F802                  sar eax, 02
:0040F7B8 83E801                  sub eax, 00000001
:0040F7BB F7D8                    neg eax
:0040F7BD 1BC0                    sbb eax, eax
:0040F7BF F7D8                    neg eax
:0040F7C1 8D940574FEFFFF          lea edx, dword ptr [ebp+eax-0000018C]
:0040F7C8 8B8568FEFFFF            mov eax, dword ptr [ebp+FFFFFE68]
:0040F7CE 8D0C42                  lea ecx, dword ptr [edx+2*eax]
:0040F7D1 8B956CFEFFFF            mov edx, dword ptr [ebp+FFFFFE6C]
:0040F7D7 8A8570FEFFFF            mov al, byte ptr [ebp+FFFFFE70]
:0040F7DD 880491                  mov byte ptr [ecx+4*edx], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F7A7(C)
|
:0040F7E0 E91EFFFFFF              jmp 0040F703

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F719(C)
|
:0040F7E5 E9F1FEFFFF              jmp 0040F6DB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F6F1(C)
|
:0040F7EA E9C4FEFFFF              jmp 0040F6B3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F6C9(C)
|
:0040F7EF 6A00                    push 00000000
:0040F7F1 8B8D60FEFFFF            mov ecx, dword ptr [ebp+FFFFFE60]
:0040F7F7 33D2                    xor edx, edx
:0040F7F9 8A5101                  mov dl, byte ptr [ecx+01]
:0040F7FC 52                      push edx
:0040F7FD 8B8560FEFFFF            mov eax, dword ptr [ebp+FFFFFE60]
:0040F803 33C9                    xor ecx, ecx
:0040F805 8A08                    mov cl, byte ptr [eax]
:0040F807 51                      push ecx
:0040F808 E82CDA0600              call 0047D239
:0040F80D 83C40C                  add esp, 0000000C
:0040F810 8D9574FEFFFF            lea edx, dword ptr [ebp+FFFFFE74]
:0040F816 52                      push edx
:0040F817 6A20                    push 00000020
:0040F819 6A20                    push 00000020
:0040F81B 8B450C                  mov eax, dword ptr [ebp+0C]
:0040F81E 50                      push eax
:0040F81F 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040F822 C1E103                  shl ecx, 03
:0040F825 51                      push ecx
:0040F826 E857EB0600              call 0047E382
:0040F82B 83C414                  add esp, 00000014
:0040F82E EB49                    jmp 0040F879

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F6A1(C)
|
:0040F830 6A00                    push 00000000
:0040F832 8B9560FEFFFF            mov edx, dword ptr [ebp+FFFFFE60]
:0040F838 33C0                    xor eax, eax
:0040F83A 8A4201                  mov al, byte ptr [edx+01]
:0040F83D 50                      push eax
:0040F83E 8B8D60FEFFFF            mov ecx, dword ptr [ebp+FFFFFE60]
:0040F844 33D2                    xor edx, edx
:0040F846 8A11                    mov dl, byte ptr [ecx]
:0040F848 52                      push edx
:0040F849 E8EBD90600              call 0047D239
:0040F84E 83C40C                  add esp, 0000000C
:0040F851 8D4580                  lea eax, dword ptr [ebp-80]
:0040F854 50                      push eax
:0040F855 8B8DF8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEF8]
:0040F85B 51                      push ecx
:0040F85C 8B95FCFEFFFF            mov edx, dword ptr [ebp+FFFFFEFC]
:0040F862 C1E203                  shl edx, 03
:0040F865 52                      push edx
:0040F866 8B450C                  mov eax, dword ptr [ebp+0C]
:0040F869 50                      push eax
:0040F86A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040F86D C1E103                  shl ecx, 03
:0040F870 51                      push ecx
:0040F871 E80CEB0600              call 0047E382
:0040F876 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F82E(U)
|
:0040F879 6A00                    push 00000000
:0040F87B 8B9560FEFFFF            mov edx, dword ptr [ebp+FFFFFE60]
:0040F881 33C0                    xor eax, eax
:0040F883 8A4201                  mov al, byte ptr [edx+01]
:0040F886 50                      push eax
:0040F887 8B8D60FEFFFF            mov ecx, dword ptr [ebp+FFFFFE60]
:0040F88D 33D2                    xor edx, edx
:0040F88F 8A11                    mov dl, byte ptr [ecx]
:0040F891 52                      push edx
:0040F892 E8A2D90600              call 0047D239
:0040F897 83C40C                  add esp, 0000000C
:0040F89A 8D4580                  lea eax, dword ptr [ebp-80]
:0040F89D 50                      push eax
:0040F89E 8B8DF8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEF8]
:0040F8A4 51                      push ecx
:0040F8A5 8B95FCFEFFFF            mov edx, dword ptr [ebp+FFFFFEFC]
:0040F8AB C1E203                  shl edx, 03
:0040F8AE 52                      push edx
:0040F8AF 8B450C                  mov eax, dword ptr [ebp+0C]
:0040F8B2 50                      push eax
:0040F8B3 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040F8B6 C1E103                  shl ecx, 03
:0040F8B9 51                      push ecx
:0040F8BA E8C3EA0600              call 0047E382
:0040F8BF 83C414                  add esp, 00000014
:0040F8C2 EB4A                    jmp 0040F90E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F697(C)
|
:0040F8C4 8B9560FEFFFF            mov edx, dword ptr [ebp+FFFFFE60]
:0040F8CA 33C0                    xor eax, eax
:0040F8CC 8A4202                  mov al, byte ptr [edx+02]
:0040F8CF 50                      push eax
:0040F8D0 8B8D60FEFFFF            mov ecx, dword ptr [ebp+FFFFFE60]
:0040F8D6 33D2                    xor edx, edx
:0040F8D8 8A5101                  mov dl, byte ptr [ecx+01]
:0040F8DB 52                      push edx
:0040F8DC 6A00                    push 00000000
:0040F8DE E856D90600              call 0047D239
:0040F8E3 83C40C                  add esp, 0000000C
:0040F8E6 8D4580                  lea eax, dword ptr [ebp-80]
:0040F8E9 50                      push eax
:0040F8EA 8B8DF8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEF8]
:0040F8F0 51                      push ecx
:0040F8F1 8B95FCFEFFFF            mov edx, dword ptr [ebp+FFFFFEFC]
:0040F8F7 C1E203                  shl edx, 03
:0040F8FA 52                      push edx
:0040F8FB 8B450C                  mov eax, dword ptr [ebp+0C]
:0040F8FE 50                      push eax
:0040F8FF 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040F902 C1E103                  shl ecx, 03
:0040F905 51                      push ecx
:0040F906 E877EA0600              call 0047E382
:0040F90B 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F8C2(U)
|
:0040F90E 8B9560FEFFFF            mov edx, dword ptr [ebp+FFFFFE60]
:0040F914 33C0                    xor eax, eax
:0040F916 8A4202                  mov al, byte ptr [edx+02]
:0040F919 50                      push eax
:0040F91A 8B8D60FEFFFF            mov ecx, dword ptr [ebp+FFFFFE60]
:0040F920 33D2                    xor edx, edx
:0040F922 8A5101                  mov dl, byte ptr [ecx+01]
:0040F925 52                      push edx
:0040F926 8B8560FEFFFF            mov eax, dword ptr [ebp+FFFFFE60]
:0040F92C 33C9                    xor ecx, ecx
:0040F92E 8A08                    mov cl, byte ptr [eax]
:0040F930 51                      push ecx
:0040F931 E803D90600              call 0047D239
:0040F936 83C40C                  add esp, 0000000C
:0040F939 33C0                    xor eax, eax
:0040F93B 8BE5                    mov esp, ebp
:0040F93D 5D                      pop ebp
:0040F93E C21000                  ret 0010



* Referenced by a CALL at Address:
|:0040F611   
|
:0040F941 55                      push ebp
:0040F942 8BEC                    mov ebp, esp
:0040F944 83EC08                  sub esp, 00000008
:0040F947 837D0C01                cmp dword ptr [ebp+0C], 00000001
:0040F94B 7502                    jne 0040F94F
:0040F94D EB7C                    jmp 0040F9CB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F94B(C)
|
:0040F94F 8B4508                  mov eax, dword ptr [ebp+08]
:0040F952 8945FC                  mov dword ptr [ebp-04], eax
:0040F955 C745F800000000          mov [ebp-08], 00000000
:0040F95C EB12                    jmp 0040F970

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F9C9(U)
|
:0040F95E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040F961 83C101                  add ecx, 00000001
:0040F964 894DF8                  mov dword ptr [ebp-08], ecx
:0040F967 8B55FC                  mov edx, dword ptr [ebp-04]
:0040F96A 83C201                  add edx, 00000001
:0040F96D 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F95C(U)
|
:0040F970 8B450C                  mov eax, dword ptr [ebp+0C]
:0040F973 C1E004                  shl eax, 04
:0040F976 3945F8                  cmp dword ptr [ebp-08], eax
:0040F979 7D50                    jge 0040F9CB
:0040F97B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040F97E 33D2                    xor edx, edx
:0040F980 8A11                    mov dl, byte ptr [ecx]
:0040F982 D1E2                    shl edx, 1
:0040F984 8B45FC                  mov eax, dword ptr [ebp-04]
:0040F987 8A08                    mov cl, byte ptr [eax]
:0040F989 0ACA                    or cl, dl
:0040F98B 8B55FC                  mov edx, dword ptr [ebp-04]
:0040F98E 880A                    mov byte ptr [edx], cl
:0040F990 837D0C01                cmp dword ptr [ebp+0C], 00000001
:0040F994 7433                    je 0040F9C9
:0040F996 8B45F8                  mov eax, dword ptr [ebp-08]
:0040F999 99                      cdq
:0040F99A 33C2                    xor eax, edx
:0040F99C 2BC2                    sub eax, edx
:0040F99E 83E001                  and eax, 00000001
:0040F9A1 33C2                    xor eax, edx
:0040F9A3 2BC2                    sub eax, edx
:0040F9A5 85C0                    test eax, eax
:0040F9A7 7520                    jne 0040F9C9
:0040F9A9 8B45FC                  mov eax, dword ptr [ebp-04]
:0040F9AC 33C9                    xor ecx, ecx
:0040F9AE 8A4801                  mov cl, byte ptr [eax+01]
:0040F9B1 81E180000000            and ecx, 00000080
:0040F9B7 F7D9                    neg ecx
:0040F9B9 1BC9                    sbb ecx, ecx
:0040F9BB F7D9                    neg ecx
:0040F9BD 8B55FC                  mov edx, dword ptr [ebp-04]
:0040F9C0 8A02                    mov al, byte ptr [edx]
:0040F9C2 0AC1                    or al, cl
:0040F9C4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040F9C7 8801                    mov byte ptr [ecx], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040F994(C), :0040F9A7(C)
|
:0040F9C9 EB93                    jmp 0040F95E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040F94D(U), :0040F979(C)
|
:0040F9CB 8BE5                    mov esp, ebp
:0040F9CD 5D                      pop ebp
:0040F9CE C3                      ret



* Referenced by a CALL at Addresses:
|:0040FA2A   , :0040FA8F   
|
:0040F9CF 55                      push ebp
:0040F9D0 8BEC                    mov ebp, esp
:0040F9D2 83EC08                  sub esp, 00000008
:0040F9D5 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FA11(U)
|
:0040F9DC 8B450C                  mov eax, dword ptr [ebp+0C]
:0040F9DF 33C9                    xor ecx, ecx
:0040F9E1 8A08                    mov cl, byte ptr [eax]
:0040F9E3 85C9                    test ecx, ecx
:0040F9E5 742C                    je 0040FA13
:0040F9E7 6A00                    push 00000000
:0040F9E9 8B550C                  mov edx, dword ptr [ebp+0C]
:0040F9EC 8A02                    mov al, byte ptr [edx]
:0040F9EE 8845FB                  mov byte ptr [ebp-05], al
:0040F9F1 8A4DFB                  mov cl, byte ptr [ebp-05]
:0040F9F4 51                      push ecx
:0040F9F5 8B550C                  mov edx, dword ptr [ebp+0C]
:0040F9F8 83C201                  add edx, 00000001
:0040F9FB 89550C                  mov dword ptr [ebp+0C], edx
:0040F9FE 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040FA01 E8BAF3FFFF              call 0040EDC0
:0040FA06 8945FC                  mov dword ptr [ebp-04], eax
:0040FA09 837DFC00                cmp dword ptr [ebp-04], 00000000
:0040FA0D 7402                    je 0040FA11
:0040FA0F EB02                    jmp 0040FA13

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FA0D(C)
|
:0040FA11 EBC9                    jmp 0040F9DC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040F9E5(C), :0040FA0F(U)
|
:0040FA13 8B45FC                  mov eax, dword ptr [ebp-04]
:0040FA16 8BE5                    mov esp, ebp
:0040FA18 5D                      pop ebp
:0040FA19 C3                      ret



* Referenced by a CALL at Address:
|:0042F65B   
|
:0040FA1A 55                      push ebp
:0040FA1B 8BEC                    mov ebp, esp
:0040FA1D E8B9EB0000              call 0041E5DB
:0040FA22 8B450C                  mov eax, dword ptr [ebp+0C]
:0040FA25 50                      push eax
:0040FA26 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040FA29 51                      push ecx
:0040FA2A E8A0FFFFFF              call 0040F9CF
:0040FA2F 83C408                  add esp, 00000008
:0040FA32 E8BFEB0000              call 0041E5F6
:0040FA37 5D                      pop ebp
:0040FA38 C3                      ret


:0040FA39 55                      push ebp
:0040FA3A 8BEC                    mov ebp, esp
:0040FA3C 83EC0C                  sub esp, 0000000C
:0040FA3F 8B4510                  mov eax, dword ptr [ebp+10]
:0040FA42 50                      push eax
:0040FA43 E812020700              call 0047FC5A
:0040FA48 83C404                  add esp, 00000004
:0040FA4B 8945F8                  mov dword ptr [ebp-08], eax
:0040FA4E 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0040FA51 3B4DF8                  cmp ecx, dword ptr [ebp-08]
:0040FA54 760D                    jbe 0040FA63
:0040FA56 8B550C                  mov edx, dword ptr [ebp+0C]
:0040FA59 2B55F8                  sub edx, dword ptr [ebp-08]
:0040FA5C D1EA                    shr edx, 1
:0040FA5E 8955F4                  mov dword ptr [ebp-0C], edx
:0040FA61 EB07                    jmp 0040FA6A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FA54(C)
|
:0040FA63 C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FA61(U)
|
:0040FA6A 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040FA6D 8945FC                  mov dword ptr [ebp-04], eax
:0040FA70 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040FA73 8B5104                  mov edx, dword ptr [ecx+04]
:0040FA76 0355FC                  add edx, dword ptr [ebp-04]
:0040FA79 52                      push edx
:0040FA7A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040FA7D E8D2F0FFFF              call 0040EB54
:0040FA82 E854EB0000              call 0041E5DB
:0040FA87 8B4510                  mov eax, dword ptr [ebp+10]
:0040FA8A 50                      push eax
:0040FA8B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040FA8E 51                      push ecx
:0040FA8F E83BFFFFFF              call 0040F9CF
:0040FA94 83C408                  add esp, 00000008
:0040FA97 E85AEB0000              call 0041E5F6
:0040FA9C 8BE5                    mov esp, ebp
:0040FA9E 5D                      pop ebp
:0040FA9F C3                      ret



* Referenced by a CALL at Addresses:
|:004086C7   , :00408719   , :0040875F   , :004087B3   , :00408858   
|:004088A9   , :004088FD   , :0041E830   , :0041E851   , :0042C97A   
|:0042CAA4   , :0042D238   , :0042D9D8   , :0042EA10   , :0042EF6A   
|:00431FCA   , :00432013   , :0043206C   , :004320A9   , :004320D9   
|:00432110   , :0043214D   , :0043216F   , :004321A6   , :004321E7   
|:00432210   , :0044045C   , :004405F4   , :00440614   , :00440CBF   
|:00440D0C   , :00440D2E   , :00440D78   , :00440DB3   , :00440DFC   
|:00440E2B   , :00440ED1   , :00440F0E   , :00440F47   , :00440F84   
|:00440FF3   , :0044102A   , :00441063   , :0044109C   , :004410D9   
|:0044117F   , :004411D0   , :004411F0   , :00441229   , :00441266   
|:004412DC   , :00441363   , :004413C8   , :00441431   , :0044B54A   
|:0044FC2D   , :004502DF   , :0045032C   , :00450377   , :004505A8   
|:004505CC   , :00450602   , :00450626   , :00450894   , :004508C4   
|:004508FA   , :0045092A   , :00450BB4   , :00450C01   , :00450C4C   
|:004510CB   , :00451104   , :004512CF   , :0045130B   , :0045134A   
|:00451364   , :004559CC   , :00455A1E   , :00455A4E   , :0045CC49   
|:0045D0D1   , :0045D1C7   , :0045E2EB   , :00460C1C   , :0046D820   
|:00473E22   , :00476302   , :00476443   , :004765EA   , :004766ED   
|
:0040FAA0 55                      push ebp
:0040FAA1 8BEC                    mov ebp, esp
:0040FAA3 E833EB0000              call 0041E5DB
:0040FAA8 8D450C                  lea eax, dword ptr [ebp+0C]
:0040FAAB 50                      push eax
:0040FAAC E8BAEAFFFF              call 0040E56B
:0040FAB1 83C404                  add esp, 00000004
:0040FAB4 E83DEB0000              call 0041E5F6
:0040FAB9 5D                      pop ebp
:0040FABA C3                      ret


:0040FABB CC                      int 03
:0040FABC CC                      int 03
:0040FABD CC                      int 03
:0040FABE CC                      int 03
:0040FABF CC                      int 03

* Referenced by a CALL at Addresses:
|:0040E647   , :0040EEE1   , :0040EF63   , :0040EFB6   
|
:0040FAC0 55                      push ebp
:0040FAC1 8BEC                    mov ebp, esp
:0040FAC3 51                      push ecx
:0040FAC4 8B4508                  mov eax, dword ptr [ebp+08]
:0040FAC7 25FF000000              and eax, 000000FF
:0040FACC 83F830                  cmp eax, 00000030
:0040FACF 7C17                    jl 0040FAE8
:0040FAD1 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040FAD4 81E1FF000000            and ecx, 000000FF
:0040FADA 83F939                  cmp ecx, 00000039
:0040FADD 7F09                    jg 0040FAE8
:0040FADF C745FC01000000          mov [ebp-04], 00000001
:0040FAE6 EB07                    jmp 0040FAEF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040FACF(C), :0040FADD(C)
|
:0040FAE8 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FAE6(U)
|
:0040FAEF 8B45FC                  mov eax, dword ptr [ebp-04]
:0040FAF2 8BE5                    mov esp, ebp
:0040FAF4 5D                      pop ebp
:0040FAF5 C3                      ret


:0040FAF6 CC                      int 03
:0040FAF7 CC                      int 03
:0040FAF8 CC                      int 03
:0040FAF9 CC                      int 03
:0040FAFA CC                      int 03
:0040FAFB CC                      int 03
:0040FAFC CC                      int 03
:0040FAFD CC                      int 03
:0040FAFE CC                      int 03
:0040FAFF CC                      int 03

* Referenced by a CALL at Addresses:
|:0040E6E1   , :0040EF02   , :0040EF83   , :0040EFD7   
|
:0040FB00 55                      push ebp
:0040FB01 8BEC                    mov ebp, esp
:0040FB03 51                      push ecx
:0040FB04 8B4508                  mov eax, dword ptr [ebp+08]
:0040FB07 25FF000000              and eax, 000000FF
:0040FB0C 83F861                  cmp eax, 00000061
:0040FB0F 7C1F                    jl 0040FB30
:0040FB11 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040FB14 81E1FF000000            and ecx, 000000FF
:0040FB1A 83F97A                  cmp ecx, 0000007A
:0040FB1D 7F11                    jg 0040FB30
:0040FB1F 8B5508                  mov edx, dword ptr [ebp+08]
:0040FB22 81E2FF000000            and edx, 000000FF
:0040FB28 83EA20                  sub edx, 00000020
:0040FB2B 8955FC                  mov dword ptr [ebp-04], edx
:0040FB2E EB0B                    jmp 0040FB3B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040FB0F(C), :0040FB1D(C)
|
:0040FB30 8B4508                  mov eax, dword ptr [ebp+08]
:0040FB33 25FF000000              and eax, 000000FF
:0040FB38 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FB2E(U)
|
:0040FB3B 8A45FC                  mov al, byte ptr [ebp-04]
:0040FB3E 8BE5                    mov esp, ebp
:0040FB40 5D                      pop ebp
:0040FB41 C3                      ret


:0040FB42 CC                      int 03
:0040FB43 CC                      int 03
:0040FB44 CC                      int 03
:0040FB45 CC                      int 03
:0040FB46 CC                      int 03
:0040FB47 CC                      int 03
:0040FB48 CC                      int 03
:0040FB49 CC                      int 03
:0040FB4A CC                      int 03
:0040FB4B CC                      int 03
:0040FB4C CC                      int 03
:0040FB4D CC                      int 03
:0040FB4E CC                      int 03
:0040FB4F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040FB84   , :00410442   
|
:0040FB50 55                      push ebp
:0040FB51 8BEC                    mov ebp, esp
:0040FB53 83EC08                  sub esp, 00000008
:0040FB56 894DF8                  mov dword ptr [ebp-08], ecx
:0040FB59 8B45F8                  mov eax, dword ptr [ebp-08]
:0040FB5C 8B4820                  mov ecx, dword ptr [eax+20]
:0040FB5F 8B55F8                  mov edx, dword ptr [ebp-08]
:0040FB62 034A30                  add ecx, dword ptr [edx+30]
:0040FB65 894DFC                  mov dword ptr [ebp-04], ecx
:0040FB68 8B45F8                  mov eax, dword ptr [ebp-08]
:0040FB6B 8B4804                  mov ecx, dword ptr [eax+04]
:0040FB6E 8B55FC                  mov edx, dword ptr [ebp-04]
:0040FB71 8B048A                  mov eax, dword ptr [edx+4*ecx]
:0040FB74 8BE5                    mov esp, ebp
:0040FB76 5D                      pop ebp
:0040FB77 C3                      ret



* Referenced by a CALL at Addresses:
|:0040FBB5   , :00410122   
|
:0040FB78 55                      push ebp
:0040FB79 8BEC                    mov ebp, esp
:0040FB7B 83EC08                  sub esp, 00000008
:0040FB7E 894DF8                  mov dword ptr [ebp-08], ecx
:0040FB81 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040FB84 E8C7FFFFFF              call 0040FB50
:0040FB89 8945FC                  mov dword ptr [ebp-04], eax
:0040FB8C 8B45F8                  mov eax, dword ptr [ebp-08]
:0040FB8F C7400800000000          mov [eax+08], 00000000
:0040FB96 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040FB99 8B5120                  mov edx, dword ptr [ecx+20]
:0040FB9C 0355FC                  add edx, dword ptr [ebp-04]
:0040FB9F 8B45F8                  mov eax, dword ptr [ebp-08]
:0040FBA2 89500C                  mov dword ptr [eax+0C], edx
:0040FBA5 8BE5                    mov esp, ebp
:0040FBA7 5D                      pop ebp
:0040FBA8 C3                      ret



* Referenced by a CALL at Address:
|:0041016D   
|
:0040FBA9 55                      push ebp
:0040FBAA 8BEC                    mov ebp, esp
:0040FBAC 83EC10                  sub esp, 00000010
:0040FBAF 894DF0                  mov dword ptr [ebp-10], ecx
:0040FBB2 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040FBB5 E8BEFFFFFF              call 0040FB78
:0040FBBA 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040FBBD E820010000              call 0040FCE2
:0040FBC2 25FFFF0000              and eax, 0000FFFF
:0040FBC7 8945F8                  mov dword ptr [ebp-08], eax
:0040FBCA C745FC00000000          mov [ebp-04], 00000000
:0040FBD1 EB09                    jmp 0040FBDC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FC12(U)
|
:0040FBD3 8B45FC                  mov eax, dword ptr [ebp-04]
:0040FBD6 83C001                  add eax, 00000001
:0040FBD9 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FBD1(U)
|
:0040FBDC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040FBDF 3B4D08                  cmp ecx, dword ptr [ebp+08]
:0040FBE2 7D30                    jge 0040FC14
:0040FBE4 8B55F0                  mov edx, dword ptr [ebp-10]
:0040FBE7 837A3400                cmp dword ptr [edx+34], 00000000
:0040FBEB 7408                    je 0040FBF5
:0040FBED 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040FBF0 E8ED000000              call 0040FCE2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FBEB(C)
|
:0040FBF5 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040FBF8 E8E5000000              call 0040FCE2
:0040FBFD 668945F4                mov word ptr [ebp-0C], ax
:0040FC01 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040FC04 25FFFF0000              and eax, 0000FFFF
:0040FC09 50                      push eax
:0040FC0A 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0040FC0D E829000000              call 0040FC3B
:0040FC12 EBBF                    jmp 0040FBD3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FBE2(C)
|
:0040FC14 8BE5                    mov esp, ebp
:0040FC16 5D                      pop ebp
:0040FC17 C20400                  ret 0004



* Referenced by a CALL at Address:
|:004101F5   
|
:0040FC1A 55                      push ebp
:0040FC1B 8BEC                    mov ebp, esp
:0040FC1D 51                      push ecx
:0040FC1E 56                      push esi
:0040FC1F 57                      push edi
:0040FC20 894DFC                  mov dword ptr [ebp-04], ecx
:0040FC23 8B7508                  mov esi, dword ptr [ebp+08]
:0040FC26 8B7DFC                  mov edi, dword ptr [ebp-04]
:0040FC29 83C704                  add edi, 00000004
:0040FC2C B905000000              mov ecx, 00000005
:0040FC31 F3                      repz
:0040FC32 A5                      movsd
:0040FC33 5F                      pop edi
:0040FC34 5E                      pop esi
:0040FC35 8BE5                    mov esp, ebp
:0040FC37 5D                      pop ebp
:0040FC38 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0040FC0D   , :004108A2   
|
:0040FC3B 55                      push ebp
:0040FC3C 8BEC                    mov ebp, esp
:0040FC3E 51                      push ecx
:0040FC3F 894DFC                  mov dword ptr [ebp-04], ecx
:0040FC42 8B45FC                  mov eax, dword ptr [ebp-04]
:0040FC45 8B4808                  mov ecx, dword ptr [eax+08]
:0040FC48 034D08                  add ecx, dword ptr [ebp+08]
:0040FC4B 8B55FC                  mov edx, dword ptr [ebp-04]
:0040FC4E 894A08                  mov dword ptr [edx+08], ecx
:0040FC51 8B45FC                  mov eax, dword ptr [ebp-04]
:0040FC54 8B480C                  mov ecx, dword ptr [eax+0C]
:0040FC57 034D08                  add ecx, dword ptr [ebp+08]
:0040FC5A 8B55FC                  mov edx, dword ptr [ebp-04]
:0040FC5D 894A0C                  mov dword ptr [edx+0C], ecx
:0040FC60 8BE5                    mov esp, ebp
:0040FC62 5D                      pop ebp
:0040FC63 C20400                  ret 0004



* Referenced by a CALL at Address:
|:004101D8   
|
:0040FC66 55                      push ebp
:0040FC67 8BEC                    mov ebp, esp
:0040FC69 51                      push ecx
:0040FC6A 56                      push esi
:0040FC6B 57                      push edi
:0040FC6C 894DFC                  mov dword ptr [ebp-04], ecx
:0040FC6F 8B75FC                  mov esi, dword ptr [ebp-04]
:0040FC72 83C604                  add esi, 00000004
:0040FC75 B905000000              mov ecx, 00000005
:0040FC7A 8B7D08                  mov edi, dword ptr [ebp+08]
:0040FC7D F3                      repz
:0040FC7E A5                      movsd
:0040FC7F 5F                      pop edi
:0040FC80 5E                      pop esi
:0040FC81 8BE5                    mov esp, ebp
:0040FC83 5D                      pop ebp
:0040FC84 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:004107A2   , :004107CA   
|
:0040FC87 55                      push ebp
:0040FC88 8BEC                    mov ebp, esp
:0040FC8A 83EC08                  sub esp, 00000008
:0040FC8D 894DF8                  mov dword ptr [ebp-08], ecx
:0040FC90 8B45F8                  mov eax, dword ptr [ebp-08]
:0040FC93 8B4820                  mov ecx, dword ptr [eax+20]
:0040FC96 8B55F8                  mov edx, dword ptr [ebp-08]
:0040FC99 034A30                  add ecx, dword ptr [edx+30]
:0040FC9C 894DFC                  mov dword ptr [ebp-04], ecx
:0040FC9F 8B45FC                  mov eax, dword ptr [ebp-04]
:0040FCA2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040FCA5 8B00                    mov eax, dword ptr [eax]
:0040FCA7 2B4130                  sub eax, dword ptr [ecx+30]
:0040FCAA C1E802                  shr eax, 02
:0040FCAD 8BE5                    mov esp, ebp
:0040FCAF 5D                      pop ebp
:0040FCB0 C3                      ret



* Referenced by a CALL at Addresses:
|:0040FCEE   , :0040FCFE   
|
:0040FCB1 55                      push ebp
:0040FCB2 8BEC                    mov ebp, esp
:0040FCB4 51                      push ecx
:0040FCB5 894DFC                  mov dword ptr [ebp-04], ecx
:0040FCB8 8B45FC                  mov eax, dword ptr [ebp-04]
:0040FCBB 8B4808                  mov ecx, dword ptr [eax+08]
:0040FCBE 83C101                  add ecx, 00000001
:0040FCC1 8B55FC                  mov edx, dword ptr [ebp-04]
:0040FCC4 894A08                  mov dword ptr [edx+08], ecx
:0040FCC7 8B45FC                  mov eax, dword ptr [ebp-04]
:0040FCCA 8B480C                  mov ecx, dword ptr [eax+0C]
:0040FCCD 8A01                    mov al, byte ptr [ecx]
:0040FCCF 8B55FC                  mov edx, dword ptr [ebp-04]
:0040FCD2 8B4A0C                  mov ecx, dword ptr [edx+0C]
:0040FCD5 83C101                  add ecx, 00000001
:0040FCD8 8B55FC                  mov edx, dword ptr [ebp-04]
:0040FCDB 894A0C                  mov dword ptr [edx+0C], ecx
:0040FCDE 8BE5                    mov esp, ebp
:0040FCE0 5D                      pop ebp
:0040FCE1 C3                      ret



* Referenced by a CALL at Addresses:
|:0040FBBD   , :0040FBF0   , :0040FBF8   , :0040FD26   , :0040FD36   
|:0041012A   , :0041017E   , :0041018A   , :004105FA   , :00410886   
|:004109FB   , :00418409   , :00418422   , :0041849B   
|
:0040FCE2 55                      push ebp
:0040FCE3 8BEC                    mov ebp, esp
:0040FCE5 83EC08                  sub esp, 00000008
:0040FCE8 894DF8                  mov dword ptr [ebp-08], ecx
:0040FCEB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040FCEE E8BEFFFFFF              call 0040FCB1
:0040FCF3 660FB6C0                movzx ax, al
:0040FCF7 668945FC                mov word ptr [ebp-04], ax
:0040FCFB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040FCFE E8AEFFFFFF              call 0040FCB1
:0040FD03 25FF000000              and eax, 000000FF
:0040FD08 C1E008                  shl eax, 08
:0040FD0B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040FD0E 81E1FFFF0000            and ecx, 0000FFFF
:0040FD14 0BC1                    or eax, ecx
:0040FD16 8BE5                    mov esp, ebp
:0040FD18 5D                      pop ebp
:0040FD19 C3                      ret



* Referenced by a CALL at Address:
|:0041845E   
|
:0040FD1A 55                      push ebp
:0040FD1B 8BEC                    mov ebp, esp
:0040FD1D 83EC08                  sub esp, 00000008
:0040FD20 894DF8                  mov dword ptr [ebp-08], ecx
:0040FD23 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040FD26 E8B7FFFFFF              call 0040FCE2
:0040FD2B 25FFFF0000              and eax, 0000FFFF
:0040FD30 8945FC                  mov dword ptr [ebp-04], eax
:0040FD33 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040FD36 E8A7FFFFFF              call 0040FCE2
:0040FD3B 25FFFF0000              and eax, 0000FFFF
:0040FD40 C1E010                  shl eax, 10
:0040FD43 0B45FC                  or eax, dword ptr [ebp-04]
:0040FD46 8BE5                    mov esp, ebp
:0040FD48 5D                      pop ebp
:0040FD49 C3                      ret



* Referenced by a CALL at Address:
|:0041847D   
|
:0040FD4A 55                      push ebp
:0040FD4B 8BEC                    mov ebp, esp
:0040FD4D 83EC08                  sub esp, 00000008
:0040FD50 894DF8                  mov dword ptr [ebp-08], ecx
:0040FD53 8B45F8                  mov eax, dword ptr [ebp-08]
:0040FD56 8B480C                  mov ecx, dword ptr [eax+0C]
:0040FD59 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FD79(U)
|
:0040FD5C 8B55F8                  mov edx, dword ptr [ebp-08]
:0040FD5F 8B420C                  mov eax, dword ptr [edx+0C]
:0040FD62 33C9                    xor ecx, ecx
:0040FD64 8A08                    mov cl, byte ptr [eax]
:0040FD66 8B55F8                  mov edx, dword ptr [ebp-08]
:0040FD69 8B420C                  mov eax, dword ptr [edx+0C]
:0040FD6C 83C001                  add eax, 00000001
:0040FD6F 8B55F8                  mov edx, dword ptr [ebp-08]
:0040FD72 89420C                  mov dword ptr [edx+0C], eax
:0040FD75 85C9                    test ecx, ecx
:0040FD77 7402                    je 0040FD7B
:0040FD79 EBE1                    jmp 0040FD5C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FD77(C)
|
:0040FD7B 8B45FC                  mov eax, dword ptr [ebp-04]
:0040FD7E 8BE5                    mov esp, ebp
:0040FD80 5D                      pop ebp
:0040FD81 C3                      ret



* Referenced by a CALL at Addresses:
|:0040FDAD   , :0040FDC4   
|
:0040FD82 55                      push ebp
:0040FD83 8BEC                    mov ebp, esp
:0040FD85 51                      push ecx
:0040FD86 894DFC                  mov dword ptr [ebp-04], ecx
:0040FD89 8B45FC                  mov eax, dword ptr [ebp-04]
:0040FD8C 8B480C                  mov ecx, dword ptr [eax+0C]
:0040FD8F 8B5508                  mov edx, dword ptr [ebp+08]
:0040FD92 8A0411                  mov al, byte ptr [ecx+edx]
:0040FD95 8BE5                    mov esp, ebp
:0040FD97 5D                      pop ebp
:0040FD98 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0040FDE7   , :0040FDFD   , :00418C0C   
|
:0040FD9B 55                      push ebp
:0040FD9C 8BEC                    mov ebp, esp
:0040FD9E 51                      push ecx
:0040FD9F 53                      push ebx
:0040FDA0 894DFC                  mov dword ptr [ebp-04], ecx
:0040FDA3 8B4508                  mov eax, dword ptr [ebp+08]
:0040FDA6 83C001                  add eax, 00000001
:0040FDA9 50                      push eax
:0040FDAA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040FDAD E8D0FFFFFF              call 0040FD82
:0040FDB2 8AD8                    mov bl, al
:0040FDB4 81E3FF000000            and ebx, 000000FF
:0040FDBA C1E308                  shl ebx, 08
:0040FDBD 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040FDC0 51                      push ecx
:0040FDC1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040FDC4 E8B9FFFFFF              call 0040FD82
:0040FDC9 25FF000000              and eax, 000000FF
:0040FDCE 0BD8                    or ebx, eax
:0040FDD0 668BC3                  mov ax, bx
:0040FDD3 5B                      pop ebx
:0040FDD4 8BE5                    mov esp, ebp
:0040FDD6 5D                      pop ebp
:0040FDD7 C20400                  ret 0004


:0040FDDA 55                      push ebp
:0040FDDB 8BEC                    mov ebp, esp
:0040FDDD 51                      push ecx
:0040FDDE 56                      push esi
:0040FDDF 894DFC                  mov dword ptr [ebp-04], ecx
:0040FDE2 6A01                    push 00000001
:0040FDE4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040FDE7 E8AFFFFFFF              call 0040FD9B
:0040FDEC 668BF0                  mov si, ax
:0040FDEF 81E6FFFF0000            and esi, 0000FFFF
:0040FDF5 C1E610                  shl esi, 10
:0040FDF8 6A00                    push 00000000
:0040FDFA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040FDFD E899FFFFFF              call 0040FD9B
:0040FE02 25FFFF0000              and eax, 0000FFFF
:0040FE07 0BC6                    or eax, esi
:0040FE09 5E                      pop esi
:0040FE0A 8BE5                    mov esp, ebp
:0040FE0C 5D                      pop ebp
:0040FE0D C3                      ret


:0040FE0E 55                      push ebp
:0040FE0F 8BEC                    mov ebp, esp
:0040FE11 51                      push ecx
:0040FE12 894DFC                  mov dword ptr [ebp-04], ecx
:0040FE15 8B45FC                  mov eax, dword ptr [ebp-04]
:0040FE18 8B400C                  mov eax, dword ptr [eax+0C]
:0040FE1B 8BE5                    mov esp, ebp
:0040FE1D 5D                      pop ebp
:0040FE1E C3                      ret



* Referenced by a CALL at Address:
|:00417977   
|
:0040FE1F 55                      push ebp
:0040FE20 8BEC                    mov ebp, esp
:0040FE22 83EC24                  sub esp, 00000024
:0040FE25 894DDC                  mov dword ptr [ebp-24], ecx
:0040FE28 6A00                    push 00000000
:0040FE2A E8C1110700              call 00480FF0
:0040FE2F 83C404                  add esp, 00000004
:0040FE32 8945FC                  mov dword ptr [ebp-04], eax
:0040FE35 8B45DC                  mov eax, dword ptr [ebp-24]
:0040FE38 83781C00                cmp dword ptr [eax+1C], 00000000
:0040FE3C 744F                    je 0040FE8D
:0040FE3E C745F400000000          mov [ebp-0C], 00000000
:0040FE45 EB09                    jmp 0040FE50

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FE76(U)
|
:0040FE47 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0040FE4A 83C101                  add ecx, 00000001
:0040FE4D 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FE45(U)
|
:0040FE50 8B55DC                  mov edx, dword ptr [ebp-24]
:0040FE53 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040FE56 3B4218                  cmp eax, dword ptr [edx+18]
:0040FE59 7D1D                    jge 0040FE78
:0040FE5B 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0040FE5E 8B511C                  mov edx, dword ptr [ecx+1C]
:0040FE61 8B45F4                  mov eax, dword ptr [ebp-0C]
:0040FE64 8B0C82                  mov ecx, dword ptr [edx+4*eax]
:0040FE67 894DEC                  mov dword ptr [ebp-14], ecx
:0040FE6A 8B55EC                  mov edx, dword ptr [ebp-14]
:0040FE6D 52                      push edx
:0040FE6E E8AD110700              call 00481020
:0040FE73 83C404                  add esp, 00000004
:0040FE76 EBCF                    jmp 0040FE47

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FE59(C)
|
:0040FE78 8B45DC                  mov eax, dword ptr [ebp-24]
:0040FE7B 8B481C                  mov ecx, dword ptr [eax+1C]
:0040FE7E 894DE8                  mov dword ptr [ebp-18], ecx
:0040FE81 8B55E8                  mov edx, dword ptr [ebp-18]
:0040FE84 52                      push edx
:0040FE85 E896110700              call 00481020
:0040FE8A 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FE3C(C)
|
:0040FE8D 8B45DC                  mov eax, dword ptr [ebp-24]
:0040FE90 8B4D08                  mov ecx, dword ptr [ebp+08]
:0040FE93 894818                  mov dword ptr [eax+18], ecx
:0040FE96 8B55DC                  mov edx, dword ptr [ebp-24]
:0040FE99 8B4218                  mov eax, dword ptr [edx+18]
:0040FE9C C1E002                  shl eax, 02
:0040FE9F 50                      push eax
:0040FEA0 E83B110700              call 00480FE0
:0040FEA5 83C404                  add esp, 00000004
:0040FEA8 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0040FEAB 89411C                  mov dword ptr [ecx+1C], eax
:0040FEAE 8B55DC                  mov edx, dword ptr [ebp-24]
:0040FEB1 837A1C00                cmp dword ptr [edx+1C], 00000000
:0040FEB5 7513                    jne 0040FECA
:0040FEB7 8B45FC                  mov eax, dword ptr [ebp-04]
:0040FEBA 50                      push eax
:0040FEBB E830110700              call 00480FF0
:0040FEC0 83C404                  add esp, 00000004
:0040FEC3 33C0                    xor eax, eax
:0040FEC5 E9C0000000              jmp 0040FF8A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FEB5(C)
|
:0040FECA C745F800000000          mov [ebp-08], 00000000
:0040FED1 EB09                    jmp 0040FEDC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FF74(U)
|
:0040FED3 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040FED6 83C101                  add ecx, 00000001
:0040FED9 894DF8                  mov dword ptr [ebp-08], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FED1(U)
|
:0040FEDC 8B55DC                  mov edx, dword ptr [ebp-24]
:0040FEDF 8B45F8                  mov eax, dword ptr [ebp-08]
:0040FEE2 3B4218                  cmp eax, dword ptr [edx+18]
:0040FEE5 0F8D8E000000            jnl 0040FF79
:0040FEEB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040FEEE 8B550C                  mov edx, dword ptr [ebp+0C]
:0040FEF1 8B048A                  mov eax, dword ptr [edx+4*ecx]
:0040FEF4 50                      push eax
:0040FEF5 E8E6100700              call 00480FE0
:0040FEFA 83C404                  add esp, 00000004
:0040FEFD 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0040FF00 8B511C                  mov edx, dword ptr [ecx+1C]
:0040FF03 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040FF06 89048A                  mov dword ptr [edx+4*ecx], eax
:0040FF09 8B55DC                  mov edx, dword ptr [ebp-24]
:0040FF0C 8B421C                  mov eax, dword ptr [edx+1C]
:0040FF0F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0040FF12 833C8800                cmp dword ptr [eax+4*ecx], 00000000
:0040FF16 755C                    jne 0040FF74
:0040FF18 C745F000000000          mov [ebp-10], 00000000
:0040FF1F EB09                    jmp 0040FF2A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FF4D(U)
|
:0040FF21 8B55F0                  mov edx, dword ptr [ebp-10]
:0040FF24 83C201                  add edx, 00000001
:0040FF27 8955F0                  mov dword ptr [ebp-10], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FF1F(U)
|
:0040FF2A 8B45F0                  mov eax, dword ptr [ebp-10]
:0040FF2D 3B45F8                  cmp eax, dword ptr [ebp-08]
:0040FF30 7D1D                    jge 0040FF4F
:0040FF32 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0040FF35 8B511C                  mov edx, dword ptr [ecx+1C]
:0040FF38 8B45F0                  mov eax, dword ptr [ebp-10]
:0040FF3B 8B0C82                  mov ecx, dword ptr [edx+4*eax]
:0040FF3E 894DE4                  mov dword ptr [ebp-1C], ecx
:0040FF41 8B55E4                  mov edx, dword ptr [ebp-1C]
:0040FF44 52                      push edx
:0040FF45 E8D6100700              call 00481020
:0040FF4A 83C404                  add esp, 00000004
:0040FF4D EBD2                    jmp 0040FF21

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FF30(C)
|
:0040FF4F 8B45DC                  mov eax, dword ptr [ebp-24]
:0040FF52 8B481C                  mov ecx, dword ptr [eax+1C]
:0040FF55 894DE0                  mov dword ptr [ebp-20], ecx
:0040FF58 8B55E0                  mov edx, dword ptr [ebp-20]
:0040FF5B 52                      push edx
:0040FF5C E8BF100700              call 00481020
:0040FF61 83C404                  add esp, 00000004
:0040FF64 8B45FC                  mov eax, dword ptr [ebp-04]
:0040FF67 50                      push eax
:0040FF68 E883100700              call 00480FF0
:0040FF6D 83C404                  add esp, 00000004
:0040FF70 33C0                    xor eax, eax
:0040FF72 EB16                    jmp 0040FF8A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FF16(C)
|
:0040FF74 E95AFFFFFF              jmp 0040FED3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FEE5(C)
|
:0040FF79 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0040FF7C 51                      push ecx
:0040FF7D E86E100700              call 00480FF0
:0040FF82 83C404                  add esp, 00000004
:0040FF85 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040FEC5(U), :0040FF72(U)
|
:0040FF8A 8BE5                    mov esp, ebp
:0040FF8C 5D                      pop ebp
:0040FF8D C20800                  ret 0008



* Referenced by a CALL at Address:
|:00417991   
|
:0040FF90 55                      push ebp
:0040FF91 8BEC                    mov ebp, esp
:0040FF93 83EC14                  sub esp, 00000014
:0040FF96 894DEC                  mov dword ptr [ebp-14], ecx
:0040FF99 8B45EC                  mov eax, dword ptr [ebp-14]
:0040FF9C 83781C00                cmp dword ptr [eax+1C], 00000000
:0040FFA0 7507                    jne 0040FFA9
:0040FFA2 33C0                    xor eax, eax
:0040FFA4 E99E000000              jmp 00410047

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FFA0(C)
|
:0040FFA9 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040FFAC 8B5508                  mov edx, dword ptr [ebp+08]
:0040FFAF 3B5118                  cmp edx, dword ptr [ecx+18]
:0040FFB2 7407                    je 0040FFBB
:0040FFB4 33C0                    xor eax, eax
:0040FFB6 E98C000000              jmp 00410047

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FFB2(C)
|
:0040FFBB C745FC00000000          mov [ebp-04], 00000000
:0040FFC2 EB09                    jmp 0040FFCD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410040(U)
|
:0040FFC4 8B45FC                  mov eax, dword ptr [ebp-04]
:0040FFC7 83C001                  add eax, 00000001
:0040FFCA 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FFC2(U)
|
:0040FFCD 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0040FFD0 8B55FC                  mov edx, dword ptr [ebp-04]
:0040FFD3 3B5118                  cmp edx, dword ptr [ecx+18]
:0040FFD6 7D6A                    jge 00410042
:0040FFD8 8B45EC                  mov eax, dword ptr [ebp-14]
:0040FFDB 8B481C                  mov ecx, dword ptr [eax+1C]
:0040FFDE 8B55FC                  mov edx, dword ptr [ebp-04]
:0040FFE1 833C9100                cmp dword ptr [ecx+4*edx], 00000000
:0040FFE5 7519                    jne 00410000
:0040FFE7 8B45EC                  mov eax, dword ptr [ebp-14]
:0040FFEA 8B481C                  mov ecx, dword ptr [eax+1C]
:0040FFED 894DF0                  mov dword ptr [ebp-10], ecx
:0040FFF0 8B55F0                  mov edx, dword ptr [ebp-10]
:0040FFF3 52                      push edx
:0040FFF4 E827100700              call 00481020
:0040FFF9 83C404                  add esp, 00000004
:0040FFFC 33C0                    xor eax, eax
:0040FFFE EB47                    jmp 00410047

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FFE5(C)
|
:00410000 8B45EC                  mov eax, dword ptr [ebp-14]
:00410003 8B481C                  mov ecx, dword ptr [eax+1C]
:00410006 8B55FC                  mov edx, dword ptr [ebp-04]
:00410009 8B0491                  mov eax, dword ptr [ecx+4*edx]
:0041000C 8945F8                  mov dword ptr [ebp-08], eax
:0041000F C745F400000000          mov [ebp-0C], 00000000
:00410016 EB09                    jmp 00410021

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041003E(U)
|
:00410018 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041001B 83C101                  add ecx, 00000001
:0041001E 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410016(U)
|
:00410021 8B55FC                  mov edx, dword ptr [ebp-04]
:00410024 8B450C                  mov eax, dword ptr [ebp+0C]
:00410027 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041002A 3B0C90                  cmp ecx, dword ptr [eax+4*edx]
:0041002D 7D11                    jge 00410040
:0041002F 8B55F8                  mov edx, dword ptr [ebp-08]
:00410032 C602FF                  mov byte ptr [edx], FF
:00410035 8B45F8                  mov eax, dword ptr [ebp-08]
:00410038 83C001                  add eax, 00000001
:0041003B 8945F8                  mov dword ptr [ebp-08], eax
:0041003E EBD8                    jmp 00410018

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041002D(C)
|
:00410040 EB82                    jmp 0040FFC4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FFD6(C)
|
:00410042 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040FFA4(U), :0040FFB6(U), :0040FFFE(U)
|
:00410047 8BE5                    mov esp, ebp
:00410049 5D                      pop ebp
:0041004A C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:00411A2D   , :00411D7C   , :00411DA7   
|
:0041004D 55                      push ebp
:0041004E 8BEC                    mov ebp, esp
:00410050 51                      push ecx
:00410051 894DFC                  mov dword ptr [ebp-04], ecx
:00410054 8B4510                  mov eax, dword ptr [ebp+10]
:00410057 50                      push eax
:00410058 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041005B 8B511C                  mov edx, dword ptr [ecx+1C]
:0041005E 8B4508                  mov eax, dword ptr [ebp+08]
:00410061 8B0C82                  mov ecx, dword ptr [edx+4*eax]
:00410064 51                      push ecx
:00410065 8B550C                  mov edx, dword ptr [ebp+0C]
:00410068 52                      push edx
:00410069 E882070700              call 004807F0
:0041006E 83C40C                  add esp, 0000000C
:00410071 8BE5                    mov esp, ebp
:00410073 5D                      pop ebp
:00410074 C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:004181D2   , :0041820E   , :00418557   , :0044F852   , :0044F892   
|:0045B922   
|
:00410077 55                      push ebp
:00410078 8BEC                    mov ebp, esp
:0041007A 51                      push ecx
:0041007B 894DFC                  mov dword ptr [ebp-04], ecx
:0041007E 8B4510                  mov eax, dword ptr [ebp+10]
:00410081 50                      push eax
:00410082 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00410085 51                      push ecx
:00410086 8B55FC                  mov edx, dword ptr [ebp-04]
:00410089 8B421C                  mov eax, dword ptr [edx+1C]
:0041008C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041008F 8B1488                  mov edx, dword ptr [eax+4*ecx]
:00410092 52                      push edx
:00410093 E858070700              call 004807F0
:00410098 83C40C                  add esp, 0000000C
:0041009B 8BE5                    mov esp, ebp
:0041009D 5D                      pop ebp
:0041009E C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:004180D4   , :0041817E   , :00418357   , :0041855F   
|
:004100A1 55                      push ebp
:004100A2 8BEC                    mov ebp, esp
:004100A4 6AFF                    push FFFFFFFF
:004100A6 68C9504800              push 004850C9
:004100AB 64A100000000            mov eax, dword ptr fs:[00000000]
:004100B1 50                      push eax
:004100B2 64892500000000          mov dword ptr fs:[00000000], esp
:004100B9 83EC34                  sub esp, 00000034
:004100BC 894DC0                  mov dword ptr [ebp-40], ecx
:004100BF 8B45C0                  mov eax, dword ptr [ebp-40]
:004100C2 33C9                    xor ecx, ecx
:004100C4 668B4810                mov cx, word ptr [eax+10]
:004100C8 81F9FFFF0000            cmp ecx, 0000FFFF
:004100CE 7429                    je 004100F9
:004100D0 8B55C0                  mov edx, dword ptr [ebp-40]
:004100D3 8B02                    mov eax, dword ptr [edx]
:004100D5 8B4DC0                  mov ecx, dword ptr [ebp-40]
:004100D8 FF500C                  call [eax+0C]
:004100DB 85C0                    test eax, eax
:004100DD 7407                    je 004100E6
:004100DF 33C0                    xor eax, eax
:004100E1 E948010000              jmp 0041022E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004100DD(C)
|
:004100E6 8B4DC0                  mov ecx, dword ptr [ebp-40]
:004100E9 66C74110FFFF            mov [ecx+10], FFFF
:004100EF B801000000              mov eax, 00000001
:004100F4 E935010000              jmp 0041022E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004100CE(C)
|
:004100F9 8B4DC0                  mov ecx, dword ptr [ebp-40]
:004100FC E84F080000              call 00410950
:00410101 85C0                    test eax, eax
:00410103 7507                    jne 0041010C
:00410105 33C0                    xor eax, eax
:00410107 E922010000              jmp 0041022E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410103(C)
|
:0041010C 8B4DC0                  mov ecx, dword ptr [ebp-40]
:0041010F E85C080000              call 00410970
:00410114 85C0                    test eax, eax
:00410116 7407                    je 0041011F
:00410118 33C0                    xor eax, eax
:0041011A E90F010000              jmp 0041022E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410116(C)
|
:0041011F 8B4DC0                  mov ecx, dword ptr [ebp-40]
:00410122 E851FAFFFF              call 0040FB78
:00410127 8B4DC0                  mov ecx, dword ptr [ebp-40]
:0041012A E8B3FBFFFF              call 0040FCE2
:0041012F 25FFFF0000              and eax, 0000FFFF
:00410134 8B55C0                  mov edx, dword ptr [ebp-40]
:00410137 894224                  mov dword ptr [edx+24], eax
:0041013A 8D4DE0                  lea ecx, dword ptr [ebp-20]
:0041013D E8CE070000              call 00410910
:00410142 C745FC00000000          mov [ebp-04], 00000000
:00410149 C745DC00000000          mov [ebp-24], 00000000
:00410150 EB09                    jmp 0041015B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004101DD(U)
|
:00410152 8B45DC                  mov eax, dword ptr [ebp-24]
:00410155 83C001                  add eax, 00000001
:00410158 8945DC                  mov dword ptr [ebp-24], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410150(U)
|
:0041015B 8B4DC0                  mov ecx, dword ptr [ebp-40]
:0041015E 8B55DC                  mov edx, dword ptr [ebp-24]
:00410161 3B5124                  cmp edx, dword ptr [ecx+24]
:00410164 7D7C                    jge 004101E2
:00410166 8B45DC                  mov eax, dword ptr [ebp-24]
:00410169 50                      push eax
:0041016A 8B4DC0                  mov ecx, dword ptr [ebp-40]
:0041016D E837FAFFFF              call 0040FBA9
:00410172 8B4DC0                  mov ecx, dword ptr [ebp-40]
:00410175 83793400                cmp dword ptr [ecx+34], 00000000
:00410179 740C                    je 00410187
:0041017B 8B4DC0                  mov ecx, dword ptr [ebp-40]
:0041017E E85FFBFFFF              call 0040FCE2
:00410183 668945D8                mov word ptr [ebp-28], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410179(C)
|
:00410187 8B4DC0                  mov ecx, dword ptr [ebp-40]
:0041018A E853FBFFFF              call 0040FCE2
:0041018F 668945D0                mov word ptr [ebp-30], ax
:00410193 C745D401000000          mov [ebp-2C], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004101C9(C)
|
:0041019A 8B55C0                  mov edx, dword ptr [ebp-40]
:0041019D 8B02                    mov eax, dword ptr [edx]
:0041019F 8B4DC0                  mov ecx, dword ptr [ebp-40]
:004101A2 FF5008                  call [eax+08]
:004101A5 8945CC                  mov dword ptr [ebp-34], eax
:004101A8 837DCC01                cmp dword ptr [ebp-34], 00000001
:004101AC 7406                    je 004101B4
:004101AE 837DCC00                cmp dword ptr [ebp-34], 00000000
:004101B2 7511                    jne 004101C5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004101AC(C)
|
:004101B4 33C9                    xor ecx, ecx
:004101B6 837DCC01                cmp dword ptr [ebp-34], 00000001
:004101BA 0F94C1                  sete cl
:004101BD 8B55D4                  mov edx, dword ptr [ebp-2C]
:004101C0 23D1                    and edx, ecx
:004101C2 8955D4                  mov dword ptr [ebp-2C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004101B2(C)
|
:004101C5 837DCC03                cmp dword ptr [ebp-34], 00000003
:004101C9 75CF                    jne 0041019A
:004101CB 837DD400                cmp dword ptr [ebp-2C], 00000000
:004101CF 740C                    je 004101DD
:004101D1 8D45E0                  lea eax, dword ptr [ebp-20]
:004101D4 50                      push eax
:004101D5 8B4DC0                  mov ecx, dword ptr [ebp-40]
:004101D8 E889FAFFFF              call 0040FC66

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004101CF(C)
|
:004101DD E970FFFFFF              jmp 00410152

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410164(C)
|
:004101E2 837DE000                cmp dword ptr [ebp-20], 00000000
:004101E6 7C2D                    jl 00410215
:004101E8 837DE400                cmp dword ptr [ebp-1C], 00000000
:004101EC 7C27                    jl 00410215
:004101EE 8D4DE0                  lea ecx, dword ptr [ebp-20]
:004101F1 51                      push ecx
:004101F2 8B4DC0                  mov ecx, dword ptr [ebp-40]
:004101F5 E820FAFFFF              call 0040FC1A
:004101FA C745C801000000          mov [ebp-38], 00000001
:00410201 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00410208 8D4DE0                  lea ecx, dword ptr [ebp-20]
:0041020B E800B30100              call 0042B510
:00410210 8B45C8                  mov eax, dword ptr [ebp-38]
:00410213 EB19                    jmp 0041022E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004101E6(C), :004101EC(C)
|
:00410215 C745C400000000          mov [ebp-3C], 00000000
:0041021C C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00410223 8D4DE0                  lea ecx, dword ptr [ebp-20]
:00410226 E8E5B20100              call 0042B510
:0041022B 8B45C4                  mov eax, dword ptr [ebp-3C]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004100E1(U), :004100F4(U), :00410107(U), :0041011A(U), :00410213(U)
|
:0041022E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00410231 64890D00000000          mov dword ptr fs:[00000000], ecx
:00410238 8BE5                    mov esp, ebp
:0041023A 5D                      pop ebp
:0041023B C3                      ret



* Referenced by a CALL at Addresses:
|:0042BFB5   , :0042C016   
|
:0041023C 55                      push ebp
:0041023D 8BEC                    mov ebp, esp
:0041023F 51                      push ecx
:00410240 894DFC                  mov dword ptr [ebp-04], ecx
:00410243 8B45FC                  mov eax, dword ptr [ebp-04]
:00410246 C7400400000000          mov [eax+04], 00000000
:0041024D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00410250 C7410800000000          mov [ecx+08], 00000000
:00410257 8B55FC                  mov edx, dword ptr [ebp-04]
:0041025A 66C74210FFFF            mov [edx+10], FFFF
:00410260 8B45FC                  mov eax, dword ptr [ebp-04]
:00410263 C74014FFFFFFFF          mov [eax+14], FFFFFFFF
:0041026A B801000000              mov eax, 00000001
:0041026F 8BE5                    mov esp, ebp
:00410271 5D                      pop ebp
:00410272 C3                      ret



* Referenced by a CALL at Address:
|:00418044   
|
:00410273 55                      push ebp
:00410274 8BEC                    mov ebp, esp
:00410276 83EC24                  sub esp, 00000024
:00410279 894DE0                  mov dword ptr [ebp-20], ecx
:0041027C 8B45E0                  mov eax, dword ptr [ebp-20]
:0041027F 83782000                cmp dword ptr [eax+20], 00000000
:00410283 7415                    je 0041029A
:00410285 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00410288 8B5120                  mov edx, dword ptr [ecx+20]
:0041028B 8955E4                  mov dword ptr [ebp-1C], edx
:0041028E 8B45E4                  mov eax, dword ptr [ebp-1C]
:00410291 50                      push eax
:00410292 E8890D0700              call 00481020
:00410297 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410283(C)
|
:0041029A 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0041029D C7413400000000          mov [ecx+34], 00000000
:004102A4 8B5508                  mov edx, dword ptr [ebp+08]
:004102A7 8955FC                  mov dword ptr [ebp-04], edx
:004102AA 6A04                    push 00000004

* Possible StringData Ref from Data Obj ->"EEX"
                                  |
:004102AC 6848B34800              push 0048B348
:004102B1 8B45FC                  mov eax, dword ptr [ebp-04]
:004102B4 50                      push eax
:004102B5 E8C60F0700              call 00481280
:004102BA 83C40C                  add esp, 0000000C
:004102BD 85C0                    test eax, eax
:004102BF 7407                    je 004102C8
:004102C1 33C0                    xor eax, eax
:004102C3 E9A2010000              jmp 0041046A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004102BF(C)
|
:004102C8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004102CB 33D2                    xor edx, edx
:004102CD 8A5104                  mov dl, byte ptr [ecx+04]
:004102D0 83FA01                  cmp edx, 00000001
:004102D3 7E07                    jle 004102DC
:004102D5 33C0                    xor eax, eax
:004102D7 E98E010000              jmp 0041046A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004102D3(C)
|
:004102DC 8B45FC                  mov eax, dword ptr [ebp-04]
:004102DF 33C9                    xor ecx, ecx
:004102E1 8A4804                  mov cl, byte ptr [eax+04]
:004102E4 83F901                  cmp ecx, 00000001
:004102E7 7514                    jne 004102FD
:004102E9 8B55FC                  mov edx, dword ptr [ebp-04]
:004102EC 33C0                    xor eax, eax
:004102EE 8A4205                  mov al, byte ptr [edx+05]
:004102F1 83F802                  cmp eax, 00000002
:004102F4 7E07                    jle 004102FD
:004102F6 33C0                    xor eax, eax
:004102F8 E96D010000              jmp 0041046A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004102E7(C), :004102F4(C)
|
:004102FD 8B4DE0                  mov ecx, dword ptr [ebp-20]

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:00410300 C7413006000000          mov [ecx+30], 00000006
:00410307 8B55FC                  mov edx, dword ptr [ebp-04]
:0041030A 33C0                    xor eax, eax
:0041030C 8A4204                  mov al, byte ptr [edx+04]
:0041030F 83F801                  cmp eax, 00000001
:00410312 7F11                    jg 00410325
:00410314 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00410317 33D2                    xor edx, edx
:00410319 8A5105                  mov dl, byte ptr [ecx+05]
:0041031C 83FA01                  cmp edx, 00000001
:0041031F 0F8C07010000            jl 0041042C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410312(C)
|
:00410325 8B45FC                  mov eax, dword ptr [ebp-04]
:00410328 83C006                  add eax, 00000006
:0041032B 8945F8                  mov dword ptr [ebp-08], eax
:0041032E C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410419(U)
|
:00410335 837DF400                cmp dword ptr [ebp-0C], 00000000
:00410339 0F85DF000000            jne 0041041E
:0041033F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00410342 660FB611                movzx dx, byte ptr [ecx]
:00410346 668955F0                mov word ptr [ebp-10], dx
:0041034A 8B45F8                  mov eax, dword ptr [ebp-08]
:0041034D 83C001                  add eax, 00000001
:00410350 8945F8                  mov dword ptr [ebp-08], eax
:00410353 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00410356 33D2                    xor edx, edx
:00410358 8A11                    mov dl, byte ptr [ecx]
:0041035A C1E208                  shl edx, 08
:0041035D 668B45F0                mov ax, word ptr [ebp-10]
:00410361 660BC2                  or ax, dx
:00410364 668945F0                mov word ptr [ebp-10], ax
:00410368 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041036B 83C101                  add ecx, 00000001
:0041036E 894DF8                  mov dword ptr [ebp-08], ecx
:00410371 8B55F8                  mov edx, dword ptr [ebp-08]
:00410374 660FB602                movzx ax, byte ptr [edx]
:00410378 668945E8                mov word ptr [ebp-18], ax
:0041037C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041037F 83C101                  add ecx, 00000001
:00410382 894DF8                  mov dword ptr [ebp-08], ecx
:00410385 8B55F8                  mov edx, dword ptr [ebp-08]
:00410388 33C0                    xor eax, eax
:0041038A 8A02                    mov al, byte ptr [edx]
:0041038C C1E008                  shl eax, 08
:0041038F 668B4DE8                mov cx, word ptr [ebp-18]
:00410393 660BC8                  or cx, ax
:00410396 66894DE8                mov word ptr [ebp-18], cx
:0041039A 8B55F8                  mov edx, dword ptr [ebp-08]
:0041039D 83C201                  add edx, 00000001
:004103A0 8955F8                  mov dword ptr [ebp-08], edx
:004103A3 8B45E8                  mov eax, dword ptr [ebp-18]
:004103A6 25FFFF0000              and eax, 0000FFFF
:004103AB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004103AE 03C8                    add ecx, eax
:004103B0 894DEC                  mov dword ptr [ebp-14], ecx
:004103B3 8B55F0                  mov edx, dword ptr [ebp-10]
:004103B6 81E2FFFF0000            and edx, 0000FFFF
:004103BC 8955DC                  mov dword ptr [ebp-24], edx
:004103BF 837DDC00                cmp dword ptr [ebp-24], 00000000
:004103C3 7408                    je 004103CD
:004103C5 837DDC01                cmp dword ptr [ebp-24], 00000001
:004103C9 740B                    je 004103D6
:004103CB EB46                    jmp 00410413

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004103C3(C)
|
:004103CD C745F401000000          mov [ebp-0C], 00000001
:004103D4 EB3D                    jmp 00410413

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004103C9(C)
|
:004103D6 833D882F490000          cmp dword ptr [00492F88], 00000000
:004103DD 742A                    je 00410409
:004103DF 6A00                    push 00000000
:004103E1 6AFF                    push FFFFFFFF
:004103E3 6850400000              push 00004050
:004103E8 6A00                    push 00000000
:004103EA 6A00                    push 00000000
:004103EC A1882F4900              mov eax, dword ptr [00492F88]
:004103F1 50                      push eax
:004103F2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004103F5 51                      push ecx
:004103F6 FF1520614800            call dword ptr [00486120]
:004103FC 83C001                  add eax, 00000001
:004103FF 50                      push eax
:00410400 8B55F8                  mov edx, dword ptr [ebp-08]
:00410403 52                      push edx
:00410404 E845C30600              call 0047C74E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004103DD(C)
|
:00410409 8B45E0                  mov eax, dword ptr [ebp-20]
:0041040C C7403401000000          mov [eax+34], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004103CB(U), :004103D4(U)
|
:00410413 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00410416 894DF8                  mov dword ptr [ebp-08], ecx
:00410419 E917FFFFFF              jmp 00410335

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410339(C)
|
:0041041E 8B55F8                  mov edx, dword ptr [ebp-08]
:00410421 2B5508                  sub edx, dword ptr [ebp+08]
:00410424 8B45E0                  mov eax, dword ptr [ebp-20]
:00410427 895030                  mov dword ptr [eax+30], edx
:0041042A EB0A                    jmp 00410436

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041031F(C)
|
:0041042C 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0041042F C7413010000000          mov [ecx+30], 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041042A(U)
|
:00410436 8B55E0                  mov edx, dword ptr [ebp-20]
:00410439 8B4508                  mov eax, dword ptr [ebp+08]
:0041043C 894220                  mov dword ptr [edx+20], eax
:0041043F 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00410442 E809F7FFFF              call 0040FB50
:00410447 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0041044A 8B5120                  mov edx, dword ptr [ecx+20]
:0041044D 03D0                    add edx, eax
:0041044F 8B45E0                  mov eax, dword ptr [ebp-20]
:00410452 035008                  add edx, dword ptr [eax+08]
:00410455 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00410458 89510C                  mov dword ptr [ecx+0C], edx
:0041045B 8B55E0                  mov edx, dword ptr [ebp-20]
:0041045E C7422801000000          mov [edx+28], 00000001
:00410465 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004102C3(U), :004102D7(U), :004102F8(U)
|
:0041046A 8BE5                    mov esp, ebp
:0041046C 5D                      pop ebp
:0041046D C20800                  ret 0008



* Referenced by a CALL at Address:
|:00417E87   
|
:00410470 55                      push ebp
:00410471 8BEC                    mov ebp, esp
:00410473 83EC08                  sub esp, 00000008
:00410476 894DF8                  mov dword ptr [ebp-08], ecx
:00410479 837D0800                cmp dword ptr [ebp+08], 00000000
:0041047D 7507                    jne 00410486
:0041047F B800040000              mov eax, 00000400
:00410484 EB7A                    jmp 00410500

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041047D(C)
|
:00410486 8B4508                  mov eax, dword ptr [ebp+08]
:00410489 8945FC                  mov dword ptr [ebp-04], eax
:0041048C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041048F 8B55F8                  mov edx, dword ptr [ebp-08]
:00410492 668B4204                mov ax, word ptr [edx+04]
:00410496 668901                  mov word ptr [ecx], ax
:00410499 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041049C 83C102                  add ecx, 00000002
:0041049F 894D08                  mov dword ptr [ebp+08], ecx
:004104A2 8B5508                  mov edx, dword ptr [ebp+08]
:004104A5 8B45F8                  mov eax, dword ptr [ebp-08]
:004104A8 668B4808                mov cx, word ptr [eax+08]
:004104AC 66890A                  mov word ptr [edx], cx
:004104AF 8B5508                  mov edx, dword ptr [ebp+08]
:004104B2 83C202                  add edx, 00000002
:004104B5 895508                  mov dword ptr [ebp+08], edx
:004104B8 8B4508                  mov eax, dword ptr [ebp+08]
:004104BB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004104BE 668B5110                mov dx, word ptr [ecx+10]
:004104C2 668910                  mov word ptr [eax], dx
:004104C5 8B4508                  mov eax, dword ptr [ebp+08]
:004104C8 83C002                  add eax, 00000002
:004104CB 894508                  mov dword ptr [ebp+08], eax
:004104CE 8B4D08                  mov ecx, dword ptr [ebp+08]
:004104D1 8B55F8                  mov edx, dword ptr [ebp-08]
:004104D4 668B4214                mov ax, word ptr [edx+14]
:004104D8 668901                  mov word ptr [ecx], ax
:004104DB 8B4D08                  mov ecx, dword ptr [ebp+08]
:004104DE 83C102                  add ecx, 00000002
:004104E1 894D08                  mov dword ptr [ebp+08], ecx
:004104E4 8B5508                  mov edx, dword ptr [ebp+08]
:004104E7 8B45F8                  mov eax, dword ptr [ebp-08]
:004104EA 668B4824                mov cx, word ptr [eax+24]
:004104EE 66890A                  mov word ptr [edx], cx
:004104F1 8B5508                  mov edx, dword ptr [ebp+08]
:004104F4 83C202                  add edx, 00000002
:004104F7 895508                  mov dword ptr [ebp+08], edx
:004104FA 8B4508                  mov eax, dword ptr [ebp+08]
:004104FD 2B45FC                  sub eax, dword ptr [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410484(U)
|
:00410500 8BE5                    mov esp, ebp
:00410502 5D                      pop ebp
:00410503 C20400                  ret 0004



* Referenced by a CALL at Address:
|:00417C4C   
|
:00410506 55                      push ebp
:00410507 8BEC                    mov ebp, esp
:00410509 83EC08                  sub esp, 00000008
:0041050C 894DF8                  mov dword ptr [ebp-08], ecx
:0041050F 837D0800                cmp dword ptr [ebp+08], 00000000
:00410513 7507                    jne 0041051C
:00410515 B800040000              mov eax, 00000400
:0041051A EB76                    jmp 00410592

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410513(C)
|
:0041051C 8B4508                  mov eax, dword ptr [ebp+08]
:0041051F 8945FC                  mov dword ptr [ebp-04], eax
:00410522 8B4D08                  mov ecx, dword ptr [ebp+08]
:00410525 0FBF11                  movsx edx, word ptr [ecx]
:00410528 8B45F8                  mov eax, dword ptr [ebp-08]
:0041052B 895004                  mov dword ptr [eax+04], edx
:0041052E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00410531 83C102                  add ecx, 00000002
:00410534 894D08                  mov dword ptr [ebp+08], ecx
:00410537 8B5508                  mov edx, dword ptr [ebp+08]
:0041053A 0FBF02                  movsx eax, word ptr [edx]
:0041053D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00410540 894108                  mov dword ptr [ecx+08], eax
:00410543 8B5508                  mov edx, dword ptr [ebp+08]
:00410546 83C202                  add edx, 00000002
:00410549 895508                  mov dword ptr [ebp+08], edx
:0041054C 8B45F8                  mov eax, dword ptr [ebp-08]
:0041054F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00410552 668B11                  mov dx, word ptr [ecx]
:00410555 66895010                mov word ptr [eax+10], dx
:00410559 8B4508                  mov eax, dword ptr [ebp+08]
:0041055C 83C002                  add eax, 00000002
:0041055F 894508                  mov dword ptr [ebp+08], eax
:00410562 8B4D08                  mov ecx, dword ptr [ebp+08]
:00410565 0FBF11                  movsx edx, word ptr [ecx]
:00410568 8B45F8                  mov eax, dword ptr [ebp-08]
:0041056B 895014                  mov dword ptr [eax+14], edx
:0041056E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00410571 83C102                  add ecx, 00000002
:00410574 894D08                  mov dword ptr [ebp+08], ecx
:00410577 8B5508                  mov edx, dword ptr [ebp+08]
:0041057A 0FBF02                  movsx eax, word ptr [edx]
:0041057D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00410580 894124                  mov dword ptr [ecx+24], eax
:00410583 8B5508                  mov edx, dword ptr [ebp+08]
:00410586 83C202                  add edx, 00000002
:00410589 895508                  mov dword ptr [ebp+08], edx
:0041058C 8B4508                  mov eax, dword ptr [ebp+08]
:0041058F 2B45FC                  sub eax, dword ptr [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041051A(U)
|
:00410592 8BE5                    mov esp, ebp
:00410594 5D                      pop ebp
:00410595 C20400                  ret 0004


:00410598 55                      push ebp
:00410599 8BEC                    mov ebp, esp
:0041059B 51                      push ecx
:0041059C 894DFC                  mov dword ptr [ebp-04], ecx
:0041059F B805000000              mov eax, 00000005
:004105A4 8BE5                    mov esp, ebp
:004105A6 5D                      pop ebp
:004105A7 C3                      ret



* Referenced by a CALL at Address:
|:004108C2   
|
:004105A8 55                      push ebp
:004105A9 8BEC                    mov ebp, esp
:004105AB 83EC2C                  sub esp, 0000002C
:004105AE 894DE4                  mov dword ptr [ebp-1C], ecx
:004105B1 C745F801000000          mov [ebp-08], 00000001
:004105B8 C745EC00000000          mov [ebp-14], 00000000
:004105BF C745F400000000          mov [ebp-0C], 00000000
:004105C6 C745FC03000000          mov [ebp-04], 00000003
:004105CD 8B45E4                  mov eax, dword ptr [ebp-1C]
:004105D0 8B4814                  mov ecx, dword ptr [eax+14]
:004105D3 3B4D08                  cmp ecx, dword ptr [ebp+08]
:004105D6 7E0C                    jle 004105E4
:004105D8 C745FC01000000          mov [ebp-04], 00000001
:004105DF E91F020000              jmp 00410803

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004105D6(C)
|
:004105E4 8B55E4                  mov edx, dword ptr [ebp-1C]
:004105E7 C74214FFFFFFFF          mov [edx+14], FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410767(C)
|
:004105EE 8B45E4                  mov eax, dword ptr [ebp-1C]
:004105F1 83783400                cmp dword ptr [eax+34], 00000000
:004105F5 740C                    je 00410603
:004105F7 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004105FA E8E3F6FFFF              call 0040FCE2
:004105FF 668945E8                mov word ptr [ebp-18], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004105F5(C)
|
:00410603 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00410606 8B11                    mov edx, dword ptr [ecx]
:00410608 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0041060B FF5210                  call [edx+10]
:0041060E 668945F0                mov word ptr [ebp-10], ax
:00410612 8B45E4                  mov eax, dword ptr [ebp-1C]
:00410615 8B10                    mov edx, dword ptr [eax]
:00410617 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0041061A FF5208                  call [edx+08]
:0041061D 8945FC                  mov dword ptr [ebp-04], eax
:00410620 8B45FC                  mov eax, dword ptr [ebp-04]
:00410623 8945E0                  mov dword ptr [ebp-20], eax
:00410626 837DE009                cmp dword ptr [ebp-20], 00000009
:0041062A 0F8729010000            ja 00410759
:00410630 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00410633 FF248D0E084100          jmp dword ptr [4*ecx+0041080E]
:0041063A E924010000              jmp 00410763
:0041063F E91F010000              jmp 00410763
:00410644 8B55E4                  mov edx, dword ptr [ebp-1C]
:00410647 668B45F0                mov ax, word ptr [ebp-10]
:0041064B 66894210                mov word ptr [edx+10], ax
:0041064F 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00410652 8B5508                  mov edx, dword ptr [ebp+08]
:00410655 895114                  mov dword ptr [ecx+14], edx
:00410658 B802000000              mov eax, 00000002
:0041065D E9A6010000              jmp 00410808
:00410662 E9FC000000              jmp 00410763
:00410667 8B45E4                  mov eax, dword ptr [ebp-1C]
:0041066A 8B10                    mov edx, dword ptr [eax]
:0041066C 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0041066F FF5208                  call [edx+08]
:00410672 8945FC                  mov dword ptr [ebp-04], eax
:00410675 8B45FC                  mov eax, dword ptr [ebp-04]
:00410678 8945DC                  mov dword ptr [ebp-24], eax
:0041067B 837DDC00                cmp dword ptr [ebp-24], 00000000
:0041067F 740E                    je 0041068F
:00410681 837DDC01                cmp dword ptr [ebp-24], 00000001
:00410685 7411                    je 00410698
:00410687 837DDC05                cmp dword ptr [ebp-24], 00000005
:0041068B 7414                    je 004106A1
:0041068D EB1C                    jmp 004106AB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041067F(C)
|
:0041068F C745F800000000          mov [ebp-08], 00000000
:00410696 EB13                    jmp 004106AB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410685(C)
|
:00410698 C745F801000000          mov [ebp-08], 00000001
:0041069F EB0A                    jmp 004106AB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041068B(C)
|
:004106A1 B801000000              mov eax, 00000001
:004106A6 E95D010000              jmp 00410808

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041068D(U), :00410696(U), :0041069F(U), :00410803(U)
|
:004106AB 837DFC06                cmp dword ptr [ebp-04], 00000006
:004106AF 7506                    jne 004106B7
:004106B1 837DF800                cmp dword ptr [ebp-08], 00000000
:004106B5 740F                    je 004106C6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004106AF(C)
|
:004106B7 837DFC01                cmp dword ptr [ebp-04], 00000001
:004106BB 7409                    je 004106C6
:004106BD C745D800000000          mov [ebp-28], 00000000
:004106C4 EB07                    jmp 004106CD

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004106B5(C), :004106BB(C)
|
:004106C6 C745D801000000          mov [ebp-28], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004106C4(U)
|
:004106CD 8B4D08                  mov ecx, dword ptr [ebp+08]
:004106D0 83C101                  add ecx, 00000001
:004106D3 51                      push ecx
:004106D4 8B55D8                  mov edx, dword ptr [ebp-28]
:004106D7 52                      push edx
:004106D8 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004106DB E86E010000              call 0041084E
:004106E0 8945D4                  mov dword ptr [ebp-2C], eax
:004106E3 837DD405                cmp dword ptr [ebp-2C], 00000005
:004106E7 773E                    ja 00410727
:004106E9 8B45D4                  mov eax, dword ptr [ebp-2C]
:004106EC FF248536084100          jmp dword ptr [4*eax+00410836]
:004106F3 EB3C                    jmp 00410731
:004106F5 B801000000              mov eax, 00000001
:004106FA E909010000              jmp 00410808
:004106FF B802000000              mov eax, 00000002
:00410704 E9FF000000              jmp 00410808
:00410709 B803000000              mov eax, 00000003
:0041070E E9F5000000              jmp 00410808
:00410713 B804000000              mov eax, 00000004
:00410718 E9EB000000              jmp 00410808
:0041071D B805000000              mov eax, 00000005
:00410722 E9E1000000              jmp 00410808

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004106E7(C)
|
:00410727 B801000000              mov eax, 00000001
:0041072C E9D7000000              jmp 00410808

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004106F3(U)
|
:00410731 EB30                    jmp 00410763
:00410733 C745EC01000000          mov [ebp-14], 00000001
:0041073A EB27                    jmp 00410763
:0041073C B801000000              mov eax, 00000001
:00410741 E9C2000000              jmp 00410808
:00410746 B805000000              mov eax, 00000005
:0041074B E9B8000000              jmp 00410808
:00410750 C745F401000000          mov [ebp-0C], 00000001
:00410757 EB0A                    jmp 00410763

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041062A(C)
|
:00410759 B801000000              mov eax, 00000001
:0041075E E9A5000000              jmp 00410808

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041063A(U), :0041063F(U), :00410662(U), :00410731(U), :0041073A(U)
|:00410757(U)
|
:00410763 837DFC03                cmp dword ptr [ebp-04], 00000003
:00410767 0F8581FEFFFF            jne 004105EE
:0041076D 837DEC00                cmp dword ptr [ebp-14], 00000000
:00410771 7513                    jne 00410786
:00410773 837D0800                cmp dword ptr [ebp+08], 00000000
:00410777 754E                    jne 004107C7
:00410779 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0041077C E80F020000              call 00410990
:00410781 83F801                  cmp eax, 00000001
:00410784 7541                    jne 004107C7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410771(C)
|
:00410786 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00410789 8B5104                  mov edx, dword ptr [ecx+04]
:0041078C 83C201                  add edx, 00000001
:0041078F 8B45E4                  mov eax, dword ptr [ebp-1C]
:00410792 895004                  mov dword ptr [eax+04], edx
:00410795 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00410798 C7410800000000          mov [ecx+08], 00000000
:0041079F 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004107A2 E8E0F4FFFF              call 0040FC87
:004107A7 8B55E4                  mov edx, dword ptr [ebp-1C]
:004107AA 394204                  cmp dword ptr [edx+04], eax
:004107AD 7C11                    jl 004107C0
:004107AF 8B45E4                  mov eax, dword ptr [ebp-1C]
:004107B2 C7402800000000          mov [eax+28], 00000000
:004107B9 B804000000              mov eax, 00000004
:004107BE EB48                    jmp 00410808

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004107AD(C)
|
:004107C0 B803000000              mov eax, 00000003
:004107C5 EB41                    jmp 00410808

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00410777(C), :00410784(C)
|
:004107C7 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004107CA E8B8F4FFFF              call 0040FC87
:004107CF 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004107D2 394104                  cmp dword ptr [ecx+04], eax
:004107D5 7C11                    jl 004107E8
:004107D7 8B55E4                  mov edx, dword ptr [ebp-1C]
:004107DA C7422800000000          mov [edx+28], 00000000
:004107E1 B804000000              mov eax, 00000004
:004107E6 EB20                    jmp 00410808

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004107D5(C)
|
:004107E8 837DF400                cmp dword ptr [ebp-0C], 00000000
:004107EC 7411                    je 004107FF
:004107EE 8B45E4                  mov eax, dword ptr [ebp-1C]
:004107F1 C7402800000000          mov [eax+28], 00000000
:004107F8 B804000000              mov eax, 00000004
:004107FD EB09                    jmp 00410808

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004107EC(C)
|
:004107FF 33C0                    xor eax, eax
:00410801 EB05                    jmp 00410808

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004105DF(U)
|
:00410803 E9A3FEFFFF              jmp 004106AB

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041065D(U), :004106A6(U), :004106FA(U), :00410704(U), :0041070E(U)
|:00410718(U), :00410722(U), :0041072C(U), :00410741(U), :0041074B(U)
|:0041075E(U), :004107BE(U), :004107C5(U), :004107E6(U), :004107FD(U)
|:00410801(U)
|
:00410808 8BE5                    mov esp, ebp
:0041080A 5D                      pop ebp
:0041080B C20400                  ret 0004



:0041080E 3A064100                DWORD 0041063A
:00410812 3F064100                DWORD 0041063F
:00410816 44064100                DWORD 00410644
:0041081A 62064100                DWORD 00410662
:0041081E 67064100                DWORD 00410667
:00410822 3C074100                DWORD 0041073C
:00410826 59074100                DWORD 00410759
:0041082A 33074100                DWORD 00410733
:0041082E 46074100                DWORD 00410746
:00410832 50074100                DWORD 00410750
:00410836 F3064100                DWORD 004106F3
:0041083A F5064100                DWORD 004106F5
:0041083E FF064100                DWORD 004106FF
:00410842 09074100                DWORD 00410709
:00410846 13074100                DWORD 00410713
:0041084A 1D074100                DWORD 0041071D



* Referenced by a CALL at Addresses:
|:004106DB   , :004180E4   , :00418131   , :00418367   , :004183B4   
|
:0041084E 55                      push ebp
:0041084F 8BEC                    mov ebp, esp
:00410851 83EC0C                  sub esp, 0000000C
:00410854 894DF4                  mov dword ptr [ebp-0C], ecx
:00410857 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041085A E8F1000000              call 00410950
:0041085F 85C0                    test eax, eax
:00410861 7507                    jne 0041086A
:00410863 B804000000              mov eax, 00000004
:00410868 EB79                    jmp 004108E3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410861(C)
|
:0041086A 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041086D 83781400                cmp dword ptr [eax+14], 00000000
:00410871 7D48                    jge 004108BB
:00410873 837D0C00                cmp dword ptr [ebp+0C], 00000000
:00410877 750A                    jne 00410883
:00410879 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041087C C7412C01000000          mov [ecx+2C], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410877(C)
|
:00410883 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00410886 E857F4FFFF              call 0040FCE2
:0041088B 668945F8                mov word ptr [ebp-08], ax
:0041088F 837D0800                cmp dword ptr [ebp+08], 00000000
:00410893 7526                    jne 004108BB
:00410895 8B55F8                  mov edx, dword ptr [ebp-08]
:00410898 81E2FFFF0000            and edx, 0000FFFF
:0041089E 52                      push edx
:0041089F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004108A2 E894F3FFFF              call 0040FC3B
:004108A7 837D0C00                cmp dword ptr [ebp+0C], 00000000
:004108AB 750A                    jne 004108B7
:004108AD 8B45F4                  mov eax, dword ptr [ebp-0C]
:004108B0 C7402C00000000          mov [eax+2C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004108AB(C)
|
:004108B7 33C0                    xor eax, eax
:004108B9 EB28                    jmp 004108E3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00410871(C), :00410893(C)
|
:004108BB 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004108BE 51                      push ecx
:004108BF 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004108C2 E8E1FCFFFF              call 004105A8
:004108C7 8945FC                  mov dword ptr [ebp-04], eax
:004108CA 837DFC02                cmp dword ptr [ebp-04], 00000002
:004108CE 7410                    je 004108E0
:004108D0 837D0C00                cmp dword ptr [ebp+0C], 00000000
:004108D4 750A                    jne 004108E0
:004108D6 8B55F4                  mov edx, dword ptr [ebp-0C]
:004108D9 C7422C00000000          mov [edx+2C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004108CE(C), :004108D4(C)
|
:004108E0 8B45FC                  mov eax, dword ptr [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00410868(U), :004108B9(U)
|
:004108E3 8BE5                    mov esp, ebp
:004108E5 5D                      pop ebp
:004108E6 C20800                  ret 0008


:004108E9 55                      push ebp
:004108EA 8BEC                    mov ebp, esp
:004108EC 51                      push ecx
:004108ED 894DFC                  mov dword ptr [ebp-04], ecx
:004108F0 B801000000              mov eax, 00000001
:004108F5 8BE5                    mov esp, ebp
:004108F7 5D                      pop ebp
:004108F8 C20400                  ret 0004


:004108FB 55                      push ebp
:004108FC 8BEC                    mov ebp, esp
:004108FE 51                      push ecx
:004108FF 894DFC                  mov dword ptr [ebp-04], ecx
:00410902 B801000000              mov eax, 00000001
:00410907 8BE5                    mov esp, ebp
:00410909 5D                      pop ebp
:0041090A C3                      ret


:0041090B CC                      int 03
:0041090C CC                      int 03
:0041090D CC                      int 03
:0041090E CC                      int 03
:0041090F CC                      int 03

* Referenced by a CALL at Addresses:
|:0041013D   , :00418AED   
|
:00410910 55                      push ebp
:00410911 8BEC                    mov ebp, esp
:00410913 51                      push ecx
:00410914 894DFC                  mov dword ptr [ebp-04], ecx
:00410917 8B45FC                  mov eax, dword ptr [ebp-04]
:0041091A C700FFFFFFFF            mov dword ptr [eax], FFFFFFFF
:00410920 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00410923 C74104FFFFFFFF          mov [ecx+04], FFFFFFFF
:0041092A 8B55FC                  mov edx, dword ptr [ebp-04]
:0041092D C7420800000000          mov [edx+08], 00000000
:00410934 8B45FC                  mov eax, dword ptr [ebp-04]
:00410937 66C7400CFFFF            mov [eax+0C], FFFF
:0041093D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00410940 C74110FFFFFFFF          mov [ecx+10], FFFFFFFF
:00410947 8B45FC                  mov eax, dword ptr [ebp-04]
:0041094A 8BE5                    mov esp, ebp
:0041094C 5D                      pop ebp
:0041094D C3                      ret


:0041094E CC                      int 03
:0041094F CC                      int 03

* Referenced by a CALL at Addresses:
|:004100FC   , :0041085A   , :00418121   , :004183A4   
|
:00410950 55                      push ebp
:00410951 8BEC                    mov ebp, esp
:00410953 51                      push ecx
:00410954 894DFC                  mov dword ptr [ebp-04], ecx
:00410957 8B45FC                  mov eax, dword ptr [ebp-04]
:0041095A 8B4028                  mov eax, dword ptr [eax+28]
:0041095D 8BE5                    mov esp, ebp
:0041095F 5D                      pop ebp
:00410960 C3                      ret


:00410961 CC                      int 03
:00410962 CC                      int 03
:00410963 CC                      int 03
:00410964 CC                      int 03
:00410965 CC                      int 03
:00410966 CC                      int 03
:00410967 CC                      int 03
:00410968 CC                      int 03
:00410969 CC                      int 03
:0041096A CC                      int 03
:0041096B CC                      int 03
:0041096C CC                      int 03
:0041096D CC                      int 03
:0041096E CC                      int 03
:0041096F CC                      int 03

* Referenced by a CALL at Address:
|:0041010F   
|
:00410970 55                      push ebp
:00410971 8BEC                    mov ebp, esp
:00410973 51                      push ecx
:00410974 894DFC                  mov dword ptr [ebp-04], ecx
:00410977 8B45FC                  mov eax, dword ptr [ebp-04]
:0041097A 8B402C                  mov eax, dword ptr [eax+2C]
:0041097D 8BE5                    mov esp, ebp
:0041097F 5D                      pop ebp
:00410980 C3                      ret


:00410981 CC                      int 03
:00410982 CC                      int 03
:00410983 CC                      int 03
:00410984 CC                      int 03
:00410985 CC                      int 03
:00410986 CC                      int 03
:00410987 CC                      int 03
:00410988 CC                      int 03
:00410989 CC                      int 03
:0041098A CC                      int 03
:0041098B CC                      int 03
:0041098C CC                      int 03
:0041098D CC                      int 03
:0041098E CC                      int 03
:0041098F CC                      int 03

* Referenced by a CALL at Addresses:
|:0041077C   , :0044C60F   
|
:00410990 55                      push ebp
:00410991 8BEC                    mov ebp, esp
:00410993 51                      push ecx
:00410994 894DFC                  mov dword ptr [ebp-04], ecx
:00410997 8B45FC                  mov eax, dword ptr [ebp-04]
:0041099A 8B4024                  mov eax, dword ptr [eax+24]
:0041099D 8BE5                    mov esp, ebp
:0041099F 5D                      pop ebp
:004109A0 C3                      ret


:004109A1 CC                      int 03
:004109A2 CC                      int 03
:004109A3 CC                      int 03
:004109A4 CC                      int 03
:004109A5 CC                      int 03
:004109A6 CC                      int 03
:004109A7 CC                      int 03
:004109A8 CC                      int 03
:004109A9 CC                      int 03
:004109AA CC                      int 03
:004109AB CC                      int 03
:004109AC CC                      int 03
:004109AD CC                      int 03
:004109AE CC                      int 03
:004109AF CC                      int 03
:004109B0 55                      push ebp
:004109B1 8BEC                    mov ebp, esp
:004109B3 E807000000              call 004109BF
:004109B8 E811000000              call 004109CE
:004109BD 5D                      pop ebp
:004109BE C3                      ret



* Referenced by a CALL at Address:
|:004109B3   
|
:004109BF 55                      push ebp
:004109C0 8BEC                    mov ebp, esp
:004109C2 B9902F4900              mov ecx, 00492F90
:004109C7 E864800000              call 00418A30
:004109CC 5D                      pop ebp
:004109CD C3                      ret



* Referenced by a CALL at Address:
|:004109B8   
|
:004109CE 55                      push ebp
:004109CF 8BEC                    mov ebp, esp
:004109D1 68E0094100              push 004109E0
:004109D6 E825070700              call 00481100
:004109DB 83C404                  add esp, 00000004
:004109DE 5D                      pop ebp
:004109DF C3                      ret


:004109E0 55                      push ebp
:004109E1 8BEC                    mov ebp, esp
:004109E3 B9902F4900              mov ecx, 00492F90
:004109E8 E823800000              call 00418A10
:004109ED 5D                      pop ebp
:004109EE C3                      ret


:004109EF 55                      push ebp
:004109F0 8BEC                    mov ebp, esp
:004109F2 83EC0C                  sub esp, 0000000C
:004109F5 894DF8                  mov dword ptr [ebp-08], ecx
:004109F8 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004109FB E8E2F2FFFF              call 0040FCE2
:00410A00 668945FC                mov word ptr [ebp-04], ax
:00410A04 8B45FC                  mov eax, dword ptr [ebp-04]
:00410A07 25FFFF0000              and eax, 0000FFFF
:00410A0C 8945F4                  mov dword ptr [ebp-0C], eax
:00410A0F 837DF46B                cmp dword ptr [ebp-0C], 0000006B
:00410A13 0F870D070000            ja 00411126
:00410A19 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00410A1C FF248D2F114100          jmp dword ptr [4*ecx+0041112F]
:00410A23 B803000000              mov eax, 00000003
:00410A28 E9FE060000              jmp 0041112B
:00410A2D B804000000              mov eax, 00000004
:00410A32 E9F4060000              jmp 0041112B
:00410A37 8B55F8                  mov edx, dword ptr [ebp-08]
:00410A3A 52                      push edx
:00410A3B E89C150000              call 00411FDC
:00410A40 83C404                  add esp, 00000004
:00410A43 E9E3060000              jmp 0041112B
:00410A48 8B45F8                  mov eax, dword ptr [ebp-08]
:00410A4B 50                      push eax
:00410A4C E88E080000              call 004112DF
:00410A51 83C404                  add esp, 00000004
:00410A54 E9D2060000              jmp 0041112B
:00410A59 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00410A5C 51                      push ecx
:00410A5D E8E60C0000              call 00411748
:00410A62 83C404                  add esp, 00000004
:00410A65 E9C1060000              jmp 0041112B
:00410A6A 8B55F8                  mov edx, dword ptr [ebp-08]
:00410A6D 52                      push edx
:00410A6E E82E0D0000              call 004117A1
:00410A73 83C404                  add esp, 00000004
:00410A76 E9B0060000              jmp 0041112B
:00410A7B 8B45F8                  mov eax, dword ptr [ebp-08]
:00410A7E 50                      push eax
:00410A7F E8C1500000              call 00415B45
:00410A84 83C404                  add esp, 00000004
:00410A87 E99F060000              jmp 0041112B
:00410A8C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00410A8F 51                      push ecx
:00410A90 E8B1510000              call 00415C46
:00410A95 83C404                  add esp, 00000004
:00410A98 E98E060000              jmp 0041112B
:00410A9D 8B55F8                  mov edx, dword ptr [ebp-08]
:00410AA0 52                      push edx
:00410AA1 E878380000              call 0041431E
:00410AA6 83C404                  add esp, 00000004
:00410AA9 E97D060000              jmp 0041112B
:00410AAE 8B45F8                  mov eax, dword ptr [ebp-08]
:00410AB1 50                      push eax
:00410AB2 E858500000              call 00415B0F
:00410AB7 83C404                  add esp, 00000004
:00410ABA E96C060000              jmp 0041112B
:00410ABF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00410AC2 51                      push ecx
:00410AC3 E80F500000              call 00415AD7
:00410AC8 83C404                  add esp, 00000004
:00410ACB E95B060000              jmp 0041112B
:00410AD0 8B55F8                  mov edx, dword ptr [ebp-08]
:00410AD3 52                      push edx
:00410AD4 E8D9370000              call 004142B2
:00410AD9 83C404                  add esp, 00000004
:00410ADC E94A060000              jmp 0041112B
:00410AE1 8B45F8                  mov eax, dword ptr [ebp-08]
:00410AE4 50                      push eax
:00410AE5 E8BA380000              call 004143A4
:00410AEA 83C404                  add esp, 00000004
:00410AED E939060000              jmp 0041112B
:00410AF2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00410AF5 51                      push ecx
:00410AF6 E8B3380000              call 004143AE
:00410AFB 83C404                  add esp, 00000004
:00410AFE E928060000              jmp 0041112B
:00410B03 8B55F8                  mov edx, dword ptr [ebp-08]
:00410B06 52                      push edx
:00410B07 E8844D0000              call 00415890
:00410B0C 83C404                  add esp, 00000004
:00410B0F E917060000              jmp 0041112B
:00410B14 8B45F8                  mov eax, dword ptr [ebp-08]
:00410B17 50                      push eax
:00410B18 E8924D0000              call 004158AF
:00410B1D 83C404                  add esp, 00000004
:00410B20 E906060000              jmp 0041112B
:00410B25 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00410B28 51                      push ecx
:00410B29 E839510000              call 00415C67
:00410B2E 83C404                  add esp, 00000004
:00410B31 E9F5050000              jmp 0041112B
:00410B36 8B55F8                  mov edx, dword ptr [ebp-08]
:00410B39 52                      push edx
:00410B3A E87A120000              call 00411DB9
:00410B3F 83C404                  add esp, 00000004
:00410B42 E9E4050000              jmp 0041112B
:00410B47 8B45F8                  mov eax, dword ptr [ebp-08]
:00410B4A 50                      push eax
:00410B4B E855140000              call 00411FA5
:00410B50 83C404                  add esp, 00000004
:00410B53 E9D3050000              jmp 0041112B
:00410B58 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00410B5B 51                      push ecx
:00410B5C E8002B0000              call 00413661
:00410B61 83C404                  add esp, 00000004
:00410B64 E9C2050000              jmp 0041112B
:00410B69 8B55F8                  mov edx, dword ptr [ebp-08]
:00410B6C 52                      push edx
:00410B6D E89F2D0000              call 00413911
:00410B72 83C404                  add esp, 00000004
:00410B75 E9B1050000              jmp 0041112B
:00410B7A 8B45F8                  mov eax, dword ptr [ebp-08]
:00410B7D 50                      push eax
:00410B7E E8822E0000              call 00413A05
:00410B83 83C404                  add esp, 00000004
:00410B86 E9A0050000              jmp 0041112B
:00410B8B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00410B8E 51                      push ecx
:00410B8F E8C62E0000              call 00413A5A
:00410B94 83C404                  add esp, 00000004
:00410B97 E98F050000              jmp 0041112B
:00410B9C 8B55F8                  mov edx, dword ptr [ebp-08]
:00410B9F 52                      push edx
:00410BA0 E80F2F0000              call 00413AB4
:00410BA5 83C404                  add esp, 00000004
:00410BA8 E97E050000              jmp 0041112B
:00410BAD 8B45F8                  mov eax, dword ptr [ebp-08]
:00410BB0 50                      push eax
:00410BB1 E8512F0000              call 00413B07
:00410BB6 83C404                  add esp, 00000004
:00410BB9 E96D050000              jmp 0041112B
:00410BBE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00410BC1 51                      push ecx
:00410BC2 E8762F0000              call 00413B3D
:00410BC7 83C404                  add esp, 00000004
:00410BCA E95C050000              jmp 0041112B
:00410BCF 8B55F8                  mov edx, dword ptr [ebp-08]
:00410BD2 52                      push edx
:00410BD3 E8F92F0000              call 00413BD1
:00410BD8 83C404                  add esp, 00000004
:00410BDB E94B050000              jmp 0041112B
:00410BE0 8B45F8                  mov eax, dword ptr [ebp-08]
:00410BE3 50                      push eax
:00410BE4 E825300000              call 00413C0E
:00410BE9 83C404                  add esp, 00000004
:00410BEC E93A050000              jmp 0041112B
:00410BF1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00410BF4 51                      push ecx
:00410BF5 E85C300000              call 00413C56
:00410BFA 83C404                  add esp, 00000004
:00410BFD E929050000              jmp 0041112B
:00410C02 8B55F8                  mov edx, dword ptr [ebp-08]
:00410C05 52                      push edx
:00410C06 E8B2320000              call 00413EBD
:00410C0B 83C404                  add esp, 00000004
:00410C0E E918050000              jmp 0041112B
:00410C13 8B45F8                  mov eax, dword ptr [ebp-08]
:00410C16 50                      push eax
:00410C17 E8C6320000              call 00413EE2
:00410C1C 83C404                  add esp, 00000004
:00410C1F E907050000              jmp 0041112B
:00410C24 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00410C27 51                      push ecx
:00410C28 E8C4320000              call 00413EF1
:00410C2D 83C404                  add esp, 00000004
:00410C30 E9F6040000              jmp 0041112B
:00410C35 8B55F8                  mov edx, dword ptr [ebp-08]
:00410C38 52                      push edx
:00410C39 E819360000              call 00414257
:00410C3E 83C404                  add esp, 00000004
:00410C41 E9E5040000              jmp 0041112B
:00410C46 8B45F8                  mov eax, dword ptr [ebp-08]
:00410C49 50                      push eax
:00410C4A E889630000              call 00416FD8
:00410C4F 83C404                  add esp, 00000004
:00410C52 E9D4040000              jmp 0041112B
:00410C57 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00410C5A 51                      push ecx
:00410C5B E89B320000              call 00413EFB
:00410C60 83C404                  add esp, 00000004
:00410C63 E9C3040000              jmp 0041112B
:00410C68 8B55F8                  mov edx, dword ptr [ebp-08]
:00410C6B 52                      push edx
:00410C6C E8EA330000              call 0041405B
:00410C71 83C404                  add esp, 00000004
:00410C74 E9B2040000              jmp 0041112B
:00410C79 8B45F8                  mov eax, dword ptr [ebp-08]
:00410C7C 50                      push eax
:00410C7D E86B150000              call 004121ED
:00410C82 83C404                  add esp, 00000004
:00410C85 E9A1040000              jmp 0041112B
:00410C8A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00410C8D 51                      push ecx
:00410C8E E8214B0000              call 004157B4
:00410C93 83C404                  add esp, 00000004
:00410C96 E990040000              jmp 0041112B
:00410C9B 8B55F8                  mov edx, dword ptr [ebp-08]
:00410C9E 52                      push edx
:00410C9F E8784B0000              call 0041581C
:00410CA4 83C404                  add esp, 00000004
:00410CA7 E97F040000              jmp 0041112B
:00410CAC 8B45F8                  mov eax, dword ptr [ebp-08]
:00410CAF 50                      push eax
:00410CB0 E89B0E0000              call 00411B50
:00410CB5 83C404                  add esp, 00000004
:00410CB8 E96E040000              jmp 0041112B
:00410CBD 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00410CC0 51                      push ecx
:00410CC1 E8700F0000              call 00411C36
:00410CC6 83C404                  add esp, 00000004
:00410CC9 E95D040000              jmp 0041112B
:00410CCE 8B55F8                  mov edx, dword ptr [ebp-08]
:00410CD1 52                      push edx
:00410CD2 E83C300000              call 00413D13
:00410CD7 83C404                  add esp, 00000004
:00410CDA E94C040000              jmp 0041112B
:00410CDF 8B45F8                  mov eax, dword ptr [ebp-08]
:00410CE2 50                      push eax
:00410CE3 E879360000              call 00414361
:00410CE8 83C404                  add esp, 00000004
:00410CEB E93B040000              jmp 0041112B
:00410CF0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00410CF3 51                      push ecx
:00410CF4 E84A640000              call 00417143
:00410CF9 83C404                  add esp, 00000004
:00410CFC E92A040000              jmp 0041112B
:00410D01 8B55F8                  mov edx, dword ptr [ebp-08]
:00410D04 52                      push edx
:00410D05 E8F5640000              call 004171FF
:00410D0A 83C404                  add esp, 00000004
:00410D0D E919040000              jmp 0041112B
:00410D12 8B45F8                  mov eax, dword ptr [ebp-08]
:00410D15 50                      push eax
:00410D16 E8A0650000              call 004172BB
:00410D1B 83C404                  add esp, 00000004
:00410D1E E908040000              jmp 0041112B
:00410D23 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00410D26 51                      push ecx
:00410D27 E8E9650000              call 00417315
:00410D2C 83C404                  add esp, 00000004
:00410D2F E9F7030000              jmp 0041112B
:00410D34 8B55F8                  mov edx, dword ptr [ebp-08]
:00410D37 52                      push edx
:00410D38 E8AA0C0000              call 004119E7
:00410D3D 83C404                  add esp, 00000004
:00410D40 E9E6030000              jmp 0041112B
:00410D45 8B45F8                  mov eax, dword ptr [ebp-08]
:00410D48 50                      push eax
:00410D49 E8060D0000              call 00411A54
:00410D4E 83C404                  add esp, 00000004
:00410D51 E9D5030000              jmp 0041112B
:00410D56 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00410D59 51                      push ecx
:00410D5A E8F3280000              call 00413652
:00410D5F 83C404                  add esp, 00000004
:00410D62 E9C4030000              jmp 0041112B
:00410D67 8B55F8                  mov edx, dword ptr [ebp-08]
:00410D6A 52                      push edx
:00410D6B E8A0220000              call 00413010
:00410D70 83C404                  add esp, 00000004
:00410D73 E9B3030000              jmp 0041112B
:00410D78 8B45F8                  mov eax, dword ptr [ebp-08]
:00410D7B 50                      push eax
:00410D7C E89B230000              call 0041311C
:00410D81 83C404                  add esp, 00000004
:00410D84 E9A2030000              jmp 0041112B
:00410D89 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00410D8C 51                      push ecx
:00410D8D E842250000              call 004132D4
:00410D92 83C404                  add esp, 00000004
:00410D95 E991030000              jmp 0041112B
:00410D9A 8B55F8                  mov edx, dword ptr [ebp-08]
:00410D9D 52                      push edx
:00410D9E E826270000              call 004134C9
:00410DA3 83C404                  add esp, 00000004
:00410DA6 E980030000              jmp 0041112B
:00410DAB 8B45F8                  mov eax, dword ptr [ebp-08]
:00410DAE 50                      push eax
:00410DAF E8B3270000              call 00413567
:00410DB4 83C404                  add esp, 00000004
:00410DB7 E96F030000              jmp 0041112B
:00410DBC 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00410DBF 51                      push ecx
:00410DC0 E819280000              call 004135DE
:00410DC5 83C404                  add esp, 00000004
:00410DC8 E95E030000              jmp 0041112B
:00410DCD 8B55F8                  mov edx, dword ptr [ebp-08]
:00410DD0 52                      push edx
:00410DD1 E813050000              call 004112E9
:00410DD6 83C404                  add esp, 00000004
:00410DD9 E94D030000              jmp 0041112B
:00410DDE 8B45F8                  mov eax, dword ptr [ebp-08]
:00410DE1 50                      push eax
:00410DE2 E8ED0A0000              call 004118D4
:00410DE7 83C404                  add esp, 00000004
:00410DEA E93C030000              jmp 0041112B
:00410DEF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00410DF2 51                      push ecx
:00410DF3 E80E120000              call 00412006
:00410DF8 83C404                  add esp, 00000004
:00410DFB E92B030000              jmp 0041112B
:00410E00 8B55F8                  mov edx, dword ptr [ebp-08]
:00410E03 52                      push edx
:00410E04 E8593D0000              call 00414B62
:00410E09 83C404                  add esp, 00000004
:00410E0C E91A030000              jmp 0041112B
:00410E11 8B45F8                  mov eax, dword ptr [ebp-08]
:00410E14 50                      push eax
:00410E15 E8DD3B0000              call 004149F7
:00410E1A 83C404                  add esp, 00000004
:00410E1D E909030000              jmp 0041112B
:00410E22 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00410E25 51                      push ecx
:00410E26 E8D33A0000              call 004148FE
:00410E2B 83C404                  add esp, 00000004
:00410E2E E9F8020000              jmp 0041112B
:00410E33 8B55F8                  mov edx, dword ptr [ebp-08]
:00410E36 52                      push edx
:00410E37 E8834E0000              call 00415CBF
:00410E3C 83C404                  add esp, 00000004
:00410E3F E9E7020000              jmp 0041112B
:00410E44 8B45F8                  mov eax, dword ptr [ebp-08]
:00410E47 50                      push eax
:00410E48 E875350000              call 004143C2
:00410E4D 83C404                  add esp, 00000004
:00410E50 E9D6020000              jmp 0041112B
:00410E55 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00410E58 51                      push ecx
:00410E59 E8BB540000              call 00416319
:00410E5E 83C404                  add esp, 00000004
:00410E61 E9C5020000              jmp 0041112B
:00410E66 8B55F8                  mov edx, dword ptr [ebp-08]
:00410E69 52                      push edx
:00410E6A E8E3070000              call 00411652
:00410E6F 83C404                  add esp, 00000004
:00410E72 E9B4020000              jmp 0041112B
:00410E77 8B45F8                  mov eax, dword ptr [ebp-08]
:00410E7A 50                      push eax
:00410E7B E86E080000              call 004116EE
:00410E80 83C404                  add esp, 00000004
:00410E83 E9A3020000              jmp 0041112B
:00410E88 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00410E8B 51                      push ecx
:00410E8C E80C060000              call 0041149D
:00410E91 83C404                  add esp, 00000004
:00410E94 E992020000              jmp 0041112B
:00410E99 8B55F8                  mov edx, dword ptr [ebp-08]
:00410E9C 52                      push edx
:00410E9D E8C10E0000              call 00411D63
:00410EA2 83C404                  add esp, 00000004
:00410EA5 E981020000              jmp 0041112B
:00410EAA 8B45F8                  mov eax, dword ptr [ebp-08]
:00410EAD 50                      push eax
:00410EAE E8DB0E0000              call 00411D8E
:00410EB3 83C404                  add esp, 00000004
:00410EB6 E970020000              jmp 0041112B
:00410EBB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00410EBE 51                      push ecx
:00410EBF E86C130000              call 00412230
:00410EC4 83C404                  add esp, 00000004
:00410EC7 E95F020000              jmp 0041112B
:00410ECC 8B55F8                  mov edx, dword ptr [ebp-08]
:00410ECF 52                      push edx
:00410ED0 E81C140000              call 004122F1
:00410ED5 83C404                  add esp, 00000004
:00410ED8 E94E020000              jmp 0041112B
:00410EDD 8B45F8                  mov eax, dword ptr [ebp-08]
:00410EE0 50                      push eax
:00410EE1 E8DF160000              call 004125C5
:00410EE6 83C404                  add esp, 00000004
:00410EE9 E93D020000              jmp 0041112B
:00410EEE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00410EF1 51                      push ecx
:00410EF2 E8AD1A0000              call 004129A4
:00410EF7 83C404                  add esp, 00000004
:00410EFA E92C020000              jmp 0041112B
:00410EFF 8B55F8                  mov edx, dword ptr [ebp-08]
:00410F02 52                      push edx
:00410F03 E8CE1E0000              call 00412DD6
:00410F08 83C404                  add esp, 00000004
:00410F0B E91B020000              jmp 0041112B
:00410F10 8B45F8                  mov eax, dword ptr [ebp-08]
:00410F13 50                      push eax
:00410F14 E87C480000              call 00415795
:00410F19 83C404                  add esp, 00000004
:00410F1C E90A020000              jmp 0041112B
:00410F21 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00410F24 51                      push ecx
:00410F25 E8684E0000              call 00415D92
:00410F2A 83C404                  add esp, 00000004
:00410F2D E9F9010000              jmp 0041112B
:00410F32 8B55F8                  mov edx, dword ptr [ebp-08]
:00410F35 52                      push edx
:00410F36 E8F64E0000              call 00415E31
:00410F3B 83C404                  add esp, 00000004
:00410F3E E9E8010000              jmp 0041112B
:00410F43 8B45F8                  mov eax, dword ptr [ebp-08]
:00410F46 50                      push eax
:00410F47 E8F63F0000              call 00414F42
:00410F4C 83C404                  add esp, 00000004
:00410F4F E9D7010000              jmp 0041112B
:00410F54 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00410F57 51                      push ecx
:00410F58 E88A410000              call 004150E7
:00410F5D 83C404                  add esp, 00000004
:00410F60 E9C6010000              jmp 0041112B
:00410F65 8B55F8                  mov edx, dword ptr [ebp-08]
:00410F68 52                      push edx
:00410F69 E866370000              call 004146D4
:00410F6E 83C404                  add esp, 00000004
:00410F71 E9B5010000              jmp 0041112B
:00410F76 8B45F8                  mov eax, dword ptr [ebp-08]
:00410F79 50                      push eax
:00410F7A E8E64F0000              call 00415F65
:00410F7F 83C404                  add esp, 00000004
:00410F82 E9A4010000              jmp 0041112B
:00410F87 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00410F8A 51                      push ecx
:00410F8B E899510000              call 00416129
:00410F90 83C404                  add esp, 00000004
:00410F93 E993010000              jmp 0041112B
:00410F98 8B55F8                  mov edx, dword ptr [ebp-08]
:00410F9B 52                      push edx
:00410F9C E8C9520000              call 0041626A
:00410FA1 83C404                  add esp, 00000004
:00410FA4 E982010000              jmp 0041112B
:00410FA9 8B45F8                  mov eax, dword ptr [ebp-08]
:00410FAC 50                      push eax
:00410FAD E8633D0000              call 00414D15
:00410FB2 83C404                  add esp, 00000004
:00410FB5 E971010000              jmp 0041112B
:00410FBA 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00410FBD 51                      push ecx
:00410FBE E8B8450000              call 0041557B
:00410FC3 83C404                  add esp, 00000004
:00410FC6 E960010000              jmp 0041112B
:00410FCB 8B55F8                  mov edx, dword ptr [ebp-08]
:00410FCE 52                      push edx
:00410FCF E89D470000              call 00415771
:00410FD4 83C404                  add esp, 00000004
:00410FD7 E94F010000              jmp 0041112B
:00410FDC 8B45F8                  mov eax, dword ptr [ebp-08]
:00410FDF 50                      push eax
:00410FE0 E837490000              call 0041591C
:00410FE5 83C404                  add esp, 00000004
:00410FE8 E93E010000              jmp 0041112B
:00410FED 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00410FF0 51                      push ecx
:00410FF1 E80D3F0000              call 00414F03
:00410FF6 83C404                  add esp, 00000004
:00410FF9 E92D010000              jmp 0041112B
:00410FFE 8B55F8                  mov edx, dword ptr [ebp-08]
:00411001 52                      push edx
:00411002 E8BD3E0000              call 00414EC4
:00411007 83C404                  add esp, 00000004
:0041100A E91C010000              jmp 0041112B
:0041100F 8B45F8                  mov eax, dword ptr [ebp-08]
:00411012 50                      push eax
:00411013 E8D3560000              call 004166EB
:00411018 83C404                  add esp, 00000004
:0041101B E90B010000              jmp 0041112B
:00411020 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00411023 51                      push ecx
:00411024 E862580000              call 0041688B
:00411029 83C404                  add esp, 00000004
:0041102C E9FA000000              jmp 0041112B
:00411031 8B55F8                  mov edx, dword ptr [ebp-08]
:00411034 52                      push edx
:00411035 E85D5C0000              call 00416C97
:0041103A 83C404                  add esp, 00000004
:0041103D E9E9000000              jmp 0041112B
:00411042 8B45F8                  mov eax, dword ptr [ebp-08]
:00411045 50                      push eax
:00411046 E8705C0000              call 00416CBB
:0041104B 83C404                  add esp, 00000004
:0041104E E9D8000000              jmp 0041112B
:00411053 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00411056 51                      push ecx
:00411057 E89E5D0000              call 00416DFA
:0041105C 83C404                  add esp, 00000004
:0041105F E9C7000000              jmp 0041112B
:00411064 8B55F8                  mov edx, dword ptr [ebp-08]
:00411067 52                      push edx
:00411068 E8AA5D0000              call 00416E17
:0041106D 83C404                  add esp, 00000004
:00411070 E9B6000000              jmp 0041112B
:00411075 8B45F8                  mov eax, dword ptr [ebp-08]
:00411078 50                      push eax
:00411079 E8EA5F0000              call 00417068
:0041107E 83C404                  add esp, 00000004
:00411081 E9A5000000              jmp 0041112B
:00411086 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00411089 51                      push ecx
:0041108A E87E480000              call 0041590D
:0041108F 83C404                  add esp, 00000004
:00411092 E994000000              jmp 0041112B
:00411097 8B55F8                  mov edx, dword ptr [ebp-08]
:0041109A 52                      push edx
:0041109B E802640000              call 004174A2
:004110A0 83C404                  add esp, 00000004
:004110A3 E983000000              jmp 0041112B
:004110A8 8B45F8                  mov eax, dword ptr [ebp-08]
:004110AB 50                      push eax
:004110AC E884640000              call 00417535
:004110B1 83C404                  add esp, 00000004
:004110B4 EB75                    jmp 0041112B
:004110B6 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004110B9 51                      push ecx
:004110BA E829650000              call 004175E8
:004110BF 83C404                  add esp, 00000004
:004110C2 EB67                    jmp 0041112B
:004110C4 8B55F8                  mov edx, dword ptr [ebp-08]
:004110C7 52                      push edx
:004110C8 E82F650000              call 004175FC
:004110CD 83C404                  add esp, 00000004
:004110D0 EB59                    jmp 0041112B
:004110D2 8B45F8                  mov eax, dword ptr [ebp-08]
:004110D5 50                      push eax
:004110D6 E8CD650000              call 004176A8
:004110DB 83C404                  add esp, 00000004
:004110DE EB4B                    jmp 0041112B
:004110E0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004110E3 51                      push ecx
:004110E4 E8D3650000              call 004176BC
:004110E9 83C404                  add esp, 00000004
:004110EC EB3D                    jmp 0041112B
:004110EE 8B55F8                  mov edx, dword ptr [ebp-08]
:004110F1 52                      push edx
:004110F2 E80A660000              call 00417701
:004110F7 83C404                  add esp, 00000004
:004110FA EB2F                    jmp 0041112B
:004110FC 8B45F8                  mov eax, dword ptr [ebp-08]
:004110FF 50                      push eax
:00411100 E8B1660000              call 004177B6
:00411105 83C404                  add esp, 00000004
:00411108 EB21                    jmp 0041112B
:0041110A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041110D 51                      push ecx
:0041110E E813670000              call 00417826
:00411113 83C404                  add esp, 00000004
:00411116 EB13                    jmp 0041112B
:00411118 8B55F8                  mov edx, dword ptr [ebp-08]
:0041111B 52                      push edx
:0041111C E8A5670000              call 004178C6
:00411121 83C404                  add esp, 00000004
:00411124 EB05                    jmp 0041112B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00410A13(C)
|
:00411126 B805000000              mov eax, 00000005

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00410A28(U), :00410A32(U), :00410A43(U), :00410A54(U), :00410A65(U)
|:00410A76(U), :00410A87(U), :00410A98(U), :00410AA9(U), :00410ABA(U)
|:00410ACB(U), :00410ADC(U), :00410AED(U), :00410AFE(U), :00410B0F(U)
|:00410B20(U), :00410B31(U), :00410B42(U), :00410B53(U), :00410B64(U)
|:00410B75(U), :00410B86(U), :00410B97(U), :00410BA8(U), :00410BB9(U)
|:00410BCA(U), :00410BDB(U), :00410BEC(U), :00410BFD(U), :00410C0E(U)
|:00410C1F(U), :00410C30(U), :00410C41(U), :00410C52(U), :00410C63(U)
|:00410C74(U), :00410C85(U), :00410C96(U), :00410CA7(U), :00410CB8(U)
|:00410CC9(U), :00410CDA(U), :00410CEB(U), :00410CFC(U), :00410D0D(U)
|:00410D1E(U), :00410D2F(U), :00410D40(U), :00410D51(U), :00410D62(U)
|:00410D73(U), :00410D84(U), :00410D95(U), :00410DA6(U), :00410DB7(U)
|:00410DC8(U), :00410DD9(U), :00410DEA(U), :00410DFB(U), :00410E0C(U)
|:00410E1D(U), :00410E2E(U), :00410E3F(U), :00410E50(U), :00410E61(U)
|:00410E72(U), :00410E83(U), :00410E94(U), :00410EA5(U), :00410EB6(U)
|:00410EC7(U), :00410ED8(U), :00410EE9(U), :00410EFA(U), :00410F0B(U)
|:00410F1C(U), :00410F2D(U), :00410F3E(U), :00410F4F(U), :00410F60(U)
|:00410F71(U), :00410F82(U), :00410F93(U), :00410FA4(U), :00410FB5(U)
|:00410FC6(U), :00410FD7(U), :00410FE8(U), :00410FF9(U), :0041100A(U)
|:0041101B(U), :0041102C(U), :0041103D(U), :0041104E(U), :0041105F(U)
|:00411070(U), :00411081(U), :00411092(U), :004110A3(U), :004110B4(U)
|:004110C2(U), :004110D0(U), :004110DE(U), :004110EC(U), :004110FA(U)
|:00411108(U), :00411116(U), :00411124(U)
|
:0041112B 8BE5                    mov esp, ebp
:0041112D 5D                      pop ebp
:0041112E C3                      ret



:0041112F 230A4100                DWORD 00410A23
:00411133 2D0A4100                DWORD 00410A2D
:00411137 370A4100                DWORD 00410A37
:0041113B 480A4100                DWORD 00410A48
:0041113F 590A4100                DWORD 00410A59
:00411143 6A0A4100                DWORD 00410A6A
:00411147 7B0A4100                DWORD 00410A7B
:0041114B 8C0A4100                DWORD 00410A8C
:0041114F 9D0A4100                DWORD 00410A9D
:00411153 AE0A4100                DWORD 00410AAE
:00411157 BF0A4100                DWORD 00410ABF
:0041115B D00A4100                DWORD 00410AD0
:0041115F E10A4100                DWORD 00410AE1
:00411163 F20A4100                DWORD 00410AF2
:00411167 030B4100                DWORD 00410B03
:0041116B 140B4100                DWORD 00410B14
:0041116F 86104100                DWORD 00411086
:00411173 250B4100                DWORD 00410B25
:00411177 360B4100                DWORD 00410B36
:0041117B 470B4100                DWORD 00410B47
:0041117F 580B4100                DWORD 00410B58
:00411183 690B4100                DWORD 00410B69
:00411187 8B0B4100                DWORD 00410B8B
:0041118B 9C0B4100                DWORD 00410B9C
:0041118F AD0B4100                DWORD 00410BAD
:00411193 CF0B4100                DWORD 00410BCF
:00411197 E00B4100                DWORD 00410BE0
:0041119B F10B4100                DWORD 00410BF1
:0041119F 020C4100                DWORD 00410C02
:004111A3 130C4100                DWORD 00410C13
:004111A7 240C4100                DWORD 00410C24
:004111AB 350C4100                DWORD 00410C35
:004111AF 460C4100                DWORD 00410C46
:004111B3 570C4100                DWORD 00410C57
:004111B7 790C4100                DWORD 00410C79
:004111BB 8A0C4100                DWORD 00410C8A
:004111BF 9B0C4100                DWORD 00410C9B
:004111C3 AC0C4100                DWORD 00410CAC
:004111C7 BD0C4100                DWORD 00410CBD
:004111CB CE0C4100                DWORD 00410CCE
:004111CF DF0C4100                DWORD 00410CDF
:004111D3 F00C4100                DWORD 00410CF0
:004111D7 010D4100                DWORD 00410D01
:004111DB 120D4100                DWORD 00410D12
:004111DF 230D4100                DWORD 00410D23
:004111E3 340D4100                DWORD 00410D34
:004111E7 450D4100                DWORD 00410D45
:004111EB 560D4100                DWORD 00410D56
:004111EF 670D4100                DWORD 00410D67
:004111F3 780D4100                DWORD 00410D78
:004111F7 890D4100                DWORD 00410D89
:004111FB 9A0D4100                DWORD 00410D9A
:004111FF AB0D4100                DWORD 00410DAB
:00411203 BC0D4100                DWORD 00410DBC
:00411207 CD0D4100                DWORD 00410DCD
:0041120B DE0D4100                DWORD 00410DDE
:0041120F EF0D4100                DWORD 00410DEF
:00411213 000E4100                DWORD 00410E00
:00411217 110E4100                DWORD 00410E11
:0041121B 220E4100                DWORD 00410E22
:0041121F 330E4100                DWORD 00410E33
:00411223 440E4100                DWORD 00410E44
:00411227 550E4100                DWORD 00410E55
:0041122B 660E4100                DWORD 00410E66
:0041122F 770E4100                DWORD 00410E77
:00411233 880E4100                DWORD 00410E88
:00411237 990E4100                DWORD 00410E99
:0041123B AA0E4100                DWORD 00410EAA
:0041123F BB0E4100                DWORD 00410EBB
:00411243 CC0E4100                DWORD 00410ECC
:00411247 DD0E4100                DWORD 00410EDD
:0041124B EE0E4100                DWORD 00410EEE
:0041124F FF0E4100                DWORD 00410EFF
:00411253 100F4100                DWORD 00410F10
:00411257 210F4100                DWORD 00410F21
:0041125B 320F4100                DWORD 00410F32
:0041125F 430F4100                DWORD 00410F43
:00411263 540F4100                DWORD 00410F54
:00411267 650F4100                DWORD 00410F65
:0041126B 760F4100                DWORD 00410F76
:0041126F 870F4100                DWORD 00410F87
:00411273 980F4100                DWORD 00410F98
:00411277 A90F4100                DWORD 00410FA9
:0041127B BA0F4100                DWORD 00410FBA
:0041127F CB0F4100                DWORD 00410FCB
:00411283 DC0F4100                DWORD 00410FDC
:00411287 ED0F4100                DWORD 00410FED
:0041128B FE0F4100                DWORD 00410FFE
:0041128F 0F104100                DWORD 0041100F
:00411293 20104100                DWORD 00411020
:00411297 31104100                DWORD 00411031
:0041129B 42104100                DWORD 00411042
:0041129F 64104100                DWORD 00411064
:004112A3 75104100                DWORD 00411075
:004112A7 97104100                DWORD 00411097
:004112AB B6104100                DWORD 004110B6
:004112AF C4104100                DWORD 004110C4
:004112B3 D2104100                DWORD 004110D2
:004112B7 E0104100                DWORD 004110E0
:004112BB EE104100                DWORD 004110EE
:004112BF FC104100                DWORD 004110FC
:004112C3 0A114100                DWORD 0041110A
:004112C7 18114100                DWORD 00411118
:004112CB BE0B4100                DWORD 00410BBE
:004112CF A8104100                DWORD 004110A8
:004112D3 7A0B4100                DWORD 00410B7A
:004112D7 53104100                DWORD 00411053
:004112DB 680C4100                DWORD 00410C68



* Referenced by a CALL at Address:
|:00410A4C   
|
:004112DF 55                      push ebp

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004112D3(C)
|
:004112E0 8BEC                    mov ebp, esp

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:004112E2 B806000000              mov eax, 00000006
:004112E7 5D                      pop ebp
:004112E8 C3                      ret



* Referenced by a CALL at Address:
|:00410DD1   
|
:004112E9 55                      push ebp
:004112EA 8BEC                    mov ebp, esp
:004112EC 83EC1C                  sub esp, 0000001C
:004112EF 6A02                    push 00000002
:004112F1 8B4D08                  mov ecx, dword ptr [ebp+08]
:004112F4 E8FE700000              call 004183F7
:004112F9 668945FC                mov word ptr [ebp-04], ax
:004112FD 8B45FC                  mov eax, dword ptr [ebp-04]
:00411300 25FFFF0000              and eax, 0000FFFF
:00411305 3D00800000              cmp eax, 00008000
:0041130A 750A                    jne 00411316
:0041130C B805000000              mov eax, 00000005
:00411311 E983010000              jmp 00411499

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041130A(C)
|
:00411316 6A23                    push 00000023
:00411318 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041131B E8D7700000              call 004183F7
:00411320 668945F0                mov word ptr [ebp-10], ax
:00411324 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00411327 81E1FFFF0000            and ecx, 0000FFFF
:0041132D 81F900800000            cmp ecx, 00008000
:00411333 750A                    jne 0041133F
:00411335 B805000000              mov eax, 00000005
:0041133A E95A010000              jmp 00411499

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411333(C)
|
:0041133F 6A04                    push 00000004
:00411341 8B4D08                  mov ecx, dword ptr [ebp+08]
:00411344 E8AE700000              call 004183F7
:00411349 8945F8                  mov dword ptr [ebp-08], eax
:0041134C 817DF800000080          cmp dword ptr [ebp-08], 80000000
:00411353 750A                    jne 0041135F
:00411355 B805000000              mov eax, 00000005
:0041135A E93A010000              jmp 00411499

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411353(C)
|
:0041135F 6A24                    push 00000024
:00411361 8B4D08                  mov ecx, dword ptr [ebp+08]
:00411364 E88E700000              call 004183F7
:00411369 668945EC                mov word ptr [ebp-14], ax
:0041136D 8B55EC                  mov edx, dword ptr [ebp-14]
:00411370 81E2FFFF0000            and edx, 0000FFFF
:00411376 81FA00800000            cmp edx, 00008000
:0041137C 750A                    jne 00411388
:0041137E B805000000              mov eax, 00000005
:00411383 E911010000              jmp 00411499

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041137C(C)
|
:00411388 E895A5FFFF              call 0040B922
:0041138D 85C0                    test eax, eax
:0041138F 742E                    je 004113BF
:00411391 8B45FC                  mov eax, dword ptr [ebp-04]
:00411394 25FFFF0000              and eax, 0000FFFF
:00411399 3D00040000              cmp eax, 00000400
:0041139E 7C1F                    jl 004113BF
:004113A0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004113A3 81E1FFFF0000            and ecx, 0000FFFF
:004113A9 81F902040000            cmp ecx, 00000402
:004113AF 7F0E                    jg 004113BF
:004113B1 B9F05D4B00              mov ecx, 004B5DF0
:004113B6 E8704C0400              call 0045602B
:004113BB 668945FC                mov word ptr [ebp-04], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041138F(C), :0041139E(C), :004113AF(C)
|
:004113BF 8B55FC                  mov edx, dword ptr [ebp-04]
:004113C2 81E2FFFF0000            and edx, 0000FFFF
:004113C8 81FAFFFF0000            cmp edx, 0000FFFF
:004113CE 740F                    je 004113DF
:004113D0 8B45FC                  mov eax, dword ptr [ebp-04]
:004113D3 25FFFF0000              and eax, 0000FFFF
:004113D8 3D00020000              cmp eax, 00000200
:004113DD 7E07                    jle 004113E6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004113CE(C)
|
:004113DF 33C0                    xor eax, eax
:004113E1 E9B3000000              jmp 00411499

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004113DD(C)
|
:004113E6 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004113E9 81E1FFFF0000            and ecx, 0000FFFF
:004113EF 83F906                  cmp ecx, 00000006
:004113F2 7F20                    jg 00411414
:004113F4 8A55F0                  mov dl, byte ptr [ebp-10]
:004113F7 52                      push edx
:004113F8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004113FB 81E1FFFF0000            and ecx, 0000FFFF
:00411401 6BC948                  imul ecx, 00000048
:00411404 81C1681B4A00            add ecx, 004A1B68
:0041140A E87859FFFF              call 00406D87
:0041140F 8945F4                  mov dword ptr [ebp-0C], eax
:00411412 EB49                    jmp 0041145D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004113F2(C)
|
:00411414 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00411417 81E1FFFF0000            and ecx, 0000FFFF
:0041141D 6BC948                  imul ecx, 00000048
:00411420 81C1681B4A00            add ecx, 004A1B68
:00411426 E8B1660600              call 00477ADC
:0041142B 8845E8                  mov byte ptr [ebp-18], al
:0041142E 8B45E8                  mov eax, dword ptr [ebp-18]
:00411431 25FF000000              and eax, 000000FF
:00411436 3DFF000000              cmp eax, 000000FF
:0041143B 741C                    je 00411459
:0041143D 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00411440 81E1FF000000            and ecx, 000000FF
:00411446 6BC924                  imul ecx, 00000024
:00411449 81C1502C4B00            add ecx, 004B2C50
:0041144F E83C180600              call 00472C90
:00411454 8945F4                  mov dword ptr [ebp-0C], eax
:00411457 EB04                    jmp 0041145D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041143B(C)
|
:00411459 33C0                    xor eax, eax
:0041145B EB3C                    jmp 00411499

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00411412(U), :00411457(U)
|
:0041145D 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00411460 81E1FFFF0000            and ecx, 0000FFFF
:00411466 894DE4                  mov dword ptr [ebp-1C], ecx
:00411469 837DE400                cmp dword ptr [ebp-1C], 00000000
:0041146D 7408                    je 00411477
:0041146F 837DE401                cmp dword ptr [ebp-1C], 00000001
:00411473 740D                    je 00411482
:00411475 EB17                    jmp 0041148E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041146D(C)
|
:00411477 8B55F4                  mov edx, dword ptr [ebp-0C]
:0041147A 3B55F8                  cmp edx, dword ptr [ebp-08]
:0041147D 1BC0                    sbb eax, eax
:0041147F 40                      inc eax
:00411480 EB17                    jmp 00411499

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411473(C)
|
:00411482 8B45F4                  mov eax, dword ptr [ebp-0C]
:00411485 3B45F8                  cmp eax, dword ptr [ebp-08]
:00411488 1BC0                    sbb eax, eax
:0041148A F7D8                    neg eax
:0041148C EB0B                    jmp 00411499

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411475(U)
|
:0041148E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00411491 33C0                    xor eax, eax
:00411493 3B4DF8                  cmp ecx, dword ptr [ebp-08]
:00411496 0F94C0                  sete al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00411311(U), :0041133A(U), :0041135A(U), :00411383(U), :004113E1(U)
|:0041145B(U), :00411480(U), :0041148C(U)
|
:00411499 8BE5                    mov esp, ebp
:0041149B 5D                      pop ebp
:0041149C C3                      ret



* Referenced by a CALL at Address:
|:00410E8C   
|
:0041149D 55                      push ebp
:0041149E 8BEC                    mov ebp, esp
:004114A0 83EC28                  sub esp, 00000028
:004114A3 6A03                    push 00000003
:004114A5 8B4D08                  mov ecx, dword ptr [ebp+08]
:004114A8 E84A6F0000              call 004183F7
:004114AD 668945DC                mov word ptr [ebp-24], ax
:004114B1 8B45DC                  mov eax, dword ptr [ebp-24]
:004114B4 25FFFF0000              and eax, 0000FFFF
:004114B9 3D00800000              cmp eax, 00008000
:004114BE 750A                    jne 004114CA
:004114C0 B805000000              mov eax, 00000005
:004114C5 E984010000              jmp 0041164E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004114BE(C)
|
:004114CA 6A04                    push 00000004
:004114CC 8B4D08                  mov ecx, dword ptr [ebp+08]
:004114CF E8236F0000              call 004183F7
:004114D4 8945FC                  mov dword ptr [ebp-04], eax
:004114D7 817DFC00000080          cmp dword ptr [ebp-04], 80000000
:004114DE 750A                    jne 004114EA
:004114E0 B805000000              mov eax, 00000005
:004114E5 E964010000              jmp 0041164E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004114DE(C)
|
:004114EA 6A24                    push 00000024
:004114EC 8B4D08                  mov ecx, dword ptr [ebp+08]
:004114EF E8036F0000              call 004183F7
:004114F4 668945EC                mov word ptr [ebp-14], ax
:004114F8 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004114FB 81E1FFFF0000            and ecx, 0000FFFF
:00411501 81F900800000            cmp ecx, 00008000
:00411507 750A                    jne 00411513
:00411509 B805000000              mov eax, 00000005
:0041150E E93B010000              jmp 0041164E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411507(C)
|
:00411513 6A3F                    push 0000003F
:00411515 8B4D08                  mov ecx, dword ptr [ebp+08]
:00411518 E8DA6E0000              call 004183F7
:0041151D 668945E0                mov word ptr [ebp-20], ax
:00411521 8B55E0                  mov edx, dword ptr [ebp-20]
:00411524 81E2FFFF0000            and edx, 0000FFFF
:0041152A 81FA00800000            cmp edx, 00008000
:00411530 750A                    jne 0041153C
:00411532 B805000000              mov eax, 00000005
:00411537 E912010000              jmp 0041164E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411530(C)
|
:0041153C 6A04                    push 00000004
:0041153E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00411541 E8B16E0000              call 004183F7
:00411546 8945F0                  mov dword ptr [ebp-10], eax
:00411549 817DF000000080          cmp dword ptr [ebp-10], 80000000
:00411550 750A                    jne 0041155C
:00411552 B805000000              mov eax, 00000005
:00411557 E9F2000000              jmp 0041164E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411550(C)
|
:0041155C 6A04                    push 00000004
:0041155E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00411561 E8916E0000              call 004183F7
:00411566 8945F8                  mov dword ptr [ebp-08], eax
:00411569 817DF800000080          cmp dword ptr [ebp-08], 80000000
:00411570 750A                    jne 0041157C
:00411572 B805000000              mov eax, 00000005
:00411577 E9D2000000              jmp 0041164E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411570(C)
|
:0041157C 6A04                    push 00000004
:0041157E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00411581 E8716E0000              call 004183F7
:00411586 8945E8                  mov dword ptr [ebp-18], eax
:00411589 817DE800000080          cmp dword ptr [ebp-18], 80000000
:00411590 750A                    jne 0041159C
:00411592 B805000000              mov eax, 00000005
:00411597 E9B2000000              jmp 0041164E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411590(C)
|
:0041159C 6A04                    push 00000004
:0041159E 8B4D08                  mov ecx, dword ptr [ebp+08]
:004115A1 E8516E0000              call 004183F7
:004115A6 8945E4                  mov dword ptr [ebp-1C], eax
:004115A9 817DE400000080          cmp dword ptr [ebp-1C], 80000000
:004115B0 750A                    jne 004115BC
:004115B2 B805000000              mov eax, 00000005
:004115B7 E992000000              jmp 0041164E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004115B0(C)
|
:004115BC 8B45DC                  mov eax, dword ptr [ebp-24]
:004115BF 25FFFF0000              and eax, 0000FFFF
:004115C4 3DFFFF0000              cmp eax, 0000FFFF
:004115C9 7506                    jne 004115D1
:004115CB 66C745DC0600            mov [ebp-24], 0006

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004115C9(C)
|
:004115D1 8B4DE0                  mov ecx, dword ptr [ebp-20]
:004115D4 81E1FFFF0000            and ecx, 0000FFFF
:004115DA 81F9FFFF0000            cmp ecx, 0000FFFF
:004115E0 7506                    jne 004115E8
:004115E2 66C745E00000            mov [ebp-20], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004115E0(C)
|
:004115E8 8A55E4                  mov dl, byte ptr [ebp-1C]
:004115EB 52                      push edx
:004115EC 8A45E8                  mov al, byte ptr [ebp-18]
:004115EF 50                      push eax
:004115F0 8A4DF8                  mov cl, byte ptr [ebp-08]
:004115F3 51                      push ecx
:004115F4 8A55F0                  mov dl, byte ptr [ebp-10]
:004115F7 52                      push edx
:004115F8 8A45E0                  mov al, byte ptr [ebp-20]
:004115FB 50                      push eax
:004115FC 8A4DDC                  mov cl, byte ptr [ebp-24]
:004115FF 51                      push ecx
:00411600 B9083D4B00              mov ecx, 004B3D08
:00411605 E8DCB20300              call 0044C8E6
:0041160A 25FF000000              and eax, 000000FF
:0041160F 8945F4                  mov dword ptr [ebp-0C], eax
:00411612 8B55EC                  mov edx, dword ptr [ebp-14]
:00411615 81E2FFFF0000            and edx, 0000FFFF
:0041161B 8955D8                  mov dword ptr [ebp-28], edx
:0041161E 837DD800                cmp dword ptr [ebp-28], 00000000
:00411622 7408                    je 0041162C
:00411624 837DD801                cmp dword ptr [ebp-28], 00000001
:00411628 740D                    je 00411637
:0041162A EB17                    jmp 00411643

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411622(C)
|
:0041162C 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041162F 3B45FC                  cmp eax, dword ptr [ebp-04]
:00411632 1BC0                    sbb eax, eax
:00411634 40                      inc eax
:00411635 EB17                    jmp 0041164E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411628(C)
|
:00411637 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041163A 3B4DFC                  cmp ecx, dword ptr [ebp-04]
:0041163D 1BC0                    sbb eax, eax
:0041163F F7D8                    neg eax
:00411641 EB0B                    jmp 0041164E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041162A(U)
|
:00411643 8B55F4                  mov edx, dword ptr [ebp-0C]
:00411646 33C0                    xor eax, eax
:00411648 3B55FC                  cmp edx, dword ptr [ebp-04]
:0041164B 0F94C0                  sete al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004114C5(U), :004114E5(U), :0041150E(U), :00411537(U), :00411557(U)
|:00411577(U), :00411597(U), :004115B7(U), :00411635(U), :00411641(U)
|
:0041164E 8BE5                    mov esp, ebp
:00411650 5D                      pop ebp
:00411651 C3                      ret



* Referenced by a CALL at Address:
|:00410E6A   
|
:00411652 55                      push ebp
:00411653 8BEC                    mov ebp, esp
:00411655 83EC10                  sub esp, 00000010
:00411658 6A04                    push 00000004
:0041165A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041165D E8956D0000              call 004183F7
:00411662 8945F8                  mov dword ptr [ebp-08], eax
:00411665 817DF800000080          cmp dword ptr [ebp-08], 80000000
:0041166C 7507                    jne 00411675
:0041166E B805000000              mov eax, 00000005
:00411673 EB75                    jmp 004116EA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041166C(C)
|
:00411675 6A24                    push 00000024
:00411677 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041167A E8786D0000              call 004183F7
:0041167F 668945F4                mov word ptr [ebp-0C], ax
:00411683 8B45F4                  mov eax, dword ptr [ebp-0C]
:00411686 25FFFF0000              and eax, 0000FFFF
:0041168B 3D00800000              cmp eax, 00008000
:00411690 7507                    jne 00411699
:00411692 B805000000              mov eax, 00000005
:00411697 EB51                    jmp 004116EA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411690(C)
|
:00411699 33C9                    xor ecx, ecx
:0041169B 8A0D0A3D4B00            mov cl, byte ptr [004B3D0A]
:004116A1 83C101                  add ecx, 00000001
:004116A4 894DFC                  mov dword ptr [ebp-04], ecx
:004116A7 8B55F4                  mov edx, dword ptr [ebp-0C]
:004116AA 81E2FFFF0000            and edx, 0000FFFF
:004116B0 8955F0                  mov dword ptr [ebp-10], edx
:004116B3 837DF000                cmp dword ptr [ebp-10], 00000000
:004116B7 7408                    je 004116C1
:004116B9 837DF001                cmp dword ptr [ebp-10], 00000001
:004116BD 7411                    je 004116D0
:004116BF EB1C                    jmp 004116DD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004116B7(C)
|
:004116C1 8B45FC                  mov eax, dword ptr [ebp-04]
:004116C4 33C9                    xor ecx, ecx
:004116C6 3B45F8                  cmp eax, dword ptr [ebp-08]
:004116C9 0F9DC1                  setnl cl
:004116CC 8BC1                    mov eax, ecx
:004116CE EB1A                    jmp 004116EA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004116BD(C)
|
:004116D0 8B55FC                  mov edx, dword ptr [ebp-04]
:004116D3 33C0                    xor eax, eax
:004116D5 3B55F8                  cmp edx, dword ptr [ebp-08]
:004116D8 0F9CC0                  setl al
:004116DB EB0D                    jmp 004116EA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004116BF(U)
|
:004116DD 8B45FC                  mov eax, dword ptr [ebp-04]
:004116E0 33C9                    xor ecx, ecx
:004116E2 3B45F8                  cmp eax, dword ptr [ebp-08]
:004116E5 0F94C1                  sete cl
:004116E8 8BC1                    mov eax, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00411673(U), :00411697(U), :004116CE(U), :004116DB(U)
|
:004116EA 8BE5                    mov esp, ebp
:004116EC 5D                      pop ebp
:004116ED C3                      ret



* Referenced by a CALL at Address:
|:00410E7B   
|
:004116EE 55                      push ebp
:004116EF 8BEC                    mov ebp, esp
:004116F1 51                      push ecx
:004116F2 6A48                    push 00000048
:004116F4 8B4D08                  mov ecx, dword ptr [ebp+08]
:004116F7 E8FB6C0000              call 004183F7
:004116FC 668945FC                mov word ptr [ebp-04], ax
:00411700 8B45FC                  mov eax, dword ptr [ebp-04]
:00411703 25FFFF0000              and eax, 0000FFFF
:00411708 3D00800000              cmp eax, 00008000
:0041170D 7507                    jne 00411716
:0041170F B805000000              mov eax, 00000005
:00411714 EB2E                    jmp 00411744

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041170D(C)
|
:00411716 E807A2FFFF              call 0040B922
:0041171B 85C0                    test eax, eax
:0041171D 7423                    je 00411742
:0041171F B9083D4B00              mov ecx, 004B3D08
:00411724 E807AC0000              call 0041C330
:00411729 25FF000000              and eax, 000000FF
:0041172E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00411731 81E1FF000000            and ecx, 000000FF
:00411737 3BC1                    cmp eax, ecx
:00411739 7507                    jne 00411742
:0041173B B801000000              mov eax, 00000001
:00411740 EB02                    jmp 00411744

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041171D(C), :00411739(C)
|
:00411742 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00411714(U), :00411740(U)
|
:00411744 8BE5                    mov esp, ebp
:00411746 5D                      pop ebp
:00411747 C3                      ret



* Referenced by a CALL at Address:
|:00410A5D   
|
:00411748 55                      push ebp
:00411749 8BEC                    mov ebp, esp
:0041174B 83EC08                  sub esp, 00000008
:0041174E 6A26                    push 00000026
:00411750 8B4D08                  mov ecx, dword ptr [ebp+08]
:00411753 E89F6C0000              call 004183F7
:00411758 668945F8                mov word ptr [ebp-08], ax
:0041175C 8B45F8                  mov eax, dword ptr [ebp-08]
:0041175F 25FFFF0000              and eax, 0000FFFF
:00411764 3D00800000              cmp eax, 00008000
:00411769 7507                    jne 00411772
:0041176B B805000000              mov eax, 00000005
:00411770 EB2B                    jmp 0041179D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411769(C)
|

* Possible StringData Ref from Data Obj ->""
                                  |
:00411772 68ACB34800              push 0048B3AC
:00411777 6A01                    push 00000001
:00411779 E81BDF0100              call 0042F699
:0041177E 83C408                  add esp, 00000008
:00411781 8945FC                  mov dword ptr [ebp-04], eax
:00411784 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00411787 81E1FFFF0000            and ecx, 0000FFFF
:0041178D 8B55F8                  mov edx, dword ptr [ebp-08]
:00411790 81E2FFFF0000            and edx, 0000FFFF
:00411796 33C0                    xor eax, eax
:00411798 3BCA                    cmp ecx, edx
:0041179A 0F94C0                  sete al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411770(U)
|
:0041179D 8BE5                    mov esp, ebp
:0041179F 5D                      pop ebp
:004117A0 C3                      ret



* Referenced by a CALL at Address:
|:00410A6E   
|
:004117A1 55                      push ebp
:004117A2 8BEC                    mov ebp, esp
:004117A4 83EC1C                  sub esp, 0000001C
:004117A7 C745F001000000          mov [ebp-10], 00000001
:004117AE 6A35                    push 00000035
:004117B0 8B4D08                  mov ecx, dword ptr [ebp+08]
:004117B3 E83F6C0000              call 004183F7
:004117B8 668945FC                mov word ptr [ebp-04], ax
:004117BC 8B45FC                  mov eax, dword ptr [ebp-04]
:004117BF 25FFFF0000              and eax, 0000FFFF
:004117C4 3D00800000              cmp eax, 00008000
:004117C9 750A                    jne 004117D5
:004117CB B805000000              mov eax, 00000005
:004117D0 E9FB000000              jmp 004118D0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004117C9(C)
|
:004117D5 C745F800000000          mov [ebp-08], 00000000
:004117DC EB09                    jmp 004117E7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041183C(U)
|
:004117DE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004117E1 83C101                  add ecx, 00000001
:004117E4 894DF8                  mov dword ptr [ebp-08], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004117DC(U)
|
:004117E7 8B55FC                  mov edx, dword ptr [ebp-04]
:004117EA 81E2FFFF0000            and edx, 0000FFFF
:004117F0 3955F8                  cmp dword ptr [ebp-08], edx
:004117F3 7D49                    jge 0041183E
:004117F5 6A01                    push 00000001
:004117F7 8B4D08                  mov ecx, dword ptr [ebp+08]
:004117FA E8F86B0000              call 004183F7
:004117FF 668945E8                mov word ptr [ebp-18], ax
:00411803 8B45E8                  mov eax, dword ptr [ebp-18]
:00411806 25FFFF0000              and eax, 0000FFFF
:0041180B 3D00800000              cmp eax, 00008000
:00411810 750A                    jne 0041181C
:00411812 B805000000              mov eax, 00000005
:00411817 E9B4000000              jmp 004118D0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411810(C)
|
:0041181C 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041181F 81E1FFFF0000            and ecx, 0000FFFF
:00411825 51                      push ecx
:00411826 8B4D08                  mov ecx, dword ptr [ebp+08]
:00411829 E8846C0000              call 004184B2
:0041182E F7D8                    neg eax
:00411830 1BC0                    sbb eax, eax
:00411832 F7D8                    neg eax
:00411834 8B55F0                  mov edx, dword ptr [ebp-10]
:00411837 23D0                    and edx, eax
:00411839 8955F0                  mov dword ptr [ebp-10], edx
:0041183C EBA0                    jmp 004117DE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004117F3(C)
|
:0041183E 6A35                    push 00000035
:00411840 8B4D08                  mov ecx, dword ptr [ebp+08]
:00411843 E8AF6B0000              call 004183F7
:00411848 668945EC                mov word ptr [ebp-14], ax
:0041184C 8B45EC                  mov eax, dword ptr [ebp-14]
:0041184F 25FFFF0000              and eax, 0000FFFF
:00411854 3D00800000              cmp eax, 00008000
:00411859 7507                    jne 00411862
:0041185B B805000000              mov eax, 00000005
:00411860 EB6E                    jmp 004118D0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411859(C)
|
:00411862 C745F400000000          mov [ebp-0C], 00000000
:00411869 EB09                    jmp 00411874

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004118C5(U)
|
:0041186B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041186E 83C101                  add ecx, 00000001
:00411871 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411869(U)
|
:00411874 8B55EC                  mov edx, dword ptr [ebp-14]
:00411877 81E2FFFF0000            and edx, 0000FFFF
:0041187D 3955F4                  cmp dword ptr [ebp-0C], edx
:00411880 7D45                    jge 004118C7
:00411882 6A01                    push 00000001
:00411884 8B4D08                  mov ecx, dword ptr [ebp+08]
:00411887 E86B6B0000              call 004183F7
:0041188C 668945E4                mov word ptr [ebp-1C], ax
:00411890 8B45E4                  mov eax, dword ptr [ebp-1C]
:00411893 25FFFF0000              and eax, 0000FFFF
:00411898 3D00800000              cmp eax, 00008000
:0041189D 7507                    jne 004118A6
:0041189F B805000000              mov eax, 00000005
:004118A4 EB2A                    jmp 004118D0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041189D(C)
|
:004118A6 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004118A9 81E1FFFF0000            and ecx, 0000FFFF
:004118AF 51                      push ecx
:004118B0 8B4D08                  mov ecx, dword ptr [ebp+08]
:004118B3 E8FA6B0000              call 004184B2
:004118B8 F7D8                    neg eax
:004118BA 1BC0                    sbb eax, eax
:004118BC 40                      inc eax
:004118BD 8B55F0                  mov edx, dword ptr [ebp-10]
:004118C0 23D0                    and edx, eax
:004118C2 8955F0                  mov dword ptr [ebp-10], edx
:004118C5 EBA4                    jmp 0041186B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411880(C)
|
:004118C7 33C0                    xor eax, eax
:004118C9 837DF000                cmp dword ptr [ebp-10], 00000000
:004118CD 0F95C0                  setne al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004117D0(U), :00411817(U), :00411860(U), :004118A4(U)
|
:004118D0 8BE5                    mov esp, ebp
:004118D2 5D                      pop ebp
:004118D3 C3                      ret



* Referenced by a CALL at Address:
|:00410DE2   
|
:004118D4 55                      push ebp
:004118D5 8BEC                    mov ebp, esp
:004118D7 83EC18                  sub esp, 00000018
:004118DA 6A28                    push 00000028
:004118DC 8B4D08                  mov ecx, dword ptr [ebp+08]
:004118DF E8136B0000              call 004183F7
:004118E4 668945F4                mov word ptr [ebp-0C], ax
:004118E8 8B45F4                  mov eax, dword ptr [ebp-0C]
:004118EB 25FFFF0000              and eax, 0000FFFF
:004118F0 3D00800000              cmp eax, 00008000
:004118F5 750A                    jne 00411901
:004118F7 B805000000              mov eax, 00000005
:004118FC E9E2000000              jmp 004119E3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004118F5(C)
|
:00411901 6A04                    push 00000004
:00411903 8B4D08                  mov ecx, dword ptr [ebp+08]
:00411906 E8EC6A0000              call 004183F7
:0041190B 8945FC                  mov dword ptr [ebp-04], eax
:0041190E 817DFC00000080          cmp dword ptr [ebp-04], 80000000
:00411915 750A                    jne 00411921
:00411917 B805000000              mov eax, 00000005
:0041191C E9C2000000              jmp 004119E3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411915(C)
|
:00411921 6A24                    push 00000024
:00411923 8B4D08                  mov ecx, dword ptr [ebp+08]
:00411926 E8CC6A0000              call 004183F7
:0041192B 668945F8                mov word ptr [ebp-08], ax
:0041192F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00411932 81E1FFFF0000            and ecx, 0000FFFF
:00411938 81F900800000            cmp ecx, 00008000
:0041193E 750A                    jne 0041194A
:00411940 B805000000              mov eax, 00000005
:00411945 E999000000              jmp 004119E3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041193E(C)
|
:0041194A C745F000000000          mov [ebp-10], 00000000
:00411951 8B55F4                  mov edx, dword ptr [ebp-0C]
:00411954 81E2FFFF0000            and edx, 0000FFFF
:0041195A 8955EC                  mov dword ptr [ebp-14], edx
:0041195D 837DEC00                cmp dword ptr [ebp-14], 00000000
:00411961 740E                    je 00411971
:00411963 837DEC01                cmp dword ptr [ebp-14], 00000001
:00411967 7417                    je 00411980
:00411969 837DEC02                cmp dword ptr [ebp-14], 00000002
:0041196D 7425                    je 00411994
:0041196F EB35                    jmp 004119A6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411961(C)
|
:00411971 B970074B00              mov ecx, 004B0770
:00411976 E855C8FFFF              call 0040E1D0
:0041197B 8945F0                  mov dword ptr [ebp-10], eax
:0041197E EB26                    jmp 004119A6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411967(C)
|
:00411980 B970074B00              mov ecx, 004B0770
:00411985 E805B9FFFF              call 0040D28F
:0041198A 25FF000000              and eax, 000000FF
:0041198F 8945F0                  mov dword ptr [ebp-10], eax
:00411992 EB12                    jmp 004119A6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041196D(C)
|
:00411994 B970074B00              mov ecx, 004B0770
:00411999 E892720000              call 00418C30
:0041199E 25FF000000              and eax, 000000FF
:004119A3 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041196F(U), :0041197E(U), :00411992(U)
|
:004119A6 8B45F8                  mov eax, dword ptr [ebp-08]
:004119A9 25FFFF0000              and eax, 0000FFFF
:004119AE 8945E8                  mov dword ptr [ebp-18], eax
:004119B1 837DE800                cmp dword ptr [ebp-18], 00000000
:004119B5 7408                    je 004119BF
:004119B7 837DE801                cmp dword ptr [ebp-18], 00000001
:004119BB 740D                    je 004119CA
:004119BD EB17                    jmp 004119D6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004119B5(C)
|
:004119BF 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004119C2 3B4DFC                  cmp ecx, dword ptr [ebp-04]
:004119C5 1BC0                    sbb eax, eax
:004119C7 40                      inc eax
:004119C8 EB19                    jmp 004119E3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004119BB(C)
|
:004119CA 8B55F0                  mov edx, dword ptr [ebp-10]
:004119CD 3B55FC                  cmp edx, dword ptr [ebp-04]
:004119D0 1BC0                    sbb eax, eax
:004119D2 F7D8                    neg eax
:004119D4 EB0D                    jmp 004119E3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004119BD(U)
|
:004119D6 8B45F0                  mov eax, dword ptr [ebp-10]
:004119D9 33C9                    xor ecx, ecx
:004119DB 3B45FC                  cmp eax, dword ptr [ebp-04]
:004119DE 0F94C1                  sete cl
:004119E1 8BC1                    mov eax, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004118FC(U), :0041191C(U), :00411945(U), :004119C8(U), :004119D4(U)
|
:004119E3 8BE5                    mov esp, ebp
:004119E5 5D                      pop ebp
:004119E6 C3                      ret



* Referenced by a CALL at Address:
|:00410D38   
|
:004119E7 55                      push ebp
:004119E8 8BEC                    mov ebp, esp
:004119EA 83EC08                  sub esp, 00000008
:004119ED 6A02                    push 00000002
:004119EF 8B4D08                  mov ecx, dword ptr [ebp+08]
:004119F2 E8006A0000              call 004183F7
:004119F7 668945F8                mov word ptr [ebp-08], ax
:004119FB 8B45F8                  mov eax, dword ptr [ebp-08]
:004119FE 25FFFF0000              and eax, 0000FFFF
:00411A03 3D00800000              cmp eax, 00008000
:00411A08 7507                    jne 00411A11
:00411A0A B805000000              mov eax, 00000005
:00411A0F EB3F                    jmp 00411A50

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411A08(C)
|
:00411A11 B970074B00              mov ecx, 004B0770
:00411A16 E8F58E0100              call 0042A910
:00411A1B 83E020                  and eax, 00000020
:00411A1E 85C0                    test eax, eax
:00411A20 742C                    je 00411A4E
:00411A22 6A04                    push 00000004
:00411A24 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00411A27 51                      push ecx
:00411A28 6A01                    push 00000001
:00411A2A 8B4D08                  mov ecx, dword ptr [ebp+08]
:00411A2D E81BE6FFFF              call 0041004D
:00411A32 8B55FC                  mov edx, dword ptr [ebp-04]
:00411A35 81E2FFFF0000            and edx, 0000FFFF
:00411A3B 8B45F8                  mov eax, dword ptr [ebp-08]
:00411A3E 25FFFF0000              and eax, 0000FFFF
:00411A43 33C9                    xor ecx, ecx
:00411A45 3BD0                    cmp edx, eax
:00411A47 0F94C1                  sete cl
:00411A4A 8BC1                    mov eax, ecx
:00411A4C EB02                    jmp 00411A50

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411A20(C)
|
:00411A4E 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00411A0F(U), :00411A4C(U)
|
:00411A50 8BE5                    mov esp, ebp
:00411A52 5D                      pop ebp
:00411A53 C3                      ret



* Referenced by a CALL at Address:
|:00410D49   
|
:00411A54 55                      push ebp
:00411A55 8BEC                    mov ebp, esp
:00411A57 83EC0C                  sub esp, 0000000C
:00411A5A 6A02                    push 00000002
:00411A5C 8B4D08                  mov ecx, dword ptr [ebp+08]
:00411A5F E893690000              call 004183F7
:00411A64 668945F8                mov word ptr [ebp-08], ax
:00411A68 8B45F8                  mov eax, dword ptr [ebp-08]
:00411A6B 25FFFF0000              and eax, 0000FFFF
:00411A70 3D00800000              cmp eax, 00008000
:00411A75 750A                    jne 00411A81
:00411A77 B805000000              mov eax, 00000005
:00411A7C E9CB000000              jmp 00411B4C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411A75(C)
|
:00411A81 6A02                    push 00000002
:00411A83 8B4D08                  mov ecx, dword ptr [ebp+08]
:00411A86 E86C690000              call 004183F7
:00411A8B 668945F4                mov word ptr [ebp-0C], ax
:00411A8F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00411A92 81E1FFFF0000            and ecx, 0000FFFF
:00411A98 81F900800000            cmp ecx, 00008000
:00411A9E 750A                    jne 00411AAA
:00411AA0 B805000000              mov eax, 00000005
:00411AA5 E9A2000000              jmp 00411B4C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411A9E(C)
|
:00411AAA 6A26                    push 00000026
:00411AAC 8B4D08                  mov ecx, dword ptr [ebp+08]
:00411AAF E843690000              call 004183F7
:00411AB4 668945FC                mov word ptr [ebp-04], ax
:00411AB8 8B55FC                  mov edx, dword ptr [ebp-04]
:00411ABB 81E2FFFF0000            and edx, 0000FFFF
:00411AC1 81FA00800000            cmp edx, 00008000
:00411AC7 7507                    jne 00411AD0
:00411AC9 B805000000              mov eax, 00000005
:00411ACE EB7C                    jmp 00411B4C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411AC7(C)
|
:00411AD0 8B45F8                  mov eax, dword ptr [ebp-08]
:00411AD3 25FFFF0000              and eax, 0000FFFF
:00411AD8 3DFFFF0000              cmp eax, 0000FFFF
:00411ADD 7411                    je 00411AF0
:00411ADF 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00411AE2 81E1FFFF0000            and ecx, 0000FFFF
:00411AE8 81F9FFFF0000            cmp ecx, 0000FFFF
:00411AEE 7504                    jne 00411AF4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411ADD(C)
|
:00411AF0 33C0                    xor eax, eax
:00411AF2 EB58                    jmp 00411B4C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411AEE(C)
|
:00411AF4 E8299EFFFF              call 0040B922
:00411AF9 85C0                    test eax, eax
:00411AFB 7504                    jne 00411B01
:00411AFD 33C0                    xor eax, eax
:00411AFF EB4B                    jmp 00411B4C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411AFB(C)
|
:00411B01 8B55FC                  mov edx, dword ptr [ebp-04]
:00411B04 81E2FFFF0000            and edx, 0000FFFF
:00411B0A 81FAFFFF0000            cmp edx, 0000FFFF
:00411B10 7506                    jne 00411B18
:00411B12 66C745FC0000            mov [ebp-04], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411B10(C)
|
:00411B18 8B45FC                  mov eax, dword ptr [ebp-04]
:00411B1B 25FFFF0000              and eax, 0000FFFF
:00411B20 50                      push eax
:00411B21 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00411B24 81E1FFFF0000            and ecx, 0000FFFF
:00411B2A 51                      push ecx
:00411B2B 8B55F8                  mov edx, dword ptr [ebp-08]
:00411B2E 81E2FFFF0000            and edx, 0000FFFF
:00411B34 52                      push edx
:00411B35 B9F05D4B00              mov ecx, 004B5DF0
:00411B3A E88B940400              call 0045AFCA
:00411B3F 85C0                    test eax, eax
:00411B41 7407                    je 00411B4A
:00411B43 B801000000              mov eax, 00000001
:00411B48 EB02                    jmp 00411B4C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411B41(C)
|
:00411B4A 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00411A7C(U), :00411AA5(U), :00411ACE(U), :00411AF2(U), :00411AFF(U)
|:00411B48(U)
|
:00411B4C 8BE5                    mov esp, ebp
:00411B4E 5D                      pop ebp
:00411B4F C3                      ret



* Referenced by a CALL at Address:
|:00410CB0   
|
:00411B50 55                      push ebp
:00411B51 8BEC                    mov ebp, esp
:00411B53 83EC0C                  sub esp, 0000000C
:00411B56 6A02                    push 00000002
:00411B58 8B4D08                  mov ecx, dword ptr [ebp+08]
:00411B5B E897680000              call 004183F7
:00411B60 668945FC                mov word ptr [ebp-04], ax
:00411B64 8B45FC                  mov eax, dword ptr [ebp-04]
:00411B67 25FFFF0000              and eax, 0000FFFF
:00411B6C 3D00800000              cmp eax, 00008000
:00411B71 750A                    jne 00411B7D
:00411B73 B805000000              mov eax, 00000005
:00411B78 E9B5000000              jmp 00411C32

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411B71(C)
|
:00411B7D 6A04                    push 00000004
:00411B7F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00411B82 E870680000              call 004183F7
:00411B87 8945F8                  mov dword ptr [ebp-08], eax
:00411B8A 817DF800000080          cmp dword ptr [ebp-08], 80000000
:00411B91 750A                    jne 00411B9D
:00411B93 B805000000              mov eax, 00000005
:00411B98 E995000000              jmp 00411C32

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411B91(C)
|
:00411B9D 6A04                    push 00000004
:00411B9F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00411BA2 E850680000              call 004183F7
:00411BA7 8945F4                  mov dword ptr [ebp-0C], eax
:00411BAA 817DF400000080          cmp dword ptr [ebp-0C], 80000000
:00411BB1 7507                    jne 00411BBA
:00411BB3 B805000000              mov eax, 00000005
:00411BB8 EB78                    jmp 00411C32

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411BB1(C)
|
:00411BBA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00411BBD 81E1FFFF0000            and ecx, 0000FFFF
:00411BC3 85C9                    test ecx, ecx
:00411BC5 7C09                    jl 00411BD0
:00411BC7 E8569DFFFF              call 0040B922
:00411BCC 85C0                    test eax, eax
:00411BCE 7504                    jne 00411BD4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411BC5(C)
|
:00411BD0 33C0                    xor eax, eax
:00411BD2 EB5E                    jmp 00411C32

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411BCE(C)
|
:00411BD4 8B55FC                  mov edx, dword ptr [ebp-04]
:00411BD7 81E2FFFF0000            and edx, 0000FFFF
:00411BDD 81FA00020000            cmp edx, 00000200
:00411BE3 7E24                    jle 00411C09
:00411BE5 8B45FC                  mov eax, dword ptr [ebp-04]
:00411BE8 25FFFF0000              and eax, 0000FFFF
:00411BED 3D00040000              cmp eax, 00000400
:00411BF2 7C11                    jl 00411C05
:00411BF4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00411BF7 81E1FFFF0000            and ecx, 0000FFFF
:00411BFD 81F902040000            cmp ecx, 00000402
:00411C03 7E04                    jle 00411C09

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411BF2(C)
|
:00411C05 33C0                    xor eax, eax
:00411C07 EB29                    jmp 00411C32

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00411BE3(C), :00411C03(C)
|
:00411C09 8A55F4                  mov dl, byte ptr [ebp-0C]
:00411C0C 52                      push edx
:00411C0D 8A45F8                  mov al, byte ptr [ebp-08]
:00411C10 50                      push eax
:00411C11 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00411C14 81E1FFFF0000            and ecx, 0000FFFF
:00411C1A 51                      push ecx
:00411C1B B9F05D4B00              mov ecx, 004B5DF0
:00411C20 E84C970400              call 0045B371
:00411C25 85C0                    test eax, eax
:00411C27 7407                    je 00411C30
:00411C29 B801000000              mov eax, 00000001
:00411C2E EB02                    jmp 00411C32

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411C27(C)
|
:00411C30 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00411B78(U), :00411B98(U), :00411BB8(U), :00411BD2(U), :00411C07(U)
|:00411C2E(U)
|
:00411C32 8BE5                    mov esp, ebp
:00411C34 5D                      pop ebp
:00411C35 C3                      ret



* Referenced by a CALL at Address:
|:00410CC1   
|
:00411C36 55                      push ebp
:00411C37 8BEC                    mov ebp, esp
:00411C39 83EC14                  sub esp, 00000014
:00411C3C 6A02                    push 00000002
:00411C3E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00411C41 E8B1670000              call 004183F7
:00411C46 668945FC                mov word ptr [ebp-04], ax
:00411C4A 8B45FC                  mov eax, dword ptr [ebp-04]
:00411C4D 25FFFF0000              and eax, 0000FFFF
:00411C52 3D00800000              cmp eax, 00008000
:00411C57 750A                    jne 00411C63
:00411C59 B805000000              mov eax, 00000005
:00411C5E E9FC000000              jmp 00411D5F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411C57(C)
|
:00411C63 6A04                    push 00000004
:00411C65 8B4D08                  mov ecx, dword ptr [ebp+08]
:00411C68 E88A670000              call 004183F7
:00411C6D 8945F0                  mov dword ptr [ebp-10], eax
:00411C70 817DF000000080          cmp dword ptr [ebp-10], 80000000
:00411C77 750A                    jne 00411C83
:00411C79 B805000000              mov eax, 00000005
:00411C7E E9DC000000              jmp 00411D5F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411C77(C)
|
:00411C83 6A04                    push 00000004
:00411C85 8B4D08                  mov ecx, dword ptr [ebp+08]
:00411C88 E86A670000              call 004183F7
:00411C8D 8945EC                  mov dword ptr [ebp-14], eax
:00411C90 817DEC00000080          cmp dword ptr [ebp-14], 80000000
:00411C97 750A                    jne 00411CA3
:00411C99 B805000000              mov eax, 00000005
:00411C9E E9BC000000              jmp 00411D5F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411C97(C)
|
:00411CA3 6A04                    push 00000004
:00411CA5 8B4D08                  mov ecx, dword ptr [ebp+08]
:00411CA8 E84A670000              call 004183F7
:00411CAD 8945F8                  mov dword ptr [ebp-08], eax
:00411CB0 817DF800000080          cmp dword ptr [ebp-08], 80000000
:00411CB7 750A                    jne 00411CC3
:00411CB9 B805000000              mov eax, 00000005
:00411CBE E99C000000              jmp 00411D5F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411CB7(C)
|
:00411CC3 6A04                    push 00000004
:00411CC5 8B4D08                  mov ecx, dword ptr [ebp+08]
:00411CC8 E82A670000              call 004183F7
:00411CCD 8945F4                  mov dword ptr [ebp-0C], eax
:00411CD0 817DF400000080          cmp dword ptr [ebp-0C], 80000000
:00411CD7 7507                    jne 00411CE0
:00411CD9 B805000000              mov eax, 00000005
:00411CDE EB7F                    jmp 00411D5F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411CD7(C)
|
:00411CE0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00411CE3 81E1FFFF0000            and ecx, 0000FFFF
:00411CE9 85C9                    test ecx, ecx
:00411CEB 7C09                    jl 00411CF6
:00411CED E8309CFFFF              call 0040B922
:00411CF2 85C0                    test eax, eax
:00411CF4 7504                    jne 00411CFA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411CEB(C)
|
:00411CF6 33C0                    xor eax, eax
:00411CF8 EB65                    jmp 00411D5F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411CF4(C)
|
:00411CFA 8B55FC                  mov edx, dword ptr [ebp-04]
:00411CFD 81E2FFFF0000            and edx, 0000FFFF
:00411D03 81FA00020000            cmp edx, 00000200
:00411D09 7E24                    jle 00411D2F
:00411D0B 8B45FC                  mov eax, dword ptr [ebp-04]
:00411D0E 25FFFF0000              and eax, 0000FFFF
:00411D13 3D00040000              cmp eax, 00000400
:00411D18 7C11                    jl 00411D2B
:00411D1A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00411D1D 81E1FFFF0000            and ecx, 0000FFFF
:00411D23 81F902040000            cmp ecx, 00000402
:00411D29 7E04                    jle 00411D2F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411D18(C)
|
:00411D2B 33C0                    xor eax, eax
:00411D2D EB30                    jmp 00411D5F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00411D09(C), :00411D29(C)
|
:00411D2F 8A55F4                  mov dl, byte ptr [ebp-0C]
:00411D32 52                      push edx
:00411D33 8A45F8                  mov al, byte ptr [ebp-08]
:00411D36 50                      push eax
:00411D37 8A4DEC                  mov cl, byte ptr [ebp-14]
:00411D3A 51                      push ecx
:00411D3B 8A55F0                  mov dl, byte ptr [ebp-10]
:00411D3E 52                      push edx
:00411D3F 8B45FC                  mov eax, dword ptr [ebp-04]
:00411D42 25FFFF0000              and eax, 0000FFFF
:00411D47 50                      push eax
:00411D48 B9F05D4B00              mov ecx, 004B5DF0
:00411D4D E853970400              call 0045B4A5
:00411D52 85C0                    test eax, eax
:00411D54 7407                    je 00411D5D
:00411D56 B801000000              mov eax, 00000001
:00411D5B EB02                    jmp 00411D5F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411D54(C)
|
:00411D5D 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00411C5E(U), :00411C7E(U), :00411C9E(U), :00411CBE(U), :00411CDE(U)
|:00411CF8(U), :00411D2D(U), :00411D5B(U)
|
:00411D5F 8BE5                    mov esp, ebp
:00411D61 5D                      pop ebp
:00411D62 C3                      ret



* Referenced by a CALL at Address:
|:00410E9D   
|
:00411D63 55                      push ebp
:00411D64 8BEC                    mov ebp, esp
:00411D66 51                      push ecx
:00411D67 B9083D4B00              mov ecx, 004B3D08
:00411D6C E8E7A80300              call 0044C658
:00411D71 6A04                    push 00000004
:00411D73 8D45FC                  lea eax, dword ptr [ebp-04]
:00411D76 50                      push eax
:00411D77 6A05                    push 00000005
:00411D79 8B4D08                  mov ecx, dword ptr [ebp+08]
:00411D7C E8CCE2FFFF              call 0041004D
:00411D81 33C0                    xor eax, eax
:00411D83 837DFC01                cmp dword ptr [ebp-04], 00000001
:00411D87 0F94C0                  sete al
:00411D8A 8BE5                    mov esp, ebp
:00411D8C 5D                      pop ebp
:00411D8D C3                      ret



* Referenced by a CALL at Address:
|:00410EAE   
|
:00411D8E 55                      push ebp
:00411D8F 8BEC                    mov ebp, esp
:00411D91 51                      push ecx
:00411D92 B9083D4B00              mov ecx, 004B3D08
:00411D97 E8B1A90300              call 0044C74D
:00411D9C 6A04                    push 00000004
:00411D9E 8D45FC                  lea eax, dword ptr [ebp-04]
:00411DA1 50                      push eax

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:00411DA2 6A06                    push 00000006
:00411DA4 8B4D08                  mov ecx, dword ptr [ebp+08]
:00411DA7 E8A1E2FFFF              call 0041004D
:00411DAC 33C0                    xor eax, eax
:00411DAE 837DFC01                cmp dword ptr [ebp-04], 00000001
:00411DB2 0F94C0                  sete al
:00411DB5 8BE5                    mov esp, ebp
:00411DB7 5D                      pop ebp
:00411DB8 C3                      ret



* Referenced by a CALL at Address:
|:00410B3A   
|
:00411DB9 55                      push ebp
:00411DBA 8BEC                    mov ebp, esp
:00411DBC 81EC20080000            sub esp, 00000820
:00411DC2 C685E0FBFFFF31          mov byte ptr [ebp+FFFFFBE0], 31
:00411DC9 C685E1FBFFFF32          mov byte ptr [ebp+FFFFFBE1], 32
:00411DD0 C685E2FBFFFF33          mov byte ptr [ebp+FFFFFBE2], 33
:00411DD7 C785E4FBFFFF00000000    mov dword ptr [ebp+FFFFFBE4], 00000000
:00411DE1 C645F400                mov [ebp-0C], 00
:00411DE5 6A05                    push 00000005
:00411DE7 8B4D08                  mov ecx, dword ptr [ebp+08]
:00411DEA E808660000              call 004183F7
:00411DEF 8945EC                  mov dword ptr [ebp-14], eax
:00411DF2 817DEC00000080          cmp dword ptr [ebp-14], 80000000
:00411DF9 750A                    jne 00411E05
:00411DFB B805000000              mov eax, 00000005
:00411E00 E99C010000              jmp 00411FA1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411DF9(C)
|
:00411E05 6A02                    push 00000002
:00411E07 8B4D08                  mov ecx, dword ptr [ebp+08]
:00411E0A E8E8650000              call 004183F7
:00411E0F 668945F8                mov word ptr [ebp-08], ax
:00411E13 8B45F8                  mov eax, dword ptr [ebp-08]
:00411E16 25FFFF0000              and eax, 0000FFFF
:00411E1B 3D00800000              cmp eax, 00008000
:00411E20 750A                    jne 00411E2C
:00411E22 B805000000              mov eax, 00000005
:00411E27 E975010000              jmp 00411FA1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411E20(C)
|
:00411E2C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00411E2F 81E1FFFF0000            and ecx, 0000FFFF
:00411E35 81F9FFFF0000            cmp ecx, 0000FFFF
:00411E3B 7506                    jne 00411E43
:00411E3D 66C745F80000            mov [ebp-08], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411E3B(C)
|
:00411E43 8B55EC                  mov edx, dword ptr [ebp-14]
:00411E46 52                      push edx
:00411E47 8D85E0F7FFFF            lea eax, dword ptr [ebp+FFFFF7E0]
:00411E4D 50                      push eax
:00411E4E B9902F4900              mov ecx, 00492F90
:00411E53 E84D5B0000              call 004179A5
:00411E58 8D8DE0F7FFFF            lea ecx, dword ptr [ebp+FFFFF7E0]
:00411E5E 894DE8                  mov dword ptr [ebp-18], ecx
:00411E61 8D95E8FBFFFF            lea edx, dword ptr [ebp+FFFFFBE8]
:00411E67 8955F0                  mov dword ptr [ebp-10], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411F0D(U)
|
:00411E6A 8B45F4                  mov eax, dword ptr [ebp-0C]
:00411E6D 25FF000000              and eax, 000000FF
:00411E72 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00411E75 8A9405E0FBFFFF          mov dl, byte ptr [ebp+eax-00000420]
:00411E7C 8811                    mov byte ptr [ecx], dl
:00411E7E 8B45F0                  mov eax, dword ptr [ebp-10]
:00411E81 83C001                  add eax, 00000001
:00411E84 8945F0                  mov dword ptr [ebp-10], eax
:00411E87 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00411E8A C6012E                  mov byte ptr [ecx], 2E
:00411E8D 8B55F0                  mov edx, dword ptr [ebp-10]
:00411E90 83C201                  add edx, 00000001
:00411E93 8955F0                  mov dword ptr [ebp-10], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411EDF(U)
|
:00411E96 8B45F0                  mov eax, dword ptr [ebp-10]
:00411E99 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00411E9C 8A11                    mov dl, byte ptr [ecx]
:00411E9E 8810                    mov byte ptr [eax], dl
:00411EA0 8B45F0                  mov eax, dword ptr [ebp-10]
:00411EA3 33C9                    xor ecx, ecx
:00411EA5 8A08                    mov cl, byte ptr [eax]
:00411EA7 85C9                    test ecx, ecx
:00411EA9 7502                    jne 00411EAD
:00411EAB EB34                    jmp 00411EE1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411EA9(C)
|
:00411EAD 8B55F0                  mov edx, dword ptr [ebp-10]
:00411EB0 33C0                    xor eax, eax
:00411EB2 8A02                    mov al, byte ptr [edx]
:00411EB4 83F80A                  cmp eax, 0000000A
:00411EB7 7514                    jne 00411ECD
:00411EB9 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00411EBC 83C101                  add ecx, 00000001
:00411EBF 894DF0                  mov dword ptr [ebp-10], ecx
:00411EC2 8B55E8                  mov edx, dword ptr [ebp-18]
:00411EC5 83C201                  add edx, 00000001
:00411EC8 8955E8                  mov dword ptr [ebp-18], edx
:00411ECB EB14                    jmp 00411EE1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411EB7(C)
|
:00411ECD 8B45F0                  mov eax, dword ptr [ebp-10]
:00411ED0 83C001                  add eax, 00000001
:00411ED3 8945F0                  mov dword ptr [ebp-10], eax
:00411ED6 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00411ED9 83C101                  add ecx, 00000001
:00411EDC 894DE8                  mov dword ptr [ebp-18], ecx
:00411EDF EBB5                    jmp 00411E96

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00411EAB(U), :00411ECB(U)
|
:00411EE1 8B55E8                  mov edx, dword ptr [ebp-18]
:00411EE4 33C0                    xor eax, eax
:00411EE6 8A02                    mov al, byte ptr [edx]
:00411EE8 85C0                    test eax, eax
:00411EEA 7502                    jne 00411EEE
:00411EEC EB24                    jmp 00411F12

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411EEA(C)
|
:00411EEE 8A4DF4                  mov cl, byte ptr [ebp-0C]
:00411EF1 80C101                  add cl, 01
:00411EF4 884DF4                  mov byte ptr [ebp-0C], cl
:00411EF7 8B55F4                  mov edx, dword ptr [ebp-0C]
:00411EFA 81E2FF000000            and edx, 000000FF
:00411F00 83FA03                  cmp edx, 00000003
:00411F03 7C08                    jl 00411F0D
:00411F05 8B45F0                  mov eax, dword ptr [ebp-10]
:00411F08 C60000                  mov byte ptr [eax], 00
:00411F0B EB05                    jmp 00411F12

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411F03(C)
|
:00411F0D E958FFFFFF              jmp 00411E6A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00411EEC(U), :00411F0B(U)
|
:00411F12 E80B9AFFFF              call 0040B922
:00411F17 85C0                    test eax, eax
:00411F19 7422                    je 00411F3D
:00411F1B 8B0DD85F4B00            mov ecx, dword ptr [004B5FD8]
:00411F21 51                      push ecx
:00411F22 FF15C8624800            call dword ptr [004862C8]
:00411F28 8945FC                  mov dword ptr [ebp-04], eax
:00411F2B E8667E0300              call 00449D96
:00411F30 8B15686A4B00            mov edx, dword ptr [004B6A68]
:00411F36 52                      push edx
:00411F37 FF15CC624800            call dword ptr [004862CC]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411F19(C)
|
:00411F3D 8B45F8                  mov eax, dword ptr [ebp-08]
:00411F40 25FFFF0000              and eax, 0000FFFF
:00411F45 50                      push eax
:00411F46 8D8DE8FBFFFF            lea ecx, dword ptr [ebp+FFFFFBE8]
:00411F4C 51                      push ecx
:00411F4D E8C0BE0100              call 0042DE12
:00411F52 83C408                  add esp, 00000008
:00411F55 25FF000000              and eax, 000000FF
:00411F5A 8985E4FBFFFF            mov dword ptr [ebp+FFFFFBE4], eax
:00411F60 8B95E4FBFFFF            mov edx, dword ptr [ebp+FFFFFBE4]
:00411F66 83C201                  add edx, 00000001
:00411F69 52                      push edx
:00411F6A 8B4D08                  mov ecx, dword ptr [ebp+08]
:00411F6D E879650000              call 004184EB
:00411F72 E8AB99FFFF              call 0040B922
:00411F77 85C0                    test eax, eax
:00411F79 7421                    je 00411F9C
:00411F7B 837DFC00                cmp dword ptr [ebp-04], 00000000
:00411F7F 751B                    jne 00411F9C
:00411F81 6A00                    push 00000000
:00411F83 A1D85F4B00              mov eax, dword ptr [004B5FD8]
:00411F88 50                      push eax
:00411F89 FF15E0624800            call dword ptr [004862E0]
:00411F8F 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:00411F95 51                      push ecx
:00411F96 FF15CC624800            call dword ptr [004862CC]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00411F79(C), :00411F7F(C)
|
:00411F9C B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00411E00(U), :00411E27(U)
|
:00411FA1 8BE5                    mov esp, ebp
:00411FA3 5D                      pop ebp
:00411FA4 C3                      ret



* Referenced by a CALL at Address:
|:00410B4B   
|
:00411FA5 55                      push ebp
:00411FA6 8BEC                    mov ebp, esp
:00411FA8 51                      push ecx
:00411FA9 6A04                    push 00000004
:00411FAB 8B4D08                  mov ecx, dword ptr [ebp+08]
:00411FAE E844640000              call 004183F7
:00411FB3 8945FC                  mov dword ptr [ebp-04], eax
:00411FB6 817DFC00000080          cmp dword ptr [ebp-04], 80000000
:00411FBD 7507                    jne 00411FC6
:00411FBF B805000000              mov eax, 00000005
:00411FC4 EB12                    jmp 00411FD8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411FBD(C)
|
:00411FC6 8B4D08                  mov ecx, dword ptr [ebp+08]
:00411FC9 E836650000              call 00418504
:00411FCE 33C9                    xor ecx, ecx
:00411FD0 3945FC                  cmp dword ptr [ebp-04], eax
:00411FD3 0F94C1                  sete cl
:00411FD6 8BC1                    mov eax, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411FC4(U)
|
:00411FD8 8BE5                    mov esp, ebp
:00411FDA 5D                      pop ebp
:00411FDB C3                      ret



* Referenced by a CALL at Address:
|:00410A3B   
|
:00411FDC 55                      push ebp
:00411FDD 8BEC                    mov ebp, esp
:00411FDF 51                      push ecx
:00411FE0 6A05                    push 00000005
:00411FE2 8B4D08                  mov ecx, dword ptr [ebp+08]
:00411FE5 E80D640000              call 004183F7
:00411FEA 8945FC                  mov dword ptr [ebp-04], eax
:00411FED 817DFC00000080          cmp dword ptr [ebp-04], 80000000
:00411FF4 7507                    jne 00411FFD
:00411FF6 B805000000              mov eax, 00000005
:00411FFB EB05                    jmp 00412002

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411FF4(C)
|
:00411FFD B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00411FFB(U)
|
:00412002 8BE5                    mov esp, ebp
:00412004 5D                      pop ebp
:00412005 C3                      ret



* Referenced by a CALL at Address:
|:00410DF3   
|
:00412006 55                      push ebp
:00412007 8BEC                    mov ebp, esp
:00412009 83EC18                  sub esp, 00000018
:0041200C 6A02                    push 00000002
:0041200E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00412011 E8E1630000              call 004183F7
:00412016 668945FC                mov word ptr [ebp-04], ax
:0041201A 8B45FC                  mov eax, dword ptr [ebp-04]
:0041201D 25FFFF0000              and eax, 0000FFFF
:00412022 3D00800000              cmp eax, 00008000
:00412027 750A                    jne 00412033
:00412029 B805000000              mov eax, 00000005
:0041202E E9B6010000              jmp 004121E9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412027(C)
|
:00412033 6A23                    push 00000023
:00412035 8B4D08                  mov ecx, dword ptr [ebp+08]
:00412038 E8BA630000              call 004183F7
:0041203D 668945EC                mov word ptr [ebp-14], ax
:00412041 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00412044 81E1FFFF0000            and ecx, 0000FFFF
:0041204A 81F900800000            cmp ecx, 00008000
:00412050 750A                    jne 0041205C
:00412052 B805000000              mov eax, 00000005
:00412057 E98D010000              jmp 004121E9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412050(C)
|
:0041205C 6A34                    push 00000034
:0041205E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00412061 E891630000              call 004183F7
:00412066 668945F0                mov word ptr [ebp-10], ax
:0041206A 8B55F0                  mov edx, dword ptr [ebp-10]
:0041206D 81E2FFFF0000            and edx, 0000FFFF
:00412073 81FA00800000            cmp edx, 00008000
:00412079 750A                    jne 00412085
:0041207B B805000000              mov eax, 00000005
:00412080 E964010000              jmp 004121E9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412079(C)
|
:00412085 6A04                    push 00000004
:00412087 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041208A E868630000              call 004183F7
:0041208F 8945F8                  mov dword ptr [ebp-08], eax
:00412092 817DF800000080          cmp dword ptr [ebp-08], 80000000
:00412099 750A                    jne 004120A5
:0041209B B805000000              mov eax, 00000005
:004120A0 E944010000              jmp 004121E9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412099(C)
|
:004120A5 E87898FFFF              call 0040B922
:004120AA 85C0                    test eax, eax
:004120AC 742E                    je 004120DC
:004120AE 8B45FC                  mov eax, dword ptr [ebp-04]
:004120B1 25FFFF0000              and eax, 0000FFFF
:004120B6 3D00040000              cmp eax, 00000400
:004120BB 7C1F                    jl 004120DC
:004120BD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004120C0 81E1FFFF0000            and ecx, 0000FFFF
:004120C6 81F902040000            cmp ecx, 00000402
:004120CC 7F0E                    jg 004120DC
:004120CE B9F05D4B00              mov ecx, 004B5DF0
:004120D3 E8533F0400              call 0045602B
:004120D8 668945FC                mov word ptr [ebp-04], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004120AC(C), :004120BB(C), :004120CC(C)
|
:004120DC 8B55FC                  mov edx, dword ptr [ebp-04]
:004120DF 81E2FFFF0000            and edx, 0000FFFF
:004120E5 81FAFFFF0000            cmp edx, 0000FFFF
:004120EB 740F                    je 004120FC
:004120ED 8B45FC                  mov eax, dword ptr [ebp-04]
:004120F0 25FFFF0000              and eax, 0000FFFF
:004120F5 3D00020000              cmp eax, 00000200
:004120FA 7E07                    jle 00412103

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004120EB(C)
|
:004120FC 33C0                    xor eax, eax
:004120FE E9E6000000              jmp 004121E9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004120FA(C)
|
:00412103 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00412106 81E1FFFF0000            and ecx, 0000FFFF
:0041210C 83F906                  cmp ecx, 00000006
:0041210F 7E07                    jle 00412118
:00412111 33C0                    xor eax, eax
:00412113 E9D1000000              jmp 004121E9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041210F(C)
|
:00412118 8B55F0                  mov edx, dword ptr [ebp-10]
:0041211B 81E2FFFF0000            and edx, 0000FFFF
:00412121 8955E8                  mov dword ptr [ebp-18], edx
:00412124 837DE800                cmp dword ptr [ebp-18], 00000000
:00412128 7411                    je 0041213B
:0041212A 837DE801                cmp dword ptr [ebp-18], 00000001
:0041212E 742C                    je 0041215C
:00412130 837DE802                cmp dword ptr [ebp-18], 00000002
:00412134 7447                    je 0041217D
:00412136 E994000000              jmp 004121CF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412128(C)
|
:0041213B 8B45F8                  mov eax, dword ptr [ebp-08]
:0041213E 50                      push eax
:0041213F 8A4DEC                  mov cl, byte ptr [ebp-14]
:00412142 51                      push ecx
:00412143 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00412146 81E1FFFF0000            and ecx, 0000FFFF
:0041214C 6BC948                  imul ecx, 00000048
:0041214F 81C1681B4A00            add ecx, 004A1B68
:00412155 E8FA4DFFFF              call 00406F54
:0041215A EB77                    jmp 004121D3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041212E(C)
|
:0041215C 8B55F8                  mov edx, dword ptr [ebp-08]
:0041215F 52                      push edx
:00412160 8A45EC                  mov al, byte ptr [ebp-14]
:00412163 50                      push eax
:00412164 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00412167 81E1FFFF0000            and ecx, 0000FFFF
:0041216D 6BC948                  imul ecx, 00000048
:00412170 81C1681B4A00            add ecx, 004A1B68
:00412176 E89C4CFFFF              call 00406E17
:0041217B EB56                    jmp 004121D3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412134(C)
|
:0041217D 8A4DEC                  mov cl, byte ptr [ebp-14]
:00412180 51                      push ecx
:00412181 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00412184 81E1FFFF0000            and ecx, 0000FFFF
:0041218A 6BC948                  imul ecx, 00000048
:0041218D 81C1681B4A00            add ecx, 004A1B68
:00412193 E8EF4BFFFF              call 00406D87
:00412198 8945F4                  mov dword ptr [ebp-0C], eax
:0041219B 8B55F8                  mov edx, dword ptr [ebp-08]
:0041219E 52                      push edx
:0041219F 8B45F4                  mov eax, dword ptr [ebp-0C]
:004121A2 50                      push eax
:004121A3 E8F6D80600              call 0047FA9E
:004121A8 83C408                  add esp, 00000008
:004121AB 8945F4                  mov dword ptr [ebp-0C], eax
:004121AE 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004121B1 51                      push ecx
:004121B2 8A55EC                  mov dl, byte ptr [ebp-14]
:004121B5 52                      push edx
:004121B6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004121B9 81E1FFFF0000            and ecx, 0000FFFF
:004121BF 6BC948                  imul ecx, 00000048
:004121C2 81C1681B4A00            add ecx, 004A1B68
:004121C8 E8874DFFFF              call 00406F54
:004121CD EB04                    jmp 004121D3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412136(U)
|
:004121CF 33C0                    xor eax, eax
:004121D1 EB16                    jmp 004121E9

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041215A(U), :0041217B(U), :004121CD(U)
|
:004121D3 8B45FC                  mov eax, dword ptr [ebp-04]
:004121D6 25FFFF0000              and eax, 0000FFFF
:004121DB 50                      push eax
:004121DC E820780600              call 00479A01
:004121E1 83C404                  add esp, 00000004
:004121E4 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041202E(U), :00412057(U), :00412080(U), :004120A0(U), :004120FE(U)
|:00412113(U), :004121D1(U)
|
:004121E9 8BE5                    mov esp, ebp
:004121EB 5D                      pop ebp
:004121EC C3                      ret



* Referenced by a CALL at Address:
|:00410C7D   
|
:004121ED 55                      push ebp
:004121EE 8BEC                    mov ebp, esp
:004121F0 51                      push ecx
:004121F1 6A1B                    push 0000001B
:004121F3 8B4D08                  mov ecx, dword ptr [ebp+08]
:004121F6 E8FC610000              call 004183F7
:004121FB 668945FC                mov word ptr [ebp-04], ax
:004121FF 8B45FC                  mov eax, dword ptr [ebp-04]
:00412202 25FFFF0000              and eax, 0000FFFF
:00412207 3D00800000              cmp eax, 00008000
:0041220C 7507                    jne 00412215
:0041220E B805000000              mov eax, 00000005
:00412213 EB17                    jmp 0041222C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041220C(C)
|
:00412215 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00412218 81E1FFFF0000            and ecx, 0000FFFF
:0041221E 51                      push ecx
:0041221F E830D50100              call 0042F754
:00412224 83C404                  add esp, 00000004
:00412227 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412213(U)
|
:0041222C 8BE5                    mov esp, ebp
:0041222E 5D                      pop ebp
:0041222F C3                      ret



* Referenced by a CALL at Address:
|:00410EBF   
|
:00412230 55                      push ebp
:00412231 8BEC                    mov ebp, esp
:00412233 83EC10                  sub esp, 00000010
:00412236 C745FC00000000          mov [ebp-04], 00000000
:0041223D EB09                    jmp 00412248

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041225F(U)
|
:0041223F 8B45FC                  mov eax, dword ptr [ebp-04]
:00412242 83C001                  add eax, 00000001
:00412245 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041223D(U)
|
:00412248 817DFC00010000          cmp dword ptr [ebp-04], 00000100
:0041224F 7310                    jnb 00412261
:00412251 6A00                    push 00000000
:00412253 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00412256 51                      push ecx
:00412257 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041225A E872620000              call 004184D1
:0041225F EBDE                    jmp 0041223F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041224F(C)
|
:00412261 E8CC490100              call 00426C32
:00412266 C745F400000000          mov [ebp-0C], 00000000
:0041226D EB09                    jmp 00412278

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004122A2(U)
|
:0041226F 8B55F4                  mov edx, dword ptr [ebp-0C]
:00412272 83C201                  add edx, 00000001
:00412275 8955F4                  mov dword ptr [ebp-0C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041226D(U)
|
:00412278 837DF473                cmp dword ptr [ebp-0C], 00000073
:0041227C 7D26                    jge 004122A4
:0041227E 8B45F4                  mov eax, dword ptr [ebp-0C]
:00412281 50                      push eax
:00412282 B9902F4900              mov ecx, 00492F90
:00412287 E8446B0000              call 00418DD0
:0041228C 8945F0                  mov dword ptr [ebp-10], eax
:0041228F 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00412292 C701FFFF0000            mov dword ptr [ecx], 0000FFFF
:00412298 8B55F0                  mov edx, dword ptr [ebp-10]
:0041229B C7420800000000          mov [edx+08], 00000000
:004122A2 EBCB                    jmp 0041226F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041227C(C)
|
:004122A4 C745F800000000          mov [ebp-08], 00000000
:004122AB EB09                    jmp 004122B6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004122E6(U)
|
:004122AD 8B45F8                  mov eax, dword ptr [ebp-08]
:004122B0 83C001                  add eax, 00000001
:004122B3 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004122AB(U)
|
:004122B6 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004122B9 813C8D50B34800FFFF0000  cmp dword ptr [4*ecx+0048B350], 0000FFFF
:004122C4 7422                    je 004122E8
:004122C6 8B55F8                  mov edx, dword ptr [ebp-08]
:004122C9 52                      push edx
:004122CA B9902F4900              mov ecx, 00492F90
:004122CF E8FC6A0000              call 00418DD0
:004122D4 8945F0                  mov dword ptr [ebp-10], eax
:004122D7 8B45F0                  mov eax, dword ptr [ebp-10]
:004122DA 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004122DD 8B148D50B34800          mov edx, dword ptr [4*ecx+0048B350]
:004122E4 8910                    mov dword ptr [eax], edx
:004122E6 EBC5                    jmp 004122AD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004122C4(C)
|
:004122E8 B801000000              mov eax, 00000001
:004122ED 8BE5                    mov esp, ebp
:004122EF 5D                      pop ebp
:004122F0 C3                      ret



* Referenced by a CALL at Address:
|:00410ED0   
|
:004122F1 55                      push ebp
:004122F2 8BEC                    mov ebp, esp
:004122F4 83EC2C                  sub esp, 0000002C
:004122F7 6A26                    push 00000026
:004122F9 8B4D08                  mov ecx, dword ptr [ebp+08]
:004122FC E8F6600000              call 004183F7
:00412301 668945F8                mov word ptr [ebp-08], ax
:00412305 8B45F8                  mov eax, dword ptr [ebp-08]
:00412308 25FFFF0000              and eax, 0000FFFF
:0041230D 3D00800000              cmp eax, 00008000
:00412312 750A                    jne 0041231E
:00412314 B805000000              mov eax, 00000005
:00412319 E9A3020000              jmp 004125C1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412312(C)
|
:0041231E 6A26                    push 00000026
:00412320 8B4D08                  mov ecx, dword ptr [ebp+08]
:00412323 E8CF600000              call 004183F7
:00412328 668945E4                mov word ptr [ebp-1C], ax
:0041232C 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0041232F 81E1FFFF0000            and ecx, 0000FFFF
:00412335 81F900800000            cmp ecx, 00008000
:0041233B 750A                    jne 00412347
:0041233D B805000000              mov eax, 00000005
:00412342 E97A020000              jmp 004125C1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041233B(C)
|
:00412347 6A04                    push 00000004
:00412349 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041234C E8A6600000              call 004183F7
:00412351 8945D8                  mov dword ptr [ebp-28], eax
:00412354 817DD800000080          cmp dword ptr [ebp-28], 80000000
:0041235B 750A                    jne 00412367
:0041235D B805000000              mov eax, 00000005
:00412362 E95A020000              jmp 004125C1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041235B(C)
|
:00412367 6A3E                    push 0000003E
:00412369 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041236C E886600000              call 004183F7
:00412371 668945EC                mov word ptr [ebp-14], ax
:00412375 8B55EC                  mov edx, dword ptr [ebp-14]
:00412378 81E2FFFF0000            and edx, 0000FFFF
:0041237E 81FA00800000            cmp edx, 00008000
:00412384 750A                    jne 00412390
:00412386 B805000000              mov eax, 00000005
:0041238B E931020000              jmp 004125C1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412384(C)
|
:00412390 6A32                    push 00000032
:00412392 8B4D08                  mov ecx, dword ptr [ebp+08]
:00412395 E85D600000              call 004183F7
:0041239A 668945E8                mov word ptr [ebp-18], ax
:0041239E 8B45E8                  mov eax, dword ptr [ebp-18]
:004123A1 25FFFF0000              and eax, 0000FFFF
:004123A6 3D00800000              cmp eax, 00008000
:004123AB 750A                    jne 004123B7
:004123AD B805000000              mov eax, 00000005
:004123B2 E90A020000              jmp 004125C1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004123AB(C)
|
:004123B7 6A02                    push 00000002
:004123B9 8B4D08                  mov ecx, dword ptr [ebp+08]
:004123BC E836600000              call 004183F7
:004123C1 668945F4                mov word ptr [ebp-0C], ax
:004123C5 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004123C8 81E1FFFF0000            and ecx, 0000FFFF
:004123CE 81F900800000            cmp ecx, 00008000
:004123D4 750A                    jne 004123E0
:004123D6 B805000000              mov eax, 00000005
:004123DB E9E1010000              jmp 004125C1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004123D4(C)
|
:004123E0 6A32                    push 00000032
:004123E2 8B4D08                  mov ecx, dword ptr [ebp+08]
:004123E5 E80D600000              call 004183F7
:004123EA 668945E0                mov word ptr [ebp-20], ax
:004123EE 8B55E0                  mov edx, dword ptr [ebp-20]
:004123F1 81E2FFFF0000            and edx, 0000FFFF
:004123F7 81FA00800000            cmp edx, 00008000
:004123FD 750A                    jne 00412409
:004123FF B805000000              mov eax, 00000005
:00412404 E9B8010000              jmp 004125C1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004123FD(C)
|
:00412409 6A02                    push 00000002
:0041240B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041240E E8E45F0000              call 004183F7
:00412413 668945F0                mov word ptr [ebp-10], ax
:00412417 8B45F0                  mov eax, dword ptr [ebp-10]
:0041241A 25FFFF0000              and eax, 0000FFFF
:0041241F 3D00800000              cmp eax, 00008000
:00412424 750A                    jne 00412430
:00412426 B805000000              mov eax, 00000005
:0041242B E991010000              jmp 004125C1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412424(C)
|
:00412430 6A47                    push 00000047
:00412432 8B4D08                  mov ecx, dword ptr [ebp+08]
:00412435 E8BD5F0000              call 004183F7
:0041243A 668945DC                mov word ptr [ebp-24], ax
:0041243E 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00412441 81E1FFFF0000            and ecx, 0000FFFF
:00412447 81F900800000            cmp ecx, 00008000
:0041244D 750A                    jne 00412459
:0041244F B805000000              mov eax, 00000005
:00412454 E968010000              jmp 004125C1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041244D(C)
|
:00412459 6A22                    push 00000022
:0041245B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041245E E8945F0000              call 004183F7
:00412463 668945FC                mov word ptr [ebp-04], ax
:00412467 8B55FC                  mov edx, dword ptr [ebp-04]
:0041246A 81E2FFFF0000            and edx, 0000FFFF
:00412470 81FA00800000            cmp edx, 00008000
:00412476 750A                    jne 00412482
:00412478 B805000000              mov eax, 00000005
:0041247D E93F010000              jmp 004125C1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412476(C)
|
:00412482 8B45F8                  mov eax, dword ptr [ebp-08]
:00412485 25FFFF0000              and eax, 0000FFFF
:0041248A F7D8                    neg eax
:0041248C 1BC0                    sbb eax, eax
:0041248E F7D8                    neg eax
:00412490 66A3D04F4900            mov word ptr [00494FD0], ax
:00412496 8A4DE4                  mov cl, byte ptr [ebp-1C]
:00412499 880D9F6C4900            mov byte ptr [00496C9F], cl
:0041249F 8B55D8                  mov edx, dword ptr [ebp-28]
:004124A2 52                      push edx
:004124A3 B9902F4900              mov ecx, 00492F90
:004124A8 E843690000              call 00418DF0
:004124AD 8B45EC                  mov eax, dword ptr [ebp-14]
:004124B0 25FFFF0000              and eax, 0000FFFF
:004124B5 3DFFFF0000              cmp eax, 0000FFFF
:004124BA 7506                    jne 004124C2
:004124BC 66C745EC0000            mov [ebp-14], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004124BA(C)
|
:004124C2 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004124C5 81E1FFFF0000            and ecx, 0000FFFF
:004124CB 83F932                  cmp ecx, 00000032
:004124CE 7F0B                    jg 004124DB
:004124D0 8A55EC                  mov dl, byte ptr [ebp-14]
:004124D3 8815236E4900            mov byte ptr [00496E23], dl
:004124D9 EB1A                    jmp 004124F5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004124CE(C)
|
:004124DB 8B45EC                  mov eax, dword ptr [ebp-14]
:004124DE 25FFFF0000              and eax, 0000FFFF
:004124E3 83E832                  sub eax, 00000032
:004124E6 F7D8                    neg eax
:004124E8 668945EC                mov word ptr [ebp-14], ax
:004124EC 8A4DEC                  mov cl, byte ptr [ebp-14]
:004124EF 880D236E4900            mov byte ptr [00496E23], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004124D9(U)
|
:004124F5 8B55F4                  mov edx, dword ptr [ebp-0C]
:004124F8 81E2FFFF0000            and edx, 0000FFFF
:004124FE 33C0                    xor eax, eax
:00412500 81FAFFFF0000            cmp edx, 0000FFFF
:00412506 0F95C0                  setne al
:00412509 66A3946C4900            mov word ptr [00496C94], ax
:0041250F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00412512 81E1FFFF0000            and ecx, 0000FFFF
:00412518 81F9FFFF0000            cmp ecx, 0000FFFF
:0041251E 740A                    je 0041252A
:00412520 668B55F4                mov dx, word ptr [ebp-0C]
:00412524 668955D6                mov word ptr [ebp-2A], dx
:00412528 EB06                    jmp 00412530

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041251E(C)
|
:0041252A 66C745D6FFFF            mov [ebp-2A], FFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412528(U)
|
:00412530 668B45D6                mov ax, word ptr [ebp-2A]
:00412534 66A3966C4900            mov word ptr [00496C96], ax
:0041253A 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0041253D 81E1FFFF0000            and ecx, 0000FFFF
:00412543 33D2                    xor edx, edx
:00412545 81F9FFFF0000            cmp ecx, 0000FFFF
:0041254B 0F95C2                  setne dl
:0041254E 668915986C4900          mov word ptr [00496C98], dx
:00412555 8B45F0                  mov eax, dword ptr [ebp-10]
:00412558 25FFFF0000              and eax, 0000FFFF
:0041255D 3DFFFF0000              cmp eax, 0000FFFF
:00412562 740A                    je 0041256E
:00412564 668B4DF0                mov cx, word ptr [ebp-10]
:00412568 66894DD4                mov word ptr [ebp-2C], cx
:0041256C EB06                    jmp 00412574

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412562(C)
|
:0041256E 66C745D4FFFF            mov [ebp-2C], FFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041256C(U)
|
:00412574 668B55D4                mov dx, word ptr [ebp-2C]
:00412578 6689159A6C4900          mov word ptr [00496C9A], dx
:0041257F 8B45DC                  mov eax, dword ptr [ebp-24]
:00412582 25FFFF0000              and eax, 0000FFFF
:00412587 3DFFFF0000              cmp eax, 0000FFFF
:0041258C 7506                    jne 00412594
:0041258E 66C745DC0000            mov [ebp-24], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041258C(C)
|
:00412594 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00412597 81E1FFFF0000            and ecx, 0000FFFF
:0041259D 81F9FFFF0000            cmp ecx, 0000FFFF
:004125A3 7506                    jne 004125AB
:004125A5 66C745FC0100            mov [ebp-04], 0001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004125A3(C)
|
:004125AB 8A55DC                  mov dl, byte ptr [ebp-24]
:004125AE 8815216E4900            mov byte ptr [00496E21], dl
:004125B4 8A45FC                  mov al, byte ptr [ebp-04]
:004125B7 A2226E4900              mov byte ptr [00496E22], al
:004125BC B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00412319(U), :00412342(U), :00412362(U), :0041238B(U), :004123B2(U)
|:004123DB(U), :00412404(U), :0041242B(U), :00412454(U), :0041247D(U)
|
:004125C1 8BE5                    mov esp, ebp
:004125C3 5D                      pop ebp
:004125C4 C3                      ret



* Referenced by a CALL at Address:
|:00410EE1   
|
:004125C5 55                      push ebp
:004125C6 8BEC                    mov ebp, esp
:004125C8 83EC44                  sub esp, 00000044
:004125CB 56                      push esi
:004125CC B9902F4900              mov ecx, 00492F90
:004125D1 E884620000              call 0041885A
:004125D6 0FBEC0                  movsx eax, al
:004125D9 0FBE0D236E4900          movsx ecx, byte ptr [00496E23]
:004125E0 03C1                    add eax, ecx
:004125E2 8845F4                  mov byte ptr [ebp-0C], al
:004125E5 0FBE55F4                movsx edx, byte ptr [ebp-0C]
:004125E9 85D2                    test edx, edx
:004125EB 7F09                    jg 004125F6
:004125ED C745C401000000          mov [ebp-3C], 00000001
:004125F4 EB07                    jmp 004125FD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004125EB(C)
|
:004125F6 0FBE45F4                movsx eax, byte ptr [ebp-0C]
:004125FA 8945C4                  mov dword ptr [ebp-3C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004125F4(U)
|
:004125FD 8A4DC4                  mov cl, byte ptr [ebp-3C]
:00412600 884DF4                  mov byte ptr [ebp-0C], cl
:00412603 C745FC0F000000          mov [ebp-04], 0000000F
:0041260A EB09                    jmp 00412615

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412979(U)
|
:0041260C 8B55FC                  mov edx, dword ptr [ebp-04]
:0041260F 83C201                  add edx, 00000001
:00412612 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041260A(U)
|
:00412615 837DFC23                cmp dword ptr [ebp-04], 00000023
:00412619 0F8D5F030000            jnl 0041297E
:0041261F 6A02                    push 00000002
:00412621 8B4D08                  mov ecx, dword ptr [ebp+08]
:00412624 E8CE5D0000              call 004183F7
:00412629 668945E8                mov word ptr [ebp-18], ax
:0041262D 8B45E8                  mov eax, dword ptr [ebp-18]
:00412630 25FFFF0000              and eax, 0000FFFF
:00412635 3D00800000              cmp eax, 00008000
:0041263A 750A                    jne 00412646
:0041263C B805000000              mov eax, 00000005
:00412641 E93D030000              jmp 00412983

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041263A(C)
|
:00412646 6A26                    push 00000026
:00412648 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041264B E8A75D0000              call 004183F7
:00412650 668945F0                mov word ptr [ebp-10], ax
:00412654 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00412657 81E1FFFF0000            and ecx, 0000FFFF
:0041265D 81F900800000            cmp ecx, 00008000
:00412663 750A                    jne 0041266F
:00412665 B805000000              mov eax, 00000005
:0041266A E914030000              jmp 00412983

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412663(C)
|
:0041266F 6A04                    push 00000004
:00412671 8B4D08                  mov ecx, dword ptr [ebp+08]
:00412674 E87E5D0000              call 004183F7
:00412679 8945D0                  mov dword ptr [ebp-30], eax
:0041267C 817DD000000080          cmp dword ptr [ebp-30], 80000000
:00412683 750A                    jne 0041268F
:00412685 B805000000              mov eax, 00000005
:0041268A E9F4020000              jmp 00412983

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412683(C)
|
:0041268F 6A04                    push 00000004
:00412691 8B4D08                  mov ecx, dword ptr [ebp+08]
:00412694 E85E5D0000              call 004183F7
:00412699 8945C8                  mov dword ptr [ebp-38], eax
:0041269C 817DC800000080          cmp dword ptr [ebp-38], 80000000
:004126A3 750A                    jne 004126AF
:004126A5 B805000000              mov eax, 00000005
:004126AA E9D4020000              jmp 00412983

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004126A3(C)
|
:004126AF 6A2B                    push 0000002B
:004126B1 8B4D08                  mov ecx, dword ptr [ebp+08]
:004126B4 E83E5D0000              call 004183F7
:004126B9 668945D8                mov word ptr [ebp-28], ax
:004126BD 8B55D8                  mov edx, dword ptr [ebp-28]
:004126C0 81E2FFFF0000            and edx, 0000FFFF
:004126C6 81FA00800000            cmp edx, 00008000
:004126CC 750A                    jne 004126D8
:004126CE B805000000              mov eax, 00000005
:004126D3 E9AB020000              jmp 00412983

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004126CC(C)
|
:004126D8 6A3E                    push 0000003E
:004126DA 8B4D08                  mov ecx, dword ptr [ebp+08]
:004126DD E8155D0000              call 004183F7
:004126E2 668945DC                mov word ptr [ebp-24], ax
:004126E6 8B45DC                  mov eax, dword ptr [ebp-24]
:004126E9 25FFFF0000              and eax, 0000FFFF
:004126EE 3D00800000              cmp eax, 00008000
:004126F3 750A                    jne 004126FF
:004126F5 B805000000              mov eax, 00000005
:004126FA E984020000              jmp 00412983

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004126F3(C)
|
:004126FF 6A45                    push 00000045
:00412701 8B4D08                  mov ecx, dword ptr [ebp+08]
:00412704 E8EE5C0000              call 004183F7
:00412709 668945D4                mov word ptr [ebp-2C], ax
:0041270D 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00412710 81E1FFFF0000            and ecx, 0000FFFF
:00412716 81F900800000            cmp ecx, 00008000
:0041271C 750A                    jne 00412728
:0041271E B805000000              mov eax, 00000005
:00412723 E95B020000              jmp 00412983

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041271C(C)
|

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:00412728 6A07                    push 00000007
:0041272A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041272D E8C55C0000              call 004183F7
:00412732 668945E0                mov word ptr [ebp-20], ax
:00412736 8B55E0                  mov edx, dword ptr [ebp-20]
:00412739 81E2FFFF0000            and edx, 0000FFFF
:0041273F 81FA00800000            cmp edx, 00008000
:00412745 750A                    jne 00412751
:00412747 B805000000              mov eax, 00000005
:0041274C E932020000              jmp 00412983

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412745(C)
|
:00412751 6A02                    push 00000002
:00412753 8B4D08                  mov ecx, dword ptr [ebp+08]
:00412756 E89C5C0000              call 004183F7
:0041275B 668945E4                mov word ptr [ebp-1C], ax
:0041275F 8B45E4                  mov eax, dword ptr [ebp-1C]
:00412762 25FFFF0000              and eax, 0000FFFF
:00412767 3D00800000              cmp eax, 00008000
:0041276C 750A                    jne 00412778
:0041276E B805000000              mov eax, 00000005
:00412773 E90B020000              jmp 00412983

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041276C(C)
|
:00412778 6A04                    push 00000004
:0041277A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041277D E8755C0000              call 004183F7
:00412782 8945CC                  mov dword ptr [ebp-34], eax
:00412785 817DCC00000080          cmp dword ptr [ebp-34], 80000000
:0041278C 750A                    jne 00412798
:0041278E B805000000              mov eax, 00000005
:00412793 E9EB010000              jmp 00412983

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041278C(C)
|
:00412798 6A04                    push 00000004
:0041279A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041279D E8555C0000              call 004183F7
:004127A2 8945EC                  mov dword ptr [ebp-14], eax
:004127A5 817DEC00000080          cmp dword ptr [ebp-14], 80000000
:004127AC 750A                    jne 004127B8
:004127AE B805000000              mov eax, 00000005
:004127B3 E9CB010000              jmp 00412983

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004127AC(C)
|
:004127B8 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004127BB 81E1FFFF0000            and ecx, 0000FFFF
:004127C1 81F9FFFF0000            cmp ecx, 0000FFFF
:004127C7 0F84AC010000            je 00412979
:004127CD 8B55F0                  mov edx, dword ptr [ebp-10]
:004127D0 81E2FFFF0000            and edx, 0000FFFF
:004127D6 81FAFFFF0000            cmp edx, 0000FFFF
:004127DC 7506                    jne 004127E4
:004127DE 66C745F00000            mov [ebp-10], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004127DC(C)
|
:004127E4 8B45E0                  mov eax, dword ptr [ebp-20]
:004127E7 25FFFF0000              and eax, 0000FFFF
:004127EC 3DFFFF0000              cmp eax, 0000FFFF
:004127F1 7506                    jne 004127F9
:004127F3 66C745E00100            mov [ebp-20], 0001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004127F1(C)
|
:004127F9 8B4DDC                  mov ecx, dword ptr [ebp-24]
:004127FC 81E1FFFF0000            and ecx, 0000FFFF
:00412802 81F9FFFF0000            cmp ecx, 0000FFFF
:00412808 7506                    jne 00412810
:0041280A 66C745DC0000            mov [ebp-24], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412808(C)
|
:00412810 8B55D4                  mov edx, dword ptr [ebp-2C]
:00412813 81E2FFFF0000            and edx, 0000FFFF
:00412819 81FAFFFF0000            cmp edx, 0000FFFF
:0041281F 7506                    jne 00412827
:00412821 66C745D40200            mov [ebp-2C], 0002

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041281F(C)
|
:00412827 8B45DC                  mov eax, dword ptr [ebp-24]
:0041282A 25FFFF0000              and eax, 0000FFFF
:0041282F 83F832                  cmp eax, 00000032
:00412832 7F1C                    jg 00412850
:00412834 6A32                    push 00000032
:00412836 8A4DDC                  mov cl, byte ptr [ebp-24]
:00412839 51                      push ecx
:0041283A 8A55F4                  mov dl, byte ptr [ebp-0C]
:0041283D 52                      push edx
:0041283E E872D20600              call 0047FAB5
:00412843 83C40C                  add esp, 0000000C
:00412846 660FB6C0                movzx ax, al
:0041284A 668945DC                mov word ptr [ebp-24], ax
:0041284E EB4E                    jmp 0041289E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412832(C)
|
:00412850 668B4DDC                mov cx, word ptr [ebp-24]
:00412854 6683E932                sub cx, 0032
:00412858 66894DDC                mov word ptr [ebp-24], cx
:0041285C 8A55DC                  mov dl, byte ptr [ebp-24]
:0041285F 52                      push edx
:00412860 8A45F4                  mov al, byte ptr [ebp-0C]
:00412863 50                      push eax
:00412864 E867D20600              call 0047FAD0
:00412869 83C408                  add esp, 00000008
:0041286C 6633C9                  xor cx, cx
:0041286F 8AC8                    mov cl, al
:00412871 66894DDC                mov word ptr [ebp-24], cx
:00412875 8B55DC                  mov edx, dword ptr [ebp-24]
:00412878 81E2FFFF0000            and edx, 0000FFFF
:0041287E 85D2                    test edx, edx
:00412880 7509                    jne 0041288B
:00412882 C745C001000000          mov [ebp-40], 00000001
:00412889 EB0B                    jmp 00412896

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412880(C)
|
:0041288B 8B45DC                  mov eax, dword ptr [ebp-24]
:0041288E 25FFFF0000              and eax, 0000FFFF
:00412893 8945C0                  mov dword ptr [ebp-40], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412889(U)
|
:00412896 668B4DC0                mov cx, word ptr [ebp-40]
:0041289A 66894DDC                mov word ptr [ebp-24], cx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041284E(U)
|
:0041289E 8B55FC                  mov edx, dword ptr [ebp-04]
:004128A1 52                      push edx
:004128A2 B9902F4900              mov ecx, 00492F90
:004128A7 E824650000              call 00418DD0
:004128AC 8945F8                  mov dword ptr [ebp-08], eax
:004128AF 8B45E8                  mov eax, dword ptr [ebp-18]
:004128B2 25FFFF0000              and eax, 0000FFFF
:004128B7 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004128BA 8901                    mov dword ptr [ecx], eax
:004128BC 8B55F8                  mov edx, dword ptr [ebp-08]
:004128BF 8A45D0                  mov al, byte ptr [ebp-30]
:004128C2 884204                  mov byte ptr [edx+04], al
:004128C5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004128C8 8A55C8                  mov dl, byte ptr [ebp-38]
:004128CB 885105                  mov byte ptr [ecx+05], dl
:004128CE 8B75F0                  mov esi, dword ptr [ebp-10]
:004128D1 81E6FFFF0000            and esi, 0000FFFF
:004128D7 F7DE                    neg esi
:004128D9 1BF6                    sbb esi, esi
:004128DB 83E604                  and esi, 00000004
:004128DE 83CE02                  or esi, 00000002
:004128E1 8A45D8                  mov al, byte ptr [ebp-28]
:004128E4 50                      push eax
:004128E5 E83D720300              call 00449B27
:004128EA 83C404                  add esp, 00000004
:004128ED 0BF0                    or esi, eax
:004128EF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004128F2 897108                  mov dword ptr [ecx+08], esi
:004128F5 8B55F8                  mov edx, dword ptr [ebp-08]
:004128F8 8A45DC                  mov al, byte ptr [ebp-24]
:004128FB 884211                  mov byte ptr [edx+11], al
:004128FE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00412901 8A55D4                  mov dl, byte ptr [ebp-2C]
:00412904 885110                  mov byte ptr [ecx+10], dl
:00412907 8B45F8                  mov eax, dword ptr [ebp-08]
:0041290A 8A4DE0                  mov cl, byte ptr [ebp-20]
:0041290D 88480C                  mov byte ptr [eax+0C], cl
:00412910 8B55E0                  mov edx, dword ptr [ebp-20]
:00412913 81E2FFFF0000            and edx, 0000FFFF
:00412919 8955BC                  mov dword ptr [ebp-44], edx
:0041291C 837DBC06                cmp dword ptr [ebp-44], 00000006
:00412920 772B                    ja 0041294D
:00412922 8B45BC                  mov eax, dword ptr [ebp-44]
:00412925 FF248588294100          jmp dword ptr [4*eax+00412988]
:0041292C EB1F                    jmp 0041294D
:0041292E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00412931 668B55E4                mov dx, word ptr [ebp-1C]
:00412935 6689510E                mov word ptr [ecx+0E], dx
:00412939 EB12                    jmp 0041294D
:0041293B 8B45F8                  mov eax, dword ptr [ebp-08]
:0041293E 8A4DCC                  mov cl, byte ptr [ebp-34]
:00412941 88480E                  mov byte ptr [eax+0E], cl
:00412944 8B55F8                  mov edx, dword ptr [ebp-08]
:00412947 8A45EC                  mov al, byte ptr [ebp-14]
:0041294A 88420F                  mov byte ptr [edx+0F], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00412920(C), :0041292C(U), :00412939(U)
|
:0041294D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00412950 C7411400000000          mov [ecx+14], 00000000
:00412957 8B55F8                  mov edx, dword ptr [ebp-08]
:0041295A C7421800000000          mov [edx+18], 00000000
:00412961 8B45F8                  mov eax, dword ptr [ebp-08]
:00412964 C7401C00000000          mov [eax+1C], 00000000
:0041296B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041296E C6412001                mov [ecx+20], 01
:00412972 8B55F8                  mov edx, dword ptr [ebp-08]
:00412975 C6422101                mov [edx+21], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004127C7(C)
|
:00412979 E98EFCFFFF              jmp 0041260C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412619(C)
|
:0041297E B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00412641(U), :0041266A(U), :0041268A(U), :004126AA(U), :004126D3(U)
|:004126FA(U), :00412723(U), :0041274C(U), :00412773(U), :00412793(U)
|:004127B3(U)
|
:00412983 5E                      pop esi
:00412984 8BE5                    mov esp, ebp
:00412986 5D                      pop ebp
:00412987 C3                      ret



:00412988 2C294100                DWORD 0041292C
:0041298C 4D294100                DWORD 0041294D
:00412990 4D294100                DWORD 0041294D
:00412994 2E294100                DWORD 0041292E
:00412998 3B294100                DWORD 0041293B
:0041299C 2E294100                DWORD 0041292E
:004129A0 3B294100                DWORD 0041293B



* Referenced by a CALL at Address:
|:00410EF2   
|
:004129A4 55                      push ebp
:004129A5 8BEC                    mov ebp, esp
:004129A7 83EC48                  sub esp, 00000048
:004129AA 56                      push esi
:004129AB B9902F4900              mov ecx, 00492F90
:004129B0 E8A55E0000              call 0041885A
:004129B5 0FBEC0                  movsx eax, al
:004129B8 0FBE0D236E4900          movsx ecx, byte ptr [00496E23]
:004129BF 03C1                    add eax, ecx
:004129C1 8845F4                  mov byte ptr [ebp-0C], al
:004129C4 0FBE55F4                movsx edx, byte ptr [ebp-0C]
:004129C8 85D2                    test edx, edx
:004129CA 7F09                    jg 004129D5
:004129CC C745C001000000          mov [ebp-40], 00000001
:004129D3 EB07                    jmp 004129DC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004129CA(C)
|
:004129D5 0FBE45F4                movsx eax, byte ptr [ebp-0C]
:004129D9 8945C0                  mov dword ptr [ebp-40], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004129D3(U)
|
:004129DC 8A4DC0                  mov cl, byte ptr [ebp-40]
:004129DF 884DF4                  mov byte ptr [ebp-0C], cl
:004129E2 C745FC23000000          mov [ebp-04], 00000023
:004129E9 EB09                    jmp 004129F4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412DAB(U)
|
:004129EB 8B55FC                  mov edx, dword ptr [ebp-04]
:004129EE 83C201                  add edx, 00000001
:004129F1 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004129E9(U)
|
:004129F4 837DFC73                cmp dword ptr [ebp-04], 00000073
:004129F8 0F8DB2030000            jnl 00412DB0
:004129FE 6A02                    push 00000002
:00412A00 8B4D08                  mov ecx, dword ptr [ebp+08]
:00412A03 E8EF590000              call 004183F7
:00412A08 668945E4                mov word ptr [ebp-1C], ax
:00412A0C 8B45E4                  mov eax, dword ptr [ebp-1C]
:00412A0F 25FFFF0000              and eax, 0000FFFF
:00412A14 3D00800000              cmp eax, 00008000
:00412A19 750A                    jne 00412A25
:00412A1B B805000000              mov eax, 00000005
:00412A20 E990030000              jmp 00412DB5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412A19(C)
|
:00412A25 6A26                    push 00000026
:00412A27 8B4D08                  mov ecx, dword ptr [ebp+08]
:00412A2A E8C8590000              call 004183F7
:00412A2F 668945EC                mov word ptr [ebp-14], ax
:00412A33 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00412A36 81E1FFFF0000            and ecx, 0000FFFF
:00412A3C 81F900800000            cmp ecx, 00008000
:00412A42 750A                    jne 00412A4E
:00412A44 B805000000              mov eax, 00000005
:00412A49 E967030000              jmp 00412DB5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412A42(C)
|
:00412A4E 6A26                    push 00000026
:00412A50 8B4D08                  mov ecx, dword ptr [ebp+08]
:00412A53 E89F590000              call 004183F7
:00412A58 668945F0                mov word ptr [ebp-10], ax
:00412A5C 8B55F0                  mov edx, dword ptr [ebp-10]
:00412A5F 81E2FFFF0000            and edx, 0000FFFF
:00412A65 81FA00800000            cmp edx, 00008000
:00412A6B 750A                    jne 00412A77
:00412A6D B805000000              mov eax, 00000005
:00412A72 E93E030000              jmp 00412DB5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412A6B(C)
|
:00412A77 6A04                    push 00000004
:00412A79 8B4D08                  mov ecx, dword ptr [ebp+08]
:00412A7C E876590000              call 004183F7
:00412A81 8945CC                  mov dword ptr [ebp-34], eax
:00412A84 817DCC00000080          cmp dword ptr [ebp-34], 80000000
:00412A8B 750A                    jne 00412A97
:00412A8D B805000000              mov eax, 00000005
:00412A92 E91E030000              jmp 00412DB5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412A8B(C)
|
:00412A97 6A04                    push 00000004
:00412A99 8B4D08                  mov ecx, dword ptr [ebp+08]
:00412A9C E856590000              call 004183F7
:00412AA1 8945C4                  mov dword ptr [ebp-3C], eax
:00412AA4 817DC400000080          cmp dword ptr [ebp-3C], 80000000
:00412AAB 750A                    jne 00412AB7
:00412AAD B805000000              mov eax, 00000005
:00412AB2 E9FE020000              jmp 00412DB5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412AAB(C)
|
:00412AB7 6A2B                    push 0000002B
:00412AB9 8B4D08                  mov ecx, dword ptr [ebp+08]
:00412ABC E836590000              call 004183F7
:00412AC1 668945D4                mov word ptr [ebp-2C], ax
:00412AC5 8B45D4                  mov eax, dword ptr [ebp-2C]
:00412AC8 25FFFF0000              and eax, 0000FFFF
:00412ACD 3D00800000              cmp eax, 00008000
:00412AD2 750A                    jne 00412ADE
:00412AD4 B805000000              mov eax, 00000005
:00412AD9 E9D7020000              jmp 00412DB5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412AD2(C)
|
:00412ADE 6A3E                    push 0000003E
:00412AE0 8B4D08                  mov ecx, dword ptr [ebp+08]
:00412AE3 E80F590000              call 004183F7
:00412AE8 668945D8                mov word ptr [ebp-28], ax
:00412AEC 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00412AEF 81E1FFFF0000            and ecx, 0000FFFF
:00412AF5 81F900800000            cmp ecx, 00008000
:00412AFB 750A                    jne 00412B07
:00412AFD B805000000              mov eax, 00000005
:00412B02 E9AE020000              jmp 00412DB5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412AFB(C)
|
:00412B07 6A45                    push 00000045
:00412B09 8B4D08                  mov ecx, dword ptr [ebp+08]
:00412B0C E8E6580000              call 004183F7
:00412B11 668945D0                mov word ptr [ebp-30], ax
:00412B15 8B55D0                  mov edx, dword ptr [ebp-30]
:00412B18 81E2FFFF0000            and edx, 0000FFFF
:00412B1E 81FA00800000            cmp edx, 00008000
:00412B24 750A                    jne 00412B30
:00412B26 B805000000              mov eax, 00000005
:00412B2B E985020000              jmp 00412DB5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412B24(C)
|

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:00412B30 6A07                    push 00000007
:00412B32 8B4D08                  mov ecx, dword ptr [ebp+08]
:00412B35 E8BD580000              call 004183F7
:00412B3A 668945DC                mov word ptr [ebp-24], ax
:00412B3E 8B45DC                  mov eax, dword ptr [ebp-24]
:00412B41 25FFFF0000              and eax, 0000FFFF
:00412B46 3D00800000              cmp eax, 00008000
:00412B4B 750A                    jne 00412B57
:00412B4D B805000000              mov eax, 00000005
:00412B52 E95E020000              jmp 00412DB5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412B4B(C)
|
:00412B57 6A02                    push 00000002
:00412B59 8B4D08                  mov ecx, dword ptr [ebp+08]
:00412B5C E896580000              call 004183F7
:00412B61 668945E0                mov word ptr [ebp-20], ax
:00412B65 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00412B68 81E1FFFF0000            and ecx, 0000FFFF
:00412B6E 81F900800000            cmp ecx, 00008000
:00412B74 750A                    jne 00412B80
:00412B76 B805000000              mov eax, 00000005
:00412B7B E935020000              jmp 00412DB5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412B74(C)
|
:00412B80 6A04                    push 00000004
:00412B82 8B4D08                  mov ecx, dword ptr [ebp+08]
:00412B85 E86D580000              call 004183F7
:00412B8A 8945C8                  mov dword ptr [ebp-38], eax
:00412B8D 817DC800000080          cmp dword ptr [ebp-38], 80000000
:00412B94 750A                    jne 00412BA0
:00412B96 B805000000              mov eax, 00000005
:00412B9B E915020000              jmp 00412DB5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412B94(C)
|
:00412BA0 6A04                    push 00000004
:00412BA2 8B4D08                  mov ecx, dword ptr [ebp+08]
:00412BA5 E84D580000              call 004183F7
:00412BAA 8945E8                  mov dword ptr [ebp-18], eax
:00412BAD 817DE800000080          cmp dword ptr [ebp-18], 80000000
:00412BB4 750A                    jne 00412BC0
:00412BB6 B805000000              mov eax, 00000005
:00412BBB E9F5010000              jmp 00412DB5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412BB4(C)
|
:00412BC0 8B55E4                  mov edx, dword ptr [ebp-1C]
:00412BC3 81E2FFFF0000            and edx, 0000FFFF
:00412BC9 81FAFFFF0000            cmp edx, 0000FFFF
:00412BCF 0F84D6010000            je 00412DAB
:00412BD5 8B45EC                  mov eax, dword ptr [ebp-14]
:00412BD8 25FFFF0000              and eax, 0000FFFF
:00412BDD 3DFFFF0000              cmp eax, 0000FFFF
:00412BE2 7506                    jne 00412BEA
:00412BE4 66C745EC0000            mov [ebp-14], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412BE2(C)
|
:00412BEA 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00412BED 81E1FFFF0000            and ecx, 0000FFFF
:00412BF3 81F9FFFF0000            cmp ecx, 0000FFFF
:00412BF9 7506                    jne 00412C01
:00412BFB 66C745F00000            mov [ebp-10], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412BF9(C)
|
:00412C01 8B55DC                  mov edx, dword ptr [ebp-24]
:00412C04 81E2FFFF0000            and edx, 0000FFFF
:00412C0A 81FAFFFF0000            cmp edx, 0000FFFF
:00412C10 7506                    jne 00412C18
:00412C12 66C745DC0100            mov [ebp-24], 0001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412C10(C)
|
:00412C18 8B45D0                  mov eax, dword ptr [ebp-30]
:00412C1B 25FFFF0000              and eax, 0000FFFF
:00412C20 3DFFFF0000              cmp eax, 0000FFFF
:00412C25 7506                    jne 00412C2D
:00412C27 66C745D00200            mov [ebp-30], 0002

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412C25(C)
|
:00412C2D 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00412C30 81E1FFFF0000            and ecx, 0000FFFF
:00412C36 81F9FFFF0000            cmp ecx, 0000FFFF
:00412C3C 7506                    jne 00412C44
:00412C3E 66C745D80000            mov [ebp-28], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412C3C(C)
|
:00412C44 8B55D8                  mov edx, dword ptr [ebp-28]
:00412C47 81E2FFFF0000            and edx, 0000FFFF
:00412C4D 83FA32                  cmp edx, 00000032
:00412C50 7F1D                    jg 00412C6F
:00412C52 6A3C                    push 0000003C
:00412C54 8A45D8                  mov al, byte ptr [ebp-28]
:00412C57 50                      push eax
:00412C58 8A4DF4                  mov cl, byte ptr [ebp-0C]
:00412C5B 51                      push ecx
:00412C5C E854CE0600              call 0047FAB5
:00412C61 83C40C                  add esp, 0000000C
:00412C64 6633D2                  xor dx, dx
:00412C67 8AD0                    mov dl, al
:00412C69 668955D8                mov word ptr [ebp-28], dx
:00412C6D EB4E                    jmp 00412CBD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412C50(C)
|
:00412C6F 668B45D8                mov ax, word ptr [ebp-28]
:00412C73 662D3200                sub ax, 0032
:00412C77 668945D8                mov word ptr [ebp-28], ax
:00412C7B 8A4DD8                  mov cl, byte ptr [ebp-28]
:00412C7E 51                      push ecx
:00412C7F 8A55F4                  mov dl, byte ptr [ebp-0C]
:00412C82 52                      push edx
:00412C83 E848CE0600              call 0047FAD0
:00412C88 83C408                  add esp, 00000008
:00412C8B 660FB6C0                movzx ax, al
:00412C8F 668945D8                mov word ptr [ebp-28], ax
:00412C93 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00412C96 81E1FFFF0000            and ecx, 0000FFFF
:00412C9C 85C9                    test ecx, ecx
:00412C9E 7509                    jne 00412CA9
:00412CA0 C745BC01000000          mov [ebp-44], 00000001
:00412CA7 EB0C                    jmp 00412CB5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412C9E(C)
|
:00412CA9 8B55D8                  mov edx, dword ptr [ebp-28]
:00412CAC 81E2FFFF0000            and edx, 0000FFFF
:00412CB2 8955BC                  mov dword ptr [ebp-44], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412CA7(U)
|
:00412CB5 668B45BC                mov ax, word ptr [ebp-44]
:00412CB9 668945D8                mov word ptr [ebp-28], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412C6D(U)
|
:00412CBD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00412CC0 51                      push ecx
:00412CC1 B9902F4900              mov ecx, 00492F90
:00412CC6 E805610000              call 00418DD0
:00412CCB 8945F8                  mov dword ptr [ebp-08], eax
:00412CCE 8B55E4                  mov edx, dword ptr [ebp-1C]
:00412CD1 81E2FFFF0000            and edx, 0000FFFF
:00412CD7 8B45F8                  mov eax, dword ptr [ebp-08]
:00412CDA 8910                    mov dword ptr [eax], edx
:00412CDC 8B75EC                  mov esi, dword ptr [ebp-14]
:00412CDF 81E6FFFF0000            and esi, 0000FFFF
:00412CE5 F7DE                    neg esi
:00412CE7 1BF6                    sbb esi, esi
:00412CE9 83E602                  and esi, 00000002
:00412CEC 83CE01                  or esi, 00000001
:00412CEF 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00412CF2 81E1FFFF0000            and ecx, 0000FFFF
:00412CF8 F7D9                    neg ecx
:00412CFA 1BC9                    sbb ecx, ecx
:00412CFC 83E104                  and ecx, 00000004
:00412CFF 0BF1                    or esi, ecx
:00412D01 8A55D4                  mov dl, byte ptr [ebp-2C]
:00412D04 52                      push edx
:00412D05 E81D6E0300              call 00449B27
:00412D0A 83C404                  add esp, 00000004
:00412D0D 0BF0                    or esi, eax
:00412D0F 8B45F8                  mov eax, dword ptr [ebp-08]
:00412D12 897008                  mov dword ptr [eax+08], esi
:00412D15 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00412D18 8A55CC                  mov dl, byte ptr [ebp-34]
:00412D1B 885104                  mov byte ptr [ecx+04], dl
:00412D1E 8B45F8                  mov eax, dword ptr [ebp-08]
:00412D21 8A4DC4                  mov cl, byte ptr [ebp-3C]
:00412D24 884805                  mov byte ptr [eax+05], cl
:00412D27 8B55F8                  mov edx, dword ptr [ebp-08]
:00412D2A 8A45D8                  mov al, byte ptr [ebp-28]
:00412D2D 884211                  mov byte ptr [edx+11], al
:00412D30 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00412D33 8A55D0                  mov dl, byte ptr [ebp-30]
:00412D36 885110                  mov byte ptr [ecx+10], dl
:00412D39 8B45F8                  mov eax, dword ptr [ebp-08]
:00412D3C 8A4DDC                  mov cl, byte ptr [ebp-24]
:00412D3F 88480C                  mov byte ptr [eax+0C], cl
:00412D42 8B55DC                  mov edx, dword ptr [ebp-24]
:00412D45 81E2FFFF0000            and edx, 0000FFFF
:00412D4B 8955B8                  mov dword ptr [ebp-48], edx
:00412D4E 837DB806                cmp dword ptr [ebp-48], 00000006
:00412D52 772B                    ja 00412D7F
:00412D54 8B45B8                  mov eax, dword ptr [ebp-48]
:00412D57 FF2485BA2D4100          jmp dword ptr [4*eax+00412DBA]
:00412D5E EB1F                    jmp 00412D7F
:00412D60 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00412D63 668B55E0                mov dx, word ptr [ebp-20]
:00412D67 6689510E                mov word ptr [ecx+0E], dx
:00412D6B EB12                    jmp 00412D7F
:00412D6D 8B45F8                  mov eax, dword ptr [ebp-08]
:00412D70 8A4DC8                  mov cl, byte ptr [ebp-38]
:00412D73 88480E                  mov byte ptr [eax+0E], cl
:00412D76 8B55F8                  mov edx, dword ptr [ebp-08]
:00412D79 8A45E8                  mov al, byte ptr [ebp-18]
:00412D7C 88420F                  mov byte ptr [edx+0F], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00412D52(C), :00412D5E(U), :00412D6B(U)
|
:00412D7F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00412D82 C7411400000000          mov [ecx+14], 00000000
:00412D89 8B55F8                  mov edx, dword ptr [ebp-08]
:00412D8C C7421800000000          mov [edx+18], 00000000
:00412D93 8B45F8                  mov eax, dword ptr [ebp-08]
:00412D96 C7401C00000000          mov [eax+1C], 00000000
:00412D9D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00412DA0 C6412001                mov [ecx+20], 01
:00412DA4 8B55F8                  mov edx, dword ptr [ebp-08]
:00412DA7 C6422101                mov [edx+21], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412BCF(C)
|
:00412DAB E93BFCFFFF              jmp 004129EB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004129F8(C)
|
:00412DB0 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00412A20(U), :00412A49(U), :00412A72(U), :00412A92(U), :00412AB2(U)
|:00412AD9(U), :00412B02(U), :00412B2B(U), :00412B52(U), :00412B7B(U)
|:00412B9B(U), :00412BBB(U)
|
:00412DB5 5E                      pop esi
:00412DB6 8BE5                    mov esp, ebp
:00412DB8 5D                      pop ebp
:00412DB9 C3                      ret



:00412DBA 5E2D4100                DWORD 00412D5E
:00412DBE 7F2D4100                DWORD 00412D7F
:00412DC2 7F2D4100                DWORD 00412D7F
:00412DC6 602D4100                DWORD 00412D60
:00412DCA 6D2D4100                DWORD 00412D6D
:00412DCE 602D4100                DWORD 00412D60
:00412DD2 6D2D4100                DWORD 00412D6D



* Referenced by a CALL at Address:
|:00410F03   
|
:00412DD6 55                      push ebp
:00412DD7 8BEC                    mov ebp, esp
:00412DD9 83EC20                  sub esp, 00000020
:00412DDC 6A02                    push 00000002
:00412DDE 8B4D08                  mov ecx, dword ptr [ebp+08]
:00412DE1 E811560000              call 004183F7
:00412DE6 668945F0                mov word ptr [ebp-10], ax
:00412DEA 8B45F0                  mov eax, dword ptr [ebp-10]
:00412DED 25FFFF0000              and eax, 0000FFFF
:00412DF2 3D00800000              cmp eax, 00008000
:00412DF7 750A                    jne 00412E03
:00412DF9 B805000000              mov eax, 00000005
:00412DFE E909020000              jmp 0041300C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412DF7(C)
|
:00412E03 6A3B                    push 0000003B
:00412E05 8B4D08                  mov ecx, dword ptr [ebp+08]
:00412E08 E8EA550000              call 004183F7
:00412E0D 668945F8                mov word ptr [ebp-08], ax
:00412E11 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00412E14 81E1FFFF0000            and ecx, 0000FFFF
:00412E1A 81F900800000            cmp ecx, 00008000
:00412E20 750A                    jne 00412E2C
:00412E22 B805000000              mov eax, 00000005
:00412E27 E9E0010000              jmp 0041300C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412E20(C)
|
:00412E2C 6A49                    push 00000049
:00412E2E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00412E31 E8C1550000              call 004183F7
:00412E36 668945FC                mov word ptr [ebp-04], ax
:00412E3A 8B55FC                  mov edx, dword ptr [ebp-04]
:00412E3D 81E2FFFF0000            and edx, 0000FFFF
:00412E43 81FA00800000            cmp edx, 00008000
:00412E49 750A                    jne 00412E55
:00412E4B B805000000              mov eax, 00000005
:00412E50 E9B7010000              jmp 0041300C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412E49(C)
|
:00412E55 6A3C                    push 0000003C
:00412E57 8B4D08                  mov ecx, dword ptr [ebp+08]
:00412E5A E898550000              call 004183F7
:00412E5F 668945F4                mov word ptr [ebp-0C], ax
:00412E63 8B45F4                  mov eax, dword ptr [ebp-0C]
:00412E66 25FFFF0000              and eax, 0000FFFF
:00412E6B 3D00800000              cmp eax, 00008000
:00412E70 750A                    jne 00412E7C
:00412E72 B805000000              mov eax, 00000005
:00412E77 E990010000              jmp 0041300C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412E70(C)
|
:00412E7C 6A49                    push 00000049
:00412E7E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00412E81 E871550000              call 004183F7
:00412E86 668945E4                mov word ptr [ebp-1C], ax
:00412E8A 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00412E8D 81E1FFFF0000            and ecx, 0000FFFF
:00412E93 81F900800000            cmp ecx, 00008000
:00412E99 750A                    jne 00412EA5
:00412E9B B805000000              mov eax, 00000005
:00412EA0 E967010000              jmp 0041300C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412E99(C)
|
:00412EA5 6A3D                    push 0000003D
:00412EA7 8B4D08                  mov ecx, dword ptr [ebp+08]
:00412EAA E848550000              call 004183F7
:00412EAF 668945E0                mov word ptr [ebp-20], ax
:00412EB3 8B55E0                  mov edx, dword ptr [ebp-20]
:00412EB6 81E2FFFF0000            and edx, 0000FFFF
:00412EBC 81FA00800000            cmp edx, 00008000
:00412EC2 750A                    jne 00412ECE
:00412EC4 B805000000              mov eax, 00000005
:00412EC9 E93E010000              jmp 0041300C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412EC2(C)
|
:00412ECE 8B45F0                  mov eax, dword ptr [ebp-10]
:00412ED1 25FFFF0000              and eax, 0000FFFF
:00412ED6 3DFFFF0000              cmp eax, 0000FFFF
:00412EDB 7411                    je 00412EEE
:00412EDD 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00412EE0 81E1FFFF0000            and ecx, 0000FFFF
:00412EE6 81F900020000            cmp ecx, 00000200
:00412EEC 7C07                    jl 00412EF5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412EDB(C)
|
:00412EEE 33C0                    xor eax, eax
:00412EF0 E917010000              jmp 0041300C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412EEC(C)
|
:00412EF5 8B55F8                  mov edx, dword ptr [ebp-08]
:00412EF8 81E2FFFF0000            and edx, 0000FFFF
:00412EFE 81FAFFFF0000            cmp edx, 0000FFFF
:00412F04 7506                    jne 00412F0C
:00412F06 66C745F80000            mov [ebp-08], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412F04(C)
|
:00412F0C 8B45F4                  mov eax, dword ptr [ebp-0C]
:00412F0F 25FFFF0000              and eax, 0000FFFF
:00412F14 3DFFFF0000              cmp eax, 0000FFFF
:00412F19 7506                    jne 00412F21
:00412F1B 66C745F40000            mov [ebp-0C], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412F19(C)
|
:00412F21 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00412F24 81E1FFFF0000            and ecx, 0000FFFF
:00412F2A 81F9FFFF0000            cmp ecx, 0000FFFF
:00412F30 7506                    jne 00412F38
:00412F32 66C745E00000            mov [ebp-20], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412F30(C)
|
:00412F38 8B55FC                  mov edx, dword ptr [ebp-04]
:00412F3B 81E2FFFF0000            and edx, 0000FFFF
:00412F41 81FAFFFF0000            cmp edx, 0000FFFF
:00412F47 7506                    jne 00412F4F
:00412F49 66C745FC0000            mov [ebp-04], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412F47(C)
|
:00412F4F 8B45E4                  mov eax, dword ptr [ebp-1C]
:00412F52 25FFFF0000              and eax, 0000FFFF
:00412F57 3DFFFF0000              cmp eax, 0000FFFF
:00412F5C 7506                    jne 00412F64
:00412F5E 66C745E40000            mov [ebp-1C], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412F5C(C)
|
:00412F64 C645E80F                mov [ebp-18], 0F
:00412F68 EB09                    jmp 00412F73

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412F9F(U)
|
:00412F6A 8A4DE8                  mov cl, byte ptr [ebp-18]
:00412F6D 80C101                  add cl, 01
:00412F70 884DE8                  mov byte ptr [ebp-18], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412F68(U)
|
:00412F73 8B55E8                  mov edx, dword ptr [ebp-18]
:00412F76 81E2FF000000            and edx, 000000FF
:00412F7C 83FA73                  cmp edx, 00000073
:00412F7F 7D20                    jge 00412FA1
:00412F81 8B45E8                  mov eax, dword ptr [ebp-18]
:00412F84 25FF000000              and eax, 000000FF
:00412F89 C1E006                  shl eax, 06
:00412F8C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00412F8F 81E1FFFF0000            and ecx, 0000FFFF
:00412F95 3988D44F4900            cmp dword ptr [eax+00494FD4], ecx
:00412F9B 7502                    jne 00412F9F
:00412F9D EB02                    jmp 00412FA1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412F9B(C)
|
:00412F9F EBC9                    jmp 00412F6A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00412F7F(C), :00412F9D(U)
|
:00412FA1 8B55E8                  mov edx, dword ptr [ebp-18]
:00412FA4 81E2FF000000            and edx, 000000FF
:00412FAA 83FA73                  cmp edx, 00000073
:00412FAD 7C04                    jl 00412FB3
:00412FAF 33C0                    xor eax, eax
:00412FB1 EB59                    jmp 0041300C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00412FAD(C)
|
:00412FB3 8B45E8                  mov eax, dword ptr [ebp-18]
:00412FB6 25FF000000              and eax, 000000FF
:00412FBB 50                      push eax
:00412FBC B9902F4900              mov ecx, 00492F90
:00412FC1 E80A5E0000              call 00418DD0
:00412FC6 8945EC                  mov dword ptr [ebp-14], eax
:00412FC9 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00412FCC 81E1FF000000            and ecx, 000000FF
:00412FD2 8B55EC                  mov edx, dword ptr [ebp-14]
:00412FD5 894A14                  mov dword ptr [edx+14], ecx
:00412FD8 8B45F4                  mov eax, dword ptr [ebp-0C]
:00412FDB 25FF000000              and eax, 000000FF
:00412FE0 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00412FE3 894118                  mov dword ptr [ecx+18], eax
:00412FE6 8B55E0                  mov edx, dword ptr [ebp-20]
:00412FE9 81E2FF000000            and edx, 000000FF
:00412FEF 8B45EC                  mov eax, dword ptr [ebp-14]
:00412FF2 89501C                  mov dword ptr [eax+1C], edx
:00412FF5 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00412FF8 8A55FC                  mov dl, byte ptr [ebp-04]
:00412FFB 885120                  mov byte ptr [ecx+20], dl
:00412FFE 8B45EC                  mov eax, dword ptr [ebp-14]
:00413001 8A4DE4                  mov cl, byte ptr [ebp-1C]
:00413004 884821                  mov byte ptr [eax+21], cl
:00413007 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00412DFE(U), :00412E27(U), :00412E50(U), :00412E77(U), :00412EA0(U)
|:00412EC9(U), :00412EF0(U), :00412FB1(U)
|
:0041300C 8BE5                    mov esp, ebp
:0041300E 5D                      pop ebp
:0041300F C3                      ret



* Referenced by a CALL at Address:
|:00410D6B   
|
:00413010 55                      push ebp
:00413011 8BEC                    mov ebp, esp
:00413013 83EC14                  sub esp, 00000014
:00413016 6A02                    push 00000002
:00413018 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041301B E8D7530000              call 004183F7
:00413020 668945FC                mov word ptr [ebp-04], ax
:00413024 8B45FC                  mov eax, dword ptr [ebp-04]
:00413027 25FFFF0000              and eax, 0000FFFF
:0041302C 3D00800000              cmp eax, 00008000
:00413031 750A                    jne 0041303D
:00413033 B805000000              mov eax, 00000005
:00413038 E9DB000000              jmp 00413118

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413031(C)
|
:0041303D 6A04                    push 00000004
:0041303F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00413042 E8B0530000              call 004183F7
:00413047 8945F0                  mov dword ptr [ebp-10], eax
:0041304A 817DF000000080          cmp dword ptr [ebp-10], 80000000
:00413051 750A                    jne 0041305D
:00413053 B805000000              mov eax, 00000005
:00413058 E9BB000000              jmp 00413118

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413051(C)
|
:0041305D 6A04                    push 00000004
:0041305F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00413062 E890530000              call 004183F7
:00413067 8945EC                  mov dword ptr [ebp-14], eax
:0041306A 817DEC00000080          cmp dword ptr [ebp-14], 80000000
:00413071 750A                    jne 0041307D
:00413073 B805000000              mov eax, 00000005
:00413078 E99B000000              jmp 00413118

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413071(C)
|
:0041307D 6A2B                    push 0000002B
:0041307F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00413082 E870530000              call 004183F7
:00413087 668945F8                mov word ptr [ebp-08], ax
:0041308B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041308E 81E1FFFF0000            and ecx, 0000FFFF
:00413094 81F900800000            cmp ecx, 00008000
:0041309A 7507                    jne 004130A3
:0041309C B805000000              mov eax, 00000005
:004130A1 EB75                    jmp 00413118

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041309A(C)
|
:004130A3 6A0D                    push 0000000D
:004130A5 8B4D08                  mov ecx, dword ptr [ebp+08]
:004130A8 E84A530000              call 004183F7
:004130AD 668945F4                mov word ptr [ebp-0C], ax
:004130B1 8B55F4                  mov edx, dword ptr [ebp-0C]
:004130B4 81E2FFFF0000            and edx, 0000FFFF
:004130BA 81FA00800000            cmp edx, 00008000
:004130C0 7507                    jne 004130C9
:004130C2 B805000000              mov eax, 00000005
:004130C7 EB4F                    jmp 00413118

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004130C0(C)
|
:004130C9 E85488FFFF              call 0040B922
:004130CE 85C0                    test eax, eax
:004130D0 7525                    jne 004130F7
:004130D2 668B45F4                mov ax, word ptr [ebp-0C]
:004130D6 50                      push eax
:004130D7 668B4DF8                mov cx, word ptr [ebp-08]
:004130DB 51                      push ecx
:004130DC 6A00                    push 00000000
:004130DE 668B55EC                mov dx, word ptr [ebp-14]
:004130E2 52                      push edx
:004130E3 668B45F0                mov ax, word ptr [ebp-10]
:004130E7 50                      push eax
:004130E8 668B4DFC                mov cx, word ptr [ebp-04]
:004130EC 51                      push ecx
:004130ED E8AB5F0100              call 0042909D
:004130F2 83C418                  add esp, 00000018
:004130F5 EB1C                    jmp 00413113

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004130D0(C)
|
:004130F7 8A55EC                  mov dl, byte ptr [ebp-14]
:004130FA 52                      push edx
:004130FB 8A45F0                  mov al, byte ptr [ebp-10]
:004130FE 50                      push eax
:004130FF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00413102 81E1FFFF0000            and ecx, 0000FFFF
:00413108 51                      push ecx
:00413109 B9F05D4B00              mov ecx, 004B5DF0
:0041310E E8DB3F0400              call 004570EE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004130F5(U)
|
:00413113 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00413038(U), :00413058(U), :00413078(U), :004130A1(U), :004130C7(U)
|
:00413118 8BE5                    mov esp, ebp
:0041311A 5D                      pop ebp
:0041311B C3                      ret



* Referenced by a CALL at Address:
|:00410D7C   
|
:0041311C 55                      push ebp
:0041311D 8BEC                    mov ebp, esp
:0041311F 83EC1C                  sub esp, 0000001C
:00413122 6A2C                    push 0000002C
:00413124 8B4D08                  mov ecx, dword ptr [ebp+08]
:00413127 E8CB520000              call 004183F7
:0041312C 668945F0                mov word ptr [ebp-10], ax
:00413130 8B45F0                  mov eax, dword ptr [ebp-10]
:00413133 25FFFF0000              and eax, 0000FFFF
:00413138 3D00800000              cmp eax, 00008000
:0041313D 750A                    jne 00413149
:0041313F B805000000              mov eax, 00000005
:00413144 E987010000              jmp 004132D0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041313D(C)
|
:00413149 6A02                    push 00000002
:0041314B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041314E E8A4520000              call 004183F7
:00413153 668945FC                mov word ptr [ebp-04], ax
:00413157 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041315A 81E1FFFF0000            and ecx, 0000FFFF
:00413160 81F900800000            cmp ecx, 00008000
:00413166 750A                    jne 00413172
:00413168 B805000000              mov eax, 00000005
:0041316D E95E010000              jmp 004132D0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413166(C)
|
:00413172 6A04                    push 00000004
:00413174 8B4D08                  mov ecx, dword ptr [ebp+08]
:00413177 E87B520000              call 004183F7
:0041317C 8945EC                  mov dword ptr [ebp-14], eax
:0041317F 817DEC00000080          cmp dword ptr [ebp-14], 80000000
:00413186 750A                    jne 00413192
:00413188 B805000000              mov eax, 00000005
:0041318D E93E010000              jmp 004132D0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413186(C)
|
:00413192 6A04                    push 00000004
:00413194 8B4D08                  mov ecx, dword ptr [ebp+08]
:00413197 E85B520000              call 004183F7
:0041319C 8945E4                  mov dword ptr [ebp-1C], eax
:0041319F 817DE400000080          cmp dword ptr [ebp-1C], 80000000
:004131A6 750A                    jne 004131B2
:004131A8 B805000000              mov eax, 00000005
:004131AD E91E010000              jmp 004132D0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004131A6(C)
|
:004131B2 6A04                    push 00000004
:004131B4 8B4D08                  mov ecx, dword ptr [ebp+08]
:004131B7 E83B520000              call 004183F7
:004131BC 8945F8                  mov dword ptr [ebp-08], eax
:004131BF 817DF800000080          cmp dword ptr [ebp-08], 80000000
:004131C6 750A                    jne 004131D2
:004131C8 B805000000              mov eax, 00000005
:004131CD E9FE000000              jmp 004132D0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004131C6(C)
|
:004131D2 6A04                    push 00000004
:004131D4 8B4D08                  mov ecx, dword ptr [ebp+08]
:004131D7 E81B520000              call 004183F7
:004131DC 8945F4                  mov dword ptr [ebp-0C], eax
:004131DF 817DF400000080          cmp dword ptr [ebp-0C], 80000000
:004131E6 750A                    jne 004131F2
:004131E8 B805000000              mov eax, 00000005
:004131ED E9DE000000              jmp 004132D0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004131E6(C)
|
:004131F2 6A03                    push 00000003
:004131F4 8B4D08                  mov ecx, dword ptr [ebp+08]
:004131F7 E8FB510000              call 004183F7
:004131FC 668945E8                mov word ptr [ebp-18], ax
:00413200 8B55E8                  mov edx, dword ptr [ebp-18]
:00413203 81E2FFFF0000            and edx, 0000FFFF
:00413209 81FA00800000            cmp edx, 00008000
:0041320F 750A                    jne 0041321B
:00413211 B805000000              mov eax, 00000005
:00413216 E9B5000000              jmp 004132D0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041320F(C)
|
:0041321B E80287FFFF              call 0040B922
:00413220 85C0                    test eax, eax
:00413222 7519                    jne 0041323D
:00413224 8B45FC                  mov eax, dword ptr [ebp-04]
:00413227 25FFFF0000              and eax, 0000FFFF
:0041322C 80CC10                  or ah, 10
:0041322F 50                      push eax
:00413230 E8ED580100              call 00428B22
:00413235 83C404                  add esp, 00000004
:00413238 E98E000000              jmp 004132CB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413222(C)
|
:0041323D 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00413240 81E1FFFF0000            and ecx, 0000FFFF
:00413246 85C9                    test ecx, ecx
:00413248 7548                    jne 00413292
:0041324A 8B55FC                  mov edx, dword ptr [ebp-04]
:0041324D 81E2FFFF0000            and edx, 0000FFFF
:00413253 81FA00040000            cmp edx, 00000400
:00413259 7C1D                    jl 00413278
:0041325B 8B45FC                  mov eax, dword ptr [ebp-04]
:0041325E 25FFFF0000              and eax, 0000FFFF
:00413263 3D02040000              cmp eax, 00000402
:00413268 7F0E                    jg 00413278
:0041326A B9F05D4B00              mov ecx, 004B5DF0
:0041326F E8B72D0400              call 0045602B
:00413274 668945FC                mov word ptr [ebp-04], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00413259(C), :00413268(C)
|
:00413278 6A00                    push 00000000
:0041327A 6A01                    push 00000001
:0041327C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041327F 81E1FFFF0000            and ecx, 0000FFFF
:00413285 51                      push ecx
:00413286 B9F05D4B00              mov ecx, 004B5DF0
:0041328B E827750400              call 0045A7B7
:00413290 EB39                    jmp 004132CB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413248(C)
|
:00413292 8B55E8                  mov edx, dword ptr [ebp-18]
:00413295 81E2FFFF0000            and edx, 0000FFFF
:0041329B 81FAFFFF0000            cmp edx, 0000FFFF
:004132A1 7506                    jne 004132A9
:004132A3 66C745E80600            mov [ebp-18], 0006

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004132A1(C)
|
:004132A9 6A00                    push 00000000
:004132AB 6A01                    push 00000001
:004132AD 8A45E8                  mov al, byte ptr [ebp-18]
:004132B0 50                      push eax
:004132B1 8A4DF4                  mov cl, byte ptr [ebp-0C]
:004132B4 51                      push ecx
:004132B5 8A55F8                  mov dl, byte ptr [ebp-08]
:004132B8 52                      push edx
:004132B9 8A45E4                  mov al, byte ptr [ebp-1C]
:004132BC 50                      push eax
:004132BD 8A4DEC                  mov cl, byte ptr [ebp-14]
:004132C0 51                      push ecx
:004132C1 B9F05D4B00              mov ecx, 004B5DF0
:004132C6 E844750400              call 0045A80F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00413238(U), :00413290(U)
|
:004132CB B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00413144(U), :0041316D(U), :0041318D(U), :004131AD(U), :004131CD(U)
|:004131ED(U), :00413216(U)
|
:004132D0 8BE5                    mov esp, ebp
:004132D2 5D                      pop ebp
:004132D3 C3                      ret



* Referenced by a CALL at Address:
|:00410D8D   
|
:004132D4 55                      push ebp
:004132D5 8BEC                    mov ebp, esp
:004132D7 83EC24                  sub esp, 00000024
:004132DA 6A40                    push 00000040
:004132DC 8B4D08                  mov ecx, dword ptr [ebp+08]
:004132DF E813510000              call 004183F7
:004132E4 668945F0                mov word ptr [ebp-10], ax
:004132E8 8B45F0                  mov eax, dword ptr [ebp-10]
:004132EB 25FFFF0000              and eax, 0000FFFF
:004132F0 3D00800000              cmp eax, 00008000
:004132F5 750A                    jne 00413301
:004132F7 B805000000              mov eax, 00000005
:004132FC E9C4010000              jmp 004134C5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004132F5(C)
|
:00413301 6A02                    push 00000002
:00413303 8B4D08                  mov ecx, dword ptr [ebp+08]
:00413306 E8EC500000              call 004183F7
:0041330B 668945FC                mov word ptr [ebp-04], ax
:0041330F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00413312 81E1FFFF0000            and ecx, 0000FFFF
:00413318 81F900800000            cmp ecx, 00008000
:0041331E 750A                    jne 0041332A
:00413320 B805000000              mov eax, 00000005
:00413325 E99B010000              jmp 004134C5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041331E(C)
|
:0041332A 6A04                    push 00000004
:0041332C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041332F E8C3500000              call 004183F7
:00413334 8945F8                  mov dword ptr [ebp-08], eax
:00413337 817DF800000080          cmp dword ptr [ebp-08], 80000000
:0041333E 750A                    jne 0041334A
:00413340 B805000000              mov eax, 00000005
:00413345 E97B010000              jmp 004134C5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041333E(C)
|
:0041334A 6A04                    push 00000004
:0041334C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041334F E8A3500000              call 004183F7
:00413354 8945EC                  mov dword ptr [ebp-14], eax
:00413357 817DEC00000080          cmp dword ptr [ebp-14], 80000000
:0041335E 750A                    jne 0041336A
:00413360 B805000000              mov eax, 00000005
:00413365 E95B010000              jmp 004134C5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041335E(C)
|
:0041336A 6A04                    push 00000004
:0041336C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041336F E883500000              call 004183F7
:00413374 8945E8                  mov dword ptr [ebp-18], eax
:00413377 817DE800000080          cmp dword ptr [ebp-18], 80000000
:0041337E 750A                    jne 0041338A
:00413380 B805000000              mov eax, 00000005
:00413385 E93B010000              jmp 004134C5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041337E(C)
|
:0041338A 6A2B                    push 0000002B
:0041338C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041338F E863500000              call 004183F7
:00413394 668945F4                mov word ptr [ebp-0C], ax
:00413398 8B55F4                  mov edx, dword ptr [ebp-0C]
:0041339B 81E2FFFF0000            and edx, 0000FFFF
:004133A1 81FA00800000            cmp edx, 00008000
:004133A7 750A                    jne 004133B3
:004133A9 B805000000              mov eax, 00000005
:004133AE E912010000              jmp 004134C5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004133A7(C)
|
:004133B3 8B45F0                  mov eax, dword ptr [ebp-10]
:004133B6 25FFFF0000              and eax, 0000FFFF
:004133BB 3DFFFF0000              cmp eax, 0000FFFF
:004133C0 7506                    jne 004133C8
:004133C2 66C745F00000            mov [ebp-10], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004133C0(C)
|
:004133C8 E85585FFFF              call 0040B922
:004133CD 85C0                    test eax, eax
:004133CF 0F84A3000000            je 00413478
:004133D5 C745E4FFFF0000          mov [ebp-1C], 0000FFFF
:004133DC 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004133DF 81E1FFFF0000            and ecx, 0000FFFF
:004133E5 83F901                  cmp ecx, 00000001
:004133E8 7542                    jne 0041342C
:004133EA 837DF80F                cmp dword ptr [ebp-08], 0000000F
:004133EE 733C                    jnb 0041342C
:004133F0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004133F3 6BC924                  imul ecx, 00000024
:004133F6 81C1502C4B00            add ecx, 004B2C50
:004133FC E88F580000              call 00418C90
:00413401 25FF000000              and eax, 000000FF
:00413406 83F802                  cmp eax, 00000002
:00413409 751F                    jne 0041342A
:0041340B 8B55F8                  mov edx, dword ptr [ebp-08]
:0041340E 52                      push edx
:0041340F B9902F4900              mov ecx, 00492F90
:00413414 E8B7590000              call 00418DD0
:00413419 8945DC                  mov dword ptr [ebp-24], eax
:0041341C 8B45DC                  mov eax, dword ptr [ebp-24]
:0041341F 8945E0                  mov dword ptr [ebp-20], eax
:00413422 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00413425 8B11                    mov edx, dword ptr [ecx]
:00413427 8955E4                  mov dword ptr [ebp-1C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413409(C)
|
:0041342A EB18                    jmp 00413444

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004133E8(C), :004133EE(C)
|
:0041342C 8B45F0                  mov eax, dword ptr [ebp-10]
:0041342F 25FFFF0000              and eax, 0000FFFF
:00413434 85C0                    test eax, eax
:00413436 750C                    jne 00413444
:00413438 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041343B 81E1FFFF0000            and ecx, 0000FFFF
:00413441 894DE4                  mov dword ptr [ebp-1C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041342A(U), :00413436(C)
|
:00413444 817DE4FFFF0000          cmp dword ptr [ebp-1C], 0000FFFF
:0041344B 7427                    je 00413474
:0041344D 8B55F4                  mov edx, dword ptr [ebp-0C]
:00413450 81E2FFFF0000            and edx, 0000FFFF
:00413456 52                      push edx
:00413457 8A45E8                  mov al, byte ptr [ebp-18]
:0041345A 50                      push eax
:0041345B 8A4DEC                  mov cl, byte ptr [ebp-14]
:0041345E 51                      push ecx
:0041345F 8B55E4                  mov edx, dword ptr [ebp-1C]
:00413462 52                      push edx
:00413463 B9F05D4B00              mov ecx, 004B5DF0
:00413468 E81A600400              call 00459487
:0041346D B801000000              mov eax, 00000001
:00413472 EB51                    jmp 004134C5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041344B(C)
|
:00413474 33C0                    xor eax, eax
:00413476 EB4D                    jmp 004134C5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004133CF(C)
|
:00413478 668B45F4                mov ax, word ptr [ebp-0C]
:0041347C 50                      push eax
:0041347D 668B4DE8                mov cx, word ptr [ebp-18]
:00413481 51                      push ecx
:00413482 668B55EC                mov dx, word ptr [ebp-14]
:00413486 52                      push edx
:00413487 8B45FC                  mov eax, dword ptr [ebp-04]
:0041348A 25FFFF0000              and eax, 0000FFFF
:0041348F 80CC10                  or ah, 10
:00413492 50                      push eax
:00413493 E8C15C0100              call 00429159
:00413498 83C410                  add esp, 00000010
:0041349B B9902F4900              mov ecx, 00492F90
:004134A0 E85B570000              call 00418C00
:004134A5 25FFFF0000              and eax, 0000FFFF
:004134AA 83F832                  cmp eax, 00000032
:004134AD 7511                    jne 004134C0
:004134AF 6A00                    push 00000000
:004134B1 E8A2930100              call 0042C858
:004134B6 83C404                  add esp, 00000004
:004134B9 B801000000              mov eax, 00000001
:004134BE EB05                    jmp 004134C5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004134AD(C)
|
:004134C0 B802000000              mov eax, 00000002

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004132FC(U), :00413325(U), :00413345(U), :00413365(U), :00413385(U)
|:004133AE(U), :00413472(U), :00413476(U), :004134BE(U)
|
:004134C5 8BE5                    mov esp, ebp
:004134C7 5D                      pop ebp
:004134C8 C3                      ret



* Referenced by a CALL at Address:
|:00410D9E   
|
:004134C9 55                      push ebp
:004134CA 8BEC                    mov ebp, esp
:004134CC 83EC0C                  sub esp, 0000000C
:004134CF 6A02                    push 00000002
:004134D1 8B4D08                  mov ecx, dword ptr [ebp+08]
:004134D4 E81E4F0000              call 004183F7
:004134D9 668945FC                mov word ptr [ebp-04], ax
:004134DD 8B45FC                  mov eax, dword ptr [ebp-04]
:004134E0 25FFFF0000              and eax, 0000FFFF
:004134E5 3D00800000              cmp eax, 00008000
:004134EA 7507                    jne 004134F3
:004134EC B805000000              mov eax, 00000005
:004134F1 EB70                    jmp 00413563

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004134EA(C)
|
:004134F3 6A0D                    push 0000000D
:004134F5 8B4D08                  mov ecx, dword ptr [ebp+08]
:004134F8 E8FA4E0000              call 004183F7
:004134FD 668945F4                mov word ptr [ebp-0C], ax
:00413501 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00413504 81E1FFFF0000            and ecx, 0000FFFF
:0041350A 81F900800000            cmp ecx, 00008000
:00413510 7507                    jne 00413519
:00413512 B805000000              mov eax, 00000005
:00413517 EB4A                    jmp 00413563

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413510(C)
|
:00413519 6A2B                    push 0000002B
:0041351B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041351E E8D44E0000              call 004183F7
:00413523 668945F8                mov word ptr [ebp-08], ax
:00413527 8B55F8                  mov edx, dword ptr [ebp-08]
:0041352A 81E2FFFF0000            and edx, 0000FFFF
:00413530 81FA00800000            cmp edx, 00008000
:00413536 7507                    jne 0041353F
:00413538 B805000000              mov eax, 00000005
:0041353D EB24                    jmp 00413563

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413536(C)
|
:0041353F 668B45F8                mov ax, word ptr [ebp-08]
:00413543 50                      push eax
:00413544 668B4DF4                mov cx, word ptr [ebp-0C]
:00413548 51                      push ecx
:00413549 8B55FC                  mov edx, dword ptr [ebp-04]
:0041354C 81E2FFFF0000            and edx, 0000FFFF
:00413552 80CE10                  or dh, 10
:00413555 52                      push edx
:00413556 E82C560100              call 00428B87
:0041355B 83C40C                  add esp, 0000000C
:0041355E B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004134F1(U), :00413517(U), :0041353D(U)
|
:00413563 8BE5                    mov esp, ebp
:00413565 5D                      pop ebp
:00413566 C3                      ret



* Referenced by a CALL at Address:
|:00410DAF   
|
:00413567 55                      push ebp
:00413568 8BEC                    mov ebp, esp
:0041356A 83EC08                  sub esp, 00000008
:0041356D 6A02                    push 00000002
:0041356F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00413572 E8804E0000              call 004183F7
:00413577 668945FC                mov word ptr [ebp-04], ax
:0041357B 8B45FC                  mov eax, dword ptr [ebp-04]
:0041357E 25FFFF0000              and eax, 0000FFFF
:00413583 3D00800000              cmp eax, 00008000
:00413588 7507                    jne 00413591
:0041358A B805000000              mov eax, 00000005
:0041358F EB49                    jmp 004135DA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413588(C)
|
:00413591 6A0D                    push 0000000D
:00413593 8B4D08                  mov ecx, dword ptr [ebp+08]
:00413596 E85C4E0000              call 004183F7
:0041359B 668945F8                mov word ptr [ebp-08], ax
:0041359F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004135A2 81E1FFFF0000            and ecx, 0000FFFF
:004135A8 81F900800000            cmp ecx, 00008000
:004135AE 7507                    jne 004135B7
:004135B0 B805000000              mov eax, 00000005
:004135B5 EB23                    jmp 004135DA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004135AE(C)
|
:004135B7 68FFFF0000              push 0000FFFF
:004135BC 668B55F8                mov dx, word ptr [ebp-08]
:004135C0 52                      push edx
:004135C1 8B45FC                  mov eax, dword ptr [ebp-04]
:004135C4 25FFFF0000              and eax, 0000FFFF
:004135C9 80CC10                  or ah, 10
:004135CC 50                      push eax
:004135CD E8B5550100              call 00428B87
:004135D2 83C40C                  add esp, 0000000C
:004135D5 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041358F(U), :004135B5(U)
|
:004135DA 8BE5                    mov esp, ebp
:004135DC 5D                      pop ebp
:004135DD C3                      ret



* Referenced by a CALL at Address:
|:00410DC0   
|
:004135DE 55                      push ebp
:004135DF 8BEC                    mov ebp, esp
:004135E1 83EC08                  sub esp, 00000008
:004135E4 6A02                    push 00000002
:004135E6 8B4D08                  mov ecx, dword ptr [ebp+08]
:004135E9 E8094E0000              call 004183F7
:004135EE 668945FC                mov word ptr [ebp-04], ax
:004135F2 8B45FC                  mov eax, dword ptr [ebp-04]
:004135F5 25FFFF0000              and eax, 0000FFFF
:004135FA 3D00800000              cmp eax, 00008000
:004135FF 7507                    jne 00413608
:00413601 B805000000              mov eax, 00000005
:00413606 EB46                    jmp 0041364E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004135FF(C)
|
:00413608 6A13                    push 00000013
:0041360A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041360D E8E54D0000              call 004183F7
:00413612 668945F8                mov word ptr [ebp-08], ax
:00413616 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00413619 81E1FFFF0000            and ecx, 0000FFFF
:0041361F 81F900800000            cmp ecx, 00008000
:00413625 7507                    jne 0041362E
:00413627 B805000000              mov eax, 00000005
:0041362C EB20                    jmp 0041364E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413625(C)
|
:0041362E 8A55F8                  mov dl, byte ptr [ebp-08]
:00413631 52                      push edx
:00413632 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00413635 81E1FFFF0000            and ecx, 0000FFFF
:0041363B 6BC948                  imul ecx, 00000048
:0041363E 81C1681B4A00            add ecx, 004A1B68
:00413644 E807560000              call 00418C50
:00413649 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00413606(U), :0041362C(U)
|
:0041364E 8BE5                    mov esp, ebp
:00413650 5D                      pop ebp
:00413651 C3                      ret



* Referenced by a CALL at Address:
|:00410D5A   
|
:00413652 55                      push ebp
:00413653 8BEC                    mov ebp, esp
:00413655 E87B350100              call 00426BD5
:0041365A B801000000              mov eax, 00000001
:0041365F 5D                      pop ebp
:00413660 C3                      ret



* Referenced by a CALL at Address:
|:00410B5C   
|
:00413661 55                      push ebp
:00413662 8BEC                    mov ebp, esp
:00413664 81EC20040000            sub esp, 00000420
:0041366A 66C785ECFBFFFFFFFF      mov word ptr [ebp+FFFFFBEC], FFFF
:00413673 6A05                    push 00000005
:00413675 8B4D08                  mov ecx, dword ptr [ebp+08]
:00413678 E87A4D0000              call 004183F7
:0041367D 8945F8                  mov dword ptr [ebp-08], eax
:00413680 817DF800000080          cmp dword ptr [ebp-08], 80000000
:00413687 750A                    jne 00413693
:00413689 B805000000              mov eax, 00000005
:0041368E E97A020000              jmp 0041390D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413687(C)
|
:00413693 8B45F8                  mov eax, dword ptr [ebp-08]
:00413696 8945FC                  mov dword ptr [ebp-04], eax
:00413699 C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413902(C)
|
:004136A0 C745F400000000          mov [ebp-0C], 00000000
:004136A7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004136AA 33D2                    xor edx, edx
:004136AC 8A11                    mov dl, byte ptr [ecx]
:004136AE 83FA26                  cmp edx, 00000026
:004136B1 0F859A010000            jne 00413851
:004136B7 8B45FC                  mov eax, dword ptr [ebp-04]
:004136BA 83C001                  add eax, 00000001
:004136BD 8945FC                  mov dword ptr [ebp-04], eax
:004136C0 E85D82FFFF              call 0040B922
:004136C5 85C0                    test eax, eax
:004136C7 742B                    je 004136F4
:004136C9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004136CC 33D2                    xor edx, edx
:004136CE 8A11                    mov dl, byte ptr [ecx]
:004136D0 83FA0A                  cmp edx, 0000000A
:004136D3 751F                    jne 004136F4
:004136D5 B9F05D4B00              mov ecx, 004B5DF0
:004136DA E84C290400              call 0045602B
:004136DF 668985ECFBFFFF          mov word ptr [ebp+FFFFFBEC], ax
:004136E6 8B45FC                  mov eax, dword ptr [ebp-04]
:004136E9 83C001                  add eax, 00000001
:004136EC 8945FC                  mov dword ptr [ebp-04], eax
:004136EF E95D010000              jmp 00413851

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004136C7(C), :004136D3(C)
|
:004136F4 E82982FFFF              call 0040B922
:004136F9 85C0                    test eax, eax
:004136FB 0F84EC000000            je 004137ED
:00413701 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00413704 33D2                    xor edx, edx
:00413706 8A11                    mov dl, byte ptr [ecx]
:00413708 83FA30                  cmp edx, 00000030
:0041370B 0F8CDC000000            jl 004137ED
:00413711 8B45FC                  mov eax, dword ptr [ebp-04]
:00413714 33C9                    xor ecx, ecx
:00413716 8A08                    mov cl, byte ptr [eax]
:00413718 83F939                  cmp ecx, 00000039
:0041371B 0F8FCC000000            jg 004137ED
:00413721 C785E8FBFFFF00000000    mov dword ptr [ebp+FFFFFBE8], 00000000
:0041372B EB0F                    jmp 0041373C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041377A(U)
|
:0041372D 8B95E8FBFFFF            mov edx, dword ptr [ebp+FFFFFBE8]
:00413733 83C201                  add edx, 00000001
:00413736 8995E8FBFFFF            mov dword ptr [ebp+FFFFFBE8], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041372B(U)
|
:0041373C 83BDE8FBFFFF02          cmp dword ptr [ebp+FFFFFBE8], 00000002
:00413743 7337                    jnb 0041377C
:00413745 8B45FC                  mov eax, dword ptr [ebp-04]
:00413748 33C9                    xor ecx, ecx
:0041374A 8A08                    mov cl, byte ptr [eax]
:0041374C 83F90A                  cmp ecx, 0000000A
:0041374F 742B                    je 0041377C
:00413751 8B95E8FBFFFF            mov edx, dword ptr [ebp+FFFFFBE8]
:00413757 8B45FC                  mov eax, dword ptr [ebp-04]
:0041375A 8A08                    mov cl, byte ptr [eax]
:0041375C 888C15E0FBFFFF          mov byte ptr [ebp+edx-00000420], cl
:00413763 8B95E8FBFFFF            mov edx, dword ptr [ebp+FFFFFBE8]
:00413769 C68415E1FBFFFF00        mov byte ptr [ebp+edx-0000041F], 00
:00413771 8B45FC                  mov eax, dword ptr [ebp-04]
:00413774 83C001                  add eax, 00000001
:00413777 8945FC                  mov dword ptr [ebp-04], eax
:0041377A EBB1                    jmp 0041372D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00413743(C), :0041374F(C)
|
:0041377C 8D8DE0FBFFFF            lea ecx, dword ptr [ebp+FFFFFBE0]
:00413782 51                      push ecx
:00413783 E8C4C30600              call 0047FB4C
:00413788 83C404                  add esp, 00000004
:0041378B 8885E4FBFFFF            mov byte ptr [ebp+FFFFFBE4], al
:00413791 8B8DE4FBFFFF            mov ecx, dword ptr [ebp+FFFFFBE4]
:00413797 81E1FF000000            and ecx, 000000FF
:0041379D 6BC924                  imul ecx, 00000024
:004137A0 81C1502C4B00            add ecx, 004B2C50
:004137A6 E8E5540000              call 00418C90
:004137AB 25FF000000              and eax, 000000FF
:004137B0 83F802                  cmp eax, 00000002
:004137B3 7523                    jne 004137D8
:004137B5 8B8DE4FBFFFF            mov ecx, dword ptr [ebp+FFFFFBE4]
:004137BB 81E1FF000000            and ecx, 000000FF
:004137C1 6BC924                  imul ecx, 00000024
:004137C4 81C1502C4B00            add ecx, 004B2C50
:004137CA E8A1BE0400              call 0045F670
:004137CF 668985ECFBFFFF          mov word ptr [ebp+FFFFFBEC], ax
:004137D6 EB0A                    jmp 004137E2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004137B3(C)
|
:004137D8 B801000000              mov eax, 00000001
:004137DD E92B010000              jmp 0041390D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004137D6(U)
|
:004137E2 8B55FC                  mov edx, dword ptr [ebp-04]
:004137E5 83C201                  add edx, 00000001
:004137E8 8955FC                  mov dword ptr [ebp-04], edx
:004137EB EB64                    jmp 00413851

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004136FB(C), :0041370B(C), :0041371B(C), :00413825(U)
|
:004137ED 8B45FC                  mov eax, dword ptr [ebp-04]
:004137F0 33C9                    xor ecx, ecx
:004137F2 8A08                    mov cl, byte ptr [eax]
:004137F4 83F90A                  cmp ecx, 0000000A
:004137F7 742E                    je 00413827
:004137F9 8B55F4                  mov edx, dword ptr [ebp-0C]
:004137FC 8B45FC                  mov eax, dword ptr [ebp-04]
:004137FF 8A08                    mov cl, byte ptr [eax]
:00413801 888C15F0FBFFFF          mov byte ptr [ebp+edx-00000410], cl
:00413808 8B55F4                  mov edx, dword ptr [ebp-0C]
:0041380B 83C201                  add edx, 00000001
:0041380E 8955F4                  mov dword ptr [ebp-0C], edx
:00413811 817DF400040000          cmp dword ptr [ebp-0C], 00000400
:00413818 7602                    jbe 0041381C
:0041381A EB0B                    jmp 00413827

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413818(C)
|
:0041381C 8B45FC                  mov eax, dword ptr [ebp-04]
:0041381F 83C001                  add eax, 00000001
:00413822 8945FC                  mov dword ptr [ebp-04], eax
:00413825 EBC6                    jmp 004137ED

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004137F7(C), :0041381A(U)
|
:00413827 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041382A 83C101                  add ecx, 00000001
:0041382D 894DFC                  mov dword ptr [ebp-04], ecx
:00413830 8B55F4                  mov edx, dword ptr [ebp-0C]
:00413833 C68415F0FBFFFF00        mov byte ptr [ebp+edx-00000410], 00
:0041383B 8D85F0FBFFFF            lea eax, dword ptr [ebp+FFFFFBF0]
:00413841 50                      push eax
:00413842 E879B60000              call 0041EEC0
:00413847 83C404                  add esp, 00000004
:0041384A 668985ECFBFFFF          mov word ptr [ebp+FFFFFBEC], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004136B1(C), :004136EF(U), :004137EB(U)
|
:00413851 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00413854 51                      push ecx
:00413855 8D95F0FBFFFF            lea edx, dword ptr [ebp+FFFFFBF0]
:0041385B 52                      push edx
:0041385C B9902F4900              mov ecx, 00492F90
:00413861 E83F410000              call 004179A5
:00413866 E8B780FFFF              call 0040B922
:0041386B 85C0                    test eax, eax
:0041386D 7412                    je 00413881
:0041386F 8B85ECFBFFFF            mov eax, dword ptr [ebp+FFFFFBEC]
:00413875 25FFFF0000              and eax, 0000FFFF
:0041387A 3DFFFF0000              cmp eax, 0000FFFF
:0041387F 7520                    jne 004138A1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041386D(C)
|
:00413881 6A20                    push 00000020
:00413883 8B8DECFBFFFF            mov ecx, dword ptr [ebp+FFFFFBEC]
:00413889 81E1FFFF0000            and ecx, 0000FFFF
:0041388F 51                      push ecx
:00413890 8D95F0FBFFFF            lea edx, dword ptr [ebp+FFFFFBF0]
:00413896 52                      push edx
:00413897 E8559D0100              call 0042D5F1
:0041389C 83C40C                  add esp, 0000000C
:0041389F EB1D                    jmp 004138BE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041387F(C)
|
:004138A1 8B85ECFBFFFF            mov eax, dword ptr [ebp+FFFFFBEC]
:004138A7 25FFFF0000              and eax, 0000FFFF
:004138AC 50                      push eax
:004138AD 8D8DF0FBFFFF            lea ecx, dword ptr [ebp+FFFFFBF0]
:004138B3 51                      push ecx
:004138B4 B9F05D4B00              mov ecx, 004B5DF0
:004138B9 E89F5D0400              call 0045965D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041389F(U), :004138F6(U)
|
:004138BE 8B55FC                  mov edx, dword ptr [ebp-04]
:004138C1 33C0                    xor eax, eax
:004138C3 8A02                    mov al, byte ptr [edx]
:004138C5 85C0                    test eax, eax
:004138C7 742F                    je 004138F8
:004138C9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004138CC 33D2                    xor edx, edx
:004138CE 8A11                    mov dl, byte ptr [ecx]
:004138D0 83FA0A                  cmp edx, 0000000A
:004138D3 7518                    jne 004138ED
:004138D5 8B45FC                  mov eax, dword ptr [ebp-04]
:004138D8 33C9                    xor ecx, ecx
:004138DA 8A4801                  mov cl, byte ptr [eax+01]
:004138DD 83F926                  cmp ecx, 00000026
:004138E0 750B                    jne 004138ED
:004138E2 8B55FC                  mov edx, dword ptr [ebp-04]
:004138E5 83C201                  add edx, 00000001
:004138E8 8955FC                  mov dword ptr [ebp-04], edx
:004138EB EB0B                    jmp 004138F8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004138D3(C), :004138E0(C)
|
:004138ED 8B45FC                  mov eax, dword ptr [ebp-04]
:004138F0 83C001                  add eax, 00000001
:004138F3 8945FC                  mov dword ptr [ebp-04], eax
:004138F6 EBC6                    jmp 004138BE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004138C7(C), :004138EB(U)
|
:004138F8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004138FB 33D2                    xor edx, edx
:004138FD 8A11                    mov dl, byte ptr [ecx]
:004138FF 83FA26                  cmp edx, 00000026
:00413902 0F8498FDFFFF            je 004136A0
:00413908 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041368E(U), :004137DD(U)
|
:0041390D 8BE5                    mov esp, ebp
:0041390F 5D                      pop ebp
:00413910 C3                      ret



* Referenced by a CALL at Address:
|:00410B6D   
|
:00413911 55                      push ebp
:00413912 8BEC                    mov ebp, esp
:00413914 81EC1C040000            sub esp, 0000041C
:0041391A 6A02                    push 00000002
:0041391C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041391F E8D34A0000              call 004183F7
:00413924 668945FC                mov word ptr [ebp-04], ax
:00413928 8B45FC                  mov eax, dword ptr [ebp-04]
:0041392B 25FFFF0000              and eax, 0000FFFF
:00413930 3D00800000              cmp eax, 00008000
:00413935 750A                    jne 00413941
:00413937 B805000000              mov eax, 00000005
:0041393C E9C0000000              jmp 00413A01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413935(C)
|
:00413941 6A02                    push 00000002
:00413943 8B4D08                  mov ecx, dword ptr [ebp+08]
:00413946 E8AC4A0000              call 004183F7
:0041394B 668945F8                mov word ptr [ebp-08], ax
:0041394F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00413952 81E1FFFF0000            and ecx, 0000FFFF
:00413958 81F900800000            cmp ecx, 00008000
:0041395E 750A                    jne 0041396A
:00413960 B805000000              mov eax, 00000005
:00413965 E997000000              jmp 00413A01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041395E(C)
|
:0041396A 6A05                    push 00000005
:0041396C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041396F E8834A0000              call 004183F7
:00413974 8945F0                  mov dword ptr [ebp-10], eax
:00413977 817DF000000080          cmp dword ptr [ebp-10], 80000000
:0041397E 7507                    jne 00413987
:00413980 B805000000              mov eax, 00000005
:00413985 EB7A                    jmp 00413A01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041397E(C)
|
:00413987 66C785E4FBFFFFFFFF      mov word ptr [ebp+FFFFFBE4], FFFF
:00413990 8B55F0                  mov edx, dword ptr [ebp-10]
:00413993 8955F4                  mov dword ptr [ebp-0C], edx
:00413996 C745EC00000000          mov [ebp-14], 00000000
:0041399D E8807FFFFF              call 0040B922
:004139A2 85C0                    test eax, eax
:004139A4 7507                    jne 004139AD
:004139A6 B801000000              mov eax, 00000001
:004139AB EB54                    jmp 00413A01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004139A4(C)
|
:004139AD 8B45F8                  mov eax, dword ptr [ebp-08]
:004139B0 25FFFF0000              and eax, 0000FFFF
:004139B5 3DFFFF0000              cmp eax, 0000FFFF
:004139BA 7507                    jne 004139C3
:004139BC B801000000              mov eax, 00000001
:004139C1 EB3E                    jmp 00413A01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004139BA(C)
|
:004139C3 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004139C6 51                      push ecx
:004139C7 8D95E8FBFFFF            lea edx, dword ptr [ebp+FFFFFBE8]
:004139CD 52                      push edx
:004139CE B9902F4900              mov ecx, 00492F90
:004139D3 E8CD3F0000              call 004179A5
:004139D8 8B45F8                  mov eax, dword ptr [ebp-08]
:004139DB 25FFFF0000              and eax, 0000FFFF
:004139E0 50                      push eax
:004139E1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004139E4 81E1FFFF0000            and ecx, 0000FFFF
:004139EA 51                      push ecx
:004139EB 8D95E8FBFFFF            lea edx, dword ptr [ebp+FFFFFBE8]
:004139F1 52                      push edx
:004139F2 B9F05D4B00              mov ecx, 004B5DF0
:004139F7 E87B5D0400              call 00459777
:004139FC B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041393C(U), :00413965(U), :00413985(U), :004139AB(U), :004139C1(U)
|
:00413A01 8BE5                    mov esp, ebp
:00413A03 5D                      pop ebp
:00413A04 C3                      ret



* Referenced by a CALL at Address:
|:00410B7E   
|
:00413A05 55                      push ebp
:00413A06 8BEC                    mov ebp, esp
:00413A08 81EC04040000            sub esp, 00000404
:00413A0E 6A05                    push 00000005
:00413A10 8B4D08                  mov ecx, dword ptr [ebp+08]
:00413A13 E8DF490000              call 004183F7
:00413A18 8945FC                  mov dword ptr [ebp-04], eax
:00413A1B 817DFC00000080          cmp dword ptr [ebp-04], 80000000
:00413A22 7507                    jne 00413A2B
:00413A24 B805000000              mov eax, 00000005
:00413A29 EB2B                    jmp 00413A56

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413A22(C)
|
:00413A2B 8B45FC                  mov eax, dword ptr [ebp-04]
:00413A2E 50                      push eax
:00413A2F 8D8DFCFBFFFF            lea ecx, dword ptr [ebp+FFFFFBFC]
:00413A35 51                      push ecx
:00413A36 B9902F4900              mov ecx, 00492F90
:00413A3B E8653F0000              call 004179A5
:00413A40 8D95FCFBFFFF            lea edx, dword ptr [ebp+FFFFFBFC]
:00413A46 52                      push edx
:00413A47 6A02                    push 00000002
:00413A49 E84BBC0100              call 0042F699
:00413A4E 83C408                  add esp, 00000008
:00413A51 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413A29(U)
|
:00413A56 8BE5                    mov esp, ebp
:00413A58 5D                      pop ebp
:00413A59 C3                      ret



* Referenced by a CALL at Address:
|:00410B8F   
|
:00413A5A 55                      push ebp
:00413A5B 8BEC                    mov ebp, esp
:00413A5D 81EC04040000            sub esp, 00000404
:00413A63 6A05                    push 00000005
:00413A65 8B4D08                  mov ecx, dword ptr [ebp+08]
:00413A68 E88A490000              call 004183F7
:00413A6D 8945FC                  mov dword ptr [ebp-04], eax
:00413A70 817DFC00000080          cmp dword ptr [ebp-04], 80000000
:00413A77 7507                    jne 00413A80
:00413A79 B805000000              mov eax, 00000005
:00413A7E EB30                    jmp 00413AB0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413A77(C)
|
:00413A80 8B45FC                  mov eax, dword ptr [ebp-04]
:00413A83 50                      push eax
:00413A84 8D8DFCFBFFFF            lea ecx, dword ptr [ebp+FFFFFBFC]
:00413A8A 51                      push ecx
:00413A8B B9902F4900              mov ecx, 00492F90
:00413A90 E8103F0000              call 004179A5
:00413A95 6A20                    push 00000020
:00413A97 68FFFF0000              push 0000FFFF
:00413A9C 8D95FCFBFFFF            lea edx, dword ptr [ebp+FFFFFBFC]
:00413AA2 52                      push edx
:00413AA3 E8499B0100              call 0042D5F1
:00413AA8 83C40C                  add esp, 0000000C
:00413AAB B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413A7E(U)
|
:00413AB0 8BE5                    mov esp, ebp
:00413AB2 5D                      pop ebp
:00413AB3 C3                      ret



* Referenced by a CALL at Address:
|:00410BA0   
|
:00413AB4 55                      push ebp
:00413AB5 8BEC                    mov ebp, esp
:00413AB7 81EC04040000            sub esp, 00000404
:00413ABD 6A05                    push 00000005
:00413ABF 8B4D08                  mov ecx, dword ptr [ebp+08]
:00413AC2 E830490000              call 004183F7
:00413AC7 8945FC                  mov dword ptr [ebp-04], eax
:00413ACA 817DFC00000080          cmp dword ptr [ebp-04], 80000000
:00413AD1 7507                    jne 00413ADA
:00413AD3 B805000000              mov eax, 00000005
:00413AD8 EB29                    jmp 00413B03

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413AD1(C)
|
:00413ADA 8B45FC                  mov eax, dword ptr [ebp-04]
:00413ADD 50                      push eax
:00413ADE 8D8DFCFBFFFF            lea ecx, dword ptr [ebp+FFFFFBFC]
:00413AE4 51                      push ecx
:00413AE5 B9902F4900              mov ecx, 00492F90
:00413AEA E8B63E0000              call 004179A5
:00413AEF 8D95FCFBFFFF            lea edx, dword ptr [ebp+FFFFFBFC]
:00413AF5 52                      push edx
:00413AF6 E87D80FFFF              call 0040BB78
:00413AFB 83C404                  add esp, 00000004
:00413AFE B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413AD8(U)
|
:00413B03 8BE5                    mov esp, ebp
:00413B05 5D                      pop ebp
:00413B06 C3                      ret



* Referenced by a CALL at Address:
|:00410BB1   
|
:00413B07 55                      push ebp
:00413B08 8BEC                    mov ebp, esp
:00413B0A 51                      push ecx
:00413B0B 6A05                    push 00000005
:00413B0D 8B4D08                  mov ecx, dword ptr [ebp+08]
:00413B10 E8E2480000              call 004183F7
:00413B15 8945FC                  mov dword ptr [ebp-04], eax
:00413B18 817DFC00000080          cmp dword ptr [ebp-04], 80000000
:00413B1F 7507                    jne 00413B28
:00413B21 B805000000              mov eax, 00000005
:00413B26 EB11                    jmp 00413B39

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413B1F(C)
|
:00413B28 8B45FC                  mov eax, dword ptr [ebp-04]
:00413B2B 50                      push eax
:00413B2C E81780FFFF              call 0040BB48
:00413B31 83C404                  add esp, 00000004
:00413B34 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413B26(U)
|
:00413B39 8BE5                    mov esp, ebp
:00413B3B 5D                      pop ebp
:00413B3C C3                      ret



* Referenced by a CALL at Address:
|:00410BC2   
|
:00413B3D 55                      push ebp
:00413B3E 8BEC                    mov ebp, esp
:00413B40 81EC08040000            sub esp, 00000408
:00413B46 6A04                    push 00000004
:00413B48 8B4D08                  mov ecx, dword ptr [ebp+08]
:00413B4B E8A7480000              call 004183F7
:00413B50 668945FC                mov word ptr [ebp-04], ax
:00413B54 8B45FC                  mov eax, dword ptr [ebp-04]
:00413B57 25FFFF0000              and eax, 0000FFFF
:00413B5C 3D00800000              cmp eax, 00008000
:00413B61 7507                    jne 00413B6A
:00413B63 B805000000              mov eax, 00000005
:00413B68 EB63                    jmp 00413BCD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413B61(C)
|
:00413B6A 6A05                    push 00000005
:00413B6C 8B4D08                  mov ecx, dword ptr [ebp+08]
:00413B6F E883480000              call 004183F7
:00413B74 8945F8                  mov dword ptr [ebp-08], eax
:00413B77 817DF800000080          cmp dword ptr [ebp-08], 80000000
:00413B7E 7507                    jne 00413B87
:00413B80 B805000000              mov eax, 00000005
:00413B85 EB46                    jmp 00413BCD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413B7E(C)
|
:00413B87 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00413B8A 51                      push ecx
:00413B8B 8D95F8FBFFFF            lea edx, dword ptr [ebp+FFFFFBF8]
:00413B91 52                      push edx
:00413B92 B9902F4900              mov ecx, 00492F90
:00413B97 E8093E0000              call 004179A5
:00413B9C 6A01                    push 00000001
:00413B9E 8A45FC                  mov al, byte ptr [ebp-04]
:00413BA1 50                      push eax
:00413BA2 E829BF0600              call 0047FAD0
:00413BA7 83C408                  add esp, 00000008
:00413BAA 50                      push eax
:00413BAB B970074B00              mov ecx, 004B0770
:00413BB0 E8BB500000              call 00418C70
:00413BB5 8D8DF8FBFFFF            lea ecx, dword ptr [ebp+FFFFFBF8]
:00413BBB 51                      push ecx
:00413BBC 8A55FC                  mov dl, byte ptr [ebp-04]
:00413BBF 52                      push edx
:00413BC0 E87B7DFFFF              call 0040B940
:00413BC5 83C408                  add esp, 00000008
:00413BC8 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00413B68(U), :00413B85(U)
|
:00413BCD 8BE5                    mov esp, ebp
:00413BCF 5D                      pop ebp
:00413BD0 C3                      ret



* Referenced by a CALL at Address:
|:00410BD3   
|
:00413BD1 55                      push ebp
:00413BD2 8BEC                    mov ebp, esp
:00413BD4 51                      push ecx
:00413BD5 6A05                    push 00000005
:00413BD7 8B4D08                  mov ecx, dword ptr [ebp+08]
:00413BDA E818480000              call 004183F7
:00413BDF 8945FC                  mov dword ptr [ebp-04], eax
:00413BE2 817DFC00000080          cmp dword ptr [ebp-04], 80000000
:00413BE9 7507                    jne 00413BF2
:00413BEB B805000000              mov eax, 00000005
:00413BF0 EB18                    jmp 00413C0A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413BE9(C)
|
:00413BF2 8B45FC                  mov eax, dword ptr [ebp-04]
:00413BF5 50                      push eax
:00413BF6 68A06C4900              push 00496CA0
:00413BFB B9902F4900              mov ecx, 00492F90
:00413C00 E8A03D0000              call 004179A5
:00413C05 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413BF0(U)
|
:00413C0A 8BE5                    mov esp, ebp
:00413C0C 5D                      pop ebp
:00413C0D C3                      ret



* Referenced by a CALL at Address:
|:00410BE4   
|
:00413C0E 55                      push ebp
:00413C0F 8BEC                    mov ebp, esp
:00413C11 51                      push ecx
:00413C12 6A05                    push 00000005
:00413C14 8B4D08                  mov ecx, dword ptr [ebp+08]
:00413C17 E8DB470000              call 004183F7
:00413C1C 8945FC                  mov dword ptr [ebp-04], eax
:00413C1F 817DFC00000080          cmp dword ptr [ebp-04], 80000000
:00413C26 7507                    jne 00413C2F
:00413C28 B805000000              mov eax, 00000005
:00413C2D EB23                    jmp 00413C52

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413C26(C)
|
:00413C2F E8EE7CFFFF              call 0040B922
:00413C34 85C0                    test eax, eax
:00413C36 7507                    jne 00413C3F
:00413C38 B801000000              mov eax, 00000001
:00413C3D EB13                    jmp 00413C52

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413C36(C)
|
:00413C3F 8B45FC                  mov eax, dword ptr [ebp-04]
:00413C42 50                      push eax
:00413C43 B9083D4B00              mov ecx, 004B3D08
:00413C48 E8DA800300              call 0044BD27
:00413C4D B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00413C2D(U), :00413C3D(U)
|
:00413C52 8BE5                    mov esp, ebp
:00413C54 5D                      pop ebp
:00413C55 C3                      ret



* Referenced by a CALL at Address:
|:00410BF5   
|
:00413C56 55                      push ebp
:00413C57 8BEC                    mov ebp, esp
:00413C59 83EC0C                  sub esp, 0000000C
:00413C5C 6A02                    push 00000002
:00413C5E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00413C61 E891470000              call 004183F7
:00413C66 668945FC                mov word ptr [ebp-04], ax
:00413C6A 8B45FC                  mov eax, dword ptr [ebp-04]
:00413C6D 25FFFF0000              and eax, 0000FFFF
:00413C72 3D00800000              cmp eax, 00008000
:00413C77 750A                    jne 00413C83
:00413C79 B805000000              mov eax, 00000005
:00413C7E E98C000000              jmp 00413D0F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413C77(C)
|
:00413C83 6A27                    push 00000027
:00413C85 8B4D08                  mov ecx, dword ptr [ebp+08]
:00413C88 E86A470000              call 004183F7
:00413C8D 668945F4                mov word ptr [ebp-0C], ax
:00413C91 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00413C94 81E1FFFF0000            and ecx, 0000FFFF
:00413C9A 81F900800000            cmp ecx, 00008000
:00413CA0 7507                    jne 00413CA9
:00413CA2 B805000000              mov eax, 00000005
:00413CA7 EB66                    jmp 00413D0F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413CA0(C)
|
:00413CA9 E8747CFFFF              call 0040B922
:00413CAE 85C0                    test eax, eax
:00413CB0 7507                    jne 00413CB9
:00413CB2 B801000000              mov eax, 00000001
:00413CB7 EB56                    jmp 00413D0F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413CB0(C)
|
:00413CB9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00413CBC 81E1FFFF0000            and ecx, 0000FFFF
:00413CC2 6BC948                  imul ecx, 00000048
:00413CC5 81C1681B4A00            add ecx, 004A1B68
:00413CCB E80C3E0600              call 00477ADC
:00413CD0 8845F8                  mov byte ptr [ebp-08], al
:00413CD3 8B55F8                  mov edx, dword ptr [ebp-08]
:00413CD6 81E2FF000000            and edx, 000000FF
:00413CDC 81FAFF000000            cmp edx, 000000FF
:00413CE2 7426                    je 00413D0A
:00413CE4 8B45F4                  mov eax, dword ptr [ebp-0C]
:00413CE7 25FFFF0000              and eax, 0000FFFF
:00413CEC F7D8                    neg eax
:00413CEE 1BC0                    sbb eax, eax
:00413CF0 F7D8                    neg eax
:00413CF2 50                      push eax
:00413CF3 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00413CF6 81E1FF000000            and ecx, 000000FF
:00413CFC 6BC924                  imul ecx, 00000024
:00413CFF 81C1502C4B00            add ecx, 004B2C50
:00413D05 E8A64F0000              call 00418CB0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413CE2(C)
|
:00413D0A B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00413C7E(U), :00413CA7(U), :00413CB7(U)
|
:00413D0F 8BE5                    mov esp, ebp
:00413D11 5D                      pop ebp
:00413D12 C3                      ret



* Referenced by a CALL at Address:
|:00410CD2   
|
:00413D13 55                      push ebp
:00413D14 8BEC                    mov ebp, esp
:00413D16 83EC18                  sub esp, 00000018
:00413D19 6A2D                    push 0000002D
:00413D1B 8B4D08                  mov ecx, dword ptr [ebp+08]
:00413D1E E8D4460000              call 004183F7
:00413D23 668945FC                mov word ptr [ebp-04], ax
:00413D27 8B45FC                  mov eax, dword ptr [ebp-04]
:00413D2A 25FFFF0000              and eax, 0000FFFF
:00413D2F 3D00800000              cmp eax, 00008000
:00413D34 750A                    jne 00413D40
:00413D36 B805000000              mov eax, 00000005
:00413D3B E969010000              jmp 00413EA9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413D34(C)
|
:00413D40 6A0C                    push 0000000C
:00413D42 8B4D08                  mov ecx, dword ptr [ebp+08]
:00413D45 E8AD460000              call 004183F7
:00413D4A 668945F0                mov word ptr [ebp-10], ax
:00413D4E 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00413D51 81E1FFFF0000            and ecx, 0000FFFF
:00413D57 81F900800000            cmp ecx, 00008000
:00413D5D 750A                    jne 00413D69
:00413D5F B805000000              mov eax, 00000005
:00413D64 E940010000              jmp 00413EA9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413D5D(C)
|
:00413D69 6A1A                    push 0000001A
:00413D6B 8B4D08                  mov ecx, dword ptr [ebp+08]
:00413D6E E884460000              call 004183F7
:00413D73 668945F8                mov word ptr [ebp-08], ax
:00413D77 8B55F8                  mov edx, dword ptr [ebp-08]
:00413D7A 81E2FFFF0000            and edx, 0000FFFF
:00413D80 81FA00800000            cmp edx, 00008000
:00413D86 750A                    jne 00413D92
:00413D88 B805000000              mov eax, 00000005
:00413D8D E917010000              jmp 00413EA9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413D86(C)
|
:00413D92 6A1C                    push 0000001C
:00413D94 8B4D08                  mov ecx, dword ptr [ebp+08]
:00413D97 E85B460000              call 004183F7
:00413D9C 668945F4                mov word ptr [ebp-0C], ax
:00413DA0 8B45F4                  mov eax, dword ptr [ebp-0C]
:00413DA3 25FFFF0000              and eax, 0000FFFF
:00413DA8 3D00800000              cmp eax, 00008000
:00413DAD 750A                    jne 00413DB9
:00413DAF B805000000              mov eax, 00000005
:00413DB4 E9F0000000              jmp 00413EA9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413DAD(C)
|
:00413DB9 6A15                    push 00000015
:00413DBB 8B4D08                  mov ecx, dword ptr [ebp+08]
:00413DBE E834460000              call 004183F7
:00413DC3 668945EC                mov word ptr [ebp-14], ax
:00413DC7 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00413DCA 81E1FFFF0000            and ecx, 0000FFFF
:00413DD0 81F900800000            cmp ecx, 00008000
:00413DD6 750A                    jne 00413DE2
:00413DD8 B805000000              mov eax, 00000005
:00413DDD E9C7000000              jmp 00413EA9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413DD6(C)
|
:00413DE2 8B55FC                  mov edx, dword ptr [ebp-04]
:00413DE5 81E2FFFF0000            and edx, 0000FFFF
:00413DEB 8955E8                  mov dword ptr [ebp-18], edx
:00413DEE 837DE803                cmp dword ptr [ebp-18], 00000003
:00413DF2 0F879D000000            ja 00413E95
:00413DF8 8B45E8                  mov eax, dword ptr [ebp-18]
:00413DFB FF2485AD3E4100          jmp dword ptr [4*eax+00413EAD]
:00413E02 8A4DEC                  mov cl, byte ptr [ebp-14]
:00413E05 51                      push ecx
:00413E06 8A55FC                  mov dl, byte ptr [ebp-04]
:00413E09 52                      push edx
:00413E0A E8C17DFFFF              call 0040BBD0
:00413E0F 83C408                  add esp, 00000008
:00413E12 8A45EC                  mov al, byte ptr [ebp-14]
:00413E15 A2083D4B00              mov byte ptr [004B3D08], al
:00413E1A EB79                    jmp 00413E95
:00413E1C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00413E1F 81E1FFFF0000            and ecx, 0000FFFF
:00413E25 81F9FFFF0000            cmp ecx, 0000FFFF
:00413E2B 7506                    jne 00413E33
:00413E2D 66C745F40000            mov [ebp-0C], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413E2B(C)
|
:00413E33 8A55F4                  mov dl, byte ptr [ebp-0C]
:00413E36 52                      push edx
:00413E37 8A45FC                  mov al, byte ptr [ebp-04]
:00413E3A 50                      push eax
:00413E3B E8907DFFFF              call 0040BBD0
:00413E40 83C408                  add esp, 00000008
:00413E43 EB50                    jmp 00413E95
:00413E45 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00413E48 81E1FFFF0000            and ecx, 0000FFFF
:00413E4E 81F9FFFF0000            cmp ecx, 0000FFFF
:00413E54 7506                    jne 00413E5C
:00413E56 66C745F00000            mov [ebp-10], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413E54(C)
|
:00413E5C 8A55F0                  mov dl, byte ptr [ebp-10]
:00413E5F 52                      push edx
:00413E60 8A45FC                  mov al, byte ptr [ebp-04]
:00413E63 50                      push eax
:00413E64 E8677DFFFF              call 0040BBD0
:00413E69 83C408                  add esp, 00000008
:00413E6C EB27                    jmp 00413E95
:00413E6E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00413E71 81E1FFFF0000            and ecx, 0000FFFF
:00413E77 81F9FFFF0000            cmp ecx, 0000FFFF
:00413E7D 7506                    jne 00413E85
:00413E7F 66C745F80000            mov [ebp-08], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413E7D(C)
|
:00413E85 8A55F8                  mov dl, byte ptr [ebp-08]
:00413E88 52                      push edx
:00413E89 8A45FC                  mov al, byte ptr [ebp-04]
:00413E8C 50                      push eax
:00413E8D E83E7DFFFF              call 0040BBD0
:00413E92 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00413DF2(C), :00413E1A(U), :00413E43(U), :00413E6C(U)
|
:00413E95 8B0D9CBF4A00            mov ecx, dword ptr [004ABF9C]
:00413E9B 83C902                  or ecx, 00000002
:00413E9E 890D9CBF4A00            mov dword ptr [004ABF9C], ecx
:00413EA4 B802000000              mov eax, 00000002

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00413D3B(U), :00413D64(U), :00413D8D(U), :00413DB4(U), :00413DDD(U)
|
:00413EA9 8BE5                    mov esp, ebp
:00413EAB 5D                      pop ebp
:00413EAC C3                      ret



:00413EAD 453E4100                DWORD 00413E45
:00413EB1 6E3E4100                DWORD 00413E6E
:00413EB5 1C3E4100                DWORD 00413E1C
:00413EB9 023E4100                DWORD 00413E02



* Referenced by a CALL at Address:
|:00410C06   
|
:00413EBD 55                      push ebp
:00413EBE 8BEC                    mov ebp, esp
:00413EC0 E84E7AFFFF              call 0040B913
:00413EC5 25FF000000              and eax, 000000FF
:00413ECA 83F802                  cmp eax, 00000002
:00413ECD 7507                    jne 00413ED6
:00413ECF E83D4C0100              call 00428B11
:00413ED4 EB05                    jmp 00413EDB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413ECD(C)
|
:00413ED6 E82AA50000              call 0041E405

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413ED4(U)
|
:00413EDB B801000000              mov eax, 00000001
:00413EE0 5D                      pop ebp
:00413EE1 C3                      ret



* Referenced by a CALL at Address:
|:00410C17   
|
:00413EE2 55                      push ebp
:00413EE3 8BEC                    mov ebp, esp
:00413EE5 E8D8A60000              call 0041E5C2
:00413EEA B801000000              mov eax, 00000001
:00413EEF 5D                      pop ebp
:00413EF0 C3                      ret



* Referenced by a CALL at Address:
|:00410C28   
|
:00413EF1 55                      push ebp
:00413EF2 8BEC                    mov ebp, esp
:00413EF4 B802000000              mov eax, 00000002
:00413EF9 5D                      pop ebp
:00413EFA C3                      ret



* Referenced by a CALL at Address:
|:00410C5B   
|
:00413EFB 55                      push ebp
:00413EFC 8BEC                    mov ebp, esp
:00413EFE 83EC18                  sub esp, 00000018
:00413F01 6A04                    push 00000004
:00413F03 8B4D08                  mov ecx, dword ptr [ebp+08]
:00413F06 E8EC440000              call 004183F7
:00413F0B 8945F4                  mov dword ptr [ebp-0C], eax
:00413F0E 817DF400000080          cmp dword ptr [ebp-0C], 80000000
:00413F15 750A                    jne 00413F21
:00413F17 B805000000              mov eax, 00000005
:00413F1C E936010000              jmp 00414057

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413F15(C)
|
:00413F21 6A04                    push 00000004
:00413F23 8B4D08                  mov ecx, dword ptr [ebp+08]
:00413F26 E8CC440000              call 004183F7
:00413F2B 8945F0                  mov dword ptr [ebp-10], eax
:00413F2E 817DF000000080          cmp dword ptr [ebp-10], 80000000
:00413F35 750A                    jne 00413F41
:00413F37 B805000000              mov eax, 00000005
:00413F3C E916010000              jmp 00414057

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413F35(C)
|
:00413F41 6A10                    push 00000010
:00413F43 8B4D08                  mov ecx, dword ptr [ebp+08]
:00413F46 E8AC440000              call 004183F7
:00413F4B 668945FC                mov word ptr [ebp-04], ax
:00413F4F 8B45FC                  mov eax, dword ptr [ebp-04]
:00413F52 25FFFF0000              and eax, 0000FFFF
:00413F57 3D00800000              cmp eax, 00008000
:00413F5C 750A                    jne 00413F68
:00413F5E B805000000              mov eax, 00000005
:00413F63 E9EF000000              jmp 00414057

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413F5C(C)
|
:00413F68 6A26                    push 00000026
:00413F6A 8B4D08                  mov ecx, dword ptr [ebp+08]
:00413F6D E885440000              call 004183F7
:00413F72 668945EC                mov word ptr [ebp-14], ax
:00413F76 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00413F79 81E1FFFF0000            and ecx, 0000FFFF
:00413F7F 81F900800000            cmp ecx, 00008000
:00413F85 750A                    jne 00413F91
:00413F87 B805000000              mov eax, 00000005
:00413F8C E9C6000000              jmp 00414057

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413F85(C)
|
:00413F91 6A26                    push 00000026
:00413F93 8B4D08                  mov ecx, dword ptr [ebp+08]
:00413F96 E85C440000              call 004183F7
:00413F9B 668945F8                mov word ptr [ebp-08], ax
:00413F9F 8B55F8                  mov edx, dword ptr [ebp-08]
:00413FA2 81E2FFFF0000            and edx, 0000FFFF
:00413FA8 81FA00800000            cmp edx, 00008000
:00413FAE 750A                    jne 00413FBA
:00413FB0 B805000000              mov eax, 00000005
:00413FB5 E99D000000              jmp 00414057

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413FAE(C)
|
:00413FBA 8B45EC                  mov eax, dword ptr [ebp-14]
:00413FBD 25FFFF0000              and eax, 0000FFFF
:00413FC2 3DFFFF0000              cmp eax, 0000FFFF
:00413FC7 7506                    jne 00413FCF
:00413FC9 66C745EC0000            mov [ebp-14], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413FC7(C)
|
:00413FCF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00413FD2 81E1FFFF0000            and ecx, 0000FFFF
:00413FD8 81F9FFFF0000            cmp ecx, 0000FFFF
:00413FDE 7506                    jne 00413FE6
:00413FE0 66C745F80000            mov [ebp-08], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413FDE(C)
|
:00413FE6 E83779FFFF              call 0040B922
:00413FEB 85C0                    test eax, eax
:00413FED 7463                    je 00414052
:00413FEF 8B55FC                  mov edx, dword ptr [ebp-04]
:00413FF2 81E2FFFF0000            and edx, 0000FFFF
:00413FF8 8955E8                  mov dword ptr [ebp-18], edx
:00413FFB 837DE800                cmp dword ptr [ebp-18], 00000000
:00413FFF 7408                    je 00414009
:00414001 837DE801                cmp dword ptr [ebp-18], 00000001
:00414005 742D                    je 00414034
:00414007 EB49                    jmp 00414052

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00413FFF(C)
|
:00414009 8B45F8                  mov eax, dword ptr [ebp-08]
:0041400C 25FFFF0000              and eax, 0000FFFF
:00414011 50                      push eax
:00414012 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00414015 81E1FFFF0000            and ecx, 0000FFFF
:0041401B 51                      push ecx
:0041401C 6A00                    push 00000000
:0041401E 6A1A                    push 0000001A
:00414020 8A55F0                  mov dl, byte ptr [ebp-10]
:00414023 52                      push edx
:00414024 8A45F4                  mov al, byte ptr [ebp-0C]
:00414027 50                      push eax
:00414028 B9F05D4B00              mov ecx, 004B5DF0
:0041402D E80E210400              call 00456140
:00414032 EB1E                    jmp 00414052

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414005(C)
|
:00414034 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00414037 81E1FFFF0000            and ecx, 0000FFFF
:0041403D 51                      push ecx
:0041403E 6A00                    push 00000000
:00414040 8A55F0                  mov dl, byte ptr [ebp-10]
:00414043 52                      push edx
:00414044 8A45F4                  mov al, byte ptr [ebp-0C]
:00414047 50                      push eax
:00414048 B9F05D4B00              mov ecx, 004B5DF0
:0041404D E86F270400              call 004567C1

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00413FED(C), :00414007(U), :00414032(U)
|
:00414052 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00413F1C(U), :00413F3C(U), :00413F63(U), :00413F8C(U), :00413FB5(U)
|
:00414057 8BE5                    mov esp, ebp
:00414059 5D                      pop ebp
:0041405A C3                      ret



* Referenced by a CALL at Address:
|:00410C6C   
|
:0041405B 55                      push ebp
:0041405C 8BEC                    mov ebp, esp
:0041405E 83EC24                  sub esp, 00000024
:00414061 6A04                    push 00000004
:00414063 8B4D08                  mov ecx, dword ptr [ebp+08]
:00414066 E88C430000              call 004183F7
:0041406B 668945FC                mov word ptr [ebp-04], ax
:0041406F 8B45FC                  mov eax, dword ptr [ebp-04]
:00414072 25FFFF0000              and eax, 0000FFFF
:00414077 3D00800000              cmp eax, 00008000
:0041407C 750A                    jne 00414088
:0041407E B805000000              mov eax, 00000005
:00414083 E9CB010000              jmp 00414253

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041407C(C)
|
:00414088 6A04                    push 00000004
:0041408A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041408D E865430000              call 004183F7
:00414092 668945F8                mov word ptr [ebp-08], ax
:00414096 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00414099 81E1FFFF0000            and ecx, 0000FFFF
:0041409F 81F900800000            cmp ecx, 00008000
:004140A5 750A                    jne 004140B1
:004140A7 B805000000              mov eax, 00000005
:004140AC E9A2010000              jmp 00414253

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004140A5(C)
|
:004140B1 6A4B                    push 0000004B
:004140B3 8B4D08                  mov ecx, dword ptr [ebp+08]
:004140B6 E83C430000              call 004183F7
:004140BB 668945F4                mov word ptr [ebp-0C], ax
:004140BF 8B55F4                  mov edx, dword ptr [ebp-0C]
:004140C2 81E2FFFF0000            and edx, 0000FFFF
:004140C8 81FA00800000            cmp edx, 00008000
:004140CE 750A                    jne 004140DA
:004140D0 B805000000              mov eax, 00000005
:004140D5 E979010000              jmp 00414253

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004140CE(C)
|
:004140DA 6A26                    push 00000026
:004140DC 8B4D08                  mov ecx, dword ptr [ebp+08]
:004140DF E813430000              call 004183F7
:004140E4 668945E4                mov word ptr [ebp-1C], ax
:004140E8 8B45E4                  mov eax, dword ptr [ebp-1C]
:004140EB 25FFFF0000              and eax, 0000FFFF
:004140F0 3D00800000              cmp eax, 00008000
:004140F5 750A                    jne 00414101
:004140F7 B805000000              mov eax, 00000005
:004140FC E952010000              jmp 00414253

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004140F5(C)
|
:00414101 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00414104 81E1FFFF0000            and ecx, 0000FFFF
:0041410A 81F9FFFF0000            cmp ecx, 0000FFFF
:00414110 7507                    jne 00414119
:00414112 33C0                    xor eax, eax
:00414114 E93A010000              jmp 00414253

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414110(C)
|
:00414119 8A55F8                  mov dl, byte ptr [ebp-08]
:0041411C 52                      push edx
:0041411D 8A45FC                  mov al, byte ptr [ebp-04]
:00414120 50                      push eax
:00414121 8D4DE8                  lea ecx, dword ptr [ebp-18]
:00414124 E8A74B0000              call 00418CD0
:00414129 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0041412C 81E1FFFF0000            and ecx, 0000FFFF
:00414132 85C9                    test ecx, ecx
:00414134 7412                    je 00414148
:00414136 8A55F8                  mov dl, byte ptr [ebp-08]
:00414139 52                      push edx
:0041413A 8A45FC                  mov al, byte ptr [ebp-04]
:0041413D 50                      push eax
:0041413E B950424B00              mov ecx, 004B4250
:00414143 E8F70E0400              call 0045503F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414134(C)
|
:00414148 668B4DE8                mov cx, word ptr [ebp-18]
:0041414C 51                      push ecx
:0041414D E82CB90300              call 0044FA7E
:00414152 83C404                  add esp, 00000004
:00414155 8945DC                  mov dword ptr [ebp-24], eax
:00414158 8955E0                  mov dword ptr [ebp-20], edx
:0041415B 8B55DC                  mov edx, dword ptr [ebp-24]
:0041415E 8955EC                  mov dword ptr [ebp-14], edx
:00414161 8B45E0                  mov eax, dword ptr [ebp-20]
:00414164 8945F0                  mov dword ptr [ebp-10], eax
:00414167 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041416A 83C118                  add ecx, 00000018
:0041416D 894DEC                  mov dword ptr [ebp-14], ecx
:00414170 8B55F0                  mov edx, dword ptr [ebp-10]
:00414173 83C218                  add edx, 00000018
:00414176 8955F0                  mov dword ptr [ebp-10], edx
:00414179 837DEC00                cmp dword ptr [ebp-14], 00000000
:0041417D 0F8CCB000000            jl 0041424E
:00414183 B950424B00              mov ecx, 004B4250
:00414188 E8B71C0400              call 00455E44
:0041418D 3945EC                  cmp dword ptr [ebp-14], eax
:00414190 0F8DB8000000            jnl 0041424E
:00414196 837DF038                cmp dword ptr [ebp-10], 00000038
:0041419A 0F8CAE000000            jl 0041424E
:004141A0 B950424B00              mov ecx, 004B4250
:004141A5 E8C11C0400              call 00455E6B
:004141AA 83C038                  add eax, 00000038
:004141AD 3945F0                  cmp dword ptr [ebp-10], eax
:004141B0 0F8D98000000            jnl 0041424E
:004141B6 8B45F4                  mov eax, dword ptr [ebp-0C]
:004141B9 25FFFF0000              and eax, 0000FFFF
:004141BE 83F86D                  cmp eax, 0000006D
:004141C1 7514                    jne 004141D7
:004141C3 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004141C6 51                      push ecx
:004141C7 8B55EC                  mov edx, dword ptr [ebp-14]
:004141CA 52                      push edx
:004141CB B9F87A4900              mov ecx, 00497AF8
:004141D0 E8A4D60000              call 00421879
:004141D5 EB77                    jmp 0041424E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004141C1(C)
|
:004141D7 8B45F4                  mov eax, dword ptr [ebp-0C]
:004141DA 25FFFF0000              and eax, 0000FFFF
:004141DF 83F864                  cmp eax, 00000064
:004141E2 7C10                    jl 004141F4
:004141E4 8A4DF4                  mov cl, byte ptr [ebp-0C]
:004141E7 51                      push ecx
:004141E8 B9F87A4900              mov ecx, 00497AF8
:004141ED E80DD60000              call 004217FF
:004141F2 EB5A                    jmp 0041424E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004141E2(C)
|
:004141F4 68004C0400              push 00044C00
:004141F9 6A04                    push 00000004
:004141FB 6A00                    push 00000000
:004141FD 6A00                    push 00000000
:004141FF B9C8E44A00              mov ecx, 004AE4C8
:00414204 E837B80600              call 0047FA40
:00414209 50                      push eax
:0041420A 8A55F4                  mov dl, byte ptr [ebp-0C]
:0041420D 52                      push edx

* Possible StringData Ref from Data Obj ->"MEFF.E5"
                                  |
:0041420E 68F8BB4800              push 0048BBF8
:00414213 B9B0174900              mov ecx, 004917B0
:00414218 E8DBD2FEFF              call 004014F8
:0041421D 8D45EC                  lea eax, dword ptr [ebp-14]
:00414220 50                      push eax
:00414221 6A01                    push 00000001
:00414223 B9B0174900              mov ecx, 004917B0
:00414228 E877D7FEFF              call 004019A4
:0041422D 25FF000000              and eax, 000000FF
:00414232 85C0                    test eax, eax
:00414234 740E                    je 00414244
:00414236 6A01                    push 00000001
:00414238 6A00                    push 00000000
:0041423A B9B0174900              mov ecx, 004917B0
:0041423F E818DCFEFF              call 00401E5C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414234(C)
|
:00414244 B9B0174900              mov ecx, 004917B0
:00414249 E85DD4FEFF              call 004016AB

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041417D(C), :00414190(C), :0041419A(C), :004141B0(C), :004141D5(U)
|:004141F2(U)
|
:0041424E B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00414083(U), :004140AC(U), :004140D5(U), :004140FC(U), :00414114(U)
|
:00414253 8BE5                    mov esp, ebp
:00414255 5D                      pop ebp
:00414256 C3                      ret



* Referenced by a CALL at Address:
|:00410C39   
|
:00414257 55                      push ebp
:00414258 8BEC                    mov ebp, esp
:0041425A 83EC08                  sub esp, 00000008
:0041425D 6A04                    push 00000004
:0041425F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00414262 E890410000              call 004183F7
:00414267 8945FC                  mov dword ptr [ebp-04], eax
:0041426A 817DFC00000080          cmp dword ptr [ebp-04], 80000000
:00414271 7507                    jne 0041427A
:00414273 B805000000              mov eax, 00000005
:00414278 EB34                    jmp 004142AE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414271(C)
|
:0041427A 6A04                    push 00000004
:0041427C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041427F E873410000              call 004183F7
:00414284 8945F8                  mov dword ptr [ebp-08], eax
:00414287 817DF800000080          cmp dword ptr [ebp-08], 80000000
:0041428E 7507                    jne 00414297
:00414290 B805000000              mov eax, 00000005
:00414295 EB17                    jmp 004142AE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041428E(C)
|
:00414297 8A45F8                  mov al, byte ptr [ebp-08]
:0041429A 50                      push eax
:0041429B 8A4DFC                  mov cl, byte ptr [ebp-04]
:0041429E 51                      push ecx
:0041429F B950424B00              mov ecx, 004B4250
:004142A4 E8960D0400              call 0045503F
:004142A9 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00414278(U), :00414295(U)
|
:004142AE 8BE5                    mov esp, ebp
:004142B0 5D                      pop ebp
:004142B1 C3                      ret



* Referenced by a CALL at Address:
|:00410AD4   
|
:004142B2 55                      push ebp
:004142B3 8BEC                    mov ebp, esp
:004142B5 83EC08                  sub esp, 00000008
:004142B8 6A04                    push 00000004
:004142BA 8B4D08                  mov ecx, dword ptr [ebp+08]
:004142BD E835410000              call 004183F7
:004142C2 8945FC                  mov dword ptr [ebp-04], eax
:004142C5 817DFC00000080          cmp dword ptr [ebp-04], 80000000
:004142CC 7507                    jne 004142D5
:004142CE B805000000              mov eax, 00000005
:004142D3 EB45                    jmp 0041431A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004142CC(C)
|
:004142D5 6A27                    push 00000027
:004142D7 8B4D08                  mov ecx, dword ptr [ebp+08]
:004142DA E818410000              call 004183F7
:004142DF 668945F8                mov word ptr [ebp-08], ax
:004142E3 8B45F8                  mov eax, dword ptr [ebp-08]
:004142E6 25FFFF0000              and eax, 0000FFFF
:004142EB 3D00800000              cmp eax, 00008000
:004142F0 7507                    jne 004142F9
:004142F2 B805000000              mov eax, 00000005
:004142F7 EB21                    jmp 0041431A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004142F0(C)
|
:004142F9 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004142FC 81E1FFFF0000            and ecx, 0000FFFF
:00414302 F7D9                    neg ecx
:00414304 1BC9                    sbb ecx, ecx
:00414306 F7D9                    neg ecx
:00414308 51                      push ecx
:00414309 8B55FC                  mov edx, dword ptr [ebp-04]
:0041430C 52                      push edx
:0041430D 8B4D08                  mov ecx, dword ptr [ebp+08]
:00414310 E8BC410000              call 004184D1
:00414315 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004142D3(U), :004142F7(U)
|
:0041431A 8BE5                    mov esp, ebp
:0041431C 5D                      pop ebp
:0041431D C3                      ret



* Referenced by a CALL at Address:
|:00410AA1   
|
:0041431E 55                      push ebp
:0041431F 8BEC                    mov ebp, esp
:00414321 51                      push ecx
:00414322 6A2E                    push 0000002E
:00414324 8B4D08                  mov ecx, dword ptr [ebp+08]
:00414327 E8CB400000              call 004183F7
:0041432C 668945FC                mov word ptr [ebp-04], ax
:00414330 8B45FC                  mov eax, dword ptr [ebp-04]
:00414333 25FFFF0000              and eax, 0000FFFF
:00414338 3D00800000              cmp eax, 00008000
:0041433D 7507                    jne 00414346
:0041433F B805000000              mov eax, 00000005
:00414344 EB17                    jmp 0041435D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041433D(C)
|
:00414346 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00414349 81E1FFFF0000            and ecx, 0000FFFF
:0041434F 51                      push ecx
:00414350 E803850100              call 0042C858
:00414355 83C404                  add esp, 00000004
:00414358 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414344(U)
|
:0041435D 8BE5                    mov esp, ebp
:0041435F 5D                      pop ebp
:00414360 C3                      ret



* Referenced by a CALL at Address:
|:00410CE3   
|
:00414361 55                      push ebp
:00414362 8BEC                    mov ebp, esp
:00414364 51                      push ecx
:00414365 6A36                    push 00000036
:00414367 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041436A E888400000              call 004183F7
:0041436F 668945FC                mov word ptr [ebp-04], ax
:00414373 8B45FC                  mov eax, dword ptr [ebp-04]
:00414376 25FFFF0000              and eax, 0000FFFF
:0041437B 3D00800000              cmp eax, 00008000
:00414380 7507                    jne 00414389
:00414382 B805000000              mov eax, 00000005
:00414387 EB17                    jmp 004143A0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414380(C)
|
:00414389 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041438C 81E1FFFF0000            and ecx, 0000FFFF
:00414392 51                      push ecx
:00414393 8B4D08                  mov ecx, dword ptr [ebp+08]
:00414396 E87D410000              call 00418518
:0041439B B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414387(U)
|
:004143A0 8BE5                    mov esp, ebp
:004143A2 5D                      pop ebp
:004143A3 C3                      ret



* Referenced by a CALL at Address:
|:00410AE5   
|
:004143A4 55                      push ebp
:004143A5 8BEC                    mov ebp, esp
:004143A7 B808000000              mov eax, 00000008
:004143AC 5D                      pop ebp
:004143AD C3                      ret



* Referenced by a CALL at Address:
|:00410AF6   
|
:004143AE 55                      push ebp
:004143AF 8BEC                    mov ebp, esp
:004143B1 6A00                    push 00000000
:004143B3 E8A0840100              call 0042C858
:004143B8 83C404                  add esp, 00000004

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:004143BB B807000000              mov eax, 00000007
:004143C0 5D                      pop ebp
:004143C1 C3                      ret



* Referenced by a CALL at Address:
|:00410E48   
|
:004143C2 55                      push ebp
:004143C3 8BEC                    mov ebp, esp
:004143C5 83EC2C                  sub esp, 0000002C
:004143C8 6A17                    push 00000017
:004143CA 8B4D08                  mov ecx, dword ptr [ebp+08]
:004143CD E825400000              call 004183F7
:004143D2 668945F8                mov word ptr [ebp-08], ax
:004143D6 8B45F8                  mov eax, dword ptr [ebp-08]
:004143D9 25FFFF0000              and eax, 0000FFFF
:004143DE 3D00800000              cmp eax, 00008000
:004143E3 750A                    jne 004143EF
:004143E5 B805000000              mov eax, 00000005
:004143EA E9E1020000              jmp 004146D0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004143E3(C)
|
:004143EF 6A49                    push 00000049
:004143F1 8B4D08                  mov ecx, dword ptr [ebp+08]
:004143F4 E8FE3F0000              call 004183F7
:004143F9 668945F0                mov word ptr [ebp-10], ax
:004143FD 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00414400 81E1FFFF0000            and ecx, 0000FFFF
:00414406 81F900800000            cmp ecx, 00008000
:0041440C 750A                    jne 00414418
:0041440E B805000000              mov eax, 00000005
:00414413 E9B8020000              jmp 004146D0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041440C(C)
|
:00414418 6A26                    push 00000026
:0041441A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041441D E8D53F0000              call 004183F7
:00414422 668945E8                mov word ptr [ebp-18], ax
:00414426 8B55E8                  mov edx, dword ptr [ebp-18]
:00414429 81E2FFFF0000            and edx, 0000FFFF
:0041442F 81FA00800000            cmp edx, 00008000
:00414435 750A                    jne 00414441
:00414437 B805000000              mov eax, 00000005
:0041443C E98F020000              jmp 004146D0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414435(C)
|
:00414441 6A02                    push 00000002
:00414443 8B4D08                  mov ecx, dword ptr [ebp+08]
:00414446 E8AC3F0000              call 004183F7
:0041444B 668945FC                mov word ptr [ebp-04], ax
:0041444F 8B45FC                  mov eax, dword ptr [ebp-04]
:00414452 25FFFF0000              and eax, 0000FFFF
:00414457 3D00800000              cmp eax, 00008000
:0041445C 750A                    jne 00414468
:0041445E B805000000              mov eax, 00000005
:00414463 E968020000              jmp 004146D0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041445C(C)
|
:00414468 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041446B 81E1FFFF0000            and ecx, 0000FFFF
:00414471 81F9FFFF0000            cmp ecx, 0000FFFF
:00414477 740E                    je 00414487
:00414479 8B55F8                  mov edx, dword ptr [ebp-08]
:0041447C 81E2FFFF0000            and edx, 0000FFFF
:00414482 83FA68                  cmp edx, 00000068
:00414485 7C07                    jl 0041448E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414477(C)
|
:00414487 33C0                    xor eax, eax
:00414489 E942020000              jmp 004146D0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414485(C)
|
:0041448E 8B45F0                  mov eax, dword ptr [ebp-10]
:00414491 25FFFF0000              and eax, 0000FFFF
:00414496 3DFFFF0000              cmp eax, 0000FFFF
:0041449B 7506                    jne 004144A3
:0041449D 66C745F00000            mov [ebp-10], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041449B(C)
|
:004144A3 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004144A6 81E1FFFF0000            and ecx, 0000FFFF
:004144AC 81F9FFFF0000            cmp ecx, 0000FFFF
:004144B2 7506                    jne 004144BA
:004144B4 66C745E80000            mov [ebp-18], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004144B2(C)
|
:004144BA 8B55F8                  mov edx, dword ptr [ebp-08]
:004144BD 81E2FFFF0000            and edx, 0000FFFF
:004144C3 8955F4                  mov dword ptr [ebp-0C], edx
:004144C6 8A45F0                  mov al, byte ptr [ebp-10]
:004144C9 8845EC                  mov byte ptr [ebp-14], al
:004144CC E87E7CFFFF              call 0040C14F
:004144D1 8845E4                  mov byte ptr [ebp-1C], al
:004144D4 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004144D7 6BC919                  imul ecx, 00000019
:004144DA 81C140114A00            add ecx, 004A1140
:004144E0 E86782FFFF              call 0040C74C
:004144E5 85C0                    test eax, eax
:004144E7 0F8494000000            je 00414581
:004144ED 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004144F0 81E1FFFF0000            and ecx, 0000FFFF
:004144F6 85C9                    test ecx, ecx
:004144F8 0F8583000000            jne 00414581
:004144FE 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00414501 6BC919                  imul ecx, 00000019
:00414504 81C140114A00            add ecx, 004A1140
:0041450A E85F82FFFF              call 0040C76E
:0041450F 85C0                    test eax, eax
:00414511 7441                    je 00414554
:00414513 8B45E4                  mov eax, dword ptr [ebp-1C]
:00414516 25FF000000              and eax, 000000FF
:0041451B 99                      cdq
:0041451C 83E203                  and edx, 00000003
:0041451F 03C2                    add eax, edx
:00414521 C1F802                  sar eax, 02
:00414524 83C001                  add eax, 00000001
:00414527 83F809                  cmp eax, 00000009
:0041452A 7609                    jbe 00414535
:0041452C C745D809000000          mov [ebp-28], 00000009
:00414533 EB17                    jmp 0041454C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041452A(C)
|
:00414535 8B45E4                  mov eax, dword ptr [ebp-1C]
:00414538 25FF000000              and eax, 000000FF
:0041453D 99                      cdq
:0041453E 83E203                  and edx, 00000003
:00414541 03C2                    add eax, edx
:00414543 C1F802                  sar eax, 02
:00414546 83C001                  add eax, 00000001
:00414549 8945D8                  mov dword ptr [ebp-28], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414533(U)
|
:0041454C 8A55D8                  mov dl, byte ptr [ebp-28]
:0041454F 8855EC                  mov byte ptr [ebp-14], dl
:00414552 EB2D                    jmp 00414581

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414511(C)
|
:00414554 8B45E4                  mov eax, dword ptr [ebp-1C]
:00414557 25FF000000              and eax, 000000FF
:0041455C 83F824                  cmp eax, 00000024
:0041455F 7206                    jb 00414567
:00414561 C645EC03                mov [ebp-14], 03
:00414565 EB1A                    jmp 00414581

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041455F(C)
|
:00414567 8B45E4                  mov eax, dword ptr [ebp-1C]
:0041456A 25FF000000              and eax, 000000FF
:0041456F 33D2                    xor edx, edx
:00414571 B90C000000              mov ecx, 0000000C
:00414576 F7F1                    div ecx
:00414578 C1EA02                  shr edx, 02
:0041457B 83C201                  add edx, 00000001
:0041457E 8855EC                  mov byte ptr [ebp-14], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004144E7(C), :004144F8(C), :00414552(U), :00414565(U)
|
:00414581 E89C73FFFF              call 0040B922
:00414586 85C0                    test eax, eax
:00414588 742C                    je 004145B6
:0041458A 6A01                    push 00000001
:0041458C 8B55FC                  mov edx, dword ptr [ebp-04]
:0041458F 81E2FFFF0000            and edx, 0000FFFF
:00414595 52                      push edx
:00414596 8B45E8                  mov eax, dword ptr [ebp-18]
:00414599 25FFFF0000              and eax, 0000FFFF
:0041459E 50                      push eax
:0041459F 8A4DEC                  mov cl, byte ptr [ebp-14]
:004145A2 51                      push ecx
:004145A3 8B55F4                  mov edx, dword ptr [ebp-0C]
:004145A6 52                      push edx
:004145A7 B9F05D4B00              mov ecx, 004B5DF0
:004145AC E86A530400              call 0045991B
:004145B1 E9EF000000              jmp 004146A5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414588(C)
|
:004145B6 8B45F4                  mov eax, dword ptr [ebp-0C]
:004145B9 50                      push eax
:004145BA E8F978FFFF              call 0040BEB8
:004145BF 83C404                  add esp, 00000004
:004145C2 50                      push eax

* Possible StringData Ref from Data Obj ->"õ%s"
                                  |
:004145C3 68B8B34800              push 0048B3B8
:004145C8 6A02                    push 00000002
:004145CA E8CAB00100              call 0042F699
:004145CF 83C40C                  add esp, 0000000C
:004145D2 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004145D5 6BC919                  imul ecx, 00000019
:004145D8 81C140114A00            add ecx, 004A1140
:004145DE E80781FFFF              call 0040C6EA
:004145E3 25FF000000              and eax, 000000FF
:004145E8 83F803                  cmp eax, 00000003
:004145EB 7513                    jne 00414600
:004145ED 8A4DF4                  mov cl, byte ptr [ebp-0C]
:004145F0 51                      push ecx
:004145F1 B970074B00              mov ecx, 004B0770
:004145F6 E84A94FFFF              call 0040DA45
:004145FB E9A5000000              jmp 004146A5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004145EB(C)
|
:00414600 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00414603 6BC919                  imul ecx, 00000019
:00414606 81C140114A00            add ecx, 004A1140
:0041460C E85D81FFFF              call 0040C76E
:00414611 F7D8                    neg eax
:00414613 1BC0                    sbb eax, eax
:00414615 83E006                  and eax, 00000006
:00414618 83C003                  add eax, 00000003
:0041461B 8845E0                  mov byte ptr [ebp-20], al
:0041461E C645DC00                mov [ebp-24], 00
:00414622 8B55EC                  mov edx, dword ptr [ebp-14]
:00414625 81E2FF000000            and edx, 000000FF
:0041462B 8B45E0                  mov eax, dword ptr [ebp-20]
:0041462E 25FF000000              and eax, 000000FF
:00414633 3BD0                    cmp edx, eax
:00414635 7C0A                    jl 00414641
:00414637 8A4DE0                  mov cl, byte ptr [ebp-20]
:0041463A 884DEC                  mov byte ptr [ebp-14], cl
:0041463D C645DCFF                mov [ebp-24], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414635(C)
|
:00414641 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00414644 6BC919                  imul ecx, 00000019
:00414647 81C140114A00            add ecx, 004A1140
:0041464D E89880FFFF              call 0040C6EA
:00414652 25FF000000              and eax, 000000FF
:00414657 83F802                  cmp eax, 00000002
:0041465A 7506                    jne 00414662
:0041465C C645D7FF                mov [ebp-29], FF
:00414660 EB06                    jmp 00414668

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041465A(C)
|
:00414662 8A55DC                  mov dl, byte ptr [ebp-24]
:00414665 8855D7                  mov byte ptr [ebp-29], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414660(U)
|
:00414668 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041466B 6BC919                  imul ecx, 00000019
:0041466E 81C140114A00            add ecx, 004A1140
:00414674 E87180FFFF              call 0040C6EA
:00414679 25FF000000              and eax, 000000FF
:0041467E 83F802                  cmp eax, 00000002
:00414681 7506                    jne 00414689
:00414683 C645D6FF                mov [ebp-2A], FF
:00414687 EB06                    jmp 0041468F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414681(C)
|
:00414689 8A45EC                  mov al, byte ptr [ebp-14]
:0041468C 8845D6                  mov byte ptr [ebp-2A], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414687(U)
|
:0041468F 8A4DD7                  mov cl, byte ptr [ebp-29]
:00414692 51                      push ecx
:00414693 8A55D6                  mov dl, byte ptr [ebp-2A]
:00414696 52                      push edx
:00414697 8A45F4                  mov al, byte ptr [ebp-0C]
:0041469A 50                      push eax
:0041469B B970074B00              mov ecx, 004B0770
:004146A0 E8F790FFFF              call 0040D79C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004145B1(U), :004145FB(U)
|
:004146A5 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004146A8 6BC919                  imul ecx, 00000019
:004146AB 81C140114A00            add ecx, 004A1140
:004146B1 E84A4FFFFF              call 00409600
:004146B6 85C0                    test eax, eax
:004146B8 7411                    je 004146CB
:004146BA 6A01                    push 00000001
:004146BC 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004146BF 83C103                  add ecx, 00000003
:004146C2 51                      push ecx
:004146C3 E8E85A0000              call 0041A1B0
:004146C8 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004146B8(C)
|
:004146CB B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004143EA(U), :00414413(U), :0041443C(U), :00414463(U), :00414489(U)
|
:004146D0 8BE5                    mov esp, ebp
:004146D2 5D                      pop ebp
:004146D3 C3                      ret



* Referenced by a CALL at Address:
|:00410F69   
|
:004146D4 55                      push ebp
:004146D5 8BEC                    mov ebp, esp
:004146D7 83EC2C                  sub esp, 0000002C
:004146DA 6A2C                    push 0000002C
:004146DC 8B4D08                  mov ecx, dword ptr [ebp+08]
:004146DF E8133D0000              call 004183F7
:004146E4 668945FC                mov word ptr [ebp-04], ax
:004146E8 8B45FC                  mov eax, dword ptr [ebp-04]
:004146EB 25FFFF0000              and eax, 0000FFFF
:004146F0 3D00800000              cmp eax, 00008000
:004146F5 750A                    jne 00414701
:004146F7 B805000000              mov eax, 00000005
:004146FC E9F9010000              jmp 004148FA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004146F5(C)
|
:00414701 6A02                    push 00000002
:00414703 8B4D08                  mov ecx, dword ptr [ebp+08]
:00414706 E8EC3C0000              call 004183F7
:0041470B 668945F8                mov word ptr [ebp-08], ax
:0041470F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00414712 81E1FFFF0000            and ecx, 0000FFFF
:00414718 81F900800000            cmp ecx, 00008000
:0041471E 750A                    jne 0041472A
:00414720 B805000000              mov eax, 00000005
:00414725 E9D0010000              jmp 004148FA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041471E(C)
|
:0041472A 6A04                    push 00000004
:0041472C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041472F E8C33C0000              call 004183F7
:00414734 8945DC                  mov dword ptr [ebp-24], eax
:00414737 817DDC00000080          cmp dword ptr [ebp-24], 80000000
:0041473E 750A                    jne 0041474A
:00414740 B805000000              mov eax, 00000005
:00414745 E9B0010000              jmp 004148FA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041473E(C)
|
:0041474A 6A04                    push 00000004
:0041474C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041474F E8A33C0000              call 004183F7
:00414754 8945D4                  mov dword ptr [ebp-2C], eax
:00414757 817DD400000080          cmp dword ptr [ebp-2C], 80000000
:0041475E 750A                    jne 0041476A
:00414760 B805000000              mov eax, 00000005
:00414765 E990010000              jmp 004148FA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041475E(C)
|
:0041476A 6A04                    push 00000004
:0041476C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041476F E8833C0000              call 004183F7
:00414774 8945EC                  mov dword ptr [ebp-14], eax
:00414777 817DEC00000080          cmp dword ptr [ebp-14], 80000000
:0041477E 750A                    jne 0041478A
:00414780 B805000000              mov eax, 00000005
:00414785 E970010000              jmp 004148FA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041477E(C)
|
:0041478A 6A04                    push 00000004
:0041478C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041478F E8633C0000              call 004183F7
:00414794 8945E8                  mov dword ptr [ebp-18], eax
:00414797 817DE800000080          cmp dword ptr [ebp-18], 80000000
:0041479E 750A                    jne 004147AA
:004147A0 B805000000              mov eax, 00000005
:004147A5 E950010000              jmp 004148FA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041479E(C)
|
:004147AA 6A03                    push 00000003
:004147AC 8B4D08                  mov ecx, dword ptr [ebp+08]
:004147AF E8433C0000              call 004183F7
:004147B4 668945D8                mov word ptr [ebp-28], ax
:004147B8 8B55D8                  mov edx, dword ptr [ebp-28]
:004147BB 81E2FFFF0000            and edx, 0000FFFF
:004147C1 81FA00800000            cmp edx, 00008000
:004147C7 750A                    jne 004147D3
:004147C9 B805000000              mov eax, 00000005
:004147CE E927010000              jmp 004148FA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004147C7(C)
|

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:004147D3 6A07                    push 00000007
:004147D5 8B4D08                  mov ecx, dword ptr [ebp+08]
:004147D8 E81A3C0000              call 004183F7
:004147DD 668945F0                mov word ptr [ebp-10], ax
:004147E1 8B45F0                  mov eax, dword ptr [ebp-10]
:004147E4 25FFFF0000              and eax, 0000FFFF
:004147E9 3D00800000              cmp eax, 00008000
:004147EE 750A                    jne 004147FA
:004147F0 B805000000              mov eax, 00000005
:004147F5 E900010000              jmp 004148FA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004147EE(C)
|
:004147FA 6A02                    push 00000002
:004147FC 8B4D08                  mov ecx, dword ptr [ebp+08]
:004147FF E8F33B0000              call 004183F7
:00414804 668945F4                mov word ptr [ebp-0C], ax
:00414808 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041480B 81E1FFFF0000            and ecx, 0000FFFF
:00414811 81F900800000            cmp ecx, 00008000
:00414817 750A                    jne 00414823
:00414819 B805000000              mov eax, 00000005
:0041481E E9D7000000              jmp 004148FA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414817(C)
|
:00414823 6A04                    push 00000004
:00414825 8B4D08                  mov ecx, dword ptr [ebp+08]
:00414828 E8CA3B0000              call 004183F7
:0041482D 8945E4                  mov dword ptr [ebp-1C], eax
:00414830 817DE400000080          cmp dword ptr [ebp-1C], 80000000
:00414837 750A                    jne 00414843
:00414839 B805000000              mov eax, 00000005
:0041483E E9B7000000              jmp 004148FA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414837(C)
|
:00414843 6A04                    push 00000004
:00414845 8B4D08                  mov ecx, dword ptr [ebp+08]
:00414848 E8AA3B0000              call 004183F7
:0041484D 8945E0                  mov dword ptr [ebp-20], eax
:00414850 817DE000000080          cmp dword ptr [ebp-20], 80000000
:00414857 750A                    jne 00414863
:00414859 B805000000              mov eax, 00000005
:0041485E E997000000              jmp 004148FA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414857(C)
|
:00414863 8B55FC                  mov edx, dword ptr [ebp-04]
:00414866 81E2FFFF0000            and edx, 0000FFFF
:0041486C 81FAFFFF0000            cmp edx, 0000FFFF
:00414872 7506                    jne 0041487A
:00414874 66C745FC0000            mov [ebp-04], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414872(C)
|
:0041487A E8A370FFFF              call 0040B922
:0041487F 85C0                    test eax, eax
:00414881 7507                    jne 0041488A
:00414883 B801000000              mov eax, 00000001
:00414888 EB70                    jmp 004148FA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414881(C)
|
:0041488A 8B45FC                  mov eax, dword ptr [ebp-04]
:0041488D 25FFFF0000              and eax, 0000FFFF
:00414892 85C0                    test eax, eax
:00414894 752B                    jne 004148C1
:00414896 8A4DE0                  mov cl, byte ptr [ebp-20]
:00414899 51                      push ecx
:0041489A 8A55E4                  mov dl, byte ptr [ebp-1C]
:0041489D 52                      push edx
:0041489E 8B45F4                  mov eax, dword ptr [ebp-0C]
:004148A1 25FFFF0000              and eax, 0000FFFF
:004148A6 50                      push eax
:004148A7 8A4DF0                  mov cl, byte ptr [ebp-10]
:004148AA 51                      push ecx
:004148AB 8B55F8                  mov edx, dword ptr [ebp-08]
:004148AE 81E2FFFF0000            and edx, 0000FFFF
:004148B4 52                      push edx
:004148B5 B9F05D4B00              mov ecx, 004B5DF0
:004148BA E8CC540400              call 00459D8B
:004148BF EB34                    jmp 004148F5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414894(C)
|
:004148C1 8A45E0                  mov al, byte ptr [ebp-20]
:004148C4 50                      push eax
:004148C5 8A4DE4                  mov cl, byte ptr [ebp-1C]
:004148C8 51                      push ecx
:004148C9 8B55F4                  mov edx, dword ptr [ebp-0C]
:004148CC 81E2FFFF0000            and edx, 0000FFFF
:004148D2 52                      push edx
:004148D3 8A45F0                  mov al, byte ptr [ebp-10]
:004148D6 50                      push eax
:004148D7 8A4DD8                  mov cl, byte ptr [ebp-28]
:004148DA 51                      push ecx
:004148DB 8A55E8                  mov dl, byte ptr [ebp-18]
:004148DE 52                      push edx
:004148DF 8A45EC                  mov al, byte ptr [ebp-14]
:004148E2 50                      push eax
:004148E3 8A4DD4                  mov cl, byte ptr [ebp-2C]
:004148E6 51                      push ecx
:004148E7 8A55DC                  mov dl, byte ptr [ebp-24]
:004148EA 52                      push edx
:004148EB B9F05D4B00              mov ecx, 004B5DF0
:004148F0 E884550400              call 00459E79

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004148BF(U)
|
:004148F5 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004146FC(U), :00414725(U), :00414745(U), :00414765(U), :00414785(U)
|:004147A5(U), :004147CE(U), :004147F5(U), :0041481E(U), :0041483E(U)
|:0041485E(U), :00414888(U)
|
:004148FA 8BE5                    mov esp, ebp
:004148FC 5D                      pop ebp
:004148FD C3                      ret



* Referenced by a CALL at Address:
|:00410E26   
|
:004148FE 55                      push ebp
:004148FF 8BEC                    mov ebp, esp
:00414901 83EC0C                  sub esp, 0000000C
:00414904 6A02                    push 00000002
:00414906 8B4D08                  mov ecx, dword ptr [ebp+08]
:00414909 E8E93A0000              call 004183F7
:0041490E 668945FC                mov word ptr [ebp-04], ax
:00414912 8B45FC                  mov eax, dword ptr [ebp-04]
:00414915 25FFFF0000              and eax, 0000FFFF
:0041491A 3D00800000              cmp eax, 00008000
:0041491F 750A                    jne 0041492B
:00414921 B805000000              mov eax, 00000005
:00414926 E9C8000000              jmp 004149F3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041491F(C)
|
:0041492B 6A0E                    push 0000000E
:0041492D 8B4D08                  mov ecx, dword ptr [ebp+08]
:00414930 E8C23A0000              call 004183F7
:00414935 668945F4                mov word ptr [ebp-0C], ax
:00414939 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041493C 81E1FFFF0000            and ecx, 0000FFFF
:00414942 81F900800000            cmp ecx, 00008000
:00414948 750A                    jne 00414954
:0041494A B805000000              mov eax, 00000005
:0041494F E99F000000              jmp 004149F3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414948(C)
|
:00414954 6A3E                    push 0000003E
:00414956 8B4D08                  mov ecx, dword ptr [ebp+08]
:00414959 E8993A0000              call 004183F7
:0041495E 668945F8                mov word ptr [ebp-08], ax
:00414962 8B55F8                  mov edx, dword ptr [ebp-08]
:00414965 81E2FFFF0000            and edx, 0000FFFF
:0041496B 81FA00800000            cmp edx, 00008000
:00414971 7507                    jne 0041497A
:00414973 B805000000              mov eax, 00000005
:00414978 EB79                    jmp 004149F3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414971(C)
|
:0041497A 8B45FC                  mov eax, dword ptr [ebp-04]
:0041497D 25FFFF0000              and eax, 0000FFFF
:00414982 3DFFFF0000              cmp eax, 0000FFFF
:00414987 7507                    jne 00414990
:00414989 B801000000              mov eax, 00000001
:0041498E EB63                    jmp 004149F3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414987(C)
|
:00414990 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00414993 81E1FFFF0000            and ecx, 0000FFFF
:00414999 81F9FFFF0000            cmp ecx, 0000FFFF
:0041499F 7506                    jne 004149A7
:004149A1 66C745F4FF00            mov [ebp-0C], 00FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041499F(C)
|
:004149A7 8B55F8                  mov edx, dword ptr [ebp-08]
:004149AA 81E2FFFF0000            and edx, 0000FFFF
:004149B0 81FAFFFF0000            cmp edx, 0000FFFF
:004149B6 7506                    jne 004149BE
:004149B8 66C745F80000            mov [ebp-08], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004149B6(C)
|
:004149BE E85F6FFFFF              call 0040B922
:004149C3 85C0                    test eax, eax
:004149C5 7402                    je 004149C9
:004149C7 EB25                    jmp 004149EE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004149C5(C)
|
:004149C9 8B45F8                  mov eax, dword ptr [ebp-08]
:004149CC 25FFFF0000              and eax, 0000FFFF
:004149D1 50                      push eax
:004149D2 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004149D5 81E1FFFF0000            and ecx, 0000FFFF
:004149DB 51                      push ecx
:004149DC 8B55FC                  mov edx, dword ptr [ebp-04]
:004149DF 81E2FFFF0000            and edx, 0000FFFF
:004149E5 52                      push edx
:004149E6 E8A178FFFF              call 0040C28C
:004149EB 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004149C7(U)
|
:004149EE B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00414926(U), :0041494F(U), :00414978(U), :0041498E(U)
|
:004149F3 8BE5                    mov esp, ebp
:004149F5 5D                      pop ebp
:004149F6 C3                      ret



* Referenced by a CALL at Address:
|:00410E15   
|
:004149F7 55                      push ebp
:004149F8 8BEC                    mov ebp, esp
:004149FA 83EC1C                  sub esp, 0000001C
:004149FD 6A28                    push 00000028
:004149FF 8B4D08                  mov ecx, dword ptr [ebp+08]
:00414A02 E8F0390000              call 004183F7
:00414A07 668945F4                mov word ptr [ebp-0C], ax
:00414A0B 8B45F4                  mov eax, dword ptr [ebp-0C]
:00414A0E 25FFFF0000              and eax, 0000FFFF
:00414A13 3D00800000              cmp eax, 00008000
:00414A18 750A                    jne 00414A24
:00414A1A B805000000              mov eax, 00000005
:00414A1F E93A010000              jmp 00414B5E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414A18(C)
|
:00414A24 6A34                    push 00000034
:00414A26 8B4D08                  mov ecx, dword ptr [ebp+08]
:00414A29 E8C9390000              call 004183F7
:00414A2E 668945F8                mov word ptr [ebp-08], ax
:00414A32 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00414A35 81E1FFFF0000            and ecx, 0000FFFF
:00414A3B 81F900800000            cmp ecx, 00008000
:00414A41 750A                    jne 00414A4D
:00414A43 B805000000              mov eax, 00000005
:00414A48 E911010000              jmp 00414B5E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414A41(C)
|
:00414A4D 6A04                    push 00000004
:00414A4F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00414A52 E8A0390000              call 004183F7
:00414A57 8945FC                  mov dword ptr [ebp-04], eax
:00414A5A 817DFC00000080          cmp dword ptr [ebp-04], 80000000
:00414A61 750A                    jne 00414A6D
:00414A63 B805000000              mov eax, 00000005
:00414A68 E9F1000000              jmp 00414B5E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414A61(C)
|
:00414A6D 8B55F4                  mov edx, dword ptr [ebp-0C]
:00414A70 81E2FFFF0000            and edx, 0000FFFF
:00414A76 8955EC                  mov dword ptr [ebp-14], edx
:00414A79 837DEC00                cmp dword ptr [ebp-14], 00000000
:00414A7D 7411                    je 00414A90
:00414A7F 837DEC01                cmp dword ptr [ebp-14], 00000001
:00414A83 7463                    je 00414AE8
:00414A85 837DEC02                cmp dword ptr [ebp-14], 00000002
:00414A89 746D                    je 00414AF8
:00414A8B E9C9000000              jmp 00414B59

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414A7D(C)
|
:00414A90 8B45F8                  mov eax, dword ptr [ebp-08]
:00414A93 25FFFF0000              and eax, 0000FFFF
:00414A98 8945E8                  mov dword ptr [ebp-18], eax
:00414A9B 837DE800                cmp dword ptr [ebp-18], 00000000
:00414A9F 740E                    je 00414AAF
:00414AA1 837DE801                cmp dword ptr [ebp-18], 00000001
:00414AA5 7418                    je 00414ABF
:00414AA7 837DE802                cmp dword ptr [ebp-18], 00000002
:00414AAB 7422                    je 00414ACF
:00414AAD EB30                    jmp 00414ADF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414A9F(C)
|
:00414AAF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00414AB2 51                      push ecx
:00414AB3 B970074B00              mov ecx, 004B0770
:00414AB8 E8E396FFFF              call 0040E1A0
:00414ABD EB27                    jmp 00414AE6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414AA5(C)
|
:00414ABF 8B55FC                  mov edx, dword ptr [ebp-04]
:00414AC2 52                      push edx
:00414AC3 B970074B00              mov ecx, 004B0770
:00414AC8 E82091FFFF              call 0040DBED
:00414ACD EB17                    jmp 00414AE6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414AAB(C)
|
:00414ACF 8B45FC                  mov eax, dword ptr [ebp-04]
:00414AD2 50                      push eax
:00414AD3 B970074B00              mov ecx, 004B0770
:00414AD8 E84691FFFF              call 0040DC23
:00414ADD EB07                    jmp 00414AE6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414AAD(U)
|
:00414ADF B805000000              mov eax, 00000005
:00414AE4 EB78                    jmp 00414B5E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00414ABD(U), :00414ACD(U), :00414ADD(U)
|
:00414AE6 EB71                    jmp 00414B59

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414A83(C)
|
:00414AE8 8A4DFC                  mov cl, byte ptr [ebp-04]
:00414AEB 51                      push ecx
:00414AEC B970074B00              mov ecx, 004B0770
:00414AF1 E87A410000              call 00418C70
:00414AF6 EB61                    jmp 00414B59

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414A89(C)
|
:00414AF8 8A55FC                  mov dl, byte ptr [ebp-04]
:00414AFB 8855F0                  mov byte ptr [ebp-10], dl
:00414AFE 8B45F8                  mov eax, dword ptr [ebp-08]
:00414B01 25FFFF0000              and eax, 0000FFFF
:00414B06 8945E4                  mov dword ptr [ebp-1C], eax
:00414B09 837DE400                cmp dword ptr [ebp-1C], 00000000
:00414B0D 740E                    je 00414B1D
:00414B0F 837DE401                cmp dword ptr [ebp-1C], 00000001
:00414B13 7426                    je 00414B3B
:00414B15 837DE402                cmp dword ptr [ebp-1C], 00000002
:00414B19 7430                    je 00414B4B
:00414B1B EB3C                    jmp 00414B59

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414B0D(C)
|
:00414B1D 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00414B20 81E1FF000000            and ecx, 000000FF
:00414B26 83F964                  cmp ecx, 00000064
:00414B29 7F0E                    jg 00414B39
:00414B2B 8A55F0                  mov dl, byte ptr [ebp-10]
:00414B2E 52                      push edx
:00414B2F B970074B00              mov ecx, 004B0770
:00414B34 E8C7410000              call 00418D00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414B29(C)
|
:00414B39 EB1E                    jmp 00414B59

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414B13(C)
|
:00414B3B 8A45F0                  mov al, byte ptr [ebp-10]
:00414B3E 50                      push eax
:00414B3F B970074B00              mov ecx, 004B0770
:00414B44 E86087FFFF              call 0040D2A9
:00414B49 EB0E                    jmp 00414B59

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414B19(C)
|
:00414B4B 8A4DF0                  mov cl, byte ptr [ebp-10]
:00414B4E 51                      push ecx
:00414B4F B970074B00              mov ecx, 004B0770
:00414B54 E85588FFFF              call 0040D3AE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00414A8B(U), :00414AE6(U), :00414AF6(U), :00414B1B(U), :00414B39(U)
|:00414B49(U)
|
:00414B59 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00414A1F(U), :00414A48(U), :00414A68(U), :00414AE4(U)
|
:00414B5E 8BE5                    mov esp, ebp
:00414B60 5D                      pop ebp
:00414B61 C3                      ret



* Referenced by a CALL at Address:
|:00410E04   
|
:00414B62 55                      push ebp
:00414B63 8BEC                    mov ebp, esp
:00414B65 83EC10                  sub esp, 00000010
:00414B68 56                      push esi
:00414B69 6A02                    push 00000002
:00414B6B 8B4D08                  mov ecx, dword ptr [ebp+08]
:00414B6E E884380000              call 004183F7
:00414B73 668945FC                mov word ptr [ebp-04], ax
:00414B77 8B45FC                  mov eax, dword ptr [ebp-04]
:00414B7A 25FFFF0000              and eax, 0000FFFF
:00414B7F 3D00800000              cmp eax, 00008000
:00414B84 750A                    jne 00414B90
:00414B86 B805000000              mov eax, 00000005
:00414B8B E980010000              jmp 00414D10

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414B84(C)
|
:00414B90 6A04                    push 00000004
:00414B92 8B4D08                  mov ecx, dword ptr [ebp+08]
:00414B95 E85D380000              call 004183F7
:00414B9A 8945F8                  mov dword ptr [ebp-08], eax
:00414B9D 817DF800000080          cmp dword ptr [ebp-08], 80000000
:00414BA4 750A                    jne 00414BB0
:00414BA6 B805000000              mov eax, 00000005
:00414BAB E960010000              jmp 00414D10

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414BA4(C)
|
:00414BB0 E86D6DFFFF              call 0040B922
:00414BB5 85C0                    test eax, eax
:00414BB7 7430                    je 00414BE9
:00414BB9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00414BBC 81E1FFFF0000            and ecx, 0000FFFF
:00414BC2 81F900040000            cmp ecx, 00000400
:00414BC8 7C1F                    jl 00414BE9
:00414BCA 8B55FC                  mov edx, dword ptr [ebp-04]
:00414BCD 81E2FFFF0000            and edx, 0000FFFF
:00414BD3 81FA02040000            cmp edx, 00000402
:00414BD9 7F0E                    jg 00414BE9
:00414BDB B9F05D4B00              mov ecx, 004B5DF0
:00414BE0 E846140400              call 0045602B
:00414BE5 668945FC                mov word ptr [ebp-04], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00414BB7(C), :00414BC8(C), :00414BD9(C)
|
:00414BE9 C645F0FF                mov [ebp-10], FF
:00414BED C745F400000000          mov [ebp-0C], 00000000
:00414BF4 E8296DFFFF              call 0040B922
:00414BF9 85C0                    test eax, eax
:00414BFB 7463                    je 00414C60
:00414BFD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00414C00 81E1FFFF0000            and ecx, 0000FFFF
:00414C06 6BC948                  imul ecx, 00000048
:00414C09 81C1681B4A00            add ecx, 004A1B68
:00414C0F E8C82E0600              call 00477ADC
:00414C14 8845F0                  mov byte ptr [ebp-10], al
:00414C17 8B45F0                  mov eax, dword ptr [ebp-10]
:00414C1A 25FF000000              and eax, 000000FF
:00414C1F 3DFF000000              cmp eax, 000000FF
:00414C24 743A                    je 00414C60
:00414C26 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00414C29 81E1FF000000            and ecx, 000000FF
:00414C2F 6BC924                  imul ecx, 00000024
:00414C32 81C1502C4B00            add ecx, 004B2C50
:00414C38 E853E00500              call 00472C90
:00414C3D 8BF0                    mov esi, eax
:00414C3F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00414C42 81E1FFFF0000            and ecx, 0000FFFF
:00414C48 6BC948                  imul ecx, 00000048
:00414C4B 81C1681B4A00            add ecx, 004A1B68
:00414C51 E8C525FFFF              call 0040721B
:00414C56 33C9                    xor ecx, ecx
:00414C58 3BF0                    cmp esi, eax
:00414C5A 0F94C1                  sete cl
:00414C5D 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00414BFB(C), :00414C24(C)
|
:00414C60 6A00                    push 00000000
:00414C62 8A55F8                  mov dl, byte ptr [ebp-08]
:00414C65 52                      push edx
:00414C66 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00414C69 81E1FFFF0000            and ecx, 0000FFFF
:00414C6F 6BC948                  imul ecx, 00000048
:00414C72 81C1681B4A00            add ecx, 004A1B68
:00414C78 E83B27FFFF              call 004073B8
:00414C7D E8A06CFFFF              call 0040B922
:00414C82 85C0                    test eax, eax
:00414C84 7473                    je 00414CF9
:00414C86 8B45F0                  mov eax, dword ptr [ebp-10]
:00414C89 25FF000000              and eax, 000000FF
:00414C8E 3DFF000000              cmp eax, 000000FF
:00414C93 7464                    je 00414CF9
:00414C95 837DF400                cmp dword ptr [ebp-0C], 00000000
:00414C99 745E                    je 00414CF9
:00414C9B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00414C9E 81E1FFFF0000            and ecx, 0000FFFF
:00414CA4 6BC948                  imul ecx, 00000048
:00414CA7 81C1681B4A00            add ecx, 004A1B68
:00414CAD E86925FFFF              call 0040721B
:00414CB2 50                      push eax
:00414CB3 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00414CB6 81E1FF000000            and ecx, 000000FF
:00414CBC 6BC924                  imul ecx, 00000024
:00414CBF 81C1502C4B00            add ecx, 004B2C50
:00414CC5 E803AA0200              call 0043F6CD
:00414CCA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00414CCD 81E1FFFF0000            and ecx, 0000FFFF
:00414CD3 6BC948                  imul ecx, 00000048
:00414CD6 81C1681B4A00            add ecx, 004A1B68
:00414CDC E86925FFFF              call 0040724A
:00414CE1 50                      push eax
:00414CE2 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00414CE5 81E1FF000000            and ecx, 000000FF
:00414CEB 6BC924                  imul ecx, 00000024
:00414CEE 81C1502C4B00            add ecx, 004B2C50
:00414CF4 E815AA0200              call 0043F70E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00414C84(C), :00414C93(C), :00414C99(C)
|
:00414CF9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00414CFC 81E1FFFF0000            and ecx, 0000FFFF
:00414D02 51                      push ecx
:00414D03 E8F94C0600              call 00479A01
:00414D08 83C404                  add esp, 00000004
:00414D0B B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00414B8B(U), :00414BAB(U)
|
:00414D10 5E                      pop esi
:00414D11 8BE5                    mov esp, ebp
:00414D13 5D                      pop ebp
:00414D14 C3                      ret



* Referenced by a CALL at Address:
|:00410FAD   
|
:00414D15 55                      push ebp
:00414D16 8BEC                    mov ebp, esp
:00414D18 83EC14                  sub esp, 00000014
:00414D1B 6A02                    push 00000002
:00414D1D 8B4D08                  mov ecx, dword ptr [ebp+08]
:00414D20 E8D2360000              call 004183F7
:00414D25 668945FC                mov word ptr [ebp-04], ax
:00414D29 8B45FC                  mov eax, dword ptr [ebp-04]
:00414D2C 25FFFF0000              and eax, 0000FFFF
:00414D31 3D00800000              cmp eax, 00008000
:00414D36 750A                    jne 00414D42
:00414D38 B805000000              mov eax, 00000005
:00414D3D E97E010000              jmp 00414EC0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414D36(C)
|
:00414D42 6A03                    push 00000003
:00414D44 8B4D08                  mov ecx, dword ptr [ebp+08]
:00414D47 E8AB360000              call 004183F7
:00414D4C 668945F8                mov word ptr [ebp-08], ax
:00414D50 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00414D53 81E1FFFF0000            and ecx, 0000FFFF
:00414D59 81F900800000            cmp ecx, 00008000
:00414D5F 750A                    jne 00414D6B
:00414D61 B805000000              mov eax, 00000005
:00414D66 E955010000              jmp 00414EC0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414D5F(C)
|
:00414D6B E8B26BFFFF              call 0040B922
:00414D70 85C0                    test eax, eax
:00414D72 742E                    je 00414DA2
:00414D74 8B55FC                  mov edx, dword ptr [ebp-04]
:00414D77 81E2FFFF0000            and edx, 0000FFFF
:00414D7D 81FA00040000            cmp edx, 00000400
:00414D83 7C1D                    jl 00414DA2
:00414D85 8B45FC                  mov eax, dword ptr [ebp-04]
:00414D88 25FFFF0000              and eax, 0000FFFF
:00414D8D 3D02040000              cmp eax, 00000402
:00414D92 7F0E                    jg 00414DA2
:00414D94 B9F05D4B00              mov ecx, 004B5DF0
:00414D99 E88D120400              call 0045602B
:00414D9E 668945FC                mov word ptr [ebp-04], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00414D72(C), :00414D83(C), :00414D92(C)
|
:00414DA2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00414DA5 81E1FFFF0000            and ecx, 0000FFFF
:00414DAB 81F900020000            cmp ecx, 00000200
:00414DB1 0F8D04010000            jnl 00414EBB
:00414DB7 8A55F8                  mov dl, byte ptr [ebp-08]
:00414DBA 52                      push edx
:00414DBB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00414DBE 81E1FFFF0000            and ecx, 0000FFFF
:00414DC4 6BC948                  imul ecx, 00000048
:00414DC7 81C1681B4A00            add ecx, 004A1B68
:00414DCD E81E92FFFF              call 0040DFF0
:00414DD2 C645F400                mov [ebp-0C], 00
:00414DD6 EB08                    jmp 00414DE0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414E47(U)
|
:00414DD8 8A45F4                  mov al, byte ptr [ebp-0C]
:00414DDB 0401                    add al, 01
:00414DDD 8845F4                  mov byte ptr [ebp-0C], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414DD6(U)
|
:00414DE0 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00414DE3 81E1FF000000            and ecx, 000000FF
:00414DE9 83F903                  cmp ecx, 00000003
:00414DEC 7D5B                    jge 00414E49
:00414DEE 8A55F4                  mov dl, byte ptr [ebp-0C]
:00414DF1 52                      push edx
:00414DF2 8D45F0                  lea eax, dword ptr [ebp-10]
:00414DF5 50                      push eax
:00414DF6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00414DF9 81E1FFFF0000            and ecx, 0000FFFF
:00414DFF 6BC948                  imul ecx, 00000048
:00414E02 81C1681B4A00            add ecx, 004A1B68
:00414E08 E82392FFFF              call 0040E030
:00414E0D 8A4DF0                  mov cl, byte ptr [ebp-10]
:00414E10 51                      push ecx
:00414E11 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00414E14 81E1FFFF0000            and ecx, 0000FFFF
:00414E1A 6BC948                  imul ecx, 00000048
:00414E1D 81C1681B4A00            add ecx, 004A1B68
:00414E23 E8DF2AFFFF              call 00407907
:00414E28 85C0                    test eax, eax
:00414E2A 751B                    jne 00414E47
:00414E2C 8A55F4                  mov dl, byte ptr [ebp-0C]
:00414E2F 52                      push edx
:00414E30 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00414E33 81E1FFFF0000            and ecx, 0000FFFF
:00414E39 6BC948                  imul ecx, 00000048
:00414E3C 81C1681B4A00            add ecx, 004A1B68
:00414E42 E87D2FFFFF              call 00407DC4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414E2A(C)
|
:00414E47 EB8F                    jmp 00414DD8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414DEC(C)
|
:00414E49 E8D46AFFFF              call 0040B922
:00414E4E 85C0                    test eax, eax
:00414E50 7457                    je 00414EA9
:00414E52 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00414E55 81E1FFFF0000            and ecx, 0000FFFF
:00414E5B 6BC948                  imul ecx, 00000048
:00414E5E 81C1681B4A00            add ecx, 004A1B68
:00414E64 E8732C0600              call 00477ADC
:00414E69 8845EC                  mov byte ptr [ebp-14], al
:00414E6C 8B45EC                  mov eax, dword ptr [ebp-14]
:00414E6F 25FF000000              and eax, 000000FF
:00414E74 3DFF000000              cmp eax, 000000FF
:00414E79 742E                    je 00414EA9
:00414E7B 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00414E7E 81E1FF000000            and ecx, 000000FF
:00414E84 6BC924                  imul ecx, 00000024
:00414E87 81C1502C4B00            add ecx, 004B2C50
:00414E8D E89AAF0200              call 0043FE2C
:00414E92 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00414E95 81E1FF000000            and ecx, 000000FF
:00414E9B 6BC924                  imul ecx, 00000024
:00414E9E 81C1502C4B00            add ecx, 004B2C50
:00414EA4 E820AE0200              call 0043FCC9

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00414E50(C), :00414E79(C)
|
:00414EA9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00414EAC 81E1FFFF0000            and ecx, 0000FFFF
:00414EB2 51                      push ecx
:00414EB3 E8494B0600              call 00479A01
:00414EB8 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414DB1(C)
|
:00414EBB B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00414D3D(U), :00414D66(U)
|
:00414EC0 8BE5                    mov esp, ebp
:00414EC2 5D                      pop ebp
:00414EC3 C3                      ret



* Referenced by a CALL at Address:
|:00411002   
|
:00414EC4 55                      push ebp
:00414EC5 8BEC                    mov ebp, esp
:00414EC7 51                      push ecx
:00414EC8 6A22                    push 00000022
:00414ECA 8B4D08                  mov ecx, dword ptr [ebp+08]
:00414ECD E825350000              call 004183F7
:00414ED2 668945FC                mov word ptr [ebp-04], ax
:00414ED6 8B45FC                  mov eax, dword ptr [ebp-04]
:00414ED9 25FFFF0000              and eax, 0000FFFF
:00414EDE 3D00800000              cmp eax, 00008000
:00414EE3 7507                    jne 00414EEC
:00414EE5 B805000000              mov eax, 00000005
:00414EEA EB13                    jmp 00414EFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414EE3(C)
|
:00414EEC 8A4DFC                  mov cl, byte ptr [ebp-04]
:00414EEF 51                      push ecx
:00414EF0 B9083D4B00              mov ecx, 004B3D08
:00414EF5 E8263E0000              call 00418D20
:00414EFA B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414EEA(U)
|
:00414EFF 8BE5                    mov esp, ebp
:00414F01 5D                      pop ebp
:00414F02 C3                      ret



* Referenced by a CALL at Address:
|:00410FF1   
|
:00414F03 55                      push ebp
:00414F04 8BEC                    mov ebp, esp
:00414F06 51                      push ecx
:00414F07 6A47                    push 00000047
:00414F09 8B4D08                  mov ecx, dword ptr [ebp+08]
:00414F0C E8E6340000              call 004183F7
:00414F11 668945FC                mov word ptr [ebp-04], ax
:00414F15 8B45FC                  mov eax, dword ptr [ebp-04]
:00414F18 25FFFF0000              and eax, 0000FFFF
:00414F1D 3D00800000              cmp eax, 00008000
:00414F22 7507                    jne 00414F2B
:00414F24 B805000000              mov eax, 00000005
:00414F29 EB13                    jmp 00414F3E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414F22(C)
|
:00414F2B 8A4DFC                  mov cl, byte ptr [ebp-04]
:00414F2E 51                      push ecx
:00414F2F B9083D4B00              mov ecx, 004B3D08
:00414F34 E8073E0000              call 00418D40
:00414F39 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414F29(U)
|
:00414F3E 8BE5                    mov esp, ebp
:00414F40 5D                      pop ebp
:00414F41 C3                      ret



* Referenced by a CALL at Address:
|:00410F47   
|
:00414F42 55                      push ebp
:00414F43 8BEC                    mov ebp, esp
:00414F45 83EC18                  sub esp, 00000018
:00414F48 6A40                    push 00000040
:00414F4A 8B4D08                  mov ecx, dword ptr [ebp+08]
:00414F4D E8A5340000              call 004183F7
:00414F52 668945F4                mov word ptr [ebp-0C], ax
:00414F56 8B45F4                  mov eax, dword ptr [ebp-0C]
:00414F59 25FFFF0000              and eax, 0000FFFF
:00414F5E 3D00800000              cmp eax, 00008000
:00414F63 750A                    jne 00414F6F
:00414F65 B805000000              mov eax, 00000005
:00414F6A E974010000              jmp 004150E3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414F63(C)
|
:00414F6F 6A02                    push 00000002
:00414F71 8B4D08                  mov ecx, dword ptr [ebp+08]
:00414F74 E87E340000              call 004183F7
:00414F79 668945FC                mov word ptr [ebp-04], ax
:00414F7D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00414F80 81E1FFFF0000            and ecx, 0000FFFF
:00414F86 81F900800000            cmp ecx, 00008000
:00414F8C 750A                    jne 00414F98
:00414F8E B805000000              mov eax, 00000005
:00414F93 E94B010000              jmp 004150E3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414F8C(C)
|
:00414F98 6A04                    push 00000004
:00414F9A 8B4D08                  mov ecx, dword ptr [ebp+08]
:00414F9D E855340000              call 004183F7
:00414FA2 8945F8                  mov dword ptr [ebp-08], eax
:00414FA5 817DF800000080          cmp dword ptr [ebp-08], 80000000
:00414FAC 750A                    jne 00414FB8
:00414FAE B805000000              mov eax, 00000005
:00414FB3 E92B010000              jmp 004150E3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414FAC(C)
|
:00414FB8 8B55F4                  mov edx, dword ptr [ebp-0C]
:00414FBB 81E2FFFF0000            and edx, 0000FFFF
:00414FC1 81FAFFFF0000            cmp edx, 0000FFFF
:00414FC7 7506                    jne 00414FCF
:00414FC9 66C745F40000            mov [ebp-0C], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414FC7(C)
|
:00414FCF E84E69FFFF              call 0040B922
:00414FD4 85C0                    test eax, eax
:00414FD6 7507                    jne 00414FDF
:00414FD8 33C0                    xor eax, eax
:00414FDA E904010000              jmp 004150E3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414FD6(C)
|
:00414FDF 8B45F4                  mov eax, dword ptr [ebp-0C]
:00414FE2 25FFFF0000              and eax, 0000FFFF
:00414FE7 85C0                    test eax, eax
:00414FE9 751D                    jne 00415008
:00414FEB 6A00                    push 00000000
:00414FED 6A00                    push 00000000
:00414FEF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00414FF2 81E1FFFF0000            and ecx, 0000FFFF
:00414FF8 51                      push ecx
:00414FF9 B9F05D4B00              mov ecx, 004B5DF0
:00414FFE E8EB200400              call 004570EE
:00415003 E9D6000000              jmp 004150DE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00414FE9(C)
|
:00415008 8B55F4                  mov edx, dword ptr [ebp-0C]
:0041500B 81E2FFFF0000            and edx, 0000FFFF
:00415011 83FA01                  cmp edx, 00000001
:00415014 0F85C4000000            jne 004150DE
:0041501A 837DF80F                cmp dword ptr [ebp-08], 0000000F
:0041501E 0F83BA000000            jnb 004150DE
:00415024 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00415027 6BC924                  imul ecx, 00000024
:0041502A 81C1502C4B00            add ecx, 004B2C50
:00415030 E85B3C0000              call 00418C90
:00415035 25FF000000              and eax, 000000FF
:0041503A 83F801                  cmp eax, 00000001
:0041503D 0F859B000000            jne 004150DE
:00415043 8B45F8                  mov eax, dword ptr [ebp-08]
:00415046 50                      push eax
:00415047 B9902F4900              mov ecx, 00492F90
:0041504C E87F3D0000              call 00418DD0
:00415051 8945EC                  mov dword ptr [ebp-14], eax
:00415054 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00415057 894DF0                  mov dword ptr [ebp-10], ecx
:0041505A 8B55F0                  mov edx, dword ptr [ebp-10]
:0041505D 83C204                  add edx, 00000004
:00415060 8955E8                  mov dword ptr [ebp-18], edx
:00415063 6A00                    push 00000000
:00415065 8B45F0                  mov eax, dword ptr [ebp-10]
:00415068 8B4808                  mov ecx, dword ptr [eax+08]
:0041506B 83E108                  and ecx, 00000008
:0041506E 51                      push ecx
:0041506F 8B55E8                  mov edx, dword ptr [ebp-18]
:00415072 8A4201                  mov al, byte ptr [edx+01]
:00415075 50                      push eax
:00415076 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00415079 8A11                    mov dl, byte ptr [ecx]
:0041507B 52                      push edx
:0041507C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041507F 6BC924                  imul ecx, 00000024
:00415082 81C1502C4B00            add ecx, 004B2C50
:00415088 E876DA0200              call 00442B03
:0041508D 6A01                    push 00000001
:0041508F 6A0F                    push 0000000F
:00415091 B9B0694B00              mov ecx, 004B69B0
:00415096 E8DFF50500              call 0047467A
:0041509B 8B45E8                  mov eax, dword ptr [ebp-18]
:0041509E 8A4801                  mov cl, byte ptr [eax+01]
:004150A1 51                      push ecx
:004150A2 8B55E8                  mov edx, dword ptr [ebp-18]
:004150A5 8A02                    mov al, byte ptr [edx]
:004150A7 50                      push eax
:004150A8 B950424B00              mov ecx, 004B4250
:004150AD E88DFF0300              call 0045503F
:004150B2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004150B5 6BC924                  imul ecx, 00000024
:004150B8 81C1502C4B00            add ecx, 004B2C50
:004150BE E806AC0200              call 0043FCC9
:004150C3 B9083D4B00              mov ecx, 004B3D08
:004150C8 E8BD570300              call 0044A88A
:004150CD 6A04                    push 00000004
:004150CF B9181B4B00              mov ecx, 004B1B18
:004150D4 E867E2FEFF              call 00403340
:004150D9 E802740100              call 0042C4E0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00415003(U), :00415014(C), :0041501E(C), :0041503D(C)
|
:004150DE B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00414F6A(U), :00414F93(U), :00414FB3(U), :00414FDA(U)
|
:004150E3 8BE5                    mov esp, ebp
:004150E5 5D                      pop ebp
:004150E6 C3                      ret



* Referenced by a CALL at Address:
|:00410F58   
|
:004150E7 55                      push ebp
:004150E8 8BEC                    mov ebp, esp
:004150EA 83EC38                  sub esp, 00000038
:004150ED 6A41                    push 00000041
:004150EF 8B4D08                  mov ecx, dword ptr [ebp+08]
:004150F2 E800330000              call 004183F7
:004150F7 668945E8                mov word ptr [ebp-18], ax
:004150FB 8B45E8                  mov eax, dword ptr [ebp-18]
:004150FE 25FFFF0000              and eax, 0000FFFF
:00415103 3D00800000              cmp eax, 00008000
:00415108 750A                    jne 00415114
:0041510A B805000000              mov eax, 00000005
:0041510F E963040000              jmp 00415577

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415108(C)
|
:00415114 6A02                    push 00000002
:00415116 8B4D08                  mov ecx, dword ptr [ebp+08]
:00415119 E8D9320000              call 004183F7
:0041511E 668945F8                mov word ptr [ebp-08], ax
:00415122 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00415125 81E1FFFF0000            and ecx, 0000FFFF
:0041512B 81F900800000            cmp ecx, 00008000
:00415131 750A                    jne 0041513D
:00415133 B805000000              mov eax, 00000005
:00415138 E93A040000              jmp 00415577

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415131(C)
|
:0041513D 6A04                    push 00000004
:0041513F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00415142 E8B0320000              call 004183F7
:00415147 8945F4                  mov dword ptr [ebp-0C], eax
:0041514A 817DF400000080          cmp dword ptr [ebp-0C], 80000000
:00415151 750A                    jne 0041515D
:00415153 B805000000              mov eax, 00000005
:00415158 E91A040000              jmp 00415577

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415151(C)
|
:0041515D 6A04                    push 00000004
:0041515F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00415162 E890320000              call 004183F7
:00415167 8945D0                  mov dword ptr [ebp-30], eax
:0041516A 817DD000000080          cmp dword ptr [ebp-30], 80000000
:00415171 750A                    jne 0041517D
:00415173 B805000000              mov eax, 00000005
:00415178 E9FA030000              jmp 00415577

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415171(C)
|
:0041517D 6A04                    push 00000004
:0041517F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00415182 E870320000              call 004183F7
:00415187 8945CC                  mov dword ptr [ebp-34], eax
:0041518A 817DCC00000080          cmp dword ptr [ebp-34], 80000000
:00415191 750A                    jne 0041519D
:00415193 B805000000              mov eax, 00000005
:00415198 E9DA030000              jmp 00415577

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415191(C)
|
:0041519D 6A04                    push 00000004
:0041519F 8B4D08                  mov ecx, dword ptr [ebp+08]
:004151A2 E850320000              call 004183F7
:004151A7 8945F0                  mov dword ptr [ebp-10], eax
:004151AA 817DF000000080          cmp dword ptr [ebp-10], 80000000
:004151B1 750A                    jne 004151BD
:004151B3 B805000000              mov eax, 00000005
:004151B8 E9BA030000              jmp 00415577

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004151B1(C)
|
:004151BD 6A04                    push 00000004
:004151BF 8B4D08                  mov ecx, dword ptr [ebp+08]
:004151C2 E830320000              call 004183F7
:004151C7 8945EC                  mov dword ptr [ebp-14], eax
:004151CA 817DEC00000080          cmp dword ptr [ebp-14], 80000000
:004151D1 750A                    jne 004151DD
:004151D3 B805000000              mov eax, 00000005
:004151D8 E99A030000              jmp 00415577

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004151D1(C)
|
:004151DD 6A03                    push 00000003
:004151DF 8B4D08                  mov ecx, dword ptr [ebp+08]
:004151E2 E810320000              call 004183F7
:004151E7 668945E0                mov word ptr [ebp-20], ax
:004151EB 8B55E0                  mov edx, dword ptr [ebp-20]
:004151EE 81E2FFFF0000            and edx, 0000FFFF
:004151F4 81FA00800000            cmp edx, 00008000
:004151FA 750A                    jne 00415206
:004151FC B805000000              mov eax, 00000005
:00415201 E971030000              jmp 00415577

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004151FA(C)
|
:00415206 6A2F                    push 0000002F
:00415208 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041520B E8E7310000              call 004183F7
:00415210 668945E4                mov word ptr [ebp-1C], ax
:00415214 8B45E4                  mov eax, dword ptr [ebp-1C]
:00415217 25FFFF0000              and eax, 0000FFFF
:0041521C 3D00800000              cmp eax, 00008000
:00415221 750A                    jne 0041522D
:00415223 B805000000              mov eax, 00000005
:00415228 E94A030000              jmp 00415577

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415221(C)
|
:0041522D 6A18                    push 00000018
:0041522F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00415232 E8C0310000              call 004183F7
:00415237 668945D4                mov word ptr [ebp-2C], ax
:0041523B 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0041523E 81E1FFFF0000            and ecx, 0000FFFF
:00415244 81F900800000            cmp ecx, 00008000
:0041524A 750A                    jne 00415256
:0041524C B805000000              mov eax, 00000005
:00415251 E921030000              jmp 00415577

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041524A(C)
|
:00415256 6A30                    push 00000030
:00415258 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041525B E897310000              call 004183F7
:00415260 668945D8                mov word ptr [ebp-28], ax
:00415264 8B55D8                  mov edx, dword ptr [ebp-28]
:00415267 81E2FFFF0000            and edx, 0000FFFF
:0041526D 81FA00800000            cmp edx, 00008000
:00415273 750A                    jne 0041527F
:00415275 B805000000              mov eax, 00000005
:0041527A E9F8020000              jmp 00415577

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415273(C)
|
:0041527F 6A04                    push 00000004
:00415281 8B4D08                  mov ecx, dword ptr [ebp+08]
:00415284 E86E310000              call 004183F7
:00415289 8945FC                  mov dword ptr [ebp-04], eax
:0041528C 817DFC00000080          cmp dword ptr [ebp-04], 80000000
:00415293 750A                    jne 0041529F
:00415295 B805000000              mov eax, 00000005
:0041529A E9D8020000              jmp 00415577

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415293(C)
|
:0041529F 6A04                    push 00000004
:004152A1 8B4D08                  mov ecx, dword ptr [ebp+08]
:004152A4 E84E310000              call 004183F7
:004152A9 8945DC                  mov dword ptr [ebp-24], eax
:004152AC 817DDC00000080          cmp dword ptr [ebp-24], 80000000
:004152B3 750A                    jne 004152BF
:004152B5 B805000000              mov eax, 00000005
:004152BA E9B8020000              jmp 00415577

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004152B3(C)
|
:004152BF E85E66FFFF              call 0040B922
:004152C4 85C0                    test eax, eax
:004152C6 750A                    jne 004152D2
:004152C8 B801000000              mov eax, 00000001
:004152CD E9A5020000              jmp 00415577

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004152C6(C)
|
:004152D2 8B45E8                  mov eax, dword ptr [ebp-18]
:004152D5 25FFFF0000              and eax, 0000FFFF
:004152DA 85C0                    test eax, eax
:004152DC 7530                    jne 0041530E
:004152DE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004152E1 81E1FFFF0000            and ecx, 0000FFFF
:004152E7 81F900040000            cmp ecx, 00000400
:004152ED 7C1F                    jl 0041530E
:004152EF 8B55F8                  mov edx, dword ptr [ebp-08]
:004152F2 81E2FFFF0000            and edx, 0000FFFF
:004152F8 81FA02040000            cmp edx, 00000402
:004152FE 7F0E                    jg 0041530E
:00415300 B9F05D4B00              mov ecx, 004B5DF0
:00415305 E8210D0400              call 0045602B
:0041530A 668945F8                mov word ptr [ebp-08], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004152DC(C), :004152ED(C), :004152FE(C)
|
:0041530E 8B45E8                  mov eax, dword ptr [ebp-18]
:00415311 25FFFF0000              and eax, 0000FFFF
:00415316 83F801                  cmp eax, 00000001
:00415319 753C                    jne 00415357
:0041531B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041531E 6BC924                  imul ecx, 00000024
:00415321 81C1502C4B00            add ecx, 004B2C50
:00415327 E864390000              call 00418C90
:0041532C 25FF000000              and eax, 000000FF
:00415331 83F802                  cmp eax, 00000002
:00415334 7517                    jne 0041534D
:00415336 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00415339 6BC924                  imul ecx, 00000024
:0041533C 81C1502C4B00            add ecx, 004B2C50
:00415342 E829A30400              call 0045F670
:00415347 668945F8                mov word ptr [ebp-08], ax
:0041534B EB0A                    jmp 00415357

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415334(C)
|
:0041534D B801000000              mov eax, 00000001
:00415352 E920020000              jmp 00415577

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00415319(C), :0041534B(U)
|
:00415357 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041535A 81E1FFFF0000            and ecx, 0000FFFF
:00415360 83F902                  cmp ecx, 00000002
:00415363 7517                    jne 0041537C
:00415365 8B55E0                  mov edx, dword ptr [ebp-20]
:00415368 81E2FFFF0000            and edx, 0000FFFF
:0041536E 81FAFFFF0000            cmp edx, 0000FFFF
:00415374 7506                    jne 0041537C
:00415376 66C745E00600            mov [ebp-20], 0006

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00415363(C), :00415374(C)
|
:0041537C 8B45E4                  mov eax, dword ptr [ebp-1C]
:0041537F 25FFFF0000              and eax, 0000FFFF
:00415384 3DFFFF0000              cmp eax, 0000FFFF
:00415389 0F84A3000000            je 00415432
:0041538F 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00415392 81E1FFFF0000            and ecx, 0000FFFF
:00415398 894DC8                  mov dword ptr [ebp-38], ecx
:0041539B 837DC800                cmp dword ptr [ebp-38], 00000000
:0041539F 740E                    je 004153AF
:004153A1 837DC801                cmp dword ptr [ebp-38], 00000001
:004153A5 7410                    je 004153B7
:004153A7 837DC802                cmp dword ptr [ebp-38], 00000002
:004153AB 7412                    je 004153BF
:004153AD EB18                    jmp 004153C7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041539F(C)
|
:004153AF 66C745D40000            mov [ebp-2C], 0000
:004153B5 EB16                    jmp 004153CD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004153A5(C)
|
:004153B7 66C745D40300            mov [ebp-2C], 0003
:004153BD EB0E                    jmp 004153CD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004153AB(C)
|
:004153BF 66C745D40600            mov [ebp-2C], 0006
:004153C5 EB06                    jmp 004153CD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004153AD(U)
|
:004153C7 66C745D40300            mov [ebp-2C], 0003

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004153B5(U), :004153BD(U), :004153C5(U)
|
:004153CD 8B55E8                  mov edx, dword ptr [ebp-18]
:004153D0 81E2FFFF0000            and edx, 0000FFFF
:004153D6 83FA02                  cmp edx, 00000002
:004153D9 7431                    je 0041540C
:004153DB 6A01                    push 00000001
:004153DD 8A45D4                  mov al, byte ptr [ebp-2C]
:004153E0 50                      push eax
:004153E1 8A4DE4                  mov cl, byte ptr [ebp-1C]
:004153E4 51                      push ecx
:004153E5 8B55F8                  mov edx, dword ptr [ebp-08]
:004153E8 81E2FFFF0000            and edx, 0000FFFF
:004153EE 52                      push edx
:004153EF B9F05D4B00              mov ecx, 004B5DF0
:004153F4 E863560400              call 0045AA5C
:004153F9 8B45F8                  mov eax, dword ptr [ebp-08]
:004153FC 25FFFF0000              and eax, 0000FFFF
:00415401 50                      push eax
:00415402 E8FA450600              call 00479A01
:00415407 83C404                  add esp, 00000004
:0041540A EB26                    jmp 00415432

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004153D9(C)
|
:0041540C 8A4DD4                  mov cl, byte ptr [ebp-2C]
:0041540F 51                      push ecx
:00415410 8A55E4                  mov dl, byte ptr [ebp-1C]
:00415413 52                      push edx
:00415414 8A45E0                  mov al, byte ptr [ebp-20]
:00415417 50                      push eax
:00415418 8A4DEC                  mov cl, byte ptr [ebp-14]
:0041541B 51                      push ecx
:0041541C 8A55F0                  mov dl, byte ptr [ebp-10]
:0041541F 52                      push edx
:00415420 8A45CC                  mov al, byte ptr [ebp-34]
:00415423 50                      push eax
:00415424 8A4DD0                  mov cl, byte ptr [ebp-30]
:00415427 51                      push ecx
:00415428 B9F05D4B00              mov ecx, 004B5DF0
:0041542D E8B3590400              call 0045ADE5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00415389(C), :0041540A(U)
|
:00415432 8B55D8                  mov edx, dword ptr [ebp-28]
:00415435 81E2FFFF0000            and edx, 0000FFFF
:0041543B 81FAFFFF0000            cmp edx, 0000FFFF
:00415441 7460                    je 004154A3
:00415443 8B45E8                  mov eax, dword ptr [ebp-18]
:00415446 25FFFF0000              and eax, 0000FFFF
:0041544B 83F802                  cmp eax, 00000002
:0041544E 742F                    je 0041547F
:00415450 6A01                    push 00000001
:00415452 8A4DD8                  mov cl, byte ptr [ebp-28]
:00415455 51                      push ecx

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:00415456 6A06                    push 00000006
:00415458 8B55F8                  mov edx, dword ptr [ebp-08]
:0041545B 81E2FFFF0000            and edx, 0000FFFF
:00415461 52                      push edx
:00415462 B9F05D4B00              mov ecx, 004B5DF0
:00415467 E8F0550400              call 0045AA5C
:0041546C 8B45F8                  mov eax, dword ptr [ebp-08]
:0041546F 25FFFF0000              and eax, 0000FFFF
:00415474 50                      push eax
:00415475 E887450600              call 00479A01
:0041547A 83C404                  add esp, 00000004
:0041547D EB24                    jmp 004154A3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041544E(C)
|
:0041547F 8A4DD8                  mov cl, byte ptr [ebp-28]
:00415482 51                      push ecx

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:00415483 6A06                    push 00000006
:00415485 8A55E0                  mov dl, byte ptr [ebp-20]
:00415488 52                      push edx
:00415489 8A45EC                  mov al, byte ptr [ebp-14]
:0041548C 50                      push eax
:0041548D 8A4DF0                  mov cl, byte ptr [ebp-10]
:00415490 51                      push ecx
:00415491 8A55CC                  mov dl, byte ptr [ebp-34]
:00415494 52                      push edx
:00415495 8A45D0                  mov al, byte ptr [ebp-30]
:00415498 50                      push eax
:00415499 B9F05D4B00              mov ecx, 004B5DF0
:0041549E E842590400              call 0045ADE5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00415441(C), :0041547D(U)
|
:004154A3 837DFC00                cmp dword ptr [ebp-04], 00000000
:004154A7 7461                    je 0041550A
:004154A9 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004154AC 81E1FFFF0000            and ecx, 0000FFFF
:004154B2 83F902                  cmp ecx, 00000002
:004154B5 742F                    je 004154E6
:004154B7 6A01                    push 00000001
:004154B9 8A55FC                  mov dl, byte ptr [ebp-04]
:004154BC 52                      push edx

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:004154BD 6A07                    push 00000007
:004154BF 8B45F8                  mov eax, dword ptr [ebp-08]
:004154C2 25FFFF0000              and eax, 0000FFFF
:004154C7 50                      push eax
:004154C8 B9F05D4B00              mov ecx, 004B5DF0
:004154CD E88A550400              call 0045AA5C
:004154D2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004154D5 81E1FFFF0000            and ecx, 0000FFFF
:004154DB 51                      push ecx
:004154DC E820450600              call 00479A01
:004154E1 83C404                  add esp, 00000004
:004154E4 EB24                    jmp 0041550A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004154B5(C)
|
:004154E6 8A55FC                  mov dl, byte ptr [ebp-04]
:004154E9 52                      push edx

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:004154EA 6A07                    push 00000007
:004154EC 8A45E0                  mov al, byte ptr [ebp-20]
:004154EF 50                      push eax
:004154F0 8A4DEC                  mov cl, byte ptr [ebp-14]
:004154F3 51                      push ecx
:004154F4 8A55F0                  mov dl, byte ptr [ebp-10]
:004154F7 52                      push edx
:004154F8 8A45CC                  mov al, byte ptr [ebp-34]
:004154FB 50                      push eax
:004154FC 8A4DD0                  mov cl, byte ptr [ebp-30]
:004154FF 51                      push ecx
:00415500 B9F05D4B00              mov ecx, 004B5DF0
:00415505 E8DB580400              call 0045ADE5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004154A7(C), :004154E4(U)
|
:0041550A 837DDC00                cmp dword ptr [ebp-24], 00000000
:0041550E 7462                    je 00415572
:00415510 8B55E8                  mov edx, dword ptr [ebp-18]
:00415513 81E2FFFF0000            and edx, 0000FFFF
:00415519 83FA02                  cmp edx, 00000002
:0041551C 7430                    je 0041554E
:0041551E 6A01                    push 00000001
:00415520 8A45DC                  mov al, byte ptr [ebp-24]
:00415523 50                      push eax
:00415524 6A08                    push 00000008
:00415526 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00415529 81E1FFFF0000            and ecx, 0000FFFF
:0041552F 51                      push ecx
:00415530 B9F05D4B00              mov ecx, 004B5DF0
:00415535 E822550400              call 0045AA5C
:0041553A 8B55F8                  mov edx, dword ptr [ebp-08]
:0041553D 81E2FFFF0000            and edx, 0000FFFF
:00415543 52                      push edx
:00415544 E8B8440600              call 00479A01
:00415549 83C404                  add esp, 00000004
:0041554C EB24                    jmp 00415572

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041551C(C)
|
:0041554E 8A45DC                  mov al, byte ptr [ebp-24]
:00415551 50                      push eax
:00415552 6A08                    push 00000008
:00415554 8A4DE0                  mov cl, byte ptr [ebp-20]
:00415557 51                      push ecx
:00415558 8A55EC                  mov dl, byte ptr [ebp-14]
:0041555B 52                      push edx
:0041555C 8A45F0                  mov al, byte ptr [ebp-10]
:0041555F 50                      push eax
:00415560 8A4DCC                  mov cl, byte ptr [ebp-34]
:00415563 51                      push ecx
:00415564 8A55D0                  mov dl, byte ptr [ebp-30]
:00415567 52                      push edx
:00415568 B9F05D4B00              mov ecx, 004B5DF0
:0041556D E873580400              call 0045ADE5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041550E(C), :0041554C(U)
|
:00415572 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041510F(U), :00415138(U), :00415158(U), :00415178(U), :00415198(U)
|:004151B8(U), :004151D8(U), :00415201(U), :00415228(U), :00415251(U)
|:0041527A(U), :0041529A(U), :004152BA(U), :004152CD(U), :00415352(U)
|
:00415577 8BE5                    mov esp, ebp
:00415579 5D                      pop ebp
:0041557A C3                      ret



* Referenced by a CALL at Address:
|:00410FBE   
|
:0041557B 55                      push ebp
:0041557C 8BEC                    mov ebp, esp
:0041557E 83EC20                  sub esp, 00000020
:00415581 6A2C                    push 0000002C
:00415583 8B4D08                  mov ecx, dword ptr [ebp+08]
:00415586 E86C2E0000              call 004183F7
:0041558B 668945EC                mov word ptr [ebp-14], ax
:0041558F 8B45EC                  mov eax, dword ptr [ebp-14]
:00415592 25FFFF0000              and eax, 0000FFFF
:00415597 3D00800000              cmp eax, 00008000
:0041559C 750A                    jne 004155A8
:0041559E B805000000              mov eax, 00000005
:004155A3 E9C5010000              jmp 0041576D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041559C(C)
|
:004155A8 6A02                    push 00000002
:004155AA 8B4D08                  mov ecx, dword ptr [ebp+08]
:004155AD E8452E0000              call 004183F7
:004155B2 668945F8                mov word ptr [ebp-08], ax
:004155B6 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004155B9 81E1FFFF0000            and ecx, 0000FFFF
:004155BF 81F900800000            cmp ecx, 00008000
:004155C5 750A                    jne 004155D1
:004155C7 B805000000              mov eax, 00000005
:004155CC E99C010000              jmp 0041576D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004155C5(C)
|
:004155D1 6A04                    push 00000004
:004155D3 8B4D08                  mov ecx, dword ptr [ebp+08]
:004155D6 E81C2E0000              call 004183F7
:004155DB 8945E8                  mov dword ptr [ebp-18], eax
:004155DE 817DE800000080          cmp dword ptr [ebp-18], 80000000
:004155E5 750A                    jne 004155F1
:004155E7 B805000000              mov eax, 00000005
:004155EC E97C010000              jmp 0041576D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004155E5(C)
|
:004155F1 6A04                    push 00000004
:004155F3 8B4D08                  mov ecx, dword ptr [ebp+08]
:004155F6 E8FC2D0000              call 004183F7
:004155FB 8945E0                  mov dword ptr [ebp-20], eax
:004155FE 817DE000000080          cmp dword ptr [ebp-20], 80000000
:00415605 750A                    jne 00415611
:00415607 B805000000              mov eax, 00000005
:0041560C E95C010000              jmp 0041576D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415605(C)
|
:00415611 6A04                    push 00000004
:00415613 8B4D08                  mov ecx, dword ptr [ebp+08]
:00415616 E8DC2D0000              call 004183F7
:0041561B 8945F4                  mov dword ptr [ebp-0C], eax
:0041561E 817DF400000080          cmp dword ptr [ebp-0C], 80000000
:00415625 750A                    jne 00415631
:00415627 B805000000              mov eax, 00000005
:0041562C E93C010000              jmp 0041576D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415625(C)
|
:00415631 6A04                    push 00000004
:00415633 8B4D08                  mov ecx, dword ptr [ebp+08]
:00415636 E8BC2D0000              call 004183F7
:0041563B 8945F0                  mov dword ptr [ebp-10], eax
:0041563E 817DF000000080          cmp dword ptr [ebp-10], 80000000
:00415645 750A                    jne 00415651
:00415647 B805000000              mov eax, 00000005
:0041564C E91C010000              jmp 0041576D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415645(C)
|
:00415651 6A03                    push 00000003
:00415653 8B4D08                  mov ecx, dword ptr [ebp+08]
:00415656 E89C2D0000              call 004183F7
:0041565B 668945E4                mov word ptr [ebp-1C], ax
:0041565F 8B55E4                  mov edx, dword ptr [ebp-1C]
:00415662 81E2FFFF0000            and edx, 0000FFFF
:00415668 81FA00800000            cmp edx, 00008000
:0041566E 750A                    jne 0041567A
:00415670 B805000000              mov eax, 00000005
:00415675 E9F3000000              jmp 0041576D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041566E(C)
|
:0041567A 6A26                    push 00000026
:0041567C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041567F E8732D0000              call 004183F7
:00415684 668945FC                mov word ptr [ebp-04], ax
:00415688 8B45FC                  mov eax, dword ptr [ebp-04]
:0041568B 25FFFF0000              and eax, 0000FFFF
:00415690 3D00800000              cmp eax, 00008000
:00415695 750A                    jne 004156A1
:00415697 B805000000              mov eax, 00000005
:0041569C E9CC000000              jmp 0041576D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415695(C)
|
:004156A1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004156A4 81E1FFFF0000            and ecx, 0000FFFF
:004156AA 81F9FFFF0000            cmp ecx, 0000FFFF
:004156B0 7506                    jne 004156B8
:004156B2 66C745FC0000            mov [ebp-04], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004156B0(C)
|
:004156B8 E86562FFFF              call 0040B922
:004156BD 85C0                    test eax, eax
:004156BF 750A                    jne 004156CB
:004156C1 B801000000              mov eax, 00000001
:004156C6 E9A2000000              jmp 0041576D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004156BF(C)
|
:004156CB 8B55EC                  mov edx, dword ptr [ebp-14]
:004156CE 81E2FFFF0000            and edx, 0000FFFF
:004156D4 85D2                    test edx, edx
:004156D6 754F                    jne 00415727
:004156D8 8B45F8                  mov eax, dword ptr [ebp-08]
:004156DB 25FFFF0000              and eax, 0000FFFF
:004156E0 3D00040000              cmp eax, 00000400
:004156E5 7C1F                    jl 00415706
:004156E7 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004156EA 81E1FFFF0000            and ecx, 0000FFFF
:004156F0 81F902040000            cmp ecx, 00000402
:004156F6 7F0E                    jg 00415706
:004156F8 B9F05D4B00              mov ecx, 004B5DF0
:004156FD E829090400              call 0045602B
:00415702 668945F8                mov word ptr [ebp-08], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004156E5(C), :004156F6(C)
|
:00415706 8B55FC                  mov edx, dword ptr [ebp-04]
:00415709 81E2FFFF0000            and edx, 0000FFFF
:0041570F 52                      push edx
:00415710 6A00                    push 00000000
:00415712 8B45F8                  mov eax, dword ptr [ebp-08]
:00415715 25FFFF0000              and eax, 0000FFFF
:0041571A 50                      push eax
:0041571B B9F05D4B00              mov ecx, 004B5DF0
:00415720 E892500400              call 0045A7B7
:00415725 EB41                    jmp 00415768

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004156D6(C)
|
:00415727 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0041572A 81E1FFFF0000            and ecx, 0000FFFF
:00415730 81F9FFFF0000            cmp ecx, 0000FFFF
:00415736 7506                    jne 0041573E
:00415738 66C745E40600            mov [ebp-1C], 0006

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415736(C)
|
:0041573E 6A00                    push 00000000
:00415740 8B55FC                  mov edx, dword ptr [ebp-04]
:00415743 81E2FFFF0000            and edx, 0000FFFF
:00415749 52                      push edx
:0041574A 8A45E4                  mov al, byte ptr [ebp-1C]
:0041574D 50                      push eax
:0041574E 8A4DF0                  mov cl, byte ptr [ebp-10]
:00415751 51                      push ecx
:00415752 8A55F4                  mov dl, byte ptr [ebp-0C]
:00415755 52                      push edx
:00415756 8A45E0                  mov al, byte ptr [ebp-20]
:00415759 50                      push eax
:0041575A 8A4DE8                  mov cl, byte ptr [ebp-18]
:0041575D 51                      push ecx
:0041575E B9F05D4B00              mov ecx, 004B5DF0
:00415763 E8A7500400              call 0045A80F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415725(U)
|
:00415768 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004155A3(U), :004155CC(U), :004155EC(U), :0041560C(U), :0041562C(U)
|:0041564C(U), :00415675(U), :0041569C(U), :004156C6(U)
|
:0041576D 8BE5                    mov esp, ebp
:0041576F 5D                      pop ebp
:00415770 C3                      ret



* Referenced by a CALL at Address:
|:00410FCF   
|
:00415771 55                      push ebp
:00415772 8BEC                    mov ebp, esp
:00415774 E8A961FFFF              call 0040B922
:00415779 85C0                    test eax, eax
:0041577B 7507                    jne 00415784
:0041577D B801000000              mov eax, 00000001
:00415782 EB0F                    jmp 00415793

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041577B(C)
|
:00415784 B9083D4B00              mov ecx, 004B3D08
:00415789 E875740300              call 0044CC03
:0041578E B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415782(U)
|
:00415793 5D                      pop ebp
:00415794 C3                      ret



* Referenced by a CALL at Address:
|:00410F14   
|
:00415795 55                      push ebp
:00415796 8BEC                    mov ebp, esp
:00415798 E88561FFFF              call 0040B922
:0041579D 85C0                    test eax, eax
:0041579F 740C                    je 004157AD
:004157A1 6A02                    push 00000002
:004157A3 B9F05D4B00              mov ecx, 004B5DF0
:004157A8 E850080400              call 00455FFD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041579F(C)
|
:004157AD B801000000              mov eax, 00000001
:004157B2 5D                      pop ebp
:004157B3 C3                      ret



* Referenced by a CALL at Address:
|:00410C8E   
|
:004157B4 55                      push ebp
:004157B5 8BEC                    mov ebp, esp
:004157B7 83EC08                  sub esp, 00000008
:004157BA 6A1E                    push 0000001E
:004157BC 8B4D08                  mov ecx, dword ptr [ebp+08]
:004157BF E8332C0000              call 004183F7
:004157C4 668945FC                mov word ptr [ebp-04], ax
:004157C8 8B45FC                  mov eax, dword ptr [ebp-04]
:004157CB 25FFFF0000              and eax, 0000FFFF
:004157D0 3D00800000              cmp eax, 00008000
:004157D5 7507                    jne 004157DE
:004157D7 B805000000              mov eax, 00000005
:004157DC EB3A                    jmp 00415818

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004157D5(C)
|
:004157DE 6A04                    push 00000004
:004157E0 8B4D08                  mov ecx, dword ptr [ebp+08]
:004157E3 E80F2C0000              call 004183F7
:004157E8 8945F8                  mov dword ptr [ebp-08], eax
:004157EB 817DF800000080          cmp dword ptr [ebp-08], 80000000
:004157F2 7507                    jne 004157FB
:004157F4 B805000000              mov eax, 00000005
:004157F9 EB1D                    jmp 00415818

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004157F2(C)
|
:004157FB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004157FE 51                      push ecx
:004157FF 8B55FC                  mov edx, dword ptr [ebp-04]
:00415802 81E2FFFF0000            and edx, 0000FFFF
:00415808 52                      push edx
:00415809 B9B0694B00              mov ecx, 004B69B0
:0041580E E8F4F10500              call 00474A07
:00415813 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004157DC(U), :004157F9(U)
|
:00415818 8BE5                    mov esp, ebp
:0041581A 5D                      pop ebp
:0041581B C3                      ret



* Referenced by a CALL at Address:
|:00410C9F   
|
:0041581C 55                      push ebp
:0041581D 8BEC                    mov ebp, esp
:0041581F 51                      push ecx
:00415820 6A09                    push 00000009
:00415822 8B4D08                  mov ecx, dword ptr [ebp+08]
:00415825 E8CD2B0000              call 004183F7
:0041582A 668945FC                mov word ptr [ebp-04], ax
:0041582E 8B45FC                  mov eax, dword ptr [ebp-04]
:00415831 25FFFF0000              and eax, 0000FFFF
:00415836 3D00800000              cmp eax, 00008000
:0041583B 7507                    jne 00415844
:0041583D B805000000              mov eax, 00000005
:00415842 EB48                    jmp 0041588C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041583B(C)
|
:00415844 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00415847 81E1FFFF0000            and ecx, 0000FFFF
:0041584D 81F9FF000000            cmp ecx, 000000FF
:00415853 7419                    je 0041586E
:00415855 8B55FC                  mov edx, dword ptr [ebp-04]
:00415858 81E2FFFF0000            and edx, 0000FFFF
:0041585E 83C202                  add edx, 00000002
:00415861 52                      push edx
:00415862 B9B8694B00              mov ecx, 004B69B8
:00415867 E892ED0500              call 004745FE
:0041586C EB19                    jmp 00415887

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415853(C)
|
:0041586E 68FF000000              push 000000FF
:00415873 B970074B00              mov ecx, 004B0770
:00415878 E8A3340000              call 00418D20
:0041587D B9B8694B00              mov ecx, 004B69B8
:00415882 E892ED0500              call 00474619

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041586C(U)
|
:00415887 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415842(U)
|
:0041588C 8BE5                    mov esp, ebp
:0041588E 5D                      pop ebp
:0041588F C3                      ret



* Referenced by a CALL at Address:
|:00410B07   
|
:00415890 55                      push ebp
:00415891 8BEC                    mov ebp, esp
:00415893 E88A60FFFF              call 0040B922
:00415898 85C0                    test eax, eax
:0041589A 740C                    je 004158A8
:0041589C 6A03                    push 00000003
:0041589E B9F05D4B00              mov ecx, 004B5DF0
:004158A3 E855070400              call 00455FFD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041589A(C)
|
:004158A8 B801000000              mov eax, 00000001
:004158AD 5D                      pop ebp
:004158AE C3                      ret



* Referenced by a CALL at Address:
|:00410B18   
|
:004158AF 55                      push ebp
:004158B0 8BEC                    mov ebp, esp
:004158B2 51                      push ecx
:004158B3 6A12                    push 00000012
:004158B5 8B4D08                  mov ecx, dword ptr [ebp+08]
:004158B8 E83A2B0000              call 004183F7
:004158BD 668945FC                mov word ptr [ebp-04], ax
:004158C1 8B45FC                  mov eax, dword ptr [ebp-04]
:004158C4 25FFFF0000              and eax, 0000FFFF
:004158C9 3D00800000              cmp eax, 00008000
:004158CE 7507                    jne 004158D7
:004158D0 B805000000              mov eax, 00000005
:004158D5 EB32                    jmp 00415909

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004158CE(C)
|
:004158D7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004158DA 81E1FFFF0000            and ecx, 0000FFFF
:004158E0 83F902                  cmp ecx, 00000002
:004158E3 7F0E                    jg 004158F3
:004158E5 6A01                    push 00000001
:004158E7 8A55FC                  mov dl, byte ptr [ebp-04]
:004158EA 52                      push edx
:004158EB E8C0480000              call 0041A1B0
:004158F0 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004158E3(C)
|
:004158F3 8B45FC                  mov eax, dword ptr [ebp-04]
:004158F6 25FFFF0000              and eax, 0000FFFF
:004158FB 50                      push eax
:004158FC E8C55E0100              call 0042B7C6
:00415901 83C404                  add esp, 00000004
:00415904 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004158D5(U)
|
:00415909 8BE5                    mov esp, ebp
:0041590B 5D                      pop ebp
:0041590C C3                      ret



* Referenced by a CALL at Address:
|:0041108A   
|
:0041590D 55                      push ebp
:0041590E 8BEC                    mov ebp, esp
:00415910 E844DA0100              call 00433359
:00415915 B801000000              mov eax, 00000001
:0041591A 5D                      pop ebp
:0041591B C3                      ret



* Referenced by a CALL at Address:
|:00410FE0   
|
:0041591C 55                      push ebp
:0041591D 8BEC                    mov ebp, esp
:0041591F 83EC24                  sub esp, 00000024
:00415922 6A40                    push 00000040
:00415924 8B4D08                  mov ecx, dword ptr [ebp+08]
:00415927 E8CB2A0000              call 004183F7
:0041592C 668945F0                mov word ptr [ebp-10], ax
:00415930 8B45F0                  mov eax, dword ptr [ebp-10]
:00415933 25FFFF0000              and eax, 0000FFFF
:00415938 3D00800000              cmp eax, 00008000
:0041593D 750A                    jne 00415949
:0041593F B805000000              mov eax, 00000005
:00415944 E98A010000              jmp 00415AD3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041593D(C)
|
:00415949 6A02                    push 00000002
:0041594B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041594E E8A42A0000              call 004183F7
:00415953 668945FC                mov word ptr [ebp-04], ax
:00415957 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041595A 81E1FFFF0000            and ecx, 0000FFFF
:00415960 81F900800000            cmp ecx, 00008000
:00415966 750A                    jne 00415972
:00415968 B805000000              mov eax, 00000005
:0041596D E961010000              jmp 00415AD3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415966(C)
|
:00415972 6A04                    push 00000004
:00415974 8B4D08                  mov ecx, dword ptr [ebp+08]
:00415977 E87B2A0000              call 004183F7
:0041597C 8945F8                  mov dword ptr [ebp-08], eax
:0041597F 817DF800000080          cmp dword ptr [ebp-08], 80000000
:00415986 750A                    jne 00415992
:00415988 B805000000              mov eax, 00000005
:0041598D E941010000              jmp 00415AD3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415986(C)
|
:00415992 6A04                    push 00000004
:00415994 8B4D08                  mov ecx, dword ptr [ebp+08]
:00415997 E85B2A0000              call 004183F7
:0041599C 8945EC                  mov dword ptr [ebp-14], eax
:0041599F 817DEC00000080          cmp dword ptr [ebp-14], 80000000
:004159A6 750A                    jne 004159B2
:004159A8 B805000000              mov eax, 00000005
:004159AD E921010000              jmp 00415AD3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004159A6(C)
|
:004159B2 6A04                    push 00000004
:004159B4 8B4D08                  mov ecx, dword ptr [ebp+08]
:004159B7 E83B2A0000              call 004183F7
:004159BC 8945E8                  mov dword ptr [ebp-18], eax
:004159BF 817DE800000080          cmp dword ptr [ebp-18], 80000000
:004159C6 750A                    jne 004159D2
:004159C8 B805000000              mov eax, 00000005
:004159CD E901010000              jmp 00415AD3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004159C6(C)
|
:004159D2 6A2B                    push 0000002B
:004159D4 8B4D08                  mov ecx, dword ptr [ebp+08]
:004159D7 E81B2A0000              call 004183F7
:004159DC 668945F4                mov word ptr [ebp-0C], ax
:004159E0 8B55F4                  mov edx, dword ptr [ebp-0C]
:004159E3 81E2FFFF0000            and edx, 0000FFFF
:004159E9 81FA00800000            cmp edx, 00008000
:004159EF 750A                    jne 004159FB
:004159F1 B805000000              mov eax, 00000005
:004159F6 E9D8000000              jmp 00415AD3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004159EF(C)
|
:004159FB 8B45F0                  mov eax, dword ptr [ebp-10]
:004159FE 25FFFF0000              and eax, 0000FFFF
:00415A03 3DFFFF0000              cmp eax, 0000FFFF
:00415A08 7506                    jne 00415A10
:00415A0A 66C745F00000            mov [ebp-10], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415A08(C)
|
:00415A10 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00415A13 81E1FFFF0000            and ecx, 0000FFFF
:00415A19 81F9FFFF0000            cmp ecx, 0000FFFF
:00415A1F 7506                    jne 00415A27
:00415A21 66C745F40200            mov [ebp-0C], 0002

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415A1F(C)
|
:00415A27 E8F65EFFFF              call 0040B922
:00415A2C 85C0                    test eax, eax
:00415A2E 0F849A000000            je 00415ACE
:00415A34 C745E4FFFF0000          mov [ebp-1C], 0000FFFF
:00415A3B 8B55F0                  mov edx, dword ptr [ebp-10]
:00415A3E 81E2FFFF0000            and edx, 0000FFFF
:00415A44 83FA01                  cmp edx, 00000001
:00415A47 7542                    jne 00415A8B
:00415A49 837DF80F                cmp dword ptr [ebp-08], 0000000F
:00415A4D 733C                    jnb 00415A8B
:00415A4F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00415A52 6BC924                  imul ecx, 00000024
:00415A55 81C1502C4B00            add ecx, 004B2C50
:00415A5B E830320000              call 00418C90
:00415A60 25FF000000              and eax, 000000FF
:00415A65 83F803                  cmp eax, 00000003
:00415A68 751F                    jne 00415A89
:00415A6A 8B45F8                  mov eax, dword ptr [ebp-08]
:00415A6D 50                      push eax
:00415A6E B9902F4900              mov ecx, 00492F90
:00415A73 E858330000              call 00418DD0
:00415A78 8945DC                  mov dword ptr [ebp-24], eax
:00415A7B 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00415A7E 894DE0                  mov dword ptr [ebp-20], ecx
:00415A81 8B55E0                  mov edx, dword ptr [ebp-20]
:00415A84 8B02                    mov eax, dword ptr [edx]
:00415A86 8945E4                  mov dword ptr [ebp-1C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415A68(C)
|
:00415A89 EB19                    jmp 00415AA4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00415A47(C), :00415A4D(C)
|
:00415A8B 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00415A8E 81E1FFFF0000            and ecx, 0000FFFF
:00415A94 85C9                    test ecx, ecx
:00415A96 750C                    jne 00415AA4
:00415A98 8B55FC                  mov edx, dword ptr [ebp-04]
:00415A9B 81E2FFFF0000            and edx, 0000FFFF
:00415AA1 8955E4                  mov dword ptr [ebp-1C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00415A89(U), :00415A96(C)
|
:00415AA4 817DE4FFFF0000          cmp dword ptr [ebp-1C], 0000FFFF
:00415AAB 7421                    je 00415ACE
:00415AAD 8A45F4                  mov al, byte ptr [ebp-0C]
:00415AB0 50                      push eax
:00415AB1 8A4DE8                  mov cl, byte ptr [ebp-18]
:00415AB4 51                      push ecx
:00415AB5 8A55EC                  mov dl, byte ptr [ebp-14]
:00415AB8 52                      push edx
:00415AB9 8B45E4                  mov eax, dword ptr [ebp-1C]
:00415ABC 50                      push eax
:00415ABD B9F05D4B00              mov ecx, 004B5DF0
:00415AC2 E8DA360400              call 004591A1
:00415AC7 B801000000              mov eax, 00000001
:00415ACC EB05                    jmp 00415AD3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00415A2E(C), :00415AAB(C)
|
:00415ACE B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00415944(U), :0041596D(U), :0041598D(U), :004159AD(U), :004159CD(U)
|:004159F6(U), :00415ACC(U)
|
:00415AD3 8BE5                    mov esp, ebp
:00415AD5 5D                      pop ebp
:00415AD6 C3                      ret



* Referenced by a CALL at Address:
|:00410AC3   
|
:00415AD7 55                      push ebp
:00415AD8 8BEC                    mov ebp, esp
:00415ADA 51                      push ecx
:00415ADB C745FC00000000          mov [ebp-04], 00000000
:00415AE2 EB09                    jmp 00415AED

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415B04(U)
|
:00415AE4 8B45FC                  mov eax, dword ptr [ebp-04]
:00415AE7 83C001                  add eax, 00000001
:00415AEA 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415AE2(U)
|
:00415AED 817DFC00010000          cmp dword ptr [ebp-04], 00000100
:00415AF4 7310                    jnb 00415B06
:00415AF6 6A00                    push 00000000
:00415AF8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00415AFB 51                      push ecx
:00415AFC 8B4D08                  mov ecx, dword ptr [ebp+08]
:00415AFF E8CD290000              call 004184D1
:00415B04 EBDE                    jmp 00415AE4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415AF4(C)
|
:00415B06 B801000000              mov eax, 00000001
:00415B0B 8BE5                    mov esp, ebp
:00415B0D 5D                      pop ebp
:00415B0E C3                      ret



* Referenced by a CALL at Address:
|:00410AB2   
|
:00415B0F 55                      push ebp
:00415B10 8BEC                    mov ebp, esp
:00415B12 51                      push ecx
:00415B13 6A04                    push 00000004
:00415B15 8B4D08                  mov ecx, dword ptr [ebp+08]
:00415B18 E8DA280000              call 004183F7
:00415B1D 8945FC                  mov dword ptr [ebp-04], eax
:00415B20 817DFC00000080          cmp dword ptr [ebp-04], 80000000
:00415B27 7507                    jne 00415B30
:00415B29 B805000000              mov eax, 00000005
:00415B2E EB11                    jmp 00415B41

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415B27(C)
|
:00415B30 8B45FC                  mov eax, dword ptr [ebp-04]
:00415B33 50                      push eax
:00415B34 E8E9690100              call 0042C522
:00415B39 83C404                  add esp, 00000004
:00415B3C B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415B2E(U)
|
:00415B41 8BE5                    mov esp, ebp
:00415B43 5D                      pop ebp
:00415B44 C3                      ret



* Referenced by a CALL at Address:
|:00410A7F   
|
:00415B45 55                      push ebp
:00415B46 8BEC                    mov ebp, esp
:00415B48 83EC0C                  sub esp, 0000000C
:00415B4B 6A2E                    push 0000002E
:00415B4D 8B4D08                  mov ecx, dword ptr [ebp+08]
:00415B50 E8A2280000              call 004183F7
:00415B55 668945FC                mov word ptr [ebp-04], ax
:00415B59 8B45FC                  mov eax, dword ptr [ebp-04]
:00415B5C 25FFFF0000              and eax, 0000FFFF
:00415B61 3D00800000              cmp eax, 00008000
:00415B66 750A                    jne 00415B72
:00415B68 B805000000              mov eax, 00000005
:00415B6D E9D0000000              jmp 00415C42

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415B66(C)
|
:00415B72 6A04                    push 00000004
:00415B74 8B4D08                  mov ecx, dword ptr [ebp+08]
:00415B77 E87B280000              call 004183F7
:00415B7C 8945F8                  mov dword ptr [ebp-08], eax
:00415B7F 817DF800000080          cmp dword ptr [ebp-08], 80000000
:00415B86 750A                    jne 00415B92
:00415B88 B805000000              mov eax, 00000005
:00415B8D E9B0000000              jmp 00415C42

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415B86(C)
|
:00415B92 C645F400                mov [ebp-0C], 00
:00415B96 EB09                    jmp 00415BA1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415BC9(U)
|
:00415B98 8A4DF4                  mov cl, byte ptr [ebp-0C]
:00415B9B 80C101                  add cl, 01
:00415B9E 884DF4                  mov byte ptr [ebp-0C], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415B96(U)
|
:00415BA1 8B55F4                  mov edx, dword ptr [ebp-0C]
:00415BA4 81E2FF000000            and edx, 000000FF
:00415BAA 83FA05                  cmp edx, 00000005
:00415BAD 7D1C                    jge 00415BCB
:00415BAF 6A38                    push 00000038
:00415BB1 8B4D08                  mov ecx, dword ptr [ebp+08]
:00415BB4 E83E280000              call 004183F7
:00415BB9 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00415BBC 81E1FF000000            and ecx, 000000FF
:00415BC2 89048DF0094B00          mov dword ptr [4*ecx+004B09F0], eax
:00415BC9 EBCD                    jmp 00415B98

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415BAD(C)
|
:00415BCB C645F400                mov [ebp-0C], 00
:00415BCF EB09                    jmp 00415BDA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415C01(U)
|
:00415BD1 8A55F4                  mov dl, byte ptr [ebp-0C]
:00415BD4 80C201                  add dl, 01
:00415BD7 8855F4                  mov byte ptr [ebp-0C], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415BCF(U)
|
:00415BDA 8B45F4                  mov eax, dword ptr [ebp-0C]
:00415BDD 25FF000000              and eax, 000000FF
:00415BE2 83F805                  cmp eax, 00000005
:00415BE5 7D1C                    jge 00415C03
:00415BE7 6A39                    push 00000039
:00415BE9 8B4D08                  mov ecx, dword ptr [ebp+08]
:00415BEC E806280000              call 004183F7
:00415BF1 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00415BF4 81E1FF000000            and ecx, 000000FF
:00415BFA 89048D040A4B00          mov dword ptr [4*ecx+004B0A04], eax
:00415C01 EBCE                    jmp 00415BD1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415BE5(C)
|
:00415C03 837DF800                cmp dword ptr [ebp-08], 00000000
:00415C07 7507                    jne 00415C10
:00415C09 C745F801000000          mov [ebp-08], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415C07(C)
|
:00415C10 8A55F8                  mov dl, byte ptr [ebp-08]
:00415C13 8815EC094B00            mov byte ptr [004B09EC], dl
:00415C19 8B45FC                  mov eax, dword ptr [ebp-04]
:00415C1C 25FFFF0000              and eax, 0000FFFF
:00415C21 85C0                    test eax, eax
:00415C23 740E                    je 00415C33
:00415C25 6A00                    push 00000000
:00415C27 B9386F4900              mov ecx, 00496F38
:00415C2C E8F1400000              call 00419D22
:00415C31 EB0A                    jmp 00415C3D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415C23(C)
|
:00415C33 B9386F4900              mov ecx, 00496F38
:00415C38 E8A5430000              call 00419FE2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415C31(U)
|
:00415C3D B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00415B6D(U), :00415B8D(U)
|
:00415C42 8BE5                    mov esp, ebp
:00415C44 5D                      pop ebp
:00415C45 C3                      ret



* Referenced by a CALL at Address:
|:00410A90   
|
:00415C46 55                      push ebp
:00415C47 8BEC                    mov ebp, esp
:00415C49 833DC0E44A0000          cmp dword ptr [004AE4C0], 00000000
:00415C50 7411                    je 00415C63
:00415C52 C705C0E44A0000000000    mov dword ptr [004AE4C0], 00000000
:00415C5C B801000000              mov eax, 00000001
:00415C61 EB02                    jmp 00415C65

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415C50(C)
|
:00415C63 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415C61(U)
|
:00415C65 5D                      pop ebp
:00415C66 C3                      ret



* Referenced by a CALL at Address:
|:00410B29   
|
:00415C67 55                      push ebp
:00415C68 8BEC                    mov ebp, esp
:00415C6A 83EC08                  sub esp, 00000008
:00415C6D 6A37                    push 00000037
:00415C6F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00415C72 E880270000              call 004183F7
:00415C77 668945FC                mov word ptr [ebp-04], ax
:00415C7B 8B45FC                  mov eax, dword ptr [ebp-04]
:00415C7E 25FFFF0000              and eax, 0000FFFF
:00415C83 3D00800000              cmp eax, 00008000
:00415C88 7507                    jne 00415C91
:00415C8A B805000000              mov eax, 00000005
:00415C8F EB2A                    jmp 00415CBB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415C88(C)
|
:00415C91 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00415C94 81E1FFFF0000            and ecx, 0000FFFF
:00415C9A 81E1FF000000            and ecx, 000000FF
:00415CA0 884DF8                  mov byte ptr [ebp-08], cl
:00415CA3 E82D0F0100              call 00426BD5
:00415CA8 8A55F8                  mov dl, byte ptr [ebp-08]
:00415CAB 52                      push edx
:00415CAC B970074B00              mov ecx, 004B0770
:00415CB1 E8AA300000              call 00418D60
:00415CB6 B809000000              mov eax, 00000009

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415C8F(U)
|
:00415CBB 8BE5                    mov esp, ebp
:00415CBD 5D                      pop ebp
:00415CBE C3                      ret



* Referenced by a CALL at Address:
|:00410E37   
|
:00415CBF 55                      push ebp
:00415CC0 8BEC                    mov ebp, esp
:00415CC2 83EC0C                  sub esp, 0000000C
:00415CC5 6A02                    push 00000002
:00415CC7 8B4D08                  mov ecx, dword ptr [ebp+08]
:00415CCA E828270000              call 004183F7
:00415CCF 668945FC                mov word ptr [ebp-04], ax
:00415CD3 8B45FC                  mov eax, dword ptr [ebp-04]
:00415CD6 25FFFF0000              and eax, 0000FFFF
:00415CDB 3D00800000              cmp eax, 00008000
:00415CE0 750A                    jne 00415CEC
:00415CE2 B805000000              mov eax, 00000005
:00415CE7 E9A2000000              jmp 00415D8E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415CE0(C)
|
:00415CEC 6A0E                    push 0000000E
:00415CEE 8B4D08                  mov ecx, dword ptr [ebp+08]
:00415CF1 E801270000              call 004183F7
:00415CF6 668945F4                mov word ptr [ebp-0C], ax
:00415CFA 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00415CFD 81E1FFFF0000            and ecx, 0000FFFF
:00415D03 81F900800000            cmp ecx, 00008000
:00415D09 7507                    jne 00415D12
:00415D0B B805000000              mov eax, 00000005
:00415D10 EB7C                    jmp 00415D8E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415D09(C)
|
:00415D12 6A3A                    push 0000003A
:00415D14 8B4D08                  mov ecx, dword ptr [ebp+08]
:00415D17 E8DB260000              call 004183F7
:00415D1C 668945F8                mov word ptr [ebp-08], ax
:00415D20 8B55F8                  mov edx, dword ptr [ebp-08]
:00415D23 81E2FFFF0000            and edx, 0000FFFF
:00415D29 81FA00800000            cmp edx, 00008000
:00415D2F 7507                    jne 00415D38
:00415D31 B805000000              mov eax, 00000005
:00415D36 EB56                    jmp 00415D8E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415D2F(C)
|
:00415D38 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00415D3B 81E1FFFF0000            and ecx, 0000FFFF
:00415D41 6BC948                  imul ecx, 00000048
:00415D44 81C1681B4A00            add ecx, 004A1B68
:00415D4A E831300000              call 00418D80
:00415D4F 25FF000000              and eax, 000000FF
:00415D54 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00415D57 81E1FFFF0000            and ecx, 0000FFFF
:00415D5D 3BC1                    cmp eax, ecx
:00415D5F 7418                    je 00415D79
:00415D61 8B55F8                  mov edx, dword ptr [ebp-08]
:00415D64 81E2FFFF0000            and edx, 0000FFFF
:00415D6A 85D2                    test edx, edx
:00415D6C 7404                    je 00415D72
:00415D6E 33C0                    xor eax, eax
:00415D70 EB1C                    jmp 00415D8E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415D6C(C)
|
:00415D72 B801000000              mov eax, 00000001
:00415D77 EB15                    jmp 00415D8E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415D5F(C)
|
:00415D79 8B45F8                  mov eax, dword ptr [ebp-08]
:00415D7C 25FFFF0000              and eax, 0000FFFF
:00415D81 85C0                    test eax, eax
:00415D83 7407                    je 00415D8C
:00415D85 B801000000              mov eax, 00000001
:00415D8A EB02                    jmp 00415D8E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415D83(C)
|
:00415D8C 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00415CE7(U), :00415D10(U), :00415D36(U), :00415D70(U), :00415D77(U)
|:00415D8A(U)
|
:00415D8E 8BE5                    mov esp, ebp
:00415D90 5D                      pop ebp
:00415D91 C3                      ret



* Referenced by a CALL at Address:
|:00410F25   
|
:00415D92 55                      push ebp
:00415D93 8BEC                    mov ebp, esp
:00415D95 83EC08                  sub esp, 00000008
:00415D98 6A04                    push 00000004
:00415D9A 8B4D08                  mov ecx, dword ptr [ebp+08]
:00415D9D E855260000              call 004183F7
:00415DA2 8945FC                  mov dword ptr [ebp-04], eax
:00415DA5 817DFC00000080          cmp dword ptr [ebp-04], 80000000
:00415DAC 7507                    jne 00415DB5
:00415DAE B805000000              mov eax, 00000005
:00415DB3 EB78                    jmp 00415E2D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415DAC(C)
|
:00415DB5 837DFC00                cmp dword ptr [ebp-04], 00000000
:00415DB9 7507                    jne 00415DC2
:00415DBB C745FC01000000          mov [ebp-04], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415DB9(C)
|
:00415DC2 C745F800000000          mov [ebp-08], 00000000
:00415DC9 EB09                    jmp 00415DD4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415DEE(U)
|
:00415DCB 8B45F8                  mov eax, dword ptr [ebp-08]
:00415DCE 83C001                  add eax, 00000001
:00415DD1 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415DC9(U)
|
:00415DD4 837DF805                cmp dword ptr [ebp-08], 00000005
:00415DD8 7316                    jnb 00415DF0
:00415DDA 6A38                    push 00000038
:00415DDC 8B4D08                  mov ecx, dword ptr [ebp+08]
:00415DDF E813260000              call 004183F7
:00415DE4 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00415DE7 89048DF0094B00          mov dword ptr [4*ecx+004B09F0], eax
:00415DEE EBDB                    jmp 00415DCB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415DD8(C)
|
:00415DF0 C745F800000000          mov [ebp-08], 00000000
:00415DF7 EB09                    jmp 00415E02

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415E1C(U)
|
:00415DF9 8B55F8                  mov edx, dword ptr [ebp-08]
:00415DFC 83C201                  add edx, 00000001
:00415DFF 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415DF7(U)
|
:00415E02 837DF805                cmp dword ptr [ebp-08], 00000005
:00415E06 7316                    jnb 00415E1E
:00415E08 6A39                    push 00000039
:00415E0A 8B4D08                  mov ecx, dword ptr [ebp+08]
:00415E0D E8E5250000              call 004183F7
:00415E12 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00415E15 89048D040A4B00          mov dword ptr [4*ecx+004B0A04], eax
:00415E1C EBDB                    jmp 00415DF9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415E06(C)
|
:00415E1E B9902F4900              mov ecx, 00492F90
:00415E23 E842270000              call 0041856A
:00415E28 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415DB3(U)
|
:00415E2D 8BE5                    mov esp, ebp
:00415E2F 5D                      pop ebp
:00415E30 C3                      ret



* Referenced by a CALL at Address:
|:00410F36   
|
:00415E31 55                      push ebp
:00415E32 8BEC                    mov ebp, esp
:00415E34 83EC18                  sub esp, 00000018
:00415E37 56                      push esi
:00415E38 6A04                    push 00000004
:00415E3A 8B4D08                  mov ecx, dword ptr [ebp+08]
:00415E3D E8B5250000              call 004183F7
:00415E42 8945F8                  mov dword ptr [ebp-08], eax
:00415E45 817DF800000080          cmp dword ptr [ebp-08], 80000000
:00415E4C 750A                    jne 00415E58
:00415E4E B805000000              mov eax, 00000005
:00415E53 E908010000              jmp 00415F60

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415E4C(C)
|
:00415E58 6A04                    push 00000004
:00415E5A 8B4D08                  mov ecx, dword ptr [ebp+08]
:00415E5D E895250000              call 004183F7
:00415E62 8945EC                  mov dword ptr [ebp-14], eax
:00415E65 817DEC00000080          cmp dword ptr [ebp-14], 80000000
:00415E6C 750A                    jne 00415E78
:00415E6E B805000000              mov eax, 00000005
:00415E73 E9E8000000              jmp 00415F60

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415E6C(C)
|
:00415E78 6A04                    push 00000004
:00415E7A 8B4D08                  mov ecx, dword ptr [ebp+08]
:00415E7D E875250000              call 004183F7
:00415E82 8945E8                  mov dword ptr [ebp-18], eax
:00415E85 817DE800000080          cmp dword ptr [ebp-18], 80000000
:00415E8C 750A                    jne 00415E98
:00415E8E B805000000              mov eax, 00000005
:00415E93 E9C8000000              jmp 00415F60

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415E8C(C)
|
:00415E98 6A2B                    push 0000002B
:00415E9A 8B4D08                  mov ecx, dword ptr [ebp+08]
:00415E9D E855250000              call 004183F7
:00415EA2 668945F0                mov word ptr [ebp-10], ax
:00415EA6 8B45F0                  mov eax, dword ptr [ebp-10]
:00415EA9 25FFFF0000              and eax, 0000FFFF
:00415EAE 3D00800000              cmp eax, 00008000
:00415EB3 750A                    jne 00415EBF
:00415EB5 B805000000              mov eax, 00000005
:00415EBA E9A1000000              jmp 00415F60

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415EB3(C)
|
:00415EBF 6A26                    push 00000026
:00415EC1 8B4D08                  mov ecx, dword ptr [ebp+08]
:00415EC4 E82E250000              call 004183F7
:00415EC9 668945FC                mov word ptr [ebp-04], ax
:00415ECD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00415ED0 81E1FFFF0000            and ecx, 0000FFFF
:00415ED6 81F900800000            cmp ecx, 00008000
:00415EDC 7507                    jne 00415EE5
:00415EDE B805000000              mov eax, 00000005
:00415EE3 EB7B                    jmp 00415F60

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415EDC(C)
|
:00415EE5 8B55FC                  mov edx, dword ptr [ebp-04]
:00415EE8 81E2FFFF0000            and edx, 0000FFFF
:00415EEE 81FAFFFF0000            cmp edx, 0000FFFF
:00415EF4 7506                    jne 00415EFC
:00415EF6 66C745FC0000            mov [ebp-04], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415EF4(C)
|
:00415EFC 8B45F8                  mov eax, dword ptr [ebp-08]
:00415EFF 50                      push eax
:00415F00 B9902F4900              mov ecx, 00492F90
:00415F05 E8C62E0000              call 00418DD0
:00415F0A 8945F4                  mov dword ptr [ebp-0C], eax
:00415F0D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00415F10 8139FFFF0000            cmp dword ptr [ecx], 0000FFFF
:00415F16 7443                    je 00415F5B
:00415F18 8B55F4                  mov edx, dword ptr [ebp-0C]
:00415F1B 8B4208                  mov eax, dword ptr [edx+08]
:00415F1E 83E003                  and eax, 00000003
:00415F21 85C0                    test eax, eax
:00415F23 7536                    jne 00415F5B
:00415F25 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00415F28 8A55EC                  mov dl, byte ptr [ebp-14]
:00415F2B 885104                  mov byte ptr [ecx+04], dl
:00415F2E 8B45F4                  mov eax, dword ptr [ebp-0C]
:00415F31 8A4DE8                  mov cl, byte ptr [ebp-18]
:00415F34 884805                  mov byte ptr [eax+05], cl
:00415F37 8B75FC                  mov esi, dword ptr [ebp-04]
:00415F3A 81E6FFFF0000            and esi, 0000FFFF
:00415F40 F7DE                    neg esi
:00415F42 1BF6                    sbb esi, esi
:00415F44 83E604                  and esi, 00000004
:00415F47 8A55F0                  mov dl, byte ptr [ebp-10]
:00415F4A 52                      push edx
:00415F4B E8D73B0300              call 00449B27
:00415F50 83C404                  add esp, 00000004
:00415F53 0BF0                    or esi, eax
:00415F55 8B45F4                  mov eax, dword ptr [ebp-0C]
:00415F58 897008                  mov dword ptr [eax+08], esi

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00415F16(C), :00415F23(C)
|
:00415F5B B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00415E53(U), :00415E73(U), :00415E93(U), :00415EBA(U), :00415EE3(U)
|
:00415F60 5E                      pop esi
:00415F61 8BE5                    mov esp, ebp
:00415F63 5D                      pop ebp
:00415F64 C3                      ret



* Referenced by a CALL at Address:
|:00410F7A   
|
:00415F65 55                      push ebp
:00415F66 8BEC                    mov ebp, esp
:00415F68 83EC18                  sub esp, 00000018
:00415F6B 6A02                    push 00000002
:00415F6D 8B4D08                  mov ecx, dword ptr [ebp+08]
:00415F70 E882240000              call 004183F7
:00415F75 668945FC                mov word ptr [ebp-04], ax
:00415F79 8B45FC                  mov eax, dword ptr [ebp-04]
:00415F7C 25FFFF0000              and eax, 0000FFFF
:00415F81 3D00800000              cmp eax, 00008000
:00415F86 750A                    jne 00415F92
:00415F88 B805000000              mov eax, 00000005
:00415F8D E993010000              jmp 00416125

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415F86(C)
|
:00415F92 6A02                    push 00000002
:00415F94 8B4D08                  mov ecx, dword ptr [ebp+08]
:00415F97 E85B240000              call 004183F7
:00415F9C 668945E8                mov word ptr [ebp-18], ax
:00415FA0 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00415FA3 81E1FFFF0000            and ecx, 0000FFFF
:00415FA9 81F900800000            cmp ecx, 00008000
:00415FAF 750A                    jne 00415FBB
:00415FB1 B805000000              mov eax, 00000005
:00415FB6 E96A010000              jmp 00416125

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415FAF(C)
|
:00415FBB 6A2B                    push 0000002B
:00415FBD 8B4D08                  mov ecx, dword ptr [ebp+08]
:00415FC0 E832240000              call 004183F7
:00415FC5 668945F4                mov word ptr [ebp-0C], ax
:00415FC9 8B55F4                  mov edx, dword ptr [ebp-0C]
:00415FCC 81E2FFFF0000            and edx, 0000FFFF
:00415FD2 81FA00800000            cmp edx, 00008000
:00415FD8 750A                    jne 00415FE4
:00415FDA B805000000              mov eax, 00000005
:00415FDF E941010000              jmp 00416125

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415FD8(C)
|
:00415FE4 6A26                    push 00000026
:00415FE6 8B4D08                  mov ecx, dword ptr [ebp+08]
:00415FE9 E809240000              call 004183F7
:00415FEE 668945F0                mov word ptr [ebp-10], ax
:00415FF2 8B45F0                  mov eax, dword ptr [ebp-10]
:00415FF5 25FFFF0000              and eax, 0000FFFF
:00415FFA 3D00800000              cmp eax, 00008000
:00415FFF 750A                    jne 0041600B
:00416001 B805000000              mov eax, 00000005
:00416006 E91A010000              jmp 00416125

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00415FFF(C)
|
:0041600B 6A26                    push 00000026
:0041600D 8B4D08                  mov ecx, dword ptr [ebp+08]
:00416010 E8E2230000              call 004183F7
:00416015 668945F8                mov word ptr [ebp-08], ax
:00416019 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041601C 81E1FFFF0000            and ecx, 0000FFFF
:00416022 81F900800000            cmp ecx, 00008000
:00416028 750A                    jne 00416034
:0041602A B805000000              mov eax, 00000005
:0041602F E9F1000000              jmp 00416125

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416028(C)
|
:00416034 6A26                    push 00000026
:00416036 8B4D08                  mov ecx, dword ptr [ebp+08]
:00416039 E8B9230000              call 004183F7
:0041603E 668945EC                mov word ptr [ebp-14], ax
:00416042 8B55EC                  mov edx, dword ptr [ebp-14]
:00416045 81E2FFFF0000            and edx, 0000FFFF
:0041604B 81FA00800000            cmp edx, 00008000
:00416051 750A                    jne 0041605D
:00416053 B805000000              mov eax, 00000005
:00416058 E9C8000000              jmp 00416125

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416051(C)
|
:0041605D B822B94000              mov eax, 0040B922
:00416062 85C0                    test eax, eax
:00416064 750A                    jne 00416070
:00416066 B801000000              mov eax, 00000001
:0041606B E9B5000000              jmp 00416125

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416064(C)
|
:00416070 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00416073 81E1FFFF0000            and ecx, 0000FFFF
:00416079 81F9FFFF0000            cmp ecx, 0000FFFF
:0041607F 7506                    jne 00416087
:00416081 66C745E8FFFF            mov [ebp-18], FFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041607F(C)
|
:00416087 8B55F0                  mov edx, dword ptr [ebp-10]
:0041608A 81E2FFFF0000            and edx, 0000FFFF
:00416090 81FAFFFF0000            cmp edx, 0000FFFF
:00416096 7506                    jne 0041609E
:00416098 66C745F00000            mov [ebp-10], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416096(C)
|
:0041609E 8B45F8                  mov eax, dword ptr [ebp-08]
:004160A1 25FFFF0000              and eax, 0000FFFF
:004160A6 3DFFFF0000              cmp eax, 0000FFFF
:004160AB 7506                    jne 004160B3
:004160AD 66C745F80100            mov [ebp-08], 0001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004160AB(C)
|
:004160B3 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004160B6 81E1FFFF0000            and ecx, 0000FFFF
:004160BC 81F9FFFF0000            cmp ecx, 0000FFFF
:004160C2 7506                    jne 004160CA
:004160C4 66C745EC0100            mov [ebp-14], 0001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004160C2(C)
|
:004160CA 8B55EC                  mov edx, dword ptr [ebp-14]
:004160CD 81E2FFFF0000            and edx, 0000FFFF
:004160D3 83EA01                  sub edx, 00000001
:004160D6 F7DA                    neg edx
:004160D8 1BD2                    sbb edx, edx
:004160DA 42                      inc edx
:004160DB 52                      push edx
:004160DC 8B45F8                  mov eax, dword ptr [ebp-08]
:004160DF 25FFFF0000              and eax, 0000FFFF
:004160E4 83E801                  sub eax, 00000001
:004160E7 F7D8                    neg eax
:004160E9 1BC0                    sbb eax, eax
:004160EB 40                      inc eax
:004160EC 50                      push eax
:004160ED 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004160F0 81E1FFFF0000            and ecx, 0000FFFF
:004160F6 83E901                  sub ecx, 00000001
:004160F9 F7D9                    neg ecx
:004160FB 1BC9                    sbb ecx, ecx
:004160FD 41                      inc ecx
:004160FE 51                      push ecx
:004160FF 8A55F4                  mov dl, byte ptr [ebp-0C]
:00416102 52                      push edx
:00416103 8B45E8                  mov eax, dword ptr [ebp-18]
:00416106 25FFFF0000              and eax, 0000FFFF
:0041610B 50                      push eax
:0041610C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041610F 81E1FFFF0000            and ecx, 0000FFFF
:00416115 51                      push ecx
:00416116 B9F05D4B00              mov ecx, 004B5DF0
:0041611B E808130400              call 00457428
:00416120 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00415F8D(U), :00415FB6(U), :00415FDF(U), :00416006(U), :0041602F(U)
|:00416058(U), :0041606B(U)
|
:00416125 8BE5                    mov esp, ebp
:00416127 5D                      pop ebp
:00416128 C3                      ret



* Referenced by a CALL at Address:
|:00410F8B   
|
:00416129 55                      push ebp
:0041612A 8BEC                    mov ebp, esp
:0041612C 83EC10                  sub esp, 00000010
:0041612F 6A02                    push 00000002
:00416131 8B4D08                  mov ecx, dword ptr [ebp+08]
:00416134 E8BE220000              call 004183F7
:00416139 668945F8                mov word ptr [ebp-08], ax
:0041613D 8B45F8                  mov eax, dword ptr [ebp-08]
:00416140 25FFFF0000              and eax, 0000FFFF
:00416145 3D00800000              cmp eax, 00008000
:0041614A 750A                    jne 00416156
:0041614C B805000000              mov eax, 00000005
:00416151 E910010000              jmp 00416266

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041614A(C)
|
:00416156 6A46                    push 00000046
:00416158 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041615B E897220000              call 004183F7
:00416160 668945FC                mov word ptr [ebp-04], ax
:00416164 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00416167 81E1FFFF0000            and ecx, 0000FFFF
:0041616D 81F900800000            cmp ecx, 00008000
:00416173 750A                    jne 0041617F
:00416175 B805000000              mov eax, 00000005
:0041617A E9E7000000              jmp 00416266

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416173(C)
|
:0041617F 6A26                    push 00000026
:00416181 8B4D08                  mov ecx, dword ptr [ebp+08]
:00416184 E86E220000              call 004183F7
:00416189 668945F4                mov word ptr [ebp-0C], ax
:0041618D 8B55F4                  mov edx, dword ptr [ebp-0C]
:00416190 81E2FFFF0000            and edx, 0000FFFF
:00416196 81FA00800000            cmp edx, 00008000
:0041619C 750A                    jne 004161A8
:0041619E B805000000              mov eax, 00000005
:004161A3 E9BE000000              jmp 00416266

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041619C(C)
|
:004161A8 6A26                    push 00000026
:004161AA 8B4D08                  mov ecx, dword ptr [ebp+08]
:004161AD E845220000              call 004183F7
:004161B2 668945F0                mov word ptr [ebp-10], ax
:004161B6 8B45F0                  mov eax, dword ptr [ebp-10]
:004161B9 25FFFF0000              and eax, 0000FFFF
:004161BE 3D00800000              cmp eax, 00008000
:004161C3 750A                    jne 004161CF
:004161C5 B805000000              mov eax, 00000005
:004161CA E997000000              jmp 00416266

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004161C3(C)
|
:004161CF B922B94000              mov ecx, 0040B922
:004161D4 85C9                    test ecx, ecx
:004161D6 750A                    jne 004161E2
:004161D8 B801000000              mov eax, 00000001
:004161DD E984000000              jmp 00416266

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004161D6(C)
|
:004161E2 8B55FC                  mov edx, dword ptr [ebp-04]
:004161E5 81E2FFFF0000            and edx, 0000FFFF
:004161EB 81FAFFFF0000            cmp edx, 0000FFFF
:004161F1 7507                    jne 004161FA
:004161F3 B801000000              mov eax, 00000001
:004161F8 EB6C                    jmp 00416266

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004161F1(C)
|
:004161FA 8B45F4                  mov eax, dword ptr [ebp-0C]
:004161FD 25FFFF0000              and eax, 0000FFFF
:00416202 3DFFFF0000              cmp eax, 0000FFFF
:00416207 7506                    jne 0041620F
:00416209 66C745F40100            mov [ebp-0C], 0001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416207(C)
|
:0041620F 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00416212 81E1FFFF0000            and ecx, 0000FFFF
:00416218 81F9FFFF0000            cmp ecx, 0000FFFF
:0041621E 7506                    jne 00416226
:00416220 66C745F00100            mov [ebp-10], 0001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041621E(C)
|
:00416226 8B55F0                  mov edx, dword ptr [ebp-10]
:00416229 81E2FFFF0000            and edx, 0000FFFF
:0041622F 83EA01                  sub edx, 00000001
:00416232 F7DA                    neg edx
:00416234 1BD2                    sbb edx, edx
:00416236 42                      inc edx
:00416237 52                      push edx
:00416238 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041623B 25FFFF0000              and eax, 0000FFFF
:00416240 83E801                  sub eax, 00000001
:00416243 F7D8                    neg eax
:00416245 1BC0                    sbb eax, eax
:00416247 40                      inc eax
:00416248 50                      push eax
:00416249 8A4DFC                  mov cl, byte ptr [ebp-04]
:0041624C 51                      push ecx
:0041624D 8B55F8                  mov edx, dword ptr [ebp-08]
:00416250 81E2FFFF0000            and edx, 0000FFFF
:00416256 52                      push edx
:00416257 B9F05D4B00              mov ecx, 004B5DF0
:0041625C E82E150400              call 0045778F
:00416261 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00416151(U), :0041617A(U), :004161A3(U), :004161CA(U), :004161DD(U)
|:004161F8(U)
|
:00416266 8BE5                    mov esp, ebp
:00416268 5D                      pop ebp
:00416269 C3                      ret



* Referenced by a CALL at Address:
|:00410F9C   
|
:0041626A 55                      push ebp
:0041626B 8BEC                    mov ebp, esp
:0041626D 83EC08                  sub esp, 00000008
:00416270 B822B94000              mov eax, 0040B922
:00416275 85C0                    test eax, eax
:00416277 750A                    jne 00416283
:00416279 B801000000              mov eax, 00000001
:0041627E E992000000              jmp 00416315

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416277(C)
|
:00416283 C645F800                mov [ebp-08], 00
:00416287 EB09                    jmp 00416292

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004162FA(U)
|
:00416289 8A4DF8                  mov cl, byte ptr [ebp-08]
:0041628C 80C101                  add cl, 01
:0041628F 884DF8                  mov byte ptr [ebp-08], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416287(U)
|
:00416292 8B55F8                  mov edx, dword ptr [ebp-08]
:00416295 81E2FF000000            and edx, 000000FF
:0041629B 83FA73                  cmp edx, 00000073
:0041629E 7D5C                    jge 004162FC
:004162A0 8B45F8                  mov eax, dword ptr [ebp-08]
:004162A3 25FF000000              and eax, 000000FF
:004162A8 6BC024                  imul eax, 00000024
:004162AB 05502C4B00              add eax, 004B2C50
:004162B0 8945FC                  mov dword ptr [ebp-04], eax
:004162B3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004162B6 E8D5290000              call 00418C90
:004162BB 25FF000000              and eax, 000000FF
:004162C0 83F802                  cmp eax, 00000002
:004162C3 7535                    jne 004162FA

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:004162C5 6A06                    push 00000006
:004162C7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004162CA E8C103FFFF              call 00406690
:004162CF 6A1E                    push 0000001E
:004162D1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004162D4 E8C72A0000              call 00418DA0
:004162D9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004162DC E88F930400              call 0045F670
:004162E1 8BC8                    mov ecx, eax
:004162E3 6BC948                  imul ecx, 00000048
:004162E6 81C1681B4A00            add ecx, 004A1B68
:004162EC E82A0FFFFF              call 0040721B
:004162F1 50                      push eax
:004162F2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004162F5 E8D3930200              call 0043F6CD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004162C3(C)
|
:004162FA EB8D                    jmp 00416289

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041629E(C)
|
:004162FC B950424B00              mov ecx, 004B4250
:00416301 E80DD80300              call 00453B13
:00416306 B9083D4B00              mov ecx, 004B3D08
:0041630B E87A450300              call 0044A88A
:00416310 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041627E(U)
|
:00416315 8BE5                    mov esp, ebp
:00416317 5D                      pop ebp
:00416318 C3                      ret



* Referenced by a CALL at Address:
|:00410E59   
|
:00416319 55                      push ebp
:0041631A 8BEC                    mov ebp, esp
:0041631C 83EC1C                  sub esp, 0000001C
:0041631F 6A02                    push 00000002
:00416321 8B4D08                  mov ecx, dword ptr [ebp+08]
:00416324 E8CE200000              call 004183F7
:00416329 668945F8                mov word ptr [ebp-08], ax
:0041632D 8B45F8                  mov eax, dword ptr [ebp-08]
:00416330 25FFFF0000              and eax, 0000FFFF
:00416335 3D00800000              cmp eax, 00008000
:0041633A 750A                    jne 00416346
:0041633C B805000000              mov eax, 00000005
:00416341 E9A1030000              jmp 004166E7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041633A(C)
|
:00416346 6A3B                    push 0000003B
:00416348 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041634B E8A7200000              call 004183F7
:00416350 668945F4                mov word ptr [ebp-0C], ax
:00416354 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00416357 81E1FFFF0000            and ecx, 0000FFFF
:0041635D 81F900800000            cmp ecx, 00008000
:00416363 750A                    jne 0041636F
:00416365 B805000000              mov eax, 00000005
:0041636A E978030000              jmp 004166E7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416363(C)
|
:0041636F 6A49                    push 00000049
:00416371 8B4D08                  mov ecx, dword ptr [ebp+08]
:00416374 E87E200000              call 004183F7
:00416379 668945FC                mov word ptr [ebp-04], ax
:0041637D 8B55FC                  mov edx, dword ptr [ebp-04]
:00416380 81E2FFFF0000            and edx, 0000FFFF
:00416386 81FA00800000            cmp edx, 00008000
:0041638C 750A                    jne 00416398
:0041638E B805000000              mov eax, 00000005
:00416393 E94F030000              jmp 004166E7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041638C(C)
|
:00416398 6A3C                    push 0000003C
:0041639A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041639D E855200000              call 004183F7
:004163A2 668945EC                mov word ptr [ebp-14], ax
:004163A6 8B45EC                  mov eax, dword ptr [ebp-14]
:004163A9 25FFFF0000              and eax, 0000FFFF
:004163AE 3D00800000              cmp eax, 00008000
:004163B3 750A                    jne 004163BF
:004163B5 B805000000              mov eax, 00000005
:004163BA E928030000              jmp 004166E7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004163B3(C)
|
:004163BF 6A49                    push 00000049
:004163C1 8B4D08                  mov ecx, dword ptr [ebp+08]
:004163C4 E82E200000              call 004183F7
:004163C9 668945E8                mov word ptr [ebp-18], ax
:004163CD 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004163D0 81E1FFFF0000            and ecx, 0000FFFF
:004163D6 81F900800000            cmp ecx, 00008000
:004163DC 750A                    jne 004163E8
:004163DE B805000000              mov eax, 00000005
:004163E3 E9FF020000              jmp 004166E7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004163DC(C)
|
:004163E8 6A3D                    push 0000003D
:004163EA 8B4D08                  mov ecx, dword ptr [ebp+08]
:004163ED E805200000              call 004183F7
:004163F2 668945F0                mov word ptr [ebp-10], ax
:004163F6 8B55F0                  mov edx, dword ptr [ebp-10]
:004163F9 81E2FFFF0000            and edx, 0000FFFF
:004163FF 81FA00800000            cmp edx, 00008000
:00416405 750A                    jne 00416411
:00416407 B805000000              mov eax, 00000005
:0041640C E9D6020000              jmp 004166E7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416405(C)
|
:00416411 8B45F8                  mov eax, dword ptr [ebp-08]
:00416414 25FFFF0000              and eax, 0000FFFF
:00416419 3DFFFF0000              cmp eax, 0000FFFF
:0041641E 7411                    je 00416431
:00416420 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00416423 81E1FFFF0000            and ecx, 0000FFFF
:00416429 81F900020000            cmp ecx, 00000200
:0041642F 7C07                    jl 00416438

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041641E(C)
|
:00416431 33C0                    xor eax, eax
:00416433 E9AF020000              jmp 004166E7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041642F(C)
|
:00416438 8B55F4                  mov edx, dword ptr [ebp-0C]
:0041643B 81E2FFFF0000            and edx, 0000FFFF
:00416441 81FAFFFF0000            cmp edx, 0000FFFF
:00416447 7506                    jne 0041644F
:00416449 66C745F40000            mov [ebp-0C], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416447(C)
|
:0041644F 8B45EC                  mov eax, dword ptr [ebp-14]
:00416452 25FFFF0000              and eax, 0000FFFF
:00416457 3DFFFF0000              cmp eax, 0000FFFF
:0041645C 7506                    jne 00416464
:0041645E 66C745EC0000            mov [ebp-14], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041645C(C)
|
:00416464 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00416467 81E1FFFF0000            and ecx, 0000FFFF
:0041646D 81F9FFFF0000            cmp ecx, 0000FFFF
:00416473 7506                    jne 0041647B
:00416475 66C745F00000            mov [ebp-10], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416473(C)
|
:0041647B 8B55FC                  mov edx, dword ptr [ebp-04]
:0041647E 81E2FFFF0000            and edx, 0000FFFF
:00416484 81FAFFFF0000            cmp edx, 0000FFFF
:0041648A 7506                    jne 00416492
:0041648C 66C745FC0000            mov [ebp-04], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041648A(C)
|
:00416492 8B45E8                  mov eax, dword ptr [ebp-18]
:00416495 25FFFF0000              and eax, 0000FFFF
:0041649A 3DFFFF0000              cmp eax, 0000FFFF
:0041649F 7506                    jne 004164A7
:004164A1 66C745E80000            mov [ebp-18], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041649F(C)
|
:004164A7 E87654FFFF              call 0040B922
:004164AC 85C0                    test eax, eax
:004164AE 0F851B010000            jne 004165CF
:004164B4 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004164B7 81E1FFFF0000            and ecx, 0000FFFF
:004164BD 85C9                    test ecx, ecx
:004164BF 7450                    je 00416511
:004164C1 8B55F4                  mov edx, dword ptr [ebp-0C]
:004164C4 81E2FFFF0000            and edx, 0000FFFF
:004164CA 83FA01                  cmp edx, 00000001
:004164CD 751B                    jne 004164EA
:004164CF 6A00                    push 00000000
:004164D1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004164D4 81E1FFFF0000            and ecx, 0000FFFF
:004164DA 6BC948                  imul ecx, 00000048
:004164DD 81C1681B4A00            add ecx, 004A1B68
:004164E3 E8DC18FFFF              call 00407DC4
:004164E8 EB27                    jmp 00416511

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004164CD(C)
|
:004164EA 8A45FC                  mov al, byte ptr [ebp-04]
:004164ED 50                      push eax
:004164EE 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004164F1 81E1FFFF0000            and ecx, 0000FFFF
:004164F7 51                      push ecx
:004164F8 6A00                    push 00000000
:004164FA 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004164FD 81E1FFFF0000            and ecx, 0000FFFF
:00416503 6BC948                  imul ecx, 00000048
:00416506 81C1681B4A00            add ecx, 004A1B68
:0041650C E8DB18FFFF              call 00407DEC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004164BF(C), :004164E8(U)
|
:00416511 8B55EC                  mov edx, dword ptr [ebp-14]
:00416514 81E2FFFF0000            and edx, 0000FFFF
:0041651A 85D2                    test edx, edx
:0041651C 744F                    je 0041656D
:0041651E 8B45F4                  mov eax, dword ptr [ebp-0C]
:00416521 25FFFF0000              and eax, 0000FFFF
:00416526 83F801                  cmp eax, 00000001
:00416529 751B                    jne 00416546
:0041652B 6A01                    push 00000001
:0041652D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00416530 81E1FFFF0000            and ecx, 0000FFFF
:00416536 6BC948                  imul ecx, 00000048
:00416539 81C1681B4A00            add ecx, 004A1B68
:0041653F E88018FFFF              call 00407DC4
:00416544 EB27                    jmp 0041656D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416529(C)
|
:00416546 8A4DE8                  mov cl, byte ptr [ebp-18]
:00416549 51                      push ecx
:0041654A 8B55EC                  mov edx, dword ptr [ebp-14]
:0041654D 81E2FFFF0000            and edx, 0000FFFF
:00416553 52                      push edx
:00416554 6A01                    push 00000001
:00416556 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00416559 81E1FFFF0000            and ecx, 0000FFFF
:0041655F 6BC948                  imul ecx, 00000048
:00416562 81C1681B4A00            add ecx, 004A1B68
:00416568 E87F18FFFF              call 00407DEC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041651C(C), :00416544(U)
|
:0041656D 8B45F0                  mov eax, dword ptr [ebp-10]
:00416570 25FFFF0000              and eax, 0000FFFF
:00416575 85C0                    test eax, eax
:00416577 7451                    je 004165CA
:00416579 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041657C 81E1FFFF0000            and ecx, 0000FFFF
:00416582 83F901                  cmp ecx, 00000001
:00416585 751B                    jne 004165A2
:00416587 6A02                    push 00000002
:00416589 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041658C 81E1FFFF0000            and ecx, 0000FFFF
:00416592 6BC948                  imul ecx, 00000048
:00416595 81C1681B4A00            add ecx, 004A1B68
:0041659B E82418FFFF              call 00407DC4
:004165A0 EB28                    jmp 004165CA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416585(C)
|
:004165A2 68FF000000              push 000000FF
:004165A7 8B55F0                  mov edx, dword ptr [ebp-10]
:004165AA 81E2FFFF0000            and edx, 0000FFFF
:004165B0 52                      push edx
:004165B1 6A02                    push 00000002
:004165B3 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004165B6 81E1FFFF0000            and ecx, 0000FFFF
:004165BC 6BC948                  imul ecx, 00000048
:004165BF 81C1681B4A00            add ecx, 004A1B68
:004165C5 E82218FFFF              call 00407DEC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00416577(C), :004165A0(U)
|
:004165CA E913010000              jmp 004166E2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004164AE(C)
|
:004165CF C645E400                mov [ebp-1C], 00
:004165D3 EB08                    jmp 004165DD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416645(U)
|
:004165D5 8A45E4                  mov al, byte ptr [ebp-1C]
:004165D8 0401                    add al, 01
:004165DA 8845E4                  mov byte ptr [ebp-1C], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004165D3(U)
|
:004165DD 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004165E0 81E1FF000000            and ecx, 000000FF
:004165E6 83F973                  cmp ecx, 00000073
:004165E9 7D5C                    jge 00416647
:004165EB 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004165EE 81E1FF000000            and ecx, 000000FF
:004165F4 6BC924                  imul ecx, 00000024
:004165F7 81C1502C4B00            add ecx, 004B2C50
:004165FD E88E260000              call 00418C90
:00416602 25FF000000              and eax, 000000FF
:00416607 85C0                    test eax, eax
:00416609 7426                    je 00416631
:0041660B 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0041660E 81E1FF000000            and ecx, 000000FF
:00416614 6BC924                  imul ecx, 00000024
:00416617 81C1502C4B00            add ecx, 004B2C50
:0041661D E84E900400              call 0045F670
:00416622 8B55F8                  mov edx, dword ptr [ebp-08]
:00416625 81E2FFFF0000            and edx, 0000FFFF
:0041662B 3BC2                    cmp eax, edx
:0041662D 7502                    jne 00416631
:0041662F EB16                    jmp 00416647

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00416609(C), :0041662D(C)
|
:00416631 8B45E4                  mov eax, dword ptr [ebp-1C]
:00416634 25FF000000              and eax, 000000FF
:00416639 83F872                  cmp eax, 00000072
:0041663C 7507                    jne 00416645
:0041663E 33C0                    xor eax, eax
:00416640 E9A2000000              jmp 004166E7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041663C(C)
|
:00416645 EB8E                    jmp 004165D5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004165E9(C), :0041662F(U)
|
:00416647 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041664A 81E1FFFF0000            and ecx, 0000FFFF
:00416650 85C9                    test ecx, ecx
:00416652 7426                    je 0041667A
:00416654 8A55FC                  mov dl, byte ptr [ebp-04]
:00416657 52                      push edx
:00416658 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041665B 25FFFF0000              and eax, 0000FFFF
:00416660 50                      push eax
:00416661 6A00                    push 00000000
:00416663 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00416666 81E1FF000000            and ecx, 000000FF
:0041666C 6BC924                  imul ecx, 00000024
:0041666F 81C1502C4B00            add ecx, 004B2C50
:00416675 E87FC30200              call 004429F9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416652(C)
|
:0041667A 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041667D 81E1FFFF0000            and ecx, 0000FFFF
:00416683 85C9                    test ecx, ecx
:00416685 7426                    je 004166AD
:00416687 8A55E8                  mov dl, byte ptr [ebp-18]
:0041668A 52                      push edx
:0041668B 8B45EC                  mov eax, dword ptr [ebp-14]
:0041668E 25FFFF0000              and eax, 0000FFFF
:00416693 50                      push eax
:00416694 6A01                    push 00000001
:00416696 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00416699 81E1FF000000            and ecx, 000000FF
:0041669F 6BC924                  imul ecx, 00000024
:004166A2 81C1502C4B00            add ecx, 004B2C50
:004166A8 E84CC30200              call 004429F9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416685(C)
|
:004166AD 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004166B0 81E1FFFF0000            and ecx, 0000FFFF
:004166B6 85C9                    test ecx, ecx
:004166B8 7428                    je 004166E2
:004166BA 68FF000000              push 000000FF
:004166BF 8B55F0                  mov edx, dword ptr [ebp-10]
:004166C2 81E2FFFF0000            and edx, 0000FFFF
:004166C8 52                      push edx
:004166C9 6A02                    push 00000002
:004166CB 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004166CE 81E1FF000000            and ecx, 000000FF
:004166D4 6BC924                  imul ecx, 00000024
:004166D7 81C1502C4B00            add ecx, 004B2C50
:004166DD E817C30200              call 004429F9

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004165CA(U), :004166B8(C)
|
:004166E2 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00416341(U), :0041636A(U), :00416393(U), :004163BA(U), :004163E3(U)
|:0041640C(U), :00416433(U), :00416640(U)
|
:004166E7 8BE5                    mov esp, ebp
:004166E9 5D                      pop ebp
:004166EA C3                      ret



* Referenced by a CALL at Address:
|:00411013   
|
:004166EB 55                      push ebp
:004166EC 8BEC                    mov ebp, esp
:004166EE 83EC1C                  sub esp, 0000001C
:004166F1 6A42                    push 00000042
:004166F3 8B4D08                  mov ecx, dword ptr [ebp+08]
:004166F6 E8FC1C0000              call 004183F7
:004166FB 668945F8                mov word ptr [ebp-08], ax
:004166FF 8B45F8                  mov eax, dword ptr [ebp-08]
:00416702 25FFFF0000              and eax, 0000FFFF
:00416707 3D00800000              cmp eax, 00008000
:0041670C 750A                    jne 00416718
:0041670E B805000000              mov eax, 00000005
:00416713 E96F010000              jmp 00416887

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041670C(C)
|
:00416718 6A43                    push 00000043
:0041671A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041671D E8D51C0000              call 004183F7
:00416722 668945EC                mov word ptr [ebp-14], ax
:00416726 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00416729 81E1FFFF0000            and ecx, 0000FFFF
:0041672F 81F900800000            cmp ecx, 00008000
:00416735 750A                    jne 00416741
:00416737 B805000000              mov eax, 00000005
:0041673C E946010000              jmp 00416887

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416735(C)
|
:00416741 6A44                    push 00000044
:00416743 8B4D08                  mov ecx, dword ptr [ebp+08]
:00416746 E8AC1C0000              call 004183F7
:0041674B 668945E4                mov word ptr [ebp-1C], ax
:0041674F 8B55E4                  mov edx, dword ptr [ebp-1C]
:00416752 81E2FFFF0000            and edx, 0000FFFF
:00416758 81FA00800000            cmp edx, 00008000
:0041675E 750A                    jne 0041676A
:00416760 B805000000              mov eax, 00000005
:00416765 E91D010000              jmp 00416887

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041675E(C)
|
:0041676A 6A04                    push 00000004
:0041676C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041676F E8831C0000              call 004183F7
:00416774 8945F4                  mov dword ptr [ebp-0C], eax
:00416777 817DF400000080          cmp dword ptr [ebp-0C], 80000000
:0041677E 750A                    jne 0041678A
:00416780 B805000000              mov eax, 00000005
:00416785 E9FD000000              jmp 00416887

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041677E(C)
|
:0041678A 6A04                    push 00000004
:0041678C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041678F E8631C0000              call 004183F7
:00416794 8945F0                  mov dword ptr [ebp-10], eax
:00416797 817DF000000080          cmp dword ptr [ebp-10], 80000000
:0041679E 750A                    jne 004167AA
:004167A0 B805000000              mov eax, 00000005
:004167A5 E9DD000000              jmp 00416887

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041679E(C)
|
:004167AA 6A26                    push 00000026
:004167AC 8B4D08                  mov ecx, dword ptr [ebp+08]
:004167AF E8431C0000              call 004183F7
:004167B4 668945E8                mov word ptr [ebp-18], ax
:004167B8 8B45E8                  mov eax, dword ptr [ebp-18]
:004167BB 25FFFF0000              and eax, 0000FFFF
:004167C0 3D00800000              cmp eax, 00008000
:004167C5 750A                    jne 004167D1
:004167C7 B805000000              mov eax, 00000005
:004167CC E9B6000000              jmp 00416887

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004167C5(C)
|
:004167D1 6A26                    push 00000026
:004167D3 8B4D08                  mov ecx, dword ptr [ebp+08]
:004167D6 E81C1C0000              call 004183F7
:004167DB 668945FC                mov word ptr [ebp-04], ax
:004167DF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004167E2 81E1FFFF0000            and ecx, 0000FFFF
:004167E8 81F900800000            cmp ecx, 00008000
:004167EE 750A                    jne 004167FA
:004167F0 B805000000              mov eax, 00000005
:004167F5 E98D000000              jmp 00416887

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004167EE(C)
|
:004167FA 8B55E8                  mov edx, dword ptr [ebp-18]
:004167FD 81E2FFFF0000            and edx, 0000FFFF
:00416803 81FAFFFF0000            cmp edx, 0000FFFF
:00416809 7506                    jne 00416811
:0041680B 66C745E80000            mov [ebp-18], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416809(C)
|
:00416811 8B45FC                  mov eax, dword ptr [ebp-04]
:00416814 25FFFF0000              and eax, 0000FFFF
:00416819 3DFFFF0000              cmp eax, 0000FFFF
:0041681E 7506                    jne 00416826
:00416820 66C745FC0000            mov [ebp-04], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041681E(C)
|
:00416826 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00416829 81E1FFFF0000            and ecx, 0000FFFF
:0041682F 85C9                    test ecx, ecx
:00416831 752F                    jne 00416862
:00416833 8B55FC                  mov edx, dword ptr [ebp-04]
:00416836 81E2FFFF0000            and edx, 0000FFFF
:0041683C 52                      push edx
:0041683D 8B45E8                  mov eax, dword ptr [ebp-18]
:00416840 25FFFF0000              and eax, 0000FFFF
:00416845 50                      push eax
:00416846 8A4DF8                  mov cl, byte ptr [ebp-08]
:00416849 51                      push ecx
:0041684A 8A55E4                  mov dl, byte ptr [ebp-1C]
:0041684D 52                      push edx
:0041684E 8A45F0                  mov al, byte ptr [ebp-10]
:00416851 50                      push eax
:00416852 8A4DF4                  mov cl, byte ptr [ebp-0C]
:00416855 51                      push ecx
:00416856 B9F05D4B00              mov ecx, 004B5DF0
:0041685B E8E0F80300              call 00456140
:00416860 EB20                    jmp 00416882

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416831(C)
|
:00416862 8B55E8                  mov edx, dword ptr [ebp-18]
:00416865 81E2FFFF0000            and edx, 0000FFFF
:0041686B 52                      push edx
:0041686C 8A45F8                  mov al, byte ptr [ebp-08]
:0041686F 50                      push eax
:00416870 8A4DF0                  mov cl, byte ptr [ebp-10]
:00416873 51                      push ecx
:00416874 8A55F4                  mov dl, byte ptr [ebp-0C]
:00416877 52                      push edx
:00416878 B9F05D4B00              mov ecx, 004B5DF0
:0041687D E83FFF0300              call 004567C1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416860(U)
|
:00416882 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00416713(U), :0041673C(U), :00416765(U), :00416785(U), :004167A5(U)
|:004167CC(U), :004167F5(U)
|
:00416887 8BE5                    mov esp, ebp
:00416889 5D                      pop ebp
:0041688A C3                      ret



* Referenced by a CALL at Address:
|:00411024   
|
:0041688B 55                      push ebp
:0041688C 8BEC                    mov ebp, esp
:0041688E 83EC48                  sub esp, 00000048
:00416891 6A04                    push 00000004
:00416893 8B4D08                  mov ecx, dword ptr [ebp+08]
:00416896 E85C1B0000              call 004183F7
:0041689B 8945F4                  mov dword ptr [ebp-0C], eax
:0041689E 817DF400000080          cmp dword ptr [ebp-0C], 80000000
:004168A5 750A                    jne 004168B1
:004168A7 B805000000              mov eax, 00000005
:004168AC E9E2030000              jmp 00416C93

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004168A5(C)
|
:004168B1 6A17                    push 00000017
:004168B3 8B4D08                  mov ecx, dword ptr [ebp+08]
:004168B6 E83C1B0000              call 004183F7
:004168BB 668945D8                mov word ptr [ebp-28], ax
:004168BF 8B45D8                  mov eax, dword ptr [ebp-28]
:004168C2 25FFFF0000              and eax, 0000FFFF
:004168C7 3D00800000              cmp eax, 00008000
:004168CC 750A                    jne 004168D8
:004168CE B805000000              mov eax, 00000005
:004168D3 E9BB030000              jmp 00416C93

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004168CC(C)
|
:004168D8 6A49                    push 00000049
:004168DA 8B4D08                  mov ecx, dword ptr [ebp+08]
:004168DD E8151B0000              call 004183F7
:004168E2 668945CC                mov word ptr [ebp-34], ax
:004168E6 8B4DCC                  mov ecx, dword ptr [ebp-34]
:004168E9 81E1FFFF0000            and ecx, 0000FFFF
:004168EF 81F900800000            cmp ecx, 00008000
:004168F5 750A                    jne 00416901
:004168F7 B805000000              mov eax, 00000005
:004168FC E992030000              jmp 00416C93

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004168F5(C)
|
:00416901 6A17                    push 00000017
:00416903 8B4D08                  mov ecx, dword ptr [ebp+08]
:00416906 E8EC1A0000              call 004183F7
:0041690B 668945DC                mov word ptr [ebp-24], ax
:0041690F 8B55DC                  mov edx, dword ptr [ebp-24]
:00416912 81E2FFFF0000            and edx, 0000FFFF
:00416918 81FA00800000            cmp edx, 00008000
:0041691E 750A                    jne 0041692A
:00416920 B805000000              mov eax, 00000005
:00416925 E969030000              jmp 00416C93

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041691E(C)
|
:0041692A 6A49                    push 00000049
:0041692C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041692F E8C31A0000              call 004183F7
:00416934 668945FC                mov word ptr [ebp-04], ax
:00416938 8B45FC                  mov eax, dword ptr [ebp-04]
:0041693B 25FFFF0000              and eax, 0000FFFF
:00416940 3D00800000              cmp eax, 00008000
:00416945 750A                    jne 00416951
:00416947 B805000000              mov eax, 00000005
:0041694C E942030000              jmp 00416C93

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416945(C)
|
:00416951 6A17                    push 00000017
:00416953 8B4D08                  mov ecx, dword ptr [ebp+08]
:00416956 E89C1A0000              call 004183F7
:0041695B 668945D4                mov word ptr [ebp-2C], ax
:0041695F 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00416962 81E1FFFF0000            and ecx, 0000FFFF
:00416968 81F900800000            cmp ecx, 00008000
:0041696E 750A                    jne 0041697A
:00416970 B805000000              mov eax, 00000005
:00416975 E919030000              jmp 00416C93

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041696E(C)
|
:0041697A 6A49                    push 00000049
:0041697C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041697F E8731A0000              call 004183F7
:00416984 668945F8                mov word ptr [ebp-08], ax
:00416988 8B55F8                  mov edx, dword ptr [ebp-08]
:0041698B 81E2FFFF0000            and edx, 0000FFFF
:00416991 81FA00800000            cmp edx, 00008000
:00416997 750A                    jne 004169A3
:00416999 B805000000              mov eax, 00000005
:0041699E E9F0020000              jmp 00416C93

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416997(C)
|
:004169A3 6A26                    push 00000026
:004169A5 8B4D08                  mov ecx, dword ptr [ebp+08]
:004169A8 E84A1A0000              call 004183F7
:004169AD 668945EC                mov word ptr [ebp-14], ax
:004169B1 8B45EC                  mov eax, dword ptr [ebp-14]
:004169B4 25FFFF0000              and eax, 0000FFFF
:004169B9 3D00800000              cmp eax, 00008000
:004169BE 750A                    jne 004169CA
:004169C0 B805000000              mov eax, 00000005
:004169C5 E9C9020000              jmp 00416C93

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004169BE(C)
|
:004169CA B922B94000              mov ecx, 0040B922
:004169CF 85C9                    test ecx, ecx
:004169D1 750A                    jne 004169DD
:004169D3 B801000000              mov eax, 00000001
:004169D8 E9B6020000              jmp 00416C93

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004169D1(C)
|
:004169DD 8B55EC                  mov edx, dword ptr [ebp-14]
:004169E0 81E2FFFF0000            and edx, 0000FFFF
:004169E6 81FAFFFF0000            cmp edx, 0000FFFF
:004169EC 7506                    jne 004169F4
:004169EE 66C745EC0000            mov [ebp-14], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004169EC(C)
|
:004169F4 C745E400000000          mov [ebp-1C], 00000000
:004169FB B9681B4A00              mov ecx, 004A1B68
:00416A00 E8CBFBFEFF              call 004065D0
:00416A05 25FF000000              and eax, 000000FF
:00416A0A 6BC064                  imul eax, 00000064
:00416A0D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00416A10 8D9408BC020000          lea edx, dword ptr [eax+ecx+000002BC]
:00416A17 8955E4                  mov dword ptr [ebp-1C], edx
:00416A1A 8B45D8                  mov eax, dword ptr [ebp-28]
:00416A1D 25FFFF0000              and eax, 0000FFFF
:00416A22 3DFFFF0000              cmp eax, 0000FFFF
:00416A27 7408                    je 00416A31
:00416A29 8A4DD8                  mov cl, byte ptr [ebp-28]
:00416A2C 884DCB                  mov byte ptr [ebp-35], cl
:00416A2F EB04                    jmp 00416A35

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416A27(C)
|
:00416A31 C645CBFF                mov [ebp-35], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416A2F(U)
|
:00416A35 8A55CB                  mov dl, byte ptr [ebp-35]
:00416A38 8855F0                  mov byte ptr [ebp-10], dl
:00416A3B 8B45DC                  mov eax, dword ptr [ebp-24]
:00416A3E 25FFFF0000              and eax, 0000FFFF
:00416A43 3DFFFF0000              cmp eax, 0000FFFF
:00416A48 7408                    je 00416A52
:00416A4A 8A4DDC                  mov cl, byte ptr [ebp-24]
:00416A4D 884DCA                  mov byte ptr [ebp-36], cl
:00416A50 EB04                    jmp 00416A56

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416A48(C)
|
:00416A52 C645CAFF                mov [ebp-36], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416A50(U)
|
:00416A56 8A55CA                  mov dl, byte ptr [ebp-36]
:00416A59 8855F1                  mov byte ptr [ebp-0F], dl
:00416A5C 8B45D4                  mov eax, dword ptr [ebp-2C]
:00416A5F 25FFFF0000              and eax, 0000FFFF
:00416A64 3DFFFF0000              cmp eax, 0000FFFF
:00416A69 7408                    je 00416A73
:00416A6B 8A4DD4                  mov cl, byte ptr [ebp-2C]
:00416A6E 884DC9                  mov byte ptr [ebp-37], cl
:00416A71 EB04                    jmp 00416A77

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416A69(C)
|
:00416A73 C645C9FF                mov [ebp-37], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416A71(U)
|
:00416A77 8A55C9                  mov dl, byte ptr [ebp-37]
:00416A7A 8855F2                  mov byte ptr [ebp-0E], dl
:00416A7D 8B45CC                  mov eax, dword ptr [ebp-34]
:00416A80 25FFFF0000              and eax, 0000FFFF
:00416A85 3DFFFF0000              cmp eax, 0000FFFF
:00416A8A 740E                    je 00416A9A
:00416A8C 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00416A8F 81E1FF000000            and ecx, 000000FF
:00416A95 894DC4                  mov dword ptr [ebp-3C], ecx
:00416A98 EB07                    jmp 00416AA1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416A8A(C)
|
:00416A9A C745C400000000          mov [ebp-3C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416A98(U)
|
:00416AA1 8A55C4                  mov dl, byte ptr [ebp-3C]
:00416AA4 8855E8                  mov byte ptr [ebp-18], dl
:00416AA7 8B45FC                  mov eax, dword ptr [ebp-04]
:00416AAA 25FFFF0000              and eax, 0000FFFF
:00416AAF 3DFFFF0000              cmp eax, 0000FFFF
:00416AB4 740E                    je 00416AC4
:00416AB6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00416AB9 81E1FF000000            and ecx, 000000FF
:00416ABF 894DC0                  mov dword ptr [ebp-40], ecx
:00416AC2 EB07                    jmp 00416ACB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416AB4(C)
|
:00416AC4 C745C000000000          mov [ebp-40], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416AC2(U)
|
:00416ACB 8A55C0                  mov dl, byte ptr [ebp-40]
:00416ACE 8855E9                  mov byte ptr [ebp-17], dl
:00416AD1 8B45F8                  mov eax, dword ptr [ebp-08]
:00416AD4 25FFFF0000              and eax, 0000FFFF
:00416AD9 3DFFFF0000              cmp eax, 0000FFFF
:00416ADE 740E                    je 00416AEE
:00416AE0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00416AE3 81E1FF000000            and ecx, 000000FF
:00416AE9 894DBC                  mov dword ptr [ebp-44], ecx
:00416AEC EB07                    jmp 00416AF5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416ADE(C)
|
:00416AEE C745BC00000000          mov [ebp-44], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416AEC(U)
|
:00416AF5 8A55BC                  mov dl, byte ptr [ebp-44]
:00416AF8 8855EA                  mov byte ptr [ebp-16], dl
:00416AFB 8B45EC                  mov eax, dword ptr [ebp-14]
:00416AFE 25FFFF0000              and eax, 0000FFFF
:00416B03 F7D8                    neg eax
:00416B05 1BC0                    sbb eax, eax
:00416B07 F7D8                    neg eax
:00416B09 50                      push eax
:00416B0A 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00416B0D 51                      push ecx
:00416B0E 8B55E4                  mov edx, dword ptr [ebp-1C]
:00416B11 52                      push edx
:00416B12 B9083D4B00              mov ecx, 004B3D08
:00416B17 E88C4A0300              call 0044B5A8
:00416B1C 8B45E4                  mov eax, dword ptr [ebp-1C]
:00416B1F 50                      push eax
:00416B20 B970074B00              mov ecx, 004B0770
:00416B25 E8C370FFFF              call 0040DBED
:00416B2A B9681B4A00              mov ecx, 004A1B68
:00416B2F E89CFAFEFF              call 004065D0
:00416B34 8845D0                  mov byte ptr [ebp-30], al
:00416B37 C745E000000000          mov [ebp-20], 00000000
:00416B3E EB09                    jmp 00416B49

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416C89(U)
|
:00416B40 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00416B43 83C101                  add ecx, 00000001
:00416B46 894DE0                  mov dword ptr [ebp-20], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416B3E(U)
|
:00416B49 837DE003                cmp dword ptr [ebp-20], 00000003
:00416B4D 0F833B010000            jnb 00416C8E
:00416B53 8B55E0                  mov edx, dword ptr [ebp-20]
:00416B56 33C0                    xor eax, eax
:00416B58 8A4415F0                mov al, byte ptr [ebp+edx-10]
:00416B5C 3DFF000000              cmp eax, 000000FF
:00416B61 0F8422010000            je 00416C89
:00416B67 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00416B6A 33D2                    xor edx, edx
:00416B6C 8A540DF0                mov dl, byte ptr [ebp+ecx-10]
:00416B70 8BCA                    mov ecx, edx
:00416B72 6BC919                  imul ecx, 00000019
:00416B75 81C140114A00            add ecx, 004A1140
:00416B7B E8CC5BFFFF              call 0040C74C
:00416B80 85C0                    test eax, eax
:00416B82 0F84A8000000            je 00416C30
:00416B88 8B45E0                  mov eax, dword ptr [ebp-20]
:00416B8B 33C9                    xor ecx, ecx
:00416B8D 8A4C05E8                mov cl, byte ptr [ebp+eax-18]
:00416B91 85C9                    test ecx, ecx
:00416B93 0F8597000000            jne 00416C30
:00416B99 8B55E0                  mov edx, dword ptr [ebp-20]
:00416B9C 33C0                    xor eax, eax
:00416B9E 8A4415F0                mov al, byte ptr [ebp+edx-10]
:00416BA2 8BC8                    mov ecx, eax
:00416BA4 6BC919                  imul ecx, 00000019
:00416BA7 81C140114A00            add ecx, 004A1140
:00416BAD E8BC5BFFFF              call 0040C76E
:00416BB2 85C0                    test eax, eax
:00416BB4 7445                    je 00416BFB
:00416BB6 8B45D0                  mov eax, dword ptr [ebp-30]
:00416BB9 25FF000000              and eax, 000000FF
:00416BBE 99                      cdq
:00416BBF 83E203                  and edx, 00000003
:00416BC2 03C2                    add eax, edx
:00416BC4 C1F802                  sar eax, 02
:00416BC7 83C001                  add eax, 00000001
:00416BCA 83F809                  cmp eax, 00000009
:00416BCD 7609                    jbe 00416BD8
:00416BCF C745B809000000          mov [ebp-48], 00000009
:00416BD6 EB17                    jmp 00416BEF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416BCD(C)
|
:00416BD8 8B45D0                  mov eax, dword ptr [ebp-30]
:00416BDB 25FF000000              and eax, 000000FF
:00416BE0 99                      cdq
:00416BE1 83E203                  and edx, 00000003
:00416BE4 03C2                    add eax, edx
:00416BE6 C1F802                  sar eax, 02
:00416BE9 83C001                  add eax, 00000001
:00416BEC 8945B8                  mov dword ptr [ebp-48], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416BD6(U)
|
:00416BEF 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00416BF2 8A55B8                  mov dl, byte ptr [ebp-48]
:00416BF5 88540DE8                mov byte ptr [ebp+ecx-18], dl
:00416BF9 EB35                    jmp 00416C30

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416BB4(C)
|
:00416BFB 8B45D0                  mov eax, dword ptr [ebp-30]
:00416BFE 25FF000000              and eax, 000000FF
:00416C03 83F824                  cmp eax, 00000024
:00416C06 720A                    jb 00416C12
:00416C08 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00416C0B C6440DE803              mov [ebp+ecx-18], 03
:00416C10 EB1E                    jmp 00416C30

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416C06(C)
|
:00416C12 8B45D0                  mov eax, dword ptr [ebp-30]
:00416C15 25FF000000              and eax, 000000FF
:00416C1A 33D2                    xor edx, edx
:00416C1C B90C000000              mov ecx, 0000000C
:00416C21 F7F1                    div ecx
:00416C23 C1EA02                  shr edx, 02
:00416C26 83C201                  add edx, 00000001
:00416C29 8B45E0                  mov eax, dword ptr [ebp-20]
:00416C2C 885405E8                mov byte ptr [ebp+eax-18], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00416B82(C), :00416B93(C), :00416BF9(U), :00416C10(U)
|
:00416C30 6A00                    push 00000000
:00416C32 68FFFF0000              push 0000FFFF
:00416C37 6A00                    push 00000000
:00416C39 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00416C3C 8A540DE8                mov dl, byte ptr [ebp+ecx-18]
:00416C40 52                      push edx
:00416C41 8B45E0                  mov eax, dword ptr [ebp-20]
:00416C44 33C9                    xor ecx, ecx
:00416C46 8A4C05F0                mov cl, byte ptr [ebp+eax-10]
:00416C4A 51                      push ecx
:00416C4B B9F05D4B00              mov ecx, 004B5DF0
:00416C50 E8C62C0400              call 0045991B
:00416C55 8B55E0                  mov edx, dword ptr [ebp-20]
:00416C58 33C0                    xor eax, eax
:00416C5A 8A4415F0                mov al, byte ptr [ebp+edx-10]
:00416C5E 8BC8                    mov ecx, eax
:00416C60 6BC919                  imul ecx, 00000019
:00416C63 81C140114A00            add ecx, 004A1140
:00416C69 E89229FFFF              call 00409600
:00416C6E 85C0                    test eax, eax
:00416C70 7417                    je 00416C89
:00416C72 6A01                    push 00000001
:00416C74 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00416C77 33D2                    xor edx, edx
:00416C79 8A540DF0                mov dl, byte ptr [ebp+ecx-10]
:00416C7D 83C203                  add edx, 00000003
:00416C80 52                      push edx
:00416C81 E82A350000              call 0041A1B0
:00416C86 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00416B61(C), :00416C70(C)
|
:00416C89 E9B2FEFFFF              jmp 00416B40

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416B4D(C)
|
:00416C8E B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004168AC(U), :004168D3(U), :004168FC(U), :00416925(U), :0041694C(U)
|:00416975(U), :0041699E(U), :004169C5(U), :004169D8(U)
|
:00416C93 8BE5                    mov esp, ebp
:00416C95 5D                      pop ebp
:00416C96 C3                      ret



* Referenced by a CALL at Address:
|:00411035   
|
:00416C97 55                      push ebp
:00416C98 8BEC                    mov ebp, esp
:00416C9A B822B94000              mov eax, 0040B922
:00416C9F 85C0                    test eax, eax
:00416CA1 7507                    jne 00416CAA
:00416CA3 B801000000              mov eax, 00000001
:00416CA8 EB0F                    jmp 00416CB9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416CA1(C)
|
:00416CAA B9083D4B00              mov ecx, 004B3D08
:00416CAF E80E4E0300              call 0044BAC2
:00416CB4 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416CA8(U)
|
:00416CB9 5D                      pop ebp
:00416CBA C3                      ret



* Referenced by a CALL at Address:
|:00411046   
|
:00416CBB 55                      push ebp
:00416CBC 8BEC                    mov ebp, esp
:00416CBE 83EC14                  sub esp, 00000014
:00416CC1 6A04                    push 00000004
:00416CC3 8B4D08                  mov ecx, dword ptr [ebp+08]
:00416CC6 E82C170000              call 004183F7
:00416CCB 668945F4                mov word ptr [ebp-0C], ax
:00416CCF 8B45F4                  mov eax, dword ptr [ebp-0C]
:00416CD2 25FFFF0000              and eax, 0000FFFF
:00416CD7 3D00800000              cmp eax, 00008000
:00416CDC 750A                    jne 00416CE8
:00416CDE B805000000              mov eax, 00000005
:00416CE3 E90E010000              jmp 00416DF6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416CDC(C)
|
:00416CE8 6A04                    push 00000004
:00416CEA 8B4D08                  mov ecx, dword ptr [ebp+08]
:00416CED E805170000              call 004183F7
:00416CF2 668945F0                mov word ptr [ebp-10], ax
:00416CF6 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00416CF9 81E1FFFF0000            and ecx, 0000FFFF
:00416CFF 81F900800000            cmp ecx, 00008000
:00416D05 750A                    jne 00416D11
:00416D07 B805000000              mov eax, 00000005
:00416D0C E9E5000000              jmp 00416DF6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416D05(C)
|
:00416D11 6A04                    push 00000004
:00416D13 8B4D08                  mov ecx, dword ptr [ebp+08]
:00416D16 E8DC160000              call 004183F7
:00416D1B 668945EC                mov word ptr [ebp-14], ax
:00416D1F 8B55EC                  mov edx, dword ptr [ebp-14]
:00416D22 81E2FFFF0000            and edx, 0000FFFF
:00416D28 81FA00800000            cmp edx, 00008000
:00416D2E 750A                    jne 00416D3A
:00416D30 B805000000              mov eax, 00000005
:00416D35 E9BC000000              jmp 00416DF6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416D2E(C)
|
:00416D3A 6A04                    push 00000004
:00416D3C 8B4D08                  mov ecx, dword ptr [ebp+08]
:00416D3F E8B3160000              call 004183F7
:00416D44 668945F8                mov word ptr [ebp-08], ax
:00416D48 8B45F8                  mov eax, dword ptr [ebp-08]
:00416D4B 25FFFF0000              and eax, 0000FFFF
:00416D50 3D00800000              cmp eax, 00008000
:00416D55 750A                    jne 00416D61
:00416D57 B805000000              mov eax, 00000005
:00416D5C E995000000              jmp 00416DF6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416D55(C)
|
:00416D61 6A26                    push 00000026
:00416D63 8B4D08                  mov ecx, dword ptr [ebp+08]
:00416D66 E88C160000              call 004183F7
:00416D6B 668945FC                mov word ptr [ebp-04], ax
:00416D6F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00416D72 81E1FFFF0000            and ecx, 0000FFFF
:00416D78 81F900800000            cmp ecx, 00008000
:00416D7E 7507                    jne 00416D87
:00416D80 B805000000              mov eax, 00000005
:00416D85 EB6F                    jmp 00416DF6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416D7E(C)
|
:00416D87 8B55FC                  mov edx, dword ptr [ebp-04]
:00416D8A 81E2FFFF0000            and edx, 0000FFFF
:00416D90 81FAFFFF0000            cmp edx, 0000FFFF
:00416D96 7506                    jne 00416D9E
:00416D98 66C745FC0000            mov [ebp-04], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416D96(C)
|
:00416D9E E87F4BFFFF              call 0040B922
:00416DA3 85C0                    test eax, eax
:00416DA5 744A                    je 00416DF1
:00416DA7 8A45F4                  mov al, byte ptr [ebp-0C]
:00416DAA A2143D4B00              mov byte ptr [004B3D14], al
:00416DAF 8A4DF0                  mov cl, byte ptr [ebp-10]
:00416DB2 880D153D4B00            mov byte ptr [004B3D15], cl
:00416DB8 8A55EC                  mov dl, byte ptr [ebp-14]
:00416DBB 8815163D4B00            mov byte ptr [004B3D16], dl
:00416DC1 8A45F8                  mov al, byte ptr [ebp-08]
:00416DC4 A2173D4B00              mov byte ptr [004B3D17], al
:00416DC9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00416DCC 81E1FFFF0000            and ecx, 0000FFFF
:00416DD2 F7D9                    neg ecx
:00416DD4 1BC9                    sbb ecx, ecx
:00416DD6 41                      inc ecx
:00416DD7 890D103D4B00            mov dword ptr [004B3D10], ecx
:00416DDD 8B55FC                  mov edx, dword ptr [ebp-04]
:00416DE0 81E2FFFF0000            and edx, 0000FFFF
:00416DE6 52                      push edx
:00416DE7 B9F05D4B00              mov ecx, 004B5DF0
:00416DEC E8DD320400              call 0045A0CE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416DA5(C)
|
:00416DF1 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00416CE3(U), :00416D0C(U), :00416D35(U), :00416D5C(U), :00416D85(U)
|
:00416DF6 8BE5                    mov esp, ebp
:00416DF8 5D                      pop ebp
:00416DF9 C3                      ret



* Referenced by a CALL at Address:
|:00411057   
|
:00416DFA 55                      push ebp
:00416DFB 8BEC                    mov ebp, esp
:00416DFD E8204BFFFF              call 0040B922
:00416E02 85C0                    test eax, eax
:00416E04 740A                    je 00416E10
:00416E06 C705103D4B0000000000    mov dword ptr [004B3D10], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416E04(C)
|
:00416E10 B801000000              mov eax, 00000001
:00416E15 5D                      pop ebp
:00416E16 C3                      ret



* Referenced by a CALL at Address:
|:00411068   
|
:00416E17 55                      push ebp
:00416E18 8BEC                    mov ebp, esp
:00416E1A 83EC10                  sub esp, 00000010
:00416E1D 6A02                    push 00000002
:00416E1F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00416E22 E8D0150000              call 004183F7
:00416E27 668945FC                mov word ptr [ebp-04], ax
:00416E2B 8B45FC                  mov eax, dword ptr [ebp-04]
:00416E2E 25FFFF0000              and eax, 0000FFFF
:00416E33 3D00800000              cmp eax, 00008000
:00416E38 750A                    jne 00416E44
:00416E3A B805000000              mov eax, 00000005
:00416E3F E990010000              jmp 00416FD4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416E38(C)
|
:00416E44 E8D94AFFFF              call 0040B922
:00416E49 85C0                    test eax, eax
:00416E4B 7422                    je 00416E6F
:00416E4D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00416E50 81E1FFFF0000            and ecx, 0000FFFF
:00416E56 81F9FFFF0000            cmp ecx, 0000FFFF
:00416E5C 7411                    je 00416E6F
:00416E5E 8B55FC                  mov edx, dword ptr [ebp-04]
:00416E61 81E2FFFF0000            and edx, 0000FFFF
:00416E67 81FA00020000            cmp edx, 00000200
:00416E6D 7C07                    jl 00416E76

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00416E4B(C), :00416E5C(C)
|
:00416E6F 33C0                    xor eax, eax
:00416E71 E95E010000              jmp 00416FD4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416E6D(C)
|
:00416E76 C645F000                mov [ebp-10], 00
:00416E7A EB08                    jmp 00416E84

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416ED9(U)
|
:00416E7C 8A45F0                  mov al, byte ptr [ebp-10]
:00416E7F 0401                    add al, 01
:00416E81 8845F0                  mov byte ptr [ebp-10], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416E7A(U)
|
:00416E84 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00416E87 81E1FF000000            and ecx, 000000FF
:00416E8D 83F973                  cmp ecx, 00000073
:00416E90 7D49                    jge 00416EDB
:00416E92 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00416E95 81E1FF000000            and ecx, 000000FF
:00416E9B 6BC924                  imul ecx, 00000024
:00416E9E 81C1502C4B00            add ecx, 004B2C50
:00416EA4 E8C7870400              call 0045F670
:00416EA9 8B55FC                  mov edx, dword ptr [ebp-04]
:00416EAC 81E2FFFF0000            and edx, 0000FFFF
:00416EB2 3BC2                    cmp eax, edx
:00416EB4 7523                    jne 00416ED9
:00416EB6 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00416EB9 81E1FF000000            and ecx, 000000FF
:00416EBF 6BC924                  imul ecx, 00000024
:00416EC2 81C1502C4B00            add ecx, 004B2C50
:00416EC8 E8C31D0000              call 00418C90
:00416ECD 25FF000000              and eax, 000000FF
:00416ED2 83F802                  cmp eax, 00000002
:00416ED5 7502                    jne 00416ED9
:00416ED7 EB02                    jmp 00416EDB

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00416EB4(C), :00416ED5(C)
|
:00416ED9 EBA1                    jmp 00416E7C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00416E90(C), :00416ED7(U)
|
:00416EDB 8B45F0                  mov eax, dword ptr [ebp-10]
:00416EDE 25FF000000              and eax, 000000FF
:00416EE3 83F873                  cmp eax, 00000073
:00416EE6 7C07                    jl 00416EEF
:00416EE8 33C0                    xor eax, eax
:00416EEA E9E5000000              jmp 00416FD4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416EE6(C)
|
:00416EEF 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00416EF2 81E1FF000000            and ecx, 000000FF
:00416EF8 6BC924                  imul ecx, 00000024
:00416EFB 81C1502C4B00            add ecx, 004B2C50
:00416F01 E85AC4FEFF              call 00403360
:00416F06 668B08                  mov cx, word ptr [eax]
:00416F09 66894DF4                mov word ptr [ebp-0C], cx
:00416F0D 8A55F5                  mov dl, byte ptr [ebp-0B]
:00416F10 52                      push edx
:00416F11 8A45F4                  mov al, byte ptr [ebp-0C]
:00416F14 50                      push eax
:00416F15 B950424B00              mov ecx, 004B4250
:00416F1A E820E10300              call 0045503F
:00416F1F 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00416F22 81E1FF000000            and ecx, 000000FF
:00416F28 6BC924                  imul ecx, 00000024
:00416F2B 81C1502C4B00            add ecx, 004B2C50
:00416F31 E868950200              call 0044049E
:00416F36 C645F800                mov [ebp-08], 00
:00416F3A EB09                    jmp 00416F45

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416FC0(U)
|
:00416F3C 8A4DF8                  mov cl, byte ptr [ebp-08]
:00416F3F 80C101                  add cl, 01
:00416F42 884DF8                  mov byte ptr [ebp-08], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416F3A(U)
|
:00416F45 8B55F8                  mov edx, dword ptr [ebp-08]
:00416F48 81E2FF000000            and edx, 000000FF
:00416F4E 83FA03                  cmp edx, 00000003
:00416F51 7D72                    jge 00416FC5
:00416F53 8A45F0                  mov al, byte ptr [ebp-10]
:00416F56 50                      push eax
:00416F57 B950424B00              mov ecx, 004B4250
:00416F5C E8DFCA0300              call 00453A40
:00416F61 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00416F64 81E1FF000000            and ecx, 000000FF
:00416F6A 6BC924                  imul ecx, 00000024
:00416F6D 81C1502C4B00            add ecx, 004B2C50
:00416F73 E8518D0200              call 0043FCC9
:00416F78 6A0A                    push 0000000A
:00416F7A B9181B4B00              mov ecx, 004B1B18
:00416F7F E8BCC3FEFF              call 00403340
:00416F84 E857550100              call 0042C4E0
:00416F89 68FF000000              push 000000FF
:00416F8E B950424B00              mov ecx, 004B4250
:00416F93 E8A8CA0300              call 00453A40
:00416F98 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00416F9B 81E1FF000000            and ecx, 000000FF
:00416FA1 6BC924                  imul ecx, 00000024
:00416FA4 81C1502C4B00            add ecx, 004B2C50
:00416FAA E81A8D0200              call 0043FCC9
:00416FAF 6A0A                    push 0000000A
:00416FB1 B9181B4B00              mov ecx, 004B1B18
:00416FB6 E885C3FEFF              call 00403340
:00416FBB E820550100              call 0042C4E0
:00416FC0 E977FFFFFF              jmp 00416F3C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416F51(C)
|
:00416FC5 B950424B00              mov ecx, 004B4250
:00416FCA E863CE0300              call 00453E32
:00416FCF B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00416E3F(U), :00416E71(U), :00416EEA(U)
|
:00416FD4 8BE5                    mov esp, ebp
:00416FD6 5D                      pop ebp
:00416FD7 C3                      ret



* Referenced by a CALL at Address:
|:00410C4A   
|
:00416FD8 55                      push ebp
:00416FD9 8BEC                    mov ebp, esp
:00416FDB 83EC08                  sub esp, 00000008
:00416FDE 6A4A                    push 0000004A
:00416FE0 8B4D08                  mov ecx, dword ptr [ebp+08]
:00416FE3 E80F140000              call 004183F7
:00416FE8 668945FC                mov word ptr [ebp-04], ax
:00416FEC 8B45FC                  mov eax, dword ptr [ebp-04]
:00416FEF 25FFFF0000              and eax, 0000FFFF
:00416FF4 3D00800000              cmp eax, 00008000
:00416FF9 7507                    jne 00417002
:00416FFB B805000000              mov eax, 00000005
:00417000 EB62                    jmp 00417064

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416FF9(C)
|
:00417002 B970074B00              mov ecx, 004B0770
:00417007 E83425FFFF              call 00409540
:0041700C 8845F8                  mov byte ptr [ebp-08], al
:0041700F 8A4DF8                  mov cl, byte ptr [ebp-08]
:00417012 80E1F0                  and cl, F0
:00417015 884DF8                  mov byte ptr [ebp-08], cl
:00417018 8B55FC                  mov edx, dword ptr [ebp-04]
:0041701B 81E2FF000000            and edx, 000000FF
:00417021 81FAFF000000            cmp edx, 000000FF
:00417027 7517                    jne 00417040
:00417029 8B45F8                  mov eax, dword ptr [ebp-08]
:0041702C 25FF000000              and eax, 000000FF
:00417031 24EF                    and al, EF
:00417033 50                      push eax
:00417034 B970074B00              mov ecx, 004B0770
:00417039 E8021D0000              call 00418D40
:0041703E EB1F                    jmp 0041705F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417027(C)
|
:00417040 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00417043 81E1FF000000            and ecx, 000000FF
:00417049 8B55FC                  mov edx, dword ptr [ebp-04]
:0041704C 81E2FFFF0000            and edx, 0000FFFF
:00417052 0BCA                    or ecx, edx
:00417054 51                      push ecx
:00417055 B970074B00              mov ecx, 004B0770
:0041705A E8E11C0000              call 00418D40

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041703E(U)
|
:0041705F B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417000(U)
|
:00417064 8BE5                    mov esp, ebp
:00417066 5D                      pop ebp
:00417067 C3                      ret



* Referenced by a CALL at Address:
|:00411079   
|
:00417068 55                      push ebp
:00417069 8BEC                    mov ebp, esp
:0041706B 83EC08                  sub esp, 00000008
:0041706E 6A34                    push 00000034
:00417070 8B4D08                  mov ecx, dword ptr [ebp+08]
:00417073 E87F130000              call 004183F7
:00417078 668945FC                mov word ptr [ebp-04], ax
:0041707C 8B45FC                  mov eax, dword ptr [ebp-04]
:0041707F 25FFFF0000              and eax, 0000FFFF
:00417084 3D00800000              cmp eax, 00008000
:00417089 750A                    jne 00417095
:0041708B B805000000              mov eax, 00000005
:00417090 E9AA000000              jmp 0041713F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417089(C)
|
:00417095 6A04                    push 00000004
:00417097 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041709A E858130000              call 004183F7
:0041709F 8945F8                  mov dword ptr [ebp-08], eax
:004170A2 817DF800000080          cmp dword ptr [ebp-08], 80000000
:004170A9 750A                    jne 004170B5
:004170AB B805000000              mov eax, 00000005
:004170B0 E98A000000              jmp 0041713F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004170A9(C)
|
:004170B5 E86848FFFF              call 0040B922
:004170BA 85C0                    test eax, eax
:004170BC 741F                    je 004170DD
:004170BE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004170C1 81E1FFFF0000            and ecx, 0000FFFF
:004170C7 81F9FFFF0000            cmp ecx, 0000FFFF
:004170CD 740E                    je 004170DD
:004170CF 8B55FC                  mov edx, dword ptr [ebp-04]
:004170D2 81E2FFFF0000            and edx, 0000FFFF
:004170D8 83FA02                  cmp edx, 00000002
:004170DB 7504                    jne 004170E1

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004170BC(C), :004170CD(C)
|
:004170DD 33C0                    xor eax, eax
:004170DF EB5E                    jmp 0041713F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004170DB(C)
|
:004170E1 8B45FC                  mov eax, dword ptr [ebp-04]
:004170E4 25FFFF0000              and eax, 0000FFFF
:004170E9 85C0                    test eax, eax
:004170EB 7526                    jne 00417113
:004170ED 33C9                    xor ecx, ecx
:004170EF 8A0D0A3D4B00            mov cl, byte ptr [004B3D0A]
:004170F5 83C101                  add ecx, 00000001
:004170F8 8B55F8                  mov edx, dword ptr [ebp-08]
:004170FB 81E2FF000000            and edx, 000000FF
:00417101 3BCA                    cmp ecx, edx
:00417103 7C04                    jl 00417109
:00417105 33C0                    xor eax, eax
:00417107 EB36                    jmp 0041713F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417103(C)
|
:00417109 8A45F8                  mov al, byte ptr [ebp-08]
:0041710C A20B3D4B00              mov byte ptr [004B3D0B], al
:00417111 EB1D                    jmp 00417130

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004170EB(C)
|
:00417113 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00417116 81E1FFFF0000            and ecx, 0000FFFF
:0041711C 83F901                  cmp ecx, 00000001
:0041711F 750F                    jne 00417130
:00417121 8A150B3D4B00            mov dl, byte ptr [004B3D0B]
:00417127 0255F8                  add dl, byte ptr [ebp-08]
:0041712A 88150B3D4B00            mov byte ptr [004B3D0B], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00417111(U), :0041711F(C)
|
:00417130 B9083D4B00              mov ecx, 004B3D08
:00417135 E8902D0300              call 00449ECA
:0041713A B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00417090(U), :004170B0(U), :004170DF(U), :00417107(U)
|
:0041713F 8BE5                    mov esp, ebp
:00417141 5D                      pop ebp
:00417142 C3                      ret



* Referenced by a CALL at Address:
|:00410CF4   
|
:00417143 55                      push ebp
:00417144 8BEC                    mov ebp, esp
:00417146 83EC0C                  sub esp, 0000000C
:00417149 6A02                    push 00000002
:0041714B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041714E E8A4120000              call 004183F7
:00417153 668945F4                mov word ptr [ebp-0C], ax
:00417157 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041715A 25FFFF0000              and eax, 0000FFFF
:0041715F 3D00800000              cmp eax, 00008000
:00417164 750A                    jne 00417170
:00417166 B805000000              mov eax, 00000005
:0041716B E98B000000              jmp 004171FB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417164(C)
|
:00417170 6A04                    push 00000004
:00417172 8B4D08                  mov ecx, dword ptr [ebp+08]
:00417175 E87D120000              call 004183F7
:0041717A 668945FC                mov word ptr [ebp-04], ax
:0041717E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00417181 81E1FFFF0000            and ecx, 0000FFFF
:00417187 81F900800000            cmp ecx, 00008000
:0041718D 7507                    jne 00417196
:0041718F B805000000              mov eax, 00000005
:00417194 EB65                    jmp 004171FB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041718D(C)
|
:00417196 6A04                    push 00000004
:00417198 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041719B E857120000              call 004183F7
:004171A0 668945F8                mov word ptr [ebp-08], ax
:004171A4 8B55F8                  mov edx, dword ptr [ebp-08]
:004171A7 81E2FFFF0000            and edx, 0000FFFF
:004171AD 81FA00800000            cmp edx, 00008000
:004171B3 7507                    jne 004171BC
:004171B5 B805000000              mov eax, 00000005
:004171BA EB3F                    jmp 004171FB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004171B3(C)
|
:004171BC 8B45F4                  mov eax, dword ptr [ebp-0C]
:004171BF 25FFFF0000              and eax, 0000FFFF
:004171C4 3D00020000              cmp eax, 00000200
:004171C9 7C04                    jl 004171CF
:004171CB 33C0                    xor eax, eax
:004171CD EB2C                    jmp 004171FB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004171C9(C)
|
:004171CF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004171D2 81E1FFFF0000            and ecx, 0000FFFF
:004171D8 51                      push ecx
:004171D9 8B55FC                  mov edx, dword ptr [ebp-04]
:004171DC 81E2FFFF0000            and edx, 0000FFFF
:004171E2 52                      push edx
:004171E3 8B45F4                  mov eax, dword ptr [ebp-0C]
:004171E6 25FFFF0000              and eax, 0000FFFF
:004171EB 50                      push eax
:004171EC B9982B4B00              mov ecx, 004B2B98
:004171F1 E8C8BF0100              call 004331BE
:004171F6 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041716B(U), :00417194(U), :004171BA(U), :004171CD(U)
|
:004171FB 8BE5                    mov esp, ebp
:004171FD 5D                      pop ebp
:004171FE C3                      ret



* Referenced by a CALL at Address:
|:00410D05   
|
:004171FF 55                      push ebp
:00417200 8BEC                    mov ebp, esp
:00417202 83EC0C                  sub esp, 0000000C
:00417205 6A02                    push 00000002
:00417207 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041720A E8E8110000              call 004183F7
:0041720F 668945F4                mov word ptr [ebp-0C], ax
:00417213 8B45F4                  mov eax, dword ptr [ebp-0C]
:00417216 25FFFF0000              and eax, 0000FFFF
:0041721B 3D00800000              cmp eax, 00008000
:00417220 750A                    jne 0041722C
:00417222 B805000000              mov eax, 00000005
:00417227 E98B000000              jmp 004172B7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417220(C)
|
:0041722C 6A04                    push 00000004
:0041722E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00417231 E8C1110000              call 004183F7
:00417236 668945FC                mov word ptr [ebp-04], ax
:0041723A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041723D 81E1FFFF0000            and ecx, 0000FFFF
:00417243 81F900800000            cmp ecx, 00008000
:00417249 7507                    jne 00417252
:0041724B B805000000              mov eax, 00000005
:00417250 EB65                    jmp 004172B7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417249(C)
|
:00417252 6A04                    push 00000004
:00417254 8B4D08                  mov ecx, dword ptr [ebp+08]
:00417257 E89B110000              call 004183F7
:0041725C 668945F8                mov word ptr [ebp-08], ax
:00417260 8B55F8                  mov edx, dword ptr [ebp-08]
:00417263 81E2FFFF0000            and edx, 0000FFFF
:00417269 81FA00800000            cmp edx, 00008000
:0041726F 7507                    jne 00417278
:00417271 B805000000              mov eax, 00000005
:00417276 EB3F                    jmp 004172B7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041726F(C)
|
:00417278 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041727B 25FFFF0000              and eax, 0000FFFF
:00417280 3D00020000              cmp eax, 00000200
:00417285 7C04                    jl 0041728B
:00417287 33C0                    xor eax, eax
:00417289 EB2C                    jmp 004172B7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417285(C)
|
:0041728B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041728E 81E1FFFF0000            and ecx, 0000FFFF
:00417294 51                      push ecx
:00417295 8B55FC                  mov edx, dword ptr [ebp-04]
:00417298 81E2FFFF0000            and edx, 0000FFFF
:0041729E 52                      push edx
:0041729F 8B45F4                  mov eax, dword ptr [ebp-0C]
:004172A2 25FFFF0000              and eax, 0000FFFF
:004172A7 50                      push eax
:004172A8 B9982B4B00              mov ecx, 004B2B98
:004172AD E842B80100              call 00432AF4
:004172B2 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00417227(U), :00417250(U), :00417276(U), :00417289(U)
|
:004172B7 8BE5                    mov esp, ebp
:004172B9 5D                      pop ebp
:004172BA C3                      ret



* Referenced by a CALL at Address:
|:00410D16   
|
:004172BB 55                      push ebp
:004172BC 8BEC                    mov ebp, esp
:004172BE 51                      push ecx
:004172BF 6A02                    push 00000002
:004172C1 8B4D08                  mov ecx, dword ptr [ebp+08]
:004172C4 E82E110000              call 004183F7
:004172C9 668945FC                mov word ptr [ebp-04], ax
:004172CD 8B45FC                  mov eax, dword ptr [ebp-04]
:004172D0 25FFFF0000              and eax, 0000FFFF
:004172D5 3D00800000              cmp eax, 00008000
:004172DA 7507                    jne 004172E3
:004172DC B805000000              mov eax, 00000005
:004172E1 EB2E                    jmp 00417311

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004172DA(C)
|
:004172E3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004172E6 81E1FFFF0000            and ecx, 0000FFFF
:004172EC 81F900020000            cmp ecx, 00000200
:004172F2 7C04                    jl 004172F8
:004172F4 33C0                    xor eax, eax
:004172F6 EB19                    jmp 00417311

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004172F2(C)
|
:004172F8 8B55FC                  mov edx, dword ptr [ebp-04]
:004172FB 81E2FFFF0000            and edx, 0000FFFF
:00417301 52                      push edx
:00417302 B9982B4B00              mov ecx, 004B2B98
:00417307 E864BD0100              call 00433070
:0041730C B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004172E1(U), :004172F6(U)
|
:00417311 8BE5                    mov esp, ebp
:00417313 5D                      pop ebp
:00417314 C3                      ret



* Referenced by a CALL at Address:
|:00410D27   
|
:00417315 55                      push ebp
:00417316 8BEC                    mov ebp, esp
:00417318 81EC1C040000            sub esp, 0000041C
:0041731E 6A05                    push 00000005
:00417320 8B4D08                  mov ecx, dword ptr [ebp+08]
:00417323 E8CF100000              call 004183F7
:00417328 8945F4                  mov dword ptr [ebp-0C], eax
:0041732B 817DF400000080          cmp dword ptr [ebp-0C], 80000000
:00417332 750A                    jne 0041733E
:00417334 B805000000              mov eax, 00000005
:00417339 E960010000              jmp 0041749E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417332(C)
|
:0041733E 6A26                    push 00000026
:00417340 8B4D08                  mov ecx, dword ptr [ebp+08]
:00417343 E8AF100000              call 004183F7
:00417348 668945F8                mov word ptr [ebp-08], ax
:0041734C 8B45F8                  mov eax, dword ptr [ebp-08]
:0041734F 25FFFF0000              and eax, 0000FFFF
:00417354 3D00800000              cmp eax, 00008000
:00417359 750A                    jne 00417365
:0041735B B805000000              mov eax, 00000005
:00417360 E939010000              jmp 0041749E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417359(C)
|
:00417365 6A26                    push 00000026
:00417367 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041736A E888100000              call 004183F7
:0041736F 668945FC                mov word ptr [ebp-04], ax
:00417373 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00417376 81E1FFFF0000            and ecx, 0000FFFF
:0041737C 81F900800000            cmp ecx, 00008000
:00417382 750A                    jne 0041738E
:00417384 B805000000              mov eax, 00000005
:00417389 E910010000              jmp 0041749E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417382(C)
|
:0041738E 6A26                    push 00000026
:00417390 8B4D08                  mov ecx, dword ptr [ebp+08]
:00417393 E85F100000              call 004183F7
:00417398 668945F0                mov word ptr [ebp-10], ax
:0041739C 8B55F0                  mov edx, dword ptr [ebp-10]
:0041739F 81E2FFFF0000            and edx, 0000FFFF
:004173A5 81FA00800000            cmp edx, 00008000
:004173AB 750A                    jne 004173B7
:004173AD B805000000              mov eax, 00000005
:004173B2 E9E7000000              jmp 0041749E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004173AB(C)
|
:004173B7 8B45F8                  mov eax, dword ptr [ebp-08]
:004173BA 25FFFF0000              and eax, 0000FFFF
:004173BF 3DFFFF0000              cmp eax, 0000FFFF
:004173C4 750C                    jne 004173D2
:004173C6 C785ECFBFFFF00000000    mov dword ptr [ebp+FFFFFBEC], 00000000
:004173D0 EB0F                    jmp 004173E1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004173C4(C)
|
:004173D2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004173D5 81E1FFFF0000            and ecx, 0000FFFF
:004173DB 898DECFBFFFF            mov dword ptr [ebp+FFFFFBEC], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004173D0(U)
|
:004173E1 668B95ECFBFFFF          mov dx, word ptr [ebp+FFFFFBEC]
:004173E8 668955F8                mov word ptr [ebp-08], dx
:004173EC 8B45FC                  mov eax, dword ptr [ebp-04]
:004173EF 25FFFF0000              and eax, 0000FFFF
:004173F4 3DFFFF0000              cmp eax, 0000FFFF
:004173F9 750C                    jne 00417407
:004173FB C785E8FBFFFF00000000    mov dword ptr [ebp+FFFFFBE8], 00000000
:00417405 EB0F                    jmp 00417416

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004173F9(C)
|
:00417407 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041740A 81E1FFFF0000            and ecx, 0000FFFF
:00417410 898DE8FBFFFF            mov dword ptr [ebp+FFFFFBE8], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417405(U)
|
:00417416 668B95E8FBFFFF          mov dx, word ptr [ebp+FFFFFBE8]
:0041741D 668955FC                mov word ptr [ebp-04], dx
:00417421 8B45F0                  mov eax, dword ptr [ebp-10]
:00417424 25FFFF0000              and eax, 0000FFFF
:00417429 3DFFFF0000              cmp eax, 0000FFFF
:0041742E 750C                    jne 0041743C
:00417430 C785E4FBFFFF00000000    mov dword ptr [ebp+FFFFFBE4], 00000000
:0041743A EB0F                    jmp 0041744B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041742E(C)
|
:0041743C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0041743F 81E1FFFF0000            and ecx, 0000FFFF
:00417445 898DE4FBFFFF            mov dword ptr [ebp+FFFFFBE4], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041743A(U)
|
:0041744B 668B95E4FBFFFF          mov dx, word ptr [ebp+FFFFFBE4]
:00417452 668955F0                mov word ptr [ebp-10], dx
:00417456 8B45F4                  mov eax, dword ptr [ebp-0C]
:00417459 50                      push eax
:0041745A 8D8DF0FBFFFF            lea ecx, dword ptr [ebp+FFFFFBF0]
:00417460 51                      push ecx
:00417461 B9902F4900              mov ecx, 00492F90
:00417466 E83A050000              call 004179A5
:0041746B 8B55F0                  mov edx, dword ptr [ebp-10]
:0041746E 81E2FFFF0000            and edx, 0000FFFF
:00417474 52                      push edx
:00417475 8B45FC                  mov eax, dword ptr [ebp-04]
:00417478 25FFFF0000              and eax, 0000FFFF
:0041747D 50                      push eax
:0041747E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00417481 81E1FFFF0000            and ecx, 0000FFFF
:00417487 51                      push ecx
:00417488 8D95F0FBFFFF            lea edx, dword ptr [ebp+FFFFFBF0]
:0041748E 52                      push edx
:0041748F B9982B4B00              mov ecx, 004B2B98
:00417494 E856B30100              call 004327EF
:00417499 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00417339(U), :00417360(U), :00417389(U), :004173B2(U)
|
:0041749E 8BE5                    mov esp, ebp
:004174A0 5D                      pop ebp
:004174A1 C3                      ret



* Referenced by a CALL at Address:
|:0041109B   
|
:004174A2 55                      push ebp
:004174A3 8BEC                    mov ebp, esp
:004174A5 83EC08                  sub esp, 00000008
:004174A8 6A02                    push 00000002
:004174AA 8B4D08                  mov ecx, dword ptr [ebp+08]
:004174AD E8450F0000              call 004183F7
:004174B2 668945FC                mov word ptr [ebp-04], ax
:004174B6 8B45FC                  mov eax, dword ptr [ebp-04]
:004174B9 25FFFF0000              and eax, 0000FFFF
:004174BE 3D00800000              cmp eax, 00008000
:004174C3 7507                    jne 004174CC
:004174C5 B805000000              mov eax, 00000005
:004174CA EB65                    jmp 00417531

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004174C3(C)
|
:004174CC 6A02                    push 00000002
:004174CE 8B4D08                  mov ecx, dword ptr [ebp+08]
:004174D1 E8210F0000              call 004183F7
:004174D6 668945F8                mov word ptr [ebp-08], ax
:004174DA 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004174DD 81E1FFFF0000            and ecx, 0000FFFF
:004174E3 81F900800000            cmp ecx, 00008000
:004174E9 7507                    jne 004174F2
:004174EB B805000000              mov eax, 00000005
:004174F0 EB3F                    jmp 00417531

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004174E9(C)
|
:004174F2 8B55FC                  mov edx, dword ptr [ebp-04]
:004174F5 81E2FFFF0000            and edx, 0000FFFF
:004174FB 81FA00020000            cmp edx, 00000200
:00417501 7D25                    jge 00417528
:00417503 8B45F8                  mov eax, dword ptr [ebp-08]
:00417506 25FFFF0000              and eax, 0000FFFF
:0041750B 3D00020000              cmp eax, 00000200
:00417510 7D16                    jge 00417528
:00417512 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00417515 81E1FFFF0000            and ecx, 0000FFFF
:0041751B 8B55F8                  mov edx, dword ptr [ebp-08]
:0041751E 81E2FFFF0000            and edx, 0000FFFF
:00417524 3BCA                    cmp ecx, edx
:00417526 7504                    jne 0041752C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00417501(C), :00417510(C)
|
:00417528 33C0                    xor eax, eax
:0041752A EB05                    jmp 00417531

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417526(C)
|
:0041752C B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004174CA(U), :004174F0(U), :0041752A(U)
|
:00417531 8BE5                    mov esp, ebp
:00417533 5D                      pop ebp
:00417534 C3                      ret



* Referenced by a CALL at Address:
|:004110AC   
|
:00417535 55                      push ebp
:00417536 8BEC                    mov ebp, esp
:00417538 83EC08                  sub esp, 00000008
:0041753B 6A02                    push 00000002
:0041753D 8B4D08                  mov ecx, dword ptr [ebp+08]
:00417540 E8B20E0000              call 004183F7
:00417545 668945FC                mov word ptr [ebp-04], ax
:00417549 8B45FC                  mov eax, dword ptr [ebp-04]
:0041754C 25FFFF0000              and eax, 0000FFFF
:00417551 3D00800000              cmp eax, 00008000
:00417556 750A                    jne 00417562
:00417558 B805000000              mov eax, 00000005
:0041755D E982000000              jmp 004175E4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417556(C)
|
:00417562 6A02                    push 00000002
:00417564 8B4D08                  mov ecx, dword ptr [ebp+08]
:00417567 E88B0E0000              call 004183F7
:0041756C 668945F8                mov word ptr [ebp-08], ax
:00417570 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00417573 81E1FFFF0000            and ecx, 0000FFFF
:00417579 81F900800000            cmp ecx, 00008000
:0041757F 7507                    jne 00417588
:00417581 B805000000              mov eax, 00000005
:00417586 EB5C                    jmp 004175E4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041757F(C)
|
:00417588 8B55FC                  mov edx, dword ptr [ebp-04]
:0041758B 81E2FFFF0000            and edx, 0000FFFF
:00417591 81FA00020000            cmp edx, 00000200
:00417597 7D25                    jge 004175BE
:00417599 8B45F8                  mov eax, dword ptr [ebp-08]
:0041759C 25FFFF0000              and eax, 0000FFFF
:004175A1 3D00020000              cmp eax, 00000200
:004175A6 7D16                    jge 004175BE
:004175A8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004175AB 81E1FFFF0000            and ecx, 0000FFFF
:004175B1 8B55F8                  mov edx, dword ptr [ebp-08]
:004175B4 81E2FFFF0000            and edx, 0000FFFF
:004175BA 3BCA                    cmp ecx, edx
:004175BC 7504                    jne 004175C2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00417597(C), :004175A6(C)
|
:004175BE 33C0                    xor eax, eax
:004175C0 EB22                    jmp 004175E4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004175BC(C)
|
:004175C2 8B45F8                  mov eax, dword ptr [ebp-08]
:004175C5 25FFFF0000              and eax, 0000FFFF
:004175CA 50                      push eax
:004175CB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004175CE 81E1FFFF0000            and ecx, 0000FFFF
:004175D4 51                      push ecx
:004175D5 B9803C4B00              mov ecx, 004B3C80
:004175DA E8C0230300              call 0044999F
:004175DF B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041755D(U), :00417586(U), :004175C0(U)
|
:004175E4 8BE5                    mov esp, ebp
:004175E6 5D                      pop ebp
:004175E7 C3                      ret



* Referenced by a CALL at Address:
|:004110BA   
|
:004175E8 55                      push ebp
:004175E9 8BEC                    mov ebp, esp
:004175EB B9803C4B00              mov ecx, 004B3C80
:004175F0 E8EB220300              call 004498E0
:004175F5 B801000000              mov eax, 00000001
:004175FA 5D                      pop ebp
:004175FB C3                      ret



* Referenced by a CALL at Address:
|:004110C8   
|
:004175FC 55                      push ebp
:004175FD 8BEC                    mov ebp, esp
:004175FF 81EC0C040000            sub esp, 0000040C
:00417605 6A26                    push 00000026
:00417607 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041760A E8E80D0000              call 004183F7
:0041760F 668945F8                mov word ptr [ebp-08], ax
:00417613 8B45F8                  mov eax, dword ptr [ebp-08]
:00417616 25FFFF0000              and eax, 0000FFFF
:0041761B 3D00800000              cmp eax, 00008000
:00417620 7507                    jne 00417629
:00417622 B805000000              mov eax, 00000005
:00417627 EB7B                    jmp 004176A4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417620(C)
|
:00417629 6A05                    push 00000005
:0041762B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041762E E8C40D0000              call 004183F7
:00417633 8945F4                  mov dword ptr [ebp-0C], eax
:00417636 817DF400000080          cmp dword ptr [ebp-0C], 80000000
:0041763D 7507                    jne 00417646
:0041763F B805000000              mov eax, 00000005
:00417644 EB5E                    jmp 004176A4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041763D(C)
|
:00417646 6A4C                    push 0000004C
:00417648 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041764B E8A70D0000              call 004183F7
:00417650 668945FC                mov word ptr [ebp-04], ax
:00417654 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00417657 81E1FFFF0000            and ecx, 0000FFFF
:0041765D 81F900800000            cmp ecx, 00008000
:00417663 7507                    jne 0041766C
:00417665 B805000000              mov eax, 00000005
:0041766A EB38                    jmp 004176A4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417663(C)
|
:0041766C 8B55F4                  mov edx, dword ptr [ebp-0C]
:0041766F 52                      push edx
:00417670 8D85F4FBFFFF            lea eax, dword ptr [ebp+FFFFFBF4]
:00417676 50                      push eax
:00417677 B9902F4900              mov ecx, 00492F90
:0041767C E824030000              call 004179A5
:00417681 8A4DFC                  mov cl, byte ptr [ebp-04]
:00417684 51                      push ecx
:00417685 8D95F4FBFFFF            lea edx, dword ptr [ebp+FFFFFBF4]
:0041768B 52                      push edx
:0041768C 8B45F8                  mov eax, dword ptr [ebp-08]
:0041768F 25FFFF0000              and eax, 0000FFFF
:00417694 50                      push eax
:00417695 B9803C4B00              mov ecx, 004B3C80
:0041769A E8E11D0300              call 00449480
:0041769F B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00417627(U), :00417644(U), :0041766A(U)
|
:004176A4 8BE5                    mov esp, ebp
:004176A6 5D                      pop ebp
:004176A7 C3                      ret



* Referenced by a CALL at Address:
|:004110D6   
|
:004176A8 55                      push ebp
:004176A9 8BEC                    mov ebp, esp
:004176AB B9803C4B00              mov ecx, 004B3C80
:004176B0 E840190300              call 00448FF5
:004176B5 B801000000              mov eax, 00000001
:004176BA 5D                      pop ebp
:004176BB C3                      ret



* Referenced by a CALL at Address:
|:004110E4   
|
:004176BC 55                      push ebp
:004176BD 8BEC                    mov ebp, esp
:004176BF 51                      push ecx
:004176C0 6A26                    push 00000026
:004176C2 8B4D08                  mov ecx, dword ptr [ebp+08]
:004176C5 E82D0D0000              call 004183F7
:004176CA 668945FC                mov word ptr [ebp-04], ax
:004176CE 8B45FC                  mov eax, dword ptr [ebp-04]
:004176D1 25FFFF0000              and eax, 0000FFFF
:004176D6 3D00800000              cmp eax, 00008000
:004176DB 7507                    jne 004176E4
:004176DD B805000000              mov eax, 00000005
:004176E2 EB19                    jmp 004176FD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004176DB(C)
|
:004176E4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004176E7 81E1FFFF0000            and ecx, 0000FFFF
:004176ED 51                      push ecx
:004176EE B9803C4B00              mov ecx, 004B3C80
:004176F3 E8E2190300              call 004490DA
:004176F8 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004176E2(U)
|
:004176FD 8BE5                    mov esp, ebp
:004176FF 5D                      pop ebp
:00417700 C3                      ret



* Referenced by a CALL at Address:
|:004110F2   
|
:00417701 55                      push ebp
:00417702 8BEC                    mov ebp, esp
:00417704 81EC0C040000            sub esp, 0000040C
:0041770A 6A26                    push 00000026
:0041770C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041770F E8E30C0000              call 004183F7
:00417714 668945FC                mov word ptr [ebp-04], ax
:00417718 8B45FC                  mov eax, dword ptr [ebp-04]
:0041771B 25FFFF0000              and eax, 0000FFFF
:00417720 3D00800000              cmp eax, 00008000
:00417725 750A                    jne 00417731
:00417727 B805000000              mov eax, 00000005
:0041772C E981000000              jmp 004177B2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417725(C)
|
:00417731 6A05                    push 00000005
:00417733 8B4D08                  mov ecx, dword ptr [ebp+08]
:00417736 E8BC0C0000              call 004183F7
:0041773B 8945F8                  mov dword ptr [ebp-08], eax
:0041773E 817DF800000080          cmp dword ptr [ebp-08], 80000000
:00417745 7507                    jne 0041774E
:00417747 B805000000              mov eax, 00000005
:0041774C EB64                    jmp 004177B2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417745(C)
|
:0041774E 6A26                    push 00000026
:00417750 8B4D08                  mov ecx, dword ptr [ebp+08]
:00417753 E89F0C0000              call 004183F7
:00417758 668945F4                mov word ptr [ebp-0C], ax
:0041775C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041775F 81E1FFFF0000            and ecx, 0000FFFF
:00417765 81F900800000            cmp ecx, 00008000
:0041776B 7507                    jne 00417774
:0041776D B805000000              mov eax, 00000005
:00417772 EB3E                    jmp 004177B2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041776B(C)
|
:00417774 8B55F8                  mov edx, dword ptr [ebp-08]
:00417777 52                      push edx
:00417778 8D85F4FBFFFF            lea eax, dword ptr [ebp+FFFFFBF4]
:0041777E 50                      push eax
:0041777F B9902F4900              mov ecx, 00492F90
:00417784 E81C020000              call 004179A5
:00417789 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041778C 81E1FFFF0000            and ecx, 0000FFFF
:00417792 51                      push ecx
:00417793 8D95F4FBFFFF            lea edx, dword ptr [ebp+FFFFFBF4]
:00417799 52                      push edx
:0041779A 8B45FC                  mov eax, dword ptr [ebp-04]
:0041779D 25FFFF0000              and eax, 0000FFFF
:004177A2 50                      push eax
:004177A3 B9803C4B00              mov ecx, 004B3C80
:004177A8 E802BA0200              call 004431AF
:004177AD B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041772C(U), :0041774C(U), :00417772(U)
|
:004177B2 8BE5                    mov esp, ebp
:004177B4 5D                      pop ebp
:004177B5 C3                      ret



* Referenced by a CALL at Address:
|:00411100   
|
:004177B6 55                      push ebp
:004177B7 8BEC                    mov ebp, esp
:004177B9 83EC08                  sub esp, 00000008
:004177BC 6A26                    push 00000026
:004177BE 8B4D08                  mov ecx, dword ptr [ebp+08]
:004177C1 E8310C0000              call 004183F7
:004177C6 668945F8                mov word ptr [ebp-08], ax
:004177CA 8B45F8                  mov eax, dword ptr [ebp-08]
:004177CD 25FFFF0000              and eax, 0000FFFF
:004177D2 3D00800000              cmp eax, 00008000
:004177D7 7507                    jne 004177E0
:004177D9 B805000000              mov eax, 00000005
:004177DE EB42                    jmp 00417822

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004177D7(C)
|
:004177E0 6A4C                    push 0000004C
:004177E2 8B4D08                  mov ecx, dword ptr [ebp+08]
:004177E5 E80D0C0000              call 004183F7
:004177EA 668945FC                mov word ptr [ebp-04], ax
:004177EE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004177F1 81E1FFFF0000            and ecx, 0000FFFF
:004177F7 81F900800000            cmp ecx, 00008000
:004177FD 7507                    jne 00417806
:004177FF B805000000              mov eax, 00000005
:00417804 EB1C                    jmp 00417822

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004177FD(C)
|
:00417806 8A55FC                  mov dl, byte ptr [ebp-04]
:00417809 52                      push edx
:0041780A 8B45F8                  mov eax, dword ptr [ebp-08]
:0041780D 25FFFF0000              and eax, 0000FFFF
:00417812 50                      push eax
:00417813 B9803C4B00              mov ecx, 004B3C80
:00417818 E8070D0300              call 00448524
:0041781D B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004177DE(U), :00417804(U)
|
:00417822 8BE5                    mov esp, ebp
:00417824 5D                      pop ebp
:00417825 C3                      ret



* Referenced by a CALL at Address:
|:0041110E   
|
:00417826 55                      push ebp
:00417827 8BEC                    mov ebp, esp
:00417829 83EC0C                  sub esp, 0000000C
:0041782C 6A26                    push 00000026
:0041782E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00417831 E8C10B0000              call 004183F7
:00417836 668945FC                mov word ptr [ebp-04], ax
:0041783A 8B45FC                  mov eax, dword ptr [ebp-04]
:0041783D 25FFFF0000              and eax, 0000FFFF
:00417842 3D00800000              cmp eax, 00008000
:00417847 7507                    jne 00417850
:00417849 B805000000              mov eax, 00000005
:0041784E EB72                    jmp 004178C2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417847(C)
|
:00417850 6A4D                    push 0000004D
:00417852 8B4D08                  mov ecx, dword ptr [ebp+08]
:00417855 E89D0B0000              call 004183F7
:0041785A 668945F8                mov word ptr [ebp-08], ax
:0041785E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00417861 81E1FFFF0000            and ecx, 0000FFFF
:00417867 81F900800000            cmp ecx, 00008000
:0041786D 7507                    jne 00417876
:0041786F B805000000              mov eax, 00000005
:00417874 EB4C                    jmp 004178C2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041786D(C)
|
:00417876 6A26                    push 00000026
:00417878 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041787B E8770B0000              call 004183F7
:00417880 668945F4                mov word ptr [ebp-0C], ax
:00417884 8B55F4                  mov edx, dword ptr [ebp-0C]
:00417887 81E2FFFF0000            and edx, 0000FFFF
:0041788D 81FA00800000            cmp edx, 00008000
:00417893 7507                    jne 0041789C
:00417895 B805000000              mov eax, 00000005
:0041789A EB26                    jmp 004178C2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417893(C)
|
:0041789C 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041789F 25FFFF0000              and eax, 0000FFFF
:004178A4 50                      push eax
:004178A5 8A4DF8                  mov cl, byte ptr [ebp-08]
:004178A8 51                      push ecx
:004178A9 8B55FC                  mov edx, dword ptr [ebp-04]
:004178AC 81E2FFFF0000            and edx, 0000FFFF
:004178B2 52                      push edx
:004178B3 B9803C4B00              mov ecx, 004B3C80
:004178B8 E8D70A0300              call 00448394
:004178BD B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041784E(U), :00417874(U), :0041789A(U)
|
:004178C2 8BE5                    mov esp, ebp
:004178C4 5D                      pop ebp
:004178C5 C3                      ret



* Referenced by a CALL at Address:
|:0041111C   
|
:004178C6 55                      push ebp
:004178C7 8BEC                    mov ebp, esp
:004178C9 83EC0C                  sub esp, 0000000C
:004178CC 6A26                    push 00000026
:004178CE 8B4D08                  mov ecx, dword ptr [ebp+08]
:004178D1 E8210B0000              call 004183F7
:004178D6 668945FC                mov word ptr [ebp-04], ax
:004178DA 8B45FC                  mov eax, dword ptr [ebp-04]
:004178DD 25FFFF0000              and eax, 0000FFFF
:004178E2 3D00800000              cmp eax, 00008000
:004178E7 7507                    jne 004178F0
:004178E9 B805000000              mov eax, 00000005
:004178EE EB72                    jmp 00417962

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004178E7(C)
|
:004178F0 6A4E                    push 0000004E
:004178F2 8B4D08                  mov ecx, dword ptr [ebp+08]
:004178F5 E8FD0A0000              call 004183F7
:004178FA 668945F4                mov word ptr [ebp-0C], ax
:004178FE 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00417901 81E1FFFF0000            and ecx, 0000FFFF
:00417907 81F900800000            cmp ecx, 00008000
:0041790D 7507                    jne 00417916
:0041790F B805000000              mov eax, 00000005
:00417914 EB4C                    jmp 00417962

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041790D(C)
|
:00417916 6A26                    push 00000026
:00417918 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041791B E8D70A0000              call 004183F7
:00417920 668945F8                mov word ptr [ebp-08], ax
:00417924 8B55F8                  mov edx, dword ptr [ebp-08]
:00417927 81E2FFFF0000            and edx, 0000FFFF
:0041792D 81FA00800000            cmp edx, 00008000
:00417933 7507                    jne 0041793C
:00417935 B805000000              mov eax, 00000005
:0041793A EB26                    jmp 00417962

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417933(C)
|
:0041793C 8B45F8                  mov eax, dword ptr [ebp-08]
:0041793F 25FFFF0000              and eax, 0000FFFF
:00417944 50                      push eax
:00417945 8A4DF4                  mov cl, byte ptr [ebp-0C]
:00417948 51                      push ecx
:00417949 8B55FC                  mov edx, dword ptr [ebp-04]
:0041794C 81E2FFFF0000            and edx, 0000FFFF
:00417952 52                      push edx
:00417953 B9803C4B00              mov ecx, 004B3C80
:00417958 E81E0B0300              call 0044847B
:0041795D B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004178EE(U), :00417914(U), :0041793A(U)
|
:00417962 8BE5                    mov esp, ebp
:00417964 5D                      pop ebp
:00417965 C3                      ret



* Referenced by a CALL at Addresses:
|:00418111   , :0041815E   , :00418394   , :004183E1   , :0042BF9C   
|
:00417966 55                      push ebp
:00417967 8BEC                    mov ebp, esp
:00417969 51                      push ecx
:0041796A 894DFC                  mov dword ptr [ebp-04], ecx
:0041796D 68F0654800              push 004865F0
:00417972 6A08                    push 00000008
:00417974 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00417977 E8A384FFFF              call 0040FE1F
:0041797C 8BE5                    mov esp, ebp
:0041797E 5D                      pop ebp
:0041797F C3                      ret



* Referenced by a CALL at Addresses:
|:00418119   , :00418166   , :0041839C   , :004183E9   , :0042BFA6   
|:0042C39C   
|
:00417980 55                      push ebp
:00417981 8BEC                    mov ebp, esp
:00417983 51                      push ecx
:00417984 894DFC                  mov dword ptr [ebp-04], ecx
:00417987 68F0654800              push 004865F0
:0041798C 6A08                    push 00000008
:0041798E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00417991 E8FA85FFFF              call 0040FF90
:00417996 8BE5                    mov esp, ebp
:00417998 5D                      pop ebp
:00417999 C3                      ret


:0041799A 55                      push ebp
:0041799B 8BEC                    mov ebp, esp
:0041799D 51                      push ecx
:0041799E 894DFC                  mov dword ptr [ebp-04], ecx
:004179A1 8BE5                    mov esp, ebp
:004179A3 5D                      pop ebp
:004179A4 C3                      ret



* Referenced by a CALL at Addresses:
|:00411E53   , :00413861   , :004139D3   , :00413A3B   , :00413A90   
|:00413AEA   , :00413B97   , :00413C00   , :00417466   , :0041767C   
|:00417784   
|
:004179A5 55                      push ebp
:004179A6 8BEC                    mov ebp, esp
:004179A8 83EC08                  sub esp, 00000008
:004179AB 894DF8                  mov dword ptr [ebp-08], ecx
:004179AE 8B4508                  mov eax, dword ptr [ebp+08]
:004179B1 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417A40(U)
|
:004179B4 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004179B7 33D2                    xor edx, edx
:004179B9 8A11                    mov dl, byte ptr [ecx]
:004179BB 85D2                    test edx, edx
:004179BD 0F8482000000            je 00417A45
:004179C3 8B450C                  mov eax, dword ptr [ebp+0C]
:004179C6 33C9                    xor ecx, ecx
:004179C8 8A08                    mov cl, byte ptr [eax]
:004179CA 83F920                  cmp ecx, 00000020
:004179CD 7D39                    jge 00417A08
:004179CF 8B550C                  mov edx, dword ptr [ebp+0C]
:004179D2 33C0                    xor eax, eax
:004179D4 8A02                    mov al, byte ptr [edx]
:004179D6 83F80A                  cmp eax, 0000000A
:004179D9 750F                    jne 004179EA
:004179DB 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004179DE 33D2                    xor edx, edx
:004179E0 8A5101                  mov dl, byte ptr [ecx+01]
:004179E3 83FA26                  cmp edx, 00000026
:004179E6 7502                    jne 004179EA
:004179E8 EB5B                    jmp 00417A45

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004179D9(C), :004179E6(C)
|
:004179EA 8B4508                  mov eax, dword ptr [ebp+08]
:004179ED 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004179F0 8A11                    mov dl, byte ptr [ecx]
:004179F2 8810                    mov byte ptr [eax], dl
:004179F4 8B4508                  mov eax, dword ptr [ebp+08]
:004179F7 83C001                  add eax, 00000001
:004179FA 894508                  mov dword ptr [ebp+08], eax
:004179FD 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00417A00 83C101                  add ecx, 00000001
:00417A03 894D0C                  mov dword ptr [ebp+0C], ecx
:00417A06 EB38                    jmp 00417A40

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004179CD(C)
|
:00417A08 8B5508                  mov edx, dword ptr [ebp+08]
:00417A0B 8B450C                  mov eax, dword ptr [ebp+0C]
:00417A0E 8A08                    mov cl, byte ptr [eax]
:00417A10 880A                    mov byte ptr [edx], cl
:00417A12 8B5508                  mov edx, dword ptr [ebp+08]
:00417A15 83C201                  add edx, 00000001
:00417A18 895508                  mov dword ptr [ebp+08], edx
:00417A1B 8B450C                  mov eax, dword ptr [ebp+0C]
:00417A1E 83C001                  add eax, 00000001
:00417A21 89450C                  mov dword ptr [ebp+0C], eax
:00417A24 8B4D08                  mov ecx, dword ptr [ebp+08]
:00417A27 8B550C                  mov edx, dword ptr [ebp+0C]
:00417A2A 8A02                    mov al, byte ptr [edx]
:00417A2C 8801                    mov byte ptr [ecx], al
:00417A2E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00417A31 83C101                  add ecx, 00000001
:00417A34 894D08                  mov dword ptr [ebp+08], ecx
:00417A37 8B550C                  mov edx, dword ptr [ebp+0C]
:00417A3A 83C201                  add edx, 00000001
:00417A3D 89550C                  mov dword ptr [ebp+0C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417A06(U)
|
:00417A40 E96FFFFFFF              jmp 004179B4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004179BD(C), :004179E8(U)
|
:00417A45 8B4508                  mov eax, dword ptr [ebp+08]
:00417A48 C60000                  mov byte ptr [eax], 00
:00417A4B 8B45FC                  mov eax, dword ptr [ebp-04]
:00417A4E 8BE5                    mov esp, ebp
:00417A50 5D                      pop ebp
:00417A51 C20800                  ret 0008



* Referenced by a CALL at Address:
|:0041B04F   
|
:00417A54 55                      push ebp
:00417A55 8BEC                    mov ebp, esp
:00417A57 6AFF                    push FFFFFFFF
:00417A59 6829514800              push 00485129
:00417A5E 64A100000000            mov eax, dword ptr fs:[00000000]
:00417A64 50                      push eax
:00417A65 64892500000000          mov dword ptr fs:[00000000], esp
:00417A6C 83EC24                  sub esp, 00000024
:00417A6F 894DD0                  mov dword ptr [ebp-30], ecx
:00417A72 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00417A75 E8A6B8FEFF              call 00403320
:00417A7A C745FC00000000          mov [ebp-04], 00000000
:00417A81 6A02                    push 00000002
:00417A83 8B4508                  mov eax, dword ptr [ebp+08]
:00417A86 50                      push eax
:00417A87 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00417A8A E8CD140000              call 00418F5C
:00417A8F C745D800000000          mov [ebp-28], 00000000
:00417A96 EB09                    jmp 00417AA1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417B83(U)
|
:00417A98 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00417A9B 83C101                  add ecx, 00000001
:00417A9E 894DD8                  mov dword ptr [ebp-28], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417A96(U)
|
:00417AA1 837DD873                cmp dword ptr [ebp-28], 00000073
:00417AA5 0F8DDD000000            jnl 00417B88
:00417AAB 6A04                    push 00000004
:00417AAD 8B55D8                  mov edx, dword ptr [ebp-28]
:00417AB0 C1E206                  shl edx, 06
:00417AB3 8B45D0                  mov eax, dword ptr [ebp-30]
:00417AB6 8D8C1044200000          lea ecx, dword ptr [eax+edx+00002044]
:00417ABD 51                      push ecx
:00417ABE 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00417AC1 E8A1160000              call 00419167
:00417AC6 6A01                    push 00000001
:00417AC8 8B55D8                  mov edx, dword ptr [ebp-28]
:00417ACB C1E206                  shl edx, 06
:00417ACE 8B45D0                  mov eax, dword ptr [ebp-30]
:00417AD1 8D8C1048200000          lea ecx, dword ptr [eax+edx+00002048]
:00417AD8 51                      push ecx
:00417AD9 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00417ADC E886160000              call 00419167
:00417AE1 6A01                    push 00000001
:00417AE3 8B55D8                  mov edx, dword ptr [ebp-28]
:00417AE6 C1E206                  shl edx, 06
:00417AE9 8B45D0                  mov eax, dword ptr [ebp-30]
:00417AEC 8D8C1049200000          lea ecx, dword ptr [eax+edx+00002049]
:00417AF3 51                      push ecx
:00417AF4 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00417AF7 E86B160000              call 00419167
:00417AFC 6A04                    push 00000004
:00417AFE 8B55D8                  mov edx, dword ptr [ebp-28]
:00417B01 C1E206                  shl edx, 06
:00417B04 8B45D0                  mov eax, dword ptr [ebp-30]
:00417B07 8D8C104C200000          lea ecx, dword ptr [eax+edx+0000204C]
:00417B0E 51                      push ecx
:00417B0F 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00417B12 E850160000              call 00419167
:00417B17 6A01                    push 00000001
:00417B19 8B55D8                  mov edx, dword ptr [ebp-28]
:00417B1C C1E206                  shl edx, 06
:00417B1F 8B45D0                  mov eax, dword ptr [ebp-30]
:00417B22 8D8C1050200000          lea ecx, dword ptr [eax+edx+00002050]
:00417B29 51                      push ecx
:00417B2A 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00417B2D E835160000              call 00419167
:00417B32 6A02                    push 00000002
:00417B34 8B55D8                  mov edx, dword ptr [ebp-28]
:00417B37 C1E206                  shl edx, 06
:00417B3A 8B45D0                  mov eax, dword ptr [ebp-30]
:00417B3D 8D8C1052200000          lea ecx, dword ptr [eax+edx+00002052]
:00417B44 51                      push ecx
:00417B45 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00417B48 E81A160000              call 00419167
:00417B4D 6A01                    push 00000001
:00417B4F 8B55D8                  mov edx, dword ptr [ebp-28]
:00417B52 C1E206                  shl edx, 06
:00417B55 8B45D0                  mov eax, dword ptr [ebp-30]
:00417B58 8D8C1054200000          lea ecx, dword ptr [eax+edx+00002054]
:00417B5F 51                      push ecx
:00417B60 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00417B63 E8FF150000              call 00419167
:00417B68 6A01                    push 00000001
:00417B6A 8B55D8                  mov edx, dword ptr [ebp-28]
:00417B6D C1E206                  shl edx, 06
:00417B70 8B45D0                  mov eax, dword ptr [ebp-30]
:00417B73 8D8C1055200000          lea ecx, dword ptr [eax+edx+00002055]
:00417B7A 51                      push ecx
:00417B7B 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00417B7E E8E4150000              call 00419167
:00417B83 E910FFFFFF              jmp 00417A98

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417AA5(C)
|
:00417B88 6881010000              push 00000181
:00417B8D 8B55D0                  mov edx, dword ptr [ebp-30]
:00417B90 81C2103D0000            add edx, 00003D10
:00417B96 52                      push edx
:00417B97 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00417B9A E8C8150000              call 00419167
:00417B9F 6A01                    push 00000001
:00417BA1 8B45D0                  mov eax, dword ptr [ebp-30]
:00417BA4 050E3D0000              add eax, 00003D0E
:00417BA9 50                      push eax
:00417BAA 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00417BAD E8B5150000              call 00419167
:00417BB2 6A01                    push 00000001
:00417BB4 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00417BB7 81C10F3D0000            add ecx, 00003D0F
:00417BBD 51                      push ecx
:00417BBE 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00417BC1 E8A1150000              call 00419167
:00417BC6 6A08                    push 00000008
:00417BC8 8B55D0                  mov edx, dword ptr [ebp-30]
:00417BCB 81C2043D0000            add edx, 00003D04
:00417BD1 52                      push edx
:00417BD2 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00417BD5 E88D150000              call 00419167
:00417BDA C745D800000000          mov [ebp-28], 00000000
:00417BE1 EB09                    jmp 00417BEC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417C0A(U)
|
:00417BE3 8B45D8                  mov eax, dword ptr [ebp-28]
:00417BE6 83C001                  add eax, 00000001
:00417BE9 8945D8                  mov dword ptr [ebp-28], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417BE1(U)
|
:00417BEC 817DD800080000          cmp dword ptr [ebp-28], 00000800
:00417BF3 7D17                    jge 00417C0C
:00417BF5 6A04                    push 00000004
:00417BF7 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00417BFA 8B55D0                  mov edx, dword ptr [ebp-30]
:00417BFD 8D448A38                lea eax, dword ptr [edx+4*ecx+38]
:00417C01 50                      push eax
:00417C02 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00417C05 E85D150000              call 00419167
:00417C0A EBD7                    jmp 00417BE3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417BF3(C)
|
:00417C0C 6A04                    push 00000004
:00417C0E 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00417C11 81C138200000            add ecx, 00002038
:00417C17 51                      push ecx
:00417C18 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00417C1B E847150000              call 00419167
:00417C20 6A04                    push 00000004
:00417C22 8B55D0                  mov edx, dword ptr [ebp-30]
:00417C25 81C23C200000            add edx, 0000203C
:00417C2B 52                      push edx
:00417C2C 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00417C2F E833150000              call 00419167
:00417C34 6A0A                    push 0000000A
:00417C36 8D45DC                  lea eax, dword ptr [ebp-24]
:00417C39 50                      push eax
:00417C3A 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00417C3D E825150000              call 00419167
:00417C42 8945EC                  mov dword ptr [ebp-14], eax
:00417C45 8D4DDC                  lea ecx, dword ptr [ebp-24]
:00417C48 51                      push ecx
:00417C49 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00417C4C E8B588FFFF              call 00410506
:00417C51 8945EC                  mov dword ptr [ebp-14], eax
:00417C54 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00417C57 E869160000              call 004192C5
:00417C5C 8B55EC                  mov edx, dword ptr [ebp-14]
:00417C5F 8955D4                  mov dword ptr [ebp-2C], edx
:00417C62 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00417C69 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00417C6C E8D8120000              call 00418F49
:00417C71 8B45D4                  mov eax, dword ptr [ebp-2C]
:00417C74 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00417C77 64890D00000000          mov dword ptr fs:[00000000], ecx
:00417C7E 8BE5                    mov esp, ebp
:00417C80 5D                      pop ebp
:00417C81 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0041B431   
|
:00417C84 55                      push ebp
:00417C85 8BEC                    mov ebp, esp
:00417C87 6AFF                    push FFFFFFFF
:00417C89 683C514800              push 0048513C
:00417C8E 64A100000000            mov eax, dword ptr fs:[00000000]
:00417C94 50                      push eax
:00417C95 64892500000000          mov dword ptr fs:[00000000], esp
:00417C9C 83EC28                  sub esp, 00000028
:00417C9F 894DCC                  mov dword ptr [ebp-34], ecx
:00417CA2 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00417CA5 E876B6FEFF              call 00403320
:00417CAA C745FC00000000          mov [ebp-04], 00000000
:00417CB1 6A01                    push 00000001
:00417CB3 8B4508                  mov eax, dword ptr [ebp+08]
:00417CB6 50                      push eax
:00417CB7 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00417CBA E89D120000              call 00418F5C
:00417CBF 8945D8                  mov dword ptr [ebp-28], eax
:00417CC2 837DD800                cmp dword ptr [ebp-28], 00000000
:00417CC6 7515                    jne 00417CDD
:00417CC8 8B4D08                  mov ecx, dword ptr [ebp+08]
:00417CCB 51                      push ecx
:00417CCC E803120000              call 00418ED4
:00417CD1 83C404                  add esp, 00000004
:00417CD4 50                      push eax
:00417CD5 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00417CD8 E8DE130000              call 004190BB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417CC6(C)
|
:00417CDD C745D400000000          mov [ebp-2C], 00000000
:00417CE4 EB09                    jmp 00417CEF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417DD1(U)
|
:00417CE6 8B55D4                  mov edx, dword ptr [ebp-2C]
:00417CE9 83C201                  add edx, 00000001
:00417CEC 8955D4                  mov dword ptr [ebp-2C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417CE4(U)
|
:00417CEF 837DD473                cmp dword ptr [ebp-2C], 00000073
:00417CF3 0F8DDD000000            jnl 00417DD6
:00417CF9 6A04                    push 00000004
:00417CFB 8B45D4                  mov eax, dword ptr [ebp-2C]
:00417CFE C1E006                  shl eax, 06
:00417D01 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00417D04 8D940144200000          lea edx, dword ptr [ecx+eax+00002044]
:00417D0B 52                      push edx
:00417D0C 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00417D0F E869150000              call 0041927D
:00417D14 6A01                    push 00000001
:00417D16 8B45D4                  mov eax, dword ptr [ebp-2C]
:00417D19 C1E006                  shl eax, 06
:00417D1C 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00417D1F 8D940148200000          lea edx, dword ptr [ecx+eax+00002048]
:00417D26 52                      push edx
:00417D27 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00417D2A E84E150000              call 0041927D
:00417D2F 6A01                    push 00000001
:00417D31 8B45D4                  mov eax, dword ptr [ebp-2C]
:00417D34 C1E006                  shl eax, 06
:00417D37 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00417D3A 8D940149200000          lea edx, dword ptr [ecx+eax+00002049]
:00417D41 52                      push edx
:00417D42 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00417D45 E833150000              call 0041927D
:00417D4A 6A04                    push 00000004
:00417D4C 8B45D4                  mov eax, dword ptr [ebp-2C]
:00417D4F C1E006                  shl eax, 06
:00417D52 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00417D55 8D94014C200000          lea edx, dword ptr [ecx+eax+0000204C]
:00417D5C 52                      push edx
:00417D5D 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00417D60 E818150000              call 0041927D
:00417D65 6A01                    push 00000001
:00417D67 8B45D4                  mov eax, dword ptr [ebp-2C]
:00417D6A C1E006                  shl eax, 06
:00417D6D 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00417D70 8D940150200000          lea edx, dword ptr [ecx+eax+00002050]
:00417D77 52                      push edx
:00417D78 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00417D7B E8FD140000              call 0041927D
:00417D80 6A02                    push 00000002
:00417D82 8B45D4                  mov eax, dword ptr [ebp-2C]
:00417D85 C1E006                  shl eax, 06
:00417D88 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00417D8B 8D940152200000          lea edx, dword ptr [ecx+eax+00002052]
:00417D92 52                      push edx
:00417D93 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00417D96 E8E2140000              call 0041927D
:00417D9B 6A01                    push 00000001
:00417D9D 8B45D4                  mov eax, dword ptr [ebp-2C]
:00417DA0 C1E006                  shl eax, 06
:00417DA3 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00417DA6 8D940154200000          lea edx, dword ptr [ecx+eax+00002054]
:00417DAD 52                      push edx
:00417DAE 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00417DB1 E8C7140000              call 0041927D
:00417DB6 6A01                    push 00000001
:00417DB8 8B45D4                  mov eax, dword ptr [ebp-2C]
:00417DBB C1E006                  shl eax, 06
:00417DBE 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00417DC1 8D940155200000          lea edx, dword ptr [ecx+eax+00002055]
:00417DC8 52                      push edx
:00417DC9 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00417DCC E8AC140000              call 0041927D
:00417DD1 E910FFFFFF              jmp 00417CE6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417CF3(C)
|
:00417DD6 6881010000              push 00000181
:00417DDB 8B45CC                  mov eax, dword ptr [ebp-34]
:00417DDE 05103D0000              add eax, 00003D10
:00417DE3 50                      push eax
:00417DE4 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00417DE7 E891140000              call 0041927D
:00417DEC 6A01                    push 00000001
:00417DEE 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00417DF1 81C10E3D0000            add ecx, 00003D0E
:00417DF7 51                      push ecx
:00417DF8 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00417DFB E87D140000              call 0041927D
:00417E00 6A01                    push 00000001
:00417E02 8B55CC                  mov edx, dword ptr [ebp-34]
:00417E05 81C20F3D0000            add edx, 00003D0F
:00417E0B 52                      push edx
:00417E0C 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00417E0F E869140000              call 0041927D
:00417E14 6A08                    push 00000008
:00417E16 8B45CC                  mov eax, dword ptr [ebp-34]
:00417E19 05043D0000              add eax, 00003D04
:00417E1E 50                      push eax
:00417E1F 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00417E22 E856140000              call 0041927D
:00417E27 C745D400000000          mov [ebp-2C], 00000000
:00417E2E EB09                    jmp 00417E39

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417E57(U)
|
:00417E30 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00417E33 83C101                  add ecx, 00000001
:00417E36 894DD4                  mov dword ptr [ebp-2C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417E2E(U)
|
:00417E39 817DD400080000          cmp dword ptr [ebp-2C], 00000800
:00417E40 7D17                    jge 00417E59
:00417E42 6A04                    push 00000004
:00417E44 8B55D4                  mov edx, dword ptr [ebp-2C]
:00417E47 8B45CC                  mov eax, dword ptr [ebp-34]
:00417E4A 8D4C9038                lea ecx, dword ptr [eax+4*edx+38]
:00417E4E 51                      push ecx
:00417E4F 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00417E52 E826140000              call 0041927D
:00417E57 EBD7                    jmp 00417E30

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417E40(C)
|
:00417E59 6A04                    push 00000004
:00417E5B 8B55CC                  mov edx, dword ptr [ebp-34]
:00417E5E 81C238200000            add edx, 00002038
:00417E64 52                      push edx
:00417E65 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00417E68 E810140000              call 0041927D
:00417E6D 6A04                    push 00000004
:00417E6F 8B45CC                  mov eax, dword ptr [ebp-34]
:00417E72 053C200000              add eax, 0000203C
:00417E77 50                      push eax
:00417E78 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00417E7B E8FD130000              call 0041927D
:00417E80 8D4DDC                  lea ecx, dword ptr [ebp-24]
:00417E83 51                      push ecx
:00417E84 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00417E87 E8E485FFFF              call 00410470
:00417E8C 8945EC                  mov dword ptr [ebp-14], eax
:00417E8F 8B55EC                  mov edx, dword ptr [ebp-14]
:00417E92 52                      push edx
:00417E93 8D45DC                  lea eax, dword ptr [ebp-24]
:00417E96 50                      push eax
:00417E97 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00417E9A E8DE130000              call 0041927D
:00417E9F 8945EC                  mov dword ptr [ebp-14], eax
:00417EA2 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00417EA5 E81B140000              call 004192C5
:00417EAA 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00417EAD 894DD0                  mov dword ptr [ebp-30], ecx
:00417EB0 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00417EB7 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00417EBA E88A100000              call 00418F49
:00417EBF 8B45D0                  mov eax, dword ptr [ebp-30]
:00417EC2 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00417EC5 64890D00000000          mov dword ptr fs:[00000000], ecx
:00417ECC 8BE5                    mov esp, ebp
:00417ECE 5D                      pop ebp
:00417ECF C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:004180FF   , :0041814C   , :00418382   , :004183CF   , :0042BFE8   
|:0042C056   
|
:00417ED2 55                      push ebp
:00417ED3 8BEC                    mov ebp, esp
:00417ED5 6AFF                    push FFFFFFFF
:00417ED7 684F514800              push 0048514F
:00417EDC 64A100000000            mov eax, dword ptr fs:[00000000]
:00417EE2 50                      push eax
:00417EE3 64892500000000          mov dword ptr fs:[00000000], esp
:00417EEA 83EC30                  sub esp, 00000030
:00417EED 894DC4                  mov dword ptr [ebp-3C], ecx
:00417EF0 8D4DEC                  lea ecx, dword ptr [ebp-14]
:00417EF3 E828B4FEFF              call 00403320
:00417EF8 C745FC00000000          mov [ebp-04], 00000000
:00417EFF B970074B00              mov ecx, 004B0770
:00417F04 E8070F0000              call 00418E10
:00417F09 25FF000000              and eax, 000000FF
:00417F0E 99                      cdq
:00417F0F B914000000              mov ecx, 00000014
:00417F14 F7F9                    idiv ecx
:00417F16 668945F0                mov word ptr [ebp-10], ax
:00417F1A B970074B00              mov ecx, 004B0770
:00417F1F E8EC0E0000              call 00418E10
:00417F24 25FF000000              and eax, 000000FF
:00417F29 99                      cdq
:00417F2A B914000000              mov ecx, 00000014
:00417F2F F7F9                    idiv ecx
:00417F31 8BC2                    mov eax, edx
:00417F33 99                      cdq
:00417F34 2BC2                    sub eax, edx
:00417F36 D1F8                    sar eax, 1
:00417F38 668945E4                mov word ptr [ebp-1C], ax
:00417F3C 8B55F0                  mov edx, dword ptr [ebp-10]
:00417F3F 81E2FFFF0000            and edx, 0000FFFF
:00417F45 83C230                  add edx, 00000030
:00417F48 881592B34800            mov byte ptr [0048B392], dl
:00417F4E 8B45E4                  mov eax, dword ptr [ebp-1C]
:00417F51 25FFFF0000              and eax, 0000FFFF
:00417F56 83C030                  add eax, 00000030
:00417F59 A293B34800              mov byte ptr [0048B393], al
:00417F5E 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00417F61 81E1FFFF0000            and ecx, 0000FFFF
:00417F67 83C130                  add ecx, 00000030
:00417F6A 880DA2B34800            mov byte ptr [0048B3A2], cl
:00417F70 8B55E4                  mov edx, dword ptr [ebp-1C]
:00417F73 81E2FFFF0000            and edx, 0000FFFF
:00417F79 83C230                  add edx, 00000030
:00417F7C 8815A3B34800            mov byte ptr [0048B3A3], dl
:00417F82 B970074B00              mov ecx, 004B0770
:00417F87 E8840E0000              call 00418E10
:00417F8C 25FF000000              and eax, 000000FF
:00417F91 99                      cdq
:00417F92 33C2                    xor eax, edx
:00417F94 2BC2                    sub eax, edx
:00417F96 83E001                  and eax, 00000001
:00417F99 33C2                    xor eax, edx
:00417F9B 2BC2                    sub eax, edx
:00417F9D 85C0                    test eax, eax
:00417F9F 7509                    jne 00417FAA

* Possible StringData Ref from Data Obj ->"R_xx.EEX"
                                  |
:00417FA1 C745E890B34800          mov [ebp-18], 0048B390
:00417FA8 EB07                    jmp 00417FB1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417F9F(C)
|

* Possible StringData Ref from Data Obj ->"S_xx.EEX"
                                  |
:00417FAA C745E8A0B34800          mov [ebp-18], 0048B3A0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417FA8(U)
|
:00417FB1 6A00                    push 00000000
:00417FB3 8B45E8                  mov eax, dword ptr [ebp-18]
:00417FB6 50                      push eax
:00417FB7 8D4DEC                  lea ecx, dword ptr [ebp-14]
:00417FBA E89D0F0000              call 00418F5C
:00417FBF 85C0                    test eax, eax
:00417FC1 7516                    jne 00417FD9
:00417FC3 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00417FC6 51                      push ecx

* Possible StringData Ref from Data Obj ->"ȡ籾"%s"ʧܡ"
                                  |
:00417FC7 68C4B34800              push 0048B3C4
:00417FCC E806CC0500              call 00474BD7
:00417FD1 83C408                  add esp, 00000008
:00417FD4 E9C1000000              jmp 0041809A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00417FC1(C)
|
:00417FD9 8D4DEC                  lea ecx, dword ptr [ebp-14]
:00417FDC E8C4130000              call 004193A5
:00417FE1 8945DC                  mov dword ptr [ebp-24], eax
:00417FE4 6A00                    push 00000000
:00417FE6 E805900600              call 00480FF0
:00417FEB 83C404                  add esp, 00000004
:00417FEE 8945E0                  mov dword ptr [ebp-20], eax
:00417FF1 8B55DC                  mov edx, dword ptr [ebp-24]
:00417FF4 52                      push edx
:00417FF5 E8E68F0600              call 00480FE0
:00417FFA 83C404                  add esp, 00000004
:00417FFD 8945D8                  mov dword ptr [ebp-28], eax
:00418000 8B45E0                  mov eax, dword ptr [ebp-20]
:00418003 50                      push eax
:00418004 E8E78F0600              call 00480FF0
:00418009 83C404                  add esp, 00000004
:0041800C 837DD800                cmp dword ptr [ebp-28], 00000000
:00418010 747B                    je 0041808D
:00418012 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00418015 51                      push ecx
:00418016 8B55D8                  mov edx, dword ptr [ebp-28]
:00418019 52                      push edx
:0041801A 6A00                    push 00000000
:0041801C 8D4DEC                  lea ecx, dword ptr [ebp-14]
:0041801F E860110000              call 00419184
:00418024 8945D4                  mov dword ptr [ebp-2C], eax
:00418027 8D4DEC                  lea ecx, dword ptr [ebp-14]
:0041802A E896120000              call 004192C5
:0041802F 8B45D4                  mov eax, dword ptr [ebp-2C]
:00418032 3B45DC                  cmp eax, dword ptr [ebp-24]
:00418035 7531                    jne 00418068
:00418037 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0041803A 51                      push ecx
:0041803B 8B55D8                  mov edx, dword ptr [ebp-28]
:0041803E 52                      push edx
:0041803F B9902F4900              mov ecx, 00492F90
:00418044 E82A82FFFF              call 00410273
:00418049 85C0                    test eax, eax
:0041804B 741B                    je 00418068
:0041804D C745D001000000          mov [ebp-30], 00000001
:00418054 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0041805B 8D4DEC                  lea ecx, dword ptr [ebp-14]
:0041805E E8E60E0000              call 00418F49
:00418063 8B45D0                  mov eax, dword ptr [ebp-30]
:00418066 EB4B                    jmp 004180B3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00418035(C), :0041804B(C)
|
:00418068 8B45D8                  mov eax, dword ptr [ebp-28]
:0041806B 8945CC                  mov dword ptr [ebp-34], eax
:0041806E 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00418071 51                      push ecx
:00418072 E8A98F0600              call 00481020
:00418077 83C404                  add esp, 00000004
:0041807A 8B55E8                  mov edx, dword ptr [ebp-18]
:0041807D 52                      push edx

* Possible StringData Ref from Data Obj ->"ȡ籾"%s"ʧܡ"
                                  |
:0041807E 68DCB34800              push 0048B3DC
:00418083 E84FCB0500              call 00474BD7
:00418088 83C408                  add esp, 00000008
:0041808B EB0D                    jmp 0041809A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418010(C)
|
:0041808D 68F06E4800              push 00486EF0
:00418092 E840CB0500              call 00474BD7
:00418097 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00417FD4(U), :0041808B(U)
|
:0041809A C745C800000000          mov [ebp-38], 00000000
:004180A1 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:004180A8 8D4DEC                  lea ecx, dword ptr [ebp-14]
:004180AB E8990E0000              call 00418F49
:004180B0 8B45C8                  mov eax, dword ptr [ebp-38]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418066(U)
|
:004180B3 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004180B6 64890D00000000          mov dword ptr fs:[00000000], ecx
:004180BD 8BE5                    mov esp, ebp
:004180BF 5D                      pop ebp
:004180C0 C3                      ret



* Referenced by a CALL at Addresses:
|:0040BBC7   , :0041821D   , :0041826F   , :0044C638   , :0044EC60   
|:0044ED52   , :0044F0C7   
|
:004180C1 55                      push ebp
:004180C2 8BEC                    mov ebp, esp
:004180C4 83EC08                  sub esp, 00000008
:004180C7 894DF8                  mov dword ptr [ebp-08], ecx
:004180CA C745FC00000000          mov [ebp-04], 00000000
:004180D1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004180D4 E8C87FFFFF              call 004100A1
:004180D9 85C0                    test eax, eax
:004180DB 7441                    je 0041811E
:004180DD 6A00                    push 00000000
:004180DF 6A01                    push 00000001
:004180E1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004180E4 E86587FFFF              call 0041084E
:004180E9 8945FC                  mov dword ptr [ebp-04], eax
:004180EC 837DFC04                cmp dword ptr [ebp-04], 00000004
:004180F0 752C                    jne 0041811E
:004180F2 B970074B00              mov ecx, 004B0770
:004180F7 E8340D0000              call 00418E30
:004180FC 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004180FF E8CEFDFFFF              call 00417ED2
:00418104 8B45F8                  mov eax, dword ptr [ebp-08]
:00418107 8B10                    mov edx, dword ptr [eax]
:00418109 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041810C FF12                    call dword ptr [edx]
:0041810E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00418111 E850F8FFFF              call 00417966
:00418116 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00418119 E862F8FFFF              call 00417980

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004180DB(C), :004180F0(C)
|
:0041811E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00418121 E82A88FFFF              call 00410950
:00418126 85C0                    test eax, eax
:00418128 7541                    jne 0041816B
:0041812A 6A00                    push 00000000
:0041812C 6A01                    push 00000001
:0041812E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00418131 E81887FFFF              call 0041084E
:00418136 8945FC                  mov dword ptr [ebp-04], eax
:00418139 837DFC04                cmp dword ptr [ebp-04], 00000004
:0041813D 752C                    jne 0041816B
:0041813F B970074B00              mov ecx, 004B0770
:00418144 E8E70C0000              call 00418E30
:00418149 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041814C E881FDFFFF              call 00417ED2
:00418151 8B45F8                  mov eax, dword ptr [ebp-08]
:00418154 8B10                    mov edx, dword ptr [eax]
:00418156 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00418159 FF12                    call dword ptr [edx]
:0041815B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041815E E803F8FFFF              call 00417966
:00418163 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00418166 E815F8FFFF              call 00417980

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00418128(C), :0041813D(C)
|
:0041816B 8B45FC                  mov eax, dword ptr [ebp-04]
:0041816E 8BE5                    mov esp, ebp
:00418170 5D                      pop ebp
:00418171 C20400                  ret 0004


:00418174 55                      push ebp
:00418175 8BEC                    mov ebp, esp
:00418177 51                      push ecx
:00418178 894DFC                  mov dword ptr [ebp-04], ecx
:0041817B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041817E E81E7FFFFF              call 004100A1
:00418183 85C0                    test eax, eax
:00418185 7407                    je 0041818E
:00418187 B801000000              mov eax, 00000001
:0041818C EB02                    jmp 00418190

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418185(C)
|
:0041818E 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041818C(U)
|
:00418190 8BE5                    mov esp, ebp
:00418192 5D                      pop ebp
:00418193 C3                      ret


:00418194 55                      push ebp
:00418195 8BEC                    mov ebp, esp
:00418197 83EC0C                  sub esp, 0000000C
:0041819A 894DF4                  mov dword ptr [ebp-0C], ecx
:0041819D B970074B00              mov ecx, 004B0770
:004181A2 E869270100              call 0042A910
:004181A7 8945F8                  mov dword ptr [ebp-08], eax
:004181AA 8B45F8                  mov eax, dword ptr [ebp-08]
:004181AD 24DF                    and al, DF
:004181AF 8945F8                  mov dword ptr [ebp-08], eax
:004181B2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004181B5 51                      push ecx
:004181B6 B970074B00              mov ecx, 004B0770
:004181BB E8C05FFFFF              call 0040E180
:004181C0 C745FCFFFF0000          mov [ebp-04], 0000FFFF
:004181C7 6A04                    push 00000004
:004181C9 8D55FC                  lea edx, dword ptr [ebp-04]
:004181CC 52                      push edx
:004181CD 6A01                    push 00000001
:004181CF 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004181D2 E8A07EFFFF              call 00410077
:004181D7 33C0                    xor eax, eax
:004181D9 8BE5                    mov esp, ebp
:004181DB 5D                      pop ebp
:004181DC C3                      ret



* Referenced by a CALL at Address:
|:0042978F   
|
:004181DD 55                      push ebp
:004181DE 8BEC                    mov ebp, esp
:004181E0 83EC08                  sub esp, 00000008
:004181E3 894DF8                  mov dword ptr [ebp-08], ecx
:004181E6 B970074B00              mov ecx, 004B0770
:004181EB E820270100              call 0042A910
:004181F0 8945FC                  mov dword ptr [ebp-04], eax
:004181F3 8B45FC                  mov eax, dword ptr [ebp-04]
:004181F6 0C20                    or al, 20
:004181F8 50                      push eax
:004181F9 B970074B00              mov ecx, 004B0770
:004181FE E87D5FFFFF              call 0040E180
:00418203 6A04                    push 00000004
:00418205 8D4D08                  lea ecx, dword ptr [ebp+08]
:00418208 51                      push ecx
:00418209 6A01                    push 00000001
:0041820B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041820E E8647EFFFF              call 00410077
:00418213 68FFFF0000              push 0000FFFF
:00418218 B9902F4900              mov ecx, 00492F90
:0041821D E89FFEFFFF              call 004180C1
:00418222 8B55FC                  mov edx, dword ptr [ebp-04]
:00418225 52                      push edx
:00418226 B970074B00              mov ecx, 004B0770
:0041822B E8505FFFFF              call 0040E180
:00418230 33C0                    xor eax, eax
:00418232 8BE5                    mov esp, ebp
:00418234 5D                      pop ebp
:00418235 C20400                  ret 0004


:00418238 55                      push ebp
:00418239 8BEC                    mov ebp, esp
:0041823B 83EC08                  sub esp, 00000008
:0041823E 894DF8                  mov dword ptr [ebp-08], ecx
:00418241 B970074B00              mov ecx, 004B0770
:00418246 E8C5260100              call 0042A910
:0041824B 8945FC                  mov dword ptr [ebp-04], eax
:0041824E 8B45FC                  mov eax, dword ptr [ebp-04]
:00418251 0B450C                  or eax, dword ptr [ebp+0C]
:00418254 8945FC                  mov dword ptr [ebp-04], eax
:00418257 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041825A 51                      push ecx
:0041825B B970074B00              mov ecx, 004B0770
:00418260 E81B5FFFFF              call 0040E180
:00418265 68FFFF0000              push 0000FFFF
:0041826A B9902F4900              mov ecx, 00492F90
:0041826F E84DFEFFFF              call 004180C1
:00418274 B970074B00              mov ecx, 004B0770
:00418279 E892260100              call 0042A910
:0041827E 8945FC                  mov dword ptr [ebp-04], eax
:00418281 8B550C                  mov edx, dword ptr [ebp+0C]
:00418284 F7D2                    not edx
:00418286 8B45FC                  mov eax, dword ptr [ebp-04]
:00418289 23C2                    and eax, edx
:0041828B 8945FC                  mov dword ptr [ebp-04], eax
:0041828E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00418291 51                      push ecx
:00418292 B970074B00              mov ecx, 004B0770
:00418297 E8E45EFFFF              call 0040E180
:0041829C 33C0                    xor eax, eax
:0041829E 8BE5                    mov esp, ebp
:004182A0 5D                      pop ebp
:004182A1 C20800                  ret 0008



* Referenced by a CALL at Address:
|:00429775   
|
:004182A4 55                      push ebp
:004182A5 8BEC                    mov ebp, esp
:004182A7 83EC14                  sub esp, 00000014
:004182AA 894DEC                  mov dword ptr [ebp-14], ecx
:004182AD C745F400000000          mov [ebp-0C], 00000000
:004182B4 C745FC00000000          mov [ebp-04], 00000000
:004182BB C745F868CF4900          mov [ebp-08], 0049CF68
:004182C2 66C745F00000            mov [ebp-10], 0000
:004182C8 EB15                    jmp 004182DF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418342(U)
|
:004182CA 668B45F0                mov ax, word ptr [ebp-10]
:004182CE 66050100                add ax, 0001
:004182D2 668945F0                mov word ptr [ebp-10], ax
:004182D6 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004182D9 83C140                  add ecx, 00000040
:004182DC 894DF8                  mov dword ptr [ebp-08], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004182C8(U)
|
:004182DF 8B55F0                  mov edx, dword ptr [ebp-10]
:004182E2 81E2FFFF0000            and edx, 0000FFFF
:004182E8 81FA80000000            cmp edx, 00000080
:004182EE 7D54                    jge 00418344
:004182F0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004182F3 E8580B0000              call 00418E50
:004182F8 25FFFF0000              and eax, 0000FFFF
:004182FD 2500800000              and eax, 00008000
:00418302 85C0                    test eax, eax
:00418304 743C                    je 00418342
:00418306 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00418309 E8620B0000              call 00418E70
:0041830E 25FFFF0000              and eax, 0000FFFF
:00418313 83F802                  cmp eax, 00000002
:00418316 7423                    je 0041833B
:00418318 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041831B E8500B0000              call 00418E70
:00418320 25FFFF0000              and eax, 0000FFFF
:00418325 83F801                  cmp eax, 00000001
:00418328 7411                    je 0041833B
:0041832A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041832D E83E0B0000              call 00418E70
:00418332 25FFFF0000              and eax, 0000FFFF
:00418337 85C0                    test eax, eax
:00418339 7507                    jne 00418342

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00418316(C), :00418328(C)
|
:0041833B C745FC01000000          mov [ebp-04], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00418304(C), :00418339(C)
|
:00418342 EB86                    jmp 004182CA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004182EE(C)
|
:00418344 837DFC00                cmp dword ptr [ebp-04], 00000000
:00418348 740A                    je 00418354

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0041834A B806000000              mov eax, 00000006
:0041834F E99D000000              jmp 004183F1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418348(C)
|
:00418354 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00418357 E8457DFFFF              call 004100A1
:0041835C 85C0                    test eax, eax
:0041835E 7441                    je 004183A1
:00418360 6A00                    push 00000000
:00418362 6A01                    push 00000001
:00418364 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00418367 E8E284FFFF              call 0041084E
:0041836C 8945F4                  mov dword ptr [ebp-0C], eax
:0041836F 837DF404                cmp dword ptr [ebp-0C], 00000004
:00418373 752C                    jne 004183A1
:00418375 B970074B00              mov ecx, 004B0770
:0041837A E8B10A0000              call 00418E30
:0041837F 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00418382 E84BFBFFFF              call 00417ED2
:00418387 8B45EC                  mov eax, dword ptr [ebp-14]
:0041838A 8B10                    mov edx, dword ptr [eax]
:0041838C 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041838F FF12                    call dword ptr [edx]
:00418391 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00418394 E8CDF5FFFF              call 00417966
:00418399 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041839C E8DFF5FFFF              call 00417980

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041835E(C), :00418373(C)
|
:004183A1 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004183A4 E8A785FFFF              call 00410950
:004183A9 85C0                    test eax, eax
:004183AB 7541                    jne 004183EE
:004183AD 6A00                    push 00000000
:004183AF 6A01                    push 00000001
:004183B1 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004183B4 E89584FFFF              call 0041084E
:004183B9 8945F4                  mov dword ptr [ebp-0C], eax
:004183BC 837DF404                cmp dword ptr [ebp-0C], 00000004
:004183C0 752C                    jne 004183EE
:004183C2 B970074B00              mov ecx, 004B0770
:004183C7 E8640A0000              call 00418E30
:004183CC 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004183CF E8FEFAFFFF              call 00417ED2
:004183D4 8B45EC                  mov eax, dword ptr [ebp-14]
:004183D7 8B10                    mov edx, dword ptr [eax]
:004183D9 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004183DC FF12                    call dword ptr [edx]
:004183DE 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004183E1 E880F5FFFF              call 00417966
:004183E6 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004183E9 E892F5FFFF              call 00417980

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004183AB(C), :004183C0(C)
|
:004183EE 8B45F4                  mov eax, dword ptr [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041834F(U)
|
:004183F1 8BE5                    mov esp, ebp
:004183F3 5D                      pop ebp
:004183F4 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:004112F4   , :0041131B   , :00411344   , :00411364   , :004114A8   
|:004114CF   , :004114EF   , :00411518   , :00411541   , :00411561   
|:00411581   , :004115A1   , :0041165D   , :0041167A   , :004116F7   
|:00411753   , :004117B3   , :004117FA   , :00411843   , :00411887   
|:004118DF   , :00411906   , :00411926   , :004119F2   , :00411A5F   
|:00411A86   , :00411AAF   , :00411B5B   , :00411B82   , :00411BA2   
|:00411C41   , :00411C68   , :00411C88   , :00411CA8   , :00411CC8   
|:00411DEA   , :00411E0A   , :00411FAE   , :00411FE5   , :00412011   
|:00412038   , :00412061   , :0041208A   , :004121F6   , :004122FC   
|:00412323   , :0041234C   , :0041236C   , :00412395   , :004123BC   
|:004123E5   , :0041240E   , :00412435   , :0041245E   , :00412624   
|:0041264B   , :00412674   , :00412694   , :004126B4   , :004126DD   
|:00412704   , :0041272D   , :00412756   , :0041277D   , :0041279D   
|:00412A03   , :00412A2A   , :00412A53   , :00412A7C   , :00412A9C   
|:00412ABC   , :00412AE3   , :00412B0C   , :00412B35   , :00412B5C   
|:00412B85   , :00412BA5   , :00412DE1   , :00412E08   , :00412E31   
|:00412E5A   , :00412E81   , :00412EAA   , :0041301B   , :00413042   
|:00413062   , :00413082   , :004130A8   , :00413127   , :0041314E   
|:00413177   , :00413197   , :004131B7   , :004131D7   , :004131F7   
|:004132DF   , :00413306   , :0041332F   , :0041334F   , :0041336F   
|:0041338F   , :004134D4   , :004134F8   , :0041351E   , :00413572   
|:00413596   , :004135E9   , :0041360D   , :00413678   , :0041391F   
|:00413946   , :0041396F   , :00413A13   , :00413A68   , :00413AC2   
|:00413B10   , :00413B4B   , :00413B6F   , :00413BDA   , :00413C17   
|:00413C61   , :00413C88   , :00413D1E   , :00413D45   , :00413D6E   
|:00413D97   , :00413DBE   , :00413F06   , :00413F26   , :00413F46   
|:00413F6D   , :00413F96   , :00414066   , :0041408D   , :004140B6   
|:004140DF   , :00414262   , :0041427F   , :004142BD   , :004142DA   
|:00414327   , :0041436A   , :004143CD   , :004143F4   , :0041441D   
|:00414446   , :004146DF   , :00414706   , :0041472F   , :0041474F   
|:0041476F   , :0041478F   , :004147AF   , :004147D8   , :004147FF   
|:00414828   , :00414848   , :00414909   , :00414930   , :00414959   
|:00414A02   , :00414A29   , :00414A52   , :00414B6E   , :00414B95   
|:00414D20   , :00414D47   , :00414ECD   , :00414F0C   , :00414F4D   
|:00414F74   , :00414F9D   , :004150F2   , :00415119   , :00415142   
|:00415162   , :00415182   , :004151A2   , :004151C2   , :004151E2   
|:0041520B   , :00415232   , :0041525B   , :00415284   , :004152A4   
|:00415586   , :004155AD   , :004155D6   , :004155F6   , :00415616   
|:00415636   , :00415656   , :0041567F   , :004157BF   , :004157E3   
|:00415825   , :004158B8   , :00415927   , :0041594E   , :00415977   
|:00415997   , :004159B7   , :004159D7   , :00415B18   , :00415B50   
|:00415B77   , :00415BB4   , :00415BEC   , :00415C72   , :00415CCA   
|:00415CF1   , :00415D17   , :00415D9D   , :00415DDF   , :00415E0D   
|:00415E3D   , :00415E5D   , :00415E7D   , :00415E9D   , :00415EC4   
|:00415F70   , :00415F97   , :00415FC0   , :00415FE9   , :00416010   
|:00416039   , :00416134   , :0041615B   , :00416184   , :004161AD   
|:00416324   , :0041634B   , :00416374   , :0041639D   , :004163C4   
|:004163ED   , :004166F6   , :0041671D   , :00416746   , :0041676F   
|:0041678F   , :004167AF   , :004167D6   , :00416896   , :004168B6   
|:004168DD   , :00416906   , :0041692F   , :00416956   , :0041697F   
|:004169A8   , :00416CC6   , :00416CED   , :00416D16   , :00416D3F   
|:00416D66   , :00416E22   , :00416FE3   , :00417073   , :0041709A   
|:0041714E   , :00417175   , :0041719B   , :0041720A   , :00417231   
|:00417257   , :004172C4   , :00417323   , :00417343   , :0041736A   
|:00417393   , :004174AD   , :004174D1   , :00417540   , :00417567   
|:0041760A   , :0041762E   , :0041764B   , :004176C5   , :0041770F   
|:00417736   , :00417753   , :004177C1   , :004177E5   , :00417831   
|:00417855   , :0041787B   , :004178D1   , :004178F5   , :0041791B   
|
:004183F7 55                      push ebp
:004183F8 8BEC                    mov ebp, esp
:004183FA 83EC18                  sub esp, 00000018
:004183FD 894DF8                  mov dword ptr [ebp-08], ecx
:00418400 837D0801                cmp dword ptr [ebp+08], 00000001
:00418404 7512                    jne 00418418
:00418406 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00418409 E8D478FFFF              call 0040FCE2
:0041840E 25FFFF0000              and eax, 0000FFFF
:00418413 E994000000              jmp 004184AC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418404(C)
|
:00418418 C745FC00000000          mov [ebp-04], 00000000
:0041841F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00418422 E8BB78FFFF              call 0040FCE2
:00418427 25FFFF0000              and eax, 0000FFFF
:0041842C 3B4508                  cmp eax, dword ptr [ebp+08]
:0041842F 7407                    je 00418438
:00418431 C745FC01000000          mov [ebp-04], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041842F(C)
|
:00418438 8B4508                  mov eax, dword ptr [ebp+08]
:0041843B 8945F4                  mov dword ptr [ebp-0C], eax
:0041843E 837DF404                cmp dword ptr [ebp-0C], 00000004
:00418442 7408                    je 0041844C
:00418444 837DF405                cmp dword ptr [ebp-0C], 00000005
:00418448 7421                    je 0041846B
:0041844A EB3E                    jmp 0041848A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418442(C)
|
:0041844C 837DFC00                cmp dword ptr [ebp-04], 00000000
:00418450 7409                    je 0041845B
:00418452 C745F000000080          mov [ebp-10], 80000000
:00418459 EB0B                    jmp 00418466

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418450(C)
|
:0041845B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041845E E8B778FFFF              call 0040FD1A
:00418463 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418459(U)
|
:00418466 8B45F0                  mov eax, dword ptr [ebp-10]
:00418469 EB41                    jmp 004184AC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418448(C)
|
:0041846B 837DFC00                cmp dword ptr [ebp-04], 00000000
:0041846F 7409                    je 0041847A
:00418471 C745EC00000080          mov [ebp-14], 80000000
:00418478 EB0B                    jmp 00418485

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041846F(C)
|
:0041847A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041847D E8C878FFFF              call 0040FD4A
:00418482 8945EC                  mov dword ptr [ebp-14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418478(U)
|
:00418485 8B45EC                  mov eax, dword ptr [ebp-14]
:00418488 EB22                    jmp 004184AC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041844A(U)
|
:0041848A 837DFC00                cmp dword ptr [ebp-04], 00000000
:0041848E 7408                    je 00418498
:00418490 66C745E80080            mov [ebp-18], 8000
:00418496 EB0C                    jmp 004184A4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041848E(C)
|
:00418498 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041849B E84278FFFF              call 0040FCE2
:004184A0 668945E8                mov word ptr [ebp-18], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418496(U)
|
:004184A4 8B45E8                  mov eax, dword ptr [ebp-18]
:004184A7 25FFFF0000              and eax, 0000FFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00418413(U), :00418469(U), :00418488(U)
|
:004184AC 8BE5                    mov esp, ebp
:004184AE 5D                      pop ebp
:004184AF C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00411829   , :004118B3   
|
:004184B2 55                      push ebp
:004184B3 8BEC                    mov ebp, esp
:004184B5 51                      push ecx
:004184B6 894DFC                  mov dword ptr [ebp-04], ecx
:004184B9 8B4508                  mov eax, dword ptr [ebp+08]
:004184BC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004184BF 33D2                    xor edx, edx
:004184C1 837C813800              cmp dword ptr [ecx+4*eax+38], 00000000
:004184C6 0F95C2                  setne dl
:004184C9 8BC2                    mov eax, edx
:004184CB 8BE5                    mov esp, ebp
:004184CD 5D                      pop ebp
:004184CE C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0041225A   , :00414310   , :00415AFF   
|
:004184D1 55                      push ebp
:004184D2 8BEC                    mov ebp, esp
:004184D4 51                      push ecx
:004184D5 894DFC                  mov dword ptr [ebp-04], ecx
:004184D8 8B4508                  mov eax, dword ptr [ebp+08]
:004184DB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004184DE 8B550C                  mov edx, dword ptr [ebp+0C]
:004184E1 89548138                mov dword ptr [ecx+4*eax+38], edx
:004184E5 8BE5                    mov esp, ebp
:004184E7 5D                      pop ebp
:004184E8 C20800                  ret 0008



* Referenced by a CALL at Address:
|:00411F6D   
|
:004184EB 55                      push ebp
:004184EC 8BEC                    mov ebp, esp
:004184EE 51                      push ecx
:004184EF 894DFC                  mov dword ptr [ebp-04], ecx
:004184F2 8B45FC                  mov eax, dword ptr [ebp-04]
:004184F5 8B4D08                  mov ecx, dword ptr [ebp+08]
:004184F8 898838200000            mov dword ptr [eax+00002038], ecx
:004184FE 8BE5                    mov esp, ebp
:00418500 5D                      pop ebp
:00418501 C20400                  ret 0004



* Referenced by a CALL at Address:
|:00411FC9   
|
:00418504 55                      push ebp
:00418505 8BEC                    mov ebp, esp
:00418507 51                      push ecx
:00418508 894DFC                  mov dword ptr [ebp-04], ecx
:0041850B 8B45FC                  mov eax, dword ptr [ebp-04]
:0041850E 8B8038200000            mov eax, dword ptr [eax+00002038]
:00418514 8BE5                    mov esp, ebp
:00418516 5D                      pop ebp
:00418517 C3                      ret



* Referenced by a CALL at Address:
|:00414396   
|
:00418518 55                      push ebp
:00418519 8BEC                    mov ebp, esp
:0041851B 51                      push ecx
:0041851C 894DFC                  mov dword ptr [ebp-04], ecx
:0041851F 8B45FC                  mov eax, dword ptr [ebp-04]
:00418522 8B4D08                  mov ecx, dword ptr [ebp+08]
:00418525 89883C200000            mov dword ptr [eax+0000203C], ecx
:0041852B 8BE5                    mov esp, ebp
:0041852D 5D                      pop ebp
:0041852E C20400                  ret 0004


:00418531 55                      push ebp
:00418532 8BEC                    mov ebp, esp
:00418534 51                      push ecx
:00418535 894DFC                  mov dword ptr [ebp-04], ecx
:00418538 8B45FC                  mov eax, dword ptr [ebp-04]
:0041853B 8B803C200000            mov eax, dword ptr [eax+0000203C]
:00418541 8BE5                    mov esp, ebp
:00418543 5D                      pop ebp
:00418544 C3                      ret


:00418545 55                      push ebp
:00418546 8BEC                    mov ebp, esp
:00418548 51                      push ecx
:00418549 894DFC                  mov dword ptr [ebp-04], ecx
:0041854C 6A04                    push 00000004
:0041854E 8D4508                  lea eax, dword ptr [ebp+08]
:00418551 50                      push eax
:00418552 6A00                    push 00000000
:00418554 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00418557 E81B7BFFFF              call 00410077
:0041855C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041855F E83D7BFFFF              call 004100A1
:00418564 8BE5                    mov esp, ebp
:00418566 5D                      pop ebp
:00418567 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00415E23   , :0041996B   
|
:0041856A 55                      push ebp
:0041856B 8BEC                    mov ebp, esp
:0041856D 83EC20                  sub esp, 00000020
:00418570 894DE0                  mov dword ptr [ebp-20], ecx
:00418573 C645FC00                mov [ebp-04], 00
:00418577 C645F400                mov [ebp-0C], 00
:0041857B EB08                    jmp 00418585

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004185A8(U)
|
:0041857D 8A45F4                  mov al, byte ptr [ebp-0C]
:00418580 0401                    add al, 01
:00418582 8845F4                  mov byte ptr [ebp-0C], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041857B(U)
|
:00418585 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00418588 81E1FF000000            and ecx, 000000FF
:0041858E 83F905                  cmp ecx, 00000005
:00418591 7D17                    jge 004185AA
:00418593 8B55F4                  mov edx, dword ptr [ebp-0C]
:00418596 81E2FF000000            and edx, 000000FF
:0041859C 833C95040A4B0000        cmp dword ptr [4*edx+004B0A04], 00000000
:004185A4 7502                    jne 004185A8
:004185A6 EB02                    jmp 004185AA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004185A4(C)
|
:004185A8 EBD3                    jmp 0041857D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00418591(C), :004185A6(U)
|
:004185AA 8B45F4                  mov eax, dword ptr [ebp-0C]
:004185AD 25FF000000              and eax, 000000FF
:004185B2 83F805                  cmp eax, 00000005
:004185B5 751D                    jne 004185D4
:004185B7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004185BA 81E1FF000000            and ecx, 000000FF
:004185C0 C7048DE05E4B00681B4A00  mov dword ptr [4*ecx+004B5EE0], 004A1B68
:004185CB 8A55FC                  mov dl, byte ptr [ebp-04]
:004185CE 80C201                  add dl, 01
:004185D1 8855FC                  mov byte ptr [ebp-04], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004185B5(C)
|
:004185D4 C645F400                mov [ebp-0C], 00
:004185D8 EB08                    jmp 004185E2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418665(U)
|
:004185DA 8A45F4                  mov al, byte ptr [ebp-0C]
:004185DD 0401                    add al, 01
:004185DF 8845F4                  mov byte ptr [ebp-0C], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004185D8(U)
|
:004185E2 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004185E5 81E1FF000000            and ecx, 000000FF
:004185EB 83F905                  cmp ecx, 00000005
:004185EE 7D7A                    jge 0041866A
:004185F0 8B55F4                  mov edx, dword ptr [ebp-0C]
:004185F3 81E2FF000000            and edx, 000000FF
:004185F9 833C95F0094B0000        cmp dword ptr [4*edx+004B09F0], 00000000
:00418601 7462                    je 00418665
:00418603 8B45F4                  mov eax, dword ptr [ebp-0C]
:00418606 25FF000000              and eax, 000000FF
:0041860B 813C85F0094B00FFFF0000  cmp dword ptr [4*eax+004B09F0], 0000FFFF
:00418616 744D                    je 00418665
:00418618 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041861B 81E1FF000000            and ecx, 000000FF
:00418621 8B148DF0094B00          mov edx, dword ptr [4*ecx+004B09F0]
:00418628 52                      push edx
:00418629 E8621B0000              call 0041A190
:0041862E 83C404                  add esp, 00000004
:00418631 85C0                    test eax, eax
:00418633 7430                    je 00418665
:00418635 8B45F4                  mov eax, dword ptr [ebp-0C]
:00418638 25FF000000              and eax, 000000FF
:0041863D 8B0C85F0094B00          mov ecx, dword ptr [4*eax+004B09F0]
:00418644 6BC948                  imul ecx, 00000048
:00418647 81C1681B4A00            add ecx, 004A1B68
:0041864D 8B55FC                  mov edx, dword ptr [ebp-04]
:00418650 81E2FF000000            and edx, 000000FF
:00418656 890C95E05E4B00          mov dword ptr [4*edx+004B5EE0], ecx
:0041865D 8A45FC                  mov al, byte ptr [ebp-04]
:00418660 0401                    add al, 01
:00418662 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00418601(C), :00418616(C), :00418633(C)
|
:00418665 E970FFFFFF              jmp 004185DA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004185EE(C)
|
:0041866A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041866D 81E1FF000000            and ecx, 000000FF
:00418673 C7048DE05E4B0000000000  mov dword ptr [4*ecx+004B5EE0], 00000000
:0041867E 33D2                    xor edx, edx
:00418680 8A15EC094B00            mov dl, byte ptr [004B09EC]
:00418686 8B45FC                  mov eax, dword ptr [ebp-04]
:00418689 25FF000000              and eax, 000000FF
:0041868E 3BD0                    cmp edx, eax
:00418690 7D09                    jge 0041869B
:00418692 8A4DFC                  mov cl, byte ptr [ebp-04]
:00418695 880DEC094B00            mov byte ptr [004B09EC], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418690(C)
|
:0041869B 33D2                    xor edx, edx
:0041869D 8A15EC094B00            mov dl, byte ptr [004B09EC]
:004186A3 8B45FC                  mov eax, dword ptr [ebp-04]
:004186A6 25FF000000              and eax, 000000FF
:004186AB 3BD0                    cmp edx, eax
:004186AD 750C                    jne 004186BB
:004186AF C745F8E05E4B00          mov [ebp-08], 004B5EE0
:004186B6 E930010000              jmp 004187EB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004186AD(C)
|
:004186BB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004186BE 81E1FF000000            and ecx, 000000FF
:004186C4 894DEC                  mov dword ptr [ebp-14], ecx
:004186C7 C745E800000000          mov [ebp-18], 00000000
:004186CE EB09                    jmp 004186D9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004187CA(U)
|
:004186D0 8B55E8                  mov edx, dword ptr [ebp-18]
:004186D3 83C201                  add edx, 00000001
:004186D6 8955E8                  mov dword ptr [ebp-18], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004186CE(U)
|
:004186D9 817DE800020000          cmp dword ptr [ebp-18], 00000200
:004186E0 0F83E9000000            jnb 004187CF
:004186E6 8B45E8                  mov eax, dword ptr [ebp-18]
:004186E9 50                      push eax
:004186EA E8A11A0000              call 0041A190
:004186EF 83C404                  add esp, 00000004
:004186F2 85C0                    test eax, eax
:004186F4 0F84BC000000            je 004187B6
:004186FA C645E400                mov [ebp-1C], 00
:004186FE EB09                    jmp 00418709

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418737(U)
|
:00418700 8A4DE4                  mov cl, byte ptr [ebp-1C]
:00418703 80C101                  add cl, 01
:00418706 884DE4                  mov byte ptr [ebp-1C], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004186FE(U)
|
:00418709 8B55E4                  mov edx, dword ptr [ebp-1C]
:0041870C 81E2FF000000            and edx, 000000FF
:00418712 833C95E05E4B0000        cmp dword ptr [4*edx+004B5EE0], 00000000
:0041871A 741D                    je 00418739
:0041871C 8B45E4                  mov eax, dword ptr [ebp-1C]
:0041871F 25FF000000              and eax, 000000FF
:00418724 8B0C85E05E4B00          mov ecx, dword ptr [4*eax+004B5EE0]
:0041872B E8D00DFFFF              call 00409500
:00418730 3B45E8                  cmp eax, dword ptr [ebp-18]
:00418733 7502                    jne 00418737
:00418735 EB02                    jmp 00418739

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418733(C)
|
:00418737 EBC7                    jmp 00418700

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041871A(C), :00418735(U)
|
:00418739 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0041873C 81E1FF000000            and ecx, 000000FF
:00418742 8B55FC                  mov edx, dword ptr [ebp-04]
:00418745 81E2FF000000            and edx, 000000FF
:0041874B 3BCA                    cmp ecx, edx
:0041874D 7567                    jne 004187B6
:0041874F C645E400                mov [ebp-1C], 00
:00418753 EB08                    jmp 0041875D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418782(U)
|
:00418755 8A45E4                  mov al, byte ptr [ebp-1C]
:00418758 0401                    add al, 01
:0041875A 8845E4                  mov byte ptr [ebp-1C], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418753(U)
|
:0041875D 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00418760 81E1FF000000            and ecx, 000000FF
:00418766 83F905                  cmp ecx, 00000005
:00418769 7D19                    jge 00418784
:0041876B 8B55E4                  mov edx, dword ptr [ebp-1C]
:0041876E 81E2FF000000            and edx, 000000FF
:00418774 8B0495040A4B00          mov eax, dword ptr [4*edx+004B0A04]
:0041877B 3B45E8                  cmp eax, dword ptr [ebp-18]
:0041877E 7502                    jne 00418782
:00418780 EB02                    jmp 00418784

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041877E(C)
|
:00418782 EBD1                    jmp 00418755

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00418769(C), :00418780(U)
|
:00418784 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00418787 81E1FF000000            and ecx, 000000FF
:0041878D 83F905                  cmp ecx, 00000005
:00418790 7524                    jne 004187B6
:00418792 8B55E8                  mov edx, dword ptr [ebp-18]
:00418795 6BD248                  imul edx, 00000048
:00418798 81C2681B4A00            add edx, 004A1B68
:0041879E 8B45FC                  mov eax, dword ptr [ebp-04]
:004187A1 25FF000000              and eax, 000000FF
:004187A6 891485E05E4B00          mov dword ptr [4*eax+004B5EE0], edx
:004187AD 8A4DFC                  mov cl, byte ptr [ebp-04]
:004187B0 80C101                  add cl, 01
:004187B3 884DFC                  mov byte ptr [ebp-04], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004186F4(C), :0041874D(C), :00418790(C)
|
:004187B6 8B55FC                  mov edx, dword ptr [ebp-04]
:004187B9 81E2FF000000            and edx, 000000FF
:004187BF C70495E05E4B0000000000  mov dword ptr [4*edx+004B5EE0], 00000000
:004187CA E901FFFFFF              jmp 004186D0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004186E0(C)
|
:004187CF 33C0                    xor eax, eax
:004187D1 A0EC094B00              mov al, byte ptr [004B09EC]
:004187D6 50                      push eax
:004187D7 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004187DA 51                      push ecx
:004187DB 68E05E4B00              push 004B5EE0
:004187E0 E8CE5E0400              call 0045E6B3
:004187E5 83C40C                  add esp, 0000000C
:004187E8 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004186B6(U)
|
:004187EB C645F000                mov [ebp-10], 00
:004187EF EB09                    jmp 004187FA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041882F(U)
|
:004187F1 8A55F0                  mov dl, byte ptr [ebp-10]
:004187F4 80C201                  add dl, 01
:004187F7 8855F0                  mov byte ptr [ebp-10], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004187EF(U)
|
:004187FA 8B45F0                  mov eax, dword ptr [ebp-10]
:004187FD 25FF000000              and eax, 000000FF
:00418802 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00418805 833C8100                cmp dword ptr [ecx+4*eax], 00000000
:00418809 7426                    je 00418831
:0041880B 8B55F0                  mov edx, dword ptr [ebp-10]
:0041880E 81E2FF000000            and edx, 000000FF
:00418814 8B45F8                  mov eax, dword ptr [ebp-08]
:00418817 8B0C90                  mov ecx, dword ptr [eax+4*edx]
:0041881A E8E10CFFFF              call 00409500
:0041881F 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00418822 81E1FF000000            and ecx, 000000FF
:00418828 89048D50B34800          mov dword ptr [4*ecx+0048B350], eax
:0041882F EBC0                    jmp 004187F1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418809(C)
|
:00418831 8B55F0                  mov edx, dword ptr [ebp-10]
:00418834 81E2FF000000            and edx, 000000FF
:0041883A C7049550B34800FFFF0000  mov dword ptr [4*edx+0048B350], 0000FFFF
:00418845 8B45F0                  mov eax, dword ptr [ebp-10]
:00418848 25FF000000              and eax, 000000FF
:0041884D 33C9                    xor ecx, ecx
:0041884F 85C0                    test eax, eax
:00418851 0F9FC1                  setg cl
:00418854 8BC1                    mov eax, ecx
:00418856 8BE5                    mov esp, ebp
:00418858 5D                      pop ebp
:00418859 C3                      ret



* Referenced by a CALL at Addresses:
|:004125D1   , :004129B0   
|
:0041885A 55                      push ebp
:0041885B 8BEC                    mov ebp, esp
:0041885D 83EC2C                  sub esp, 0000002C
:00418860 894DD4                  mov dword ptr [ebp-2C], ecx
:00418863 C745EC00000000          mov [ebp-14], 00000000
:0041886A C645E400                mov [ebp-1C], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041888C(U)
|
:0041886E 8B45E4                  mov eax, dword ptr [ebp-1C]
:00418871 25FF000000              and eax, 000000FF
:00418876 813C8550B34800FFFF0000  cmp dword ptr [4*eax+0048B350], 0000FFFF
:00418881 740B                    je 0041888E
:00418883 8A4DE4                  mov cl, byte ptr [ebp-1C]
:00418886 80C101                  add cl, 01
:00418889 884DE4                  mov byte ptr [ebp-1C], cl
:0041888C EBE0                    jmp 0041886E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418881(C)
|
:0041888E 8B45E4                  mov eax, dword ptr [ebp-1C]
:00418891 25FF000000              and eax, 000000FF
:00418896 99                      cdq
:00418897 83E203                  and edx, 00000003
:0041889A 03C2                    add eax, edx
:0041889C C1F802                  sar eax, 02
:0041889F 8845D8                  mov byte ptr [ebp-28], al
:004188A2 C645E000                mov [ebp-20], 00
:004188A6 EB09                    jmp 004188B1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004188F1(U)
|
:004188A8 8A55E0                  mov dl, byte ptr [ebp-20]
:004188AB 80C201                  add dl, 01
:004188AE 8855E0                  mov byte ptr [ebp-20], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004188A6(U)
|
:004188B1 8B45E0                  mov eax, dword ptr [ebp-20]
:004188B4 25FF000000              and eax, 000000FF
:004188B9 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004188BC 81E1FF000000            and ecx, 000000FF
:004188C2 3BC1                    cmp eax, ecx
:004188C4 7D2D                    jge 004188F3
:004188C6 8B55E0                  mov edx, dword ptr [ebp-20]
:004188C9 81E2FF000000            and edx, 000000FF
:004188CF 8B0C9550B34800          mov ecx, dword ptr [4*edx+0048B350]
:004188D6 6BC948                  imul ecx, 00000048
:004188D9 81C1681B4A00            add ecx, 004A1B68
:004188DF E8ECDCFEFF              call 004065D0
:004188E4 8B4DE0                  mov ecx, dword ptr [ebp-20]
:004188E7 81E1FF000000            and ecx, 000000FF
:004188ED 88440DF0                mov byte ptr [ebp+ecx-10], al
:004188F1 EBB5                    jmp 004188A8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004188C4(C)
|
:004188F3 C645E800                mov [ebp-18], 00
:004188F7 EB09                    jmp 00418902

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041899E(U)
|
:004188F9 8A55E8                  mov dl, byte ptr [ebp-18]
:004188FC 80C201                  add dl, 01
:004188FF 8855E8                  mov byte ptr [ebp-18], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004188F7(U)
|
:00418902 8B45E8                  mov eax, dword ptr [ebp-18]
:00418905 25FF000000              and eax, 000000FF
:0041890A 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0041890D 81E1FF000000            and ecx, 000000FF
:00418913 3BC1                    cmp eax, ecx
:00418915 0F8D88000000            jnl 004189A3
:0041891B C645E000                mov [ebp-20], 00
:0041891F EB09                    jmp 0041892A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041899C(U)
|
:00418921 8A55E0                  mov dl, byte ptr [ebp-20]
:00418924 80C201                  add dl, 01
:00418927 8855E0                  mov byte ptr [ebp-20], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041891F(U)
|
:0041892A 8B45E0                  mov eax, dword ptr [ebp-20]
:0041892D 25FF000000              and eax, 000000FF
:00418932 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00418935 81E1FF000000            and ecx, 000000FF
:0041893B 83E901                  sub ecx, 00000001
:0041893E 3BC1                    cmp eax, ecx
:00418940 7D5C                    jge 0041899E
:00418942 8B55E0                  mov edx, dword ptr [ebp-20]
:00418945 81E2FF000000            and edx, 000000FF
:0041894B 33C0                    xor eax, eax
:0041894D 8A4415F0                mov al, byte ptr [ebp+edx-10]
:00418951 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00418954 81E1FF000000            and ecx, 000000FF
:0041895A 33D2                    xor edx, edx
:0041895C 8A540DF1                mov dl, byte ptr [ebp+ecx-0F]
:00418960 3BC2                    cmp eax, edx
:00418962 7D38                    jge 0041899C
:00418964 8B45E0                  mov eax, dword ptr [ebp-20]
:00418967 25FF000000              and eax, 000000FF
:0041896C 8A4C05F0                mov cl, byte ptr [ebp+eax-10]
:00418970 884DDC                  mov byte ptr [ebp-24], cl
:00418973 8B55E0                  mov edx, dword ptr [ebp-20]
:00418976 81E2FF000000            and edx, 000000FF
:0041897C 8B45E0                  mov eax, dword ptr [ebp-20]
:0041897F 25FF000000              and eax, 000000FF
:00418984 8A4C15F1                mov cl, byte ptr [ebp+edx-0F]
:00418988 884C05F0                mov byte ptr [ebp+eax-10], cl
:0041898C 8B55E0                  mov edx, dword ptr [ebp-20]
:0041898F 81E2FF000000            and edx, 000000FF
:00418995 8A45DC                  mov al, byte ptr [ebp-24]
:00418998 884415F1                mov byte ptr [ebp+edx-0F], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418962(C)
|
:0041899C EB83                    jmp 00418921

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418940(C)
|
:0041899E E956FFFFFF              jmp 004188F9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418915(C)
|
:004189A3 8A4DD8                  mov cl, byte ptr [ebp-28]
:004189A6 884DE0                  mov byte ptr [ebp-20], cl
:004189A9 EB09                    jmp 004189B4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004189EA(U)
|
:004189AB 8A55E0                  mov dl, byte ptr [ebp-20]
:004189AE 80C201                  add dl, 01
:004189B1 8855E0                  mov byte ptr [ebp-20], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004189A9(U)
|
:004189B4 8B45E0                  mov eax, dword ptr [ebp-20]
:004189B7 25FF000000              and eax, 000000FF
:004189BC 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004189BF 81E1FF000000            and ecx, 000000FF
:004189C5 8B55D8                  mov edx, dword ptr [ebp-28]
:004189C8 81E2FF000000            and edx, 000000FF
:004189CE 2BCA                    sub ecx, edx
:004189D0 3BC1                    cmp eax, ecx
:004189D2 7D18                    jge 004189EC
:004189D4 8B45E0                  mov eax, dword ptr [ebp-20]
:004189D7 25FF000000              and eax, 000000FF
:004189DC 33C9                    xor ecx, ecx
:004189DE 8A4C05F0                mov cl, byte ptr [ebp+eax-10]
:004189E2 8B55EC                  mov edx, dword ptr [ebp-14]
:004189E5 03D1                    add edx, ecx
:004189E7 8955EC                  mov dword ptr [ebp-14], edx
:004189EA EBBF                    jmp 004189AB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004189D2(C)
|
:004189EC 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004189EF 81E1FF000000            and ecx, 000000FF
:004189F5 8B55D8                  mov edx, dword ptr [ebp-28]
:004189F8 81E2FF000000            and edx, 000000FF
:004189FE D1E2                    shl edx, 1
:00418A00 2BCA                    sub ecx, edx
:00418A02 8B45EC                  mov eax, dword ptr [ebp-14]
:00418A05 33D2                    xor edx, edx
:00418A07 F7F1                    div ecx
:00418A09 8BE5                    mov esp, ebp
:00418A0B 5D                      pop ebp
:00418A0C C3                      ret


:00418A0D CC                      int 03
:00418A0E CC                      int 03
:00418A0F CC                      int 03

* Referenced by a CALL at Address:
|:004109E8   
|
:00418A10 55                      push ebp
:00418A11 8BEC                    mov ebp, esp
:00418A13 51                      push ecx
:00418A14 894DFC                  mov dword ptr [ebp-04], ecx
:00418A17 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00418A1A E821010000              call 00418B40
:00418A1F 8BE5                    mov esp, ebp
:00418A21 5D                      pop ebp
:00418A22 C3                      ret


:00418A23 CC                      int 03
:00418A24 CC                      int 03
:00418A25 CC                      int 03
:00418A26 CC                      int 03
:00418A27 CC                      int 03
:00418A28 CC                      int 03
:00418A29 CC                      int 03
:00418A2A CC                      int 03
:00418A2B CC                      int 03
:00418A2C CC                      int 03
:00418A2D CC                      int 03
:00418A2E CC                      int 03
:00418A2F CC                      int 03

* Referenced by a CALL at Address:
|:004109C7   
|
:00418A30 55                      push ebp
:00418A31 8BEC                    mov ebp, esp
:00418A33 6AFF                    push FFFFFFFF
:00418A35 68E9504800              push 004850E9
:00418A3A 64A100000000            mov eax, dword ptr fs:[00000000]
:00418A40 50                      push eax
:00418A41 64892500000000          mov dword ptr fs:[00000000], esp
:00418A48 51                      push ecx
:00418A49 894DF0                  mov dword ptr [ebp-10], ecx
:00418A4C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00418A4F E88C000000              call 00418AE0
:00418A54 C745FC00000000          mov [ebp-04], 00000000
:00418A5B 68A08A4100              push 00418AA0
:00418A60 6A73                    push 00000073
:00418A62 6A40                    push 00000040
:00418A64 8B45F0                  mov eax, dword ptr [ebp-10]
:00418A67 0544200000              add eax, 00002044
:00418A6C 50                      push eax
:00418A6D E80EA9FEFF              call 00403380
:00418A72 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00418A75 C70110664800            mov dword ptr [ecx], 00486610
:00418A7B C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00418A82 8B45F0                  mov eax, dword ptr [ebp-10]
:00418A85 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00418A88 64890D00000000          mov dword ptr fs:[00000000], ecx
:00418A8F 8BE5                    mov esp, ebp
:00418A91 5D                      pop ebp
:00418A92 C3                      ret


:00418A93 CC                      int 03
:00418A94 CC                      int 03
:00418A95 CC                      int 03
:00418A96 CC                      int 03
:00418A97 CC                      int 03
:00418A98 CC                      int 03
:00418A99 CC                      int 03
:00418A9A CC                      int 03
:00418A9B CC                      int 03
:00418A9C CC                      int 03
:00418A9D CC                      int 03
:00418A9E CC                      int 03
:00418A9F CC                      int 03
:00418AA0 55                      push ebp
:00418AA1 8BEC                    mov ebp, esp
:00418AA3 51                      push ecx
:00418AA4 894DFC                  mov dword ptr [ebp-04], ecx
:00418AA7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00418AAA E811000000              call 00418AC0
:00418AAF 8B45FC                  mov eax, dword ptr [ebp-04]
:00418AB2 8BE5                    mov esp, ebp
:00418AB4 5D                      pop ebp
:00418AB5 C3                      ret


:00418AB6 CC                      int 03
:00418AB7 CC                      int 03
:00418AB8 CC                      int 03
:00418AB9 CC                      int 03
:00418ABA CC                      int 03
:00418ABB CC                      int 03
:00418ABC CC                      int 03
:00418ABD CC                      int 03
:00418ABE CC                      int 03
:00418ABF CC                      int 03

* Referenced by a CALL at Address:
|:00418AAA   
|
:00418AC0 55                      push ebp
:00418AC1 8BEC                    mov ebp, esp
:00418AC3 51                      push ecx
:00418AC4 894DFC                  mov dword ptr [ebp-04], ecx
:00418AC7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00418ACA 83C104                  add ecx, 00000004
:00418ACD E83E6C0400              call 0045F710
:00418AD2 8B45FC                  mov eax, dword ptr [ebp-04]
:00418AD5 8BE5                    mov esp, ebp
:00418AD7 5D                      pop ebp
:00418AD8 C3                      ret


:00418AD9 CC                      int 03
:00418ADA CC                      int 03
:00418ADB CC                      int 03
:00418ADC CC                      int 03
:00418ADD CC                      int 03
:00418ADE CC                      int 03
:00418ADF CC                      int 03

* Referenced by a CALL at Address:
|:00418A4F   
|
:00418AE0 55                      push ebp
:00418AE1 8BEC                    mov ebp, esp
:00418AE3 51                      push ecx
:00418AE4 894DFC                  mov dword ptr [ebp-04], ecx
:00418AE7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00418AEA 83C104                  add ecx, 00000004
:00418AED E81E7EFFFF              call 00410910
:00418AF2 8B45FC                  mov eax, dword ptr [ebp-04]
:00418AF5 C7401800000000          mov [eax+18], 00000000
:00418AFC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00418AFF C7411C00000000          mov [ecx+1C], 00000000
:00418B06 8B55FC                  mov edx, dword ptr [ebp-04]
:00418B09 C7422000000000          mov [edx+20], 00000000
:00418B10 8B45FC                  mov eax, dword ptr [ebp-04]
:00418B13 C7402400000000          mov [eax+24], 00000000
:00418B1A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00418B1D C7412800000000          mov [ecx+28], 00000000
:00418B24 8B55FC                  mov edx, dword ptr [ebp-04]
:00418B27 C7422C00000000          mov [edx+2C], 00000000
:00418B2E 8B45FC                  mov eax, dword ptr [ebp-04]
:00418B31 C70028664800            mov dword ptr [eax], 00486628
:00418B37 8B45FC                  mov eax, dword ptr [ebp-04]
:00418B3A 8BE5                    mov esp, ebp
:00418B3C 5D                      pop ebp
:00418B3D C3                      ret


:00418B3E CC                      int 03
:00418B3F CC                      int 03

* Referenced by a CALL at Addresses:
|:00418A1A   , :004850E3   
|
:00418B40 55                      push ebp
:00418B41 8BEC                    mov ebp, esp
:00418B43 6AFF                    push FFFFFFFF
:00418B45 680C514800              push 0048510C
:00418B4A 64A100000000            mov eax, dword ptr fs:[00000000]
:00418B50 50                      push eax
:00418B51 64892500000000          mov dword ptr fs:[00000000], esp
:00418B58 83EC14                  sub esp, 00000014
:00418B5B 894DE0                  mov dword ptr [ebp-20], ecx
:00418B5E 8B45E0                  mov eax, dword ptr [ebp-20]
:00418B61 C70028664800            mov dword ptr [eax], 00486628
:00418B67 C745FC00000000          mov [ebp-04], 00000000
:00418B6E C745F000000000          mov [ebp-10], 00000000
:00418B75 EB09                    jmp 00418B80

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418BA6(U)
|
:00418B77 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00418B7A 83C101                  add ecx, 00000001
:00418B7D 894DF0                  mov dword ptr [ebp-10], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418B75(U)
|
:00418B80 8B55E0                  mov edx, dword ptr [ebp-20]
:00418B83 8B45F0                  mov eax, dword ptr [ebp-10]
:00418B86 3B4218                  cmp eax, dword ptr [edx+18]
:00418B89 7D1D                    jge 00418BA8
:00418B8B 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00418B8E 8B511C                  mov edx, dword ptr [ecx+1C]
:00418B91 8B45F0                  mov eax, dword ptr [ebp-10]
:00418B94 8B0C82                  mov ecx, dword ptr [edx+4*eax]
:00418B97 894DEC                  mov dword ptr [ebp-14], ecx
:00418B9A 8B55EC                  mov edx, dword ptr [ebp-14]
:00418B9D 52                      push edx
:00418B9E E87D840600              call 00481020
:00418BA3 83C404                  add esp, 00000004
:00418BA6 EBCF                    jmp 00418B77

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418B89(C)
|
:00418BA8 8B45E0                  mov eax, dword ptr [ebp-20]
:00418BAB 8B481C                  mov ecx, dword ptr [eax+1C]
:00418BAE 894DE8                  mov dword ptr [ebp-18], ecx
:00418BB1 8B55E8                  mov edx, dword ptr [ebp-18]
:00418BB4 52                      push edx
:00418BB5 E866840600              call 00481020
:00418BBA 83C404                  add esp, 00000004
:00418BBD 8B45E0                  mov eax, dword ptr [ebp-20]
:00418BC0 8B4820                  mov ecx, dword ptr [eax+20]
:00418BC3 894DE4                  mov dword ptr [ebp-1C], ecx
:00418BC6 8B55E4                  mov edx, dword ptr [ebp-1C]
:00418BC9 52                      push edx
:00418BCA E851840600              call 00481020
:00418BCF 83C404                  add esp, 00000004
:00418BD2 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00418BD9 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00418BDC 83C104                  add ecx, 00000004
:00418BDF E82C290100              call 0042B510
:00418BE4 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00418BE7 64890D00000000          mov dword ptr fs:[00000000], ecx
:00418BEE 8BE5                    mov esp, ebp
:00418BF0 5D                      pop ebp
:00418BF1 C3                      ret


:00418BF2 CC                      int 03
:00418BF3 CC                      int 03
:00418BF4 CC                      int 03
:00418BF5 CC                      int 03
:00418BF6 CC                      int 03
:00418BF7 CC                      int 03
:00418BF8 CC                      int 03
:00418BF9 CC                      int 03
:00418BFA CC                      int 03
:00418BFB CC                      int 03
:00418BFC CC                      int 03
:00418BFD CC                      int 03
:00418BFE CC                      int 03
:00418BFF CC                      int 03

* Referenced by a CALL at Address:
|:004134A0   
|
:00418C00 55                      push ebp
:00418C01 8BEC                    mov ebp, esp
:00418C03 51                      push ecx
:00418C04 894DFC                  mov dword ptr [ebp-04], ecx
:00418C07 6A00                    push 00000000
:00418C09 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00418C0C E88A71FFFF              call 0040FD9B
:00418C11 8BE5                    mov esp, ebp
:00418C13 5D                      pop ebp
:00418C14 C3                      ret


:00418C15 CC                      int 03
:00418C16 CC                      int 03
:00418C17 CC                      int 03
:00418C18 CC                      int 03
:00418C19 CC                      int 03
:00418C1A CC                      int 03
:00418C1B CC                      int 03
:00418C1C CC                      int 03
:00418C1D CC                      int 03
:00418C1E CC                      int 03
:00418C1F CC                      int 03
:00418C20 55                      push ebp
:00418C21 8BEC                    mov ebp, esp
:00418C23 51                      push ecx
:00418C24 894DFC                  mov dword ptr [ebp-04], ecx
:00418C27 33C0                    xor eax, eax
:00418C29 8BE5                    mov esp, ebp
:00418C2B 5D                      pop ebp
:00418C2C C3                      ret


:00418C2D CC                      int 03
:00418C2E CC                      int 03
:00418C2F CC                      int 03

* Referenced by a CALL at Addresses:
|:00411999   , :0042C28C   
|
:00418C30 55                      push ebp
:00418C31 8BEC                    mov ebp, esp
:00418C33 51                      push ecx
:00418C34 894DFC                  mov dword ptr [ebp-04], ecx
:00418C37 8B45FC                  mov eax, dword ptr [ebp-04]
:00418C3A 8A4012                  mov al, byte ptr [eax+12]
:00418C3D 8BE5                    mov esp, ebp
:00418C3F 5D                      pop ebp
:00418C40 C3                      ret


:00418C41 CC                      int 03
:00418C42 CC                      int 03
:00418C43 CC                      int 03
:00418C44 CC                      int 03
:00418C45 CC                      int 03
:00418C46 CC                      int 03
:00418C47 CC                      int 03
:00418C48 CC                      int 03
:00418C49 CC                      int 03
:00418C4A CC                      int 03
:00418C4B CC                      int 03
:00418C4C CC                      int 03
:00418C4D CC                      int 03
:00418C4E CC                      int 03
:00418C4F CC                      int 03

* Referenced by a CALL at Address:
|:00413644   
|
:00418C50 55                      push ebp
:00418C51 8BEC                    mov ebp, esp
:00418C53 51                      push ecx
:00418C54 894DFC                  mov dword ptr [ebp-04], ecx
:00418C57 8B45FC                  mov eax, dword ptr [ebp-04]
:00418C5A 8A4D08                  mov cl, byte ptr [ebp+08]
:00418C5D 884802                  mov byte ptr [eax+02], cl
:00418C60 8BE5                    mov esp, ebp
:00418C62 5D                      pop ebp
:00418C63 C20400                  ret 0004


:00418C66 CC                      int 03
:00418C67 CC                      int 03
:00418C68 CC                      int 03
:00418C69 CC                      int 03
:00418C6A CC                      int 03
:00418C6B CC                      int 03
:00418C6C CC                      int 03
:00418C6D CC                      int 03
:00418C6E CC                      int 03
:00418C6F CC                      int 03

* Referenced by a CALL at Addresses:
|:00413BB0   , :00414AF1   
|
:00418C70 55                      push ebp
:00418C71 8BEC                    mov ebp, esp
:00418C73 51                      push ecx
:00418C74 894DFC                  mov dword ptr [ebp-04], ecx
:00418C77 8B45FC                  mov eax, dword ptr [ebp-04]
:00418C7A 8A4D08                  mov cl, byte ptr [ebp+08]
:00418C7D 884806                  mov byte ptr [eax+06], cl
:00418C80 8BE5                    mov esp, ebp
:00418C82 5D                      pop ebp
:00418C83 C20400                  ret 0004


:00418C86 CC                      int 03
:00418C87 CC                      int 03
:00418C88 CC                      int 03
:00418C89 CC                      int 03
:00418C8A CC                      int 03
:00418C8B CC                      int 03
:00418C8C CC                      int 03
:00418C8D CC                      int 03
:00418C8E CC                      int 03
:00418C8F CC                      int 03

* Referenced by a CALL at Addresses:
|:004133FC   , :004137A6   , :00415030   , :00415327   , :00415A5B   
|:004162B6   , :004165FD   , :00416EC8   , :0042427A   , :00424553   
|:0042484B   , :0042528F   , :0042CC7C   , :00435945   , :00438898   
|:00439264   , :00439642   , :0043A328   , :0043A96E   , :0043ADA5   
|:0043ADC8   , :0043AE6B   , :0043C7E2   , :0043C981   , :0043CE1E   
|:0043D24E   , :0043FCD4   , :00440209   , :00441611   , :00441636   
|:00441750   , :00442A26   , :00442B27   , :00442B90   , :0044A47B   
|:0044C3E2   , :0044C462   , :0044C4CE   , :0044C54A   , :0044C5B6   
|:0044C6A9   , :0044C6CA   , :0044C79E   , :0044C7BF   , :0044C854   
|:0044C875   , :0044C9A0   , :0044CACF   , :0044CC3A   , :0044D329   
|:0044D91A   , :0044D98C   , :0044DB1F   , :0044DBEB   , :0044DCA5   
|:0044DD89   , :0044DE42   , :0044DEF8   , :0044E176   , :0044E2DB   
|:0044E676   , :0044E76A   , :0044EA54   , :0044ECA1   , :0044EF83   
|:00454346   , :004552BB   , :0045604E   , :004560C7   , :00456114   
|:0045711E   , :004574AB   , :00457622   , :00457872   , :004591E2   
|:004594B8   , :004596CB   , :004597E1   , :0045984E   , :004599D2   
|:00459F8F   , :0045A4CB   , :0045A561   , :0045A5CD   , :0045A67C   
|:0045A925   , :0045AAA5   , :0045AE8C   , :0045B03A   , :0045B15D   
|:0045B17E   , :0045B417   , :0045B569   , :0045B634   , :0046FC8D   
|:00477B21   , :00479859   , :00479A6C   
|
:00418C90 55                      push ebp
:00418C91 8BEC                    mov ebp, esp
:00418C93 51                      push ecx
:00418C94 894DFC                  mov dword ptr [ebp-04], ecx
:00418C97 8B45FC                  mov eax, dword ptr [ebp-04]
:00418C9A 8A400C                  mov al, byte ptr [eax+0C]
:00418C9D 8BE5                    mov esp, ebp
:00418C9F 5D                      pop ebp
:00418CA0 C3                      ret


:00418CA1 CC                      int 03
:00418CA2 CC                      int 03
:00418CA3 CC                      int 03
:00418CA4 CC                      int 03
:00418CA5 CC                      int 03
:00418CA6 CC                      int 03
:00418CA7 CC                      int 03
:00418CA8 CC                      int 03
:00418CA9 CC                      int 03
:00418CAA CC                      int 03
:00418CAB CC                      int 03
:00418CAC CC                      int 03
:00418CAD CC                      int 03
:00418CAE CC                      int 03
:00418CAF CC                      int 03

* Referenced by a CALL at Addresses:
|:00413D05   , :0044265E   
|
:00418CB0 55                      push ebp
:00418CB1 8BEC                    mov ebp, esp
:00418CB3 51                      push ecx
:00418CB4 894DFC                  mov dword ptr [ebp-04], ecx
:00418CB7 8B45FC                  mov eax, dword ptr [ebp-04]
:00418CBA 8B4D08                  mov ecx, dword ptr [ebp+08]
:00418CBD 894820                  mov dword ptr [eax+20], ecx
:00418CC0 8BE5                    mov esp, ebp
:00418CC2 5D                      pop ebp
:00418CC3 C20400                  ret 0004


:00418CC6 CC                      int 03
:00418CC7 CC                      int 03
:00418CC8 CC                      int 03
:00418CC9 CC                      int 03
:00418CCA CC                      int 03
:00418CCB CC                      int 03
:00418CCC CC                      int 03
:00418CCD CC                      int 03
:00418CCE CC                      int 03
:00418CCF CC                      int 03

* Referenced by a CALL at Addresses:
|:00414124   , :00435C07   , :004365A0   , :00437B0F   , :00437C0D   
|:00438346   , :0043D152   , :0043F053   , :0043F4E4   , :004426A0   
|:00442B57   , :004538B2   , :00456170   , :004567F2   , :00456E57   
|:0045B3D6   
|
:00418CD0 55                      push ebp
:00418CD1 8BEC                    mov ebp, esp
:00418CD3 51                      push ecx
:00418CD4 894DFC                  mov dword ptr [ebp-04], ecx
:00418CD7 8B45FC                  mov eax, dword ptr [ebp-04]
:00418CDA 8A4D08                  mov cl, byte ptr [ebp+08]
:00418CDD 8808                    mov byte ptr [eax], cl
:00418CDF 8B55FC                  mov edx, dword ptr [ebp-04]
:00418CE2 8A450C                  mov al, byte ptr [ebp+0C]
:00418CE5 884201                  mov byte ptr [edx+01], al
:00418CE8 8B45FC                  mov eax, dword ptr [ebp-04]
:00418CEB 8BE5                    mov esp, ebp
:00418CED 5D                      pop ebp
:00418CEE C20800                  ret 0008


:00418CF1 CC                      int 03
:00418CF2 CC                      int 03
:00418CF3 CC                      int 03
:00418CF4 CC                      int 03
:00418CF5 CC                      int 03
:00418CF6 CC                      int 03
:00418CF7 CC                      int 03
:00418CF8 CC                      int 03
:00418CF9 CC                      int 03
:00418CFA CC                      int 03
:00418CFB CC                      int 03
:00418CFC CC                      int 03
:00418CFD CC                      int 03
:00418CFE CC                      int 03
:00418CFF CC                      int 03

* Referenced by a CALL at Address:
|:00414B34   
|
:00418D00 55                      push ebp
:00418D01 8BEC                    mov ebp, esp
:00418D03 51                      push ecx
:00418D04 894DFC                  mov dword ptr [ebp-04], ecx
:00418D07 8B45FC                  mov eax, dword ptr [ebp-04]
:00418D0A 8A4D08                  mov cl, byte ptr [ebp+08]
:00418D0D 884812                  mov byte ptr [eax+12], cl
:00418D10 8BE5                    mov esp, ebp
:00418D12 5D                      pop ebp
:00418D13 C20400                  ret 0004


:00418D16 CC                      int 03
:00418D17 CC                      int 03
:00418D18 CC                      int 03
:00418D19 CC                      int 03
:00418D1A CC                      int 03
:00418D1B CC                      int 03
:00418D1C CC                      int 03
:00418D1D CC                      int 03
:00418D1E CC                      int 03
:00418D1F CC                      int 03

* Referenced by a CALL at Addresses:
|:00414EF5   , :00415878   , :004745CE   
|
:00418D20 55                      push ebp
:00418D21 8BEC                    mov ebp, esp
:00418D23 51                      push ecx
:00418D24 894DFC                  mov dword ptr [ebp-04], ecx
:00418D27 8B45FC                  mov eax, dword ptr [ebp-04]
:00418D2A 8A4D08                  mov cl, byte ptr [ebp+08]
:00418D2D 884804                  mov byte ptr [eax+04], cl
:00418D30 8BE5                    mov esp, ebp
:00418D32 5D                      pop ebp
:00418D33 C20400                  ret 0004


:00418D36 CC                      int 03
:00418D37 CC                      int 03
:00418D38 CC                      int 03
:00418D39 CC                      int 03
:00418D3A CC                      int 03
:00418D3B CC                      int 03
:00418D3C CC                      int 03
:00418D3D CC                      int 03
:00418D3E CC                      int 03
:00418D3F CC                      int 03

* Referenced by a CALL at Addresses:
|:00414F34   , :00417039   , :0041705A   
|
:00418D40 55                      push ebp
:00418D41 8BEC                    mov ebp, esp
:00418D43 51                      push ecx
:00418D44 894DFC                  mov dword ptr [ebp-04], ecx
:00418D47 8B45FC                  mov eax, dword ptr [ebp-04]
:00418D4A 8A4D08                  mov cl, byte ptr [ebp+08]
:00418D4D 884811                  mov byte ptr [eax+11], cl
:00418D50 8BE5                    mov esp, ebp
:00418D52 5D                      pop ebp
:00418D53 C20400                  ret 0004


:00418D56 CC                      int 03
:00418D57 CC                      int 03
:00418D58 CC                      int 03
:00418D59 CC                      int 03
:00418D5A CC                      int 03
:00418D5B CC                      int 03
:00418D5C CC                      int 03
:00418D5D CC                      int 03
:00418D5E CC                      int 03
:00418D5F CC                      int 03

* Referenced by a CALL at Addresses:
|:00415CB1   , :0042C0E3   
|
:00418D60 55                      push ebp
:00418D61 8BEC                    mov ebp, esp
:00418D63 51                      push ecx
:00418D64 894DFC                  mov dword ptr [ebp-04], ecx
:00418D67 8B45FC                  mov eax, dword ptr [ebp-04]
:00418D6A 8A4D08                  mov cl, byte ptr [ebp+08]
:00418D6D 884807                  mov byte ptr [eax+07], cl
:00418D70 8BE5                    mov esp, ebp
:00418D72 5D                      pop ebp
:00418D73 C20400                  ret 0004


:00418D76 CC                      int 03
:00418D77 CC                      int 03
:00418D78 CC                      int 03
:00418D79 CC                      int 03
:00418D7A CC                      int 03
:00418D7B CC                      int 03
:00418D7C CC                      int 03
:00418D7D CC                      int 03
:00418D7E CC                      int 03
:00418D7F CC                      int 03

* Referenced by a CALL at Addresses:
|:00415D4A   , :0041A19F   , :0043F94C   , :0045A499   , :0045B775   
|
:00418D80 55                      push ebp
:00418D81 8BEC                    mov ebp, esp
:00418D83 51                      push ecx
:00418D84 894DFC                  mov dword ptr [ebp-04], ecx
:00418D87 8B45FC                  mov eax, dword ptr [ebp-04]
:00418D8A 8A402A                  mov al, byte ptr [eax+2A]
:00418D8D 8BE5                    mov esp, ebp
:00418D8F 5D                      pop ebp
:00418D90 C3                      ret


:00418D91 CC                      int 03
:00418D92 CC                      int 03
:00418D93 CC                      int 03
:00418D94 CC                      int 03
:00418D95 CC                      int 03
:00418D96 CC                      int 03
:00418D97 CC                      int 03
:00418D98 CC                      int 03
:00418D99 CC                      int 03
:00418D9A CC                      int 03
:00418D9B CC                      int 03
:00418D9C CC                      int 03
:00418D9D CC                      int 03
:00418D9E CC                      int 03
:00418D9F CC                      int 03

* Referenced by a CALL at Addresses:
|:004162D4   , :0041D027   , :0041D036   , :0041D045   , :0041D054   
|:0041D063   , :00420EA0   , :0044D8FF   , :0045ABE9   
|
:00418DA0 55                      push ebp
:00418DA1 8BEC                    mov ebp, esp
:00418DA3 51                      push ecx
:00418DA4 894DFC                  mov dword ptr [ebp-04], ecx
:00418DA7 8B4508                  mov eax, dword ptr [ebp+08]
:00418DAA 25FF000000              and eax, 000000FF
:00418DAF F7D0                    not eax
:00418DB1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00418DB4 8A511E                  mov dl, byte ptr [ecx+1E]
:00418DB7 22D0                    and dl, al
:00418DB9 8B45FC                  mov eax, dword ptr [ebp-04]
:00418DBC 88501E                  mov byte ptr [eax+1E], dl
:00418DBF 8BE5                    mov esp, ebp
:00418DC1 5D                      pop ebp
:00418DC2 C20400                  ret 0004


:00418DC5 CC                      int 03
:00418DC6 CC                      int 03
:00418DC7 CC                      int 03
:00418DC8 CC                      int 03
:00418DC9 CC                      int 03
:00418DCA CC                      int 03
:00418DCB CC                      int 03
:00418DCC CC                      int 03
:00418DCD CC                      int 03
:00418DCE CC                      int 03
:00418DCF CC                      int 03

* Referenced by a CALL at Addresses:
|:00412287   , :004122CF   , :004128A7   , :00412CC6   , :00412FC1   
|:00413414   , :0041504C   , :00415A73   , :00415F05   , :0044CCE7   
|:00457152   , :00459216   
|
:00418DD0 55                      push ebp
:00418DD1 8BEC                    mov ebp, esp
:00418DD3 51                      push ecx
:00418DD4 894DFC                  mov dword ptr [ebp-04], ecx
:00418DD7 8B4508                  mov eax, dword ptr [ebp+08]
:00418DDA C1E006                  shl eax, 06
:00418DDD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00418DE0 8D840144200000          lea eax, dword ptr [ecx+eax+00002044]
:00418DE7 8BE5                    mov esp, ebp
:00418DE9 5D                      pop ebp
:00418DEA C20400                  ret 0004


:00418DED CC                      int 03
:00418DEE CC                      int 03
:00418DEF CC                      int 03

* Referenced by a CALL at Address:
|:004124A8   
|
:00418DF0 55                      push ebp
:00418DF1 8BEC                    mov ebp, esp
:00418DF3 51                      push ecx
:00418DF4 894DFC                  mov dword ptr [ebp-04], ecx
:00418DF7 8B45FC                  mov eax, dword ptr [ebp-04]
:00418DFA 8A4D08                  mov cl, byte ptr [ebp+08]
:00418DFD 88880E3D0000            mov byte ptr [eax+00003D0E], cl
:00418E03 8BE5                    mov esp, ebp
:00418E05 5D                      pop ebp
:00418E06 C20400                  ret 0004


:00418E09 CC                      int 03
:00418E0A CC                      int 03
:00418E0B CC                      int 03
:00418E0C CC                      int 03
:00418E0D CC                      int 03
:00418E0E CC                      int 03
:00418E0F CC                      int 03

* Referenced by a CALL at Addresses:
|:00417F04   , :00417F1F   , :00417F87   , :0042A078   , :0042A093   
|
:00418E10 55                      push ebp
:00418E11 8BEC                    mov ebp, esp
:00418E13 51                      push ecx
:00418E14 894DFC                  mov dword ptr [ebp-04], ecx
:00418E17 8B45FC                  mov eax, dword ptr [ebp-04]
:00418E1A 8A4007                  mov al, byte ptr [eax+07]
:00418E1D 8BE5                    mov esp, ebp
:00418E1F 5D                      pop ebp
:00418E20 C3                      ret


:00418E21 CC                      int 03
:00418E22 CC                      int 03
:00418E23 CC                      int 03
:00418E24 CC                      int 03
:00418E25 CC                      int 03
:00418E26 CC                      int 03
:00418E27 CC                      int 03
:00418E28 CC                      int 03
:00418E29 CC                      int 03
:00418E2A CC                      int 03
:00418E2B CC                      int 03
:00418E2C CC                      int 03
:00418E2D CC                      int 03
:00418E2E CC                      int 03
:00418E2F CC                      int 03

* Referenced by a CALL at Addresses:
|:004180F7   , :00418144   , :0041837A   , :004183C7   
|
:00418E30 55                      push ebp
:00418E31 8BEC                    mov ebp, esp
:00418E33 51                      push ecx
:00418E34 894DFC                  mov dword ptr [ebp-04], ecx
:00418E37 8B45FC                  mov eax, dword ptr [ebp-04]
:00418E3A 8A4807                  mov cl, byte ptr [eax+07]
:00418E3D 80C101                  add cl, 01
:00418E40 8B55FC                  mov edx, dword ptr [ebp-04]
:00418E43 884A07                  mov byte ptr [edx+07], cl
:00418E46 8BE5                    mov esp, ebp
:00418E48 5D                      pop ebp
:00418E49 C3                      ret


:00418E4A CC                      int 03
:00418E4B CC                      int 03
:00418E4C CC                      int 03
:00418E4D CC                      int 03
:00418E4E CC                      int 03
:00418E4F CC                      int 03

* Referenced by a CALL at Addresses:
|:004182F3   , :00426B15   , :00426E0F   , :00427EBE   , :004289A8   
|:00428E42   , :00429654   , :00429CD9   , :00429E20   , :0042A191   
|
:00418E50 55                      push ebp
:00418E51 8BEC                    mov ebp, esp
:00418E53 51                      push ecx
:00418E54 894DFC                  mov dword ptr [ebp-04], ecx
:00418E57 8B45FC                  mov eax, dword ptr [ebp-04]
:00418E5A 668B4028                mov ax, word ptr [eax+28]
:00418E5E 8BE5                    mov esp, ebp
:00418E60 5D                      pop ebp
:00418E61 C3                      ret


:00418E62 CC                      int 03
:00418E63 CC                      int 03
:00418E64 CC                      int 03
:00418E65 CC                      int 03
:00418E66 CC                      int 03
:00418E67 CC                      int 03
:00418E68 CC                      int 03
:00418E69 CC                      int 03
:00418E6A CC                      int 03
:00418E6B CC                      int 03
:00418E6C CC                      int 03
:00418E6D CC                      int 03
:00418E6E CC                      int 03
:00418E6F CC                      int 03

* Referenced by a CALL at Addresses:
|:00418309   , :0041831B   , :0041832D   , :0042913D   , :004291B1   
|:00429CF8   
|
:00418E70 55                      push ebp
:00418E71 8BEC                    mov ebp, esp
:00418E73 51                      push ecx
:00418E74 894DFC                  mov dword ptr [ebp-04], ecx
:00418E77 8B45FC                  mov eax, dword ptr [ebp-04]
:00418E7A 668B4030                mov ax, word ptr [eax+30]
:00418E7E 8BE5                    mov esp, ebp
:00418E80 5D                      pop ebp
:00418E81 C3                      ret


:00418E82 CC                      int 03
:00418E83 CC                      int 03
:00418E84 CC                      int 03
:00418E85 CC                      int 03
:00418E86 CC                      int 03
:00418E87 CC                      int 03
:00418E88 CC                      int 03
:00418E89 CC                      int 03
:00418E8A CC                      int 03
:00418E8B CC                      int 03
:00418E8C CC                      int 03
:00418E8D CC                      int 03
:00418E8E CC                      int 03
:00418E8F CC                      int 03

* Referenced by a CALL at Addresses:
|:00418EFA   , :00418F3D   
|
:00418E90 55                      push ebp
:00418E91 8BEC                    mov ebp, esp
:00418E93 837D0800                cmp dword ptr [ebp+08], 00000000
:00418E97 7423                    je 00418EBC
:00418E99 8B4508                  mov eax, dword ptr [ebp+08]
:00418E9C 50                      push eax
:00418E9D 68286E4900              push 00496E28
:00418EA2 E8E9820600              call 00481190
:00418EA7 83C408                  add esp, 00000008

* Possible StringData Ref from Data Obj ->"\"
                                  |
:00418EAA 68FCB34800              push 0048B3FC
:00418EAF 68286E4900              push 00496E28
:00418EB4 E8E7820600              call 004811A0
:00418EB9 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418E97(C)
|
:00418EBC 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00418EBF 51                      push ecx
:00418EC0 68286E4900              push 00496E28
:00418EC5 E8D6820600              call 004811A0
:00418ECA 83C408                  add esp, 00000008
:00418ECD B8286E4900              mov eax, 00496E28
:00418ED2 5D                      pop ebp
:00418ED3 C3                      ret



* Referenced by a CALL at Addresses:
|:0040B345   , :00417CCC   , :00418FF0   , :0041A1F7   , :0041A2CB   
|:0041B0C3   , :0041B472   , :0046C679   , :00474876   , :004748CB   
|:0047490B   
|
:00418ED4 55                      push ebp
:00418ED5 8BEC                    mov ebp, esp
:00418ED7 81EC04010000            sub esp, 00000104
:00418EDD 8D85FCFEFFFF            lea eax, dword ptr [ebp+FFFFFEFC]
:00418EE3 50                      push eax
:00418EE4 6804010000              push 00000104
:00418EE9 FF1510614800            call dword ptr [00486110]
:00418EEF 8B4D08                  mov ecx, dword ptr [ebp+08]
:00418EF2 51                      push ecx
:00418EF3 8D95FCFEFFFF            lea edx, dword ptr [ebp+FFFFFEFC]
:00418EF9 52                      push edx
:00418EFA E891FFFFFF              call 00418E90
:00418EFF 83C408                  add esp, 00000008
:00418F02 8BE5                    mov esp, ebp
:00418F04 5D                      pop ebp
:00418F05 C3                      ret



* Referenced by a CALL at Addresses:
|:0041905F   , :0041F52A   
|
:00418F06 55                      push ebp
:00418F07 8BEC                    mov ebp, esp
:00418F09 81EC04010000            sub esp, 00000104

* Possible StringData Ref from Data Obj ->"."
                                  |
:00418F0F 6800B44800              push 0048B400
:00418F14 8D85FCFEFFFF            lea eax, dword ptr [ebp+FFFFFEFC]
:00418F1A 50                      push eax
:00418F1B E870820600              call 00481190
:00418F20 83C408                  add esp, 00000008
:00418F23 8D8DFCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEFC]
:00418F29 51                      push ecx
:00418F2A 90                      nop
:00418F2B 90                      nop
:00418F2C 90                      nop
:00418F2D 90                      nop
:00418F2E 90                      nop
:00418F2F 83C404                  add esp, 00000004
:00418F32 8B5508                  mov edx, dword ptr [ebp+08]
:00418F35 52                      push edx
:00418F36 8D85FCFEFFFF            lea eax, dword ptr [ebp+FFFFFEFC]
:00418F3C 50                      push eax
:00418F3D E84EFFFFFF              call 00418E90
:00418F42 83C408                  add esp, 00000008
:00418F45 8BE5                    mov esp, ebp
:00418F47 5D                      pop ebp
:00418F48 C3                      ret



* Referenced by a CALL at Addresses:
|:004032DA   , :0040368A   , :00417C6C   , :00417EBA   , :0041805E   
|:004180AB   , :0041A271   , :0041A32E   , :0041A982   , :0041ADB1   
|:0041ADFF   , :0041AE49   , :0041AE97   , :0041B14F   , :0041B214   
|:0041B503   , :0042B4A8   , :0042BAA3   , :004314DF   , :0047C6D2   
|:0047C70A   , :0047C737   , :00484F46   , :00484F66   , :00485123   
|:00485136   , :00485149   , :00485183   , :00485196   , :004851D5   
|:004851E8   , :004851FB   , :00485305   , :0048538F   , :00485DC3   
|
:00418F49 55                      push ebp
:00418F4A 8BEC                    mov ebp, esp
:00418F4C 51                      push ecx
:00418F4D 894DFC                  mov dword ptr [ebp-04], ecx
:00418F50 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00418F53 E86D030000              call 004192C5
:00418F58 8BE5                    mov esp, ebp
:00418F5A 5D                      pop ebp
:00418F5B C3                      ret



* Referenced by a CALL at Addresses:
|:00402FBB   , :00417A8A   , :00417CBA   , :00417FBA   , :0041A1E4   
|:0041A2B8   , :0041A73A   , :0041A776   , :0041ADE2   , :0041AEB8   
|:0041B0A8   , :0041B3D7   , :0041B457   , :0041FB45   , :0041FB96   
|:0042BA6F   , :0042BC58   , :0047C6B8   
|
:00418F5C 55                      push ebp
:00418F5D 8BEC                    mov ebp, esp
:00418F5F 83EC10                  sub esp, 00000010
:00418F62 894DF4                  mov dword ptr [ebp-0C], ecx
:00418F65 8B450C                  mov eax, dword ptr [ebp+0C]
:00418F68 25FFFF0000              and eax, 0000FFFF
:00418F6D 8945F0                  mov dword ptr [ebp-10], eax
:00418F70 837DF006                cmp dword ptr [ebp-10], 00000006
:00418F74 7740                    ja 00418FB6
:00418F76 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00418F79 FF248D9F904100          jmp dword ptr [4*ecx+0041909F]
:00418F80 C745F800000040          mov [ebp-08], 40000000
:00418F87 EB34                    jmp 00418FBD
:00418F89 C745F800000040          mov [ebp-08], 40000000
:00418F90 EB2B                    jmp 00418FBD
:00418F92 C745F800000080          mov [ebp-08], 80000000
:00418F99 EB22                    jmp 00418FBD
:00418F9B C745F800000080          mov [ebp-08], 80000000
:00418FA2 EB19                    jmp 00418FBD
:00418FA4 C745F8000000C0          mov [ebp-08], C0000000
:00418FAB EB10                    jmp 00418FBD
:00418FAD C745F8000000C0          mov [ebp-08], C0000000
:00418FB4 EB07                    jmp 00418FBD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418F74(C)
|
:00418FB6 C745F800000080          mov [ebp-08], 80000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00418F87(U), :00418F90(U), :00418F99(U), :00418FA2(U), :00418FAB(U)
|:00418FB4(U)
|
:00418FBD 8B55F4                  mov edx, dword ptr [ebp-0C]
:00418FC0 833A00                  cmp dword ptr [edx], 00000000
:00418FC3 0F85CB000000            jne 00419094
:00418FC9 C745FC00000000          mov [ebp-04], 00000000
:00418FD0 EB09                    jmp 00418FDB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419021(U)
|
:00418FD2 8B45FC                  mov eax, dword ptr [ebp-04]
:00418FD5 83C001                  add eax, 00000001
:00418FD8 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418FD0(U)
|
:00418FDB 6A00                    push 00000000
:00418FDD 6880000000              push 00000080
:00418FE2 6A03                    push 00000003
:00418FE4 6A00                    push 00000000
:00418FE6 6A01                    push 00000001
:00418FE8 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00418FEB 51                      push ecx
:00418FEC 8B5508                  mov edx, dword ptr [ebp+08]
:00418FEF 52                      push edx
:00418FF0 E8DFFEFFFF              call 00418ED4
:00418FF5 83C404                  add esp, 00000004
:00418FF8 50                      push eax
:00418FF9 FF1518614800            call dword ptr [00486118]
:00418FFF 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00419002 8901                    mov dword ptr [ecx], eax
:00419004 8B55F4                  mov edx, dword ptr [ebp-0C]
:00419007 833AFF                  cmp dword ptr [edx], FFFFFFFF
:0041900A 7513                    jne 0041901F
:0041900C 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041900F C70000000000            mov dword ptr [eax], 00000000
:00419015 837DFC05                cmp dword ptr [ebp-04], 00000005
:00419019 7E02                    jle 0041901D
:0041901B EB06                    jmp 00419023

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419019(C)
|
:0041901D EB02                    jmp 00419021

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041900A(C)
|
:0041901F EB02                    jmp 00419023

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041901D(U)
|
:00419021 EBAF                    jmp 00418FD2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041901B(U), :0041901F(U)
|
:00419023 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00419026 833900                  cmp dword ptr [ecx], 00000000
:00419029 7569                    jne 00419094
:0041902B 817DF800000040          cmp dword ptr [ebp-08], 40000000
:00419032 7504                    jne 00419038
:00419034 33C0                    xor eax, eax
:00419036 EB61                    jmp 00419099

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419032(C)
|
:00419038 C745FC00000000          mov [ebp-04], 00000000
:0041903F EB09                    jmp 0041904A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419092(U)
|
:00419041 8B55FC                  mov edx, dword ptr [ebp-04]
:00419044 83C201                  add edx, 00000001
:00419047 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041903F(U)
|
:0041904A 6A00                    push 00000000
:0041904C 6880000000              push 00000080
:00419051 6A03                    push 00000003
:00419053 6A00                    push 00000000
:00419055 6A01                    push 00000001
:00419057 8B45F8                  mov eax, dword ptr [ebp-08]
:0041905A 50                      push eax
:0041905B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041905E 51                      push ecx
:0041905F E8A2FEFFFF              call 00418F06
:00419064 83C404                  add esp, 00000004
:00419067 50                      push eax
:00419068 FF1518614800            call dword ptr [00486118]
:0041906E 8B55F4                  mov edx, dword ptr [ebp-0C]
:00419071 8902                    mov dword ptr [edx], eax
:00419073 8B45F4                  mov eax, dword ptr [ebp-0C]
:00419076 8338FF                  cmp dword ptr [eax], FFFFFFFF
:00419079 7515                    jne 00419090
:0041907B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041907E C70100000000            mov dword ptr [ecx], 00000000
:00419084 837DFC05                cmp dword ptr [ebp-04], 00000005
:00419088 7E04                    jle 0041908E
:0041908A 33C0                    xor eax, eax
:0041908C EB0B                    jmp 00419099

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419088(C)
|
:0041908E EB02                    jmp 00419092

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419079(C)
|
:00419090 EB02                    jmp 00419094

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041908E(U)
|
:00419092 EBAD                    jmp 00419041

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00418FC3(C), :00419029(C), :00419090(U)
|
:00419094 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00419036(U), :0041908C(U)
|
:00419099 8BE5                    mov esp, ebp
:0041909B 5D                      pop ebp
:0041909C C20800                  ret 0008



:0041909F 928F4100                DWORD 00418F92
:004190A3 808F4100                DWORD 00418F80
:004190A7 A48F4100                DWORD 00418FA4
:004190AB B68F4100                DWORD 00418FB6
:004190AF 9B8F4100                DWORD 00418F9B
:004190B3 898F4100                DWORD 00418F89
:004190B7 AD8F4100                DWORD 00418FAD



* Referenced by a CALL at Addresses:
|:00417CD8   , :0041A203   , :0041A2D7   , :0041B0CF   , :0041B47E   
|
:004190BB 55                      push ebp
:004190BC 8BEC                    mov ebp, esp
:004190BE 51                      push ecx
:004190BF 894DFC                  mov dword ptr [ebp-04], ecx
:004190C2 8B45FC                  mov eax, dword ptr [ebp-04]
:004190C5 833800                  cmp dword ptr [eax], 00000000
:004190C8 752D                    jne 004190F7
:004190CA 6A00                    push 00000000
:004190CC 6880000000              push 00000080
:004190D1 6A04                    push 00000004
:004190D3 6A00                    push 00000000
:004190D5 6A01                    push 00000001
:004190D7 68000000C0              push C0000000
:004190DC 8B4D08                  mov ecx, dword ptr [ebp+08]
:004190DF 51                      push ecx
:004190E0 FF1518614800            call dword ptr [00486118]
:004190E6 8B55FC                  mov edx, dword ptr [ebp-04]
:004190E9 8902                    mov dword ptr [edx], eax
:004190EB 8B45FC                  mov eax, dword ptr [ebp-04]
:004190EE 8338FF                  cmp dword ptr [eax], FFFFFFFF
:004190F1 7504                    jne 004190F7
:004190F3 33C0                    xor eax, eax
:004190F5 EB05                    jmp 004190FC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004190C8(C), :004190F1(C)
|
:004190F7 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004190F5(U)
|
:004190FC 8BE5                    mov esp, ebp
:004190FE 5D                      pop ebp
:004190FF C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00419179   , :004191A4   
|
:00419102 55                      push ebp
:00419103 8BEC                    mov ebp, esp
:00419105 83EC10                  sub esp, 00000010
:00419108 894DF0                  mov dword ptr [ebp-10], ecx
:0041910B 8B45F0                  mov eax, dword ptr [ebp-10]
:0041910E 833800                  cmp dword ptr [eax], 00000000
:00419111 7447                    je 0041915A
:00419113 C745F400000000          mov [ebp-0C], 00000000
:0041911A EB09                    jmp 00419125

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419156(U)
|
:0041911C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041911F 83C101                  add ecx, 00000001
:00419122 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041911A(U)
|
:00419125 6A00                    push 00000000
:00419127 8D55FC                  lea edx, dword ptr [ebp-04]
:0041912A 52                      push edx
:0041912B 8B450C                  mov eax, dword ptr [ebp+0C]
:0041912E 50                      push eax
:0041912F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00419132 51                      push ecx
:00419133 8B55F0                  mov edx, dword ptr [ebp-10]
:00419136 8B02                    mov eax, dword ptr [edx]
:00419138 50                      push eax
:00419139 FF1514614800            call dword ptr [00486114]
:0041913F 8945F8                  mov dword ptr [ebp-08], eax
:00419142 837DF800                cmp dword ptr [ebp-08], 00000000
:00419146 750C                    jne 00419154
:00419148 837DF405                cmp dword ptr [ebp-0C], 00000005
:0041914C 7E04                    jle 00419152
:0041914E 33C0                    xor eax, eax
:00419150 EB0F                    jmp 00419161

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041914C(C)
|
:00419152 EB02                    jmp 00419156

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419146(C)
|
:00419154 EB02                    jmp 00419158

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419152(U)
|
:00419156 EBC4                    jmp 0041911C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419154(U)
|
:00419158 EB04                    jmp 0041915E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419111(C)
|
:0041915A 33C0                    xor eax, eax
:0041915C EB03                    jmp 00419161

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419158(U)
|
:0041915E 8B45FC                  mov eax, dword ptr [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00419150(U), :0041915C(U)
|
:00419161 8BE5                    mov esp, ebp
:00419163 5D                      pop ebp
:00419164 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:00402966   , :00402A12   , :00402A82   , :00402B0C   , :00402BD2   
|:00402C87   , :00417AC1   , :00417ADC   , :00417AF7   , :00417B12   
|:00417B2D   , :00417B48   , :00417B63   , :00417B7E   , :00417B9A   
|:00417BAD   , :00417BC1   , :00417BD5   , :00417C05   , :00417C1B   
|:00417C2F   , :00417C3D   , :0041A74B   , :0041A787   , :0041AE1B   
|:0041AECC   , :0041F9CE   , :0041FCE9   , :0041FE87   , :0047C6E8   
|
:00419167 55                      push ebp
:00419168 8BEC                    mov ebp, esp
:0041916A 51                      push ecx
:0041916B 894DFC                  mov dword ptr [ebp-04], ecx
:0041916E 8B450C                  mov eax, dword ptr [ebp+0C]
:00419171 50                      push eax
:00419172 8B4D08                  mov ecx, dword ptr [ebp+08]
:00419175 51                      push ecx
:00419176 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00419179 E884FFFFFF              call 00419102
:0041917E 8BE5                    mov esp, ebp
:00419180 5D                      pop ebp
:00419181 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0040281F   , :0040BF71   , :0041801F   , :0041A30E   , :0041FB76   
|:0041FBC7   , :0042BA8C   , :0044F71A   
|
:00419184 55                      push ebp
:00419185 8BEC                    mov ebp, esp
:00419187 51                      push ecx
:00419188 894DFC                  mov dword ptr [ebp-04], ecx
:0041918B 6A00                    push 00000000
:0041918D 8B4508                  mov eax, dword ptr [ebp+08]
:00419190 50                      push eax
:00419191 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00419194 E816000000              call 004191AF
:00419199 8B4D10                  mov ecx, dword ptr [ebp+10]
:0041919C 51                      push ecx
:0041919D 8B550C                  mov edx, dword ptr [ebp+0C]
:004191A0 52                      push edx
:004191A1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004191A4 E859FFFFFF              call 00419102
:004191A9 8BE5                    mov esp, ebp
:004191AB 5D                      pop ebp
:004191AC C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:00419194   , :00419231   , :004192AA   
|
:004191AF 55                      push ebp
:004191B0 8BEC                    mov ebp, esp
:004191B2 83EC0C                  sub esp, 0000000C
:004191B5 894DF8                  mov dword ptr [ebp-08], ecx
:004191B8 C745FC00000000          mov [ebp-04], 00000000
:004191BF 8B450C                  mov eax, dword ptr [ebp+0C]
:004191C2 8945F4                  mov dword ptr [ebp-0C], eax
:004191C5 837DF400                cmp dword ptr [ebp-0C], 00000000
:004191C9 740E                    je 004191D9
:004191CB 837DF401                cmp dword ptr [ebp-0C], 00000001
:004191CF 7411                    je 004191E2
:004191D1 837DF402                cmp dword ptr [ebp-0C], 00000002
:004191D5 7414                    je 004191EB
:004191D7 EB1B                    jmp 004191F4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004191C9(C)
|
:004191D9 C745FC00000000          mov [ebp-04], 00000000
:004191E0 EB19                    jmp 004191FB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004191CF(C)
|
:004191E2 C745FC01000000          mov [ebp-04], 00000001
:004191E9 EB10                    jmp 004191FB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004191D5(C)
|
:004191EB C745FC02000000          mov [ebp-04], 00000002
:004191F2 EB07                    jmp 004191FB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004191D7(U)
|
:004191F4 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004191E0(U), :004191E9(U), :004191F2(U)
|
:004191FB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004191FE 833900                  cmp dword ptr [ecx], 00000000
:00419201 7416                    je 00419219
:00419203 8B55FC                  mov edx, dword ptr [ebp-04]
:00419206 52                      push edx
:00419207 6A00                    push 00000000
:00419209 8B4508                  mov eax, dword ptr [ebp+08]
:0041920C 50                      push eax
:0041920D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00419210 8B11                    mov edx, dword ptr [ecx]
:00419212 52                      push edx
:00419213 FF1504614800            call dword ptr [00486104]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419201(C)
|
:00419219 8BE5                    mov esp, ebp
:0041921B 5D                      pop ebp
:0041921C C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:004028D1   , :00402A6E   , :00402AF1   , :00402BB7   , :00402C70   
|:0041FCD5   , :0041FE69   
|
:0041921F 55                      push ebp
:00419220 8BEC                    mov ebp, esp
:00419222 51                      push ecx
:00419223 894DFC                  mov dword ptr [ebp-04], ecx
:00419226 8B450C                  mov eax, dword ptr [ebp+0C]
:00419229 50                      push eax
:0041922A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041922D 51                      push ecx
:0041922E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00419231 E879FFFFFF              call 004191AF
:00419236 8BE5                    mov esp, ebp
:00419238 5D                      pop ebp
:00419239 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0041928F   , :004192BA   
|
:0041923C 55                      push ebp
:0041923D 8BEC                    mov ebp, esp
:0041923F 83EC0C                  sub esp, 0000000C
:00419242 894DF4                  mov dword ptr [ebp-0C], ecx
:00419245 8B45F4                  mov eax, dword ptr [ebp-0C]
:00419248 833800                  cmp dword ptr [eax], 00000000
:0041924B 7427                    je 00419274
:0041924D 6A00                    push 00000000
:0041924F 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00419252 51                      push ecx
:00419253 8B550C                  mov edx, dword ptr [ebp+0C]
:00419256 52                      push edx
:00419257 8B4508                  mov eax, dword ptr [ebp+08]
:0041925A 50                      push eax
:0041925B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041925E 8B11                    mov edx, dword ptr [ecx]
:00419260 52                      push edx
:00419261 FF150C614800            call dword ptr [0048610C]
:00419267 8945F8                  mov dword ptr [ebp-08], eax
:0041926A 837DF800                cmp dword ptr [ebp-08], 00000000
:0041926E 7504                    jne 00419274
:00419270 33C0                    xor eax, eax
:00419272 EB03                    jmp 00419277

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041924B(C), :0041926E(C)
|
:00419274 8B45FC                  mov eax, dword ptr [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419272(U)
|
:00419277 8BE5                    mov esp, ebp
:00419279 5D                      pop ebp
:0041927A C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:00417D0F   , :00417D2A   , :00417D45   , :00417D60   , :00417D7B   
|:00417D96   , :00417DB1   , :00417DCC   , :00417DE7   , :00417DFB   
|:00417E0F   , :00417E22   , :00417E52   , :00417E68   , :00417E7B   
|:00417E9A   , :0041B3F6   
|
:0041927D 55                      push ebp
:0041927E 8BEC                    mov ebp, esp
:00419280 51                      push ecx
:00419281 894DFC                  mov dword ptr [ebp-04], ecx
:00419284 8B450C                  mov eax, dword ptr [ebp+0C]
:00419287 50                      push eax
:00419288 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041928B 51                      push ecx
:0041928C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041928F E8A8FFFFFF              call 0041923C
:00419294 8BE5                    mov esp, ebp
:00419296 5D                      pop ebp
:00419297 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0041A233   , :0041A25A   , :0041A2F7   , :0041B4BA   , :0044F6CE   
|
:0041929A 55                      push ebp
:0041929B 8BEC                    mov ebp, esp
:0041929D 51                      push ecx
:0041929E 894DFC                  mov dword ptr [ebp-04], ecx
:004192A1 6A00                    push 00000000
:004192A3 8B4508                  mov eax, dword ptr [ebp+08]
:004192A6 50                      push eax
:004192A7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004192AA E800FFFFFF              call 004191AF
:004192AF 8B4D10                  mov ecx, dword ptr [ebp+10]
:004192B2 51                      push ecx
:004192B3 8B550C                  mov edx, dword ptr [ebp+0C]
:004192B6 52                      push edx
:004192B7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004192BA E87DFFFFFF              call 0041923C
:004192BF 8BE5                    mov esp, ebp
:004192C1 5D                      pop ebp
:004192C2 C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:004015BA   , :0040267C   , :00402FAA   , :00403C4F   , :00403E62   
|:00408607   , :0040B02D   , :00417C57   , :00417EA5   , :0041802A   
|:00418F53   , :0041930B   , :0041A23B   , :0041A262   , :0041A316   
|:0041A753   , :0041A78F   , :0041AE23   , :0041AED7   , :0041B0E5   
|:0041B401   , :0041B4C5   , :0041B5A2   , :0041B5D1   , :0041C7ED   
|:0041C864   , :0041D803   , :0041E171   , :00421972   , :00422471   
|:00426D48   , :00428921   , :0042B736   , :0042BA97   , :0042BCD9   
|:0042BE31   , :0042C16F   , :0043133B   , :00431466   , :00431B24   
|:0043D2B2   , :0043FECF   , :00441B44   , :00443E8A   , :00443FDC   
|:0044417C   , :00444375   , :00444521   , :0044475C   , :00444F75   
|:004456AD   , :00445D0C   , :004462B5   , :004466BD   , :004471E3   
|:00447682   , :00448B9B   , :00449F6C   , :0044AC02   , :0044B492   
|:0044C238   , :0044D185   , :0044D5E5   , :00456553   , :00456996   
|:00456F22   , :00457A15   , :00457B01   , :00457CBC   , :00457DA7   
|:00457E92   , :00458051   , :004582DE   , :004585F5   , :004588E0   
|:00458A30   , :00458BE1   , :00458D54   , :00458EF1   , :00459B4D   
|:0045C2CD   , :0045EF78   , :0046FCEB   , :0046FE10   , :00477FFD   
|:00478196   , :0047C6F4   , :0047C717   
|
:004192C5 55                      push ebp
:004192C6 8BEC                    mov ebp, esp
:004192C8 51                      push ecx
:004192C9 894DFC                  mov dword ptr [ebp-04], ecx
:004192CC 8B45FC                  mov eax, dword ptr [ebp-04]
:004192CF 833800                  cmp dword ptr [eax], 00000000
:004192D2 7424                    je 004192F8
:004192D4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004192D7 8B11                    mov edx, dword ptr [ecx]
:004192D9 52                      push edx
:004192DA FF1508614800            call dword ptr [00486108]
:004192E0 85C0                    test eax, eax
:004192E2 7410                    je 004192F4
:004192E4 8B45FC                  mov eax, dword ptr [ebp-04]
:004192E7 C70000000000            mov dword ptr [eax], 00000000
:004192ED B801000000              mov eax, 00000001
:004192F2 EB09                    jmp 004192FD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004192E2(C)
|
:004192F4 33C0                    xor eax, eax
:004192F6 EB05                    jmp 004192FD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004192D2(C)
|
:004192F8 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004192F2(U), :004192F6(U)
|
:004192FD 8BE5                    mov esp, ebp
:004192FF 5D                      pop ebp
:00419300 C3                      ret


:00419301 55                      push ebp
:00419302 8BEC                    mov ebp, esp
:00419304 51                      push ecx
:00419305 894DFC                  mov dword ptr [ebp-04], ecx
:00419308 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041930B E8B5FFFFFF              call 004192C5
:00419310 8B4508                  mov eax, dword ptr [ebp+08]
:00419313 50                      push eax
:00419314 FF15F8604800            call dword ptr [004860F8]
:0041931A 8BE5                    mov esp, ebp
:0041931C 5D                      pop ebp
:0041931D C20400                  ret 0004


:00419320 55                      push ebp
:00419321 8BEC                    mov ebp, esp
:00419323 51                      push ecx
:00419324 894DFC                  mov dword ptr [ebp-04], ecx
:00419327 8B45FC                  mov eax, dword ptr [ebp-04]
:0041932A 8B00                    mov eax, dword ptr [eax]
:0041932C 8BE5                    mov esp, ebp
:0041932E 5D                      pop ebp
:0041932F C3                      ret


:00419330 55                      push ebp
:00419331 8BEC                    mov ebp, esp
:00419333 81EC4C010000            sub esp, 0000014C
:00419339 898DB4FEFFFF            mov dword ptr [ebp+FFFFFEB4], ecx
:0041933F C745FC00000000          mov [ebp-04], 00000000
:00419346 C785B8FEFFFF00000000    mov dword ptr [ebp+FFFFFEB8], 00000000
:00419350 8D85BCFEFFFF            lea eax, dword ptr [ebp+FFFFFEBC]
:00419356 50                      push eax
:00419357 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041935A 51                      push ecx
:0041935B FF15FC604800            call dword ptr [004860FC]
:00419361 8985B8FEFFFF            mov dword ptr [ebp+FFFFFEB8], eax
:00419367 83BDB8FEFFFFFF          cmp dword ptr [ebp+FFFFFEB8], FFFFFFFF
:0041936E 7416                    je 00419386
:00419370 83BDD8FEFFFF00          cmp dword ptr [ebp+FFFFFED8], 00000000
:00419377 7404                    je 0041937D
:00419379 33C0                    xor eax, eax
:0041937B EB22                    jmp 0041939F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419377(C)
|
:0041937D 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:00419383 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041936E(C)
|
:00419386 83BDB8FEFFFF00          cmp dword ptr [ebp+FFFFFEB8], 00000000
:0041938D 740D                    je 0041939C
:0041938F 8B85B8FEFFFF            mov eax, dword ptr [ebp+FFFFFEB8]
:00419395 50                      push eax
:00419396 FF1500614800            call dword ptr [00486100]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041938D(C)
|
:0041939C 8B45FC                  mov eax, dword ptr [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041937B(U)
|
:0041939F 8BE5                    mov esp, ebp
:004193A1 5D                      pop ebp
:004193A2 C20400                  ret 0004



* Referenced by a CALL at Address:
|:00417FDC   
|
:004193A5 55                      push ebp
:004193A6 8BEC                    mov ebp, esp
:004193A8 83EC08                  sub esp, 00000008
:004193AB 894DF8                  mov dword ptr [ebp-08], ecx
:004193AE C745FC00000000          mov [ebp-04], 00000000
:004193B5 8B45F8                  mov eax, dword ptr [ebp-08]
:004193B8 833800                  cmp dword ptr [eax], 00000000
:004193BB 741E                    je 004193DB
:004193BD 6A00                    push 00000000
:004193BF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004193C2 8B11                    mov edx, dword ptr [ecx]
:004193C4 52                      push edx
:004193C5 FF15EC604800            call dword ptr [004860EC]
:004193CB 8945FC                  mov dword ptr [ebp-04], eax
:004193CE 837DFCFF                cmp dword ptr [ebp-04], FFFFFFFF
:004193D2 7507                    jne 004193DB
:004193D4 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004193BB(C), :004193D2(C)
|
:004193DB 8B45FC                  mov eax, dword ptr [ebp-04]
:004193DE 8BE5                    mov esp, ebp
:004193E0 5D                      pop ebp
:004193E1 C3                      ret


:004193E2 C3                      ret


:004193E3 8BEC                    mov ebp, esp
:004193E5 83EC10                  sub esp, 00000010
:004193E8 C645F863                mov [ebp-08], 63
:004193EC A104B44800              mov eax, dword ptr [0048B404]
:004193F1 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419461(U)
|
:004193F4 C645FC41                mov [ebp-04], 41
:004193F8 C745F400000000          mov [ebp-0C], 00000000
:004193FF EB12                    jmp 00419413

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419448(U)
|
:00419401 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00419404 83C101                  add ecx, 00000001
:00419407 894DF4                  mov dword ptr [ebp-0C], ecx
:0041940A 8A55FC                  mov dl, byte ptr [ebp-04]
:0041940D 80C201                  add dl, 01
:00419410 8855FC                  mov byte ptr [ebp-04], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004193FF(U)
|
:00419413 837DF41A                cmp dword ptr [ebp-0C], 0000001A
:00419417 7F31                    jg 0041944A
:00419419 8D45FC                  lea eax, dword ptr [ebp-04]
:0041941C 50                      push eax
:0041941D FF15F4604800            call dword ptr [004860F4]
:00419423 8945F0                  mov dword ptr [ebp-10], eax
:00419426 837DF005                cmp dword ptr [ebp-10], 00000005
:0041942A 750D                    jne 00419439
:0041942C E84D000000              call 0041947E
:00419431 85C0                    test eax, eax
:00419433 7402                    je 00419437
:00419435 EB13                    jmp 0041944A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419433(C)
|
:00419437 EB0F                    jmp 00419448

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041942A(C)
|
:00419439 837DF003                cmp dword ptr [ebp-10], 00000003
:0041943D 7509                    jne 00419448
:0041943F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00419442 83C141                  add ecx, 00000041
:00419445 884DF8                  mov byte ptr [ebp-08], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00419437(U), :0041943D(C)
|
:00419448 EBB7                    jmp 00419401

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00419417(C), :00419435(U)
|
:0041944A 837DF41A                cmp dword ptr [ebp-0C], 0000001A
:0041944E 7E1A                    jle 0041946A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419468(U)
|

* Possible StringData Ref from Data Obj ->"ѡ־ܲٴϷ̷
"
                                        ->"Ѿ룬˳ãĲų"
                                  |
:00419450 6808B44800              push 0048B408
:00419455 E8B7B70500              call 00474C11
:0041945A 83C404                  add esp, 00000004
:0041945D 85C0                    test eax, eax
:0041945F 7402                    je 00419463
:00419461 EB91                    jmp 004193F4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041945F(C)
|
:00419463 E83FB70500              call 00474BA7
:00419468 EBE6                    jmp 00419450

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041944E(C)
|
:0041946A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041946D 83C141                  add ecx, 00000041
:00419470 8B5508                  mov edx, dword ptr [ebp+08]
:00419473 880A                    mov byte ptr [edx], cl
:00419475 B801000000              mov eax, 00000001
:0041947A 8BE5                    mov esp, ebp
:0041947C 5D                      pop ebp
:0041947D C3                      ret



* Referenced by a CALL at Address:
|:0041942C   
|
:0041947E B801000000              mov eax, 00000001
:00419483 C3                      ret


:00419484 0200                    add al, byte ptr [eax]
:00419486 00A158B44800            add byte ptr [ecx+0048B458], ah
:0041948C 8945F8                  mov dword ptr [ebp-08], eax
:0041948F C685F0FEFFFF41          mov byte ptr [ebp+FFFFFEF0], 41
:00419496 EB0F                    jmp 004194A7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041951E(U)
|
:00419498 8A8DF0FEFFFF            mov cl, byte ptr [ebp+FFFFFEF0]
:0041949E 80C101                  add cl, 01
:004194A1 888DF0FEFFFF            mov byte ptr [ebp+FFFFFEF0], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419496(U)
|
:004194A7 0FBE95F0FEFFFF          movsx edx, byte ptr [ebp+FFFFFEF0]
:004194AE 83FA5A                  cmp edx, 0000005A
:004194B1 7F70                    jg 00419523
:004194B3 8A85F0FEFFFF            mov al, byte ptr [ebp+FFFFFEF0]
:004194B9 8845F8                  mov byte ptr [ebp-08], al
:004194BC 8D4DF8                  lea ecx, dword ptr [ebp-08]
:004194BF 51                      push ecx
:004194C0 FF15F4604800            call dword ptr [004860F4]
:004194C6 83F805                  cmp eax, 00000005
:004194C9 7553                    jne 0041951E
:004194CB 6804010000              push 00000104
:004194D0 8D95E4FDFFFF            lea edx, dword ptr [ebp+FFFFFDE4]
:004194D6 52                      push edx
:004194D7 8D85E8FEFFFF            lea eax, dword ptr [ebp+FFFFFEE8]
:004194DD 50                      push eax
:004194DE 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:004194E4 51                      push ecx
:004194E5 8D55FC                  lea edx, dword ptr [ebp-04]
:004194E8 52                      push edx
:004194E9 6804010000              push 00000104
:004194EE 8D85F4FEFFFF            lea eax, dword ptr [ebp+FFFFFEF4]
:004194F4 50                      push eax
:004194F5 8D4DF8                  lea ecx, dword ptr [ebp-08]
:004194F8 51                      push ecx
:004194F9 FF15F0604800            call dword ptr [004860F0]
:004194FF 8D95F4FEFFFF            lea edx, dword ptr [ebp+FFFFFEF4]
:00419505 52                      push edx

* Possible StringData Ref from Data Obj ->"SOUSOU"
                                  |
:00419506 68F4B34800              push 0048B3F4
:0041950B E8207E0600              call 00481330
:00419510 83C408                  add esp, 00000008
:00419513 85C0                    test eax, eax
:00419515 7507                    jne 0041951E
:00419517 B801000000              mov eax, 00000001
:0041951C EB07                    jmp 00419525

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004194C9(C), :00419515(C)
|
:0041951E E975FFFFFF              jmp 00419498

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004194B1(C)
|
:00419523 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041951C(U)
|
:00419525 8BE5                    mov esp, ebp
:00419527 5D                      pop ebp
:00419528 C3                      ret


:00419529 55                      push ebp
:0041952A 8BEC                    mov ebp, esp
:0041952C 81EC80000000            sub esp, 00000080
:00419532 8B4508                  mov eax, dword ptr [ebp+08]
:00419535 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:00419536 685CB44800              push 0048B45C
:0041953B 8D4D80                  lea ecx, dword ptr [ebp-80]
:0041953E 51                      push ecx
:0041953F FF15C0624800            call dword ptr [004862C0]
:00419545 83C40C                  add esp, 0000000C
:00419548 6830200000              push 00002030

* Possible StringData Ref from Data Obj ->"־ܲٴִд"
                                  |
:0041954D 6860B44800              push 0048B460
:00419552 8D5580                  lea edx, dword ptr [ebp-80]
:00419555 52                      push edx
:00419556 A1686A4B00              mov eax, dword ptr [004B6A68]
:0041955B 50                      push eax
:0041955C FF15C4624800            call dword ptr [004862C4]
:00419562 E840B60500              call 00474BA7
:00419567 8BE5                    mov esp, ebp
:00419569 5D                      pop ebp
:0041956A C3                      ret


:0041956B CC                      int 03
:0041956C CC                      int 03
:0041956D CC                      int 03
:0041956E CC                      int 03
:0041956F CC                      int 03
:00419570 55                      push ebp
:00419571 8BEC                    mov ebp, esp
:00419573 E807000000              call 0041957F
:00419578 E811000000              call 0041958E
:0041957D 5D                      pop ebp
:0041957E C3                      ret



* Referenced by a CALL at Address:
|:00419573   
|
:0041957F 55                      push ebp
:00419580 8BEC                    mov ebp, esp
:00419582 B9386F4900              mov ecx, 00496F38
:00419587 E8A40B0000              call 0041A130
:0041958C 5D                      pop ebp
:0041958D C3                      ret



* Referenced by a CALL at Address:
|:00419578   
|
:0041958E 55                      push ebp
:0041958F 8BEC                    mov ebp, esp
:00419591 68A0954100              push 004195A0
:00419596 E8657B0600              call 00481100
:0041959B 83C404                  add esp, 00000004
:0041959E 5D                      pop ebp
:0041959F C3                      ret


:004195A0 55                      push ebp
:004195A1 8BEC                    mov ebp, esp
:004195A3 B9386F4900              mov ecx, 00496F38
:004195A8 E8631F0100              call 0042B510
:004195AD 5D                      pop ebp
:004195AE C3                      ret


:004195AF 55                      push ebp
:004195B0 8BEC                    mov ebp, esp
:004195B2 51                      push ecx
:004195B3 8B450C                  mov eax, dword ptr [ebp+0C]
:004195B6 8945FC                  mov dword ptr [ebp-04], eax
:004195B9 837DFC05                cmp dword ptr [ebp-04], 00000005
:004195BD 7719                    ja 004195D8
:004195BF 837DFC05                cmp dword ptr [ebp-04], 00000005
:004195C3 0F849C000000            je 00419665
:004195C9 837DFC02                cmp dword ptr [ebp-04], 00000002
:004195CD 0F8483000000            je 00419656
:004195D3 E9EC000000              jmp 004196C4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004195BD(C)
|
:004195D8 817DFC10010000          cmp dword ptr [ebp-04], 00000110
:004195DF 741F                    je 00419600
:004195E1 817DFC11010000          cmp dword ptr [ebp-04], 00000111
:004195E8 0F84C1000000            je 004196AF
:004195EE 817DFC35010000          cmp dword ptr [ebp-04], 00000135
:004195F5 0F848C000000            je 00419687
:004195FB E9C4000000              jmp 004196C4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004195DF(C)
|
:00419600 8B0DF07F4900            mov ecx, dword ptr [00497FF0]
:00419606 51                      push ecx
:00419607 6AF4                    push FFFFFFF4

* Possible Reference to Dialog: DialogID_0129, CONTROL_ID:056B, ""
                                  |
:00419609 686B050000              push 0000056B
:0041960E 8B5508                  mov edx, dword ptr [ebp+08]
:00419611 52                      push edx
:00419612 FF15DC624800            call dword ptr [004862DC]
:00419618 50                      push eax
:00419619 FF15B8624800            call dword ptr [004862B8]
:0041961F 6856010000              push 00000156
:00419624 E8A3000000              call 004196CC
:00419629 83C404                  add esp, 00000004
:0041962C A3306F4900              mov dword ptr [00496F30], eax
:00419631 A1306F4900              mov eax, dword ptr [00496F30]
:00419636 50                      push eax
:00419637 6A00                    push 00000000
:00419639 68F7000000              push 000000F7

* Possible Reference to Dialog: DialogID_0129, CONTROL_ID:056B, ""
                                  |
:0041963E 686B050000              push 0000056B
:00419643 8B4D08                  mov ecx, dword ptr [ebp+08]
:00419646 51                      push ecx
:00419647 FF15DC624800            call dword ptr [004862DC]
:0041964D 50                      push eax
:0041964E FF15F4624800            call dword ptr [004862F4]
:00419654 EB6E                    jmp 004196C4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004195CD(C)
|
:00419656 8B15306F4900            mov edx, dword ptr [00496F30]
:0041965C 52                      push edx
:0041965D FF1548604800            call dword ptr [00486048]
:00419663 EB5F                    jmp 004196C4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004195C3(C)
|
:00419665 6A00                    push 00000000
:00419667 6A30                    push 00000030
:00419669 6A30                    push 00000030
:0041966B 6A01                    push 00000001
:0041966D 6A01                    push 00000001

* Possible Reference to Dialog: DialogID_0129, CONTROL_ID:056B, ""
                                  |
:0041966F 686B050000              push 0000056B
:00419674 8B4508                  mov eax, dword ptr [ebp+08]
:00419677 50                      push eax
:00419678 FF15DC624800            call dword ptr [004862DC]
:0041967E 50                      push eax
:0041967F FF15BC624800            call dword ptr [004862BC]
:00419685 EB3D                    jmp 004196C4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004195F5(C)
|
:00419687 6A00                    push 00000000
:00419689 B9386F4900              mov ecx, 00496F38
:0041968E E895090000              call 0041A028
:00419693 85C0                    test eax, eax
:00419695 7416                    je 004196AD
:00419697 6A00                    push 00000000
:00419699 6A00                    push 00000000
:0041969B 6A01                    push 00000001
:0041969D 8B4D14                  mov ecx, dword ptr [ebp+14]
:004196A0 51                      push ecx
:004196A1 8B5510                  mov edx, dword ptr [ebp+10]
:004196A4 52                      push edx
:004196A5 E8D7820500              call 00471981
:004196AA 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419695(C)
|
:004196AD EB15                    jmp 004196C4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004195E8(C)
|
:004196AF 8B4510                  mov eax, dword ptr [ebp+10]
:004196B2 50                      push eax
:004196B3 8B0D306F4900            mov ecx, dword ptr [00496F30]
:004196B9 51                      push ecx
:004196BA 6A00                    push 00000000
:004196BC E87B000000              call 0041973C
:004196C1 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004195D3(U), :004195FB(U), :00419654(U), :00419663(U), :00419685(U)
|:004196AD(U)
|
:004196C4 33C0                    xor eax, eax
:004196C6 8BE5                    mov esp, ebp
:004196C8 5D                      pop ebp
:004196C9 C21000                  ret 0010



* Referenced by a CALL at Addresses:
|:00419624   , :00419A40   , :00419B5D   , :00419C7A   
|
:004196CC 55                      push ebp
:004196CD 8BEC                    mov ebp, esp
:004196CF 6AFF                    push FFFFFFFF
:004196D1 6869514800              push 00485169
:004196D6 64A100000000            mov eax, dword ptr fs:[00000000]
:004196DC 50                      push eax
:004196DD 64892500000000          mov dword ptr fs:[00000000], esp
:004196E4 83EC20                  sub esp, 00000020
:004196E7 8D4DD8                  lea ecx, dword ptr [ebp-28]
:004196EA E84121FFFF              call 0040B830
:004196EF C745FC00000000          mov [ebp-04], 00000000
:004196F6 8B4508                  mov eax, dword ptr [ebp+08]
:004196F9 50                      push eax
:004196FA 8B0D606A4B00            mov ecx, dword ptr [004B6A60]
:00419700 51                      push ecx
:00419701 8D4DD8                  lea ecx, dword ptr [ebp-28]
:00419704 E81400FFFF              call 0040971D
:00419709 8D4DD8                  lea ecx, dword ptr [ebp-28]
:0041970C E80B0EFFFF              call 0040A51C
:00419711 8D4DD8                  lea ecx, dword ptr [ebp-28]
:00419714 E8D9FFFEFF              call 004096F2
:00419719 8945D4                  mov dword ptr [ebp-2C], eax
:0041971C C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00419723 8D4DD8                  lea ecx, dword ptr [ebp-28]
:00419726 E86521FFFF              call 0040B890
:0041972B 8B45D4                  mov eax, dword ptr [ebp-2C]
:0041972E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00419731 64890D00000000          mov dword ptr fs:[00000000], ecx
:00419738 8BE5                    mov esp, ebp
:0041973A 5D                      pop ebp
:0041973B C3                      ret



* Referenced by a CALL at Addresses:
|:004196BC   , :00419AD8   , :00419BF5   , :00419D12   
|
:0041973C 55                      push ebp
:0041973D 8BEC                    mov ebp, esp
:0041973F 83EC74                  sub esp, 00000074
:00419742 C7459400000000          mov [ebp-6C], 00000000
:00419749 E8A5D30000              call 00426AF3
:0041974E 894590                  mov dword ptr [ebp-70], eax
:00419751 8B4510                  mov eax, dword ptr [ebp+10]
:00419754 25FFFF0000              and eax, 0000FFFF

* Possible Reference to Dialog: DialogID_0129, CONTROL_ID:056B, ""
                                  |
:00419759 3D6B050000              cmp eax, 0000056B
:0041975E 0F8553020000            jne 004199B7
:00419764 8B4D10                  mov ecx, dword ptr [ebp+10]
:00419767 C1E910                  shr ecx, 10
:0041976A 81E1FFFF0000            and ecx, 0000FFFF
:00419770 81E1FFFF0000            and ecx, 0000FFFF
:00419776 85C9                    test ecx, ecx
:00419778 0F8539020000            jne 004199B7
:0041977E 8B5508                  mov edx, dword ptr [ebp+08]
:00419781 52                      push edx
:00419782 B9386F4900              mov ecx, 00496F38
:00419787 E89C080000              call 0041A028
:0041978C 85C0                    test eax, eax
:0041978E 0F8423020000            je 004199B7
:00419794 6A00                    push 00000000
:00419796 E821C20500              call 004759BC
:0041979B 83C404                  add esp, 00000004
:0041979E B9386F4900              mov ecx, 00496F38
:004197A3 E818090000              call 0041A0C0
:004197A8 E8494E0000              call 0041E5F6
:004197AD 8B4508                  mov eax, dword ptr [ebp+08]
:004197B0 89458C                  mov dword ptr [ebp-74], eax
:004197B3 837D8C03                cmp dword ptr [ebp-74], 00000003
:004197B7 0F87DF010000            ja 0041999C
:004197BD 8B4D8C                  mov ecx, dword ptr [ebp-74]
:004197C0 FF248DBB994100          jmp dword ptr [4*ecx+004199BB]
:004197C7 833D546F490000          cmp dword ptr [00496F54], 00000000
:004197CE 7475                    je 00419845
:004197D0 837D9000                cmp dword ptr [ebp-70], 00000000
:004197D4 746F                    je 00419845
:004197D6 B970074B00              mov ecx, 004B0770
:004197DB E8AF3AFFFF              call 0040D28F
:004197E0 8AC8                    mov cl, al
:004197E2 81E1FF000000            and ecx, 000000FF
:004197E8 6BC928                  imul ecx, 00000028
:004197EB 81C168EB4A00            add ecx, 004AEB68
:004197F1 E87A090000              call 0041A170
:004197F6 894598                  mov dword ptr [ebp-68], eax
:004197F9 8B5598                  mov edx, dword ptr [ebp-68]
:004197FC 52                      push edx
:004197FD E85ECFFEFF              call 00406760
:00419802 83C404                  add esp, 00000004
:00419805 50                      push eax

* Possible StringData Ref from Data Obj ->"%sʣ"
                                  |
:00419806 687CB44800              push 0048B47C
:0041980B 8D459C                  lea eax, dword ptr [ebp-64]
:0041980E 50                      push eax
:0041980F FF15C0624800            call dword ptr [004862C0]
:00419815 83C40C                  add esp, 0000000C
:00419818 6A00                    push 00000000
:0041981A 6A00                    push 00000000
:0041981C 8D4D9C                  lea ecx, dword ptr [ebp-64]
:0041981F 51                      push ecx
:00419820 E8CC3D0100              call 0042D5F1
:00419825 83C40C                  add esp, 0000000C
:00419828 6A00                    push 00000000
:0041982A 8B5598                  mov edx, dword ptr [ebp-68]
:0041982D 52                      push edx

* Possible StringData Ref from Data Obj ->"ǣ"
                                  |
:0041982E 688CB44800              push 0048B48C
:00419833 E8B93D0100              call 0042D5F1
:00419838 83C40C                  add esp, 0000000C
:0041983B C705546F490000000000    mov dword ptr [00496F54], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004197CE(C), :004197D4(C)
|
:00419845 6A01                    push 00000001
:00419847 E8CC840400              call 00461D18
:0041984C 83C404                  add esp, 00000004
:0041984F E948010000              jmp 0041999C
:00419854 833D506F490000          cmp dword ptr [00496F50], 00000000
:0041985B 7475                    je 004198D2
:0041985D 837D9000                cmp dword ptr [ebp-70], 00000000
:00419861 746F                    je 004198D2
:00419863 B970074B00              mov ecx, 004B0770
:00419868 E8223AFFFF              call 0040D28F
:0041986D 8AC8                    mov cl, al
:0041986F 81E1FF000000            and ecx, 000000FF
:00419875 6BC928                  imul ecx, 00000028
:00419878 81C168EB4A00            add ecx, 004AEB68
:0041987E E8ED080000              call 0041A170
:00419883 894598                  mov dword ptr [ebp-68], eax
:00419886 8B4598                  mov eax, dword ptr [ebp-68]
:00419889 50                      push eax
:0041988A E8D1CEFEFF              call 00406760
:0041988F 83C404                  add esp, 00000004
:00419892 50                      push eax

* Possible StringData Ref from Data Obj ->"%sʣ"
                                  |
:00419893 6894B44800              push 0048B494
:00419898 8D4D9C                  lea ecx, dword ptr [ebp-64]
:0041989B 51                      push ecx
:0041989C FF15C0624800            call dword ptr [004862C0]
:004198A2 83C40C                  add esp, 0000000C
:004198A5 6A00                    push 00000000
:004198A7 6A00                    push 00000000
:004198A9 8D559C                  lea edx, dword ptr [ebp-64]
:004198AC 52                      push edx
:004198AD E83F3D0100              call 0042D5F1
:004198B2 83C40C                  add esp, 0000000C
:004198B5 6A00                    push 00000000
:004198B7 8B4598                  mov eax, dword ptr [ebp-68]
:004198BA 50                      push eax

* Possible StringData Ref from Data Obj ->"ǣ"
                                  |
:004198BB 68A4B44800              push 0048B4A4
:004198C0 E82C3D0100              call 0042D5F1
:004198C5 83C40C                  add esp, 0000000C
:004198C8 C705506F490000000000    mov dword ptr [00496F50], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041985B(C), :00419861(C)
|
:004198D2 6A00                    push 00000000
:004198D4 E83F840400              call 00461D18
:004198D9 83C404                  add esp, 00000004
:004198DC E9BB000000              jmp 0041999C
:004198E1 833D4C6F490000          cmp dword ptr [00496F4C], 00000000
:004198E8 7475                    je 0041995F
:004198EA 837D9000                cmp dword ptr [ebp-70], 00000000
:004198EE 746F                    je 0041995F
:004198F0 B970074B00              mov ecx, 004B0770
:004198F5 E89539FFFF              call 0040D28F
:004198FA 8AC8                    mov cl, al
:004198FC 81E1FF000000            and ecx, 000000FF
:00419902 6BC928                  imul ecx, 00000028
:00419905 81C168EB4A00            add ecx, 004AEB68
:0041990B E8605D0400              call 0045F670
:00419910 894598                  mov dword ptr [ebp-68], eax
:00419913 8B4D98                  mov ecx, dword ptr [ebp-68]
:00419916 51                      push ecx
:00419917 E844CEFEFF              call 00406760
:0041991C 83C404                  add esp, 00000004
:0041991F 50                      push eax

* Possible StringData Ref from Data Obj ->"%s򿪲ֿ⣡"
                                  |
:00419920 68ACB44800              push 0048B4AC
:00419925 8D559C                  lea edx, dword ptr [ebp-64]
:00419928 52                      push edx
:00419929 FF15C0624800            call dword ptr [004862C0]
:0041992F 83C40C                  add esp, 0000000C
:00419932 6A00                    push 00000000
:00419934 6A00                    push 00000000
:00419936 8D459C                  lea eax, dword ptr [ebp-64]
:00419939 50                      push eax
:0041993A E8B23C0100              call 0042D5F1
:0041993F 83C40C                  add esp, 0000000C
:00419942 6A00                    push 00000000
:00419944 8B4D98                  mov ecx, dword ptr [ebp-68]
:00419947 51                      push ecx

* Possible StringData Ref from Data Obj ->"ǣ"
                                  |
:00419948 68BCB44800              push 0048B4BC
:0041994D E89F3C0100              call 0042D5F1
:00419952 83C40C                  add esp, 0000000C
:00419955 C7054C6F490000000000    mov dword ptr [00496F4C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004198E8(C), :004198EE(C)
|
:0041995F E84C830400              call 00461CB0
:00419964 EB36                    jmp 0041999C
:00419966 B9902F4900              mov ecx, 00492F90
:0041996B E8FAEBFFFF              call 0041856A
:00419970 894594                  mov dword ptr [ebp-6C], eax
:00419973 837D9400                cmp dword ptr [ebp-6C], 00000000
:00419977 7423                    je 0041999C
:00419979 6A00                    push 00000000
:0041997B 8B1508754B00            mov edx, dword ptr [004B7508]
:00419981 52                      push edx
:00419982 FF15E0624800            call dword ptr [004862E0]
:00419988 6A00                    push 00000000
:0041998A E8C92E0100              call 0042C858
:0041998F 83C404                  add esp, 00000004
:00419992 C705C0E44A0001000000    mov dword ptr [004AE4C0], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004197B7(C), :0041984F(U), :004198DC(U), :00419964(U), :00419977(C)
|
:0041999C 837D9400                cmp dword ptr [ebp-6C], 00000000
:004199A0 7515                    jne 004199B7
:004199A2 C605486F490000          mov byte ptr [00496F48], 00
:004199A9 E8DF2E0100              call 0042C88D
:004199AE 50                      push eax
:004199AF E808C00500              call 004759BC
:004199B4 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041975E(C), :00419778(C), :0041978E(C), :004199A0(C)
|
:004199B7 8BE5                    mov esp, ebp
:004199B9 5D                      pop ebp
:004199BA C3                      ret



:004199BB C7974100                DWORD 004197C7
:004199BF 54984100                DWORD 00419854
:004199C3 E1984100                DWORD 004198E1
:004199C7 66994100                DWORD 00419966


:004199CB 55                      push ebp
:004199CC 8BEC                    mov ebp, esp
:004199CE 51                      push ecx
:004199CF 8B450C                  mov eax, dword ptr [ebp+0C]
:004199D2 8945FC                  mov dword ptr [ebp-04], eax
:004199D5 837DFC05                cmp dword ptr [ebp-04], 00000005
:004199D9 7719                    ja 004199F4
:004199DB 837DFC05                cmp dword ptr [ebp-04], 00000005
:004199DF 0F849C000000            je 00419A81
:004199E5 837DFC02                cmp dword ptr [ebp-04], 00000002
:004199E9 0F8483000000            je 00419A72
:004199EF E9EC000000              jmp 00419AE0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004199D9(C)
|
:004199F4 817DFC10010000          cmp dword ptr [ebp-04], 00000110
:004199FB 741F                    je 00419A1C
:004199FD 817DFC11010000          cmp dword ptr [ebp-04], 00000111
:00419A04 0F84C1000000            je 00419ACB
:00419A0A 817DFC35010000          cmp dword ptr [ebp-04], 00000135
:00419A11 0F848C000000            je 00419AA3
:00419A17 E9C4000000              jmp 00419AE0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004199FB(C)
|
:00419A1C 8B0DF07F4900            mov ecx, dword ptr [00497FF0]
:00419A22 51                      push ecx
:00419A23 6AF4                    push FFFFFFF4

* Possible Reference to Dialog: DialogID_0129, CONTROL_ID:056B, ""
                                  |
:00419A25 686B050000              push 0000056B
:00419A2A 8B5508                  mov edx, dword ptr [ebp+08]
:00419A2D 52                      push edx
:00419A2E FF15DC624800            call dword ptr [004862DC]
:00419A34 50                      push eax
:00419A35 FF15B8624800            call dword ptr [004862B8]
:00419A3B 6857010000              push 00000157
:00419A40 E887FCFFFF              call 004196CC
:00419A45 83C404                  add esp, 00000004
:00419A48 A3586F4900              mov dword ptr [00496F58], eax
:00419A4D A1586F4900              mov eax, dword ptr [00496F58]
:00419A52 50                      push eax
:00419A53 6A00                    push 00000000
:00419A55 68F7000000              push 000000F7

* Possible Reference to Dialog: DialogID_0129, CONTROL_ID:056B, ""
                                  |
:00419A5A 686B050000              push 0000056B
:00419A5F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00419A62 51                      push ecx
:00419A63 FF15DC624800            call dword ptr [004862DC]
:00419A69 50                      push eax
:00419A6A FF15F4624800            call dword ptr [004862F4]
:00419A70 EB6E                    jmp 00419AE0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004199E9(C)
|
:00419A72 8B15586F4900            mov edx, dword ptr [00496F58]
:00419A78 52                      push edx
:00419A79 FF1548604800            call dword ptr [00486048]
:00419A7F EB5F                    jmp 00419AE0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004199DF(C)
|
:00419A81 6A00                    push 00000000
:00419A83 6A30                    push 00000030
:00419A85 6A30                    push 00000030
:00419A87 6A01                    push 00000001
:00419A89 6A01                    push 00000001

* Possible Reference to Dialog: DialogID_0129, CONTROL_ID:056B, ""
                                  |
:00419A8B 686B050000              push 0000056B
:00419A90 8B4508                  mov eax, dword ptr [ebp+08]
:00419A93 50                      push eax
:00419A94 FF15DC624800            call dword ptr [004862DC]
:00419A9A 50                      push eax
:00419A9B FF15BC624800            call dword ptr [004862BC]
:00419AA1 EB3D                    jmp 00419AE0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419A11(C)
|
:00419AA3 6A01                    push 00000001
:00419AA5 B9386F4900              mov ecx, 00496F38
:00419AAA E879050000              call 0041A028
:00419AAF 85C0                    test eax, eax
:00419AB1 7416                    je 00419AC9
:00419AB3 6A00                    push 00000000
:00419AB5 6A00                    push 00000000
:00419AB7 6A01                    push 00000001
:00419AB9 8B4D14                  mov ecx, dword ptr [ebp+14]
:00419ABC 51                      push ecx
:00419ABD 8B5510                  mov edx, dword ptr [ebp+10]
:00419AC0 52                      push edx
:00419AC1 E8BB7E0500              call 00471981
:00419AC6 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419AB1(C)
|
:00419AC9 EB15                    jmp 00419AE0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419A04(C)
|
:00419ACB 8B4510                  mov eax, dword ptr [ebp+10]
:00419ACE 50                      push eax
:00419ACF 8B0D586F4900            mov ecx, dword ptr [00496F58]
:00419AD5 51                      push ecx
:00419AD6 6A01                    push 00000001
:00419AD8 E85FFCFFFF              call 0041973C
:00419ADD 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004199EF(U), :00419A17(U), :00419A70(U), :00419A7F(U), :00419AA1(U)
|:00419AC9(U)
|
:00419AE0 33C0                    xor eax, eax
:00419AE2 8BE5                    mov esp, ebp
:00419AE4 5D                      pop ebp
:00419AE5 C21000                  ret 0010


:00419AE8 55                      push ebp
:00419AE9 8BEC                    mov ebp, esp
:00419AEB 51                      push ecx
:00419AEC 8B450C                  mov eax, dword ptr [ebp+0C]
:00419AEF 8945FC                  mov dword ptr [ebp-04], eax
:00419AF2 837DFC05                cmp dword ptr [ebp-04], 00000005
:00419AF6 7719                    ja 00419B11
:00419AF8 837DFC05                cmp dword ptr [ebp-04], 00000005
:00419AFC 0F849C000000            je 00419B9E
:00419B02 837DFC02                cmp dword ptr [ebp-04], 00000002
:00419B06 0F8483000000            je 00419B8F
:00419B0C E9EC000000              jmp 00419BFD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419AF6(C)
|
:00419B11 817DFC10010000          cmp dword ptr [ebp-04], 00000110
:00419B18 741F                    je 00419B39
:00419B1A 817DFC11010000          cmp dword ptr [ebp-04], 00000111
:00419B21 0F84C1000000            je 00419BE8
:00419B27 817DFC35010000          cmp dword ptr [ebp-04], 00000135
:00419B2E 0F848C000000            je 00419BC0
:00419B34 E9C4000000              jmp 00419BFD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419B18(C)
|
:00419B39 8B0DF07F4900            mov ecx, dword ptr [00497FF0]
:00419B3F 51                      push ecx
:00419B40 6AF4                    push FFFFFFF4

* Possible Reference to Dialog: DialogID_0129, CONTROL_ID:056B, ""
                                  |
:00419B42 686B050000              push 0000056B
:00419B47 8B5508                  mov edx, dword ptr [ebp+08]
:00419B4A 52                      push edx
:00419B4B FF15DC624800            call dword ptr [004862DC]
:00419B51 50                      push eax
:00419B52 FF15B8624800            call dword ptr [004862B8]
:00419B58 6858010000              push 00000158
:00419B5D E86AFBFFFF              call 004196CC
:00419B62 83C404                  add esp, 00000004
:00419B65 A35C6F4900              mov dword ptr [00496F5C], eax
:00419B6A A15C6F4900              mov eax, dword ptr [00496F5C]
:00419B6F 50                      push eax
:00419B70 6A00                    push 00000000
:00419B72 68F7000000              push 000000F7

* Possible Reference to Dialog: DialogID_0129, CONTROL_ID:056B, ""
                                  |
:00419B77 686B050000              push 0000056B
:00419B7C 8B4D08                  mov ecx, dword ptr [ebp+08]
:00419B7F 51                      push ecx
:00419B80 FF15DC624800            call dword ptr [004862DC]
:00419B86 50                      push eax
:00419B87 FF15F4624800            call dword ptr [004862F4]
:00419B8D EB6E                    jmp 00419BFD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419B06(C)
|
:00419B8F 8B155C6F4900            mov edx, dword ptr [00496F5C]
:00419B95 52                      push edx
:00419B96 FF1548604800            call dword ptr [00486048]
:00419B9C EB5F                    jmp 00419BFD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419AFC(C)
|
:00419B9E 6A00                    push 00000000
:00419BA0 6A30                    push 00000030
:00419BA2 6A30                    push 00000030
:00419BA4 6A01                    push 00000001
:00419BA6 6A01                    push 00000001

* Possible Reference to Dialog: DialogID_0129, CONTROL_ID:056B, ""
                                  |
:00419BA8 686B050000              push 0000056B
:00419BAD 8B4508                  mov eax, dword ptr [ebp+08]
:00419BB0 50                      push eax
:00419BB1 FF15DC624800            call dword ptr [004862DC]
:00419BB7 50                      push eax
:00419BB8 FF15BC624800            call dword ptr [004862BC]
:00419BBE EB3D                    jmp 00419BFD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419B2E(C)
|
:00419BC0 6A02                    push 00000002
:00419BC2 B9386F4900              mov ecx, 00496F38
:00419BC7 E85C040000              call 0041A028
:00419BCC 85C0                    test eax, eax
:00419BCE 7416                    je 00419BE6
:00419BD0 6A00                    push 00000000
:00419BD2 6A00                    push 00000000
:00419BD4 6A01                    push 00000001
:00419BD6 8B4D14                  mov ecx, dword ptr [ebp+14]
:00419BD9 51                      push ecx
:00419BDA 8B5510                  mov edx, dword ptr [ebp+10]
:00419BDD 52                      push edx
:00419BDE E89E7D0500              call 00471981
:00419BE3 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419BCE(C)
|
:00419BE6 EB15                    jmp 00419BFD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419B21(C)
|
:00419BE8 8B4510                  mov eax, dword ptr [ebp+10]
:00419BEB 50                      push eax
:00419BEC 8B0D5C6F4900            mov ecx, dword ptr [00496F5C]
:00419BF2 51                      push ecx
:00419BF3 6A02                    push 00000002
:00419BF5 E842FBFFFF              call 0041973C
:00419BFA 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00419B0C(U), :00419B34(U), :00419B8D(U), :00419B9C(U), :00419BBE(U)
|:00419BE6(U)
|
:00419BFD 33C0                    xor eax, eax
:00419BFF 8BE5                    mov esp, ebp
:00419C01 5D                      pop ebp
:00419C02 C21000                  ret 0010


:00419C05 55                      push ebp
:00419C06 8BEC                    mov ebp, esp
:00419C08 51                      push ecx
:00419C09 8B450C                  mov eax, dword ptr [ebp+0C]
:00419C0C 8945FC                  mov dword ptr [ebp-04], eax
:00419C0F 837DFC05                cmp dword ptr [ebp-04], 00000005
:00419C13 7719                    ja 00419C2E
:00419C15 837DFC05                cmp dword ptr [ebp-04], 00000005
:00419C19 0F849C000000            je 00419CBB
:00419C1F 837DFC02                cmp dword ptr [ebp-04], 00000002
:00419C23 0F8483000000            je 00419CAC
:00419C29 E9EC000000              jmp 00419D1A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419C13(C)
|
:00419C2E 817DFC10010000          cmp dword ptr [ebp-04], 00000110
:00419C35 741F                    je 00419C56
:00419C37 817DFC11010000          cmp dword ptr [ebp-04], 00000111
:00419C3E 0F84C1000000            je 00419D05
:00419C44 817DFC35010000          cmp dword ptr [ebp-04], 00000135
:00419C4B 0F848C000000            je 00419CDD
:00419C51 E9C4000000              jmp 00419D1A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419C35(C)
|
:00419C56 8B0DF07F4900            mov ecx, dword ptr [00497FF0]
:00419C5C 51                      push ecx
:00419C5D 6AF4                    push FFFFFFF4

* Possible Reference to Dialog: DialogID_0129, CONTROL_ID:056B, ""
                                  |
:00419C5F 686B050000              push 0000056B
:00419C64 8B5508                  mov edx, dword ptr [ebp+08]
:00419C67 52                      push edx
:00419C68 FF15DC624800            call dword ptr [004862DC]
:00419C6E 50                      push eax
:00419C6F FF15B8624800            call dword ptr [004862B8]
:00419C75 6855010000              push 00000155
:00419C7A E84DFAFFFF              call 004196CC
:00419C7F 83C404                  add esp, 00000004
:00419C82 A3346F4900              mov dword ptr [00496F34], eax
:00419C87 A1346F4900              mov eax, dword ptr [00496F34]
:00419C8C 50                      push eax
:00419C8D 6A00                    push 00000000
:00419C8F 68F7000000              push 000000F7

* Possible Reference to Dialog: DialogID_0129, CONTROL_ID:056B, ""
                                  |
:00419C94 686B050000              push 0000056B
:00419C99 8B4D08                  mov ecx, dword ptr [ebp+08]
:00419C9C 51                      push ecx
:00419C9D FF15DC624800            call dword ptr [004862DC]
:00419CA3 50                      push eax
:00419CA4 FF15F4624800            call dword ptr [004862F4]
:00419CAA EB6E                    jmp 00419D1A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419C23(C)
|
:00419CAC 8B15346F4900            mov edx, dword ptr [00496F34]
:00419CB2 52                      push edx
:00419CB3 FF1548604800            call dword ptr [00486048]
:00419CB9 EB5F                    jmp 00419D1A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419C19(C)
|
:00419CBB 6A00                    push 00000000
:00419CBD 6A30                    push 00000030
:00419CBF 6A30                    push 00000030
:00419CC1 6A01                    push 00000001
:00419CC3 6A01                    push 00000001

* Possible Reference to Dialog: DialogID_0129, CONTROL_ID:056B, ""
                                  |
:00419CC5 686B050000              push 0000056B
:00419CCA 8B4508                  mov eax, dword ptr [ebp+08]
:00419CCD 50                      push eax
:00419CCE FF15DC624800            call dword ptr [004862DC]
:00419CD4 50                      push eax
:00419CD5 FF15BC624800            call dword ptr [004862BC]
:00419CDB EB3D                    jmp 00419D1A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419C4B(C)
|
:00419CDD 6A03                    push 00000003
:00419CDF B9386F4900              mov ecx, 00496F38
:00419CE4 E83F030000              call 0041A028
:00419CE9 85C0                    test eax, eax
:00419CEB 7416                    je 00419D03
:00419CED 6A00                    push 00000000
:00419CEF 6A00                    push 00000000
:00419CF1 6A01                    push 00000001
:00419CF3 8B4D14                  mov ecx, dword ptr [ebp+14]
:00419CF6 51                      push ecx
:00419CF7 8B5510                  mov edx, dword ptr [ebp+10]
:00419CFA 52                      push edx
:00419CFB E8817C0500              call 00471981
:00419D00 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419CEB(C)
|
:00419D03 EB15                    jmp 00419D1A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419C3E(C)
|
:00419D05 8B4510                  mov eax, dword ptr [ebp+10]
:00419D08 50                      push eax
:00419D09 8B0D346F4900            mov ecx, dword ptr [00496F34]
:00419D0F 51                      push ecx
:00419D10 6A03                    push 00000003
:00419D12 E825FAFFFF              call 0041973C
:00419D17 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00419C29(U), :00419C51(U), :00419CAA(U), :00419CB9(U), :00419CDB(U)
|:00419D03(U)
|
:00419D1A 33C0                    xor eax, eax
:00419D1C 8BE5                    mov esp, ebp
:00419D1E 5D                      pop ebp
:00419D1F C21000                  ret 0010



* Referenced by a CALL at Addresses:
|:00415C2C   , :0042A2AA   
|
:00419D22 55                      push ebp
:00419D23 8BEC                    mov ebp, esp
:00419D25 83EC18                  sub esp, 00000018
:00419D28 894DE8                  mov dword ptr [ebp-18], ecx
:00419D2B 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00419D2E E88D030000              call 0041A0C0
:00419D33 8B45E8                  mov eax, dword ptr [ebp-18]
:00419D36 C7401401000000          mov [eax+14], 00000001
:00419D3D 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00419D40 C7411801000000          mov [ecx+18], 00000001
:00419D47 8B55E8                  mov edx, dword ptr [ebp-18]
:00419D4A C7421C01000000          mov [edx+1C], 00000001
:00419D51 8B45E8                  mov eax, dword ptr [ebp-18]
:00419D54 833800                  cmp dword ptr [eax], 00000000
:00419D57 7525                    jne 00419D7E
:00419D59 6A00                    push 00000000
:00419D5B 68AF954100              push 004195AF
:00419D60 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:00419D66 51                      push ecx

* Possible Reference to Dialog: DialogID_0129 
                                  |
:00419D67 6829010000              push 00000129
:00419D6C 8B15606A4B00            mov edx, dword ptr [004B6A60]
:00419D72 52                      push edx
:00419D73 FF15B0624800            call dword ptr [004862B0]
:00419D79 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00419D7C 8901                    mov dword ptr [ecx], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419D57(C)
|
:00419D7E 8B55E8                  mov edx, dword ptr [ebp-18]
:00419D81 837A0400                cmp dword ptr [edx+04], 00000000
:00419D85 7525                    jne 00419DAC
:00419D87 6A00                    push 00000000

* Possible StringData Ref from Code Obj ->"UQEE}w}"
                                  |
:00419D89 68CB994100              push 004199CB
:00419D8E A1686A4B00              mov eax, dword ptr [004B6A68]
:00419D93 50                      push eax

* Possible Reference to Dialog: DialogID_0129 
                                  |
:00419D94 6829010000              push 00000129
:00419D99 8B0D606A4B00            mov ecx, dword ptr [004B6A60]
:00419D9F 51                      push ecx
:00419DA0 FF15B0624800            call dword ptr [004862B0]
:00419DA6 8B55E8                  mov edx, dword ptr [ebp-18]
:00419DA9 894204                  mov dword ptr [edx+04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419D85(C)
|
:00419DAC 8B45E8                  mov eax, dword ptr [ebp-18]
:00419DAF 83780800                cmp dword ptr [eax+08], 00000000
:00419DB3 7526                    jne 00419DDB
:00419DB5 6A00                    push 00000000

* Possible StringData Ref from Code Obj ->"UQEE}w}"
                                  |
:00419DB7 68E89A4100              push 00419AE8
:00419DBC 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:00419DC2 51                      push ecx

* Possible Reference to Dialog: DialogID_0129 
                                  |
:00419DC3 6829010000              push 00000129
:00419DC8 8B15606A4B00            mov edx, dword ptr [004B6A60]
:00419DCE 52                      push edx
:00419DCF FF15B0624800            call dword ptr [004862B0]
:00419DD5 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00419DD8 894108                  mov dword ptr [ecx+08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419DB3(C)
|
:00419DDB 8B55E8                  mov edx, dword ptr [ebp-18]
:00419DDE 837A0C00                cmp dword ptr [edx+0C], 00000000
:00419DE2 7525                    jne 00419E09
:00419DE4 6A00                    push 00000000

* Possible StringData Ref from Code Obj ->"UQEE}w}"
                                  |
:00419DE6 68059C4100              push 00419C05
:00419DEB A1686A4B00              mov eax, dword ptr [004B6A68]
:00419DF0 50                      push eax

* Possible Reference to Dialog: DialogID_0129 
                                  |
:00419DF1 6829010000              push 00000129
:00419DF6 8B0D606A4B00            mov ecx, dword ptr [004B6A60]
:00419DFC 51                      push ecx
:00419DFD FF15B0624800            call dword ptr [004862B0]
:00419E03 8B55E8                  mov edx, dword ptr [ebp-18]
:00419E06 89420C                  mov dword ptr [edx+0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419DE2(C)
|
:00419E09 C745F000000000          mov [ebp-10], 00000000
:00419E10 C745F8B8010000          mov [ebp-08], 000001B8
:00419E17 C745EC00000000          mov [ebp-14], 00000000
:00419E1E C745F480020000          mov [ebp-0C], 00000280
:00419E25 E89A000000              call 00419EC4
:00419E2A C745FC00000000          mov [ebp-04], 00000000
:00419E31 EB09                    jmp 00419E3C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419EB0(U)
|
:00419E33 8B45FC                  mov eax, dword ptr [ebp-04]
:00419E36 83C001                  add eax, 00000001
:00419E39 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419E31(U)
|
:00419E3C 837DFC04                cmp dword ptr [ebp-04], 00000004
:00419E40 7370                    jnb 00419EB2
:00419E42 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00419E45 51                      push ecx
:00419E46 83EC10                  sub esp, 00000010
:00419E49 8BD4                    mov edx, esp
:00419E4B 8B45EC                  mov eax, dword ptr [ebp-14]
:00419E4E 8902                    mov dword ptr [edx], eax
:00419E50 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00419E53 894A04                  mov dword ptr [edx+04], ecx
:00419E56 8B45F4                  mov eax, dword ptr [ebp-0C]
:00419E59 894208                  mov dword ptr [edx+08], eax
:00419E5C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00419E5F 894A0C                  mov dword ptr [edx+0C], ecx
:00419E62 8B55E8                  mov edx, dword ptr [ebp-18]
:00419E65 52                      push edx
:00419E66 E8B7000000              call 00419F22
:00419E6B 83C418                  add esp, 00000018
:00419E6E 6A05                    push 00000005
:00419E70 8B45FC                  mov eax, dword ptr [ebp-04]
:00419E73 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00419E76 8B1481                  mov edx, dword ptr [ecx+4*eax]
:00419E79 52                      push edx
:00419E7A FF15E0624800            call dword ptr [004862E0]
:00419E80 6801010000              push 00000101
:00419E85 6A00                    push 00000000
:00419E87 6A00                    push 00000000
:00419E89 8B45FC                  mov eax, dword ptr [ebp-04]
:00419E8C 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00419E8F 8B1481                  mov edx, dword ptr [ecx+4*eax]
:00419E92 52                      push edx
:00419E93 FF15B4624800            call dword ptr [004862B4]
:00419E99 837D0800                cmp dword ptr [ebp+08], 00000000
:00419E9D 7511                    jne 00419EB0
:00419E9F 6A04                    push 00000004
:00419EA1 B9181B4B00              mov ecx, 004B1B18
:00419EA6 E89594FEFF              call 00403340
:00419EAB E830260100              call 0042C4E0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419E9D(C)
|
:00419EB0 EB81                    jmp 00419E33

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419E40(C)
|
:00419EB2 E809CA0500              call 004768C0
:00419EB7 8B45E8                  mov eax, dword ptr [ebp-18]
:00419EBA C6401000                mov [eax+10], 00
:00419EBE 8BE5                    mov esp, ebp
:00419EC0 5D                      pop ebp
:00419EC1 C20400                  ret 0004



* Referenced by a CALL at Address:
|:00419E25   
|
:00419EC4 55                      push ebp
:00419EC5 8BEC                    mov ebp, esp
:00419EC7 6809020000              push 00000209
:00419ECC 6800020000              push 00000200
:00419ED1 E817000000              call 00419EED
:00419ED6 83C408                  add esp, 00000008
:00419ED9 6808010000              push 00000108
:00419EDE 6800010000              push 00000100
:00419EE3 E805000000              call 00419EED
:00419EE8 83C408                  add esp, 00000008
:00419EEB 5D                      pop ebp
:00419EEC C3                      ret



* Referenced by a CALL at Addresses:
|:00419ED1   , :00419EE3   
|
:00419EED 55                      push ebp
:00419EEE 8BEC                    mov ebp, esp
:00419EF0 83EC1C                  sub esp, 0000001C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419F1C(U)
|
:00419EF3 B801000000              mov eax, 00000001
:00419EF8 85C0                    test eax, eax
:00419EFA 7422                    je 00419F1E
:00419EFC 6A01                    push 00000001
:00419EFE 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00419F01 51                      push ecx
:00419F02 8B5508                  mov edx, dword ptr [ebp+08]
:00419F05 52                      push edx
:00419F06 A1686A4B00              mov eax, dword ptr [004B6A68]
:00419F0B 50                      push eax
:00419F0C 8D4DE4                  lea ecx, dword ptr [ebp-1C]
:00419F0F 51                      push ecx
:00419F10 FF15AC624800            call dword ptr [004862AC]
:00419F16 85C0                    test eax, eax
:00419F18 7502                    jne 00419F1C
:00419F1A EB02                    jmp 00419F1E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419F18(C)
|
:00419F1C EBD5                    jmp 00419EF3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00419EFA(C), :00419F1A(U)
|
:00419F1E 8BE5                    mov esp, ebp
:00419F20 5D                      pop ebp
:00419F21 C3                      ret



* Referenced by a CALL at Address:
|:00419E66   
|
:00419F22 55                      push ebp
:00419F23 8BEC                    mov ebp, esp
:00419F25 51                      push ecx
:00419F26 8B451C                  mov eax, dword ptr [ebp+1C]
:00419F29 8945FC                  mov dword ptr [ebp-04], eax
:00419F2C 837DFC03                cmp dword ptr [ebp-04], 00000003
:00419F30 0F8798000000            ja 00419FCE
:00419F36 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00419F39 FF248DD29F4100          jmp dword ptr [4*ecx+00419FD2]
:00419F40 6A01                    push 00000001
:00419F42 6A32                    push 00000032
:00419F44 6A32                    push 00000032
:00419F46 8B5518                  mov edx, dword ptr [ebp+18]
:00419F49 83EA32                  sub edx, 00000032
:00419F4C 52                      push edx
:00419F4D 8B4514                  mov eax, dword ptr [ebp+14]
:00419F50 83E832                  sub eax, 00000032
:00419F53 50                      push eax
:00419F54 8B4D08                  mov ecx, dword ptr [ebp+08]
:00419F57 8B11                    mov edx, dword ptr [ecx]
:00419F59 52                      push edx
:00419F5A FF15BC624800            call dword ptr [004862BC]
:00419F60 EB6C                    jmp 00419FCE
:00419F62 6A01                    push 00000001
:00419F64 6A32                    push 00000032
:00419F66 6A32                    push 00000032
:00419F68 8B4518                  mov eax, dword ptr [ebp+18]
:00419F6B 83E832                  sub eax, 00000032
:00419F6E 50                      push eax
:00419F6F 8B4D14                  mov ecx, dword ptr [ebp+14]
:00419F72 83E964                  sub ecx, 00000064
:00419F75 51                      push ecx
:00419F76 8B5508                  mov edx, dword ptr [ebp+08]
:00419F79 8B4204                  mov eax, dword ptr [edx+04]
:00419F7C 50                      push eax
:00419F7D FF15BC624800            call dword ptr [004862BC]
:00419F83 EB49                    jmp 00419FCE
:00419F85 6A01                    push 00000001
:00419F87 6A32                    push 00000032
:00419F89 6A32                    push 00000032
:00419F8B 8B4D18                  mov ecx, dword ptr [ebp+18]
:00419F8E 83E932                  sub ecx, 00000032
:00419F91 51                      push ecx
:00419F92 8B5514                  mov edx, dword ptr [ebp+14]
:00419F95 81EA96000000            sub edx, 00000096
:00419F9B 52                      push edx
:00419F9C 8B4508                  mov eax, dword ptr [ebp+08]
:00419F9F 8B4808                  mov ecx, dword ptr [eax+08]
:00419FA2 51                      push ecx
:00419FA3 FF15BC624800            call dword ptr [004862BC]
:00419FA9 EB23                    jmp 00419FCE
:00419FAB 6A01                    push 00000001
:00419FAD 6A32                    push 00000032
:00419FAF 6A32                    push 00000032
:00419FB1 8B5518                  mov edx, dword ptr [ebp+18]
:00419FB4 83EA32                  sub edx, 00000032
:00419FB7 52                      push edx
:00419FB8 8B4514                  mov eax, dword ptr [ebp+14]
:00419FBB 2DC8000000              sub eax, 000000C8
:00419FC0 50                      push eax
:00419FC1 8B4D08                  mov ecx, dword ptr [ebp+08]
:00419FC4 8B510C                  mov edx, dword ptr [ecx+0C]
:00419FC7 52                      push edx
:00419FC8 FF15BC624800            call dword ptr [004862BC]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00419F30(C), :00419F60(U), :00419F83(U), :00419FA9(U)
|
:00419FCE 8BE5                    mov esp, ebp
:00419FD0 5D                      pop ebp
:00419FD1 C3                      ret



:00419FD2 409F4100                DWORD 00419F40
:00419FD6 629F4100                DWORD 00419F62
:00419FDA 859F4100                DWORD 00419F85
:00419FDE AB9F4100                DWORD 00419FAB



* Referenced by a CALL at Addresses:
|:00415C38   , :0041A44C   , :0042B637   
|
:00419FE2 55                      push ebp
:00419FE3 8BEC                    mov ebp, esp
:00419FE5 83EC08                  sub esp, 00000008
:00419FE8 894DF8                  mov dword ptr [ebp-08], ecx
:00419FEB C745FC00000000          mov [ebp-04], 00000000
:00419FF2 EB09                    jmp 00419FFD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A022(U)
|
:00419FF4 8B45FC                  mov eax, dword ptr [ebp-04]
:00419FF7 83C001                  add eax, 00000001
:00419FFA 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00419FF2(U)
|
:00419FFD 837DFC04                cmp dword ptr [ebp-04], 00000004
:0041A001 7D21                    jge 0041A024
:0041A003 6A00                    push 00000000
:0041A005 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041A008 8B55F8                  mov edx, dword ptr [ebp-08]
:0041A00B 8B048A                  mov eax, dword ptr [edx+4*ecx]
:0041A00E 50                      push eax
:0041A00F FF15D4624800            call dword ptr [004862D4]
:0041A015 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041A018 8B55F8                  mov edx, dword ptr [ebp-08]
:0041A01B C7048A00000000          mov dword ptr [edx+4*ecx], 00000000
:0041A022 EBD0                    jmp 00419FF4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A001(C)
|
:0041A024 8BE5                    mov esp, ebp
:0041A026 5D                      pop ebp
:0041A027 C3                      ret



* Referenced by a CALL at Addresses:
|:0041968E   , :00419787   , :00419AAA   , :00419BC7   , :00419CE4   
|
:0041A028 55                      push ebp
:0041A029 8BEC                    mov ebp, esp
:0041A02B 51                      push ecx
:0041A02C 894DFC                  mov dword ptr [ebp-04], ecx
:0041A02F 8B45FC                  mov eax, dword ptr [ebp-04]
:0041A032 33C9                    xor ecx, ecx
:0041A034 8A4810                  mov cl, byte ptr [eax+10]
:0041A037 8BD1                    mov edx, ecx
:0041A039 B801000000              mov eax, 00000001
:0041A03E 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041A041 D3E0                    shl eax, cl
:0041A043 23D0                    and edx, eax
:0041A045 85D2                    test edx, edx
:0041A047 7404                    je 0041A04D
:0041A049 33C0                    xor eax, eax
:0041A04B EB05                    jmp 0041A052

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A047(C)
|
:0041A04D B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A04B(U)
|
:0041A052 8BE5                    mov esp, ebp
:0041A054 5D                      pop ebp
:0041A055 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0041A11B   
|
:0041A058 55                      push ebp
:0041A059 8BEC                    mov ebp, esp
:0041A05B 51                      push ecx
:0041A05C 894DFC                  mov dword ptr [ebp-04], ecx
:0041A05F B801000000              mov eax, 00000001
:0041A064 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041A067 D3E0                    shl eax, cl
:0041A069 F7D0                    not eax
:0041A06B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041A06E 8A5110                  mov dl, byte ptr [ecx+10]
:0041A071 22D0                    and dl, al
:0041A073 8B45FC                  mov eax, dword ptr [ebp-04]
:0041A076 885010                  mov byte ptr [eax+10], dl
:0041A079 8BE5                    mov esp, ebp
:0041A07B 5D                      pop ebp
:0041A07C C20400                  ret 0004



* Referenced by a CALL at Address:
|:0041A0E8   
|
:0041A07F 55                      push ebp
:0041A080 8BEC                    mov ebp, esp
:0041A082 51                      push ecx
:0041A083 894DFC                  mov dword ptr [ebp-04], ecx
:0041A086 B801000000              mov eax, 00000001
:0041A08B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041A08E D3E0                    shl eax, cl
:0041A090 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041A093 8A5110                  mov dl, byte ptr [ecx+10]
:0041A096 0AD0                    or dl, al
:0041A098 8B45FC                  mov eax, dword ptr [ebp-04]
:0041A09B 885010                  mov byte ptr [eax+10], dl
:0041A09E 8BE5                    mov esp, ebp
:0041A0A0 5D                      pop ebp
:0041A0A1 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00426B7C   , :00429DB9   , :0042D779   , :0046D9D7   
|
:0041A0A4 55                      push ebp
:0041A0A5 8BEC                    mov ebp, esp
:0041A0A7 51                      push ecx
:0041A0A8 894DFC                  mov dword ptr [ebp-04], ecx
:0041A0AB 8B45FC                  mov eax, dword ptr [ebp-04]
:0041A0AE 833800                  cmp dword ptr [eax], 00000000
:0041A0B1 7507                    jne 0041A0BA
:0041A0B3 B801000000              mov eax, 00000001
:0041A0B8 EB02                    jmp 0041A0BC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A0B1(C)
|
:0041A0BA 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A0B8(U)
|
:0041A0BC 8BE5                    mov esp, ebp
:0041A0BE 5D                      pop ebp
:0041A0BF C3                      ret



* Referenced by a CALL at Addresses:
|:004197A3   , :00419D2E   , :0041A43D   , :00426B9C   , :0042B61A   
|
:0041A0C0 55                      push ebp
:0041A0C1 8BEC                    mov ebp, esp
:0041A0C3 83EC08                  sub esp, 00000008
:0041A0C6 894DF8                  mov dword ptr [ebp-08], ecx
:0041A0C9 C745FC00000000          mov [ebp-04], 00000000
:0041A0D0 EB09                    jmp 0041A0DB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A0ED(U)
|
:0041A0D2 8B45FC                  mov eax, dword ptr [ebp-04]
:0041A0D5 83C001                  add eax, 00000001
:0041A0D8 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A0D0(U)
|
:0041A0DB 837DFC04                cmp dword ptr [ebp-04], 00000004
:0041A0DF 730E                    jnb 0041A0EF
:0041A0E1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041A0E4 51                      push ecx
:0041A0E5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041A0E8 E892FFFFFF              call 0041A07F
:0041A0ED EBE3                    jmp 0041A0D2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A0DF(C)
|
:0041A0EF 8BE5                    mov esp, ebp
:0041A0F1 5D                      pop ebp
:0041A0F2 C3                      ret



* Referenced by a CALL at Address:
|:00426B90   
|
:0041A0F3 55                      push ebp
:0041A0F4 8BEC                    mov ebp, esp
:0041A0F6 83EC08                  sub esp, 00000008
:0041A0F9 894DF8                  mov dword ptr [ebp-08], ecx
:0041A0FC C745FC00000000          mov [ebp-04], 00000000
:0041A103 EB09                    jmp 0041A10E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A120(U)
|
:0041A105 8B45FC                  mov eax, dword ptr [ebp-04]
:0041A108 83C001                  add eax, 00000001
:0041A10B 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A103(U)
|
:0041A10E 837DFC04                cmp dword ptr [ebp-04], 00000004
:0041A112 730E                    jnb 0041A122
:0041A114 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041A117 51                      push ecx
:0041A118 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041A11B E838FFFFFF              call 0041A058
:0041A120 EBE3                    jmp 0041A105

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A112(C)
|
:0041A122 8BE5                    mov esp, ebp
:0041A124 5D                      pop ebp
:0041A125 C3                      ret


:0041A126 CC                      int 03
:0041A127 CC                      int 03
:0041A128 CC                      int 03
:0041A129 CC                      int 03
:0041A12A CC                      int 03
:0041A12B CC                      int 03
:0041A12C CC                      int 03
:0041A12D CC                      int 03
:0041A12E CC                      int 03
:0041A12F CC                      int 03

* Referenced by a CALL at Address:
|:00419587   
|
:0041A130 55                      push ebp
:0041A131 8BEC                    mov ebp, esp
:0041A133 83EC08                  sub esp, 00000008
:0041A136 894DF8                  mov dword ptr [ebp-08], ecx
:0041A139 C745FC00000000          mov [ebp-04], 00000000
:0041A140 EB09                    jmp 0041A14B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A15E(U)
|
:0041A142 8B45FC                  mov eax, dword ptr [ebp-04]
:0041A145 83C001                  add eax, 00000001
:0041A148 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A140(U)
|
:0041A14B 837DFC04                cmp dword ptr [ebp-04], 00000004
:0041A14F 7D0F                    jge 0041A160
:0041A151 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041A154 8B55F8                  mov edx, dword ptr [ebp-08]
:0041A157 C7048A00000000          mov dword ptr [edx+4*ecx], 00000000
:0041A15E EBE2                    jmp 0041A142

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A14F(C)
|
:0041A160 8B45F8                  mov eax, dword ptr [ebp-08]
:0041A163 C6401000                mov [eax+10], 00
:0041A167 8B45F8                  mov eax, dword ptr [ebp-08]
:0041A16A 8BE5                    mov esp, ebp
:0041A16C 5D                      pop ebp
:0041A16D C3                      ret


:0041A16E CC                      int 03
:0041A16F CC                      int 03

* Referenced by a CALL at Addresses:
|:004197F1   , :0041987E   , :0046049C   , :004604CC   , :00468614   
|:0046B140   , :0046B272   , :0046DBC1   , :0046DC49   , :00470EC6   
|:00470EDC   , :0047106F   
|
:0041A170 55                      push ebp
:0041A171 8BEC                    mov ebp, esp
:0041A173 51                      push ecx
:0041A174 894DFC                  mov dword ptr [ebp-04], ecx
:0041A177 8B45FC                  mov eax, dword ptr [ebp-04]
:0041A17A 8B4004                  mov eax, dword ptr [eax+04]
:0041A17D 8BE5                    mov esp, ebp
:0041A17F 5D                      pop ebp
:0041A180 C3                      ret


:0041A181 CC                      int 03
:0041A182 CC                      int 03
:0041A183 CC                      int 03
:0041A184 CC                      int 03
:0041A185 CC                      int 03
:0041A186 CC                      int 03
:0041A187 CC                      int 03
:0041A188 CC                      int 03
:0041A189 CC                      int 03
:0041A18A CC                      int 03
:0041A18B CC                      int 03
:0041A18C CC                      int 03
:0041A18D CC                      int 03
:0041A18E CC                      int 03
:0041A18F CC                      int 03

* Referenced by a CALL at Addresses:
|:00407FAF   , :0040C17F   , :0040C2CF   , :0040C3CD   , :00418629   
|:004186EA   , :00431E92   , :00441839   , :00442810   , :004499AA   
|:004499CE   , :0044CD7D   , :0044ECCC   , :00459DD8   , :00466D90   
|:004676B3   , :00469DE1   , :00476903   , :004784F5   
|
:0041A190 55                      push ebp
:0041A191 8BEC                    mov ebp, esp
:0041A193 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041A196 6BC948                  imul ecx, 00000048
:0041A199 81C1681B4A00            add ecx, 004A1B68
:0041A19F E8DCEBFFFF              call 00418D80
:0041A1A4 25FF000000              and eax, 000000FF
:0041A1A9 F7D8                    neg eax
:0041A1AB 1BC0                    sbb eax, eax
:0041A1AD 40                      inc eax
:0041A1AE 5D                      pop ebp
:0041A1AF C3                      ret



* Referenced by a CALL at Addresses:
|:00407FD9   , :0040B06C   , :004146C3   , :004158EB   , :00416C81   
|
:0041A1B0 55                      push ebp
:0041A1B1 8BEC                    mov ebp, esp
:0041A1B3 6AFF                    push FFFFFFFF
:0041A1B5 6889514800              push 00485189
:0041A1BA 64A100000000            mov eax, dword ptr fs:[00000000]
:0041A1C0 50                      push eax
:0041A1C1 64892500000000          mov dword ptr fs:[00000000], esp
:0041A1C8 83EC74                  sub esp, 00000074
:0041A1CB 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041A1CE E84D91FEFF              call 00403320
:0041A1D3 C745FC00000000          mov [ebp-04], 00000000
:0041A1DA 6A02                    push 00000002

* Possible StringData Ref from Data Obj ->"SVCMN.E5S"
                                  |
:0041A1DC 6810BC4800              push 0048BC10
:0041A1E1 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041A1E4 E873EDFFFF              call 00418F5C
:0041A1E9 894580                  mov dword ptr [ebp-80], eax
:0041A1EC 837D8000                cmp dword ptr [ebp-80], 00000000
:0041A1F0 7550                    jne 0041A242

* Possible StringData Ref from Data Obj ->"SVCMN.E5S"
                                  |
:0041A1F2 6810BC4800              push 0048BC10
:0041A1F7 E8D8ECFFFF              call 00418ED4
:0041A1FC 83C404                  add esp, 00000004
:0041A1FF 50                      push eax
:0041A200 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041A203 E8B3EEFFFF              call 004190BB

* Possible Ref to Menu: APPMENU, Item: ":)"
                                  |
:0041A208 6A6C                    push 0000006C
:0041A20A 6A00                    push 00000000
:0041A20C 8D4584                  lea eax, dword ptr [ebp-7C]
:0041A20F 50                      push eax
:0041A210 E81B690600              call 00480B30
:0041A215 83C40C                  add esp, 0000000C
:0041A218 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041A21B 81E1FF000000            and ecx, 000000FF
:0041A221 8A550C                  mov dl, byte ptr [ebp+0C]
:0041A224 88540D84                mov byte ptr [ebp+ecx-7C], dl

* Possible Ref to Menu: APPMENU, Item: ":)"
                                  |
:0041A228 6A6C                    push 0000006C
:0041A22A 8D4584                  lea eax, dword ptr [ebp-7C]
:0041A22D 50                      push eax
:0041A22E 6A00                    push 00000000
:0041A230 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041A233 E862F0FFFF              call 0041929A
:0041A238 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041A23B E885F0FFFF              call 004192C5
:0041A240 EB25                    jmp 0041A267

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A1F0(C)
|
:0041A242 8A4D0C                  mov cl, byte ptr [ebp+0C]
:0041A245 884D84                  mov byte ptr [ebp-7C], cl
:0041A248 6A01                    push 00000001
:0041A24A 8D5584                  lea edx, dword ptr [ebp-7C]
:0041A24D 52                      push edx
:0041A24E 8B4508                  mov eax, dword ptr [ebp+08]
:0041A251 25FF000000              and eax, 000000FF
:0041A256 50                      push eax
:0041A257 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041A25A E83BF0FFFF              call 0041929A
:0041A25F 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041A262 E85EF0FFFF              call 004192C5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A240(U)
|
:0041A267 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0041A26E 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041A271 E8D3ECFFFF              call 00418F49
:0041A276 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041A279 64890D00000000          mov dword ptr fs:[00000000], ecx
:0041A280 8BE5                    mov esp, ebp
:0041A282 5D                      pop ebp
:0041A283 C3                      ret



* Referenced by a CALL at Addresses:
|:0040B055   , :0040B093   , :0042BEA5   , :00435034   , :00435097   
|:00470675   
|
:0041A284 55                      push ebp
:0041A285 8BEC                    mov ebp, esp
:0041A287 6AFF                    push FFFFFFFF
:0041A289 689C514800              push 0048519C
:0041A28E 64A100000000            mov eax, dword ptr fs:[00000000]
:0041A294 50                      push eax
:0041A295 64892500000000          mov dword ptr fs:[00000000], esp
:0041A29C 83EC78                  sub esp, 00000078
:0041A29F 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041A2A2 E87990FEFF              call 00403320
:0041A2A7 C745FC00000000          mov [ebp-04], 00000000
:0041A2AE 6A02                    push 00000002

* Possible StringData Ref from Data Obj ->"SVCMN.E5S"
                                  |
:0041A2B0 6810BC4800              push 0048BC10
:0041A2B5 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041A2B8 E89FECFFFF              call 00418F5C
:0041A2BD 894580                  mov dword ptr [ebp-80], eax
:0041A2C0 837D8000                cmp dword ptr [ebp-80], 00000000
:0041A2C4 7536                    jne 0041A2FC

* Possible StringData Ref from Data Obj ->"SVCMN.E5S"
                                  |
:0041A2C6 6810BC4800              push 0048BC10
:0041A2CB E804ECFFFF              call 00418ED4
:0041A2D0 83C404                  add esp, 00000004
:0041A2D3 50                      push eax
:0041A2D4 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041A2D7 E8DFEDFFFF              call 004190BB

* Possible Ref to Menu: APPMENU, Item: ":)"
                                  |
:0041A2DC 6A6C                    push 0000006C
:0041A2DE 6A00                    push 00000000
:0041A2E0 8D4584                  lea eax, dword ptr [ebp-7C]
:0041A2E3 50                      push eax
:0041A2E4 E847680600              call 00480B30
:0041A2E9 83C40C                  add esp, 0000000C

* Possible Ref to Menu: APPMENU, Item: ":)"
                                  |
:0041A2EC 6A6C                    push 0000006C
:0041A2EE 8D4D84                  lea ecx, dword ptr [ebp-7C]
:0041A2F1 51                      push ecx
:0041A2F2 6A00                    push 00000000
:0041A2F4 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041A2F7 E89EEFFFFF              call 0041929A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A2C4(C)
|
:0041A2FC 6A01                    push 00000001
:0041A2FE 8D5584                  lea edx, dword ptr [ebp-7C]
:0041A301 52                      push edx
:0041A302 8B4508                  mov eax, dword ptr [ebp+08]
:0041A305 25FF000000              and eax, 000000FF
:0041A30A 50                      push eax
:0041A30B 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041A30E E871EEFFFF              call 00419184
:0041A313 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041A316 E8AAEFFFFF              call 004192C5
:0041A31B 8A4D84                  mov cl, byte ptr [ebp-7C]
:0041A31E 888D7CFFFFFF            mov byte ptr [ebp+FFFFFF7C], cl
:0041A324 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0041A32B 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041A32E E816ECFFFF              call 00418F49
:0041A333 8A857CFFFFFF            mov al, byte ptr [ebp+FFFFFF7C]
:0041A339 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041A33C 64890D00000000          mov dword ptr fs:[00000000], ecx
:0041A343 8BE5                    mov esp, ebp
:0041A345 5D                      pop ebp
:0041A346 C3                      ret



* Referenced by a CALL at Addresses:
|:0041A40C   , :0041BFFA   
|
:0041A347 55                      push ebp
:0041A348 8BEC                    mov ebp, esp
:0041A34A 6AFF                    push FFFFFFFF
:0041A34C 68B2514800              push 004851B2
:0041A351 64A100000000            mov eax, dword ptr fs:[00000000]
:0041A357 50                      push eax
:0041A358 64892500000000          mov dword ptr fs:[00000000], esp
:0041A35F 81EC88020000            sub esp, 00000288
:0041A365 B930694B00              mov ecx, 004B6930
:0041A36A E821200000              call 0041C390
:0041A36F 85C0                    test eax, eax
:0041A371 7404                    je 0041A377
:0041A373 33C0                    xor eax, eax
:0041A375 EB74                    jmp 0041A3EB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A371(C)
|
:0041A377 8D8D74FDFFFF            lea ecx, dword ptr [ebp+FFFFFD74]
:0041A37D E8DE1E0000              call 0041C260
:0041A382 C745FC00000000          mov [ebp-04], 00000000
:0041A389 6A00                    push 00000000
:0041A38B 8D8D74FDFFFF            lea ecx, dword ptr [ebp+FFFFFD74]
:0041A391 E8464C0500              call 0046EFDC
:0041A396 8945F0                  mov dword ptr [ebp-10], eax
:0041A399 837DF000                cmp dword ptr [ebp-10], 00000000
:0041A39D 7C06                    jl 0041A3A5
:0041A39F 837DF00A                cmp dword ptr [ebp-10], 0000000A
:0041A3A3 7C24                    jl 0041A3C9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A39D(C)
|
:0041A3A5 C78570FDFFFF00000000    mov dword ptr [ebp+FFFFFD70], 00000000
:0041A3AF C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0041A3B6 8D8D74FDFFFF            lea ecx, dword ptr [ebp+FFFFFD74]
:0041A3BC E8CF1E0000              call 0041C290
:0041A3C1 8B8570FDFFFF            mov eax, dword ptr [ebp+FFFFFD70]
:0041A3C7 EB22                    jmp 0041A3EB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A3A3(C)
|
:0041A3C9 C7856CFDFFFF01000000    mov dword ptr [ebp+FFFFFD6C], 00000001
:0041A3D3 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0041A3DA 8D8D74FDFFFF            lea ecx, dword ptr [ebp+FFFFFD74]
:0041A3E0 E8AB1E0000              call 0041C290
:0041A3E5 8B856CFDFFFF            mov eax, dword ptr [ebp+FFFFFD6C]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041A375(U), :0041A3C7(U)
|
:0041A3EB 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041A3EE 64890D00000000          mov dword ptr fs:[00000000], ecx
:0041A3F5 8BE5                    mov esp, ebp
:0041A3F7 5D                      pop ebp
:0041A3F8 C3                      ret



* Referenced by a CALL at Address:
|:00474D2B   
|
:0041A3F9 55                      push ebp
:0041A3FA 8BEC                    mov ebp, esp
:0041A3FC 83EC0C                  sub esp, 0000000C
:0041A3FF E80F15FFFF              call 0040B913
:0041A404 25FF000000              and eax, 000000FF
:0041A409 8945FC                  mov dword ptr [ebp-04], eax
:0041A40C E836FFFFFF              call 0041A347
:0041A411 8945F8                  mov dword ptr [ebp-08], eax
:0041A414 837DF800                cmp dword ptr [ebp-08], 00000000
:0041A418 7445                    je 0041A45F
:0041A41A 6A00                    push 00000000
:0041A41C E89BB50500              call 004759BC
:0041A421 83C404                  add esp, 00000004
:0041A424 8B45FC                  mov eax, dword ptr [ebp-04]
:0041A427 8945F4                  mov dword ptr [ebp-0C], eax
:0041A42A 837DF402                cmp dword ptr [ebp-0C], 00000002
:0041A42E 7408                    je 0041A438
:0041A430 837DF403                cmp dword ptr [ebp-0C], 00000003
:0041A434 741D                    je 0041A453
:0041A436 EB27                    jmp 0041A45F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A42E(C)
|
:0041A438 B9386F4900              mov ecx, 00496F38
:0041A43D E87EFCFFFF              call 0041A0C0
:0041A442 E87B410000              call 0041E5C2
:0041A447 B9386F4900              mov ecx, 00496F38
:0041A44C E891FBFFFF              call 00419FE2
:0041A451 EB0C                    jmp 0041A45F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A434(C)
|
:0041A453 6A05                    push 00000005
:0041A455 B9083D4B00              mov ecx, 004B3D08
:0041A45A E8C119FFFF              call 0040BE20

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041A418(C), :0041A436(U), :0041A451(U)
|
:0041A45F 8B45F8                  mov eax, dword ptr [ebp-08]
:0041A462 8BE5                    mov esp, ebp
:0041A464 5D                      pop ebp
:0041A465 C3                      ret



* Referenced by a CALL at Addresses:
|:0044ED87   , :00474D21   
|
:0041A466 55                      push ebp
:0041A467 8BEC                    mov ebp, esp
:0041A469 6AFF                    push FFFFFFFF
:0041A46B 68C8514800              push 004851C8
:0041A470 64A100000000            mov eax, dword ptr fs:[00000000]
:0041A476 50                      push eax
:0041A477 64892500000000          mov dword ptr fs:[00000000], esp
:0041A47E 81EC88020000            sub esp, 00000288
:0041A484 B930694B00              mov ecx, 004B6930
:0041A489 E8021F0000              call 0041C390
:0041A48E 85C0                    test eax, eax
:0041A490 7404                    je 0041A496
:0041A492 33C0                    xor eax, eax
:0041A494 EB74                    jmp 0041A50A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A490(C)
|
:0041A496 8D8D74FDFFFF            lea ecx, dword ptr [ebp+FFFFFD74]
:0041A49C E8BF1D0000              call 0041C260
:0041A4A1 C745FC00000000          mov [ebp-04], 00000000
:0041A4A8 6A01                    push 00000001
:0041A4AA 8D8D74FDFFFF            lea ecx, dword ptr [ebp+FFFFFD74]
:0041A4B0 E8274B0500              call 0046EFDC
:0041A4B5 8945F0                  mov dword ptr [ebp-10], eax
:0041A4B8 837DF000                cmp dword ptr [ebp-10], 00000000
:0041A4BC 7C06                    jl 0041A4C4
:0041A4BE 837DF00A                cmp dword ptr [ebp-10], 0000000A
:0041A4C2 7C24                    jl 0041A4E8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A4BC(C)
|
:0041A4C4 C78570FDFFFF00000000    mov dword ptr [ebp+FFFFFD70], 00000000
:0041A4CE C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0041A4D5 8D8D74FDFFFF            lea ecx, dword ptr [ebp+FFFFFD74]
:0041A4DB E8B01D0000              call 0041C290
:0041A4E0 8B8570FDFFFF            mov eax, dword ptr [ebp+FFFFFD70]
:0041A4E6 EB22                    jmp 0041A50A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A4C2(C)
|
:0041A4E8 C7856CFDFFFF01000000    mov dword ptr [ebp+FFFFFD6C], 00000001
:0041A4F2 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0041A4F9 8D8D74FDFFFF            lea ecx, dword ptr [ebp+FFFFFD74]
:0041A4FF E88C1D0000              call 0041C290
:0041A504 8B856CFDFFFF            mov eax, dword ptr [ebp+FFFFFD6C]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041A494(U), :0041A4E6(U)
|
:0041A50A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041A50D 64890D00000000          mov dword ptr fs:[00000000], ecx
:0041A514 8BE5                    mov esp, ebp
:0041A516 5D                      pop ebp
:0041A517 C3                      ret


:0041A518 55                      push ebp
:0041A519 8BEC                    mov ebp, esp
:0041A51B 6AFF                    push FFFFFFFF
:0041A51D 68DB514800              push 004851DB
:0041A522 64A100000000            mov eax, dword ptr fs:[00000000]
:0041A528 50                      push eax
:0041A529 64892500000000          mov dword ptr fs:[00000000], esp
:0041A530 81ECB8010000            sub esp, 000001B8
:0041A536 898D40FEFFFF            mov dword ptr [ebp+FFFFFE40], ecx
:0041A53C C78544FEFFFF00000000    mov dword ptr [ebp+FFFFFE44], 00000000
:0041A546 C78548FEFFFF01000000    mov dword ptr [ebp+FFFFFE48], 00000001
:0041A550 C7854CFEFFFF02000000    mov dword ptr [ebp+FFFFFE4C], 00000002
:0041A55A 8D8544FEFFFF            lea eax, dword ptr [ebp+FFFFFE44]
:0041A560 50                      push eax
:0041A561 6A03                    push 00000003
:0041A563 8B8D40FEFFFF            mov ecx, dword ptr [ebp+FFFFFE40]
:0041A569 E88D970400              call 00463CFB
:0041A56E C78590FEFFFF0F000000    mov dword ptr [ebp+FFFFFE90], 0000000F
:0041A578 8D4DC0                  lea ecx, dword ptr [ebp-40]
:0041A57B 51                      push ecx
:0041A57C 8B9540FEFFFF            mov edx, dword ptr [ebp+FFFFFE40]
:0041A582 8B4210                  mov eax, dword ptr [edx+10]
:0041A585 50                      push eax
:0041A586 FF15EC624800            call dword ptr [004862EC]
:0041A58C 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0041A58F 2B4DC0                  sub ecx, dword ptr [ebp-40]
:0041A592 898D88FEFFFF            mov dword ptr [ebp+FFFFFE88], ecx
:0041A598 C785B0FEFFFF00000000    mov dword ptr [ebp+FFFFFEB0], 00000000
:0041A5A2 EB0F                    jmp 0041A5B3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A6CF(U)
|
:0041A5A4 8B95B0FEFFFF            mov edx, dword ptr [ebp+FFFFFEB0]
:0041A5AA 83C201                  add edx, 00000001
:0041A5AD 8995B0FEFFFF            mov dword ptr [ebp+FFFFFEB0], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A5A2(U)
|
:0041A5B3 8B8540FEFFFF            mov eax, dword ptr [ebp+FFFFFE40]
:0041A5B9 33C9                    xor ecx, ecx
:0041A5BB 8A4814                  mov cl, byte ptr [eax+14]
:0041A5BE 398DB0FEFFFF            cmp dword ptr [ebp+FFFFFEB0], ecx
:0041A5C4 0F8D0A010000            jnl 0041A6D4
:0041A5CA C7859CFEFFFF48774900    mov dword ptr [ebp+FFFFFE9C], 00497748
:0041A5D4 8B9540FEFFFF            mov edx, dword ptr [ebp+FFFFFE40]
:0041A5DA 8B4218                  mov eax, dword ptr [edx+18]
:0041A5DD 8B8DB0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEB0]
:0041A5E3 8B1488                  mov edx, dword ptr [eax+4*ecx]
:0041A5E6 89953CFEFFFF            mov dword ptr [ebp+FFFFFE3C], edx
:0041A5EC 83BD3CFEFFFF00          cmp dword ptr [ebp+FFFFFE3C], 00000000
:0041A5F3 741B                    je 0041A610
:0041A5F5 83BD3CFEFFFF01          cmp dword ptr [ebp+FFFFFE3C], 00000001
:0041A5FC 7455                    je 0041A653
:0041A5FE 83BD3CFEFFFF02          cmp dword ptr [ebp+FFFFFE3C], 00000002
:0041A605 0F848B000000            je 0041A696
:0041A60B E99C000000              jmp 0041A6AC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A5F3(C)
|
:0041A610 C78594FEFFFF00000000    mov dword ptr [ebp+FFFFFE94], 00000000

* Possible StringData Ref from Data Obj ->"No.99"
                                  |
:0041A61A 6818B54800              push 0048B518
:0041A61F 6A00                    push 00000000
:0041A621 6811100000              push 00001011
:0041A626 8B8540FEFFFF            mov eax, dword ptr [ebp+FFFFFE40]
:0041A62C 8B4810                  mov ecx, dword ptr [eax+10]
:0041A62F 51                      push ecx
:0041A630 FF15F4624800            call dword ptr [004862F4]
:0041A636 83C00C                  add eax, 0000000C
:0041A639 898598FEFFFF            mov dword ptr [ebp+FFFFFE98], eax
:0041A63F 8B9588FEFFFF            mov edx, dword ptr [ebp+FFFFFE88]
:0041A645 2B9598FEFFFF            sub edx, dword ptr [ebp+FFFFFE98]
:0041A64B 899588FEFFFF            mov dword ptr [ebp+FFFFFE88], edx
:0041A651 EB59                    jmp 0041A6AC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A5FC(C)
|
:0041A653 C78594FEFFFF02000000    mov dword ptr [ebp+FFFFFE94], 00000002

* Possible StringData Ref from Data Obj ->"Lv.99"
                                  |
:0041A65D 6820B54800              push 0048B520
:0041A662 6A00                    push 00000000
:0041A664 6811100000              push 00001011
:0041A669 8B8540FEFFFF            mov eax, dword ptr [ebp+FFFFFE40]
:0041A66F 8B4810                  mov ecx, dword ptr [eax+10]
:0041A672 51                      push ecx
:0041A673 FF15F4624800            call dword ptr [004862F4]
:0041A679 83C00C                  add eax, 0000000C
:0041A67C 898598FEFFFF            mov dword ptr [ebp+FFFFFE98], eax
:0041A682 8B9588FEFFFF            mov edx, dword ptr [ebp+FFFFFE88]
:0041A688 2B9598FEFFFF            sub edx, dword ptr [ebp+FFFFFE98]
:0041A68E 899588FEFFFF            mov dword ptr [ebp+FFFFFE88], edx
:0041A694 EB16                    jmp 0041A6AC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A605(C)
|
:0041A696 C78594FEFFFF00000000    mov dword ptr [ebp+FFFFFE94], 00000000
:0041A6A0 8B8588FEFFFF            mov eax, dword ptr [ebp+FFFFFE88]
:0041A6A6 898598FEFFFF            mov dword ptr [ebp+FFFFFE98], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041A60B(U), :0041A651(U), :0041A694(U)
|
:0041A6AC 8D8D90FEFFFF            lea ecx, dword ptr [ebp+FFFFFE90]
:0041A6B2 51                      push ecx
:0041A6B3 8B95B0FEFFFF            mov edx, dword ptr [ebp+FFFFFEB0]
:0041A6B9 52                      push edx
:0041A6BA 681B100000              push 0000101B
:0041A6BF 8B8540FEFFFF            mov eax, dword ptr [ebp+FFFFFE40]
:0041A6C5 8B4810                  mov ecx, dword ptr [eax+10]
:0041A6C8 51                      push ecx
:0041A6C9 FF15F4624800            call dword ptr [004862F4]
:0041A6CF E9D0FEFFFF              jmp 0041A5A4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A5C4(C)
|
:0041A6D4 8D4DD0                  lea ecx, dword ptr [ebp-30]
:0041A6D7 E8448CFEFF              call 00403320
:0041A6DC C745FC00000000          mov [ebp-04], 00000000
:0041A6E3 C78584FEFFFF00000000    mov dword ptr [ebp+FFFFFE84], 00000000
:0041A6ED C785F0FEFFFF00000000    mov dword ptr [ebp+FFFFFEF0], 00000000
:0041A6F7 EB0F                    jmp 0041A708

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A924(U)
|
:0041A6F9 8B95F0FEFFFF            mov edx, dword ptr [ebp+FFFFFEF0]
:0041A6FF 83C201                  add edx, 00000001
:0041A702 8995F0FEFFFF            mov dword ptr [ebp+FFFFFEF0], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A6F7(U)
|
:0041A708 83BDF0FEFFFF0A          cmp dword ptr [ebp+FFFFFEF0], 0000000A
:0041A70F 0F8314020000            jnb 0041A929
:0041A715 C68550FEFFFF00          mov byte ptr [ebp+FFFFFE50], 00
:0041A71C 6A00                    push 00000000
:0041A71E 8B85F0FEFFFF            mov eax, dword ptr [ebp+FFFFFEF0]
:0041A724 50                      push eax
:0041A725 8D4DD4                  lea ecx, dword ptr [ebp-2C]
:0041A728 51                      push ecx
:0041A729 E867020000              call 0041A995
:0041A72E 83C40C                  add esp, 0000000C
:0041A731 6A00                    push 00000000
:0041A733 8D55D4                  lea edx, dword ptr [ebp-2C]
:0041A736 52                      push edx
:0041A737 8D4DD0                  lea ecx, dword ptr [ebp-30]
:0041A73A E81DE8FFFF              call 00418F5C
:0041A73F 6A31                    push 00000031
:0041A741 8D8550FEFFFF            lea eax, dword ptr [ebp+FFFFFE50]
:0041A747 50                      push eax
:0041A748 8D4DD0                  lea ecx, dword ptr [ebp-30]
:0041A74B E817EAFFFF              call 00419167
:0041A750 8D4DD0                  lea ecx, dword ptr [ebp-30]
:0041A753 E86DEBFFFF              call 004192C5
:0041A758 6A02                    push 00000002
:0041A75A 8B8DF0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEF0]
:0041A760 51                      push ecx
:0041A761 8D55D4                  lea edx, dword ptr [ebp-2C]
:0041A764 52                      push edx
:0041A765 E82B020000              call 0041A995
:0041A76A 83C40C                  add esp, 0000000C
:0041A76D 6A00                    push 00000000
:0041A76F 8D45D4                  lea eax, dword ptr [ebp-2C]
:0041A772 50                      push eax
:0041A773 8D4DD0                  lea ecx, dword ptr [ebp-30]
:0041A776 E8E1E7FFFF              call 00418F5C
:0041A77B 6A32                    push 00000032
:0041A77D 8D8DB4FEFFFF            lea ecx, dword ptr [ebp+FFFFFEB4]
:0041A783 51                      push ecx
:0041A784 8D4DD0                  lea ecx, dword ptr [ebp-30]
:0041A787 E8DBE9FFFF              call 00419167
:0041A78C 8D4DD0                  lea ecx, dword ptr [ebp-30]
:0041A78F E831EBFFFF              call 004192C5
:0041A794 8B9550FEFFFF            mov edx, dword ptr [ebp+FFFFFE50]
:0041A79A 81E2FF000000            and edx, 000000FF
:0041A7A0 85D2                    test edx, edx
:0041A7A2 0F8444010000            je 0041A8EC
:0041A7A8 8B8551FEFFFF            mov eax, dword ptr [ebp+FFFFFE51]
:0041A7AE 25FF000000              and eax, 000000FF
:0041A7B3 8B8DF0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEF0]
:0041A7B9 8B9540FEFFFF            mov edx, dword ptr [ebp+FFFFFE40]
:0041A7BF 89448A50                mov dword ptr [edx+4*ecx+50], eax
:0041A7C3 8B8552FEFFFF            mov eax, dword ptr [ebp+FFFFFE52]
:0041A7C9 25FF000000              and eax, 000000FF
:0041A7CE 83F803                  cmp eax, 00000003
:0041A7D1 7573                    jne 0041A846
:0041A7D3 8B8D54FEFFFF            mov ecx, dword ptr [ebp+FFFFFE54]
:0041A7D9 81E1FF000000            and ecx, 000000FF
:0041A7DF 898D8CFEFFFF            mov dword ptr [ebp+FFFFFE8C], ecx
:0041A7E5 83BD8CFEFFFF3A          cmp dword ptr [ebp+FFFFFE8C], 0000003A
:0041A7EC 7316                    jnb 0041A804
:0041A7EE 8B958CFEFFFF            mov edx, dword ptr [ebp+FFFFFE8C]
:0041A7F4 52                      push edx
:0041A7F5 8D85F4FEFFFF            lea eax, dword ptr [ebp+FFFFFEF4]
:0041A7FB 50                      push eax
:0041A7FC E8A317FFFF              call 0040BFA4
:0041A801 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A7EC(C)
|
:0041A804 8B8DB6FEFFFF            mov ecx, dword ptr [ebp+FFFFFEB6]
:0041A80A 81E1FF000000            and ecx, 000000FF
:0041A810 51                      push ecx
:0041A811 8D956BFEFFFF            lea edx, dword ptr [ebp+FFFFFE6B]
:0041A817 52                      push edx
:0041A818 8D8555FEFFFF            lea eax, dword ptr [ebp+FFFFFE55]
:0041A81E 50                      push eax

* Possible StringData Ref from Data Obj ->"%s - %s - (%2dغ)"
                                  |
:0041A81F 6838B54800              push 0048B538
:0041A824 8B8DF0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEF0]
:0041A82A 6BC932                  imul ecx, 00000032
:0041A82D 8B9540FEFFFF            mov edx, dword ptr [ebp+FFFFFE40]
:0041A833 8D440A78                lea eax, dword ptr [edx+ecx+78]
:0041A837 50                      push eax
:0041A838 FF15C0624800            call dword ptr [004862C0]
:0041A83E 83C414                  add esp, 00000014
:0041A841 E9A4000000              jmp 0041A8EA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A7D1(C)
|
:0041A846 8B8D52FEFFFF            mov ecx, dword ptr [ebp+FFFFFE52]
:0041A84C 81E1FF000000            and ecx, 000000FF
:0041A852 83F904                  cmp ecx, 00000004
:0041A855 7563                    jne 0041A8BA
:0041A857 8B9554FEFFFF            mov edx, dword ptr [ebp+FFFFFE54]
:0041A85D 81E2FF000000            and edx, 000000FF
:0041A863 89958CFEFFFF            mov dword ptr [ebp+FFFFFE8C], edx
:0041A869 83BD8CFEFFFF3A          cmp dword ptr [ebp+FFFFFE8C], 0000003A
:0041A870 7316                    jnb 0041A888
:0041A872 8B858CFEFFFF            mov eax, dword ptr [ebp+FFFFFE8C]
:0041A878 50                      push eax
:0041A879 8D8DF4FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF4]
:0041A87F 51                      push ecx
:0041A880 E81F17FFFF              call 0040BFA4
:0041A885 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A870(C)
|
:0041A888 8D956BFEFFFF            lea edx, dword ptr [ebp+FFFFFE6B]
:0041A88E 52                      push edx
:0041A88F 8D8555FEFFFF            lea eax, dword ptr [ebp+FFFFFE55]
:0041A895 50                      push eax

* Possible StringData Ref from Data Obj ->"%s - %s - ս"
                                  |
:0041A896 6850B54800              push 0048B550
:0041A89B 8B8DF0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEF0]
:0041A8A1 6BC932                  imul ecx, 00000032
:0041A8A4 8B9540FEFFFF            mov edx, dword ptr [ebp+FFFFFE40]
:0041A8AA 8D440A78                lea eax, dword ptr [edx+ecx+78]
:0041A8AE 50                      push eax
:0041A8AF FF15C0624800            call dword ptr [004862C0]
:0041A8B5 83C410                  add esp, 00000010
:0041A8B8 EB30                    jmp 0041A8EA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A855(C)
|
:0041A8BA 8D8D6BFEFFFF            lea ecx, dword ptr [ebp+FFFFFE6B]
:0041A8C0 51                      push ecx
:0041A8C1 8D9555FEFFFF            lea edx, dword ptr [ebp+FFFFFE55]
:0041A8C7 52                      push edx

* Possible StringData Ref from Data Obj ->"%s  %s"
                                  |
:0041A8C8 6864B54800              push 0048B564
:0041A8CD 8B85F0FEFFFF            mov eax, dword ptr [ebp+FFFFFEF0]
:0041A8D3 6BC032                  imul eax, 00000032
:0041A8D6 8B8D40FEFFFF            mov ecx, dword ptr [ebp+FFFFFE40]
:0041A8DC 8D540178                lea edx, dword ptr [ecx+eax+78]
:0041A8E0 52                      push edx
:0041A8E1 FF15C0624800            call dword ptr [004862C0]
:0041A8E7 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041A841(U), :0041A8B8(U)
|
:0041A8EA EB38                    jmp 0041A924

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A7A2(C)
|
:0041A8EC 8B85F0FEFFFF            mov eax, dword ptr [ebp+FFFFFEF0]
:0041A8F2 8B8D40FEFFFF            mov ecx, dword ptr [ebp+FFFFFE40]
:0041A8F8 C744815000000000        mov [ecx+4*eax+50], 00000000

* Possible StringData Ref from Data Obj ->"δʹñ"
                                  |
:0041A900 8B1514B54800            mov edx, dword ptr [0048B514]
:0041A906 52                      push edx
:0041A907 8B85F0FEFFFF            mov eax, dword ptr [ebp+FFFFFEF0]
:0041A90D 6BC032                  imul eax, 00000032
:0041A910 8B8D40FEFFFF            mov ecx, dword ptr [ebp+FFFFFE40]
:0041A916 8D540178                lea edx, dword ptr [ecx+eax+78]
:0041A91A 52                      push edx
:0041A91B FF15C0624800            call dword ptr [004862C0]
:0041A921 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A8EA(U)
|
:0041A924 E9D0FDFFFF              jmp 0041A6F9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A70F(C)
|
:0041A929 8B8D40FEFFFF            mov ecx, dword ptr [ebp+FFFFFE40]
:0041A92F E8399A0400              call 0046436D
:0041A934 C785B0FEFFFF00000000    mov dword ptr [ebp+FFFFFEB0], 00000000
:0041A93E EB0F                    jmp 0041A94F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A976(U)
|
:0041A940 8B85B0FEFFFF            mov eax, dword ptr [ebp+FFFFFEB0]
:0041A946 83C001                  add eax, 00000001
:0041A949 8985B0FEFFFF            mov dword ptr [ebp+FFFFFEB0], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A93E(U)
|
:0041A94F 83BDB0FEFFFF0A          cmp dword ptr [ebp+FFFFFEB0], 0000000A
:0041A956 7D20                    jge 0041A978
:0041A958 8B8DB0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEB0]
:0041A95E 51                      push ecx
:0041A95F 8B8D40FEFFFF            mov ecx, dword ptr [ebp+FFFFFE40]
:0041A965 E8561A0000              call 0041C3C0
:0041A96A 50                      push eax
:0041A96B 8B8D40FEFFFF            mov ecx, dword ptr [ebp+FFFFFE40]
:0041A971 E80D940400              call 00463D83
:0041A976 EBC8                    jmp 0041A940

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A956(C)
|
:0041A978 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0041A97F 8D4DD0                  lea ecx, dword ptr [ebp-30]
:0041A982 E8C2E5FFFF              call 00418F49
:0041A987 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041A98A 64890D00000000          mov dword ptr fs:[00000000], ecx
:0041A991 8BE5                    mov esp, ebp
:0041A993 5D                      pop ebp
:0041A994 C3                      ret



* Referenced by a CALL at Addresses:
|:0041A729   , :0041A765   , :0041ADCE   , :0041B03B   , :0041B094   
|:0041B3C3   , :0041B41D   , :0041B443   
|
:0041A995 55                      push ebp
:0041A996 8BEC                    mov ebp, esp
:0041A998 81EC04010000            sub esp, 00000104
:0041A99E 57                      push edi
:0041A99F A16CB54800              mov eax, dword ptr [0048B56C]
:0041A9A4 898500FFFFFF            mov dword ptr [ebp+FFFFFF00], eax
:0041A9AA 8B0D70B54800            mov ecx, dword ptr [0048B570]
:0041A9B0 898D04FFFFFF            mov dword ptr [ebp+FFFFFF04], ecx
:0041A9B6 668B1574B54800          mov dx, word ptr [0048B574]
:0041A9BD 66899508FFFFFF          mov word ptr [ebp+FFFFFF08], dx
:0041A9C4 B93D000000              mov ecx, 0000003D
:0041A9C9 33C0                    xor eax, eax
:0041A9CB 8DBD0AFFFFFF            lea edi, dword ptr [ebp+FFFFFF0A]
:0041A9D1 F3                      repz
:0041A9D2 AB                      stosd
:0041A9D3 66AB                    stosw
:0041A9D5 8B450C                  mov eax, dword ptr [ebp+0C]
:0041A9D8 33D2                    xor edx, edx
:0041A9DA B90A000000              mov ecx, 0000000A
:0041A9DF F7F1                    div ecx
:0041A9E1 83C030                  add eax, 00000030
:0041A9E4 888502FFFFFF            mov byte ptr [ebp+FFFFFF02], al
:0041A9EA 8B450C                  mov eax, dword ptr [ebp+0C]
:0041A9ED 33D2                    xor edx, edx
:0041A9EF B90A000000              mov ecx, 0000000A
:0041A9F4 F7F1                    div ecx
:0041A9F6 83C230                  add edx, 00000030
:0041A9F9 889503FFFFFF            mov byte ptr [ebp+FFFFFF03], dl
:0041A9FF 8B5510                  mov edx, dword ptr [ebp+10]
:0041AA02 8995FCFEFFFF            mov dword ptr [ebp+FFFFFEFC], edx
:0041AA08 83BDFCFEFFFF01          cmp dword ptr [ebp+FFFFFEFC], 00000001
:0041AA0F 740B                    je 0041AA1C
:0041AA11 83BDFCFEFFFF02          cmp dword ptr [ebp+FFFFFEFC], 00000002
:0041AA18 740B                    je 0041AA25
:0041AA1A EB12                    jmp 0041AA2E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AA0F(C)
|
:0041AA1C C68504FFFFFF45          mov byte ptr [ebp+FFFFFF04], 45
:0041AA23 EB10                    jmp 0041AA35

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AA18(C)
|
:0041AA25 C68504FFFFFF53          mov byte ptr [ebp+FFFFFF04], 53
:0041AA2C EB07                    jmp 0041AA35

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AA1A(U)
|
:0041AA2E C68504FFFFFF44          mov byte ptr [ebp+FFFFFF04], 44

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041AA23(U), :0041AA2C(U)
|
:0041AA35 8D8500FFFFFF            lea eax, dword ptr [ebp+FFFFFF00]
:0041AA3B 50                      push eax
:0041AA3C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041AA3F 51                      push ecx
:0041AA40 E838520600              call 0047FC7D
:0041AA45 83C408                  add esp, 00000008
:0041AA48 5F                      pop edi
:0041AA49 8BE5                    mov esp, ebp
:0041AA4B 5D                      pop ebp
:0041AA4C C3                      ret


:0041AA4D 55                      push ebp
:0041AA4E 8BEC                    mov ebp, esp
:0041AA50 81EC10010000            sub esp, 00000110
:0041AA56 898DF8FEFFFF            mov dword ptr [ebp+FFFFFEF8], ecx
:0041AA5C 8B4508                  mov eax, dword ptr [ebp+08]
:0041AA5F 83C01C                  add eax, 0000001C
:0041AA62 8B08                    mov ecx, dword ptr [eax]
:0041AA64 898D1CFFFFFF            mov dword ptr [ebp+FFFFFF1C], ecx
:0041AA6A 8B5004                  mov edx, dword ptr [eax+04]
:0041AA6D 899520FFFFFF            mov dword ptr [ebp+FFFFFF20], edx
:0041AA73 8B4808                  mov ecx, dword ptr [eax+08]
:0041AA76 898D24FFFFFF            mov dword ptr [ebp+FFFFFF24], ecx
:0041AA7C 8B500C                  mov edx, dword ptr [eax+0C]
:0041AA7F 899528FFFFFF            mov dword ptr [ebp+FFFFFF28], edx
:0041AA85 8B4508                  mov eax, dword ptr [ebp+08]
:0041AA88 50                      push eax
:0041AA89 8B8DF8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEF8]
:0041AA8F 8B11                    mov edx, dword ptr [ecx]
:0041AA91 8B8DF8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEF8]
:0041AA97 FF5218                  call [edx+18]
:0041AA9A C785FCFEFFFF01000000    mov dword ptr [ebp+FFFFFEFC], 00000001
:0041AAA4 C745F800000000          mov [ebp-08], 00000000
:0041AAAB EB09                    jmp 0041AAB6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AC7B(U)
|
:0041AAAD 8B45F8                  mov eax, dword ptr [ebp-08]
:0041AAB0 83C001                  add eax, 00000001
:0041AAB3 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AAAB(U)
|
:0041AAB6 8B8DF8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEF8]
:0041AABC 33D2                    xor edx, edx
:0041AABE 8A5114                  mov dl, byte ptr [ecx+14]
:0041AAC1 3955F8                  cmp dword ptr [ebp-08], edx
:0041AAC4 0F8DB6010000            jnl 0041AC80
:0041AACA 8D85FCFEFFFF            lea eax, dword ptr [ebp+FFFFFEFC]
:0041AAD0 50                      push eax
:0041AAD1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041AAD4 51                      push ecx
:0041AAD5 6819100000              push 00001019
:0041AADA 8B95F8FEFFFF            mov edx, dword ptr [ebp+FFFFFEF8]
:0041AAE0 8B4210                  mov eax, dword ptr [edx+10]
:0041AAE3 50                      push eax
:0041AAE4 FF15F4624800            call dword ptr [004862F4]
:0041AAEA C745FC24800000          mov [ebp-04], 00008024
:0041AAF1 8B8D00FFFFFF            mov ecx, dword ptr [ebp+FFFFFF00]
:0041AAF7 83E103                  and ecx, 00000003
:0041AAFA 898DF4FEFFFF            mov dword ptr [ebp+FFFFFEF4], ecx
:0041AB00 83BDF4FEFFFF00          cmp dword ptr [ebp+FFFFFEF4], 00000000
:0041AB07 7414                    je 0041AB1D
:0041AB09 83BDF4FEFFFF01          cmp dword ptr [ebp+FFFFFEF4], 00000001
:0041AB10 7413                    je 0041AB25
:0041AB12 83BDF4FEFFFF02          cmp dword ptr [ebp+FFFFFEF4], 00000002
:0041AB19 7414                    je 0041AB2F
:0041AB1B EB1D                    jmp 0041AB3A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AB07(C)
|
:0041AB1D 8B55FC                  mov edx, dword ptr [ebp-04]
:0041AB20 8955FC                  mov dword ptr [ebp-04], edx
:0041AB23 EB1B                    jmp 0041AB40

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AB10(C)
|
:0041AB25 8B45FC                  mov eax, dword ptr [ebp-04]
:0041AB28 0C02                    or al, 02
:0041AB2A 8945FC                  mov dword ptr [ebp-04], eax
:0041AB2D EB11                    jmp 0041AB40

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AB19(C)
|
:0041AB2F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041AB32 83C901                  or ecx, 00000001
:0041AB35 894DFC                  mov dword ptr [ebp-04], ecx
:0041AB38 EB06                    jmp 0041AB40

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AB1B(U)
|
:0041AB3A 8B55FC                  mov edx, dword ptr [ebp-04]
:0041AB3D 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041AB23(U), :0041AB2D(U), :0041AB38(U)
|
:0041AB40 6A00                    push 00000000
:0041AB42 8B45F8                  mov eax, dword ptr [ebp-08]
:0041AB45 50                      push eax
:0041AB46 681D100000              push 0000101D
:0041AB4B 8B8DF8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEF8]
:0041AB51 8B5110                  mov edx, dword ptr [ecx+10]
:0041AB54 52                      push edx
:0041AB55 FF15F4624800            call dword ptr [004862F4]
:0041AB5B 8B8D1CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF1C]
:0041AB61 8D5401FB                lea edx, dword ptr [ecx+eax-05]
:0041AB65 899524FFFFFF            mov dword ptr [ebp+FFFFFF24], edx
:0041AB6B 8B851CFFFFFF            mov eax, dword ptr [ebp+FFFFFF1C]
:0041AB71 83C005                  add eax, 00000005
:0041AB74 89851CFFFFFF            mov dword ptr [ebp+FFFFFF1C], eax
:0041AB7A 8B8DF8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEF8]
:0041AB80 8B5118                  mov edx, dword ptr [ecx+18]
:0041AB83 8B45F8                  mov eax, dword ptr [ebp-08]
:0041AB86 8B0C82                  mov ecx, dword ptr [edx+4*eax]
:0041AB89 898DF0FEFFFF            mov dword ptr [ebp+FFFFFEF0], ecx
:0041AB8F 83BDF0FEFFFF00          cmp dword ptr [ebp+FFFFFEF0], 00000000
:0041AB96 7417                    je 0041ABAF
:0041AB98 83BDF0FEFFFF01          cmp dword ptr [ebp+FFFFFEF0], 00000001
:0041AB9F 742F                    je 0041ABD0
:0041ABA1 83BDF0FEFFFF02          cmp dword ptr [ebp+FFFFFEF0], 00000002
:0041ABA8 7478                    je 0041AC22
:0041ABAA E99C000000              jmp 0041AC4B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AB96(C)
|
:0041ABAF 8B5508                  mov edx, dword ptr [ebp+08]
:0041ABB2 8B4208                  mov eax, dword ptr [edx+08]
:0041ABB5 83C001                  add eax, 00000001
:0041ABB8 50                      push eax

* Possible StringData Ref from Data Obj ->"No.%2d"
                                  |
:0041ABB9 6878B54800              push 0048B578
:0041ABBE 8D8D2CFFFFFF            lea ecx, dword ptr [ebp+FFFFFF2C]
:0041ABC4 51                      push ecx
:0041ABC5 FF15C0624800            call dword ptr [004862C0]
:0041ABCB 83C40C                  add esp, 0000000C
:0041ABCE EB7B                    jmp 0041AC4B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AB9F(C)
|
:0041ABD0 8B5508                  mov edx, dword ptr [ebp+08]
:0041ABD3 8B4208                  mov eax, dword ptr [edx+08]
:0041ABD6 8B8DF8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEF8]
:0041ABDC 837C815000              cmp dword ptr [ecx+4*eax+50], 00000000
:0041ABE1 7E28                    jle 0041AC0B
:0041ABE3 8B5508                  mov edx, dword ptr [ebp+08]
:0041ABE6 8B4208                  mov eax, dword ptr [edx+08]
:0041ABE9 8B8DF8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEF8]
:0041ABEF 8B548150                mov edx, dword ptr [ecx+4*eax+50]
:0041ABF3 52                      push edx

* Possible StringData Ref from Data Obj ->"Lv.%2d"
                                  |
:0041ABF4 6880B54800              push 0048B580
:0041ABF9 8D852CFFFFFF            lea eax, dword ptr [ebp+FFFFFF2C]
:0041ABFF 50                      push eax
:0041AC00 FF15C0624800            call dword ptr [004862C0]
:0041AC06 83C40C                  add esp, 0000000C
:0041AC09 EB15                    jmp 0041AC20

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041ABE1(C)
|

* Possible StringData Ref from Data Obj ->"--"
                                  |
:0041AC0B 6888B54800              push 0048B588
:0041AC10 8D8D2CFFFFFF            lea ecx, dword ptr [ebp+FFFFFF2C]
:0041AC16 51                      push ecx
:0041AC17 FF15C0624800            call dword ptr [004862C0]
:0041AC1D 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AC09(U)
|
:0041AC20 EB29                    jmp 0041AC4B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041ABA8(C)
|
:0041AC22 8B5508                  mov edx, dword ptr [ebp+08]
:0041AC25 8B4208                  mov eax, dword ptr [edx+08]
:0041AC28 6BC032                  imul eax, 00000032
:0041AC2B 8B8DF8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEF8]
:0041AC31 8D540178                lea edx, dword ptr [ecx+eax+78]
:0041AC35 52                      push edx

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:0041AC36 688CB54800              push 0048B58C
:0041AC3B 8D852CFFFFFF            lea eax, dword ptr [ebp+FFFFFF2C]
:0041AC41 50                      push eax
:0041AC42 FF15C0624800            call dword ptr [004862C0]
:0041AC48 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041ABAA(U), :0041ABCE(U), :0041AC20(U)
|
:0041AC4B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041AC4E 51                      push ecx
:0041AC4F 8D951CFFFFFF            lea edx, dword ptr [ebp+FFFFFF1C]
:0041AC55 52                      push edx
:0041AC56 8D852CFFFFFF            lea eax, dword ptr [ebp+FFFFFF2C]
:0041AC5C 50                      push eax
:0041AC5D 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041AC60 51                      push ecx
:0041AC61 8B8DF8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEF8]
:0041AC67 E8F6A00400              call 00464D62
:0041AC6C 8B9524FFFFFF            mov edx, dword ptr [ebp+FFFFFF24]
:0041AC72 83C205                  add edx, 00000005
:0041AC75 89951CFFFFFF            mov dword ptr [ebp+FFFFFF1C], edx
:0041AC7B E92DFEFFFF              jmp 0041AAAD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AAC4(C)
|
:0041AC80 8BE5                    mov esp, ebp
:0041AC82 5D                      pop ebp
:0041AC83 C20400                  ret 0004


:0041AC86 55                      push ebp
:0041AC87 8BEC                    mov ebp, esp
:0041AC89 51                      push ecx
:0041AC8A 894DFC                  mov dword ptr [ebp-04], ecx
:0041AC8D 8B4508                  mov eax, dword ptr [ebp+08]
:0041AC90 50                      push eax
:0041AC91 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041AC94 8B11                    mov edx, dword ptr [ecx]
:0041AC96 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041AC99 FF5220                  call [edx+20]
:0041AC9C 85C0                    test eax, eax
:0041AC9E 7460                    je 0041AD00
:0041ACA0 8B45FC                  mov eax, dword ptr [ebp-04]
:0041ACA3 83B86C02000000          cmp dword ptr [eax+0000026C], 00000000
:0041ACAA 742B                    je 0041ACD7
:0041ACAC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041ACAF E8DEA60400              call 00465392
:0041ACB4 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041ACB7 51                      push ecx
:0041ACB8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041ACBB E8AA040000              call 0041B16A
:0041ACC0 85C0                    test eax, eax
:0041ACC2 7411                    je 0041ACD5
:0041ACC4 8B5508                  mov edx, dword ptr [ebp+08]
:0041ACC7 52                      push edx
:0041ACC8 8B45FC                  mov eax, dword ptr [ebp-04]
:0041ACCB 8B480C                  mov ecx, dword ptr [eax+0C]
:0041ACCE 51                      push ecx
:0041ACCF FF15D4624800            call dword ptr [004862D4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041ACC2(C)
|
:0041ACD5 EB29                    jmp 0041AD00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041ACAA(C)
|
:0041ACD7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041ACDA E8B3A60400              call 00465392
:0041ACDF 8B5508                  mov edx, dword ptr [ebp+08]
:0041ACE2 52                      push edx
:0041ACE3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041ACE6 E81B000000              call 0041AD06
:0041ACEB 85C0                    test eax, eax
:0041ACED 7411                    je 0041AD00
:0041ACEF 8B4508                  mov eax, dword ptr [ebp+08]
:0041ACF2 50                      push eax
:0041ACF3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041ACF6 8B510C                  mov edx, dword ptr [ecx+0C]
:0041ACF9 52                      push edx
:0041ACFA FF15D4624800            call dword ptr [004862D4]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041AC9E(C), :0041ACD5(U), :0041ACED(C)
|
:0041AD00 8BE5                    mov esp, ebp
:0041AD02 5D                      pop ebp
:0041AD03 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0041ACE6   
|
:0041AD06 55                      push ebp
:0041AD07 8BEC                    mov ebp, esp
:0041AD09 6AFF                    push FFFFFFFF
:0041AD0B 68EE514800              push 004851EE
:0041AD10 64A100000000            mov eax, dword ptr fs:[00000000]
:0041AD16 50                      push eax
:0041AD17 64892500000000          mov dword ptr fs:[00000000], esp
:0041AD1E 81EC38010000            sub esp, 00000138
:0041AD24 898DBCFEFFFF            mov dword ptr [ebp+FFFFFEBC], ecx
:0041AD2A 837D0800                cmp dword ptr [ebp+08], 00000000
:0041AD2E 7C06                    jl 0041AD36
:0041AD30 837D080A                cmp dword ptr [ebp+08], 0000000A
:0041AD34 7C07                    jl 0041AD3D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AD2E(C)
|
:0041AD36 33C0                    xor eax, eax
:0041AD38 E91D040000              jmp 0041B15A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AD34(C)
|
:0041AD3D 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041AD40 E8DB85FEFF              call 00403320
:0041AD45 C745FC00000000          mov [ebp-04], 00000000
:0041AD4C 8B4508                  mov eax, dword ptr [ebp+08]
:0041AD4F 6BC032                  imul eax, 00000032
:0041AD52 8B8DBCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEBC]
:0041AD58 8D540178                lea edx, dword ptr [ecx+eax+78]
:0041AD5C 52                      push edx
:0041AD5D 8B4508                  mov eax, dword ptr [ebp+08]
:0041AD60 83C001                  add eax, 00000001
:0041AD63 50                      push eax

* Possible StringData Ref from Data Obj ->"No.%2d: %s
Զȡ"
                                  |
:0041AD64 6890B54800              push 0048B590
:0041AD69 8D8DE4FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE4]
:0041AD6F 51                      push ecx
:0041AD70 FF15C0624800            call dword ptr [004862C0]
:0041AD76 83C410                  add esp, 00000010
:0041AD79 6A01                    push 00000001

* Possible StringData Ref from Data Obj ->"ȡ"
                                  |
:0041AD7B 68B0B54800              push 0048B5B0
:0041AD80 8D95E4FEFFFF            lea edx, dword ptr [ebp+FFFFFEE4]
:0041AD86 52                      push edx
:0041AD87 8B85BCFEFFFF            mov eax, dword ptr [ebp+FFFFFEBC]
:0041AD8D 8B480C                  mov ecx, dword ptr [eax+0C]
:0041AD90 51                      push ecx
:0041AD91 E8799D0500              call 00474B0F
:0041AD96 83C410                  add esp, 00000010
:0041AD99 85C0                    test eax, eax
:0041AD9B 7524                    jne 0041ADC1
:0041AD9D C785D0FEFFFF00000000    mov dword ptr [ebp+FFFFFED0], 00000000
:0041ADA7 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0041ADAE 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041ADB1 E893E1FFFF              call 00418F49
:0041ADB6 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:0041ADBC E999030000              jmp 0041B15A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AD9B(C)
|
:0041ADC1 6A00                    push 00000000
:0041ADC3 8B5508                  mov edx, dword ptr [ebp+08]
:0041ADC6 52                      push edx
:0041ADC7 8D85E4FEFFFF            lea eax, dword ptr [ebp+FFFFFEE4]
:0041ADCD 50                      push eax
:0041ADCE E8C2FBFFFF              call 0041A995
:0041ADD3 83C40C                  add esp, 0000000C
:0041ADD6 6A00                    push 00000000
:0041ADD8 8D8DE4FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE4]
:0041ADDE 51                      push ecx
:0041ADDF 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041ADE2 E875E1FFFF              call 00418F5C
:0041ADE7 85C0                    test eax, eax
:0041ADE9 7524                    jne 0041AE0F
:0041ADEB C785CCFEFFFF00000000    mov dword ptr [ebp+FFFFFECC], 00000000
:0041ADF5 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0041ADFC 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041ADFF E845E1FFFF              call 00418F49
:0041AE04 8B85CCFEFFFF            mov eax, dword ptr [ebp+FFFFFECC]
:0041AE0A E94B030000              jmp 0041B15A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041ADE9(C)
|
:0041AE0F 6A23                    push 00000023
:0041AE11 8B15606F4900            mov edx, dword ptr [00496F60]
:0041AE17 52                      push edx
:0041AE18 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041AE1B E847E3FFFF              call 00419167
:0041AE20 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041AE23 E89DE4FFFF              call 004192C5
:0041AE28 A1606F4900              mov eax, dword ptr [00496F60]
:0041AE2D 33C9                    xor ecx, ecx
:0041AE2F 8A08                    mov cl, byte ptr [eax]
:0041AE31 85C9                    test ecx, ecx
:0041AE33 7524                    jne 0041AE59
:0041AE35 C785C8FEFFFF00000000    mov dword ptr [ebp+FFFFFEC8], 00000000
:0041AE3F C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0041AE46 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041AE49 E8FBE0FFFF              call 00418F49
:0041AE4E 8B85C8FEFFFF            mov eax, dword ptr [ebp+FFFFFEC8]
:0041AE54 E901030000              jmp 0041B15A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AE33(C)
|
:0041AE59 8B15606F4900            mov edx, dword ptr [00496F60]
:0041AE5F 33C0                    xor eax, eax
:0041AE61 8A02                    mov al, byte ptr [edx]
:0041AE63 83F805                  cmp eax, 00000005
:0041AE66 743F                    je 0041AEA7
:0041AE68 6A01                    push 00000001
:0041AE6A 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"ʹȡ"
                                  |
:0041AE6C 68B8B54800              push 0048B5B8
:0041AE71 8B8DBCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEBC]
:0041AE77 8B510C                  mov edx, dword ptr [ecx+0C]
:0041AE7A 52                      push edx
:0041AE7B E8F89C0500              call 00474B78
:0041AE80 83C410                  add esp, 00000010
:0041AE83 C785C4FEFFFF00000000    mov dword ptr [ebp+FFFFFEC4], 00000000
:0041AE8D C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0041AE94 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041AE97 E8ADE0FFFF              call 00418F49
:0041AE9C 8B85C4FEFFFF            mov eax, dword ptr [ebp+FFFFFEC4]
:0041AEA2 E9B3020000              jmp 0041B15A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AE66(C)
|
:0041AEA7 E886BD0000              call 00426C32
:0041AEAC 6A00                    push 00000000
:0041AEAE 8D85E4FEFFFF            lea eax, dword ptr [ebp+FFFFFEE4]
:0041AEB4 50                      push eax
:0041AEB5 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041AEB8 E89FE0FFFF              call 00418F5C
:0041AEBD 68DC560000              push 000056DC
:0041AEC2 8B0D606F4900            mov ecx, dword ptr [00496F60]
:0041AEC8 51                      push ecx
:0041AEC9 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041AECC E896E2FFFF              call 00419167
:0041AED1 8945E8                  mov dword ptr [ebp-18], eax
:0041AED4 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041AED7 E8E9E3FFFF              call 004192C5
:0041AEDC 6800500000              push 00005000
:0041AEE1 B990F44A00              mov ecx, 004AF490
:0041AEE6 E8A531FFFF              call 0040E090
:0041AEEB 50                      push eax
:0041AEEC 8B15606F4900            mov edx, dword ptr [00496F60]
:0041AEF2 52                      push edx
:0041AEF3 E8054E0600              call 0047FCFD
:0041AEF8 83C40C                  add esp, 0000000C
:0041AEFB A1606F4900              mov eax, dword ptr [00496F60]
:0041AF00 83C005                  add eax, 00000005
:0041AF03 50                      push eax
:0041AF04 6828114A00              push 004A1128
:0041AF09 E86F4D0600              call 0047FC7D
:0041AF0E 83C408                  add esp, 00000008
:0041AF11 8B0D606F4900            mov ecx, dword ptr [00496F60]
:0041AF17 83C11B                  add ecx, 0000001B
:0041AF1A 51                      push ecx
:0041AF1B 6858074B00              push 004B0758
:0041AF20 E8584D0600              call 0047FC7D
:0041AF25 83C408                  add esp, 00000008
:0041AF28 8B15606F4900            mov edx, dword ptr [00496F60]
:0041AF2E 83C232                  add edx, 00000032
:0041AF31 52                      push edx
:0041AF32 B970074B00              mov ecx, 004B0770
:0041AF37 E8291DFFFF              call 0040CC65
:0041AF3C 8945EC                  mov dword ptr [ebp-14], eax
:0041AF3F C785E0FEFFFF00000000    mov dword ptr [ebp+FFFFFEE0], 00000000
:0041AF49 C705E4BA4800FFFF0000    mov dword ptr [0048BAE4], 0000FFFF
:0041AF53 A1606F4900              mov eax, dword ptr [00496F60]
:0041AF58 05DA020000              add eax, 000002DA
:0041AF5D 8945EC                  mov dword ptr [ebp-14], eax
:0041AF60 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041AF63 51                      push ecx
:0041AF64 B93CC64A00              mov ecx, 004AC63C
:0041AF69 E8F22CFFFF              call 0040DC60
:0041AF6E 8B55EC                  mov edx, dword ptr [ebp-14]
:0041AF71 83C202                  add edx, 00000002
:0041AF74 8955EC                  mov dword ptr [ebp-14], edx
:0041AF77 C785DCFEFFFF68CF4900    mov dword ptr [ebp+FFFFFEDC], 0049CF68
:0041AF81 C785D8FEFFFF00000000    mov dword ptr [ebp+FFFFFED8], 00000000
:0041AF8B EB27                    jmp 0041AFB4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AFCF(U)
|
:0041AF8D 8B85D8FEFFFF            mov eax, dword ptr [ebp+FFFFFED8]
:0041AF93 83C001                  add eax, 00000001
:0041AF96 8985D8FEFFFF            mov dword ptr [ebp+FFFFFED8], eax
:0041AF9C 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:0041AFA2 83C140                  add ecx, 00000040
:0041AFA5 898DDCFEFFFF            mov dword ptr [ebp+FFFFFEDC], ecx
:0041AFAB 8B55EC                  mov edx, dword ptr [ebp-14]
:0041AFAE 83C224                  add edx, 00000024
:0041AFB1 8955EC                  mov dword ptr [ebp-14], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AF8B(U)
|
:0041AFB4 81BDD8FEFFFF80000000    cmp dword ptr [ebp+FFFFFED8], 00000080
:0041AFBE 7311                    jnb 0041AFD1
:0041AFC0 8B45EC                  mov eax, dword ptr [ebp-14]
:0041AFC3 50                      push eax
:0041AFC4 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:0041AFCA E8F4F50000              call 0042A5C3
:0041AFCF EBBC                    jmp 0041AF8D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AFBE(C)
|
:0041AFD1 8B0D606F4900            mov ecx, dword ptr [00496F60]
:0041AFD7 81C1DC140000            add ecx, 000014DC
:0041AFDD 894DEC                  mov dword ptr [ebp-14], ecx
:0041AFE0 C785D8FEFFFF00000000    mov dword ptr [ebp+FFFFFED8], 00000000
:0041AFEA EB0F                    jmp 0041AFFB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B022(U)
|
:0041AFEC 8B95D8FEFFFF            mov edx, dword ptr [ebp+FFFFFED8]
:0041AFF2 83C201                  add edx, 00000001
:0041AFF5 8995D8FEFFFF            mov dword ptr [ebp+FFFFFED8], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041AFEA(U)
|
:0041AFFB 81BDD8FEFFFF00020000    cmp dword ptr [ebp+FFFFFED8], 00000200
:0041B005 731D                    jnb 0041B024
:0041B007 8B45EC                  mov eax, dword ptr [ebp-14]
:0041B00A 50                      push eax
:0041B00B 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:0041B011 6BC948                  imul ecx, 00000048
:0041B014 81C1681B4A00            add ecx, 004A1B68
:0041B01A E869E1FEFF              call 00409188
:0041B01F 8945EC                  mov dword ptr [ebp-14], eax
:0041B022 EBC8                    jmp 0041AFEC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B005(C)
|
:0041B024 6A0E                    push 0000000E
:0041B026 E8F0070100              call 0042B81B
:0041B02B 83C404                  add esp, 00000004
:0041B02E 6A01                    push 00000001
:0041B030 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041B033 51                      push ecx
:0041B034 8D95E4FEFFFF            lea edx, dword ptr [ebp+FFFFFEE4]
:0041B03A 52                      push edx
:0041B03B E855F9FFFF              call 0041A995
:0041B040 83C40C                  add esp, 0000000C
:0041B043 8D85E4FEFFFF            lea eax, dword ptr [ebp+FFFFFEE4]
:0041B049 50                      push eax
:0041B04A B9902F4900              mov ecx, 00492F90
:0041B04F E800CAFFFF              call 00417A54
:0041B054 C60594AB4A0001          mov byte ptr [004AAB94], 01
:0041B05B C705C8B4480001000000    mov dword ptr [0048B4C8], 00000001
:0041B065 8B0D9CBF4A00            mov ecx, dword ptr [004ABF9C]
:0041B06B 83C908                  or ecx, 00000008
:0041B06E 890D9CBF4A00            mov dword ptr [004ABF9C], ecx
:0041B074 C7053877490000000000    mov dword ptr [00497738], 00000000
:0041B07E E89F08FFFF              call 0040B922
:0041B083 85C0                    test eax, eax
:0041B085 7479                    je 0041B100
:0041B087 6A02                    push 00000002
:0041B089 8B5508                  mov edx, dword ptr [ebp+08]
:0041B08C 52                      push edx
:0041B08D 8D85E4FEFFFF            lea eax, dword ptr [ebp+FFFFFEE4]
:0041B093 50                      push eax
:0041B094 E8FCF8FFFF              call 0041A995
:0041B099 83C40C                  add esp, 0000000C
:0041B09C 6A02                    push 00000002
:0041B09E 8D8DE4FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE4]
:0041B0A4 51                      push ecx
:0041B0A5 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041B0A8 E8AFDEFFFF              call 00418F5C
:0041B0AD 8985D4FEFFFF            mov dword ptr [ebp+FFFFFED4], eax
:0041B0B3 83BDD4FEFFFF00          cmp dword ptr [ebp+FFFFFED4], 00000000
:0041B0BA 7518                    jne 0041B0D4
:0041B0BC 8D95E4FEFFFF            lea edx, dword ptr [ebp+FFFFFEE4]
:0041B0C2 52                      push edx
:0041B0C3 E80CDEFFFF              call 00418ED4
:0041B0C8 83C404                  add esp, 00000004
:0041B0CB 50                      push eax
:0041B0CC 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041B0CF E8E7DFFFFF              call 004190BB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B0BA(C)
|
:0041B0D4 8D45F0                  lea eax, dword ptr [ebp-10]
:0041B0D7 50                      push eax
:0041B0D8 B9083D4B00              mov ecx, 004B3D08
:0041B0DD E804460300              call 0044F6E6
:0041B0E2 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041B0E5 E8DBE1FFFF              call 004192C5
:0041B0EA C7053877490001000000    mov dword ptr [00497738], 00000001
:0041B0F4 C705ECBA4800FF000000    mov dword ptr [0048BAEC], 000000FF
:0041B0FE EB3B                    jmp 0041B13B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B085(C)
|
:0041B100 B9B8694B00              mov ecx, 004B69B8
:0041B105 E80F950500              call 00474619
:0041B10A B970074B00              mov ecx, 004B0770
:0041B10F E89C110000              call 0041C2B0
:0041B114 25FF000000              and eax, 000000FF
:0041B119 50                      push eax
:0041B11A B9B8694B00              mov ecx, 004B69B8
:0041B11F E8DA940500              call 004745FE
:0041B124 C705ECBA4800FF000000    mov dword ptr [0048BAEC], 000000FF
:0041B12E 6828114A00              push 004A1128
:0041B133 E8D7B30500              call 0047650F
:0041B138 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B0FE(U)
|
:0041B13B C785C0FEFFFF01000000    mov dword ptr [ebp+FFFFFEC0], 00000001
:0041B145 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0041B14C 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041B14F E8F5DDFFFF              call 00418F49
:0041B154 8B85C0FEFFFF            mov eax, dword ptr [ebp+FFFFFEC0]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041AD38(U), :0041ADBC(U), :0041AE0A(U), :0041AE54(U), :0041AEA2(U)
|
:0041B15A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041B15D 64890D00000000          mov dword ptr fs:[00000000], ecx
:0041B164 8BE5                    mov esp, ebp
:0041B166 5D                      pop ebp
:0041B167 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0041ACBB   
|
:0041B16A 55                      push ebp
:0041B16B 8BEC                    mov ebp, esp
:0041B16D 6AFF                    push FFFFFFFF
:0041B16F 6801524800              push 00485201
:0041B174 64A100000000            mov eax, dword ptr fs:[00000000]
:0041B17A 50                      push eax
:0041B17B 64892500000000          mov dword ptr fs:[00000000], esp
:0041B182 81EC2C010000            sub esp, 0000012C
:0041B188 898DC8FEFFFF            mov dword ptr [ebp+FFFFFEC8], ecx
:0041B18E 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041B191 E88A81FEFF              call 00403320
:0041B196 C745FC00000000          mov [ebp-04], 00000000
:0041B19D 8B4508                  mov eax, dword ptr [ebp+08]
:0041B1A0 A33C774900              mov dword ptr [0049773C], eax
:0041B1A5 C7054077490000000000    mov dword ptr [00497740], 00000000
:0041B1AF 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041B1B2 6BC932                  imul ecx, 00000032
:0041B1B5 8B95C8FEFFFF            mov edx, dword ptr [ebp+FFFFFEC8]
:0041B1BB 8D440A78                lea eax, dword ptr [edx+ecx+78]
:0041B1BF 50                      push eax
:0041B1C0 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041B1C3 83C101                  add ecx, 00000001
:0041B1C6 51                      push ecx

* Possible StringData Ref from Data Obj ->"No.%2d: %s
Ա"
                                  |
:0041B1C7 68CCB54800              push 0048B5CC
:0041B1CC 8D95E4FEFFFF            lea edx, dword ptr [ebp+FFFFFEE4]
:0041B1D2 52                      push edx
:0041B1D3 FF15C0624800            call dword ptr [004862C0]
:0041B1D9 83C410                  add esp, 00000010
:0041B1DC 6A01                    push 00000001

* Possible StringData Ref from Data Obj ->""
                                  |
:0041B1DE 68ECB54800              push 0048B5EC
:0041B1E3 8D85E4FEFFFF            lea eax, dword ptr [ebp+FFFFFEE4]
:0041B1E9 50                      push eax
:0041B1EA 8B8DC8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC8]
:0041B1F0 8B510C                  mov edx, dword ptr [ecx+0C]
:0041B1F3 52                      push edx
:0041B1F4 E816990500              call 00474B0F
:0041B1F9 83C410                  add esp, 00000010
:0041B1FC 85C0                    test eax, eax
:0041B1FE 7524                    jne 0041B224
:0041B200 C785D0FEFFFF00000000    mov dword ptr [ebp+FFFFFED0], 00000000
:0041B20A C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0041B211 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041B214 E830DDFFFF              call 00418F49
:0041B219 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:0041B21F E9EA020000              jmp 0041B50E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B1FE(C)
|
:0041B224 6A0E                    push 0000000E
:0041B226 E8F0050100              call 0042B81B
:0041B22B 83C404                  add esp, 00000004
:0041B22E A1606F4900              mov eax, dword ptr [00496F60]
:0041B233 C60005                  mov byte ptr [eax], 05
:0041B236 B9681B4A00              mov ecx, 004A1B68
:0041B23B E890B3FEFF              call 004065D0
:0041B240 8B0D606F4900            mov ecx, dword ptr [00496F60]
:0041B246 884101                  mov byte ptr [ecx+01], al
:0041B249 B93CC64A00              mov ecx, 004AC63C
:0041B24E E85D06FFFF              call 0040B8B0
:0041B253 8B15606F4900            mov edx, dword ptr [00496F60]
:0041B259 884202                  mov byte ptr [edx+02], al
:0041B25C B970074B00              mov ecx, 004B0770
:0041B261 E82920FFFF              call 0040D28F
:0041B266 8B0D606F4900            mov ecx, dword ptr [00496F60]
:0041B26C 884103                  mov byte ptr [ecx+03], al
:0041B26F 8B15606F4900            mov edx, dword ptr [00496F60]
:0041B275 33C0                    xor eax, eax
:0041B277 8A4202                  mov al, byte ptr [edx+02]
:0041B27A 83F803                  cmp eax, 00000003
:0041B27D 7515                    jne 0041B294
:0041B27F B970074B00              mov ecx, 004B0770
:0041B284 E847100000              call 0041C2D0
:0041B289 8B0D606F4900            mov ecx, dword ptr [00496F60]
:0041B28F 884104                  mov byte ptr [ecx+04], al
:0041B292 EB13                    jmp 0041B2A7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B27D(C)
|
:0041B294 B93CC64A00              mov ecx, 004AC63C
:0041B299 E802470300              call 0044F9A0
:0041B29E 8B15606F4900            mov edx, dword ptr [00496F60]
:0041B2A4 884204                  mov byte ptr [edx+04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B292(U)
|
:0041B2A7 6828114A00              push 004A1128
:0041B2AC A1606F4900              mov eax, dword ptr [00496F60]
:0041B2B1 83C005                  add eax, 00000005
:0041B2B4 50                      push eax
:0041B2B5 E8C3490600              call 0047FC7D
:0041B2BA 83C408                  add esp, 00000008
:0041B2BD 6858074B00              push 004B0758
:0041B2C2 8B0D606F4900            mov ecx, dword ptr [00496F60]
:0041B2C8 83C11B                  add ecx, 0000001B
:0041B2CB 51                      push ecx
:0041B2CC E8AC490600              call 0047FC7D
:0041B2D1 83C408                  add esp, 00000008
:0041B2D4 8B15606F4900            mov edx, dword ptr [00496F60]
:0041B2DA 83C232                  add edx, 00000032
:0041B2DD 8955EC                  mov dword ptr [ebp-14], edx
:0041B2E0 8B45EC                  mov eax, dword ptr [ebp-14]
:0041B2E3 50                      push eax
:0041B2E4 B970074B00              mov ecx, 004B0770
:0041B2E9 E87C1CFFFF              call 0040CF6A
:0041B2EE 8945EC                  mov dword ptr [ebp-14], eax
:0041B2F1 8B0D606F4900            mov ecx, dword ptr [00496F60]
:0041B2F7 81C1DA020000            add ecx, 000002DA
:0041B2FD 894DEC                  mov dword ptr [ebp-14], ecx
:0041B300 8B55EC                  mov edx, dword ptr [ebp-14]
:0041B303 52                      push edx
:0041B304 B93CC64A00              mov ecx, 004AC63C
:0041B309 E88929FFFF              call 0040DC97
:0041B30E 8945EC                  mov dword ptr [ebp-14], eax
:0041B311 C785E0FEFFFF68CF4900    mov dword ptr [ebp+FFFFFEE0], 0049CF68
:0041B31B C785D8FEFFFF00000000    mov dword ptr [ebp+FFFFFED8], 00000000
:0041B325 EB1E                    jmp 0041B345

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B363(U)
|
:0041B327 8B85D8FEFFFF            mov eax, dword ptr [ebp+FFFFFED8]
:0041B32D 83C001                  add eax, 00000001
:0041B330 8985D8FEFFFF            mov dword ptr [ebp+FFFFFED8], eax
:0041B336 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:0041B33C 83C140                  add ecx, 00000040
:0041B33F 898DE0FEFFFF            mov dword ptr [ebp+FFFFFEE0], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B325(U)
|
:0041B345 81BDD8FEFFFF80000000    cmp dword ptr [ebp+FFFFFED8], 00000080
:0041B34F 7314                    jnb 0041B365
:0041B351 8B55EC                  mov edx, dword ptr [ebp-14]
:0041B354 52                      push edx
:0041B355 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:0041B35B E806F40000              call 0042A766
:0041B360 8945EC                  mov dword ptr [ebp-14], eax
:0041B363 EBC2                    jmp 0041B327

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B34F(C)
|
:0041B365 A1606F4900              mov eax, dword ptr [00496F60]
:0041B36A 05DC140000              add eax, 000014DC
:0041B36F 8945EC                  mov dword ptr [ebp-14], eax
:0041B372 C785D8FEFFFF00000000    mov dword ptr [ebp+FFFFFED8], 00000000
:0041B37C EB0F                    jmp 0041B38D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B3B4(U)
|
:0041B37E 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:0041B384 83C101                  add ecx, 00000001
:0041B387 898DD8FEFFFF            mov dword ptr [ebp+FFFFFED8], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B37C(U)
|
:0041B38D 81BDD8FEFFFF00020000    cmp dword ptr [ebp+FFFFFED8], 00000200
:0041B397 731D                    jnb 0041B3B6
:0041B399 8B55EC                  mov edx, dword ptr [ebp-14]
:0041B39C 52                      push edx
:0041B39D 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:0041B3A3 6BC948                  imul ecx, 00000048
:0041B3A6 81C1681B4A00            add ecx, 004A1B68
:0041B3AC E87DDBFEFF              call 00408F2E
:0041B3B1 8945EC                  mov dword ptr [ebp-14], eax
:0041B3B4 EBC8                    jmp 0041B37E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B397(C)
|
:0041B3B6 6A00                    push 00000000
:0041B3B8 8B4508                  mov eax, dword ptr [ebp+08]
:0041B3BB 50                      push eax
:0041B3BC 8D8DE4FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE4]
:0041B3C2 51                      push ecx
:0041B3C3 E8CDF5FFFF              call 0041A995
:0041B3C8 83C40C                  add esp, 0000000C
:0041B3CB 6A02                    push 00000002
:0041B3CD 8D95E4FEFFFF            lea edx, dword ptr [ebp+FFFFFEE4]
:0041B3D3 52                      push edx
:0041B3D4 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041B3D7 E880DBFFFF              call 00418F5C
:0041B3DC 8B45EC                  mov eax, dword ptr [ebp-14]
:0041B3DF 2B05606F4900            sub eax, dword ptr [00496F60]
:0041B3E5 8945E8                  mov dword ptr [ebp-18], eax
:0041B3E8 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041B3EB 51                      push ecx
:0041B3EC 8B15606F4900            mov edx, dword ptr [00496F60]
:0041B3F2 52                      push edx
:0041B3F3 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041B3F6 E882DEFFFF              call 0041927D
:0041B3FB 8945E8                  mov dword ptr [ebp-18], eax
:0041B3FE 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041B401 E8BFDEFFFF              call 004192C5
:0041B406 6A0E                    push 0000000E
:0041B408 E80E040100              call 0042B81B
:0041B40D 83C404                  add esp, 00000004
:0041B410 6A01                    push 00000001
:0041B412 8B4508                  mov eax, dword ptr [ebp+08]
:0041B415 50                      push eax
:0041B416 8D8DE4FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE4]
:0041B41C 51                      push ecx
:0041B41D E873F5FFFF              call 0041A995
:0041B422 83C40C                  add esp, 0000000C
:0041B425 8D95E4FEFFFF            lea edx, dword ptr [ebp+FFFFFEE4]
:0041B42B 52                      push edx
:0041B42C B9902F4900              mov ecx, 00492F90
:0041B431 E84EC8FFFF              call 00417C84
:0041B436 6A02                    push 00000002
:0041B438 8B4508                  mov eax, dword ptr [ebp+08]
:0041B43B 50                      push eax
:0041B43C 8D8DE4FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE4]
:0041B442 51                      push ecx
:0041B443 E84DF5FFFF              call 0041A995
:0041B448 83C40C                  add esp, 0000000C
:0041B44B 6A01                    push 00000001
:0041B44D 8D95E4FEFFFF            lea edx, dword ptr [ebp+FFFFFEE4]
:0041B453 52                      push edx
:0041B454 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041B457 E800DBFFFF              call 00418F5C
:0041B45C 8985DCFEFFFF            mov dword ptr [ebp+FFFFFEDC], eax
:0041B462 83BDDCFEFFFF00          cmp dword ptr [ebp+FFFFFEDC], 00000000
:0041B469 7518                    jne 0041B483
:0041B46B 8D85E4FEFFFF            lea eax, dword ptr [ebp+FFFFFEE4]
:0041B471 50                      push eax
:0041B472 E85DDAFFFF              call 00418ED4
:0041B477 83C404                  add esp, 00000004
:0041B47A 50                      push eax
:0041B47B 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041B47E E838DCFFFF              call 004190BB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B469(C)
|
:0041B483 E89A04FFFF              call 0040B922
:0041B488 85C0                    test eax, eax
:0041B48A 7410                    je 0041B49C
:0041B48C 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041B48F 51                      push ecx
:0041B490 B9083D4B00              mov ecx, 004B3D08
:0041B495 E824410300              call 0044F5BE
:0041B49A EB26                    jmp 0041B4C2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B48A(C)
|
:0041B49C B9902F4900              mov ecx, 00492F90
:0041B4A1 E8CA0E0000              call 0041C370
:0041B4A6 8985D4FEFFFF            mov dword ptr [ebp+FFFFFED4], eax
:0041B4AC 6A1E                    push 0000001E
:0041B4AE 8B95D4FEFFFF            mov edx, dword ptr [ebp+FFFFFED4]
:0041B4B4 52                      push edx
:0041B4B5 6A05                    push 00000005
:0041B4B7 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041B4BA E8DBDDFFFF              call 0041929A
:0041B4BF 8945E8                  mov dword ptr [ebp-18], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B49A(U)
|
:0041B4C2 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041B4C5 E8FBDDFFFF              call 004192C5
:0041B4CA 6A00                    push 00000000
:0041B4CC E84A030100              call 0042B81B
:0041B4D1 83C404                  add esp, 00000004
:0041B4D4 6A01                    push 00000001
:0041B4D6 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"ϡ"
                                  |
:0041B4D8 68F4B54800              push 0048B5F4
:0041B4DD 8B85C8FEFFFF            mov eax, dword ptr [ebp+FFFFFEC8]
:0041B4E3 8B480C                  mov ecx, dword ptr [eax+0C]
:0041B4E6 51                      push ecx
:0041B4E7 E88C960500              call 00474B78
:0041B4EC 83C410                  add esp, 00000010
:0041B4EF C785CCFEFFFF01000000    mov dword ptr [ebp+FFFFFECC], 00000001
:0041B4F9 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0041B500 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0041B503 E841DAFFFF              call 00418F49
:0041B508 8B85CCFEFFFF            mov eax, dword ptr [ebp+FFFFFECC]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B21F(U)
|
:0041B50E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041B511 64890D00000000          mov dword ptr fs:[00000000], ecx
:0041B518 8BE5                    mov esp, ebp
:0041B51A 5D                      pop ebp
:0041B51B C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0040C450   , :0041B679   , :0041B6E2   , :0041B742   , :0041B7A2   
|:0041B802   , :0041B862   , :0044CCBA   
|
:0041B51E 55                      push ebp
:0041B51F 8BEC                    mov ebp, esp
:0041B521 6AFF                    push FFFFFFFF
:0041B523 6817524800              push 00485217
:0041B528 64A100000000            mov eax, dword ptr fs:[00000000]
:0041B52E 50                      push eax
:0041B52F 64892500000000          mov dword ptr fs:[00000000], esp
:0041B536 81EC10010000            sub esp, 00000110
:0041B53C 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0041B542 E8697DFEFF              call 004032B0
:0041B547 C745FC00000000          mov [ebp-04], 00000000
:0041B54E 8B4508                  mov eax, dword ptr [ebp+08]
:0041B551 50                      push eax
:0041B552 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0041B558 E8D8450000              call 0041FB35
:0041B55D 85C0                    test eax, eax
:0041B55F 7524                    jne 0041B585
:0041B561 C785ECFEFFFF00000000    mov dword ptr [ebp+FFFFFEEC], 00000000
:0041B56B C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0041B572 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0041B578 E8537DFEFF              call 004032D0
:0041B57D 8B85ECFEFFFF            mov eax, dword ptr [ebp+FFFFFEEC]
:0041B583 EB73                    jmp 0041B5F8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B55F(C)
|
:0041B585 8B4D10                  mov ecx, dword ptr [ebp+10]
:0041B588 51                      push ecx
:0041B589 8B550C                  mov edx, dword ptr [ebp+0C]
:0041B58C 52                      push edx
:0041B58D 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0041B593 E8B80D0000              call 0041C350
:0041B598 85C0                    test eax, eax
:0041B59A 752F                    jne 0041B5CB
:0041B59C 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0041B5A2 E81EDDFFFF              call 004192C5
:0041B5A7 C785E8FEFFFF00000000    mov dword ptr [ebp+FFFFFEE8], 00000000
:0041B5B1 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0041B5B8 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0041B5BE E80D7DFEFF              call 004032D0
:0041B5C3 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:0041B5C9 EB2D                    jmp 0041B5F8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B59A(C)
|
:0041B5CB 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0041B5D1 E8EFDCFFFF              call 004192C5
:0041B5D6 C785E4FEFFFF01000000    mov dword ptr [ebp+FFFFFEE4], 00000001
:0041B5E0 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0041B5E7 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0041B5ED E8DE7CFEFF              call 004032D0
:0041B5F2 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041B583(U), :0041B5C9(U)
|
:0041B5F8 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041B5FB 64890D00000000          mov dword ptr fs:[00000000], ecx
:0041B602 8BE5                    mov esp, ebp
:0041B604 5D                      pop ebp
:0041B605 C3                      ret



* Referenced by a CALL at Addresses:
|:0040C469   , :0044CDCB   , :0044CF35   
|
:0041B606 55                      push ebp
:0041B607 8BEC                    mov ebp, esp
:0041B609 51                      push ecx
:0041B60A 8B450C                  mov eax, dword ptr [ebp+0C]
:0041B60D C1E005                  shl eax, 05
:0041B610 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041B613 03C8                    add ecx, eax
:0041B615 894DFC                  mov dword ptr [ebp-04], ecx
:0041B618 8B5510                  mov edx, dword ptr [ebp+10]
:0041B61B 52                      push edx
:0041B61C 8B45FC                  mov eax, dword ptr [ebp-04]
:0041B61F 50                      push eax
:0041B620 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0041B623 51                      push ecx
:0041B624 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0041B627 6BC948                  imul ecx, 00000048
:0041B62A 81C1681B4A00            add ecx, 004A1B68
:0041B630 E8AED5FEFF              call 00408BE3
:0041B635 8BE5                    mov esp, ebp
:0041B637 5D                      pop ebp
:0041B638 C3                      ret



* Referenced by a CALL at Address:
|:0041BF9B   
|
:0041B639 55                      push ebp
:0041B63A 8BEC                    mov ebp, esp
:0041B63C E825000000              call 0041B666
:0041B641 E889000000              call 0041B6CF
:0041B646 E8E4000000              call 0041B72F
:0041B64B E83F010000              call 0041B78F
:0041B650 E89A010000              call 0041B7EF
:0041B655 B9202E4900              mov ecx, 00492E20
:0041B65A E829FAFEFF              call 0040B088
:0041B65F E8EB010000              call 0041B84F
:0041B664 5D                      pop ebp
:0041B665 C3                      ret



* Referenced by a CALL at Address:
|:0041B63C   
|
:0041B666 55                      push ebp
:0041B667 8BEC                    mov ebp, esp
:0041B669 83EC08                  sub esp, 00000008
:0041B66C A1606F4900              mov eax, dword ptr [00496F60]
:0041B671 50                      push eax
:0041B672 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"DATA.E5"
                                  |
:0041B674 6860BB4800              push 0048BB60
:0041B679 E8A0FEFFFF              call 0041B51E
:0041B67E 83C40C                  add esp, 0000000C
:0041B681 85C0                    test eax, eax
:0041B683 7502                    jne 0041B687
:0041B685 EB44                    jmp 0041B6CB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B683(C)
|
:0041B687 8B0D606F4900            mov ecx, dword ptr [00496F60]
:0041B68D 894DFC                  mov dword ptr [ebp-04], ecx
:0041B690 C745F800000000          mov [ebp-08], 00000000
:0041B697 EB09                    jmp 0041B6A2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B6C9(U)
|
:0041B699 8B55F8                  mov edx, dword ptr [ebp-08]
:0041B69C 83C201                  add edx, 00000001
:0041B69F 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B697(U)
|
:0041B6A2 817DF800020000          cmp dword ptr [ebp-08], 00000200
:0041B6A9 7320                    jnb 0041B6CB
:0041B6AB 6A00                    push 00000000
:0041B6AD 8B45FC                  mov eax, dword ptr [ebp-04]
:0041B6B0 50                      push eax
:0041B6B1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041B6B4 51                      push ecx
:0041B6B5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041B6B8 6BC948                  imul ecx, 00000048
:0041B6BB 81C1681B4A00            add ecx, 004A1B68
:0041B6C1 E81DD5FEFF              call 00408BE3
:0041B6C6 8945FC                  mov dword ptr [ebp-04], eax
:0041B6C9 EBCE                    jmp 0041B699

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041B685(U), :0041B6A9(C)
|
:0041B6CB 8BE5                    mov esp, ebp
:0041B6CD 5D                      pop ebp
:0041B6CE C3                      ret



* Referenced by a CALL at Address:
|:0041B641   
|
:0041B6CF 55                      push ebp
:0041B6D0 8BEC                    mov ebp, esp
:0041B6D2 83EC08                  sub esp, 00000008
:0041B6D5 A1606F4900              mov eax, dword ptr [00496F60]
:0041B6DA 50                      push eax
:0041B6DB 6A01                    push 00000001

* Possible StringData Ref from Data Obj ->"DATA.E5"
                                  |
:0041B6DD 6860BB4800              push 0048BB60
:0041B6E2 E837FEFFFF              call 0041B51E
:0041B6E7 83C40C                  add esp, 0000000C
:0041B6EA 85C0                    test eax, eax
:0041B6EC 7502                    jne 0041B6F0
:0041B6EE EB3B                    jmp 0041B72B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B6EC(C)
|
:0041B6F0 8B0D606F4900            mov ecx, dword ptr [00496F60]
:0041B6F6 894DFC                  mov dword ptr [ebp-04], ecx
:0041B6F9 C745F800000000          mov [ebp-08], 00000000
:0041B700 EB09                    jmp 0041B70B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B729(U)
|
:0041B702 8B55F8                  mov edx, dword ptr [ebp-08]
:0041B705 83C201                  add edx, 00000001
:0041B708 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B700(U)
|
:0041B70B 837DF868                cmp dword ptr [ebp-08], 00000068
:0041B70F 731A                    jnb 0041B72B
:0041B711 8B45FC                  mov eax, dword ptr [ebp-04]
:0041B714 50                      push eax
:0041B715 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041B718 6BC919                  imul ecx, 00000019
:0041B71B 81C140114A00            add ecx, 004A1140
:0041B721 E8110EFFFF              call 0040C537
:0041B726 8945FC                  mov dword ptr [ebp-04], eax
:0041B729 EBD7                    jmp 0041B702

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041B6EE(U), :0041B70F(C)
|
:0041B72B 8BE5                    mov esp, ebp
:0041B72D 5D                      pop ebp
:0041B72E C3                      ret



* Referenced by a CALL at Address:
|:0041B646   
|
:0041B72F 55                      push ebp
:0041B730 8BEC                    mov ebp, esp
:0041B732 83EC08                  sub esp, 00000008
:0041B735 A1606F4900              mov eax, dword ptr [00496F60]
:0041B73A 50                      push eax
:0041B73B 6A03                    push 00000003

* Possible StringData Ref from Data Obj ->"DATA.E5"
                                  |
:0041B73D 6860BB4800              push 0048BB60
:0041B742 E8D7FDFFFF              call 0041B51E
:0041B747 83C40C                  add esp, 0000000C
:0041B74A 85C0                    test eax, eax
:0041B74C 7502                    jne 0041B750
:0041B74E EB3B                    jmp 0041B78B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B74C(C)
|
:0041B750 8B0D606F4900            mov ecx, dword ptr [00496F60]
:0041B756 894DFC                  mov dword ptr [ebp-04], ecx
:0041B759 C745F800000000          mov [ebp-08], 00000000
:0041B760 EB09                    jmp 0041B76B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B789(U)
|
:0041B762 8B55F8                  mov edx, dword ptr [ebp-08]
:0041B765 83C201                  add edx, 00000001
:0041B768 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B760(U)
|
:0041B76B 837DF835                cmp dword ptr [ebp-08], 00000035
:0041B76F 731A                    jnb 0041B78B
:0041B771 8B45FC                  mov eax, dword ptr [ebp-04]
:0041B774 50                      push eax
:0041B775 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041B778 6BC91B                  imul ecx, 0000001B
:0041B77B 81C1A0BF4A00            add ecx, 004ABFA0
:0041B781 E869DCFEFF              call 004093EF
:0041B786 8945FC                  mov dword ptr [ebp-04], eax
:0041B789 EBD7                    jmp 0041B762

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041B74E(U), :0041B76F(C)
|
:0041B78B 8BE5                    mov esp, ebp
:0041B78D 5D                      pop ebp
:0041B78E C3                      ret



* Referenced by a CALL at Address:
|:0041B64B   
|
:0041B78F 55                      push ebp
:0041B790 8BEC                    mov ebp, esp
:0041B792 83EC08                  sub esp, 00000008
:0041B795 A1606F4900              mov eax, dword ptr [00496F60]
:0041B79A 50                      push eax
:0041B79B 6A04                    push 00000004

* Possible StringData Ref from Data Obj ->"DATA.E5"
                                  |
:0041B79D 6860BB4800              push 0048BB60
:0041B7A2 E877FDFFFF              call 0041B51E
:0041B7A7 83C40C                  add esp, 0000000C
:0041B7AA 85C0                    test eax, eax
:0041B7AC 7502                    jne 0041B7B0
:0041B7AE EB3B                    jmp 0041B7EB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B7AC(C)
|
:0041B7B0 8B0D606F4900            mov ecx, dword ptr [00496F60]
:0041B7B6 894DFC                  mov dword ptr [ebp-04], ecx
:0041B7B9 C745F800000000          mov [ebp-08], 00000000
:0041B7C0 EB09                    jmp 0041B7CB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B7E9(U)
|
:0041B7C2 8B55F8                  mov edx, dword ptr [ebp-08]
:0041B7C5 83C201                  add edx, 00000001
:0041B7C8 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B7C0(U)
|
:0041B7CB 837DF81B                cmp dword ptr [ebp-08], 0000001B
:0041B7CF 731A                    jnb 0041B7EB
:0041B7D1 8B45FC                  mov eax, dword ptr [ebp-04]
:0041B7D4 50                      push eax
:0041B7D5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041B7D8 6BC93C                  imul ecx, 0000003C
:0041B7DB 81C1E0E44A00            add ecx, 004AE4E0
:0041B7E1 E8A4DCFEFF              call 0040948A
:0041B7E6 8945FC                  mov dword ptr [ebp-04], eax
:0041B7E9 EBD7                    jmp 0041B7C2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041B7AE(U), :0041B7CF(C)
|
:0041B7EB 8BE5                    mov esp, ebp
:0041B7ED 5D                      pop ebp
:0041B7EE C3                      ret



* Referenced by a CALL at Address:
|:0041B650   
|
:0041B7EF 55                      push ebp
:0041B7F0 8BEC                    mov ebp, esp
:0041B7F2 83EC08                  sub esp, 00000008
:0041B7F5 A1606F4900              mov eax, dword ptr [00496F60]
:0041B7FA 50                      push eax
:0041B7FB 6A02                    push 00000002

* Possible StringData Ref from Data Obj ->"DATA.E5"
                                  |
:0041B7FD 6860BB4800              push 0048BB60
:0041B802 E817FDFFFF              call 0041B51E
:0041B807 83C40C                  add esp, 0000000C
:0041B80A 85C0                    test eax, eax
:0041B80C 7502                    jne 0041B810
:0041B80E EB3B                    jmp 0041B84B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B80C(C)
|
:0041B810 8B0D606F4900            mov ecx, dword ptr [00496F60]
:0041B816 894DFC                  mov dword ptr [ebp-04], ecx
:0041B819 C745F800000000          mov [ebp-08], 00000000
:0041B820 EB09                    jmp 0041B82B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B849(U)
|
:0041B822 8B55F8                  mov edx, dword ptr [ebp-08]
:0041B825 83C201                  add edx, 00000001
:0041B828 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B820(U)
|
:0041B82B 837DF83A                cmp dword ptr [ebp-08], 0000003A
:0041B82F 731A                    jnb 0041B84B
:0041B831 8B45FC                  mov eax, dword ptr [ebp-04]
:0041B834 50                      push eax
:0041B835 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041B838 6BC928                  imul ecx, 00000028
:0041B83B 81C168EB4A00            add ecx, 004AEB68
:0041B841 E88824FFFF              call 0040DCCE
:0041B846 8945FC                  mov dword ptr [ebp-04], eax
:0041B849 EBD7                    jmp 0041B822

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041B80E(U), :0041B82F(C)
|
:0041B84B 8BE5                    mov esp, ebp
:0041B84D 5D                      pop ebp
:0041B84E C3                      ret



* Referenced by a CALL at Address:
|:0041B65F   
|
:0041B84F 55                      push ebp
:0041B850 8BEC                    mov ebp, esp
:0041B852 83EC08                  sub esp, 00000008
:0041B855 A1606F4900              mov eax, dword ptr [00496F60]
:0041B85A 50                      push eax
:0041B85B 6A05                    push 00000005

* Possible StringData Ref from Data Obj ->"DATA.E5"
                                  |
:0041B85D 6860BB4800              push 0048BB60
:0041B862 E8B7FCFFFF              call 0041B51E
:0041B867 83C40C                  add esp, 0000000C
:0041B86A 85C0                    test eax, eax
:0041B86C 7502                    jne 0041B870
:0041B86E EB3B                    jmp 0041B8AB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B86C(C)
|
:0041B870 8B0D606F4900            mov ecx, dword ptr [00496F60]
:0041B876 894DFC                  mov dword ptr [ebp-04], ecx
:0041B879 C745F800000000          mov [ebp-08], 00000000
:0041B880 EB09                    jmp 0041B88B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B8A9(U)
|
:0041B882 8B55F8                  mov edx, dword ptr [ebp-08]
:0041B885 83C201                  add edx, 00000001
:0041B888 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B880(U)
|
:0041B88B 837DF844                cmp dword ptr [ebp-08], 00000044
:0041B88F 731A                    jnb 0041B8AB
:0041B891 8B45FC                  mov eax, dword ptr [ebp-04]
:0041B894 50                      push eax
:0041B895 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041B898 6BC946                  imul ecx, 00000046
:0041B89B 81C1C0F44A00            add ecx, 004AF4C0
:0041B8A1 E80925FFFF              call 0040DDAF
:0041B8A6 8945FC                  mov dword ptr [ebp-04], eax
:0041B8A9 EBD7                    jmp 0041B882

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041B86E(U), :0041B88F(C)
|
:0041B8AB 8BE5                    mov esp, ebp
:0041B8AD 5D                      pop ebp
:0041B8AE C3                      ret



* Referenced by a CALL at Addresses:
|:0041B901   , :0041B99E   , :0041B9EA   
|
:0041B8AF 55                      push ebp
:0041B8B0 8BEC                    mov ebp, esp
:0041B8B2 6A00                    push 00000000
:0041B8B4 6A00                    push 00000000
:0041B8B6 68F0000000              push 000000F0
:0041B8BB 8B4508                  mov eax, dword ptr [ebp+08]
:0041B8BE 50                      push eax
:0041B8BF FF15F4624800            call dword ptr [004862F4]
:0041B8C5 83E801                  sub eax, 00000001
:0041B8C8 F7D8                    neg eax
:0041B8CA 1BC0                    sbb eax, eax
:0041B8CC 40                      inc eax
:0041B8CD 5D                      pop ebp
:0041B8CE C3                      ret



* Referenced by a CALL at Addresses:
|:0041BDFC   , :0041BE52   , :0041BEA8   , :0047A3F5   
|
:0041B8CF 55                      push ebp
:0041B8D0 8BEC                    mov ebp, esp
:0041B8D2 6A00                    push 00000000
:0041B8D4 33C0                    xor eax, eax
:0041B8D6 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0041B8DA 0F95C0                  setne al
:0041B8DD 50                      push eax
:0041B8DE 68F1000000              push 000000F1
:0041B8E3 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041B8E6 51                      push ecx
:0041B8E7 FF15F4624800            call dword ptr [004862F4]
:0041B8ED 5D                      pop ebp
:0041B8EE C3                      ret



* Referenced by a CALL at Address:
|:0041B966   
|
:0041B8EF 55                      push ebp
:0041B8F0 8BEC                    mov ebp, esp
:0041B8F2 8B450C                  mov eax, dword ptr [ebp+0C]
:0041B8F5 50                      push eax
:0041B8F6 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041B8F9 51                      push ecx
:0041B8FA FF15DC624800            call dword ptr [004862DC]
:0041B900 50                      push eax
:0041B901 E8A9FFFFFF              call 0041B8AF
:0041B906 83C404                  add esp, 00000004
:0041B909 85C0                    test eax, eax
:0041B90B 7410                    je 0041B91D
:0041B90D 8B5510                  mov edx, dword ptr [ebp+10]
:0041B910 52                      push edx
:0041B911 B970074B00              mov ecx, 004B0770
:0041B916 E88822FFFF              call 0040DBA3
:0041B91B EB0E                    jmp 0041B92B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B90B(C)
|
:0041B91D 8B4510                  mov eax, dword ptr [ebp+10]
:0041B920 50                      push eax
:0041B921 B970074B00              mov ecx, 004B0770
:0041B926 E89B22FFFF              call 0040DBC6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B91B(U)
|
:0041B92B 5D                      pop ebp
:0041B92C C3                      ret



* Referenced by a CALL at Address:
|:0041BD38   
|
:0041B92D 55                      push ebp
:0041B92E 8BEC                    mov ebp, esp
:0041B930 83EC08                  sub esp, 00000008
:0041B933 56                      push esi
:0041B934 C745F800000000          mov [ebp-08], 00000000
:0041B93B EB09                    jmp 0041B946

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B96E(U)
|
:0041B93D 8B45F8                  mov eax, dword ptr [ebp-08]
:0041B940 83C001                  add eax, 00000001
:0041B943 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B93B(U)
|
:0041B946 837DF805                cmp dword ptr [ebp-08], 00000005
:0041B94A 7324                    jnb 0041B970
:0041B94C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041B94F 8B14CDD4B44800          mov edx, dword ptr [8*ecx+0048B4D4]
:0041B956 52                      push edx
:0041B957 8B45F8                  mov eax, dword ptr [ebp-08]
:0041B95A 8B0CC5D0B44800          mov ecx, dword ptr [8*eax+0048B4D0]
:0041B961 51                      push ecx
:0041B962 8B5508                  mov edx, dword ptr [ebp+08]
:0041B965 52                      push edx
:0041B966 E884FFFFFF              call 0041B8EF
:0041B96B 83C40C                  add esp, 0000000C
:0041B96E EBCD                    jmp 0041B93D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B94A(C)
|
:0041B970 C745F800000000          mov [ebp-08], 00000000
:0041B977 EB09                    jmp 0041B982

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B9BA(U)
|
:0041B979 8B45F8                  mov eax, dword ptr [ebp-08]
:0041B97C 83C001                  add eax, 00000001
:0041B97F 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B977(U)
|
:0041B982 837DF803                cmp dword ptr [ebp-08], 00000003
:0041B986 7334                    jnb 0041B9BC
:0041B988 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041B98B 8B148DF8B44800          mov edx, dword ptr [4*ecx+0048B4F8]
:0041B992 52                      push edx
:0041B993 8B4508                  mov eax, dword ptr [ebp+08]
:0041B996 50                      push eax
:0041B997 FF15DC624800            call dword ptr [004862DC]
:0041B99D 50                      push eax
:0041B99E E80CFFFFFF              call 0041B8AF
:0041B9A3 83C404                  add esp, 00000004
:0041B9A6 85C0                    test eax, eax
:0041B9A8 7410                    je 0041B9BA
:0041B9AA 8A4DF8                  mov cl, byte ptr [ebp-08]
:0041B9AD 51                      push ecx
:0041B9AE B970074B00              mov ecx, 004B0770
:0041B9B3 E838090000              call 0041C2F0
:0041B9B8 EB02                    jmp 0041B9BC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B9A8(C)
|
:0041B9BA EBBD                    jmp 0041B979

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041B986(C), :0041B9B8(U)
|
:0041B9BC C745F800000000          mov [ebp-08], 00000000
:0041B9C3 EB09                    jmp 0041B9CE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BA06(U)
|
:0041B9C5 8B55F8                  mov edx, dword ptr [ebp-08]
:0041B9C8 83C201                  add edx, 00000001
:0041B9CB 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B9C3(U)
|
:0041B9CE 837DF803                cmp dword ptr [ebp-08], 00000003
:0041B9D2 7334                    jnb 0041BA08
:0041B9D4 8B45F8                  mov eax, dword ptr [ebp-08]
:0041B9D7 8B0C8508B54800          mov ecx, dword ptr [4*eax+0048B508]
:0041B9DE 51                      push ecx
:0041B9DF 8B5508                  mov edx, dword ptr [ebp+08]
:0041B9E2 52                      push edx
:0041B9E3 FF15DC624800            call dword ptr [004862DC]
:0041B9E9 50                      push eax
:0041B9EA E8C0FEFFFF              call 0041B8AF
:0041B9EF 83C404                  add esp, 00000004
:0041B9F2 85C0                    test eax, eax
:0041B9F4 7410                    je 0041BA06
:0041B9F6 8A45F8                  mov al, byte ptr [ebp-08]
:0041B9F9 50                      push eax
:0041B9FA B970074B00              mov ecx, 004B0770
:0041B9FF E83C770200              call 00443140
:0041BA04 EB02                    jmp 0041BA08

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041B9F4(C)
|
:0041BA06 EBBD                    jmp 0041B9C5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041B9D2(C), :0041BA04(U)
|
:0041BA08 B970074B00              mov ecx, 004B0770
:0041BA0D E8FEEE0000              call 0042A910
:0041BA12 2500100000              and eax, 00001000
:0041BA17 85C0                    test eax, eax
:0041BA19 750A                    jne 0041BA25
:0041BA1B B9B0694B00              mov ecx, 004B69B0
:0041BA20 E82D8C0500              call 00474652

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BA19(C)
|
:0041BA25 B970074B00              mov ecx, 004B0770
:0041BA2A E8E1EE0000              call 0042A910
:0041BA2F 2500200000              and eax, 00002000
:0041BA34 85C0                    test eax, eax
:0041BA36 750A                    jne 0041BA42
:0041BA38 B9B8694B00              mov ecx, 004B69B8
:0041BA3D E8D78B0500              call 00474619

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BA36(C)
|
:0041BA42 B970074B00              mov ecx, 004B0770
:0041BA47 E864080000              call 0041C2B0
:0041BA4C 25FF000000              and eax, 000000FF
:0041BA51 50                      push eax
:0041BA52 B9B8694B00              mov ecx, 004B69B8
:0041BA57 E8A28B0500              call 004745FE
:0041BA5C 6A00                    push 00000000
:0041BA5E 6A00                    push 00000000

* Possible Reference to Dialog: DialogID_0147 
                                  |
:0041BA60 6847010000              push 00000147
:0041BA65 68D0050000              push 000005D0
:0041BA6A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041BA6D 51                      push ecx
:0041BA6E FF15DC624800            call dword ptr [004862DC]
:0041BA74 50                      push eax
:0041BA75 FF15F4624800            call dword ptr [004862F4]
:0041BA7B 8845FC                  mov byte ptr [ebp-04], al
:0041BA7E 8B75FC                  mov esi, dword ptr [ebp-04]
:0041BA81 81E6FF000000            and esi, 000000FF
:0041BA87 B9202E4900              mov ecx, 00492E20
:0041BA8C E81FFEFEFF              call 0040B8B0
:0041BA91 25FF000000              and eax, 000000FF
:0041BA96 3BF0                    cmp esi, eax
:0041BA98 743E                    je 0041BAD8
:0041BA9A 6A01                    push 00000001
:0041BA9C 8A55FC                  mov dl, byte ptr [ebp-04]
:0041BA9F 52                      push edx
:0041BAA0 B9202E4900              mov ecx, 00492E20
:0041BAA5 E8CDF4FEFF              call 0040AF77
:0041BAAA A108754B00              mov eax, dword ptr [004B7508]
:0041BAAF 50                      push eax
:0041BAB0 FF15C8624800            call dword ptr [004862C8]
:0041BAB6 85C0                    test eax, eax
:0041BAB8 741E                    je 0041BAD8
:0041BABA 6A01                    push 00000001
:0041BABC 6A00                    push 00000000
:0041BABE 8B0D08754B00            mov ecx, dword ptr [004B7508]
:0041BAC4 51                      push ecx
:0041BAC5 FF15A4624800            call dword ptr [004862A4]
:0041BACB 8B1508754B00            mov edx, dword ptr [004B7508]
:0041BAD1 52                      push edx
:0041BAD2 FF15A8624800            call dword ptr [004862A8]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041BA98(C), :0041BAB8(C)
|
:0041BAD8 5E                      pop esi
:0041BAD9 8BE5                    mov esp, ebp
:0041BADB 5D                      pop ebp
:0041BADC C3                      ret


:0041BADD 55                      push ebp
:0041BADE 8BEC                    mov ebp, esp
:0041BAE0 83EC0C                  sub esp, 0000000C
:0041BAE3 8B450C                  mov eax, dword ptr [ebp+0C]
:0041BAE6 8945F4                  mov dword ptr [ebp-0C], eax
:0041BAE9 817DF410010000          cmp dword ptr [ebp-0C], 00000110
:0041BAF0 7718                    ja 0041BB0A
:0041BAF2 817DF410010000          cmp dword ptr [ebp-0C], 00000110
:0041BAF9 747A                    je 0041BB75
:0041BAFB 837DF42B                cmp dword ptr [ebp-0C], 0000002B
:0041BAFF 0F84C8010000            je 0041BCCD
:0041BB05 E99B020000              jmp 0041BDA5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BAF0(C)
|
:0041BB0A 817DF435010000          cmp dword ptr [ebp-0C], 00000135
:0041BB11 771F                    ja 0041BB32
:0041BB13 817DF435010000          cmp dword ptr [ebp-0C], 00000135
:0041BB1A 0F84C9000000            je 0041BBE9
:0041BB20 817DF411010000          cmp dword ptr [ebp-0C], 00000111
:0041BB27 0F84FA010000            je 0041BD27
:0041BB2D E973020000              jmp 0041BDA5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BB11(C)
|
:0041BB32 817DF40F030000          cmp dword ptr [ebp-0C], 0000030F
:0041BB39 7728                    ja 0041BB63
:0041BB3B 817DF40F030000          cmp dword ptr [ebp-0C], 0000030F
:0041BB42 0F845F010000            je 0041BCA7
:0041BB48 817DF436010000          cmp dword ptr [ebp-0C], 00000136
:0041BB4F 0F84F4000000            je 0041BC49
:0041BB55 817DF438010000          cmp dword ptr [ebp-0C], 00000138
:0041BB5C 742D                    je 0041BB8B
:0041BB5E E942020000              jmp 0041BDA5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BB39(C)
|
:0041BB63 817DF411030000          cmp dword ptr [ebp-0C], 00000311
:0041BB6A 0F8448010000            je 0041BCB8
:0041BB70 E930020000              jmp 0041BDA5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BAF9(C)
|
:0041BB75 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041BB78 51                      push ecx
:0041BB79 E833020000              call 0041BDB1
:0041BB7E 83C404                  add esp, 00000004
:0041BB81 B801000000              mov eax, 00000001
:0041BB86 E920020000              jmp 0041BDAB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BB5C(C)
|
:0041BB8B 6A00                    push 00000000
:0041BB8D 6A00                    push 00000000

* Possible Reference to Dialog: DialogID_0147 
                                  |
:0041BB8F 6847010000              push 00000147
:0041BB94 68D0050000              push 000005D0
:0041BB99 8B5508                  mov edx, dword ptr [ebp+08]
:0041BB9C 52                      push edx
:0041BB9D FF15DC624800            call dword ptr [004862DC]
:0041BBA3 50                      push eax
:0041BBA4 FF15F4624800            call dword ptr [004862F4]
:0041BBAA 8845F8                  mov byte ptr [ebp-08], al
:0041BBAD 6A00                    push 00000000
:0041BBAF 8A45F8                  mov al, byte ptr [ebp-08]
:0041BBB2 50                      push eax
:0041BBB3 B9202E4900              mov ecx, 00492E20
:0041BBB8 E8BAF3FEFF              call 0040AF77
:0041BBBD 8845FC                  mov byte ptr [ebp-04], al
:0041BBC0 6A00                    push 00000000
:0041BBC2 6A01                    push 00000001
:0041BBC4 8B4D14                  mov ecx, dword ptr [ebp+14]
:0041BBC7 51                      push ecx
:0041BBC8 8B5510                  mov edx, dword ptr [ebp+10]
:0041BBCB 52                      push edx
:0041BBCC E8BA590500              call 0047158B
:0041BBD1 83C410                  add esp, 00000010
:0041BBD4 6A00                    push 00000000
:0041BBD6 8A45FC                  mov al, byte ptr [ebp-04]
:0041BBD9 50                      push eax
:0041BBDA B9202E4900              mov ecx, 00492E20
:0041BBDF E893F3FEFF              call 0040AF77
:0041BBE4 E9C0010000              jmp 0041BDA9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BB1A(C)
|
:0041BBE9 6A00                    push 00000000
:0041BBEB 6A00                    push 00000000

* Possible Reference to Dialog: DialogID_0147 
                                  |
:0041BBED 6847010000              push 00000147
:0041BBF2 68D0050000              push 000005D0
:0041BBF7 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041BBFA 51                      push ecx
:0041BBFB FF15DC624800            call dword ptr [004862DC]
:0041BC01 50                      push eax
:0041BC02 FF15F4624800            call dword ptr [004862F4]
:0041BC08 8845F8                  mov byte ptr [ebp-08], al
:0041BC0B 6A00                    push 00000000
:0041BC0D 8A55F8                  mov dl, byte ptr [ebp-08]
:0041BC10 52                      push edx
:0041BC11 B9202E4900              mov ecx, 00492E20
:0041BC16 E85CF3FEFF              call 0040AF77
:0041BC1B 8845FC                  mov byte ptr [ebp-04], al
:0041BC1E 6A00                    push 00000000
:0041BC20 6A00                    push 00000000
:0041BC22 6A01                    push 00000001
:0041BC24 8B4514                  mov eax, dword ptr [ebp+14]
:0041BC27 50                      push eax
:0041BC28 8B4D10                  mov ecx, dword ptr [ebp+10]
:0041BC2B 51                      push ecx
:0041BC2C E8505D0500              call 00471981
:0041BC31 83C414                  add esp, 00000014
:0041BC34 6A00                    push 00000000
:0041BC36 8A55FC                  mov dl, byte ptr [ebp-04]
:0041BC39 52                      push edx
:0041BC3A B9202E4900              mov ecx, 00492E20
:0041BC3F E833F3FEFF              call 0040AF77
:0041BC44 E960010000              jmp 0041BDA9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BB4F(C)
|
:0041BC49 6A00                    push 00000000
:0041BC4B 6A00                    push 00000000

* Possible Reference to Dialog: DialogID_0147 
                                  |
:0041BC4D 6847010000              push 00000147
:0041BC52 68D0050000              push 000005D0
:0041BC57 8B4508                  mov eax, dword ptr [ebp+08]
:0041BC5A 50                      push eax
:0041BC5B FF15DC624800            call dword ptr [004862DC]
:0041BC61 50                      push eax
:0041BC62 FF15F4624800            call dword ptr [004862F4]
:0041BC68 8845F8                  mov byte ptr [ebp-08], al
:0041BC6B 6A00                    push 00000000
:0041BC6D 8A4DF8                  mov cl, byte ptr [ebp-08]
:0041BC70 51                      push ecx
:0041BC71 B9202E4900              mov ecx, 00492E20
:0041BC76 E8FCF2FEFF              call 0040AF77
:0041BC7B 8845FC                  mov byte ptr [ebp-04], al
:0041BC7E 6A00                    push 00000000
:0041BC80 6A01                    push 00000001
:0041BC82 8B5514                  mov edx, dword ptr [ebp+14]
:0041BC85 52                      push edx
:0041BC86 8B4510                  mov eax, dword ptr [ebp+10]
:0041BC89 50                      push eax
:0041BC8A E8FC550500              call 0047128B
:0041BC8F 83C410                  add esp, 00000010
:0041BC92 6A00                    push 00000000
:0041BC94 8A4DFC                  mov cl, byte ptr [ebp-04]
:0041BC97 51                      push ecx
:0041BC98 B9202E4900              mov ecx, 00492E20
:0041BC9D E8D5F2FEFF              call 0040AF77
:0041BCA2 E902010000              jmp 0041BDA9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BB42(C)
|
:0041BCA7 8B5508                  mov edx, dword ptr [ebp+08]
:0041BCAA 52                      push edx
:0041BCAB E87B680500              call 0047252B
:0041BCB0 83C404                  add esp, 00000004
:0041BCB3 E9F1000000              jmp 0041BDA9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BB6A(C)
|
:0041BCB8 8B4510                  mov eax, dword ptr [ebp+10]
:0041BCBB 50                      push eax
:0041BCBC 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041BCBF 51                      push ecx
:0041BCC0 E8B9680500              call 0047257E
:0041BCC5 83C408                  add esp, 00000008
:0041BCC8 E9DC000000              jmp 0041BDA9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BAFF(C)
|
:0041BCCD 6A00                    push 00000000
:0041BCCF 6A00                    push 00000000

* Possible Reference to Dialog: DialogID_0147 
                                  |
:0041BCD1 6847010000              push 00000147
:0041BCD6 68D0050000              push 000005D0
:0041BCDB 8B5508                  mov edx, dword ptr [ebp+08]
:0041BCDE 52                      push edx
:0041BCDF FF15DC624800            call dword ptr [004862DC]
:0041BCE5 50                      push eax
:0041BCE6 FF15F4624800            call dword ptr [004862F4]
:0041BCEC 8845F8                  mov byte ptr [ebp-08], al
:0041BCEF 6A00                    push 00000000
:0041BCF1 8A45F8                  mov al, byte ptr [ebp-08]
:0041BCF4 50                      push eax
:0041BCF5 B9202E4900              mov ecx, 00492E20
:0041BCFA E878F2FEFF              call 0040AF77
:0041BCFF 8845FC                  mov byte ptr [ebp-04], al
:0041BD02 6A00                    push 00000000
:0041BD04 6A01                    push 00000001
:0041BD06 8B4D14                  mov ecx, dword ptr [ebp+14]
:0041BD09 51                      push ecx
:0041BD0A E8CF620500              call 00471FDE
:0041BD0F 83C40C                  add esp, 0000000C
:0041BD12 6A00                    push 00000000
:0041BD14 8A55FC                  mov dl, byte ptr [ebp-04]
:0041BD17 52                      push edx
:0041BD18 B9202E4900              mov ecx, 00492E20
:0041BD1D E855F2FEFF              call 0040AF77
:0041BD22 E982000000              jmp 0041BDA9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BB27(C)
|
:0041BD27 8B4510                  mov eax, dword ptr [ebp+10]
:0041BD2A 25FFFF0000              and eax, 0000FFFF
:0041BD2F 83F801                  cmp eax, 00000001
:0041BD32 7518                    jne 0041BD4C
:0041BD34 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041BD37 51                      push ecx
:0041BD38 E8F0FBFFFF              call 0041B92D
:0041BD3D 83C404                  add esp, 00000004
:0041BD40 6A01                    push 00000001
:0041BD42 8B5508                  mov edx, dword ptr [ebp+08]
:0041BD45 52                      push edx
:0041BD46 FF15D4624800            call dword ptr [004862D4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BD32(C)
|
:0041BD4C 8B4510                  mov eax, dword ptr [ebp+10]
:0041BD4F 25FFFF0000              and eax, 0000FFFF
:0041BD54 83F802                  cmp eax, 00000002
:0041BD57 750C                    jne 0041BD65
:0041BD59 6A01                    push 00000001
:0041BD5B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041BD5E 51                      push ecx
:0041BD5F FF15D4624800            call dword ptr [004862D4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BD57(C)
|
:0041BD65 8B5510                  mov edx, dword ptr [ebp+10]
:0041BD68 81E2FFFF0000            and edx, 0000FFFF
:0041BD6E 81FAD0050000            cmp edx, 000005D0
:0041BD74 752D                    jne 0041BDA3
:0041BD76 8B4510                  mov eax, dword ptr [ebp+10]
:0041BD79 C1E810                  shr eax, 10
:0041BD7C 25FFFF0000              and eax, 0000FFFF
:0041BD81 25FFFF0000              and eax, 0000FFFF
:0041BD86 83F809                  cmp eax, 00000009
:0041BD89 7518                    jne 0041BDA3
:0041BD8B 6A01                    push 00000001
:0041BD8D 6A00                    push 00000000
:0041BD8F 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041BD92 51                      push ecx
:0041BD93 FF15A4624800            call dword ptr [004862A4]
:0041BD99 8B5508                  mov edx, dword ptr [ebp+08]
:0041BD9C 52                      push edx
:0041BD9D FF15A8624800            call dword ptr [004862A8]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041BD74(C), :0041BD89(C)
|
:0041BDA3 EB04                    jmp 0041BDA9

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041BB05(U), :0041BB2D(U), :0041BB5E(U), :0041BB70(U)
|
:0041BDA5 33C0                    xor eax, eax
:0041BDA7 EB02                    jmp 0041BDAB

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041BBE4(U), :0041BC44(U), :0041BCA2(U), :0041BCB3(U), :0041BCC8(U)
|:0041BD22(U), :0041BDA3(U)
|
:0041BDA9 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041BB86(U), :0041BDA7(U)
|
:0041BDAB 8BE5                    mov esp, ebp
:0041BDAD 5D                      pop ebp
:0041BDAE C21000                  ret 0010



* Referenced by a CALL at Address:
|:0041BB79   
|
:0041BDB1 55                      push ebp
:0041BDB2 8BEC                    mov ebp, esp
:0041BDB4 83EC14                  sub esp, 00000014
:0041BDB7 56                      push esi
:0041BDB8 C745EC00000000          mov [ebp-14], 00000000
:0041BDBF EB09                    jmp 0041BDCA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BE04(U)
|
:0041BDC1 8B45EC                  mov eax, dword ptr [ebp-14]
:0041BDC4 83C001                  add eax, 00000001
:0041BDC7 8945EC                  mov dword ptr [ebp-14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BDBF(U)
|
:0041BDCA 837DEC05                cmp dword ptr [ebp-14], 00000005
:0041BDCE 7336                    jnb 0041BE06
:0041BDD0 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041BDD3 8B14CDD4B44800          mov edx, dword ptr [8*ecx+0048B4D4]
:0041BDDA 52                      push edx
:0041BDDB B970074B00              mov ecx, 004B0770
:0041BDE0 E89E1DFFFF              call 0040DB83
:0041BDE5 50                      push eax
:0041BDE6 8B45EC                  mov eax, dword ptr [ebp-14]
:0041BDE9 8B0CC5D0B44800          mov ecx, dword ptr [8*eax+0048B4D0]
:0041BDF0 51                      push ecx
:0041BDF1 8B5508                  mov edx, dword ptr [ebp+08]
:0041BDF4 52                      push edx
:0041BDF5 FF15DC624800            call dword ptr [004862DC]
:0041BDFB 50                      push eax
:0041BDFC E8CEFAFFFF              call 0041B8CF
:0041BE01 83C408                  add esp, 00000008
:0041BE04 EBBB                    jmp 0041BDC1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BDCE(C)
|
:0041BE06 B970074B00              mov ecx, 004B0770
:0041BE0B E820050000              call 0041C330
:0041BE10 25FF000000              and eax, 000000FF
:0041BE15 8945F8                  mov dword ptr [ebp-08], eax
:0041BE18 C745EC00000000          mov [ebp-14], 00000000
:0041BE1F EB09                    jmp 0041BE2A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BE5A(U)
|
:0041BE21 8B45EC                  mov eax, dword ptr [ebp-14]
:0041BE24 83C001                  add eax, 00000001
:0041BE27 8945EC                  mov dword ptr [ebp-14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BE1F(U)
|
:0041BE2A 837DEC03                cmp dword ptr [ebp-14], 00000003
:0041BE2E 732C                    jnb 0041BE5C
:0041BE30 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041BE33 33D2                    xor edx, edx
:0041BE35 3B4DEC                  cmp ecx, dword ptr [ebp-14]
:0041BE38 0F94C2                  sete dl
:0041BE3B 52                      push edx
:0041BE3C 8B45EC                  mov eax, dword ptr [ebp-14]
:0041BE3F 8B0C85F8B44800          mov ecx, dword ptr [4*eax+0048B4F8]
:0041BE46 51                      push ecx
:0041BE47 8B5508                  mov edx, dword ptr [ebp+08]
:0041BE4A 52                      push edx
:0041BE4B FF15DC624800            call dword ptr [004862DC]
:0041BE51 50                      push eax
:0041BE52 E878FAFFFF              call 0041B8CF
:0041BE57 83C408                  add esp, 00000008
:0041BE5A EBC5                    jmp 0041BE21

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BE2E(C)
|
:0041BE5C B970074B00              mov ecx, 004B0770
:0041BE61 E8AA040000              call 0041C310
:0041BE66 25FF000000              and eax, 000000FF
:0041BE6B 8945FC                  mov dword ptr [ebp-04], eax
:0041BE6E C745EC00000000          mov [ebp-14], 00000000
:0041BE75 EB09                    jmp 0041BE80

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BEB0(U)
|
:0041BE77 8B45EC                  mov eax, dword ptr [ebp-14]
:0041BE7A 83C001                  add eax, 00000001
:0041BE7D 8945EC                  mov dword ptr [ebp-14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BE75(U)
|
:0041BE80 837DEC03                cmp dword ptr [ebp-14], 00000003
:0041BE84 732C                    jnb 0041BEB2
:0041BE86 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041BE89 33D2                    xor edx, edx
:0041BE8B 3B4DEC                  cmp ecx, dword ptr [ebp-14]
:0041BE8E 0F94C2                  sete dl
:0041BE91 52                      push edx
:0041BE92 8B45EC                  mov eax, dword ptr [ebp-14]
:0041BE95 8B0C8508B54800          mov ecx, dword ptr [4*eax+0048B508]
:0041BE9C 51                      push ecx
:0041BE9D 8B5508                  mov edx, dword ptr [ebp+08]
:0041BEA0 52                      push edx
:0041BEA1 FF15DC624800            call dword ptr [004862DC]
:0041BEA7 50                      push eax
:0041BEA8 E822FAFFFF              call 0041B8CF
:0041BEAD 83C408                  add esp, 00000008
:0041BEB0 EBC5                    jmp 0041BE77

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BE84(C)
|
:0041BEB2 68D0050000              push 000005D0
:0041BEB7 8B4508                  mov eax, dword ptr [ebp+08]
:0041BEBA 50                      push eax
:0041BEBB FF15DC624800            call dword ptr [004862DC]
:0041BEC1 8945F0                  mov dword ptr [ebp-10], eax
:0041BEC4 6A00                    push 00000000
:0041BEC6 6A00                    push 00000000
:0041BEC8 684B010000              push 0000014B
:0041BECD 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0041BED0 51                      push ecx
:0041BED1 FF15F4624800            call dword ptr [004862F4]
:0041BED7 C645F400                mov [ebp-0C], 00
:0041BEDB EB09                    jmp 0041BEE6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BF1B(U)
|
:0041BEDD 8A55F4                  mov dl, byte ptr [ebp-0C]
:0041BEE0 80C201                  add dl, 01
:0041BEE3 8855F4                  mov byte ptr [ebp-0C], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BEDB(U)
|
:0041BEE6 8B75F4                  mov esi, dword ptr [ebp-0C]
:0041BEE9 81E6FF000000            and esi, 000000FF
:0041BEEF E8BC040000              call 0041C3B0
:0041BEF4 25FF000000              and eax, 000000FF
:0041BEF9 3BF0                    cmp esi, eax
:0041BEFB 7D20                    jge 0041BF1D
:0041BEFD 8A45F4                  mov al, byte ptr [ebp-0C]
:0041BF00 50                      push eax
:0041BF01 E80EF0FEFF              call 0040AF14
:0041BF06 83C404                  add esp, 00000004
:0041BF09 50                      push eax
:0041BF0A 6A00                    push 00000000
:0041BF0C 6843010000              push 00000143
:0041BF11 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0041BF14 51                      push ecx
:0041BF15 FF15F4624800            call dword ptr [004862F4]
:0041BF1B EBC0                    jmp 0041BEDD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041BEFB(C)
|
:0041BF1D 6A00                    push 00000000
:0041BF1F B9202E4900              mov ecx, 00492E20
:0041BF24 E887F9FEFF              call 0040B8B0
:0041BF29 25FF000000              and eax, 000000FF
:0041BF2E 50                      push eax

* Possible Reference to Dialog: DialogID_014E 
                                  |
:0041BF2F 684E010000              push 0000014E
:0041BF34 8B55F0                  mov edx, dword ptr [ebp-10]
:0041BF37 52                      push edx
:0041BF38 FF15F4624800            call dword ptr [004862F4]
:0041BF3E 5E                      pop esi
:0041BF3F 8BE5                    mov esp, ebp
:0041BF41 5D                      pop ebp
:0041BF42 C3                      ret



* Referenced by a CALL at Addresses:
|:0041C001   , :00474DE8   
|
:0041BF43 55                      push ebp
:0041BF44 8BEC                    mov ebp, esp
:0041BF46 6A00                    push 00000000
:0041BF48 68DDBA4100              push 0041BADD
:0041BF4D A1686A4B00              mov eax, dword ptr [004B6A68]
:0041BF52 50                      push eax

* Possible StringData Ref from Data Obj ->"KANKYOU"
                                  |
:0041BF53 6800B64800              push 0048B600
:0041BF58 8B0D606A4B00            mov ecx, dword ptr [004B6A60]
:0041BF5E 51                      push ecx
:0041BF5F FF15A0624800            call dword ptr [004862A0]
:0041BF65 5D                      pop ebp
:0041BF66 C3                      ret



* Referenced by a CALL at Address:
|:0042BFBA   
|
:0041BF67 55                      push ebp
:0041BF68 8BEC                    mov ebp, esp
:0041BF6A 51                      push ecx
:0041BF6B C705C8B44800FF000000    mov dword ptr [0048B4C8], 000000FF
:0041BF75 6A04                    push 00000004
:0041BF77 6A00                    push 00000000
:0041BF79 6A00                    push 00000000
:0041BF7B B968AB4A00              mov ecx, 004AAB68
:0041BF80 E8BB3A0600              call 0047FA40
:0041BF85 A3606F4900              mov dword ptr [00496F60], eax
:0041BF8A 6A00                    push 00000000
:0041BF8C 6A16                    push 00000016
:0041BF8E 6828114A00              push 004A1128
:0041BF93 E87B3D0600              call 0047FD13
:0041BF98 83C40C                  add esp, 0000000C
:0041BF9B E899F6FFFF              call 0041B639
:0041BFA0 B970074B00              mov ecx, 004B0770
:0041BFA5 E8D70BFFFF              call 0040CB81
:0041BFAA 6A12                    push 00000012
:0041BFAC B9B8694B00              mov ecx, 004B69B8
:0041BFB1 E848860500              call 004745FE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C01D(U)
|
:0041BFB6 6A00                    push 00000000

* Possible StringData Ref from Code Obj ->"UEE}"
                                  |
:0041BFB8 6869C04100              push 0041C069
:0041BFBD A1686A4B00              mov eax, dword ptr [004B6A68]
:0041BFC2 50                      push eax

* Possible Reference to Dialog: DialogID_00C1 
                                  |
:0041BFC3 68C1000000              push 000000C1
:0041BFC8 8B0D606A4B00            mov ecx, dword ptr [004B6A60]
:0041BFCE 51                      push ecx
:0041BFCF FF15A0624800            call dword ptr [004862A0]
:0041BFD5 8B153C774900            mov edx, dword ptr [0049773C]
:0041BFDB 8955FC                  mov dword ptr [ebp-04], edx
:0041BFDE 837DFC03                cmp dword ptr [ebp-04], 00000003
:0041BFE2 772B                    ja 0041C00F
:0041BFE4 8B45FC                  mov eax, dword ptr [ebp-04]
:0041BFE7 FF248559C04100          jmp dword ptr [4*eax+0041C059]
:0041BFEE C705C8B4480000000000    mov dword ptr [0048B4C8], 00000000
:0041BFF8 EB15                    jmp 0041C00F
:0041BFFA E848E3FFFF              call 0041A347
:0041BFFF EB0E                    jmp 0041C00F
:0041C001 E83DFFFFFF              call 0041BF43
:0041C006 EB07                    jmp 0041C00F
:0041C008 B8FFFF0000              mov eax, 0000FFFF
:0041C00D EB46                    jmp 0041C055

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041BFE2(C), :0041BFF8(U), :0041BFFF(U), :0041C006(U)
|
:0041C00F 813DC8B44800FF000000    cmp dword ptr [0048B4C8], 000000FF
:0041C019 7402                    je 0041C01D
:0041C01B EB02                    jmp 0041C01F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C019(C)
|
:0041C01D EB97                    jmp 0041BFB6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C01B(U)
|
:0041C01F E899DB0500              call 00479BBD
:0041C024 85C0                    test eax, eax
:0041C026 7519                    jne 0041C041

* Possible StringData Ref from Data Obj ->"ɶԻ
鴫ͳڴӲ̵
ʣ"
                                        ->"䡣"
                                  |
:0041C028 6808B64800              push 0048B608
:0041C02D E8A58B0500              call 00474BD7
:0041C032 83C404                  add esp, 00000004
:0041C035 E8AF000600              call 0047C0E9
:0041C03A B8FFFF0000              mov eax, 0000FFFF
:0041C03F EB14                    jmp 0041C055

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C026(C)
|
:0041C041 E8ECAB0000              call 00426C32
:0041C046 C705D8BA4800FFFF0000    mov dword ptr [0048BAD8], 0000FFFF
:0041C050 A1C8B44800              mov eax, dword ptr [0048B4C8]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041C00D(U), :0041C03F(U)
|
:0041C055 8BE5                    mov esp, ebp
:0041C057 5D                      pop ebp
:0041C058 C3                      ret



:0041C059 EEBF4100                DWORD 0041BFEE
:0041C05D FABF4100                DWORD 0041BFFA
:0041C061 01C04100                DWORD 0041C001
:0041C065 08C04100                DWORD 0041C008


:0041C069 55                      push ebp
:0041C06A 8BEC                    mov ebp, esp
:0041C06C 83EC08                  sub esp, 00000008
:0041C06F 8B450C                  mov eax, dword ptr [ebp+0C]
:0041C072 8945FC                  mov dword ptr [ebp-04], eax
:0041C075 817DFC10010000          cmp dword ptr [ebp-04], 00000110
:0041C07C 7718                    ja 0041C096
:0041C07E 817DFC10010000          cmp dword ptr [ebp-04], 00000110
:0041C085 746E                    je 0041C0F5
:0041C087 837DFC2B                cmp dword ptr [ebp-04], 0000002B
:0041C08B 0F84DC000000            je 0041C16D
:0041C091 E986010000              jmp 0041C21C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C07C(C)
|
:0041C096 817DFC35010000          cmp dword ptr [ebp-04], 00000135
:0041C09D 771F                    ja 0041C0BE
:0041C09F 817DFC35010000          cmp dword ptr [ebp-04], 00000135
:0041C0A6 0F848D000000            je 0041C139
:0041C0AC 817DFC11010000          cmp dword ptr [ebp-04], 00000111
:0041C0B3 0F84C9000000            je 0041C182
:0041C0B9 E95E010000              jmp 0041C21C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C09D(C)
|
:0041C0BE 817DFC0F030000          cmp dword ptr [ebp-04], 0000030F
:0041C0C5 7720                    ja 0041C0E7
:0041C0C7 817DFC0F030000          cmp dword ptr [ebp-04], 0000030F
:0041C0CE 742A                    je 0041C0FA
:0041C0D0 817DFC36010000          cmp dword ptr [ebp-04], 00000136
:0041C0D7 747B                    je 0041C154
:0041C0D9 817DFC38010000          cmp dword ptr [ebp-04], 00000138
:0041C0E0 743E                    je 0041C120
:0041C0E2 E935010000              jmp 0041C21C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C0C5(C)
|
:0041C0E7 817DFC11030000          cmp dword ptr [ebp-04], 00000311
:0041C0EE 741B                    je 0041C10B
:0041C0F0 E927010000              jmp 0041C21C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C085(C)
|
:0041C0F5 E926010000              jmp 0041C220

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C0CE(C)
|
:0041C0FA 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041C0FD 51                      push ecx
:0041C0FE E828640500              call 0047252B
:0041C103 83C404                  add esp, 00000004
:0041C106 E915010000              jmp 0041C220

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C0EE(C)
|
:0041C10B 8B5510                  mov edx, dword ptr [ebp+10]
:0041C10E 52                      push edx
:0041C10F 8B4508                  mov eax, dword ptr [ebp+08]
:0041C112 50                      push eax
:0041C113 E866640500              call 0047257E
:0041C118 83C408                  add esp, 00000008
:0041C11B E900010000              jmp 0041C220

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C0E0(C)
|
:0041C120 6A00                    push 00000000
:0041C122 6A01                    push 00000001
:0041C124 8B4D14                  mov ecx, dword ptr [ebp+14]
:0041C127 51                      push ecx
:0041C128 8B5510                  mov edx, dword ptr [ebp+10]
:0041C12B 52                      push edx
:0041C12C E85A540500              call 0047158B
:0041C131 83C410                  add esp, 00000010
:0041C134 E9E7000000              jmp 0041C220

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C0A6(C)
|
:0041C139 6A00                    push 00000000
:0041C13B 6A00                    push 00000000
:0041C13D 6A01                    push 00000001
:0041C13F 8B4514                  mov eax, dword ptr [ebp+14]
:0041C142 50                      push eax
:0041C143 8B4D10                  mov ecx, dword ptr [ebp+10]
:0041C146 51                      push ecx
:0041C147 E835580500              call 00471981
:0041C14C 83C414                  add esp, 00000014
:0041C14F E9CC000000              jmp 0041C220

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C0D7(C)
|
:0041C154 6A00                    push 00000000
:0041C156 6A01                    push 00000001
:0041C158 8B5514                  mov edx, dword ptr [ebp+14]
:0041C15B 52                      push edx
:0041C15C 8B4510                  mov eax, dword ptr [ebp+10]
:0041C15F 50                      push eax
:0041C160 E826510500              call 0047128B
:0041C165 83C410                  add esp, 00000010
:0041C168 E9B3000000              jmp 0041C220

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C08B(C)
|
:0041C16D 6A00                    push 00000000
:0041C16F 6A01                    push 00000001
:0041C171 8B4D14                  mov ecx, dword ptr [ebp+14]
:0041C174 51                      push ecx
:0041C175 E8645E0500              call 00471FDE
:0041C17A 83C40C                  add esp, 0000000C
:0041C17D E99E000000              jmp 0041C220

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C0B3(C)
|
:0041C182 8B5510                  mov edx, dword ptr [ebp+10]
:0041C185 81E2FFFF0000            and edx, 0000FFFF
:0041C18B 8955F8                  mov dword ptr [ebp-08], edx
:0041C18E 8B45F8                  mov eax, dword ptr [ebp-08]
:0041C191 2D03040000              sub eax, 00000403
:0041C196 8945F8                  mov dword ptr [ebp-08], eax
:0041C199 837DF820                cmp dword ptr [ebp-08], 00000020
:0041C19D 777D                    ja 0041C21C
:0041C19F 8B55F8                  mov edx, dword ptr [ebp-08]
:0041C1A2 33C9                    xor ecx, ecx
:0041C1A4 8A8A3FC24100            mov cl, byte ptr [edx+0041C23F]
:0041C1AA FF248D2BC24100          jmp dword ptr [4*ecx+0041C22B]
:0041C1B1 6A01                    push 00000001
:0041C1B3 8B4508                  mov eax, dword ptr [ebp+08]
:0041C1B6 50                      push eax
:0041C1B7 FF15D4624800            call dword ptr [004862D4]
:0041C1BD C7053C77490000000000    mov dword ptr [0049773C], 00000000
:0041C1C7 33C0                    xor eax, eax
:0041C1C9 EB5A                    jmp 0041C225
:0041C1CB 6A01                    push 00000001
:0041C1CD 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041C1D0 51                      push ecx
:0041C1D1 FF15D4624800            call dword ptr [004862D4]
:0041C1D7 C7053C77490001000000    mov dword ptr [0049773C], 00000001
:0041C1E1 33C0                    xor eax, eax
:0041C1E3 EB40                    jmp 0041C225
:0041C1E5 6A01                    push 00000001
:0041C1E7 8B5508                  mov edx, dword ptr [ebp+08]
:0041C1EA 52                      push edx
:0041C1EB FF15D4624800            call dword ptr [004862D4]
:0041C1F1 C7053C77490002000000    mov dword ptr [0049773C], 00000002
:0041C1FB 33C0                    xor eax, eax
:0041C1FD EB26                    jmp 0041C225
:0041C1FF 6A01                    push 00000001
:0041C201 8B4508                  mov eax, dword ptr [ebp+08]
:0041C204 50                      push eax
:0041C205 FF15D4624800            call dword ptr [004862D4]
:0041C20B C7053C77490003000000    mov dword ptr [0049773C], 00000003
:0041C215 B801000000              mov eax, 00000001
:0041C21A EB09                    jmp 0041C225

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041C091(U), :0041C0B9(U), :0041C0E2(U), :0041C0F0(U), :0041C19D(C)
|
:0041C21C 33C0                    xor eax, eax
:0041C21E EB05                    jmp 0041C225

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041C0F5(U), :0041C106(U), :0041C11B(U), :0041C134(U), :0041C14F(U)
|:0041C168(U), :0041C17D(U)
|
:0041C220 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041C1C9(U), :0041C1E3(U), :0041C1FD(U), :0041C21A(U), :0041C21E(U)
|
:0041C225 8BE5                    mov esp, ebp
:0041C227 5D                      pop ebp
:0041C228 C21000                  ret 0010



:0041C22B B1C14100                DWORD 0041C1B1
:0041C22F CBC14100                DWORD 0041C1CB
:0041C233 E5C14100                DWORD 0041C1E5
:0041C237 FFC14100                DWORD 0041C1FF
:0041C23B 1CC24100                DWORD 0041C21C


:0041C23F 0001                    add byte ptr [ecx], al
:0041C241 0404                    add al, 04
:0041C243 0404                    add al, 04
:0041C245 0404                    add al, 04
:0041C247 0404                    add al, 04
:0041C249 0404                    add al, 04
:0041C24B 0404                    add al, 04
:0041C24D 0404                    add al, 04
:0041C24F 0404                    add al, 04
:0041C251 0404                    add al, 04
:0041C253 0404                    add al, 04
:0041C255 0404                    add al, 04
:0041C257 0404                    add al, 04
:0041C259 0404                    add al, 04
:0041C25B 0404                    add al, 04
:0041C25D 0402                    add al, 02
:0041C25F 03                      BYTE 03h


* Referenced by a CALL at Addresses:
|:0041A37D   , :0041A49C   
|
:0041C260 55                      push ebp
:0041C261 8BEC                    mov ebp, esp
:0041C263 51                      push ecx
:0041C264 894DFC                  mov dword ptr [ebp-04], ecx
:0041C267 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041C26A E83121FFFF              call 0040E3A0
:0041C26F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041C272 83C10C                  add ecx, 0000000C
:0041C275 E876010000              call 0041C3F0
:0041C27A 8B45FC                  mov eax, dword ptr [ebp-04]
:0041C27D C70040664800            mov dword ptr [eax], 00486640
:0041C283 8B45FC                  mov eax, dword ptr [ebp-04]
:0041C286 8BE5                    mov esp, ebp
:0041C288 5D                      pop ebp
:0041C289 C3                      ret


:0041C28A CC                      int 03
:0041C28B CC                      int 03
:0041C28C CC                      int 03
:0041C28D CC                      int 03
:0041C28E CC                      int 03
:0041C28F CC                      int 03

* Referenced by a CALL at Addresses:
|:0041A3BC   , :0041A3E0   , :0041A4DB   , :0041A4FF   , :004851AC   
|:004851C2   
|
:0041C290 55                      push ebp
:0041C291 8BEC                    mov ebp, esp
:0041C293 51                      push ecx
:0041C294 894DFC                  mov dword ptr [ebp-04], ecx
:0041C297 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041C29A 83C10C                  add ecx, 0000000C
:0041C29D E88E950500              call 00475830
:0041C2A2 8BE5                    mov esp, ebp
:0041C2A4 5D                      pop ebp
:0041C2A5 C3                      ret


:0041C2A6 CC                      int 03
:0041C2A7 CC                      int 03
:0041C2A8 CC                      int 03
:0041C2A9 CC                      int 03
:0041C2AA CC                      int 03
:0041C2AB CC                      int 03
:0041C2AC CC                      int 03
:0041C2AD CC                      int 03
:0041C2AE CC                      int 03
:0041C2AF CC                      int 03

* Referenced by a CALL at Addresses:
|:0041B10F   , :0041BA47   , :00423BEA   , :0043B52E   , :0043B55B   
|:0043B760   , :0043B78D   , :0043BAA2   , :0043BAE5   , :0043C007   
|:0043D288   , :00440732   , :00440A3D   , :00448AA9   , :0044D3B1   
|:0045721F   , :004572DB   , :0045754B   , :0045763E   , :00457647   
|:004576A1   , :004576AA   , :00457921   , :004592FD   , :004593BA   
|:00459637   , :0045A5FB   , :0045A79E   , :0045E6AC   
|
:0041C2B0 55                      push ebp
:0041C2B1 8BEC                    mov ebp, esp
:0041C2B3 51                      push ecx
:0041C2B4 894DFC                  mov dword ptr [ebp-04], ecx
:0041C2B7 8B45FC                  mov eax, dword ptr [ebp-04]
:0041C2BA 8A4004                  mov al, byte ptr [eax+04]
:0041C2BD 8BE5                    mov esp, ebp
:0041C2BF 5D                      pop ebp
:0041C2C0 C3                      ret


:0041C2C1 CC                      int 03
:0041C2C2 CC                      int 03
:0041C2C3 CC                      int 03
:0041C2C4 CC                      int 03
:0041C2C5 CC                      int 03
:0041C2C6 CC                      int 03
:0041C2C7 CC                      int 03
:0041C2C8 CC                      int 03
:0041C2C9 CC                      int 03
:0041C2CA CC                      int 03
:0041C2CB CC                      int 03
:0041C2CC CC                      int 03
:0041C2CD CC                      int 03
:0041C2CE CC                      int 03
:0041C2CF CC                      int 03

* Referenced by a CALL at Addresses:
|:0041B284   , :004224D2   , :00424A80   , :0043E62E   , :0043E655   
|:0043EBC6   , :0043EC6F   , :0043ED25   , :0043EDDB   , :0043EE91   
|:0043EF46   , :0043EFAE   , :0043F013   , :0045158D   , :004515F6   
|:0045165F   , :004516BD   , :0045179F   , :004517EE   , :0045183D   
|:00451884   , :00452772   , :004527C3   , :00452814   
|
:0041C2D0 55                      push ebp
:0041C2D1 8BEC                    mov ebp, esp
:0041C2D3 51                      push ecx
:0041C2D4 894DFC                  mov dword ptr [ebp-04], ecx
:0041C2D7 8B45FC                  mov eax, dword ptr [ebp-04]
:0041C2DA 8A4005                  mov al, byte ptr [eax+05]
:0041C2DD 8BE5                    mov esp, ebp
:0041C2DF 5D                      pop ebp
:0041C2E0 C3                      ret


:0041C2E1 CC                      int 03
:0041C2E2 CC                      int 03
:0041C2E3 CC                      int 03
:0041C2E4 CC                      int 03
:0041C2E5 CC                      int 03
:0041C2E6 CC                      int 03
:0041C2E7 CC                      int 03
:0041C2E8 CC                      int 03
:0041C2E9 CC                      int 03
:0041C2EA CC                      int 03
:0041C2EB CC                      int 03
:0041C2EC CC                      int 03
:0041C2ED CC                      int 03
:0041C2EE CC                      int 03
:0041C2EF CC                      int 03

* Referenced by a CALL at Address:
|:0041B9B3   
|
:0041C2F0 55                      push ebp
:0041C2F1 8BEC                    mov ebp, esp
:0041C2F3 51                      push ecx
:0041C2F4 894DFC                  mov dword ptr [ebp-04], ecx
:0041C2F7 8B45FC                  mov eax, dword ptr [ebp-04]
:0041C2FA 8A4D08                  mov cl, byte ptr [ebp+08]
:0041C2FD 884810                  mov byte ptr [eax+10], cl
:0041C300 8BE5                    mov esp, ebp
:0041C302 5D                      pop ebp
:0041C303 C20400                  ret 0004


:0041C306 CC                      int 03
:0041C307 CC                      int 03
:0041C308 CC                      int 03
:0041C309 CC                      int 03
:0041C30A CC                      int 03
:0041C30B CC                      int 03
:0041C30C CC                      int 03
:0041C30D CC                      int 03
:0041C30E CC                      int 03
:0041C30F CC                      int 03

* Referenced by a CALL at Addresses:
|:0041BE61   , :00429916   , :00438E60   , :004418E4   , :004423C5   
|:004423DD   
|
:0041C310 55                      push ebp
:0041C311 8BEC                    mov ebp, esp
:0041C313 51                      push ecx
:0041C314 894DFC                  mov dword ptr [ebp-04], ecx
:0041C317 8B45FC                  mov eax, dword ptr [ebp-04]
:0041C31A 8A4008                  mov al, byte ptr [eax+08]
:0041C31D 8BE5                    mov esp, ebp
:0041C31F 5D                      pop ebp
:0041C320 C3                      ret


:0041C321 CC                      int 03
:0041C322 CC                      int 03
:0041C323 CC                      int 03
:0041C324 CC                      int 03
:0041C325 CC                      int 03
:0041C326 CC                      int 03
:0041C327 CC                      int 03
:0041C328 CC                      int 03
:0041C329 CC                      int 03
:0041C32A CC                      int 03
:0041C32B CC                      int 03
:0041C32C CC                      int 03
:0041C32D CC                      int 03
:0041C32E CC                      int 03
:0041C32F CC                      int 03

* Referenced by a CALL at Addresses:
|:00411724   , :0041BE0B   , :0042D379   , :0042DB18   , :0042F66D   
|:00432A59   , :004433B8   , :0046575F   , :0046C933   , :0046C981   
|:0046C9CF   , :0046CA1D   , :0046FB30   
|
:0041C330 55                      push ebp
:0041C331 8BEC                    mov ebp, esp
:0041C333 51                      push ecx
:0041C334 894DFC                  mov dword ptr [ebp-04], ecx
:0041C337 8B45FC                  mov eax, dword ptr [ebp-04]
:0041C33A 8A4010                  mov al, byte ptr [eax+10]
:0041C33D 8BE5                    mov esp, ebp
:0041C33F 5D                      pop ebp
:0041C340 C3                      ret


:0041C341 CC                      int 03
:0041C342 CC                      int 03
:0041C343 CC                      int 03
:0041C344 CC                      int 03
:0041C345 CC                      int 03
:0041C346 CC                      int 03
:0041C347 CC                      int 03
:0041C348 CC                      int 03
:0041C349 CC                      int 03
:0041C34A CC                      int 03
:0041C34B CC                      int 03
:0041C34C CC                      int 03
:0041C34D CC                      int 03
:0041C34E CC                      int 03
:0041C34F CC                      int 03

* Referenced by a CALL at Address:
|:0041B593   
|
:0041C350 55                      push ebp
:0041C351 8BEC                    mov ebp, esp
:0041C353 51                      push ecx
:0041C354 894DFC                  mov dword ptr [ebp-04], ecx
:0041C357 8B450C                  mov eax, dword ptr [ebp+0C]
:0041C35A 50                      push eax
:0041C35B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041C35E 51                      push ecx
:0041C35F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041C362 E822390000              call 0041FC89
:0041C367 8BE5                    mov esp, ebp
:0041C369 5D                      pop ebp
:0041C36A C20800                  ret 0008


:0041C36D CC                      int 03
:0041C36E CC                      int 03
:0041C36F CC                      int 03

* Referenced by a CALL at Addresses:
|:0041B4A1   , :00449D1E   , :0044F628   
|
:0041C370 55                      push ebp
:0041C371 8BEC                    mov ebp, esp
:0041C373 51                      push ecx
:0041C374 894DFC                  mov dword ptr [ebp-04], ecx
:0041C377 8B45FC                  mov eax, dword ptr [ebp-04]
:0041C37A 05103D0000              add eax, 00003D10
:0041C37F 8BE5                    mov esp, ebp
:0041C381 5D                      pop ebp
:0041C382 C3                      ret


:0041C383 CC                      int 03
:0041C384 CC                      int 03
:0041C385 CC                      int 03
:0041C386 CC                      int 03
:0041C387 CC                      int 03
:0041C388 CC                      int 03
:0041C389 CC                      int 03
:0041C38A CC                      int 03
:0041C38B CC                      int 03
:0041C38C CC                      int 03
:0041C38D CC                      int 03
:0041C38E CC                      int 03
:0041C38F CC                      int 03

* Referenced by a CALL at Addresses:
|:0041A36A   , :0041A489   
|
:0041C390 55                      push ebp
:0041C391 8BEC                    mov ebp, esp
:0041C393 51                      push ecx
:0041C394 894DFC                  mov dword ptr [ebp-04], ecx
:0041C397 8B45FC                  mov eax, dword ptr [ebp-04]
:0041C39A 33C9                    xor ecx, ecx
:0041C39C 8A4878                  mov cl, byte ptr [eax+78]
:0041C39F 33C0                    xor eax, eax
:0041C3A1 85C9                    test ecx, ecx
:0041C3A3 0F9FC0                  setg al
:0041C3A6 8BE5                    mov esp, ebp
:0041C3A8 5D                      pop ebp
:0041C3A9 C3                      ret


:0041C3AA CC                      int 03
:0041C3AB CC                      int 03
:0041C3AC CC                      int 03
:0041C3AD CC                      int 03
:0041C3AE CC                      int 03
:0041C3AF CC                      int 03

* Referenced by a CALL at Address:
|:0041BEEF   
|
:0041C3B0 55                      push ebp
:0041C3B1 8BEC                    mov ebp, esp
:0041C3B3 B005                    mov al, 05
:0041C3B5 5D                      pop ebp
:0041C3B6 C3                      ret


:0041C3B7 CC                      int 03
:0041C3B8 CC                      int 03
:0041C3B9 CC                      int 03
:0041C3BA CC                      int 03
:0041C3BB CC                      int 03
:0041C3BC CC                      int 03
:0041C3BD CC                      int 03
:0041C3BE CC                      int 03
:0041C3BF CC                      int 03

* Referenced by a CALL at Addresses:
|:0041A965   , :00464018   , :00464553   , :00464581   , :004668BC   
|:00466A4E   , :00466B08   , :00466C62   , :00466D38   , :00466E8A   
|:00468686   , :00468A89   , :0046BB32   , :0046BD3D   , :0046C774   
|:0047308E   
|
:0041C3C0 55                      push ebp
:0041C3C1 8BEC                    mov ebp, esp
:0041C3C3 51                      push ecx
:0041C3C4 894DFC                  mov dword ptr [ebp-04], ecx
:0041C3C7 6A00                    push 00000000
:0041C3C9 6A00                    push 00000000
:0041C3CB 6804100000              push 00001004
:0041C3D0 8B45FC                  mov eax, dword ptr [ebp-04]
:0041C3D3 8B4810                  mov ecx, dword ptr [eax+10]
:0041C3D6 51                      push ecx
:0041C3D7 FF15F4624800            call dword ptr [004862F4]
:0041C3DD 8BE5                    mov esp, ebp
:0041C3DF 5D                      pop ebp
:0041C3E0 C3                      ret


:0041C3E1 CC                      int 03
:0041C3E2 CC                      int 03
:0041C3E3 CC                      int 03
:0041C3E4 CC                      int 03
:0041C3E5 CC                      int 03
:0041C3E6 CC                      int 03
:0041C3E7 CC                      int 03
:0041C3E8 CC                      int 03
:0041C3E9 CC                      int 03
:0041C3EA CC                      int 03
:0041C3EB CC                      int 03
:0041C3EC CC                      int 03
:0041C3ED CC                      int 03
:0041C3EE CC                      int 03
:0041C3EF CC                      int 03

* Referenced by a CALL at Address:
|:0041C275   
|
:0041C3F0 55                      push ebp
:0041C3F1 8BEC                    mov ebp, esp
:0041C3F3 51                      push ecx
:0041C3F4 894DFC                  mov dword ptr [ebp-04], ecx
:0041C3F7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041C3FA E8AE770400              call 00463BAD
:0041C3FF 8B45FC                  mov eax, dword ptr [ebp-04]
:0041C402 C70068664800            mov dword ptr [eax], 00486668
:0041C408 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041C40B 8B55FC                  mov edx, dword ptr [ebp-04]
:0041C40E 8B4228                  mov eax, dword ptr [edx+28]
:0041C411 89412C                  mov dword ptr [ecx+2C], eax
:0041C414 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041C417 8B55FC                  mov edx, dword ptr [ebp-04]
:0041C41A 8B4230                  mov eax, dword ptr [edx+30]
:0041C41D 894134                  mov dword ptr [ecx+34], eax
:0041C420 8B45FC                  mov eax, dword ptr [ebp-04]
:0041C423 8BE5                    mov esp, ebp
:0041C425 5D                      pop ebp
:0041C426 C3                      ret


:0041C427 CC                      int 03
:0041C428 CC                      int 03
:0041C429 CC                      int 03
:0041C42A CC                      int 03
:0041C42B CC                      int 03
:0041C42C CC                      int 03
:0041C42D CC                      int 03
:0041C42E CC                      int 03
:0041C42F CC                      int 03
:0041C430 55                      push ebp
:0041C431 8BEC                    mov ebp, esp
:0041C433 51                      push ecx
:0041C434 894DFC                  mov dword ptr [ebp-04], ecx
:0041C437 6A00                    push 00000000
:0041C439 8B4508                  mov eax, dword ptr [ebp+08]
:0041C43C 50                      push eax
:0041C43D 681D100000              push 0000101D
:0041C442 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041C445 8B5110                  mov edx, dword ptr [ecx+10]
:0041C448 52                      push edx
:0041C449 FF15F4624800            call dword ptr [004862F4]
:0041C44F 8BE5                    mov esp, ebp
:0041C451 5D                      pop ebp
:0041C452 C20400                  ret 0004


:0041C455 CC                      int 03
:0041C456 CC                      int 03
:0041C457 CC                      int 03
:0041C458 CC                      int 03
:0041C459 CC                      int 03
:0041C45A CC                      int 03
:0041C45B CC                      int 03
:0041C45C CC                      int 03
:0041C45D CC                      int 03
:0041C45E CC                      int 03
:0041C45F CC                      int 03
:0041C460 55                      push ebp
:0041C461 8BEC                    mov ebp, esp
:0041C463 83EC08                  sub esp, 00000008
:0041C466 894DFC                  mov dword ptr [ebp-04], ecx
:0041C469 837D0800                cmp dword ptr [ebp+08], 00000000
:0041C46D 7C0D                    jl 0041C47C
:0041C46F 8B4508                  mov eax, dword ptr [ebp+08]
:0041C472 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041C475 837C815000              cmp dword ptr [ecx+4*eax+50], 00000000
:0041C47A 7F15                    jg 0041C491

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C46D(C)
|
:0041C47C 8B55FC                  mov edx, dword ptr [ebp-04]
:0041C47F 83BA6C02000000          cmp dword ptr [edx+0000026C], 00000000
:0041C486 7509                    jne 0041C491
:0041C488 C745F800000000          mov [ebp-08], 00000000
:0041C48F EB07                    jmp 0041C498

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041C47A(C), :0041C486(C)
|
:0041C491 C745F801000000          mov [ebp-08], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C48F(U)
|
:0041C498 8B45F8                  mov eax, dword ptr [ebp-08]
:0041C49B 8BE5                    mov esp, ebp
:0041C49D 5D                      pop ebp
:0041C49E C20400                  ret 0004


:0041C4A1 CC                      int 03
:0041C4A2 CC                      int 03
:0041C4A3 CC                      int 03
:0041C4A4 CC                      int 03
:0041C4A5 CC                      int 03
:0041C4A6 CC                      int 03
:0041C4A7 CC                      int 03
:0041C4A8 CC                      int 03
:0041C4A9 CC                      int 03
:0041C4AA CC                      int 03
:0041C4AB CC                      int 03
:0041C4AC CC                      int 03
:0041C4AD CC                      int 03
:0041C4AE CC                      int 03
:0041C4AF CC                      int 03
:0041C4B0 55                      push ebp
:0041C4B1 8BEC                    mov ebp, esp
:0041C4B3 51                      push ecx
:0041C4B4 894DFC                  mov dword ptr [ebp-04], ecx
:0041C4B7 6AFF                    push FFFFFFFF
:0041C4B9 8B45FC                  mov eax, dword ptr [ebp-04]
:0041C4BC 8B4804                  mov ecx, dword ptr [eax+04]
:0041C4BF 51                      push ecx
:0041C4C0 FF15D4624800            call dword ptr [004862D4]
:0041C4C6 8BE5                    mov esp, ebp
:0041C4C8 5D                      pop ebp
:0041C4C9 C3                      ret


:0041C4CA CC                      int 03
:0041C4CB CC                      int 03
:0041C4CC CC                      int 03
:0041C4CD CC                      int 03
:0041C4CE CC                      int 03
:0041C4CF CC                      int 03
:0041C4D0 55                      push ebp
:0041C4D1 8BEC                    mov ebp, esp
:0041C4D3 E802000000              call 0041C4DA
:0041C4D8 5D                      pop ebp
:0041C4D9 C3                      ret



* Referenced by a CALL at Address:
|:0041C4D3   
|
:0041C4DA 55                      push ebp
:0041C4DB 8BEC                    mov ebp, esp
:0041C4DD B950774900              mov ecx, 00497750
:0041C4E2 E869180000              call 0041DD50
:0041C4E7 5D                      pop ebp
:0041C4E8 C3                      ret



* Referenced by a CALL at Addresses:
|:0041CD8D   , :0041CEA6   , :0041CFE3   , :0041D126   , :0041D45A   
|:0041D5BE   , :0044096C   
|
:0041C4E9 55                      push ebp
:0041C4EA 8BEC                    mov ebp, esp
:0041C4EC 83EC14                  sub esp, 00000014
:0041C4EF 56                      push esi
:0041C4F0 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041C4F3 81E1FF000000            and ecx, 000000FF
:0041C4F9 6BC919                  imul ecx, 00000019
:0041C4FC 81C140114A00            add ecx, 004A1140
:0041C502 E839D0FEFF              call 00409540
:0041C507 8845F8                  mov byte ptr [ebp-08], al
:0041C50A 8B450C                  mov eax, dword ptr [ebp+0C]
:0041C50D 25FF000000              and eax, 000000FF
:0041C512 6BC024                  imul eax, 00000024
:0041C515 05502C4B00              add eax, 004B2C50
:0041C51A 8945FC                  mov dword ptr [ebp-04], eax
:0041C51D C745F401000000          mov [ebp-0C], 00000001
:0041C524 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041C527 81E1FF000000            and ecx, 000000FF
:0041C52D 894DEC                  mov dword ptr [ebp-14], ecx
:0041C530 8B55EC                  mov edx, dword ptr [ebp-14]
:0041C533 83EA3F                  sub edx, 0000003F
:0041C536 8955EC                  mov dword ptr [ebp-14], edx
:0041C539 837DEC0D                cmp dword ptr [ebp-14], 0000000D
:0041C53D 0F87DF010000            ja 0041C722
:0041C543 8B45EC                  mov eax, dword ptr [ebp-14]
:0041C546 FF24852AC74100          jmp dword ptr [4*eax+0041C72A]
:0041C54D E9D0010000              jmp 0041C722
:0041C552 837D1000                cmp dword ptr [ebp+10], 00000000
:0041C556 7415                    je 0041C56D
:0041C558 6A08                    push 00000008
:0041C55A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041C55D E87EA1FEFF              call 004066E0
:0041C562 85C0                    test eax, eax
:0041C564 7507                    jne 0041C56D
:0041C566 C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041C556(C), :0041C564(C)
|
:0041C56D E9B0010000              jmp 0041C722
:0041C572 837D1000                cmp dword ptr [ebp+10], 00000000
:0041C576 7415                    je 0041C58D
:0041C578 6A10                    push 00000010
:0041C57A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041C57D E85EA1FEFF              call 004066E0
:0041C582 85C0                    test eax, eax
:0041C584 7507                    jne 0041C58D
:0041C586 C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041C576(C), :0041C584(C)
|
:0041C58D E990010000              jmp 0041C722
:0041C592 837D1000                cmp dword ptr [ebp+10], 00000000
:0041C596 7415                    je 0041C5AD
:0041C598 6A02                    push 00000002
:0041C59A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041C59D E83EA1FEFF              call 004066E0
:0041C5A2 85C0                    test eax, eax
:0041C5A4 7507                    jne 0041C5AD
:0041C5A6 C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041C596(C), :0041C5A4(C)
|
:0041C5AD E970010000              jmp 0041C722
:0041C5B2 837D1000                cmp dword ptr [ebp+10], 00000000
:0041C5B6 7415                    je 0041C5CD
:0041C5B8 6A04                    push 00000004
:0041C5BA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041C5BD E81EA1FEFF              call 004066E0
:0041C5C2 85C0                    test eax, eax
:0041C5C4 7507                    jne 0041C5CD
:0041C5C6 C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041C5B6(C), :0041C5C4(C)
|
:0041C5CD E950010000              jmp 0041C722
:0041C5D2 837D1000                cmp dword ptr [ebp+10], 00000000
:0041C5D6 7418                    je 0041C5F0
:0041C5D8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041C5DB E8501A0000              call 0041E030
:0041C5E0 25FF000000              and eax, 000000FF
:0041C5E5 85C0                    test eax, eax
:0041C5E7 7507                    jne 0041C5F0
:0041C5E9 C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041C5D6(C), :0041C5E7(C)
|
:0041C5F0 E92D010000              jmp 0041C722
:0041C5F5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041C5F8 E873300400              call 0045F670
:0041C5FD 8BC8                    mov ecx, eax
:0041C5FF 6BC948                  imul ecx, 00000048
:0041C602 81C1681B4A00            add ecx, 004A1B68
:0041C608 E8C39FFEFF              call 004065D0
:0041C60D 25FF000000              and eax, 000000FF
:0041C612 83F832                  cmp eax, 00000032
:0041C615 721C                    jb 0041C633
:0041C617 837D1000                cmp dword ptr [ebp+10], 00000000
:0041C61B 750F                    jne 0041C62C

* Possible StringData Ref from Data Obj ->"ˡ"
                                  |
:0041C61D 683CB64800              push 0048B63C
:0041C622 6A02                    push 00000002
:0041C624 E870300100              call 0042F699
:0041C629 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C61B(C)
|
:0041C62C C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C615(C)
|
:0041C633 E9EA000000              jmp 0041C722
:0041C638 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041C63B E830300400              call 0045F670
:0041C640 8BC8                    mov ecx, eax
:0041C642 6BC948                  imul ecx, 00000048
:0041C645 81C1681B4A00            add ecx, 004A1B68
:0041C64B E8C09FFEFF              call 00406610
:0041C650 8845F0                  mov byte ptr [ebp-10], al
:0041C653 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0041C656 81E1FF000000            and ecx, 000000FF
:0041C65C 83F926                  cmp ecx, 00000026
:0041C65F 7E21                    jle 0041C682
:0041C661 837D1000                cmp dword ptr [ebp+10], 00000000
:0041C665 750F                    jne 0041C676

* Possible StringData Ref from Data Obj ->"ǲֵĲӡ"
                                  |
:0041C667 684CB64800              push 0048B64C
:0041C66C 6A02                    push 00000002
:0041C66E E826300100              call 0042F699
:0041C673 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C665(C)
|
:0041C676 C745F400000000          mov [ebp-0C], 00000000
:0041C67D E9A0000000              jmp 0041C722

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C65F(C)
|
:0041C682 8B45F0                  mov eax, dword ptr [ebp-10]
:0041C685 25FF000000              and eax, 000000FF
:0041C68A 99                      cdq
:0041C68B B903000000              mov ecx, 00000003
:0041C690 F7F9                    idiv ecx
:0041C692 83FA02                  cmp edx, 00000002
:0041C695 751E                    jne 0041C6B5
:0041C697 837D1000                cmp dword ptr [ebp+10], 00000000
:0041C69B 750F                    jne 0041C6AC

* Possible StringData Ref from Data Obj ->"ˡ"
                                  |
:0041C69D 6868B64800              push 0048B668
:0041C6A2 6A02                    push 00000002
:0041C6A4 E8F02F0100              call 0042F699
:0041C6A9 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C69B(C)
|
:0041C6AC C745F400000000          mov [ebp-0C], 00000000
:0041C6B3 EB6D                    jmp 0041C722

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C695(C)
|
:0041C6B5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041C6B8 E8B32F0400              call 0045F670
:0041C6BD 8BC8                    mov ecx, eax
:0041C6BF 6BC948                  imul ecx, 00000048
:0041C6C2 81C1681B4A00            add ecx, 004A1B68
:0041C6C8 E8039FFEFF              call 004065D0
:0041C6CD 8AC8                    mov cl, al
:0041C6CF 81E1FF000000            and ecx, 000000FF
:0041C6D5 8B45F0                  mov eax, dword ptr [ebp-10]
:0041C6D8 25FF000000              and eax, 000000FF
:0041C6DD 99                      cdq
:0041C6DE BE03000000              mov esi, 00000003
:0041C6E3 F7FE                    idiv esi
:0041C6E5 83C201                  add edx, 00000001
:0041C6E8 6BD20F                  imul edx, 0000000F
:0041C6EB 3BCA                    cmp ecx, edx
:0041C6ED 7D33                    jge 0041C722
:0041C6EF 837D1000                cmp dword ptr [ebp+10], 00000000
:0041C6F3 7526                    jne 0041C71B
:0041C6F5 8B45F0                  mov eax, dword ptr [ebp-10]
:0041C6F8 25FF000000              and eax, 000000FF
:0041C6FD 99                      cdq
:0041C6FE B903000000              mov ecx, 00000003
:0041C703 F7F9                    idiv ecx
:0041C705 83C201                  add edx, 00000001
:0041C708 6BD20F                  imul edx, 0000000F
:0041C70B 52                      push edx

* Possible StringData Ref from Data Obj ->"һҪȼ%uϡ"
                                  |
:0041C70C 687CB64800              push 0048B67C
:0041C711 6A02                    push 00000002
:0041C713 E8812F0100              call 0042F699
:0041C718 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041C6F3(C)
|
:0041C71B C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041C53D(C), :0041C54D(U), :0041C56D(U), :0041C58D(U), :0041C5AD(U)
|:0041C5CD(U), :0041C5F0(U), :0041C633(U), :0041C67D(U), :0041C6B3(U)
|:0041C6ED(C)
|
:0041C722 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041C725 5E                      pop esi
:0041C726 8BE5                    mov esp, ebp
:0041C728 5D                      pop ebp
:0041C729 C3                      ret



:0041C72A 4DC54100                DWORD 0041C54D
:0041C72E 22C74100                DWORD 0041C722
:0041C732 52C54100                DWORD 0041C552
:0041C736 72C54100                DWORD 0041C572
:0041C73A 92C54100                DWORD 0041C592
:0041C73E B2C54100                DWORD 0041C5B2
:0041C742 D2C54100                DWORD 0041C5D2
:0041C746 22C74100                DWORD 0041C722
:0041C74A 22C74100                DWORD 0041C722
:0041C74E 22C74100                DWORD 0041C722
:0041C752 22C74100                DWORD 0041C722
:0041C756 22C74100                DWORD 0041C722
:0041C75A F5C54100                DWORD 0041C5F5
:0041C75E 38C64100                DWORD 0041C638



* Referenced by a CALL at Addresses:
|:0041CDBC   , :0041CED5   , :0041CFF6   , :0041D291   , :0041D470   
|:0041D5EC   
|
:0041C762 55                      push ebp
:0041C763 8BEC                    mov ebp, esp
:0041C765 6AFF                    push FFFFFFFF
:0041C767 683C524800              push 0048523C
:0041C76C 64A100000000            mov eax, dword ptr fs:[00000000]
:0041C772 50                      push eax
:0041C773 64892500000000          mov dword ptr fs:[00000000], esp
:0041C77A 81EC2C010000            sub esp, 0000012C
:0041C780 898DC8FEFFFF            mov dword ptr [ebp+FFFFFEC8], ecx
:0041C786 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0041C78C E81F6BFEFF              call 004032B0
:0041C791 C745FC00000000          mov [ebp-04], 00000000

* Possible StringData Ref from Data Obj ->"UNIT_SPC.E5"
                                  |
:0041C798 68D0BB4800              push 0048BBD0
:0041C79D 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0041C7A3 E88D330000              call 0041FB35
:0041C7A8 6A04                    push 00000004
:0041C7AA 6A00                    push 00000000
:0041C7AC 6800690000              push 00006900
:0041C7B1 B9C8E44A00              mov ecx, 004AE4C8
:0041C7B6 E885320600              call 0047FA40
:0041C7BB 50                      push eax
:0041C7BC 8B85C8FEFFFF            mov eax, dword ptr [ebp+FFFFFEC8]
:0041C7C2 33C9                    xor ecx, ecx
:0041C7C4 8A4802                  mov cl, byte ptr [eax+02]
:0041C7C7 51                      push ecx
:0041C7C8 8B95C8FEFFFF            mov edx, dword ptr [ebp+FFFFFEC8]
:0041C7CE 8B4A04                  mov ecx, dword ptr [edx+04]
:0041C7D1 E872340200              call 0043FC48
:0041C7D6 25FF000000              and eax, 000000FF
:0041C7DB 50                      push eax
:0041C7DC 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0041C7E2 E8A2340000              call 0041FC89
:0041C7E7 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0041C7ED E8D3CAFFFF              call 004192C5
:0041C7F2 6800090000              push 00000900
:0041C7F7 6A04                    push 00000004
:0041C7F9 6A00                    push 00000000
:0041C7FB 6A00                    push 00000000
:0041C7FD B9C8E44A00              mov ecx, 004AE4C8
:0041C802 E839320600              call 0047FA40
:0041C807 50                      push eax
:0041C808 6A04                    push 00000004
:0041C80A 6A00                    push 00000000
:0041C80C 68008D0000              push 00008D00
:0041C811 B9C8E44A00              mov ecx, 004AE4C8
:0041C816 E825320600              call 0047FA40
:0041C81B 50                      push eax
:0041C81C E8DC340600              call 0047FCFD
:0041C821 83C40C                  add esp, 0000000C

* Possible StringData Ref from Data Obj ->"ITEM.E5"
                                  |
:0041C824 68F0BB4800              push 0048BBF0
:0041C829 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0041C82F E801330000              call 0041FB35
:0041C834 6A04                    push 00000004
:0041C836 6A00                    push 00000000
:0041C838 6800690000              push 00006900
:0041C83D B9C8E44A00              mov ecx, 004AE4C8
:0041C842 E8F9310600              call 0047FA40
:0041C847 50                      push eax
:0041C848 8B85C8FEFFFF            mov eax, dword ptr [ebp+FFFFFEC8]
:0041C84E 33C9                    xor ecx, ecx
:0041C850 8A08                    mov cl, byte ptr [eax]
:0041C852 51                      push ecx
:0041C853 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0041C859 E82B340000              call 0041FC89
:0041C85E 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0041C864 E85CCAFFFF              call 004192C5
:0041C869 6800040000              push 00000400
:0041C86E 6A04                    push 00000004
:0041C870 6A00                    push 00000000
:0041C872 6800090000              push 00000900
:0041C877 B9C8E44A00              mov ecx, 004AE4C8
:0041C87C E8BF310600              call 0047FA40
:0041C881 50                      push eax
:0041C882 6A04                    push 00000004
:0041C884 6A00                    push 00000000
:0041C886 6800690000              push 00006900
:0041C88B B9C8E44A00              mov ecx, 004AE4C8
:0041C890 E8AB310600              call 0047FA40
:0041C895 50                      push eax
:0041C896 E862340600              call 0047FCFD
:0041C89B 83C40C                  add esp, 0000000C
:0041C89E 8B95C8FEFFFF            mov edx, dword ptr [ebp+FFFFFEC8]
:0041C8A4 8B4A04                  mov ecx, dword ptr [edx+04]
:0041C8A7 E8B46AFEFF              call 00403360
:0041C8AC 668B00                  mov ax, word ptr [eax]
:0041C8AF 50                      push eax
:0041C8B0 E8C9310300              call 0044FA7E
:0041C8B5 83C404                  add esp, 00000004
:0041C8B8 8985D8FEFFFF            mov dword ptr [ebp+FFFFFED8], eax
:0041C8BE 8995DCFEFFFF            mov dword ptr [ebp+FFFFFEDC], edx
:0041C8C4 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:0041C8CA 898DE4FEFFFF            mov dword ptr [ebp+FFFFFEE4], ecx
:0041C8D0 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:0041C8D6 8995E8FEFFFF            mov dword ptr [ebp+FFFFFEE8], edx
:0041C8DC 8B85C8FEFFFF            mov eax, dword ptr [ebp+FFFFFEC8]
:0041C8E2 8B4804                  mov ecx, dword ptr [eax+04]
:0041C8E5 E8766AFEFF              call 00403360
:0041C8EA 668B08                  mov cx, word ptr [eax]
:0041C8ED 51                      push ecx
:0041C8EE 8D95E0FEFFFF            lea edx, dword ptr [ebp+FFFFFEE0]
:0041C8F4 52                      push edx
:0041C8F5 E825310300              call 0044FA1F
:0041C8FA 83C408                  add esp, 00000008
:0041C8FD E8D91C0000              call 0041E5DB
:0041C902 8B85E1FEFFFF            mov eax, dword ptr [ebp+FFFFFEE1]
:0041C908 25FF000000              and eax, 000000FF
:0041C90D 50                      push eax
:0041C90E 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:0041C914 81E1FF000000            and ecx, 000000FF
:0041C91A 51                      push ecx
:0041C91B E8D96DFEFF              call 004036F9
:0041C920 83C408                  add esp, 00000008
:0041C923 6A04                    push 00000004
:0041C925 6A00                    push 00000000
:0041C927 8B95C8FEFFFF            mov edx, dword ptr [ebp+FFFFFEC8]
:0041C92D 33C0                    xor eax, eax
:0041C92F 8A4202                  mov al, byte ptr [edx+02]
:0041C932 69C000630000            imul eax, 00006300
:0041C938 0500360000              add eax, 00003600
:0041C93D 50                      push eax
:0041C93E B980AB4A00              mov ecx, 004AAB80
:0041C943 E8F8300600              call 0047FA40
:0041C948 50                      push eax
:0041C949 8B8DC8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC8]
:0041C94F 8A5102                  mov dl, byte ptr [ecx+02]
:0041C952 52                      push edx
:0041C953 6A30                    push 00000030
:0041C955 6A30                    push 00000030
:0041C957 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:0041C95D 50                      push eax
:0041C95E 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:0041C964 51                      push ecx
:0041C965 E8124A0300              call 0045137C
:0041C96A 83C418                  add esp, 00000018
:0041C96D 6A04                    push 00000004
:0041C96F 6A04                    push 00000004
:0041C971 6A00                    push 00000000
:0041C973 6800090000              push 00000900
:0041C978 B9C8E44A00              mov ecx, 004AE4C8
:0041C97D E8BE300600              call 0047FA40
:0041C982 50                      push eax
:0041C983 6A20                    push 00000020
:0041C985 6A20                    push 00000020
:0041C987 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:0041C98D 83C210                  add edx, 00000010
:0041C990 52                      push edx
:0041C991 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:0041C997 83C008                  add eax, 00000008
:0041C99A 50                      push eax
:0041C99B E8734F0300              call 00451913
:0041C9A0 83C418                  add esp, 00000018
:0041C9A3 E84E1C0000              call 0041E5F6
:0041C9A8 6A05                    push 00000005
:0041C9AA B9181B4B00              mov ecx, 004B1B18
:0041C9AF E88C69FEFF              call 00403340
:0041C9B4 E827FB0000              call 0042C4E0
:0041C9B9 6A01                    push 00000001
:0041C9BB 6A29                    push 00000029
:0041C9BD B9B0694B00              mov ecx, 004B69B0
:0041C9C2 E8B37C0500              call 0047467A
:0041C9C7 E80F1C0000              call 0041E5DB
:0041C9CC 8B8DE1FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE1]
:0041C9D2 81E1FF000000            and ecx, 000000FF
:0041C9D8 51                      push ecx
:0041C9D9 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:0041C9DF 81E2FF000000            and edx, 000000FF
:0041C9E5 52                      push edx
:0041C9E6 E80E6DFEFF              call 004036F9
:0041C9EB 83C408                  add esp, 00000008
:0041C9EE 6A04                    push 00000004
:0041C9F0 6A00                    push 00000000
:0041C9F2 6A00                    push 00000000
:0041C9F4 B9C8E44A00              mov ecx, 004AE4C8
:0041C9F9 E842300600              call 0047FA40
:0041C9FE 50                      push eax
:0041C9FF 8B85C8FEFFFF            mov eax, dword ptr [ebp+FFFFFEC8]
:0041CA05 8A4802                  mov cl, byte ptr [eax+02]
:0041CA08 51                      push ecx
:0041CA09 6A30                    push 00000030
:0041CA0B 6A30                    push 00000030
:0041CA0D 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:0041CA13 52                      push edx
:0041CA14 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:0041CA1A 50                      push eax
:0041CA1B E85C490300              call 0045137C
:0041CA20 83C418                  add esp, 00000018
:0041CA23 6A04                    push 00000004
:0041CA25 6A04                    push 00000004
:0041CA27 6A00                    push 00000000
:0041CA29 6800090000              push 00000900
:0041CA2E B9C8E44A00              mov ecx, 004AE4C8
:0041CA33 E808300600              call 0047FA40
:0041CA38 50                      push eax
:0041CA39 6A20                    push 00000020
:0041CA3B 6A20                    push 00000020
:0041CA3D 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:0041CA43 51                      push ecx
:0041CA44 8B95E4FEFFFF            mov edx, dword ptr [ebp+FFFFFEE4]
:0041CA4A 83C208                  add edx, 00000008
:0041CA4D 52                      push edx
:0041CA4E E8C04E0300              call 00451913
:0041CA53 83C418                  add esp, 00000018
:0041CA56 E89B1B0000              call 0041E5F6
:0041CA5B 6A0A                    push 0000000A
:0041CA5D B9181B4B00              mov ecx, 004B1B18
:0041CA62 E8D968FEFF              call 00403340
:0041CA67 E874FA0000              call 0042C4E0
:0041CA6C E86A1B0000              call 0041E5DB
:0041CA71 8B85E1FEFFFF            mov eax, dword ptr [ebp+FFFFFEE1]
:0041CA77 25FF000000              and eax, 000000FF
:0041CA7C 50                      push eax
:0041CA7D 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:0041CA83 81E1FF000000            and ecx, 000000FF
:0041CA89 51                      push ecx
:0041CA8A E86A6CFEFF              call 004036F9
:0041CA8F 83C408                  add esp, 00000008
:0041CA92 6A04                    push 00000004
:0041CA94 6A00                    push 00000000
:0041CA96 6A00                    push 00000000
:0041CA98 B9C8E44A00              mov ecx, 004AE4C8
:0041CA9D E89E2F0600              call 0047FA40
:0041CAA2 50                      push eax
:0041CAA3 8B95C8FEFFFF            mov edx, dword ptr [ebp+FFFFFEC8]
:0041CAA9 8A4202                  mov al, byte ptr [edx+02]
:0041CAAC 50                      push eax
:0041CAAD 6A30                    push 00000030
:0041CAAF 6A30                    push 00000030
:0041CAB1 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:0041CAB7 51                      push ecx
:0041CAB8 8B95E4FEFFFF            mov edx, dword ptr [ebp+FFFFFEE4]
:0041CABE 52                      push edx
:0041CABF E8B8480300              call 0045137C
:0041CAC4 83C418                  add esp, 00000018
:0041CAC7 E82A1B0000              call 0041E5F6
:0041CACC 8B85C8FEFFFF            mov eax, dword ptr [ebp+FFFFFEC8]
:0041CAD2 8B4808                  mov ecx, dword ptr [eax+08]
:0041CAD5 E88668FEFF              call 00403360
:0041CADA 668B08                  mov cx, word ptr [eax]
:0041CADD 51                      push ecx
:0041CADE E89B2F0300              call 0044FA7E
:0041CAE3 83C404                  add esp, 00000004
:0041CAE6 8985D0FEFFFF            mov dword ptr [ebp+FFFFFED0], eax
:0041CAEC 8995D4FEFFFF            mov dword ptr [ebp+FFFFFED4], edx
:0041CAF2 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:0041CAF8 8995E4FEFFFF            mov dword ptr [ebp+FFFFFEE4], edx
:0041CAFE 8B85D4FEFFFF            mov eax, dword ptr [ebp+FFFFFED4]
:0041CB04 8985E8FEFFFF            mov dword ptr [ebp+FFFFFEE8], eax
:0041CB0A 8B8DC8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC8]
:0041CB10 8B4908                  mov ecx, dword ptr [ecx+08]
:0041CB13 E84868FEFF              call 00403360
:0041CB18 668B10                  mov dx, word ptr [eax]
:0041CB1B 52                      push edx
:0041CB1C 8D85CCFEFFFF            lea eax, dword ptr [ebp+FFFFFECC]
:0041CB22 50                      push eax
:0041CB23 E8F72E0300              call 0044FA1F
:0041CB28 83C408                  add esp, 00000008
:0041CB2B 50                      push eax
:0041CB2C 8D8DE0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE0]
:0041CB32 E8699AFEFF              call 004065A0
:0041CB37 C785ECFEFFFF00000000    mov dword ptr [ebp+FFFFFEEC], 00000000
:0041CB41 EB0F                    jmp 0041CB52

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041CC41(U)
|
:0041CB43 8B8DECFEFFFF            mov ecx, dword ptr [ebp+FFFFFEEC]
:0041CB49 83C101                  add ecx, 00000001
:0041CB4C 898DECFEFFFF            mov dword ptr [ebp+FFFFFEEC], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041CB41(U)
|
:0041CB52 83BDECFEFFFF10          cmp dword ptr [ebp+FFFFFEEC], 00000010
:0041CB59 0F83E7000000            jnb 0041CC46
:0041CB5F E8771A0000              call 0041E5DB
:0041CB64 8B95C8FEFFFF            mov edx, dword ptr [ebp+FFFFFEC8]
:0041CB6A 8B4A08                  mov ecx, dword ptr [edx+08]
:0041CB6D E857310200              call 0043FCC9
:0041CB72 6A04                    push 00000004
:0041CB74 6A00                    push 00000000
:0041CB76 6800720000              push 00007200
:0041CB7B B9C8E44A00              mov ecx, 004AE4C8
:0041CB80 E8BB2E0600              call 0047FA40
:0041CB85 50                      push eax
:0041CB86 6A20                    push 00000020
:0041CB88 6A20                    push 00000020
:0041CB8A 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:0041CB90 50                      push eax
:0041CB91 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:0041CB97 83C108                  add ecx, 00000008
:0041CB9A 51                      push ecx
:0041CB9B E8B1160600              call 0047E251
:0041CBA0 83C414                  add esp, 00000014
:0041CBA3 6A00                    push 00000000
:0041CBA5 6A00                    push 00000000
:0041CBA7 6A01                    push 00000001
:0041CBA9 8A95ECFEFFFF            mov dl, byte ptr [ebp+FFFFFEEC]
:0041CBAF 52                      push edx
:0041CBB0 6A04                    push 00000004
:0041CBB2 6A00                    push 00000000
:0041CBB4 6800690000              push 00006900
:0041CBB9 B9C8E44A00              mov ecx, 004AE4C8
:0041CBBE E87D2E0600              call 0047FA40
:0041CBC3 50                      push eax
:0041CBC4 6A04                    push 00000004
:0041CBC6 6A00                    push 00000000
:0041CBC8 6800720000              push 00007200
:0041CBCD B9C8E44A00              mov ecx, 004AE4C8
:0041CBD2 E8692E0600              call 0047FA40
:0041CBD7 50                      push eax
:0041CBD8 6A04                    push 00000004
:0041CBDA 6A00                    push 00000000
:0041CBDC 6800090000              push 00000900
:0041CBE1 B9C8E44A00              mov ecx, 004AE4C8
:0041CBE6 E8552E0600              call 0047FA40
:0041CBEB 50                      push eax
:0041CBEC 6A20                    push 00000020
:0041CBEE 6A20                    push 00000020
:0041CBF0 E865310100              call 0042FD5A
:0041CBF5 83C424                  add esp, 00000024
:0041CBF8 6A04                    push 00000004
:0041CBFA 6A04                    push 00000004
:0041CBFC 6A00                    push 00000000
:0041CBFE 6800690000              push 00006900
:0041CC03 B9C8E44A00              mov ecx, 004AE4C8
:0041CC08 E8332E0600              call 0047FA40
:0041CC0D 50                      push eax
:0041CC0E 6A20                    push 00000020
:0041CC10 6A20                    push 00000020
:0041CC12 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:0041CC18 50                      push eax
:0041CC19 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:0041CC1F 83C108                  add ecx, 00000008
:0041CC22 51                      push ecx
:0041CC23 E8EB4C0300              call 00451913
:0041CC28 83C418                  add esp, 00000018
:0041CC2B E8C6190000              call 0041E5F6
:0041CC30 6A01                    push 00000001
:0041CC32 B9181B4B00              mov ecx, 004B1B18
:0041CC37 E80467FEFF              call 00403340
:0041CC3C E89FF80000              call 0042C4E0
:0041CC41 E9FDFEFFFF              jmp 0041CB43

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041CB59(C)
|
:0041CC46 8B5508                  mov edx, dword ptr [ebp+08]
:0041CC49 81E2FF000000            and edx, 000000FF
:0041CC4F 81FAFF000000            cmp edx, 000000FF
:0041CC55 7459                    je 0041CCB0
:0041CC57 68004C0400              push 00044C00
:0041CC5C 6A04                    push 00000004
:0041CC5E 6A00                    push 00000000
:0041CC60 6A00                    push 00000000
:0041CC62 B9C8E44A00              mov ecx, 004AE4C8
:0041CC67 E8D42D0600              call 0047FA40
:0041CC6C 50                      push eax
:0041CC6D 8A4508                  mov al, byte ptr [ebp+08]
:0041CC70 50                      push eax

* Possible StringData Ref from Data Obj ->"MEFF.E5"
                                  |
:0041CC71 68F8BB4800              push 0048BBF8
:0041CC76 B9B0174900              mov ecx, 004917B0
:0041CC7B E87848FEFF              call 004014F8
:0041CC80 8B8DC8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC8]
:0041CC86 8A5103                  mov dl, byte ptr [ecx+03]
:0041CC89 52                      push edx
:0041CC8A B9B0174900              mov ecx, 004917B0
:0041CC8F E8A851FEFF              call 00401E3C
:0041CC94 85C0                    test eax, eax
:0041CC96 740E                    je 0041CCA6
:0041CC98 6A01                    push 00000001
:0041CC9A 6A00                    push 00000000
:0041CC9C B9B0174900              mov ecx, 004917B0
:0041CCA1 E8B651FEFF              call 00401E5C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041CC96(C)
|
:0041CCA6 B9B0174900              mov ecx, 004917B0
:0041CCAB E8FB49FEFF              call 004016AB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041CC55(C)
|
:0041CCB0 8B85C8FEFFFF            mov eax, dword ptr [ebp+FFFFFEC8]
:0041CCB6 C7401C01000000          mov [eax+1C], 00000001
:0041CCBD C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0041CCC4 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0041CCCA E80166FEFF              call 004032D0
:0041CCCF 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041CCD2 64890D00000000          mov dword ptr fs:[00000000], ecx
:0041CCD9 8BE5                    mov esp, ebp
:0041CCDB 5D                      pop ebp
:0041CCDC C20400                  ret 0004



* Referenced by a CALL at Address:
|:0041DC8F   
|
:0041CCDF 55                      push ebp
:0041CCE0 8BEC                    mov ebp, esp
:0041CCE2 83EC08                  sub esp, 00000008
:0041CCE5 894DF8                  mov dword ptr [ebp-08], ecx
:0041CCE8 837D0800                cmp dword ptr [ebp+08], 00000000
:0041CCEC 746C                    je 0041CD5A
:0041CCEE 8B45F8                  mov eax, dword ptr [ebp-08]
:0041CCF1 8A08                    mov cl, byte ptr [eax]
:0041CCF3 51                      push ecx
:0041CCF4 6A04                    push 00000004
:0041CCF6 8B55F8                  mov edx, dword ptr [ebp-08]
:0041CCF9 8A4218                  mov al, byte ptr [edx+18]
:0041CCFC 50                      push eax
:0041CCFD 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041CD00 8A5102                  mov dl, byte ptr [ecx+02]
:0041CD03 52                      push edx
:0041CD04 B950424B00              mov ecx, 004B4250
:0041CD09 E82F860300              call 0045533D
:0041CD0E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041CD11 884103                  mov byte ptr [ecx+03], al
:0041CD14 8B55F8                  mov edx, dword ptr [ebp-08]
:0041CD17 33C0                    xor eax, eax
:0041CD19 8A4203                  mov al, byte ptr [edx+03]
:0041CD1C 3DFF000000              cmp eax, 000000FF
:0041CD21 7505                    jne 0041CD28
:0041CD23 E90F010000              jmp 0041CE37

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041CD21(C)
|
:0041CD28 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041CD2B 33D2                    xor edx, edx
:0041CD2D 8A5103                  mov dl, byte ptr [ecx+03]
:0041CD30 6BD224                  imul edx, 00000024
:0041CD33 81C2502C4B00            add edx, 004B2C50
:0041CD39 8B45F8                  mov eax, dword ptr [ebp-08]
:0041CD3C 895008                  mov dword ptr [eax+08], edx
:0041CD3F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041CD42 8B4908                  mov ecx, dword ptr [ecx+08]
:0041CD45 E826290400              call 0045F670
:0041CD4A 6BC048                  imul eax, 00000048
:0041CD4D 05681B4A00              add eax, 004A1B68
:0041CD52 8B55F8                  mov edx, dword ptr [ebp-08]
:0041CD55 894210                  mov dword ptr [edx+10], eax
:0041CD58 EB24                    jmp 0041CD7E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041CCEC(C)
|
:0041CD5A 8B45F8                  mov eax, dword ptr [ebp-08]
:0041CD5D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041CD60 8A5102                  mov dl, byte ptr [ecx+02]
:0041CD63 885003                  mov byte ptr [eax+03], dl
:0041CD66 8B45F8                  mov eax, dword ptr [ebp-08]
:0041CD69 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041CD6C 8B5104                  mov edx, dword ptr [ecx+04]
:0041CD6F 895008                  mov dword ptr [eax+08], edx
:0041CD72 8B45F8                  mov eax, dword ptr [ebp-08]
:0041CD75 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041CD78 8B510C                  mov edx, dword ptr [ecx+0C]
:0041CD7B 895010                  mov dword ptr [eax+10], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041CD58(U)
|
:0041CD7E 6A00                    push 00000000
:0041CD80 8B45F8                  mov eax, dword ptr [ebp-08]
:0041CD83 8A4803                  mov cl, byte ptr [eax+03]
:0041CD86 51                      push ecx
:0041CD87 8B55F8                  mov edx, dword ptr [ebp-08]
:0041CD8A 8A02                    mov al, byte ptr [edx]
:0041CD8C 50                      push eax
:0041CD8D E857F7FFFF              call 0041C4E9
:0041CD92 83C40C                  add esp, 0000000C
:0041CD95 85C0                    test eax, eax
:0041CD97 7505                    jne 0041CD9E
:0041CD99 E999000000              jmp 0041CE37

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041CD97(C)
|
:0041CD9E 6A00                    push 00000000
:0041CDA0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041CDA3 8A11                    mov dl, byte ptr [ecx]
:0041CDA5 52                      push edx
:0041CDA6 8B45F8                  mov eax, dword ptr [ebp-08]
:0041CDA9 8B4808                  mov ecx, dword ptr [eax+08]
:0041CDAC E87DF60100              call 0043C42E
:0041CDB1 8945FC                  mov dword ptr [ebp-04], eax
:0041CDB4 68FF000000              push 000000FF
:0041CDB9 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041CDBC E8A1F9FFFF              call 0041C762
:0041CDC1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041CDC4 8B4908                  mov ecx, dword ptr [ecx+08]
:0041CDC7 E89465FEFF              call 00403360
:0041CDCC 50                      push eax
:0041CDCD 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041CDD0 83C119                  add ecx, 00000019
:0041CDD3 E8C897FEFF              call 004065A0
:0041CDD8 8B55F8                  mov edx, dword ptr [ebp-08]
:0041CDDB 8A4202                  mov al, byte ptr [edx+02]
:0041CDDE 50                      push eax
:0041CDDF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041CDE2 8A511A                  mov dl, byte ptr [ecx+1A]
:0041CDE5 52                      push edx
:0041CDE6 8B45F8                  mov eax, dword ptr [ebp-08]
:0041CDE9 8A4819                  mov cl, byte ptr [eax+19]
:0041CDEC 51                      push ecx
:0041CDED B950424B00              mov ecx, 004B4250
:0041CDF2 E82C830300              call 00455123
:0041CDF7 6A01                    push 00000001
:0041CDF9 6A00                    push 00000000
:0041CDFB 6A00                    push 00000000
:0041CDFD 6A00                    push 00000000
:0041CDFF 6A00                    push 00000000
:0041CE01 8B55FC                  mov edx, dword ptr [ebp-04]
:0041CE04 F7DA                    neg edx
:0041CE06 52                      push edx
:0041CE07 8B45F8                  mov eax, dword ptr [ebp-08]
:0041CE0A 8A4802                  mov cl, byte ptr [eax+02]
:0041CE0D 51                      push ecx
:0041CE0E 8B55F8                  mov edx, dword ptr [ebp-08]
:0041CE11 8A4203                  mov al, byte ptr [edx+03]
:0041CE14 50                      push eax
:0041CE15 E86A3B0300              call 00450984
:0041CE1A 83C420                  add esp, 00000020
:0041CE1D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041CE20 8B4908                  mov ecx, dword ptr [ecx+08]
:0041CE23 E8685E0500              call 00472C90
:0041CE28 0345FC                  add eax, dword ptr [ebp-04]
:0041CE2B 50                      push eax
:0041CE2C 8B55F8                  mov edx, dword ptr [ebp-08]
:0041CE2F 8B4A08                  mov ecx, dword ptr [edx+08]
:0041CE32 E896280200              call 0043F6CD

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041CD23(U), :0041CD99(U)
|
:0041CE37 8BE5                    mov esp, ebp
:0041CE39 5D                      pop ebp
:0041CE3A C20400                  ret 0004



* Referenced by a CALL at Address:
|:0041DC99   
|
:0041CE3D 55                      push ebp
:0041CE3E 8BEC                    mov ebp, esp
:0041CE40 83EC08                  sub esp, 00000008
:0041CE43 894DF8                  mov dword ptr [ebp-08], ecx
:0041CE46 8B45F8                  mov eax, dword ptr [ebp-08]
:0041CE49 8A08                    mov cl, byte ptr [eax]
:0041CE4B 51                      push ecx
:0041CE4C 6A04                    push 00000004
:0041CE4E 8B55F8                  mov edx, dword ptr [ebp-08]
:0041CE51 8A4218                  mov al, byte ptr [edx+18]
:0041CE54 50                      push eax
:0041CE55 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041CE58 8A5102                  mov dl, byte ptr [ecx+02]
:0041CE5B 52                      push edx
:0041CE5C B950424B00              mov ecx, 004B4250
:0041CE61 E8D7840300              call 0045533D
:0041CE66 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041CE69 884103                  mov byte ptr [ecx+03], al
:0041CE6C 8B55F8                  mov edx, dword ptr [ebp-08]
:0041CE6F 33C0                    xor eax, eax
:0041CE71 8A4203                  mov al, byte ptr [edx+03]
:0041CE74 3DFF000000              cmp eax, 000000FF
:0041CE79 7505                    jne 0041CE80
:0041CE7B E9DD000000              jmp 0041CF5D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041CE79(C)
|
:0041CE80 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041CE83 33D2                    xor edx, edx
:0041CE85 8A5103                  mov dl, byte ptr [ecx+03]
:0041CE88 6BD224                  imul edx, 00000024
:0041CE8B 81C2502C4B00            add edx, 004B2C50
:0041CE91 8B45F8                  mov eax, dword ptr [ebp-08]
:0041CE94 895008                  mov dword ptr [eax+08], edx
:0041CE97 6A00                    push 00000000
:0041CE99 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041CE9C 8A5103                  mov dl, byte ptr [ecx+03]
:0041CE9F 52                      push edx
:0041CEA0 8B45F8                  mov eax, dword ptr [ebp-08]
:0041CEA3 8A08                    mov cl, byte ptr [eax]
:0041CEA5 51                      push ecx
:0041CEA6 E83EF6FFFF              call 0041C4E9
:0041CEAB 83C40C                  add esp, 0000000C
:0041CEAE 85C0                    test eax, eax
:0041CEB0 7505                    jne 0041CEB7
:0041CEB2 E9A6000000              jmp 0041CF5D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041CEB0(C)
|
:0041CEB7 6A00                    push 00000000
:0041CEB9 8B55F8                  mov edx, dword ptr [ebp-08]
:0041CEBC 8A02                    mov al, byte ptr [edx]
:0041CEBE 50                      push eax
:0041CEBF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041CEC2 8B4908                  mov ecx, dword ptr [ecx+08]
:0041CEC5 E864F50100              call 0043C42E
:0041CECA 8845FC                  mov byte ptr [ebp-04], al
:0041CECD 68FF000000              push 000000FF
:0041CED2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041CED5 E888F8FFFF              call 0041C762
:0041CEDA 8B55F8                  mov edx, dword ptr [ebp-08]
:0041CEDD 8B4A08                  mov ecx, dword ptr [edx+08]
:0041CEE0 E87B64FEFF              call 00403360
:0041CEE5 50                      push eax
:0041CEE6 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041CEE9 83C119                  add ecx, 00000019
:0041CEEC E8AF96FEFF              call 004065A0
:0041CEF1 8B45F8                  mov eax, dword ptr [ebp-08]
:0041CEF4 8A4802                  mov cl, byte ptr [eax+02]
:0041CEF7 51                      push ecx
:0041CEF8 8B55F8                  mov edx, dword ptr [ebp-08]
:0041CEFB 8A421A                  mov al, byte ptr [edx+1A]
:0041CEFE 50                      push eax
:0041CEFF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041CF02 8A5119                  mov dl, byte ptr [ecx+19]
:0041CF05 52                      push edx
:0041CF06 B950424B00              mov ecx, 004B4250
:0041CF0B E813820300              call 00455123
:0041CF10 6A01                    push 00000001
:0041CF12 6A00                    push 00000000
:0041CF14 6A00                    push 00000000
:0041CF16 6A00                    push 00000000
:0041CF18 8B45FC                  mov eax, dword ptr [ebp-04]
:0041CF1B 25FF000000              and eax, 000000FF
:0041CF20 F7D8                    neg eax
:0041CF22 50                      push eax
:0041CF23 6A00                    push 00000000
:0041CF25 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041CF28 8A5102                  mov dl, byte ptr [ecx+02]
:0041CF2B 52                      push edx
:0041CF2C 8B45F8                  mov eax, dword ptr [ebp-08]
:0041CF2F 8A4803                  mov cl, byte ptr [eax+03]
:0041CF32 51                      push ecx
:0041CF33 E84C3A0300              call 00450984
:0041CF38 83C420                  add esp, 00000020
:0041CF3B 8B55F8                  mov edx, dword ptr [ebp-08]
:0041CF3E 8B4A08                  mov ecx, dword ptr [edx+08]
:0041CF41 E8FA580500              call 00472840
:0041CF46 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041CF49 81E1FF000000            and ecx, 000000FF
:0041CF4F 03C1                    add eax, ecx
:0041CF51 50                      push eax
:0041CF52 8B55F8                  mov edx, dword ptr [ebp-08]
:0041CF55 8B4A08                  mov ecx, dword ptr [edx+08]
:0041CF58 E8B1270200              call 0043F70E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041CE7B(U), :0041CEB2(U)
|
:0041CF5D 8BE5                    mov esp, ebp
:0041CF5F 5D                      pop ebp
:0041CF60 C3                      ret



* Referenced by a CALL at Address:
|:0041DCA3   
|
:0041CF61 55                      push ebp
:0041CF62 8BEC                    mov ebp, esp
:0041CF64 83EC08                  sub esp, 00000008
:0041CF67 894DFC                  mov dword ptr [ebp-04], ecx
:0041CF6A 8B45FC                  mov eax, dword ptr [ebp-04]
:0041CF6D 8A08                    mov cl, byte ptr [eax]
:0041CF6F 51                      push ecx
:0041CF70 6A04                    push 00000004
:0041CF72 8B55FC                  mov edx, dword ptr [ebp-04]
:0041CF75 8A4218                  mov al, byte ptr [edx+18]
:0041CF78 50                      push eax
:0041CF79 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041CF7C 8A5102                  mov dl, byte ptr [ecx+02]
:0041CF7F 52                      push edx
:0041CF80 B950424B00              mov ecx, 004B4250
:0041CF85 E8B3830300              call 0045533D
:0041CF8A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041CF8D 884103                  mov byte ptr [ecx+03], al
:0041CF90 8B55FC                  mov edx, dword ptr [ebp-04]
:0041CF93 33C0                    xor eax, eax
:0041CF95 8A4203                  mov al, byte ptr [edx+03]
:0041CF98 3DFF000000              cmp eax, 000000FF
:0041CF9D 7505                    jne 0041CFA4
:0041CF9F E9C4000000              jmp 0041D068

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041CF9D(C)
|
:0041CFA4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041CFA7 33D2                    xor edx, edx
:0041CFA9 8A5103                  mov dl, byte ptr [ecx+03]
:0041CFAC 6BD224                  imul edx, 00000024
:0041CFAF 81C2502C4B00            add edx, 004B2C50
:0041CFB5 8B45FC                  mov eax, dword ptr [ebp-04]
:0041CFB8 895008                  mov dword ptr [eax+08], edx
:0041CFBB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041CFBE 8B4908                  mov ecx, dword ptr [ecx+08]
:0041CFC1 E8AA260400              call 0045F670
:0041CFC6 6BC048                  imul eax, 00000048
:0041CFC9 05681B4A00              add eax, 004A1B68
:0041CFCE 8B55FC                  mov edx, dword ptr [ebp-04]
:0041CFD1 894210                  mov dword ptr [edx+10], eax
:0041CFD4 6A00                    push 00000000
:0041CFD6 8B45FC                  mov eax, dword ptr [ebp-04]
:0041CFD9 8A4803                  mov cl, byte ptr [eax+03]
:0041CFDC 51                      push ecx
:0041CFDD 8B55FC                  mov edx, dword ptr [ebp-04]
:0041CFE0 8A02                    mov al, byte ptr [edx]
:0041CFE2 50                      push eax
:0041CFE3 E801F5FFFF              call 0041C4E9
:0041CFE8 83C40C                  add esp, 0000000C
:0041CFEB 85C0                    test eax, eax
:0041CFED 7502                    jne 0041CFF1
:0041CFEF EB77                    jmp 0041D068

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041CFED(C)
|
:0041CFF1 6A2C                    push 0000002C
:0041CFF3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041CFF6 E867F7FFFF              call 0041C762
:0041CFFB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041CFFE 33D2                    xor edx, edx
:0041D000 8A5101                  mov dl, byte ptr [ecx+01]
:0041D003 8955F8                  mov dword ptr [ebp-08], edx
:0041D006 8B45F8                  mov eax, dword ptr [ebp-08]
:0041D009 83E841                  sub eax, 00000041
:0041D00C 8945F8                  mov dword ptr [ebp-08], eax
:0041D00F 837DF804                cmp dword ptr [ebp-08], 00000004
:0041D013 7753                    ja 0041D068
:0041D015 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041D018 FF248D6CD04100          jmp dword ptr [4*ecx+0041D06C]
:0041D01F 6A08                    push 00000008
:0041D021 8B55FC                  mov edx, dword ptr [ebp-04]
:0041D024 8B4A08                  mov ecx, dword ptr [edx+08]
:0041D027 E874BDFFFF              call 00418DA0
:0041D02C EB3A                    jmp 0041D068
:0041D02E 6A10                    push 00000010
:0041D030 8B45FC                  mov eax, dword ptr [ebp-04]
:0041D033 8B4808                  mov ecx, dword ptr [eax+08]
:0041D036 E865BDFFFF              call 00418DA0
:0041D03B EB2B                    jmp 0041D068
:0041D03D 6A02                    push 00000002
:0041D03F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041D042 8B4908                  mov ecx, dword ptr [ecx+08]
:0041D045 E856BDFFFF              call 00418DA0
:0041D04A EB1C                    jmp 0041D068
:0041D04C 6A04                    push 00000004
:0041D04E 8B55FC                  mov edx, dword ptr [ebp-04]
:0041D051 8B4A08                  mov ecx, dword ptr [edx+08]
:0041D054 E847BDFFFF              call 00418DA0
:0041D059 EB0D                    jmp 0041D068
:0041D05B 6A1E                    push 0000001E
:0041D05D 8B45FC                  mov eax, dword ptr [ebp-04]
:0041D060 8B4808                  mov ecx, dword ptr [eax+08]
:0041D063 E838BDFFFF              call 00418DA0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041CF9F(U), :0041CFEF(U), :0041D013(C), :0041D02C(U), :0041D03B(U)
|:0041D04A(U), :0041D059(U)
|
:0041D068 8BE5                    mov esp, ebp
:0041D06A 5D                      pop ebp
:0041D06B C3                      ret



:0041D06C 1FD04100                DWORD 0041D01F
:0041D070 2ED04100                DWORD 0041D02E
:0041D074 3DD04100                DWORD 0041D03D
:0041D078 4CD04100                DWORD 0041D04C
:0041D07C 5BD04100                DWORD 0041D05B



* Referenced by a CALL at Address:
|:0041DCAD   
|
:0041D080 55                      push ebp
:0041D081 8BEC                    mov ebp, esp
:0041D083 83EC20                  sub esp, 00000020
:0041D086 894DE8                  mov dword ptr [ebp-18], ecx
:0041D089 C645EC00                mov [ebp-14], 00
:0041D08D C645F400                mov [ebp-0C], 00
:0041D091 8B45E8                  mov eax, dword ptr [ebp-18]
:0041D094 8B4814                  mov ecx, dword ptr [eax+14]
:0041D097 E8D40C0000              call 0041DD70
:0041D09C 25FF000000              and eax, 000000FF
:0041D0A1 99                      cdq
:0041D0A2 2BC2                    sub eax, edx
:0041D0A4 D1F8                    sar eax, 1
:0041D0A6 8845F0                  mov byte ptr [ebp-10], al
:0041D0A9 C645FCFF                mov [ebp-04], FF
:0041D0AD 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041D0B0 8A11                    mov dl, byte ptr [ecx]
:0041D0B2 52                      push edx
:0041D0B3 6A04                    push 00000004
:0041D0B5 8B45E8                  mov eax, dword ptr [ebp-18]
:0041D0B8 8A4818                  mov cl, byte ptr [eax+18]
:0041D0BB 51                      push ecx
:0041D0BC 8B55E8                  mov edx, dword ptr [ebp-18]
:0041D0BF 8A4202                  mov al, byte ptr [edx+02]
:0041D0C2 50                      push eax
:0041D0C3 B950424B00              mov ecx, 004B4250
:0041D0C8 E870820300              call 0045533D
:0041D0CD 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041D0D0 884103                  mov byte ptr [ecx+03], al
:0041D0D3 8B55E8                  mov edx, dword ptr [ebp-18]
:0041D0D6 33C0                    xor eax, eax
:0041D0D8 8A4203                  mov al, byte ptr [edx+03]
:0041D0DB 3DFF000000              cmp eax, 000000FF
:0041D0E0 7505                    jne 0041D0E7
:0041D0E2 E9C6020000              jmp 0041D3AD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D0E0(C)
|
:0041D0E7 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041D0EA 33D2                    xor edx, edx
:0041D0EC 8A5103                  mov dl, byte ptr [ecx+03]
:0041D0EF 6BD224                  imul edx, 00000024
:0041D0F2 81C2502C4B00            add edx, 004B2C50
:0041D0F8 8B45E8                  mov eax, dword ptr [ebp-18]
:0041D0FB 895008                  mov dword ptr [eax+08], edx
:0041D0FE 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041D101 8B4908                  mov ecx, dword ptr [ecx+08]
:0041D104 E867250400              call 0045F670
:0041D109 6BC048                  imul eax, 00000048
:0041D10C 05681B4A00              add eax, 004A1B68
:0041D111 8B55E8                  mov edx, dword ptr [ebp-18]
:0041D114 894210                  mov dword ptr [edx+10], eax
:0041D117 6A00                    push 00000000
:0041D119 8B45E8                  mov eax, dword ptr [ebp-18]
:0041D11C 8A4803                  mov cl, byte ptr [eax+03]
:0041D11F 51                      push ecx
:0041D120 8B55E8                  mov edx, dword ptr [ebp-18]
:0041D123 8A02                    mov al, byte ptr [edx]
:0041D125 50                      push eax
:0041D126 E8BEF3FFFF              call 0041C4E9
:0041D12B 83C40C                  add esp, 0000000C
:0041D12E 85C0                    test eax, eax
:0041D130 7505                    jne 0041D137
:0041D132 E976020000              jmp 0041D3AD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D130(C)
|
:0041D137 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041D13A 33D2                    xor edx, edx
:0041D13C 8A5101                  mov dl, byte ptr [ecx+01]
:0041D13F 8955E4                  mov dword ptr [ebp-1C], edx
:0041D142 8B45E4                  mov eax, dword ptr [ebp-1C]
:0041D145 83E846                  sub eax, 00000046
:0041D148 8945E4                  mov dword ptr [ebp-1C], eax
:0041D14B 837DE404                cmp dword ptr [ebp-1C], 00000004
:0041D14F 0F8708010000            ja 0041D25D
:0041D155 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0041D158 FF248DB1D34100          jmp dword ptr [4*ecx+0041D3B1]
:0041D15F 8B55E8                  mov edx, dword ptr [ebp-18]
:0041D162 8B4A10                  mov ecx, dword ptr [edx+10]
:0041D165 E8060C0000              call 0041DD70
:0041D16A 8845EC                  mov byte ptr [ebp-14], al
:0041D16D 6A00                    push 00000000
:0041D16F 8B45E8                  mov eax, dword ptr [ebp-18]
:0041D172 8B4810                  mov ecx, dword ptr [eax+10]
:0041D175 E8B60C0000              call 0041DE30
:0041D17A 8845F4                  mov byte ptr [ebp-0C], al
:0041D17D 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041D180 8B4908                  mov ecx, dword ptr [ecx+08]
:0041D183 E8080E0000              call 0041DF90
:0041D188 8845F8                  mov byte ptr [ebp-08], al
:0041D18B C645FC22                mov [ebp-04], 22
:0041D18F E9C9000000              jmp 0041D25D
:0041D194 8B55E8                  mov edx, dword ptr [ebp-18]
:0041D197 8B4A10                  mov ecx, dword ptr [edx+10]
:0041D19A E8510C0000              call 0041DDF0
:0041D19F 8845EC                  mov byte ptr [ebp-14], al
:0041D1A2 6A00                    push 00000000
:0041D1A4 8B45E8                  mov eax, dword ptr [ebp-18]
:0041D1A7 8B4810                  mov ecx, dword ptr [eax+10]
:0041D1AA E8010D0000              call 0041DEB0
:0041D1AF 8845F4                  mov byte ptr [ebp-0C], al
:0041D1B2 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041D1B5 8B4908                  mov ecx, dword ptr [ecx+08]
:0041D1B8 E8130E0000              call 0041DFD0
:0041D1BD 8845F8                  mov byte ptr [ebp-08], al
:0041D1C0 C645FC22                mov [ebp-04], 22
:0041D1C4 E994000000              jmp 0041D25D
:0041D1C9 8B55E8                  mov edx, dword ptr [ebp-18]
:0041D1CC 8B4A10                  mov ecx, dword ptr [edx+10]
:0041D1CF E8DC0B0000              call 0041DDB0
:0041D1D4 8845EC                  mov byte ptr [ebp-14], al
:0041D1D7 6A00                    push 00000000
:0041D1D9 8B45E8                  mov eax, dword ptr [ebp-18]
:0041D1DC 8B4810                  mov ecx, dword ptr [eax+10]
:0041D1DF E88C0C0000              call 0041DE70
:0041D1E4 8845F4                  mov byte ptr [ebp-0C], al
:0041D1E7 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041D1EA 8B4908                  mov ecx, dword ptr [ecx+08]
:0041D1ED E8BE0D0000              call 0041DFB0
:0041D1F2 8845F8                  mov byte ptr [ebp-08], al
:0041D1F5 C645FC23                mov [ebp-04], 23
:0041D1F9 EB62                    jmp 0041D25D
:0041D1FB 8B55E8                  mov edx, dword ptr [ebp-18]
:0041D1FE 8B4A10                  mov ecx, dword ptr [edx+10]
:0041D201 E88A0D0000              call 0041DF90
:0041D206 8845EC                  mov byte ptr [ebp-14], al
:0041D209 6A00                    push 00000000
:0041D20B 8B45E8                  mov eax, dword ptr [ebp-18]
:0041D20E 8B4810                  mov ecx, dword ptr [eax+10]
:0041D211 E81A0D0000              call 0041DF30
:0041D216 8845F4                  mov byte ptr [ebp-0C], al
:0041D219 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041D21C 8B4908                  mov ecx, dword ptr [ecx+08]
:0041D21F E8CC0D0000              call 0041DFF0
:0041D224 8845F8                  mov byte ptr [ebp-08], al
:0041D227 C645FC24                mov [ebp-04], 24
:0041D22B EB30                    jmp 0041D25D
:0041D22D 8B55E8                  mov edx, dword ptr [ebp-18]
:0041D230 8B4A10                  mov ecx, dword ptr [edx+10]
:0041D233 E8780D0000              call 0041DFB0
:0041D238 8845EC                  mov byte ptr [ebp-14], al
:0041D23B 6A00                    push 00000000
:0041D23D 8B45E8                  mov eax, dword ptr [ebp-18]
:0041D240 8B4810                  mov ecx, dword ptr [eax+10]
:0041D243 E8A80C0000              call 0041DEF0
:0041D248 8845F4                  mov byte ptr [ebp-0C], al
:0041D24B 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041D24E 8B4908                  mov ecx, dword ptr [ecx+08]
:0041D251 E8BA0D0000              call 0041E010
:0041D256 8845F8                  mov byte ptr [ebp-08], al
:0041D259 C645FC25                mov [ebp-04], 25

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041D14F(C), :0041D18F(U), :0041D1C4(U), :0041D1F9(U), :0041D22B(U)
|
:0041D25D 68FF000000              push 000000FF
:0041D262 8A55F0                  mov dl, byte ptr [ebp-10]
:0041D265 52                      push edx
:0041D266 8A45EC                  mov al, byte ptr [ebp-14]
:0041D269 50                      push eax
:0041D26A E846280600              call 0047FAB5
:0041D26F 83C40C                  add esp, 0000000C
:0041D272 8845EC                  mov byte ptr [ebp-14], al
:0041D275 6A32                    push 00000032
:0041D277 8A4DF0                  mov cl, byte ptr [ebp-10]
:0041D27A 51                      push ecx
:0041D27B 8A55F4                  mov dl, byte ptr [ebp-0C]
:0041D27E 52                      push edx
:0041D27F E831280600              call 0047FAB5
:0041D284 83C40C                  add esp, 0000000C
:0041D287 8845F4                  mov byte ptr [ebp-0C], al
:0041D28A 8A45FC                  mov al, byte ptr [ebp-04]
:0041D28D 50                      push eax
:0041D28E 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041D291 E8CCF4FFFF              call 0041C762
:0041D296 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041D299 33D2                    xor edx, edx
:0041D29B 8A5101                  mov dl, byte ptr [ecx+01]
:0041D29E 8955E0                  mov dword ptr [ebp-20], edx
:0041D2A1 8B45E0                  mov eax, dword ptr [ebp-20]
:0041D2A4 83E846                  sub eax, 00000046
:0041D2A7 8945E0                  mov dword ptr [ebp-20], eax
:0041D2AA 837DE004                cmp dword ptr [ebp-20], 00000004
:0041D2AE 0F87F9000000            ja 0041D3AD
:0041D2B4 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0041D2B7 FF248DC5D34100          jmp dword ptr [4*ecx+0041D3C5]
:0041D2BE 8A55EC                  mov dl, byte ptr [ebp-14]
:0041D2C1 52                      push edx
:0041D2C2 8B45E8                  mov eax, dword ptr [ebp-18]
:0041D2C5 8B4810                  mov ecx, dword ptr [eax+10]
:0041D2C8 E8C30A0000              call 0041DD90
:0041D2CD 8A4DF4                  mov cl, byte ptr [ebp-0C]
:0041D2D0 51                      push ecx
:0041D2D1 8B55E8                  mov edx, dword ptr [ebp-18]
:0041D2D4 8B4A10                  mov ecx, dword ptr [edx+10]
:0041D2D7 E8740B0000              call 0041DE50
:0041D2DC 6A01                    push 00000001
:0041D2DE 6A00                    push 00000000
:0041D2E0 8B45E8                  mov eax, dword ptr [ebp-18]
:0041D2E3 8B4808                  mov ecx, dword ptr [eax+08]
:0041D2E6 E8A3260200              call 0043F98E
:0041D2EB E9BD000000              jmp 0041D3AD
:0041D2F0 8A4DEC                  mov cl, byte ptr [ebp-14]
:0041D2F3 51                      push ecx
:0041D2F4 8B55E8                  mov edx, dword ptr [ebp-18]
:0041D2F7 8B4A10                  mov ecx, dword ptr [edx+10]
:0041D2FA E8110B0000              call 0041DE10
:0041D2FF 8A45F4                  mov al, byte ptr [ebp-0C]
:0041D302 50                      push eax
:0041D303 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041D306 8B4910                  mov ecx, dword ptr [ecx+10]
:0041D309 E8C20B0000              call 0041DED0
:0041D30E 6A01                    push 00000001
:0041D310 6A02                    push 00000002
:0041D312 8B55E8                  mov edx, dword ptr [ebp-18]
:0041D315 8B4A08                  mov ecx, dword ptr [edx+08]
:0041D318 E871260200              call 0043F98E
:0041D31D E98B000000              jmp 0041D3AD
:0041D322 8A45EC                  mov al, byte ptr [ebp-14]
:0041D325 50                      push eax
:0041D326 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041D329 8B4910                  mov ecx, dword ptr [ecx+10]
:0041D32C E89F0A0000              call 0041DDD0
:0041D331 8A55F4                  mov dl, byte ptr [ebp-0C]
:0041D334 52                      push edx
:0041D335 8B45E8                  mov eax, dword ptr [ebp-18]
:0041D338 8B4810                  mov ecx, dword ptr [eax+10]
:0041D33B E8500B0000              call 0041DE90
:0041D340 6A01                    push 00000001
:0041D342 6A01                    push 00000001
:0041D344 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041D347 8B4908                  mov ecx, dword ptr [ecx+08]
:0041D34A E83F260200              call 0043F98E
:0041D34F EB5C                    jmp 0041D3AD
:0041D351 8A55EC                  mov dl, byte ptr [ebp-14]
:0041D354 52                      push edx
:0041D355 8B45E8                  mov eax, dword ptr [ebp-18]
:0041D358 8B4810                  mov ecx, dword ptr [eax+10]
:0041D35B E8F0E40300              call 0045B850
:0041D360 8A4DF4                  mov cl, byte ptr [ebp-0C]
:0041D363 51                      push ecx
:0041D364 8B55E8                  mov edx, dword ptr [ebp-18]
:0041D367 8B4A10                  mov ecx, dword ptr [edx+10]
:0041D36A E8E10B0000              call 0041DF50
:0041D36F 6A01                    push 00000001
:0041D371 6A03                    push 00000003
:0041D373 8B45E8                  mov eax, dword ptr [ebp-18]
:0041D376 8B4808                  mov ecx, dword ptr [eax+08]
:0041D379 E810260200              call 0043F98E
:0041D37E EB2D                    jmp 0041D3AD
:0041D380 8A4DEC                  mov cl, byte ptr [ebp-14]
:0041D383 51                      push ecx
:0041D384 8B55E8                  mov edx, dword ptr [ebp-18]
:0041D387 8B4A10                  mov ecx, dword ptr [edx+10]
:0041D38A E8E1E40300              call 0045B870
:0041D38F 8A45F4                  mov al, byte ptr [ebp-0C]
:0041D392 50                      push eax
:0041D393 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041D396 8B4910                  mov ecx, dword ptr [ecx+10]
:0041D399 E8720B0000              call 0041DF10
:0041D39E 6A01                    push 00000001
:0041D3A0 6A04                    push 00000004
:0041D3A2 8B55E8                  mov edx, dword ptr [ebp-18]
:0041D3A5 8B4A08                  mov ecx, dword ptr [edx+08]
:0041D3A8 E8E1250200              call 0043F98E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041D0E2(U), :0041D132(U), :0041D2AE(C), :0041D2EB(U), :0041D31D(U)
|:0041D34F(U), :0041D37E(U)
|
:0041D3AD 8BE5                    mov esp, ebp
:0041D3AF 5D                      pop ebp
:0041D3B0 C3                      ret



:0041D3B1 5FD14100                DWORD 0041D15F
:0041D3B5 94D14100                DWORD 0041D194
:0041D3B9 C9D14100                DWORD 0041D1C9
:0041D3BD FBD14100                DWORD 0041D1FB
:0041D3C1 2DD24100                DWORD 0041D22D
:0041D3C5 BED24100                DWORD 0041D2BE
:0041D3C9 F0D24100                DWORD 0041D2F0
:0041D3CD 22D34100                DWORD 0041D322
:0041D3D1 51D34100                DWORD 0041D351
:0041D3D5 80D34100                DWORD 0041D380



* Referenced by a CALL at Address:
|:0041DCB7   
|
:0041D3D9 55                      push ebp
:0041D3DA 8BEC                    mov ebp, esp
:0041D3DC 51                      push ecx
:0041D3DD 53                      push ebx
:0041D3DE 894DFC                  mov dword ptr [ebp-04], ecx
:0041D3E1 8B45FC                  mov eax, dword ptr [ebp-04]
:0041D3E4 8A08                    mov cl, byte ptr [eax]
:0041D3E6 51                      push ecx
:0041D3E7 6A04                    push 00000004
:0041D3E9 8B55FC                  mov edx, dword ptr [ebp-04]
:0041D3EC 8A4218                  mov al, byte ptr [edx+18]
:0041D3EF 50                      push eax
:0041D3F0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041D3F3 8A5102                  mov dl, byte ptr [ecx+02]
:0041D3F6 52                      push edx
:0041D3F7 B950424B00              mov ecx, 004B4250
:0041D3FC E83C7F0300              call 0045533D
:0041D401 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041D404 884103                  mov byte ptr [ecx+03], al
:0041D407 8B55FC                  mov edx, dword ptr [ebp-04]
:0041D40A 33C0                    xor eax, eax
:0041D40C 8A4203                  mov al, byte ptr [edx+03]
:0041D40F 3DFF000000              cmp eax, 000000FF
:0041D414 7505                    jne 0041D41B
:0041D416 E9BB000000              jmp 0041D4D6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D414(C)
|
:0041D41B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041D41E 33D2                    xor edx, edx
:0041D420 8A5103                  mov dl, byte ptr [ecx+03]
:0041D423 6BD224                  imul edx, 00000024
:0041D426 81C2502C4B00            add edx, 004B2C50
:0041D42C 8B45FC                  mov eax, dword ptr [ebp-04]
:0041D42F 895008                  mov dword ptr [eax+08], edx
:0041D432 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041D435 8B4908                  mov ecx, dword ptr [ecx+08]
:0041D438 E833220400              call 0045F670
:0041D43D 6BC048                  imul eax, 00000048
:0041D440 05681B4A00              add eax, 004A1B68
:0041D445 8B55FC                  mov edx, dword ptr [ebp-04]
:0041D448 894210                  mov dword ptr [edx+10], eax
:0041D44B 6A00                    push 00000000
:0041D44D 8B45FC                  mov eax, dword ptr [ebp-04]
:0041D450 8A4803                  mov cl, byte ptr [eax+03]
:0041D453 51                      push ecx
:0041D454 8B55FC                  mov edx, dword ptr [ebp-04]
:0041D457 8A02                    mov al, byte ptr [edx]
:0041D459 50                      push eax
:0041D45A E88AF0FFFF              call 0041C4E9
:0041D45F 83C40C                  add esp, 0000000C
:0041D462 85C0                    test eax, eax
:0041D464 7502                    jne 0041D468
:0041D466 EB6E                    jmp 0041D4D6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D464(C)
|
:0041D468 68FF000000              push 000000FF
:0041D46D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041D470 E8EDF2FFFF              call 0041C762
:0041D475 6A01                    push 00000001
:0041D477 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041D47A 8B4910                  mov ecx, dword ptr [ecx+10]
:0041D47D E8CE91FEFF              call 00406650
:0041D482 8AD8                    mov bl, al
:0041D484 81E3FF000000            and ebx, 000000FF
:0041D48A 8B55FC                  mov edx, dword ptr [ebp-04]
:0041D48D 8B4A14                  mov ecx, dword ptr [edx+14]
:0041D490 E8DB080000              call 0041DD70
:0041D495 25FF000000              and eax, 000000FF
:0041D49A 03D8                    add ebx, eax
:0041D49C 53                      push ebx
:0041D49D 8B45FC                  mov eax, dword ptr [ebp-04]
:0041D4A0 8B4810                  mov ecx, dword ptr [eax+10]
:0041D4A3 E8A8B4FEFF              call 00408950
:0041D4A8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041D4AB 8B4910                  mov ecx, dword ptr [ecx+10]
:0041D4AE E8689DFEFF              call 0040721B
:0041D4B3 50                      push eax
:0041D4B4 8B55FC                  mov edx, dword ptr [ebp-04]
:0041D4B7 8B4A08                  mov ecx, dword ptr [edx+08]
:0041D4BA E80E220200              call 0043F6CD
:0041D4BF 8B45FC                  mov eax, dword ptr [ebp-04]
:0041D4C2 8B4810                  mov ecx, dword ptr [eax+10]
:0041D4C5 E8809DFEFF              call 0040724A
:0041D4CA 50                      push eax
:0041D4CB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041D4CE 8B4908                  mov ecx, dword ptr [ecx+08]
:0041D4D1 E838220200              call 0043F70E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041D416(U), :0041D466(U)
|
:0041D4D6 5B                      pop ebx
:0041D4D7 8BE5                    mov esp, ebp
:0041D4D9 5D                      pop ebp
:0041D4DA C3                      ret



* Referenced by a CALL at Address:
|:0041DCC1   
|
:0041D4DB 55                      push ebp
:0041D4DC 8BEC                    mov ebp, esp
:0041D4DE 6AFF                    push FFFFFFFF
:0041D4E0 6852524800              push 00485252
:0041D4E5 64A100000000            mov eax, dword ptr fs:[00000000]
:0041D4EB 50                      push eax
:0041D4EC 64892500000000          mov dword ptr fs:[00000000], esp
:0041D4F3 81EC2C010000            sub esp, 0000012C
:0041D4F9 53                      push ebx
:0041D4FA 898DC8FEFFFF            mov dword ptr [ebp+FFFFFEC8], ecx
:0041D500 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0041D506 E8A55DFEFF              call 004032B0
:0041D50B C745FC00000000          mov [ebp-04], 00000000
:0041D512 8B85C8FEFFFF            mov eax, dword ptr [ebp+FFFFFEC8]
:0041D518 8A08                    mov cl, byte ptr [eax]
:0041D51A 51                      push ecx
:0041D51B 6A04                    push 00000004
:0041D51D 8B95C8FEFFFF            mov edx, dword ptr [ebp+FFFFFEC8]
:0041D523 8A4218                  mov al, byte ptr [edx+18]
:0041D526 50                      push eax
:0041D527 8B8DC8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC8]
:0041D52D 8A5102                  mov dl, byte ptr [ecx+02]
:0041D530 52                      push edx
:0041D531 B950424B00              mov ecx, 004B4250
:0041D536 E8027E0300              call 0045533D
:0041D53B 8B8DC8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC8]
:0041D541 884103                  mov byte ptr [ecx+03], al
:0041D544 8B95C8FEFFFF            mov edx, dword ptr [ebp+FFFFFEC8]
:0041D54A 33C0                    xor eax, eax
:0041D54C 8A4203                  mov al, byte ptr [edx+03]
:0041D54F 3DFF000000              cmp eax, 000000FF
:0041D554 7517                    jne 0041D56D
:0041D556 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0041D55D 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0041D563 E8685DFEFF              call 004032D0
:0041D568 E940060000              jmp 0041DBAD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D554(C)
|
:0041D56D 8B8DC8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC8]
:0041D573 33D2                    xor edx, edx
:0041D575 8A5103                  mov dl, byte ptr [ecx+03]
:0041D578 6BD224                  imul edx, 00000024
:0041D57B 81C2502C4B00            add edx, 004B2C50
:0041D581 8B85C8FEFFFF            mov eax, dword ptr [ebp+FFFFFEC8]
:0041D587 895008                  mov dword ptr [eax+08], edx
:0041D58A 8B8DC8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC8]
:0041D590 8B4908                  mov ecx, dword ptr [ecx+08]
:0041D593 E8D8200400              call 0045F670
:0041D598 6BC048                  imul eax, 00000048
:0041D59B 05681B4A00              add eax, 004A1B68
:0041D5A0 8B95C8FEFFFF            mov edx, dword ptr [ebp+FFFFFEC8]
:0041D5A6 894210                  mov dword ptr [edx+10], eax
:0041D5A9 6A00                    push 00000000
:0041D5AB 8B85C8FEFFFF            mov eax, dword ptr [ebp+FFFFFEC8]
:0041D5B1 8A4803                  mov cl, byte ptr [eax+03]
:0041D5B4 51                      push ecx
:0041D5B5 8B95C8FEFFFF            mov edx, dword ptr [ebp+FFFFFEC8]
:0041D5BB 8A02                    mov al, byte ptr [edx]
:0041D5BD 50                      push eax
:0041D5BE E826EFFFFF              call 0041C4E9
:0041D5C3 83C40C                  add esp, 0000000C
:0041D5C6 85C0                    test eax, eax
:0041D5C8 7517                    jne 0041D5E1
:0041D5CA C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0041D5D1 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0041D5D7 E8F45CFEFF              call 004032D0
:0041D5DC E9CC050000              jmp 0041DBAD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D5C8(C)
|
:0041D5E1 68FF000000              push 000000FF
:0041D5E6 8B8DC8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC8]
:0041D5EC E871F1FFFF              call 0041C762
:0041D5F1 8B8DC8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC8]
:0041D5F7 8B4910                  mov ecx, dword ptr [ecx+10]
:0041D5FA E81190FEFF              call 00406610
:0041D5FF 8885E8FEFFFF            mov byte ptr [ebp+FFFFFEE8], al
:0041D605 6A05                    push 00000005
:0041D607 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:0041D60D 81E1FF000000            and ecx, 000000FF
:0041D613 6BC91B                  imul ecx, 0000001B
:0041D616 81C1A0BF4A00            add ecx, 004ABFA0
:0041D61C E87FBFFEFF              call 004095A0
:0041D621 25FF000000              and eax, 000000FF
:0041D626 D1E0                    shl eax, 1
:0041D628 8885ECFEFFFF            mov byte ptr [ebp+FFFFFEEC], al

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0041D62E 6A06                    push 00000006
:0041D630 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:0041D636 81E1FF000000            and ecx, 000000FF
:0041D63C 6BC91B                  imul ecx, 0000001B
:0041D63F 81C1A0BF4A00            add ecx, 004ABFA0
:0041D645 E856BFFEFF              call 004095A0
:0041D64A 25FF000000              and eax, 000000FF
:0041D64F D1E0                    shl eax, 1
:0041D651 8885E4FEFFFF            mov byte ptr [ebp+FFFFFEE4], al
:0041D657 8B95ECFEFFFF            mov edx, dword ptr [ebp+FFFFFEEC]
:0041D65D 81E2FF000000            and edx, 000000FF
:0041D663 52                      push edx
:0041D664 6A05                    push 00000005
:0041D666 8B85C8FEFFFF            mov eax, dword ptr [ebp+FFFFFEC8]
:0041D66C 8B4810                  mov ecx, dword ptr [eax+10]
:0041D66F E8A397FEFF              call 00406E17
:0041D674 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:0041D67A 81E1FF000000            and ecx, 000000FF
:0041D680 51                      push ecx

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0041D681 6A06                    push 00000006
:0041D683 8B95C8FEFFFF            mov edx, dword ptr [ebp+FFFFFEC8]
:0041D689 8B4A10                  mov ecx, dword ptr [edx+10]
:0041D68C E88697FEFF              call 00406E17
:0041D691 8B85C8FEFFFF            mov eax, dword ptr [ebp+FFFFFEC8]
:0041D697 8B4810                  mov ecx, dword ptr [eax+10]
:0041D69A E87C9BFEFF              call 0040721B
:0041D69F 50                      push eax
:0041D6A0 8B8DC8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC8]
:0041D6A6 8B4908                  mov ecx, dword ptr [ecx+08]
:0041D6A9 E81F200200              call 0043F6CD
:0041D6AE 8B95C8FEFFFF            mov edx, dword ptr [ebp+FFFFFEC8]
:0041D6B4 8B4A10                  mov ecx, dword ptr [edx+10]
:0041D6B7 E88E9BFEFF              call 0040724A
:0041D6BC 50                      push eax
:0041D6BD 8B85C8FEFFFF            mov eax, dword ptr [ebp+FFFFFEC8]
:0041D6C3 8B4808                  mov ecx, dword ptr [eax+08]
:0041D6C6 E843200200              call 0043F70E
:0041D6CB 6A00                    push 00000000
:0041D6CD 6A00                    push 00000000
:0041D6CF 6A0B                    push 0000000B
:0041D6D1 8B8DC8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC8]
:0041D6D7 8B4910                  mov ecx, dword ptr [ecx+10]
:0041D6DA E821BEFEFF              call 00409500
:0041D6DF 50                      push eax
:0041D6E0 B9F05D4B00              mov ecx, 004B5DF0
:0041D6E5 E8A5A00300              call 0045778F

* Possible StringData Ref from Data Obj ->"UNIT_SPC.E5"
                                  |
:0041D6EA 68D0BB4800              push 0048BBD0
:0041D6EF 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0041D6F5 E83B240000              call 0041FB35
:0041D6FA 6A04                    push 00000004
:0041D6FC 6A00                    push 00000000
:0041D6FE 6800690000              push 00006900
:0041D703 B9C8E44A00              mov ecx, 004AE4C8
:0041D708 E833230600              call 0047FA40
:0041D70D 50                      push eax
:0041D70E 8B95C8FEFFFF            mov edx, dword ptr [ebp+FFFFFEC8]
:0041D714 33C0                    xor eax, eax
:0041D716 8A4203                  mov al, byte ptr [edx+03]
:0041D719 50                      push eax
:0041D71A 8B8DC8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC8]
:0041D720 8B4908                  mov ecx, dword ptr [ecx+08]
:0041D723 E820250200              call 0043FC48
:0041D728 25FF000000              and eax, 000000FF
:0041D72D 50                      push eax
:0041D72E 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0041D734 E850250000              call 0041FC89
:0041D739 6800090000              push 00000900
:0041D73E 6A04                    push 00000004
:0041D740 6A00                    push 00000000
:0041D742 6A00                    push 00000000
:0041D744 B9C8E44A00              mov ecx, 004AE4C8
:0041D749 E8F2220600              call 0047FA40
:0041D74E 50                      push eax
:0041D74F 6A04                    push 00000004
:0041D751 6A00                    push 00000000
:0041D753 68008D0000              push 00008D00
:0041D758 B9C8E44A00              mov ecx, 004AE4C8
:0041D75D E8DE220600              call 0047FA40
:0041D762 50                      push eax
:0041D763 E895250600              call 0047FCFD
:0041D768 83C40C                  add esp, 0000000C
:0041D76B 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:0041D771 81E2FF000000            and edx, 000000FF
:0041D777 83C201                  add edx, 00000001
:0041D77A 52                      push edx
:0041D77B 8B85C8FEFFFF            mov eax, dword ptr [ebp+FFFFFEC8]
:0041D781 8B4810                  mov ecx, dword ptr [eax+10]
:0041D784 E86708FFFF              call 0040DFF0
:0041D789 6A04                    push 00000004
:0041D78B 6A00                    push 00000000
:0041D78D 6800690000              push 00006900
:0041D792 B9C8E44A00              mov ecx, 004AE4C8
:0041D797 E8A4220600              call 0047FA40
:0041D79C 50                      push eax
:0041D79D 8B8DC8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC8]
:0041D7A3 33D2                    xor edx, edx
:0041D7A5 8A5103                  mov dl, byte ptr [ecx+03]
:0041D7A8 52                      push edx
:0041D7A9 8B85C8FEFFFF            mov eax, dword ptr [ebp+FFFFFEC8]
:0041D7AF 8B4808                  mov ecx, dword ptr [eax+08]
:0041D7B2 E891240200              call 0043FC48
:0041D7B7 25FF000000              and eax, 000000FF
:0041D7BC 50                      push eax
:0041D7BD 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0041D7C3 E8C1240000              call 0041FC89
:0041D7C8 6800090000              push 00000900
:0041D7CD 6A04                    push 00000004
:0041D7CF 6A00                    push 00000000
:0041D7D1 6800090000              push 00000900
:0041D7D6 B9C8E44A00              mov ecx, 004AE4C8
:0041D7DB E860220600              call 0047FA40
:0041D7E0 50                      push eax
:0041D7E1 6A04                    push 00000004
:0041D7E3 6A00                    push 00000000
:0041D7E5 68008D0000              push 00008D00
:0041D7EA B9C8E44A00              mov ecx, 004AE4C8
:0041D7EF E84C220600              call 0047FA40
:0041D7F4 50                      push eax
:0041D7F5 E803250600              call 0047FCFD
:0041D7FA 83C40C                  add esp, 0000000C
:0041D7FD 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0041D803 E8BDBAFFFF              call 004192C5
:0041D808 8B8DC8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC8]
:0041D80E 8B4908                  mov ecx, dword ptr [ecx+08]
:0041D811 E84A5BFEFF              call 00403360
:0041D816 668B10                  mov dx, word ptr [eax]
:0041D819 52                      push edx
:0041D81A E85F220300              call 0044FA7E
:0041D81F 83C404                  add esp, 00000004
:0041D822 8985CCFEFFFF            mov dword ptr [ebp+FFFFFECC], eax
:0041D828 8995D0FEFFFF            mov dword ptr [ebp+FFFFFED0], edx
:0041D82E 8B85CCFEFFFF            mov eax, dword ptr [ebp+FFFFFECC]
:0041D834 8985D8FEFFFF            mov dword ptr [ebp+FFFFFED8], eax
:0041D83A 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:0041D840 898DDCFEFFFF            mov dword ptr [ebp+FFFFFEDC], ecx
:0041D846 8B95C8FEFFFF            mov edx, dword ptr [ebp+FFFFFEC8]
:0041D84C 8B4A08                  mov ecx, dword ptr [edx+08]
:0041D84F E80C5BFEFF              call 00403360
:0041D854 668B00                  mov ax, word ptr [eax]
:0041D857 50                      push eax
:0041D858 8D8DD4FEFFFF            lea ecx, dword ptr [ebp+FFFFFED4]
:0041D85E 51                      push ecx
:0041D85F E8BB210300              call 0044FA1F
:0041D864 83C408                  add esp, 00000008
:0041D867 6A01                    push 00000001
:0041D869 6A21                    push 00000021
:0041D86B B9B0694B00              mov ecx, 004B69B0
:0041D870 E8056E0500              call 0047467A
:0041D875 C785E0FEFFFF00000000    mov dword ptr [ebp+FFFFFEE0], 00000000
:0041D87F EB0F                    jmp 0041D890

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D937(U)
|
:0041D881 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:0041D887 83C201                  add edx, 00000001
:0041D88A 8995E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D87F(U)
|
:0041D890 83BDE0FEFFFF10          cmp dword ptr [ebp+FFFFFEE0], 00000010
:0041D897 0F839F000000            jnb 0041D93C
:0041D89D E8390D0000              call 0041E5DB
:0041D8A2 8B85D5FEFFFF            mov eax, dword ptr [ebp+FFFFFED5]
:0041D8A8 25FF000000              and eax, 000000FF
:0041D8AD 50                      push eax
:0041D8AE 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:0041D8B4 81E1FF000000            and ecx, 000000FF
:0041D8BA 51                      push ecx
:0041D8BB E8395EFEFF              call 004036F9
:0041D8C0 83C408                  add esp, 00000008
:0041D8C3 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:0041D8C9 D1EA                    shr edx, 1
:0041D8CB 83C201                  add edx, 00000001
:0041D8CE 52                      push edx
:0041D8CF 6A30                    push 00000030
:0041D8D1 6A30                    push 00000030
:0041D8D3 6A04                    push 00000004
:0041D8D5 6A00                    push 00000000
:0041D8D7 6A00                    push 00000000
:0041D8D9 B9C8E44A00              mov ecx, 004AE4C8
:0041D8DE E85D210600              call 0047FA40
:0041D8E3 50                      push eax
:0041D8E4 E8D72A0100              call 004303C0
:0041D8E9 83C410                  add esp, 00000010
:0041D8EC 6A04                    push 00000004
:0041D8EE 6A00                    push 00000000
:0041D8F0 6A00                    push 00000000
:0041D8F2 B9C8E44A00              mov ecx, 004AE4C8
:0041D8F7 E844210600              call 0047FA40
:0041D8FC 50                      push eax
:0041D8FD 8B85C8FEFFFF            mov eax, dword ptr [ebp+FFFFFEC8]
:0041D903 8A4803                  mov cl, byte ptr [eax+03]
:0041D906 51                      push ecx
:0041D907 6A30                    push 00000030
:0041D909 6A30                    push 00000030
:0041D90B 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:0041D911 52                      push edx
:0041D912 8B85D8FEFFFF            mov eax, dword ptr [ebp+FFFFFED8]
:0041D918 50                      push eax
:0041D919 E85E3A0300              call 0045137C
:0041D91E 83C418                  add esp, 00000018
:0041D921 E8D00C0000              call 0041E5F6
:0041D926 6A01                    push 00000001
:0041D928 B9181B4B00              mov ecx, 004B1B18
:0041D92D E80E5AFEFF              call 00403340
:0041D932 E8A9EB0000              call 0042C4E0
:0041D937 E945FFFFFF              jmp 0041D881

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D897(C)
|
:0041D93C 6A01                    push 00000001
:0041D93E 6A0C                    push 0000000C
:0041D940 B9B0694B00              mov ecx, 004B69B0
:0041D945 E8306D0500              call 0047467A
:0041D94A C785E0FEFFFF00000000    mov dword ptr [ebp+FFFFFEE0], 00000000
:0041D954 EB0F                    jmp 0041D965

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041DA40(U)
|
:0041D956 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:0041D95C 83C101                  add ecx, 00000001
:0041D95F 898DE0FEFFFF            mov dword ptr [ebp+FFFFFEE0], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D954(U)
|
:0041D965 83BDE0FEFFFF10          cmp dword ptr [ebp+FFFFFEE0], 00000010
:0041D96C 0F83D3000000            jnb 0041DA45
:0041D972 6800090000              push 00000900
:0041D977 6A04                    push 00000004
:0041D979 6A00                    push 00000000
:0041D97B 6A00                    push 00000000
:0041D97D B9C8E44A00              mov ecx, 004AE4C8
:0041D982 E8B9200600              call 0047FA40
:0041D987 50                      push eax
:0041D988 6A04                    push 00000004
:0041D98A 6A00                    push 00000000
:0041D98C 6800090000              push 00000900
:0041D991 B9C8E44A00              mov ecx, 004AE4C8
:0041D996 E8A5200600              call 0047FA40
:0041D99B 50                      push eax
:0041D99C E85C230600              call 0047FCFD
:0041D9A1 83C40C                  add esp, 0000000C
:0041D9A4 E8320C0000              call 0041E5DB
:0041D9A9 8B95D5FEFFFF            mov edx, dword ptr [ebp+FFFFFED5]
:0041D9AF 81E2FF000000            and edx, 000000FF
:0041D9B5 52                      push edx
:0041D9B6 8B85D4FEFFFF            mov eax, dword ptr [ebp+FFFFFED4]
:0041D9BC 25FF000000              and eax, 000000FF
:0041D9C1 50                      push eax
:0041D9C2 E8325DFEFF              call 004036F9
:0041D9C7 83C408                  add esp, 00000008
:0041D9CA B910000000              mov ecx, 00000010
:0041D9CF 2B8DE0FEFFFF            sub ecx, dword ptr [ebp+FFFFFEE0]
:0041D9D5 D1E9                    shr ecx, 1
:0041D9D7 51                      push ecx
:0041D9D8 6A30                    push 00000030
:0041D9DA 6A30                    push 00000030
:0041D9DC 6A04                    push 00000004
:0041D9DE 6A00                    push 00000000
:0041D9E0 6A00                    push 00000000
:0041D9E2 B9C8E44A00              mov ecx, 004AE4C8
:0041D9E7 E854200600              call 0047FA40
:0041D9EC 50                      push eax
:0041D9ED E8CE290100              call 004303C0
:0041D9F2 83C410                  add esp, 00000010
:0041D9F5 6A04                    push 00000004
:0041D9F7 6A00                    push 00000000
:0041D9F9 6A00                    push 00000000
:0041D9FB B9C8E44A00              mov ecx, 004AE4C8
:0041DA00 E83B200600              call 0047FA40
:0041DA05 50                      push eax
:0041DA06 8B95C8FEFFFF            mov edx, dword ptr [ebp+FFFFFEC8]
:0041DA0C 8A4203                  mov al, byte ptr [edx+03]
:0041DA0F 50                      push eax
:0041DA10 6A30                    push 00000030
:0041DA12 6A30                    push 00000030
:0041DA14 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:0041DA1A 51                      push ecx
:0041DA1B 8B95D8FEFFFF            mov edx, dword ptr [ebp+FFFFFED8]
:0041DA21 52                      push edx
:0041DA22 E855390300              call 0045137C
:0041DA27 83C418                  add esp, 00000018
:0041DA2A E8C70B0000              call 0041E5F6
:0041DA2F 6A01                    push 00000001
:0041DA31 B9181B4B00              mov ecx, 004B1B18
:0041DA36 E80559FEFF              call 00403340
:0041DA3B E8A0EA0000              call 0042C4E0
:0041DA40 E911FFFFFF              jmp 0041D956

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041D96C(C)
|
:0041DA45 8B85C8FEFFFF            mov eax, dword ptr [ebp+FFFFFEC8]
:0041DA4B 8B4808                  mov ecx, dword ptr [eax+08]
:0041DA4E E81D050000              call 0041DF70
:0041DA53 25FF000000              and eax, 000000FF
:0041DA58 8B0C85A8BE4800          mov ecx, dword ptr [4*eax+0048BEA8]
:0041DA5F 51                      push ecx
:0041DA60 8B95C8FEFFFF            mov edx, dword ptr [ebp+FFFFFEC8]
:0041DA66 8B4A10                  mov ecx, dword ptr [edx+10]
:0041DA69 E8E99CFEFF              call 00407757
:0041DA6E 50                      push eax

* Possible StringData Ref from Data Obj ->"%sıΪ%s"
                                  |
:0041DA6F 6898B64800              push 0048B698
:0041DA74 6A02                    push 00000002
:0041DA76 E81E1C0100              call 0042F699
:0041DA7B 83C410                  add esp, 00000010
:0041DA7E C785E0FEFFFF00000000    mov dword ptr [ebp+FFFFFEE0], 00000000
:0041DA88 EB0F                    jmp 0041DA99

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041DB7A(U)
|
:0041DA8A 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:0041DA90 83C001                  add eax, 00000001
:0041DA93 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041DA88(U)
|
:0041DA99 83BDE0FEFFFF44          cmp dword ptr [ebp+FFFFFEE0], 00000044
:0041DAA0 0F83D9000000            jnb 0041DB7F
:0041DAA6 8B8DC8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC8]
:0041DAAC 8B4908                  mov ecx, dword ptr [ecx+08]
:0041DAAF E8BC040000              call 0041DF70
:0041DAB4 25FF000000              and eax, 000000FF
:0041DAB9 83E801                  sub eax, 00000001
:0041DABC 50                      push eax
:0041DABD 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:0041DAC3 6BC946                  imul ecx, 00000046
:0041DAC6 81C1C0F44A00            add ecx, 004AF4C0
:0041DACC E8AFBAFEFF              call 00409580
:0041DAD1 25FF000000              and eax, 000000FF
:0041DAD6 85C0                    test eax, eax
:0041DAD8 0F859C000000            jne 0041DB7A
:0041DADE 8B95C8FEFFFF            mov edx, dword ptr [ebp+FFFFFEC8]
:0041DAE4 8B4A08                  mov ecx, dword ptr [edx+08]
:0041DAE7 E884040000              call 0041DF70
:0041DAEC 25FF000000              and eax, 000000FF
:0041DAF1 50                      push eax
:0041DAF2 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:0041DAF8 6BC946                  imul ecx, 00000046
:0041DAFB 81C1C0F44A00            add ecx, 004AF4C0
:0041DB01 E87ABAFEFF              call 00409580
:0041DB06 25FF000000              and eax, 000000FF
:0041DB0B 85C0                    test eax, eax
:0041DB0D 746B                    je 0041DB7A
:0041DB0F 8B85C8FEFFFF            mov eax, dword ptr [ebp+FFFFFEC8]
:0041DB15 8B4808                  mov ecx, dword ptr [eax+08]
:0041DB18 E853040000              call 0041DF70
:0041DB1D 25FF000000              and eax, 000000FF
:0041DB22 50                      push eax
:0041DB23 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:0041DB29 6BC946                  imul ecx, 00000046
:0041DB2C 81C1C0F44A00            add ecx, 004AF4C0
:0041DB32 E849BAFEFF              call 00409580
:0041DB37 8AD8                    mov bl, al
:0041DB39 81E3FF000000            and ebx, 000000FF
:0041DB3F 8B8DC8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC8]
:0041DB45 8B4910                  mov ecx, dword ptr [ecx+10]
:0041DB48 E8838AFEFF              call 004065D0
:0041DB4D 25FF000000              and eax, 000000FF
:0041DB52 3BD8                    cmp ebx, eax
:0041DB54 7F24                    jg 0041DB7A
:0041DB56 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:0041DB5C 6BC946                  imul ecx, 00000046
:0041DB5F 81C1C0F44A00            add ecx, 004AF4C0
:0041DB65 E8A61B0400              call 0045F710
:0041DB6A 50                      push eax

* Possible StringData Ref from Data Obj ->"ѧˡ%sԣ"
                                  |
:0041DB6B 68ACB64800              push 0048B6AC
:0041DB70 6A02                    push 00000002
:0041DB72 E8221B0100              call 0042F699
:0041DB77 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041DAD8(C), :0041DB0D(C), :0041DB54(C)
|
:0041DB7A E90BFFFFFF              jmp 0041DA8A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041DAA0(C)
|
:0041DB7F 8B95C8FEFFFF            mov edx, dword ptr [ebp+FFFFFEC8]
:0041DB85 8B4A08                  mov ecx, dword ptr [edx+08]
:0041DB88 E89F220200              call 0043FE2C
:0041DB8D 8B85C8FEFFFF            mov eax, dword ptr [ebp+FFFFFEC8]
:0041DB93 8B4808                  mov ecx, dword ptr [eax+08]
:0041DB96 E82E210200              call 0043FCC9
:0041DB9B C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0041DBA2 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0041DBA8 E82357FEFF              call 004032D0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041D568(U), :0041D5DC(U)
|
:0041DBAD 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041DBB0 64890D00000000          mov dword ptr fs:[00000000], ecx
:0041DBB7 5B                      pop ebx
:0041DBB8 8BE5                    mov esp, ebp
:0041DBBA 5D                      pop ebp
:0041DBBB C3                      ret



* Referenced by a CALL at Address:
|:0041DC57   
|
:0041DBBC 55                      push ebp
:0041DBBD 8BEC                    mov ebp, esp
:0041DBBF 51                      push ecx
:0041DBC0 894DFC                  mov dword ptr [ebp-04], ecx
:0041DBC3 8B45FC                  mov eax, dword ptr [ebp-04]
:0041DBC6 8A4D08                  mov cl, byte ptr [ebp+08]
:0041DBC9 8808                    mov byte ptr [eax], cl
:0041DBCB 8B5508                  mov edx, dword ptr [ebp+08]
:0041DBCE 81E2FF000000            and edx, 000000FF
:0041DBD4 6BD219                  imul edx, 00000019
:0041DBD7 81C240114A00            add edx, 004A1140
:0041DBDD 8B45FC                  mov eax, dword ptr [ebp-04]
:0041DBE0 895014                  mov dword ptr [eax+14], edx
:0041DBE3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041DBE6 8B4914                  mov ecx, dword ptr [ecx+14]
:0041DBE9 E852B9FEFF              call 00409540
:0041DBEE 8B55FC                  mov edx, dword ptr [ebp-04]
:0041DBF1 884201                  mov byte ptr [edx+01], al
:0041DBF4 8B45FC                  mov eax, dword ptr [ebp-04]
:0041DBF7 8A4D0C                  mov cl, byte ptr [ebp+0C]
:0041DBFA 884802                  mov byte ptr [eax+02], cl
:0041DBFD 8B55FC                  mov edx, dword ptr [ebp-04]
:0041DC00 33C0                    xor eax, eax
:0041DC02 8A4202                  mov al, byte ptr [edx+02]
:0041DC05 6BC024                  imul eax, 00000024
:0041DC08 05502C4B00              add eax, 004B2C50
:0041DC0D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041DC10 894104                  mov dword ptr [ecx+04], eax
:0041DC13 8B55FC                  mov edx, dword ptr [ebp-04]
:0041DC16 8B4A04                  mov ecx, dword ptr [edx+04]
:0041DC19 E8521A0400              call 0045F670
:0041DC1E 6BC048                  imul eax, 00000048
:0041DC21 05681B4A00              add eax, 004A1B68
:0041DC26 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041DC29 89410C                  mov dword ptr [ecx+0C], eax
:0041DC2C 8B55FC                  mov edx, dword ptr [ebp-04]
:0041DC2F C6421801                mov [edx+18], 01
:0041DC33 8B45FC                  mov eax, dword ptr [ebp-04]
:0041DC36 C7401C00000000          mov [eax+1C], 00000000
:0041DC3D 8BE5                    mov esp, ebp
:0041DC3F 5D                      pop ebp
:0041DC40 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:00405C2B   , :00405C44   , :00422D20   , :00422D39   , :0043DDC5   
|
:0041DC43 55                      push ebp
:0041DC44 8BEC                    mov ebp, esp
:0041DC46 83EC08                  sub esp, 00000008
:0041DC49 894DFC                  mov dword ptr [ebp-04], ecx
:0041DC4C 8A450C                  mov al, byte ptr [ebp+0C]
:0041DC4F 50                      push eax
:0041DC50 8A4D08                  mov cl, byte ptr [ebp+08]
:0041DC53 51                      push ecx
:0041DC54 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041DC57 E860FFFFFF              call 0041DBBC
:0041DC5C 8B55FC                  mov edx, dword ptr [ebp-04]
:0041DC5F 33C0                    xor eax, eax
:0041DC61 8A4201                  mov al, byte ptr [edx+01]
:0041DC64 8945F8                  mov dword ptr [ebp-08], eax
:0041DC67 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041DC6A 83E93F                  sub ecx, 0000003F
:0041DC6D 894DF8                  mov dword ptr [ebp-08], ecx
:0041DC70 837DF80D                cmp dword ptr [ebp-08], 0000000D
:0041DC74 7750                    ja 0041DCC6
:0041DC76 8B45F8                  mov eax, dword ptr [ebp-08]
:0041DC79 33D2                    xor edx, edx
:0041DC7B 8A9035DD4100            mov dl, byte ptr [eax+0041DD35]
:0041DC81 FF249519DD4100          jmp dword ptr [4*edx+0041DD19]
:0041DC88 8B4D10                  mov ecx, dword ptr [ebp+10]
:0041DC8B 51                      push ecx
:0041DC8C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041DC8F E84BF0FFFF              call 0041CCDF
:0041DC94 EB30                    jmp 0041DCC6
:0041DC96 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041DC99 E89FF1FFFF              call 0041CE3D
:0041DC9E EB26                    jmp 0041DCC6
:0041DCA0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041DCA3 E8B9F2FFFF              call 0041CF61
:0041DCA8 EB1C                    jmp 0041DCC6
:0041DCAA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041DCAD E8CEF3FFFF              call 0041D080
:0041DCB2 EB12                    jmp 0041DCC6
:0041DCB4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041DCB7 E81DF7FFFF              call 0041D3D9
:0041DCBC EB08                    jmp 0041DCC6
:0041DCBE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041DCC1 E815F8FFFF              call 0041D4DB

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041DC74(C), :0041DC94(U), :0041DC9E(U), :0041DCA8(U), :0041DCB2(U)
|:0041DCBC(U)
|
:0041DCC6 8B55FC                  mov edx, dword ptr [ebp-04]
:0041DCC9 837A1C00                cmp dword ptr [edx+1C], 00000000
:0041DCCD 743E                    je 0041DD0D
:0041DCCF 837D1400                cmp dword ptr [ebp+14], 00000000
:0041DCD3 7510                    jne 0041DCE5
:0041DCD5 8B45FC                  mov eax, dword ptr [ebp-04]
:0041DCD8 8A08                    mov cl, byte ptr [eax]
:0041DCDA 51                      push ecx
:0041DCDB B970074B00              mov ecx, 004B0770
:0041DCE0 E870FCFEFF              call 0040D955

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041DCD3(C)
|
:0041DCE5 8B55FC                  mov edx, dword ptr [ebp-04]
:0041DCE8 8B4A08                  mov ecx, dword ptr [edx+08]
:0041DCEB E880190400              call 0045F670
:0041DCF0 50                      push eax
:0041DCF1 E80BBD0500              call 00479A01
:0041DCF6 83C404                  add esp, 00000004
:0041DCF9 8B45FC                  mov eax, dword ptr [ebp-04]
:0041DCFC 8B4804                  mov ecx, dword ptr [eax+04]
:0041DCFF E86C190400              call 0045F670
:0041DD04 50                      push eax
:0041DD05 E8F7BC0500              call 00479A01
:0041DD0A 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041DCCD(C)
|
:0041DD0D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041DD10 8B411C                  mov eax, dword ptr [ecx+1C]
:0041DD13 8BE5                    mov esp, ebp
:0041DD15 5D                      pop ebp
:0041DD16 C21000                  ret 0010



:0041DD19 88DC4100                DWORD 0041DC88
:0041DD1D 96DC4100                DWORD 0041DC96
:0041DD21 A0DC4100                DWORD 0041DCA0
:0041DD25 AADC4100                DWORD 0041DCAA
:0041DD29 B4DC4100                DWORD 0041DCB4
:0041DD2D BEDC4100                DWORD 0041DCBE
:0041DD31 C6DC4100                DWORD 0041DCC6


:0041DD35 0001                    add byte ptr [ecx], al
:0041DD37 0202                    add al, byte ptr [edx]
:0041DD39 0202                    add al, byte ptr [edx]
:0041DD3B 0203                    add al, byte ptr [ebx]
:0041DD3D 0303                    add eax, dword ptr [ebx]
:0041DD3F 0303                    add eax, dword ptr [ebx]
:0041DD41 0405                    add al, 05
:0041DD43 CC                      int 03
:0041DD44 CC                      int 03
:0041DD45 CC                      int 03
:0041DD46 CC                      int 03
:0041DD47 CC                      int 03
:0041DD48 CC                      int 03
:0041DD49 CC                      int 03
:0041DD4A CC                      int 03
:0041DD4B CC                      int 03
:0041DD4C CC                      int 03
:0041DD4D CC                      int 03
:0041DD4E CC                      int 03
:0041DD4F CC                      int 03

* Referenced by a CALL at Address:
|:0041C4E2   
|
:0041DD50 55                      push ebp
:0041DD51 8BEC                    mov ebp, esp
:0041DD53 51                      push ecx
:0041DD54 894DFC                  mov dword ptr [ebp-04], ecx
:0041DD57 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041DD5A 83C119                  add ecx, 00000019
:0041DD5D E8AE190400              call 0045F710
:0041DD62 8B45FC                  mov eax, dword ptr [ebp-04]
:0041DD65 8BE5                    mov esp, ebp
:0041DD67 5D                      pop ebp
:0041DD68 C3                      ret


:0041DD69 CC                      int 03
:0041DD6A CC                      int 03
:0041DD6B CC                      int 03
:0041DD6C CC                      int 03
:0041DD6D CC                      int 03
:0041DD6E CC                      int 03
:0041DD6F CC                      int 03

* Referenced by a CALL at Addresses:
|:00407BFD   , :00407D62   , :0040C680   , :0041D097   , :0041D165   
|:0041D490   , :00420004   , :0042011F   , :00420239   , :00420354   
|:0043C46B   , :00440925   , :00461E91   , :004621FD   
|
:0041DD70 55                      push ebp
:0041DD71 8BEC                    mov ebp, esp
:0041DD73 51                      push ecx
:0041DD74 894DFC                  mov dword ptr [ebp-04], ecx
:0041DD77 8B45FC                  mov eax, dword ptr [ebp-04]
:0041DD7A 8A4015                  mov al, byte ptr [eax+15]
:0041DD7D 8BE5                    mov esp, ebp
:0041DD7F 5D                      pop ebp
:0041DD80 C3                      ret


:0041DD81 CC                      int 03
:0041DD82 CC                      int 03
:0041DD83 CC                      int 03
:0041DD84 CC                      int 03
:0041DD85 CC                      int 03
:0041DD86 CC                      int 03
:0041DD87 CC                      int 03
:0041DD88 CC                      int 03
:0041DD89 CC                      int 03
:0041DD8A CC                      int 03
:0041DD8B CC                      int 03
:0041DD8C CC                      int 03
:0041DD8D CC                      int 03
:0041DD8E CC                      int 03
:0041DD8F CC                      int 03

* Referenced by a CALL at Address:
|:0041D2C8   
|
:0041DD90 55                      push ebp
:0041DD91 8BEC                    mov ebp, esp
:0041DD93 51                      push ecx
:0041DD94 894DFC                  mov dword ptr [ebp-04], ecx
:0041DD97 8B45FC                  mov eax, dword ptr [ebp-04]
:0041DD9A 8A4D08                  mov cl, byte ptr [ebp+08]
:0041DD9D 884815                  mov byte ptr [eax+15], cl
:0041DDA0 8BE5                    mov esp, ebp
:0041DDA2 5D                      pop ebp
:0041DDA3 C20400                  ret 0004


:0041DDA6 CC                      int 03
:0041DDA7 CC                      int 03
:0041DDA8 CC                      int 03
:0041DDA9 CC                      int 03
:0041DDAA CC                      int 03
:0041DDAB CC                      int 03
:0041DDAC CC                      int 03
:0041DDAD CC                      int 03
:0041DDAE CC                      int 03
:0041DDAF CC                      int 03

* Referenced by a CALL at Addresses:
|:00407B97   , :00407CFE   , :0041D1CF   , :00461EDA   , :004621E2   
|
:0041DDB0 55                      push ebp
:0041DDB1 8BEC                    mov ebp, esp
:0041DDB3 51                      push ecx
:0041DDB4 894DFC                  mov dword ptr [ebp-04], ecx
:0041DDB7 8B45FC                  mov eax, dword ptr [ebp-04]
:0041DDBA 8A4016                  mov al, byte ptr [eax+16]
:0041DDBD 8BE5                    mov esp, ebp
:0041DDBF 5D                      pop ebp
:0041DDC0 C3                      ret


:0041DDC1 CC                      int 03
:0041DDC2 CC                      int 03
:0041DDC3 CC                      int 03
:0041DDC4 CC                      int 03
:0041DDC5 CC                      int 03
:0041DDC6 CC                      int 03
:0041DDC7 CC                      int 03
:0041DDC8 CC                      int 03
:0041DDC9 CC                      int 03
:0041DDCA CC                      int 03
:0041DDCB CC                      int 03
:0041DDCC CC                      int 03
:0041DDCD CC                      int 03
:0041DDCE CC                      int 03
:0041DDCF CC                      int 03

* Referenced by a CALL at Address:
|:0041D32C   
|
:0041DDD0 55                      push ebp
:0041DDD1 8BEC                    mov ebp, esp
:0041DDD3 51                      push ecx
:0041DDD4 894DFC                  mov dword ptr [ebp-04], ecx
:0041DDD7 8B45FC                  mov eax, dword ptr [ebp-04]
:0041DDDA 8A4D08                  mov cl, byte ptr [ebp+08]
:0041DDDD 884816                  mov byte ptr [eax+16], cl
:0041DDE0 8BE5                    mov esp, ebp
:0041DDE2 5D                      pop ebp
:0041DDE3 C20400                  ret 0004


:0041DDE6 CC                      int 03
:0041DDE7 CC                      int 03
:0041DDE8 CC                      int 03
:0041DDE9 CC                      int 03
:0041DDEA CC                      int 03
:0041DDEB CC                      int 03
:0041DDEC CC                      int 03
:0041DDED CC                      int 03
:0041DDEE CC                      int 03
:0041DDEF CC                      int 03

* Referenced by a CALL at Addresses:
|:00407985   , :0040C68B   , :0040CA34   , :0041D19A   
|
:0041DDF0 55                      push ebp
:0041DDF1 8BEC                    mov ebp, esp
:0041DDF3 51                      push ecx
:0041DDF4 894DFC                  mov dword ptr [ebp-04], ecx
:0041DDF7 8B45FC                  mov eax, dword ptr [ebp-04]
:0041DDFA 8A4017                  mov al, byte ptr [eax+17]
:0041DDFD 8BE5                    mov esp, ebp
:0041DDFF 5D                      pop ebp
:0041DE00 C3                      ret


:0041DE01 CC                      int 03
:0041DE02 CC                      int 03
:0041DE03 CC                      int 03
:0041DE04 CC                      int 03
:0041DE05 CC                      int 03
:0041DE06 CC                      int 03
:0041DE07 CC                      int 03
:0041DE08 CC                      int 03
:0041DE09 CC                      int 03
:0041DE0A CC                      int 03
:0041DE0B CC                      int 03
:0041DE0C CC                      int 03
:0041DE0D CC                      int 03
:0041DE0E CC                      int 03
:0041DE0F CC                      int 03

* Referenced by a CALL at Address:
|:0041D2FA   
|
:0041DE10 55                      push ebp
:0041DE11 8BEC                    mov ebp, esp
:0041DE13 51                      push ecx
:0041DE14 894DFC                  mov dword ptr [ebp-04], ecx
:0041DE17 8B45FC                  mov eax, dword ptr [ebp-04]
:0041DE1A 8A4D08                  mov cl, byte ptr [ebp+08]
:0041DE1D 884817                  mov byte ptr [eax+17], cl
:0041DE20 8BE5                    mov esp, ebp
:0041DE22 5D                      pop ebp
:0041DE23 C20400                  ret 0004


:0041DE26 CC                      int 03
:0041DE27 CC                      int 03
:0041DE28 CC                      int 03
:0041DE29 CC                      int 03
:0041DE2A CC                      int 03
:0041DE2B CC                      int 03
:0041DE2C CC                      int 03
:0041DE2D CC                      int 03
:0041DE2E CC                      int 03
:0041DE2F CC                      int 03

* Referenced by a CALL at Addresses:
|:0041D175   , :0045C7C1   , :004783F2   
|
:0041DE30 55                      push ebp
:0041DE31 8BEC                    mov ebp, esp
:0041DE33 51                      push ecx
:0041DE34 894DFC                  mov dword ptr [ebp-04], ecx
:0041DE37 8B4508                  mov eax, dword ptr [ebp+08]
:0041DE3A 50                      push eax
:0041DE3B 6A00                    push 00000000
:0041DE3D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041DE40 E85592FEFF              call 0040709A
:0041DE45 8BE5                    mov esp, ebp
:0041DE47 5D                      pop ebp
:0041DE48 C20400                  ret 0004


:0041DE4B CC                      int 03
:0041DE4C CC                      int 03
:0041DE4D CC                      int 03
:0041DE4E CC                      int 03
:0041DE4F CC                      int 03

* Referenced by a CALL at Address:
|:0041D2D7   
|
:0041DE50 55                      push ebp
:0041DE51 8BEC                    mov ebp, esp
:0041DE53 51                      push ecx
:0041DE54 894DFC                  mov dword ptr [ebp-04], ecx
:0041DE57 8B45FC                  mov eax, dword ptr [ebp-04]
:0041DE5A 8A4D08                  mov cl, byte ptr [ebp+08]
:0041DE5D 884821                  mov byte ptr [eax+21], cl
:0041DE60 8BE5                    mov esp, ebp
:0041DE62 5D                      pop ebp
:0041DE63 C20400                  ret 0004


:0041DE66 CC                      int 03
:0041DE67 CC                      int 03
:0041DE68 CC                      int 03
:0041DE69 CC                      int 03
:0041DE6A CC                      int 03
:0041DE6B CC                      int 03
:0041DE6C CC                      int 03
:0041DE6D CC                      int 03
:0041DE6E CC                      int 03
:0041DE6F CC                      int 03

* Referenced by a CALL at Addresses:
|:0041D1DF   , :0045C80F   , :0047843A   
|
:0041DE70 55                      push ebp
:0041DE71 8BEC                    mov ebp, esp
:0041DE73 51                      push ecx
:0041DE74 894DFC                  mov dword ptr [ebp-04], ecx
:0041DE77 8B4508                  mov eax, dword ptr [ebp+08]
:0041DE7A 50                      push eax
:0041DE7B 6A01                    push 00000001
:0041DE7D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041DE80 E81592FEFF              call 0040709A
:0041DE85 8BE5                    mov esp, ebp
:0041DE87 5D                      pop ebp
:0041DE88 C20400                  ret 0004


:0041DE8B CC                      int 03
:0041DE8C CC                      int 03
:0041DE8D CC                      int 03
:0041DE8E CC                      int 03
:0041DE8F CC                      int 03

* Referenced by a CALL at Address:
|:0041D33B   
|
:0041DE90 55                      push ebp
:0041DE91 8BEC                    mov ebp, esp
:0041DE93 51                      push ecx
:0041DE94 894DFC                  mov dword ptr [ebp-04], ecx
:0041DE97 8B45FC                  mov eax, dword ptr [ebp-04]
:0041DE9A 8A4D08                  mov cl, byte ptr [ebp+08]
:0041DE9D 884822                  mov byte ptr [eax+22], cl
:0041DEA0 8BE5                    mov esp, ebp
:0041DEA2 5D                      pop ebp
:0041DEA3 C20400                  ret 0004


:0041DEA6 CC                      int 03
:0041DEA7 CC                      int 03
:0041DEA8 CC                      int 03
:0041DEA9 CC                      int 03
:0041DEAA CC                      int 03
:0041DEAB CC                      int 03
:0041DEAC CC                      int 03
:0041DEAD CC                      int 03
:0041DEAE CC                      int 03
:0041DEAF CC                      int 03

* Referenced by a CALL at Addresses:
|:0041D1AA   , :0045C7E8   , :00478416   
|
:0041DEB0 55                      push ebp
:0041DEB1 8BEC                    mov ebp, esp
:0041DEB3 51                      push ecx
:0041DEB4 894DFC                  mov dword ptr [ebp-04], ecx
:0041DEB7 8B4508                  mov eax, dword ptr [ebp+08]
:0041DEBA 50                      push eax
:0041DEBB 6A02                    push 00000002
:0041DEBD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041DEC0 E8D591FEFF              call 0040709A
:0041DEC5 8BE5                    mov esp, ebp
:0041DEC7 5D                      pop ebp
:0041DEC8 C20400                  ret 0004


:0041DECB CC                      int 03
:0041DECC CC                      int 03
:0041DECD CC                      int 03
:0041DECE CC                      int 03
:0041DECF CC                      int 03

* Referenced by a CALL at Address:
|:0041D309   
|
:0041DED0 55                      push ebp
:0041DED1 8BEC                    mov ebp, esp
:0041DED3 51                      push ecx
:0041DED4 894DFC                  mov dword ptr [ebp-04], ecx
:0041DED7 8B45FC                  mov eax, dword ptr [ebp-04]
:0041DEDA 8A4D08                  mov cl, byte ptr [ebp+08]
:0041DEDD 884823                  mov byte ptr [eax+23], cl
:0041DEE0 8BE5                    mov esp, ebp
:0041DEE2 5D                      pop ebp
:0041DEE3 C20400                  ret 0004


:0041DEE6 CC                      int 03
:0041DEE7 CC                      int 03
:0041DEE8 CC                      int 03
:0041DEE9 CC                      int 03
:0041DEEA CC                      int 03
:0041DEEB CC                      int 03
:0041DEEC CC                      int 03
:0041DEED CC                      int 03
:0041DEEE CC                      int 03
:0041DEEF CC                      int 03

* Referenced by a CALL at Addresses:
|:0041D243   , :0043C77C   , :0043C798   , :0043C7C0   , :0045C85D   
|:00478482   
|
:0041DEF0 55                      push ebp
:0041DEF1 8BEC                    mov ebp, esp
:0041DEF3 51                      push ecx
:0041DEF4 894DFC                  mov dword ptr [ebp-04], ecx
:0041DEF7 8B4508                  mov eax, dword ptr [ebp+08]
:0041DEFA 50                      push eax
:0041DEFB 6A04                    push 00000004
:0041DEFD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041DF00 E89591FEFF              call 0040709A
:0041DF05 8BE5                    mov esp, ebp
:0041DF07 5D                      pop ebp
:0041DF08 C20400                  ret 0004


:0041DF0B CC                      int 03
:0041DF0C CC                      int 03
:0041DF0D CC                      int 03
:0041DF0E CC                      int 03
:0041DF0F CC                      int 03

* Referenced by a CALL at Address:
|:0041D399   
|
:0041DF10 55                      push ebp
:0041DF11 8BEC                    mov ebp, esp
:0041DF13 51                      push ecx
:0041DF14 894DFC                  mov dword ptr [ebp-04], ecx
:0041DF17 8B45FC                  mov eax, dword ptr [ebp-04]
:0041DF1A 8A4D08                  mov cl, byte ptr [ebp+08]
:0041DF1D 884825                  mov byte ptr [eax+25], cl
:0041DF20 8BE5                    mov esp, ebp
:0041DF22 5D                      pop ebp
:0041DF23 C20400                  ret 0004


:0041DF26 CC                      int 03
:0041DF27 CC                      int 03
:0041DF28 CC                      int 03
:0041DF29 CC                      int 03
:0041DF2A CC                      int 03
:0041DF2B CC                      int 03
:0041DF2C CC                      int 03
:0041DF2D CC                      int 03
:0041DF2E CC                      int 03
:0041DF2F CC                      int 03

* Referenced by a CALL at Addresses:
|:0041D211   , :0045C836   , :0047845E   
|
:0041DF30 55                      push ebp
:0041DF31 8BEC                    mov ebp, esp
:0041DF33 51                      push ecx
:0041DF34 894DFC                  mov dword ptr [ebp-04], ecx
:0041DF37 8B4508                  mov eax, dword ptr [ebp+08]
:0041DF3A 50                      push eax
:0041DF3B 6A03                    push 00000003
:0041DF3D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041DF40 E85591FEFF              call 0040709A
:0041DF45 8BE5                    mov esp, ebp
:0041DF47 5D                      pop ebp
:0041DF48 C20400                  ret 0004


:0041DF4B CC                      int 03
:0041DF4C CC                      int 03
:0041DF4D CC                      int 03
:0041DF4E CC                      int 03
:0041DF4F CC                      int 03

* Referenced by a CALL at Address:
|:0041D36A   
|
:0041DF50 55                      push ebp
:0041DF51 8BEC                    mov ebp, esp
:0041DF53 51                      push ecx
:0041DF54 894DFC                  mov dword ptr [ebp-04], ecx
:0041DF57 8B45FC                  mov eax, dword ptr [ebp-04]
:0041DF5A 8A4D08                  mov cl, byte ptr [ebp+08]
:0041DF5D 884824                  mov byte ptr [eax+24], cl
:0041DF60 8BE5                    mov esp, ebp
:0041DF62 5D                      pop ebp
:0041DF63 C20400                  ret 0004


:0041DF66 CC                      int 03
:0041DF67 CC                      int 03
:0041DF68 CC                      int 03
:0041DF69 CC                      int 03
:0041DF6A CC                      int 03
:0041DF6B CC                      int 03
:0041DF6C CC                      int 03
:0041DF6D CC                      int 03
:0041DF6E CC                      int 03
:0041DF6F CC                      int 03

* Referenced by a CALL at Addresses:
|:0041DA4E   , :0041DAAF   , :0041DAE7   , :0041DB18   , :00438258   
|:00438279   , :0043AB2F   , :0043DE06   , :0043DF91   , :0043DFCE   
|:0043F8F8   , :004405D8   , :004428AD   , :0044DCE3   , :0045035B   
|:00450C30   , :004573D5   , :00465ACC   , :00465C46   , :00465C8D   
|
:0041DF70 55                      push ebp
:0041DF71 8BEC                    mov ebp, esp
:0041DF73 51                      push ecx
:0041DF74 894DFC                  mov dword ptr [ebp-04], ecx
:0041DF77 8B45FC                  mov eax, dword ptr [ebp-04]
:0041DF7A 8B08                    mov ecx, dword ptr [eax]
:0041DF7C 6BC948                  imul ecx, 00000048
:0041DF7F 81C1681B4A00            add ecx, 004A1B68
:0041DF85 E88686FEFF              call 00406610
:0041DF8A 8BE5                    mov esp, ebp
:0041DF8C 5D                      pop ebp
:0041DF8D C3                      ret


:0041DF8E CC                      int 03
:0041DF8F CC                      int 03

* Referenced by a CALL at Addresses:
|:0041D183   , :0041D201   , :00420C39   , :00438FB2   , :0043E736   
|:00476C4F   , :00478B68   , :00478BC7   , :0047A9AB   , :0047A9D5   
|
:0041DF90 55                      push ebp
:0041DF91 8BEC                    mov ebp, esp
:0041DF93 51                      push ecx
:0041DF94 894DFC                  mov dword ptr [ebp-04], ecx
:0041DF97 8B45FC                  mov eax, dword ptr [ebp-04]
:0041DF9A 8A4018                  mov al, byte ptr [eax+18]
:0041DF9D 8BE5                    mov esp, ebp
:0041DF9F 5D                      pop ebp
:0041DFA0 C3                      ret


:0041DFA1 CC                      int 03
:0041DFA2 CC                      int 03
:0041DFA3 CC                      int 03
:0041DFA4 CC                      int 03
:0041DFA5 CC                      int 03
:0041DFA6 CC                      int 03
:0041DFA7 CC                      int 03
:0041DFA8 CC                      int 03
:0041DFA9 CC                      int 03
:0041DFAA CC                      int 03
:0041DFAB CC                      int 03
:0041DFAC CC                      int 03
:0041DFAD CC                      int 03
:0041DFAE CC                      int 03
:0041DFAF CC                      int 03

* Referenced by a CALL at Addresses:
|:0041D1ED   , :0041D233   , :00420C46   , :00438FFB   , :00439042   
|:0043E7B5   , :00476C83   , :00478CE0   , :00478D3F   , :0047AB19   
|:0047AB43   
|
:0041DFB0 55                      push ebp
:0041DFB1 8BEC                    mov ebp, esp
:0041DFB3 51                      push ecx
:0041DFB4 894DFC                  mov dword ptr [ebp-04], ecx
:0041DFB7 8B45FC                  mov eax, dword ptr [ebp-04]
:0041DFBA 8A4019                  mov al, byte ptr [eax+19]
:0041DFBD 8BE5                    mov esp, ebp
:0041DFBF 5D                      pop ebp
:0041DFC0 C3                      ret


:0041DFC1 CC                      int 03
:0041DFC2 CC                      int 03
:0041DFC3 CC                      int 03
:0041DFC4 CC                      int 03
:0041DFC5 CC                      int 03
:0041DFC6 CC                      int 03
:0041DFC7 CC                      int 03
:0041DFC8 CC                      int 03
:0041DFC9 CC                      int 03
:0041DFCA CC                      int 03
:0041DFCB CC                      int 03
:0041DFCC CC                      int 03
:0041DFCD CC                      int 03
:0041DFCE CC                      int 03
:0041DFCF CC                      int 03

* Referenced by a CALL at Addresses:
|:0041D1B8   , :00420C2C   , :0043E834   , :00476C69   , :00478C24   
|:00478C83   , :0047AA62   , :0047AA8C   
|
:0041DFD0 55                      push ebp
:0041DFD1 8BEC                    mov ebp, esp
:0041DFD3 51                      push ecx
:0041DFD4 894DFC                  mov dword ptr [ebp-04], ecx
:0041DFD7 8B45FC                  mov eax, dword ptr [ebp-04]
:0041DFDA 8A401A                  mov al, byte ptr [eax+1A]
:0041DFDD 8BE5                    mov esp, ebp
:0041DFDF 5D                      pop ebp
:0041DFE0 C3                      ret


:0041DFE1 CC                      int 03
:0041DFE2 CC                      int 03
:0041DFE3 CC                      int 03
:0041DFE4 CC                      int 03
:0041DFE5 CC                      int 03
:0041DFE6 CC                      int 03
:0041DFE7 CC                      int 03
:0041DFE8 CC                      int 03
:0041DFE9 CC                      int 03
:0041DFEA CC                      int 03
:0041DFEB CC                      int 03
:0041DFEC CC                      int 03
:0041DFED CC                      int 03
:0041DFEE CC                      int 03
:0041DFEF CC                      int 03

* Referenced by a CALL at Addresses:
|:0041D21F   , :00420C06   , :0043E8B3   , :00476C9D   , :00478D9C   
|:00478DFB   , :0047ABD0   , :0047ABFA   
|
:0041DFF0 55                      push ebp
:0041DFF1 8BEC                    mov ebp, esp
:0041DFF3 51                      push ecx
:0041DFF4 894DFC                  mov dword ptr [ebp-04], ecx
:0041DFF7 8B45FC                  mov eax, dword ptr [ebp-04]
:0041DFFA 8A401B                  mov al, byte ptr [eax+1B]
:0041DFFD 8BE5                    mov esp, ebp
:0041DFFF 5D                      pop ebp
:0041E000 C3                      ret


:0041E001 CC                      int 03
:0041E002 CC                      int 03
:0041E003 CC                      int 03
:0041E004 CC                      int 03
:0041E005 CC                      int 03
:0041E006 CC                      int 03
:0041E007 CC                      int 03
:0041E008 CC                      int 03
:0041E009 CC                      int 03
:0041E00A CC                      int 03
:0041E00B CC                      int 03
:0041E00C CC                      int 03
:0041E00D CC                      int 03
:0041E00E CC                      int 03
:0041E00F CC                      int 03

* Referenced by a CALL at Addresses:
|:0041D251   , :00420C13   , :0043E932   , :00476CB7   , :00478E58   
|:00478EB7   , :0047AC87   , :0047ACB1   
|
:0041E010 55                      push ebp
:0041E011 8BEC                    mov ebp, esp
:0041E013 51                      push ecx
:0041E014 894DFC                  mov dword ptr [ebp-04], ecx
:0041E017 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E01A 8A401C                  mov al, byte ptr [eax+1C]
:0041E01D 8BE5                    mov esp, ebp
:0041E01F 5D                      pop ebp
:0041E020 C3                      ret


:0041E021 CC                      int 03
:0041E022 CC                      int 03
:0041E023 CC                      int 03
:0041E024 CC                      int 03
:0041E025 CC                      int 03
:0041E026 CC                      int 03
:0041E027 CC                      int 03
:0041E028 CC                      int 03
:0041E029 CC                      int 03
:0041E02A CC                      int 03
:0041E02B CC                      int 03
:0041E02C CC                      int 03
:0041E02D CC                      int 03
:0041E02E CC                      int 03
:0041E02F CC                      int 03

* Referenced by a CALL at Addresses:
|:0041C5DB   , :004207DA   , :00439088   , :00439C2C   , :0043B9F1   
|:0043BA39   , :0043C7F9   
|
:0041E030 55                      push ebp
:0041E031 8BEC                    mov ebp, esp
:0041E033 51                      push ecx
:0041E034 894DFC                  mov dword ptr [ebp-04], ecx
:0041E037 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E03A 8A401E                  mov al, byte ptr [eax+1E]
:0041E03D 8BE5                    mov esp, ebp
:0041E03F 5D                      pop ebp
:0041E040 C3                      ret


:0041E041 CC                      int 03
:0041E042 CC                      int 03
:0041E043 CC                      int 03
:0041E044 CC                      int 03
:0041E045 CC                      int 03
:0041E046 CC                      int 03
:0041E047 CC                      int 03
:0041E048 CC                      int 03
:0041E049 CC                      int 03
:0041E04A CC                      int 03
:0041E04B CC                      int 03
:0041E04C CC                      int 03
:0041E04D CC                      int 03
:0041E04E CC                      int 03
:0041E04F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040BD98   , :0042B6FA   , :0042B9AE   , :0042BC93   , :0042BD94   
|:0042C133   , :004312F5   , :0043142A   , :0044D149   , :0044D5A9   
|
:0041E050 55                      push ebp
:0041E051 8BEC                    mov ebp, esp
:0041E053 6AFF                    push FFFFFFFF
:0041E055 686C524800              push 0048526C
:0041E05A 64A100000000            mov eax, dword ptr fs:[00000000]
:0041E060 50                      push eax
:0041E061 64892500000000          mov dword ptr fs:[00000000], esp
:0041E068 81EC10010000            sub esp, 00000110
:0041E06E 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0041E074 E83752FEFF              call 004032B0
:0041E079 C745FC00000000          mov [ebp-04], 00000000

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0041E080 6A07                    push 00000007
:0041E082 E843F10500              call 0047D1CA
:0041E087 83C404                  add esp, 00000004
:0041E08A 8A450C                  mov al, byte ptr [ebp+0C]
:0041E08D 8885E4FEFFFF            mov byte ptr [ebp+FFFFFEE4], al
:0041E093 80BDE4FEFFFF00          cmp byte ptr [ebp+FFFFFEE4], 00
:0041E09A 7417                    je 0041E0B3
:0041E09C 80BDE4FEFFFF01          cmp byte ptr [ebp+FFFFFEE4], 01
:0041E0A3 743B                    je 0041E0E0
:0041E0A5 80BDE4FEFFFF02          cmp byte ptr [ebp+FFFFFEE4], 02
:0041E0AC 745F                    je 0041E10D
:0041E0AE E987000000              jmp 0041E13A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E09A(C)
|

* Possible StringData Ref from Data Obj ->"PMPALET.E5"
                                  |
:0041E0B3 6820BB4800              push 0048BB20
:0041E0B8 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0041E0BE E8721A0000              call 0041FB35
:0041E0C3 85C0                    test eax, eax
:0041E0C5 7517                    jne 0041E0DE
:0041E0C7 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0041E0CE 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0041E0D4 E8F751FEFF              call 004032D0
:0041E0D9 E9FD000000              jmp 0041E1DB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E0C5(C)
|
:0041E0DE EB71                    jmp 0041E151

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E0A3(C)
|

* Possible StringData Ref from Data Obj ->"SPALET.E5"
                                  |
:0041E0E0 6810BB4800              push 0048BB10
:0041E0E5 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0041E0EB E8451A0000              call 0041FB35
:0041E0F0 85C0                    test eax, eax
:0041E0F2 7517                    jne 0041E10B
:0041E0F4 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0041E0FB 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0041E101 E8CA51FEFF              call 004032D0
:0041E106 E9D0000000              jmp 0041E1DB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E0F2(C)
|
:0041E10B EB44                    jmp 0041E151

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E0AC(C)
|

* Possible StringData Ref from Data Obj ->"LOGO_P.E5"
                                  |
:0041E10D 68F8BA4800              push 0048BAF8
:0041E112 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0041E118 E8181A0000              call 0041FB35
:0041E11D 85C0                    test eax, eax
:0041E11F 7517                    jne 0041E138
:0041E121 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0041E128 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0041E12E E89D51FEFF              call 004032D0
:0041E133 E9A3000000              jmp 0041E1DB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E11F(C)
|
:0041E138 EB17                    jmp 0041E151

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E0AE(U)
|
:0041E13A C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0041E141 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0041E147 E88451FEFF              call 004032D0
:0041E14C E98A000000              jmp 0041E1DB

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041E0DE(U), :0041E10B(U), :0041E138(U)
|
:0041E151 6870774900              push 00497770
:0041E156 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041E159 81E1FFFF0000            and ecx, 0000FFFF
:0041E15F 51                      push ecx
:0041E160 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0041E166 E81E1B0000              call 0041FC89
:0041E16B 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0041E171 E84FB1FFFF              call 004192C5
:0041E176 C745F070774900          mov [ebp-10], 00497770
:0041E17D C785E8FEFFFF00000000    mov dword ptr [ebp+FFFFFEE8], 00000000
:0041E187 EB0F                    jmp 0041E198

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E1BA(U)
|
:0041E189 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:0041E18F 83C201                  add edx, 00000001
:0041E192 8995E8FEFFFF            mov dword ptr [ebp+FFFFFEE8], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E187(U)
|
:0041E198 81BDE8FEFFFF00030000    cmp dword ptr [ebp+FFFFFEE8], 00000300
:0041E1A2 7D18                    jge 0041E1BC
:0041E1A4 8B45F0                  mov eax, dword ptr [ebp-10]
:0041E1A7 8A08                    mov cl, byte ptr [eax]
:0041E1A9 C0E904                  shr cl, 04
:0041E1AC 8B55F0                  mov edx, dword ptr [ebp-10]
:0041E1AF 880A                    mov byte ptr [edx], cl
:0041E1B1 8B45F0                  mov eax, dword ptr [ebp-10]
:0041E1B4 83C001                  add eax, 00000001
:0041E1B7 8945F0                  mov dword ptr [ebp-10], eax
:0041E1BA EBCD                    jmp 0041E189

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E1A2(C)
|
:0041E1BC 6870774900              push 00497770
:0041E1C1 E8001B0100              call 0042FCC6
:0041E1C6 83C404                  add esp, 00000004
:0041E1C9 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0041E1D0 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0041E1D6 E8F550FEFF              call 004032D0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041E0D9(U), :0041E106(U), :0041E133(U), :0041E14C(U)
|
:0041E1DB 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041E1DE 64890D00000000          mov dword ptr fs:[00000000], ecx
:0041E1E5 8BE5                    mov esp, ebp
:0041E1E7 5D                      pop ebp
:0041E1E8 C3                      ret



* Referenced by a CALL at Address:
|:0044ED63   
|
:0041E1E9 55                      push ebp
:0041E1EA 8BEC                    mov ebp, esp
:0041E1EC E802000000              call 0041E1F3
:0041E1F1 5D                      pop ebp
:0041E1F2 C3                      ret



* Referenced by a CALL at Address:
|:0041E1EC   
|
:0041E1F3 55                      push ebp
:0041E1F4 8BEC                    mov ebp, esp
:0041E1F6 51                      push ecx

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0041E1F7 6A07                    push 00000007
:0041E1F9 E8CCEF0500              call 0047D1CA
:0041E1FE 83C404                  add esp, 00000004
:0041E201 C745FC70774900          mov [ebp-04], 00497770
:0041E208 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E20B 83C01E                  add eax, 0000001E
:0041E20E 50                      push eax

* Possible Reference to Dialog: DialogID_00EC 
                                  |
:0041E20F 68EC000000              push 000000EC
:0041E214 6A0A                    push 0000000A
:0041E216 E84C060600              call 0047E867
:0041E21B 83C40C                  add esp, 0000000C
:0041E21E 8BE5                    mov esp, ebp
:0041E220 5D                      pop ebp
:0041E221 C3                      ret



* Referenced by a CALL at Addresses:
|:0042BCA0   , :0042BDA1   , :0042F7E2   , :00431302   , :0044ED8C   
|
:0041E222 55                      push ebp
:0041E223 8BEC                    mov ebp, esp
:0041E225 6A00                    push 00000000
:0041E227 E805000000              call 0041E231
:0041E22C 83C404                  add esp, 00000004
:0041E22F 5D                      pop ebp
:0041E230 C3                      ret



* Referenced by a CALL at Addresses:
|:0041E227   , :0041E5D1   
|
:0041E231 55                      push ebp
:0041E232 8BEC                    mov ebp, esp
:0041E234 81EC14030000            sub esp, 00000314
:0041E23A 6A00                    push 00000000
:0041E23C 6800030000              push 00000300
:0041E241 8D8500FDFFFF            lea eax, dword ptr [ebp+FFFFFD00]
:0041E247 50                      push eax
:0041E248 E8C61A0600              call 0047FD13
:0041E24D 83C40C                  add esp, 0000000C
:0041E250 837D0800                cmp dword ptr [ebp+08], 00000000
:0041E254 0F8491010000            je 0041E3EB
:0041E25A 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:0041E260 51                      push ecx
:0041E261 FF1598624800            call dword ptr [00486298]
:0041E267 8985F0FCFFFF            mov dword ptr [ebp+FFFFFCF0], eax
:0041E26D 6A0C                    push 0000000C
:0041E26F 8B95F0FCFFFF            mov edx, dword ptr [ebp+FFFFFCF0]
:0041E275 52                      push edx
:0041E276 FF153C604800            call dword ptr [0048603C]
:0041E27C 33C9                    xor ecx, ecx
:0041E27E 83F808                  cmp eax, 00000008
:0041E281 0F94C1                  sete cl
:0041E284 898DF8FCFFFF            mov dword ptr [ebp+FFFFFCF8], ecx
:0041E28A C785F4FCFFFF70774900    mov dword ptr [ebp+FFFFFCF4], 00497770
:0041E294 8B95F0FCFFFF            mov edx, dword ptr [ebp+FFFFFCF0]
:0041E29A 52                      push edx
:0041E29B A1686A4B00              mov eax, dword ptr [004B6A68]
:0041E2A0 50                      push eax
:0041E2A1 FF159C624800            call dword ptr [0048629C]
:0041E2A7 C685FCFCFFFF0A          mov byte ptr [ebp+FFFFFCFC], 0A
:0041E2AE EB0F                    jmp 0041E2BF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E3E4(U)
|
:0041E2B0 8A8DFCFCFFFF            mov cl, byte ptr [ebp+FFFFFCFC]
:0041E2B6 80E901                  sub cl, 01
:0041E2B9 888DFCFCFFFF            mov byte ptr [ebp+FFFFFCFC], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E2AE(U)
|
:0041E2BF 0FBE95FCFCFFFF          movsx edx, byte ptr [ebp+FFFFFCFC]
:0041E2C6 85D2                    test edx, edx
:0041E2C8 0F8C1B010000            jl 0041E3E9
:0041E2CE E8F1070600              call 0047EAC4
:0041E2D3 C785ECFCFFFF0A000000    mov dword ptr [ebp+FFFFFCEC], 0000000A
:0041E2DD EB0F                    jmp 0041E2EE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E3AF(U)
|
:0041E2DF 8B85ECFCFFFF            mov eax, dword ptr [ebp+FFFFFCEC]
:0041E2E5 83C001                  add eax, 00000001
:0041E2E8 8985ECFCFFFF            mov dword ptr [ebp+FFFFFCEC], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E2DD(U)
|
:0041E2EE 81BDECFCFFFFF6000000    cmp dword ptr [ebp+FFFFFCEC], 000000F6
:0041E2F8 0F83B6000000            jnb 0041E3B4
:0041E2FE 8B8DECFCFFFF            mov ecx, dword ptr [ebp+FFFFFCEC]
:0041E304 6BC903                  imul ecx, 00000003
:0041E307 8B95F4FCFFFF            mov edx, dword ptr [ebp+FFFFFCF4]
:0041E30D 33C0                    xor eax, eax
:0041E30F 8A040A                  mov al, byte ptr [edx+ecx]
:0041E312 0FBE8DFCFCFFFF          movsx ecx, byte ptr [ebp+FFFFFCFC]
:0041E319 0FAFC1                  imul eax, ecx
:0041E31C 6BC00A                  imul eax, 0000000A
:0041E31F 99                      cdq
:0041E320 B964000000              mov ecx, 00000064
:0041E325 F7F9                    idiv ecx
:0041E327 8B95ECFCFFFF            mov edx, dword ptr [ebp+FFFFFCEC]
:0041E32D 6BD203                  imul edx, 00000003
:0041E330 88841500FDFFFF          mov byte ptr [ebp+edx-00000300], al
:0041E337 8B85ECFCFFFF            mov eax, dword ptr [ebp+FFFFFCEC]
:0041E33D 6BC003                  imul eax, 00000003
:0041E340 8B8DF4FCFFFF            mov ecx, dword ptr [ebp+FFFFFCF4]
:0041E346 33D2                    xor edx, edx
:0041E348 8A540101                mov dl, byte ptr [ecx+eax+01]
:0041E34C 8BC2                    mov eax, edx
:0041E34E 0FBE8DFCFCFFFF          movsx ecx, byte ptr [ebp+FFFFFCFC]
:0041E355 0FAFC1                  imul eax, ecx
:0041E358 6BC00A                  imul eax, 0000000A
:0041E35B 99                      cdq
:0041E35C B964000000              mov ecx, 00000064
:0041E361 F7F9                    idiv ecx
:0041E363 8B95ECFCFFFF            mov edx, dword ptr [ebp+FFFFFCEC]
:0041E369 6BD203                  imul edx, 00000003
:0041E36C 88841501FDFFFF          mov byte ptr [ebp+edx-000002FF], al
:0041E373 8B85ECFCFFFF            mov eax, dword ptr [ebp+FFFFFCEC]
:0041E379 6BC003                  imul eax, 00000003
:0041E37C 8B8DF4FCFFFF            mov ecx, dword ptr [ebp+FFFFFCF4]
:0041E382 33D2                    xor edx, edx
:0041E384 8A540102                mov dl, byte ptr [ecx+eax+02]
:0041E388 8BC2                    mov eax, edx
:0041E38A 0FBE8DFCFCFFFF          movsx ecx, byte ptr [ebp+FFFFFCFC]
:0041E391 0FAFC1                  imul eax, ecx
:0041E394 6BC00A                  imul eax, 0000000A
:0041E397 99                      cdq
:0041E398 B964000000              mov ecx, 00000064
:0041E39D F7F9                    idiv ecx
:0041E39F 8B95ECFCFFFF            mov edx, dword ptr [ebp+FFFFFCEC]
:0041E3A5 6BD203                  imul edx, 00000003
:0041E3A8 88841502FDFFFF          mov byte ptr [ebp+edx-000002FE], al
:0041E3AF E92BFFFFFF              jmp 0041E2DF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E2F8(C)
|
:0041E3B4 8D851EFDFFFF            lea eax, dword ptr [ebp+FFFFFD1E]
:0041E3BA 50                      push eax

* Possible Reference to Dialog: DialogID_00EC 
                                  |
:0041E3BB 68EC000000              push 000000EC
:0041E3C0 6A0A                    push 0000000A
:0041E3C2 E8A0040600              call 0047E867
:0041E3C7 83C40C                  add esp, 0000000C
:0041E3CA 83BDF8FCFFFF00          cmp dword ptr [ebp+FFFFFCF8], 00000000
:0041E3D1 7411                    je 0041E3E4
:0041E3D3 6A01                    push 00000001
:0041E3D5 B9181B4B00              mov ecx, 004B1B18
:0041E3DA E8614FFEFF              call 00403340
:0041E3DF E8FCE00000              call 0042C4E0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E3D1(C)
|
:0041E3E4 E9C7FEFFFF              jmp 0041E2B0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E2C8(C)
|
:0041E3E9 EB16                    jmp 0041E401

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E254(C)
|
:0041E3EB 8D8D1EFDFFFF            lea ecx, dword ptr [ebp+FFFFFD1E]
:0041E3F1 51                      push ecx

* Possible Reference to Dialog: DialogID_00EC 
                                  |
:0041E3F2 68EC000000              push 000000EC
:0041E3F7 6A0A                    push 0000000A
:0041E3F9 E869040600              call 0047E867
:0041E3FE 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E3E9(U)
|
:0041E401 8BE5                    mov esp, ebp
:0041E403 5D                      pop ebp
:0041E404 C3                      ret



* Referenced by a CALL at Addresses:
|:0040BA79   , :0040BB24   , :00413ED6   , :00428B19   , :0042901D   
|:0042A275   , :0042B788   , :0042BD27   , :0042BEF9   , :0042C1BC   
|:004314AB   , :00431DC4   , :00432444   , :0044D274   , :0044D398   
|:0044D6D5   
|
:0041E405 55                      push ebp
:0041E406 8BEC                    mov ebp, esp
:0041E408 81EC14030000            sub esp, 00000314
:0041E40E C745F470774900          mov [ebp-0C], 00497770
:0041E415 A1686A4B00              mov eax, dword ptr [004B6A68]
:0041E41A 50                      push eax
:0041E41B FF1598624800            call dword ptr [00486298]
:0041E421 8945F0                  mov dword ptr [ebp-10], eax
:0041E424 6A0C                    push 0000000C
:0041E426 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0041E429 51                      push ecx
:0041E42A FF153C604800            call dword ptr [0048603C]
:0041E430 33D2                    xor edx, edx
:0041E432 83F808                  cmp eax, 00000008
:0041E435 0F94C2                  sete dl
:0041E438 8955F8                  mov dword ptr [ebp-08], edx
:0041E43B 8B45F0                  mov eax, dword ptr [ebp-10]
:0041E43E 50                      push eax
:0041E43F 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:0041E445 51                      push ecx
:0041E446 FF159C624800            call dword ptr [0048629C]

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0041E44C 6A07                    push 00000007
:0041E44E E877ED0500              call 0047D1CA
:0041E453 83C404                  add esp, 00000004
:0041E456 C645FC00                mov [ebp-04], 00
:0041E45A EB09                    jmp 0041E465

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E588(U)
|
:0041E45C 8A55FC                  mov dl, byte ptr [ebp-04]
:0041E45F 80C201                  add dl, 01
:0041E462 8855FC                  mov byte ptr [ebp-04], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E45A(U)
|
:0041E465 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E468 25FF000000              and eax, 000000FF
:0041E46D 83F80A                  cmp eax, 0000000A
:0041E470 0F8D17010000            jnl 0041E58D
:0041E476 E849060600              call 0047EAC4
:0041E47B C785ECFCFFFF0A000000    mov dword ptr [ebp+FFFFFCEC], 0000000A
:0041E485 EB0F                    jmp 0041E496

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E556(U)
|
:0041E487 8B8DECFCFFFF            mov ecx, dword ptr [ebp+FFFFFCEC]
:0041E48D 83C101                  add ecx, 00000001
:0041E490 898DECFCFFFF            mov dword ptr [ebp+FFFFFCEC], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E485(U)
|
:0041E496 81BDECFCFFFFF6000000    cmp dword ptr [ebp+FFFFFCEC], 000000F6
:0041E4A0 0F83B5000000            jnb 0041E55B
:0041E4A6 8B95ECFCFFFF            mov edx, dword ptr [ebp+FFFFFCEC]
:0041E4AC 6BD203                  imul edx, 00000003
:0041E4AF 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041E4B2 33C9                    xor ecx, ecx
:0041E4B4 8A0C10                  mov cl, byte ptr [eax+edx]
:0041E4B7 8BC1                    mov eax, ecx
:0041E4B9 8B55FC                  mov edx, dword ptr [ebp-04]
:0041E4BC 81E2FF000000            and edx, 000000FF
:0041E4C2 0FAFC2                  imul eax, edx
:0041E4C5 6BC00A                  imul eax, 0000000A
:0041E4C8 99                      cdq
:0041E4C9 B964000000              mov ecx, 00000064
:0041E4CE F7F9                    idiv ecx
:0041E4D0 8B95ECFCFFFF            mov edx, dword ptr [ebp+FFFFFCEC]
:0041E4D6 6BD203                  imul edx, 00000003
:0041E4D9 888415F0FCFFFF          mov byte ptr [ebp+edx-00000310], al
:0041E4E0 8B85ECFCFFFF            mov eax, dword ptr [ebp+FFFFFCEC]
:0041E4E6 6BC003                  imul eax, 00000003
:0041E4E9 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041E4EC 33D2                    xor edx, edx
:0041E4EE 8A540101                mov dl, byte ptr [ecx+eax+01]
:0041E4F2 8BC2                    mov eax, edx
:0041E4F4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041E4F7 81E1FF000000            and ecx, 000000FF
:0041E4FD 0FAFC1                  imul eax, ecx
:0041E500 6BC00A                  imul eax, 0000000A
:0041E503 99                      cdq
:0041E504 B964000000              mov ecx, 00000064
:0041E509 F7F9                    idiv ecx
:0041E50B 8B95ECFCFFFF            mov edx, dword ptr [ebp+FFFFFCEC]
:0041E511 6BD203                  imul edx, 00000003
:0041E514 888415F1FCFFFF          mov byte ptr [ebp+edx-0000030F], al
:0041E51B 8B85ECFCFFFF            mov eax, dword ptr [ebp+FFFFFCEC]
:0041E521 6BC003                  imul eax, 00000003
:0041E524 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041E527 33D2                    xor edx, edx
:0041E529 8A540102                mov dl, byte ptr [ecx+eax+02]
:0041E52D 8BC2                    mov eax, edx
:0041E52F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041E532 81E1FF000000            and ecx, 000000FF
:0041E538 0FAFC1                  imul eax, ecx
:0041E53B 6BC00A                  imul eax, 0000000A
:0041E53E 99                      cdq
:0041E53F B964000000              mov ecx, 00000064
:0041E544 F7F9                    idiv ecx
:0041E546 8B95ECFCFFFF            mov edx, dword ptr [ebp+FFFFFCEC]
:0041E54C 6BD203                  imul edx, 00000003
:0041E54F 888415F2FCFFFF          mov byte ptr [ebp+edx-0000030E], al
:0041E556 E92CFFFFFF              jmp 0041E487

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E4A0(C)
|
:0041E55B 8D850EFDFFFF            lea eax, dword ptr [ebp+FFFFFD0E]
:0041E561 50                      push eax

* Possible Reference to Dialog: DialogID_00EC 
                                  |
:0041E562 68EC000000              push 000000EC
:0041E567 6A0A                    push 0000000A
:0041E569 E8F9020600              call 0047E867
:0041E56E 83C40C                  add esp, 0000000C
:0041E571 837DF800                cmp dword ptr [ebp-08], 00000000
:0041E575 7411                    je 0041E588
:0041E577 6A01                    push 00000001
:0041E579 B9181B4B00              mov ecx, 004B1B18
:0041E57E E8BD4DFEFF              call 00403340
:0041E583 E858DF0000              call 0042C4E0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E575(C)
|
:0041E588 E9CFFEFFFF              jmp 0041E45C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E470(C)
|
:0041E58D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041E590 83C11E                  add ecx, 0000001E
:0041E593 51                      push ecx

* Possible Reference to Dialog: DialogID_00EC 
                                  |
:0041E594 68EC000000              push 000000EC
:0041E599 6A0A                    push 0000000A
:0041E59B E8C7020600              call 0047E867
:0041E5A0 83C40C                  add esp, 0000000C
:0041E5A3 6A03                    push 00000003
:0041E5A5 B9181B4B00              mov ecx, 004B1B18
:0041E5AA E8914DFEFF              call 00403340
:0041E5AF E82CDF0000              call 0042C4E0
:0041E5B4 B9986A4B00              mov ecx, 004B6A98
:0041E5B9 E887790500              call 00475F45
:0041E5BE 8BE5                    mov esp, ebp
:0041E5C0 5D                      pop ebp
:0041E5C1 C3                      ret



* Referenced by a CALL at Addresses:
|:0040BA94   , :0040BB3F   , :00413EE5   , :0041A442   , :0042B61F   
|:0042BD36   , :0042BFD9   , :0042C116   , :0042C1E7   , :00431B29   
|:00431DDD   , :0044D2B5   , :0044D845   , :0044F023   
|
:0041E5C2 55                      push ebp
:0041E5C3 8BEC                    mov ebp, esp
:0041E5C5 B9986A4B00              mov ecx, 004B6A98
:0041E5CA E82B790500              call 00475EFA
:0041E5CF 6A01                    push 00000001
:0041E5D1 E85BFCFFFF              call 0041E231
:0041E5D6 83C404                  add esp, 00000004
:0041E5D9 5D                      pop ebp
:0041E5DA C3                      ret



* Referenced by a CALL at Addresses:
|:00401EEC   , :00402125   , :0040246B   , :00403078   , :00403764   
|:0040428B   , :0040431F   , :0040449E   , :0040466A   , :00404808   
|:00404931   , :00404A9C   , :00404C10   , :00404CBC   , :00404D96   
|:00404FFA   , :0040522C   , :0040535F   , :004055D2   , :0040860C   
|:0040BD86   , :0040FA1D   , :0040FA82   , :0040FAA3   , :0041C8FD   
|:0041C9C7   , :0041CA6C   , :0041CB5F   , :0041D89D   , :0041D9A4   
|:0041E705   , :004216F7   , :004219FC   , :0042228B   , :00422A95   
|:004281B6   , :0042997D   , :00429F4F   , :0042B73B   , :0042BCF6   
|:0042BE4E   , :0042C17E   , :0042CFEA   , :0042D3D8   , :0042D7F8   
|:0042DB7D   , :0042DE72   , :0042DF3C   , :0042DFE6   , :0042E133   
|:0042E2AB   , :0042EE39   , :0042F5E8   , :0043146B   , :00431662   
|:00431B2E   , :00431EF1   , :0043202C   , :00432242   , :004322B9   
|:00432399   , :0043245A   , :00432561   , :004325ED   , :00432642   
|:00432D87   , :00432F6E   , :00433026   , :004330CE   , :00433185   
|:0043D472   , :00440500   , :00441B57   , :00441C19   , :00441E2A   
|:00441F03   , :0044246A   , :004432EC   , :004433F7   , :0044358C   
|:004436AD   , :004438B3   , :00443A3A   , :00443D4A   , :00443DBC   
|:00443EE6   , :00444086   , :004441D8   , :004442A7   , :0044441F   
|:00444639   , :0044489C   , :00444A19   , :00444B5C   , :00444C68   
|:00444D6A   , :00444E87   , :004450EB   , :0044516F   , :00445206   
|:0044528A   , :00445321   , :004453A5   , :004454F3   , :00445566   
|:004455F9   , :004457CA   , :00445891   , :00445A1C   , :00445BBD   
|:00445E52   , :00445ECC   , :00446039   , :00446196   , :004463B4   
|:004467E6   , :00446B60   , :00446F51   , :004472E0   , :0044776A   
|:00448240   , :0044872A   , :00448AD4   , :00448B29   , :00448B62   
|:00449021   , :0044909F   , :00449106   , :00449EAB   , :0044A8E5   
|:0044AD75   , :0044AEB6   , :0044B12D   , :0044B288   , :0044B72E   
|:0044B7F1   , :0044B8C3   , :0044B995   , :0044BC1E   , :0044BE27   
|:0044BF89   , :0044C073   , :0044D34D   , :0044D886   , :0044FC1A   
|:0045023D   , :0045069D   , :00450827   , :00450ABC   , :00450DC1   
|:00450F1C   , :004511C2   , :0045233A   , :00453C8A   , :00453E45   
|:0045416A   , :00454CAB   , :00455924   , :004571BA   , :004572A7   
|:00457A75   , :00457C31   , :00457D1C   , :00457E07   , :00457FBF   
|:004581AD   , :00458467   , :0045856A   , :004586B6   , :004587FD   
|:0045896C   , :00458A90   , :00458AE4   , :00458B40   , :00458DD2   
|:00458E58   , :00459053   , :0045929B   , :00459385   , :00459B84   
|:0045CCB3   , :0045CD47   , :0045CE29   , :0045CEAB   , :0045D220   
|:0045E40D   , :00460BE8   , :00461212   , :0046D44D   , :0046D78B   
|:00473245   , :00473684   , :00473A77   , :00473B3D   , :00473C11   
|:00473CC7   , :00473F0F   , :004740FB   , :00476251   , :00476373   
|:0047654E   , :00476651   , :00476761   
|
:0041E5DB 55                      push ebp
:0041E5DC 8BEC                    mov ebp, esp
:0041E5DE A0707A4900              mov al, byte ptr [00497A70]
:0041E5E3 0401                    add al, 01
:0041E5E5 A2707A4900              mov byte ptr [00497A70], al
:0041E5EA 6A00                    push 00000000
:0041E5EC E8B4050600              call 0047EBA5
:0041E5F1 83C404                  add esp, 00000004
:0041E5F4 5D                      pop ebp
:0041E5F5 C3                      ret



* Referenced by a CALL at Addresses:
|:00401FF9   , :00402213   , :00402539   , :004030C0   , :00403792   
|:00404309   , :004043FF   , :004044CC   , :004047FE   , :004048D5   
|:00404A4F   , :00404AF8   , :00404B41   , :00404BC4   , :00404C6C   
|:00404CB2   , :00404D8C   , :00404FF0   , :00405222   , :00405355   
|:0040552E   , :004056D0   , :00408905   , :0040BDC4   , :0040FA32   
|:0040FA97   , :0040FAB4   , :004197A8   , :0041C9A3   , :0041CA56   
|:0041CAC7   , :0041CC2B   , :0041D921   , :0041DA2A   , :0041E880   
|:0041E8A0   , :0042178D   , :00421C19   , :00422461   , :00422AD8   
|:004281C0   , :00429987   , :00429FD7   , :0042B781   , :0042BD22   
|:0042BEF4   , :0042C1B5   , :0042D35F   , :0042D412   , :0042DB01   
|:0042DBE5   , :0042DE92   , :0042DFBD   , :0042E185   , :0042E36B   
|:0042EF77   , :0042F663   , :004314A6   , :00431A35   , :00431DAE   
|:00431F34   , :00432218   , :00432298   , :00432351   , :0043243F   
|:0043253D   , :004325D7   , :0043263D   , :00432692   , :00432DE8   
|:0043300B   , :00433065   , :0043316A   , :00433196   , :0043D4DB   
|:00440E6D   , :00441BC9   , :00441C8B   , :00441EBC   , :00441FDE   
|:004425D7   , :0044339E   , :0044342C   , :0044364A   , :0044376A   
|:00443A02   , :00443AE2   , :00443D82   , :00443DF4   , :00443F2A   
|:004440CA   , :0044421C   , :004442DF   , :0044446F   , :00444694   
|:004448F7   , :00444A5B   , :00444B9E   , :00444CB1   , :00444DA2   
|:00444EC9   , :00445143   , :004451B9   , :0044525E   , :004452D4   
|:00445379   , :004453EF   , :0044554B   , :004455B0   , :00445642   
|:0044582E   , :004458F5   , :00445A65   , :00445C06   , :00445EA3   
|:00445FB0   , :0044600B   , :00446120   , :0044617E   , :004461EA   
|:004465BE   , :00446996   , :00446D61   , :004470CA   , :00447569   
|:00447FA7   , :00448362   , :00448A9F   , :00448AF7   , :00448B4C   
|:00448F59   , :00449081   , :004490C0   , :00449464   , :00449D75   
|:00449EC1   , :0044A944   , :0044AE45   , :0044AF50   , :0044B1CB   
|:0044B552   , :0044B7C8   , :0044B88E   , :0044B95D   , :0044BA32   
|:0044BCB8   , :0044BEC1   , :0044C023   , :0044C10D   , :0044D393   
|:0044D9F6   , :0044FC35   , :0045062E   , :00450799   , :00450932   
|:00450D61   , :00450E83   , :00451047   , :00451242   , :00452737   
|:00453E27   , :00453E78   , :0045417C   , :00454CCA   , :004552D5   
|:00455BFB   , :004572F5   , :00457300   , :00457AB8   , :00457C74   
|:00457D5F   , :00457E4A   , :00458008   , :00458280   , :0045854A   
|:004585AD   , :0045873A   , :00458881   , :004589D1   , :00458ACE   
|:00458B2A   , :00458B99   , :00458E3D   , :00458EA8   , :004590BE   
|:004593D4   , :004593DF   , :00459BF9   , :0045CD1F   , :0045CE0B   
|:0045CE5C   , :0045D1F3   , :0045D25A   , :0045E647   , :00460C54   
|:004613EC   , :0046D4C2   , :0046D8D5   , :00473491   , :004736E3   
|:00473AC7   , :00473BE4   , :00473C58   , :00473E2A   , :00474047   
|:004741D4   , :0047630A   , :0047644B   , :004765F2   , :004766F5   
|:00476851   
|
:0041E5F6 55                      push ebp
:0041E5F7 8BEC                    mov ebp, esp
:0041E5F9 33C0                    xor eax, eax
:0041E5FB A0707A4900              mov al, byte ptr [00497A70]
:0041E600 85C0                    test eax, eax
:0041E602 7419                    je 0041E61D
:0041E604 6A01                    push 00000001
:0041E606 E89A050600              call 0047EBA5
:0041E60B 83C404                  add esp, 00000004
:0041E60E 8A0D707A4900            mov cl, byte ptr [00497A70]
:0041E614 80E901                  sub cl, 01
:0041E617 880D707A4900            mov byte ptr [00497A70], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E602(C)
|
:0041E61D 5D                      pop ebp
:0041E61E C3                      ret



* Referenced by a CALL at Address:
|:004735AD   
|
:0041E61F 55                      push ebp
:0041E620 8BEC                    mov ebp, esp

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0041E622 6A07                    push 00000007
:0041E624 E8A1EB0500              call 0047D1CA
:0041E629 83C404                  add esp, 00000004
:0041E62C 8B4518                  mov eax, dword ptr [ebp+18]
:0041E62F 50                      push eax
:0041E630 8B4D14                  mov ecx, dword ptr [ebp+14]
:0041E633 51                      push ecx
:0041E634 8B5510                  mov edx, dword ptr [ebp+10]
:0041E637 52                      push edx
:0041E638 8B450C                  mov eax, dword ptr [ebp+0C]
:0041E63B 50                      push eax
:0041E63C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041E63F 51                      push ecx
:0041E640 E80CFC0500              call 0047E251
:0041E645 83C414                  add esp, 00000014
:0041E648 5D                      pop ebp
:0041E649 C3                      ret


:0041E64A 55                      push ebp
:0041E64B 8BEC                    mov ebp, esp
:0041E64D 6A00                    push 00000000
:0041E64F E88FE40500              call 0047CAE3
:0041E654 83C404                  add esp, 00000004

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0041E657 6A07                    push 00000007
:0041E659 E86CEB0500              call 0047D1CA
:0041E65E 83C404                  add esp, 00000004
:0041E661 6A00                    push 00000000
:0041E663 6A00                    push 00000000
:0041E665 8B4518                  mov eax, dword ptr [ebp+18]
:0041E668 50                      push eax
:0041E669 E883EB0500              call 0047D1F1
:0041E66E 83C40C                  add esp, 0000000C
:0041E671 8B4D1C                  mov ecx, dword ptr [ebp+1C]
:0041E674 51                      push ecx
:0041E675 8B5514                  mov edx, dword ptr [ebp+14]
:0041E678 52                      push edx
:0041E679 8B4510                  mov eax, dword ptr [ebp+10]
:0041E67C 50                      push eax
:0041E67D 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0041E680 51                      push ecx
:0041E681 8B5508                  mov edx, dword ptr [ebp+08]
:0041E684 52                      push edx
:0041E685 E811FA0500              call 0047E09B
:0041E68A 83C414                  add esp, 00000014
:0041E68D 5D                      pop ebp
:0041E68E C3                      ret



* Referenced by a CALL at Addresses:
|:0040BD8B   , :0042B554   , :0042B74A   , :0042B7EC   , :0042B9B6   
|:0042BC9B   , :0042BD3B   , :0042BD9C   , :0042BFDE   , :0042C11B   
|:0042C1EC   , :0042F7A5   , :004312FD   , :0043147A   , :00431B33   
|:0044ED5E   
|
:0041E68F 55                      push ebp
:0041E690 8BEC                    mov ebp, esp
:0041E692 6A00                    push 00000000
:0041E694 E84AE40500              call 0047CAE3
:0041E699 83C404                  add esp, 00000004
:0041E69C E89FEC0500              call 0047D340
:0041E6A1 5D                      pop ebp
:0041E6A2 C3                      ret



* Referenced by a CALL at Addresses:
|:0041E71F   , :0042D26E   , :0042D40A   , :0042DA0D   , :0042DBB5   
|:0042E004   , :0042ED22   , :00450F44   , :004511DA   , :00460C4C   
|:00460C9B   , :0046D467   , :0046D8C1   
|
:0041E6A3 55                      push ebp
:0041E6A4 8BEC                    mov ebp, esp
:0041E6A6 6A00                    push 00000000
:0041E6A8 8B451C                  mov eax, dword ptr [ebp+1C]
:0041E6AB 50                      push eax
:0041E6AC 6A00                    push 00000000
:0041E6AE E83EEB0500              call 0047D1F1
:0041E6B3 83C40C                  add esp, 0000000C
:0041E6B6 8B4D18                  mov ecx, dword ptr [ebp+18]
:0041E6B9 51                      push ecx
:0041E6BA 8B5514                  mov edx, dword ptr [ebp+14]
:0041E6BD 8B450C                  mov eax, dword ptr [ebp+0C]
:0041E6C0 8D4C10FF                lea ecx, dword ptr [eax+edx-01]
:0041E6C4 51                      push ecx
:0041E6C5 8B5510                  mov edx, dword ptr [ebp+10]
:0041E6C8 8B4508                  mov eax, dword ptr [ebp+08]
:0041E6CB 8D4C10FF                lea ecx, dword ptr [eax+edx-01]
:0041E6CF 51                      push ecx
:0041E6D0 8B550C                  mov edx, dword ptr [ebp+0C]
:0041E6D3 52                      push edx
:0041E6D4 8B4508                  mov eax, dword ptr [ebp+08]
:0041E6D7 50                      push eax
:0041E6D8 E8E6F40500              call 0047DBC3
:0041E6DD 83C414                  add esp, 00000014
:0041E6E0 5D                      pop ebp
:0041E6E1 C3                      ret



* Referenced by a CALL at Addresses:
|:0041E79A   , :0041E954   , :0041E981   
|
:0041E6E2 55                      push ebp
:0041E6E3 8BEC                    mov ebp, esp
:0041E6E5 8B450C                  mov eax, dword ptr [ebp+0C]
:0041E6E8 50                      push eax
:0041E6E9 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041E6EC 51                      push ecx
:0041E6ED B938C54A00              mov ecx, 004AC538
:0041E6F2 E892150000              call 0041FC89
:0041E6F7 5D                      pop ebp
:0041E6F8 C3                      ret


:0041E6F9 55                      push ebp
:0041E6FA 8BEC                    mov ebp, esp
:0041E6FC 83EC10                  sub esp, 00000010
:0041E6FF 66C745F40000            mov [ebp-0C], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E8B1(U)
|
:0041E705 E8D1FEFFFF              call 0041E5DB
:0041E70A 6881000000              push 00000081
:0041E70F 6A00                    push 00000000
:0041E711 68B8010000              push 000001B8
:0041E716 6880020000              push 00000280
:0041E71B 6A28                    push 00000028
:0041E71D 6A00                    push 00000000
:0041E71F E87FFFFFFF              call 0041E6A3
:0041E724 83C418                  add esp, 00000018
:0041E727 6A00                    push 00000000
:0041E729 6A1F                    push 0000001F
:0041E72B 6A04                    push 00000004
:0041E72D E8BFEA0500              call 0047D1F1
:0041E732 83C40C                  add esp, 0000000C
:0041E735 66C745F86000            mov [ebp-08], 0060
:0041E73B EB0C                    jmp 0041E749

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E89B(U)
|
:0041E73D 668B45F8                mov ax, word ptr [ebp-08]
:0041E741 66057000                add ax, 0070
:0041E745 668945F8                mov word ptr [ebp-08], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E73B(U)
|
:0041E749 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041E74C 81E1FFFF0000            and ecx, 0000FFFF
:0041E752 83C170                  add ecx, 00000070
:0041E755 81F9E0010000            cmp ecx, 000001E0
:0041E75B 0F8D3F010000            jnl 0041E8A0
:0041E761 66C745FC3000            mov [ebp-04], 0030
:0041E767 EB0C                    jmp 0041E775

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E896(U)
|
:0041E769 668B55FC                mov dx, word ptr [ebp-04]
:0041E76D 6683C270                add dx, 0070
:0041E771 668955FC                mov word ptr [ebp-04], dx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E767(U)
|
:0041E775 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E778 25FFFF0000              and eax, 0000FFFF
:0041E77D 83C070                  add eax, 00000070
:0041E780 3D80020000              cmp eax, 00000280
:0041E785 0F8D10010000            jnl 0041E89B
:0041E78B 68A8D04A00              push 004AD0A8
:0041E790 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041E793 81E1FFFF0000            and ecx, 0000FFFF
:0041E799 51                      push ecx
:0041E79A E843FFFFFF              call 0041E6E2
:0041E79F 83C408                  add esp, 00000008
:0041E7A2 68A8D04A00              push 004AD0A8
:0041E7A7 8B55F8                  mov edx, dword ptr [ebp-08]
:0041E7AA 81E2FFFF0000            and edx, 0000FFFF
:0041E7B0 52                      push edx
:0041E7B1 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E7B4 25FFFF0000              and eax, 0000FFFF
:0041E7B9 50                      push eax
:0041E7BA E8FB000000              call 0041E8BA
:0041E7BF 83C40C                  add esp, 0000000C
:0041E7C2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041E7C5 81E1FFFF0000            and ecx, 0000FFFF
:0041E7CB 83E914                  sub ecx, 00000014
:0041E7CE 51                      push ecx
:0041E7CF 8B45FC                  mov eax, dword ptr [ebp-04]
:0041E7D2 25FFFF0000              and eax, 0000FFFF
:0041E7D7 99                      cdq
:0041E7D8 83E207                  and edx, 00000007
:0041E7DB 03C2                    add eax, edx
:0041E7DD C1F803                  sar eax, 03
:0041E7E0 50                      push eax
:0041E7E1 B9382F4900              mov ecx, 00492F38
:0041E7E6 E8EC03FFFF              call 0040EBD7
:0041E7EB 6A01                    push 00000001
:0041E7ED B9382F4900              mov ecx, 00492F38
:0041E7F2 E81305FFFF              call 0040ED0A
:0041E7F7 6A12                    push 00000012
:0041E7F9 B9382F4900              mov ecx, 00492F38
:0041E7FE E88104FFFF              call 0040EC84
:0041E803 6A18                    push 00000018
:0041E805 B9382F4900              mov ecx, 00492F38
:0041E80A E8E504FFFF              call 0040ECF4
:0041E80F 8B55F4                  mov edx, dword ptr [ebp-0C]
:0041E812 81E2FFFF0000            and edx, 0000FFFF
:0041E818 83FA07                  cmp edx, 00000007
:0041E81B 7F1D                    jg 0041E83A
:0041E81D 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041E820 25FFFF0000              and eax, 0000FFFF
:0041E825 50                      push eax

* Possible StringData Ref from Data Obj ->"S_%u"
                                  |
:0041E826 68C0B64800              push 0048B6C0
:0041E82B 68382F4900              push 00492F38
:0041E830 E86B12FFFF              call 0040FAA0
:0041E835 83C40C                  add esp, 0000000C
:0041E838 EB1F                    jmp 0041E859

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E81B(C)
|
:0041E83A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041E83D 81E1FFFF0000            and ecx, 0000FFFF
:0041E843 83E907                  sub ecx, 00000007
:0041E846 51                      push ecx

* Possible StringData Ref from Data Obj ->"%u"
                                  |
:0041E847 68C8B64800              push 0048B6C8
:0041E84C 68382F4900              push 00492F38
:0041E851 E84A12FFFF              call 0040FAA0
:0041E856 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E838(U)
|
:0041E859 6A00                    push 00000000
:0041E85B B9382F4900              mov ecx, 00492F38
:0041E860 E8A504FFFF              call 0040ED0A
:0041E865 668B55F4                mov dx, word ptr [ebp-0C]
:0041E869 6683C201                add dx, 0001
:0041E86D 668955F4                mov word ptr [ebp-0C], dx
:0041E871 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041E874 25FFFF0000              and eax, 0000FFFF
:0041E879 3DE4000000              cmp eax, 000000E4
:0041E87E 7516                    jne 0041E896
:0041E880 E871FDFFFF              call 0041E5F6
:0041E885 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0041E888 51                      push ecx
:0041E889 FF1594624800            call dword ptr [00486294]
:0041E88F E881DD0000              call 0042C615
:0041E894 EB20                    jmp 0041E8B6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E87E(C)
|
:0041E896 E9CEFEFFFF              jmp 0041E769

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E785(C)
|
:0041E89B E99DFEFFFF              jmp 0041E73D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E75B(C)
|
:0041E8A0 E851FDFFFF              call 0041E5F6
:0041E8A5 E86BDD0000              call 0042C615
:0041E8AA 83F802                  cmp eax, 00000002
:0041E8AD 7502                    jne 0041E8B1
:0041E8AF EB05                    jmp 0041E8B6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E8AD(C)
|
:0041E8B1 E94FFEFFFF              jmp 0041E705

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041E894(U), :0041E8AF(U)
|
:0041E8B6 8BE5                    mov esp, ebp
:0041E8B8 5D                      pop ebp
:0041E8B9 C3                      ret



* Referenced by a CALL at Addresses:
|:0041E7BA   , :0041E9A8   
|
:0041E8BA 55                      push ebp
:0041E8BB 8BEC                    mov ebp, esp
:0041E8BD 6A00                    push 00000000
:0041E8BF E81FE20500              call 0047CAE3
:0041E8C4 83C404                  add esp, 00000004
:0041E8C7 8B4510                  mov eax, dword ptr [ebp+10]
:0041E8CA 50                      push eax
:0041E8CB 6A50                    push 00000050
:0041E8CD 6A40                    push 00000040
:0041E8CF 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0041E8D2 51                      push ecx
:0041E8D3 8B5508                  mov edx, dword ptr [ebp+08]
:0041E8D6 52                      push edx
:0041E8D7 E8BFF70500              call 0047E09B
:0041E8DC 83C414                  add esp, 00000014
:0041E8DF 5D                      pop ebp
:0041E8E0 C3                      ret



* Referenced by a CALL at Addresses:
|:0042D1D8   , :0042D978   , :00443A58   
|
:0041E8E1 55                      push ebp
:0041E8E2 8BEC                    mov ebp, esp
:0041E8E4 83EC08                  sub esp, 00000008
:0041E8E7 C745F8FFFF0000          mov [ebp-08], 0000FFFF
:0041E8EE 817D10E4000000          cmp dword ptr [ebp+10], 000000E4
:0041E8F5 720F                    jb 0041E906
:0041E8F7 8B4510                  mov eax, dword ptr [ebp+10]
:0041E8FA 33D2                    xor edx, edx
:0041E8FC B9E4000000              mov ecx, 000000E4
:0041E901 F7F1                    div ecx
:0041E903 895510                  mov dword ptr [ebp+10], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E8F5(C)
|
:0041E906 C745FCA8D04A00          mov [ebp-04], 004AD0A8
:0041E90D 8B5510                  mov edx, dword ptr [ebp+10]
:0041E910 3B15D8BA4800            cmp edx, dword ptr [0048BAD8]
:0041E916 750C                    jne 0041E924
:0041E918 C705747A490001000000    mov dword ptr [00497A74], 00000001
:0041E922 EB78                    jmp 0041E99C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E916(C)
|
:0041E924 8B4510                  mov eax, dword ptr [ebp+10]
:0041E927 3B05DCBA4800            cmp eax, dword ptr [0048BADC]
:0041E92D 7513                    jne 0041E942
:0041E92F C745FC98AB4A00          mov [ebp-04], 004AAB98
:0041E936 C705747A490000000000    mov dword ptr [00497A74], 00000000
:0041E940 EB5A                    jmp 0041E99C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E92D(C)
|
:0041E942 833D747A490000          cmp dword ptr [00497A74], 00000000
:0041E949 7526                    jne 0041E971
:0041E94B 68A8D04A00              push 004AD0A8
:0041E950 8B4D10                  mov ecx, dword ptr [ebp+10]
:0041E953 51                      push ecx
:0041E954 E889FDFFFF              call 0041E6E2
:0041E959 83C408                  add esp, 00000008
:0041E95C 8B5510                  mov edx, dword ptr [ebp+10]
:0041E95F 8915D8BA4800            mov dword ptr [0048BAD8], edx
:0041E965 C705747A490001000000    mov dword ptr [00497A74], 00000001
:0041E96F EB2B                    jmp 0041E99C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E949(C)
|
:0041E971 C745FC98AB4A00          mov [ebp-04], 004AAB98
:0041E978 6898AB4A00              push 004AAB98
:0041E97D 8B4510                  mov eax, dword ptr [ebp+10]
:0041E980 50                      push eax
:0041E981 E85CFDFFFF              call 0041E6E2
:0041E986 83C408                  add esp, 00000008
:0041E989 8B4D10                  mov ecx, dword ptr [ebp+10]
:0041E98C 890DDCBA4800            mov dword ptr [0048BADC], ecx
:0041E992 C705747A490000000000    mov dword ptr [00497A74], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041E922(U), :0041E940(U), :0041E96F(U)
|
:0041E99C 8B55FC                  mov edx, dword ptr [ebp-04]
:0041E99F 52                      push edx
:0041E9A0 8B450C                  mov eax, dword ptr [ebp+0C]
:0041E9A3 50                      push eax
:0041E9A4 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041E9A7 51                      push ecx
:0041E9A8 E80DFFFFFF              call 0041E8BA
:0041E9AD 83C40C                  add esp, 0000000C
:0041E9B0 8BE5                    mov esp, ebp
:0041E9B2 5D                      pop ebp
:0041E9B3 C3                      ret



* Referenced by a CALL at Addresses:
|:0040BA71   , :0040BB1C   , :0041ED52   , :00431863   , :0043188E   
|:0043197E   , :004319EE   , :00431A19   , :00431BFB   , :00431C26   
|:00431CD3   , :00431D43   , :00431D6E   , :00432437   , :00432535   
|:004325CF   , :00432635   , :0043268A   , :00443642   , :00443762   
|:004439FA   , :0044AE3D   , :0044AF48   , :0044B1C3   , :0044B7C0   
|:0044B886   , :0044B955   , :0044BA2A   , :0044BCB0   , :0044BEB9   
|:0044C01B   , :0044C105   , :0044D26C   , :0044D6CD   
|
:0041E9B4 55                      push ebp
:0041E9B5 8BEC                    mov ebp, esp
:0041E9B7 83EC5C                  sub esp, 0000005C
:0041E9BA 56                      push esi
:0041E9BB 57                      push edi
:0041E9BC 837D2000                cmp dword ptr [ebp+20], 00000000
:0041E9C0 7F0F                    jg 0041E9D1
:0041E9C2 8B4514                  mov eax, dword ptr [ebp+14]
:0041E9C5 50                      push eax
:0041E9C6 E8F5290600              call 004813C0
:0041E9CB 83C404                  add esp, 00000004
:0041E9CE 894520                  mov dword ptr [ebp+20], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041E9C0(C)
|
:0041E9D1 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:0041E9D7 51                      push ecx
:0041E9D8 FF1598624800            call dword ptr [00486298]
:0041E9DE 8945C0                  mov dword ptr [ebp-40], eax
:0041E9E1 8B55C0                  mov edx, dword ptr [ebp-40]
:0041E9E4 52                      push edx
:0041E9E5 FF1564604800            call dword ptr [00486064]
:0041E9EB 8945F8                  mov dword ptr [ebp-08], eax

* Possible StringData Ref from Data Obj ->""
                                  |
:0041E9EE 68CCB64800              push 0048B6CC
:0041E9F3 6A00                    push 00000000
:0041E9F5 6A00                    push 00000000
:0041E9F7 6A00                    push 00000000
:0041E9F9 6A04                    push 00000004
:0041E9FB 6886000000              push 00000086
:0041EA00 6A00                    push 00000000
:0041EA02 6A00                    push 00000000
:0041EA04 6A00                    push 00000000
:0041EA06 68BC020000              push 000002BC
:0041EA0B 6A00                    push 00000000
:0041EA0D 6A00                    push 00000000
:0041EA0F 8B450C                  mov eax, dword ptr [ebp+0C]
:0041EA12 50                      push eax
:0041EA13 8B4D10                  mov ecx, dword ptr [ebp+10]
:0041EA16 6BC9FF                  imul ecx, FFFFFFFF
:0041EA19 51                      push ecx
:0041EA1A FF1588604800            call dword ptr [00486088]
:0041EA20 8945F0                  mov dword ptr [ebp-10], eax
:0041EA23 8B55F0                  mov edx, dword ptr [ebp-10]
:0041EA26 52                      push edx
:0041EA27 8B45F8                  mov eax, dword ptr [ebp-08]
:0041EA2A 50                      push eax
:0041EA2B FF156C604800            call dword ptr [0048606C]
:0041EA31 8945B8                  mov dword ptr [ebp-48], eax
:0041EA34 8D4DB0                  lea ecx, dword ptr [ebp-50]
:0041EA37 51                      push ecx
:0041EA38 8B5520                  mov edx, dword ptr [ebp+20]
:0041EA3B 52                      push edx
:0041EA3C 8B4514                  mov eax, dword ptr [ebp+14]
:0041EA3F 50                      push eax
:0041EA40 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041EA43 51                      push ecx
:0041EA44 FF1590604800            call dword ptr [00486090]
:0041EA4A C745C828000000          mov [ebp-38], 00000028
:0041EA51 8B45B0                  mov eax, dword ptr [ebp-50]
:0041EA54 83C01F                  add eax, 0000001F
:0041EA57 99                      cdq
:0041EA58 83E21F                  and edx, 0000001F
:0041EA5B 03C2                    add eax, edx
:0041EA5D C1F805                  sar eax, 05
:0041EA60 C1E005                  shl eax, 05
:0041EA63 8945CC                  mov dword ptr [ebp-34], eax
:0041EA66 8B55B4                  mov edx, dword ptr [ebp-4C]
:0041EA69 8955D0                  mov dword ptr [ebp-30], edx
:0041EA6C 66C745D40100            mov [ebp-2C], 0001
:0041EA72 66C745D60100            mov [ebp-2A], 0001
:0041EA78 C745D800000000          mov [ebp-28], 00000000
:0041EA7F 8B45CC                  mov eax, dword ptr [ebp-34]
:0041EA82 99                      cdq
:0041EA83 83E207                  and edx, 00000007
:0041EA86 03C2                    add eax, edx
:0041EA88 C1F803                  sar eax, 03
:0041EA8B 0FAF45D0                imul eax, dword ptr [ebp-30]
:0041EA8F 8945DC                  mov dword ptr [ebp-24], eax
:0041EA92 C745E000000000          mov [ebp-20], 00000000
:0041EA99 C745E400000000          mov [ebp-1C], 00000000
:0041EAA0 C745E800000000          mov [ebp-18], 00000000
:0041EAA7 C745EC00000000          mov [ebp-14], 00000000
:0041EAAE 6A00                    push 00000000
:0041EAB0 E83B250600              call 00480FF0
:0041EAB5 83C404                  add esp, 00000004
:0041EAB8 8945FC                  mov dword ptr [ebp-04], eax
:0041EABB 6A30                    push 00000030
:0041EABD E81E250600              call 00480FE0
:0041EAC2 83C404                  add esp, 00000004
:0041EAC5 8945BC                  mov dword ptr [ebp-44], eax
:0041EAC8 8B45FC                  mov eax, dword ptr [ebp-04]
:0041EACB 50                      push eax
:0041EACC E81F250600              call 00480FF0
:0041EAD1 83C404                  add esp, 00000004
:0041EAD4 837DBC00                cmp dword ptr [ebp-44], 00000000
:0041EAD8 7544                    jne 0041EB1E
:0041EADA 8B4DB8                  mov ecx, dword ptr [ebp-48]
:0041EADD 51                      push ecx
:0041EADE 8B55F8                  mov edx, dword ptr [ebp-08]
:0041EAE1 52                      push edx
:0041EAE2 FF156C604800            call dword ptr [0048606C]
:0041EAE8 8B45F0                  mov eax, dword ptr [ebp-10]
:0041EAEB 50                      push eax
:0041EAEC FF1548604800            call dword ptr [00486048]
:0041EAF2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041EAF5 51                      push ecx
:0041EAF6 FF15A0604800            call dword ptr [004860A0]
:0041EAFC 8B55C0                  mov edx, dword ptr [ebp-40]
:0041EAFF 52                      push edx
:0041EB00 A1686A4B00              mov eax, dword ptr [004B6A68]
:0041EB05 50                      push eax
:0041EB06 FF159C624800            call dword ptr [0048629C]
:0041EB0C 68F06E4800              push 00486EF0
:0041EB11 E8C1600500              call 00474BD7
:0041EB16 83C404                  add esp, 00000004
:0041EB19 E9D4010000              jmp 0041ECF2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EAD8(C)
|
:0041EB1E B90A000000              mov ecx, 0000000A
:0041EB23 8D75C8                  lea esi, dword ptr [ebp-38]
:0041EB26 8B7DBC                  mov edi, dword ptr [ebp-44]
:0041EB29 F3                      repz
:0041EB2A A5                      movsd
:0041EB2B 8B4DBC                  mov ecx, dword ptr [ebp-44]
:0041EB2E 83C128                  add ecx, 00000028
:0041EB31 894DC4                  mov dword ptr [ebp-3C], ecx
:0041EB34 8B55C4                  mov edx, dword ptr [ebp-3C]
:0041EB37 C602FF                  mov byte ptr [edx], FF
:0041EB3A 8B45C4                  mov eax, dword ptr [ebp-3C]
:0041EB3D C64002FF                mov [eax+02], FF
:0041EB41 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:0041EB44 C64101FF                mov [ecx+01], FF
:0041EB48 8B55C4                  mov edx, dword ptr [ebp-3C]
:0041EB4B 83C204                  add edx, 00000004
:0041EB4E 8955C4                  mov dword ptr [ebp-3C], edx
:0041EB51 8B45C4                  mov eax, dword ptr [ebp-3C]
:0041EB54 C60000                  mov byte ptr [eax], 00
:0041EB57 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:0041EB5A C6410200                mov [ecx+02], 00
:0041EB5E 8B55C4                  mov edx, dword ptr [ebp-3C]
:0041EB61 C6420100                mov [edx+01], 00
:0041EB65 6A00                    push 00000000
:0041EB67 6A00                    push 00000000
:0041EB69 8D45F4                  lea eax, dword ptr [ebp-0C]
:0041EB6C 50                      push eax
:0041EB6D 6A00                    push 00000000
:0041EB6F 8B4DBC                  mov ecx, dword ptr [ebp-44]
:0041EB72 51                      push ecx
:0041EB73 8B55C0                  mov edx, dword ptr [ebp-40]
:0041EB76 52                      push edx
:0041EB77 FF1580604800            call dword ptr [00486080]
:0041EB7D 8945AC                  mov dword ptr [ebp-54], eax
:0041EB80 837DAC00                cmp dword ptr [ebp-54], 00000000
:0041EB84 0F841A010000            je 0041ECA4
:0041EB8A 8B45AC                  mov eax, dword ptr [ebp-54]
:0041EB8D 50                      push eax
:0041EB8E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041EB91 51                      push ecx
:0041EB92 FF156C604800            call dword ptr [0048606C]
:0041EB98 C745A800000000          mov [ebp-58], 00000000
:0041EB9F EB09                    jmp 0041EBAA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EBBB(U)
|
:0041EBA1 8B55A8                  mov edx, dword ptr [ebp-58]
:0041EBA4 83C201                  add edx, 00000001
:0041EBA7 8955A8                  mov dword ptr [ebp-58], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EB9F(U)
|
:0041EBAA 8B45A8                  mov eax, dword ptr [ebp-58]
:0041EBAD 3B45DC                  cmp eax, dword ptr [ebp-24]
:0041EBB0 730B                    jnb 0041EBBD
:0041EBB2 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041EBB5 034DA8                  add ecx, dword ptr [ebp-58]
:0041EBB8 C60100                  mov byte ptr [ecx], 00
:0041EBBB EBE4                    jmp 0041EBA1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EBB0(C)
|
:0041EBBD 68FFFFFF00              push 00FFFFFF
:0041EBC2 8B55F8                  mov edx, dword ptr [ebp-08]
:0041EBC5 52                      push edx
:0041EBC6 FF157C604800            call dword ptr [0048607C]
:0041EBCC 6A00                    push 00000000
:0041EBCE 8B45F8                  mov eax, dword ptr [ebp-08]
:0041EBD1 50                      push eax
:0041EBD2 FF1584604800            call dword ptr [00486084]
:0041EBD8 8B4D20                  mov ecx, dword ptr [ebp+20]
:0041EBDB 51                      push ecx
:0041EBDC 8B5514                  mov edx, dword ptr [ebp+14]
:0041EBDF 52                      push edx
:0041EBE0 6A00                    push 00000000
:0041EBE2 6A00                    push 00000000
:0041EBE4 8B45F8                  mov eax, dword ptr [ebp-08]
:0041EBE7 50                      push eax
:0041EBE8 FF1574604800            call dword ptr [00486074]
:0041EBEE 8B4DD0                  mov ecx, dword ptr [ebp-30]
:0041EBF1 51                      push ecx
:0041EBF2 8B45DC                  mov eax, dword ptr [ebp-24]
:0041EBF5 33D2                    xor edx, edx
:0041EBF7 F775D0                  div [ebp-30]
:0041EBFA 50                      push eax
:0041EBFB 8B55F4                  mov edx, dword ptr [ebp-0C]
:0041EBFE 52                      push edx
:0041EBFF E858010000              call 0041ED5C
:0041EC04 83C40C                  add esp, 0000000C
:0041EC07 837D1C00                cmp dword ptr [ebp+1C], 00000000
:0041EC0B 7423                    je 0041EC30
:0041EC0D 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041EC10 50                      push eax
:0041EC11 8B4DD0                  mov ecx, dword ptr [ebp-30]
:0041EC14 51                      push ecx
:0041EC15 8B55CC                  mov edx, dword ptr [ebp-34]
:0041EC18 52                      push edx
:0041EC19 8B4508                  mov eax, dword ptr [ebp+08]
:0041EC1C 8B4804                  mov ecx, dword ptr [eax+04]
:0041EC1F 51                      push ecx
:0041EC20 8B5508                  mov edx, dword ptr [ebp+08]
:0041EC23 8B02                    mov eax, dword ptr [edx]
:0041EC25 50                      push eax
:0041EC26 E857F70500              call 0047E382
:0041EC2B 83C414                  add esp, 00000014
:0041EC2E EB74                    jmp 0041ECA4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EC0B(C)
|
:0041EC30 837D1800                cmp dword ptr [ebp+18], 00000000
:0041EC34 743F                    je 0041EC75
:0041EC36 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041EC39 51                      push ecx
:0041EC3A 8B55D0                  mov edx, dword ptr [ebp-30]
:0041EC3D 52                      push edx
:0041EC3E 8B45CC                  mov eax, dword ptr [ebp-34]
:0041EC41 50                      push eax
:0041EC42 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041EC45 8B4104                  mov eax, dword ptr [ecx+04]
:0041EC48 8B5508                  mov edx, dword ptr [ebp+08]
:0041EC4B 03420C                  add eax, dword ptr [edx+0C]
:0041EC4E 2B45B4                  sub eax, dword ptr [ebp-4C]
:0041EC51 99                      cdq
:0041EC52 2BC2                    sub eax, edx
:0041EC54 D1F8                    sar eax, 1
:0041EC56 50                      push eax
:0041EC57 8B4508                  mov eax, dword ptr [ebp+08]
:0041EC5A 8B00                    mov eax, dword ptr [eax]
:0041EC5C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041EC5F 034108                  add eax, dword ptr [ecx+08]
:0041EC62 2B45B0                  sub eax, dword ptr [ebp-50]
:0041EC65 99                      cdq
:0041EC66 2BC2                    sub eax, edx
:0041EC68 D1F8                    sar eax, 1
:0041EC6A 50                      push eax
:0041EC6B E812F70500              call 0047E382
:0041EC70 83C414                  add esp, 00000014
:0041EC73 EB2F                    jmp 0041ECA4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EC34(C)
|
:0041EC75 8B55F4                  mov edx, dword ptr [ebp-0C]
:0041EC78 52                      push edx
:0041EC79 8B45D0                  mov eax, dword ptr [ebp-30]
:0041EC7C 50                      push eax
:0041EC7D 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0041EC80 51                      push ecx
:0041EC81 8B5508                  mov edx, dword ptr [ebp+08]
:0041EC84 8B4204                  mov eax, dword ptr [edx+04]
:0041EC87 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041EC8A 03410C                  add eax, dword ptr [ecx+0C]
:0041EC8D 2B45B4                  sub eax, dword ptr [ebp-4C]
:0041EC90 99                      cdq
:0041EC91 2BC2                    sub eax, edx
:0041EC93 D1F8                    sar eax, 1
:0041EC95 50                      push eax
:0041EC96 8B5508                  mov edx, dword ptr [ebp+08]
:0041EC99 8B02                    mov eax, dword ptr [edx]
:0041EC9B 50                      push eax
:0041EC9C E8E1F60500              call 0047E382
:0041ECA1 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041EB84(C), :0041EC2E(U), :0041EC73(U)
|
:0041ECA4 8B4DBC                  mov ecx, dword ptr [ebp-44]
:0041ECA7 894DA4                  mov dword ptr [ebp-5C], ecx
:0041ECAA 8B55A4                  mov edx, dword ptr [ebp-5C]
:0041ECAD 52                      push edx
:0041ECAE E86D230600              call 00481020
:0041ECB3 83C404                  add esp, 00000004
:0041ECB6 8B45B8                  mov eax, dword ptr [ebp-48]
:0041ECB9 50                      push eax
:0041ECBA 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041ECBD 51                      push ecx
:0041ECBE FF156C604800            call dword ptr [0048606C]
:0041ECC4 8B55F0                  mov edx, dword ptr [ebp-10]
:0041ECC7 52                      push edx
:0041ECC8 FF1548604800            call dword ptr [00486048]
:0041ECCE 8B45F8                  mov eax, dword ptr [ebp-08]
:0041ECD1 50                      push eax
:0041ECD2 FF15A0604800            call dword ptr [004860A0]
:0041ECD8 8B4DAC                  mov ecx, dword ptr [ebp-54]
:0041ECDB 51                      push ecx
:0041ECDC FF1548604800            call dword ptr [00486048]
:0041ECE2 8B55C0                  mov edx, dword ptr [ebp-40]
:0041ECE5 52                      push edx
:0041ECE6 A1686A4B00              mov eax, dword ptr [004B6A68]
:0041ECEB 50                      push eax
:0041ECEC FF159C624800            call dword ptr [0048629C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EB19(U)
|
:0041ECF2 5F                      pop edi
:0041ECF3 5E                      pop esi
:0041ECF4 8BE5                    mov esp, ebp
:0041ECF6 5D                      pop ebp
:0041ECF7 C3                      ret



* Referenced by a CALL at Addresses:
|:0040BA08   , :0040BA41   , :0040BAC6   , :0040BAF6   , :0043240F   
|:004324AD   , :004324DD   , :0043250D   , :004435B9   , :004435E9   
|:00443619   , :004436DA   , :0044370A   , :0044373A   , :004438F3   
|:00443936   , :0044397C   , :004439BF   , :0044ADBA   , :0044AE02   
|:0044AEE5   , :0044AF17   , :0044B15E   , :0044B192   , :0044B75D   
|:0044B78F   , :0044B823   , :0044B855   , :0044B8F2   , :0044B924   
|:0044B9C7   , :0044B9F9   , :0044BC4D   , :0044BC7F   , :0044BE56   
|:0044BE88   , :0044BFB8   , :0044BFEA   , :0044C0A2   , :0044C0D4   
|:0044D206   , :0044D23E   , :0044D667   , :0044D69F   
|
:0041ECF8 55                      push ebp
:0041ECF9 8BEC                    mov ebp, esp
:0041ECFB 8B450C                  mov eax, dword ptr [ebp+0C]
:0041ECFE 03451C                  add eax, dword ptr [ebp+1C]
:0041ED01 89450C                  mov dword ptr [ebp+0C], eax
:0041ED04 8B4D14                  mov ecx, dword ptr [ebp+14]
:0041ED07 034D1C                  add ecx, dword ptr [ebp+1C]
:0041ED0A 894D14                  mov dword ptr [ebp+14], ecx
:0041ED0D 8B5508                  mov edx, dword ptr [ebp+08]
:0041ED10 03551C                  add edx, dword ptr [ebp+1C]
:0041ED13 895508                  mov dword ptr [ebp+08], edx
:0041ED16 8B4510                  mov eax, dword ptr [ebp+10]
:0041ED19 03451C                  add eax, dword ptr [ebp+1C]
:0041ED1C 894510                  mov dword ptr [ebp+10], eax
:0041ED1F 6A00                    push 00000000
:0041ED21 8B4D20                  mov ecx, dword ptr [ebp+20]
:0041ED24 81E1FF000000            and ecx, 000000FF
:0041ED2A 51                      push ecx
:0041ED2B 6A04                    push 00000004
:0041ED2D E807E50500              call 0047D239
:0041ED32 83C40C                  add esp, 0000000C
:0041ED35 6A00                    push 00000000
:0041ED37 6A00                    push 00000000
:0041ED39 8B5528                  mov edx, dword ptr [ebp+28]
:0041ED3C 52                      push edx
:0041ED3D 8B4524                  mov eax, dword ptr [ebp+24]
:0041ED40 50                      push eax
:0041ED41 8B4D18                  mov ecx, dword ptr [ebp+18]
:0041ED44 51                      push ecx
:0041ED45 8B4518                  mov eax, dword ptr [ebp+18]
:0041ED48 99                      cdq
:0041ED49 2BC2                    sub eax, edx
:0041ED4B D1F8                    sar eax, 1
:0041ED4D 50                      push eax
:0041ED4E 8D5508                  lea edx, dword ptr [ebp+08]
:0041ED51 52                      push edx
:0041ED52 E85DFCFFFF              call 0041E9B4
:0041ED57 83C41C                  add esp, 0000001C
:0041ED5A 5D                      pop ebp
:0041ED5B C3                      ret



* Referenced by a CALL at Addresses:
|:0041EBFF   , :0042D0FD   
|
:0041ED5C 55                      push ebp
:0041ED5D 8BEC                    mov ebp, esp
:0041ED5F 83EC0C                  sub esp, 0000000C
:0041ED62 56                      push esi
:0041ED63 8B4510                  mov eax, dword ptr [ebp+10]
:0041ED66 99                      cdq
:0041ED67 2BC2                    sub eax, edx
:0041ED69 D1F8                    sar eax, 1
:0041ED6B 83E801                  sub eax, 00000001
:0041ED6E 8945F4                  mov dword ptr [ebp-0C], eax
:0041ED71 EB09                    jmp 0041ED7C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EDF0(U)
|
:0041ED73 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041ED76 83E801                  sub eax, 00000001
:0041ED79 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041ED71(U)
|
:0041ED7C 837DF400                cmp dword ptr [ebp-0C], 00000000
:0041ED80 7C70                    jl 0041EDF2
:0041ED82 C745FC00000000          mov [ebp-04], 00000000
:0041ED89 EB09                    jmp 0041ED94

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EDEE(U)
|
:0041ED8B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041ED8E 83C101                  add ecx, 00000001
:0041ED91 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041ED89(U)
|
:0041ED94 8B55FC                  mov edx, dword ptr [ebp-04]
:0041ED97 3B550C                  cmp edx, dword ptr [ebp+0C]
:0041ED9A 7D54                    jge 0041EDF0
:0041ED9C 8B4508                  mov eax, dword ptr [ebp+08]
:0041ED9F 0345FC                  add eax, dword ptr [ebp-04]
:0041EDA2 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041EDA5 0FAF4D0C                imul ecx, dword ptr [ebp+0C]
:0041EDA9 8A1408                  mov dl, byte ptr [eax+ecx]
:0041EDAC 8855F8                  mov byte ptr [ebp-08], dl
:0041EDAF 8B4508                  mov eax, dword ptr [ebp+08]
:0041EDB2 0345FC                  add eax, dword ptr [ebp-04]
:0041EDB5 8B4D10                  mov ecx, dword ptr [ebp+10]
:0041EDB8 2B4DF4                  sub ecx, dword ptr [ebp-0C]
:0041EDBB 83E901                  sub ecx, 00000001
:0041EDBE 0FAF4D0C                imul ecx, dword ptr [ebp+0C]
:0041EDC2 8B5508                  mov edx, dword ptr [ebp+08]
:0041EDC5 0355FC                  add edx, dword ptr [ebp-04]
:0041EDC8 8B75F4                  mov esi, dword ptr [ebp-0C]
:0041EDCB 0FAF750C                imul esi, dword ptr [ebp+0C]
:0041EDCF 8A0408                  mov al, byte ptr [eax+ecx]
:0041EDD2 880432                  mov byte ptr [edx+esi], al
:0041EDD5 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041EDD8 034DFC                  add ecx, dword ptr [ebp-04]
:0041EDDB 8B5510                  mov edx, dword ptr [ebp+10]
:0041EDDE 2B55F4                  sub edx, dword ptr [ebp-0C]
:0041EDE1 83EA01                  sub edx, 00000001
:0041EDE4 0FAF550C                imul edx, dword ptr [ebp+0C]
:0041EDE8 8A45F8                  mov al, byte ptr [ebp-08]
:0041EDEB 880411                  mov byte ptr [ecx+edx], al
:0041EDEE EB9B                    jmp 0041ED8B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041ED9A(C)
|
:0041EDF0 EB81                    jmp 0041ED73

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041ED80(C)
|
:0041EDF2 5E                      pop esi
:0041EDF3 8BE5                    mov esp, ebp
:0041EDF5 5D                      pop ebp
:0041EDF6 C3                      ret



* Referenced by a CALL at Address:
|:0041EEB2   
|
:0041EDF7 55                      push ebp
:0041EDF8 8BEC                    mov ebp, esp
:0041EDFA 51                      push ecx
:0041EDFB 66C745FC0000            mov [ebp-04], 0000
:0041EE01 EB15                    jmp 0041EE18

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EE4D(U)
|
:0041EE03 668B45FC                mov ax, word ptr [ebp-04]
:0041EE07 66050100                add ax, 0001
:0041EE0B 668945FC                mov word ptr [ebp-04], ax
:0041EE0F 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0041EE12 83C101                  add ecx, 00000001
:0041EE15 894D0C                  mov dword ptr [ebp+0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EE01(U)
|
:0041EE18 8B55FC                  mov edx, dword ptr [ebp-04]
:0041EE1B 81E2FFFF0000            and edx, 0000FFFF
:0041EE21 8B4510                  mov eax, dword ptr [ebp+10]
:0041EE24 25FFFF0000              and eax, 0000FFFF
:0041EE29 3BD0                    cmp edx, eax
:0041EE2B 7D22                    jge 0041EE4F
:0041EE2D 8B4D10                  mov ecx, dword ptr [ebp+10]
:0041EE30 81E1FFFF0000            and ecx, 0000FFFF
:0041EE36 8B5508                  mov edx, dword ptr [ebp+08]
:0041EE39 03D1                    add edx, ecx
:0041EE3B 8B45FC                  mov eax, dword ptr [ebp-04]
:0041EE3E 25FFFF0000              and eax, 0000FFFF
:0041EE43 2BD0                    sub edx, eax
:0041EE45 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0041EE48 8A52FF                  mov dl, byte ptr [edx-01]
:0041EE4B 8811                    mov byte ptr [ecx], dl
:0041EE4D EBB4                    jmp 0041EE03

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EE2B(C)
|
:0041EE4F 8BE5                    mov esp, ebp
:0041EE51 5D                      pop ebp
:0041EE52 C3                      ret



* Referenced by a CALL at Addresses:
|:00403CE1   , :00403F56   , :00421B08   , :0042216D   , :00426D68   
|:00426D8A   , :0042D17A   , :0043D3DF   , :0043FD89   , :0043FDE6   
|:00444048   , :004443E1   , :004445BC   , :004447F7   , :00445016   
|:00445714   , :00445B54   , :00445DA7   , :00446338   , :0044673A   
|:00447266   , :00447705   , :004516F3   , :004518B5   , :00457BAF   
|:00457F3D   , :004580FE   , :0045838C   , :0045863B   , :00458D0E   
|:0045901E   
|
:0041EE53 55                      push ebp
:0041EE54 8BEC                    mov ebp, esp
:0041EE56 51                      push ecx
:0041EE57 66C745FC0000            mov [ebp-04], 0000
:0041EE5D EB0C                    jmp 0041EE6B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EEBA(U)
|
:0041EE5F 668B45FC                mov ax, word ptr [ebp-04]
:0041EE63 66050100                add ax, 0001
:0041EE67 668945FC                mov word ptr [ebp-04], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EE5D(U)
|
:0041EE6B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041EE6E 81E1FFFF0000            and ecx, 0000FFFF
:0041EE74 3B4D0C                  cmp ecx, dword ptr [ebp+0C]
:0041EE77 7D43                    jge 0041EEBC
:0041EE79 668B5508                mov dx, word ptr [ebp+08]
:0041EE7D 52                      push edx
:0041EE7E 8B4508                  mov eax, dword ptr [ebp+08]
:0041EE81 25FFFF0000              and eax, 0000FFFF
:0041EE86 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041EE89 81E1FFFF0000            and ecx, 0000FFFF
:0041EE8F 0FAFC1                  imul eax, ecx
:0041EE92 8B5514                  mov edx, dword ptr [ebp+14]
:0041EE95 03D0                    add edx, eax
:0041EE97 52                      push edx
:0041EE98 8B4508                  mov eax, dword ptr [ebp+08]
:0041EE9B 25FFFF0000              and eax, 0000FFFF
:0041EEA0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041EEA3 81E1FFFF0000            and ecx, 0000FFFF
:0041EEA9 0FAFC1                  imul eax, ecx
:0041EEAC 8B5510                  mov edx, dword ptr [ebp+10]
:0041EEAF 03D0                    add edx, eax
:0041EEB1 52                      push edx
:0041EEB2 E840FFFFFF              call 0041EDF7
:0041EEB7 83C40C                  add esp, 0000000C
:0041EEBA EBA3                    jmp 0041EE5F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EE77(C)
|
:0041EEBC 8BE5                    mov esp, ebp
:0041EEBE 5D                      pop ebp
:0041EEBF C3                      ret



* Referenced by a CALL at Address:
|:00413842   
|
:0041EEC0 55                      push ebp
:0041EEC1 8BEC                    mov ebp, esp
:0041EEC3 51                      push ecx
:0041EEC4 C745FC00000000          mov [ebp-04], 00000000
:0041EECB EB09                    jmp 0041EED6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EF06(U)
|
:0041EECD 8B45FC                  mov eax, dword ptr [ebp-04]
:0041EED0 83C001                  add eax, 00000001
:0041EED3 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EECB(U)
|
:0041EED6 817DFC00020000          cmp dword ptr [ebp-04], 00000200
:0041EEDD 7329                    jnb 0041EF08
:0041EEDF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041EEE2 6BC948                  imul ecx, 00000048
:0041EEE5 81C1681B4A00            add ecx, 004A1B68
:0041EEEB E830000000              call 0041EF20
:0041EEF0 50                      push eax
:0041EEF1 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041EEF4 51                      push ecx
:0041EEF5 E8C90D0600              call 0047FCC3
:0041EEFA 83C408                  add esp, 00000008
:0041EEFD 85C0                    test eax, eax
:0041EEFF 7505                    jne 0041EF06
:0041EF01 8B45FC                  mov eax, dword ptr [ebp-04]
:0041EF04 EB07                    jmp 0041EF0D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EEFF(C)
|
:0041EF06 EBC5                    jmp 0041EECD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EEDD(C)
|
:0041EF08 B8FFFF0000              mov eax, 0000FFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EF04(U)
|
:0041EF0D 8BE5                    mov esp, ebp
:0041EF0F 5D                      pop ebp
:0041EF10 C3                      ret


:0041EF11 CC                      int 03
:0041EF12 CC                      int 03
:0041EF13 CC                      int 03
:0041EF14 CC                      int 03
:0041EF15 CC                      int 03
:0041EF16 CC                      int 03
:0041EF17 CC                      int 03
:0041EF18 CC                      int 03
:0041EF19 CC                      int 03
:0041EF1A CC                      int 03
:0041EF1B CC                      int 03
:0041EF1C CC                      int 03
:0041EF1D CC                      int 03
:0041EF1E CC                      int 03
:0041EF1F CC                      int 03

* Referenced by a CALL at Address:
|:0041EEEB   
|
:0041EF20 55                      push ebp
:0041EF21 8BEC                    mov ebp, esp
:0041EF23 51                      push ecx
:0041EF24 894DFC                  mov dword ptr [ebp-04], ecx
:0041EF27 8B45FC                  mov eax, dword ptr [ebp-04]
:0041EF2A 83C008                  add eax, 00000008
:0041EF2D 8BE5                    mov esp, ebp
:0041EF2F 5D                      pop ebp
:0041EF30 C3                      ret


:0041EF31 CC                      int 03
:0041EF32 CC                      int 03
:0041EF33 CC                      int 03
:0041EF34 CC                      int 03
:0041EF35 CC                      int 03
:0041EF36 CC                      int 03
:0041EF37 CC                      int 03
:0041EF38 CC                      int 03
:0041EF39 CC                      int 03
:0041EF3A CC                      int 03
:0041EF3B CC                      int 03
:0041EF3C CC                      int 03
:0041EF3D CC                      int 03
:0041EF3E CC                      int 03
:0041EF3F CC                      int 03
:0041EF40 55                      push ebp
:0041EF41 8BEC                    mov ebp, esp
:0041EF43 E807000000              call 0041EF4F
:0041EF48 E811000000              call 0041EF5E
:0041EF4D 5D                      pop ebp
:0041EF4E C3                      ret



* Referenced by a CALL at Address:
|:0041EF43   
|
:0041EF4F 55                      push ebp
:0041EF50 8BEC                    mov ebp, esp
:0041EF52 B9787A4900              mov ecx, 00497A78
:0041EF57 E8240A0000              call 0041F980
:0041EF5C 5D                      pop ebp
:0041EF5D C3                      ret



* Referenced by a CALL at Address:
|:0041EF48   
|
:0041EF5E 55                      push ebp
:0041EF5F 8BEC                    mov ebp, esp
:0041EF61 6870EF4100              push 0041EF70
:0041EF66 E895210600              call 00481100
:0041EF6B 83C404                  add esp, 00000004
:0041EF6E 5D                      pop ebp
:0041EF6F C3                      ret


:0041EF70 55                      push ebp
:0041EF71 8BEC                    mov ebp, esp
:0041EF73 B9787A4900              mov ecx, 00497A78
:0041EF78 E8E2000000              call 0041F05F
:0041EF7D 5D                      pop ebp
:0041EF7E C3                      ret


:0041EF7F 55                      push ebp
:0041EF80 8BEC                    mov ebp, esp
:0041EF82 E807000000              call 0041EF8E
:0041EF87 E811000000              call 0041EF9D
:0041EF8C 5D                      pop ebp
:0041EF8D C3                      ret



* Referenced by a CALL at Address:
|:0041EF82   
|
:0041EF8E 55                      push ebp
:0041EF8F 8BEC                    mov ebp, esp
:0041EF91 B9A07A4900              mov ecx, 00497AA0
:0041EF96 E845090000              call 0041F8E0
:0041EF9B 5D                      pop ebp
:0041EF9C C3                      ret



* Referenced by a CALL at Address:
|:0041EF87   
|
:0041EF9D 55                      push ebp
:0041EF9E 8BEC                    mov ebp, esp
:0041EFA0 68AFEF4100              push 0041EFAF
:0041EFA5 E856210600              call 00481100
:0041EFAA 83C404                  add esp, 00000004
:0041EFAD 5D                      pop ebp
:0041EFAE C3                      ret


:0041EFAF 55                      push ebp
:0041EFB0 8BEC                    mov ebp, esp
:0041EFB2 B9A07A4900              mov ecx, 00497AA0
:0041EFB7 E8F36B0000              call 00425BAF
:0041EFBC 5D                      pop ebp
:0041EFBD C3                      ret


:0041EFBE 55                      push ebp
:0041EFBF 8BEC                    mov ebp, esp
:0041EFC1 83EC18                  sub esp, 00000018
:0041EFC4 837D0800                cmp dword ptr [ebp+08], 00000000
:0041EFC8 7C76                    jl 0041F040
:0041EFCA 8B4510                  mov eax, dword ptr [ebp+10]
:0041EFCD 8B08                    mov ecx, dword ptr [eax]
:0041EFCF 894DFC                  mov dword ptr [ebp-04], ecx
:0041EFD2 8B5510                  mov edx, dword ptr [ebp+10]
:0041EFD5 8B4204                  mov eax, dword ptr [edx+04]
:0041EFD8 8945F8                  mov dword ptr [ebp-08], eax
:0041EFDB 817DF801020000          cmp dword ptr [ebp-08], 00000201
:0041EFE2 755C                    jne 0041F040
:0041EFE4 833D947A490000          cmp dword ptr [00497A94], 00000000
:0041EFEB 7417                    je 0041F004
:0041EFED 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041EFF0 3B0D9C7A4900            cmp ecx, dword ptr [00497A9C]
:0041EFF6 750A                    jne 0041F002
:0041EFF8 C705907A490001000000    mov dword ptr [00497A90], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EFF6(C)
|
:0041F002 EB3C                    jmp 0041F040

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041EFEB(C)
|
:0041F004 33D2                    xor edx, edx
:0041F006 668B15686A4B00          mov dx, word ptr [004B6A68]
:0041F00D 8955EC                  mov dword ptr [ebp-14], edx
:0041F010 C745F400000000          mov [ebp-0C], 00000000
:0041F017 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041F01A 8945F0                  mov dword ptr [ebp-10], eax
:0041F01D C745E801000000          mov [ebp-18], 00000001
:0041F024 8D4DEC                  lea ecx, dword ptr [ebp-14]
:0041F027 51                      push ecx
:0041F028 8B55E8                  mov edx, dword ptr [ebp-18]
:0041F02B 52                      push edx
:0041F02C 6806080000              push 00000806
:0041F031 33C0                    xor eax, eax
:0041F033 66A1E07A4900            mov ax, word ptr [00497AE0]
:0041F039 50                      push eax
:0041F03A FF15CC634800            call dword ptr [004863CC]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041EFC8(C), :0041EFE2(C), :0041F002(U)
|
:0041F040 8B4D10                  mov ecx, dword ptr [ebp+10]
:0041F043 51                      push ecx
:0041F044 8B550C                  mov edx, dword ptr [ebp+0C]
:0041F047 52                      push edx
:0041F048 8B4508                  mov eax, dword ptr [ebp+08]
:0041F04B 50                      push eax
:0041F04C 8B0D987A4900            mov ecx, dword ptr [00497A98]
:0041F052 51                      push ecx
:0041F053 FF1590624800            call dword ptr [00486290]
:0041F059 8BE5                    mov esp, ebp
:0041F05B 5D                      pop ebp
:0041F05C C20C00                  ret 000C



* Referenced by a CALL at Address:
|:0041EF78   
|
:0041F05F 55                      push ebp
:0041F060 8BEC                    mov ebp, esp
:0041F062 51                      push ecx
:0041F063 894DFC                  mov dword ptr [ebp-04], ecx
:0041F066 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041F069 E804000000              call 0041F072
:0041F06E 8BE5                    mov esp, ebp
:0041F070 5D                      pop ebp
:0041F071 C3                      ret



* Referenced by a CALL at Addresses:
|:0041F069   , :0041F806   
|
:0041F072 55                      push ebp
:0041F073 8BEC                    mov ebp, esp
:0041F075 83EC20                  sub esp, 00000020
:0041F078 894DE0                  mov dword ptr [ebp-20], ecx
:0041F07B C745E400000000          mov [ebp-1C], 00000000
:0041F082 C745E800000000          mov [ebp-18], 00000000

* Possible StringData Ref from Data Obj ->"avivideo"
                                  |
:0041F089 C745EC14B74800          mov [ebp-14], 0048B714
:0041F090 C745F000000000          mov [ebp-10], 00000000
:0041F097 C745F400000000          mov [ebp-0C], 00000000
:0041F09E C745F800000000          mov [ebp-08], 00000000
:0041F0A5 C745FC00000000          mov [ebp-04], 00000000
:0041F0AC 8D45E4                  lea eax, dword ptr [ebp-1C]
:0041F0AF 50                      push eax
:0041F0B0 6800200000              push 00002000
:0041F0B5 6803080000              push 00000803
:0041F0BA 6A00                    push 00000000
:0041F0BC FF15CC634800            call dword ptr [004863CC]
:0041F0C2 F7D8                    neg eax
:0041F0C4 1BC0                    sbb eax, eax
:0041F0C6 40                      inc eax
:0041F0C7 8BE5                    mov esp, ebp
:0041F0C9 5D                      pop ebp
:0041F0CA C3                      ret



* Referenced by a CALL at Addresses:
|:0041F15B   , :0041F673   , :0041F81A   
|
:0041F0CB 55                      push ebp
:0041F0CC 8BEC                    mov ebp, esp
:0041F0CE 83EC08                  sub esp, 00000008
:0041F0D1 894DF8                  mov dword ptr [ebp-08], ecx
:0041F0D4 8B45F8                  mov eax, dword ptr [ebp-08]
:0041F0D7 83781000                cmp dword ptr [eax+10], 00000000
:0041F0DB 7453                    je 0041F130
:0041F0DD 8B0D987A4900            mov ecx, dword ptr [00497A98]
:0041F0E3 51                      push ecx
:0041F0E4 FF158C624800            call dword ptr [0048628C]
:0041F0EA 8D55FC                  lea edx, dword ptr [ebp-04]
:0041F0ED 52                      push edx
:0041F0EE 6A00                    push 00000000
:0041F0F0 6804080000              push 00000804
:0041F0F5 33C0                    xor eax, eax
:0041F0F7 66A1E07A4900            mov ax, word ptr [00497AE0]
:0041F0FD 50                      push eax
:0041F0FE FF15CC634800            call dword ptr [004863CC]
:0041F104 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041F107 C7411400000000          mov [ecx+14], 00000000
:0041F10E 8B55F8                  mov edx, dword ptr [ebp-08]
:0041F111 C7421000000000          mov [edx+10], 00000000
:0041F118 6A01                    push 00000001
:0041F11A 6A00                    push 00000000
:0041F11C 8B4508                  mov eax, dword ptr [ebp+08]
:0041F11F 50                      push eax
:0041F120 FF15A4624800            call dword ptr [004862A4]
:0041F126 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041F129 51                      push ecx
:0041F12A FF15A8624800            call dword ptr [004862A8]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F0DB(C)
|
:0041F130 B801000000              mov eax, 00000001
:0041F135 8BE5                    mov esp, ebp
:0041F137 5D                      pop ebp
:0041F138 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0041F54C   
|
:0041F13B 55                      push ebp
:0041F13C 8BEC                    mov ebp, esp
:0041F13E 83EC50                  sub esp, 00000050
:0041F141 894DB0                  mov dword ptr [ebp-50], ecx
:0041F144 C745FC00000000          mov [ebp-04], 00000000
:0041F14B 8B45B0                  mov eax, dword ptr [ebp-50]
:0041F14E 83781000                cmp dword ptr [eax+10], 00000000
:0041F152 740C                    je 0041F160
:0041F154 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041F157 51                      push ecx
:0041F158 8B4DB0                  mov ecx, dword ptr [ebp-50]
:0041F15B E86BFFFFFF              call 0041F0CB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F152(C)
|
:0041F160 C745B400000000          mov [ebp-4C], 00000000
:0041F167 C745B800000000          mov [ebp-48], 00000000
:0041F16E C745BC00000000          mov [ebp-44], 00000000
:0041F175 8B550C                  mov edx, dword ptr [ebp+0C]
:0041F178 8955C0                  mov dword ptr [ebp-40], edx
:0041F17B C745C400000000          mov [ebp-3C], 00000000
:0041F182 C745C800000080          mov [ebp-38], 80000000
:0041F189 8B4508                  mov eax, dword ptr [ebp+08]
:0041F18C 8945CC                  mov dword ptr [ebp-34], eax
:0041F18F C745D000000000          mov [ebp-30], 00000000
:0041F196 EB09                    jmp 0041F1A1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F1CA(U)
|
:0041F198 8B4DD0                  mov ecx, dword ptr [ebp-30]
:0041F19B 83C101                  add ecx, 00000001
:0041F19E 894DD0                  mov dword ptr [ebp-30], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F196(U)
|
:0041F1A1 837DD005                cmp dword ptr [ebp-30], 00000005
:0041F1A5 7D25                    jge 0041F1CC
:0041F1A7 8D55B4                  lea edx, dword ptr [ebp-4C]
:0041F1AA 52                      push edx
:0041F1AB 6800020300              push 00030200
:0041F1B0 6803080000              push 00000803
:0041F1B5 6A00                    push 00000000
:0041F1B7 FF15CC634800            call dword ptr [004863CC]
:0041F1BD 85C0                    test eax, eax
:0041F1BF 7509                    jne 0041F1CA
:0041F1C1 C745FC01000000          mov [ebp-04], 00000001
:0041F1C8 EB02                    jmp 0041F1CC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F1BF(C)
|
:0041F1CA EBCC                    jmp 0041F198

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041F1A5(C), :0041F1C8(U)
|
:0041F1CC 837DFC00                cmp dword ptr [ebp-04], 00000000
:0041F1D0 0F8488000000            je 0041F25E
:0041F1D6 668B45B8                mov ax, word ptr [ebp-48]
:0041F1DA 66A3E07A4900            mov word ptr [00497AE0], ax
:0041F1E0 8B4DB0                  mov ecx, dword ptr [ebp-50]
:0041F1E3 C7411001000000          mov [ecx+10], 00000001
:0041F1EA C745EC00000000          mov [ebp-14], 00000000
:0041F1F1 C745F000000000          mov [ebp-10], 00000000
:0041F1F8 C745F405000000          mov [ebp-0C], 00000005
:0041F1FF C745F800000000          mov [ebp-08], 00000000
:0041F206 8D55EC                  lea edx, dword ptr [ebp-14]
:0041F209 52                      push edx
:0041F20A 6800000400              push 00040000
:0041F20F 6841080000              push 00000841
:0041F214 33C0                    xor eax, eax
:0041F216 66A1E07A4900            mov ax, word ptr [00497AE0]
:0041F21C 50                      push eax
:0041F21D FF15CC634800            call dword ptr [004863CC]
:0041F223 C745DC01400000          mov [ebp-24], 00004001
:0041F22A 8D4DD4                  lea ecx, dword ptr [ebp-2C]
:0041F22D 51                      push ecx
:0041F22E 6800010000              push 00000100
:0041F233 6814080000              push 00000814
:0041F238 33D2                    xor edx, edx
:0041F23A 668B15E07A4900          mov dx, word ptr [00497AE0]
:0041F241 52                      push edx
:0041F242 FF15CC634800            call dword ptr [004863CC]
:0041F248 8B45D8                  mov eax, dword ptr [ebp-28]
:0041F24B A39C7A4900              mov dword ptr [00497A9C], eax
:0041F250 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041F253 51                      push ecx
:0041F254 8B4DB0                  mov ecx, dword ptr [ebp-50]
:0041F257 E87E000000              call 0041F2DA
:0041F25C EB24                    jmp 0041F282

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F1D0(C)
|
:0041F25E 6A30                    push 00000030

* Possible StringData Ref from Data Obj ->"־ܲٴ"
                                  |
:0041F260 6820B74800              push 0048B720

* Possible StringData Ref from Data Obj ->"ļʧܡ"
                                  |
:0041F265 6834B74800              push 0048B734
:0041F26A 8B5508                  mov edx, dword ptr [ebp+08]
:0041F26D 52                      push edx
:0041F26E FF15C4624800            call dword ptr [004862C4]
:0041F274 8B45B0                  mov eax, dword ptr [ebp-50]
:0041F277 C7401000000000          mov [eax+10], 00000000
:0041F27E 33C0                    xor eax, eax
:0041F280 EB52                    jmp 0041F2D4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F25C(U)
|
:0041F282 6A00                    push 00000000
:0041F284 6A00                    push 00000000
:0041F286 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041F289 51                      push ecx
:0041F28A FF15A4624800            call dword ptr [004862A4]
:0041F290 8B5508                  mov edx, dword ptr [ebp+08]
:0041F293 52                      push edx
:0041F294 FF15A8624800            call dword ptr [004862A8]
:0041F29A A1686A4B00              mov eax, dword ptr [004B6A68]
:0041F29F 50                      push eax
:0041F2A0 FF15CC624800            call dword ptr [004862CC]
:0041F2A6 6A00                    push 00000000
:0041F2A8 8B0D9C7A4900            mov ecx, dword ptr [00497A9C]
:0041F2AE 51                      push ecx
:0041F2AF FF1584624800            call dword ptr [00486284]
:0041F2B5 50                      push eax
:0041F2B6 8B15606A4B00            mov edx, dword ptr [004B6A60]
:0041F2BC 52                      push edx
:0041F2BD 68BEEF4100              push 0041EFBE
:0041F2C2 6A03                    push 00000003
:0041F2C4 FF1588624800            call dword ptr [00486288]
:0041F2CA A3987A4900              mov dword ptr [00497A98], eax
:0041F2CF B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F280(U)
|
:0041F2D4 8BE5                    mov esp, ebp
:0041F2D6 5D                      pop ebp
:0041F2D7 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0041F257   , :0041F85B   
|
:0041F2DA 55                      push ebp
:0041F2DB 8BEC                    mov ebp, esp
:0041F2DD 83EC40                  sub esp, 00000040
:0041F2E0 894DC0                  mov dword ptr [ebp-40], ecx
:0041F2E3 8B45C0                  mov eax, dword ptr [ebp-40]
:0041F2E6 83781000                cmp dword ptr [eax+10], 00000000
:0041F2EA 7505                    jne 0041F2F1
:0041F2EC E9ED000000              jmp 0041F3DE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F2EA(C)
|
:0041F2F1 8D4DC4                  lea ecx, dword ptr [ebp-3C]
:0041F2F4 51                      push ecx
:0041F2F5 8B5508                  mov edx, dword ptr [ebp+08]
:0041F2F8 52                      push edx
:0041F2F9 FF15EC624800            call dword ptr [004862EC]
:0041F2FF 8D45D4                  lea eax, dword ptr [ebp-2C]
:0041F302 50                      push eax
:0041F303 6800000200              push 00020000
:0041F308 6843080000              push 00000843
:0041F30D 33C9                    xor ecx, ecx
:0041F30F 668B0DE07A4900          mov cx, word ptr [00497AE0]
:0041F316 51                      push ecx
:0041F317 FF15CC634800            call dword ptr [004863CC]
:0041F31D 8B55D8                  mov edx, dword ptr [ebp-28]
:0041F320 8955E8                  mov dword ptr [ebp-18], edx
:0041F323 8B45DC                  mov eax, dword ptr [ebp-24]
:0041F326 8945EC                  mov dword ptr [ebp-14], eax
:0041F329 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0041F32C 894DF0                  mov dword ptr [ebp-10], ecx
:0041F32F 8B55E4                  mov edx, dword ptr [ebp-1C]
:0041F332 8955F4                  mov dword ptr [ebp-0C], edx
:0041F335 8B45CC                  mov eax, dword ptr [ebp-34]
:0041F338 99                      cdq
:0041F339 2BC2                    sub eax, edx
:0041F33B 8BC8                    mov ecx, eax
:0041F33D D1F9                    sar ecx, 1
:0041F33F 8B45F0                  mov eax, dword ptr [ebp-10]
:0041F342 99                      cdq
:0041F343 2BC2                    sub eax, edx
:0041F345 D1F8                    sar eax, 1
:0041F347 2BC8                    sub ecx, eax
:0041F349 8B55C0                  mov edx, dword ptr [ebp-40]
:0041F34C 890A                    mov dword ptr [edx], ecx
:0041F34E 8B45D0                  mov eax, dword ptr [ebp-30]
:0041F351 99                      cdq
:0041F352 2BC2                    sub eax, edx
:0041F354 8BC8                    mov ecx, eax
:0041F356 D1F9                    sar ecx, 1
:0041F358 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041F35B 99                      cdq
:0041F35C 2BC2                    sub eax, edx
:0041F35E D1F8                    sar eax, 1
:0041F360 2BC8                    sub ecx, eax
:0041F362 8B55C0                  mov edx, dword ptr [ebp-40]
:0041F365 894A04                  mov dword ptr [edx+04], ecx
:0041F368 8B45C0                  mov eax, dword ptr [ebp-40]
:0041F36B 8B08                    mov ecx, dword ptr [eax]
:0041F36D 034DF0                  add ecx, dword ptr [ebp-10]
:0041F370 8B55C0                  mov edx, dword ptr [ebp-40]
:0041F373 894A08                  mov dword ptr [edx+08], ecx
:0041F376 8B45C0                  mov eax, dword ptr [ebp-40]
:0041F379 8B4804                  mov ecx, dword ptr [eax+04]
:0041F37C 034DF4                  add ecx, dword ptr [ebp-0C]
:0041F37F 8B55C0                  mov edx, dword ptr [ebp-40]
:0041F382 894A0C                  mov dword ptr [edx+0C], ecx
:0041F385 8B45C0                  mov eax, dword ptr [ebp-40]
:0041F388 8B08                    mov ecx, dword ptr [eax]
:0041F38A 894DF8                  mov dword ptr [ebp-08], ecx
:0041F38D 8B55C0                  mov edx, dword ptr [ebp-40]
:0041F390 8B4204                  mov eax, dword ptr [edx+04]
:0041F393 8945FC                  mov dword ptr [ebp-04], eax
:0041F396 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0041F399 51                      push ecx
:0041F39A 8B5508                  mov edx, dword ptr [ebp+08]
:0041F39D 52                      push edx
:0041F39E FF1520634800            call dword ptr [00486320]
:0041F3A4 8B45C0                  mov eax, dword ptr [ebp-40]
:0041F3A7 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041F3AA 8908                    mov dword ptr [eax], ecx
:0041F3AC 8B55C0                  mov edx, dword ptr [ebp-40]
:0041F3AF 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F3B2 894204                  mov dword ptr [edx+04], eax
:0041F3B5 6A00                    push 00000000
:0041F3B7 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041F3BA 51                      push ecx
:0041F3BB 8B55F0                  mov edx, dword ptr [ebp-10]
:0041F3BE 52                      push edx
:0041F3BF 8B45C0                  mov eax, dword ptr [ebp-40]
:0041F3C2 8B4804                  mov ecx, dword ptr [eax+04]
:0041F3C5 83C110                  add ecx, 00000010
:0041F3C8 51                      push ecx
:0041F3C9 8B55C0                  mov edx, dword ptr [ebp-40]
:0041F3CC 8B02                    mov eax, dword ptr [edx]
:0041F3CE 50                      push eax
:0041F3CF 6A00                    push 00000000
:0041F3D1 8B0D9C7A4900            mov ecx, dword ptr [00497A9C]
:0041F3D7 51                      push ecx
:0041F3D8 FF1580624800            call dword ptr [00486280]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F2EC(U)
|
:0041F3DE 8BE5                    mov esp, ebp
:0041F3E0 5D                      pop ebp
:0041F3E1 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0041F59F   
|
:0041F3E4 55                      push ebp
:0041F3E5 8BEC                    mov ebp, esp
:0041F3E7 83EC18                  sub esp, 00000018
:0041F3EA 894DE8                  mov dword ptr [ebp-18], ecx
:0041F3ED 8B45E8                  mov eax, dword ptr [ebp-18]
:0041F3F0 C7401401000000          mov [eax+14], 00000001
:0041F3F7 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041F3FA 83791400                cmp dword ptr [ecx+14], 00000000
:0041F3FE 745B                    je 0041F45B
:0041F400 8B5508                  mov edx, dword ptr [ebp+08]
:0041F403 81E2FFFF0000            and edx, 0000FFFF
:0041F409 8955F0                  mov dword ptr [ebp-10], edx
:0041F40C C745F800000000          mov [ebp-08], 00000000
:0041F413 8B45F8                  mov eax, dword ptr [ebp-08]
:0041F416 8945F4                  mov dword ptr [ebp-0C], eax
:0041F419 C745EC01000000          mov [ebp-14], 00000001
:0041F420 6A00                    push 00000000
:0041F422 6800010000              push 00000100
:0041F427 6807080000              push 00000807
:0041F42C 33C9                    xor ecx, ecx
:0041F42E 668B0DE07A4900          mov cx, word ptr [00497AE0]
:0041F435 51                      push ecx
:0041F436 FF15CC634800            call dword ptr [004863CC]
:0041F43C 8D55F0                  lea edx, dword ptr [ebp-10]
:0041F43F 52                      push edx
:0041F440 8B45EC                  mov eax, dword ptr [ebp-14]
:0041F443 50                      push eax
:0041F444 6806080000              push 00000806
:0041F449 33C9                    xor ecx, ecx
:0041F44B 668B0DE07A4900          mov cx, word ptr [00497AE0]
:0041F452 51                      push ecx
:0041F453 FF15CC634800            call dword ptr [004863CC]
:0041F459 EB1A                    jmp 0041F475

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F3FE(C)
|
:0041F45B 8D55FC                  lea edx, dword ptr [ebp-04]
:0041F45E 52                      push edx
:0041F45F 6A00                    push 00000000
:0041F461 6809080000              push 00000809
:0041F466 33C0                    xor eax, eax
:0041F468 66A1E07A4900            mov ax, word ptr [00497AE0]
:0041F46E 50                      push eax
:0041F46F FF15CC634800            call dword ptr [004863CC]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F459(U)
|
:0041F475 B801000000              mov eax, 00000001
:0041F47A 8BE5                    mov esp, ebp
:0041F47C 5D                      pop ebp
:0041F47D C20400                  ret 0004



* Referenced by a CALL at Address:
|:0041F848   
|
:0041F480 55                      push ebp
:0041F481 8BEC                    mov ebp, esp
:0041F483 83EC08                  sub esp, 00000008
:0041F486 894DFC                  mov dword ptr [ebp-04], ecx
:0041F489 33C0                    xor eax, eax
:0041F48B 66A1E07A4900            mov ax, word ptr [00497AE0]
:0041F491 39450C                  cmp dword ptr [ebp+0C], eax
:0041F494 751F                    jne 0041F4B5
:0041F496 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041F499 894DF8                  mov dword ptr [ebp-08], ecx
:0041F49C 837DF801                cmp dword ptr [ebp-08], 00000001
:0041F4A0 7402                    je 0041F4A4
:0041F4A2 EB11                    jmp 0041F4B5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F4A0(C)
|
:0041F4A4 8B55FC                  mov edx, dword ptr [ebp-04]
:0041F4A7 C7421400000000          mov [edx+14], 00000000
:0041F4AE B801000000              mov eax, 00000001
:0041F4B3 EB02                    jmp 0041F4B7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041F494(C), :0041F4A2(U)
|
:0041F4B5 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F4B3(U)
|
:0041F4B7 8BE5                    mov esp, ebp
:0041F4B9 5D                      pop ebp
:0041F4BA C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0041F888   , :0041F8B3   
|
:0041F4BD 55                      push ebp
:0041F4BE 8BEC                    mov ebp, esp
:0041F4C0 83EC1C                  sub esp, 0000001C
:0041F4C3 894DE8                  mov dword ptr [ebp-18], ecx
:0041F4C6 C745F801000000          mov [ebp-08], 00000001
:0041F4CD 8B4520                  mov eax, dword ptr [ebp+20]
:0041F4D0 8945F4                  mov dword ptr [ebp-0C], eax
:0041F4D3 837DF400                cmp dword ptr [ebp-0C], 00000000
:0041F4D7 7409                    je 0041F4E2
:0041F4D9 C745F001000000          mov [ebp-10], 00000001
:0041F4E0 EB07                    jmp 0041F4E9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F4D7(C)
|
:0041F4E2 C745F000000000          mov [ebp-10], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F4E0(U)
|
:0041F4E9 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0041F4EC 81E1FFFF0000            and ecx, 0000FFFF
:0041F4F2 83F904                  cmp ecx, 00000004
:0041F4F5 7C07                    jl 0041F4FE
:0041F4F7 33C0                    xor eax, eax
:0041F4F9 E98C010000              jmp 0041F68A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F4F5(C)
|
:0041F4FE 6A00                    push 00000000
:0041F500 B9986A4B00              mov ecx, 004B6A98
:0041F505 E85D690500              call 00475E67
:0041F50A 6A00                    push 00000000
:0041F50C E8AB640500              call 004759BC
:0041F511 83C404                  add esp, 00000004
:0041F514 E83ED00000              call 0042C557
:0041F519 8B550C                  mov edx, dword ptr [ebp+0C]
:0041F51C 81E2FFFF0000            and edx, 0000FFFF
:0041F522 8B0495D8B64800          mov eax, dword ptr [4*edx+0048B6D8]
:0041F529 50                      push eax
:0041F52A E8D799FFFF              call 00418F06
:0041F52F 83C404                  add esp, 00000004
:0041F532 8945FC                  mov dword ptr [ebp-04], eax
:0041F535 6A00                    push 00000000
:0041F537 6A00                    push 00000000
:0041F539 E816D20500              call 0047C754
:0041F53E 83C408                  add esp, 00000008
:0041F541 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041F544 51                      push ecx
:0041F545 8B5508                  mov edx, dword ptr [ebp+08]
:0041F548 52                      push edx
:0041F549 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041F54C E8EAFBFFFF              call 0041F13B
:0041F551 8B45E8                  mov eax, dword ptr [ebp-18]
:0041F554 83781000                cmp dword ptr [eax+10], 00000000
:0041F558 752B                    jne 0041F585
:0041F55A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041F55D 51                      push ecx

* Possible StringData Ref from Data Obj ->"ܲŶļ%s"
                                  |
:0041F55E 6848B74800              push 0048B748
:0041F563 E8A9560500              call 00474C11
:0041F568 83C408                  add esp, 00000008
:0041F56B 85C0                    test eax, eax
:0041F56D 7516                    jne 0041F585
:0041F56F 6800010000              push 00000100
:0041F574 6A00                    push 00000000
:0041F576 E8D9D10500              call 0047C754
:0041F57B 83C408                  add esp, 00000008
:0041F57E 33C0                    xor eax, eax
:0041F580 E905010000              jmp 0041F68A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041F558(C), :0041F56D(C)
|
:0041F585 C705907A490000000000    mov dword ptr [00497A90], 00000000
:0041F58F 8B5514                  mov edx, dword ptr [ebp+14]
:0041F592 8915947A4900            mov dword ptr [00497A94], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F660(C)
|
:0041F598 8B4508                  mov eax, dword ptr [ebp+08]
:0041F59B 50                      push eax
:0041F59C 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041F59F E840FEFFFF              call 0041F3E4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F635(U)
|
:0041F5A4 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041F5A7 83791400                cmp dword ptr [ecx+14], 00000000
:0041F5AB 0F8489000000            je 0041F63A
:0041F5B1 E80EF50500              call 0047EAC4
:0041F5B6 837DF000                cmp dword ptr [ebp-10], 00000000
:0041F5BA 7424                    je 0041F5E0
:0041F5BC 8B55F4                  mov edx, dword ptr [ebp-0C]
:0041F5BF 52                      push edx
:0041F5C0 E881D00000              call 0042C646
:0041F5C5 83C404                  add esp, 00000004
:0041F5C8 C7451401000000          mov [ebp+14], 00000001
:0041F5CF C745F000000000          mov [ebp-10], 00000000
:0041F5D6 C705947A490001000000    mov dword ptr [00497A94], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F5BA(C)
|
:0041F5E0 A19C7A4900              mov eax, dword ptr [00497A9C]
:0041F5E5 50                      push eax
:0041F5E6 B9A07A4900              mov ecx, 00497AA0
:0041F5EB E8D56D0000              call 004263C5
:0041F5F0 F7D8                    neg eax
:0041F5F2 1BC0                    sbb eax, eax
:0041F5F4 F7D8                    neg eax
:0041F5F6 85C0                    test eax, eax
:0041F5F8 7512                    jne 0041F60C
:0041F5FA 833D907A490000          cmp dword ptr [00497A90], 00000000
:0041F601 7509                    jne 0041F60C
:0041F603 C745E400000000          mov [ebp-1C], 00000000
:0041F60A EB07                    jmp 0041F613

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041F5F8(C), :0041F601(C)
|
:0041F60C C745E401000000          mov [ebp-1C], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F60A(U)
|
:0041F613 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0041F616 894DEC                  mov dword ptr [ebp-14], ecx
:0041F619 837D1400                cmp dword ptr [ebp+14], 00000000
:0041F61D 7416                    je 0041F635
:0041F61F 837DEC00                cmp dword ptr [ebp-14], 00000000
:0041F623 7410                    je 0041F635
:0041F625 C745F800000000          mov [ebp-08], 00000000
:0041F62C C7451000000000          mov [ebp+10], 00000000
:0041F633 EB05                    jmp 0041F63A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041F61D(C), :0041F623(C)
|
:0041F635 E96AFFFFFF              jmp 0041F5A4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041F5AB(C), :0041F633(U)
|
:0041F63A 837D1000                cmp dword ptr [ebp+10], 00000000
:0041F63E 741C                    je 0041F65C
:0041F640 6A00                    push 00000000
:0041F642 6800010000              push 00000100
:0041F647 6807080000              push 00000807
:0041F64C 33D2                    xor edx, edx
:0041F64E 668B15E07A4900          mov dx, word ptr [00497AE0]
:0041F655 52                      push edx
:0041F656 FF15CC634800            call dword ptr [004863CC]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F63E(C)
|
:0041F65C 837D1000                cmp dword ptr [ebp+10], 00000000
:0041F660 0F8532FFFFFF            jne 0041F598
:0041F666 837D1800                cmp dword ptr [ebp+18], 00000000
:0041F66A 751B                    jne 0041F687
:0041F66C 8B4508                  mov eax, dword ptr [ebp+08]
:0041F66F 50                      push eax
:0041F670 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041F673 E853FAFFFF              call 0041F0CB
:0041F678 6800010000              push 00000100
:0041F67D 6A00                    push 00000000
:0041F67F E8D0D00500              call 0047C754
:0041F684 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F66A(C)
|
:0041F687 8B45F8                  mov eax, dword ptr [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041F4F9(U), :0041F580(U)
|
:0041F68A 8BE5                    mov esp, ebp
:0041F68C 5D                      pop ebp
:0041F68D C21C00                  ret 001C



* Referenced by a CALL at Addresses:
|:0041F6BF   , :0041F713   , :0041F777   , :0041F7D3   
|
:0041F690 55                      push ebp
:0041F691 8BEC                    mov ebp, esp
:0041F693 51                      push ecx
:0041F694 894DFC                  mov dword ptr [ebp-04], ecx
:0041F697 33C0                    xor eax, eax
:0041F699 66A1E07A4900            mov ax, word ptr [00497AE0]
:0041F69F 3DFFFF0000              cmp eax, 0000FFFF
:0041F6A4 7504                    jne 0041F6AA
:0041F6A6 33C0                    xor eax, eax
:0041F6A8 EB05                    jmp 0041F6AF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F6A4(C)
|
:0041F6AA B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F6A8(U)
|
:0041F6AF 8BE5                    mov esp, ebp
:0041F6B1 5D                      pop ebp
:0041F6B2 C3                      ret


:0041F6B3 55                      push ebp
:0041F6B4 8BEC                    mov ebp, esp
:0041F6B6 83EC14                  sub esp, 00000014
:0041F6B9 894DEC                  mov dword ptr [ebp-14], ecx
:0041F6BC 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041F6BF E8CCFFFFFF              call 0041F690
:0041F6C4 85C0                    test eax, eax
:0041F6C6 7504                    jne 0041F6CC
:0041F6C8 33C0                    xor eax, eax
:0041F6CA EB37                    jmp 0041F703

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F6C6(C)
|
:0041F6CC C745F804000000          mov [ebp-08], 00000004
:0041F6D3 8D45F0                  lea eax, dword ptr [ebp-10]
:0041F6D6 50                      push eax
:0041F6D7 6800010000              push 00000100
:0041F6DC 6814080000              push 00000814
:0041F6E1 33C9                    xor ecx, ecx
:0041F6E3 668B0DE07A4900          mov cx, word ptr [00497AE0]
:0041F6EA 51                      push ecx
:0041F6EB FF15CC634800            call dword ptr [004863CC]
:0041F6F1 817DF411020000          cmp dword ptr [ebp-0C], 00000211
:0041F6F8 7507                    jne 0041F701
:0041F6FA B801000000              mov eax, 00000001
:0041F6FF EB02                    jmp 0041F703

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F6F8(C)
|
:0041F701 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041F6CA(U), :0041F6FF(U)
|
:0041F703 8BE5                    mov esp, ebp
:0041F705 5D                      pop ebp
:0041F706 C3                      ret



* Referenced by a CALL at Address:
|:0041F7E6   
|
:0041F707 55                      push ebp
:0041F708 8BEC                    mov ebp, esp
:0041F70A 83EC14                  sub esp, 00000014
:0041F70D 894DEC                  mov dword ptr [ebp-14], ecx
:0041F710 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0041F713 E878FFFFFF              call 0041F690
:0041F718 85C0                    test eax, eax
:0041F71A 7507                    jne 0041F723
:0041F71C B801000000              mov eax, 00000001
:0041F721 EB44                    jmp 0041F767

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F71A(C)
|
:0041F723 C745F804000000          mov [ebp-08], 00000004
:0041F72A 8D45F0                  lea eax, dword ptr [ebp-10]
:0041F72D 50                      push eax
:0041F72E 6800010000              push 00000100
:0041F733 6814080000              push 00000814
:0041F738 33C9                    xor ecx, ecx
:0041F73A 668B0DE07A4900          mov cx, word ptr [00497AE0]
:0041F741 51                      push ecx
:0041F742 FF15CC634800            call dword ptr [004863CC]
:0041F748 817DF40E020000          cmp dword ptr [ebp-0C], 0000020E
:0041F74F 7504                    jne 0041F755
:0041F751 33C0                    xor eax, eax
:0041F753 EB12                    jmp 0041F767

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F74F(C)
|
:0041F755 817DF411020000          cmp dword ptr [ebp-0C], 00000211
:0041F75C 7504                    jne 0041F762
:0041F75E 33C0                    xor eax, eax
:0041F760 EB05                    jmp 0041F767

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F75C(C)
|
:0041F762 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041F721(U), :0041F753(U), :0041F760(U)
|
:0041F767 8BE5                    mov esp, ebp
:0041F769 5D                      pop ebp
:0041F76A C3                      ret



* Referenced by a CALL at Address:
|:0041F8C2   
|
:0041F76B 55                      push ebp
:0041F76C 8BEC                    mov ebp, esp
:0041F76E 83EC08                  sub esp, 00000008
:0041F771 894DF8                  mov dword ptr [ebp-08], ecx
:0041F774 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041F777 E814FFFFFF              call 0041F690
:0041F77C 85C0                    test eax, eax
:0041F77E 7502                    jne 0041F782
:0041F780 EB1B                    jmp 0041F79D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F77E(C)
|
:0041F782 8D45FC                  lea eax, dword ptr [ebp-04]
:0041F785 50                      push eax
:0041F786 6A00                    push 00000000
:0041F788 6809080000              push 00000809
:0041F78D 33C9                    xor ecx, ecx
:0041F78F 668B0DE07A4900          mov cx, word ptr [00497AE0]
:0041F796 51                      push ecx
:0041F797 FF15CC634800            call dword ptr [004863CC]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F780(U)
|
:0041F79D 8BE5                    mov esp, ebp
:0041F79F 5D                      pop ebp
:0041F7A0 C3                      ret



* Referenced by a CALL at Address:
|:0041F8D7   
|
:0041F7A1 55                      push ebp
:0041F7A2 8BEC                    mov ebp, esp
:0041F7A4 83EC08                  sub esp, 00000008
:0041F7A7 894DF8                  mov dword ptr [ebp-08], ecx
:0041F7AA 8B4508                  mov eax, dword ptr [ebp+08]
:0041F7AD 25FFFF0000              and eax, 0000FFFF
:0041F7B2 8945FC                  mov dword ptr [ebp-04], eax
:0041F7B5 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0041F7B8 51                      push ecx
:0041F7B9 6A01                    push 00000001
:0041F7BB 6806080000              push 00000806
:0041F7C0 33D2                    xor edx, edx
:0041F7C2 668B15E07A4900          mov dx, word ptr [00497AE0]
:0041F7C9 52                      push edx
:0041F7CA FF15CC634800            call dword ptr [004863CC]
:0041F7D0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041F7D3 E8B8FEFFFF              call 0041F690
:0041F7D8 85C0                    test eax, eax
:0041F7DA 7407                    je 0041F7E3
:0041F7DC B801000000              mov eax, 00000001
:0041F7E1 EB15                    jmp 0041F7F8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F7DA(C)
|
:0041F7E3 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041F7E6 E81CFFFFFF              call 0041F707
:0041F7EB 85C0                    test eax, eax
:0041F7ED 7407                    je 0041F7F6
:0041F7EF B801000000              mov eax, 00000001
:0041F7F4 EB02                    jmp 0041F7F8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F7ED(C)
|
:0041F7F6 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041F7E1(U), :0041F7F4(U)
|
:0041F7F8 8BE5                    mov esp, ebp
:0041F7FA 5D                      pop ebp
:0041F7FB C20400                  ret 0004


:0041F7FE 55                      push ebp
:0041F7FF 8BEC                    mov ebp, esp
:0041F801 B9787A4900              mov ecx, 00497A78
:0041F806 E867F8FFFF              call 0041F072
:0041F80B 5D                      pop ebp
:0041F80C C3                      ret



* Referenced by a CALL at Address:
|:0042B66A   
|
:0041F80D 55                      push ebp
:0041F80E 8BEC                    mov ebp, esp
:0041F810 51                      push ecx
:0041F811 8B4508                  mov eax, dword ptr [ebp+08]
:0041F814 50                      push eax
:0041F815 B9787A4900              mov ecx, 00497A78
:0041F81A E8ACF8FFFF              call 0041F0CB
:0041F81F 8945FC                  mov dword ptr [ebp-04], eax
:0041F822 6800010000              push 00000100
:0041F827 6A00                    push 00000000
:0041F829 E826CF0500              call 0047C754
:0041F82E 83C408                  add esp, 00000008
:0041F831 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F834 8BE5                    mov esp, ebp
:0041F836 5D                      pop ebp
:0041F837 C3                      ret



* Referenced by a CALL at Address:
|:00475216   
|
:0041F838 55                      push ebp
:0041F839 8BEC                    mov ebp, esp
:0041F83B 8B450C                  mov eax, dword ptr [ebp+0C]
:0041F83E 50                      push eax
:0041F83F 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041F842 51                      push ecx
:0041F843 B9787A4900              mov ecx, 00497A78
:0041F848 E833FCFFFF              call 0041F480
:0041F84D 5D                      pop ebp
:0041F84E C3                      ret



* Referenced by a CALL at Address:
|:004750BD   
|
:0041F84F 55                      push ebp
:0041F850 8BEC                    mov ebp, esp
:0041F852 8B4508                  mov eax, dword ptr [ebp+08]
:0041F855 50                      push eax
:0041F856 B9787A4900              mov ecx, 00497A78
:0041F85B E87AFAFFFF              call 0041F2DA
:0041F860 5D                      pop ebp
:0041F861 C3                      ret



* Referenced by a CALL at Addresses:
|:0042B7FB   , :0042BF4A   , :0042BF80   , :0042F7BD   , :0042F7DA   
|
:0041F862 55                      push ebp
:0041F863 8BEC                    mov ebp, esp
:0041F865 8B4518                  mov eax, dword ptr [ebp+18]
:0041F868 50                      push eax
:0041F869 6A00                    push 00000000
:0041F86B 8B4D14                  mov ecx, dword ptr [ebp+14]
:0041F86E 51                      push ecx
:0041F86F 8B5510                  mov edx, dword ptr [ebp+10]
:0041F872 52                      push edx
:0041F873 8B450C                  mov eax, dword ptr [ebp+0C]
:0041F876 50                      push eax
:0041F877 668B4D08                mov cx, word ptr [ebp+08]
:0041F87B 51                      push ecx
:0041F87C 8B15686A4B00            mov edx, dword ptr [004B6A68]
:0041F882 52                      push edx
:0041F883 B9787A4900              mov ecx, 00497A78
:0041F888 E830FCFFFF              call 0041F4BD
:0041F88D 5D                      pop ebp
:0041F88E C3                      ret


:0041F88F 55                      push ebp
:0041F890 8BEC                    mov ebp, esp
:0041F892 6A00                    push 00000000
:0041F894 6A01                    push 00000001
:0041F896 8B4514                  mov eax, dword ptr [ebp+14]
:0041F899 50                      push eax
:0041F89A 8B4D10                  mov ecx, dword ptr [ebp+10]
:0041F89D 51                      push ecx
:0041F89E 8B550C                  mov edx, dword ptr [ebp+0C]
:0041F8A1 52                      push edx
:0041F8A2 668B4508                mov ax, word ptr [ebp+08]
:0041F8A6 50                      push eax
:0041F8A7 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:0041F8AD 51                      push ecx
:0041F8AE B9787A4900              mov ecx, 00497A78
:0041F8B3 E805FCFFFF              call 0041F4BD
:0041F8B8 5D                      pop ebp
:0041F8B9 C3                      ret



* Referenced by a CALL at Address:
|:0047BD29   
|
:0041F8BA 55                      push ebp
:0041F8BB 8BEC                    mov ebp, esp
:0041F8BD B9787A4900              mov ecx, 00497A78
:0041F8C2 E8A4FEFFFF              call 0041F76B
:0041F8C7 5D                      pop ebp
:0041F8C8 C3                      ret



* Referenced by a CALL at Address:
|:0047BDDE   
|
:0041F8C9 55                      push ebp
:0041F8CA 8BEC                    mov ebp, esp
:0041F8CC A1686A4B00              mov eax, dword ptr [004B6A68]
:0041F8D1 50                      push eax
:0041F8D2 B9787A4900              mov ecx, 00497A78
:0041F8D7 E8C5FEFFFF              call 0041F7A1
:0041F8DC 5D                      pop ebp
:0041F8DD C3                      ret


:0041F8DE CC                      int 03
:0041F8DF CC                      int 03

* Referenced by a CALL at Addresses:
|:0041EF96   , :00425B87   
|
:0041F8E0 55                      push ebp
:0041F8E1 8BEC                    mov ebp, esp
:0041F8E3 51                      push ecx
:0041F8E4 894DFC                  mov dword ptr [ebp-04], ecx
:0041F8E7 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F8EA C7400800000000          mov [eax+08], 00000000
:0041F8F1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041F8F4 C7410C00000000          mov [ecx+0C], 00000000
:0041F8FB 8B55FC                  mov edx, dword ptr [ebp-04]

* Possible Reference to Dialog: DialogID_0140 
                                  |
:0041F8FE C7421840010000          mov [edx+18], 00000140
:0041F905 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F908 C7401CF0000000          mov [eax+1C], 000000F0
:0041F90F 8B4DFC                  mov ecx, dword ptr [ebp-04]

* Possible Reference to Dialog: DialogID_0140 
                                  |
:0041F912 C7411040010000          mov [ecx+10], 00000140
:0041F919 8B55FC                  mov edx, dword ptr [ebp-04]
:0041F91C C74214F0000000          mov [edx+14], 000000F0
:0041F923 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F926 C7402000000000          mov [eax+20], 00000000
:0041F92D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041F930 C7412400000000          mov [ecx+24], 00000000
:0041F937 8B55FC                  mov edx, dword ptr [ebp-04]
:0041F93A C7422800000000          mov [edx+28], 00000000
:0041F941 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F944 C7402C00000000          mov [eax+2C], 00000000
:0041F94B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041F94E C7413000000000          mov [ecx+30], 00000000
:0041F955 8B55FC                  mov edx, dword ptr [ebp-04]
:0041F958 C7423400000000          mov [edx+34], 00000000
:0041F95F 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F962 C7403800000000          mov [eax+38], 00000000
:0041F969 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041F96C C7413C00000000          mov [ecx+3C], 00000000
:0041F973 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F976 8BE5                    mov esp, ebp
:0041F978 5D                      pop ebp
:0041F979 C3                      ret


:0041F97A CC                      int 03
:0041F97B CC                      int 03
:0041F97C CC                      int 03
:0041F97D CC                      int 03
:0041F97E CC                      int 03
:0041F97F CC                      int 03

* Referenced by a CALL at Address:
|:0041EF57   
|
:0041F980 55                      push ebp
:0041F981 8BEC                    mov ebp, esp
:0041F983 51                      push ecx
:0041F984 894DFC                  mov dword ptr [ebp-04], ecx
:0041F987 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F98A C7401000000000          mov [eax+10], 00000000
:0041F991 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041F994 C7411400000000          mov [ecx+14], 00000000
:0041F99B 8B45FC                  mov eax, dword ptr [ebp-04]
:0041F99E 8BE5                    mov esp, ebp
:0041F9A0 5D                      pop ebp
:0041F9A1 C3                      ret


:0041F9A2 CC                      int 03
:0041F9A3 CC                      int 03
:0041F9A4 CC                      int 03
:0041F9A5 CC                      int 03
:0041F9A6 CC                      int 03
:0041F9A7 CC                      int 03
:0041F9A8 CC                      int 03
:0041F9A9 CC                      int 03
:0041F9AA CC                      int 03
:0041F9AB CC                      int 03
:0041F9AC CC                      int 03
:0041F9AD CC                      int 03
:0041F9AE CC                      int 03
:0041F9AF CC                      int 03

* Referenced by a CALL at Address:
|:0041FA53   
|
:0041F9B0 55                      push ebp
:0041F9B1 8BEC                    mov ebp, esp
:0041F9B3 51                      push ecx
:0041F9B4 894DFC                  mov dword ptr [ebp-04], ecx
:0041F9B7 833DF47A490000          cmp dword ptr [00497AF4], 00000000
:0041F9BE 7532                    jne 0041F9F2
:0041F9C0 6800040000              push 00000400
:0041F9C5 A1F07A4900              mov eax, dword ptr [00497AF0]
:0041F9CA 50                      push eax
:0041F9CB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041F9CE E89497FFFF              call 00419167
:0041F9D3 A3F47A4900              mov dword ptr [00497AF4], eax
:0041F9D8 833DF47A490000          cmp dword ptr [00497AF4], 00000000
:0041F9DF 7F05                    jg 0041F9E6
:0041F9E1 83C8FF                  or eax, FFFFFFFF
:0041F9E4 EB3A                    jmp 0041FA20

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F9DF(C)
|
:0041F9E6 8B0DF07A4900            mov ecx, dword ptr [00497AF0]
:0041F9EC 890DEC7A4900            mov dword ptr [00497AEC], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F9BE(C)
|
:0041F9F2 8B15F47A4900            mov edx, dword ptr [00497AF4]
:0041F9F8 83EA01                  sub edx, 00000001
:0041F9FB 8915F47A4900            mov dword ptr [00497AF4], edx
:0041FA01 A1EC7A4900              mov eax, dword ptr [00497AEC]
:0041FA06 33C9                    xor ecx, ecx
:0041FA08 8A08                    mov cl, byte ptr [eax]
:0041FA0A 8BC1                    mov eax, ecx
:0041FA0C 25FF000000              and eax, 000000FF
:0041FA11 8B15EC7A4900            mov edx, dword ptr [00497AEC]
:0041FA17 83C201                  add edx, 00000001
:0041FA1A 8915EC7A4900            mov dword ptr [00497AEC], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041F9E4(U)
|
:0041FA20 8BE5                    mov esp, ebp
:0041FA22 5D                      pop ebp
:0041FA23 C3                      ret



* Referenced by a CALL at Addresses:
|:0041FAD5   , :0041FB12   
|
:0041FA24 55                      push ebp
:0041FA25 8BEC                    mov ebp, esp
:0041FA27 83EC0C                  sub esp, 0000000C
:0041FA2A 894DF4                  mov dword ptr [ebp-0C], ecx
:0041FA2D C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FAAF(U)
|
:0041FA34 8B4508                  mov eax, dword ptr [ebp+08]
:0041FA37 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041FA3A 83E901                  sub ecx, 00000001
:0041FA3D 894D08                  mov dword ptr [ebp+08], ecx
:0041FA40 85C0                    test eax, eax
:0041FA42 746D                    je 0041FAB1
:0041FA44 33D2                    xor edx, edx
:0041FA46 8A15E87A4900            mov dl, byte ptr [00497AE8]
:0041FA4C 85D2                    test edx, edx
:0041FA4E 7525                    jne 0041FA75
:0041FA50 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041FA53 E858FFFFFF              call 0041F9B0
:0041FA58 8945F8                  mov dword ptr [ebp-08], eax
:0041FA5B 837DF8FF                cmp dword ptr [ebp-08], FFFFFFFF
:0041FA5F 7505                    jne 0041FA66
:0041FA61 83C8FF                  or eax, FFFFFFFF
:0041FA64 EB4E                    jmp 0041FAB4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FA5F(C)
|
:0041FA66 8A45F8                  mov al, byte ptr [ebp-08]
:0041FA69 A2E47A4900              mov byte ptr [00497AE4], al
:0041FA6E C605E87A490008          mov byte ptr [00497AE8], 08

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FA4E(C)
|
:0041FA75 8A0DE87A4900            mov cl, byte ptr [00497AE8]
:0041FA7B 80E901                  sub cl, 01
:0041FA7E 880DE87A4900            mov byte ptr [00497AE8], cl
:0041FA84 33D2                    xor edx, edx
:0041FA86 8A15E47A4900            mov dl, byte ptr [00497AE4]
:0041FA8C 81E280000000            and edx, 00000080
:0041FA92 F7DA                    neg edx
:0041FA94 1BD2                    sbb edx, edx
:0041FA96 F7DA                    neg edx
:0041FA98 8B45FC                  mov eax, dword ptr [ebp-04]
:0041FA9B 8D0C42                  lea ecx, dword ptr [edx+2*eax]
:0041FA9E 894DFC                  mov dword ptr [ebp-04], ecx
:0041FAA1 8A15E47A4900            mov dl, byte ptr [00497AE4]
:0041FAA7 D0E2                    shl dl, 1
:0041FAA9 8815E47A4900            mov byte ptr [00497AE4], dl
:0041FAAF EB83                    jmp 0041FA34

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FA42(C)
|
:0041FAB1 8B45FC                  mov eax, dword ptr [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FA64(U)
|
:0041FAB4 8BE5                    mov esp, ebp
:0041FAB6 5D                      pop ebp
:0041FAB7 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0041FBE3   , :0041FC02   
|
:0041FABA 55                      push ebp
:0041FABB 8BEC                    mov ebp, esp
:0041FABD 83EC10                  sub esp, 00000010
:0041FAC0 894DF0                  mov dword ptr [ebp-10], ecx
:0041FAC3 C745FC00000000          mov [ebp-04], 00000000
:0041FACA 66C745F40000            mov [ebp-0C], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FB08(C)
|
:0041FAD0 6A01                    push 00000001
:0041FAD2 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0041FAD5 E84AFFFFFF              call 0041FA24
:0041FADA 8945F8                  mov dword ptr [ebp-08], eax
:0041FADD 837DF8FF                cmp dword ptr [ebp-08], FFFFFFFF
:0041FAE1 7505                    jne 0041FAE8
:0041FAE3 83C8FF                  or eax, FFFFFFFF
:0041FAE6 EB49                    jmp 0041FB31

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FAE1(C)
|
:0041FAE8 8B45FC                  mov eax, dword ptr [ebp-04]
:0041FAEB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041FAEE 8D1441                  lea edx, dword ptr [ecx+2*eax]
:0041FAF1 8955FC                  mov dword ptr [ebp-04], edx
:0041FAF4 668B45F4                mov ax, word ptr [ebp-0C]
:0041FAF8 66050100                add ax, 0001
:0041FAFC 668945F4                mov word ptr [ebp-0C], ax
:0041FB00 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041FB03 83E101                  and ecx, 00000001
:0041FB06 85C9                    test ecx, ecx
:0041FB08 75C6                    jne 0041FAD0
:0041FB0A 0FBF55F4                movsx edx, word ptr [ebp-0C]
:0041FB0E 52                      push edx
:0041FB0F 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0041FB12 E80DFFFFFF              call 0041FA24
:0041FB17 8945F8                  mov dword ptr [ebp-08], eax
:0041FB1A 837DF8FF                cmp dword ptr [ebp-08], FFFFFFFF
:0041FB1E 7505                    jne 0041FB25
:0041FB20 83C8FF                  or eax, FFFFFFFF
:0041FB23 EB0C                    jmp 0041FB31

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FB1E(C)
|
:0041FB25 8B45FC                  mov eax, dword ptr [ebp-04]
:0041FB28 0345F8                  add eax, dword ptr [ebp-08]
:0041FB2B 8945FC                  mov dword ptr [ebp-04], eax
:0041FB2E 8B45FC                  mov eax, dword ptr [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041FAE6(U), :0041FB23(U)
|
:0041FB31 8BE5                    mov esp, ebp
:0041FB33 5D                      pop ebp
:0041FB34 C3                      ret



* Referenced by a CALL at Addresses:
|:00401561   , :00403C1B   , :00403E2F   , :004085D3   , :0040AFF7   
|:0041B558   , :0041C7A3   , :0041C82F   , :0041D6F5   , :0041E0BE   
|:0041E0EB   , :0041E118   , :0042191E   , :00421F5C   , :00426CFD   
|:004288F3   , :0042B70D   , :0042BC38   , :0042BC47   , :0042BCB0   
|:0042BDB1   , :0042C146   , :00431312   , :0043143D   , :00431AED   
|:0043D26C   , :0043FE9E   , :00441B11   , :00443E57   , :00443FA9   
|:00444149   , :00444342   , :004444EE   , :00444729   , :00444F42   
|:00445679   , :00445CD9   , :0044627E   , :00446686   , :004471AC   
|:0044764B   , :00448B72   , :00449F31   , :0044ABD0   , :0044B45A   
|:0044C20C   , :0044D15C   , :0044D5BC   , :0045651E   , :00456961   
|:00456EED   , :004579E1   , :00457ACD   , :00457C89   , :00457D74   
|:00457E5F   , :0045801D   , :004582AB   , :004585C2   , :004588AC   
|:004589FC   , :00458BAE   , :00458D21   , :00458EBD   , :00459B1F   
|:0045C1B1   , :0045EC35   , :0046FCBE   , :0046FDE4   , :00477FB3   
|:0047816E   
|
:0041FB35 55                      push ebp
:0041FB36 8BEC                    mov ebp, esp
:0041FB38 51                      push ecx
:0041FB39 894DFC                  mov dword ptr [ebp-04], ecx
:0041FB3C 6A04                    push 00000004
:0041FB3E 8B4508                  mov eax, dword ptr [ebp+08]
:0041FB41 50                      push eax
:0041FB42 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041FB45 E81294FFFF              call 00418F5C
:0041FB4A 85C0                    test eax, eax
:0041FB4C 7517                    jne 0041FB65
:0041FB4E 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041FB51 51                      push ecx

* Possible StringData Ref from Data Obj ->"File%sOpenErr"
                                  |
:0041FB52 6860B74800              push 0048B760
:0041FB57 6A00                    push 00000000
:0041FB59 E83BFB0000              call 0042F699
:0041FB5E 83C40C                  add esp, 0000000C
:0041FB61 33C0                    xor eax, eax
:0041FB63 EB1B                    jmp 0041FB80

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FB4C(C)
|
:0041FB65 6800010000              push 00000100
:0041FB6A 8B55FC                  mov edx, dword ptr [ebp-04]
:0041FB6D 83C204                  add edx, 00000004
:0041FB70 52                      push edx
:0041FB71 6A10                    push 00000010
:0041FB73 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041FB76 E80996FFFF              call 00419184
:0041FB7B B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FB63(U)
|
:0041FB80 8BE5                    mov esp, ebp
:0041FB82 5D                      pop ebp
:0041FB83 C20400                  ret 0004


:0041FB86 55                      push ebp
:0041FB87 8BEC                    mov ebp, esp
:0041FB89 51                      push ecx
:0041FB8A 894DFC                  mov dword ptr [ebp-04], ecx
:0041FB8D 6A00                    push 00000000
:0041FB8F 8B4508                  mov eax, dword ptr [ebp+08]
:0041FB92 50                      push eax
:0041FB93 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041FB96 E8C193FFFF              call 00418F5C
:0041FB9B 85C0                    test eax, eax
:0041FB9D 7517                    jne 0041FBB6
:0041FB9F 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041FBA2 51                      push ecx

* Possible StringData Ref from Data Obj ->"File%sOpenErr"
                                  |
:0041FBA3 6870B74800              push 0048B770
:0041FBA8 6A00                    push 00000000
:0041FBAA E8EAFA0000              call 0042F699
:0041FBAF 83C40C                  add esp, 0000000C
:0041FBB2 33C0                    xor eax, eax
:0041FBB4 EB1B                    jmp 0041FBD1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FB9D(C)
|
:0041FBB6 6800010000              push 00000100
:0041FBBB 8B55FC                  mov edx, dword ptr [ebp-04]
:0041FBBE 83C204                  add edx, 00000004
:0041FBC1 52                      push edx
:0041FBC2 6A10                    push 00000010
:0041FBC4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041FBC7 E8B895FFFF              call 00419184
:0041FBCC B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FBB4(U)
|
:0041FBD1 8BE5                    mov esp, ebp
:0041FBD3 5D                      pop ebp
:0041FBD4 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0041FE9C   
|
:0041FBD7 55                      push ebp
:0041FBD8 8BEC                    mov ebp, esp
:0041FBDA 83EC18                  sub esp, 00000018
:0041FBDD 894DE8                  mov dword ptr [ebp-18], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FC7D(C)
|
:0041FBE0 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041FBE3 E8D2FEFFFF              call 0041FABA
:0041FBE8 8945F8                  mov dword ptr [ebp-08], eax
:0041FBEB 817DF800010000          cmp dword ptr [ebp-08], 00000100
:0041FBF2 7C65                    jl 0041FC59
:0041FBF4 8B45F8                  mov eax, dword ptr [ebp-08]
:0041FBF7 2D00010000              sub eax, 00000100
:0041FBFC 8945F0                  mov dword ptr [ebp-10], eax
:0041FBFF 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041FC02 E8B3FEFFFF              call 0041FABA
:0041FC07 83C003                  add eax, 00000003
:0041FC0A 8945F4                  mov dword ptr [ebp-0C], eax
:0041FC0D 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041FC10 2B4DF0                  sub ecx, dword ptr [ebp-10]
:0041FC13 894DFC                  mov dword ptr [ebp-04], ecx
:0041FC16 C745EC00000000          mov [ebp-14], 00000000
:0041FC1D EB09                    jmp 0041FC28

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FC4C(U)
|
:0041FC1F 8B55EC                  mov edx, dword ptr [ebp-14]
:0041FC22 83C201                  add edx, 00000001
:0041FC25 8955EC                  mov dword ptr [ebp-14], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FC1D(U)
|
:0041FC28 8B45EC                  mov eax, dword ptr [ebp-14]
:0041FC2B 3B45F4                  cmp eax, dword ptr [ebp-0C]
:0041FC2E 7D1E                    jge 0041FC4E
:0041FC30 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041FC33 8B55FC                  mov edx, dword ptr [ebp-04]
:0041FC36 8A02                    mov al, byte ptr [edx]
:0041FC38 8801                    mov byte ptr [ecx], al
:0041FC3A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041FC3D 83C101                  add ecx, 00000001
:0041FC40 894D08                  mov dword ptr [ebp+08], ecx
:0041FC43 8B55FC                  mov edx, dword ptr [ebp-04]
:0041FC46 83C201                  add edx, 00000001
:0041FC49 8955FC                  mov dword ptr [ebp-04], edx
:0041FC4C EBD1                    jmp 0041FC1F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FC2E(C)
|
:0041FC4E 8B450C                  mov eax, dword ptr [ebp+0C]
:0041FC51 2B45F4                  sub eax, dword ptr [ebp-0C]
:0041FC54 89450C                  mov dword ptr [ebp+0C], eax
:0041FC57 EB20                    jmp 0041FC79

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FBF2(C)
|
:0041FC59 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0041FC5C 034DF8                  add ecx, dword ptr [ebp-08]
:0041FC5F 8B5508                  mov edx, dword ptr [ebp+08]
:0041FC62 8A4104                  mov al, byte ptr [ecx+04]
:0041FC65 8802                    mov byte ptr [edx], al
:0041FC67 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041FC6A 83C101                  add ecx, 00000001
:0041FC6D 894D08                  mov dword ptr [ebp+08], ecx
:0041FC70 8B550C                  mov edx, dword ptr [ebp+0C]
:0041FC73 83EA01                  sub edx, 00000001
:0041FC76 89550C                  mov dword ptr [ebp+0C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FC57(U)
|
:0041FC79 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0041FC7D 0F855DFFFFFF            jne 0041FBE0
:0041FC83 8BE5                    mov esp, ebp
:0041FC85 5D                      pop ebp
:0041FC86 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0040158B   , :00403C44   , :00403E57   , :004085FC   , :0040B022   
|:0040BC30   , :0041C362   , :0041C7E2   , :0041C859   , :0041D734   
|:0041D7C3   , :0041E166   , :0041E6F2   , :00421967   , :00422014   
|:00426D1C   , :00426D3D   , :00428916   , :0042B72B   , :0042BCCE   
|:0042BDCF   , :0042BE24   , :0042C164   , :0042DEEE   , :00431330   
|:0043145B   , :00431B19   , :00431E82   , :00432F43   , :0043D2A7   
|:0043FEC4   , :00441B39   , :00443E7F   , :00443FD1   , :00444171   
|:0044436A   , :00444516   , :00444751   , :00444F6A   , :004456A2   
|:00445D01   , :004462AA   , :004466B2   , :004471D8   , :00447677   
|:00448B90   , :00449F61   , :0044ABF7   , :0044B487   , :0044C22D   
|:0044D17A   , :0044D5DA   , :00456548   , :0045698B   , :00456F17   
|:00457A0A   , :00457AF6   , :00457CB1   , :00457D9C   , :00457E87   
|:00458046   , :004582D3   , :004585EA   , :004588D5   , :00458A25   
|:00458BD6   , :00458D49   , :00458EE6   , :00459B42   , :0045C226   
|:0045C6F8   , :0045EC56   , :0045EDE8   , :0045EE7C   , :0046A05E   
|:0046D7BB   , :0046FCE0   , :0046FE05   , :00477FD9   , :0047818B   
|:004788CB   
|
:0041FC89 55                      push ebp
:0041FC8A 8BEC                    mov ebp, esp
:0041FC8C 81EC10040000            sub esp, 00000410
:0041FC92 898DF0FBFFFF            mov dword ptr [ebp+FFFFFBF0], ecx
:0041FC98 8D85FCFBFFFF            lea eax, dword ptr [ebp+FFFFFBFC]
:0041FC9E A3F07A4900              mov dword ptr [00497AF0], eax
:0041FCA3 C705F47A490000000000    mov dword ptr [00497AF4], 00000000
:0041FCAD C605E87A490000          mov byte ptr [00497AE8], 00
:0041FCB4 8A0DE87A4900            mov cl, byte ptr [00497AE8]
:0041FCBA 880DE47A4900            mov byte ptr [00497AE4], cl
:0041FCC0 6A00                    push 00000000
:0041FCC2 8B5508                  mov edx, dword ptr [ebp+08]
:0041FCC5 6BD20C                  imul edx, 0000000C
:0041FCC8 81C210010000            add edx, 00000110
:0041FCCE 52                      push edx
:0041FCCF 8B8DF0FBFFFF            mov ecx, dword ptr [ebp+FFFFFBF0]
:0041FCD5 E84595FFFF              call 0041921F
:0041FCDA 6A0C                    push 0000000C
:0041FCDC 8D85FCFBFFFF            lea eax, dword ptr [ebp+FFFFFBFC]
:0041FCE2 50                      push eax
:0041FCE3 8B8DF0FBFFFF            mov ecx, dword ptr [ebp+FFFFFBF0]
:0041FCE9 E87994FFFF              call 00419167
:0041FCEE 8B8D04FCFFFF            mov ecx, dword ptr [ebp+FFFFFC04]
:0041FCF4 81E1FF000000            and ecx, 000000FF
:0041FCFA 81E1FF000000            and ecx, 000000FF
:0041FD00 898DF4FBFFFF            mov dword ptr [ebp+FFFFFBF4], ecx
:0041FD06 8B95F4FBFFFF            mov edx, dword ptr [ebp+FFFFFBF4]
:0041FD0C C1E208                  shl edx, 08
:0041FD0F 8B8505FCFFFF            mov eax, dword ptr [ebp+FFFFFC05]
:0041FD15 25FF000000              and eax, 000000FF
:0041FD1A 25FF000000              and eax, 000000FF
:0041FD1F 03D0                    add edx, eax
:0041FD21 8995F4FBFFFF            mov dword ptr [ebp+FFFFFBF4], edx
:0041FD27 8B8DF4FBFFFF            mov ecx, dword ptr [ebp+FFFFFBF4]
:0041FD2D C1E108                  shl ecx, 08
:0041FD30 8B9506FCFFFF            mov edx, dword ptr [ebp+FFFFFC06]
:0041FD36 81E2FF000000            and edx, 000000FF
:0041FD3C 81E2FF000000            and edx, 000000FF
:0041FD42 03CA                    add ecx, edx
:0041FD44 898DF4FBFFFF            mov dword ptr [ebp+FFFFFBF4], ecx
:0041FD4A 8B85F4FBFFFF            mov eax, dword ptr [ebp+FFFFFBF4]
:0041FD50 C1E008                  shl eax, 08
:0041FD53 8B8D07FCFFFF            mov ecx, dword ptr [ebp+FFFFFC07]
:0041FD59 81E1FF000000            and ecx, 000000FF
:0041FD5F 81E1FF000000            and ecx, 000000FF
:0041FD65 03C1                    add eax, ecx
:0041FD67 8985F4FBFFFF            mov dword ptr [ebp+FFFFFBF4], eax
:0041FD6D 8B9500FCFFFF            mov edx, dword ptr [ebp+FFFFFC00]
:0041FD73 81E2FF000000            and edx, 000000FF
:0041FD79 81E2FF000000            and edx, 000000FF
:0041FD7F 8955FC                  mov dword ptr [ebp-04], edx
:0041FD82 8B45FC                  mov eax, dword ptr [ebp-04]
:0041FD85 C1E008                  shl eax, 08
:0041FD88 8B8D01FCFFFF            mov ecx, dword ptr [ebp+FFFFFC01]
:0041FD8E 81E1FF000000            and ecx, 000000FF
:0041FD94 81E1FF000000            and ecx, 000000FF
:0041FD9A 03C1                    add eax, ecx
:0041FD9C 8945FC                  mov dword ptr [ebp-04], eax
:0041FD9F 8B55FC                  mov edx, dword ptr [ebp-04]
:0041FDA2 C1E208                  shl edx, 08
:0041FDA5 8B8502FCFFFF            mov eax, dword ptr [ebp+FFFFFC02]
:0041FDAB 25FF000000              and eax, 000000FF
:0041FDB0 25FF000000              and eax, 000000FF
:0041FDB5 03D0                    add edx, eax
:0041FDB7 8955FC                  mov dword ptr [ebp-04], edx
:0041FDBA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0041FDBD C1E108                  shl ecx, 08
:0041FDC0 8B9503FCFFFF            mov edx, dword ptr [ebp+FFFFFC03]
:0041FDC6 81E2FF000000            and edx, 000000FF
:0041FDCC 81E2FF000000            and edx, 000000FF
:0041FDD2 03CA                    add ecx, edx
:0041FDD4 894DFC                  mov dword ptr [ebp-04], ecx
:0041FDD7 8B85FCFBFFFF            mov eax, dword ptr [ebp+FFFFFBFC]
:0041FDDD 25FF000000              and eax, 000000FF
:0041FDE2 25FF000000              and eax, 000000FF
:0041FDE7 8985F8FBFFFF            mov dword ptr [ebp+FFFFFBF8], eax
:0041FDED 8B8DF8FBFFFF            mov ecx, dword ptr [ebp+FFFFFBF8]
:0041FDF3 C1E108                  shl ecx, 08
:0041FDF6 8B95FDFBFFFF            mov edx, dword ptr [ebp+FFFFFBFD]
:0041FDFC 81E2FF000000            and edx, 000000FF
:0041FE02 81E2FF000000            and edx, 000000FF
:0041FE08 03CA                    add ecx, edx
:0041FE0A 898DF8FBFFFF            mov dword ptr [ebp+FFFFFBF8], ecx
:0041FE10 8B85F8FBFFFF            mov eax, dword ptr [ebp+FFFFFBF8]
:0041FE16 C1E008                  shl eax, 08
:0041FE19 8B8DFEFBFFFF            mov ecx, dword ptr [ebp+FFFFFBFE]
:0041FE1F 81E1FF000000            and ecx, 000000FF
:0041FE25 81E1FF000000            and ecx, 000000FF
:0041FE2B 03C1                    add eax, ecx
:0041FE2D 8985F8FBFFFF            mov dword ptr [ebp+FFFFFBF8], eax
:0041FE33 8B95F8FBFFFF            mov edx, dword ptr [ebp+FFFFFBF8]
:0041FE39 C1E208                  shl edx, 08
:0041FE3C 8B85FFFBFFFF            mov eax, dword ptr [ebp+FFFFFBFF]
:0041FE42 25FF000000              and eax, 000000FF
:0041FE47 25FF000000              and eax, 000000FF
:0041FE4C 03D0                    add edx, eax
:0041FE4E 8995F8FBFFFF            mov dword ptr [ebp+FFFFFBF8], edx
:0041FE54 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0041FE58 7447                    je 0041FEA1
:0041FE5A 6A00                    push 00000000
:0041FE5C 8B8DF4FBFFFF            mov ecx, dword ptr [ebp+FFFFFBF4]
:0041FE62 51                      push ecx
:0041FE63 8B8DF0FBFFFF            mov ecx, dword ptr [ebp+FFFFFBF0]
:0041FE69 E8B193FFFF              call 0041921F
:0041FE6E 8B55FC                  mov edx, dword ptr [ebp-04]
:0041FE71 3B95F8FBFFFF            cmp edx, dword ptr [ebp+FFFFFBF8]
:0041FE77 7515                    jne 0041FE8E
:0041FE79 8B45FC                  mov eax, dword ptr [ebp-04]
:0041FE7C 50                      push eax
:0041FE7D 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0041FE80 51                      push ecx
:0041FE81 8B8DF0FBFFFF            mov ecx, dword ptr [ebp+FFFFFBF0]
:0041FE87 E8DB92FFFF              call 00419167
:0041FE8C EB13                    jmp 0041FEA1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FE77(C)
|
:0041FE8E 8B55FC                  mov edx, dword ptr [ebp-04]
:0041FE91 52                      push edx
:0041FE92 8B450C                  mov eax, dword ptr [ebp+0C]
:0041FE95 50                      push eax
:0041FE96 8B8DF0FBFFFF            mov ecx, dword ptr [ebp+FFFFFBF0]
:0041FE9C E836FDFFFF              call 0041FBD7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041FE58(C), :0041FE8C(U)
|
:0041FEA1 8B45FC                  mov eax, dword ptr [ebp-04]
:0041FEA4 8BE5                    mov esp, ebp
:0041FEA6 5D                      pop ebp
:0041FEA7 C20800                  ret 0008


:0041FEAA CC                      int 03
:0041FEAB CC                      int 03
:0041FEAC CC                      int 03
:0041FEAD CC                      int 03
:0041FEAE CC                      int 03
:0041FEAF CC                      int 03
:0041FEB0 55                      push ebp
:0041FEB1 8BEC                    mov ebp, esp
:0041FEB3 E802000000              call 0041FEBA
:0041FEB8 5D                      pop ebp
:0041FEB9 C3                      ret



* Referenced by a CALL at Address:
|:0041FEB3   
|
:0041FEBA 55                      push ebp
:0041FEBB 8BEC                    mov ebp, esp
:0041FEBD B9F87A4900              mov ecx, 00497AF8
:0041FEC2 E8C95B0000              call 00425A90
:0041FEC7 5D                      pop ebp
:0041FEC8 C3                      ret



* Referenced by a CALL at Addresses:
|:00425666   , :004390FE   
|
:0041FEC9 55                      push ebp
:0041FECA 8BEC                    mov ebp, esp
:0041FECC 83EC14                  sub esp, 00000014
:0041FECF 8B450C                  mov eax, dword ptr [ebp+0C]
:0041FED2 25FF000000              and eax, 000000FF
:0041FED7 6BC024                  imul eax, 00000024
:0041FEDA 05502C4B00              add eax, 004B2C50
:0041FEDF 8945F0                  mov dword ptr [ebp-10], eax
:0041FEE2 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0041FEE5 E886F70300              call 0045F670
:0041FEEA 6BC048                  imul eax, 00000048
:0041FEED 05681B4A00              add eax, 004A1B68
:0041FEF2 8945F8                  mov dword ptr [ebp-08], eax
:0041FEF5 C745FC01000000          mov [ebp-04], 00000001
:0041FEFC 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041FEFF 81E1FF000000            and ecx, 000000FF
:0041FF05 894DEC                  mov dword ptr [ebp-14], ecx
:0041FF08 837DEC43                cmp dword ptr [ebp-14], 00000043
:0041FF0C 0F87A9040000            ja 004203BB
:0041FF12 8B45EC                  mov eax, dword ptr [ebp-14]
:0041FF15 33D2                    xor edx, edx
:0041FF17 8A90DE034200            mov dl, byte ptr [eax+004203DE]
:0041FF1D FF2495C2034200          jmp dword ptr [4*edx+004203C2]
:0041FF24 B9083D4B00              mov ecx, 004B3D08
:0041FF29 E8A6A20200              call 0044A1D4
:0041FF2E 25FF000000              and eax, 000000FF
:0041FF33 83F802                  cmp eax, 00000002
:0041FF36 7C1C                    jl 0041FF54
:0041FF38 837D1000                cmp dword ptr [ebp+10], 00000000
:0041FF3C 740F                    je 0041FF4D

* Possible StringData Ref from Data Obj ->"ڶʱ޷ʹá"
                                  |
:0041FF3E 6880B74800              push 0048B780
:0041FF43 6A02                    push 00000002
:0041FF45 E84FF70000              call 0042F699
:0041FF4A 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FF3C(C)
|
:0041FF4D C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FF36(C)
|
:0041FF54 E962040000              jmp 004203BB
:0041FF59 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0041FF5C E82F2D0500              call 00472C90
:0041FF61 83F803                  cmp eax, 00000003
:0041FF64 731C                    jnb 0041FF82
:0041FF66 837D1000                cmp dword ptr [ebp+10], 00000000
:0041FF6A 740F                    je 0041FF7B

* Possible StringData Ref from Data Obj ->"ȣв㡣"
                                  |
:0041FF6C 6898B74800              push 0048B798
:0041FF71 6A02                    push 00000002
:0041FF73 E821F70000              call 0042F699
:0041FF78 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FF6A(C)
|
:0041FF7B C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FF64(C)
|
:0041FF82 E934040000              jmp 004203BB
:0041FF87 6A32                    push 00000032
:0041FF89 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041FF8C E8787AFEFF              call 00407A09
:0041FF91 85C0                    test eax, eax
:0041FF93 7420                    je 0041FFB5
:0041FF95 6A32                    push 00000032
:0041FF97 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0041FF9A E8537BFEFF              call 00407AF2
:0041FF9F 25FF000000              and eax, 000000FF
:0041FFA4 8B4D08                  mov ecx, dword ptr [ebp+08]
:0041FFA7 81E1FF000000            and ecx, 000000FF
:0041FFAD 3BC1                    cmp eax, ecx
:0041FFAF 0F84B8000000            je 0042006D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FF93(C)
|
:0041FFB5 C645F400                mov [ebp-0C], 00
:0041FFB9 EB09                    jmp 0041FFC4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042001D(U)
|
:0041FFBB 8A55F4                  mov dl, byte ptr [ebp-0C]
:0041FFBE 80C201                  add dl, 01
:0041FFC1 8855F4                  mov byte ptr [ebp-0C], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FFB9(U)
|
:0041FFC4 8B45F4                  mov eax, dword ptr [ebp-0C]
:0041FFC7 25FF000000              and eax, 000000FF
:0041FFCC 83F868                  cmp eax, 00000068
:0041FFCF 7D4E                    jge 0042001F
:0041FFD1 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041FFD4 81E1FF000000            and ecx, 000000FF
:0041FFDA 6BC919                  imul ecx, 00000019
:0041FFDD 81C140114A00            add ecx, 004A1140
:0041FFE3 E85895FEFF              call 00409540
:0041FFE8 25FF000000              and eax, 000000FF
:0041FFED 83F832                  cmp eax, 00000032
:0041FFF0 752B                    jne 0042001D
:0041FFF2 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0041FFF5 81E1FF000000            and ecx, 000000FF
:0041FFFB 6BC919                  imul ecx, 00000019
:0041FFFE 81C140114A00            add ecx, 004A1140
:00420004 E867DDFFFF              call 0041DD70
:00420009 25FF000000              and eax, 000000FF
:0042000E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00420011 81E1FF000000            and ecx, 000000FF
:00420017 3BC1                    cmp eax, ecx
:00420019 7502                    jne 0042001D
:0042001B EB02                    jmp 0042001F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041FFF0(C), :00420019(C)
|
:0042001D EB9C                    jmp 0041FFBB

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041FFCF(C), :0042001B(U)
|
:0042001F 837D1000                cmp dword ptr [ebp+10], 00000000
:00420023 743F                    je 00420064
:00420025 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00420028 81E1FF000000            and ecx, 000000FF
:0042002E 6BC919                  imul ecx, 00000019
:00420031 81C140114A00            add ecx, 004A1140
:00420037 E8D4F60300              call 0045F710
:0042003C 50                      push eax
:0042003D 8B4D08                  mov ecx, dword ptr [ebp+08]
:00420040 81E1FF000000            and ecx, 000000FF
:00420046 6BC946                  imul ecx, 00000046
:00420049 81C1C0F44A00            add ecx, 004AF4C0
:0042004F E8BCF60300              call 0045F710
:00420054 50                      push eax

* Possible StringData Ref from Data Obj ->"ʹ%sҪ%s"
                                  |
:00420055 68A4B74800              push 0048B7A4
:0042005A 6A02                    push 00000002
:0042005C E838F60000              call 0042F699
:00420061 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420023(C)
|
:00420064 C745FC00000000          mov [ebp-04], 00000000
:0042006B EB30                    jmp 0042009D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041FFAF(C)
|
:0042006D B9083D4B00              mov ecx, 004B3D08
:00420072 E85DA10200              call 0044A1D4
:00420077 25FF000000              and eax, 000000FF
:0042007C 83F802                  cmp eax, 00000002
:0042007F 7D1C                    jge 0042009D
:00420081 837D1000                cmp dword ptr [ebp+10], 00000000
:00420085 740F                    je 00420096

* Possible StringData Ref from Data Obj ->"ֻڶʱʹá"
                                  |
:00420087 68B4B74800              push 0048B7B4
:0042008C 6A02                    push 00000002
:0042008E E806F60000              call 0042F699
:00420093 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420085(C)
|
:00420096 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042006B(U), :0042007F(C)
|
:0042009D E919030000              jmp 004203BB
:004200A2 6A32                    push 00000032
:004200A4 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004200A7 E85D79FEFF              call 00407A09
:004200AC 85C0                    test eax, eax
:004200AE 7420                    je 004200D0
:004200B0 6A32                    push 00000032
:004200B2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004200B5 E8387AFEFF              call 00407AF2
:004200BA 25FF000000              and eax, 000000FF
:004200BF 8B5508                  mov edx, dword ptr [ebp+08]
:004200C2 81E2FF000000            and edx, 000000FF
:004200C8 3BC2                    cmp eax, edx
:004200CA 0F84B8000000            je 00420188

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004200AE(C)
|
:004200D0 C645F400                mov [ebp-0C], 00
:004200D4 EB08                    jmp 004200DE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420138(U)
|
:004200D6 8A45F4                  mov al, byte ptr [ebp-0C]
:004200D9 0401                    add al, 01
:004200DB 8845F4                  mov byte ptr [ebp-0C], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004200D4(U)
|
:004200DE 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004200E1 81E1FF000000            and ecx, 000000FF
:004200E7 83F968                  cmp ecx, 00000068
:004200EA 7D4E                    jge 0042013A
:004200EC 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004200EF 81E1FF000000            and ecx, 000000FF
:004200F5 6BC919                  imul ecx, 00000019
:004200F8 81C140114A00            add ecx, 004A1140
:004200FE E83D94FEFF              call 00409540
:00420103 25FF000000              and eax, 000000FF
:00420108 83F832                  cmp eax, 00000032
:0042010B 752B                    jne 00420138
:0042010D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00420110 81E1FF000000            and ecx, 000000FF
:00420116 6BC919                  imul ecx, 00000019
:00420119 81C140114A00            add ecx, 004A1140
:0042011F E84CDCFFFF              call 0041DD70
:00420124 25FF000000              and eax, 000000FF
:00420129 8B5508                  mov edx, dword ptr [ebp+08]
:0042012C 81E2FF000000            and edx, 000000FF
:00420132 3BC2                    cmp eax, edx
:00420134 7502                    jne 00420138
:00420136 EB02                    jmp 0042013A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042010B(C), :00420134(C)
|
:00420138 EB9C                    jmp 004200D6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004200EA(C), :00420136(U)
|
:0042013A 837D1000                cmp dword ptr [ebp+10], 00000000
:0042013E 743F                    je 0042017F
:00420140 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00420143 81E1FF000000            and ecx, 000000FF
:00420149 6BC919                  imul ecx, 00000019
:0042014C 81C140114A00            add ecx, 004A1140
:00420152 E8B9F50300              call 0045F710
:00420157 50                      push eax
:00420158 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042015B 81E1FF000000            and ecx, 000000FF
:00420161 6BC946                  imul ecx, 00000046
:00420164 81C1C0F44A00            add ecx, 004AF4C0
:0042016A E8A1F50300              call 0045F710
:0042016F 50                      push eax

* Possible StringData Ref from Data Obj ->"ʹ%sҪ%s"
                                  |
:00420170 68CCB74800              push 0048B7CC
:00420175 6A02                    push 00000002
:00420177 E81DF50000              call 0042F699
:0042017C 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042013E(C)
|
:0042017F C745FC00000000          mov [ebp-04], 00000000
:00420186 EB2F                    jmp 004201B7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004200CA(C)
|
:00420188 B9083D4B00              mov ecx, 004B3D08
:0042018D E842A00200              call 0044A1D4
:00420192 25FF000000              and eax, 000000FF
:00420197 85C0                    test eax, eax
:00420199 741C                    je 004201B7
:0042019B 837D1000                cmp dword ptr [ebp+10], 00000000
:0042019F 740F                    je 004201B0

* Possible StringData Ref from Data Obj ->"ֻʱʹá"
                                  |
:004201A1 68DCB74800              push 0048B7DC
:004201A6 6A02                    push 00000002
:004201A8 E8ECF40000              call 0042F699
:004201AD 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042019F(C)
|
:004201B0 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00420186(U), :00420199(C)
|
:004201B7 E9FF010000              jmp 004203BB
:004201BC 6A32                    push 00000032
:004201BE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004201C1 E84378FEFF              call 00407A09
:004201C6 85C0                    test eax, eax
:004201C8 7420                    je 004201EA
:004201CA 6A32                    push 00000032
:004201CC 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004201CF E81E79FEFF              call 00407AF2
:004201D4 25FF000000              and eax, 000000FF
:004201D9 8B4D08                  mov ecx, dword ptr [ebp+08]
:004201DC 81E1FF000000            and ecx, 000000FF
:004201E2 3BC1                    cmp eax, ecx
:004201E4 0F84B8000000            je 004202A2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004201C8(C)
|
:004201EA C645F400                mov [ebp-0C], 00
:004201EE EB09                    jmp 004201F9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420252(U)
|
:004201F0 8A55F4                  mov dl, byte ptr [ebp-0C]
:004201F3 80C201                  add dl, 01
:004201F6 8855F4                  mov byte ptr [ebp-0C], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004201EE(U)
|
:004201F9 8B45F4                  mov eax, dword ptr [ebp-0C]
:004201FC 25FF000000              and eax, 000000FF
:00420201 83F868                  cmp eax, 00000068
:00420204 7D4E                    jge 00420254
:00420206 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00420209 81E1FF000000            and ecx, 000000FF
:0042020F 6BC919                  imul ecx, 00000019
:00420212 81C140114A00            add ecx, 004A1140
:00420218 E82393FEFF              call 00409540
:0042021D 25FF000000              and eax, 000000FF
:00420222 83F832                  cmp eax, 00000032
:00420225 752B                    jne 00420252
:00420227 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042022A 81E1FF000000            and ecx, 000000FF
:00420230 6BC919                  imul ecx, 00000019
:00420233 81C140114A00            add ecx, 004A1140
:00420239 E832DBFFFF              call 0041DD70
:0042023E 25FF000000              and eax, 000000FF
:00420243 8B4D08                  mov ecx, dword ptr [ebp+08]
:00420246 81E1FF000000            and ecx, 000000FF
:0042024C 3BC1                    cmp eax, ecx
:0042024E 7502                    jne 00420252
:00420250 EB02                    jmp 00420254

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00420225(C), :0042024E(C)
|
:00420252 EB9C                    jmp 004201F0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00420204(C), :00420250(U)
|
:00420254 837D1000                cmp dword ptr [ebp+10], 00000000
:00420258 743F                    je 00420299
:0042025A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042025D 81E1FF000000            and ecx, 000000FF
:00420263 6BC919                  imul ecx, 00000019
:00420266 81C140114A00            add ecx, 004A1140
:0042026C E89FF40300              call 0045F710
:00420271 50                      push eax
:00420272 8B4D08                  mov ecx, dword ptr [ebp+08]
:00420275 81E1FF000000            and ecx, 000000FF
:0042027B 6BC946                  imul ecx, 00000046
:0042027E 81C1C0F44A00            add ecx, 004AF4C0
:00420284 E887F40300              call 0045F710
:00420289 50                      push eax

* Possible StringData Ref from Data Obj ->"ʹ%sҪ%s"
                                  |
:0042028A 68F0B74800              push 0048B7F0
:0042028F 6A02                    push 00000002
:00420291 E803F40000              call 0042F699
:00420296 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420258(C)
|
:00420299 C745FC00000000          mov [ebp-04], 00000000
:004202A0 EB30                    jmp 004202D2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004201E4(C)
|
:004202A2 B9083D4B00              mov ecx, 004B3D08
:004202A7 E8289F0200              call 0044A1D4
:004202AC 25FF000000              and eax, 000000FF
:004202B1 83F801                  cmp eax, 00000001
:004202B4 741C                    je 004202D2
:004202B6 837D1000                cmp dword ptr [ebp+10], 00000000
:004202BA 740F                    je 004202CB

* Possible StringData Ref from Data Obj ->"ֻʱʹá"
                                  |
:004202BC 6800B84800              push 0048B800
:004202C1 6A02                    push 00000002
:004202C3 E8D1F30000              call 0042F699
:004202C8 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004202BA(C)
|
:004202CB C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004202A0(U), :004202B4(C)
|
:004202D2 E9E4000000              jmp 004203BB
:004202D7 6A32                    push 00000032
:004202D9 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004202DC E82877FEFF              call 00407A09
:004202E1 85C0                    test eax, eax
:004202E3 7420                    je 00420305
:004202E5 6A32                    push 00000032
:004202E7 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004202EA E80378FEFF              call 00407AF2
:004202EF 25FF000000              and eax, 000000FF
:004202F4 8B5508                  mov edx, dword ptr [ebp+08]
:004202F7 81E2FF000000            and edx, 000000FF
:004202FD 3BC2                    cmp eax, edx
:004202FF 0F84B6000000            je 004203BB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004202E3(C)
|
:00420305 C645F400                mov [ebp-0C], 00
:00420309 EB08                    jmp 00420313

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042036D(U)
|
:0042030B 8A45F4                  mov al, byte ptr [ebp-0C]
:0042030E 0401                    add al, 01
:00420310 8845F4                  mov byte ptr [ebp-0C], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420309(U)
|
:00420313 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00420316 81E1FF000000            and ecx, 000000FF
:0042031C 83F968                  cmp ecx, 00000068
:0042031F 7D4E                    jge 0042036F
:00420321 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00420324 81E1FF000000            and ecx, 000000FF
:0042032A 6BC919                  imul ecx, 00000019
:0042032D 81C140114A00            add ecx, 004A1140
:00420333 E80892FEFF              call 00409540
:00420338 25FF000000              and eax, 000000FF
:0042033D 83F832                  cmp eax, 00000032
:00420340 752B                    jne 0042036D
:00420342 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00420345 81E1FF000000            and ecx, 000000FF
:0042034B 6BC919                  imul ecx, 00000019
:0042034E 81C140114A00            add ecx, 004A1140
:00420354 E817DAFFFF              call 0041DD70
:00420359 25FF000000              and eax, 000000FF
:0042035E 8B5508                  mov edx, dword ptr [ebp+08]
:00420361 81E2FF000000            and edx, 000000FF
:00420367 3BC2                    cmp eax, edx
:00420369 7502                    jne 0042036D
:0042036B EB02                    jmp 0042036F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00420340(C), :00420369(C)
|
:0042036D EB9C                    jmp 0042030B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042031F(C), :0042036B(U)
|
:0042036F 837D1000                cmp dword ptr [ebp+10], 00000000
:00420373 743F                    je 004203B4
:00420375 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00420378 81E1FF000000            and ecx, 000000FF
:0042037E 6BC919                  imul ecx, 00000019
:00420381 81C140114A00            add ecx, 004A1140
:00420387 E884F30300              call 0045F710
:0042038C 50                      push eax
:0042038D 8B4D08                  mov ecx, dword ptr [ebp+08]
:00420390 81E1FF000000            and ecx, 000000FF
:00420396 6BC946                  imul ecx, 00000046
:00420399 81C1C0F44A00            add ecx, 004AF4C0
:0042039F E86CF30300              call 0045F710
:004203A4 50                      push eax

* Possible StringData Ref from Data Obj ->"ʹ%sҪ%s"
                                  |
:004203A5 6814B84800              push 0048B814
:004203AA 6A02                    push 00000002
:004203AC E8E8F20000              call 0042F699
:004203B1 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420373(C)
|
:004203B4 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041FF0C(C), :0041FF54(U), :0041FF82(U), :0042009D(U), :004201B7(U)
|:004202D2(U), :004202FF(C)
|
:004203BB 8B45FC                  mov eax, dword ptr [ebp-04]
:004203BE 8BE5                    mov esp, ebp
:004203C0 5D                      pop ebp
:004203C1 C3                      ret


:004203C2 24FF                    and al, FF
:004203C4 41                      inc ecx
:004203C5 0059FF                  add byte ptr [ecx-01], bl
:004203C8 41                      inc ecx
:004203C9 0087FF4100A2            add byte ptr [edi+A20041FF], al
:004203CF 004200                  add byte ptr [edx+00], al

:004203D2 BC014200                DWORD 004201BC
:004203D6 D7024200                DWORD 004202D7
:004203DA BB034200                DWORD 004203BB


:004203DE 0000000000              BYTE  5 DUP(0)


:004203E3 06                      push es
:004203E4 06                      push es
:004203E5 06                      push es
:004203E6 06                      push es
:004203E7 06                      push es
:004203E8 06                      push es
:004203E9 06                      push es
:004203EA 06                      push es
:004203EB 06                      push es
:004203EC 06                      push es
:004203ED 06                      push es
:004203EE 06                      push es
:004203EF 06                      push es
:004203F0 06                      push es
:004203F1 06                      push es
:004203F2 06                      push es
:004203F3 06                      push es
:004203F4 06                      push es
:004203F5 06                      push es
:004203F6 06                      push es
:004203F7 06                      push es
:004203F8 06                      push es
:004203F9 06                      push es
:004203FA 06                      push es
:004203FB 06                      push es
:004203FC 06                      push es
:004203FD 06                      push es
:004203FE 06                      push es
:004203FF 06                      push es
:00420400 06                      push es
:00420401 06                      push es
:00420402 06                      push es
:00420403 06                      push es
:00420404 06                      push es
:00420405 06                      push es
:00420406 06                      push es
:00420407 06                      push es
:00420408 06                      push es
:00420409 06                      push es
:0042040A 06                      push es
:0042040B 06                      push es
:0042040C 06                      push es
:0042040D 06                      push es
:0042040E 06                      push es
:0042040F 06                      push es
:00420410 06                      push es
:00420411 06                      push es
:00420412 06                      push es
:00420413 06                      push es
:00420414 06                      push es
:00420415 06                      push es
:00420416 06                      push es
:00420417 06                      push es
:00420418 06                      push es
:00420419 06                      push es
:0042041A 06                      push es
:0042041B 06                      push es
:0042041C 0106                    add dword ptr [esi], eax
:0042041E 0203                    add al, byte ptr [ebx]
:00420420 0405                    add al, 05

* Referenced by a CALL at Addresses:
|:004231A2   , :004233CA   , :004235B8   , :004237F1   , :004239C4   
|:00423D07   , :00423DAA   , :00423F40   , :0043911C   , :0043B811   
|:0043C018   
|
:00420422 55                      push ebp
:00420423 8BEC                    mov ebp, esp
:00420425 83EC14                  sub esp, 00000014
:00420428 56                      push esi
:00420429 C745F401000000          mov [ebp-0C], 00000001
:00420430 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00420433 81E1FF000000            and ecx, 000000FF
:00420439 6BC924                  imul ecx, 00000024
:0042043C 81C1502C4B00            add ecx, 004B2C50
:00420442 E889560000              call 00425AD0
:00420447 25FF000000              and eax, 000000FF
:0042044C 33C9                    xor ecx, ecx
:0042044E 83F807                  cmp eax, 00000007
:00420451 0F95C1                  setne cl
:00420454 894DFC                  mov dword ptr [ebp-04], ecx
:00420457 8B550C                  mov edx, dword ptr [ebp+0C]
:0042045A 81E2FF000000            and edx, 000000FF
:00420460 6BD224                  imul edx, 00000024
:00420463 81C2502C4B00            add edx, 004B2C50
:00420469 8955F0                  mov dword ptr [ebp-10], edx
:0042046C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0042046F E8FCF10300              call 0045F670
:00420474 6BC048                  imul eax, 00000048
:00420477 05681B4A00              add eax, 004A1B68
:0042047C 8945F8                  mov dword ptr [ebp-08], eax
:0042047F 8B4508                  mov eax, dword ptr [ebp+08]
:00420482 25FF000000              and eax, 000000FF
:00420487 8945EC                  mov dword ptr [ebp-14], eax
:0042048A 837DEC3D                cmp dword ptr [ebp-14], 0000003D
:0042048E 0F8758040000            ja 004208EC
:00420494 8B55EC                  mov edx, dword ptr [ebp-14]
:00420497 33C9                    xor ecx, ecx
:00420499 8A8A3C094200            mov cl, byte ptr [edx+0042093C]
:0042049F FF248DF4084200          jmp dword ptr [4*ecx+004208F4]
:004204A6 8B4D10                  mov ecx, dword ptr [ebp+10]
:004204A9 81E1FF000000            and ecx, 000000FF
:004204AF 6BC924                  imul ecx, 00000024
:004204B2 81C1502C4B00            add ecx, 004B2C50
:004204B8 E8A32EFEFF              call 00403360
:004204BD 50                      push eax
:004204BE E8CE540100              call 00435991
:004204C3 83C404                  add esp, 00000004
:004204C6 50                      push eax
:004204C7 E8EA050000              call 00420AB6
:004204CC 83C404                  add esp, 00000004
:004204CF 85C0                    test eax, eax
:004204D1 751C                    jne 004204EF
:004204D3 837D1400                cmp dword ptr [ebp+14], 00000000
:004204D7 740F                    je 004204E8

* Possible StringData Ref from Data Obj ->"ʹá"
                                  |
:004204D9 6824B84800              push 0048B824
:004204DE 6A02                    push 00000002
:004204E0 E8B4F10000              call 0042F699
:004204E5 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004204D7(C)
|
:004204E8 C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004204D1(C)
|
:004204EF E9F8030000              jmp 004208EC
:004204F4 8B4D10                  mov ecx, dword ptr [ebp+10]
:004204F7 81E1FF000000            and ecx, 000000FF
:004204FD 6BC924                  imul ecx, 00000024
:00420500 81C1502C4B00            add ecx, 004B2C50
:00420506 E8552EFEFF              call 00403360
:0042050B 50                      push eax
:0042050C E880540100              call 00435991
:00420511 83C404                  add esp, 00000004
:00420514 50                      push eax
:00420515 E8FD050000              call 00420B17
:0042051A 83C404                  add esp, 00000004
:0042051D 85C0                    test eax, eax
:0042051F 751C                    jne 0042053D
:00420521 837D1400                cmp dword ptr [ebp+14], 00000000
:00420525 740F                    je 00420536

* Possible StringData Ref from Data Obj ->"ʹá"
                                  |
:00420527 6838B84800              push 0048B838
:0042052C 6A02                    push 00000002
:0042052E E866F10000              call 0042F699
:00420533 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420525(C)
|
:00420536 C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042051F(C)
|
:0042053D E9AA030000              jmp 004208EC
:00420542 8B4D10                  mov ecx, dword ptr [ebp+10]
:00420545 81E1FF000000            and ecx, 000000FF
:0042054B 6BC924                  imul ecx, 00000024
:0042054E 81C1502C4B00            add ecx, 004B2C50
:00420554 E8072EFEFF              call 00403360
:00420559 50                      push eax
:0042055A E832540100              call 00435991
:0042055F 83C404                  add esp, 00000004
:00420562 50                      push eax
:00420563 E8DA050000              call 00420B42
:00420568 83C404                  add esp, 00000004
:0042056B 85C0                    test eax, eax
:0042056D 751C                    jne 0042058B
:0042056F 837D1400                cmp dword ptr [ebp+14], 00000000
:00420573 740F                    je 00420584

* Possible StringData Ref from Data Obj ->"ʹá"
                                  |
:00420575 684CB84800              push 0048B84C
:0042057A 6A02                    push 00000002
:0042057C E818F10000              call 0042F699
:00420581 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420573(C)
|
:00420584 C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042056D(C)
|
:0042058B E95C030000              jmp 004208EC
:00420590 8B4D10                  mov ecx, dword ptr [ebp+10]
:00420593 81E1FF000000            and ecx, 000000FF
:00420599 6BC924                  imul ecx, 00000024
:0042059C 81C1502C4B00            add ecx, 004B2C50
:004205A2 E8B92DFEFF              call 00403360
:004205A7 50                      push eax
:004205A8 E8E4530100              call 00435991
:004205AD 83C404                  add esp, 00000004
:004205B0 50                      push eax
:004205B1 E8E2050000              call 00420B98
:004205B6 83C404                  add esp, 00000004
:004205B9 85C0                    test eax, eax
:004205BB 751C                    jne 004205D9
:004205BD 837D1400                cmp dword ptr [ebp+14], 00000000
:004205C1 740F                    je 004205D2

* Possible StringData Ref from Data Obj ->"ʹá"
                                  |
:004205C3 6860B84800              push 0048B860
:004205C8 6A02                    push 00000002
:004205CA E8CAF00000              call 0042F699
:004205CF 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004205C1(C)
|
:004205D2 C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004205BB(C)
|
:004205D9 E90E030000              jmp 004208EC
:004205DE 837DFC00                cmp dword ptr [ebp-04], 00000000
:004205E2 741D                    je 00420601
:004205E4 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004205E7 E8A4260500              call 00472C90
:004205EC 8BF0                    mov esi, eax
:004205EE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004205F1 E8256CFEFF              call 0040721B
:004205F6 3BF0                    cmp esi, eax
:004205F8 7507                    jne 00420601
:004205FA C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004205E2(C), :004205F8(C)
|
:00420601 E9E6020000              jmp 004208EC
:00420606 837DFC00                cmp dword ptr [ebp-04], 00000000
:0042060A 741D                    je 00420629
:0042060C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0042060F E82C220500              call 00472840
:00420614 8BF0                    mov esi, eax
:00420616 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00420619 E82C6CFEFF              call 0040724A
:0042061E 3BF0                    cmp esi, eax
:00420620 7507                    jne 00420629
:00420622 C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042060A(C), :00420620(C)
|
:00420629 E9BE020000              jmp 004208EC
:0042062E 837DFC00                cmp dword ptr [ebp-04], 00000000
:00420632 7421                    je 00420655
:00420634 8A4510                  mov al, byte ptr [ebp+10]
:00420637 50                      push eax
:00420638 8A4D08                  mov cl, byte ptr [ebp+08]
:0042063B 51                      push ecx
:0042063C E87C050000              call 00420BBD
:00420641 83C408                  add esp, 00000008
:00420644 25FF000000              and eax, 000000FF
:00420649 83F802                  cmp eax, 00000002
:0042064C 7507                    jne 00420655
:0042064E C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00420632(C), :0042064C(C)
|
:00420655 E992020000              jmp 004208EC
:0042065A 837DFC00                cmp dword ptr [ebp-04], 00000000
:0042065E 7424                    je 00420684
:00420660 6A08                    push 00000008
:00420662 8B4D10                  mov ecx, dword ptr [ebp+10]
:00420665 81E1FF000000            and ecx, 000000FF
:0042066B 6BC924                  imul ecx, 00000024
:0042066E 81C1502C4B00            add ecx, 004B2C50
:00420674 E86760FEFF              call 004066E0
:00420679 85C0                    test eax, eax
:0042067B 7407                    je 00420684
:0042067D C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042065E(C), :0042067B(C)
|
:00420684 E963020000              jmp 004208EC
:00420689 837DFC00                cmp dword ptr [ebp-04], 00000000
:0042068D 7424                    je 004206B3
:0042068F 6A10                    push 00000010
:00420691 8B4D10                  mov ecx, dword ptr [ebp+10]
:00420694 81E1FF000000            and ecx, 000000FF
:0042069A 6BC924                  imul ecx, 00000024
:0042069D 81C1502C4B00            add ecx, 004B2C50
:004206A3 E83860FEFF              call 004066E0
:004206A8 85C0                    test eax, eax
:004206AA 7407                    je 004206B3
:004206AC C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042068D(C), :004206AA(C)
|
:004206B3 E934020000              jmp 004208EC
:004206B8 837DFC00                cmp dword ptr [ebp-04], 00000000
:004206BC 7424                    je 004206E2
:004206BE 6A02                    push 00000002
:004206C0 8B4D10                  mov ecx, dword ptr [ebp+10]
:004206C3 81E1FF000000            and ecx, 000000FF
:004206C9 6BC924                  imul ecx, 00000024
:004206CC 81C1502C4B00            add ecx, 004B2C50
:004206D2 E80960FEFF              call 004066E0
:004206D7 85C0                    test eax, eax
:004206D9 7407                    je 004206E2
:004206DB C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004206BC(C), :004206D9(C)
|
:004206E2 E905020000              jmp 004208EC
:004206E7 837DFC00                cmp dword ptr [ebp-04], 00000000
:004206EB 7424                    je 00420711
:004206ED 6A04                    push 00000004
:004206EF 8B4D10                  mov ecx, dword ptr [ebp+10]
:004206F2 81E1FF000000            and ecx, 000000FF
:004206F8 6BC924                  imul ecx, 00000024
:004206FB 81C1502C4B00            add ecx, 004B2C50
:00420701 E8DA5FFEFF              call 004066E0
:00420706 85C0                    test eax, eax
:00420708 7407                    je 00420711
:0042070A C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004206EB(C), :00420708(C)
|
:00420711 E9D6010000              jmp 004208EC
:00420716 837DFC00                cmp dword ptr [ebp-04], 00000000
:0042071A 744B                    je 00420767
:0042071C 8B4D10                  mov ecx, dword ptr [ebp+10]
:0042071F 81E1FF000000            and ecx, 000000FF
:00420725 6BC924                  imul ecx, 00000024
:00420728 81C1502C4B00            add ecx, 004B2C50
:0042072E E85D250500              call 00472C90
:00420733 8BF0                    mov esi, eax
:00420735 8B4D10                  mov ecx, dword ptr [ebp+10]
:00420738 81E1FF000000            and ecx, 000000FF
:0042073E 6BC924                  imul ecx, 00000024
:00420741 81C1502C4B00            add ecx, 004B2C50
:00420747 E824EF0300              call 0045F670
:0042074C 8BC8                    mov ecx, eax
:0042074E 6BC948                  imul ecx, 00000048
:00420751 81C1681B4A00            add ecx, 004A1B68
:00420757 E8BF6AFEFF              call 0040721B
:0042075C 3BF0                    cmp esi, eax
:0042075E 7507                    jne 00420767
:00420760 C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042071A(C), :0042075E(C)
|
:00420767 E980010000              jmp 004208EC
:0042076C 837DFC00                cmp dword ptr [ebp-04], 00000000
:00420770 744B                    je 004207BD
:00420772 8B4D10                  mov ecx, dword ptr [ebp+10]
:00420775 81E1FF000000            and ecx, 000000FF
:0042077B 6BC924                  imul ecx, 00000024
:0042077E 81C1502C4B00            add ecx, 004B2C50
:00420784 E8B7200500              call 00472840
:00420789 8BF0                    mov esi, eax
:0042078B 8B4D10                  mov ecx, dword ptr [ebp+10]
:0042078E 81E1FF000000            and ecx, 000000FF
:00420794 6BC924                  imul ecx, 00000024
:00420797 81C1502C4B00            add ecx, 004B2C50
:0042079D E8CEEE0300              call 0045F670
:004207A2 8BC8                    mov ecx, eax
:004207A4 6BC948                  imul ecx, 00000048
:004207A7 81C1681B4A00            add ecx, 004A1B68
:004207AD E8986AFEFF              call 0040724A
:004207B2 3BF0                    cmp esi, eax
:004207B4 7507                    jne 004207BD
:004207B6 C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00420770(C), :004207B4(C)
|
:004207BD E92A010000              jmp 004208EC
:004207C2 837DFC00                cmp dword ptr [ebp-04], 00000000
:004207C6 7427                    je 004207EF
:004207C8 8B4D10                  mov ecx, dword ptr [ebp+10]
:004207CB 81E1FF000000            and ecx, 000000FF
:004207D1 6BC924                  imul ecx, 00000024
:004207D4 81C1502C4B00            add ecx, 004B2C50
:004207DA E851D8FFFF              call 0041E030
:004207DF 25FF000000              and eax, 000000FF
:004207E4 85C0                    test eax, eax
:004207E6 7507                    jne 004207EF
:004207E8 C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004207C6(C), :004207E6(C)
|
:004207EF E9F8000000              jmp 004208EC
:004207F4 837DFC00                cmp dword ptr [ebp-04], 00000000
:004207F8 7421                    je 0042081B
:004207FA 8A5510                  mov dl, byte ptr [ebp+10]
:004207FD 52                      push edx
:004207FE 8A4508                  mov al, byte ptr [ebp+08]
:00420801 50                      push eax
:00420802 E8B6030000              call 00420BBD
:00420807 83C408                  add esp, 00000008
:0042080A 25FF000000              and eax, 000000FF
:0042080F 83F804                  cmp eax, 00000004
:00420812 7C07                    jl 0042081B
:00420814 C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004207F8(C), :00420812(C)
|
:0042081B E9CC000000              jmp 004208EC
:00420820 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00420823 81E1FF000000            and ecx, 000000FF
:00420829 8B5510                  mov edx, dword ptr [ebp+10]
:0042082C 81E2FF000000            and edx, 000000FF
:00420832 3BCA                    cmp ecx, edx
:00420834 751E                    jne 00420854
:00420836 837D1400                cmp dword ptr [ebp+14], 00000000
:0042083A 740F                    je 0042084B

* Possible StringData Ref from Data Obj ->"ܶҷʹá"
                                  |
:0042083C 6874B84800              push 0048B874
:00420841 6A02                    push 00000002
:00420843 E851EE0000              call 0042F699
:00420848 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042083A(C)
|
:0042084B C745F400000000          mov [ebp-0C], 00000000
:00420852 EB71                    jmp 004208C5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420834(C)
|
:00420854 837DFC00                cmp dword ptr [ebp-04], 00000000
:00420858 7443                    je 0042089D
:0042085A 6A04                    push 00000004
:0042085C 8B4D10                  mov ecx, dword ptr [ebp+10]
:0042085F 81E1FF000000            and ecx, 000000FF
:00420865 6BC924                  imul ecx, 00000024
:00420868 81C1502C4B00            add ecx, 004B2C50
:0042086E E87D520000              call 00425AF0
:00420873 85C0                    test eax, eax
:00420875 7526                    jne 0042089D
:00420877 6A02                    push 00000002
:00420879 8B4D10                  mov ecx, dword ptr [ebp+10]
:0042087C 81E1FF000000            and ecx, 000000FF
:00420882 6BC924                  imul ecx, 00000024
:00420885 81C1502C4B00            add ecx, 004B2C50
:0042088B E860520000              call 00425AF0
:00420890 85C0                    test eax, eax
:00420892 7509                    jne 0042089D
:00420894 C745F400000000          mov [ebp-0C], 00000000
:0042089B EB28                    jmp 004208C5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00420858(C), :00420875(C), :00420892(C)
|
:0042089D 837DFC00                cmp dword ptr [ebp-04], 00000000
:004208A1 7422                    je 004208C5
:004208A3 8B4D10                  mov ecx, dword ptr [ebp+10]
:004208A6 81E1FF000000            and ecx, 000000FF
:004208AC 6BC924                  imul ecx, 00000024
:004208AF 81C1502C4B00            add ecx, 004B2C50
:004208B5 E89AF60100              call 0043FF54
:004208BA 85C0                    test eax, eax
:004208BC 7407                    je 004208C5
:004208BE C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00420852(U), :0042089B(U), :004208A1(C), :004208BC(C)
|
:004208C5 EB25                    jmp 004208EC
:004208C7 837DFC00                cmp dword ptr [ebp-04], 00000000
:004208CB 741F                    je 004208EC
:004208CD 8A4510                  mov al, byte ptr [ebp+10]
:004208D0 50                      push eax
:004208D1 6A35                    push 00000035
:004208D3 E8E5020000              call 00420BBD
:004208D8 83C408                  add esp, 00000008
:004208DB 25FF000000              and eax, 000000FF
:004208E0 83F804                  cmp eax, 00000004
:004208E3 7C07                    jl 004208EC
:004208E5 C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042048E(C), :004204EF(U), :0042053D(U), :0042058B(U), :004205D9(U)
|:00420601(U), :00420629(U), :00420655(U), :00420684(U), :004206B3(U)
|:004206E2(U), :00420711(U), :00420767(U), :004207BD(U), :004207EF(U)
|:0042081B(U), :004208C5(U), :004208CB(C), :004208E3(C)
|
:004208EC 8B45F4                  mov eax, dword ptr [ebp-0C]
:004208EF 5E                      pop esi
:004208F0 8BE5                    mov esp, ebp
:004208F2 5D                      pop ebp
:004208F3 C3                      ret



:004208F4 A6044200                DWORD 004204A6
:004208F8 F4044200                DWORD 004204F4
:004208FC 42054200                DWORD 00420542
:00420900 90054200                DWORD 00420590
:00420904 DE054200                DWORD 004205DE
:00420908 06064200                DWORD 00420606
:0042090C 2E064200                DWORD 0042062E
:00420910 5A064200                DWORD 0042065A
:00420914 89064200                DWORD 00420689
:00420918 B8064200                DWORD 004206B8
:0042091C E7064200                DWORD 004206E7
:00420920 16074200                DWORD 00420716
:00420924 6C074200                DWORD 0042076C
:00420928 C2074200                DWORD 004207C2
:0042092C F4074200                DWORD 004207F4
:00420930 20084200                DWORD 00420820
:00420934 C7084200                DWORD 004208C7
:00420938 EC084200                DWORD 004208EC


:0042093C 0000000000              BYTE  5 DUP(0)


:00420941 0101                    add dword ptr [ecx], eax
:00420943 0101                    add dword ptr [ecx], eax
:00420945 0102                    add dword ptr [edx], eax
:00420947 0202                    add al, byte ptr [edx]
:00420949 0202                    add al, byte ptr [edx]
:0042094B 0303                    add eax, dword ptr [ebx]
:0042094D 0303                    add eax, dword ptr [ebx]
:0042094F 030411                  add eax, dword ptr [ecx+edx]
:00420952 0506060606              add eax, 06060606
:00420957 06                      push es
:00420958 06                      push es
:00420959 06                      push es
:0042095A 06                      push es
:0042095B 07                      pop es
:0042095C 07                      pop es
:0042095D 0808                    or byte ptr [eax], cl
:0042095F 0909                    or dword ptr [ecx], ecx
:00420961 0A11                    or dl, byte ptr [ecx]
:00420963 0B0B                    or ecx, dword ptr [ebx]
:00420965 0B0B                    or ecx, dword ptr [ebx]
:00420967 0B0C0C                  or ecx, dword ptr [esp+ecx]
:0042096A 0D0D110E0E              or eax, 0E0E110D
:0042096F 0E                      push cs
:00420970 0E                      push cs
:00420971 0E                      push cs
:00420972 0E                      push cs
:00420973 0E                      push cs
:00420974 0E                      push cs
:00420975 0F                      BYTE 0fh
:00420976 1111                    adc dword ptr [ecx], edx
:00420978 1110                    adc dword ptr [eax], edx

* Referenced by a CALL at Addresses:
|:004242BB   , :00424597   , :00424867   , :004253D4   
|
:0042097A 55                      push ebp
:0042097B 8BEC                    mov ebp, esp
:0042097D 83EC08                  sub esp, 00000008
:00420980 C745FC01000000          mov [ebp-04], 00000001
:00420987 8B4508                  mov eax, dword ptr [ebp+08]
:0042098A 25FF000000              and eax, 000000FF
:0042098F 8945F8                  mov dword ptr [ebp-08], eax
:00420992 837DF813                cmp dword ptr [ebp-08], 00000013
:00420996 0F87EB000000            ja 00420A87
:0042099C 8B55F8                  mov edx, dword ptr [ebp-08]
:0042099F 33C9                    xor ecx, ecx
:004209A1 8A8AA20A4200            mov cl, byte ptr [edx+00420AA2]
:004209A7 FF248D8E0A4200          jmp dword ptr [4*ecx+00420A8E]
:004209AE 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004209B1 81E1FF000000            and ecx, 000000FF
:004209B7 6BC924                  imul ecx, 00000024
:004209BA 81C1502C4B00            add ecx, 004B2C50
:004209C0 E89B29FEFF              call 00403360
:004209C5 50                      push eax
:004209C6 E8C64F0100              call 00435991
:004209CB 83C404                  add esp, 00000004
:004209CE 50                      push eax
:004209CF E8E2000000              call 00420AB6
:004209D4 83C404                  add esp, 00000004
:004209D7 85C0                    test eax, eax
:004209D9 7507                    jne 004209E2
:004209DB C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004209D9(C)
|
:004209E2 E9A0000000              jmp 00420A87
:004209E7 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004209EA 81E1FF000000            and ecx, 000000FF
:004209F0 6BC924                  imul ecx, 00000024
:004209F3 81C1502C4B00            add ecx, 004B2C50
:004209F9 E86229FEFF              call 00403360
:004209FE 50                      push eax
:004209FF E88D4F0100              call 00435991
:00420A04 83C404                  add esp, 00000004
:00420A07 50                      push eax
:00420A08 E80A010000              call 00420B17
:00420A0D 83C404                  add esp, 00000004
:00420A10 85C0                    test eax, eax
:00420A12 7507                    jne 00420A1B
:00420A14 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420A12(C)
|
:00420A1B EB6A                    jmp 00420A87
:00420A1D 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00420A20 81E1FF000000            and ecx, 000000FF
:00420A26 6BC924                  imul ecx, 00000024
:00420A29 81C1502C4B00            add ecx, 004B2C50
:00420A2F E82C29FEFF              call 00403360
:00420A34 50                      push eax
:00420A35 E8574F0100              call 00435991
:00420A3A 83C404                  add esp, 00000004
:00420A3D 50                      push eax
:00420A3E E8FF000000              call 00420B42
:00420A43 83C404                  add esp, 00000004
:00420A46 85C0                    test eax, eax
:00420A48 7507                    jne 00420A51
:00420A4A C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420A48(C)
|
:00420A51 EB34                    jmp 00420A87
:00420A53 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00420A56 81E1FF000000            and ecx, 000000FF
:00420A5C 6BC924                  imul ecx, 00000024
:00420A5F 81C1502C4B00            add ecx, 004B2C50
:00420A65 E8F628FEFF              call 00403360
:00420A6A 50                      push eax
:00420A6B E8214F0100              call 00435991
:00420A70 83C404                  add esp, 00000004
:00420A73 50                      push eax
:00420A74 E81F010000              call 00420B98
:00420A79 83C404                  add esp, 00000004
:00420A7C 85C0                    test eax, eax
:00420A7E 7507                    jne 00420A87
:00420A80 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00420996(C), :004209E2(U), :00420A1B(U), :00420A51(U), :00420A7E(C)
|
:00420A87 8B45FC                  mov eax, dword ptr [ebp-04]
:00420A8A 8BE5                    mov esp, ebp
:00420A8C 5D                      pop ebp
:00420A8D C3                      ret



:00420A8E AE094200                DWORD 004209AE
:00420A92 E7094200                DWORD 004209E7
:00420A96 1D0A4200                DWORD 00420A1D
:00420A9A 530A4200                DWORD 00420A53
:00420A9E 870A4200                DWORD 00420A87


:00420AA2 0000000000              BYTE  5 DUP(0)


:00420AA7 0101                    add dword ptr [ecx], eax
:00420AA9 0101                    add dword ptr [ecx], eax
:00420AAB 0102                    add dword ptr [edx], eax
:00420AAD 0202                    add al, byte ptr [edx]
:00420AAF 0202                    add al, byte ptr [edx]
:00420AB1 0303                    add eax, dword ptr [ebx]
:00420AB3 0303                    add eax, dword ptr [ebx]
:00420AB5 03                      BYTE 03h


* Referenced by a CALL at Addresses:
|:004204C7   , :004209CF   , :00455AF3   , :0046C90E   
|
:00420AB6 55                      push ebp
:00420AB7 8BEC                    mov ebp, esp
:00420AB9 51                      push ecx
:00420ABA 8B4508                  mov eax, dword ptr [ebp+08]
:00420ABD 25FF000000              and eax, 000000FF
:00420AC2 8945FC                  mov dword ptr [ebp-04], eax
:00420AC5 837DFC18                cmp dword ptr [ebp-04], 00000018
:00420AC9 7719                    ja 00420AE4
:00420ACB 8B55FC                  mov edx, dword ptr [ebp-04]
:00420ACE 33C9                    xor ecx, ecx
:00420AD0 8A8AFE0A4200            mov cl, byte ptr [edx+00420AFE]
:00420AD6 FF248DEA0A4200          jmp dword ptr [4*ecx+00420AEA]
:00420ADD B801000000              mov eax, 00000001
:00420AE2 EB02                    jmp 00420AE6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420AC9(C)
|
:00420AE4 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420AE2(U)
|
:00420AE6 8BE5                    mov esp, ebp
:00420AE8 5D                      pop ebp
:00420AE9 C3                      ret



:00420AEA DD0A4200                DWORD 00420ADD
:00420AEE DD0A4200                DWORD 00420ADD
:00420AF2 DD0A4200                DWORD 00420ADD
:00420AF6 DD0A4200                DWORD 00420ADD
:00420AFA E40A4200                DWORD 00420AE4


:00420AFE 000000                  BYTE  3 DUP(0)


:00420B01 0404                    add al, 04
:00420B03 0404                    add al, 04
:00420B05 0401                    add al, 01
:00420B07 0404                    add al, 04
:00420B09 0404                    add al, 04
:00420B0B 0404                    add al, 04
:00420B0D 0402                    add al, 02
:00420B0F 0403                    add al, 03
:00420B11 0303                    add eax, dword ptr [ebx]
:00420B13 0303                    add eax, dword ptr [ebx]
:00420B15 0303                    add eax, dword ptr [ebx]

* Referenced by a CALL at Addresses:
|:00420515   , :00420A08   , :00455B36   , :0046C95C   
|
:00420B17 55                      push ebp
:00420B18 8BEC                    mov ebp, esp
:00420B1A 51                      push ecx
:00420B1B 8A4508                  mov al, byte ptr [ebp+08]
:00420B1E 8845FC                  mov byte ptr [ebp-04], al
:00420B21 807DFC07                cmp byte ptr [ebp-04], 07
:00420B25 7215                    jb 00420B3C
:00420B27 807DFC0A                cmp byte ptr [ebp-04], 0A
:00420B2B 7608                    jbe 00420B35
:00420B2D 807DFC0D                cmp byte ptr [ebp-04], 0D
:00420B31 7402                    je 00420B35
:00420B33 EB07                    jmp 00420B3C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00420B2B(C), :00420B31(C)
|
:00420B35 B801000000              mov eax, 00000001
:00420B3A EB02                    jmp 00420B3E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00420B25(C), :00420B33(U)
|
:00420B3C 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420B3A(U)
|
:00420B3E 8BE5                    mov esp, ebp
:00420B40 5D                      pop ebp
:00420B41 C3                      ret



* Referenced by a CALL at Addresses:
|:00420563   , :00420A3E   , :00455BBC   , :0046C9F8   
|
:00420B42 55                      push ebp
:00420B43 8BEC                    mov ebp, esp
:00420B45 51                      push ecx
:00420B46 8B4508                  mov eax, dword ptr [ebp+08]
:00420B49 25FF000000              and eax, 000000FF
:00420B4E 8945FC                  mov dword ptr [ebp-04], eax
:00420B51 837DFC0D                cmp dword ptr [ebp-04], 0000000D
:00420B55 7719                    ja 00420B70
:00420B57 8B55FC                  mov edx, dword ptr [ebp-04]
:00420B5A 33C9                    xor ecx, ecx
:00420B5C 8A8A8A0B4200            mov cl, byte ptr [edx+00420B8A]
:00420B62 FF248D760B4200          jmp dword ptr [4*ecx+00420B76]
:00420B69 B801000000              mov eax, 00000001
:00420B6E EB02                    jmp 00420B72

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420B55(C)
|
:00420B70 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420B6E(U)
|
:00420B72 8BE5                    mov esp, ebp
:00420B74 5D                      pop ebp
:00420B75 C3                      ret



:00420B76 690B4200                DWORD 00420B69
:00420B7A 690B4200                DWORD 00420B69
:00420B7E 690B4200                DWORD 00420B69
:00420B82 690B4200                DWORD 00420B69
:00420B86 700B4200                DWORD 00420B70


:00420B8A 0000                    add byte ptr [eax], al
:00420B8C 0401                    add al, 01
:00420B8E 010404                  add dword ptr [esp+eax], eax
:00420B91 0202                    add al, byte ptr [edx]
:00420B93 0202                    add al, byte ptr [edx]
:00420B95 0404                    add al, 04
:00420B97 03                      BYTE 03h


* Referenced by a CALL at Addresses:
|:004205B1   , :00420A74   , :00455B79   , :0046C9AA   
|
:00420B98 55                      push ebp
:00420B99 8BEC                    mov ebp, esp
:00420B9B 51                      push ecx
:00420B9C 8A4508                  mov al, byte ptr [ebp+08]
:00420B9F 8845FC                  mov byte ptr [ebp-04], al
:00420BA2 807DFC03                cmp byte ptr [ebp-04], 03
:00420BA6 720F                    jb 00420BB7
:00420BA8 807DFC04                cmp byte ptr [ebp-04], 04
:00420BAC 7602                    jbe 00420BB0
:00420BAE EB07                    jmp 00420BB7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420BAC(C)
|
:00420BB0 B801000000              mov eax, 00000001
:00420BB5 EB02                    jmp 00420BB9

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00420BA6(C), :00420BAE(U)
|
:00420BB7 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420BB5(U)
|
:00420BB9 8BE5                    mov esp, ebp
:00420BBB 5D                      pop ebp
:00420BBC C3                      ret



* Referenced by a CALL at Addresses:
|:0042063C   , :00420802   , :004208D3   , :00420CC0   
|
:00420BBD 55                      push ebp
:00420BBE 8BEC                    mov ebp, esp
:00420BC0 83EC0C                  sub esp, 0000000C
:00420BC3 8B450C                  mov eax, dword ptr [ebp+0C]
:00420BC6 25FF000000              and eax, 000000FF
:00420BCB 6BC024                  imul eax, 00000024
:00420BCE 05502C4B00              add eax, 004B2C50
:00420BD3 8945F8                  mov dword ptr [ebp-08], eax
:00420BD6 8B4D08                  mov ecx, dword ptr [ebp+08]
:00420BD9 81E1FF000000            and ecx, 000000FF
:00420BDF 894DF4                  mov dword ptr [ebp-0C], ecx
:00420BE2 8B55F4                  mov edx, dword ptr [ebp-0C]
:00420BE5 83EA17                  sub edx, 00000017
:00420BE8 8955F4                  mov dword ptr [ebp-0C], edx
:00420BEB 837DF421                cmp dword ptr [ebp-0C], 00000021
:00420BEF 776C                    ja 00420C5D
:00420BF1 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00420BF4 33C0                    xor eax, eax
:00420BF6 8A81900C4200            mov al, byte ptr [ecx+00420C90]
:00420BFC FF2485680C4200          jmp dword ptr [4*eax+00420C68]
:00420C03 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00420C06 E8E5D3FFFF              call 0041DFF0
:00420C0B 8845FC                  mov byte ptr [ebp-04], al
:00420C0E EB51                    jmp 00420C61
:00420C10 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00420C13 E8F8D3FFFF              call 0041E010
:00420C18 8845FC                  mov byte ptr [ebp-04], al
:00420C1B EB44                    jmp 00420C61
:00420C1D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00420C20 E8C8F30100              call 0043FFED
:00420C25 85C0                    test eax, eax
:00420C27 740D                    je 00420C36
:00420C29 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00420C2C E89FD3FFFF              call 0041DFD0
:00420C31 8845FC                  mov byte ptr [ebp-04], al
:00420C34 EB0B                    jmp 00420C41

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420C27(C)
|
:00420C36 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00420C39 E852D3FFFF              call 0041DF90
:00420C3E 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420C34(U)
|
:00420C41 EB1E                    jmp 00420C61
:00420C43 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00420C46 E865D3FFFF              call 0041DFB0
:00420C4B 8845FC                  mov byte ptr [ebp-04], al
:00420C4E EB11                    jmp 00420C61
:00420C50 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00420C53 E8D84E0000              call 00425B30
:00420C58 8845FC                  mov byte ptr [ebp-04], al
:00420C5B EB04                    jmp 00420C61

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420BEF(C)
|
:00420C5D C645FC03                mov [ebp-04], 03

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00420C0E(U), :00420C1B(U), :00420C41(U), :00420C4E(U), :00420C5B(U)
|
:00420C61 8A45FC                  mov al, byte ptr [ebp-04]
:00420C64 8BE5                    mov esp, ebp
:00420C66 5D                      pop ebp
:00420C67 C3                      ret



:00420C68 030C4200                DWORD 00420C03
:00420C6C 100C4200                DWORD 00420C10
:00420C70 1D0C4200                DWORD 00420C1D
:00420C74 430C4200                DWORD 00420C43
:00420C78 500C4200                DWORD 00420C50
:00420C7C 030C4200                DWORD 00420C03
:00420C80 100C4200                DWORD 00420C10
:00420C84 1D0C4200                DWORD 00420C1D
:00420C88 430C4200                DWORD 00420C43
:00420C8C 5D0C4200                DWORD 00420C5D


:00420C90 0000                    add byte ptr [eax], al
:00420C92 0101                    add dword ptr [ecx], eax
:00420C94 0202                    add al, byte ptr [edx]
:00420C96 0303                    add eax, dword ptr [ebx]
:00420C98 0909                    or dword ptr [ecx], ecx
:00420C9A 0909                    or dword ptr [ecx], ecx
:00420C9C 0909                    or dword ptr [ecx], ecx
:00420C9E 0909                    or dword ptr [ecx], ecx
:00420CA0 0909                    or dword ptr [ecx], ecx
:00420CA2 0909                    or dword ptr [ecx], ecx
:00420CA4 0909                    or dword ptr [ecx], ecx
:00420CA6 0909                    or dword ptr [ecx], ecx
:00420CA8 09040505060607          or dword ptr [eax+07060605], eax
:00420CAF 07                      pop es
:00420CB0 0808                    or byte ptr [eax], cl

* Referenced by a CALL at Addresses:
|:004225AC   , :004225D0   , :004225F4   , :00422618   , :0042263C   
|:00422657   , :00422672   , :0042268D   , :004226B1   , :004226D5   
|:004226F9   , :0042271D   , :00422741   , :00422765   , :00422780   
|:0042279B   , :004227B6   , :00424B34   , :00424B4F   , :00424B6A   
|:00424B85   , :00424C25   , :00424C40   , :00424C5B   , :00424C76   
|:00424C91   
|
:00420CB2 55                      push ebp
:00420CB3 8BEC                    mov ebp, esp
:00420CB5 83EC0C                  sub esp, 0000000C
:00420CB8 8A450C                  mov al, byte ptr [ebp+0C]
:00420CBB 50                      push eax
:00420CBC 8A4D08                  mov cl, byte ptr [ebp+08]
:00420CBF 51                      push ecx
:00420CC0 E8F8FEFFFF              call 00420BBD
:00420CC5 83C408                  add esp, 00000008
:00420CC8 8845FC                  mov byte ptr [ebp-04], al
:00420CCB 8B550C                  mov edx, dword ptr [ebp+0C]
:00420CCE 81E2FF000000            and edx, 000000FF
:00420CD4 6BD224                  imul edx, 00000024
:00420CD7 81C2502C4B00            add edx, 004B2C50
:00420CDD 8955F8                  mov dword ptr [ebp-08], edx
:00420CE0 8B4508                  mov eax, dword ptr [ebp+08]
:00420CE3 25FF000000              and eax, 000000FF
:00420CE8 8945F4                  mov dword ptr [ebp-0C], eax
:00420CEB 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00420CEE 83E917                  sub ecx, 00000017
:00420CF1 894DF4                  mov dword ptr [ebp-0C], ecx
:00420CF4 837DF421                cmp dword ptr [ebp-0C], 00000021
:00420CF8 0F87C8000000            ja 00420DC6
:00420CFE 8B45F4                  mov eax, dword ptr [ebp-0C]
:00420D01 33D2                    xor edx, edx
:00420D03 8A90030E4200            mov dl, byte ptr [eax+00420E03]
:00420D09 FF2495DB0D4200          jmp dword ptr [4*edx+00420DDB]
:00420D10 6A00                    push 00000000
:00420D12 6A03                    push 00000003
:00420D14 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00420D17 E872EC0100              call 0043F98E
:00420D1C E9A5000000              jmp 00420DC6
:00420D21 6A00                    push 00000000
:00420D23 6A04                    push 00000004
:00420D25 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00420D28 E861EC0100              call 0043F98E
:00420D2D E994000000              jmp 00420DC6
:00420D32 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00420D35 E8B3F20100              call 0043FFED
:00420D3A 85C0                    test eax, eax
:00420D3C 740E                    je 00420D4C
:00420D3E 6A00                    push 00000000
:00420D40 6A02                    push 00000002
:00420D42 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00420D45 E844EC0100              call 0043F98E
:00420D4A EB0C                    jmp 00420D58

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420D3C(C)
|
:00420D4C 6A00                    push 00000000
:00420D4E 6A00                    push 00000000
:00420D50 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00420D53 E836EC0100              call 0043F98E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420D4A(U)
|
:00420D58 EB6C                    jmp 00420DC6
:00420D5A 6A00                    push 00000000
:00420D5C 6A01                    push 00000001
:00420D5E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00420D61 E828EC0100              call 0043F98E
:00420D66 EB5E                    jmp 00420DC6
:00420D68 6A01                    push 00000001
:00420D6A 6A05                    push 00000005
:00420D6C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00420D6F E81AEC0100              call 0043F98E
:00420D74 EB50                    jmp 00420DC6
:00420D76 6A01                    push 00000001
:00420D78 6A03                    push 00000003
:00420D7A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00420D7D E80CEC0100              call 0043F98E
:00420D82 EB42                    jmp 00420DC6
:00420D84 6A01                    push 00000001
:00420D86 6A04                    push 00000004
:00420D88 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00420D8B E8FEEB0100              call 0043F98E
:00420D90 EB34                    jmp 00420DC6
:00420D92 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00420D95 E853F20100              call 0043FFED
:00420D9A 85C0                    test eax, eax
:00420D9C 740E                    je 00420DAC
:00420D9E 6A01                    push 00000001
:00420DA0 6A02                    push 00000002
:00420DA2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00420DA5 E8E4EB0100              call 0043F98E
:00420DAA EB0C                    jmp 00420DB8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420D9C(C)
|
:00420DAC 6A01                    push 00000001
:00420DAE 6A00                    push 00000000
:00420DB0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00420DB3 E8D6EB0100              call 0043F98E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420DAA(U)
|
:00420DB8 EB0C                    jmp 00420DC6
:00420DBA 6A01                    push 00000001
:00420DBC 6A01                    push 00000001
:00420DBE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00420DC1 E8C8EB0100              call 0043F98E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00420CF8(C), :00420D1C(U), :00420D2D(U), :00420D58(U), :00420D66(U)
|:00420D74(U), :00420D82(U), :00420D90(U), :00420DB8(U)
|
:00420DC6 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00420DC9 E8A2E80300              call 0045F670
:00420DCE 50                      push eax
:00420DCF E82D8C0500              call 00479A01
:00420DD4 83C404                  add esp, 00000004
:00420DD7 8BE5                    mov esp, ebp
:00420DD9 5D                      pop ebp
:00420DDA C3                      ret



:00420DDB 100D4200                DWORD 00420D10
:00420DDF 210D4200                DWORD 00420D21
:00420DE3 320D4200                DWORD 00420D32
:00420DE7 5A0D4200                DWORD 00420D5A
:00420DEB 680D4200                DWORD 00420D68
:00420DEF 760D4200                DWORD 00420D76
:00420DF3 840D4200                DWORD 00420D84
:00420DF7 920D4200                DWORD 00420D92
:00420DFB BA0D4200                DWORD 00420DBA
:00420DFF C60D4200                DWORD 00420DC6


:00420E03 0000                    add byte ptr [eax], al
:00420E05 0101                    add dword ptr [ecx], eax
:00420E07 0202                    add al, byte ptr [edx]
:00420E09 0303                    add eax, dword ptr [ebx]
:00420E0B 0909                    or dword ptr [ecx], ecx
:00420E0D 0909                    or dword ptr [ecx], ecx
:00420E0F 0909                    or dword ptr [ecx], ecx
:00420E11 0909                    or dword ptr [ecx], ecx
:00420E13 0909                    or dword ptr [ecx], ecx
:00420E15 0909                    or dword ptr [ecx], ecx
:00420E17 0909                    or dword ptr [ecx], ecx
:00420E19 0909                    or dword ptr [ecx], ecx
:00420E1B 09040505060607          or dword ptr [eax+07060605], eax
:00420E22 07                      pop es
:00420E23 0808                    or byte ptr [eax], cl

* Referenced by a CALL at Addresses:
|:004227DA   , :0042285D   , :004228BD   , :0042291B   , :0042297B   
|:004247F1   , :00424BA5   , :00424BC5   , :00424BE5   , :00424C05   
|
:00420E25 55                      push ebp
:00420E26 8BEC                    mov ebp, esp
:00420E28 83EC08                  sub esp, 00000008
:00420E2B 8B450C                  mov eax, dword ptr [ebp+0C]
:00420E2E 25FF000000              and eax, 000000FF
:00420E33 6BC024                  imul eax, 00000024
:00420E36 05502C4B00              add eax, 004B2C50
:00420E3B 8945FC                  mov dword ptr [ebp-04], eax
:00420E3E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00420E41 81E1FF000000            and ecx, 000000FF
:00420E47 894DF8                  mov dword ptr [ebp-08], ecx
:00420E4A 8B55F8                  mov edx, dword ptr [ebp-08]
:00420E4D 83EA1F                  sub edx, 0000001F
:00420E50 8955F8                  mov dword ptr [ebp-08], edx
:00420E53 837DF824                cmp dword ptr [ebp-08], 00000024
:00420E57 774C                    ja 00420EA5
:00420E59 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00420E5C 33C0                    xor eax, eax
:00420E5E 8A81D60E4200            mov al, byte ptr [ecx+00420ED6]
:00420E64 FF2485BA0E4200          jmp dword ptr [4*eax+00420EBA]
:00420E6B 6A10                    push 00000010
:00420E6D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00420E70 E84B58FEFF              call 004066C0
:00420E75 EB2E                    jmp 00420EA5
:00420E77 6A08                    push 00000008
:00420E79 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00420E7C E83F58FEFF              call 004066C0
:00420E81 EB22                    jmp 00420EA5
:00420E83 6A02                    push 00000002
:00420E85 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00420E88 E83358FEFF              call 004066C0
:00420E8D EB16                    jmp 00420EA5
:00420E8F 6A04                    push 00000004
:00420E91 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00420E94 E82758FEFF              call 004066C0
:00420E99 EB0A                    jmp 00420EA5
:00420E9B 6A1E                    push 0000001E
:00420E9D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00420EA0 E8FB7EFFFF              call 00418DA0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00420E57(C), :00420E75(U), :00420E81(U), :00420E8D(U), :00420E99(U)
|
:00420EA5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00420EA8 E8C3E70300              call 0045F670
:00420EAD 50                      push eax
:00420EAE E84E8B0500              call 00479A01
:00420EB3 83C404                  add esp, 00000004
:00420EB6 8BE5                    mov esp, ebp
:00420EB8 5D                      pop ebp
:00420EB9 C3                      ret



:00420EBA 770E4200                DWORD 00420E77
:00420EBE 6B0E4200                DWORD 00420E6B
:00420EC2 830E4200                DWORD 00420E83
:00420EC6 8F0E4200                DWORD 00420E8F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420EBA(C)
|
:00420ECA 9B0E4200                DWORD 00420E9B
:00420ECE 9B0E4200                DWORD 00420E9B
:00420ED2 A50E4200                DWORD 00420EA5


:00420ED6 0000                    add byte ptr [eax], al
:00420ED8 0101                    add dword ptr [ecx], eax
:00420EDA 0202                    add al, byte ptr [edx]
:00420EDC 0306                    add eax, dword ptr [esi]
:00420EDE 06                      push es
:00420EDF 06                      push es
:00420EE0 06                      push es
:00420EE1 06                      push es
:00420EE2 06                      push es
:00420EE3 06                      push es
:00420EE4 06                      push es
:00420EE5 0404                    add al, 04
:00420EE7 06                      push es
:00420EE8 06                      push es
:00420EE9 06                      push es
:00420EEA 06                      push es
:00420EEB 06                      push es
:00420EEC 06                      push es
:00420EED 06                      push es
:00420EEE 06                      push es
:00420EEF 06                      push es
:00420EF0 06                      push es
:00420EF1 06                      push es
:00420EF2 06                      push es
:00420EF3 06                      push es
:00420EF4 06                      push es
:00420EF5 06                      push es
:00420EF6 06                      push es
:00420EF7 06                      push es
:00420EF8 06                      push es
:00420EF9 06                      push es
:00420EFA 05                      BYTE 05h


* Referenced by a CALL at Addresses:
|:004232A5   , :004232BC   , :00423491   , :004234A8   , :004236D5   
|:004236EC   , :004238AA   , :004238C1   , :00423A79   , :00423A90   
|:00423C90   , :00423D3C   , :00423EA3   , :00424164   , :0042417B   
|:00424336   , :0042434B   , :0042445C   , :00424473   , :004246A4   
|:004246BB   , :004249D6   , :004249ED   , :00425139   , :0042514E   
|
:00420EFB 55                      push ebp
:00420EFC 8BEC                    mov ebp, esp
:00420EFE 83EC38                  sub esp, 00000038
:00420F01 56                      push esi
:00420F02 894DEC                  mov dword ptr [ebp-14], ecx
:00420F05 C745F400000000          mov [ebp-0C], 00000000
:00420F0C 8B45EC                  mov eax, dword ptr [ebp-14]
:00420F0F 33C9                    xor ecx, ecx
:00420F11 8A08                    mov cl, byte ptr [eax]
:00420F13 6BC946                  imul ecx, 00000046
:00420F16 81C1C0F44A00            add ecx, 004AF4C0
:00420F1C E88F4B0000              call 00425AB0
:00420F21 8845FC                  mov byte ptr [ebp-04], al
:00420F24 8B55EC                  mov edx, dword ptr [ebp-14]
:00420F27 83BAA804000000          cmp dword ptr [edx+000004A8], 00000000
:00420F2E 7508                    jne 00420F38
:00420F30 8B45F4                  mov eax, dword ptr [ebp-0C]
:00420F33 E94C030000              jmp 00421284

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420F2E(C)
|
:00420F38 8A45FC                  mov al, byte ptr [ebp-04]
:00420F3B 8845E8                  mov byte ptr [ebp-18], al
:00420F3E 807DE800                cmp byte ptr [ebp-18], 00
:00420F42 7419                    je 00420F5D
:00420F44 807DE801                cmp byte ptr [ebp-18], 01
:00420F48 0F844F020000            je 0042119D
:00420F4E 807DE802                cmp byte ptr [ebp-18], 02
:00420F52 0F8400030000            je 00421258
:00420F58 E902030000              jmp 0042125F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420F42(C)
|
:00420F5D 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00420F60 8B4904                  mov ecx, dword ptr [ecx+04]
:00420F63 E86856FEFF              call 004065D0
:00420F68 25FF000000              and eax, 000000FF
:00420F6D 8945F8                  mov dword ptr [ebp-08], eax
:00420F70 8B55EC                  mov edx, dword ptr [ebp-14]
:00420F73 33C0                    xor eax, eax
:00420F75 8A420C                  mov al, byte ptr [edx+0C]
:00420F78 8BC8                    mov ecx, eax
:00420F7A 6BC924                  imul ecx, 00000024
:00420F7D 81C1502C4B00            add ecx, 004B2C50
:00420F83 E8E8E60300              call 0045F670
:00420F88 8BC8                    mov ecx, eax
:00420F8A 6BC948                  imul ecx, 00000048
:00420F8D 81C1681B4A00            add ecx, 004A1B68
:00420F93 E83856FEFF              call 004065D0
:00420F98 25FF000000              and eax, 000000FF
:00420F9D 8945F0                  mov dword ptr [ebp-10], eax
:00420FA0 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00420FA3 8A11                    mov dl, byte ptr [ecx]
:00420FA5 52                      push edx
:00420FA6 E8018C0200              call 00449BAC
:00420FAB 83C404                  add esp, 00000004
:00420FAE 85C0                    test eax, eax
:00420FB0 0F846A010000            je 00421120
:00420FB6 8B45EC                  mov eax, dword ptr [ebp-14]
:00420FB9 33C9                    xor ecx, ecx
:00420FBB 8A08                    mov cl, byte ptr [eax]
:00420FBD 83F916                  cmp ecx, 00000016
:00420FC0 0F845A010000            je 00421120
:00420FC6 8B7508                  mov esi, dword ptr [ebp+08]
:00420FC9 81E6FF000000            and esi, 000000FF
:00420FCF 8B55EC                  mov edx, dword ptr [ebp-14]
:00420FD2 33C0                    xor eax, eax
:00420FD4 8A420C                  mov al, byte ptr [edx+0C]
:00420FD7 8BC8                    mov ecx, eax
:00420FD9 6BC924                  imul ecx, 00000024
:00420FDC 81C1502C4B00            add ecx, 004B2C50
:00420FE2 E8A91C0500              call 00472C90
:00420FE7 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00420FEA 3984B184000000          cmp dword ptr [ecx+4*esi+00000084], eax
:00420FF1 0F82AF000000            jb 004210A6
:00420FF7 8B55F8                  mov edx, dword ptr [ebp-08]
:00420FFA 3B55F0                  cmp edx, dword ptr [ebp-10]
:00420FFD 7336                    jnb 00421035
:00420FFF 8B45F0                  mov eax, dword ptr [ebp-10]
:00421002 2B45F8                  sub eax, dword ptr [ebp-08]
:00421005 8D0CC520000000          lea ecx, dword ptr [8*eax+00000020]
:0042100C 81F9C8000000            cmp ecx, 000000C8
:00421012 7609                    jbe 0042101D

* Possible Reference to Dialog: DialogID_00C8 
                                  |
:00421014 C745E4C8000000          mov [ebp-1C], 000000C8
:0042101B EB10                    jmp 0042102D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421012(C)
|
:0042101D 8B55F0                  mov edx, dword ptr [ebp-10]
:00421020 2B55F8                  sub edx, dword ptr [ebp-08]
:00421023 8D04D520000000          lea eax, dword ptr [8*edx+00000020]
:0042102A 8945E4                  mov dword ptr [ebp-1C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042101B(U)
|
:0042102D 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00421030 894DF4                  mov dword ptr [ebp-0C], ecx
:00421033 EB3F                    jmp 00421074

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420FFD(C)
|
:00421035 8B55F8                  mov edx, dword ptr [ebp-08]
:00421038 2B55F0                  sub edx, dword ptr [ebp-10]
:0042103B C1E202                  shl edx, 02
:0042103E 52                      push edx
:0042103F 6A20                    push 00000020
:00421041 E858EA0500              call 0047FA9E
:00421046 83C408                  add esp, 00000008
:00421049 83F80A                  cmp eax, 0000000A
:0042104C 7309                    jnb 00421057
:0042104E C745E00A000000          mov [ebp-20], 0000000A
:00421055 EB17                    jmp 0042106E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042104C(C)
|
:00421057 8B45F8                  mov eax, dword ptr [ebp-08]
:0042105A 2B45F0                  sub eax, dword ptr [ebp-10]
:0042105D C1E002                  shl eax, 02
:00421060 50                      push eax
:00421061 6A20                    push 00000020
:00421063 E836EA0500              call 0047FA9E
:00421068 83C408                  add esp, 00000008
:0042106B 8945E0                  mov dword ptr [ebp-20], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421055(U)
|
:0042106E 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00421071 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421033(U)
|
:00421074 8B55EC                  mov edx, dword ptr [ebp-14]
:00421077 33C0                    xor eax, eax
:00421079 8A420C                  mov al, byte ptr [edx+0C]
:0042107C 8BC8                    mov ecx, eax
:0042107E 6BC924                  imul ecx, 00000024
:00421081 81C1502C4B00            add ecx, 004B2C50
:00421087 E8E4E50300              call 0045F670
:0042108C 8BF0                    mov esi, eax
:0042108E B9902F4900              mov ecx, 00492F90
:00421093 E89855FEFF              call 00406630
:00421098 3BF0                    cmp esi, eax
:0042109A 7508                    jne 004210A4
:0042109C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042109F D1E1                    shl ecx, 1
:004210A1 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042109A(C)
|
:004210A4 EB78                    jmp 0042111E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420FF1(C)
|
:004210A6 8B55F8                  mov edx, dword ptr [ebp-08]
:004210A9 3B55F0                  cmp edx, dword ptr [ebp-10]
:004210AC 7333                    jnb 004210E1
:004210AE 8B45F0                  mov eax, dword ptr [ebp-10]
:004210B1 2B45F8                  sub eax, dword ptr [ebp-08]
:004210B4 8D0C850A000000          lea ecx, dword ptr [4*eax+0000000A]
:004210BB 83F964                  cmp ecx, 00000064
:004210BE 7609                    jbe 004210C9
:004210C0 C745DC64000000          mov [ebp-24], 00000064
:004210C7 EB10                    jmp 004210D9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004210BE(C)
|
:004210C9 8B55F0                  mov edx, dword ptr [ebp-10]
:004210CC 2B55F8                  sub edx, dword ptr [ebp-08]
:004210CF 8D04950A000000          lea eax, dword ptr [4*edx+0000000A]
:004210D6 8945DC                  mov dword ptr [ebp-24], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004210C7(U)
|
:004210D9 8B4DDC                  mov ecx, dword ptr [ebp-24]
:004210DC 894DF4                  mov dword ptr [ebp-0C], ecx
:004210DF EB3D                    jmp 0042111E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004210AC(C)
|
:004210E1 8B55F8                  mov edx, dword ptr [ebp-08]
:004210E4 2B55F0                  sub edx, dword ptr [ebp-10]
:004210E7 D1EA                    shr edx, 1
:004210E9 52                      push edx
:004210EA 6A0A                    push 0000000A
:004210EC E8ADE90500              call 0047FA9E
:004210F1 83C408                  add esp, 00000008
:004210F4 83F805                  cmp eax, 00000005
:004210F7 7309                    jnb 00421102
:004210F9 C745D805000000          mov [ebp-28], 00000005
:00421100 EB16                    jmp 00421118

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004210F7(C)
|
:00421102 8B45F8                  mov eax, dword ptr [ebp-08]
:00421105 2B45F0                  sub eax, dword ptr [ebp-10]
:00421108 D1E8                    shr eax, 1
:0042110A 50                      push eax
:0042110B 6A0A                    push 0000000A
:0042110D E88CE90500              call 0047FA9E
:00421112 83C408                  add esp, 00000008
:00421115 8945D8                  mov dword ptr [ebp-28], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421100(U)
|
:00421118 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0042111B 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004210A4(U), :004210DF(U)
|
:0042111E EB78                    jmp 00421198

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00420FB0(C), :00420FC0(C)
|
:00421120 8B55F8                  mov edx, dword ptr [ebp-08]
:00421123 3B55F0                  cmp edx, dword ptr [ebp-10]
:00421126 7333                    jnb 0042115B
:00421128 8B45F0                  mov eax, dword ptr [ebp-10]
:0042112B 2B45F8                  sub eax, dword ptr [ebp-08]
:0042112E 8D0C850A000000          lea ecx, dword ptr [4*eax+0000000A]
:00421135 83F964                  cmp ecx, 00000064
:00421138 7609                    jbe 00421143
:0042113A C745D464000000          mov [ebp-2C], 00000064
:00421141 EB10                    jmp 00421153

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421138(C)
|
:00421143 8B55F0                  mov edx, dword ptr [ebp-10]
:00421146 2B55F8                  sub edx, dword ptr [ebp-08]
:00421149 8D04950A000000          lea eax, dword ptr [4*edx+0000000A]
:00421150 8945D4                  mov dword ptr [ebp-2C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421141(U)
|
:00421153 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00421156 894DF4                  mov dword ptr [ebp-0C], ecx
:00421159 EB3D                    jmp 00421198

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421126(C)
|
:0042115B 8B55F8                  mov edx, dword ptr [ebp-08]
:0042115E 2B55F0                  sub edx, dword ptr [ebp-10]
:00421161 D1EA                    shr edx, 1
:00421163 52                      push edx
:00421164 6A0A                    push 0000000A
:00421166 E833E90500              call 0047FA9E
:0042116B 83C408                  add esp, 00000008
:0042116E 83F805                  cmp eax, 00000005
:00421171 7309                    jnb 0042117C
:00421173 C745D005000000          mov [ebp-30], 00000005
:0042117A EB16                    jmp 00421192

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421171(C)
|
:0042117C 8B45F8                  mov eax, dword ptr [ebp-08]
:0042117F 2B45F0                  sub eax, dword ptr [ebp-10]
:00421182 D1E8                    shr eax, 1
:00421184 50                      push eax
:00421185 6A0A                    push 0000000A
:00421187 E812E90500              call 0047FA9E
:0042118C 83C408                  add esp, 00000008
:0042118F 8945D0                  mov dword ptr [ebp-30], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042117A(U)
|
:00421192 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00421195 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042111E(U), :00421159(U)
|
:00421198 E9C2000000              jmp 0042125F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420F48(C)
|
:0042119D 8B55EC                  mov edx, dword ptr [ebp-14]
:004211A0 8B4A04                  mov ecx, dword ptr [edx+04]
:004211A3 E82854FEFF              call 004065D0
:004211A8 25FF000000              and eax, 000000FF
:004211AD 8945F8                  mov dword ptr [ebp-08], eax
:004211B0 8B45EC                  mov eax, dword ptr [ebp-14]
:004211B3 33C9                    xor ecx, ecx
:004211B5 8A480C                  mov cl, byte ptr [eax+0C]
:004211B8 6BC924                  imul ecx, 00000024
:004211BB 81C1502C4B00            add ecx, 004B2C50
:004211C1 E8AAE40300              call 0045F670
:004211C6 8BC8                    mov ecx, eax
:004211C8 6BC948                  imul ecx, 00000048
:004211CB 81C1681B4A00            add ecx, 004A1B68
:004211D1 E8FA53FEFF              call 004065D0
:004211D6 25FF000000              and eax, 000000FF
:004211DB 8945F0                  mov dword ptr [ebp-10], eax
:004211DE 8B55F8                  mov edx, dword ptr [ebp-08]
:004211E1 3B55F0                  cmp edx, dword ptr [ebp-10]
:004211E4 7333                    jnb 00421219
:004211E6 8B45F0                  mov eax, dword ptr [ebp-10]
:004211E9 2B45F8                  sub eax, dword ptr [ebp-08]
:004211EC 8D0C850A000000          lea ecx, dword ptr [4*eax+0000000A]
:004211F3 83F964                  cmp ecx, 00000064
:004211F6 7609                    jbe 00421201
:004211F8 C745CC64000000          mov [ebp-34], 00000064
:004211FF EB10                    jmp 00421211

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004211F6(C)
|
:00421201 8B55F0                  mov edx, dword ptr [ebp-10]
:00421204 2B55F8                  sub edx, dword ptr [ebp-08]
:00421207 8D04950A000000          lea eax, dword ptr [4*edx+0000000A]
:0042120E 8945CC                  mov dword ptr [ebp-34], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004211FF(U)
|
:00421211 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00421214 894DF4                  mov dword ptr [ebp-0C], ecx
:00421217 EB3D                    jmp 00421256

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004211E4(C)
|
:00421219 8B55F8                  mov edx, dword ptr [ebp-08]
:0042121C 2B55F0                  sub edx, dword ptr [ebp-10]
:0042121F D1EA                    shr edx, 1
:00421221 52                      push edx
:00421222 6A0A                    push 0000000A
:00421224 E875E80500              call 0047FA9E
:00421229 83C408                  add esp, 00000008
:0042122C 83F805                  cmp eax, 00000005
:0042122F 7309                    jnb 0042123A
:00421231 C745C805000000          mov [ebp-38], 00000005
:00421238 EB16                    jmp 00421250

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042122F(C)
|
:0042123A 8B45F8                  mov eax, dword ptr [ebp-08]
:0042123D 2B45F0                  sub eax, dword ptr [ebp-10]
:00421240 D1E8                    shr eax, 1
:00421242 50                      push eax
:00421243 6A0A                    push 0000000A
:00421245 E854E80500              call 0047FA9E
:0042124A 83C408                  add esp, 00000008
:0042124D 8945C8                  mov dword ptr [ebp-38], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421238(U)
|
:00421250 8B4DC8                  mov ecx, dword ptr [ebp-38]
:00421253 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421217(U)
|
:00421256 EB07                    jmp 0042125F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420F52(C)
|
:00421258 C745F414000000          mov [ebp-0C], 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00420F58(U), :00421198(U), :00421256(U)
|
:0042125F 8B55EC                  mov edx, dword ptr [ebp-14]
:00421262 8B4A04                  mov ecx, dword ptr [edx+04]
:00421265 E85360FEFF              call 004072BD
:0042126A 25FF000000              and eax, 000000FF
:0042126F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00421272 0FAFC1                  imul eax, ecx
:00421275 33D2                    xor edx, edx
:00421277 B90A000000              mov ecx, 0000000A
:0042127C F7F1                    div ecx
:0042127E 8945F4                  mov dword ptr [ebp-0C], eax
:00421281 8B45F4                  mov eax, dword ptr [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00420F33(U)
|
:00421284 5E                      pop esi
:00421285 8BE5                    mov esp, ebp
:00421287 5D                      pop ebp
:00421288 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:004232E1   , :004232F4   , :004234CD   , :004234E0   , :00423711   
|:00423724   , :004238E6   , :004238F9   , :00423AB5   , :00423AC8   
|:00423CA1   , :00423D4D   , :00423EB4   , :004241A0   , :004241B3   
|:00424498   , :004244AB   , :004246E0   , :004246F3   , :00424A12   
|:00424A25   , :00425173   , :00425186   
|
:0042128B 55                      push ebp
:0042128C 8BEC                    mov ebp, esp
:0042128E 83EC18                  sub esp, 00000018
:00421291 894DEC                  mov dword ptr [ebp-14], ecx
:00421294 C745F400000000          mov [ebp-0C], 00000000
:0042129B 8B45EC                  mov eax, dword ptr [ebp-14]
:0042129E 33C9                    xor ecx, ecx
:004212A0 8A08                    mov cl, byte ptr [eax]
:004212A2 6BC946                  imul ecx, 00000046
:004212A5 81C1C0F44A00            add ecx, 004AF4C0
:004212AB E800480000              call 00425AB0
:004212B0 8845FC                  mov byte ptr [ebp-04], al
:004212B3 8B55EC                  mov edx, dword ptr [ebp-14]
:004212B6 83BAA804000000          cmp dword ptr [edx+000004A8], 00000000
:004212BD 7508                    jne 004212C7
:004212BF 8B45F4                  mov eax, dword ptr [ebp-0C]
:004212C2 E9D8000000              jmp 0042139F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004212BD(C)
|
:004212C7 6A00                    push 00000000
:004212C9 8B45EC                  mov eax, dword ptr [ebp-14]
:004212CC 8B4804                  mov ecx, dword ptr [eax+04]
:004212CF E81C53FEFF              call 004065F0
:004212D4 25FF000000              and eax, 000000FF
:004212D9 50                      push eax
:004212DA E83B55FEFF              call 0040681A
:004212DF 83C404                  add esp, 00000004
:004212E2 25FF000000              and eax, 000000FF
:004212E7 83F802                  cmp eax, 00000002
:004212EA 7408                    je 004212F4
:004212EC 8B45F4                  mov eax, dword ptr [ebp-0C]
:004212EF E9AB000000              jmp 0042139F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004212EA(C)
|
:004212F4 8A4DFC                  mov cl, byte ptr [ebp-04]
:004212F7 884DE8                  mov byte ptr [ebp-18], cl
:004212FA 807DE800                cmp byte ptr [ebp-18], 00
:004212FE 727A                    jb 0042137A
:00421300 807DE801                cmp byte ptr [ebp-18], 01
:00421304 7608                    jbe 0042130E
:00421306 807DE802                cmp byte ptr [ebp-18], 02
:0042130A 7467                    je 00421373
:0042130C EB6C                    jmp 0042137A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421304(C)
|
:0042130E 8B55EC                  mov edx, dword ptr [ebp-14]
:00421311 8B4A04                  mov ecx, dword ptr [edx+04]
:00421314 E8B752FEFF              call 004065D0
:00421319 25FF000000              and eax, 000000FF
:0042131E 8945F8                  mov dword ptr [ebp-08], eax
:00421321 8B45EC                  mov eax, dword ptr [ebp-14]
:00421324 33C9                    xor ecx, ecx
:00421326 8A480C                  mov cl, byte ptr [eax+0C]
:00421329 6BC924                  imul ecx, 00000024
:0042132C 81C1502C4B00            add ecx, 004B2C50
:00421332 E839E30300              call 0045F670
:00421337 8BC8                    mov ecx, eax
:00421339 6BC948                  imul ecx, 00000048
:0042133C 81C1681B4A00            add ecx, 004A1B68
:00421342 E88952FEFF              call 004065D0
:00421347 25FF000000              and eax, 000000FF
:0042134C 8945F0                  mov dword ptr [ebp-10], eax
:0042134F C745F403000000          mov [ebp-0C], 00000003
:00421356 8B55F8                  mov edx, dword ptr [ebp-08]
:00421359 3B55F0                  cmp edx, dword ptr [ebp-10]
:0042135C 7302                    jnb 00421360
:0042135E EB11                    jmp 00421371

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042135C(C)
|
:00421360 8B45F8                  mov eax, dword ptr [ebp-08]
:00421363 3B45F0                  cmp eax, dword ptr [ebp-10]
:00421366 7609                    jbe 00421371
:00421368 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042136B 83E901                  sub ecx, 00000001
:0042136E 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042135E(U), :00421366(C)
|
:00421371 EB07                    jmp 0042137A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042130A(C)
|
:00421373 C745F403000000          mov [ebp-0C], 00000003

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004212FE(C), :0042130C(U), :00421371(U)
|
:0042137A 8B55EC                  mov edx, dword ptr [ebp-14]
:0042137D 8B4A04                  mov ecx, dword ptr [edx+04]
:00421380 E8385FFEFF              call 004072BD
:00421385 25FF000000              and eax, 000000FF
:0042138A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042138D 0FAFC1                  imul eax, ecx
:00421390 33D2                    xor edx, edx
:00421392 B90A000000              mov ecx, 0000000A
:00421397 F7F1                    div ecx
:00421399 8945F4                  mov dword ptr [ebp-0C], eax
:0042139C 8B45F4                  mov eax, dword ptr [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004212C2(U), :004212EF(U)
|
:0042139F 8BE5                    mov esp, ebp
:004213A1 5D                      pop ebp
:004213A2 C3                      ret



* Referenced by a CALL at Addresses:
|:0042331D   , :00423509   , :0042374D   , :00423922   , :00423AF1   
|:004241DC   , :004244D4   , :0042471C   , :00424A4E   , :004251AD   
|
:004213A3 55                      push ebp
:004213A4 8BEC                    mov ebp, esp
:004213A6 83EC14                  sub esp, 00000014
:004213A9 894DEC                  mov dword ptr [ebp-14], ecx
:004213AC C745F400000000          mov [ebp-0C], 00000000
:004213B3 8B45EC                  mov eax, dword ptr [ebp-14]
:004213B6 8B4804                  mov ecx, dword ptr [eax+04]
:004213B9 E81252FEFF              call 004065D0
:004213BE 25FF000000              and eax, 000000FF
:004213C3 8945F8                  mov dword ptr [ebp-08], eax
:004213C6 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004213C9 33D2                    xor edx, edx
:004213CB 8A510C                  mov dl, byte ptr [ecx+0C]
:004213CE 8BCA                    mov ecx, edx
:004213D0 6BC924                  imul ecx, 00000024
:004213D3 81C1502C4B00            add ecx, 004B2C50
:004213D9 E892E20300              call 0045F670
:004213DE 8BC8                    mov ecx, eax
:004213E0 6BC948                  imul ecx, 00000048
:004213E3 81C1681B4A00            add ecx, 004A1B68
:004213E9 E8E251FEFF              call 004065D0
:004213EE 25FF000000              and eax, 000000FF
:004213F3 8945F0                  mov dword ptr [ebp-10], eax
:004213F6 8B45EC                  mov eax, dword ptr [ebp-14]
:004213F9 33C9                    xor ecx, ecx
:004213FB 8A08                    mov cl, byte ptr [eax]
:004213FD 6BC946                  imul ecx, 00000046
:00421400 81C1C0F44A00            add ecx, 004AF4C0
:00421406 E8A5460000              call 00425AB0
:0042140B 8845FC                  mov byte ptr [ebp-04], al
:0042140E 8B55EC                  mov edx, dword ptr [ebp-14]
:00421411 33C0                    xor eax, eax
:00421413 8A420C                  mov al, byte ptr [edx+0C]
:00421416 8BC8                    mov ecx, eax
:00421418 6BC924                  imul ecx, 00000024
:0042141B 81C1502C4B00            add ecx, 004B2C50
:00421421 E82EEB0100              call 0043FF54
:00421426 85C0                    test eax, eax
:00421428 7508                    jne 00421432
:0042142A 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042142D E987000000              jmp 004214B9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421428(C)
|
:00421432 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00421435 81E1FF000000            and ecx, 000000FF
:0042143B 85C9                    test ecx, ecx
:0042143D 7538                    jne 00421477
:0042143F 8B5508                  mov edx, dword ptr [ebp+08]
:00421442 81E2FF000000            and edx, 000000FF
:00421448 8B45EC                  mov eax, dword ptr [ebp-14]
:0042144B 83BC908400000000        cmp dword ptr [eax+4*edx+00000084], 00000000
:00421453 7422                    je 00421477
:00421455 C745F404000000          mov [ebp-0C], 00000004
:0042145C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0042145F 3B4DF8                  cmp ecx, dword ptr [ebp-08]
:00421462 7302                    jnb 00421466
:00421464 EB11                    jmp 00421477

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421462(C)
|
:00421466 8B55F0                  mov edx, dword ptr [ebp-10]
:00421469 3B55F8                  cmp edx, dword ptr [ebp-08]
:0042146C 7609                    jbe 00421477
:0042146E 8B45F4                  mov eax, dword ptr [ebp-0C]
:00421471 83E801                  sub eax, 00000001
:00421474 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042143D(C), :00421453(C), :00421464(U), :0042146C(C)
|
:00421477 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0042147A 33D2                    xor edx, edx
:0042147C 8A510C                  mov dl, byte ptr [ecx+0C]
:0042147F 8BCA                    mov ecx, edx
:00421481 6BC924                  imul ecx, 00000024
:00421484 81C1502C4B00            add ecx, 004B2C50
:0042148A E8E1E10300              call 0045F670
:0042148F 8BC8                    mov ecx, eax
:00421491 6BC948                  imul ecx, 00000048
:00421494 81C1681B4A00            add ecx, 004A1B68
:0042149A E81E5EFEFF              call 004072BD
:0042149F 25FF000000              and eax, 000000FF
:004214A4 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004214A7 0FAFC1                  imul eax, ecx
:004214AA 33D2                    xor edx, edx
:004214AC B90A000000              mov ecx, 0000000A
:004214B1 F7F1                    div ecx
:004214B3 8945F4                  mov dword ptr [ebp-0C], eax
:004214B6 8B45F4                  mov eax, dword ptr [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042142D(U)
|
:004214B9 8BE5                    mov esp, ebp
:004214BB 5D                      pop ebp
:004214BC C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0042333D   , :00423529   , :0042376D   , :00423942   , :00423B11   
|:00423BD1   , :00423D2A   , :00423E99   , :004241FC   , :004244F4   
|:0042473C   , :00424A6E   , :004251BE   
|
:004214BF 55                      push ebp
:004214C0 8BEC                    mov ebp, esp
:004214C2 83EC28                  sub esp, 00000028
:004214C5 894DE0                  mov dword ptr [ebp-20], ecx
:004214C8 8B45E0                  mov eax, dword ptr [ebp-20]
:004214CB 33C9                    xor ecx, ecx
:004214CD 8A08                    mov cl, byte ptr [eax]
:004214CF 8A91C0664800            mov dl, byte ptr [ecx+004866C0]
:004214D5 8855EC                  mov byte ptr [ebp-14], dl
:004214D8 8B45E0                  mov eax, dword ptr [ebp-20]
:004214DB 33C9                    xor ecx, ecx
:004214DD 8A08                    mov cl, byte ptr [eax]
:004214DF 83F940                  cmp ecx, 00000040
:004214E2 7408                    je 004214EC
:004214E4 8B4DE0                  mov ecx, dword ptr [ebp-20]
:004214E7 E8EA030000              call 004218D6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004214E2(C)
|
:004214EC 8B55E0                  mov edx, dword ptr [ebp-20]
:004214EF 33C0                    xor eax, eax
:004214F1 8A420D                  mov al, byte ptr [edx+0D]
:004214F4 8BC8                    mov ecx, eax
:004214F6 6BC924                  imul ecx, 00000024
:004214F9 81C1502C4B00            add ecx, 004B2C50
:004214FF E85C1EFEFF              call 00403360
:00421504 50                      push eax
:00421505 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00421508 81C1CB020000            add ecx, 000002CB
:0042150E E88D50FEFF              call 004065A0
:00421513 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00421516 83B9B004000000          cmp dword ptr [ecx+000004B0], 00000000
:0042151D 0F84C4000000            je 004215E7
:00421523 8B55E0                  mov edx, dword ptr [ebp-20]
:00421526 33C0                    xor eax, eax
:00421528 8A02                    mov al, byte ptr [edx]
:0042152A 83F842                  cmp eax, 00000042
:0042152D 740C                    je 0042153B
:0042152F 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00421532 33D2                    xor edx, edx
:00421534 8A11                    mov dl, byte ptr [ecx]
:00421536 83FA43                  cmp edx, 00000043
:00421539 7529                    jne 00421564

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042152D(C)
|
:0042153B B950424B00              mov ecx, 004B4250
:00421540 E8FF480300              call 00455E44
:00421545 99                      cdq
:00421546 2BC2                    sub eax, edx
:00421548 D1F8                    sar eax, 1
:0042154A 8945F4                  mov dword ptr [ebp-0C], eax
:0042154D B950424B00              mov ecx, 004B4250
:00421552 E814490300              call 00455E6B
:00421557 99                      cdq
:00421558 2BC2                    sub eax, edx
:0042155A D1F8                    sar eax, 1
:0042155C 83C038                  add eax, 00000038
:0042155F 8945F8                  mov dword ptr [ebp-08], eax
:00421562 EB66                    jmp 004215CA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421539(C)
|
:00421564 8B45E0                  mov eax, dword ptr [ebp-20]
:00421567 8A88CC020000            mov cl, byte ptr [eax+000002CC]
:0042156D 51                      push ecx
:0042156E 8B55E0                  mov edx, dword ptr [ebp-20]
:00421571 8A82CB020000            mov al, byte ptr [edx+000002CB]
:00421577 50                      push eax
:00421578 B950424B00              mov ecx, 004B4250
:0042157D E8BD3A0300              call 0045503F
:00421582 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00421585 33D2                    xor edx, edx
:00421587 8A510D                  mov dl, byte ptr [ecx+0D]
:0042158A 8BCA                    mov ecx, edx
:0042158C 6BC924                  imul ecx, 00000024
:0042158F 81C1502C4B00            add ecx, 004B2C50
:00421595 E8C61DFEFF              call 00403360
:0042159A 668B00                  mov ax, word ptr [eax]
:0042159D 50                      push eax
:0042159E E8DBE40200              call 0044FA7E
:004215A3 83C404                  add esp, 00000004
:004215A6 8945E4                  mov dword ptr [ebp-1C], eax
:004215A9 8955E8                  mov dword ptr [ebp-18], edx
:004215AC 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004215AF 894DF4                  mov dword ptr [ebp-0C], ecx
:004215B2 8B55E8                  mov edx, dword ptr [ebp-18]
:004215B5 8955F8                  mov dword ptr [ebp-08], edx
:004215B8 8B45F4                  mov eax, dword ptr [ebp-0C]
:004215BB 83C018                  add eax, 00000018
:004215BE 8945F4                  mov dword ptr [ebp-0C], eax
:004215C1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004215C4 83C118                  add ecx, 00000018
:004215C7 894DF8                  mov dword ptr [ebp-08], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421562(U)
|
:004215CA 8B55F8                  mov edx, dword ptr [ebp-08]
:004215CD 52                      push edx
:004215CE 8B45F4                  mov eax, dword ptr [ebp-0C]
:004215D1 50                      push eax
:004215D2 8B4DE0                  mov ecx, dword ptr [ebp-20]
:004215D5 E89F020000              call 00421879
:004215DA 8B4DE0                  mov ecx, dword ptr [ebp-20]
:004215DD C781B004000000000000    mov dword ptr [ebx+000004B0], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042151D(C)
|
:004215E7 8B55EC                  mov edx, dword ptr [ebp-14]
:004215EA 81E2FF000000            and edx, 000000FF
:004215F0 83FA63                  cmp edx, 00000063
:004215F3 7E76                    jle 0042166B
:004215F5 8B45EC                  mov eax, dword ptr [ebp-14]
:004215F8 25FF000000              and eax, 000000FF
:004215FD 3DFF000000              cmp eax, 000000FF
:00421602 7467                    je 0042166B
:00421604 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00421607 33D2                    xor edx, edx
:00421609 8A11                    mov dl, byte ptr [ecx]
:0042160B 8955DC                  mov dword ptr [ebp-24], edx
:0042160E 8B45DC                  mov eax, dword ptr [ebp-24]
:00421611 83E803                  sub eax, 00000003
:00421614 8945DC                  mov dword ptr [ebp-24], eax
:00421617 837DDC40                cmp dword ptr [ebp-24], 00000040
:0042161B 774E                    ja 0042166B
:0042161D 8B55DC                  mov edx, dword ptr [ebp-24]
:00421620 33C9                    xor ecx, ecx
:00421622 8A8ABE174200            mov cl, byte ptr [edx+004217BE]
:00421628 FF248D96174200          jmp dword ptr [4*ecx+00421796]
:0042162F C645EC01                mov [ebp-14], 01
:00421633 EB36                    jmp 0042166B
:00421635 C645EC03                mov [ebp-14], 03
:00421639 EB30                    jmp 0042166B
:0042163B C645EC05                mov [ebp-14], 05
:0042163F EB2A                    jmp 0042166B
:00421641 C645EC07                mov [ebp-14], 07
:00421645 EB24                    jmp 0042166B
:00421647 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0042164A E896060000              call 00421CE5
:0042164F C645ECFF                mov [ebp-14], FF
:00421653 EB16                    jmp 0042166B
:00421655 C645EC16                mov [ebp-14], 16
:00421659 EB10                    jmp 0042166B
:0042165B C645EC39                mov [ebp-14], 39
:0042165F EB0A                    jmp 0042166B
:00421661 C645ECFF                mov [ebp-14], FF
:00421665 EB04                    jmp 0042166B
:00421667 C645EC0A                mov [ebp-14], 0A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004215F3(C), :00421602(C), :0042161B(C), :00421633(U), :00421639(U)
|:0042163F(U), :00421645(U), :00421653(U), :00421659(U), :0042165F(U)
|:00421665(U)
|
:0042166B 8B45EC                  mov eax, dword ptr [ebp-14]
:0042166E 25FF000000              and eax, 000000FF
:00421673 3DFF000000              cmp eax, 000000FF
:00421678 747D                    je 004216F7
:0042167A 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0042167D 8A91CC020000            mov dl, byte ptr [ecx+000002CC]
:00421683 52                      push edx
:00421684 8B45E0                  mov eax, dword ptr [ebp-20]
:00421687 8A88CB020000            mov cl, byte ptr [eax+000002CB]
:0042168D 51                      push ecx
:0042168E B950424B00              mov ecx, 004B4250
:00421693 E8A7390300              call 0045503F
:00421698 68004C0400              push 00044C00
:0042169D 6A04                    push 00000004
:0042169F 6A00                    push 00000000
:004216A1 6A00                    push 00000000
:004216A3 B9C8E44A00              mov ecx, 004AE4C8
:004216A8 E893E30500              call 0047FA40
:004216AD 50                      push eax
:004216AE 8A55EC                  mov dl, byte ptr [ebp-14]
:004216B1 52                      push edx

* Possible StringData Ref from Data Obj ->"MEFF.E5"
                                  |
:004216B2 68F8BB4800              push 0048BBF8
:004216B7 B9B0174900              mov ecx, 004917B0
:004216BC E837FEFDFF              call 004014F8
:004216C1 8B45E0                  mov eax, dword ptr [ebp-20]
:004216C4 83C00D                  add eax, 0000000D
:004216C7 50                      push eax
:004216C8 6A74                    push 00000074
:004216CA B9B0174900              mov ecx, 004917B0
:004216CF E8B405FEFF              call 00401C88
:004216D4 25FF000000              and eax, 000000FF
:004216D9 85C0                    test eax, eax
:004216DB 7410                    je 004216ED
:004216DD 6A01                    push 00000001
:004216DF 8B4DE0                  mov ecx, dword ptr [ebp-20]
:004216E2 51                      push ecx
:004216E3 B9B0174900              mov ecx, 004917B0
:004216E8 E86F07FEFF              call 00401E5C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004216DB(C)
|
:004216ED B9B0174900              mov ecx, 004917B0
:004216F2 E8B4FFFDFF              call 004016AB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421678(C)
|
:004216F7 E8DFCEFFFF              call 0041E5DB
:004216FC C745FC05000000          mov [ebp-04], 00000005
:00421703 C645F000                mov [ebp-10], 00
:00421707 EB09                    jmp 00421712

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421763(U)
|
:00421709 8A55F0                  mov dl, byte ptr [ebp-10]
:0042170C 80C201                  add dl, 01
:0042170F 8855F0                  mov byte ptr [ebp-10], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421707(U)
|
:00421712 8B45F0                  mov eax, dword ptr [ebp-10]
:00421715 25FF000000              and eax, 000000FF
:0042171A 83F874                  cmp eax, 00000074
:0042171D 7D46                    jge 00421765
:0042171F 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00421722 81E1FF000000            and ecx, 000000FF
:00421728 8B55E0                  mov edx, dword ptr [ebp-20]
:0042172B 33C0                    xor eax, eax
:0042172D 8A440A0D                mov al, byte ptr [edx+ecx+0D]
:00421731 3DFF000000              cmp eax, 000000FF
:00421736 742D                    je 00421765
:00421738 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0042173B 81E1FF000000            and ecx, 000000FF
:00421741 8B55E0                  mov edx, dword ptr [ebp-20]
:00421744 33C0                    xor eax, eax
:00421746 8A440A0D                mov al, byte ptr [edx+ecx+0D]
:0042174A 8BC8                    mov ecx, eax
:0042174C 6BC924                  imul ecx, 00000024
:0042174F 81C1502C4B00            add ecx, 004B2C50
:00421755 E86FE50100              call 0043FCC9
:0042175A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042175D 83C105                  add ecx, 00000005
:00421760 894DFC                  mov dword ptr [ebp-04], ecx
:00421763 EBA4                    jmp 00421709

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042171D(C), :00421736(C)
|
:00421765 837DFC14                cmp dword ptr [ebp-04], 00000014
:00421769 7D08                    jge 00421773
:0042176B 8B55FC                  mov edx, dword ptr [ebp-04]
:0042176E 8955D8                  mov dword ptr [ebp-28], edx
:00421771 EB07                    jmp 0042177A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421769(C)
|
:00421773 C745D814000000          mov [ebp-28], 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421771(U)
|
:0042177A 8B45D8                  mov eax, dword ptr [ebp-28]
:0042177D 50                      push eax
:0042177E B9181B4B00              mov ecx, 004B1B18
:00421783 E8B81BFEFF              call 00403340
:00421788 E853AD0000              call 0042C4E0
:0042178D E864CEFFFF              call 0041E5F6
:00421792 8BE5                    mov esp, ebp
:00421794 5D                      pop ebp
:00421795 C3                      ret



:00421796 2F164200                DWORD 0042162F
:0042179A 35164200                DWORD 00421635
:0042179E 3B164200                DWORD 0042163B
:004217A2 41164200                DWORD 00421641
:004217A6 47164200                DWORD 00421647
:004217AA 55164200                DWORD 00421655
:004217AE 5B164200                DWORD 0042165B
:004217B2 61164200                DWORD 00421661
:004217B6 67164200                DWORD 00421667
:004217BA 6B164200                DWORD 0042166B


:004217BE 0009                    add byte ptr [ecx], cl
:004217C0 0909                    or dword ptr [ecx], ecx
:004217C2 0901                    or dword ptr [ecx], eax
:004217C4 0909                    or dword ptr [ecx], ecx
:004217C6 0909                    or dword ptr [ecx], ecx
:004217C8 0209                    add cl, byte ptr [ecx]
:004217CA 0909                    or dword ptr [ecx], ecx
:004217CC 0903                    or dword ptr [ebx], eax
:004217CE 0909                    or dword ptr [ecx], ecx
:004217D0 0909                    or dword ptr [ecx], ecx
:004217D2 0909                    or dword ptr [ecx], ecx
:004217D4 0909                    or dword ptr [ecx], ecx
:004217D6 0909                    or dword ptr [ecx], ecx
:004217D8 0909                    or dword ptr [ecx], ecx
:004217DA 0909                    or dword ptr [ecx], ecx
:004217DC 0909                    or dword ptr [ecx], ecx
:004217DE 0909                    or dword ptr [ecx], ecx
:004217E0 090409                  or dword ptr [ecx+ecx], eax
:004217E3 0909                    or dword ptr [ecx], ecx
:004217E5 0909                    or dword ptr [ecx], ecx
:004217E7 0909                    or dword ptr [ecx], ecx
:004217E9 0909                    or dword ptr [ecx], ecx
:004217EB 0909                    or dword ptr [ecx], ecx
:004217ED 0909                    or dword ptr [ecx], ecx
:004217EF 0909                    or dword ptr [ecx], ecx
:004217F1 0909                    or dword ptr [ecx], ecx
:004217F3 0909                    or dword ptr [ecx], ecx
:004217F5 0909                    or dword ptr [ecx], ecx
:004217F7 0909                    or dword ptr [ecx], ecx
:004217F9 0909                    or dword ptr [ecx], ecx
:004217FB 05                      BYTE 05h
:004217FC 06                      BYTE 06h
:004217FD 07                      BYTE 07h
:004217FE 08                      BYTE 08h


* Referenced by a CALL at Addresses:
|:004141ED   , :004218B7   , :004256BB   
|
:004217FF 55                      push ebp
:00421800 8BEC                    mov ebp, esp
:00421802 83EC10                  sub esp, 00000010
:00421805 894DF0                  mov dword ptr [ebp-10], ecx
:00421808 A18CB84800              mov eax, dword ptr [0048B88C]
:0042180D 8945F4                  mov dword ptr [ebp-0C], eax
:00421810 8B0D90B84800            mov ecx, dword ptr [0048B890]
:00421816 894DF8                  mov dword ptr [ebp-08], ecx
:00421819 668B1594B84800          mov dx, word ptr [0048B894]
:00421820 668955FC                mov word ptr [ebp-04], dx
:00421824 A096B84800              mov al, byte ptr [0048B896]
:00421829 8845FE                  mov byte ptr [ebp-02], al
:0042182C 8B4508                  mov eax, dword ptr [ebp+08]
:0042182F 25FF000000              and eax, 000000FF
:00421834 99                      cdq
:00421835 B964000000              mov ecx, 00000064
:0042183A F7F9                    idiv ecx
:0042183C 52                      push edx

* Possible StringData Ref from Data Obj ->"MCALL%02u.E5"
                                  |
:0042183D 6898B84800              push 0048B898
:00421842 8D55F4                  lea edx, dword ptr [ebp-0C]
:00421845 52                      push edx
:00421846 FF15C0624800            call dword ptr [004862C0]
:0042184C 83C40C                  add esp, 0000000C
:0042184F 68004C0400              push 00044C00
:00421854 6A04                    push 00000004
:00421856 6A00                    push 00000000
:00421858 6A00                    push 00000000
:0042185A B9C8E44A00              mov ecx, 004AE4C8
:0042185F E8DCE10500              call 0047FA40
:00421864 50                      push eax
:00421865 8D45F4                  lea eax, dword ptr [ebp-0C]
:00421868 50                      push eax
:00421869 B988274900              mov ecx, 00492788
:0042186E E80C17FEFF              call 00402F7F
:00421873 8BE5                    mov esp, ebp
:00421875 5D                      pop ebp
:00421876 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:004141D0   , :004215D5   , :004218CB   , :00425008   
|
:00421879 55                      push ebp
:0042187A 8BEC                    mov ebp, esp
:0042187C 51                      push ecx
:0042187D 894DFC                  mov dword ptr [ebp-04], ecx
:00421880 8B450C                  mov eax, dword ptr [ebp+0C]
:00421883 50                      push eax
:00421884 8B4D08                  mov ecx, dword ptr [ebp+08]
:00421887 51                      push ecx
:00421888 B988274900              mov ecx, 00492788
:0042188D E88217FEFF              call 00403014
:00421892 6A04                    push 00000004
:00421894 B9181B4B00              mov ecx, 004B1B18
:00421899 E8A21AFEFF              call 00403340
:0042189E E83DAC0000              call 0042C4E0
:004218A3 8BE5                    mov esp, ebp
:004218A5 5D                      pop ebp
:004218A6 C20800                  ret 0008


:004218A9 55                      push ebp
:004218AA 8BEC                    mov ebp, esp
:004218AC 51                      push ecx
:004218AD 894DFC                  mov dword ptr [ebp-04], ecx
:004218B0 8A4510                  mov al, byte ptr [ebp+10]
:004218B3 50                      push eax
:004218B4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004218B7 E843FFFFFF              call 004217FF
:004218BC 85C0                    test eax, eax
:004218BE 7410                    je 004218D0
:004218C0 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004218C3 51                      push ecx
:004218C4 8B5508                  mov edx, dword ptr [ebp+08]
:004218C7 52                      push edx
:004218C8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004218CB E8A9FFFFFF              call 00421879

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004218BE(C)
|
:004218D0 8BE5                    mov esp, ebp
:004218D2 5D                      pop ebp
:004218D3 C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:004214E7   , :00424370   , :00424F3C   
|
:004218D6 55                      push ebp
:004218D7 8BEC                    mov ebp, esp
:004218D9 6AFF                    push FFFFFFFF
:004218DB 688C524800              push 0048528C
:004218E0 64A100000000            mov eax, dword ptr fs:[00000000]
:004218E6 50                      push eax
:004218E7 64892500000000          mov dword ptr fs:[00000000], esp
:004218EE 81EC34010000            sub esp, 00000134
:004218F4 898DC4FEFFFF            mov dword ptr [ebp+FFFFFEC4], ecx
:004218FA C745D800100000          mov [ebp-28], 00001000
:00421901 8D8DD4FEFFFF            lea ecx, dword ptr [ebp+FFFFFED4]
:00421907 E8A419FEFF              call 004032B0
:0042190C C745FC00000000          mov [ebp-04], 00000000

* Possible StringData Ref from Data Obj ->"UNIT_ATK.E5"
                                  |
:00421913 68C0BB4800              push 0048BBC0
:00421918 8D8DD4FEFFFF            lea ecx, dword ptr [ebp+FFFFFED4]
:0042191E E812E2FFFF              call 0041FB35
:00421923 6A04                    push 00000004
:00421925 6A00                    push 00000000
:00421927 8B45D8                  mov eax, dword ptr [ebp-28]
:0042192A 50                      push eax
:0042192B B9C8E44A00              mov ecx, 004AE4C8
:00421930 E80BE10500              call 0047FA40
:00421935 50                      push eax
:00421936 8B8DC4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC4]
:0042193C 33D2                    xor edx, edx
:0042193E 8A5101                  mov dl, byte ptr [ecx+01]
:00421941 52                      push edx
:00421942 8B85C4FEFFFF            mov eax, dword ptr [ebp+FFFFFEC4]
:00421948 33C9                    xor ecx, ecx
:0042194A 8A4801                  mov cl, byte ptr [eax+01]
:0042194D 6BC924                  imul ecx, 00000024
:00421950 81C1502C4B00            add ecx, 004B2C50
:00421956 E8EDE20100              call 0043FC48
:0042195B 25FF000000              and eax, 000000FF
:00421960 50                      push eax
:00421961 8D8DD4FEFFFF            lea ecx, dword ptr [ebp+FFFFFED4]
:00421967 E81DE3FFFF              call 0041FC89
:0042196C 8D8DD4FEFFFF            lea ecx, dword ptr [ebp+FFFFFED4]
:00421972 E84E79FFFF              call 004192C5
:00421977 6A08                    push 00000008
:00421979 B9181B4B00              mov ecx, 004B1B18
:0042197E E8BD19FEFF              call 00403340
:00421983 6A01                    push 00000001
:00421985 6A08                    push 00000008
:00421987 B9B0694B00              mov ecx, 004B69B0
:0042198C E8E92C0500              call 0047467A
:00421991 8B95C4FEFFFF            mov edx, dword ptr [ebp+FFFFFEC4]
:00421997 33C0                    xor eax, eax
:00421999 8A8254020000            mov al, byte ptr [edx+00000254]
:0042199F 25C0000000              and eax, 000000C0
:004219A4 3DC0000000              cmp eax, 000000C0
:004219A9 7451                    je 004219FC
:004219AB 8B8DC4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC4]
:004219B1 33D2                    xor edx, edx
:004219B3 8A510D                  mov dl, byte ptr [ecx+0D]
:004219B6 8BCA                    mov ecx, edx
:004219B8 6BC924                  imul ecx, 00000024
:004219BB 81C1502C4B00            add ecx, 004B2C50
:004219C1 E89A19FEFF              call 00403360
:004219C6 50                      push eax
:004219C7 8B8DC4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC4]
:004219CD 81C1CB020000            add ecx, 000002CB
:004219D3 E8C84BFEFF              call 004065A0
:004219D8 8B85C4FEFFFF            mov eax, dword ptr [ebp+FFFFFEC4]
:004219DE 8A88CC020000            mov cl, byte ptr [eax+000002CC]
:004219E4 51                      push ecx
:004219E5 8B95C4FEFFFF            mov edx, dword ptr [ebp+FFFFFEC4]
:004219EB 8A82CB020000            mov al, byte ptr [edx+000002CB]
:004219F1 50                      push eax
:004219F2 B950424B00              mov ecx, 004B4250
:004219F7 E843360300              call 0045503F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004219A9(C)
|
:004219FC E8DACBFFFF              call 0041E5DB
:00421A01 B950424B00              mov ecx, 004B4250
:00421A06 E8112C0300              call 0045461C
:00421A0B 8B8DC4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC4]
:00421A11 33D2                    xor edx, edx
:00421A13 8A11                    mov dl, byte ptr [ecx]
:00421A15 83FA43                  cmp edx, 00000043
:00421A18 742D                    je 00421A47
:00421A1A 8B85C4FEFFFF            mov eax, dword ptr [ebp+FFFFFEC4]
:00421A20 33C9                    xor ecx, ecx
:00421A22 8A08                    mov cl, byte ptr [eax]
:00421A24 83F942                  cmp ecx, 00000042
:00421A27 741E                    je 00421A47
:00421A29 8B95C4FEFFFF            mov edx, dword ptr [ebp+FFFFFEC4]
:00421A2F 8A420D                  mov al, byte ptr [edx+0D]
:00421A32 50                      push eax
:00421A33 8B8DC4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC4]
:00421A39 8A5101                  mov dl, byte ptr [ecx+01]
:00421A3C 52                      push edx
:00421A3D E8E73D0100              call 00435829
:00421A42 83C408                  add esp, 00000008
:00421A45 EB1B                    jmp 00421A62

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00421A18(C), :00421A27(C)
|
:00421A47 6A02                    push 00000002
:00421A49 8B85C4FEFFFF            mov eax, dword ptr [ebp+FFFFFEC4]
:00421A4F 33C9                    xor ecx, ecx
:00421A51 8A4801                  mov cl, byte ptr [eax+01]
:00421A54 6BC924                  imul ecx, 00000024
:00421A57 81C1502C4B00            add ecx, 004B2C50
:00421A5D E80E4CFEFF              call 00406670

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421A45(U)
|
:00421A62 8B95C4FEFFFF            mov edx, dword ptr [ebp+FFFFFEC4]
:00421A68 33C0                    xor eax, eax
:00421A6A 8A4201                  mov al, byte ptr [edx+01]
:00421A6D 8BC8                    mov ecx, eax
:00421A6F 6BC924                  imul ecx, 00000024
:00421A72 81C1502C4B00            add ecx, 004B2C50
:00421A78 E84CE20100              call 0043FCC9
:00421A7D 8B8DC4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC4]
:00421A83 33D2                    xor edx, edx
:00421A85 8A5101                  mov dl, byte ptr [ecx+01]
:00421A88 8BCA                    mov ecx, edx
:00421A8A 6BC924                  imul ecx, 00000024
:00421A8D 81C1502C4B00            add ecx, 004B2C50
:00421A93 E888C80100              call 0043E320
:00421A98 25FF000000              and eax, 000000FF
:00421A9D 8945DC                  mov dword ptr [ebp-24], eax
:00421AA0 8B45DC                  mov eax, dword ptr [ebp-24]
:00421AA3 8985C0FEFFFF            mov dword ptr [ebp+FFFFFEC0], eax
:00421AA9 83BDC0FEFFFF03          cmp dword ptr [ebp+FFFFFEC0], 00000003
:00421AB0 777F                    ja 00421B31
:00421AB2 8B8DC0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC0]
:00421AB8 FF248DD51C4200          jmp dword ptr [4*ecx+00421CD5]
:00421ABF 8B55D8                  mov edx, dword ptr [ebp-28]
:00421AC2 81C200400000            add edx, 00004000
:00421AC8 8955D8                  mov dword ptr [ebp-28], edx
:00421ACB EB64                    jmp 00421B31
:00421ACD 8B45D8                  mov eax, dword ptr [ebp-28]
:00421AD0 0500800000              add eax, 00008000
:00421AD5 8945D8                  mov dword ptr [ebp-28], eax
:00421AD8 6A04                    push 00000004
:00421ADA 6A00                    push 00000000
:00421ADC 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00421ADF 81C100100000            add ecx, 00001000
:00421AE5 51                      push ecx
:00421AE6 B9C8E44A00              mov ecx, 004AE4C8
:00421AEB E850DF0500              call 0047FA40
:00421AF0 50                      push eax
:00421AF1 6A04                    push 00000004
:00421AF3 6A00                    push 00000000
:00421AF5 8B55D8                  mov edx, dword ptr [ebp-28]
:00421AF8 52                      push edx
:00421AF9 B9C8E44A00              mov ecx, 004AE4C8
:00421AFE E83DDF0500              call 0047FA40
:00421B03 50                      push eax
:00421B04 6A40                    push 00000040
:00421B06 6A40                    push 00000040
:00421B08 E846D3FFFF              call 0041EE53
:00421B0D 83C410                  add esp, 00000010
:00421B10 8B45D8                  mov eax, dword ptr [ebp-28]
:00421B13 0500100000              add eax, 00001000
:00421B18 8945D8                  mov dword ptr [ebp-28], eax
:00421B1B EB14                    jmp 00421B31
:00421B1D 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00421B20 81C100800000            add ecx, 00008000
:00421B26 894DD8                  mov dword ptr [ebp-28], ecx
:00421B29 EB06                    jmp 00421B31
:00421B2B 8B55D8                  mov edx, dword ptr [ebp-28]
:00421B2E 8955D8                  mov dword ptr [ebp-28], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00421AB0(C), :00421ACB(U), :00421B1B(U), :00421B29(U)
|
:00421B31 8B85C4FEFFFF            mov eax, dword ptr [ebp+FFFFFEC4]
:00421B37 33C9                    xor ecx, ecx
:00421B39 8A4801                  mov cl, byte ptr [eax+01]
:00421B3C 6BC924                  imul ecx, 00000024
:00421B3F 81C1502C4B00            add ecx, 004B2C50
:00421B45 E81618FEFF              call 00403360
:00421B4A 668B10                  mov dx, word ptr [eax]
:00421B4D 668995D0FEFFFF          mov word ptr [ebp+FFFFFED0], dx
:00421B54 668B85D0FEFFFF          mov ax, word ptr [ebp+FFFFFED0]
:00421B5B 50                      push eax
:00421B5C 8D4DE0                  lea ecx, dword ptr [ebp-20]
:00421B5F 51                      push ecx
:00421B60 E8BADE0200              call 0044FA1F
:00421B65 83C408                  add esp, 00000008
:00421B68 668B95D0FEFFFF          mov dx, word ptr [ebp+FFFFFED0]
:00421B6F 52                      push edx
:00421B70 E809DF0200              call 0044FA7E
:00421B75 83C404                  add esp, 00000004
:00421B78 8985C8FEFFFF            mov dword ptr [ebp+FFFFFEC8], eax
:00421B7E 8995CCFEFFFF            mov dword ptr [ebp+FFFFFECC], edx
:00421B84 8B85C8FEFFFF            mov eax, dword ptr [ebp+FFFFFEC8]
:00421B8A 8945E4                  mov dword ptr [ebp-1C], eax
:00421B8D 8B8DCCFEFFFF            mov ecx, dword ptr [ebp+FFFFFECC]
:00421B93 894DE8                  mov dword ptr [ebp-18], ecx
:00421B96 8B55E4                  mov edx, dword ptr [ebp-1C]
:00421B99 83EA08                  sub edx, 00000008
:00421B9C 8955E4                  mov dword ptr [ebp-1C], edx
:00421B9F 8B45E8                  mov eax, dword ptr [ebp-18]
:00421BA2 83E808                  sub eax, 00000008
:00421BA5 8945E8                  mov dword ptr [ebp-18], eax
:00421BA8 6A04                    push 00000004
:00421BAA 6A00                    push 00000000
:00421BAC 6A00                    push 00000000
:00421BAE B9C8E44A00              mov ecx, 004AE4C8
:00421BB3 E888DE0500              call 0047FA40
:00421BB8 50                      push eax
:00421BB9 6A40                    push 00000040
:00421BBB 6A40                    push 00000040
:00421BBD 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00421BC0 51                      push ecx
:00421BC1 8B55E4                  mov edx, dword ptr [ebp-1C]
:00421BC4 52                      push edx
:00421BC5 E81CFE0200              call 004519E6
:00421BCA 83C414                  add esp, 00000014
:00421BCD 8B45E1                  mov eax, dword ptr [ebp-1F]
:00421BD0 25FF000000              and eax, 000000FF
:00421BD5 50                      push eax
:00421BD6 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00421BD9 81E1FF000000            and ecx, 000000FF
:00421BDF 51                      push ecx
:00421BE0 E8141BFEFF              call 004036F9
:00421BE5 83C408                  add esp, 00000008
:00421BE8 6A04                    push 00000004
:00421BEA 6A00                    push 00000000
:00421BEC 8B55D8                  mov edx, dword ptr [ebp-28]
:00421BEF 52                      push edx
:00421BF0 B9C8E44A00              mov ecx, 004AE4C8
:00421BF5 E846DE0500              call 0047FA40
:00421BFA 50                      push eax
:00421BFB 8B85C4FEFFFF            mov eax, dword ptr [ebp+FFFFFEC4]
:00421C01 8A4801                  mov cl, byte ptr [eax+01]
:00421C04 51                      push ecx
:00421C05 6A40                    push 00000040
:00421C07 6A40                    push 00000040
:00421C09 8B55E8                  mov edx, dword ptr [ebp-18]
:00421C0C 52                      push edx
:00421C0D 8B45E4                  mov eax, dword ptr [ebp-1C]
:00421C10 50                      push eax
:00421C11 E866F70200              call 0045137C
:00421C16 83C418                  add esp, 00000018
:00421C19 E8D8C9FFFF              call 0041E5F6
:00421C1E E8BDA80000              call 0042C4E0
:00421C23 E86FCF0500              call 0047EB97
:00421C28 8945EC                  mov dword ptr [ebp-14], eax
:00421C2B 6A01                    push 00000001
:00421C2D 6A27                    push 00000027
:00421C2F B9B0694B00              mov ecx, 004B69B0
:00421C34 E8412A0500              call 0047467A
:00421C39 8B8DC4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC4]
:00421C3F 33D2                    xor edx, edx
:00421C41 8A11                    mov dl, byte ptr [ecx]
:00421C43 8BCA                    mov ecx, edx
:00421C45 6BC946                  imul ecx, 00000046
:00421C48 81C1C0F44A00            add ecx, 004AF4C0
:00421C4E E8BDDA0300              call 0045F710
:00421C53 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:00421C54 68A8B84800              push 0048B8A8
:00421C59 6A02                    push 00000002
:00421C5B E839DA0000              call 0042F699
:00421C60 83C40C                  add esp, 0000000C
:00421C63 E82FCF0500              call 0047EB97
:00421C68 2B45EC                  sub eax, dword ptr [ebp-14]
:00421C6B B914000000              mov ecx, 00000014
:00421C70 2BC8                    sub ecx, eax
:00421C72 894DF0                  mov dword ptr [ebp-10], ecx
:00421C75 837DF000                cmp dword ptr [ebp-10], 00000000
:00421C79 7E0E                    jle 00421C89
:00421C7B 8B55F0                  mov edx, dword ptr [ebp-10]
:00421C7E 52                      push edx
:00421C7F B9181B4B00              mov ecx, 004B1B18
:00421C84 E8B716FEFF              call 00403340

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421C79(C)
|
:00421C89 E852A80000              call 0042C4E0
:00421C8E 6A00                    push 00000000
:00421C90 6A04                    push 00000004
:00421C92 6A00                    push 00000000
:00421C94 6A00                    push 00000000
:00421C96 B9C8E44A00              mov ecx, 004AE4C8
:00421C9B E8A0DD0500              call 0047FA40
:00421CA0 50                      push eax
:00421CA1 6A40                    push 00000040
:00421CA3 6A40                    push 00000040
:00421CA5 8B45E8                  mov eax, dword ptr [ebp-18]
:00421CA8 50                      push eax
:00421CA9 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00421CAC 51                      push ecx
:00421CAD E861FC0200              call 00451913
:00421CB2 83C418                  add esp, 00000018
:00421CB5 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00421CBC 8D8DD4FEFFFF            lea ecx, dword ptr [ebp+FFFFFED4]
:00421CC2 E80916FEFF              call 004032D0
:00421CC7 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00421CCA 64890D00000000          mov dword ptr fs:[00000000], ecx
:00421CD1 8BE5                    mov esp, ebp
:00421CD3 5D                      pop ebp
:00421CD4 C3                      ret



:00421CD5 BF1A4200                DWORD 00421ABF
:00421CD9 CD1A4200                DWORD 00421ACD
:00421CDD 2B1B4200                DWORD 00421B2B
:00421CE1 1D1B4200                DWORD 00421B1D



* Referenced by a CALL at Address:
|:0042164A   
|
:00421CE5 55                      push ebp
:00421CE6 8BEC                    mov ebp, esp
:00421CE8 83EC18                  sub esp, 00000018
:00421CEB 894DEC                  mov dword ptr [ebp-14], ecx
:00421CEE C645F800                mov [ebp-08], 00
:00421CF2 EB08                    jmp 00421CFC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421E67(U)
|
:00421CF4 8A45F8                  mov al, byte ptr [ebp-08]
:00421CF7 0401                    add al, 01
:00421CF9 8845F8                  mov byte ptr [ebp-08], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421CF2(U)
|
:00421CFC 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00421CFF 81E1FF000000            and ecx, 000000FF
:00421D05 83F908                  cmp ecx, 00000008
:00421D08 0F8D5E010000            jnl 00421E6C
:00421D0E 8B55F8                  mov edx, dword ptr [ebp-08]
:00421D11 81E2FF000000            and edx, 000000FF
:00421D17 8B45EC                  mov eax, dword ptr [ebp-14]
:00421D1A 8A8A08674800            mov cl, byte ptr [edx+00486708]
:00421D20 888854020000            mov byte ptr [eax+00000254], cl
:00421D26 8B55F8                  mov edx, dword ptr [ebp-08]
:00421D29 81E2FF000000            and edx, 000000FF
:00421D2F 33C0                    xor eax, eax
:00421D31 8A8208674800            mov al, byte ptr [edx+00486708]
:00421D37 8945E8                  mov dword ptr [ebp-18], eax
:00421D3A 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00421D3D 83E940                  sub ecx, 00000040
:00421D40 894DE8                  mov dword ptr [ebp-18], ecx
:00421D43 837DE86F                cmp dword ptr [ebp-18], 0000006F
:00421D47 7740                    ja 00421D89
:00421D49 8B45E8                  mov eax, dword ptr [ebp-18]
:00421D4C 33D2                    xor edx, edx
:00421D4E 8A90941E4200            mov dl, byte ptr [eax+00421E94]
:00421D54 FF2495701E4200          jmp dword ptr [4*edx+00421E70]
:00421D5B C645F408                mov [ebp-0C], 08
:00421D5F EB28                    jmp 00421D89
:00421D61 C645F419                mov [ebp-0C], 19
:00421D65 EB22                    jmp 00421D89
:00421D67 C645F41A                mov [ebp-0C], 1A
:00421D6B EB1C                    jmp 00421D89
:00421D6D C645F41B                mov [ebp-0C], 1B
:00421D71 EB16                    jmp 00421D89
:00421D73 C645F417                mov [ebp-0C], 17
:00421D77 EB10                    jmp 00421D89
:00421D79 C645F421                mov [ebp-0C], 21
:00421D7D EB0A                    jmp 00421D89
:00421D7F C645F411                mov [ebp-0C], 11
:00421D83 EB04                    jmp 00421D89
:00421D85 C645F40A                mov [ebp-0C], 0A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00421D47(C), :00421D5F(U), :00421D65(U), :00421D6B(U), :00421D71(U)
|:00421D77(U), :00421D7D(U), :00421D83(U)
|
:00421D89 68004C0400              push 00044C00
:00421D8E 6A04                    push 00000004
:00421D90 6A00                    push 00000000
:00421D92 6A00                    push 00000000
:00421D94 B9C8E44A00              mov ecx, 004AE4C8
:00421D99 E8A2DC0500              call 0047FA40
:00421D9E 50                      push eax
:00421D9F 8A4DF4                  mov cl, byte ptr [ebp-0C]
:00421DA2 51                      push ecx

* Possible StringData Ref from Data Obj ->"MEFF.E5"
                                  |
:00421DA3 68F8BB4800              push 0048BBF8
:00421DA8 B9B0174900              mov ecx, 004917B0
:00421DAD E846F7FDFF              call 004014F8
:00421DB2 C645F000                mov [ebp-10], 00
:00421DB6 C645FC00                mov [ebp-04], 00
:00421DBA EB09                    jmp 00421DC5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421E3B(U)
|
:00421DBC 8A55F0                  mov dl, byte ptr [ebp-10]
:00421DBF 80C201                  add dl, 01
:00421DC2 8855F0                  mov byte ptr [ebp-10], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421DBA(U)
|
:00421DC5 8B45F0                  mov eax, dword ptr [ebp-10]
:00421DC8 25FF000000              and eax, 000000FF
:00421DCD 83F874                  cmp eax, 00000074
:00421DD0 7D6E                    jge 00421E40
:00421DD2 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00421DD5 81E1FF000000            and ecx, 000000FF
:00421DDB 8B55EC                  mov edx, dword ptr [ebp-14]
:00421DDE 33C0                    xor eax, eax
:00421DE0 8A440A0D                mov al, byte ptr [edx+ecx+0D]
:00421DE4 3DFF000000              cmp eax, 000000FF
:00421DE9 7455                    je 00421E40
:00421DEB 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00421DEE 81E1FF000000            and ecx, 000000FF
:00421DF4 8B55EC                  mov edx, dword ptr [ebp-14]
:00421DF7 33C0                    xor eax, eax
:00421DF9 8A840A55020000          mov al, byte ptr [edx+ecx+00000255]
:00421E00 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00421E03 81E1FF000000            and ecx, 000000FF
:00421E09 33D2                    xor edx, edx
:00421E0B 8A9108674800            mov dl, byte ptr [ecx+00486708]
:00421E11 3BC2                    cmp eax, edx
:00421E13 7526                    jne 00421E3B
:00421E15 8B45F0                  mov eax, dword ptr [ebp-10]
:00421E18 25FF000000              and eax, 000000FF
:00421E1D 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00421E20 8A54010D                mov dl, byte ptr [ecx+eax+0D]
:00421E24 52                      push edx
:00421E25 B9B0174900              mov ecx, 004917B0
:00421E2A E80D00FEFF              call 00401E3C
:00421E2F 85C0                    test eax, eax
:00421E31 7408                    je 00421E3B
:00421E33 8A45FC                  mov al, byte ptr [ebp-04]
:00421E36 0401                    add al, 01
:00421E38 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00421E13(C), :00421E31(C)
|
:00421E3B E97CFFFFFF              jmp 00421DBC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00421DD0(C), :00421DE9(C)
|
:00421E40 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00421E43 81E1FF000000            and ecx, 000000FF
:00421E49 85C9                    test ecx, ecx
:00421E4B 7E10                    jle 00421E5D
:00421E4D 6A01                    push 00000001
:00421E4F 8B55EC                  mov edx, dword ptr [ebp-14]
:00421E52 52                      push edx
:00421E53 B9B0174900              mov ecx, 004917B0
:00421E58 E8FFFFFDFF              call 00401E5C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421E4B(C)
|
:00421E5D B9B0174900              mov ecx, 004917B0
:00421E62 E844F8FDFF              call 004016AB
:00421E67 E988FEFFFF              jmp 00421CF4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421D08(C)
|
:00421E6C 8BE5                    mov esp, ebp
:00421E6E 5D                      pop ebp
:00421E6F C3                      ret



:00421E70 5B1D4200                DWORD 00421D5B
:00421E74 791D4200                DWORD 00421D79
:00421E78 731D4200                DWORD 00421D73
:00421E7C 611D4200                DWORD 00421D61
:00421E80 671D4200                DWORD 00421D67
:00421E84 6D1D4200                DWORD 00421D6D
:00421E88 851D4200                DWORD 00421D85
:00421E8C 7F1D4200                DWORD 00421D7F
:00421E90 891D4200                DWORD 00421D89


:00421E94 0008                    add byte ptr [eax], cl
:00421E96 0808                    or byte ptr [eax], cl
:00421E98 0808                    or byte ptr [eax], cl
:00421E9A 0808                    or byte ptr [eax], cl
:00421E9C 0808                    or byte ptr [eax], cl
:00421E9E 0808                    or byte ptr [eax], cl
:00421EA0 0808                    or byte ptr [eax], cl
:00421EA2 0808                    or byte ptr [eax], cl
:00421EA4 0808                    or byte ptr [eax], cl
:00421EA6 0808                    or byte ptr [eax], cl
:00421EA8 0808                    or byte ptr [eax], cl
:00421EAA 0808                    or byte ptr [eax], cl
:00421EAC 0808                    or byte ptr [eax], cl
:00421EAE 0808                    or byte ptr [eax], cl
:00421EB0 0808                    or byte ptr [eax], cl
:00421EB2 0808                    or byte ptr [eax], cl
:00421EB4 0808                    or byte ptr [eax], cl
:00421EB6 0808                    or byte ptr [eax], cl
:00421EB8 0808                    or byte ptr [eax], cl
:00421EBA 0808                    or byte ptr [eax], cl
:00421EBC 0808                    or byte ptr [eax], cl
:00421EBE 0808                    or byte ptr [eax], cl
:00421EC0 0808                    or byte ptr [eax], cl
:00421EC2 0801                    or byte ptr [ecx], al
:00421EC4 0203                    add al, byte ptr [ebx]
:00421EC6 0408                    add al, 08
:00421EC8 0508080808              add eax, 08080808
:00421ECD 0808                    or byte ptr [eax], cl
:00421ECF 0808                    or byte ptr [eax], cl
:00421ED1 0808                    or byte ptr [eax], cl
:00421ED3 0806                    or byte ptr [esi], al
:00421ED5 0808                    or byte ptr [eax], cl
:00421ED7 0808                    or byte ptr [eax], cl
:00421ED9 0808                    or byte ptr [eax], cl
:00421EDB 0808                    or byte ptr [eax], cl
:00421EDD 0808                    or byte ptr [eax], cl
:00421EDF 0808                    or byte ptr [eax], cl
:00421EE1 0808                    or byte ptr [eax], cl
:00421EE3 0808                    or byte ptr [eax], cl
:00421EE5 0808                    or byte ptr [eax], cl
:00421EE7 0808                    or byte ptr [eax], cl
:00421EE9 0808                    or byte ptr [eax], cl
:00421EEB 0808                    or byte ptr [eax], cl
:00421EED 0808                    or byte ptr [eax], cl
:00421EEF 0808                    or byte ptr [eax], cl
:00421EF1 0808                    or byte ptr [eax], cl
:00421EF3 0808                    or byte ptr [eax], cl
:00421EF5 0808                    or byte ptr [eax], cl
:00421EF7 0808                    or byte ptr [eax], cl
:00421EF9 0808                    or byte ptr [eax], cl
:00421EFB 0808                    or byte ptr [eax], cl
:00421EFD 0808                    or byte ptr [eax], cl
:00421EFF 0808                    or byte ptr [eax], cl
:00421F01 0808                    or byte ptr [eax], cl
:00421F03 07                      pop es

* Referenced by a CALL at Address:
|:00401F61   
|
:00421F04 55                      push ebp
:00421F05 8BEC                    mov ebp, esp
:00421F07 6AFF                    push FFFFFFFF
:00421F09 68A2524800              push 004852A2
:00421F0E 64A100000000            mov eax, dword ptr fs:[00000000]
:00421F14 50                      push eax
:00421F15 64892500000000          mov dword ptr fs:[00000000], esp
:00421F1C 81EC30010000            sub esp, 00000130
:00421F22 898DCCFEFFFF            mov dword ptr [ebp+FFFFFECC], ecx
:00421F28 8A4508                  mov al, byte ptr [ebp+08]
:00421F2B 8885C8FEFFFF            mov byte ptr [ebp+FFFFFEC8], al
:00421F31 80BDC8FEFFFF01          cmp byte ptr [ebp+FFFFFEC8], 01
:00421F38 7405                    je 00421F3F
:00421F3A E949050000              jmp 00422488

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421F38(C)
|
:00421F3F 8D8DE4FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE4]
:00421F45 E86613FEFF              call 004032B0
:00421F4A C745FC00000000          mov [ebp-04], 00000000

* Possible StringData Ref from Data Obj ->"UNIT_SPC.E5"
                                  |
:00421F51 68D0BB4800              push 0048BBD0
:00421F56 8D8DE4FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE4]
:00421F5C E8D4DBFFFF              call 0041FB35
:00421F61 C745F000000000          mov [ebp-10], 00000000
:00421F68 8D8DDCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEDC]
:00421F6E E89DD70300              call 0045F710
:00421F73 C685E0FEFFFF00          mov byte ptr [ebp+FFFFFEE0], 00
:00421F7A EB0F                    jmp 00421F8B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00422195(U), :00422466(U)
|
:00421F7C 8A8DE0FEFFFF            mov cl, byte ptr [ebp+FFFFFEE0]
:00421F82 80C101                  add cl, 01
:00421F85 888DE0FEFFFF            mov byte ptr [ebp+FFFFFEE0], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421F7A(U)
|
:00421F8B 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:00421F91 81E2FF000000            and edx, 000000FF
:00421F97 83FA74                  cmp edx, 00000074
:00421F9A 0F8DCB040000            jnl 0042246B
:00421FA0 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:00421FA6 25FF000000              and eax, 000000FF
:00421FAB 8B8DCCFEFFFF            mov ecx, dword ptr [ebp+FFFFFECC]
:00421FB1 33D2                    xor edx, edx
:00421FB3 8A54010D                mov dl, byte ptr [ecx+eax+0D]
:00421FB7 81FAFF000000            cmp edx, 000000FF
:00421FBD 0F84A8040000            je 0042246B
:00421FC3 8B450C                  mov eax, dword ptr [ebp+0C]
:00421FC6 50                      push eax
:00421FC7 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:00421FCD 81E1FF000000            and ecx, 000000FF
:00421FD3 8B95CCFEFFFF            mov edx, dword ptr [ebp+FFFFFECC]
:00421FD9 33C0                    xor eax, eax
:00421FDB 8A440A0D                mov al, byte ptr [edx+ecx+0D]
:00421FDF 50                      push eax
:00421FE0 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:00421FE6 81E1FF000000            and ecx, 000000FF
:00421FEC 8B95CCFEFFFF            mov edx, dword ptr [ebp+FFFFFECC]
:00421FF2 33C0                    xor eax, eax
:00421FF4 8A440A0D                mov al, byte ptr [edx+ecx+0D]
:00421FF8 8BC8                    mov ecx, eax
:00421FFA 6BC924                  imul ecx, 00000024
:00421FFD 81C1502C4B00            add ecx, 004B2C50
:00422003 E840DC0100              call 0043FC48
:00422008 25FF000000              and eax, 000000FF
:0042200D 50                      push eax
:0042200E 8D8DE4FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE4]
:00422014 E870DCFFFF              call 0041FC89
:00422019 8945F0                  mov dword ptr [ebp-10], eax
:0042201C 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:00422022 81E1FF000000            and ecx, 000000FF
:00422028 8B95CCFEFFFF            mov edx, dword ptr [ebp+FFFFFECC]
:0042202E 33C0                    xor eax, eax
:00422030 8A840A55020000          mov al, byte ptr [edx+ecx+00000255]
:00422037 25C0000000              and eax, 000000C0
:0042203C 83F840                  cmp eax, 00000040
:0042203F 7539                    jne 0042207A
:00422041 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:00422047 81E1FF000000            and ecx, 000000FF
:0042204D 8B95CCFEFFFF            mov edx, dword ptr [ebp+FFFFFECC]
:00422053 33C0                    xor eax, eax
:00422055 8A840A55020000          mov al, byte ptr [edx+ecx+00000255]
:0042205C 8B8DCCFEFFFF            mov ecx, dword ptr [ebp+FFFFFECC]
:00422062 33D2                    xor edx, edx
:00422064 8A9154020000            mov dl, byte ptr [ecx+00000254]
:0042206A 3BC2                    cmp eax, edx
:0042206C 750C                    jne 0042207A
:0042206E C745F0001B0000          mov [ebp-10], 00001B00
:00422075 E920010000              jmp 0042219A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042203F(C), :0042206C(C)
|
:0042207A 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:00422080 25FF000000              and eax, 000000FF
:00422085 8B8DCCFEFFFF            mov ecx, dword ptr [ebp+FFFFFECC]
:0042208B 33D2                    xor edx, edx
:0042208D 8A940155020000          mov dl, byte ptr [ecx+eax+00000255]
:00422094 81E2C0000000            and edx, 000000C0
:0042209A 81FA80000000            cmp edx, 00000080
:004220A0 7538                    jne 004220DA
:004220A2 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:004220A8 25FF000000              and eax, 000000FF
:004220AD 8B8DCCFEFFFF            mov ecx, dword ptr [ebp+FFFFFECC]
:004220B3 33D2                    xor edx, edx
:004220B5 8A940155020000          mov dl, byte ptr [ecx+eax+00000255]
:004220BC 8B85CCFEFFFF            mov eax, dword ptr [ebp+FFFFFECC]
:004220C2 33C9                    xor ecx, ecx
:004220C4 8A8854020000            mov cl, byte ptr [eax+00000254]
:004220CA 3BD1                    cmp edx, ecx
:004220CC 750C                    jne 004220DA
:004220CE C745F000240000          mov [ebp-10], 00002400
:004220D5 E9C0000000              jmp 0042219A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004220A0(C), :004220CC(C)
|
:004220DA 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:004220E0 81E2FF000000            and edx, 000000FF
:004220E6 8B85CCFEFFFF            mov eax, dword ptr [ebp+FFFFFECC]
:004220EC 33C9                    xor ecx, ecx
:004220EE 8A8C1055020000          mov cl, byte ptr [eax+edx+00000255]
:004220F5 85C9                    test ecx, ecx
:004220F7 0F8598000000            jne 00422195
:004220FD 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:00422103 81E2FF000000            and edx, 000000FF
:00422109 8B85CCFEFFFF            mov eax, dword ptr [ebp+FFFFFECC]
:0042210F 33C9                    xor ecx, ecx
:00422111 8A4C100D                mov cl, byte ptr [eax+edx+0D]
:00422115 6BC924                  imul ecx, 00000024
:00422118 81C1502C4B00            add ecx, 004B2C50
:0042211E E8FDC10100              call 0043E320
:00422123 25FF000000              and eax, 000000FF
:00422128 8985C4FEFFFF            mov dword ptr [ebp+FFFFFEC4], eax
:0042212E 83BDC4FEFFFF03          cmp dword ptr [ebp+FFFFFEC4], 00000003
:00422135 775C                    ja 00422193
:00422137 8B95C4FEFFFF            mov edx, dword ptr [ebp+FFFFFEC4]
:0042213D FF249598244200          jmp dword ptr [4*edx+00422498]
:00422144 C745F000090000          mov [ebp-10], 00000900
:0042214B EB46                    jmp 00422193
:0042214D C745F000120000          mov [ebp-10], 00001200
:00422154 8B45F0                  mov eax, dword ptr [ebp-10]
:00422157 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0042215A 8D940100090000          lea edx, dword ptr [ecx+eax+00000900]
:00422161 52                      push edx
:00422162 8B450C                  mov eax, dword ptr [ebp+0C]
:00422165 0345F0                  add eax, dword ptr [ebp-10]
:00422168 50                      push eax
:00422169 6A30                    push 00000030
:0042216B 6A30                    push 00000030
:0042216D E8E1CCFFFF              call 0041EE53
:00422172 83C410                  add esp, 00000010
:00422175 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00422178 81C100090000            add ecx, 00000900
:0042217E 894DF0                  mov dword ptr [ebp-10], ecx
:00422181 EB10                    jmp 00422193
:00422183 C745F000120000          mov [ebp-10], 00001200
:0042218A EB07                    jmp 00422193
:0042218C C745F000000000          mov [ebp-10], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00422135(C), :0042214B(U), :00422181(U), :0042218A(U)
|
:00422193 EB05                    jmp 0042219A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004220F7(C)
|
:00422195 E9E2FDFFFF              jmp 00421F7C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00422075(U), :004220D5(U), :00422193(U)
|
:0042219A 6A02                    push 00000002
:0042219C 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:004221A2 81E2FF000000            and edx, 000000FF
:004221A8 8B85CCFEFFFF            mov eax, dword ptr [ebp+FFFFFECC]
:004221AE 33C9                    xor ecx, ecx
:004221B0 8A4C100D                mov cl, byte ptr [eax+edx+0D]
:004221B4 6BC924                  imul ecx, 00000024
:004221B7 81C1502C4B00            add ecx, 004B2C50
:004221BD E82E390000              call 00425AF0
:004221C2 85C0                    test eax, eax
:004221C4 7441                    je 00422207
:004221C6 6A04                    push 00000004
:004221C8 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:004221CE 81E2FF000000            and edx, 000000FF
:004221D4 8B85CCFEFFFF            mov eax, dword ptr [ebp+FFFFFECC]
:004221DA 33C9                    xor ecx, ecx
:004221DC 8A4C100D                mov cl, byte ptr [eax+edx+0D]
:004221E0 6BC924                  imul ecx, 00000024
:004221E3 81C1502C4B00            add ecx, 004B2C50
:004221E9 E802390000              call 00425AF0
:004221EE 85C0                    test eax, eax
:004221F0 7415                    je 00422207
:004221F2 6A04                    push 00000004
:004221F4 6A30                    push 00000030
:004221F6 6A30                    push 00000030
:004221F8 8B550C                  mov edx, dword ptr [ebp+0C]
:004221FB 0355F0                  add edx, dword ptr [ebp-10]
:004221FE 52                      push edx
:004221FF E87CE20000              call 00430480
:00422204 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004221C4(C), :004221F0(C)
|
:00422207 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:0042220D 25FF000000              and eax, 000000FF
:00422212 8B8DCCFEFFFF            mov ecx, dword ptr [ebp+FFFFFECC]
:00422218 33D2                    xor edx, edx
:0042221A 8A54010D                mov dl, byte ptr [ecx+eax+0D]
:0042221E 8BCA                    mov ecx, edx
:00422220 6BC924                  imul ecx, 00000024
:00422223 81C1502C4B00            add ecx, 004B2C50
:00422229 E83211FEFF              call 00403360
:0042222E 50                      push eax
:0042222F 8D8DDCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEDC]
:00422235 E86643FEFF              call 004065A0
:0042223A 668B85DCFEFFFF          mov ax, word ptr [ebp+FFFFFEDC]
:00422241 50                      push eax
:00422242 E837D80200              call 0044FA7E
:00422247 83C404                  add esp, 00000004
:0042224A 8985D4FEFFFF            mov dword ptr [ebp+FFFFFED4], eax
:00422250 8995D8FEFFFF            mov dword ptr [ebp+FFFFFED8], edx
:00422256 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:0042225C 894DE8                  mov dword ptr [ebp-18], ecx
:0042225F 8B95D8FEFFFF            mov edx, dword ptr [ebp+FFFFFED8]
:00422265 8955EC                  mov dword ptr [ebp-14], edx
:00422268 668B85DCFEFFFF          mov ax, word ptr [ebp+FFFFFEDC]
:0042226F 50                      push eax
:00422270 8D8DD0FEFFFF            lea ecx, dword ptr [ebp+FFFFFED0]
:00422276 51                      push ecx
:00422277 E8A3D70200              call 0044FA1F
:0042227C 83C408                  add esp, 00000008
:0042227F 50                      push eax
:00422280 8D8DDCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEDC]
:00422286 E81543FEFF              call 004065A0
:0042228B E84BC3FFFF              call 0041E5DB
:00422290 8B95DDFEFFFF            mov edx, dword ptr [ebp+FFFFFEDD]
:00422296 81E2FF000000            and edx, 000000FF
:0042229C 52                      push edx
:0042229D 8B85DCFEFFFF            mov eax, dword ptr [ebp+FFFFFEDC]
:004222A3 25FF000000              and eax, 000000FF
:004222A8 50                      push eax
:004222A9 E84B14FEFF              call 004036F9
:004222AE 83C408                  add esp, 00000008
:004222B1 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004222B4 034DF0                  add ecx, dword ptr [ebp-10]
:004222B7 51                      push ecx
:004222B8 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:004222BE 81E2FF000000            and edx, 000000FF
:004222C4 8B85CCFEFFFF            mov eax, dword ptr [ebp+FFFFFECC]
:004222CA 8A4C100D                mov cl, byte ptr [eax+edx+0D]
:004222CE 51                      push ecx
:004222CF 6A30                    push 00000030
:004222D1 6A30                    push 00000030
:004222D3 8B55EC                  mov edx, dword ptr [ebp-14]
:004222D6 52                      push edx
:004222D7 8B45E8                  mov eax, dword ptr [ebp-18]
:004222DA 50                      push eax
:004222DB E89CF00200              call 0045137C
:004222E0 83C418                  add esp, 00000018
:004222E3 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:004222E9 81E1FF000000            and ecx, 000000FF
:004222EF 8B95CCFEFFFF            mov edx, dword ptr [ebp+FFFFFECC]
:004222F5 83BC8A8400000000        cmp dword ptr [edx+4*ecx+00000084], 00000000
:004222FD 0F8E9C000000            jle 0042239F
:00422303 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:00422309 25FF000000              and eax, 000000FF
:0042230E 8B8DCCFEFFFF            mov ecx, dword ptr [ebp+FFFFFECC]
:00422314 33D2                    xor edx, edx
:00422316 8A940155020000          mov dl, byte ptr [ecx+eax+00000255]
:0042231D 83FA50                  cmp edx, 00000050
:00422320 753D                    jne 0042235F
:00422322 6A18                    push 00000018
:00422324 6A45                    push 00000045
:00422326 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:0042232C 25FF000000              and eax, 000000FF
:00422331 8B8DCCFEFFFF            mov ecx, dword ptr [ebp+FFFFFECC]
:00422337 8B948184000000          mov edx, dword ptr [ecx+4*eax+00000084]
:0042233E 52                      push edx
:0042233F 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:00422345 25FF000000              and eax, 000000FF
:0042234A 8B8DCCFEFFFF            mov ecx, dword ptr [ebp+FFFFFECC]
:00422350 8A54010D                mov dl, byte ptr [ecx+eax+0D]
:00422354 52                      push edx
:00422355 E897D70200              call 0044FAF1
:0042235A 83C410                  add esp, 00000010
:0042235D EB3B                    jmp 0042239A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422320(C)
|
:0042235F 6A18                    push 00000018
:00422361 6A12                    push 00000012
:00422363 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:00422369 25FF000000              and eax, 000000FF
:0042236E 8B8DCCFEFFFF            mov ecx, dword ptr [ebp+FFFFFECC]
:00422374 8B948184000000          mov edx, dword ptr [ecx+4*eax+00000084]
:0042237B 52                      push edx
:0042237C 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:00422382 25FF000000              and eax, 000000FF
:00422387 8B8DCCFEFFFF            mov ecx, dword ptr [ebp+FFFFFECC]
:0042238D 8A54010D                mov dl, byte ptr [ecx+eax+0D]
:00422391 52                      push edx
:00422392 E85AD70200              call 0044FAF1
:00422397 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042235D(U)
|
:0042239A E9C2000000              jmp 00422461

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004222FD(C)
|
:0042239F 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:004223A5 25FF000000              and eax, 000000FF
:004223AA 8B8DCCFEFFFF            mov ecx, dword ptr [ebp+FFFFFECC]
:004223B0 83BC818400000000        cmp dword ptr [ecx+4*eax+00000084], 00000000
:004223B8 0F8DA3000000            jnl 00422461
:004223BE 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:004223C4 81E2FF000000            and edx, 000000FF
:004223CA 8B85CCFEFFFF            mov eax, dword ptr [ebp+FFFFFECC]
:004223D0 33C9                    xor ecx, ecx
:004223D2 8A8C1055020000          mov cl, byte ptr [eax+edx+00000255]
:004223D9 81F990000000            cmp ecx, 00000090
:004223DF 7541                    jne 00422422
:004223E1 6A18                    push 00000018
:004223E3 6A45                    push 00000045
:004223E5 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:004223EB 81E2FF000000            and edx, 000000FF
:004223F1 8B85CCFEFFFF            mov eax, dword ptr [ebp+FFFFFECC]
:004223F7 8B8C9084000000          mov ecx, dword ptr [eax+4*edx+00000084]
:004223FE F7D9                    neg ecx
:00422400 51                      push ecx
:00422401 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:00422407 81E2FF000000            and edx, 000000FF
:0042240D 8B85CCFEFFFF            mov eax, dword ptr [ebp+FFFFFECC]
:00422413 8A4C100D                mov cl, byte ptr [eax+edx+0D]
:00422417 51                      push ecx
:00422418 E8D4D60200              call 0044FAF1
:0042241D 83C410                  add esp, 00000010
:00422420 EB3F                    jmp 00422461

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004223DF(C)
|
:00422422 6A18                    push 00000018
:00422424 6A12                    push 00000012
:00422426 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:0042242C 81E2FF000000            and edx, 000000FF
:00422432 8B85CCFEFFFF            mov eax, dword ptr [ebp+FFFFFECC]
:00422438 8B8C9084000000          mov ecx, dword ptr [eax+4*edx+00000084]
:0042243F F7D9                    neg ecx
:00422441 51                      push ecx
:00422442 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:00422448 81E2FF000000            and edx, 000000FF
:0042244E 8B85CCFEFFFF            mov eax, dword ptr [ebp+FFFFFECC]
:00422454 8A4C100D                mov cl, byte ptr [eax+edx+0D]
:00422458 51                      push ecx
:00422459 E893D60200              call 0044FAF1
:0042245E 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042239A(U), :004223B8(C), :00422420(U)
|
:00422461 E890C1FFFF              call 0041E5F6
:00422466 E911FBFFFF              jmp 00421F7C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00421F9A(C), :00421FBD(C)
|
:0042246B 8D8DE4FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE4]
:00422471 E84F6EFFFF              call 004192C5
:00422476 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0042247D 8D8DE4FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE4]
:00422483 E8480EFEFF              call 004032D0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00421F3A(U)
|
:00422488 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042248B 64890D00000000          mov dword ptr fs:[00000000], ecx
:00422492 8BE5                    mov esp, ebp
:00422494 5D                      pop ebp
:00422495 C20C00                  ret 000C



:00422498 44214200                DWORD 00422144
:0042249C 4D214200                DWORD 0042214D
:004224A0 8C214200                DWORD 0042218C
:004224A4 83214200                DWORD 00422183



* Referenced by a CALL at Addresses:
|:00423345   , :00423531   , :00423775   , :0042394A   , :00423B19   
|:00423D32   , :00423EC5   , :00424204   , :004244FC   , :004251C6   
|
:004224A8 55                      push ebp
:004224A9 8BEC                    mov ebp, esp
:004224AB 83EC34                  sub esp, 00000034
:004224AE 56                      push esi
:004224AF 894DD4                  mov dword ptr [ebp-2C], ecx
:004224B2 8B45D4                  mov eax, dword ptr [ebp-2C]
:004224B5 33C9                    xor ecx, ecx
:004224B7 8A88CA020000            mov cl, byte ptr [eax+000002CA]
:004224BD F7D9                    neg ecx
:004224BF 1BC9                    sbb ecx, ecx
:004224C1 41                      inc ecx
:004224C2 894DFC                  mov dword ptr [ebp-04], ecx
:004224C5 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:004224C8 E8852F0000              call 00425452
:004224CD B9083D4B00              mov ecx, 004B3D08
:004224D2 E8F99DFFFF              call 0041C2D0
:004224D7 25FF000000              and eax, 000000FF
:004224DC 99                      cdq
:004224DD 33C2                    xor eax, edx
:004224DF 2BC2                    sub eax, edx
:004224E1 83E003                  and eax, 00000003
:004224E4 33C2                    xor eax, edx
:004224E6 2BC2                    sub eax, edx
:004224E8 83F802                  cmp eax, 00000002
:004224EB 7D14                    jge 00422501
:004224ED B9083D4B00              mov ecx, 004B3D08
:004224F2 E83942FEFF              call 00406730
:004224F7 B9083D4B00              mov ecx, 004B3D08
:004224FC E82F42FEFF              call 00406730

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004224EB(C)
|
:00422501 B950424B00              mov ecx, 004B4250
:00422506 E808160300              call 00453B13
:0042250B C645F800                mov [ebp-08], 00
:0042250F EB09                    jmp 0042251A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422DBE(U)
|
:00422511 8A55F8                  mov dl, byte ptr [ebp-08]
:00422514 80C201                  add dl, 01
:00422517 8855F8                  mov byte ptr [ebp-08], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042250F(U)
|
:0042251A 8B45F8                  mov eax, dword ptr [ebp-08]
:0042251D 25FF000000              and eax, 000000FF
:00422522 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00422525 33D2                    xor edx, edx
:00422527 8A54010D                mov dl, byte ptr [ecx+eax+0D]
:0042252B 81FAFF000000            cmp edx, 000000FF
:00422531 0F848C080000            je 00422DC3
:00422537 8B45F8                  mov eax, dword ptr [ebp-08]
:0042253A 25FF000000              and eax, 000000FF
:0042253F 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00422542 8B55D4                  mov edx, dword ptr [ebp-2C]
:00422545 8A44020D                mov al, byte ptr [edx+eax+0D]
:00422549 88410C                  mov byte ptr [ecx+0C], al
:0042254C 6A01                    push 00000001
:0042254E 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00422551 8A510C                  mov dl, byte ptr [ecx+0C]
:00422554 52                      push edx
:00422555 B950424B00              mov ecx, 004B4250
:0042255A E8B1290300              call 00454F10
:0042255F 8B45F8                  mov eax, dword ptr [ebp-08]
:00422562 25FF000000              and eax, 000000FF
:00422567 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0042256A 33D2                    xor edx, edx
:0042256C 8A940155020000          mov dl, byte ptr [ecx+eax+00000255]
:00422573 8955D0                  mov dword ptr [ebp-30], edx
:00422576 817DD0BF000000          cmp dword ptr [ebp-30], 000000BF
:0042257D 0F872A040000            ja 004229AD
:00422583 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00422586 33C0                    xor eax, eax
:00422588 8A81142E4200            mov al, byte ptr [ecx+00422E14]
:0042258E FF2485C82D4200          jmp dword ptr [4*eax+00422DC8]
:00422595 C645EC22                mov [ebp-14], 22
:00422599 8B55F8                  mov edx, dword ptr [ebp-08]
:0042259C 81E2FF000000            and edx, 000000FF
:004225A2 8B45D4                  mov eax, dword ptr [ebp-2C]
:004225A5 8A4C100D                mov cl, byte ptr [eax+edx+0D]
:004225A9 51                      push ecx
:004225AA 6A35                    push 00000035
:004225AC E801E7FFFF              call 00420CB2
:004225B1 83C408                  add esp, 00000008
:004225B4 E9F8030000              jmp 004229B1
:004225B9 C645EC23                mov [ebp-14], 23
:004225BD 8B55F8                  mov edx, dword ptr [ebp-08]
:004225C0 81E2FF000000            and edx, 000000FF
:004225C6 8B45D4                  mov eax, dword ptr [ebp-2C]
:004225C9 8A4C100D                mov cl, byte ptr [eax+edx+0D]
:004225CD 51                      push ecx
:004225CE 6A37                    push 00000037
:004225D0 E8DDE6FFFF              call 00420CB2
:004225D5 83C408                  add esp, 00000008
:004225D8 E9D4030000              jmp 004229B1
:004225DD C645EC24                mov [ebp-14], 24
:004225E1 8B55F8                  mov edx, dword ptr [ebp-08]
:004225E4 81E2FF000000            and edx, 000000FF
:004225EA 8B45D4                  mov eax, dword ptr [ebp-2C]
:004225ED 8A4C100D                mov cl, byte ptr [eax+edx+0D]
:004225F1 51                      push ecx
:004225F2 6A31                    push 00000031
:004225F4 E8B9E6FFFF              call 00420CB2
:004225F9 83C408                  add esp, 00000008
:004225FC E9B0030000              jmp 004229B1
:00422601 C645EC25                mov [ebp-14], 25
:00422605 8B55F8                  mov edx, dword ptr [ebp-08]
:00422608 81E2FF000000            and edx, 000000FF
:0042260E 8B45D4                  mov eax, dword ptr [ebp-2C]
:00422611 8A4C100D                mov cl, byte ptr [eax+edx+0D]
:00422615 51                      push ecx
:00422616 6A33                    push 00000033
:00422618 E895E6FFFF              call 00420CB2
:0042261D 83C408                  add esp, 00000008
:00422620 E98C030000              jmp 004229B1
:00422625 C645EC26                mov [ebp-14], 26
:00422629 8B55F8                  mov edx, dword ptr [ebp-08]
:0042262C 81E2FF000000            and edx, 000000FF
:00422632 8B45D4                  mov eax, dword ptr [ebp-2C]
:00422635 8A4C100D                mov cl, byte ptr [eax+edx+0D]
:00422639 51                      push ecx
:0042263A 6A31                    push 00000031
:0042263C E871E6FFFF              call 00420CB2
:00422641 83C408                  add esp, 00000008
:00422644 8B55F8                  mov edx, dword ptr [ebp-08]
:00422647 81E2FF000000            and edx, 000000FF
:0042264D 8B45D4                  mov eax, dword ptr [ebp-2C]
:00422650 8A4C100D                mov cl, byte ptr [eax+edx+0D]
:00422654 51                      push ecx
:00422655 6A33                    push 00000033
:00422657 E856E6FFFF              call 00420CB2
:0042265C 83C408                  add esp, 00000008
:0042265F 8B55F8                  mov edx, dword ptr [ebp-08]
:00422662 81E2FF000000            and edx, 000000FF
:00422668 8B45D4                  mov eax, dword ptr [ebp-2C]
:0042266B 8A4C100D                mov cl, byte ptr [eax+edx+0D]
:0042266F 51                      push ecx
:00422670 6A35                    push 00000035
:00422672 E83BE6FFFF              call 00420CB2
:00422677 83C408                  add esp, 00000008
:0042267A 8B55F8                  mov edx, dword ptr [ebp-08]
:0042267D 81E2FF000000            and edx, 000000FF
:00422683 8B45D4                  mov eax, dword ptr [ebp-2C]
:00422686 8A4C100D                mov cl, byte ptr [eax+edx+0D]
:0042268A 51                      push ecx
:0042268B 6A37                    push 00000037
:0042268D E820E6FFFF              call 00420CB2
:00422692 83C408                  add esp, 00000008
:00422695 E917030000              jmp 004229B1
:0042269A C645EC2E                mov [ebp-14], 2E
:0042269E 8B55F8                  mov edx, dword ptr [ebp-08]
:004226A1 81E2FF000000            and edx, 000000FF
:004226A7 8B45D4                  mov eax, dword ptr [ebp-2C]
:004226AA 8A4C100D                mov cl, byte ptr [eax+edx+0D]
:004226AE 51                      push ecx
:004226AF 6A30                    push 00000030
:004226B1 E8FCE5FFFF              call 00420CB2
:004226B6 83C408                  add esp, 00000008
:004226B9 E9F3020000              jmp 004229B1
:004226BE C645EC27                mov [ebp-14], 27
:004226C2 8B55F8                  mov edx, dword ptr [ebp-08]
:004226C5 81E2FF000000            and edx, 000000FF
:004226CB 8B45D4                  mov eax, dword ptr [ebp-2C]
:004226CE 8A4C100D                mov cl, byte ptr [eax+edx+0D]
:004226D2 51                      push ecx
:004226D3 6A1B                    push 0000001B
:004226D5 E8D8E5FFFF              call 00420CB2
:004226DA 83C408                  add esp, 00000008
:004226DD E9CF020000              jmp 004229B1
:004226E2 C645EC28                mov [ebp-14], 28
:004226E6 8B55F8                  mov edx, dword ptr [ebp-08]
:004226E9 81E2FF000000            and edx, 000000FF
:004226EF 8B45D4                  mov eax, dword ptr [ebp-2C]
:004226F2 8A4C100D                mov cl, byte ptr [eax+edx+0D]
:004226F6 51                      push ecx
:004226F7 6A1D                    push 0000001D
:004226F9 E8B4E5FFFF              call 00420CB2
:004226FE 83C408                  add esp, 00000008
:00422701 E9AB020000              jmp 004229B1
:00422706 C645EC29                mov [ebp-14], 29
:0042270A 8B55F8                  mov edx, dword ptr [ebp-08]
:0042270D 81E2FF000000            and edx, 000000FF
:00422713 8B45D4                  mov eax, dword ptr [ebp-2C]
:00422716 8A4C100D                mov cl, byte ptr [eax+edx+0D]
:0042271A 51                      push ecx
:0042271B 6A17                    push 00000017
:0042271D E890E5FFFF              call 00420CB2
:00422722 83C408                  add esp, 00000008
:00422725 E987020000              jmp 004229B1
:0042272A C645EC2A                mov [ebp-14], 2A
:0042272E 8B55F8                  mov edx, dword ptr [ebp-08]
:00422731 81E2FF000000            and edx, 000000FF
:00422737 8B45D4                  mov eax, dword ptr [ebp-2C]
:0042273A 8A4C100D                mov cl, byte ptr [eax+edx+0D]
:0042273E 51                      push ecx
:0042273F 6A19                    push 00000019
:00422741 E86CE5FFFF              call 00420CB2
:00422746 83C408                  add esp, 00000008
:00422749 E963020000              jmp 004229B1
:0042274E C645EC2B                mov [ebp-14], 2B
:00422752 8B55F8                  mov edx, dword ptr [ebp-08]
:00422755 81E2FF000000            and edx, 000000FF
:0042275B 8B45D4                  mov eax, dword ptr [ebp-2C]
:0042275E 8A4C100D                mov cl, byte ptr [eax+edx+0D]
:00422762 51                      push ecx
:00422763 6A17                    push 00000017
:00422765 E848E5FFFF              call 00420CB2
:0042276A 83C408                  add esp, 00000008
:0042276D 8B55F8                  mov edx, dword ptr [ebp-08]
:00422770 81E2FF000000            and edx, 000000FF
:00422776 8B45D4                  mov eax, dword ptr [ebp-2C]
:00422779 8A4C100D                mov cl, byte ptr [eax+edx+0D]
:0042277D 51                      push ecx
:0042277E 6A19                    push 00000019
:00422780 E82DE5FFFF              call 00420CB2
:00422785 83C408                  add esp, 00000008
:00422788 8B55F8                  mov edx, dword ptr [ebp-08]
:0042278B 81E2FF000000            and edx, 000000FF
:00422791 8B45D4                  mov eax, dword ptr [ebp-2C]
:00422794 8A4C100D                mov cl, byte ptr [eax+edx+0D]
:00422798 51                      push ecx
:00422799 6A1B                    push 0000001B
:0042279B E812E5FFFF              call 00420CB2
:004227A0 83C408                  add esp, 00000008
:004227A3 8B55F8                  mov edx, dword ptr [ebp-08]
:004227A6 81E2FF000000            and edx, 000000FF
:004227AC 8B45D4                  mov eax, dword ptr [ebp-2C]
:004227AF 8A4C100D                mov cl, byte ptr [eax+edx+0D]
:004227B3 51                      push ecx
:004227B4 6A1D                    push 0000001D
:004227B6 E8F7E4FFFF              call 00420CB2
:004227BB 83C408                  add esp, 00000008
:004227BE E9EE010000              jmp 004229B1
:004227C3 C645EC2C                mov [ebp-14], 2C
:004227C7 8B55F8                  mov edx, dword ptr [ebp-08]
:004227CA 81E2FF000000            and edx, 000000FF
:004227D0 8B45D4                  mov eax, dword ptr [ebp-2C]
:004227D3 8A4C100D                mov cl, byte ptr [eax+edx+0D]
:004227D7 51                      push ecx
:004227D8 6A2E                    push 0000002E
:004227DA E846E6FFFF              call 00420E25
:004227DF 83C408                  add esp, 00000008
:004227E2 E9CA010000              jmp 004229B1
:004227E7 C645EC2C                mov [ebp-14], 2C

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:004227EB 6A06                    push 00000006
:004227ED 8B55F8                  mov edx, dword ptr [ebp-08]
:004227F0 81E2FF000000            and edx, 000000FF
:004227F6 8B45D4                  mov eax, dword ptr [ebp-2C]
:004227F9 33C9                    xor ecx, ecx
:004227FB 8A4C100D                mov cl, byte ptr [eax+edx+0D]
:004227FF 6BC924                  imul ecx, 00000024
:00422802 81C1502C4B00            add ecx, 004B2C50
:00422808 E8833EFEFF              call 00406690
:0042280D E99F010000              jmp 004229B1
:00422812 8B75F8                  mov esi, dword ptr [ebp-08]
:00422815 81E6FF000000            and esi, 000000FF
:0042281B 8B55F8                  mov edx, dword ptr [ebp-08]
:0042281E 81E2FF000000            and edx, 000000FF
:00422824 8B45D4                  mov eax, dword ptr [ebp-2C]
:00422827 33C9                    xor ecx, ecx
:00422829 8A4C100D                mov cl, byte ptr [eax+edx+0D]
:0042282D 6BC924                  imul ecx, 00000024
:00422830 81C1502C4B00            add ecx, 004B2C50
:00422836 E855040500              call 00472C90
:0042283B 8B55D4                  mov edx, dword ptr [ebp-2C]
:0042283E 3984B284000000          cmp dword ptr [edx+4*esi+00000084], eax
:00422845 7D20                    jge 00422867
:00422847 C645EC30                mov [ebp-14], 30
:0042284B 8B45F8                  mov eax, dword ptr [ebp-08]
:0042284E 25FF000000              and eax, 000000FF
:00422853 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00422856 8A54010D                mov dl, byte ptr [ecx+eax+0D]
:0042285A 52                      push edx
:0042285B 6A1F                    push 0000001F
:0042285D E8C3E5FFFF              call 00420E25
:00422862 83C408                  add esp, 00000008
:00422865 EB04                    jmp 0042286B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422845(C)
|
:00422867 C645ECFF                mov [ebp-14], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422865(U)
|
:0042286B E941010000              jmp 004229B1
:00422870 8B75F8                  mov esi, dword ptr [ebp-08]
:00422873 81E6FF000000            and esi, 000000FF
:00422879 8B45F8                  mov eax, dword ptr [ebp-08]
:0042287C 25FF000000              and eax, 000000FF
:00422881 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00422884 33D2                    xor edx, edx
:00422886 8A54010D                mov dl, byte ptr [ecx+eax+0D]
:0042288A 8BCA                    mov ecx, edx
:0042288C 6BC924                  imul ecx, 00000024
:0042288F 81C1502C4B00            add ecx, 004B2C50
:00422895 E8F6030500              call 00472C90
:0042289A 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0042289D 3984B184000000          cmp dword ptr [ecx+4*esi+00000084], eax
:004228A4 7D21                    jge 004228C7
:004228A6 C645EC31                mov [ebp-14], 31
:004228AA 8B55F8                  mov edx, dword ptr [ebp-08]
:004228AD 81E2FF000000            and edx, 000000FF
:004228B3 8B45D4                  mov eax, dword ptr [ebp-2C]
:004228B6 8A4C100D                mov cl, byte ptr [eax+edx+0D]
:004228BA 51                      push ecx
:004228BB 6A21                    push 00000021
:004228BD E863E5FFFF              call 00420E25
:004228C2 83C408                  add esp, 00000008
:004228C5 EB04                    jmp 004228CB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004228A4(C)
|
:004228C7 C645ECFF                mov [ebp-14], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004228C5(U)
|
:004228CB E9E1000000              jmp 004229B1
:004228D0 8B75F8                  mov esi, dword ptr [ebp-08]
:004228D3 81E6FF000000            and esi, 000000FF
:004228D9 8B55F8                  mov edx, dword ptr [ebp-08]
:004228DC 81E2FF000000            and edx, 000000FF
:004228E2 8B45D4                  mov eax, dword ptr [ebp-2C]
:004228E5 33C9                    xor ecx, ecx
:004228E7 8A4C100D                mov cl, byte ptr [eax+edx+0D]
:004228EB 6BC924                  imul ecx, 00000024
:004228EE 81C1502C4B00            add ecx, 004B2C50
:004228F4 E897030500              call 00472C90
:004228F9 8B55D4                  mov edx, dword ptr [ebp-2C]
:004228FC 3984B284000000          cmp dword ptr [edx+4*esi+00000084], eax
:00422903 7D20                    jge 00422925
:00422905 C645EC32                mov [ebp-14], 32
:00422909 8B45F8                  mov eax, dword ptr [ebp-08]
:0042290C 25FF000000              and eax, 000000FF
:00422911 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00422914 8A54010D                mov dl, byte ptr [ecx+eax+0D]
:00422918 52                      push edx
:00422919 6A23                    push 00000023
:0042291B E805E5FFFF              call 00420E25
:00422920 83C408                  add esp, 00000008
:00422923 EB04                    jmp 00422929

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422903(C)
|
:00422925 C645ECFF                mov [ebp-14], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422923(U)
|
:00422929 E983000000              jmp 004229B1
:0042292E 8B75F8                  mov esi, dword ptr [ebp-08]
:00422931 81E6FF000000            and esi, 000000FF
:00422937 8B45F8                  mov eax, dword ptr [ebp-08]
:0042293A 25FF000000              and eax, 000000FF
:0042293F 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00422942 33D2                    xor edx, edx
:00422944 8A54010D                mov dl, byte ptr [ecx+eax+0D]
:00422948 8BCA                    mov ecx, edx
:0042294A 6BC924                  imul ecx, 00000024
:0042294D 81C1502C4B00            add ecx, 004B2C50
:00422953 E838030500              call 00472C90
:00422958 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0042295B 3984B184000000          cmp dword ptr [ecx+4*esi+00000084], eax
:00422962 7D21                    jge 00422985
:00422964 C645EC33                mov [ebp-14], 33
:00422968 8B55F8                  mov edx, dword ptr [ebp-08]
:0042296B 81E2FF000000            and edx, 000000FF
:00422971 8B45D4                  mov eax, dword ptr [ebp-2C]
:00422974 8A4C100D                mov cl, byte ptr [eax+edx+0D]
:00422978 51                      push ecx
:00422979 6A25                    push 00000025
:0042297B E8A5E4FFFF              call 00420E25
:00422980 83C408                  add esp, 00000008
:00422983 EB04                    jmp 00422989

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422962(C)
|
:00422985 C645ECFF                mov [ebp-14], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422983(U)
|
:00422989 EB26                    jmp 004229B1
:0042298B 8B55F8                  mov edx, dword ptr [ebp-08]
:0042298E 81E2FF000000            and edx, 000000FF
:00422994 8B45D4                  mov eax, dword ptr [ebp-2C]
:00422997 83BC908400000000        cmp dword ptr [eax+4*edx+00000084], 00000000
:0042299F 7506                    jne 004229A7
:004229A1 C645EC2D                mov [ebp-14], 2D
:004229A5 EB04                    jmp 004229AB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042299F(C)
|
:004229A7 C645ECFF                mov [ebp-14], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004229A5(U)
|
:004229AB EB04                    jmp 004229B1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042257D(C)
|
:004229AD C645ECFF                mov [ebp-14], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004225B4(U), :004225D8(U), :004225FC(U), :00422620(U), :00422695(U)
|:004226B9(U), :004226DD(U), :00422701(U), :00422725(U), :00422749(U)
|:004227BE(U), :004227E2(U), :0042280D(U), :0042286B(U), :004228CB(U)
|:00422929(U), :00422989(U), :004229AB(U)
|
:004229B1 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004229B4 81E1FF000000            and ecx, 000000FF
:004229BA 81F9FF000000            cmp ecx, 000000FF
:004229C0 0F8417010000            je 00422ADD
:004229C6 68004C0400              push 00044C00
:004229CB 6A04                    push 00000004
:004229CD 6A00                    push 00000000
:004229CF 6A00                    push 00000000
:004229D1 B9C8E44A00              mov ecx, 004AE4C8
:004229D6 E865D00500              call 0047FA40
:004229DB 50                      push eax
:004229DC 8A55EC                  mov dl, byte ptr [ebp-14]
:004229DF 52                      push edx

* Possible StringData Ref from Data Obj ->"MEFF.E5"
                                  |
:004229E0 68F8BB4800              push 0048BBF8
:004229E5 B9B0174900              mov ecx, 004917B0
:004229EA E809EBFDFF              call 004014F8
:004229EF 8B45F8                  mov eax, dword ptr [ebp-08]
:004229F2 25FF000000              and eax, 000000FF
:004229F7 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:004229FA 8A54010D                mov dl, byte ptr [ecx+eax+0D]
:004229FE 52                      push edx
:004229FF B9B0174900              mov ecx, 004917B0
:00422A04 E833F4FDFF              call 00401E3C
:00422A09 85C0                    test eax, eax
:00422A0B 740E                    je 00422A1B
:00422A0D 6A01                    push 00000001
:00422A0F 6A00                    push 00000000
:00422A11 B9B0174900              mov ecx, 004917B0
:00422A16 E841F4FDFF              call 00401E5C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422A0B(C)
|
:00422A1B B9B0174900              mov ecx, 004917B0
:00422A20 E886ECFDFF              call 004016AB
:00422A25 8B45F8                  mov eax, dword ptr [ebp-08]
:00422A28 25FF000000              and eax, 000000FF
:00422A2D 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00422A30 33D2                    xor edx, edx
:00422A32 8A54010D                mov dl, byte ptr [ecx+eax+0D]
:00422A36 8BCA                    mov ecx, edx
:00422A38 6BC924                  imul ecx, 00000024
:00422A3B 81C1502C4B00            add ecx, 004B2C50
:00422A41 E81A09FEFF              call 00403360
:00422A46 668B00                  mov ax, word ptr [eax]
:00422A49 50                      push eax
:00422A4A E82FD00200              call 0044FA7E
:00422A4F 83C404                  add esp, 00000004
:00422A52 8945D8                  mov dword ptr [ebp-28], eax
:00422A55 8955DC                  mov dword ptr [ebp-24], edx
:00422A58 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00422A5B 894DE4                  mov dword ptr [ebp-1C], ecx
:00422A5E 8B55DC                  mov edx, dword ptr [ebp-24]
:00422A61 8955E8                  mov dword ptr [ebp-18], edx
:00422A64 8B45F8                  mov eax, dword ptr [ebp-08]
:00422A67 25FF000000              and eax, 000000FF
:00422A6C 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00422A6F 33D2                    xor edx, edx
:00422A71 8A54010D                mov dl, byte ptr [ecx+eax+0D]
:00422A75 8BCA                    mov ecx, edx
:00422A77 6BC924                  imul ecx, 00000024
:00422A7A 81C1502C4B00            add ecx, 004B2C50
:00422A80 E8DB08FEFF              call 00403360
:00422A85 668B00                  mov ax, word ptr [eax]
:00422A88 50                      push eax
:00422A89 8D4DE0                  lea ecx, dword ptr [ebp-20]
:00422A8C 51                      push ecx
:00422A8D E88DCF0200              call 0044FA1F
:00422A92 83C408                  add esp, 00000008
:00422A95 E841BBFFFF              call 0041E5DB
:00422A9A 8B55E1                  mov edx, dword ptr [ebp-1F]
:00422A9D 81E2FF000000            and edx, 000000FF
:00422AA3 52                      push edx
:00422AA4 8B45E0                  mov eax, dword ptr [ebp-20]
:00422AA7 25FF000000              and eax, 000000FF
:00422AAC 50                      push eax
:00422AAD E8470CFEFF              call 004036F9
:00422AB2 83C408                  add esp, 00000008
:00422AB5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00422AB8 81E1FF000000            and ecx, 000000FF
:00422ABE 8B55D4                  mov edx, dword ptr [ebp-2C]
:00422AC1 33C0                    xor eax, eax
:00422AC3 8A440A0D                mov al, byte ptr [edx+ecx+0D]
:00422AC7 50                      push eax
:00422AC8 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00422ACB 51                      push ecx
:00422ACC 8B55E4                  mov edx, dword ptr [ebp-1C]
:00422ACF 52                      push edx
:00422AD0 E84AC00100              call 0043EB1F
:00422AD5 83C40C                  add esp, 0000000C
:00422AD8 E819BBFFFF              call 0041E5F6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004229C0(C)
|
:00422ADD 8B45F8                  mov eax, dword ptr [ebp-08]
:00422AE0 25FF000000              and eax, 000000FF
:00422AE5 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00422AE8 83BC818400000000        cmp dword ptr [ecx+4*eax+00000084], 00000000
:00422AF0 0F844A020000            je 00422D40
:00422AF6 8B55D4                  mov edx, dword ptr [ebp-2C]
:00422AF9 33C0                    xor eax, eax
:00422AFB 8A02                    mov al, byte ptr [edx]
:00422AFD 8945CC                  mov dword ptr [ebp-34], eax
:00422B00 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00422B03 83E916                  sub ecx, 00000016
:00422B06 894DCC                  mov dword ptr [ebp-34], ecx
:00422B09 837DCC28                cmp dword ptr [ebp-34], 00000028
:00422B0D 7762                    ja 00422B71
:00422B0F 8B45CC                  mov eax, dword ptr [ebp-34]
:00422B12 33D2                    xor edx, edx
:00422B14 8A90E42E4200            mov dl, byte ptr [eax+00422EE4]
:00422B1A FF2495D42E4200          jmp dword ptr [4*edx+00422ED4]
:00422B21 C745F000000000          mov [ebp-10], 00000000
:00422B28 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00422B2B 81E1FF000000            and ecx, 000000FF
:00422B31 8B55D4                  mov edx, dword ptr [ebp-2C]
:00422B34 8B848A84000000          mov eax, dword ptr [edx+4*ecx+00000084]
:00422B3B 8945F4                  mov dword ptr [ebp-0C], eax
:00422B3E E981000000              jmp 00422BC4
:00422B43 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00422B46 81E1FF000000            and ecx, 000000FF
:00422B4C 8B55D4                  mov edx, dword ptr [ebp-2C]
:00422B4F 8B848A88000000          mov eax, dword ptr [edx+4*ecx+00000088]
:00422B56 8945F0                  mov dword ptr [ebp-10], eax
:00422B59 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00422B5C 81E1FF000000            and ecx, 000000FF
:00422B62 8B55D4                  mov edx, dword ptr [ebp-2C]
:00422B65 8B848A84000000          mov eax, dword ptr [edx+4*ecx+00000084]
:00422B6C 8945F4                  mov dword ptr [ebp-0C], eax
:00422B6F EB53                    jmp 00422BC4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422B0D(C)
|
:00422B71 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00422B74 81E1FF000000            and ecx, 000000FF
:00422B7A 8B55D4                  mov edx, dword ptr [ebp-2C]
:00422B7D 8B848A84000000          mov eax, dword ptr [edx+4*ecx+00000084]
:00422B84 8945F0                  mov dword ptr [ebp-10], eax
:00422B87 C745F400000000          mov [ebp-0C], 00000000
:00422B8E 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00422B91 33D2                    xor edx, edx
:00422B93 8A510C                  mov dl, byte ptr [ecx+0C]
:00422B96 8BCA                    mov ecx, edx
:00422B98 6BC924                  imul ecx, 00000024
:00422B9B 81C1502C4B00            add ecx, 004B2C50
:00422BA1 E8EA000500              call 00472C90
:00422BA6 3945F0                  cmp dword ptr [ebp-10], eax
:00422BA9 7E19                    jle 00422BC4
:00422BAB 8B45D4                  mov eax, dword ptr [ebp-2C]
:00422BAE 33C9                    xor ecx, ecx
:00422BB0 8A480C                  mov cl, byte ptr [eax+0C]
:00422BB3 6BC924                  imul ecx, 00000024
:00422BB6 81C1502C4B00            add ecx, 004B2C50
:00422BBC E8CF000500              call 00472C90
:00422BC1 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00422B3E(U), :00422B6F(U), :00422BA9(C)
|
:00422BC4 8B55FC                  mov edx, dword ptr [ebp-04]
:00422BC7 52                      push edx
:00422BC8 8B45F8                  mov eax, dword ptr [ebp-08]
:00422BCB 25FF000000              and eax, 000000FF
:00422BD0 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00422BD3 8B9481D8020000          mov edx, dword ptr [ecx+4*eax+000002D8]
:00422BDA 52                      push edx
:00422BDB 6A00                    push 00000000
:00422BDD 6A00                    push 00000000
:00422BDF 8B45F4                  mov eax, dword ptr [ebp-0C]
:00422BE2 50                      push eax
:00422BE3 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00422BE6 51                      push ecx
:00422BE7 8B55D4                  mov edx, dword ptr [ebp-2C]
:00422BEA 8A4201                  mov al, byte ptr [edx+01]
:00422BED 50                      push eax
:00422BEE 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00422BF1 8A510C                  mov dl, byte ptr [ecx+0C]
:00422BF4 52                      push edx
:00422BF5 E88ADD0200              call 00450984
:00422BFA 83C420                  add esp, 00000020
:00422BFD 8B45D4                  mov eax, dword ptr [ebp-2C]
:00422C00 33C9                    xor ecx, ecx
:00422C02 8A480C                  mov cl, byte ptr [eax+0C]
:00422C05 6BC924                  imul ecx, 00000024
:00422C08 81C1502C4B00            add ecx, 004B2C50
:00422C0E E87D000500              call 00472C90
:00422C13 2B45F0                  sub eax, dword ptr [ebp-10]
:00422C16 50                      push eax
:00422C17 8B55D4                  mov edx, dword ptr [ebp-2C]
:00422C1A 33C0                    xor eax, eax
:00422C1C 8A420C                  mov al, byte ptr [edx+0C]
:00422C1F 8BC8                    mov ecx, eax
:00422C21 6BC924                  imul ecx, 00000024
:00422C24 81C1502C4B00            add ecx, 004B2C50
:00422C2A E89ECA0100              call 0043F6CD
:00422C2F 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00422C32 33D2                    xor edx, edx
:00422C34 8A510C                  mov dl, byte ptr [ecx+0C]
:00422C37 8BCA                    mov ecx, edx
:00422C39 6BC924                  imul ecx, 00000024
:00422C3C 81C1502C4B00            add ecx, 004B2C50
:00422C42 E8F9FB0400              call 00472840
:00422C47 2B45F4                  sub eax, dword ptr [ebp-0C]
:00422C4A 50                      push eax
:00422C4B 8B45D4                  mov eax, dword ptr [ebp-2C]
:00422C4E 33C9                    xor ecx, ecx
:00422C50 8A480C                  mov cl, byte ptr [eax+0C]
:00422C53 6BC924                  imul ecx, 00000024
:00422C56 81C1502C4B00            add ecx, 004B2C50
:00422C5C E8ADCA0100              call 0043F70E
:00422C61 837DF000                cmp dword ptr [ebp-10], 00000000
:00422C65 0F8ED3000000            jle 00422D3E
:00422C6B 8B55D4                  mov edx, dword ptr [ebp-2C]
:00422C6E 33C0                    xor eax, eax
:00422C70 8A420C                  mov al, byte ptr [edx+0C]
:00422C73 8BC8                    mov ecx, eax
:00422C75 6BC924                  imul ecx, 00000024
:00422C78 81C1502C4B00            add ecx, 004B2C50
:00422C7E E80D000500              call 00472C90
:00422C83 85C0                    test eax, eax
:00422C85 0F86B3000000            jbe 00422D3E
:00422C8B 6A3E                    push 0000003E
:00422C8D 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00422C90 33D2                    xor edx, edx
:00422C92 8A510C                  mov dl, byte ptr [ecx+0C]
:00422C95 8BCA                    mov ecx, edx
:00422C97 6BC924                  imul ecx, 00000024
:00422C9A 81C1502C4B00            add ecx, 004B2C50
:00422CA0 E8CBC90300              call 0045F670
:00422CA5 8BC8                    mov ecx, eax
:00422CA7 6BC948                  imul ecx, 00000048
:00422CAA 81C1681B4A00            add ecx, 004A1B68
:00422CB0 E8544DFEFF              call 00407A09
:00422CB5 85C0                    test eax, eax
:00422CB7 0F8481000000            je 00422D3E
:00422CBD 8B45D4                  mov eax, dword ptr [ebp-2C]
:00422CC0 33C9                    xor ecx, ecx
:00422CC2 8A480C                  mov cl, byte ptr [eax+0C]
:00422CC5 6BC924                  imul ecx, 00000024
:00422CC8 81C1502C4B00            add ecx, 004B2C50
:00422CCE E881D20100              call 0043FF54
:00422CD3 85C0                    test eax, eax
:00422CD5 7450                    je 00422D27
:00422CD7 837DF000                cmp dword ptr [ebp-10], 00000000
:00422CDB 7E48                    jle 00422D25
:00422CDD 8B55D4                  mov edx, dword ptr [ebp-2C]
:00422CE0 33C0                    xor eax, eax
:00422CE2 8A420C                  mov al, byte ptr [edx+0C]
:00422CE5 8BC8                    mov ecx, eax
:00422CE7 6BC924                  imul ecx, 00000024
:00422CEA 81C1502C4B00            add ecx, 004B2C50
:00422CF0 E89BFF0400              call 00472C90
:00422CF5 85C0                    test eax, eax
:00422CF7 762C                    jbe 00422D25
:00422CF9 6A57                    push 00000057
:00422CFB B970074B00              mov ecx, 004B0770
:00422D00 E839AEFEFF              call 0040DB3E
:00422D05 25FF000000              and eax, 000000FF
:00422D0A 85C0                    test eax, eax
:00422D0C 7E17                    jle 00422D25
:00422D0E 6A00                    push 00000000
:00422D10 6A00                    push 00000000
:00422D12 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00422D15 8A510C                  mov dl, byte ptr [ecx+0C]
:00422D18 52                      push edx
:00422D19 6A57                    push 00000057
:00422D1B B950774900              mov ecx, 00497750
:00422D20 E81EAFFFFF              call 0041DC43

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00422CDB(C), :00422CF7(C), :00422D0C(C)
|
:00422D25 EB17                    jmp 00422D3E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422CD5(C)
|
:00422D27 6A01                    push 00000001
:00422D29 6A00                    push 00000000
:00422D2B 8B45D4                  mov eax, dword ptr [ebp-2C]
:00422D2E 8A480C                  mov cl, byte ptr [eax+0C]
:00422D31 51                      push ecx
:00422D32 6A57                    push 00000057
:00422D34 B950774900              mov ecx, 00497750
:00422D39 E805AFFFFF              call 0041DC43

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00422C65(C), :00422C85(C), :00422CB7(C), :00422D25(U)
|
:00422D3E EB22                    jmp 00422D62

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422AF0(C)
|
:00422D40 8B55EC                  mov edx, dword ptr [ebp-14]
:00422D43 81E2FF000000            and edx, 000000FF
:00422D49 81FAFF000000            cmp edx, 000000FF
:00422D4F 7411                    je 00422D62
:00422D51 6A08                    push 00000008
:00422D53 B9181B4B00              mov ecx, 004B1B18
:00422D58 E8E305FEFF              call 00403340
:00422D5D E87E970000              call 0042C4E0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00422D3E(U), :00422D4F(C)
|
:00422D62 8B45F8                  mov eax, dword ptr [ebp-08]
:00422D65 25FF000000              and eax, 000000FF
:00422D6A 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00422D6D 8B9481D8020000          mov edx, dword ptr [ecx+4*eax+000002D8]
:00422D74 52                      push edx
:00422D75 6A01                    push 00000001
:00422D77 8B45D4                  mov eax, dword ptr [ebp-2C]
:00422D7A 33C9                    xor ecx, ecx
:00422D7C 8A480C                  mov cl, byte ptr [eax+0C]
:00422D7F 6BC924                  imul ecx, 00000024
:00422D82 81C1502C4B00            add ecx, 004B2C50
:00422D88 E8E3C80300              call 0045F670
:00422D8D 8BC8                    mov ecx, eax
:00422D8F 6BC948                  imul ecx, 00000048
:00422D92 81C1681B4A00            add ecx, 004A1B68
:00422D98 E83955FEFF              call 004082D6
:00422D9D 8B55D4                  mov edx, dword ptr [ebp-2C]
:00422DA0 33C0                    xor eax, eax
:00422DA2 8A420C                  mov al, byte ptr [edx+0C]
:00422DA5 8BC8                    mov ecx, eax
:00422DA7 6BC924                  imul ecx, 00000024
:00422DAA 81C1502C4B00            add ecx, 004B2C50
:00422DB0 E8BBC80300              call 0045F670
:00422DB5 50                      push eax
:00422DB6 E8466C0500              call 00479A01
:00422DBB 83C404                  add esp, 00000004
:00422DBE E94EF7FFFF              jmp 00422511

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422531(C)
|
:00422DC3 5E                      pop esi
:00422DC4 8BE5                    mov esp, ebp
:00422DC6 5D                      pop ebp
:00422DC7 C3                      ret



:00422DC8 8B294200                DWORD 0042298B
:00422DCC BE264200                DWORD 004226BE
:00422DD0 E2264200                DWORD 004226E2
:00422DD4 06274200                DWORD 00422706
:00422DD8 2A274200                DWORD 0042272A
:00422DDC 4E274200                DWORD 0042274E
:00422DE0 70284200                DWORD 00422870
:00422DE4 12284200                DWORD 00422812
:00422DE8 D0284200                DWORD 004228D0
:00422DEC 2E294200                DWORD 0042292E
:00422DF0 95254200                DWORD 00422595
:00422DF4 B9254200                DWORD 004225B9
:00422DF8 DD254200                DWORD 004225DD
:00422DFC 01264200                DWORD 00422601
:00422E00 9A264200                DWORD 0042269A
:00422E04 25264200                DWORD 00422625
:00422E08 E7274200                DWORD 004227E7
:00422E0C C3274200                DWORD 004227C3
:00422E10 AD294200                DWORD 004229AD


:00422E14 0012                    add byte ptr [edx], dl
:00422E16 1212                    adc dl, byte ptr [edx]
:00422E18 1212                    adc dl, byte ptr [edx]
:00422E1A 1212                    adc dl, byte ptr [edx]
:00422E1C 1212                    adc dl, byte ptr [edx]
:00422E1E 1212                    adc dl, byte ptr [edx]
:00422E20 1212                    adc dl, byte ptr [edx]
:00422E22 1212                    adc dl, byte ptr [edx]
:00422E24 1212                    adc dl, byte ptr [edx]
:00422E26 1212                    adc dl, byte ptr [edx]
:00422E28 1212                    adc dl, byte ptr [edx]
:00422E2A 1212                    adc dl, byte ptr [edx]
:00422E2C 1212                    adc dl, byte ptr [edx]
:00422E2E 1212                    adc dl, byte ptr [edx]
:00422E30 1212                    adc dl, byte ptr [edx]
:00422E32 1212                    adc dl, byte ptr [edx]
:00422E34 1212                    adc dl, byte ptr [edx]
:00422E36 1212                    adc dl, byte ptr [edx]
:00422E38 1212                    adc dl, byte ptr [edx]
:00422E3A 1212                    adc dl, byte ptr [edx]
:00422E3C 1212                    adc dl, byte ptr [edx]
:00422E3E 1212                    adc dl, byte ptr [edx]
:00422E40 1212                    adc dl, byte ptr [edx]
:00422E42 1212                    adc dl, byte ptr [edx]
:00422E44 1212                    adc dl, byte ptr [edx]
:00422E46 1212                    adc dl, byte ptr [edx]
:00422E48 1212                    adc dl, byte ptr [edx]
:00422E4A 1212                    adc dl, byte ptr [edx]
:00422E4C 1212                    adc dl, byte ptr [edx]
:00422E4E 1212                    adc dl, byte ptr [edx]
:00422E50 1212                    adc dl, byte ptr [edx]
:00422E52 1212                    adc dl, byte ptr [edx]
:00422E54 1212                    adc dl, byte ptr [edx]
:00422E56 1212                    adc dl, byte ptr [edx]
:00422E58 1212                    adc dl, byte ptr [edx]
:00422E5A 1212                    adc dl, byte ptr [edx]
:00422E5C 1212                    adc dl, byte ptr [edx]
:00422E5E 1212                    adc dl, byte ptr [edx]
:00422E60 1212                    adc dl, byte ptr [edx]
:00422E62 1212                    adc dl, byte ptr [edx]
:00422E64 1212                    adc dl, byte ptr [edx]
:00422E66 1212                    adc dl, byte ptr [edx]
:00422E68 1212                    adc dl, byte ptr [edx]
:00422E6A 1212                    adc dl, byte ptr [edx]
:00422E6C 1212                    adc dl, byte ptr [edx]
:00422E6E 1212                    adc dl, byte ptr [edx]
:00422E70 1212                    adc dl, byte ptr [edx]
:00422E72 1212                    adc dl, byte ptr [edx]
:00422E74 0102                    add dword ptr [edx], eax
:00422E76 0312                    add edx, dword ptr [edx]
:00422E78 0412                    add al, 12
:00422E7A 1212                    adc dl, byte ptr [edx]
:00422E7C 1212                    adc dl, byte ptr [edx]
:00422E7E 1212                    adc dl, byte ptr [edx]
:00422E80 1212                    adc dl, byte ptr [edx]
:00422E82 120506070812            adc al, byte ptr [12080706]
:00422E88 0912                    or dword ptr [edx], edx
:00422E8A 1212                    adc dl, byte ptr [edx]
:00422E8C 1212                    adc dl, byte ptr [edx]
:00422E8E 1212                    adc dl, byte ptr [edx]
:00422E90 1212                    adc dl, byte ptr [edx]
:00422E92 1212                    adc dl, byte ptr [edx]
:00422E94 1212                    adc dl, byte ptr [edx]
:00422E96 1212                    adc dl, byte ptr [edx]
:00422E98 1212                    adc dl, byte ptr [edx]
:00422E9A 1212                    adc dl, byte ptr [edx]
:00422E9C 1212                    adc dl, byte ptr [edx]
:00422E9E 1212                    adc dl, byte ptr [edx]
:00422EA0 1212                    adc dl, byte ptr [edx]
:00422EA2 1212                    adc dl, byte ptr [edx]
:00422EA4 1212                    adc dl, byte ptr [edx]
:00422EA6 1212                    adc dl, byte ptr [edx]
:00422EA8 1212                    adc dl, byte ptr [edx]
:00422EAA 1212                    adc dl, byte ptr [edx]
:00422EAC 1212                    adc dl, byte ptr [edx]
:00422EAE 1212                    adc dl, byte ptr [edx]
:00422EB0 1212                    adc dl, byte ptr [edx]
:00422EB2 1212                    adc dl, byte ptr [edx]
:00422EB4 0A0B                    or cl, byte ptr [ebx]
:00422EB6 0C12                    or al, 12
:00422EB8 0D1212120E              or eax, 0E121212
:00422EBD 1212                    adc dl, byte ptr [edx]
:00422EBF 1212                    adc dl, byte ptr [edx]
:00422EC1 1212                    adc dl, byte ptr [edx]
:00422EC3 0F                      BYTE 0fh
:00422EC4 1212                    adc dl, byte ptr [edx]
:00422EC6 1212                    adc dl, byte ptr [edx]
:00422EC8 1212                    adc dl, byte ptr [edx]
:00422ECA 1212                    adc dl, byte ptr [edx]
:00422ECC 1012                    adc byte ptr [edx], dl
:00422ECE 1212                    adc dl, byte ptr [edx]
:00422ED0 1212                    adc dl, byte ptr [edx]
:00422ED2 1211                    adc dl, byte ptr [ecx]

:00422ED4 212B4200                DWORD 00422B21
:00422ED8 212B4200                DWORD 00422B21
:00422EDC 432B4200                DWORD 00422B43
:00422EE0 712B4200                DWORD 00422B71


:00422EE4 0003                    add byte ptr [ebx], al
:00422EE6 0303                    add eax, dword ptr [ebx]
:00422EE8 0303                    add eax, dword ptr [ebx]
:00422EEA 0303                    add eax, dword ptr [ebx]
:00422EEC 0303                    add eax, dword ptr [ebx]
:00422EEE 0303                    add eax, dword ptr [ebx]
:00422EF0 0303                    add eax, dword ptr [ebx]
:00422EF2 0303                    add eax, dword ptr [ebx]
:00422EF4 0303                    add eax, dword ptr [ebx]
:00422EF6 0303                    add eax, dword ptr [ebx]
:00422EF8 0303                    add eax, dword ptr [ebx]
:00422EFA 0101                    add dword ptr [ecx], eax
:00422EFC 0303                    add eax, dword ptr [ebx]
:00422EFE 0303                    add eax, dword ptr [ebx]
:00422F00 0303                    add eax, dword ptr [ebx]
:00422F02 0303                    add eax, dword ptr [ebx]
:00422F04 0303                    add eax, dword ptr [ebx]
:00422F06 0303                    add eax, dword ptr [ebx]
:00422F08 0303                    add eax, dword ptr [ebx]
:00422F0A 0303                    add eax, dword ptr [ebx]
:00422F0C 02                      BYTE 02h


* Referenced by a CALL at Address:
|:004259AF   
|

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422EE0(C)
|
:00422F0D 55                      push ebp
:00422F0E 8BEC                    mov ebp, esp
:00422F10 83EC20                  sub esp, 00000020
:00422F13 56                      push esi
:00422F14 894DEC                  mov dword ptr [ebp-14], ecx
:00422F17 8B45EC                  mov eax, dword ptr [ebp-14]
:00422F1A 83B8AC04000000          cmp dword ptr [eax+000004AC], 00000000
:00422F21 0F8412020000            je 00423139
:00422F27 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00422F2A 33D2                    xor edx, edx
:00422F2C 8A11                    mov dl, byte ptr [ecx]
:00422F2E 8BCA                    mov ecx, edx
:00422F30 6BC946                  imul ecx, 00000046
:00422F33 81C1C0F44A00            add ecx, 004AF4C0
:00422F39 E8922B0000              call 00425AD0
:00422F3E 25FF000000              and eax, 000000FF
:00422F43 8945F8                  mov dword ptr [ebp-08], eax
:00422F46 6A31                    push 00000031
:00422F48 8B45EC                  mov eax, dword ptr [ebp-14]
:00422F4B 8B4804                  mov ecx, dword ptr [eax+04]
:00422F4E E8B64AFEFF              call 00407A09
:00422F53 85C0                    test eax, eax
:00422F55 741E                    je 00422F75
:00422F57 6A31                    push 00000031
:00422F59 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00422F5C 8B4904                  mov ecx, dword ptr [ecx+04]
:00422F5F E88E4BFEFF              call 00407AF2
:00422F64 8AC8                    mov cl, al
:00422F66 81E1FF000000            and ecx, 000000FF
:00422F6C 8B45F8                  mov eax, dword ptr [ebp-08]
:00422F6F 99                      cdq
:00422F70 F7F9                    idiv ecx
:00422F72 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422F55(C)
|
:00422F75 8B55F8                  mov edx, dword ptr [ebp-08]
:00422F78 52                      push edx
:00422F79 8B45EC                  mov eax, dword ptr [ebp-14]
:00422F7C 8B4808                  mov ecx, dword ptr [eax+08]
:00422F7F E8BCF80400              call 00472840
:00422F84 50                      push eax
:00422F85 E814CB0500              call 0047FA9E
:00422F8A 83C408                  add esp, 00000008
:00422F8D 8945FC                  mov dword ptr [ebp-04], eax
:00422F90 C745F000000000          mov [ebp-10], 00000000
:00422F97 C745F400000000          mov [ebp-0C], 00000000
:00422F9E 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00422FA1 8A11                    mov dl, byte ptr [ecx]
:00422FA3 8855E8                  mov byte ptr [ebp-18], dl
:00422FA6 807DE814                cmp byte ptr [ebp-18], 14
:00422FAA 740B                    je 00422FB7
:00422FAC 807DE816                cmp byte ptr [ebp-18], 16
:00422FB0 7465                    je 00423017
:00422FB2 E9B2000000              jmp 00423069

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422FAA(C)
|
:00422FB7 8B45EC                  mov eax, dword ptr [ebp-14]
:00422FBA 8B4804                  mov ecx, dword ptr [eax+04]
:00422FBD E85942FEFF              call 0040721B
:00422FC2 8BF0                    mov esi, eax
:00422FC4 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00422FC7 8B4908                  mov ecx, dword ptr [ecx+08]
:00422FCA E8C1FC0400              call 00472C90
:00422FCF 2BF0                    sub esi, eax
:00422FD1 8B55EC                  mov edx, dword ptr [ebp-14]
:00422FD4 39B284000000            cmp dword ptr [edx+00000084], esi
:00422FDA 7D0E                    jge 00422FEA
:00422FDC 8B45EC                  mov eax, dword ptr [ebp-14]
:00422FDF 8B8884000000            mov ecx, dword ptr [eax+00000084]
:00422FE5 894DE4                  mov dword ptr [ebp-1C], ecx
:00422FE8 EB1D                    jmp 00423007

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422FDA(C)
|
:00422FEA 8B55EC                  mov edx, dword ptr [ebp-14]
:00422FED 8B4A04                  mov ecx, dword ptr [edx+04]
:00422FF0 E82642FEFF              call 0040721B
:00422FF5 8BF0                    mov esi, eax
:00422FF7 8B45EC                  mov eax, dword ptr [ebp-14]
:00422FFA 8B4808                  mov ecx, dword ptr [eax+08]
:00422FFD E88EFC0400              call 00472C90
:00423002 2BF0                    sub esi, eax
:00423004 8975E4                  mov dword ptr [ebp-1C], esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422FE8(U)
|
:00423007 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0042300A 894DF0                  mov dword ptr [ebp-10], ecx
:0042300D 8B55F8                  mov edx, dword ptr [ebp-08]
:00423010 F7DA                    neg edx
:00423012 8955F4                  mov dword ptr [ebp-0C], edx
:00423015 EB5A                    jmp 00423071

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422FB0(C)
|
:00423017 8B45EC                  mov eax, dword ptr [ebp-14]
:0042301A 8B4804                  mov ecx, dword ptr [eax+04]
:0042301D E82842FEFF              call 0040724A
:00423022 2B45FC                  sub eax, dword ptr [ebp-04]
:00423025 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00423028 398184000000            cmp dword ptr [ecx+00000084], eax
:0042302E 7D0E                    jge 0042303E
:00423030 8B55EC                  mov edx, dword ptr [ebp-14]
:00423033 8B8284000000            mov eax, dword ptr [edx+00000084]
:00423039 8945E0                  mov dword ptr [ebp-20], eax
:0042303C EB11                    jmp 0042304F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042302E(C)
|
:0042303E 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00423041 8B4904                  mov ecx, dword ptr [ecx+04]
:00423044 E80142FEFF              call 0040724A
:00423049 2B45FC                  sub eax, dword ptr [ebp-04]
:0042304C 8945E0                  mov dword ptr [ebp-20], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042303C(U)
|
:0042304F 8B55E0                  mov edx, dword ptr [ebp-20]
:00423052 8955F4                  mov dword ptr [ebp-0C], edx
:00423055 8B45FC                  mov eax, dword ptr [ebp-04]
:00423058 0345F4                  add eax, dword ptr [ebp-0C]
:0042305B 8945FC                  mov dword ptr [ebp-04], eax
:0042305E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00423061 2B4DF8                  sub ecx, dword ptr [ebp-08]
:00423064 894DF4                  mov dword ptr [ebp-0C], ecx
:00423067 EB08                    jmp 00423071

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422FB2(U)
|
:00423069 8B55F8                  mov edx, dword ptr [ebp-08]
:0042306C F7DA                    neg edx
:0042306E 8955F4                  mov dword ptr [ebp-0C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00423015(U), :00423067(U)
|
:00423071 6A01                    push 00000001
:00423073 8B45EC                  mov eax, dword ptr [ebp-14]
:00423076 8A4801                  mov cl, byte ptr [eax+01]
:00423079 51                      push ecx
:0042307A B950424B00              mov ecx, 004B4250
:0042307F E88C1E0300              call 00454F10
:00423084 6A01                    push 00000001
:00423086 6A00                    push 00000000
:00423088 8B55EC                  mov edx, dword ptr [ebp-14]
:0042308B 8B82D4020000            mov eax, dword ptr [edx+000002D4]
:00423091 50                      push eax
:00423092 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00423095 8B91D0020000            mov edx, dword ptr [ecx+000002D0]
:0042309B 52                      push edx
:0042309C 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042309F F7D8                    neg eax
:004230A1 50                      push eax
:004230A2 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004230A5 F7D9                    neg ecx
:004230A7 51                      push ecx
:004230A8 8B55EC                  mov edx, dword ptr [ebp-14]
:004230AB 8A420C                  mov al, byte ptr [edx+0C]
:004230AE 50                      push eax
:004230AF 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004230B2 8A5101                  mov dl, byte ptr [ecx+01]
:004230B5 52                      push edx
:004230B6 E8C9D80200              call 00450984
:004230BB 83C420                  add esp, 00000020
:004230BE 8B45EC                  mov eax, dword ptr [ebp-14]
:004230C1 8B4808                  mov ecx, dword ptr [eax+08]
:004230C4 E8C7FB0400              call 00472C90
:004230C9 0345F0                  add eax, dword ptr [ebp-10]
:004230CC 50                      push eax
:004230CD 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004230D0 8B4908                  mov ecx, dword ptr [ecx+08]
:004230D3 E8F5C50100              call 0043F6CD
:004230D8 8B55FC                  mov edx, dword ptr [ebp-04]
:004230DB 52                      push edx
:004230DC 8B45EC                  mov eax, dword ptr [ebp-14]
:004230DF 8B4808                  mov ecx, dword ptr [eax+08]
:004230E2 E827C60100              call 0043F70E
:004230E7 6A01                    push 00000001
:004230E9 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004230EC 8B4904                  mov ecx, dword ptr [ecx+04]
:004230EF E85C35FEFF              call 00406650
:004230F4 25FF000000              and eax, 000000FF
:004230F9 8B55EC                  mov edx, dword ptr [ebp-14]
:004230FC 0382D0020000            add eax, dword ptr [edx+000002D0]
:00423102 50                      push eax
:00423103 8B45EC                  mov eax, dword ptr [ebp-14]
:00423106 8B4804                  mov ecx, dword ptr [eax+04]
:00423109 E84258FEFF              call 00408950
:0042310E 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00423111 8B91D4020000            mov edx, dword ptr [ecx+000002D4]
:00423117 52                      push edx
:00423118 6A00                    push 00000000
:0042311A 8B45EC                  mov eax, dword ptr [ebp-14]
:0042311D 8B4804                  mov ecx, dword ptr [eax+04]
:00423120 E8B151FEFF              call 004082D6
:00423125 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00423128 8B4908                  mov ecx, dword ptr [ecx+08]
:0042312B E840C50300              call 0045F670
:00423130 50                      push eax
:00423131 E8CB680500              call 00479A01
:00423136 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00422F21(C)
|
:00423139 5E                      pop esi
:0042313A 8BE5                    mov esp, ebp
:0042313C 5D                      pop ebp
:0042313D C3                      ret



* Referenced by a CALL at Addresses:
|:0042570B   , :00425722   
|
:0042313E 55                      push ebp
:0042313F 8BEC                    mov ebp, esp
:00423141 83EC10                  sub esp, 00000010
:00423144 894DF8                  mov dword ptr [ebp-08], ecx
:00423147 8B45F8                  mov eax, dword ptr [ebp-08]
:0042314A 8A08                    mov cl, byte ptr [eax]
:0042314C 51                      push ecx
:0042314D 6A02                    push 00000002
:0042314F 8B55F8                  mov edx, dword ptr [ebp-08]
:00423152 8A82C9020000            mov al, byte ptr [edx+000002C9]
:00423158 50                      push eax
:00423159 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042315C 8A5101                  mov dl, byte ptr [ecx+01]
:0042315F 52                      push edx
:00423160 B950424B00              mov ecx, 004B4250
:00423165 E8D3210300              call 0045533D
:0042316A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042316D 88410C                  mov byte ptr [ecx+0C], al
:00423170 8B55F8                  mov edx, dword ptr [ebp-08]
:00423173 33C0                    xor eax, eax
:00423175 8A420C                  mov al, byte ptr [edx+0C]
:00423178 3DFF000000              cmp eax, 000000FF
:0042317D 7505                    jne 00423184
:0042317F E9D3010000              jmp 00423357

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042317D(C)
|
:00423184 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423187 8B91A8040000            mov edx, dword ptr [ecx+000004A8]
:0042318D 52                      push edx
:0042318E 8B45F8                  mov eax, dword ptr [ebp-08]
:00423191 8A480C                  mov cl, byte ptr [eax+0C]
:00423194 51                      push ecx
:00423195 8B55F8                  mov edx, dword ptr [ebp-08]
:00423198 8A4201                  mov al, byte ptr [edx+01]
:0042319B 50                      push eax
:0042319C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042319F 8A11                    mov dl, byte ptr [ecx]
:004231A1 52                      push edx
:004231A2 E87BD2FFFF              call 00420422
:004231A7 83C410                  add esp, 00000010
:004231AA 85C0                    test eax, eax
:004231AC 7505                    jne 004231B3
:004231AE E9A4010000              jmp 00423357

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004231AC(C)
|
:004231B3 6A00                    push 00000000
:004231B5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004231B8 E88C210000              call 00425349
:004231BD C645FC00                mov [ebp-04], 00
:004231C1 EB08                    jmp 004231CB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423335(U)
|
:004231C3 8A45FC                  mov al, byte ptr [ebp-04]
:004231C6 0401                    add al, 01
:004231C8 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004231C1(U)
|
:004231CB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004231CE 81E1FF000000            and ecx, 000000FF
:004231D4 8B55F8                  mov edx, dword ptr [ebp-08]
:004231D7 33C0                    xor eax, eax
:004231D9 8A440A0D                mov al, byte ptr [edx+ecx+0D]
:004231DD 3DFF000000              cmp eax, 000000FF
:004231E2 0F8452010000            je 0042333A
:004231E8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004231EB 81E1FF000000            and ecx, 000000FF
:004231F1 8B55F8                  mov edx, dword ptr [ebp-08]
:004231F4 8B45F8                  mov eax, dword ptr [ebp-08]
:004231F7 8A4C080D                mov cl, byte ptr [eax+ecx+0D]
:004231FB 884A0C                  mov byte ptr [edx+0C], cl
:004231FE 6A00                    push 00000000
:00423200 8B55F8                  mov edx, dword ptr [ebp-08]
:00423203 8A02                    mov al, byte ptr [edx]
:00423205 50                      push eax
:00423206 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423209 33D2                    xor edx, edx
:0042320B 8A510C                  mov dl, byte ptr [ecx+0C]
:0042320E 8BCA                    mov ecx, edx
:00423210 6BC924                  imul ecx, 00000024
:00423213 81C1502C4B00            add ecx, 004B2C50
:00423219 E852C40300              call 0045F670
:0042321E 6BC048                  imul eax, 00000048
:00423221 05681B4A00              add eax, 004A1B68
:00423226 50                      push eax
:00423227 8B45F8                  mov eax, dword ptr [ebp-08]
:0042322A 33C9                    xor ecx, ecx
:0042322C 8A480C                  mov cl, byte ptr [eax+0C]
:0042322F 6BC924                  imul ecx, 00000024
:00423232 81C1502C4B00            add ecx, 004B2C50
:00423238 51                      push ecx
:00423239 8B55F8                  mov edx, dword ptr [ebp-08]
:0042323C 8B4A08                  mov ecx, dword ptr [edx+08]
:0042323F E8668D0100              call 0043BFAA
:00423244 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00423247 81E1FF000000            and ecx, 000000FF
:0042324D 8B55F8                  mov edx, dword ptr [ebp-08]
:00423250 89848A84000000          mov dword ptr [edx+4*ecx+00000084], eax
:00423257 8B45FC                  mov eax, dword ptr [ebp-04]
:0042325A 25FF000000              and eax, 000000FF
:0042325F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423262 83BC818400000000        cmp dword ptr [ecx+4*eax+00000084], 00000000
:0042326A 7516                    jne 00423282
:0042326C 8B55FC                  mov edx, dword ptr [ebp-04]
:0042326F 81E2FF000000            and edx, 000000FF
:00423275 8B45F8                  mov eax, dword ptr [ebp-08]
:00423278 C684105502000000        mov byte ptr [eax+edx+00000255], 00
:00423280 EB1C                    jmp 0042329E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042326A(C)
|
:00423282 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00423285 81E1FF000000            and ecx, 000000FF
:0042328B 8B55F8                  mov edx, dword ptr [ebp-08]
:0042328E 8B45F8                  mov eax, dword ptr [ebp-08]
:00423291 8A8054020000            mov al, byte ptr [eax+00000254]
:00423297 88840A55020000          mov byte ptr [edx+ecx+00000255], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423280(U)
|
:0042329E 8A4DFC                  mov cl, byte ptr [ebp-04]
:004232A1 51                      push ecx
:004232A2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004232A5 E851DCFFFF              call 00420EFB
:004232AA 8B55F8                  mov edx, dword ptr [ebp-08]
:004232AD 3B82D0020000            cmp eax, dword ptr [edx+000002D0]
:004232B3 7611                    jbe 004232C6
:004232B5 8A45FC                  mov al, byte ptr [ebp-04]
:004232B8 50                      push eax
:004232B9 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004232BC E83ADCFFFF              call 00420EFB
:004232C1 8945F4                  mov dword ptr [ebp-0C], eax
:004232C4 EB0C                    jmp 004232D2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004232B3(C)
|
:004232C6 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004232C9 8B91D0020000            mov edx, dword ptr [ecx+000002D0]
:004232CF 8955F4                  mov dword ptr [ebp-0C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004232C4(U)
|
:004232D2 8B45F8                  mov eax, dword ptr [ebp-08]
:004232D5 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004232D8 8988D0020000            mov dword ptr [eax+000002D0], ecx
:004232DE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004232E1 E8A5DFFFFF              call 0042128B
:004232E6 8B55F8                  mov edx, dword ptr [ebp-08]
:004232E9 3B82D4020000            cmp eax, dword ptr [edx+000002D4]
:004232EF 760D                    jbe 004232FE
:004232F1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004232F4 E892DFFFFF              call 0042128B
:004232F9 8945F0                  mov dword ptr [ebp-10], eax
:004232FC EB0C                    jmp 0042330A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004232EF(C)
|
:004232FE 8B45F8                  mov eax, dword ptr [ebp-08]
:00423301 8B88D4020000            mov ecx, dword ptr [eax+000002D4]
:00423307 894DF0                  mov dword ptr [ebp-10], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004232FC(U)
|
:0042330A 8B55F8                  mov edx, dword ptr [ebp-08]
:0042330D 8B45F0                  mov eax, dword ptr [ebp-10]
:00423310 8982D4020000            mov dword ptr [edx+000002D4], eax
:00423316 8A4DFC                  mov cl, byte ptr [ebp-04]
:00423319 51                      push ecx
:0042331A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042331D E881E0FFFF              call 004213A3
:00423322 8B55FC                  mov edx, dword ptr [ebp-04]
:00423325 81E2FF000000            and edx, 000000FF
:0042332B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042332E 898491D8020000          mov dword ptr [ecx+4*edx+000002D8], eax
:00423335 E989FEFFFF              jmp 004231C3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004231E2(C)
|
:0042333A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042333D E87DE1FFFF              call 004214BF
:00423342 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423345 E85EF1FFFF              call 004224A8
:0042334A 8B55F8                  mov edx, dword ptr [ebp-08]
:0042334D C782AC04000001000000    mov dword ptr [ebx+000004AC], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042317F(U), :004231AE(U)
|
:00423357 8BE5                    mov esp, ebp
:00423359 5D                      pop ebp
:0042335A C3                      ret



* Referenced by a CALL at Addresses:
|:00425752   , :0042576B   , :00425784   , :0042579D   , :00425848   
|:00425861   , :0042587A   , :00425893   , :004258AC   
|
:0042335B 55                      push ebp
:0042335C 8BEC                    mov ebp, esp
:0042335E 83EC10                  sub esp, 00000010
:00423361 894DF8                  mov dword ptr [ebp-08], ecx
:00423364 8B45F8                  mov eax, dword ptr [ebp-08]
:00423367 8A08                    mov cl, byte ptr [eax]
:00423369 51                      push ecx
:0042336A 33D2                    xor edx, edx
:0042336C 837D0800                cmp dword ptr [ebp+08], 00000000
:00423370 0F95C2                  setne dl
:00423373 83C202                  add edx, 00000002
:00423376 52                      push edx
:00423377 8B45F8                  mov eax, dword ptr [ebp-08]
:0042337A 8A88C9020000            mov cl, byte ptr [eax+000002C9]
:00423380 51                      push ecx
:00423381 8B55F8                  mov edx, dword ptr [ebp-08]
:00423384 8A4201                  mov al, byte ptr [edx+01]
:00423387 50                      push eax
:00423388 B950424B00              mov ecx, 004B4250
:0042338D E8AB1F0300              call 0045533D
:00423392 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423395 88410C                  mov byte ptr [ecx+0C], al
:00423398 8B55F8                  mov edx, dword ptr [ebp-08]
:0042339B 33C0                    xor eax, eax
:0042339D 8A420C                  mov al, byte ptr [edx+0C]
:004233A0 3DFF000000              cmp eax, 000000FF
:004233A5 7505                    jne 004233AC
:004233A7 E997010000              jmp 00423543

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004233A5(C)
|
:004233AC 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004233AF 8B91A8040000            mov edx, dword ptr [ecx+000004A8]
:004233B5 52                      push edx
:004233B6 8B45F8                  mov eax, dword ptr [ebp-08]
:004233B9 8A480C                  mov cl, byte ptr [eax+0C]
:004233BC 51                      push ecx
:004233BD 8B55F8                  mov edx, dword ptr [ebp-08]
:004233C0 8A4201                  mov al, byte ptr [edx+01]
:004233C3 50                      push eax
:004233C4 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004233C7 8A11                    mov dl, byte ptr [ecx]
:004233C9 52                      push edx
:004233CA E853D0FFFF              call 00420422
:004233CF 83C410                  add esp, 00000010
:004233D2 85C0                    test eax, eax
:004233D4 7505                    jne 004233DB
:004233D6 E968010000              jmp 00423543

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004233D4(C)
|
:004233DB 33C0                    xor eax, eax
:004233DD 837D0800                cmp dword ptr [ebp+08], 00000000
:004233E1 0F95C0                  setne al
:004233E4 50                      push eax
:004233E5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004233E8 E85C1F0000              call 00425349
:004233ED C645FC00                mov [ebp-04], 00
:004233F1 EB09                    jmp 004233FC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423521(U)
|
:004233F3 8A4DFC                  mov cl, byte ptr [ebp-04]
:004233F6 80C101                  add cl, 01
:004233F9 884DFC                  mov byte ptr [ebp-04], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004233F1(U)
|
:004233FC 8B55FC                  mov edx, dword ptr [ebp-04]
:004233FF 81E2FF000000            and edx, 000000FF
:00423405 8B45F8                  mov eax, dword ptr [ebp-08]
:00423408 33C9                    xor ecx, ecx
:0042340A 8A4C100D                mov cl, byte ptr [eax+edx+0D]
:0042340E 81F9FF000000            cmp ecx, 000000FF
:00423414 0F840C010000            je 00423526
:0042341A 8B55FC                  mov edx, dword ptr [ebp-04]
:0042341D 81E2FF000000            and edx, 000000FF
:00423423 8B45F8                  mov eax, dword ptr [ebp-08]
:00423426 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423429 8A54110D                mov dl, byte ptr [ecx+edx+0D]
:0042342D 88500C                  mov byte ptr [eax+0C], dl
:00423430 8B45F8                  mov eax, dword ptr [ebp-08]
:00423433 8A08                    mov cl, byte ptr [eax]
:00423435 51                      push ecx
:00423436 6A02                    push 00000002
:00423438 8B55F8                  mov edx, dword ptr [ebp-08]
:0042343B 33C0                    xor eax, eax
:0042343D 8A420C                  mov al, byte ptr [edx+0C]
:00423440 6BC024                  imul eax, 00000024
:00423443 05502C4B00              add eax, 004B2C50
:00423448 50                      push eax
:00423449 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042344C 8B4908                  mov ecx, dword ptr [ecx+08]
:0042344F E85C800100              call 0043B4B0
:00423454 85C0                    test eax, eax
:00423456 741E                    je 00423476
:00423458 8B55FC                  mov edx, dword ptr [ebp-04]
:0042345B 81E2FF000000            and edx, 000000FF
:00423461 8B45F8                  mov eax, dword ptr [ebp-08]
:00423464 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423467 8A8954020000            mov cl, byte ptr [ecx+00000254]
:0042346D 888C1055020000          mov byte ptr [eax+edx+00000255], cl
:00423474 EB14                    jmp 0042348A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423456(C)
|
:00423476 8B55FC                  mov edx, dword ptr [ebp-04]
:00423479 81E2FF000000            and edx, 000000FF
:0042347F 8B45F8                  mov eax, dword ptr [ebp-08]
:00423482 C684105502000000        mov byte ptr [eax+edx+00000255], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423474(U)
|
:0042348A 8A4DFC                  mov cl, byte ptr [ebp-04]
:0042348D 51                      push ecx
:0042348E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423491 E865DAFFFF              call 00420EFB
:00423496 8B55F8                  mov edx, dword ptr [ebp-08]
:00423499 3B82D0020000            cmp eax, dword ptr [edx+000002D0]
:0042349F 7611                    jbe 004234B2
:004234A1 8A45FC                  mov al, byte ptr [ebp-04]
:004234A4 50                      push eax
:004234A5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004234A8 E84EDAFFFF              call 00420EFB
:004234AD 8945F4                  mov dword ptr [ebp-0C], eax
:004234B0 EB0C                    jmp 004234BE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042349F(C)
|
:004234B2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004234B5 8B91D0020000            mov edx, dword ptr [ecx+000002D0]
:004234BB 8955F4                  mov dword ptr [ebp-0C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004234B0(U)
|
:004234BE 8B45F8                  mov eax, dword ptr [ebp-08]
:004234C1 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004234C4 8988D0020000            mov dword ptr [eax+000002D0], ecx
:004234CA 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004234CD E8B9DDFFFF              call 0042128B
:004234D2 8B55F8                  mov edx, dword ptr [ebp-08]
:004234D5 3B82D4020000            cmp eax, dword ptr [edx+000002D4]
:004234DB 760D                    jbe 004234EA
:004234DD 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004234E0 E8A6DDFFFF              call 0042128B
:004234E5 8945F0                  mov dword ptr [ebp-10], eax
:004234E8 EB0C                    jmp 004234F6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004234DB(C)
|
:004234EA 8B45F8                  mov eax, dword ptr [ebp-08]
:004234ED 8B88D4020000            mov ecx, dword ptr [eax+000002D4]
:004234F3 894DF0                  mov dword ptr [ebp-10], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004234E8(U)
|
:004234F6 8B55F8                  mov edx, dword ptr [ebp-08]
:004234F9 8B45F0                  mov eax, dword ptr [ebp-10]
:004234FC 8982D4020000            mov dword ptr [edx+000002D4], eax
:00423502 8A4DFC                  mov cl, byte ptr [ebp-04]
:00423505 51                      push ecx
:00423506 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423509 E895DEFFFF              call 004213A3
:0042350E 8B55FC                  mov edx, dword ptr [ebp-04]
:00423511 81E2FF000000            and edx, 000000FF
:00423517 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042351A 898491D8020000          mov dword ptr [ecx+4*edx+000002D8], eax
:00423521 E9CDFEFFFF              jmp 004233F3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423414(C)
|
:00423526 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423529 E891DFFFFF              call 004214BF
:0042352E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423531 E872EFFFFF              call 004224A8
:00423536 8B55F8                  mov edx, dword ptr [ebp-08]
:00423539 C782AC04000001000000    mov dword ptr [ebx+000004AC], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004233A7(U), :004233D6(U)
|
:00423543 8BE5                    mov esp, ebp
:00423545 5D                      pop ebp
:00423546 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:004257B6   , :004257CF   , :004257E8   , :00425801   , :004258C5   
|
:00423549 55                      push ebp
:0042354A 8BEC                    mov ebp, esp
:0042354C 83EC10                  sub esp, 00000010
:0042354F 894DF8                  mov dword ptr [ebp-08], ecx
:00423552 8B45F8                  mov eax, dword ptr [ebp-08]
:00423555 8A08                    mov cl, byte ptr [eax]
:00423557 51                      push ecx
:00423558 33D2                    xor edx, edx
:0042355A 837D0800                cmp dword ptr [ebp+08], 00000000
:0042355E 0F95C2                  setne dl
:00423561 83C202                  add edx, 00000002
:00423564 52                      push edx
:00423565 8B45F8                  mov eax, dword ptr [ebp-08]
:00423568 8A88C9020000            mov cl, byte ptr [eax+000002C9]
:0042356E 51                      push ecx
:0042356F 8B55F8                  mov edx, dword ptr [ebp-08]
:00423572 8A4201                  mov al, byte ptr [edx+01]
:00423575 50                      push eax
:00423576 B950424B00              mov ecx, 004B4250
:0042357B E8BD1D0300              call 0045533D
:00423580 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423583 88410C                  mov byte ptr [ecx+0C], al
:00423586 8B55F8                  mov edx, dword ptr [ebp-08]
:00423589 33C0                    xor eax, eax
:0042358B 8A420C                  mov al, byte ptr [edx+0C]
:0042358E 3DFF000000              cmp eax, 000000FF
:00423593 7505                    jne 0042359A
:00423595 E9ED010000              jmp 00423787

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423593(C)
|
:0042359A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042359D 8B91A8040000            mov edx, dword ptr [ecx+000004A8]
:004235A3 52                      push edx
:004235A4 8B45F8                  mov eax, dword ptr [ebp-08]
:004235A7 8A480C                  mov cl, byte ptr [eax+0C]
:004235AA 51                      push ecx
:004235AB 8B55F8                  mov edx, dword ptr [ebp-08]
:004235AE 8A4201                  mov al, byte ptr [edx+01]
:004235B1 50                      push eax
:004235B2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004235B5 8A11                    mov dl, byte ptr [ecx]
:004235B7 52                      push edx
:004235B8 E865CEFFFF              call 00420422
:004235BD 83C410                  add esp, 00000010
:004235C0 85C0                    test eax, eax
:004235C2 7505                    jne 004235C9
:004235C4 E9BE010000              jmp 00423787

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004235C2(C)
|
:004235C9 33C0                    xor eax, eax
:004235CB 837D0800                cmp dword ptr [ebp+08], 00000000
:004235CF 0F95C0                  setne al
:004235D2 50                      push eax
:004235D3 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004235D6 E86E1D0000              call 00425349
:004235DB C645FC00                mov [ebp-04], 00
:004235DF EB09                    jmp 004235EA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423765(U)
|
:004235E1 8A4DFC                  mov cl, byte ptr [ebp-04]
:004235E4 80C101                  add cl, 01
:004235E7 884DFC                  mov byte ptr [ebp-04], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004235DF(U)
|
:004235EA 8B55FC                  mov edx, dword ptr [ebp-04]
:004235ED 81E2FF000000            and edx, 000000FF
:004235F3 8B45F8                  mov eax, dword ptr [ebp-08]
:004235F6 33C9                    xor ecx, ecx
:004235F8 8A4C100D                mov cl, byte ptr [eax+edx+0D]
:004235FC 81F9FF000000            cmp ecx, 000000FF
:00423602 0F8462010000            je 0042376A
:00423608 8B55FC                  mov edx, dword ptr [ebp-04]
:0042360B 81E2FF000000            and edx, 000000FF
:00423611 8B45F8                  mov eax, dword ptr [ebp-08]
:00423614 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423617 8A54110D                mov dl, byte ptr [ecx+edx+0D]
:0042361B 88500C                  mov byte ptr [eax+0C], dl
:0042361E 8B45F8                  mov eax, dword ptr [ebp-08]
:00423621 8A08                    mov cl, byte ptr [eax]
:00423623 51                      push ecx
:00423624 6A02                    push 00000002
:00423626 8B55F8                  mov edx, dword ptr [ebp-08]
:00423629 33C0                    xor eax, eax
:0042362B 8A420C                  mov al, byte ptr [edx+0C]
:0042362E 6BC024                  imul eax, 00000024
:00423631 05502C4B00              add eax, 004B2C50
:00423636 50                      push eax
:00423637 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042363A 8B4908                  mov ecx, dword ptr [ecx+08]
:0042363D E86E7E0100              call 0043B4B0
:00423642 85C0                    test eax, eax
:00423644 741E                    je 00423664
:00423646 8B55FC                  mov edx, dword ptr [ebp-04]
:00423649 81E2FF000000            and edx, 000000FF
:0042364F 8B45F8                  mov eax, dword ptr [ebp-08]
:00423652 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423655 8A8954020000            mov cl, byte ptr [ecx+00000254]
:0042365B 888C1055020000          mov byte ptr [eax+edx+00000255], cl
:00423662 EB14                    jmp 00423678

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423644(C)
|
:00423664 8B55FC                  mov edx, dword ptr [ebp-04]
:00423667 81E2FF000000            and edx, 000000FF
:0042366D 8B45F8                  mov eax, dword ptr [ebp-08]
:00423670 C684105502000000        mov byte ptr [eax+edx+00000255], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423662(U)
|
:00423678 6A00                    push 00000000
:0042367A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042367D 8A11                    mov dl, byte ptr [ecx]
:0042367F 52                      push edx
:00423680 8B45F8                  mov eax, dword ptr [ebp-08]
:00423683 33C9                    xor ecx, ecx
:00423685 8A480C                  mov cl, byte ptr [eax+0C]
:00423688 6BC924                  imul ecx, 00000024
:0042368B 81C1502C4B00            add ecx, 004B2C50
:00423691 E8DABF0300              call 0045F670
:00423696 6BC048                  imul eax, 00000048
:00423699 05681B4A00              add eax, 004A1B68
:0042369E 50                      push eax
:0042369F 8B55F8                  mov edx, dword ptr [ebp-08]
:004236A2 33C0                    xor eax, eax
:004236A4 8A420C                  mov al, byte ptr [edx+0C]
:004236A7 6BC024                  imul eax, 00000024
:004236AA 05502C4B00              add eax, 004B2C50
:004236AF 50                      push eax
:004236B0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004236B3 8B4908                  mov ecx, dword ptr [ecx+08]
:004236B6 E8EF880100              call 0043BFAA
:004236BB 8B55FC                  mov edx, dword ptr [ebp-04]
:004236BE 81E2FF000000            and edx, 000000FF
:004236C4 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004236C7 89849184000000          mov dword ptr [ecx+4*edx+00000084], eax
:004236CE 8A55FC                  mov dl, byte ptr [ebp-04]
:004236D1 52                      push edx
:004236D2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004236D5 E821D8FFFF              call 00420EFB
:004236DA 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004236DD 3B81D0020000            cmp eax, dword ptr [ecx+000002D0]
:004236E3 7611                    jbe 004236F6
:004236E5 8A55FC                  mov dl, byte ptr [ebp-04]
:004236E8 52                      push edx
:004236E9 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004236EC E80AD8FFFF              call 00420EFB
:004236F1 8945F4                  mov dword ptr [ebp-0C], eax
:004236F4 EB0C                    jmp 00423702

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004236E3(C)
|
:004236F6 8B45F8                  mov eax, dword ptr [ebp-08]
:004236F9 8B88D0020000            mov ecx, dword ptr [eax+000002D0]
:004236FF 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004236F4(U)
|
:00423702 8B55F8                  mov edx, dword ptr [ebp-08]
:00423705 8B45F4                  mov eax, dword ptr [ebp-0C]
:00423708 8982D0020000            mov dword ptr [edx+000002D0], eax
:0042370E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423711 E875DBFFFF              call 0042128B
:00423716 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423719 3B81D4020000            cmp eax, dword ptr [ecx+000002D4]
:0042371F 760D                    jbe 0042372E
:00423721 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423724 E862DBFFFF              call 0042128B
:00423729 8945F0                  mov dword ptr [ebp-10], eax
:0042372C EB0C                    jmp 0042373A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042371F(C)
|
:0042372E 8B55F8                  mov edx, dword ptr [ebp-08]
:00423731 8B82D4020000            mov eax, dword ptr [edx+000002D4]
:00423737 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042372C(U)
|
:0042373A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042373D 8B55F0                  mov edx, dword ptr [ebp-10]
:00423740 8991D4020000            mov dword ptr [ecx+000002D4], edx
:00423746 8A45FC                  mov al, byte ptr [ebp-04]
:00423749 50                      push eax
:0042374A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042374D E851DCFFFF              call 004213A3
:00423752 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00423755 81E1FF000000            and ecx, 000000FF
:0042375B 8B55F8                  mov edx, dword ptr [ebp-08]
:0042375E 89848AD8020000          mov dword ptr [edx+4*ecx+000002D8], eax
:00423765 E977FEFFFF              jmp 004235E1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423602(C)
|
:0042376A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042376D E84DDDFFFF              call 004214BF
:00423772 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423775 E82EEDFFFF              call 004224A8
:0042377A 8B45F8                  mov eax, dword ptr [ebp-08]
:0042377D C780AC04000001000000    mov dword ptr [ebx+000004AC], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00423595(U), :004235C4(U)
|
:00423787 8BE5                    mov esp, ebp
:00423789 5D                      pop ebp
:0042378A C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00425818   , :0042582F   
|
:0042378D 55                      push ebp
:0042378E 8BEC                    mov ebp, esp
:00423790 83EC10                  sub esp, 00000010
:00423793 894DF8                  mov dword ptr [ebp-08], ecx
:00423796 8B45F8                  mov eax, dword ptr [ebp-08]
:00423799 8A08                    mov cl, byte ptr [eax]
:0042379B 51                      push ecx
:0042379C 6A03                    push 00000003
:0042379E 8B55F8                  mov edx, dword ptr [ebp-08]
:004237A1 8A82C9020000            mov al, byte ptr [edx+000002C9]
:004237A7 50                      push eax
:004237A8 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004237AB 8A5101                  mov dl, byte ptr [ecx+01]
:004237AE 52                      push edx
:004237AF B950424B00              mov ecx, 004B4250
:004237B4 E8841B0300              call 0045533D
:004237B9 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004237BC 88410C                  mov byte ptr [ecx+0C], al
:004237BF 8B55F8                  mov edx, dword ptr [ebp-08]
:004237C2 33C0                    xor eax, eax
:004237C4 8A420C                  mov al, byte ptr [edx+0C]
:004237C7 3DFF000000              cmp eax, 000000FF
:004237CC 7505                    jne 004237D3
:004237CE E989010000              jmp 0042395C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004237CC(C)
|
:004237D3 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004237D6 8B91A8040000            mov edx, dword ptr [ecx+000004A8]
:004237DC 52                      push edx
:004237DD 8B45F8                  mov eax, dword ptr [ebp-08]
:004237E0 8A480C                  mov cl, byte ptr [eax+0C]
:004237E3 51                      push ecx
:004237E4 8B55F8                  mov edx, dword ptr [ebp-08]
:004237E7 8A4201                  mov al, byte ptr [edx+01]
:004237EA 50                      push eax
:004237EB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004237EE 8A11                    mov dl, byte ptr [ecx]
:004237F0 52                      push edx
:004237F1 E82CCCFFFF              call 00420422
:004237F6 83C410                  add esp, 00000010
:004237F9 85C0                    test eax, eax
:004237FB 7505                    jne 00423802
:004237FD E95A010000              jmp 0042395C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004237FB(C)
|
:00423802 6A01                    push 00000001
:00423804 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423807 E83D1B0000              call 00425349
:0042380C C645FC00                mov [ebp-04], 00
:00423810 EB08                    jmp 0042381A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042393A(U)
|
:00423812 8A45FC                  mov al, byte ptr [ebp-04]
:00423815 0401                    add al, 01
:00423817 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423810(U)
|
:0042381A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042381D 81E1FF000000            and ecx, 000000FF
:00423823 8B55F8                  mov edx, dword ptr [ebp-08]
:00423826 33C0                    xor eax, eax
:00423828 8A440A0D                mov al, byte ptr [edx+ecx+0D]
:0042382C 3DFF000000              cmp eax, 000000FF
:00423831 0F8408010000            je 0042393F
:00423837 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042383A 81E1FF000000            and ecx, 000000FF
:00423840 8B55F8                  mov edx, dword ptr [ebp-08]
:00423843 8B45F8                  mov eax, dword ptr [ebp-08]
:00423846 8A4C080D                mov cl, byte ptr [eax+ecx+0D]
:0042384A 884A0C                  mov byte ptr [edx+0C], cl
:0042384D 6A00                    push 00000000
:0042384F 8B55F8                  mov edx, dword ptr [ebp-08]
:00423852 8A4201                  mov al, byte ptr [edx+01]
:00423855 50                      push eax
:00423856 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423859 8A11                    mov dl, byte ptr [ecx]
:0042385B 52                      push edx
:0042385C 8B45F8                  mov eax, dword ptr [ebp-08]
:0042385F 33C9                    xor ecx, ecx
:00423861 8A480C                  mov cl, byte ptr [eax+0C]
:00423864 6BC924                  imul ecx, 00000024
:00423867 81C1502C4B00            add ecx, 004B2C50
:0042386D E8D68C0100              call 0043C548
:00423872 F7D8                    neg eax
:00423874 8B55FC                  mov edx, dword ptr [ebp-04]
:00423877 81E2FF000000            and edx, 000000FF
:0042387D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423880 89849184000000          mov dword ptr [ecx+4*edx+00000084], eax
:00423887 8B55FC                  mov edx, dword ptr [ebp-04]
:0042388A 81E2FF000000            and edx, 000000FF
:00423890 8B45F8                  mov eax, dword ptr [ebp-08]
:00423893 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423896 8A8954020000            mov cl, byte ptr [ecx+00000254]
:0042389C 888C1055020000          mov byte ptr [eax+edx+00000255], cl
:004238A3 8A55FC                  mov dl, byte ptr [ebp-04]
:004238A6 52                      push edx
:004238A7 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004238AA E84CD6FFFF              call 00420EFB
:004238AF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004238B2 3B81D0020000            cmp eax, dword ptr [ecx+000002D0]
:004238B8 7611                    jbe 004238CB
:004238BA 8A55FC                  mov dl, byte ptr [ebp-04]
:004238BD 52                      push edx
:004238BE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004238C1 E835D6FFFF              call 00420EFB
:004238C6 8945F4                  mov dword ptr [ebp-0C], eax
:004238C9 EB0C                    jmp 004238D7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004238B8(C)
|
:004238CB 8B45F8                  mov eax, dword ptr [ebp-08]
:004238CE 8B88D0020000            mov ecx, dword ptr [eax+000002D0]
:004238D4 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004238C9(U)
|
:004238D7 8B55F8                  mov edx, dword ptr [ebp-08]
:004238DA 8B45F4                  mov eax, dword ptr [ebp-0C]
:004238DD 8982D0020000            mov dword ptr [edx+000002D0], eax
:004238E3 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004238E6 E8A0D9FFFF              call 0042128B
:004238EB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004238EE 3B81D4020000            cmp eax, dword ptr [ecx+000002D4]
:004238F4 760D                    jbe 00423903
:004238F6 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004238F9 E88DD9FFFF              call 0042128B
:004238FE 8945F0                  mov dword ptr [ebp-10], eax
:00423901 EB0C                    jmp 0042390F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004238F4(C)
|
:00423903 8B55F8                  mov edx, dword ptr [ebp-08]
:00423906 8B82D4020000            mov eax, dword ptr [edx+000002D4]
:0042390C 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423901(U)
|
:0042390F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423912 8B55F0                  mov edx, dword ptr [ebp-10]
:00423915 8991D4020000            mov dword ptr [ecx+000002D4], edx
:0042391B 8A45FC                  mov al, byte ptr [ebp-04]
:0042391E 50                      push eax
:0042391F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423922 E87CDAFFFF              call 004213A3
:00423927 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042392A 81E1FF000000            and ecx, 000000FF
:00423930 8B55F8                  mov edx, dword ptr [ebp-08]
:00423933 89848AD8020000          mov dword ptr [edx+4*ecx+000002D8], eax
:0042393A E9D3FEFFFF              jmp 00423812

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423831(C)
|
:0042393F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423942 E878DBFFFF              call 004214BF
:00423947 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042394A E859EBFFFF              call 004224A8
:0042394F 8B45F8                  mov eax, dword ptr [ebp-08]
:00423952 C780AC04000001000000    mov dword ptr [ebx+000004AC], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004237CE(U), :004237FD(U)
|
:0042395C 8BE5                    mov esp, ebp
:0042395E 5D                      pop ebp
:0042395F C3                      ret



* Referenced by a CALL at Address:
|:004258DC   
|
:00423960 55                      push ebp
:00423961 8BEC                    mov ebp, esp
:00423963 83EC10                  sub esp, 00000010
:00423966 894DF8                  mov dword ptr [ebp-08], ecx
:00423969 8B45F8                  mov eax, dword ptr [ebp-08]
:0042396C 8A08                    mov cl, byte ptr [eax]
:0042396E 51                      push ecx
:0042396F 6A03                    push 00000003
:00423971 8B55F8                  mov edx, dword ptr [ebp-08]
:00423974 8A82C9020000            mov al, byte ptr [edx+000002C9]
:0042397A 50                      push eax
:0042397B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042397E 8A5101                  mov dl, byte ptr [ecx+01]
:00423981 52                      push edx
:00423982 B950424B00              mov ecx, 004B4250
:00423987 E8B1190300              call 0045533D
:0042398C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042398F 88410C                  mov byte ptr [ecx+0C], al
:00423992 8B55F8                  mov edx, dword ptr [ebp-08]
:00423995 33C0                    xor eax, eax
:00423997 8A420C                  mov al, byte ptr [edx+0C]
:0042399A 3DFF000000              cmp eax, 000000FF
:0042399F 7505                    jne 004239A6
:004239A1 E985010000              jmp 00423B2B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042399F(C)
|
:004239A6 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004239A9 8B91A8040000            mov edx, dword ptr [ecx+000004A8]
:004239AF 52                      push edx
:004239B0 8B45F8                  mov eax, dword ptr [ebp-08]
:004239B3 8A480C                  mov cl, byte ptr [eax+0C]
:004239B6 51                      push ecx
:004239B7 8B55F8                  mov edx, dword ptr [ebp-08]
:004239BA 8A4201                  mov al, byte ptr [edx+01]
:004239BD 50                      push eax
:004239BE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004239C1 8A11                    mov dl, byte ptr [ecx]
:004239C3 52                      push edx
:004239C4 E859CAFFFF              call 00420422
:004239C9 83C410                  add esp, 00000010
:004239CC 85C0                    test eax, eax
:004239CE 7505                    jne 004239D5
:004239D0 E956010000              jmp 00423B2B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004239CE(C)
|
:004239D5 6A01                    push 00000001
:004239D7 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004239DA E86A190000              call 00425349
:004239DF C645FC00                mov [ebp-04], 00
:004239E3 EB08                    jmp 004239ED

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423B09(U)
|
:004239E5 8A45FC                  mov al, byte ptr [ebp-04]
:004239E8 0401                    add al, 01
:004239EA 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004239E3(U)
|
:004239ED 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004239F0 81E1FF000000            and ecx, 000000FF
:004239F6 8B55F8                  mov edx, dword ptr [ebp-08]
:004239F9 33C0                    xor eax, eax
:004239FB 8A440A0D                mov al, byte ptr [edx+ecx+0D]
:004239FF 3DFF000000              cmp eax, 000000FF
:00423A04 0F8404010000            je 00423B0E
:00423A0A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00423A0D 81E1FF000000            and ecx, 000000FF
:00423A13 8B55F8                  mov edx, dword ptr [ebp-08]
:00423A16 8B45F8                  mov eax, dword ptr [ebp-08]
:00423A19 8A4C080D                mov cl, byte ptr [eax+ecx+0D]
:00423A1D 884A0C                  mov byte ptr [edx+0C], cl
:00423A20 8B55F8                  mov edx, dword ptr [ebp-08]
:00423A23 8A02                    mov al, byte ptr [edx]
:00423A25 50                      push eax
:00423A26 6A02                    push 00000002
:00423A28 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423A2B 33D2                    xor edx, edx
:00423A2D 8A510C                  mov dl, byte ptr [ecx+0C]
:00423A30 6BD224                  imul edx, 00000024
:00423A33 81C2502C4B00            add edx, 004B2C50
:00423A39 52                      push edx
:00423A3A 8B45F8                  mov eax, dword ptr [ebp-08]
:00423A3D 8B4808                  mov ecx, dword ptr [eax+08]
:00423A40 E86B7A0100              call 0043B4B0
:00423A45 85C0                    test eax, eax
:00423A47 7416                    je 00423A5F
:00423A49 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00423A4C 81E1FF000000            and ecx, 000000FF
:00423A52 8B55F8                  mov edx, dword ptr [ebp-08]
:00423A55 C6840A55020000B8        mov byte ptr [edx+ecx+00000255], B8
:00423A5D EB13                    jmp 00423A72

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423A47(C)
|
:00423A5F 8B45FC                  mov eax, dword ptr [ebp-04]
:00423A62 25FF000000              and eax, 000000FF
:00423A67 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423A6A C684015502000000        mov byte ptr [ecx+eax+00000255], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423A5D(U)
|
:00423A72 8A55FC                  mov dl, byte ptr [ebp-04]
:00423A75 52                      push edx
:00423A76 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423A79 E87DD4FFFF              call 00420EFB
:00423A7E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423A81 3B81D0020000            cmp eax, dword ptr [ecx+000002D0]
:00423A87 7611                    jbe 00423A9A
:00423A89 8A55FC                  mov dl, byte ptr [ebp-04]
:00423A8C 52                      push edx
:00423A8D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423A90 E866D4FFFF              call 00420EFB
:00423A95 8945F4                  mov dword ptr [ebp-0C], eax
:00423A98 EB0C                    jmp 00423AA6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423A87(C)
|
:00423A9A 8B45F8                  mov eax, dword ptr [ebp-08]
:00423A9D 8B88D0020000            mov ecx, dword ptr [eax+000002D0]
:00423AA3 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423A98(U)
|
:00423AA6 8B55F8                  mov edx, dword ptr [ebp-08]
:00423AA9 8B45F4                  mov eax, dword ptr [ebp-0C]
:00423AAC 8982D0020000            mov dword ptr [edx+000002D0], eax
:00423AB2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423AB5 E8D1D7FFFF              call 0042128B
:00423ABA 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423ABD 3B81D4020000            cmp eax, dword ptr [ecx+000002D4]
:00423AC3 760D                    jbe 00423AD2
:00423AC5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423AC8 E8BED7FFFF              call 0042128B
:00423ACD 8945F0                  mov dword ptr [ebp-10], eax
:00423AD0 EB0C                    jmp 00423ADE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423AC3(C)
|
:00423AD2 8B55F8                  mov edx, dword ptr [ebp-08]
:00423AD5 8B82D4020000            mov eax, dword ptr [edx+000002D4]
:00423ADB 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423AD0(U)
|
:00423ADE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423AE1 8B55F0                  mov edx, dword ptr [ebp-10]
:00423AE4 8991D4020000            mov dword ptr [ecx+000002D4], edx
:00423AEA 8A45FC                  mov al, byte ptr [ebp-04]
:00423AED 50                      push eax
:00423AEE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423AF1 E8ADD8FFFF              call 004213A3
:00423AF6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00423AF9 81E1FF000000            and ecx, 000000FF
:00423AFF 8B55F8                  mov edx, dword ptr [ebp-08]
:00423B02 89848AD8020000          mov dword ptr [edx+4*ecx+000002D8], eax
:00423B09 E9D7FEFFFF              jmp 004239E5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423A04(C)
|
:00423B0E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423B11 E8A9D9FFFF              call 004214BF
:00423B16 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423B19 E88AE9FFFF              call 004224A8
:00423B1E 8B45F8                  mov eax, dword ptr [ebp-08]
:00423B21 C780AC04000001000000    mov dword ptr [ebx+000004AC], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004239A1(U), :004239D0(U)
|
:00423B2B 8BE5                    mov esp, ebp
:00423B2D 5D                      pop ebp
:00423B2E C3                      ret



* Referenced by a CALL at Address:
|:0042590A   
|
:00423B2F 55                      push ebp
:00423B30 8BEC                    mov ebp, esp
:00423B32 83EC08                  sub esp, 00000008
:00423B35 894DFC                  mov dword ptr [ebp-04], ecx
:00423B38 8B45FC                  mov eax, dword ptr [ebp-04]
:00423B3B C6805502000000          mov byte ptr [eax+00000255], 00
:00423B42 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00423B45 8A11                    mov dl, byte ptr [ecx]
:00423B47 8855F8                  mov byte ptr [ebp-08], dl
:00423B4A 807DF83A                cmp byte ptr [ebp-08], 3A
:00423B4E 740E                    je 00423B5E
:00423B50 807DF83B                cmp byte ptr [ebp-08], 3B
:00423B54 742E                    je 00423B84
:00423B56 807DF83C                cmp byte ptr [ebp-08], 3C
:00423B5A 744E                    je 00423BAA
:00423B5C EB70                    jmp 00423BCE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423B4E(C)
|
:00423B5E 6A02                    push 00000002
:00423B60 B9083D4B00              mov ecx, 004B3D08
:00423B65 E88F660200              call 0044A1F9
:00423B6A 25FF000000              and eax, 000000FF
:00423B6F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00423B72 898184000000            mov dword ptr [ecx+00000084], eax
:00423B78 8B55FC                  mov edx, dword ptr [ebp-04]
:00423B7B C68255020000C0          mov byte ptr [edx+00000255], C0
:00423B82 EB4A                    jmp 00423BCE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423B54(C)
|
:00423B84 6A00                    push 00000000
:00423B86 B9083D4B00              mov ecx, 004B3D08
:00423B8B E869660200              call 0044A1F9
:00423B90 25FF000000              and eax, 000000FF
:00423B95 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00423B98 898184000000            mov dword ptr [ecx+00000084], eax
:00423B9E 8B55FC                  mov edx, dword ptr [ebp-04]
:00423BA1 C68255020000C1          mov byte ptr [edx+00000255], C1
:00423BA8 EB24                    jmp 00423BCE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423B5A(C)
|
:00423BAA 6A01                    push 00000001
:00423BAC B9083D4B00              mov ecx, 004B3D08
:00423BB1 E843660200              call 0044A1F9
:00423BB6 25FF000000              and eax, 000000FF
:00423BBB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00423BBE 898184000000            mov dword ptr [ecx+00000084], eax
:00423BC4 8B55FC                  mov edx, dword ptr [ebp-04]
:00423BC7 C68255020000C2          mov byte ptr [edx+00000255], C2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00423B5C(U), :00423B82(U), :00423BA8(U)
|
:00423BCE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00423BD1 E8E9D8FFFF              call 004214BF
:00423BD6 8B45FC                  mov eax, dword ptr [ebp-04]
:00423BD9 33C9                    xor ecx, ecx
:00423BDB 8A8855020000            mov cl, byte ptr [eax+00000255]
:00423BE1 85C9                    test ecx, ecx
:00423BE3 7452                    je 00423C37
:00423BE5 B9083D4B00              mov ecx, 004B3D08
:00423BEA E8C186FFFF              call 0041C2B0
:00423BEF 25FF000000              and eax, 000000FF
:00423BF4 8B55FC                  mov edx, dword ptr [ebp-04]
:00423BF7 398284000000            cmp dword ptr [edx+00000084], eax
:00423BFD 7438                    je 00423C37
:00423BFF 6A01                    push 00000001
:00423C01 6886000000              push 00000086
:00423C06 B9B0694B00              mov ecx, 004B69B0
:00423C0B E86A0A0500              call 0047467A
:00423C10 6A1E                    push 0000001E
:00423C12 B9181B4B00              mov ecx, 004B1B18
:00423C17 E824F7FDFF              call 00403340
:00423C1C E8BF880000              call 0042C4E0
:00423C21 8B45FC                  mov eax, dword ptr [ebp-04]
:00423C24 8A8884000000            mov cl, byte ptr [eax+00000084]
:00423C2A 51                      push ecx
:00423C2B B9083D4B00              mov ecx, 004B3D08
:00423C30 E85C630200              call 00449F91
:00423C35 EB54                    jmp 00423C8B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00423BE3(C), :00423BFD(C)
|
:00423C37 68004C0400              push 00044C00
:00423C3C 6A04                    push 00000004
:00423C3E 6A00                    push 00000000
:00423C40 6A00                    push 00000000
:00423C42 B9C8E44A00              mov ecx, 004AE4C8
:00423C47 E8F4BD0500              call 0047FA40
:00423C4C 50                      push eax
:00423C4D 6A2D                    push 0000002D

* Possible StringData Ref from Data Obj ->"MEFF.E5"
                                  |
:00423C4F 68F8BB4800              push 0048BBF8
:00423C54 B9B0174900              mov ecx, 004917B0
:00423C59 E89AD8FDFF              call 004014F8
:00423C5E 8B55FC                  mov edx, dword ptr [ebp-04]
:00423C61 8A4201                  mov al, byte ptr [edx+01]
:00423C64 50                      push eax
:00423C65 B9B0174900              mov ecx, 004917B0
:00423C6A E8CDE1FDFF              call 00401E3C
:00423C6F 85C0                    test eax, eax
:00423C71 740E                    je 00423C81
:00423C73 6A01                    push 00000001
:00423C75 6A00                    push 00000000
:00423C77 B9B0174900              mov ecx, 004917B0
:00423C7C E8DBE1FDFF              call 00401E5C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423C71(C)
|
:00423C81 B9B0174900              mov ecx, 004917B0
:00423C86 E820DAFDFF              call 004016AB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423C35(U)
|
:00423C8B 6A00                    push 00000000
:00423C8D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00423C90 E866D2FFFF              call 00420EFB
:00423C95 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00423C98 8981D0020000            mov dword ptr [ecx+000002D0], eax
:00423C9E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00423CA1 E8E5D5FFFF              call 0042128B
:00423CA6 8B55FC                  mov edx, dword ptr [ebp-04]
:00423CA9 8982D4020000            mov dword ptr [edx+000002D4], eax
:00423CAF 8B45FC                  mov eax, dword ptr [ebp-04]
:00423CB2 C780AC04000001000000    mov dword ptr [ebx+000004AC], 00000001
:00423CBC 8BE5                    mov esp, ebp
:00423CBE 5D                      pop ebp
:00423CBF C3                      ret



* Referenced by a CALL at Addresses:
|:00425921   , :00425935   
|
:00423CC0 55                      push ebp
:00423CC1 8BEC                    mov ebp, esp
:00423CC3 51                      push ecx
:00423CC4 894DFC                  mov dword ptr [ebp-04], ecx
:00423CC7 8B45FC                  mov eax, dword ptr [ebp-04]
:00423CCA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00423CCD 8A5101                  mov dl, byte ptr [ecx+01]
:00423CD0 88500D                  mov byte ptr [eax+0D], dl
:00423CD3 8B45FC                  mov eax, dword ptr [ebp-04]
:00423CD6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00423CD9 8A510D                  mov dl, byte ptr [ecx+0D]
:00423CDC 88500C                  mov byte ptr [eax+0C], dl
:00423CDF B950424B00              mov ecx, 004B4250
:00423CE4 E833090300              call 0045461C
:00423CE9 8B45FC                  mov eax, dword ptr [ebp-04]
:00423CEC 8B88A8040000            mov ecx, dword ptr [eax+000004A8]
:00423CF2 51                      push ecx
:00423CF3 8B55FC                  mov edx, dword ptr [ebp-04]
:00423CF6 8A420C                  mov al, byte ptr [edx+0C]
:00423CF9 50                      push eax
:00423CFA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00423CFD 8A5101                  mov dl, byte ptr [ecx+01]
:00423D00 52                      push edx
:00423D01 8B45FC                  mov eax, dword ptr [ebp-04]
:00423D04 8A08                    mov cl, byte ptr [eax]
:00423D06 51                      push ecx
:00423D07 E816C7FFFF              call 00420422
:00423D0C 83C410                  add esp, 00000010
:00423D0F 85C0                    test eax, eax
:00423D11 7502                    jne 00423D15
:00423D13 EB53                    jmp 00423D68

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423D11(C)
|
:00423D15 8B55FC                  mov edx, dword ptr [ebp-04]
:00423D18 8B45FC                  mov eax, dword ptr [ebp-04]
:00423D1B 8A8854020000            mov cl, byte ptr [eax+00000254]
:00423D21 888A55020000            mov byte ptr [edx+00000255], cl
:00423D27 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00423D2A E890D7FFFF              call 004214BF
:00423D2F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00423D32 E871E7FFFF              call 004224A8
:00423D37 6A00                    push 00000000
:00423D39 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00423D3C E8BAD1FFFF              call 00420EFB
:00423D41 8B55FC                  mov edx, dword ptr [ebp-04]
:00423D44 8982D0020000            mov dword ptr [edx+000002D0], eax
:00423D4A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00423D4D E839D5FFFF              call 0042128B
:00423D52 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00423D55 8981D4020000            mov dword ptr [ecx+000002D4], eax
:00423D5B 8B55FC                  mov edx, dword ptr [ebp-04]
:00423D5E C782AC04000001000000    mov dword ptr [ebx+000004AC], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423D13(U)
|
:00423D68 8BE5                    mov esp, ebp
:00423D6A 5D                      pop ebp
:00423D6B C3                      ret



* Referenced by a CALL at Address:
|:00425949   
|
:00423D6C 55                      push ebp
:00423D6D 8BEC                    mov ebp, esp
:00423D6F 51                      push ecx
:00423D70 56                      push esi
:00423D71 894DFC                  mov dword ptr [ebp-04], ecx
:00423D74 8B45FC                  mov eax, dword ptr [ebp-04]
:00423D77 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00423D7A 8A5101                  mov dl, byte ptr [ecx+01]
:00423D7D 88500D                  mov byte ptr [eax+0D], dl
:00423D80 8B45FC                  mov eax, dword ptr [ebp-04]
:00423D83 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00423D86 8A510D                  mov dl, byte ptr [ecx+0D]
:00423D89 88500C                  mov byte ptr [eax+0C], dl
:00423D8C 8B45FC                  mov eax, dword ptr [ebp-04]
:00423D8F 8B88A8040000            mov ecx, dword ptr [eax+000004A8]
:00423D95 51                      push ecx
:00423D96 8B55FC                  mov edx, dword ptr [ebp-04]
:00423D99 8A420C                  mov al, byte ptr [edx+0C]
:00423D9C 50                      push eax
:00423D9D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00423DA0 8A5101                  mov dl, byte ptr [ecx+01]
:00423DA3 52                      push edx
:00423DA4 8B45FC                  mov eax, dword ptr [ebp-04]
:00423DA7 8A08                    mov cl, byte ptr [eax]
:00423DA9 51                      push ecx
:00423DAA E873C6FFFF              call 00420422
:00423DAF 83C410                  add esp, 00000010
:00423DB2 85C0                    test eax, eax
:00423DB4 7505                    jne 00423DBB
:00423DB6 E91C010000              jmp 00423ED7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423DB4(C)
|
:00423DBB 8B55FC                  mov edx, dword ptr [ebp-04]
:00423DBE 8B45FC                  mov eax, dword ptr [ebp-04]
:00423DC1 8A8854020000            mov cl, byte ptr [eax+00000254]
:00423DC7 888A55020000            mov byte ptr [edx+00000255], cl
:00423DCD 8B55FC                  mov edx, dword ptr [ebp-04]
:00423DD0 8B4A08                  mov ecx, dword ptr [edx+08]
:00423DD3 E8B8EE0400              call 00472C90
:00423DD8 83F832                  cmp eax, 00000032
:00423DDB 761C                    jbe 00423DF9
:00423DDD 8B45FC                  mov eax, dword ptr [ebp-04]
:00423DE0 C7808800000032000000    mov dword ptr [ebx+00000088], 00000032
:00423DEA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00423DED C78184000000E7FFFFFF    mov dword ptr [ebx+00000084], FFFFFFE7
:00423DF7 EB30                    jmp 00423E29

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423DDB(C)
|
:00423DF9 8B55FC                  mov edx, dword ptr [ebp-04]
:00423DFC 8B4A08                  mov ecx, dword ptr [edx+08]
:00423DFF E88CEE0400              call 00472C90
:00423E04 83E801                  sub eax, 00000001
:00423E07 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00423E0A 898188000000            mov dword ptr [ecx+00000088], eax
:00423E10 8B55FC                  mov edx, dword ptr [ebp-04]
:00423E13 8B8288000000            mov eax, dword ptr [edx+00000088]
:00423E19 99                      cdq
:00423E1A 2BC2                    sub eax, edx
:00423E1C D1F8                    sar eax, 1
:00423E1E F7D8                    neg eax
:00423E20 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00423E23 898184000000            mov dword ptr [ecx+00000084], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423DF7(U)
|
:00423E29 8B55FC                  mov edx, dword ptr [ebp-04]
:00423E2C 8B4A08                  mov ecx, dword ptr [edx+08]
:00423E2F E83CB80300              call 0045F670
:00423E34 8BC8                    mov ecx, eax
:00423E36 6BC948                  imul ecx, 00000048
:00423E39 81C1681B4A00            add ecx, 004A1B68
:00423E3F E80634FEFF              call 0040724A
:00423E44 8BF0                    mov esi, eax
:00423E46 8B45FC                  mov eax, dword ptr [ebp-04]
:00423E49 8B4808                  mov ecx, dword ptr [eax+08]
:00423E4C E8EFE90400              call 00472840
:00423E51 2BF0                    sub esi, eax
:00423E53 F7DE                    neg esi
:00423E55 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00423E58 39B184000000            cmp dword ptr [ecx+00000084], esi
:00423E5E 7D36                    jge 00423E96
:00423E60 8B55FC                  mov edx, dword ptr [ebp-04]
:00423E63 8B4A08                  mov ecx, dword ptr [edx+08]
:00423E66 E805B80300              call 0045F670
:00423E6B 8BC8                    mov ecx, eax
:00423E6D 6BC948                  imul ecx, 00000048
:00423E70 81C1681B4A00            add ecx, 004A1B68
:00423E76 E8CF33FEFF              call 0040724A
:00423E7B 8BF0                    mov esi, eax
:00423E7D 8B45FC                  mov eax, dword ptr [ebp-04]
:00423E80 8B4808                  mov ecx, dword ptr [eax+08]
:00423E83 E8B8E90400              call 00472840
:00423E88 2BF0                    sub esi, eax
:00423E8A 6BF6FF                  imul esi, FFFFFFFF
:00423E8D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00423E90 89B184000000            mov dword ptr [ecx+00000084], esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423E5E(C)
|
:00423E96 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00423E99 E821D6FFFF              call 004214BF
:00423E9E 6A00                    push 00000000
:00423EA0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00423EA3 E853D0FFFF              call 00420EFB
:00423EA8 8B55FC                  mov edx, dword ptr [ebp-04]
:00423EAB 8982D0020000            mov dword ptr [edx+000002D0], eax
:00423EB1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00423EB4 E8D2D3FFFF              call 0042128B
:00423EB9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00423EBC 8981D4020000            mov dword ptr [ecx+000002D4], eax
:00423EC2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00423EC5 E8DEE5FFFF              call 004224A8
:00423ECA 8B55FC                  mov edx, dword ptr [ebp-04]
:00423ECD C782AC04000001000000    mov dword ptr [ebx+000004AC], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423DB6(U)
|
:00423ED7 5E                      pop esi
:00423ED8 8BE5                    mov esp, ebp
:00423EDA 5D                      pop ebp
:00423EDB C3                      ret



* Referenced by a CALL at Address:
|:004258F3   
|
:00423EDC 55                      push ebp
:00423EDD 8BEC                    mov ebp, esp
:00423EDF 83EC14                  sub esp, 00000014
:00423EE2 894DF8                  mov dword ptr [ebp-08], ecx
:00423EE5 8B45F8                  mov eax, dword ptr [ebp-08]
:00423EE8 8A08                    mov cl, byte ptr [eax]
:00423EEA 51                      push ecx
:00423EEB 6A02                    push 00000002
:00423EED 8B55F8                  mov edx, dword ptr [ebp-08]
:00423EF0 8A82C9020000            mov al, byte ptr [edx+000002C9]
:00423EF6 50                      push eax
:00423EF7 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423EFA 8A5101                  mov dl, byte ptr [ecx+01]
:00423EFD 52                      push edx
:00423EFE B950424B00              mov ecx, 004B4250
:00423F03 E835140300              call 0045533D
:00423F08 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423F0B 88410C                  mov byte ptr [ecx+0C], al
:00423F0E 8B55F8                  mov edx, dword ptr [ebp-08]
:00423F11 33C0                    xor eax, eax
:00423F13 8A420C                  mov al, byte ptr [edx+0C]
:00423F16 3DFF000000              cmp eax, 000000FF
:00423F1B 7505                    jne 00423F22
:00423F1D E9F4020000              jmp 00424216

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423F1B(C)
|
:00423F22 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423F25 8B91A8040000            mov edx, dword ptr [ecx+000004A8]
:00423F2B 52                      push edx
:00423F2C 8B45F8                  mov eax, dword ptr [ebp-08]
:00423F2F 8A480C                  mov cl, byte ptr [eax+0C]
:00423F32 51                      push ecx
:00423F33 8B55F8                  mov edx, dword ptr [ebp-08]
:00423F36 8A4201                  mov al, byte ptr [edx+01]
:00423F39 50                      push eax
:00423F3A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423F3D 8A11                    mov dl, byte ptr [ecx]
:00423F3F 52                      push edx
:00423F40 E8DDC4FFFF              call 00420422
:00423F45 83C410                  add esp, 00000010
:00423F48 85C0                    test eax, eax
:00423F4A 7505                    jne 00423F51
:00423F4C E9C5020000              jmp 00424216

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423F4A(C)
|
:00423F51 6A00                    push 00000000
:00423F53 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423F56 E8EE130000              call 00425349
:00423F5B C645FC00                mov [ebp-04], 00
:00423F5F EB08                    jmp 00423F69

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004241F4(U)
|
:00423F61 8A45FC                  mov al, byte ptr [ebp-04]
:00423F64 0401                    add al, 01
:00423F66 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423F5F(U)
|
:00423F69 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00423F6C 81E1FF000000            and ecx, 000000FF
:00423F72 8B55F8                  mov edx, dword ptr [ebp-08]
:00423F75 33C0                    xor eax, eax
:00423F77 8A440A0D                mov al, byte ptr [edx+ecx+0D]
:00423F7B 3DFF000000              cmp eax, 000000FF
:00423F80 0F8473020000            je 004241F9
:00423F86 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00423F89 81E1FF000000            and ecx, 000000FF
:00423F8F 8B55F8                  mov edx, dword ptr [ebp-08]
:00423F92 8B45F8                  mov eax, dword ptr [ebp-08]
:00423F95 8A4C080D                mov cl, byte ptr [eax+ecx+0D]
:00423F99 884A0C                  mov byte ptr [edx+0C], cl
:00423F9C 6A08                    push 00000008
:00423F9E E870BB0500              call 0047FB13
:00423FA3 83C404                  add esp, 00000004
:00423FA6 8945F4                  mov dword ptr [ebp-0C], eax
:00423FA9 837DF407                cmp dword ptr [ebp-0C], 00000007
:00423FAD 0F87AA010000            ja 0042415D
:00423FB3 8B55F4                  mov edx, dword ptr [ebp-0C]
:00423FB6 FF24951A424200          jmp dword ptr [4*edx+0042421A]
:00423FBD 6A00                    push 00000000
:00423FBF 8B45F8                  mov eax, dword ptr [ebp-08]
:00423FC2 8A08                    mov cl, byte ptr [eax]
:00423FC4 51                      push ecx
:00423FC5 8B55F8                  mov edx, dword ptr [ebp-08]
:00423FC8 33C0                    xor eax, eax
:00423FCA 8A420C                  mov al, byte ptr [edx+0C]
:00423FCD 8BC8                    mov ecx, eax
:00423FCF 6BC924                  imul ecx, 00000024
:00423FD2 81C1502C4B00            add ecx, 004B2C50
:00423FD8 E893B60300              call 0045F670
:00423FDD 6BC048                  imul eax, 00000048
:00423FE0 05681B4A00              add eax, 004A1B68
:00423FE5 50                      push eax
:00423FE6 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00423FE9 33D2                    xor edx, edx
:00423FEB 8A510C                  mov dl, byte ptr [ecx+0C]
:00423FEE 6BD224                  imul edx, 00000024
:00423FF1 81C2502C4B00            add edx, 004B2C50
:00423FF7 52                      push edx
:00423FF8 8B45F8                  mov eax, dword ptr [ebp-08]
:00423FFB 8B4808                  mov ecx, dword ptr [eax+08]
:00423FFE E8A77F0100              call 0043BFAA
:00424003 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00424006 81E1FF000000            and ecx, 000000FF
:0042400C 8B55F8                  mov edx, dword ptr [ebp-08]
:0042400F 89848A84000000          mov dword ptr [edx+4*ecx+00000084], eax
:00424016 8B45FC                  mov eax, dword ptr [ebp-04]
:00424019 25FF000000              and eax, 000000FF
:0042401E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00424021 C684015502000040        mov byte ptr [ecx+eax+00000255], 40
:00424029 E92F010000              jmp 0042415D
:0042402E 8B55FC                  mov edx, dword ptr [ebp-04]
:00424031 81E2FF000000            and edx, 000000FF
:00424037 8B45F8                  mov eax, dword ptr [ebp-08]
:0042403A C684105502000071        mov byte ptr [eax+edx+00000255], 71
:00424042 E916010000              jmp 0042415D
:00424047 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042404A 81E1FF000000            and ecx, 000000FF
:00424050 8B55F8                  mov edx, dword ptr [ebp-08]
:00424053 C6840A5502000072        mov byte ptr [edx+ecx+00000255], 72
:0042405B E9FD000000              jmp 0042415D
:00424060 8B45FC                  mov eax, dword ptr [ebp-04]
:00424063 25FF000000              and eax, 000000FF
:00424068 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042406B C684015502000074        mov byte ptr [ecx+eax+00000255], 74
:00424073 E9E5000000              jmp 0042415D
:00424078 6A00                    push 00000000
:0042407A 6A21                    push 00000021
:0042407C 8B55F8                  mov edx, dword ptr [ebp-08]
:0042407F 33C0                    xor eax, eax
:00424081 8A420C                  mov al, byte ptr [edx+0C]
:00424084 8BC8                    mov ecx, eax
:00424086 6BC924                  imul ecx, 00000024
:00424089 81C1502C4B00            add ecx, 004B2C50
:0042408F E8DCB50300              call 0045F670
:00424094 6BC048                  imul eax, 00000048
:00424097 05681B4A00              add eax, 004A1B68
:0042409C 50                      push eax
:0042409D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004240A0 33D2                    xor edx, edx
:004240A2 8A510C                  mov dl, byte ptr [ecx+0C]
:004240A5 6BD224                  imul edx, 00000024
:004240A8 81C2502C4B00            add edx, 004B2C50
:004240AE 52                      push edx
:004240AF 8B45F8                  mov eax, dword ptr [ebp-08]
:004240B2 8B4808                  mov ecx, dword ptr [eax+08]
:004240B5 E8F07E0100              call 0043BFAA
:004240BA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004240BD 81E1FF000000            and ecx, 000000FF
:004240C3 8B55F8                  mov edx, dword ptr [ebp-08]
:004240C6 89848A84000000          mov dword ptr [edx+4*ecx+00000084], eax
:004240CD 8B45FC                  mov eax, dword ptr [ebp-04]
:004240D0 25FF000000              and eax, 000000FF
:004240D5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004240D8 C684015502000070        mov byte ptr [ecx+eax+00000255], 70
:004240E0 EB7B                    jmp 0042415D
:004240E2 8B55FC                  mov edx, dword ptr [ebp-04]
:004240E5 81E2FF000000            and edx, 000000FF
:004240EB 8B45F8                  mov eax, dword ptr [ebp-08]
:004240EE C68410550200006F        mov byte ptr [eax+edx+00000255], 6F
:004240F6 EB65                    jmp 0042415D
:004240F8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004240FB 81E1FF000000            and ecx, 000000FF
:00424101 8B55F8                  mov edx, dword ptr [ebp-08]
:00424104 C6840A55020000AF        mov byte ptr [edx+ecx+00000255], AF
:0042410C EB4F                    jmp 0042415D
:0042410E 6A00                    push 00000000
:00424110 8B45F8                  mov eax, dword ptr [ebp-08]
:00424113 8A4801                  mov cl, byte ptr [eax+01]
:00424116 51                      push ecx
:00424117 8B55F8                  mov edx, dword ptr [ebp-08]
:0042411A 8A02                    mov al, byte ptr [edx]
:0042411C 50                      push eax
:0042411D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00424120 33D2                    xor edx, edx
:00424122 8A510C                  mov dl, byte ptr [ecx+0C]
:00424125 8BCA                    mov ecx, edx
:00424127 6BC924                  imul ecx, 00000024
:0042412A 81C1502C4B00            add ecx, 004B2C50
:00424130 E813840100              call 0043C548
:00424135 F7D8                    neg eax
:00424137 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042413A 81E1FF000000            and ecx, 000000FF
:00424140 8B55F8                  mov edx, dword ptr [ebp-08]
:00424143 89848A84000000          mov dword ptr [edx+4*ecx+00000084], eax
:0042414A 8B45FC                  mov eax, dword ptr [ebp-04]
:0042414D 25FF000000              and eax, 000000FF
:00424152 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00424155 C684015502000080        mov byte ptr [ecx+eax+00000255], 80

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00423FAD(C), :00424029(U), :00424042(U), :0042405B(U), :00424073(U)
|:004240E0(U), :004240F6(U), :0042410C(U)
|
:0042415D 8A55FC                  mov dl, byte ptr [ebp-04]
:00424160 52                      push edx
:00424161 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00424164 E892CDFFFF              call 00420EFB
:00424169 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042416C 3B81D0020000            cmp eax, dword ptr [ecx+000002D0]
:00424172 7611                    jbe 00424185
:00424174 8A55FC                  mov dl, byte ptr [ebp-04]
:00424177 52                      push edx
:00424178 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042417B E87BCDFFFF              call 00420EFB
:00424180 8945F0                  mov dword ptr [ebp-10], eax
:00424183 EB0C                    jmp 00424191

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424172(C)
|
:00424185 8B45F8                  mov eax, dword ptr [ebp-08]
:00424188 8B88D0020000            mov ecx, dword ptr [eax+000002D0]
:0042418E 894DF0                  mov dword ptr [ebp-10], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424183(U)
|
:00424191 8B55F8                  mov edx, dword ptr [ebp-08]
:00424194 8B45F0                  mov eax, dword ptr [ebp-10]
:00424197 8982D0020000            mov dword ptr [edx+000002D0], eax
:0042419D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004241A0 E8E6D0FFFF              call 0042128B
:004241A5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004241A8 3B81D4020000            cmp eax, dword ptr [ecx+000002D4]
:004241AE 760D                    jbe 004241BD
:004241B0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004241B3 E8D3D0FFFF              call 0042128B
:004241B8 8945EC                  mov dword ptr [ebp-14], eax
:004241BB EB0C                    jmp 004241C9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004241AE(C)
|
:004241BD 8B55F8                  mov edx, dword ptr [ebp-08]
:004241C0 8B82D4020000            mov eax, dword ptr [edx+000002D4]
:004241C6 8945EC                  mov dword ptr [ebp-14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004241BB(U)
|
:004241C9 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004241CC 8B55EC                  mov edx, dword ptr [ebp-14]
:004241CF 8991D4020000            mov dword ptr [ecx+000002D4], edx
:004241D5 8A45FC                  mov al, byte ptr [ebp-04]
:004241D8 50                      push eax
:004241D9 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004241DC E8C2D1FFFF              call 004213A3
:004241E1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004241E4 81E1FF000000            and ecx, 000000FF
:004241EA 8B55F8                  mov edx, dword ptr [ebp-08]
:004241ED 89848AD8020000          mov dword ptr [edx+4*ecx+000002D8], eax
:004241F4 E968FDFFFF              jmp 00423F61

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00423F80(C)
|
:004241F9 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004241FC E8BED2FFFF              call 004214BF
:00424201 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00424204 E89FE2FFFF              call 004224A8
:00424209 8B45F8                  mov eax, dword ptr [ebp-08]
:0042420C C780AC04000001000000    mov dword ptr [ebx+000004AC], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00423F1D(U), :00423F4C(U)
|
:00424216 8BE5                    mov esp, ebp
:00424218 5D                      pop ebp
:00424219 C3                      ret



:0042421A BD3F4200                DWORD 00423FBD
:0042421E 2E404200                DWORD 0042402E
:00424222 47404200                DWORD 00424047
:00424226 60404200                DWORD 00424060
:0042422A 78404200                DWORD 00424078
:0042422E E2404200                DWORD 004240E2
:00424232 F8404200                DWORD 004240F8
:00424236 0E414200                DWORD 0042410E



* Referenced by a CALL at Address:
|:00425739   
|
:0042423A 55                      push ebp
:0042423B 8BEC                    mov ebp, esp
:0042423D 83EC18                  sub esp, 00000018
:00424240 56                      push esi
:00424241 894DF4                  mov dword ptr [ebp-0C], ecx
:00424244 C645F800                mov [ebp-08], 00
:00424248 C645FC00                mov [ebp-04], 00
:0042424C EB08                    jmp 00424256

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004242C7(U), :004242E3(U)
|
:0042424E 8A45FC                  mov al, byte ptr [ebp-04]
:00424251 0401                    add al, 01
:00424253 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042424C(U)
|
:00424256 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00424259 81E1FF000000            and ecx, 000000FF
:0042425F 83F973                  cmp ecx, 00000073
:00424262 0F8D80000000            jnl 004242E8
:00424268 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042426B 81E1FF000000            and ecx, 000000FF
:00424271 6BC924                  imul ecx, 00000024
:00424274 81C1502C4B00            add ecx, 004B2C50
:0042427A E8114AFFFF              call 00418C90
:0042427F 25FF000000              and eax, 000000FF
:00424284 83F802                  cmp eax, 00000002
:00424287 755A                    jne 004242E3
:00424289 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042428C 81E1FF000000            and ecx, 000000FF
:00424292 6BC924                  imul ecx, 00000024
:00424295 81C1502C4B00            add ecx, 004B2C50
:0042429B E87024FEFF              call 00406710
:004242A0 8BF0                    mov esi, eax
:004242A2 8B55F4                  mov edx, dword ptr [ebp-0C]
:004242A5 8B4A08                  mov ecx, dword ptr [edx+08]
:004242A8 E86324FEFF              call 00406710
:004242AD 3BF0                    cmp esi, eax
:004242AF 7432                    je 004242E3
:004242B1 8A45FC                  mov al, byte ptr [ebp-04]
:004242B4 50                      push eax
:004242B5 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004242B8 8A11                    mov dl, byte ptr [ecx]
:004242BA 52                      push edx
:004242BB E8BAC6FFFF              call 0042097A
:004242C0 83C408                  add esp, 00000008
:004242C3 85C0                    test eax, eax
:004242C5 7502                    jne 004242C9
:004242C7 EB85                    jmp 0042424E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004242C5(C)
|
:004242C9 8B45F8                  mov eax, dword ptr [ebp-08]
:004242CC 25FF000000              and eax, 000000FF
:004242D1 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004242D4 8A55FC                  mov dl, byte ptr [ebp-04]
:004242D7 8854010D                mov byte ptr [ecx+eax+0D], dl
:004242DB 8A45F8                  mov al, byte ptr [ebp-08]
:004242DE 0401                    add al, 01
:004242E0 8845F8                  mov byte ptr [ebp-08], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00424287(C), :004242AF(C)
|
:004242E3 E966FFFFFF              jmp 0042424E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424262(C)
|
:004242E8 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004242EB 81E1FF000000            and ecx, 000000FF
:004242F1 85C9                    test ecx, ecx
:004242F3 0F8581000000            jne 0042437A
:004242F9 8B55F4                  mov edx, dword ptr [ebp-0C]
:004242FC 8B45F4                  mov eax, dword ptr [ebp-0C]
:004242FF 8A4801                  mov cl, byte ptr [eax+01]
:00424302 884A0D                  mov byte ptr [edx+0D], cl
:00424305 8B55F4                  mov edx, dword ptr [ebp-0C]
:00424308 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042430B 8A480D                  mov cl, byte ptr [eax+0D]
:0042430E 884A0C                  mov byte ptr [edx+0C], cl
:00424311 8B55F4                  mov edx, dword ptr [ebp-0C]
:00424314 C7828400000000000000    mov dword ptr [ebx+00000084], 00000000
:0042431E 8B45FC                  mov eax, dword ptr [ebp-04]
:00424321 25FF000000              and eax, 000000FF
:00424326 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00424329 C684015502000000        mov byte ptr [ecx+eax+00000255], 00
:00424331 6A00                    push 00000000
:00424333 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00424336 E8C0CBFFFF              call 00420EFB
:0042433B 8B55F4                  mov edx, dword ptr [ebp-0C]
:0042433E 3B82D0020000            cmp eax, dword ptr [edx+000002D0]
:00424344 760F                    jbe 00424355
:00424346 6A00                    push 00000000
:00424348 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042434B E8ABCBFFFF              call 00420EFB
:00424350 8945F0                  mov dword ptr [ebp-10], eax
:00424353 EB0C                    jmp 00424361

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424344(C)
|
:00424355 8B45F4                  mov eax, dword ptr [ebp-0C]
:00424358 8B88D0020000            mov ecx, dword ptr [eax+000002D0]
:0042435E 894DF0                  mov dword ptr [ebp-10], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424353(U)
|
:00424361 8B55F4                  mov edx, dword ptr [ebp-0C]
:00424364 8B45F0                  mov eax, dword ptr [ebp-10]
:00424367 8982D0020000            mov dword ptr [edx+000002D0], eax
:0042436D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00424370 E861D5FFFF              call 004218D6
:00424375 E97F010000              jmp 004244F9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004242F3(C)
|
:0042437A C645FC00                mov [ebp-04], 00
:0042437E EB09                    jmp 00424389

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004244EC(U)
|
:00424380 8A4DFC                  mov cl, byte ptr [ebp-04]
:00424383 80C101                  add cl, 01
:00424386 884DFC                  mov byte ptr [ebp-04], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042437E(U)
|
:00424389 8B55FC                  mov edx, dword ptr [ebp-04]
:0042438C 81E2FF000000            and edx, 000000FF
:00424392 8B45F4                  mov eax, dword ptr [ebp-0C]
:00424395 33C9                    xor ecx, ecx
:00424397 8A4C100D                mov cl, byte ptr [eax+edx+0D]
:0042439B 81F9FF000000            cmp ecx, 000000FF
:004243A1 0F844A010000            je 004244F1
:004243A7 8B55FC                  mov edx, dword ptr [ebp-04]
:004243AA 81E2FF000000            and edx, 000000FF
:004243B0 8B45F4                  mov eax, dword ptr [ebp-0C]
:004243B3 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004243B6 8A54110D                mov dl, byte ptr [ecx+edx+0D]
:004243BA 88500C                  mov byte ptr [eax+0C], dl
:004243BD 6A00                    push 00000000
:004243BF 8B45F4                  mov eax, dword ptr [ebp-0C]
:004243C2 8A08                    mov cl, byte ptr [eax]
:004243C4 51                      push ecx
:004243C5 8B55F4                  mov edx, dword ptr [ebp-0C]
:004243C8 33C0                    xor eax, eax
:004243CA 8A420C                  mov al, byte ptr [edx+0C]
:004243CD 8BC8                    mov ecx, eax
:004243CF 6BC924                  imul ecx, 00000024
:004243D2 81C1502C4B00            add ecx, 004B2C50
:004243D8 E893B20300              call 0045F670
:004243DD 6BC048                  imul eax, 00000048
:004243E0 05681B4A00              add eax, 004A1B68
:004243E5 50                      push eax
:004243E6 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004243E9 33D2                    xor edx, edx
:004243EB 8A510C                  mov dl, byte ptr [ecx+0C]
:004243EE 6BD224                  imul edx, 00000024
:004243F1 81C2502C4B00            add edx, 004B2C50
:004243F7 52                      push edx
:004243F8 8B45F4                  mov eax, dword ptr [ebp-0C]
:004243FB 8B4808                  mov ecx, dword ptr [eax+08]
:004243FE E8A77B0100              call 0043BFAA
:00424403 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00424406 81E1FF000000            and ecx, 000000FF
:0042440C 8B55F4                  mov edx, dword ptr [ebp-0C]
:0042440F 89848A84000000          mov dword ptr [edx+4*ecx+00000084], eax
:00424416 8B45FC                  mov eax, dword ptr [ebp-04]
:00424419 25FF000000              and eax, 000000FF
:0042441E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00424421 83BC818400000000        cmp dword ptr [ecx+4*eax+00000084], 00000000
:00424429 7516                    jne 00424441
:0042442B 8B55FC                  mov edx, dword ptr [ebp-04]
:0042442E 81E2FF000000            and edx, 000000FF
:00424434 8B45F4                  mov eax, dword ptr [ebp-0C]
:00424437 C684105502000000        mov byte ptr [eax+edx+00000255], 00
:0042443F EB14                    jmp 00424455

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424429(C)
|
:00424441 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00424444 81E1FF000000            and ecx, 000000FF
:0042444A 8B55F4                  mov edx, dword ptr [ebp-0C]
:0042444D C6840A5502000040        mov byte ptr [edx+ecx+00000255], 40

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042443F(U)
|
:00424455 8A45FC                  mov al, byte ptr [ebp-04]
:00424458 50                      push eax
:00424459 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042445C E89ACAFFFF              call 00420EFB
:00424461 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00424464 3B81D0020000            cmp eax, dword ptr [ecx+000002D0]
:0042446A 7611                    jbe 0042447D
:0042446C 8A55FC                  mov dl, byte ptr [ebp-04]
:0042446F 52                      push edx
:00424470 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00424473 E883CAFFFF              call 00420EFB
:00424478 8945EC                  mov dword ptr [ebp-14], eax
:0042447B EB0C                    jmp 00424489

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042446A(C)
|
:0042447D 8B45F4                  mov eax, dword ptr [ebp-0C]
:00424480 8B88D0020000            mov ecx, dword ptr [eax+000002D0]
:00424486 894DEC                  mov dword ptr [ebp-14], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042447B(U)
|
:00424489 8B55F4                  mov edx, dword ptr [ebp-0C]
:0042448C 8B45EC                  mov eax, dword ptr [ebp-14]
:0042448F 8982D0020000            mov dword ptr [edx+000002D0], eax
:00424495 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00424498 E8EECDFFFF              call 0042128B
:0042449D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004244A0 3B81D4020000            cmp eax, dword ptr [ecx+000002D4]
:004244A6 760D                    jbe 004244B5
:004244A8 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004244AB E8DBCDFFFF              call 0042128B
:004244B0 8945E8                  mov dword ptr [ebp-18], eax
:004244B3 EB0C                    jmp 004244C1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004244A6(C)
|
:004244B5 8B55F4                  mov edx, dword ptr [ebp-0C]
:004244B8 8B82D4020000            mov eax, dword ptr [edx+000002D4]
:004244BE 8945E8                  mov dword ptr [ebp-18], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004244B3(U)
|
:004244C1 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004244C4 8B55E8                  mov edx, dword ptr [ebp-18]
:004244C7 8991D4020000            mov dword ptr [ecx+000002D4], edx
:004244CD 8A45FC                  mov al, byte ptr [ebp-04]
:004244D0 50                      push eax
:004244D1 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004244D4 E8CACEFFFF              call 004213A3
:004244D9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004244DC 81E1FF000000            and ecx, 000000FF
:004244E2 8B55F4                  mov edx, dword ptr [ebp-0C]
:004244E5 89848AD8020000          mov dword ptr [edx+4*ecx+000002D8], eax
:004244EC E98FFEFFFF              jmp 00424380

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004243A1(C)
|
:004244F1 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004244F4 E8C6CFFFFF              call 004214BF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424375(U)
|
:004244F9 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004244FC E8A7DFFFFF              call 004224A8
:00424501 8B45F4                  mov eax, dword ptr [ebp-0C]
:00424504 C780AC04000001000000    mov dword ptr [ebx+000004AC], 00000001
:0042450E 5E                      pop esi
:0042450F 8BE5                    mov esp, ebp
:00424511 5D                      pop ebp
:00424512 C3                      ret



* Referenced by a CALL at Address:
|:00425985   
|
:00424513 55                      push ebp
:00424514 8BEC                    mov ebp, esp
:00424516 83EC14                  sub esp, 00000014
:00424519 56                      push esi
:0042451A 894DF4                  mov dword ptr [ebp-0C], ecx
:0042451D C645F800                mov [ebp-08], 00
:00424521 C645FC00                mov [ebp-04], 00
:00424525 EB08                    jmp 0042452F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004245A3(U), :004245C1(U)
|
:00424527 8A45FC                  mov al, byte ptr [ebp-04]
:0042452A 0401                    add al, 01
:0042452C 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424525(U)
|
:0042452F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00424532 81E1FF000000            and ecx, 000000FF
:00424538 83F973                  cmp ecx, 00000073
:0042453B 0F8D85000000            jnl 004245C6
:00424541 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00424544 81E1FF000000            and ecx, 000000FF
:0042454A 6BC924                  imul ecx, 00000024
:0042454D 81C1502C4B00            add ecx, 004B2C50
:00424553 E83847FFFF              call 00418C90
:00424558 25FF000000              and eax, 000000FF
:0042455D 83F802                  cmp eax, 00000002
:00424560 755F                    jne 004245C1
:00424562 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00424565 81E1FF000000            and ecx, 000000FF
:0042456B 6BC924                  imul ecx, 00000024
:0042456E 81C1502C4B00            add ecx, 004B2C50
:00424574 E89721FEFF              call 00406710
:00424579 8BF0                    mov esi, eax
:0042457B 8B55F4                  mov edx, dword ptr [ebp-0C]
:0042457E 8B4A08                  mov ecx, dword ptr [edx+08]
:00424581 E88A21FEFF              call 00406710
:00424586 3BF0                    cmp esi, eax
:00424588 7537                    jne 004245C1
:0042458A 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042458D 8A480C                  mov cl, byte ptr [eax+0C]
:00424590 51                      push ecx
:00424591 8B55F4                  mov edx, dword ptr [ebp-0C]
:00424594 8A02                    mov al, byte ptr [edx]
:00424596 50                      push eax
:00424597 E8DEC3FFFF              call 0042097A
:0042459C 83C408                  add esp, 00000008
:0042459F 85C0                    test eax, eax
:004245A1 7502                    jne 004245A5
:004245A3 EB82                    jmp 00424527

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004245A1(C)
|
:004245A5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004245A8 81E1FF000000            and ecx, 000000FF
:004245AE 8B55F4                  mov edx, dword ptr [ebp-0C]
:004245B1 8A45FC                  mov al, byte ptr [ebp-04]
:004245B4 88440A0D                mov byte ptr [edx+ecx+0D], al
:004245B8 8A4DF8                  mov cl, byte ptr [ebp-08]
:004245BB 80C101                  add cl, 01
:004245BE 884DF8                  mov byte ptr [ebp-08], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00424560(C), :00424588(C)
|
:004245C1 E961FFFFFF              jmp 00424527

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042453B(C)
|
:004245C6 C645FC00                mov [ebp-04], 00
:004245CA EB09                    jmp 004245D5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424734(U)
|
:004245CC 8A55FC                  mov dl, byte ptr [ebp-04]
:004245CF 80C201                  add dl, 01
:004245D2 8855FC                  mov byte ptr [ebp-04], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004245CA(U)
|
:004245D5 8B45FC                  mov eax, dword ptr [ebp-04]
:004245D8 25FF000000              and eax, 000000FF
:004245DD 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004245E0 33D2                    xor edx, edx
:004245E2 8A54010D                mov dl, byte ptr [ecx+eax+0D]
:004245E6 81FAFF000000            cmp edx, 000000FF
:004245EC 0F8447010000            je 00424739
:004245F2 8B45FC                  mov eax, dword ptr [ebp-04]
:004245F5 25FF000000              and eax, 000000FF
:004245FA 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004245FD 8B55F4                  mov edx, dword ptr [ebp-0C]
:00424600 8A44020D                mov al, byte ptr [edx+eax+0D]
:00424604 88410C                  mov byte ptr [ecx+0C], al
:00424607 6A00                    push 00000000
:00424609 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042460C 8A5101                  mov dl, byte ptr [ecx+01]
:0042460F 52                      push edx
:00424610 8B45F4                  mov eax, dword ptr [ebp-0C]
:00424613 8A08                    mov cl, byte ptr [eax]
:00424615 51                      push ecx
:00424616 8B55F4                  mov edx, dword ptr [ebp-0C]
:00424619 33C0                    xor eax, eax
:0042461B 8A420C                  mov al, byte ptr [edx+0C]
:0042461E 8BC8                    mov ecx, eax
:00424620 6BC924                  imul ecx, 00000024
:00424623 81C1502C4B00            add ecx, 004B2C50
:00424629 E81A7F0100              call 0043C548
:0042462E F7D8                    neg eax
:00424630 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00424633 81E1FF000000            and ecx, 000000FF
:00424639 8B55F4                  mov edx, dword ptr [ebp-0C]
:0042463C 89848A84000000          mov dword ptr [edx+4*ecx+00000084], eax
:00424643 8B45F4                  mov eax, dword ptr [ebp-0C]
:00424646 8A08                    mov cl, byte ptr [eax]
:00424648 51                      push ecx
:00424649 6A02                    push 00000002
:0042464B 8B55F4                  mov edx, dword ptr [ebp-0C]
:0042464E 33C0                    xor eax, eax
:00424650 8A420C                  mov al, byte ptr [edx+0C]
:00424653 6BC024                  imul eax, 00000024
:00424656 05502C4B00              add eax, 004B2C50
:0042465B 50                      push eax
:0042465C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042465F 8B4908                  mov ecx, dword ptr [ecx+08]
:00424662 E8496E0100              call 0043B4B0
:00424667 85C0                    test eax, eax
:00424669 741E                    je 00424689
:0042466B 8B55FC                  mov edx, dword ptr [ebp-04]
:0042466E 81E2FF000000            and edx, 000000FF
:00424674 8B45F4                  mov eax, dword ptr [ebp-0C]
:00424677 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042467A 8A8954020000            mov cl, byte ptr [ecx+00000254]
:00424680 888C1055020000          mov byte ptr [eax+edx+00000255], cl
:00424687 EB14                    jmp 0042469D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424669(C)
|
:00424689 8B55FC                  mov edx, dword ptr [ebp-04]
:0042468C 81E2FF000000            and edx, 000000FF
:00424692 8B45F4                  mov eax, dword ptr [ebp-0C]
:00424695 C684105502000000        mov byte ptr [eax+edx+00000255], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424687(U)
|
:0042469D 8A4DFC                  mov cl, byte ptr [ebp-04]
:004246A0 51                      push ecx
:004246A1 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004246A4 E852C8FFFF              call 00420EFB
:004246A9 8B55F4                  mov edx, dword ptr [ebp-0C]
:004246AC 3B82D0020000            cmp eax, dword ptr [edx+000002D0]
:004246B2 7611                    jbe 004246C5
:004246B4 8A45FC                  mov al, byte ptr [ebp-04]
:004246B7 50                      push eax
:004246B8 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004246BB E83BC8FFFF              call 00420EFB
:004246C0 8945F0                  mov dword ptr [ebp-10], eax
:004246C3 EB0C                    jmp 004246D1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004246B2(C)
|
:004246C5 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004246C8 8B91D0020000            mov edx, dword ptr [ecx+000002D0]
:004246CE 8955F0                  mov dword ptr [ebp-10], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004246C3(U)
|
:004246D1 8B45F4                  mov eax, dword ptr [ebp-0C]
:004246D4 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004246D7 8988D0020000            mov dword ptr [eax+000002D0], ecx
:004246DD 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004246E0 E8A6CBFFFF              call 0042128B
:004246E5 8B55F4                  mov edx, dword ptr [ebp-0C]
:004246E8 3B82D4020000            cmp eax, dword ptr [edx+000002D4]
:004246EE 760D                    jbe 004246FD
:004246F0 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004246F3 E893CBFFFF              call 0042128B
:004246F8 8945EC                  mov dword ptr [ebp-14], eax
:004246FB EB0C                    jmp 00424709

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004246EE(C)
|
:004246FD 8B45F4                  mov eax, dword ptr [ebp-0C]
:00424700 8B88D4020000            mov ecx, dword ptr [eax+000002D4]
:00424706 894DEC                  mov dword ptr [ebp-14], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004246FB(U)
|
:00424709 8B55F4                  mov edx, dword ptr [ebp-0C]
:0042470C 8B45EC                  mov eax, dword ptr [ebp-14]
:0042470F 8982D4020000            mov dword ptr [edx+000002D4], eax
:00424715 8A4DFC                  mov cl, byte ptr [ebp-04]
:00424718 51                      push ecx
:00424719 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042471C E882CCFFFF              call 004213A3
:00424721 8B55FC                  mov edx, dword ptr [ebp-04]
:00424724 81E2FF000000            and edx, 000000FF
:0042472A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042472D 898491D8020000          mov dword ptr [ecx+4*edx+000002D8], eax
:00424734 E993FEFFFF              jmp 004245CC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004245EC(C)
|
:00424739 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042473C E87ECDFFFF              call 004214BF
:00424741 C645FC00                mov [ebp-04], 00
:00424745 EB09                    jmp 00424750

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004247F9(U)
|
:00424747 8A55FC                  mov dl, byte ptr [ebp-04]
:0042474A 80C201                  add dl, 01
:0042474D 8855FC                  mov byte ptr [ebp-04], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424745(U)
|
:00424750 8B45FC                  mov eax, dword ptr [ebp-04]
:00424753 25FF000000              and eax, 000000FF
:00424758 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042475B 33D2                    xor edx, edx
:0042475D 8A54010D                mov dl, byte ptr [ecx+eax+0D]
:00424761 81FAFF000000            cmp edx, 000000FF
:00424767 0F8491000000            je 004247FE
:0042476D 8B45FC                  mov eax, dword ptr [ebp-04]
:00424770 25FF000000              and eax, 000000FF
:00424775 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00424778 33D2                    xor edx, edx
:0042477A 8A940155020000          mov dl, byte ptr [ecx+eax+00000255]
:00424781 85D2                    test edx, edx
:00424783 7474                    je 004247F9
:00424785 8B45FC                  mov eax, dword ptr [ebp-04]
:00424788 25FF000000              and eax, 000000FF
:0042478D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00424790 33D2                    xor edx, edx
:00424792 8A54010D                mov dl, byte ptr [ecx+eax+0D]
:00424796 8BCA                    mov ecx, edx
:00424798 6BC924                  imul ecx, 00000024
:0042479B 81C1502C4B00            add ecx, 004B2C50
:004247A1 E8EAE40400              call 00472C90
:004247A6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004247A9 81E1FF000000            and ecx, 000000FF
:004247AF 8B55F4                  mov edx, dword ptr [ebp-0C]
:004247B2 2B848A84000000          sub eax, dword ptr [edx+4*ecx+00000084]
:004247B9 50                      push eax
:004247BA 8B45FC                  mov eax, dword ptr [ebp-04]
:004247BD 25FF000000              and eax, 000000FF
:004247C2 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004247C5 33D2                    xor edx, edx
:004247C7 8A54010D                mov dl, byte ptr [ecx+eax+0D]
:004247CB 8BCA                    mov ecx, edx
:004247CD 6BC924                  imul ecx, 00000024
:004247D0 81C1502C4B00            add ecx, 004B2C50
:004247D6 E8F2AE0100              call 0043F6CD
:004247DB 8B45FC                  mov eax, dword ptr [ebp-04]
:004247DE 25FF000000              and eax, 000000FF
:004247E3 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004247E6 8A54010D                mov dl, byte ptr [ecx+eax+0D]
:004247EA 52                      push edx
:004247EB 8B45F4                  mov eax, dword ptr [ebp-0C]
:004247EE 8A08                    mov cl, byte ptr [eax]
:004247F0 51                      push ecx
:004247F1 E82FC6FFFF              call 00420E25
:004247F6 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424783(C)
|
:004247F9 E949FFFFFF              jmp 00424747

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424767(C)
|
:004247FE 8B55F4                  mov edx, dword ptr [ebp-0C]
:00424801 C782AC04000001000000    mov dword ptr [ebx+000004AC], 00000001
:0042480B 5E                      pop esi
:0042480C 8BE5                    mov esp, ebp
:0042480E 5D                      pop ebp
:0042480F C3                      ret



* Referenced by a CALL at Address:
|:00425971   
|
:00424810 55                      push ebp
:00424811 8BEC                    mov ebp, esp
:00424813 83EC2C                  sub esp, 0000002C
:00424816 894DE4                  mov dword ptr [ebp-1C], ecx
:00424819 C645F800                mov [ebp-08], 00
:0042481D C645FC00                mov [ebp-04], 00
:00424821 EB08                    jmp 0042482B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00424873(U), :0042488F(U)
|
:00424823 8A45FC                  mov al, byte ptr [ebp-04]
:00424826 0401                    add al, 01
:00424828 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424821(U)
|
:0042482B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042482E 81E1FF000000            and ecx, 000000FF
:00424834 83F973                  cmp ecx, 00000073
:00424837 7D58                    jge 00424891
:00424839 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042483C 81E1FF000000            and ecx, 000000FF
:00424842 6BC924                  imul ecx, 00000024
:00424845 81C1502C4B00            add ecx, 004B2C50
:0042484B E84044FFFF              call 00418C90
:00424850 25FF000000              and eax, 000000FF
:00424855 83F802                  cmp eax, 00000002
:00424858 7535                    jne 0042488F
:0042485A 8B55E4                  mov edx, dword ptr [ebp-1C]
:0042485D 8A420C                  mov al, byte ptr [edx+0C]
:00424860 50                      push eax
:00424861 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00424864 8A11                    mov dl, byte ptr [ecx]
:00424866 52                      push edx
:00424867 E80EC1FFFF              call 0042097A
:0042486C 83C408                  add esp, 00000008
:0042486F 85C0                    test eax, eax
:00424871 7502                    jne 00424875
:00424873 EBAE                    jmp 00424823

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424871(C)
|
:00424875 8B45F8                  mov eax, dword ptr [ebp-08]
:00424878 25FF000000              and eax, 000000FF
:0042487D 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00424880 8A55FC                  mov dl, byte ptr [ebp-04]
:00424883 8854010D                mov byte ptr [ecx+eax+0D], dl
:00424887 8A45F8                  mov al, byte ptr [ebp-08]
:0042488A 0401                    add al, 01
:0042488C 8845F8                  mov byte ptr [ebp-08], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424858(C)
|
:0042488F EB92                    jmp 00424823

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424837(C)
|
:00424891 C645FC00                mov [ebp-04], 00
:00424895 EB09                    jmp 004248A0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424A66(U)
|
:00424897 8A4DFC                  mov cl, byte ptr [ebp-04]
:0042489A 80C101                  add cl, 01
:0042489D 884DFC                  mov byte ptr [ebp-04], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424895(U)
|
:004248A0 8B55FC                  mov edx, dword ptr [ebp-04]
:004248A3 81E2FF000000            and edx, 000000FF
:004248A9 8B45E4                  mov eax, dword ptr [ebp-1C]
:004248AC 33C9                    xor ecx, ecx
:004248AE 8A4C100D                mov cl, byte ptr [eax+edx+0D]
:004248B2 81F9FF000000            cmp ecx, 000000FF
:004248B8 0F84AD010000            je 00424A6B
:004248BE 8B55FC                  mov edx, dword ptr [ebp-04]
:004248C1 81E2FF000000            and edx, 000000FF
:004248C7 8B45E4                  mov eax, dword ptr [ebp-1C]
:004248CA 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004248CD 8A54110D                mov dl, byte ptr [ecx+edx+0D]
:004248D1 88500C                  mov byte ptr [eax+0C], dl

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:004248D4 6A07                    push 00000007
:004248D6 E838B20500              call 0047FB13
:004248DB 83C404                  add esp, 00000004
:004248DE 8945E0                  mov dword ptr [ebp-20], eax
:004248E1 837DE006                cmp dword ptr [ebp-20], 00000006
:004248E5 0F87E4000000            ja 004249CF
:004248EB 8B45E0                  mov eax, dword ptr [ebp-20]
:004248EE FF2485214E4200          jmp dword ptr [4*eax+00424E21]
:004248F5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004248F8 81E1FF000000            and ecx, 000000FF
:004248FE 8B55E4                  mov edx, dword ptr [ebp-1C]
:00424901 C6840A5502000071        mov byte ptr [edx+ecx+00000255], 71
:00424909 E9C1000000              jmp 004249CF
:0042490E 8B45FC                  mov eax, dword ptr [ebp-04]
:00424911 25FF000000              and eax, 000000FF
:00424916 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00424919 C684015502000072        mov byte ptr [ecx+eax+00000255], 72
:00424921 E9A9000000              jmp 004249CF
:00424926 8B55FC                  mov edx, dword ptr [ebp-04]
:00424929 81E2FF000000            and edx, 000000FF
:0042492F 8B45E4                  mov eax, dword ptr [ebp-1C]
:00424932 C684105502000074        mov byte ptr [eax+edx+00000255], 74
:0042493A E990000000              jmp 004249CF
:0042493F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00424942 81E1FF000000            and ecx, 000000FF
:00424948 8B55E4                  mov edx, dword ptr [ebp-1C]
:0042494B C6840A5502000070        mov byte ptr [edx+ecx+00000255], 70
:00424953 EB7A                    jmp 004249CF
:00424955 8B45FC                  mov eax, dword ptr [ebp-04]
:00424958 25FF000000              and eax, 000000FF
:0042495D 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00424960 C68401550200006F        mov byte ptr [ecx+eax+00000255], 6F
:00424968 EB65                    jmp 004249CF
:0042496A 8B55FC                  mov edx, dword ptr [ebp-04]
:0042496D 81E2FF000000            and edx, 000000FF
:00424973 8B45E4                  mov eax, dword ptr [ebp-1C]
:00424976 C6841055020000AF        mov byte ptr [eax+edx+00000255], AF
:0042497E EB4F                    jmp 004249CF
:00424980 6A00                    push 00000000
:00424982 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00424985 8A5101                  mov dl, byte ptr [ecx+01]
:00424988 52                      push edx
:00424989 8B45E4                  mov eax, dword ptr [ebp-1C]
:0042498C 8A08                    mov cl, byte ptr [eax]
:0042498E 51                      push ecx
:0042498F 8B55E4                  mov edx, dword ptr [ebp-1C]
:00424992 33C0                    xor eax, eax
:00424994 8A420C                  mov al, byte ptr [edx+0C]
:00424997 8BC8                    mov ecx, eax
:00424999 6BC924                  imul ecx, 00000024
:0042499C 81C1502C4B00            add ecx, 004B2C50
:004249A2 E8A17B0100              call 0043C548
:004249A7 F7D8                    neg eax
:004249A9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004249AC 81E1FF000000            and ecx, 000000FF
:004249B2 8B55E4                  mov edx, dword ptr [ebp-1C]
:004249B5 89848A84000000          mov dword ptr [edx+4*ecx+00000084], eax
:004249BC 8B45FC                  mov eax, dword ptr [ebp-04]
:004249BF 25FF000000              and eax, 000000FF
:004249C4 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004249C7 C684015502000080        mov byte ptr [ecx+eax+00000255], 80

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004248E5(C), :00424909(U), :00424921(U), :0042493A(U), :00424953(U)
|:00424968(U), :0042497E(U)
|
:004249CF 8A55FC                  mov dl, byte ptr [ebp-04]
:004249D2 52                      push edx
:004249D3 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004249D6 E820C5FFFF              call 00420EFB
:004249DB 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004249DE 3B81D0020000            cmp eax, dword ptr [ecx+000002D0]
:004249E4 7611                    jbe 004249F7
:004249E6 8A55FC                  mov dl, byte ptr [ebp-04]
:004249E9 52                      push edx
:004249EA 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004249ED E809C5FFFF              call 00420EFB
:004249F2 8945DC                  mov dword ptr [ebp-24], eax
:004249F5 EB0C                    jmp 00424A03

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004249E4(C)
|
:004249F7 8B45E4                  mov eax, dword ptr [ebp-1C]
:004249FA 8B88D0020000            mov ecx, dword ptr [eax+000002D0]
:00424A00 894DDC                  mov dword ptr [ebp-24], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004249F5(U)
|
:00424A03 8B55E4                  mov edx, dword ptr [ebp-1C]
:00424A06 8B45DC                  mov eax, dword ptr [ebp-24]
:00424A09 8982D0020000            mov dword ptr [edx+000002D0], eax
:00424A0F 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00424A12 E874C8FFFF              call 0042128B
:00424A17 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00424A1A 3B81D4020000            cmp eax, dword ptr [ecx+000002D4]
:00424A20 760D                    jbe 00424A2F
:00424A22 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00424A25 E861C8FFFF              call 0042128B
:00424A2A 8945D8                  mov dword ptr [ebp-28], eax
:00424A2D EB0C                    jmp 00424A3B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424A20(C)
|
:00424A2F 8B55E4                  mov edx, dword ptr [ebp-1C]
:00424A32 8B82D4020000            mov eax, dword ptr [edx+000002D4]
:00424A38 8945D8                  mov dword ptr [ebp-28], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424A2D(U)
|
:00424A3B 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00424A3E 8B55D8                  mov edx, dword ptr [ebp-28]
:00424A41 8991D4020000            mov dword ptr [ecx+000002D4], edx
:00424A47 8A45FC                  mov al, byte ptr [ebp-04]
:00424A4A 50                      push eax
:00424A4B 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00424A4E E850C9FFFF              call 004213A3
:00424A53 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00424A56 81E1FF000000            and ecx, 000000FF
:00424A5C 8B55E4                  mov edx, dword ptr [ebp-1C]
:00424A5F 89848AD8020000          mov dword ptr [edx+4*ecx+000002D8], eax
:00424A66 E92CFEFFFF              jmp 00424897

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004248B8(C)
|
:00424A6B 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00424A6E E84CCAFFFF              call 004214BF
:00424A73 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00424A76 E8D7090000              call 00425452
:00424A7B B9083D4B00              mov ecx, 004B3D08
:00424A80 E84B78FFFF              call 0041C2D0
:00424A85 25FF000000              and eax, 000000FF
:00424A8A 99                      cdq
:00424A8B 33C2                    xor eax, edx
:00424A8D 2BC2                    sub eax, edx
:00424A8F 83E003                  and eax, 00000003
:00424A92 33C2                    xor eax, edx
:00424A94 2BC2                    sub eax, edx
:00424A96 83F802                  cmp eax, 00000002
:00424A99 7D14                    jge 00424AAF
:00424A9B B9083D4B00              mov ecx, 004B3D08
:00424AA0 E88B1CFEFF              call 00406730
:00424AA5 B9083D4B00              mov ecx, 004B3D08
:00424AAA E8811CFEFF              call 00406730

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424A99(C)
|
:00424AAF B950424B00              mov ecx, 004B4250
:00424AB4 E85AF00200              call 00453B13
:00424AB9 C645FC00                mov [ebp-04], 00
:00424ABD EB08                    jmp 00424AC7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424E0B(U)
|
:00424ABF 8A45FC                  mov al, byte ptr [ebp-04]
:00424AC2 0401                    add al, 01
:00424AC4 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424ABD(U)
|
:00424AC7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00424ACA 81E1FF000000            and ecx, 000000FF
:00424AD0 8B55E4                  mov edx, dword ptr [ebp-1C]
:00424AD3 33C0                    xor eax, eax
:00424AD5 8A440A0D                mov al, byte ptr [edx+ecx+0D]
:00424AD9 3DFF000000              cmp eax, 000000FF
:00424ADE 0F842C030000            je 00424E10
:00424AE4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00424AE7 81E1FF000000            and ecx, 000000FF
:00424AED 8B55E4                  mov edx, dword ptr [ebp-1C]
:00424AF0 33C0                    xor eax, eax
:00424AF2 8A840A55020000          mov al, byte ptr [edx+ecx+00000255]
:00424AF9 8945D4                  mov dword ptr [ebp-2C], eax
:00424AFC 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00424AFF 83E96F                  sub ecx, 0000006F
:00424B02 894DD4                  mov dword ptr [ebp-2C], ecx
:00424B05 837DD440                cmp dword ptr [ebp-2C], 00000040
:00424B09 0F87E3010000            ja 00424CF2
:00424B0F 8B45D4                  mov eax, dword ptr [ebp-2C]
:00424B12 33D2                    xor edx, edx
:00424B14 8A905D4E4200            mov dl, byte ptr [eax+00424E5D]
:00424B1A FF24953D4E4200          jmp dword ptr [4*edx+00424E3D]
:00424B21 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00424B24 81E1FF000000            and ecx, 000000FF
:00424B2A 8B55E4                  mov edx, dword ptr [ebp-1C]
:00424B2D 8A440A0D                mov al, byte ptr [edx+ecx+0D]
:00424B31 50                      push eax
:00424B32 6A17                    push 00000017
:00424B34 E879C1FFFF              call 00420CB2
:00424B39 83C408                  add esp, 00000008
:00424B3C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00424B3F 81E1FF000000            and ecx, 000000FF
:00424B45 8B55E4                  mov edx, dword ptr [ebp-1C]
:00424B48 8A440A0D                mov al, byte ptr [edx+ecx+0D]
:00424B4C 50                      push eax
:00424B4D 6A19                    push 00000019
:00424B4F E85EC1FFFF              call 00420CB2
:00424B54 83C408                  add esp, 00000008
:00424B57 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00424B5A 81E1FF000000            and ecx, 000000FF
:00424B60 8B55E4                  mov edx, dword ptr [ebp-1C]
:00424B63 8A440A0D                mov al, byte ptr [edx+ecx+0D]
:00424B67 50                      push eax
:00424B68 6A1B                    push 0000001B
:00424B6A E843C1FFFF              call 00420CB2
:00424B6F 83C408                  add esp, 00000008
:00424B72 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00424B75 81E1FF000000            and ecx, 000000FF
:00424B7B 8B55E4                  mov edx, dword ptr [ebp-1C]
:00424B7E 8A440A0D                mov al, byte ptr [edx+ecx+0D]
:00424B82 50                      push eax
:00424B83 6A1D                    push 0000001D
:00424B85 E828C1FFFF              call 00420CB2
:00424B8A 83C408                  add esp, 00000008
:00424B8D E960010000              jmp 00424CF2
:00424B92 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00424B95 81E1FF000000            and ecx, 000000FF
:00424B9B 8B55E4                  mov edx, dword ptr [ebp-1C]
:00424B9E 8A440A0D                mov al, byte ptr [edx+ecx+0D]
:00424BA2 50                      push eax
:00424BA3 6A1F                    push 0000001F
:00424BA5 E87BC2FFFF              call 00420E25
:00424BAA 83C408                  add esp, 00000008
:00424BAD E940010000              jmp 00424CF2
:00424BB2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00424BB5 81E1FF000000            and ecx, 000000FF
:00424BBB 8B55E4                  mov edx, dword ptr [ebp-1C]
:00424BBE 8A440A0D                mov al, byte ptr [edx+ecx+0D]
:00424BC2 50                      push eax
:00424BC3 6A21                    push 00000021
:00424BC5 E85BC2FFFF              call 00420E25
:00424BCA 83C408                  add esp, 00000008
:00424BCD E920010000              jmp 00424CF2
:00424BD2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00424BD5 81E1FF000000            and ecx, 000000FF
:00424BDB 8B55E4                  mov edx, dword ptr [ebp-1C]
:00424BDE 8A440A0D                mov al, byte ptr [edx+ecx+0D]
:00424BE2 50                      push eax
:00424BE3 6A23                    push 00000023
:00424BE5 E83BC2FFFF              call 00420E25
:00424BEA 83C408                  add esp, 00000008
:00424BED E900010000              jmp 00424CF2
:00424BF2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00424BF5 81E1FF000000            and ecx, 000000FF
:00424BFB 8B55E4                  mov edx, dword ptr [ebp-1C]
:00424BFE 8A440A0D                mov al, byte ptr [edx+ecx+0D]
:00424C02 50                      push eax
:00424C03 6A25                    push 00000025
:00424C05 E81BC2FFFF              call 00420E25
:00424C0A 83C408                  add esp, 00000008
:00424C0D E9E0000000              jmp 00424CF2
:00424C12 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00424C15 81E1FF000000            and ecx, 000000FF
:00424C1B 8B55E4                  mov edx, dword ptr [ebp-1C]
:00424C1E 8A440A0D                mov al, byte ptr [edx+ecx+0D]
:00424C22 50                      push eax
:00424C23 6A31                    push 00000031
:00424C25 E888C0FFFF              call 00420CB2
:00424C2A 83C408                  add esp, 00000008
:00424C2D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00424C30 81E1FF000000            and ecx, 000000FF
:00424C36 8B55E4                  mov edx, dword ptr [ebp-1C]
:00424C39 8A440A0D                mov al, byte ptr [edx+ecx+0D]
:00424C3D 50                      push eax
:00424C3E 6A33                    push 00000033
:00424C40 E86DC0FFFF              call 00420CB2
:00424C45 83C408                  add esp, 00000008
:00424C48 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00424C4B 81E1FF000000            and ecx, 000000FF
:00424C51 8B55E4                  mov edx, dword ptr [ebp-1C]
:00424C54 8A440A0D                mov al, byte ptr [edx+ecx+0D]
:00424C58 50                      push eax
:00424C59 6A35                    push 00000035
:00424C5B E852C0FFFF              call 00420CB2
:00424C60 83C408                  add esp, 00000008
:00424C63 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00424C66 81E1FF000000            and ecx, 000000FF
:00424C6C 8B55E4                  mov edx, dword ptr [ebp-1C]
:00424C6F 8A440A0D                mov al, byte ptr [edx+ecx+0D]
:00424C73 50                      push eax
:00424C74 6A37                    push 00000037
:00424C76 E837C0FFFF              call 00420CB2
:00424C7B 83C408                  add esp, 00000008
:00424C7E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00424C81 81E1FF000000            and ecx, 000000FF
:00424C87 8B55E4                  mov edx, dword ptr [ebp-1C]
:00424C8A 8A440A0D                mov al, byte ptr [edx+ecx+0D]
:00424C8E 50                      push eax
:00424C8F 6A30                    push 00000030
:00424C91 E81CC0FFFF              call 00420CB2
:00424C96 83C408                  add esp, 00000008
:00424C99 EB57                    jmp 00424CF2
:00424C9B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00424C9E 81E1FF000000            and ecx, 000000FF
:00424CA4 8B55E4                  mov edx, dword ptr [ebp-1C]
:00424CA7 33C0                    xor eax, eax
:00424CA9 8A440A0D                mov al, byte ptr [edx+ecx+0D]
:00424CAD 8BC8                    mov ecx, eax
:00424CAF 6BC924                  imul ecx, 00000024
:00424CB2 81C1502C4B00            add ecx, 004B2C50
:00424CB8 E8D3DF0400              call 00472C90
:00424CBD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00424CC0 81E1FF000000            and ecx, 000000FF
:00424CC6 8B55E4                  mov edx, dword ptr [ebp-1C]
:00424CC9 2B848A84000000          sub eax, dword ptr [edx+4*ecx+00000084]
:00424CD0 50                      push eax
:00424CD1 8B45FC                  mov eax, dword ptr [ebp-04]
:00424CD4 25FF000000              and eax, 000000FF
:00424CD9 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00424CDC 33D2                    xor edx, edx
:00424CDE 8A54010D                mov dl, byte ptr [ecx+eax+0D]
:00424CE2 8BCA                    mov ecx, edx
:00424CE4 6BC924                  imul ecx, 00000024
:00424CE7 81C1502C4B00            add ecx, 004B2C50
:00424CED E8DBA90100              call 0043F6CD

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00424B09(C), :00424B8D(U), :00424BAD(U), :00424BCD(U), :00424BED(U)
|:00424C0D(U), :00424C99(U)
|
:00424CF2 8B45FC                  mov eax, dword ptr [ebp-04]
:00424CF5 25FF000000              and eax, 000000FF
:00424CFA 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00424CFD 33D2                    xor edx, edx
:00424CFF 8A940155020000          mov dl, byte ptr [ecx+eax+00000255]
:00424D06 85D2                    test edx, edx
:00424D08 0F84FD000000            je 00424E0B
:00424D0E E8CD770000              call 0042C4E0
:00424D13 6A01                    push 00000001
:00424D15 6A7C                    push 0000007C
:00424D17 B9B0694B00              mov ecx, 004B69B0
:00424D1C E859F90400              call 0047467A
:00424D21 6A02                    push 00000002
:00424D23 B9181B4B00              mov ecx, 004B1B18
:00424D28 E813E6FDFF              call 00403340
:00424D2D 8B45FC                  mov eax, dword ptr [ebp-04]
:00424D30 25FF000000              and eax, 000000FF
:00424D35 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00424D38 33D2                    xor edx, edx
:00424D3A 8A54010D                mov dl, byte ptr [ecx+eax+0D]
:00424D3E 8BCA                    mov ecx, edx
:00424D40 6BC924                  imul ecx, 00000024
:00424D43 81C1502C4B00            add ecx, 004B2C50
:00424D49 E812E6FDFF              call 00403360
:00424D4E 50                      push eax
:00424D4F 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00424D52 81C1CB020000            add ecx, 000002CB
:00424D58 E84318FEFF              call 004065A0
:00424D5D 8B45E4                  mov eax, dword ptr [ebp-1C]
:00424D60 8A88CC020000            mov cl, byte ptr [eax+000002CC]
:00424D66 51                      push ecx
:00424D67 8B55E4                  mov edx, dword ptr [ebp-1C]
:00424D6A 8A82CB020000            mov al, byte ptr [edx+000002CB]
:00424D70 50                      push eax
:00424D71 B950424B00              mov ecx, 004B4250
:00424D76 E8C4020300              call 0045503F
:00424D7B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00424D7E 81E1FF000000            and ecx, 000000FF
:00424D84 8B55E4                  mov edx, dword ptr [ebp-1C]
:00424D87 33C0                    xor eax, eax
:00424D89 8A440A0D                mov al, byte ptr [edx+ecx+0D]
:00424D8D 8BC8                    mov ecx, eax
:00424D8F 6BC924                  imul ecx, 00000024
:00424D92 81C1502C4B00            add ecx, 004B2C50
:00424D98 E8C3E5FDFF              call 00403360
:00424D9D 50                      push eax
:00424D9E B950424B00              mov ecx, 004B4250
:00424DA3 E82BF70200              call 004544D3
:00424DA8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00424DAB 81E1FF000000            and ecx, 000000FF
:00424DB1 8B55E4                  mov edx, dword ptr [ebp-1C]
:00424DB4 33C0                    xor eax, eax
:00424DB6 8A440A0D                mov al, byte ptr [edx+ecx+0D]
:00424DBA 8BC8                    mov ecx, eax
:00424DBC 6BC924                  imul ecx, 00000024
:00424DBF 81C1502C4B00            add ecx, 004B2C50
:00424DC5 E896E5FDFF              call 00403360
:00424DCA 668B08                  mov cx, word ptr [eax]
:00424DCD 51                      push ecx
:00424DCE E8ABAC0200              call 0044FA7E
:00424DD3 83C404                  add esp, 00000004
:00424DD6 8945E8                  mov dword ptr [ebp-18], eax
:00424DD9 8955EC                  mov dword ptr [ebp-14], edx
:00424DDC 8B55E8                  mov edx, dword ptr [ebp-18]
:00424DDF 8955F0                  mov dword ptr [ebp-10], edx
:00424DE2 8B45EC                  mov eax, dword ptr [ebp-14]
:00424DE5 8945F4                  mov dword ptr [ebp-0C], eax
:00424DE8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00424DEB 81E1FF000000            and ecx, 000000FF
:00424DF1 8B55E4                  mov edx, dword ptr [ebp-1C]
:00424DF4 33C0                    xor eax, eax
:00424DF6 8A440A0D                mov al, byte ptr [edx+ecx+0D]
:00424DFA 50                      push eax
:00424DFB 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00424DFE 51                      push ecx
:00424DFF 8B55F0                  mov edx, dword ptr [ebp-10]
:00424E02 52                      push edx
:00424E03 E8179D0100              call 0043EB1F
:00424E08 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424D08(C)
|
:00424E0B E9AFFCFFFF              jmp 00424ABF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424ADE(C)
|
:00424E10 8B45E4                  mov eax, dword ptr [ebp-1C]
:00424E13 C780AC04000001000000    mov dword ptr [ebx+000004AC], 00000001
:00424E1D 8BE5                    mov esp, ebp
:00424E1F 5D                      pop ebp
:00424E20 C3                      ret



:00424E21 F5484200                DWORD 004248F5
:00424E25 0E494200                DWORD 0042490E
:00424E29 26494200                DWORD 00424926
:00424E2D 3F494200                DWORD 0042493F
:00424E31 55494200                DWORD 00424955
:00424E35 6A494200                DWORD 0042496A
:00424E39 80494200                DWORD 00424980
:00424E3D 214B4200                DWORD 00424B21
:00424E41 B24B4200                DWORD 00424BB2
:00424E45 924B4200                DWORD 00424B92
:00424E49 D24B4200                DWORD 00424BD2
:00424E4D F24B4200                DWORD 00424BF2
:00424E51 9B4C4200                DWORD 00424C9B
:00424E55 124C4200                DWORD 00424C12
:00424E59 F24C4200                DWORD 00424CF2


:00424E5D 0001                    add byte ptr [ecx], al
:00424E5F 0203                    add al, byte ptr [ebx]
:00424E61 07                      pop es
:00424E62 0407                    add al, 07
:00424E64 07                      pop es
:00424E65 07                      pop es
:00424E66 07                      pop es
:00424E67 07                      pop es
:00424E68 07                      pop es
:00424E69 07                      pop es
:00424E6A 07                      pop es
:00424E6B 07                      pop es
:00424E6C 07                      pop es
:00424E6D 07                      pop es
:00424E6E 0507070707              add eax, 07070707
:00424E73 07                      pop es
:00424E74 07                      pop es
:00424E75 07                      pop es
:00424E76 07                      pop es
:00424E77 07                      pop es
:00424E78 07                      pop es
:00424E79 07                      pop es
:00424E7A 07                      pop es
:00424E7B 07                      pop es
:00424E7C 07                      pop es
:00424E7D 07                      pop es
:00424E7E 07                      pop es
:00424E7F 07                      pop es
:00424E80 07                      pop es
:00424E81 07                      pop es
:00424E82 07                      pop es
:00424E83 07                      pop es
:00424E84 07                      pop es
:00424E85 07                      pop es
:00424E86 07                      pop es
:00424E87 07                      pop es
:00424E88 07                      pop es
:00424E89 07                      pop es
:00424E8A 07                      pop es
:00424E8B 07                      pop es
:00424E8C 07                      pop es
:00424E8D 07                      pop es
:00424E8E 07                      pop es
:00424E8F 07                      pop es
:00424E90 07                      pop es
:00424E91 07                      pop es
:00424E92 07                      pop es
:00424E93 07                      pop es
:00424E94 07                      pop es
:00424E95 07                      pop es
:00424E96 07                      pop es
:00424E97 07                      pop es
:00424E98 07                      pop es
:00424E99 07                      pop es
:00424E9A 07                      pop es
:00424E9B 07                      pop es
:00424E9C 07                      pop es
:00424E9D 06                      push es

* Referenced by a CALL at Address:
|:0042595D   
|
:00424E9E 55                      push ebp
:00424E9F 8BEC                    mov ebp, esp
:00424EA1 83EC44                  sub esp, 00000044
:00424EA4 894DC4                  mov dword ptr [ebp-3C], ecx
:00424EA7 C645D000                mov [ebp-30], 00
:00424EAB 8B45C4                  mov eax, dword ptr [ebp-3C]
:00424EAE 8A08                    mov cl, byte ptr [eax]
:00424EB0 51                      push ecx
:00424EB1 6A02                    push 00000002
:00424EB3 8B55C4                  mov edx, dword ptr [ebp-3C]
:00424EB6 8A82C9020000            mov al, byte ptr [edx+000002C9]
:00424EBC 50                      push eax
:00424EBD 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:00424EC0 8A5101                  mov dl, byte ptr [ecx+01]
:00424EC3 52                      push edx
:00424EC4 B950424B00              mov ecx, 004B4250
:00424EC9 E86F040300              call 0045533D
:00424ECE 8845E4                  mov byte ptr [ebp-1C], al
:00424ED1 8B45E4                  mov eax, dword ptr [ebp-1C]
:00424ED4 25FF000000              and eax, 000000FF
:00424ED9 3DFF000000              cmp eax, 000000FF
:00424EDE 7505                    jne 00424EE5
:00424EE0 E9F8020000              jmp 004251DD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424EDE(C)
|
:00424EE5 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:00424EE8 8B55C4                  mov edx, dword ptr [ebp-3C]
:00424EEB 8A4201                  mov al, byte ptr [edx+01]
:00424EEE 88410C                  mov byte ptr [ecx+0C], al
:00424EF1 6A00                    push 00000000
:00424EF3 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:00424EF6 E84E040000              call 00425349
:00424EFB 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:00424EFE 8A55E4                  mov dl, byte ptr [ebp-1C]
:00424F01 88510D                  mov byte ptr [ecx+0D], dl
:00424F04 C645D000                mov [ebp-30], 00
:00424F08 EB08                    jmp 00424F12

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424F2B(U)
|
:00424F0A 8A45D0                  mov al, byte ptr [ebp-30]
:00424F0D 0401                    add al, 01
:00424F0F 8845D0                  mov byte ptr [ebp-30], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424F08(U)
|
:00424F12 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00424F15 81E1FF000000            and ecx, 000000FF
:00424F1B 8B55C4                  mov edx, dword ptr [ebp-3C]
:00424F1E 33C0                    xor eax, eax
:00424F20 8A440A0E                mov al, byte ptr [edx+ecx+0E]
:00424F24 3DFF000000              cmp eax, 000000FF
:00424F29 7402                    je 00424F2D
:00424F2B EBDD                    jmp 00424F0A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424F29(C)
|
:00424F2D 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:00424F30 8B55C4                  mov edx, dword ptr [ebp-3C]
:00424F33 8A4201                  mov al, byte ptr [edx+01]
:00424F36 88410D                  mov byte ptr [ecx+0D], al
:00424F39 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:00424F3C E895C9FFFF              call 004218D6
:00424F41 C645DC00                mov [ebp-24], 00
:00424F45 EB09                    jmp 00424F50

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424F82(U)
|
:00424F47 8A4DDC                  mov cl, byte ptr [ebp-24]
:00424F4A 80C101                  add cl, 01
:00424F4D 884DDC                  mov byte ptr [ebp-24], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424F45(U)
|
:00424F50 8B55DC                  mov edx, dword ptr [ebp-24]
:00424F53 81E2FF000000            and edx, 000000FF
:00424F59 8B45D0                  mov eax, dword ptr [ebp-30]
:00424F5C 25FF000000              and eax, 000000FF
:00424F61 3BD0                    cmp edx, eax
:00424F63 7D1F                    jge 00424F84
:00424F65 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00424F68 81E1FF000000            and ecx, 000000FF
:00424F6E 8B55DC                  mov edx, dword ptr [ebp-24]
:00424F71 81E2FF000000            and edx, 000000FF
:00424F77 8B45C4                  mov eax, dword ptr [ebp-3C]
:00424F7A 8A4C080E                mov cl, byte ptr [eax+ecx+0E]
:00424F7E 884C15E4                mov byte ptr [ebp+edx-1C], cl
:00424F82 EBC3                    jmp 00424F47

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424F63(C)
|
:00424F84 8B55D0                  mov edx, dword ptr [ebp-30]
:00424F87 81E2FF000000            and edx, 000000FF
:00424F8D C64415E4FF              mov [ebp+edx-1C], FF
:00424F92 C645DC00                mov [ebp-24], 00
:00424F96 EB08                    jmp 00424FA0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424FBF(U)
|
:00424F98 8A45DC                  mov al, byte ptr [ebp-24]
:00424F9B 0401                    add al, 01
:00424F9D 8845DC                  mov byte ptr [ebp-24], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424F96(U)
|
:00424FA0 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00424FA3 81E1FF000000            and ecx, 000000FF
:00424FA9 83F905                  cmp ecx, 00000005
:00424FAC 7D13                    jge 00424FC1
:00424FAE 8B55DC                  mov edx, dword ptr [ebp-24]
:00424FB1 81E2FF000000            and edx, 000000FF
:00424FB7 8B45C4                  mov eax, dword ptr [ebp-3C]
:00424FBA C644100DFF              mov [eax+edx+0D], FF
:00424FBF EBD7                    jmp 00424F98

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424FAC(C)
|
:00424FC1 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:00424FC4 33D2                    xor edx, edx
:00424FC6 8A5101                  mov dl, byte ptr [ecx+01]
:00424FC9 8BCA                    mov ecx, edx
:00424FCB 6BC924                  imul ecx, 00000024
:00424FCE 81C1502C4B00            add ecx, 004B2C50
:00424FD4 E887E3FDFF              call 00403360
:00424FD9 668B00                  mov ax, word ptr [eax]
:00424FDC 50                      push eax
:00424FDD E89CAA0200              call 0044FA7E
:00424FE2 83C404                  add esp, 00000004
:00424FE5 8945C8                  mov dword ptr [ebp-38], eax
:00424FE8 8955CC                  mov dword ptr [ebp-34], edx
:00424FEB 8B4DC8                  mov ecx, dword ptr [ebp-38]
:00424FEE 894DD4                  mov dword ptr [ebp-2C], ecx
:00424FF1 8B55CC                  mov edx, dword ptr [ebp-34]
:00424FF4 8955D8                  mov dword ptr [ebp-28], edx
:00424FF7 8B45D8                  mov eax, dword ptr [ebp-28]
:00424FFA 83C018                  add eax, 00000018
:00424FFD 50                      push eax
:00424FFE 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00425001 83C118                  add ecx, 00000018
:00425004 51                      push ecx
:00425005 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:00425008 E86CC8FFFF              call 00421879
:0042500D 8B55C4                  mov edx, dword ptr [ebp-3C]
:00425010 C782B004000000000000    mov dword ptr [ebx+000004B0], 00000000
:0042501A C645DC00                mov [ebp-24], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004250B5(U), :004251CB(U)
|
:0042501E 8B45DC                  mov eax, dword ptr [ebp-24]
:00425021 25FF000000              and eax, 000000FF
:00425026 83F805                  cmp eax, 00000005
:00425029 0F8DA1010000            jnl 004251D0
:0042502F 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00425032 81E1FF000000            and ecx, 000000FF
:00425038 51                      push ecx
:00425039 E8D5AA0500              call 0047FB13
:0042503E 83C404                  add esp, 00000004
:00425041 8945E0                  mov dword ptr [ebp-20], eax
:00425044 8B55C4                  mov edx, dword ptr [ebp-3C]
:00425047 8B45E0                  mov eax, dword ptr [ebp-20]
:0042504A 8A4C05E4                mov cl, byte ptr [ebp+eax-1C]
:0042504E 884A0D                  mov byte ptr [edx+0D], cl
:00425051 8B55C4                  mov edx, dword ptr [ebp-3C]
:00425054 8B45C4                  mov eax, dword ptr [ebp-3C]
:00425057 8A480D                  mov cl, byte ptr [eax+0D]
:0042505A 884A0C                  mov byte ptr [edx+0C], cl
:0042505D 8B55C4                  mov edx, dword ptr [ebp-3C]
:00425060 33C0                    xor eax, eax
:00425062 8A420C                  mov al, byte ptr [edx+0C]
:00425065 8BC8                    mov ecx, eax
:00425067 6BC924                  imul ecx, 00000024
:0042506A 81C1502C4B00            add ecx, 004B2C50
:00425070 E81BDC0400              call 00472C90
:00425075 85C0                    test eax, eax
:00425077 7541                    jne 004250BA
:00425079 8A4DD0                  mov cl, byte ptr [ebp-30]
:0042507C 80E901                  sub cl, 01
:0042507F 884DD0                  mov byte ptr [ebp-30], cl
:00425082 8B55D0                  mov edx, dword ptr [ebp-30]
:00425085 81E2FF000000            and edx, 000000FF
:0042508B 8B45E0                  mov eax, dword ptr [ebp-20]
:0042508E 8A4C15E4                mov cl, byte ptr [ebp+edx-1C]
:00425092 884C05E4                mov byte ptr [ebp+eax-1C], cl
:00425096 8B55D0                  mov edx, dword ptr [ebp-30]
:00425099 81E2FF000000            and edx, 000000FF
:0042509F C64415E4FF              mov [ebp+edx-1C], FF
:004250A4 8B45D0                  mov eax, dword ptr [ebp-30]
:004250A7 25FF000000              and eax, 000000FF
:004250AC 85C0                    test eax, eax
:004250AE 7505                    jne 004250B5
:004250B0 E91B010000              jmp 004251D0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004250AE(C)
|
:004250B5 E964FFFFFF              jmp 0042501E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425077(C)
|
:004250BA 8A4DDC                  mov cl, byte ptr [ebp-24]
:004250BD 80C101                  add cl, 01
:004250C0 884DDC                  mov byte ptr [ebp-24], cl
:004250C3 6A00                    push 00000000
:004250C5 8B55C4                  mov edx, dword ptr [ebp-3C]
:004250C8 8A02                    mov al, byte ptr [edx]
:004250CA 50                      push eax
:004250CB 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:004250CE 33D2                    xor edx, edx
:004250D0 8A510C                  mov dl, byte ptr [ecx+0C]
:004250D3 8BCA                    mov ecx, edx
:004250D5 6BC924                  imul ecx, 00000024
:004250D8 81C1502C4B00            add ecx, 004B2C50
:004250DE E88DA50300              call 0045F670
:004250E3 6BC048                  imul eax, 00000048
:004250E6 05681B4A00              add eax, 004A1B68
:004250EB 50                      push eax
:004250EC 8B45C4                  mov eax, dword ptr [ebp-3C]
:004250EF 33C9                    xor ecx, ecx
:004250F1 8A480C                  mov cl, byte ptr [eax+0C]
:004250F4 6BC924                  imul ecx, 00000024
:004250F7 81C1502C4B00            add ecx, 004B2C50
:004250FD 51                      push ecx
:004250FE 8B55C4                  mov edx, dword ptr [ebp-3C]
:00425101 8B4A08                  mov ecx, dword ptr [edx+08]
:00425104 E8A16E0100              call 0043BFAA
:00425109 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:0042510C 898184000000            mov dword ptr [ecx+00000084], eax
:00425112 8B55C4                  mov edx, dword ptr [ebp-3C]
:00425115 83BA8400000000          cmp dword ptr [edx+00000084], 00000000
:0042511C 750C                    jne 0042512A
:0042511E 8B45C4                  mov eax, dword ptr [ebp-3C]
:00425121 C6805502000000          mov byte ptr [eax+00000255], 00
:00425128 EB0A                    jmp 00425134

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042511C(C)
|
:0042512A 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:0042512D C6815502000040          mov byte ptr [ecx+00000255], 40

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425128(U)
|
:00425134 6A00                    push 00000000
:00425136 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:00425139 E8BDBDFFFF              call 00420EFB
:0042513E 8B55C4                  mov edx, dword ptr [ebp-3C]
:00425141 3B82D0020000            cmp eax, dword ptr [edx+000002D0]
:00425147 760F                    jbe 00425158
:00425149 6A00                    push 00000000
:0042514B 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:0042514E E8A8BDFFFF              call 00420EFB
:00425153 8945C0                  mov dword ptr [ebp-40], eax
:00425156 EB0C                    jmp 00425164

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425147(C)
|
:00425158 8B45C4                  mov eax, dword ptr [ebp-3C]
:0042515B 8B88D0020000            mov ecx, dword ptr [eax+000002D0]
:00425161 894DC0                  mov dword ptr [ebp-40], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425156(U)
|
:00425164 8B55C4                  mov edx, dword ptr [ebp-3C]
:00425167 8B45C0                  mov eax, dword ptr [ebp-40]
:0042516A 8982D0020000            mov dword ptr [edx+000002D0], eax
:00425170 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:00425173 E813C1FFFF              call 0042128B
:00425178 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:0042517B 3B81D4020000            cmp eax, dword ptr [ecx+000002D4]
:00425181 760D                    jbe 00425190
:00425183 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:00425186 E800C1FFFF              call 0042128B
:0042518B 8945BC                  mov dword ptr [ebp-44], eax
:0042518E EB0C                    jmp 0042519C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425181(C)
|
:00425190 8B55C4                  mov edx, dword ptr [ebp-3C]
:00425193 8B82D4020000            mov eax, dword ptr [edx+000002D4]
:00425199 8945BC                  mov dword ptr [ebp-44], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042518E(U)
|
:0042519C 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:0042519F 8B55BC                  mov edx, dword ptr [ebp-44]
:004251A2 8991D4020000            mov dword ptr [ecx+000002D4], edx
:004251A8 6A00                    push 00000000
:004251AA 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:004251AD E8F1C1FFFF              call 004213A3
:004251B2 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:004251B5 8981D8020000            mov dword ptr [ecx+000002D8], eax
:004251BB 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:004251BE E8FCC2FFFF              call 004214BF
:004251C3 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:004251C6 E8DDD2FFFF              call 004224A8
:004251CB E94EFEFFFF              jmp 0042501E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00425029(C), :004250B0(U)
|
:004251D0 8B55C4                  mov edx, dword ptr [ebp-3C]
:004251D3 C782AC04000001000000    mov dword ptr [ebx+000004AC], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00424EE0(U)
|
:004251DD 8BE5                    mov esp, ebp
:004251DF 5D                      pop ebp
:004251E0 C3                      ret



* Referenced by a CALL at Address:
|:0042563B   
|
:004251E1 55                      push ebp
:004251E2 8BEC                    mov ebp, esp
:004251E4 83EC08                  sub esp, 00000008
:004251E7 894DFC                  mov dword ptr [ebp-04], ecx
:004251EA 8B45FC                  mov eax, dword ptr [ebp-04]
:004251ED C780AC04000000000000    mov dword ptr [ebx+000004AC], 00000000
:004251F7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004251FA 8A5508                  mov dl, byte ptr [ebp+08]
:004251FD 8811                    mov byte ptr [ecx], dl
:004251FF 8B45FC                  mov eax, dword ptr [ebp-04]
:00425202 8A4D0C                  mov cl, byte ptr [ebp+0C]
:00425205 884801                  mov byte ptr [eax+01], cl
:00425208 8B55FC                  mov edx, dword ptr [ebp-04]
:0042520B C6420CFF                mov [edx+0C], FF
:0042520F 8B45FC                  mov eax, dword ptr [ebp-04]
:00425212 33C9                    xor ecx, ecx
:00425214 8A4801                  mov cl, byte ptr [eax+01]
:00425217 6BC924                  imul ecx, 00000024
:0042521A 81C1502C4B00            add ecx, 004B2C50
:00425220 8B55FC                  mov edx, dword ptr [ebp-04]
:00425223 894A08                  mov dword ptr [edx+08], ecx
:00425226 8B45FC                  mov eax, dword ptr [ebp-04]
:00425229 8B4808                  mov ecx, dword ptr [eax+08]
:0042522C E83FA40300              call 0045F670
:00425231 6BC048                  imul eax, 00000048
:00425234 05681B4A00              add eax, 004A1B68
:00425239 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042523C 894104                  mov dword ptr [ecx+04], eax
:0042523F 8B55FC                  mov edx, dword ptr [ebp-04]
:00425242 8B4A08                  mov ecx, dword ptr [edx+08]
:00425245 E80AAD0100              call 0043FF54
:0042524A 85C0                    test eax, eax
:0042524C 751E                    jne 0042526C
:0042524E 8B45FC                  mov eax, dword ptr [ebp-04]
:00425251 8B4808                  mov ecx, dword ptr [eax+08]
:00425254 E877080000              call 00425AD0
:00425259 25FF000000              and eax, 000000FF
:0042525E 83F807                  cmp eax, 00000007
:00425261 7409                    je 0042526C
:00425263 C745F800000000          mov [ebp-08], 00000000
:0042526A EB07                    jmp 00425273

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042524C(C), :00425261(C)
|
:0042526C C745F801000000          mov [ebp-08], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042526A(U)
|
:00425273 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00425276 8B55F8                  mov edx, dword ptr [ebp-08]
:00425279 8991A8040000            mov dword ptr [ecx+000004A8], edx
:0042527F 8B45FC                  mov eax, dword ptr [ebp-04]
:00425282 33C9                    xor ecx, ecx
:00425284 8A08                    mov cl, byte ptr [eax]
:00425286 6BC946                  imul ecx, 00000046
:00425289 81C1C0F44A00            add ecx, 004AF4C0
:0042528F E8FC39FFFF              call 00418C90
:00425294 8B55FC                  mov edx, dword ptr [ebp-04]
:00425297 8882C9020000            mov byte ptr [edx+000002C9], al
:0042529D 8B45FC                  mov eax, dword ptr [ebp-04]
:004252A0 33C9                    xor ecx, ecx
:004252A2 8A08                    mov cl, byte ptr [eax]
:004252A4 6BC946                  imul ecx, 00000046
:004252A7 81C1C0F44A00            add ecx, 004AF4C0
:004252AD E89E080000              call 00425B50
:004252B2 8B55FC                  mov edx, dword ptr [ebp-04]
:004252B5 8882CA020000            mov byte ptr [edx+000002CA], al
:004252BB 8B45FC                  mov eax, dword ptr [ebp-04]
:004252BE C780D002000000000000    mov dword ptr [ebx+000002D0], 00000000
:004252C8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004252CB C781D402000000000000    mov dword ptr [ebx+000002D4], 00000000
:004252D5 6A00                    push 00000000
:004252D7 6A74                    push 00000074
:004252D9 8B55FC                  mov edx, dword ptr [ebp-04]
:004252DC 81C2D8020000            add edx, 000002D8
:004252E2 52                      push edx
:004252E3 E82BAA0500              call 0047FD13
:004252E8 83C40C                  add esp, 0000000C
:004252EB 68FF000000              push 000000FF
:004252F0 6A74                    push 00000074
:004252F2 8B45FC                  mov eax, dword ptr [ebp-04]
:004252F5 83C00D                  add eax, 0000000D
:004252F8 50                      push eax
:004252F9 E815AA0500              call 0047FD13
:004252FE 83C40C                  add esp, 0000000C
:00425301 6A00                    push 00000000
:00425303 6A74                    push 00000074
:00425305 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00425308 81C184000000            add ecx, 00000084
:0042530E 51                      push ecx
:0042530F E8FFA90500              call 0047FD13
:00425314 83C40C                  add esp, 0000000C
:00425317 6A00                    push 00000000
:00425319 6A74                    push 00000074
:0042531B 8B55FC                  mov edx, dword ptr [ebp-04]
:0042531E 81C255020000            add edx, 00000255
:00425324 52                      push edx
:00425325 E8E9A90500              call 0047FD13
:0042532A 83C40C                  add esp, 0000000C
:0042532D 8B45FC                  mov eax, dword ptr [ebp-04]
:00425330 8B4808                  mov ecx, dword ptr [eax+08]
:00425333 E838A30300              call 0045F670
:00425338 50                      push eax
:00425339 B9F05D4B00              mov ecx, 004B5DF0
:0042533E E81DA60200              call 0044F960
:00425343 8BE5                    mov esp, ebp
:00425345 5D                      pop ebp
:00425346 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:004231B8   , :004233E8   , :004235D6   , :00423807   , :004239DA   
|:00423F56   , :00424EF6   
|
:00425349 55                      push ebp
:0042534A 8BEC                    mov ebp, esp
:0042534C 83EC0C                  sub esp, 0000000C
:0042534F 56                      push esi
:00425350 894DF4                  mov dword ptr [ebp-0C], ecx
:00425353 8B45F4                  mov eax, dword ptr [ebp-0C]
:00425356 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00425359 8A510C                  mov dl, byte ptr [ecx+0C]
:0042535C 88500D                  mov byte ptr [eax+0D], dl
:0042535F 68FF000000              push 000000FF
:00425364 68FF000000              push 000000FF
:00425369 8A4508                  mov al, byte ptr [ebp+08]
:0042536C 50                      push eax
:0042536D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00425370 83C10E                  add ecx, 0000000E
:00425373 51                      push ecx
:00425374 8B55F4                  mov edx, dword ptr [ebp-0C]
:00425377 8A82CA020000            mov al, byte ptr [edx+000002CA]
:0042537D 50                      push eax
:0042537E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00425381 8A510C                  mov dl, byte ptr [ecx+0C]
:00425384 52                      push edx
:00425385 8B45F4                  mov eax, dword ptr [ebp-0C]
:00425388 8B4808                  mov ecx, dword ptr [eax+08]
:0042538B E89E110100              call 0043652E
:00425390 C645FC00                mov [ebp-04], 00
:00425394 C645F800                mov [ebp-08], 00
:00425398 EB09                    jmp 004253A3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004253E0(U), :0042540B(U)
|
:0042539A 8A4DF8                  mov cl, byte ptr [ebp-08]
:0042539D 80C101                  add cl, 01
:004253A0 884DF8                  mov byte ptr [ebp-08], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425398(U)
|
:004253A3 8B55F8                  mov edx, dword ptr [ebp-08]
:004253A6 81E2FF000000            and edx, 000000FF
:004253AC 8B45F4                  mov eax, dword ptr [ebp-0C]
:004253AF 33C9                    xor ecx, ecx
:004253B1 8A4C100D                mov cl, byte ptr [eax+edx+0D]
:004253B5 81F9FF000000            cmp ecx, 000000FF
:004253BB 7450                    je 0042540D
:004253BD 8B55F8                  mov edx, dword ptr [ebp-08]
:004253C0 81E2FF000000            and edx, 000000FF
:004253C6 8B45F4                  mov eax, dword ptr [ebp-0C]
:004253C9 8A4C100D                mov cl, byte ptr [eax+edx+0D]
:004253CD 51                      push ecx
:004253CE 8B55F4                  mov edx, dword ptr [ebp-0C]
:004253D1 8A02                    mov al, byte ptr [edx]
:004253D3 50                      push eax
:004253D4 E8A1B5FFFF              call 0042097A
:004253D9 83C408                  add esp, 00000008
:004253DC 85C0                    test eax, eax
:004253DE 7502                    jne 004253E2
:004253E0 EBB8                    jmp 0042539A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004253DE(C)
|
:004253E2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004253E5 81E1FF000000            and ecx, 000000FF
:004253EB 8B55FC                  mov edx, dword ptr [ebp-04]
:004253EE 81E2FF000000            and edx, 000000FF
:004253F4 8B45F4                  mov eax, dword ptr [ebp-0C]
:004253F7 8B75F4                  mov esi, dword ptr [ebp-0C]
:004253FA 8A4C0E0D                mov cl, byte ptr [esi+ecx+0D]
:004253FE 884C100D                mov byte ptr [eax+edx+0D], cl
:00425402 8A55FC                  mov dl, byte ptr [ebp-04]
:00425405 80C201                  add dl, 01
:00425408 8855FC                  mov byte ptr [ebp-04], dl
:0042540B EB8D                    jmp 0042539A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004253BB(C)
|
:0042540D 8A45FC                  mov al, byte ptr [ebp-04]
:00425410 8845F8                  mov byte ptr [ebp-08], al
:00425413 EB09                    jmp 0042541E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425449(U)
|
:00425415 8A4DF8                  mov cl, byte ptr [ebp-08]
:00425418 80C101                  add cl, 01
:0042541B 884DF8                  mov byte ptr [ebp-08], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425413(U)
|
:0042541E 8B55F8                  mov edx, dword ptr [ebp-08]
:00425421 81E2FF000000            and edx, 000000FF
:00425427 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042542A 33C9                    xor ecx, ecx
:0042542C 8A4C100D                mov cl, byte ptr [eax+edx+0D]
:00425430 81F9FF000000            cmp ecx, 000000FF
:00425436 7413                    je 0042544B
:00425438 8B55F8                  mov edx, dword ptr [ebp-08]
:0042543B 81E2FF000000            and edx, 000000FF
:00425441 8B45F4                  mov eax, dword ptr [ebp-0C]
:00425444 C644100DFF              mov [eax+edx+0D], FF
:00425449 EBCA                    jmp 00425415

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425436(C)
|
:0042544B 5E                      pop esi
:0042544C 8BE5                    mov esp, ebp
:0042544E 5D                      pop ebp
:0042544F C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:004224C8   , :00424A76   
|
:00425452 55                      push ebp
:00425453 8BEC                    mov ebp, esp
:00425455 83EC20                  sub esp, 00000020
:00425458 56                      push esi
:00425459 894DE0                  mov dword ptr [ebp-20], ecx
:0042545C 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0042545F E8ACA20300              call 0045F710
:00425464 8D4DEC                  lea ecx, dword ptr [ebp-14]
:00425467 E8A4A20300              call 0045F710
:0042546C C745F801000000          mov [ebp-08], 00000001
:00425473 EB09                    jmp 0042547E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042561D(U)
|
:00425475 8B45F8                  mov eax, dword ptr [ebp-08]
:00425478 83C001                  add eax, 00000001
:0042547B 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425473(U)
|
:0042547E 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00425481 034DF8                  add ecx, dword ptr [ebp-08]
:00425484 33D2                    xor edx, edx
:00425486 8A510D                  mov dl, byte ptr [ecx+0D]
:00425489 81FAFF000000            cmp edx, 000000FF
:0042548F 0F848D010000            je 00425622
:00425495 8B45F8                  mov eax, dword ptr [ebp-08]
:00425498 8945F4                  mov dword ptr [ebp-0C], eax
:0042549B EB09                    jmp 004254A6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425618(U)
|
:0042549D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004254A0 83E901                  sub ecx, 00000001
:004254A3 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042549B(U)
|
:004254A6 837DF400                cmp dword ptr [ebp-0C], 00000000
:004254AA 0F8E6D010000            jle 0042561D
:004254B0 8B55E0                  mov edx, dword ptr [ebp-20]
:004254B3 0355F4                  add edx, dword ptr [ebp-0C]
:004254B6 33C0                    xor eax, eax
:004254B8 8A420C                  mov al, byte ptr [edx+0C]
:004254BB 8BC8                    mov ecx, eax
:004254BD 6BC924                  imul ecx, 00000024
:004254C0 81C1502C4B00            add ecx, 004B2C50
:004254C6 E895DEFDFF              call 00403360
:004254CB 50                      push eax
:004254CC 8D4DF0                  lea ecx, dword ptr [ebp-10]
:004254CF E8CC10FEFF              call 004065A0
:004254D4 8B4DE0                  mov ecx, dword ptr [ebp-20]
:004254D7 034DF4                  add ecx, dword ptr [ebp-0C]
:004254DA 33D2                    xor edx, edx
:004254DC 8A510D                  mov dl, byte ptr [ecx+0D]
:004254DF 8BCA                    mov ecx, edx
:004254E1 6BC924                  imul ecx, 00000024
:004254E4 81C1502C4B00            add ecx, 004B2C50
:004254EA E871DEFDFF              call 00403360
:004254EF 50                      push eax
:004254F0 8D4DEC                  lea ecx, dword ptr [ebp-14]
:004254F3 E8A810FEFF              call 004065A0
:004254F8 8B45ED                  mov eax, dword ptr [ebp-13]
:004254FB 25FF000000              and eax, 000000FF
:00425500 8B4DF1                  mov ecx, dword ptr [ebp-0F]
:00425503 81E1FF000000            and ecx, 000000FF
:00425509 3BC1                    cmp eax, ecx
:0042550B 7C33                    jl 00425540
:0042550D 8B55ED                  mov edx, dword ptr [ebp-13]
:00425510 81E2FF000000            and edx, 000000FF
:00425516 8B45F1                  mov eax, dword ptr [ebp-0F]
:00425519 25FF000000              and eax, 000000FF
:0042551E 3BD0                    cmp edx, eax
:00425520 0F85F0000000            jne 00425616
:00425526 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00425529 81E1FF000000            and ecx, 000000FF
:0042552F 8B55F0                  mov edx, dword ptr [ebp-10]
:00425532 81E2FF000000            and edx, 000000FF
:00425538 3BCA                    cmp ecx, edx
:0042553A 0F8DD6000000            jnl 00425616

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042550B(C)
|
:00425540 8B45E0                  mov eax, dword ptr [ebp-20]
:00425543 0345F4                  add eax, dword ptr [ebp-0C]
:00425546 8A480C                  mov cl, byte ptr [eax+0C]
:00425549 884DFC                  mov byte ptr [ebp-04], cl
:0042554C 8B55E0                  mov edx, dword ptr [ebp-20]
:0042554F 0355F4                  add edx, dword ptr [ebp-0C]
:00425552 8B45E0                  mov eax, dword ptr [ebp-20]
:00425555 0345F4                  add eax, dword ptr [ebp-0C]
:00425558 8A480D                  mov cl, byte ptr [eax+0D]
:0042555B 884A0C                  mov byte ptr [edx+0C], cl
:0042555E 8B55E0                  mov edx, dword ptr [ebp-20]
:00425561 0355F4                  add edx, dword ptr [ebp-0C]
:00425564 8A45FC                  mov al, byte ptr [ebp-04]
:00425567 88420D                  mov byte ptr [edx+0D], al
:0042556A 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0042556D 034DF4                  add ecx, dword ptr [ebp-0C]
:00425570 8A9154020000            mov dl, byte ptr [ecx+00000254]
:00425576 8855FC                  mov byte ptr [ebp-04], dl
:00425579 8B45E0                  mov eax, dword ptr [ebp-20]
:0042557C 0345F4                  add eax, dword ptr [ebp-0C]
:0042557F 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00425582 034DF4                  add ecx, dword ptr [ebp-0C]
:00425585 8A9155020000            mov dl, byte ptr [ecx+00000255]
:0042558B 889054020000            mov byte ptr [eax+00000254], dl
:00425591 8B45E0                  mov eax, dword ptr [ebp-20]
:00425594 0345F4                  add eax, dword ptr [ebp-0C]
:00425597 8A4DFC                  mov cl, byte ptr [ebp-04]
:0042559A 888855020000            mov byte ptr [eax+00000255], cl
:004255A0 8B55F4                  mov edx, dword ptr [ebp-0C]
:004255A3 8B45E0                  mov eax, dword ptr [ebp-20]
:004255A6 8B8C9080000000          mov ecx, dword ptr [eax+4*edx+00000080]
:004255AD 894DE8                  mov dword ptr [ebp-18], ecx
:004255B0 8B55F4                  mov edx, dword ptr [ebp-0C]
:004255B3 8B45E0                  mov eax, dword ptr [ebp-20]
:004255B6 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004255B9 8B75E0                  mov esi, dword ptr [ebp-20]
:004255BC 8B8C8E84000000          mov ecx, dword ptr [esi+4*ecx+00000084]
:004255C3 898C9080000000          mov dword ptr [eax+4*edx+00000080], ecx
:004255CA 8B55F4                  mov edx, dword ptr [ebp-0C]
:004255CD 8B45E0                  mov eax, dword ptr [ebp-20]
:004255D0 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004255D3 898C9084000000          mov dword ptr [eax+4*edx+00000084], ecx
:004255DA 8B55F4                  mov edx, dword ptr [ebp-0C]
:004255DD 8B45E0                  mov eax, dword ptr [ebp-20]
:004255E0 8B8C90D4020000          mov ecx, dword ptr [eax+4*edx+000002D4]
:004255E7 894DE4                  mov dword ptr [ebp-1C], ecx
:004255EA 8B55F4                  mov edx, dword ptr [ebp-0C]
:004255ED 8B45E0                  mov eax, dword ptr [ebp-20]
:004255F0 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004255F3 8B75E0                  mov esi, dword ptr [ebp-20]
:004255F6 8B8C8ED8020000          mov ecx, dword ptr [esi+4*ecx+000002D8]
:004255FD 898C90D4020000          mov dword ptr [eax+4*edx+000002D4], ecx
:00425604 8B55F4                  mov edx, dword ptr [ebp-0C]
:00425607 8B45E0                  mov eax, dword ptr [ebp-20]
:0042560A 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0042560D 898C90D8020000          mov dword ptr [eax+4*edx+000002D8], ecx
:00425614 EB02                    jmp 00425618

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00425520(C), :0042553A(C)
|
:00425616 EB05                    jmp 0042561D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425614(U)
|
:00425618 E980FEFFFF              jmp 0042549D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004254AA(C), :00425616(U)
|
:0042561D E953FEFFFF              jmp 00425475

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042548F(C)
|
:00425622 5E                      pop esi
:00425623 8BE5                    mov esp, ebp
:00425625 5D                      pop ebp
:00425626 C3                      ret



* Referenced by a CALL at Address:
|:0043DCB2   
|
:00425627 55                      push ebp
:00425628 8BEC                    mov ebp, esp
:0042562A 83EC08                  sub esp, 00000008
:0042562D 894DFC                  mov dword ptr [ebp-04], ecx
:00425630 8A450C                  mov al, byte ptr [ebp+0C]
:00425633 50                      push eax
:00425634 8A4D08                  mov cl, byte ptr [ebp+08]
:00425637 51                      push ecx
:00425638 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042563B E8A1FBFFFF              call 004251E1
:00425640 8B55FC                  mov edx, dword ptr [ebp-04]
:00425643 8B4A08                  mov ecx, dword ptr [edx+08]
:00425646 E885040000              call 00425AD0
:0042564B 25FF000000              and eax, 000000FF
:00425650 33C9                    xor ecx, ecx
:00425652 83F807                  cmp eax, 00000007
:00425655 0F94C1                  sete cl
:00425658 51                      push ecx
:00425659 8B55FC                  mov edx, dword ptr [ebp-04]
:0042565C 8A4201                  mov al, byte ptr [edx+01]
:0042565F 50                      push eax
:00425660 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00425663 8A11                    mov dl, byte ptr [ecx]
:00425665 52                      push edx
:00425666 E85EA8FFFF              call 0041FEC9
:0042566B 83C40C                  add esp, 0000000C
:0042566E 85C0                    test eax, eax
:00425670 750E                    jne 00425680
:00425672 8B45FC                  mov eax, dword ptr [ebp-04]
:00425675 8B80AC040000            mov eax, dword ptr [eax+000004AC]
:0042567B E93D030000              jmp 004259BD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425670(C)
|
:00425680 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00425683 33D2                    xor edx, edx
:00425685 8A11                    mov dl, byte ptr [ecx]
:00425687 33C0                    xor eax, eax
:00425689 8A82C0664800            mov al, byte ptr [edx+004866C0]
:0042568F 83F863                  cmp eax, 00000063
:00425692 7E37                    jle 004256CB
:00425694 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00425697 33D2                    xor edx, edx
:00425699 8A11                    mov dl, byte ptr [ecx]
:0042569B 33C0                    xor eax, eax
:0042569D 8A82C0664800            mov al, byte ptr [edx+004866C0]
:004256A3 3DFF000000              cmp eax, 000000FF
:004256A8 7421                    je 004256CB
:004256AA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004256AD 33D2                    xor edx, edx
:004256AF 8A11                    mov dl, byte ptr [ecx]
:004256B1 8A82C0664800            mov al, byte ptr [edx+004866C0]
:004256B7 50                      push eax
:004256B8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004256BB E83FC1FFFF              call 004217FF
:004256C0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004256C3 8981B0040000            mov dword ptr [ecx+000004B0], eax
:004256C9 EB0D                    jmp 004256D8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00425692(C), :004256A8(C)
|
:004256CB 8B55FC                  mov edx, dword ptr [ebp-04]
:004256CE C782B004000000000000    mov dword ptr [ebx+000004B0], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004256C9(U)
|
:004256D8 8B45FC                  mov eax, dword ptr [ebp-04]
:004256DB 33C9                    xor ecx, ecx
:004256DD 8A08                    mov cl, byte ptr [eax]
:004256DF 894DF8                  mov dword ptr [ebp-08], ecx
:004256E2 837DF843                cmp dword ptr [ebp-08], 00000043
:004256E6 0F87A0020000            ja 0042598C
:004256EC 8B45F8                  mov eax, dword ptr [ebp-08]
:004256EF 33D2                    xor edx, edx
:004256F1 8A903F5A4200            mov dl, byte ptr [eax+00425A3F]
:004256F7 FF2495C3594200          jmp dword ptr [4*edx+004259C3]
:004256FE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00425701 C6815402000040          mov byte ptr [ecx+00000254], 40
:00425708 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042570B E82EDAFFFF              call 0042313E
:00425710 E981020000              jmp 00425996
:00425715 8B55FC                  mov edx, dword ptr [ebp-04]
:00425718 C6825402000050          mov byte ptr [edx+00000254], 50
:0042571F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00425722 E817DAFFFF              call 0042313E
:00425727 E96A020000              jmp 00425996
:0042572C 8B45FC                  mov eax, dword ptr [ebp-04]
:0042572F C6805402000040          mov byte ptr [eax+00000254], 40
:00425736 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00425739 E8FCEAFFFF              call 0042423A
:0042573E E953020000              jmp 00425996
:00425743 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00425746 C6815402000062          mov byte ptr [ecx+00000254], 62
:0042574D 6A00                    push 00000000
:0042574F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00425752 E804DCFFFF              call 0042335B
:00425757 E93A020000              jmp 00425996
:0042575C 8B55FC                  mov edx, dword ptr [ebp-04]
:0042575F C6825402000064          mov byte ptr [edx+00000254], 64
:00425766 6A00                    push 00000000
:00425768 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042576B E8EBDBFFFF              call 0042335B
:00425770 E921020000              jmp 00425996
:00425775 8B45FC                  mov eax, dword ptr [ebp-04]
:00425778 C6805402000060          mov byte ptr [eax+00000254], 60
:0042577F 6A00                    push 00000000
:00425781 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00425784 E8D2DBFFFF              call 0042335B
:00425789 E908020000              jmp 00425996
:0042578E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00425791 C6815402000061          mov byte ptr [ecx+00000254], 61
:00425798 6A00                    push 00000000
:0042579A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042579D E8B9DBFFFF              call 0042335B
:004257A2 E9EF010000              jmp 00425996
:004257A7 8B55FC                  mov edx, dword ptr [ebp-04]
:004257AA C6825402000070          mov byte ptr [edx+00000254], 70
:004257B1 6A00                    push 00000000
:004257B3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004257B6 E88EDDFFFF              call 00423549
:004257BB E9D6010000              jmp 00425996
:004257C0 8B45FC                  mov eax, dword ptr [ebp-04]
:004257C3 C6805402000071          mov byte ptr [eax+00000254], 71
:004257CA 6A00                    push 00000000
:004257CC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004257CF E875DDFFFF              call 00423549
:004257D4 E9BD010000              jmp 00425996
:004257D9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004257DC C6815402000072          mov byte ptr [ecx+00000254], 72
:004257E3 6A00                    push 00000000
:004257E5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004257E8 E85CDDFFFF              call 00423549
:004257ED E9A4010000              jmp 00425996
:004257F2 8B55FC                  mov edx, dword ptr [ebp-04]
:004257F5 C6825402000074          mov byte ptr [edx+00000254], 74
:004257FC 6A00                    push 00000000
:004257FE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00425801 E843DDFFFF              call 00423549
:00425806 E98B010000              jmp 00425996
:0042580B 8B45FC                  mov eax, dword ptr [ebp-04]
:0042580E C6805402000080          mov byte ptr [eax+00000254], 80
:00425815 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00425818 E870DFFFFF              call 0042378D
:0042581D E974010000              jmp 00425996
:00425822 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00425825 C6815402000090          mov byte ptr [ecx+00000254], 90
:0042582C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042582F E859DFFFFF              call 0042378D
:00425834 E95D010000              jmp 00425996
:00425839 8B55FC                  mov edx, dword ptr [ebp-04]
:0042583C C68254020000A8          mov byte ptr [edx+00000254], A8
:00425843 6A01                    push 00000001
:00425845 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00425848 E80EDBFFFF              call 0042335B
:0042584D E944010000              jmp 00425996
:00425852 8B45FC                  mov eax, dword ptr [ebp-04]
:00425855 C68054020000A2          mov byte ptr [eax+00000254], A2
:0042585C 6A01                    push 00000001
:0042585E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00425861 E8F5DAFFFF              call 0042335B
:00425866 E92B010000              jmp 00425996
:0042586B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042586E C68154020000A4          mov byte ptr [ecx+00000254], A4
:00425875 6A01                    push 00000001
:00425877 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042587A E8DCDAFFFF              call 0042335B
:0042587F E912010000              jmp 00425996
:00425884 8B55FC                  mov edx, dword ptr [ebp-04]
:00425887 C68254020000A0          mov byte ptr [edx+00000254], A0
:0042588E 6A01                    push 00000001
:00425890 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00425893 E8C3DAFFFF              call 0042335B
:00425898 E9F9000000              jmp 00425996
:0042589D 8B45FC                  mov eax, dword ptr [ebp-04]
:004258A0 C68054020000A1          mov byte ptr [eax+00000254], A1
:004258A7 6A01                    push 00000001
:004258A9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004258AC E8AADAFFFF              call 0042335B
:004258B1 E9E0000000              jmp 00425996
:004258B6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004258B9 C68154020000BF          mov byte ptr [ecx+00000254], BF
:004258C0 6A01                    push 00000001
:004258C2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004258C5 E87FDCFFFF              call 00423549
:004258CA E9C7000000              jmp 00425996
:004258CF 8B55FC                  mov edx, dword ptr [ebp-04]
:004258D2 C68254020000B8          mov byte ptr [edx+00000254], B8
:004258D9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004258DC E87FE0FFFF              call 00423960
:004258E1 E9B0000000              jmp 00425996
:004258E6 8B45FC                  mov eax, dword ptr [ebp-04]
:004258E9 C68054020000FF          mov byte ptr [eax+00000254], FF
:004258F0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004258F3 E8E4E5FFFF              call 00423EDC
:004258F8 E999000000              jmp 00425996
:004258FD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00425900 C68154020000C0          mov byte ptr [ecx+00000254], C0
:00425907 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042590A E820E2FFFF              call 00423B2F
:0042590F E982000000              jmp 00425996
:00425914 8B55FC                  mov edx, dword ptr [ebp-04]
:00425917 C68254020000A0          mov byte ptr [edx+00000254], A0
:0042591E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00425921 E89AE3FFFF              call 00423CC0
:00425926 EB6E                    jmp 00425996
:00425928 8B45FC                  mov eax, dword ptr [ebp-04]
:0042592B C68054020000AF          mov byte ptr [eax+00000254], AF
:00425932 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00425935 E886E3FFFF              call 00423CC0
:0042593A EB5A                    jmp 00425996
:0042593C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042593F C6815402000090          mov byte ptr [ecx+00000254], 90
:00425946 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00425949 E81EE4FFFF              call 00423D6C
:0042594E EB46                    jmp 00425996
:00425950 8B55FC                  mov edx, dword ptr [ebp-04]
:00425953 C6825402000040          mov byte ptr [edx+00000254], 40
:0042595A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042595D E83CF5FFFF              call 00424E9E
:00425962 EB32                    jmp 00425996
:00425964 8B45FC                  mov eax, dword ptr [ebp-04]
:00425967 C68054020000FF          mov byte ptr [eax+00000254], FF
:0042596E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00425971 E89AEEFFFF              call 00424810
:00425976 EB1E                    jmp 00425996
:00425978 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042597B C68154020000BF          mov byte ptr [ecx+00000254], BF
:00425982 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00425985 E889EBFFFF              call 00424513
:0042598A EB0A                    jmp 00425996

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004256E6(C)
|
:0042598C 8B55FC                  mov edx, dword ptr [ebp-04]
:0042598F C6825402000000          mov byte ptr [edx+00000254], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00425710(U), :00425727(U), :0042573E(U), :00425757(U), :00425770(U)
|:00425789(U), :004257A2(U), :004257BB(U), :004257D4(U), :004257ED(U)
|:00425806(U), :0042581D(U), :00425834(U), :0042584D(U), :00425866(U)
|:0042587F(U), :00425898(U), :004258B1(U), :004258CA(U), :004258E1(U)
|:004258F8(U), :0042590F(U), :00425926(U), :0042593A(U), :0042594E(U)
|:00425962(U), :00425976(U), :0042598A(U)
|
:00425996 8B45FC                  mov eax, dword ptr [ebp-04]
:00425999 83B8B004000000          cmp dword ptr [eax+000004B0], 00000000
:004259A0 740A                    je 004259AC
:004259A2 B988274900              mov ecx, 00492788
:004259A7 E8EFCCFDFF              call 0040269B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004259A0(C)
|
:004259AC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004259AF E859D5FFFF              call 00422F0D
:004259B4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004259B7 8B81AC040000            mov eax, dword ptr [ecx+000004AC]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042567B(U)
|
:004259BD 8BE5                    mov esp, ebp
:004259BF 5D                      pop ebp
:004259C0 C20800                  ret 0008



:004259C3 FE564200                DWORD 004256FE
:004259C7 2C574200                DWORD 0042572C
:004259CB FE564200                DWORD 004256FE
:004259CF 15574200                DWORD 00425715
:004259D3 43574200                DWORD 00425743
:004259D7 5C574200                DWORD 0042575C
:004259DB 75574200                DWORD 00425775
:004259DF 8E574200                DWORD 0042578E
:004259E3 C0574200                DWORD 004257C0
:004259E7 A7574200                DWORD 004257A7
:004259EB D9574200                DWORD 004257D9
:004259EF F2574200                DWORD 004257F2
:004259F3 E6584200                DWORD 004258E6
:004259F7 0B584200                DWORD 0042580B
:004259FB 22584200                DWORD 00425822
:004259FF B6584200                DWORD 004258B6
:00425A03 39584200                DWORD 00425839
:00425A07 52584200                DWORD 00425852
:00425A0B 6B584200                DWORD 0042586B
:00425A0F 84584200                DWORD 00425884
:00425A13 9D584200                DWORD 0042589D
:00425A17 CF584200                DWORD 004258CF
:00425A1B FD584200                DWORD 004258FD
:00425A1F 14594200                DWORD 00425914
:00425A23 3C594200                DWORD 0042593C
:00425A27 28594200                DWORD 00425928
:00425A2B 50594200                DWORD 00425950
:00425A2F FE564200                DWORD 004256FE
:00425A33 64594200                DWORD 00425964
:00425A37 78594200                DWORD 00425978
:00425A3B 8C594200                DWORD 0042598C


:00425A3F 00000000000000000000    BYTE 10 DUP(0)
:00425A49 00000000                BYTE  4 DUP(0)


:00425A4D 0102                    add dword ptr [edx], eax
:00425A4F 0202                    add al, byte ptr [edx]
:00425A51 0202                    add al, byte ptr [edx]
:00425A53 0202                    add al, byte ptr [edx]
:00425A55 030404                  add eax, dword ptr [esp+eax]
:00425A58 0505060607              add eax, 07060605
:00425A5D 07                      pop es
:00425A5E 0808                    or byte ptr [eax], cl
:00425A60 0909                    or dword ptr [ecx], ecx
:00425A62 0A0A                    or cl, byte ptr [edx]
:00425A64 0B0C0D0D0D0D0D          or ecx, dword ptr [ecx+0D0D0D0D]
:00425A6B 0E                      push cs
:00425A6C 0E                      push cs
:00425A6D 0F                      BYTE 0fh
:00425A6E 0F                      BYTE 0fh
:00425A6F 1011                    adc byte ptr [ecx], dl
:00425A71 1112                    adc dword ptr [edx], edx
:00425A73 1213                    adc dl, byte ptr [ebx]
:00425A75 131414                  adc edx, dword ptr [esp+edx]
:00425A78 1516161617              adc eax, 17161616
:00425A7D 1819                    sbb byte ptr [ecx], bl
:00425A7F 1A1B                    sbb bl, byte ptr [ebx]
:00425A81 1C1D                    sbb al, 1D
:00425A83 CC                      int 03
:00425A84 CC                      int 03
:00425A85 CC                      int 03
:00425A86 CC                      int 03
:00425A87 CC                      int 03
:00425A88 CC                      int 03
:00425A89 CC                      int 03
:00425A8A CC                      int 03
:00425A8B CC                      int 03
:00425A8C CC                      int 03
:00425A8D CC                      int 03
:00425A8E CC                      int 03
:00425A8F CC                      int 03

* Referenced by a CALL at Address:
|:0041FEC2   
|
:00425A90 55                      push ebp
:00425A91 8BEC                    mov ebp, esp
:00425A93 51                      push ecx
:00425A94 894DFC                  mov dword ptr [ebp-04], ecx
:00425A97 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00425A9A 81C1CB020000            add ecx, 000002CB
:00425AA0 E86B9C0300              call 0045F710
:00425AA5 8B45FC                  mov eax, dword ptr [ebp-04]
:00425AA8 8BE5                    mov esp, ebp
:00425AAA 5D                      pop ebp
:00425AAB C3                      ret


:00425AAC CC                      int 03
:00425AAD CC                      int 03
:00425AAE CC                      int 03
:00425AAF CC                      int 03

* Referenced by a CALL at Addresses:
|:00420F1C   , :004212AB   , :00421406   , :0043913E   , :0044DB70   
|:0044DC29   , :0044DD0D   , :0044DDC7   , :0044DE80   , :0044DF1B   
|:0044EA77   
|
:00425AB0 55                      push ebp
:00425AB1 8BEC                    mov ebp, esp
:00425AB3 51                      push ecx
:00425AB4 894DFC                  mov dword ptr [ebp-04], ecx
:00425AB7 8B45FC                  mov eax, dword ptr [ebp-04]
:00425ABA 8A400B                  mov al, byte ptr [eax+0B]
:00425ABD 8BE5                    mov esp, ebp
:00425ABF 5D                      pop ebp
:00425AC0 C3                      ret


:00425AC1 CC                      int 03
:00425AC2 CC                      int 03
:00425AC3 CC                      int 03
:00425AC4 CC                      int 03
:00425AC5 CC                      int 03
:00425AC6 CC                      int 03
:00425AC7 CC                      int 03
:00425AC8 CC                      int 03
:00425AC9 CC                      int 03
:00425ACA CC                      int 03
:00425ACB CC                      int 03
:00425ACC CC                      int 03
:00425ACD CC                      int 03
:00425ACE CC                      int 03
:00425ACF CC                      int 03

* Referenced by a CALL at Addresses:
|:00420442   , :00422F39   , :00425254   , :00425646   , :004384D9   
|:00438B5C   , :00439C6D   , :00439C8E   , :00439F15   , :00439FFD   
|:0043A01E   , :0043A3C4   , :0043A3DA   , :0043A5BB   , :0043AB6A   
|:0043ABD8   , :0043AFB3   , :0043B019   , :0043B03A   , :0043B37B   
|:0043C676   , :0043D598   , :0043D617   , :0043E28B   , :004402B2   
|:004402C3   , :0044190C   , :0044192C   , :0044E15B   , :0044E691   
|:0044E785   , :0044EA9F   , :0045537B   , :00459527   , :00465421   
|:0046543A   , :004657F0   , :00466466   , :0046FBB0   
|
:00425AD0 55                      push ebp
:00425AD1 8BEC                    mov ebp, esp
:00425AD3 51                      push ecx
:00425AD4 894DFC                  mov dword ptr [ebp-04], ecx
:00425AD7 8B45FC                  mov eax, dword ptr [ebp-04]
:00425ADA 8A400E                  mov al, byte ptr [eax+0E]
:00425ADD 8BE5                    mov esp, ebp
:00425ADF 5D                      pop ebp
:00425AE0 C3                      ret


:00425AE1 CC                      int 03
:00425AE2 CC                      int 03
:00425AE3 CC                      int 03
:00425AE4 CC                      int 03
:00425AE5 CC                      int 03
:00425AE6 CC                      int 03
:00425AE7 CC                      int 03
:00425AE8 CC                      int 03
:00425AE9 CC                      int 03
:00425AEA CC                      int 03
:00425AEB CC                      int 03
:00425AEC CC                      int 03
:00425AED CC                      int 03
:00425AEE CC                      int 03
:00425AEF CC                      int 03

* Referenced by a CALL at Addresses:
|:0042086E   , :0042088B   , :004221BD   , :004221E9   , :00437E56   
|:00438371   , :0043A5AB   , :0043A9E2   , :0043AAA6   , :0043AAD2   
|:0043AB5E   , :0043ABC8   , :0043AD31   , :0043ADE0   , :0043AE27   
|:0043B089   , :0043B36F   , :0043B3E7   , :0043B3F5   , :0043D58C   
|:0043D5D5   , :0043DC5C   , :0043DCEE   , :0043E11B   , :0043E242   
|:0043E58D   , :0043E5A4   , :0043EB69   , :0043EB80   , :0043FD42   
|:0043FF0A   , :00440192   , :004403EA   , :004414BF   , :004498AC   
|:004498BF   , :0044A5B7   , :0044A5D2   , :0044E146   , :0044E64A   
|:0044E73A   , :0044E755   , :0044EAC6   , :0044EAE7   , :0044EB4D   
|:0044EB8C   , :0045755E   , :0045756C   , :00457725   , :00457733   
|:00459704   , :00459712   , :00459887   , :00459895   , :00478F35   
|
:00425AF0 55                      push ebp
:00425AF1 8BEC                    mov ebp, esp
:00425AF3 51                      push ecx
:00425AF4 894DFC                  mov dword ptr [ebp-04], ecx
:00425AF7 8B45FC                  mov eax, dword ptr [ebp-04]
:00425AFA 33C9                    xor ecx, ecx
:00425AFC 8A480D                  mov cl, byte ptr [eax+0D]
:00425AFF 8B5508                  mov edx, dword ptr [ebp+08]
:00425B02 81E2FF000000            and edx, 000000FF
:00425B08 23CA                    and ecx, edx
:00425B0A 8B4508                  mov eax, dword ptr [ebp+08]
:00425B0D 25FF000000              and eax, 000000FF
:00425B12 33D2                    xor edx, edx
:00425B14 3BC8                    cmp ecx, eax
:00425B16 0F94C2                  sete dl
:00425B19 8BC2                    mov eax, edx
:00425B1B 8BE5                    mov esp, ebp
:00425B1D 5D                      pop ebp
:00425B1E C20400                  ret 0004


:00425B21 CC                      int 03
:00425B22 CC                      int 03
:00425B23 CC                      int 03
:00425B24 CC                      int 03
:00425B25 CC                      int 03
:00425B26 CC                      int 03
:00425B27 CC                      int 03
:00425B28 CC                      int 03
:00425B29 CC                      int 03
:00425B2A CC                      int 03
:00425B2B CC                      int 03
:00425B2C CC                      int 03
:00425B2D CC                      int 03
:00425B2E CC                      int 03
:00425B2F CC                      int 03

* Referenced by a CALL at Addresses:
|:00420C53   , :0043E9B1   , :004769F7   
|
:00425B30 55                      push ebp
:00425B31 8BEC                    mov ebp, esp
:00425B33 51                      push ecx
:00425B34 894DFC                  mov dword ptr [ebp-04], ecx
:00425B37 8B45FC                  mov eax, dword ptr [ebp-04]
:00425B3A 8A401D                  mov al, byte ptr [eax+1D]
:00425B3D 8BE5                    mov esp, ebp
:00425B3F 5D                      pop ebp
:00425B40 C3                      ret


:00425B41 CC                      int 03
:00425B42 CC                      int 03
:00425B43 CC                      int 03
:00425B44 CC                      int 03
:00425B45 CC                      int 03
:00425B46 CC                      int 03
:00425B47 CC                      int 03
:00425B48 CC                      int 03
:00425B49 CC                      int 03
:00425B4A CC                      int 03
:00425B4B CC                      int 03
:00425B4C CC                      int 03
:00425B4D CC                      int 03
:00425B4E CC                      int 03
:00425B4F CC                      int 03

* Referenced by a CALL at Addresses:
|:004252AD   , :004392C3   , :0043953C   , :0043965F   , :00455507   
|:00459532   , :0046FDBC   
|
:00425B50 55                      push ebp
:00425B51 8BEC                    mov ebp, esp
:00425B53 51                      push ecx
:00425B54 894DFC                  mov dword ptr [ebp-04], ecx
:00425B57 8B45FC                  mov eax, dword ptr [ebp-04]
:00425B5A 8A400D                  mov al, byte ptr [eax+0D]
:00425B5D 8BE5                    mov esp, ebp
:00425B5F 5D                      pop ebp
:00425B60 C3                      ret


:00425B61 CC                      int 03
:00425B62 CC                      int 03
:00425B63 CC                      int 03
:00425B64 CC                      int 03
:00425B65 CC                      int 03
:00425B66 CC                      int 03
:00425B67 CC                      int 03
:00425B68 CC                      int 03
:00425B69 CC                      int 03
:00425B6A CC                      int 03
:00425B6B CC                      int 03
:00425B6C CC                      int 03
:00425B6D CC                      int 03
:00425B6E CC                      int 03
:00425B6F CC                      int 03
:00425B70 55                      push ebp
:00425B71 8BEC                    mov ebp, esp
:00425B73 E807000000              call 00425B7F
:00425B78 E811000000              call 00425B8E
:00425B7D 5D                      pop ebp
:00425B7E C3                      ret



* Referenced by a CALL at Address:
|:00425B73   
|
:00425B7F 55                      push ebp
:00425B80 8BEC                    mov ebp, esp
:00425B82 B9B07F4900              mov ecx, 00497FB0
:00425B87 E8549DFFFF              call 0041F8E0
:00425B8C 5D                      pop ebp
:00425B8D C3                      ret



* Referenced by a CALL at Address:
|:00425B78   
|
:00425B8E 55                      push ebp
:00425B8F 8BEC                    mov ebp, esp
:00425B91 68A05B4200              push 00425BA0
:00425B96 E865B50500              call 00481100
:00425B9B 83C404                  add esp, 00000004
:00425B9E 5D                      pop ebp
:00425B9F C3                      ret


:00425BA0 55                      push ebp
:00425BA1 8BEC                    mov ebp, esp
:00425BA3 B9B07F4900              mov ecx, 00497FB0
:00425BA8 E802000000              call 00425BAF
:00425BAD 5D                      pop ebp
:00425BAE C3                      ret



* Referenced by a CALL at Addresses:
|:0041EFB7   , :00425BA8   
|
:00425BAF 55                      push ebp
:00425BB0 8BEC                    mov ebp, esp
:00425BB2 51                      push ecx
:00425BB3 894DFC                  mov dword ptr [ebp-04], ecx
:00425BB6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00425BB9 E8EA030000              call 00425FA8
:00425BBE 8BE5                    mov esp, ebp
:00425BC0 5D                      pop ebp
:00425BC1 C3                      ret



* Referenced by a CALL at Addresses:
|:00429946   , :0042EB0F   , :0042ED96   , :00453EB4   , :0047372B   
|:0047389F   , :00473E41   , :00474056   
|
:00425BC2 55                      push ebp
:00425BC3 8BEC                    mov ebp, esp
:00425BC5 51                      push ecx
:00425BC6 894DFC                  mov dword ptr [ebp-04], ecx
:00425BC9 E8F68E0500              call 0047EAC4
:00425BCE A1686A4B00              mov eax, dword ptr [004B6A68]
:00425BD3 50                      push eax
:00425BD4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00425BD7 E801060000              call 004261DD
:00425BDC 8BE5                    mov esp, ebp
:00425BDE 5D                      pop ebp
:00425BDF C3                      ret


:00425BE0 55                      push ebp
:00425BE1 8BEC                    mov ebp, esp
:00425BE3 83EC0C                  sub esp, 0000000C
:00425BE6 894DF4                  mov dword ptr [ebp-0C], ecx
:00425BE9 8B4508                  mov eax, dword ptr [ebp+08]
:00425BEC 8945F8                  mov dword ptr [ebp-08], eax
:00425BEF 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00425BF2 894DFC                  mov dword ptr [ebp-04], ecx
:00425BF5 8D55F8                  lea edx, dword ptr [ebp-08]
:00425BF8 52                      push edx
:00425BF9 A1686A4B00              mov eax, dword ptr [004B6A68]
:00425BFE 50                      push eax
:00425BFF 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00425C02 E83A060000              call 00426241
:00425C07 8BE5                    mov esp, ebp
:00425C09 5D                      pop ebp
:00425C0A C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0042C510   , :0042C579   , :0042EAA6   , :0042ED42   , :0042EFC5   
|:00460A2A   , :0047379B   , :0047388C   , :00473E70   
|
:00425C0D 55                      push ebp
:00425C0E 8BEC                    mov ebp, esp
:00425C10 51                      push ecx
:00425C11 894DFC                  mov dword ptr [ebp-04], ecx
:00425C14 A1686A4B00              mov eax, dword ptr [004B6A68]
:00425C19 50                      push eax
:00425C1A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00425C1D E8A3070000              call 004263C5
:00425C22 8BE5                    mov esp, ebp
:00425C24 5D                      pop ebp
:00425C25 C3                      ret



* Referenced by a CALL at Addresses:
|:00429D9D   , :0042B834   , :0042C693   , :0042C78A   , :0042E292   
|:0042EB19   , :0042EDA0   , :00453EBE   , :00473735   , :004738A9   
|:00473E4B   , :00474060   
|
:00425C26 55                      push ebp
:00425C27 8BEC                    mov ebp, esp
:00425C29 51                      push ecx
:00425C2A 894DFC                  mov dword ptr [ebp-04], ecx
:00425C2D 8B45FC                  mov eax, dword ptr [ebp-04]
:00425C30 8B4018                  mov eax, dword ptr [eax+18]
:00425C33 8BE5                    mov esp, ebp
:00425C35 5D                      pop ebp
:00425C36 C3                      ret



* Referenced by a CALL at Addresses:
|:00429DAB   , :0042B841   , :0042C6A0   , :0042C797   , :0042E29F   
|:0042EB29   , :0042EDB0   , :00453ED1   , :00473742   , :004738B6   
|:00473E58   , :0047406D   , :004750FD   
|
:00425C37 55                      push ebp
:00425C38 8BEC                    mov ebp, esp
:00425C3A 51                      push ecx
:00425C3B 894DFC                  mov dword ptr [ebp-04], ecx
:00425C3E 8B45FC                  mov eax, dword ptr [ebp-04]
:00425C41 8B401C                  mov eax, dword ptr [eax+1C]
:00425C44 8BE5                    mov esp, ebp
:00425C46 5D                      pop ebp
:00425C47 C3                      ret



* Referenced by a CALL at Address:
|:0042B9D7   
|
:00425C48 55                      push ebp
:00425C49 8BEC                    mov ebp, esp
:00425C4B 51                      push ecx
:00425C4C 894DFC                  mov dword ptr [ebp-04], ecx
:00425C4F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00425C52 E889030000              call 00425FE0
:00425C57 B801000000              mov eax, 00000001
:00425C5C 8BE5                    mov esp, ebp
:00425C5E 5D                      pop ebp
:00425C5F C3                      ret



* Referenced by a CALL at Address:
|:00475552   
|
:00425C60 55                      push ebp
:00425C61 8BEC                    mov ebp, esp
:00425C63 51                      push ecx
:00425C64 894DFC                  mov dword ptr [ebp-04], ecx
:00425C67 6A7B                    push 0000007B
:00425C69 A1606A4B00              mov eax, dword ptr [004B6A60]
:00425C6E 50                      push eax
:00425C6F FF15B0634800            call dword ptr [004863B0]
:00425C75 A3F07F4900              mov dword ptr [00497FF0], eax
:00425C7A 833DF07F490000          cmp dword ptr [00497FF0], 00000000
:00425C81 7507                    jne 00425C8A
:00425C83 33C0                    xor eax, eax
:00425C85 E91A030000              jmp 00425FA4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425C81(C)
|
:00425C8A 6A7F                    push 0000007F
:00425C8C 8B0D606A4B00            mov ecx, dword ptr [004B6A60]
:00425C92 51                      push ecx
:00425C93 FF15B0634800            call dword ptr [004863B0]
:00425C99 A3F47F4900              mov dword ptr [00497FF4], eax
:00425C9E 833DF47F490000          cmp dword ptr [00497FF4], 00000000
:00425CA5 7507                    jne 00425CAE
:00425CA7 33C0                    xor eax, eax
:00425CA9 E9F6020000              jmp 00425FA4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425CA5(C)
|
:00425CAE 6A79                    push 00000079
:00425CB0 8B15606A4B00            mov edx, dword ptr [004B6A60]
:00425CB6 52                      push edx
:00425CB7 FF15B0634800            call dword ptr [004863B0]
:00425CBD A3F87F4900              mov dword ptr [00497FF8], eax
:00425CC2 833DF87F490000          cmp dword ptr [00497FF8], 00000000
:00425CC9 7507                    jne 00425CD2
:00425CCB 33C0                    xor eax, eax
:00425CCD E9D2020000              jmp 00425FA4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425CC9(C)
|
:00425CD2 6A78                    push 00000078
:00425CD4 A1606A4B00              mov eax, dword ptr [004B6A60]
:00425CD9 50                      push eax
:00425CDA FF15B0634800            call dword ptr [004863B0]
:00425CE0 A3FC7F4900              mov dword ptr [00497FFC], eax
:00425CE5 833DFC7F490000          cmp dword ptr [00497FFC], 00000000
:00425CEC 7507                    jne 00425CF5
:00425CEE 33C0                    xor eax, eax
:00425CF0 E9AF020000              jmp 00425FA4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425CEC(C)
|
:00425CF5 6A7A                    push 0000007A
:00425CF7 8B0D606A4B00            mov ecx, dword ptr [004B6A60]
:00425CFD 51                      push ecx
:00425CFE FF15B0634800            call dword ptr [004863B0]
:00425D04 A300804900              mov dword ptr [00498000], eax
:00425D09 833D0080490000          cmp dword ptr [00498000], 00000000
:00425D10 7507                    jne 00425D19
:00425D12 33C0                    xor eax, eax
:00425D14 E98B020000              jmp 00425FA4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425D10(C)
|
:00425D19 6A75                    push 00000075
:00425D1B 8B15606A4B00            mov edx, dword ptr [004B6A60]
:00425D21 52                      push edx
:00425D22 FF15B0634800            call dword ptr [004863B0]
:00425D28 A304804900              mov dword ptr [00498004], eax
:00425D2D 833D0480490000          cmp dword ptr [00498004], 00000000
:00425D34 7507                    jne 00425D3D
:00425D36 33C0                    xor eax, eax
:00425D38 E967020000              jmp 00425FA4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425D34(C)
|
:00425D3D 6A76                    push 00000076
:00425D3F A1606A4B00              mov eax, dword ptr [004B6A60]
:00425D44 50                      push eax
:00425D45 FF15B0634800            call dword ptr [004863B0]
:00425D4B A308804900              mov dword ptr [00498008], eax
:00425D50 833D0880490000          cmp dword ptr [00498008], 00000000
:00425D57 7507                    jne 00425D60
:00425D59 33C0                    xor eax, eax
:00425D5B E944020000              jmp 00425FA4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425D57(C)
|
:00425D60 6A74                    push 00000074
:00425D62 8B0D606A4B00            mov ecx, dword ptr [004B6A60]
:00425D68 51                      push ecx
:00425D69 FF15B0634800            call dword ptr [004863B0]
:00425D6F A30C804900              mov dword ptr [0049800C], eax
:00425D74 833D0C80490000          cmp dword ptr [0049800C], 00000000
:00425D7B 7507                    jne 00425D84
:00425D7D 33C0                    xor eax, eax
:00425D7F E920020000              jmp 00425FA4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425D7B(C)
|
:00425D84 6A73                    push 00000073
:00425D86 8B15606A4B00            mov edx, dword ptr [004B6A60]
:00425D8C 52                      push edx
:00425D8D FF15B0634800            call dword ptr [004863B0]
:00425D93 A310804900              mov dword ptr [00498010], eax
:00425D98 833D1080490000          cmp dword ptr [00498010], 00000000
:00425D9F 7507                    jne 00425DA8
:00425DA1 33C0                    xor eax, eax
:00425DA3 E9FC010000              jmp 00425FA4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425D9F(C)
|
:00425DA8 6A77                    push 00000077
:00425DAA A1606A4B00              mov eax, dword ptr [004B6A60]
:00425DAF 50                      push eax
:00425DB0 FF15B0634800            call dword ptr [004863B0]
:00425DB6 A314804900              mov dword ptr [00498014], eax
:00425DBB 833D1480490000          cmp dword ptr [00498014], 00000000
:00425DC2 7507                    jne 00425DCB
:00425DC4 33C0                    xor eax, eax
:00425DC6 E9D9010000              jmp 00425FA4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425DC2(C)
|
:00425DCB 6A7D                    push 0000007D
:00425DCD 8B0D606A4B00            mov ecx, dword ptr [004B6A60]
:00425DD3 51                      push ecx
:00425DD4 FF15B0634800            call dword ptr [004863B0]
:00425DDA A318804900              mov dword ptr [00498018], eax
:00425DDF 833D1880490000          cmp dword ptr [00498018], 00000000
:00425DE6 7507                    jne 00425DEF
:00425DE8 33C0                    xor eax, eax
:00425DEA E9B5010000              jmp 00425FA4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425DE6(C)
|
:00425DEF 6A7E                    push 0000007E
:00425DF1 8B15606A4B00            mov edx, dword ptr [004B6A60]
:00425DF7 52                      push edx
:00425DF8 FF15B0634800            call dword ptr [004863B0]
:00425DFE A31C804900              mov dword ptr [0049801C], eax
:00425E03 833D1C80490000          cmp dword ptr [0049801C], 00000000
:00425E0A 7507                    jne 00425E13
:00425E0C 33C0                    xor eax, eax
:00425E0E E991010000              jmp 00425FA4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425E0A(C)
|
:00425E13 68007F0000              push 00007F00
:00425E18 6A00                    push 00000000
:00425E1A FF15B0634800            call dword ptr [004863B0]
:00425E20 A320804900              mov dword ptr [00498020], eax
:00425E25 833D2080490000          cmp dword ptr [00498020], 00000000
:00425E2C 7507                    jne 00425E35
:00425E2E 33C0                    xor eax, eax
:00425E30 E96F010000              jmp 00425FA4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425E2C(C)
|
:00425E35 68017F0000              push 00007F01
:00425E3A 6A00                    push 00000000
:00425E3C FF15B0634800            call dword ptr [004863B0]
:00425E42 A324804900              mov dword ptr [00498024], eax
:00425E47 833D2480490000          cmp dword ptr [00498024], 00000000
:00425E4E 7507                    jne 00425E57
:00425E50 33C0                    xor eax, eax
:00425E52 E94D010000              jmp 00425FA4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425E4E(C)
|
:00425E57 68027F0000              push 00007F02
:00425E5C 6A00                    push 00000000
:00425E5E FF15B0634800            call dword ptr [004863B0]
:00425E64 A328804900              mov dword ptr [00498028], eax
:00425E69 833D2880490000          cmp dword ptr [00498028], 00000000
:00425E70 7507                    jne 00425E79
:00425E72 33C0                    xor eax, eax
:00425E74 E92B010000              jmp 00425FA4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425E70(C)
|
:00425E79 68037F0000              push 00007F03
:00425E7E 6A00                    push 00000000
:00425E80 FF15B0634800            call dword ptr [004863B0]
:00425E86 A32C804900              mov dword ptr [0049802C], eax
:00425E8B 833D2C80490000          cmp dword ptr [0049802C], 00000000
:00425E92 7507                    jne 00425E9B
:00425E94 33C0                    xor eax, eax
:00425E96 E909010000              jmp 00425FA4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425E92(C)
|
:00425E9B 68047F0000              push 00007F04
:00425EA0 6A00                    push 00000000
:00425EA2 FF15B0634800            call dword ptr [004863B0]
:00425EA8 A330804900              mov dword ptr [00498030], eax
:00425EAD 833D3080490000          cmp dword ptr [00498030], 00000000
:00425EB4 7507                    jne 00425EBD
:00425EB6 33C0                    xor eax, eax
:00425EB8 E9E7000000              jmp 00425FA4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425EB4(C)
|
:00425EBD 68827F0000              push 00007F82
:00425EC2 6A00                    push 00000000
:00425EC4 FF15B0634800            call dword ptr [004863B0]
:00425ECA A334804900              mov dword ptr [00498034], eax
:00425ECF 833D3480490000          cmp dword ptr [00498034], 00000000
:00425ED6 7507                    jne 00425EDF
:00425ED8 33C0                    xor eax, eax
:00425EDA E9C5000000              jmp 00425FA4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425ED6(C)
|
:00425EDF 68837F0000              push 00007F83
:00425EE4 6A00                    push 00000000
:00425EE6 FF15B0634800            call dword ptr [004863B0]
:00425EEC A338804900              mov dword ptr [00498038], eax
:00425EF1 833D3880490000          cmp dword ptr [00498038], 00000000
:00425EF8 7507                    jne 00425F01
:00425EFA 33C0                    xor eax, eax
:00425EFC E9A3000000              jmp 00425FA4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425EF8(C)
|
:00425F01 68847F0000              push 00007F84
:00425F06 6A00                    push 00000000
:00425F08 FF15B0634800            call dword ptr [004863B0]
:00425F0E A33C804900              mov dword ptr [0049803C], eax
:00425F13 833D3C80490000          cmp dword ptr [0049803C], 00000000
:00425F1A 7507                    jne 00425F23
:00425F1C 33C0                    xor eax, eax
:00425F1E E981000000              jmp 00425FA4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425F1A(C)
|
:00425F23 68857F0000              push 00007F85
:00425F28 6A00                    push 00000000
:00425F2A FF15B0634800            call dword ptr [004863B0]
:00425F30 A340804900              mov dword ptr [00498040], eax
:00425F35 833D4080490000          cmp dword ptr [00498040], 00000000
:00425F3C 7504                    jne 00425F42
:00425F3E 33C0                    xor eax, eax
:00425F40 EB62                    jmp 00425FA4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425F3C(C)
|
:00425F42 68867F0000              push 00007F86
:00425F47 6A00                    push 00000000
:00425F49 FF15B0634800            call dword ptr [004863B0]
:00425F4F A344804900              mov dword ptr [00498044], eax
:00425F54 833D4480490000          cmp dword ptr [00498044], 00000000
:00425F5B 7504                    jne 00425F61
:00425F5D 33C0                    xor eax, eax
:00425F5F EB43                    jmp 00425FA4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425F5B(C)
|
:00425F61 68887F0000              push 00007F88
:00425F66 6A00                    push 00000000
:00425F68 FF15B0634800            call dword ptr [004863B0]
:00425F6E A348804900              mov dword ptr [00498048], eax
:00425F73 833D4880490000          cmp dword ptr [00498048], 00000000
:00425F7A 7504                    jne 00425F80
:00425F7C 33C0                    xor eax, eax
:00425F7E EB24                    jmp 00425FA4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425F7A(C)
|
:00425F80 688A7F0000              push 00007F8A
:00425F85 6A00                    push 00000000
:00425F87 FF15B0634800            call dword ptr [004863B0]
:00425F8D A34C804900              mov dword ptr [0049804C], eax
:00425F92 833D4C80490000          cmp dword ptr [0049804C], 00000000
:00425F99 7504                    jne 00425F9F
:00425F9B 33C0                    xor eax, eax
:00425F9D EB05                    jmp 00425FA4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425F99(C)
|
:00425F9F B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00425C85(U), :00425CA9(U), :00425CCD(U), :00425CF0(U), :00425D14(U)
|:00425D38(U), :00425D5B(U), :00425D7F(U), :00425DA3(U), :00425DC6(U)
|:00425DEA(U), :00425E0E(U), :00425E30(U), :00425E52(U), :00425E74(U)
|:00425E96(U), :00425EB8(U), :00425EDA(U), :00425EFC(U), :00425F1E(U)
|:00425F40(U), :00425F5F(U), :00425F7E(U), :00425F9D(U)
|
:00425FA4 8BE5                    mov esp, ebp
:00425FA6 5D                      pop ebp
:00425FA7 C3                      ret



* Referenced by a CALL at Addresses:
|:00425BB9   , :004755E6   
|
:00425FA8 55                      push ebp
:00425FA9 8BEC                    mov ebp, esp
:00425FAB 83EC08                  sub esp, 00000008
:00425FAE 894DF8                  mov dword ptr [ebp-08], ecx
:00425FB1 C745FC00000000          mov [ebp-04], 00000000
:00425FB8 EB09                    jmp 00425FC3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425FDA(U)
|
:00425FBA 8B45FC                  mov eax, dword ptr [ebp-04]
:00425FBD 83C001                  add eax, 00000001
:00425FC0 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425FB8(U)
|
:00425FC3 837DFC18                cmp dword ptr [ebp-04], 00000018
:00425FC7 7D13                    jge 00425FDC
:00425FC9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00425FCC 8B148DF07F4900          mov edx, dword ptr [4*ecx+00497FF0]
:00425FD3 52                      push edx
:00425FD4 FF15AC634800            call dword ptr [004863AC]
:00425FDA EBDE                    jmp 00425FBA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425FC7(C)
|
:00425FDC 8BE5                    mov esp, ebp
:00425FDE 5D                      pop ebp
:00425FDF C3                      ret



* Referenced by a CALL at Address:
|:00425C52   
|
:00425FE0 55                      push ebp
:00425FE1 8BEC                    mov ebp, esp
:00425FE3 51                      push ecx
:00425FE4 894DFC                  mov dword ptr [ebp-04], ecx
:00425FE7 8B45FC                  mov eax, dword ptr [ebp-04]
:00425FEA 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:00425FF0 8908                    mov dword ptr [eax], ecx
:00425FF2 8B55FC                  mov edx, dword ptr [ebp-04]
:00425FF5 C7420800000000          mov [edx+08], 00000000
:00425FFC 8B45FC                  mov eax, dword ptr [ebp-04]
:00425FFF C7400C00000000          mov [eax+0C], 00000000
:00426006 8B4DFC                  mov ecx, dword ptr [ebp-04]

* Possible Reference to Dialog: DialogID_0140 
                                  |
:00426009 C7411840010000          mov [ecx+18], 00000140
:00426010 8B55FC                  mov edx, dword ptr [ebp-04]
:00426013 C7421CF0000000          mov [edx+1C], 000000F0
:0042601A 8B45FC                  mov eax, dword ptr [ebp-04]

* Possible Reference to Dialog: DialogID_0140 
                                  |
:0042601D C7401040010000          mov [eax+10], 00000140
:00426024 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00426027 C74114F0000000          mov [ecx+14], 000000F0
:0042602E 8B55FC                  mov edx, dword ptr [ebp-04]
:00426031 83C210                  add edx, 00000010
:00426034 52                      push edx
:00426035 A1686A4B00              mov eax, dword ptr [004B6A68]
:0042603A 50                      push eax
:0042603B FF1520634800            call dword ptr [00486320]
:00426041 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00426044 8B5114                  mov edx, dword ptr [ecx+14]
:00426047 52                      push edx
:00426048 8B45FC                  mov eax, dword ptr [ebp-04]
:0042604B 8B4810                  mov ecx, dword ptr [eax+10]
:0042604E 51                      push ecx
:0042604F FF1570624800            call dword ptr [00486270]
:00426055 8B15F07F4900            mov edx, dword ptr [00497FF0]
:0042605B 52                      push edx
:0042605C FF1594624800            call dword ptr [00486294]
:00426062 8BE5                    mov esp, ebp
:00426064 5D                      pop ebp
:00426065 C3                      ret



* Referenced by a CALL at Addresses:
|:0042D4D1   , :0042D551   , :0042DD0A   , :0042DD86   , :0042E1A5   
|:0042E415   , :0042EA47   , :0042ED2F   , :0042EF81   , :0042F5CD   
|:00432A2F   , :00432A96   , :004434C2   , :00443529   , :004737E3   
|:00473932   , :00473A06   , :00473EEE   , :004740D2   
|
:00426066 55                      push ebp
:00426067 8BEC                    mov ebp, esp
:00426069 51                      push ecx
:0042606A 894DFC                  mov dword ptr [ebp-04], ecx
:0042606D 8B45FC                  mov eax, dword ptr [ebp-04]
:00426070 83780800                cmp dword ptr [eax+08], 00000000
:00426074 7512                    jne 00426088
:00426076 6A01                    push 00000001
:00426078 FF156C624800            call dword ptr [0048626C]
:0042607E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00426081 C7410801000000          mov [ecx+08], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426074(C)
|
:00426088 8BE5                    mov esp, ebp
:0042608A 5D                      pop ebp
:0042608B C3                      ret


:0042608C 55                      push ebp
:0042608D 8BEC                    mov ebp, esp
:0042608F 51                      push ecx
:00426090 894DFC                  mov dword ptr [ebp-04], ecx
:00426093 8B45FC                  mov eax, dword ptr [ebp-04]
:00426096 83780800                cmp dword ptr [eax+08], 00000000
:0042609A 7412                    je 004260AE
:0042609C 6A00                    push 00000000
:0042609E FF156C624800            call dword ptr [0048626C]
:004260A4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004260A7 C7410800000000          mov [ecx+08], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042609A(C)
|
:004260AE 8BE5                    mov esp, ebp
:004260B0 5D                      pop ebp
:004260B1 C3                      ret



* Referenced by a CALL at Address:
|:004750DB   
|
:004260B2 55                      push ebp
:004260B3 8BEC                    mov ebp, esp
:004260B5 51                      push ecx
:004260B6 894DFC                  mov dword ptr [ebp-04], ecx
:004260B9 8B45FC                  mov eax, dword ptr [ebp-04]
:004260BC 8B4D08                  mov ecx, dword ptr [ebp+08]
:004260BF 894804                  mov dword ptr [eax+04], ecx
:004260C2 8B55FC                  mov edx, dword ptr [ebp-04]
:004260C5 83C210                  add edx, 00000010
:004260C8 52                      push edx
:004260C9 FF1568624800            call dword ptr [00486268]
:004260CF 8B4510                  mov eax, dword ptr [ebp+10]
:004260D2 25FFFF0000              and eax, 0000FFFF
:004260D7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004260DA 894118                  mov dword ptr [ecx+18], eax
:004260DD 8B5510                  mov edx, dword ptr [ebp+10]
:004260E0 C1EA10                  shr edx, 10
:004260E3 81E2FFFF0000            and edx, 0000FFFF
:004260E9 81E2FFFF0000            and edx, 0000FFFF
:004260EF 8B45FC                  mov eax, dword ptr [ebp-04]
:004260F2 89501C                  mov dword ptr [eax+1C], edx
:004260F5 817D0C01020000          cmp dword ptr [ebp+0C], 00000201
:004260FC 751B                    jne 00426119
:004260FE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00426101 8B55FC                  mov edx, dword ptr [ebp-04]
:00426104 8B4228                  mov eax, dword ptr [edx+28]
:00426107 89412C                  mov dword ptr [ecx+2C], eax
:0042610A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042610D C7412801000000          mov [ecx+28], 00000001
:00426114 E9BE000000              jmp 004261D7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004260FC(C)
|
:00426119 817D0C04020000          cmp dword ptr [ebp+0C], 00000204
:00426120 751B                    jne 0042613D
:00426122 8B55FC                  mov edx, dword ptr [ebp-04]
:00426125 8B45FC                  mov eax, dword ptr [ebp-04]
:00426128 8B4834                  mov ecx, dword ptr [eax+34]
:0042612B 894A34                  mov dword ptr [edx+34], ecx
:0042612E 8B55FC                  mov edx, dword ptr [ebp-04]
:00426131 C7423002000000          mov [edx+30], 00000002
:00426138 E99A000000              jmp 004261D7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426120(C)
|
:0042613D 817D0C03020000          cmp dword ptr [ebp+0C], 00000203
:00426144 7518                    jne 0042615E
:00426146 8B45FC                  mov eax, dword ptr [ebp-04]
:00426149 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042614C 8B5128                  mov edx, dword ptr [ecx+28]
:0042614F 89502C                  mov dword ptr [eax+2C], edx
:00426152 8B45FC                  mov eax, dword ptr [ebp-04]
:00426155 C7402805000000          mov [eax+28], 00000005
:0042615C EB79                    jmp 004261D7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426144(C)
|
:0042615E 817D0C06020000          cmp dword ptr [ebp+0C], 00000206
:00426165 7518                    jne 0042617F
:00426167 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042616A 8B55FC                  mov edx, dword ptr [ebp-04]
:0042616D 8B4230                  mov eax, dword ptr [edx+30]
:00426170 894134                  mov dword ptr [ecx+34], eax
:00426173 8B4DFC                  mov ecx, dword ptr [ebp-04]

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:00426176 C7413006000000          mov [ecx+30], 00000006
:0042617D EB58                    jmp 004261D7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426165(C)
|
:0042617F 817D0C02020000          cmp dword ptr [ebp+0C], 00000202
:00426186 7518                    jne 004261A0
:00426188 8B55FC                  mov edx, dword ptr [ebp-04]
:0042618B 8B45FC                  mov eax, dword ptr [ebp-04]
:0042618E 8B4828                  mov ecx, dword ptr [eax+28]
:00426191 894A2C                  mov dword ptr [edx+2C], ecx
:00426194 8B55FC                  mov edx, dword ptr [ebp-04]
:00426197 C7422803000000          mov [edx+28], 00000003
:0042619E EB37                    jmp 004261D7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426186(C)
|
:004261A0 817D0C05020000          cmp dword ptr [ebp+0C], 00000205
:004261A7 7518                    jne 004261C1
:004261A9 8B45FC                  mov eax, dword ptr [ebp-04]
:004261AC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004261AF 8B5130                  mov edx, dword ptr [ecx+30]
:004261B2 895034                  mov dword ptr [eax+34], edx
:004261B5 8B45FC                  mov eax, dword ptr [ebp-04]
:004261B8 C7403004000000          mov [eax+30], 00000004
:004261BF EB16                    jmp 004261D7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004261A7(C)
|
:004261C1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004261C4 8B55FC                  mov edx, dword ptr [ebp-04]
:004261C7 8B4230                  mov eax, dword ptr [edx+30]
:004261CA 894134                  mov dword ptr [ecx+34], eax
:004261CD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004261D0 C7413000000000          mov [ecx+30], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00426114(U), :00426138(U), :0042615C(U), :0042617D(U), :0042619E(U)
|:004261BF(U)
|
:004261D7 8BE5                    mov esp, ebp
:004261D9 5D                      pop ebp
:004261DA C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:00425BD7   , :00426404   , :00426509   , :00426574   , :0042659A   
|:0042667C   , :00426698   , :0047C16E   
|
:004261DD 55                      push ebp
:004261DE 8BEC                    mov ebp, esp
:004261E0 83EC08                  sub esp, 00000008
:004261E3 894DF8                  mov dword ptr [ebp-08], ecx
:004261E6 FF1560624800            call dword ptr [00486260]
:004261EC 8945FC                  mov dword ptr [ebp-04], eax
:004261EF 8B4508                  mov eax, dword ptr [ebp+08]
:004261F2 3B45FC                  cmp eax, dword ptr [ebp-04]
:004261F5 753E                    jne 00426235
:004261F7 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004261FA 83C110                  add ecx, 00000010
:004261FD 51                      push ecx
:004261FE FF1568624800            call dword ptr [00486268]
:00426204 8B55F8                  mov edx, dword ptr [ebp-08]
:00426207 8B45F8                  mov eax, dword ptr [ebp-08]
:0042620A 8B4810                  mov ecx, dword ptr [eax+10]
:0042620D 894A18                  mov dword ptr [edx+18], ecx
:00426210 8B55F8                  mov edx, dword ptr [ebp-08]
:00426213 8B45F8                  mov eax, dword ptr [ebp-08]
:00426216 8B4814                  mov ecx, dword ptr [eax+14]
:00426219 894A1C                  mov dword ptr [edx+1C], ecx
:0042621C 8B55F8                  mov edx, dword ptr [ebp-08]
:0042621F 83C218                  add edx, 00000018
:00426222 52                      push edx
:00426223 8B4508                  mov eax, dword ptr [ebp+08]
:00426226 50                      push eax
:00426227 FF1564624800            call dword ptr [00486264]
:0042622D 8B45F8                  mov eax, dword ptr [ebp-08]
:00426230 83C018                  add eax, 00000018
:00426233 EB06                    jmp 0042623B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004261F5(C)
|
:00426235 8B45F8                  mov eax, dword ptr [ebp-08]
:00426238 83C020                  add eax, 00000020

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426233(U)
|
:0042623B 8BE5                    mov esp, ebp
:0042623D 5D                      pop ebp
:0042623E C20400                  ret 0004



* Referenced by a CALL at Address:
|:00425C02   
|
:00426241 55                      push ebp
:00426242 8BEC                    mov ebp, esp
:00426244 51                      push ecx
:00426245 894DFC                  mov dword ptr [ebp-04], ecx
:00426248 8B45FC                  mov eax, dword ptr [ebp-04]
:0042624B 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0042624E 8B11                    mov edx, dword ptr [ecx]
:00426250 895018                  mov dword ptr [eax+18], edx
:00426253 8B45FC                  mov eax, dword ptr [ebp-04]
:00426256 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00426259 8B5104                  mov edx, dword ptr [ecx+04]
:0042625C 89501C                  mov dword ptr [eax+1C], edx
:0042625F 8B45FC                  mov eax, dword ptr [ebp-04]
:00426262 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00426265 8B5118                  mov edx, dword ptr [ecx+18]
:00426268 895010                  mov dword ptr [eax+10], edx
:0042626B 8B45FC                  mov eax, dword ptr [ebp-04]
:0042626E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00426271 8B511C                  mov edx, dword ptr [ecx+1C]
:00426274 895014                  mov dword ptr [eax+14], edx
:00426277 8B45FC                  mov eax, dword ptr [ebp-04]
:0042627A 83C010                  add eax, 00000010
:0042627D 50                      push eax
:0042627E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00426281 51                      push ecx
:00426282 FF1520634800            call dword ptr [00486320]
:00426288 8B55FC                  mov edx, dword ptr [ebp-04]
:0042628B 8B4214                  mov eax, dword ptr [edx+14]
:0042628E 50                      push eax
:0042628F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00426292 8B5110                  mov edx, dword ptr [ecx+10]
:00426295 52                      push edx
:00426296 FF1570624800            call dword ptr [00486270]
:0042629C 8BE5                    mov esp, ebp
:0042629E 5D                      pop ebp
:0042629F C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0042B87F   , :0042B8F3   , :0042B92E   , :0042C701   , :0042C716   
|:0042C7FC   
|
:004262A2 55                      push ebp
:004262A3 8BEC                    mov ebp, esp
:004262A5 51                      push ecx
:004262A6 894DFC                  mov dword ptr [ebp-04], ecx
:004262A9 837D0C18                cmp dword ptr [ebp+0C], 00000018
:004262AD 7D0B                    jge 004262BA
:004262AF 8B45FC                  mov eax, dword ptr [ebp-04]
:004262B2 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004262B5 89480C                  mov dword ptr [eax+0C], ecx
:004262B8 EB0A                    jmp 004262C4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004262AD(C)
|
:004262BA 8B55FC                  mov edx, dword ptr [ebp-04]
:004262BD C7420C0C000000          mov [edx+0C], 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004262B8(U)
|
:004262C4 8B45FC                  mov eax, dword ptr [ebp-04]
:004262C7 8B4D08                  mov ecx, dword ptr [ebp+08]
:004262CA 8908                    mov dword ptr [eax], ecx
:004262CC 8BE5                    mov esp, ebp
:004262CE 5D                      pop ebp
:004262CF C20800                  ret 0008


:004262D2 55                      push ebp
:004262D3 8BEC                    mov ebp, esp
:004262D5 51                      push ecx
:004262D6 894DFC                  mov dword ptr [ebp-04], ecx
:004262D9 8B45FC                  mov eax, dword ptr [ebp-04]
:004262DC 8B400C                  mov eax, dword ptr [eax+0C]
:004262DF 8BE5                    mov esp, ebp
:004262E1 5D                      pop ebp
:004262E2 C3                      ret



* Referenced by a CALL at Addresses:
|:0042B889   , :0042B8FD   , :0042B938   , :0042C720   , :0042C806   
|
:004262E3 55                      push ebp
:004262E4 8BEC                    mov ebp, esp
:004262E6 83EC08                  sub esp, 00000008
:004262E9 894DF8                  mov dword ptr [ebp-08], ecx
:004262EC FF1560624800            call dword ptr [00486260]
:004262F2 8945FC                  mov dword ptr [ebp-04], eax
:004262F5 8B45F8                  mov eax, dword ptr [ebp-08]
:004262F8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004262FB 3B08                    cmp ecx, dword ptr [eax]
:004262FD 7514                    jne 00426313
:004262FF 8B55F8                  mov edx, dword ptr [ebp-08]
:00426302 8B420C                  mov eax, dword ptr [edx+0C]
:00426305 8B0C85F07F4900          mov ecx, dword ptr [4*eax+00497FF0]
:0042630C 51                      push ecx
:0042630D FF1594624800            call dword ptr [00486294]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004262FD(C)
|
:00426313 8BE5                    mov esp, ebp
:00426315 5D                      pop ebp
:00426316 C3                      ret



* Referenced by a CALL at Addresses:
|:0042644A   , :00426558   
|
:00426317 55                      push ebp
:00426318 8BEC                    mov ebp, esp
:0042631A 51                      push ecx
:0042631B 894DFC                  mov dword ptr [ebp-04], ecx
:0042631E 8B45FC                  mov eax, dword ptr [ebp-04]
:00426321 83782801                cmp dword ptr [eax+28], 00000001
:00426325 7507                    jne 0042632E
:00426327 B801000000              mov eax, 00000001
:0042632C EB02                    jmp 00426330

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426325(C)
|
:0042632E 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042632C(U)
|
:00426330 8BE5                    mov esp, ebp
:00426332 5D                      pop ebp
:00426333 C3                      ret



* Referenced by a CALL at Address:
|:00426496   
|
:00426334 55                      push ebp
:00426335 8BEC                    mov ebp, esp
:00426337 51                      push ecx
:00426338 894DFC                  mov dword ptr [ebp-04], ecx
:0042633B 8B45FC                  mov eax, dword ptr [ebp-04]
:0042633E 83782803                cmp dword ptr [eax+28], 00000003
:00426342 7507                    jne 0042634B
:00426344 B801000000              mov eax, 00000001
:00426349 EB02                    jmp 0042634D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426342(C)
|
:0042634B 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426349(U)
|
:0042634D 8BE5                    mov esp, ebp
:0042634F 5D                      pop ebp
:00426350 C3                      ret



* Referenced by a CALL at Addresses:
|:0042645D   , :00426562   
|
:00426351 55                      push ebp
:00426352 8BEC                    mov ebp, esp
:00426354 51                      push ecx
:00426355 894DFC                  mov dword ptr [ebp-04], ecx
:00426358 8B45FC                  mov eax, dword ptr [ebp-04]
:0042635B 83783002                cmp dword ptr [eax+30], 00000002
:0042635F 7507                    jne 00426368
:00426361 B801000000              mov eax, 00000001
:00426366 EB02                    jmp 0042636A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042635F(C)
|
:00426368 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426366(U)
|
:0042636A 8BE5                    mov esp, ebp
:0042636C 5D                      pop ebp
:0042636D C3                      ret



* Referenced by a CALL at Address:
|:004264A9   
|
:0042636E 55                      push ebp
:0042636F 8BEC                    mov ebp, esp
:00426371 51                      push ecx
:00426372 894DFC                  mov dword ptr [ebp-04], ecx
:00426375 8B45FC                  mov eax, dword ptr [ebp-04]
:00426378 83783004                cmp dword ptr [eax+30], 00000004
:0042637C 7507                    jne 00426385
:0042637E B801000000              mov eax, 00000001
:00426383 EB02                    jmp 00426387

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042637C(C)
|
:00426385 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426383(U)
|
:00426387 8BE5                    mov esp, ebp
:00426389 5D                      pop ebp
:0042638A C3                      ret



* Referenced by a CALL at Addresses:
|:00426470   , :0042657E   
|
:0042638B 55                      push ebp
:0042638C 8BEC                    mov ebp, esp
:0042638E 51                      push ecx
:0042638F 894DFC                  mov dword ptr [ebp-04], ecx
:00426392 8B45FC                  mov eax, dword ptr [ebp-04]
:00426395 83782805                cmp dword ptr [eax+28], 00000005
:00426399 7507                    jne 004263A2
:0042639B B801000000              mov eax, 00000001
:004263A0 EB02                    jmp 004263A4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426399(C)
|
:004263A2 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004263A0(U)
|
:004263A4 8BE5                    mov esp, ebp
:004263A6 5D                      pop ebp
:004263A7 C3                      ret



* Referenced by a CALL at Addresses:
|:00426483   , :00426588   
|
:004263A8 55                      push ebp
:004263A9 8BEC                    mov ebp, esp
:004263AB 51                      push ecx
:004263AC 894DFC                  mov dword ptr [ebp-04], ecx
:004263AF 8B45FC                  mov eax, dword ptr [ebp-04]
:004263B2 83783006                cmp dword ptr [eax+30], 00000006
:004263B6 7507                    jne 004263BF
:004263B8 B801000000              mov eax, 00000001
:004263BD EB02                    jmp 004263C1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004263B6(C)
|
:004263BF 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004263BD(U)
|
:004263C1 8BE5                    mov esp, ebp
:004263C3 5D                      pop ebp
:004263C4 C3                      ret



* Referenced by a CALL at Addresses:
|:0041F5EB   , :00425C1D   
|
:004263C5 55                      push ebp
:004263C6 8BEC                    mov ebp, esp
:004263C8 83EC18                  sub esp, 00000018
:004263CB 894DE8                  mov dword ptr [ebp-18], ecx
:004263CE E8F1860500              call 0047EAC4
:004263D3 FF1560624800            call dword ptr [00486260]
:004263D9 8945FC                  mov dword ptr [ebp-04], eax
:004263DC 8B4508                  mov eax, dword ptr [ebp+08]
:004263DF 3B45FC                  cmp eax, dword ptr [ebp-04]
:004263E2 7407                    je 004263EB
:004263E4 33C0                    xor eax, eax
:004263E6 E9D0000000              jmp 004264BB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004263E2(C)
|
:004263EB 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004263EE 8B5104                  mov edx, dword ptr [ecx+04]
:004263F1 3B55FC                  cmp edx, dword ptr [ebp-04]
:004263F4 7407                    je 004263FD
:004263F6 33C0                    xor eax, eax
:004263F8 E9BE000000              jmp 004264BB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004263F4(C)
|
:004263FD 8B4508                  mov eax, dword ptr [ebp+08]
:00426400 50                      push eax
:00426401 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00426404 E8D4FDFFFF              call 004261DD
:00426409 8D4DEC                  lea ecx, dword ptr [ebp-14]
:0042640C 51                      push ecx
:0042640D 8B5508                  mov edx, dword ptr [ebp+08]
:00426410 52                      push edx
:00426411 FF15EC624800            call dword ptr [004862EC]
:00426417 8B45E8                  mov eax, dword ptr [ebp-18]
:0042641A 8B4818                  mov ecx, dword ptr [eax+18]
:0042641D 3B4DEC                  cmp ecx, dword ptr [ebp-14]
:00426420 7C21                    jl 00426443
:00426422 8B55E8                  mov edx, dword ptr [ebp-18]
:00426425 8B421C                  mov eax, dword ptr [edx+1C]
:00426428 3B45F0                  cmp eax, dword ptr [ebp-10]
:0042642B 7C16                    jl 00426443
:0042642D 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00426430 8B5118                  mov edx, dword ptr [ecx+18]
:00426433 3B55F4                  cmp edx, dword ptr [ebp-0C]
:00426436 7F0B                    jg 00426443
:00426438 8B45E8                  mov eax, dword ptr [ebp-18]
:0042643B 8B481C                  mov ecx, dword ptr [eax+1C]
:0042643E 3B4DF8                  cmp ecx, dword ptr [ebp-08]
:00426441 7E04                    jle 00426447

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00426420(C), :0042642B(C), :00426436(C)
|
:00426443 33C0                    xor eax, eax
:00426445 EB74                    jmp 004264BB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426441(C)
|
:00426447 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0042644A E8C8FEFFFF              call 00426317
:0042644F 85C0                    test eax, eax
:00426451 7407                    je 0042645A
:00426453 B801000000              mov eax, 00000001
:00426458 EB61                    jmp 004264BB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426451(C)
|
:0042645A 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0042645D E8EFFEFFFF              call 00426351
:00426462 85C0                    test eax, eax
:00426464 7407                    je 0042646D
:00426466 B802000000              mov eax, 00000002
:0042646B EB4E                    jmp 004264BB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426464(C)
|
:0042646D 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00426470 E816FFFFFF              call 0042638B
:00426475 85C0                    test eax, eax
:00426477 7407                    je 00426480
:00426479 B805000000              mov eax, 00000005
:0042647E EB3B                    jmp 004264BB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426477(C)
|
:00426480 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00426483 E820FFFFFF              call 004263A8
:00426488 85C0                    test eax, eax
:0042648A 7407                    je 00426493

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0042648C B806000000              mov eax, 00000006
:00426491 EB28                    jmp 004264BB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042648A(C)
|
:00426493 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00426496 E899FEFFFF              call 00426334
:0042649B 85C0                    test eax, eax
:0042649D 7407                    je 004264A6
:0042649F B803000000              mov eax, 00000003
:004264A4 EB15                    jmp 004264BB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042649D(C)
|
:004264A6 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004264A9 E8C0FEFFFF              call 0042636E
:004264AE 85C0                    test eax, eax
:004264B0 7407                    je 004264B9
:004264B2 B804000000              mov eax, 00000004
:004264B7 EB02                    jmp 004264BB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004264B0(C)
|
:004264B9 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004263E6(U), :004263F8(U), :00426445(U), :00426458(U), :0042646B(U)
|:0042647E(U), :00426491(U), :004264A4(U), :004264B7(U)
|
:004264BB 8BE5                    mov esp, ebp
:004264BD 5D                      pop ebp
:004264BE C20400                  ret 0004


:004264C1 55                      push ebp
:004264C2 8BEC                    mov ebp, esp
:004264C4 83EC18                  sub esp, 00000018
:004264C7 56                      push esi
:004264C8 894DE8                  mov dword ptr [ebp-18], ecx
:004264CB E8F4850500              call 0047EAC4
:004264D0 FF1560624800            call dword ptr [00486260]
:004264D6 8945FC                  mov dword ptr [ebp-04], eax
:004264D9 8B4508                  mov eax, dword ptr [ebp+08]
:004264DC 3B45FC                  cmp eax, dword ptr [ebp-04]
:004264DF 740B                    je 004264EC
:004264E1 8B45E8                  mov eax, dword ptr [ebp-18]
:004264E4 83C020                  add eax, 00000020
:004264E7 E9BB000000              jmp 004265A7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004264DF(C)
|
:004264EC 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004264EF 8B5104                  mov edx, dword ptr [ecx+04]
:004264F2 3B55FC                  cmp edx, dword ptr [ebp-04]
:004264F5 740B                    je 00426502
:004264F7 8B45E8                  mov eax, dword ptr [ebp-18]
:004264FA 83C020                  add eax, 00000020
:004264FD E9A5000000              jmp 004265A7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004264F5(C)
|
:00426502 8B4508                  mov eax, dword ptr [ebp+08]
:00426505 50                      push eax
:00426506 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00426509 E8CFFCFFFF              call 004261DD
:0042650E 8D4DEC                  lea ecx, dword ptr [ebp-14]
:00426511 51                      push ecx
:00426512 8B5508                  mov edx, dword ptr [ebp+08]
:00426515 52                      push edx
:00426516 FF15EC624800            call dword ptr [004862EC]
:0042651C 8B45E8                  mov eax, dword ptr [ebp-18]
:0042651F 8B4818                  mov ecx, dword ptr [eax+18]
:00426522 3B4DEC                  cmp ecx, dword ptr [ebp-14]
:00426525 7C21                    jl 00426548
:00426527 8B55E8                  mov edx, dword ptr [ebp-18]
:0042652A 8B421C                  mov eax, dword ptr [edx+1C]
:0042652D 3B45F0                  cmp eax, dword ptr [ebp-10]
:00426530 7C16                    jl 00426548
:00426532 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00426535 8B5118                  mov edx, dword ptr [ecx+18]
:00426538 3B55F4                  cmp edx, dword ptr [ebp-0C]
:0042653B 7F0B                    jg 00426548
:0042653D 8B45E8                  mov eax, dword ptr [ebp-18]
:00426540 8B481C                  mov ecx, dword ptr [eax+1C]
:00426543 3B4DF8                  cmp ecx, dword ptr [ebp-08]
:00426546 7E08                    jle 00426550

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00426525(C), :00426530(C), :0042653B(C)
|
:00426548 8B45E8                  mov eax, dword ptr [ebp-18]
:0042654B 83C020                  add eax, 00000020
:0042654E EB57                    jmp 004265A7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426546(C)
|
:00426550 E86F850500              call 0047EAC4
:00426555 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00426558 E8BAFDFFFF              call 00426317
:0042655D 8BF0                    mov esi, eax
:0042655F 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00426562 E8EAFDFFFF              call 00426351
:00426567 0BF0                    or esi, eax
:00426569 85F6                    test esi, esi
:0042656B 740E                    je 0042657B
:0042656D 8B5508                  mov edx, dword ptr [ebp+08]
:00426570 52                      push edx
:00426571 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00426574 E864FCFFFF              call 004261DD
:00426579 EB2C                    jmp 004265A7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042656B(C)
|
:0042657B 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0042657E E808FEFFFF              call 0042638B
:00426583 8BF0                    mov esi, eax
:00426585 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00426588 E81BFEFFFF              call 004263A8
:0042658D 0BF0                    or esi, eax
:0042658F 85F6                    test esi, esi
:00426591 740E                    je 004265A1
:00426593 8B4508                  mov eax, dword ptr [ebp+08]
:00426596 50                      push eax
:00426597 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0042659A E83EFCFFFF              call 004261DD
:0042659F EB06                    jmp 004265A7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426591(C)
|
:004265A1 8B45E8                  mov eax, dword ptr [ebp-18]
:004265A4 83C020                  add eax, 00000020

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004264E7(U), :004264FD(U), :0042654E(U), :00426579(U), :0042659F(U)
|
:004265A7 5E                      pop esi
:004265A8 8BE5                    mov esp, ebp
:004265AA 5D                      pop ebp
:004265AB C20400                  ret 0004



* Referenced by a CALL at Address:
|:0042671F   
|
:004265AE 55                      push ebp
:004265AF 8BEC                    mov ebp, esp
:004265B1 51                      push ecx
:004265B2 894DFC                  mov dword ptr [ebp-04], ecx
:004265B5 8A4508                  mov al, byte ptr [ebp+08]
:004265B8 50                      push eax
:004265B9 6860090000              push 00000960
:004265BE 6A04                    push 00000004
:004265C0 6A00                    push 00000000
:004265C2 68400D0300              push 00030D40
:004265C7 B9C8E44A00              mov ecx, 004AE4C8
:004265CC E86F940500              call 0047FA40
:004265D1 50                      push eax
:004265D2 E83C970500              call 0047FD13
:004265D7 83C40C                  add esp, 0000000C
:004265DA 8BE5                    mov esp, ebp
:004265DC 5D                      pop ebp
:004265DD C20400                  ret 0004


:004265E0 55                      push ebp
:004265E1 8BEC                    mov ebp, esp
:004265E3 83EC10                  sub esp, 00000010
:004265E6 894DF0                  mov dword ptr [ebp-10], ecx
:004265E9 6A04                    push 00000004
:004265EB 6A00                    push 00000000
:004265ED 8B450C                  mov eax, dword ptr [ebp+0C]
:004265F0 6BC050                  imul eax, 00000050
:004265F3 8B4D08                  mov ecx, dword ptr [ebp+08]
:004265F6 8D9408400D0300          lea edx, dword ptr [eax+ecx+00030D40]
:004265FD 52                      push edx
:004265FE B9C8E44A00              mov ecx, 004AE4C8
:00426603 E838940500              call 0047FA40
:00426608 8945FC                  mov dword ptr [ebp-04], eax
:0042660B C745F400000000          mov [ebp-0C], 00000000
:00426612 EB09                    jmp 0042661D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426662(U)
|
:00426614 8B45F4                  mov eax, dword ptr [ebp-0C]
:00426617 83C001                  add eax, 00000001
:0042661A 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426612(U)
|
:0042661D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00426620 3B4D14                  cmp ecx, dword ptr [ebp+14]
:00426623 733F                    jnb 00426664
:00426625 C745F800000000          mov [ebp-08], 00000000
:0042662C EB09                    jmp 00426637

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426650(U)
|
:0042662E 8B55F8                  mov edx, dword ptr [ebp-08]
:00426631 83C201                  add edx, 00000001
:00426634 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042662C(U)
|
:00426637 8B45F8                  mov eax, dword ptr [ebp-08]
:0042663A 3B4510                  cmp eax, dword ptr [ebp+10]
:0042663D 7313                    jnb 00426652
:0042663F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00426642 8A5518                  mov dl, byte ptr [ebp+18]
:00426645 8811                    mov byte ptr [ecx], dl
:00426647 8B45FC                  mov eax, dword ptr [ebp-04]
:0042664A 83C001                  add eax, 00000001
:0042664D 8945FC                  mov dword ptr [ebp-04], eax
:00426650 EBDC                    jmp 0042662E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042663D(C)
|
:00426652 B950000000              mov ecx, 00000050
:00426657 2B4D10                  sub ecx, dword ptr [ebp+10]
:0042665A 8B55FC                  mov edx, dword ptr [ebp-04]
:0042665D 03D1                    add edx, ecx
:0042665F 8955FC                  mov dword ptr [ebp-04], edx
:00426662 EBB0                    jmp 00426614

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426623(C)
|
:00426664 8BE5                    mov esp, ebp
:00426666 5D                      pop ebp
:00426667 C21400                  ret 0014


:0042666A 55                      push ebp
:0042666B 8BEC                    mov ebp, esp
:0042666D 83EC10                  sub esp, 00000010
:00426670 894DF0                  mov dword ptr [ebp-10], ecx
:00426673 A1686A4B00              mov eax, dword ptr [004B6A68]
:00426678 50                      push eax
:00426679 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0042667C E85CFBFFFF              call 004261DD
:00426681 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00426684 8B10                    mov edx, dword ptr [eax]
:00426686 2B5138                  sub edx, dword ptr [ecx+38]
:00426689 C1EA03                  shr edx, 03
:0042668C 8955F8                  mov dword ptr [ebp-08], edx
:0042668F A1686A4B00              mov eax, dword ptr [004B6A68]
:00426694 50                      push eax
:00426695 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00426698 E840FBFFFF              call 004261DD
:0042669D 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004266A0 8B5004                  mov edx, dword ptr [eax+04]
:004266A3 2B513C                  sub edx, dword ptr [ecx+3C]
:004266A6 C1EA04                  shr edx, 04
:004266A9 8955F4                  mov dword ptr [ebp-0C], edx
:004266AC 837DF402                cmp dword ptr [ebp-0C], 00000002
:004266B0 720C                    jb 004266BE
:004266B2 837DF850                cmp dword ptr [ebp-08], 00000050
:004266B6 7306                    jnb 004266BE
:004266B8 837DF41B                cmp dword ptr [ebp-0C], 0000001B
:004266BC 7604                    jbe 004266C2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004266B0(C), :004266B6(C)
|
:004266BE 0CFF                    or al, FF
:004266C0 EB27                    jmp 004266E9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004266BC(C)
|
:004266C2 6A04                    push 00000004
:004266C4 6A00                    push 00000000
:004266C6 8B45F4                  mov eax, dword ptr [ebp-0C]
:004266C9 6BC050                  imul eax, 00000050
:004266CC 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004266CF 8D9408400D0300          lea edx, dword ptr [eax+ecx+00030D40]
:004266D6 52                      push edx
:004266D7 B9C8E44A00              mov ecx, 004AE4C8
:004266DC E85F930500              call 0047FA40
:004266E1 8945FC                  mov dword ptr [ebp-04], eax
:004266E4 8B45FC                  mov eax, dword ptr [ebp-04]
:004266E7 8A00                    mov al, byte ptr [eax]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004266C0(U)
|
:004266E9 8BE5                    mov esp, ebp
:004266EB 5D                      pop ebp
:004266EC C3                      ret


:004266ED 55                      push ebp
:004266EE 8BEC                    mov ebp, esp
:004266F0 51                      push ecx
:004266F1 894DFC                  mov dword ptr [ebp-04], ecx
:004266F4 6860090000              push 00000960
:004266F9 6848C74A00              push 004AC748
:004266FE 6A04                    push 00000004
:00426700 6A00                    push 00000000
:00426702 68400D0300              push 00030D40
:00426707 B9C8E44A00              mov ecx, 004AE4C8
:0042670C E82F930500              call 0047FA40
:00426711 50                      push eax
:00426712 E8E6950500              call 0047FCFD
:00426717 83C40C                  add esp, 0000000C
:0042671A 6A00                    push 00000000
:0042671C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042671F E88AFEFFFF              call 004265AE
:00426724 8BE5                    mov esp, ebp
:00426726 5D                      pop ebp
:00426727 C3                      ret


:00426728 55                      push ebp
:00426729 8BEC                    mov ebp, esp
:0042672B 51                      push ecx
:0042672C 894DFC                  mov dword ptr [ebp-04], ecx
:0042672F 6860090000              push 00000960
:00426734 6A04                    push 00000004
:00426736 6A00                    push 00000000
:00426738 68400D0300              push 00030D40
:0042673D B9C8E44A00              mov ecx, 004AE4C8
:00426742 E8F9920500              call 0047FA40
:00426747 50                      push eax
:00426748 6848C74A00              push 004AC748
:0042674D E8AB950500              call 0047FCFD
:00426752 83C40C                  add esp, 0000000C
:00426755 8BE5                    mov esp, ebp
:00426757 5D                      pop ebp
:00426758 C3                      ret


:00426759 55                      push ebp
:0042675A 8BEC                    mov ebp, esp
:0042675C 51                      push ecx
:0042675D 894DFC                  mov dword ptr [ebp-04], ecx
:00426760 8B45FC                  mov eax, dword ptr [ebp-04]
:00426763 8B4D08                  mov ecx, dword ptr [ebp+08]
:00426766 894838                  mov dword ptr [eax+38], ecx
:00426769 8B55FC                  mov edx, dword ptr [ebp-04]
:0042676C 8B450C                  mov eax, dword ptr [ebp+0C]
:0042676F 89423C                  mov dword ptr [edx+3C], eax
:00426772 8BE5                    mov esp, ebp
:00426774 5D                      pop ebp
:00426775 C20800                  ret 0008


:00426778 CC                      int 03
:00426779 CC                      int 03
:0042677A CC                      int 03
:0042677B CC                      int 03
:0042677C CC                      int 03
:0042677D CC                      int 03
:0042677E CC                      int 03
:0042677F CC                      int 03
:00426780 55                      push ebp
:00426781 8BEC                    mov ebp, esp
:00426783 E807000000              call 0042678F
:00426788 E81F000000              call 004267AC
:0042678D 5D                      pop ebp
:0042678E C3                      ret



* Referenced by a CALL at Address:
|:00426783   
|
:0042678F 55                      push ebp
:00426790 8BEC                    mov ebp, esp
:00426792 6810B54200              push 0042B510
:00426797 6870A94200              push 0042A970
:0042679C 6A08                    push 00000008
:0042679E 6A0E                    push 0000000E
:004267A0 68F8CE4900              push 0049CEF8
:004267A5 E896AC0500              call 00481440
:004267AA 5D                      pop ebp
:004267AB C3                      ret



* Referenced by a CALL at Address:
|:00426788   
|
:004267AC 55                      push ebp
:004267AD 8BEC                    mov ebp, esp
:004267AF 68BE674200              push 004267BE
:004267B4 E847A90500              call 00481100
:004267B9 83C404                  add esp, 00000004
:004267BC 5D                      pop ebp
:004267BD C3                      ret


:004267BE 55                      push ebp
:004267BF 8BEC                    mov ebp, esp
:004267C1 6810B54200              push 0042B510
:004267C6 6A08                    push 00000008
:004267C8 6A0E                    push 0000000E
:004267CA 68F8CE4900              push 0049CEF8
:004267CF E80CAD0500              call 004814E0
:004267D4 5D                      pop ebp
:004267D5 C3                      ret


:004267D6 55                      push ebp
:004267D7 8BEC                    mov ebp, esp
:004267D9 E807000000              call 004267E5
:004267DE E811000000              call 004267F4
:004267E3 5D                      pop ebp
:004267E4 C3                      ret



* Referenced by a CALL at Address:
|:004267D9   
|
:004267E5 55                      push ebp
:004267E6 8BEC                    mov ebp, esp
:004267E8 B900114A00              mov ecx, 004A1100
:004267ED E88E420000              call 0042AA80
:004267F2 5D                      pop ebp
:004267F3 C3                      ret



* Referenced by a CALL at Address:
|:004267DE   
|
:004267F4 55                      push ebp
:004267F5 8BEC                    mov ebp, esp
:004267F7 6806684200              push 00426806
:004267FC E8FFA80500              call 00481100
:00426801 83C404                  add esp, 00000004
:00426804 5D                      pop ebp
:00426805 C3                      ret


:00426806 55                      push ebp
:00426807 8BEC                    mov ebp, esp
:00426809 B900114A00              mov ecx, 004A1100
:0042680E E8BD4C0000              call 0042B4D0
:00426813 5D                      pop ebp
:00426814 C3                      ret


:00426815 55                      push ebp
:00426816 8BEC                    mov ebp, esp
:00426818 E807000000              call 00426824
:0042681D E822000000              call 00426844
:00426822 5D                      pop ebp
:00426823 C3                      ret



* Referenced by a CALL at Address:
|:00426818   
|
:00426824 55                      push ebp
:00426825 8BEC                    mov ebp, esp
:00426827 6810B54200              push 0042B510
:0042682C 68F0AA4200              push 0042AAF0
:00426831 6881000000              push 00000081
:00426836 6A40                    push 00000040
:00426838 6868CF4900              push 0049CF68
:0042683D E8FEAB0500              call 00481440
:00426842 5D                      pop ebp
:00426843 C3                      ret



* Referenced by a CALL at Address:
|:0042681D   
|
:00426844 55                      push ebp
:00426845 8BEC                    mov ebp, esp
:00426847 6856684200              push 00426856
:0042684C E8AFA80500              call 00481100
:00426851 83C404                  add esp, 00000004
:00426854 5D                      pop ebp
:00426855 C3                      ret


:00426856 55                      push ebp
:00426857 8BEC                    mov ebp, esp
:00426859 6810B54200              push 0042B510
:0042685E 6881000000              push 00000081
:00426863 6A40                    push 00000040
:00426865 6868CF4900              push 0049CF68
:0042686A E871AC0500              call 004814E0
:0042686F 5D                      pop ebp
:00426870 C3                      ret



* Referenced by a CALL at Addresses:
|:0042A4BE   , :0042AB78   
|
:00426871 55                      push ebp
:00426872 8BEC                    mov ebp, esp
:00426874 8B4508                  mov eax, dword ptr [ebp+08]
:00426877 25FFFF0000              and eax, 0000FFFF
:0042687C 6BC009                  imul eax, 00000009
:0042687F 0520B94800              add eax, 0048B920
:00426884 5D                      pop ebp
:00426885 C3                      ret



* Referenced by a CALL at Addresses:
|:00428C71   , :00428F94   
|
:00426886 55                      push ebp
:00426887 8BEC                    mov ebp, esp
:00426889 837D0800                cmp dword ptr [ebp+08], 00000000
:0042688D 7507                    jne 00426896
:0042688F B801000000              mov eax, 00000001
:00426894 EB02                    jmp 00426898

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042688D(C)
|
:00426896 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426894(U)
|
:00426898 5D                      pop ebp
:00426899 C3                      ret



* Referenced by a CALL at Addresses:
|:00428C81   , :00428D9A   
|
:0042689A 55                      push ebp
:0042689B 8BEC                    mov ebp, esp
:0042689D 8B4508                  mov eax, dword ptr [ebp+08]
:004268A0 2D68CF4900              sub eax, 0049CF68
:004268A5 C1F806                  sar eax, 06
:004268A8 5D                      pop ebp
:004268A9 C3                      ret



* Referenced by a CALL at Addresses:
|:00429E32   , :0042A1CA   
|
:004268AA 55                      push ebp
:004268AB 8BEC                    mov ebp, esp
:004268AD 8B4508                  mov eax, dword ptr [ebp+08]
:004268B0 25FFFF0000              and eax, 0000FFFF
:004268B5 2500F00000              and eax, 0000F000
:004268BA 5D                      pop ebp
:004268BB C3                      ret



* Referenced by a CALL at Addresses:
|:00428C63   , :00428F86   , :00429AAE   
|
:004268BC 55                      push ebp
:004268BD 8BEC                    mov ebp, esp
:004268BF 8B4508                  mov eax, dword ptr [ebp+08]
:004268C2 25FFFF0000              and eax, 0000FFFF
:004268C7 80E40F                  and ah, 0F
:004268CA 5D                      pop ebp
:004268CB C3                      ret



* Referenced by a CALL at Address:
|:00428EF3   
|
:004268CC 55                      push ebp
:004268CD 8BEC                    mov ebp, esp
:004268CF 83EC08                  sub esp, 00000008
:004268D2 8B4508                  mov eax, dword ptr [ebp+08]
:004268D5 25FFFF0000              and eax, 0000FFFF
:004268DA 2500F00000              and eax, 0000F000
:004268DF 668945F8                mov word ptr [ebp-08], ax
:004268E3 668B4D08                mov cx, word ptr [ebp+08]
:004268E7 6681E1FF0F              and cx, 0FFF
:004268EC 66894D08                mov word ptr [ebp+08], cx
:004268F0 C745FC00114A00          mov [ebp-04], 004A1100
:004268F7 8B55F8                  mov edx, dword ptr [ebp-08]
:004268FA 81E2FFFF0000            and edx, 0000FFFF
:00426900 81FA00100000            cmp edx, 00001000
:00426906 7514                    jne 0042691C
:00426908 8B4508                  mov eax, dword ptr [ebp+08]
:0042690B 25FFFF0000              and eax, 0000FFFF
:00426910 50                      push eax
:00426911 E84A55FEFF              call 0040BE60
:00426916 83C404                  add esp, 00000004
:00426919 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426906(C)
|
:0042691C 8B45FC                  mov eax, dword ptr [ebp-04]
:0042691F 8BE5                    mov esp, ebp
:00426921 5D                      pop ebp
:00426922 C3                      ret



* Referenced by a CALL at Address:
|:00429F0D   
|
:00426923 55                      push ebp
:00426924 8BEC                    mov ebp, esp
:00426926 51                      push ecx
:00426927 8B4508                  mov eax, dword ptr [ebp+08]
:0042692A 25FFFF0000              and eax, 0000FFFF
:0042692F 2500F00000              and eax, 0000F000
:00426934 668945FC                mov word ptr [ebp-04], ax
:00426938 668B4D08                mov cx, word ptr [ebp+08]
:0042693C 6681E1FF0F              and cx, 0FFF
:00426941 66894D08                mov word ptr [ebp+08], cx
:00426945 8B55FC                  mov edx, dword ptr [ebp-04]
:00426948 81E2FFFF0000            and edx, 0000FFFF
:0042694E 81FA00100000            cmp edx, 00001000
:00426954 751A                    jne 00426970
:00426956 8B4508                  mov eax, dword ptr [ebp+08]
:00426959 25FFFF0000              and eax, 0000FFFF
:0042695E 50                      push eax
:0042695F E8FC54FEFF              call 0040BE60
:00426964 83C404                  add esp, 00000004
:00426967 8BC8                    mov ecx, eax
:00426969 E8E90DFEFF              call 00407757
:0042696E EB0A                    jmp 0042697A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426954(C)
|
:00426970 B900114A00              mov ecx, 004A1100
:00426975 E856410000              call 0042AAD0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042696E(U)
|
:0042697A 8BE5                    mov esp, ebp
:0042697C 5D                      pop ebp
:0042697D C3                      ret


:0042697E 55                      push ebp
:0042697F 8BEC                    mov ebp, esp
:00426981 8B450C                  mov eax, dword ptr [ebp+0C]
:00426984 33D2                    xor edx, edx
:00426986 F77508                  div [ebp+08]
:00426989 85D2                    test edx, edx
:0042698B 7413                    je 004269A0
:0042698D 8B450C                  mov eax, dword ptr [ebp+0C]
:00426990 33D2                    xor edx, edx
:00426992 F77508                  div [ebp+08]
:00426995 8B450C                  mov eax, dword ptr [ebp+0C]
:00426998 2BC2                    sub eax, edx
:0042699A 034508                  add eax, dword ptr [ebp+08]
:0042699D 89450C                  mov dword ptr [ebp+0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042698B(C)
|
:004269A0 8B450C                  mov eax, dword ptr [ebp+0C]
:004269A3 5D                      pop ebp
:004269A4 C3                      ret


:004269A5 55                      push ebp
:004269A6 8BEC                    mov ebp, esp
:004269A8 56                      push esi
:004269A9 8B450C                  mov eax, dword ptr [ebp+0C]
:004269AC 25FFFF0000              and eax, 0000FFFF
:004269B1 8B4D08                  mov ecx, dword ptr [ebp+08]
:004269B4 81E1FFFF0000            and ecx, 0000FFFF
:004269BA 99                      cdq
:004269BB F7F9                    idiv ecx
:004269BD 85D2                    test edx, edx
:004269BF 742E                    je 004269EF
:004269C1 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004269C4 81E1FFFF0000            and ecx, 0000FFFF
:004269CA 8B450C                  mov eax, dword ptr [ebp+0C]
:004269CD 25FFFF0000              and eax, 0000FFFF
:004269D2 8B7508                  mov esi, dword ptr [ebp+08]
:004269D5 81E6FFFF0000            and esi, 0000FFFF
:004269DB 99                      cdq
:004269DC F7FE                    idiv esi
:004269DE 2BCA                    sub ecx, edx
:004269E0 8B5508                  mov edx, dword ptr [ebp+08]
:004269E3 81E2FFFF0000            and edx, 0000FFFF
:004269E9 03CA                    add ecx, edx
:004269EB 66894D0C                mov word ptr [ebp+0C], cx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004269BF(C)
|
:004269EF 668B450C                mov ax, word ptr [ebp+0C]
:004269F3 5E                      pop esi
:004269F4 5D                      pop ebp
:004269F5 C3                      ret


:004269F6 55                      push ebp
:004269F7 8BEC                    mov ebp, esp
:004269F9 56                      push esi
:004269FA 8B450C                  mov eax, dword ptr [ebp+0C]
:004269FD 25FFFF0000              and eax, 0000FFFF
:00426A02 8B4D08                  mov ecx, dword ptr [ebp+08]
:00426A05 81E1FFFF0000            and ecx, 0000FFFF
:00426A0B 99                      cdq
:00426A0C F7F9                    idiv ecx
:00426A0E 85D2                    test edx, edx
:00426A10 7423                    je 00426A35
:00426A12 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00426A15 81E1FFFF0000            and ecx, 0000FFFF
:00426A1B 8B450C                  mov eax, dword ptr [ebp+0C]
:00426A1E 25FFFF0000              and eax, 0000FFFF
:00426A23 8B7508                  mov esi, dword ptr [ebp+08]
:00426A26 81E6FFFF0000            and esi, 0000FFFF
:00426A2C 99                      cdq
:00426A2D F7FE                    idiv esi
:00426A2F 2BCA                    sub ecx, edx
:00426A31 66894D0C                mov word ptr [ebp+0C], cx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426A10(C)
|
:00426A35 668B450C                mov ax, word ptr [ebp+0C]
:00426A39 5E                      pop esi
:00426A3A 5D                      pop ebp
:00426A3B C3                      ret



* Referenced by a CALL at Addresses:
|:00426C41   , :00426C52   , :004273BD   , :004297DC   
|
:00426A3C 55                      push ebp
:00426A3D 8BEC                    mov ebp, esp
:00426A3F 51                      push ecx
:00426A40 C745FC00000000          mov [ebp-04], 00000000
:00426A47 EB09                    jmp 00426A52

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426A6B(U)
|
:00426A49 8B45FC                  mov eax, dword ptr [ebp-04]
:00426A4C 83C001                  add eax, 00000001
:00426A4F 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426A47(U)
|
:00426A52 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00426A55 3B4D0C                  cmp ecx, dword ptr [ebp+0C]
:00426A58 7313                    jnb 00426A6D
:00426A5A 8B5508                  mov edx, dword ptr [ebp+08]
:00426A5D 8A4510                  mov al, byte ptr [ebp+10]
:00426A60 8802                    mov byte ptr [edx], al
:00426A62 8B4D08                  mov ecx, dword ptr [ebp+08]
:00426A65 83C101                  add ecx, 00000001
:00426A68 894D08                  mov dword ptr [ebp+08], ecx
:00426A6B EBDC                    jmp 00426A49

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426A58(C)
|
:00426A6D 8BE5                    mov esp, ebp
:00426A6F 5D                      pop ebp
:00426A70 C3                      ret



* Referenced by a CALL at Addresses:
|:00429294   , :00429820   
|
:00426A71 55                      push ebp
:00426A72 8BEC                    mov ebp, esp
:00426A74 51                      push ecx
:00426A75 C745FC00000000          mov [ebp-04], 00000000
:00426A7C EB09                    jmp 00426A87

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426AA2(U)
|
:00426A7E 8B45FC                  mov eax, dword ptr [ebp-04]
:00426A81 83C001                  add eax, 00000001
:00426A84 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426A7C(U)
|
:00426A87 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00426A8A 3B4D0C                  cmp ecx, dword ptr [ebp+0C]
:00426A8D 7315                    jnb 00426AA4
:00426A8F 8B5508                  mov edx, dword ptr [ebp+08]
:00426A92 668B4510                mov ax, word ptr [ebp+10]
:00426A96 668902                  mov word ptr [edx], ax
:00426A99 8B4D08                  mov ecx, dword ptr [ebp+08]
:00426A9C 83C102                  add ecx, 00000002
:00426A9F 894D08                  mov dword ptr [ebp+08], ecx
:00426AA2 EBDA                    jmp 00426A7E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426A8D(C)
|
:00426AA4 8BE5                    mov esp, ebp
:00426AA6 5D                      pop ebp
:00426AA7 C3                      ret



* Referenced by a CALL at Addresses:
|:00426AE7   , :00426DCC   , :00426E3C   , :004274BF   , :00428A33   
|:00428A9F   , :00428B56   , :00428BB4   , :00428F48   , :0042912F   
|:004291A3   , :004299CE   , :00429A40   , :00429A68   , :00429C41   
|:00429C9D   , :0042A0E2   , :0042A14A   , :0042A24F   , :00460945   
|
:00426AA8 55                      push ebp
:00426AA9 8BEC                    mov ebp, esp
:00426AAB 8B4508                  mov eax, dword ptr [ebp+08]
:00426AAE 25FFFF0000              and eax, 0000FFFF
:00426AB3 C1E006                  shl eax, 06
:00426AB6 0568CF4900              add eax, 0049CF68
:00426ABB 5D                      pop ebp
:00426ABC C3                      ret



* Referenced by a CALL at Addresses:
|:00426B0A   , :00429022   , :00429A5C   
|
:00426ABD 55                      push ebp
:00426ABE 8BEC                    mov ebp, esp
:00426AC0 51                      push ecx
:00426AC1 66A1E4CE4900            mov ax, word ptr [0049CEE4]
:00426AC7 668945FC                mov word ptr [ebp-04], ax
:00426ACB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00426ACE 81E1FFFF0000            and ecx, 0000FFFF
:00426AD4 81F9FFFF0000            cmp ecx, 0000FFFF
:00426ADA 7506                    jne 00426AE2
:00426ADC 66C745FC8000            mov [ebp-04], 0080

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426ADA(C)
|
:00426AE2 668B55FC                mov dx, word ptr [ebp-04]
:00426AE6 52                      push edx
:00426AE7 E8BCFFFFFF              call 00426AA8
:00426AEC 83C404                  add esp, 00000004
:00426AEF 8BE5                    mov esp, ebp
:00426AF1 5D                      pop ebp
:00426AF2 C3                      ret



* Referenced by a CALL at Address:
|:00419749   
|
:00426AF3 55                      push ebp
:00426AF4 8BEC                    mov ebp, esp
:00426AF6 51                      push ecx
:00426AF7 33C0                    xor eax, eax
:00426AF9 66A1E4CE4900            mov ax, word ptr [0049CEE4]
:00426AFF 3DFFFF0000              cmp eax, 0000FFFF
:00426B04 7504                    jne 00426B0A
:00426B06 33C0                    xor eax, eax
:00426B08 EB27                    jmp 00426B31

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426B04(C)
|
:00426B0A E8AEFFFFFF              call 00426ABD
:00426B0F 8945FC                  mov dword ptr [ebp-04], eax
:00426B12 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00426B15 E83623FFFF              call 00418E50
:00426B1A 25FFFF0000              and eax, 0000FFFF
:00426B1F 2500800000              and eax, 00008000
:00426B24 85C0                    test eax, eax
:00426B26 7504                    jne 00426B2C
:00426B28 33C0                    xor eax, eax
:00426B2A EB05                    jmp 00426B31

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426B26(C)
|
:00426B2C B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00426B08(U), :00426B2A(U)
|
:00426B31 8BE5                    mov esp, ebp
:00426B33 5D                      pop ebp
:00426B34 C3                      ret



* Referenced by a CALL at Addresses:
|:00426BAC   , :00429C04   
|
:00426B35 55                      push ebp
:00426B36 8BEC                    mov ebp, esp
:00426B38 6800040000              push 00000400
:00426B3D 6A01                    push 00000001
:00426B3F A1686A4B00              mov eax, dword ptr [004B6A68]
:00426B44 50                      push eax
:00426B45 FF1558624800            call dword ptr [00486258]
:00426B4B 50                      push eax
:00426B4C FF155C624800            call dword ptr [0048625C]
:00426B52 83E001                  and eax, 00000001
:00426B55 85C0                    test eax, eax
:00426B57 740A                    je 00426B63
:00426B59 837D0800                cmp dword ptr [ebp+08], 00000000
:00426B5D 7502                    jne 00426B61
:00426B5F EB40                    jmp 00426BA1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426B5D(C)
|
:00426B61 EB08                    jmp 00426B6B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426B57(C)
|
:00426B63 837D0801                cmp dword ptr [ebp+08], 00000001
:00426B67 7502                    jne 00426B6B
:00426B69 EB36                    jmp 00426BA1

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00426B61(U), :00426B67(C)
|
:00426B6B 8B4D08                  mov ecx, dword ptr [ebp+08]
:00426B6E 51                      push ecx
:00426B6F E848EE0400              call 004759BC
:00426B74 83C404                  add esp, 00000004
:00426B77 B9386F4900              mov ecx, 00496F38
:00426B7C E82335FFFF              call 0041A0A4
:00426B81 85C0                    test eax, eax
:00426B83 751C                    jne 00426BA1
:00426B85 837D0800                cmp dword ptr [ebp+08], 00000000
:00426B89 740C                    je 00426B97
:00426B8B B9386F4900              mov ecx, 00496F38
:00426B90 E85E35FFFF              call 0041A0F3
:00426B95 EB0A                    jmp 00426BA1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426B89(C)
|
:00426B97 B9386F4900              mov ecx, 00496F38
:00426B9C E81F35FFFF              call 0041A0C0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00426B5F(U), :00426B69(U), :00426B83(C), :00426B95(U)
|
:00426BA1 5D                      pop ebp
:00426BA2 C3                      ret



* Referenced by a CALL at Addresses:
|:004297A1   , :0042990C   , :00429A0F   , :00429AE5   
|
:00426BA3 55                      push ebp
:00426BA4 8BEC                    mov ebp, esp
:00426BA6 E8E25C0000              call 0042C88D
:00426BAB 50                      push eax
:00426BAC E884FFFFFF              call 00426B35
:00426BB1 83C404                  add esp, 00000004
:00426BB4 5D                      pop ebp
:00426BB5 C3                      ret



* Referenced by a CALL at Addresses:
|:004270E3   , :00427103   , :00427123   , :00427143   , :00427155   
|:00427173   , :00427334   , :004273E4   , :00427418   , :0042744C   
|:00428262   , :00428289   , :004282A8   , :004282C7   , :0042838F   
|:004292B9   
|
:00426BB6 55                      push ebp
:00426BB7 8BEC                    mov ebp, esp
:00426BB9 6A04                    push 00000004
:00426BBB 6A00                    push 00000000
:00426BBD 8B4508                  mov eax, dword ptr [ebp+08]
:00426BC0 25FFFF0000              and eax, 0000FFFF
:00426BC5 50                      push eax
:00426BC6 B938EB4A00              mov ecx, 004AEB38
:00426BCB E8708E0500              call 0047FA40
:00426BD0 668B00                  mov ax, word ptr [eax]
:00426BD3 5D                      pop ebp
:00426BD4 C3                      ret



* Referenced by a CALL at Addresses:
|:00413655   , :00415CA3   , :00426C5A   
|
:00426BD5 55                      push ebp
:00426BD6 8BEC                    mov ebp, esp
:00426BD8 83EC08                  sub esp, 00000008
:00426BDB C745FC68CF4900          mov [ebp-04], 0049CF68
:00426BE2 66C745F80000            mov [ebp-08], 0000
:00426BE8 EB15                    jmp 00426BFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426C2C(U)
|
:00426BEA 668B45F8                mov ax, word ptr [ebp-08]
:00426BEE 66050100                add ax, 0001
:00426BF2 668945F8                mov word ptr [ebp-08], ax
:00426BF6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00426BF9 83C140                  add ecx, 00000040
:00426BFC 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426BE8(U)
|
:00426BFF 8B55F8                  mov edx, dword ptr [ebp-08]
:00426C02 81E2FFFF0000            and edx, 0000FFFF
:00426C08 81FA80000000            cmp edx, 00000080
:00426C0E 7D1E                    jge 00426C2E
:00426C10 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00426C13 E8D83F0000              call 0042ABF0
:00426C18 6A00                    push 00000000
:00426C1A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00426C1D E82E430000              call 0042AF50
:00426C22 6A00                    push 00000000
:00426C24 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00426C27 E874BC0400              call 004728A0
:00426C2C EBBC                    jmp 00426BEA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426C0E(C)
|
:00426C2E 8BE5                    mov esp, ebp
:00426C30 5D                      pop ebp
:00426C31 C3                      ret



* Referenced by a CALL at Addresses:
|:00412261   , :0041AEA7   , :0041C041   , :00479C3E   
|
:00426C32 55                      push ebp
:00426C33 8BEC                    mov ebp, esp
:00426C35 68FF000000              push 000000FF
:00426C3A 6A0F                    push 0000000F
:00426C3C 68B0EF4900              push 0049EFB0
:00426C41 E8F6FDFFFF              call 00426A3C
:00426C46 83C40C                  add esp, 0000000C
:00426C49 6A00                    push 00000000
:00426C4B 6A0F                    push 0000000F
:00426C4D 6860804900              push 00498060
:00426C52 E8E5FDFFFF              call 00426A3C
:00426C57 83C40C                  add esp, 0000000C
:00426C5A E876FFFFFF              call 00426BD5
:00426C5F 66C705E4CE4900FFFF      mov word ptr [0049CEE4], FFFF
:00426C68 5D                      pop ebp
:00426C69 C3                      ret



* Referenced by a CALL at Address:
|:00426EAA   
|
:00426C6A 55                      push ebp
:00426C6B 8BEC                    mov ebp, esp
:00426C6D 6AFF                    push FFFFFFFF
:00426C6F 68BC524800              push 004852BC
:00426C74 64A100000000            mov eax, dword ptr fs:[00000000]
:00426C7A 50                      push eax
:00426C7B 64892500000000          mov dword ptr fs:[00000000], esp
:00426C82 81EC10010000            sub esp, 00000110
:00426C88 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:00426C8E E81DC6FDFF              call 004032B0
:00426C93 C745FC00000000          mov [ebp-04], 00000000
:00426C9A 8B4508                  mov eax, dword ptr [ebp+08]
:00426C9D 25FFFF0000              and eax, 0000FFFF
:00426CA2 D1E0                    shl eax, 1
:00426CA4 668985ECFEFFFF          mov word ptr [ebp+FFFFFEEC], ax
:00426CAB C705ECBA4800FFFF0000    mov dword ptr [0048BAEC], 0000FFFF
:00426CB5 6A04                    push 00000004
:00426CB7 6A00                    push 00000000
:00426CB9 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00426CBC 81E1FFFF0000            and ecx, 0000FFFF
:00426CC2 6BC914                  imul ecx, 00000014
:00426CC5 6BC930                  imul ecx, 00000030
:00426CC8 C1E106                  shl ecx, 06
:00426CCB D1E1                    shl ecx, 1
:00426CCD D1E1                    shl ecx, 1
:00426CCF 51                      push ecx
:00426CD0 B9A8E44A00              mov ecx, 004AE4A8
:00426CD5 E8668D0500              call 0047FA40
:00426CDA 8985E8FEFFFF            mov dword ptr [ebp+FFFFFEE8], eax
:00426CE0 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:00426CE6 81C200E00100            add edx, 0001E000
:00426CEC 8995E4FEFFFF            mov dword ptr [ebp+FFFFFEE4], edx

* Possible StringData Ref from Data Obj ->"PMAPOBJ.E5"
                                  |
:00426CF2 6870BB4800              push 0048BB70
:00426CF7 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:00426CFD E8338EFFFF              call 0041FB35
:00426D02 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:00426D08 50                      push eax
:00426D09 8B8DECFEFFFF            mov ecx, dword ptr [ebp+FFFFFEEC]
:00426D0F 81E1FFFF0000            and ecx, 0000FFFF
:00426D15 51                      push ecx
:00426D16 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:00426D1C E8688FFFFF              call 0041FC89
:00426D21 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:00426D27 52                      push edx
:00426D28 8B85ECFEFFFF            mov eax, dword ptr [ebp+FFFFFEEC]
:00426D2E 25FFFF0000              and eax, 0000FFFF
:00426D33 83C001                  add eax, 00000001
:00426D36 50                      push eax
:00426D37 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:00426D3D E8478FFFFF              call 0041FC89
:00426D42 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:00426D48 E87825FFFF              call 004192C5
:00426D4D 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:00426D53 81C100F00000            add ecx, 0000F000
:00426D59 51                      push ecx
:00426D5A 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:00426D60 52                      push edx
:00426D61 6800050000              push 00000500
:00426D66 6A30                    push 00000030
:00426D68 E8E680FFFF              call 0041EE53
:00426D6D 83C410                  add esp, 00000010
:00426D70 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:00426D76 0500F00000              add eax, 0000F000
:00426D7B 50                      push eax
:00426D7C 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:00426D82 51                      push ecx
:00426D83 6800050000              push 00000500
:00426D88 6A30                    push 00000030
:00426D8A E8C480FFFF              call 0041EE53
:00426D8F 83C410                  add esp, 00000010
:00426D92 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00426D99 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:00426D9F E82CC5FDFF              call 004032D0
:00426DA4 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00426DA7 64890D00000000          mov dword ptr fs:[00000000], ecx
:00426DAE 8BE5                    mov esp, ebp
:00426DB0 5D                      pop ebp
:00426DB1 C3                      ret



* Referenced by a CALL at Addresses:
|:004274AF   , :00428F38   
|
:00426DB2 55                      push ebp
:00426DB3 8BEC                    mov ebp, esp
:00426DB5 83EC10                  sub esp, 00000010
:00426DB8 8B450C                  mov eax, dword ptr [ebp+0C]
:00426DBB 25FFFF0000              and eax, 0000FFFF
:00426DC0 3DCE000000              cmp eax, 000000CE
:00426DC5 7C12                    jl 00426DD9
:00426DC7 6880000000              push 00000080
:00426DCC E8D7FCFFFF              call 00426AA8
:00426DD1 83C404                  add esp, 00000004
:00426DD4 E921010000              jmp 00426EFA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426DC5(C)
|
:00426DD9 C745F868CF4900          mov [ebp-08], 0049CF68
:00426DE0 66C745F00000            mov [ebp-10], 0000
:00426DE6 EB15                    jmp 00426DFD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426E24(U)
|
:00426DE8 668B4DF0                mov cx, word ptr [ebp-10]
:00426DEC 6683C101                add cx, 0001
:00426DF0 66894DF0                mov word ptr [ebp-10], cx
:00426DF4 8B55F8                  mov edx, dword ptr [ebp-08]
:00426DF7 83C240                  add edx, 00000040
:00426DFA 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426DE6(U)
|
:00426DFD 8B45F0                  mov eax, dword ptr [ebp-10]
:00426E00 25FFFF0000              and eax, 0000FFFF
:00426E05 3D80000000              cmp eax, 00000080
:00426E0A 7D1A                    jge 00426E26
:00426E0C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00426E0F E83C20FFFF              call 00418E50
:00426E14 25FFFF0000              and eax, 0000FFFF
:00426E19 2500800000              and eax, 00008000
:00426E1E 85C0                    test eax, eax
:00426E20 7502                    jne 00426E24
:00426E22 EB02                    jmp 00426E26

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426E20(C)
|
:00426E24 EBC2                    jmp 00426DE8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00426E0A(C), :00426E22(U)
|
:00426E26 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00426E29 81E1FFFF0000            and ecx, 0000FFFF
:00426E2F 81F980000000            cmp ecx, 00000080
:00426E35 7512                    jne 00426E49
:00426E37 6880000000              push 00000080
:00426E3C E867FCFFFF              call 00426AA8
:00426E41 83C404                  add esp, 00000004
:00426E44 E9B1000000              jmp 00426EFA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426E35(C)
|
:00426E49 668B5508                mov dx, word ptr [ebp+08]
:00426E4D 52                      push edx
:00426E4E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00426E51 E81A3E0000              call 0042AC70
:00426E56 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00426E59 E8923D0000              call 0042ABF0
:00426E5E 6800800000              push 00008000
:00426E63 6800800000              push 00008000
:00426E68 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00426E6B E8A03F0000              call 0042AE10
:00426E70 668B450C                mov ax, word ptr [ebp+0C]
:00426E74 50                      push eax
:00426E75 E884000000              call 00426EFE
:00426E7A 83C404                  add esp, 00000004
:00426E7D 668945F4                mov word ptr [ebp-0C], ax
:00426E81 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00426E84 81E1FFFF0000            and ecx, 0000FFFF
:00426E8A 83F90F                  cmp ecx, 0000000F
:00426E8D 7523                    jne 00426EB2
:00426E8F 668B550C                mov dx, word ptr [ebp+0C]
:00426E93 52                      push edx
:00426E94 E858010000              call 00426FF1
:00426E99 83C404                  add esp, 00000004
:00426E9C 668945F4                mov word ptr [ebp-0C], ax
:00426EA0 668B45F4                mov ax, word ptr [ebp-0C]
:00426EA4 50                      push eax
:00426EA5 668B4D0C                mov cx, word ptr [ebp+0C]
:00426EA9 51                      push ecx
:00426EAA E8BBFDFFFF              call 00426C6A
:00426EAF 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426E8D(C)
|
:00426EB2 8B55F4                  mov edx, dword ptr [ebp-0C]
:00426EB5 81E2FFFF0000            and edx, 0000FFFF
:00426EBB 52                      push edx
:00426EBC E891000000              call 00426F52
:00426EC1 83C404                  add esp, 00000004
:00426EC4 6A04                    push 00000004
:00426EC6 6A00                    push 00000000
:00426EC8 8B45F4                  mov eax, dword ptr [ebp-0C]
:00426ECB 25FFFF0000              and eax, 0000FFFF
:00426ED0 6BC014                  imul eax, 00000014
:00426ED3 6BC030                  imul eax, 00000030
:00426ED6 C1E006                  shl eax, 06
:00426ED9 D1E0                    shl eax, 1
:00426EDB D1E0                    shl eax, 1
:00426EDD 50                      push eax
:00426EDE B9A8E44A00              mov ecx, 004AE4A8
:00426EE3 E8588B0500              call 0047FA40
:00426EE8 8945FC                  mov dword ptr [ebp-04], eax
:00426EEB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00426EEE 51                      push ecx
:00426EEF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00426EF2 E8A9B90400              call 004728A0
:00426EF7 8B45F8                  mov eax, dword ptr [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00426DD4(U), :00426E44(U)
|
:00426EFA 8BE5                    mov esp, ebp
:00426EFC 5D                      pop ebp
:00426EFD C3                      ret



* Referenced by a CALL at Addresses:
|:00426E75   , :00427036   
|
:00426EFE 55                      push ebp
:00426EFF 8BEC                    mov ebp, esp
:00426F01 51                      push ecx
:00426F02 66C745FC0000            mov [ebp-04], 0000
:00426F08 EB0C                    jmp 00426F16

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426F48(U)
|
:00426F0A 668B45FC                mov ax, word ptr [ebp-04]
:00426F0E 66050100                add ax, 0001
:00426F12 668945FC                mov word ptr [ebp-04], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426F08(U)
|
:00426F16 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00426F19 81E1FFFF0000            and ecx, 0000FFFF
:00426F1F 83F90F                  cmp ecx, 0000000F
:00426F22 7D26                    jge 00426F4A
:00426F24 8B55FC                  mov edx, dword ptr [ebp-04]
:00426F27 81E2FFFF0000            and edx, 0000FFFF
:00426F2D 33C0                    xor eax, eax
:00426F2F 8A82B0EF4900            mov al, byte ptr [edx+0049EFB0]
:00426F35 8B4D08                  mov ecx, dword ptr [ebp+08]
:00426F38 81E1FFFF0000            and ecx, 0000FFFF
:00426F3E 3BC1                    cmp eax, ecx
:00426F40 7506                    jne 00426F48
:00426F42 668B45FC                mov ax, word ptr [ebp-04]
:00426F46 EB06                    jmp 00426F4E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426F40(C)
|
:00426F48 EBC0                    jmp 00426F0A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426F22(C)
|
:00426F4A 668B45FC                mov ax, word ptr [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426F46(U)
|
:00426F4E 8BE5                    mov esp, ebp
:00426F50 5D                      pop ebp
:00426F51 C3                      ret



* Referenced by a CALL at Address:
|:00426EBC   
|
:00426F52 55                      push ebp
:00426F53 8BEC                    mov ebp, esp
:00426F55 51                      push ecx
:00426F56 66C745FC0000            mov [ebp-04], 0000
:00426F5C EB0C                    jmp 00426F6A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426FE8(U)
|
:00426F5E 668B45FC                mov ax, word ptr [ebp-04]
:00426F62 66050100                add ax, 0001
:00426F66 668945FC                mov word ptr [ebp-04], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426F5C(U)
|
:00426F6A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00426F6D 81E1FFFF0000            and ecx, 0000FFFF
:00426F73 83F90F                  cmp ecx, 0000000F
:00426F76 7D75                    jge 00426FED
:00426F78 8B55FC                  mov edx, dword ptr [ebp-04]
:00426F7B 81E2FFFF0000            and edx, 0000FFFF
:00426F81 3B5508                  cmp edx, dword ptr [ebp+08]
:00426F84 7511                    jne 00426F97
:00426F86 8B45FC                  mov eax, dword ptr [ebp-04]
:00426F89 25FFFF0000              and eax, 0000FFFF
:00426F8E C6806080490000          mov byte ptr [eax+00498060], 00
:00426F95 EB51                    jmp 00426FE8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426F84(C)
|
:00426F97 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00426F9A 81E1FFFF0000            and ecx, 0000FFFF
:00426FA0 33D2                    xor edx, edx
:00426FA2 8A91B0EF4900            mov dl, byte ptr [ecx+0049EFB0]
:00426FA8 81FAFF000000            cmp edx, 000000FF
:00426FAE 7438                    je 00426FE8
:00426FB0 8B45FC                  mov eax, dword ptr [ebp-04]
:00426FB3 25FFFF0000              and eax, 0000FFFF
:00426FB8 33C9                    xor ecx, ecx
:00426FBA 8A8860804900            mov cl, byte ptr [eax+00498060]
:00426FC0 81F9FF000000            cmp ecx, 000000FF
:00426FC6 7420                    je 00426FE8
:00426FC8 8B55FC                  mov edx, dword ptr [ebp-04]
:00426FCB 81E2FFFF0000            and edx, 0000FFFF
:00426FD1 8A8260804900            mov al, byte ptr [edx+00498060]
:00426FD7 0401                    add al, 01
:00426FD9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00426FDC 81E1FFFF0000            and ecx, 0000FFFF
:00426FE2 888160804900            mov byte ptr [ecx+00498060], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00426F95(U), :00426FAE(C), :00426FC6(C)
|
:00426FE8 E971FFFFFF              jmp 00426F5E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00426F76(C)
|
:00426FED 8BE5                    mov esp, ebp
:00426FEF 5D                      pop ebp
:00426FF0 C3                      ret



* Referenced by a CALL at Address:
|:00426E94   
|
:00426FF1 55                      push ebp
:00426FF2 8BEC                    mov ebp, esp
:00426FF4 51                      push ecx
:00426FF5 E834000000              call 0042702E
:00426FFA 668945FC                mov word ptr [ebp-04], ax
:00426FFE 8B45FC                  mov eax, dword ptr [ebp-04]
:00427001 25FFFF0000              and eax, 0000FFFF
:00427006 83F80F                  cmp eax, 0000000F
:00427009 7509                    jne 00427014
:0042700B E830000000              call 00427040
:00427010 668945FC                mov word ptr [ebp-04], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427009(C)
|
:00427014 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00427017 81E1FFFF0000            and ecx, 0000FFFF
:0042701D 8A5508                  mov dl, byte ptr [ebp+08]
:00427020 8891B0EF4900            mov byte ptr [ecx+0049EFB0], dl
:00427026 668B45FC                mov ax, word ptr [ebp-04]
:0042702A 8BE5                    mov esp, ebp
:0042702C 5D                      pop ebp
:0042702D C3                      ret



* Referenced by a CALL at Address:
|:00426FF5   
|
:0042702E 55                      push ebp
:0042702F 8BEC                    mov ebp, esp
:00427031 68FF000000              push 000000FF
:00427036 E8C3FEFFFF              call 00426EFE
:0042703B 83C404                  add esp, 00000004
:0042703E 5D                      pop ebp
:0042703F C3                      ret



* Referenced by a CALL at Address:
|:0042700B   
|
:00427040 55                      push ebp
:00427041 8BEC                    mov ebp, esp
:00427043 83EC0C                  sub esp, 0000000C
:00427046 66C745F40000            mov [ebp-0C], 0000
:0042704C 668B45F4                mov ax, word ptr [ebp-0C]
:00427050 668945FC                mov word ptr [ebp-04], ax
:00427054 66C745F80000            mov [ebp-08], 0000
:0042705A EB0C                    jmp 00427068

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004270C9(U)
|
:0042705C 668B4DF8                mov cx, word ptr [ebp-08]
:00427060 6683C101                add cx, 0001
:00427064 66894DF8                mov word ptr [ebp-08], cx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042705A(U)
|
:00427068 8B55F8                  mov edx, dword ptr [ebp-08]
:0042706B 81E2FFFF0000            and edx, 0000FFFF
:00427071 83FA0F                  cmp edx, 0000000F
:00427074 7D55                    jge 004270CB
:00427076 8B45F8                  mov eax, dword ptr [ebp-08]
:00427079 25FFFF0000              and eax, 0000FFFF
:0042707E 33C9                    xor ecx, ecx
:00427080 8A88B0EF4900            mov cl, byte ptr [eax+0049EFB0]
:00427086 81F9FF000000            cmp ecx, 000000FF
:0042708C 743B                    je 004270C9
:0042708E 8B55F8                  mov edx, dword ptr [ebp-08]
:00427091 81E2FFFF0000            and edx, 0000FFFF
:00427097 33C0                    xor eax, eax
:00427099 8A8260804900            mov al, byte ptr [edx+00498060]
:0042709F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004270A2 81E1FFFF0000            and ecx, 0000FFFF
:004270A8 3BC1                    cmp eax, ecx
:004270AA 7E1D                    jle 004270C9
:004270AC 8B55F8                  mov edx, dword ptr [ebp-08]
:004270AF 81E2FFFF0000            and edx, 0000FFFF
:004270B5 660FB68260804900        movzx ax, byte ptr [edx+00498060]
:004270BD 668945FC                mov word ptr [ebp-04], ax
:004270C1 668B4DF8                mov cx, word ptr [ebp-08]
:004270C5 66894DF4                mov word ptr [ebp-0C], cx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042708C(C), :004270AA(C)
|
:004270C9 EB91                    jmp 0042705C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427074(C)
|
:004270CB 668B45F4                mov ax, word ptr [ebp-0C]
:004270CF 8BE5                    mov esp, ebp
:004270D1 5D                      pop ebp
:004270D2 C3                      ret



* Referenced by a CALL at Addresses:
|:0042728C   , :00427470   
|
:004270D3 55                      push ebp
:004270D4 8BEC                    mov ebp, esp
:004270D6 51                      push ecx
:004270D7 56                      push esi
:004270D8 8B7510                  mov esi, dword ptr [ebp+10]
:004270DB 81E6FFFF0000            and esi, 0000FFFF

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:004270E1 6A06                    push 00000006
:004270E3 E8CEFAFFFF              call 00426BB6
:004270E8 83C404                  add esp, 00000004
:004270EB 25FFFF0000              and eax, 0000FFFF
:004270F0 3BF0                    cmp esi, eax
:004270F2 0F8DC6000000            jnl 004271BE
:004270F8 8B750C                  mov esi, dword ptr [ebp+0C]
:004270FB 81E6FFFF0000            and esi, 0000FFFF
:00427101 6A04                    push 00000004
:00427103 E8AEFAFFFF              call 00426BB6
:00427108 83C404                  add esp, 00000004
:0042710B 25FFFF0000              and eax, 0000FFFF
:00427110 3BF0                    cmp esi, eax
:00427112 0F8DA6000000            jnl 004271BE
:00427118 8B7508                  mov esi, dword ptr [ebp+08]
:0042711B 81E6FFFF0000            and esi, 0000FFFF
:00427121 6A02                    push 00000002
:00427123 E88EFAFFFF              call 00426BB6
:00427128 83C404                  add esp, 00000004
:0042712B 25FFFF0000              and eax, 0000FFFF
:00427130 3BF0                    cmp esi, eax
:00427132 0F8D86000000            jnl 004271BE
:00427138 8B7510                  mov esi, dword ptr [ebp+10]
:0042713B 81E6FFFF0000            and esi, 0000FFFF
:00427141 6A02                    push 00000002
:00427143 E86EFAFFFF              call 00426BB6
:00427148 83C404                  add esp, 00000004
:0042714B 25FFFF0000              and eax, 0000FFFF
:00427150 0FAFF0                  imul esi, eax
:00427153 6A04                    push 00000004
:00427155 E85CFAFFFF              call 00426BB6
:0042715A 83C404                  add esp, 00000004
:0042715D 25FFFF0000              and eax, 0000FFFF
:00427162 0FAFF0                  imul esi, eax
:00427165 8975FC                  mov dword ptr [ebp-04], esi
:00427168 8B750C                  mov esi, dword ptr [ebp+0C]
:0042716B 81E6FFFF0000            and esi, 0000FFFF
:00427171 6A02                    push 00000002
:00427173 E83EFAFFFF              call 00426BB6
:00427178 83C404                  add esp, 00000004
:0042717B 25FFFF0000              and eax, 0000FFFF
:00427180 0FAFF0                  imul esi, eax
:00427183 8B45FC                  mov eax, dword ptr [ebp-04]
:00427186 03C6                    add eax, esi
:00427188 8945FC                  mov dword ptr [ebp-04], eax
:0042718B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042718E 81E1FFFF0000            and ecx, 0000FFFF
:00427194 8B55FC                  mov edx, dword ptr [ebp-04]
:00427197 03D1                    add edx, ecx
:00427199 8955FC                  mov dword ptr [ebp-04], edx
:0042719C 8B45FC                  mov eax, dword ptr [ebp-04]
:0042719F D1E0                    shl eax, 1
:004271A1 8945FC                  mov dword ptr [ebp-04], eax
:004271A4 6A04                    push 00000004
:004271A6 6A00                    push 00000000
:004271A8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004271AB 83C110                  add ecx, 00000010
:004271AE 51                      push ecx
:004271AF B938EB4A00              mov ecx, 004AEB38
:004271B4 E887880500              call 0047FA40
:004271B9 668B00                  mov ax, word ptr [eax]
:004271BC EB04                    jmp 004271C2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004270F2(C), :00427112(C), :00427132(C)
|
:004271BE 66B800F0                mov ax, F000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004271BC(U)
|
:004271C2 5E                      pop esi
:004271C3 8BE5                    mov esp, ebp
:004271C5 5D                      pop ebp
:004271C6 C3                      ret



* Referenced by a CALL at Addresses:
|:00428352   , :004295C4   
|
:004271C7 55                      push ebp
:004271C8 8BEC                    mov ebp, esp
:004271CA 83EC10                  sub esp, 00000010
:004271CD 668B4510                mov ax, word ptr [ebp+10]
:004271D1 668945FC                mov word ptr [ebp-04], ax
:004271D5 EB0C                    jmp 004271E3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004272B9(U)
|
:004271D7 668B4DFC                mov cx, word ptr [ebp-04]
:004271DB 6683C101                add cx, 0001
:004271DF 66894DFC                mov word ptr [ebp-04], cx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004271D5(U)
|
:004271E3 8B55FC                  mov edx, dword ptr [ebp-04]
:004271E6 81E2FFFF0000            and edx, 0000FFFF
:004271EC 8B4510                  mov eax, dword ptr [ebp+10]
:004271EF 25FFFF0000              and eax, 0000FFFF
:004271F4 8B4D1C                  mov ecx, dword ptr [ebp+1C]
:004271F7 81E1FFFF0000            and ecx, 0000FFFF
:004271FD 03C1                    add eax, ecx
:004271FF 3BD0                    cmp edx, eax
:00427201 0F8DB7000000            jnl 004272BE
:00427207 8B550C                  mov edx, dword ptr [ebp+0C]
:0042720A 81E2FFFF0000            and edx, 0000FFFF
:00427210 8B4518                  mov eax, dword ptr [ebp+18]
:00427213 25FFFF0000              and eax, 0000FFFF
:00427218 2BD0                    sub edx, eax
:0042721A 83C201                  add edx, 00000001
:0042721D 668955F0                mov word ptr [ebp-10], dx
:00427221 EB0C                    jmp 0042722F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004272B4(U)
|
:00427223 668B4DF0                mov cx, word ptr [ebp-10]
:00427227 6683C101                add cx, 0001
:0042722B 66894DF0                mov word ptr [ebp-10], cx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427221(U)
|
:0042722F 8B55F0                  mov edx, dword ptr [ebp-10]
:00427232 81E2FFFF0000            and edx, 0000FFFF
:00427238 8B450C                  mov eax, dword ptr [ebp+0C]
:0042723B 25FFFF0000              and eax, 0000FFFF
:00427240 83C001                  add eax, 00000001
:00427243 3BD0                    cmp edx, eax
:00427245 7D72                    jge 004272B9
:00427247 668B4D08                mov cx, word ptr [ebp+08]
:0042724B 66894DF8                mov word ptr [ebp-08], cx
:0042724F EB0C                    jmp 0042725D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004272B2(U)
|
:00427251 668B55F8                mov dx, word ptr [ebp-08]
:00427255 6683C201                add dx, 0001
:00427259 668955F8                mov word ptr [ebp-08], dx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042724F(U)
|
:0042725D 8B45F8                  mov eax, dword ptr [ebp-08]
:00427260 25FFFF0000              and eax, 0000FFFF
:00427265 8B4D08                  mov ecx, dword ptr [ebp+08]
:00427268 81E1FFFF0000            and ecx, 0000FFFF
:0042726E 8B5514                  mov edx, dword ptr [ebp+14]
:00427271 81E2FFFF0000            and edx, 0000FFFF
:00427277 03CA                    add ecx, edx
:00427279 3BC1                    cmp eax, ecx
:0042727B 7D37                    jge 004272B4
:0042727D 668B45FC                mov ax, word ptr [ebp-04]
:00427281 50                      push eax
:00427282 668B4DF0                mov cx, word ptr [ebp-10]
:00427286 51                      push ecx
:00427287 668B55F8                mov dx, word ptr [ebp-08]
:0042728B 52                      push edx
:0042728C E842FEFFFF              call 004270D3
:00427291 83C40C                  add esp, 0000000C
:00427294 668945F4                mov word ptr [ebp-0C], ax
:00427298 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042729B 25FFFF0000              and eax, 0000FFFF
:004272A0 2500FF0000              and eax, 0000FF00
:004272A5 3D00F00000              cmp eax, 0000F000
:004272AA 7506                    jne 004272B2
:004272AC 660DFFFF                or ax, FFFF
:004272B0 EB0F                    jmp 004272C1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004272AA(C)
|
:004272B2 EB9D                    jmp 00427251

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042727B(C)
|
:004272B4 E96AFFFFFF              jmp 00427223

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427245(C)
|
:004272B9 E919FFFFFF              jmp 004271D7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427201(C)
|
:004272BE 6633C0                  xor ax, ax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004272B0(U)
|
:004272C1 8BE5                    mov esp, ebp
:004272C3 5D                      pop ebp
:004272C4 C3                      ret



* Referenced by a CALL at Addresses:
|:0042761C   , :00427B17   , :00460979   
|
:004272C5 55                      push ebp
:004272C6 8BEC                    mov ebp, esp
:004272C8 83EC10                  sub esp, 00000010
:004272CB 56                      push esi
:004272CC 8B4508                  mov eax, dword ptr [ebp+08]
:004272CF 33C9                    xor ecx, ecx
:004272D1 668B08                  mov cx, word ptr [eax]
:004272D4 C1E103                  shl ecx, 03
:004272D7 66894DF0                mov word ptr [ebp-10], cx
:004272DB 8B550C                  mov edx, dword ptr [ebp+0C]
:004272DE 33C0                    xor eax, eax
:004272E0 668B02                  mov ax, word ptr [edx]
:004272E3 6BC0F8                  imul eax, FFFFFFF8
:004272E6 668945FC                mov word ptr [ebp-04], ax
:004272EA 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004272ED 81E1FFFF0000            and ecx, 0000FFFF
:004272F3 8B55FC                  mov edx, dword ptr [ebp-04]
:004272F6 81E2FFFF0000            and edx, 0000FFFF
:004272FC 03CA                    add ecx, edx
:004272FE 66894DF8                mov word ptr [ebp-08], cx
:00427302 8B4508                  mov eax, dword ptr [ebp+08]
:00427305 33C9                    xor ecx, ecx
:00427307 668B08                  mov cx, word ptr [eax]
:0042730A 8B550C                  mov edx, dword ptr [ebp+0C]
:0042730D 33C0                    xor eax, eax
:0042730F 668B02                  mov ax, word ptr [edx]
:00427312 03C8                    add ecx, eax
:00427314 C1E102                  shl ecx, 02
:00427317 8B5510                  mov edx, dword ptr [ebp+10]
:0042731A 81E2FFFF0000            and edx, 0000FFFF
:00427320 C1E203                  shl edx, 03
:00427323 2BCA                    sub ecx, edx
:00427325 66894DF4                mov word ptr [ebp-0C], cx
:00427329 8B75F8                  mov esi, dword ptr [ebp-08]
:0042732C 81E6FFFF0000            and esi, 0000FFFF
:00427332 6A08                    push 00000008
:00427334 E87DF8FFFF              call 00426BB6
:00427339 83C404                  add esp, 00000004
:0042733C 25FFFF0000              and eax, 0000FFFF
:00427341 C1E003                  shl eax, 03
:00427344 99                      cdq
:00427345 2BC2                    sub eax, edx
:00427347 D1F8                    sar eax, 1
:00427349 8D4406F8                lea eax, dword ptr [esi+eax-08]
:0042734D 668945F8                mov word ptr [ebp-08], ax
:00427351 33C9                    xor ecx, ecx
:00427353 668B0DB4CE4900          mov cx, word ptr [0049CEB4]
:0042735A C1E103                  shl ecx, 03
:0042735D 668B55F8                mov dx, word ptr [ebp-08]
:00427361 662BD1                  sub dx, cx
:00427364 668955F8                mov word ptr [ebp-08], dx
:00427368 33C0                    xor eax, eax
:0042736A 66A1B6CE4900            mov ax, word ptr [0049CEB6]
:00427370 8D0CC5F8FFFFFF          lea ecx, dword ptr [8*eax+FFFFFFF8]
:00427377 668B55F4                mov dx, word ptr [ebp-0C]
:0042737B 662BD1                  sub dx, cx
:0042737E 668955F4                mov word ptr [ebp-0C], dx
:00427382 8B4508                  mov eax, dword ptr [ebp+08]
:00427385 668B4DF8                mov cx, word ptr [ebp-08]
:00427389 668908                  mov word ptr [eax], cx
:0042738C 8B550C                  mov edx, dword ptr [ebp+0C]
:0042738F 668B45F4                mov ax, word ptr [ebp-0C]
:00427393 668902                  mov word ptr [edx], ax
:00427396 5E                      pop esi
:00427397 8BE5                    mov esp, ebp
:00427399 5D                      pop ebp
:0042739A C3                      ret



* Referenced by a CALL at Addresses:
|:0042A261   , :0042A2B3   
|
:0042739B 55                      push ebp
:0042739C 8BEC                    mov ebp, esp
:0042739E 83EC30                  sub esp, 00000030
:004273A1 56                      push esi
:004273A2 66C745D8FFFF            mov [ebp-28], FFFF
:004273A8 66C745D4FFFF            mov [ebp-2C], FFFF
:004273AE 66C745DCFFFF            mov [ebp-24], FFFF
:004273B4 6A00                    push 00000000
:004273B6 6A70                    push 00000070
:004273B8 68F8CE4900              push 0049CEF8
:004273BD E87AF6FFFF              call 00426A3C
:004273C2 83C40C                  add esp, 0000000C
:004273C5 66C745E40000            mov [ebp-1C], 0000
:004273CB EB0C                    jmp 004273D9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427692(U)
|
:004273CD 668B45E4                mov ax, word ptr [ebp-1C]
:004273D1 66050100                add ax, 0001
:004273D5 668945E4                mov word ptr [ebp-1C], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004273CB(U)
|
:004273D9 8B75E4                  mov esi, dword ptr [ebp-1C]
:004273DC 81E6FFFF0000            and esi, 0000FFFF

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:004273E2 6A06                    push 00000006
:004273E4 E8CDF7FFFF              call 00426BB6
:004273E9 83C404                  add esp, 00000004
:004273EC 25FFFF0000              and eax, 0000FFFF
:004273F1 3BF0                    cmp esi, eax
:004273F3 0F8D9E020000            jnl 00427697
:004273F9 66C745E00000            mov [ebp-20], 0000
:004273FF EB0C                    jmp 0042740D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042768D(U)
|
:00427401 668B4DE0                mov cx, word ptr [ebp-20]
:00427405 6683C101                add cx, 0001
:00427409 66894DE0                mov word ptr [ebp-20], cx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004273FF(U)
|
:0042740D 8B75E0                  mov esi, dword ptr [ebp-20]
:00427410 81E6FFFF0000            and esi, 0000FFFF
:00427416 6A04                    push 00000004
:00427418 E899F7FFFF              call 00426BB6
:0042741D 83C404                  add esp, 00000004
:00427420 25FFFF0000              and eax, 0000FFFF
:00427425 3BF0                    cmp esi, eax
:00427427 0F8D65020000            jnl 00427692
:0042742D 66C745E80000            mov [ebp-18], 0000
:00427433 EB0C                    jmp 00427441

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427688(U)
|
:00427435 668B55E8                mov dx, word ptr [ebp-18]
:00427439 6683C201                add dx, 0001
:0042743D 668955E8                mov word ptr [ebp-18], dx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427433(U)
|
:00427441 8B75E8                  mov esi, dword ptr [ebp-18]
:00427444 81E6FFFF0000            and esi, 0000FFFF
:0042744A 6A02                    push 00000002
:0042744C E865F7FFFF              call 00426BB6
:00427451 83C404                  add esp, 00000004
:00427454 25FFFF0000              and eax, 0000FFFF
:00427459 3BF0                    cmp esi, eax
:0042745B 0F8D2C020000            jnl 0042768D
:00427461 668B45E4                mov ax, word ptr [ebp-1C]
:00427465 50                      push eax
:00427466 668B4DE0                mov cx, word ptr [ebp-20]
:0042746A 51                      push ecx
:0042746B 668B55E8                mov dx, word ptr [ebp-18]
:0042746F 52                      push edx
:00427470 E85EFCFFFF              call 004270D3
:00427475 83C40C                  add esp, 0000000C
:00427478 668945F4                mov word ptr [ebp-0C], ax
:0042747C 8B4508                  mov eax, dword ptr [ebp+08]
:0042747F 25FFFF0000              and eax, 0000FFFF
:00427484 83F801                  cmp eax, 00000001
:00427487 7572                    jne 004274FB
:00427489 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042748C 81E1FFFF0000            and ecx, 0000FFFF
:00427492 80E500                  and ch, 00
:00427495 81F9FF000000            cmp ecx, 000000FF
:0042749B 745E                    je 004274FB
:0042749D 8B55F4                  mov edx, dword ptr [ebp-0C]
:004274A0 81E2FFFF0000            and edx, 0000FFFF
:004274A6 80E600                  and dh, 00
:004274A9 52                      push edx
:004274AA 6800300000              push 00003000
:004274AF E8FEF8FFFF              call 00426DB2
:004274B4 83C408                  add esp, 00000008
:004274B7 8945FC                  mov dword ptr [ebp-04], eax
:004274BA 6880000000              push 00000080
:004274BF E8E4F5FFFF              call 00426AA8
:004274C4 83C404                  add esp, 00000004
:004274C7 3B45FC                  cmp eax, dword ptr [ebp-04]
:004274CA 7505                    jne 004274D1
:004274CC E91D020000              jmp 004276EE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004274CA(C)
|
:004274D1 8B45FC                  mov eax, dword ptr [ebp-04]
:004274D4 50                      push eax
:004274D5 6A00                    push 00000000
:004274D7 6A00                    push 00000000
:004274D9 6A00                    push 00000000
:004274DB 6A00                    push 00000000
:004274DD 6A00                    push 00000000
:004274DF 668B4DE4                mov cx, word ptr [ebp-1C]
:004274E3 51                      push ecx
:004274E4 668B55E0                mov dx, word ptr [ebp-20]
:004274E8 52                      push edx
:004274E9 668B45E8                mov ax, word ptr [ebp-18]
:004274ED 50                      push eax
:004274EE 6800300000              push 00003000
:004274F3 E826170000              call 00428C1E
:004274F8 83C428                  add esp, 00000028

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00427487(C), :0042749B(C)
|
:004274FB 668B4DF4                mov cx, word ptr [ebp-0C]
:004274FF 6681E100FF              and cx, FF00
:00427504 66894DF4                mov word ptr [ebp-0C], cx
:00427508 8B55F4                  mov edx, dword ptr [ebp-0C]
:0042750B 81E2FFFF0000            and edx, 0000FFFF
:00427511 8955D0                  mov dword ptr [ebp-30], edx
:00427514 817DD000F20000          cmp dword ptr [ebp-30], 0000F200
:0042751B 7F17                    jg 00427534
:0042751D 817DD000F20000          cmp dword ptr [ebp-30], 0000F200
:00427524 7472                    je 00427598
:00427526 817DD000F10000          cmp dword ptr [ebp-30], 0000F100
:0042752D 7469                    je 00427598
:0042752F E954010000              jmp 00427688

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042751B(C)
|
:00427534 817DD000F40000          cmp dword ptr [ebp-30], 0000F400
:0042753B 7F17                    jg 00427554
:0042753D 817DD000F40000          cmp dword ptr [ebp-30], 0000F400
:00427544 7452                    je 00427598
:00427546 817DD000F30000          cmp dword ptr [ebp-30], 0000F300
:0042754D 7449                    je 00427598
:0042754F E934010000              jmp 00427688

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042753B(C)
|
:00427554 817DD000F60000          cmp dword ptr [ebp-30], 0000F600
:0042755B 7F17                    jg 00427574
:0042755D 817DD000F60000          cmp dword ptr [ebp-30], 0000F600
:00427564 7432                    je 00427598
:00427566 817DD000F50000          cmp dword ptr [ebp-30], 0000F500
:0042756D 7429                    je 00427598
:0042756F E914010000              jmp 00427688

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042755B(C)
|
:00427574 817DD000F70000          cmp dword ptr [ebp-30], 0000F700
:0042757B 741B                    je 00427598
:0042757D 817DD000F80000          cmp dword ptr [ebp-30], 0000F800
:00427584 7412                    je 00427598
:00427586 817DD000F90000          cmp dword ptr [ebp-30], 0000F900
:0042758D 0F84DD000000            je 00427670
:00427593 E9F0000000              jmp 00427688

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00427524(C), :0042752D(C), :00427544(C), :0042754D(C), :00427564(C)
|:0042756D(C), :0042757B(C), :00427584(C)
|
:00427598 668B45F4                mov ax, word ptr [ebp-0C]
:0042759C 662D00F1                sub ax, F100
:004275A0 668945F4                mov word ptr [ebp-0C], ax
:004275A4 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004275A7 81E1FFFF0000            and ecx, 0000FFFF
:004275AD C1F908                  sar ecx, 08
:004275B0 6BC90E                  imul ecx, 0000000E
:004275B3 81C1F8CE4900            add ecx, 0049CEF8
:004275B9 894DF0                  mov dword ptr [ebp-10], ecx
:004275BC 6800800000              push 00008000
:004275C1 6800800000              push 00008000
:004275C6 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004275C9 E8E2330000              call 0042A9B0
:004275CE 668B55E8                mov dx, word ptr [ebp-18]
:004275D2 52                      push edx
:004275D3 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004275D6 E875360000              call 0042AC50
:004275DB 668B45E0                mov ax, word ptr [ebp-20]
:004275DF 50                      push eax
:004275E0 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004275E3 E8A8370000              call 0042AD90
:004275E8 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004275EB 81E1FFFF0000            and ecx, 0000FFFF
:004275F1 83C104                  add ecx, 00000004
:004275F4 66894DF8                mov word ptr [ebp-08], cx
:004275F8 8B55E0                  mov edx, dword ptr [ebp-20]
:004275FB 81E2FFFF0000            and edx, 0000FFFF
:00427601 83C204                  add edx, 00000004
:00427604 668955EC                mov word ptr [ebp-14], dx
:00427608 8B45E4                  mov eax, dword ptr [ebp-1C]
:0042760B 25FFFF0000              and eax, 0000FFFF
:00427610 83C009                  add eax, 00000009
:00427613 50                      push eax
:00427614 8D4DEC                  lea ecx, dword ptr [ebp-14]
:00427617 51                      push ecx
:00427618 8D55F8                  lea edx, dword ptr [ebp-08]
:0042761B 52                      push edx
:0042761C E8A4FCFFFF              call 004272C5
:00427621 83C40C                  add esp, 0000000C
:00427624 668B45F8                mov ax, word ptr [ebp-08]
:00427628 668945F8                mov word ptr [ebp-08], ax
:0042762C 668B4DEC                mov cx, word ptr [ebp-14]
:00427630 6683C128                add cx, 0028
:00427634 66894DEC                mov word ptr [ebp-14], cx
:00427638 8B55F8                  mov edx, dword ptr [ebp-08]
:0042763B 81E2FFFF0000            and edx, 0000FFFF
:00427641 83EA18                  sub edx, 00000018
:00427644 52                      push edx
:00427645 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00427648 E863370000              call 0042ADB0
:0042764D 668B45EC                mov ax, word ptr [ebp-14]
:00427651 50                      push eax
:00427652 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00427655 E8E6330000              call 0042AA40
:0042765A 6A50                    push 00000050
:0042765C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0042765F E86C360000              call 0042ACD0
:00427664 6A48                    push 00000048
:00427666 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00427669 E8F2330000              call 0042AA60
:0042766E EB18                    jmp 00427688

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042758D(C)
|
:00427670 668B4DE8                mov cx, word ptr [ebp-18]
:00427674 66894DD8                mov word ptr [ebp-28], cx
:00427678 668B55E0                mov dx, word ptr [ebp-20]
:0042767C 668955D4                mov word ptr [ebp-2C], dx
:00427680 668B45E4                mov ax, word ptr [ebp-1C]
:00427684 668945DC                mov word ptr [ebp-24], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042752F(U), :0042754F(U), :0042756F(U), :00427593(U), :0042766E(U)
|
:00427688 E9A8FDFFFF              jmp 00427435

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042745B(C)
|
:0042768D E96FFDFFFF              jmp 00427401

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427427(C)
|
:00427692 E936FDFFFF              jmp 004273CD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004273F3(C)
|
:00427697 C745F0F8CE4900          mov [ebp-10], 0049CEF8
:0042769E 66C745F40000            mov [ebp-0C], 0000
:004276A4 EB15                    jmp 004276BB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004276E0(U)
|
:004276A6 668B4DF4                mov cx, word ptr [ebp-0C]
:004276AA 6683C101                add cx, 0001
:004276AE 66894DF4                mov word ptr [ebp-0C], cx
:004276B2 8B55F0                  mov edx, dword ptr [ebp-10]
:004276B5 83C20E                  add edx, 0000000E
:004276B8 8955F0                  mov dword ptr [ebp-10], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004276A4(U)
|
:004276BB 8B45F4                  mov eax, dword ptr [ebp-0C]
:004276BE 25FFFF0000              and eax, 0000FFFF
:004276C3 83F804                  cmp eax, 00000004
:004276C6 7D1A                    jge 004276E2
:004276C8 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004276CB E8C0320000              call 0042A990
:004276D0 25FFFF0000              and eax, 0000FFFF
:004276D5 2500800000              and eax, 00008000
:004276DA 85C0                    test eax, eax
:004276DC 7402                    je 004276E0
:004276DE EB02                    jmp 004276E2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004276DC(C)
|
:004276E0 EBC4                    jmp 004276A6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004276C6(C), :004276DE(U)
|
:004276E2 668B4DF4                mov cx, word ptr [ebp-0C]
:004276E6 6683E103                and cx, 0003
:004276EA 66894DF4                mov word ptr [ebp-0C], cx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004274CC(U)
|
:004276EE 5E                      pop esi
:004276EF 8BE5                    mov esp, ebp
:004276F1 5D                      pop ebp
:004276F2 C3                      ret



* Referenced by a CALL at Address:
|:00428945   
|
:004276F3 55                      push ebp
:004276F4 8BEC                    mov ebp, esp
:004276F6 83EC14                  sub esp, 00000014
:004276F9 A1A4CE4900              mov eax, dword ptr [0049CEA4]
:004276FE 8945F8                  mov dword ptr [ebp-08], eax
:00427701 66C745FC0000            mov [ebp-04], 0000
:00427707 66C745EC0000            mov [ebp-14], 0000
:0042770D EB0C                    jmp 0042771B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427783(U)
|
:0042770F 668B4DEC                mov cx, word ptr [ebp-14]
:00427713 6683C101                add cx, 0001
:00427717 66894DEC                mov word ptr [ebp-14], cx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042770D(U)
|
:0042771B 8B55EC                  mov edx, dword ptr [ebp-14]
:0042771E 81E2FFFF0000            and edx, 0000FFFF
:00427724 83FA32                  cmp edx, 00000032
:00427727 7D5C                    jge 00427785
:00427729 8B45F8                  mov eax, dword ptr [ebp-08]
:0042772C 8945F4                  mov dword ptr [ebp-0C], eax
:0042772F 66C745F00000            mov [ebp-10], 0000
:00427735 EB18                    jmp 0042774F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042776F(U)
|
:00427737 668B4DF0                mov cx, word ptr [ebp-10]
:0042773B 6683C101                add cx, 0001
:0042773F 66894DF0                mov word ptr [ebp-10], cx
:00427743 668B55FC                mov dx, word ptr [ebp-04]
:00427747 6683C201                add dx, 0001
:0042774B 668955FC                mov word ptr [ebp-04], dx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427735(U)
|
:0042774F 8B45F0                  mov eax, dword ptr [ebp-10]
:00427752 25FFFF0000              and eax, 0000FFFF
:00427757 83F850                  cmp eax, 00000050
:0042775A 7D15                    jge 00427771
:0042775C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042775F 668B55FC                mov dx, word ptr [ebp-04]
:00427763 668911                  mov word ptr [ecx], dx
:00427766 8B45F8                  mov eax, dword ptr [ebp-08]
:00427769 83C002                  add eax, 00000002
:0042776C 8945F8                  mov dword ptr [ebp-08], eax
:0042776F EBC6                    jmp 00427737

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042775A(C)
|
:00427771 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00427774 894DF8                  mov dword ptr [ebp-08], ecx
:00427777 8B55F8                  mov edx, dword ptr [ebp-08]
:0042777A 81C290010000            add edx, 00000190
:00427780 8955F8                  mov dword ptr [ebp-08], edx
:00427783 EB8A                    jmp 0042770F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427727(C)
|
:00427785 8BE5                    mov esp, ebp
:00427787 5D                      pop ebp
:00427788 C3                      ret



* Referenced by a CALL at Address:
|:00427A84   
|
:00427789 55                      push ebp
:0042778A 8BEC                    mov ebp, esp
:0042778C 83EC0C                  sub esp, 0000000C
:0042778F 66C745FC0000            mov [ebp-04], 0000
:00427795 EB0C                    jmp 004277A3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042782E(U)
|
:00427797 668B45FC                mov ax, word ptr [ebp-04]
:0042779B 66050100                add ax, 0001
:0042779F 668945FC                mov word ptr [ebp-04], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427795(U)
|
:004277A3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004277A6 81E1FFFF0000            and ecx, 0000FFFF
:004277AC 8B5514                  mov edx, dword ptr [ebp+14]
:004277AF 81E2FFFF0000            and edx, 0000FFFF
:004277B5 3BCA                    cmp ecx, edx
:004277B7 7D7A                    jge 00427833
:004277B9 C745F8C0F14900          mov [ebp-08], 0049F1C0
:004277C0 8B450C                  mov eax, dword ptr [ebp+0C]
:004277C3 25FFFF0000              and eax, 0000FFFF
:004277C8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004277CB 81E1FFFF0000            and ecx, 0000FFFF
:004277D1 03C1                    add eax, ecx
:004277D3 6BC050                  imul eax, 00000050
:004277D6 8B5508                  mov edx, dword ptr [ebp+08]
:004277D9 81E2FFFF0000            and edx, 0000FFFF
:004277DF 03C2                    add eax, edx
:004277E1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004277E4 8D1441                  lea edx, dword ptr [ecx+2*eax]
:004277E7 8955F8                  mov dword ptr [ebp-08], edx
:004277EA 66C745F40000            mov [ebp-0C], 0000
:004277F0 EB15                    jmp 00427807

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042782C(U)
|
:004277F2 668B45F4                mov ax, word ptr [ebp-0C]
:004277F6 66050100                add ax, 0001
:004277FA 668945F4                mov word ptr [ebp-0C], ax
:004277FE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00427801 83C102                  add ecx, 00000002
:00427804 894DF8                  mov dword ptr [ebp-08], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004277F0(U)
|
:00427807 8B55F4                  mov edx, dword ptr [ebp-0C]
:0042780A 81E2FFFF0000            and edx, 0000FFFF
:00427810 8B4510                  mov eax, dword ptr [ebp+10]
:00427813 25FFFF0000              and eax, 0000FFFF
:00427818 3BD0                    cmp edx, eax
:0042781A 7D12                    jge 0042782E
:0042781C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042781F 668B11                  mov dx, word ptr [ecx]
:00427822 660B5518                or dx, word ptr [ebp+18]
:00427826 8B45F8                  mov eax, dword ptr [ebp-08]
:00427829 668910                  mov word ptr [eax], dx
:0042782C EBC4                    jmp 004277F2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042781A(C)
|
:0042782E E964FFFFFF              jmp 00427797

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004277B7(C)
|
:00427833 8BE5                    mov esp, ebp
:00427835 5D                      pop ebp
:00427836 C3                      ret



* Referenced by a CALL at Addresses:
|:00427A34   , :00427A61   
|
:00427837 55                      push ebp
:00427838 8BEC                    mov ebp, esp
:0042783A 51                      push ecx
:0042783B 8B4508                  mov eax, dword ptr [ebp+08]
:0042783E 25FFFF0000              and eax, 0000FFFF
:00427843 99                      cdq
:00427844 83E207                  and edx, 00000007
:00427847 03C2                    add eax, edx
:00427849 C1F803                  sar eax, 03
:0042784C 668945FC                mov word ptr [ebp-04], ax
:00427850 8B4508                  mov eax, dword ptr [ebp+08]
:00427853 25FFFF0000              and eax, 0000FFFF
:00427858 99                      cdq
:00427859 33C2                    xor eax, edx
:0042785B 2BC2                    sub eax, edx
:0042785D 83E007                  and eax, 00000007
:00427860 33C2                    xor eax, edx
:00427862 2BC2                    sub eax, edx
:00427864 85C0                    test eax, eax
:00427866 740C                    je 00427874
:00427868 668B45FC                mov ax, word ptr [ebp-04]
:0042786C 66050100                add ax, 0001
:00427870 668945FC                mov word ptr [ebp-04], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427866(C)
|
:00427874 668B45FC                mov ax, word ptr [ebp-04]
:00427878 8BE5                    mov esp, ebp
:0042787A 5D                      pop ebp
:0042787B C3                      ret


:0042787C 55                      push ebp
:0042787D 8BEC                    mov ebp, esp
:0042787F 51                      push ecx
:00427880 8B4508                  mov eax, dword ptr [ebp+08]
:00427883 25FFFF0000              and eax, 0000FFFF
:00427888 99                      cdq
:00427889 83E207                  and edx, 00000007
:0042788C 03C2                    add eax, edx
:0042788E C1F803                  sar eax, 03
:00427891 668945FC                mov word ptr [ebp-04], ax
:00427895 668B45FC                mov ax, word ptr [ebp-04]
:00427899 8BE5                    mov esp, ebp
:0042789B 5D                      pop ebp
:0042789C C3                      ret



* Referenced by a CALL at Address:
|:0042A353   
|
:0042789D 55                      push ebp
:0042789E 8BEC                    mov ebp, esp
:004278A0 83EC20                  sub esp, 00000020
:004278A3 8B4508                  mov eax, dword ptr [ebp+08]
:004278A6 25FFFF0000              and eax, 0000FFFF
:004278AB 25FFFF0000              and eax, 0000FFFF
:004278B0 668945EC                mov word ptr [ebp-14], ax
:004278B4 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004278B7 81E1FFFF0000            and ecx, 0000FFFF
:004278BD 83E928                  sub ecx, 00000028
:004278C0 81E1FFFF0000            and ecx, 0000FFFF
:004278C6 66894DE4                mov word ptr [ebp-1C], cx
:004278CA 668B55EC                mov dx, word ptr [ebp-14]
:004278CE 668955F8                mov word ptr [ebp-08], dx
:004278D2 668B45E4                mov ax, word ptr [ebp-1C]
:004278D6 668945F0                mov word ptr [ebp-10], ax
:004278DA 0FBF4DEC                movsx ecx, word ptr [ebp-14]
:004278DE 85C9                    test ecx, ecx
:004278E0 7D37                    jge 00427919
:004278E2 668B55EC                mov dx, word ptr [ebp-14]
:004278E6 66035510                add dx, word ptr [ebp+10]
:004278EA 668955EC                mov word ptr [ebp-14], dx
:004278EE 0FBF45EC                movsx eax, word ptr [ebp-14]
:004278F2 85C0                    test eax, eax
:004278F4 7F08                    jg 004278FE
:004278F6 6633C0                  xor ax, ax
:004278F9 E992010000              jmp 00427A90

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004278F4(C)
|
:004278FE 66C745F80000            mov [ebp-08], 0000
:00427904 8B4D10                  mov ecx, dword ptr [ebp+10]
:00427907 81E1FFFF0000            and ecx, 0000FFFF
:0042790D 0FBF55EC                movsx edx, word ptr [ebp-14]
:00427911 2BCA                    sub ecx, edx
:00427913 66894DFC                mov word ptr [ebp-04], cx
:00427917 EB42                    jmp 0042795B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004278E0(C)
|
:00427919 0FBF45EC                movsx eax, word ptr [ebp-14]
:0042791D 3D80020000              cmp eax, 00000280
:00427922 7C08                    jl 0042792C
:00427924 6633C0                  xor ax, ax
:00427927 E964010000              jmp 00427A90

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427922(C)
|
:0042792C 668B4DEC                mov cx, word ptr [ebp-14]
:00427930 66034D10                add cx, word ptr [ebp+10]
:00427934 66894DEC                mov word ptr [ebp-14], cx
:00427938 668B55EC                mov dx, word ptr [ebp-14]
:0042793C 6681EA8002              sub dx, 0280
:00427941 668955EC                mov word ptr [ebp-14], dx
:00427945 0FBF45EC                movsx eax, word ptr [ebp-14]
:00427949 85C0                    test eax, eax
:0042794B 7D06                    jge 00427953
:0042794D 66C745EC0000            mov [ebp-14], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042794B(C)
|
:00427953 668B4DEC                mov cx, word ptr [ebp-14]
:00427957 66894DFC                mov word ptr [ebp-04], cx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427917(U)
|
:0042795B 0FBF55E4                movsx edx, word ptr [ebp-1C]
:0042795F 85D2                    test edx, edx
:00427961 7D37                    jge 0042799A
:00427963 668B45E4                mov ax, word ptr [ebp-1C]
:00427967 66034514                add ax, word ptr [ebp+14]
:0042796B 668945E4                mov word ptr [ebp-1C], ax
:0042796F 0FBF4DE4                movsx ecx, word ptr [ebp-1C]
:00427973 85C9                    test ecx, ecx
:00427975 7F08                    jg 0042797F
:00427977 6633C0                  xor ax, ax
:0042797A E911010000              jmp 00427A90

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427975(C)
|
:0042797F 66C745F00000            mov [ebp-10], 0000
:00427985 8B5514                  mov edx, dword ptr [ebp+14]
:00427988 81E2FFFF0000            and edx, 0000FFFF
:0042798E 0FBF45E4                movsx eax, word ptr [ebp-1C]
:00427992 2BD0                    sub edx, eax
:00427994 668955F4                mov word ptr [ebp-0C], dx
:00427998 EB42                    jmp 004279DC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427961(C)
|
:0042799A 0FBF4DE4                movsx ecx, word ptr [ebp-1C]
:0042799E 81F990010000            cmp ecx, 00000190
:004279A4 7C08                    jl 004279AE
:004279A6 6633C0                  xor ax, ax
:004279A9 E9E2000000              jmp 00427A90

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004279A4(C)
|
:004279AE 668B55E4                mov dx, word ptr [ebp-1C]
:004279B2 66035514                add dx, word ptr [ebp+14]
:004279B6 668955E4                mov word ptr [ebp-1C], dx
:004279BA 668B45E4                mov ax, word ptr [ebp-1C]
:004279BE 662D9001                sub ax, 0190
:004279C2 668945E4                mov word ptr [ebp-1C], ax
:004279C6 0FBF4DE4                movsx ecx, word ptr [ebp-1C]
:004279CA 85C9                    test ecx, ecx
:004279CC 7D06                    jge 004279D4
:004279CE 66C745E40000            mov [ebp-1C], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004279CC(C)
|
:004279D4 668B55E4                mov dx, word ptr [ebp-1C]
:004279D8 668955F4                mov word ptr [ebp-0C], dx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427998(U)
|
:004279DC 668B4510                mov ax, word ptr [ebp+10]
:004279E0 662B45FC                sub ax, word ptr [ebp-04]
:004279E4 66894510                mov word ptr [ebp+10], ax
:004279E8 668B4D14                mov cx, word ptr [ebp+14]
:004279EC 662B4DF4                sub cx, word ptr [ebp-0C]
:004279F0 66894D14                mov word ptr [ebp+14], cx
:004279F4 8B45F8                  mov eax, dword ptr [ebp-08]
:004279F7 25FFFF0000              and eax, 0000FFFF
:004279FC 99                      cdq
:004279FD 83E207                  and edx, 00000007
:00427A00 03C2                    add eax, edx
:00427A02 C1F803                  sar eax, 03
:00427A05 668945E8                mov word ptr [ebp-18], ax
:00427A09 8B45F0                  mov eax, dword ptr [ebp-10]
:00427A0C 25FFFF0000              and eax, 0000FFFF
:00427A11 99                      cdq
:00427A12 83E207                  and edx, 00000007
:00427A15 03C2                    add eax, edx
:00427A17 C1F803                  sar eax, 03
:00427A1A 668945E0                mov word ptr [ebp-20], ax
:00427A1E 6A02                    push 00000002
:00427A20 8B55F0                  mov edx, dword ptr [ebp-10]
:00427A23 81E2FFFF0000            and edx, 0000FFFF
:00427A29 8B4514                  mov eax, dword ptr [ebp+14]
:00427A2C 25FFFF0000              and eax, 0000FFFF
:00427A31 03D0                    add edx, eax
:00427A33 52                      push edx
:00427A34 E8FEFDFFFF              call 00427837
:00427A39 83C404                  add esp, 00000004
:00427A3C 25FFFF0000              and eax, 0000FFFF
:00427A41 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00427A44 81E1FFFF0000            and ecx, 0000FFFF
:00427A4A 2BC1                    sub eax, ecx
:00427A4C 50                      push eax
:00427A4D 8B55F8                  mov edx, dword ptr [ebp-08]
:00427A50 81E2FFFF0000            and edx, 0000FFFF
:00427A56 8B4510                  mov eax, dword ptr [ebp+10]
:00427A59 25FFFF0000              and eax, 0000FFFF
:00427A5E 03D0                    add edx, eax
:00427A60 52                      push edx
:00427A61 E8D1FDFFFF              call 00427837
:00427A66 83C404                  add esp, 00000004
:00427A69 25FFFF0000              and eax, 0000FFFF
:00427A6E 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00427A71 81E1FFFF0000            and ecx, 0000FFFF
:00427A77 2BC1                    sub eax, ecx
:00427A79 50                      push eax
:00427A7A 668B55E0                mov dx, word ptr [ebp-20]
:00427A7E 52                      push edx
:00427A7F 668B45E8                mov ax, word ptr [ebp-18]
:00427A83 50                      push eax
:00427A84 E800FDFFFF              call 00427789
:00427A89 83C414                  add esp, 00000014
:00427A8C 66B80100                mov ax, 0001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004278F9(U), :00427927(U), :0042797A(U), :004279A9(U)
|
:00427A90 8BE5                    mov esp, ebp
:00427A92 5D                      pop ebp
:00427A93 C3                      ret



* Referenced by a CALL at Address:
|:00428141   
|
:00427A94 55                      push ebp
:00427A95 8BEC                    mov ebp, esp
:00427A97 83EC10                  sub esp, 00000010
:00427A9A 6A00                    push 00000000
:00427A9C E842500500              call 0047CAE3
:00427AA1 83C404                  add esp, 00000004
:00427AA4 6A00                    push 00000000
:00427AA6 6A00                    push 00000000
:00427AA8 6A04                    push 00000004
:00427AAA E842570500              call 0047D1F1
:00427AAF 83C40C                  add esp, 0000000C
:00427AB2 66C745F00000            mov [ebp-10], 0000
:00427AB8 EB0C                    jmp 00427AC6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427B45(U)
|
:00427ABA 668B45F0                mov ax, word ptr [ebp-10]
:00427ABE 66050100                add ax, 0001
:00427AC2 668945F0                mov word ptr [ebp-10], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427AB8(U)
|
:00427AC6 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00427AC9 81E1FFFF0000            and ecx, 0000FFFF
:00427ACF 33D2                    xor edx, edx
:00427AD1 668B1574804900          mov dx, word ptr [00498074]
:00427AD8 3BCA                    cmp ecx, edx
:00427ADA 7D6E                    jge 00427B4A
:00427ADC 8B45F0                  mov eax, dword ptr [ebp-10]
:00427ADF 25FFFF0000              and eax, 0000FFFF
:00427AE4 8B0C85C0EF4900          mov ecx, dword ptr [4*eax+0049EFC0]
:00427AEB 894DF4                  mov dword ptr [ebp-0C], ecx
:00427AEE 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00427AF1 E82A2F0000              call 0042AA20
:00427AF6 668945FC                mov word ptr [ebp-04], ax
:00427AFA 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00427AFD E8CE320000              call 0042ADD0
:00427B02 668945F8                mov word ptr [ebp-08], ax
:00427B06 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00427B09 E8E2320000              call 0042ADF0
:00427B0E 50                      push eax
:00427B0F 8D55F8                  lea edx, dword ptr [ebp-08]
:00427B12 52                      push edx
:00427B13 8D45FC                  lea eax, dword ptr [ebp-04]
:00427B16 50                      push eax
:00427B17 E8A9F7FFFF              call 004272C5
:00427B1C 83C40C                  add esp, 0000000C
:00427B1F 668B4DFC                mov cx, word ptr [ebp-04]
:00427B23 66894DFC                mov word ptr [ebp-04], cx
:00427B27 668B55F8                mov dx, word ptr [ebp-08]
:00427B2B 6683C228                add dx, 0028
:00427B2F 668955F8                mov word ptr [ebp-08], dx
:00427B33 668B45F8                mov ax, word ptr [ebp-08]
:00427B37 50                      push eax
:00427B38 668B4DFC                mov cx, word ptr [ebp-04]
:00427B3C 51                      push ecx
:00427B3D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00427B40 E87F270000              call 0042A2C4
:00427B45 E970FFFFFF              jmp 00427ABA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427ADA(C)
|
:00427B4A 6A00                    push 00000000
:00427B4C 6A00                    push 00000000
:00427B4E 6A00                    push 00000000
:00427B50 E89C560500              call 0047D1F1
:00427B55 83C40C                  add esp, 0000000C
:00427B58 8BE5                    mov esp, ebp
:00427B5A 5D                      pop ebp
:00427B5B C3                      ret



* Referenced by a CALL at Address:
|:0042A032   
|
:00427B5C 55                      push ebp
:00427B5D 8BEC                    mov ebp, esp
:00427B5F 83EC18                  sub esp, 00000018
:00427B62 66C745EC0000            mov [ebp-14], 0000
:00427B68 66C745E80200            mov [ebp-18], 0002
:00427B6E 66C745FC0000            mov [ebp-04], 0000
:00427B74 66C745F00000            mov [ebp-10], 0000
:00427B7A 66C745F40000            mov [ebp-0C], 0000
:00427B80 EB0C                    jmp 00427B8E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427C2E(U)
|
:00427B82 668B45F4                mov ax, word ptr [ebp-0C]
:00427B86 66050100                add ax, 0001
:00427B8A 668945F4                mov word ptr [ebp-0C], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427B80(U)
|
:00427B8E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00427B91 81E1FFFF0000            and ecx, 0000FFFF
:00427B97 83F964                  cmp ecx, 00000064
:00427B9A 0F8D93000000            jnl 00427C33
:00427BA0 668B55EC                mov dx, word ptr [ebp-14]
:00427BA4 668955FC                mov word ptr [ebp-04], dx
:00427BA8 66C745F80000            mov [ebp-08], 0000
:00427BAE EB0C                    jmp 00427BBC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427C04(U)
|
:00427BB0 668B45F8                mov ax, word ptr [ebp-08]
:00427BB4 66050100                add ax, 0001
:00427BB8 668945F8                mov word ptr [ebp-08], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427BAE(U)
|
:00427BBC 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00427BBF 81E1FFFF0000            and ecx, 0000FFFF
:00427BC5 83F964                  cmp ecx, 00000064
:00427BC8 7D3C                    jge 00427C06
:00427BCA 8B55F4                  mov edx, dword ptr [ebp-0C]
:00427BCD 81E2FFFF0000            and edx, 0000FFFF
:00427BD3 6BD264                  imul edx, 00000064
:00427BD6 8B45F8                  mov eax, dword ptr [ebp-08]
:00427BD9 25FFFF0000              and eax, 0000FFFF
:00427BDE 03D0                    add edx, eax
:00427BE0 668B4DFC                mov cx, word ptr [ebp-04]
:00427BE4 66890C5580804900        mov word ptr [2*edx+00498080], cx
:00427BEC 668B55F0                mov dx, word ptr [ebp-10]
:00427BF0 6683C201                add dx, 0001
:00427BF4 668955F0                mov word ptr [ebp-10], dx
:00427BF8 668B45FC                mov ax, word ptr [ebp-04]
:00427BFC 660345F0                add ax, word ptr [ebp-10]
:00427C00 668945FC                mov word ptr [ebp-04], ax
:00427C04 EBAA                    jmp 00427BB0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427BC8(C)
|
:00427C06 668B4DEC                mov cx, word ptr [ebp-14]
:00427C0A 66034DE8                add cx, word ptr [ebp-18]
:00427C0E 66894DEC                mov word ptr [ebp-14], cx
:00427C12 8B55E8                  mov edx, dword ptr [ebp-18]
:00427C15 81E2FFFF0000            and edx, 0000FFFF
:00427C1B 83EA01                  sub edx, 00000001
:00427C1E 668955F0                mov word ptr [ebp-10], dx
:00427C22 668B45E8                mov ax, word ptr [ebp-18]
:00427C26 66050100                add ax, 0001
:00427C2A 668945E8                mov word ptr [ebp-18], ax
:00427C2E E94FFFFFFF              jmp 00427B82

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427B9A(C)
|
:00427C33 8BE5                    mov esp, ebp
:00427C35 5D                      pop ebp
:00427C36 C3                      ret



* Referenced by a CALL at Address:
|:00427FFD   
|
:00427C37 55                      push ebp
:00427C38 8BEC                    mov ebp, esp
:00427C3A 83EC24                  sub esp, 00000024
:00427C3D 56                      push esi
:00427C3E 66C745EC0000            mov [ebp-14], 0000
:00427C44 EB0C                    jmp 00427C52

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427CDA(U)
|
:00427C46 668B45EC                mov ax, word ptr [ebp-14]
:00427C4A 66050100                add ax, 0001
:00427C4E 668945EC                mov word ptr [ebp-14], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427C44(U)
|
:00427C52 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00427C55 81E1FFFF0000            and ecx, 0000FFFF
:00427C5B 33D2                    xor edx, edx
:00427C5D 668B1574804900          mov dx, word ptr [00498074]
:00427C64 3BCA                    cmp ecx, edx
:00427C66 7D77                    jge 00427CDF
:00427C68 8B45EC                  mov eax, dword ptr [ebp-14]
:00427C6B 25FFFF0000              and eax, 0000FFFF
:00427C70 8B0C85C0EF4900          mov ecx, dword ptr [4*eax+0049EFC0]
:00427C77 894DF4                  mov dword ptr [ebp-0C], ecx
:00427C7A 66C745E04000            mov [ebp-20], 0040
:00427C80 8B45E0                  mov eax, dword ptr [ebp-20]
:00427C83 25FFFF0000              and eax, 0000FFFF
:00427C88 99                      cdq
:00427C89 83E203                  and edx, 00000003
:00427C8C 03C2                    add eax, edx
:00427C8E C1F802                  sar eax, 02
:00427C91 668945F0                mov word ptr [ebp-10], ax
:00427C95 8B45E0                  mov eax, dword ptr [ebp-20]
:00427C98 25FFFF0000              and eax, 0000FFFF
:00427C9D 99                      cdq
:00427C9E 33C2                    xor eax, edx
:00427CA0 2BC2                    sub eax, edx
:00427CA2 83E003                  and eax, 00000003
:00427CA5 33C2                    xor eax, edx
:00427CA7 2BC2                    sub eax, edx
:00427CA9 85C0                    test eax, eax
:00427CAB 740C                    je 00427CB9
:00427CAD 668B55F0                mov dx, word ptr [ebp-10]
:00427CB1 6683C201                add dx, 0001
:00427CB5 668955F0                mov word ptr [ebp-10], dx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427CAB(C)
|
:00427CB9 8B75F0                  mov esi, dword ptr [ebp-10]
:00427CBC 81E6FFFF0000            and esi, 0000FFFF
:00427CC2 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00427CC5 E826310000              call 0042ADF0
:00427CCA 25FFFF0000              and eax, 0000FFFF
:00427CCF 03F0                    add esi, eax
:00427CD1 56                      push esi
:00427CD2 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00427CD5 E876300000              call 0042AD50
:00427CDA E967FFFFFF              jmp 00427C46

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427C66(C)
|
:00427CDF 66C745EC0000            mov [ebp-14], 0000
:00427CE5 EB0C                    jmp 00427CF3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427E6D(U)
|
:00427CE7 668B45EC                mov ax, word ptr [ebp-14]
:00427CEB 66050100                add ax, 0001
:00427CEF 668945EC                mov word ptr [ebp-14], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427CE5(U)
|
:00427CF3 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00427CF6 81E1FFFF0000            and ecx, 0000FFFF
:00427CFC 33D2                    xor edx, edx
:00427CFE 668B1574804900          mov dx, word ptr [00498074]
:00427D05 3BCA                    cmp ecx, edx
:00427D07 0F8D65010000            jnl 00427E72
:00427D0D 8B45EC                  mov eax, dword ptr [ebp-14]
:00427D10 25FFFF0000              and eax, 0000FFFF
:00427D15 8B0C85C0EF4900          mov ecx, dword ptr [4*eax+0049EFC0]
:00427D1C 894DF4                  mov dword ptr [ebp-0C], ecx
:00427D1F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00427D22 E8A9300000              call 0042ADD0
:00427D27 668BF0                  mov si, ax
:00427D2A 81E6FFFF0000            and esi, 0000FFFF
:00427D30 6BF664                  imul esi, 00000064
:00427D33 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00427D36 E8E52C0000              call 0042AA20
:00427D3B 25FFFF0000              and eax, 0000FFFF
:00427D40 03F0                    add esi, eax
:00427D42 668B147580804900        mov dx, word ptr [2*esi+00498080]
:00427D4A 668955FC                mov word ptr [ebp-04], dx
:00427D4E 8B45EC                  mov eax, dword ptr [ebp-14]
:00427D51 25FFFF0000              and eax, 0000FFFF
:00427D56 83C001                  add eax, 00000001
:00427D59 668945E8                mov word ptr [ebp-18], ax
:00427D5D EB0C                    jmp 00427D6B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427E68(U)
|
:00427D5F 668B4DE8                mov cx, word ptr [ebp-18]
:00427D63 6683C101                add cx, 0001
:00427D67 66894DE8                mov word ptr [ebp-18], cx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427D5D(U)
|
:00427D6B 8B55E8                  mov edx, dword ptr [ebp-18]
:00427D6E 81E2FFFF0000            and edx, 0000FFFF
:00427D74 33C0                    xor eax, eax
:00427D76 66A174804900            mov ax, word ptr [00498074]
:00427D7C 3BD0                    cmp edx, eax
:00427D7E 0F8DE9000000            jnl 00427E6D
:00427D84 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00427D87 81E1FFFF0000            and ecx, 0000FFFF
:00427D8D 8B148DC0EF4900          mov edx, dword ptr [4*ecx+0049EFC0]
:00427D94 8955DC                  mov dword ptr [ebp-24], edx
:00427D97 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00427D9A E831300000              call 0042ADD0
:00427D9F 668BF0                  mov si, ax
:00427DA2 81E6FFFF0000            and esi, 0000FFFF
:00427DA8 6BF664                  imul esi, 00000064
:00427DAB 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00427DAE E86D2C0000              call 0042AA20
:00427DB3 25FFFF0000              and eax, 0000FFFF
:00427DB8 03F0                    add esi, eax
:00427DBA 668B047580804900        mov ax, word ptr [2*esi+00498080]
:00427DC2 668945E4                mov word ptr [ebp-1C], ax
:00427DC6 66C745F80000            mov [ebp-08], 0000
:00427DCC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00427DCF 81E1FFFF0000            and ecx, 0000FFFF
:00427DD5 8B55E4                  mov edx, dword ptr [ebp-1C]
:00427DD8 81E2FFFF0000            and edx, 0000FFFF
:00427DDE 3BCA                    cmp ecx, edx
:00427DE0 7E08                    jle 00427DEA
:00427DE2 66C745F80100            mov [ebp-08], 0001
:00427DE8 EB3D                    jmp 00427E27

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427DE0(C)
|
:00427DEA 8B45FC                  mov eax, dword ptr [ebp-04]
:00427DED 25FFFF0000              and eax, 0000FFFF
:00427DF2 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00427DF5 81E1FFFF0000            and ecx, 0000FFFF
:00427DFB 3BC1                    cmp eax, ecx
:00427DFD 7528                    jne 00427E27
:00427DFF 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00427E02 E8692F0000              call 0042AD70
:00427E07 668BF0                  mov si, ax
:00427E0A 81E6FFFF0000            and esi, 0000FFFF
:00427E10 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00427E13 E8582F0000              call 0042AD70
:00427E18 25FFFF0000              and eax, 0000FFFF
:00427E1D 3BF0                    cmp esi, eax
:00427E1F 7E06                    jle 00427E27
:00427E21 66C745F80100            mov [ebp-08], 0001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00427DE8(U), :00427DFD(C), :00427E1F(C)
|
:00427E27 8B55F8                  mov edx, dword ptr [ebp-08]
:00427E2A 81E2FFFF0000            and edx, 0000FFFF
:00427E30 83FA01                  cmp edx, 00000001
:00427E33 7533                    jne 00427E68
:00427E35 668B45E4                mov ax, word ptr [ebp-1C]
:00427E39 668945FC                mov word ptr [ebp-04], ax
:00427E3D 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00427E40 81E1FFFF0000            and ecx, 0000FFFF
:00427E46 8B55DC                  mov edx, dword ptr [ebp-24]
:00427E49 89148DC0EF4900          mov dword ptr [4*ecx+0049EFC0], edx
:00427E50 8B45E8                  mov eax, dword ptr [ebp-18]
:00427E53 25FFFF0000              and eax, 0000FFFF
:00427E58 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00427E5B 890C85C0EF4900          mov dword ptr [4*eax+0049EFC0], ecx
:00427E62 8B55DC                  mov edx, dword ptr [ebp-24]
:00427E65 8955F4                  mov dword ptr [ebp-0C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427E33(C)
|
:00427E68 E9F2FEFFFF              jmp 00427D5F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427D7E(C)
|
:00427E6D E975FEFFFF              jmp 00427CE7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427D07(C)
|
:00427E72 5E                      pop esi
:00427E73 8BE5                    mov esp, ebp
:00427E75 5D                      pop ebp
:00427E76 C3                      ret



* Referenced by a CALL at Address:
|:00427FF8   
|
:00427E77 55                      push ebp
:00427E78 8BEC                    mov ebp, esp
:00427E7A 83EC0C                  sub esp, 0000000C
:00427E7D 66C705748049000000      mov word ptr [00498074], 0000
:00427E86 C745FC68CF4900          mov [ebp-04], 0049CF68
:00427E8D 66C745F80000            mov [ebp-08], 0000
:00427E93 EB15                    jmp 00427EAA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427EFE(U)
|
:00427E95 668B45F8                mov ax, word ptr [ebp-08]
:00427E99 66050100                add ax, 0001
:00427E9D 668945F8                mov word ptr [ebp-08], ax
:00427EA1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00427EA4 83C140                  add ecx, 00000040
:00427EA7 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427E93(U)
|
:00427EAA 8B55F8                  mov edx, dword ptr [ebp-08]
:00427EAD 81E2FFFF0000            and edx, 0000FFFF
:00427EB3 81FA80000000            cmp edx, 00000080
:00427EB9 7D45                    jge 00427F00
:00427EBB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00427EBE E88D0FFFFF              call 00418E50
:00427EC3 668945F4                mov word ptr [ebp-0C], ax
:00427EC7 8B45F4                  mov eax, dword ptr [ebp-0C]
:00427ECA 25FFFF0000              and eax, 0000FFFF
:00427ECF 2501800000              and eax, 00008001
:00427ED4 3D01800000              cmp eax, 00008001
:00427ED9 7523                    jne 00427EFE
:00427EDB 33C9                    xor ecx, ecx
:00427EDD 668B0D74804900          mov cx, word ptr [00498074]
:00427EE4 8B55FC                  mov edx, dword ptr [ebp-04]
:00427EE7 89148DC0EF4900          mov dword ptr [4*ecx+0049EFC0], edx
:00427EEE 66A174804900            mov ax, word ptr [00498074]
:00427EF4 66050100                add ax, 0001
:00427EF8 66A374804900            mov word ptr [00498074], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427ED9(C)
|
:00427EFE EB95                    jmp 00427E95

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427EB9(C)
|
:00427F00 8BE5                    mov esp, ebp
:00427F02 5D                      pop ebp
:00427F03 C3                      ret



* Referenced by a CALL at Addresses:
|:00427F3A   , :0042A3E7   
|
:00427F04 55                      push ebp
:00427F05 8BEC                    mov ebp, esp
:00427F07 51                      push ecx
:00427F08 8B4508                  mov eax, dword ptr [ebp+08]
:00427F0B 8A08                    mov cl, byte ptr [eax]
:00427F0D 884DFC                  mov byte ptr [ebp-04], cl
:00427F10 8B55FC                  mov edx, dword ptr [ebp-04]
:00427F13 81E2FF000000            and edx, 000000FF
:00427F19 660FB682D8B94800        movzx ax, byte ptr [edx+0048B9D8]
:00427F21 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00427F24 668901                  mov word ptr [ecx], ax
:00427F27 8A45FC                  mov al, byte ptr [ebp-04]
:00427F2A 8BE5                    mov esp, ebp
:00427F2C 5D                      pop ebp
:00427F2D C3                      ret



* Referenced by a CALL at Address:
|:0042A487   
|
:00427F2E 55                      push ebp
:00427F2F 8BEC                    mov ebp, esp
:00427F31 51                      push ecx
:00427F32 8D45FC                  lea eax, dword ptr [ebp-04]
:00427F35 50                      push eax
:00427F36 8B4D08                  mov ecx, dword ptr [ebp+08]
:00427F39 51                      push ecx
:00427F3A E8C5FFFFFF              call 00427F04
:00427F3F 83C408                  add esp, 00000008
:00427F42 8B55FC                  mov edx, dword ptr [ebp-04]
:00427F45 81E2FFFF0000            and edx, 0000FFFF
:00427F4B 8B4508                  mov eax, dword ptr [ebp+08]
:00427F4E 03C2                    add eax, edx
:00427F50 8BE5                    mov esp, ebp
:00427F52 5D                      pop ebp
:00427F53 C3                      ret


:00427F54 55                      push ebp
:00427F55 8BEC                    mov ebp, esp
:00427F57 51                      push ecx
:00427F58 8B450C                  mov eax, dword ptr [ebp+0C]
:00427F5B 25FFFF0000              and eax, 0000FFFF
:00427F60 85C0                    test eax, eax
:00427F62 7512                    jne 00427F76
:00427F64 8B4508                  mov eax, dword ptr [ebp+08]
:00427F67 33D2                    xor edx, edx
:00427F69 B910270000              mov ecx, 00002710
:00427F6E F7F1                    div ecx
:00427F70 668945FC                mov word ptr [ebp-04], ax
:00427F74 EB10                    jmp 00427F86

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427F62(C)
|
:00427F76 8B4508                  mov eax, dword ptr [ebp+08]
:00427F79 33D2                    xor edx, edx
:00427F7B B910270000              mov ecx, 00002710
:00427F80 F7F1                    div ecx
:00427F82 668955FC                mov word ptr [ebp-04], dx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427F74(U)
|
:00427F86 668B45FC                mov ax, word ptr [ebp-04]
:00427F8A 8BE5                    mov esp, ebp
:00427F8C 5D                      pop ebp
:00427F8D C3                      ret



* Referenced by a CALL at Addresses:
|:00428166   , :00429978   
|
:00427F8E 55                      push ebp
:00427F8F 8BEC                    mov ebp, esp
:00427F91 83EC0C                  sub esp, 0000000C
:00427F94 C745FCC0F14900          mov [ebp-04], 0049F1C0
:00427F9B 66C745F4A00F            mov [ebp-0C], 0FA0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00427FEC(C)
|
:00427FA1 8B45FC                  mov eax, dword ptr [ebp-04]
:00427FA4 668B08                  mov cx, word ptr [eax]
:00427FA7 66894DF8                mov word ptr [ebp-08], cx
:00427FAB 668B55F8                mov dx, word ptr [ebp-08]
:00427FAF 6683E202                and dx, 0002
:00427FB3 668955F8                mov word ptr [ebp-08], dx
:00427FB7 668B45F8                mov ax, word ptr [ebp-08]
:00427FBB 66D1E8                  shr ax, 1
:00427FBE 668945F8                mov word ptr [ebp-08], ax
:00427FC2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00427FC5 668B55F8                mov dx, word ptr [ebp-08]
:00427FC9 668911                  mov word ptr [ecx], dx
:00427FCC 8B45FC                  mov eax, dword ptr [ebp-04]
:00427FCF 83C002                  add eax, 00000002
:00427FD2 8945FC                  mov dword ptr [ebp-04], eax
:00427FD5 668B4DF4                mov cx, word ptr [ebp-0C]
:00427FD9 6683E901                sub cx, 0001
:00427FDD 66894DF4                mov word ptr [ebp-0C], cx
:00427FE1 8B55F4                  mov edx, dword ptr [ebp-0C]
:00427FE4 81E2FFFF0000            and edx, 0000FFFF
:00427FEA 85D2                    test edx, edx
:00427FEC 75B3                    jne 00427FA1
:00427FEE 8BE5                    mov esp, ebp
:00427FF0 5D                      pop ebp
:00427FF1 C3                      ret



* Referenced by a CALL at Addresses:
|:004281AA   , :00429982   
|
:00427FF2 55                      push ebp
:00427FF3 8BEC                    mov ebp, esp
:00427FF5 83EC20                  sub esp, 00000020
:00427FF8 E87AFEFFFF              call 00427E77
:00427FFD E835FCFFFF              call 00427C37
:00428002 68B8010000              push 000001B8
:00428007 6880020000              push 00000280
:0042800C 6A28                    push 00000028
:0042800E 6A00                    push 00000000
:00428010 E86C520500              call 0047D281
:00428015 83C410                  add esp, 00000010
:00428018 A1A4CE4900              mov eax, dword ptr [0049CEA4]
:0042801D 8945F8                  mov dword ptr [ebp-08], eax
:00428020 668B0DF0CE4900          mov cx, word ptr [0049CEF0]
:00428027 66894DF0                mov word ptr [ebp-10], cx
:0042802B 66C745EC2800            mov [ebp-14], 0028
:00428031 C745FCC0F14900          mov [ebp-04], 0049F1C0
:00428038 6A00                    push 00000000
:0042803A E8A44A0500              call 0047CAE3
:0042803F 83C404                  add esp, 00000004
:00428042 6A00                    push 00000000
:00428044 6A00                    push 00000000
:00428046 6A00                    push 00000000
:00428048 E8A4510500              call 0047D1F1
:0042804D 83C40C                  add esp, 0000000C
:00428050 66C745E80000            mov [ebp-18], 0000
:00428056 EB0C                    jmp 00428064

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042813C(U)
|
:00428058 668B55E8                mov dx, word ptr [ebp-18]
:0042805C 6683C201                add dx, 0001
:00428060 668955E8                mov word ptr [ebp-18], dx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428056(U)
|
:00428064 8B45E8                  mov eax, dword ptr [ebp-18]
:00428067 25FFFF0000              and eax, 0000FFFF
:0042806C 83F832                  cmp eax, 00000032
:0042806F 0F8DCC000000            jnl 00428141
:00428075 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00428078 894DF4                  mov dword ptr [ebp-0C], ecx
:0042807B 66C745E40000            mov [ebp-1C], 0000
:00428081 EB21                    jmp 004280A4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042810E(U)
|
:00428083 668B55F0                mov dx, word ptr [ebp-10]
:00428087 6683C208                add dx, 0008
:0042808B 668955F0                mov word ptr [ebp-10], dx
:0042808F 668B45E4                mov ax, word ptr [ebp-1C]
:00428093 66050100                add ax, 0001
:00428097 668945E4                mov word ptr [ebp-1C], ax
:0042809B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042809E 83C102                  add ecx, 00000002
:004280A1 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428081(U)
|
:004280A4 8B55E4                  mov edx, dword ptr [ebp-1C]
:004280A7 81E2FFFF0000            and edx, 0000FFFF
:004280AD 83FA50                  cmp edx, 00000050
:004280B0 7D61                    jge 00428113
:004280B2 8B45FC                  mov eax, dword ptr [ebp-04]
:004280B5 668B08                  mov cx, word ptr [eax]
:004280B8 66894DE0                mov word ptr [ebp-20], cx
:004280BC 8B55FC                  mov edx, dword ptr [ebp-04]
:004280BF 83C202                  add edx, 00000002
:004280C2 8955FC                  mov dword ptr [ebp-04], edx
:004280C5 8B45E0                  mov eax, dword ptr [ebp-20]
:004280C8 25FFFF0000              and eax, 0000FFFF
:004280CD 83E003                  and eax, 00000003
:004280D0 85C0                    test eax, eax
:004280D2 743A                    je 0042810E
:004280D4 6A04                    push 00000004
:004280D6 6A00                    push 00000000
:004280D8 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004280DB 33D2                    xor edx, edx
:004280DD 668B11                  mov dx, word ptr [ecx]
:004280E0 C1E206                  shl edx, 06
:004280E3 52                      push edx
:004280E4 B980AB4A00              mov ecx, 004AAB80
:004280E9 E852790500              call 0047FA40
:004280EE 50                      push eax
:004280EF 6A08                    push 00000008
:004280F1 6A08                    push 00000008
:004280F3 8B45EC                  mov eax, dword ptr [ebp-14]
:004280F6 25FFFF0000              and eax, 0000FFFF
:004280FB 50                      push eax
:004280FC 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004280FF 81E1FFFF0000            and ecx, 0000FFFF
:00428105 51                      push ecx
:00428106 E8905F0500              call 0047E09B
:0042810B 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004280D2(C)
|
:0042810E E970FFFFFF              jmp 00428083

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004280B0(C)
|
:00428113 668B15F0CE4900          mov dx, word ptr [0049CEF0]
:0042811A 668955F0                mov word ptr [ebp-10], dx
:0042811E 668B45EC                mov ax, word ptr [ebp-14]
:00428122 66050800                add ax, 0008
:00428126 668945EC                mov word ptr [ebp-14], ax
:0042812A 33C9                    xor ecx, ecx
:0042812C 668B0DB0CE4900          mov cx, word ptr [0049CEB0]
:00428133 8B55F8                  mov edx, dword ptr [ebp-08]
:00428136 8D044A                  lea eax, dword ptr [edx+2*ecx]
:00428139 8945F8                  mov dword ptr [ebp-08], eax
:0042813C E917FFFFFF              jmp 00428058

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042806F(C)
|
:00428141 E84EF9FFFF              call 00427A94
:00428146 68B8010000              push 000001B8
:0042814B 6880020000              push 00000280
:00428150 6A28                    push 00000028
:00428152 6A00                    push 00000000
:00428154 E828510500              call 0047D281
:00428159 83C410                  add esp, 00000010
:0042815C 8BE5                    mov esp, ebp
:0042815E 5D                      pop ebp
:0042815F C3                      ret



* Referenced by a CALL at Address:
|:004281BB   
|
:00428160 55                      push ebp
:00428161 8BEC                    mov ebp, esp
:00428163 83EC08                  sub esp, 00000008
:00428166 E823FEFFFF              call 00427F8E
:0042816B C745FCC0F14900          mov [ebp-04], 0049F1C0
:00428172 66C745F80000            mov [ebp-08], 0000
:00428178 EB15                    jmp 0042818F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004281A8(U)
|
:0042817A 668B45F8                mov ax, word ptr [ebp-08]
:0042817E 66050100                add ax, 0001
:00428182 668945F8                mov word ptr [ebp-08], ax
:00428186 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00428189 83C102                  add ecx, 00000002
:0042818C 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428178(U)
|
:0042818F 8B55F8                  mov edx, dword ptr [ebp-08]
:00428192 81E2FFFF0000            and edx, 0000FFFF
:00428198 81FAA00F0000            cmp edx, 00000FA0
:0042819E 7D0A                    jge 004281AA
:004281A0 8B45FC                  mov eax, dword ptr [ebp-04]
:004281A3 66C7000900              mov word ptr [eax], 0009
:004281A8 EBD0                    jmp 0042817A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042819E(C)
|
:004281AA E843FEFFFF              call 00427FF2
:004281AF 8BE5                    mov esp, ebp
:004281B1 5D                      pop ebp
:004281B2 C3                      ret



* Referenced by a CALL at Addresses:
|:00428B08   , :00428B14   , :00429AA0   , :00429AE0   , :0042A270   
|:0042A2BB   
|
:004281B3 55                      push ebp
:004281B4 8BEC                    mov ebp, esp
:004281B6 E82064FFFF              call 0041E5DB
:004281BB E8A0FFFFFF              call 00428160
:004281C0 E83164FFFF              call 0041E5F6
:004281C5 5D                      pop ebp
:004281C6 C3                      ret



* Referenced by a CALL at Addresses:
|:00428324   , :00428837   , :004293F3   
|
:004281C7 55                      push ebp
:004281C8 8BEC                    mov ebp, esp
:004281CA 83EC10                  sub esp, 00000010
:004281CD 56                      push esi
:004281CE 668B4510                mov ax, word ptr [ebp+10]
:004281D2 662D0100                sub ax, 0001
:004281D6 66894510                mov word ptr [ebp+10], ax
:004281DA 668B4D14                mov cx, word ptr [ebp+14]
:004281DE 6683E901                sub cx, 0001
:004281E2 66894D14                mov word ptr [ebp+14], cx
:004281E6 8B550C                  mov edx, dword ptr [ebp+0C]
:004281E9 0FBF02                  movsx eax, word ptr [edx]
:004281EC 8B4D18                  mov ecx, dword ptr [ebp+18]
:004281EF 81E1FFFF0000            and ecx, 0000FFFF
:004281F5 0FBF144DB0B84800        movsx edx, word ptr [2*ecx+0048B8B0]
:004281FD 03C2                    add eax, edx
:004281FF 8B4D14                  mov ecx, dword ptr [ebp+14]
:00428202 81E1FFFF0000            and ecx, 0000FFFF
:00428208 2BC1                    sub eax, ecx
:0042820A 668945FC                mov word ptr [ebp-04], ax
:0042820E 8B5508                  mov edx, dword ptr [ebp+08]
:00428211 0FBF02                  movsx eax, word ptr [edx]
:00428214 8B4D18                  mov ecx, dword ptr [ebp+18]
:00428217 81E1FFFF0000            and ecx, 0000FFFF
:0042821D 0FBF144DC0B84800        movsx edx, word ptr [2*ecx+0048B8C0]
:00428225 03C2                    add eax, edx
:00428227 668945F0                mov word ptr [ebp-10], ax
:0042822B 0FBF45F0                movsx eax, word ptr [ebp-10]
:0042822F 8B4D10                  mov ecx, dword ptr [ebp+10]
:00428232 81E1FFFF0000            and ecx, 0000FFFF
:00428238 03C1                    add eax, ecx
:0042823A 668945F8                mov word ptr [ebp-08], ax
:0042823E 0FBF55FC                movsx edx, word ptr [ebp-04]
:00428242 8B4514                  mov eax, dword ptr [ebp+14]
:00428245 25FFFF0000              and eax, 0000FFFF
:0042824A 2BD0                    sub edx, eax
:0042824C 668955F4                mov word ptr [ebp-0C], dx
:00428250 0FBF4DF0                movsx ecx, word ptr [ebp-10]
:00428254 85C9                    test ecx, ecx
:00428256 0F8CA7000000            jl 00428303
:0042825C 0FBF75F0                movsx esi, word ptr [ebp-10]
:00428260 6A02                    push 00000002
:00428262 E84FE9FFFF              call 00426BB6
:00428267 83C404                  add esp, 00000004
:0042826A 25FFFF0000              and eax, 0000FFFF
:0042826F 3BF0                    cmp esi, eax
:00428271 0F8D8C000000            jnl 00428303
:00428277 0FBF55F8                movsx edx, word ptr [ebp-08]
:0042827B 85D2                    test edx, edx
:0042827D 0F8C80000000            jl 00428303
:00428283 0FBF75F8                movsx esi, word ptr [ebp-08]
:00428287 6A02                    push 00000002
:00428289 E828E9FFFF              call 00426BB6
:0042828E 83C404                  add esp, 00000004
:00428291 25FFFF0000              and eax, 0000FFFF
:00428296 3BF0                    cmp esi, eax
:00428298 7D69                    jge 00428303
:0042829A 0FBF45FC                movsx eax, word ptr [ebp-04]
:0042829E 85C0                    test eax, eax
:004282A0 7C61                    jl 00428303
:004282A2 0FBF75FC                movsx esi, word ptr [ebp-04]
:004282A6 6A04                    push 00000004
:004282A8 E809E9FFFF              call 00426BB6
:004282AD 83C404                  add esp, 00000004
:004282B0 25FFFF0000              and eax, 0000FFFF
:004282B5 3BF0                    cmp esi, eax
:004282B7 7D4A                    jge 00428303
:004282B9 0FBF4DF4                movsx ecx, word ptr [ebp-0C]
:004282BD 85C9                    test ecx, ecx
:004282BF 7C42                    jl 00428303
:004282C1 0FBF75F4                movsx esi, word ptr [ebp-0C]
:004282C5 6A04                    push 00000004
:004282C7 E8EAE8FFFF              call 00426BB6
:004282CC 83C404                  add esp, 00000004
:004282CF 25FFFF0000              and eax, 0000FFFF
:004282D4 3BF0                    cmp esi, eax
:004282D6 7D2B                    jge 00428303
:004282D8 8B5508                  mov edx, dword ptr [ebp+08]
:004282DB 668B45F0                mov ax, word ptr [ebp-10]
:004282DF 668902                  mov word ptr [edx], ax
:004282E2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004282E5 81E1FFFF0000            and ecx, 0000FFFF
:004282EB 8B5514                  mov edx, dword ptr [ebp+14]
:004282EE 81E2FFFF0000            and edx, 0000FFFF
:004282F4 03CA                    add ecx, edx
:004282F6 8B450C                  mov eax, dword ptr [ebp+0C]
:004282F9 668908                  mov word ptr [eax], cx
:004282FC B801000000              mov eax, 00000001
:00428301 EB02                    jmp 00428305

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00428256(C), :00428271(C), :0042827D(C), :00428298(C), :004282A0(C)
|:004282B7(C), :004282BF(C), :004282D6(C)
|
:00428303 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428301(U)
|
:00428305 5E                      pop esi
:00428306 8BE5                    mov esp, ebp
:00428308 5D                      pop ebp
:00428309 C3                      ret



* Referenced by a CALL at Addresses:
|:0042844A   , :00428DE0   , :00428F6D   , :0042A57F   
|
:0042830A 55                      push ebp
:0042830B 8BEC                    mov ebp, esp
:0042830D 668B4518                mov ax, word ptr [ebp+18]
:00428311 50                      push eax
:00428312 668B4D14                mov cx, word ptr [ebp+14]
:00428316 51                      push ecx
:00428317 668B5510                mov dx, word ptr [ebp+10]
:0042831B 52                      push edx
:0042831C 8B450C                  mov eax, dword ptr [ebp+0C]
:0042831F 50                      push eax
:00428320 8B4D08                  mov ecx, dword ptr [ebp+08]
:00428323 51                      push ecx
:00428324 E89EFEFFFF              call 004281C7
:00428329 83C414                  add esp, 00000014
:0042832C 85C0                    test eax, eax
:0042832E 7506                    jne 00428336
:00428330 660DFFFF                or ax, FFFF
:00428334 EB36                    jmp 0042836C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042832E(C)
|
:00428336 6A01                    push 00000001
:00428338 668B5514                mov dx, word ptr [ebp+14]
:0042833C 52                      push edx
:0042833D 668B4510                mov ax, word ptr [ebp+10]
:00428341 50                      push eax
:00428342 6A00                    push 00000000
:00428344 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00428347 668B11                  mov dx, word ptr [ecx]
:0042834A 52                      push edx
:0042834B 8B4508                  mov eax, dword ptr [ebp+08]
:0042834E 668B08                  mov cx, word ptr [eax]
:00428351 51                      push ecx
:00428352 E870EEFFFF              call 004271C7
:00428357 83C418                  add esp, 00000018
:0042835A 25FFFF0000              and eax, 0000FFFF
:0042835F 85C0                    test eax, eax
:00428361 7406                    je 00428369
:00428363 660DFFFF                or ax, FFFF
:00428367 EB03                    jmp 0042836C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428361(C)
|
:00428369 6633C0                  xor ax, ax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00428334(U), :00428367(U)
|
:0042836C 5D                      pop ebp
:0042836D C3                      ret



* Referenced by a CALL at Address:
|:00428779   
|
:0042836E 55                      push ebp
:0042836F 8BEC                    mov ebp, esp
:00428371 83EC28                  sub esp, 00000028
:00428374 6A04                    push 00000004
:00428376 6A00                    push 00000000
:00428378 6A00                    push 00000000
:0042837A B968AB4A00              mov ecx, 004AAB68
:0042837F E8BC760500              call 0047FA40
:00428384 8945EC                  mov dword ptr [ebp-14], eax
:00428387 8B45EC                  mov eax, dword ptr [ebp-14]
:0042838A 8945F4                  mov dword ptr [ebp-0C], eax
:0042838D 6A02                    push 00000002
:0042838F E822E8FFFF              call 00426BB6
:00428394 83C404                  add esp, 00000004
:00428397 668945D8                mov word ptr [ebp-28], ax
:0042839B 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0042839E 81E1FFFF0000            and ecx, 0000FFFF
:004283A4 8B55D8                  mov edx, dword ptr [ebp-28]
:004283A7 81E2FFFF0000            and edx, 0000FFFF
:004283AD 0FAFCA                  imul ecx, edx
:004283B0 8B45F4                  mov eax, dword ptr [ebp-0C]
:004283B3 8D0C48                  lea ecx, dword ptr [eax+2*ecx]
:004283B6 8B5508                  mov edx, dword ptr [ebp+08]
:004283B9 81E2FFFF0000            and edx, 0000FFFF
:004283BF 668B0451                mov ax, word ptr [ecx+2*edx]
:004283C3 668945DC                mov word ptr [ebp-24], ax
:004283C7 8B4DDC                  mov ecx, dword ptr [ebp-24]
:004283CA 81E1FFFF0000            and ecx, 0000FFFF
:004283D0 85C9                    test ecx, ecx
:004283D2 7509                    jne 004283DD
:004283D4 660DFFFF                or ax, FFFF
:004283D8 E9DB000000              jmp 004284B8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004283D2(C)
|
:004283DD 66C745F8FFFF            mov [ebp-08], FFFF
:004283E3 66C745E40000            mov [ebp-1C], 0000
:004283E9 EB0C                    jmp 004283F7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004284AF(U)
|
:004283EB 668B55E4                mov dx, word ptr [ebp-1C]
:004283EF 6683C201                add dx, 0001
:004283F3 668955E4                mov word ptr [ebp-1C], dx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004283E9(U)
|
:004283F7 8B45E4                  mov eax, dword ptr [ebp-1C]
:004283FA 25FFFF0000              and eax, 0000FFFF
:004283FF 83F804                  cmp eax, 00000004
:00428402 0F8DAC000000            jnl 004284B4
:00428408 33C9                    xor ecx, ecx
:0042840A 668B0D58804900          mov cx, word ptr [00498058]
:00428411 8B55E4                  mov edx, dword ptr [ebp-1C]
:00428414 81E2FFFF0000            and edx, 0000FFFF
:0042841A 03CA                    add ecx, edx
:0042841C 83E103                  and ecx, 00000003
:0042841F 66894DE0                mov word ptr [ebp-20], cx
:00428423 668B4508                mov ax, word ptr [ebp+08]
:00428427 668945F0                mov word ptr [ebp-10], ax
:0042842B 668B4D0C                mov cx, word ptr [ebp+0C]
:0042842F 66894DE8                mov word ptr [ebp-18], cx
:00428433 668B55E0                mov dx, word ptr [ebp-20]
:00428437 52                      push edx
:00428438 668B4514                mov ax, word ptr [ebp+14]
:0042843C 50                      push eax
:0042843D 668B4D10                mov cx, word ptr [ebp+10]
:00428441 51                      push ecx
:00428442 8D55E8                  lea edx, dword ptr [ebp-18]
:00428445 52                      push edx
:00428446 8D45F0                  lea eax, dword ptr [ebp-10]
:00428449 50                      push eax
:0042844A E8BBFEFFFF              call 0042830A
:0042844F 83C414                  add esp, 00000014
:00428452 25FFFF0000              and eax, 0000FFFF
:00428457 3DFFFF0000              cmp eax, 0000FFFF
:0042845C 7451                    je 004284AF
:0042845E 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00428461 81E1FFFF0000            and ecx, 0000FFFF
:00428467 8B55D8                  mov edx, dword ptr [ebp-28]
:0042846A 81E2FFFF0000            and edx, 0000FFFF
:00428470 0FAFCA                  imul ecx, edx
:00428473 8B45F4                  mov eax, dword ptr [ebp-0C]
:00428476 8D0C48                  lea ecx, dword ptr [eax+2*ecx]
:00428479 8B55F0                  mov edx, dword ptr [ebp-10]
:0042847C 81E2FFFF0000            and edx, 0000FFFF
:00428482 8D0451                  lea eax, dword ptr [ecx+2*edx]
:00428485 8945FC                  mov dword ptr [ebp-04], eax
:00428488 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0042848B 81E1FFFF0000            and ecx, 0000FFFF
:00428491 8B55FC                  mov edx, dword ptr [ebp-04]
:00428494 33C0                    xor eax, eax
:00428496 668B02                  mov ax, word ptr [edx]
:00428499 3BC8                    cmp ecx, eax
:0042849B 7E12                    jle 004284AF
:0042849D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004284A0 668B11                  mov dx, word ptr [ecx]
:004284A3 668955DC                mov word ptr [ebp-24], dx
:004284A7 668B45E0                mov ax, word ptr [ebp-20]
:004284AB 668945F8                mov word ptr [ebp-08], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042845C(C), :0042849B(C)
|
:004284AF E937FFFFFF              jmp 004283EB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428402(C)
|
:004284B4 668B45F8                mov ax, word ptr [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004283D8(U)
|
:004284B8 8BE5                    mov esp, ebp
:004284BA 5D                      pop ebp
:004284BB C3                      ret


:004284BC 55                      push ebp
:004284BD 8BEC                    mov ebp, esp
:004284BF 66B80100                mov ax, 0001
:004284C3 5D                      pop ebp
:004284C4 C3                      ret



* Referenced by a CALL at Address:
|:004286BA   
|
:004284C5 55                      push ebp
:004284C6 8BEC                    mov ebp, esp
:004284C8 83EC08                  sub esp, 00000008
:004284CB C745FC01000000          mov [ebp-04], 00000001
:004284D2 C745F800000000          mov [ebp-08], 00000000
:004284D9 EB11                    jmp 004284EC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428501(U)
|
:004284DB 8B45F8                  mov eax, dword ptr [ebp-08]
:004284DE 83C001                  add eax, 00000001
:004284E1 8945F8                  mov dword ptr [ebp-08], eax
:004284E4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004284E7 D1E1                    shl ecx, 1
:004284E9 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004284D9(U)
|
:004284EC 837DF820                cmp dword ptr [ebp-08], 00000020
:004284F0 7311                    jnb 00428503
:004284F2 8B1570804900            mov edx, dword ptr [00498070]
:004284F8 2355FC                  and edx, dword ptr [ebp-04]
:004284FB 85D2                    test edx, edx
:004284FD 7502                    jne 00428501
:004284FF EB02                    jmp 00428503

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004284FD(C)
|
:00428501 EBD8                    jmp 004284DB

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004284F0(C), :004284FF(U)
|
:00428503 837DF820                cmp dword ptr [ebp-08], 00000020
:00428507 7506                    jne 0042850F
:00428509 660DFFFF                or ax, FFFF
:0042850D EB1C                    jmp 0042852B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428507(C)
|
:0042850F B801000000              mov eax, 00000001
:00428514 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00428517 D3E0                    shl eax, cl
:00428519 8B0D70804900            mov ecx, dword ptr [00498070]
:0042851F 0BC8                    or ecx, eax
:00428521 890D70804900            mov dword ptr [00498070], ecx
:00428527 668B45F8                mov ax, word ptr [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042850D(U)
|
:0042852B 8BE5                    mov esp, ebp
:0042852D 5D                      pop ebp
:0042852E C3                      ret



* Referenced by a CALL at Address:
|:00429D5A   
|
:0042852F 55                      push ebp
:00428530 8BEC                    mov ebp, esp
:00428532 8B4508                  mov eax, dword ptr [ebp+08]
:00428535 25FFFF0000              and eax, 0000FFFF
:0042853A 83F820                  cmp eax, 00000020
:0042853D 7D1E                    jge 0042855D
:0042853F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00428542 81E1FFFF0000            and ecx, 0000FFFF
:00428548 BA01000000              mov edx, 00000001
:0042854D D3E2                    shl edx, cl
:0042854F F7D2                    not edx
:00428551 A170804900              mov eax, dword ptr [00498070]
:00428556 23C2                    and eax, edx
:00428558 A370804900              mov dword ptr [00498070], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042853D(C)
|
:0042855D 5D                      pop ebp
:0042855E C3                      ret



* Referenced by a CALL at Addresses:
|:00428751   , :00429B75   
|
:0042855F 55                      push ebp
:00428560 8BEC                    mov ebp, esp
:00428562 83EC08                  sub esp, 00000008
:00428565 0FBF4510                movsx eax, word ptr [ebp+10]
:00428569 0FBF4D08                movsx ecx, word ptr [ebp+08]
:0042856D 3BC1                    cmp eax, ecx
:0042856F 0F8E91000000            jle 00428606
:00428575 0FBF5514                movsx edx, word ptr [ebp+14]
:00428579 0FBF450C                movsx eax, word ptr [ebp+0C]
:0042857D 3BD0                    cmp edx, eax
:0042857F 7E41                    jle 004285C2
:00428581 0FBF4D10                movsx ecx, word ptr [ebp+10]
:00428585 0FBF5508                movsx edx, word ptr [ebp+08]
:00428589 2BCA                    sub ecx, edx
:0042858B 66894DFC                mov word ptr [ebp-04], cx
:0042858F 0FBF4514                movsx eax, word ptr [ebp+14]
:00428593 0FBF4D0C                movsx ecx, word ptr [ebp+0C]
:00428597 2BC1                    sub eax, ecx
:00428599 668945F8                mov word ptr [ebp-08], ax
:0042859D 8B55FC                  mov edx, dword ptr [ebp-04]
:004285A0 81E2FFFF0000            and edx, 0000FFFF
:004285A6 8B45F8                  mov eax, dword ptr [ebp-08]
:004285A9 25FFFF0000              and eax, 0000FFFF
:004285AE 3BD0                    cmp edx, eax
:004285B0 7C08                    jl 004285BA
:004285B2 66C745FC0100            mov [ebp-04], 0001
:004285B8 EB06                    jmp 004285C0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004285B0(C)
|
:004285BA 66C745FC0200            mov [ebp-04], 0002

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004285B8(U)
|
:004285C0 EB3F                    jmp 00428601

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042857F(C)
|
:004285C2 0FBF4D10                movsx ecx, word ptr [ebp+10]
:004285C6 0FBF5508                movsx edx, word ptr [ebp+08]
:004285CA 2BCA                    sub ecx, edx
:004285CC 66894DFC                mov word ptr [ebp-04], cx
:004285D0 0FBF450C                movsx eax, word ptr [ebp+0C]
:004285D4 0FBF4D14                movsx ecx, word ptr [ebp+14]
:004285D8 2BC1                    sub eax, ecx
:004285DA 668945F8                mov word ptr [ebp-08], ax
:004285DE 8B55FC                  mov edx, dword ptr [ebp-04]
:004285E1 81E2FFFF0000            and edx, 0000FFFF
:004285E7 8B45F8                  mov eax, dword ptr [ebp-08]
:004285EA 25FFFF0000              and eax, 0000FFFF
:004285EF 3BD0                    cmp edx, eax
:004285F1 7C08                    jl 004285FB
:004285F3 66C745FC0100            mov [ebp-04], 0001
:004285F9 EB06                    jmp 00428601

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004285F1(C)
|
:004285FB 66C745FC0000            mov [ebp-04], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004285C0(U), :004285F9(U)
|
:00428601 E98E000000              jmp 00428694

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042856F(C)
|
:00428606 0FBF4D14                movsx ecx, word ptr [ebp+14]
:0042860A 0FBF550C                movsx edx, word ptr [ebp+0C]
:0042860E 3BCA                    cmp ecx, edx
:00428610 7E42                    jle 00428654
:00428612 0FBF4508                movsx eax, word ptr [ebp+08]
:00428616 0FBF4D10                movsx ecx, word ptr [ebp+10]
:0042861A 2BC1                    sub eax, ecx
:0042861C 668945FC                mov word ptr [ebp-04], ax
:00428620 0FBF5514                movsx edx, word ptr [ebp+14]
:00428624 0FBF450C                movsx eax, word ptr [ebp+0C]
:00428628 2BD0                    sub edx, eax
:0042862A 668955F8                mov word ptr [ebp-08], dx
:0042862E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00428631 81E1FFFF0000            and ecx, 0000FFFF
:00428637 8B55F8                  mov edx, dword ptr [ebp-08]
:0042863A 81E2FFFF0000            and edx, 0000FFFF
:00428640 3BCA                    cmp ecx, edx
:00428642 7C08                    jl 0042864C
:00428644 66C745FC0300            mov [ebp-04], 0003
:0042864A EB06                    jmp 00428652

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428642(C)
|
:0042864C 66C745FC0200            mov [ebp-04], 0002

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042864A(U)
|
:00428652 EB40                    jmp 00428694

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428610(C)
|
:00428654 0FBF4508                movsx eax, word ptr [ebp+08]
:00428658 0FBF4D10                movsx ecx, word ptr [ebp+10]
:0042865C 2BC1                    sub eax, ecx
:0042865E 668945FC                mov word ptr [ebp-04], ax
:00428662 0FBF550C                movsx edx, word ptr [ebp+0C]
:00428666 0FBF4514                movsx eax, word ptr [ebp+14]
:0042866A 2BD0                    sub edx, eax
:0042866C 668955F8                mov word ptr [ebp-08], dx
:00428670 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00428673 81E1FFFF0000            and ecx, 0000FFFF
:00428679 8B55F8                  mov edx, dword ptr [ebp-08]
:0042867C 81E2FFFF0000            and edx, 0000FFFF
:00428682 3BCA                    cmp ecx, edx
:00428684 7C08                    jl 0042868E
:00428686 66C745FC0300            mov [ebp-04], 0003
:0042868C EB06                    jmp 00428694

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428684(C)
|
:0042868E 66C745FC0000            mov [ebp-04], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00428601(U), :00428652(U), :0042868C(U)
|
:00428694 668B45FC                mov ax, word ptr [ebp-04]
:00428698 8BE5                    mov esp, ebp
:0042869A 5D                      pop ebp
:0042869B C3                      ret



* Referenced by a CALL at Address:
|:00429214   
|
:0042869C 55                      push ebp
:0042869D 8BEC                    mov ebp, esp
:0042869F 83EC24                  sub esp, 00000024
:004286A2 8B4D08                  mov ecx, dword ptr [ebp+08]
:004286A5 E876230000              call 0042AA20
:004286AA 668945F0                mov word ptr [ebp-10], ax
:004286AE 8B4D08                  mov ecx, dword ptr [ebp+08]
:004286B1 E81A270000              call 0042ADD0
:004286B6 668945EC                mov word ptr [ebp-14], ax
:004286BA E806FEFFFF              call 004284C5
:004286BF 668945E0                mov word ptr [ebp-20], ax
:004286C3 8B45E0                  mov eax, dword ptr [ebp-20]
:004286C6 25FFFF0000              and eax, 0000FFFF
:004286CB 3DFFFF0000              cmp eax, 0000FFFF
:004286D0 7509                    jne 004286DB
:004286D2 660DFFFF                or ax, FFFF
:004286D6 E978010000              jmp 00428853

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004286D0(C)
|
:004286DB 668B4DE0                mov cx, word ptr [ebp-20]
:004286DF 51                      push ecx
:004286E0 8B4D08                  mov ecx, dword ptr [ebp+08]
:004286E3 E808280000              call 0042AEF0
:004286E8 8B55E0                  mov edx, dword ptr [ebp-20]
:004286EB 81E2FFFF0000            and edx, 0000FFFF
:004286F1 C1E20A                  shl edx, 0A
:004286F4 668955F4                mov word ptr [ebp-0C], dx
:004286F8 668B45F4                mov ax, word ptr [ebp-0C]
:004286FC 50                      push eax
:004286FD 8B4D08                  mov ecx, dword ptr [ebp+08]
:00428700 E80B280000              call 0042AF10
:00428705 6A04                    push 00000004
:00428707 6A00                    push 00000000
:00428709 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042870C 81E1FFFF0000            and ecx, 0000FFFF
:00428712 51                      push ecx
:00428713 B9C8E44A00              mov ecx, 004AE4C8
:00428718 E823730500              call 0047FA40
:0042871D 8945FC                  mov dword ptr [ebp-04], eax
:00428720 8B4D08                  mov ecx, dword ptr [ebp+08]
:00428723 E8C8250000              call 0042ACF0
:00428728 668945E8                mov word ptr [ebp-18], ax
:0042872C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042872F E8DC250000              call 0042AD10
:00428734 668945E4                mov word ptr [ebp-1C], ax
:00428738 668B15ECCE4900          mov dx, word ptr [0049CEEC]
:0042873F 52                      push edx
:00428740 66A1E8CE4900            mov ax, word ptr [0049CEE8]
:00428746 50                      push eax
:00428747 668B4DEC                mov cx, word ptr [ebp-14]
:0042874B 51                      push ecx
:0042874C 668B55F0                mov dx, word ptr [ebp-10]
:00428750 52                      push edx
:00428751 E809FEFFFF              call 0042855F
:00428756 83C410                  add esp, 00000010
:00428759 66A358804900            mov word ptr [00498058], ax
:0042875F 66C745F80000            mov [ebp-08], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042884B(U)
|
:00428765 668B45E4                mov ax, word ptr [ebp-1C]
:00428769 50                      push eax
:0042876A 668B4DE8                mov cx, word ptr [ebp-18]
:0042876E 51                      push ecx
:0042876F 668B55EC                mov dx, word ptr [ebp-14]
:00428773 52                      push edx
:00428774 668B45F0                mov ax, word ptr [ebp-10]
:00428778 50                      push eax
:00428779 E8F0FBFFFF              call 0042836E
:0042877E 83C410                  add esp, 00000010
:00428781 668945DC                mov word ptr [ebp-24], ax
:00428785 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00428788 81E1FFFF0000            and ecx, 0000FFFF
:0042878E 81F9FFFF0000            cmp ecx, 0000FFFF
:00428794 756E                    jne 00428804
:00428796 8B550C                  mov edx, dword ptr [ebp+0C]
:00428799 81E2FFFF0000            and edx, 0000FFFF
:0042879F 81FAFFFF0000            cmp edx, 0000FFFF
:004287A5 741A                    je 004287C1
:004287A7 8B450C                  mov eax, dword ptr [ebp+0C]
:004287AA 25FF000000              and eax, 000000FF
:004287AF 0C10                    or al, 10
:004287B1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004287B4 8801                    mov byte ptr [ecx], al
:004287B6 8B55FC                  mov edx, dword ptr [ebp-04]
:004287B9 83C201                  add edx, 00000001
:004287BC 8955FC                  mov dword ptr [ebp-04], edx
:004287BF EB3B                    jmp 004287FC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004287A5(C)
|
:004287C1 8B4510                  mov eax, dword ptr [ebp+10]
:004287C4 25FFFF0000              and eax, 0000FFFF
:004287C9 85C0                    test eax, eax
:004287CB 742F                    je 004287FC
:004287CD 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004287D0 81E1FFFF0000            and ecx, 0000FFFF
:004287D6 8B5510                  mov edx, dword ptr [ebp+10]
:004287D9 81E2FFFF0000            and edx, 0000FFFF
:004287DF 3BCA                    cmp ecx, edx
:004287E1 7D08                    jge 004287EB
:004287E3 668B45F8                mov ax, word ptr [ebp-08]
:004287E7 66894510                mov word ptr [ebp+10], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004287E1(C)
|
:004287EB 8B4D10                  mov ecx, dword ptr [ebp+10]
:004287EE 81E1FFFF0000            and ecx, 0000FFFF
:004287F4 8B55FC                  mov edx, dword ptr [ebp-04]
:004287F7 2BD1                    sub edx, ecx
:004287F9 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004287BF(U), :004287CB(C)
|
:004287FC 8B45FC                  mov eax, dword ptr [ebp-04]
:004287FF C600EF                  mov byte ptr [eax], EF
:00428802 EB4C                    jmp 00428850

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428794(C)
|
:00428804 668B4DDC                mov cx, word ptr [ebp-24]
:00428808 66890D58804900          mov word ptr [00498058], cx
:0042880F 8B55FC                  mov edx, dword ptr [ebp-04]
:00428812 8A45DC                  mov al, byte ptr [ebp-24]
:00428815 8802                    mov byte ptr [edx], al
:00428817 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042881A 83C101                  add ecx, 00000001
:0042881D 894DFC                  mov dword ptr [ebp-04], ecx
:00428820 668B55DC                mov dx, word ptr [ebp-24]
:00428824 52                      push edx
:00428825 668B45E4                mov ax, word ptr [ebp-1C]
:00428829 50                      push eax
:0042882A 668B4DE8                mov cx, word ptr [ebp-18]
:0042882E 51                      push ecx
:0042882F 8D55EC                  lea edx, dword ptr [ebp-14]
:00428832 52                      push edx
:00428833 8D45F0                  lea eax, dword ptr [ebp-10]
:00428836 50                      push eax
:00428837 E88BF9FFFF              call 004281C7
:0042883C 83C414                  add esp, 00000014
:0042883F 668B4DF8                mov cx, word ptr [ebp-08]
:00428843 6683C101                add cx, 0001
:00428847 66894DF8                mov word ptr [ebp-08], cx
:0042884B E915FFFFFF              jmp 00428765

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428802(U)
|
:00428850 6633C0                  xor ax, ax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004286D6(U)
|
:00428853 8BE5                    mov esp, ebp
:00428855 5D                      pop ebp
:00428856 C3                      ret



* Referenced by a CALL at Address:
|:0042A037   
|
:00428857 55                      push ebp
:00428858 8BEC                    mov ebp, esp
:0042885A 6AFF                    push FFFFFFFF
:0042885C 68D2524800              push 004852D2
:00428861 64A100000000            mov eax, dword ptr fs:[00000000]
:00428867 50                      push eax
:00428868 64892500000000          mov dword ptr fs:[00000000], esp
:0042886F 81EC0C010000            sub esp, 0000010C
:00428875 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0042887B E830AAFDFF              call 004032B0
:00428880 C745FC00000000          mov [ebp-04], 00000000
:00428887 B93CC64A00              mov ecx, 004AC63C
:0042888C E80F710200              call 0044F9A0
:00428891 660FB6C0                movzx ax, al
:00428895 668985E8FEFFFF          mov word ptr [ebp+FFFFFEE8], ax
:0042889C 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:004288A2 81E1FFFF0000            and ecx, 0000FFFF
:004288A8 660FB691D0B84800        movzx dx, byte ptr [ecx+0048B8D0]
:004288B0 668995E8FEFFFF          mov word ptr [ebp+FFFFFEE8], dx
:004288B7 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:004288BD 25FFFF0000              and eax, 0000FFFF
:004288C2 3DFF000000              cmp eax, 000000FF
:004288C7 7509                    jne 004288D2
:004288C9 66C785E8FEFFFF2800      mov word ptr [ebp+FFFFFEE8], 0028

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004288C7(C)
|
:004288D2 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:004288D8 81E1FFFF0000            and ecx, 0000FFFF
:004288DE 83E928                  sub ecx, 00000028
:004288E1 66898DECFEFFFF          mov word ptr [ebp+FFFFFEEC], cx

* Possible StringData Ref from Data Obj ->"PMAP.E5"
                                  |
:004288E8 6880BB4800              push 0048BB80
:004288ED 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:004288F3 E83D72FFFF              call 0041FB35
:004288F8 B938EB4A00              mov ecx, 004AEB38
:004288FD E88E57FEFF              call 0040E090
:00428902 50                      push eax
:00428903 8B95ECFEFFFF            mov edx, dword ptr [ebp+FFFFFEEC]
:00428909 81E2FFFF0000            and edx, 0000FFFF
:0042890F 52                      push edx
:00428910 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:00428916 E86E73FFFF              call 0041FC89
:0042891B 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:00428921 E89F09FFFF              call 004192C5
:00428926 6A04                    push 00000004
:00428928 6A00                    push 00000000
:0042892A 6A00                    push 00000000
:0042892C B938EB4A00              mov ecx, 004AEB38
:00428931 E80A710500              call 0047FA40
:00428936 668B8DE8FEFFFF          mov cx, word ptr [ebp+FFFFFEE8]
:0042893D 668908                  mov word ptr [eax], cx
:00428940 E8F232FEFF              call 0040BC37
:00428945 E8A9EDFFFF              call 004276F3
:0042894A C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00428951 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:00428957 E874A9FDFF              call 004032D0
:0042895C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042895F 64890D00000000          mov dword ptr fs:[00000000], ecx
:00428966 8BE5                    mov esp, ebp
:00428968 5D                      pop ebp
:00428969 C3                      ret



* Referenced by a CALL at Addresses:
|:00428A07   , :00428A7F   , :00428B2D   , :00428B92   , :00428EC1   
|:00429106   , :00429177   , :00429EEB   
|
:0042896A 55                      push ebp
:0042896B 8BEC                    mov ebp, esp
:0042896D 83EC08                  sub esp, 00000008
:00428970 C745FC68CF4900          mov [ebp-04], 0049CF68
:00428977 66C745F80000            mov [ebp-08], 0000
:0042897D EB15                    jmp 00428994

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004289D7(U)
|
:0042897F 668B45F8                mov ax, word ptr [ebp-08]
:00428983 66050100                add ax, 0001
:00428987 668945F8                mov word ptr [ebp-08], ax
:0042898B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042898E 83C140                  add ecx, 00000040
:00428991 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042897D(U)
|
:00428994 8B55F8                  mov edx, dword ptr [ebp-08]
:00428997 81E2FFFF0000            and edx, 0000FFFF
:0042899D 81FA80000000            cmp edx, 00000080
:004289A3 7D34                    jge 004289D9
:004289A5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004289A8 E8A304FFFF              call 00418E50
:004289AD 25FFFF0000              and eax, 0000FFFF
:004289B2 2500800000              and eax, 00008000
:004289B7 85C0                    test eax, eax
:004289B9 741C                    je 004289D7
:004289BB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004289BE E8CD220000              call 0042AC90
:004289C3 25FFFF0000              and eax, 0000FFFF
:004289C8 8B4D08                  mov ecx, dword ptr [ebp+08]
:004289CB 81E1FFFF0000            and ecx, 0000FFFF
:004289D1 3BC1                    cmp eax, ecx
:004289D3 7502                    jne 004289D7
:004289D5 EB02                    jmp 004289D9

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004289B9(C), :004289D3(C)
|
:004289D7 EBA6                    jmp 0042897F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004289A3(C), :004289D5(U)
|
:004289D9 8B55F8                  mov edx, dword ptr [ebp-08]
:004289DC 81E2FFFF0000            and edx, 0000FFFF
:004289E2 81FA80000000            cmp edx, 00000080
:004289E8 7506                    jne 004289F0
:004289EA 66C745F8FFFF            mov [ebp-08], FFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004289E8(C)
|
:004289F0 668B45F8                mov ax, word ptr [ebp-08]
:004289F4 8BE5                    mov esp, ebp
:004289F6 5D                      pop ebp
:004289F7 C3                      ret



* Referenced by a CALL at Addresses:
|:0042D716   , :0042D729   , :0042D73E   
|
:004289F8 55                      push ebp
:004289F9 8BEC                    mov ebp, esp
:004289FB 83EC0C                  sub esp, 0000000C
:004289FE 8B4D08                  mov ecx, dword ptr [ebp+08]
:00428A01 E80A1F0000              call 0042A910
:00428A06 50                      push eax
:00428A07 E85EFFFFFF              call 0042896A
:00428A0C 83C404                  add esp, 00000004
:00428A0F 668945FC                mov word ptr [ebp-04], ax
:00428A13 8B45FC                  mov eax, dword ptr [ebp-04]
:00428A16 25FFFF0000              and eax, 0000FFFF
:00428A1B 3DFFFF0000              cmp eax, 0000FFFF
:00428A20 7504                    jne 00428A26
:00428A22 33C0                    xor eax, eax
:00428A24 EB3F                    jmp 00428A65

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428A20(C)
|
:00428A26 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:00428A29 51                      push ecx
:00428A2A 8D55F8                  lea edx, dword ptr [ebp-08]
:00428A2D 52                      push edx
:00428A2E 668B45FC                mov ax, word ptr [ebp-04]
:00428A32 50                      push eax
:00428A33 E870E0FFFF              call 00426AA8
:00428A38 83C404                  add esp, 00000004
:00428A3B 8BC8                    mov ecx, eax
:00428A3D E84E240000              call 0042AE90
:00428A42 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00428A45 81E1FFFF0000            and ecx, 0000FFFF
:00428A4B 890DD8CE4900            mov dword ptr [0049CED8], ecx
:00428A51 8B55F4                  mov edx, dword ptr [ebp-0C]
:00428A54 81E2FFFF0000            and edx, 0000FFFF
:00428A5A 8915DCCE4900            mov dword ptr [0049CEDC], edx
:00428A60 B8D8CE4900              mov eax, 0049CED8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428A24(U)
|
:00428A65 8BE5                    mov esp, ebp
:00428A67 5D                      pop ebp
:00428A68 C3                      ret



* Referenced by a CALL at Address:
|:0042D84B   
|
:00428A69 55                      push ebp
:00428A6A 8BEC                    mov ebp, esp
:00428A6C 83EC0C                  sub esp, 0000000C
:00428A6F C745F801000000          mov [ebp-08], 00000001
:00428A76 8B4D08                  mov ecx, dword ptr [ebp+08]
:00428A79 E8921E0000              call 0042A910
:00428A7E 50                      push eax
:00428A7F E8E6FEFFFF              call 0042896A
:00428A84 83C404                  add esp, 00000004
:00428A87 668945FC                mov word ptr [ebp-04], ax
:00428A8B 8B45FC                  mov eax, dword ptr [ebp-04]
:00428A8E 25FFFF0000              and eax, 0000FFFF
:00428A93 3DFFFF0000              cmp eax, 0000FFFF
:00428A98 744D                    je 00428AE7
:00428A9A 668B4DFC                mov cx, word ptr [ebp-04]
:00428A9E 51                      push ecx
:00428A9F E804E0FFFF              call 00426AA8
:00428AA4 83C404                  add esp, 00000004
:00428AA7 8BC8                    mov ecx, eax
:00428AA9 E8C2240000              call 0042AF70
:00428AAE 25FFFF0000              and eax, 0000FFFF
:00428AB3 8945F8                  mov dword ptr [ebp-08], eax
:00428AB6 8B55F8                  mov edx, dword ptr [ebp-08]
:00428AB9 8955F4                  mov dword ptr [ebp-0C], edx
:00428ABC 837DF403                cmp dword ptr [ebp-0C], 00000003
:00428AC0 771C                    ja 00428ADE
:00428AC2 8B45F4                  mov eax, dword ptr [ebp-0C]
:00428AC5 FF2485F58A4200          jmp dword ptr [4*eax+00428AF5]
:00428ACC C745F801000000          mov [ebp-08], 00000001
:00428AD3 EB10                    jmp 00428AE5
:00428AD5 C745F803000000          mov [ebp-08], 00000003
:00428ADC EB07                    jmp 00428AE5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428AC0(C)
|
:00428ADE C745F8FF000000          mov [ebp-08], 000000FF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00428AD3(U), :00428ADC(U)
|
:00428AE5 EB07                    jmp 00428AEE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428A98(C)
|
:00428AE7 C745F8FF000000          mov [ebp-08], 000000FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428AE5(U)
|
:00428AEE 8B45F8                  mov eax, dword ptr [ebp-08]
:00428AF1 8BE5                    mov esp, ebp
:00428AF3 5D                      pop ebp
:00428AF4 C3                      ret



:00428AF5 CC8A4200                DWORD 00428ACC
:00428AF9 CC8A4200                DWORD 00428ACC
:00428AFD D58A4200                DWORD 00428AD5
:00428B01 D58A4200                DWORD 00428AD5



* Referenced by a CALL at Address:
|:00428C0E   
|
:00428B05 55                      push ebp
:00428B06 8BEC                    mov ebp, esp
:00428B08 E8A6F6FFFF              call 004281B3
:00428B0D 33C0                    xor eax, eax
:00428B0F 5D                      pop ebp
:00428B10 C3                      ret



* Referenced by a CALL at Address:
|:00413ECF   
|
:00428B11 55                      push ebp
:00428B12 8BEC                    mov ebp, esp
:00428B14 E89AF6FFFF              call 004281B3
:00428B19 E8E758FFFF              call 0041E405
:00428B1E 33C0                    xor eax, eax
:00428B20 5D                      pop ebp
:00428B21 C3                      ret



* Referenced by a CALL at Address:
|:00413230   
|
:00428B22 55                      push ebp
:00428B23 8BEC                    mov ebp, esp
:00428B25 83EC08                  sub esp, 00000008
:00428B28 668B4508                mov ax, word ptr [ebp+08]
:00428B2C 50                      push eax
:00428B2D E838FEFFFF              call 0042896A
:00428B32 83C404                  add esp, 00000004
:00428B35 668945FC                mov word ptr [ebp-04], ax
:00428B39 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00428B3C 81E1FFFF0000            and ecx, 0000FFFF
:00428B42 81F980000000            cmp ecx, 00000080
:00428B48 7C07                    jl 00428B51
:00428B4A B8FFFF0000              mov eax, 0000FFFF
:00428B4F EB32                    jmp 00428B83

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428B48(C)
|
:00428B51 668B55FC                mov dx, word ptr [ebp-04]
:00428B55 52                      push edx
:00428B56 E84DDFFFFF              call 00426AA8
:00428B5B 83C404                  add esp, 00000004
:00428B5E 8945F8                  mov dword ptr [ebp-08], eax
:00428B61 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00428B64 E887200000              call 0042ABF0
:00428B69 8B4508                  mov eax, dword ptr [ebp+08]
:00428B6C 25FFFF0000              and eax, 0000FFFF
:00428B71 3D00100000              cmp eax, 00001000
:00428B76 7509                    jne 00428B81
:00428B78 66C705E4CE4900FFFF      mov word ptr [0049CEE4], FFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428B76(C)
|
:00428B81 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428B4F(U)
|
:00428B83 8BE5                    mov esp, ebp
:00428B85 5D                      pop ebp
:00428B86 C3                      ret



* Referenced by a CALL at Addresses:
|:00413556   , :004135CD   
|
:00428B87 55                      push ebp
:00428B88 8BEC                    mov ebp, esp
:00428B8A 83EC08                  sub esp, 00000008
:00428B8D 668B4508                mov ax, word ptr [ebp+08]
:00428B91 50                      push eax
:00428B92 E8D3FDFFFF              call 0042896A
:00428B97 83C404                  add esp, 00000004
:00428B9A 668945F8                mov word ptr [ebp-08], ax
:00428B9E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00428BA1 81E1FFFF0000            and ecx, 0000FFFF
:00428BA7 81F980000000            cmp ecx, 00000080
:00428BAD 7D68                    jge 00428C17
:00428BAF 668B55F8                mov dx, word ptr [ebp-08]
:00428BB3 52                      push edx
:00428BB4 E8EFDEFFFF              call 00426AA8
:00428BB9 83C404                  add esp, 00000004
:00428BBC 8945FC                  mov dword ptr [ebp-04], eax
:00428BBF 6A00                    push 00000000
:00428BC1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00428BC4 E8E7200000              call 0042ACB0
:00428BC9 8B450C                  mov eax, dword ptr [ebp+0C]
:00428BCC 25FFFF0000              and eax, 0000FFFF
:00428BD1 3DFFFF0000              cmp eax, 0000FFFF
:00428BD6 741A                    je 00428BF2
:00428BD8 668B4D0C                mov cx, word ptr [ebp+0C]
:00428BDC 51                      push ecx
:00428BDD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00428BE0 E84B230000              call 0042AF30
:00428BE5 668B550C                mov dx, word ptr [ebp+0C]
:00428BE9 52                      push edx
:00428BEA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00428BED E8BE180000              call 0042A4B0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428BD6(C)
|
:00428BF2 8B4510                  mov eax, dword ptr [ebp+10]
:00428BF5 25FFFF0000              and eax, 0000FFFF
:00428BFA 3DFFFF0000              cmp eax, 0000FFFF
:00428BFF 740D                    je 00428C0E
:00428C01 668B4D10                mov cx, word ptr [ebp+10]
:00428C05 51                      push ecx
:00428C06 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00428C09 E842230000              call 0042AF50

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428BFF(C)
|
:00428C0E E8F2FEFFFF              call 00428B05
:00428C13 33C0                    xor eax, eax
:00428C15 EB03                    jmp 00428C1A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428BAD(C)
|
:00428C17 83C8FF                  or eax, FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428C15(U)
|
:00428C1A 8BE5                    mov esp, ebp
:00428C1C 5D                      pop ebp
:00428C1D C3                      ret



* Referenced by a CALL at Addresses:
|:004274F3   , :0042900B   
|
:00428C1E 55                      push ebp
:00428C1F 8BEC                    mov ebp, esp
:00428C21 83EC14                  sub esp, 00000014
:00428C24 66C745FC0000            mov [ebp-04], 0000
:00428C2A 8B4508                  mov eax, dword ptr [ebp+08]
:00428C2D 25FFFF0000              and eax, 0000FFFF
:00428C32 2500F00000              and eax, 0000F000
:00428C37 668945F8                mov word ptr [ebp-08], ax
:00428C3B 66C745F40400            mov [ebp-0C], 0004
:00428C41 66C745F00100            mov [ebp-10], 0001
:00428C47 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00428C4A 81E1FFFF0000            and ecx, 0000FFFF
:00428C50 894DEC                  mov dword ptr [ebp-14], ecx
:00428C53 817DEC00100000          cmp dword ptr [ebp-14], 00001000
:00428C5A 7402                    je 00428C5E
:00428C5C EB3E                    jmp 00428C9C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428C5A(C)
|
:00428C5E 668B5508                mov dx, word ptr [ebp+08]
:00428C62 52                      push edx
:00428C63 E854DCFFFF              call 004268BC
:00428C68 83C404                  add esp, 00000004
:00428C6B 25FFFF0000              and eax, 0000FFFF
:00428C70 50                      push eax
:00428C71 E810DCFFFF              call 00426886
:00428C76 83C404                  add esp, 00000004
:00428C79 85C0                    test eax, eax
:00428C7B 7414                    je 00428C91
:00428C7D 8B452C                  mov eax, dword ptr [ebp+2C]
:00428C80 50                      push eax
:00428C81 E814DCFFFF              call 0042689A
:00428C86 83C404                  add esp, 00000004
:00428C89 66A3E4CE4900            mov word ptr [0049CEE4], ax
:00428C8F EB0B                    jmp 00428C9C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428C7B(C)
|
:00428C91 668B4DF0                mov cx, word ptr [ebp-10]
:00428C95 80CD40                  or ch, 40
:00428C98 66894DF0                mov word ptr [ebp-10], cx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00428C5C(U), :00428C8F(U)
|
:00428C9C 6A00                    push 00000000
:00428C9E 8B4D2C                  mov ecx, dword ptr [ebp+2C]
:00428CA1 E88A1F0000              call 0042AC30
:00428CA6 668B5524                mov dx, word ptr [ebp+24]
:00428CAA 52                      push edx
:00428CAB 8B4D2C                  mov ecx, dword ptr [ebp+2C]
:00428CAE E89D220000              call 0042AF50
:00428CB3 6A00                    push 00000000
:00428CB5 8B4D2C                  mov ecx, dword ptr [ebp+2C]
:00428CB8 E8531F0000              call 0042AC10
:00428CBD 6A00                    push 00000000
:00428CBF 8B4D2C                  mov ecx, dword ptr [ebp+2C]
:00428CC2 E8E91F0000              call 0042ACB0
:00428CC7 668B45FC                mov ax, word ptr [ebp-04]
:00428CCB 50                      push eax
:00428CCC 8B4D2C                  mov ecx, dword ptr [ebp+2C]
:00428CCF E8AC54FEFF              call 0040E180
:00428CD4 6A00                    push 00000000
:00428CD6 8B4D2C                  mov ecx, dword ptr [ebp+2C]
:00428CD9 E8721F0000              call 0042AC50
:00428CDE 668B4D0C                mov cx, word ptr [ebp+0C]
:00428CE2 51                      push ecx
:00428CE3 8B4D2C                  mov ecx, dword ptr [ebp+2C]
:00428CE6 E8A5200000              call 0042AD90
:00428CEB 668B5510                mov dx, word ptr [ebp+10]
:00428CEF 52                      push edx
:00428CF0 8B4D2C                  mov ecx, dword ptr [ebp+2C]
:00428CF3 E8B8200000              call 0042ADB0
:00428CF8 668B4514                mov ax, word ptr [ebp+14]
:00428CFC 50                      push eax
:00428CFD 8B4D2C                  mov ecx, dword ptr [ebp+2C]
:00428D00 E83B1D0000              call 0042AA40
:00428D05 668B4D18                mov cx, word ptr [ebp+18]
:00428D09 51                      push ecx
:00428D0A 8B4D2C                  mov ecx, dword ptr [ebp+2C]
:00428D0D E8BE1F0000              call 0042ACD0
:00428D12 668B551C                mov dx, word ptr [ebp+1C]
:00428D16 52                      push edx
:00428D17 8B4D2C                  mov ecx, dword ptr [ebp+2C]
:00428D1A E8411D0000              call 0042AA60
:00428D1F 668B4520                mov ax, word ptr [ebp+20]
:00428D23 50                      push eax
:00428D24 8B4D2C                  mov ecx, dword ptr [ebp+2C]
:00428D27 E804200000              call 0042AD30
:00428D2C 68FFFF0000              push 0000FFFF
:00428D31 68FFFF0000              push 0000FFFF
:00428D36 8B4D2C                  mov ecx, dword ptr [ebp+2C]
:00428D39 E822210000              call 0042AE60
:00428D3E 68FFFF0000              push 0000FFFF
:00428D43 68FFFF0000              push 0000FFFF
:00428D48 8B4D2C                  mov ecx, dword ptr [ebp+2C]
:00428D4B E870210000              call 0042AEC0
:00428D50 668B4DF4                mov cx, word ptr [ebp-0C]
:00428D54 51                      push ecx
:00428D55 8B4D2C                  mov ecx, dword ptr [ebp+2C]
:00428D58 E833220000              call 0042AF90
:00428D5D 68FFFF0000              push 0000FFFF
:00428D62 8B4D2C                  mov ecx, dword ptr [ebp+2C]
:00428D65 E886210000              call 0042AEF0
:00428D6A 668B55F0                mov dx, word ptr [ebp-10]
:00428D6E 52                      push edx
:00428D6F 668B45F0                mov ax, word ptr [ebp-10]
:00428D73 50                      push eax
:00428D74 8B4D2C                  mov ecx, dword ptr [ebp+2C]
:00428D77 E894200000              call 0042AE10
:00428D7C 668B4D28                mov cx, word ptr [ebp+28]
:00428D80 51                      push ecx
:00428D81 8B4D2C                  mov ecx, dword ptr [ebp+2C]
:00428D84 E8A7210000              call 0042AF30
:00428D89 668B5528                mov dx, word ptr [ebp+28]
:00428D8D 52                      push edx
:00428D8E 8B4D2C                  mov ecx, dword ptr [ebp+2C]
:00428D91 E81A170000              call 0042A4B0
:00428D96 8B452C                  mov eax, dword ptr [ebp+2C]
:00428D99 50                      push eax
:00428D9A E8FBDAFFFF              call 0042689A
:00428D9F 83C404                  add esp, 00000004
:00428DA2 25FFFF0000              and eax, 0000FFFF
:00428DA7 8BE5                    mov esp, ebp
:00428DA9 5D                      pop ebp
:00428DAA C3                      ret



* Referenced by a CALL at Addresses:
|:00428FBE   , :00428FD2   
|
:00428DAB 55                      push ebp
:00428DAC 8BEC                    mov ebp, esp
:00428DAE 83EC08                  sub esp, 00000008
:00428DB1 56                      push esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428EA6(U)
|
:00428DB2 6A64                    push 00000064
:00428DB4 E85A6D0500              call 0047FB13
:00428DB9 83C404                  add esp, 00000004
:00428DBC 8B4D08                  mov ecx, dword ptr [ebp+08]
:00428DBF 668901                  mov word ptr [ecx], ax
:00428DC2 6A64                    push 00000064
:00428DC4 E84A6D0500              call 0047FB13
:00428DC9 83C404                  add esp, 00000004
:00428DCC 8B550C                  mov edx, dword ptr [ebp+0C]
:00428DCF 668902                  mov word ptr [edx], ax
:00428DD2 6A04                    push 00000004
:00428DD4 6A03                    push 00000003
:00428DD6 6A03                    push 00000003
:00428DD8 8B450C                  mov eax, dword ptr [ebp+0C]
:00428DDB 50                      push eax
:00428DDC 8B4D08                  mov ecx, dword ptr [ebp+08]
:00428DDF 51                      push ecx
:00428DE0 E825F5FFFF              call 0042830A
:00428DE5 83C414                  add esp, 00000014
:00428DE8 25FFFF0000              and eax, 0000FFFF
:00428DED 3DFFFF0000              cmp eax, 0000FFFF
:00428DF2 0F84AE000000            je 00428EA6
:00428DF8 8B5510                  mov edx, dword ptr [ebp+10]
:00428DFB 81E2FFFF0000            and edx, 0000FFFF
:00428E01 83FA01                  cmp edx, 00000001
:00428E04 0F859A000000            jne 00428EA4
:00428E0A C745FC68CF4900          mov [ebp-04], 0049CF68
:00428E11 66C745F80000            mov [ebp-08], 0000
:00428E17 EB15                    jmp 00428E2E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428E8D(U)
|
:00428E19 668B45F8                mov ax, word ptr [ebp-08]
:00428E1D 66050100                add ax, 0001
:00428E21 668945F8                mov word ptr [ebp-08], ax
:00428E25 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00428E28 83C140                  add ecx, 00000040
:00428E2B 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428E17(U)
|
:00428E2E 8B55F8                  mov edx, dword ptr [ebp-08]
:00428E31 81E2FFFF0000            and edx, 0000FFFF
:00428E37 81FA80000000            cmp edx, 00000080
:00428E3D 7D50                    jge 00428E8F
:00428E3F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00428E42 E80900FFFF              call 00418E50
:00428E47 25FFFF0000              and eax, 0000FFFF
:00428E4C 2500800000              and eax, 00008000
:00428E51 85C0                    test eax, eax
:00428E53 7438                    je 00428E8D
:00428E55 8B4508                  mov eax, dword ptr [ebp+08]
:00428E58 33C9                    xor ecx, ecx
:00428E5A 668B08                  mov cx, word ptr [eax]
:00428E5D 8BF1                    mov esi, ecx
:00428E5F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00428E62 E8B91B0000              call 0042AA20
:00428E67 25FFFF0000              and eax, 0000FFFF
:00428E6C 3BF0                    cmp esi, eax
:00428E6E 751D                    jne 00428E8D
:00428E70 8B550C                  mov edx, dword ptr [ebp+0C]
:00428E73 33C0                    xor eax, eax
:00428E75 668B02                  mov ax, word ptr [edx]
:00428E78 8BF0                    mov esi, eax
:00428E7A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00428E7D E84E1F0000              call 0042ADD0
:00428E82 25FFFF0000              and eax, 0000FFFF
:00428E87 3BF0                    cmp esi, eax
:00428E89 7502                    jne 00428E8D
:00428E8B EB02                    jmp 00428E8F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00428E53(C), :00428E6E(C), :00428E89(C)
|
:00428E8D EB8A                    jmp 00428E19

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00428E3D(C), :00428E8B(U)
|
:00428E8F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00428E92 81E1FFFF0000            and ecx, 0000FFFF
:00428E98 81F980000000            cmp ecx, 00000080
:00428E9E 7502                    jne 00428EA2
:00428EA0 EB09                    jmp 00428EAB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428E9E(C)
|
:00428EA2 EB02                    jmp 00428EA6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428E04(C)
|
:00428EA4 EB05                    jmp 00428EAB

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00428DF2(C), :00428EA2(U)
|
:00428EA6 E907FFFFFF              jmp 00428DB2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00428EA0(U), :00428EA4(U)
|
:00428EAB 5E                      pop esi
:00428EAC 8BE5                    mov esp, ebp
:00428EAE 5D                      pop ebp
:00428EAF C3                      ret



* Referenced by a CALL at Addresses:
|:004290EC   , :0042A23E   
|
:00428EB0 55                      push ebp
:00428EB1 8BEC                    mov ebp, esp
:00428EB3 83EC14                  sub esp, 00000014
:00428EB6 66C745F80000            mov [ebp-08], 0000
:00428EBC 668B4508                mov ax, word ptr [ebp+08]
:00428EC0 50                      push eax
:00428EC1 E8A4FAFFFF              call 0042896A
:00428EC6 83C404                  add esp, 00000004
:00428EC9 668945F0                mov word ptr [ebp-10], ax
:00428ECD 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00428ED0 81E1FFFF0000            and ecx, 0000FFFF
:00428ED6 81F980000000            cmp ecx, 00000080
:00428EDC 7D0A                    jge 00428EE8
:00428EDE B880000000              mov eax, 00000080
:00428EE3 E92B010000              jmp 00429013

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428EDC(C)
|
:00428EE8 66C745140000            mov [ebp+14], 0000
:00428EEE 668B5508                mov dx, word ptr [ebp+08]
:00428EF2 52                      push edx
:00428EF3 E8D4D9FFFF              call 004268CC
:00428EF8 83C404                  add esp, 00000004
:00428EFB 8945EC                  mov dword ptr [ebp-14], eax
:00428EFE 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00428F01 E82A1A0000              call 0042A930
:00428F06 668945F4                mov word ptr [ebp-0C], ax
:00428F0A 8B45F4                  mov eax, dword ptr [ebp-0C]
:00428F0D 25FFFF0000              and eax, 0000FFFF
:00428F12 3D00100000              cmp eax, 00001000
:00428F17 7408                    je 00428F21
:00428F19 83C8FF                  or eax, FFFFFFFF
:00428F1C E9F2000000              jmp 00429013

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428F17(C)
|
:00428F21 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00428F24 E8271A0000              call 0042A950
:00428F29 6633C9                  xor cx, cx
:00428F2C 8AC8                    mov cl, al
:00428F2E 51                      push ecx
:00428F2F 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00428F32 E8D9190000              call 0042A910
:00428F37 50                      push eax
:00428F38 E875DEFFFF              call 00426DB2
:00428F3D 83C408                  add esp, 00000008
:00428F40 8945FC                  mov dword ptr [ebp-04], eax
:00428F43 6880000000              push 00000080
:00428F48 E85BDBFFFF              call 00426AA8
:00428F4D 83C404                  add esp, 00000004
:00428F50 3945FC                  cmp dword ptr [ebp-04], eax
:00428F53 750A                    jne 00428F5F
:00428F55 B880000000              mov eax, 00000080
:00428F5A E9B4000000              jmp 00429013

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428F53(C)
|
:00428F5F 6A04                    push 00000004
:00428F61 6A03                    push 00000003
:00428F63 6A03                    push 00000003
:00428F65 8D5510                  lea edx, dword ptr [ebp+10]
:00428F68 52                      push edx
:00428F69 8D450C                  lea eax, dword ptr [ebp+0C]
:00428F6C 50                      push eax
:00428F6D E898F3FFFF              call 0042830A
:00428F72 83C414                  add esp, 00000014
:00428F75 25FFFF0000              and eax, 0000FFFF
:00428F7A 3DFFFF0000              cmp eax, 0000FFFF
:00428F7F 7559                    jne 00428FDA
:00428F81 668B4D08                mov cx, word ptr [ebp+08]
:00428F85 51                      push ecx
:00428F86 E831D9FFFF              call 004268BC
:00428F8B 83C404                  add esp, 00000004
:00428F8E 25FFFF0000              and eax, 0000FFFF
:00428F93 50                      push eax
:00428F94 E8EDD8FFFF              call 00426886
:00428F99 83C404                  add esp, 00000004
:00428F9C 85C0                    test eax, eax
:00428F9E 7428                    je 00428FC8
:00428FA0 8D5510                  lea edx, dword ptr [ebp+10]
:00428FA3 52                      push edx
:00428FA4 8D450C                  lea eax, dword ptr [ebp+0C]
:00428FA7 50                      push eax
:00428FA8 E86A000000              call 00429017
:00428FAD 83C408                  add esp, 00000008
:00428FB0 85C0                    test eax, eax
:00428FB2 7512                    jne 00428FC6
:00428FB4 6A01                    push 00000001
:00428FB6 8D4D10                  lea ecx, dword ptr [ebp+10]
:00428FB9 51                      push ecx
:00428FBA 8D550C                  lea edx, dword ptr [ebp+0C]
:00428FBD 52                      push edx
:00428FBE E8E8FDFFFF              call 00428DAB
:00428FC3 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428FB2(C)
|
:00428FC6 EB12                    jmp 00428FDA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428F9E(C)
|
:00428FC8 6A01                    push 00000001
:00428FCA 8D4510                  lea eax, dword ptr [ebp+10]
:00428FCD 50                      push eax
:00428FCE 8D4D0C                  lea ecx, dword ptr [ebp+0C]
:00428FD1 51                      push ecx
:00428FD2 E8D4FDFFFF              call 00428DAB
:00428FD7 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00428F7F(C), :00428FC6(U)
|
:00428FDA 8B55FC                  mov edx, dword ptr [ebp-04]
:00428FDD 52                      push edx
:00428FDE 668B4528                mov ax, word ptr [ebp+28]
:00428FE2 50                      push eax
:00428FE3 668B4D24                mov cx, word ptr [ebp+24]
:00428FE7 51                      push ecx
:00428FE8 668B5520                mov dx, word ptr [ebp+20]
:00428FEC 52                      push edx
:00428FED 668B451C                mov ax, word ptr [ebp+1C]
:00428FF1 50                      push eax
:00428FF2 668B4D18                mov cx, word ptr [ebp+18]
:00428FF6 51                      push ecx
:00428FF7 668B5514                mov dx, word ptr [ebp+14]
:00428FFB 52                      push edx
:00428FFC 668B4510                mov ax, word ptr [ebp+10]
:00429000 50                      push eax
:00429001 668B4D0C                mov cx, word ptr [ebp+0C]
:00429005 51                      push ecx
:00429006 668B5508                mov dx, word ptr [ebp+08]
:0042900A 52                      push edx
:0042900B E80EFCFFFF              call 00428C1E
:00429010 83C428                  add esp, 00000028

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00428EE3(U), :00428F1C(U), :00428F5A(U)
|
:00429013 8BE5                    mov esp, ebp
:00429015 5D                      pop ebp
:00429016 C3                      ret



* Referenced by a CALL at Address:
|:00428FA8   
|
:00429017 55                      push ebp
:00429018 8BEC                    mov ebp, esp
:0042901A 83EC0C                  sub esp, 0000000C
:0042901D E8E353FFFF              call 0041E405
:00429022 E896DAFFFF              call 00426ABD
:00429027 8945F8                  mov dword ptr [ebp-08], eax
:0042902A C745FC30CF4900          mov [ebp-04], 0049CF30
:00429031 66C745F40400            mov [ebp-0C], 0004
:00429037 EB15                    jmp 0042904E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429095(U)
|
:00429039 668B45F4                mov ax, word ptr [ebp-0C]
:0042903D 66050100                add ax, 0001
:00429041 668945F4                mov word ptr [ebp-0C], ax
:00429045 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00429048 83C10E                  add ecx, 0000000E
:0042904B 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429037(U)
|
:0042904E 8B55F4                  mov edx, dword ptr [ebp-0C]
:00429051 81E2FFFF0000            and edx, 0000FFFF
:00429057 83FA08                  cmp edx, 00000008
:0042905A 7D3B                    jge 00429097
:0042905C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042905F E82C190000              call 0042A990
:00429064 25FFFF0000              and eax, 0000FFFF
:00429069 2500800000              and eax, 00008000
:0042906E 85C0                    test eax, eax
:00429070 7423                    je 00429095
:00429072 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00429075 E886190000              call 0042AA00
:0042907A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042907D 668901                  mov word ptr [ecx], ax
:00429080 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00429083 E898190000              call 0042AA20
:00429088 8B550C                  mov edx, dword ptr [ebp+0C]
:0042908B 668902                  mov word ptr [edx], ax
:0042908E B801000000              mov eax, 00000001
:00429093 EB04                    jmp 00429099

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429070(C)
|
:00429095 EBA2                    jmp 00429039

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042905A(C)
|
:00429097 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429093(U)
|
:00429099 8BE5                    mov esp, ebp
:0042909B 5D                      pop ebp
:0042909C C3                      ret



* Referenced by a CALL at Address:
|:004130ED   
|
:0042909D 55                      push ebp
:0042909E 8BEC                    mov ebp, esp
:004290A0 668B4518                mov ax, word ptr [ebp+18]
:004290A4 66250300                and ax, 0003
:004290A8 66894518                mov word ptr [ebp+18], ax
:004290AC 8B4D1C                  mov ecx, dword ptr [ebp+1C]
:004290AF 81E1FFFF0000            and ecx, 0000FFFF
:004290B5 83F912                  cmp ecx, 00000012
:004290B8 7E06                    jle 004290C0
:004290BA 66C7451C0000            mov [ebp+1C], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004290B8(C)
|
:004290C0 668B551C                mov dx, word ptr [ebp+1C]
:004290C4 52                      push edx
:004290C5 668B4518                mov ax, word ptr [ebp+18]
:004290C9 50                      push eax
:004290CA 6A01                    push 00000001
:004290CC 6A03                    push 00000003
:004290CE 6A03                    push 00000003
:004290D0 668B4D14                mov cx, word ptr [ebp+14]
:004290D4 51                      push ecx
:004290D5 668B5510                mov dx, word ptr [ebp+10]
:004290D9 52                      push edx
:004290DA 668B450C                mov ax, word ptr [ebp+0C]
:004290DE 50                      push eax
:004290DF 8B4D08                  mov ecx, dword ptr [ebp+08]
:004290E2 81E1FFFF0000            and ecx, 0000FFFF
:004290E8 80CD10                  or ch, 10
:004290EB 51                      push ecx
:004290EC E8BFFDFFFF              call 00428EB0
:004290F1 83C424                  add esp, 00000024
:004290F4 B8FFFF0000              mov eax, 0000FFFF
:004290F9 5D                      pop ebp
:004290FA C3                      ret


:004290FB 55                      push ebp
:004290FC 8BEC                    mov ebp, esp
:004290FE 83EC08                  sub esp, 00000008
:00429101 668B4508                mov ax, word ptr [ebp+08]
:00429105 50                      push eax
:00429106 E85FF8FFFF              call 0042896A
:0042910B 83C404                  add esp, 00000004
:0042910E 668945FC                mov word ptr [ebp-04], ax
:00429112 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00429115 81E1FFFF0000            and ecx, 0000FFFF
:0042911B 81F980000000            cmp ecx, 00000080
:00429121 7C07                    jl 0042912A
:00429123 B8FFFF0000              mov eax, 0000FFFF
:00429128 EB2B                    jmp 00429155

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429121(C)
|
:0042912A 668B55FC                mov dx, word ptr [ebp-04]
:0042912E 52                      push edx
:0042912F E874D9FFFF              call 00426AA8
:00429134 83C404                  add esp, 00000004
:00429137 8945F8                  mov dword ptr [ebp-08], eax
:0042913A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042913D E82EFDFEFF              call 00418E70
:00429142 25FFFF0000              and eax, 0000FFFF
:00429147 83F804                  cmp eax, 00000004
:0042914A 7407                    je 00429153
:0042914C B801000000              mov eax, 00000001
:00429151 EB02                    jmp 00429155

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042914A(C)
|
:00429153 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00429128(U), :00429151(U)
|
:00429155 8BE5                    mov esp, ebp
:00429157 5D                      pop ebp
:00429158 C3                      ret



* Referenced by a CALL at Address:
|:00413493   
|
:00429159 55                      push ebp
:0042915A 8BEC                    mov ebp, esp
:0042915C 83EC08                  sub esp, 00000008
:0042915F 8B4514                  mov eax, dword ptr [ebp+14]
:00429162 25FFFF0000              and eax, 0000FFFF
:00429167 83F803                  cmp eax, 00000003
:0042916A 7E06                    jle 00429172
:0042916C 66C745140000            mov [ebp+14], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042916A(C)
|
:00429172 668B4D08                mov cx, word ptr [ebp+08]
:00429176 51                      push ecx
:00429177 E8EEF7FFFF              call 0042896A
:0042917C 83C404                  add esp, 00000004
:0042917F 668945FC                mov word ptr [ebp-04], ax
:00429183 8B55FC                  mov edx, dword ptr [ebp-04]
:00429186 81E2FFFF0000            and edx, 0000FFFF
:0042918C 81FA80000000            cmp edx, 00000080
:00429192 7C0A                    jl 0042919E
:00429194 B8FFFF0000              mov eax, 0000FFFF
:00429199 E9C4000000              jmp 00429262

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429192(C)
|
:0042919E 668B45FC                mov ax, word ptr [ebp-04]
:004291A2 50                      push eax
:004291A3 E800D9FFFF              call 00426AA8
:004291A8 83C404                  add esp, 00000004
:004291AB 8945F8                  mov dword ptr [ebp-08], eax
:004291AE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004291B1 E8BAFCFEFF              call 00418E70
:004291B6 25FFFF0000              and eax, 0000FFFF
:004291BB 83F804                  cmp eax, 00000004
:004291BE 740A                    je 004291CA
:004291C0 B8FFFF0000              mov eax, 0000FFFF
:004291C5 E998000000              jmp 00429262

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004291BE(C)
|
:004291CA 6A00                    push 00000000
:004291CC 6A01                    push 00000001
:004291CE 668B4D10                mov cx, word ptr [ebp+10]
:004291D2 51                      push ecx
:004291D3 668B550C                mov dx, word ptr [ebp+0C]
:004291D7 52                      push edx
:004291D8 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004291DB E8301B0000              call 0042AD10
:004291E0 50                      push eax
:004291E1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004291E4 E8071B0000              call 0042ACF0
:004291E9 50                      push eax
:004291EA 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004291ED E8DE1B0000              call 0042ADD0
:004291F2 50                      push eax
:004291F3 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004291F6 E825180000              call 0042AA20
:004291FB 50                      push eax
:004291FC E865000000              call 00429266
:00429201 83C420                  add esp, 00000020
:00429204 83F801                  cmp eax, 00000001
:00429207 7528                    jne 00429231
:00429209 6A00                    push 00000000
:0042920B 668B4514                mov ax, word ptr [ebp+14]
:0042920F 50                      push eax
:00429210 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00429213 51                      push ecx
:00429214 E883F4FFFF              call 0042869C
:00429219 83C40C                  add esp, 0000000C
:0042921C 25FFFF0000              and eax, 0000FFFF
:00429221 3DFFFF0000              cmp eax, 0000FFFF
:00429226 7507                    jne 0042922F
:00429228 B8FFFF0000              mov eax, 0000FFFF
:0042922D EB33                    jmp 00429262

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429226(C)
|
:0042922F EB07                    jmp 00429238

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429207(C)
|
:00429231 B8FFFF0000              mov eax, 0000FFFF
:00429236 EB2A                    jmp 00429262

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042922F(U)
|
:00429238 6A02                    push 00000002
:0042923A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042923D E84E1D0000              call 0042AF90
:00429242 6A00                    push 00000000
:00429244 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00429247 E8E41C0000              call 0042AF30
:0042924C 6A00                    push 00000000
:0042924E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00429251 E85A120000              call 0042A4B0
:00429256 6A00                    push 00000000
:00429258 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042925B E8204FFEFF              call 0040E180
:00429260 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00429199(U), :004291C5(U), :0042922D(U), :00429236(U)
|
:00429262 8BE5                    mov esp, ebp
:00429264 5D                      pop ebp
:00429265 C3                      ret



* Referenced by a CALL at Address:
|:004291FC   
|
:00429266 55                      push ebp
:00429267 8BEC                    mov ebp, esp
:00429269 83EC44                  sub esp, 00000044
:0042926C 56                      push esi
:0042926D 6A04                    push 00000004
:0042926F 6A00                    push 00000000
:00429271 6A00                    push 00000000
:00429273 B968AB4A00              mov ecx, 004AAB68
:00429278 E8C3670500              call 0047FA40
:0042927D 8945E0                  mov dword ptr [ebp-20], eax
:00429280 8B45E0                  mov eax, dword ptr [ebp-20]
:00429283 8945E8                  mov dword ptr [ebp-18], eax
:00429286 68FEFE0000              push 0000FEFE
:0042928B 68204E0000              push 00004E20
:00429290 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00429293 51                      push ecx
:00429294 E8D8D7FFFF              call 00426A71
:00429299 83C40C                  add esp, 0000000C
:0042929C 8B55E0                  mov edx, dword ptr [ebp-20]
:0042929F 81C2409C0000            add edx, 00009C40
:004292A5 8955F8                  mov dword ptr [ebp-08], edx
:004292A8 8B45F8                  mov eax, dword ptr [ebp-08]
:004292AB 8945F0                  mov dword ptr [ebp-10], eax
:004292AE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004292B1 83C102                  add ecx, 00000002
:004292B4 894DC8                  mov dword ptr [ebp-38], ecx
:004292B7 6A02                    push 00000002
:004292B9 E8F8D8FFFF              call 00426BB6
:004292BE 83C404                  add esp, 00000004
:004292C1 668945C4                mov word ptr [ebp-3C], ax
:004292C5 8B551C                  mov edx, dword ptr [ebp+1C]
:004292C8 81E2FFFF0000            and edx, 0000FFFF
:004292CE 8B45C4                  mov eax, dword ptr [ebp-3C]
:004292D1 25FFFF0000              and eax, 0000FFFF
:004292D6 0FAFD0                  imul edx, eax
:004292D9 8B4D18                  mov ecx, dword ptr [ebp+18]
:004292DC 81E1FFFF0000            and ecx, 0000FFFF
:004292E2 03D1                    add edx, ecx
:004292E4 8B45F0                  mov eax, dword ptr [ebp-10]
:004292E7 668910                  mov word ptr [eax], dx
:004292EA 668B4D18                mov cx, word ptr [ebp+18]
:004292EE 66890DE8CE4900          mov word ptr [0049CEE8], cx
:004292F5 668B551C                mov dx, word ptr [ebp+1C]
:004292F9 668915ECCE4900          mov word ptr [0049CEEC], dx
:00429300 8B45F0                  mov eax, dword ptr [ebp-10]
:00429303 33C9                    xor ecx, ecx
:00429305 668B08                  mov cx, word ptr [eax]
:00429308 8B55E8                  mov edx, dword ptr [ebp-18]
:0042930B 66C7044A0000            mov word ptr [edx+2*ecx], 0000
:00429311 8B4520                  mov eax, dword ptr [ebp+20]
:00429314 25FFFF0000              and eax, 0000FFFF
:00429319 83E001                  and eax, 00000001
:0042931C 85C0                    test eax, eax
:0042931E 7435                    je 00429355
:00429320 8B4D18                  mov ecx, dword ptr [ebp+18]
:00429323 81E1FFFF0000            and ecx, 0000FFFF
:00429329 8B5508                  mov edx, dword ptr [ebp+08]
:0042932C 81E2FFFF0000            and edx, 0000FFFF
:00429332 3BCA                    cmp ecx, edx
:00429334 751F                    jne 00429355
:00429336 8B451C                  mov eax, dword ptr [ebp+1C]
:00429339 25FFFF0000              and eax, 0000FFFF
:0042933E 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00429341 81E1FFFF0000            and ecx, 0000FFFF
:00429347 3BC1                    cmp eax, ecx
:00429349 750A                    jne 00429355
:0042934B B801000000              mov eax, 00000001
:00429350 E94C020000              jmp 004295A1

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042931E(C), :00429334(C), :00429349(C), :0042959A(U)
|
:00429355 8B55F0                  mov edx, dword ptr [ebp-10]
:00429358 3B55C8                  cmp edx, dword ptr [ebp-38]
:0042935B 0F843E020000            je 0042959F
:00429361 8B45F0                  mov eax, dword ptr [ebp-10]
:00429364 33C9                    xor ecx, ecx
:00429366 668B08                  mov cx, word ptr [eax]
:00429369 8BC1                    mov eax, ecx
:0042936B 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:0042936E 81E1FFFF0000            and ecx, 0000FFFF
:00429374 99                      cdq
:00429375 F7F9                    idiv ecx
:00429377 668955D8                mov word ptr [ebp-28], dx
:0042937B 8B55F0                  mov edx, dword ptr [ebp-10]
:0042937E 33C0                    xor eax, eax
:00429380 668B02                  mov ax, word ptr [edx]
:00429383 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:00429386 81E1FFFF0000            and ecx, 0000FFFF
:0042938C 99                      cdq
:0042938D F7F9                    idiv ecx
:0042938F 668945D0                mov word ptr [ebp-30], ax
:00429393 8B55F0                  mov edx, dword ptr [ebp-10]
:00429396 33C0                    xor eax, eax
:00429398 668B02                  mov ax, word ptr [edx]
:0042939B 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0042939E 668B1441                mov dx, word ptr [ecx+2*eax]
:004293A2 668955F4                mov word ptr [ebp-0C], dx
:004293A6 66C745BC0000            mov [ebp-44], 0000
:004293AC EB0C                    jmp 004293BA

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004294D3(U), :00429578(U)
|
:004293AE 668B45BC                mov ax, word ptr [ebp-44]
:004293B2 66050100                add ax, 0001
:004293B6 668945BC                mov word ptr [ebp-44], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004293AC(U)
|
:004293BA 8B4DBC                  mov ecx, dword ptr [ebp-44]
:004293BD 81E1FFFF0000            and ecx, 0000FFFF
:004293C3 83F904                  cmp ecx, 00000004
:004293C6 0F8DB1010000            jnl 0042957D
:004293CC 668B55D8                mov dx, word ptr [ebp-28]
:004293D0 668955E4                mov word ptr [ebp-1C], dx
:004293D4 668B45D0                mov ax, word ptr [ebp-30]
:004293D8 668945DC                mov word ptr [ebp-24], ax
:004293DC 668B4DBC                mov cx, word ptr [ebp-44]
:004293E0 51                      push ecx
:004293E1 668B5514                mov dx, word ptr [ebp+14]
:004293E5 52                      push edx
:004293E6 668B4510                mov ax, word ptr [ebp+10]
:004293EA 50                      push eax
:004293EB 8D4DDC                  lea ecx, dword ptr [ebp-24]
:004293EE 51                      push ecx
:004293EF 8D55E4                  lea edx, dword ptr [ebp-1C]
:004293F2 52                      push edx
:004293F3 E8CFEDFFFF              call 004281C7
:004293F8 83C414                  add esp, 00000014
:004293FB 83F801                  cmp eax, 00000001
:004293FE 0F8574010000            jne 00429578
:00429404 8B4520                  mov eax, dword ptr [ebp+20]
:00429407 25FFFF0000              and eax, 0000FFFF
:0042940C 83E001                  and eax, 00000001
:0042940F 85C0                    test eax, eax
:00429411 7435                    je 00429448
:00429413 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00429416 81E1FFFF0000            and ecx, 0000FFFF
:0042941C 8B5508                  mov edx, dword ptr [ebp+08]
:0042941F 81E2FFFF0000            and edx, 0000FFFF
:00429425 3BCA                    cmp ecx, edx
:00429427 751F                    jne 00429448
:00429429 8B45DC                  mov eax, dword ptr [ebp-24]
:0042942C 25FFFF0000              and eax, 0000FFFF
:00429431 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00429434 81E1FFFF0000            and ecx, 0000FFFF
:0042943A 3BC1                    cmp eax, ecx
:0042943C 750A                    jne 00429448
:0042943E B801000000              mov eax, 00000001
:00429443 E959010000              jmp 004295A1

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00429411(C), :00429427(C), :0042943C(C)
|
:00429448 8B55DC                  mov edx, dword ptr [ebp-24]
:0042944B 81E2FFFF0000            and edx, 0000FFFF
:00429451 8B45C4                  mov eax, dword ptr [ebp-3C]
:00429454 25FFFF0000              and eax, 0000FFFF
:00429459 0FAFD0                  imul edx, eax
:0042945C 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0042945F 81E1FFFF0000            and ecx, 0000FFFF
:00429465 03D1                    add edx, ecx
:00429467 668955D4                mov word ptr [ebp-2C], dx
:0042946B 8B55D4                  mov edx, dword ptr [ebp-2C]
:0042946E 81E2FFFF0000            and edx, 0000FFFF
:00429474 8B45E8                  mov eax, dword ptr [ebp-18]
:00429477 8D0C50                  lea ecx, dword ptr [eax+2*edx]
:0042947A 894DFC                  mov dword ptr [ebp-04], ecx
:0042947D 8B55FC                  mov edx, dword ptr [ebp-04]
:00429480 33C0                    xor eax, eax
:00429482 668B02                  mov ax, word ptr [edx]
:00429485 3DFEFE0000              cmp eax, 0000FEFE
:0042948A 0F85E8000000            jne 00429578
:00429490 8B4D24                  mov ecx, dword ptr [ebp+24]
:00429493 51                      push ecx
:00429494 668B5514                mov dx, word ptr [ebp+14]
:00429498 52                      push edx
:00429499 668B4510                mov ax, word ptr [ebp+10]
:0042949D 50                      push eax
:0042949E 668B4DDC                mov cx, word ptr [ebp-24]
:004294A2 51                      push ecx
:004294A3 668B55E4                mov dx, word ptr [ebp-1C]
:004294A7 52                      push edx
:004294A8 E8F9000000              call 004295A6
:004294AD 83C414                  add esp, 00000014
:004294B0 668945C0                mov word ptr [ebp-40], ax
:004294B4 8B45C0                  mov eax, dword ptr [ebp-40]
:004294B7 25FFFF0000              and eax, 0000FFFF
:004294BC 3DFFFF0000              cmp eax, 0000FFFF
:004294C1 7515                    jne 004294D8
:004294C3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004294C6 668B11                  mov dx, word ptr [ecx]
:004294C9 6683C201                add dx, 0001
:004294CD 8B45FC                  mov eax, dword ptr [ebp-04]
:004294D0 668910                  mov word ptr [eax], dx
:004294D3 E9D6FEFFFF              jmp 004293AE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004294C1(C)
|
:004294D8 8B4DC0                  mov ecx, dword ptr [ebp-40]
:004294DB 81E1FFFF0000            and ecx, 0000FFFF
:004294E1 8B55F4                  mov edx, dword ptr [ebp-0C]
:004294E4 81E2FFFF0000            and edx, 0000FFFF
:004294EA 03CA                    add ecx, edx
:004294EC 8B45FC                  mov eax, dword ptr [ebp-04]
:004294EF 668908                  mov word ptr [eax], cx
:004294F2 8B4DC8                  mov ecx, dword ptr [ebp-38]
:004294F5 894DEC                  mov dword ptr [ebp-14], ecx
:004294F8 8B55C8                  mov edx, dword ptr [ebp-38]
:004294FB 83EA02                  sub edx, 00000002
:004294FE 8955CC                  mov dword ptr [ebp-34], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429559(U)
|
:00429501 8B45CC                  mov eax, dword ptr [ebp-34]
:00429504 3B45F8                  cmp eax, dword ptr [ebp-08]
:00429507 730C                    jnb 00429515
:00429509 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042950C 81C11E4E0000            add ecx, 00004E1E
:00429512 894DCC                  mov dword ptr [ebp-34], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429507(C)
|
:00429515 8B55EC                  mov edx, dword ptr [ebp-14]
:00429518 8B45CC                  mov eax, dword ptr [ebp-34]
:0042951B 668B08                  mov cx, word ptr [eax]
:0042951E 66890A                  mov word ptr [edx], cx
:00429521 8B55FC                  mov edx, dword ptr [ebp-04]
:00429524 33C0                    xor eax, eax
:00429526 668B02                  mov ax, word ptr [edx]
:00429529 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0042952C 33D2                    xor edx, edx
:0042952E 668B11                  mov dx, word ptr [ecx]
:00429531 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00429534 33F6                    xor esi, esi
:00429536 668B3451                mov si, word ptr [ecx+2*edx]
:0042953A 3BC6                    cmp eax, esi
:0042953C 7C0C                    jl 0042954A
:0042953E 8B55EC                  mov edx, dword ptr [ebp-14]
:00429541 668B45D4                mov ax, word ptr [ebp-2C]
:00429545 668902                  mov word ptr [edx], ax
:00429548 EB11                    jmp 0042955B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042953C(C)
|
:0042954A 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0042954D 894DEC                  mov dword ptr [ebp-14], ecx
:00429550 8B55CC                  mov edx, dword ptr [ebp-34]
:00429553 83EA02                  sub edx, 00000002
:00429556 8955CC                  mov dword ptr [ebp-34], edx
:00429559 EBA6                    jmp 00429501

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429548(U)
|
:0042955B 8B45C8                  mov eax, dword ptr [ebp-38]
:0042955E 83C002                  add eax, 00000002
:00429561 8945C8                  mov dword ptr [ebp-38], eax
:00429564 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00429567 81C1204E0000            add ecx, 00004E20
:0042956D 394DC8                  cmp dword ptr [ebp-38], ecx
:00429570 7206                    jb 00429578
:00429572 8B55F8                  mov edx, dword ptr [ebp-08]
:00429575 8955C8                  mov dword ptr [ebp-38], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004293FE(C), :0042948A(C), :00429570(C)
|
:00429578 E931FEFFFF              jmp 004293AE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004293C6(C)
|
:0042957D 8B45F0                  mov eax, dword ptr [ebp-10]
:00429580 83C002                  add eax, 00000002
:00429583 8945F0                  mov dword ptr [ebp-10], eax
:00429586 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00429589 81C1204E0000            add ecx, 00004E20
:0042958F 394DF0                  cmp dword ptr [ebp-10], ecx
:00429592 7206                    jb 0042959A
:00429594 8B55F8                  mov edx, dword ptr [ebp-08]
:00429597 8955F0                  mov dword ptr [ebp-10], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429592(C)
|
:0042959A E9B6FDFFFF              jmp 00429355

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042935B(C)
|
:0042959F 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00429350(U), :00429443(U)
|
:004295A1 5E                      pop esi
:004295A2 8BE5                    mov esp, ebp
:004295A4 5D                      pop ebp
:004295A5 C3                      ret



* Referenced by a CALL at Address:
|:004294A8   
|
:004295A6 55                      push ebp
:004295A7 8BEC                    mov ebp, esp
:004295A9 83EC10                  sub esp, 00000010
:004295AC 6A01                    push 00000001
:004295AE 668B4514                mov ax, word ptr [ebp+14]
:004295B2 50                      push eax
:004295B3 668B4D10                mov cx, word ptr [ebp+10]
:004295B7 51                      push ecx
:004295B8 6A00                    push 00000000
:004295BA 668B550C                mov dx, word ptr [ebp+0C]
:004295BE 52                      push edx
:004295BF 668B4508                mov ax, word ptr [ebp+08]
:004295C3 50                      push eax
:004295C4 E8FEDBFFFF              call 004271C7
:004295C9 83C418                  add esp, 00000018
:004295CC 25FFFF0000              and eax, 0000FFFF
:004295D1 85C0                    test eax, eax
:004295D3 7409                    je 004295DE
:004295D5 660DFFFF                or ax, FFFF
:004295D9 E951010000              jmp 0042972F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004295D3(C)
|
:004295DE 837D1800                cmp dword ptr [ebp+18], 00000000
:004295E2 7509                    jne 004295ED
:004295E4 66B80100                mov ax, 0001
:004295E8 E942010000              jmp 0042972F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004295E2(C)
|
:004295ED C745FC68CF4900          mov [ebp-04], 0049CF68
:004295F4 66C745F00000            mov [ebp-10], 0000
:004295FA EB15                    jmp 00429611

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042964F(U), :004296BA(U), :00429726(U)
|
:004295FC 668B4DF0                mov cx, word ptr [ebp-10]
:00429600 6683C101                add cx, 0001
:00429604 66894DF0                mov word ptr [ebp-10], cx
:00429608 8B55FC                  mov edx, dword ptr [ebp-04]
:0042960B 83C240                  add edx, 00000040
:0042960E 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004295FA(U)
|
:00429611 8B45F0                  mov eax, dword ptr [ebp-10]
:00429614 25FFFF0000              and eax, 0000FFFF
:00429619 3D80000000              cmp eax, 00000080
:0042961E 0F8D07010000            jnl 0042972B
:00429624 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00429627 81E1FFFF0000            and ecx, 0000FFFF
:0042962D 33D2                    xor edx, edx
:0042962F 668B15E4CE4900          mov dx, word ptr [0049CEE4]
:00429636 3BCA                    cmp ecx, edx
:00429638 7415                    je 0042964F
:0042963A 8B45F0                  mov eax, dword ptr [ebp-10]
:0042963D 25FFFF0000              and eax, 0000FFFF
:00429642 33C9                    xor ecx, ecx
:00429644 668B0D78804900          mov cx, word ptr [00498078]
:0042964B 3BC1                    cmp eax, ecx
:0042964D 7502                    jne 00429651

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429638(C)
|
:0042964F EBAB                    jmp 004295FC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042964D(C)
|
:00429651 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00429654 E8F7F7FEFF              call 00418E50
:00429659 25FFFF0000              and eax, 0000FFFF
:0042965E 2500800000              and eax, 00008000
:00429663 85C0                    test eax, eax
:00429665 0F84BB000000            je 00429726
:0042966B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042966E E8AD130000              call 0042AA20
:00429673 668945F8                mov word ptr [ebp-08], ax
:00429677 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042967A E851170000              call 0042ADD0
:0042967F 668945F4                mov word ptr [ebp-0C], ax
:00429683 8B55F8                  mov edx, dword ptr [ebp-08]
:00429686 81E2FFFF0000            and edx, 0000FFFF
:0042968C 83FA5A                  cmp edx, 0000005A
:0042968F 7F29                    jg 004296BA
:00429691 8B45F8                  mov eax, dword ptr [ebp-08]
:00429694 25FFFF0000              and eax, 0000FFFF
:00429699 83F808                  cmp eax, 00000008
:0042969C 7C1C                    jl 004296BA
:0042969E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004296A1 81E1FFFF0000            and ecx, 0000FFFF
:004296A7 83F95A                  cmp ecx, 0000005A
:004296AA 7F0E                    jg 004296BA
:004296AC 8B55F4                  mov edx, dword ptr [ebp-0C]
:004296AF 81E2FFFF0000            and edx, 0000FFFF
:004296B5 83FA08                  cmp edx, 00000008
:004296B8 7D05                    jge 004296BF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042968F(C), :0042969C(C), :004296AA(C)
|
:004296BA E93DFFFFFF              jmp 004295FC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004296B8(C)
|
:004296BF 8B45F8                  mov eax, dword ptr [ebp-08]
:004296C2 25FFFF0000              and eax, 0000FFFF
:004296C7 83E801                  sub eax, 00000001
:004296CA 8B4D08                  mov ecx, dword ptr [ebp+08]
:004296CD 81E1FFFF0000            and ecx, 0000FFFF
:004296D3 3BC1                    cmp eax, ecx
:004296D5 7F4F                    jg 00429726
:004296D7 8B5508                  mov edx, dword ptr [ebp+08]
:004296DA 81E2FFFF0000            and edx, 0000FFFF
:004296E0 8B45F8                  mov eax, dword ptr [ebp-08]
:004296E3 25FFFF0000              and eax, 0000FFFF
:004296E8 83C002                  add eax, 00000002
:004296EB 3BD0                    cmp edx, eax
:004296ED 7D37                    jge 00429726
:004296EF 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004296F2 81E1FFFF0000            and ecx, 0000FFFF
:004296F8 83E901                  sub ecx, 00000001
:004296FB 8B550C                  mov edx, dword ptr [ebp+0C]
:004296FE 81E2FFFF0000            and edx, 0000FFFF
:00429704 3BCA                    cmp ecx, edx
:00429706 7F1E                    jg 00429726
:00429708 8B450C                  mov eax, dword ptr [ebp+0C]
:0042970B 25FFFF0000              and eax, 0000FFFF
:00429710 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00429713 81E1FFFF0000            and ecx, 0000FFFF
:00429719 83C102                  add ecx, 00000002
:0042971C 3BC1                    cmp eax, ecx
:0042971E 7D06                    jge 00429726
:00429720 660DFFFF                or ax, FFFF
:00429724 EB09                    jmp 0042972F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00429665(C), :004296D5(C), :004296ED(C), :00429706(C), :0042971E(C)
|
:00429726 E9D1FEFFFF              jmp 004295FC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042961E(C)
|
:0042972B 66B80100                mov ax, 0001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004295D9(U), :004295E8(U), :00429724(U)
|
:0042972F 8BE5                    mov esp, ebp
:00429731 5D                      pop ebp
:00429732 C3                      ret



* Referenced by a CALL at Addresses:
|:00429993   , :00429ACB   
|
:00429733 55                      push ebp
:00429734 8BEC                    mov ebp, esp
:00429736 83EC08                  sub esp, 00000008
:00429739 66C745FCFFFF            mov [ebp-04], FFFF
:0042973F 33C0                    xor eax, eax
:00429741 66A1A8EF4900            mov ax, word ptr [0049EFA8]
:00429747 85C0                    test eax, eax
:00429749 754D                    jne 00429798
:0042974B 833D9CBF4A0002          cmp dword ptr [004ABF9C], 00000002
:00429752 7444                    je 00429798
:00429754 8B4D08                  mov ecx, dword ptr [ebp+08]
:00429757 81E1FFFF0000            and ecx, 0000FFFF
:0042975D 894DF8                  mov dword ptr [ebp-08], ecx
:00429760 837DF800                cmp dword ptr [ebp-08], 00000000
:00429764 7408                    je 0042976E
:00429766 837DF801                cmp dword ptr [ebp-08], 00000001
:0042976A 7414                    je 00429780
:0042976C EB2A                    jmp 00429798

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429764(C)
|
:0042976E 6A00                    push 00000000
:00429770 B9902F4900              mov ecx, 00492F90
:00429775 E82AEBFEFF              call 004182A4
:0042977A 668945FC                mov word ptr [ebp-04], ax
:0042977E EB18                    jmp 00429798

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042976A(C)
|
:00429780 8B550C                  mov edx, dword ptr [ebp+0C]
:00429783 81E2FFFF0000            and edx, 0000FFFF
:00429789 52                      push edx
:0042978A B9902F4900              mov ecx, 00492F90
:0042978F E849EAFEFF              call 004181DD
:00429794 668945FC                mov word ptr [ebp-04], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00429749(C), :00429752(C), :0042976C(U), :0042977E(U)
|
:00429798 33C0                    xor eax, eax
:0042979A 8BE5                    mov esp, ebp
:0042979C 5D                      pop ebp
:0042979D C3                      ret



* Referenced by a CALL at Address:
|:0042C881   
|
:0042979E 55                      push ebp
:0042979F 8BEC                    mov ebp, esp
:004297A1 E8FDD3FFFF              call 00426BA3
:004297A6 5D                      pop ebp
:004297A7 C3                      ret



* Referenced by a CALL at Address:
|:0042A03C   
|
:004297A8 55                      push ebp
:004297A9 8BEC                    mov ebp, esp
:004297AB C70598BF4A0000000000    mov dword ptr [004ABF98], 00000000
:004297B5 C705BCF44A0000000000    mov dword ptr [004AF4BC], 00000000
:004297BF 66C705748049000000      mov word ptr [00498074], 0000
:004297C8 5D                      pop ebp
:004297C9 C3                      ret



* Referenced by a CALL at Address:
|:0042A02D   
|
:004297CA 55                      push ebp
:004297CB 8BEC                    mov ebp, esp
:004297CD 83EC0C                  sub esp, 0000000C
:004297D0 6A00                    push 00000000
:004297D2 68401F0000              push 00001F40
:004297D7 68C0F14900              push 0049F1C0
:004297DC E85BD2FFFF              call 00426A3C
:004297E1 83C40C                  add esp, 0000000C
:004297E4 66C705548049000000      mov word ptr [00498054], 0000
:004297ED 66C705508049000000      mov word ptr [00498050], 0000
:004297F6 66C705F0CE49000000      mov word ptr [0049CEF0], 0000
:004297FF 6A04                    push 00000004
:00429801 6A00                    push 00000000
:00429803 68509C0000              push 00009C50
:00429808 B938EB4A00              mov ecx, 004AEB38
:0042980D E82E620500              call 0047FA40
:00429812 8945FC                  mov dword ptr [ebp-04], eax
:00429815 6A00                    push 00000000
:00429817 68204E0000              push 00004E20
:0042981C 8B45FC                  mov eax, dword ptr [ebp-04]
:0042981F 50                      push eax
:00429820 E84CD2FFFF              call 00426A71
:00429825 83C40C                  add esp, 0000000C
:00429828 66C745F83C00            mov [ebp-08], 003C
:0042982E 66C745F41900            mov [ebp-0C], 0019
:00429834 66C705B0CE4900C800      mov word ptr [0049CEB0], 00C8
:0042983D 66C705B2CE49007800      mov word ptr [0049CEB2], 0078
:00429846 66C705B8CE49003200      mov word ptr [0049CEB8], 0032
:0042984F 668B4DF4                mov cx, word ptr [ebp-0C]
:00429853 66890DB6CE4900          mov word ptr [0049CEB6], cx
:0042985A 668B55F8                mov dx, word ptr [ebp-08]
:0042985E 668915B4CE4900          mov word ptr [0049CEB4], dx
:00429865 8B45FC                  mov eax, dword ptr [ebp-04]
:00429868 A3A0CE4900              mov dword ptr [0049CEA0], eax
:0042986D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00429870 81E1FFFF0000            and ecx, 0000FFFF
:00429876 69C9C8000000            imul ecx, 000000C8
:0042987C 8B55F8                  mov edx, dword ptr [ebp-08]
:0042987F 81E2FFFF0000            and edx, 0000FFFF
:00429885 03CA                    add ecx, edx
:00429887 8B45FC                  mov eax, dword ptr [ebp-04]
:0042988A 8D0C48                  lea ecx, dword ptr [eax+2*ecx]
:0042988D 890DA4CE4900            mov dword ptr [0049CEA4], ecx
:00429893 66C705BACE49000100      mov word ptr [0049CEBA], 0001
:0042989C 8B15A4CE4900            mov edx, dword ptr [0049CEA4]
:004298A2 8915ACCE4900            mov dword ptr [0049CEAC], edx
:004298A8 A1ACCE4900              mov eax, dword ptr [0049CEAC]
:004298AD A3A8CE4900              mov dword ptr [0049CEA8], eax
:004298B2 8BE5                    mov esp, ebp
:004298B4 5D                      pop ebp
:004298B5 C3                      ret



* Referenced by a CALL at Address:
|:0042C2BF   
|
:004298B6 55                      push ebp
:004298B7 8BEC                    mov ebp, esp
:004298B9 83EC08                  sub esp, 00000008
:004298BC E85220FEFF              call 0040B913
:004298C1 8845F8                  mov byte ptr [ebp-08], al
:004298C4 807DF802                cmp byte ptr [ebp-08], 02
:004298C8 7402                    je 004298CC
:004298CA EB32                    jmp 004298FE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004298C8(C)
|
:004298CC E825070000              call 00429FF6
:004298D1 E832000000              call 00429908
:004298D6 668945FC                mov word ptr [ebp-04], ax
:004298DA 8B45FC                  mov eax, dword ptr [ebp-04]
:004298DD 25FFFF0000              and eax, 0000FFFF
:004298E2 83E008                  and eax, 00000008
:004298E5 85C0                    test eax, eax
:004298E7 740F                    je 004298F8
:004298E9 6A00                    push 00000000
:004298EB 8B0D08754B00            mov ecx, dword ptr [004B7508]
:004298F1 51                      push ecx
:004298F2 FF15E0624800            call dword ptr [004862E0]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004298E7(C)
|
:004298F8 668B45FC                mov ax, word ptr [ebp-04]
:004298FC EB06                    jmp 00429904

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004298CA(U)
|
:004298FE 66A19CBF4A00            mov ax, word ptr [004ABF9C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004298FC(U)
|
:00429904 8BE5                    mov esp, ebp
:00429906 5D                      pop ebp
:00429907 C3                      ret



* Referenced by a CALL at Address:
|:004298D1   
|
:00429908 55                      push ebp
:00429909 8BEC                    mov ebp, esp
:0042990B 51                      push ecx
:0042990C E892D2FFFF              call 00426BA3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004299AE(U)
|
:00429911 B970074B00              mov ecx, 004B0770
:00429916 E8F529FFFF              call 0041C310
:0042991B 660FB6C0                movzx ax, al
:0042991F 668945FC                mov word ptr [ebp-04], ax
:00429923 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00429926 81E1FFFF0000            and ecx, 0000FFFF
:0042992C 51                      push ecx
:0042992D B9181B4B00              mov ecx, 004B1B18
:00429932 E8099AFDFF              call 00403340
:00429937 C7059CBF4A0000000000    mov dword ptr [004ABF9C], 00000000
:00429941 B9B07F4900              mov ecx, 00497FB0
:00429946 E877C2FFFF              call 00425BC2
:0042994B E81B2C0000              call 0042C56B
:00429950 A3BCF44A00              mov dword ptr [004AF4BC], eax
:00429955 E817040000              call 00429D71
:0042995A E8D1050000              call 00429F30
:0042995F E859000000              call 004299BD
:00429964 8B159CBF4A00            mov edx, dword ptr [004ABF9C]
:0042996A 83E26E                  and edx, 0000006E
:0042996D 85D2                    test edx, edx
:0042996F 7402                    je 00429973
:00429971 EB40                    jmp 004299B3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042996F(C)
|
:00429973 E81D030000              call 00429C95
:00429978 E811E6FFFF              call 00427F8E
:0042997D E8594CFFFF              call 0041E5DB
:00429982 E86BE6FFFF              call 00427FF2
:00429987 E86A4CFFFF              call 0041E5F6
:0042998C 68FF000000              push 000000FF
:00429991 6A00                    push 00000000
:00429993 E89BFDFFFF              call 00429733
:00429998 83C408                  add esp, 00000008
:0042999B E8402B0000              call 0042C4E0
:004299A0 A19CBF4A00              mov eax, dword ptr [004ABF9C]
:004299A5 83E06E                  and eax, 0000006E
:004299A8 85C0                    test eax, eax
:004299AA 7402                    je 004299AE
:004299AC EB05                    jmp 004299B3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004299AA(C)
|
:004299AE E95EFFFFFF              jmp 00429911

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00429971(U), :004299AC(U)
|
:004299B3 66A19CBF4A00            mov ax, word ptr [004ABF9C]
:004299B9 8BE5                    mov esp, ebp
:004299BB 5D                      pop ebp
:004299BC C3                      ret



* Referenced by a CALL at Address:
|:0042995F   
|
:004299BD 55                      push ebp
:004299BE 8BEC                    mov ebp, esp
:004299C0 83EC14                  sub esp, 00000014
:004299C3 66C745F40000            mov [ebp-0C], 0000
:004299C9 6880000000              push 00000080
:004299CE E8D5D0FFFF              call 00426AA8
:004299D3 83C404                  add esp, 00000004
:004299D6 8945FC                  mov dword ptr [ebp-04], eax
:004299D9 E8AF2E0000              call 0042C88D
:004299DE 85C0                    test eax, eax
:004299E0 7505                    jne 004299E7
:004299E2 E90C010000              jmp 00429AF3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004299E0(C)
|
:004299E7 A1BCF44A00              mov eax, dword ptr [004AF4BC]
:004299EC 3B0598BF4A00            cmp eax, dword ptr [004ABF98]
:004299F2 7420                    je 00429A14
:004299F4 8B0DBCF44A00            mov ecx, dword ptr [004AF4BC]
:004299FA 890D98BF4A00            mov dword ptr [004ABF98], ecx
:00429A00 E87C010000              call 00429B81
:00429A05 25FFFF0000              and eax, 0000FFFF
:00429A0A 83F801                  cmp eax, 00000001
:00429A0D 7505                    jne 00429A14
:00429A0F E88FD1FFFF              call 00426BA3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004299F2(C), :00429A0D(C)
|
:00429A14 33D2                    xor edx, edx
:00429A16 668B15E0CE4900          mov dx, word ptr [0049CEE0]
:00429A1D 85D2                    test edx, edx
:00429A1F 0F85CE000000            jne 00429AF3
:00429A25 33C0                    xor eax, eax
:00429A27 66A178804900            mov ax, word ptr [00498078]
:00429A2D 3D80000000              cmp eax, 00000080
:00429A32 0F8DBB000000            jnl 00429AF3
:00429A38 668B0D78804900          mov cx, word ptr [00498078]
:00429A3F 51                      push ecx
:00429A40 E863D0FFFF              call 00426AA8
:00429A45 83C404                  add esp, 00000004
:00429A48 8945FC                  mov dword ptr [ebp-04], eax
:00429A4B 33D2                    xor edx, edx
:00429A4D 668B15E4CE4900          mov dx, word ptr [0049CEE4]
:00429A54 81FAFFFF0000            cmp edx, 0000FFFF
:00429A5A 740A                    je 00429A66
:00429A5C E85CD0FFFF              call 00426ABD
:00429A61 8945F8                  mov dword ptr [ebp-08], eax
:00429A64 EB0D                    jmp 00429A73

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429A5A(C)
|
:00429A66 6A00                    push 00000000
:00429A68 E83BD0FFFF              call 00426AA8
:00429A6D 83C404                  add esp, 00000004
:00429A70 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429A64(U)
|
:00429A73 8B45F8                  mov eax, dword ptr [ebp-08]
:00429A76 50                      push eax
:00429A77 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00429A7A 51                      push ecx
:00429A7B E877000000              call 00429AF7
:00429A80 83C408                  add esp, 00000008
:00429A83 668945EC                mov word ptr [ebp-14], ax
:00429A87 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00429A8A E8E1140000              call 0042AF70
:00429A8F 668945F4                mov word ptr [ebp-0C], ax
:00429A93 668B55EC                mov dx, word ptr [ebp-14]
:00429A97 52                      push edx
:00429A98 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00429A9B E8B0140000              call 0042AF50
:00429AA0 E80EE7FFFF              call 004281B3
:00429AA5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00429AA8 E8E3110000              call 0042AC90
:00429AAD 50                      push eax
:00429AAE E809CEFFFF              call 004268BC
:00429AB3 83C404                  add esp, 00000004
:00429AB6 668945F0                mov word ptr [ebp-10], ax
:00429ABA B928604B00              mov ecx, 004B6028
:00429ABF E8DA700300              call 00460B9E
:00429AC4 668B45F0                mov ax, word ptr [ebp-10]
:00429AC8 50                      push eax
:00429AC9 6A01                    push 00000001
:00429ACB E863FCFFFF              call 00429733
:00429AD0 83C408                  add esp, 00000008
:00429AD3 668B4DF4                mov cx, word ptr [ebp-0C]
:00429AD7 51                      push ecx
:00429AD8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00429ADB E870140000              call 0042AF50
:00429AE0 E8CEE6FFFF              call 004281B3
:00429AE5 E8B9D0FFFF              call 00426BA3
:00429AEA 66C705E0CE4900FFFF      mov word ptr [0049CEE0], FFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004299E2(U), :00429A1F(C), :00429A32(C)
|
:00429AF3 8BE5                    mov esp, ebp
:00429AF5 5D                      pop ebp
:00429AF6 C3                      ret



* Referenced by a CALL at Address:
|:00429A7B   
|
:00429AF7 55                      push ebp
:00429AF8 8BEC                    mov ebp, esp
:00429AFA 83EC10                  sub esp, 00000010
:00429AFD 8B4D08                  mov ecx, dword ptr [ebp+08]
:00429B00 E81B0F0000              call 0042AA20
:00429B05 668945FC                mov word ptr [ebp-04], ax
:00429B09 8B4D08                  mov ecx, dword ptr [ebp+08]
:00429B0C E8BF120000              call 0042ADD0
:00429B11 668945F8                mov word ptr [ebp-08], ax
:00429B15 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00429B18 E8030F0000              call 0042AA20
:00429B1D 668945F4                mov word ptr [ebp-0C], ax
:00429B21 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00429B24 E8A7120000              call 0042ADD0
:00429B29 668945F0                mov word ptr [ebp-10], ax
:00429B2D 8B45FC                  mov eax, dword ptr [ebp-04]
:00429B30 25FFFF0000              and eax, 0000FFFF
:00429B35 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00429B38 81E1FFFF0000            and ecx, 0000FFFF
:00429B3E 3BC1                    cmp eax, ecx
:00429B40 751F                    jne 00429B61
:00429B42 8B55F8                  mov edx, dword ptr [ebp-08]
:00429B45 81E2FFFF0000            and edx, 0000FFFF
:00429B4B 8B45F0                  mov eax, dword ptr [ebp-10]
:00429B4E 25FFFF0000              and eax, 0000FFFF
:00429B53 3BD0                    cmp edx, eax
:00429B55 750A                    jne 00429B61
:00429B57 8B4D08                  mov ecx, dword ptr [ebp+08]
:00429B5A E811140000              call 0042AF70
:00429B5F EB1C                    jmp 00429B7D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00429B40(C), :00429B55(C)
|
:00429B61 668B4DF0                mov cx, word ptr [ebp-10]
:00429B65 51                      push ecx
:00429B66 668B55F4                mov dx, word ptr [ebp-0C]
:00429B6A 52                      push edx
:00429B6B 668B45F8                mov ax, word ptr [ebp-08]
:00429B6F 50                      push eax
:00429B70 668B4DFC                mov cx, word ptr [ebp-04]
:00429B74 51                      push ecx
:00429B75 E8E5E9FFFF              call 0042855F
:00429B7A 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429B5F(U)
|
:00429B7D 8BE5                    mov esp, ebp
:00429B7F 5D                      pop ebp
:00429B80 C3                      ret



* Referenced by a CALL at Address:
|:00429A00   
|
:00429B81 55                      push ebp
:00429B82 8BEC                    mov ebp, esp
:00429B84 83EC0C                  sub esp, 0000000C
:00429B87 66C745FC0000            mov [ebp-04], 0000
:00429B8D 66C745F40000            mov [ebp-0C], 0000
:00429B93 E8F52C0000              call 0042C88D
:00429B98 85C0                    test eax, eax
:00429B9A 7508                    jne 00429BA4
:00429B9C 6633C0                  xor ax, ax
:00429B9F E9ED000000              jmp 00429C91

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429B9A(C)
|
:00429BA4 833DBCF44A0001          cmp dword ptr [004AF4BC], 00000001
:00429BAB 7567                    jne 00429C14
:00429BAD 33C0                    xor eax, eax
:00429BAF 66A178804900            mov ax, word ptr [00498078]
:00429BB5 80E47F                  and ah, 7F
:00429BB8 668945F4                mov word ptr [ebp-0C], ax
:00429BBC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00429BBF 81E1FFFF0000            and ecx, 0000FFFF
:00429BC5 83F901                  cmp ecx, 00000001
:00429BC8 7509                    jne 00429BD3
:00429BCA 66B80100                mov ax, 0001
:00429BCE E9BE000000              jmp 00429C91

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429BC8(C)
|
:00429BD3 33D2                    xor edx, edx
:00429BD5 668B1578804900          mov dx, word ptr [00498078]
:00429BDC 81FAFFFF0000            cmp edx, 0000FFFF
:00429BE2 742E                    je 00429C12
:00429BE4 33C0                    xor eax, eax
:00429BE6 66A178804900            mov ax, word ptr [00498078]
:00429BEC 33C9                    xor ecx, ecx
:00429BEE 668B0DE4CE4900          mov cx, word ptr [0049CEE4]
:00429BF5 3BC1                    cmp eax, ecx
:00429BF7 7419                    je 00429C12
:00429BF9 66C705E0CE49000000      mov word ptr [0049CEE0], 0000
:00429C02 6A00                    push 00000000
:00429C04 E82CCFFFFF              call 00426B35
:00429C09 83C404                  add esp, 00000004
:00429C0C 66B80200                mov ax, 0002
:00429C10 EB7F                    jmp 00429C91

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00429BE2(C), :00429BF7(C)
|
:00429C12 EB7A                    jmp 00429C8E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429BAB(C)
|
:00429C14 833DBCF44A0002          cmp dword ptr [004AF4BC], 00000002
:00429C1B 7571                    jne 00429C8E
:00429C1D 33D2                    xor edx, edx
:00429C1F 668B1578804900          mov dx, word ptr [00498078]
:00429C26 80E67F                  and dh, 7F
:00429C29 668955F4                mov word ptr [ebp-0C], dx
:00429C2D 8B45F4                  mov eax, dword ptr [ebp-0C]
:00429C30 25FFFF0000              and eax, 0000FFFF
:00429C35 3D80000000              cmp eax, 00000080
:00429C3A 7D52                    jge 00429C8E
:00429C3C 668B4DF4                mov cx, word ptr [ebp-0C]
:00429C40 51                      push ecx
:00429C41 E862CEFFFF              call 00426AA8
:00429C46 83C404                  add esp, 00000004
:00429C49 8945F8                  mov dword ptr [ebp-08], eax
:00429C4C 837DF800                cmp dword ptr [ebp-08], 00000000
:00429C50 743C                    je 00429C8E
:00429C52 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00429C55 E836100000              call 0042AC90
:00429C5A 25FFFF0000              and eax, 0000FFFF
:00429C5F 50                      push eax
:00429C60 E81ECBFDFF              call 00406783
:00429C65 83C404                  add esp, 00000004
:00429C68 668945FC                mov word ptr [ebp-04], ax
:00429C6C 8B55FC                  mov edx, dword ptr [ebp-04]
:00429C6F 81E2FFFF0000            and edx, 0000FFFF
:00429C75 81FAFF000000            cmp edx, 000000FF
:00429C7B 7D11                    jge 00429C8E
:00429C7D 8B45FC                  mov eax, dword ptr [ebp-04]
:00429C80 25FFFF0000              and eax, 0000FFFF
:00429C85 50                      push eax
:00429C86 E825FD0400              call 004799B0
:00429C8B 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00429C12(U), :00429C1B(C), :00429C3A(C), :00429C50(C), :00429C7B(C)
|
:00429C8E 6633C0                  xor ax, ax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00429B9F(U), :00429BCE(U), :00429C10(U)
|
:00429C91 8BE5                    mov esp, ebp
:00429C93 5D                      pop ebp
:00429C94 C3                      ret



* Referenced by a CALL at Address:
|:00429973   
|
:00429C95 55                      push ebp
:00429C96 8BEC                    mov ebp, esp
:00429C98 83EC10                  sub esp, 00000010
:00429C9B 6A00                    push 00000000
:00429C9D E806CEFFFF              call 00426AA8
:00429CA2 83C404                  add esp, 00000004
:00429CA5 8945FC                  mov dword ptr [ebp-04], eax
:00429CA8 66C745F80000            mov [ebp-08], 0000
:00429CAE EB15                    jmp 00429CC5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00429CF3(U), :00429D3B(U)
|
:00429CB0 668B45F8                mov ax, word ptr [ebp-08]
:00429CB4 66050100                add ax, 0001
:00429CB8 668945F8                mov word ptr [ebp-08], ax
:00429CBC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00429CBF 83C140                  add ecx, 00000040
:00429CC2 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429CAE(U)
|
:00429CC5 8B55F8                  mov edx, dword ptr [ebp-08]
:00429CC8 81E2FFFF0000            and edx, 0000FFFF
:00429CCE 81FA80000000            cmp edx, 00000080
:00429CD4 7D6A                    jge 00429D40
:00429CD6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00429CD9 E872F1FEFF              call 00418E50
:00429CDE 668945F4                mov word ptr [ebp-0C], ax
:00429CE2 8B45F4                  mov eax, dword ptr [ebp-0C]
:00429CE5 25FFFF0000              and eax, 0000FFFF
:00429CEA 2500800000              and eax, 00008000
:00429CEF 85C0                    test eax, eax
:00429CF1 7502                    jne 00429CF5
:00429CF3 EBBB                    jmp 00429CB0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429CF1(C)
|
:00429CF5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00429CF8 E873F1FEFF              call 00418E70
:00429CFD 25FFFF0000              and eax, 0000FFFF
:00429D02 8945F0                  mov dword ptr [ebp-10], eax
:00429D05 837DF002                cmp dword ptr [ebp-10], 00000002
:00429D09 7402                    je 00429D0D
:00429D0B EB22                    jmp 00429D2F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429D09(C)
|
:00429D0D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00429D10 E84C060000              call 0042A361
:00429D15 25FFFF0000              and eax, 0000FFFF
:00429D1A 3DFFFF0000              cmp eax, 0000FFFF
:00429D1F 750C                    jne 00429D2D
:00429D21 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00429D24 51                      push ecx
:00429D25 E81A000000              call 00429D44
:00429D2A 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429D1F(C)
|
:00429D2D EB0C                    jmp 00429D3B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429D0B(U)
|
:00429D2F 8B55FC                  mov edx, dword ptr [ebp-04]
:00429D32 52                      push edx
:00429D33 E80C000000              call 00429D44
:00429D38 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429D2D(U)
|
:00429D3B E970FFFFFF              jmp 00429CB0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429CD4(C)
|
:00429D40 8BE5                    mov esp, ebp
:00429D42 5D                      pop ebp
:00429D43 C3                      ret



* Referenced by a CALL at Addresses:
|:00429D25   , :00429D33   
|
:00429D44 55                      push ebp
:00429D45 8BEC                    mov ebp, esp
:00429D47 6A04                    push 00000004
:00429D49 8B4D08                  mov ecx, dword ptr [ebp+08]
:00429D4C E83F120000              call 0042AF90
:00429D51 8B4D08                  mov ecx, dword ptr [ebp+08]
:00429D54 E857120000              call 0042AFB0
:00429D59 50                      push eax
:00429D5A E8D0E7FFFF              call 0042852F
:00429D5F 83C404                  add esp, 00000004
:00429D62 68FFFF0000              push 0000FFFF
:00429D67 8B4D08                  mov ecx, dword ptr [ebp+08]
:00429D6A E881110000              call 0042AEF0
:00429D6F 5D                      pop ebp
:00429D70 C3                      ret



* Referenced by a CALL at Address:
|:00429955   
|
:00429D71 55                      push ebp
:00429D72 8BEC                    mov ebp, esp
:00429D74 83EC28                  sub esp, 00000028
:00429D77 E81B4E0500              call 0047EB97
:00429D7C 50                      push eax
:00429D7D E8835D0500              call 0047FB05
:00429D82 83C404                  add esp, 00000004
:00429D85 C70508114A0000000000    mov dword ptr [004A1108], 00000000
:00429D8F 66C70578804900FFFF      mov word ptr [00498078], FFFF
:00429D98 B9B07F4900              mov ecx, 00497FB0
:00429D9D E884BEFFFF              call 00425C26
:00429DA2 668945E0                mov word ptr [ebp-20], ax
:00429DA6 B9B07F4900              mov ecx, 00497FB0
:00429DAB E887BEFFFF              call 00425C37
:00429DB0 668945D8                mov word ptr [ebp-28], ax
:00429DB4 B9386F4900              mov ecx, 00496F38
:00429DB9 E8E602FFFF              call 0041A0A4
:00429DBE 85C0                    test eax, eax
:00429DC0 7405                    je 00429DC7
:00429DC2 E965010000              jmp 00429F2C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429DC0(C)
|
:00429DC7 33C0                    xor eax, eax
:00429DC9 66A174804900            mov ax, word ptr [00498074]
:00429DCF 85C0                    test eax, eax
:00429DD1 0F8E55010000            jle 00429F2C
:00429DD7 668B0D74804900          mov cx, word ptr [00498074]
:00429DDE 66894DF4                mov word ptr [ebp-0C], cx
:00429DE2 EB15                    jmp 00429DF9

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00429E46(U), :00429E78(U), :00429F27(U)
|
:00429DE4 668B55F4                mov dx, word ptr [ebp-0C]
:00429DE8 6683EA01                sub dx, 0001
:00429DEC 668955F4                mov word ptr [ebp-0C], dx
:00429DF0 8B45FC                  mov eax, dword ptr [ebp-04]
:00429DF3 83E840                  sub eax, 00000040
:00429DF6 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429DE2(U)
|
:00429DF9 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00429DFC 81E1FFFF0000            and ecx, 0000FFFF
:00429E02 85C9                    test ecx, ecx
:00429E04 0F8422010000            je 00429F2C
:00429E0A 8B55F4                  mov edx, dword ptr [ebp-0C]
:00429E0D 81E2FFFF0000            and edx, 0000FFFF
:00429E13 8B0495BCEF4900          mov eax, dword ptr [4*edx+0049EFBC]
:00429E1A 8945FC                  mov dword ptr [ebp-04], eax
:00429E1D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00429E20 E82BF0FEFF              call 00418E50
:00429E25 668945EC                mov word ptr [ebp-14], ax
:00429E29 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00429E2C E85F0E0000              call 0042AC90
:00429E31 50                      push eax
:00429E32 E873CAFFFF              call 004268AA
:00429E37 83C404                  add esp, 00000004
:00429E3A 25FFFF0000              and eax, 0000FFFF
:00429E3F 3D00300000              cmp eax, 00003000
:00429E44 7502                    jne 00429E48
:00429E46 EB9C                    jmp 00429DE4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429E44(C)
|
:00429E48 8D4DF8                  lea ecx, dword ptr [ebp-08]
:00429E4B 51                      push ecx
:00429E4C 8D55DC                  lea edx, dword ptr [ebp-24]
:00429E4F 52                      push edx
:00429E50 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00429E53 E838100000              call 0042AE90
:00429E58 8B45DC                  mov eax, dword ptr [ebp-24]
:00429E5B 25FFFF0000              and eax, 0000FFFF
:00429E60 3DFFFF0000              cmp eax, 0000FFFF
:00429E65 7516                    jne 00429E7D
:00429E67 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00429E6A 81E1FFFF0000            and ecx, 0000FFFF
:00429E70 81F9FFFF0000            cmp ecx, 0000FFFF
:00429E76 7505                    jne 00429E7D
:00429E78 E967FFFFFF              jmp 00429DE4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00429E65(C), :00429E76(C)
|
:00429E7D 66C745F03000            mov [ebp-10], 0030
:00429E83 66C745E84000            mov [ebp-18], 0040
:00429E89 0FBF55E0                movsx edx, word ptr [ebp-20]
:00429E8D 0FBF45DC                movsx eax, word ptr [ebp-24]
:00429E91 3BD0                    cmp edx, eax
:00429E93 0F8C8E000000            jl 00429F27
:00429E99 0FBF4DE0                movsx ecx, word ptr [ebp-20]
:00429E9D 8B55DC                  mov edx, dword ptr [ebp-24]
:00429EA0 81E2FFFF0000            and edx, 0000FFFF
:00429EA6 8B45F0                  mov eax, dword ptr [ebp-10]
:00429EA9 25FFFF0000              and eax, 0000FFFF
:00429EAE 03D0                    add edx, eax
:00429EB0 0FBFD2                  movsx edx, dx
:00429EB3 3BCA                    cmp ecx, edx
:00429EB5 7F70                    jg 00429F27
:00429EB7 0FBF45D8                movsx eax, word ptr [ebp-28]
:00429EBB 0FBF4DF8                movsx ecx, word ptr [ebp-08]
:00429EBF 3BC1                    cmp eax, ecx
:00429EC1 7C64                    jl 00429F27
:00429EC3 0FBF55D8                movsx edx, word ptr [ebp-28]
:00429EC7 0FBF45F8                movsx eax, word ptr [ebp-08]
:00429ECB 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00429ECE 81E1FFFF0000            and ecx, 0000FFFF
:00429ED4 03C1                    add eax, ecx
:00429ED6 3BD0                    cmp edx, eax
:00429ED8 7F4D                    jg 00429F27
:00429EDA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00429EDD E8AE0D0000              call 0042AC90
:00429EE2 668945E4                mov word ptr [ebp-1C], ax
:00429EE6 668B55E4                mov dx, word ptr [ebp-1C]
:00429EEA 52                      push edx
:00429EEB E87AEAFFFF              call 0042896A
:00429EF0 83C404                  add esp, 00000004
:00429EF3 668945E8                mov word ptr [ebp-18], ax
:00429EF7 8B45E8                  mov eax, dword ptr [ebp-18]
:00429EFA 25FFFF0000              and eax, 0000FFFF
:00429EFF 3DFFFF0000              cmp eax, 0000FFFF
:00429F04 7502                    jne 00429F08
:00429F06 EB24                    jmp 00429F2C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429F04(C)
|
:00429F08 668B4DE4                mov cx, word ptr [ebp-1C]
:00429F0C 51                      push ecx
:00429F0D E811CAFFFF              call 00426923
:00429F12 83C404                  add esp, 00000004
:00429F15 A308114A00              mov dword ptr [004A1108], eax
:00429F1A 668B55E8                mov dx, word ptr [ebp-18]
:00429F1E 66891578804900          mov word ptr [00498078], dx
:00429F25 EB05                    jmp 00429F2C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00429E93(C), :00429EB5(C), :00429EC1(C), :00429ED8(C)
|
:00429F27 E9B8FEFFFF              jmp 00429DE4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00429DC2(U), :00429DD1(C), :00429E04(C), :00429F06(U), :00429F25(U)
|
:00429F2C 8BE5                    mov esp, ebp
:00429F2E 5D                      pop ebp
:00429F2F C3                      ret



* Referenced by a CALL at Address:
|:0042995A   
|
:00429F30 55                      push ebp
:00429F31 8BEC                    mov ebp, esp
:00429F33 83EC08                  sub esp, 00000008
:00429F36 66C745FC0000            mov [ebp-04], 0000
:00429F3C 33C0                    xor eax, eax
:00429F3E 66A178804900            mov ax, word ptr [00498078]
:00429F44 3DFFFF0000              cmp eax, 0000FFFF
:00429F49 0F848F000000            je 00429FDE
:00429F4F E88746FFFF              call 0041E5DB
:00429F54 33C9                    xor ecx, ecx
:00429F56 668B0D78804900          mov cx, word ptr [00498078]
:00429F5D 80E57F                  and ch, 7F
:00429F60 66894DFC                mov word ptr [ebp-04], cx
:00429F64 833D08114A0000          cmp dword ptr [004A1108], 00000000
:00429F6B 7417                    je 00429F84
:00429F6D 668B55FC                mov dx, word ptr [ebp-04]
:00429F71 52                      push edx
:00429F72 A108114A00              mov eax, dword ptr [004A1108]
:00429F77 50                      push eax
:00429F78 B928604B00              mov ecx, 004B6028
:00429F7D E8B4690300              call 00460936
:00429F82 EB0A                    jmp 00429F8E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429F6B(C)
|
:00429F84 B928604B00              mov ecx, 004B6028
:00429F89 E8106C0300              call 00460B9E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429F82(U)
|
:00429F8E C745F800000000          mov [ebp-08], 00000000
:00429F95 33C9                    xor ecx, ecx
:00429F97 668B0D78804900          mov cx, word ptr [00498078]
:00429F9E 81F9FFFF0000            cmp ecx, 0000FFFF
:00429FA4 7425                    je 00429FCB
:00429FA6 33D2                    xor edx, edx
:00429FA8 668B1578804900          mov dx, word ptr [00498078]
:00429FAF 33C0                    xor eax, eax
:00429FB1 66A1E4CE4900            mov ax, word ptr [0049CEE4]
:00429FB7 3BD0                    cmp edx, eax
:00429FB9 7410                    je 00429FCB
:00429FBB E8CD280000              call 0042C88D
:00429FC0 85C0                    test eax, eax
:00429FC2 7407                    je 00429FCB
:00429FC4 C745F801000000          mov [ebp-08], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00429FA4(C), :00429FB9(C), :00429FC2(C)
|
:00429FCB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00429FCE 51                      push ecx
:00429FCF E847180000              call 0042B81B
:00429FD4 83C404                  add esp, 00000004
:00429FD7 E81A46FFFF              call 0041E5F6
:00429FDC EB14                    jmp 00429FF2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429F49(C)
|
:00429FDE B928604B00              mov ecx, 004B6028
:00429FE3 E8B66B0300              call 00460B9E
:00429FE8 6A00                    push 00000000
:00429FEA E82C180000              call 0042B81B
:00429FEF 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429FDC(U)
|
:00429FF2 8BE5                    mov esp, ebp
:00429FF4 5D                      pop ebp
:00429FF5 C3                      ret



* Referenced by a CALL at Address:
|:004298CC   
|
:00429FF6 55                      push ebp
:00429FF7 8BEC                    mov ebp, esp
:00429FF9 51                      push ecx
:00429FFA 68027F0000              push 00007F02
:00429FFF 6A00                    push 00000000
:0042A001 FF15B0634800            call dword ptr [004863B0]
:0042A007 50                      push eax
:0042A008 FF1594624800            call dword ptr [00486294]
:0042A00E 8945FC                  mov dword ptr [ebp-04], eax
:0042A011 C7057080490000000000    mov dword ptr [00498070], 00000000
:0042A01B 66C705E4CE4900FFFF      mov word ptr [0049CEE4], FFFF
:0042A024 66C705E0CE4900FF00      mov word ptr [0049CEE0], 00FF
:0042A02D E898F7FFFF              call 004297CA
:0042A032 E825DBFFFF              call 00427B5C
:0042A037 E81BE8FFFF              call 00428857
:0042A03C E867F7FFFF              call 004297A8
:0042A041 E80E000000              call 0042A054
:0042A046 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A049 50                      push eax
:0042A04A FF1594624800            call dword ptr [00486294]
:0042A050 8BE5                    mov esp, ebp
:0042A052 5D                      pop ebp
:0042A053 C3                      ret



* Referenced by a CALL at Address:
|:0042A041   
|
:0042A054 55                      push ebp
:0042A055 8BEC                    mov ebp, esp
:0042A057 83EC30                  sub esp, 00000030
:0042A05A 66C705A8EF49000000      mov word ptr [0049EFA8], 0000
:0042A063 33C0                    xor eax, eax
:0042A065 A094AB4A00              mov al, byte ptr [004AAB94]
:0042A06A 83F801                  cmp eax, 00000001
:0042A06D 0F853E020000            jne 0042A2B1
:0042A073 B970074B00              mov ecx, 004B0770
:0042A078 E893EDFEFF              call 00418E10
:0042A07D 25FF000000              and eax, 000000FF
:0042A082 99                      cdq
:0042A083 B914000000              mov ecx, 00000014
:0042A088 F7F9                    idiv ecx
:0042A08A 668945D8                mov word ptr [ebp-28], ax
:0042A08E B970074B00              mov ecx, 004B0770
:0042A093 E878EDFEFF              call 00418E10
:0042A098 25FF000000              and eax, 000000FF
:0042A09D 99                      cdq
:0042A09E B914000000              mov ecx, 00000014
:0042A0A3 F7F9                    idiv ecx
:0042A0A5 8BC2                    mov eax, edx
:0042A0A7 99                      cdq
:0042A0A8 2BC2                    sub eax, edx
:0042A0AA D1F8                    sar eax, 1
:0042A0AC 668945D0                mov word ptr [ebp-30], ax
:0042A0B0 8B55D8                  mov edx, dword ptr [ebp-28]
:0042A0B3 81E2FFFF0000            and edx, 0000FFFF
:0042A0B9 6BD20A                  imul edx, 0000000A
:0042A0BC 8B45D0                  mov eax, dword ptr [ebp-30]
:0042A0BF 25FFFF0000              and eax, 0000FFFF
:0042A0C4 03D0                    add edx, eax
:0042A0C6 668955D4                mov word ptr [ebp-2C], dx
:0042A0CA 6A04                    push 00000004
:0042A0CC 6A00                    push 00000000
:0042A0CE 68DC020000              push 000002DC
:0042A0D3 B990F44A00              mov ecx, 004AF490
:0042A0D8 E863590500              call 0047FA40
:0042A0DD 8945FC                  mov dword ptr [ebp-04], eax
:0042A0E0 6A00                    push 00000000
:0042A0E2 E8C1C9FFFF              call 00426AA8
:0042A0E7 83C404                  add esp, 00000004
:0042A0EA 8945F8                  mov dword ptr [ebp-08], eax
:0042A0ED 66C745EC0000            mov [ebp-14], 0000
:0042A0F3 EB1E                    jmp 0042A113

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A130(U)
|
:0042A0F5 668B4DEC                mov cx, word ptr [ebp-14]
:0042A0F9 6683C101                add cx, 0001
:0042A0FD 66894DEC                mov word ptr [ebp-14], cx
:0042A101 8B55F8                  mov edx, dword ptr [ebp-08]
:0042A104 83C240                  add edx, 00000040
:0042A107 8955F8                  mov dword ptr [ebp-08], edx
:0042A10A 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A10D 83C024                  add eax, 00000024
:0042A110 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A0F3(U)
|
:0042A113 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0042A116 81E1FFFF0000            and ecx, 0000FFFF
:0042A11C 81F980000000            cmp ecx, 00000080
:0042A122 7D0E                    jge 0042A132
:0042A124 8B55FC                  mov edx, dword ptr [ebp-04]
:0042A127 52                      push edx
:0042A128 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042A12B E893040000              call 0042A5C3
:0042A130 EBC3                    jmp 0042A0F5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A122(C)
|
:0042A132 6A04                    push 00000004
:0042A134 6A00                    push 00000000
:0042A136 68DC020000              push 000002DC
:0042A13B B990F44A00              mov ecx, 004AF490
:0042A140 E8FB580500              call 0047FA40
:0042A145 8945FC                  mov dword ptr [ebp-04], eax
:0042A148 6A00                    push 00000000
:0042A14A E859C9FFFF              call 00426AA8
:0042A14F 83C404                  add esp, 00000004
:0042A152 8945F8                  mov dword ptr [ebp-08], eax
:0042A155 66C745EC0000            mov [ebp-14], 0000
:0042A15B EB1E                    jmp 0042A17B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A25A(U)
|
:0042A15D 668B45EC                mov ax, word ptr [ebp-14]
:0042A161 66050100                add ax, 0001
:0042A165 668945EC                mov word ptr [ebp-14], ax
:0042A169 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042A16C 83C140                  add ecx, 00000040
:0042A16F 894DF8                  mov dword ptr [ebp-08], ecx
:0042A172 8B55FC                  mov edx, dword ptr [ebp-04]
:0042A175 83C224                  add edx, 00000024
:0042A178 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A15B(U)
|
:0042A17B 8B45EC                  mov eax, dword ptr [ebp-14]
:0042A17E 25FFFF0000              and eax, 0000FFFF
:0042A183 3D80000000              cmp eax, 00000080
:0042A188 0F8DD1000000            jnl 0042A25F
:0042A18E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042A191 E8BAECFEFF              call 00418E50
:0042A196 668945E0                mov word ptr [ebp-20], ax
:0042A19A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042A19D E84E0A0000              call 0042ABF0
:0042A1A2 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0042A1A5 81E1FFFF0000            and ecx, 0000FFFF
:0042A1AB 81E100800000            and ecx, 00008000
:0042A1B1 85C9                    test ecx, ecx
:0042A1B3 0F84A1000000            je 0042A25A
:0042A1B9 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042A1BC E8CF0A0000              call 0042AC90
:0042A1C1 668945DC                mov word ptr [ebp-24], ax
:0042A1C5 668B55DC                mov dx, word ptr [ebp-24]
:0042A1C9 52                      push edx
:0042A1CA E8DBC6FFFF              call 004268AA
:0042A1CF 83C404                  add esp, 00000004
:0042A1D2 668945F0                mov word ptr [ebp-10], ax
:0042A1D6 8B45F0                  mov eax, dword ptr [ebp-10]
:0042A1D9 25FFFF0000              and eax, 0000FFFF
:0042A1DE 3D00100000              cmp eax, 00001000
:0042A1E3 7575                    jne 0042A25A
:0042A1E5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042A1E8 E8A3070000              call 0042A990
:0042A1ED 668945F4                mov word ptr [ebp-0C], ax
:0042A1F1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042A1F4 E8F70D0000              call 0042AFF0
:0042A1F9 50                      push eax
:0042A1FA 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042A1FD E86E0D0000              call 0042AF70
:0042A202 50                      push eax
:0042A203 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042A206 E8C50D0000              call 0042AFD0
:0042A20B 50                      push eax
:0042A20C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042A20F E8FC0A0000              call 0042AD10
:0042A214 50                      push eax
:0042A215 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042A218 E8D30A0000              call 0042ACF0
:0042A21D 50                      push eax
:0042A21E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042A221 E8CA0B0000              call 0042ADF0
:0042A226 50                      push eax
:0042A227 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042A22A E8A10B0000              call 0042ADD0
:0042A22F 50                      push eax
:0042A230 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042A233 E8E8070000              call 0042AA20
:0042A238 50                      push eax
:0042A239 668B4DDC                mov cx, word ptr [ebp-24]
:0042A23D 51                      push ecx
:0042A23E E86DECFFFF              call 00428EB0
:0042A243 83C424                  add esp, 00000024
:0042A246 668945E4                mov word ptr [ebp-1C], ax
:0042A24A 668B55E4                mov dx, word ptr [ebp-1C]
:0042A24E 52                      push edx
:0042A24F E854C8FFFF              call 00426AA8
:0042A254 83C404                  add esp, 00000004
:0042A257 8945E8                  mov dword ptr [ebp-18], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042A1B3(C), :0042A1E3(C)
|
:0042A25A E9FEFEFFFF              jmp 0042A15D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A188(C)
|
:0042A25F 6A01                    push 00000001
:0042A261 E835D1FFFF              call 0042739B
:0042A266 83C404                  add esp, 00000004
:0042A269 C60594AB4A0000          mov byte ptr [004AAB94], 00
:0042A270 E83EDFFFFF              call 004281B3
:0042A275 E88B41FFFF              call 0041E405
:0042A27A 6828114A00              push 004A1128
:0042A27F E88BC20400              call 0047650F
:0042A284 83C404                  add esp, 00000004
:0042A287 6858074B00              push 004B0758
:0042A28C E881C30400              call 00476612
:0042A291 83C404                  add esp, 00000004
:0042A294 6858074B00              push 004B0758
:0042A299 6A02                    push 00000002
:0042A29B E8F9530000              call 0042F699
:0042A2A0 83C408                  add esp, 00000008
:0042A2A3 6A00                    push 00000000
:0042A2A5 B9386F4900              mov ecx, 00496F38
:0042A2AA E873FAFEFF              call 00419D22
:0042A2AF EB0F                    jmp 0042A2C0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A06D(C)
|
:0042A2B1 6A00                    push 00000000
:0042A2B3 E8E3D0FFFF              call 0042739B
:0042A2B8 83C404                  add esp, 00000004
:0042A2BB E8F3DEFFFF              call 004281B3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A2AF(U)
|
:0042A2C0 8BE5                    mov esp, ebp
:0042A2C2 5D                      pop ebp
:0042A2C3 C3                      ret



* Referenced by a CALL at Address:
|:00427B40   
|
:0042A2C4 55                      push ebp
:0042A2C5 8BEC                    mov ebp, esp
:0042A2C7 83EC08                  sub esp, 00000008
:0042A2CA 894DF8                  mov dword ptr [ebp-08], ecx
:0042A2CD 668B450C                mov ax, word ptr [ebp+0C]
:0042A2D1 662D4000                sub ax, 0040
:0042A2D5 6689450C                mov word ptr [ebp+0C], ax
:0042A2D9 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042A2DC E85F0D0000              call 0042B040
:0042A2E1 668B4D0C                mov cx, word ptr [ebp+0C]
:0042A2E5 51                      push ecx
:0042A2E6 668B5508                mov dx, word ptr [ebp+08]
:0042A2EA 52                      push edx
:0042A2EB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042A2EE E86D0B0000              call 0042AE60
:0042A2F3 8B4508                  mov eax, dword ptr [ebp+08]
:0042A2F6 25FFFF0000              and eax, 0000FFFF
:0042A2FB 8945FC                  mov dword ptr [ebp-04], eax
:0042A2FE 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042A301 81E1FFFF0000            and ecx, 0000FFFF
:0042A307 81E100800000            and ecx, 00008000
:0042A30D 85C9                    test ecx, ecx
:0042A30F 7412                    je 0042A323
:0042A311 8B5508                  mov edx, dword ptr [ebp+08]
:0042A314 81E2FFFF0000            and edx, 0000FFFF
:0042A31A 81EAFFFF0000            sub edx, 0000FFFF
:0042A320 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A30F(C)
|
:0042A323 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042A326 E8E50C0000              call 0042B010
:0042A32B 50                      push eax
:0042A32C 6A40                    push 00000040
:0042A32E 6A30                    push 00000030
:0042A330 8B450C                  mov eax, dword ptr [ebp+0C]
:0042A333 25FFFF0000              and eax, 0000FFFF
:0042A338 50                      push eax
:0042A339 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042A33C 51                      push ecx
:0042A33D E8593D0500              call 0047E09B
:0042A342 83C414                  add esp, 00000014
:0042A345 6A40                    push 00000040
:0042A347 6A30                    push 00000030
:0042A349 668B550C                mov dx, word ptr [ebp+0C]
:0042A34D 52                      push edx
:0042A34E 668B4508                mov ax, word ptr [ebp+08]
:0042A352 50                      push eax
:0042A353 E845D5FFFF              call 0042789D
:0042A358 83C410                  add esp, 00000010
:0042A35B 8BE5                    mov esp, ebp
:0042A35D 5D                      pop ebp
:0042A35E C20800                  ret 0008



* Referenced by a CALL at Address:
|:00429D10   
|
:0042A361 55                      push ebp
:0042A362 8BEC                    mov ebp, esp
:0042A364 83EC28                  sub esp, 00000028
:0042A367 894DDC                  mov dword ptr [ebp-24], ecx
:0042A36A 8B45DC                  mov eax, dword ptr [ebp-24]
:0042A36D 33C9                    xor ecx, ecx
:0042A36F 668B08                  mov cx, word ptr [eax]
:0042A372 8B55DC                  mov edx, dword ptr [ebp-24]
:0042A375 33C0                    xor eax, eax
:0042A377 668B4202                mov ax, word ptr [edx+02]
:0042A37B 3BC8                    cmp ecx, eax
:0042A37D 7E17                    jle 0042A396
:0042A37F 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0042A382 668B5102                mov dx, word ptr [ecx+02]
:0042A386 6683C201                add dx, 0001
:0042A38A 8B45DC                  mov eax, dword ptr [ebp-24]
:0042A38D 66895002                mov word ptr [eax+02], dx
:0042A391 E913010000              jmp 0042A4A9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A37D(C)
|
:0042A396 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0042A399 66C741020000            mov [ecx+02], 0000
:0042A39F 66C745F40000            mov [ebp-0C], 0000
:0042A3A5 8B55DC                  mov edx, dword ptr [ebp-24]
:0042A3A8 33C0                    xor eax, eax
:0042A3AA 668B423C                mov ax, word ptr [edx+3C]
:0042A3AE 3DFFFF0000              cmp eax, 0000FFFF
:0042A3B3 7509                    jne 0042A3BE
:0042A3B5 660DFFFF                or ax, FFFF
:0042A3B9 E9EE000000              jmp 0042A4AC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A3B3(C)
|
:0042A3BE 6A04                    push 00000004
:0042A3C0 6A00                    push 00000000
:0042A3C2 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0042A3C5 33D2                    xor edx, edx
:0042A3C7 668B513E                mov dx, word ptr [ecx+3E]
:0042A3CB 52                      push edx
:0042A3CC B9C8E44A00              mov ecx, 004AE4C8
:0042A3D1 E86A560500              call 0047FA40
:0042A3D6 8945FC                  mov dword ptr [ebp-04], eax
:0042A3D9 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A3DC 8945EC                  mov dword ptr [ebp-14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A4A4(U)
|
:0042A3DF 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0042A3E2 51                      push ecx
:0042A3E3 8B55FC                  mov edx, dword ptr [ebp-04]
:0042A3E6 52                      push edx
:0042A3E7 E818DBFFFF              call 00427F04
:0042A3EC 83C408                  add esp, 00000008
:0042A3EF 8845E8                  mov byte ptr [ebp-18], al
:0042A3F2 8B45E8                  mov eax, dword ptr [ebp-18]
:0042A3F5 25FF000000              and eax, 000000FF
:0042A3FA 3DEF000000              cmp eax, 000000EF
:0042A3FF 7509                    jne 0042A40A
:0042A401 660DFFFF                or ax, FFFF
:0042A405 E9A2000000              jmp 0042A4AC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A3FF(C)
|
:0042A40A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042A40D 81E1FFFF0000            and ecx, 0000FFFF
:0042A413 83F901                  cmp ecx, 00000001
:0042A416 7505                    jne 0042A41D
:0042A418 E98C000000              jmp 0042A4A9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A416(C)
|
:0042A41D 8B55FC                  mov edx, dword ptr [ebp-04]
:0042A420 8955F0                  mov dword ptr [ebp-10], edx
:0042A423 8B45F0                  mov eax, dword ptr [ebp-10]
:0042A426 83C001                  add eax, 00000001
:0042A429 8945F0                  mov dword ptr [ebp-10], eax
:0042A42C 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0042A42F 81E1FF000000            and ecx, 000000FF
:0042A435 81E1F0000000            and ecx, 000000F0
:0042A43B 884DE0                  mov byte ptr [ebp-20], cl
:0042A43E 8B55E8                  mov edx, dword ptr [ebp-18]
:0042A441 81E2FF000000            and edx, 000000FF
:0042A447 80E20F                  and dl, 0F
:0042A44A 8855E4                  mov byte ptr [ebp-1C], dl
:0042A44D 66C745F40100            mov [ebp-0C], 0001
:0042A453 8A45E0                  mov al, byte ptr [ebp-20]
:0042A456 8845D8                  mov byte ptr [ebp-28], al
:0042A459 807DD800                cmp byte ptr [ebp-28], 00
:0042A45D 7408                    je 0042A467
:0042A45F 807DD810                cmp byte ptr [ebp-28], 10
:0042A463 7412                    je 0042A477
:0042A465 EB1C                    jmp 0042A483

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A45D(C)
|
:0042A467 660FB64DE4              movzx cx, byte ptr [ebp-1C]
:0042A46C 51                      push ecx
:0042A46D 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0042A470 E880000000              call 0042A4F5
:0042A475 EB0C                    jmp 0042A483

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A463(C)
|
:0042A477 660FB655E4              movzx dx, byte ptr [ebp-1C]
:0042A47C 8B45DC                  mov eax, dword ptr [ebp-24]
:0042A47F 6689502E                mov word ptr [eax+2E], dx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042A465(U), :0042A475(U)
|
:0042A483 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042A486 51                      push ecx
:0042A487 E8A2DAFFFF              call 00427F2E
:0042A48C 83C404                  add esp, 00000004
:0042A48F 8945FC                  mov dword ptr [ebp-04], eax
:0042A492 8B55DC                  mov edx, dword ptr [ebp-24]
:0042A495 668B423E                mov ax, word ptr [edx+3E]
:0042A499 660345F8                add ax, word ptr [ebp-08]
:0042A49D 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0042A4A0 6689413E                mov word ptr [ecx+3E], ax
:0042A4A4 E936FFFFFF              jmp 0042A3DF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042A391(U), :0042A418(U)
|
:0042A4A9 6633C0                  xor ax, ax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042A3B9(U), :0042A405(U)
|
:0042A4AC 8BE5                    mov esp, ebp
:0042A4AE 5D                      pop ebp
:0042A4AF C3                      ret



* Referenced by a CALL at Addresses:
|:00428BED   , :00428D91   , :00429251   
|
:0042A4B0 55                      push ebp
:0042A4B1 8BEC                    mov ebp, esp
:0042A4B3 83EC08                  sub esp, 00000008
:0042A4B6 894DF8                  mov dword ptr [ebp-08], ecx
:0042A4B9 668B4508                mov ax, word ptr [ebp+08]
:0042A4BD 50                      push eax
:0042A4BE E8AEC3FFFF              call 00426871
:0042A4C3 83C404                  add esp, 00000004
:0042A4C6 8945FC                  mov dword ptr [ebp-04], eax
:0042A4C9 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042A4CC 8B55FC                  mov edx, dword ptr [ebp-04]
:0042A4CF 895134                  mov dword ptr [ecx+34], edx
:0042A4D2 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A4D5 660FB64801              movzx cx, byte ptr [eax+01]
:0042A4DA 8B55F8                  mov edx, dword ptr [ebp-08]
:0042A4DD 66894A2A                mov word ptr [edx+2A], cx
:0042A4E1 8BE5                    mov esp, ebp
:0042A4E3 5D                      pop ebp
:0042A4E4 C20400                  ret 0004


:0042A4E7 55                      push ebp
:0042A4E8 8BEC                    mov ebp, esp
:0042A4EA 51                      push ecx
:0042A4EB 894DFC                  mov dword ptr [ebp-04], ecx
:0042A4EE 6633C0                  xor ax, ax
:0042A4F1 8BE5                    mov esp, ebp
:0042A4F3 5D                      pop ebp
:0042A4F4 C3                      ret



* Referenced by a CALL at Address:
|:0042A470   
|
:0042A4F5 55                      push ebp
:0042A4F6 8BEC                    mov ebp, esp
:0042A4F8 83EC0C                  sub esp, 0000000C
:0042A4FB 894DF4                  mov dword ptr [ebp-0C], ecx
:0042A4FE 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042A501 668B481A                mov cx, word ptr [eax+1A]
:0042A505 6683C101                add cx, 0001
:0042A509 8B55F4                  mov edx, dword ptr [ebp-0C]
:0042A50C 66894A1A                mov word ptr [edx+1A], cx
:0042A510 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042A513 8B4834                  mov ecx, dword ptr [eax+34]
:0042A516 33D2                    xor edx, edx
:0042A518 8A11                    mov dl, byte ptr [ecx]
:0042A51A 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042A51D 33C9                    xor ecx, ecx
:0042A51F 668B481A                mov cx, word ptr [eax+1A]
:0042A523 3BD1                    cmp edx, ecx
:0042A525 7F09                    jg 0042A530
:0042A527 8B55F4                  mov edx, dword ptr [ebp-0C]
:0042A52A 66C7421A0000            mov [edx+1A], 0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A525(C)
|
:0042A530 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042A533 8B4834                  mov ecx, dword ptr [eax+34]
:0042A536 8B55F4                  mov edx, dword ptr [ebp-0C]
:0042A539 33C0                    xor eax, eax
:0042A53B 668B421A                mov ax, word ptr [edx+1A]
:0042A53F 660FB64C0101            movzx cx, byte ptr [ecx+eax+01]
:0042A545 8B55F4                  mov edx, dword ptr [ebp-0C]
:0042A548 66894A2A                mov word ptr [edx+2A], cx
:0042A54C 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042A54F 668B4804                mov cx, word ptr [eax+04]
:0042A553 66894DFC                mov word ptr [ebp-04], cx
:0042A557 8B55F4                  mov edx, dword ptr [ebp-0C]
:0042A55A 668B4206                mov ax, word ptr [edx+06]
:0042A55E 668945F8                mov word ptr [ebp-08], ax
:0042A562 668B4D08                mov cx, word ptr [ebp+08]
:0042A566 51                      push ecx
:0042A567 8B55F4                  mov edx, dword ptr [ebp-0C]
:0042A56A 668B420C                mov ax, word ptr [edx+0C]
:0042A56E 50                      push eax
:0042A56F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042A572 668B510A                mov dx, word ptr [ecx+0A]
:0042A576 52                      push edx
:0042A577 8D45F8                  lea eax, dword ptr [ebp-08]
:0042A57A 50                      push eax
:0042A57B 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0042A57E 51                      push ecx
:0042A57F E886DDFFFF              call 0042830A
:0042A584 83C414                  add esp, 00000014
:0042A587 25FFFF0000              and eax, 0000FFFF
:0042A58C 3DFFFF0000              cmp eax, 0000FFFF
:0042A591 7428                    je 0042A5BB
:0042A593 8B55F4                  mov edx, dword ptr [ebp-0C]
:0042A596 668B45FC                mov ax, word ptr [ebp-04]
:0042A59A 66894204                mov word ptr [edx+04], ax
:0042A59E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042A5A1 668B55F8                mov dx, word ptr [ebp-08]
:0042A5A5 66895106                mov word ptr [ecx+06], dx
:0042A5A9 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042A5AC 668B4D08                mov cx, word ptr [ebp+08]
:0042A5B0 6689482E                mov word ptr [eax+2E], cx
:0042A5B4 B801000000              mov eax, 00000001
:0042A5B9 EB02                    jmp 0042A5BD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A591(C)
|
:0042A5BB 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042A5B9(U)
|
:0042A5BD 8BE5                    mov esp, ebp
:0042A5BF 5D                      pop ebp
:0042A5C0 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0041AFCA   , :0042A12B   
|
:0042A5C3 55                      push ebp
:0042A5C4 8BEC                    mov ebp, esp
:0042A5C6 83EC08                  sub esp, 00000008
:0042A5C9 894DF8                  mov dword ptr [ebp-08], ecx
:0042A5CC 8B4508                  mov eax, dword ptr [ebp+08]
:0042A5CF 8945FC                  mov dword ptr [ebp-04], eax
:0042A5D2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042A5D5 8B55FC                  mov edx, dword ptr [ebp-04]
:0042A5D8 668B02                  mov ax, word ptr [edx]
:0042A5DB 668901                  mov word ptr [ecx], ax
:0042A5DE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042A5E1 83C102                  add ecx, 00000002
:0042A5E4 894DFC                  mov dword ptr [ebp-04], ecx
:0042A5E7 8B55F8                  mov edx, dword ptr [ebp-08]
:0042A5EA 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A5ED 668B08                  mov cx, word ptr [eax]
:0042A5F0 66894A02                mov word ptr [edx+02], cx
:0042A5F4 8B55FC                  mov edx, dword ptr [ebp-04]
:0042A5F7 83C202                  add edx, 00000002
:0042A5FA 8955FC                  mov dword ptr [ebp-04], edx
:0042A5FD 8B45F8                  mov eax, dword ptr [ebp-08]
:0042A600 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042A603 668B11                  mov dx, word ptr [ecx]
:0042A606 66895004                mov word ptr [eax+04], dx
:0042A60A 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A60D 83C002                  add eax, 00000002
:0042A610 8945FC                  mov dword ptr [ebp-04], eax
:0042A613 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042A616 8B55FC                  mov edx, dword ptr [ebp-04]
:0042A619 668B02                  mov ax, word ptr [edx]
:0042A61C 66894106                mov word ptr [ecx+06], ax
:0042A620 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042A623 83C102                  add ecx, 00000002
:0042A626 894DFC                  mov dword ptr [ebp-04], ecx
:0042A629 8B55F8                  mov edx, dword ptr [ebp-08]
:0042A62C 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A62F 668B08                  mov cx, word ptr [eax]
:0042A632 66894A08                mov word ptr [edx+08], cx
:0042A636 8B55FC                  mov edx, dword ptr [ebp-04]
:0042A639 83C202                  add edx, 00000002
:0042A63C 8955FC                  mov dword ptr [ebp-04], edx
:0042A63F 8B45F8                  mov eax, dword ptr [ebp-08]
:0042A642 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042A645 668B11                  mov dx, word ptr [ecx]
:0042A648 6689500A                mov word ptr [eax+0A], dx
:0042A64C 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A64F 83C002                  add eax, 00000002
:0042A652 8945FC                  mov dword ptr [ebp-04], eax
:0042A655 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042A658 8B55FC                  mov edx, dword ptr [ebp-04]
:0042A65B 668B02                  mov ax, word ptr [edx]
:0042A65E 6689410C                mov word ptr [ecx+0C], ax
:0042A662 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042A665 83C102                  add ecx, 00000002
:0042A668 894DFC                  mov dword ptr [ebp-04], ecx
:0042A66B 8B55F8                  mov edx, dword ptr [ebp-08]
:0042A66E 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A671 668B08                  mov cx, word ptr [eax]
:0042A674 66894A0E                mov word ptr [edx+0E], cx
:0042A678 8B55FC                  mov edx, dword ptr [ebp-04]
:0042A67B 83C202                  add edx, 00000002
:0042A67E 8955FC                  mov dword ptr [ebp-04], edx
:0042A681 8B45F8                  mov eax, dword ptr [ebp-08]
:0042A684 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042A687 668B11                  mov dx, word ptr [ecx]
:0042A68A 66895016                mov word ptr [eax+16], dx
:0042A68E 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A691 83C002                  add eax, 00000002
:0042A694 8945FC                  mov dword ptr [ebp-04], eax
:0042A697 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042A69A 8B55FC                  mov edx, dword ptr [ebp-04]
:0042A69D 668B02                  mov ax, word ptr [edx]
:0042A6A0 66894118                mov word ptr [ecx+18], ax
:0042A6A4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042A6A7 83C102                  add ecx, 00000002
:0042A6AA 894DFC                  mov dword ptr [ebp-04], ecx
:0042A6AD 8B55F8                  mov edx, dword ptr [ebp-08]
:0042A6B0 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A6B3 668B08                  mov cx, word ptr [eax]
:0042A6B6 66894A1A                mov word ptr [edx+1A], cx
:0042A6BA 8B55FC                  mov edx, dword ptr [ebp-04]
:0042A6BD 83C202                  add edx, 00000002
:0042A6C0 8955FC                  mov dword ptr [ebp-04], edx
:0042A6C3 8B45F8                  mov eax, dword ptr [ebp-08]
:0042A6C6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042A6C9 668B11                  mov dx, word ptr [ecx]
:0042A6CC 6689501C                mov word ptr [eax+1C], dx
:0042A6D0 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A6D3 83C002                  add eax, 00000002
:0042A6D6 8945FC                  mov dword ptr [ebp-04], eax
:0042A6D9 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042A6DC 8B55FC                  mov edx, dword ptr [ebp-04]
:0042A6DF 668B02                  mov ax, word ptr [edx]
:0042A6E2 66894128                mov word ptr [ecx+28], ax
:0042A6E6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042A6E9 83C102                  add ecx, 00000002
:0042A6EC 894DFC                  mov dword ptr [ebp-04], ecx
:0042A6EF 8B55F8                  mov edx, dword ptr [ebp-08]
:0042A6F2 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A6F5 668B08                  mov cx, word ptr [eax]
:0042A6F8 66894A2C                mov word ptr [edx+2C], cx
:0042A6FC 8B55FC                  mov edx, dword ptr [ebp-04]
:0042A6FF 83C202                  add edx, 00000002
:0042A702 8955FC                  mov dword ptr [ebp-04], edx
:0042A705 8B45F8                  mov eax, dword ptr [ebp-08]
:0042A708 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042A70B 668B11                  mov dx, word ptr [ecx]
:0042A70E 6689502E                mov word ptr [eax+2E], dx
:0042A712 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A715 83C002                  add eax, 00000002
:0042A718 8945FC                  mov dword ptr [ebp-04], eax
:0042A71B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042A71E 8B55FC                  mov edx, dword ptr [ebp-04]
:0042A721 668B02                  mov ax, word ptr [edx]
:0042A724 66894130                mov word ptr [ecx+30], ax
:0042A728 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042A72B 83C102                  add ecx, 00000002
:0042A72E 894DFC                  mov dword ptr [ebp-04], ecx
:0042A731 8B55F8                  mov edx, dword ptr [ebp-08]
:0042A734 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A737 668B08                  mov cx, word ptr [eax]
:0042A73A 66894A38                mov word ptr [edx+38], cx
:0042A73E 8B55FC                  mov edx, dword ptr [ebp-04]
:0042A741 83C202                  add edx, 00000002
:0042A744 8955FC                  mov dword ptr [ebp-04], edx
:0042A747 8B45F8                  mov eax, dword ptr [ebp-08]
:0042A74A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042A74D 668B11                  mov dx, word ptr [ecx]
:0042A750 6689503A                mov word ptr [eax+3A], dx
:0042A754 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A757 83C002                  add eax, 00000002
:0042A75A 8945FC                  mov dword ptr [ebp-04], eax
:0042A75D 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A760 8BE5                    mov esp, ebp
:0042A762 5D                      pop ebp
:0042A763 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0041B35B   
|
:0042A766 55                      push ebp
:0042A767 8BEC                    mov ebp, esp
:0042A769 83EC08                  sub esp, 00000008
:0042A76C 894DF8                  mov dword ptr [ebp-08], ecx
:0042A76F 8B4508                  mov eax, dword ptr [ebp+08]
:0042A772 8945FC                  mov dword ptr [ebp-04], eax
:0042A775 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042A778 8B55F8                  mov edx, dword ptr [ebp-08]
:0042A77B 668B02                  mov ax, word ptr [edx]
:0042A77E 668901                  mov word ptr [ecx], ax
:0042A781 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042A784 83C102                  add ecx, 00000002
:0042A787 894DFC                  mov dword ptr [ebp-04], ecx
:0042A78A 8B55FC                  mov edx, dword ptr [ebp-04]
:0042A78D 8B45F8                  mov eax, dword ptr [ebp-08]
:0042A790 668B4802                mov cx, word ptr [eax+02]
:0042A794 66890A                  mov word ptr [edx], cx
:0042A797 8B55FC                  mov edx, dword ptr [ebp-04]
:0042A79A 83C202                  add edx, 00000002
:0042A79D 8955FC                  mov dword ptr [ebp-04], edx
:0042A7A0 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A7A3 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042A7A6 668B5104                mov dx, word ptr [ecx+04]
:0042A7AA 668910                  mov word ptr [eax], dx
:0042A7AD 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A7B0 83C002                  add eax, 00000002
:0042A7B3 8945FC                  mov dword ptr [ebp-04], eax
:0042A7B6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042A7B9 8B55F8                  mov edx, dword ptr [ebp-08]
:0042A7BC 668B4206                mov ax, word ptr [edx+06]
:0042A7C0 668901                  mov word ptr [ecx], ax
:0042A7C3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042A7C6 83C102                  add ecx, 00000002
:0042A7C9 894DFC                  mov dword ptr [ebp-04], ecx
:0042A7CC 8B55FC                  mov edx, dword ptr [ebp-04]
:0042A7CF 8B45F8                  mov eax, dword ptr [ebp-08]
:0042A7D2 668B4808                mov cx, word ptr [eax+08]
:0042A7D6 66890A                  mov word ptr [edx], cx
:0042A7D9 8B55FC                  mov edx, dword ptr [ebp-04]
:0042A7DC 83C202                  add edx, 00000002
:0042A7DF 8955FC                  mov dword ptr [ebp-04], edx
:0042A7E2 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A7E5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042A7E8 668B510A                mov dx, word ptr [ecx+0A]
:0042A7EC 668910                  mov word ptr [eax], dx
:0042A7EF 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A7F2 83C002                  add eax, 00000002
:0042A7F5 8945FC                  mov dword ptr [ebp-04], eax
:0042A7F8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042A7FB 8B55F8                  mov edx, dword ptr [ebp-08]
:0042A7FE 668B420C                mov ax, word ptr [edx+0C]
:0042A802 668901                  mov word ptr [ecx], ax
:0042A805 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042A808 83C102                  add ecx, 00000002
:0042A80B 894DFC                  mov dword ptr [ebp-04], ecx
:0042A80E 8B55FC                  mov edx, dword ptr [ebp-04]
:0042A811 8B45F8                  mov eax, dword ptr [ebp-08]
:0042A814 668B480E                mov cx, word ptr [eax+0E]
:0042A818 66890A                  mov word ptr [edx], cx
:0042A81B 8B55FC                  mov edx, dword ptr [ebp-04]
:0042A81E 83C202                  add edx, 00000002
:0042A821 8955FC                  mov dword ptr [ebp-04], edx
:0042A824 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A827 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042A82A 668B5116                mov dx, word ptr [ecx+16]
:0042A82E 668910                  mov word ptr [eax], dx
:0042A831 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A834 83C002                  add eax, 00000002
:0042A837 8945FC                  mov dword ptr [ebp-04], eax
:0042A83A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042A83D 8B55F8                  mov edx, dword ptr [ebp-08]
:0042A840 668B4218                mov ax, word ptr [edx+18]
:0042A844 668901                  mov word ptr [ecx], ax
:0042A847 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042A84A 83C102                  add ecx, 00000002
:0042A84D 894DFC                  mov dword ptr [ebp-04], ecx
:0042A850 8B55FC                  mov edx, dword ptr [ebp-04]
:0042A853 8B45F8                  mov eax, dword ptr [ebp-08]
:0042A856 668B481A                mov cx, word ptr [eax+1A]
:0042A85A 66890A                  mov word ptr [edx], cx
:0042A85D 8B55FC                  mov edx, dword ptr [ebp-04]
:0042A860 83C202                  add edx, 00000002
:0042A863 8955FC                  mov dword ptr [ebp-04], edx
:0042A866 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A869 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042A86C 668B511C                mov dx, word ptr [ecx+1C]
:0042A870 668910                  mov word ptr [eax], dx
:0042A873 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A876 83C002                  add eax, 00000002
:0042A879 8945FC                  mov dword ptr [ebp-04], eax
:0042A87C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042A87F 8B55F8                  mov edx, dword ptr [ebp-08]
:0042A882 668B4228                mov ax, word ptr [edx+28]
:0042A886 668901                  mov word ptr [ecx], ax
:0042A889 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042A88C 83C102                  add ecx, 00000002
:0042A88F 894DFC                  mov dword ptr [ebp-04], ecx
:0042A892 8B55FC                  mov edx, dword ptr [ebp-04]
:0042A895 8B45F8                  mov eax, dword ptr [ebp-08]
:0042A898 668B482C                mov cx, word ptr [eax+2C]
:0042A89C 66890A                  mov word ptr [edx], cx
:0042A89F 8B55FC                  mov edx, dword ptr [ebp-04]
:0042A8A2 83C202                  add edx, 00000002
:0042A8A5 8955FC                  mov dword ptr [ebp-04], edx
:0042A8A8 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A8AB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042A8AE 668B512E                mov dx, word ptr [ecx+2E]
:0042A8B2 668910                  mov word ptr [eax], dx
:0042A8B5 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A8B8 83C002                  add eax, 00000002
:0042A8BB 8945FC                  mov dword ptr [ebp-04], eax
:0042A8BE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042A8C1 8B55F8                  mov edx, dword ptr [ebp-08]
:0042A8C4 668B4230                mov ax, word ptr [edx+30]
:0042A8C8 668901                  mov word ptr [ecx], ax
:0042A8CB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042A8CE 83C102                  add ecx, 00000002
:0042A8D1 894DFC                  mov dword ptr [ebp-04], ecx
:0042A8D4 8B55FC                  mov edx, dword ptr [ebp-04]
:0042A8D7 8B45F8                  mov eax, dword ptr [ebp-08]
:0042A8DA 668B4838                mov cx, word ptr [eax+38]
:0042A8DE 66890A                  mov word ptr [edx], cx
:0042A8E1 8B55FC                  mov edx, dword ptr [ebp-04]
:0042A8E4 83C202                  add edx, 00000002
:0042A8E7 8955FC                  mov dword ptr [ebp-04], edx
:0042A8EA 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A8ED 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042A8F0 668B513A                mov dx, word ptr [ecx+3A]
:0042A8F4 668910                  mov word ptr [eax], dx
:0042A8F7 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A8FA 83C002                  add eax, 00000002
:0042A8FD 8945FC                  mov dword ptr [ebp-04], eax
:0042A900 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A903 8BE5                    mov esp, ebp
:0042A905 5D                      pop ebp
:0042A906 C20400                  ret 0004


:0042A909 CC                      int 03
:0042A90A CC                      int 03
:0042A90B CC                      int 03
:0042A90C CC                      int 03
:0042A90D CC                      int 03
:0042A90E CC                      int 03
:0042A90F CC                      int 03

* Referenced by a CALL at Addresses:
|:00411A16   , :004181A2   , :004181EB   , :00418246   , :00418279   
|:0041BA0D   , :0041BA2A   , :00428A01   , :00428A79   , :00428F32   
|:0042BF26   , :0042BF5C   , :0042D3A1   , :0042DB40   , :00432A3F   
|:0044D2DC   , :0044D86C   , :0044F104   , :004566F6   , :0045677F   
|:00456C88   , :00456CF7   , :0045DD1A   , :0045DD24   , :004745D8   
|:00474785   
|
:0042A910 55                      push ebp
:0042A911 8BEC                    mov ebp, esp
:0042A913 51                      push ecx
:0042A914 894DFC                  mov dword ptr [ebp-04], ecx
:0042A917 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A91A 33C9                    xor ecx, ecx
:0042A91C 668B08                  mov cx, word ptr [eax]
:0042A91F 8BC1                    mov eax, ecx
:0042A921 8BE5                    mov esp, ebp
:0042A923 5D                      pop ebp
:0042A924 C3                      ret


:0042A925 CC                      int 03
:0042A926 CC                      int 03
:0042A927 CC                      int 03
:0042A928 CC                      int 03
:0042A929 CC                      int 03
:0042A92A CC                      int 03
:0042A92B CC                      int 03
:0042A92C CC                      int 03
:0042A92D CC                      int 03
:0042A92E CC                      int 03
:0042A92F CC                      int 03

* Referenced by a CALL at Address:
|:00428F01   
|
:0042A930 55                      push ebp
:0042A931 8BEC                    mov ebp, esp
:0042A933 51                      push ecx
:0042A934 894DFC                  mov dword ptr [ebp-04], ecx
:0042A937 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A93A 33C9                    xor ecx, ecx
:0042A93C 668B08                  mov cx, word ptr [eax]
:0042A93F 8BC1                    mov eax, ecx
:0042A941 2500F00000              and eax, 0000F000
:0042A946 8BE5                    mov esp, ebp
:0042A948 5D                      pop ebp
:0042A949 C3                      ret


:0042A94A CC                      int 03
:0042A94B CC                      int 03
:0042A94C CC                      int 03
:0042A94D CC                      int 03
:0042A94E CC                      int 03
:0042A94F CC                      int 03

* Referenced by a CALL at Address:
|:00428F24   
|
:0042A950 55                      push ebp
:0042A951 8BEC                    mov ebp, esp
:0042A953 51                      push ecx
:0042A954 894DFC                  mov dword ptr [ebp-04], ecx
:0042A957 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A95A 8A4002                  mov al, byte ptr [eax+02]
:0042A95D 8BE5                    mov esp, ebp
:0042A95F 5D                      pop ebp
:0042A960 C3                      ret


:0042A961 CC                      int 03
:0042A962 CC                      int 03
:0042A963 CC                      int 03
:0042A964 CC                      int 03
:0042A965 CC                      int 03
:0042A966 CC                      int 03
:0042A967 CC                      int 03
:0042A968 CC                      int 03
:0042A969 CC                      int 03
:0042A96A CC                      int 03
:0042A96B CC                      int 03
:0042A96C CC                      int 03
:0042A96D CC                      int 03
:0042A96E CC                      int 03
:0042A96F CC                      int 03
:0042A970 55                      push ebp
:0042A971 8BEC                    mov ebp, esp
:0042A973 51                      push ecx
:0042A974 894DFC                  mov dword ptr [ebp-04], ecx
:0042A977 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A97A 66C7000000              mov word ptr [eax], 0000
:0042A97F 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A982 8BE5                    mov esp, ebp
:0042A984 5D                      pop ebp
:0042A985 C3                      ret


:0042A986 CC                      int 03
:0042A987 CC                      int 03
:0042A988 CC                      int 03
:0042A989 CC                      int 03
:0042A98A CC                      int 03
:0042A98B CC                      int 03
:0042A98C CC                      int 03
:0042A98D CC                      int 03
:0042A98E CC                      int 03
:0042A98F CC                      int 03

* Referenced by a CALL at Addresses:
|:004276CB   , :0042905F   , :0042A1E8   
|
:0042A990 55                      push ebp
:0042A991 8BEC                    mov ebp, esp
:0042A993 51                      push ecx
:0042A994 894DFC                  mov dword ptr [ebp-04], ecx
:0042A997 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A99A 668B00                  mov ax, word ptr [eax]
:0042A99D 8BE5                    mov esp, ebp
:0042A99F 5D                      pop ebp
:0042A9A0 C3                      ret


:0042A9A1 CC                      int 03
:0042A9A2 CC                      int 03
:0042A9A3 CC                      int 03
:0042A9A4 CC                      int 03
:0042A9A5 CC                      int 03
:0042A9A6 CC                      int 03
:0042A9A7 CC                      int 03
:0042A9A8 CC                      int 03
:0042A9A9 CC                      int 03
:0042A9AA CC                      int 03
:0042A9AB CC                      int 03
:0042A9AC CC                      int 03
:0042A9AD CC                      int 03
:0042A9AE CC                      int 03
:0042A9AF CC                      int 03

* Referenced by a CALL at Address:
|:004275C9   
|
:0042A9B0 55                      push ebp
:0042A9B1 8BEC                    mov ebp, esp
:0042A9B3 51                      push ecx
:0042A9B4 894DFC                  mov dword ptr [ebp-04], ecx
:0042A9B7 8B450C                  mov eax, dword ptr [ebp+0C]
:0042A9BA 25FFFF0000              and eax, 0000FFFF
:0042A9BF F7D0                    not eax
:0042A9C1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042A9C4 668B11                  mov dx, word ptr [ecx]
:0042A9C7 6623D0                  and dx, ax
:0042A9CA 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A9CD 668910                  mov word ptr [eax], dx
:0042A9D0 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042A9D3 81E1FFFF0000            and ecx, 0000FFFF
:0042A9D9 8B550C                  mov edx, dword ptr [ebp+0C]
:0042A9DC 81E2FFFF0000            and edx, 0000FFFF
:0042A9E2 23CA                    and ecx, edx
:0042A9E4 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A9E7 668B10                  mov dx, word ptr [eax]
:0042A9EA 660BD1                  or dx, cx
:0042A9ED 8B45FC                  mov eax, dword ptr [ebp-04]
:0042A9F0 668910                  mov word ptr [eax], dx
:0042A9F3 8BE5                    mov esp, ebp
:0042A9F5 5D                      pop ebp
:0042A9F6 C20800                  ret 0008


:0042A9F9 CC                      int 03
:0042A9FA CC                      int 03
:0042A9FB CC                      int 03
:0042A9FC CC                      int 03
:0042A9FD CC                      int 03
:0042A9FE CC                      int 03
:0042A9FF CC                      int 03

* Referenced by a CALL at Address:
|:00429075   
|
:0042AA00 55                      push ebp
:0042AA01 8BEC                    mov ebp, esp
:0042AA03 51                      push ecx
:0042AA04 894DFC                  mov dword ptr [ebp-04], ecx
:0042AA07 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AA0A 668B4002                mov ax, word ptr [eax+02]
:0042AA0E 8BE5                    mov esp, ebp
:0042AA10 5D                      pop ebp
:0042AA11 C3                      ret


:0042AA12 CC                      int 03
:0042AA13 CC                      int 03
:0042AA14 CC                      int 03
:0042AA15 CC                      int 03
:0042AA16 CC                      int 03
:0042AA17 CC                      int 03
:0042AA18 CC                      int 03
:0042AA19 CC                      int 03
:0042AA1A CC                      int 03
:0042AA1B CC                      int 03
:0042AA1C CC                      int 03
:0042AA1D CC                      int 03
:0042AA1E CC                      int 03
:0042AA1F CC                      int 03

* Referenced by a CALL at Addresses:
|:00427AF1   , :00427D36   , :00427DAE   , :004286A5   , :00428E62   
|:00429083   , :004291F6   , :0042966E   , :00429B00   , :00429B18   
|:0042A233   , :00460953   
|
:0042AA20 55                      push ebp
:0042AA21 8BEC                    mov ebp, esp
:0042AA23 51                      push ecx
:0042AA24 894DFC                  mov dword ptr [ebp-04], ecx
:0042AA27 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AA2A 668B4004                mov ax, word ptr [eax+04]
:0042AA2E 8BE5                    mov esp, ebp
:0042AA30 5D                      pop ebp
:0042AA31 C3                      ret


:0042AA32 CC                      int 03
:0042AA33 CC                      int 03
:0042AA34 CC                      int 03
:0042AA35 CC                      int 03
:0042AA36 CC                      int 03
:0042AA37 CC                      int 03
:0042AA38 CC                      int 03
:0042AA39 CC                      int 03
:0042AA3A CC                      int 03
:0042AA3B CC                      int 03
:0042AA3C CC                      int 03
:0042AA3D CC                      int 03
:0042AA3E CC                      int 03
:0042AA3F CC                      int 03

* Referenced by a CALL at Addresses:
|:00427655   , :00428D00   
|
:0042AA40 55                      push ebp
:0042AA41 8BEC                    mov ebp, esp
:0042AA43 51                      push ecx
:0042AA44 894DFC                  mov dword ptr [ebp-04], ecx
:0042AA47 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AA4A 668B4D08                mov cx, word ptr [ebp+08]
:0042AA4E 66894808                mov word ptr [eax+08], cx
:0042AA52 8BE5                    mov esp, ebp
:0042AA54 5D                      pop ebp
:0042AA55 C20400                  ret 0004


:0042AA58 CC                      int 03
:0042AA59 CC                      int 03
:0042AA5A CC                      int 03
:0042AA5B CC                      int 03
:0042AA5C CC                      int 03
:0042AA5D CC                      int 03
:0042AA5E CC                      int 03
:0042AA5F CC                      int 03

* Referenced by a CALL at Addresses:
|:00427669   , :00428D1A   
|
:0042AA60 55                      push ebp
:0042AA61 8BEC                    mov ebp, esp
:0042AA63 51                      push ecx
:0042AA64 894DFC                  mov dword ptr [ebp-04], ecx
:0042AA67 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AA6A 668B4D08                mov cx, word ptr [ebp+08]
:0042AA6E 6689480C                mov word ptr [eax+0C], cx
:0042AA72 8BE5                    mov esp, ebp
:0042AA74 5D                      pop ebp
:0042AA75 C20400                  ret 0004


:0042AA78 CC                      int 03
:0042AA79 CC                      int 03
:0042AA7A CC                      int 03
:0042AA7B CC                      int 03
:0042AA7C CC                      int 03
:0042AA7D CC                      int 03
:0042AA7E CC                      int 03
:0042AA7F CC                      int 03

* Referenced by a CALL at Address:
|:004267ED   
|
:0042AA80 55                      push ebp
:0042AA81 8BEC                    mov ebp, esp
:0042AA83 51                      push ecx
:0042AA84 894DFC                  mov dword ptr [ebp-04], ecx
:0042AA87 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042AA8A E821000000              call 0042AAB0
:0042AA8F 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AA92 C6400400                mov [eax+04], 00
:0042AA96 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042AA99 66C7010030              mov word ptr [ecx], 3000
:0042AA9E 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AAA1 8BE5                    mov esp, ebp
:0042AAA3 5D                      pop ebp
:0042AAA4 C3                      ret


:0042AAA5 CC                      int 03
:0042AAA6 CC                      int 03
:0042AAA7 CC                      int 03
:0042AAA8 CC                      int 03
:0042AAA9 CC                      int 03
:0042AAAA CC                      int 03
:0042AAAB CC                      int 03
:0042AAAC CC                      int 03
:0042AAAD CC                      int 03
:0042AAAE CC                      int 03
:0042AAAF CC                      int 03

* Referenced by a CALL at Addresses:
|:0042AA8A   , :0042B4BA   
|
:0042AAB0 55                      push ebp
:0042AAB1 8BEC                    mov ebp, esp
:0042AAB3 51                      push ecx
:0042AAB4 894DFC                  mov dword ptr [ebp-04], ecx
:0042AAB7 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AABA 66C700FFFF              mov word ptr [eax], FFFF
:0042AABF 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AAC2 8BE5                    mov esp, ebp
:0042AAC4 5D                      pop ebp
:0042AAC5 C3                      ret


:0042AAC6 CC                      int 03
:0042AAC7 CC                      int 03
:0042AAC8 CC                      int 03
:0042AAC9 CC                      int 03
:0042AACA CC                      int 03
:0042AACB CC                      int 03
:0042AACC CC                      int 03
:0042AACD CC                      int 03
:0042AACE CC                      int 03
:0042AACF CC                      int 03

* Referenced by a CALL at Address:
|:00426975   
|
:0042AAD0 55                      push ebp
:0042AAD1 8BEC                    mov ebp, esp
:0042AAD3 51                      push ecx
:0042AAD4 894DFC                  mov dword ptr [ebp-04], ecx
:0042AAD7 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AADA 83C004                  add eax, 00000004
:0042AADD 8BE5                    mov esp, ebp
:0042AADF 5D                      pop ebp
:0042AAE0 C3                      ret


:0042AAE1 CC                      int 03
:0042AAE2 CC                      int 03
:0042AAE3 CC                      int 03
:0042AAE4 CC                      int 03
:0042AAE5 CC                      int 03
:0042AAE6 CC                      int 03
:0042AAE7 CC                      int 03
:0042AAE8 CC                      int 03
:0042AAE9 CC                      int 03
:0042AAEA CC                      int 03
:0042AAEB CC                      int 03
:0042AAEC CC                      int 03
:0042AAED CC                      int 03
:0042AAEE CC                      int 03
:0042AAEF CC                      int 03
:0042AAF0 55                      push ebp
:0042AAF1 8BEC                    mov ebp, esp
:0042AAF3 51                      push ecx
:0042AAF4 894DFC                  mov dword ptr [ebp-04], ecx
:0042AAF7 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AAFA C7401000000000          mov [eax+10], 00000000
:0042AB01 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042AB04 66C741140000            mov [ecx+14], 0000
:0042AB0A 8B55FC                  mov edx, dword ptr [ebp-04]
:0042AB0D 66C742040000            mov [edx+04], 0000
:0042AB13 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AB16 66C740060000            mov [eax+06], 0000
:0042AB1C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042AB1F 66C741080000            mov [ecx+08], 0000
:0042AB25 8B55FC                  mov edx, dword ptr [ebp-04]
:0042AB28 66C7421E0000            mov [edx+1E], 0000
:0042AB2E 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AB31 66C740200000            mov [eax+20], 0000
:0042AB37 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042AB3A 66C741220000            mov [ecx+22], 0000
:0042AB40 8B55FC                  mov edx, dword ptr [ebp-04]
:0042AB43 66C742240000            mov [edx+24], 0000
:0042AB49 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AB4C 66C740260000            mov [eax+26], 0000
:0042AB52 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042AB55 66C7411A0000            mov [ecx+1A], 0000
:0042AB5B 8B55FC                  mov edx, dword ptr [ebp-04]
:0042AB5E 66C742280000            mov [edx+28], 0000
:0042AB64 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AB67 66C7402A0000            mov [eax+2A], 0000
:0042AB6D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042AB70 66C7412C0000            mov [ecx+2C], 0000
:0042AB76 6A00                    push 00000000
:0042AB78 E8F4BCFFFF              call 00426871
:0042AB7D 83C404                  add esp, 00000004
:0042AB80 8B55FC                  mov edx, dword ptr [ebp-04]
:0042AB83 894234                  mov dword ptr [edx+34], eax
:0042AB86 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AB89 66C7402E0000            mov [eax+2E], 0000
:0042AB8F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042AB92 66C741300400            mov [ecx+30], 0004
:0042AB98 8B55FC                  mov edx, dword ptr [ebp-04]
:0042AB9B 66C7423C0000            mov [edx+3C], 0000
:0042ABA1 8B45FC                  mov eax, dword ptr [ebp-04]
:0042ABA4 66C7403E0000            mov [eax+3E], 0000
:0042ABAA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042ABAD 66C741380000            mov [ecx+38], 0000
:0042ABB3 8B55FC                  mov edx, dword ptr [ebp-04]
:0042ABB6 66C7420A0300            mov [edx+0A], 0003
:0042ABBC 8B45FC                  mov eax, dword ptr [ebp-04]
:0042ABBF 66C7400C0300            mov [eax+0C], 0003
:0042ABC5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042ABC8 66C7410E0100            mov [ecx+0E], 0001
:0042ABCE 8B55FC                  mov edx, dword ptr [ebp-04]
:0042ABD1 66C7020000              mov word ptr [edx], 0000
:0042ABD6 8B45FC                  mov eax, dword ptr [ebp-04]
:0042ABD9 66C740020000            mov [eax+02], 0000
:0042ABDF 8B45FC                  mov eax, dword ptr [ebp-04]
:0042ABE2 8BE5                    mov esp, ebp
:0042ABE4 5D                      pop ebp
:0042ABE5 C3                      ret


:0042ABE6 CC                      int 03
:0042ABE7 CC                      int 03
:0042ABE8 CC                      int 03
:0042ABE9 CC                      int 03
:0042ABEA CC                      int 03
:0042ABEB CC                      int 03
:0042ABEC CC                      int 03
:0042ABED CC                      int 03
:0042ABEE CC                      int 03
:0042ABEF CC                      int 03

* Referenced by a CALL at Addresses:
|:00426C13   , :00426E59   , :00428B64   , :0042A19D   
|
:0042ABF0 55                      push ebp
:0042ABF1 8BEC                    mov ebp, esp
:0042ABF3 51                      push ecx
:0042ABF4 894DFC                  mov dword ptr [ebp-04], ecx
:0042ABF7 8B45FC                  mov eax, dword ptr [ebp-04]
:0042ABFA 66C740280000            mov [eax+28], 0000
:0042AC00 8BE5                    mov esp, ebp
:0042AC02 5D                      pop ebp
:0042AC03 C3                      ret


:0042AC04 CC                      int 03
:0042AC05 CC                      int 03
:0042AC06 CC                      int 03
:0042AC07 CC                      int 03
:0042AC08 CC                      int 03
:0042AC09 CC                      int 03
:0042AC0A CC                      int 03
:0042AC0B CC                      int 03
:0042AC0C CC                      int 03
:0042AC0D CC                      int 03
:0042AC0E CC                      int 03
:0042AC0F CC                      int 03

* Referenced by a CALL at Address:
|:00428CB8   
|
:0042AC10 55                      push ebp
:0042AC11 8BEC                    mov ebp, esp
:0042AC13 51                      push ecx
:0042AC14 894DFC                  mov dword ptr [ebp-04], ecx
:0042AC17 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AC1A 668B4D08                mov cx, word ptr [ebp+08]
:0042AC1E 66894816                mov word ptr [eax+16], cx
:0042AC22 8BE5                    mov esp, ebp
:0042AC24 5D                      pop ebp
:0042AC25 C20400                  ret 0004


:0042AC28 CC                      int 03
:0042AC29 CC                      int 03
:0042AC2A CC                      int 03
:0042AC2B CC                      int 03
:0042AC2C CC                      int 03
:0042AC2D CC                      int 03
:0042AC2E CC                      int 03
:0042AC2F CC                      int 03

* Referenced by a CALL at Address:
|:00428CA1   
|
:0042AC30 55                      push ebp
:0042AC31 8BEC                    mov ebp, esp
:0042AC33 51                      push ecx
:0042AC34 894DFC                  mov dword ptr [ebp-04], ecx
:0042AC37 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AC3A 668B4D08                mov cx, word ptr [ebp+08]
:0042AC3E 66894818                mov word ptr [eax+18], cx
:0042AC42 8BE5                    mov esp, ebp
:0042AC44 5D                      pop ebp
:0042AC45 C20400                  ret 0004


:0042AC48 CC                      int 03
:0042AC49 CC                      int 03
:0042AC4A CC                      int 03
:0042AC4B CC                      int 03
:0042AC4C CC                      int 03
:0042AC4D CC                      int 03
:0042AC4E CC                      int 03
:0042AC4F CC                      int 03

* Referenced by a CALL at Addresses:
|:004275D6   , :00428CD9   
|
:0042AC50 55                      push ebp
:0042AC51 8BEC                    mov ebp, esp
:0042AC53 51                      push ecx
:0042AC54 894DFC                  mov dword ptr [ebp-04], ecx
:0042AC57 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AC5A 668B4D08                mov cx, word ptr [ebp+08]
:0042AC5E 66894802                mov word ptr [eax+02], cx
:0042AC62 8BE5                    mov esp, ebp
:0042AC64 5D                      pop ebp
:0042AC65 C20400                  ret 0004


:0042AC68 CC                      int 03
:0042AC69 CC                      int 03
:0042AC6A CC                      int 03
:0042AC6B CC                      int 03
:0042AC6C CC                      int 03
:0042AC6D CC                      int 03
:0042AC6E CC                      int 03
:0042AC6F CC                      int 03

* Referenced by a CALL at Address:
|:00426E51   
|
:0042AC70 55                      push ebp
:0042AC71 8BEC                    mov ebp, esp
:0042AC73 51                      push ecx
:0042AC74 894DFC                  mov dword ptr [ebp-04], ecx
:0042AC77 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AC7A 668B4D08                mov cx, word ptr [ebp+08]
:0042AC7E 6689483A                mov word ptr [eax+3A], cx
:0042AC82 8BE5                    mov esp, ebp
:0042AC84 5D                      pop ebp
:0042AC85 C20400                  ret 0004


:0042AC88 CC                      int 03
:0042AC89 CC                      int 03
:0042AC8A CC                      int 03
:0042AC8B CC                      int 03
:0042AC8C CC                      int 03
:0042AC8D CC                      int 03
:0042AC8E CC                      int 03
:0042AC8F CC                      int 03

* Referenced by a CALL at Addresses:
|:004289BE   , :00429AA8   , :00429C55   , :00429E2C   , :00429EDD   
|:0042A1BC   
|
:0042AC90 55                      push ebp
:0042AC91 8BEC                    mov ebp, esp
:0042AC93 51                      push ecx
:0042AC94 894DFC                  mov dword ptr [ebp-04], ecx
:0042AC97 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AC9A 668B403A                mov ax, word ptr [eax+3A]
:0042AC9E 8BE5                    mov esp, ebp
:0042ACA0 5D                      pop ebp
:0042ACA1 C3                      ret


:0042ACA2 CC                      int 03
:0042ACA3 CC                      int 03
:0042ACA4 CC                      int 03
:0042ACA5 CC                      int 03
:0042ACA6 CC                      int 03
:0042ACA7 CC                      int 03
:0042ACA8 CC                      int 03
:0042ACA9 CC                      int 03
:0042ACAA CC                      int 03
:0042ACAB CC                      int 03
:0042ACAC CC                      int 03
:0042ACAD CC                      int 03
:0042ACAE CC                      int 03
:0042ACAF CC                      int 03

* Referenced by a CALL at Addresses:
|:00428BC4   , :00428CC2   
|
:0042ACB0 55                      push ebp
:0042ACB1 8BEC                    mov ebp, esp
:0042ACB3 51                      push ecx
:0042ACB4 894DFC                  mov dword ptr [ebp-04], ecx
:0042ACB7 8B45FC                  mov eax, dword ptr [ebp-04]
:0042ACBA 668B4D08                mov cx, word ptr [ebp+08]
:0042ACBE 6689481A                mov word ptr [eax+1A], cx
:0042ACC2 8BE5                    mov esp, ebp
:0042ACC4 5D                      pop ebp
:0042ACC5 C20400                  ret 0004


:0042ACC8 CC                      int 03
:0042ACC9 CC                      int 03
:0042ACCA CC                      int 03
:0042ACCB CC                      int 03
:0042ACCC CC                      int 03
:0042ACCD CC                      int 03
:0042ACCE CC                      int 03
:0042ACCF CC                      int 03

* Referenced by a CALL at Addresses:
|:0042765F   , :00428D0D   
|
:0042ACD0 55                      push ebp
:0042ACD1 8BEC                    mov ebp, esp
:0042ACD3 51                      push ecx
:0042ACD4 894DFC                  mov dword ptr [ebp-04], ecx
:0042ACD7 8B45FC                  mov eax, dword ptr [ebp-04]
:0042ACDA 668B4D08                mov cx, word ptr [ebp+08]
:0042ACDE 6689480A                mov word ptr [eax+0A], cx
:0042ACE2 8BE5                    mov esp, ebp
:0042ACE4 5D                      pop ebp
:0042ACE5 C20400                  ret 0004


:0042ACE8 CC                      int 03
:0042ACE9 CC                      int 03
:0042ACEA CC                      int 03
:0042ACEB CC                      int 03
:0042ACEC CC                      int 03
:0042ACED CC                      int 03
:0042ACEE CC                      int 03
:0042ACEF CC                      int 03

* Referenced by a CALL at Addresses:
|:00428723   , :004291E4   , :0042A218   
|
:0042ACF0 55                      push ebp
:0042ACF1 8BEC                    mov ebp, esp
:0042ACF3 51                      push ecx
:0042ACF4 894DFC                  mov dword ptr [ebp-04], ecx
:0042ACF7 8B45FC                  mov eax, dword ptr [ebp-04]
:0042ACFA 668B400A                mov ax, word ptr [eax+0A]
:0042ACFE 8BE5                    mov esp, ebp
:0042AD00 5D                      pop ebp
:0042AD01 C3                      ret


:0042AD02 CC                      int 03
:0042AD03 CC                      int 03
:0042AD04 CC                      int 03
:0042AD05 CC                      int 03
:0042AD06 CC                      int 03
:0042AD07 CC                      int 03
:0042AD08 CC                      int 03
:0042AD09 CC                      int 03
:0042AD0A CC                      int 03
:0042AD0B CC                      int 03
:0042AD0C CC                      int 03
:0042AD0D CC                      int 03
:0042AD0E CC                      int 03
:0042AD0F CC                      int 03

* Referenced by a CALL at Addresses:
|:0042872F   , :004291DB   , :0042A20F   
|
:0042AD10 55                      push ebp
:0042AD11 8BEC                    mov ebp, esp
:0042AD13 51                      push ecx
:0042AD14 894DFC                  mov dword ptr [ebp-04], ecx
:0042AD17 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AD1A 668B400C                mov ax, word ptr [eax+0C]
:0042AD1E 8BE5                    mov esp, ebp
:0042AD20 5D                      pop ebp
:0042AD21 C3                      ret


:0042AD22 CC                      int 03
:0042AD23 CC                      int 03
:0042AD24 CC                      int 03
:0042AD25 CC                      int 03
:0042AD26 CC                      int 03
:0042AD27 CC                      int 03
:0042AD28 CC                      int 03
:0042AD29 CC                      int 03
:0042AD2A CC                      int 03
:0042AD2B CC                      int 03
:0042AD2C CC                      int 03
:0042AD2D CC                      int 03
:0042AD2E CC                      int 03
:0042AD2F CC                      int 03

* Referenced by a CALL at Address:
|:00428D27   
|
:0042AD30 55                      push ebp
:0042AD31 8BEC                    mov ebp, esp
:0042AD33 51                      push ecx
:0042AD34 894DFC                  mov dword ptr [ebp-04], ecx
:0042AD37 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AD3A 668B4D08                mov cx, word ptr [ebp+08]
:0042AD3E 6689480E                mov word ptr [eax+0E], cx
:0042AD42 8BE5                    mov esp, ebp
:0042AD44 5D                      pop ebp
:0042AD45 C20400                  ret 0004


:0042AD48 CC                      int 03
:0042AD49 CC                      int 03
:0042AD4A CC                      int 03
:0042AD4B CC                      int 03
:0042AD4C CC                      int 03
:0042AD4D CC                      int 03
:0042AD4E CC                      int 03
:0042AD4F CC                      int 03

* Referenced by a CALL at Address:
|:00427CD5   
|
:0042AD50 55                      push ebp
:0042AD51 8BEC                    mov ebp, esp
:0042AD53 51                      push ecx
:0042AD54 894DFC                  mov dword ptr [ebp-04], ecx
:0042AD57 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AD5A 668B4D08                mov cx, word ptr [ebp+08]
:0042AD5E 66894826                mov word ptr [eax+26], cx
:0042AD62 8BE5                    mov esp, ebp
:0042AD64 5D                      pop ebp
:0042AD65 C20400                  ret 0004


:0042AD68 CC                      int 03
:0042AD69 CC                      int 03
:0042AD6A CC                      int 03
:0042AD6B CC                      int 03
:0042AD6C CC                      int 03
:0042AD6D CC                      int 03
:0042AD6E CC                      int 03
:0042AD6F CC                      int 03

* Referenced by a CALL at Addresses:
|:00427E02   , :00427E13   
|
:0042AD70 55                      push ebp
:0042AD71 8BEC                    mov ebp, esp
:0042AD73 51                      push ecx
:0042AD74 894DFC                  mov dword ptr [ebp-04], ecx
:0042AD77 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AD7A 668B4026                mov ax, word ptr [eax+26]
:0042AD7E 8BE5                    mov esp, ebp
:0042AD80 5D                      pop ebp
:0042AD81 C3                      ret


:0042AD82 CC                      int 03
:0042AD83 CC                      int 03
:0042AD84 CC                      int 03
:0042AD85 CC                      int 03
:0042AD86 CC                      int 03
:0042AD87 CC                      int 03
:0042AD88 CC                      int 03
:0042AD89 CC                      int 03
:0042AD8A CC                      int 03
:0042AD8B CC                      int 03
:0042AD8C CC                      int 03
:0042AD8D CC                      int 03
:0042AD8E CC                      int 03
:0042AD8F CC                      int 03

* Referenced by a CALL at Addresses:
|:004275E3   , :00428CE6   
|
:0042AD90 55                      push ebp
:0042AD91 8BEC                    mov ebp, esp
:0042AD93 51                      push ecx
:0042AD94 894DFC                  mov dword ptr [ebp-04], ecx
:0042AD97 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AD9A 668B4D08                mov cx, word ptr [ebp+08]
:0042AD9E 66894804                mov word ptr [eax+04], cx
:0042ADA2 8BE5                    mov esp, ebp
:0042ADA4 5D                      pop ebp
:0042ADA5 C20400                  ret 0004


:0042ADA8 CC                      int 03
:0042ADA9 CC                      int 03
:0042ADAA CC                      int 03
:0042ADAB CC                      int 03
:0042ADAC CC                      int 03
:0042ADAD CC                      int 03
:0042ADAE CC                      int 03
:0042ADAF CC                      int 03

* Referenced by a CALL at Addresses:
|:00427648   , :00428CF3   
|
:0042ADB0 55                      push ebp
:0042ADB1 8BEC                    mov ebp, esp
:0042ADB3 51                      push ecx
:0042ADB4 894DFC                  mov dword ptr [ebp-04], ecx
:0042ADB7 8B45FC                  mov eax, dword ptr [ebp-04]
:0042ADBA 668B4D08                mov cx, word ptr [ebp+08]
:0042ADBE 66894806                mov word ptr [eax+06], cx
:0042ADC2 8BE5                    mov esp, ebp
:0042ADC4 5D                      pop ebp
:0042ADC5 C20400                  ret 0004


:0042ADC8 CC                      int 03
:0042ADC9 CC                      int 03
:0042ADCA CC                      int 03
:0042ADCB CC                      int 03
:0042ADCC CC                      int 03
:0042ADCD CC                      int 03
:0042ADCE CC                      int 03
:0042ADCF CC                      int 03

* Referenced by a CALL at Addresses:
|:00427AFD   , :00427D22   , :00427D9A   , :004286B1   , :00428E7D   
|:004291ED   , :0042967A   , :00429B0C   , :00429B24   , :0042A22A   
|:0046095F   
|
:0042ADD0 55                      push ebp
:0042ADD1 8BEC                    mov ebp, esp
:0042ADD3 51                      push ecx
:0042ADD4 894DFC                  mov dword ptr [ebp-04], ecx
:0042ADD7 8B45FC                  mov eax, dword ptr [ebp-04]
:0042ADDA 668B4006                mov ax, word ptr [eax+06]
:0042ADDE 8BE5                    mov esp, ebp
:0042ADE0 5D                      pop ebp
:0042ADE1 C3                      ret


:0042ADE2 CC                      int 03
:0042ADE3 CC                      int 03
:0042ADE4 CC                      int 03
:0042ADE5 CC                      int 03
:0042ADE6 CC                      int 03
:0042ADE7 CC                      int 03
:0042ADE8 CC                      int 03
:0042ADE9 CC                      int 03
:0042ADEA CC                      int 03
:0042ADEB CC                      int 03
:0042ADEC CC                      int 03
:0042ADED CC                      int 03
:0042ADEE CC                      int 03
:0042ADEF CC                      int 03

* Referenced by a CALL at Addresses:
|:00427B09   , :00427CC5   , :0042A221   , :0046096B   
|
:0042ADF0 55                      push ebp
:0042ADF1 8BEC                    mov ebp, esp
:0042ADF3 51                      push ecx
:0042ADF4 894DFC                  mov dword ptr [ebp-04], ecx
:0042ADF7 8B45FC                  mov eax, dword ptr [ebp-04]
:0042ADFA 668B4008                mov ax, word ptr [eax+08]
:0042ADFE 8BE5                    mov esp, ebp
:0042AE00 5D                      pop ebp
:0042AE01 C3                      ret


:0042AE02 CC                      int 03
:0042AE03 CC                      int 03
:0042AE04 CC                      int 03
:0042AE05 CC                      int 03
:0042AE06 CC                      int 03
:0042AE07 CC                      int 03
:0042AE08 CC                      int 03
:0042AE09 CC                      int 03
:0042AE0A CC                      int 03
:0042AE0B CC                      int 03
:0042AE0C CC                      int 03
:0042AE0D CC                      int 03
:0042AE0E CC                      int 03
:0042AE0F CC                      int 03

* Referenced by a CALL at Addresses:
|:00426E6B   , :00428D77   
|
:0042AE10 55                      push ebp
:0042AE11 8BEC                    mov ebp, esp
:0042AE13 51                      push ecx
:0042AE14 894DFC                  mov dword ptr [ebp-04], ecx
:0042AE17 8B450C                  mov eax, dword ptr [ebp+0C]
:0042AE1A 25FFFF0000              and eax, 0000FFFF
:0042AE1F F7D0                    not eax
:0042AE21 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042AE24 668B5128                mov dx, word ptr [ecx+28]
:0042AE28 6623D0                  and dx, ax
:0042AE2B 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AE2E 66895028                mov word ptr [eax+28], dx
:0042AE32 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042AE35 81E1FFFF0000            and ecx, 0000FFFF
:0042AE3B 8B550C                  mov edx, dword ptr [ebp+0C]
:0042AE3E 81E2FFFF0000            and edx, 0000FFFF
:0042AE44 23CA                    and ecx, edx
:0042AE46 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AE49 668B5028                mov dx, word ptr [eax+28]
:0042AE4D 660BD1                  or dx, cx
:0042AE50 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AE53 66895028                mov word ptr [eax+28], dx
:0042AE57 8BE5                    mov esp, ebp
:0042AE59 5D                      pop ebp
:0042AE5A C20800                  ret 0008


:0042AE5D CC                      int 03
:0042AE5E CC                      int 03
:0042AE5F CC                      int 03

* Referenced by a CALL at Addresses:
|:00428D39   , :0042A2EE   
|
:0042AE60 55                      push ebp
:0042AE61 8BEC                    mov ebp, esp
:0042AE63 51                      push ecx
:0042AE64 894DFC                  mov dword ptr [ebp-04], ecx
:0042AE67 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AE6A 668B4D08                mov cx, word ptr [ebp+08]
:0042AE6E 6689481E                mov word ptr [eax+1E], cx
:0042AE72 8B55FC                  mov edx, dword ptr [ebp-04]
:0042AE75 668B450C                mov ax, word ptr [ebp+0C]
:0042AE79 66894220                mov word ptr [edx+20], ax
:0042AE7D 8BE5                    mov esp, ebp
:0042AE7F 5D                      pop ebp
:0042AE80 C20800                  ret 0008


:0042AE83 CC                      int 03
:0042AE84 CC                      int 03
:0042AE85 CC                      int 03
:0042AE86 CC                      int 03
:0042AE87 CC                      int 03
:0042AE88 CC                      int 03
:0042AE89 CC                      int 03
:0042AE8A CC                      int 03
:0042AE8B CC                      int 03
:0042AE8C CC                      int 03
:0042AE8D CC                      int 03
:0042AE8E CC                      int 03
:0042AE8F CC                      int 03

* Referenced by a CALL at Addresses:
|:00428A3D   , :00429E53   
|
:0042AE90 55                      push ebp
:0042AE91 8BEC                    mov ebp, esp
:0042AE93 51                      push ecx
:0042AE94 894DFC                  mov dword ptr [ebp-04], ecx
:0042AE97 8B4508                  mov eax, dword ptr [ebp+08]
:0042AE9A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042AE9D 668B511E                mov dx, word ptr [ecx+1E]
:0042AEA1 668910                  mov word ptr [eax], dx
:0042AEA4 8B450C                  mov eax, dword ptr [ebp+0C]
:0042AEA7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042AEAA 668B5120                mov dx, word ptr [ecx+20]
:0042AEAE 668910                  mov word ptr [eax], dx
:0042AEB1 8BE5                    mov esp, ebp
:0042AEB3 5D                      pop ebp
:0042AEB4 C20800                  ret 0008


:0042AEB7 CC                      int 03
:0042AEB8 CC                      int 03
:0042AEB9 CC                      int 03
:0042AEBA CC                      int 03
:0042AEBB CC                      int 03
:0042AEBC CC                      int 03
:0042AEBD CC                      int 03
:0042AEBE CC                      int 03
:0042AEBF CC                      int 03

* Referenced by a CALL at Address:
|:00428D4B   
|
:0042AEC0 55                      push ebp
:0042AEC1 8BEC                    mov ebp, esp
:0042AEC3 51                      push ecx
:0042AEC4 894DFC                  mov dword ptr [ebp-04], ecx
:0042AEC7 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AECA 668B4D08                mov cx, word ptr [ebp+08]
:0042AECE 66894822                mov word ptr [eax+22], cx
:0042AED2 8B55FC                  mov edx, dword ptr [ebp-04]
:0042AED5 668B450C                mov ax, word ptr [ebp+0C]
:0042AED9 66894224                mov word ptr [edx+24], ax
:0042AEDD 8BE5                    mov esp, ebp
:0042AEDF 5D                      pop ebp
:0042AEE0 C20800                  ret 0008


:0042AEE3 CC                      int 03
:0042AEE4 CC                      int 03
:0042AEE5 CC                      int 03
:0042AEE6 CC                      int 03
:0042AEE7 CC                      int 03
:0042AEE8 CC                      int 03
:0042AEE9 CC                      int 03
:0042AEEA CC                      int 03
:0042AEEB CC                      int 03
:0042AEEC CC                      int 03
:0042AEED CC                      int 03
:0042AEEE CC                      int 03
:0042AEEF CC                      int 03

* Referenced by a CALL at Addresses:
|:004286E3   , :00428D65   , :00429D6A   
|
:0042AEF0 55                      push ebp
:0042AEF1 8BEC                    mov ebp, esp
:0042AEF3 51                      push ecx
:0042AEF4 894DFC                  mov dword ptr [ebp-04], ecx
:0042AEF7 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AEFA 668B4D08                mov cx, word ptr [ebp+08]
:0042AEFE 6689483C                mov word ptr [eax+3C], cx
:0042AF02 8BE5                    mov esp, ebp
:0042AF04 5D                      pop ebp
:0042AF05 C20400                  ret 0004


:0042AF08 CC                      int 03
:0042AF09 CC                      int 03
:0042AF0A CC                      int 03
:0042AF0B CC                      int 03
:0042AF0C CC                      int 03
:0042AF0D CC                      int 03
:0042AF0E CC                      int 03
:0042AF0F CC                      int 03

* Referenced by a CALL at Address:
|:00428700   
|
:0042AF10 55                      push ebp
:0042AF11 8BEC                    mov ebp, esp
:0042AF13 51                      push ecx
:0042AF14 894DFC                  mov dword ptr [ebp-04], ecx
:0042AF17 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AF1A 668B4D08                mov cx, word ptr [ebp+08]
:0042AF1E 6689483E                mov word ptr [eax+3E], cx
:0042AF22 8BE5                    mov esp, ebp
:0042AF24 5D                      pop ebp
:0042AF25 C20400                  ret 0004


:0042AF28 CC                      int 03
:0042AF29 CC                      int 03
:0042AF2A CC                      int 03
:0042AF2B CC                      int 03
:0042AF2C CC                      int 03
:0042AF2D CC                      int 03
:0042AF2E CC                      int 03
:0042AF2F CC                      int 03

* Referenced by a CALL at Addresses:
|:00428BE0   , :00428D84   , :00429247   
|
:0042AF30 55                      push ebp
:0042AF31 8BEC                    mov ebp, esp
:0042AF33 51                      push ecx
:0042AF34 894DFC                  mov dword ptr [ebp-04], ecx
:0042AF37 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AF3A 668B4D08                mov cx, word ptr [ebp+08]
:0042AF3E 6689482C                mov word ptr [eax+2C], cx
:0042AF42 8BE5                    mov esp, ebp
:0042AF44 5D                      pop ebp
:0042AF45 C20400                  ret 0004


:0042AF48 CC                      int 03
:0042AF49 CC                      int 03
:0042AF4A CC                      int 03
:0042AF4B CC                      int 03
:0042AF4C CC                      int 03
:0042AF4D CC                      int 03
:0042AF4E CC                      int 03
:0042AF4F CC                      int 03

* Referenced by a CALL at Addresses:
|:00426C1D   , :00428C09   , :00428CAE   , :00429A9B   , :00429ADB   
|
:0042AF50 55                      push ebp
:0042AF51 8BEC                    mov ebp, esp
:0042AF53 51                      push ecx
:0042AF54 894DFC                  mov dword ptr [ebp-04], ecx
:0042AF57 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AF5A 668B4D08                mov cx, word ptr [ebp+08]
:0042AF5E 6689482E                mov word ptr [eax+2E], cx
:0042AF62 8BE5                    mov esp, ebp
:0042AF64 5D                      pop ebp
:0042AF65 C20400                  ret 0004


:0042AF68 CC                      int 03
:0042AF69 CC                      int 03
:0042AF6A CC                      int 03
:0042AF6B CC                      int 03
:0042AF6C CC                      int 03
:0042AF6D CC                      int 03
:0042AF6E CC                      int 03
:0042AF6F CC                      int 03

* Referenced by a CALL at Addresses:
|:00428AA9   , :00429A8A   , :00429B5A   , :0042A1FD   
|
:0042AF70 55                      push ebp
:0042AF71 8BEC                    mov ebp, esp
:0042AF73 51                      push ecx
:0042AF74 894DFC                  mov dword ptr [ebp-04], ecx
:0042AF77 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AF7A 668B402E                mov ax, word ptr [eax+2E]
:0042AF7E 8BE5                    mov esp, ebp
:0042AF80 5D                      pop ebp
:0042AF81 C3                      ret


:0042AF82 CC                      int 03
:0042AF83 CC                      int 03
:0042AF84 CC                      int 03
:0042AF85 CC                      int 03
:0042AF86 CC                      int 03
:0042AF87 CC                      int 03
:0042AF88 CC                      int 03
:0042AF89 CC                      int 03
:0042AF8A CC                      int 03
:0042AF8B CC                      int 03
:0042AF8C CC                      int 03
:0042AF8D CC                      int 03
:0042AF8E CC                      int 03
:0042AF8F CC                      int 03

* Referenced by a CALL at Addresses:
|:00428D58   , :0042923D   , :00429D4C   
|
:0042AF90 55                      push ebp
:0042AF91 8BEC                    mov ebp, esp
:0042AF93 51                      push ecx
:0042AF94 894DFC                  mov dword ptr [ebp-04], ecx
:0042AF97 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AF9A 668B4D08                mov cx, word ptr [ebp+08]
:0042AF9E 66894830                mov word ptr [eax+30], cx
:0042AFA2 8BE5                    mov esp, ebp
:0042AFA4 5D                      pop ebp
:0042AFA5 C20400                  ret 0004


:0042AFA8 CC                      int 03
:0042AFA9 CC                      int 03
:0042AFAA CC                      int 03
:0042AFAB CC                      int 03
:0042AFAC CC                      int 03
:0042AFAD CC                      int 03
:0042AFAE CC                      int 03
:0042AFAF CC                      int 03

* Referenced by a CALL at Address:
|:00429D54   
|
:0042AFB0 55                      push ebp
:0042AFB1 8BEC                    mov ebp, esp
:0042AFB3 51                      push ecx
:0042AFB4 894DFC                  mov dword ptr [ebp-04], ecx
:0042AFB7 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AFBA 668B403C                mov ax, word ptr [eax+3C]
:0042AFBE 8BE5                    mov esp, ebp
:0042AFC0 5D                      pop ebp
:0042AFC1 C3                      ret


:0042AFC2 CC                      int 03
:0042AFC3 CC                      int 03
:0042AFC4 CC                      int 03
:0042AFC5 CC                      int 03
:0042AFC6 CC                      int 03
:0042AFC7 CC                      int 03
:0042AFC8 CC                      int 03
:0042AFC9 CC                      int 03
:0042AFCA CC                      int 03
:0042AFCB CC                      int 03
:0042AFCC CC                      int 03
:0042AFCD CC                      int 03
:0042AFCE CC                      int 03
:0042AFCF CC                      int 03

* Referenced by a CALL at Address:
|:0042A206   
|
:0042AFD0 55                      push ebp
:0042AFD1 8BEC                    mov ebp, esp
:0042AFD3 51                      push ecx
:0042AFD4 894DFC                  mov dword ptr [ebp-04], ecx
:0042AFD7 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AFDA 668B400E                mov ax, word ptr [eax+0E]
:0042AFDE 8BE5                    mov esp, ebp
:0042AFE0 5D                      pop ebp
:0042AFE1 C3                      ret


:0042AFE2 CC                      int 03
:0042AFE3 CC                      int 03
:0042AFE4 CC                      int 03
:0042AFE5 CC                      int 03
:0042AFE6 CC                      int 03
:0042AFE7 CC                      int 03
:0042AFE8 CC                      int 03
:0042AFE9 CC                      int 03
:0042AFEA CC                      int 03
:0042AFEB CC                      int 03
:0042AFEC CC                      int 03
:0042AFED CC                      int 03
:0042AFEE CC                      int 03
:0042AFEF CC                      int 03

* Referenced by a CALL at Address:
|:0042A1F4   
|
:0042AFF0 55                      push ebp
:0042AFF1 8BEC                    mov ebp, esp
:0042AFF3 51                      push ecx
:0042AFF4 894DFC                  mov dword ptr [ebp-04], ecx
:0042AFF7 8B45FC                  mov eax, dword ptr [ebp-04]
:0042AFFA 668B402C                mov ax, word ptr [eax+2C]
:0042AFFE 8BE5                    mov esp, ebp
:0042B000 5D                      pop ebp
:0042B001 C3                      ret


:0042B002 CC                      int 03
:0042B003 CC                      int 03
:0042B004 CC                      int 03
:0042B005 CC                      int 03
:0042B006 CC                      int 03
:0042B007 CC                      int 03
:0042B008 CC                      int 03
:0042B009 CC                      int 03
:0042B00A CC                      int 03
:0042B00B CC                      int 03
:0042B00C CC                      int 03
:0042B00D CC                      int 03
:0042B00E CC                      int 03
:0042B00F CC                      int 03

* Referenced by a CALL at Address:
|:0042A326   
|
:0042B010 55                      push ebp
:0042B011 8BEC                    mov ebp, esp
:0042B013 51                      push ecx
:0042B014 894DFC                  mov dword ptr [ebp-04], ecx
:0042B017 8B45FC                  mov eax, dword ptr [ebp-04]
:0042B01A 33C9                    xor ecx, ecx
:0042B01C 668B482E                mov cx, word ptr [eax+2E]
:0042B020 6BC914                  imul ecx, 00000014
:0042B023 8B55FC                  mov edx, dword ptr [ebp-04]
:0042B026 33C0                    xor eax, eax
:0042B028 668B422A                mov ax, word ptr [edx+2A]
:0042B02C 03C8                    add ecx, eax
:0042B02E 6BC930                  imul ecx, 00000030
:0042B031 C1E106                  shl ecx, 06
:0042B034 8B55FC                  mov edx, dword ptr [ebp-04]
:0042B037 8B4210                  mov eax, dword ptr [edx+10]
:0042B03A 03C1                    add eax, ecx
:0042B03C 8BE5                    mov esp, ebp
:0042B03E 5D                      pop ebp
:0042B03F C3                      ret



* Referenced by a CALL at Address:
|:0042A2DC   
|
:0042B040 55                      push ebp
:0042B041 8BEC                    mov ebp, esp
:0042B043 51                      push ecx
:0042B044 894DFC                  mov dword ptr [ebp-04], ecx
:0042B047 8B45FC                  mov eax, dword ptr [ebp-04]
:0042B04A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B04D 668B511E                mov dx, word ptr [ecx+1E]
:0042B051 66895022                mov word ptr [eax+22], dx
:0042B055 8B45FC                  mov eax, dword ptr [ebp-04]
:0042B058 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B05B 668B5120                mov dx, word ptr [ecx+20]
:0042B05F 66895024                mov word ptr [eax+24], dx
:0042B063 8BE5                    mov esp, ebp
:0042B065 5D                      pop ebp
:0042B066 C3                      ret


:0042B067 CC                      int 03
:0042B068 CC                      int 03
:0042B069 CC                      int 03
:0042B06A CC                      int 03
:0042B06B CC                      int 03
:0042B06C CC                      int 03
:0042B06D CC                      int 03
:0042B06E CC                      int 03
:0042B06F CC                      int 03
:0042B070 55                      push ebp
:0042B071 8BEC                    mov ebp, esp
:0042B073 E807000000              call 0042B07F
:0042B078 E811000000              call 0042B08E
:0042B07D 5D                      pop ebp
:0042B07E C3                      ret



* Referenced by a CALL at Address:
|:0042B073   
|
:0042B07F 55                      push ebp
:0042B080 8BEC                    mov ebp, esp
:0042B082 B970074B00              mov ecx, 004B0770
:0042B087 E884460300              call 0045F710
:0042B08C 5D                      pop ebp
:0042B08D C3                      ret



* Referenced by a CALL at Address:
|:0042B078   
|
:0042B08E 55                      push ebp
:0042B08F 8BEC                    mov ebp, esp
:0042B091 68A0B04200              push 0042B0A0
:0042B096 E865600500              call 00481100
:0042B09B 83C404                  add esp, 00000004
:0042B09E 5D                      pop ebp
:0042B09F C3                      ret


:0042B0A0 55                      push ebp
:0042B0A1 8BEC                    mov ebp, esp
:0042B0A3 B970074B00              mov ecx, 004B0770
:0042B0A8 E863040000              call 0042B510
:0042B0AD 5D                      pop ebp
:0042B0AE C3                      ret


:0042B0AF 55                      push ebp
:0042B0B0 8BEC                    mov ebp, esp
:0042B0B2 E807000000              call 0042B0BE
:0042B0B7 E822000000              call 0042B0DE
:0042B0BC 5D                      pop ebp
:0042B0BD C3                      ret



* Referenced by a CALL at Address:
|:0042B0B2   
|
:0042B0BE 55                      push ebp
:0042B0BF 8BEC                    mov ebp, esp
:0042B0C1 68D0B44200              push 0042B4D0
:0042B0C6 68B0B44200              push 0042B4B0
:0042B0CB 6800020000              push 00000200
:0042B0D0 6A48                    push 00000048
:0042B0D2 68681B4A00              push 004A1B68
:0042B0D7 E864630500              call 00481440
:0042B0DC 5D                      pop ebp
:0042B0DD C3                      ret



* Referenced by a CALL at Address:
|:0042B0B7   
|
:0042B0DE 55                      push ebp
:0042B0DF 8BEC                    mov ebp, esp
:0042B0E1 68F0B04200              push 0042B0F0
:0042B0E6 E815600500              call 00481100
:0042B0EB 83C404                  add esp, 00000004
:0042B0EE 5D                      pop ebp
:0042B0EF C3                      ret


:0042B0F0 55                      push ebp
:0042B0F1 8BEC                    mov ebp, esp
:0042B0F3 68D0B44200              push 0042B4D0
:0042B0F8 6800020000              push 00000200
:0042B0FD 6A48                    push 00000048
:0042B0FF 68681B4A00              push 004A1B68
:0042B104 E8D7630500              call 004814E0
:0042B109 5D                      pop ebp
:0042B10A C3                      ret


:0042B10B 55                      push ebp
:0042B10C 8BEC                    mov ebp, esp
:0042B10E E807000000              call 0042B11A
:0042B113 E81F000000              call 0042B137
:0042B118 5D                      pop ebp
:0042B119 C3                      ret



* Referenced by a CALL at Address:
|:0042B10E   
|
:0042B11A 55                      push ebp
:0042B11B 8BEC                    mov ebp, esp
:0042B11D 6810B54200              push 0042B510
:0042B122 68F0B44200              push 0042B4F0

* Possible Ref to Menu: APPMENU, Item: "_8"
                                  |
:0042B127 6A68                    push 00000068
:0042B129 6A19                    push 00000019
:0042B12B 6840114A00              push 004A1140
:0042B130 E80B630500              call 00481440
:0042B135 5D                      pop ebp
:0042B136 C3                      ret



* Referenced by a CALL at Address:
|:0042B113   
|
:0042B137 55                      push ebp
:0042B138 8BEC                    mov ebp, esp
:0042B13A 6849B14200              push 0042B149
:0042B13F E8BC5F0500              call 00481100
:0042B144 83C404                  add esp, 00000004
:0042B147 5D                      pop ebp
:0042B148 C3                      ret


:0042B149 55                      push ebp
:0042B14A 8BEC                    mov ebp, esp
:0042B14C 6810B54200              push 0042B510

* Possible Ref to Menu: APPMENU, Item: "_8"
                                  |
:0042B151 6A68                    push 00000068
:0042B153 6A19                    push 00000019
:0042B155 6840114A00              push 004A1140
:0042B15A E881630500              call 004814E0
:0042B15F 5D                      pop ebp
:0042B160 C3                      ret


:0042B161 55                      push ebp
:0042B162 8BEC                    mov ebp, esp
:0042B164 E807000000              call 0042B170
:0042B169 E81F000000              call 0042B18D
:0042B16E 5D                      pop ebp
:0042B16F C3                      ret



* Referenced by a CALL at Address:
|:0042B164   
|
:0042B170 55                      push ebp
:0042B171 8BEC                    mov ebp, esp
:0042B173 6810B54200              push 0042B510
:0042B178 68F0B44200              push 0042B4F0
:0042B17D 6A44                    push 00000044
:0042B17F 6A46                    push 00000046
:0042B181 68C0F44A00              push 004AF4C0
:0042B186 E8B5620500              call 00481440
:0042B18B 5D                      pop ebp
:0042B18C C3                      ret



* Referenced by a CALL at Address:
|:0042B169   
|
:0042B18D 55                      push ebp
:0042B18E 8BEC                    mov ebp, esp
:0042B190 689FB14200              push 0042B19F
:0042B195 E8665F0500              call 00481100
:0042B19A 83C404                  add esp, 00000004
:0042B19D 5D                      pop ebp
:0042B19E C3                      ret


:0042B19F 55                      push ebp
:0042B1A0 8BEC                    mov ebp, esp
:0042B1A2 6810B54200              push 0042B510
:0042B1A7 6A44                    push 00000044
:0042B1A9 6A46                    push 00000046
:0042B1AB 68C0F44A00              push 004AF4C0
:0042B1B0 E82B630500              call 004814E0
:0042B1B5 5D                      pop ebp
:0042B1B6 C3                      ret


:0042B1B7 55                      push ebp
:0042B1B8 8BEC                    mov ebp, esp
:0042B1BA E807000000              call 0042B1C6
:0042B1BF E81F000000              call 0042B1E3
:0042B1C4 5D                      pop ebp
:0042B1C5 C3                      ret



* Referenced by a CALL at Address:
|:0042B1BA   
|
:0042B1C6 55                      push ebp
:0042B1C7 8BEC                    mov ebp, esp
:0042B1C9 6810B54200              push 0042B510
:0042B1CE 6810F74500              push 0045F710
:0042B1D3 6A35                    push 00000035
:0042B1D5 6A1B                    push 0000001B
:0042B1D7 68A0BF4A00              push 004ABFA0
:0042B1DC E85F620500              call 00481440
:0042B1E1 5D                      pop ebp
:0042B1E2 C3                      ret



* Referenced by a CALL at Address:
|:0042B1BF   
|
:0042B1E3 55                      push ebp
:0042B1E4 8BEC                    mov ebp, esp
:0042B1E6 68F5B14200              push 0042B1F5
:0042B1EB E8105F0500              call 00481100
:0042B1F0 83C404                  add esp, 00000004
:0042B1F3 5D                      pop ebp
:0042B1F4 C3                      ret


:0042B1F5 55                      push ebp
:0042B1F6 8BEC                    mov ebp, esp
:0042B1F8 6810B54200              push 0042B510
:0042B1FD 6A35                    push 00000035
:0042B1FF 6A1B                    push 0000001B
:0042B201 68A0BF4A00              push 004ABFA0
:0042B206 E8D5620500              call 004814E0
:0042B20B 5D                      pop ebp
:0042B20C C3                      ret


:0042B20D 55                      push ebp
:0042B20E 8BEC                    mov ebp, esp
:0042B210 E807000000              call 0042B21C
:0042B215 E81F000000              call 0042B239
:0042B21A 5D                      pop ebp
:0042B21B C3                      ret



* Referenced by a CALL at Address:
|:0042B210   
|
:0042B21C 55                      push ebp
:0042B21D 8BEC                    mov ebp, esp
:0042B21F 6810B54200              push 0042B510
:0042B224 6810F74500              push 0045F710
:0042B229 6A1B                    push 0000001B
:0042B22B 6A3C                    push 0000003C
:0042B22D 68E0E44A00              push 004AE4E0
:0042B232 E809620500              call 00481440
:0042B237 5D                      pop ebp
:0042B238 C3                      ret



* Referenced by a CALL at Address:
|:0042B215   
|
:0042B239 55                      push ebp
:0042B23A 8BEC                    mov ebp, esp
:0042B23C 684BB24200              push 0042B24B
:0042B241 E8BA5E0500              call 00481100
:0042B246 83C404                  add esp, 00000004
:0042B249 5D                      pop ebp
:0042B24A C3                      ret


:0042B24B 55                      push ebp
:0042B24C 8BEC                    mov ebp, esp
:0042B24E 6810B54200              push 0042B510
:0042B253 6A1B                    push 0000001B
:0042B255 6A3C                    push 0000003C
:0042B257 68E0E44A00              push 004AE4E0
:0042B25C E87F620500              call 004814E0
:0042B261 5D                      pop ebp
:0042B262 C3                      ret


:0042B263 55                      push ebp
:0042B264 8BEC                    mov ebp, esp
:0042B266 E807000000              call 0042B272
:0042B26B E81F000000              call 0042B28F
:0042B270 5D                      pop ebp
:0042B271 C3                      ret



* Referenced by a CALL at Address:
|:0042B266   
|
:0042B272 55                      push ebp
:0042B273 8BEC                    mov ebp, esp
:0042B275 6810B54200              push 0042B510
:0042B27A 6810F74500              push 0045F710
:0042B27F 6A3A                    push 0000003A
:0042B281 6A28                    push 00000028
:0042B283 6868EB4A00              push 004AEB68
:0042B288 E8B3610500              call 00481440
:0042B28D 5D                      pop ebp
:0042B28E C3                      ret



* Referenced by a CALL at Address:
|:0042B26B   
|
:0042B28F 55                      push ebp
:0042B290 8BEC                    mov ebp, esp
:0042B292 68A1B24200              push 0042B2A1
:0042B297 E8645E0500              call 00481100
:0042B29C 83C404                  add esp, 00000004
:0042B29F 5D                      pop ebp
:0042B2A0 C3                      ret


:0042B2A1 55                      push ebp
:0042B2A2 8BEC                    mov ebp, esp
:0042B2A4 6810B54200              push 0042B510
:0042B2A9 6A3A                    push 0000003A
:0042B2AB 6A28                    push 00000028
:0042B2AD 6868EB4A00              push 004AEB68
:0042B2B2 E829620500              call 004814E0
:0042B2B7 5D                      pop ebp
:0042B2B8 C3                      ret


:0042B2B9 55                      push ebp
:0042B2BA 8BEC                    mov ebp, esp
:0042B2BC E807000000              call 0042B2C8
:0042B2C1 E811000000              call 0042B2D7
:0042B2C6 5D                      pop ebp
:0042B2C7 C3                      ret



* Referenced by a CALL at Address:
|:0042B2BC   
|
:0042B2C8 55                      push ebp
:0042B2C9 8BEC                    mov ebp, esp
:0042B2CB B93CC64A00              mov ecx, 004AC63C
:0042B2D0 E83B440300              call 0045F710
:0042B2D5 5D                      pop ebp
:0042B2D6 C3                      ret



* Referenced by a CALL at Address:
|:0042B2C1   
|
:0042B2D7 55                      push ebp
:0042B2D8 8BEC                    mov ebp, esp
:0042B2DA 68E9B24200              push 0042B2E9
:0042B2DF E81C5E0500              call 00481100
:0042B2E4 83C404                  add esp, 00000004
:0042B2E7 5D                      pop ebp
:0042B2E8 C3                      ret


:0042B2E9 55                      push ebp
:0042B2EA 8BEC                    mov ebp, esp
:0042B2EC B93CC64A00              mov ecx, 004AC63C
:0042B2F1 E81A020000              call 0042B510
:0042B2F6 5D                      pop ebp
:0042B2F7 C3                      ret


:0042B2F8 55                      push ebp
:0042B2F9 8BEC                    mov ebp, esp
:0042B2FB E802000000              call 0042B302
:0042B300 5D                      pop ebp
:0042B301 C3                      ret



* Referenced by a CALL at Address:
|:0042B2FB   
|
:0042B302 55                      push ebp
:0042B303 8BEC                    mov ebp, esp
:0042B305 B9A8E44A00              mov ecx, 004AE4A8
:0042B30A E811020000              call 0042B520
:0042B30F 5D                      pop ebp
:0042B310 C3                      ret


:0042B311 55                      push ebp
:0042B312 8BEC                    mov ebp, esp
:0042B314 E802000000              call 0042B31B
:0042B319 5D                      pop ebp
:0042B31A C3                      ret



* Referenced by a CALL at Address:
|:0042B314   
|
:0042B31B 55                      push ebp
:0042B31C 8BEC                    mov ebp, esp
:0042B31E B980AB4A00              mov ecx, 004AAB80
:0042B323 E8F8010000              call 0042B520
:0042B328 5D                      pop ebp
:0042B329 C3                      ret


:0042B32A 55                      push ebp
:0042B32B 8BEC                    mov ebp, esp
:0042B32D E802000000              call 0042B334
:0042B332 5D                      pop ebp
:0042B333 C3                      ret



* Referenced by a CALL at Address:
|:0042B32D   
|
:0042B334 55                      push ebp
:0042B335 8BEC                    mov ebp, esp
:0042B337 B938EB4A00              mov ecx, 004AEB38
:0042B33C E8DF010000              call 0042B520
:0042B341 5D                      pop ebp
:0042B342 C3                      ret


:0042B343 55                      push ebp
:0042B344 8BEC                    mov ebp, esp
:0042B346 E802000000              call 0042B34D
:0042B34B 5D                      pop ebp
:0042B34C C3                      ret



* Referenced by a CALL at Address:
|:0042B346   
|
:0042B34D 55                      push ebp
:0042B34E 8BEC                    mov ebp, esp
:0042B350 B968AB4A00              mov ecx, 004AAB68
:0042B355 E8C6010000              call 0042B520
:0042B35A 5D                      pop ebp
:0042B35B C3                      ret


:0042B35C 55                      push ebp
:0042B35D 8BEC                    mov ebp, esp
:0042B35F E802000000              call 0042B366
:0042B364 5D                      pop ebp
:0042B365 C3                      ret



* Referenced by a CALL at Address:
|:0042B35F   
|
:0042B366 55                      push ebp
:0042B367 8BEC                    mov ebp, esp
:0042B369 B9A8F44A00              mov ecx, 004AF4A8
:0042B36E E8AD010000              call 0042B520
:0042B373 5D                      pop ebp
:0042B374 C3                      ret


:0042B375 55                      push ebp
:0042B376 8BEC                    mov ebp, esp
:0042B378 E802000000              call 0042B37F
:0042B37D 5D                      pop ebp
:0042B37E C3                      ret



* Referenced by a CALL at Address:
|:0042B378   
|
:0042B37F 55                      push ebp
:0042B380 8BEC                    mov ebp, esp
:0042B382 B9C8E44A00              mov ecx, 004AE4C8
:0042B387 E894010000              call 0042B520
:0042B38C 5D                      pop ebp
:0042B38D C3                      ret


:0042B38E 55                      push ebp
:0042B38F 8BEC                    mov ebp, esp
:0042B391 E802000000              call 0042B398
:0042B396 5D                      pop ebp
:0042B397 C3                      ret



* Referenced by a CALL at Address:
|:0042B391   
|
:0042B398 55                      push ebp
:0042B399 8BEC                    mov ebp, esp
:0042B39B B990F44A00              mov ecx, 004AF490
:0042B3A0 E87B010000              call 0042B520
:0042B3A5 5D                      pop ebp
:0042B3A6 C3                      ret


:0042B3A7 55                      push ebp
:0042B3A8 8BEC                    mov ebp, esp
:0042B3AA E802000000              call 0042B3B1
:0042B3AF 5D                      pop ebp
:0042B3B0 C3                      ret



* Referenced by a CALL at Address:
|:0042B3AA   
|
:0042B3B1 55                      push ebp
:0042B3B2 8BEC                    mov ebp, esp
:0042B3B4 B950EB4A00              mov ecx, 004AEB50
:0042B3B9 E862010000              call 0042B520
:0042B3BE 5D                      pop ebp
:0042B3BF C3                      ret


:0042B3C0 55                      push ebp
:0042B3C1 8BEC                    mov ebp, esp
:0042B3C3 E802000000              call 0042B3CA
:0042B3C8 5D                      pop ebp
:0042B3C9 C3                      ret



* Referenced by a CALL at Address:
|:0042B3C3   
|
:0042B3CA 55                      push ebp
:0042B3CB 8BEC                    mov ebp, esp
:0042B3CD B978F44A00              mov ecx, 004AF478
:0042B3D2 E849010000              call 0042B520
:0042B3D7 5D                      pop ebp
:0042B3D8 C3                      ret


:0042B3D9 55                      push ebp
:0042B3DA 8BEC                    mov ebp, esp
:0042B3DC E802000000              call 0042B3E3
:0042B3E1 5D                      pop ebp
:0042B3E2 C3                      ret



* Referenced by a CALL at Address:
|:0042B3DC   
|
:0042B3E3 55                      push ebp
:0042B3E4 8BEC                    mov ebp, esp
:0042B3E6 B910114A00              mov ecx, 004A1110
:0042B3EB E830010000              call 0042B520
:0042B3F0 5D                      pop ebp
:0042B3F1 C3                      ret


:0042B3F2 55                      push ebp
:0042B3F3 8BEC                    mov ebp, esp
:0042B3F5 E807000000              call 0042B401
:0042B3FA E811000000              call 0042B410
:0042B3FF 5D                      pop ebp
:0042B400 C3                      ret



* Referenced by a CALL at Address:
|:0042B3F5   
|
:0042B401 55                      push ebp
:0042B402 8BEC                    mov ebp, esp
:0042B404 B938C54A00              mov ecx, 004AC538
:0042B409 E8A27EFDFF              call 004032B0
:0042B40E 5D                      pop ebp
:0042B40F C3                      ret



* Referenced by a CALL at Address:
|:0042B3FA   
|
:0042B410 55                      push ebp
:0042B411 8BEC                    mov ebp, esp
:0042B413 6822B44200              push 0042B422
:0042B418 E8E35C0500              call 00481100
:0042B41D 83C404                  add esp, 00000004
:0042B420 5D                      pop ebp
:0042B421 C3                      ret


:0042B422 55                      push ebp
:0042B423 8BEC                    mov ebp, esp
:0042B425 B938C54A00              mov ecx, 004AC538
:0042B42A E8A17EFDFF              call 004032D0
:0042B42F 5D                      pop ebp
:0042B430 C3                      ret


:0042B431 55                      push ebp
:0042B432 8BEC                    mov ebp, esp
:0042B434 E807000000              call 0042B440
:0042B439 E811000000              call 0042B44F
:0042B43E 5D                      pop ebp
:0042B43F C3                      ret



* Referenced by a CALL at Address:
|:0042B434   
|
:0042B440 55                      push ebp
:0042B441 8BEC                    mov ebp, esp
:0042B443 B940C64A00              mov ecx, 004AC640
:0042B448 E8637EFDFF              call 004032B0
:0042B44D 5D                      pop ebp
:0042B44E C3                      ret



* Referenced by a CALL at Address:
|:0042B439   
|
:0042B44F 55                      push ebp
:0042B450 8BEC                    mov ebp, esp
:0042B452 6861B44200              push 0042B461
:0042B457 E8A45C0500              call 00481100
:0042B45C 83C404                  add esp, 00000004
:0042B45F 5D                      pop ebp
:0042B460 C3                      ret


:0042B461 55                      push ebp
:0042B462 8BEC                    mov ebp, esp
:0042B464 B940C64A00              mov ecx, 004AC640
:0042B469 E8627EFDFF              call 004032D0
:0042B46E 5D                      pop ebp
:0042B46F C3                      ret


:0042B470 55                      push ebp
:0042B471 8BEC                    mov ebp, esp
:0042B473 E807000000              call 0042B47F
:0042B478 E811000000              call 0042B48E
:0042B47D 5D                      pop ebp
:0042B47E C3                      ret



* Referenced by a CALL at Address:
|:0042B473   
|
:0042B47F 55                      push ebp
:0042B480 8BEC                    mov ebp, esp
:0042B482 B9BCE44A00              mov ecx, 004AE4BC
:0042B487 E8947EFDFF              call 00403320
:0042B48C 5D                      pop ebp
:0042B48D C3                      ret



* Referenced by a CALL at Address:
|:0042B478   
|
:0042B48E 55                      push ebp
:0042B48F 8BEC                    mov ebp, esp
:0042B491 68A0B44200              push 0042B4A0
:0042B496 E8655C0500              call 00481100
:0042B49B 83C404                  add esp, 00000004
:0042B49E 5D                      pop ebp
:0042B49F C3                      ret


:0042B4A0 55                      push ebp
:0042B4A1 8BEC                    mov ebp, esp
:0042B4A3 B9BCE44A00              mov ecx, 004AE4BC
:0042B4A8 E89CDAFEFF              call 00418F49
:0042B4AD 5D                      pop ebp
:0042B4AE C3                      ret


:0042B4AF CC                      int 03
:0042B4B0 55                      push ebp
:0042B4B1 8BEC                    mov ebp, esp
:0042B4B3 51                      push ecx
:0042B4B4 894DFC                  mov dword ptr [ebp-04], ecx
:0042B4B7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B4BA E8F1F5FFFF              call 0042AAB0
:0042B4BF 8B45FC                  mov eax, dword ptr [ebp-04]
:0042B4C2 C6400800                mov [eax+08], 00
:0042B4C6 8B45FC                  mov eax, dword ptr [ebp-04]
:0042B4C9 8BE5                    mov esp, ebp
:0042B4CB 5D                      pop ebp
:0042B4CC C3                      ret


:0042B4CD CC                      int 03
:0042B4CE CC                      int 03
:0042B4CF CC                      int 03

* Referenced by a CALL at Address:
|:0042680E   
|
:0042B4D0 55                      push ebp
:0042B4D1 8BEC                    mov ebp, esp
:0042B4D3 51                      push ecx
:0042B4D4 894DFC                  mov dword ptr [ebp-04], ecx
:0042B4D7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B4DA E831000000              call 0042B510
:0042B4DF 8BE5                    mov esp, ebp
:0042B4E1 5D                      pop ebp
:0042B4E2 C3                      ret


:0042B4E3 CC                      int 03
:0042B4E4 CC                      int 03
:0042B4E5 CC                      int 03
:0042B4E6 CC                      int 03
:0042B4E7 CC                      int 03
:0042B4E8 CC                      int 03
:0042B4E9 CC                      int 03
:0042B4EA CC                      int 03
:0042B4EB CC                      int 03
:0042B4EC CC                      int 03
:0042B4ED CC                      int 03
:0042B4EE CC                      int 03
:0042B4EF CC                      int 03
:0042B4F0 55                      push ebp
:0042B4F1 8BEC                    mov ebp, esp
:0042B4F3 51                      push ecx
:0042B4F4 894DFC                  mov dword ptr [ebp-04], ecx
:0042B4F7 8B45FC                  mov eax, dword ptr [ebp-04]
:0042B4FA C60000                  mov byte ptr [eax], 00
:0042B4FD 8B45FC                  mov eax, dword ptr [ebp-04]
:0042B500 8BE5                    mov esp, ebp
:0042B502 5D                      pop ebp
:0042B503 C3                      ret


:0042B504 CC                      int 03
:0042B505 CC                      int 03
:0042B506 CC                      int 03
:0042B507 CC                      int 03
:0042B508 CC                      int 03
:0042B509 CC                      int 03
:0042B50A CC                      int 03
:0042B50B CC                      int 03
:0042B50C CC                      int 03
:0042B50D CC                      int 03
:0042B50E CC                      int 03
:0042B50F CC                      int 03

* Referenced by a CALL at Addresses:
|:00401373   , :0041020B   , :00410226   , :00418BDF   , :004195A8   
|:0042B0A8   , :0042B2F1   , :0042B4DA   , :0042F065   , :00449AC8   
|:0045F778   , :0045F888   , :0045F8C7   , :00484EE3   , :004850C3   
|:00485106   , :0048536F   , :00485726   , :0048575B   
|
:0042B510 55                      push ebp
:0042B511 8BEC                    mov ebp, esp
:0042B513 51                      push ecx
:0042B514 894DFC                  mov dword ptr [ebp-04], ecx
:0042B517 8BE5                    mov esp, ebp
:0042B519 5D                      pop ebp
:0042B51A C3                      ret


:0042B51B CC                      int 03
:0042B51C CC                      int 03
:0042B51D CC                      int 03
:0042B51E CC                      int 03
:0042B51F CC                      int 03

* Referenced by a CALL at Addresses:
|:0042B30A   , :0042B323   , :0042B33C   , :0042B355   , :0042B36E   
|:0042B387   , :0042B3A0   , :0042B3B9   , :0042B3D2   , :0042B3EB   
|:0045BE7A   , :0045BE85   , :0045BE90   , :0045BE9B   
|
:0042B520 55                      push ebp
:0042B521 8BEC                    mov ebp, esp
:0042B523 51                      push ecx
:0042B524 894DFC                  mov dword ptr [ebp-04], ecx
:0042B527 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042B52A E8E1410300              call 0045F710
:0042B52F 8B45FC                  mov eax, dword ptr [ebp-04]
:0042B532 C6401000                mov [eax+10], 00
:0042B536 8B45FC                  mov eax, dword ptr [ebp-04]
:0042B539 8BE5                    mov esp, ebp
:0042B53B 5D                      pop ebp
:0042B53C C3                      ret


:0042B53D CC                      int 03
:0042B53E CC                      int 03
:0042B53F CC                      int 03

* Referenced by a CALL at Addresses:
|:0042BAE5   , :0042BB07   , :0042BB29   , :0042BB4B   , :0042BB6D   
|:0042BB8F   , :0042BBB1   , :0042BBDD   , :0042BBFF   , :0042BC21   
|:0045BFA3   , :0045BFC6   , :0045BFE9   , :0045C00C   
|
:0042B540 55                      push ebp
:0042B541 8BEC                    mov ebp, esp
:0042B543 8B4508                  mov eax, dword ptr [ebp+08]
:0042B546 50                      push eax

* Possible StringData Ref from Data Obj ->"ڴ治(%s)
ϷҪͣϵ"
                                        ->"ڴ档"
                                  |
:0042B547 6878C74800              push 0048C778
:0042B54C E886960400              call 00474BD7
:0042B551 83C408                  add esp, 00000008
:0042B554 E83631FFFF              call 0041E68F
:0042B559 E81F000000              call 0042B57D
:0042B55E 6A01                    push 00000001
:0042B560 6A00                    push 00000000
:0042B562 B9C4CB4B00              mov ecx, 004BCBC4
:0042B567 E8CC4F0500              call 00480538
:0042B56C E8961B0500              call 0047D107
:0042B571 6A00                    push 00000000
:0042B573 E88C3D0500              call 0047F304
:0042B578 83C404                  add esp, 00000004
:0042B57B 5D                      pop ebp
:0042B57C C3                      ret



* Referenced by a CALL at Addresses:
|:0042B559   , :0042B67D   
|
:0042B57D 55                      push ebp
:0042B57E 8BEC                    mov ebp, esp
:0042B580 B978F44A00              mov ecx, 004AF478
:0042B585 E82C440500              call 0047F9B6
:0042B58A B910114A00              mov ecx, 004A1110
:0042B58F E822440500              call 0047F9B6
:0042B594 B968AB4A00              mov ecx, 004AAB68
:0042B599 E818440500              call 0047F9B6
:0042B59E B9A8F44A00              mov ecx, 004AF4A8
:0042B5A3 E80E440500              call 0047F9B6
:0042B5A8 B9C8E44A00              mov ecx, 004AE4C8
:0042B5AD E804440500              call 0047F9B6
:0042B5B2 B990F44A00              mov ecx, 004AF490
:0042B5B7 E8FA430500              call 0047F9B6
:0042B5BC B950EB4A00              mov ecx, 004AEB50
:0042B5C1 E8F0430500              call 0047F9B6
:0042B5C6 E802000000              call 0042B5CD
:0042B5CB 5D                      pop ebp
:0042B5CC C3                      ret



* Referenced by a CALL at Address:
|:0042B5C6   
|
:0042B5CD 55                      push ebp
:0042B5CE 8BEC                    mov ebp, esp
:0042B5D0 B9A8E44A00              mov ecx, 004AE4A8
:0042B5D5 E8DC430500              call 0047F9B6
:0042B5DA B980AB4A00              mov ecx, 004AAB80
:0042B5DF E8D2430500              call 0047F9B6
:0042B5E4 B938EB4A00              mov ecx, 004AEB38
:0042B5E9 E8C8430500              call 0047F9B6
:0042B5EE 5D                      pop ebp
:0042B5EF C3                      ret



* Referenced by a CALL at Addresses:
|:0042B7BC   , :0042B811   , :0042B954   , :0047C2D9   , :0047C31C   
|
:0042B5F0 55                      push ebp
:0042B5F1 8BEC                    mov ebp, esp
:0042B5F3 6A00                    push 00000000
:0042B5F5 B9986A4B00              mov ecx, 004B6A98
:0042B5FA E868A80400              call 00475E67
:0042B5FF 6A00                    push 00000000
:0042B601 B9C06B4B00              mov ecx, 004B6BC0
:0042B606 E86BAB0400              call 00476176
:0042B60B 6A00                    push 00000000
:0042B60D E8AAA30400              call 004759BC
:0042B612 83C404                  add esp, 00000004
:0042B615 B9386F4900              mov ecx, 00496F38
:0042B61A E8A1EAFEFF              call 0041A0C0
:0042B61F E89E2FFFFF              call 0041E5C2
:0042B624 E8F902FEFF              call 0040B922
:0042B629 85C0                    test eax, eax
:0042B62B 7405                    je 0042B632
:0042B62D E886AE0400              call 004764B8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B62B(C)
|
:0042B632 B9386F4900              mov ecx, 00496F38
:0042B637 E8A6E9FEFF              call 00419FE2
:0042B63C E8B6FE0400              call 0047B4F7
:0042B641 E8B9510300              call 004607FF
:0042B646 B9B8694B00              mov ecx, 004B69B8
:0042B64B E8C98F0400              call 00474619
:0042B650 B9B8694B00              mov ecx, 004B69B8
:0042B655 E8E58D0400              call 0047443F
:0042B65A B9B0694B00              mov ecx, 004B69B0
:0042B65F E8EE8F0400              call 00474652
:0042B664 A1686A4B00              mov eax, dword ptr [004B6A68]
:0042B669 50                      push eax
:0042B66A E89E41FFFF              call 0041F80D
:0042B66F 83C404                  add esp, 00000004
:0042B672 837D0800                cmp dword ptr [ebp+08], 00000000
:0042B676 7405                    je 0042B67D
:0042B678 E835000000              call 0042B6B2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B676(C)
|
:0042B67D E8FBFEFFFF              call 0042B57D
:0042B682 68E7030000              push 000003E7
:0042B687 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:0042B68D 51                      push ecx
:0042B68E FF1550624800            call dword ptr [00486250]
:0042B694 E86E1A0500              call 0047D107
:0042B699 8B15686A4B00            mov edx, dword ptr [004B6A68]
:0042B69F 52                      push edx
:0042B6A0 FF1554624800            call dword ptr [00486254]
:0042B6A6 6A00                    push 00000000
:0042B6A8 E8835F0500              call 00481630
:0042B6AD 83C404                  add esp, 00000004
:0042B6B0 5D                      pop ebp
:0042B6B1 C3                      ret



* Referenced by a CALL at Address:
|:0042B678   
|
:0042B6B2 55                      push ebp
:0042B6B3 8BEC                    mov ebp, esp
:0042B6B5 6AFF                    push FFFFFFFF
:0042B6B7 68EC524800              push 004852EC
:0042B6BC 64A100000000            mov eax, dword ptr fs:[00000000]
:0042B6C2 50                      push eax
:0042B6C3 64892500000000          mov dword ptr fs:[00000000], esp
:0042B6CA 81EC04010000            sub esp, 00000104
:0042B6D0 E822FE0400              call 0047B4F7
:0042B6D5 B9B8694B00              mov ecx, 004B69B8
:0042B6DA E83A8F0400              call 00474619
:0042B6DF E81C0F0000              call 0042C600
:0042B6E4 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0042B6EA E8C17BFDFF              call 004032B0
:0042B6EF C745FC00000000          mov [ebp-04], 00000000
:0042B6F6 6A02                    push 00000002
:0042B6F8 6A01                    push 00000001
:0042B6FA E85129FFFF              call 0041E050
:0042B6FF 83C408                  add esp, 00000008

* Possible StringData Ref from Data Obj ->"LOGO.E5"
                                  |
:0042B702 68F0BA4800              push 0048BAF0
:0042B707 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0042B70D E82344FFFF              call 0041FB35
:0042B712 6A04                    push 00000004
:0042B714 6A00                    push 00000000
:0042B716 6A00                    push 00000000
:0042B718 B968AB4A00              mov ecx, 004AAB68
:0042B71D E81E430500              call 0047FA40
:0042B722 50                      push eax

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0042B723 6A06                    push 00000006
:0042B725 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0042B72B E85945FFFF              call 0041FC89
:0042B730 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0042B736 E88ADBFEFF              call 004192C5
:0042B73B E89B2EFFFF              call 0041E5DB
:0042B740 6A00                    push 00000000
:0042B742 E89C130500              call 0047CAE3
:0042B747 83C404                  add esp, 00000004
:0042B74A E8402FFFFF              call 0041E68F
:0042B74F 6A04                    push 00000004
:0042B751 6A00                    push 00000000
:0042B753 6A00                    push 00000000
:0042B755 B968AB4A00              mov ecx, 004AAB68
:0042B75A E8E1420500              call 0047FA40
:0042B75F 50                      push eax
:0042B760 6890010000              push 00000190
:0042B765 6880020000              push 00000280
:0042B76A 6A28                    push 00000028
:0042B76C 6A00                    push 00000000
:0042B76E E828290500              call 0047E09B
:0042B773 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B786(U)
|
:0042B776 33C0                    xor eax, eax
:0042B778 A0707A4900              mov al, byte ptr [00497A70]
:0042B77D 85C0                    test eax, eax
:0042B77F 7E07                    jle 0042B788
:0042B781 E8702EFFFF              call 0041E5F6
:0042B786 EBEE                    jmp 0042B776

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B77F(C)
|
:0042B788 E8782CFFFF              call 0041E405
:0042B78D 6A03                    push 00000003
:0042B78F E8AC0D0000              call 0042C540
:0042B794 83C404                  add esp, 00000004
:0042B797 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0042B79E 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0042B7A4 E8277BFDFF              call 004032D0
:0042B7A9 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042B7AC 64890D00000000          mov dword ptr fs:[00000000], ecx
:0042B7B3 8BE5                    mov esp, ebp
:0042B7B5 5D                      pop ebp
:0042B7B6 C3                      ret



* Referenced by a CALL at Address:
|:00474BD0   
|
:0042B7B7 55                      push ebp
:0042B7B8 8BEC                    mov ebp, esp
:0042B7BA 6A01                    push 00000001
:0042B7BC E82FFEFFFF              call 0042B5F0
:0042B7C1 83C404                  add esp, 00000004
:0042B7C4 5D                      pop ebp
:0042B7C5 C3                      ret



* Referenced by a CALL at Address:
|:004158FC   
|
:0042B7C6 55                      push ebp
:0042B7C7 8BEC                    mov ebp, esp
:0042B7C9 E8A2B00400              call 00476870
:0042B7CE E8AFB00400              call 00476882
:0042B7D3 B9B0694B00              mov ecx, 004B69B0
:0042B7D8 E8758E0400              call 00474652
:0042B7DD B9B8694B00              mov ecx, 004B69B8
:0042B7E2 E8328E0400              call 00474619
:0042B7E7 E8140E0000              call 0042C600
:0042B7EC E89E2EFFFF              call 0041E68F
:0042B7F1 6A00                    push 00000000
:0042B7F3 6A00                    push 00000000
:0042B7F5 6A00                    push 00000000
:0042B7F7 6A00                    push 00000000
:0042B7F9 6A02                    push 00000002
:0042B7FB E86240FFFF              call 0041F862
:0042B800 83C414                  add esp, 00000014
:0042B803 8A4508                  mov al, byte ptr [ebp+08]
:0042B806 50                      push eax
:0042B807 E8845A0000              call 00431290
:0042B80C 83C404                  add esp, 00000004
:0042B80F 6A00                    push 00000000
:0042B811 E8DAFDFFFF              call 0042B5F0
:0042B816 83C404                  add esp, 00000004
:0042B819 5D                      pop ebp
:0042B81A C3                      ret



* Referenced by a CALL at Addresses:
|:0040BC59   , :0040BDCB   , :0041B026   , :0041B226   , :0041B408   
|:0041B4CC   , :00429FCF   , :00429FEA   , :0042B9E8   , :0042C23C   
|:0042C75C   , :0042C82E   , :0042C84C   , :0042E77A   , :0042EA99   
|:0042F5BB   , :0044D0DE   , :0044D3D9   , :0044D469   , :0044DA07   
|:0044E1C1   , :0044EB05   , :0044F5C9   , :0044F6D8   , :0044F6F1   
|:0044F796   , :0045475B   , :004547A6   , :004549DD   , :00455707   
|:00455CC8   , :00455D0E   , :00455D48   
|
:0042B81B 55                      push ebp
:0042B81C 8BEC                    mov ebp, esp
:0042B81E 83EC1C                  sub esp, 0000001C
:0042B821 E89E320500              call 0047EAC4
:0042B826 FF1560624800            call dword ptr [00486260]
:0042B82C 8945FC                  mov dword ptr [ebp-04], eax
:0042B82F B9B07F4900              mov ecx, 00497FB0
:0042B834 E8EDA3FFFF              call 00425C26
:0042B839 8945F8                  mov dword ptr [ebp-08], eax
:0042B83C B9B07F4900              mov ecx, 00497FB0
:0042B841 E8F1A3FFFF              call 00425C37
:0042B846 8945F4                  mov dword ptr [ebp-0C], eax
:0042B849 8D45E4                  lea eax, dword ptr [ebp-1C]
:0042B84C 50                      push eax
:0042B84D 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:0042B853 51                      push ecx
:0042B854 FF15EC624800            call dword ptr [004862EC]
:0042B85A 8B55FC                  mov edx, dword ptr [ebp-04]
:0042B85D 3B15686A4B00            cmp edx, dword ptr [004B6A68]
:0042B863 0F85D4000000            jne 0042B93D
:0042B869 E8E8080500              call 0047C156
:0042B86E 85C0                    test eax, eax
:0042B870 7421                    je 0042B893
:0042B872 6A0C                    push 0000000C
:0042B874 A1686A4B00              mov eax, dword ptr [004B6A68]
:0042B879 50                      push eax
:0042B87A B9B07F4900              mov ecx, 00497FB0
:0042B87F E81EAAFFFF              call 004262A2
:0042B884 B9B07F4900              mov ecx, 00497FB0
:0042B889 E855AAFFFF              call 004262E3
:0042B88E E9AA000000              jmp 0042B93D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B870(C)
|
:0042B893 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042B896 3B4DE4                  cmp ecx, dword ptr [ebp-1C]
:0042B899 0F8E9E000000            jle 0042B93D
:0042B89F 8B55F8                  mov edx, dword ptr [ebp-08]
:0042B8A2 3B55EC                  cmp edx, dword ptr [ebp-14]
:0042B8A5 0F8D92000000            jnl 0042B93D
:0042B8AB 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042B8AE 3B45E8                  cmp eax, dword ptr [ebp-18]
:0042B8B1 0F8E86000000            jle 0042B93D
:0042B8B7 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042B8BA 3B4DF0                  cmp ecx, dword ptr [ebp-10]
:0042B8BD 7D7E                    jge 0042B93D
:0042B8BF E85E00FEFF              call 0040B922
:0042B8C4 F7D8                    neg eax
:0042B8C6 1BC0                    sbb eax, eax
:0042B8C8 83E010                  and eax, 00000010
:0042B8CB 83C028                  add eax, 00000028
:0042B8CE 3945F4                  cmp dword ptr [ebp-0C], eax
:0042B8D1 7C31                    jl 0042B904
:0042B8D3 8B55F8                  mov edx, dword ptr [ebp-08]
:0042B8D6 3B55EC                  cmp edx, dword ptr [ebp-14]
:0042B8D9 7D29                    jge 0042B904
:0042B8DB 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042B8DE 3B45F0                  cmp eax, dword ptr [ebp-10]
:0042B8E1 7D21                    jge 0042B904
:0042B8E3 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042B8E6 51                      push ecx
:0042B8E7 8B15686A4B00            mov edx, dword ptr [004B6A68]
:0042B8ED 52                      push edx
:0042B8EE B9B07F4900              mov ecx, 00497FB0
:0042B8F3 E8AAA9FFFF              call 004262A2
:0042B8F8 B9B07F4900              mov ecx, 00497FB0
:0042B8FD E8E1A9FFFF              call 004262E3
:0042B902 EB39                    jmp 0042B93D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042B8D1(C), :0042B8D9(C), :0042B8E1(C)
|
:0042B904 E81900FEFF              call 0040B922
:0042B909 F7D8                    neg eax
:0042B90B 1BC0                    sbb eax, eax
:0042B90D 83E010                  and eax, 00000010
:0042B910 83C028                  add eax, 00000028
:0042B913 3945F4                  cmp dword ptr [ebp-0C], eax
:0042B916 7D25                    jge 0042B93D
:0042B918 8B45F8                  mov eax, dword ptr [ebp-08]
:0042B91B 3B45EC                  cmp eax, dword ptr [ebp-14]
:0042B91E 7D1D                    jge 0042B93D
:0042B920 6A0C                    push 0000000C
:0042B922 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:0042B928 51                      push ecx
:0042B929 B9B07F4900              mov ecx, 00497FB0
:0042B92E E86FA9FFFF              call 004262A2
:0042B933 B9B07F4900              mov ecx, 00497FB0
:0042B938 E8A6A9FFFF              call 004262E3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042B863(C), :0042B88E(U), :0042B899(C), :0042B8A5(C), :0042B8B1(C)
|:0042B8BD(C), :0042B902(U), :0042B916(C), :0042B91E(C)
|
:0042B93D 8BE5                    mov esp, ebp
:0042B93F 5D                      pop ebp
:0042B940 C3                      ret



* Referenced by a CALL at Address:
|:004755DC   
|
:0042B941 55                      push ebp
:0042B942 8BEC                    mov ebp, esp
:0042B944 E815000000              call 0042B95E
:0042B949 85C0                    test eax, eax
:0042B94B 7405                    je 0042B952
:0042B94D E838060000              call 0042BF8A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B94B(C)
|
:0042B952 6A01                    push 00000001
:0042B954 E897FCFFFF              call 0042B5F0
:0042B959 83C404                  add esp, 00000004
:0042B95C 5D                      pop ebp
:0042B95D C3                      ret



* Referenced by a CALL at Address:
|:0042B944   
|
:0042B95E 55                      push ebp
:0042B95F 8BEC                    mov ebp, esp
:0042B961 6A00                    push 00000000
:0042B963 E854A00400              call 004759BC
:0042B968 83C404                  add esp, 00000004
:0042B96B 6A00                    push 00000000
:0042B96D B93CC64A00              mov ecx, 004AC63C
:0042B972 E88904FEFF              call 0040BE00
:0042B977 6A01                    push 00000001
:0042B979 A15CE84800              mov eax, dword ptr [0048E85C]
:0042B97E 83E828                  sub eax, 00000028
:0042B981 50                      push eax
:0042B982 8B0D58E84800            mov ecx, dword ptr [0048E858]
:0042B988 51                      push ecx
:0042B989 E8F4320500              call 0047EC82
:0042B98E 83C40C                  add esp, 0000000C
:0042B991 E861FB0400              call 0047B4F7
:0042B996 B9C4CB4B00              mov ecx, 004BCBC4
:0042B99B E8AD4A0500              call 0048044D
:0042B9A0 E8F70E0000              call 0042C89C
:0042B9A5 E81E010000              call 0042BAC8
:0042B9AA 6A02                    push 00000002
:0042B9AC 6A00                    push 00000000
:0042B9AE E89D26FFFF              call 0041E050
:0042B9B3 83C408                  add esp, 00000008
:0042B9B6 E8D42CFFFF              call 0041E68F
:0042B9BB B9B8694B00              mov ecx, 004B69B8
:0042B9C0 90                      nop
:0042B9C1 90                      nop
:0042B9C2 90                      nop
:0042B9C3 90                      nop
:0042B9C4 90                      nop
:0042B9C5 85C0                    test eax, eax
:0042B9C7 EB04                    jmp 0042B9CD
:0042B9C9 33C0                    xor eax, eax
:0042B9CB EB5A                    jmp 0042BA27

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B9C7(U)
|
:0042B9CD E857000000              call 0042BA29
:0042B9D2 B9B07F4900              mov ecx, 00497FB0
:0042B9D7 E86CA2FFFF              call 00425C48
:0042B9DC 6A01                    push 00000001
:0042B9DE E8750E0000              call 0042C858
:0042B9E3 83C404                  add esp, 00000004
:0042B9E6 6A00                    push 00000000
:0042B9E8 E82EFEFFFF              call 0042B81B
:0042B9ED 83C404                  add esp, 00000004
:0042B9F0 E836020000              call 0042BC2B
:0042B9F5 6A00                    push 00000000
:0042B9F7 E809410500              call 0047FB05
:0042B9FC 83C404                  add esp, 00000004
:0042B9FF E8639F0400              call 00475967
:0042BA04 6A00                    push 00000000
:0042BA06 E8B19F0400              call 004759BC
:0042BA0B 83C404                  add esp, 00000004
:0042BA0E E841050000              call 0042BF54
:0042BA13 E847020000              call 0042BC5F
:0042BA18 E801050000              call 0042BF1E
:0042BA1D E83E030000              call 0042BD60
:0042BA22 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042B9CB(U)
|
:0042BA27 5D                      pop ebp
:0042BA28 C3                      ret



* Referenced by a CALL at Address:
|:0042B9CD   
|
:0042BA29 55                      push ebp
:0042BA2A 8BEC                    mov ebp, esp
:0042BA2C 6AFF                    push FFFFFFFF
:0042BA2E 680B534800              push 0048530B
:0042BA33 64A100000000            mov eax, dword ptr fs:[00000000]
:0042BA39 50                      push eax
:0042BA3A 64892500000000          mov dword ptr fs:[00000000], esp
:0042BA41 81EC0C010000            sub esp, 0000010C
:0042BA47 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:0042BA4D E85E78FDFF              call 004032B0
:0042BA52 C745FC00000000          mov [ebp-04], 00000000
:0042BA59 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0042BA5C E8BF78FDFF              call 00403320
:0042BA61 C645FC01                mov [ebp-04], 01
:0042BA65 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"MARK.E5"
                                  |
:0042BA67 6830BB4800              push 0048BB30
:0042BA6C 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0042BA6F E8E8D4FEFF              call 00418F5C
:0042BA74 8945EC                  mov dword ptr [ebp-14], eax
:0042BA77 68E0C70100              push 0001C7E0
:0042BA7C B950EB4A00              mov ecx, 004AEB50
:0042BA81 E80A26FEFF              call 0040E090
:0042BA86 50                      push eax
:0042BA87 6A00                    push 00000000
:0042BA89 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0042BA8C E8F3D6FEFF              call 00419184
:0042BA91 8945EC                  mov dword ptr [ebp-14], eax
:0042BA94 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0042BA97 E829D8FEFF              call 004192C5
:0042BA9C C645FC00                mov [ebp-04], 00
:0042BAA0 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0042BAA3 E8A1D4FEFF              call 00418F49
:0042BAA8 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0042BAAF 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:0042BAB5 E81678FDFF              call 004032D0
:0042BABA 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042BABD 64890D00000000          mov dword ptr fs:[00000000], ecx
:0042BAC4 8BE5                    mov esp, ebp
:0042BAC6 5D                      pop ebp
:0042BAC7 C3                      ret



* Referenced by a CALL at Address:
|:0042B9A5   
|
:0042BAC8 55                      push ebp
:0042BAC9 8BEC                    mov ebp, esp
:0042BACB 6A01                    push 00000001
:0042BACD 6800220100              push 00012200
:0042BAD2 B978F44A00              mov ecx, 004AF478
:0042BAD7 E8993E0500              call 0047F975
:0042BADC 85C0                    test eax, eax
:0042BADE 750D                    jne 0042BAED

* Possible StringData Ref from Data Obj ->"SmallMap"
                                  |
:0042BAE0 68B0C74800              push 0048C7B0
:0042BAE5 E856FAFFFF              call 0042B540
:0042BAEA 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BADE(C)
|
:0042BAED 6A01                    push 00000001
:0042BAEF 6800140000              push 00001400
:0042BAF4 B910114A00              mov ecx, 004A1110
:0042BAF9 E8773E0500              call 0047F975
:0042BAFE 85C0                    test eax, eax
:0042BB00 750D                    jne 0042BB0F

* Possible StringData Ref from Data Obj ->"SoldierFace"
                                  |
:0042BB02 68BCC74800              push 0048C7BC
:0042BB07 E834FAFFFF              call 0042B540
:0042BB0C 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BB00(C)
|
:0042BB0F 6A01                    push 00000001
:0042BB11 68004C0400              push 00044C00
:0042BB16 B968AB4A00              mov ecx, 004AAB68
:0042BB1B E8553E0500              call 0047F975
:0042BB20 85C0                    test eax, eax
:0042BB22 750D                    jne 0042BB31

* Possible StringData Ref from Data Obj ->"Window"
                                  |
:0042BB24 68C8C74800              push 0048C7C8
:0042BB29 E812FAFFFF              call 0042B540
:0042BB2E 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BB22(C)
|
:0042BB31 6A01                    push 00000001
:0042BB33 6840060000              push 00000640
:0042BB38 B9A8F44A00              mov ecx, 004AF4A8
:0042BB3D E8333E0500              call 0047F975
:0042BB42 85C0                    test eax, eax
:0042BB44 750D                    jne 0042BB53

* Possible StringData Ref from Data Obj ->"Attack"
                                  |
:0042BB46 68D0C74800              push 0048C7D0
:0042BB4B E8F0F9FFFF              call 0042B540
:0042BB50 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BB44(C)
|
:0042BB53 6A01                    push 00000001
:0042BB55 68004C0400              push 00044C00
:0042BB5A B9C8E44A00              mov ecx, 004AE4C8
:0042BB5F E8113E0500              call 0047F975
:0042BB64 85C0                    test eax, eax
:0042BB66 750D                    jne 0042BB75

* Possible StringData Ref from Data Obj ->"Tmp"
                                  |
:0042BB68 68D8C74800              push 0048C7D8
:0042BB6D E8CEF9FFFF              call 0042B540
:0042BB72 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BB66(C)
|
:0042BB75 6A01                    push 00000001
:0042BB77 6800710200              push 00027100
:0042BB7C B950EB4A00              mov ecx, 004AEB50
:0042BB81 E8EF3D0500              call 0047F975
:0042BB86 85C0                    test eax, eax
:0042BB88 750D                    jne 0042BB97

* Possible StringData Ref from Data Obj ->"Mark"
                                  |
:0042BB8A 68DCC74800              push 0048C7DC
:0042BB8F E8ACF9FFFF              call 0042B540
:0042BB94 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BB88(C)
|
:0042BB97 6A01                    push 00000001
:0042BB99 6800500000              push 00005000
:0042BB9E B990F44A00              mov ecx, 004AF490
:0042BBA3 E8CD3D0500              call 0047F975
:0042BBA8 85C0                    test eax, eax
:0042BBAA 750D                    jne 0042BBB9

* Possible StringData Ref from Data Obj ->"Data"
                                  |
:0042BBAC 68E4C74800              push 0048C7E4
:0042BBB1 E88AF9FFFF              call 0042B540
:0042BBB6 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BBAA(C)
|
:0042BBB9 E802000000              call 0042BBC0
:0042BBBE 5D                      pop ebp
:0042BBBF C3                      ret



* Referenced by a CALL at Address:
|:0042BBB9   
|
:0042BBC0 55                      push ebp
:0042BBC1 8BEC                    mov ebp, esp
:0042BBC3 6A01                    push 00000001
:0042BBC5 6800403800              push 00384000
:0042BBCA B9A8E44A00              mov ecx, 004AE4A8
:0042BBCF E8A13D0500              call 0047F975
:0042BBD4 85C0                    test eax, eax
:0042BBD6 750D                    jne 0042BBE5

* Possible StringData Ref from Data Obj ->"BigMap"
                                  |
:0042BBD8 68ECC74800              push 0048C7EC
:0042BBDD E85EF9FFFF              call 0042B540
:0042BBE2 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BBD6(C)
|
:0042BBE5 6A01                    push 00000001
:0042BBE7 6800792C00              push 002C7900
:0042BBEC B980AB4A00              mov ecx, 004AAB80
:0042BBF1 E87F3D0500              call 0047F975
:0042BBF6 85C0                    test eax, eax
:0042BBF8 750D                    jne 0042BC07

* Possible StringData Ref from Data Obj ->"Character"
                                  |
:0042BBFA 68F4C74800              push 0048C7F4
:0042BBFF E83CF9FFFF              call 0042B540
:0042BC04 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BBF8(C)
|
:0042BC07 6A01                    push 00000001
:0042BC09 6800900100              push 00019000
:0042BC0E B938EB4A00              mov ecx, 004AEB38
:0042BC13 E85D3D0500              call 0047F975
:0042BC18 85C0                    test eax, eax
:0042BC1A 750D                    jne 0042BC29

* Possible StringData Ref from Data Obj ->"MapData"
                                  |
:0042BC1C 6800C84800              push 0048C800
:0042BC21 E81AF9FFFF              call 0042B540
:0042BC26 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BC1A(C)
|
:0042BC29 5D                      pop ebp
:0042BC2A C3                      ret



* Referenced by a CALL at Address:
|:0042B9F0   
|
:0042BC2B 55                      push ebp
:0042BC2C 8BEC                    mov ebp, esp

* Possible StringData Ref from Data Obj ->"MMAP.E5"
                                  |
:0042BC2E 6808BB4800              push 0048BB08
:0042BC33 B940C64A00              mov ecx, 004AC640
:0042BC38 E8F83EFFFF              call 0041FB35

* Possible StringData Ref from Data Obj ->"FACE.E5"
                                  |
:0042BC3D 6838BB4800              push 0048BB38
:0042BC42 B938C54A00              mov ecx, 004AC538
:0042BC47 E8E93EFFFF              call 0041FB35
:0042BC4C 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"IMSG.E5"
                                  |
:0042BC4E 6868BB4800              push 0048BB68
:0042BC53 B9BCE44A00              mov ecx, 004AE4BC
:0042BC58 E8FFD2FEFF              call 00418F5C
:0042BC5D 5D                      pop ebp
:0042BC5E C3                      ret



* Referenced by a CALL at Address:
|:0042BA13   
|
:0042BC5F 55                      push ebp
:0042BC60 8BEC                    mov ebp, esp
:0042BC62 6AFF                    push FFFFFFFF
:0042BC64 6821534800              push 00485321
:0042BC69 64A100000000            mov eax, dword ptr fs:[00000000]
:0042BC6F 50                      push eax
:0042BC70 64892500000000          mov dword ptr fs:[00000000], esp
:0042BC77 81EC04010000            sub esp, 00000104
:0042BC7D 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0042BC83 E82876FDFF              call 004032B0
:0042BC88 C745FC00000000          mov [ebp-04], 00000000
:0042BC8F 6A02                    push 00000002
:0042BC91 6A03                    push 00000003
:0042BC93 E8B823FFFF              call 0041E050
:0042BC98 83C408                  add esp, 00000008
:0042BC9B E8EF29FFFF              call 0041E68F
:0042BCA0 E87D25FFFF              call 0041E222

* Possible StringData Ref from Data Obj ->"LOGO.E5"
                                  |
:0042BCA5 68F0BA4800              push 0048BAF0
:0042BCAA 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0042BCB0 E8803EFFFF              call 0041FB35
:0042BCB5 6A04                    push 00000004
:0042BCB7 6A00                    push 00000000
:0042BCB9 6A00                    push 00000000
:0042BCBB B968AB4A00              mov ecx, 004AAB68
:0042BCC0 E87B3D0500              call 0047FA40
:0042BCC5 50                      push eax
:0042BCC6 6A0C                    push 0000000C
:0042BCC8 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0042BCCE E8B63FFFFF              call 0041FC89
:0042BCD3 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0042BCD9 E8E7D5FEFF              call 004192C5
:0042BCDE 6A00                    push 00000000
:0042BCE0 E8FE0D0500              call 0047CAE3
:0042BCE5 83C404                  add esp, 00000004
:0042BCE8 6A00                    push 00000000
:0042BCEA 6A1F                    push 0000001F
:0042BCEC 6A04                    push 00000004
:0042BCEE E8FE140500              call 0047D1F1
:0042BCF3 83C40C                  add esp, 0000000C
:0042BCF6 E8E028FFFF              call 0041E5DB
:0042BCFB 6A04                    push 00000004
:0042BCFD 6A00                    push 00000000
:0042BCFF 6A00                    push 00000000
:0042BD01 B968AB4A00              mov ecx, 004AAB68
:0042BD06 E8353D0500              call 0047FA40
:0042BD0B 50                      push eax
:0042BD0C 68E0010000              push 000001E0
:0042BD11 6880020000              push 00000280
:0042BD16 6A00                    push 00000000
:0042BD18 6A00                    push 00000000
:0042BD1A E87C230500              call 0047E09B
:0042BD1F 83C414                  add esp, 00000014
:0042BD22 E8CF28FFFF              call 0041E5F6
:0042BD27 E8D926FFFF              call 0041E405
:0042BD2C 6A01                    push 00000001
:0042BD2E E80D080000              call 0042C540
:0042BD33 83C404                  add esp, 00000004
:0042BD36 E88728FFFF              call 0041E5C2
:0042BD3B E84F29FFFF              call 0041E68F
:0042BD40 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0042BD47 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0042BD4D E87E75FDFF              call 004032D0
:0042BD52 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042BD55 64890D00000000          mov dword ptr fs:[00000000], ecx
:0042BD5C 8BE5                    mov esp, ebp
:0042BD5E 5D                      pop ebp
:0042BD5F C3                      ret



* Referenced by a CALL at Addresses:
|:0042BA1D   , :0042C094   
|
:0042BD60 55                      push ebp
:0042BD61 8BEC                    mov ebp, esp
:0042BD63 6AFF                    push FFFFFFFF
:0042BD65 6837534800              push 00485337
:0042BD6A 64A100000000            mov eax, dword ptr fs:[00000000]
:0042BD70 50                      push eax
:0042BD71 64892500000000          mov dword ptr fs:[00000000], esp
:0042BD78 81EC08010000            sub esp, 00000108
:0042BD7E 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0042BD84 E82775FDFF              call 004032B0
:0042BD89 C745FC00000000          mov [ebp-04], 00000000
:0042BD90 6A02                    push 00000002
:0042BD92 6A00                    push 00000000
:0042BD94 E8B722FFFF              call 0041E050
:0042BD99 83C408                  add esp, 00000008
:0042BD9C E8EE28FFFF              call 0041E68F
:0042BDA1 E87C24FFFF              call 0041E222

* Possible StringData Ref from Data Obj ->"LOGO.E5"
                                  |
:0042BDA6 68F0BA4800              push 0048BAF0
:0042BDAB 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0042BDB1 E87F3DFFFF              call 0041FB35
:0042BDB6 6A04                    push 00000004
:0042BDB8 6A00                    push 00000000
:0042BDBA 6A00                    push 00000000
:0042BDBC B968AB4A00              mov ecx, 004AAB68
:0042BDC1 E87A3C0500              call 0047FA40
:0042BDC6 50                      push eax
:0042BDC7 6A00                    push 00000000
:0042BDC9 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0042BDCF E8B53EFFFF              call 0041FC89
:0042BDD4 C785ECFEFFFF00000000    mov dword ptr [ebp+FFFFFEEC], 00000000
:0042BDDE EB0F                    jmp 0042BDEF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BE29(U)
|
:0042BDE0 8B85ECFEFFFF            mov eax, dword ptr [ebp+FFFFFEEC]
:0042BDE6 83C001                  add eax, 00000001
:0042BDE9 8985ECFEFFFF            mov dword ptr [ebp+FFFFFEEC], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BDDE(U)
|
:0042BDEF 83BDECFEFFFF03          cmp dword ptr [ebp+FFFFFEEC], 00000003
:0042BDF6 7333                    jnb 0042BE2B
:0042BDF8 6A04                    push 00000004
:0042BDFA 6A00                    push 00000000
:0042BDFC 8B8DECFEFFFF            mov ecx, dword ptr [ebp+FFFFFEEC]
:0042BE02 C1E106                  shl ecx, 06
:0042BE05 C1E106                  shl ecx, 06
:0042BE08 51                      push ecx
:0042BE09 B9C8E44A00              mov ecx, 004AE4C8
:0042BE0E E82D3C0500              call 0047FA40
:0042BE13 50                      push eax
:0042BE14 8B95ECFEFFFF            mov edx, dword ptr [ebp+FFFFFEEC]
:0042BE1A 83C201                  add edx, 00000001
:0042BE1D 52                      push edx
:0042BE1E 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0042BE24 E8603EFFFF              call 0041FC89
:0042BE29 EBB5                    jmp 0042BDE0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BDF6(C)
|
:0042BE2B 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0042BE31 E88FD4FEFF              call 004192C5
:0042BE36 6A00                    push 00000000
:0042BE38 E8A60C0500              call 0047CAE3
:0042BE3D 83C404                  add esp, 00000004
:0042BE40 6A00                    push 00000000
:0042BE42 6A1F                    push 0000001F
:0042BE44 6A04                    push 00000004
:0042BE46 E8A6130500              call 0047D1F1
:0042BE4B 83C40C                  add esp, 0000000C
:0042BE4E E88827FFFF              call 0041E5DB
:0042BE53 6A04                    push 00000004
:0042BE55 6A00                    push 00000000
:0042BE57 6A00                    push 00000000
:0042BE59 B968AB4A00              mov ecx, 004AAB68
:0042BE5E E8DD3B0500              call 0047FA40
:0042BE63 50                      push eax
:0042BE64 6890010000              push 00000190
:0042BE69 6880020000              push 00000280
:0042BE6E 6A28                    push 00000028
:0042BE70 6A00                    push 00000000
:0042BE72 E824220500              call 0047E09B
:0042BE77 83C414                  add esp, 00000014
:0042BE7A C785ECFEFFFF00000000    mov dword ptr [ebp+FFFFFEEC], 00000000
:0042BE84 EB0F                    jmp 0042BE95

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BEF2(U)
|
:0042BE86 8B85ECFEFFFF            mov eax, dword ptr [ebp+FFFFFEEC]
:0042BE8C 83C001                  add eax, 00000001
:0042BE8F 8985ECFEFFFF            mov dword ptr [ebp+FFFFFEEC], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BE84(U)
|
:0042BE95 83BDECFEFFFF03          cmp dword ptr [ebp+FFFFFEEC], 00000003
:0042BE9C 7356                    jnb 0042BEF4
:0042BE9E 8A8DECFEFFFF            mov cl, byte ptr [ebp+FFFFFEEC]
:0042BEA4 51                      push ecx
:0042BEA5 E8DAE3FEFF              call 0041A284
:0042BEAA 83C404                  add esp, 00000004
:0042BEAD 25FF000000              and eax, 000000FF
:0042BEB2 85C0                    test eax, eax
:0042BEB4 743C                    je 0042BEF2
:0042BEB6 6A04                    push 00000004
:0042BEB8 6A00                    push 00000000
:0042BEBA 8B95ECFEFFFF            mov edx, dword ptr [ebp+FFFFFEEC]
:0042BEC0 C1E206                  shl edx, 06
:0042BEC3 C1E206                  shl edx, 06
:0042BEC6 52                      push edx
:0042BEC7 B9C8E44A00              mov ecx, 004AE4C8
:0042BECC E86F3B0500              call 0047FA40
:0042BED1 50                      push eax
:0042BED2 6A40                    push 00000040
:0042BED4 6A40                    push 00000040

* Possible Reference to Dialog: DialogID_0154 
                                  |
:0042BED6 6854010000              push 00000154
:0042BEDB 8B85ECFEFFFF            mov eax, dword ptr [ebp+FFFFFEEC]
:0042BEE1 6BC064                  imul eax, 00000064
:0042BEE4 05BC000000              add eax, 000000BC
:0042BEE9 50                      push eax
:0042BEEA E8AC210500              call 0047E09B
:0042BEEF 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BEB4(C)
|
:0042BEF2 EB92                    jmp 0042BE86

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BE9C(C)
|
:0042BEF4 E8FD26FFFF              call 0041E5F6
:0042BEF9 E80725FFFF              call 0041E405
:0042BEFE C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0042BF05 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0042BF0B E8C073FDFF              call 004032D0
:0042BF10 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042BF13 64890D00000000          mov dword ptr fs:[00000000], ecx
:0042BF1A 8BE5                    mov esp, ebp
:0042BF1C 5D                      pop ebp
:0042BF1D C3                      ret



* Referenced by a CALL at Address:
|:0042BA18   
|
:0042BF1E 55                      push ebp
:0042BF1F 8BEC                    mov ebp, esp
:0042BF21 B970074B00              mov ecx, 004B0770
:0042BF26 E8E5E9FFFF              call 0042A910
:0042BF2B 2500020000              and eax, 00000200
:0042BF30 85C0                    test eax, eax
:0042BF32 7402                    je 0042BF36
:0042BF34 EB1C                    jmp 0042BF52

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BF32(C)
|
:0042BF36 6A00                    push 00000000
:0042BF38 E87F9A0400              call 004759BC
:0042BF3D 83C404                  add esp, 00000004
:0042BF40 6A00                    push 00000000
:0042BF42 6A00                    push 00000000
:0042BF44 6A01                    push 00000001
:0042BF46 6A00                    push 00000000
:0042BF48 6A00                    push 00000000
:0042BF4A E81339FFFF              call 0041F862
:0042BF4F 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BF34(U)
|
:0042BF52 5D                      pop ebp
:0042BF53 C3                      ret



* Referenced by a CALL at Address:
|:0042BA0E   
|
:0042BF54 55                      push ebp
:0042BF55 8BEC                    mov ebp, esp
:0042BF57 B970074B00              mov ecx, 004B0770
:0042BF5C E8AFE9FFFF              call 0042A910
:0042BF61 2500020000              and eax, 00000200
:0042BF66 85C0                    test eax, eax
:0042BF68 7402                    je 0042BF6C
:0042BF6A EB1C                    jmp 0042BF88

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BF68(C)
|
:0042BF6C 6A00                    push 00000000
:0042BF6E E8499A0400              call 004759BC
:0042BF73 83C404                  add esp, 00000004
:0042BF76 6A14                    push 00000014
:0042BF78 6A00                    push 00000000
:0042BF7A 6A00                    push 00000000
:0042BF7C 6A00                    push 00000000
:0042BF7E 6A03                    push 00000003
:0042BF80 E8DD38FFFF              call 0041F862
:0042BF85 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042BF6A(U)
|
:0042BF88 5D                      pop ebp
:0042BF89 C3                      ret



* Referenced by a CALL at Address:
|:0042B94D   
|
:0042BF8A 55                      push ebp
:0042BF8B 8BEC                    mov ebp, esp
:0042BF8D 83EC08                  sub esp, 00000008
:0042BF90 C745F800000000          mov [ebp-08], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C099(U)
|
:0042BF97 B9902F4900              mov ecx, 00492F90
:0042BF9C E8C5B9FEFF              call 00417966
:0042BFA1 B9902F4900              mov ecx, 00492F90
:0042BFA6 E8D5B9FEFF              call 00417980
:0042BFAB E84F480300              call 004607FF
:0042BFB0 B9902F4900              mov ecx, 00492F90
:0042BFB5 E88242FEFF              call 0041023C
:0042BFBA E8A8FFFEFF              call 0041BF67
:0042BFBF 8945FC                  mov dword ptr [ebp-04], eax
:0042BFC2 C7059CBF4A0000000000    mov dword ptr [004ABF9C], 00000000
:0042BFCC 817DFCFFFF0000          cmp dword ptr [ebp-04], 0000FFFF
:0042BFD3 0F84C5000000            je 0042C09E
:0042BFD9 E8E425FFFF              call 0041E5C2
:0042BFDE E8AC26FFFF              call 0041E68F
:0042BFE3 B9902F4900              mov ecx, 00492F90
:0042BFE8 E8E5BEFEFF              call 00417ED2
:0042BFED 85C0                    test eax, eax
:0042BFEF 0F84A9000000            je 0042C09E
:0042BFF5 A1686A4B00              mov eax, dword ptr [004B6A68]
:0042BFFA 50                      push eax
:0042BFFB FF15CC624800            call dword ptr [004862CC]
:0042C001 837DFC00                cmp dword ptr [ebp-04], 00000000
:0042C005 7519                    jne 0042C020
:0042C007 B9B8694B00              mov ecx, 004B69B8
:0042C00C E808860400              call 00474619
:0042C011 B9902F4900              mov ecx, 00492F90
:0042C016 E82142FEFF              call 0041023C
:0042C01B E888FBFDFF              call 0040BBA8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042C005(C), :0042C06B(U)
|
:0042C020 E8FE010000              call 0042C223
:0042C025 8945F8                  mov dword ptr [ebp-08], eax
:0042C028 C745FCFF000000          mov [ebp-04], 000000FF
:0042C02F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042C032 83E144                  and ecx, 00000044
:0042C035 85C9                    test ecx, ecx
:0042C037 7402                    je 0042C03B
:0042C039 EB32                    jmp 0042C06D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C037(C)
|
:0042C03B 8B55F8                  mov edx, dword ptr [ebp-08]
:0042C03E 83E220                  and edx, 00000020
:0042C041 85D2                    test edx, edx
:0042C043 7402                    je 0042C047
:0042C045 EB26                    jmp 0042C06D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C043(C)
|
:0042C047 8B45F8                  mov eax, dword ptr [ebp-08]
:0042C04A 83E008                  and eax, 00000008
:0042C04D 85C0                    test eax, eax
:0042C04F 741A                    je 0042C06B
:0042C051 B9902F4900              mov ecx, 00492F90
:0042C056 E877BEFEFF              call 00417ED2
:0042C05B 85C0                    test eax, eax
:0042C05D 7502                    jne 0042C061
:0042C05F EB0C                    jmp 0042C06D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C05D(C)
|
:0042C061 B930694B00              mov ecx, 004B6930
:0042C066 E80E710400              call 00473179

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C04F(C)
|
:0042C06B EBB3                    jmp 0042C020

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042C039(U), :0042C045(U), :0042C05F(U)
|
:0042C06D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042C070 83E160                  and ecx, 00000060
:0042C073 85C9                    test ecx, ecx
:0042C075 7427                    je 0042C09E
:0042C077 E826000000              call 0042C0A2
:0042C07C 85C0                    test eax, eax
:0042C07E 741E                    je 0042C09E
:0042C080 6A01                    push 00000001
:0042C082 E8D1070000              call 0042C858
:0042C087 83C404                  add esp, 00000004
:0042C08A 6A00                    push 00000000
:0042C08C E82B990400              call 004759BC
:0042C091 83C404                  add esp, 00000004
:0042C094 E8C7FCFFFF              call 0042BD60
:0042C099 E9F9FEFFFF              jmp 0042BF97

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042BFD3(C), :0042BFEF(C), :0042C075(C), :0042C07E(C)
|
:0042C09E 8BE5                    mov esp, ebp
:0042C0A0 5D                      pop ebp
:0042C0A1 C3                      ret



* Referenced by a CALL at Address:
|:0042C077   
|
:0042C0A2 55                      push ebp
:0042C0A3 8BEC                    mov ebp, esp
:0042C0A5 6AFF                    push FFFFFFFF
:0042C0A7 684D534800              push 0048534D
:0042C0AC 64A100000000            mov eax, dword ptr fs:[00000000]
:0042C0B2 50                      push eax
:0042C0B3 64892500000000          mov dword ptr fs:[00000000], esp
:0042C0BA 81EC0C010000            sub esp, 0000010C
:0042C0C0 C785ECFEFFFF00000000    mov dword ptr [ebp+FFFFFEEC], 00000000
:0042C0CA 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0042C0D0 E8DB71FDFF              call 004032B0
:0042C0D5 C745FC00000000          mov [ebp-04], 00000000
:0042C0DC 6A00                    push 00000000
:0042C0DE B970074B00              mov ecx, 004B0770
:0042C0E3 E878CCFEFF              call 00418D60
:0042C0E8 6A00                    push 00000000
:0042C0EA B970074B00              mov ecx, 004B0770
:0042C0EF E81C030000              call 0042C410
:0042C0F4 B9B8694B00              mov ecx, 004B69B8
:0042C0F9 E81B850400              call 00474619
:0042C0FE B9B0694B00              mov ecx, 004B69B0
:0042C103 E84A850400              call 00474652
:0042C108 6A01                    push 00000001
:0042C10A 6A28                    push 00000028
:0042C10C B9B0694B00              mov ecx, 004B69B0
:0042C111 E864850400              call 0047467A
:0042C116 E8A724FFFF              call 0041E5C2
:0042C11B E86F25FFFF              call 0041E68F
:0042C120 E8D2F30400              call 0047B4F7
:0042C125 E88EA30400              call 004764B8
:0042C12A E8D1040000              call 0042C600
:0042C12F 6A02                    push 00000002
:0042C131 6A02                    push 00000002
:0042C133 E8181FFFFF              call 0041E050
:0042C138 83C408                  add esp, 00000008

* Possible StringData Ref from Data Obj ->"LOGO.E5"
                                  |
:0042C13B 68F0BA4800              push 0048BAF0
:0042C140 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0042C146 E8EA39FFFF              call 0041FB35
:0042C14B 6A04                    push 00000004
:0042C14D 6A00                    push 00000000
:0042C14F 6A00                    push 00000000
:0042C151 B968AB4A00              mov ecx, 004AAB68
:0042C156 E8E5380500              call 0047FA40
:0042C15B 50                      push eax

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0042C15C 6A07                    push 00000007
:0042C15E 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0042C164 E8203BFFFF              call 0041FC89
:0042C169 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0042C16F E851D1FEFF              call 004192C5
:0042C174 6A00                    push 00000000
:0042C176 E868090500              call 0047CAE3
:0042C17B 83C404                  add esp, 00000004
:0042C17E E85824FFFF              call 0041E5DB
:0042C183 6A04                    push 00000004
:0042C185 6A00                    push 00000000
:0042C187 6A00                    push 00000000
:0042C189 B968AB4A00              mov ecx, 004AAB68
:0042C18E E8AD380500              call 0047FA40
:0042C193 50                      push eax
:0042C194 6890010000              push 00000190
:0042C199 6880020000              push 00000280
:0042C19E 6A28                    push 00000028
:0042C1A0 6A00                    push 00000000
:0042C1A2 E8F41E0500              call 0047E09B
:0042C1A7 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C1BA(U)
|
:0042C1AA 33C0                    xor eax, eax
:0042C1AC A0707A4900              mov al, byte ptr [00497A70]
:0042C1B1 85C0                    test eax, eax
:0042C1B3 7E07                    jle 0042C1BC
:0042C1B5 E83C24FFFF              call 0041E5F6
:0042C1BA EBEE                    jmp 0042C1AA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C1B3(C)
|
:0042C1BC E84422FFFF              call 0041E405
:0042C1C1 6A32                    push 00000032
:0042C1C3 B9181B4B00              mov ecx, 004B1B18
:0042C1C8 E87371FDFF              call 00403340
:0042C1CD E80E030000              call 0042C4E0

* Possible StringData Ref from Data Obj ->"һ"
                                  |
:0042C1D2 6808C84800              push 0048C808
:0042C1D7 6A01                    push 00000001
:0042C1D9 E8BB340000              call 0042F699
:0042C1DE 83C408                  add esp, 00000008
:0042C1E1 8985ECFEFFFF            mov dword ptr [ebp+FFFFFEEC], eax
:0042C1E7 E8D623FFFF              call 0041E5C2
:0042C1EC E89E24FFFF              call 0041E68F
:0042C1F1 8B8DECFEFFFF            mov ecx, dword ptr [ebp+FFFFFEEC]
:0042C1F7 898DE8FEFFFF            mov dword ptr [ebp+FFFFFEE8], ecx
:0042C1FD C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0042C204 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0042C20A E8C170FDFF              call 004032D0
:0042C20F 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:0042C215 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042C218 64890D00000000          mov dword ptr fs:[00000000], ecx
:0042C21F 8BE5                    mov esp, ebp
:0042C221 5D                      pop ebp
:0042C222 C3                      ret



* Referenced by a CALL at Address:
|:0042C020   
|
:0042C223 55                      push ebp
:0042C224 8BEC                    mov ebp, esp
:0042C226 83EC14                  sub esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C3D8(U)
|
:0042C229 B930694B00              mov ecx, 004B6930
:0042C22E E8FD010000              call 0042C430
:0042C233 C745F400000000          mov [ebp-0C], 00000000
:0042C23A 6A00                    push 00000000
:0042C23C E8DAF5FFFF              call 0042B81B
:0042C241 83C404                  add esp, 00000004
:0042C244 B93CC64A00              mov ecx, 004AC63C
:0042C249 E862F6FDFF              call 0040B8B0
:0042C24E 8845F8                  mov byte ptr [ebp-08], al
:0042C251 6A00                    push 00000000
:0042C253 E864970400              call 004759BC
:0042C258 83C404                  add esp, 00000004
:0042C25B 8B45F8                  mov eax, dword ptr [ebp-08]
:0042C25E 25FF000000              and eax, 000000FF
:0042C263 83F803                  cmp eax, 00000003
:0042C266 7437                    je 0042C29F
:0042C268 B9986A4B00              mov ecx, 004B6A98
:0042C26D E8CEFBFDFF              call 0040BE40
:0042C272 85C0                    test eax, eax
:0042C274 7524                    jne 0042C29A
:0042C276 6A01                    push 00000001
:0042C278 B9986A4B00              mov ecx, 004B6A98
:0042C27D E8E59B0400              call 00475E67
:0042C282 E8E9A50400              call 00476870
:0042C287 B970074B00              mov ecx, 004B0770
:0042C28C E89FC9FEFF              call 00418C30
:0042C291 50                      push eax
:0042C292 E87EA40400              call 00476715
:0042C297 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C274(C)
|
:0042C29A E8E3A50400              call 00476882

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C266(C)
|
:0042C29F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042C2A2 81E1FF000000            and ecx, 000000FF
:0042C2A8 894DF0                  mov dword ptr [ebp-10], ecx
:0042C2AB 837DF004                cmp dword ptr [ebp-10], 00000004
:0042C2AF 0F870B010000            ja 0042C3C0
:0042C2B5 8B55F0                  mov edx, dword ptr [ebp-10]
:0042C2B8 FF2495E4C34200          jmp dword ptr [4*edx+0042C3E4]
:0042C2BF E8F2D5FFFF              call 004298B6
:0042C2C4 25FFFF0000              and eax, 0000FFFF
:0042C2C9 8945F4                  mov dword ptr [ebp-0C], eax
:0042C2CC E9EF000000              jmp 0042C3C0
:0042C2D1 E801FBFDFF              call 0040BDD7
:0042C2D6 8945F4                  mov dword ptr [ebp-0C], eax
:0042C2D9 E9E2000000              jmp 0042C3C0
:0042C2DE B9982B4B00              mov ecx, 004B2B98
:0042C2E3 E828700000              call 00433310
:0042C2E8 8945F4                  mov dword ptr [ebp-0C], eax
:0042C2EB E9D0000000              jmp 0042C3C0
:0042C2F0 C7059CBF4A0000000000    mov dword ptr [004ABF9C], 00000000
:0042C2FA C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C3A3(U)
|
:0042C301 FF15E0604800            call dword ptr [004860E0]
:0042C307 33D2                    xor edx, edx
:0042C309 B9FFFFFF7F              mov ecx, 7FFFFFFF
:0042C30E F7F1                    div ecx
:0042C310 52                      push edx
:0042C311 E8EF370500              call 0047FB05
:0042C316 83C404                  add esp, 00000004
:0042C319 B9083D4B00              mov ecx, 004B3D08
:0042C31E E8302D0200              call 0044F053
:0042C323 25FF000000              and eax, 000000FF
:0042C328 8945EC                  mov dword ptr [ebp-14], eax
:0042C32B 8B55EC                  mov edx, dword ptr [ebp-14]
:0042C32E 83EA01                  sub edx, 00000001
:0042C331 8955EC                  mov dword ptr [ebp-14], edx
:0042C334 837DEC04                cmp dword ptr [ebp-14], 00000004
:0042C338 7744                    ja 0042C37E
:0042C33A 8B45EC                  mov eax, dword ptr [ebp-14]
:0042C33D FF2485F8C34200          jmp dword ptr [4*eax+0042C3F8]
:0042C344 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042C347 83C920                  or ecx, 00000020
:0042C34A 894DF4                  mov dword ptr [ebp-0C], ecx
:0042C34D EB39                    jmp 0042C388
:0042C34F C745FC01000000          mov [ebp-04], 00000001
:0042C356 6A00                    push 00000000
:0042C358 B9083D4B00              mov ecx, 004B3D08
:0042C35D E8BEFAFDFF              call 0040BE20
:0042C362 EB24                    jmp 0042C388
:0042C364 8B55F4                  mov edx, dword ptr [ebp-0C]
:0042C367 83CA40                  or edx, 00000040
:0042C36A 8955F4                  mov dword ptr [ebp-0C], edx
:0042C36D EB19                    jmp 0042C388
:0042C36F E883F10400              call 0047B4F7
:0042C374 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042C377 0C08                    or al, 08
:0042C379 8945F4                  mov dword ptr [ebp-0C], eax
:0042C37C EB0A                    jmp 0042C388

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C338(C)
|
:0042C37E 6A00                    push 00000000
:0042C380 E837960400              call 004759BC
:0042C385 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042C34D(U), :0042C362(U), :0042C36D(U), :0042C37C(U)
|
:0042C388 837DFC01                cmp dword ptr [ebp-04], 00000001
:0042C38C 7509                    jne 0042C397
:0042C38E C745FC00000000          mov [ebp-04], 00000000
:0042C395 EB0C                    jmp 0042C3A3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C38C(C)
|
:0042C397 B9902F4900              mov ecx, 00492F90
:0042C39C E8DFB5FEFF              call 00417980
:0042C3A1 EB05                    jmp 0042C3A8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C395(U)
|
:0042C3A3 E959FFFFFF              jmp 0042C301

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C3A1(U)
|
:0042C3A8 EB16                    jmp 0042C3C0
:0042C3AA C7059CBF4A0000000000    mov dword ptr [004ABF9C], 00000000
:0042C3B4 C60594AB4A0000          mov byte ptr [004AAB94], 00
:0042C3BB E8E8F7FDFF              call 0040BBA8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042C2AF(C), :0042C2CC(U), :0042C2D9(U), :0042C2EB(U), :0042C3A8(U)
|
:0042C3C0 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042C3C3 83E16C                  and ecx, 0000006C
:0042C3C6 85C9                    test ecx, ecx
:0042C3C8 740E                    je 0042C3D8
:0042C3CA 6A00                    push 00000000
:0042C3CC B9986A4B00              mov ecx, 004B6A98
:0042C3D1 E8919A0400              call 00475E67
:0042C3D6 EB05                    jmp 0042C3DD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C3C8(C)
|
:0042C3D8 E94CFEFFFF              jmp 0042C229

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C3D6(U)
|
:0042C3DD 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042C3E0 8BE5                    mov esp, ebp
:0042C3E2 5D                      pop ebp
:0042C3E3 C3                      ret



:0042C3E4 D1C24200                DWORD 0042C2D1
:0042C3E8 DEC24200                DWORD 0042C2DE
:0042C3EC BFC24200                DWORD 0042C2BF
:0042C3F0 F0C24200                DWORD 0042C2F0
:0042C3F4 AAC34200                DWORD 0042C3AA
:0042C3F8 4FC34200                DWORD 0042C34F
:0042C3FC 7EC34200                DWORD 0042C37E
:0042C400 44C34200                DWORD 0042C344
:0042C404 64C34200                DWORD 0042C364
:0042C408 6FC34200                DWORD 0042C36F


:0042C40C CC                      int 03
:0042C40D CC                      int 03
:0042C40E CC                      int 03
:0042C40F CC                      int 03

* Referenced by a CALL at Addresses:
|:0042C0EF   , :0044D4BE   
|
:0042C410 55                      push ebp
:0042C411 8BEC                    mov ebp, esp
:0042C413 51                      push ecx
:0042C414 894DFC                  mov dword ptr [ebp-04], ecx
:0042C417 8B45FC                  mov eax, dword ptr [ebp-04]
:0042C41A 8A4D08                  mov cl, byte ptr [ebp+08]
:0042C41D 884805                  mov byte ptr [eax+05], cl
:0042C420 8BE5                    mov esp, ebp
:0042C422 5D                      pop ebp
:0042C423 C20400                  ret 0004


:0042C426 CC                      int 03
:0042C427 CC                      int 03
:0042C428 CC                      int 03
:0042C429 CC                      int 03
:0042C42A CC                      int 03
:0042C42B CC                      int 03
:0042C42C CC                      int 03
:0042C42D CC                      int 03
:0042C42E CC                      int 03
:0042C42F CC                      int 03

* Referenced by a CALL at Address:
|:0042C22E   
|
:0042C430 55                      push ebp
:0042C431 8BEC                    mov ebp, esp
:0042C433 51                      push ecx
:0042C434 894DFC                  mov dword ptr [ebp-04], ecx
:0042C437 8B45FC                  mov eax, dword ptr [ebp-04]
:0042C43A C6407800                mov [eax+78], 00
:0042C43E 8BE5                    mov esp, ebp
:0042C440 5D                      pop ebp
:0042C441 C3                      ret


:0042C442 CC                      int 03
:0042C443 CC                      int 03
:0042C444 CC                      int 03
:0042C445 CC                      int 03
:0042C446 CC                      int 03
:0042C447 CC                      int 03
:0042C448 CC                      int 03
:0042C449 CC                      int 03
:0042C44A CC                      int 03
:0042C44B CC                      int 03
:0042C44C CC                      int 03
:0042C44D CC                      int 03
:0042C44E CC                      int 03
:0042C44F CC                      int 03
:0042C450 55                      push ebp
:0042C451 8BEC                    mov ebp, esp
:0042C453 E802000000              call 0042C45A
:0042C458 5D                      pop ebp
:0042C459 C3                      ret



* Referenced by a CALL at Address:
|:0042C453   
|
:0042C45A 55                      push ebp
:0042C45B 8BEC                    mov ebp, esp
:0042C45D 5D                      pop ebp
:0042C45E C3                      ret



* Referenced by a CALL at Address:
|:0040334E   
|
:0042C45F 55                      push ebp
:0042C460 8BEC                    mov ebp, esp
:0042C462 51                      push ecx
:0042C463 894DFC                  mov dword ptr [ebp-04], ecx
:0042C466 E82C270500              call 0047EB97
:0042C46B 034508                  add eax, dword ptr [ebp+08]
:0042C46E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042C471 8901                    mov dword ptr [ecx], eax
:0042C473 8BE5                    mov esp, ebp
:0042C475 5D                      pop ebp
:0042C476 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0042F7FA   
|
:0042C479 55                      push ebp
:0042C47A 8BEC                    mov ebp, esp
:0042C47C 83EC08                  sub esp, 00000008
:0042C47F 894DFC                  mov dword ptr [ebp-04], ecx
:0042C482 E810270500              call 0047EB97
:0042C487 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042C48A 3B01                    cmp eax, dword ptr [ecx]
:0042C48C 7D0A                    jge 0042C498
:0042C48E E804270500              call 0047EB97
:0042C493 8945F8                  mov dword ptr [ebp-08], eax
:0042C496 EB08                    jmp 0042C4A0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C48C(C)
|
:0042C498 8B55FC                  mov edx, dword ptr [ebp-04]
:0042C49B 8B02                    mov eax, dword ptr [edx]
:0042C49D 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C496(U)
|
:0042C4A0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042C4A3 8B01                    mov eax, dword ptr [ecx]
:0042C4A5 2B45F8                  sub eax, dword ptr [ebp-08]
:0042C4A8 8BE5                    mov esp, ebp
:0042C4AA 5D                      pop ebp
:0042C4AB C3                      ret


:0042C4AC 55                      push ebp
:0042C4AD 8BEC                    mov ebp, esp
:0042C4AF E8E3260500              call 0047EB97
:0042C4B4 A31C1B4B00              mov dword ptr [004B1B1C], eax
:0042C4B9 5D                      pop ebp
:0042C4BA C3                      ret


:0042C4BB 55                      push ebp
:0042C4BC 8BEC                    mov ebp, esp
:0042C4BE E8D4260500              call 0047EB97
:0042C4C3 2B051C1B4B00            sub eax, dword ptr [004B1B1C]
:0042C4C9 5D                      pop ebp
:0042C4CA C3                      ret



* Referenced by a CALL at Addresses:
|:0042C531   , :0042C673   , :0042C76B   , :0042C838   , :0044E232   
|:004542D3   , :00455CDC   , :00455D32   , :00474077   
|
:0042C4CB 55                      push ebp
:0042C4CC 8BEC                    mov ebp, esp
:0042C4CE 8B4508                  mov eax, dword ptr [ebp+08]
:0042C4D1 D1E0                    shl eax, 1
:0042C4D3 50                      push eax
:0042C4D4 B9181B4B00              mov ecx, 004B1B18
:0042C4D9 E8626EFDFF              call 00403340
:0042C4DE 5D                      pop ebp
:0042C4DF C3                      ret



* Referenced by a CALL at Addresses:
|:00401FDC   , :0040203A   , :004030A7   , :004030D8   , :00404286   
|:0040431A   , :00404499   , :00404A97   , :00404B52   , :00404C0B   
|:004056F3   , :00408528   , :00408916   , :0040D364   , :0040D3A3   
|:0040D45D   , :0040D49C   , :004150D9   , :00416F84   , :00416FBB   
|:00419EAB   , :0041C9B4   , :0041CA67   , :0041CC3C   , :0041D932   
|:0041DA3B   , :0041E3DF   , :0041E583   , :0041E5AF   , :00421788   
|:0042189E   , :00421C1E   , :00421C89   , :00422D5D   , :00423C1C   
|:00424D0E   , :0042999B   , :0042C1CD   , :0042C539   , :0042C725   
|:0042C91B   , :0042CA01   , :0042CA44   , :0042CA68   , :0042DFCE   
|:0042E196   , :0042E404   , :00431369   , :004313AB   , :004313DA   
|:004313F2   , :004314BC   , :00431ACF   , :00431DBF   , :00431DD8   
|:00431DEE   , :00431F45   , :00432027   , :0043223D   , :00432362   
|:00432455   , :004325E8   , :004326A3   , :004328E5   , :00432E11   
|:0043301C   , :0043317B   , :00433654   , :00433898   , :00433C5B   
|:00433E2A   , :00434333   , :00434607   , :0043465E   , :004348EB   
|:00434A90   , :00434C50   , :00434E82   , :0043D4EC   , :00441AD3   
|:00441AFA   , :00441BDA   , :00441C9C   , :00441D98   , :00441DD3   
|:00441ECD   , :00441FEF   , :004425DC   , :004446A5   , :00444908   
|:00444A6C   , :00444BAF   , :00444CC2   , :00444EDA   , :00445154   
|:0044516A   , :004451CA   , :0044526F   , :00445285   , :004452E5   
|:0044538A   , :004453A0   , :00445400   , :0044555C   , :004455C1   
|:00445653   , :00445669   , :0044583F   , :00445855   , :00445906   
|:0044591C   , :004459E3   , :00445A90   , :00445AD0   , :00445C31   
|:00445C71   , :00445EC2   , :00445FC1   , :0044601C   , :00446131   
|:0044618F   , :004461FB   , :004465CF   , :004469A7   , :00446D72   
|:004470DB   , :0044757A   , :00447FB8   , :00448373   , :00448389   
|:00448ACF   , :00448B08   , :00448B24   , :00448B5D   , :0044901C   
|:0044909A   , :004490D1   , :00449101   , :00449475   , :004495AB   
|:004495BE   , :0044AE60   , :0044AF61   , :0044B283   , :0044B577   
|:0044B7D9   , :0044B89F   , :0044B96E   , :0044BA43   , :0044BCC9   
|:0044BED2   , :0044C034   , :0044C11E   , :0044D3D2   , :0044D840   
|:00450698   , :004507AF   , :00450822   , :00450966   , :00450DBC   
|:00450EB7   , :00454B71   , :004564F7   , :00456710   , :00456799   
|:00456CA2   , :00456D11   , :00457311   , :0045739A   , :00457524   
|:004575AD   , :0045768B   , :00457774   , :00457972   , :00458291   
|:0045855B   , :0045874B   , :00458892   , :004589E2   , :00458ADF   
|:00458B3B   , :00458E4E   , :004590CF   , :00459105   , :004593F0   
|:00459BF4   , :00459C0F   , :0045A402   , :0045A45E   , :0045E99A   
|:0046DD18   , :0046E34A   , :0047407F   
|
:0042C4E0 55                      push ebp
:0042C4E1 8BEC                    mov ebp, esp

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C4F6(U)
|
:0042C4E3 B9181B4B00              mov ecx, 004B1B18
:0042C4E8 E803330000              call 0042F7F0
:0042C4ED 85C0                    test eax, eax
:0042C4EF 7507                    jne 0042C4F8
:0042C4F1 E8CE250500              call 0047EAC4
:0042C4F6 EBEB                    jmp 0042C4E3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C4EF(C)
|
:0042C4F8 5D                      pop ebp
:0042C4F9 C3                      ret


:0042C4FA 55                      push ebp
:0042C4FB 8BEC                    mov ebp, esp

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C51E(U)
|
:0042C4FD B9181B4B00              mov ecx, 004B1B18
:0042C502 E8E9320000              call 0042F7F0
:0042C507 85C0                    test eax, eax
:0042C509 7515                    jne 0042C520
:0042C50B B9B07F4900              mov ecx, 00497FB0
:0042C510 E8F896FFFF              call 00425C0D
:0042C515 85C0                    test eax, eax
:0042C517 7507                    jne 0042C520
:0042C519 E8A6250500              call 0047EAC4
:0042C51E EBDD                    jmp 0042C4FD

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042C509(C), :0042C517(C)
|
:0042C520 5D                      pop ebp
:0042C521 C3                      ret



* Referenced by a CALL at Addresses:
|:00415B34   , :0042C5F0   , :004749E3   
|
:0042C522 55                      push ebp
:0042C523 8BEC                    mov ebp, esp
:0042C525 837D0800                cmp dword ptr [ebp+08], 00000000
:0042C529 7502                    jne 0042C52D
:0042C52B EB11                    jmp 0042C53E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C529(C)
|
:0042C52D 8B4508                  mov eax, dword ptr [ebp+08]
:0042C530 50                      push eax
:0042C531 E895FFFFFF              call 0042C4CB
:0042C536 83C404                  add esp, 00000004
:0042C539 E8A2FFFFFF              call 0042C4E0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C52B(U)
|
:0042C53E 5D                      pop ebp
:0042C53F C3                      ret



* Referenced by a CALL at Addresses:
|:0040EE5D   , :0042B78F   , :0042BD2E   
|
:0042C540 55                      push ebp
:0042C541 8BEC                    mov ebp, esp
:0042C543 8B4508                  mov eax, dword ptr [ebp+08]
:0042C546 6BC00A                  imul eax, 0000000A
:0042C549 6BC003                  imul eax, 00000003
:0042C54C 50                      push eax
:0042C54D E8F4000000              call 0042C646
:0042C552 83C404                  add esp, 00000004
:0042C555 5D                      pop ebp
:0042C556 C3                      ret



* Referenced by a CALL at Addresses:
|:0041F514   , :0042C64C   , :0042CFE5   , :0042D7F3   , :0042DE55   
|:0042E523   , :0042F5C3   , :0042F6B7   , :0042F788   , :0044D39D   
|:0044DA1B   , :0045972F   , :0045975A   , :004598B0   , :004598E0   
|:004598FE   
|
:0042C557 55                      push ebp
:0042C558 8BEC                    mov ebp, esp
:0042C55A 6A02                    push 00000002
:0042C55C E894250500              call 0047EAF5
:0042C561 83C404                  add esp, 00000004
:0042C564 E85B250500              call 0047EAC4
:0042C569 5D                      pop ebp
:0042C56A C3                      ret



* Referenced by a CALL at Addresses:
|:00401FC6   , :0042994B   , :0042C5DB   , :0042C603   , :0042C625   
|:0042C67B   , :0042C773   , :0042C8F9   , :0042E383   , :004416BB   
|:0044E3AE   , :0044E4FC   , :00454265   , :0045426F   , :00454495   
|:00454A0F   , :00455CE4   
|
:0042C56B 55                      push ebp
:0042C56C 8BEC                    mov ebp, esp
:0042C56E 51                      push ecx
:0042C56F E850250500              call 0047EAC4
:0042C574 B9B07F4900              mov ecx, 00497FB0
:0042C579 E88F96FFFF              call 00425C0D
:0042C57E 8945FC                  mov dword ptr [ebp-04], eax
:0042C581 8B45FC                  mov eax, dword ptr [ebp-04]
:0042C584 83E801                  sub eax, 00000001
:0042C587 8945FC                  mov dword ptr [ebp-04], eax
:0042C58A 837DFC05                cmp dword ptr [ebp-04], 00000005
:0042C58E 7718                    ja 0042C5A8
:0042C590 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042C593 FF248DAEC54200          jmp dword ptr [4*ecx+0042C5AE]
:0042C59A B801000000              mov eax, 00000001
:0042C59F EB09                    jmp 0042C5AA
:0042C5A1 B802000000              mov eax, 00000002
:0042C5A6 EB02                    jmp 0042C5AA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C58E(C)
|
:0042C5A8 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042C59F(U), :0042C5A6(U)
|
:0042C5AA 8BE5                    mov esp, ebp
:0042C5AC 5D                      pop ebp
:0042C5AD C3                      ret



:0042C5AE 9AC54200                DWORD 0042C59A
:0042C5B2 A1C54200                DWORD 0042C5A1
:0042C5B6 A8C54200                DWORD 0042C5A8
:0042C5BA A8C54200                DWORD 0042C5A8
:0042C5BE 9AC54200                DWORD 0042C59A
:0042C5C2 A1C54200                DWORD 0042C5A1


:0042C5C6 55                      push ebp
:0042C5C7 8BEC                    mov ebp, esp
:0042C5C9 51                      push ecx
:0042C5CA EB09                    jmp 0042C5D5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C5F8(U)
|
:0042C5CC 8B4508                  mov eax, dword ptr [ebp+08]
:0042C5CF 83E801                  sub eax, 00000001
:0042C5D2 894508                  mov dword ptr [ebp+08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C5CA(U)
|
:0042C5D5 837D0800                cmp dword ptr [ebp+08], 00000000
:0042C5D9 741F                    je 0042C5FA
:0042C5DB E88BFFFFFF              call 0042C56B
:0042C5E0 8945FC                  mov dword ptr [ebp-04], eax
:0042C5E3 837DFC00                cmp dword ptr [ebp-04], 00000000
:0042C5E7 7405                    je 0042C5EE
:0042C5E9 8B45FC                  mov eax, dword ptr [ebp-04]
:0042C5EC EB0E                    jmp 0042C5FC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C5E7(C)
|
:0042C5EE 6A01                    push 00000001
:0042C5F0 E82DFFFFFF              call 0042C522
:0042C5F5 83C404                  add esp, 00000004
:0042C5F8 EBD2                    jmp 0042C5CC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C5D9(C)
|
:0042C5FA 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C5EC(U)
|
:0042C5FC 8BE5                    mov esp, ebp
:0042C5FE 5D                      pop ebp
:0042C5FF C3                      ret



* Referenced by a CALL at Addresses:
|:0042B6DF   , :0042B7E7   , :0042C12A   , :0042C620   , :0042C63A   
|:0042C764   , :0042C845   , :0042EA56   , :0042EF8D   , :0042EFEF   
|:0042F690   , :0042F6B2   , :0042F765   , :004556EC   , :00455C06   
|:00455C16   , :004737E8   , :00473842   , :004739AD   , :00473A0B   
|:0047404C   
|
:0042C600 55                      push ebp
:0042C601 8BEC                    mov ebp, esp

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C611(U)
|
:0042C603 E863FFFFFF              call 0042C56B
:0042C608 85C0                    test eax, eax
:0042C60A 7407                    je 0042C613
:0042C60C E8B3240500              call 0047EAC4
:0042C611 EBF0                    jmp 0042C603

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C60A(C)
|
:0042C613 5D                      pop ebp
:0042C614 C3                      ret



* Referenced by a CALL at Addresses:
|:0041E88F   , :0041E8A5   
|
:0042C615 55                      push ebp
:0042C616 8BEC                    mov ebp, esp
:0042C618 51                      push ecx
:0042C619 C745FCFFFF0000          mov [ebp-04], 0000FFFF
:0042C620 E8DBFFFFFF              call 0042C600

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C638(U)
|
:0042C625 E841FFFFFF              call 0042C56B
:0042C62A 8945FC                  mov dword ptr [ebp-04], eax
:0042C62D 837DFC00                cmp dword ptr [ebp-04], 00000000
:0042C631 7507                    jne 0042C63A
:0042C633 E88C240500              call 0047EAC4
:0042C638 EBEB                    jmp 0042C625

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C631(C)
|
:0042C63A E8C1FFFFFF              call 0042C600
:0042C63F 8B45FC                  mov eax, dword ptr [ebp-04]
:0042C642 8BE5                    mov esp, ebp
:0042C644 5D                      pop ebp
:0042C645 C3                      ret



* Referenced by a CALL at Addresses:
|:0040891D   , :0040BA8C   , :0040BB37   , :0041F5C0   , :0042C54D   
|:0042D516   , :0042D522   , :0042D52E   , :0042DD4E   , :0042DD5A   
|:0042DD66   , :0042F67E   , :004314C6   , :00432A71   , :00432A7D   
|:00432A89   , :004416C8   , :004434F8   , :00443504   , :00443510   
|:00449916   , :0044B57E   , :0044B8A6   , :0044BA4A   , :0044C125   
|
:0042C646 55                      push ebp
:0042C647 8BEC                    mov ebp, esp
:0042C649 83EC1C                  sub esp, 0000001C
:0042C64C E806FFFFFF              call 0042C557
:0042C651 E846020000              call 0042C89C
:0042C656 8B4508                  mov eax, dword ptr [ebp+08]
:0042C659 8945F4                  mov dword ptr [ebp-0C], eax
:0042C65C EB09                    jmp 0042C667

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C72A(U)
|
:0042C65E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042C661 83E901                  sub ecx, 00000001
:0042C664 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C65C(U)
|
:0042C667 837DF400                cmp dword ptr [ebp-0C], 00000000
:0042C66B 0F84BE000000            je 0042C72F
:0042C671 6A01                    push 00000001
:0042C673 E853FEFFFF              call 0042C4CB
:0042C678 83C404                  add esp, 00000004
:0042C67B E8EBFEFFFF              call 0042C56B
:0042C680 85C0                    test eax, eax
:0042C682 7405                    je 0042C689
:0042C684 E9A6000000              jmp 0042C72F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C682(C)
|
:0042C689 E836240500              call 0047EAC4
:0042C68E B9B07F4900              mov ecx, 00497FB0
:0042C693 E88E95FFFF              call 00425C26
:0042C698 8945FC                  mov dword ptr [ebp-04], eax
:0042C69B B9B07F4900              mov ecx, 00497FB0
:0042C6A0 E89295FFFF              call 00425C37
:0042C6A5 8945F8                  mov dword ptr [ebp-08], eax
:0042C6A8 8D55E4                  lea edx, dword ptr [ebp-1C]
:0042C6AB 52                      push edx
:0042C6AC A1686A4B00              mov eax, dword ptr [004B6A68]
:0042C6B1 50                      push eax
:0042C6B2 FF15EC624800            call dword ptr [004862EC]
:0042C6B8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042C6BB 3B4DE4                  cmp ecx, dword ptr [ebp-1C]
:0042C6BE 7E65                    jle 0042C725
:0042C6C0 8B55FC                  mov edx, dword ptr [ebp-04]
:0042C6C3 3B55EC                  cmp edx, dword ptr [ebp-14]
:0042C6C6 7D5D                    jge 0042C725
:0042C6C8 8B45F8                  mov eax, dword ptr [ebp-08]
:0042C6CB 3B45E8                  cmp eax, dword ptr [ebp-18]
:0042C6CE 7E55                    jle 0042C725
:0042C6D0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042C6D3 3B4DF0                  cmp ecx, dword ptr [ebp-10]
:0042C6D6 7D4D                    jge 0042C725
:0042C6D8 E845F2FDFF              call 0040B922
:0042C6DD F7D8                    neg eax
:0042C6DF 1BC0                    sbb eax, eax
:0042C6E1 83E010                  and eax, 00000010
:0042C6E4 83C028                  add eax, 00000028
:0042C6E7 3945F8                  cmp dword ptr [ebp-08], eax
:0042C6EA 7F1C                    jg 0042C708
:0042C6EC 8B55FC                  mov edx, dword ptr [ebp-04]
:0042C6EF 3B55EC                  cmp edx, dword ptr [ebp-14]
:0042C6F2 7D14                    jge 0042C708
:0042C6F4 6A0C                    push 0000000C
:0042C6F6 A1686A4B00              mov eax, dword ptr [004B6A68]
:0042C6FB 50                      push eax
:0042C6FC B9B07F4900              mov ecx, 00497FB0
:0042C701 E89C9BFFFF              call 004262A2
:0042C706 EB13                    jmp 0042C71B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042C6EA(C), :0042C6F2(C)
|
:0042C708 6A00                    push 00000000
:0042C70A 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:0042C710 51                      push ecx
:0042C711 B9B07F4900              mov ecx, 00497FB0
:0042C716 E8879BFFFF              call 004262A2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C706(U)
|
:0042C71B B9B07F4900              mov ecx, 00497FB0
:0042C720 E8BE9BFFFF              call 004262E3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042C6BE(C), :0042C6C6(C), :0042C6CE(C), :0042C6D6(C)
|
:0042C725 E8B6FDFFFF              call 0042C4E0
:0042C72A E92FFFFFFF              jmp 0042C65E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042C66B(C), :0042C684(U)
|
:0042C72F 8BE5                    mov esp, ebp
:0042C731 5D                      pop ebp
:0042C732 C3                      ret



* Referenced by a CALL at Addresses:
|:0042D538   , :0042DD70   , :00432A4D   
|
:0042C733 55                      push ebp
:0042C734 8BEC                    mov ebp, esp
:0042C736 83EC1C                  sub esp, 0000001C
:0042C739 C645FC0A                mov [ebp-04], 0A
:0042C73D 6A00                    push 00000000
:0042C73F 6A00                    push 00000000
:0042C741 6802020000              push 00000202
:0042C746 A1686A4B00              mov eax, dword ptr [004B6A68]
:0042C74B 50                      push eax
:0042C74C FF15F4624800            call dword ptr [004862F4]
:0042C752 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042C755 81E1FF000000            and ecx, 000000FF
:0042C75B 51                      push ecx
:0042C75C E8BAF0FFFF              call 0042B81B
:0042C761 83C404                  add esp, 00000004
:0042C764 E897FEFFFF              call 0042C600
:0042C769 6A03                    push 00000003
:0042C76B E85BFDFFFF              call 0042C4CB
:0042C770 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C840(U)
|
:0042C773 E8F3FDFFFF              call 0042C56B
:0042C778 85C0                    test eax, eax
:0042C77A 0F85C5000000            jne 0042C845
:0042C780 E83F230500              call 0047EAC4
:0042C785 B9B07F4900              mov ecx, 00497FB0
:0042C78A E89794FFFF              call 00425C26
:0042C78F 8945F8                  mov dword ptr [ebp-08], eax
:0042C792 B9B07F4900              mov ecx, 00497FB0
:0042C797 E89B94FFFF              call 00425C37
:0042C79C 8945F4                  mov dword ptr [ebp-0C], eax
:0042C79F 8D55E4                  lea edx, dword ptr [ebp-1C]
:0042C7A2 52                      push edx
:0042C7A3 A1686A4B00              mov eax, dword ptr [004B6A68]
:0042C7A8 50                      push eax
:0042C7A9 FF15EC624800            call dword ptr [004862EC]
:0042C7AF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042C7B2 3B4DE4                  cmp ecx, dword ptr [ebp-1C]
:0042C7B5 0F8E85000000            jle 0042C840
:0042C7BB 8B55F8                  mov edx, dword ptr [ebp-08]
:0042C7BE 3B55EC                  cmp edx, dword ptr [ebp-14]
:0042C7C1 7D7D                    jge 0042C840
:0042C7C3 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042C7C6 3B45E8                  cmp eax, dword ptr [ebp-18]
:0042C7C9 7E75                    jle 0042C840
:0042C7CB 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042C7CE 3B4DF0                  cmp ecx, dword ptr [ebp-10]
:0042C7D1 7D6D                    jge 0042C840
:0042C7D3 E84AF1FDFF              call 0040B922
:0042C7D8 F7D8                    neg eax
:0042C7DA 1BC0                    sbb eax, eax
:0042C7DC 83E010                  and eax, 00000010
:0042C7DF 83C028                  add eax, 00000028
:0042C7E2 3945F4                  cmp dword ptr [ebp-0C], eax
:0042C7E5 7F26                    jg 0042C80D
:0042C7E7 8B55F8                  mov edx, dword ptr [ebp-08]
:0042C7EA 3B55EC                  cmp edx, dword ptr [ebp-14]
:0042C7ED 7D1E                    jge 0042C80D
:0042C7EF 6A0C                    push 0000000C
:0042C7F1 A1686A4B00              mov eax, dword ptr [004B6A68]
:0042C7F6 50                      push eax
:0042C7F7 B9B07F4900              mov ecx, 00497FB0
:0042C7FC E8A19AFFFF              call 004262A2
:0042C801 B9B07F4900              mov ecx, 00497FB0
:0042C806 E8D89AFFFF              call 004262E3
:0042C80B EB33                    jmp 0042C840

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042C7E5(C), :0042C7ED(C)
|
:0042C80D B9181B4B00              mov ecx, 004B1B18
:0042C812 E8D92F0000              call 0042F7F0
:0042C817 85C0                    test eax, eax
:0042C819 7425                    je 0042C840
:0042C81B 8A4DFC                  mov cl, byte ptr [ebp-04]
:0042C81E 80F101                  xor cl, 01
:0042C821 884DFC                  mov byte ptr [ebp-04], cl
:0042C824 8B55FC                  mov edx, dword ptr [ebp-04]
:0042C827 81E2FF000000            and edx, 000000FF
:0042C82D 52                      push edx
:0042C82E E8E8EFFFFF              call 0042B81B
:0042C833 83C404                  add esp, 00000004
:0042C836 6A03                    push 00000003
:0042C838 E88EFCFFFF              call 0042C4CB
:0042C83D 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042C7B5(C), :0042C7C1(C), :0042C7C9(C), :0042C7D1(C), :0042C80B(U)
|:0042C819(C)
|
:0042C840 E92EFFFFFF              jmp 0042C773

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C77A(C)
|
:0042C845 E8B6FDFFFF              call 0042C600
:0042C84A 6A00                    push 00000000
:0042C84C E8CAEFFFFF              call 0042B81B
:0042C851 83C404                  add esp, 00000004
:0042C854 8BE5                    mov esp, ebp
:0042C856 5D                      pop ebp
:0042C857 C3                      ret



* Referenced by a CALL at Addresses:
|:004134B1   , :00414350   , :004143B3   , :0041998A   , :0042B9DE   
|:0042C082   
|
:0042C858 55                      push ebp
:0042C859 8BEC                    mov ebp, esp
:0042C85B 8B4508                  mov eax, dword ptr [ebp+08]
:0042C85E 50                      push eax
:0042C85F B970074B00              mov ecx, 004B0770
:0042C864 E80E0AFEFF              call 0040D277
:0042C869 B93CC64A00              mov ecx, 004AC63C
:0042C86E E83DF0FDFF              call 0040B8B0
:0042C873 25FF000000              and eax, 000000FF
:0042C878 83F802                  cmp eax, 00000002
:0042C87B 750C                    jne 0042C889
:0042C87D 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042C880 51                      push ecx
:0042C881 E818CFFFFF              call 0042979E
:0042C886 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C87B(C)
|
:0042C889 33C0                    xor eax, eax
:0042C88B 5D                      pop ebp
:0042C88C C3                      ret



* Referenced by a CALL at Addresses:
|:004199A9   , :00426BA6   , :004299D9   , :00429B93   , :00429FBB   
|
:0042C88D 55                      push ebp
:0042C88E 8BEC                    mov ebp, esp
:0042C890 B970074B00              mov ecx, 004B0770
:0042C895 E8C709FEFF              call 0040D261
:0042C89A 5D                      pop ebp
:0042C89B C3                      ret



* Referenced by a CALL at Addresses:
|:0042B9A0   , :0042C651   
|
:0042C89C 55                      push ebp
:0042C89D 8BEC                    mov ebp, esp
:0042C89F 6A01                    push 00000001
:0042C8A1 E84F220500              call 0047EAF5
:0042C8A6 83C404                  add esp, 00000004
:0042C8A9 E816220500              call 0047EAC4
:0042C8AE 5D                      pop ebp
:0042C8AF C3                      ret



* Referenced by a CALL at Addresses:
|:0042D4A8   , :0042DC95   , :0042DCE1   , :0042E155   , :004329E1   
|:004434A2   , :0046D4B0   
|
:0042C8B0 55                      push ebp
:0042C8B1 8BEC                    mov ebp, esp
:0042C8B3 83EC18                  sub esp, 00000018
:0042C8B6 8B4510                  mov eax, dword ptr [ebp+10]
:0042C8B9 8945F8                  mov dword ptr [ebp-08], eax
:0042C8BC C745F400000000          mov [ebp-0C], 00000000
:0042C8C3 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042C8C6 894DEC                  mov dword ptr [ebp-14], ecx
:0042C8C9 C645FE00                mov [ebp-02], 00
:0042C8CD C745F000000000          mov [ebp-10], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CABE(U)
|
:0042C8D4 8B55F8                  mov edx, dword ptr [ebp-08]
:0042C8D7 33C0                    xor eax, eax
:0042C8D9 8A02                    mov al, byte ptr [edx]
:0042C8DB 83F80A                  cmp eax, 0000000A
:0042C8DE 0F84DF010000            je 0042CAC3
:0042C8E4 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042C8E7 33D2                    xor edx, edx
:0042C8E9 8A11                    mov dl, byte ptr [ecx]
:0042C8EB 85D2                    test edx, edx
:0042C8ED 0F84D0010000            je 0042CAC3
:0042C8F3 837D1400                cmp dword ptr [ebp+14], 00000000
:0042C8F7 7410                    je 0042C909
:0042C8F9 E86DFCFFFF              call 0042C56B
:0042C8FE 85C0                    test eax, eax
:0042C900 7407                    je 0042C909
:0042C902 C7451400000000          mov [ebp+14], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042C8F7(C), :0042C900(C)
|
:0042C909 837D1400                cmp dword ptr [ebp+14], 00000000
:0042C90D 7411                    je 0042C920
:0042C90F 6A01                    push 00000001
:0042C911 B9181B4B00              mov ecx, 004B1B18
:0042C916 E8256AFDFF              call 00403340
:0042C91B E8C0FBFFFF              call 0042C4E0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C90D(C)
|
:0042C920 8B45F8                  mov eax, dword ptr [ebp-08]
:0042C923 33C9                    xor ecx, ecx
:0042C925 8A08                    mov cl, byte ptr [eax]
:0042C927 51                      push ecx
:0042C928 E80F330500              call 0047FC3C
:0042C92D 83C404                  add esp, 00000004
:0042C930 85C0                    test eax, eax
:0042C932 0F8437010000            je 0042CA6F
:0042C938 8B55F8                  mov edx, dword ptr [ebp-08]
:0042C93B 8A02                    mov al, byte ptr [edx]
:0042C93D 8845FC                  mov byte ptr [ebp-04], al
:0042C940 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042C943 83C101                  add ecx, 00000001
:0042C946 894DF8                  mov dword ptr [ebp-08], ecx
:0042C949 8B55F8                  mov edx, dword ptr [ebp-08]
:0042C94C 8A02                    mov al, byte ptr [edx]
:0042C94E 8845FD                  mov byte ptr [ebp-03], al
:0042C951 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042C954 83C101                  add ecx, 00000001
:0042C957 894DF8                  mov dword ptr [ebp-08], ecx
:0042C95A 8B550C                  mov edx, dword ptr [ebp+0C]
:0042C95D 52                      push edx
:0042C95E 8B45EC                  mov eax, dword ptr [ebp-14]
:0042C961 50                      push eax
:0042C962 B9382F4900              mov ecx, 00492F38
:0042C967 E86B22FEFF              call 0040EBD7
:0042C96C 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0042C96F 51                      push ecx

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:0042C970 6820C84800              push 0048C820
:0042C975 68382F4900              push 00492F38
:0042C97A E82131FEFF              call 0040FAA0
:0042C97F 83C40C                  add esp, 0000000C
:0042C982 8B55F4                  mov edx, dword ptr [ebp-0C]
:0042C985 83C202                  add edx, 00000002
:0042C988 8955F4                  mov dword ptr [ebp-0C], edx
:0042C98B 8B45EC                  mov eax, dword ptr [ebp-14]
:0042C98E 83C002                  add eax, 00000002
:0042C991 8945EC                  mov dword ptr [ebp-14], eax
:0042C994 837D1400                cmp dword ptr [ebp+14], 00000000
:0042C998 0F84CF000000            je 0042CA6D
:0042C99E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042C9A1 81E1FF000000            and ecx, 000000FF
:0042C9A7 81F9A1000000            cmp ecx, 000000A1
:0042C9AD 0F85BA000000            jne 0042CA6D
:0042C9B3 8B55FD                  mov edx, dword ptr [ebp-03]
:0042C9B6 81E2FF000000            and edx, 000000FF
:0042C9BC 8955E8                  mov dword ptr [ebp-18], edx
:0042C9BF 8B45E8                  mov eax, dword ptr [ebp-18]
:0042C9C2 83E842                  sub eax, 00000042
:0042C9C5 8945E8                  mov dword ptr [ebp-18], eax
:0042C9C8 837DE860                cmp dword ptr [ebp-18], 00000060
:0042C9CC 0F879B000000            ja 0042CA6D
:0042C9D2 8B55E8                  mov edx, dword ptr [ebp-18]
:0042C9D5 33C9                    xor ecx, ecx
:0042C9D7 8A8A0CCB4200            mov cl, byte ptr [edx+0042CB0C]
:0042C9DD FF248DF4CA4200          jmp dword ptr [4*ecx+0042CAF4]
:0042C9E4 837D1400                cmp dword ptr [ebp+14], 00000000
:0042C9E8 741C                    je 0042CA06
:0042C9EA 8B45F8                  mov eax, dword ptr [ebp-08]
:0042C9ED 33C9                    xor ecx, ecx
:0042C9EF 8A08                    mov cl, byte ptr [eax]
:0042C9F1 85C9                    test ecx, ecx
:0042C9F3 7411                    je 0042CA06
:0042C9F5 6A01                    push 00000001
:0042C9F7 B9181B4B00              mov ecx, 004B1B18
:0042C9FC E83F69FDFF              call 00403340
:0042CA01 E8DAFAFFFF              call 0042C4E0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042C9E8(C), :0042C9F3(C)
|
:0042CA06 EB65                    jmp 0042CA6D
:0042CA08 837D1400                cmp dword ptr [ebp+14], 00000000
:0042CA0C 743B                    je 0042CA49
:0042CA0E 8B55F8                  mov edx, dword ptr [ebp-08]
:0042CA11 33C0                    xor eax, eax
:0042CA13 8A02                    mov al, byte ptr [edx]
:0042CA15 85C0                    test eax, eax
:0042CA17 7430                    je 0042CA49
:0042CA19 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042CA1C 33D2                    xor edx, edx
:0042CA1E 8A11                    mov dl, byte ptr [ecx]
:0042CA20 81FAA3000000            cmp edx, 000000A3
:0042CA26 7510                    jne 0042CA38
:0042CA28 8B45F8                  mov eax, dword ptr [ebp-08]
:0042CA2B 33C9                    xor ecx, ecx
:0042CA2D 8A4801                  mov cl, byte ptr [eax+01]
:0042CA30 81F9A9000000            cmp ecx, 000000A9
:0042CA36 7411                    je 0042CA49

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CA26(C)
|

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0042CA38 6A06                    push 00000006
:0042CA3A B9181B4B00              mov ecx, 004B1B18
:0042CA3F E8FC68FDFF              call 00403340
:0042CA44 E897FAFFFF              call 0042C4E0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042CA0C(C), :0042CA17(C), :0042CA36(C)
|
:0042CA49 EB22                    jmp 0042CA6D
:0042CA4B 837D1400                cmp dword ptr [ebp+14], 00000000
:0042CA4F 741C                    je 0042CA6D
:0042CA51 8B55F8                  mov edx, dword ptr [ebp-08]
:0042CA54 33C0                    xor eax, eax
:0042CA56 8A02                    mov al, byte ptr [edx]
:0042CA58 85C0                    test eax, eax
:0042CA5A 7411                    je 0042CA6D

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0042CA5C 6A06                    push 00000006
:0042CA5E B9181B4B00              mov ecx, 004B1B18
:0042CA63 E8D868FDFF              call 00403340
:0042CA68 E873FAFFFF              call 0042C4E0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042C998(C), :0042C9AD(C), :0042C9CC(C), :0042CA06(U), :0042CA49(U)
|:0042CA4F(C), :0042CA5A(C)
|
:0042CA6D EB4F                    jmp 0042CABE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042C932(C)
|
:0042CA6F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042CA72 8A11                    mov dl, byte ptr [ecx]
:0042CA74 8855FC                  mov byte ptr [ebp-04], dl
:0042CA77 8B45F8                  mov eax, dword ptr [ebp-08]
:0042CA7A 83C001                  add eax, 00000001
:0042CA7D 8945F8                  mov dword ptr [ebp-08], eax
:0042CA80 C645FD00                mov [ebp-03], 00
:0042CA84 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0042CA87 51                      push ecx
:0042CA88 8B55EC                  mov edx, dword ptr [ebp-14]
:0042CA8B 52                      push edx
:0042CA8C B9382F4900              mov ecx, 00492F38
:0042CA91 E84121FEFF              call 0040EBD7
:0042CA96 8D45FC                  lea eax, dword ptr [ebp-04]
:0042CA99 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:0042CA9A 6824C84800              push 0048C824
:0042CA9F 68382F4900              push 00492F38
:0042CAA4 E8F72FFEFF              call 0040FAA0
:0042CAA9 83C40C                  add esp, 0000000C
:0042CAAC 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042CAAF 83C101                  add ecx, 00000001
:0042CAB2 894DF4                  mov dword ptr [ebp-0C], ecx
:0042CAB5 8B55EC                  mov edx, dword ptr [ebp-14]
:0042CAB8 83C201                  add edx, 00000001
:0042CABB 8955EC                  mov dword ptr [ebp-14], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CA6D(U)
|
:0042CABE E911FEFFFF              jmp 0042C8D4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042C8DE(C), :0042C8ED(C)
|
:0042CAC3 8B45F8                  mov eax, dword ptr [ebp-08]
:0042CAC6 33C9                    xor ecx, ecx
:0042CAC8 8A08                    mov cl, byte ptr [eax]
:0042CACA 83F90A                  cmp ecx, 0000000A
:0042CACD 7509                    jne 0042CAD8
:0042CACF 8B55F4                  mov edx, dword ptr [ebp-0C]
:0042CAD2 83C201                  add edx, 00000001
:0042CAD5 8955F4                  mov dword ptr [ebp-0C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CACD(C)
|
:0042CAD8 8B45F8                  mov eax, dword ptr [ebp-08]
:0042CADB 33C9                    xor ecx, ecx
:0042CADD 8A08                    mov cl, byte ptr [eax]
:0042CADF 83F90D                  cmp ecx, 0000000D
:0042CAE2 7509                    jne 0042CAED
:0042CAE4 8B55F4                  mov edx, dword ptr [ebp-0C]
:0042CAE7 83C202                  add edx, 00000002
:0042CAEA 8955F4                  mov dword ptr [ebp-0C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CAE2(C)
|
:0042CAED 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042CAF0 8BE5                    mov esp, ebp
:0042CAF2 5D                      pop ebp
:0042CAF3 C3                      ret



:0042CAF4 E4C94200                DWORD 0042C9E4
:0042CAF8 08CA4200                DWORD 0042CA08
:0042CAFC 08CA4200                DWORD 0042CA08
:0042CB00 4BCA4200                DWORD 0042CA4B
:0042CB04 E4C94200                DWORD 0042C9E4
:0042CB08 6DCA4200                DWORD 0042CA6D


:0042CB0C 0001                    add byte ptr [ecx], al
:0042CB0E 0505050505              add eax, 05050505
:0042CB13 0505050505              add eax, 05050505
:0042CB18 0505050505              add eax, 05050505
:0042CB1D 0202                    add al, byte ptr [edx]
:0042CB1F 0505050505              add eax, 05050505
:0042CB24 0505050505              add eax, 05050505
:0042CB29 0505050505              add eax, 05050505
:0042CB2E 0505050505              add eax, 05050505
:0042CB33 0505050505              add eax, 05050505
:0042CB38 0505050505              add eax, 05050505
:0042CB3D 0505050505              add eax, 05050505
:0042CB42 0505050505              add eax, 05050505
:0042CB47 0503050505              add eax, 05050503
:0042CB4C 0505050505              add eax, 05050505
:0042CB51 0505050505              add eax, 05050505
:0042CB56 0505050505              add eax, 05050505
:0042CB5B 0505050505              add eax, 05050505
:0042CB60 0505050505              add eax, 05050505
:0042CB65 0505050505              add eax, 05050505
:0042CB6A 05                      BYTE 05h
:0042CB6B 05                      BYTE 05h
:0042CB6C 04                      BYTE 04h


* Referenced by a CALL at Address:
|:0042D618   
|
:0042CB6D 55                      push ebp
:0042CB6E 8BEC                    mov ebp, esp
:0042CB70 81EC78020000            sub esp, 00000278
:0042CB76 53                      push ebx
:0042CB77 56                      push esi
:0042CB78 C685B8FEFFFFFF          mov byte ptr [ebp+FFFFFEB8], FF
:0042CB7F 817D0C00020000          cmp dword ptr [ebp+0C], 00000200
:0042CB86 7314                    jnb 0042CB9C
:0042CB88 8B450C                  mov eax, dword ptr [ebp+0C]
:0042CB8B 50                      push eax
:0042CB8C E8CFF2FDFF              call 0040BE60
:0042CB91 83C404                  add esp, 00000004
:0042CB94 898594FDFFFF            mov dword ptr [ebp+FFFFFD94], eax
:0042CB9A EB0A                    jmp 0042CBA6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CB86(C)
|
:0042CB9C C78594FDFFFF00000000    mov dword ptr [ebp+FFFFFD94], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CB9A(U)
|
:0042CBA6 8B8D94FDFFFF            mov ecx, dword ptr [ebp+FFFFFD94]
:0042CBAC 898DD0FEFFFF            mov dword ptr [ebp+FFFFFED0], ecx
:0042CBB2 B950424B00              mov ecx, 004B4250
:0042CBB7 E888920200              call 00455E44
:0042CBBC 99                      cdq
:0042CBBD B930000000              mov ecx, 00000030
:0042CBC2 F7F9                    idiv ecx
:0042CBC4 8885D4FEFFFF            mov byte ptr [ebp+FFFFFED4], al
:0042CBCA B950424B00              mov ecx, 004B4250
:0042CBCF E897920200              call 00455E6B
:0042CBD4 99                      cdq
:0042CBD5 B930000000              mov ecx, 00000030
:0042CBDA F7F9                    idiv ecx
:0042CBDC 8885C0FEFFFF            mov byte ptr [ebp+FFFFFEC0], al
:0042CBE2 8B85D4FEFFFF            mov eax, dword ptr [ebp+FFFFFED4]
:0042CBE8 25FF000000              and eax, 000000FF
:0042CBED 99                      cdq
:0042CBEE 2BC2                    sub eax, edx
:0042CBF0 D1F8                    sar eax, 1
:0042CBF2 8885B4FEFFFF            mov byte ptr [ebp+FFFFFEB4], al
:0042CBF8 8B85C0FEFFFF            mov eax, dword ptr [ebp+FFFFFEC0]
:0042CBFE 25FF000000              and eax, 000000FF
:0042CC03 99                      cdq
:0042CC04 2BC2                    sub eax, edx
:0042CC06 D1F8                    sar eax, 1
:0042CC08 8885C4FEFFFF            mov byte ptr [ebp+FFFFFEC4], al
:0042CC0E 8B95B4FEFFFF            mov edx, dword ptr [ebp+FFFFFEB4]
:0042CC14 81E2FF000000            and edx, 000000FF
:0042CC1A 6BD230                  imul edx, 00000030
:0042CC1D 8995ECFEFFFF            mov dword ptr [ebp+FFFFFEEC], edx
:0042CC23 8B85C4FEFFFF            mov eax, dword ptr [ebp+FFFFFEC4]
:0042CC29 25FF000000              and eax, 000000FF
:0042CC2E 6BC030                  imul eax, 00000030
:0042CC31 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:0042CC37 C785A8FEFFFF00000000    mov dword ptr [ebp+FFFFFEA8], 00000000
:0042CC41 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0042CC44 6BC948                  imul ecx, 00000048
:0042CC47 81C1681B4A00            add ecx, 004A1B68
:0042CC4D E88AAE0400              call 00477ADC
:0042CC52 8845F8                  mov byte ptr [ebp-08], al
:0042CC55 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042CC58 81E1FF000000            and ecx, 000000FF
:0042CC5E 81F9FF000000            cmp ecx, 000000FF
:0042CC64 0F84DE020000            je 0042CF48
:0042CC6A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042CC6D 81E1FF000000            and ecx, 000000FF
:0042CC73 6BC924                  imul ecx, 00000024
:0042CC76 81C1502C4B00            add ecx, 004B2C50
:0042CC7C E80FC0FEFF              call 00418C90
:0042CC81 25FF000000              and eax, 000000FF
:0042CC86 83F802                  cmp eax, 00000002
:0042CC89 0F85B9020000            jne 0042CF48
:0042CC8F C785A8FEFFFF01000000    mov dword ptr [ebp+FFFFFEA8], 00000001
:0042CC99 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042CC9C 81E1FF000000            and ecx, 000000FF
:0042CCA2 6BC924                  imul ecx, 00000024
:0042CCA5 81C1502C4B00            add ecx, 004B2C50
:0042CCAB E8B066FDFF              call 00403360
:0042CCB0 668B10                  mov dx, word ptr [eax]
:0042CCB3 66899598FDFFFF          mov word ptr [ebp+FFFFFD98], dx
:0042CCBA 8B9D98FDFFFF            mov ebx, dword ptr [ebp+FFFFFD98]
:0042CCC0 81E3FF000000            and ebx, 000000FF
:0042CCC6 B950424B00              mov ecx, 004B4250
:0042CCCB E8C34D0200              call 00451A93
:0042CCD0 99                      cdq
:0042CCD1 B930000000              mov ecx, 00000030
:0042CCD6 F7F9                    idiv ecx
:0042CCD8 2BD8                    sub ebx, eax
:0042CCDA 889D9CFDFFFF            mov byte ptr [ebp+FFFFFD9C], bl
:0042CCE0 8B9D99FDFFFF            mov ebx, dword ptr [ebp+FFFFFD99]
:0042CCE6 81E3FF000000            and ebx, 000000FF
:0042CCEC B950424B00              mov ecx, 004B4250
:0042CCF1 E8AE4D0200              call 00451AA4
:0042CCF6 99                      cdq
:0042CCF7 B930000000              mov ecx, 00000030
:0042CCFC F7F9                    idiv ecx
:0042CCFE 2BD8                    sub ebx, eax
:0042CD00 889DA0FDFFFF            mov byte ptr [ebp+FFFFFDA0], bl
:0042CD06 8B959CFDFFFF            mov edx, dword ptr [ebp+FFFFFD9C]
:0042CD0C 81E2FF000000            and edx, 000000FF
:0042CD12 83FA02                  cmp edx, 00000002
:0042CD15 7C22                    jl 0042CD39
:0042CD17 8B859CFDFFFF            mov eax, dword ptr [ebp+FFFFFD9C]
:0042CD1D 25FF000000              and eax, 000000FF
:0042CD22 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:0042CD28 81E1FF000000            and ecx, 000000FF
:0042CD2E 83E902                  sub ecx, 00000002
:0042CD31 3BC1                    cmp eax, ecx
:0042CD33 0F8CE9000000            jl 0042CE22

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CD15(C)
|
:0042CD39 8B959CFDFFFF            mov edx, dword ptr [ebp+FFFFFD9C]
:0042CD3F 81E2FF000000            and edx, 000000FF
:0042CD45 83FA02                  cmp edx, 00000002
:0042CD48 7D32                    jge 0042CD7C
:0042CD4A 8B859CFDFFFF            mov eax, dword ptr [ebp+FFFFFD9C]
:0042CD50 25FF000000              and eax, 000000FF
:0042CD55 83C001                  add eax, 00000001
:0042CD58 6BC030                  imul eax, 00000030
:0042CD5B 83C010                  add eax, 00000010
:0042CD5E 8985B0FEFFFF            mov dword ptr [ebp+FFFFFEB0], eax
:0042CD64 8B8DB0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEB0]
:0042CD6A 83E910                  sub ecx, 00000010
:0042CD6D 898DBCFEFFFF            mov dword ptr [ebp+FFFFFEBC], ecx
:0042CD73 C685E4FEFFFF03          mov byte ptr [ebp+FFFFFEE4], 03
:0042CD7A EB39                    jmp 0042CDB5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CD48(C)
|
:0042CD7C 8B959CFDFFFF            mov edx, dword ptr [ebp+FFFFFD9C]
:0042CD82 81E2FF000000            and edx, 000000FF
:0042CD88 6BD230                  imul edx, 00000030
:0042CD8B 81EAC0010000            sub edx, 000001C0
:0042CD91 8995B0FEFFFF            mov dword ptr [ebp+FFFFFEB0], edx
:0042CD97 8B859CFDFFFF            mov eax, dword ptr [ebp+FFFFFD9C]
:0042CD9D 25FF000000              and eax, 000000FF
:0042CDA2 6BC030                  imul eax, 00000030
:0042CDA5 83E810                  sub eax, 00000010
:0042CDA8 8985BCFEFFFF            mov dword ptr [ebp+FFFFFEBC], eax
:0042CDAE C685E4FEFFFF01          mov byte ptr [ebp+FFFFFEE4], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CD7A(U)
|
:0042CDB5 8B8DA0FDFFFF            mov ecx, dword ptr [ebp+FFFFFDA0]
:0042CDBB 81E1FF000000            and ecx, 000000FF
:0042CDC1 8B95C4FEFFFF            mov edx, dword ptr [ebp+FFFFFEC4]
:0042CDC7 81E2FF000000            and edx, 000000FF
:0042CDCD 3BCA                    cmp ecx, edx
:0042CDCF 7D19                    jge 0042CDEA
:0042CDD1 8B85A0FDFFFF            mov eax, dword ptr [ebp+FFFFFDA0]
:0042CDD7 25FF000000              and eax, 000000FF
:0042CDDC 6BC030                  imul eax, 00000030
:0042CDDF 83C008                  add eax, 00000008
:0042CDE2 8985ACFEFFFF            mov dword ptr [ebp+FFFFFEAC], eax
:0042CDE8 EB1B                    jmp 0042CE05

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CDCF(C)
|
:0042CDEA 8B8DA0FDFFFF            mov ecx, dword ptr [ebp+FFFFFDA0]
:0042CDF0 81E1FF000000            and ecx, 000000FF
:0042CDF6 83C101                  add ecx, 00000001
:0042CDF9 6BC930                  imul ecx, 00000030
:0042CDFC 83E968                  sub ecx, 00000068
:0042CDFF 898DACFEFFFF            mov dword ptr [ebp+FFFFFEAC], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CDE8(U)
|
:0042CE05 8B95A0FDFFFF            mov edx, dword ptr [ebp+FFFFFDA0]
:0042CE0B 81E2FF000000            and edx, 000000FF
:0042CE11 6BD230                  imul edx, 00000030
:0042CE14 83C210                  add edx, 00000010
:0042CE17 8995A4FEFFFF            mov dword ptr [ebp+FFFFFEA4], edx
:0042CE1D E924010000              jmp 0042CF46

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CD33(C)
|
:0042CE22 8B859CFDFFFF            mov eax, dword ptr [ebp+FFFFFD9C]
:0042CE28 25FF000000              and eax, 000000FF
:0042CE2D 6BC030                  imul eax, 00000030

* Possible Reference to Dialog: DialogID_00C8 
                                  |
:0042CE30 3DC8000000              cmp eax, 000000C8
:0042CE35 7D1D                    jge 0042CE54
:0042CE37 8B8D9CFDFFFF            mov ecx, dword ptr [ebp+FFFFFD9C]
:0042CE3D 81E1FF000000            and ecx, 000000FF
:0042CE43 83E901                  sub ecx, 00000001
:0042CE46 6BC930                  imul ecx, 00000030
:0042CE49 83C108                  add ecx, 00000008
:0042CE4C 898DB0FEFFFF            mov dword ptr [ebp+FFFFFEB0], ecx
:0042CE52 EB5F                    jmp 0042CEB3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CE35(C)
|
:0042CE54 8BB59CFDFFFF            mov esi, dword ptr [ebp+FFFFFD9C]
:0042CE5A 81E6FF000000            and esi, 000000FF
:0042CE60 83C601                  add esi, 00000001
:0042CE63 6BF630                  imul esi, 00000030
:0042CE66 81C6C8000000            add esi, 000000C8
:0042CE6C B950424B00              mov ecx, 004B4250
:0042CE71 E8CE8F0200              call 00455E44
:0042CE76 3BF0                    cmp esi, eax
:0042CE78 7C20                    jl 0042CE9A
:0042CE7A 8B95D4FEFFFF            mov edx, dword ptr [ebp+FFFFFED4]
:0042CE80 81E2FF000000            and edx, 000000FF
:0042CE86 83EA01                  sub edx, 00000001
:0042CE89 6BD230                  imul edx, 00000030
:0042CE8C 81EAB8010000            sub edx, 000001B8
:0042CE92 8995B0FEFFFF            mov dword ptr [ebp+FFFFFEB0], edx
:0042CE98 EB19                    jmp 0042CEB3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CE78(C)
|
:0042CE9A 8B859CFDFFFF            mov eax, dword ptr [ebp+FFFFFD9C]
:0042CEA0 25FF000000              and eax, 000000FF
:0042CEA5 6BC030                  imul eax, 00000030
:0042CEA8 2DB8000000              sub eax, 000000B8
:0042CEAD 8985B0FEFFFF            mov dword ptr [ebp+FFFFFEB0], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042CE52(U), :0042CE98(U)
|
:0042CEB3 8B8D9CFDFFFF            mov ecx, dword ptr [ebp+FFFFFD9C]
:0042CEB9 81E1FF000000            and ecx, 000000FF
:0042CEBF 6BC930                  imul ecx, 00000030
:0042CEC2 83C110                  add ecx, 00000010
:0042CEC5 898DBCFEFFFF            mov dword ptr [ebp+FFFFFEBC], ecx
:0042CECB 8B95A0FDFFFF            mov edx, dword ptr [ebp+FFFFFDA0]
:0042CED1 81E2FF000000            and edx, 000000FF
:0042CED7 8B85C4FEFFFF            mov eax, dword ptr [ebp+FFFFFEC4]
:0042CEDD 25FF000000              and eax, 000000FF
:0042CEE2 3BD0                    cmp edx, eax
:0042CEE4 7D33                    jge 0042CF19
:0042CEE6 8B8DA0FDFFFF            mov ecx, dword ptr [ebp+FFFFFDA0]
:0042CEEC 81E1FF000000            and ecx, 000000FF
:0042CEF2 83C101                  add ecx, 00000001
:0042CEF5 6BC930                  imul ecx, 00000030
:0042CEF8 83C110                  add ecx, 00000010
:0042CEFB 898DACFEFFFF            mov dword ptr [ebp+FFFFFEAC], ecx
:0042CF01 8B95ACFEFFFF            mov edx, dword ptr [ebp+FFFFFEAC]
:0042CF07 83EA10                  sub edx, 00000010
:0042CF0A 8995A4FEFFFF            mov dword ptr [ebp+FFFFFEA4], edx
:0042CF10 C685E4FEFFFF00          mov byte ptr [ebp+FFFFFEE4], 00
:0042CF17 EB2D                    jmp 0042CF46

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CEE4(C)
|
:0042CF19 8B85A0FDFFFF            mov eax, dword ptr [ebp+FFFFFDA0]
:0042CF1F 25FF000000              and eax, 000000FF
:0042CF24 6BC030                  imul eax, 00000030
:0042CF27 83E870                  sub eax, 00000070
:0042CF2A 8985ACFEFFFF            mov dword ptr [ebp+FFFFFEAC], eax
:0042CF30 8B8DACFEFFFF            mov ecx, dword ptr [ebp+FFFFFEAC]
:0042CF36 83C160                  add ecx, 00000060
:0042CF39 898DA4FEFFFF            mov dword ptr [ebp+FFFFFEA4], ecx
:0042CF3F C685E4FEFFFF02          mov byte ptr [ebp+FFFFFEE4], 02

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042CE1D(U), :0042CF17(U)
|
:0042CF46 EB21                    jmp 0042CF69

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042CC64(C), :0042CC89(C)
|
:0042CF48 8B95ECFEFFFF            mov edx, dword ptr [ebp+FFFFFEEC]
:0042CF4E 81EAD8000000            sub edx, 000000D8
:0042CF54 8995B0FEFFFF            mov dword ptr [ebp+FFFFFEB0], edx
:0042CF5A 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:0042CF60 83E830                  sub eax, 00000030
:0042CF63 8985ACFEFFFF            mov dword ptr [ebp+FFFFFEAC], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CF46(U)
|
:0042CF69 B950424B00              mov ecx, 004B4250
:0042CF6E E8DC4A0200              call 00451A4F
:0042CF73 8B8DB0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEB0]
:0042CF79 03C8                    add ecx, eax
:0042CF7B 898DB0FEFFFF            mov dword ptr [ebp+FFFFFEB0], ecx
:0042CF81 B950424B00              mov ecx, 004B4250
:0042CF86 E8D54A0200              call 00451A60
:0042CF8B 8B95ACFEFFFF            mov edx, dword ptr [ebp+FFFFFEAC]
:0042CF91 03D0                    add edx, eax
:0042CF93 8995ACFEFFFF            mov dword ptr [ebp+FFFFFEAC], edx
:0042CF99 B950424B00              mov ecx, 004B4250
:0042CF9E E8AC4A0200              call 00451A4F
:0042CFA3 8B8DBCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEBC]
:0042CFA9 03C8                    add ecx, eax
:0042CFAB 898DBCFEFFFF            mov dword ptr [ebp+FFFFFEBC], ecx
:0042CFB1 B950424B00              mov ecx, 004B4250
:0042CFB6 E8A54A0200              call 00451A60
:0042CFBB 8B95A4FEFFFF            mov edx, dword ptr [ebp+FFFFFEA4]
:0042CFC1 03D0                    add edx, eax
:0042CFC3 8995A4FEFFFF            mov dword ptr [ebp+FFFFFEA4], edx
:0042CFC9 8B4510                  mov eax, dword ptr [ebp+10]
:0042CFCC 83E010                  and eax, 00000010
:0042CFCF F7D8                    neg eax
:0042CFD1 1BC0                    sbb eax, eax
:0042CFD3 F7D8                    neg eax
:0042CFD5 8985CCFEFFFF            mov dword ptr [ebp+FFFFFECC], eax
:0042CFDB C785DCFEFFFF03000000    mov dword ptr [ebp+FFFFFEDC], 00000003
:0042CFE5 E86DF5FFFF              call 0042C557
:0042CFEA E8EC15FFFF              call 0041E5DB
:0042CFEF 6A04                    push 00000004
:0042CFF1 B9382F4900              mov ecx, 00492F38
:0042CFF6 E83B1DFEFF              call 0040ED36
:0042CFFB 6A00                    push 00000000
:0042CFFD B9382F4900              mov ecx, 00492F38
:0042D002 E8B51CFEFF              call 0040ECBC
:0042D007 8B0D201B4B00            mov ecx, dword ptr [004B1B20]
:0042D00D 3B8DD0FEFFFF            cmp ecx, dword ptr [ebp+FFFFFED0]
:0042D013 741D                    je 0042D032
:0042D015 33D2                    xor edx, edx
:0042D017 833D18C8480000          cmp dword ptr [0048C818], 00000000
:0042D01E 0F94C2                  sete dl
:0042D021 891518C84800            mov dword ptr [0048C818], edx
:0042D027 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:0042D02D A3201B4B00              mov dword ptr [004B1B20], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D013(C)
|
:0042D032 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0042D036 750A                    jne 0042D042
:0042D038 C70518C8480001000000    mov dword ptr [0048C818], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D036(C)
|
:0042D042 8D8DA4FDFFFF            lea ecx, dword ptr [ebp+FFFFFDA4]
:0042D048 51                      push ecx
:0042D049 6A10                    push 00000010
:0042D04B 6A10                    push 00000010
:0042D04D 8B95A4FEFFFF            mov edx, dword ptr [ebp+FFFFFEA4]
:0042D053 52                      push edx
:0042D054 8B85BCFEFFFF            mov eax, dword ptr [ebp+FFFFFEBC]
:0042D05A 50                      push eax
:0042D05B E8F1110500              call 0047E251
:0042D060 83C414                  add esp, 00000014
:0042D063 6A00                    push 00000000
:0042D065 6A60                    push 00000060
:0042D067 68B0010000              push 000001B0
:0042D06C 8B8DACFEFFFF            mov ecx, dword ptr [ebp+FFFFFEAC]
:0042D072 51                      push ecx
:0042D073 8B95B0FEFFFF            mov edx, dword ptr [ebp+FFFFFEB0]
:0042D079 52                      push edx
:0042D07A B930694B00              mov ecx, 004B6930
:0042D07F E837650400              call 004735BB
:0042D084 6A00                    push 00000000
:0042D086 6A1F                    push 0000001F
:0042D088 6A04                    push 00000004
:0042D08A E862010500              call 0047D1F1
:0042D08F 83C40C                  add esp, 0000000C
:0042D092 83BDA8FEFFFF00          cmp dword ptr [ebp+FFFFFEA8], 00000000
:0042D099 0F8404010000            je 0042D1A3
:0042D09F 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:0042D0A5 25FF000000              and eax, 000000FF
:0042D0AA 898590FDFFFF            mov dword ptr [ebp+FFFFFD90], eax
:0042D0B0 83BD90FDFFFF03          cmp dword ptr [ebp+FFFFFD90], 00000003
:0042D0B7 0F87C5000000            ja 0042D182
:0042D0BD 8B8D90FDFFFF            mov ecx, dword ptr [ebp+FFFFFD90]
:0042D0C3 FF248DD1D54200          jmp dword ptr [4*ecx+0042D5D1]
:0042D0CA 6800010000              push 00000100
:0042D0CF 8D95F8FEFFFF            lea edx, dword ptr [ebp+FFFFFEF8]
:0042D0D5 52                      push edx
:0042D0D6 6A04                    push 00000004
:0042D0D8 6A00                    push 00000000
:0042D0DA 68C0970100              push 000197C0
:0042D0DF B950EB4A00              mov ecx, 004AEB50
:0042D0E4 E857290500              call 0047FA40
:0042D0E9 50                      push eax
:0042D0EA E80E2C0500              call 0047FCFD
:0042D0EF 83C40C                  add esp, 0000000C
:0042D0F2 6A10                    push 00000010
:0042D0F4 6A10                    push 00000010
:0042D0F6 8D85F8FEFFFF            lea eax, dword ptr [ebp+FFFFFEF8]
:0042D0FC 50                      push eax
:0042D0FD E85A1CFFFF              call 0041ED5C
:0042D102 83C40C                  add esp, 0000000C
:0042D105 EB7B                    jmp 0042D182
:0042D107 6800010000              push 00000100
:0042D10C 8D8DF8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF8]
:0042D112 51                      push ecx
:0042D113 6A04                    push 00000004
:0042D115 6A00                    push 00000000
:0042D117 68C0970100              push 000197C0
:0042D11C B950EB4A00              mov ecx, 004AEB50
:0042D121 E81A290500              call 0047FA40
:0042D126 50                      push eax
:0042D127 E8D12B0500              call 0047FCFD
:0042D12C 83C40C                  add esp, 0000000C
:0042D12F EB51                    jmp 0042D182
:0042D131 6800010000              push 00000100
:0042D136 8D95F8FEFFFF            lea edx, dword ptr [ebp+FFFFFEF8]
:0042D13C 52                      push edx
:0042D13D 6A04                    push 00000004
:0042D13F 6A00                    push 00000000
:0042D141 68C0960100              push 000196C0
:0042D146 B950EB4A00              mov ecx, 004AEB50
:0042D14B E8F0280500              call 0047FA40
:0042D150 50                      push eax
:0042D151 E8A72B0500              call 0047FCFD
:0042D156 83C40C                  add esp, 0000000C
:0042D159 EB27                    jmp 0042D182
:0042D15B 8D85F8FEFFFF            lea eax, dword ptr [ebp+FFFFFEF8]
:0042D161 50                      push eax
:0042D162 6A04                    push 00000004
:0042D164 6A00                    push 00000000
:0042D166 68C0960100              push 000196C0
:0042D16B B950EB4A00              mov ecx, 004AEB50
:0042D170 E8CB280500              call 0047FA40
:0042D175 50                      push eax
:0042D176 6A10                    push 00000010
:0042D178 6A10                    push 00000010
:0042D17A E8D41CFFFF              call 0041EE53
:0042D17F 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042D0B7(C), :0042D105(U), :0042D12F(U), :0042D159(U)
|
:0042D182 8D8DF8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF8]
:0042D188 51                      push ecx
:0042D189 6A10                    push 00000010
:0042D18B 6A10                    push 00000010
:0042D18D 8B95A4FEFFFF            mov edx, dword ptr [ebp+FFFFFEA4]
:0042D193 52                      push edx
:0042D194 8B85BCFEFFFF            mov eax, dword ptr [ebp+FFFFFEBC]
:0042D19A 50                      push eax
:0042D19B E8FB0E0500              call 0047E09B
:0042D1A0 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D099(C)
|
:0042D1A3 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:0042D1A9 E8F9A3FDFF              call 004075A7
:0042D1AE 50                      push eax
:0042D1AF 8B8DACFEFFFF            mov ecx, dword ptr [ebp+FFFFFEAC]
:0042D1B5 83C108                  add ecx, 00000008
:0042D1B8 51                      push ecx
:0042D1B9 8B1518C84800            mov edx, dword ptr [0048C818]
:0042D1BF F7DA                    neg edx
:0042D1C1 1BD2                    sbb edx, edx
:0042D1C3 81E2A0FEFFFF            and edx, FFFFFEA0
:0042D1C9 81C268010000            add edx, 00000168
:0042D1CF 8B85B0FEFFFF            mov eax, dword ptr [ebp+FFFFFEB0]
:0042D1D5 03C2                    add eax, edx
:0042D1D7 50                      push eax
:0042D1D8 E80417FFFF              call 0041E8E1
:0042D1DD 83C40C                  add esp, 0000000C
:0042D1E0 6A3A                    push 0000003A
:0042D1E2 B9382F4900              mov ecx, 00492F38
:0042D1E7 E8981AFEFF              call 0040EC84
:0042D1EC 8B8DACFEFFFF            mov ecx, dword ptr [ebp+FFFFFEAC]
:0042D1F2 83C106                  add ecx, 00000006
:0042D1F5 51                      push ecx
:0042D1F6 8B1518C84800            mov edx, dword ptr [0048C818]
:0042D1FC F7DA                    neg edx
:0042D1FE 1BD2                    sbb edx, edx
:0042D200 83E250                  and edx, 00000050
:0042D203 83C210                  add edx, 00000010
:0042D206 8B85B0FEFFFF            mov eax, dword ptr [ebp+FFFFFEB0]
:0042D20C 03C2                    add eax, edx
:0042D20E 99                      cdq
:0042D20F 83E207                  and edx, 00000007
:0042D212 03C2                    add eax, edx
:0042D214 C1F803                  sar eax, 03
:0042D217 50                      push eax
:0042D218 B9382F4900              mov ecx, 00492F38
:0042D21D E8B519FEFF              call 0040EBD7
:0042D222 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:0042D228 E82AA5FDFF              call 00407757
:0042D22D 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:0042D22E 6828C84800              push 0048C828
:0042D233 68382F4900              push 00492F38
:0042D238 E86328FEFF              call 0040FAA0
:0042D23D 83C40C                  add esp, 0000000C
:0042D240 6A12                    push 00000012
:0042D242 6A00                    push 00000000
:0042D244 6A40                    push 00000040
:0042D246 6820010000              push 00000120
:0042D24B 8B85ACFEFFFF            mov eax, dword ptr [ebp+FFFFFEAC]
:0042D251 83C01A                  add eax, 0000001A
:0042D254 50                      push eax
:0042D255 8B0D18C84800            mov ecx, dword ptr [0048C818]
:0042D25B F7D9                    neg ecx
:0042D25D 1BC9                    sbb ecx, ecx
:0042D25F 83E150                  and ecx, 00000050
:0042D262 83C120                  add ecx, 00000020
:0042D265 8B95B0FEFFFF            mov edx, dword ptr [ebp+FFFFFEB0]
:0042D26B 03D1                    add edx, ecx
:0042D26D 52                      push edx
:0042D26E E83014FFFF              call 0041E6A3
:0042D273 83C418                  add esp, 00000018
:0042D276 6A00                    push 00000000
:0042D278 6A1F                    push 0000001F
:0042D27A 6A04                    push 00000004
:0042D27C E870FF0400              call 0047D1F1
:0042D281 83C40C                  add esp, 0000000C
:0042D284 6A04                    push 00000004
:0042D286 6A00                    push 00000000
:0042D288 A118C84800              mov eax, dword ptr [0048C818]
:0042D28D F7D8                    neg eax
:0042D28F 1BC0                    sbb eax, eax
:0042D291 2400                    and al, 00
:0042D293 05C0990100              add eax, 000199C0
:0042D298 50                      push eax
:0042D299 B950EB4A00              mov ecx, 004AEB50
:0042D29E E89D270500              call 0047FA40
:0042D2A3 50                      push eax
:0042D2A4 6A10                    push 00000010
:0042D2A6 6A10                    push 00000010
:0042D2A8 8B8DACFEFFFF            mov ecx, dword ptr [ebp+FFFFFEAC]
:0042D2AE 83C13C                  add ecx, 0000003C
:0042D2B1 51                      push ecx
:0042D2B2 8B1518C84800            mov edx, dword ptr [0048C818]
:0042D2B8 F7DA                    neg edx
:0042D2BA 1BD2                    sbb edx, edx
:0042D2BC 80E200                  and dl, 00
:0042D2BF 81C250010000            add edx, 00000150
:0042D2C5 8B85B0FEFFFF            mov eax, dword ptr [ebp+FFFFFEB0]
:0042D2CB 03C2                    add eax, edx
:0042D2CD 50                      push eax
:0042D2CE E8C80D0500              call 0047E09B
:0042D2D3 83C414                  add esp, 00000014
:0042D2D6 6A04                    push 00000004
:0042D2D8 6A00                    push 00000000
:0042D2DA 68C09A0100              push 00019AC0
:0042D2DF B950EB4A00              mov ecx, 004AEB50
:0042D2E4 E857270500              call 0047FA40
:0042D2E9 50                      push eax
:0042D2EA 6A40                    push 00000040
:0042D2EC 6A10                    push 00000010
:0042D2EE 8B8DACFEFFFF            mov ecx, dword ptr [ebp+FFFFFEAC]
:0042D2F4 83C11A                  add ecx, 0000001A
:0042D2F7 51                      push ecx
:0042D2F8 8B1518C84800            mov edx, dword ptr [0048C818]
:0042D2FE F7DA                    neg edx
:0042D300 1BD2                    sbb edx, edx
:0042D302 83E250                  and edx, 00000050
:0042D305 83C210                  add edx, 00000010
:0042D308 8B85B0FEFFFF            mov eax, dword ptr [ebp+FFFFFEB0]
:0042D30E 03C2                    add eax, edx
:0042D310 50                      push eax
:0042D311 E8850D0500              call 0047E09B
:0042D316 83C414                  add esp, 00000014
:0042D319 6A04                    push 00000004
:0042D31B 6A00                    push 00000000
:0042D31D 68C09E0100              push 00019EC0
:0042D322 B950EB4A00              mov ecx, 004AEB50
:0042D327 E814270500              call 0047FA40
:0042D32C 50                      push eax
:0042D32D 6A40                    push 00000040
:0042D32F 6A10                    push 00000010
:0042D331 8B8DACFEFFFF            mov ecx, dword ptr [ebp+FFFFFEAC]
:0042D337 83C11A                  add ecx, 0000001A
:0042D33A 51                      push ecx
:0042D33B 8B1518C84800            mov edx, dword ptr [0048C818]
:0042D341 F7DA                    neg edx
:0042D343 1BD2                    sbb edx, edx
:0042D345 83E250                  and edx, 00000050
:0042D348 81C240010000            add edx, 00000140
:0042D34E 8B85B0FEFFFF            mov eax, dword ptr [ebp+FFFFFEB0]
:0042D354 03C2                    add eax, edx
:0042D356 50                      push eax
:0042D357 E83F0D0500              call 0047E09B
:0042D35C 83C414                  add esp, 00000014
:0042D35F E89212FFFF              call 0041E5F6
:0042D364 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042D367 894DFC                  mov dword ptr [ebp-04], ecx
:0042D36A C785F4FEFFFF01000000    mov dword ptr [ebp+FFFFFEF4], 00000001
:0042D374 B970074B00              mov ecx, 004B0770
:0042D379 E8B2EFFEFF              call 0041C330
:0042D37E 8885D8FEFFFF            mov byte ptr [ebp+FFFFFED8], al
:0042D384 8B95D8FEFFFF            mov edx, dword ptr [ebp+FFFFFED8]
:0042D38A 81E2FF000000            and edx, 000000FF
:0042D390 F7DA                    neg edx
:0042D392 1BD2                    sbb edx, edx
:0042D394 F7DA                    neg edx
:0042D396 8995C8FEFFFF            mov dword ptr [ebp+FFFFFEC8], edx
:0042D39C B970074B00              mov ecx, 004B0770
:0042D3A1 E86AD5FFFF              call 0042A910
:0042D3A6 2500080000              and eax, 00000800
:0042D3AB 85C0                    test eax, eax
:0042D3AD 7407                    je 0042D3B6
:0042D3AF C685D8FEFFFF03          mov byte ptr [ebp+FFFFFED8], 03

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042D3AD(C), :0042D547(U)
|
:0042D3B6 8B45FC                  mov eax, dword ptr [ebp-04]
:0042D3B9 33C9                    xor ecx, ecx
:0042D3BB 8A08                    mov cl, byte ptr [eax]
:0042D3BD 85C9                    test ecx, ecx
:0042D3BF 0F8487010000            je 0042D54C
:0042D3C5 C785E8FEFFFF1E000000    mov dword ptr [ebp+FFFFFEE8], 0000001E
:0042D3CF 83BDF4FEFFFF00          cmp dword ptr [ebp+FFFFFEF4], 00000000
:0042D3D6 753F                    jne 0042D417
:0042D3D8 E8FE11FFFF              call 0041E5DB
:0042D3DD 6A12                    push 00000012
:0042D3DF 6A00                    push 00000000
:0042D3E1 6A40                    push 00000040
:0042D3E3 6820010000              push 00000120
:0042D3E8 8B95ACFEFFFF            mov edx, dword ptr [ebp+FFFFFEAC]
:0042D3EE 83C21A                  add edx, 0000001A
:0042D3F1 52                      push edx
:0042D3F2 A118C84800              mov eax, dword ptr [0048C818]
:0042D3F7 F7D8                    neg eax
:0042D3F9 1BC0                    sbb eax, eax
:0042D3FB 83E050                  and eax, 00000050
:0042D3FE 83C020                  add eax, 00000020
:0042D401 8B8DB0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEB0]
:0042D407 03C8                    add ecx, eax
:0042D409 51                      push ecx
:0042D40A E89412FFFF              call 0041E6A3
:0042D40F 83C418                  add esp, 00000018
:0042D412 E8DF11FFFF              call 0041E5F6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D3D6(C)
|
:0042D417 6A00                    push 00000000
:0042D419 6A00                    push 00000000
:0042D41B 6802020000              push 00000202
:0042D420 8B15686A4B00            mov edx, dword ptr [004B6A68]
:0042D426 52                      push edx
:0042D427 FF15F4624800            call dword ptr [004862F4]
:0042D42D 6A1F                    push 0000001F
:0042D42F B9382F4900              mov ecx, 00492F38
:0042D434 E84B18FEFF              call 0040EC84
:0042D439 C685F0FEFFFF00          mov byte ptr [ebp+FFFFFEF0], 00
:0042D440 EB0E                    jmp 0042D450

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D4C7(U)
|
:0042D442 8A85F0FEFFFF            mov al, byte ptr [ebp+FFFFFEF0]
:0042D448 0401                    add al, 01
:0042D44A 8885F0FEFFFF            mov byte ptr [ebp+FFFFFEF0], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D440(U)
|
:0042D450 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042D453 33D2                    xor edx, edx
:0042D455 8A11                    mov dl, byte ptr [ecx]
:0042D457 85D2                    test edx, edx
:0042D459 7471                    je 0042D4CC
:0042D45B 8B85F0FEFFFF            mov eax, dword ptr [ebp+FFFFFEF0]
:0042D461 25FF000000              and eax, 000000FF
:0042D466 3B85DCFEFFFF            cmp eax, dword ptr [ebp+FFFFFEDC]
:0042D46C 7D5E                    jge 0042D4CC
:0042D46E 8B8DC8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC8]
:0042D474 51                      push ecx
:0042D475 8B55FC                  mov edx, dword ptr [ebp-04]
:0042D478 52                      push edx
:0042D479 8B85ACFEFFFF            mov eax, dword ptr [ebp+FFFFFEAC]
:0042D47F 0385E8FEFFFF            add eax, dword ptr [ebp+FFFFFEE8]
:0042D485 50                      push eax
:0042D486 8B0D18C84800            mov ecx, dword ptr [0048C818]
:0042D48C F7D9                    neg ecx
:0042D48E 1BC9                    sbb ecx, ecx
:0042D490 83E150                  and ecx, 00000050
:0042D493 83C120                  add ecx, 00000020
:0042D496 8B85B0FEFFFF            mov eax, dword ptr [ebp+FFFFFEB0]
:0042D49C 03C1                    add eax, ecx
:0042D49E 99                      cdq
:0042D49F 83E207                  and edx, 00000007
:0042D4A2 03C2                    add eax, edx
:0042D4A4 C1F803                  sar eax, 03
:0042D4A7 50                      push eax
:0042D4A8 E803F4FFFF              call 0042C8B0
:0042D4AD 83C410                  add esp, 00000010
:0042D4B0 8B55FC                  mov edx, dword ptr [ebp-04]
:0042D4B3 03D0                    add edx, eax
:0042D4B5 8955FC                  mov dword ptr [ebp-04], edx
:0042D4B8 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:0042D4BE 83C014                  add eax, 00000014
:0042D4C1 8985E8FEFFFF            mov dword ptr [ebp+FFFFFEE8], eax
:0042D4C7 E976FFFFFF              jmp 0042D442

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042D459(C), :0042D46C(C)
|
:0042D4CC B9B07F4900              mov ecx, 00497FB0
:0042D4D1 E8908BFFFF              call 00426066
:0042D4D6 6A00                    push 00000000
:0042D4D8 6A00                    push 00000000
:0042D4DA 6802020000              push 00000202
:0042D4DF 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:0042D4E5 51                      push ecx
:0042D4E6 FF15F4624800            call dword ptr [004862F4]
:0042D4EC 8B95D8FEFFFF            mov edx, dword ptr [ebp+FFFFFED8]
:0042D4F2 81E2FF000000            and edx, 000000FF
:0042D4F8 89958CFDFFFF            mov dword ptr [ebp+FFFFFD8C], edx
:0042D4FE 83BD8CFDFFFF03          cmp dword ptr [ebp+FFFFFD8C], 00000003
:0042D505 7736                    ja 0042D53D
:0042D507 8B858CFDFFFF            mov eax, dword ptr [ebp+FFFFFD8C]
:0042D50D FF2485E1D54200          jmp dword ptr [4*eax+0042D5E1]
:0042D514 6A0F                    push 0000000F
:0042D516 E82BF1FFFF              call 0042C646
:0042D51B 83C404                  add esp, 00000004
:0042D51E EB1D                    jmp 0042D53D
:0042D520 6A0A                    push 0000000A
:0042D522 E81FF1FFFF              call 0042C646
:0042D527 83C404                  add esp, 00000004
:0042D52A EB11                    jmp 0042D53D
:0042D52C 6A14                    push 00000014
:0042D52E E813F1FFFF              call 0042C646
:0042D533 83C404                  add esp, 00000004
:0042D536 EB05                    jmp 0042D53D
:0042D538 E8F6F1FFFF              call 0042C733

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042D505(C), :0042D51E(U), :0042D52A(U), :0042D536(U)
|
:0042D53D C785F4FEFFFF00000000    mov dword ptr [ebp+FFFFFEF4], 00000000
:0042D547 E96AFEFFFF              jmp 0042D3B6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D3BF(C)
|
:0042D54C B9B07F4900              mov ecx, 00497FB0
:0042D551 E8108BFFFF              call 00426066
:0042D556 B930694B00              mov ecx, 004B6930
:0042D55B E8C3600400              call 00473623
:0042D560 83BDA8FEFFFF00          cmp dword ptr [ebp+FFFFFEA8], 00000000
:0042D567 7421                    je 0042D58A
:0042D569 8D8DA4FDFFFF            lea ecx, dword ptr [ebp+FFFFFDA4]
:0042D56F 51                      push ecx
:0042D570 6A10                    push 00000010
:0042D572 6A10                    push 00000010
:0042D574 8B95A4FEFFFF            mov edx, dword ptr [ebp+FFFFFEA4]
:0042D57A 52                      push edx
:0042D57B 8B85BCFEFFFF            mov eax, dword ptr [ebp+FFFFFEBC]
:0042D581 50                      push eax
:0042D582 E8140B0500              call 0047E09B
:0042D587 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D567(C)
|
:0042D58A 8B8DB8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEB8]
:0042D590 81E1FF000000            and ecx, 000000FF
:0042D596 81F9FF000000            cmp ecx, 000000FF
:0042D59C 741D                    je 0042D5BB
:0042D59E 8B95B8FEFFFF            mov edx, dword ptr [ebp+FFFFFEB8]
:0042D5A4 81E2FF000000            and edx, 000000FF
:0042D5AA 83FA01                  cmp edx, 00000001
:0042D5AD 740C                    je 0042D5BB
:0042D5AF C78588FDFFFF00000000    mov dword ptr [ebp+FFFFFD88], 00000000
:0042D5B9 EB0A                    jmp 0042D5C5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042D59C(C), :0042D5AD(C)
|
:0042D5BB C78588FDFFFF01000000    mov dword ptr [ebp+FFFFFD88], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D5B9(U)
|
:0042D5C5 8B8588FDFFFF            mov eax, dword ptr [ebp+FFFFFD88]
:0042D5CB 5E                      pop esi
:0042D5CC 5B                      pop ebx
:0042D5CD 8BE5                    mov esp, ebp
:0042D5CF 5D                      pop ebp
:0042D5D0 C3                      ret



:0042D5D1 CAD04200                DWORD 0042D0CA
:0042D5D5 5BD14200                DWORD 0042D15B
:0042D5D9 07D14200                DWORD 0042D107
:0042D5DD 31D14200                DWORD 0042D131
:0042D5E1 14D54200                DWORD 0042D514
:0042D5E5 20D54200                DWORD 0042D520
:0042D5E9 2CD54200                DWORD 0042D52C
:0042D5ED 38D54200                DWORD 0042D538



* Referenced by a CALL at Addresses:
|:00413897   , :00413AA3   , :00419820   , :00419833   , :004198AD   
|:004198C0   , :0041993A   , :0041994D   , :0045973E   , :00459769   
|:004598C4   , :004598F4   , :0045990D   
|
:0042D5F1 55                      push ebp
:0042D5F2 8BEC                    mov ebp, esp
:0042D5F4 81EC68090000            sub esp, 00000968
:0042D5FA E823E3FDFF              call 0040B922
:0042D5FF 85C0                    test eax, eax
:0042D601 7422                    je 0042D625
:0042D603 817D0C00020000          cmp dword ptr [ebp+0C], 00000200
:0042D60A 7319                    jnb 0042D625
:0042D60C 8B4510                  mov eax, dword ptr [ebp+10]
:0042D60F 50                      push eax
:0042D610 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0042D613 51                      push ecx
:0042D614 8B5508                  mov edx, dword ptr [ebp+08]
:0042D617 52                      push edx
:0042D618 E850F5FFFF              call 0042CB6D
:0042D61D 83C40C                  add esp, 0000000C
:0042D620 E9D9070000              jmp 0042DDFE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042D601(C), :0042D60A(C)
|
:0042D625 C785ACF6FFFF00000000    mov dword ptr [ebp+FFFFF6AC], 00000000
:0042D62F C685BCF6FFFFFF          mov byte ptr [ebp+FFFFF6BC], FF
:0042D636 C785B0F6FFFF00000000    mov dword ptr [ebp+FFFFF6B0], 00000000
:0042D640 B950424B00              mov ecx, 004B4250
:0042D645 E821880200              call 00455E6B
:0042D64A 8945E4                  mov dword ptr [ebp-1C], eax
:0042D64D B950424B00              mov ecx, 004B4250
:0042D652 E8ED870200              call 00455E44
:0042D657 8945FC                  mov dword ptr [ebp-04], eax
:0042D65A 817D0C00020000          cmp dword ptr [ebp+0C], 00000200
:0042D661 7314                    jnb 0042D677
:0042D663 8B450C                  mov eax, dword ptr [ebp+0C]
:0042D666 50                      push eax
:0042D667 E8F4E7FDFF              call 0040BE60
:0042D66C 83C404                  add esp, 00000004
:0042D66F 8985A8F6FFFF            mov dword ptr [ebp+FFFFF6A8], eax
:0042D675 EB0A                    jmp 0042D681

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D661(C)
|
:0042D677 C785A8F6FFFF00000000    mov dword ptr [ebp+FFFFF6A8], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D675(U)
|
:0042D681 8B8DA8F6FFFF            mov ecx, dword ptr [ebp+FFFFF6A8]
:0042D687 898DCCF6FFFF            mov dword ptr [ebp+FFFFF6CC], ecx
:0042D68D 8B15241B4B00            mov edx, dword ptr [004B1B24]
:0042D693 3B95CCF6FFFF            cmp edx, dword ptr [ebp+FFFFF6CC]
:0042D699 741D                    je 0042D6B8
:0042D69B 33C0                    xor eax, eax
:0042D69D 833D1CC8480000          cmp dword ptr [0048C81C], 00000000
:0042D6A4 0F94C0                  sete al
:0042D6A7 A31CC84800              mov dword ptr [0048C81C], eax
:0042D6AC 8B8DCCF6FFFF            mov ecx, dword ptr [ebp+FFFFF6CC]
:0042D6B2 890D241B4B00            mov dword ptr [004B1B24], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D699(C)
|
:0042D6B8 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0042D6BC 750A                    jne 0042D6C8
:0042D6BE C7051CC8480001000000    mov dword ptr [0048C81C], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D6BC(C)
|
:0042D6C8 817D0C00020000          cmp dword ptr [ebp+0C], 00000200
:0042D6CF 1BD2                    sbb edx, edx
:0042D6D1 F7DA                    neg edx
:0042D6D3 8955DC                  mov dword ptr [ebp-24], edx
:0042D6D6 837DDC00                cmp dword ptr [ebp-24], 00000000
:0042D6DA 0F84C1000000            je 0042D7A1
:0042D6E0 833D1CC8480000          cmp dword ptr [0048C81C], 00000000
:0042D6E7 740C                    je 0042D6F5
:0042D6E9 C785A4F6FFFF10000000    mov dword ptr [ebp+FFFFF6A4], 00000010
:0042D6F3 EB0E                    jmp 0042D703

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D6E7(C)
|
:0042D6F5 8B45FC                  mov eax, dword ptr [ebp-04]
:0042D6F8 2DC0010000              sub eax, 000001C0
:0042D6FD 8985A4F6FFFF            mov dword ptr [ebp+FFFFF6A4], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D6F3(U)
|
:0042D703 8B8DA4F6FFFF            mov ecx, dword ptr [ebp+FFFFF6A4]
:0042D709 898DB8F6FFFF            mov dword ptr [ebp+FFFFF6B8], ecx
:0042D70F 8B95CCF6FFFF            mov edx, dword ptr [ebp+FFFFF6CC]
:0042D715 52                      push edx
:0042D716 E8DDB2FFFF              call 004289F8
:0042D71B 83C404                  add esp, 00000004
:0042D71E 85C0                    test eax, eax
:0042D720 742B                    je 0042D74D
:0042D722 8B85CCF6FFFF            mov eax, dword ptr [ebp+FFFFF6CC]
:0042D728 50                      push eax
:0042D729 E8CAB2FFFF              call 004289F8
:0042D72E 83C404                  add esp, 00000004
:0042D731 8B4804                  mov ecx, dword ptr [eax+04]
:0042D734 894DEC                  mov dword ptr [ebp-14], ecx
:0042D737 8B95CCF6FFFF            mov edx, dword ptr [ebp+FFFFF6CC]
:0042D73D 52                      push edx
:0042D73E E8B5B2FFFF              call 004289F8
:0042D743 83C404                  add esp, 00000004
:0042D746 8B00                    mov eax, dword ptr [eax]
:0042D748 8945F8                  mov dword ptr [ebp-08], eax
:0042D74B EB0E                    jmp 0042D75B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D720(C)
|
:0042D74D C745EC00000000          mov [ebp-14], 00000000
:0042D754 C745F800000000          mov [ebp-08], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D74B(U)
|
:0042D75B 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0042D75E 83E928                  sub ecx, 00000028
:0042D761 D1E9                    shr ecx, 1
:0042D763 394DEC                  cmp dword ptr [ebp-14], ecx
:0042D766 7E0C                    jle 0042D774
:0042D768 C785B4F6FFFF38000000    mov dword ptr [ebp+FFFFF6B4], 00000038
:0042D772 EB2B                    jmp 0042D79F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D766(C)
|
:0042D774 B9386F4900              mov ecx, 00496F38
:0042D779 E826C9FEFF              call 0041A0A4
:0042D77E 85C0                    test eax, eax
:0042D780 7511                    jne 0042D793
:0042D782 8B55E4                  mov edx, dword ptr [ebp-1C]
:0042D785 81EAA2000000            sub edx, 000000A2
:0042D78B 8995B4F6FFFF            mov dword ptr [ebp+FFFFF6B4], edx
:0042D791 EB0C                    jmp 0042D79F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D780(C)
|
:0042D793 8B45E4                  mov eax, dword ptr [ebp-1C]
:0042D796 83E870                  sub eax, 00000070
:0042D799 8985B4F6FFFF            mov dword ptr [ebp+FFFFF6B4], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042D772(U), :0042D791(U)
|
:0042D79F EB22                    jmp 0042D7C3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D6DA(C)
|
:0042D7A1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042D7A4 D1E9                    shr ecx, 1
:0042D7A6 81E9A0000000            sub ecx, 000000A0
:0042D7AC 898DB8F6FFFF            mov dword ptr [ebp+FFFFF6B8], ecx
:0042D7B2 8B55E4                  mov edx, dword ptr [ebp-1C]
:0042D7B5 83EA5A                  sub edx, 0000005A
:0042D7B8 D1EA                    shr edx, 1
:0042D7BA 83EA10                  sub edx, 00000010
:0042D7BD 8995B4F6FFFF            mov dword ptr [ebp+FFFFF6B4], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D79F(U)
|
:0042D7C3 8B4510                  mov eax, dword ptr [ebp+10]
:0042D7C6 25C0000000              and eax, 000000C0
:0042D7CB C1E806                  shr eax, 06
:0042D7CE 8945F4                  mov dword ptr [ebp-0C], eax
:0042D7D1 8B4D10                  mov ecx, dword ptr [ebp+10]
:0042D7D4 83E110                  and ecx, 00000010
:0042D7D7 F7D9                    neg ecx
:0042D7D9 1BC9                    sbb ecx, ecx
:0042D7DB F7D9                    neg ecx
:0042D7DD 898DC8F6FFFF            mov dword ptr [ebp+FFFFF6C8], ecx
:0042D7E3 8B55DC                  mov edx, dword ptr [ebp-24]
:0042D7E6 F7DA                    neg edx
:0042D7E8 1BD2                    sbb edx, edx
:0042D7EA 83C204                  add edx, 00000004
:0042D7ED 8995D4F6FFFF            mov dword ptr [ebp+FFFFF6D4], edx
:0042D7F3 E85FEDFFFF              call 0042C557
:0042D7F8 E8DE0DFFFF              call 0041E5DB
:0042D7FD 6A04                    push 00000004
:0042D7FF B9382F4900              mov ecx, 00492F38
:0042D804 E82D15FEFF              call 0040ED36
:0042D809 6A00                    push 00000000
:0042D80B B9382F4900              mov ecx, 00492F38
:0042D810 E8A714FEFF              call 0040ECBC
:0042D815 837DDC00                cmp dword ptr [ebp-24], 00000000
:0042D819 7529                    jne 0042D844
:0042D81B 6A00                    push 00000000
:0042D81D 6890000000              push 00000090
:0042D822 6850010000              push 00000150
:0042D827 8B85B4F6FFFF            mov eax, dword ptr [ebp+FFFFF6B4]
:0042D82D 50                      push eax
:0042D82E 8B8DB8F6FFFF            mov ecx, dword ptr [ebp+FFFFF6B8]
:0042D834 51                      push ecx
:0042D835 B930694B00              mov ecx, 004B6930
:0042D83A E87C5D0400              call 004735BB
:0042D83F E9BD020000              jmp 0042DB01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D819(C)
|
:0042D844 8B95CCF6FFFF            mov edx, dword ptr [ebp+FFFFF6CC]
:0042D84A 52                      push edx
:0042D84B E819B2FFFF              call 00428A69
:0042D850 83C404                  add esp, 00000004
:0042D853 8985C0F6FFFF            mov dword ptr [ebp+FFFFF6C0], eax
:0042D859 81BDC0F6FFFFFF000000    cmp dword ptr [ebp+FFFFF6C0], 000000FF
:0042D863 0F84AB000000            je 0042D914
:0042D869 6A00                    push 00000000
:0042D86B 6A1F                    push 0000001F
:0042D86D 6A04                    push 00000004
:0042D86F E87DF90400              call 0047D1F1
:0042D874 83C40C                  add esp, 0000000C
:0042D877 83BDC0F6FFFF03          cmp dword ptr [ebp+FFFFF6C0], 00000003
:0042D87E 750E                    jne 0042D88E
:0042D880 8B45F8                  mov eax, dword ptr [ebp-08]
:0042D883 83E810                  sub eax, 00000010
:0042D886 8985A0F6FFFF            mov dword ptr [ebp+FFFFF6A0], eax
:0042D88C EB0C                    jmp 0042D89A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D87E(C)
|
:0042D88E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042D891 83C128                  add ecx, 00000028
:0042D894 898DA0F6FFFF            mov dword ptr [ebp+FFFFF6A0], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D88C(U)
|
:0042D89A 8B95A0F6FFFF            mov edx, dword ptr [ebp+FFFFF6A0]
:0042D8A0 8995B0F6FFFF            mov dword ptr [ebp+FFFFF6B0], edx
:0042D8A6 8D85DCF6FFFF            lea eax, dword ptr [ebp+FFFFF6DC]
:0042D8AC 50                      push eax
:0042D8AD 6A18                    push 00000018
:0042D8AF 6A18                    push 00000018
:0042D8B1 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0042D8B4 83E910                  sub ecx, 00000010
:0042D8B7 51                      push ecx
:0042D8B8 8B95B0F6FFFF            mov edx, dword ptr [ebp+FFFFF6B0]
:0042D8BE 52                      push edx
:0042D8BF E88D090500              call 0047E251
:0042D8C4 83C414                  add esp, 00000014
:0042D8C7 6A04                    push 00000004
:0042D8C9 6A00                    push 00000000
:0042D8CB 6840080000              push 00000840
:0042D8D0 B950EB4A00              mov ecx, 004AEB50
:0042D8D5 E866210500              call 0047FA40
:0042D8DA 8B8DC0F6FFFF            mov ecx, dword ptr [ebp+FFFFF6C0]
:0042D8E0 83E901                  sub ecx, 00000001
:0042D8E3 F7D9                    neg ecx
:0042D8E5 1BC9                    sbb ecx, ecx
:0042D8E7 81E140020000            and ecx, 00000240
:0042D8ED 03C1                    add eax, ecx
:0042D8EF 50                      push eax
:0042D8F0 6A18                    push 00000018
:0042D8F2 6A18                    push 00000018
:0042D8F4 8B55EC                  mov edx, dword ptr [ebp-14]
:0042D8F7 83EA10                  sub edx, 00000010
:0042D8FA 52                      push edx
:0042D8FB 8B85B0F6FFFF            mov eax, dword ptr [ebp+FFFFF6B0]
:0042D901 50                      push eax
:0042D902 E894070500              call 0047E09B
:0042D907 83C414                  add esp, 00000014
:0042D90A C785ACF6FFFF01000000    mov dword ptr [ebp+FFFFF6AC], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D863(C)
|
:0042D914 6A00                    push 00000000
:0042D916 6A60                    push 00000060
:0042D918 68B0010000              push 000001B0
:0042D91D 8B8DB4F6FFFF            mov ecx, dword ptr [ebp+FFFFF6B4]
:0042D923 51                      push ecx
:0042D924 8B95B8F6FFFF            mov edx, dword ptr [ebp+FFFFF6B8]
:0042D92A 52                      push edx
:0042D92B B930694B00              mov ecx, 004B6930
:0042D930 E8865C0400              call 004735BB
:0042D935 6A00                    push 00000000
:0042D937 6A1F                    push 0000001F
:0042D939 6A04                    push 00000004
:0042D93B E8B1F80400              call 0047D1F1
:0042D940 83C40C                  add esp, 0000000C
:0042D943 8B8DCCF6FFFF            mov ecx, dword ptr [ebp+FFFFF6CC]
:0042D949 E8599CFDFF              call 004075A7
:0042D94E 50                      push eax
:0042D94F 8B85B4F6FFFF            mov eax, dword ptr [ebp+FFFFF6B4]
:0042D955 83C008                  add eax, 00000008
:0042D958 50                      push eax
:0042D959 8B0D1CC84800            mov ecx, dword ptr [0048C81C]
:0042D95F F7D9                    neg ecx
:0042D961 1BC9                    sbb ecx, ecx
:0042D963 81E1A0FEFFFF            and ecx, FFFFFEA0
:0042D969 81C168010000            add ecx, 00000168
:0042D96F 8B95B8F6FFFF            mov edx, dword ptr [ebp+FFFFF6B8]
:0042D975 03D1                    add edx, ecx
:0042D977 52                      push edx
:0042D978 E8640FFFFF              call 0041E8E1
:0042D97D 83C40C                  add esp, 0000000C
:0042D980 6A3A                    push 0000003A
:0042D982 B9382F4900              mov ecx, 00492F38
:0042D987 E8F812FEFF              call 0040EC84
:0042D98C 8B85B4F6FFFF            mov eax, dword ptr [ebp+FFFFF6B4]
:0042D992 83C006                  add eax, 00000006
:0042D995 50                      push eax
:0042D996 8B0D1CC84800            mov ecx, dword ptr [0048C81C]
:0042D99C F7D9                    neg ecx
:0042D99E 1BC9                    sbb ecx, ecx
:0042D9A0 83E150                  and ecx, 00000050
:0042D9A3 83C110                  add ecx, 00000010
:0042D9A6 8B85B8F6FFFF            mov eax, dword ptr [ebp+FFFFF6B8]
:0042D9AC 03C1                    add eax, ecx
:0042D9AE 99                      cdq
:0042D9AF 83E207                  and edx, 00000007
:0042D9B2 03C2                    add eax, edx
:0042D9B4 C1F803                  sar eax, 03
:0042D9B7 50                      push eax
:0042D9B8 B9382F4900              mov ecx, 00492F38
:0042D9BD E81512FEFF              call 0040EBD7
:0042D9C2 8B8DCCF6FFFF            mov ecx, dword ptr [ebp+FFFFF6CC]
:0042D9C8 E88A9DFDFF              call 00407757
:0042D9CD 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:0042D9CE 682CC84800              push 0048C82C
:0042D9D3 68382F4900              push 00492F38
:0042D9D8 E8C320FEFF              call 0040FAA0
:0042D9DD 83C40C                  add esp, 0000000C
:0042D9E0 6A12                    push 00000012
:0042D9E2 6A00                    push 00000000
:0042D9E4 6A40                    push 00000040
:0042D9E6 6820010000              push 00000120
:0042D9EB 8B95B4F6FFFF            mov edx, dword ptr [ebp+FFFFF6B4]
:0042D9F1 83C21A                  add edx, 0000001A
:0042D9F4 52                      push edx
:0042D9F5 A11CC84800              mov eax, dword ptr [0048C81C]
:0042D9FA F7D8                    neg eax
:0042D9FC 1BC0                    sbb eax, eax
:0042D9FE 83E050                  and eax, 00000050
:0042DA01 83C020                  add eax, 00000020
:0042DA04 8B8DB8F6FFFF            mov ecx, dword ptr [ebp+FFFFF6B8]
:0042DA0A 03C8                    add ecx, eax
:0042DA0C 51                      push ecx
:0042DA0D E8910CFFFF              call 0041E6A3
:0042DA12 83C418                  add esp, 00000018
:0042DA15 6A00                    push 00000000
:0042DA17 6A1F                    push 0000001F
:0042DA19 6A04                    push 00000004
:0042DA1B E8D1F70400              call 0047D1F1
:0042DA20 83C40C                  add esp, 0000000C
:0042DA23 6A04                    push 00000004
:0042DA25 6A00                    push 00000000
:0042DA27 8B151CC84800            mov edx, dword ptr [0048C81C]
:0042DA2D F7DA                    neg edx
:0042DA2F 1BD2                    sbb edx, edx
:0042DA31 80E200                  and dl, 00
:0042DA34 81C2C0990100            add edx, 000199C0
:0042DA3A 52                      push edx
:0042DA3B B950EB4A00              mov ecx, 004AEB50
:0042DA40 E8FB1F0500              call 0047FA40
:0042DA45 50                      push eax
:0042DA46 6A10                    push 00000010
:0042DA48 6A10                    push 00000010
:0042DA4A 8B85B4F6FFFF            mov eax, dword ptr [ebp+FFFFF6B4]
:0042DA50 83C03C                  add eax, 0000003C
:0042DA53 50                      push eax
:0042DA54 8B0D1CC84800            mov ecx, dword ptr [0048C81C]
:0042DA5A F7D9                    neg ecx
:0042DA5C 1BC9                    sbb ecx, ecx
:0042DA5E 80E100                  and cl, 00
:0042DA61 81C150010000            add ecx, 00000150
:0042DA67 8B95B8F6FFFF            mov edx, dword ptr [ebp+FFFFF6B8]
:0042DA6D 03D1                    add edx, ecx
:0042DA6F 52                      push edx
:0042DA70 E826060500              call 0047E09B
:0042DA75 83C414                  add esp, 00000014
:0042DA78 6A04                    push 00000004
:0042DA7A 6A00                    push 00000000
:0042DA7C 68C09A0100              push 00019AC0
:0042DA81 B950EB4A00              mov ecx, 004AEB50
:0042DA86 E8B51F0500              call 0047FA40
:0042DA8B 50                      push eax
:0042DA8C 6A40                    push 00000040
:0042DA8E 6A10                    push 00000010
:0042DA90 8B85B4F6FFFF            mov eax, dword ptr [ebp+FFFFF6B4]
:0042DA96 83C01A                  add eax, 0000001A
:0042DA99 50                      push eax
:0042DA9A 8B0D1CC84800            mov ecx, dword ptr [0048C81C]
:0042DAA0 F7D9                    neg ecx
:0042DAA2 1BC9                    sbb ecx, ecx
:0042DAA4 83E150                  and ecx, 00000050
:0042DAA7 83C110                  add ecx, 00000010
:0042DAAA 8B95B8F6FFFF            mov edx, dword ptr [ebp+FFFFF6B8]
:0042DAB0 03D1                    add edx, ecx
:0042DAB2 52                      push edx
:0042DAB3 E8E3050500              call 0047E09B
:0042DAB8 83C414                  add esp, 00000014
:0042DABB 6A04                    push 00000004
:0042DABD 6A00                    push 00000000
:0042DABF 68C09E0100              push 00019EC0
:0042DAC4 B950EB4A00              mov ecx, 004AEB50
:0042DAC9 E8721F0500              call 0047FA40
:0042DACE 50                      push eax
:0042DACF 6A40                    push 00000040
:0042DAD1 6A10                    push 00000010
:0042DAD3 8B85B4F6FFFF            mov eax, dword ptr [ebp+FFFFF6B4]
:0042DAD9 83C01A                  add eax, 0000001A
:0042DADC 50                      push eax
:0042DADD 8B0D1CC84800            mov ecx, dword ptr [0048C81C]
:0042DAE3 F7D9                    neg ecx
:0042DAE5 1BC9                    sbb ecx, ecx
:0042DAE7 83E150                  and ecx, 00000050
:0042DAEA 81C140010000            add ecx, 00000140
:0042DAF0 8B95B8F6FFFF            mov edx, dword ptr [ebp+FFFFF6B8]
:0042DAF6 03D1                    add edx, ecx
:0042DAF8 52                      push edx
:0042DAF9 E89D050500              call 0047E09B
:0042DAFE 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D83F(U)
|
:0042DB01 E8F00AFFFF              call 0041E5F6
:0042DB06 8B4508                  mov eax, dword ptr [ebp+08]
:0042DB09 8945F0                  mov dword ptr [ebp-10], eax
:0042DB0C C745E801000000          mov [ebp-18], 00000001
:0042DB13 B970074B00              mov ecx, 004B0770
:0042DB18 E813E8FEFF              call 0041C330
:0042DB1D 8885D0F6FFFF            mov byte ptr [ebp+FFFFF6D0], al
:0042DB23 8B8DD0F6FFFF            mov ecx, dword ptr [ebp+FFFFF6D0]
:0042DB29 81E1FF000000            and ecx, 000000FF
:0042DB2F F7D9                    neg ecx
:0042DB31 1BC9                    sbb ecx, ecx
:0042DB33 F7D9                    neg ecx
:0042DB35 898DC4F6FFFF            mov dword ptr [ebp+FFFFF6C4], ecx
:0042DB3B B970074B00              mov ecx, 004B0770
:0042DB40 E8CBCDFFFF              call 0042A910
:0042DB45 2500080000              and eax, 00000800
:0042DB4A 85C0                    test eax, eax
:0042DB4C 7407                    je 0042DB55
:0042DB4E C685D0F6FFFF03          mov byte ptr [ebp+FFFFF6D0], 03

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042DB4C(C), :0042DD7C(U)
|
:0042DB55 8B55F0                  mov edx, dword ptr [ebp-10]
:0042DB58 33C0                    xor eax, eax
:0042DB5A 8A02                    mov al, byte ptr [edx]
:0042DB5C 85C0                    test eax, eax
:0042DB5E 0F841D020000            je 0042DD81
:0042DB64 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0042DB67 F7D9                    neg ecx
:0042DB69 1BC9                    sbb ecx, ecx
:0042DB6B 83E10A                  and ecx, 0000000A
:0042DB6E 83C114                  add ecx, 00000014
:0042DB71 898DD8F6FFFF            mov dword ptr [ebp+FFFFF6D8], ecx
:0042DB77 837DE800                cmp dword ptr [ebp-18], 00000000
:0042DB7B 756D                    jne 0042DBEA
:0042DB7D E8590AFFFF              call 0041E5DB
:0042DB82 837DDC00                cmp dword ptr [ebp-24], 00000000
:0042DB86 7437                    je 0042DBBF
:0042DB88 6A12                    push 00000012
:0042DB8A 6A00                    push 00000000
:0042DB8C 6A40                    push 00000040
:0042DB8E 6820010000              push 00000120
:0042DB93 8B95B4F6FFFF            mov edx, dword ptr [ebp+FFFFF6B4]
:0042DB99 83C21A                  add edx, 0000001A
:0042DB9C 52                      push edx
:0042DB9D A11CC84800              mov eax, dword ptr [0048C81C]
:0042DBA2 F7D8                    neg eax
:0042DBA4 1BC0                    sbb eax, eax
:0042DBA6 83E050                  and eax, 00000050
:0042DBA9 83C020                  add eax, 00000020
:0042DBAC 8B8DB8F6FFFF            mov ecx, dword ptr [ebp+FFFFF6B8]
:0042DBB2 03C8                    add ecx, eax
:0042DBB4 51                      push ecx
:0042DBB5 E8E90AFFFF              call 0041E6A3
:0042DBBA 83C418                  add esp, 00000018
:0042DBBD EB26                    jmp 0042DBE5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DB86(C)
|
:0042DBBF 6A00                    push 00000000
:0042DBC1 6A00                    push 00000000
:0042DBC3 6890000000              push 00000090
:0042DBC8 6850010000              push 00000150
:0042DBCD 8B95B4F6FFFF            mov edx, dword ptr [ebp+FFFFF6B4]
:0042DBD3 52                      push edx
:0042DBD4 8B85B8F6FFFF            mov eax, dword ptr [ebp+FFFFF6B8]
:0042DBDA 50                      push eax
:0042DBDB B930694B00              mov ecx, 004B6930
:0042DBE0 E81D560400              call 00473202

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DBBD(U)
|
:0042DBE5 E80C0AFFFF              call 0041E5F6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DB7B(C)
|
:0042DBEA 6A00                    push 00000000
:0042DBEC 6A00                    push 00000000
:0042DBEE 6802020000              push 00000202
:0042DBF3 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:0042DBF9 51                      push ecx
:0042DBFA FF15F4624800            call dword ptr [004862F4]
:0042DC00 837DDC00                cmp dword ptr [ebp-24], 00000000
:0042DC04 740E                    je 0042DC14
:0042DC06 6A1F                    push 0000001F
:0042DC08 B9382F4900              mov ecx, 00492F38
:0042DC0D E87210FEFF              call 0040EC84
:0042DC12 EB0F                    jmp 0042DC23

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DC04(C)
|
:0042DC14 68AC000000              push 000000AC
:0042DC19 B9382F4900              mov ecx, 00492F38
:0042DC1E E86110FEFF              call 0040EC84

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DC12(U)
|
:0042DC23 C645E000                mov [ebp-20], 00
:0042DC27 EB09                    jmp 0042DC32

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DD00(U)
|
:0042DC29 8A55E0                  mov dl, byte ptr [ebp-20]
:0042DC2C 80C201                  add dl, 01
:0042DC2F 8855E0                  mov byte ptr [ebp-20], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DC27(U)
|
:0042DC32 8B45F0                  mov eax, dword ptr [ebp-10]
:0042DC35 33C9                    xor ecx, ecx
:0042DC37 8A08                    mov cl, byte ptr [eax]
:0042DC39 85C9                    test ecx, ecx
:0042DC3B 0F84C4000000            je 0042DD05
:0042DC41 8B55E0                  mov edx, dword ptr [ebp-20]
:0042DC44 81E2FF000000            and edx, 000000FF
:0042DC4A 3B95D4F6FFFF            cmp edx, dword ptr [ebp+FFFFF6D4]
:0042DC50 0F8DAF000000            jnl 0042DD05
:0042DC56 837DDC00                cmp dword ptr [ebp-24], 00000000
:0042DC5A 745A                    je 0042DCB6
:0042DC5C 8B85C4F6FFFF            mov eax, dword ptr [ebp+FFFFF6C4]
:0042DC62 50                      push eax
:0042DC63 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0042DC66 51                      push ecx
:0042DC67 8B95B4F6FFFF            mov edx, dword ptr [ebp+FFFFF6B4]
:0042DC6D 0395D8F6FFFF            add edx, dword ptr [ebp+FFFFF6D8]
:0042DC73 52                      push edx
:0042DC74 A11CC84800              mov eax, dword ptr [0048C81C]
:0042DC79 F7D8                    neg eax
:0042DC7B 1BC0                    sbb eax, eax
:0042DC7D 83E050                  and eax, 00000050
:0042DC80 83C020                  add eax, 00000020
:0042DC83 8B8DB8F6FFFF            mov ecx, dword ptr [ebp+FFFFF6B8]
:0042DC89 03C1                    add eax, ecx
:0042DC8B 99                      cdq
:0042DC8C 83E207                  and edx, 00000007
:0042DC8F 03C2                    add eax, edx
:0042DC91 C1F803                  sar eax, 03
:0042DC94 50                      push eax
:0042DC95 E816ECFFFF              call 0042C8B0
:0042DC9A 83C410                  add esp, 00000010
:0042DC9D 8B55F0                  mov edx, dword ptr [ebp-10]
:0042DCA0 03D0                    add edx, eax
:0042DCA2 8955F0                  mov dword ptr [ebp-10], edx
:0042DCA5 8B85D8F6FFFF            mov eax, dword ptr [ebp+FFFFF6D8]
:0042DCAB 83C014                  add eax, 00000014
:0042DCAE 8985D8F6FFFF            mov dword ptr [ebp+FFFFF6D8], eax
:0042DCB4 EB4A                    jmp 0042DD00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DC5A(C)
|
:0042DCB6 8B8DC4F6FFFF            mov ecx, dword ptr [ebp+FFFFF6C4]
:0042DCBC 51                      push ecx
:0042DCBD 8B55F0                  mov edx, dword ptr [ebp-10]
:0042DCC0 52                      push edx
:0042DCC1 8B85B4F6FFFF            mov eax, dword ptr [ebp+FFFFF6B4]
:0042DCC7 0385D8F6FFFF            add eax, dword ptr [ebp+FFFFF6D8]
:0042DCCD 50                      push eax
:0042DCCE 8B85B8F6FFFF            mov eax, dword ptr [ebp+FFFFF6B8]
:0042DCD4 83C018                  add eax, 00000018
:0042DCD7 99                      cdq
:0042DCD8 83E207                  and edx, 00000007
:0042DCDB 03C2                    add eax, edx
:0042DCDD C1F803                  sar eax, 03
:0042DCE0 50                      push eax
:0042DCE1 E8CAEBFFFF              call 0042C8B0
:0042DCE6 83C410                  add esp, 00000010
:0042DCE9 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0042DCEC 03C8                    add ecx, eax
:0042DCEE 894DF0                  mov dword ptr [ebp-10], ecx
:0042DCF1 8B95D8F6FFFF            mov edx, dword ptr [ebp+FFFFF6D8]
:0042DCF7 83C21E                  add edx, 0000001E
:0042DCFA 8995D8F6FFFF            mov dword ptr [ebp+FFFFF6D8], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DCB4(U)
|
:0042DD00 E924FFFFFF              jmp 0042DC29

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042DC3B(C), :0042DC50(C)
|
:0042DD05 B9B07F4900              mov ecx, 00497FB0
:0042DD0A E85783FFFF              call 00426066
:0042DD0F 6A00                    push 00000000
:0042DD11 6A00                    push 00000000
:0042DD13 6802020000              push 00000202
:0042DD18 A1686A4B00              mov eax, dword ptr [004B6A68]
:0042DD1D 50                      push eax
:0042DD1E FF15F4624800            call dword ptr [004862F4]
:0042DD24 8B8DD0F6FFFF            mov ecx, dword ptr [ebp+FFFFF6D0]
:0042DD2A 81E1FF000000            and ecx, 000000FF
:0042DD30 898D9CF6FFFF            mov dword ptr [ebp+FFFFF69C], ecx
:0042DD36 83BD9CF6FFFF03          cmp dword ptr [ebp+FFFFF69C], 00000003
:0042DD3D 7736                    ja 0042DD75
:0042DD3F 8B959CF6FFFF            mov edx, dword ptr [ebp+FFFFF69C]
:0042DD45 FF249502DE4200          jmp dword ptr [4*edx+0042DE02]
:0042DD4C 6A0F                    push 0000000F
:0042DD4E E8F3E8FFFF              call 0042C646
:0042DD53 83C404                  add esp, 00000004
:0042DD56 EB1D                    jmp 0042DD75
:0042DD58 6A0A                    push 0000000A
:0042DD5A E8E7E8FFFF              call 0042C646
:0042DD5F 83C404                  add esp, 00000004
:0042DD62 EB11                    jmp 0042DD75
:0042DD64 6A14                    push 00000014
:0042DD66 E8DBE8FFFF              call 0042C646
:0042DD6B 83C404                  add esp, 00000004
:0042DD6E EB05                    jmp 0042DD75
:0042DD70 E8BEE9FFFF              call 0042C733

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042DD3D(C), :0042DD56(U), :0042DD62(U), :0042DD6E(U)
|
:0042DD75 C745E800000000          mov [ebp-18], 00000000
:0042DD7C E9D4FDFFFF              jmp 0042DB55

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DB5E(C)
|
:0042DD81 B9B07F4900              mov ecx, 00497FB0
:0042DD86 E8DB82FFFF              call 00426066
:0042DD8B B930694B00              mov ecx, 004B6930
:0042DD90 E88E580400              call 00473623
:0042DD95 83BDACF6FFFF00          cmp dword ptr [ebp+FFFFF6AC], 00000000
:0042DD9C 7421                    je 0042DDBF
:0042DD9E 8D85DCF6FFFF            lea eax, dword ptr [ebp+FFFFF6DC]
:0042DDA4 50                      push eax
:0042DDA5 6A18                    push 00000018
:0042DDA7 6A18                    push 00000018
:0042DDA9 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0042DDAC 83E910                  sub ecx, 00000010
:0042DDAF 51                      push ecx
:0042DDB0 8B95B0F6FFFF            mov edx, dword ptr [ebp+FFFFF6B0]
:0042DDB6 52                      push edx
:0042DDB7 E8DF020500              call 0047E09B
:0042DDBC 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DD9C(C)
|
:0042DDBF 8B85BCF6FFFF            mov eax, dword ptr [ebp+FFFFF6BC]
:0042DDC5 25FF000000              and eax, 000000FF
:0042DDCA 3DFF000000              cmp eax, 000000FF
:0042DDCF 741D                    je 0042DDEE
:0042DDD1 8B8DBCF6FFFF            mov ecx, dword ptr [ebp+FFFFF6BC]
:0042DDD7 81E1FF000000            and ecx, 000000FF
:0042DDDD 83F901                  cmp ecx, 00000001
:0042DDE0 740C                    je 0042DDEE
:0042DDE2 C78598F6FFFF00000000    mov dword ptr [ebp+FFFFF698], 00000000
:0042DDEC EB0A                    jmp 0042DDF8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042DDCF(C), :0042DDE0(C)
|
:0042DDEE C78598F6FFFF01000000    mov dword ptr [ebp+FFFFF698], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DDEC(U)
|
:0042DDF8 8B8598F6FFFF            mov eax, dword ptr [ebp+FFFFF698]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D620(U)
|
:0042DDFE 8BE5                    mov esp, ebp
:0042DE00 5D                      pop ebp
:0042DE01 C3                      ret



:0042DE02 4CDD4200                DWORD 0042DD4C
:0042DE06 58DD4200                DWORD 0042DD58
:0042DE0A 64DD4200                DWORD 0042DD64
:0042DE0E 70DD4200                DWORD 0042DD70



* Referenced by a CALL at Addresses:
|:00411F4D   , :004333F0   , :004334C0   , :00434882   , :00434A27   
|:00434BCC   , :00434E19   
|
:0042DE12 55                      push ebp
:0042DE13 8BEC                    mov ebp, esp
:0042DE15 83EC54                  sub esp, 00000054
:0042DE18 C645B4FF                mov [ebp-4C], FF
:0042DE1C B950424B00              mov ecx, 004B4250
:0042DE21 E845800200              call 00455E6B
:0042DE26 8945D4                  mov dword ptr [ebp-2C], eax
:0042DE29 B950424B00              mov ecx, 004B4250
:0042DE2E E811800200              call 00455E44
:0042DE33 8945F4                  mov dword ptr [ebp-0C], eax
:0042DE36 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042DE39 D1E8                    shr eax, 1
:0042DE3B 2DD8000000              sub eax, 000000D8
:0042DE40 8945B0                  mov dword ptr [ebp-50], eax
:0042DE43 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0042DE46 D1E9                    shr ecx, 1
:0042DE48 83E930                  sub ecx, 00000030
:0042DE4B 894DAC                  mov dword ptr [ebp-54], ecx
:0042DE4E C745C803000000          mov [ebp-38], 00000003
:0042DE55 E8FDE6FFFF              call 0042C557
:0042DE5A 6A04                    push 00000004
:0042DE5C B9382F4900              mov ecx, 00492F38
:0042DE61 E8D00EFEFF              call 0040ED36
:0042DE66 6A00                    push 00000000
:0042DE68 B9382F4900              mov ecx, 00492F38
:0042DE6D E84A0EFEFF              call 0040ECBC
:0042DE72 E86407FFFF              call 0041E5DB
:0042DE77 6A01                    push 00000001
:0042DE79 6A60                    push 00000060
:0042DE7B 68B0010000              push 000001B0
:0042DE80 8B55AC                  mov edx, dword ptr [ebp-54]
:0042DE83 52                      push edx
:0042DE84 8B45B0                  mov eax, dword ptr [ebp-50]
:0042DE87 50                      push eax
:0042DE88 B930694B00              mov ecx, 004B6930
:0042DE8D E829570400              call 004735BB
:0042DE92 E85F07FFFF              call 0041E5F6
:0042DE97 6A00                    push 00000000
:0042DE99 6A1F                    push 0000001F
:0042DE9B 6A04                    push 00000004
:0042DE9D E84FF30400              call 0047D1F1
:0042DEA2 83C40C                  add esp, 0000000C
:0042DEA5 C745E000B10000          mov [ebp-20], 0000B100
:0042DEAC 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0042DEAF 81C100140000            add ecx, 00001400
:0042DEB5 894DC0                  mov dword ptr [ebp-40], ecx
:0042DEB8 8B55C0                  mov edx, dword ptr [ebp-40]
:0042DEBB 81C200140000            add edx, 00001400
:0042DEC1 8955BC                  mov dword ptr [ebp-44], edx
:0042DEC4 6A04                    push 00000004
:0042DEC6 6A00                    push 00000000
:0042DEC8 8B45E0                  mov eax, dword ptr [ebp-20]
:0042DECB 50                      push eax
:0042DECC B9C8E44A00              mov ecx, 004AE4C8
:0042DED1 E86A1B0500              call 0047FA40
:0042DED6 50                      push eax
:0042DED7 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0042DEDA 6BC948                  imul ecx, 00000048
:0042DEDD 81C1681B4A00            add ecx, 004A1B68
:0042DEE3 E8BF96FDFF              call 004075A7
:0042DEE8 50                      push eax
:0042DEE9 B938C54A00              mov ecx, 004AC538
:0042DEEE E8961DFFFF              call 0041FC89
:0042DEF3 6A04                    push 00000004
:0042DEF5 6A00                    push 00000000
:0042DEF7 8B4DC0                  mov ecx, dword ptr [ebp-40]
:0042DEFA 51                      push ecx
:0042DEFB B9C8E44A00              mov ecx, 004AE4C8
:0042DF00 E83B1B0500              call 0047FA40
:0042DF05 50                      push eax
:0042DF06 6A50                    push 00000050
:0042DF08 6A40                    push 00000040
:0042DF0A 8B55AC                  mov edx, dword ptr [ebp-54]
:0042DF0D 83C208                  add edx, 00000008
:0042DF10 52                      push edx
:0042DF11 8B45B0                  mov eax, dword ptr [ebp-50]
:0042DF14 83C008                  add eax, 00000008
:0042DF17 50                      push eax
:0042DF18 E834030500              call 0047E251
:0042DF1D 83C414                  add esp, 00000014
:0042DF20 C745B80F000000          mov [ebp-48], 0000000F
:0042DF27 EB09                    jmp 0042DF32

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DFD3(U)
|
:0042DF29 8B4DB8                  mov ecx, dword ptr [ebp-48]
:0042DF2C 83E901                  sub ecx, 00000001
:0042DF2F 894DB8                  mov dword ptr [ebp-48], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DF27(U)
|
:0042DF32 837DB800                cmp dword ptr [ebp-48], 00000000
:0042DF36 0F869C000000            jbe 0042DFD8
:0042DF3C E89A06FFFF              call 0041E5DB
:0042DF41 6A00                    push 00000000
:0042DF43 6A00                    push 00000000
:0042DF45 6A01                    push 00000001
:0042DF47 8A55B8                  mov dl, byte ptr [ebp-48]
:0042DF4A 52                      push edx
:0042DF4B 6A04                    push 00000004
:0042DF4D 6A00                    push 00000000
:0042DF4F 8B45BC                  mov eax, dword ptr [ebp-44]
:0042DF52 50                      push eax
:0042DF53 B9C8E44A00              mov ecx, 004AE4C8
:0042DF58 E8E31A0500              call 0047FA40
:0042DF5D 50                      push eax
:0042DF5E 6A04                    push 00000004
:0042DF60 6A00                    push 00000000
:0042DF62 8B4DC0                  mov ecx, dword ptr [ebp-40]
:0042DF65 51                      push ecx
:0042DF66 B9C8E44A00              mov ecx, 004AE4C8
:0042DF6B E8D01A0500              call 0047FA40
:0042DF70 50                      push eax
:0042DF71 6A04                    push 00000004
:0042DF73 6A00                    push 00000000
:0042DF75 8B55E0                  mov edx, dword ptr [ebp-20]
:0042DF78 52                      push edx
:0042DF79 B9C8E44A00              mov ecx, 004AE4C8
:0042DF7E E8BD1A0500              call 0047FA40
:0042DF83 50                      push eax
:0042DF84 6A50                    push 00000050
:0042DF86 6A40                    push 00000040
:0042DF88 E8CD1D0000              call 0042FD5A
:0042DF8D 83C424                  add esp, 00000024
:0042DF90 6A04                    push 00000004
:0042DF92 6A00                    push 00000000
:0042DF94 8B45BC                  mov eax, dword ptr [ebp-44]
:0042DF97 50                      push eax
:0042DF98 B9C8E44A00              mov ecx, 004AE4C8
:0042DF9D E89E1A0500              call 0047FA40
:0042DFA2 50                      push eax
:0042DFA3 6A50                    push 00000050
:0042DFA5 6A40                    push 00000040
:0042DFA7 8B4DAC                  mov ecx, dword ptr [ebp-54]
:0042DFAA 83C108                  add ecx, 00000008
:0042DFAD 51                      push ecx
:0042DFAE 8B55B0                  mov edx, dword ptr [ebp-50]
:0042DFB1 83C208                  add edx, 00000008
:0042DFB4 52                      push edx
:0042DFB5 E8E1000500              call 0047E09B
:0042DFBA 83C414                  add esp, 00000014
:0042DFBD E83406FFFF              call 0041E5F6
:0042DFC2 6A01                    push 00000001
:0042DFC4 B9181B4B00              mov ecx, 004B1B18
:0042DFC9 E87253FDFF              call 00403340
:0042DFCE E80DE5FFFF              call 0042C4E0
:0042DFD3 E951FFFFFF              jmp 0042DF29

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042DF36(C)
|
:0042DFD8 6A00                    push 00000000
:0042DFDA 6A1F                    push 0000001F
:0042DFDC 6A04                    push 00000004
:0042DFDE E80EF20400              call 0047D1F1
:0042DFE3 83C40C                  add esp, 0000000C
:0042DFE6 E8F005FFFF              call 0041E5DB
:0042DFEB 6A12                    push 00000012
:0042DFED 6A00                    push 00000000
:0042DFEF 6A40                    push 00000040
:0042DFF1 6820010000              push 00000120
:0042DFF6 8B45AC                  mov eax, dword ptr [ebp-54]
:0042DFF9 83C01A                  add eax, 0000001A
:0042DFFC 50                      push eax
:0042DFFD 8B4DB0                  mov ecx, dword ptr [ebp-50]
:0042E000 83C170                  add ecx, 00000070
:0042E003 51                      push ecx
:0042E004 E89A06FFFF              call 0041E6A3
:0042E009 83C418                  add esp, 00000018
:0042E00C 6A00                    push 00000000
:0042E00E 6A1F                    push 0000001F
:0042E010 6A04                    push 00000004
:0042E012 E8DAF10400              call 0047D1F1
:0042E017 83C40C                  add esp, 0000000C
:0042E01A 6A04                    push 00000004
:0042E01C 6A00                    push 00000000
:0042E01E 68C0980100              push 000198C0
:0042E023 B950EB4A00              mov ecx, 004AEB50
:0042E028 E8131A0500              call 0047FA40
:0042E02D 50                      push eax
:0042E02E 6A10                    push 00000010
:0042E030 6A10                    push 00000010
:0042E032 8B55AC                  mov edx, dword ptr [ebp-54]
:0042E035 83C23C                  add edx, 0000003C
:0042E038 52                      push edx
:0042E039 8B45B0                  mov eax, dword ptr [ebp-50]
:0042E03C 83C050                  add eax, 00000050
:0042E03F 50                      push eax
:0042E040 E856000500              call 0047E09B
:0042E045 83C414                  add esp, 00000014
:0042E048 6A04                    push 00000004
:0042E04A 6A00                    push 00000000
:0042E04C 68C09A0100              push 00019AC0
:0042E051 B950EB4A00              mov ecx, 004AEB50
:0042E056 E8E5190500              call 0047FA40
:0042E05B 50                      push eax
:0042E05C 6A40                    push 00000040
:0042E05E 6A10                    push 00000010
:0042E060 8B4DAC                  mov ecx, dword ptr [ebp-54]
:0042E063 83C11A                  add ecx, 0000001A
:0042E066 51                      push ecx
:0042E067 8B55B0                  mov edx, dword ptr [ebp-50]
:0042E06A 83C260                  add edx, 00000060
:0042E06D 52                      push edx
:0042E06E E828000500              call 0047E09B
:0042E073 83C414                  add esp, 00000014
:0042E076 6A04                    push 00000004
:0042E078 6A00                    push 00000000
:0042E07A 68C09E0100              push 00019EC0
:0042E07F B950EB4A00              mov ecx, 004AEB50
:0042E084 E8B7190500              call 0047FA40
:0042E089 50                      push eax
:0042E08A 6A40                    push 00000040
:0042E08C 6A10                    push 00000010
:0042E08E 8B45AC                  mov eax, dword ptr [ebp-54]
:0042E091 83C01A                  add eax, 0000001A
:0042E094 50                      push eax
:0042E095 8B4DB0                  mov ecx, dword ptr [ebp-50]
:0042E098 81C190010000            add ecx, 00000190
:0042E09E 51                      push ecx
:0042E09F E8F7FF0400              call 0047E09B
:0042E0A4 83C414                  add esp, 00000014
:0042E0A7 8B5508                  mov edx, dword ptr [ebp+08]
:0042E0AA 8955E4                  mov dword ptr [ebp-1C], edx
:0042E0AD 8B45B0                  mov eax, dword ptr [ebp-50]
:0042E0B0 83C070                  add eax, 00000070
:0042E0B3 99                      cdq
:0042E0B4 83E207                  and edx, 00000007
:0042E0B7 03C2                    add eax, edx
:0042E0B9 C1F803                  sar eax, 03
:0042E0BC 8945F8                  mov dword ptr [ebp-08], eax
:0042E0BF 6A03                    push 00000003
:0042E0C1 68FFFF0000              push 0000FFFF
:0042E0C6 8D45E8                  lea eax, dword ptr [ebp-18]
:0042E0C9 50                      push eax
:0042E0CA E8612A0500              call 00480B30
:0042E0CF 83C40C                  add esp, 0000000C
:0042E0D2 C745CC1E000000          mov [ebp-34], 0000001E
:0042E0D9 6A00                    push 00000000
:0042E0DB 6A00                    push 00000000
:0042E0DD 6802020000              push 00000202
:0042E0E2 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:0042E0E8 51                      push ecx
:0042E0E9 FF15F4624800            call dword ptr [004862F4]
:0042E0EF 6A1F                    push 0000001F
:0042E0F1 B9382F4900              mov ecx, 00492F38
:0042E0F6 E8890BFEFF              call 0040EC84
:0042E0FB C645D000                mov [ebp-30], 00
:0042E0FF EB09                    jmp 0042E10A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E19B(U)
|
:0042E101 8A55D0                  mov dl, byte ptr [ebp-30]
:0042E104 80C201                  add dl, 01
:0042E107 8855D0                  mov byte ptr [ebp-30], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E0FF(U)
|
:0042E10A 8B45E4                  mov eax, dword ptr [ebp-1C]
:0042E10D 33C9                    xor ecx, ecx
:0042E10F 8A08                    mov cl, byte ptr [eax]
:0042E111 85C9                    test ecx, ecx
:0042E113 0F8487000000            je 0042E1A0
:0042E119 8B55D0                  mov edx, dword ptr [ebp-30]
:0042E11C 81E2FF000000            and edx, 000000FF
:0042E122 3B55C8                  cmp edx, dword ptr [ebp-38]
:0042E125 7D79                    jge 0042E1A0
:0042E127 8B45D0                  mov eax, dword ptr [ebp-30]
:0042E12A 25FF000000              and eax, 000000FF
:0042E12F 85C0                    test eax, eax
:0042E131 7405                    je 0042E138
:0042E133 E8A304FFFF              call 0041E5DB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E131(C)
|
:0042E138 6A00                    push 00000000
:0042E13A 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0042E13D 51                      push ecx
:0042E13E 8B55AC                  mov edx, dword ptr [ebp-54]
:0042E141 0355CC                  add edx, dword ptr [ebp-34]
:0042E144 52                      push edx
:0042E145 8B45B0                  mov eax, dword ptr [ebp-50]
:0042E148 83C070                  add eax, 00000070
:0042E14B 99                      cdq
:0042E14C 83E207                  and edx, 00000007
:0042E14F 03C2                    add eax, edx
:0042E151 C1F803                  sar eax, 03
:0042E154 50                      push eax
:0042E155 E856E7FFFF              call 0042C8B0
:0042E15A 83C410                  add esp, 00000010
:0042E15D 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0042E160 03C8                    add ecx, eax
:0042E162 894DE4                  mov dword ptr [ebp-1C], ecx
:0042E165 8B55CC                  mov edx, dword ptr [ebp-34]
:0042E168 8B45AC                  mov eax, dword ptr [ebp-54]
:0042E16B 8D4C10FF                lea ecx, dword ptr [eax+edx-01]
:0042E16F 8B55D0                  mov edx, dword ptr [ebp-30]
:0042E172 81E2FF000000            and edx, 000000FF
:0042E178 894C95E8                mov dword ptr [ebp+4*edx-18], ecx
:0042E17C 8B45CC                  mov eax, dword ptr [ebp-34]
:0042E17F 83C014                  add eax, 00000014
:0042E182 8945CC                  mov dword ptr [ebp-34], eax
:0042E185 E86C04FFFF              call 0041E5F6
:0042E18A 6A0A                    push 0000000A
:0042E18C B9181B4B00              mov ecx, 004B1B18
:0042E191 E8AA51FDFF              call 00403340
:0042E196 E845E3FFFF              call 0042C4E0
:0042E19B E961FFFFFF              jmp 0042E101

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042E113(C), :0042E125(C)
|
:0042E1A0 B9B07F4900              mov ecx, 00497FB0
:0042E1A5 E8BC7EFFFF              call 00426066
:0042E1AA 6A00                    push 00000000
:0042E1AC 6A00                    push 00000000
:0042E1AE 6802020000              push 00000202
:0042E1B3 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:0042E1B9 51                      push ecx
:0042E1BA FF15F4624800            call dword ptr [004862F4]
:0042E1C0 8B55F8                  mov edx, dword ptr [ebp-08]
:0042E1C3 C1E203                  shl edx, 03
:0042E1C6 8955F8                  mov dword ptr [ebp-08], edx
:0042E1C9 C645C4FF                mov [ebp-3C], FF
:0042E1CD C745FC40140000          mov [ebp-04], 00001440
:0042E1D4 6A04                    push 00000004
:0042E1D6 6A00                    push 00000000
:0042E1D8 6800690000              push 00006900
:0042E1DD B9C8E44A00              mov ecx, 004AE4C8
:0042E1E2 E859180500              call 0047FA40
:0042E1E7 50                      push eax
:0042E1E8 6A40                    push 00000040
:0042E1EA 6820010000              push 00000120
:0042E1EF 8B45E8                  mov eax, dword ptr [ebp-18]
:0042E1F2 50                      push eax
:0042E1F3 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042E1F6 51                      push ecx
:0042E1F7 E855000500              call 0047E251
:0042E1FC 83C414                  add esp, 00000014
:0042E1FF C745B800000000          mov [ebp-48], 00000000
:0042E206 EB09                    jmp 0042E211

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E278(U)
|
:0042E208 8B55B8                  mov edx, dword ptr [ebp-48]
:0042E20B 83C201                  add edx, 00000001
:0042E20E 8955B8                  mov dword ptr [ebp-48], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E206(U)
|
:0042E211 8B45D0                  mov eax, dword ptr [ebp-30]
:0042E214 25FF000000              and eax, 000000FF
:0042E219 3945B8                  cmp dword ptr [ebp-48], eax
:0042E21C 735C                    jnb 0042E27A
:0042E21E 6A04                    push 00000004
:0042E220 6A00                    push 00000000
:0042E222 8B4DB8                  mov ecx, dword ptr [ebp-48]
:0042E225 0FAF4DFC                imul ecx, dword ptr [ebp-04]
:0042E229 51                      push ecx
:0042E22A B9C8E44A00              mov ecx, 004AE4C8
:0042E22F E80C180500              call 0047FA40
:0042E234 50                      push eax
:0042E235 6A12                    push 00000012
:0042E237 6820010000              push 00000120
:0042E23C 8B55B8                  mov edx, dword ptr [ebp-48]
:0042E23F 8B4495E8                mov eax, dword ptr [ebp+4*edx-18]
:0042E243 50                      push eax
:0042E244 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042E247 51                      push ecx
:0042E248 E804000500              call 0047E251
:0042E24D 83C414                  add esp, 00000014
:0042E250 6A00                    push 00000000
:0042E252 6A12                    push 00000012
:0042E254 6820010000              push 00000120
:0042E259 6A04                    push 00000004
:0042E25B 6A00                    push 00000000
:0042E25D 8B55B8                  mov edx, dword ptr [ebp-48]
:0042E260 0FAF55FC                imul edx, dword ptr [ebp-04]
:0042E264 52                      push edx
:0042E265 B9C8E44A00              mov ecx, 004AE4C8
:0042E26A E8D1170500              call 0047FA40
:0042E26F 50                      push eax
:0042E270 E8B6010000              call 0042E42B
:0042E275 83C410                  add esp, 00000010
:0042E278 EB8E                    jmp 0042E208

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E21C(C)
|
:0042E27A 6A00                    push 00000000
:0042E27C 6A1F                    push 0000001F
:0042E27E 6A04                    push 00000004
:0042E280 E86CEF0400              call 0047D1F1
:0042E285 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E40B(U)
|
:0042E288 E837080500              call 0047EAC4
:0042E28D B9B07F4900              mov ecx, 00497FB0
:0042E292 E88F79FFFF              call 00425C26
:0042E297 8945DC                  mov dword ptr [ebp-24], eax
:0042E29A B9B07F4900              mov ecx, 00497FB0
:0042E29F E89379FFFF              call 00425C37
:0042E2A4 8945D8                  mov dword ptr [ebp-28], eax
:0042E2A7 C645C4FF                mov [ebp-3C], FF
:0042E2AB E82B03FFFF              call 0041E5DB
:0042E2B0 6A04                    push 00000004
:0042E2B2 6A00                    push 00000000
:0042E2B4 6800690000              push 00006900
:0042E2B9 B9C8E44A00              mov ecx, 004AE4C8
:0042E2BE E87D170500              call 0047FA40
:0042E2C3 50                      push eax
:0042E2C4 6A40                    push 00000040
:0042E2C6 6820010000              push 00000120
:0042E2CB 8B45E8                  mov eax, dword ptr [ebp-18]
:0042E2CE 50                      push eax
:0042E2CF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042E2D2 51                      push ecx
:0042E2D3 E8C3FD0400              call 0047E09B
:0042E2D8 83C414                  add esp, 00000014
:0042E2DB 8B55F8                  mov edx, dword ptr [ebp-08]
:0042E2DE 3B55DC                  cmp edx, dword ptr [ebp-24]
:0042E2E1 0F8784000000            ja 0042E36B
:0042E2E7 8B45F8                  mov eax, dword ptr [ebp-08]
:0042E2EA 0520010000              add eax, 00000120
:0042E2EF 3945DC                  cmp dword ptr [ebp-24], eax
:0042E2F2 7377                    jnb 0042E36B
:0042E2F4 C745B800000000          mov [ebp-48], 00000000
:0042E2FB EB09                    jmp 0042E306

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E369(U)
|
:0042E2FD 8B4DB8                  mov ecx, dword ptr [ebp-48]
:0042E300 83C101                  add ecx, 00000001
:0042E303 894DB8                  mov dword ptr [ebp-48], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E2FB(U)
|
:0042E306 8B55D0                  mov edx, dword ptr [ebp-30]
:0042E309 81E2FF000000            and edx, 000000FF
:0042E30F 3955B8                  cmp dword ptr [ebp-48], edx
:0042E312 7357                    jnb 0042E36B
:0042E314 8B45B8                  mov eax, dword ptr [ebp-48]
:0042E317 8B4C85E8                mov ecx, dword ptr [ebp+4*eax-18]
:0042E31B 3B4DD8                  cmp ecx, dword ptr [ebp-28]
:0042E31E 7749                    ja 0042E369
:0042E320 8B55B8                  mov edx, dword ptr [ebp-48]
:0042E323 8B4495E8                mov eax, dword ptr [ebp+4*edx-18]
:0042E327 83C012                  add eax, 00000012
:0042E32A 3945D8                  cmp dword ptr [ebp-28], eax
:0042E32D 733A                    jnb 0042E369
:0042E32F 6A04                    push 00000004
:0042E331 6A00                    push 00000000
:0042E333 8B4DB8                  mov ecx, dword ptr [ebp-48]
:0042E336 0FAF4DFC                imul ecx, dword ptr [ebp-04]
:0042E33A 51                      push ecx
:0042E33B B9C8E44A00              mov ecx, 004AE4C8
:0042E340 E8FB160500              call 0047FA40
:0042E345 50                      push eax
:0042E346 6A12                    push 00000012
:0042E348 6820010000              push 00000120
:0042E34D 8B55B8                  mov edx, dword ptr [ebp-48]
:0042E350 8B4495E8                mov eax, dword ptr [ebp+4*edx-18]
:0042E354 50                      push eax
:0042E355 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042E358 51                      push ecx
:0042E359 E83DFD0400              call 0047E09B
:0042E35E 83C414                  add esp, 00000014
:0042E361 8A55B8                  mov dl, byte ptr [ebp-48]
:0042E364 8855C4                  mov byte ptr [ebp-3C], dl
:0042E367 EB02                    jmp 0042E36B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042E31E(C), :0042E32D(C)
|
:0042E369 EB92                    jmp 0042E2FD

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042E2E1(C), :0042E2F2(C), :0042E312(C), :0042E367(U)
|
:0042E36B E88602FFFF              call 0041E5F6
:0042E370 8B45C4                  mov eax, dword ptr [ebp-3C]
:0042E373 25FF000000              and eax, 000000FF
:0042E378 3DFF000000              cmp eax, 000000FF
:0042E37D 0F8488000000            je 0042E40B
:0042E383 E8E3E1FFFF              call 0042C56B
:0042E388 83F801                  cmp eax, 00000001
:0042E38B 757E                    jne 0042E40B
:0042E38D 6A01                    push 00000001
:0042E38F 6A12                    push 00000012
:0042E391 6820010000              push 00000120
:0042E396 6A04                    push 00000004
:0042E398 6A00                    push 00000000
:0042E39A 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:0042E39D 81E1FF000000            and ecx, 000000FF
:0042E3A3 0FAF4DFC                imul ecx, dword ptr [ebp-04]
:0042E3A7 51                      push ecx
:0042E3A8 B9C8E44A00              mov ecx, 004AE4C8
:0042E3AD E88E160500              call 0047FA40
:0042E3B2 50                      push eax
:0042E3B3 E873000000              call 0042E42B
:0042E3B8 83C410                  add esp, 00000010
:0042E3BB 6A04                    push 00000004
:0042E3BD 6A00                    push 00000000
:0042E3BF 8B55C4                  mov edx, dword ptr [ebp-3C]
:0042E3C2 81E2FF000000            and edx, 000000FF
:0042E3C8 0FAF55FC                imul edx, dword ptr [ebp-04]
:0042E3CC 52                      push edx
:0042E3CD B9C8E44A00              mov ecx, 004AE4C8
:0042E3D2 E869160500              call 0047FA40
:0042E3D7 50                      push eax
:0042E3D8 6A12                    push 00000012
:0042E3DA 6820010000              push 00000120
:0042E3DF 8B45C4                  mov eax, dword ptr [ebp-3C]
:0042E3E2 25FF000000              and eax, 000000FF
:0042E3E7 8B4C85E8                mov ecx, dword ptr [ebp+4*eax-18]
:0042E3EB 51                      push ecx
:0042E3EC 8B55F8                  mov edx, dword ptr [ebp-08]
:0042E3EF 52                      push edx
:0042E3F0 E8A6FC0400              call 0047E09B
:0042E3F5 83C414                  add esp, 00000014
:0042E3F8 6A02                    push 00000002
:0042E3FA B9181B4B00              mov ecx, 004B1B18
:0042E3FF E83C4FFDFF              call 00403340
:0042E404 E8D7E0FFFF              call 0042C4E0
:0042E409 EB05                    jmp 0042E410

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042E37D(C), :0042E38B(C)
|
:0042E40B E978FEFFFF              jmp 0042E288

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E409(U)
|
:0042E410 B9B07F4900              mov ecx, 00497FB0
:0042E415 E84C7CFFFF              call 00426066
:0042E41A B930694B00              mov ecx, 004B6930
:0042E41F E8FF510400              call 00473623
:0042E424 8A45C4                  mov al, byte ptr [ebp-3C]
:0042E427 8BE5                    mov esp, ebp
:0042E429 5D                      pop ebp
:0042E42A C3                      ret



* Referenced by a CALL at Addresses:
|:0042E270   , :0042E3B3   
|
:0042E42B 55                      push ebp
:0042E42C 8BEC                    mov ebp, esp
:0042E42E 83EC10                  sub esp, 00000010
:0042E431 8B4514                  mov eax, dword ptr [ebp+14]
:0042E434 F7D8                    neg eax
:0042E436 1BC0                    sbb eax, eax
:0042E438 24F3                    and al, F3
:0042E43A 83C01F                  add eax, 0000001F
:0042E43D 8845FC                  mov byte ptr [ebp-04], al
:0042E440 8B4D14                  mov ecx, dword ptr [ebp+14]
:0042E443 F7D9                    neg ecx
:0042E445 1BC9                    sbb ecx, ecx
:0042E447 83E1EE                  and ecx, FFFFFFEE
:0042E44A 83C13A                  add ecx, 0000003A
:0042E44D 884DF4                  mov byte ptr [ebp-0C], cl
:0042E450 C745F800000000          mov [ebp-08], 00000000
:0042E457 EB09                    jmp 0042E462

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E4B3(U)
|
:0042E459 8B55F8                  mov edx, dword ptr [ebp-08]
:0042E45C 83C201                  add edx, 00000001
:0042E45F 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E457(U)
|
:0042E462 8B45F8                  mov eax, dword ptr [ebp-08]
:0042E465 3B4510                  cmp eax, dword ptr [ebp+10]
:0042E468 734B                    jnb 0042E4B5
:0042E46A C745F000000000          mov [ebp-10], 00000000
:0042E471 EB09                    jmp 0042E47C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E4B1(U)
|
:0042E473 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0042E476 83C101                  add ecx, 00000001
:0042E479 894DF0                  mov dword ptr [ebp-10], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E471(U)
|
:0042E47C 8B55F0                  mov edx, dword ptr [ebp-10]
:0042E47F 3B550C                  cmp edx, dword ptr [ebp+0C]
:0042E482 732F                    jnb 0042E4B3
:0042E484 8B4508                  mov eax, dword ptr [ebp+08]
:0042E487 33C9                    xor ecx, ecx
:0042E489 8A08                    mov cl, byte ptr [eax]
:0042E48B 8B55FC                  mov edx, dword ptr [ebp-04]
:0042E48E 81E2FF000000            and edx, 000000FF
:0042E494 3BCA                    cmp ecx, edx
:0042E496 7508                    jne 0042E4A0
:0042E498 8B4508                  mov eax, dword ptr [ebp+08]
:0042E49B C60012                  mov byte ptr [eax], 12
:0042E49E EB08                    jmp 0042E4A8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E496(C)
|
:0042E4A0 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E4A3 8A55F4                  mov dl, byte ptr [ebp-0C]
:0042E4A6 8811                    mov byte ptr [ecx], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E49E(U)
|
:0042E4A8 8B4508                  mov eax, dword ptr [ebp+08]
:0042E4AB 83C001                  add eax, 00000001
:0042E4AE 894508                  mov dword ptr [ebp+08], eax
:0042E4B1 EBC0                    jmp 0042E473

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E482(C)
|
:0042E4B3 EBA4                    jmp 0042E459

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E468(C)
|
:0042E4B5 8BE5                    mov esp, ebp
:0042E4B7 5D                      pop ebp
:0042E4B8 C3                      ret


:0042E4B9 55                      push ebp
:0042E4BA 8BEC                    mov ebp, esp
:0042E4BC 6AFF                    push FFFFFFFF
:0042E4BE 6875534800              push 00485375
:0042E4C3 64A100000000            mov eax, dword ptr fs:[00000000]
:0042E4C9 50                      push eax
:0042E4CA 64892500000000          mov dword ptr fs:[00000000], esp
:0042E4D1 81ECBC010000            sub esp, 000001BC
:0042E4D7 C645DC00                mov [ebp-24], 00
:0042E4DB 8B4518                  mov eax, dword ptr [ebp+18]
:0042E4DE 25FF000000              and eax, 000000FF
:0042E4E3 2580000000              and eax, 00000080
:0042E4E8 888584FEFFFF            mov byte ptr [ebp+FFFFFE84], al
:0042E4EE 8B4D18                  mov ecx, dword ptr [ebp+18]
:0042E4F1 81E1FF000000            and ecx, 000000FF
:0042E4F7 83E140                  and ecx, 00000040
:0042E4FA 888D70FEFFFF            mov byte ptr [ebp+FFFFFE70], cl
:0042E500 C68560FEFFFF00          mov byte ptr [ebp+FFFFFE60], 00
:0042E507 C645F014                mov [ebp-10], 14
:0042E50B C745E800000000          mov [ebp-18], 00000000
:0042E512 C78568FEFFFF08000000    mov dword ptr [ebp+FFFFFE68], 00000008
:0042E51C C745EC00000000          mov [ebp-14], 00000000
:0042E523 E82FE0FFFF              call 0042C557
:0042E528 837D2400                cmp dword ptr [ebp+24], 00000000
:0042E52C 741A                    je 0042E548
:0042E52E 8B5518                  mov edx, dword ptr [ebp+18]
:0042E531 81E2FF000000            and edx, 000000FF
:0042E537 83E220                  and edx, 00000020
:0042E53A 85D2                    test edx, edx
:0042E53C 740A                    je 0042E548
:0042E53E 8B4524                  mov eax, dword ptr [ebp+24]
:0042E541 33C9                    xor ecx, ecx
:0042E543 8A08                    mov cl, byte ptr [eax]
:0042E545 894DE8                  mov dword ptr [ebp-18], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042E52C(C), :0042E53C(C)
|
:0042E548 C68588FEFFFF00          mov byte ptr [ebp+FFFFFE88], 00
:0042E54F EB0F                    jmp 0042E560

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E5FB(U)
|
:0042E551 8A9588FEFFFF            mov dl, byte ptr [ebp+FFFFFE88]
:0042E557 80C201                  add dl, 01
:0042E55A 889588FEFFFF            mov byte ptr [ebp+FFFFFE88], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E54F(U)
|
:0042E560 8B8588FEFFFF            mov eax, dword ptr [ebp+FFFFFE88]
:0042E566 25FF000000              and eax, 000000FF
:0042E56B 8B4D10                  mov ecx, dword ptr [ebp+10]
:0042E56E 833C8100                cmp dword ptr [ecx+4*eax], 00000000
:0042E572 0F8488000000            je 0042E600
:0042E578 C6857CFEFFFF00          mov byte ptr [ebp+FFFFFE7C], 00
:0042E57F EB0F                    jmp 0042E590

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E5B6(U)
|
:0042E581 8A957CFEFFFF            mov dl, byte ptr [ebp+FFFFFE7C]
:0042E587 80C201                  add dl, 01
:0042E58A 88957CFEFFFF            mov byte ptr [ebp+FFFFFE7C], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E57F(U)
|
:0042E590 8B8588FEFFFF            mov eax, dword ptr [ebp+FFFFFE88]
:0042E596 25FF000000              and eax, 000000FF
:0042E59B 8B8D7CFEFFFF            mov ecx, dword ptr [ebp+FFFFFE7C]
:0042E5A1 81E1FF000000            and ecx, 000000FF
:0042E5A7 8B5510                  mov edx, dword ptr [ebp+10]
:0042E5AA 8B0482                  mov eax, dword ptr [edx+4*eax]
:0042E5AD 33D2                    xor edx, edx
:0042E5AF 8A1408                  mov dl, byte ptr [eax+ecx]
:0042E5B2 85D2                    test edx, edx
:0042E5B4 7402                    je 0042E5B8
:0042E5B6 EBC9                    jmp 0042E581

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E5B4(C)
|
:0042E5B8 8B4520                  mov eax, dword ptr [ebp+20]
:0042E5BB 25FF000000              and eax, 000000FF
:0042E5C0 8B8D7CFEFFFF            mov ecx, dword ptr [ebp+FFFFFE7C]
:0042E5C6 81E1FF000000            and ecx, 000000FF
:0042E5CC 3BC1                    cmp eax, ecx
:0042E5CE 7E11                    jle 0042E5E1
:0042E5D0 8B5520                  mov edx, dword ptr [ebp+20]
:0042E5D3 81E2FF000000            and edx, 000000FF
:0042E5D9 899540FEFFFF            mov dword ptr [ebp+FFFFFE40], edx
:0042E5DF EB11                    jmp 0042E5F2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E5CE(C)
|
:0042E5E1 8B857CFEFFFF            mov eax, dword ptr [ebp+FFFFFE7C]
:0042E5E7 25FF000000              and eax, 000000FF
:0042E5EC 898540FEFFFF            mov dword ptr [ebp+FFFFFE40], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E5DF(U)
|
:0042E5F2 8A8D40FEFFFF            mov cl, byte ptr [ebp+FFFFFE40]
:0042E5F8 884D20                  mov byte ptr [ebp+20], cl
:0042E5FB E951FFFFFF              jmp 0042E551

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E572(C)
|
:0042E600 8A9588FEFFFF            mov dl, byte ptr [ebp+FFFFFE88]
:0042E606 889560FEFFFF            mov byte ptr [ebp+FFFFFE60], dl
:0042E60C 8B4520                  mov eax, dword ptr [ebp+20]
:0042E60F 25FF000000              and eax, 000000FF
:0042E614 83F808                  cmp eax, 00000008
:0042E617 7E11                    jle 0042E62A
:0042E619 8B4D20                  mov ecx, dword ptr [ebp+20]
:0042E61C 81E1FF000000            and ecx, 000000FF
:0042E622 898D3CFEFFFF            mov dword ptr [ebp+FFFFFE3C], ecx
:0042E628 EB0A                    jmp 0042E634

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E617(C)
|
:0042E62A C7853CFEFFFF08000000    mov dword ptr [ebp+FFFFFE3C], 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E628(U)
|
:0042E634 8A953CFEFFFF            mov dl, byte ptr [ebp+FFFFFE3C]
:0042E63A 885520                  mov byte ptr [ebp+20], dl
:0042E63D 8B8584FEFFFF            mov eax, dword ptr [ebp+FFFFFE84]
:0042E643 25FF000000              and eax, 000000FF
:0042E648 F7D8                    neg eax
:0042E64A 1BC0                    sbb eax, eax
:0042E64C 83E002                  and eax, 00000002
:0042E64F 8A4D20                  mov cl, byte ptr [ebp+20]
:0042E652 02C8                    add cl, al
:0042E654 884D20                  mov byte ptr [ebp+20], cl
:0042E657 8B9584FEFFFF            mov edx, dword ptr [ebp+FFFFFE84]
:0042E65D 81E2FF000000            and edx, 000000FF
:0042E663 85D2                    test edx, edx
:0042E665 7429                    je 0042E690
:0042E667 8B8560FEFFFF            mov eax, dword ptr [ebp+FFFFFE60]
:0042E66D 25FF000000              and eax, 000000FF
:0042E672 8B4D14                  mov ecx, dword ptr [ebp+14]
:0042E675 81E1FF000000            and ecx, 000000FF
:0042E67B 3BC1                    cmp eax, ecx
:0042E67D 7E06                    jle 0042E685
:0042E67F C645DC01                mov [ebp-24], 01
:0042E683 EB09                    jmp 0042E68E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E67D(C)
|
:0042E685 8A9560FEFFFF            mov dl, byte ptr [ebp+FFFFFE60]
:0042E68B 885514                  mov byte ptr [ebp+14], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E683(U)
|
:0042E68E EB21                    jmp 0042E6B1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E665(C)
|
:0042E690 8B8560FEFFFF            mov eax, dword ptr [ebp+FFFFFE60]
:0042E696 25FF000000              and eax, 000000FF
:0042E69B 8B4D14                  mov ecx, dword ptr [ebp+14]
:0042E69E 81E1FF000000            and ecx, 000000FF
:0042E6A4 3BC1                    cmp eax, ecx
:0042E6A6 7F09                    jg 0042E6B1
:0042E6A8 8A9560FEFFFF            mov dl, byte ptr [ebp+FFFFFE60]
:0042E6AE 885514                  mov byte ptr [ebp+14], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042E68E(U), :0042E6A6(C)
|
:0042E6B1 8A4514                  mov al, byte ptr [ebp+14]
:0042E6B4 50                      push eax
:0042E6B5 8A4D20                  mov cl, byte ptr [ebp+20]
:0042E6B8 51                      push ecx
:0042E6B9 8B551C                  mov edx, dword ptr [ebp+1C]
:0042E6BC 52                      push edx
:0042E6BD 8B4510                  mov eax, dword ptr [ebp+10]
:0042E6C0 50                      push eax
:0042E6C1 8D8D8CFEFFFF            lea ecx, dword ptr [ebp+FFFFFE8C]
:0042E6C7 E8C4110000              call 0042F890
:0042E6CC C745FC00000000          mov [ebp-04], 00000000
:0042E6D3 8B4D14                  mov ecx, dword ptr [ebp+14]
:0042E6D6 81E1FF000000            and ecx, 000000FF
:0042E6DC 8B55F0                  mov edx, dword ptr [ebp-10]
:0042E6DF 81E2FF000000            and edx, 000000FF
:0042E6E5 0FAFCA                  imul ecx, edx
:0042E6E8 8B8568FEFFFF            mov eax, dword ptr [ebp+FFFFFE68]
:0042E6EE 8D44410F                lea eax, dword ptr [ecx+2*eax+0F]
:0042E6F2 C1E804                  shr eax, 04
:0042E6F5 C1E004                  shl eax, 04
:0042E6F8 33D2                    xor edx, edx
:0042E6FA B930000000              mov ecx, 00000030
:0042E6FF F7F1                    div ecx
:0042E701 83C001                  add eax, 00000001
:0042E704 898580FEFFFF            mov dword ptr [ebp+FFFFFE80], eax
:0042E70A 8B9580FEFFFF            mov edx, dword ptr [ebp+FFFFFE80]
:0042E710 6BD230                  imul edx, 00000030
:0042E713 899580FEFFFF            mov dword ptr [ebp+FFFFFE80], edx
:0042E719 837D0810                cmp dword ptr [ebp+08], 00000010
:0042E71D 7307                    jnb 0042E726
:0042E71F C7450810000000          mov [ebp+08], 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E71D(C)
|
:0042E726 8B4520                  mov eax, dword ptr [ebp+20]
:0042E729 25FF000000              and eax, 000000FF
:0042E72E 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E731 8D54C130                lea edx, dword ptr [ecx+8*eax+30]
:0042E735 81FA78020000            cmp edx, 00000278
:0042E73B 7219                    jb 0042E756
:0042E73D 8B4520                  mov eax, dword ptr [ebp+20]
:0042E740 25FF000000              and eax, 000000FF
:0042E745 8D0CC530000000          lea ecx, dword ptr [8*eax+00000030]
:0042E74C BA78020000              mov edx, 00000278
:0042E751 2BD1                    sub edx, ecx
:0042E753 895508                  mov dword ptr [ebp+08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E73B(C)
|
:0042E756 837D0C30                cmp dword ptr [ebp+0C], 00000030
:0042E75A 7307                    jnb 0042E763
:0042E75C C7450C30000000          mov [ebp+0C], 00000030

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E75A(C)
|
:0042E763 E8BAD1FDFF              call 0040B922
:0042E768 F7D8                    neg eax
:0042E76A 1BC0                    sbb eax, eax
:0042E76C 83E003                  and eax, 00000003
:0042E76F 83C002                  add eax, 00000002
:0042E772 888588FEFFFF            mov byte ptr [ebp+FFFFFE88], al
:0042E778 6A00                    push 00000000
:0042E77A E89CD0FFFF              call 0042B81B
:0042E77F 83C404                  add esp, 00000004
:0042E782 8B4520                  mov eax, dword ptr [ebp+20]
:0042E785 25FF000000              and eax, 000000FF
:0042E78A 8D04C510000000          lea eax, dword ptr [8*eax+00000010]
:0042E791 99                      cdq
:0042E792 B930000000              mov ecx, 00000030
:0042E797 F7F9                    idiv ecx
:0042E799 83C001                  add eax, 00000001
:0042E79C 8945E0                  mov dword ptr [ebp-20], eax
:0042E79F 8B9570FEFFFF            mov edx, dword ptr [ebp+FFFFFE70]
:0042E7A5 81E2FF000000            and edx, 000000FF
:0042E7AB 85D2                    test edx, edx
:0042E7AD 7426                    je 0042E7D5
:0042E7AF 6A00                    push 00000000
:0042E7B1 6A00                    push 00000000
:0042E7B3 8B8580FEFFFF            mov eax, dword ptr [ebp+FFFFFE80]
:0042E7B9 50                      push eax
:0042E7BA 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0042E7BD 6BC930                  imul ecx, 00000030
:0042E7C0 51                      push ecx
:0042E7C1 8B550C                  mov edx, dword ptr [ebp+0C]
:0042E7C4 52                      push edx
:0042E7C5 8B4508                  mov eax, dword ptr [ebp+08]
:0042E7C8 50                      push eax
:0042E7C9 B930694B00              mov ecx, 004B6930
:0042E7CE E82F4A0400              call 00473202
:0042E7D3 EB6E                    jmp 0042E843

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E7AD(C)
|
:0042E7D5 6A00                    push 00000000
:0042E7D7 8B8D80FEFFFF            mov ecx, dword ptr [ebp+FFFFFE80]
:0042E7DD 51                      push ecx
:0042E7DE 8B55E0                  mov edx, dword ptr [ebp-20]
:0042E7E1 6BD230                  imul edx, 00000030
:0042E7E4 52                      push edx
:0042E7E5 8B450C                  mov eax, dword ptr [ebp+0C]
:0042E7E8 50                      push eax
:0042E7E9 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E7EC 51                      push ecx
:0042E7ED B930694B00              mov ecx, 004B6930
:0042E7F2 E8C44D0400              call 004735BB
:0042E7F7 6A04                    push 00000004
:0042E7F9 6A00                    push 00000000
:0042E7FB 6A00                    push 00000000
:0042E7FD B9C8E44A00              mov ecx, 004AE4C8
:0042E802 E839120500              call 0047FA40
:0042E807 50                      push eax
:0042E808 8B5514                  mov edx, dword ptr [ebp+14]
:0042E80B 81E2FF000000            and edx, 000000FF
:0042E811 8B45F0                  mov eax, dword ptr [ebp-10]
:0042E814 25FF000000              and eax, 000000FF
:0042E819 0FAFD0                  imul edx, eax
:0042E81C 52                      push edx
:0042E81D 8B4D20                  mov ecx, dword ptr [ebp+20]
:0042E820 81E1FF000000            and ecx, 000000FF
:0042E826 C1E103                  shl ecx, 03
:0042E829 51                      push ecx
:0042E82A 8B550C                  mov edx, dword ptr [ebp+0C]
:0042E82D 039568FEFFFF            add edx, dword ptr [ebp+FFFFFE68]
:0042E833 52                      push edx
:0042E834 8B4508                  mov eax, dword ptr [ebp+08]
:0042E837 83C008                  add eax, 00000008
:0042E83A 50                      push eax
:0042E83B E811FA0400              call 0047E251
:0042E840 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E7D3(U)
|
:0042E843 8B8D80FEFFFF            mov ecx, dword ptr [ebp+FFFFFE80]
:0042E849 83E910                  sub ecx, 00000010
:0042E84C 8B55F0                  mov edx, dword ptr [ebp-10]
:0042E84F 81E2FF000000            and edx, 000000FF
:0042E855 8B4514                  mov eax, dword ptr [ebp+14]
:0042E858 25FF000000              and eax, 000000FF
:0042E85D 0FAFD0                  imul edx, eax
:0042E860 2BCA                    sub ecx, edx
:0042E862 D1E9                    shr ecx, 1
:0042E864 8B9568FEFFFF            mov edx, dword ptr [ebp+FFFFFE68]
:0042E86A 03D1                    add edx, ecx
:0042E86C 899568FEFFFF            mov dword ptr [ebp+FFFFFE68], edx
:0042E872 8B4520                  mov eax, dword ptr [ebp+20]
:0042E875 25FF000000              and eax, 000000FF
:0042E87A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E87D 8D54C110                lea edx, dword ptr [ecx+8*eax+10]
:0042E881 8955E4                  mov dword ptr [ebp-1C], edx
:0042E884 8B8560FEFFFF            mov eax, dword ptr [ebp+FFFFFE60]
:0042E88A 25FF000000              and eax, 000000FF
:0042E88F 50                      push eax
:0042E890 8B4D14                  mov ecx, dword ptr [ebp+14]
:0042E893 81E1FF000000            and ecx, 000000FF
:0042E899 51                      push ecx
:0042E89A 8B5514                  mov edx, dword ptr [ebp+14]
:0042E89D 81E2FF000000            and edx, 000000FF
:0042E8A3 8B45F0                  mov eax, dword ptr [ebp-10]
:0042E8A6 25FF000000              and eax, 000000FF
:0042E8AB 0FAFD0                  imul edx, eax
:0042E8AE 52                      push edx
:0042E8AF 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0042E8B2 038D68FEFFFF            add ecx, dword ptr [ebp+FFFFFE68]
:0042E8B8 51                      push ecx
:0042E8B9 8B55E4                  mov edx, dword ptr [ebp-1C]
:0042E8BC C1EA03                  shr edx, 03
:0042E8BF 52                      push edx
:0042E8C0 8D4DC0                  lea ecx, dword ptr [ebp-40]
:0042E8C3 E8480F0000              call 0042F810
:0042E8C8 C645FC01                mov [ebp-04], 01
:0042E8CC 8B45DC                  mov eax, dword ptr [ebp-24]
:0042E8CF 25FF000000              and eax, 000000FF
:0042E8D4 83F801                  cmp eax, 00000001
:0042E8D7 752A                    jne 0042E903
:0042E8D9 837D2400                cmp dword ptr [ebp+24], 00000000
:0042E8DD 741C                    je 0042E8FB
:0042E8DF 8B4D18                  mov ecx, dword ptr [ebp+18]
:0042E8E2 81E1FF000000            and ecx, 000000FF
:0042E8E8 83E120                  and ecx, 00000020
:0042E8EB 85C9                    test ecx, ecx
:0042E8ED 740C                    je 0042E8FB
:0042E8EF 8B55E8                  mov edx, dword ptr [ebp-18]
:0042E8F2 52                      push edx
:0042E8F3 8D4DC0                  lea ecx, dword ptr [ebp-40]
:0042E8F6 E860510400              call 00473A5B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042E8DD(C), :0042E8ED(C)
|
:0042E8FB 8D4DC0                  lea ecx, dword ptr [ebp-40]
:0042E8FE E8E94D0400              call 004736EC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E8D7(C)
|
:0042E903 8B8584FEFFFF            mov eax, dword ptr [ebp+FFFFFE84]
:0042E909 25FF000000              and eax, 000000FF
:0042E90E 85C0                    test eax, eax
:0042E910 0F8409010000            je 0042EA1F
:0042E916 6A04                    push 00000004
:0042E918 B9382F4900              mov ecx, 00492F38
:0042E91D E81404FEFF              call 0040ED36
:0042E922 68AC000000              push 000000AC
:0042E927 B9382F4900              mov ecx, 00492F38
:0042E92C E85303FEFF              call 0040EC84
:0042E931 6A00                    push 00000000
:0042E933 B9382F4900              mov ecx, 00492F38
:0042E938 E87F03FEFF              call 0040ECBC
:0042E93D C68588FEFFFF00          mov byte ptr [ebp+FFFFFE88], 00
:0042E944 EB0F                    jmp 0042E955

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042EA18(U)
|
:0042E946 8A8D88FEFFFF            mov cl, byte ptr [ebp+FFFFFE88]
:0042E94C 80C101                  add cl, 01
:0042E94F 888D88FEFFFF            mov byte ptr [ebp+FFFFFE88], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E944(U)
|
:0042E955 8B9588FEFFFF            mov edx, dword ptr [ebp+FFFFFE88]
:0042E95B 81E2FF000000            and edx, 000000FF
:0042E961 8B4514                  mov eax, dword ptr [ebp+14]
:0042E964 25FF000000              and eax, 000000FF
:0042E969 3BD0                    cmp edx, eax
:0042E96B 0F8DAC000000            jnl 0042EA1D
:0042E971 8B8D88FEFFFF            mov ecx, dword ptr [ebp+FFFFFE88]
:0042E977 81E1FF000000            and ecx, 000000FF
:0042E97D 034DE8                  add ecx, dword ptr [ebp-18]
:0042E980 8B5510                  mov edx, dword ptr [ebp+10]
:0042E983 8B048A                  mov eax, dword ptr [edx+4*ecx]
:0042E986 50                      push eax
:0042E987 E8CE120500              call 0047FC5A
:0042E98C 83C404                  add esp, 00000004
:0042E98F 898574FEFFFF            mov dword ptr [ebp+FFFFFE74], eax
:0042E995 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0042E998 038D68FEFFFF            add ecx, dword ptr [ebp+FFFFFE68]
:0042E99E 8B45F0                  mov eax, dword ptr [ebp-10]
:0042E9A1 25FF000000              and eax, 000000FF
:0042E9A6 83E810                  sub eax, 00000010
:0042E9A9 99                      cdq
:0042E9AA 2BC2                    sub eax, edx
:0042E9AC D1F8                    sar eax, 1
:0042E9AE 03C8                    add ecx, eax
:0042E9B0 8B9588FEFFFF            mov edx, dword ptr [ebp+FFFFFE88]
:0042E9B6 81E2FF000000            and edx, 000000FF
:0042E9BC 8B45F0                  mov eax, dword ptr [ebp-10]
:0042E9BF 25FF000000              and eax, 000000FF
:0042E9C4 0FAFD0                  imul edx, eax
:0042E9C7 03CA                    add ecx, edx
:0042E9C9 51                      push ecx
:0042E9CA 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042E9CD C1E903                  shr ecx, 03
:0042E9D0 8B5520                  mov edx, dword ptr [ebp+20]
:0042E9D3 81E2FF000000            and edx, 000000FF
:0042E9D9 2B9574FEFFFF            sub edx, dword ptr [ebp+FFFFFE74]
:0042E9DF D1EA                    shr edx, 1
:0042E9E1 8D441101                lea eax, dword ptr [ecx+edx+01]
:0042E9E5 50                      push eax
:0042E9E6 B9382F4900              mov ecx, 00492F38
:0042E9EB E8E701FEFF              call 0040EBD7
:0042E9F0 8B8D88FEFFFF            mov ecx, dword ptr [ebp+FFFFFE88]
:0042E9F6 81E1FF000000            and ecx, 000000FF
:0042E9FC 034DE8                  add ecx, dword ptr [ebp-18]
:0042E9FF 8B5510                  mov edx, dword ptr [ebp+10]
:0042EA02 8B048A                  mov eax, dword ptr [edx+4*ecx]
:0042EA05 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:0042EA06 6830C84800              push 0048C830
:0042EA0B 68382F4900              push 00492F38
:0042EA10 E88B10FEFF              call 0040FAA0
:0042EA15 83C40C                  add esp, 0000000C
:0042EA18 E929FFFFFF              jmp 0042E946

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E96B(C)
|
:0042EA1D EB23                    jmp 0042EA42

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E910(C)
|
:0042EA1F 6A00                    push 00000000
:0042EA21 6A14                    push 00000014
:0042EA23 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0042EA26 038D68FEFFFF            add ecx, dword ptr [ebp+FFFFFE68]
:0042EA2C 51                      push ecx
:0042EA2D 8B5508                  mov edx, dword ptr [ebp+08]
:0042EA30 C1EA03                  shr edx, 03
:0042EA33 83C201                  add edx, 00000001
:0042EA36 52                      push edx
:0042EA37 8D8D8CFEFFFF            lea ecx, dword ptr [ebp+FFFFFE8C]
:0042EA3D E8A3560400              call 004740E5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042EA1D(U)
|
:0042EA42 B9B07F4900              mov ecx, 00497FB0
:0042EA47 E81A76FFFF              call 00426066
:0042EA4C C78564FEFFFFFEFF0000    mov dword ptr [ebp+FFFFFE64], 0000FFFE
:0042EA56 E8A5DBFFFF              call 0042C600
:0042EA5B C7856CFEFFFF01000000    mov dword ptr [ebp+FFFFFE6C], 00000001
:0042EA65 C745D8FEFF0000          mov [ebp-28], 0000FFFE
:0042EA6C C78578FEFFFF00000000    mov dword ptr [ebp+FFFFFE78], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042EFEA(U)
|
:0042EA76 83BD6CFEFFFF00          cmp dword ptr [ebp+FFFFFE6C], 00000000
:0042EA7D 0F846C050000            je 0042EFEF
:0042EA83 E83C000500              call 0047EAC4
:0042EA88 8B8584FEFFFF            mov eax, dword ptr [ebp+FFFFFE84]
:0042EA8E 25FF000000              and eax, 000000FF
:0042EA93 85C0                    test eax, eax
:0042EA95 7573                    jne 0042EB0A
:0042EA97 6A00                    push 00000000
:0042EA99 E87DCDFFFF              call 0042B81B
:0042EA9E 83C404                  add esp, 00000004
:0042EAA1 B9B07F4900              mov ecx, 00497FB0
:0042EAA6 E86271FFFF              call 00425C0D
:0042EAAB 83F801                  cmp eax, 00000001
:0042EAAE 7555                    jne 0042EB05
:0042EAB0 8D8D8CFEFFFF            lea ecx, dword ptr [ebp+FFFFFE8C]
:0042EAB6 E824570400              call 004741DF
:0042EABB 25FF000000              and eax, 000000FF
:0042EAC0 898564FEFFFF            mov dword ptr [ebp+FFFFFE64], eax
:0042EAC6 81BD64FEFFFFFF000000    cmp dword ptr [ebp+FFFFFE64], 000000FF
:0042EAD0 7405                    je 0042EAD7
:0042EAD2 E918050000              jmp 0042EFEF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042EAD0(C)
|
:0042EAD7 8D8D8CFEFFFF            lea ecx, dword ptr [ebp+FFFFFE8C]
:0042EADD E855570400              call 00474237
:0042EAE2 85C0                    test eax, eax
:0042EAE4 751F                    jne 0042EB05
:0042EAE6 8B4D18                  mov ecx, dword ptr [ebp+18]
:0042EAE9 81E1FF000000            and ecx, 000000FF
:0042EAEF 83E101                  and ecx, 00000001
:0042EAF2 85C9                    test ecx, ecx
:0042EAF4 750F                    jne 0042EB05
:0042EAF6 C78564FEFFFFFEFF0000    mov dword ptr [ebp+FFFFFE64], 0000FFFE
:0042EB00 E9EA040000              jmp 0042EFEF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042EAAE(C), :0042EAE4(C), :0042EAF4(C)
|
:0042EB05 E9B6040000              jmp 0042EFC0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042EA95(C)
|
:0042EB0A B9B07F4900              mov ecx, 00497FB0
:0042EB0F E8AE70FFFF              call 00425BC2
:0042EB14 B9B07F4900              mov ecx, 00497FB0
:0042EB19 E80871FFFF              call 00425C26
:0042EB1E 89855CFEFFFF            mov dword ptr [ebp+FFFFFE5C], eax
:0042EB24 B9B07F4900              mov ecx, 00497FB0
:0042EB29 E80971FFFF              call 00425C37
:0042EB2E 898558FEFFFF            mov dword ptr [ebp+FFFFFE58], eax
:0042EB34 C78554FEFFFF00000000    mov dword ptr [ebp+FFFFFE54], 00000000
:0042EB3E 8B955CFEFFFF            mov edx, dword ptr [ebp+FFFFFE5C]
:0042EB44 3B5508                  cmp edx, dword ptr [ebp+08]
:0042EB47 7267                    jb 0042EBB0
:0042EB49 8B855CFEFFFF            mov eax, dword ptr [ebp+FFFFFE5C]
:0042EB4F 3B45E4                  cmp eax, dword ptr [ebp-1C]
:0042EB52 735C                    jnb 0042EBB0
:0042EB54 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0042EB57 038D68FEFFFF            add ecx, dword ptr [ebp+FFFFFE68]
:0042EB5D 398D58FEFFFF            cmp dword ptr [ebp+FFFFFE58], ecx
:0042EB63 724B                    jb 0042EBB0
:0042EB65 8B5514                  mov edx, dword ptr [ebp+14]
:0042EB68 81E2FF000000            and edx, 000000FF
:0042EB6E 8B45F0                  mov eax, dword ptr [ebp-10]
:0042EB71 25FF000000              and eax, 000000FF
:0042EB76 0FAFD0                  imul edx, eax
:0042EB79 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0042EB7C 03CA                    add ecx, edx
:0042EB7E 038D68FEFFFF            add ecx, dword ptr [ebp+FFFFFE68]
:0042EB84 398D58FEFFFF            cmp dword ptr [ebp+FFFFFE58], ecx
:0042EB8A 7324                    jnb 0042EBB0
:0042EB8C 8B8558FEFFFF            mov eax, dword ptr [ebp+FFFFFE58]
:0042EB92 2B450C                  sub eax, dword ptr [ebp+0C]
:0042EB95 2B8568FEFFFF            sub eax, dword ptr [ebp+FFFFFE68]
:0042EB9B 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0042EB9E 81E1FF000000            and ecx, 000000FF
:0042EBA4 33D2                    xor edx, edx
:0042EBA6 F7F1                    div ecx
:0042EBA8 898564FEFFFF            mov dword ptr [ebp+FFFFFE64], eax
:0042EBAE EB65                    jmp 0042EC15

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042EB47(C), :0042EB52(C), :0042EB63(C), :0042EB8A(C)
|
:0042EBB0 C78564FEFFFFFEFF0000    mov dword ptr [ebp+FFFFFE64], 0000FFFE
:0042EBBA 8B955CFEFFFF            mov edx, dword ptr [ebp+FFFFFE5C]
:0042EBC0 3B55E4                  cmp edx, dword ptr [ebp-1C]
:0042EBC3 7250                    jb 0042EC15
:0042EBC5 8B45E4                  mov eax, dword ptr [ebp-1C]
:0042EBC8 83C010                  add eax, 00000010
:0042EBCB 39855CFEFFFF            cmp dword ptr [ebp+FFFFFE5C], eax
:0042EBD1 7342                    jnb 0042EC15
:0042EBD3 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0042EBD6 038D68FEFFFF            add ecx, dword ptr [ebp+FFFFFE68]
:0042EBDC 398D58FEFFFF            cmp dword ptr [ebp+FFFFFE58], ecx
:0042EBE2 7231                    jb 0042EC15
:0042EBE4 8B5514                  mov edx, dword ptr [ebp+14]
:0042EBE7 81E2FF000000            and edx, 000000FF
:0042EBED 8B45F0                  mov eax, dword ptr [ebp-10]
:0042EBF0 25FF000000              and eax, 000000FF
:0042EBF5 0FAFD0                  imul edx, eax
:0042EBF8 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0042EBFB 03CA                    add ecx, edx
:0042EBFD 038D68FEFFFF            add ecx, dword ptr [ebp+FFFFFE68]
:0042EC03 398D58FEFFFF            cmp dword ptr [ebp+FFFFFE58], ecx
:0042EC09 730A                    jnb 0042EC15
:0042EC0B C78554FEFFFF01000000    mov dword ptr [ebp+FFFFFE54], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042EBAE(U), :0042EBC3(C), :0042EBD1(C), :0042EBE2(C), :0042EC09(C)
|
:0042EC15 8B55D8                  mov edx, dword ptr [ebp-28]
:0042EC18 3B9564FEFFFF            cmp edx, dword ptr [ebp+FFFFFE64]
:0042EC1E 0F8419010000            je 0042ED3D
:0042EC24 817DD8FEFF0000          cmp dword ptr [ebp-28], 0000FFFE
:0042EC2B 7462                    je 0042EC8F
:0042EC2D 83BD78FEFFFF01          cmp dword ptr [ebp+FFFFFE78], 00000001
:0042EC34 744F                    je 0042EC85
:0042EC36 6A00                    push 00000000
:0042EC38 E8A6DE0400              call 0047CAE3
:0042EC3D 83C404                  add esp, 00000004
:0042EC40 B990F44A00              mov ecx, 004AF490
:0042EC45 E846F4FDFF              call 0040E090
:0042EC4A 50                      push eax
:0042EC4B 6A14                    push 00000014
:0042EC4D 8B4520                  mov eax, dword ptr [ebp+20]
:0042EC50 25FF000000              and eax, 000000FF
:0042EC55 C1E003                  shl eax, 03
:0042EC58 50                      push eax
:0042EC59 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0042EC5C 038D68FEFFFF            add ecx, dword ptr [ebp+FFFFFE68]
:0042EC62 8B55F0                  mov edx, dword ptr [ebp-10]
:0042EC65 81E2FF000000            and edx, 000000FF
:0042EC6B 8B45D8                  mov eax, dword ptr [ebp-28]
:0042EC6E 0FAFC2                  imul eax, edx
:0042EC71 03C8                    add ecx, eax
:0042EC73 51                      push ecx
:0042EC74 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042EC77 83C108                  add ecx, 00000008
:0042EC7A 51                      push ecx
:0042EC7B E81BF40400              call 0047E09B
:0042EC80 83C414                  add esp, 00000014
:0042EC83 EB0A                    jmp 0042EC8F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042EC34(C)
|
:0042EC85 C78578FEFFFF00000000    mov dword ptr [ebp+FFFFFE78], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042EC2B(C), :0042EC83(U)
|
:0042EC8F 81BD64FEFFFFFEFF0000    cmp dword ptr [ebp+FFFFFE64], 0000FFFE
:0042EC99 0F848B000000            je 0042ED2A
:0042EC9F B990F44A00              mov ecx, 004AF490
:0042ECA4 E8E7F3FDFF              call 0040E090
:0042ECA9 50                      push eax
:0042ECAA 6A14                    push 00000014
:0042ECAC 8B5520                  mov edx, dword ptr [ebp+20]
:0042ECAF 81E2FF000000            and edx, 000000FF
:0042ECB5 C1E203                  shl edx, 03
:0042ECB8 52                      push edx
:0042ECB9 8B450C                  mov eax, dword ptr [ebp+0C]
:0042ECBC 038568FEFFFF            add eax, dword ptr [ebp+FFFFFE68]
:0042ECC2 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0042ECC5 81E1FF000000            and ecx, 000000FF
:0042ECCB 8B9564FEFFFF            mov edx, dword ptr [ebp+FFFFFE64]
:0042ECD1 0FAFD1                  imul edx, ecx
:0042ECD4 03C2                    add eax, edx
:0042ECD6 50                      push eax
:0042ECD7 8B4508                  mov eax, dword ptr [ebp+08]
:0042ECDA 83C008                  add eax, 00000008
:0042ECDD 50                      push eax
:0042ECDE E86EF50400              call 0047E251
:0042ECE3 83C414                  add esp, 00000014
:0042ECE6 6A3A                    push 0000003A
:0042ECE8 6A01                    push 00000001
:0042ECEA 6A14                    push 00000014
:0042ECEC 8B4D20                  mov ecx, dword ptr [ebp+20]
:0042ECEF 81E1FF000000            and ecx, 000000FF
:0042ECF5 8D14CDF8FFFFFF          lea edx, dword ptr [8*ecx+FFFFFFF8]
:0042ECFC 52                      push edx
:0042ECFD 8B450C                  mov eax, dword ptr [ebp+0C]
:0042ED00 038568FEFFFF            add eax, dword ptr [ebp+FFFFFE68]
:0042ED06 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0042ED09 81E1FF000000            and ecx, 000000FF
:0042ED0F 8B9564FEFFFF            mov edx, dword ptr [ebp+FFFFFE64]
:0042ED15 0FAFD1                  imul edx, ecx
:0042ED18 03C2                    add eax, edx
:0042ED1A 50                      push eax
:0042ED1B 8B4508                  mov eax, dword ptr [ebp+08]
:0042ED1E 83C00C                  add eax, 0000000C
:0042ED21 50                      push eax
:0042ED22 E87CF9FEFF              call 0041E6A3
:0042ED27 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042EC99(C)
|
:0042ED2A B9B07F4900              mov ecx, 00497FB0
:0042ED2F E83273FFFF              call 00426066
:0042ED34 8B8D64FEFFFF            mov ecx, dword ptr [ebp+FFFFFE64]
:0042ED3A 894DD8                  mov dword ptr [ebp-28], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042EC1E(C)
|
:0042ED3D B9B07F4900              mov ecx, 00497FB0
:0042ED42 E8C66EFFFF              call 00425C0D
:0042ED47 83F801                  cmp eax, 00000001
:0042ED4A 0F8570020000            jne 0042EFC0
:0042ED50 C78578FEFFFF00000000    mov dword ptr [ebp+FFFFFE78], 00000000
:0042ED5A 8B55DC                  mov edx, dword ptr [ebp-24]
:0042ED5D 81E2FF000000            and edx, 000000FF
:0042ED63 83FA01                  cmp edx, 00000001
:0042ED66 7529                    jne 0042ED91
:0042ED68 8D4DC0                  lea ecx, dword ptr [ebp-40]
:0042ED6B E8AD490400              call 0047371D
:0042ED70 898548FEFFFF            mov dword ptr [ebp+FFFFFE48], eax
:0042ED76 8B8548FEFFFF            mov eax, dword ptr [ebp+FFFFFE48]
:0042ED7C 3B45E8                  cmp eax, dword ptr [ebp-18]
:0042ED7F 7410                    je 0042ED91
:0042ED81 8B8D48FEFFFF            mov ecx, dword ptr [ebp+FFFFFE48]
:0042ED87 894DE8                  mov dword ptr [ebp-18], ecx
:0042ED8A C745EC01000000          mov [ebp-14], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042ED66(C), :0042ED7F(C)
|
:0042ED91 B9B07F4900              mov ecx, 00497FB0
:0042ED96 E8276EFFFF              call 00425BC2
:0042ED9B B9B07F4900              mov ecx, 00497FB0
:0042EDA0 E8816EFFFF              call 00425C26
:0042EDA5 898550FEFFFF            mov dword ptr [ebp+FFFFFE50], eax
:0042EDAB B9B07F4900              mov ecx, 00497FB0
:0042EDB0 E8826EFFFF              call 00425C37
:0042EDB5 89854CFEFFFF            mov dword ptr [ebp+FFFFFE4C], eax
:0042EDBB 8B9550FEFFFF            mov edx, dword ptr [ebp+FFFFFE50]
:0042EDC1 3B5508                  cmp edx, dword ptr [ebp+08]
:0042EDC4 7245                    jb 0042EE0B
:0042EDC6 8B8550FEFFFF            mov eax, dword ptr [ebp+FFFFFE50]
:0042EDCC 3B45E4                  cmp eax, dword ptr [ebp-1C]
:0042EDCF 733A                    jnb 0042EE0B
:0042EDD1 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0042EDD4 038D68FEFFFF            add ecx, dword ptr [ebp+FFFFFE68]
:0042EDDA 398D4CFEFFFF            cmp dword ptr [ebp+FFFFFE4C], ecx
:0042EDE0 7229                    jb 0042EE0B
:0042EDE2 8B5514                  mov edx, dword ptr [ebp+14]
:0042EDE5 81E2FF000000            and edx, 000000FF
:0042EDEB 8B45F0                  mov eax, dword ptr [ebp-10]
:0042EDEE 25FF000000              and eax, 000000FF
:0042EDF3 0FAFD0                  imul edx, eax
:0042EDF6 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0042EDF9 03CA                    add ecx, edx
:0042EDFB 038D68FEFFFF            add ecx, dword ptr [ebp+FFFFFE68]
:0042EE01 398D4CFEFFFF            cmp dword ptr [ebp+FFFFFE4C], ecx
:0042EE07 7302                    jnb 0042EE0B
:0042EE09 EB0A                    jmp 0042EE15

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042EDC4(C), :0042EDCF(C), :0042EDE0(C), :0042EE07(C)
|
:0042EE0B C78564FEFFFFFF000000    mov dword ptr [ebp+FFFFFE64], 000000FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042EE09(U)
|
:0042EE15 837DEC00                cmp dword ptr [ebp-14], 00000000
:0042EE19 0F8473010000            je 0042EF92
:0042EE1F C78578FEFFFF01000000    mov dword ptr [ebp+FFFFFE78], 00000001
:0042EE29 C745D8FF000000          mov [ebp-28], 000000FF
:0042EE30 8B55D8                  mov edx, dword ptr [ebp-28]
:0042EE33 899564FEFFFF            mov dword ptr [ebp+FFFFFE64], edx
:0042EE39 E89DF7FEFF              call 0041E5DB
:0042EE3E 6A04                    push 00000004
:0042EE40 6A00                    push 00000000
:0042EE42 6A00                    push 00000000
:0042EE44 B9C8E44A00              mov ecx, 004AE4C8
:0042EE49 E8F20B0500              call 0047FA40
:0042EE4E 50                      push eax
:0042EE4F 8B4514                  mov eax, dword ptr [ebp+14]
:0042EE52 25FF000000              and eax, 000000FF
:0042EE57 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0042EE5A 81E1FF000000            and ecx, 000000FF
:0042EE60 0FAFC1                  imul eax, ecx
:0042EE63 50                      push eax
:0042EE64 8B5520                  mov edx, dword ptr [ebp+20]
:0042EE67 81E2FF000000            and edx, 000000FF
:0042EE6D C1E203                  shl edx, 03
:0042EE70 52                      push edx
:0042EE71 8B450C                  mov eax, dword ptr [ebp+0C]
:0042EE74 038568FEFFFF            add eax, dword ptr [ebp+FFFFFE68]
:0042EE7A 50                      push eax
:0042EE7B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042EE7E 83C108                  add ecx, 00000008
:0042EE81 51                      push ecx
:0042EE82 E814F20400              call 0047E09B
:0042EE87 83C414                  add esp, 00000014
:0042EE8A 68AC000000              push 000000AC
:0042EE8F B9382F4900              mov ecx, 00492F38
:0042EE94 E8EBFDFDFF              call 0040EC84
:0042EE99 C68588FEFFFF00          mov byte ptr [ebp+FFFFFE88], 00
:0042EEA0 EB0F                    jmp 0042EEB1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042EF72(U)
|
:0042EEA2 8A9588FEFFFF            mov dl, byte ptr [ebp+FFFFFE88]
:0042EEA8 80C201                  add dl, 01
:0042EEAB 889588FEFFFF            mov byte ptr [ebp+FFFFFE88], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042EEA0(U)
|
:0042EEB1 8B8588FEFFFF            mov eax, dword ptr [ebp+FFFFFE88]
:0042EEB7 25FF000000              and eax, 000000FF
:0042EEBC 8B4D14                  mov ecx, dword ptr [ebp+14]
:0042EEBF 81E1FF000000            and ecx, 000000FF
:0042EEC5 3BC1                    cmp eax, ecx
:0042EEC7 0F8DAA000000            jnl 0042EF77
:0042EECD 8B9588FEFFFF            mov edx, dword ptr [ebp+FFFFFE88]
:0042EED3 81E2FF000000            and edx, 000000FF
:0042EED9 0355E8                  add edx, dword ptr [ebp-18]
:0042EEDC 8B4510                  mov eax, dword ptr [ebp+10]
:0042EEDF 8B0C90                  mov ecx, dword ptr [eax+4*edx]
:0042EEE2 51                      push ecx
:0042EEE3 E8720D0500              call 0047FC5A
:0042EEE8 83C404                  add esp, 00000004
:0042EEEB 898574FEFFFF            mov dword ptr [ebp+FFFFFE74], eax
:0042EEF1 8B8D88FEFFFF            mov ecx, dword ptr [ebp+FFFFFE88]
:0042EEF7 81E1FF000000            and ecx, 000000FF
:0042EEFD 8B55F0                  mov edx, dword ptr [ebp-10]
:0042EF00 81E2FF000000            and edx, 000000FF
:0042EF06 0FAFCA                  imul ecx, edx
:0042EF09 034D0C                  add ecx, dword ptr [ebp+0C]
:0042EF0C 038D68FEFFFF            add ecx, dword ptr [ebp+FFFFFE68]
:0042EF12 8B45F0                  mov eax, dword ptr [ebp-10]
:0042EF15 25FF000000              and eax, 000000FF
:0042EF1A 83E810                  sub eax, 00000010
:0042EF1D 99                      cdq
:0042EF1E 2BC2                    sub eax, edx
:0042EF20 D1F8                    sar eax, 1
:0042EF22 03C8                    add ecx, eax
:0042EF24 51                      push ecx
:0042EF25 8B4508                  mov eax, dword ptr [ebp+08]
:0042EF28 C1E803                  shr eax, 03
:0042EF2B 8B4D20                  mov ecx, dword ptr [ebp+20]
:0042EF2E 81E1FF000000            and ecx, 000000FF
:0042EF34 2B8D74FEFFFF            sub ecx, dword ptr [ebp+FFFFFE74]
:0042EF3A D1E9                    shr ecx, 1
:0042EF3C 8D540801                lea edx, dword ptr [eax+ecx+01]
:0042EF40 52                      push edx
:0042EF41 B9382F4900              mov ecx, 00492F38
:0042EF46 E88CFCFDFF              call 0040EBD7
:0042EF4B 8B8588FEFFFF            mov eax, dword ptr [ebp+FFFFFE88]
:0042EF51 25FF000000              and eax, 000000FF
:0042EF56 0345E8                  add eax, dword ptr [ebp-18]
:0042EF59 8B4D10                  mov ecx, dword ptr [ebp+10]
:0042EF5C 8B1481                  mov edx, dword ptr [ecx+4*eax]
:0042EF5F 52                      push edx

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:0042EF60 6834C84800              push 0048C834
:0042EF65 68382F4900              push 00492F38
:0042EF6A E8310BFEFF              call 0040FAA0
:0042EF6F 83C40C                  add esp, 0000000C
:0042EF72 E92BFFFFFF              jmp 0042EEA2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042EEC7(C)
|
:0042EF77 E87AF6FEFF              call 0041E5F6
:0042EF7C B9B07F4900              mov ecx, 00497FB0
:0042EF81 E8E070FFFF              call 00426066
:0042EF86 C745EC00000000          mov [ebp-14], 00000000
:0042EF8D E86ED6FFFF              call 0042C600

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042EE19(C)
|
:0042EF92 81BD64FEFFFFFEFF0000    cmp dword ptr [ebp+FFFFFE64], 0000FFFE
:0042EF9C 7417                    je 0042EFB5
:0042EF9E 81BD64FEFFFFFF000000    cmp dword ptr [ebp+FFFFFE64], 000000FF
:0042EFA8 740B                    je 0042EFB5
:0042EFAA 83BD78FEFFFF01          cmp dword ptr [ebp+FFFFFE78], 00000001
:0042EFB1 7402                    je 0042EFB5
:0042EFB3 EB3A                    jmp 0042EFEF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042EF9C(C), :0042EFA8(C), :0042EFB1(C)
|
:0042EFB5 83BD54FEFFFF00          cmp dword ptr [ebp+FFFFFE54], 00000000
:0042EFBC 7502                    jne 0042EFC0
:0042EFBE EB2F                    jmp 0042EFEF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042EB05(U), :0042ED4A(C), :0042EFBC(C)
|
:0042EFC0 B9B07F4900              mov ecx, 00497FB0
:0042EFC5 E8436CFFFF              call 00425C0D
:0042EFCA 83F802                  cmp eax, 00000002
:0042EFCD 751B                    jne 0042EFEA
:0042EFCF 8B4518                  mov eax, dword ptr [ebp+18]
:0042EFD2 25FF000000              and eax, 000000FF
:0042EFD7 83E001                  and eax, 00000001
:0042EFDA 85C0                    test eax, eax
:0042EFDC 750C                    jne 0042EFEA
:0042EFDE C78564FEFFFFFEFF0000    mov dword ptr [ebp+FFFFFE64], 0000FFFE
:0042EFE8 EB05                    jmp 0042EFEF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042EFCD(C), :0042EFDC(C)
|
:0042EFEA E987FAFFFF              jmp 0042EA76

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042EA7D(C), :0042EAD2(U), :0042EB00(U), :0042EFB3(U), :0042EFBE(U)
|:0042EFE8(U)
|
:0042EFEF E80CD6FFFF              call 0042C600
:0042EFF4 8B8D70FEFFFF            mov ecx, dword ptr [ebp+FFFFFE70]
:0042EFFA 81E1FF000000            and ecx, 000000FF
:0042F000 85C9                    test ecx, ecx
:0042F002 7402                    je 0042F006
:0042F004 EB0A                    jmp 0042F010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F002(C)
|
:0042F006 B930694B00              mov ecx, 004B6930
:0042F00B E813460400              call 00473623

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F004(U)
|
:0042F010 837D2400                cmp dword ptr [ebp+24], 00000000
:0042F014 7418                    je 0042F02E
:0042F016 8B5518                  mov edx, dword ptr [ebp+18]
:0042F019 81E2FF000000            and edx, 000000FF
:0042F01F 83E220                  and edx, 00000020
:0042F022 85D2                    test edx, edx
:0042F024 7408                    je 0042F02E
:0042F026 8B4524                  mov eax, dword ptr [ebp+24]
:0042F029 8A4DE8                  mov cl, byte ptr [ebp-18]
:0042F02C 8808                    mov byte ptr [eax], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F014(C), :0042F024(C)
|
:0042F02E 81BD64FEFFFFFEFF0000    cmp dword ptr [ebp+FFFFFE64], 0000FFFE
:0042F038 7509                    jne 0042F043
:0042F03A C6853BFEFFFFFF          mov byte ptr [ebp+FFFFFE3B], FF
:0042F041 EB0F                    jmp 0042F052

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F038(C)
|
:0042F043 8B55E8                  mov edx, dword ptr [ebp-18]
:0042F046 039564FEFFFF            add edx, dword ptr [ebp+FFFFFE64]
:0042F04C 88953BFEFFFF            mov byte ptr [ebp+FFFFFE3B], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F041(U)
|
:0042F052 8A853BFEFFFF            mov al, byte ptr [ebp+FFFFFE3B]
:0042F058 888544FEFFFF            mov byte ptr [ebp+FFFFFE44], al
:0042F05E C645FC00                mov [ebp-04], 00
:0042F062 8D4DC0                  lea ecx, dword ptr [ebp-40]
:0042F065 E8A6C4FFFF              call 0042B510
:0042F06A C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0042F071 8D8D8CFEFFFF            lea ecx, dword ptr [ebp+FFFFFE8C]
:0042F077 E8A4090000              call 0042FA20
:0042F07C 8A8544FEFFFF            mov al, byte ptr [ebp+FFFFFE44]
:0042F082 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042F085 64890D00000000          mov dword ptr fs:[00000000], ecx
:0042F08C 8BE5                    mov esp, ebp
:0042F08E 5D                      pop ebp
:0042F08F C3                      ret



* Referenced by a CALL at Addresses:
|:0042F126   , :0042F2FD   
|
:0042F090 55                      push ebp
:0042F091 8BEC                    mov ebp, esp
:0042F093 83EC0C                  sub esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F0AA(U)
|
:0042F096 8B4508                  mov eax, dword ptr [ebp+08]
:0042F099 33C9                    xor ecx, ecx
:0042F09B 8A08                    mov cl, byte ptr [eax]
:0042F09D 85C9                    test ecx, ecx
:0042F09F 740B                    je 0042F0AC
:0042F0A1 8B5508                  mov edx, dword ptr [ebp+08]
:0042F0A4 83C201                  add edx, 00000001
:0042F0A7 895508                  mov dword ptr [ebp+08], edx
:0042F0AA EBEA                    jmp 0042F096

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F09F(C)
|
:0042F0AC 8D45F4                  lea eax, dword ptr [ebp-0C]
:0042F0AF 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F0E2(C)
|
:0042F0B2 8B450C                  mov eax, dword ptr [ebp+0C]
:0042F0B5 33D2                    xor edx, edx
:0042F0B7 B90A000000              mov ecx, 0000000A
:0042F0BC F7F1                    div ecx
:0042F0BE 83C230                  add edx, 00000030
:0042F0C1 8B45FC                  mov eax, dword ptr [ebp-04]
:0042F0C4 8810                    mov byte ptr [eax], dl
:0042F0C6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042F0C9 83C101                  add ecx, 00000001
:0042F0CC 894DFC                  mov dword ptr [ebp-04], ecx
:0042F0CF 8B450C                  mov eax, dword ptr [ebp+0C]
:0042F0D2 33D2                    xor edx, edx
:0042F0D4 B90A000000              mov ecx, 0000000A
:0042F0D9 F7F1                    div ecx
:0042F0DB 89450C                  mov dword ptr [ebp+0C], eax
:0042F0DE 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0042F0E2 75CE                    jne 0042F0B2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F108(C)
|
:0042F0E4 8B55FC                  mov edx, dword ptr [ebp-04]
:0042F0E7 83EA01                  sub edx, 00000001
:0042F0EA 8955FC                  mov dword ptr [ebp-04], edx
:0042F0ED 8B4508                  mov eax, dword ptr [ebp+08]
:0042F0F0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042F0F3 8A11                    mov dl, byte ptr [ecx]
:0042F0F5 8810                    mov byte ptr [eax], dl
:0042F0F7 8B4508                  mov eax, dword ptr [ebp+08]
:0042F0FA 83C001                  add eax, 00000001
:0042F0FD 894508                  mov dword ptr [ebp+08], eax
:0042F100 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042F103 8D55F4                  lea edx, dword ptr [ebp-0C]
:0042F106 3BCA                    cmp ecx, edx
:0042F108 75DA                    jne 0042F0E4
:0042F10A 8B4508                  mov eax, dword ptr [ebp+08]
:0042F10D C60000                  mov byte ptr [eax], 00
:0042F110 8BE5                    mov esp, ebp
:0042F112 5D                      pop ebp
:0042F113 C3                      ret



* Referenced by a CALL at Addresses:
|:0042F329   , :0044FB6E   
|
:0042F114 55                      push ebp
:0042F115 8BEC                    mov ebp, esp
:0042F117 83EC14                  sub esp, 00000014
:0042F11A C645F000                mov [ebp-10], 00
:0042F11E 8B450C                  mov eax, dword ptr [ebp+0C]
:0042F121 50                      push eax
:0042F122 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0042F125 51                      push ecx
:0042F126 E865FFFFFF              call 0042F090
:0042F12B 83C408                  add esp, 00000008
:0042F12E 8B5508                  mov edx, dword ptr [ebp+08]
:0042F131 8955FC                  mov dword ptr [ebp-04], edx
:0042F134 C645EC00                mov [ebp-14], 00
:0042F138 EB08                    jmp 0042F142

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F184(U)
|
:0042F13A 8A45EC                  mov al, byte ptr [ebp-14]
:0042F13D 0401                    add al, 01
:0042F13F 8845EC                  mov byte ptr [ebp-14], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F138(U)
|
:0042F142 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0042F145 81E1FF000000            and ecx, 000000FF
:0042F14B 33D2                    xor edx, edx
:0042F14D 8A540DF0                mov dl, byte ptr [ebp+ecx-10]
:0042F151 85D2                    test edx, edx
:0042F153 7431                    je 0042F186
:0042F155 8B45FC                  mov eax, dword ptr [ebp-04]
:0042F158 C600A2                  mov byte ptr [eax], A2
:0042F15B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042F15E 83C101                  add ecx, 00000001
:0042F161 894DFC                  mov dword ptr [ebp-04], ecx
:0042F164 8B55EC                  mov edx, dword ptr [ebp-14]
:0042F167 81E2FF000000            and edx, 000000FF
:0042F16D 33C0                    xor eax, eax
:0042F16F 8A4415F0                mov al, byte ptr [ebp+edx-10]
:0042F173 83C07F                  add eax, 0000007F
:0042F176 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042F179 8801                    mov byte ptr [ecx], al
:0042F17B 8B55FC                  mov edx, dword ptr [ebp-04]
:0042F17E 83C201                  add edx, 00000001
:0042F181 8955FC                  mov dword ptr [ebp-04], edx
:0042F184 EBB4                    jmp 0042F13A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F153(C)
|
:0042F186 8B45FC                  mov eax, dword ptr [ebp-04]
:0042F189 C60000                  mov byte ptr [eax], 00
:0042F18C 8BE5                    mov esp, ebp
:0042F18E 5D                      pop ebp
:0042F18F C3                      ret



* Referenced by a CALL at Addresses:
|:0042F429   , :0042F6AA   
|
:0042F190 55                      push ebp
:0042F191 8BEC                    mov ebp, esp
:0042F193 83EC4C                  sub esp, 0000004C
:0042F196 C745F4181A4B00          mov [ebp-0C], 004B1A18
:0042F19D 8B4508                  mov eax, dword ptr [ebp+08]
:0042F1A0 8B08                    mov ecx, dword ptr [eax]
:0042F1A2 894DC0                  mov dword ptr [ebp-40], ecx
:0042F1A5 8B5508                  mov edx, dword ptr [ebp+08]
:0042F1A8 83C204                  add edx, 00000004
:0042F1AB 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F413(U)
|
:0042F1AE 8B45C0                  mov eax, dword ptr [ebp-40]
:0042F1B1 33C9                    xor ecx, ecx
:0042F1B3 8A08                    mov cl, byte ptr [eax]
:0042F1B5 85C9                    test ecx, ecx
:0042F1B7 0F845B020000            je 0042F418
:0042F1BD 8B55C0                  mov edx, dword ptr [ebp-40]
:0042F1C0 33C0                    xor eax, eax
:0042F1C2 8A02                    mov al, byte ptr [edx]
:0042F1C4 3D80000000              cmp eax, 00000080
:0042F1C9 0F8D0C020000            jnl 0042F3DB
:0042F1CF 8B4DC0                  mov ecx, dword ptr [ebp-40]
:0042F1D2 33D2                    xor edx, edx
:0042F1D4 8A11                    mov dl, byte ptr [ecx]
:0042F1D6 83FA25                  cmp edx, 00000025
:0042F1D9 0F85DE010000            jne 0042F3BD
:0042F1DF 8B45C0                  mov eax, dword ptr [ebp-40]
:0042F1E2 83C001                  add eax, 00000001
:0042F1E5 8945C0                  mov dword ptr [ebp-40], eax
:0042F1E8 8B4DC0                  mov ecx, dword ptr [ebp-40]
:0042F1EB 33D2                    xor edx, edx
:0042F1ED 8A11                    mov dl, byte ptr [ecx]
:0042F1EF 83FA30                  cmp edx, 00000030
:0042F1F2 7E24                    jle 0042F218
:0042F1F4 8B45C0                  mov eax, dword ptr [ebp-40]
:0042F1F7 33C9                    xor ecx, ecx
:0042F1F9 8A08                    mov cl, byte ptr [eax]
:0042F1FB 83F939                  cmp ecx, 00000039
:0042F1FE 7D18                    jge 0042F218
:0042F200 8B55C0                  mov edx, dword ptr [ebp-40]
:0042F203 33C0                    xor eax, eax
:0042F205 8A02                    mov al, byte ptr [edx]
:0042F207 83E830                  sub eax, 00000030
:0042F20A 8945FC                  mov dword ptr [ebp-04], eax
:0042F20D 8B4DC0                  mov ecx, dword ptr [ebp-40]
:0042F210 83C101                  add ecx, 00000001
:0042F213 894DC0                  mov dword ptr [ebp-40], ecx
:0042F216 EB07                    jmp 0042F21F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F1F2(C), :0042F1FE(C)
|
:0042F218 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F216(U)
|
:0042F21F 8B55C0                  mov edx, dword ptr [ebp-40]
:0042F222 33C0                    xor eax, eax
:0042F224 8A02                    mov al, byte ptr [edx]
:0042F226 8945B8                  mov dword ptr [ebp-48], eax
:0042F229 8B4DC0                  mov ecx, dword ptr [ebp-40]
:0042F22C 83C101                  add ecx, 00000001
:0042F22F 894DC0                  mov dword ptr [ebp-40], ecx
:0042F232 8B55B8                  mov edx, dword ptr [ebp-48]
:0042F235 8955B4                  mov dword ptr [ebp-4C], edx
:0042F238 837DB473                cmp dword ptr [ebp-4C], 00000073
:0042F23C 7419                    je 0042F257
:0042F23E 837DB475                cmp dword ptr [ebp-4C], 00000075
:0042F242 0F849A000000            je 0042F2E2
:0042F248 837DB477                cmp dword ptr [ebp-4C], 00000077
:0042F24C 0F8490000000            je 0042F2E2
:0042F252 E964010000              jmp 0042F3BB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F23C(C)
|
:0042F257 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F25A C60000                  mov byte ptr [eax], 00
:0042F25D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042F260 8B11                    mov edx, dword ptr [ecx]
:0042F262 52                      push edx
:0042F263 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F266 50                      push eax
:0042F267 E8340A0500              call 0047FCA0
:0042F26C 83C408                  add esp, 00000008
:0042F26F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042F272 8B11                    mov edx, dword ptr [ecx]
:0042F274 52                      push edx
:0042F275 E8E0090500              call 0047FC5A
:0042F27A 83C404                  add esp, 00000004
:0042F27D 8845EC                  mov byte ptr [ebp-14], al
:0042F280 8B45EC                  mov eax, dword ptr [ebp-14]
:0042F283 25FF000000              and eax, 000000FF
:0042F288 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042F28B 03C8                    add ecx, eax
:0042F28D 894DF4                  mov dword ptr [ebp-0C], ecx
:0042F290 8B55EC                  mov edx, dword ptr [ebp-14]
:0042F293 81E2FF000000            and edx, 000000FF
:0042F299 3955FC                  cmp dword ptr [ebp-04], edx
:0042F29C 7636                    jbe 0042F2D4
:0042F29E C745F000000000          mov [ebp-10], 00000000
:0042F2A5 EB09                    jmp 0042F2B0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F2D2(U)
|
:0042F2A7 8B45F0                  mov eax, dword ptr [ebp-10]
:0042F2AA 83C001                  add eax, 00000001
:0042F2AD 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F2A5(U)
|
:0042F2B0 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0042F2B3 81E1FF000000            and ecx, 000000FF
:0042F2B9 8B55FC                  mov edx, dword ptr [ebp-04]
:0042F2BC 2BD1                    sub edx, ecx
:0042F2BE 3955F0                  cmp dword ptr [ebp-10], edx
:0042F2C1 7311                    jnb 0042F2D4
:0042F2C3 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F2C6 C60020                  mov byte ptr [eax], 20
:0042F2C9 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042F2CC 83C101                  add ecx, 00000001
:0042F2CF 894DF4                  mov dword ptr [ebp-0C], ecx
:0042F2D2 EBD3                    jmp 0042F2A7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F29C(C), :0042F2C1(C)
|
:0042F2D4 8B55F8                  mov edx, dword ptr [ebp-08]
:0042F2D7 83C204                  add edx, 00000004
:0042F2DA 8955F8                  mov dword ptr [ebp-08], edx
:0042F2DD E9D9000000              jmp 0042F3BB

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F242(C), :0042F24C(C)
|
:0042F2E2 C645C400                mov [ebp-3C], 00
:0042F2E6 8B45C0                  mov eax, dword ptr [ebp-40]
:0042F2E9 33C9                    xor ecx, ecx
:0042F2EB 8A48FF                  mov cl, byte ptr [eax-01]
:0042F2EE 83F975                  cmp ecx, 00000075
:0042F2F1 7514                    jne 0042F307
:0042F2F3 8B55F8                  mov edx, dword ptr [ebp-08]
:0042F2F6 8B02                    mov eax, dword ptr [edx]
:0042F2F8 50                      push eax
:0042F2F9 8D4DC4                  lea ecx, dword ptr [ebp-3C]
:0042F2FC 51                      push ecx
:0042F2FD E88EFDFFFF              call 0042F090
:0042F302 83C408                  add esp, 00000008
:0042F305 EB2A                    jmp 0042F331

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F2F1(C)
|
:0042F307 8B55FC                  mov edx, dword ptr [ebp-04]
:0042F30A D1E2                    shl edx, 1
:0042F30C 8955FC                  mov dword ptr [ebp-04], edx
:0042F30F 6A00                    push 00000000
:0042F311 6A14                    push 00000014
:0042F313 8D45C4                  lea eax, dword ptr [ebp-3C]
:0042F316 50                      push eax
:0042F317 E8F7090500              call 0047FD13
:0042F31C 83C40C                  add esp, 0000000C
:0042F31F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042F322 8B11                    mov edx, dword ptr [ecx]
:0042F324 52                      push edx
:0042F325 8D45C4                  lea eax, dword ptr [ebp-3C]
:0042F328 50                      push eax
:0042F329 E8E6FDFFFF              call 0042F114
:0042F32E 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F305(U)
|
:0042F331 8D4DC4                  lea ecx, dword ptr [ebp-3C]
:0042F334 51                      push ecx
:0042F335 E820090500              call 0047FC5A
:0042F33A 83C404                  add esp, 00000004
:0042F33D 8845EC                  mov byte ptr [ebp-14], al
:0042F340 8B55EC                  mov edx, dword ptr [ebp-14]
:0042F343 81E2FF000000            and edx, 000000FF
:0042F349 3955FC                  cmp dword ptr [ebp-04], edx
:0042F34C 763A                    jbe 0042F388
:0042F34E C645BC00                mov [ebp-44], 00
:0042F352 EB08                    jmp 0042F35C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F386(U)
|
:0042F354 8A45BC                  mov al, byte ptr [ebp-44]
:0042F357 0401                    add al, 01
:0042F359 8845BC                  mov byte ptr [ebp-44], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F352(U)
|
:0042F35C 8B4DBC                  mov ecx, dword ptr [ebp-44]
:0042F35F 81E1FF000000            and ecx, 000000FF
:0042F365 8B55EC                  mov edx, dword ptr [ebp-14]
:0042F368 81E2FF000000            and edx, 000000FF
:0042F36E 8B45FC                  mov eax, dword ptr [ebp-04]
:0042F371 2BC2                    sub eax, edx
:0042F373 3BC8                    cmp ecx, eax
:0042F375 7311                    jnb 0042F388
:0042F377 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042F37A C60120                  mov byte ptr [ecx], 20
:0042F37D 8B55F4                  mov edx, dword ptr [ebp-0C]
:0042F380 83C201                  add edx, 00000001
:0042F383 8955F4                  mov dword ptr [ebp-0C], edx
:0042F386 EBCC                    jmp 0042F354

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F34C(C), :0042F375(C)
|
:0042F388 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F38B C60000                  mov byte ptr [eax], 00
:0042F38E 8D4DC4                  lea ecx, dword ptr [ebp-3C]
:0042F391 51                      push ecx
:0042F392 8B55F4                  mov edx, dword ptr [ebp-0C]
:0042F395 52                      push edx
:0042F396 E8E2080500              call 0047FC7D
:0042F39B 83C408                  add esp, 00000008
:0042F39E 8D45C4                  lea eax, dword ptr [ebp-3C]
:0042F3A1 50                      push eax
:0042F3A2 E8B3080500              call 0047FC5A
:0042F3A7 83C404                  add esp, 00000004
:0042F3AA 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042F3AD 03C8                    add ecx, eax
:0042F3AF 894DF4                  mov dword ptr [ebp-0C], ecx
:0042F3B2 8B55F8                  mov edx, dword ptr [ebp-08]
:0042F3B5 83C204                  add edx, 00000004
:0042F3B8 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F252(U), :0042F2DD(U)
|
:0042F3BB EB1C                    jmp 0042F3D9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F1D9(C)
|
:0042F3BD 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F3C0 8B4DC0                  mov ecx, dword ptr [ebp-40]
:0042F3C3 8A11                    mov dl, byte ptr [ecx]
:0042F3C5 8810                    mov byte ptr [eax], dl
:0042F3C7 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F3CA 83C001                  add eax, 00000001
:0042F3CD 8945F4                  mov dword ptr [ebp-0C], eax
:0042F3D0 8B4DC0                  mov ecx, dword ptr [ebp-40]
:0042F3D3 83C101                  add ecx, 00000001
:0042F3D6 894DC0                  mov dword ptr [ebp-40], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F3BB(U)
|
:0042F3D9 EB38                    jmp 0042F413

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F1C9(C)
|
:0042F3DB 8B55F4                  mov edx, dword ptr [ebp-0C]
:0042F3DE 8B45C0                  mov eax, dword ptr [ebp-40]
:0042F3E1 8A08                    mov cl, byte ptr [eax]
:0042F3E3 880A                    mov byte ptr [edx], cl
:0042F3E5 8B55F4                  mov edx, dword ptr [ebp-0C]
:0042F3E8 83C201                  add edx, 00000001
:0042F3EB 8955F4                  mov dword ptr [ebp-0C], edx
:0042F3EE 8B45C0                  mov eax, dword ptr [ebp-40]
:0042F3F1 83C001                  add eax, 00000001
:0042F3F4 8945C0                  mov dword ptr [ebp-40], eax
:0042F3F7 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042F3FA 8B55C0                  mov edx, dword ptr [ebp-40]
:0042F3FD 8A02                    mov al, byte ptr [edx]
:0042F3FF 8801                    mov byte ptr [ecx], al
:0042F401 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042F404 83C101                  add ecx, 00000001
:0042F407 894DF4                  mov dword ptr [ebp-0C], ecx
:0042F40A 8B55C0                  mov edx, dword ptr [ebp-40]
:0042F40D 83C201                  add edx, 00000001
:0042F410 8955C0                  mov dword ptr [ebp-40], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F3D9(U)
|
:0042F413 E996FDFFFF              jmp 0042F1AE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F1B7(C)
|
:0042F418 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F41B C60000                  mov byte ptr [eax], 00
:0042F41E 8BE5                    mov esp, ebp
:0042F420 5D                      pop ebp
:0042F421 C3                      ret


:0042F422 55                      push ebp
:0042F423 8BEC                    mov ebp, esp
:0042F425 8D4508                  lea eax, dword ptr [ebp+08]
:0042F428 50                      push eax
:0042F429 E862FDFFFF              call 0042F190
:0042F42E 83C404                  add esp, 00000004
:0042F431 5D                      pop ebp
:0042F432 C3                      ret



* Referenced by a CALL at Address:
|:0042F72F   
|
:0042F433 55                      push ebp
:0042F434 8BEC                    mov ebp, esp
:0042F436 83EC28                  sub esp, 00000028
:0042F439 8B4508                  mov eax, dword ptr [ebp+08]
:0042F43C 50                      push eax
:0042F43D E818080500              call 0047FC5A
:0042F442 83C404                  add esp, 00000004
:0042F445 8945EC                  mov dword ptr [ebp-14], eax

* Possible Reference to Dialog: DialogID_0140 
                                  |
:0042F448 C745F040010000          mov [ebp-10], 00000140
:0042F44F C745E8A0000000          mov [ebp-18], 000000A0
:0042F456 E8C7C4FDFF              call 0040B922
:0042F45B 85C0                    test eax, eax
:0042F45D 7427                    je 0042F486
:0042F45F B950424B00              mov ecx, 004B4250
:0042F464 E8DB690200              call 00455E44
:0042F469 99                      cdq
:0042F46A 2BC2                    sub eax, edx
:0042F46C D1F8                    sar eax, 1
:0042F46E 8945F0                  mov dword ptr [ebp-10], eax
:0042F471 B950424B00              mov ecx, 004B4250
:0042F476 E8F0690200              call 00455E6B
:0042F47B 99                      cdq
:0042F47C 2BC2                    sub eax, edx
:0042F47E D1F8                    sar eax, 1
:0042F480 83E830                  sub eax, 00000030
:0042F483 8945E8                  mov dword ptr [ebp-18], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F45D(C)
|
:0042F486 8B45EC                  mov eax, dword ptr [ebp-14]
:0042F489 33D2                    xor edx, edx
:0042F48B B902000000              mov ecx, 00000002
:0042F490 F7F1                    div ecx
:0042F492 85D2                    test edx, edx
:0042F494 740D                    je 0042F4A3
:0042F496 8B55EC                  mov edx, dword ptr [ebp-14]
:0042F499 D1EA                    shr edx, 1
:0042F49B 83C201                  add edx, 00000001
:0042F49E 8955EC                  mov dword ptr [ebp-14], edx
:0042F4A1 EB08                    jmp 0042F4AB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F494(C)
|
:0042F4A3 8B45EC                  mov eax, dword ptr [ebp-14]
:0042F4A6 D1E8                    shr eax, 1
:0042F4A8 8945EC                  mov dword ptr [ebp-14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F4A1(U)
|
:0042F4AB 8B45EC                  mov eax, dword ptr [ebp-14]
:0042F4AE 33D2                    xor edx, edx
:0042F4B0 B903000000              mov ecx, 00000003
:0042F4B5 F7F1                    div ecx
:0042F4B7 8955E4                  mov dword ptr [ebp-1C], edx
:0042F4BA 837DE400                cmp dword ptr [ebp-1C], 00000000
:0042F4BE 7415                    je 0042F4D5
:0042F4C0 837DE401                cmp dword ptr [ebp-1C], 00000001
:0042F4C4 7450                    je 0042F516
:0042F4C6 837DE402                cmp dword ptr [ebp-1C], 00000002
:0042F4CA 0F8484000000            je 0042F554
:0042F4D0 E9BD000000              jmp 0042F592

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F4BE(C)
|
:0042F4D5 C745FC18000000          mov [ebp-04], 00000018
:0042F4DC 8B45EC                  mov eax, dword ptr [ebp-14]
:0042F4DF 33D2                    xor edx, edx
:0042F4E1 B903000000              mov ecx, 00000003
:0042F4E6 F7F1                    div ecx
:0042F4E8 83C001                  add eax, 00000001
:0042F4EB 83F802                  cmp eax, 00000002
:0042F4EE 7614                    jbe 0042F504
:0042F4F0 8B45EC                  mov eax, dword ptr [ebp-14]
:0042F4F3 33D2                    xor edx, edx
:0042F4F5 B903000000              mov ecx, 00000003
:0042F4FA F7F1                    div ecx
:0042F4FC 83C001                  add eax, 00000001
:0042F4FF 8945E0                  mov dword ptr [ebp-20], eax
:0042F502 EB07                    jmp 0042F50B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F4EE(C)
|
:0042F504 C745E002000000          mov [ebp-20], 00000002

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F502(U)
|
:0042F50B 8B55E0                  mov edx, dword ptr [ebp-20]
:0042F50E 8955F4                  mov dword ptr [ebp-0C], edx
:0042F511 E981000000              jmp 0042F597

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F4C4(C)
|
:0042F516 C745FC10000000          mov [ebp-04], 00000010
:0042F51D 8B45EC                  mov eax, dword ptr [ebp-14]
:0042F520 33D2                    xor edx, edx
:0042F522 B903000000              mov ecx, 00000003
:0042F527 F7F1                    div ecx
:0042F529 83C001                  add eax, 00000001
:0042F52C 83F802                  cmp eax, 00000002
:0042F52F 7614                    jbe 0042F545
:0042F531 8B45EC                  mov eax, dword ptr [ebp-14]
:0042F534 33D2                    xor edx, edx
:0042F536 B903000000              mov ecx, 00000003
:0042F53B F7F1                    div ecx
:0042F53D 83C001                  add eax, 00000001
:0042F540 8945DC                  mov dword ptr [ebp-24], eax
:0042F543 EB07                    jmp 0042F54C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F52F(C)
|
:0042F545 C745DC02000000          mov [ebp-24], 00000002

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F543(U)
|
:0042F54C 8B55DC                  mov edx, dword ptr [ebp-24]
:0042F54F 8955F4                  mov dword ptr [ebp-0C], edx
:0042F552 EB43                    jmp 0042F597

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F4CA(C)
|
:0042F554 C745FC20000000          mov [ebp-04], 00000020
:0042F55B 8B45EC                  mov eax, dword ptr [ebp-14]
:0042F55E 33D2                    xor edx, edx
:0042F560 B903000000              mov ecx, 00000003
:0042F565 F7F1                    div ecx
:0042F567 83C002                  add eax, 00000002
:0042F56A 83F802                  cmp eax, 00000002
:0042F56D 7614                    jbe 0042F583
:0042F56F 8B45EC                  mov eax, dword ptr [ebp-14]
:0042F572 33D2                    xor edx, edx
:0042F574 B903000000              mov ecx, 00000003
:0042F579 F7F1                    div ecx
:0042F57B 83C002                  add eax, 00000002
:0042F57E 8945D8                  mov dword ptr [ebp-28], eax
:0042F581 EB07                    jmp 0042F58A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F56D(C)
|
:0042F583 C745D802000000          mov [ebp-28], 00000002

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F581(U)
|
:0042F58A 8B55D8                  mov edx, dword ptr [ebp-28]
:0042F58D 8955F4                  mov dword ptr [ebp-0C], edx
:0042F590 EB05                    jmp 0042F597

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F4D0(U)
|
:0042F592 E9FE000000              jmp 0042F695

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F511(U), :0042F552(U), :0042F590(U)
|
:0042F597 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F59A 6BC030                  imul eax, 00000030
:0042F59D D1E8                    shr eax, 1
:0042F59F 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0042F5A2 2BC8                    sub ecx, eax
:0042F5A4 894DF0                  mov dword ptr [ebp-10], ecx
:0042F5A7 8B55F0                  mov edx, dword ptr [ebp-10]
:0042F5AA 0355FC                  add edx, dword ptr [ebp-04]
:0042F5AD 8955FC                  mov dword ptr [ebp-04], edx
:0042F5B0 8B45E8                  mov eax, dword ptr [ebp-18]
:0042F5B3 83C010                  add eax, 00000010
:0042F5B6 8945F8                  mov dword ptr [ebp-08], eax
:0042F5B9 6A00                    push 00000000
:0042F5BB E85BC2FFFF              call 0042B81B
:0042F5C0 83C404                  add esp, 00000004
:0042F5C3 E88FCFFFFF              call 0042C557
:0042F5C8 B9B07F4900              mov ecx, 00497FB0
:0042F5CD E8946AFFFF              call 00426066
:0042F5D2 6A00                    push 00000000
:0042F5D4 6A00                    push 00000000
:0042F5D6 6802020000              push 00000202
:0042F5DB 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:0042F5E1 51                      push ecx
:0042F5E2 FF15F4624800            call dword ptr [004862F4]
:0042F5E8 E8EEEFFEFF              call 0041E5DB
:0042F5ED 6A00                    push 00000000
:0042F5EF 6A30                    push 00000030
:0042F5F1 8B55F4                  mov edx, dword ptr [ebp-0C]
:0042F5F4 6BD230                  imul edx, 00000030
:0042F5F7 52                      push edx
:0042F5F8 8B45E8                  mov eax, dword ptr [ebp-18]
:0042F5FB 50                      push eax
:0042F5FC 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0042F5FF 51                      push ecx
:0042F600 B930694B00              mov ecx, 004B6930
:0042F605 E8B13F0400              call 004735BB
:0042F60A 6A04                    push 00000004
:0042F60C B9382F4900              mov ecx, 00492F38
:0042F611 E820F7FDFF              call 0040ED36
:0042F616 6A00                    push 00000000
:0042F618 B9382F4900              mov ecx, 00492F38
:0042F61D E8E8F6FDFF              call 0040ED0A
:0042F622 68AC000000              push 000000AC
:0042F627 B9382F4900              mov ecx, 00492F38
:0042F62C E853F6FDFF              call 0040EC84
:0042F631 6A00                    push 00000000
:0042F633 B9382F4900              mov ecx, 00492F38
:0042F638 E87FF6FDFF              call 0040ECBC
:0042F63D 8B55F8                  mov edx, dword ptr [ebp-08]
:0042F640 52                      push edx
:0042F641 8B45FC                  mov eax, dword ptr [ebp-04]
:0042F644 C1E803                  shr eax, 03
:0042F647 50                      push eax
:0042F648 B9382F4900              mov ecx, 00492F38
:0042F64D E885F5FDFF              call 0040EBD7
:0042F652 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042F655 51                      push ecx
:0042F656 68382F4900              push 00492F38
:0042F65B E8BA03FEFF              call 0040FA1A
:0042F660 83C408                  add esp, 00000008
:0042F663 E88EEFFEFF              call 0041E5F6
:0042F668 B970074B00              mov ecx, 004B0770
:0042F66D E8BECCFEFF              call 0041C330
:0042F672 25FF000000              and eax, 000000FF
:0042F677 83C001                  add eax, 00000001
:0042F67A 6BC00A                  imul eax, 0000000A
:0042F67D 50                      push eax
:0042F67E E8C3CFFFFF              call 0042C646
:0042F683 83C404                  add esp, 00000004
:0042F686 B930694B00              mov ecx, 004B6930
:0042F68B E8933F0400              call 00473623
:0042F690 E86BCFFFFF              call 0042C600

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F592(U)
|
:0042F695 8BE5                    mov esp, ebp
:0042F697 5D                      pop ebp
:0042F698 C3                      ret



* Referenced by a CALL at Addresses:
|:0040751D   , :00407591   , :004084E7   , :0040857E   , :0040BB6E   
|:0040BB9E   , :0040D8B7   , :00411779   , :00413A49   , :004145CA   
|:0041C624   , :0041C66E   , :0041C6A4   , :0041C713   , :0041DA76   
|:0041DB72   , :0041FB59   , :0041FBAA   , :0041FF45   , :0041FF73   
|:0042005C   , :0042008E   , :00420177   , :004201A8   , :00420291   
|:004202C3   , :004203AC   , :004204E0   , :0042052E   , :0042057C   
|:004205CA   , :00420843   , :00421C5B   , :0042A29B   , :0042C1D9   
|:0043499C   , :00434B41   , :00434D13   , :00434F25   , :00434F78   
|:0043D7E3   , :0043D7F4   , :0043D86A   , :0043D8C0   , :0043D927   
|:0043D97A   , :0043DC4D   , :0043FC0C   , :0044E5A9   , :0044E6C8   
|:0044E7F1   , :0044ED7B   , :0044EF0E   , :0045548E   , :0045549F   
|:0045560E   , :0045566E   , :0045569A   , :00459C2E   
|
:0042F699 55                      push ebp
:0042F69A 8BEC                    mov ebp, esp
:0042F69C 83EC08                  sub esp, 00000008
:0042F69F C745FC01000000          mov [ebp-04], 00000001
:0042F6A6 8D450C                  lea eax, dword ptr [ebp+0C]
:0042F6A9 50                      push eax
:0042F6AA E8E1FAFFFF              call 0042F190
:0042F6AF 83C404                  add esp, 00000004
:0042F6B2 E849CFFFFF              call 0042C600
:0042F6B7 E89BCEFFFF              call 0042C557
:0042F6BC 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042F6BF 894DF8                  mov dword ptr [ebp-08], ecx
:0042F6C2 837DF800                cmp dword ptr [ebp-08], 00000000
:0042F6C6 740E                    je 0042F6D6
:0042F6C8 837DF801                cmp dword ptr [ebp-08], 00000001
:0042F6CC 7431                    je 0042F6FF
:0042F6CE 837DF802                cmp dword ptr [ebp-08], 00000002
:0042F6D2 7456                    je 0042F72A
:0042F6D4 EB77                    jmp 0042F74D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F6C6(C)
|
:0042F6D6 6A01                    push 00000001
:0042F6D8 6A00                    push 00000000
:0042F6DA 68181A4B00              push 004B1A18
:0042F6DF E875540400              call 00474B59
:0042F6E4 83C40C                  add esp, 0000000C
:0042F6E7 6A00                    push 00000000
:0042F6E9 6A00                    push 00000000
:0042F6EB 6802020000              push 00000202
:0042F6F0 8B15686A4B00            mov edx, dword ptr [004B6A68]
:0042F6F6 52                      push edx
:0042F6F7 FF15F4624800            call dword ptr [004862F4]
:0042F6FD EB4E                    jmp 0042F74D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F6CC(C)
|
:0042F6FF 6A01                    push 00000001
:0042F701 6A00                    push 00000000
:0042F703 68181A4B00              push 004B1A18
:0042F708 E8E3530400              call 00474AF0
:0042F70D 83C40C                  add esp, 0000000C
:0042F710 8945FC                  mov dword ptr [ebp-04], eax
:0042F713 6A00                    push 00000000
:0042F715 6A00                    push 00000000
:0042F717 6802020000              push 00000202
:0042F71C A1686A4B00              mov eax, dword ptr [004B6A68]
:0042F721 50                      push eax
:0042F722 FF15F4624800            call dword ptr [004862F4]
:0042F728 EB23                    jmp 0042F74D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F6D2(C)
|
:0042F72A 68181A4B00              push 004B1A18
:0042F72F E8FFFCFFFF              call 0042F433
:0042F734 83C404                  add esp, 00000004
:0042F737 6A00                    push 00000000
:0042F739 6A00                    push 00000000
:0042F73B 6802020000              push 00000202
:0042F740 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:0042F746 51                      push ecx
:0042F747 FF15F4624800            call dword ptr [004862F4]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F6D4(U), :0042F6FD(U), :0042F728(U)
|
:0042F74D 8B45FC                  mov eax, dword ptr [ebp-04]
:0042F750 8BE5                    mov esp, ebp
:0042F752 5D                      pop ebp
:0042F753 C3                      ret



* Referenced by a CALL at Address:
|:0041221F   
|
:0042F754 55                      push ebp
:0042F755 8BEC                    mov ebp, esp
:0042F757 833DD0E7480000          cmp dword ptr [0048E7D0], 00000000
:0042F75E 7505                    jne 0042F765
:0042F760 E982000000              jmp 0042F7E7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F75E(C)
|
:0042F765 E896CEFFFF              call 0042C600
:0042F76A 6A00                    push 00000000
:0042F76C E84B620400              call 004759BC
:0042F771 83C404                  add esp, 00000004
:0042F774 B9B8694B00              mov ecx, 004B69B8
:0042F779 E89B4E0400              call 00474619
:0042F77E B9B0694B00              mov ecx, 004B69B0
:0042F783 E8CA4E0400              call 00474652
:0042F788 E8CACDFFFF              call 0042C557
:0042F78D 6A04                    push 00000004
:0042F78F B9382F4900              mov ecx, 00492F38
:0042F794 E89DF5FDFF              call 0040ED36
:0042F799 6A12                    push 00000012
:0042F79B B9382F4900              mov ecx, 00492F38
:0042F7A0 E8DFF4FDFF              call 0040EC84
:0042F7A5 E8E5EEFEFF              call 0041E68F
:0042F7AA 837D0801                cmp dword ptr [ebp+08], 00000001
:0042F7AE 7517                    jne 0042F7C7
:0042F7B0 6A00                    push 00000000
:0042F7B2 6A00                    push 00000000
:0042F7B4 6A00                    push 00000000
:0042F7B6 6A00                    push 00000000
:0042F7B8 668B4508                mov ax, word ptr [ebp+08]
:0042F7BC 50                      push eax
:0042F7BD E8A000FFFF              call 0041F862
:0042F7C2 83C414                  add esp, 00000014
:0042F7C5 EB1B                    jmp 0042F7E2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F7AE(C)
|
:0042F7C7 837D0804                cmp dword ptr [ebp+08], 00000004
:0042F7CB 7315                    jnb 0042F7E2
:0042F7CD 6A00                    push 00000000
:0042F7CF 6A00                    push 00000000
:0042F7D1 6A01                    push 00000001
:0042F7D3 6A00                    push 00000000
:0042F7D5 668B4D08                mov cx, word ptr [ebp+08]
:0042F7D9 51                      push ecx
:0042F7DA E88300FFFF              call 0041F862
:0042F7DF 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042F7C5(U), :0042F7CB(C)
|
:0042F7E2 E83BEAFEFF              call 0041E222

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F760(U)
|
:0042F7E7 5D                      pop ebp
:0042F7E8 C3                      ret


:0042F7E9 CC                      int 03
:0042F7EA CC                      int 03
:0042F7EB CC                      int 03
:0042F7EC CC                      int 03
:0042F7ED CC                      int 03
:0042F7EE CC                      int 03
:0042F7EF CC                      int 03

* Referenced by a CALL at Addresses:
|:0042C4E8   , :0042C502   , :0042C812   , :0044E215   , :004542B6   
|:00455CF2   
|
:0042F7F0 55                      push ebp
:0042F7F1 8BEC                    mov ebp, esp
:0042F7F3 51                      push ecx
:0042F7F4 894DFC                  mov dword ptr [ebp-04], ecx
:0042F7F7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042F7FA E87ACCFFFF              call 0042C479
:0042F7FF F7D8                    neg eax
:0042F801 1BC0                    sbb eax, eax
:0042F803 40                      inc eax
:0042F804 8BE5                    mov esp, ebp
:0042F806 5D                      pop ebp
:0042F807 C3                      ret


:0042F808 CC                      int 03
:0042F809 CC                      int 03
:0042F80A CC                      int 03
:0042F80B CC                      int 03
:0042F80C CC                      int 03
:0042F80D CC                      int 03
:0042F80E CC                      int 03
:0042F80F CC                      int 03

* Referenced by a CALL at Address:
|:0042E8C3   
|
:0042F810 55                      push ebp
:0042F811 8BEC                    mov ebp, esp
:0042F813 51                      push ecx
:0042F814 894DFC                  mov dword ptr [ebp-04], ecx
:0042F817 8B4518                  mov eax, dword ptr [ebp+18]
:0042F81A 50                      push eax
:0042F81B 8B4D14                  mov ecx, dword ptr [ebp+14]
:0042F81E 51                      push ecx
:0042F81F 8B5510                  mov edx, dword ptr [ebp+10]
:0042F822 52                      push edx
:0042F823 8B450C                  mov eax, dword ptr [ebp+0C]
:0042F826 50                      push eax
:0042F827 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042F82A 51                      push ecx
:0042F82B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042F82E E80D000000              call 0042F840
:0042F833 8B45FC                  mov eax, dword ptr [ebp-04]
:0042F836 8BE5                    mov esp, ebp
:0042F838 5D                      pop ebp
:0042F839 C21400                  ret 0014


:0042F83C CC                      int 03
:0042F83D CC                      int 03
:0042F83E CC                      int 03
:0042F83F CC                      int 03

* Referenced by a CALL at Address:
|:0042F82E   
|
:0042F840 55                      push ebp
:0042F841 8BEC                    mov ebp, esp
:0042F843 51                      push ecx
:0042F844 894DFC                  mov dword ptr [ebp-04], ecx
:0042F847 8B4508                  mov eax, dword ptr [ebp+08]
:0042F84A C1E003                  shl eax, 03
:0042F84D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042F850 8901                    mov dword ptr [ecx], eax
:0042F852 8B55FC                  mov edx, dword ptr [ebp-04]
:0042F855 8B450C                  mov eax, dword ptr [ebp+0C]
:0042F858 894204                  mov dword ptr [edx+04], eax
:0042F85B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042F85E 8B5510                  mov edx, dword ptr [ebp+10]
:0042F861 895108                  mov dword ptr [ecx+08], edx
:0042F864 8B45FC                  mov eax, dword ptr [ebp-04]
:0042F867 8B4D14                  mov ecx, dword ptr [ebp+14]
:0042F86A 89480C                  mov dword ptr [eax+0C], ecx
:0042F86D 8B55FC                  mov edx, dword ptr [ebp-04]
:0042F870 8B4518                  mov eax, dword ptr [ebp+18]
:0042F873 894210                  mov dword ptr [edx+10], eax
:0042F876 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042F879 C7411400000000          mov [ecx+14], 00000000
:0042F880 8BE5                    mov esp, ebp
:0042F882 5D                      pop ebp
:0042F883 C21400                  ret 0014


:0042F886 CC                      int 03
:0042F887 CC                      int 03
:0042F888 CC                      int 03
:0042F889 CC                      int 03
:0042F88A CC                      int 03
:0042F88B CC                      int 03
:0042F88C CC                      int 03
:0042F88D CC                      int 03
:0042F88E CC                      int 03
:0042F88F CC                      int 03

* Referenced by a CALL at Address:
|:0042E6C7   
|
:0042F890 55                      push ebp
:0042F891 8BEC                    mov ebp, esp
:0042F893 83EC18                  sub esp, 00000018
:0042F896 56                      push esi
:0042F897 894DF4                  mov dword ptr [ebp-0C], ecx
:0042F89A 6810B54200              push 0042B510
:0042F89F 6840FA4200              push 0042FA40
:0042F8A4 6A0C                    push 0000000C
:0042F8A6 6A18                    push 00000018
:0042F8A8 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F8AB 83C008                  add eax, 00000008
:0042F8AE 50                      push eax
:0042F8AF E88C1B0500              call 00481440
:0042F8B4 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042F8B7 8B5508                  mov edx, dword ptr [ebp+08]
:0042F8BA 895104                  mov dword ptr [ecx+04], edx
:0042F8BD C645FC00                mov [ebp-04], 00
:0042F8C1 EB08                    jmp 0042F8CB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F948(U)
|
:0042F8C3 8A45FC                  mov al, byte ptr [ebp-04]
:0042F8C6 0401                    add al, 01
:0042F8C8 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F8C1(U)
|
:0042F8CB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042F8CE 81E1FF000000            and ecx, 000000FF
:0042F8D4 8B55F4                  mov edx, dword ptr [ebp-0C]
:0042F8D7 8B4204                  mov eax, dword ptr [edx+04]
:0042F8DA 833C8800                cmp dword ptr [eax+4*ecx], 00000000
:0042F8DE 746D                    je 0042F94D
:0042F8E0 C645F800                mov [ebp-08], 00
:0042F8E4 EB09                    jmp 0042F8EF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F912(U)
|
:0042F8E6 8A4DF8                  mov cl, byte ptr [ebp-08]
:0042F8E9 80C101                  add cl, 01
:0042F8EC 884DF8                  mov byte ptr [ebp-08], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F8E4(U)
|
:0042F8EF 8B55FC                  mov edx, dword ptr [ebp-04]
:0042F8F2 81E2FF000000            and edx, 000000FF
:0042F8F8 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F8FB 8B4804                  mov ecx, dword ptr [eax+04]
:0042F8FE 8B45F8                  mov eax, dword ptr [ebp-08]
:0042F901 25FF000000              and eax, 000000FF
:0042F906 8B0C91                  mov ecx, dword ptr [ecx+4*edx]
:0042F909 33D2                    xor edx, edx
:0042F90B 8A1401                  mov dl, byte ptr [ecx+eax]
:0042F90E 85D2                    test edx, edx
:0042F910 7402                    je 0042F914
:0042F912 EBD2                    jmp 0042F8E6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F910(C)
|
:0042F914 8B4510                  mov eax, dword ptr [ebp+10]
:0042F917 25FF000000              and eax, 000000FF
:0042F91C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042F91F 81E1FF000000            and ecx, 000000FF
:0042F925 3BC1                    cmp eax, ecx
:0042F927 7E0E                    jle 0042F937
:0042F929 8B5510                  mov edx, dword ptr [ebp+10]
:0042F92C 81E2FF000000            and edx, 000000FF
:0042F932 8955F0                  mov dword ptr [ebp-10], edx
:0042F935 EB0B                    jmp 0042F942

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F927(C)
|
:0042F937 8B45F8                  mov eax, dword ptr [ebp-08]
:0042F93A 25FF000000              and eax, 000000FF
:0042F93F 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F935(U)
|
:0042F942 8A4DF0                  mov cl, byte ptr [ebp-10]
:0042F945 884D10                  mov byte ptr [ebp+10], cl
:0042F948 E976FFFFFF              jmp 0042F8C3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F8DE(C)
|
:0042F94D 8B55FC                  mov edx, dword ptr [ebp-04]
:0042F950 81E2FF000000            and edx, 000000FF
:0042F956 8B4514                  mov eax, dword ptr [ebp+14]
:0042F959 25FF000000              and eax, 000000FF
:0042F95E 3BD0                    cmp edx, eax
:0042F960 7D0E                    jge 0042F970
:0042F962 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042F965 81E1FF000000            and ecx, 000000FF
:0042F96B 894DEC                  mov dword ptr [ebp-14], ecx
:0042F96E EB0C                    jmp 0042F97C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F960(C)
|
:0042F970 8B5514                  mov edx, dword ptr [ebp+14]
:0042F973 81E2FF000000            and edx, 000000FF
:0042F979 8955EC                  mov dword ptr [ebp-14], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F96E(U)
|
:0042F97C 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042F97F 8A4DEC                  mov cl, byte ptr [ebp-14]
:0042F982 8808                    mov byte ptr [eax], cl
:0042F984 8B5510                  mov edx, dword ptr [ebp+10]
:0042F987 81E2FF000000            and edx, 000000FF
:0042F98D 83FA08                  cmp edx, 00000008
:0042F990 7E0D                    jle 0042F99F
:0042F992 8B4510                  mov eax, dword ptr [ebp+10]
:0042F995 25FF000000              and eax, 000000FF
:0042F99A 8945E8                  mov dword ptr [ebp-18], eax
:0042F99D EB07                    jmp 0042F9A6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F990(C)
|
:0042F99F C745E808000000          mov [ebp-18], 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F99D(U)
|
:0042F9A6 8A4DE8                  mov cl, byte ptr [ebp-18]
:0042F9A9 884D10                  mov byte ptr [ebp+10], cl
:0042F9AC 8B55F4                  mov edx, dword ptr [ebp-0C]
:0042F9AF 8A4510                  mov al, byte ptr [ebp+10]
:0042F9B2 884201                  mov byte ptr [edx+01], al
:0042F9B5 C645FC00                mov [ebp-04], 00
:0042F9B9 EB09                    jmp 0042F9C4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FA0F(U)
|
:0042F9BB 8A4DFC                  mov cl, byte ptr [ebp-04]
:0042F9BE 80C101                  add cl, 01
:0042F9C1 884DFC                  mov byte ptr [ebp-04], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F9B9(U)
|
:0042F9C4 8B55FC                  mov edx, dword ptr [ebp-04]
:0042F9C7 81E2FF000000            and edx, 000000FF
:0042F9CD 83FA0C                  cmp edx, 0000000C
:0042F9D0 7D3F                    jge 0042FA11
:0042F9D2 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0042F9D6 7423                    je 0042F9FB
:0042F9D8 8B45FC                  mov eax, dword ptr [ebp-04]
:0042F9DB 25FF000000              and eax, 000000FF
:0042F9E0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042F9E3 81E1FF000000            and ecx, 000000FF
:0042F9E9 8B55F4                  mov edx, dword ptr [ebp-0C]
:0042F9EC 8B750C                  mov esi, dword ptr [ebp+0C]
:0042F9EF 8A0406                  mov al, byte ptr [esi+eax]
:0042F9F2 88840A28010000          mov byte ptr [edx+ecx+00000128], al
:0042F9F9 EB14                    jmp 0042FA0F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F9D6(C)
|
:0042F9FB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042F9FE 81E1FF000000            and ecx, 000000FF
:0042FA04 8B55F4                  mov edx, dword ptr [ebp-0C]
:0042FA07 C6840A2801000000        mov byte ptr [edx+ecx+00000128], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F9F9(U)
|
:0042FA0F EBAA                    jmp 0042F9BB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042F9D0(C)
|
:0042FA11 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042FA14 5E                      pop esi
:0042FA15 8BE5                    mov esp, ebp
:0042FA17 5D                      pop ebp
:0042FA18 C21000                  ret 0010


:0042FA1B CC                      int 03
:0042FA1C CC                      int 03
:0042FA1D CC                      int 03
:0042FA1E CC                      int 03
:0042FA1F CC                      int 03

* Referenced by a CALL at Addresses:
|:0042F077   , :00485366   
|
:0042FA20 55                      push ebp
:0042FA21 8BEC                    mov ebp, esp
:0042FA23 51                      push ecx
:0042FA24 894DFC                  mov dword ptr [ebp-04], ecx
:0042FA27 6810B54200              push 0042B510
:0042FA2C 6A0C                    push 0000000C
:0042FA2E 6A18                    push 00000018
:0042FA30 8B45FC                  mov eax, dword ptr [ebp-04]
:0042FA33 83C008                  add eax, 00000008
:0042FA36 50                      push eax
:0042FA37 E8A41A0500              call 004814E0
:0042FA3C 8BE5                    mov esp, ebp
:0042FA3E 5D                      pop ebp
:0042FA3F C3                      ret


:0042FA40 55                      push ebp
:0042FA41 8BEC                    mov ebp, esp
:0042FA43 51                      push ecx
:0042FA44 894DFC                  mov dword ptr [ebp-04], ecx
:0042FA47 6A00                    push 00000000
:0042FA49 6A00                    push 00000000
:0042FA4B 6A00                    push 00000000
:0042FA4D 6A00                    push 00000000
:0042FA4F 6A00                    push 00000000
:0042FA51 6A00                    push 00000000
:0042FA53 6A00                    push 00000000
:0042FA55 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042FA58 E813000000              call 0042FA70
:0042FA5D 8BE5                    mov esp, ebp
:0042FA5F 5D                      pop ebp
:0042FA60 C3                      ret


:0042FA61 CC                      int 03
:0042FA62 CC                      int 03
:0042FA63 CC                      int 03
:0042FA64 CC                      int 03
:0042FA65 CC                      int 03
:0042FA66 CC                      int 03
:0042FA67 CC                      int 03
:0042FA68 CC                      int 03
:0042FA69 CC                      int 03
:0042FA6A CC                      int 03
:0042FA6B CC                      int 03
:0042FA6C CC                      int 03
:0042FA6D CC                      int 03
:0042FA6E CC                      int 03
:0042FA6F CC                      int 03

* Referenced by a CALL at Address:
|:0042FA58   
|
:0042FA70 55                      push ebp
:0042FA71 8BEC                    mov ebp, esp
:0042FA73 51                      push ecx
:0042FA74 894DFC                  mov dword ptr [ebp-04], ecx
:0042FA77 8A4520                  mov al, byte ptr [ebp+20]
:0042FA7A 50                      push eax
:0042FA7B 8A4D1C                  mov cl, byte ptr [ebp+1C]
:0042FA7E 51                      push ecx
:0042FA7F 8B5518                  mov edx, dword ptr [ebp+18]
:0042FA82 52                      push edx
:0042FA83 8B4514                  mov eax, dword ptr [ebp+14]
:0042FA86 50                      push eax
:0042FA87 8B4D10                  mov ecx, dword ptr [ebp+10]
:0042FA8A 51                      push ecx
:0042FA8B 8B550C                  mov edx, dword ptr [ebp+0C]
:0042FA8E 52                      push edx
:0042FA8F 8B4508                  mov eax, dword ptr [ebp+08]
:0042FA92 50                      push eax
:0042FA93 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042FA96 E815000000              call 0042FAB0
:0042FA9B 8B45FC                  mov eax, dword ptr [ebp-04]
:0042FA9E 8BE5                    mov esp, ebp
:0042FAA0 5D                      pop ebp
:0042FAA1 C21C00                  ret 001C


:0042FAA4 CC                      int 03
:0042FAA5 CC                      int 03
:0042FAA6 CC                      int 03
:0042FAA7 CC                      int 03
:0042FAA8 CC                      int 03
:0042FAA9 CC                      int 03
:0042FAAA CC                      int 03
:0042FAAB CC                      int 03
:0042FAAC CC                      int 03
:0042FAAD CC                      int 03
:0042FAAE CC                      int 03
:0042FAAF CC                      int 03

* Referenced by a CALL at Addresses:
|:0042FA96   , :004741B2   
|
:0042FAB0 55                      push ebp
:0042FAB1 8BEC                    mov ebp, esp
:0042FAB3 51                      push ecx
:0042FAB4 894DFC                  mov dword ptr [ebp-04], ecx
:0042FAB7 8B4508                  mov eax, dword ptr [ebp+08]
:0042FABA C1E003                  shl eax, 03
:0042FABD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042FAC0 8901                    mov dword ptr [ecx], eax
:0042FAC2 8B55FC                  mov edx, dword ptr [ebp-04]
:0042FAC5 8B450C                  mov eax, dword ptr [ebp+0C]
:0042FAC8 894204                  mov dword ptr [edx+04], eax
:0042FACB 8B4D10                  mov ecx, dword ptr [ebp+10]
:0042FACE C1E103                  shl ecx, 03
:0042FAD1 8B55FC                  mov edx, dword ptr [ebp-04]
:0042FAD4 894A08                  mov dword ptr [edx+08], ecx
:0042FAD7 8B45FC                  mov eax, dword ptr [ebp-04]
:0042FADA 8B4D14                  mov ecx, dword ptr [ebp+14]
:0042FADD 89480C                  mov dword ptr [eax+0C], ecx
:0042FAE0 8B55FC                  mov edx, dword ptr [ebp-04]
:0042FAE3 8B4518                  mov eax, dword ptr [ebp+18]
:0042FAE6 894210                  mov dword ptr [edx+10], eax
:0042FAE9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042FAEC 8A551C                  mov dl, byte ptr [ebp+1C]
:0042FAEF 885114                  mov byte ptr [ecx+14], dl
:0042FAF2 8B45FC                  mov eax, dword ptr [ebp-04]
:0042FAF5 8A4D20                  mov cl, byte ptr [ebp+20]
:0042FAF8 884815                  mov byte ptr [eax+15], cl
:0042FAFB 8BE5                    mov esp, ebp
:0042FAFD 5D                      pop ebp
:0042FAFE C21C00                  ret 001C


:0042FB01 CC                      int 03
:0042FB02 CC                      int 03
:0042FB03 CC                      int 03
:0042FB04 CC                      int 03
:0042FB05 CC                      int 03
:0042FB06 CC                      int 03
:0042FB07 CC                      int 03
:0042FB08 CC                      int 03
:0042FB09 CC                      int 03
:0042FB0A CC                      int 03
:0042FB0B CC                      int 03
:0042FB0C CC                      int 03
:0042FB0D CC                      int 03
:0042FB0E CC                      int 03
:0042FB0F CC                      int 03

* Referenced by a CALL at Address:
|:0042FD2F   
|
:0042FB10 55                      push ebp
:0042FB11 8BEC                    mov ebp, esp
:0042FB13 83EC34                  sub esp, 00000034
:0042FB16 53                      push ebx
:0042FB17 C645E000                mov [ebp-20], 00
:0042FB1B C745F800000000          mov [ebp-08], 00000000
:0042FB22 C745E400000000          mov [ebp-1C], 00000000
:0042FB29 C745DC00000000          mov [ebp-24], 00000000
:0042FB30 EB09                    jmp 0042FB3B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FB63(U)
|
:0042FB32 8B45DC                  mov eax, dword ptr [ebp-24]
:0042FB35 83C001                  add eax, 00000001
:0042FB38 8945DC                  mov dword ptr [ebp-24], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FB30(U)
|
:0042FB3B 837DDC03                cmp dword ptr [ebp-24], 00000003
:0042FB3F 7324                    jnb 0042FB65
:0042FB41 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042FB44 034DDC                  add ecx, dword ptr [ebp-24]
:0042FB47 33D2                    xor edx, edx
:0042FB49 8A11                    mov dl, byte ptr [ecx]
:0042FB4B 3B55F8                  cmp edx, dword ptr [ebp-08]
:0042FB4E 7613                    jbe 0042FB63
:0042FB50 8B45DC                  mov eax, dword ptr [ebp-24]
:0042FB53 8945E4                  mov dword ptr [ebp-1C], eax
:0042FB56 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042FB59 034DDC                  add ecx, dword ptr [ebp-24]
:0042FB5C 33D2                    xor edx, edx
:0042FB5E 8A11                    mov dl, byte ptr [ecx]
:0042FB60 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FB4E(C)
|
:0042FB63 EBCD                    jmp 0042FB32

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FB3F(C)
|
:0042FB65 C745E8FFFF0000          mov [ebp-18], 0000FFFF
:0042FB6C C745F0FFFF0000          mov [ebp-10], 0000FFFF
:0042FB73 C745DC0A000000          mov [ebp-24], 0000000A
:0042FB7A EB09                    jmp 0042FB85

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FCB9(U)
|
:0042FB7C 8B45DC                  mov eax, dword ptr [ebp-24]
:0042FB7F 83C001                  add eax, 00000001
:0042FB82 8945DC                  mov dword ptr [ebp-24], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FB7A(U)
|
:0042FB85 817DDCF5000000          cmp dword ptr [ebp-24], 000000F5
:0042FB8C 0F872C010000            ja 0042FCBE
:0042FB92 C745FC00000000          mov [ebp-04], 00000000
:0042FB99 C745EC00000000          mov [ebp-14], 00000000
:0042FBA0 C745D800000000          mov [ebp-28], 00000000
:0042FBA7 C745F800000000          mov [ebp-08], 00000000
:0042FBAE C745D400000000          mov [ebp-2C], 00000000
:0042FBB5 EB09                    jmp 0042FBC0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FC8A(U)
|
:0042FBB7 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0042FBBA 83C101                  add ecx, 00000001
:0042FBBD 894DD4                  mov dword ptr [ebp-2C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FBB5(U)
|
:0042FBC0 837DD403                cmp dword ptr [ebp-2C], 00000003
:0042FBC4 0F83C5000000            jnb 0042FC8F
:0042FBCA 8B5508                  mov edx, dword ptr [ebp+08]
:0042FBCD 0355D4                  add edx, dword ptr [ebp-2C]
:0042FBD0 33C0                    xor eax, eax
:0042FBD2 8A02                    mov al, byte ptr [edx]
:0042FBD4 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0042FBD7 6BC903                  imul ecx, 00000003
:0042FBDA 034DD4                  add ecx, dword ptr [ebp-2C]
:0042FBDD 8B550C                  mov edx, dword ptr [ebp+0C]
:0042FBE0 33DB                    xor ebx, ebx
:0042FBE2 8A1C0A                  mov bl, byte ptr [edx+ecx]
:0042FBE5 2BC3                    sub eax, ebx
:0042FBE7 85C0                    test eax, eax
:0042FBE9 7C22                    jl 0042FC0D
:0042FBEB 8B4508                  mov eax, dword ptr [ebp+08]
:0042FBEE 0345D4                  add eax, dword ptr [ebp-2C]
:0042FBF1 33C9                    xor ecx, ecx
:0042FBF3 8A08                    mov cl, byte ptr [eax]
:0042FBF5 8B55DC                  mov edx, dword ptr [ebp-24]
:0042FBF8 6BD203                  imul edx, 00000003
:0042FBFB 0355D4                  add edx, dword ptr [ebp-2C]
:0042FBFE 8B450C                  mov eax, dword ptr [ebp+0C]
:0042FC01 33DB                    xor ebx, ebx
:0042FC03 8A1C10                  mov bl, byte ptr [eax+edx]
:0042FC06 2BCB                    sub ecx, ebx
:0042FC08 894DD0                  mov dword ptr [ebp-30], ecx
:0042FC0B EB22                    jmp 0042FC2F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FBE9(C)
|
:0042FC0D 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042FC10 034DD4                  add ecx, dword ptr [ebp-2C]
:0042FC13 33D2                    xor edx, edx
:0042FC15 8A11                    mov dl, byte ptr [ecx]
:0042FC17 8B45DC                  mov eax, dword ptr [ebp-24]
:0042FC1A 6BC003                  imul eax, 00000003
:0042FC1D 0345D4                  add eax, dword ptr [ebp-2C]
:0042FC20 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0042FC23 33DB                    xor ebx, ebx
:0042FC25 8A1C01                  mov bl, byte ptr [ecx+eax]
:0042FC28 2BD3                    sub edx, ebx
:0042FC2A F7DA                    neg edx
:0042FC2C 8955D0                  mov dword ptr [ebp-30], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FC0B(U)
|
:0042FC2F 8B55D0                  mov edx, dword ptr [ebp-30]
:0042FC32 8955F4                  mov dword ptr [ebp-0C], edx
:0042FC35 8B45F4                  mov eax, dword ptr [ebp-0C]
:0042FC38 3B45FC                  cmp eax, dword ptr [ebp-04]
:0042FC3B 7608                    jbe 0042FC45
:0042FC3D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042FC40 894DCC                  mov dword ptr [ebp-34], ecx
:0042FC43 EB06                    jmp 0042FC4B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FC3B(C)
|
:0042FC45 8B55FC                  mov edx, dword ptr [ebp-04]
:0042FC48 8955CC                  mov dword ptr [ebp-34], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FC43(U)
|
:0042FC4B 8B45CC                  mov eax, dword ptr [ebp-34]
:0042FC4E 8945FC                  mov dword ptr [ebp-04], eax
:0042FC51 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0042FC54 034DF4                  add ecx, dword ptr [ebp-0C]
:0042FC57 894DEC                  mov dword ptr [ebp-14], ecx
:0042FC5A 8B55DC                  mov edx, dword ptr [ebp-24]
:0042FC5D 6BD203                  imul edx, 00000003
:0042FC60 0355D4                  add edx, dword ptr [ebp-2C]
:0042FC63 8B450C                  mov eax, dword ptr [ebp+0C]
:0042FC66 33C9                    xor ecx, ecx
:0042FC68 8A0C10                  mov cl, byte ptr [eax+edx]
:0042FC6B 3B4DF8                  cmp ecx, dword ptr [ebp-08]
:0042FC6E 761A                    jbe 0042FC8A
:0042FC70 8B55D4                  mov edx, dword ptr [ebp-2C]
:0042FC73 8955D8                  mov dword ptr [ebp-28], edx
:0042FC76 8B45DC                  mov eax, dword ptr [ebp-24]
:0042FC79 6BC003                  imul eax, 00000003
:0042FC7C 0345D4                  add eax, dword ptr [ebp-2C]
:0042FC7F 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0042FC82 33D2                    xor edx, edx
:0042FC84 8A1401                  mov dl, byte ptr [ecx+eax]
:0042FC87 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FC6E(C)
|
:0042FC8A E928FFFFFF              jmp 0042FBB7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FBC4(C)
|
:0042FC8F 8B45FC                  mov eax, dword ptr [ebp-04]
:0042FC92 3B45E8                  cmp eax, dword ptr [ebp-18]
:0042FC95 7722                    ja 0042FCB9
:0042FC97 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0042FC9A 3B4DF0                  cmp ecx, dword ptr [ebp-10]
:0042FC9D 771A                    ja 0042FCB9
:0042FC9F 8B55E4                  mov edx, dword ptr [ebp-1C]
:0042FCA2 3B55D8                  cmp edx, dword ptr [ebp-28]
:0042FCA5 7512                    jne 0042FCB9
:0042FCA7 8A45DC                  mov al, byte ptr [ebp-24]
:0042FCAA 8845E0                  mov byte ptr [ebp-20], al
:0042FCAD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0042FCB0 894DE8                  mov dword ptr [ebp-18], ecx
:0042FCB3 8B55EC                  mov edx, dword ptr [ebp-14]
:0042FCB6 8955F0                  mov dword ptr [ebp-10], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042FC95(C), :0042FC9D(C), :0042FCA5(C)
|
:0042FCB9 E9BEFEFFFF              jmp 0042FB7C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FB8C(C)
|
:0042FCBE 8A45E0                  mov al, byte ptr [ebp-20]
:0042FCC1 5B                      pop ebx
:0042FCC2 8BE5                    mov esp, ebp
:0042FCC4 5D                      pop ebp
:0042FCC5 C3                      ret



* Referenced by a CALL at Address:
|:0041E1C1   
|
:0042FCC6 55                      push ebp
:0042FCC7 8BEC                    mov ebp, esp
:0042FCC9 83EC10                  sub esp, 00000010
:0042FCCC 56                      push esi
:0042FCCD C745F000000000          mov [ebp-10], 00000000
:0042FCD4 EB09                    jmp 0042FCDF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FD53(U)
|
:0042FCD6 8B45F0                  mov eax, dword ptr [ebp-10]
:0042FCD9 83C001                  add eax, 00000001
:0042FCDC 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FCD4(U)
|
:0042FCDF 837DF010                cmp dword ptr [ebp-10], 00000010
:0042FCE3 7D70                    jge 0042FD55
:0042FCE5 8A4DF0                  mov cl, byte ptr [ebp-10]
:0042FCE8 884DFC                  mov byte ptr [ebp-04], cl
:0042FCEB C745F800000000          mov [ebp-08], 00000000
:0042FCF2 EB09                    jmp 0042FCFD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FD51(U)
|
:0042FCF4 8B55F8                  mov edx, dword ptr [ebp-08]
:0042FCF7 83C201                  add edx, 00000001
:0042FCFA 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FCF2(U)
|
:0042FCFD 837DF810                cmp dword ptr [ebp-08], 00000010
:0042FD01 7D50                    jge 0042FD53
:0042FD03 8A45F8                  mov al, byte ptr [ebp-08]
:0042FD06 8845FD                  mov byte ptr [ebp-03], al
:0042FD09 C745F400000000          mov [ebp-0C], 00000000
:0042FD10 EB09                    jmp 0042FD1B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FD4F(U)
|
:0042FD12 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0042FD15 83C101                  add ecx, 00000001
:0042FD18 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FD10(U)
|
:0042FD1B 837DF410                cmp dword ptr [ebp-0C], 00000010
:0042FD1F 7D30                    jge 0042FD51
:0042FD21 8A55F4                  mov dl, byte ptr [ebp-0C]
:0042FD24 8855FE                  mov byte ptr [ebp-02], dl
:0042FD27 8B4508                  mov eax, dword ptr [ebp+08]
:0042FD2A 50                      push eax
:0042FD2B 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0042FD2E 51                      push ecx
:0042FD2F E8DCFDFFFF              call 0042FB10
:0042FD34 83C408                  add esp, 00000008
:0042FD37 8B55F0                  mov edx, dword ptr [ebp-10]
:0042FD3A C1E208                  shl edx, 08
:0042FD3D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0042FD40 C1E104                  shl ecx, 04
:0042FD43 8B75F4                  mov esi, dword ptr [ebp-0C]
:0042FD46 03F2                    add esi, edx
:0042FD48 888431281B4B00          mov byte ptr [ecx+esi+004B1B28], al
:0042FD4F EBC1                    jmp 0042FD12

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FD1F(C)
|
:0042FD51 EBA1                    jmp 0042FCF4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FD01(C)
|
:0042FD53 EB81                    jmp 0042FCD6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FCE3(C)
|
:0042FD55 5E                      pop esi
:0042FD56 8BE5                    mov esp, ebp
:0042FD58 5D                      pop ebp
:0042FD59 C3                      ret



* Referenced by a CALL at Addresses:
|:0041CBF0   , :0042DF88   , :00430335   , :00432310   , :00432FD5   
|:00433134   , :00441F9E   
|
:0042FD5A 55                      push ebp
:0042FD5B 8BEC                    mov ebp, esp
:0042FD5D 83EC20                  sub esp, 00000020
:0042FD60 53                      push ebx
:0042FD61 8B4518                  mov eax, dword ptr [ebp+18]
:0042FD64 8945F0                  mov dword ptr [ebp-10], eax
:0042FD67 837D2400                cmp dword ptr [ebp+24], 00000000
:0042FD6B 7507                    jne 0042FD74
:0042FD6D C7452470774900          mov [ebp+24], 00497770

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FD6B(C)
|
:0042FD74 8B4D08                  mov ecx, dword ptr [ebp+08]
:0042FD77 0FAF4D0C                imul ecx, dword ptr [ebp+0C]
:0042FD7B 894DF8                  mov dword ptr [ebp-08], ecx
:0042FD7E 8B551C                  mov edx, dword ptr [ebp+1C]
:0042FD81 81E2FF000000            and edx, 000000FF
:0042FD87 85D2                    test edx, edx
:0042FD89 0F85A3000000            jne 0042FE32
:0042FD8F C745E800000000          mov [ebp-18], 00000000
:0042FD96 EB24                    jmp 0042FDBC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FE28(U)
|
:0042FD98 8B45E8                  mov eax, dword ptr [ebp-18]
:0042FD9B 83C001                  add eax, 00000001
:0042FD9E 8945E8                  mov dword ptr [ebp-18], eax
:0042FDA1 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0042FDA4 83C101                  add ecx, 00000001
:0042FDA7 894DF0                  mov dword ptr [ebp-10], ecx
:0042FDAA 8B5510                  mov edx, dword ptr [ebp+10]
:0042FDAD 83C201                  add edx, 00000001
:0042FDB0 895510                  mov dword ptr [ebp+10], edx
:0042FDB3 8B4514                  mov eax, dword ptr [ebp+14]
:0042FDB6 83C001                  add eax, 00000001
:0042FDB9 894514                  mov dword ptr [ebp+14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FD96(U)
|
:0042FDBC 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0042FDBF 3B4DF8                  cmp ecx, dword ptr [ebp-08]
:0042FDC2 7369                    jnb 0042FE2D
:0042FDC4 8B5510                  mov edx, dword ptr [ebp+10]
:0042FDC7 33C0                    xor eax, eax
:0042FDC9 8A02                    mov al, byte ptr [edx]
:0042FDCB 85C0                    test eax, eax
:0042FDCD 750C                    jne 0042FDDB
:0042FDCF 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0042FDD2 8B5514                  mov edx, dword ptr [ebp+14]
:0042FDD5 8A02                    mov al, byte ptr [edx]
:0042FDD7 8801                    mov byte ptr [ecx], al
:0042FDD9 EB4D                    jmp 0042FE28

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FDCD(C)
|
:0042FDDB 8B4D10                  mov ecx, dword ptr [ebp+10]
:0042FDDE 33D2                    xor edx, edx
:0042FDE0 8A11                    mov dl, byte ptr [ecx]
:0042FDE2 6BD203                  imul edx, 00000003
:0042FDE5 8B4524                  mov eax, dword ptr [ebp+24]
:0042FDE8 33C9                    xor ecx, ecx
:0042FDEA 8A0C10                  mov cl, byte ptr [eax+edx]
:0042FDED C1E108                  shl ecx, 08
:0042FDF0 8B5510                  mov edx, dword ptr [ebp+10]
:0042FDF3 33C0                    xor eax, eax
:0042FDF5 8A02                    mov al, byte ptr [edx]
:0042FDF7 6BC003                  imul eax, 00000003
:0042FDFA 8B5524                  mov edx, dword ptr [ebp+24]
:0042FDFD 33DB                    xor ebx, ebx
:0042FDFF 8A5C0201                mov bl, byte ptr [edx+eax+01]
:0042FE03 C1E304                  shl ebx, 04
:0042FE06 8D8419281B4B00          lea eax, dword ptr [ecx+ebx+004B1B28]
:0042FE0D 8B4D10                  mov ecx, dword ptr [ebp+10]
:0042FE10 33D2                    xor edx, edx
:0042FE12 8A11                    mov dl, byte ptr [ecx]
:0042FE14 6BD203                  imul edx, 00000003
:0042FE17 8B4D24                  mov ecx, dword ptr [ebp+24]
:0042FE1A 33DB                    xor ebx, ebx
:0042FE1C 8A5C1102                mov bl, byte ptr [ecx+edx+02]
:0042FE20 8B55F0                  mov edx, dword ptr [ebp-10]
:0042FE23 8A0418                  mov al, byte ptr [eax+ebx]
:0042FE26 8802                    mov byte ptr [edx], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FDD9(U)
|
:0042FE28 E96BFFFFFF              jmp 0042FD98

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FDC2(C)
|
:0042FE2D E991020000              jmp 004300C3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FD89(C)
|
:0042FE32 8B4D28                  mov ecx, dword ptr [ebp+28]
:0042FE35 81E1FF000000            and ecx, 000000FF
:0042FE3B 85C9                    test ecx, ecx
:0042FE3D 754B                    jne 0042FE8A
:0042FE3F 8B551C                  mov edx, dword ptr [ebp+1C]
:0042FE42 81E2FF000000            and edx, 000000FF
:0042FE48 83FA10                  cmp edx, 00000010
:0042FE4B 753D                    jne 0042FE8A
:0042FE4D C745E800000000          mov [ebp-18], 00000000
:0042FE54 EB1B                    jmp 0042FE71

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FE83(U)
|
:0042FE56 8B45E8                  mov eax, dword ptr [ebp-18]
:0042FE59 83C001                  add eax, 00000001
:0042FE5C 8945E8                  mov dword ptr [ebp-18], eax
:0042FE5F 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0042FE62 83C101                  add ecx, 00000001
:0042FE65 894DF0                  mov dword ptr [ebp-10], ecx
:0042FE68 8B5514                  mov edx, dword ptr [ebp+14]
:0042FE6B 83C201                  add edx, 00000001
:0042FE6E 895514                  mov dword ptr [ebp+14], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FE54(U)
|
:0042FE71 8B45E8                  mov eax, dword ptr [ebp-18]
:0042FE74 3B45F8                  cmp eax, dword ptr [ebp-08]
:0042FE77 730C                    jnb 0042FE85
:0042FE79 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0042FE7C 8B5514                  mov edx, dword ptr [ebp+14]
:0042FE7F 8A02                    mov al, byte ptr [edx]
:0042FE81 8801                    mov byte ptr [ecx], al
:0042FE83 EBD1                    jmp 0042FE56

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FE77(C)
|
:0042FE85 E939020000              jmp 004300C3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042FE3D(C), :0042FE4B(C)
|
:0042FE8A C745E800000000          mov [ebp-18], 00000000
:0042FE91 EB24                    jmp 0042FEB7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004300BE(U)
|
:0042FE93 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0042FE96 83C101                  add ecx, 00000001
:0042FE99 894DE8                  mov dword ptr [ebp-18], ecx
:0042FE9C 8B55F0                  mov edx, dword ptr [ebp-10]
:0042FE9F 83C201                  add edx, 00000001
:0042FEA2 8955F0                  mov dword ptr [ebp-10], edx
:0042FEA5 8B4510                  mov eax, dword ptr [ebp+10]
:0042FEA8 83C001                  add eax, 00000001
:0042FEAB 894510                  mov dword ptr [ebp+10], eax
:0042FEAE 8B4D14                  mov ecx, dword ptr [ebp+14]
:0042FEB1 83C101                  add ecx, 00000001
:0042FEB4 894D14                  mov dword ptr [ebp+14], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FE91(U)
|
:0042FEB7 8B55E8                  mov edx, dword ptr [ebp-18]
:0042FEBA 3B55F8                  cmp edx, dword ptr [ebp-08]
:0042FEBD 0F8300020000            jnb 004300C3
:0042FEC3 8B4510                  mov eax, dword ptr [ebp+10]
:0042FEC6 33C9                    xor ecx, ecx
:0042FEC8 8A08                    mov cl, byte ptr [eax]
:0042FECA 85C9                    test ecx, ecx
:0042FECC 750F                    jne 0042FEDD
:0042FECE 8B55F0                  mov edx, dword ptr [ebp-10]
:0042FED1 8B4514                  mov eax, dword ptr [ebp+14]
:0042FED4 8A08                    mov cl, byte ptr [eax]
:0042FED6 880A                    mov byte ptr [edx], cl
:0042FED8 E9E1010000              jmp 004300BE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FECC(C)
|
:0042FEDD 837D2000                cmp dword ptr [ebp+20], 00000000
:0042FEE1 7453                    je 0042FF36
:0042FEE3 8B5510                  mov edx, dword ptr [ebp+10]
:0042FEE6 33C0                    xor eax, eax
:0042FEE8 8A02                    mov al, byte ptr [edx]
:0042FEEA 6BC003                  imul eax, 00000003
:0042FEED 8B4D24                  mov ecx, dword ptr [ebp+24]
:0042FEF0 33D2                    xor edx, edx
:0042FEF2 8A1401                  mov dl, byte ptr [ecx+eax]
:0042FEF5 8B4510                  mov eax, dword ptr [ebp+10]
:0042FEF8 33C9                    xor ecx, ecx
:0042FEFA 8A08                    mov cl, byte ptr [eax]
:0042FEFC 6BC903                  imul ecx, 00000003
:0042FEFF 8B4524                  mov eax, dword ptr [ebp+24]
:0042FF02 33DB                    xor ebx, ebx
:0042FF04 8A5C0801                mov bl, byte ptr [eax+ecx+01]
:0042FF08 03D3                    add edx, ebx
:0042FF0A 8B4D10                  mov ecx, dword ptr [ebp+10]
:0042FF0D 33C0                    xor eax, eax
:0042FF0F 8A01                    mov al, byte ptr [ecx]
:0042FF11 6BC003                  imul eax, 00000003
:0042FF14 8B4D24                  mov ecx, dword ptr [ebp+24]
:0042FF17 33DB                    xor ebx, ebx
:0042FF19 8A5C0102                mov bl, byte ptr [ecx+eax+02]
:0042FF1D 03D3                    add edx, ebx
:0042FF1F B82D000000              mov eax, 0000002D
:0042FF24 2BC2                    sub eax, edx
:0042FF26 99                      cdq
:0042FF27 B903000000              mov ecx, 00000003
:0042FF2C F7F9                    idiv ecx
:0042FF2E 83C001                  add eax, 00000001
:0042FF31 8945EC                  mov dword ptr [ebp-14], eax
:0042FF34 EB49                    jmp 0042FF7F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FEE1(C)
|
:0042FF36 8B5510                  mov edx, dword ptr [ebp+10]
:0042FF39 33C0                    xor eax, eax
:0042FF3B 8A02                    mov al, byte ptr [edx]
:0042FF3D 6BC003                  imul eax, 00000003
:0042FF40 8B4D24                  mov ecx, dword ptr [ebp+24]
:0042FF43 33D2                    xor edx, edx
:0042FF45 8A1401                  mov dl, byte ptr [ecx+eax]
:0042FF48 8BC2                    mov eax, edx
:0042FF4A 8B4D10                  mov ecx, dword ptr [ebp+10]
:0042FF4D 33D2                    xor edx, edx
:0042FF4F 8A11                    mov dl, byte ptr [ecx]
:0042FF51 6BD203                  imul edx, 00000003
:0042FF54 8B4D24                  mov ecx, dword ptr [ebp+24]
:0042FF57 33DB                    xor ebx, ebx
:0042FF59 8A5C1101                mov bl, byte ptr [ecx+edx+01]
:0042FF5D 03C3                    add eax, ebx
:0042FF5F 8B5510                  mov edx, dword ptr [ebp+10]
:0042FF62 33C9                    xor ecx, ecx
:0042FF64 8A0A                    mov cl, byte ptr [edx]
:0042FF66 6BC903                  imul ecx, 00000003
:0042FF69 8B5524                  mov edx, dword ptr [ebp+24]
:0042FF6C 33DB                    xor ebx, ebx
:0042FF6E 8A5C0A02                mov bl, byte ptr [edx+ecx+02]
:0042FF72 03C3                    add eax, ebx
:0042FF74 99                      cdq
:0042FF75 B903000000              mov ecx, 00000003
:0042FF7A F7F9                    idiv ecx
:0042FF7C 8945EC                  mov dword ptr [ebp-14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FF34(U)
|
:0042FF7F 8B551C                  mov edx, dword ptr [ebp+1C]
:0042FF82 81E2FF000000            and edx, 000000FF
:0042FF88 8B4528                  mov eax, dword ptr [ebp+28]
:0042FF8B 25FF000000              and eax, 000000FF
:0042FF90 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0042FF93 0FAFC8                  imul ecx, eax
:0042FF96 B800010000              mov eax, 00000100
:0042FF9B 2BC1                    sub eax, ecx
:0042FF9D 0FAFD0                  imul edx, eax
:0042FFA0 C1EA04                  shr edx, 04
:0042FFA3 8955E0                  mov dword ptr [ebp-20], edx
:0042FFA6 837DE000                cmp dword ptr [ebp-20], 00000000
:0042FFAA 7552                    jne 0042FFFE
:0042FFAC 8B4D10                  mov ecx, dword ptr [ebp+10]
:0042FFAF 33D2                    xor edx, edx
:0042FFB1 8A11                    mov dl, byte ptr [ecx]
:0042FFB3 6BD203                  imul edx, 00000003
:0042FFB6 8B4524                  mov eax, dword ptr [ebp+24]
:0042FFB9 33C9                    xor ecx, ecx
:0042FFBB 8A0C10                  mov cl, byte ptr [eax+edx]
:0042FFBE C1E108                  shl ecx, 08
:0042FFC1 8B5510                  mov edx, dword ptr [ebp+10]
:0042FFC4 33C0                    xor eax, eax
:0042FFC6 8A02                    mov al, byte ptr [edx]
:0042FFC8 6BC003                  imul eax, 00000003
:0042FFCB 8B5524                  mov edx, dword ptr [ebp+24]
:0042FFCE 33DB                    xor ebx, ebx
:0042FFD0 8A5C0201                mov bl, byte ptr [edx+eax+01]
:0042FFD4 C1E304                  shl ebx, 04
:0042FFD7 8D8419281B4B00          lea eax, dword ptr [ecx+ebx+004B1B28]
:0042FFDE 8B4D10                  mov ecx, dword ptr [ebp+10]
:0042FFE1 33D2                    xor edx, edx
:0042FFE3 8A11                    mov dl, byte ptr [ecx]
:0042FFE5 6BD203                  imul edx, 00000003
:0042FFE8 8B4D24                  mov ecx, dword ptr [ebp+24]
:0042FFEB 33DB                    xor ebx, ebx
:0042FFED 8A5C1102                mov bl, byte ptr [ecx+edx+02]
:0042FFF1 8B55F0                  mov edx, dword ptr [ebp-10]
:0042FFF4 8A0418                  mov al, byte ptr [eax+ebx]
:0042FFF7 8802                    mov byte ptr [edx], al
:0042FFF9 E9C0000000              jmp 004300BE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042FFAA(C)
|
:0042FFFE 8B4D28                  mov ecx, dword ptr [ebp+28]
:00430001 81E1FF000000            and ecx, 000000FF
:00430007 BA10000000              mov edx, 00000010
:0043000C 2BD1                    sub edx, ecx
:0043000E 8B45E0                  mov eax, dword ptr [ebp-20]
:00430011 0FAFC2                  imul eax, edx
:00430014 C1E804                  shr eax, 04
:00430017 B900010000              mov ecx, 00000100
:0043001C 2BC8                    sub ecx, eax
:0043001E 894DF4                  mov dword ptr [ebp-0C], ecx
:00430021 C745E400000000          mov [ebp-1C], 00000000
:00430028 EB09                    jmp 00430033

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043008E(U)
|
:0043002A 8B55E4                  mov edx, dword ptr [ebp-1C]
:0043002D 83C201                  add edx, 00000001
:00430030 8955E4                  mov dword ptr [ebp-1C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430028(U)
|
:00430033 837DE403                cmp dword ptr [ebp-1C], 00000003
:00430037 7357                    jnb 00430090
:00430039 8B4514                  mov eax, dword ptr [ebp+14]
:0043003C 33C9                    xor ecx, ecx
:0043003E 8A08                    mov cl, byte ptr [eax]
:00430040 6BC903                  imul ecx, 00000003
:00430043 8B55E4                  mov edx, dword ptr [ebp-1C]
:00430046 33C0                    xor eax, eax
:00430048 8A841170774900          mov al, byte ptr [ecx+edx+00497770]
:0043004F 0FAF45E0                imul eax, dword ptr [ebp-20]
:00430053 8B4D10                  mov ecx, dword ptr [ebp+10]
:00430056 33D2                    xor edx, edx
:00430058 8A11                    mov dl, byte ptr [ecx]
:0043005A 6BD203                  imul edx, 00000003
:0043005D 0355E4                  add edx, dword ptr [ebp-1C]
:00430060 8B4D24                  mov ecx, dword ptr [ebp+24]
:00430063 33DB                    xor ebx, ebx
:00430065 8A1C11                  mov bl, byte ptr [ecx+edx]
:00430068 0FAF5DF4                imul ebx, dword ptr [ebp-0C]
:0043006C 03C3                    add eax, ebx
:0043006E C1E808                  shr eax, 08
:00430071 8B55E4                  mov edx, dword ptr [ebp-1C]
:00430074 884415FC                mov byte ptr [ebp+edx-04], al
:00430078 8B45E4                  mov eax, dword ptr [ebp-1C]
:0043007B 33C9                    xor ecx, ecx
:0043007D 8A4C05FC                mov cl, byte ptr [ebp+eax-04]
:00430081 83F90F                  cmp ecx, 0000000F
:00430084 7E08                    jle 0043008E
:00430086 8B55E4                  mov edx, dword ptr [ebp-1C]
:00430089 C64415FC0F              mov [ebp+edx-04], 0F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430084(C)
|
:0043008E EB9A                    jmp 0043002A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430037(C)
|
:00430090 8B45FC                  mov eax, dword ptr [ebp-04]
:00430093 25FF000000              and eax, 000000FF
:00430098 C1E008                  shl eax, 08
:0043009B 8B4DFD                  mov ecx, dword ptr [ebp-03]
:0043009E 81E1FF000000            and ecx, 000000FF
:004300A4 C1E104                  shl ecx, 04
:004300A7 8D9408281B4B00          lea edx, dword ptr [eax+ecx+004B1B28]
:004300AE 8B45FE                  mov eax, dword ptr [ebp-02]
:004300B1 25FF000000              and eax, 000000FF
:004300B6 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004300B9 8A1402                  mov dl, byte ptr [edx+eax]
:004300BC 8811                    mov byte ptr [ecx], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042FED8(U), :0042FFF9(U)
|
:004300BE E9D0FDFFFF              jmp 0042FE93

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042FE2D(U), :0042FE85(U), :0042FEBD(C)
|
:004300C3 5B                      pop ebx
:004300C4 8BE5                    mov esp, ebp
:004300C6 5D                      pop ebp
:004300C7 C3                      ret



* Referenced by a CALL at Address:
|:0043038C   
|
:004300C8 55                      push ebp
:004300C9 8BEC                    mov ebp, esp
:004300CB 83EC20                  sub esp, 00000020
:004300CE 53                      push ebx
:004300CF 837D2000                cmp dword ptr [ebp+20], 00000000
:004300D3 7507                    jne 004300DC
:004300D5 C7452070774900          mov [ebp+20], 00497770

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004300D3(C)
|
:004300DC 8B451C                  mov eax, dword ptr [ebp+1C]
:004300DF 8945F0                  mov dword ptr [ebp-10], eax
:004300E2 8B4D08                  mov ecx, dword ptr [ebp+08]
:004300E5 0FAF4D0C                imul ecx, dword ptr [ebp+0C]
:004300E9 894DF8                  mov dword ptr [ebp-08], ecx
:004300EC C745E800000000          mov [ebp-18], 00000000
:004300F3 EB2D                    jmp 00430122

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00430169(U), :00430304(U)
|
:004300F5 8B55E8                  mov edx, dword ptr [ebp-18]
:004300F8 83C201                  add edx, 00000001
:004300FB 8955E8                  mov dword ptr [ebp-18], edx
:004300FE 8B45F0                  mov eax, dword ptr [ebp-10]
:00430101 83C001                  add eax, 00000001
:00430104 8945F0                  mov dword ptr [ebp-10], eax
:00430107 8B4D10                  mov ecx, dword ptr [ebp+10]
:0043010A 83C101                  add ecx, 00000001
:0043010D 894D10                  mov dword ptr [ebp+10], ecx
:00430110 8B5514                  mov edx, dword ptr [ebp+14]
:00430113 83C201                  add edx, 00000001
:00430116 895514                  mov dword ptr [ebp+14], edx
:00430119 8B4518                  mov eax, dword ptr [ebp+18]
:0043011C 83C001                  add eax, 00000001
:0043011F 894518                  mov dword ptr [ebp+18], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004300F3(U)
|
:00430122 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00430125 3B4DF8                  cmp ecx, dword ptr [ebp-08]
:00430128 0F83DB010000            jnb 00430309
:0043012E 8B5510                  mov edx, dword ptr [ebp+10]
:00430131 33C0                    xor eax, eax
:00430133 8A02                    mov al, byte ptr [edx]
:00430135 85C0                    test eax, eax
:00430137 750F                    jne 00430148
:00430139 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043013C 8B5518                  mov edx, dword ptr [ebp+18]
:0043013F 8A02                    mov al, byte ptr [edx]
:00430141 8801                    mov byte ptr [ecx], al
:00430143 E9BC010000              jmp 00430304

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430137(C)
|
:00430148 8B4D14                  mov ecx, dword ptr [ebp+14]
:0043014B 33D2                    xor edx, edx
:0043014D 8A11                    mov dl, byte ptr [ecx]
:0043014F 85D2                    test edx, edx
:00430151 7518                    jne 0043016B
:00430153 8B4524                  mov eax, dword ptr [ebp+24]
:00430156 25FF000000              and eax, 000000FF
:0043015B 85C0                    test eax, eax
:0043015D 750C                    jne 0043016B
:0043015F 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00430162 8B5518                  mov edx, dword ptr [ebp+18]
:00430165 8A02                    mov al, byte ptr [edx]
:00430167 8801                    mov byte ptr [ecx], al
:00430169 EB8A                    jmp 004300F5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00430151(C), :0043015D(C)
|
:0043016B 8B4D10                  mov ecx, dword ptr [ebp+10]
:0043016E 33D2                    xor edx, edx
:00430170 8A11                    mov dl, byte ptr [ecx]
:00430172 6BD203                  imul edx, 00000003
:00430175 8B4520                  mov eax, dword ptr [ebp+20]
:00430178 33C9                    xor ecx, ecx
:0043017A 8A0C10                  mov cl, byte ptr [eax+edx]
:0043017D 8BC1                    mov eax, ecx
:0043017F 8B5510                  mov edx, dword ptr [ebp+10]
:00430182 33C9                    xor ecx, ecx
:00430184 8A0A                    mov cl, byte ptr [edx]
:00430186 6BC903                  imul ecx, 00000003
:00430189 8B5520                  mov edx, dword ptr [ebp+20]
:0043018C 33DB                    xor ebx, ebx
:0043018E 8A5C0A01                mov bl, byte ptr [edx+ecx+01]
:00430192 03C3                    add eax, ebx
:00430194 8B4D10                  mov ecx, dword ptr [ebp+10]
:00430197 33D2                    xor edx, edx
:00430199 8A11                    mov dl, byte ptr [ecx]
:0043019B 6BD203                  imul edx, 00000003
:0043019E 8B4D20                  mov ecx, dword ptr [ebp+20]
:004301A1 33DB                    xor ebx, ebx
:004301A3 8A5C1102                mov bl, byte ptr [ecx+edx+02]
:004301A7 03C3                    add eax, ebx
:004301A9 99                      cdq
:004301AA B903000000              mov ecx, 00000003
:004301AF F7F9                    idiv ecx
:004301B1 8945EC                  mov dword ptr [ebp-14], eax
:004301B4 8B5514                  mov edx, dword ptr [ebp+14]
:004301B7 33C0                    xor eax, eax
:004301B9 8A02                    mov al, byte ptr [edx]
:004301BB B900010000              mov ecx, 00000100
:004301C0 2BC8                    sub ecx, eax
:004301C2 8B5524                  mov edx, dword ptr [ebp+24]
:004301C5 81E2FF000000            and edx, 000000FF
:004301CB 8B45EC                  mov eax, dword ptr [ebp-14]
:004301CE 0FAFC2                  imul eax, edx
:004301D1 BA00010000              mov edx, 00000100
:004301D6 2BD0                    sub edx, eax
:004301D8 0FAFCA                  imul ecx, edx
:004301DB C1E908                  shr ecx, 08
:004301DE 894DE0                  mov dword ptr [ebp-20], ecx
:004301E1 8B4514                  mov eax, dword ptr [ebp+14]
:004301E4 33C9                    xor ecx, ecx
:004301E6 8A08                    mov cl, byte ptr [eax]
:004301E8 81F9FF000000            cmp ecx, 000000FF
:004301EE 7552                    jne 00430242
:004301F0 8B5510                  mov edx, dword ptr [ebp+10]
:004301F3 33C0                    xor eax, eax
:004301F5 8A02                    mov al, byte ptr [edx]
:004301F7 6BC003                  imul eax, 00000003
:004301FA 8B4D20                  mov ecx, dword ptr [ebp+20]
:004301FD 33D2                    xor edx, edx
:004301FF 8A1401                  mov dl, byte ptr [ecx+eax]
:00430202 C1E208                  shl edx, 08
:00430205 8B4510                  mov eax, dword ptr [ebp+10]
:00430208 33C9                    xor ecx, ecx
:0043020A 8A08                    mov cl, byte ptr [eax]
:0043020C 6BC903                  imul ecx, 00000003
:0043020F 8B4520                  mov eax, dword ptr [ebp+20]
:00430212 33DB                    xor ebx, ebx
:00430214 8A5C0801                mov bl, byte ptr [eax+ecx+01]
:00430218 C1E304                  shl ebx, 04
:0043021B 8D8C1A281B4B00          lea ecx, dword ptr [edx+ebx+004B1B28]
:00430222 8B5510                  mov edx, dword ptr [ebp+10]
:00430225 33C0                    xor eax, eax
:00430227 8A02                    mov al, byte ptr [edx]
:00430229 6BC003                  imul eax, 00000003
:0043022C 8B5520                  mov edx, dword ptr [ebp+20]
:0043022F 33DB                    xor ebx, ebx
:00430231 8A5C0202                mov bl, byte ptr [edx+eax+02]
:00430235 8B45F0                  mov eax, dword ptr [ebp-10]
:00430238 8A0C19                  mov cl, byte ptr [ecx+ebx]
:0043023B 8808                    mov byte ptr [eax], cl
:0043023D E9C2000000              jmp 00430304

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004301EE(C)
|
:00430242 8B5524                  mov edx, dword ptr [ebp+24]
:00430245 81E2FF000000            and edx, 000000FF
:0043024B B810000000              mov eax, 00000010
:00430250 2BC2                    sub eax, edx
:00430252 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00430255 0FAFC8                  imul ecx, eax
:00430258 C1E904                  shr ecx, 04
:0043025B BA00010000              mov edx, 00000100
:00430260 2BD1                    sub edx, ecx
:00430262 8955F4                  mov dword ptr [ebp-0C], edx
:00430265 C745E400000000          mov [ebp-1C], 00000000
:0043026C EB09                    jmp 00430277

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004302D2(U)
|
:0043026E 8B45E4                  mov eax, dword ptr [ebp-1C]
:00430271 83C001                  add eax, 00000001
:00430274 8945E4                  mov dword ptr [ebp-1C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043026C(U)
|
:00430277 837DE403                cmp dword ptr [ebp-1C], 00000003
:0043027B 7357                    jnb 004302D4
:0043027D 8B4D18                  mov ecx, dword ptr [ebp+18]
:00430280 33D2                    xor edx, edx
:00430282 8A11                    mov dl, byte ptr [ecx]
:00430284 6BD203                  imul edx, 00000003
:00430287 8B45E4                  mov eax, dword ptr [ebp-1C]
:0043028A 33C9                    xor ecx, ecx
:0043028C 8A8C0270774900          mov cl, byte ptr [edx+eax+00497770]
:00430293 0FAF4DE0                imul ecx, dword ptr [ebp-20]
:00430297 8B5510                  mov edx, dword ptr [ebp+10]
:0043029A 33C0                    xor eax, eax
:0043029C 8A02                    mov al, byte ptr [edx]
:0043029E 6BC003                  imul eax, 00000003
:004302A1 0345E4                  add eax, dword ptr [ebp-1C]
:004302A4 8B5520                  mov edx, dword ptr [ebp+20]
:004302A7 33DB                    xor ebx, ebx
:004302A9 8A1C02                  mov bl, byte ptr [edx+eax]
:004302AC 0FAF5DF4                imul ebx, dword ptr [ebp-0C]
:004302B0 03CB                    add ecx, ebx
:004302B2 C1E908                  shr ecx, 08
:004302B5 8B45E4                  mov eax, dword ptr [ebp-1C]
:004302B8 884C05FC                mov byte ptr [ebp+eax-04], cl
:004302BC 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004302BF 33D2                    xor edx, edx
:004302C1 8A540DFC                mov dl, byte ptr [ebp+ecx-04]
:004302C5 83FA0F                  cmp edx, 0000000F
:004302C8 7E08                    jle 004302D2
:004302CA 8B45E4                  mov eax, dword ptr [ebp-1C]
:004302CD C64405FC0F              mov [ebp+eax-04], 0F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004302C8(C)
|
:004302D2 EB9A                    jmp 0043026E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043027B(C)
|
:004302D4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004302D7 81E1FF000000            and ecx, 000000FF
:004302DD C1E108                  shl ecx, 08
:004302E0 8B55FD                  mov edx, dword ptr [ebp-03]
:004302E3 81E2FF000000            and edx, 000000FF
:004302E9 C1E204                  shl edx, 04
:004302EC 8D8411281B4B00          lea eax, dword ptr [ecx+edx+004B1B28]
:004302F3 8B4DFE                  mov ecx, dword ptr [ebp-02]
:004302F6 81E1FF000000            and ecx, 000000FF
:004302FC 8B55F0                  mov edx, dword ptr [ebp-10]
:004302FF 8A0408                  mov al, byte ptr [eax+ecx]
:00430302 8802                    mov byte ptr [edx], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00430143(U), :0043023D(U)
|
:00430304 E9ECFDFFFF              jmp 004300F5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430128(C)
|
:00430309 5B                      pop ebx
:0043030A 8BE5                    mov esp, ebp
:0043030C 5D                      pop ebp
:0043030D C3                      ret



* Referenced by a CALL at Addresses:
|:0040245E   , :00402EA3   , :0045CFDA   
|
:0043030E 55                      push ebp
:0043030F 8BEC                    mov ebp, esp
:00430311 8A4534                  mov al, byte ptr [ebp+34]
:00430314 50                      push eax
:00430315 8B4D30                  mov ecx, dword ptr [ebp+30]
:00430318 51                      push ecx
:00430319 8B552C                  mov edx, dword ptr [ebp+2C]
:0043031C 52                      push edx
:0043031D 8A4528                  mov al, byte ptr [ebp+28]
:00430320 50                      push eax
:00430321 8B4D20                  mov ecx, dword ptr [ebp+20]
:00430324 51                      push ecx
:00430325 8B551C                  mov edx, dword ptr [ebp+1C]
:00430328 52                      push edx
:00430329 8B4518                  mov eax, dword ptr [ebp+18]
:0043032C 50                      push eax
:0043032D 8B4D14                  mov ecx, dword ptr [ebp+14]
:00430330 51                      push ecx
:00430331 8B5510                  mov edx, dword ptr [ebp+10]
:00430334 52                      push edx
:00430335 E820FAFFFF              call 0042FD5A
:0043033A 83C424                  add esp, 00000024
:0043033D 6A00                    push 00000000
:0043033F 6A00                    push 00000000
:00430341 6A00                    push 00000000
:00430343 E8A9CE0400              call 0047D1F1
:00430348 83C40C                  add esp, 0000000C
:0043034B 8B4520                  mov eax, dword ptr [ebp+20]
:0043034E 50                      push eax
:0043034F 8B4D14                  mov ecx, dword ptr [ebp+14]
:00430352 51                      push ecx
:00430353 8B5510                  mov edx, dword ptr [ebp+10]
:00430356 52                      push edx
:00430357 8B450C                  mov eax, dword ptr [ebp+0C]
:0043035A 50                      push eax
:0043035B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043035E 51                      push ecx
:0043035F E837DD0400              call 0047E09B
:00430364 83C414                  add esp, 00000014
:00430367 5D                      pop ebp
:00430368 C3                      ret



* Referenced by a CALL at Addresses:
|:0040238F   , :00402E3D   
|
:00430369 55                      push ebp
:0043036A 8BEC                    mov ebp, esp
:0043036C 8A4530                  mov al, byte ptr [ebp+30]
:0043036F 50                      push eax
:00430370 8B4D2C                  mov ecx, dword ptr [ebp+2C]
:00430373 51                      push ecx
:00430374 8B5524                  mov edx, dword ptr [ebp+24]
:00430377 52                      push edx
:00430378 8B4520                  mov eax, dword ptr [ebp+20]
:0043037B 50                      push eax
:0043037C 8B4D1C                  mov ecx, dword ptr [ebp+1C]
:0043037F 51                      push ecx
:00430380 8B5518                  mov edx, dword ptr [ebp+18]
:00430383 52                      push edx
:00430384 8B4514                  mov eax, dword ptr [ebp+14]
:00430387 50                      push eax
:00430388 8B4D10                  mov ecx, dword ptr [ebp+10]
:0043038B 51                      push ecx
:0043038C E837FDFFFF              call 004300C8
:00430391 83C420                  add esp, 00000020
:00430394 6A00                    push 00000000
:00430396 6A00                    push 00000000
:00430398 6A00                    push 00000000
:0043039A E852CE0400              call 0047D1F1
:0043039F 83C40C                  add esp, 0000000C
:004303A2 8B5524                  mov edx, dword ptr [ebp+24]
:004303A5 52                      push edx
:004303A6 8B4514                  mov eax, dword ptr [ebp+14]
:004303A9 50                      push eax
:004303AA 8B4D10                  mov ecx, dword ptr [ebp+10]
:004303AD 51                      push ecx
:004303AE 8B550C                  mov edx, dword ptr [ebp+0C]
:004303B1 52                      push edx
:004303B2 8B4508                  mov eax, dword ptr [ebp+08]
:004303B5 50                      push eax
:004303B6 E8E0DC0400              call 0047E09B
:004303BB 83C414                  add esp, 00000014
:004303BE 5D                      pop ebp
:004303BF C3                      ret



* Referenced by a CALL at Addresses:
|:00404AC0   , :00404C34   , :00404F46   , :00405172   , :0041D8E4   
|:0041D9ED   , :00441E7C   , :00445F67   , :004460D7   , :004464A2   
|:0044687D   , :004473A5   , :0044744D   , :00447AE8   , :00447DF6   
|:00448105   , :004481D8   , :00449572   
|
:004303C0 55                      push ebp
:004303C1 8BEC                    mov ebp, esp
:004303C3 83EC10                  sub esp, 00000010
:004303C6 8B450C                  mov eax, dword ptr [ebp+0C]
:004303C9 0FAF4510                imul eax, dword ptr [ebp+10]
:004303CD 8945F8                  mov dword ptr [ebp-08], eax
:004303D0 C745F400000000          mov [ebp-0C], 00000000
:004303D7 EB12                    jmp 004303EB

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00430402(U), :00430477(U)
|
:004303D9 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004303DC 83C101                  add ecx, 00000001
:004303DF 894DF4                  mov dword ptr [ebp-0C], ecx
:004303E2 8B5508                  mov edx, dword ptr [ebp+08]
:004303E5 83C201                  add edx, 00000001
:004303E8 895508                  mov dword ptr [ebp+08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004303D7(U)
|
:004303EB 8B45F4                  mov eax, dword ptr [ebp-0C]
:004303EE 3B45F8                  cmp eax, dword ptr [ebp-08]
:004303F1 0F8385000000            jnb 0043047C
:004303F7 8B4D08                  mov ecx, dword ptr [ebp+08]
:004303FA 33D2                    xor edx, edx
:004303FC 8A11                    mov dl, byte ptr [ecx]
:004303FE 85D2                    test edx, edx
:00430400 7502                    jne 00430404
:00430402 EBD5                    jmp 004303D9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430400(C)
|
:00430404 C745F000000000          mov [ebp-10], 00000000
:0043040B EB09                    jmp 00430416

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430446(U)
|
:0043040D 8B45F0                  mov eax, dword ptr [ebp-10]
:00430410 83C001                  add eax, 00000001
:00430413 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043040B(U)
|
:00430416 837DF003                cmp dword ptr [ebp-10], 00000003
:0043041A 732C                    jnb 00430448
:0043041C 6A0F                    push 0000000F
:0043041E 8A4D14                  mov cl, byte ptr [ebp+14]
:00430421 51                      push ecx
:00430422 8B5508                  mov edx, dword ptr [ebp+08]
:00430425 33C0                    xor eax, eax
:00430427 8A02                    mov al, byte ptr [edx]
:00430429 6BC003                  imul eax, 00000003
:0043042C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043042F 8A940870774900          mov dl, byte ptr [eax+ecx+00497770]
:00430436 52                      push edx
:00430437 E879F60400              call 0047FAB5
:0043043C 83C40C                  add esp, 0000000C
:0043043F 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00430442 88440DFC                mov byte ptr [ebp+ecx-04], al
:00430446 EBC5                    jmp 0043040D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043041A(C)
|
:00430448 8B55FC                  mov edx, dword ptr [ebp-04]
:0043044B 81E2FF000000            and edx, 000000FF
:00430451 C1E208                  shl edx, 08
:00430454 8B45FD                  mov eax, dword ptr [ebp-03]
:00430457 25FF000000              and eax, 000000FF
:0043045C C1E004                  shl eax, 04
:0043045F 8D8C02281B4B00          lea ecx, dword ptr [edx+eax+004B1B28]
:00430466 8B55FE                  mov edx, dword ptr [ebp-02]
:00430469 81E2FF000000            and edx, 000000FF
:0043046F 8B4508                  mov eax, dword ptr [ebp+08]
:00430472 8A0C11                  mov cl, byte ptr [ecx+edx]
:00430475 8808                    mov byte ptr [eax], cl
:00430477 E95DFFFFFF              jmp 004303D9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004303F1(C)
|
:0043047C 8BE5                    mov esp, ebp
:0043047E 5D                      pop ebp
:0043047F C3                      ret



* Referenced by a CALL at Addresses:
|:004221FF   , :004328A7   , :0043EBAB   , :00453CE7   , :0045C29D   
|
:00430480 55                      push ebp
:00430481 8BEC                    mov ebp, esp
:00430483 83EC10                  sub esp, 00000010
:00430486 8B450C                  mov eax, dword ptr [ebp+0C]
:00430489 0FAF4510                imul eax, dword ptr [ebp+10]
:0043048D 8945F8                  mov dword ptr [ebp-08], eax
:00430490 C745F400000000          mov [ebp-0C], 00000000
:00430497 EB12                    jmp 004304AB

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004304C2(U), :00430535(U)
|
:00430499 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043049C 83C101                  add ecx, 00000001
:0043049F 894DF4                  mov dword ptr [ebp-0C], ecx
:004304A2 8B5508                  mov edx, dword ptr [ebp+08]
:004304A5 83C201                  add edx, 00000001
:004304A8 895508                  mov dword ptr [ebp+08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430497(U)
|
:004304AB 8B45F4                  mov eax, dword ptr [ebp-0C]
:004304AE 3B45F8                  cmp eax, dword ptr [ebp-08]
:004304B1 0F8383000000            jnb 0043053A
:004304B7 8B4D08                  mov ecx, dword ptr [ebp+08]
:004304BA 33D2                    xor edx, edx
:004304BC 8A11                    mov dl, byte ptr [ecx]
:004304BE 85D2                    test edx, edx
:004304C0 7502                    jne 004304C4
:004304C2 EBD5                    jmp 00430499

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004304C0(C)
|
:004304C4 C745F000000000          mov [ebp-10], 00000000
:004304CB EB09                    jmp 004304D6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430504(U)
|
:004304CD 8B45F0                  mov eax, dword ptr [ebp-10]
:004304D0 83C001                  add eax, 00000001
:004304D3 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004304CB(U)
|
:004304D6 837DF003                cmp dword ptr [ebp-10], 00000003
:004304DA 732A                    jnb 00430506
:004304DC 8A4D14                  mov cl, byte ptr [ebp+14]
:004304DF 51                      push ecx
:004304E0 8B5508                  mov edx, dword ptr [ebp+08]
:004304E3 33C0                    xor eax, eax
:004304E5 8A02                    mov al, byte ptr [edx]
:004304E7 6BC003                  imul eax, 00000003
:004304EA 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004304ED 8A940870774900          mov dl, byte ptr [eax+ecx+00497770]
:004304F4 52                      push edx
:004304F5 E8D6F50400              call 0047FAD0
:004304FA 83C408                  add esp, 00000008
:004304FD 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00430500 88440DFC                mov byte ptr [ebp+ecx-04], al
:00430504 EBC7                    jmp 004304CD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004304DA(C)
|
:00430506 8B55FC                  mov edx, dword ptr [ebp-04]
:00430509 81E2FF000000            and edx, 000000FF
:0043050F C1E208                  shl edx, 08
:00430512 8B45FD                  mov eax, dword ptr [ebp-03]
:00430515 25FF000000              and eax, 000000FF
:0043051A C1E004                  shl eax, 04
:0043051D 8D8C02281B4B00          lea ecx, dword ptr [edx+eax+004B1B28]
:00430524 8B55FE                  mov edx, dword ptr [ebp-02]
:00430527 81E2FF000000            and edx, 000000FF
:0043052D 8B4508                  mov eax, dword ptr [ebp+08]
:00430530 8A0C11                  mov cl, byte ptr [ecx+edx]
:00430533 8808                    mov byte ptr [eax], cl
:00430535 E95FFFFFFF              jmp 00430499

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004304B1(C)
|
:0043053A 8BE5                    mov esp, ebp
:0043053C 5D                      pop ebp
:0043053D C3                      ret



* Referenced by a CALL at Addresses:
|:0040519A   , :0043EBF2   
|
:0043053E 55                      push ebp
:0043053F 8BEC                    mov ebp, esp
:00430541 83EC1C                  sub esp, 0000001C
:00430544 8B450C                  mov eax, dword ptr [ebp+0C]
:00430547 0FAF4510                imul eax, dword ptr [ebp+10]
:0043054B 8945F4                  mov dword ptr [ebp-0C], eax
:0043054E C745F000000000          mov [ebp-10], 00000000
:00430555 EB12                    jmp 00430569

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00430580(U), :004306A1(U)
|
:00430557 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043055A 83C101                  add ecx, 00000001
:0043055D 894DF0                  mov dword ptr [ebp-10], ecx
:00430560 8B5508                  mov edx, dword ptr [ebp+08]
:00430563 83C201                  add edx, 00000001
:00430566 895508                  mov dword ptr [ebp+08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430555(U)
|
:00430569 8B45F0                  mov eax, dword ptr [ebp-10]
:0043056C 3B45F4                  cmp eax, dword ptr [ebp-0C]
:0043056F 0F8331010000            jnb 004306A6
:00430575 8B4D08                  mov ecx, dword ptr [ebp+08]
:00430578 33D2                    xor edx, edx
:0043057A 8A11                    mov dl, byte ptr [ecx]
:0043057C 85D2                    test edx, edx
:0043057E 7502                    jne 00430582
:00430580 EBD5                    jmp 00430557

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043057E(C)
|
:00430582 C745EC00000000          mov [ebp-14], 00000000
:00430589 EB09                    jmp 00430594

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043066D(U)
|
:0043058B 8B45EC                  mov eax, dword ptr [ebp-14]
:0043058E 83C001                  add eax, 00000001
:00430591 8945EC                  mov dword ptr [ebp-14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430589(U)
|
:00430594 837DEC03                cmp dword ptr [ebp-14], 00000003
:00430598 0F83D4000000            jnb 00430672
:0043059E 837DEC00                cmp dword ptr [ebp-14], 00000000
:004305A2 7508                    jne 004305AC
:004305A4 8A4D1C                  mov cl, byte ptr [ebp+1C]
:004305A7 884DEB                  mov byte ptr [ebp-15], cl
:004305AA EB1A                    jmp 004305C6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004305A2(C)
|
:004305AC 837DEC01                cmp dword ptr [ebp-14], 00000001
:004305B0 7508                    jne 004305BA
:004305B2 8A5514                  mov dl, byte ptr [ebp+14]
:004305B5 8855EA                  mov byte ptr [ebp-16], dl
:004305B8 EB06                    jmp 004305C0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004305B0(C)
|
:004305BA 8A4518                  mov al, byte ptr [ebp+18]
:004305BD 8845EA                  mov byte ptr [ebp-16], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004305B8(U)
|
:004305C0 8A4DEA                  mov cl, byte ptr [ebp-16]
:004305C3 884DEB                  mov byte ptr [ebp-15], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004305AA(U)
|
:004305C6 8A55EB                  mov dl, byte ptr [ebp-15]
:004305C9 8855FC                  mov byte ptr [ebp-04], dl
:004305CC 8B45FC                  mov eax, dword ptr [ebp-04]
:004305CF 25FF000000              and eax, 000000FF
:004305D4 83F807                  cmp eax, 00000007
:004305D7 7E3C                    jle 00430615
:004305D9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004305DC 81E1FF000000            and ecx, 000000FF
:004305E2 8D5409F2                lea edx, dword ptr [ecx+ecx-0E]
:004305E6 8855FC                  mov byte ptr [ebp-04], dl
:004305E9 6A0F                    push 0000000F
:004305EB 8A45FC                  mov al, byte ptr [ebp-04]
:004305EE 50                      push eax
:004305EF 8B4D08                  mov ecx, dword ptr [ebp+08]
:004305F2 33D2                    xor edx, edx
:004305F4 8A11                    mov dl, byte ptr [ecx]
:004305F6 6BD203                  imul edx, 00000003
:004305F9 8B45EC                  mov eax, dword ptr [ebp-14]
:004305FC 8A8C0270774900          mov cl, byte ptr [edx+eax+00497770]
:00430603 51                      push ecx
:00430604 E8ACF40400              call 0047FAB5
:00430609 83C40C                  add esp, 0000000C
:0043060C 8B55EC                  mov edx, dword ptr [ebp-14]
:0043060F 884415F8                mov byte ptr [ebp+edx-08], al
:00430613 EB58                    jmp 0043066D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004305D7(C)
|
:00430615 8B45FC                  mov eax, dword ptr [ebp-04]
:00430618 25FF000000              and eax, 000000FF
:0043061D 85C0                    test eax, eax
:0043061F 7509                    jne 0043062A
:00430621 C745E40F000000          mov [ebp-1C], 0000000F
:00430628 EB15                    jmp 0043063F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043061F(C)
|
:0043062A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043062D 81E1FF000000            and ecx, 000000FF

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:00430633 BA07000000              mov edx, 00000007
:00430638 2BD1                    sub edx, ecx
:0043063A D1E2                    shl edx, 1
:0043063C 8955E4                  mov dword ptr [ebp-1C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430628(U)
|
:0043063F 8A45E4                  mov al, byte ptr [ebp-1C]
:00430642 8845FC                  mov byte ptr [ebp-04], al
:00430645 8A4DFC                  mov cl, byte ptr [ebp-04]
:00430648 51                      push ecx
:00430649 8B5508                  mov edx, dword ptr [ebp+08]
:0043064C 33C0                    xor eax, eax
:0043064E 8A02                    mov al, byte ptr [edx]
:00430650 6BC003                  imul eax, 00000003
:00430653 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00430656 8A940870774900          mov dl, byte ptr [eax+ecx+00497770]
:0043065D 52                      push edx
:0043065E E86DF40400              call 0047FAD0
:00430663 83C408                  add esp, 00000008
:00430666 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00430669 88440DF8                mov byte ptr [ebp+ecx-08], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430613(U)
|
:0043066D E919FFFFFF              jmp 0043058B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430598(C)
|
:00430672 8B55F8                  mov edx, dword ptr [ebp-08]
:00430675 81E2FF000000            and edx, 000000FF
:0043067B C1E208                  shl edx, 08
:0043067E 8B45F9                  mov eax, dword ptr [ebp-07]
:00430681 25FF000000              and eax, 000000FF
:00430686 C1E004                  shl eax, 04
:00430689 8D8C02281B4B00          lea ecx, dword ptr [edx+eax+004B1B28]
:00430690 8B55FA                  mov edx, dword ptr [ebp-06]
:00430693 81E2FF000000            and edx, 000000FF
:00430699 8B4508                  mov eax, dword ptr [ebp+08]
:0043069C 8A0C11                  mov cl, byte ptr [ecx+edx]
:0043069F 8808                    mov byte ptr [eax], cl
:004306A1 E9B1FEFFFF              jmp 00430557

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043056F(C)
|
:004306A6 8BE5                    mov esp, ebp
:004306A8 5D                      pop ebp
:004306A9 C3                      ret



* Referenced by a CALL at Addresses:
|:0040AC6B   , :0045DC13   
|
:004306AA 55                      push ebp
:004306AB 8BEC                    mov ebp, esp
:004306AD 83EC1C                  sub esp, 0000001C
:004306B0 8B450C                  mov eax, dword ptr [ebp+0C]
:004306B3 0FAF4510                imul eax, dword ptr [ebp+10]
:004306B7 8945F8                  mov dword ptr [ebp-08], eax
:004306BA 8A4D1C                  mov cl, byte ptr [ebp+1C]
:004306BD 884DEC                  mov byte ptr [ebp-14], cl
:004306C0 8A5514                  mov dl, byte ptr [ebp+14]
:004306C3 8855ED                  mov byte ptr [ebp-13], dl
:004306C6 8A4518                  mov al, byte ptr [ebp+18]
:004306C9 8845EE                  mov byte ptr [ebp-12], al
:004306CC C745E800000000          mov [ebp-18], 00000000
:004306D3 EB12                    jmp 004306E7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004306FE(U), :00430720(U), :00430871(U)
|
:004306D5 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004306D8 83C101                  add ecx, 00000001
:004306DB 894DE8                  mov dword ptr [ebp-18], ecx
:004306DE 8B5508                  mov edx, dword ptr [ebp+08]
:004306E1 83C201                  add edx, 00000001
:004306E4 895508                  mov dword ptr [ebp+08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004306D3(U)
|
:004306E7 8B45E8                  mov eax, dword ptr [ebp-18]
:004306EA 3B45F8                  cmp eax, dword ptr [ebp-08]
:004306ED 0F8383010000            jnb 00430876
:004306F3 8B4D08                  mov ecx, dword ptr [ebp+08]
:004306F6 33D2                    xor edx, edx
:004306F8 8A11                    mov dl, byte ptr [ecx]
:004306FA 85D2                    test edx, edx
:004306FC 7502                    jne 00430700
:004306FE EBD5                    jmp 004306D5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004306FC(C)
|
:00430700 837D2400                cmp dword ptr [ebp+24], 00000000
:00430704 741C                    je 00430722
:00430706 8B4508                  mov eax, dword ptr [ebp+08]
:00430709 33C9                    xor ecx, ecx
:0043070B 8A08                    mov cl, byte ptr [eax]
:0043070D 8B5520                  mov edx, dword ptr [ebp+20]
:00430710 81E2FF000000            and edx, 000000FF
:00430716 3BCA                    cmp ecx, edx
:00430718 7508                    jne 00430722
:0043071A 8B4508                  mov eax, dword ptr [ebp+08]
:0043071D C60000                  mov byte ptr [eax], 00
:00430720 EBB3                    jmp 004306D5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00430704(C), :00430718(C)
|
:00430722 8B4D08                  mov ecx, dword ptr [ebp+08]
:00430725 33D2                    xor edx, edx
:00430727 8A11                    mov dl, byte ptr [ecx]
:00430729 6BD203                  imul edx, 00000003
:0043072C 33C0                    xor eax, eax
:0043072E 8A8270774900            mov al, byte ptr [edx+00497770]
:00430734 8B4D08                  mov ecx, dword ptr [ebp+08]
:00430737 33D2                    xor edx, edx
:00430739 8A11                    mov dl, byte ptr [ecx]
:0043073B 6BD203                  imul edx, 00000003
:0043073E 33C9                    xor ecx, ecx
:00430740 8A8A71774900            mov cl, byte ptr [edx+00497771]
:00430746 03C1                    add eax, ecx
:00430748 8B5508                  mov edx, dword ptr [ebp+08]
:0043074B 33C9                    xor ecx, ecx
:0043074D 8A0A                    mov cl, byte ptr [edx]
:0043074F 6BC903                  imul ecx, 00000003
:00430752 33D2                    xor edx, edx
:00430754 8A9172774900            mov dl, byte ptr [ecx+00497772]
:0043075A 03C2                    add eax, edx
:0043075C 668945F4                mov word ptr [ebp-0C], ax
:00430760 8B4520                  mov eax, dword ptr [ebp+20]
:00430763 25FF000000              and eax, 000000FF
:00430768 85C0                    test eax, eax
:0043076A 7524                    jne 00430790
:0043076C 8B4D1C                  mov ecx, dword ptr [ebp+1C]
:0043076F 81E1FF000000            and ecx, 000000FF
:00430775 8B5514                  mov edx, dword ptr [ebp+14]
:00430778 81E2FF000000            and edx, 000000FF
:0043077E 03CA                    add ecx, edx
:00430780 8B4518                  mov eax, dword ptr [ebp+18]
:00430783 25FF000000              and eax, 000000FF
:00430788 03C8                    add ecx, eax
:0043078A 66894DF0                mov word ptr [ebp-10], cx
:0043078E EB45                    jmp 004307D5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043076A(C)
|
:00430790 8B4D20                  mov ecx, dword ptr [ebp+20]
:00430793 81E1FF000000            and ecx, 000000FF
:00430799 6BC903                  imul ecx, 00000003
:0043079C 33D2                    xor edx, edx
:0043079E 8A9170774900            mov dl, byte ptr [ecx+00497770]
:004307A4 8B4520                  mov eax, dword ptr [ebp+20]
:004307A7 25FF000000              and eax, 000000FF
:004307AC 6BC003                  imul eax, 00000003
:004307AF 33C9                    xor ecx, ecx
:004307B1 8A8871774900            mov cl, byte ptr [eax+00497771]
:004307B7 03D1                    add edx, ecx
:004307B9 8B4520                  mov eax, dword ptr [ebp+20]
:004307BC 25FF000000              and eax, 000000FF
:004307C1 6BC003                  imul eax, 00000003
:004307C4 33C9                    xor ecx, ecx
:004307C6 8A8872774900            mov cl, byte ptr [eax+00497772]
:004307CC 03D1                    add edx, ecx
:004307CE C1E204                  shl edx, 04
:004307D1 668955F0                mov word ptr [ebp-10], dx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043078E(U)
|
:004307D5 8B55F0                  mov edx, dword ptr [ebp-10]
:004307D8 81E2FFFF0000            and edx, 0000FFFF
:004307DE 85D2                    test edx, edx
:004307E0 7506                    jne 004307E8
:004307E2 66C745F00100            mov [ebp-10], 0001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004307E0(C)
|
:004307E8 C745E400000000          mov [ebp-1C], 00000000
:004307EF EB09                    jmp 004307FA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430841(U)
|
:004307F1 8B45E4                  mov eax, dword ptr [ebp-1C]
:004307F4 83C001                  add eax, 00000001
:004307F7 8945E4                  mov dword ptr [ebp-1C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004307EF(U)
|
:004307FA 837DE403                cmp dword ptr [ebp-1C], 00000003
:004307FE 7343                    jnb 00430843
:00430800 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00430803 81E1FFFF0000            and ecx, 0000FFFF
:00430809 51                      push ecx
:0043080A 8B55E4                  mov edx, dword ptr [ebp-1C]
:0043080D 33C0                    xor eax, eax
:0043080F 8A4415EC                mov al, byte ptr [ebp+edx-14]
:00430813 50                      push eax
:00430814 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00430817 81E1FFFF0000            and ecx, 0000FFFF
:0043081D 51                      push ecx
:0043081E FF15E8604800            call dword ptr [004860E8]
:00430824 8B55E4                  mov edx, dword ptr [ebp-1C]
:00430827 884415FC                mov byte ptr [ebp+edx-04], al
:0043082B 8B45E4                  mov eax, dword ptr [ebp-1C]
:0043082E 33C9                    xor ecx, ecx
:00430830 8A4C05FC                mov cl, byte ptr [ebp+eax-04]
:00430834 83F90F                  cmp ecx, 0000000F
:00430837 7E08                    jle 00430841
:00430839 8B55E4                  mov edx, dword ptr [ebp-1C]
:0043083C C64415FC0F              mov [ebp+edx-04], 0F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430837(C)
|
:00430841 EBAE                    jmp 004307F1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004307FE(C)
|
:00430843 8B45FC                  mov eax, dword ptr [ebp-04]
:00430846 25FF000000              and eax, 000000FF
:0043084B C1E008                  shl eax, 08
:0043084E 8B4DFD                  mov ecx, dword ptr [ebp-03]
:00430851 81E1FF000000            and ecx, 000000FF
:00430857 C1E104                  shl ecx, 04
:0043085A 8D9408281B4B00          lea edx, dword ptr [eax+ecx+004B1B28]
:00430861 8B45FE                  mov eax, dword ptr [ebp-02]
:00430864 25FF000000              and eax, 000000FF
:00430869 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043086C 8A1402                  mov dl, byte ptr [edx+eax]
:0043086F 8811                    mov byte ptr [ecx], dl
:00430871 E95FFEFFFF              jmp 004306D5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004306ED(C)
|
:00430876 8BE5                    mov esp, ebp
:00430878 5D                      pop ebp
:00430879 C3                      ret



* Referenced by a CALL at Addresses:
|:00431ED1   , :00443AAC   , :004491BE   , :004493DB   , :00455AB5   
|
:0043087A 55                      push ebp
:0043087B 8BEC                    mov ebp, esp
:0043087D 83EC10                  sub esp, 00000010
:00430880 56                      push esi
:00430881 8B450C                  mov eax, dword ptr [ebp+0C]
:00430884 0FAF4510                imul eax, dword ptr [ebp+10]
:00430888 8945F8                  mov dword ptr [ebp-08], eax
:0043088B C745F400000000          mov [ebp-0C], 00000000
:00430892 EB12                    jmp 004308A6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004308BD(U), :0043093E(U)
|
:00430894 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00430897 83C101                  add ecx, 00000001
:0043089A 894DF4                  mov dword ptr [ebp-0C], ecx
:0043089D 8B5508                  mov edx, dword ptr [ebp+08]
:004308A0 83C201                  add edx, 00000001
:004308A3 895508                  mov dword ptr [ebp+08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430892(U)
|
:004308A6 8B45F4                  mov eax, dword ptr [ebp-0C]
:004308A9 3B45F8                  cmp eax, dword ptr [ebp-08]
:004308AC 0F8391000000            jnb 00430943
:004308B2 8B4D08                  mov ecx, dword ptr [ebp+08]
:004308B5 33D2                    xor edx, edx
:004308B7 8A11                    mov dl, byte ptr [ecx]
:004308B9 85D2                    test edx, edx
:004308BB 7502                    jne 004308BF
:004308BD EBD5                    jmp 00430894

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004308BB(C)
|
:004308BF C645FC00                mov [ebp-04], 00
:004308C3 C745F000000000          mov [ebp-10], 00000000
:004308CA EB09                    jmp 004308D5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004308F5(U)
|
:004308CC 8B45F0                  mov eax, dword ptr [ebp-10]
:004308CF 83C001                  add eax, 00000001
:004308D2 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004308CA(U)
|
:004308D5 837DF003                cmp dword ptr [ebp-10], 00000003
:004308D9 731C                    jnb 004308F7
:004308DB 8B4D08                  mov ecx, dword ptr [ebp+08]
:004308DE 33D2                    xor edx, edx
:004308E0 8A11                    mov dl, byte ptr [ecx]
:004308E2 6BD203                  imul edx, 00000003
:004308E5 8B45F0                  mov eax, dword ptr [ebp-10]
:004308E8 8A4DFC                  mov cl, byte ptr [ebp-04]
:004308EB 028C0270774900          add cl, byte ptr [edx+eax+00497770]
:004308F2 884DFC                  mov byte ptr [ebp-04], cl
:004308F5 EBD5                    jmp 004308CC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004308D9(C)
|
:004308F7 8B45FC                  mov eax, dword ptr [ebp-04]
:004308FA 25FF000000              and eax, 000000FF
:004308FF 99                      cdq
:00430900 B903000000              mov ecx, 00000003
:00430905 F7F9                    idiv ecx
:00430907 8BC8                    mov ecx, eax
:00430909 C1E108                  shl ecx, 08
:0043090C 8B45FC                  mov eax, dword ptr [ebp-04]
:0043090F 25FF000000              and eax, 000000FF
:00430914 99                      cdq
:00430915 BE03000000              mov esi, 00000003
:0043091A F7FE                    idiv esi
:0043091C C1E004                  shl eax, 04
:0043091F 8D8C01281B4B00          lea ecx, dword ptr [ecx+eax+004B1B28]
:00430926 8B45FC                  mov eax, dword ptr [ebp-04]
:00430929 25FF000000              and eax, 000000FF
:0043092E 99                      cdq
:0043092F BE03000000              mov esi, 00000003
:00430934 F7FE                    idiv esi
:00430936 8B5508                  mov edx, dword ptr [ebp+08]
:00430939 8A0401                  mov al, byte ptr [ecx+eax]
:0043093C 8802                    mov byte ptr [edx], al
:0043093E E951FFFFFF              jmp 00430894

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004308AC(C)
|
:00430943 5E                      pop esi
:00430944 8BE5                    mov esp, ebp
:00430946 5D                      pop ebp
:00430947 C3                      ret


:00430948 55                      push ebp
:00430949 8BEC                    mov ebp, esp
:0043094B 83EC10                  sub esp, 00000010
:0043094E 56                      push esi
:0043094F C745FC00000000          mov [ebp-04], 00000000
:00430956 EB09                    jmp 00430961

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004309FD(U)
|
:00430958 8B45FC                  mov eax, dword ptr [ebp-04]
:0043095B 83C001                  add eax, 00000001
:0043095E 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430956(U)
|
:00430961 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00430964 3B4D10                  cmp ecx, dword ptr [ebp+10]
:00430967 0F8395000000            jnb 00430A02
:0043096D C745F800000000          mov [ebp-08], 00000000
:00430974 EB09                    jmp 0043097F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004309F8(U)
|
:00430976 8B55F8                  mov edx, dword ptr [ebp-08]
:00430979 83C201                  add edx, 00000001
:0043097C 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430974(U)
|
:0043097F 8B45F8                  mov eax, dword ptr [ebp-08]
:00430982 3B450C                  cmp eax, dword ptr [ebp+0C]
:00430985 7376                    jnb 004309FD
:00430987 8B45F8                  mov eax, dword ptr [ebp-08]
:0043098A 33D2                    xor edx, edx
:0043098C B902000000              mov ecx, 00000002
:00430991 F7F1                    div ecx
:00430993 8BCA                    mov ecx, edx
:00430995 8B45FC                  mov eax, dword ptr [ebp-04]
:00430998 33D2                    xor edx, edx
:0043099A BE02000000              mov esi, 00000002
:0043099F F7F6                    div esi
:004309A1 3BCA                    cmp ecx, edx
:004309A3 7553                    jne 004309F8
:004309A5 837D1400                cmp dword ptr [ebp+14], 00000000
:004309A9 7409                    je 004309B4
:004309AB C745F400000000          mov [ebp-0C], 00000000
:004309B2 EB31                    jmp 004309E5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004309A9(C)
|
:004309B4 8B55FC                  mov edx, dword ptr [ebp-04]
:004309B7 0FAF550C                imul edx, dword ptr [ebp+0C]
:004309BB 0355F8                  add edx, dword ptr [ebp-08]
:004309BE 8B4508                  mov eax, dword ptr [ebp+08]
:004309C1 33C9                    xor ecx, ecx
:004309C3 8A0C10                  mov cl, byte ptr [eax+edx]
:004309C6 85C9                    test ecx, ecx
:004309C8 740E                    je 004309D8
:004309CA 8B5518                  mov edx, dword ptr [ebp+18]
:004309CD 81E2FF000000            and edx, 000000FF
:004309D3 8955F0                  mov dword ptr [ebp-10], edx
:004309D6 EB07                    jmp 004309DF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004309C8(C)
|
:004309D8 C745F000000000          mov [ebp-10], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004309D6(U)
|
:004309DF 8B45F0                  mov eax, dword ptr [ebp-10]
:004309E2 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004309B2(U)
|
:004309E5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004309E8 0FAF4D0C                imul ecx, dword ptr [ebp+0C]
:004309EC 034DF8                  add ecx, dword ptr [ebp-08]
:004309EF 8B5508                  mov edx, dword ptr [ebp+08]
:004309F2 8A45F4                  mov al, byte ptr [ebp-0C]
:004309F5 88040A                  mov byte ptr [edx+ecx], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004309A3(C)
|
:004309F8 E979FFFFFF              jmp 00430976

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430985(C)
|
:004309FD E956FFFFFF              jmp 00430958

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430967(C)
|
:00430A02 5E                      pop esi
:00430A03 8BE5                    mov esp, ebp
:00430A05 5D                      pop ebp
:00430A06 C3                      ret



* Referenced by a CALL at Addresses:
|:0045141A   , :00451469   , :004514BB   , :0045150A   , :00451713   
|
:00430A07 55                      push ebp
:00430A08 8BEC                    mov ebp, esp
:00430A0A 83EC08                  sub esp, 00000008
:00430A0D C745FC00000000          mov [ebp-04], 00000000
:00430A14 EB09                    jmp 00430A1F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430A70(U)
|
:00430A16 8B45FC                  mov eax, dword ptr [ebp-04]
:00430A19 83C001                  add eax, 00000001
:00430A1C 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430A14(U)
|
:00430A1F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00430A22 3B4D14                  cmp ecx, dword ptr [ebp+14]
:00430A25 734B                    jnb 00430A72
:00430A27 C745F800000000          mov [ebp-08], 00000000
:00430A2E EB09                    jmp 00430A39

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430A6E(U)
|
:00430A30 8B55F8                  mov edx, dword ptr [ebp-08]
:00430A33 83C201                  add edx, 00000001
:00430A36 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430A2E(U)
|
:00430A39 8B45F8                  mov eax, dword ptr [ebp-08]
:00430A3C 3B4510                  cmp eax, dword ptr [ebp+10]
:00430A3F 732F                    jnb 00430A70
:00430A41 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00430A44 33D2                    xor edx, edx
:00430A46 8A11                    mov dl, byte ptr [ecx]
:00430A48 8B4518                  mov eax, dword ptr [ebp+18]
:00430A4B 25FF000000              and eax, 000000FF
:00430A50 3BD0                    cmp edx, eax
:00430A52 7408                    je 00430A5C
:00430A54 8B4D08                  mov ecx, dword ptr [ebp+08]
:00430A57 8A5518                  mov dl, byte ptr [ebp+18]
:00430A5A 8811                    mov byte ptr [ecx], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430A52(C)
|
:00430A5C 8B4508                  mov eax, dword ptr [ebp+08]
:00430A5F 83C001                  add eax, 00000001
:00430A62 894508                  mov dword ptr [ebp+08], eax
:00430A65 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00430A68 83C101                  add ecx, 00000001
:00430A6B 894D0C                  mov dword ptr [ebp+0C], ecx
:00430A6E EBC0                    jmp 00430A30

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430A3F(C)
|
:00430A70 EBA4                    jmp 00430A16

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430A25(C)
|
:00430A72 8BE5                    mov esp, ebp
:00430A74 5D                      pop ebp
:00430A75 C3                      ret



* Referenced by a CALL at Addresses:
|:00443D34   , :00443ED0   , :00444070   , :004441C2   , :00444291   
|:00444409   , :004445FA   , :00444835   , :004449B2   , :00444AF5   
|:00444C38   , :00444D54   , :00444E26   , :00445083   , :004450BF   
|:00445483   , :004454AF   , :00445786   , :004459CD   , :00445B30   
|:00445B70   , :00445DE5   , :0044636D   , :00446754   , :00446ABE   
|:00446B19   , :00446E77   , :00446F0A   , :0044729B   , :0044773A   
|:004480AC   , :0044817F   , :00449516   
|
:00430A76 55                      push ebp
:00430A77 8BEC                    mov ebp, esp
:00430A79 83EC24                  sub esp, 00000024
:00430A7C 53                      push ebx
:00430A7D 8B4508                  mov eax, dword ptr [ebp+08]
:00430A80 8945F8                  mov dword ptr [ebp-08], eax
:00430A83 C745E800000000          mov [ebp-18], 00000000
:00430A8A EB09                    jmp 00430A95

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430EA0(U)
|
:00430A8C 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00430A8F 83C101                  add ecx, 00000001
:00430A92 894DE8                  mov dword ptr [ebp-18], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430A8A(U)
|
:00430A95 8B55E8                  mov edx, dword ptr [ebp-18]
:00430A98 3B5514                  cmp edx, dword ptr [ebp+14]
:00430A9B 0F8304040000            jnb 00430EA5
:00430AA1 C745F400000000          mov [ebp-0C], 00000000
:00430AA8 EB09                    jmp 00430AB3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430E9B(U)
|
:00430AAA 8B45F4                  mov eax, dword ptr [ebp-0C]
:00430AAD 83C001                  add eax, 00000001
:00430AB0 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430AA8(U)
|
:00430AB3 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00430AB6 3B4D10                  cmp ecx, dword ptr [ebp+10]
:00430AB9 0F83E1030000            jnb 00430EA0
:00430ABF 8B5510                  mov edx, dword ptr [ebp+10]
:00430AC2 C1E202                  shl edx, 02
:00430AC5 8B45E8                  mov eax, dword ptr [ebp-18]
:00430AC8 0FAFC2                  imul eax, edx
:00430ACB 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00430ACE 8D1448                  lea edx, dword ptr [eax+2*ecx]
:00430AD1 8955F0                  mov dword ptr [ebp-10], edx
:00430AD4 8B45F0                  mov eax, dword ptr [ebp-10]
:00430AD7 83C001                  add eax, 00000001
:00430ADA 8945E0                  mov dword ptr [ebp-20], eax
:00430ADD 8B4D10                  mov ecx, dword ptr [ebp+10]
:00430AE0 C1E102                  shl ecx, 02
:00430AE3 8B55E8                  mov edx, dword ptr [ebp-18]
:00430AE6 0FAFD1                  imul edx, ecx
:00430AE9 8B4510                  mov eax, dword ptr [ebp+10]
:00430AEC 8D0C42                  lea ecx, dword ptr [edx+2*eax]
:00430AEF 8B55F4                  mov edx, dword ptr [ebp-0C]
:00430AF2 8D0451                  lea eax, dword ptr [ecx+2*edx]
:00430AF5 8945E4                  mov dword ptr [ebp-1C], eax
:00430AF8 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00430AFB 83C101                  add ecx, 00000001
:00430AFE 894DDC                  mov dword ptr [ebp-24], ecx
:00430B01 8B550C                  mov edx, dword ptr [ebp+0C]
:00430B04 0355DC                  add edx, dword ptr [ebp-24]
:00430B07 8B4508                  mov eax, dword ptr [ebp+08]
:00430B0A 8A08                    mov cl, byte ptr [eax]
:00430B0C 880A                    mov byte ptr [edx], cl
:00430B0E 8B550C                  mov edx, dword ptr [ebp+0C]
:00430B11 0355E4                  add edx, dword ptr [ebp-1C]
:00430B14 8B450C                  mov eax, dword ptr [ebp+0C]
:00430B17 0345DC                  add eax, dword ptr [ebp-24]
:00430B1A 8A08                    mov cl, byte ptr [eax]
:00430B1C 880A                    mov byte ptr [edx], cl
:00430B1E 8B550C                  mov edx, dword ptr [ebp+0C]
:00430B21 0355E0                  add edx, dword ptr [ebp-20]
:00430B24 8B450C                  mov eax, dword ptr [ebp+0C]
:00430B27 0345E4                  add eax, dword ptr [ebp-1C]
:00430B2A 8A08                    mov cl, byte ptr [eax]
:00430B2C 880A                    mov byte ptr [edx], cl
:00430B2E 8B550C                  mov edx, dword ptr [ebp+0C]
:00430B31 0355F0                  add edx, dword ptr [ebp-10]
:00430B34 8B450C                  mov eax, dword ptr [ebp+0C]
:00430B37 0345E0                  add eax, dword ptr [ebp-20]
:00430B3A 8A08                    mov cl, byte ptr [eax]
:00430B3C 880A                    mov byte ptr [edx], cl
:00430B3E 8B5510                  mov edx, dword ptr [ebp+10]
:00430B41 83EA01                  sub edx, 00000001
:00430B44 3955F4                  cmp dword ptr [ebp-0C], edx
:00430B47 0F84CD000000            je 00430C1A
:00430B4D 8B4508                  mov eax, dword ptr [ebp+08]
:00430B50 33C9                    xor ecx, ecx
:00430B52 8A08                    mov cl, byte ptr [eax]
:00430B54 85C9                    test ecx, ecx
:00430B56 0F84BE000000            je 00430C1A
:00430B5C 8B5508                  mov edx, dword ptr [ebp+08]
:00430B5F 33C0                    xor eax, eax
:00430B61 8A4201                  mov al, byte ptr [edx+01]
:00430B64 85C0                    test eax, eax
:00430B66 0F84AE000000            je 00430C1A
:00430B6C C745EC00000000          mov [ebp-14], 00000000
:00430B73 EB09                    jmp 00430B7E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430BD7(U)
|
:00430B75 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00430B78 83C101                  add ecx, 00000001
:00430B7B 894DEC                  mov dword ptr [ebp-14], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430B73(U)
|
:00430B7E 837DEC03                cmp dword ptr [ebp-14], 00000003
:00430B82 7355                    jnb 00430BD9
:00430B84 8B5508                  mov edx, dword ptr [ebp+08]
:00430B87 33C0                    xor eax, eax
:00430B89 8A4201                  mov al, byte ptr [edx+01]
:00430B8C 6BC003                  imul eax, 00000003
:00430B8F 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00430B92 33D2                    xor edx, edx
:00430B94 8A940870774900          mov dl, byte ptr [eax+ecx+00497770]
:00430B9B 8BC2                    mov eax, edx
:00430B9D 8B4D08                  mov ecx, dword ptr [ebp+08]
:00430BA0 33D2                    xor edx, edx
:00430BA2 8A11                    mov dl, byte ptr [ecx]
:00430BA4 6BD203                  imul edx, 00000003
:00430BA7 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00430BAA 33DB                    xor ebx, ebx
:00430BAC 8A9C0A70774900          mov bl, byte ptr [edx+ecx+00497770]
:00430BB3 03C3                    add eax, ebx
:00430BB5 99                      cdq
:00430BB6 2BC2                    sub eax, edx
:00430BB8 D1F8                    sar eax, 1
:00430BBA 8B55EC                  mov edx, dword ptr [ebp-14]
:00430BBD 884415FC                mov byte ptr [ebp+edx-04], al
:00430BC1 8B45EC                  mov eax, dword ptr [ebp-14]
:00430BC4 33C9                    xor ecx, ecx
:00430BC6 8A4C05FC                mov cl, byte ptr [ebp+eax-04]
:00430BCA 83F90F                  cmp ecx, 0000000F
:00430BCD 7E08                    jle 00430BD7
:00430BCF 8B55EC                  mov edx, dword ptr [ebp-14]
:00430BD2 C64415FC0F              mov [ebp+edx-04], 0F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430BCD(C)
|
:00430BD7 EB9C                    jmp 00430B75

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430B82(C)
|
:00430BD9 8B45FC                  mov eax, dword ptr [ebp-04]
:00430BDC 25FF000000              and eax, 000000FF
:00430BE1 C1E008                  shl eax, 08
:00430BE4 8B4DFD                  mov ecx, dword ptr [ebp-03]
:00430BE7 81E1FF000000            and ecx, 000000FF
:00430BED C1E104                  shl ecx, 04
:00430BF0 8D9408281B4B00          lea edx, dword ptr [eax+ecx+004B1B28]
:00430BF7 8B45FE                  mov eax, dword ptr [ebp-02]
:00430BFA 25FF000000              and eax, 000000FF
:00430BFF 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00430C02 034DDC                  add ecx, dword ptr [ebp-24]
:00430C05 8A1402                  mov dl, byte ptr [edx+eax]
:00430C08 8811                    mov byte ptr [ecx], dl
:00430C0A 8B450C                  mov eax, dword ptr [ebp+0C]
:00430C0D 0345E0                  add eax, dword ptr [ebp-20]
:00430C10 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00430C13 034DDC                  add ecx, dword ptr [ebp-24]
:00430C16 8A11                    mov dl, byte ptr [ecx]
:00430C18 8810                    mov byte ptr [eax], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00430B47(C), :00430B56(C), :00430B66(C)
|
:00430C1A 8B4514                  mov eax, dword ptr [ebp+14]
:00430C1D 83E801                  sub eax, 00000001
:00430C20 3945E8                  cmp dword ptr [ebp-18], eax
:00430C23 0F84BF000000            je 00430CE8
:00430C29 8B4D08                  mov ecx, dword ptr [ebp+08]
:00430C2C 33D2                    xor edx, edx
:00430C2E 8A11                    mov dl, byte ptr [ecx]
:00430C30 85D2                    test edx, edx
:00430C32 0F84B0000000            je 00430CE8
:00430C38 8B4508                  mov eax, dword ptr [ebp+08]
:00430C3B 034510                  add eax, dword ptr [ebp+10]
:00430C3E 33C9                    xor ecx, ecx
:00430C40 8A08                    mov cl, byte ptr [eax]
:00430C42 85C9                    test ecx, ecx
:00430C44 0F849E000000            je 00430CE8
:00430C4A C745EC00000000          mov [ebp-14], 00000000
:00430C51 EB09                    jmp 00430C5C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430CB5(U)
|
:00430C53 8B55EC                  mov edx, dword ptr [ebp-14]
:00430C56 83C201                  add edx, 00000001
:00430C59 8955EC                  mov dword ptr [ebp-14], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430C51(U)
|
:00430C5C 837DEC03                cmp dword ptr [ebp-14], 00000003
:00430C60 7355                    jnb 00430CB7
:00430C62 8B4508                  mov eax, dword ptr [ebp+08]
:00430C65 034510                  add eax, dword ptr [ebp+10]
:00430C68 33C9                    xor ecx, ecx
:00430C6A 8A08                    mov cl, byte ptr [eax]
:00430C6C 6BC903                  imul ecx, 00000003
:00430C6F 8B55EC                  mov edx, dword ptr [ebp-14]
:00430C72 33C0                    xor eax, eax
:00430C74 8A841170774900          mov al, byte ptr [ecx+edx+00497770]
:00430C7B 8B4D08                  mov ecx, dword ptr [ebp+08]
:00430C7E 33D2                    xor edx, edx
:00430C80 8A11                    mov dl, byte ptr [ecx]
:00430C82 6BD203                  imul edx, 00000003
:00430C85 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00430C88 33DB                    xor ebx, ebx
:00430C8A 8A9C0A70774900          mov bl, byte ptr [edx+ecx+00497770]
:00430C91 03C3                    add eax, ebx
:00430C93 99                      cdq
:00430C94 2BC2                    sub eax, edx
:00430C96 D1F8                    sar eax, 1
:00430C98 8B55EC                  mov edx, dword ptr [ebp-14]
:00430C9B 884415FC                mov byte ptr [ebp+edx-04], al
:00430C9F 8B45EC                  mov eax, dword ptr [ebp-14]
:00430CA2 33C9                    xor ecx, ecx
:00430CA4 8A4C05FC                mov cl, byte ptr [ebp+eax-04]
:00430CA8 83F90F                  cmp ecx, 0000000F
:00430CAB 7E08                    jle 00430CB5
:00430CAD 8B55EC                  mov edx, dword ptr [ebp-14]
:00430CB0 C64415FC0F              mov [ebp+edx-04], 0F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430CAB(C)
|
:00430CB5 EB9C                    jmp 00430C53

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430C60(C)
|
:00430CB7 8B45FC                  mov eax, dword ptr [ebp-04]
:00430CBA 25FF000000              and eax, 000000FF
:00430CBF C1E008                  shl eax, 08
:00430CC2 8B4DFD                  mov ecx, dword ptr [ebp-03]
:00430CC5 81E1FF000000            and ecx, 000000FF
:00430CCB C1E104                  shl ecx, 04
:00430CCE 8D9408281B4B00          lea edx, dword ptr [eax+ecx+004B1B28]
:00430CD5 8B45FE                  mov eax, dword ptr [ebp-02]
:00430CD8 25FF000000              and eax, 000000FF
:00430CDD 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00430CE0 034DE4                  add ecx, dword ptr [ebp-1C]
:00430CE3 8A1402                  mov dl, byte ptr [edx+eax]
:00430CE6 8811                    mov byte ptr [ecx], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00430C23(C), :00430C32(C), :00430C44(C)
|
:00430CE8 8B450C                  mov eax, dword ptr [ebp+0C]
:00430CEB 0345F0                  add eax, dword ptr [ebp-10]
:00430CEE 33C9                    xor ecx, ecx
:00430CF0 8A08                    mov cl, byte ptr [eax]
:00430CF2 8B550C                  mov edx, dword ptr [ebp+0C]
:00430CF5 0355E0                  add edx, dword ptr [ebp-20]
:00430CF8 33C0                    xor eax, eax
:00430CFA 8A02                    mov al, byte ptr [edx]
:00430CFC 3BC8                    cmp ecx, eax
:00430CFE 751C                    jne 00430D1C
:00430D00 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00430D03 034DF0                  add ecx, dword ptr [ebp-10]
:00430D06 33D2                    xor edx, edx
:00430D08 8A11                    mov dl, byte ptr [ecx]
:00430D0A 8B450C                  mov eax, dword ptr [ebp+0C]
:00430D0D 0345E4                  add eax, dword ptr [ebp-1C]
:00430D10 33C9                    xor ecx, ecx
:00430D12 8A08                    mov cl, byte ptr [eax]
:00430D14 3BD1                    cmp edx, ecx
:00430D16 0F8476010000            je 00430E92

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430CFE(C)
|
:00430D1C C745EC00000000          mov [ebp-14], 00000000
:00430D23 EB09                    jmp 00430D2E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430D8A(U)
|
:00430D25 8B55EC                  mov edx, dword ptr [ebp-14]
:00430D28 83C201                  add edx, 00000001
:00430D2B 8955EC                  mov dword ptr [ebp-14], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430D23(U)
|
:00430D2E 837DEC03                cmp dword ptr [ebp-14], 00000003
:00430D32 7358                    jnb 00430D8C
:00430D34 8B450C                  mov eax, dword ptr [ebp+0C]
:00430D37 0345E0                  add eax, dword ptr [ebp-20]
:00430D3A 33C9                    xor ecx, ecx
:00430D3C 8A08                    mov cl, byte ptr [eax]
:00430D3E 6BC903                  imul ecx, 00000003
:00430D41 8B55EC                  mov edx, dword ptr [ebp-14]
:00430D44 33C0                    xor eax, eax
:00430D46 8A841170774900          mov al, byte ptr [ecx+edx+00497770]
:00430D4D 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00430D50 034DE4                  add ecx, dword ptr [ebp-1C]
:00430D53 33D2                    xor edx, edx
:00430D55 8A11                    mov dl, byte ptr [ecx]
:00430D57 6BD203                  imul edx, 00000003
:00430D5A 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00430D5D 33DB                    xor ebx, ebx
:00430D5F 8A9C0A70774900          mov bl, byte ptr [edx+ecx+00497770]
:00430D66 03C3                    add eax, ebx
:00430D68 99                      cdq
:00430D69 2BC2                    sub eax, edx
:00430D6B D1F8                    sar eax, 1
:00430D6D 8B55EC                  mov edx, dword ptr [ebp-14]
:00430D70 884415FC                mov byte ptr [ebp+edx-04], al
:00430D74 8B45EC                  mov eax, dword ptr [ebp-14]
:00430D77 33C9                    xor ecx, ecx
:00430D79 8A4C05FC                mov cl, byte ptr [ebp+eax-04]
:00430D7D 83F90F                  cmp ecx, 0000000F
:00430D80 7E08                    jle 00430D8A
:00430D82 8B55EC                  mov edx, dword ptr [ebp-14]
:00430D85 C64415FC0F              mov [ebp+edx-04], 0F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430D80(C)
|
:00430D8A EB99                    jmp 00430D25

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430D32(C)
|
:00430D8C 8B45FC                  mov eax, dword ptr [ebp-04]
:00430D8F 25FF000000              and eax, 000000FF
:00430D94 C1E008                  shl eax, 08
:00430D97 8B4DFD                  mov ecx, dword ptr [ebp-03]
:00430D9A 81E1FF000000            and ecx, 000000FF
:00430DA0 C1E104                  shl ecx, 04
:00430DA3 8D9408281B4B00          lea edx, dword ptr [eax+ecx+004B1B28]
:00430DAA 8B45FE                  mov eax, dword ptr [ebp-02]
:00430DAD 25FF000000              and eax, 000000FF
:00430DB2 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00430DB5 034DDC                  add ecx, dword ptr [ebp-24]
:00430DB8 8A1402                  mov dl, byte ptr [edx+eax]
:00430DBB 8811                    mov byte ptr [ecx], dl
:00430DBD 8B4514                  mov eax, dword ptr [ebp+14]
:00430DC0 83E801                  sub eax, 00000001
:00430DC3 3945E8                  cmp dword ptr [ebp-18], eax
:00430DC6 0F84C6000000            je 00430E92
:00430DCC 8B4D10                  mov ecx, dword ptr [ebp+10]
:00430DCF 83E901                  sub ecx, 00000001
:00430DD2 394DF4                  cmp dword ptr [ebp-0C], ecx
:00430DD5 0F84B7000000            je 00430E92
:00430DDB 8B5508                  mov edx, dword ptr [ebp+08]
:00430DDE 035510                  add edx, dword ptr [ebp+10]
:00430DE1 33C0                    xor eax, eax
:00430DE3 8A4201                  mov al, byte ptr [edx+01]
:00430DE6 85C0                    test eax, eax
:00430DE8 0F84A4000000            je 00430E92
:00430DEE C745EC00000000          mov [ebp-14], 00000000
:00430DF5 EB09                    jmp 00430E00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430E5F(U)
|
:00430DF7 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00430DFA 83C101                  add ecx, 00000001
:00430DFD 894DEC                  mov dword ptr [ebp-14], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430DF5(U)
|
:00430E00 837DEC03                cmp dword ptr [ebp-14], 00000003
:00430E04 735B                    jnb 00430E61
:00430E06 8B5508                  mov edx, dword ptr [ebp+08]
:00430E09 035510                  add edx, dword ptr [ebp+10]
:00430E0C 33C0                    xor eax, eax
:00430E0E 8A4201                  mov al, byte ptr [edx+01]
:00430E11 6BC003                  imul eax, 00000003
:00430E14 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00430E17 33D2                    xor edx, edx
:00430E19 8A940870774900          mov dl, byte ptr [eax+ecx+00497770]
:00430E20 8BC2                    mov eax, edx
:00430E22 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00430E25 034DDC                  add ecx, dword ptr [ebp-24]
:00430E28 33D2                    xor edx, edx
:00430E2A 8A11                    mov dl, byte ptr [ecx]
:00430E2C 6BD203                  imul edx, 00000003
:00430E2F 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00430E32 33DB                    xor ebx, ebx
:00430E34 8A9C0A70774900          mov bl, byte ptr [edx+ecx+00497770]
:00430E3B 03C3                    add eax, ebx
:00430E3D 99                      cdq
:00430E3E 2BC2                    sub eax, edx
:00430E40 D1F8                    sar eax, 1
:00430E42 8B55EC                  mov edx, dword ptr [ebp-14]
:00430E45 884415FC                mov byte ptr [ebp+edx-04], al
:00430E49 8B45EC                  mov eax, dword ptr [ebp-14]
:00430E4C 33C9                    xor ecx, ecx
:00430E4E 8A4C05FC                mov cl, byte ptr [ebp+eax-04]
:00430E52 83F90F                  cmp ecx, 0000000F
:00430E55 7E08                    jle 00430E5F
:00430E57 8B55EC                  mov edx, dword ptr [ebp-14]
:00430E5A C64415FC0F              mov [ebp+edx-04], 0F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430E55(C)
|
:00430E5F EB96                    jmp 00430DF7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430E04(C)
|
:00430E61 8B45FC                  mov eax, dword ptr [ebp-04]
:00430E64 25FF000000              and eax, 000000FF
:00430E69 C1E008                  shl eax, 08
:00430E6C 8B4DFD                  mov ecx, dword ptr [ebp-03]
:00430E6F 81E1FF000000            and ecx, 000000FF
:00430E75 C1E104                  shl ecx, 04
:00430E78 8D9408281B4B00          lea edx, dword ptr [eax+ecx+004B1B28]
:00430E7F 8B45FE                  mov eax, dword ptr [ebp-02]
:00430E82 25FF000000              and eax, 000000FF
:00430E87 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00430E8A 034DDC                  add ecx, dword ptr [ebp-24]
:00430E8D 8A1402                  mov dl, byte ptr [edx+eax]
:00430E90 8811                    mov byte ptr [ecx], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00430D16(C), :00430DC6(C), :00430DD5(C), :00430DE8(C)
|
:00430E92 8B4508                  mov eax, dword ptr [ebp+08]
:00430E95 83C001                  add eax, 00000001
:00430E98 894508                  mov dword ptr [ebp+08], eax
:00430E9B E90AFCFFFF              jmp 00430AAA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430AB9(C)
|
:00430EA0 E9E7FBFFFF              jmp 00430A8C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430A9B(C)
|
:00430EA5 C745E800000000          mov [ebp-18], 00000000
:00430EAC EB09                    jmp 00430EB7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431277(U)
|
:00430EAE 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00430EB1 83C101                  add ecx, 00000001
:00430EB4 894DE8                  mov dword ptr [ebp-18], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430EAC(U)
|
:00430EB7 8B55E8                  mov edx, dword ptr [ebp-18]
:00430EBA 3B5514                  cmp edx, dword ptr [ebp+14]
:00430EBD 0F83B9030000            jnb 0043127C
:00430EC3 C745F400000000          mov [ebp-0C], 00000000
:00430ECA EB09                    jmp 00430ED5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431272(U)
|
:00430ECC 8B45F4                  mov eax, dword ptr [ebp-0C]
:00430ECF 83C001                  add eax, 00000001
:00430ED2 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430ECA(U)
|
:00430ED5 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00430ED8 3B4D10                  cmp ecx, dword ptr [ebp+10]
:00430EDB 0F8396030000            jnb 00431277
:00430EE1 8B5510                  mov edx, dword ptr [ebp+10]
:00430EE4 C1E202                  shl edx, 02
:00430EE7 8B45E8                  mov eax, dword ptr [ebp-18]
:00430EEA 0FAFC2                  imul eax, edx
:00430EED 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00430EF0 8D1448                  lea edx, dword ptr [eax+2*ecx]
:00430EF3 8955F0                  mov dword ptr [ebp-10], edx
:00430EF6 8B45F0                  mov eax, dword ptr [ebp-10]
:00430EF9 83C001                  add eax, 00000001
:00430EFC 8945E0                  mov dword ptr [ebp-20], eax
:00430EFF 8B4D10                  mov ecx, dword ptr [ebp+10]
:00430F02 C1E102                  shl ecx, 02
:00430F05 8B55E8                  mov edx, dword ptr [ebp-18]
:00430F08 0FAFD1                  imul edx, ecx
:00430F0B 8B4510                  mov eax, dword ptr [ebp+10]
:00430F0E 8D0C42                  lea ecx, dword ptr [edx+2*eax]
:00430F11 8B55F4                  mov edx, dword ptr [ebp-0C]
:00430F14 8D0451                  lea eax, dword ptr [ecx+2*edx]
:00430F17 8945E4                  mov dword ptr [ebp-1C], eax
:00430F1A 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00430F1D 83C101                  add ecx, 00000001
:00430F20 894DDC                  mov dword ptr [ebp-24], ecx
:00430F23 8B55F8                  mov edx, dword ptr [ebp-08]
:00430F26 33C0                    xor eax, eax
:00430F28 8A02                    mov al, byte ptr [edx]
:00430F2A 85C0                    test eax, eax
:00430F2C 0F8537030000            jne 00431269
:00430F32 837DF400                cmp dword ptr [ebp-0C], 00000000
:00430F36 0F848E010000            je 004310CA
:00430F3C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00430F3F 33D2                    xor edx, edx
:00430F41 8A51FF                  mov dl, byte ptr [ecx-01]
:00430F44 85D2                    test edx, edx
:00430F46 0F847E010000            je 004310CA
:00430F4C 837DE800                cmp dword ptr [ebp-18], 00000000
:00430F50 0F84B1000000            je 00431007
:00430F56 8B45F8                  mov eax, dword ptr [ebp-08]
:00430F59 2B4510                  sub eax, dword ptr [ebp+10]
:00430F5C 33C9                    xor ecx, ecx
:00430F5E 8A08                    mov cl, byte ptr [eax]
:00430F60 85C9                    test ecx, ecx
:00430F62 0F849F000000            je 00431007
:00430F68 C745EC00000000          mov [ebp-14], 00000000
:00430F6F EB09                    jmp 00430F7A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430FD4(U)
|
:00430F71 8B55EC                  mov edx, dword ptr [ebp-14]
:00430F74 83C201                  add edx, 00000001
:00430F77 8955EC                  mov dword ptr [ebp-14], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430F6F(U)
|
:00430F7A 837DEC03                cmp dword ptr [ebp-14], 00000003
:00430F7E 7356                    jnb 00430FD6
:00430F80 8B45F8                  mov eax, dword ptr [ebp-08]
:00430F83 2B4510                  sub eax, dword ptr [ebp+10]
:00430F86 33C9                    xor ecx, ecx
:00430F88 8A08                    mov cl, byte ptr [eax]
:00430F8A 6BC903                  imul ecx, 00000003
:00430F8D 8B55EC                  mov edx, dword ptr [ebp-14]
:00430F90 33C0                    xor eax, eax
:00430F92 8A841170774900          mov al, byte ptr [ecx+edx+00497770]
:00430F99 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00430F9C 33D2                    xor edx, edx
:00430F9E 8A51FF                  mov dl, byte ptr [ecx-01]
:00430FA1 6BD203                  imul edx, 00000003
:00430FA4 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00430FA7 33DB                    xor ebx, ebx
:00430FA9 8A9C0A70774900          mov bl, byte ptr [edx+ecx+00497770]
:00430FB0 03C3                    add eax, ebx
:00430FB2 99                      cdq
:00430FB3 2BC2                    sub eax, edx
:00430FB5 D1F8                    sar eax, 1
:00430FB7 8B55EC                  mov edx, dword ptr [ebp-14]
:00430FBA 884415FC                mov byte ptr [ebp+edx-04], al
:00430FBE 8B45EC                  mov eax, dword ptr [ebp-14]
:00430FC1 33C9                    xor ecx, ecx
:00430FC3 8A4C05FC                mov cl, byte ptr [ebp+eax-04]
:00430FC7 83F90F                  cmp ecx, 0000000F
:00430FCA 7E08                    jle 00430FD4
:00430FCC 8B55EC                  mov edx, dword ptr [ebp-14]
:00430FCF C64415FC0F              mov [ebp+edx-04], 0F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430FCA(C)
|
:00430FD4 EB9B                    jmp 00430F71

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430F7E(C)
|
:00430FD6 8B45FC                  mov eax, dword ptr [ebp-04]
:00430FD9 25FF000000              and eax, 000000FF
:00430FDE C1E008                  shl eax, 08
:00430FE1 8B4DFD                  mov ecx, dword ptr [ebp-03]
:00430FE4 81E1FF000000            and ecx, 000000FF
:00430FEA C1E104                  shl ecx, 04
:00430FED 8D9408281B4B00          lea edx, dword ptr [eax+ecx+004B1B28]
:00430FF4 8B45FE                  mov eax, dword ptr [ebp-02]
:00430FF7 25FF000000              and eax, 000000FF
:00430FFC 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00430FFF 034DF0                  add ecx, dword ptr [ebp-10]
:00431002 8A1402                  mov dl, byte ptr [edx+eax]
:00431005 8811                    mov byte ptr [ecx], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00430F50(C), :00430F62(C)
|
:00431007 8B4514                  mov eax, dword ptr [ebp+14]
:0043100A 83E801                  sub eax, 00000001
:0043100D 3945E8                  cmp dword ptr [ebp-18], eax
:00431010 0F84B4000000            je 004310CA
:00431016 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00431019 034D10                  add ecx, dword ptr [ebp+10]
:0043101C 33D2                    xor edx, edx
:0043101E 8A11                    mov dl, byte ptr [ecx]
:00431020 85D2                    test edx, edx
:00431022 0F84A2000000            je 004310CA
:00431028 C745EC00000000          mov [ebp-14], 00000000
:0043102F EB09                    jmp 0043103A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431096(U)
|
:00431031 8B45EC                  mov eax, dword ptr [ebp-14]
:00431034 83C001                  add eax, 00000001
:00431037 8945EC                  mov dword ptr [ebp-14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043102F(U)
|
:0043103A 837DEC03                cmp dword ptr [ebp-14], 00000003
:0043103E 7358                    jnb 00431098
:00431040 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00431043 034D10                  add ecx, dword ptr [ebp+10]
:00431046 33D2                    xor edx, edx
:00431048 8A11                    mov dl, byte ptr [ecx]
:0043104A 6BD203                  imul edx, 00000003
:0043104D 8B45EC                  mov eax, dword ptr [ebp-14]
:00431050 33C9                    xor ecx, ecx
:00431052 8A8C0270774900          mov cl, byte ptr [edx+eax+00497770]
:00431059 8BC1                    mov eax, ecx
:0043105B 8B55F8                  mov edx, dword ptr [ebp-08]
:0043105E 33C9                    xor ecx, ecx
:00431060 8A4AFF                  mov cl, byte ptr [edx-01]
:00431063 6BC903                  imul ecx, 00000003
:00431066 8B55EC                  mov edx, dword ptr [ebp-14]
:00431069 33DB                    xor ebx, ebx
:0043106B 8A9C1170774900          mov bl, byte ptr [ecx+edx+00497770]
:00431072 03C3                    add eax, ebx
:00431074 99                      cdq
:00431075 2BC2                    sub eax, edx
:00431077 D1F8                    sar eax, 1
:00431079 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043107C 88440DFC                mov byte ptr [ebp+ecx-04], al
:00431080 8B55EC                  mov edx, dword ptr [ebp-14]
:00431083 33C0                    xor eax, eax
:00431085 8A4415FC                mov al, byte ptr [ebp+edx-04]
:00431089 83F80F                  cmp eax, 0000000F
:0043108C 7E08                    jle 00431096
:0043108E 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00431091 C6440DFC0F              mov [ebp+ecx-04], 0F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043108C(C)
|
:00431096 EB99                    jmp 00431031

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043103E(C)
|
:00431098 8B55FC                  mov edx, dword ptr [ebp-04]
:0043109B 81E2FF000000            and edx, 000000FF
:004310A1 C1E208                  shl edx, 08
:004310A4 8B45FD                  mov eax, dword ptr [ebp-03]
:004310A7 25FF000000              and eax, 000000FF
:004310AC C1E004                  shl eax, 04
:004310AF 8D8C02281B4B00          lea ecx, dword ptr [edx+eax+004B1B28]
:004310B6 8B55FE                  mov edx, dword ptr [ebp-02]
:004310B9 81E2FF000000            and edx, 000000FF
:004310BF 8B450C                  mov eax, dword ptr [ebp+0C]
:004310C2 0345E4                  add eax, dword ptr [ebp-1C]
:004310C5 8A0C11                  mov cl, byte ptr [ecx+edx]
:004310C8 8808                    mov byte ptr [eax], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00430F36(C), :00430F46(C), :00431010(C), :00431022(C)
|
:004310CA 8B5510                  mov edx, dword ptr [ebp+10]
:004310CD 83EA01                  sub edx, 00000001
:004310D0 3955F4                  cmp dword ptr [ebp-0C], edx
:004310D3 0F8490010000            je 00431269
:004310D9 8B45F8                  mov eax, dword ptr [ebp-08]
:004310DC 33C9                    xor ecx, ecx
:004310DE 8A4801                  mov cl, byte ptr [eax+01]
:004310E1 85C9                    test ecx, ecx
:004310E3 0F8480010000            je 00431269
:004310E9 837DE800                cmp dword ptr [ebp-18], 00000000
:004310ED 0F84B3000000            je 004311A6
:004310F3 8B55F8                  mov edx, dword ptr [ebp-08]
:004310F6 2B5510                  sub edx, dword ptr [ebp+10]
:004310F9 33C0                    xor eax, eax
:004310FB 8A02                    mov al, byte ptr [edx]
:004310FD 85C0                    test eax, eax
:004310FF 0F84A1000000            je 004311A6
:00431105 C745EC00000000          mov [ebp-14], 00000000
:0043110C EB09                    jmp 00431117

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431173(U)
|
:0043110E 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00431111 83C101                  add ecx, 00000001
:00431114 894DEC                  mov dword ptr [ebp-14], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043110C(U)
|
:00431117 837DEC03                cmp dword ptr [ebp-14], 00000003
:0043111B 7358                    jnb 00431175
:0043111D 8B55F8                  mov edx, dword ptr [ebp-08]
:00431120 2B5510                  sub edx, dword ptr [ebp+10]
:00431123 33C0                    xor eax, eax
:00431125 8A02                    mov al, byte ptr [edx]
:00431127 6BC003                  imul eax, 00000003
:0043112A 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043112D 33D2                    xor edx, edx
:0043112F 8A940870774900          mov dl, byte ptr [eax+ecx+00497770]
:00431136 8BC2                    mov eax, edx
:00431138 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043113B 33D2                    xor edx, edx
:0043113D 8A5101                  mov dl, byte ptr [ecx+01]
:00431140 6BD203                  imul edx, 00000003
:00431143 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00431146 33DB                    xor ebx, ebx
:00431148 8A9C0A70774900          mov bl, byte ptr [edx+ecx+00497770]
:0043114F 03C3                    add eax, ebx
:00431151 99                      cdq
:00431152 2BC2                    sub eax, edx
:00431154 D1F8                    sar eax, 1
:00431156 8B55EC                  mov edx, dword ptr [ebp-14]
:00431159 884415FC                mov byte ptr [ebp+edx-04], al
:0043115D 8B45EC                  mov eax, dword ptr [ebp-14]
:00431160 33C9                    xor ecx, ecx
:00431162 8A4C05FC                mov cl, byte ptr [ebp+eax-04]
:00431166 83F90F                  cmp ecx, 0000000F
:00431169 7E08                    jle 00431173
:0043116B 8B55EC                  mov edx, dword ptr [ebp-14]
:0043116E C64415FC0F              mov [ebp+edx-04], 0F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431169(C)
|
:00431173 EB99                    jmp 0043110E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043111B(C)
|
:00431175 8B45FC                  mov eax, dword ptr [ebp-04]
:00431178 25FF000000              and eax, 000000FF
:0043117D C1E008                  shl eax, 08
:00431180 8B4DFD                  mov ecx, dword ptr [ebp-03]
:00431183 81E1FF000000            and ecx, 000000FF
:00431189 C1E104                  shl ecx, 04
:0043118C 8D9408281B4B00          lea edx, dword ptr [eax+ecx+004B1B28]
:00431193 8B45FE                  mov eax, dword ptr [ebp-02]
:00431196 25FF000000              and eax, 000000FF
:0043119B 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0043119E 034DE0                  add ecx, dword ptr [ebp-20]
:004311A1 8A1402                  mov dl, byte ptr [edx+eax]
:004311A4 8811                    mov byte ptr [ecx], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004310ED(C), :004310FF(C)
|
:004311A6 8B4514                  mov eax, dword ptr [ebp+14]
:004311A9 83E801                  sub eax, 00000001
:004311AC 3945E8                  cmp dword ptr [ebp-18], eax
:004311AF 0F84B4000000            je 00431269
:004311B5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004311B8 034D10                  add ecx, dword ptr [ebp+10]
:004311BB 33D2                    xor edx, edx
:004311BD 8A11                    mov dl, byte ptr [ecx]
:004311BF 85D2                    test edx, edx
:004311C1 0F84A2000000            je 00431269
:004311C7 C745EC00000000          mov [ebp-14], 00000000
:004311CE EB09                    jmp 004311D9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431235(U)
|
:004311D0 8B45EC                  mov eax, dword ptr [ebp-14]
:004311D3 83C001                  add eax, 00000001
:004311D6 8945EC                  mov dword ptr [ebp-14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004311CE(U)
|
:004311D9 837DEC03                cmp dword ptr [ebp-14], 00000003
:004311DD 7358                    jnb 00431237
:004311DF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004311E2 034D10                  add ecx, dword ptr [ebp+10]
:004311E5 33D2                    xor edx, edx
:004311E7 8A11                    mov dl, byte ptr [ecx]
:004311E9 6BD203                  imul edx, 00000003
:004311EC 8B45EC                  mov eax, dword ptr [ebp-14]
:004311EF 33C9                    xor ecx, ecx
:004311F1 8A8C0270774900          mov cl, byte ptr [edx+eax+00497770]
:004311F8 8BC1                    mov eax, ecx
:004311FA 8B55F8                  mov edx, dword ptr [ebp-08]
:004311FD 33C9                    xor ecx, ecx
:004311FF 8A4A01                  mov cl, byte ptr [edx+01]
:00431202 6BC903                  imul ecx, 00000003
:00431205 8B55EC                  mov edx, dword ptr [ebp-14]
:00431208 33DB                    xor ebx, ebx
:0043120A 8A9C1170774900          mov bl, byte ptr [ecx+edx+00497770]
:00431211 03C3                    add eax, ebx
:00431213 99                      cdq
:00431214 2BC2                    sub eax, edx
:00431216 D1F8                    sar eax, 1
:00431218 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043121B 88440DFC                mov byte ptr [ebp+ecx-04], al
:0043121F 8B55EC                  mov edx, dword ptr [ebp-14]
:00431222 33C0                    xor eax, eax
:00431224 8A4415FC                mov al, byte ptr [ebp+edx-04]
:00431228 83F80F                  cmp eax, 0000000F
:0043122B 7E08                    jle 00431235
:0043122D 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00431230 C6440DFC0F              mov [ebp+ecx-04], 0F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043122B(C)
|
:00431235 EB99                    jmp 004311D0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004311DD(C)
|
:00431237 8B55FC                  mov edx, dword ptr [ebp-04]
:0043123A 81E2FF000000            and edx, 000000FF
:00431240 C1E208                  shl edx, 08
:00431243 8B45FD                  mov eax, dword ptr [ebp-03]
:00431246 25FF000000              and eax, 000000FF
:0043124B C1E004                  shl eax, 04
:0043124E 8D8C02281B4B00          lea ecx, dword ptr [edx+eax+004B1B28]
:00431255 8B55FE                  mov edx, dword ptr [ebp-02]
:00431258 81E2FF000000            and edx, 000000FF
:0043125E 8B450C                  mov eax, dword ptr [ebp+0C]
:00431261 0345DC                  add eax, dword ptr [ebp-24]
:00431264 8A0C11                  mov cl, byte ptr [ecx+edx]
:00431267 8808                    mov byte ptr [eax], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00430F2C(C), :004310D3(C), :004310E3(C), :004311AF(C), :004311C1(C)
|
:00431269 8B55F8                  mov edx, dword ptr [ebp-08]
:0043126C 83C201                  add edx, 00000001
:0043126F 8955F8                  mov dword ptr [ebp-08], edx
:00431272 E955FCFFFF              jmp 00430ECC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430EDB(C)
|
:00431277 E932FCFFFF              jmp 00430EAE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00430EBD(C)
|
:0043127C 5B                      pop ebx
:0043127D 8BE5                    mov esp, ebp
:0043127F 5D                      pop ebp
:00431280 C3                      ret


:00431281 CC                      int 03
:00431282 CC                      int 03
:00431283 CC                      int 03
:00431284 CC                      int 03
:00431285 CC                      int 03
:00431286 CC                      int 03
:00431287 CC                      int 03
:00431288 CC                      int 03
:00431289 CC                      int 03
:0043128A CC                      int 03
:0043128B CC                      int 03
:0043128C CC                      int 03
:0043128D CC                      int 03
:0043128E CC                      int 03
:0043128F CC                      int 03

* Referenced by a CALL at Address:
|:0042B807   
|
:00431290 55                      push ebp
:00431291 8BEC                    mov ebp, esp
:00431293 6AFF                    push FFFFFFFF
:00431295 6895534800              push 00485395
:0043129A 64A100000000            mov eax, dword ptr fs:[00000000]
:004312A0 50                      push eax
:004312A1 64892500000000          mov dword ptr fs:[00000000], esp
:004312A8 81EC0C010000            sub esp, 0000010C
:004312AE 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:004312B4 E8F71FFDFF              call 004032B0
:004312B9 C745FC00000000          mov [ebp-04], 00000000
:004312C0 8D4DF0                  lea ecx, dword ptr [ebp-10]
:004312C3 E85820FDFF              call 00403320
:004312C8 C645FC01                mov [ebp-04], 01
:004312CC B9B0694B00              mov ecx, 004B69B0
:004312D1 E87C330400              call 00474652
:004312D6 B9B8694B00              mov ecx, 004B69B8
:004312DB E839330400              call 00474619
:004312E0 6A10                    push 00000010
:004312E2 B9B8694B00              mov ecx, 004B69B8
:004312E7 E812330400              call 004745FE
:004312EC E8BB130000              call 004326AC
:004312F1 6A02                    push 00000002
:004312F3 6A00                    push 00000000
:004312F5 E856CDFEFF              call 0041E050
:004312FA 83C408                  add esp, 00000008
:004312FD E88DD3FEFF              call 0041E68F
:00431302 E81BCFFEFF              call 0041E222

* Possible StringData Ref from Data Obj ->"LOGO.E5"
                                  |
:00431307 68F0BA4800              push 0048BAF0
:0043130C 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00431312 E81EE8FEFF              call 0041FB35
:00431317 6A04                    push 00000004
:00431319 6A00                    push 00000000
:0043131B 6A00                    push 00000000
:0043131D B968AB4A00              mov ecx, 004AAB68
:00431322 E819E70400              call 0047FA40
:00431327 50                      push eax
:00431328 6A04                    push 00000004
:0043132A 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00431330 E854E9FEFF              call 0041FC89
:00431335 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0043133B E8857FFEFF              call 004192C5
:00431340 6A00                    push 00000000
:00431342 E89CB70400              call 0047CAE3
:00431347 83C404                  add esp, 00000004
:0043134A 6A00                    push 00000000
:0043134C 6A1F                    push 0000001F
:0043134E 6A04                    push 00000004
:00431350 E89CBE0400              call 0047D1F1
:00431355 83C40C                  add esp, 0000000C
:00431358 E828100000              call 00432385
:0043135D 6A78                    push 00000078
:0043135F B9181B4B00              mov ecx, 004B1B18
:00431364 E8D71FFDFF              call 00403340
:00431369 E872B1FFFF              call 0042C4E0
:0043136E C785E8FEFFFF00000000    mov dword ptr [ebp+FFFFFEE8], 00000000
:00431378 EB0F                    jmp 00431389

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004313E4(U), :00431415(U)
|
:0043137A 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:00431380 83C001                  add eax, 00000001
:00431383 8985E8FEFFFF            mov dword ptr [ebp+FFFFFEE8], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431378(U)
|
:00431389 83BDE8FEFFFF18          cmp dword ptr [ebp+FFFFFEE8], 00000018
:00431390 0F8D84000000            jnl 0043141A
:00431396 83BDE8FEFFFF16          cmp dword ptr [ebp+FFFFFEE8], 00000016
:0043139D 7547                    jne 004313E6
:0043139F 6A0A                    push 0000000A
:004313A1 B9181B4B00              mov ecx, 004B1B18
:004313A6 E8951FFDFF              call 00403340
:004313AB E830B1FFFF              call 0042C4E0
:004313B0 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:004313B6 51                      push ecx
:004313B7 E848010000              call 00431504
:004313BC 83C404                  add esp, 00000004
:004313BF 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:004313C5 52                      push edx
:004313C6 E8480A0000              call 00431E13
:004313CB 83C404                  add esp, 00000004
:004313CE 6A0A                    push 0000000A
:004313D0 B9181B4B00              mov ecx, 004B1B18
:004313D5 E8661FFDFF              call 00403340
:004313DA E801B1FFFF              call 0042C4E0
:004313DF E862110000              call 00432546
:004313E4 EB94                    jmp 0043137A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043139D(C)
|
:004313E6 6A0A                    push 0000000A
:004313E8 B9181B4B00              mov ecx, 004B1B18
:004313ED E84E1FFDFF              call 00403340
:004313F2 E8E9B0FFFF              call 0042C4E0
:004313F7 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:004313FD 50                      push eax
:004313FE E801010000              call 00431504
:00431403 83C404                  add esp, 00000004
:00431406 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:0043140C 51                      push ecx
:0043140D E8010A0000              call 00431E13
:00431412 83C404                  add esp, 00000004
:00431415 E960FFFFFF              jmp 0043137A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431390(C)
|
:0043141A 8A5508                  mov dl, byte ptr [ebp+08]
:0043141D 52                      push edx
:0043141E E81B060000              call 00431A3E
:00431423 83C404                  add esp, 00000004
:00431426 6A02                    push 00000002
:00431428 6A01                    push 00000001
:0043142A E821CCFEFF              call 0041E050
:0043142F 83C408                  add esp, 00000008

* Possible StringData Ref from Data Obj ->"LOGO.E5"
                                  |
:00431432 68F0BA4800              push 0048BAF0
:00431437 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0043143D E8F3E6FEFF              call 0041FB35
:00431442 6A04                    push 00000004
:00431444 6A00                    push 00000000
:00431446 6A00                    push 00000000
:00431448 B968AB4A00              mov ecx, 004AAB68
:0043144D E8EEE50400              call 0047FA40
:00431452 50                      push eax

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:00431453 6A06                    push 00000006
:00431455 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0043145B E829E8FEFF              call 0041FC89
:00431460 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00431466 E85A7EFEFF              call 004192C5
:0043146B E86BD1FEFF              call 0041E5DB
:00431470 6A00                    push 00000000
:00431472 E86CB60400              call 0047CAE3
:00431477 83C404                  add esp, 00000004
:0043147A E810D2FEFF              call 0041E68F
:0043147F 6A04                    push 00000004
:00431481 6A00                    push 00000000
:00431483 6A00                    push 00000000
:00431485 B968AB4A00              mov ecx, 004AAB68
:0043148A E8B1E50400              call 0047FA40
:0043148F 50                      push eax
:00431490 6890010000              push 00000190
:00431495 6880020000              push 00000280
:0043149A 6A28                    push 00000028
:0043149C 6A00                    push 00000000
:0043149E E8F8CB0400              call 0047E09B
:004314A3 83C414                  add esp, 00000014
:004314A6 E84BD1FEFF              call 0041E5F6
:004314AB E855CFFEFF              call 0041E405
:004314B0 6A64                    push 00000064
:004314B2 B9181B4B00              mov ecx, 004B1B18
:004314B7 E8841EFDFF              call 00403340
:004314BC E81FB0FFFF              call 0042C4E0

* Possible Reference to Dialog: DialogID_00C8 
                                  |
:004314C1 68C8000000              push 000000C8
:004314C6 E87BB1FFFF              call 0042C646
:004314CB 83C404                  add esp, 00000004
:004314CE B9B8694B00              mov ecx, 004B69B8
:004314D3 E841310400              call 00474619
:004314D8 C645FC00                mov [ebp-04], 00
:004314DC 8D4DF0                  lea ecx, dword ptr [ebp-10]
:004314DF E8657AFEFF              call 00418F49
:004314E4 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:004314EB 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:004314F1 E8DA1DFDFF              call 004032D0
:004314F6 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004314F9 64890D00000000          mov dword ptr fs:[00000000], ecx
:00431500 8BE5                    mov esp, ebp
:00431502 5D                      pop ebp
:00431503 C3                      ret



* Referenced by a CALL at Addresses:
|:004313B7   , :004313FE   
|
:00431504 55                      push ebp
:00431505 8BEC                    mov ebp, esp
:00431507 81EC0C010000            sub esp, 0000010C
:0043150D A1282B4B00              mov eax, dword ptr [004B2B28]
:00431512 898510FFFFFF            mov dword ptr [ebp+FFFFFF10], eax
:00431518 C745F800000000          mov [ebp-08], 00000000
:0043151F C78518FFFFFF00000000    mov dword ptr [ebp+FFFFFF18], 00000000
:00431529 C745FC00000000          mov [ebp-04], 00000000
:00431530 C785F4FEFFFF00000000    mov dword ptr [ebp+FFFFFEF4], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043159C(U), :0043160A(U)
|
:0043153A 8B8D10FFFFFF            mov ecx, dword ptr [ebp+FFFFFF10]
:00431540 81C120030000            add ecx, 00000320
:00431546 51                      push ecx
:00431547 8D951CFFFFFF            lea edx, dword ptr [ebp+FFFFFF1C]
:0043154D 52                      push edx
:0043154E E803AAFDFF              call 0040BF56
:00431553 83C408                  add esp, 00000008
:00431556 8B8510FFFFFF            mov eax, dword ptr [ebp+FFFFFF10]
:0043155C 83C001                  add eax, 00000001
:0043155F 898510FFFFFF            mov dword ptr [ebp+FFFFFF10], eax
:00431565 8B8D1CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF1C]
:0043156B 81E1FF000000            and ecx, 000000FF
:00431571 83F93B                  cmp ecx, 0000003B
:00431574 7505                    jne 0043157B
:00431576 E994000000              jmp 0043160F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431574(C)
|
:0043157B 8B951CFFFFFF            mov edx, dword ptr [ebp+FFFFFF1C]
:00431581 81E2FF000000            and edx, 000000FF
:00431587 83FA2F                  cmp edx, 0000002F
:0043158A 7512                    jne 0043159E
:0043158C 8B851DFFFFFF            mov eax, dword ptr [ebp+FFFFFF1D]
:00431592 25FF000000              and eax, 000000FF
:00431597 83F82F                  cmp eax, 0000002F
:0043159A 7502                    jne 0043159E
:0043159C EB9C                    jmp 0043153A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043158A(C), :0043159A(C)
|
:0043159E 8B8D1CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF1C]
:004315A4 81E1FF000000            and ecx, 000000FF
:004315AA 83F925                  cmp ecx, 00000025
:004315AD 753A                    jne 004315E9
:004315AF 83BD18FFFFFF00          cmp dword ptr [ebp+FFFFFF18], 00000000
:004315B6 7620                    jbe 004315D8
:004315B8 8B951DFFFFFF            mov edx, dword ptr [ebp+FFFFFF1D]
:004315BE 81E2FF000000            and edx, 000000FF
:004315C4 83FA20                  cmp edx, 00000020
:004315C7 740F                    je 004315D8
:004315C9 8B85F4FEFFFF            mov eax, dword ptr [ebp+FFFFFEF4]
:004315CF 83C001                  add eax, 00000001
:004315D2 8985F4FEFFFF            mov dword ptr [ebp+FFFFFEF4], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004315B6(C), :004315C7(C)
|
:004315D8 8B8D18FFFFFF            mov ecx, dword ptr [ebp+FFFFFF18]
:004315DE 83C101                  add ecx, 00000001
:004315E1 898D18FFFFFF            mov dword ptr [ebp+FFFFFF18], ecx
:004315E7 EB21                    jmp 0043160A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004315AD(C)
|
:004315E9 837DF800                cmp dword ptr [ebp-08], 00000000
:004315ED 7709                    ja 004315F8
:004315EF 83BD18FFFFFF00          cmp dword ptr [ebp+FFFFFF18], 00000000
:004315F6 7609                    jbe 00431601

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004315ED(C)
|
:004315F8 8B55FC                  mov edx, dword ptr [ebp-04]
:004315FB 83C201                  add edx, 00000001
:004315FE 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004315F6(C)
|
:00431601 8B45F8                  mov eax, dword ptr [ebp-08]
:00431604 83C001                  add eax, 00000001
:00431607 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004315E7(U)
|
:0043160A E92BFFFFFF              jmp 0043153A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431576(U)
|
:0043160F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00431612 C1E106                  shl ecx, 06
:00431615 8B9518FFFFFF            mov edx, dword ptr [ebp+FFFFFF18]
:0043161B C1E205                  shl edx, 05
:0043161E 03CA                    add ecx, edx
:00431620 8B45FC                  mov eax, dword ptr [ebp-04]
:00431623 C1E004                  shl eax, 04
:00431626 03C8                    add ecx, eax
:00431628 8B95F4FEFFFF            mov edx, dword ptr [ebp+FFFFFEF4]
:0043162E C1E205                  shl edx, 05
:00431631 03CA                    add ecx, edx
:00431633 898D14FFFFFF            mov dword ptr [ebp+FFFFFF14], ecx
:00431639 8B8514FFFFFF            mov eax, dword ptr [ebp+FFFFFF14]
:0043163F D1E8                    shr eax, 1

* Possible Reference to Dialog: DialogID_00C8 
                                  |
:00431641 B9C8000000              mov ecx, 000000C8
:00431646 2BC8                    sub ecx, eax
:00431648 83C128                  add ecx, 00000028
:0043164B 898D14FFFFFF            mov dword ptr [ebp+FFFFFF14], ecx
:00431651 C78518FFFFFF00000000    mov dword ptr [ebp+FFFFFF18], 00000000
:0043165B C745F800000000          mov [ebp-08], 00000000
:00431662 E874CFFEFF              call 0041E5DB
:00431667 6A04                    push 00000004
:00431669 6A00                    push 00000000
:0043166B 6A00                    push 00000000
:0043166D B968AB4A00              mov ecx, 004AAB68
:00431672 E8C9E30400              call 0047FA40
:00431677 50                      push eax
:00431678 6890010000              push 00000190
:0043167D 6880020000              push 00000280
:00431682 6A28                    push 00000028
:00431684 6A00                    push 00000000
:00431686 E810CA0400              call 0047E09B
:0043168B 83C414                  add esp, 00000014
:0043168E EB0F                    jmp 0043169F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00431711(U), :00431A30(U)
|
:00431690 8B15282B4B00            mov edx, dword ptr [004B2B28]
:00431696 83C201                  add edx, 00000001
:00431699 8915282B4B00            mov dword ptr [004B2B28], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043168E(U)
|
:0043169F A1282B4B00              mov eax, dword ptr [004B2B28]
:004316A4 3B8510FFFFFF            cmp eax, dword ptr [ebp+FFFFFF10]
:004316AA 0F8385030000            jnb 00431A35
:004316B0 8B0D282B4B00            mov ecx, dword ptr [004B2B28]
:004316B6 81C120030000            add ecx, 00000320
:004316BC 51                      push ecx
:004316BD 8D951CFFFFFF            lea edx, dword ptr [ebp+FFFFFF1C]
:004316C3 52                      push edx
:004316C4 E88DA8FDFF              call 0040BF56
:004316C9 83C408                  add esp, 00000008
:004316CC 8B851CFFFFFF            mov eax, dword ptr [ebp+FFFFFF1C]
:004316D2 25FF000000              and eax, 000000FF
:004316D7 83F83B                  cmp eax, 0000003B
:004316DA 7514                    jne 004316F0
:004316DC 8B0D282B4B00            mov ecx, dword ptr [004B2B28]
:004316E2 83C101                  add ecx, 00000001
:004316E5 890D282B4B00            mov dword ptr [004B2B28], ecx
:004316EB E945030000              jmp 00431A35

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004316DA(C)
|
:004316F0 8B951CFFFFFF            mov edx, dword ptr [ebp+FFFFFF1C]
:004316F6 81E2FF000000            and edx, 000000FF
:004316FC 83FA2F                  cmp edx, 0000002F
:004316FF 7515                    jne 00431716
:00431701 8B851DFFFFFF            mov eax, dword ptr [ebp+FFFFFF1D]
:00431707 25FF000000              and eax, 000000FF
:0043170C 83F82F                  cmp eax, 0000002F
:0043170F 7505                    jne 00431716
:00431711 E97AFFFFFF              jmp 00431690

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004316FF(C), :0043170F(C)
|
:00431716 8B8D1CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF1C]
:0043171C 81E1FF000000            and ecx, 000000FF
:00431722 83F925                  cmp ecx, 00000025
:00431725 0F858E010000            jne 004318B9
:0043172B 83BD18FFFFFF00          cmp dword ptr [ebp+FFFFFF18], 00000000
:00431732 7620                    jbe 00431754
:00431734 8B951DFFFFFF            mov edx, dword ptr [ebp+FFFFFF1D]
:0043173A 81E2FF000000            and edx, 000000FF
:00431740 83FA20                  cmp edx, 00000020
:00431743 740F                    je 00431754
:00431745 8B8514FFFFFF            mov eax, dword ptr [ebp+FFFFFF14]
:0043174B 83C020                  add eax, 00000020
:0043174E 898514FFFFFF            mov dword ptr [ebp+FFFFFF14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00431732(C), :00431743(C)
|
:00431754 C7850CFFFFFF00000000    mov dword ptr [ebp+FFFFFF0C], 00000000
:0043175E EB0F                    jmp 0043176F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043179C(U)
|
:00431760 8B8D0CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF0C]
:00431766 83C101                  add ecx, 00000001
:00431769 898D0CFFFFFF            mov dword ptr [ebp+FFFFFF0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043175E(U)
|
:0043176F 8B950CFFFFFF            mov edx, dword ptr [ebp+FFFFFF0C]
:00431775 33C0                    xor eax, eax
:00431777 8A84151CFFFFFF          mov al, byte ptr [ebp+edx-000000E4]
:0043177E 85C0                    test eax, eax
:00431780 741C                    je 0043179E
:00431782 8B8D0CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF0C]
:00431788 8B950CFFFFFF            mov edx, dword ptr [ebp+FFFFFF0C]
:0043178E 8A84151DFFFFFF          mov al, byte ptr [ebp+edx-000000E3]
:00431795 88840D1CFFFFFF          mov byte ptr [ebp+ecx-000000E4], al
:0043179C EBC2                    jmp 00431760

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431780(C)
|
:0043179E 8D8D1CFFFFFF            lea ecx, dword ptr [ebp+FFFFFF1C]
:004317A4 51                      push ecx
:004317A5 E8B0E40400              call 0047FC5A
:004317AA 83C404                  add esp, 00000004
:004317AD 8985F8FEFFFF            mov dword ptr [ebp+FFFFFEF8], eax
:004317B3 C745E8D0000000          mov [ebp-18], 000000D0
:004317BA 8B95F8FEFFFF            mov edx, dword ptr [ebp+FFFFFEF8]
:004317C0 C1E204                  shl edx, 04
:004317C3 8B45E8                  mov eax, dword ptr [ebp-18]
:004317C6 03C2                    add eax, edx
:004317C8 8945F0                  mov dword ptr [ebp-10], eax
:004317CB 8B8D14FFFFFF            mov ecx, dword ptr [ebp+FFFFFF14]
:004317D1 894DEC                  mov dword ptr [ebp-14], ecx
:004317D4 8B55EC                  mov edx, dword ptr [ebp-14]
:004317D7 83C220                  add edx, 00000020
:004317DA 8955F4                  mov dword ptr [ebp-0C], edx
:004317DD 8B45E8                  mov eax, dword ptr [ebp-18]
:004317E0 8985FCFEFFFF            mov dword ptr [ebp+FFFFFEFC], eax
:004317E6 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004317E9 898D00FFFFFF            mov dword ptr [ebp+FFFFFF00], ecx
:004317EF 8B55F0                  mov edx, dword ptr [ebp-10]
:004317F2 899504FFFFFF            mov dword ptr [ebp+FFFFFF04], edx
:004317F8 8B45F4                  mov eax, dword ptr [ebp-0C]
:004317FB 898508FFFFFF            mov dword ptr [ebp+FFFFFF08], eax
:00431801 8B8D00FFFFFF            mov ecx, dword ptr [ebp+FFFFFF00]
:00431807 83E901                  sub ecx, 00000001
:0043180A 898D00FFFFFF            mov dword ptr [ebp+FFFFFF00], ecx
:00431810 8B9508FFFFFF            mov edx, dword ptr [ebp+FFFFFF08]
:00431816 83EA01                  sub edx, 00000001
:00431819 899508FFFFFF            mov dword ptr [ebp+FFFFFF08], edx
:0043181F 8B85FCFEFFFF            mov eax, dword ptr [ebp+FFFFFEFC]
:00431825 83E801                  sub eax, 00000001
:00431828 8985FCFEFFFF            mov dword ptr [ebp+FFFFFEFC], eax
:0043182E 8B8D04FFFFFF            mov ecx, dword ptr [ebp+FFFFFF04]
:00431834 83E901                  sub ecx, 00000001
:00431837 898D04FFFFFF            mov dword ptr [ebp+FFFFFF04], ecx
:0043183D 6A00                    push 00000000
:0043183F 6A15                    push 00000015
:00431841 6A04                    push 00000004
:00431843 E8F1B90400              call 0047D239
:00431848 83C40C                  add esp, 0000000C
:0043184B 6A00                    push 00000000
:0043184D 6A01                    push 00000001
:0043184F 6A00                    push 00000000
:00431851 8D951CFFFFFF            lea edx, dword ptr [ebp+FFFFFF1C]
:00431857 52                      push edx
:00431858 6A20                    push 00000020
:0043185A 6A10                    push 00000010
:0043185C 8D85FCFEFFFF            lea eax, dword ptr [ebp+FFFFFEFC]
:00431862 50                      push eax
:00431863 E84CD1FEFF              call 0041E9B4
:00431868 83C41C                  add esp, 0000001C
:0043186B 6A00                    push 00000000
:0043186D 6A12                    push 00000012
:0043186F 6A04                    push 00000004
:00431871 E8C3B90400              call 0047D239
:00431876 83C40C                  add esp, 0000000C
:00431879 6A00                    push 00000000
:0043187B 6A01                    push 00000001
:0043187D 6A00                    push 00000000
:0043187F 8D8D1CFFFFFF            lea ecx, dword ptr [ebp+FFFFFF1C]
:00431885 51                      push ecx
:00431886 6A20                    push 00000020
:00431888 6A10                    push 00000010
:0043188A 8D55E8                  lea edx, dword ptr [ebp-18]
:0043188D 52                      push edx
:0043188E E821D1FEFF              call 0041E9B4
:00431893 83C41C                  add esp, 0000001C
:00431896 8B8518FFFFFF            mov eax, dword ptr [ebp+FFFFFF18]
:0043189C 83C001                  add eax, 00000001
:0043189F 898518FFFFFF            mov dword ptr [ebp+FFFFFF18], eax
:004318A5 8B8D14FFFFFF            mov ecx, dword ptr [ebp+FFFFFF14]
:004318AB 83C120                  add ecx, 00000020
:004318AE 898D14FFFFFF            mov dword ptr [ebp+FFFFFF14], ecx
:004318B4 E977010000              jmp 00431A30

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431725(C)
|
:004318B9 837DF800                cmp dword ptr [ebp-08], 00000000
:004318BD 7709                    ja 004318C8
:004318BF 83BD18FFFFFF00          cmp dword ptr [ebp+FFFFFF18], 00000000
:004318C6 760F                    jbe 004318D7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004318BD(C)
|
:004318C8 8B9514FFFFFF            mov edx, dword ptr [ebp+FFFFFF14]
:004318CE 83C210                  add edx, 00000010
:004318D1 899514FFFFFF            mov dword ptr [ebp+FFFFFF14], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004318C6(C)
|
:004318D7 8D851CFFFFFF            lea eax, dword ptr [ebp+FFFFFF1C]
:004318DD 50                      push eax
:004318DE E877E30400              call 0047FC5A
:004318E3 83C404                  add esp, 00000004
:004318E6 8985F8FEFFFF            mov dword ptr [ebp+FFFFFEF8], eax
:004318EC C745E8F0000000          mov [ebp-18], 000000F0
:004318F3 8B8DF8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEF8]
:004318F9 C1E105                  shl ecx, 05
:004318FC 8B55E8                  mov edx, dword ptr [ebp-18]
:004318FF 03D1                    add edx, ecx
:00431901 8955F0                  mov dword ptr [ebp-10], edx
:00431904 8B8514FFFFFF            mov eax, dword ptr [ebp+FFFFFF14]
:0043190A 8945EC                  mov dword ptr [ebp-14], eax
:0043190D 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00431910 83C140                  add ecx, 00000040
:00431913 894DF4                  mov dword ptr [ebp-0C], ecx
:00431916 8B55E8                  mov edx, dword ptr [ebp-18]
:00431919 8995FCFEFFFF            mov dword ptr [ebp+FFFFFEFC], edx
:0043191F 8B45EC                  mov eax, dword ptr [ebp-14]
:00431922 898500FFFFFF            mov dword ptr [ebp+FFFFFF00], eax
:00431928 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043192B 898D04FFFFFF            mov dword ptr [ebp+FFFFFF04], ecx
:00431931 8B55F4                  mov edx, dword ptr [ebp-0C]
:00431934 899508FFFFFF            mov dword ptr [ebp+FFFFFF08], edx
:0043193A 8B8500FFFFFF            mov eax, dword ptr [ebp+FFFFFF00]
:00431940 83C001                  add eax, 00000001
:00431943 898500FFFFFF            mov dword ptr [ebp+FFFFFF00], eax
:00431949 8B8D08FFFFFF            mov ecx, dword ptr [ebp+FFFFFF08]
:0043194F 83C101                  add ecx, 00000001
:00431952 898D08FFFFFF            mov dword ptr [ebp+FFFFFF08], ecx
:00431958 6A00                    push 00000000
:0043195A 6A18                    push 00000018
:0043195C 6A04                    push 00000004
:0043195E E8D6B80400              call 0047D239
:00431963 83C40C                  add esp, 0000000C
:00431966 6A00                    push 00000000
:00431968 6A01                    push 00000001
:0043196A 6A00                    push 00000000
:0043196C 8D951CFFFFFF            lea edx, dword ptr [ebp+FFFFFF1C]
:00431972 52                      push edx
:00431973 6A40                    push 00000040
:00431975 6A20                    push 00000020
:00431977 8D85FCFEFFFF            lea eax, dword ptr [ebp+FFFFFEFC]
:0043197D 50                      push eax
:0043197E E831D0FEFF              call 0041E9B4
:00431983 83C41C                  add esp, 0000001C
:00431986 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00431989 898DFCFEFFFF            mov dword ptr [ebp+FFFFFEFC], ecx
:0043198F 8B55EC                  mov edx, dword ptr [ebp-14]
:00431992 899500FFFFFF            mov dword ptr [ebp+FFFFFF00], edx
:00431998 8B45F0                  mov eax, dword ptr [ebp-10]
:0043199B 898504FFFFFF            mov dword ptr [ebp+FFFFFF04], eax
:004319A1 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004319A4 898D08FFFFFF            mov dword ptr [ebp+FFFFFF08], ecx
:004319AA 8B95FCFEFFFF            mov edx, dword ptr [ebp+FFFFFEFC]
:004319B0 83EA01                  sub edx, 00000001
:004319B3 8995FCFEFFFF            mov dword ptr [ebp+FFFFFEFC], edx
:004319B9 8B8504FFFFFF            mov eax, dword ptr [ebp+FFFFFF04]
:004319BF 83E801                  sub eax, 00000001
:004319C2 898504FFFFFF            mov dword ptr [ebp+FFFFFF04], eax
:004319C8 6A00                    push 00000000
:004319CA 6A15                    push 00000015
:004319CC 6A04                    push 00000004
:004319CE E866B80400              call 0047D239
:004319D3 83C40C                  add esp, 0000000C
:004319D6 6A00                    push 00000000
:004319D8 6A01                    push 00000001
:004319DA 6A00                    push 00000000
:004319DC 8D8D1CFFFFFF            lea ecx, dword ptr [ebp+FFFFFF1C]
:004319E2 51                      push ecx
:004319E3 6A40                    push 00000040
:004319E5 6A20                    push 00000020
:004319E7 8D95FCFEFFFF            lea edx, dword ptr [ebp+FFFFFEFC]
:004319ED 52                      push edx
:004319EE E8C1CFFEFF              call 0041E9B4
:004319F3 83C41C                  add esp, 0000001C
:004319F6 6A00                    push 00000000
:004319F8 6A12                    push 00000012
:004319FA 6A04                    push 00000004
:004319FC E838B80400              call 0047D239
:00431A01 83C40C                  add esp, 0000000C
:00431A04 6A00                    push 00000000
:00431A06 6A01                    push 00000001
:00431A08 6A00                    push 00000000
:00431A0A 8D851CFFFFFF            lea eax, dword ptr [ebp+FFFFFF1C]
:00431A10 50                      push eax
:00431A11 6A40                    push 00000040
:00431A13 6A20                    push 00000020
:00431A15 8D4DE8                  lea ecx, dword ptr [ebp-18]
:00431A18 51                      push ecx
:00431A19 E896CFFEFF              call 0041E9B4
:00431A1E 83C41C                  add esp, 0000001C
:00431A21 8B9514FFFFFF            mov edx, dword ptr [ebp+FFFFFF14]
:00431A27 83C240                  add edx, 00000040
:00431A2A 899514FFFFFF            mov dword ptr [ebp+FFFFFF14], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004318B4(U)
|
:00431A30 E95BFCFFFF              jmp 00431690

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004316AA(C), :004316EB(U)
|
:00431A35 E8BCCBFEFF              call 0041E5F6
:00431A3A 8BE5                    mov esp, ebp
:00431A3C 5D                      pop ebp
:00431A3D C3                      ret



* Referenced by a CALL at Address:
|:0043141E   
|
:00431A3E 55                      push ebp
:00431A3F 8BEC                    mov ebp, esp
:00431A41 6AFF                    push FFFFFFFF
:00431A43 68AB534800              push 004853AB
:00431A48 64A100000000            mov eax, dword ptr fs:[00000000]
:00431A4E 50                      push eax
:00431A4F 64892500000000          mov dword ptr fs:[00000000], esp
:00431A56 81EC40010000            sub esp, 00000140
:00431A5C A138C84800              mov eax, dword ptr [0048C838]
:00431A61 8985D8FEFFFF            mov dword ptr [ebp+FFFFFED8], eax
:00431A67 668B0D3CC84800          mov cx, word ptr [0048C83C]
:00431A6E 66898DDCFEFFFF          mov word ptr [ebp+FFFFFEDC], cx
:00431A75 8A153EC84800            mov dl, byte ptr [0048C83E]
:00431A7B 8895DEFEFFFF            mov byte ptr [ebp+FFFFFEDE], dl
:00431A81 A140C84800              mov eax, dword ptr [0048C840]
:00431A86 8985C8FEFFFF            mov dword ptr [ebp+FFFFFEC8], eax
:00431A8C 8B0D44C84800            mov ecx, dword ptr [0048C844]
:00431A92 898DCCFEFFFF            mov dword ptr [ebp+FFFFFECC], ecx
:00431A98 8B1548C84800            mov edx, dword ptr [0048C848]
:00431A9E 8995D0FEFFFF            mov dword ptr [ebp+FFFFFED0], edx
:00431AA4 66A14CC84800            mov ax, word ptr [0048C84C]
:00431AAA 668985D4FEFFFF          mov word ptr [ebp+FFFFFED4], ax
:00431AB1 8D8DE0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE0]
:00431AB7 E8F417FDFF              call 004032B0
:00431ABC C745FC00000000          mov [ebp-04], 00000000
:00431AC3 6A0A                    push 0000000A
:00431AC5 B9181B4B00              mov ecx, 004B1B18
:00431ACA E87118FDFF              call 00403340
:00431ACF E80CAAFFFF              call 0042C4E0
:00431AD4 8B4D08                  mov ecx, dword ptr [ebp+08]
:00431AD7 81E1FF000000            and ecx, 000000FF
:00431ADD 83F902                  cmp ecx, 00000002
:00431AE0 7F47                    jg 00431B29

* Possible StringData Ref from Data Obj ->"LOGO.E5"
                                  |
:00431AE2 68F0BA4800              push 0048BAF0
:00431AE7 8D8DE0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE0]
:00431AED E843E0FEFF              call 0041FB35
:00431AF2 6A04                    push 00000004
:00431AF4 6A00                    push 00000000
:00431AF6 6800690000              push 00006900
:00431AFB B9C8E44A00              mov ecx, 004AE4C8
:00431B00 E83BDF0400              call 0047FA40
:00431B05 50                      push eax
:00431B06 8B5508                  mov edx, dword ptr [ebp+08]
:00431B09 81E2FF000000            and edx, 000000FF
:00431B0F 83C201                  add edx, 00000001
:00431B12 52                      push edx
:00431B13 8D8DE0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE0]
:00431B19 E86BE1FEFF              call 0041FC89
:00431B1E 8D8DE0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE0]
:00431B24 E89C77FEFF              call 004192C5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431AE0(C)
|
:00431B29 E894CAFEFF              call 0041E5C2
:00431B2E E8A8CAFEFF              call 0041E5DB
:00431B33 E857CBFEFF              call 0041E68F
:00431B38 8D85D8FEFFFF            lea eax, dword ptr [ebp+FFFFFED8]
:00431B3E 50                      push eax
:00431B3F E816E10400              call 0047FC5A
:00431B44 83C404                  add esp, 00000004
:00431B47 8985B4FEFFFF            mov dword ptr [ebp+FFFFFEB4], eax
:00431B4D C745E440000000          mov [ebp-1C], 00000040
:00431B54 8B8DB4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEB4]
:00431B5A C1E104                  shl ecx, 04
:00431B5D 8B55E4                  mov edx, dword ptr [ebp-1C]
:00431B60 03D1                    add edx, ecx
:00431B62 8955EC                  mov dword ptr [ebp-14], edx
:00431B65 C745E8A0000000          mov [ebp-18], 000000A0
:00431B6C 8B45E8                  mov eax, dword ptr [ebp-18]
:00431B6F 83C020                  add eax, 00000020
:00431B72 8945F0                  mov dword ptr [ebp-10], eax
:00431B75 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00431B78 898DB8FEFFFF            mov dword ptr [ebp+FFFFFEB8], ecx
:00431B7E 8B55E8                  mov edx, dword ptr [ebp-18]
:00431B81 8995BCFEFFFF            mov dword ptr [ebp+FFFFFEBC], edx
:00431B87 8B45EC                  mov eax, dword ptr [ebp-14]
:00431B8A 8985C0FEFFFF            mov dword ptr [ebp+FFFFFEC0], eax
:00431B90 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00431B93 898DC4FEFFFF            mov dword ptr [ebp+FFFFFEC4], ecx
:00431B99 8B95BCFEFFFF            mov edx, dword ptr [ebp+FFFFFEBC]
:00431B9F 83EA01                  sub edx, 00000001
:00431BA2 8995BCFEFFFF            mov dword ptr [ebp+FFFFFEBC], edx
:00431BA8 8B85C4FEFFFF            mov eax, dword ptr [ebp+FFFFFEC4]
:00431BAE 83E801                  sub eax, 00000001
:00431BB1 8985C4FEFFFF            mov dword ptr [ebp+FFFFFEC4], eax
:00431BB7 8B8DB8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEB8]
:00431BBD 83E901                  sub ecx, 00000001
:00431BC0 898DB8FEFFFF            mov dword ptr [ebp+FFFFFEB8], ecx
:00431BC6 8B95C0FEFFFF            mov edx, dword ptr [ebp+FFFFFEC0]
:00431BCC 83EA01                  sub edx, 00000001
:00431BCF 8995C0FEFFFF            mov dword ptr [ebp+FFFFFEC0], edx
:00431BD5 6A00                    push 00000000
:00431BD7 6A15                    push 00000015
:00431BD9 6A04                    push 00000004
:00431BDB E859B60400              call 0047D239
:00431BE0 83C40C                  add esp, 0000000C
:00431BE3 6A00                    push 00000000
:00431BE5 6A01                    push 00000001
:00431BE7 6A00                    push 00000000
:00431BE9 8D85D8FEFFFF            lea eax, dword ptr [ebp+FFFFFED8]
:00431BEF 50                      push eax
:00431BF0 6A20                    push 00000020
:00431BF2 6A10                    push 00000010
:00431BF4 8D8DB8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEB8]
:00431BFA 51                      push ecx
:00431BFB E8B4CDFEFF              call 0041E9B4
:00431C00 83C41C                  add esp, 0000001C
:00431C03 6A00                    push 00000000
:00431C05 6A12                    push 00000012
:00431C07 6A04                    push 00000004
:00431C09 E82BB60400              call 0047D239
:00431C0E 83C40C                  add esp, 0000000C
:00431C11 6A00                    push 00000000
:00431C13 6A01                    push 00000001
:00431C15 6A00                    push 00000000
:00431C17 8D95D8FEFFFF            lea edx, dword ptr [ebp+FFFFFED8]
:00431C1D 52                      push edx
:00431C1E 6A20                    push 00000020
:00431C20 6A10                    push 00000010
:00431C22 8D45E4                  lea eax, dword ptr [ebp-1C]
:00431C25 50                      push eax
:00431C26 E889CDFEFF              call 0041E9B4
:00431C2B 83C41C                  add esp, 0000001C
:00431C2E 8D8DC8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEC8]
:00431C34 51                      push ecx
:00431C35 E820E00400              call 0047FC5A
:00431C3A 83C404                  add esp, 00000004
:00431C3D 8985B4FEFFFF            mov dword ptr [ebp+FFFFFEB4], eax
:00431C43 C745E480000000          mov [ebp-1C], 00000080
:00431C4A 8B95B4FEFFFF            mov edx, dword ptr [ebp+FFFFFEB4]
:00431C50 C1E205                  shl edx, 05
:00431C53 8B45E4                  mov eax, dword ptr [ebp-1C]
:00431C56 03C2                    add eax, edx
:00431C58 8945EC                  mov dword ptr [ebp-14], eax
:00431C5B C745E8D0000000          mov [ebp-18], 000000D0
:00431C62 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00431C65 83C140                  add ecx, 00000040
:00431C68 894DF0                  mov dword ptr [ebp-10], ecx
:00431C6B 8B55E4                  mov edx, dword ptr [ebp-1C]
:00431C6E 8995B8FEFFFF            mov dword ptr [ebp+FFFFFEB8], edx
:00431C74 8B45E8                  mov eax, dword ptr [ebp-18]
:00431C77 8985BCFEFFFF            mov dword ptr [ebp+FFFFFEBC], eax
:00431C7D 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00431C80 898DC0FEFFFF            mov dword ptr [ebp+FFFFFEC0], ecx
:00431C86 8B55F0                  mov edx, dword ptr [ebp-10]
:00431C89 8995C4FEFFFF            mov dword ptr [ebp+FFFFFEC4], edx
:00431C8F 8B85BCFEFFFF            mov eax, dword ptr [ebp+FFFFFEBC]
:00431C95 83C001                  add eax, 00000001
:00431C98 8985BCFEFFFF            mov dword ptr [ebp+FFFFFEBC], eax
:00431C9E 8B8DC4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC4]
:00431CA4 83C101                  add ecx, 00000001
:00431CA7 898DC4FEFFFF            mov dword ptr [ebp+FFFFFEC4], ecx
:00431CAD 6A00                    push 00000000
:00431CAF 6A18                    push 00000018
:00431CB1 6A04                    push 00000004
:00431CB3 E881B50400              call 0047D239
:00431CB8 83C40C                  add esp, 0000000C
:00431CBB 6A00                    push 00000000
:00431CBD 6A01                    push 00000001
:00431CBF 6A00                    push 00000000
:00431CC1 8D95C8FEFFFF            lea edx, dword ptr [ebp+FFFFFEC8]
:00431CC7 52                      push edx
:00431CC8 6A40                    push 00000040
:00431CCA 6A20                    push 00000020
:00431CCC 8D85B8FEFFFF            lea eax, dword ptr [ebp+FFFFFEB8]
:00431CD2 50                      push eax
:00431CD3 E8DCCCFEFF              call 0041E9B4
:00431CD8 83C41C                  add esp, 0000001C
:00431CDB 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00431CDE 898DB8FEFFFF            mov dword ptr [ebp+FFFFFEB8], ecx
:00431CE4 8B55E8                  mov edx, dword ptr [ebp-18]
:00431CE7 8995BCFEFFFF            mov dword ptr [ebp+FFFFFEBC], edx
:00431CED 8B45EC                  mov eax, dword ptr [ebp-14]
:00431CF0 8985C0FEFFFF            mov dword ptr [ebp+FFFFFEC0], eax
:00431CF6 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00431CF9 898DC4FEFFFF            mov dword ptr [ebp+FFFFFEC4], ecx
:00431CFF 8B95B8FEFFFF            mov edx, dword ptr [ebp+FFFFFEB8]
:00431D05 83EA01                  sub edx, 00000001
:00431D08 8995B8FEFFFF            mov dword ptr [ebp+FFFFFEB8], edx
:00431D0E 8B85C0FEFFFF            mov eax, dword ptr [ebp+FFFFFEC0]
:00431D14 83E801                  sub eax, 00000001
:00431D17 8985C0FEFFFF            mov dword ptr [ebp+FFFFFEC0], eax
:00431D1D 6A00                    push 00000000
:00431D1F 6A15                    push 00000015
:00431D21 6A04                    push 00000004
:00431D23 E811B50400              call 0047D239
:00431D28 83C40C                  add esp, 0000000C
:00431D2B 6A00                    push 00000000
:00431D2D 6A01                    push 00000001
:00431D2F 6A00                    push 00000000
:00431D31 8D8DC8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEC8]
:00431D37 51                      push ecx
:00431D38 6A40                    push 00000040
:00431D3A 6A20                    push 00000020
:00431D3C 8D95B8FEFFFF            lea edx, dword ptr [ebp+FFFFFEB8]
:00431D42 52                      push edx
:00431D43 E86CCCFEFF              call 0041E9B4
:00431D48 83C41C                  add esp, 0000001C
:00431D4B 6A00                    push 00000000
:00431D4D 6A12                    push 00000012
:00431D4F 6A04                    push 00000004
:00431D51 E8E3B40400              call 0047D239
:00431D56 83C40C                  add esp, 0000000C
:00431D59 6A00                    push 00000000
:00431D5B 6A01                    push 00000001
:00431D5D 6A00                    push 00000000
:00431D5F 8D85C8FEFFFF            lea eax, dword ptr [ebp+FFFFFEC8]
:00431D65 50                      push eax
:00431D66 6A40                    push 00000040
:00431D68 6A20                    push 00000020
:00431D6A 8D4DE4                  lea ecx, dword ptr [ebp-1C]
:00431D6D 51                      push ecx
:00431D6E E841CCFEFF              call 0041E9B4
:00431D73 83C41C                  add esp, 0000001C
:00431D76 8B5508                  mov edx, dword ptr [ebp+08]
:00431D79 81E2FF000000            and edx, 000000FF
:00431D7F 83FA02                  cmp edx, 00000002
:00431D82 7F2A                    jg 00431DAE
:00431D84 6A04                    push 00000004
:00431D86 6A00                    push 00000000
:00431D88 6800690000              push 00006900
:00431D8D B9C8E44A00              mov ecx, 004AE4C8
:00431D92 E8A9DC0400              call 0047FA40
:00431D97 50                      push eax
:00431D98 6A40                    push 00000040
:00431D9A 6A40                    push 00000040

* Possible Reference to Dialog: DialogID_0154 
                                  |
:00431D9C 6854010000              push 00000154
:00431DA1 6820010000              push 00000120
:00431DA6 E8F0C20400              call 0047E09B
:00431DAB 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431D82(C)
|
:00431DAE E843C8FEFF              call 0041E5F6
:00431DB3 6A0A                    push 0000000A
:00431DB5 B9181B4B00              mov ecx, 004B1B18
:00431DBA E88115FDFF              call 00403340
:00431DBF E81CA7FFFF              call 0042C4E0
:00431DC4 E83CC6FEFF              call 0041E405
:00431DC9 68A0000000              push 000000A0
:00431DCE B9181B4B00              mov ecx, 004B1B18
:00431DD3 E86815FDFF              call 00403340
:00431DD8 E803A7FFFF              call 0042C4E0
:00431DDD E8E0C7FEFF              call 0041E5C2
:00431DE2 6A0A                    push 0000000A
:00431DE4 B9181B4B00              mov ecx, 004B1B18
:00431DE9 E85215FDFF              call 00403340
:00431DEE E8EDA6FFFF              call 0042C4E0
:00431DF3 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00431DFA 8D8DE0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE0]
:00431E00 E8CB14FDFF              call 004032D0
:00431E05 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00431E08 64890D00000000          mov dword ptr fs:[00000000], ecx
:00431E0F 8BE5                    mov esp, ebp
:00431E11 5D                      pop ebp
:00431E12 C3                      ret



* Referenced by a CALL at Addresses:
|:004313C6   , :0043140D   
|
:00431E13 55                      push ebp
:00431E14 8BEC                    mov ebp, esp
:00431E16 83EC14                  sub esp, 00000014
:00431E19 C745F000000000          mov [ebp-10], 00000000

* Possible StringData Ref from Data Obj ->"????"
                                  |
:00431E20 C745F850C84800          mov [ebp-08], 0048C850
:00431E27 837D081A                cmp dword ptr [ebp+08], 0000001A
:00431E2B 7205                    jb 00431E32
:00431E2D E94F050000              jmp 00432381

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431E2B(C)
|
:00431E32 8B4508                  mov eax, dword ptr [ebp+08]
:00431E35 8B0C85302B4B00          mov ecx, dword ptr [4*eax+004B2B30]
:00431E3C 6BC948                  imul ecx, 00000048
:00431E3F 81C1681B4A00            add ecx, 004A1B68
:00431E45 894DEC                  mov dword ptr [ebp-14], ecx
:00431E48 6A04                    push 00000004
:00431E4A 6A00                    push 00000000
:00431E4C 6A00                    push 00000000
:00431E4E B9C8E44A00              mov ecx, 004AE4C8
:00431E53 E8E8DB0400              call 0047FA40
:00431E58 50                      push eax
:00431E59 68B8010000              push 000001B8
:00431E5E 68D0000000              push 000000D0
:00431E63 6A00                    push 00000000
:00431E65 6A00                    push 00000000
:00431E67 E8E5C30400              call 0047E251
:00431E6C 83C414                  add esp, 00000014
:00431E6F 68A8D04A00              push 004AD0A8
:00431E74 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00431E77 E82B57FDFF              call 004075A7
:00431E7C 50                      push eax
:00431E7D B938C54A00              mov ecx, 004AC538
:00431E82 E802DEFEFF              call 0041FC89
:00431E87 8B5508                  mov edx, dword ptr [ebp+08]
:00431E8A 8B0495302B4B00          mov eax, dword ptr [4*edx+004B2B30]
:00431E91 50                      push eax
:00431E92 E8F982FEFF              call 0041A190
:00431E97 83C404                  add esp, 00000004
:00431E9A 85C0                    test eax, eax
:00431E9C 753B                    jne 00431ED9
:00431E9E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00431EA1 833C8D302B4B0003        cmp dword ptr [4*ecx+004B2B30], 00000003
:00431EA9 751D                    jne 00431EC8
:00431EAB 6A1F                    push 0000001F
:00431EAD 6800140000              push 00001400
:00431EB2 68A8D04A00              push 004AD0A8
:00431EB7 E857DE0400              call 0047FD13
:00431EBC 83C40C                  add esp, 0000000C
:00431EBF C745F001000000          mov [ebp-10], 00000001
:00431EC6 EB11                    jmp 00431ED9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431EA9(C)
|
:00431EC8 6A50                    push 00000050
:00431ECA 6A40                    push 00000040
:00431ECC 68A8D04A00              push 004AD0A8
:00431ED1 E8A4E9FFFF              call 0043087A
:00431ED6 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00431E9C(C), :00431EC6(U)
|
:00431ED9 C745F4B8FFFFFF          mov [ebp-0C], FFFFFFB8
:00431EE0 EB09                    jmp 00431EEB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431F4A(U)
|
:00431EE2 8B55F4                  mov edx, dword ptr [ebp-0C]
:00431EE5 83C208                  add edx, 00000008
:00431EE8 8955F4                  mov dword ptr [ebp-0C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431EE0(U)
|
:00431EEB 837DF410                cmp dword ptr [ebp-0C], 00000010
:00431EEF 7F5B                    jg 00431F4C
:00431EF1 E8E5C6FEFF              call 0041E5DB
:00431EF6 6A04                    push 00000004
:00431EF8 6A00                    push 00000000
:00431EFA 6800410000              push 00004100
:00431EFF B9C8E44A00              mov ecx, 004AE4C8
:00431F04 E837DB0400              call 0047FA40
:00431F09 50                      push eax
:00431F0A 6A50                    push 00000050
:00431F0C 68D0000000              push 000000D0
:00431F11 6A50                    push 00000050
:00431F13 6A00                    push 00000000
:00431F15 E881C10400              call 0047E09B
:00431F1A 83C414                  add esp, 00000014
:00431F1D 68A8D04A00              push 004AD0A8
:00431F22 6A50                    push 00000050
:00431F24 6A40                    push 00000040
:00431F26 6A50                    push 00000050
:00431F28 8B45F4                  mov eax, dword ptr [ebp-0C]
:00431F2B 50                      push eax
:00431F2C E86AC10400              call 0047E09B
:00431F31 83C414                  add esp, 00000014
:00431F34 E8BDC6FEFF              call 0041E5F6
:00431F39 6A01                    push 00000001
:00431F3B B9181B4B00              mov ecx, 004B1B18
:00431F40 E8FB13FDFF              call 00403340
:00431F45 E896A5FFFF              call 0042C4E0
:00431F4A EB96                    jmp 00431EE2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431EEF(C)
|
:00431F4C C745FCB0000000          mov [ebp-04], 000000B0
:00431F53 6A04                    push 00000004
:00431F55 B9382F4900              mov ecx, 00492F38
:00431F5A E8D7CDFDFF              call 0040ED36
:00431F5F 6A00                    push 00000000
:00431F61 B9382F4900              mov ecx, 00492F38
:00431F66 E89FCDFDFF              call 0040ED0A
:00431F6B 6A12                    push 00000012
:00431F6D B9382F4900              mov ecx, 00492F38
:00431F72 E80DCDFDFF              call 0040EC84
:00431F77 6A2A                    push 0000002A
:00431F79 B9382F4900              mov ecx, 00492F38
:00431F7E E871CDFDFF              call 0040ECF4
:00431F83 6A00                    push 00000000
:00431F85 B9382F4900              mov ecx, 00492F38
:00431F8A E82DCDFDFF              call 0040ECBC
:00431F8F 837DF000                cmp dword ptr [ebp-10], 00000000
:00431F93 743F                    je 00431FD4
:00431F95 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00431F98 51                      push ecx
:00431F99 8B55F8                  mov edx, dword ptr [ebp-08]
:00431F9C 52                      push edx
:00431F9D E8B8DC0400              call 0047FC5A
:00431FA2 83C404                  add esp, 00000004
:00431FA5 B908000000              mov ecx, 00000008
:00431FAA 2BC8                    sub ecx, eax
:00431FAC D1E9                    shr ecx, 1
:00431FAE 83C102                  add ecx, 00000002
:00431FB1 51                      push ecx
:00431FB2 B9382F4900              mov ecx, 00492F38
:00431FB7 E81BCCFDFF              call 0040EBD7
:00431FBC 8B55F8                  mov edx, dword ptr [ebp-08]
:00431FBF 52                      push edx

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:00431FC0 6858C84800              push 0048C858
:00431FC5 68382F4900              push 00492F38
:00431FCA E8D1DAFDFF              call 0040FAA0
:00431FCF 83C40C                  add esp, 0000000C
:00431FD2 EB47                    jmp 0043201B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431F93(C)
|
:00431FD4 8B45FC                  mov eax, dword ptr [ebp-04]
:00431FD7 50                      push eax
:00431FD8 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00431FDB E87757FDFF              call 00407757
:00431FE0 50                      push eax
:00431FE1 E874DC0400              call 0047FC5A
:00431FE6 83C404                  add esp, 00000004
:00431FE9 B908000000              mov ecx, 00000008
:00431FEE 2BC8                    sub ecx, eax
:00431FF0 D1E9                    shr ecx, 1
:00431FF2 83C102                  add ecx, 00000002
:00431FF5 51                      push ecx
:00431FF6 B9382F4900              mov ecx, 00492F38
:00431FFB E8D7CBFDFF              call 0040EBD7
:00432000 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00432003 E84F57FDFF              call 00407757
:00432008 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:00432009 685CC84800              push 0048C85C
:0043200E 68382F4900              push 00492F38
:00432013 E888DAFDFF              call 0040FAA0
:00432018 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431FD2(U)
|
:0043201B 6A14                    push 00000014
:0043201D B9181B4B00              mov ecx, 004B1B18
:00432022 E81913FDFF              call 00403340
:00432027 E8B4A4FFFF              call 0042C4E0
:0043202C E8AAC5FEFF              call 0041E5DB
:00432031 8B55FC                  mov edx, dword ptr [ebp-04]
:00432034 83C228                  add edx, 00000028
:00432037 8955FC                  mov dword ptr [ebp-04], edx
:0043203A 8B45FC                  mov eax, dword ptr [ebp-04]
:0043203D 50                      push eax
:0043203E 6A02                    push 00000002
:00432040 B9382F4900              mov ecx, 00492F38
:00432045 E88DCBFDFF              call 0040EBD7
:0043204A 6A01                    push 00000001
:0043204C B9382F4900              mov ecx, 00492F38
:00432051 E8B4CCFDFF              call 0040ED0A
:00432056 6A3A                    push 0000003A
:00432058 B9382F4900              mov ecx, 00492F38
:0043205D E892CCFDFF              call 0040ECF4

* Possible StringData Ref from Data Obj ->"ս"
                                  |
:00432062 6860C84800              push 0048C860
:00432067 68382F4900              push 00492F38
:0043206C E82FDAFDFF              call 0040FAA0
:00432071 83C408                  add esp, 00000008
:00432074 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00432077 83C120                  add ecx, 00000020
:0043207A 894DFC                  mov dword ptr [ebp-04], ecx
:0043207D 8B55FC                  mov edx, dword ptr [ebp-04]
:00432080 52                      push edx
:00432081 6A02                    push 00000002
:00432083 B9382F4900              mov ecx, 00492F38
:00432088 E84ACBFDFF              call 0040EBD7
:0043208D 6A00                    push 00000000
:0043208F B9382F4900              mov ecx, 00492F38
:00432094 E871CCFDFF              call 0040ED0A
:00432099 837DF000                cmp dword ptr [ebp-10], 00000000
:0043209D 7414                    je 004320B3

* Possible StringData Ref from Data Obj ->" --  ˴ --"
                                  |
:0043209F 686CC84800              push 0048C86C
:004320A4 68382F4900              push 00492F38
:004320A9 E8F2D9FDFF              call 0040FAA0
:004320AE 83C408                  add esp, 00000008
:004320B1 EB2E                    jmp 004320E1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043209D(C)
|
:004320B3 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004320B6 E805070000              call 004327C0
:004320BB 25FF000000              and eax, 000000FF
:004320C0 50                      push eax
:004320C1 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004320C4 E8D7060000              call 004327A0
:004320C9 25FF000000              and eax, 000000FF
:004320CE 50                      push eax

* Possible StringData Ref from Data Obj ->" %2u  ˴ %2u"
                                  |
:004320CF 6888C84800              push 0048C888
:004320D4 68382F4900              push 00492F38
:004320D9 E8C2D9FDFF              call 0040FAA0
:004320DE 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004320B1(U)
|
:004320E1 8B45FC                  mov eax, dword ptr [ebp-04]
:004320E4 83C028                  add eax, 00000028
:004320E7 8945FC                  mov dword ptr [ebp-04], eax
:004320EA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004320ED 51                      push ecx
:004320EE 6A02                    push 00000002
:004320F0 B9382F4900              mov ecx, 00492F38
:004320F5 E8DDCAFDFF              call 0040EBD7
:004320FA 6A01                    push 00000001
:004320FC B9382F4900              mov ecx, 00492F38
:00432101 E804CCFDFF              call 0040ED0A

* Possible StringData Ref from Data Obj ->"յȼ"
                                  |
:00432106 68A4C84800              push 0048C8A4
:0043210B 68382F4900              push 00492F38
:00432110 E88BD9FDFF              call 0040FAA0
:00432115 83C408                  add esp, 00000008
:00432118 8B55FC                  mov edx, dword ptr [ebp-04]
:0043211B 83C220                  add edx, 00000020
:0043211E 8955FC                  mov dword ptr [ebp-04], edx
:00432121 8B45FC                  mov eax, dword ptr [ebp-04]
:00432124 50                      push eax
:00432125 6A02                    push 00000002
:00432127 B9382F4900              mov ecx, 00492F38
:0043212C E8A6CAFDFF              call 0040EBD7
:00432131 6A00                    push 00000000
:00432133 B9382F4900              mov ecx, 00492F38
:00432138 E8CDCBFDFF              call 0040ED0A
:0043213D 837DF000                cmp dword ptr [ebp-10], 00000000
:00432141 7414                    je 00432157

* Possible StringData Ref from Data Obj ->"Lv --"
                                  |
:00432143 68B0C84800              push 0048C8B0
:00432148 68382F4900              push 00492F38
:0043214D E84ED9FDFF              call 0040FAA0
:00432152 83C408                  add esp, 00000008
:00432155 EB20                    jmp 00432177

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432141(C)
|
:00432157 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043215A E87144FDFF              call 004065D0
:0043215F 25FF000000              and eax, 000000FF
:00432164 50                      push eax

* Possible StringData Ref from Data Obj ->"Lv %2u"
                                  |
:00432165 68B8C84800              push 0048C8B8
:0043216A 68382F4900              push 00492F38
:0043216F E82CD9FDFF              call 0040FAA0
:00432174 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432155(U)
|
:00432177 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043217A 83C128                  add ecx, 00000028
:0043217D 894DFC                  mov dword ptr [ebp-04], ecx
:00432180 8B55FC                  mov edx, dword ptr [ebp-04]
:00432183 52                      push edx
:00432184 6A02                    push 00000002
:00432186 B9382F4900              mov ecx, 00492F38
:0043218B E847CAFDFF              call 0040EBD7
:00432190 6A01                    push 00000001
:00432192 B9382F4900              mov ecx, 00492F38
:00432197 E86ECBFDFF              call 0040ED0A

* Possible StringData Ref from Data Obj ->"ղ"
                                  |
:0043219C 68C0C84800              push 0048C8C0
:004321A1 68382F4900              push 00492F38
:004321A6 E8F5D8FDFF              call 0040FAA0
:004321AB 83C408                  add esp, 00000008
:004321AE 8B45FC                  mov eax, dword ptr [ebp-04]
:004321B1 83C020                  add eax, 00000020
:004321B4 8945FC                  mov dword ptr [ebp-04], eax
:004321B7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004321BA 51                      push ecx
:004321BB 6A02                    push 00000002
:004321BD B9382F4900              mov ecx, 00492F38
:004321C2 E810CAFDFF              call 0040EBD7
:004321C7 6A00                    push 00000000
:004321C9 B9382F4900              mov ecx, 00492F38
:004321CE E837CBFDFF              call 0040ED0A
:004321D3 837DF000                cmp dword ptr [ebp-10], 00000000
:004321D7 7418                    je 004321F1
:004321D9 8B55F8                  mov edx, dword ptr [ebp-08]
:004321DC 52                      push edx

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:004321DD 68D0C84800              push 0048C8D0
:004321E2 68382F4900              push 00492F38
:004321E7 E8B4D8FDFF              call 0040FAA0
:004321EC 83C40C                  add esp, 0000000C
:004321EF EB27                    jmp 00432218

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004321D7(C)
|
:004321F1 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004321F4 E81744FDFF              call 00406610
:004321F9 25FF000000              and eax, 000000FF
:004321FE 8B0485A8BE4800          mov eax, dword ptr [4*eax+0048BEA8]
:00432205 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:00432206 68D4C84800              push 0048C8D4
:0043220B 68382F4900              push 00492F38
:00432210 E88BD8FDFF              call 0040FAA0
:00432215 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004321EF(U)
|
:00432218 E8D9C3FEFF              call 0041E5F6
:0043221D 837D0819                cmp dword ptr [ebp+08], 00000019
:00432221 750E                    jne 00432231
:00432223 6A78                    push 00000078
:00432225 B9181B4B00              mov ecx, 004B1B18
:0043222A E81111FDFF              call 00403340
:0043222F EB0C                    jmp 0043223D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432221(C)
|
:00432231 6A64                    push 00000064
:00432233 B9181B4B00              mov ecx, 004B1B18
:00432238 E80311FDFF              call 00403340

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043222F(U)
|
:0043223D E89EA2FFFF              call 0042C4E0
:00432242 E894C3FEFF              call 0041E5DB
:00432247 6A04                    push 00000004
:00432249 6A00                    push 00000000
:0043224B 6A00                    push 00000000
:0043224D B9C8E44A00              mov ecx, 004AE4C8
:00432252 E8E9D70400              call 0047FA40
:00432257 50                      push eax
:00432258 68B8010000              push 000001B8
:0043225D 68D0000000              push 000000D0
:00432262 6A00                    push 00000000
:00432264 6A00                    push 00000000
:00432266 E830BE0400              call 0047E09B
:0043226B 83C414                  add esp, 00000014
:0043226E 6898AB4A00              push 004AAB98
:00432273 6A50                    push 00000050
:00432275 6A40                    push 00000040
:00432277 6A50                    push 00000050
:00432279 6A10                    push 00000010
:0043227B E8D1BF0400              call 0047E251
:00432280 83C414                  add esp, 00000014
:00432283 68A8D04A00              push 004AD0A8
:00432288 6A50                    push 00000050
:0043228A 6A40                    push 00000040
:0043228C 6A50                    push 00000050
:0043228E 6A10                    push 00000010
:00432290 E806BE0400              call 0047E09B
:00432295 83C414                  add esp, 00000014
:00432298 E859C3FEFF              call 0041E5F6
:0043229D C745F400000000          mov [ebp-0C], 00000000
:004322A4 EB09                    jmp 004322AF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432367(U)
|
:004322A6 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004322A9 83C101                  add ecx, 00000001
:004322AC 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004322A4(U)
|
:004322AF 837DF410                cmp dword ptr [ebp-0C], 00000010
:004322B3 0F8DB3000000            jnl 0043236C
:004322B9 E81DC3FEFF              call 0041E5DB
:004322BE 6800140000              push 00001400
:004322C3 6A04                    push 00000004
:004322C5 6A00                    push 00000000
:004322C7 6880650100              push 00016580
:004322CC B9C8E44A00              mov ecx, 004AE4C8
:004322D1 E86AD70400              call 0047FA40
:004322D6 50                      push eax
:004322D7 68A8D04A00              push 004AD0A8
:004322DC E81CDA0400              call 0047FCFD
:004322E1 83C40C                  add esp, 0000000C
:004322E4 6A00                    push 00000000
:004322E6 6A00                    push 00000000
:004322E8 6A00                    push 00000000
:004322EA 8A55F4                  mov dl, byte ptr [ebp-0C]
:004322ED 52                      push edx
:004322EE 6A04                    push 00000004
:004322F0 6A00                    push 00000000
:004322F2 6880650100              push 00016580
:004322F7 B9C8E44A00              mov ecx, 004AE4C8
:004322FC E83FD70400              call 0047FA40
:00432301 50                      push eax
:00432302 6898AB4A00              push 004AAB98
:00432307 68A8D04A00              push 004AD0A8
:0043230C 6A50                    push 00000050
:0043230E 6A40                    push 00000040
:00432310 E845DAFFFF              call 0042FD5A
:00432315 83C424                  add esp, 00000024
:00432318 6898AB4A00              push 004AAB98
:0043231D 6A50                    push 00000050
:0043231F 6A40                    push 00000040
:00432321 6A50                    push 00000050
:00432323 6A10                    push 00000010
:00432325 E871BD0400              call 0047E09B
:0043232A 83C414                  add esp, 00000014
:0043232D 6A04                    push 00000004
:0043232F 6A00                    push 00000000
:00432331 6880650100              push 00016580
:00432336 B9C8E44A00              mov ecx, 004AE4C8
:0043233B E800D70400              call 0047FA40
:00432340 50                      push eax
:00432341 6A50                    push 00000050
:00432343 6A40                    push 00000040
:00432345 6A50                    push 00000050
:00432347 6A10                    push 00000010
:00432349 E84DBD0400              call 0047E09B
:0043234E 83C414                  add esp, 00000014
:00432351 E8A0C2FEFF              call 0041E5F6
:00432356 6A01                    push 00000001
:00432358 B9181B4B00              mov ecx, 004B1B18
:0043235D E8DE0FFDFF              call 00403340
:00432362 E879A1FFFF              call 0042C4E0
:00432367 E93AFFFFFF              jmp 004322A6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004322B3(C)
|
:0043236C 6898AB4A00              push 004AAB98
:00432371 6A50                    push 00000050
:00432373 6A40                    push 00000040
:00432375 6A50                    push 00000050
:00432377 6A10                    push 00000010
:00432379 E81DBD0400              call 0047E09B
:0043237E 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00431E2D(U)
|
:00432381 8BE5                    mov esp, ebp
:00432383 5D                      pop ebp
:00432384 C3                      ret



* Referenced by a CALL at Address:
|:00431358   
|
:00432385 55                      push ebp
:00432386 8BEC                    mov ebp, esp
:00432388 83EC18                  sub esp, 00000018

* Possible StringData Ref from Data Obj ->"־ܲٴ"
                                  |
:0043238B C745E8D8C84800          mov [ebp-18], 0048C8D8

* Possible StringData Ref from Data Obj ->"  Ⱥ  "
                                  |
:00432392 C745ECE8C84800          mov [ebp-14], 0048C8E8
:00432399 E83DC2FEFF              call 0041E5DB
:0043239E 6A04                    push 00000004
:004323A0 6A00                    push 00000000
:004323A2 6A00                    push 00000000
:004323A4 B968AB4A00              mov ecx, 004AAB68
:004323A9 E892D60400              call 0047FA40
:004323AE 50                      push eax
:004323AF 6890010000              push 00000190
:004323B4 6880020000              push 00000280
:004323B9 6A28                    push 00000028
:004323BB 6A00                    push 00000000
:004323BD E8D9BC0400              call 0047E09B
:004323C2 83C414                  add esp, 00000014
:004323C5 C745F080000000          mov [ebp-10], 00000080
:004323CC 8B45F0                  mov eax, dword ptr [ebp-10]
:004323CF 0580010000              add eax, 00000180
:004323D4 8945F8                  mov dword ptr [ebp-08], eax
:004323D7 C745F464000000          mov [ebp-0C], 00000064
:004323DE 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004323E1 83C140                  add ecx, 00000040
:004323E4 894DFC                  mov dword ptr [ebp-04], ecx
:004323E7 6A00                    push 00000000
:004323E9 8B55E8                  mov edx, dword ptr [ebp-18]
:004323EC 52                      push edx
:004323ED 6A15                    push 00000015
:004323EF 6A01                    push 00000001
:004323F1 6A40                    push 00000040
:004323F3 83EC10                  sub esp, 00000010
:004323F6 8BC4                    mov eax, esp
:004323F8 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004323FB 8908                    mov dword ptr [eax], ecx
:004323FD 8B55F4                  mov edx, dword ptr [ebp-0C]
:00432400 895004                  mov dword ptr [eax+04], edx
:00432403 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00432406 894808                  mov dword ptr [eax+08], ecx
:00432409 8B55FC                  mov edx, dword ptr [ebp-04]
:0043240C 89500C                  mov dword ptr [eax+0C], edx
:0043240F E8E4C8FEFF              call 0041ECF8
:00432414 83C424                  add esp, 00000024
:00432417 6A00                    push 00000000
:00432419 6A12                    push 00000012
:0043241B 6A04                    push 00000004
:0043241D E817AE0400              call 0047D239
:00432422 83C40C                  add esp, 0000000C
:00432425 6A00                    push 00000000
:00432427 6A01                    push 00000001
:00432429 6A00                    push 00000000
:0043242B 8B45E8                  mov eax, dword ptr [ebp-18]
:0043242E 50                      push eax
:0043242F 6A40                    push 00000040
:00432431 6A20                    push 00000020
:00432433 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00432436 51                      push ecx
:00432437 E878C5FEFF              call 0041E9B4
:0043243C 83C41C                  add esp, 0000001C
:0043243F E8B2C1FEFF              call 0041E5F6
:00432444 E8BCBFFEFF              call 0041E405
:00432449 6A14                    push 00000014
:0043244B B9181B4B00              mov ecx, 004B1B18
:00432450 E8EB0EFDFF              call 00403340
:00432455 E886A0FFFF              call 0042C4E0
:0043245A E87CC1FEFF              call 0041E5DB
:0043245F C745F0B0000000          mov [ebp-10], 000000B0
:00432466 8B55F0                  mov edx, dword ptr [ebp-10]
:00432469 81C220010000            add edx, 00000120
:0043246F 8955F8                  mov dword ptr [ebp-08], edx
:00432472 C745F4DC000000          mov [ebp-0C], 000000DC
:00432479 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043247C 83C040                  add eax, 00000040
:0043247F 8945FC                  mov dword ptr [ebp-04], eax
:00432482 6A00                    push 00000000
:00432484 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00432487 51                      push ecx
:00432488 68AC000000              push 000000AC
:0043248D 6A03                    push 00000003
:0043248F 6A40                    push 00000040
:00432491 83EC10                  sub esp, 00000010
:00432494 8BD4                    mov edx, esp
:00432496 8B45F0                  mov eax, dword ptr [ebp-10]
:00432499 8902                    mov dword ptr [edx], eax
:0043249B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043249E 894A04                  mov dword ptr [edx+04], ecx
:004324A1 8B45F8                  mov eax, dword ptr [ebp-08]
:004324A4 894208                  mov dword ptr [edx+08], eax
:004324A7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004324AA 894A0C                  mov dword ptr [edx+0C], ecx
:004324AD E846C8FEFF              call 0041ECF8
:004324B2 83C424                  add esp, 00000024
:004324B5 6A00                    push 00000000
:004324B7 8B55EC                  mov edx, dword ptr [ebp-14]
:004324BA 52                      push edx
:004324BB 6A3A                    push 0000003A
:004324BD 6A02                    push 00000002
:004324BF 6A40                    push 00000040
:004324C1 83EC10                  sub esp, 00000010
:004324C4 8BC4                    mov eax, esp
:004324C6 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004324C9 8908                    mov dword ptr [eax], ecx
:004324CB 8B55F4                  mov edx, dword ptr [ebp-0C]
:004324CE 895004                  mov dword ptr [eax+04], edx
:004324D1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004324D4 894808                  mov dword ptr [eax+08], ecx
:004324D7 8B55FC                  mov edx, dword ptr [ebp-04]
:004324DA 89500C                  mov dword ptr [eax+0C], edx
:004324DD E816C8FEFF              call 0041ECF8
:004324E2 83C424                  add esp, 00000024
:004324E5 6A00                    push 00000000
:004324E7 8B45EC                  mov eax, dword ptr [ebp-14]
:004324EA 50                      push eax
:004324EB 6A35                    push 00000035
:004324ED 6A01                    push 00000001
:004324EF 6A40                    push 00000040
:004324F1 83EC10                  sub esp, 00000010
:004324F4 8BCC                    mov ecx, esp
:004324F6 8B55F0                  mov edx, dword ptr [ebp-10]
:004324F9 8911                    mov dword ptr [ecx], edx
:004324FB 8B45F4                  mov eax, dword ptr [ebp-0C]
:004324FE 894104                  mov dword ptr [ecx+04], eax
:00432501 8B55F8                  mov edx, dword ptr [ebp-08]
:00432504 895108                  mov dword ptr [ecx+08], edx
:00432507 8B45FC                  mov eax, dword ptr [ebp-04]
:0043250A 89410C                  mov dword ptr [ecx+0C], eax
:0043250D E8E6C7FEFF              call 0041ECF8
:00432512 83C424                  add esp, 00000024
:00432515 6A00                    push 00000000
:00432517 6A12                    push 00000012
:00432519 6A04                    push 00000004
:0043251B E819AD0400              call 0047D239
:00432520 83C40C                  add esp, 0000000C
:00432523 6A00                    push 00000000
:00432525 6A01                    push 00000001
:00432527 6A00                    push 00000000
:00432529 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043252C 51                      push ecx
:0043252D 6A40                    push 00000040
:0043252F 6A20                    push 00000020
:00432531 8D55F0                  lea edx, dword ptr [ebp-10]
:00432534 52                      push edx
:00432535 E87AC4FEFF              call 0041E9B4
:0043253A 83C41C                  add esp, 0000001C
:0043253D E8B4C0FEFF              call 0041E5F6
:00432542 8BE5                    mov esp, ebp
:00432544 5D                      pop ebp
:00432545 C3                      ret



* Referenced by a CALL at Address:
|:004313DF   
|
:00432546 55                      push ebp
:00432547 8BEC                    mov ebp, esp
:00432549 83EC1C                  sub esp, 0000001C

* Possible StringData Ref from Data Obj ->"ļ"
                                  |
:0043254C C745E8F4C84800          mov [ebp-18], 0048C8F4

* Possible StringData Ref from Data Obj ->"          "
                                  |
:00432553 C745EC00C94800          mov [ebp-14], 0048C900

* Possible StringData Ref from Data Obj ->"    ޹˾    "
                                  |
:0043255A C745E414C94800          mov [ebp-1C], 0048C914
:00432561 E875C0FEFF              call 0041E5DB
:00432566 6A04                    push 00000004
:00432568 6A00                    push 00000000
:0043256A 6A00                    push 00000000
:0043256C B968AB4A00              mov ecx, 004AAB68
:00432571 E8CAD40400              call 0047FA40
:00432576 50                      push eax
:00432577 6890010000              push 00000190
:0043257C 6880020000              push 00000280
:00432581 6A28                    push 00000028
:00432583 6A00                    push 00000000
:00432585 E811BB0400              call 0047E09B
:0043258A 83C414                  add esp, 00000014
:0043258D C745F064000000          mov [ebp-10], 00000064
:00432594 8B45F0                  mov eax, dword ptr [ebp-10]
:00432597 0580010000              add eax, 00000180
:0043259C 8945F8                  mov dword ptr [ebp-08], eax
:0043259F C745F482000000          mov [ebp-0C], 00000082
:004325A6 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004325A9 83C140                  add ecx, 00000040
:004325AC 894DFC                  mov dword ptr [ebp-04], ecx
:004325AF 6A00                    push 00000000
:004325B1 6A12                    push 00000012
:004325B3 6A04                    push 00000004
:004325B5 E87FAC0400              call 0047D239
:004325BA 83C40C                  add esp, 0000000C
:004325BD 6A00                    push 00000000
:004325BF 6A01                    push 00000001
:004325C1 6A00                    push 00000000
:004325C3 8B55E8                  mov edx, dword ptr [ebp-18]
:004325C6 52                      push edx
:004325C7 6A20                    push 00000020
:004325C9 6A10                    push 00000010
:004325CB 8D45F0                  lea eax, dword ptr [ebp-10]
:004325CE 50                      push eax
:004325CF E8E0C3FEFF              call 0041E9B4
:004325D4 83C41C                  add esp, 0000001C
:004325D7 E81AC0FEFF              call 0041E5F6
:004325DC 6A14                    push 00000014
:004325DE B9181B4B00              mov ecx, 004B1B18
:004325E3 E8580DFDFF              call 00403340
:004325E8 E8F39EFFFF              call 0042C4E0
:004325ED E8E9BFFEFF              call 0041E5DB
:004325F2 C745F02E000000          mov [ebp-10], 0000002E
:004325F9 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004325FC 81C120010000            add ecx, 00000120
:00432602 894DF8                  mov dword ptr [ebp-08], ecx
:00432605 C745F4C3000000          mov [ebp-0C], 000000C3
:0043260C 8B55F4                  mov edx, dword ptr [ebp-0C]
:0043260F 83C240                  add edx, 00000040
:00432612 8955FC                  mov dword ptr [ebp-04], edx
:00432615 6A00                    push 00000000
:00432617 6A12                    push 00000012
:00432619 6A04                    push 00000004
:0043261B E819AC0400              call 0047D239
:00432620 83C40C                  add esp, 0000000C
:00432623 6A00                    push 00000000
:00432625 6A01                    push 00000001
:00432627 6A00                    push 00000000
:00432629 8B45EC                  mov eax, dword ptr [ebp-14]
:0043262C 50                      push eax
:0043262D 6A40                    push 00000040
:0043262F 6A20                    push 00000020
:00432631 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00432634 51                      push ecx
:00432635 E87AC3FEFF              call 0041E9B4
:0043263A 83C41C                  add esp, 0000001C
:0043263D E8B4BFFEFF              call 0041E5F6
:00432642 E894BFFEFF              call 0041E5DB
:00432647 C745F02E000000          mov [ebp-10], 0000002E
:0043264E 8B55F0                  mov edx, dword ptr [ebp-10]
:00432651 81C220010000            add edx, 00000120
:00432657 8955F8                  mov dword ptr [ebp-08], edx
:0043265A C745F404010000          mov [ebp-0C], 00000104
:00432661 8B45F4                  mov eax, dword ptr [ebp-0C]
:00432664 83C040                  add eax, 00000040
:00432667 8945FC                  mov dword ptr [ebp-04], eax
:0043266A 6A00                    push 00000000
:0043266C 6A12                    push 00000012
:0043266E 6A04                    push 00000004
:00432670 E8C4AB0400              call 0047D239
:00432675 83C40C                  add esp, 0000000C
:00432678 6A00                    push 00000000
:0043267A 6A01                    push 00000001
:0043267C 6A00                    push 00000000
:0043267E 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00432681 51                      push ecx
:00432682 6A40                    push 00000040
:00432684 6A20                    push 00000020
:00432686 8D55F0                  lea edx, dword ptr [ebp-10]
:00432689 52                      push edx
:0043268A E825C3FEFF              call 0041E9B4
:0043268F 83C41C                  add esp, 0000001C
:00432692 E85FBFFEFF              call 0041E5F6
:00432697 6A50                    push 00000050
:00432699 B9181B4B00              mov ecx, 004B1B18
:0043269E E89D0CFDFF              call 00403340
:004326A3 E8389EFFFF              call 0042C4E0
:004326A8 8BE5                    mov esp, ebp
:004326AA 5D                      pop ebp
:004326AB C3                      ret



* Referenced by a CALL at Address:
|:004312EC   
|
:004326AC 55                      push ebp
:004326AD 8BEC                    mov ebp, esp
:004326AF 83EC0C                  sub esp, 0000000C
:004326B2 53                      push ebx
:004326B3 C705282B4B0000000000    mov dword ptr [004B2B28], 00000000
:004326BD C745F800000000          mov [ebp-08], 00000000
:004326C4 EB09                    jmp 004326CF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004326E5(U)
|
:004326C6 8B45F8                  mov eax, dword ptr [ebp-08]
:004326C9 83C001                  add eax, 00000001
:004326CC 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004326C4(U)
|
:004326CF 837DF819                cmp dword ptr [ebp-08], 00000019
:004326D3 7312                    jnb 004326E7
:004326D5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004326D8 83C101                  add ecx, 00000001
:004326DB 8B55F8                  mov edx, dword ptr [ebp-08]
:004326DE 890C95302B4B00          mov dword ptr [4*edx+004B2B30], ecx
:004326E5 EBDF                    jmp 004326C6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004326D3(C)
|
:004326E7 C745F800000000          mov [ebp-08], 00000000
:004326EE EB09                    jmp 004326F9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043278C(U)
|
:004326F0 8B45F8                  mov eax, dword ptr [ebp-08]
:004326F3 83C001                  add eax, 00000001
:004326F6 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004326EE(U)
|
:004326F9 837DF819                cmp dword ptr [ebp-08], 00000019
:004326FD 0F838E000000            jnb 00432791
:00432703 C745F400000000          mov [ebp-0C], 00000000
:0043270A EB09                    jmp 00432715

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043278A(U)
|
:0043270C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043270F 83C101                  add ecx, 00000001
:00432712 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043270A(U)
|
:00432715 837DF418                cmp dword ptr [ebp-0C], 00000018
:00432719 7371                    jnb 0043278C
:0043271B 8B55F4                  mov edx, dword ptr [ebp-0C]
:0043271E 8B0C95302B4B00          mov ecx, dword ptr [4*edx+004B2B30]
:00432725 6BC948                  imul ecx, 00000048
:00432728 81C1681B4A00            add ecx, 004A1B68
:0043272E E86D000000              call 004327A0
:00432733 8AD8                    mov bl, al
:00432735 81E3FF000000            and ebx, 000000FF
:0043273B 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043273E 8B0C85342B4B00          mov ecx, dword ptr [4*eax+004B2B34]
:00432745 6BC948                  imul ecx, 00000048
:00432748 81C1681B4A00            add ecx, 004A1B68
:0043274E E84D000000              call 004327A0
:00432753 25FF000000              and eax, 000000FF
:00432758 3BD8                    cmp ebx, eax
:0043275A 7D2E                    jge 0043278A
:0043275C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043275F 8B148D302B4B00          mov edx, dword ptr [4*ecx+004B2B30]
:00432766 8955FC                  mov dword ptr [ebp-04], edx
:00432769 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043276C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043276F 8B148D342B4B00          mov edx, dword ptr [4*ecx+004B2B34]
:00432776 891485302B4B00          mov dword ptr [4*eax+004B2B30], edx
:0043277D 8B45F4                  mov eax, dword ptr [ebp-0C]
:00432780 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00432783 890C85342B4B00          mov dword ptr [4*eax+004B2B34], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043275A(C)
|
:0043278A EB80                    jmp 0043270C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432719(C)
|
:0043278C E95FFFFFFF              jmp 004326F0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004326FD(C)
|
:00432791 C705942B4B0000000000    mov dword ptr [004B2B94], 00000000
:0043279B 5B                      pop ebx
:0043279C 8BE5                    mov esp, ebp
:0043279E 5D                      pop ebp
:0043279F C3                      ret



* Referenced by a CALL at Addresses:
|:004320C4   , :0043272E   , :0043274E   , :0044282F   
|
:004327A0 55                      push ebp
:004327A1 8BEC                    mov ebp, esp
:004327A3 51                      push ecx
:004327A4 894DFC                  mov dword ptr [ebp-04], ecx
:004327A7 8B45FC                  mov eax, dword ptr [ebp-04]
:004327AA 8A4027                  mov al, byte ptr [eax+27]
:004327AD 8BE5                    mov esp, ebp
:004327AF 5D                      pop ebp
:004327B0 C3                      ret


:004327B1 CC                      int 03
:004327B2 CC                      int 03
:004327B3 CC                      int 03
:004327B4 CC                      int 03
:004327B5 CC                      int 03
:004327B6 CC                      int 03
:004327B7 CC                      int 03
:004327B8 CC                      int 03
:004327B9 CC                      int 03
:004327BA CC                      int 03
:004327BB CC                      int 03
:004327BC CC                      int 03
:004327BD CC                      int 03
:004327BE CC                      int 03
:004327BF CC                      int 03

* Referenced by a CALL at Addresses:
|:004320B6   , :0044185A   
|
:004327C0 55                      push ebp
:004327C1 8BEC                    mov ebp, esp
:004327C3 51                      push ecx
:004327C4 894DFC                  mov dword ptr [ebp-04], ecx
:004327C7 8B45FC                  mov eax, dword ptr [ebp-04]
:004327CA 8A4029                  mov al, byte ptr [eax+29]
:004327CD 8BE5                    mov esp, ebp
:004327CF 5D                      pop ebp
:004327D0 C3                      ret


:004327D1 CC                      int 03
:004327D2 CC                      int 03
:004327D3 CC                      int 03
:004327D4 CC                      int 03
:004327D5 CC                      int 03
:004327D6 CC                      int 03
:004327D7 CC                      int 03
:004327D8 CC                      int 03
:004327D9 CC                      int 03
:004327DA CC                      int 03
:004327DB CC                      int 03
:004327DC CC                      int 03
:004327DD CC                      int 03
:004327DE CC                      int 03
:004327DF CC                      int 03
:004327E0 55                      push ebp
:004327E1 8BEC                    mov ebp, esp
:004327E3 E802000000              call 004327EA
:004327E8 5D                      pop ebp
:004327E9 C3                      ret



* Referenced by a CALL at Address:
|:004327E3   
|
:004327EA 55                      push ebp
:004327EB 8BEC                    mov ebp, esp
:004327ED 5D                      pop ebp
:004327EE C3                      ret



* Referenced by a CALL at Address:
|:00417494   
|
:004327EF 55                      push ebp
:004327F0 8BEC                    mov ebp, esp
:004327F2 83EC0C                  sub esp, 0000000C
:004327F5 894DF8                  mov dword ptr [ebp-08], ecx
:004327F8 8B45F8                  mov eax, dword ptr [ebp-08]
:004327FB 83786800                cmp dword ptr [eax+68], 00000000
:004327FF 0F841B010000            je 00432920
:00432805 6A00                    push 00000000
:00432807 6A1F                    push 0000001F
:00432809 6A04                    push 00000004
:0043280B E8E1A90400              call 0047D1F1
:00432810 83C40C                  add esp, 0000000C
:00432813 6A04                    push 00000004
:00432815 6A00                    push 00000000
:00432817 6A00                    push 00000000
:00432819 B9C8E44A00              mov ecx, 004AE4C8
:0043281E E81DD20400              call 0047FA40
:00432823 50                      push eax
:00432824 6A50                    push 00000050
:00432826 6880020000              push 00000280
:0043282B 6868010000              push 00000168
:00432830 6A00                    push 00000000
:00432832 E81ABA0400              call 0047E251
:00432837 83C414                  add esp, 00000014
:0043283A C745FC00000000          mov [ebp-04], 00000000
:00432841 EB09                    jmp 0043284C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004328EA(U)
|
:00432843 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00432846 83C101                  add ecx, 00000001
:00432849 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432841(U)
|
:0043284C 837DFC05                cmp dword ptr [ebp-04], 00000005
:00432850 0F8399000000            jnb 004328EF
:00432856 6800C80000              push 0000C800
:0043285B 6A04                    push 00000004
:0043285D 6A00                    push 00000000
:0043285F 6800080200              push 00020800
:00432864 B9C8E44A00              mov ecx, 004AE4C8
:00432869 E8D2D10400              call 0047FA40
:0043286E 50                      push eax
:0043286F 6A04                    push 00000004
:00432871 6A00                    push 00000000
:00432873 6A00                    push 00000000
:00432875 B9C8E44A00              mov ecx, 004AE4C8
:0043287A E8C1D10400              call 0047FA40
:0043287F 50                      push eax
:00432880 E878D40400              call 0047FCFD
:00432885 83C40C                  add esp, 0000000C
:00432888 8A55FC                  mov dl, byte ptr [ebp-04]
:0043288B 52                      push edx
:0043288C 6A50                    push 00000050
:0043288E 6880020000              push 00000280
:00432893 6A04                    push 00000004
:00432895 6A00                    push 00000000
:00432897 6800080200              push 00020800
:0043289C B9C8E44A00              mov ecx, 004AE4C8
:004328A1 E89AD10400              call 0047FA40
:004328A6 50                      push eax
:004328A7 E8D4DBFFFF              call 00430480
:004328AC 83C410                  add esp, 00000010
:004328AF 6A04                    push 00000004
:004328B1 6A00                    push 00000000
:004328B3 6800080200              push 00020800
:004328B8 B9C8E44A00              mov ecx, 004AE4C8
:004328BD E87ED10400              call 0047FA40
:004328C2 50                      push eax
:004328C3 6A50                    push 00000050
:004328C5 6880020000              push 00000280
:004328CA 6868010000              push 00000168
:004328CF 6A00                    push 00000000
:004328D1 E8C5B70400              call 0047E09B
:004328D6 83C414                  add esp, 00000014
:004328D9 6A02                    push 00000002
:004328DB B9181B4B00              mov ecx, 004B1B18
:004328E0 E85B0AFDFF              call 00403340
:004328E5 E8F69BFFFF              call 0042C4E0
:004328EA E954FFFFFF              jmp 00432843

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432850(C)
|
:004328EF 6A04                    push 00000004
:004328F1 6A00                    push 00000000
:004328F3 6A00                    push 00000000
:004328F5 B9C8E44A00              mov ecx, 004AE4C8
:004328FA E841D10400              call 0047FA40
:004328FF 50                      push eax
:00432900 6A50                    push 00000050
:00432902 6880020000              push 00000280
:00432907 6868010000              push 00000168
:0043290C 6A00                    push 00000000
:0043290E E83EB90400              call 0047E251
:00432913 83C414                  add esp, 00000014
:00432916 8B45F8                  mov eax, dword ptr [ebp-08]
:00432919 C7406800000000          mov [eax+68], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004327FF(C)
|
:00432920 837D1000                cmp dword ptr [ebp+10], 00000000
:00432924 7419                    je 0043293F
:00432926 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00432929 C7416008000000          mov [ecx+60], 00000008
:00432930 8B55F8                  mov edx, dword ptr [ebp-08]
:00432933 8B4264                  mov eax, dword ptr [edx+64]
:00432936 83C018                  add eax, 00000018
:00432939 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043293C 894164                  mov dword ptr [ecx+64], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432924(C)
|
:0043293F 837D0C00                cmp dword ptr [ebp+0C], 00000000
:00432943 7412                    je 00432957
:00432945 837D1000                cmp dword ptr [ebp+10], 00000000
:00432949 7447                    je 00432992
:0043294B 8B55F8                  mov edx, dword ptr [ebp-08]
:0043294E 817A64B8010000          cmp dword ptr [edx+64], 000001B8
:00432955 723B                    jb 00432992

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432943(C)
|
:00432957 8B45F8                  mov eax, dword ptr [ebp-08]
:0043295A C7406008000000          mov [eax+60], 00000008
:00432961 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00432964 C7416470010000          mov [ecx+64], 00000170
:0043296B 6A04                    push 00000004
:0043296D 6A00                    push 00000000
:0043296F 6A00                    push 00000000
:00432971 B9C8E44A00              mov ecx, 004AE4C8
:00432976 E8C5D00400              call 0047FA40
:0043297B 50                      push eax
:0043297C 6A50                    push 00000050
:0043297E 6880020000              push 00000280
:00432983 6868010000              push 00000168
:00432988 6A00                    push 00000000
:0043298A E80CB70400              call 0047E09B
:0043298F 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00432949(C), :00432955(C)
|
:00432992 6A04                    push 00000004
:00432994 B9382F4900              mov ecx, 00492F38
:00432999 E898C3FDFF              call 0040ED36
:0043299E 6A00                    push 00000000
:004329A0 B9382F4900              mov ecx, 00492F38
:004329A5 E860C3FDFF              call 0040ED0A
:004329AA 6A12                    push 00000012
:004329AC B9382F4900              mov ecx, 00492F38
:004329B1 E8CEC2FDFF              call 0040EC84
:004329B6 6A00                    push 00000000
:004329B8 B9382F4900              mov ecx, 00492F38
:004329BD E8FAC2FDFF              call 0040ECBC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432A28(U)
|
:004329C2 8B5508                  mov edx, dword ptr [ebp+08]
:004329C5 33C0                    xor eax, eax
:004329C7 8A02                    mov al, byte ptr [edx]
:004329C9 85C0                    test eax, eax
:004329CB 745D                    je 00432A2A
:004329CD 6A01                    push 00000001
:004329CF 8B4D08                  mov ecx, dword ptr [ebp+08]
:004329D2 51                      push ecx
:004329D3 8B55F8                  mov edx, dword ptr [ebp-08]
:004329D6 8B4264                  mov eax, dword ptr [edx+64]
:004329D9 50                      push eax
:004329DA 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004329DD 8B5160                  mov edx, dword ptr [ecx+60]
:004329E0 52                      push edx
:004329E1 E8CA9EFFFF              call 0042C8B0
:004329E6 83C410                  add esp, 00000010
:004329E9 8945FC                  mov dword ptr [ebp-04], eax
:004329EC 8B4508                  mov eax, dword ptr [ebp+08]
:004329EF 0345FC                  add eax, dword ptr [ebp-04]
:004329F2 894508                  mov dword ptr [ebp+08], eax
:004329F5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004329F8 8B5160                  mov edx, dword ptr [ecx+60]
:004329FB 0355FC                  add edx, dword ptr [ebp-04]
:004329FE 8B45F8                  mov eax, dword ptr [ebp-08]
:00432A01 895060                  mov dword ptr [eax+60], edx
:00432A04 8B4D08                  mov ecx, dword ptr [ebp+08]
:00432A07 33D2                    xor edx, edx
:00432A09 8A11                    mov dl, byte ptr [ecx]
:00432A0B 85D2                    test edx, edx
:00432A0D 7419                    je 00432A28
:00432A0F 8B45F8                  mov eax, dword ptr [ebp-08]
:00432A12 C7406008000000          mov [eax+60], 00000008
:00432A19 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00432A1C 8B5164                  mov edx, dword ptr [ecx+64]
:00432A1F 83C218                  add edx, 00000018
:00432A22 8B45F8                  mov eax, dword ptr [ebp-08]
:00432A25 895064                  mov dword ptr [eax+64], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432A0D(C)
|
:00432A28 EB98                    jmp 004329C2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004329CB(C)
|
:00432A2A B9B07F4900              mov ecx, 00497FB0
:00432A2F E83236FFFF              call 00426066
:00432A34 837D1400                cmp dword ptr [ebp+14], 00000000
:00432A38 7457                    je 00432A91
:00432A3A B970074B00              mov ecx, 004B0770
:00432A3F E8CC7EFFFF              call 0042A910
:00432A44 2500080000              and eax, 00000800
:00432A49 85C0                    test eax, eax
:00432A4B 7407                    je 00432A54
:00432A4D E8E19CFFFF              call 0042C733
:00432A52 EB3D                    jmp 00432A91

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432A4B(C)
|
:00432A54 B970074B00              mov ecx, 004B0770
:00432A59 E8D298FEFF              call 0041C330
:00432A5E 8845F4                  mov byte ptr [ebp-0C], al
:00432A61 807DF400                cmp byte ptr [ebp-0C], 00
:00432A65 7408                    je 00432A6F
:00432A67 807DF401                cmp byte ptr [ebp-0C], 01
:00432A6B 740E                    je 00432A7B
:00432A6D EB18                    jmp 00432A87

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432A65(C)
|
:00432A6F 6A05                    push 00000005
:00432A71 E8D09BFFFF              call 0042C646
:00432A76 83C404                  add esp, 00000004
:00432A79 EB16                    jmp 00432A91

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432A6B(C)
|
:00432A7B 6A0A                    push 0000000A
:00432A7D E8C49BFFFF              call 0042C646
:00432A82 83C404                  add esp, 00000004
:00432A85 EB0A                    jmp 00432A91

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432A6D(U)
|
:00432A87 6A14                    push 00000014
:00432A89 E8B89BFFFF              call 0042C646
:00432A8E 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00432A38(C), :00432A52(U), :00432A79(U), :00432A85(U)
|
:00432A91 B9B07F4900              mov ecx, 00497FB0
:00432A96 E8CB35FFFF              call 00426066
:00432A9B 8BE5                    mov esp, ebp
:00432A9D 5D                      pop ebp
:00432A9E C21000                  ret 0010



* Referenced by a CALL at Addresses:
|:00432B12   , :00433080   , :004331CF   
|
:00432AA1 55                      push ebp
:00432AA2 8BEC                    mov ebp, esp
:00432AA4 83EC0C                  sub esp, 0000000C
:00432AA7 894DF4                  mov dword ptr [ebp-0C], ecx
:00432AAA C645F8FF                mov [ebp-08], FF
:00432AAE C645FC00                mov [ebp-04], 00
:00432AB2 EB08                    jmp 00432ABC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432AE9(U)
|
:00432AB4 8A45FC                  mov al, byte ptr [ebp-04]
:00432AB7 0401                    add al, 01
:00432AB9 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432AB2(U)
|
:00432ABC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00432ABF 81E1FF000000            and ecx, 000000FF
:00432AC5 83F908                  cmp ecx, 00000008
:00432AC8 7D21                    jge 00432AEB
:00432ACA 8B55FC                  mov edx, dword ptr [ebp-04]
:00432ACD 81E2FF000000            and edx, 000000FF
:00432AD3 6BD20C                  imul edx, 0000000C
:00432AD6 8B45F4                  mov eax, dword ptr [ebp-0C]
:00432AD9 8B0C10                  mov ecx, dword ptr [eax+edx]
:00432ADC 3B4D08                  cmp ecx, dword ptr [ebp+08]
:00432ADF 7508                    jne 00432AE9
:00432AE1 8A55FC                  mov dl, byte ptr [ebp-04]
:00432AE4 8855F8                  mov byte ptr [ebp-08], dl
:00432AE7 EB02                    jmp 00432AEB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432ADF(C)
|
:00432AE9 EBC9                    jmp 00432AB4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00432AC8(C), :00432AE7(U)
|
:00432AEB 8A45F8                  mov al, byte ptr [ebp-08]
:00432AEE 8BE5                    mov esp, ebp
:00432AF0 5D                      pop ebp
:00432AF1 C20400                  ret 0004



* Referenced by a CALL at Address:
|:004172AD   
|
:00432AF4 55                      push ebp
:00432AF5 8BEC                    mov ebp, esp
:00432AF7 83EC3C                  sub esp, 0000003C
:00432AFA 894DE8                  mov dword ptr [ebp-18], ecx
:00432AFD C745F800000000          mov [ebp-08], 00000000
:00432B04 C745FC00000000          mov [ebp-04], 00000000
:00432B0B 8B4508                  mov eax, dword ptr [ebp+08]
:00432B0E 50                      push eax
:00432B0F 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00432B12 E88AFFFFFF              call 00432AA1
:00432B17 8845EC                  mov byte ptr [ebp-14], al
:00432B1A 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00432B1D 81E1FF000000            and ecx, 000000FF
:00432B23 81F9FF000000            cmp ecx, 000000FF
:00432B29 7505                    jne 00432B30
:00432B2B E9EB020000              jmp 00432E1B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432B29(C)
|
:00432B30 8B55EC                  mov edx, dword ptr [ebp-14]
:00432B33 81E2FF000000            and edx, 000000FF
:00432B39 6BD20C                  imul edx, 0000000C
:00432B3C 8B45E8                  mov eax, dword ptr [ebp-18]
:00432B3F 03C2                    add eax, edx
:00432B41 8945F0                  mov dword ptr [ebp-10], eax
:00432B44 8B4D10                  mov ecx, dword ptr [ebp+10]
:00432B47 83C128                  add ecx, 00000028
:00432B4A 894D10                  mov dword ptr [ebp+10], ecx
:00432B4D 8B55F0                  mov edx, dword ptr [ebp-10]
:00432B50 8B4204                  mov eax, dword ptr [edx+04]
:00432B53 2B450C                  sub eax, dword ptr [ebp+0C]
:00432B56 99                      cdq
:00432B57 83E203                  and edx, 00000003
:00432B5A 03C2                    add eax, edx
:00432B5C C1F802                  sar eax, 02
:00432B5F 85C0                    test eax, eax
:00432B61 7C17                    jl 00432B7A
:00432B63 8B45F0                  mov eax, dword ptr [ebp-10]
:00432B66 8B4004                  mov eax, dword ptr [eax+04]
:00432B69 2B450C                  sub eax, dword ptr [ebp+0C]
:00432B6C 99                      cdq
:00432B6D 83E203                  and edx, 00000003
:00432B70 03C2                    add eax, edx
:00432B72 C1F802                  sar eax, 02
:00432B75 8945E4                  mov dword ptr [ebp-1C], eax
:00432B78 EB17                    jmp 00432B91

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432B61(C)
|
:00432B7A 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00432B7D 8B4104                  mov eax, dword ptr [ecx+04]
:00432B80 2B450C                  sub eax, dword ptr [ebp+0C]
:00432B83 99                      cdq
:00432B84 83E203                  and edx, 00000003
:00432B87 03C2                    add eax, edx
:00432B89 C1F802                  sar eax, 02
:00432B8C F7D8                    neg eax
:00432B8E 8945E4                  mov dword ptr [ebp-1C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432B78(U)
|
:00432B91 8B55F0                  mov edx, dword ptr [ebp-10]
:00432B94 8B4208                  mov eax, dword ptr [edx+08]
:00432B97 2B4510                  sub eax, dword ptr [ebp+10]
:00432B9A 99                      cdq
:00432B9B 83E203                  and edx, 00000003
:00432B9E 03C2                    add eax, edx
:00432BA0 C1F802                  sar eax, 02
:00432BA3 85C0                    test eax, eax
:00432BA5 7C17                    jl 00432BBE
:00432BA7 8B45F0                  mov eax, dword ptr [ebp-10]
:00432BAA 8B4008                  mov eax, dword ptr [eax+08]
:00432BAD 2B4510                  sub eax, dword ptr [ebp+10]
:00432BB0 99                      cdq
:00432BB1 83E203                  and edx, 00000003
:00432BB4 03C2                    add eax, edx
:00432BB6 C1F802                  sar eax, 02
:00432BB9 8945E0                  mov dword ptr [ebp-20], eax
:00432BBC EB17                    jmp 00432BD5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432BA5(C)
|
:00432BBE 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00432BC1 8B4108                  mov eax, dword ptr [ecx+08]
:00432BC4 2B4510                  sub eax, dword ptr [ebp+10]
:00432BC7 99                      cdq
:00432BC8 83E203                  and edx, 00000003
:00432BCB 03C2                    add eax, edx
:00432BCD C1F802                  sar eax, 02
:00432BD0 F7D8                    neg eax
:00432BD2 8945E0                  mov dword ptr [ebp-20], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432BBC(U)
|
:00432BD5 8B55E4                  mov edx, dword ptr [ebp-1C]
:00432BD8 3B55E0                  cmp edx, dword ptr [ebp-20]
:00432BDB 7E4C                    jle 00432C29
:00432BDD 8B45F0                  mov eax, dword ptr [ebp-10]
:00432BE0 8B4004                  mov eax, dword ptr [eax+04]
:00432BE3 2B450C                  sub eax, dword ptr [ebp+0C]
:00432BE6 99                      cdq
:00432BE7 83E203                  and edx, 00000003
:00432BEA 03C2                    add eax, edx
:00432BEC C1F802                  sar eax, 02
:00432BEF 85C0                    test eax, eax
:00432BF1 7C17                    jl 00432C0A
:00432BF3 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00432BF6 8B4104                  mov eax, dword ptr [ecx+04]
:00432BF9 2B450C                  sub eax, dword ptr [ebp+0C]
:00432BFC 99                      cdq
:00432BFD 83E203                  and edx, 00000003
:00432C00 03C2                    add eax, edx
:00432C02 C1F802                  sar eax, 02
:00432C05 8945DC                  mov dword ptr [ebp-24], eax
:00432C08 EB17                    jmp 00432C21

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432BF1(C)
|
:00432C0A 8B55F0                  mov edx, dword ptr [ebp-10]
:00432C0D 8B4204                  mov eax, dword ptr [edx+04]
:00432C10 2B450C                  sub eax, dword ptr [ebp+0C]
:00432C13 99                      cdq
:00432C14 83E203                  and edx, 00000003
:00432C17 03C2                    add eax, edx
:00432C19 C1F802                  sar eax, 02
:00432C1C F7D8                    neg eax
:00432C1E 8945DC                  mov dword ptr [ebp-24], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432C08(U)
|
:00432C21 8B45DC                  mov eax, dword ptr [ebp-24]
:00432C24 8945D8                  mov dword ptr [ebp-28], eax
:00432C27 EB4A                    jmp 00432C73

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432BDB(C)
|
:00432C29 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00432C2C 8B4108                  mov eax, dword ptr [ecx+08]
:00432C2F 2B4510                  sub eax, dword ptr [ebp+10]
:00432C32 99                      cdq
:00432C33 83E203                  and edx, 00000003
:00432C36 03C2                    add eax, edx
:00432C38 C1F802                  sar eax, 02
:00432C3B 85C0                    test eax, eax
:00432C3D 7C17                    jl 00432C56
:00432C3F 8B55F0                  mov edx, dword ptr [ebp-10]
:00432C42 8B4208                  mov eax, dword ptr [edx+08]
:00432C45 2B4510                  sub eax, dword ptr [ebp+10]
:00432C48 99                      cdq
:00432C49 83E203                  and edx, 00000003
:00432C4C 03C2                    add eax, edx
:00432C4E C1F802                  sar eax, 02
:00432C51 8945D4                  mov dword ptr [ebp-2C], eax
:00432C54 EB17                    jmp 00432C6D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432C3D(C)
|
:00432C56 8B45F0                  mov eax, dword ptr [ebp-10]
:00432C59 8B4008                  mov eax, dword ptr [eax+08]
:00432C5C 2B4510                  sub eax, dword ptr [ebp+10]
:00432C5F 99                      cdq
:00432C60 83E203                  and edx, 00000003
:00432C63 03C2                    add eax, edx
:00432C65 C1F802                  sar eax, 02
:00432C68 F7D8                    neg eax
:00432C6A 8945D4                  mov dword ptr [ebp-2C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432C54(U)
|
:00432C6D 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00432C70 894DD8                  mov dword ptr [ebp-28], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432C27(U)
|
:00432C73 8B55D8                  mov edx, dword ptr [ebp-28]
:00432C76 8955F4                  mov dword ptr [ebp-0C], edx
:00432C79 837DF400                cmp dword ptr [ebp-0C], 00000000
:00432C7D 7422                    je 00432CA1
:00432C7F 8B45F0                  mov eax, dword ptr [ebp-10]
:00432C82 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00432C85 2B4804                  sub ecx, dword ptr [eax+04]
:00432C88 8BC1                    mov eax, ecx
:00432C8A 99                      cdq
:00432C8B F77DF4                  idiv [ebp-0C]
:00432C8E 8945F8                  mov dword ptr [ebp-08], eax
:00432C91 8B55F0                  mov edx, dword ptr [ebp-10]
:00432C94 8B4510                  mov eax, dword ptr [ebp+10]
:00432C97 2B4208                  sub eax, dword ptr [edx+08]
:00432C9A 99                      cdq
:00432C9B F77DF4                  idiv [ebp-0C]
:00432C9E 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432C7D(C)
|
:00432CA1 837DF800                cmp dword ptr [ebp-08], 00000000
:00432CA5 751A                    jne 00432CC1
:00432CA7 8B45F0                  mov eax, dword ptr [ebp-10]
:00432CAA 8B4804                  mov ecx, dword ptr [eax+04]
:00432CAD 2B4D0C                  sub ecx, dword ptr [ebp+0C]
:00432CB0 33D2                    xor edx, edx
:00432CB2 85C9                    test ecx, ecx
:00432CB4 0F9DC2                  setnl dl
:00432CB7 4A                      dec edx
:00432CB8 83E202                  and edx, 00000002
:00432CBB 83C2FF                  add edx, FFFFFFFF
:00432CBE 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432CA5(C)
|
:00432CC1 837DFC00                cmp dword ptr [ebp-04], 00000000
:00432CC5 751A                    jne 00432CE1
:00432CC7 8B45F0                  mov eax, dword ptr [ebp-10]
:00432CCA 8B4808                  mov ecx, dword ptr [eax+08]
:00432CCD 2B4D10                  sub ecx, dword ptr [ebp+10]
:00432CD0 33D2                    xor edx, edx
:00432CD2 85C9                    test ecx, ecx
:00432CD4 0F9DC2                  setnl dl
:00432CD7 4A                      dec edx
:00432CD8 83E202                  and edx, 00000002
:00432CDB 83C2FF                  add edx, FFFFFFFF
:00432CDE 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00432CC5(C), :00432E16(U)
|
:00432CE1 8B45F0                  mov eax, dword ptr [ebp-10]
:00432CE4 8B4804                  mov ecx, dword ptr [eax+04]
:00432CE7 2B4D0C                  sub ecx, dword ptr [ebp+0C]
:00432CEA 85C9                    test ecx, ecx
:00432CEC 7C0E                    jl 00432CFC
:00432CEE 8B55F0                  mov edx, dword ptr [ebp-10]
:00432CF1 8B4204                  mov eax, dword ptr [edx+04]
:00432CF4 2B450C                  sub eax, dword ptr [ebp+0C]
:00432CF7 8945D0                  mov dword ptr [ebp-30], eax
:00432CFA EB0E                    jmp 00432D0A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432CEC(C)
|
:00432CFC 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00432CFF 8B5104                  mov edx, dword ptr [ecx+04]
:00432D02 2B550C                  sub edx, dword ptr [ebp+0C]
:00432D05 F7DA                    neg edx
:00432D07 8955D0                  mov dword ptr [ebp-30], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432CFA(U)
|
:00432D0A 837DF800                cmp dword ptr [ebp-08], 00000000
:00432D0E 7C08                    jl 00432D18
:00432D10 8B45F8                  mov eax, dword ptr [ebp-08]
:00432D13 8945CC                  mov dword ptr [ebp-34], eax
:00432D16 EB08                    jmp 00432D20

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432D0E(C)
|
:00432D18 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00432D1B F7D9                    neg ecx
:00432D1D 894DCC                  mov dword ptr [ebp-34], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432D16(U)
|
:00432D20 8B55D0                  mov edx, dword ptr [ebp-30]
:00432D23 3B55CC                  cmp edx, dword ptr [ebp-34]
:00432D26 7D0C                    jge 00432D34
:00432D28 8B45F0                  mov eax, dword ptr [ebp-10]
:00432D2B 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00432D2E 2B4804                  sub ecx, dword ptr [eax+04]
:00432D31 894DF8                  mov dword ptr [ebp-08], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432D26(C)
|
:00432D34 8B55F0                  mov edx, dword ptr [ebp-10]
:00432D37 8B4208                  mov eax, dword ptr [edx+08]
:00432D3A 2B4510                  sub eax, dword ptr [ebp+10]
:00432D3D 85C0                    test eax, eax
:00432D3F 7C0E                    jl 00432D4F
:00432D41 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00432D44 8B5108                  mov edx, dword ptr [ecx+08]
:00432D47 2B5510                  sub edx, dword ptr [ebp+10]
:00432D4A 8955C8                  mov dword ptr [ebp-38], edx
:00432D4D EB0E                    jmp 00432D5D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432D3F(C)
|
:00432D4F 8B45F0                  mov eax, dword ptr [ebp-10]
:00432D52 8B4808                  mov ecx, dword ptr [eax+08]
:00432D55 2B4D10                  sub ecx, dword ptr [ebp+10]
:00432D58 F7D9                    neg ecx
:00432D5A 894DC8                  mov dword ptr [ebp-38], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432D4D(U)
|
:00432D5D 837DFC00                cmp dword ptr [ebp-04], 00000000
:00432D61 7C08                    jl 00432D6B
:00432D63 8B55FC                  mov edx, dword ptr [ebp-04]
:00432D66 8955C4                  mov dword ptr [ebp-3C], edx
:00432D69 EB08                    jmp 00432D73

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432D61(C)
|
:00432D6B 8B45FC                  mov eax, dword ptr [ebp-04]
:00432D6E F7D8                    neg eax
:00432D70 8945C4                  mov dword ptr [ebp-3C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432D69(U)
|
:00432D73 8B4DC8                  mov ecx, dword ptr [ebp-38]
:00432D76 3B4DC4                  cmp ecx, dword ptr [ebp-3C]
:00432D79 7D0C                    jge 00432D87
:00432D7B 8B55F0                  mov edx, dword ptr [ebp-10]
:00432D7E 8B4510                  mov eax, dword ptr [ebp+10]
:00432D81 2B4208                  sub eax, dword ptr [edx+08]
:00432D84 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432D79(C)
|
:00432D87 E84FB8FEFF              call 0041E5DB
:00432D8C 8A4DEC                  mov cl, byte ptr [ebp-14]
:00432D8F 51                      push ecx
:00432D90 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00432D93 E889000000              call 00432E21
:00432D98 8B55F0                  mov edx, dword ptr [ebp-10]
:00432D9B 8B4204                  mov eax, dword ptr [edx+04]
:00432D9E 3B450C                  cmp eax, dword ptr [ebp+0C]
:00432DA1 740F                    je 00432DB2
:00432DA3 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00432DA6 8B5104                  mov edx, dword ptr [ecx+04]
:00432DA9 0355F8                  add edx, dword ptr [ebp-08]
:00432DAC 8B45F0                  mov eax, dword ptr [ebp-10]
:00432DAF 895004                  mov dword ptr [eax+04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432DA1(C)
|
:00432DB2 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00432DB5 8B5108                  mov edx, dword ptr [ecx+08]
:00432DB8 3B5510                  cmp edx, dword ptr [ebp+10]
:00432DBB 740F                    je 00432DCC
:00432DBD 8B45F0                  mov eax, dword ptr [ebp-10]
:00432DC0 8B4808                  mov ecx, dword ptr [eax+08]
:00432DC3 034DFC                  add ecx, dword ptr [ebp-04]
:00432DC6 8B55F0                  mov edx, dword ptr [ebp-10]
:00432DC9 894A08                  mov dword ptr [edx+08], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432DBB(C)
|
:00432DCC 8A45EC                  mov al, byte ptr [ebp-14]
:00432DCF 50                      push eax
:00432DD0 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00432DD3 E8A5000000              call 00432E7D
:00432DD8 6A01                    push 00000001
:00432DDA 6A00                    push 00000000
:00432DDC 8A4DEC                  mov cl, byte ptr [ebp-14]
:00432DDF 51                      push ecx
:00432DE0 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00432DE3 E8F1000000              call 00432ED9
:00432DE8 E809B8FEFF              call 0041E5F6
:00432DED 8B55F0                  mov edx, dword ptr [ebp-10]
:00432DF0 8B4204                  mov eax, dword ptr [edx+04]
:00432DF3 3B450C                  cmp eax, dword ptr [ebp+0C]
:00432DF6 750D                    jne 00432E05
:00432DF8 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00432DFB 8B5108                  mov edx, dword ptr [ecx+08]
:00432DFE 3B5510                  cmp edx, dword ptr [ebp+10]
:00432E01 7502                    jne 00432E05
:00432E03 EB16                    jmp 00432E1B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00432DF6(C), :00432E01(C)
|
:00432E05 6A01                    push 00000001
:00432E07 B9181B4B00              mov ecx, 004B1B18
:00432E0C E82F05FDFF              call 00403340
:00432E11 E8CA96FFFF              call 0042C4E0
:00432E16 E9C6FEFFFF              jmp 00432CE1

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00432B2B(U), :00432E03(U)
|
:00432E1B 8BE5                    mov esp, ebp
:00432E1D 5D                      pop ebp
:00432E1E C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:00432D93   , :00433191   
|
:00432E21 55                      push ebp
:00432E22 8BEC                    mov ebp, esp
:00432E24 83EC08                  sub esp, 00000008
:00432E27 894DF8                  mov dword ptr [ebp-08], ecx
:00432E2A 8B4508                  mov eax, dword ptr [ebp+08]
:00432E2D 25FF000000              and eax, 000000FF
:00432E32 6BC00C                  imul eax, 0000000C
:00432E35 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00432E38 03C8                    add ecx, eax
:00432E3A 894DFC                  mov dword ptr [ebp-04], ecx
:00432E3D 6A04                    push 00000004
:00432E3F 6A00                    push 00000000
:00432E41 8B5508                  mov edx, dword ptr [ebp+08]
:00432E44 81E2FF000000            and edx, 000000FF
:00432E4A 8B049550C94800          mov eax, dword ptr [4*edx+0048C950]
:00432E51 50                      push eax
:00432E52 B9C8E44A00              mov ecx, 004AE4C8
:00432E57 E8E4CB0400              call 0047FA40
:00432E5C 50                      push eax
:00432E5D 6A50                    push 00000050
:00432E5F 6A40                    push 00000040
:00432E61 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00432E64 8B5108                  mov edx, dword ptr [ecx+08]
:00432E67 52                      push edx
:00432E68 8B45FC                  mov eax, dword ptr [ebp-04]
:00432E6B 8B4804                  mov ecx, dword ptr [eax+04]
:00432E6E 51                      push ecx
:00432E6F E827B20400              call 0047E09B
:00432E74 83C414                  add esp, 00000014
:00432E77 8BE5                    mov esp, ebp
:00432E79 5D                      pop ebp
:00432E7A C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00432DD3   , :00432F06   
|
:00432E7D 55                      push ebp
:00432E7E 8BEC                    mov ebp, esp
:00432E80 83EC08                  sub esp, 00000008
:00432E83 894DF8                  mov dword ptr [ebp-08], ecx
:00432E86 8B4508                  mov eax, dword ptr [ebp+08]
:00432E89 25FF000000              and eax, 000000FF
:00432E8E 6BC00C                  imul eax, 0000000C
:00432E91 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00432E94 03C8                    add ecx, eax
:00432E96 894DFC                  mov dword ptr [ebp-04], ecx
:00432E99 6A04                    push 00000004
:00432E9B 6A00                    push 00000000
:00432E9D 8B5508                  mov edx, dword ptr [ebp+08]
:00432EA0 81E2FF000000            and edx, 000000FF
:00432EA6 8B049550C94800          mov eax, dword ptr [4*edx+0048C950]
:00432EAD 50                      push eax
:00432EAE B9C8E44A00              mov ecx, 004AE4C8
:00432EB3 E888CB0400              call 0047FA40
:00432EB8 50                      push eax
:00432EB9 6A50                    push 00000050
:00432EBB 6A40                    push 00000040
:00432EBD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00432EC0 8B5108                  mov edx, dword ptr [ecx+08]
:00432EC3 52                      push edx
:00432EC4 8B45FC                  mov eax, dword ptr [ebp-04]
:00432EC7 8B4804                  mov ecx, dword ptr [eax+04]
:00432ECA 51                      push ecx
:00432ECB E881B30400              call 0047E251
:00432ED0 83C414                  add esp, 00000014
:00432ED3 8BE5                    mov esp, ebp
:00432ED5 5D                      pop ebp
:00432ED6 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00432DE3   , :0043325D   , :0043326F   
|
:00432ED9 55                      push ebp
:00432EDA 8BEC                    mov ebp, esp
:00432EDC 83EC0C                  sub esp, 0000000C
:00432EDF 894DF4                  mov dword ptr [ebp-0C], ecx
:00432EE2 8B4508                  mov eax, dword ptr [ebp+08]
:00432EE5 25FF000000              and eax, 000000FF
:00432EEA 6BC00C                  imul eax, 0000000C
:00432EED 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00432EF0 03C8                    add ecx, eax
:00432EF2 894DFC                  mov dword ptr [ebp-04], ecx
:00432EF5 837D0C00                cmp dword ptr [ebp+0C], 00000000
:00432EF9 0F8427010000            je 00433026
:00432EFF 8A5508                  mov dl, byte ptr [ebp+08]
:00432F02 52                      push edx
:00432F03 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00432F06 E872FFFFFF              call 00432E7D
:00432F0B 6A04                    push 00000004
:00432F0D 6A00                    push 00000000
:00432F0F 8B4508                  mov eax, dword ptr [ebp+08]
:00432F12 25FF000000              and eax, 000000FF
:00432F17 8B0C8530C94800          mov ecx, dword ptr [4*eax+0048C930]
:00432F1E 51                      push ecx
:00432F1F B9C8E44A00              mov ecx, 004AE4C8
:00432F24 E817CB0400              call 0047FA40
:00432F29 50                      push eax
:00432F2A 8B55FC                  mov edx, dword ptr [ebp-04]
:00432F2D 8B0A                    mov ecx, dword ptr [edx]
:00432F2F 6BC948                  imul ecx, 00000048
:00432F32 81C1681B4A00            add ecx, 004A1B68
:00432F38 E86A46FDFF              call 004075A7
:00432F3D 50                      push eax
:00432F3E B938C54A00              mov ecx, 004AC538
:00432F43 E841CDFEFF              call 0041FC89
:00432F48 837D1000                cmp dword ptr [ebp+10], 00000000
:00432F4C 0F84D4000000            je 00433026
:00432F52 C745F80F000000          mov [ebp-08], 0000000F
:00432F59 EB09                    jmp 00432F64

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433021(U)
|
:00432F5B 8B45F8                  mov eax, dword ptr [ebp-08]
:00432F5E 83E801                  sub eax, 00000001
:00432F61 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00432F59(U)
|
:00432F64 837DF800                cmp dword ptr [ebp-08], 00000000
:00432F68 0F86B8000000            jbe 00433026
:00432F6E E868B6FEFF              call 0041E5DB
:00432F73 6A00                    push 00000000
:00432F75 6A00                    push 00000000
:00432F77 6A01                    push 00000001
:00432F79 8A4DF8                  mov cl, byte ptr [ebp-08]
:00432F7C 51                      push ecx
:00432F7D 6A04                    push 00000004
:00432F7F 6A00                    push 00000000
:00432F81 6800080200              push 00020800
:00432F86 B9C8E44A00              mov ecx, 004AE4C8
:00432F8B E8B0CA0400              call 0047FA40
:00432F90 50                      push eax
:00432F91 6A04                    push 00000004
:00432F93 6A00                    push 00000000
:00432F95 8B5508                  mov edx, dword ptr [ebp+08]
:00432F98 81E2FF000000            and edx, 000000FF
:00432F9E 8B049550C94800          mov eax, dword ptr [4*edx+0048C950]
:00432FA5 50                      push eax
:00432FA6 B9C8E44A00              mov ecx, 004AE4C8
:00432FAB E890CA0400              call 0047FA40
:00432FB0 50                      push eax
:00432FB1 6A04                    push 00000004
:00432FB3 6A00                    push 00000000
:00432FB5 8B4D08                  mov ecx, dword ptr [ebp+08]
:00432FB8 81E1FF000000            and ecx, 000000FF
:00432FBE 8B148D30C94800          mov edx, dword ptr [4*ecx+0048C930]
:00432FC5 52                      push edx
:00432FC6 B9C8E44A00              mov ecx, 004AE4C8
:00432FCB E870CA0400              call 0047FA40
:00432FD0 50                      push eax
:00432FD1 6A50                    push 00000050
:00432FD3 6A40                    push 00000040
:00432FD5 E880CDFFFF              call 0042FD5A
:00432FDA 83C424                  add esp, 00000024
:00432FDD 6A04                    push 00000004
:00432FDF 6A00                    push 00000000
:00432FE1 6800080200              push 00020800
:00432FE6 B9C8E44A00              mov ecx, 004AE4C8
:00432FEB E850CA0400              call 0047FA40
:00432FF0 50                      push eax
:00432FF1 6A50                    push 00000050
:00432FF3 6A40                    push 00000040
:00432FF5 8B45FC                  mov eax, dword ptr [ebp-04]
:00432FF8 8B4808                  mov ecx, dword ptr [eax+08]
:00432FFB 51                      push ecx
:00432FFC 8B55FC                  mov edx, dword ptr [ebp-04]
:00432FFF 8B4204                  mov eax, dword ptr [edx+04]
:00433002 50                      push eax
:00433003 E893B00400              call 0047E09B
:00433008 83C414                  add esp, 00000014
:0043300B E8E6B5FEFF              call 0041E5F6
:00433010 6A01                    push 00000001
:00433012 B9181B4B00              mov ecx, 004B1B18
:00433017 E82403FDFF              call 00403340
:0043301C E8BF94FFFF              call 0042C4E0
:00433021 E935FFFFFF              jmp 00432F5B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00432EF9(C), :00432F4C(C), :00432F68(C)
|
:00433026 E8B0B5FEFF              call 0041E5DB
:0043302B 6A04                    push 00000004
:0043302D 6A00                    push 00000000
:0043302F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00433032 81E1FF000000            and ecx, 000000FF
:00433038 8B148D30C94800          mov edx, dword ptr [4*ecx+0048C930]
:0043303F 52                      push edx
:00433040 B9C8E44A00              mov ecx, 004AE4C8
:00433045 E8F6C90400              call 0047FA40
:0043304A 50                      push eax
:0043304B 6A50                    push 00000050
:0043304D 6A40                    push 00000040
:0043304F 8B45FC                  mov eax, dword ptr [ebp-04]
:00433052 8B4808                  mov ecx, dword ptr [eax+08]
:00433055 51                      push ecx
:00433056 8B55FC                  mov edx, dword ptr [ebp-04]
:00433059 8B4204                  mov eax, dword ptr [edx+04]
:0043305C 50                      push eax
:0043305D E839B00400              call 0047E09B
:00433062 83C414                  add esp, 00000014
:00433065 E88CB5FEFF              call 0041E5F6
:0043306A 8BE5                    mov esp, ebp
:0043306C 5D                      pop ebp
:0043306D C20C00                  ret 000C



* Referenced by a CALL at Address:
|:00417307   
|
:00433070 55                      push ebp
:00433071 8BEC                    mov ebp, esp
:00433073 83EC10                  sub esp, 00000010
:00433076 894DF0                  mov dword ptr [ebp-10], ecx
:00433079 8B4508                  mov eax, dword ptr [ebp+08]
:0043307C 50                      push eax
:0043307D 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00433080 E81CFAFFFF              call 00432AA1
:00433085 8845F4                  mov byte ptr [ebp-0C], al
:00433088 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043308B 81E1FF000000            and ecx, 000000FF
:00433091 81F9FF000000            cmp ecx, 000000FF
:00433097 7505                    jne 0043309E
:00433099 E91A010000              jmp 004331B8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433097(C)
|
:0043309E 8B55F4                  mov edx, dword ptr [ebp-0C]
:004330A1 81E2FF000000            and edx, 000000FF
:004330A7 6BD20C                  imul edx, 0000000C
:004330AA 8B45F0                  mov eax, dword ptr [ebp-10]
:004330AD 03C2                    add eax, edx
:004330AF 8945FC                  mov dword ptr [ebp-04], eax
:004330B2 C745F800000000          mov [ebp-08], 00000000
:004330B9 EB09                    jmp 004330C4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433180(U)
|
:004330BB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004330BE 83C101                  add ecx, 00000001
:004330C1 894DF8                  mov dword ptr [ebp-08], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004330B9(U)
|
:004330C4 837DF810                cmp dword ptr [ebp-08], 00000010
:004330C8 0F83B7000000            jnb 00433185
:004330CE E808B5FEFF              call 0041E5DB
:004330D3 6A00                    push 00000000
:004330D5 6A00                    push 00000000
:004330D7 6A01                    push 00000001
:004330D9 8A55F8                  mov dl, byte ptr [ebp-08]
:004330DC 52                      push edx
:004330DD 6A04                    push 00000004
:004330DF 6A00                    push 00000000
:004330E1 6800080200              push 00020800
:004330E6 B9C8E44A00              mov ecx, 004AE4C8
:004330EB E850C90400              call 0047FA40
:004330F0 50                      push eax
:004330F1 6A04                    push 00000004
:004330F3 6A00                    push 00000000
:004330F5 8B45F4                  mov eax, dword ptr [ebp-0C]
:004330F8 25FF000000              and eax, 000000FF
:004330FD 8B0C8550C94800          mov ecx, dword ptr [4*eax+0048C950]
:00433104 51                      push ecx
:00433105 B9C8E44A00              mov ecx, 004AE4C8
:0043310A E831C90400              call 0047FA40
:0043310F 50                      push eax
:00433110 6A04                    push 00000004
:00433112 6A00                    push 00000000
:00433114 8B55F4                  mov edx, dword ptr [ebp-0C]
:00433117 81E2FF000000            and edx, 000000FF
:0043311D 8B049530C94800          mov eax, dword ptr [4*edx+0048C930]
:00433124 50                      push eax
:00433125 B9C8E44A00              mov ecx, 004AE4C8
:0043312A E811C90400              call 0047FA40
:0043312F 50                      push eax
:00433130 6A50                    push 00000050
:00433132 6A40                    push 00000040
:00433134 E821CCFFFF              call 0042FD5A
:00433139 83C424                  add esp, 00000024
:0043313C 6A04                    push 00000004
:0043313E 6A00                    push 00000000
:00433140 6800080200              push 00020800
:00433145 B9C8E44A00              mov ecx, 004AE4C8
:0043314A E8F1C80400              call 0047FA40
:0043314F 50                      push eax
:00433150 6A50                    push 00000050
:00433152 6A40                    push 00000040
:00433154 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00433157 8B5108                  mov edx, dword ptr [ecx+08]
:0043315A 52                      push edx
:0043315B 8B45FC                  mov eax, dword ptr [ebp-04]
:0043315E 8B4804                  mov ecx, dword ptr [eax+04]
:00433161 51                      push ecx
:00433162 E834AF0400              call 0047E09B
:00433167 83C414                  add esp, 00000014
:0043316A E887B4FEFF              call 0041E5F6
:0043316F 6A01                    push 00000001
:00433171 B9181B4B00              mov ecx, 004B1B18
:00433176 E8C501FDFF              call 00403340
:0043317B E86093FFFF              call 0042C4E0
:00433180 E936FFFFFF              jmp 004330BB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004330C8(C)
|
:00433185 E851B4FEFF              call 0041E5DB
:0043318A 8A55F4                  mov dl, byte ptr [ebp-0C]
:0043318D 52                      push edx
:0043318E 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00433191 E88BFCFFFF              call 00432E21
:00433196 E85BB4FEFF              call 0041E5F6
:0043319B 8B45FC                  mov eax, dword ptr [ebp-04]
:0043319E C700FFFF0000            mov dword ptr [eax], 0000FFFF
:004331A4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004331A7 C7410400000000          mov [ecx+04], 00000000
:004331AE 8B55FC                  mov edx, dword ptr [ebp-04]
:004331B1 C7420800000000          mov [edx+08], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433099(U)
|
:004331B8 8BE5                    mov esp, ebp
:004331BA 5D                      pop ebp
:004331BB C20400                  ret 0004



* Referenced by a CALL at Address:
|:004171F1   
|
:004331BE 55                      push ebp
:004331BF 8BEC                    mov ebp, esp
:004331C1 83EC10                  sub esp, 00000010
:004331C4 894DF0                  mov dword ptr [ebp-10], ecx
:004331C7 68FFFF0000              push 0000FFFF
:004331CC 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004331CF E8CDF8FFFF              call 00432AA1
:004331D4 8845F4                  mov byte ptr [ebp-0C], al
:004331D7 8B45F4                  mov eax, dword ptr [ebp-0C]
:004331DA 25FF000000              and eax, 000000FF
:004331DF 3DFF000000              cmp eax, 000000FF
:004331E4 7505                    jne 004331EB
:004331E6 E989000000              jmp 00433274

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004331E4(C)
|
:004331EB 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004331EE 81E1FF000000            and ecx, 000000FF
:004331F4 6BC90C                  imul ecx, 0000000C
:004331F7 8B55F0                  mov edx, dword ptr [ebp-10]
:004331FA 03D1                    add edx, ecx
:004331FC 8955FC                  mov dword ptr [ebp-04], edx
:004331FF 8B45FC                  mov eax, dword ptr [ebp-04]
:00433202 8B4D08                  mov ecx, dword ptr [ebp+08]
:00433205 8908                    mov dword ptr [eax], ecx
:00433207 8B55FC                  mov edx, dword ptr [ebp-04]
:0043320A 8B450C                  mov eax, dword ptr [ebp+0C]
:0043320D 894204                  mov dword ptr [edx+04], eax
:00433210 8B4D10                  mov ecx, dword ptr [ebp+10]
:00433213 83C128                  add ecx, 00000028
:00433216 8B55FC                  mov edx, dword ptr [ebp-04]
:00433219 894A08                  mov dword ptr [edx+08], ecx
:0043321C 8D45F8                  lea eax, dword ptr [ebp-08]
:0043321F 50                      push eax
:00433220 6A01                    push 00000001
:00433222 6A3A                    push 0000003A
:00433224 E8C8B70400              call 0047E9F1
:00433229 83C40C                  add esp, 0000000C
:0043322C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043322F 81E1FF000000            and ecx, 000000FF
:00433235 85C9                    test ecx, ecx
:00433237 752B                    jne 00433264
:00433239 8B55F9                  mov edx, dword ptr [ebp-07]
:0043323C 81E2FF000000            and edx, 000000FF
:00433242 85D2                    test edx, edx
:00433244 751E                    jne 00433264
:00433246 8B45FA                  mov eax, dword ptr [ebp-06]
:00433249 25FF000000              and eax, 000000FF
:0043324E 85C0                    test eax, eax
:00433250 7512                    jne 00433264
:00433252 6A00                    push 00000000
:00433254 6A01                    push 00000001
:00433256 8A4DF4                  mov cl, byte ptr [ebp-0C]
:00433259 51                      push ecx
:0043325A 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043325D E877FCFFFF              call 00432ED9
:00433262 EB10                    jmp 00433274

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00433237(C), :00433244(C), :00433250(C)
|
:00433264 6A01                    push 00000001
:00433266 6A01                    push 00000001
:00433268 8A55F4                  mov dl, byte ptr [ebp-0C]
:0043326B 52                      push edx
:0043326C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043326F E865FCFFFF              call 00432ED9

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004331E6(U), :00433262(U)
|
:00433274 8BE5                    mov esp, ebp
:00433276 5D                      pop ebp
:00433277 C20C00                  ret 000C



* Referenced by a CALL at Address:
|:0043331A   
|
:0043327A 55                      push ebp
:0043327B 8BEC                    mov ebp, esp
:0043327D 83EC08                  sub esp, 00000008
:00433280 894DF8                  mov dword ptr [ebp-08], ecx
:00433283 C7059CBF4A0000000000    mov dword ptr [004ABF9C], 00000000
:0043328D C645FC00                mov [ebp-04], 00
:00433291 EB08                    jmp 0043329B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004332EC(U)
|
:00433293 8A45FC                  mov al, byte ptr [ebp-04]
:00433296 0401                    add al, 01
:00433298 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433291(U)
|
:0043329B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043329E 81E1FF000000            and ecx, 000000FF
:004332A4 83F908                  cmp ecx, 00000008
:004332A7 7D45                    jge 004332EE
:004332A9 8B55FC                  mov edx, dword ptr [ebp-04]
:004332AC 81E2FF000000            and edx, 000000FF
:004332B2 6BD20C                  imul edx, 0000000C
:004332B5 8B45F8                  mov eax, dword ptr [ebp-08]
:004332B8 C70410FFFF0000          mov dword ptr [eax+edx], 0000FFFF
:004332BF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004332C2 81E1FF000000            and ecx, 000000FF
:004332C8 6BC90C                  imul ecx, 0000000C
:004332CB 8B55F8                  mov edx, dword ptr [ebp-08]
:004332CE C7440A0400000000        mov [edx+ecx+04], 00000000
:004332D6 8B45FC                  mov eax, dword ptr [ebp-04]
:004332D9 25FF000000              and eax, 000000FF
:004332DE 6BC00C                  imul eax, 0000000C
:004332E1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004332E4 C744010800000000        mov [ecx+eax+08], 00000000
:004332EC EBA5                    jmp 00433293

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004332A7(C)
|
:004332EE 8B55F8                  mov edx, dword ptr [ebp-08]
:004332F1 C7426008000000          mov [edx+60], 00000008
:004332F8 8B45F8                  mov eax, dword ptr [ebp-08]
:004332FB C7406470010000          mov [eax+64], 00000170
:00433302 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00433305 C7416801000000          mov [ecx+68], 00000001
:0043330C 8BE5                    mov esp, ebp
:0043330E 5D                      pop ebp
:0043330F C3                      ret



* Referenced by a CALL at Address:
|:0042C2E3   
|
:00433310 55                      push ebp
:00433311 8BEC                    mov ebp, esp
:00433313 51                      push ecx
:00433314 894DFC                  mov dword ptr [ebp-04], ecx
:00433317 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043331A E85BFFFFFF              call 0043327A
:0043331F E81389FDFF              call 0040BC37
:00433324 E87F88FDFF              call 0040BBA8
:00433329 A19CBF4A00              mov eax, dword ptr [004ABF9C]
:0043332E 8BE5                    mov esp, ebp
:00433330 5D                      pop ebp
:00433331 C3                      ret


:00433332 CC                      int 03
:00433333 CC                      int 03
:00433334 CC                      int 03
:00433335 CC                      int 03
:00433336 CC                      int 03
:00433337 CC                      int 03
:00433338 CC                      int 03
:00433339 CC                      int 03
:0043333A CC                      int 03
:0043333B CC                      int 03
:0043333C CC                      int 03
:0043333D CC                      int 03
:0043333E CC                      int 03
:0043333F CC                      int 03
:00433340 55                      push ebp
:00433341 8BEC                    mov ebp, esp
:00433343 E802000000              call 0043334A
:00433348 5D                      pop ebp
:00433349 C3                      ret



* Referenced by a CALL at Address:
|:00433343   
|
:0043334A 55                      push ebp
:0043334B 8BEC                    mov ebp, esp
:0043334D B9182C4B00              mov ecx, 004B2C18
:00433352 E8B9C30200              call 0045F710
:00433357 5D                      pop ebp
:00433358 C3                      ret



* Referenced by a CALL at Address:
|:00415910   
|
:00433359 55                      push ebp
:0043335A 8BEC                    mov ebp, esp
:0043335C E8231C0000              call 00434F84
:00433361 E89E000000              call 00433404
:00433366 85C0                    test eax, eax
:00433368 7434                    je 0043339E
:0043336A E8CD010000              call 0043353C
:0043336F E85E000000              call 004333D2
:00433374 85C0                    test eax, eax
:00433376 7421                    je 00433399
:00433378 E877040000              call 004337F4
:0043337D E850000000              call 004333D2
:00433382 85C0                    test eax, eax
:00433384 7413                    je 00433399
:00433386 E83D080000              call 00433BC8
:0043338B E842000000              call 004333D2
:00433390 85C0                    test eax, eax
:00433392 7405                    je 00433399
:00433394 E8060E0000              call 0043419F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00433376(C), :00433384(C), :00433392(C)
|
:00433399 E874010000              call 00433512

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433368(C)
|
:0043339E 33C0                    xor eax, eax
:004333A0 A0102C4B00              mov al, byte ptr [004B2C10]
:004333A5 85C0                    test eax, eax
:004333A7 7405                    je 004333AE
:004333A9 E851140000              call 004347FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004333A7(C)
|
:004333AE 833D082C4B0000          cmp dword ptr [004B2C08], 00000000
:004333B5 7405                    je 004333BC
:004333B7 E877190000              call 00434D33

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004333B5(C)
|
:004333BC 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ôС϶ˡ
ǡǡǡǡ"
                                  |
:004333C1 6870C94800              push 0048C970
:004333C6 B9F05D4B00              mov ecx, 004B5DF0
:004333CB E88D620200              call 0045965D
:004333D0 5D                      pop ebp
:004333D1 C3                      ret



* Referenced by a CALL at Addresses:
|:0043336F   , :0043337D   , :0043338B   
|
:004333D2 55                      push ebp
:004333D3 8BEC                    mov ebp, esp
:004333D5 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"µ˵"
                                  |
:004333DA 6894C94800              push 0048C994
:004333DF B9F05D4B00              mov ecx, 004B5DF0
:004333E4 E874620200              call 0045965D
:004333E9 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"1.ǳ
2.̫"
                                  |
:004333EB 68ACC94800              push 0048C9AC
:004333F0 E81DAAFFFF              call 0042DE12
:004333F5 83C408                  add esp, 00000008
:004333F8 25FF000000              and eax, 000000FF
:004333FD F7D8                    neg eax
:004333FF 1BC0                    sbb eax, eax
:00433401 40                      inc eax
:00433402 5D                      pop ebp
:00433403 C3                      ret



* Referenced by a CALL at Address:
|:00433361   
|
:00433404 55                      push ebp
:00433405 8BEC                    mov ebp, esp
:00433407 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"Ҫսˣ
ܴˡ"
                                  |
:0043340C 68C4C94800              push 0048C9C4
:00433411 B9F05D4B00              mov ecx, 004B5DF0
:00433416 E842620200              call 0045965D
:0043341B 6A01                    push 00000001
:0043341D 6A01                    push 00000001
:0043341F 6A00                    push 00000000
:00433421 68FF000000              push 000000FF
:00433426 689D000000              push 0000009D
:0043342B 6A00                    push 00000000
:0043342D B9F05D4B00              mov ecx, 004B5DF0
:00433432 E8F13F0200              call 00457428
:00433437 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"ŶǸղλ˼ң
Ϊλᵽս"
                                        ->"ģ"
                                  |
:00433439 68DCC94800              push 0048C9DC
:0043343E B9F05D4B00              mov ecx, 004B5DF0
:00433443 E815620200              call 0045965D
:00433448 33C0                    xor eax, eax
:0043344A A0102C4B00              mov al, byte ptr [004B2C10]
:0043344F 85C0                    test eax, eax
:00433451 752A                    jne 0043347D
:00433453 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"Ϊ˼˵
ǲܴ˵һ
Ծ"
                                        ->"ˡ"
                                  |
:00433458 6810CA4800              push 0048CA10
:0043345D B9F05D4B00              mov ecx, 004B5DF0
:00433462 E8F6610200              call 0045965D
:00433467 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ҪһЩ
սӦעĻ"
                                        ->"Ҫ㡣
ܴˣ֪Σ"
                                  |
:0043346C 6848CA4800              push 0048CA48
:00433471 B9F05D4B00              mov ecx, 004B5DF0
:00433476 E8E2610200              call 0045965D
:0043347B EB3C                    jmp 004334B9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433451(C)
|
:0043347D 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"˵ǵһ
˵ʵð"
                                  |
:00433482 6898CA4800              push 0048CA98
:00433487 B9F05D4B00              mov ecx, 004B5DF0
:0043348C E8CC610200              call 0045965D
:00433491 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"͵С϶ʧˡ
ƺǳ"
                                        ->"ӡ"
                                  |
:00433496 68C4CA4800              push 0048CAC4
:0043349B B9F05D4B00              mov ecx, 004B5DF0
:004334A0 E8B8610200              call 0045965D
:004334A5 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"С϶ǵͬ⡣
Ҹһ"
                                        ->"
սӦעĻҪɣ"
                                  |
:004334AA 68FCCA4800              push 0048CAFC
:004334AF B9F05D4B00              mov ecx, 004B5DF0
:004334B4 E8A4610200              call 0045965D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043347B(U)
|
:004334B9 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"1.֮
2.ûҪ"
                                  |
:004334BB 6850CB4800              push 0048CB50
:004334C0 E84DA9FFFF              call 0042DE12
:004334C5 83C408                  add esp, 00000008
:004334C8 25FF000000              and eax, 000000FF
:004334CD 85C0                    test eax, eax
:004334CF 7518                    jne 004334E9
:004334D1 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"֮ã
˼Ҳߴͽ̡"
                                  |
:004334D3 6870CB4800              push 0048CB70
:004334D8 B9F05D4B00              mov ecx, 004B5DF0
:004334DD E87B610200              call 0045965D
:004334E2 B801000000              mov eax, 00000001
:004334E7 EB27                    jmp 00433510

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004334CF(C)
|
:004334E9 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"˼ҵĺˡ
ĳϾҲ֮ͨ"
                                        ->"ˣ
ҿͲͷͽˡ"
                                  |
:004334EB 6894CB4800              push 0048CB94
:004334F0 B9F05D4B00              mov ecx, 004B5DF0
:004334F5 E863610200              call 0045965D
:004334FA 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ԭˣ治ǲܴˡ
͵ͷӵĶ"
                                        ->"ǣ
ϡ"
                                  |
:004334FF 68E0CB4800              push 0048CBE0
:00433504 B9F05D4B00              mov ecx, 004B5DF0
:00433509 E84F610200              call 0045965D
:0043350E 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004334E7(U)
|
:00433510 5D                      pop ebp
:00433511 C3                      ret



* Referenced by a CALL at Address:
|:00433399   
|
:00433512 55                      push ebp
:00433513 8BEC                    mov ebp, esp
:00433515 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"ţҲ˼һƬ⡣
ĳڴл"
                                  |
:00433517 6824CC4800              push 0048CC24
:0043351C B9F05D4B00              mov ecx, 004B5DF0
:00433521 E837610200              call 0045965D
:00433526 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ô˵̵ܽľС
"
                                        ->"ܴսԼᡣ"
                                  |
:0043352B 6850CC4800              push 0048CC50
:00433530 B9F05D4B00              mov ecx, 004B5DF0
:00433535 E823610200              call 0045965D
:0043353A 5D                      pop ebp
:0043353B C3                      ret



* Referenced by a CALL at Address:
|:0043336A   
|
:0043353C 55                      push ebp
:0043353D 8BEC                    mov ebp, esp
:0043353F 83EC08                  sub esp, 00000008
:00433542 8D4DF8                  lea ecx, dword ptr [ebp-08]
:00433545 E8C6C10200              call 0045F710
:0043354A 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ôҾͿʼΪ˵ɡ"
                                  |
:0043354F 6898CC4800              push 0048CC98
:00433554 B9F05D4B00              mov ecx, 004B5DF0
:00433559 E8FF600200              call 0045965D
:0043355E 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ǻ˵"
                                  |
:00433563 68B4CC4800              push 0048CCB4
:00433568 B9F05D4B00              mov ecx, 004B5DF0
:0043356D E8EB600200              call 0045965D
:00433572 A0182C4B00              mov al, byte ptr [004B2C18]
:00433577 0401                    add al, 01
:00433579 A2182C4B00              mov byte ptr [004B2C18], al
:0043357E 668B0D182C4B00          mov cx, word ptr [004B2C18]
:00433585 51                      push ecx
:00433586 E89B010000              call 00433726
:0043358B 83C404                  add esp, 00000004
:0043358E 6A01                    push 00000001
:00433590 6A01                    push 00000001
:00433592 6A00                    push 00000000
:00433594 6A01                    push 00000001
:00433596 68FFFF0000              push 0000FFFF
:0043359B 689D000000              push 0000009D
:004335A0 B9F05D4B00              mov ecx, 004B5DF0
:004335A5 E87E3E0200              call 00457428
:004335AA 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"˽׿
ս׿
"
                                        ->"иֲ"
                                  |
:004335AF 68C8CC4800              push 0048CCC8
:004335B4 B9F05D4B00              mov ecx, 004B5DF0
:004335B9 E89F600200              call 0045965D
:004335BE 6A01                    push 00000001
:004335C0 6A01                    push 00000001
:004335C2 6A00                    push 00000000
:004335C4 6A02                    push 00000002
:004335C6 68FFFF0000              push 0000FFFF
:004335CB 689D000000              push 0000009D
:004335D0 B9F05D4B00              mov ecx, 004B5DF0
:004335D5 E84E3E0200              call 00457428
:004335DA 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ʽܼ򵥡
ƶʱ
Ҳһ"
                                        ->"ƶ"
                                  |
:004335DF 6808CD4800              push 0048CD08
:004335E4 B9F05D4B00              mov ecx, 004B5DF0
:004335E9 E86F600200              call 0045965D
:004335EE 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ƶ򡭡"
                                  |
:004335F3 6840CD4800              push 0048CD40
:004335F8 B9F05D4B00              mov ecx, 004B5DF0
:004335FD E85B600200              call 0045965D
:00433602 C745FC00000000          mov [ebp-04], 00000000
:00433609 EB09                    jmp 00433614

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433659(U)
|
:0043360B 8B55FC                  mov edx, dword ptr [ebp-04]
:0043360E 83C201                  add edx, 00000001
:00433611 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433609(U)
|
:00433614 837DFC06                cmp dword ptr [ebp-04], 00000006
:00433618 7341                    jnb 0043365B
:0043361A 66A1182C4B00            mov ax, word ptr [004B2C18]
:00433620 50                      push eax
:00433621 E867010000              call 0043378D
:00433626 83C404                  add esp, 00000004
:00433629 8A0D192C4B00            mov cl, byte ptr [004B2C19]
:0043362F 80C101                  add cl, 01
:00433632 880D192C4B00            mov byte ptr [004B2C19], cl
:00433638 668B15182C4B00          mov dx, word ptr [004B2C18]
:0043363F 52                      push edx
:00433640 E8E1000000              call 00433726
:00433645 83C404                  add esp, 00000004
:00433648 6A04                    push 00000004
:0043364A B9181B4B00              mov ecx, 004B1B18
:0043364F E8ECFCFCFF              call 00403340
:00433654 E8878EFFFF              call 0042C4E0
:00433659 EBB0                    jmp 0043360B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433618(C)
|
:0043365B 8B0D0C2C4B00            mov ecx, dword ptr [004B2C0C]
:00433661 E838CE0000              call 0044049E
:00433666 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ָܴ˵Ĳʱ
ͻʾܴ˵ĸſ"
                                        ->""
                                  |
:0043366B 6858CD4800              push 0048CD58
:00433670 B9F05D4B00              mov ecx, 004B5DF0
:00433675 E8E35F0200              call 0045965D
:0043367A 6A01                    push 00000001
:0043367C 6A01                    push 00000001
:0043367E 6A01                    push 00000001
:00433680 689D000000              push 0000009D
:00433685 B9F05D4B00              mov ecx, 004B5DF0
:0043368A E800410200              call 0045778F
:0043368F 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"鱨Ӵսʱ
ŷǳҪĽɫ"
                                  |
:00433694 6888CD4800              push 0048CD88
:00433699 B9F05D4B00              mov ecx, 004B5DF0
:0043369E E8BA5F0200              call 0045965D
:004336A3 6A01                    push 00000001
:004336A5 6A01                    push 00000001
:004336A7 6A02                    push 00000002
:004336A9 689D000000              push 0000009D
:004336AE B9F05D4B00              mov ecx, 004B5DF0
:004336B3 E8D7400200              call 0045778F
:004336B8 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"йʩչʱ
ʾԤ˺"
                                        ->"ʡ"
                                  |
:004336BD 68B8CD4800              push 0048CDB8
:004336C2 B9F05D4B00              mov ecx, 004B5DF0
:004336C7 E8915F0200              call 0045965D
:004336CC 6A01                    push 00000001
:004336CE 6A01                    push 00000001
:004336D0 6A00                    push 00000000
:004336D2 689D000000              push 0000009D
:004336D7 B9F05D4B00              mov ecx, 004B5DF0
:004336DC E8AE400200              call 0045778F
:004336E1 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"˵ģʱҼ
ʾϸ"
                                        ->"鱨"
                                  |
:004336E6 68ECCD4800              push 0048CDEC
:004336EB B9F05D4B00              mov ecx, 004B5DF0
:004336F0 E8685F0200              call 0045965D
:004336F5 B950424B00              mov ecx, 004B4250
:004336FA E833070200              call 00453E32
:004336FF 66A1182C4B00            mov ax, word ptr [004B2C18]
:00433705 50                      push eax
:00433706 E882000000              call 0043378D
:0043370B 83C404                  add esp, 00000004
:0043370E 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ϾǻĽ˵"
                                  |
:00433713 6824CE4800              push 0048CE24
:00433718 B9F05D4B00              mov ecx, 004B5DF0
:0043371D E83B5F0200              call 0045965D
:00433722 8BE5                    mov esp, ebp
:00433724 5D                      pop ebp
:00433725 C3                      ret



* Referenced by a CALL at Addresses:
|:00433586   , :00433640   , :0043381B   , :004338C3   , :00433C47   
|:00433C86   , :00433E16   , :00433F7B   , :004340E0   , :004341B4   
|:0043431F   , :0043435E   , :004343CC   , :004345F3   , :0043464A   
|
:00433726 55                      push ebp
:00433727 8BEC                    mov ebp, esp
:00433729 51                      push ecx
:0043372A 668B4508                mov ax, word ptr [ebp+08]
:0043372E 50                      push eax
:0043372F 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00433732 51                      push ecx
:00433733 E8E7C20100              call 0044FA1F
:00433738 83C408                  add esp, 00000008
:0043373B 6A04                    push 00000004
:0043373D 6A00                    push 00000000
:0043373F 6A00                    push 00000000
:00433741 B938EB4A00              mov ecx, 004AEB38
:00433746 E8F5C20400              call 0047FA40
:0043374B 8B5508                  mov edx, dword ptr [ebp+08]
:0043374E 81E2FF000000            and edx, 000000FF
:00433754 8D8410401F0000          lea eax, dword ptr [eax+edx+00001F40]
:0043375B 8B4D09                  mov ecx, dword ptr [ebp+09]
:0043375E 81E1FF000000            and ecx, 000000FF
:00433764 33D2                    xor edx, edx
:00433766 8A152C424B00            mov dl, byte ptr [004B422C]
:0043376C 0FAFCA                  imul ecx, edx
:0043376F C6040803                mov byte ptr [eax+ecx], 03
:00433773 6A01                    push 00000001
:00433775 6A01                    push 00000001
:00433777 8A45FD                  mov al, byte ptr [ebp-03]
:0043377A 50                      push eax
:0043377B 8A4DFC                  mov cl, byte ptr [ebp-04]
:0043377E 51                      push ecx
:0043377F B950424B00              mov ecx, 004B4250
:00433784 E8BF030200              call 00453B48
:00433789 8BE5                    mov esp, ebp
:0043378B 5D                      pop ebp
:0043378C C3                      ret



* Referenced by a CALL at Addresses:
|:00433621   , :00433706   , :004338A4   , :00433B93   , :00433C67   
|:00433DFA   , :00433F49   , :00434092   , :0043416A   , :00434303   
|:00434342   , :004343AC   , :004345D5   , :0043462E   , :00434704   
|
:0043378D 55                      push ebp
:0043378E 8BEC                    mov ebp, esp
:00433790 51                      push ecx
:00433791 668B4508                mov ax, word ptr [ebp+08]
:00433795 50                      push eax
:00433796 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00433799 51                      push ecx
:0043379A E880C20100              call 0044FA1F
:0043379F 83C408                  add esp, 00000008
:004337A2 6A04                    push 00000004
:004337A4 6A00                    push 00000000
:004337A6 6A00                    push 00000000
:004337A8 B938EB4A00              mov ecx, 004AEB38
:004337AD E88EC20400              call 0047FA40
:004337B2 8B5508                  mov edx, dword ptr [ebp+08]
:004337B5 81E2FF000000            and edx, 000000FF
:004337BB 8D8410401F0000          lea eax, dword ptr [eax+edx+00001F40]
:004337C2 8B4D09                  mov ecx, dword ptr [ebp+09]
:004337C5 81E1FF000000            and ecx, 000000FF
:004337CB 33D2                    xor edx, edx
:004337CD 8A152C424B00            mov dl, byte ptr [004B422C]
:004337D3 0FAFCA                  imul ecx, edx
:004337D6 C60408FF                mov byte ptr [eax+ecx], FF
:004337DA 6A01                    push 00000001
:004337DC 6A01                    push 00000001
:004337DE 8A45FD                  mov al, byte ptr [ebp-03]
:004337E1 50                      push eax
:004337E2 8A4DFC                  mov cl, byte ptr [ebp-04]
:004337E5 51                      push ecx
:004337E6 B950424B00              mov ecx, 004B4250
:004337EB E858030200              call 00453B48
:004337F0 8BE5                    mov esp, ebp
:004337F2 5D                      pop ebp
:004337F3 C3                      ret



* Referenced by a CALL at Address:
|:00433378   
|
:004337F4 55                      push ebp
:004337F5 8BEC                    mov ebp, esp
:004337F7 51                      push ecx
:004337F8 8D4DFC                  lea ecx, dword ptr [ebp-04]
:004337FB E810BF0200              call 0045F710
:00433800 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"Ѿ͵о˵"
                                  |
:00433805 683CCE4800              push 0048CE3C
:0043380A B9F05D4B00              mov ecx, 004B5DF0
:0043380F E8495E0200              call 0045965D
:00433814 66A1182C4B00            mov ax, word ptr [004B2C18]
:0043381A 50                      push eax
:0043381B E806FFFFFF              call 00433726
:00433820 83C404                  add esp, 00000004
:00433823 8B0D142C4B00            mov ecx, dword ptr [004B2C14]
:00433829 E832FBFCFF              call 00403360
:0043382E 50                      push eax
:0043382F 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00433832 E8692DFDFF              call 004065A0
:00433837 68FFFF0000              push 0000FFFF
:0043383C 8A4DFD                  mov cl, byte ptr [ebp-03]
:0043383F 51                      push ecx
:00433840 8B55FC                  mov edx, dword ptr [ebp-04]
:00433843 81E2FF000000            and edx, 000000FF
:00433849 83C201                  add edx, 00000001
:0043384C 52                      push edx
:0043384D 689D000000              push 0000009D
:00433852 B9F05D4B00              mov ecx, 004B5DF0
:00433857 E82B5C0200              call 00459487
:0043385C 6A01                    push 00000001
:0043385E 6A01                    push 00000001
:00433860 6A00                    push 00000000
:00433862 6A03                    push 00000003
:00433864 68FFFF0000              push 0000FFFF
:00433869 689D000000              push 0000009D
:0043386E B9F05D4B00              mov ecx, 004B5DF0
:00433873 E8B03B0200              call 00457428
:00433878 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ذѿƶһԵĲӿɡ"
                                  |
:0043387D 6858CE4800              push 0048CE58
:00433882 B9F05D4B00              mov ecx, 004B5DF0
:00433887 E8D15D0200              call 0045965D
:0043388C 6A04                    push 00000004
:0043388E B9181B4B00              mov ecx, 004B1B18
:00433893 E8A8FAFCFF              call 00403340
:00433898 E8438CFFFF              call 0042C4E0
:0043389D 66A1182C4B00            mov ax, word ptr [004B2C18]
:004338A3 50                      push eax
:004338A4 E8E4FEFFFF              call 0043378D
:004338A9 83C404                  add esp, 00000004
:004338AC 8A0D182C4B00            mov cl, byte ptr [004B2C18]
:004338B2 80E901                  sub cl, 01
:004338B5 880D182C4B00            mov byte ptr [004B2C18], cl
:004338BB 668B15182C4B00          mov dx, word ptr [004B2C18]
:004338C2 52                      push edx
:004338C3 E85EFEFFFF              call 00433726
:004338C8 83C404                  add esp, 00000004
:004338CB 8B0D042C4B00            mov ecx, dword ptr [004B2C04]
:004338D1 E8C8CB0000              call 0044049E
:004338D6 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ʾڲӵ鱨ˡ
λ"
                                  |
:004338DB 687CCE4800              push 0048CE7C
:004338E0 B9F05D4B00              mov ecx, 004B5DF0
:004338E5 E8735D0200              call 0045965D
:004338EA 6A01                    push 00000001
:004338EC 6A01                    push 00000001
:004338EE 6A00                    push 00000000
:004338F0 6A02                    push 00000002
:004338F2 68FFFF0000              push 0000FFFF
:004338F7 689D000000              push 0000009D
:004338FC B9F05D4B00              mov ecx, 004B5DF0
:00433901 E8223B0200              call 00457428
:00433906 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"һҪĵط
½ʾѾѶ"
                                        ->""
                                  |
:0043390B 68A8CE4800              push 0048CEA8
:00433910 B9F05D4B00              mov ecx, 004B5DF0
:00433915 E8435D0200              call 0045965D
:0043391A 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ЩȻܴͬһ
ȴ޷"
                                        ->"
ͱʾѾ"
                                  |
:0043391F 68DCCE4800              push 0048CEDC
:00433924 B9F05D4B00              mov ecx, 004B5DF0
:00433929 E82F5D0200              call 0045965D
:0043392E 6A01                    push 00000001
:00433930 6A01                    push 00000001
:00433932 6A02                    push 00000002
:00433934 689D000000              push 0000009D
:00433939 B9F05D4B00              mov ecx, 004B5DF0
:0043393E E84C3E0200              call 0045778F
:00433943 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"һкܶˣ
ѾĽɫս"
                                        ->"ġ"
                                  |
:00433948 6824CF4800              push 0048CF24
:0043394D B9F05D4B00              mov ecx, 004B5DF0
:00433952 E8065D0200              call 0045965D
:00433957 6A01                    push 00000001
:00433959 6A01                    push 00000001
:0043395B 6A00                    push 00000000
:0043395D 689D000000              push 0000009D
:00433962 B9F05D4B00              mov ecx, 004B5DF0
:00433967 E8233E0200              call 0045778F
:0043396C 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ҪЭͬս"
                                  |
:00433971 6858CF4800              push 0048CF58
:00433976 B9F05D4B00              mov ecx, 004B5DF0
:0043397B E8DD5C0200              call 0045965D
:00433980 6A01                    push 00000001
:00433982 6A01                    push 00000001
:00433984 6A05                    push 00000005
:00433986 689D000000              push 0000009D
:0043398B B9F05D4B00              mov ecx, 004B5DF0
:00433990 E8FA3D0200              call 0045778F
:00433995 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"һǣΪеĲӣ
ڴ˻Եо"
                                        ->"Ϣʾ
㻹⡣"
                                  |
:0043399A 6878CF4800              push 0048CF78
:0043399F B9F05D4B00              mov ecx, 004B5DF0
:004339A4 E8B45C0200              call 0045965D
:004339A9 6A01                    push 00000001
:004339AB 6A01                    push 00000001
:004339AD 6A00                    push 00000000
:004339AF 6A03                    push 00000003
:004339B1 68FFFF0000              push 0000FFFF
:004339B6 689D000000              push 0000009D
:004339BB B9F05D4B00              mov ecx, 004B5DF0
:004339C0 E8633A0200              call 00457428
:004339C5 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ڰѿƶĲӣ
"
                                        ->""
                                  |
:004339CA 68C0CF4800              push 0048CFC0
:004339CF B9F05D4B00              mov ecx, 004B5DF0
:004339D4 E8845C0200              call 0045965D
:004339D9 6A01                    push 00000001
:004339DB 6A00                    push 00000000
:004339DD B9B0694B00              mov ecx, 004B69B0
:004339E2 E8930C0400              call 0047467A
:004339E7 6A01                    push 00000001
:004339E9 68FF000000              push 000000FF
:004339EE 68FF000000              push 000000FF
:004339F3 6A00                    push 00000000
:004339F5 8B0D042C4B00            mov ecx, dword ptr [004B2C04]
:004339FB E84FBD0000              call 0043F74F
:00433A00 50                      push eax
:00433A01 8B0D042C4B00            mov ecx, dword ptr [004B2C04]
:00433A07 E854F9FCFF              call 00403360
:00433A0C 50                      push eax
:00433A0D 8B0D042C4B00            mov ecx, dword ptr [004B2C04]
:00433A13 E8F0480000              call 00438308
:00433A18 6A01                    push 00000001
:00433A1A B950424B00              mov ecx, 004B4250
:00433A1F E8CC160000              call 004350F0
:00433A24 6A00                    push 00000000
:00433A26 8B0D042C4B00            mov ecx, dword ptr [004B2C04]
:00433A2C E88DBE0000              call 0043F8BE
:00433A31 50                      push eax
:00433A32 8B0D042C4B00            mov ecx, dword ptr [004B2C04]
:00433A38 E823F9FCFF              call 00403360
:00433A3D 668B00                  mov ax, word ptr [eax]
:00433A40 50                      push eax
:00433A41 B950424B00              mov ecx, 004B4250
:00433A46 E891FF0100              call 004539DC
:00433A4B B950424B00              mov ecx, 004B4250
:00433A50 E8DD030200              call 00453E32
:00433A55 B950424B00              mov ecx, 004B4250
:00433A5A E8B4000200              call 00453B13
:00433A5F 6A01                    push 00000001
:00433A61 6A01                    push 00000001
:00433A63 6A00                    push 00000000
:00433A65 6A02                    push 00000002
:00433A67 68FFFF0000              push 0000FFFF
:00433A6C 689D000000              push 0000009D
:00433A71 B9F05D4B00              mov ecx, 004B5DF0
:00433A76 E8AD390200              call 00457428
:00433A7B 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ͻʾЩѶϢ
ɫĲ֣
"
                                        ->"ƶΧ"
                                  |
:00433A80 68F0CF4800              push 0048CFF0
:00433A85 B9F05D4B00              mov ecx, 004B5DF0
:00433A8A E8CE5B0200              call 0045965D
:00433A8F 6A01                    push 00000001
:00433A91 6A01                    push 00000001

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:00433A93 6A06                    push 00000006
:00433A95 689D000000              push 0000009D
:00433A9A B9F05D4B00              mov ecx, 004B5DF0
:00433A9F E8EB3C0200              call 0045778F
:00433AA4 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ɫĿʾǹΧ"
                                  |
:00433AA9 6830D04800              push 0048D030
:00433AAE B9F05D4B00              mov ecx, 004B5DF0
:00433AB3 E8A55B0200              call 0045965D
:00433AB8 6A01                    push 00000001
:00433ABA 6A01                    push 00000001
:00433ABC 6A00                    push 00000000
:00433ABE 689D000000              push 0000009D
:00433AC3 B9F05D4B00              mov ecx, 004B5DF0
:00433AC8 E8C23C0200              call 0045778F
:00433ACD 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ȻоҲͬʾ
˽ƶ"
                                        ->"Χʱ
Ϳ˻á"
                                  |
:00433AD2 6850D04800              push 0048D050
:00433AD7 B9F05D4B00              mov ecx, 004B5DF0
:00433ADC E87C5B0200              call 0045965D
:00433AE1 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"״̬
԰Ҽ
Խ"
                                        ->""
                                  |
:00433AE6 689CD04800              push 0048D09C
:00433AEB B9F05D4B00              mov ecx, 004B5DF0
:00433AF0 E8685B0200              call 0045965D
:00433AF5 6A01                    push 00000001
:00433AF7 6A02                    push 00000002
:00433AF9 B9B0694B00              mov ecx, 004B69B0
:00433AFE E8770B0400              call 0047467A
:00433B03 6A00                    push 00000000
:00433B05 B950424B00              mov ecx, 004B4250
:00433B0A E8E1150000              call 004350F0
:00433B0F 6A00                    push 00000000
:00433B11 68FF000000              push 000000FF
:00433B16 8B0D042C4B00            mov ecx, dword ptr [004B2C04]
:00433B1C E83FF8FCFF              call 00403360
:00433B21 668B08                  mov cx, word ptr [eax]
:00433B24 51                      push ecx
:00433B25 B950424B00              mov ecx, 004B4250
:00433B2A E8ADFE0100              call 004539DC
:00433B2F B950424B00              mov ecx, 004B4250
:00433B34 E8DAFF0100              call 00453B13
:00433B39 6A01                    push 00000001
:00433B3B 6A01                    push 00000001
:00433B3D 6A01                    push 00000001
:00433B3F 689D000000              push 0000009D
:00433B44 B9F05D4B00              mov ecx, 004B5DF0
:00433B49 E8413C0200              call 0045778F
:00433B4E 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ⲿӵλ
ƾòӵĻɫ
"
                                        ->"Էֱ档"
                                  |
:00433B53 68D0D04800              push 0048D0D0
:00433B58 B9F05D4B00              mov ecx, 004B5DF0
:00433B5D E8FB5A0200              call 0045965D
:00433B62 6A01                    push 00000001
:00433B64 6A01                    push 00000001
:00433B66 6A02                    push 00000002
:00433B68 689D000000              push 0000009D
:00433B6D B9F05D4B00              mov ecx, 004B5DF0
:00433B72 E8183C0200              call 0045778F
:00433B77 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ҾһǺɫѾǳɫ
оɫ
"
                                        ->"Ҳ⣬㻹⡣"
                                  |
:00433B7C 680CD14800              push 0048D10C
:00433B81 B9F05D4B00              mov ecx, 004B5DF0
:00433B86 E8D25A0200              call 0045965D
:00433B8B 668B15182C4B00          mov dx, word ptr [004B2C18]
:00433B92 52                      push edx
:00433B93 E8F5FBFFFF              call 0043378D
:00433B98 83C404                  add esp, 00000004
:00433B9B 6A01                    push 00000001
:00433B9D 6A01                    push 00000001
:00433B9F 6A00                    push 00000000
:00433BA1 689D000000              push 0000009D
:00433BA6 B9F05D4B00              mov ecx, 004B5DF0
:00433BAB E8DF3B0200              call 0045778F
:00433BB0 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ڵоѾĽ˵͵Ϊֹ"
                                  |
:00433BB5 6858D14800              push 0048D158
:00433BBA B9F05D4B00              mov ecx, 004B5DF0
:00433BBF E8995A0200              call 0045965D
:00433BC4 8BE5                    mov esp, ebp
:00433BC6 5D                      pop ebp
:00433BC7 C3                      ret



* Referenced by a CALL at Address:
|:00433386   
|
:00433BC8 55                      push ebp
:00433BC9 8BEC                    mov ebp, esp
:00433BCB 83EC08                  sub esp, 00000008
:00433BCE 8D4DF8                  lea ecx, dword ptr [ebp-08]
:00433BD1 E83ABB0200              call 0045F710
:00433BD6 8B0D142C4B00            mov ecx, dword ptr [004B2C14]
:00433BDC E87FF7FCFF              call 00403360
:00433BE1 50                      push eax
:00433BE2 8D4DF8                  lea ecx, dword ptr [ebp-08]
:00433BE5 E8B629FDFF              call 004065A0
:00433BEA 68FFFF0000              push 0000FFFF
:00433BEF 8A45F9                  mov al, byte ptr [ebp-07]
:00433BF2 50                      push eax
:00433BF3 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00433BF6 81E1FF000000            and ecx, 000000FF
:00433BFC 83E901                  sub ecx, 00000001
:00433BFF 51                      push ecx
:00433C00 689D000000              push 0000009D
:00433C05 B9F05D4B00              mov ecx, 004B5DF0
:00433C0A E878580200              call 00459487
:00433C0F 6A01                    push 00000001
:00433C11 6A01                    push 00000001
:00433C13 6A00                    push 00000000
:00433C15 6A02                    push 00000002
:00433C17 68FFFF0000              push 0000FFFF
:00433C1C 689D000000              push 0000009D
:00433C21 B9F05D4B00              mov ecx, 004B5DF0
:00433C26 E8FD370200              call 00457428
:00433C2B 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"Ž˵йزӵĲ
ָܹӵĲֻ"
                                        ->"Ҿ
ҲǲܴԼĲӡ"
                                  |
:00433C30 687CD14800              push 0048D17C
:00433C35 B9F05D4B00              mov ecx, 004B5DF0
:00433C3A E81E5A0200              call 0045965D
:00433C3F 668B15182C4B00          mov dx, word ptr [004B2C18]
:00433C46 52                      push edx
:00433C47 E8DAFAFFFF              call 00433726
:00433C4C 83C404                  add esp, 00000004
:00433C4F 6A04                    push 00000004
:00433C51 B9181B4B00              mov ecx, 004B1B18
:00433C56 E8E5F6FCFF              call 00403340
:00433C5B E88088FFFF              call 0042C4E0
:00433C60 66A1182C4B00            mov ax, word ptr [004B2C18]
:00433C66 50                      push eax
:00433C67 E821FBFFFF              call 0043378D
:00433C6C 83C404                  add esp, 00000004
:00433C6F 8A0D182C4B00            mov cl, byte ptr [004B2C18]
:00433C75 80C101                  add cl, 01
:00433C78 880D182C4B00            mov byte ptr [004B2C18], cl
:00433C7E 668B15182C4B00          mov dx, word ptr [004B2C18]
:00433C85 52                      push edx
:00433C86 E89BFAFFFF              call 00433726
:00433C8B 83C404                  add esp, 00000004
:00433C8E 6A01                    push 00000001
:00433C90 6A01                    push 00000001
:00433C92 6A00                    push 00000000
:00433C94 6A01                    push 00000001
:00433C96 68FFFF0000              push 0000FFFF
:00433C9B 689D000000              push 0000009D
:00433CA0 B9F05D4B00              mov ecx, 004B5DF0
:00433CA5 E87E370200              call 00457428
:00433CAA 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ʱͬƶ׿򵽲ϣ
"
                                  |
:00433CAF 68CCD14800              push 0048D1CC
:00433CB4 B9F05D4B00              mov ecx, 004B5DF0
:00433CB9 E89F590200              call 0045965D
:00433CBE 6A01                    push 00000001
:00433CC0 6A00                    push 00000000
:00433CC2 B9B0694B00              mov ecx, 004B69B0
:00433CC7 E8AE090400              call 0047467A
:00433CCC 6A01                    push 00000001
:00433CCE 68FF000000              push 000000FF
:00433CD3 68FF000000              push 000000FF
:00433CD8 6A00                    push 00000000
:00433CDA 8B0D0C2C4B00            mov ecx, dword ptr [004B2C0C]
:00433CE0 E86ABA0000              call 0043F74F
:00433CE5 50                      push eax
:00433CE6 8B0D0C2C4B00            mov ecx, dword ptr [004B2C0C]
:00433CEC E86FF6FCFF              call 00403360
:00433CF1 50                      push eax
:00433CF2 8B0D0C2C4B00            mov ecx, dword ptr [004B2C0C]
:00433CF8 E80B460000              call 00438308
:00433CFD 6A01                    push 00000001
:00433CFF B950424B00              mov ecx, 004B4250
:00433D04 E8FADE0100              call 00451C03
:00433D09 6A00                    push 00000000
:00433D0B 8B0D0C2C4B00            mov ecx, dword ptr [004B2C0C]
:00433D11 E8A8BB0000              call 0043F8BE
:00433D16 50                      push eax
:00433D17 8B0D0C2C4B00            mov ecx, dword ptr [004B2C0C]
:00433D1D E83EF6FCFF              call 00403360
:00433D22 668B00                  mov ax, word ptr [eax]
:00433D25 50                      push eax
:00433D26 B950424B00              mov ecx, 004B4250
:00433D2B E8ACFC0100              call 004539DC
:00433D30 B950424B00              mov ecx, 004B4250
:00433D35 E8F8000200              call 00453E32
:00433D3A B950424B00              mov ecx, 004B4250
:00433D3F E8CFFD0100              call 00453B13
:00433D44 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ͻѶϢ"
                                  |
:00433D49 68F8D14800              push 0048D1F8
:00433D4E B9F05D4B00              mov ecx, 004B5DF0
:00433D53 E805590200              call 0045965D
:00433D58 6A01                    push 00000001
:00433D5A 6A01                    push 00000001
:00433D5C 6A00                    push 00000000
:00433D5E 6A02                    push 00000002
:00433D60 68FFFF0000              push 0000FFFF
:00433D65 689D000000              push 0000009D
:00433D6A B9F05D4B00              mov ecx, 004B5DF0
:00433D6F E8B4360200              call 00457428
:00433D74 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"͸ղŲһǣ
ƶΧɫʾġ"
                                        ->"
֪ע⵽"
                                  |
:00433D79 6810D24800              push 0048D210
:00433D7E B9F05D4B00              mov ecx, 004B5DF0
:00433D83 E8D5580200              call 0045965D
:00433D88 6A01                    push 00000001
:00433D8A 6A01                    push 00000001
:00433D8C 6A01                    push 00000001
:00433D8E 689D000000              push 0000009D
:00433D93 B9F05D4B00              mov ecx, 004B5DF0
:00433D98 E8F2390200              call 0045778F
:00433D9D 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ֻԼܹĲӣ
ƶΧɫʾ"
                                        ->"
ס"
                                  |
:00433DA2 6858D24800              push 0048D258
:00433DA7 B9F05D4B00              mov ecx, 004B5DF0
:00433DAC E8AC580200              call 0045965D
:00433DB1 6A01                    push 00000001
:00433DB3 6A01                    push 00000001
:00433DB5 6A00                    push 00000000
:00433DB7 689D000000              push 0000009D
:00433DBC B9F05D4B00              mov ecx, 004B5DF0
:00433DC1 E8C9390200              call 0045778F
:00433DC6 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ƶ
ڴ״̬ƶ׿򡭡"
                                  |
:00433DCB 6898D24800              push 0048D298
:00433DD0 B9F05D4B00              mov ecx, 004B5DF0
:00433DD5 E883580200              call 0045965D
:00433DDA C745FC00000000          mov [ebp-04], 00000000
:00433DE1 EB09                    jmp 00433DEC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433E2F(U)
|
:00433DE3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00433DE6 83C101                  add ecx, 00000001
:00433DE9 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433DE1(U)
|
:00433DEC 837DFC06                cmp dword ptr [ebp-04], 00000006
:00433DF0 733F                    jnb 00433E31
:00433DF2 668B15182C4B00          mov dx, word ptr [004B2C18]
:00433DF9 52                      push edx
:00433DFA E88EF9FFFF              call 0043378D
:00433DFF 83C404                  add esp, 00000004
:00433E02 A0192C4B00              mov al, byte ptr [004B2C19]
:00433E07 2C01                    sub al, 01
:00433E09 A2192C4B00              mov byte ptr [004B2C19], al
:00433E0E 668B0D182C4B00          mov cx, word ptr [004B2C18]
:00433E15 51                      push ecx
:00433E16 E80BF9FFFF              call 00433726
:00433E1B 83C404                  add esp, 00000004
:00433E1E 6A04                    push 00000004
:00433E20 B9181B4B00              mov ecx, 004B1B18
:00433E25 E816F5FCFF              call 00403340
:00433E2A E8B186FFFF              call 0042C4E0
:00433E2F EBB2                    jmp 00433DE3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00433DF0(C)
|
:00433E31 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ƶĿĵذ"
                                  |
:00433E36 68C0D24800              push 0048D2C0
:00433E3B B9F05D4B00              mov ecx, 004B5DF0
:00433E40 E818580200              call 0045965D
:00433E45 6A00                    push 00000000
:00433E47 B950424B00              mov ecx, 004B4250
:00433E4C E8B2DD0100              call 00451C03
:00433E51 6A00                    push 00000000
:00433E53 68FF000000              push 000000FF
:00433E58 8B0D0C2C4B00            mov ecx, dword ptr [004B2C0C]
:00433E5E E8FDF4FCFF              call 00403360
:00433E63 668B10                  mov dx, word ptr [eax]
:00433E66 52                      push edx
:00433E67 B950424B00              mov ecx, 004B4250
:00433E6C E86BFB0100              call 004539DC
:00433E71 B950424B00              mov ecx, 004B4250
:00433E76 E898FC0100              call 00453B13
:00433E7B 8B0D0C2C4B00            mov ecx, dword ptr [004B2C0C]
:00433E81 E8DAF4FCFF              call 00403360
:00433E86 50                      push eax
:00433E87 8D4DF8                  lea ecx, dword ptr [ebp-08]
:00433E8A E81127FDFF              call 004065A0
:00433E8F 68FFFF0000              push 0000FFFF
:00433E94 A0192C4B00              mov al, byte ptr [004B2C19]
:00433E99 50                      push eax
:00433E9A 8A0D182C4B00            mov cl, byte ptr [004B2C18]
:00433EA0 51                      push ecx
:00433EA1 6A00                    push 00000000
:00433EA3 B9F05D4B00              mov ecx, 004B5DF0
:00433EA8 E8DA550200              call 00459487
:00433EAD 6A01                    push 00000001
:00433EAF 6A01                    push 00000001
:00433EB1 6A00                    push 00000000
:00433EB3 6A01                    push 00000001
:00433EB5 68FFFF0000              push 0000FFFF
:00433EBA 689D000000              push 0000009D
:00433EBF B9F05D4B00              mov ecx, 004B5DF0
:00433EC4 E85F350200              call 00457428
:00433EC9 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ͻƶȥ
ʱҼ"
                                  |
:00433ECE 68E4D24800              push 0048D2E4
:00433ED3 B9F05D4B00              mov ecx, 004B5DF0
:00433ED8 E880570200              call 0045965D
:00433EDD 6A01                    push 00000001
:00433EDF 6A01                    push 00000001
:00433EE1 B9B0694B00              mov ecx, 004B69B0
:00433EE6 E88F070400              call 0047467A
:00433EEB 6A00                    push 00000000
:00433EED 6A00                    push 00000000
:00433EEF 8D55F8                  lea edx, dword ptr [ebp-08]
:00433EF2 52                      push edx
:00433EF3 8B0D0C2C4B00            mov ecx, dword ptr [004B2C0C]
:00433EF9 E8C2110000              call 004350C0
:00433EFE B950424B00              mov ecx, 004B4250
:00433F03 E80BFC0100              call 00453B13
:00433F08 B9083D4B00              mov ecx, 004B3D08
:00433F0D E878690100              call 0044A88A
:00433F12 6A01                    push 00000001
:00433F14 6A01                    push 00000001
:00433F16 6A00                    push 00000000
:00433F18 6A02                    push 00000002
:00433F1A 68FFFF0000              push 0000FFFF
:00433F1F 689D000000              push 0000009D
:00433F24 B9F05D4B00              mov ecx, 004B5DF0
:00433F29 E8FA340200              call 00457428
:00433F2E 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ͿԽƶ
Ūƶصʱ
ָ"
                                        ->"ǳ㡣"
                                  |
:00433F33 6810D34800              push 0048D310
:00433F38 B9F05D4B00              mov ecx, 004B5DF0
:00433F3D E81B570200              call 0045965D
:00433F42 66A1182C4B00            mov ax, word ptr [004B2C18]
:00433F48 50                      push eax
:00433F49 E83FF8FFFF              call 0043378D
:00433F4E 83C404                  add esp, 00000004
:00433F51 8D4DF8                  lea ecx, dword ptr [ebp-08]
:00433F54 51                      push ecx
:00433F55 B9182C4B00              mov ecx, 004B2C18
:00433F5A E84126FDFF              call 004065A0
:00433F5F 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"Ҫ˵ǣ
ƶж"
                                  |
:00433F64 684CD34800              push 0048D34C
:00433F69 B9F05D4B00              mov ecx, 004B5DF0
:00433F6E E8EA560200              call 0045965D
:00433F73 668B15182C4B00          mov dx, word ptr [004B2C18]
:00433F7A 52                      push edx
:00433F7B E8A6F7FFFF              call 00433726
:00433F80 83C404                  add esp, 00000004
:00433F83 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ٰһ
صղŵ״̬"
                                  |
:00433F88 6874D34800              push 0048D374
:00433F8D B9F05D4B00              mov ecx, 004B5DF0
:00433F92 E8C6560200              call 0045965D
:00433F97 6A01                    push 00000001
:00433F99 6A00                    push 00000000
:00433F9B B9B0694B00              mov ecx, 004B69B0
:00433FA0 E8D5060400              call 0047467A
:00433FA5 6A01                    push 00000001
:00433FA7 68FF000000              push 000000FF
:00433FAC 68FF000000              push 000000FF
:00433FB1 6A00                    push 00000000
:00433FB3 8B0D0C2C4B00            mov ecx, dword ptr [004B2C0C]
:00433FB9 E891B70000              call 0043F74F
:00433FBE 50                      push eax
:00433FBF 8B0D0C2C4B00            mov ecx, dword ptr [004B2C0C]
:00433FC5 E896F3FCFF              call 00403360
:00433FCA 50                      push eax
:00433FCB 8B0D0C2C4B00            mov ecx, dword ptr [004B2C0C]
:00433FD1 E832430000              call 00438308
:00433FD6 6A01                    push 00000001
:00433FD8 B950424B00              mov ecx, 004B4250
:00433FDD E821DC0100              call 00451C03
:00433FE2 6A00                    push 00000000
:00433FE4 8B0D0C2C4B00            mov ecx, dword ptr [004B2C0C]
:00433FEA E8CFB80000              call 0043F8BE
:00433FEF 50                      push eax
:00433FF0 8B0D0C2C4B00            mov ecx, dword ptr [004B2C0C]
:00433FF6 E865F3FCFF              call 00403360
:00433FFB 668B00                  mov ax, word ptr [eax]
:00433FFE 50                      push eax
:00433FFF B950424B00              mov ecx, 004B4250
:00434004 E8D3F90100              call 004539DC
:00434009 B950424B00              mov ecx, 004B4250
:0043400E E800FB0100              call 00453B13
:00434013 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ڴ״̬°
ͻѡ¸ж"
                                        ->"Ӵ"
                                  |
:00434018 689CD34800              push 0048D39C
:0043401D B9F05D4B00              mov ecx, 004B5DF0
:00434022 E836560200              call 0045965D
:00434027 6A01                    push 00000001
:00434029 6A01                    push 00000001
:0043402B 6A01                    push 00000001
:0043402D 689D000000              push 0000009D
:00434032 B9F05D4B00              mov ecx, 004B5DF0
:00434037 E853370200              call 0045778F
:0043403C 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ָӴ
㰴"
                                  |
:00434041 68D0D34800              push 0048D3D0
:00434046 B9F05D4B00              mov ecx, 004B5DF0
:0043404B E80D560200              call 0045965D
:00434050 6A01                    push 00000001
:00434052 6A00                    push 00000000
:00434054 B9B0694B00              mov ecx, 004B69B0
:00434059 E81C060400              call 0047467A
:0043405E 6A00                    push 00000000
:00434060 B950424B00              mov ecx, 004B4250
:00434065 E899DB0100              call 00451C03
:0043406A 6A00                    push 00000000
:0043406C 68FF000000              push 000000FF
:00434071 8B0D0C2C4B00            mov ecx, dword ptr [004B2C0C]
:00434077 E8E4F2FCFF              call 00403360
:0043407C 668B08                  mov cx, word ptr [eax]
:0043407F 51                      push ecx
:00434080 B950424B00              mov ecx, 004B4250
:00434085 E852F90100              call 004539DC
:0043408A 668B15182C4B00          mov dx, word ptr [004B2C18]
:00434091 52                      push edx
:00434092 E8F6F6FFFF              call 0043378D
:00434097 83C404                  add esp, 00000004
:0043409A B950424B00              mov ecx, 004B4250
:0043409F E86FFA0100              call 00453B13
:004340A4 A0192C4B00              mov al, byte ptr [004B2C19]
:004340A9 50                      push eax
:004340AA 8A0D182C4B00            mov cl, byte ptr [004B2C18]
:004340B0 51                      push ecx
:004340B1 B9985E4B00              mov ecx, 004B5E98
:004340B6 E8E57A0200              call 0045BBA0
:004340BB 6A01                    push 00000001
:004340BD B9985E4B00              mov ecx, 004B5E98
:004340C2 E849100000              call 00435110
:004340C7 6A01                    push 00000001
:004340C9 B9985E4B00              mov ecx, 004B5E98
:004340CE E85D100000              call 00435130
:004340D3 E8C2A50200              call 0045E69A
:004340D8 668B15182C4B00          mov dx, word ptr [004B2C18]
:004340DF 52                      push edx
:004340E0 E841F6FFFF              call 00433726
:004340E5 83C404                  add esp, 00000004
:004340E8 6A01                    push 00000001
:004340EA 6A01                    push 00000001
:004340EC 6A00                    push 00000000
:004340EE 689D000000              push 0000009D
:004340F3 B9F05D4B00              mov ecx, 004B5DF0
:004340F8 E892360200              call 0045778F
:004340FD 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"˱ѡ񲿶ӵж"
                                  |
:00434102 68F8D34800              push 0048D3F8
:00434107 B9F05D4B00              mov ecx, 004B5DF0
:0043410C E84C550200              call 0045965D
:00434111 6A01                    push 00000001
:00434113 6A01                    push 00000001
:00434115 6A02                    push 00000002
:00434117 689D000000              push 0000009D
:0043411C B9F05D4B00              mov ecx, 004B5DF0
:00434121 E869360200              call 0045778F
:00434126 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"˵
ѡӴƶ
ҲԶ"
                                        ->"֡"
                                  |
:0043412B 6814D44800              push 0048D414
:00434130 B9F05D4B00              mov ecx, 004B5DF0
:00434135 E823550200              call 0045965D
:0043413A 6A01                    push 00000001
:0043413C 6A01                    push 00000001
:0043413E 6A01                    push 00000001
:00434140 689D000000              push 0000009D
:00434145 B9F05D4B00              mov ecx, 004B5DF0
:0043414A E840360200              call 0045778F
:0043414F 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"״̬ʱ밴Ҽ
޷ѡʱʾ"
                                        ->"ɫ
ס"
                                  |
:00434154 6848D44800              push 0048D448
:00434159 B9F05D4B00              mov ecx, 004B5DF0
:0043415E E8FA540200              call 0045965D
:00434163 66A1182C4B00            mov ax, word ptr [004B2C18]
:00434169 50                      push eax
:0043416A E81EF6FFFF              call 0043378D
:0043416F 83C404                  add esp, 00000004
:00434172 6A01                    push 00000001
:00434174 6A01                    push 00000001
:00434176 6A00                    push 00000000
:00434178 689D000000              push 0000009D
:0043417D B9F05D4B00              mov ecx, 004B5DF0
:00434182 E808360200              call 0045778F
:00434187 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ǹڲӲ˵"
                                  |
:0043418C 688CD44800              push 0048D48C
:00434191 B9F05D4B00              mov ecx, 004B5DF0
:00434196 E8C2540200              call 0045965D
:0043419B 8BE5                    mov esp, ebp
:0043419D 5D                      pop ebp
:0043419E C3                      ret



* Referenced by a CALL at Address:
|:00433394   
|
:0043419F 55                      push ebp
:004341A0 8BEC                    mov ebp, esp
:004341A2 83EC08                  sub esp, 00000008
:004341A5 8D4DF8                  lea ecx, dword ptr [ebp-08]
:004341A8 E863B50200              call 0045F710
:004341AD 66A1182C4B00            mov ax, word ptr [004B2C18]
:004341B3 50                      push eax
:004341B4 E86DF5FFFF              call 00433726
:004341B9 83C404                  add esp, 00000004
:004341BC 6A01                    push 00000001
:004341BE 6A01                    push 00000001
:004341C0 6A00                    push 00000000
:004341C2 689D000000              push 0000009D
:004341C7 B9F05D4B00              mov ecx, 004B5DF0
:004341CC E8BE350200              call 0045778F
:004341D1 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"Ϊ˵һµΡ"
                                  |
:004341D6 68A8D44800              push 0048D4A8
:004341DB B9F05D4B00              mov ecx, 004B5DF0
:004341E0 E878540200              call 0045965D
:004341E5 6A01                    push 00000001
:004341E7 6A01                    push 00000001
:004341E9 6A00                    push 00000000
:004341EB 6A01                    push 00000001
:004341ED 68FFFF0000              push 0000FFFF
:004341F2 689D000000              push 0000009D
:004341F7 B9F05D4B00              mov ecx, 004B5DF0
:004341FC E827320200              call 00457428
:00434201 6A01                    push 00000001
:00434203 6A01                    push 00000001
:00434205 6A00                    push 00000000
:00434207 6A02                    push 00000002
:00434209 68FFFF0000              push 0000FFFF
:0043420E 689D000000              push 0000009D
:00434213 B9F05D4B00              mov ecx, 004B5DF0
:00434218 E80B320200              call 00457428
:0043421D 6A01                    push 00000001
:0043421F 6A01                    push 00000001
:00434221 6A00                    push 00000000
:00434223 6A03                    push 00000003
:00434225 68FFFF0000              push 0000FFFF
:0043422A 689D000000              push 0000009D
:0043422F B9F05D4B00              mov ecx, 004B5DF0
:00434234 E8EF310200              call 00457428
:00434239 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"սиʽĵΡ"
                                  |
:0043423E 68C0D44800              push 0048D4C0
:00434243 B9F05D4B00              mov ecx, 004B5DF0
:00434248 E810540200              call 0045965D
:0043424D 6A01                    push 00000001
:0043424F 6A01                    push 00000001
:00434251 6A00                    push 00000000
:00434253 6A02                    push 00000002
:00434255 68FFFF0000              push 0000FFFF
:0043425A 689D000000              push 0000009D
:0043425F B9F05D4B00              mov ecx, 004B5DF0
:00434264 E8BF310200              call 00457428
:00434269 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"вƶĵΡ
¹Ρׯȵȡ
"
                                        ->"òӻָĵΡ"
                                  |
:0043426E 68DCD44800              push 0048D4DC
:00434273 B9F05D4B00              mov ecx, 004B5DF0
:00434278 E8E0530200              call 0045965D
:0043427D 6A01                    push 00000001
:0043427F 6A01                    push 00000001
:00434281 6A01                    push 00000001
:00434283 689D000000              push 0000009D
:00434288 B9F05D4B00              mov ecx, 004B5DF0
:0043428D E8FD340200              call 0045778F
:00434292 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ҲбӪͱȣ
ܹõߵĵΡ"
                                  |
:00434297 6824D54800              push 0048D524
:0043429C B9F05D4B00              mov ecx, 004B5DF0
:004342A1 E8B7530200              call 0045965D
:004342A6 6A01                    push 00000001
:004342A8 6A01                    push 00000001
:004342AA 6A00                    push 00000000
:004342AC 689D000000              push 0000009D
:004342B1 B9F05D4B00              mov ecx, 004B5DF0
:004342B6 E8D4340200              call 0045778F
:004342BB 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"Ҳ֮У
Ҳضβʩչļı"
                                  |
:004342C0 6854D54800              push 0048D554
:004342C5 B9F05D4B00              mov ecx, 004B5DF0
:004342CA E88E530200              call 0045965D
:004342CF 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ǿʵʵɡ"
                                  |
:004342D4 6884D54800              push 0048D584
:004342D9 B9F05D4B00              mov ecx, 004B5DF0
:004342DE E87A530200              call 0045965D
:004342E3 C745FC00000000          mov [ebp-04], 00000000
:004342EA EB09                    jmp 004342F5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434338(U)
|
:004342EC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004342EF 83C101                  add ecx, 00000001
:004342F2 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004342EA(U)
|
:004342F5 837DFC02                cmp dword ptr [ebp-04], 00000002
:004342F9 733F                    jnb 0043433A
:004342FB 668B15182C4B00          mov dx, word ptr [004B2C18]
:00434302 52                      push edx
:00434303 E885F4FFFF              call 0043378D
:00434308 83C404                  add esp, 00000004
:0043430B A0192C4B00              mov al, byte ptr [004B2C19]
:00434310 2C01                    sub al, 01
:00434312 A2192C4B00              mov byte ptr [004B2C19], al
:00434317 668B0D182C4B00          mov cx, word ptr [004B2C18]
:0043431E 51                      push ecx
:0043431F E802F4FFFF              call 00433726
:00434324 83C404                  add esp, 00000004
:00434327 6A04                    push 00000004
:00434329 B9181B4B00              mov ecx, 004B1B18
:0043432E E80DF0FCFF              call 00403340
:00434333 E8A881FFFF              call 0042C4E0
:00434338 EBB2                    jmp 004342EC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004342F9(C)
|
:0043433A 668B15182C4B00          mov dx, word ptr [004B2C18]
:00434341 52                      push edx
:00434342 E846F4FFFF              call 0043378D
:00434347 83C404                  add esp, 00000004
:0043434A A0182C4B00              mov al, byte ptr [004B2C18]
:0043434F 0401                    add al, 01
:00434351 A2182C4B00              mov byte ptr [004B2C18], al
:00434356 668B0D182C4B00          mov cx, word ptr [004B2C18]
:0043435D 51                      push ecx
:0043435E E8C3F3FFFF              call 00433726
:00434363 83C404                  add esp, 00000004
:00434366 6A01                    push 00000001
:00434368 6A01                    push 00000001
:0043436A 6A00                    push 00000000
:0043436C 6A01                    push 00000001
:0043436E 68FFFF0000              push 0000FFFF
:00434373 689D000000              push 0000009D
:00434378 B9F05D4B00              mov ecx, 004B5DF0
:0043437D E8A6300200              call 00457428
:00434382 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ƶۿĵϣ
ٰ"
                                        ->""
                                  |
:00434387 68A0D54800              push 0048D5A0
:0043438C B9F05D4B00              mov ecx, 004B5DF0
:00434391 E8C7520200              call 0045965D
:00434396 6A01                    push 00000001
:00434398 6A00                    push 00000000
:0043439A B9B0694B00              mov ecx, 004B69B0
:0043439F E8D6020400              call 0047467A
:004343A4 668B15182C4B00          mov dx, word ptr [004B2C18]
:004343AB 52                      push edx
:004343AC E8DCF3FFFF              call 0043378D
:004343B1 83C404                  add esp, 00000004
:004343B4 6A00                    push 00000000
:004343B6 68182C4B00              push 004B2C18
:004343BB B950424B00              mov ecx, 004B4250
:004343C0 E8A8130200              call 0045576D
:004343C5 66A1182C4B00            mov ax, word ptr [004B2C18]
:004343CB 50                      push eax
:004343CC E855F3FFFF              call 00433726
:004343D1 83C404                  add esp, 00000004
:004343D4 6A01                    push 00000001
:004343D6 6A01                    push 00000001
:004343D8 6A00                    push 00000000
:004343DA 6A02                    push 00000002
:004343DC 68FFFF0000              push 0000FFFF
:004343E1 689D000000              push 0000009D
:004343E6 B9F05D4B00              mov ecx, 004B5DF0
:004343EB E838300200              call 00457428
:004343F0 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ͻʾõε鱨
޷ƶԻָĵ"
                                        ->"Σ
Ҳչ֡"
                                  |
:004343F5 68D0D54800              push 0048D5D0
:004343FA B9F05D4B00              mov ecx, 004B5DF0
:004343FF E859520200              call 0045965D
:00434404 6A01                    push 00000001
:00434406 6A01                    push 00000001
:00434408 6A05                    push 00000005
:0043440A 689D000000              push 0000009D
:0043440F B9F05D4B00              mov ecx, 004B5DF0
:00434414 E876330200              call 0045778F
:00434419 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ʱעĸͼʾ
õܹʩչԵ"
                                        ->""
                                  |
:0043441E 6814D64800              push 0048D614
:00434423 B9F05D4B00              mov ecx, 004B5DF0
:00434428 E830520200              call 0045965D
:0043442D 6A01                    push 00000001
:0043442F 6A01                    push 00000001
:00434431 6A00                    push 00000000
:00434433 689D000000              push 0000009D
:00434438 B9F05D4B00              mov ecx, 004B5DF0
:0043443D E84D330200              call 0045778F
:00434442 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ǻࡢˮࡢ
ࡢĲԡ"
                                  |
:00434447 684CD64800              push 0048D64C
:0043444C B9F05D4B00              mov ecx, 004B5DF0
:00434451 E807520200              call 0045965D
:00434456 6A01                    push 00000001
:00434458 6A01                    push 00000001
:0043445A 6A02                    push 00000002
:0043445C 689D000000              push 0000009D
:00434461 B9F05D4B00              mov ecx, 004B5DF0
:00434466 E824330200              call 0045778F
:0043446B 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ǳɫʾͼʾ
ʾõ޷ʩչĲԡ"
                                  |
:00434470 687CD64800              push 0048D67C
:00434475 B9F05D4B00              mov ecx, 004B5DF0
:0043447A E8DE510200              call 0045965D
:0043447F 6A01                    push 00000001
:00434481 6A01                    push 00000001
:00434483 6A00                    push 00000000
:00434485 689D000000              push 0000009D
:0043448A B9F05D4B00              mov ecx, 004B5DF0
:0043448F E8FB320200              call 0045778F
:00434494 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"Ҳ˵ֵϣ
ʩչͷĲ"
                                        ->"ԡ"
                                  |
:00434499 68A8D64800              push 0048D6A8
:0043449E B9F05D4B00              mov ecx, 004B5DF0
:004344A3 E8B5510200              call 0045965D
:004344A8 6A01                    push 00000001
:004344AA 6A01                    push 00000001
:004344AC 6A01                    push 00000001
:004344AE 689D000000              push 0000009D
:004344B3 B9F05D4B00              mov ecx, 004B5DF0
:004344B8 E8D2320200              call 0045778F
:004344BD 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"һǣ
ָͷĲԲܵ"
                                        ->"ơ
ס"
                                  |
:004344C2 68DCD64800              push 0048D6DC
:004344C7 B9F05D4B00              mov ecx, 004B5DF0
:004344CC E88C510200              call 0045965D
:004344D1 6A01                    push 00000001
:004344D3 6A01                    push 00000001
:004344D5 6A00                    push 00000000
:004344D7 689D000000              push 0000009D
:004344DC B9F05D4B00              mov ecx, 004B5DF0
:004344E1 E8A9320200              call 0045778F
:004344E6 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"Ҽ
ͿԹرո鱨"
                                  |
:004344EB 6820D74800              push 0048D720
:004344F0 B9F05D4B00              mov ecx, 004B5DF0
:004344F5 E863510200              call 0045965D
:004344FA 6A01                    push 00000001
:004344FC 6A01                    push 00000001
:004344FE B9B0694B00              mov ecx, 004B69B0
:00434503 E872010400              call 0047467A
:00434508 B950424B00              mov ecx, 004B4250
:0043450D E820F90100              call 00453E32
:00434512 B950424B00              mov ecx, 004B4250
:00434517 E8F7F50100              call 00453B13
:0043451C 8B0D142C4B00            mov ecx, dword ptr [004B2C14]
:00434522 E839EEFCFF              call 00403360
:00434527 50                      push eax
:00434528 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0043452B E87020FDFF              call 004065A0
:00434530 68FFFF0000              push 0000FFFF
:00434535 8A4DF9                  mov cl, byte ptr [ebp-07]
:00434538 51                      push ecx
:00434539 8B55F8                  mov edx, dword ptr [ebp-08]
:0043453C 81E2FF000000            and edx, 000000FF
:00434542 83C201                  add edx, 00000001
:00434545 52                      push edx
:00434546 689D000000              push 0000009D
:0043454B B9F05D4B00              mov ecx, 004B5DF0
:00434550 E8324F0200              call 00459487
:00434555 6A01                    push 00000001
:00434557 6A01                    push 00000001
:00434559 6A00                    push 00000000
:0043455B 6A02                    push 00000002
:0043455D 68FFFF0000              push 0000FFFF
:00434562 689D000000              push 0000009D
:00434567 B9F05D4B00              mov ecx, 004B5DF0
:0043456C E8B72E0200              call 00457428
:00434571 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ڲӵԣ
óĵΡ"
                                  |
:00434576 6848D74800              push 0048D748
:0043457B B9F05D4B00              mov ecx, 004B5DF0
:00434580 E8D8500200              call 0045965D
:00434585 6A01                    push 00000001
:00434587 6A01                    push 00000001
:00434589 6A00                    push 00000000
:0043458B 6A03                    push 00000003
:0043458D 68FFFF0000              push 0000FFFF
:00434592 689D000000              push 0000009D
:00434597 B9F05D4B00              mov ecx, 004B5DF0
:0043459C E8872E0200              call 00457428
:004345A1 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ٿһ鱨ɡ"
                                  |
:004345A6 6874D74800              push 0048D774
:004345AB B9F05D4B00              mov ecx, 004B5DF0
:004345B0 E8A8500200              call 0045965D
:004345B5 C745FC00000000          mov [ebp-04], 00000000
:004345BC EB09                    jmp 004345C7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043460C(U)
|
:004345BE 8B45FC                  mov eax, dword ptr [ebp-04]
:004345C1 83C001                  add eax, 00000001
:004345C4 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004345BC(U)
|
:004345C7 837DFC02                cmp dword ptr [ebp-04], 00000002
:004345CB 7341                    jnb 0043460E
:004345CD 668B0D182C4B00          mov cx, word ptr [004B2C18]
:004345D4 51                      push ecx
:004345D5 E8B3F1FFFF              call 0043378D
:004345DA 83C404                  add esp, 00000004
:004345DD 8A15182C4B00            mov dl, byte ptr [004B2C18]
:004345E3 80EA01                  sub dl, 01
:004345E6 8815182C4B00            mov byte ptr [004B2C18], dl
:004345EC 66A1182C4B00            mov ax, word ptr [004B2C18]
:004345F2 50                      push eax
:004345F3 E82EF1FFFF              call 00433726
:004345F8 83C404                  add esp, 00000004
:004345FB 6A04                    push 00000004
:004345FD B9181B4B00              mov ecx, 004B1B18
:00434602 E839EDFCFF              call 00403340
:00434607 E8D47EFFFF              call 0042C4E0
:0043460C EBB0                    jmp 004345BE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004345CB(C)
|
:0043460E C745FC00000000          mov [ebp-04], 00000000
:00434615 EB09                    jmp 00434620

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434663(U)
|
:00434617 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043461A 83C101                  add ecx, 00000001
:0043461D 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434615(U)
|
:00434620 837DFC02                cmp dword ptr [ebp-04], 00000002
:00434624 733F                    jnb 00434665
:00434626 668B15182C4B00          mov dx, word ptr [004B2C18]
:0043462D 52                      push edx
:0043462E E85AF1FFFF              call 0043378D
:00434633 83C404                  add esp, 00000004
:00434636 A0192C4B00              mov al, byte ptr [004B2C19]
:0043463B 0401                    add al, 01
:0043463D A2192C4B00              mov byte ptr [004B2C19], al
:00434642 668B0D182C4B00          mov cx, word ptr [004B2C18]
:00434649 51                      push ecx
:0043464A E8D7F0FFFF              call 00433726
:0043464F 83C404                  add esp, 00000004
:00434652 6A04                    push 00000004
:00434654 B9181B4B00              mov ecx, 004B1B18
:00434659 E8E2ECFCFF              call 00403340
:0043465E E87D7EFFFF              call 0042C4E0
:00434663 EBB2                    jmp 00434617

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434624(C)
|
:00434665 8B0D042C4B00            mov ecx, dword ptr [004B2C04]
:0043466B E82EBE0000              call 0044049E
:00434670 6A01                    push 00000001
:00434672 6A01                    push 00000001
:00434674 6A00                    push 00000000
:00434676 6A02                    push 00000002
:00434678 68FFFF0000              push 0000FFFF
:0043467D 689D000000              push 0000009D
:00434682 B9F05D4B00              mov ecx, 004B5DF0
:00434687 E89C2D0200              call 00457428
:0043468C 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"½ʾƽԭ100%ѶϢ
˽ʲô˼"
                                        ->""
                                  |
:00434691 6894D74800              push 0048D794
:00434696 B9F05D4B00              mov ecx, 004B5DF0
:0043469B E8BD4F0200              call 0045965D
:004346A0 6A01                    push 00000001
:004346A2 6A01                    push 00000001
:004346A4 6A05                    push 00000005
:004346A6 689D000000              push 0000009D
:004346AB B9F05D4B00              mov ecx, 004B5DF0
:004346B0 E8DA300200              call 0045778F
:004346B5 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ʾĲĿǰƽԭ
Է100%"
                                        ->""
                                  |
:004346BA 68C8D74800              push 0048D7C8
:004346BF B9F05D4B00              mov ecx, 004B5DF0
:004346C4 E8944F0200              call 0045965D
:004346C9 6A01                    push 00000001
:004346CB 6A01                    push 00000001
:004346CD 6A00                    push 00000000
:004346CF 689D000000              push 0000009D
:004346D4 B9F05D4B00              mov ecx, 004B5DF0
:004346D9 E8B1300200              call 0045778F
:004346DE 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ܲοһ
Ӧøڰյ"
                                        ->"ԵĹϵ"
                                  |
:004346E3 68FCD74800              push 0048D7FC
:004346E8 B9F05D4B00              mov ecx, 004B5DF0
:004346ED E86B4F0200              call 0045965D
:004346F2 B950424B00              mov ecx, 004B4250
:004346F7 E836F70100              call 00453E32
:004346FC 668B15182C4B00          mov dx, word ptr [004B2C18]
:00434703 52                      push edx
:00434704 E884F0FFFF              call 0043378D
:00434709 83C404                  add esp, 00000004
:0043470C 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"˵ȫ"
                                  |
:00434711 683CD84800              push 0048D83C
:00434716 B9F05D4B00              mov ecx, 004B5DF0
:0043471B E83D4F0200              call 0045965D
:00434720 6A01                    push 00000001
:00434722 6A01                    push 00000001
:00434724 6A00                    push 00000000
:00434726 6A00                    push 00000000
:00434728 68FFFF0000              push 0000FFFF
:0043472D 689D000000              push 0000009D
:00434732 B9F05D4B00              mov ecx, 004B5DF0
:00434737 E8EC2C0200              call 00457428
:0043473C 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"Ϊ˸лȫ˵
ڴҪһ"
                                        ->""
                                  |
:00434741 6858D84800              push 0048D858
:00434746 B9F05D4B00              mov ecx, 004B5DF0
:0043474B E80D4F0200              call 0045965D
:00434750 6A01                    push 00000001
:00434752 6A01                    push 00000001
:00434754 6A00                    push 00000000
:00434756 6A02                    push 00000002
:00434758 68FFFF0000              push 0000FFFF
:0043475D 689D000000              push 0000009D
:00434762 B9F05D4B00              mov ecx, 004B5DF0
:00434767 E8BC2C0200              call 00457428
:0043476C 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"սϣ
ᱻٸ־"
                                  |
:00434771 6888D84800              push 0048D888
:00434776 B9F05D4B00              mov ecx, 004B5DF0
:0043477B E8DD4E0200              call 0045965D
:00434780 6A01                    push 00000001
:00434782 6A01                    push 00000001
:00434784 6A02                    push 00000002
:00434786 689D000000              push 0000009D
:0043478B B9F05D4B00              mov ecx, 004B5DF0
:00434790 E8FA2F0200              call 0045778F
:00434795 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"õʱĴ
൱Ծʱ򡭡"
                                  |
:0043479A 68B4D84800              push 0048D8B4
:0043479F B9F05D4B00              mov ecx, 004B5DF0
:004347A4 E8B44E0200              call 0045965D
:004347A9 6A01                    push 00000001
:004347AB 6A01                    push 00000001
:004347AD 6A01                    push 00000001
:004347AF 689D000000              push 0000009D
:004347B4 B9F05D4B00              mov ecx, 004B5DF0
:004347B9 E8D12F0200              call 0045778F
:004347BE 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ʱѡѡ
ܹ׽ص"
                                        ->"̬"
                                  |
:004347C3 68E4D84800              push 0048D8E4
:004347C8 B9F05D4B00              mov ecx, 004B5DF0
:004347CD E88B4E0200              call 0045965D
:004347D2 6A01                    push 00000001
:004347D4 6A01                    push 00000001
:004347D6 6A00                    push 00000000
:004347D8 689D000000              push 0000009D
:004347DD B9F05D4B00              mov ecx, 004B5DF0
:004347E2 E8A82F0200              call 0045778F
:004347E7 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ȻҲ⣬
ϵܴ˵δ
"
                                        ->"ǵɲܴ¾ϡ"
                                  |
:004347EC 681CD94800              push 0048D91C
:004347F1 B9F05D4B00              mov ecx, 004B5DF0
:004347F6 E8624E0200              call 0045965D
:004347FB 8BE5                    mov esp, ebp
:004347FD 5D                      pop ebp
:004347FE C3                      ret



* Referenced by a CALL at Address:
|:004333A9   
|
:004347FF 55                      push ebp
:00434800 8BEC                    mov ebp, esp
:00434802 83EC08                  sub esp, 00000008
:00434805 33C0                    xor eax, eax
:00434807 A0102C4B00              mov al, byte ptr [004B2C10]
:0043480C 83F801                  cmp eax, 00000001
:0043480F 0F8594010000            jne 004349A9
:00434815 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ˣܴˡ
ѧķˡ"
                                  |
:0043481A 6864D94800              push 0048D964
:0043481F B9F05D4B00              mov ecx, 004B5DF0
:00434824 E8344E0200              call 0045965D
:00434829 6A01                    push 00000001
:0043482B 6A01                    push 00000001
:0043482D 6A01                    push 00000001
:0043482F 689D000000              push 0000009D
:00434834 B9F05D4B00              mov ecx, 004B5DF0
:00434839 E8512F0200              call 0045778F
:0043483E 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"Lvء"
                                  |
:00434843 6890D94800              push 0048D990
:00434848 B9F05D4B00              mov ecx, 004B5DF0
:0043484D E80B4E0200              call 0045965D
:00434852 6A01                    push 00000001
:00434854 6A01                    push 00000001
:00434856 6A00                    push 00000000
:00434858 689D000000              push 0000009D
:0043485D B9F05D4B00              mov ecx, 004B5DF0
:00434862 E8282F0200              call 0045778F
:00434867 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ҰLvɣ
ܴˣΣ"
                                  |
:0043486C 68B8D94800              push 0048D9B8
:00434871 B9F05D4B00              mov ecx, 004B5DF0
:00434876 E8E24D0200              call 0045965D
:0043487B 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"1.֮
2.ûҪ"
                                  |
:0043487D 68E0D94800              push 0048D9E0
:00434882 E88B95FFFF              call 0042DE12
:00434887 83C408                  add esp, 00000008
:0043488A 25FF000000              and eax, 000000FF
:0043488F 85C0                    test eax, eax
:00434891 0F85BC000000            jne 00434953
:00434897 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"֮ã
ˡ"
                                  |
:00434899 6800DA4800              push 0048DA00
:0043489E B9F05D4B00              mov ecx, 004B5DF0
:004348A3 E8B54D0200              call 0045965D
:004348A8 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ðɣҪʩ
٣"
                                  |
:004348AD 681CDA4800              push 0048DA1C
:004348B2 B9F05D4B00              mov ecx, 004B5DF0
:004348B7 E8A14D0200              call 0045965D
:004348BC 6A01                    push 00000001
:004348BE 6A01                    push 00000001
:004348C0 6A05                    push 00000005
:004348C2 689D000000              push 0000009D
:004348C7 B9F05D4B00              mov ecx, 004B5DF0
:004348CC E8BE2E0200              call 0045778F
:004348D1 6A01                    push 00000001
:004348D3 6A27                    push 00000027
:004348D5 B9B0694B00              mov ecx, 004B69B0
:004348DA E89BFD0300              call 0047467A
:004348DF 6A0A                    push 0000000A
:004348E1 B9181B4B00              mov ecx, 004B1B18
:004348E6 E855EAFCFF              call 00403340
:004348EB E8F07BFFFF              call 0042C4E0
:004348F0 6A01                    push 00000001
:004348F2 6A01                    push 00000001
:004348F4 6A00                    push 00000000
:004348F6 689D000000              push 0000009D
:004348FB B9F05D4B00              mov ecx, 004B5DF0
:00434900 E88A2E0200              call 0045778F
:00434905 6A01                    push 00000001
:00434907 6A01                    push 00000001
:00434909 B9681B4A00              mov ecx, 004A1B68
:0043490E E8A52AFDFF              call 004073B8
:00434913 B9681B4A00              mov ecx, 004A1B68
:00434918 E8FE28FDFF              call 0040721B
:0043491D 50                      push eax
:0043491E 8B0D0C2C4B00            mov ecx, dword ptr [004B2C0C]
:00434924 E8A4AD0000              call 0043F6CD
:00434929 B9681B4A00              mov ecx, 004A1B68
:0043492E E81729FDFF              call 0040724A
:00434933 50                      push eax
:00434934 8B0D0C2C4B00            mov ecx, dword ptr [004B2C0C]
:0043493A E8CFAD0000              call 0043F70E
:0043493F 6A01                    push 00000001
:00434941 6A01                    push 00000001
:00434943 6A00                    push 00000000
:00434945 6A00                    push 00000000
:00434947 B9F05D4B00              mov ecx, 004B5DF0
:0043494C E83E2E0200              call 0045778F
:00434951 EB51                    jmp 004349A4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434891(C)
|
:00434953 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"ĺˡ
Ҿˡ"
                                  |
:00434955 6834DA4800              push 0048DA34
:0043495A B9F05D4B00              mov ecx, 004B5DF0
:0043495F E8F94C0200              call 0045965D
:00434964 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"𡭡
ô"
                                  |
:00434969 6860DA4800              push 0048DA60
:0043496E B9F05D4B00              mov ecx, 004B5DF0
:00434973 E8E54C0200              call 0045965D
:00434978 6A01                    push 00000001
:0043497A 6A0A                    push 0000000A
:0043497C B9B0694B00              mov ecx, 004B69B0
:00434981 E8F4FC0300              call 0047467A
:00434986 68D0070000              push 000007D0
:0043498B B970074B00              mov ecx, 004B0770
:00434990 E85892FDFF              call 0040DBED

* Possible StringData Ref from Data Obj ->"õ˻ƽ2000"
                                  |
:00434995 6888DA4800              push 0048DA88
:0043499A 6A02                    push 00000002
:0043499C E8F8ACFFFF              call 0042F699
:004349A1 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434951(U)
|
:004349A4 E972030000              jmp 00434D1B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043480F(C)
|
:004349A9 33C9                    xor ecx, ecx
:004349AB 8A0D102C4B00            mov cl, byte ptr [004B2C10]
:004349B1 83F902                  cmp ecx, 00000002
:004349B4 0F8594010000            jne 00434B4E
:004349BA 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ˣܴˡ
ǰѧķ
ֱǿ"
                                        ->"һ㡣"
                                  |
:004349BF 689CDA4800              push 0048DA9C
:004349C4 B9F05D4B00              mov ecx, 004B5DF0
:004349C9 E88F4C0200              call 0045965D
:004349CE 6A01                    push 00000001
:004349D0 6A01                    push 00000001
:004349D2 6A01                    push 00000001
:004349D4 689D000000              push 0000009D
:004349D9 B9F05D4B00              mov ecx, 004B5DF0
:004349DE E8AC2D0200              call 0045778F
:004349E3 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"Lvء"
                                  |
:004349E8 68D4DA4800              push 0048DAD4
:004349ED B9F05D4B00              mov ecx, 004B5DF0
:004349F2 E8664C0200              call 0045965D
:004349F7 6A01                    push 00000001
:004349F9 6A01                    push 00000001
:004349FB 6A00                    push 00000000
:004349FD 689D000000              push 0000009D
:00434A02 B9F05D4B00              mov ecx, 004B5DF0
:00434A07 E8832D0200              call 0045778F
:00434A0C 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ҰLvɣ
ܴˣΣ"
                                  |
:00434A11 68FCDA4800              push 0048DAFC
:00434A16 B9F05D4B00              mov ecx, 004B5DF0
:00434A1B E83D4C0200              call 0045965D
:00434A20 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"1.֮
2.ûҪ"
                                  |
:00434A22 6824DB4800              push 0048DB24
:00434A27 E8E693FFFF              call 0042DE12
:00434A2C 83C408                  add esp, 00000008
:00434A2F 25FF000000              and eax, 000000FF
:00434A34 85C0                    test eax, eax
:00434A36 0F85BC000000            jne 00434AF8
:00434A3C 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"֮ã
ˡ"
                                  |
:00434A3E 6844DB4800              push 0048DB44
:00434A43 B9F05D4B00              mov ecx, 004B5DF0
:00434A48 E8104C0200              call 0045965D
:00434A4D 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ðɣҪʩ
٣"
                                  |
:00434A52 6860DB4800              push 0048DB60
:00434A57 B9F05D4B00              mov ecx, 004B5DF0
:00434A5C E8FC4B0200              call 0045965D
:00434A61 6A01                    push 00000001
:00434A63 6A01                    push 00000001
:00434A65 6A05                    push 00000005
:00434A67 689D000000              push 0000009D
:00434A6C B9F05D4B00              mov ecx, 004B5DF0
:00434A71 E8192D0200              call 0045778F
:00434A76 6A01                    push 00000001
:00434A78 6A27                    push 00000027
:00434A7A B9B0694B00              mov ecx, 004B69B0
:00434A7F E8F6FB0300              call 0047467A
:00434A84 6A0A                    push 0000000A
:00434A86 B9181B4B00              mov ecx, 004B1B18
:00434A8B E8B0E8FCFF              call 00403340
:00434A90 E84B7AFFFF              call 0042C4E0
:00434A95 6A01                    push 00000001
:00434A97 6A01                    push 00000001
:00434A99 6A00                    push 00000000
:00434A9B 689D000000              push 0000009D
:00434AA0 B9F05D4B00              mov ecx, 004B5DF0
:00434AA5 E8E52C0200              call 0045778F
:00434AAA 6A01                    push 00000001
:00434AAC 6A02                    push 00000002
:00434AAE B9681B4A00              mov ecx, 004A1B68
:00434AB3 E80029FDFF              call 004073B8
:00434AB8 B9681B4A00              mov ecx, 004A1B68
:00434ABD E85927FDFF              call 0040721B
:00434AC2 50                      push eax
:00434AC3 8B0D0C2C4B00            mov ecx, dword ptr [004B2C0C]
:00434AC9 E8FFAB0000              call 0043F6CD
:00434ACE B9681B4A00              mov ecx, 004A1B68
:00434AD3 E87227FDFF              call 0040724A
:00434AD8 50                      push eax
:00434AD9 8B0D0C2C4B00            mov ecx, dword ptr [004B2C0C]
:00434ADF E82AAC0000              call 0043F70E
:00434AE4 6A01                    push 00000001
:00434AE6 6A01                    push 00000001
:00434AE8 6A00                    push 00000000
:00434AEA 6A00                    push 00000000
:00434AEC B9F05D4B00              mov ecx, 004B5DF0
:00434AF1 E8992C0200              call 0045778F
:00434AF6 EB51                    jmp 00434B49

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434A36(C)
|
:00434AF8 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"ĺˡ
Ҿˡ"
                                  |
:00434AFA 6878DB4800              push 0048DB78
:00434AFF B9F05D4B00              mov ecx, 004B5DF0
:00434B04 E8544B0200              call 0045965D
:00434B09 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"𡭡
ô"
                                  |
:00434B0E 68A4DB4800              push 0048DBA4
:00434B13 B9F05D4B00              mov ecx, 004B5DF0
:00434B18 E8404B0200              call 0045965D
:00434B1D 6A01                    push 00000001
:00434B1F 6A0A                    push 0000000A
:00434B21 B9B0694B00              mov ecx, 004B69B0
:00434B26 E84FFB0300              call 0047467A
:00434B2B 68A00F0000              push 00000FA0
:00434B30 B970074B00              mov ecx, 004B0770
:00434B35 E8B390FDFF              call 0040DBED

* Possible StringData Ref from Data Obj ->"õ˻ƽ4000"
                                  |
:00434B3A 68CCDB4800              push 0048DBCC
:00434B3F 6A02                    push 00000002
:00434B41 E853ABFFFF              call 0042F699
:00434B46 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434AF6(U)
|
:00434B49 E9CD010000              jmp 00434D1B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004349B4(C)
|
:00434B4E 33D2                    xor edx, edx
:00434B50 8A15102C4B00            mov dl, byte ptr [004B2C10]
:00434B56 83FA03                  cmp edx, 00000003
:00434B59 0F8CBC010000            jl 00434D1B
:00434B5F 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ˣܴˡ
ǰѧķ
ڱ"
                                        ->"øǿˡ"
                                  |
:00434B64 68E0DB4800              push 0048DBE0
:00434B69 B9F05D4B00              mov ecx, 004B5DF0
:00434B6E E8EA4A0200              call 0045965D
:00434B73 6A01                    push 00000001
:00434B75 6A01                    push 00000001
:00434B77 6A01                    push 00000001
:00434B79 689D000000              push 0000009D
:00434B7E B9F05D4B00              mov ecx, 004B5DF0
:00434B83 E8072C0200              call 0045778F
:00434B88 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ҿԵLvˡ"
                                  |
:00434B8D 681CDC4800              push 0048DC1C
:00434B92 B9F05D4B00              mov ecx, 004B5DF0
:00434B97 E8C14A0200              call 0045965D
:00434B9C 6A01                    push 00000001
:00434B9E 6A01                    push 00000001
:00434BA0 6A00                    push 00000000
:00434BA2 689D000000              push 0000009D
:00434BA7 B9F05D4B00              mov ecx, 004B5DF0
:00434BAC E8DE2B0200              call 0045778F
:00434BB1 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"֪Σܴˡ
ϣҸ"
                                        ->"ȼ"
                                  |
:00434BB6 6840DC4800              push 0048DC40
:00434BBB B9F05D4B00              mov ecx, 004B5DF0
:00434BC0 E8984A0200              call 0045965D
:00434BC5 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"1.ϣ
2.ϣ
3.ûҪ"
                                  |
:00434BC7 6874DC4800              push 0048DC74
:00434BCC E84192FFFF              call 0042DE12
:00434BD1 83C408                  add esp, 00000008
:00434BD4 8845FC                  mov byte ptr [ebp-04], al
:00434BD7 8A45FC                  mov al, byte ptr [ebp-04]
:00434BDA 8845F8                  mov byte ptr [ebp-08], al
:00434BDD 807DF800                cmp byte ptr [ebp-08], 00
:00434BE1 0F8234010000            jb 00434D1B
:00434BE7 807DF801                cmp byte ptr [ebp-08], 01
:00434BEB 760F                    jbe 00434BFC
:00434BED 807DF802                cmp byte ptr [ebp-08], 02
:00434BF1 0F84D3000000            je 00434CCA
:00434BF7 E91F010000              jmp 00434D1B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434BEB(C)
|
:00434BFC 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"֮ã
ˡ"
                                  |
:00434BFE 68A4DC4800              push 0048DCA4
:00434C03 B9F05D4B00              mov ecx, 004B5DF0
:00434C08 E8504A0200              call 0045965D
:00434C0D 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ðɣҪʩ
٣"
                                  |
:00434C12 68C0DC4800              push 0048DCC0
:00434C17 B9F05D4B00              mov ecx, 004B5DF0
:00434C1C E83C4A0200              call 0045965D
:00434C21 6A01                    push 00000001
:00434C23 6A01                    push 00000001
:00434C25 6A05                    push 00000005
:00434C27 689D000000              push 0000009D
:00434C2C B9F05D4B00              mov ecx, 004B5DF0
:00434C31 E8592B0200              call 0045778F
:00434C36 6A01                    push 00000001
:00434C38 6A27                    push 00000027
:00434C3A B9B0694B00              mov ecx, 004B69B0
:00434C3F E836FA0300              call 0047467A
:00434C44 6A0A                    push 0000000A
:00434C46 B9181B4B00              mov ecx, 004B1B18
:00434C4B E8F0E6FCFF              call 00403340
:00434C50 E88B78FFFF              call 0042C4E0
:00434C55 6A01                    push 00000001
:00434C57 6A01                    push 00000001
:00434C59 6A00                    push 00000000
:00434C5B 689D000000              push 0000009D
:00434C60 B9F05D4B00              mov ecx, 004B5DF0
:00434C65 E8252B0200              call 0045778F
:00434C6A 6A01                    push 00000001
:00434C6C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00434C6F 81E1FF000000            and ecx, 000000FF
:00434C75 F7D9                    neg ecx
:00434C77 1BC9                    sbb ecx, ecx
:00434C79 83E1FD                  and ecx, FFFFFFFD
:00434C7C 83C106                  add ecx, 00000006
:00434C7F 51                      push ecx
:00434C80 B9681B4A00              mov ecx, 004A1B68
:00434C85 E82E27FDFF              call 004073B8
:00434C8A B9681B4A00              mov ecx, 004A1B68
:00434C8F E88725FDFF              call 0040721B
:00434C94 50                      push eax
:00434C95 8B0D0C2C4B00            mov ecx, dword ptr [004B2C0C]
:00434C9B E82DAA0000              call 0043F6CD
:00434CA0 B9681B4A00              mov ecx, 004A1B68
:00434CA5 E8A025FDFF              call 0040724A
:00434CAA 50                      push eax
:00434CAB 8B0D0C2C4B00            mov ecx, dword ptr [004B2C0C]
:00434CB1 E858AA0000              call 0043F70E
:00434CB6 6A01                    push 00000001
:00434CB8 6A01                    push 00000001
:00434CBA 6A00                    push 00000000
:00434CBC 6A00                    push 00000000
:00434CBE B9F05D4B00              mov ecx, 004B5DF0
:00434CC3 E8C72A0200              call 0045778F
:00434CC8 EB51                    jmp 00434D1B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434BF1(C)
|
:00434CCA 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"ĺˡ
Ҿˡ"
                                  |
:00434CCC 68D8DC4800              push 0048DCD8
:00434CD1 B9F05D4B00              mov ecx, 004B5DF0
:00434CD6 E882490200              call 0045965D
:00434CDB 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"𡭡
ô"
                                  |
:00434CE0 6804DD4800              push 0048DD04
:00434CE5 B9F05D4B00              mov ecx, 004B5DF0
:00434CEA E86E490200              call 0045965D
:00434CEF 6A01                    push 00000001
:00434CF1 6A0A                    push 0000000A
:00434CF3 B9B0694B00              mov ecx, 004B69B0
:00434CF8 E87DF90300              call 0047467A
:00434CFD 6810270000              push 00002710
:00434D02 B970074B00              mov ecx, 004B0770
:00434D07 E8E18EFDFF              call 0040DBED

* Possible StringData Ref from Data Obj ->"õ˻ƽ10000"
                                  |
:00434D0C 682CDD4800              push 0048DD2C
:00434D11 6A02                    push 00000002
:00434D13 E881A9FFFF              call 0042F699
:00434D18 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004349A4(U), :00434B49(U), :00434B59(C), :00434BE1(C), :00434BF7(U)
|:00434CC8(U)
|
:00434D1B 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"ҷǳڴܴ˽󡭡
߳Լ"
                                        ->""
                                  |
:00434D20 6840DD4800              push 0048DD40
:00434D25 B9F05D4B00              mov ecx, 004B5DF0
:00434D2A E82E490200              call 0045965D
:00434D2F 8BE5                    mov esp, ebp
:00434D31 5D                      pop ebp
:00434D32 C3                      ret



* Referenced by a CALL at Address:
|:004333B7   
|
:00434D33 55                      push ebp
:00434D34 8BEC                    mov ebp, esp
:00434D36 51                      push ecx
:00434D37 6A01                    push 00000001
:00434D39 6A01                    push 00000001
:00434D3B 6A00                    push 00000000
:00434D3D 6A00                    push 00000000
:00434D3F 68FFFF0000              push 0000FFFF
:00434D44 689D000000              push 0000009D
:00434D49 B9F05D4B00              mov ecx, 004B5DF0
:00434D4E E8D5260200              call 00457428
:00434D53 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"˵
û뵽Ȼ˱ͼ
"
                                        ->"˾ȡ"
                                  |
:00434D58 6874DD4800              push 0048DD74
:00434D5D B9F05D4B00              mov ecx, 004B5DF0
:00434D62 E8F6480200              call 0045965D
:00434D67 6A01                    push 00000001
:00434D69 6A01                    push 00000001
:00434D6B 6A00                    push 00000000
:00434D6D 6A02                    push 00000002
:00434D6F 68FFFF0000              push 0000FFFF
:00434D74 689D000000              push 0000009D
:00434D79 B9F05D4B00              mov ecx, 004B5DF0
:00434D7E E8A5260200              call 00457428
:00434D83 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"չʾͼʱ̣
ڵˡ"
                                  |
:00434D88 68ACDD4800              push 0048DDAC
:00434D8D B9F05D4B00              mov ecx, 004B5DF0
:00434D92 E8C6480200              call 0045965D
:00434D97 6A01                    push 00000001
:00434D99 6A01                    push 00000001
:00434D9B 6A02                    push 00000002
:00434D9D 689D000000              push 0000009D
:00434DA2 B9F05D4B00              mov ecx, 004B5DF0
:00434DA7 E8E3290200              call 0045778F
:00434DAC 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"Ҳֻеͼ
ͼŻ"
                                        ->"ᷢӡ"
                                  |
:00434DB1 68DCDD4800              push 0048DDDC
:00434DB6 B9F05D4B00              mov ecx, 004B5DF0
:00434DBB E89D480200              call 0045965D
:00434DC0 6A01                    push 00000001
:00434DC2 6A01                    push 00000001
:00434DC4 6A01                    push 00000001
:00434DC6 689D000000              push 0000009D
:00434DCB B9F05D4B00              mov ecx, 004B5DF0
:00434DD0 E8BA290200              call 0045778F
:00434DD5 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"˿Եõȫ"
                                  |
:00434DDA 6814DE4800              push 0048DE14
:00434DDF B9F05D4B00              mov ecx, 004B5DF0
:00434DE4 E874480200              call 0045965D
:00434DE9 6A01                    push 00000001
:00434DEB 6A01                    push 00000001
:00434DED 6A00                    push 00000000
:00434DEF 689D000000              push 0000009D
:00434DF4 B9F05D4B00              mov ecx, 004B5DF0
:00434DF9 E891290200              call 0045778F
:00434DFE 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"֪Σܴˡ
ϣЩ"
                                        ->""
                                  |
:00434E03 6830DE4800              push 0048DE30
:00434E08 B9F05D4B00              mov ecx, 004B5DF0
:00434E0D E84B480200              call 0045965D
:00434E12 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"1.ǳڽ
2.ҪЩ"
                                  |
:00434E14 6860DE4800              push 0048DE60
:00434E19 E8F48FFFFF              call 0042DE12
:00434E1E 83C408                  add esp, 00000008
:00434E21 25FF000000              and eax, 000000FF
:00434E26 85C0                    test eax, eax
:00434E28 0F8501010000            jne 00434F2F
:00434E2E 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"มĳڽܡ"
                                  |
:00434E30 6880DE4800              push 0048DE80
:00434E35 B9F05D4B00              mov ecx, 004B5DF0
:00434E3A E81E480200              call 0045965D
:00434E3F 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"̫ˡ
ôǽŵʱ̣
ɣ"
                                        ->"ͼ"
                                  |
:00434E44 6894DE4800              push 0048DE94
:00434E49 B9F05D4B00              mov ecx, 004B5DF0
:00434E4E E80A480200              call 0045965D
:00434E53 6A01                    push 00000001
:00434E55 6A01                    push 00000001
:00434E57 6A05                    push 00000005
:00434E59 689D000000              push 0000009D
:00434E5E B9F05D4B00              mov ecx, 004B5DF0
:00434E63 E827290200              call 0045778F
:00434E68 6A01                    push 00000001
:00434E6A 6A27                    push 00000027
:00434E6C B9B0694B00              mov ecx, 004B69B0
:00434E71 E804F80300              call 0047467A
:00434E76 6A14                    push 00000014
:00434E78 B9181B4B00              mov ecx, 004B1B18
:00434E7D E8BEE4FCFF              call 00403340
:00434E82 E85976FFFF              call 0042C4E0
:00434E87 6A01                    push 00000001
:00434E89 6A01                    push 00000001
:00434E8B 6A00                    push 00000000
:00434E8D 689D000000              push 0000009D
:00434E92 B9F05D4B00              mov ecx, 004B5DF0
:00434E97 E8F3280200              call 0045778F
:00434E9C C645FC00                mov [ebp-04], 00
:00434EA0 EB08                    jmp 00434EAA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434F0E(U)
|
:00434EA2 8A45FC                  mov al, byte ptr [ebp-04]
:00434EA5 0401                    add al, 01
:00434EA7 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434EA0(U)
|
:00434EAA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00434EAD 81E1FF000000            and ecx, 000000FF
:00434EB3 83F968                  cmp ecx, 00000068
:00434EB6 7D58                    jge 00434F10
:00434EB8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00434EBB 81E1FF000000            and ecx, 000000FF
:00434EC1 6BC919                  imul ecx, 00000019
:00434EC4 81C140114A00            add ecx, 004A1140
:00434ECA E83147FDFF              call 00409600
:00434ECF 85C0                    test eax, eax
:00434ED1 743B                    je 00434F0E
:00434ED3 6A00                    push 00000000
:00434ED5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00434ED8 81E1FF000000            and ecx, 000000FF
:00434EDE 6BC919                  imul ecx, 00000019
:00434EE1 81C140114A00            add ecx, 004A1140
:00434EE7 E8FE77FDFF              call 0040C6EA
:00434EEC 25FF000000              and eax, 000000FF
:00434EF1 83E802                  sub eax, 00000002
:00434EF4 F7D8                    neg eax
:00434EF6 1BC0                    sbb eax, eax
:00434EF8 2404                    and al, 04
:00434EFA 05FF000000              add eax, 000000FF
:00434EFF 50                      push eax
:00434F00 8A55FC                  mov dl, byte ptr [ebp-04]
:00434F03 52                      push edx
:00434F04 B970074B00              mov ecx, 004B0770
:00434F09 E88E88FDFF              call 0040D79C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434ED1(C)
|
:00434F0E EB92                    jmp 00434EA2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434EB6(C)
|
:00434F10 6A01                    push 00000001
:00434F12 6A0E                    push 0000000E
:00434F14 B9B0694B00              mov ecx, 004B69B0
:00434F19 E85CF70300              call 0047467A

* Possible StringData Ref from Data Obj ->"õб"
                                  |
:00434F1E 68CCDE4800              push 0048DECC
:00434F23 6A02                    push 00000002
:00434F25 E86FA7FFFF              call 0042F699
:00434F2A 83C408                  add esp, 00000008
:00434F2D EB51                    jmp 00434F80

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434E28(C)
|
:00434F2F 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"ĺˡ
Ҿˡ"
                                  |
:00434F31 68E0DE4800              push 0048DEE0
:00434F36 B9F05D4B00              mov ecx, 004B5DF0
:00434F3B E81D470200              call 0045965D
:00434F40 689D000000              push 0000009D

* Possible StringData Ref from Data Obj ->"𡭡
ô"
                                  |
:00434F45 680CDF4800              push 0048DF0C
:00434F4A B9F05D4B00              mov ecx, 004B5DF0
:00434F4F E809470200              call 0045965D
:00434F54 6A01                    push 00000001
:00434F56 6A0A                    push 0000000A
:00434F58 B9B0694B00              mov ecx, 004B69B0
:00434F5D E818F70300              call 0047467A
:00434F62 6830750000              push 00007530
:00434F67 B970074B00              mov ecx, 004B0770
:00434F6C E87C8CFDFF              call 0040DBED

* Possible StringData Ref from Data Obj ->"õ˻ƽ30000"
                                  |
:00434F71 6834DF4800              push 0048DF34
:00434F76 6A02                    push 00000002
:00434F78 E81CA7FFFF              call 0042F699
:00434F7D 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00434F2D(U)
|
:00434F80 8BE5                    mov esp, ebp
:00434F82 5D                      pop ebp
:00434F83 C3                      ret



* Referenced by a CALL at Address:
|:0043335C   
|
:00434F84 55                      push ebp
:00434F85 8BEC                    mov ebp, esp
:00434F87 83EC10                  sub esp, 00000010
:00434F8A C745F090474A00          mov [ebp-10], 004A4790
:00434F91 C745F8681B4A00          mov [ebp-08], 004A1B68
:00434F98 C745FC68244A00          mov [ebp-04], 004A2468
:00434F9F 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00434FA2 E8352B0400              call 00477ADC
:00434FA7 25FF000000              and eax, 000000FF
:00434FAC 6BC024                  imul eax, 00000024
:00434FAF 05502C4B00              add eax, 004B2C50
:00434FB4 A3142C4B00              mov dword ptr [004B2C14], eax
:00434FB9 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00434FBC E81B2B0400              call 00477ADC
:00434FC1 25FF000000              and eax, 000000FF
:00434FC6 6BC024                  imul eax, 00000024
:00434FC9 05502C4B00              add eax, 004B2C50
:00434FCE A30C2C4B00              mov dword ptr [004B2C0C], eax
:00434FD3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00434FD6 E8012B0400              call 00477ADC
:00434FDB 25FF000000              and eax, 000000FF
:00434FE0 6BC024                  imul eax, 00000024
:00434FE3 05502C4B00              add eax, 004B2C50
:00434FE8 A3042C4B00              mov dword ptr [004B2C04], eax
:00434FED 8B0D142C4B00            mov ecx, dword ptr [004B2C14]
:00434FF3 E868E3FCFF              call 00403360
:00434FF8 50                      push eax
:00434FF9 B9182C4B00              mov ecx, 004B2C18
:00434FFE E89D15FDFF              call 004065A0
:00435003 C605102C4B0000          mov byte ptr [004B2C10], 00
:0043500A C705082C4B0001000000    mov dword ptr [004B2C08], 00000001
:00435014 C645F400                mov [ebp-0C], 00
:00435018 EB08                    jmp 00435022

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435051(U)
|
:0043501A 8A45F4                  mov al, byte ptr [ebp-0C]
:0043501D 0401                    add al, 01
:0043501F 8845F4                  mov byte ptr [ebp-0C], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435018(U)
|
:00435022 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00435025 81E1FF000000            and ecx, 000000FF
:0043502B 83F903                  cmp ecx, 00000003
:0043502E 7D23                    jge 00435053
:00435030 8A55F4                  mov dl, byte ptr [ebp-0C]
:00435033 52                      push edx
:00435034 E84B52FEFF              call 0041A284
:00435039 83C404                  add esp, 00000004
:0043503C 25FF000000              and eax, 000000FF
:00435041 85C0                    test eax, eax
:00435043 740C                    je 00435051
:00435045 A0102C4B00              mov al, byte ptr [004B2C10]
:0043504A 0401                    add al, 01
:0043504C A2102C4B00              mov byte ptr [004B2C10], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435043(C)
|
:00435051 EBC7                    jmp 0043501A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043502E(C)
|
:00435053 C645F400                mov [ebp-0C], 00
:00435057 EB09                    jmp 00435062

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004350B4(U)
|
:00435059 8A4DF4                  mov cl, byte ptr [ebp-0C]
:0043505C 80C101                  add cl, 01
:0043505F 884DF4                  mov byte ptr [ebp-0C], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435057(U)
|
:00435062 8B55F4                  mov edx, dword ptr [ebp-0C]
:00435065 81E2FF000000            and edx, 000000FF
:0043506B 83FA68                  cmp edx, 00000068
:0043506E 7D46                    jge 004350B6
:00435070 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00435073 81E1FF000000            and ecx, 000000FF
:00435079 6BC919                  imul ecx, 00000019
:0043507C 81C140114A00            add ecx, 004A1140
:00435082 E87945FDFF              call 00409600
:00435087 85C0                    test eax, eax
:00435089 7429                    je 004350B4
:0043508B 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043508E 25FF000000              and eax, 000000FF
:00435093 83C003                  add eax, 00000003
:00435096 50                      push eax
:00435097 E8E851FEFF              call 0041A284
:0043509C 83C404                  add esp, 00000004
:0043509F 25FF000000              and eax, 000000FF
:004350A4 85C0                    test eax, eax
:004350A6 750C                    jne 004350B4
:004350A8 C705082C4B0000000000    mov dword ptr [004B2C08], 00000000
:004350B2 EB02                    jmp 004350B6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00435089(C), :004350A6(C)
|
:004350B4 EBA3                    jmp 00435059

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043506E(C), :004350B2(U)
|
:004350B6 8BE5                    mov esp, ebp
:004350B8 5D                      pop ebp
:004350B9 C3                      ret


:004350BA CC                      int 03
:004350BB CC                      int 03
:004350BC CC                      int 03
:004350BD CC                      int 03
:004350BE CC                      int 03
:004350BF CC                      int 03

* Referenced by a CALL at Addresses:
|:00433EF9   , :0043D763   , :0043E1DE   
|
:004350C0 55                      push ebp
:004350C1 8BEC                    mov ebp, esp
:004350C3 51                      push ecx
:004350C4 894DFC                  mov dword ptr [ebp-04], ecx
:004350C7 8B4510                  mov eax, dword ptr [ebp+10]
:004350CA 50                      push eax
:004350CB 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004350CE 51                      push ecx
:004350CF 8B5508                  mov edx, dword ptr [ebp+08]
:004350D2 8A4201                  mov al, byte ptr [edx+01]
:004350D5 50                      push eax
:004350D6 8B4D08                  mov ecx, dword ptr [ebp+08]
:004350D9 8A11                    mov dl, byte ptr [ecx]
:004350DB 52                      push edx
:004350DC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004350DF E81FDA0000              call 00442B03
:004350E4 8BE5                    mov esp, ebp
:004350E6 5D                      pop ebp
:004350E7 C20C00                  ret 000C


:004350EA CC                      int 03
:004350EB CC                      int 03
:004350EC CC                      int 03
:004350ED CC                      int 03
:004350EE CC                      int 03
:004350EF CC                      int 03

* Referenced by a CALL at Addresses:
|:00433A1F   , :00433B0A   , :0043D63B   , :0043D995   , :0044150F   
|:004416F0   
|
:004350F0 55                      push ebp
:004350F1 8BEC                    mov ebp, esp
:004350F3 51                      push ecx
:004350F4 894DFC                  mov dword ptr [ebp-04], ecx
:004350F7 8B45FC                  mov eax, dword ptr [ebp-04]
:004350FA 8B4D08                  mov ecx, dword ptr [ebp+08]
:004350FD 894868                  mov dword ptr [eax+68], ecx
:00435100 8BE5                    mov esp, ebp
:00435102 5D                      pop ebp
:00435103 C20400                  ret 0004


:00435106 CC                      int 03
:00435107 CC                      int 03
:00435108 CC                      int 03
:00435109 CC                      int 03
:0043510A CC                      int 03
:0043510B CC                      int 03
:0043510C CC                      int 03
:0043510D CC                      int 03
:0043510E CC                      int 03
:0043510F CC                      int 03

* Referenced by a CALL at Addresses:
|:004340C2   , :0043E0EB   
|
:00435110 55                      push ebp
:00435111 8BEC                    mov ebp, esp
:00435113 51                      push ecx
:00435114 894DFC                  mov dword ptr [ebp-04], ecx
:00435117 8B45FC                  mov eax, dword ptr [ebp-04]
:0043511A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043511D 894838                  mov dword ptr [eax+38], ecx
:00435120 8BE5                    mov esp, ebp
:00435122 5D                      pop ebp
:00435123 C20400                  ret 0004


:00435126 CC                      int 03
:00435127 CC                      int 03
:00435128 CC                      int 03
:00435129 CC                      int 03
:0043512A CC                      int 03
:0043512B CC                      int 03
:0043512C CC                      int 03
:0043512D CC                      int 03
:0043512E CC                      int 03
:0043512F CC                      int 03

* Referenced by a CALL at Addresses:
|:004340CE   , :0043E111   
|
:00435130 55                      push ebp
:00435131 8BEC                    mov ebp, esp
:00435133 51                      push ecx
:00435134 894DFC                  mov dword ptr [ebp-04], ecx
:00435137 8B45FC                  mov eax, dword ptr [ebp-04]
:0043513A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043513D 894840                  mov dword ptr [eax+40], ecx
:00435140 8BE5                    mov esp, ebp
:00435142 5D                      pop ebp
:00435143 C20400                  ret 0004


:00435146 CC                      int 03
:00435147 CC                      int 03
:00435148 CC                      int 03
:00435149 CC                      int 03
:0043514A CC                      int 03
:0043514B CC                      int 03
:0043514C CC                      int 03
:0043514D CC                      int 03
:0043514E CC                      int 03
:0043514F CC                      int 03
:00435150 55                      push ebp
:00435151 8BEC                    mov ebp, esp
:00435153 E802000000              call 0043515A
:00435158 5D                      pop ebp
:00435159 C3                      ret



* Referenced by a CALL at Address:
|:00435153   
|
:0043515A 55                      push ebp
:0043515B 8BEC                    mov ebp, esp
:0043515D B9202C4B00              mov ecx, 004B2C20
:00435162 E8A9A50200              call 0045F710
:00435167 5D                      pop ebp
:00435168 C3                      ret


:00435169 55                      push ebp
:0043516A 8BEC                    mov ebp, esp
:0043516C E802000000              call 00435173
:00435171 5D                      pop ebp
:00435172 C3                      ret



* Referenced by a CALL at Address:
|:0043516C   
|
:00435173 55                      push ebp
:00435174 8BEC                    mov ebp, esp
:00435176 B9382C4B00              mov ecx, 004B2C38
:0043517B E890A50200              call 0045F710
:00435180 5D                      pop ebp
:00435181 C3                      ret



* Referenced by a CALL at Addresses:
|:004351D0   , :004559FC   
|
:00435182 55                      push ebp
:00435183 8BEC                    mov ebp, esp
:00435185 83EC08                  sub esp, 00000008
:00435188 8B4508                  mov eax, dword ptr [ebp+08]
:0043518B 25FF000000              and eax, 000000FF
:00435190 83F812                  cmp eax, 00000012
:00435193 7C17                    jl 004351AC
:00435195 8B4D08                  mov ecx, dword ptr [ebp+08]
:00435198 81E1FF000000            and ecx, 000000FF
:0043519E 83F916                  cmp ecx, 00000016
:004351A1 7F09                    jg 004351AC
:004351A3 C745F801000000          mov [ebp-08], 00000001
:004351AA EB07                    jmp 004351B3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00435193(C), :004351A1(C)
|
:004351AC C745F800000000          mov [ebp-08], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004351AA(U)
|
:004351B3 8B55F8                  mov edx, dword ptr [ebp-08]
:004351B6 8955FC                  mov dword ptr [ebp-04], edx
:004351B9 8B45FC                  mov eax, dword ptr [ebp-04]
:004351BC 8BE5                    mov esp, ebp
:004351BE 5D                      pop ebp
:004351BF C3                      ret



* Referenced by a CALL at Addresses:
|:0043A442   , :0043CE4B   , :0044DB52   
|
:004351C0 55                      push ebp
:004351C1 8BEC                    mov ebp, esp
:004351C3 8B4508                  mov eax, dword ptr [ebp+08]
:004351C6 50                      push eax
:004351C7 E8C5070000              call 00435991
:004351CC 83C404                  add esp, 00000004
:004351CF 50                      push eax
:004351D0 E8ADFFFFFF              call 00435182
:004351D5 83C404                  add esp, 00000004
:004351D8 5D                      pop ebp
:004351D9 C3                      ret



* Referenced by a CALL at Addresses:
|:0043583B   , :0045764D   
|
:004351DA 55                      push ebp
:004351DB 8BEC                    mov ebp, esp
:004351DD 83EC1C                  sub esp, 0000001C
:004351E0 8B4508                  mov eax, dword ptr [ebp+08]
:004351E3 25FF000000              and eax, 000000FF
:004351E8 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004351EB 81E1FF000000            and ecx, 000000FF
:004351F1 3BC1                    cmp eax, ecx
:004351F3 7527                    jne 0043521C
:004351F5 8B4D08                  mov ecx, dword ptr [ebp+08]
:004351F8 81E1FF000000            and ecx, 000000FF
:004351FE 6BC924                  imul ecx, 00000024
:00435201 81C1502C4B00            add ecx, 004B2C50
:00435207 E814910000              call 0043E320
:0043520C 25FF000000              and eax, 000000FF
:00435211 8945F4                  mov dword ptr [ebp-0C], eax
:00435214 8B45F4                  mov eax, dword ptr [ebp-0C]
:00435217 E909060000              jmp 00435825

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004351F3(C)
|
:0043521C 8B5508                  mov edx, dword ptr [ebp+08]
:0043521F 81E2FF000000            and edx, 000000FF
:00435225 81FAFF000000            cmp edx, 000000FF
:0043522B 7527                    jne 00435254
:0043522D 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00435230 81E1FF000000            and ecx, 000000FF
:00435236 6BC924                  imul ecx, 00000024
:00435239 81C1502C4B00            add ecx, 004B2C50
:0043523F E8DC900000              call 0043E320
:00435244 25FF000000              and eax, 000000FF
:00435249 8945F4                  mov dword ptr [ebp-0C], eax
:0043524C 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043524F E9D1050000              jmp 00435825

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043522B(C)
|
:00435254 8B450C                  mov eax, dword ptr [ebp+0C]
:00435257 25FF000000              and eax, 000000FF
:0043525C 3DFF000000              cmp eax, 000000FF
:00435261 7527                    jne 0043528A
:00435263 8B4D08                  mov ecx, dword ptr [ebp+08]
:00435266 81E1FF000000            and ecx, 000000FF
:0043526C 6BC924                  imul ecx, 00000024
:0043526F 81C1502C4B00            add ecx, 004B2C50
:00435275 E8A6900000              call 0043E320
:0043527A 25FF000000              and eax, 000000FF
:0043527F 8945F4                  mov dword ptr [ebp-0C], eax
:00435282 8B45F4                  mov eax, dword ptr [ebp-0C]
:00435285 E99B050000              jmp 00435825

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435261(C)
|
:0043528A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043528D 81E1FF000000            and ecx, 000000FF
:00435293 6BC924                  imul ecx, 00000024
:00435296 81C1502C4B00            add ecx, 004B2C50
:0043529C E8BFE0FCFF              call 00403360
:004352A1 8A08                    mov cl, byte ptr [eax]
:004352A3 884DEC                  mov byte ptr [ebp-14], cl
:004352A6 8B4D08                  mov ecx, dword ptr [ebp+08]
:004352A9 81E1FF000000            and ecx, 000000FF
:004352AF 6BC924                  imul ecx, 00000024
:004352B2 81C1502C4B00            add ecx, 004B2C50
:004352B8 E8A3E0FCFF              call 00403360
:004352BD 8A5001                  mov dl, byte ptr [eax+01]
:004352C0 8855FC                  mov byte ptr [ebp-04], dl
:004352C3 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004352C6 81E1FF000000            and ecx, 000000FF
:004352CC 6BC924                  imul ecx, 00000024
:004352CF 81C1502C4B00            add ecx, 004B2C50
:004352D5 E886E0FCFF              call 00403360
:004352DA 8A00                    mov al, byte ptr [eax]
:004352DC 8845E8                  mov byte ptr [ebp-18], al
:004352DF 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004352E2 81E1FF000000            and ecx, 000000FF
:004352E8 6BC924                  imul ecx, 00000024
:004352EB 81C1502C4B00            add ecx, 004B2C50
:004352F1 E86AE0FCFF              call 00403360
:004352F6 8A4801                  mov cl, byte ptr [eax+01]
:004352F9 884DE4                  mov byte ptr [ebp-1C], cl
:004352FC 8B55FC                  mov edx, dword ptr [ebp-04]
:004352FF 81E2FF000000            and edx, 000000FF
:00435305 8B45E4                  mov eax, dword ptr [ebp-1C]
:00435308 25FF000000              and eax, 000000FF
:0043530D 3BD0                    cmp edx, eax
:0043530F 0F8E27020000            jle 0043553C
:00435315 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00435318 81E1FF000000            and ecx, 000000FF
:0043531E 8B55E4                  mov edx, dword ptr [ebp-1C]
:00435321 81E2FF000000            and edx, 000000FF
:00435327 2BCA                    sub ecx, edx
:00435329 884DF0                  mov byte ptr [ebp-10], cl
:0043532C 8B45EC                  mov eax, dword ptr [ebp-14]
:0043532F 25FF000000              and eax, 000000FF
:00435334 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00435337 81E1FF000000            and ecx, 000000FF
:0043533D 3BC1                    cmp eax, ecx
:0043533F 754A                    jne 0043538B
:00435341 C745F400000000          mov [ebp-0C], 00000000
:00435348 837D1400                cmp dword ptr [ebp+14], 00000000
:0043534C 7419                    je 00435367
:0043534E 6A00                    push 00000000
:00435350 8B4D08                  mov ecx, dword ptr [ebp+08]
:00435353 81E1FF000000            and ecx, 000000FF
:00435359 6BC924                  imul ecx, 00000024
:0043535C 81C1502C4B00            add ecx, 004B2C50
:00435362 E80913FDFF              call 00406670

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043534C(C)
|
:00435367 837D1800                cmp dword ptr [ebp+18], 00000000
:0043536B 7419                    je 00435386
:0043536D 6A02                    push 00000002
:0043536F 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00435372 81E1FF000000            and ecx, 000000FF
:00435378 6BC924                  imul ecx, 00000024
:0043537B 81C1502C4B00            add ecx, 004B2C50
:00435381 E8EA12FDFF              call 00406670

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043536B(C)
|
:00435386 E9AC010000              jmp 00435537

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043533F(C)
|
:0043538B 8B55EC                  mov edx, dword ptr [ebp-14]
:0043538E 81E2FF000000            and edx, 000000FF
:00435394 8B45E8                  mov eax, dword ptr [ebp-18]
:00435397 25FF000000              and eax, 000000FF
:0043539C 3BD0                    cmp edx, eax
:0043539E 0F8ECC000000            jle 00435470
:004353A4 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004353A7 81E1FF000000            and ecx, 000000FF
:004353AD 8B55E8                  mov edx, dword ptr [ebp-18]
:004353B0 81E2FF000000            and edx, 000000FF
:004353B6 2BCA                    sub ecx, edx
:004353B8 884DF8                  mov byte ptr [ebp-08], cl
:004353BB 8B45F0                  mov eax, dword ptr [ebp-10]
:004353BE 25FF000000              and eax, 000000FF
:004353C3 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004353C6 81E1FF000000            and ecx, 000000FF
:004353CC 3BC1                    cmp eax, ecx
:004353CE 7E4D                    jle 0043541D
:004353D0 8B5510                  mov edx, dword ptr [ebp+10]
:004353D3 F7DA                    neg edx
:004353D5 1BD2                    sbb edx, edx
:004353D7 83E207                  and edx, 00000007
:004353DA 8955F4                  mov dword ptr [ebp-0C], edx
:004353DD 837D1400                cmp dword ptr [ebp+14], 00000000
:004353E1 7419                    je 004353FC
:004353E3 6A00                    push 00000000
:004353E5 8B4D08                  mov ecx, dword ptr [ebp+08]
:004353E8 81E1FF000000            and ecx, 000000FF
:004353EE 6BC924                  imul ecx, 00000024
:004353F1 81C1502C4B00            add ecx, 004B2C50
:004353F7 E87412FDFF              call 00406670

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004353E1(C)
|
:004353FC 837D1800                cmp dword ptr [ebp+18], 00000000
:00435400 7419                    je 0043541B
:00435402 6A02                    push 00000002
:00435404 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00435407 81E1FF000000            and ecx, 000000FF
:0043540D 6BC924                  imul ecx, 00000024
:00435410 81C1502C4B00            add ecx, 004B2C50
:00435416 E85512FDFF              call 00406670

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435400(C)
|
:0043541B EB4E                    jmp 0043546B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004353CE(C)
|
:0043541D 8B4510                  mov eax, dword ptr [ebp+10]
:00435420 F7D8                    neg eax
:00435422 1BC0                    sbb eax, eax
:00435424 83E004                  and eax, 00000004
:00435427 83C003                  add eax, 00000003
:0043542A 8945F4                  mov dword ptr [ebp-0C], eax
:0043542D 837D1400                cmp dword ptr [ebp+14], 00000000
:00435431 7419                    je 0043544C
:00435433 6A03                    push 00000003
:00435435 8B4D08                  mov ecx, dword ptr [ebp+08]
:00435438 81E1FF000000            and ecx, 000000FF
:0043543E 6BC924                  imul ecx, 00000024
:00435441 81C1502C4B00            add ecx, 004B2C50
:00435447 E82412FDFF              call 00406670

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435431(C)
|
:0043544C 837D1800                cmp dword ptr [ebp+18], 00000000
:00435450 7419                    je 0043546B
:00435452 6A01                    push 00000001
:00435454 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00435457 81E1FF000000            and ecx, 000000FF
:0043545D 6BC924                  imul ecx, 00000024
:00435460 81C1502C4B00            add ecx, 004B2C50
:00435466 E80512FDFF              call 00406670

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043541B(U), :00435450(C)
|
:0043546B E9C7000000              jmp 00435537

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043539E(C)
|
:00435470 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00435473 81E1FF000000            and ecx, 000000FF
:00435479 8B55EC                  mov edx, dword ptr [ebp-14]
:0043547C 81E2FF000000            and edx, 000000FF
:00435482 2BCA                    sub ecx, edx
:00435484 884DF8                  mov byte ptr [ebp-08], cl
:00435487 8B45F0                  mov eax, dword ptr [ebp-10]
:0043548A 25FF000000              and eax, 000000FF
:0043548F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00435492 81E1FF000000            and ecx, 000000FF
:00435498 3BC1                    cmp eax, ecx
:0043549A 7E4D                    jle 004354E9
:0043549C 8B5510                  mov edx, dword ptr [ebp+10]
:0043549F F7DA                    neg edx
:004354A1 1BD2                    sbb edx, edx
:004354A3 83E204                  and edx, 00000004
:004354A6 8955F4                  mov dword ptr [ebp-0C], edx
:004354A9 837D1400                cmp dword ptr [ebp+14], 00000000
:004354AD 7419                    je 004354C8
:004354AF 6A00                    push 00000000
:004354B1 8B4D08                  mov ecx, dword ptr [ebp+08]
:004354B4 81E1FF000000            and ecx, 000000FF
:004354BA 6BC924                  imul ecx, 00000024
:004354BD 81C1502C4B00            add ecx, 004B2C50
:004354C3 E8A811FDFF              call 00406670

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004354AD(C)
|
:004354C8 837D1800                cmp dword ptr [ebp+18], 00000000
:004354CC 7419                    je 004354E7
:004354CE 6A02                    push 00000002
:004354D0 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004354D3 81E1FF000000            and ecx, 000000FF
:004354D9 6BC924                  imul ecx, 00000024
:004354DC 81C1502C4B00            add ecx, 004B2C50
:004354E2 E88911FDFF              call 00406670

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004354CC(C)
|
:004354E7 EB4E                    jmp 00435537

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043549A(C)
|
:004354E9 8B4510                  mov eax, dword ptr [ebp+10]
:004354EC F7D8                    neg eax
:004354EE 1BC0                    sbb eax, eax
:004354F0 83E003                  and eax, 00000003
:004354F3 83C001                  add eax, 00000001
:004354F6 8945F4                  mov dword ptr [ebp-0C], eax
:004354F9 837D1400                cmp dword ptr [ebp+14], 00000000
:004354FD 7419                    je 00435518
:004354FF 6A01                    push 00000001
:00435501 8B4D08                  mov ecx, dword ptr [ebp+08]
:00435504 81E1FF000000            and ecx, 000000FF
:0043550A 6BC924                  imul ecx, 00000024
:0043550D 81C1502C4B00            add ecx, 004B2C50
:00435513 E85811FDFF              call 00406670

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004354FD(C)
|
:00435518 837D1800                cmp dword ptr [ebp+18], 00000000
:0043551C 7419                    je 00435537
:0043551E 6A03                    push 00000003
:00435520 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00435523 81E1FF000000            and ecx, 000000FF
:00435529 6BC924                  imul ecx, 00000024
:0043552C 81C1502C4B00            add ecx, 004B2C50
:00435532 E83911FDFF              call 00406670

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00435386(U), :0043546B(U), :004354E7(U), :0043551C(C)
|
:00435537 E9E6020000              jmp 00435822

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043530F(C)
|
:0043553C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043553F 81E1FF000000            and ecx, 000000FF
:00435545 8B55E4                  mov edx, dword ptr [ebp-1C]
:00435548 81E2FF000000            and edx, 000000FF
:0043554E 3BCA                    cmp ecx, edx
:00435550 0F8D2B020000            jnl 00435781
:00435556 8B45E4                  mov eax, dword ptr [ebp-1C]
:00435559 25FF000000              and eax, 000000FF
:0043555E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00435561 81E1FF000000            and ecx, 000000FF
:00435567 2BC1                    sub eax, ecx
:00435569 8845F0                  mov byte ptr [ebp-10], al
:0043556C 8B55EC                  mov edx, dword ptr [ebp-14]
:0043556F 81E2FF000000            and edx, 000000FF
:00435575 8B45E8                  mov eax, dword ptr [ebp-18]
:00435578 25FF000000              and eax, 000000FF
:0043557D 3BD0                    cmp edx, eax
:0043557F 754A                    jne 004355CB
:00435581 C745F402000000          mov [ebp-0C], 00000002
:00435588 837D1400                cmp dword ptr [ebp+14], 00000000
:0043558C 7419                    je 004355A7
:0043558E 6A02                    push 00000002
:00435590 8B4D08                  mov ecx, dword ptr [ebp+08]
:00435593 81E1FF000000            and ecx, 000000FF
:00435599 6BC924                  imul ecx, 00000024
:0043559C 81C1502C4B00            add ecx, 004B2C50
:004355A2 E8C910FDFF              call 00406670

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043558C(C)
|
:004355A7 837D1800                cmp dword ptr [ebp+18], 00000000
:004355AB 7419                    je 004355C6
:004355AD 6A00                    push 00000000
:004355AF 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004355B2 81E1FF000000            and ecx, 000000FF
:004355B8 6BC924                  imul ecx, 00000024
:004355BB 81C1502C4B00            add ecx, 004B2C50
:004355C1 E8AA10FDFF              call 00406670

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004355AB(C)
|
:004355C6 E9B1010000              jmp 0043577C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043557F(C)
|
:004355CB 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004355CE 81E1FF000000            and ecx, 000000FF
:004355D4 8B55E8                  mov edx, dword ptr [ebp-18]
:004355D7 81E2FF000000            and edx, 000000FF
:004355DD 3BCA                    cmp ecx, edx
:004355DF 0F8ECE000000            jle 004356B3
:004355E5 8B45EC                  mov eax, dword ptr [ebp-14]
:004355E8 25FF000000              and eax, 000000FF
:004355ED 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004355F0 81E1FF000000            and ecx, 000000FF
:004355F6 2BC1                    sub eax, ecx
:004355F8 8845F8                  mov byte ptr [ebp-08], al
:004355FB 8B55F0                  mov edx, dword ptr [ebp-10]
:004355FE 81E2FF000000            and edx, 000000FF
:00435604 8B45F8                  mov eax, dword ptr [ebp-08]
:00435607 25FF000000              and eax, 000000FF
:0043560C 3BD0                    cmp edx, eax
:0043560E 7E50                    jle 00435660
:00435610 8B4D10                  mov ecx, dword ptr [ebp+10]
:00435613 F7D9                    neg ecx
:00435615 1BC9                    sbb ecx, ecx
:00435617 83E104                  and ecx, 00000004
:0043561A 83C102                  add ecx, 00000002
:0043561D 894DF4                  mov dword ptr [ebp-0C], ecx
:00435620 837D1400                cmp dword ptr [ebp+14], 00000000
:00435624 7419                    je 0043563F
:00435626 6A02                    push 00000002
:00435628 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043562B 81E1FF000000            and ecx, 000000FF
:00435631 6BC924                  imul ecx, 00000024
:00435634 81C1502C4B00            add ecx, 004B2C50
:0043563A E83110FDFF              call 00406670

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435624(C)
|
:0043563F 837D1800                cmp dword ptr [ebp+18], 00000000
:00435643 7419                    je 0043565E
:00435645 6A00                    push 00000000
:00435647 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0043564A 81E1FF000000            and ecx, 000000FF
:00435650 6BC924                  imul ecx, 00000024
:00435653 81C1502C4B00            add ecx, 004B2C50
:00435659 E81210FDFF              call 00406670

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435643(C)
|
:0043565E EB4E                    jmp 004356AE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043560E(C)
|
:00435660 8B5510                  mov edx, dword ptr [ebp+10]
:00435663 F7DA                    neg edx
:00435665 1BD2                    sbb edx, edx
:00435667 83E203                  and edx, 00000003
:0043566A 83C203                  add edx, 00000003
:0043566D 8955F4                  mov dword ptr [ebp-0C], edx
:00435670 837D1400                cmp dword ptr [ebp+14], 00000000
:00435674 7419                    je 0043568F
:00435676 6A03                    push 00000003
:00435678 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043567B 81E1FF000000            and ecx, 000000FF
:00435681 6BC924                  imul ecx, 00000024
:00435684 81C1502C4B00            add ecx, 004B2C50
:0043568A E8E10FFDFF              call 00406670

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435674(C)
|
:0043568F 837D1800                cmp dword ptr [ebp+18], 00000000
:00435693 7419                    je 004356AE
:00435695 6A01                    push 00000001
:00435697 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0043569A 81E1FF000000            and ecx, 000000FF
:004356A0 6BC924                  imul ecx, 00000024
:004356A3 81C1502C4B00            add ecx, 004B2C50
:004356A9 E8C20FFDFF              call 00406670

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043565E(U), :00435693(C)
|
:004356AE E9C9000000              jmp 0043577C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004355DF(C)
|
:004356B3 8B45E8                  mov eax, dword ptr [ebp-18]
:004356B6 25FF000000              and eax, 000000FF
:004356BB 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004356BE 81E1FF000000            and ecx, 000000FF
:004356C4 2BC1                    sub eax, ecx
:004356C6 8845F8                  mov byte ptr [ebp-08], al
:004356C9 8B55F0                  mov edx, dword ptr [ebp-10]
:004356CC 81E2FF000000            and edx, 000000FF
:004356D2 8B45F8                  mov eax, dword ptr [ebp-08]
:004356D5 25FF000000              and eax, 000000FF
:004356DA 3BD0                    cmp edx, eax
:004356DC 7E50                    jle 0043572E
:004356DE 8B4D10                  mov ecx, dword ptr [ebp+10]
:004356E1 F7D9                    neg ecx
:004356E3 1BC9                    sbb ecx, ecx
:004356E5 83E103                  and ecx, 00000003
:004356E8 83C102                  add ecx, 00000002
:004356EB 894DF4                  mov dword ptr [ebp-0C], ecx
:004356EE 837D1400                cmp dword ptr [ebp+14], 00000000
:004356F2 7419                    je 0043570D
:004356F4 6A02                    push 00000002
:004356F6 8B4D08                  mov ecx, dword ptr [ebp+08]
:004356F9 81E1FF000000            and ecx, 000000FF
:004356FF 6BC924                  imul ecx, 00000024
:00435702 81C1502C4B00            add ecx, 004B2C50
:00435708 E8630FFDFF              call 00406670

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004356F2(C)
|
:0043570D 837D1800                cmp dword ptr [ebp+18], 00000000
:00435711 7419                    je 0043572C
:00435713 6A00                    push 00000000
:00435715 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00435718 81E1FF000000            and ecx, 000000FF
:0043571E 6BC924                  imul ecx, 00000024
:00435721 81C1502C4B00            add ecx, 004B2C50
:00435727 E8440FFDFF              call 00406670

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435711(C)
|
:0043572C EB4E                    jmp 0043577C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004356DC(C)
|
:0043572E 8B5510                  mov edx, dword ptr [ebp+10]
:00435731 F7DA                    neg edx
:00435733 1BD2                    sbb edx, edx
:00435735 83E204                  and edx, 00000004
:00435738 83C201                  add edx, 00000001
:0043573B 8955F4                  mov dword ptr [ebp-0C], edx
:0043573E 837D1400                cmp dword ptr [ebp+14], 00000000
:00435742 7419                    je 0043575D
:00435744 6A01                    push 00000001
:00435746 8B4D08                  mov ecx, dword ptr [ebp+08]
:00435749 81E1FF000000            and ecx, 000000FF
:0043574F 6BC924                  imul ecx, 00000024
:00435752 81C1502C4B00            add ecx, 004B2C50
:00435758 E8130FFDFF              call 00406670

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435742(C)
|
:0043575D 837D1800                cmp dword ptr [ebp+18], 00000000
:00435761 7419                    je 0043577C
:00435763 6A03                    push 00000003
:00435765 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00435768 81E1FF000000            and ecx, 000000FF
:0043576E 6BC924                  imul ecx, 00000024
:00435771 81C1502C4B00            add ecx, 004B2C50
:00435777 E8F40EFDFF              call 00406670

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004355C6(U), :004356AE(U), :0043572C(U), :00435761(C)
|
:0043577C E9A1000000              jmp 00435822

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435550(C)
|
:00435781 8B45EC                  mov eax, dword ptr [ebp-14]
:00435784 25FF000000              and eax, 000000FF
:00435789 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043578C 81E1FF000000            and ecx, 000000FF
:00435792 3BC1                    cmp eax, ecx
:00435794 7E47                    jle 004357DD
:00435796 C745F403000000          mov [ebp-0C], 00000003
:0043579D 837D1400                cmp dword ptr [ebp+14], 00000000
:004357A1 7419                    je 004357BC
:004357A3 6A03                    push 00000003
:004357A5 8B4D08                  mov ecx, dword ptr [ebp+08]
:004357A8 81E1FF000000            and ecx, 000000FF
:004357AE 6BC924                  imul ecx, 00000024
:004357B1 81C1502C4B00            add ecx, 004B2C50
:004357B7 E8B40EFDFF              call 00406670

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004357A1(C)
|
:004357BC 837D1800                cmp dword ptr [ebp+18], 00000000
:004357C0 7419                    je 004357DB
:004357C2 6A01                    push 00000001
:004357C4 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004357C7 81E1FF000000            and ecx, 000000FF
:004357CD 6BC924                  imul ecx, 00000024
:004357D0 81C1502C4B00            add ecx, 004B2C50
:004357D6 E8950EFDFF              call 00406670

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004357C0(C)
|
:004357DB EB45                    jmp 00435822

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435794(C)
|
:004357DD C745F401000000          mov [ebp-0C], 00000001
:004357E4 837D1400                cmp dword ptr [ebp+14], 00000000
:004357E8 7419                    je 00435803
:004357EA 6A01                    push 00000001
:004357EC 8B4D08                  mov ecx, dword ptr [ebp+08]
:004357EF 81E1FF000000            and ecx, 000000FF
:004357F5 6BC924                  imul ecx, 00000024
:004357F8 81C1502C4B00            add ecx, 004B2C50
:004357FE E86D0EFDFF              call 00406670

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004357E8(C)
|
:00435803 837D1800                cmp dword ptr [ebp+18], 00000000
:00435807 7419                    je 00435822
:00435809 6A03                    push 00000003
:0043580B 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0043580E 81E1FF000000            and ecx, 000000FF
:00435814 6BC924                  imul ecx, 00000024
:00435817 81C1502C4B00            add ecx, 004B2C50
:0043581D E84E0EFDFF              call 00406670

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00435537(U), :0043577C(U), :004357DB(U), :00435807(C)
|
:00435822 8B45F4                  mov eax, dword ptr [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00435217(U), :0043524F(U), :00435285(U)
|
:00435825 8BE5                    mov esp, ebp
:00435827 5D                      pop ebp
:00435828 C3                      ret



* Referenced by a CALL at Addresses:
|:00404EE2   , :00405130   , :0040579F   , :004057E2   , :004064CF   
|:00421A3D   , :0043AC14   , :0043ACDD   , :0043DB36   , :0043DBEC   
|:00457551   , :004576B0   , :0045963D   
|
:00435829 55                      push ebp
:0043582A 8BEC                    mov ebp, esp
:0043582C 51                      push ecx
:0043582D 6A00                    push 00000000
:0043582F 6A01                    push 00000001
:00435831 6A00                    push 00000000
:00435833 8A450C                  mov al, byte ptr [ebp+0C]
:00435836 50                      push eax
:00435837 8A4D08                  mov cl, byte ptr [ebp+08]
:0043583A 51                      push ecx
:0043583B E89AF9FFFF              call 004351DA
:00435840 83C414                  add esp, 00000014
:00435843 8945FC                  mov dword ptr [ebp-04], eax
:00435846 837DFC01                cmp dword ptr [ebp-04], 00000001
:0043584A 751B                    jne 00435867
:0043584C 6A01                    push 00000001
:0043584E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00435851 81E1FF000000            and ecx, 000000FF
:00435857 6BC924                  imul ecx, 00000024
:0043585A 81C1502C4B00            add ecx, 004B2C50
:00435860 E8CFA40000              call 0043FD34
:00435865 EB19                    jmp 00435880

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043584A(C)
|
:00435867 6A00                    push 00000000
:00435869 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043586C 81E1FF000000            and ecx, 000000FF
:00435872 6BC924                  imul ecx, 00000024
:00435875 81C1502C4B00            add ecx, 004B2C50
:0043587B E8B4A40000              call 0043FD34

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435865(U)
|
:00435880 8BE5                    mov esp, ebp
:00435882 5D                      pop ebp
:00435883 C3                      ret



* Referenced by a CALL at Addresses:
|:00435B5E   , :00435C24   , :00435D8A   , :00435E76   , :00435F62   
|:004362D5   , :00437B18   , :00437DDA   , :00437E85   , :0043808A   
|:004381FD   , :0043A574   , :0043D1DC   , :0043D710   , :0043D744   
|:0043D788   , :0043DF3F   , :0043F0B7   , :0043F15F   , :0043F266   
|:00440381   , :004420FE   , :0044210D   , :0044C970   , :0044E263   
|:0044E50A   , :00454225   , :004542F3   , :004555A1   , :0045957F   
|:00459F5F   , :0045A8F5   , :0045AE5A   , :0045B248   , :0045B3DF   
|:0045B533   , :00465BDF   
|
:00435884 55                      push ebp
:00435885 8BEC                    mov ebp, esp
:00435887 51                      push ecx
:00435888 8B4508                  mov eax, dword ptr [ebp+08]
:0043588B 33C9                    xor ecx, ecx
:0043588D 8A08                    mov cl, byte ptr [eax]
:0043588F 33D2                    xor edx, edx
:00435891 8A152C424B00            mov dl, byte ptr [004B422C]
:00435897 3BCA                    cmp ecx, edx
:00435899 7D5F                    jge 004358FA
:0043589B 8B4508                  mov eax, dword ptr [ebp+08]
:0043589E 33C9                    xor ecx, ecx
:004358A0 8A4801                  mov cl, byte ptr [eax+01]
:004358A3 33D2                    xor edx, edx
:004358A5 8A152D424B00            mov dl, byte ptr [004B422D]
:004358AB 3BCA                    cmp ecx, edx
:004358AD 7D4B                    jge 004358FA
:004358AF 6A04                    push 00000004
:004358B1 6A00                    push 00000000
:004358B3 68800C0000              push 00000C80
:004358B8 B938EB4A00              mov ecx, 004AEB38
:004358BD E87EA10400              call 0047FA40
:004358C2 8B4D08                  mov ecx, dword ptr [ebp+08]
:004358C5 33D2                    xor edx, edx
:004358C7 8A11                    mov dl, byte ptr [ecx]
:004358C9 03C2                    add eax, edx
:004358CB 8B4D08                  mov ecx, dword ptr [ebp+08]
:004358CE 33D2                    xor edx, edx
:004358D0 8A5101                  mov dl, byte ptr [ecx+01]
:004358D3 33C9                    xor ecx, ecx
:004358D5 8A0D2C424B00            mov cl, byte ptr [004B422C]
:004358DB 0FAFD1                  imul edx, ecx
:004358DE 8A1410                  mov dl, byte ptr [eax+edx]
:004358E1 8855FC                  mov byte ptr [ebp-04], dl
:004358E4 8B45FC                  mov eax, dword ptr [ebp-04]
:004358E7 25FF000000              and eax, 000000FF
:004358EC 83F873                  cmp eax, 00000073
:004358EF 7D05                    jge 004358F6
:004358F1 8A45FC                  mov al, byte ptr [ebp-04]
:004358F4 EB06                    jmp 004358FC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004358EF(C)
|
:004358F6 0CFF                    or al, FF
:004358F8 EB02                    jmp 004358FC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00435899(C), :004358AD(C)
|
:004358FA 0CFF                    or al, FF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004358F4(U), :004358F8(U)
|
:004358FC 8BE5                    mov esp, ebp
:004358FE 5D                      pop ebp
:004358FF C3                      ret



* Referenced by a CALL at Addresses:
|:00442AD0   , :00442AF7   , :00442BAB   , :00442BDB   
|
:00435900 55                      push ebp
:00435901 8BEC                    mov ebp, esp
:00435903 8B450C                  mov eax, dword ptr [ebp+0C]
:00435906 25FF000000              and eax, 000000FF
:0043590B 83F873                  cmp eax, 00000073
:0043590E 7C04                    jl 00435914
:00435910 C6450CFF                mov [ebp+0C], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043590E(C)
|
:00435914 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00435917 81E1FF000000            and ecx, 000000FF
:0043591D 83F973                  cmp ecx, 00000073
:00435920 7D36                    jge 00435958
:00435922 8B550C                  mov edx, dword ptr [ebp+0C]
:00435925 81E2FF000000            and edx, 000000FF
:0043592B 81FAFF000000            cmp edx, 000000FF
:00435931 7425                    je 00435958
:00435933 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00435936 81E1FF000000            and ecx, 000000FF
:0043593C 6BC924                  imul ecx, 00000024
:0043593F 81C1502C4B00            add ecx, 004B2C50
:00435945 E84633FEFF              call 00418C90
:0043594A 25FF000000              and eax, 000000FF
:0043594F 83F803                  cmp eax, 00000003
:00435952 7504                    jne 00435958
:00435954 C6450CFF                mov [ebp+0C], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00435920(C), :00435931(C), :00435952(C)
|
:00435958 6A04                    push 00000004
:0043595A 6A00                    push 00000000
:0043595C 6A00                    push 00000000
:0043595E B938EB4A00              mov ecx, 004AEB38
:00435963 E8D8A00400              call 0047FA40
:00435968 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043596B 33D2                    xor edx, edx
:0043596D 8A11                    mov dl, byte ptr [ecx]
:0043596F 8D8410800C0000          lea eax, dword ptr [eax+edx+00000C80]
:00435976 8B4D08                  mov ecx, dword ptr [ebp+08]
:00435979 33D2                    xor edx, edx
:0043597B 8A5101                  mov dl, byte ptr [ecx+01]
:0043597E 33C9                    xor ecx, ecx
:00435980 8A0D2C424B00            mov cl, byte ptr [004B422C]
:00435986 0FAFD1                  imul edx, ecx
:00435989 8A4D0C                  mov cl, byte ptr [ebp+0C]
:0043598C 880C10                  mov byte ptr [eax+edx], cl
:0043598F 5D                      pop ebp
:00435990 C3                      ret



* Referenced by a CALL at Addresses:
|:004204BE   , :0042050C   , :0042055A   , :004205A8   , :004209C6   
|:004209FF   , :00420A35   , :00420A6B   , :004351C7   , :00437FE2   
|:0043818C   , :0043851D   , :0043873C   , :0043933D   , :00439443   
|:00439622   , :0043A4CC   , :0043CE39   , :0043F0CF   , :0043F177   
|:0043F282   , :0043F3CF   , :0043F875   , :0044021C   , :00440C73   
|:004513BD   , :00455824   
|
:00435991 55                      push ebp
:00435992 8BEC                    mov ebp, esp
:00435994 8B4508                  mov eax, dword ptr [ebp+08]
:00435997 33C9                    xor ecx, ecx
:00435999 8A08                    mov cl, byte ptr [eax]
:0043599B 33D2                    xor edx, edx
:0043599D 8A152C424B00            mov dl, byte ptr [004B422C]
:004359A3 3BCA                    cmp ecx, edx
:004359A5 7D4A                    jge 004359F1
:004359A7 8B4508                  mov eax, dword ptr [ebp+08]
:004359AA 33C9                    xor ecx, ecx
:004359AC 8A4801                  mov cl, byte ptr [eax+01]
:004359AF 33D2                    xor edx, edx
:004359B1 8A152D424B00            mov dl, byte ptr [004B422D]
:004359B7 3BCA                    cmp ecx, edx
:004359B9 7D36                    jge 004359F1
:004359BB 6A04                    push 00000004
:004359BD 6A00                    push 00000000
:004359BF 6A00                    push 00000000
:004359C1 B938EB4A00              mov ecx, 004AEB38
:004359C6 E875A00400              call 0047FA40
:004359CB 8B4D08                  mov ecx, dword ptr [ebp+08]
:004359CE 33D2                    xor edx, edx
:004359D0 8A11                    mov dl, byte ptr [ecx]
:004359D2 8D841040060000          lea eax, dword ptr [eax+edx+00000640]
:004359D9 8B4D08                  mov ecx, dword ptr [ebp+08]
:004359DC 33D2                    xor edx, edx
:004359DE 8A5101                  mov dl, byte ptr [ecx+01]
:004359E1 33C9                    xor ecx, ecx
:004359E3 8A0D2C424B00            mov cl, byte ptr [004B422C]
:004359E9 0FAFD1                  imul edx, ecx
:004359EC 8A0410                  mov al, byte ptr [eax+edx]
:004359EF EB02                    jmp 004359F3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004359A5(C), :004359B9(C)
|
:004359F1 0CFF                    or al, FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004359EF(U)
|
:004359F3 5D                      pop ebp
:004359F4 C3                      ret



* Referenced by a CALL at Addresses:
|:00435D75   , :00435E61   , :00435F4D   , :004362C0   , :00437C36   
|:00437DB4   , :00437F42   , :00438040   , :004382AC   , :0043869F   
|:0043AA61   , :0043D1A9   , :0043DA64   , :0043DF17   , :0043F0A0   
|:0043F139   , :0043F1D6   , :0044035D   , :004420E8   , :004538DB   
|:0045B0B1   , :0045B21B   , :00465BAC   
|
:004359F5 55                      push ebp
:004359F6 8BEC                    mov ebp, esp
:004359F8 33C0                    xor eax, eax
:004359FA A0482C4B00              mov al, byte ptr [004B2C48]
:004359FF 83E001                  and eax, 00000001
:00435A02 85C0                    test eax, eax
:00435A04 7526                    jne 00435A2C
:00435A06 8A0D482C4B00            mov cl, byte ptr [004B2C48]
:00435A0C 80C901                  or cl, 01
:00435A0F 880D482C4B00            mov byte ptr [004B2C48], cl
:00435A15 B93C2C4B00              mov ecx, 004B2C3C
:00435A1A E8F19C0200              call 0045F710
:00435A1F 68A85A4300              push 00435AA8
:00435A24 E8D7B60400              call 00481100
:00435A29 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435A04(C)
|
:00435A2C 8B5508                  mov edx, dword ptr [ebp+08]
:00435A2F 52                      push edx
:00435A30 B93C2C4B00              mov ecx, 004B2C3C
:00435A35 E8660BFDFF              call 004065A0
:00435A3A 8B450C                  mov eax, dword ptr [ebp+0C]
:00435A3D 25FF000000              and eax, 000000FF
:00435A42 D1E0                    shl eax, 1
:00435A44 8A0D3C2C4B00            mov cl, byte ptr [004B2C3C]
:00435A4A 020C8568DF4800          add cl, byte ptr [4*eax+0048DF68]
:00435A51 880D3C2C4B00            mov byte ptr [004B2C3C], cl
:00435A57 8B550C                  mov edx, dword ptr [ebp+0C]
:00435A5A 81E2FF000000            and edx, 000000FF
:00435A60 D1E2                    shl edx, 1
:00435A62 A03D2C4B00              mov al, byte ptr [004B2C3D]
:00435A67 0204956CDF4800          add al, byte ptr [4*edx+0048DF6C]
:00435A6E A23D2C4B00              mov byte ptr [004B2C3D], al
:00435A73 33C9                    xor ecx, ecx
:00435A75 8A0D3C2C4B00            mov cl, byte ptr [004B2C3C]
:00435A7B 33D2                    xor edx, edx
:00435A7D 8A152C424B00            mov dl, byte ptr [004B422C]
:00435A83 3BCA                    cmp ecx, edx
:00435A85 7D13                    jge 00435A9A
:00435A87 33C0                    xor eax, eax
:00435A89 A03D2C4B00              mov al, byte ptr [004B2C3D]
:00435A8E 33C9                    xor ecx, ecx
:00435A90 8A0D2D424B00            mov cl, byte ptr [004B422D]
:00435A96 3BC1                    cmp eax, ecx
:00435A98 7C07                    jl 00435AA1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435A85(C)
|
:00435A9A C6053C2C4B00FF          mov byte ptr [004B2C3C], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435A98(C)
|
:00435AA1 B83C2C4B00              mov eax, 004B2C3C
:00435AA6 5D                      pop ebp
:00435AA7 C3                      ret


:00435AA8 55                      push ebp
:00435AA9 8BEC                    mov ebp, esp
:00435AAB 5D                      pop ebp
:00435AAC C3                      ret



* Referenced by a CALL at Addresses:
|:00438C78   , :00439747   
|
:00435AAD 55                      push ebp
:00435AAE 8BEC                    mov ebp, esp
:00435AB0 83EC08                  sub esp, 00000008
:00435AB3 894DF8                  mov dword ptr [ebp-08], ecx
:00435AB6 8B4514                  mov eax, dword ptr [ebp+14]
:00435AB9 8945FC                  mov dword ptr [ebp-04], eax
:00435ABC 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00435ABF 81E1FF000000            and ecx, 000000FF
:00435AC5 85C9                    test ecx, ecx
:00435AC7 7519                    jne 00435AE2
:00435AC9 8B5514                  mov edx, dword ptr [ebp+14]
:00435ACC 8A4508                  mov al, byte ptr [ebp+08]
:00435ACF 8802                    mov byte ptr [edx], al
:00435AD1 8B4D14                  mov ecx, dword ptr [ebp+14]
:00435AD4 83C101                  add ecx, 00000001
:00435AD7 894D14                  mov dword ptr [ebp+14], ecx
:00435ADA 8B5514                  mov edx, dword ptr [ebp+14]
:00435ADD C602FF                  mov byte ptr [edx], FF
:00435AE0 EB53                    jmp 00435B35

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435AC7(C)
|
:00435AE2 8B450C                  mov eax, dword ptr [ebp+0C]
:00435AE5 25FF000000              and eax, 000000FF
:00435AEA 83F801                  cmp eax, 00000001
:00435AED 7523                    jne 00435B12
:00435AEF 8A4D1C                  mov cl, byte ptr [ebp+1C]
:00435AF2 51                      push ecx
:00435AF3 8A5518                  mov dl, byte ptr [ebp+18]
:00435AF6 52                      push edx
:00435AF7 6A00                    push 00000000
:00435AF9 8B4514                  mov eax, dword ptr [ebp+14]
:00435AFC 50                      push eax
:00435AFD 8A4D10                  mov cl, byte ptr [ebp+10]
:00435B00 51                      push ecx
:00435B01 8A5508                  mov dl, byte ptr [ebp+08]
:00435B04 52                      push edx
:00435B05 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00435B08 E8210A0000              call 0043652E
:00435B0D 8945FC                  mov dword ptr [ebp-04], eax
:00435B10 EB23                    jmp 00435B35

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435AED(C)
|
:00435B12 68FF000000              push 000000FF
:00435B17 68FF000000              push 000000FF
:00435B1C 6A01                    push 00000001
:00435B1E 8B4514                  mov eax, dword ptr [ebp+14]
:00435B21 50                      push eax
:00435B22 8A4D10                  mov cl, byte ptr [ebp+10]
:00435B25 51                      push ecx
:00435B26 8A5508                  mov dl, byte ptr [ebp+08]
:00435B29 52                      push edx
:00435B2A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00435B2D E8FC090000              call 0043652E
:00435B32 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00435AE0(U), :00435B10(U)
|
:00435B35 8B45FC                  mov eax, dword ptr [ebp-04]
:00435B38 8BE5                    mov esp, ebp
:00435B3A 5D                      pop ebp
:00435B3B C21800                  ret 0018



* Referenced by a CALL at Address:
|:0043930B   
|
:00435B3E 55                      push ebp
:00435B3F 8BEC                    mov ebp, esp
:00435B41 83EC0C                  sub esp, 0000000C
:00435B44 894DF4                  mov dword ptr [ebp-0C], ecx
:00435B47 8B4514                  mov eax, dword ptr [ebp+14]
:00435B4A 8945FC                  mov dword ptr [ebp-04], eax
:00435B4D 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00435B50 81E1FF000000            and ecx, 000000FF
:00435B56 85C9                    test ecx, ecx
:00435B58 753A                    jne 00435B94
:00435B5A 8D5508                  lea edx, dword ptr [ebp+08]
:00435B5D 52                      push edx
:00435B5E E821FDFFFF              call 00435884
:00435B63 83C404                  add esp, 00000004
:00435B66 8845F8                  mov byte ptr [ebp-08], al
:00435B69 8B45F8                  mov eax, dword ptr [ebp-08]
:00435B6C 25FF000000              and eax, 000000FF
:00435B71 3DFF000000              cmp eax, 000000FF
:00435B76 7514                    jne 00435B8C
:00435B78 8B4D14                  mov ecx, dword ptr [ebp+14]
:00435B7B 8B55F4                  mov edx, dword ptr [ebp-0C]
:00435B7E 8A4204                  mov al, byte ptr [edx+04]
:00435B81 8801                    mov byte ptr [ecx], al
:00435B83 8B4D14                  mov ecx, dword ptr [ebp+14]
:00435B86 83C101                  add ecx, 00000001
:00435B89 894D14                  mov dword ptr [ebp+14], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435B76(C)
|
:00435B8C 8B5514                  mov edx, dword ptr [ebp+14]
:00435B8F C602FF                  mov byte ptr [edx], FF
:00435B92 EB55                    jmp 00435BE9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435B58(C)
|
:00435B94 8B450C                  mov eax, dword ptr [ebp+0C]
:00435B97 25FF000000              and eax, 000000FF
:00435B9C 83F801                  cmp eax, 00000001
:00435B9F 7524                    jne 00435BC5
:00435BA1 8A4D1C                  mov cl, byte ptr [ebp+1C]
:00435BA4 51                      push ecx
:00435BA5 8A5518                  mov dl, byte ptr [ebp+18]
:00435BA8 52                      push edx
:00435BA9 6A00                    push 00000000
:00435BAB 8B4514                  mov eax, dword ptr [ebp+14]
:00435BAE 50                      push eax
:00435BAF 8A4D10                  mov cl, byte ptr [ebp+10]
:00435BB2 51                      push ecx
:00435BB3 668B5508                mov dx, word ptr [ebp+08]
:00435BB7 52                      push edx
:00435BB8 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00435BBB E846010000              call 00435D06
:00435BC0 8945FC                  mov dword ptr [ebp-04], eax
:00435BC3 EB24                    jmp 00435BE9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435B9F(C)
|
:00435BC5 68FF000000              push 000000FF
:00435BCA 68FF000000              push 000000FF
:00435BCF 6A01                    push 00000001
:00435BD1 8B4514                  mov eax, dword ptr [ebp+14]
:00435BD4 50                      push eax
:00435BD5 8A4D10                  mov cl, byte ptr [ebp+10]
:00435BD8 51                      push ecx
:00435BD9 668B5508                mov dx, word ptr [ebp+08]
:00435BDD 52                      push edx
:00435BDE 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00435BE1 E820010000              call 00435D06
:00435BE6 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00435B92(U), :00435BC3(U)
|
:00435BE9 8B45FC                  mov eax, dword ptr [ebp-04]
:00435BEC 8BE5                    mov esp, ebp
:00435BEE 5D                      pop ebp
:00435BEF C21800                  ret 0018



* Referenced by a CALL at Addresses:
|:00436025   , :00436049   , :0043606D   , :00436091   , :00436177   
|:00436275   , :004363BC   , :004363ED   , :00436438   , :00436469   
|:0043648E   , :004364B2   , :004364D6   , :004364FA   
|
:00435BF2 55                      push ebp
:00435BF3 8BEC                    mov ebp, esp
:00435BF5 83EC0C                  sub esp, 0000000C
:00435BF8 56                      push esi
:00435BF9 894DF4                  mov dword ptr [ebp-0C], ecx
:00435BFC 8A450C                  mov al, byte ptr [ebp+0C]
:00435BFF 50                      push eax
:00435C00 8A4D08                  mov cl, byte ptr [ebp+08]
:00435C03 51                      push ecx
:00435C04 8D4DF8                  lea ecx, dword ptr [ebp-08]
:00435C07 E8C430FEFF              call 00418CD0
:00435C0C 8D55F8                  lea edx, dword ptr [ebp-08]
:00435C0F 52                      push edx
:00435C10 E8BC000000              call 00435CD1
:00435C15 83C404                  add esp, 00000004
:00435C18 85C0                    test eax, eax
:00435C1A 0F84A7000000            je 00435CC7
:00435C20 8D45F8                  lea eax, dword ptr [ebp-08]
:00435C23 50                      push eax
:00435C24 E85BFCFFFF              call 00435884
:00435C29 83C404                  add esp, 00000004
:00435C2C 8845FC                  mov byte ptr [ebp-04], al
:00435C2F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00435C32 81E1FF000000            and ecx, 000000FF
:00435C38 81F9FF000000            cmp ecx, 000000FF
:00435C3E 0F8483000000            je 00435CC7
:00435C44 8B5514                  mov edx, dword ptr [ebp+14]
:00435C47 81E2FF000000            and edx, 000000FF
:00435C4D 85D2                    test edx, edx
:00435C4F 7525                    jne 00435C76
:00435C51 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00435C54 81E1FF000000            and ecx, 000000FF
:00435C5A 6BC924                  imul ecx, 00000024
:00435C5D 81C1502C4B00            add ecx, 004B2C50
:00435C63 E8A80AFDFF              call 00406710
:00435C68 8BF0                    mov esi, eax
:00435C6A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00435C6D E89E0AFDFF              call 00406710
:00435C72 3BF0                    cmp esi, eax
:00435C74 7540                    jne 00435CB6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435C4F(C)
|
:00435C76 8B4514                  mov eax, dword ptr [ebp+14]
:00435C79 25FF000000              and eax, 000000FF
:00435C7E 83F801                  cmp eax, 00000001
:00435C81 7525                    jne 00435CA8
:00435C83 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00435C86 81E1FF000000            and ecx, 000000FF
:00435C8C 6BC924                  imul ecx, 00000024
:00435C8F 81C1502C4B00            add ecx, 004B2C50
:00435C95 E8760AFDFF              call 00406710
:00435C9A 8BF0                    mov esi, eax
:00435C9C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00435C9F E86C0AFDFF              call 00406710
:00435CA4 3BF0                    cmp esi, eax
:00435CA6 740E                    je 00435CB6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435C81(C)
|
:00435CA8 8B4D14                  mov ecx, dword ptr [ebp+14]
:00435CAB 81E1FF000000            and ecx, 000000FF
:00435CB1 83F902                  cmp ecx, 00000002
:00435CB4 7511                    jne 00435CC7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00435C74(C), :00435CA6(C)
|
:00435CB6 8B5510                  mov edx, dword ptr [ebp+10]
:00435CB9 8A45FC                  mov al, byte ptr [ebp-04]
:00435CBC 8802                    mov byte ptr [edx], al
:00435CBE 8B4D10                  mov ecx, dword ptr [ebp+10]
:00435CC1 83C101                  add ecx, 00000001
:00435CC4 894D10                  mov dword ptr [ebp+10], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00435C1A(C), :00435C3E(C), :00435CB4(C)
|
:00435CC7 8B4510                  mov eax, dword ptr [ebp+10]
:00435CCA 5E                      pop esi
:00435CCB 8BE5                    mov esp, ebp
:00435CCD 5D                      pop ebp
:00435CCE C21000                  ret 0010



* Referenced by a CALL at Address:
|:00435C10   
|
:00435CD1 55                      push ebp
:00435CD2 8BEC                    mov ebp, esp
:00435CD4 8B4508                  mov eax, dword ptr [ebp+08]
:00435CD7 33C9                    xor ecx, ecx
:00435CD9 8A08                    mov cl, byte ptr [eax]
:00435CDB 33D2                    xor edx, edx
:00435CDD 8A152C424B00            mov dl, byte ptr [004B422C]
:00435CE3 3BCA                    cmp ecx, edx
:00435CE5 7D14                    jge 00435CFB
:00435CE7 8B4508                  mov eax, dword ptr [ebp+08]
:00435CEA 33C9                    xor ecx, ecx
:00435CEC 8A4801                  mov cl, byte ptr [eax+01]
:00435CEF 33D2                    xor edx, edx
:00435CF1 8A152D424B00            mov dl, byte ptr [004B422D]
:00435CF7 3BCA                    cmp ecx, edx
:00435CF9 7C04                    jl 00435CFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435CE5(C)
|
:00435CFB 33C0                    xor eax, eax
:00435CFD EB05                    jmp 00435D04

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435CF9(C)
|
:00435CFF B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435CFD(U)
|
:00435D04 5D                      pop ebp
:00435D05 C3                      ret



* Referenced by a CALL at Addresses:
|:00435BBB   , :00435BE1   , :0043657B   
|
:00435D06 55                      push ebp
:00435D07 8BEC                    mov ebp, esp
:00435D09 83EC20                  sub esp, 00000020
:00435D0C 56                      push esi
:00435D0D 894DE4                  mov dword ptr [ebp-1C], ecx
:00435D10 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00435D13 E8F8990200              call 0045F710
:00435D18 C645EC00                mov [ebp-14], 00
:00435D1C C645E800                mov [ebp-18], 00
:00435D20 8B4510                  mov eax, dword ptr [ebp+10]
:00435D23 8945F4                  mov dword ptr [ebp-0C], eax
:00435D26 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00435D29 81E1FF000000            and ecx, 000000FF
:00435D2F 894DE0                  mov dword ptr [ebp-20], ecx
:00435D32 837DE006                cmp dword ptr [ebp-20], 00000006
:00435D36 0F87CC070000            ja 00436508
:00435D3C 8B55E0                  mov edx, dword ptr [ebp-20]
:00435D3F FF249512654300          jmp dword ptr [4*edx+00436512]
:00435D46 8B45F4                  mov eax, dword ptr [ebp-0C]
:00435D49 C600FF                  mov byte ptr [eax], FF
:00435D4C E9B7070000              jmp 00436508
:00435D51 C745F000000000          mov [ebp-10], 00000000
:00435D58 EB09                    jmp 00435D63

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435E2D(U)
|
:00435D5A 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00435D5D 83C101                  add ecx, 00000001
:00435D60 894DF0                  mov dword ptr [ebp-10], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435D58(U)
|
:00435D63 837DF004                cmp dword ptr [ebp-10], 00000004
:00435D67 0F83C5000000            jnb 00435E32
:00435D6D 8A55F0                  mov dl, byte ptr [ebp-10]
:00435D70 52                      push edx
:00435D71 8D4508                  lea eax, dword ptr [ebp+08]
:00435D74 50                      push eax
:00435D75 E87BFCFFFF              call 004359F5
:00435D7A 83C408                  add esp, 00000008
:00435D7D 50                      push eax
:00435D7E 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00435D81 E81A08FDFF              call 004065A0
:00435D86 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00435D89 51                      push ecx
:00435D8A E8F5FAFFFF              call 00435884
:00435D8F 83C404                  add esp, 00000004
:00435D92 8845F8                  mov byte ptr [ebp-08], al
:00435D95 8B55F8                  mov edx, dword ptr [ebp-08]
:00435D98 81E2FF000000            and edx, 000000FF
:00435D9E 81FAFF000000            cmp edx, 000000FF
:00435DA4 0F8483000000            je 00435E2D
:00435DAA 8B4514                  mov eax, dword ptr [ebp+14]
:00435DAD 25FF000000              and eax, 000000FF
:00435DB2 85C0                    test eax, eax
:00435DB4 7525                    jne 00435DDB
:00435DB6 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00435DB9 81E1FF000000            and ecx, 000000FF
:00435DBF 6BC924                  imul ecx, 00000024
:00435DC2 81C1502C4B00            add ecx, 004B2C50
:00435DC8 E84309FDFF              call 00406710
:00435DCD 8BF0                    mov esi, eax
:00435DCF 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00435DD2 E83909FDFF              call 00406710
:00435DD7 3BF0                    cmp esi, eax
:00435DD9 7541                    jne 00435E1C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435DB4(C)
|
:00435DDB 8B4D14                  mov ecx, dword ptr [ebp+14]
:00435DDE 81E1FF000000            and ecx, 000000FF
:00435DE4 83F901                  cmp ecx, 00000001
:00435DE7 7525                    jne 00435E0E
:00435DE9 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00435DEC 81E1FF000000            and ecx, 000000FF
:00435DF2 6BC924                  imul ecx, 00000024
:00435DF5 81C1502C4B00            add ecx, 004B2C50
:00435DFB E81009FDFF              call 00406710
:00435E00 8BF0                    mov esi, eax
:00435E02 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00435E05 E80609FDFF              call 00406710
:00435E0A 3BF0                    cmp esi, eax
:00435E0C 740E                    je 00435E1C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435DE7(C)
|
:00435E0E 8B5514                  mov edx, dword ptr [ebp+14]
:00435E11 81E2FF000000            and edx, 000000FF
:00435E17 83FA02                  cmp edx, 00000002
:00435E1A 7511                    jne 00435E2D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00435DD9(C), :00435E0C(C)
|
:00435E1C 8B45F4                  mov eax, dword ptr [ebp-0C]
:00435E1F 8A4DF8                  mov cl, byte ptr [ebp-08]
:00435E22 8808                    mov byte ptr [eax], cl
:00435E24 8B55F4                  mov edx, dword ptr [ebp-0C]
:00435E27 83C201                  add edx, 00000001
:00435E2A 8955F4                  mov dword ptr [ebp-0C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00435DA4(C), :00435E1A(C)
|
:00435E2D E928FFFFFF              jmp 00435D5A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435D67(C)
|
:00435E32 8B45F4                  mov eax, dword ptr [ebp-0C]
:00435E35 C600FF                  mov byte ptr [eax], FF
:00435E38 E9CB060000              jmp 00436508
:00435E3D C745F000000000          mov [ebp-10], 00000000
:00435E44 EB09                    jmp 00435E4F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435F19(U)
|
:00435E46 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00435E49 83C101                  add ecx, 00000001
:00435E4C 894DF0                  mov dword ptr [ebp-10], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435E44(U)
|
:00435E4F 837DF008                cmp dword ptr [ebp-10], 00000008
:00435E53 0F83C5000000            jnb 00435F1E
:00435E59 8A55F0                  mov dl, byte ptr [ebp-10]
:00435E5C 52                      push edx
:00435E5D 8D4508                  lea eax, dword ptr [ebp+08]
:00435E60 50                      push eax
:00435E61 E88FFBFFFF              call 004359F5
:00435E66 83C408                  add esp, 00000008
:00435E69 50                      push eax
:00435E6A 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00435E6D E82E07FDFF              call 004065A0
:00435E72 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00435E75 51                      push ecx
:00435E76 E809FAFFFF              call 00435884
:00435E7B 83C404                  add esp, 00000004
:00435E7E 8845F8                  mov byte ptr [ebp-08], al
:00435E81 8B55F8                  mov edx, dword ptr [ebp-08]
:00435E84 81E2FF000000            and edx, 000000FF
:00435E8A 81FAFF000000            cmp edx, 000000FF
:00435E90 0F8483000000            je 00435F19
:00435E96 8B4514                  mov eax, dword ptr [ebp+14]
:00435E99 25FF000000              and eax, 000000FF
:00435E9E 85C0                    test eax, eax
:00435EA0 7525                    jne 00435EC7
:00435EA2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00435EA5 81E1FF000000            and ecx, 000000FF
:00435EAB 6BC924                  imul ecx, 00000024
:00435EAE 81C1502C4B00            add ecx, 004B2C50
:00435EB4 E85708FDFF              call 00406710
:00435EB9 8BF0                    mov esi, eax
:00435EBB 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00435EBE E84D08FDFF              call 00406710
:00435EC3 3BF0                    cmp esi, eax
:00435EC5 7541                    jne 00435F08

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435EA0(C)
|
:00435EC7 8B4D14                  mov ecx, dword ptr [ebp+14]
:00435ECA 81E1FF000000            and ecx, 000000FF
:00435ED0 83F901                  cmp ecx, 00000001
:00435ED3 7525                    jne 00435EFA
:00435ED5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00435ED8 81E1FF000000            and ecx, 000000FF
:00435EDE 6BC924                  imul ecx, 00000024
:00435EE1 81C1502C4B00            add ecx, 004B2C50
:00435EE7 E82408FDFF              call 00406710
:00435EEC 8BF0                    mov esi, eax
:00435EEE 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00435EF1 E81A08FDFF              call 00406710
:00435EF6 3BF0                    cmp esi, eax
:00435EF8 740E                    je 00435F08

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435ED3(C)
|
:00435EFA 8B5514                  mov edx, dword ptr [ebp+14]
:00435EFD 81E2FF000000            and edx, 000000FF
:00435F03 83FA02                  cmp edx, 00000002
:00435F06 7511                    jne 00435F19

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00435EC5(C), :00435EF8(C)
|
:00435F08 8B45F4                  mov eax, dword ptr [ebp-0C]
:00435F0B 8A4DF8                  mov cl, byte ptr [ebp-08]
:00435F0E 8808                    mov byte ptr [eax], cl
:00435F10 8B55F4                  mov edx, dword ptr [ebp-0C]
:00435F13 83C201                  add edx, 00000001
:00435F16 8955F4                  mov dword ptr [ebp-0C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00435E90(C), :00435F06(C)
|
:00435F19 E928FFFFFF              jmp 00435E46

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435E53(C)
|
:00435F1E 8B45F4                  mov eax, dword ptr [ebp-0C]
:00435F21 C600FF                  mov byte ptr [eax], FF
:00435F24 E9DF050000              jmp 00436508
:00435F29 C745F000000000          mov [ebp-10], 00000000
:00435F30 EB09                    jmp 00435F3B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436005(U)
|
:00435F32 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00435F35 83C101                  add ecx, 00000001
:00435F38 894DF0                  mov dword ptr [ebp-10], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435F30(U)
|
:00435F3B 837DF008                cmp dword ptr [ebp-10], 00000008
:00435F3F 0F83C5000000            jnb 0043600A
:00435F45 8A55F0                  mov dl, byte ptr [ebp-10]
:00435F48 52                      push edx
:00435F49 8D4508                  lea eax, dword ptr [ebp+08]
:00435F4C 50                      push eax
:00435F4D E8A3FAFFFF              call 004359F5
:00435F52 83C408                  add esp, 00000008
:00435F55 50                      push eax
:00435F56 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00435F59 E84206FDFF              call 004065A0
:00435F5E 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00435F61 51                      push ecx
:00435F62 E81DF9FFFF              call 00435884
:00435F67 83C404                  add esp, 00000004
:00435F6A 8845F8                  mov byte ptr [ebp-08], al
:00435F6D 8B55F8                  mov edx, dword ptr [ebp-08]
:00435F70 81E2FF000000            and edx, 000000FF
:00435F76 81FAFF000000            cmp edx, 000000FF
:00435F7C 0F8483000000            je 00436005
:00435F82 8B4514                  mov eax, dword ptr [ebp+14]
:00435F85 25FF000000              and eax, 000000FF
:00435F8A 85C0                    test eax, eax
:00435F8C 7525                    jne 00435FB3
:00435F8E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00435F91 81E1FF000000            and ecx, 000000FF
:00435F97 6BC924                  imul ecx, 00000024
:00435F9A 81C1502C4B00            add ecx, 004B2C50
:00435FA0 E86B07FDFF              call 00406710
:00435FA5 8BF0                    mov esi, eax
:00435FA7 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00435FAA E86107FDFF              call 00406710
:00435FAF 3BF0                    cmp esi, eax
:00435FB1 7541                    jne 00435FF4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435F8C(C)
|
:00435FB3 8B4D14                  mov ecx, dword ptr [ebp+14]
:00435FB6 81E1FF000000            and ecx, 000000FF
:00435FBC 83F901                  cmp ecx, 00000001
:00435FBF 7525                    jne 00435FE6
:00435FC1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00435FC4 81E1FF000000            and ecx, 000000FF
:00435FCA 6BC924                  imul ecx, 00000024
:00435FCD 81C1502C4B00            add ecx, 004B2C50
:00435FD3 E83807FDFF              call 00406710
:00435FD8 8BF0                    mov esi, eax
:00435FDA 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00435FDD E82E07FDFF              call 00406710
:00435FE2 3BF0                    cmp esi, eax
:00435FE4 740E                    je 00435FF4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435FBF(C)
|
:00435FE6 8B5514                  mov edx, dword ptr [ebp+14]
:00435FE9 81E2FF000000            and edx, 000000FF
:00435FEF 83FA02                  cmp edx, 00000002
:00435FF2 7511                    jne 00436005

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00435FB1(C), :00435FE4(C)
|
:00435FF4 8B45F4                  mov eax, dword ptr [ebp-0C]
:00435FF7 8A4DF8                  mov cl, byte ptr [ebp-08]
:00435FFA 8808                    mov byte ptr [eax], cl
:00435FFC 8B55F4                  mov edx, dword ptr [ebp-0C]
:00435FFF 83C201                  add edx, 00000001
:00436002 8955F4                  mov dword ptr [ebp-0C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00435F7C(C), :00435FF2(C)
|
:00436005 E928FFFFFF              jmp 00435F32

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00435F3F(C)
|
:0043600A 8A4514                  mov al, byte ptr [ebp+14]
:0043600D 50                      push eax
:0043600E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00436011 51                      push ecx
:00436012 8A5509                  mov dl, byte ptr [ebp+09]
:00436015 52                      push edx
:00436016 8B4508                  mov eax, dword ptr [ebp+08]
:00436019 25FF000000              and eax, 000000FF
:0043601E 83C002                  add eax, 00000002
:00436021 50                      push eax
:00436022 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00436025 E8C8FBFFFF              call 00435BF2
:0043602A 8945F4                  mov dword ptr [ebp-0C], eax
:0043602D 8A4D14                  mov cl, byte ptr [ebp+14]
:00436030 51                      push ecx
:00436031 8B55F4                  mov edx, dword ptr [ebp-0C]
:00436034 52                      push edx
:00436035 8A4509                  mov al, byte ptr [ebp+09]
:00436038 50                      push eax
:00436039 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043603C 81E1FF000000            and ecx, 000000FF
:00436042 83E902                  sub ecx, 00000002
:00436045 51                      push ecx
:00436046 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00436049 E8A4FBFFFF              call 00435BF2
:0043604E 8945F4                  mov dword ptr [ebp-0C], eax
:00436051 8A5514                  mov dl, byte ptr [ebp+14]
:00436054 52                      push edx
:00436055 8B45F4                  mov eax, dword ptr [ebp-0C]
:00436058 50                      push eax
:00436059 8B4D09                  mov ecx, dword ptr [ebp+09]
:0043605C 81E1FF000000            and ecx, 000000FF
:00436062 83C102                  add ecx, 00000002
:00436065 51                      push ecx
:00436066 8A5508                  mov dl, byte ptr [ebp+08]
:00436069 52                      push edx
:0043606A 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043606D E880FBFFFF              call 00435BF2
:00436072 8945F4                  mov dword ptr [ebp-0C], eax
:00436075 8A4514                  mov al, byte ptr [ebp+14]
:00436078 50                      push eax
:00436079 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043607C 51                      push ecx
:0043607D 8B5509                  mov edx, dword ptr [ebp+09]
:00436080 81E2FF000000            and edx, 000000FF
:00436086 83EA02                  sub edx, 00000002
:00436089 52                      push edx
:0043608A 8A4508                  mov al, byte ptr [ebp+08]
:0043608D 50                      push eax
:0043608E 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00436091 E85CFBFFFF              call 00435BF2
:00436096 8945F4                  mov dword ptr [ebp-0C], eax
:00436099 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043609C C601FF                  mov byte ptr [ecx], FF
:0043609F E964040000              jmp 00436508
:004360A4 8B5518                  mov edx, dword ptr [ebp+18]
:004360A7 81E2FF000000            and edx, 000000FF
:004360AD 81FAFF000000            cmp edx, 000000FF
:004360B3 7509                    jne 004360BE
:004360B5 8B45E4                  mov eax, dword ptr [ebp-1C]
:004360B8 8A4806                  mov cl, byte ptr [eax+06]
:004360BB 884D18                  mov byte ptr [ebp+18], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004360B3(C)
|
:004360BE 8B551C                  mov edx, dword ptr [ebp+1C]
:004360C1 81E2FF000000            and edx, 000000FF
:004360C7 81FAFF000000            cmp edx, 000000FF
:004360CD 7509                    jne 004360D8
:004360CF 8B45E4                  mov eax, dword ptr [ebp-1C]
:004360D2 8A4807                  mov cl, byte ptr [eax+07]
:004360D5 884D1C                  mov byte ptr [ebp+1C], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004360CD(C)
|
:004360D8 8B5508                  mov edx, dword ptr [ebp+08]
:004360DB 81E2FF000000            and edx, 000000FF
:004360E1 8B4518                  mov eax, dword ptr [ebp+18]
:004360E4 25FF000000              and eax, 000000FF
:004360E9 3BD0                    cmp edx, eax
:004360EB 7506                    jne 004360F3
:004360ED C645EC00                mov [ebp-14], 00
:004360F1 EB20                    jmp 00436113

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004360EB(C)
|
:004360F3 8B4D08                  mov ecx, dword ptr [ebp+08]
:004360F6 81E1FF000000            and ecx, 000000FF
:004360FC 8B5518                  mov edx, dword ptr [ebp+18]
:004360FF 81E2FF000000            and edx, 000000FF
:00436105 3BCA                    cmp ecx, edx
:00436107 7E06                    jle 0043610F
:00436109 C645EC01                mov [ebp-14], 01
:0043610D EB04                    jmp 00436113

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436107(C)
|
:0043610F C645ECFF                mov [ebp-14], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004360F1(U), :0043610D(U)
|
:00436113 8B4509                  mov eax, dword ptr [ebp+09]
:00436116 25FF000000              and eax, 000000FF
:0043611B 8B4D1C                  mov ecx, dword ptr [ebp+1C]
:0043611E 81E1FF000000            and ecx, 000000FF
:00436124 3BC1                    cmp eax, ecx
:00436126 7506                    jne 0043612E
:00436128 C645E800                mov [ebp-18], 00
:0043612C EB1F                    jmp 0043614D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436126(C)
|
:0043612E 8B5509                  mov edx, dword ptr [ebp+09]
:00436131 81E2FF000000            and edx, 000000FF
:00436137 8B451C                  mov eax, dword ptr [ebp+1C]
:0043613A 25FF000000              and eax, 000000FF
:0043613F 3BD0                    cmp edx, eax
:00436141 7E06                    jle 00436149
:00436143 C645E801                mov [ebp-18], 01
:00436147 EB04                    jmp 0043614D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436141(C)
|
:00436149 C645E8FF                mov [ebp-18], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043612C(U), :00436147(U)
|
:0043614D 8A4D14                  mov cl, byte ptr [ebp+14]
:00436150 51                      push ecx
:00436151 8B55F4                  mov edx, dword ptr [ebp-0C]
:00436154 52                      push edx
:00436155 8B4509                  mov eax, dword ptr [ebp+09]
:00436158 25FF000000              and eax, 000000FF
:0043615D 0FBE4DE8                movsx ecx, byte ptr [ebp-18]
:00436161 03C1                    add eax, ecx
:00436163 50                      push eax
:00436164 8B5508                  mov edx, dword ptr [ebp+08]
:00436167 81E2FF000000            and edx, 000000FF
:0043616D 0FBE45EC                movsx eax, byte ptr [ebp-14]
:00436171 03D0                    add edx, eax
:00436173 52                      push edx
:00436174 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00436177 E876FAFFFF              call 00435BF2
:0043617C 8945F4                  mov dword ptr [ebp-0C], eax
:0043617F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00436182 C601FF                  mov byte ptr [ecx], FF
:00436185 E97E030000              jmp 00436508
:0043618A 8B5518                  mov edx, dword ptr [ebp+18]
:0043618D 81E2FF000000            and edx, 000000FF
:00436193 81FAFF000000            cmp edx, 000000FF
:00436199 7509                    jne 004361A4
:0043619B 8B45E4                  mov eax, dword ptr [ebp-1C]
:0043619E 8A4806                  mov cl, byte ptr [eax+06]
:004361A1 884D18                  mov byte ptr [ebp+18], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436199(C)
|
:004361A4 8B551C                  mov edx, dword ptr [ebp+1C]
:004361A7 81E2FF000000            and edx, 000000FF
:004361AD 81FAFF000000            cmp edx, 000000FF
:004361B3 7509                    jne 004361BE
:004361B5 8B45E4                  mov eax, dword ptr [ebp-1C]
:004361B8 8A4807                  mov cl, byte ptr [eax+07]
:004361BB 884D1C                  mov byte ptr [ebp+1C], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004361B3(C)
|
:004361BE 8B5508                  mov edx, dword ptr [ebp+08]
:004361C1 81E2FF000000            and edx, 000000FF
:004361C7 8B4518                  mov eax, dword ptr [ebp+18]
:004361CA 25FF000000              and eax, 000000FF
:004361CF 3BD0                    cmp edx, eax
:004361D1 7506                    jne 004361D9
:004361D3 C645EC00                mov [ebp-14], 00
:004361D7 EB20                    jmp 004361F9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004361D1(C)
|
:004361D9 8B4D08                  mov ecx, dword ptr [ebp+08]
:004361DC 81E1FF000000            and ecx, 000000FF
:004361E2 8B5518                  mov edx, dword ptr [ebp+18]
:004361E5 81E2FF000000            and edx, 000000FF
:004361EB 3BCA                    cmp ecx, edx
:004361ED 7E06                    jle 004361F5
:004361EF C645EC01                mov [ebp-14], 01
:004361F3 EB04                    jmp 004361F9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004361ED(C)
|
:004361F5 C645ECFF                mov [ebp-14], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004361D7(U), :004361F3(U)
|
:004361F9 8B4509                  mov eax, dword ptr [ebp+09]
:004361FC 25FF000000              and eax, 000000FF
:00436201 8B4D1C                  mov ecx, dword ptr [ebp+1C]
:00436204 81E1FF000000            and ecx, 000000FF
:0043620A 3BC1                    cmp eax, ecx
:0043620C 7506                    jne 00436214
:0043620E C645E800                mov [ebp-18], 00
:00436212 EB1F                    jmp 00436233

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043620C(C)
|
:00436214 8B5509                  mov edx, dword ptr [ebp+09]
:00436217 81E2FF000000            and edx, 000000FF
:0043621D 8B451C                  mov eax, dword ptr [ebp+1C]
:00436220 25FF000000              and eax, 000000FF
:00436225 3BD0                    cmp edx, eax
:00436227 7E06                    jle 0043622F
:00436229 C645E801                mov [ebp-18], 01
:0043622D EB04                    jmp 00436233

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436227(C)
|
:0043622F C645E8FF                mov [ebp-18], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00436212(U), :0043622D(U)
|
:00436233 C745F000000000          mov [ebp-10], 00000000
:0043623A EB09                    jmp 00436245

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043628F(U)
|
:0043623C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043623F 83C101                  add ecx, 00000001
:00436242 894DF0                  mov dword ptr [ebp-10], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043623A(U)
|
:00436245 837DF005                cmp dword ptr [ebp-10], 00000005
:00436249 7346                    jnb 00436291
:0043624B 8A5514                  mov dl, byte ptr [ebp+14]
:0043624E 52                      push edx
:0043624F 8B45F4                  mov eax, dword ptr [ebp-0C]
:00436252 50                      push eax
:00436253 8B4D09                  mov ecx, dword ptr [ebp+09]
:00436256 81E1FF000000            and ecx, 000000FF
:0043625C 0FBE55E8                movsx edx, byte ptr [ebp-18]
:00436260 03CA                    add ecx, edx
:00436262 51                      push ecx
:00436263 8B4508                  mov eax, dword ptr [ebp+08]
:00436266 25FF000000              and eax, 000000FF
:0043626B 0FBE4DEC                movsx ecx, byte ptr [ebp-14]
:0043626F 03C1                    add eax, ecx
:00436271 50                      push eax
:00436272 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00436275 E878F9FFFF              call 00435BF2
:0043627A 8945F4                  mov dword ptr [ebp-0C], eax
:0043627D 8A5508                  mov dl, byte ptr [ebp+08]
:00436280 0255EC                  add dl, byte ptr [ebp-14]
:00436283 885508                  mov byte ptr [ebp+08], dl
:00436286 8A4509                  mov al, byte ptr [ebp+09]
:00436289 0245E8                  add al, byte ptr [ebp-18]
:0043628C 884509                  mov byte ptr [ebp+09], al
:0043628F EBAB                    jmp 0043623C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436249(C)
|
:00436291 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00436294 C601FF                  mov byte ptr [ecx], FF
:00436297 E96C020000              jmp 00436508
:0043629C C745F000000000          mov [ebp-10], 00000000
:004362A3 EB09                    jmp 004362AE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436376(U)
|
:004362A5 8B55F0                  mov edx, dword ptr [ebp-10]
:004362A8 83C201                  add edx, 00000001
:004362AB 8955F0                  mov dword ptr [ebp-10], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004362A3(U)
|
:004362AE 837DF008                cmp dword ptr [ebp-10], 00000008
:004362B2 0F83C3000000            jnb 0043637B
:004362B8 8A45F0                  mov al, byte ptr [ebp-10]
:004362BB 50                      push eax
:004362BC 8D4D08                  lea ecx, dword ptr [ebp+08]
:004362BF 51                      push ecx
:004362C0 E830F7FFFF              call 004359F5
:004362C5 83C408                  add esp, 00000008
:004362C8 50                      push eax
:004362C9 8D4DFC                  lea ecx, dword ptr [ebp-04]
:004362CC E8CF02FDFF              call 004065A0
:004362D1 8D55FC                  lea edx, dword ptr [ebp-04]
:004362D4 52                      push edx
:004362D5 E8AAF5FFFF              call 00435884
:004362DA 83C404                  add esp, 00000004
:004362DD 8845F8                  mov byte ptr [ebp-08], al
:004362E0 8B45F8                  mov eax, dword ptr [ebp-08]
:004362E3 25FF000000              and eax, 000000FF
:004362E8 3DFF000000              cmp eax, 000000FF
:004362ED 0F8483000000            je 00436376
:004362F3 8B4D14                  mov ecx, dword ptr [ebp+14]
:004362F6 81E1FF000000            and ecx, 000000FF
:004362FC 85C9                    test ecx, ecx
:004362FE 7525                    jne 00436325
:00436300 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00436303 81E1FF000000            and ecx, 000000FF
:00436309 6BC924                  imul ecx, 00000024
:0043630C 81C1502C4B00            add ecx, 004B2C50
:00436312 E8F903FDFF              call 00406710
:00436317 8BF0                    mov esi, eax
:00436319 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043631C E8EF03FDFF              call 00406710
:00436321 3BF0                    cmp esi, eax
:00436323 7540                    jne 00436365

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004362FE(C)
|
:00436325 8B5514                  mov edx, dword ptr [ebp+14]
:00436328 81E2FF000000            and edx, 000000FF
:0043632E 83FA01                  cmp edx, 00000001
:00436331 7525                    jne 00436358
:00436333 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00436336 81E1FF000000            and ecx, 000000FF
:0043633C 6BC924                  imul ecx, 00000024
:0043633F 81C1502C4B00            add ecx, 004B2C50
:00436345 E8C603FDFF              call 00406710
:0043634A 8BF0                    mov esi, eax
:0043634C 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043634F E8BC03FDFF              call 00406710
:00436354 3BF0                    cmp esi, eax
:00436356 740D                    je 00436365

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436331(C)
|
:00436358 8B4514                  mov eax, dword ptr [ebp+14]
:0043635B 25FF000000              and eax, 000000FF
:00436360 83F802                  cmp eax, 00000002
:00436363 7511                    jne 00436376

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00436323(C), :00436356(C)
|
:00436365 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00436368 8A55F8                  mov dl, byte ptr [ebp-08]
:0043636B 8811                    mov byte ptr [ecx], dl
:0043636D 8B45F4                  mov eax, dword ptr [ebp-0C]
:00436370 83C001                  add eax, 00000001
:00436373 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004362ED(C), :00436363(C)
|
:00436376 E92AFFFFFF              jmp 004362A5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004362B2(C)
|
:0043637B C745F000000000          mov [ebp-10], 00000000
:00436382 EB09                    jmp 0043638D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004363F5(U)
|
:00436384 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00436387 83C101                  add ecx, 00000001
:0043638A 894DF0                  mov dword ptr [ebp-10], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436382(U)
|
:0043638D 837DF003                cmp dword ptr [ebp-10], 00000003
:00436391 7364                    jnb 004363F7
:00436393 8A5514                  mov dl, byte ptr [ebp+14]
:00436396 52                      push edx
:00436397 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043639A 50                      push eax
:0043639B 8B4D09                  mov ecx, dword ptr [ebp+09]
:0043639E 81E1FF000000            and ecx, 000000FF
:004363A4 83E902                  sub ecx, 00000002
:004363A7 51                      push ecx
:004363A8 8B5508                  mov edx, dword ptr [ebp+08]
:004363AB 81E2FF000000            and edx, 000000FF
:004363B1 8B45F0                  mov eax, dword ptr [ebp-10]
:004363B4 8D4C02FF                lea ecx, dword ptr [edx+eax-01]
:004363B8 51                      push ecx
:004363B9 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004363BC E831F8FFFF              call 00435BF2
:004363C1 8945F4                  mov dword ptr [ebp-0C], eax
:004363C4 8A5514                  mov dl, byte ptr [ebp+14]
:004363C7 52                      push edx
:004363C8 8B45F4                  mov eax, dword ptr [ebp-0C]
:004363CB 50                      push eax
:004363CC 8B4D09                  mov ecx, dword ptr [ebp+09]
:004363CF 81E1FF000000            and ecx, 000000FF
:004363D5 83C102                  add ecx, 00000002
:004363D8 51                      push ecx
:004363D9 8B5508                  mov edx, dword ptr [ebp+08]
:004363DC 81E2FF000000            and edx, 000000FF
:004363E2 8B45F0                  mov eax, dword ptr [ebp-10]
:004363E5 8D4C02FF                lea ecx, dword ptr [edx+eax-01]
:004363E9 51                      push ecx
:004363EA 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004363ED E800F8FFFF              call 00435BF2
:004363F2 8945F4                  mov dword ptr [ebp-0C], eax
:004363F5 EB8D                    jmp 00436384

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436391(C)
|
:004363F7 C745F000000000          mov [ebp-10], 00000000
:004363FE EB09                    jmp 00436409

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436471(U)
|
:00436400 8B55F0                  mov edx, dword ptr [ebp-10]
:00436403 83C201                  add edx, 00000001
:00436406 8955F0                  mov dword ptr [ebp-10], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004363FE(U)
|
:00436409 837DF003                cmp dword ptr [ebp-10], 00000003
:0043640D 7364                    jnb 00436473
:0043640F 8A4514                  mov al, byte ptr [ebp+14]
:00436412 50                      push eax
:00436413 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00436416 51                      push ecx
:00436417 8B5509                  mov edx, dword ptr [ebp+09]
:0043641A 81E2FF000000            and edx, 000000FF
:00436420 8B45F0                  mov eax, dword ptr [ebp-10]
:00436423 8D4C02FF                lea ecx, dword ptr [edx+eax-01]
:00436427 51                      push ecx
:00436428 8B5508                  mov edx, dword ptr [ebp+08]
:0043642B 81E2FF000000            and edx, 000000FF
:00436431 83EA02                  sub edx, 00000002
:00436434 52                      push edx
:00436435 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00436438 E8B5F7FFFF              call 00435BF2
:0043643D 8945F4                  mov dword ptr [ebp-0C], eax
:00436440 8A4514                  mov al, byte ptr [ebp+14]
:00436443 50                      push eax
:00436444 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00436447 51                      push ecx
:00436448 8B5509                  mov edx, dword ptr [ebp+09]
:0043644B 81E2FF000000            and edx, 000000FF
:00436451 8B45F0                  mov eax, dword ptr [ebp-10]
:00436454 8D4C02FF                lea ecx, dword ptr [edx+eax-01]
:00436458 51                      push ecx
:00436459 8B5508                  mov edx, dword ptr [ebp+08]
:0043645C 81E2FF000000            and edx, 000000FF
:00436462 83C202                  add edx, 00000002
:00436465 52                      push edx
:00436466 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00436469 E884F7FFFF              call 00435BF2
:0043646E 8945F4                  mov dword ptr [ebp-0C], eax
:00436471 EB8D                    jmp 00436400

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043640D(C)
|
:00436473 8A4514                  mov al, byte ptr [ebp+14]
:00436476 50                      push eax
:00436477 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043647A 51                      push ecx
:0043647B 8A5509                  mov dl, byte ptr [ebp+09]
:0043647E 52                      push edx
:0043647F 8B4508                  mov eax, dword ptr [ebp+08]
:00436482 25FF000000              and eax, 000000FF
:00436487 83C003                  add eax, 00000003
:0043648A 50                      push eax
:0043648B 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043648E E85FF7FFFF              call 00435BF2
:00436493 8945F4                  mov dword ptr [ebp-0C], eax
:00436496 8A4D14                  mov cl, byte ptr [ebp+14]
:00436499 51                      push ecx
:0043649A 8B55F4                  mov edx, dword ptr [ebp-0C]
:0043649D 52                      push edx
:0043649E 8A4509                  mov al, byte ptr [ebp+09]
:004364A1 50                      push eax
:004364A2 8B4D08                  mov ecx, dword ptr [ebp+08]
:004364A5 81E1FF000000            and ecx, 000000FF
:004364AB 83E903                  sub ecx, 00000003
:004364AE 51                      push ecx
:004364AF 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004364B2 E83BF7FFFF              call 00435BF2
:004364B7 8945F4                  mov dword ptr [ebp-0C], eax
:004364BA 8A5514                  mov dl, byte ptr [ebp+14]
:004364BD 52                      push edx
:004364BE 8B45F4                  mov eax, dword ptr [ebp-0C]
:004364C1 50                      push eax
:004364C2 8B4D09                  mov ecx, dword ptr [ebp+09]
:004364C5 81E1FF000000            and ecx, 000000FF
:004364CB 83C103                  add ecx, 00000003
:004364CE 51                      push ecx
:004364CF 8A5508                  mov dl, byte ptr [ebp+08]
:004364D2 52                      push edx
:004364D3 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004364D6 E817F7FFFF              call 00435BF2
:004364DB 8945F4                  mov dword ptr [ebp-0C], eax
:004364DE 8A4514                  mov al, byte ptr [ebp+14]
:004364E1 50                      push eax
:004364E2 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004364E5 51                      push ecx
:004364E6 8B5509                  mov edx, dword ptr [ebp+09]
:004364E9 81E2FF000000            and edx, 000000FF
:004364EF 83EA03                  sub edx, 00000003
:004364F2 52                      push edx
:004364F3 8A4508                  mov al, byte ptr [ebp+08]
:004364F6 50                      push eax
:004364F7 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004364FA E8F3F6FFFF              call 00435BF2
:004364FF 8945F4                  mov dword ptr [ebp-0C], eax
:00436502 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00436505 C601FF                  mov byte ptr [ecx], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00435D36(C), :00435D4C(U), :00435E38(U), :00435F24(U), :0043609F(U)
|:00436185(U), :00436297(U)
|
:00436508 8B4510                  mov eax, dword ptr [ebp+10]
:0043650B 5E                      pop esi
:0043650C 8BE5                    mov esp, ebp
:0043650E 5D                      pop ebp
:0043650F C21800                  ret 0018



:00436512 465D4300                DWORD 00435D46
:00436516 515D4300                DWORD 00435D51
:0043651A 3D5E4300                DWORD 00435E3D
:0043651E 295F4300                DWORD 00435F29
:00436522 A4604300                DWORD 004360A4
:00436526 8A614300                DWORD 0043618A
:0043652A 9C624300                DWORD 0043629C



* Referenced by a CALL at Addresses:
|:00406304   , :0042538B   , :00435B08   , :00435B2D   
|
:0043652E 55                      push ebp
:0043652F 8BEC                    mov ebp, esp
:00436531 83EC08                  sub esp, 00000008
:00436534 894DF8                  mov dword ptr [ebp-08], ecx
:00436537 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0043653A E8D1910200              call 0045F710
:0043653F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00436542 81E1FF000000            and ecx, 000000FF
:00436548 6BC924                  imul ecx, 00000024
:0043654B 81C1502C4B00            add ecx, 004B2C50
:00436551 E80ACEFCFF              call 00403360
:00436556 50                      push eax
:00436557 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0043655A E84100FDFF              call 004065A0
:0043655F 8A451C                  mov al, byte ptr [ebp+1C]
:00436562 50                      push eax
:00436563 8A4D18                  mov cl, byte ptr [ebp+18]
:00436566 51                      push ecx
:00436567 8A5514                  mov dl, byte ptr [ebp+14]
:0043656A 52                      push edx
:0043656B 8B4510                  mov eax, dword ptr [ebp+10]
:0043656E 50                      push eax
:0043656F 8A4D0C                  mov cl, byte ptr [ebp+0C]
:00436572 51                      push ecx
:00436573 668B55FC                mov dx, word ptr [ebp-04]
:00436577 52                      push edx
:00436578 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043657B E886F7FFFF              call 00435D06
:00436580 8BE5                    mov esp, ebp
:00436582 5D                      pop ebp
:00436583 C21800                  ret 0018



* Referenced by a CALL at Addresses:
|:0040649A   , :0043899A   , :00438D3C   , :00439409   , :0043A373   
|:0043AB4E   , :0043ACB9   , :0043DBC8   , :0043E2F4   , :00455431   
|:0045B329   
|
:00436586 55                      push ebp
:00436587 8BEC                    mov ebp, esp
:00436589 83EC3C                  sub esp, 0000003C
:0043658C 894DE0                  mov dword ptr [ebp-20], ecx
:0043658F C645E4FF                mov [ebp-1C], FF
:00436593 68FF000000              push 000000FF
:00436598 68FF000000              push 000000FF
:0043659D 8D4DFC                  lea ecx, dword ptr [ebp-04]
:004365A0 E82B27FEFF              call 00418CD0
:004365A5 8B450C                  mov eax, dword ptr [ebp+0C]
:004365A8 25FF000000              and eax, 000000FF
:004365AD 3DFF000000              cmp eax, 000000FF
:004365B2 7507                    jne 004365BB
:004365B4 0CFF                    or al, FF
:004365B6 E903140000              jmp 004379BE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004365B2(C)
|
:004365BB 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004365BE 81E1FF000000            and ecx, 000000FF
:004365C4 81E180000000            and ecx, 00000080
:004365CA 894DE8                  mov dword ptr [ebp-18], ecx
:004365CD 8A550C                  mov dl, byte ptr [ebp+0C]
:004365D0 80E27F                  and dl, 7F
:004365D3 88550C                  mov byte ptr [ebp+0C], dl
:004365D6 8B4514                  mov eax, dword ptr [ebp+14]
:004365D9 25FF000000              and eax, 000000FF
:004365DE 85C0                    test eax, eax
:004365E0 750A                    jne 004365EC
:004365E2 C705342C4B0048C74A00    mov dword ptr [004B2C34], 004AC748

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004365E0(C)
|
:004365EC 8B4D10                  mov ecx, dword ptr [ebp+10]
:004365EF 81E1FF000000            and ecx, 000000FF
:004365F5 83E101                  and ecx, 00000001
:004365F8 85C9                    test ecx, ecx
:004365FA 7424                    je 00436620
:004365FC 8A5514                  mov dl, byte ptr [ebp+14]
:004365FF 52                      push edx
:00436600 8A4510                  mov al, byte ptr [ebp+10]
:00436603 50                      push eax
:00436604 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00436607 8A5104                  mov dl, byte ptr [ecx+04]
:0043660A 52                      push edx
:0043660B 8B4508                  mov eax, dword ptr [ebp+08]
:0043660E 8A4801                  mov cl, byte ptr [eax+01]
:00436611 51                      push ecx
:00436612 8B5508                  mov edx, dword ptr [ebp+08]
:00436615 8A02                    mov al, byte ptr [edx]
:00436617 50                      push eax
:00436618 E8E7130000              call 00437A04
:0043661D 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004365FA(C)
|
:00436620 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00436623 81E1FF000000            and ecx, 000000FF
:00436629 894DDC                  mov dword ptr [ebp-24], ecx
:0043662C 837DDC0F                cmp dword ptr [ebp-24], 0000000F
:00436630 0F870B130000            ja 00437941
:00436636 8B55DC                  mov edx, dword ptr [ebp-24]
:00436639 FF2495C4794300          jmp dword ptr [4*edx+004379C4]
:00436640 8B45E0                  mov eax, dword ptr [ebp-20]
:00436643 8A4804                  mov cl, byte ptr [eax+04]
:00436646 51                      push ecx
:00436647 8A5514                  mov dl, byte ptr [ebp+14]
:0043664A 52                      push edx
:0043664B 8A4510                  mov al, byte ptr [ebp+10]
:0043664E 50                      push eax
:0043664F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00436652 51                      push ecx
:00436653 E8A2150000              call 00437BFA
:00436658 83C410                  add esp, 00000010
:0043665B E9E1120000              jmp 00437941
:00436660 8B55E0                  mov edx, dword ptr [ebp-20]
:00436663 8A4204                  mov al, byte ptr [edx+04]
:00436666 50                      push eax
:00436667 8A4D14                  mov cl, byte ptr [ebp+14]
:0043666A 51                      push ecx
:0043666B 8A5510                  mov dl, byte ptr [ebp+10]
:0043666E 52                      push edx
:0043666F 8B4508                  mov eax, dword ptr [ebp+08]
:00436672 50                      push eax
:00436673 E882150000              call 00437BFA
:00436678 83C410                  add esp, 00000010
:0043667B 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0043667E 8A5104                  mov dl, byte ptr [ecx+04]
:00436681 52                      push edx
:00436682 8A4514                  mov al, byte ptr [ebp+14]
:00436685 50                      push eax
:00436686 8A4D10                  mov cl, byte ptr [ebp+10]
:00436689 51                      push ecx
:0043668A 8B5508                  mov edx, dword ptr [ebp+08]
:0043668D 52                      push edx
:0043668E E8E7150000              call 00437C7A
:00436693 83C410                  add esp, 00000010
:00436696 E9A6120000              jmp 00437941
:0043669B 8B45E0                  mov eax, dword ptr [ebp-20]
:0043669E 8A4804                  mov cl, byte ptr [eax+04]
:004366A1 51                      push ecx
:004366A2 8A5514                  mov dl, byte ptr [ebp+14]
:004366A5 52                      push edx
:004366A6 8A4510                  mov al, byte ptr [ebp+10]
:004366A9 50                      push eax
:004366AA 8B4D08                  mov ecx, dword ptr [ebp+08]
:004366AD 51                      push ecx
:004366AE E8C7150000              call 00437C7A
:004366B3 83C410                  add esp, 00000010
:004366B6 8A5514                  mov dl, byte ptr [ebp+14]
:004366B9 52                      push edx
:004366BA 8A4510                  mov al, byte ptr [ebp+10]
:004366BD 50                      push eax
:004366BE 8B4DE0                  mov ecx, dword ptr [ebp-20]
:004366C1 8A5104                  mov dl, byte ptr [ecx+04]
:004366C4 52                      push edx
:004366C5 8B4508                  mov eax, dword ptr [ebp+08]
:004366C8 8A4801                  mov cl, byte ptr [eax+01]
:004366CB 51                      push ecx
:004366CC 8B5508                  mov edx, dword ptr [ebp+08]
:004366CF 33C0                    xor eax, eax
:004366D1 8A02                    mov al, byte ptr [edx]
:004366D3 83E802                  sub eax, 00000002
:004366D6 50                      push eax
:004366D7 E828130000              call 00437A04
:004366DC 83C414                  add esp, 00000014
:004366DF 8A4D14                  mov cl, byte ptr [ebp+14]
:004366E2 51                      push ecx
:004366E3 8A5510                  mov dl, byte ptr [ebp+10]
:004366E6 52                      push edx
:004366E7 8B45E0                  mov eax, dword ptr [ebp-20]
:004366EA 8A4804                  mov cl, byte ptr [eax+04]
:004366ED 51                      push ecx
:004366EE 8B5508                  mov edx, dword ptr [ebp+08]
:004366F1 8A4201                  mov al, byte ptr [edx+01]
:004366F4 50                      push eax
:004366F5 8B4D08                  mov ecx, dword ptr [ebp+08]
:004366F8 33D2                    xor edx, edx
:004366FA 8A11                    mov dl, byte ptr [ecx]
:004366FC 83C202                  add edx, 00000002
:004366FF 52                      push edx
:00436700 E8FF120000              call 00437A04
:00436705 83C414                  add esp, 00000014
:00436708 8A4514                  mov al, byte ptr [ebp+14]
:0043670B 50                      push eax
:0043670C 8A4D10                  mov cl, byte ptr [ebp+10]
:0043670F 51                      push ecx
:00436710 8B55E0                  mov edx, dword ptr [ebp-20]
:00436713 8A4204                  mov al, byte ptr [edx+04]
:00436716 50                      push eax
:00436717 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043671A 33D2                    xor edx, edx
:0043671C 8A5101                  mov dl, byte ptr [ecx+01]
:0043671F 83EA02                  sub edx, 00000002
:00436722 52                      push edx
:00436723 8B4508                  mov eax, dword ptr [ebp+08]
:00436726 8A08                    mov cl, byte ptr [eax]
:00436728 51                      push ecx
:00436729 E8D6120000              call 00437A04
:0043672E 83C414                  add esp, 00000014
:00436731 8A5514                  mov dl, byte ptr [ebp+14]
:00436734 52                      push edx
:00436735 8A4510                  mov al, byte ptr [ebp+10]
:00436738 50                      push eax
:00436739 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0043673C 8A5104                  mov dl, byte ptr [ecx+04]
:0043673F 52                      push edx
:00436740 8B4508                  mov eax, dword ptr [ebp+08]
:00436743 33C9                    xor ecx, ecx
:00436745 8A4801                  mov cl, byte ptr [eax+01]
:00436748 83C102                  add ecx, 00000002
:0043674B 51                      push ecx
:0043674C 8B5508                  mov edx, dword ptr [ebp+08]
:0043674F 8A02                    mov al, byte ptr [edx]
:00436751 50                      push eax
:00436752 E8AD120000              call 00437A04
:00436757 83C414                  add esp, 00000014
:0043675A E9E2110000              jmp 00437941
:0043675F 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00436762 8A5104                  mov dl, byte ptr [ecx+04]
:00436765 52                      push edx
:00436766 8A4514                  mov al, byte ptr [ebp+14]
:00436769 50                      push eax
:0043676A 8A4D10                  mov cl, byte ptr [ebp+10]
:0043676D 51                      push ecx
:0043676E 8B5508                  mov edx, dword ptr [ebp+08]
:00436771 52                      push edx
:00436772 E803150000              call 00437C7A
:00436777 83C410                  add esp, 00000010
:0043677A C645F000                mov [ebp-10], 00
:0043677E EB08                    jmp 00436788

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436806(U)
|
:00436780 8A45F0                  mov al, byte ptr [ebp-10]
:00436783 0401                    add al, 01
:00436785 8845F0                  mov byte ptr [ebp-10], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043677E(U)
|
:00436788 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043678B 81E1FF000000            and ecx, 000000FF
:00436791 83F903                  cmp ecx, 00000003
:00436794 7D75                    jge 0043680B
:00436796 8A5514                  mov dl, byte ptr [ebp+14]
:00436799 52                      push edx
:0043679A 8A4510                  mov al, byte ptr [ebp+10]
:0043679D 50                      push eax
:0043679E 8B4DE0                  mov ecx, dword ptr [ebp-20]
:004367A1 8A5104                  mov dl, byte ptr [ecx+04]
:004367A4 52                      push edx
:004367A5 8B4508                  mov eax, dword ptr [ebp+08]
:004367A8 33C9                    xor ecx, ecx
:004367AA 8A4801                  mov cl, byte ptr [eax+01]
:004367AD 83E902                  sub ecx, 00000002
:004367B0 51                      push ecx
:004367B1 8B5508                  mov edx, dword ptr [ebp+08]
:004367B4 33C0                    xor eax, eax
:004367B6 8A02                    mov al, byte ptr [edx]
:004367B8 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004367BB 81E1FF000000            and ecx, 000000FF
:004367C1 8D5408FF                lea edx, dword ptr [eax+ecx-01]
:004367C5 52                      push edx
:004367C6 E839120000              call 00437A04
:004367CB 83C414                  add esp, 00000014
:004367CE 8A4514                  mov al, byte ptr [ebp+14]
:004367D1 50                      push eax
:004367D2 8A4D10                  mov cl, byte ptr [ebp+10]
:004367D5 51                      push ecx
:004367D6 8B55E0                  mov edx, dword ptr [ebp-20]
:004367D9 8A4204                  mov al, byte ptr [edx+04]
:004367DC 50                      push eax
:004367DD 8B4D08                  mov ecx, dword ptr [ebp+08]
:004367E0 33D2                    xor edx, edx
:004367E2 8A5101                  mov dl, byte ptr [ecx+01]
:004367E5 83C202                  add edx, 00000002
:004367E8 52                      push edx
:004367E9 8B4508                  mov eax, dword ptr [ebp+08]
:004367EC 33C9                    xor ecx, ecx
:004367EE 8A08                    mov cl, byte ptr [eax]
:004367F0 8B55F0                  mov edx, dword ptr [ebp-10]
:004367F3 81E2FF000000            and edx, 000000FF
:004367F9 8D4411FF                lea eax, dword ptr [ecx+edx-01]
:004367FD 50                      push eax
:004367FE E801120000              call 00437A04
:00436803 83C414                  add esp, 00000014
:00436806 E975FFFFFF              jmp 00436780

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436794(C)
|
:0043680B C645F000                mov [ebp-10], 00
:0043680F EB09                    jmp 0043681A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436897(U)
|
:00436811 8A4DF0                  mov cl, byte ptr [ebp-10]
:00436814 80C101                  add cl, 01
:00436817 884DF0                  mov byte ptr [ebp-10], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043680F(U)
|
:0043681A 8B55F0                  mov edx, dword ptr [ebp-10]
:0043681D 81E2FF000000            and edx, 000000FF
:00436823 83FA03                  cmp edx, 00000003
:00436826 7D74                    jge 0043689C
:00436828 8A4514                  mov al, byte ptr [ebp+14]
:0043682B 50                      push eax
:0043682C 8A4D10                  mov cl, byte ptr [ebp+10]
:0043682F 51                      push ecx
:00436830 8B55E0                  mov edx, dword ptr [ebp-20]
:00436833 8A4204                  mov al, byte ptr [edx+04]
:00436836 50                      push eax
:00436837 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043683A 33D2                    xor edx, edx
:0043683C 8A5101                  mov dl, byte ptr [ecx+01]
:0043683F 8B45F0                  mov eax, dword ptr [ebp-10]
:00436842 25FF000000              and eax, 000000FF
:00436847 8D4C02FF                lea ecx, dword ptr [edx+eax-01]
:0043684B 51                      push ecx
:0043684C 8B5508                  mov edx, dword ptr [ebp+08]
:0043684F 33C0                    xor eax, eax
:00436851 8A02                    mov al, byte ptr [edx]
:00436853 83C002                  add eax, 00000002
:00436856 50                      push eax
:00436857 E8A8110000              call 00437A04
:0043685C 83C414                  add esp, 00000014
:0043685F 8A4D14                  mov cl, byte ptr [ebp+14]
:00436862 51                      push ecx
:00436863 8A5510                  mov dl, byte ptr [ebp+10]
:00436866 52                      push edx
:00436867 8B45E0                  mov eax, dword ptr [ebp-20]
:0043686A 8A4804                  mov cl, byte ptr [eax+04]
:0043686D 51                      push ecx
:0043686E 8B5508                  mov edx, dword ptr [ebp+08]
:00436871 33C0                    xor eax, eax
:00436873 8A4201                  mov al, byte ptr [edx+01]
:00436876 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00436879 81E1FF000000            and ecx, 000000FF
:0043687F 8D5408FF                lea edx, dword ptr [eax+ecx-01]
:00436883 52                      push edx
:00436884 8B4508                  mov eax, dword ptr [ebp+08]
:00436887 33C9                    xor ecx, ecx
:00436889 8A08                    mov cl, byte ptr [eax]
:0043688B 83E902                  sub ecx, 00000002
:0043688E 51                      push ecx
:0043688F E870110000              call 00437A04
:00436894 83C414                  add esp, 00000014
:00436897 E975FFFFFF              jmp 00436811

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436826(C)
|
:0043689C 8A5514                  mov dl, byte ptr [ebp+14]
:0043689F 52                      push edx
:004368A0 8A4510                  mov al, byte ptr [ebp+10]
:004368A3 50                      push eax
:004368A4 8B4DE0                  mov ecx, dword ptr [ebp-20]
:004368A7 8A5104                  mov dl, byte ptr [ecx+04]
:004368AA 52                      push edx
:004368AB 8B4508                  mov eax, dword ptr [ebp+08]
:004368AE 8A4801                  mov cl, byte ptr [eax+01]
:004368B1 51                      push ecx
:004368B2 8B5508                  mov edx, dword ptr [ebp+08]
:004368B5 33C0                    xor eax, eax
:004368B7 8A02                    mov al, byte ptr [edx]
:004368B9 83E803                  sub eax, 00000003
:004368BC 50                      push eax
:004368BD E842110000              call 00437A04
:004368C2 83C414                  add esp, 00000014
:004368C5 8A4D14                  mov cl, byte ptr [ebp+14]
:004368C8 51                      push ecx
:004368C9 8A5510                  mov dl, byte ptr [ebp+10]
:004368CC 52                      push edx
:004368CD 8B45E0                  mov eax, dword ptr [ebp-20]
:004368D0 8A4804                  mov cl, byte ptr [eax+04]
:004368D3 51                      push ecx
:004368D4 8B5508                  mov edx, dword ptr [ebp+08]
:004368D7 8A4201                  mov al, byte ptr [edx+01]
:004368DA 50                      push eax
:004368DB 8B4D08                  mov ecx, dword ptr [ebp+08]
:004368DE 33D2                    xor edx, edx
:004368E0 8A11                    mov dl, byte ptr [ecx]
:004368E2 83C203                  add edx, 00000003
:004368E5 52                      push edx
:004368E6 E819110000              call 00437A04
:004368EB 83C414                  add esp, 00000014
:004368EE 8A4514                  mov al, byte ptr [ebp+14]
:004368F1 50                      push eax
:004368F2 8A4D10                  mov cl, byte ptr [ebp+10]
:004368F5 51                      push ecx
:004368F6 8B55E0                  mov edx, dword ptr [ebp-20]
:004368F9 8A4204                  mov al, byte ptr [edx+04]
:004368FC 50                      push eax
:004368FD 8B4D08                  mov ecx, dword ptr [ebp+08]
:00436900 33D2                    xor edx, edx
:00436902 8A5101                  mov dl, byte ptr [ecx+01]
:00436905 83EA03                  sub edx, 00000003
:00436908 52                      push edx
:00436909 8B4508                  mov eax, dword ptr [ebp+08]
:0043690C 8A08                    mov cl, byte ptr [eax]
:0043690E 51                      push ecx
:0043690F E8F0100000              call 00437A04
:00436914 83C414                  add esp, 00000014
:00436917 8A5514                  mov dl, byte ptr [ebp+14]
:0043691A 52                      push edx
:0043691B 8A4510                  mov al, byte ptr [ebp+10]
:0043691E 50                      push eax
:0043691F 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00436922 8A5104                  mov dl, byte ptr [ecx+04]
:00436925 52                      push edx
:00436926 8B4508                  mov eax, dword ptr [ebp+08]
:00436929 33C9                    xor ecx, ecx
:0043692B 8A4801                  mov cl, byte ptr [eax+01]
:0043692E 83C103                  add ecx, 00000003
:00436931 51                      push ecx
:00436932 8B5508                  mov edx, dword ptr [ebp+08]
:00436935 8A02                    mov al, byte ptr [edx]
:00436937 50                      push eax
:00436938 E8C7100000              call 00437A04
:0043693D 83C414                  add esp, 00000014
:00436940 E9FC0F0000              jmp 00437941
:00436945 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00436948 8A5104                  mov dl, byte ptr [ecx+04]
:0043694B 52                      push edx
:0043694C 8A4514                  mov al, byte ptr [ebp+14]
:0043694F 50                      push eax
:00436950 8A4D10                  mov cl, byte ptr [ebp+10]
:00436953 51                      push ecx
:00436954 8B5508                  mov edx, dword ptr [ebp+08]
:00436957 52                      push edx
:00436958 E81D130000              call 00437C7A
:0043695D 83C410                  add esp, 00000010
:00436960 C645F000                mov [ebp-10], 00
:00436964 EB08                    jmp 0043696E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004369EC(U)
|
:00436966 8A45F0                  mov al, byte ptr [ebp-10]
:00436969 0401                    add al, 01
:0043696B 8845F0                  mov byte ptr [ebp-10], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436964(U)
|
:0043696E 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00436971 81E1FF000000            and ecx, 000000FF
:00436977 83F903                  cmp ecx, 00000003
:0043697A 7D75                    jge 004369F1
:0043697C 8A5514                  mov dl, byte ptr [ebp+14]
:0043697F 52                      push edx
:00436980 8A4510                  mov al, byte ptr [ebp+10]
:00436983 50                      push eax
:00436984 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00436987 8A5104                  mov dl, byte ptr [ecx+04]
:0043698A 52                      push edx
:0043698B 8B4508                  mov eax, dword ptr [ebp+08]
:0043698E 33C9                    xor ecx, ecx
:00436990 8A4801                  mov cl, byte ptr [eax+01]
:00436993 83E902                  sub ecx, 00000002
:00436996 51                      push ecx
:00436997 8B5508                  mov edx, dword ptr [ebp+08]
:0043699A 33C0                    xor eax, eax
:0043699C 8A02                    mov al, byte ptr [edx]
:0043699E 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004369A1 81E1FF000000            and ecx, 000000FF
:004369A7 8D5408FF                lea edx, dword ptr [eax+ecx-01]
:004369AB 52                      push edx
:004369AC E853100000              call 00437A04
:004369B1 83C414                  add esp, 00000014
:004369B4 8A4514                  mov al, byte ptr [ebp+14]
:004369B7 50                      push eax
:004369B8 8A4D10                  mov cl, byte ptr [ebp+10]
:004369BB 51                      push ecx
:004369BC 8B55E0                  mov edx, dword ptr [ebp-20]
:004369BF 8A4204                  mov al, byte ptr [edx+04]
:004369C2 50                      push eax
:004369C3 8B4D08                  mov ecx, dword ptr [ebp+08]
:004369C6 33D2                    xor edx, edx
:004369C8 8A5101                  mov dl, byte ptr [ecx+01]
:004369CB 83C202                  add edx, 00000002
:004369CE 52                      push edx
:004369CF 8B4508                  mov eax, dword ptr [ebp+08]
:004369D2 33C9                    xor ecx, ecx
:004369D4 8A08                    mov cl, byte ptr [eax]
:004369D6 8B55F0                  mov edx, dword ptr [ebp-10]
:004369D9 81E2FF000000            and edx, 000000FF
:004369DF 8D4411FF                lea eax, dword ptr [ecx+edx-01]
:004369E3 50                      push eax
:004369E4 E81B100000              call 00437A04
:004369E9 83C414                  add esp, 00000014
:004369EC E975FFFFFF              jmp 00436966

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043697A(C)
|
:004369F1 C645F000                mov [ebp-10], 00
:004369F5 EB09                    jmp 00436A00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436A7D(U)
|
:004369F7 8A4DF0                  mov cl, byte ptr [ebp-10]
:004369FA 80C101                  add cl, 01
:004369FD 884DF0                  mov byte ptr [ebp-10], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004369F5(U)
|
:00436A00 8B55F0                  mov edx, dword ptr [ebp-10]
:00436A03 81E2FF000000            and edx, 000000FF
:00436A09 83FA03                  cmp edx, 00000003
:00436A0C 7D74                    jge 00436A82
:00436A0E 8A4514                  mov al, byte ptr [ebp+14]
:00436A11 50                      push eax
:00436A12 8A4D10                  mov cl, byte ptr [ebp+10]
:00436A15 51                      push ecx
:00436A16 8B55E0                  mov edx, dword ptr [ebp-20]
:00436A19 8A4204                  mov al, byte ptr [edx+04]
:00436A1C 50                      push eax
:00436A1D 8B4D08                  mov ecx, dword ptr [ebp+08]
:00436A20 33D2                    xor edx, edx
:00436A22 8A5101                  mov dl, byte ptr [ecx+01]
:00436A25 8B45F0                  mov eax, dword ptr [ebp-10]
:00436A28 25FF000000              and eax, 000000FF
:00436A2D 8D4C02FF                lea ecx, dword ptr [edx+eax-01]
:00436A31 51                      push ecx
:00436A32 8B5508                  mov edx, dword ptr [ebp+08]
:00436A35 33C0                    xor eax, eax
:00436A37 8A02                    mov al, byte ptr [edx]
:00436A39 83C002                  add eax, 00000002
:00436A3C 50                      push eax
:00436A3D E8C20F0000              call 00437A04
:00436A42 83C414                  add esp, 00000014
:00436A45 8A4D14                  mov cl, byte ptr [ebp+14]
:00436A48 51                      push ecx
:00436A49 8A5510                  mov dl, byte ptr [ebp+10]
:00436A4C 52                      push edx
:00436A4D 8B45E0                  mov eax, dword ptr [ebp-20]
:00436A50 8A4804                  mov cl, byte ptr [eax+04]
:00436A53 51                      push ecx
:00436A54 8B5508                  mov edx, dword ptr [ebp+08]
:00436A57 33C0                    xor eax, eax
:00436A59 8A4201                  mov al, byte ptr [edx+01]
:00436A5C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00436A5F 81E1FF000000            and ecx, 000000FF
:00436A65 8D5408FF                lea edx, dword ptr [eax+ecx-01]
:00436A69 52                      push edx
:00436A6A 8B4508                  mov eax, dword ptr [ebp+08]
:00436A6D 33C9                    xor ecx, ecx
:00436A6F 8A08                    mov cl, byte ptr [eax]
:00436A71 83E902                  sub ecx, 00000002
:00436A74 51                      push ecx
:00436A75 E88A0F0000              call 00437A04
:00436A7A 83C414                  add esp, 00000014
:00436A7D E975FFFFFF              jmp 004369F7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436A0C(C)
|
:00436A82 C645F000                mov [ebp-10], 00
:00436A86 EB09                    jmp 00436A91

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436B0D(U)
|
:00436A88 8A55F0                  mov dl, byte ptr [ebp-10]
:00436A8B 80C201                  add dl, 01
:00436A8E 8855F0                  mov byte ptr [ebp-10], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436A86(U)
|
:00436A91 8B45F0                  mov eax, dword ptr [ebp-10]
:00436A94 25FF000000              and eax, 000000FF
:00436A99 83F803                  cmp eax, 00000003
:00436A9C 7D74                    jge 00436B12
:00436A9E 8A4D14                  mov cl, byte ptr [ebp+14]
:00436AA1 51                      push ecx
:00436AA2 8A5510                  mov dl, byte ptr [ebp+10]
:00436AA5 52                      push edx
:00436AA6 8B45E0                  mov eax, dword ptr [ebp-20]
:00436AA9 8A4804                  mov cl, byte ptr [eax+04]
:00436AAC 51                      push ecx
:00436AAD 8B5508                  mov edx, dword ptr [ebp+08]
:00436AB0 33C0                    xor eax, eax
:00436AB2 8A4201                  mov al, byte ptr [edx+01]
:00436AB5 83E803                  sub eax, 00000003
:00436AB8 50                      push eax
:00436AB9 8B4D08                  mov ecx, dword ptr [ebp+08]
:00436ABC 33D2                    xor edx, edx
:00436ABE 8A11                    mov dl, byte ptr [ecx]
:00436AC0 8B45F0                  mov eax, dword ptr [ebp-10]
:00436AC3 25FF000000              and eax, 000000FF
:00436AC8 8D4C02FF                lea ecx, dword ptr [edx+eax-01]
:00436ACC 51                      push ecx
:00436ACD E8320F0000              call 00437A04
:00436AD2 83C414                  add esp, 00000014
:00436AD5 8A5514                  mov dl, byte ptr [ebp+14]
:00436AD8 52                      push edx
:00436AD9 8A4510                  mov al, byte ptr [ebp+10]
:00436ADC 50                      push eax
:00436ADD 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00436AE0 8A5104                  mov dl, byte ptr [ecx+04]
:00436AE3 52                      push edx
:00436AE4 8B4508                  mov eax, dword ptr [ebp+08]
:00436AE7 33C9                    xor ecx, ecx
:00436AE9 8A4801                  mov cl, byte ptr [eax+01]
:00436AEC 83C103                  add ecx, 00000003
:00436AEF 51                      push ecx
:00436AF0 8B5508                  mov edx, dword ptr [ebp+08]
:00436AF3 33C0                    xor eax, eax
:00436AF5 8A02                    mov al, byte ptr [edx]
:00436AF7 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00436AFA 81E1FF000000            and ecx, 000000FF
:00436B00 8D5408FF                lea edx, dword ptr [eax+ecx-01]
:00436B04 52                      push edx
:00436B05 E8FA0E0000              call 00437A04
:00436B0A 83C414                  add esp, 00000014
:00436B0D E976FFFFFF              jmp 00436A88

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436A9C(C)
|
:00436B12 C645F000                mov [ebp-10], 00
:00436B16 EB08                    jmp 00436B20

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436B9D(U)
|
:00436B18 8A45F0                  mov al, byte ptr [ebp-10]
:00436B1B 0401                    add al, 01
:00436B1D 8845F0                  mov byte ptr [ebp-10], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436B16(U)
|
:00436B20 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00436B23 81E1FF000000            and ecx, 000000FF
:00436B29 83F903                  cmp ecx, 00000003
:00436B2C 7D74                    jge 00436BA2
:00436B2E 8A5514                  mov dl, byte ptr [ebp+14]
:00436B31 52                      push edx
:00436B32 8A4510                  mov al, byte ptr [ebp+10]
:00436B35 50                      push eax
:00436B36 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00436B39 8A5104                  mov dl, byte ptr [ecx+04]
:00436B3C 52                      push edx
:00436B3D 8B4508                  mov eax, dword ptr [ebp+08]
:00436B40 33C9                    xor ecx, ecx
:00436B42 8A4801                  mov cl, byte ptr [eax+01]
:00436B45 8B55F0                  mov edx, dword ptr [ebp-10]
:00436B48 81E2FF000000            and edx, 000000FF
:00436B4E 8D4411FF                lea eax, dword ptr [ecx+edx-01]
:00436B52 50                      push eax
:00436B53 8B4D08                  mov ecx, dword ptr [ebp+08]
:00436B56 33D2                    xor edx, edx
:00436B58 8A11                    mov dl, byte ptr [ecx]
:00436B5A 83C203                  add edx, 00000003
:00436B5D 52                      push edx
:00436B5E E8A10E0000              call 00437A04
:00436B63 83C414                  add esp, 00000014
:00436B66 8A4514                  mov al, byte ptr [ebp+14]
:00436B69 50                      push eax
:00436B6A 8A4D10                  mov cl, byte ptr [ebp+10]
:00436B6D 51                      push ecx
:00436B6E 8B55E0                  mov edx, dword ptr [ebp-20]
:00436B71 8A4204                  mov al, byte ptr [edx+04]
:00436B74 50                      push eax
:00436B75 8B4D08                  mov ecx, dword ptr [ebp+08]
:00436B78 33D2                    xor edx, edx
:00436B7A 8A5101                  mov dl, byte ptr [ecx+01]
:00436B7D 8B45F0                  mov eax, dword ptr [ebp-10]
:00436B80 25FF000000              and eax, 000000FF
:00436B85 8D4C02FF                lea ecx, dword ptr [edx+eax-01]
:00436B89 51                      push ecx
:00436B8A 8B5508                  mov edx, dword ptr [ebp+08]
:00436B8D 33C0                    xor eax, eax
:00436B8F 8A02                    mov al, byte ptr [edx]
:00436B91 83E803                  sub eax, 00000003
:00436B94 50                      push eax
:00436B95 E86A0E0000              call 00437A04
:00436B9A 83C414                  add esp, 00000014
:00436B9D E976FFFFFF              jmp 00436B18

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436B2C(C)
|
:00436BA2 8A4D14                  mov cl, byte ptr [ebp+14]
:00436BA5 51                      push ecx
:00436BA6 8A5510                  mov dl, byte ptr [ebp+10]
:00436BA9 52                      push edx
:00436BAA 8B45E0                  mov eax, dword ptr [ebp-20]
:00436BAD 8A4804                  mov cl, byte ptr [eax+04]
:00436BB0 51                      push ecx
:00436BB1 8B5508                  mov edx, dword ptr [ebp+08]
:00436BB4 33C0                    xor eax, eax
:00436BB6 8A4201                  mov al, byte ptr [edx+01]
:00436BB9 83E802                  sub eax, 00000002
:00436BBC 50                      push eax
:00436BBD 8B4D08                  mov ecx, dword ptr [ebp+08]
:00436BC0 33D2                    xor edx, edx
:00436BC2 8A11                    mov dl, byte ptr [ecx]
:00436BC4 83EA02                  sub edx, 00000002
:00436BC7 52                      push edx
:00436BC8 E8370E0000              call 00437A04
:00436BCD 83C414                  add esp, 00000014
:00436BD0 8A4514                  mov al, byte ptr [ebp+14]
:00436BD3 50                      push eax
:00436BD4 8A4D10                  mov cl, byte ptr [ebp+10]
:00436BD7 51                      push ecx
:00436BD8 8B55E0                  mov edx, dword ptr [ebp-20]
:00436BDB 8A4204                  mov al, byte ptr [edx+04]
:00436BDE 50                      push eax
:00436BDF 8B4D08                  mov ecx, dword ptr [ebp+08]
:00436BE2 33D2                    xor edx, edx
:00436BE4 8A5101                  mov dl, byte ptr [ecx+01]
:00436BE7 83C202                  add edx, 00000002
:00436BEA 52                      push edx
:00436BEB 8B4508                  mov eax, dword ptr [ebp+08]
:00436BEE 33C9                    xor ecx, ecx
:00436BF0 8A08                    mov cl, byte ptr [eax]
:00436BF2 83C102                  add ecx, 00000002
:00436BF5 51                      push ecx
:00436BF6 E8090E0000              call 00437A04
:00436BFB 83C414                  add esp, 00000014
:00436BFE 8A5514                  mov dl, byte ptr [ebp+14]
:00436C01 52                      push edx
:00436C02 8A4510                  mov al, byte ptr [ebp+10]
:00436C05 50                      push eax
:00436C06 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00436C09 8A5104                  mov dl, byte ptr [ecx+04]
:00436C0C 52                      push edx
:00436C0D 8B4508                  mov eax, dword ptr [ebp+08]
:00436C10 33C9                    xor ecx, ecx
:00436C12 8A4801                  mov cl, byte ptr [eax+01]
:00436C15 83E902                  sub ecx, 00000002
:00436C18 51                      push ecx
:00436C19 8B5508                  mov edx, dword ptr [ebp+08]
:00436C1C 33C0                    xor eax, eax
:00436C1E 8A02                    mov al, byte ptr [edx]
:00436C20 83C002                  add eax, 00000002
:00436C23 50                      push eax
:00436C24 E8DB0D0000              call 00437A04
:00436C29 83C414                  add esp, 00000014
:00436C2C 8A4D14                  mov cl, byte ptr [ebp+14]
:00436C2F 51                      push ecx
:00436C30 8A5510                  mov dl, byte ptr [ebp+10]
:00436C33 52                      push edx
:00436C34 8B45E0                  mov eax, dword ptr [ebp-20]
:00436C37 8A4804                  mov cl, byte ptr [eax+04]
:00436C3A 51                      push ecx
:00436C3B 8B5508                  mov edx, dword ptr [ebp+08]
:00436C3E 33C0                    xor eax, eax
:00436C40 8A4201                  mov al, byte ptr [edx+01]
:00436C43 83C002                  add eax, 00000002
:00436C46 50                      push eax
:00436C47 8B4D08                  mov ecx, dword ptr [ebp+08]
:00436C4A 33D2                    xor edx, edx
:00436C4C 8A11                    mov dl, byte ptr [ecx]
:00436C4E 83EA02                  sub edx, 00000002
:00436C51 52                      push edx
:00436C52 E8AD0D0000              call 00437A04
:00436C57 83C414                  add esp, 00000014
:00436C5A 8A4514                  mov al, byte ptr [ebp+14]
:00436C5D 50                      push eax
:00436C5E 8A4D10                  mov cl, byte ptr [ebp+10]
:00436C61 51                      push ecx
:00436C62 8B55E0                  mov edx, dword ptr [ebp-20]
:00436C65 8A4204                  mov al, byte ptr [edx+04]
:00436C68 50                      push eax
:00436C69 8B4D08                  mov ecx, dword ptr [ebp+08]
:00436C6C 8A5101                  mov dl, byte ptr [ecx+01]
:00436C6F 52                      push edx
:00436C70 8B4508                  mov eax, dword ptr [ebp+08]
:00436C73 33C9                    xor ecx, ecx
:00436C75 8A08                    mov cl, byte ptr [eax]
:00436C77 83E904                  sub ecx, 00000004
:00436C7A 51                      push ecx
:00436C7B E8840D0000              call 00437A04
:00436C80 83C414                  add esp, 00000014
:00436C83 8A5514                  mov dl, byte ptr [ebp+14]
:00436C86 52                      push edx
:00436C87 8A4510                  mov al, byte ptr [ebp+10]
:00436C8A 50                      push eax
:00436C8B 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00436C8E 8A5104                  mov dl, byte ptr [ecx+04]
:00436C91 52                      push edx
:00436C92 8B4508                  mov eax, dword ptr [ebp+08]
:00436C95 8A4801                  mov cl, byte ptr [eax+01]
:00436C98 51                      push ecx
:00436C99 8B5508                  mov edx, dword ptr [ebp+08]
:00436C9C 33C0                    xor eax, eax
:00436C9E 8A02                    mov al, byte ptr [edx]
:00436CA0 83C004                  add eax, 00000004
:00436CA3 50                      push eax
:00436CA4 E85B0D0000              call 00437A04
:00436CA9 83C414                  add esp, 00000014
:00436CAC 8A4D14                  mov cl, byte ptr [ebp+14]
:00436CAF 51                      push ecx
:00436CB0 8A5510                  mov dl, byte ptr [ebp+10]
:00436CB3 52                      push edx
:00436CB4 8B45E0                  mov eax, dword ptr [ebp-20]
:00436CB7 8A4804                  mov cl, byte ptr [eax+04]
:00436CBA 51                      push ecx
:00436CBB 8B5508                  mov edx, dword ptr [ebp+08]
:00436CBE 33C0                    xor eax, eax
:00436CC0 8A4201                  mov al, byte ptr [edx+01]
:00436CC3 83E804                  sub eax, 00000004
:00436CC6 50                      push eax
:00436CC7 8B4D08                  mov ecx, dword ptr [ebp+08]
:00436CCA 8A11                    mov dl, byte ptr [ecx]
:00436CCC 52                      push edx
:00436CCD E8320D0000              call 00437A04
:00436CD2 83C414                  add esp, 00000014
:00436CD5 8A4514                  mov al, byte ptr [ebp+14]
:00436CD8 50                      push eax
:00436CD9 8A4D10                  mov cl, byte ptr [ebp+10]
:00436CDC 51                      push ecx
:00436CDD 8B55E0                  mov edx, dword ptr [ebp-20]
:00436CE0 8A4204                  mov al, byte ptr [edx+04]
:00436CE3 50                      push eax
:00436CE4 8B4D08                  mov ecx, dword ptr [ebp+08]
:00436CE7 33D2                    xor edx, edx
:00436CE9 8A5101                  mov dl, byte ptr [ecx+01]
:00436CEC 83C204                  add edx, 00000004
:00436CEF 52                      push edx
:00436CF0 8B4508                  mov eax, dword ptr [ebp+08]
:00436CF3 8A08                    mov cl, byte ptr [eax]
:00436CF5 51                      push ecx
:00436CF6 E8090D0000              call 00437A04
:00436CFB 83C414                  add esp, 00000014
:00436CFE E93E0C0000              jmp 00437941
:00436D03 8B55E0                  mov edx, dword ptr [ebp-20]
:00436D06 8A4204                  mov al, byte ptr [edx+04]
:00436D09 50                      push eax
:00436D0A 8A4D14                  mov cl, byte ptr [ebp+14]
:00436D0D 51                      push ecx
:00436D0E 8A5510                  mov dl, byte ptr [ebp+10]
:00436D11 52                      push edx
:00436D12 8B4508                  mov eax, dword ptr [ebp+08]
:00436D15 50                      push eax
:00436D16 E8DF0E0000              call 00437BFA
:00436D1B 83C410                  add esp, 00000010
:00436D1E 8A4D14                  mov cl, byte ptr [ebp+14]
:00436D21 51                      push ecx
:00436D22 8A5510                  mov dl, byte ptr [ebp+10]
:00436D25 52                      push edx
:00436D26 8B45E0                  mov eax, dword ptr [ebp-20]
:00436D29 8A4804                  mov cl, byte ptr [eax+04]
:00436D2C 51                      push ecx
:00436D2D 8B5508                  mov edx, dword ptr [ebp+08]
:00436D30 8A4201                  mov al, byte ptr [edx+01]
:00436D33 50                      push eax
:00436D34 8B4D08                  mov ecx, dword ptr [ebp+08]
:00436D37 33D2                    xor edx, edx
:00436D39 8A11                    mov dl, byte ptr [ecx]
:00436D3B 83EA02                  sub edx, 00000002
:00436D3E 52                      push edx
:00436D3F E8C00C0000              call 00437A04
:00436D44 83C414                  add esp, 00000014
:00436D47 8A4514                  mov al, byte ptr [ebp+14]
:00436D4A 50                      push eax
:00436D4B 8A4D10                  mov cl, byte ptr [ebp+10]
:00436D4E 51                      push ecx
:00436D4F 8B55E0                  mov edx, dword ptr [ebp-20]
:00436D52 8A4204                  mov al, byte ptr [edx+04]
:00436D55 50                      push eax
:00436D56 8B4D08                  mov ecx, dword ptr [ebp+08]
:00436D59 8A5101                  mov dl, byte ptr [ecx+01]
:00436D5C 52                      push edx
:00436D5D 8B4508                  mov eax, dword ptr [ebp+08]
:00436D60 33C9                    xor ecx, ecx
:00436D62 8A08                    mov cl, byte ptr [eax]
:00436D64 83C102                  add ecx, 00000002
:00436D67 51                      push ecx
:00436D68 E8970C0000              call 00437A04
:00436D6D 83C414                  add esp, 00000014
:00436D70 8A5514                  mov dl, byte ptr [ebp+14]
:00436D73 52                      push edx
:00436D74 8A4510                  mov al, byte ptr [ebp+10]
:00436D77 50                      push eax
:00436D78 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00436D7B 8A5104                  mov dl, byte ptr [ecx+04]
:00436D7E 52                      push edx
:00436D7F 8B4508                  mov eax, dword ptr [ebp+08]
:00436D82 33C9                    xor ecx, ecx
:00436D84 8A4801                  mov cl, byte ptr [eax+01]
:00436D87 83E902                  sub ecx, 00000002
:00436D8A 51                      push ecx
:00436D8B 8B5508                  mov edx, dword ptr [ebp+08]
:00436D8E 8A02                    mov al, byte ptr [edx]
:00436D90 50                      push eax
:00436D91 E86E0C0000              call 00437A04
:00436D96 83C414                  add esp, 00000014
:00436D99 8A4D14                  mov cl, byte ptr [ebp+14]
:00436D9C 51                      push ecx
:00436D9D 8A5510                  mov dl, byte ptr [ebp+10]
:00436DA0 52                      push edx
:00436DA1 8B45E0                  mov eax, dword ptr [ebp-20]
:00436DA4 8A4804                  mov cl, byte ptr [eax+04]
:00436DA7 51                      push ecx
:00436DA8 8B5508                  mov edx, dword ptr [ebp+08]
:00436DAB 33C0                    xor eax, eax
:00436DAD 8A4201                  mov al, byte ptr [edx+01]
:00436DB0 83C002                  add eax, 00000002
:00436DB3 50                      push eax
:00436DB4 8B4D08                  mov ecx, dword ptr [ebp+08]
:00436DB7 8A11                    mov dl, byte ptr [ecx]
:00436DB9 52                      push edx
:00436DBA E8450C0000              call 00437A04
:00436DBF 83C414                  add esp, 00000014
:00436DC2 E97A0B0000              jmp 00437941
:00436DC7 8B45E0                  mov eax, dword ptr [ebp-20]
:00436DCA 8A4804                  mov cl, byte ptr [eax+04]
:00436DCD 51                      push ecx
:00436DCE 8A5514                  mov dl, byte ptr [ebp+14]
:00436DD1 52                      push edx
:00436DD2 8A4510                  mov al, byte ptr [ebp+10]
:00436DD5 50                      push eax
:00436DD6 8B4D08                  mov ecx, dword ptr [ebp+08]
:00436DD9 51                      push ecx
:00436DDA E81B0E0000              call 00437BFA
:00436DDF 83C410                  add esp, 00000010
:00436DE2 8B55E0                  mov edx, dword ptr [ebp-20]
:00436DE5 8A4204                  mov al, byte ptr [edx+04]
:00436DE8 50                      push eax
:00436DE9 8A4D14                  mov cl, byte ptr [ebp+14]
:00436DEC 51                      push ecx
:00436DED 8A5510                  mov dl, byte ptr [ebp+10]
:00436DF0 52                      push edx
:00436DF1 8B4508                  mov eax, dword ptr [ebp+08]
:00436DF4 50                      push eax
:00436DF5 E8800E0000              call 00437C7A
:00436DFA 83C410                  add esp, 00000010
:00436DFD 8A4D14                  mov cl, byte ptr [ebp+14]
:00436E00 51                      push ecx
:00436E01 8A5510                  mov dl, byte ptr [ebp+10]
:00436E04 52                      push edx
:00436E05 8B45E0                  mov eax, dword ptr [ebp-20]
:00436E08 8A4804                  mov cl, byte ptr [eax+04]
:00436E0B 51                      push ecx
:00436E0C 8B5508                  mov edx, dword ptr [ebp+08]
:00436E0F 8A4201                  mov al, byte ptr [edx+01]
:00436E12 50                      push eax
:00436E13 8B4D08                  mov ecx, dword ptr [ebp+08]
:00436E16 33D2                    xor edx, edx
:00436E18 8A11                    mov dl, byte ptr [ecx]
:00436E1A 83EA02                  sub edx, 00000002
:00436E1D 52                      push edx
:00436E1E E8E10B0000              call 00437A04
:00436E23 83C414                  add esp, 00000014
:00436E26 8A4514                  mov al, byte ptr [ebp+14]
:00436E29 50                      push eax
:00436E2A 8A4D10                  mov cl, byte ptr [ebp+10]
:00436E2D 51                      push ecx
:00436E2E 8B55E0                  mov edx, dword ptr [ebp-20]
:00436E31 8A4204                  mov al, byte ptr [edx+04]
:00436E34 50                      push eax
:00436E35 8B4D08                  mov ecx, dword ptr [ebp+08]
:00436E38 8A5101                  mov dl, byte ptr [ecx+01]
:00436E3B 52                      push edx
:00436E3C 8B4508                  mov eax, dword ptr [ebp+08]
:00436E3F 33C9                    xor ecx, ecx
:00436E41 8A08                    mov cl, byte ptr [eax]
:00436E43 83C102                  add ecx, 00000002
:00436E46 51                      push ecx
:00436E47 E8B80B0000              call 00437A04
:00436E4C 83C414                  add esp, 00000014
:00436E4F 8A5514                  mov dl, byte ptr [ebp+14]
:00436E52 52                      push edx
:00436E53 8A4510                  mov al, byte ptr [ebp+10]
:00436E56 50                      push eax
:00436E57 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00436E5A 8A5104                  mov dl, byte ptr [ecx+04]
:00436E5D 52                      push edx
:00436E5E 8B4508                  mov eax, dword ptr [ebp+08]
:00436E61 33C9                    xor ecx, ecx
:00436E63 8A4801                  mov cl, byte ptr [eax+01]
:00436E66 83E902                  sub ecx, 00000002
:00436E69 51                      push ecx
:00436E6A 8B5508                  mov edx, dword ptr [ebp+08]
:00436E6D 8A02                    mov al, byte ptr [edx]
:00436E6F 50                      push eax
:00436E70 E88F0B0000              call 00437A04
:00436E75 83C414                  add esp, 00000014
:00436E78 8A4D14                  mov cl, byte ptr [ebp+14]
:00436E7B 51                      push ecx
:00436E7C 8A5510                  mov dl, byte ptr [ebp+10]
:00436E7F 52                      push edx
:00436E80 8B45E0                  mov eax, dword ptr [ebp-20]
:00436E83 8A4804                  mov cl, byte ptr [eax+04]
:00436E86 51                      push ecx
:00436E87 8B5508                  mov edx, dword ptr [ebp+08]
:00436E8A 33C0                    xor eax, eax
:00436E8C 8A4201                  mov al, byte ptr [edx+01]
:00436E8F 83C002                  add eax, 00000002
:00436E92 50                      push eax
:00436E93 8B4D08                  mov ecx, dword ptr [ebp+08]
:00436E96 8A11                    mov dl, byte ptr [ecx]
:00436E98 52                      push edx
:00436E99 E8660B0000              call 00437A04
:00436E9E 83C414                  add esp, 00000014
:00436EA1 E99B0A0000              jmp 00437941
:00436EA6 C745F4FCFFFFFF          mov [ebp-0C], FFFFFFFC
:00436EAD EB09                    jmp 00436EB8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436F43(U)
|
:00436EAF 8B45F4                  mov eax, dword ptr [ebp-0C]
:00436EB2 83C001                  add eax, 00000001
:00436EB5 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436EAD(U)
|
:00436EB8 837DF405                cmp dword ptr [ebp-0C], 00000005
:00436EBC 0F8D86000000            jnl 00436F48
:00436EC2 C745F8FCFFFFFF          mov [ebp-08], FFFFFFFC
:00436EC9 EB09                    jmp 00436ED4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436F41(U)
|
:00436ECB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00436ECE 83C101                  add ecx, 00000001
:00436ED1 894DF8                  mov dword ptr [ebp-08], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436EC9(U)
|
:00436ED4 837DF805                cmp dword ptr [ebp-08], 00000005
:00436ED8 7D69                    jge 00436F43
:00436EDA 837DF400                cmp dword ptr [ebp-0C], 00000000
:00436EDE 7C08                    jl 00436EE8
:00436EE0 8B55F4                  mov edx, dword ptr [ebp-0C]
:00436EE3 8955D8                  mov dword ptr [ebp-28], edx
:00436EE6 EB08                    jmp 00436EF0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436EDE(C)
|
:00436EE8 8B45F4                  mov eax, dword ptr [ebp-0C]
:00436EEB F7D8                    neg eax
:00436EED 8945D8                  mov dword ptr [ebp-28], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436EE6(U)
|
:00436EF0 837DF800                cmp dword ptr [ebp-08], 00000000
:00436EF4 7C08                    jl 00436EFE
:00436EF6 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00436EF9 894DD4                  mov dword ptr [ebp-2C], ecx
:00436EFC EB08                    jmp 00436F06

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436EF4(C)
|
:00436EFE 8B55F8                  mov edx, dword ptr [ebp-08]
:00436F01 F7DA                    neg edx
:00436F03 8955D4                  mov dword ptr [ebp-2C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436EFC(U)
|
:00436F06 B804000000              mov eax, 00000004
:00436F0B 2B45D8                  sub eax, dword ptr [ebp-28]
:00436F0E 3B45D4                  cmp eax, dword ptr [ebp-2C]
:00436F11 752E                    jne 00436F41
:00436F13 8A4D14                  mov cl, byte ptr [ebp+14]
:00436F16 51                      push ecx
:00436F17 8A5510                  mov dl, byte ptr [ebp+10]
:00436F1A 52                      push edx
:00436F1B 8B45E0                  mov eax, dword ptr [ebp-20]
:00436F1E 8A4804                  mov cl, byte ptr [eax+04]
:00436F21 51                      push ecx
:00436F22 8B5508                  mov edx, dword ptr [ebp+08]
:00436F25 33C0                    xor eax, eax
:00436F27 8A4201                  mov al, byte ptr [edx+01]
:00436F2A 0345F4                  add eax, dword ptr [ebp-0C]
:00436F2D 50                      push eax
:00436F2E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00436F31 33D2                    xor edx, edx
:00436F33 8A11                    mov dl, byte ptr [ecx]
:00436F35 0355F8                  add edx, dword ptr [ebp-08]
:00436F38 52                      push edx
:00436F39 E8C60A0000              call 00437A04
:00436F3E 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436F11(C)
|
:00436F41 EB88                    jmp 00436ECB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436ED8(C)
|
:00436F43 E967FFFFFF              jmp 00436EAF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436EBC(C)
|
:00436F48 E9F4090000              jmp 00437941
:00436F4D C745F4FCFFFFFF          mov [ebp-0C], FFFFFFFC
:00436F54 EB09                    jmp 00436F5F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436FEA(U)
|
:00436F56 8B45F4                  mov eax, dword ptr [ebp-0C]
:00436F59 83C001                  add eax, 00000001
:00436F5C 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436F54(U)
|
:00436F5F 837DF405                cmp dword ptr [ebp-0C], 00000005
:00436F63 0F8D86000000            jnl 00436FEF
:00436F69 C745F8FCFFFFFF          mov [ebp-08], FFFFFFFC
:00436F70 EB09                    jmp 00436F7B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436FE8(U)
|
:00436F72 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00436F75 83C101                  add ecx, 00000001
:00436F78 894DF8                  mov dword ptr [ebp-08], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436F70(U)
|
:00436F7B 837DF805                cmp dword ptr [ebp-08], 00000005
:00436F7F 7D69                    jge 00436FEA
:00436F81 837DF400                cmp dword ptr [ebp-0C], 00000000
:00436F85 7C08                    jl 00436F8F
:00436F87 8B55F4                  mov edx, dword ptr [ebp-0C]
:00436F8A 8955D0                  mov dword ptr [ebp-30], edx
:00436F8D EB08                    jmp 00436F97

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436F85(C)
|
:00436F8F 8B45F4                  mov eax, dword ptr [ebp-0C]
:00436F92 F7D8                    neg eax
:00436F94 8945D0                  mov dword ptr [ebp-30], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436F8D(U)
|
:00436F97 837DF800                cmp dword ptr [ebp-08], 00000000
:00436F9B 7C08                    jl 00436FA5
:00436F9D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00436FA0 894DCC                  mov dword ptr [ebp-34], ecx
:00436FA3 EB08                    jmp 00436FAD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436F9B(C)
|
:00436FA5 8B55F8                  mov edx, dword ptr [ebp-08]
:00436FA8 F7DA                    neg edx
:00436FAA 8955CC                  mov dword ptr [ebp-34], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436FA3(U)
|
:00436FAD B804000000              mov eax, 00000004
:00436FB2 2B45D0                  sub eax, dword ptr [ebp-30]
:00436FB5 3B45CC                  cmp eax, dword ptr [ebp-34]
:00436FB8 752E                    jne 00436FE8
:00436FBA 8A4D14                  mov cl, byte ptr [ebp+14]
:00436FBD 51                      push ecx
:00436FBE 8A5510                  mov dl, byte ptr [ebp+10]
:00436FC1 52                      push edx
:00436FC2 8B45E0                  mov eax, dword ptr [ebp-20]
:00436FC5 8A4804                  mov cl, byte ptr [eax+04]
:00436FC8 51                      push ecx
:00436FC9 8B5508                  mov edx, dword ptr [ebp+08]
:00436FCC 33C0                    xor eax, eax
:00436FCE 8A4201                  mov al, byte ptr [edx+01]
:00436FD1 0345F4                  add eax, dword ptr [ebp-0C]
:00436FD4 50                      push eax
:00436FD5 8B4D08                  mov ecx, dword ptr [ebp+08]
:00436FD8 33D2                    xor edx, edx
:00436FDA 8A11                    mov dl, byte ptr [ecx]
:00436FDC 0355F8                  add edx, dword ptr [ebp-08]
:00436FDF 52                      push edx
:00436FE0 E81F0A0000              call 00437A04
:00436FE5 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436FB8(C)
|
:00436FE8 EB88                    jmp 00436F72

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436F7F(C)
|
:00436FEA E967FFFFFF              jmp 00436F56

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436F63(C)
|
:00436FEF C745F4FBFFFFFF          mov [ebp-0C], FFFFFFFB
:00436FF6 EB09                    jmp 00437001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043708C(U)
|
:00436FF8 8B45F4                  mov eax, dword ptr [ebp-0C]
:00436FFB 83C001                  add eax, 00000001
:00436FFE 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00436FF6(U)
|
:00437001 837DF406                cmp dword ptr [ebp-0C], 00000006
:00437005 0F8D86000000            jnl 00437091
:0043700B C745F8FBFFFFFF          mov [ebp-08], FFFFFFFB
:00437012 EB09                    jmp 0043701D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043708A(U)
|
:00437014 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00437017 83C101                  add ecx, 00000001
:0043701A 894DF8                  mov dword ptr [ebp-08], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437012(U)
|
:0043701D 837DF806                cmp dword ptr [ebp-08], 00000006
:00437021 7D69                    jge 0043708C
:00437023 837DF400                cmp dword ptr [ebp-0C], 00000000
:00437027 7C08                    jl 00437031
:00437029 8B55F4                  mov edx, dword ptr [ebp-0C]
:0043702C 8955C8                  mov dword ptr [ebp-38], edx
:0043702F EB08                    jmp 00437039

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437027(C)
|
:00437031 8B45F4                  mov eax, dword ptr [ebp-0C]
:00437034 F7D8                    neg eax
:00437036 8945C8                  mov dword ptr [ebp-38], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043702F(U)
|
:00437039 837DF800                cmp dword ptr [ebp-08], 00000000
:0043703D 7C08                    jl 00437047
:0043703F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00437042 894DC4                  mov dword ptr [ebp-3C], ecx
:00437045 EB08                    jmp 0043704F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043703D(C)
|
:00437047 8B55F8                  mov edx, dword ptr [ebp-08]
:0043704A F7DA                    neg edx
:0043704C 8955C4                  mov dword ptr [ebp-3C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437045(U)
|
:0043704F B805000000              mov eax, 00000005
:00437054 2B45C8                  sub eax, dword ptr [ebp-38]
:00437057 3B45C4                  cmp eax, dword ptr [ebp-3C]
:0043705A 752E                    jne 0043708A
:0043705C 8A4D14                  mov cl, byte ptr [ebp+14]
:0043705F 51                      push ecx
:00437060 8A5510                  mov dl, byte ptr [ebp+10]
:00437063 52                      push edx
:00437064 8B45E0                  mov eax, dword ptr [ebp-20]
:00437067 8A4804                  mov cl, byte ptr [eax+04]
:0043706A 51                      push ecx
:0043706B 8B5508                  mov edx, dword ptr [ebp+08]
:0043706E 33C0                    xor eax, eax
:00437070 8A4201                  mov al, byte ptr [edx+01]
:00437073 0345F4                  add eax, dword ptr [ebp-0C]
:00437076 50                      push eax
:00437077 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043707A 33D2                    xor edx, edx
:0043707C 8A11                    mov dl, byte ptr [ecx]
:0043707E 0355F8                  add edx, dword ptr [ebp-08]
:00437081 52                      push edx
:00437082 E87D090000              call 00437A04
:00437087 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043705A(C)
|
:0043708A EB88                    jmp 00437014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437021(C)
|
:0043708C E967FFFFFF              jmp 00436FF8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437005(C)
|
:00437091 E9AB080000              jmp 00437941
:00437096 8A4514                  mov al, byte ptr [ebp+14]
:00437099 50                      push eax
:0043709A 8A4D10                  mov cl, byte ptr [ebp+10]
:0043709D 51                      push ecx
:0043709E 8B55E0                  mov edx, dword ptr [ebp-20]
:004370A1 8A4204                  mov al, byte ptr [edx+04]
:004370A4 50                      push eax
:004370A5 8B4D08                  mov ecx, dword ptr [ebp+08]
:004370A8 8A5101                  mov dl, byte ptr [ecx+01]
:004370AB 52                      push edx
:004370AC 8B4508                  mov eax, dword ptr [ebp+08]
:004370AF 33C9                    xor ecx, ecx
:004370B1 8A08                    mov cl, byte ptr [eax]
:004370B3 83E902                  sub ecx, 00000002
:004370B6 51                      push ecx
:004370B7 E848090000              call 00437A04
:004370BC 83C414                  add esp, 00000014
:004370BF 8A5514                  mov dl, byte ptr [ebp+14]
:004370C2 52                      push edx
:004370C3 8A4510                  mov al, byte ptr [ebp+10]
:004370C6 50                      push eax
:004370C7 8B4DE0                  mov ecx, dword ptr [ebp-20]
:004370CA 8A5104                  mov dl, byte ptr [ecx+04]
:004370CD 52                      push edx
:004370CE 8B4508                  mov eax, dword ptr [ebp+08]
:004370D1 8A4801                  mov cl, byte ptr [eax+01]
:004370D4 51                      push ecx
:004370D5 8B5508                  mov edx, dword ptr [ebp+08]
:004370D8 33C0                    xor eax, eax
:004370DA 8A02                    mov al, byte ptr [edx]
:004370DC 83C002                  add eax, 00000002
:004370DF 50                      push eax
:004370E0 E81F090000              call 00437A04
:004370E5 83C414                  add esp, 00000014
:004370E8 8A4D14                  mov cl, byte ptr [ebp+14]
:004370EB 51                      push ecx
:004370EC 8A5510                  mov dl, byte ptr [ebp+10]
:004370EF 52                      push edx
:004370F0 8B45E0                  mov eax, dword ptr [ebp-20]
:004370F3 8A4804                  mov cl, byte ptr [eax+04]
:004370F6 51                      push ecx
:004370F7 8B5508                  mov edx, dword ptr [ebp+08]
:004370FA 33C0                    xor eax, eax
:004370FC 8A4201                  mov al, byte ptr [edx+01]
:004370FF 83E802                  sub eax, 00000002
:00437102 50                      push eax
:00437103 8B4D08                  mov ecx, dword ptr [ebp+08]
:00437106 8A11                    mov dl, byte ptr [ecx]
:00437108 52                      push edx
:00437109 E8F6080000              call 00437A04
:0043710E 83C414                  add esp, 00000014
:00437111 8A4514                  mov al, byte ptr [ebp+14]
:00437114 50                      push eax
:00437115 8A4D10                  mov cl, byte ptr [ebp+10]
:00437118 51                      push ecx
:00437119 8B55E0                  mov edx, dword ptr [ebp-20]
:0043711C 8A4204                  mov al, byte ptr [edx+04]
:0043711F 50                      push eax
:00437120 8B4D08                  mov ecx, dword ptr [ebp+08]
:00437123 33D2                    xor edx, edx
:00437125 8A5101                  mov dl, byte ptr [ecx+01]
:00437128 83C202                  add edx, 00000002
:0043712B 52                      push edx
:0043712C 8B4508                  mov eax, dword ptr [ebp+08]
:0043712F 8A08                    mov cl, byte ptr [eax]
:00437131 51                      push ecx
:00437132 E8CD080000              call 00437A04
:00437137 83C414                  add esp, 00000014
:0043713A E902080000              jmp 00437941
:0043713F 8A5514                  mov dl, byte ptr [ebp+14]
:00437142 52                      push edx
:00437143 8A4510                  mov al, byte ptr [ebp+10]
:00437146 50                      push eax
:00437147 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0043714A 8A5104                  mov dl, byte ptr [ecx+04]
:0043714D 52                      push edx
:0043714E E8960B0000              call 00437CE9
:00437153 83C40C                  add esp, 0000000C
:00437156 E9E6070000              jmp 00437941
:0043715B 8B45E0                  mov eax, dword ptr [ebp-20]
:0043715E 8A4804                  mov cl, byte ptr [eax+04]
:00437161 51                      push ecx
:00437162 8A5514                  mov dl, byte ptr [ebp+14]
:00437165 52                      push edx
:00437166 8A4510                  mov al, byte ptr [ebp+10]
:00437169 50                      push eax
:0043716A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043716D 51                      push ecx
:0043716E E8870A0000              call 00437BFA
:00437173 83C410                  add esp, 00000010
:00437176 8B55E0                  mov edx, dword ptr [ebp-20]
:00437179 8A4204                  mov al, byte ptr [edx+04]
:0043717C 50                      push eax
:0043717D 8A4D14                  mov cl, byte ptr [ebp+14]
:00437180 51                      push ecx
:00437181 8A5510                  mov dl, byte ptr [ebp+10]
:00437184 52                      push edx
:00437185 8B4508                  mov eax, dword ptr [ebp+08]
:00437188 50                      push eax
:00437189 E8EC0A0000              call 00437C7A
:0043718E 83C410                  add esp, 00000010
:00437191 C645F000                mov [ebp-10], 00
:00437195 EB09                    jmp 004371A0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043721D(U)
|
:00437197 8A4DF0                  mov cl, byte ptr [ebp-10]
:0043719A 80C101                  add cl, 01
:0043719D 884DF0                  mov byte ptr [ebp-10], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437195(U)
|
:004371A0 8B55F0                  mov edx, dword ptr [ebp-10]
:004371A3 81E2FF000000            and edx, 000000FF
:004371A9 83FA03                  cmp edx, 00000003
:004371AC 7D74                    jge 00437222
:004371AE 8A4514                  mov al, byte ptr [ebp+14]
:004371B1 50                      push eax
:004371B2 8A4D10                  mov cl, byte ptr [ebp+10]
:004371B5 51                      push ecx
:004371B6 8B55E0                  mov edx, dword ptr [ebp-20]
:004371B9 8A4204                  mov al, byte ptr [edx+04]
:004371BC 50                      push eax
:004371BD 8B4D08                  mov ecx, dword ptr [ebp+08]
:004371C0 33D2                    xor edx, edx
:004371C2 8A5101                  mov dl, byte ptr [ecx+01]
:004371C5 83EA02                  sub edx, 00000002
:004371C8 52                      push edx
:004371C9 8B4508                  mov eax, dword ptr [ebp+08]
:004371CC 33C9                    xor ecx, ecx
:004371CE 8A08                    mov cl, byte ptr [eax]
:004371D0 8B55F0                  mov edx, dword ptr [ebp-10]
:004371D3 81E2FF000000            and edx, 000000FF
:004371D9 8D4411FF                lea eax, dword ptr [ecx+edx-01]
:004371DD 50                      push eax
:004371DE E821080000              call 00437A04
:004371E3 83C414                  add esp, 00000014
:004371E6 8A4D14                  mov cl, byte ptr [ebp+14]
:004371E9 51                      push ecx
:004371EA 8A5510                  mov dl, byte ptr [ebp+10]
:004371ED 52                      push edx
:004371EE 8B45E0                  mov eax, dword ptr [ebp-20]
:004371F1 8A4804                  mov cl, byte ptr [eax+04]
:004371F4 51                      push ecx
:004371F5 8B5508                  mov edx, dword ptr [ebp+08]
:004371F8 33C0                    xor eax, eax
:004371FA 8A4201                  mov al, byte ptr [edx+01]
:004371FD 83C002                  add eax, 00000002
:00437200 50                      push eax
:00437201 8B4D08                  mov ecx, dword ptr [ebp+08]
:00437204 33D2                    xor edx, edx
:00437206 8A11                    mov dl, byte ptr [ecx]
:00437208 8B45F0                  mov eax, dword ptr [ebp-10]
:0043720B 25FF000000              and eax, 000000FF
:00437210 8D4C02FF                lea ecx, dword ptr [edx+eax-01]
:00437214 51                      push ecx
:00437215 E8EA070000              call 00437A04
:0043721A 83C414                  add esp, 00000014
:0043721D E975FFFFFF              jmp 00437197

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004371AC(C)
|
:00437222 C645F000                mov [ebp-10], 00
:00437226 EB09                    jmp 00437231

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004372AE(U)
|
:00437228 8A55F0                  mov dl, byte ptr [ebp-10]
:0043722B 80C201                  add dl, 01
:0043722E 8855F0                  mov byte ptr [ebp-10], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437226(U)
|
:00437231 8B45F0                  mov eax, dword ptr [ebp-10]
:00437234 25FF000000              and eax, 000000FF
:00437239 83F803                  cmp eax, 00000003
:0043723C 7D75                    jge 004372B3
:0043723E 8A4D14                  mov cl, byte ptr [ebp+14]
:00437241 51                      push ecx
:00437242 8A5510                  mov dl, byte ptr [ebp+10]
:00437245 52                      push edx
:00437246 8B45E0                  mov eax, dword ptr [ebp-20]
:00437249 8A4804                  mov cl, byte ptr [eax+04]
:0043724C 51                      push ecx
:0043724D 8B5508                  mov edx, dword ptr [ebp+08]
:00437250 33C0                    xor eax, eax
:00437252 8A4201                  mov al, byte ptr [edx+01]
:00437255 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00437258 81E1FF000000            and ecx, 000000FF
:0043725E 8D5408FF                lea edx, dword ptr [eax+ecx-01]
:00437262 52                      push edx
:00437263 8B4508                  mov eax, dword ptr [ebp+08]
:00437266 33C9                    xor ecx, ecx
:00437268 8A08                    mov cl, byte ptr [eax]
:0043726A 83C102                  add ecx, 00000002
:0043726D 51                      push ecx
:0043726E E891070000              call 00437A04
:00437273 83C414                  add esp, 00000014
:00437276 8A5514                  mov dl, byte ptr [ebp+14]
:00437279 52                      push edx
:0043727A 8A4510                  mov al, byte ptr [ebp+10]
:0043727D 50                      push eax
:0043727E 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00437281 8A5104                  mov dl, byte ptr [ecx+04]
:00437284 52                      push edx
:00437285 8B4508                  mov eax, dword ptr [ebp+08]
:00437288 33C9                    xor ecx, ecx
:0043728A 8A4801                  mov cl, byte ptr [eax+01]
:0043728D 8B55F0                  mov edx, dword ptr [ebp-10]
:00437290 81E2FF000000            and edx, 000000FF
:00437296 8D4411FF                lea eax, dword ptr [ecx+edx-01]
:0043729A 50                      push eax
:0043729B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043729E 33D2                    xor edx, edx
:004372A0 8A11                    mov dl, byte ptr [ecx]
:004372A2 83EA02                  sub edx, 00000002
:004372A5 52                      push edx
:004372A6 E859070000              call 00437A04
:004372AB 83C414                  add esp, 00000014
:004372AE E975FFFFFF              jmp 00437228

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043723C(C)
|
:004372B3 8A4514                  mov al, byte ptr [ebp+14]
:004372B6 50                      push eax
:004372B7 8A4D10                  mov cl, byte ptr [ebp+10]
:004372BA 51                      push ecx
:004372BB 8B55E0                  mov edx, dword ptr [ebp-20]
:004372BE 8A4204                  mov al, byte ptr [edx+04]
:004372C1 50                      push eax
:004372C2 8B4D08                  mov ecx, dword ptr [ebp+08]
:004372C5 8A5101                  mov dl, byte ptr [ecx+01]
:004372C8 52                      push edx
:004372C9 8B4508                  mov eax, dword ptr [ebp+08]
:004372CC 33C9                    xor ecx, ecx
:004372CE 8A08                    mov cl, byte ptr [eax]
:004372D0 83E903                  sub ecx, 00000003
:004372D3 51                      push ecx
:004372D4 E82B070000              call 00437A04
:004372D9 83C414                  add esp, 00000014
:004372DC 8A5514                  mov dl, byte ptr [ebp+14]
:004372DF 52                      push edx
:004372E0 8A4510                  mov al, byte ptr [ebp+10]
:004372E3 50                      push eax
:004372E4 8B4DE0                  mov ecx, dword ptr [ebp-20]
:004372E7 8A5104                  mov dl, byte ptr [ecx+04]
:004372EA 52                      push edx
:004372EB 8B4508                  mov eax, dword ptr [ebp+08]
:004372EE 8A4801                  mov cl, byte ptr [eax+01]
:004372F1 51                      push ecx
:004372F2 8B5508                  mov edx, dword ptr [ebp+08]
:004372F5 33C0                    xor eax, eax
:004372F7 8A02                    mov al, byte ptr [edx]
:004372F9 83C003                  add eax, 00000003
:004372FC 50                      push eax
:004372FD E802070000              call 00437A04
:00437302 83C414                  add esp, 00000014
:00437305 8A4D14                  mov cl, byte ptr [ebp+14]
:00437308 51                      push ecx
:00437309 8A5510                  mov dl, byte ptr [ebp+10]
:0043730C 52                      push edx
:0043730D 8B45E0                  mov eax, dword ptr [ebp-20]
:00437310 8A4804                  mov cl, byte ptr [eax+04]
:00437313 51                      push ecx
:00437314 8B5508                  mov edx, dword ptr [ebp+08]
:00437317 33C0                    xor eax, eax
:00437319 8A4201                  mov al, byte ptr [edx+01]
:0043731C 83E803                  sub eax, 00000003
:0043731F 50                      push eax
:00437320 8B4D08                  mov ecx, dword ptr [ebp+08]
:00437323 8A11                    mov dl, byte ptr [ecx]
:00437325 52                      push edx
:00437326 E8D9060000              call 00437A04
:0043732B 83C414                  add esp, 00000014
:0043732E 8A4514                  mov al, byte ptr [ebp+14]
:00437331 50                      push eax
:00437332 8A4D10                  mov cl, byte ptr [ebp+10]
:00437335 51                      push ecx
:00437336 8B55E0                  mov edx, dword ptr [ebp-20]
:00437339 8A4204                  mov al, byte ptr [edx+04]
:0043733C 50                      push eax
:0043733D 8B4D08                  mov ecx, dword ptr [ebp+08]
:00437340 33D2                    xor edx, edx
:00437342 8A5101                  mov dl, byte ptr [ecx+01]
:00437345 83C203                  add edx, 00000003
:00437348 52                      push edx
:00437349 8B4508                  mov eax, dword ptr [ebp+08]
:0043734C 8A08                    mov cl, byte ptr [eax]
:0043734E 51                      push ecx
:0043734F E8B0060000              call 00437A04
:00437354 83C414                  add esp, 00000014
:00437357 E9E5050000              jmp 00437941
:0043735C 8B55E0                  mov edx, dword ptr [ebp-20]
:0043735F 8A4204                  mov al, byte ptr [edx+04]
:00437362 50                      push eax
:00437363 8A4D14                  mov cl, byte ptr [ebp+14]
:00437366 51                      push ecx
:00437367 8A5510                  mov dl, byte ptr [ebp+10]
:0043736A 52                      push edx
:0043736B 8B4508                  mov eax, dword ptr [ebp+08]
:0043736E 50                      push eax
:0043736F E886080000              call 00437BFA
:00437374 83C410                  add esp, 00000010
:00437377 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0043737A 8A5104                  mov dl, byte ptr [ecx+04]
:0043737D 52                      push edx
:0043737E 8A4514                  mov al, byte ptr [ebp+14]
:00437381 50                      push eax
:00437382 8A4D10                  mov cl, byte ptr [ebp+10]
:00437385 51                      push ecx
:00437386 8B5508                  mov edx, dword ptr [ebp+08]
:00437389 52                      push edx
:0043738A E8EB080000              call 00437C7A
:0043738F 83C410                  add esp, 00000010
:00437392 C645F000                mov [ebp-10], 00
:00437396 EB08                    jmp 004373A0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043741E(U)
|
:00437398 8A45F0                  mov al, byte ptr [ebp-10]
:0043739B 0401                    add al, 01
:0043739D 8845F0                  mov byte ptr [ebp-10], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437396(U)
|
:004373A0 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004373A3 81E1FF000000            and ecx, 000000FF
:004373A9 83F903                  cmp ecx, 00000003
:004373AC 7D75                    jge 00437423
:004373AE 8A5514                  mov dl, byte ptr [ebp+14]
:004373B1 52                      push edx
:004373B2 8A4510                  mov al, byte ptr [ebp+10]
:004373B5 50                      push eax
:004373B6 8B4DE0                  mov ecx, dword ptr [ebp-20]
:004373B9 8A5104                  mov dl, byte ptr [ecx+04]
:004373BC 52                      push edx
:004373BD 8B4508                  mov eax, dword ptr [ebp+08]
:004373C0 33C9                    xor ecx, ecx
:004373C2 8A4801                  mov cl, byte ptr [eax+01]
:004373C5 83E902                  sub ecx, 00000002
:004373C8 51                      push ecx
:004373C9 8B5508                  mov edx, dword ptr [ebp+08]
:004373CC 33C0                    xor eax, eax
:004373CE 8A02                    mov al, byte ptr [edx]
:004373D0 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004373D3 81E1FF000000            and ecx, 000000FF
:004373D9 8D5408FF                lea edx, dword ptr [eax+ecx-01]
:004373DD 52                      push edx
:004373DE E821060000              call 00437A04
:004373E3 83C414                  add esp, 00000014
:004373E6 8A4514                  mov al, byte ptr [ebp+14]
:004373E9 50                      push eax
:004373EA 8A4D10                  mov cl, byte ptr [ebp+10]
:004373ED 51                      push ecx
:004373EE 8B55E0                  mov edx, dword ptr [ebp-20]
:004373F1 8A4204                  mov al, byte ptr [edx+04]
:004373F4 50                      push eax
:004373F5 8B4D08                  mov ecx, dword ptr [ebp+08]
:004373F8 33D2                    xor edx, edx
:004373FA 8A5101                  mov dl, byte ptr [ecx+01]
:004373FD 83C202                  add edx, 00000002
:00437400 52                      push edx
:00437401 8B4508                  mov eax, dword ptr [ebp+08]
:00437404 33C9                    xor ecx, ecx
:00437406 8A08                    mov cl, byte ptr [eax]
:00437408 8B55F0                  mov edx, dword ptr [ebp-10]
:0043740B 81E2FF000000            and edx, 000000FF
:00437411 8D4411FF                lea eax, dword ptr [ecx+edx-01]
:00437415 50                      push eax
:00437416 E8E9050000              call 00437A04
:0043741B 83C414                  add esp, 00000014
:0043741E E975FFFFFF              jmp 00437398

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004373AC(C)
|
:00437423 C645F000                mov [ebp-10], 00
:00437427 EB09                    jmp 00437432

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004374AF(U)
|
:00437429 8A4DF0                  mov cl, byte ptr [ebp-10]
:0043742C 80C101                  add cl, 01
:0043742F 884DF0                  mov byte ptr [ebp-10], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437427(U)
|
:00437432 8B55F0                  mov edx, dword ptr [ebp-10]
:00437435 81E2FF000000            and edx, 000000FF
:0043743B 83FA03                  cmp edx, 00000003
:0043743E 7D74                    jge 004374B4
:00437440 8A4514                  mov al, byte ptr [ebp+14]
:00437443 50                      push eax
:00437444 8A4D10                  mov cl, byte ptr [ebp+10]
:00437447 51                      push ecx
:00437448 8B55E0                  mov edx, dword ptr [ebp-20]
:0043744B 8A4204                  mov al, byte ptr [edx+04]
:0043744E 50                      push eax
:0043744F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00437452 33D2                    xor edx, edx
:00437454 8A5101                  mov dl, byte ptr [ecx+01]
:00437457 8B45F0                  mov eax, dword ptr [ebp-10]
:0043745A 25FF000000              and eax, 000000FF
:0043745F 8D4C02FF                lea ecx, dword ptr [edx+eax-01]
:00437463 51                      push ecx
:00437464 8B5508                  mov edx, dword ptr [ebp+08]
:00437467 33C0                    xor eax, eax
:00437469 8A02                    mov al, byte ptr [edx]
:0043746B 83C002                  add eax, 00000002
:0043746E 50                      push eax
:0043746F E890050000              call 00437A04
:00437474 83C414                  add esp, 00000014
:00437477 8A4D14                  mov cl, byte ptr [ebp+14]
:0043747A 51                      push ecx
:0043747B 8A5510                  mov dl, byte ptr [ebp+10]
:0043747E 52                      push edx
:0043747F 8B45E0                  mov eax, dword ptr [ebp-20]
:00437482 8A4804                  mov cl, byte ptr [eax+04]
:00437485 51                      push ecx
:00437486 8B5508                  mov edx, dword ptr [ebp+08]
:00437489 33C0                    xor eax, eax
:0043748B 8A4201                  mov al, byte ptr [edx+01]
:0043748E 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00437491 81E1FF000000            and ecx, 000000FF
:00437497 8D5408FF                lea edx, dword ptr [eax+ecx-01]
:0043749B 52                      push edx
:0043749C 8B4508                  mov eax, dword ptr [ebp+08]
:0043749F 33C9                    xor ecx, ecx
:004374A1 8A08                    mov cl, byte ptr [eax]
:004374A3 83E902                  sub ecx, 00000002
:004374A6 51                      push ecx
:004374A7 E858050000              call 00437A04
:004374AC 83C414                  add esp, 00000014
:004374AF E975FFFFFF              jmp 00437429

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043743E(C)
|
:004374B4 C645F000                mov [ebp-10], 00
:004374B8 EB09                    jmp 004374C3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043753F(U)
|
:004374BA 8A55F0                  mov dl, byte ptr [ebp-10]
:004374BD 80C201                  add dl, 01
:004374C0 8855F0                  mov byte ptr [ebp-10], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004374B8(U)
|
:004374C3 8B45F0                  mov eax, dword ptr [ebp-10]
:004374C6 25FF000000              and eax, 000000FF
:004374CB 83F803                  cmp eax, 00000003
:004374CE 7D74                    jge 00437544
:004374D0 8A4D14                  mov cl, byte ptr [ebp+14]
:004374D3 51                      push ecx
:004374D4 8A5510                  mov dl, byte ptr [ebp+10]
:004374D7 52                      push edx
:004374D8 8B45E0                  mov eax, dword ptr [ebp-20]
:004374DB 8A4804                  mov cl, byte ptr [eax+04]
:004374DE 51                      push ecx
:004374DF 8B5508                  mov edx, dword ptr [ebp+08]
:004374E2 33C0                    xor eax, eax
:004374E4 8A4201                  mov al, byte ptr [edx+01]
:004374E7 83E803                  sub eax, 00000003
:004374EA 50                      push eax
:004374EB 8B4D08                  mov ecx, dword ptr [ebp+08]
:004374EE 33D2                    xor edx, edx
:004374F0 8A11                    mov dl, byte ptr [ecx]
:004374F2 8B45F0                  mov eax, dword ptr [ebp-10]
:004374F5 25FF000000              and eax, 000000FF
:004374FA 8D4C02FF                lea ecx, dword ptr [edx+eax-01]
:004374FE 51                      push ecx
:004374FF E800050000              call 00437A04
:00437504 83C414                  add esp, 00000014
:00437507 8A5514                  mov dl, byte ptr [ebp+14]
:0043750A 52                      push edx
:0043750B 8A4510                  mov al, byte ptr [ebp+10]
:0043750E 50                      push eax
:0043750F 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00437512 8A5104                  mov dl, byte ptr [ecx+04]
:00437515 52                      push edx
:00437516 8B4508                  mov eax, dword ptr [ebp+08]
:00437519 33C9                    xor ecx, ecx
:0043751B 8A4801                  mov cl, byte ptr [eax+01]
:0043751E 83C103                  add ecx, 00000003
:00437521 51                      push ecx
:00437522 8B5508                  mov edx, dword ptr [ebp+08]
:00437525 33C0                    xor eax, eax
:00437527 8A02                    mov al, byte ptr [edx]
:00437529 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043752C 81E1FF000000            and ecx, 000000FF
:00437532 8D5408FF                lea edx, dword ptr [eax+ecx-01]
:00437536 52                      push edx
:00437537 E8C8040000              call 00437A04
:0043753C 83C414                  add esp, 00000014
:0043753F E976FFFFFF              jmp 004374BA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004374CE(C)
|
:00437544 C645F000                mov [ebp-10], 00
:00437548 EB08                    jmp 00437552

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004375CF(U)
|
:0043754A 8A45F0                  mov al, byte ptr [ebp-10]
:0043754D 0401                    add al, 01
:0043754F 8845F0                  mov byte ptr [ebp-10], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437548(U)
|
:00437552 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00437555 81E1FF000000            and ecx, 000000FF
:0043755B 83F903                  cmp ecx, 00000003
:0043755E 7D74                    jge 004375D4
:00437560 8A5514                  mov dl, byte ptr [ebp+14]
:00437563 52                      push edx
:00437564 8A4510                  mov al, byte ptr [ebp+10]
:00437567 50                      push eax
:00437568 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0043756B 8A5104                  mov dl, byte ptr [ecx+04]
:0043756E 52                      push edx
:0043756F 8B4508                  mov eax, dword ptr [ebp+08]
:00437572 33C9                    xor ecx, ecx
:00437574 8A4801                  mov cl, byte ptr [eax+01]
:00437577 8B55F0                  mov edx, dword ptr [ebp-10]
:0043757A 81E2FF000000            and edx, 000000FF
:00437580 8D4411FF                lea eax, dword ptr [ecx+edx-01]
:00437584 50                      push eax
:00437585 8B4D08                  mov ecx, dword ptr [ebp+08]
:00437588 33D2                    xor edx, edx
:0043758A 8A11                    mov dl, byte ptr [ecx]
:0043758C 83C203                  add edx, 00000003
:0043758F 52                      push edx
:00437590 E86F040000              call 00437A04
:00437595 83C414                  add esp, 00000014
:00437598 8A4514                  mov al, byte ptr [ebp+14]
:0043759B 50                      push eax
:0043759C 8A4D10                  mov cl, byte ptr [ebp+10]
:0043759F 51                      push ecx
:004375A0 8B55E0                  mov edx, dword ptr [ebp-20]
:004375A3 8A4204                  mov al, byte ptr [edx+04]
:004375A6 50                      push eax
:004375A7 8B4D08                  mov ecx, dword ptr [ebp+08]
:004375AA 33D2                    xor edx, edx
:004375AC 8A5101                  mov dl, byte ptr [ecx+01]
:004375AF 8B45F0                  mov eax, dword ptr [ebp-10]
:004375B2 25FF000000              and eax, 000000FF
:004375B7 8D4C02FF                lea ecx, dword ptr [edx+eax-01]
:004375BB 51                      push ecx
:004375BC 8B5508                  mov edx, dword ptr [ebp+08]
:004375BF 33C0                    xor eax, eax
:004375C1 8A02                    mov al, byte ptr [edx]
:004375C3 83E803                  sub eax, 00000003
:004375C6 50                      push eax
:004375C7 E838040000              call 00437A04
:004375CC 83C414                  add esp, 00000014
:004375CF E976FFFFFF              jmp 0043754A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043755E(C)
|
:004375D4 8A4D14                  mov cl, byte ptr [ebp+14]
:004375D7 51                      push ecx
:004375D8 8A5510                  mov dl, byte ptr [ebp+10]
:004375DB 52                      push edx
:004375DC 8B45E0                  mov eax, dword ptr [ebp-20]
:004375DF 8A4804                  mov cl, byte ptr [eax+04]
:004375E2 51                      push ecx
:004375E3 8B5508                  mov edx, dword ptr [ebp+08]
:004375E6 33C0                    xor eax, eax
:004375E8 8A4201                  mov al, byte ptr [edx+01]
:004375EB 83E802                  sub eax, 00000002
:004375EE 50                      push eax
:004375EF 8B4D08                  mov ecx, dword ptr [ebp+08]
:004375F2 33D2                    xor edx, edx
:004375F4 8A11                    mov dl, byte ptr [ecx]
:004375F6 83EA02                  sub edx, 00000002
:004375F9 52                      push edx
:004375FA E805040000              call 00437A04
:004375FF 83C414                  add esp, 00000014
:00437602 8A4514                  mov al, byte ptr [ebp+14]
:00437605 50                      push eax
:00437606 8A4D10                  mov cl, byte ptr [ebp+10]
:00437609 51                      push ecx
:0043760A 8B55E0                  mov edx, dword ptr [ebp-20]
:0043760D 8A4204                  mov al, byte ptr [edx+04]
:00437610 50                      push eax
:00437611 8B4D08                  mov ecx, dword ptr [ebp+08]
:00437614 33D2                    xor edx, edx
:00437616 8A5101                  mov dl, byte ptr [ecx+01]
:00437619 83C202                  add edx, 00000002
:0043761C 52                      push edx
:0043761D 8B4508                  mov eax, dword ptr [ebp+08]
:00437620 33C9                    xor ecx, ecx
:00437622 8A08                    mov cl, byte ptr [eax]
:00437624 83C102                  add ecx, 00000002
:00437627 51                      push ecx
:00437628 E8D7030000              call 00437A04
:0043762D 83C414                  add esp, 00000014
:00437630 8A5514                  mov dl, byte ptr [ebp+14]
:00437633 52                      push edx
:00437634 8A4510                  mov al, byte ptr [ebp+10]
:00437637 50                      push eax
:00437638 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0043763B 8A5104                  mov dl, byte ptr [ecx+04]
:0043763E 52                      push edx
:0043763F 8B4508                  mov eax, dword ptr [ebp+08]
:00437642 33C9                    xor ecx, ecx
:00437644 8A4801                  mov cl, byte ptr [eax+01]
:00437647 83E902                  sub ecx, 00000002
:0043764A 51                      push ecx
:0043764B 8B5508                  mov edx, dword ptr [ebp+08]
:0043764E 33C0                    xor eax, eax
:00437650 8A02                    mov al, byte ptr [edx]
:00437652 83C002                  add eax, 00000002
:00437655 50                      push eax
:00437656 E8A9030000              call 00437A04
:0043765B 83C414                  add esp, 00000014
:0043765E 8A4D14                  mov cl, byte ptr [ebp+14]
:00437661 51                      push ecx
:00437662 8A5510                  mov dl, byte ptr [ebp+10]
:00437665 52                      push edx
:00437666 8B45E0                  mov eax, dword ptr [ebp-20]
:00437669 8A4804                  mov cl, byte ptr [eax+04]
:0043766C 51                      push ecx
:0043766D 8B5508                  mov edx, dword ptr [ebp+08]
:00437670 33C0                    xor eax, eax
:00437672 8A4201                  mov al, byte ptr [edx+01]
:00437675 83C002                  add eax, 00000002
:00437678 50                      push eax
:00437679 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043767C 33D2                    xor edx, edx
:0043767E 8A11                    mov dl, byte ptr [ecx]
:00437680 83EA02                  sub edx, 00000002
:00437683 52                      push edx
:00437684 E87B030000              call 00437A04
:00437689 83C414                  add esp, 00000014
:0043768C 8A4514                  mov al, byte ptr [ebp+14]
:0043768F 50                      push eax
:00437690 8A4D10                  mov cl, byte ptr [ebp+10]
:00437693 51                      push ecx
:00437694 8B55E0                  mov edx, dword ptr [ebp-20]
:00437697 8A4204                  mov al, byte ptr [edx+04]
:0043769A 50                      push eax
:0043769B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043769E 8A5101                  mov dl, byte ptr [ecx+01]
:004376A1 52                      push edx
:004376A2 8B4508                  mov eax, dword ptr [ebp+08]
:004376A5 33C9                    xor ecx, ecx
:004376A7 8A08                    mov cl, byte ptr [eax]
:004376A9 83E904                  sub ecx, 00000004
:004376AC 51                      push ecx
:004376AD E852030000              call 00437A04
:004376B2 83C414                  add esp, 00000014
:004376B5 8A5514                  mov dl, byte ptr [ebp+14]
:004376B8 52                      push edx
:004376B9 8A4510                  mov al, byte ptr [ebp+10]
:004376BC 50                      push eax
:004376BD 8B4DE0                  mov ecx, dword ptr [ebp-20]
:004376C0 8A5104                  mov dl, byte ptr [ecx+04]
:004376C3 52                      push edx
:004376C4 8B4508                  mov eax, dword ptr [ebp+08]
:004376C7 8A4801                  mov cl, byte ptr [eax+01]
:004376CA 51                      push ecx
:004376CB 8B5508                  mov edx, dword ptr [ebp+08]
:004376CE 33C0                    xor eax, eax
:004376D0 8A02                    mov al, byte ptr [edx]
:004376D2 83C004                  add eax, 00000004
:004376D5 50                      push eax
:004376D6 E829030000              call 00437A04
:004376DB 83C414                  add esp, 00000014
:004376DE 8A4D14                  mov cl, byte ptr [ebp+14]
:004376E1 51                      push ecx
:004376E2 8A5510                  mov dl, byte ptr [ebp+10]
:004376E5 52                      push edx
:004376E6 8B45E0                  mov eax, dword ptr [ebp-20]
:004376E9 8A4804                  mov cl, byte ptr [eax+04]
:004376EC 51                      push ecx
:004376ED 8B5508                  mov edx, dword ptr [ebp+08]
:004376F0 33C0                    xor eax, eax
:004376F2 8A4201                  mov al, byte ptr [edx+01]
:004376F5 83E804                  sub eax, 00000004
:004376F8 50                      push eax
:004376F9 8B4D08                  mov ecx, dword ptr [ebp+08]
:004376FC 8A11                    mov dl, byte ptr [ecx]
:004376FE 52                      push edx
:004376FF E800030000              call 00437A04
:00437704 83C414                  add esp, 00000014
:00437707 8A4514                  mov al, byte ptr [ebp+14]
:0043770A 50                      push eax
:0043770B 8A4D10                  mov cl, byte ptr [ebp+10]
:0043770E 51                      push ecx
:0043770F 8B55E0                  mov edx, dword ptr [ebp-20]
:00437712 8A4204                  mov al, byte ptr [edx+04]
:00437715 50                      push eax
:00437716 8B4D08                  mov ecx, dword ptr [ebp+08]
:00437719 33D2                    xor edx, edx
:0043771B 8A5101                  mov dl, byte ptr [ecx+01]
:0043771E 83C204                  add edx, 00000004
:00437721 52                      push edx
:00437722 8B4508                  mov eax, dword ptr [ebp+08]
:00437725 8A08                    mov cl, byte ptr [eax]
:00437727 51                      push ecx
:00437728 E8D7020000              call 00437A04
:0043772D 83C414                  add esp, 00000014
:00437730 E90C020000              jmp 00437941
:00437735 C645F000                mov [ebp-10], 00
:00437739 EB09                    jmp 00437744

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437834(U)
|
:0043773B 8A55F0                  mov dl, byte ptr [ebp-10]
:0043773E 80C201                  add dl, 01
:00437741 8855F0                  mov byte ptr [ebp-10], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437739(U)
|
:00437744 8B45F0                  mov eax, dword ptr [ebp-10]
:00437747 25FF000000              and eax, 000000FF
:0043774C 83F803                  cmp eax, 00000003
:0043774F 0F8DE4000000            jnl 00437839
:00437755 8A4D14                  mov cl, byte ptr [ebp+14]
:00437758 51                      push ecx
:00437759 8A5510                  mov dl, byte ptr [ebp+10]
:0043775C 52                      push edx
:0043775D 8B45E0                  mov eax, dword ptr [ebp-20]
:00437760 8A4804                  mov cl, byte ptr [eax+04]
:00437763 51                      push ecx
:00437764 8B5508                  mov edx, dword ptr [ebp+08]
:00437767 33C0                    xor eax, eax
:00437769 8A4201                  mov al, byte ptr [edx+01]
:0043776C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043776F 81E1FF000000            and ecx, 000000FF
:00437775 8D5408FF                lea edx, dword ptr [eax+ecx-01]
:00437779 52                      push edx
:0043777A 8B4508                  mov eax, dword ptr [ebp+08]
:0043777D 33C9                    xor ecx, ecx
:0043777F 8A08                    mov cl, byte ptr [eax]
:00437781 83E903                  sub ecx, 00000003
:00437784 51                      push ecx
:00437785 E87A020000              call 00437A04
:0043778A 83C414                  add esp, 00000014
:0043778D 8A5514                  mov dl, byte ptr [ebp+14]
:00437790 52                      push edx
:00437791 8A4510                  mov al, byte ptr [ebp+10]
:00437794 50                      push eax
:00437795 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00437798 8A5104                  mov dl, byte ptr [ecx+04]
:0043779B 52                      push edx
:0043779C 8B4508                  mov eax, dword ptr [ebp+08]
:0043779F 33C9                    xor ecx, ecx
:004377A1 8A4801                  mov cl, byte ptr [eax+01]
:004377A4 8B55F0                  mov edx, dword ptr [ebp-10]
:004377A7 81E2FF000000            and edx, 000000FF
:004377AD 8D4411FF                lea eax, dword ptr [ecx+edx-01]
:004377B1 50                      push eax
:004377B2 8B4D08                  mov ecx, dword ptr [ebp+08]
:004377B5 33D2                    xor edx, edx
:004377B7 8A11                    mov dl, byte ptr [ecx]
:004377B9 83C203                  add edx, 00000003
:004377BC 52                      push edx
:004377BD E842020000              call 00437A04
:004377C2 83C414                  add esp, 00000014
:004377C5 8A4514                  mov al, byte ptr [ebp+14]
:004377C8 50                      push eax
:004377C9 8A4D10                  mov cl, byte ptr [ebp+10]
:004377CC 51                      push ecx
:004377CD 8B55E0                  mov edx, dword ptr [ebp-20]
:004377D0 8A4204                  mov al, byte ptr [edx+04]
:004377D3 50                      push eax
:004377D4 8B4D08                  mov ecx, dword ptr [ebp+08]
:004377D7 33D2                    xor edx, edx
:004377D9 8A5101                  mov dl, byte ptr [ecx+01]
:004377DC 83EA03                  sub edx, 00000003
:004377DF 52                      push edx
:004377E0 8B4508                  mov eax, dword ptr [ebp+08]
:004377E3 33C9                    xor ecx, ecx
:004377E5 8A08                    mov cl, byte ptr [eax]
:004377E7 8B55F0                  mov edx, dword ptr [ebp-10]
:004377EA 81E2FF000000            and edx, 000000FF
:004377F0 8D4411FF                lea eax, dword ptr [ecx+edx-01]
:004377F4 50                      push eax
:004377F5 E80A020000              call 00437A04
:004377FA 83C414                  add esp, 00000014
:004377FD 8A4D14                  mov cl, byte ptr [ebp+14]
:00437800 51                      push ecx
:00437801 8A5510                  mov dl, byte ptr [ebp+10]
:00437804 52                      push edx
:00437805 8B45E0                  mov eax, dword ptr [ebp-20]
:00437808 8A4804                  mov cl, byte ptr [eax+04]
:0043780B 51                      push ecx
:0043780C 8B5508                  mov edx, dword ptr [ebp+08]
:0043780F 33C0                    xor eax, eax
:00437811 8A4201                  mov al, byte ptr [edx+01]
:00437814 83C003                  add eax, 00000003
:00437817 50                      push eax
:00437818 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043781B 33D2                    xor edx, edx
:0043781D 8A11                    mov dl, byte ptr [ecx]
:0043781F 8B45F0                  mov eax, dword ptr [ebp-10]
:00437822 25FF000000              and eax, 000000FF
:00437827 8D4C02FF                lea ecx, dword ptr [edx+eax-01]
:0043782B 51                      push ecx
:0043782C E8D3010000              call 00437A04
:00437831 83C414                  add esp, 00000014
:00437834 E902FFFFFF              jmp 0043773B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043774F(C)
|
:00437839 E903010000              jmp 00437941
:0043783E C645F000                mov [ebp-10], 00
:00437842 EB09                    jmp 0043784D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043793C(U)
|
:00437844 8A55F0                  mov dl, byte ptr [ebp-10]
:00437847 80C201                  add dl, 01
:0043784A 8855F0                  mov byte ptr [ebp-10], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437842(U)
|
:0043784D 8B45F0                  mov eax, dword ptr [ebp-10]
:00437850 25FF000000              and eax, 000000FF
:00437855 83F805                  cmp eax, 00000005
:00437858 0F8DE3000000            jnl 00437941
:0043785E 8A4D14                  mov cl, byte ptr [ebp+14]
:00437861 51                      push ecx
:00437862 8A5510                  mov dl, byte ptr [ebp+10]
:00437865 52                      push edx
:00437866 8B45E0                  mov eax, dword ptr [ebp-20]
:00437869 8A4804                  mov cl, byte ptr [eax+04]
:0043786C 51                      push ecx
:0043786D 8B5508                  mov edx, dword ptr [ebp+08]
:00437870 33C0                    xor eax, eax
:00437872 8A4201                  mov al, byte ptr [edx+01]
:00437875 83E803                  sub eax, 00000003
:00437878 50                      push eax
:00437879 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043787C 33D2                    xor edx, edx
:0043787E 8A11                    mov dl, byte ptr [ecx]
:00437880 8B45F0                  mov eax, dword ptr [ebp-10]
:00437883 25FF000000              and eax, 000000FF
:00437888 8D4C02FE                lea ecx, dword ptr [edx+eax-02]
:0043788C 51                      push ecx
:0043788D E872010000              call 00437A04
:00437892 83C414                  add esp, 00000014
:00437895 8A5514                  mov dl, byte ptr [ebp+14]
:00437898 52                      push edx
:00437899 8A4510                  mov al, byte ptr [ebp+10]
:0043789C 50                      push eax
:0043789D 8B4DE0                  mov ecx, dword ptr [ebp-20]
:004378A0 8A5104                  mov dl, byte ptr [ecx+04]
:004378A3 52                      push edx
:004378A4 8B4508                  mov eax, dword ptr [ebp+08]
:004378A7 33C9                    xor ecx, ecx
:004378A9 8A4801                  mov cl, byte ptr [eax+01]
:004378AC 83C103                  add ecx, 00000003
:004378AF 51                      push ecx
:004378B0 8B5508                  mov edx, dword ptr [ebp+08]
:004378B3 33C0                    xor eax, eax
:004378B5 8A02                    mov al, byte ptr [edx]
:004378B7 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004378BA 81E1FF000000            and ecx, 000000FF
:004378C0 8D5408FE                lea edx, dword ptr [eax+ecx-02]
:004378C4 52                      push edx
:004378C5 E83A010000              call 00437A04
:004378CA 83C414                  add esp, 00000014
:004378CD 8A4514                  mov al, byte ptr [ebp+14]
:004378D0 50                      push eax
:004378D1 8A4D10                  mov cl, byte ptr [ebp+10]
:004378D4 51                      push ecx
:004378D5 8B55E0                  mov edx, dword ptr [ebp-20]
:004378D8 8A4204                  mov al, byte ptr [edx+04]
:004378DB 50                      push eax
:004378DC 8B4D08                  mov ecx, dword ptr [ebp+08]
:004378DF 33D2                    xor edx, edx
:004378E1 8A5101                  mov dl, byte ptr [ecx+01]
:004378E4 8B45F0                  mov eax, dword ptr [ebp-10]
:004378E7 25FF000000              and eax, 000000FF
:004378EC 8D4C02FE                lea ecx, dword ptr [edx+eax-02]
:004378F0 51                      push ecx
:004378F1 8B5508                  mov edx, dword ptr [ebp+08]
:004378F4 33C0                    xor eax, eax
:004378F6 8A02                    mov al, byte ptr [edx]
:004378F8 83E803                  sub eax, 00000003
:004378FB 50                      push eax
:004378FC E803010000              call 00437A04
:00437901 83C414                  add esp, 00000014
:00437904 8A4D14                  mov cl, byte ptr [ebp+14]
:00437907 51                      push ecx
:00437908 8A5510                  mov dl, byte ptr [ebp+10]
:0043790B 52                      push edx
:0043790C 8B45E0                  mov eax, dword ptr [ebp-20]
:0043790F 8A4804                  mov cl, byte ptr [eax+04]
:00437912 51                      push ecx
:00437913 8B5508                  mov edx, dword ptr [ebp+08]
:00437916 33C0                    xor eax, eax
:00437918 8A4201                  mov al, byte ptr [edx+01]
:0043791B 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043791E 81E1FF000000            and ecx, 000000FF
:00437924 8D5408FE                lea edx, dword ptr [eax+ecx-02]
:00437928 52                      push edx
:00437929 8B4508                  mov eax, dword ptr [ebp+08]
:0043792C 33C9                    xor ecx, ecx
:0043792E 8A08                    mov cl, byte ptr [eax]
:00437930 83C103                  add ecx, 00000003
:00437933 51                      push ecx
:00437934 E8CB000000              call 00437A04
:00437939 83C414                  add esp, 00000014
:0043793C E903FFFFFF              jmp 00437844

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00436630(C), :0043665B(U), :00436696(U), :0043675A(U), :00436940(U)
|:00436CFE(U), :00436DC2(U), :00436EA1(U), :00436F48(U), :00437091(U)
|:0043713A(U), :00437156(U), :00437357(U), :00437730(U), :00437839(U)
|:00437858(C)
|
:00437941 8B5514                  mov edx, dword ptr [ebp+14]
:00437944 81E2FF000000            and edx, 000000FF
:0043794A 85D2                    test edx, edx
:0043794C 7404                    je 00437952
:0043794E 0CFF                    or al, FF
:00437950 EB6C                    jmp 004379BE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043794C(C)
|
:00437952 A1342C4B00              mov eax, dword ptr [004B2C34]
:00437957 C600FF                  mov byte ptr [eax], FF
:0043795A 8B0D342C4B00            mov ecx, dword ptr [004B2C34]
:00437960 83C101                  add ecx, 00000001
:00437963 890D342C4B00            mov dword ptr [004B2C34], ecx
:00437969 C745EC48C74A00          mov [ebp-14], 004AC748
:00437970 EB09                    jmp 0043797B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004379B9(U)
|
:00437972 8B55EC                  mov edx, dword ptr [ebp-14]
:00437975 83C201                  add edx, 00000001
:00437978 8955EC                  mov dword ptr [ebp-14], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437970(U)
|
:0043797B 8B45EC                  mov eax, dword ptr [ebp-14]
:0043797E 33C9                    xor ecx, ecx
:00437980 8A08                    mov cl, byte ptr [eax]
:00437982 81F9FF000000            cmp ecx, 000000FF
:00437988 7431                    je 004379BB
:0043798A 8B55EC                  mov edx, dword ptr [ebp-14]
:0043798D 8A02                    mov al, byte ptr [edx]
:0043798F 8845E4                  mov byte ptr [ebp-1C], al
:00437992 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00437995 81E1FF000000            and ecx, 000000FF
:0043799B 81F9FF000000            cmp ecx, 000000FF
:004379A1 7416                    je 004379B9
:004379A3 8B55E4                  mov edx, dword ptr [ebp-1C]
:004379A6 81E2FF000000            and edx, 000000FF
:004379AC 33C0                    xor eax, eax
:004379AE A0282C4B00              mov al, byte ptr [004B2C28]
:004379B3 3BD0                    cmp edx, eax
:004379B5 7502                    jne 004379B9
:004379B7 EB02                    jmp 004379BB

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004379A1(C), :004379B5(C)
|
:004379B9 EBB7                    jmp 00437972

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00437988(C), :004379B7(U)
|
:004379BB 8A45E4                  mov al, byte ptr [ebp-1C]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004365B6(U), :00437950(U)
|
:004379BE 8BE5                    mov esp, ebp
:004379C0 5D                      pop ebp
:004379C1 C21000                  ret 0010



:004379C4 40664300                DWORD 00436640
:004379C8 60664300                DWORD 00436660
:004379CC 9B664300                DWORD 0043669B
:004379D0 5F674300                DWORD 0043675F
:004379D4 45694300                DWORD 00436945
:004379D8 036D4300                DWORD 00436D03
:004379DC C76D4300                DWORD 00436DC7
:004379E0 A66E4300                DWORD 00436EA6
:004379E4 4D6F4300                DWORD 00436F4D
:004379E8 96704300                DWORD 00437096
:004379EC 3F714300                DWORD 0043713F
:004379F0 41794300                DWORD 00437941
:004379F4 5B714300                DWORD 0043715B
:004379F8 5C734300                DWORD 0043735C
:004379FC 35774300                DWORD 00437735
:00437A00 3E784300                DWORD 0043783E



* Referenced by a CALL at Addresses:
|:00436618   , :004366D7   , :00436700   , :00436729   , :00436752   
|:004367C6   , :004367FE   , :00436857   , :0043688F   , :004368BD   
|:004368E6   , :0043690F   , :00436938   , :004369AC   , :004369E4   
|:00436A3D   , :00436A75   , :00436ACD   , :00436B05   , :00436B5E   
|:00436B95   , :00436BC8   , :00436BF6   , :00436C24   , :00436C52   
|:00436C7B   , :00436CA4   , :00436CCD   , :00436CF6   , :00436D3F   
|:00436D68   , :00436D91   , :00436DBA   , :00436E1E   , :00436E47   
|:00436E70   , :00436E99   , :00436F39   , :00436FE0   , :00437082   
|:004370B7   , :004370E0   , :00437109   , :00437132   , :004371DE   
|:00437215   , :0043726E   , :004372A6   , :004372D4   , :004372FD   
|:00437326   , :0043734F   , :004373DE   , :00437416   , :0043746F   
|:004374A7   , :004374FF   , :00437537   , :00437590   , :004375C7   
|:004375FA   , :00437628   , :00437656   , :00437684   , :004376AD   
|:004376D6   , :004376FF   , :00437728   , :00437785   , :004377BD   
|:004377F5   , :0043782C   , :0043788D   , :004378C5   , :004378FC   
|:00437934   , :00437C6C   , :00437CDB   , :00437D49   
|
:00437A04 55                      push ebp
:00437A05 8BEC                    mov ebp, esp
:00437A07 83EC10                  sub esp, 00000010
:00437A0A 8B4508                  mov eax, dword ptr [ebp+08]
:00437A0D 25FF000000              and eax, 000000FF
:00437A12 33C9                    xor ecx, ecx
:00437A14 8A0D2C424B00            mov cl, byte ptr [004B422C]
:00437A1A 3BC1                    cmp eax, ecx
:00437A1C 0F8DD4010000            jnl 00437BF6
:00437A22 8B550C                  mov edx, dword ptr [ebp+0C]
:00437A25 81E2FF000000            and edx, 000000FF
:00437A2B 33C0                    xor eax, eax
:00437A2D A02D424B00              mov al, byte ptr [004B422D]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004379ED(C)
|
:00437A32 3BD0                    cmp edx, eax
:00437A34 0F8DBC010000            jnl 00437BF6
:00437A3A 8B4D14                  mov ecx, dword ptr [ebp+14]
:00437A3D 81E1FF000000            and ecx, 000000FF
:00437A43 81E180000000            and ecx, 00000080
:00437A49 85C9                    test ecx, ecx
:00437A4B 756F                    jne 00437ABC
:00437A4D 6A04                    push 00000004
:00437A4F 6A00                    push 00000000
:00437A51 6A00                    push 00000000
:00437A53 B938EB4A00              mov ecx, 004AEB38
:00437A58 E8E37F0400              call 0047FA40
:00437A5D 8B5508                  mov edx, dword ptr [ebp+08]
:00437A60 81E2FF000000            and edx, 000000FF
:00437A66 8D8410C0120000          lea eax, dword ptr [eax+edx+000012C0]
:00437A6D 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00437A70 81E1FF000000            and ecx, 000000FF
:00437A76 33D2                    xor edx, edx
:00437A78 8A152C424B00            mov dl, byte ptr [004B422C]
:00437A7E 0FAFCA                  imul ecx, edx
:00437A81 8A5510                  mov dl, byte ptr [ebp+10]
:00437A84 881408                  mov byte ptr [eax+ecx], dl
:00437A87 6A04                    push 00000004
:00437A89 6A00                    push 00000000
:00437A8B 6A00                    push 00000000
:00437A8D B968AB4A00              mov ecx, 004AAB68
:00437A92 E8A97F0400              call 0047FA40
:00437A97 8B4D08                  mov ecx, dword ptr [ebp+08]
:00437A9A 81E1FF000000            and ecx, 000000FF
:00437AA0 03C1                    add eax, ecx
:00437AA2 8B550C                  mov edx, dword ptr [ebp+0C]
:00437AA5 81E2FF000000            and edx, 000000FF
:00437AAB 33C9                    xor ecx, ecx
:00437AAD 8A0D2C424B00            mov cl, byte ptr [004B422C]
:00437AB3 0FAFD1                  imul edx, ecx
:00437AB6 8A4D10                  mov cl, byte ptr [ebp+10]
:00437AB9 880C10                  mov byte ptr [eax+edx], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437A4B(C)
|
:00437ABC 8B5518                  mov edx, dword ptr [ebp+18]
:00437ABF 81E2FF000000            and edx, 000000FF
:00437AC5 85D2                    test edx, edx
:00437AC7 743B                    je 00437B04
:00437AC9 6A04                    push 00000004
:00437ACB 6A00                    push 00000000
:00437ACD 68800C0000              push 00000C80
:00437AD2 B968AB4A00              mov ecx, 004AAB68
:00437AD7 E8647F0400              call 0047FA40
:00437ADC 8B4D08                  mov ecx, dword ptr [ebp+08]
:00437ADF 81E1FF000000            and ecx, 000000FF
:00437AE5 03C1                    add eax, ecx
:00437AE7 8B550C                  mov edx, dword ptr [ebp+0C]
:00437AEA 81E2FF000000            and edx, 000000FF
:00437AF0 33C9                    xor ecx, ecx
:00437AF2 8A0D2C424B00            mov cl, byte ptr [004B422C]
:00437AF8 0FAFD1                  imul edx, ecx
:00437AFB C6041001                mov byte ptr [eax+edx], 01
:00437AFF E9F2000000              jmp 00437BF6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437AC7(C)
|
:00437B04 8A550C                  mov dl, byte ptr [ebp+0C]
:00437B07 52                      push edx
:00437B08 8A4508                  mov al, byte ptr [ebp+08]
:00437B0B 50                      push eax
:00437B0C 8D4DF8                  lea ecx, dword ptr [ebp-08]
:00437B0F E8BC11FEFF              call 00418CD0
:00437B14 8D4DF8                  lea ecx, dword ptr [ebp-08]
:00437B17 51                      push ecx
:00437B18 E867DDFFFF              call 00435884
:00437B1D 83C404                  add esp, 00000004
:00437B20 8845FC                  mov byte ptr [ebp-04], al
:00437B23 8B55FC                  mov edx, dword ptr [ebp-04]
:00437B26 81E2FF000000            and edx, 000000FF
:00437B2C 81FAFF000000            cmp edx, 000000FF
:00437B32 0F84BE000000            je 00437BF6
:00437B38 8B4D10                  mov ecx, dword ptr [ebp+10]
:00437B3B 81E1FF000000            and ecx, 000000FF
:00437B41 6BC924                  imul ecx, 00000024
:00437B44 81C1502C4B00            add ecx, 004B2C50
:00437B4A E8C1EBFCFF              call 00406710
:00437B4F 8945F4                  mov dword ptr [ebp-0C], eax
:00437B52 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00437B55 81E1FF000000            and ecx, 000000FF
:00437B5B 6BC924                  imul ecx, 00000024
:00437B5E 81C1502C4B00            add ecx, 004B2C50
:00437B64 E8A7EBFCFF              call 00406710
:00437B69 8945F0                  mov dword ptr [ebp-10], eax
:00437B6C 8B4514                  mov eax, dword ptr [ebp+14]
:00437B6F 25FF000000              and eax, 000000FF
:00437B74 83E001                  and eax, 00000001
:00437B77 85C0                    test eax, eax
:00437B79 743F                    je 00437BBA
:00437B7B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00437B7E 3B4DF0                  cmp ecx, dword ptr [ebp-10]
:00437B81 7535                    jne 00437BB8
:00437B83 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00437B86 81E1FF000000            and ecx, 000000FF
:00437B8C 6BC924                  imul ecx, 00000024
:00437B8F 81C1502C4B00            add ecx, 004B2C50
:00437B95 E8F6B00300              call 00472C90
:00437B9A 85C0                    test eax, eax
:00437B9C 761A                    jbe 00437BB8
:00437B9E 8B15342C4B00            mov edx, dword ptr [004B2C34]
:00437BA4 8A45FC                  mov al, byte ptr [ebp-04]
:00437BA7 8802                    mov byte ptr [edx], al
:00437BA9 8B0D342C4B00            mov ecx, dword ptr [004B2C34]
:00437BAF 83C101                  add ecx, 00000001
:00437BB2 890D342C4B00            mov dword ptr [004B2C34], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00437B81(C), :00437B9C(C)
|
:00437BB8 EB3C                    jmp 00437BF6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437B79(C)
|
:00437BBA 8B55F4                  mov edx, dword ptr [ebp-0C]
:00437BBD 3B55F0                  cmp edx, dword ptr [ebp-10]
:00437BC0 7434                    je 00437BF6
:00437BC2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00437BC5 81E1FF000000            and ecx, 000000FF
:00437BCB 6BC924                  imul ecx, 00000024
:00437BCE 81C1502C4B00            add ecx, 004B2C50
:00437BD4 E8B7B00300              call 00472C90
:00437BD9 85C0                    test eax, eax
:00437BDB 7619                    jbe 00437BF6
:00437BDD A1342C4B00              mov eax, dword ptr [004B2C34]
:00437BE2 8A4DFC                  mov cl, byte ptr [ebp-04]
:00437BE5 8808                    mov byte ptr [eax], cl
:00437BE7 8B15342C4B00            mov edx, dword ptr [004B2C34]
:00437BED 83C201                  add edx, 00000001
:00437BF0 8915342C4B00            mov dword ptr [004B2C34], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00437A1C(C), :00437A34(C), :00437AFF(U), :00437B32(C), :00437BB8(U)
|:00437BC0(C), :00437BDB(C)
|
:00437BF6 8BE5                    mov esp, ebp
:00437BF8 5D                      pop ebp
:00437BF9 C3                      ret



* Referenced by a CALL at Addresses:
|:00436653   , :00436673   , :00436D16   , :00436DDA   , :0043716E   
|:0043736F   
|
:00437BFA 55                      push ebp
:00437BFB 8BEC                    mov ebp, esp
:00437BFD 83EC08                  sub esp, 00000008
:00437C00 68FF000000              push 000000FF
:00437C05 68FF000000              push 000000FF
:00437C0A 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00437C0D E8BE10FEFF              call 00418CD0
:00437C12 C645F800                mov [ebp-08], 00
:00437C16 EB08                    jmp 00437C20

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437C74(U)
|
:00437C18 8A45F8                  mov al, byte ptr [ebp-08]
:00437C1B 0401                    add al, 01
:00437C1D 8845F8                  mov byte ptr [ebp-08], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437C16(U)
|
:00437C20 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00437C23 81E1FF000000            and ecx, 000000FF
:00437C29 83F904                  cmp ecx, 00000004
:00437C2C 7D48                    jge 00437C76
:00437C2E 8A55F8                  mov dl, byte ptr [ebp-08]
:00437C31 52                      push edx
:00437C32 8B4508                  mov eax, dword ptr [ebp+08]
:00437C35 50                      push eax
:00437C36 E8BADDFFFF              call 004359F5
:00437C3B 83C408                  add esp, 00000008
:00437C3E 50                      push eax
:00437C3F 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00437C42 E859E9FCFF              call 004065A0
:00437C47 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00437C4A 81E1FF000000            and ecx, 000000FF
:00437C50 81F9FF000000            cmp ecx, 000000FF
:00437C56 741C                    je 00437C74
:00437C58 8A5510                  mov dl, byte ptr [ebp+10]
:00437C5B 52                      push edx
:00437C5C 8A450C                  mov al, byte ptr [ebp+0C]
:00437C5F 50                      push eax
:00437C60 8A4D14                  mov cl, byte ptr [ebp+14]
:00437C63 51                      push ecx
:00437C64 8A55FD                  mov dl, byte ptr [ebp-03]
:00437C67 52                      push edx
:00437C68 8A45FC                  mov al, byte ptr [ebp-04]
:00437C6B 50                      push eax
:00437C6C E893FDFFFF              call 00437A04
:00437C71 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437C56(C)
|
:00437C74 EBA2                    jmp 00437C18

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437C2C(C)
|
:00437C76 8BE5                    mov esp, ebp
:00437C78 5D                      pop ebp
:00437C79 C3                      ret



* Referenced by a CALL at Addresses:
|:0043668E   , :004366AE   , :00436772   , :00436958   , :00436DF5   
|:00437189   , :0043738A   
|
:00437C7A 55                      push ebp
:00437C7B 8BEC                    mov ebp, esp
:00437C7D 51                      push ecx
:00437C7E C645FC00                mov [ebp-04], 00
:00437C82 EB08                    jmp 00437C8C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437CE3(U)
|
:00437C84 8A45FC                  mov al, byte ptr [ebp-04]
:00437C87 0401                    add al, 01
:00437C89 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437C82(U)
|
:00437C8C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00437C8F 81E1FF000000            and ecx, 000000FF
:00437C95 83F904                  cmp ecx, 00000004
:00437C98 7D4B                    jge 00437CE5
:00437C9A 8A5510                  mov dl, byte ptr [ebp+10]
:00437C9D 52                      push edx
:00437C9E 8A450C                  mov al, byte ptr [ebp+0C]
:00437CA1 50                      push eax
:00437CA2 8A4D14                  mov cl, byte ptr [ebp+14]
:00437CA5 51                      push ecx
:00437CA6 8B5508                  mov edx, dword ptr [ebp+08]
:00437CA9 33C0                    xor eax, eax
:00437CAB 8A4201                  mov al, byte ptr [edx+01]
:00437CAE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00437CB1 81E1FF000000            and ecx, 000000FF
:00437CB7 D1E1                    shl ecx, 1
:00437CB9 03048D4CDF4800          add eax, dword ptr [4*ecx+0048DF4C]
:00437CC0 50                      push eax
:00437CC1 8B5508                  mov edx, dword ptr [ebp+08]
:00437CC4 33C0                    xor eax, eax
:00437CC6 8A02                    mov al, byte ptr [edx]
:00437CC8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00437CCB 81E1FF000000            and ecx, 000000FF
:00437CD1 D1E1                    shl ecx, 1
:00437CD3 03048D48DF4800          add eax, dword ptr [4*ecx+0048DF48]
:00437CDA 50                      push eax
:00437CDB E824FDFFFF              call 00437A04
:00437CE0 83C414                  add esp, 00000014
:00437CE3 EB9F                    jmp 00437C84

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437C98(C)
|
:00437CE5 8BE5                    mov esp, ebp
:00437CE7 5D                      pop ebp
:00437CE8 C3                      ret



* Referenced by a CALL at Address:
|:0043714E   
|
:00437CE9 55                      push ebp
:00437CEA 8BEC                    mov ebp, esp
:00437CEC 83EC08                  sub esp, 00000008
:00437CEF C645F800                mov [ebp-08], 00
:00437CF3 EB08                    jmp 00437CFD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437D53(U)
|
:00437CF5 8A45F8                  mov al, byte ptr [ebp-08]
:00437CF8 0401                    add al, 01
:00437CFA 8845F8                  mov byte ptr [ebp-08], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437CF3(U)
|
:00437CFD 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00437D00 81E1FF000000            and ecx, 000000FF
:00437D06 33D2                    xor edx, edx
:00437D08 8A152D424B00            mov dl, byte ptr [004B422D]
:00437D0E 3BCA                    cmp ecx, edx
:00437D10 7D43                    jge 00437D55
:00437D12 C645FC00                mov [ebp-04], 00
:00437D16 EB08                    jmp 00437D20

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437D51(U)
|
:00437D18 8A45FC                  mov al, byte ptr [ebp-04]
:00437D1B 0401                    add al, 01
:00437D1D 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437D16(U)
|
:00437D20 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00437D23 81E1FF000000            and ecx, 000000FF
:00437D29 33D2                    xor edx, edx
:00437D2B 8A152C424B00            mov dl, byte ptr [004B422C]
:00437D31 3BCA                    cmp ecx, edx
:00437D33 7D1E                    jge 00437D53
:00437D35 8A4510                  mov al, byte ptr [ebp+10]
:00437D38 50                      push eax
:00437D39 8A4D0C                  mov cl, byte ptr [ebp+0C]
:00437D3C 51                      push ecx
:00437D3D 8A5508                  mov dl, byte ptr [ebp+08]
:00437D40 52                      push edx
:00437D41 8A45F8                  mov al, byte ptr [ebp-08]
:00437D44 50                      push eax
:00437D45 8A4DFC                  mov cl, byte ptr [ebp-04]
:00437D48 51                      push ecx
:00437D49 E8B6FCFFFF              call 00437A04
:00437D4E 83C414                  add esp, 00000014
:00437D51 EBC5                    jmp 00437D18

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437D33(C)
|
:00437D53 EBA0                    jmp 00437CF5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437D10(C)
|
:00437D55 8BE5                    mov esp, ebp
:00437D57 5D                      pop ebp
:00437D58 C3                      ret



* Referenced by a CALL at Addresses:
|:00437F6B   , :0043866D   , :0043880F   
|
:00437D59 55                      push ebp
:00437D5A 8BEC                    mov ebp, esp
:00437D5C 83EC10                  sub esp, 00000010
:00437D5F 56                      push esi
:00437D60 894DF0                  mov dword ptr [ebp-10], ecx
:00437D63 8D4DF8                  lea ecx, dword ptr [ebp-08]
:00437D66 E8A5790200              call 0045F710
:00437D6B 6A21                    push 00000021
:00437D6D 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00437D70 E8FB780200              call 0045F670
:00437D75 8BC8                    mov ecx, eax
:00437D77 6BC948                  imul ecx, 00000048
:00437D7A 81C1681B4A00            add ecx, 004A1B68
:00437D80 E884FCFCFF              call 00407A09
:00437D85 85C0                    test eax, eax
:00437D87 7407                    je 00437D90
:00437D89 33C0                    xor eax, eax
:00437D8B E997000000              jmp 00437E27

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437D87(C)
|
:00437D90 C645FC00                mov [ebp-04], 00
:00437D94 EB08                    jmp 00437D9E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437E20(U)
|
:00437D96 8A45FC                  mov al, byte ptr [ebp-04]
:00437D99 0401                    add al, 01
:00437D9B 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437D94(U)
|
:00437D9E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00437DA1 81E1FF000000            and ecx, 000000FF
:00437DA7 83F904                  cmp ecx, 00000004
:00437DAA 7D79                    jge 00437E25
:00437DAC 8A55FC                  mov dl, byte ptr [ebp-04]
:00437DAF 52                      push edx
:00437DB0 8B4508                  mov eax, dword ptr [ebp+08]
:00437DB3 50                      push eax
:00437DB4 E83CDCFFFF              call 004359F5
:00437DB9 83C408                  add esp, 00000008
:00437DBC 50                      push eax
:00437DBD 8D4DF8                  lea ecx, dword ptr [ebp-08]
:00437DC0 E8DBE7FCFF              call 004065A0
:00437DC5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00437DC8 81E1FF000000            and ecx, 000000FF
:00437DCE 81F9FF000000            cmp ecx, 000000FF
:00437DD4 744A                    je 00437E20
:00437DD6 8D55F8                  lea edx, dword ptr [ebp-08]
:00437DD9 52                      push edx
:00437DDA E8A5DAFFFF              call 00435884
:00437DDF 83C404                  add esp, 00000004
:00437DE2 8845F4                  mov byte ptr [ebp-0C], al
:00437DE5 8B45F4                  mov eax, dword ptr [ebp-0C]
:00437DE8 25FF000000              and eax, 000000FF
:00437DED 3DFF000000              cmp eax, 000000FF
:00437DF2 742C                    je 00437E20
:00437DF4 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00437DF7 81E1FF000000            and ecx, 000000FF
:00437DFD 6BC924                  imul ecx, 00000024
:00437E00 81C1502C4B00            add ecx, 004B2C50
:00437E06 E805E9FCFF              call 00406710
:00437E0B 8BF0                    mov esi, eax
:00437E0D 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00437E10 E8FBE8FCFF              call 00406710
:00437E15 3BF0                    cmp esi, eax
:00437E17 7407                    je 00437E20
:00437E19 B801000000              mov eax, 00000001
:00437E1E EB07                    jmp 00437E27

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00437DD4(C), :00437DF2(C), :00437E17(C)
|
:00437E20 E971FFFFFF              jmp 00437D96

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437DAA(C)
|
:00437E25 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00437D8B(U), :00437E1E(U)
|
:00437E27 5E                      pop esi
:00437E28 8BE5                    mov esp, ebp
:00437E2A 5D                      pop ebp
:00437E2B C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0043A917   , :0043A9BE   , :0043AF2D   , :0043AF77   , :0043B19E   
|:0043B1E8   , :0043DA0D   
|
:00437E2E 55                      push ebp
:00437E2F 8BEC                    mov ebp, esp
:00437E31 83EC50                  sub esp, 00000050
:00437E34 894DB0                  mov dword ptr [ebp-50], ecx
:00437E37 8D4DDC                  lea ecx, dword ptr [ebp-24]
:00437E3A E8D1780200              call 0045F710
:00437E3F 8D4DD8                  lea ecx, dword ptr [ebp-28]
:00437E42 E8C9780200              call 0045F710
:00437E47 C745E001000000          mov [ebp-20], 00000001
:00437E4E 6880000000              push 00000080
:00437E53 8B4DB0                  mov ecx, dword ptr [ebp-50]
:00437E56 E895DCFEFF              call 00425AF0
:00437E5B 8945F8                  mov dword ptr [ebp-08], eax
:00437E5E 8B4DB0                  mov ecx, dword ptr [ebp-50]
:00437E61 E8AAE8FCFF              call 00406710
:00437E66 8945EC                  mov dword ptr [ebp-14], eax
:00437E69 6A04                    push 00000004
:00437E6B 6A00                    push 00000000
:00437E6D 6A00                    push 00000000
:00437E6F B938EB4A00              mov ecx, 004AEB38
:00437E74 E8C77B0400              call 0047FA40
:00437E79 0500190000              add eax, 00001900
:00437E7E 8945E4                  mov dword ptr [ebp-1C], eax
:00437E81 8B4508                  mov eax, dword ptr [ebp+08]
:00437E84 50                      push eax
:00437E85 E8FAD9FFFF              call 00435884
:00437E8A 83C404                  add esp, 00000004
:00437E8D 8845F0                  mov byte ptr [ebp-10], al
:00437E90 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00437E93 51                      push ecx
:00437E94 8D4DDC                  lea ecx, dword ptr [ebp-24]
:00437E97 E804E7FCFF              call 004065A0
:00437E9C 8A5510                  mov dl, byte ptr [ebp+10]
:00437E9F 8855E8                  mov byte ptr [ebp-18], dl
:00437EA2 C745FC00000000          mov [ebp-04], 00000000
:00437EA9 EB09                    jmp 00437EB4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043806E(U)
|
:00437EAB 8B45FC                  mov eax, dword ptr [ebp-04]
:00437EAE 83C001                  add eax, 00000001
:00437EB1 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437EA9(U)
|
:00437EB4 8B4D08                  mov ecx, dword ptr [ebp+08]
:00437EB7 51                      push ecx
:00437EB8 8D55DC                  lea edx, dword ptr [ebp-24]
:00437EBB 52                      push edx
:00437EBC E85F350000              call 0043B420
:00437EC1 83C408                  add esp, 00000008
:00437EC4 85C0                    test eax, eax
:00437EC6 0F85A7010000            jne 00438073
:00437ECC 837DE000                cmp dword ptr [ebp-20], 00000000
:00437ED0 0F849D010000            je 00438073
:00437ED6 6A04                    push 00000004
:00437ED8 6A00                    push 00000000
:00437EDA 6A00                    push 00000000
:00437EDC B938EB4A00              mov ecx, 004AEB38
:00437EE1 E85A7B0400              call 0047FA40
:00437EE6 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00437EE9 81E1FF000000            and ecx, 000000FF
:00437EEF 8D9408C0120000          lea edx, dword ptr [eax+ecx+000012C0]
:00437EF6 8B45DD                  mov eax, dword ptr [ebp-23]
:00437EF9 25FF000000              and eax, 000000FF
:00437EFE 33C9                    xor ecx, ecx
:00437F00 8A0D2C424B00            mov cl, byte ptr [004B422C]
:00437F06 0FAFC1                  imul eax, ecx
:00437F09 8A1402                  mov dl, byte ptr [edx+eax]
:00437F0C 8855CC                  mov byte ptr [ebp-34], dl
:00437F0F C645D4FF                mov [ebp-2C], FF
:00437F13 8A45CC                  mov al, byte ptr [ebp-34]
:00437F16 8845C0                  mov byte ptr [ebp-40], al
:00437F19 C645C400                mov [ebp-3C], 00
:00437F1D EB09                    jmp 00437F28

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00437F8E(U), :00438024(U)
|
:00437F1F 8A4DC4                  mov cl, byte ptr [ebp-3C]
:00437F22 80C101                  add cl, 01
:00437F25 884DC4                  mov byte ptr [ebp-3C], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437F1D(U)
|
:00437F28 8B55C4                  mov edx, dword ptr [ebp-3C]
:00437F2B 81E2FF000000            and edx, 000000FF
:00437F31 83FA04                  cmp edx, 00000004
:00437F34 0F8DEF000000            jnl 00438029
:00437F3A 8A45C4                  mov al, byte ptr [ebp-3C]
:00437F3D 50                      push eax
:00437F3E 8D4DDC                  lea ecx, dword ptr [ebp-24]
:00437F41 51                      push ecx
:00437F42 E8AEDAFFFF              call 004359F5
:00437F47 83C408                  add esp, 00000008
:00437F4A 50                      push eax
:00437F4B 8D4DD8                  lea ecx, dword ptr [ebp-28]
:00437F4E E84DE6FCFF              call 004065A0
:00437F53 8B55D8                  mov edx, dword ptr [ebp-28]
:00437F56 81E2FF000000            and edx, 000000FF
:00437F5C 81FAFF000000            cmp edx, 000000FF
:00437F62 742A                    je 00437F8E
:00437F64 8D45D8                  lea eax, dword ptr [ebp-28]
:00437F67 50                      push eax
:00437F68 8B4DB0                  mov ecx, dword ptr [ebp-50]
:00437F6B E8E9FDFFFF              call 00437D59
:00437F70 85C0                    test eax, eax
:00437F72 741C                    je 00437F90
:00437F74 8B4D08                  mov ecx, dword ptr [ebp+08]
:00437F77 51                      push ecx
:00437F78 8D55D8                  lea edx, dword ptr [ebp-28]
:00437F7B 52                      push edx
:00437F7C E89F340000              call 0043B420
:00437F81 83C408                  add esp, 00000008
:00437F84 85C0                    test eax, eax
:00437F86 7508                    jne 00437F90
:00437F88 837DF800                cmp dword ptr [ebp-08], 00000000
:00437F8C 7502                    jne 00437F90

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437F62(C)
|
:00437F8E EB8F                    jmp 00437F1F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00437F72(C), :00437F86(C), :00437F8C(C)
|
:00437F90 6A04                    push 00000004
:00437F92 6A00                    push 00000000
:00437F94 6A00                    push 00000000
:00437F96 B938EB4A00              mov ecx, 004AEB38
:00437F9B E8A07A0400              call 0047FA40
:00437FA0 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00437FA3 81E1FF000000            and ecx, 000000FF
:00437FA9 8D9408C0120000          lea edx, dword ptr [eax+ecx+000012C0]
:00437FB0 8B45D9                  mov eax, dword ptr [ebp-27]
:00437FB3 25FF000000              and eax, 000000FF
:00437FB8 33C9                    xor ecx, ecx
:00437FBA 8A0D2C424B00            mov cl, byte ptr [004B422C]
:00437FC0 0FAFC1                  imul eax, ecx
:00437FC3 8A1402                  mov dl, byte ptr [edx+eax]
:00437FC6 8855C8                  mov byte ptr [ebp-38], dl
:00437FC9 8B45CC                  mov eax, dword ptr [ebp-34]
:00437FCC 25FF000000              and eax, 000000FF
:00437FD1 8B4DC8                  mov ecx, dword ptr [ebp-38]
:00437FD4 81E1FF000000            and ecx, 000000FF
:00437FDA 3BC1                    cmp eax, ecx
:00437FDC 7E46                    jle 00438024
:00437FDE 8D55D8                  lea edx, dword ptr [ebp-28]
:00437FE1 52                      push edx
:00437FE2 E8AAD9FFFF              call 00435991
:00437FE7 83C404                  add esp, 00000004
:00437FEA 8845B8                  mov byte ptr [ebp-48], al
:00437FED 8A45B8                  mov al, byte ptr [ebp-48]
:00437FF0 50                      push eax
:00437FF1 8B4DB0                  mov ecx, dword ptr [ebp-50]
:00437FF4 E8D6770000              call 0043F7CF
:00437FF9 8845BC                  mov byte ptr [ebp-44], al
:00437FFC 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00437FFF 81E1FF000000            and ecx, 000000FF
:00438005 8B55BC                  mov edx, dword ptr [ebp-44]
:00438008 81E2FF000000            and edx, 000000FF
:0043800E 3BCA                    cmp ecx, edx
:00438010 7C12                    jl 00438024
:00438012 8A45C8                  mov al, byte ptr [ebp-38]
:00438015 8845CC                  mov byte ptr [ebp-34], al
:00438018 8A4DC4                  mov cl, byte ptr [ebp-3C]
:0043801B 884DD4                  mov byte ptr [ebp-2C], cl
:0043801E 8A55BC                  mov dl, byte ptr [ebp-44]
:00438021 8855D0                  mov byte ptr [ebp-30], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00437FDC(C), :00438010(C)
|
:00438024 E9F6FEFFFF              jmp 00437F1F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00437F34(C)
|
:00438029 8B45D4                  mov eax, dword ptr [ebp-2C]
:0043802C 25FF000000              and eax, 000000FF
:00438031 3DFF000000              cmp eax, 000000FF
:00438036 742F                    je 00438067
:00438038 8A4DD4                  mov cl, byte ptr [ebp-2C]
:0043803B 51                      push ecx
:0043803C 8D55DC                  lea edx, dword ptr [ebp-24]
:0043803F 52                      push edx
:00438040 E8B0D9FFFF              call 004359F5
:00438045 83C408                  add esp, 00000008
:00438048 50                      push eax
:00438049 8D4DDC                  lea ecx, dword ptr [ebp-24]
:0043804C E84FE5FCFF              call 004065A0
:00438051 8A45E8                  mov al, byte ptr [ebp-18]
:00438054 2A45D0                  sub al, byte ptr [ebp-30]
:00438057 8845E8                  mov byte ptr [ebp-18], al
:0043805A 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043805D 034DFC                  add ecx, dword ptr [ebp-04]
:00438060 8A55D4                  mov dl, byte ptr [ebp-2C]
:00438063 8811                    mov byte ptr [ecx], dl
:00438065 EB07                    jmp 0043806E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438036(C)
|
:00438067 C745E000000000          mov [ebp-20], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438065(U)
|
:0043806E E938FEFFFF              jmp 00437EAB

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00437EC6(C), :00437ED0(C)
|
:00438073 837DE000                cmp dword ptr [ebp-20], 00000000
:00438077 7551                    jne 004380CA
:00438079 8B4514                  mov eax, dword ptr [ebp+14]
:0043807C 25FF000000              and eax, 000000FF
:00438081 83F801                  cmp eax, 00000001
:00438084 7544                    jne 004380CA
:00438086 8D4DDC                  lea ecx, dword ptr [ebp-24]
:00438089 51                      push ecx
:0043808A E8F5D7FFFF              call 00435884
:0043808F 83C404                  add esp, 00000004
:00438092 25FF000000              and eax, 000000FF
:00438097 3DFF000000              cmp eax, 000000FF
:0043809C 7417                    je 004380B5
:0043809E 8B55B0                  mov edx, dword ptr [ebp-50]
:004380A1 8A4204                  mov al, byte ptr [edx+04]
:004380A4 50                      push eax
:004380A5 6A14                    push 00000014
:004380A7 8D4DDC                  lea ecx, dword ptr [ebp-24]
:004380AA 51                      push ecx
:004380AB E8C8000000              call 00438178
:004380B0 83C40C                  add esp, 0000000C
:004380B3 EB15                    jmp 004380CA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043809C(C)
|
:004380B5 8B55B0                  mov edx, dword ptr [ebp-50]
:004380B8 8A4204                  mov al, byte ptr [edx+04]
:004380BB 50                      push eax
:004380BC 6A0A                    push 0000000A
:004380BE 8D4DDC                  lea ecx, dword ptr [ebp-24]
:004380C1 51                      push ecx
:004380C2 E8B1000000              call 00438178
:004380C7 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00438077(C), :00438084(C), :004380B3(U)
|
:004380CA 8B55FC                  mov edx, dword ptr [ebp-04]
:004380CD 83EA01                  sub edx, 00000001
:004380D0 8955FC                  mov dword ptr [ebp-04], edx
:004380D3 837DFC00                cmp dword ptr [ebp-04], 00000000
:004380D7 0F8C8C000000            jl 00438169
:004380DD C645B400                mov [ebp-4C], 00
:004380E1 EB11                    jmp 004380F4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438162(U)
|
:004380E3 8A45B4                  mov al, byte ptr [ebp-4C]
:004380E6 0401                    add al, 01
:004380E8 8845B4                  mov byte ptr [ebp-4C], al
:004380EB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004380EE 83E901                  sub ecx, 00000001
:004380F1 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004380E1(U)
|
:004380F4 837DFC00                cmp dword ptr [ebp-04], 00000000
:004380F8 7C6D                    jl 00438167
:004380FA 8B55B4                  mov edx, dword ptr [ebp-4C]
:004380FD 81E2FF000000            and edx, 000000FF
:00438103 3B55FC                  cmp edx, dword ptr [ebp-04]
:00438106 7F5F                    jg 00438167
:00438108 8B45B4                  mov eax, dword ptr [ebp-4C]
:0043810B 25FF000000              and eax, 000000FF
:00438110 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00438113 8A1401                  mov dl, byte ptr [ecx+eax]
:00438116 8855F4                  mov byte ptr [ebp-0C], dl
:00438119 8B45E4                  mov eax, dword ptr [ebp-1C]
:0043811C 0345FC                  add eax, dword ptr [ebp-04]
:0043811F 33C9                    xor ecx, ecx
:00438121 8A08                    mov cl, byte ptr [eax]
:00438123 8BC1                    mov eax, ecx
:00438125 83C002                  add eax, 00000002
:00438128 99                      cdq
:00438129 33C2                    xor eax, edx
:0043812B 2BC2                    sub eax, edx
:0043812D 83E003                  and eax, 00000003
:00438130 33C2                    xor eax, edx
:00438132 2BC2                    sub eax, edx
:00438134 8B55B4                  mov edx, dword ptr [ebp-4C]
:00438137 81E2FF000000            and edx, 000000FF
:0043813D 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00438140 880411                  mov byte ptr [ecx+edx], al
:00438143 8B45F4                  mov eax, dword ptr [ebp-0C]
:00438146 25FF000000              and eax, 000000FF
:0043814B 83C002                  add eax, 00000002
:0043814E 99                      cdq
:0043814F 33C2                    xor eax, edx
:00438151 2BC2                    sub eax, edx
:00438153 83E003                  and eax, 00000003
:00438156 33C2                    xor eax, edx
:00438158 2BC2                    sub eax, edx
:0043815A 8B55E4                  mov edx, dword ptr [ebp-1C]
:0043815D 0355FC                  add edx, dword ptr [ebp-04]
:00438160 8802                    mov byte ptr [edx], al
:00438162 E97CFFFFFF              jmp 004380E3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004380F8(C), :00438106(C)
|
:00438167 EB06                    jmp 0043816F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004380D7(C)
|
:00438169 8B45E4                  mov eax, dword ptr [ebp-1C]
:0043816C C600FF                  mov byte ptr [eax], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438167(U)
|
:0043816F 8B45E4                  mov eax, dword ptr [ebp-1C]
:00438172 8BE5                    mov esp, ebp
:00438174 5D                      pop ebp
:00438175 C21000                  ret 0010



* Referenced by a CALL at Addresses:
|:004380AB   , :004380C2   , :004382E1   , :004382FA   , :0043AEB5   
|:0043B0EB   , :0043B126   
|
:00438178 55                      push ebp
:00438179 8BEC                    mov ebp, esp
:0043817B 83EC10                  sub esp, 00000010
:0043817E 837D0C09                cmp dword ptr [ebp+0C], 00000009
:00438182 0F8C7C010000            jl 00438304
:00438188 8B4508                  mov eax, dword ptr [ebp+08]
:0043818B 50                      push eax
:0043818C E800D8FFFF              call 00435991
:00438191 83C404                  add esp, 00000004
:00438194 8845F8                  mov byte ptr [ebp-08], al
:00438197 6A04                    push 00000004
:00438199 6A00                    push 00000000
:0043819B 6840060000              push 00000640
:004381A0 B968AB4A00              mov ecx, 004AAB68
:004381A5 E896780400              call 0047FA40
:004381AA 8B4D08                  mov ecx, dword ptr [ebp+08]
:004381AD 33D2                    xor edx, edx
:004381AF 8A11                    mov dl, byte ptr [ecx]
:004381B1 03C2                    add eax, edx
:004381B3 8B4D08                  mov ecx, dword ptr [ebp+08]
:004381B6 33D2                    xor edx, edx
:004381B8 8A5101                  mov dl, byte ptr [ecx+01]
:004381BB 33C9                    xor ecx, ecx
:004381BD 8A0D2C424B00            mov cl, byte ptr [004B422C]
:004381C3 0FAFD1                  imul edx, ecx
:004381C6 03C2                    add eax, edx
:004381C8 8945FC                  mov dword ptr [ebp-04], eax
:004381CB 8B4D10                  mov ecx, dword ptr [ebp+10]
:004381CE 81E1FF000000            and ecx, 000000FF
:004381D4 6BC924                  imul ecx, 00000024
:004381D7 81C1502C4B00            add ecx, 004B2C50
:004381DD E86B760000              call 0043F84D
:004381E2 25FF000000              and eax, 000000FF
:004381E7 3DFF000000              cmp eax, 000000FF
:004381EC 7458                    je 00438246
:004381EE 8B55FC                  mov edx, dword ptr [ebp-04]
:004381F1 33C0                    xor eax, eax
:004381F3 8A02                    mov al, byte ptr [edx]
:004381F5 85C0                    test eax, eax
:004381F7 754D                    jne 00438246
:004381F9 8B4D08                  mov ecx, dword ptr [ebp+08]
:004381FC 51                      push ecx
:004381FD E882D6FFFF              call 00435884
:00438202 83C404                  add esp, 00000004
:00438205 25FF000000              and eax, 000000FF
:0043820A 3DFF000000              cmp eax, 000000FF
:0043820F 7428                    je 00438239
:00438211 8B4D10                  mov ecx, dword ptr [ebp+10]
:00438214 81E1FF000000            and ecx, 000000FF
:0043821A 6BC924                  imul ecx, 00000024
:0043821D 81C1502C4B00            add ecx, 004B2C50
:00438223 E838B1FCFF              call 00403360
:00438228 50                      push eax
:00438229 8B5508                  mov edx, dword ptr [ebp+08]
:0043822C 52                      push edx
:0043822D E8EE310000              call 0043B420
:00438232 83C408                  add esp, 00000008
:00438235 85C0                    test eax, eax
:00438237 740D                    je 00438246

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043820F(C)
|
:00438239 8B45FC                  mov eax, dword ptr [ebp-04]
:0043823C 8A08                    mov cl, byte ptr [eax]
:0043823E 024D0C                  add cl, byte ptr [ebp+0C]
:00438241 8B55FC                  mov edx, dword ptr [ebp-04]
:00438244 880A                    mov byte ptr [edx], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004381EC(C), :004381F7(C), :00438237(C)
|
:00438246 8B4D10                  mov ecx, dword ptr [ebp+10]
:00438249 81E1FF000000            and ecx, 000000FF
:0043824F 6BC924                  imul ecx, 00000024
:00438252 81C1502C4B00            add ecx, 004B2C50
:00438258 E8135DFEFF              call 0041DF70
:0043825D 25FF000000              and eax, 000000FF
:00438262 83F80F                  cmp eax, 0000000F
:00438265 7C21                    jl 00438288
:00438267 8B4D10                  mov ecx, dword ptr [ebp+10]
:0043826A 81E1FF000000            and ecx, 000000FF
:00438270 6BC924                  imul ecx, 00000024
:00438273 81C1502C4B00            add ecx, 004B2C50
:00438279 E8F25CFEFF              call 0041DF70
:0043827E 25FF000000              and eax, 000000FF
:00438283 83F810                  cmp eax, 00000010
:00438286 7E7C                    jle 00438304

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438265(C)
|
:00438288 C645F400                mov [ebp-0C], 00
:0043828C EB08                    jmp 00438296

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438302(U)
|
:0043828E 8A45F4                  mov al, byte ptr [ebp-0C]
:00438291 0401                    add al, 01
:00438293 8845F4                  mov byte ptr [ebp-0C], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043828C(U)
|
:00438296 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00438299 81E1FF000000            and ecx, 000000FF
:0043829F 83F904                  cmp ecx, 00000004
:004382A2 7D60                    jge 00438304
:004382A4 8A55F4                  mov dl, byte ptr [ebp-0C]
:004382A7 52                      push edx
:004382A8 8B4508                  mov eax, dword ptr [ebp+08]
:004382AB 50                      push eax
:004382AC E844D7FFFF              call 004359F5
:004382B1 83C408                  add esp, 00000008
:004382B4 668B08                  mov cx, word ptr [eax]
:004382B7 66894DF0                mov word ptr [ebp-10], cx
:004382BB 8B55F0                  mov edx, dword ptr [ebp-10]
:004382BE 81E2FF000000            and edx, 000000FF
:004382C4 81FAFF000000            cmp edx, 000000FF
:004382CA 7436                    je 00438302
:004382CC 837D0C0A                cmp dword ptr [ebp+0C], 0000000A
:004382D0 7E19                    jle 004382EB
:004382D2 8A4510                  mov al, byte ptr [ebp+10]
:004382D5 50                      push eax
:004382D6 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004382D9 83E90A                  sub ecx, 0000000A
:004382DC 51                      push ecx
:004382DD 8D55F0                  lea edx, dword ptr [ebp-10]
:004382E0 52                      push edx
:004382E1 E892FEFFFF              call 00438178
:004382E6 83C40C                  add esp, 0000000C
:004382E9 EB17                    jmp 00438302

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004382D0(C)
|
:004382EB 8A4510                  mov al, byte ptr [ebp+10]
:004382EE 50                      push eax
:004382EF 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004382F2 83E901                  sub ecx, 00000001
:004382F5 51                      push ecx
:004382F6 8D55F0                  lea edx, dword ptr [ebp-10]
:004382F9 52                      push edx
:004382FA E879FEFFFF              call 00438178
:004382FF 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004382CA(C), :004382E9(U)
|
:00438302 EB8A                    jmp 0043828E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00438182(C), :00438286(C), :004382A2(C)
|
:00438304 8BE5                    mov esp, ebp
:00438306 5D                      pop ebp
:00438307 C3                      ret



* Referenced by a CALL at Addresses:
|:00433A13   , :00433CF8   , :00433FD1   , :0043A7EE   , :0043A82D   
|:0043A854   , :0043A8AF   , :0043A8DC   , :0043A938   , :0043AEDB   
|:0043AF08   , :0043AF4E   , :0043AF98   , :0043B0B2   , :0043B10F   
|:0043B14C   , :0043B179   , :0043B1BF   , :0043B209   , :0043B22E   
|:0043B258   , :0043B2CA   , :0043B2FF   , :0043B341   , :0043D603   
|
:00438308 55                      push ebp
:00438309 8BEC                    mov ebp, esp
:0043830B 83EC68                  sub esp, 00000068
:0043830E 53                      push ebx
:0043830F 56                      push esi
:00438310 894D98                  mov dword ptr [ebp-68], ecx
:00438313 6A04                    push 00000004
:00438315 6A00                    push 00000000
:00438317 6A00                    push 00000000
:00438319 B938EB4A00              mov ecx, 004AEB38
:0043831E E81D770400              call 0047FA40
:00438323 05C0120000              add eax, 000012C0
:00438328 8945B4                  mov dword ptr [ebp-4C], eax
:0043832B 8D4DC4                  lea ecx, dword ptr [ebp-3C]
:0043832E E8DD730200              call 0045F710
:00438333 8D4DB8                  lea ecx, dword ptr [ebp-48]
:00438336 E8D5730200              call 0045F710
:0043833B 8A4518                  mov al, byte ptr [ebp+18]
:0043833E 50                      push eax
:0043833F 8A4D14                  mov cl, byte ptr [ebp+14]
:00438342 51                      push ecx
:00438343 8D4DEC                  lea ecx, dword ptr [ebp-14]
:00438346 E88509FEFF              call 00418CD0
:0043834B 8B4D98                  mov ecx, dword ptr [ebp-68]
:0043834E E8BDE3FCFF              call 00406710
:00438353 8845C0                  mov byte ptr [ebp-40], al
:00438356 C645BCFF                mov [ebp-44], FF
:0043835A C645FCFF                mov [ebp-04], FF
:0043835E C645F0FF                mov [ebp-10], FF
:00438362 C745E801000000          mov [ebp-18], 00000001
:00438369 6880000000              push 00000080
:0043836E 8B4D98                  mov ecx, dword ptr [ebp-68]
:00438371 E87AD7FEFF              call 00425AF0
:00438376 8945F4                  mov dword ptr [ebp-0C], eax
:00438379 8D55EC                  lea edx, dword ptr [ebp-14]
:0043837C 52                      push edx
:0043837D 8B4508                  mov eax, dword ptr [ebp+08]
:00438380 50                      push eax
:00438381 E89A300000              call 0043B420
:00438386 83C408                  add esp, 00000008
:00438389 85C0                    test eax, eax
:0043838B 7407                    je 00438394
:0043838D 0CFF                    or al, FF
:0043838F E9C9050000              jmp 0043895D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043838B(C)
|
:00438394 68FF000000              push 000000FF
:00438399 33C9                    xor ecx, ecx
:0043839B 8A0D2C424B00            mov cl, byte ptr [004B422C]
:004383A1 33D2                    xor edx, edx
:004383A3 8A152D424B00            mov dl, byte ptr [004B422D]
:004383A9 0FAFCA                  imul ecx, edx
:004383AC 51                      push ecx
:004383AD 8B45B4                  mov eax, dword ptr [ebp-4C]
:004383B0 50                      push eax
:004383B1 E85D790400              call 0047FD13
:004383B6 83C40C                  add esp, 0000000C
:004383B9 6A04                    push 00000004
:004383BB 6A00                    push 00000000
:004383BD 6A00                    push 00000000
:004383BF B938EB4A00              mov ecx, 004AEB38
:004383C4 E877760400              call 0047FA40
:004383C9 C68000190000FF          mov byte ptr [eax+00001900], FF
:004383D0 8B4D08                  mov ecx, dword ptr [ebp+08]
:004383D3 33D2                    xor edx, edx
:004383D5 8A11                    mov dl, byte ptr [ecx]
:004383D7 8B45B4                  mov eax, dword ptr [ebp-4C]
:004383DA 03C2                    add eax, edx
:004383DC 8B4D08                  mov ecx, dword ptr [ebp+08]
:004383DF 33D2                    xor edx, edx
:004383E1 8A5101                  mov dl, byte ptr [ecx+01]
:004383E4 33C9                    xor ecx, ecx
:004383E6 8A0D2C424B00            mov cl, byte ptr [004B422C]
:004383EC 0FAFD1                  imul edx, ecx
:004383EF C6041000                mov byte ptr [eax+edx], 00
:004383F3 8B5510                  mov edx, dword ptr [ebp+10]
:004383F6 81E2FF000000            and edx, 000000FF
:004383FC 83E204                  and edx, 00000004
:004383FF 85D2                    test edx, edx
:00438401 0F8412010000            je 00438519
:00438407 C6054C2C4B0000          mov byte ptr [004B2C4C], 00
:0043840E C605282C4B00FF          mov byte ptr [004B2C28], FF
:00438415 C605202C4B00FF          mov byte ptr [004B2C20], FF
:0043841C C605442C4B00FF          mov byte ptr [004B2C44], FF
:00438423 8B4598                  mov eax, dword ptr [ebp-68]
:00438426 8B08                    mov ecx, dword ptr [eax]
:00438428 6BC948                  imul ecx, 00000048
:0043842B 81C1681B4A00            add ecx, 004A1B68
:00438431 894DA8                  mov dword ptr [ebp-58], ecx
:00438434 C745B0ACC74A00          mov [ebp-50], 004AC7AC
:0043843B C645AC00                mov [ebp-54], 00
:0043843F EB09                    jmp 0043844A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004384FC(U)
|
:00438441 8A55AC                  mov dl, byte ptr [ebp-54]
:00438444 80C201                  add dl, 01
:00438447 8855AC                  mov byte ptr [ebp-54], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043843F(U)
|
:0043844A 8B45AC                  mov eax, dword ptr [ebp-54]
:0043844D 25FF000000              and eax, 000000FF
:00438452 83F844                  cmp eax, 00000044
:00438455 0F8DA6000000            jnl 00438501
:0043845B 8B4DA8                  mov ecx, dword ptr [ebp-58]
:0043845E E8ADE1FCFF              call 00406610
:00438463 25FF000000              and eax, 000000FF
:00438468 50                      push eax
:00438469 8B4DAC                  mov ecx, dword ptr [ebp-54]
:0043846C 81E1FF000000            and ecx, 000000FF
:00438472 6BC946                  imul ecx, 00000046
:00438475 81C1C0F44A00            add ecx, 004AF4C0
:0043847B E80011FDFF              call 00409580
:00438480 25FF000000              and eax, 000000FF
:00438485 85C0                    test eax, eax
:00438487 7473                    je 004384FC
:00438489 8B4DA8                  mov ecx, dword ptr [ebp-58]
:0043848C E87FE1FCFF              call 00406610
:00438491 25FF000000              and eax, 000000FF
:00438496 50                      push eax
:00438497 8B4DAC                  mov ecx, dword ptr [ebp-54]
:0043849A 81E1FF000000            and ecx, 000000FF
:004384A0 6BC946                  imul ecx, 00000046
:004384A3 81C1C0F44A00            add ecx, 004AF4C0
:004384A9 E8D210FDFF              call 00409580
:004384AE 8AD8                    mov bl, al
:004384B0 81E3FF000000            and ebx, 000000FF
:004384B6 8B4DA8                  mov ecx, dword ptr [ebp-58]
:004384B9 E812E1FCFF              call 004065D0
:004384BE 25FF000000              and eax, 000000FF
:004384C3 3BD8                    cmp ebx, eax
:004384C5 7F35                    jg 004384FC
:004384C7 8B4DAC                  mov ecx, dword ptr [ebp-54]
:004384CA 81E1FF000000            and ecx, 000000FF
:004384D0 6BC946                  imul ecx, 00000046
:004384D3 81C1C0F44A00            add ecx, 004AF4C0
:004384D9 E8F2D5FEFF              call 00425AD0
:004384DE 25FF000000              and eax, 000000FF
:004384E3 8B4D98                  mov ecx, dword ptr [ebp-68]
:004384E6 394114                  cmp dword ptr [ecx+14], eax
:004384E9 7211                    jb 004384FC
:004384EB 8B55B0                  mov edx, dword ptr [ebp-50]
:004384EE 8A45AC                  mov al, byte ptr [ebp-54]
:004384F1 8802                    mov byte ptr [edx], al
:004384F3 8B4DB0                  mov ecx, dword ptr [ebp-50]
:004384F6 83C101                  add ecx, 00000001
:004384F9 894DB0                  mov dword ptr [ebp-50], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00438487(C), :004384C5(C), :004384E9(C)
|
:004384FC E940FFFFFF              jmp 00438441

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438455(C)
|
:00438501 8B55B0                  mov edx, dword ptr [ebp-50]
:00438504 C602FF                  mov byte ptr [edx], FF
:00438507 837DF400                cmp dword ptr [ebp-0C], 00000000
:0043850B 750C                    jne 00438519
:0043850D 8B4508                  mov eax, dword ptr [ebp+08]
:00438510 50                      push eax
:00438511 8B4D98                  mov ecx, dword ptr [ebp-68]
:00438514 E810200000              call 0043A529

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00438401(C), :0043850B(C)
|
:00438519 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043851C 51                      push ecx
:0043851D E86FD4FFFF              call 00435991
:00438522 83C404                  add esp, 00000004
:00438525 8845C8                  mov byte ptr [ebp-38], al
:00438528 8A55C8                  mov dl, byte ptr [ebp-38]
:0043852B 52                      push edx
:0043852C 8B4D98                  mov ecx, dword ptr [ebp-68]
:0043852F E89B720000              call 0043F7CF
:00438534 25FF000000              and eax, 000000FF
:00438539 3DFF000000              cmp eax, 000000FF
:0043853E 7507                    jne 00438547
:00438540 0CFF                    or al, FF
:00438542 E916040000              jmp 0043895D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043853E(C)
|
:00438547 C645E000                mov [ebp-20], 00
:0043854B EB06                    jmp 00438553

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438956(U)
|
:0043854D 8A45BC                  mov al, byte ptr [ebp-44]
:00438550 8845E0                  mov byte ptr [ebp-20], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043854B(U)
|
:00438553 837DE800                cmp dword ptr [ebp-18], 00000000
:00438557 0F84FE030000            je 0043895B
:0043855D 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00438560 81E1FF000000            and ecx, 000000FF
:00438566 8B550C                  mov edx, dword ptr [ebp+0C]
:00438569 81E2FF000000            and edx, 000000FF
:0043856F 3BCA                    cmp ecx, edx
:00438571 0F8DE4030000            jnl 0043895B
:00438577 C745E800000000          mov [ebp-18], 00000000
:0043857E C645BCFF                mov [ebp-44], FF
:00438582 C645FCFF                mov [ebp-04], FF
:00438586 C745D000000000          mov [ebp-30], 00000000
:0043858D EB09                    jmp 00438598

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438951(U)
|
:0043858F 8B45D0                  mov eax, dword ptr [ebp-30]
:00438592 83C001                  add eax, 00000001
:00438595 8945D0                  mov dword ptr [ebp-30], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043858D(U)
|
:00438598 33C9                    xor ecx, ecx
:0043859A 8A0D2D424B00            mov cl, byte ptr [004B422D]
:004385A0 394DD0                  cmp dword ptr [ebp-30], ecx
:004385A3 0F83AD030000            jnb 00438956
:004385A9 C745DC00000000          mov [ebp-24], 00000000
:004385B0 EB09                    jmp 004385BB

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043863B(U), :00438676(U), :0043890B(U)
|
:004385B2 8B55DC                  mov edx, dword ptr [ebp-24]
:004385B5 83C201                  add edx, 00000001
:004385B8 8955DC                  mov dword ptr [ebp-24], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004385B0(U)
|
:004385BB 33C0                    xor eax, eax
:004385BD A02C424B00              mov al, byte ptr [004B422C]
:004385C2 3945DC                  cmp dword ptr [ebp-24], eax
:004385C5 0F8345030000            jnb 00438910
:004385CB 8B4DB4                  mov ecx, dword ptr [ebp-4C]
:004385CE 034DDC                  add ecx, dword ptr [ebp-24]
:004385D1 33D2                    xor edx, edx
:004385D3 8A152C424B00            mov dl, byte ptr [004B422C]
:004385D9 8B45D0                  mov eax, dword ptr [ebp-30]
:004385DC 0FAFC2                  imul eax, edx
:004385DF 8A0C01                  mov cl, byte ptr [ecx+eax]
:004385E2 884DA4                  mov byte ptr [ebp-5C], cl
:004385E5 8B55A4                  mov edx, dword ptr [ebp-5C]
:004385E8 81E2FF000000            and edx, 000000FF
:004385EE 8B45E0                  mov eax, dword ptr [ebp-20]
:004385F1 25FF000000              and eax, 000000FF
:004385F6 3BD0                    cmp edx, eax
:004385F8 7E2C                    jle 00438626
:004385FA 8B4DA4                  mov ecx, dword ptr [ebp-5C]
:004385FD 81E1FF000000            and ecx, 000000FF
:00438603 81F9FF000000            cmp ecx, 000000FF
:00438609 741B                    je 00438626
:0043860B 8B55FC                  mov edx, dword ptr [ebp-04]
:0043860E 81E2FF000000            and edx, 000000FF
:00438614 8B45A4                  mov eax, dword ptr [ebp-5C]
:00438617 25FF000000              and eax, 000000FF
:0043861C 3BD0                    cmp edx, eax
:0043861E 7E06                    jle 00438626
:00438620 8A4DA4                  mov cl, byte ptr [ebp-5C]
:00438623 884DFC                  mov byte ptr [ebp-04], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004385F8(C), :00438609(C), :0043861E(C)
|
:00438626 8B55A4                  mov edx, dword ptr [ebp-5C]
:00438629 81E2FF000000            and edx, 000000FF
:0043862F 8B45E0                  mov eax, dword ptr [ebp-20]
:00438632 25FF000000              and eax, 000000FF
:00438637 3BD0                    cmp edx, eax
:00438639 7405                    je 00438640
:0043863B E972FFFFFF              jmp 004385B2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438639(C)
|
:00438640 8A4DDC                  mov cl, byte ptr [ebp-24]
:00438643 884DC4                  mov byte ptr [ebp-3C], cl
:00438646 8A55D0                  mov dl, byte ptr [ebp-30]
:00438649 8855C5                  mov byte ptr [ebp-3B], dl
:0043864C 8D45C4                  lea eax, dword ptr [ebp-3C]
:0043864F 50                      push eax
:00438650 8B4D08                  mov ecx, dword ptr [ebp+08]
:00438653 51                      push ecx
:00438654 E8C72D0000              call 0043B420
:00438659 83C408                  add esp, 00000008
:0043865C 85C0                    test eax, eax
:0043865E 751B                    jne 0043867B
:00438660 837D1C00                cmp dword ptr [ebp+1C], 00000000
:00438664 7415                    je 0043867B
:00438666 8D55C4                  lea edx, dword ptr [ebp-3C]
:00438669 52                      push edx
:0043866A 8B4D98                  mov ecx, dword ptr [ebp-68]
:0043866D E8E7F6FFFF              call 00437D59
:00438672 85C0                    test eax, eax
:00438674 7405                    je 0043867B
:00438676 E937FFFFFF              jmp 004385B2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043865E(C), :00438664(C), :00438674(C)
|
:0043867B C745CC00000000          mov [ebp-34], 00000000
:00438682 EB09                    jmp 0043868D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004386BF(U), :004387C5(U), :00438906(U)
|
:00438684 8B45CC                  mov eax, dword ptr [ebp-34]
:00438687 83C001                  add eax, 00000001
:0043868A 8945CC                  mov dword ptr [ebp-34], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438682(U)
|
:0043868D 837DCC04                cmp dword ptr [ebp-34], 00000004
:00438691 0F8374020000            jnb 0043890B
:00438697 8A4DCC                  mov cl, byte ptr [ebp-34]
:0043869A 51                      push ecx
:0043869B 8D55C4                  lea edx, dword ptr [ebp-3C]
:0043869E 52                      push edx
:0043869F E851D3FFFF              call 004359F5
:004386A4 83C408                  add esp, 00000008
:004386A7 50                      push eax
:004386A8 8D4DB8                  lea ecx, dword ptr [ebp-48]
:004386AB E8F0DEFCFF              call 004065A0
:004386B0 8B45B8                  mov eax, dword ptr [ebp-48]
:004386B3 25FF000000              and eax, 000000FF
:004386B8 3DFF000000              cmp eax, 000000FF
:004386BD 7502                    jne 004386C1
:004386BF EBC3                    jmp 00438684

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004386BD(C)
|
:004386C1 8B4DB8                  mov ecx, dword ptr [ebp-48]
:004386C4 81E1FF000000            and ecx, 000000FF
:004386CA 8B55B9                  mov edx, dword ptr [ebp-47]
:004386CD 81E2FF000000            and edx, 000000FF
:004386D3 33C0                    xor eax, eax
:004386D5 A02C424B00              mov al, byte ptr [004B422C]
:004386DA 0FAFD0                  imul edx, eax
:004386DD 03CA                    add ecx, edx
:004386DF 894DE4                  mov dword ptr [ebp-1C], ecx
:004386E2 8B4DB4                  mov ecx, dword ptr [ebp-4C]
:004386E5 034DE4                  add ecx, dword ptr [ebp-1C]
:004386E8 894DD4                  mov dword ptr [ebp-2C], ecx
:004386EB 6A04                    push 00000004
:004386ED 6A00                    push 00000000
:004386EF 6A00                    push 00000000
:004386F1 B938EB4A00              mov ecx, 004AEB38
:004386F6 E845730400              call 0047FA40
:004386FB 8B55E4                  mov edx, dword ptr [ebp-1C]
:004386FE 8D8410800C0000          lea eax, dword ptr [eax+edx+00000C80]
:00438705 8945D8                  mov dword ptr [ebp-28], eax
:00438708 6A04                    push 00000004
:0043870A 6A00                    push 00000000
:0043870C 6A00                    push 00000000
:0043870E B968AB4A00              mov ecx, 004AAB68
:00438713 E828730400              call 0047FA40
:00438718 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043871B 8D940840060000          lea edx, dword ptr [eax+ecx+00000640]
:00438722 8955F8                  mov dword ptr [ebp-08], edx
:00438725 8B45D4                  mov eax, dword ptr [ebp-2C]
:00438728 33C9                    xor ecx, ecx
:0043872A 8A08                    mov cl, byte ptr [eax]
:0043872C 81F9FF000000            cmp ecx, 000000FF
:00438732 0F85CE010000            jne 00438906
:00438738 8D55B8                  lea edx, dword ptr [ebp-48]
:0043873B 52                      push edx
:0043873C E850D2FFFF              call 00435991
:00438741 83C404                  add esp, 00000004
:00438744 88459C                  mov byte ptr [ebp-64], al
:00438747 8A459C                  mov al, byte ptr [ebp-64]
:0043874A 50                      push eax
:0043874B 8B4D98                  mov ecx, dword ptr [ebp-68]
:0043874E E87C700000              call 0043F7CF
:00438753 8845A0                  mov byte ptr [ebp-60], al
:00438756 8B4DA0                  mov ecx, dword ptr [ebp-60]
:00438759 81E1FF000000            and ecx, 000000FF
:0043875F 81F9FF000000            cmp ecx, 000000FF
:00438765 745E                    je 004387C5
:00438767 8B55A0                  mov edx, dword ptr [ebp-60]
:0043876A 81E2FF000000            and edx, 000000FF
:00438770 8B45A4                  mov eax, dword ptr [ebp-5C]
:00438773 25FF000000              and eax, 000000FF
:00438778 03D0                    add edx, eax
:0043877A 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0043877D 81E1FF000000            and ecx, 000000FF
:00438783 3BD1                    cmp edx, ecx
:00438785 7F3E                    jg 004387C5
:00438787 8B55D8                  mov edx, dword ptr [ebp-28]
:0043878A 33C0                    xor eax, eax
:0043878C 8A02                    mov al, byte ptr [edx]
:0043878E 3DFF000000              cmp eax, 000000FF
:00438793 7435                    je 004387CA
:00438795 8B75C0                  mov esi, dword ptr [ebp-40]
:00438798 81E6FF000000            and esi, 000000FF
:0043879E 8B4DD8                  mov ecx, dword ptr [ebp-28]
:004387A1 33D2                    xor edx, edx
:004387A3 8A11                    mov dl, byte ptr [ecx]
:004387A5 8BCA                    mov ecx, edx
:004387A7 6BC924                  imul ecx, 00000024
:004387AA 81C1502C4B00            add ecx, 004B2C50
:004387B0 E85BDFFCFF              call 00406710
:004387B5 3BF0                    cmp esi, eax
:004387B7 7411                    je 004387CA
:004387B9 837D1C00                cmp dword ptr [ebp+1C], 00000000
:004387BD 7506                    jne 004387C5
:004387BF 837DF400                cmp dword ptr [ebp-0C], 00000000
:004387C3 7505                    jne 004387CA

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00438765(C), :00438785(C), :004387BD(C)
|
:004387C5 E9BAFEFFFF              jmp 00438684

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00438793(C), :004387B7(C), :004387C3(C)
|
:004387CA 8B45A4                  mov eax, dword ptr [ebp-5C]
:004387CD 25FF000000              and eax, 000000FF
:004387D2 8B4DA0                  mov ecx, dword ptr [ebp-60]
:004387D5 81E1FF000000            and ecx, 000000FF
:004387DB 03C1                    add eax, ecx
:004387DD 8B55D4                  mov edx, dword ptr [ebp-2C]
:004387E0 8802                    mov byte ptr [edx], al
:004387E2 C745E801000000          mov [ebp-18], 00000001
:004387E9 8B45BC                  mov eax, dword ptr [ebp-44]
:004387EC 25FF000000              and eax, 000000FF
:004387F1 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:004387F4 33D2                    xor edx, edx
:004387F6 8A11                    mov dl, byte ptr [ecx]
:004387F8 3BC2                    cmp eax, edx
:004387FA 7E49                    jle 00438845
:004387FC 837D1C00                cmp dword ptr [ebp+1C], 00000000
:00438800 743B                    je 0043883D
:00438802 837DF400                cmp dword ptr [ebp-0C], 00000000
:00438806 7535                    jne 0043883D
:00438808 8D45B8                  lea eax, dword ptr [ebp-48]
:0043880B 50                      push eax
:0043880C 8B4D98                  mov ecx, dword ptr [ebp-68]
:0043880F E845F5FFFF              call 00437D59
:00438814 85C0                    test eax, eax
:00438816 7523                    jne 0043883B
:00438818 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0043881B 8A11                    mov dl, byte ptr [ecx]
:0043881D 8855BC                  mov byte ptr [ebp-44], dl
:00438820 8B45BC                  mov eax, dword ptr [ebp-44]
:00438823 25FF000000              and eax, 000000FF
:00438828 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043882B 81E1FF000000            and ecx, 000000FF
:00438831 3BC1                    cmp eax, ecx
:00438833 7E06                    jle 0043883B
:00438835 8A55FC                  mov dl, byte ptr [ebp-04]
:00438838 8855BC                  mov byte ptr [ebp-44], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00438816(C), :00438833(C)
|
:0043883B EB08                    jmp 00438845

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00438800(C), :00438806(C)
|
:0043883D 8B45D4                  mov eax, dword ptr [ebp-2C]
:00438840 8A08                    mov cl, byte ptr [eax]
:00438842 884DBC                  mov byte ptr [ebp-44], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004387FA(C), :0043883B(U)
|
:00438845 8B5510                  mov edx, dword ptr [ebp+10]
:00438848 81E2FF000000            and edx, 000000FF
:0043884E 83E208                  and edx, 00000008
:00438851 85D2                    test edx, edx
:00438853 746D                    je 004388C2
:00438855 6A04                    push 00000004
:00438857 6A00                    push 00000000
:00438859 6A00                    push 00000000
:0043885B B968AB4A00              mov ecx, 004AAB68
:00438860 E8DB710400              call 0047FA40
:00438865 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00438868 33D2                    xor edx, edx
:0043886A 8A1408                  mov dl, byte ptr [eax+ecx]
:0043886D 81FAFF000000            cmp edx, 000000FF
:00438873 744D                    je 004388C2
:00438875 6A04                    push 00000004
:00438877 6A00                    push 00000000
:00438879 6A00                    push 00000000
:0043887B B968AB4A00              mov ecx, 004AAB68
:00438880 E8BB710400              call 0047FA40
:00438885 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00438888 33D2                    xor edx, edx
:0043888A 8A1408                  mov dl, byte ptr [eax+ecx]
:0043888D 8BCA                    mov ecx, edx
:0043888F 6BC924                  imul ecx, 00000024
:00438892 81C1502C4B00            add ecx, 004B2C50
:00438898 E8F303FEFF              call 00418C90
:0043889D 25FF000000              and eax, 000000FF
:004388A2 83F802                  cmp eax, 00000002
:004388A5 751B                    jne 004388C2
:004388A7 6A04                    push 00000004
:004388A9 6A00                    push 00000000
:004388AB 6A00                    push 00000000
:004388AD B968AB4A00              mov ecx, 004AAB68
:004388B2 E889710400              call 0047FA40
:004388B7 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004388BA 8A0408                  mov al, byte ptr [eax+ecx]
:004388BD E99B000000              jmp 0043895D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00438853(C), :00438873(C), :004388A5(C)
|
:004388C2 8B5510                  mov edx, dword ptr [ebp+10]
:004388C5 81E2FF000000            and edx, 000000FF
:004388CB 83E202                  and edx, 00000002
:004388CE 85D2                    test edx, edx
:004388D0 7418                    je 004388EA
:004388D2 8D45EC                  lea eax, dword ptr [ebp-14]
:004388D5 50                      push eax
:004388D6 8D4DB8                  lea ecx, dword ptr [ebp-48]
:004388D9 51                      push ecx
:004388DA E8412B0000              call 0043B420
:004388DF 83C408                  add esp, 00000008
:004388E2 85C0                    test eax, eax
:004388E4 7404                    je 004388EA
:004388E6 B001                    mov al, 01
:004388E8 EB73                    jmp 0043895D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004388D0(C), :004388E4(C)
|
:004388EA 8B5510                  mov edx, dword ptr [ebp+10]
:004388ED 81E2FF000000            and edx, 000000FF
:004388F3 83E204                  and edx, 00000004
:004388F6 85D2                    test edx, edx
:004388F8 740C                    je 00438906
:004388FA 8D45B8                  lea eax, dword ptr [ebp-48]
:004388FD 50                      push eax
:004388FE 8B4D98                  mov ecx, dword ptr [ebp-68]
:00438901 E8231C0000              call 0043A529

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00438732(C), :004388F8(C)
|
:00438906 E979FDFFFF              jmp 00438684

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438691(C)
|
:0043890B E9A2FCFFFF              jmp 004385B2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004385C5(C)
|
:00438910 837DE800                cmp dword ptr [ebp-18], 00000000
:00438914 7520                    jne 00438936
:00438916 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00438919 81E1FF000000            and ecx, 000000FF
:0043891F 81F9FF000000            cmp ecx, 000000FF
:00438925 740D                    je 00438934
:00438927 8A55FC                  mov dl, byte ptr [ebp-04]
:0043892A 8855BC                  mov byte ptr [ebp-44], dl
:0043892D C745E801000000          mov [ebp-18], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438925(C)
|
:00438934 EB1B                    jmp 00438951

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438914(C)
|
:00438936 8B45BC                  mov eax, dword ptr [ebp-44]
:00438939 25FF000000              and eax, 000000FF
:0043893E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00438941 81E1FF000000            and ecx, 000000FF
:00438947 3BC1                    cmp eax, ecx
:00438949 7E06                    jle 00438951
:0043894B 8A55FC                  mov dl, byte ptr [ebp-04]
:0043894E 8855BC                  mov byte ptr [ebp-44], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00438934(U), :00438949(C)
|
:00438951 E939FCFFFF              jmp 0043858F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004385A3(C)
|
:00438956 E9F2FBFFFF              jmp 0043854D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00438557(C), :00438571(C)
|
:0043895B 0CFF                    or al, FF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043838F(U), :00438542(U), :004388BD(U), :004388E8(U)
|
:0043895D 5E                      pop esi
:0043895E 5B                      pop ebx
:0043895F 8BE5                    mov esp, ebp
:00438961 5D                      pop ebp
:00438962 C21800                  ret 0018



* Referenced by a CALL at Address:
|:0043A625   
|
:00438965 55                      push ebp
:00438966 8BEC                    mov ebp, esp
:00438968 83EC14                  sub esp, 00000014
:0043896B 894DEC                  mov dword ptr [ebp-14], ecx
:0043896E 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00438971 E8486F0000              call 0043F8BE
:00438976 8845F8                  mov byte ptr [ebp-08], al
:00438979 C645FC00                mov [ebp-04], 00
:0043897D C645F400                mov [ebp-0C], 00
:00438981 C605302C4B00FF          mov byte ptr [004B2C30], FF
:00438988 6A00                    push 00000000
:0043898A 6880000000              push 00000080
:0043898F 8A45F8                  mov al, byte ptr [ebp-08]
:00438992 50                      push eax
:00438993 8B4D08                  mov ecx, dword ptr [ebp+08]
:00438996 51                      push ecx
:00438997 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043899A E8E7DBFFFF              call 00436586
:0043899F 25FF000000              and eax, 000000FF
:004389A4 3DFF000000              cmp eax, 000000FF
:004389A9 746C                    je 00438A17
:004389AB C745F048C74A00          mov [ebp-10], 004AC748
:004389B2 EB09                    jmp 004389BD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438A15(U)
|
:004389B4 8B55F0                  mov edx, dword ptr [ebp-10]
:004389B7 83C201                  add edx, 00000001
:004389BA 8955F0                  mov dword ptr [ebp-10], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004389B2(U)
|
:004389BD 8B45F0                  mov eax, dword ptr [ebp-10]
:004389C0 33C9                    xor ecx, ecx
:004389C2 8A08                    mov cl, byte ptr [eax]
:004389C4 81F9FF000000            cmp ecx, 000000FF
:004389CA 744B                    je 00438A17
:004389CC 8B55F0                  mov edx, dword ptr [ebp-10]
:004389CF 33C0                    xor eax, eax
:004389D1 8A02                    mov al, byte ptr [edx]
:004389D3 83F873                  cmp eax, 00000073
:004389D6 7D3F                    jge 00438A17
:004389D8 8B4D08                  mov ecx, dword ptr [ebp+08]
:004389DB 668B11                  mov dx, word ptr [ecx]
:004389DE 52                      push edx
:004389DF 8B45F0                  mov eax, dword ptr [ebp-10]
:004389E2 8A08                    mov cl, byte ptr [eax]
:004389E4 51                      push ecx
:004389E5 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004389E8 E833000000              call 00438A20
:004389ED 8845FC                  mov byte ptr [ebp-04], al
:004389F0 8B55F4                  mov edx, dword ptr [ebp-0C]
:004389F3 81E2FF000000            and edx, 000000FF
:004389F9 8B45FC                  mov eax, dword ptr [ebp-04]
:004389FC 25FF000000              and eax, 000000FF
:00438A01 3BD0                    cmp edx, eax
:00438A03 7D10                    jge 00438A15
:00438A05 8A4DFC                  mov cl, byte ptr [ebp-04]
:00438A08 884DF4                  mov byte ptr [ebp-0C], cl
:00438A0B 8B55F0                  mov edx, dword ptr [ebp-10]
:00438A0E 8A02                    mov al, byte ptr [edx]
:00438A10 A2302C4B00              mov byte ptr [004B2C30], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438A03(C)
|
:00438A15 EB9D                    jmp 004389B4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004389A9(C), :004389CA(C), :004389D6(C)
|
:00438A17 8A45F4                  mov al, byte ptr [ebp-0C]
:00438A1A 8BE5                    mov esp, ebp
:00438A1C 5D                      pop ebp
:00438A1D C20400                  ret 0004



* Referenced by a CALL at Address:
|:004389E8   
|
:00438A20 55                      push ebp
:00438A21 8BEC                    mov ebp, esp
:00438A23 81EC98000000            sub esp, 00000098
:00438A29 56                      push esi
:00438A2A 898D68FFFFFF            mov dword ptr [ebp+FFFFFF68], ecx
:00438A30 8B4D08                  mov ecx, dword ptr [ebp+08]
:00438A33 81E1FF000000            and ecx, 000000FF
:00438A39 6BC924                  imul ecx, 00000024
:00438A3C 81C1502C4B00            add ecx, 004B2C50
:00438A42 E8296C0200              call 0045F670
:00438A47 8945F8                  mov dword ptr [ebp-08], eax
:00438A4A C745F400000000          mov [ebp-0C], 00000000
:00438A51 8B4508                  mov eax, dword ptr [ebp+08]
:00438A54 25FF000000              and eax, 000000FF
:00438A59 3DFF000000              cmp eax, 000000FF
:00438A5E 0F8417010000            je 00438B7B
:00438A64 8B4D08                  mov ecx, dword ptr [ebp+08]
:00438A67 81E1FF000000            and ecx, 000000FF
:00438A6D 83F973                  cmp ecx, 00000073
:00438A70 0F8D05010000            jnl 00438B7B
:00438A76 8B4D08                  mov ecx, dword ptr [ebp+08]
:00438A79 81E1FF000000            and ecx, 000000FF
:00438A7F 6BC924                  imul ecx, 00000024
:00438A82 81C1502C4B00            add ecx, 004B2C50
:00438A88 E883DCFCFF              call 00406710
:00438A8D 8BF0                    mov esi, eax
:00438A8F 8B8D68FFFFFF            mov ecx, dword ptr [ebp+FFFFFF68]
:00438A95 E876DCFCFF              call 00406710
:00438A9A 3BF0                    cmp esi, eax
:00438A9C 0F84D9000000            je 00438B7B
:00438AA2 8B55F8                  mov edx, dword ptr [ebp-08]
:00438AA5 6BD248                  imul edx, 00000048
:00438AA8 81C2681B4A00            add edx, 004A1B68
:00438AAE 8955F0                  mov dword ptr [ebp-10], edx
:00438AB1 6A00                    push 00000000
:00438AB3 6A00                    push 00000000
:00438AB5 8B45F0                  mov eax, dword ptr [ebp-10]
:00438AB8 50                      push eax
:00438AB9 8B8D68FFFFFF            mov ecx, dword ptr [ebp+FFFFFF68]
:00438ABF E887310000              call 0043BC4B
:00438AC4 8945EC                  mov dword ptr [ebp-14], eax
:00438AC7 8B4D08                  mov ecx, dword ptr [ebp+08]
:00438ACA 81E1FF000000            and ecx, 000000FF
:00438AD0 6BC924                  imul ecx, 00000024
:00438AD3 81C1502C4B00            add ecx, 004B2C50
:00438AD9 E8B2A10300              call 00472C90
:00438ADE 3945EC                  cmp dword ptr [ebp-14], eax
:00438AE1 720C                    jb 00438AEF
:00438AE3 C745F450000000          mov [ebp-0C], 00000050
:00438AEA E98C000000              jmp 00438B7B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438AE1(C)
|
:00438AEF 8B75EC                  mov esi, dword ptr [ebp-14]
:00438AF2 6BF60A                  imul esi, 0000000A
:00438AF5 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00438AF8 E81EE7FCFF              call 0040721B
:00438AFD 8BC8                    mov ecx, eax
:00438AFF 8BC6                    mov eax, esi
:00438B01 33D2                    xor edx, edx
:00438B03 F7F1                    div ecx
:00438B05 83F801                  cmp eax, 00000001
:00438B08 7209                    jb 00438B13
:00438B0A C745F410000000          mov [ebp-0C], 00000010
:00438B11 EB68                    jmp 00438B7B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438B08(C)
|
:00438B13 8B4D08                  mov ecx, dword ptr [ebp+08]
:00438B16 81E1FF000000            and ecx, 000000FF
:00438B1C 6BC924                  imul ecx, 00000024
:00438B1F 81C1502C4B00            add ecx, 004B2C50
:00438B25 E866A10300              call 00472C90
:00438B2A 8BF0                    mov esi, eax
:00438B2C 6BF664                  imul esi, 00000064
:00438B2F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00438B32 6BC948                  imul ecx, 00000048
:00438B35 81C1681B4A00            add ecx, 004A1B68
:00438B3B E8DBE6FCFF              call 0040721B
:00438B40 8BC8                    mov ecx, eax
:00438B42 8BC6                    mov eax, esi
:00438B44 33D2                    xor edx, edx
:00438B46 F7F1                    div ecx
:00438B48 83F828                  cmp eax, 00000028
:00438B4B 7709                    ja 00438B56
:00438B4D C745F410000000          mov [ebp-0C], 00000010
:00438B54 EB25                    jmp 00438B7B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438B4B(C)
|
:00438B56 8B8D68FFFFFF            mov ecx, dword ptr [ebp+FFFFFF68]
:00438B5C E86FCFFEFF              call 00425AD0
:00438B61 25FF000000              and eax, 000000FF
:00438B66 83F801                  cmp eax, 00000001
:00438B69 7509                    jne 00438B74
:00438B6B C745F40A000000          mov [ebp-0C], 0000000A
:00438B72 EB07                    jmp 00438B7B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438B69(C)
|
:00438B74 C745F402000000          mov [ebp-0C], 00000002

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00438A5E(C), :00438A70(C), :00438A9C(C), :00438AEA(U), :00438B11(U)
|:00438B54(U), :00438B72(U)
|
:00438B7B 6A08                    push 00000008
:00438B7D 8B4D08                  mov ecx, dword ptr [ebp+08]
:00438B80 81E1FF000000            and ecx, 000000FF
:00438B86 6BC924                  imul ecx, 00000024
:00438B89 81C1502C4B00            add ecx, 004B2C50
:00438B8F E84CDBFCFF              call 004066E0
:00438B94 85C0                    test eax, eax
:00438B96 7409                    je 00438BA1
:00438B98 8B55F4                  mov edx, dword ptr [ebp-0C]
:00438B9B 83C208                  add edx, 00000008
:00438B9E 8955F4                  mov dword ptr [ebp-0C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438B96(C)
|
:00438BA1 837DF400                cmp dword ptr [ebp-0C], 00000000
:00438BA5 7651                    jbe 00438BF8
:00438BA7 817DF8AE000000          cmp dword ptr [ebp-08], 000000AE
:00438BAE 7348                    jnb 00438BF8
:00438BB0 8B4D08                  mov ecx, dword ptr [ebp+08]
:00438BB3 81E1FF000000            and ecx, 000000FF
:00438BB9 6BC924                  imul ecx, 00000024
:00438BBC 81C1502C4B00            add ecx, 004B2C50
:00438BC2 E8A96A0200              call 0045F670
:00438BC7 8BF0                    mov esi, eax
:00438BC9 B9902F4900              mov ecx, 00492F90
:00438BCE E85DDAFCFF              call 00406630
:00438BD3 3BF0                    cmp esi, eax
:00438BD5 740D                    je 00438BE4
:00438BD7 8B4508                  mov eax, dword ptr [ebp+08]
:00438BDA 25FF000000              and eax, 000000FF
:00438BDF 83F823                  cmp eax, 00000023
:00438BE2 750B                    jne 00438BEF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438BD5(C)
|
:00438BE4 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00438BE7 83C108                  add ecx, 00000008
:00438BEA 894DF4                  mov dword ptr [ebp-0C], ecx
:00438BED EB09                    jmp 00438BF8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438BE2(C)
|
:00438BEF 8B55F4                  mov edx, dword ptr [ebp-0C]
:00438BF2 83C204                  add edx, 00000004
:00438BF5 8955F4                  mov dword ptr [ebp-0C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00438BA5(C), :00438BAE(C), :00438BED(U)
|
:00438BF8 837DF44B                cmp dword ptr [ebp-0C], 0000004B
:00438BFC 7316                    jnb 00438C14
:00438BFE 8B8D68FFFFFF            mov ecx, dword ptr [ebp+FFFFFF68]
:00438C04 E8E4730000              call 0043FFED
:00438C09 85C0                    test eax, eax
:00438C0B 7407                    je 00438C14
:00438C0D 33C0                    xor eax, eax
:00438C0F E97B010000              jmp 00438D8F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00438BFC(C), :00438C0B(C)
|
:00438C14 8B8568FFFFFF            mov eax, dword ptr [ebp+FFFFFF68]
:00438C1A 8B08                    mov ecx, dword ptr [eax]
:00438C1C 6BC948                  imul ecx, 00000048
:00438C1F 81C1681B4A00            add ecx, 004A1B68
:00438C25 E8EEEBFCFF              call 00407818
:00438C2A 8845FC                  mov byte ptr [ebp-04], al
:00438C2D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00438C30 81E1FF000000            and ecx, 000000FF
:00438C36 81F9FF000000            cmp ecx, 000000FF
:00438C3C 746C                    je 00438CAA
:00438C3E 8B55FC                  mov edx, dword ptr [ebp-04]
:00438C41 81E2FF000000            and edx, 000000FF
:00438C47 85D2                    test edx, edx
:00438C49 745F                    je 00438CAA
:00438C4B 8D8578FFFFFF            lea eax, dword ptr [ebp+FFFFFF78]
:00438C51 898574FFFFFF            mov dword ptr [ebp+FFFFFF74], eax
:00438C57 68FF000000              push 000000FF
:00438C5C 68FF000000              push 000000FF
:00438C61 8D8D78FFFFFF            lea ecx, dword ptr [ebp+FFFFFF78]
:00438C67 51                      push ecx
:00438C68 8A55FC                  mov dl, byte ptr [ebp-04]
:00438C6B 52                      push edx
:00438C6C 6A01                    push 00000001
:00438C6E 8A4508                  mov al, byte ptr [ebp+08]
:00438C71 50                      push eax
:00438C72 8B8D68FFFFFF            mov ecx, dword ptr [ebp+FFFFFF68]
:00438C78 E830CEFFFF              call 00435AAD
:00438C7D 898574FFFFFF            mov dword ptr [ebp+FFFFFF74], eax
:00438C83 68FF000000              push 000000FF
:00438C88 8B8D68FFFFFF            mov ecx, dword ptr [ebp+FFFFFF68]
:00438C8E 8A5104                  mov dl, byte ptr [ecx+04]
:00438C91 52                      push edx
:00438C92 6A00                    push 00000000
:00438C94 8B45F4                  mov eax, dword ptr [ebp-0C]
:00438C97 50                      push eax
:00438C98 8B8D74FFFFFF            mov ecx, dword ptr [ebp+FFFFFF74]
:00438C9E 51                      push ecx
:00438C9F E8F2000000              call 00438D96
:00438CA4 83C414                  add esp, 00000014
:00438CA7 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00438C3C(C), :00438C49(C)
|
:00438CAA 837DF400                cmp dword ptr [ebp-0C], 00000000
:00438CAE 0F86D8000000            jbe 00438D8C
:00438CB4 8B4D08                  mov ecx, dword ptr [ebp+08]
:00438CB7 81E1FF000000            and ecx, 000000FF
:00438CBD 6BC924                  imul ecx, 00000024
:00438CC0 81C1502C4B00            add ecx, 004B2C50
:00438CC6 E895A6FCFF              call 00403360
:00438CCB 668B10                  mov dx, word ptr [eax]
:00438CCE 66899570FFFFFF          mov word ptr [ebp+FFFFFF70], dx
:00438CD5 8B4D08                  mov ecx, dword ptr [ebp+08]
:00438CD8 81E1FF000000            and ecx, 000000FF
:00438CDE 6BC924                  imul ecx, 00000024
:00438CE1 81C1502C4B00            add ecx, 004B2C50
:00438CE7 E8D26B0000              call 0043F8BE
:00438CEC 88856CFFFFFF            mov byte ptr [ebp+FFFFFF6C], al
:00438CF2 6A00                    push 00000000
:00438CF4 6840060000              push 00000640
:00438CF9 6A04                    push 00000004
:00438CFB 6A00                    push 00000000
:00438CFD 68800C0000              push 00000C80
:00438D02 B968AB4A00              mov ecx, 004AAB68
:00438D07 E8346D0400              call 0047FA40
:00438D0C 50                      push eax
:00438D0D E801700400              call 0047FD13
:00438D12 83C40C                  add esp, 0000000C
:00438D15 6A01                    push 00000001
:00438D17 6880000000              push 00000080
:00438D1C 8A856CFFFFFF            mov al, byte ptr [ebp+FFFFFF6C]
:00438D22 50                      push eax
:00438D23 8D8D70FFFFFF            lea ecx, dword ptr [ebp+FFFFFF70]
:00438D29 51                      push ecx
:00438D2A 8B4D08                  mov ecx, dword ptr [ebp+08]
:00438D2D 81E1FF000000            and ecx, 000000FF
:00438D33 6BC924                  imul ecx, 00000024
:00438D36 81C1502C4B00            add ecx, 004B2C50
:00438D3C E845D8FFFF              call 00436586
:00438D41 6A04                    push 00000004
:00438D43 6A00                    push 00000000
:00438D45 68800C0000              push 00000C80
:00438D4A B968AB4A00              mov ecx, 004AAB68
:00438D4F E8EC6C0400              call 0047FA40
:00438D54 8B550C                  mov edx, dword ptr [ebp+0C]
:00438D57 81E2FF000000            and edx, 000000FF
:00438D5D 03C2                    add eax, edx
:00438D5F 8B4D0D                  mov ecx, dword ptr [ebp+0D]
:00438D62 81E1FF000000            and ecx, 000000FF
:00438D68 33D2                    xor edx, edx
:00438D6A 8A152C424B00            mov dl, byte ptr [004B422C]
:00438D70 0FAFCA                  imul ecx, edx
:00438D73 33D2                    xor edx, edx
:00438D75 8A1408                  mov dl, byte ptr [eax+ecx]
:00438D78 83FA01                  cmp edx, 00000001
:00438D7B 750F                    jne 00438D8C
:00438D7D 837DF401                cmp dword ptr [ebp-0C], 00000001
:00438D81 7609                    jbe 00438D8C
:00438D83 8B45F4                  mov eax, dword ptr [ebp-0C]
:00438D86 83E801                  sub eax, 00000001
:00438D89 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00438CAE(C), :00438D7B(C), :00438D81(C)
|
:00438D8C 8B45F4                  mov eax, dword ptr [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438C0F(U)
|
:00438D8F 5E                      pop esi
:00438D90 8BE5                    mov esp, ebp
:00438D92 5D                      pop ebp
:00438D93 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:00438C9F   , :004399D2   , :00439A9B   , :00439BD0   , :00439D14   
|
:00438D96 55                      push ebp
:00438D97 8BEC                    mov ebp, esp
:00438D99 83EC14                  sub esp, 00000014
:00438D9C 56                      push esi
:00438D9D C745FC00000000          mov [ebp-04], 00000000
:00438DA4 C745F400000000          mov [ebp-0C], 00000000
:00438DAB C745F800000000          mov [ebp-08], 00000000
:00438DB2 8B4508                  mov eax, dword ptr [ebp+08]
:00438DB5 33C9                    xor ecx, ecx
:00438DB7 8A08                    mov cl, byte ptr [eax]
:00438DB9 81F9FF000000            cmp ecx, 000000FF
:00438DBF 751D                    jne 00438DDE
:00438DC1 837D0C04                cmp dword ptr [ebp+0C], 00000004
:00438DC5 7E0B                    jle 00438DD2
:00438DC7 8B550C                  mov edx, dword ptr [ebp+0C]
:00438DCA 83EA04                  sub edx, 00000004
:00438DCD 89550C                  mov dword ptr [ebp+0C], edx
:00438DD0 EB07                    jmp 00438DD9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438DC5(C)
|
:00438DD2 C7450C00000000          mov [ebp+0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438DD0(U)
|
:00438DD9 E9CF020000              jmp 004390AD

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00438DBF(C), :004390A8(U)
|
:00438DDE 8B4508                  mov eax, dword ptr [ebp+08]
:00438DE1 33C9                    xor ecx, ecx
:00438DE3 8A08                    mov cl, byte ptr [eax]
:00438DE5 81F9FF000000            cmp ecx, 000000FF
:00438DEB 0F84BC020000            je 004390AD
:00438DF1 8B5510                  mov edx, dword ptr [ebp+10]
:00438DF4 81E2FF000000            and edx, 000000FF
:00438DFA 8955F0                  mov dword ptr [ebp-10], edx
:00438DFD 837DF005                cmp dword ptr [ebp-10], 00000005
:00438E01 0F8798020000            ja 0043909F
:00438E07 8B45F0                  mov eax, dword ptr [ebp-10]
:00438E0A FF2485D7904300          jmp dword ptr [4*eax+004390D7]
:00438E11 8B4D18                  mov ecx, dword ptr [ebp+18]
:00438E14 81E1FF000000            and ecx, 000000FF
:00438E1A 81F9FF000000            cmp ecx, 000000FF
:00438E20 745A                    je 00438E7C
:00438E22 8A5518                  mov dl, byte ptr [ebp+18]
:00438E25 52                      push edx
:00438E26 8B4508                  mov eax, dword ptr [ebp+08]
:00438E29 8A08                    mov cl, byte ptr [eax]
:00438E2B 51                      push ecx
:00438E2C 8A5514                  mov dl, byte ptr [ebp+14]
:00438E2F 52                      push edx
:00438E30 E8BA020000              call 004390EF
:00438E35 83C40C                  add esp, 0000000C
:00438E38 85C0                    test eax, eax
:00438E3A 743B                    je 00438E77
:00438E3C 8B45FC                  mov eax, dword ptr [ebp-04]
:00438E3F 83C003                  add eax, 00000003
:00438E42 8945FC                  mov dword ptr [ebp-04], eax
:00438E45 8B4D08                  mov ecx, dword ptr [ebp+08]
:00438E48 33D2                    xor edx, edx
:00438E4A 8A11                    mov dl, byte ptr [ecx]
:00438E4C 8BF2                    mov esi, edx
:00438E4E 8B4D14                  mov ecx, dword ptr [ebp+14]
:00438E51 81E1FF000000            and ecx, 000000FF
:00438E57 6BC924                  imul ecx, 00000024
:00438E5A 81C1502C4B00            add ecx, 004B2C50
:00438E60 E8AB34FEFF              call 0041C310
:00438E65 25FF000000              and eax, 000000FF
:00438E6A 3BF0                    cmp esi, eax
:00438E6C 7509                    jne 00438E77
:00438E6E 8B45FC                  mov eax, dword ptr [ebp-04]
:00438E71 83C003                  add eax, 00000003
:00438E74 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00438E3A(C), :00438E6C(C)
|
:00438E77 E98F000000              jmp 00438F0B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438E20(C)
|
:00438E7C 8B4D08                  mov ecx, dword ptr [ebp+08]
:00438E7F 33D2                    xor edx, edx
:00438E81 8A11                    mov dl, byte ptr [ecx]
:00438E83 8BCA                    mov ecx, edx
:00438E85 6BC924                  imul ecx, 00000024
:00438E88 81C1502C4B00            add ecx, 004B2C50
:00438E8E E8DD670200              call 0045F670
:00438E93 6BC048                  imul eax, 00000048
:00438E96 05681B4A00              add eax, 004A1B68
:00438E9B 8945F8                  mov dword ptr [ebp-08], eax
:00438E9E 6A00                    push 00000000
:00438EA0 6A00                    push 00000000
:00438EA2 8B45F8                  mov eax, dword ptr [ebp-08]
:00438EA5 50                      push eax
:00438EA6 8B4D14                  mov ecx, dword ptr [ebp+14]
:00438EA9 81E1FF000000            and ecx, 000000FF
:00438EAF 6BC924                  imul ecx, 00000024
:00438EB2 81C1502C4B00            add ecx, 004B2C50
:00438EB8 E88E2D0000              call 0043BC4B
:00438EBD 8945F4                  mov dword ptr [ebp-0C], eax
:00438EC0 8B4D08                  mov ecx, dword ptr [ebp+08]
:00438EC3 33D2                    xor edx, edx
:00438EC5 8A11                    mov dl, byte ptr [ecx]
:00438EC7 8BCA                    mov ecx, edx
:00438EC9 6BC924                  imul ecx, 00000024
:00438ECC 81C1502C4B00            add ecx, 004B2C50
:00438ED2 E8B99D0300              call 00472C90
:00438ED7 3945F4                  cmp dword ptr [ebp-0C], eax
:00438EDA 720B                    jb 00438EE7
:00438EDC 8B45FC                  mov eax, dword ptr [ebp-04]
:00438EDF 83C00A                  add eax, 0000000A
:00438EE2 8945FC                  mov dword ptr [ebp-04], eax
:00438EE5 EB24                    jmp 00438F0B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00438EDA(C)
|
:00438EE7 8B75F4                  mov esi, dword ptr [ebp-0C]
:00438EEA 6BF60A                  imul esi, 0000000A
:00438EED 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00438EF0 E826E3FCFF              call 0040721B
:00438EF5 8BC8                    mov ecx, eax
:00438EF7 8BC6                    mov eax, esi
:00438EF9 33D2                    xor edx, edx
:00438EFB F7F1                    div ecx
:00438EFD 83F801                  cmp eax, 00000001
:00438F00 7209                    jb 00438F0B
:00438F02 8B55FC                  mov edx, dword ptr [ebp-04]
:00438F05 83C204                  add edx, 00000004
:00438F08 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00438E77(U), :00438EE5(U), :00438F00(C)
|
:00438F0B E98F010000              jmp 0043909F
:00438F10 8A4518                  mov al, byte ptr [ebp+18]
:00438F13 50                      push eax
:00438F14 8B4D08                  mov ecx, dword ptr [ebp+08]
:00438F17 8A11                    mov dl, byte ptr [ecx]
:00438F19 52                      push edx
:00438F1A 8A4514                  mov al, byte ptr [ebp+14]
:00438F1D 50                      push eax
:00438F1E E8CC010000              call 004390EF
:00438F23 83C40C                  add esp, 0000000C
:00438F26 85C0                    test eax, eax
:00438F28 7457                    je 00438F81
:00438F2A 8B4D08                  mov ecx, dword ptr [ebp+08]
:00438F2D 33D2                    xor edx, edx
:00438F2F 8A11                    mov dl, byte ptr [ecx]
:00438F31 8BCA                    mov ecx, edx
:00438F33 6BC924                  imul ecx, 00000024
:00438F36 81C1502C4B00            add ecx, 004B2C50
:00438F3C E84F9D0300              call 00472C90
:00438F41 8BF0                    mov esi, eax
:00438F43 6BF664                  imul esi, 00000064
:00438F46 8B4508                  mov eax, dword ptr [ebp+08]
:00438F49 33C9                    xor ecx, ecx
:00438F4B 8A08                    mov cl, byte ptr [eax]
:00438F4D 6BC924                  imul ecx, 00000024
:00438F50 81C1502C4B00            add ecx, 004B2C50
:00438F56 E815670200              call 0045F670
:00438F5B 8BC8                    mov ecx, eax
:00438F5D 6BC948                  imul ecx, 00000048
:00438F60 81C1681B4A00            add ecx, 004A1B68
:00438F66 E8B0E2FCFF              call 0040721B
:00438F6B 8BC8                    mov ecx, eax
:00438F6D 8BC6                    mov eax, esi
:00438F6F 33D2                    xor edx, edx
:00438F71 F7F1                    div ecx
:00438F73 83F83C                  cmp eax, 0000003C
:00438F76 7309                    jnb 00438F81
:00438F78 8B55FC                  mov edx, dword ptr [ebp-04]
:00438F7B 83C205                  add edx, 00000005
:00438F7E 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00438F28(C), :00438F76(C)
|
:00438F81 E919010000              jmp 0043909F
:00438F86 8A4518                  mov al, byte ptr [ebp+18]
:00438F89 50                      push eax
:00438F8A 8B4D08                  mov ecx, dword ptr [ebp+08]
:00438F8D 8A11                    mov dl, byte ptr [ecx]
:00438F8F 52                      push edx
:00438F90 8A4514                  mov al, byte ptr [ebp+14]
:00438F93 50                      push eax
:00438F94 E856010000              call 004390EF
:00438F99 83C40C                  add esp, 0000000C
:00438F9C 85C0                    test eax, eax
:00438F9E 742A                    je 00438FCA
:00438FA0 8B4D08                  mov ecx, dword ptr [ebp+08]
:00438FA3 33D2                    xor edx, edx
:00438FA5 8A11                    mov dl, byte ptr [ecx]
:00438FA7 8BCA                    mov ecx, edx
:00438FA9 6BC924                  imul ecx, 00000024
:00438FAC 81C1502C4B00            add ecx, 004B2C50
:00438FB2 E8D94FFEFF              call 0041DF90
:00438FB7 25FF000000              and eax, 000000FF
:00438FBC 83F804                  cmp eax, 00000004
:00438FBF 7D09                    jge 00438FCA
:00438FC1 8B45FC                  mov eax, dword ptr [ebp-04]
:00438FC4 83C003                  add eax, 00000003
:00438FC7 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00438F9E(C), :00438FBF(C)
|
:00438FCA E9D0000000              jmp 0043909F
:00438FCF 8A4D18                  mov cl, byte ptr [ebp+18]
:00438FD2 51                      push ecx
:00438FD3 8B5508                  mov edx, dword ptr [ebp+08]
:00438FD6 8A02                    mov al, byte ptr [edx]
:00438FD8 50                      push eax
:00438FD9 8A4D14                  mov cl, byte ptr [ebp+14]
:00438FDC 51                      push ecx
:00438FDD E80D010000              call 004390EF
:00438FE2 83C40C                  add esp, 0000000C
:00438FE5 85C0                    test eax, eax
:00438FE7 742A                    je 00439013
:00438FE9 8B5508                  mov edx, dword ptr [ebp+08]
:00438FEC 33C0                    xor eax, eax
:00438FEE 8A02                    mov al, byte ptr [edx]
:00438FF0 8BC8                    mov ecx, eax
:00438FF2 6BC924                  imul ecx, 00000024
:00438FF5 81C1502C4B00            add ecx, 004B2C50
:00438FFB E8B04FFEFF              call 0041DFB0
:00439000 25FF000000              and eax, 000000FF
:00439005 83F804                  cmp eax, 00000004
:00439008 7D09                    jge 00439013
:0043900A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043900D 83C103                  add ecx, 00000003
:00439010 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00438FE7(C), :00439008(C)
|
:00439013 E987000000              jmp 0043909F
:00439018 8A5518                  mov dl, byte ptr [ebp+18]
:0043901B 52                      push edx
:0043901C 8B4508                  mov eax, dword ptr [ebp+08]
:0043901F 8A08                    mov cl, byte ptr [eax]
:00439021 51                      push ecx
:00439022 8A5514                  mov dl, byte ptr [ebp+14]
:00439025 52                      push edx
:00439026 E8C4000000              call 004390EF
:0043902B 83C40C                  add esp, 0000000C
:0043902E 85C0                    test eax, eax
:00439030 7428                    je 0043905A
:00439032 8B4508                  mov eax, dword ptr [ebp+08]
:00439035 33C9                    xor ecx, ecx
:00439037 8A08                    mov cl, byte ptr [eax]
:00439039 6BC924                  imul ecx, 00000024
:0043903C 81C1502C4B00            add ecx, 004B2C50
:00439042 E8694FFEFF              call 0041DFB0
:00439047 25FF000000              and eax, 000000FF
:0043904C 83F804                  cmp eax, 00000004
:0043904F 7D09                    jge 0043905A
:00439051 8B55FC                  mov edx, dword ptr [ebp-04]
:00439054 83C203                  add edx, 00000003
:00439057 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00439030(C), :0043904F(C)
|
:0043905A EB43                    jmp 0043909F
:0043905C 8A4518                  mov al, byte ptr [ebp+18]
:0043905F 50                      push eax
:00439060 8B4D08                  mov ecx, dword ptr [ebp+08]
:00439063 8A11                    mov dl, byte ptr [ecx]
:00439065 52                      push edx
:00439066 8A4514                  mov al, byte ptr [ebp+14]
:00439069 50                      push eax
:0043906A E880000000              call 004390EF
:0043906F 83C40C                  add esp, 0000000C
:00439072 85C0                    test eax, eax
:00439074 7429                    je 0043909F
:00439076 8B4D08                  mov ecx, dword ptr [ebp+08]
:00439079 33D2                    xor edx, edx
:0043907B 8A11                    mov dl, byte ptr [ecx]
:0043907D 8BCA                    mov ecx, edx
:0043907F 6BC924                  imul ecx, 00000024
:00439082 81C1502C4B00            add ecx, 004B2C50
:00439088 E8A34FFEFF              call 0041E030
:0043908D 25FF000000              and eax, 000000FF
:00439092 85C0                    test eax, eax
:00439094 7409                    je 0043909F
:00439096 8B45FC                  mov eax, dword ptr [ebp-04]
:00439099 83C003                  add eax, 00000003
:0043909C 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00438E01(C), :00438F0B(U), :00438F81(U), :00438FCA(U), :00439013(U)
|:0043905A(U), :00439074(C), :00439094(C)
|
:0043909F 8B4D08                  mov ecx, dword ptr [ebp+08]
:004390A2 83C101                  add ecx, 00000001
:004390A5 894D08                  mov dword ptr [ebp+08], ecx
:004390A8 E931FDFFFF              jmp 00438DDE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00438DD9(U), :00438DEB(C)
|
:004390AD 8B550C                  mov edx, dword ptr [ebp+0C]
:004390B0 0355FC                  add edx, dword ptr [ebp-04]
:004390B3 85D2                    test edx, edx
:004390B5 7E0B                    jle 004390C2
:004390B7 8B450C                  mov eax, dword ptr [ebp+0C]
:004390BA 0345FC                  add eax, dword ptr [ebp-04]
:004390BD 8945EC                  mov dword ptr [ebp-14], eax
:004390C0 EB07                    jmp 004390C9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004390B5(C)
|
:004390C2 C745EC00000000          mov [ebp-14], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004390C0(U)
|
:004390C9 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004390CC 894DFC                  mov dword ptr [ebp-04], ecx
:004390CF 8B45FC                  mov eax, dword ptr [ebp-04]
:004390D2 5E                      pop esi
:004390D3 8BE5                    mov esp, ebp
:004390D5 5D                      pop ebp
:004390D6 C3                      ret



:004390D7 118E4300                DWORD 00438E11
:004390DB 108F4300                DWORD 00438F10
:004390DF 868F4300                DWORD 00438F86
:004390E3 CF8F4300                DWORD 00438FCF
:004390E7 18904300                DWORD 00439018
:004390EB 5C904300                DWORD 0043905C



* Referenced by a CALL at Addresses:
|:00438E30   , :00438F1E   , :00438F94   , :00438FDD   , :00439026   
|:0043906A   , :00439778   , :004397DE   , :004399F7   , :00439AC0   
|:00439B5C   , :00439BF5   , :00439D39   , :00439DC1   , :00439E96   
|:00439FD0   
|
:004390EF 55                      push ebp
:004390F0 8BEC                    mov ebp, esp
:004390F2 51                      push ecx
:004390F3 56                      push esi
:004390F4 6A00                    push 00000000
:004390F6 8A4508                  mov al, byte ptr [ebp+08]
:004390F9 50                      push eax
:004390FA 8A4D10                  mov cl, byte ptr [ebp+10]
:004390FD 51                      push ecx
:004390FE E8C66DFEFF              call 0041FEC9
:00439103 83C40C                  add esp, 0000000C
:00439106 85C0                    test eax, eax
:00439108 0F84C7000000            je 004391D5
:0043910E 6A00                    push 00000000
:00439110 8A550C                  mov dl, byte ptr [ebp+0C]
:00439113 52                      push edx
:00439114 8A4508                  mov al, byte ptr [ebp+08]
:00439117 50                      push eax
:00439118 8A4D10                  mov cl, byte ptr [ebp+10]
:0043911B 51                      push ecx
:0043911C E80173FEFF              call 00420422
:00439121 83C410                  add esp, 00000010
:00439124 85C0                    test eax, eax
:00439126 0F84A9000000            je 004391D5
:0043912C 8B4D10                  mov ecx, dword ptr [ebp+10]
:0043912F 81E1FF000000            and ecx, 000000FF
:00439135 6BC946                  imul ecx, 00000046
:00439138 81C1C0F44A00            add ecx, 004AF4C0
:0043913E E86DC9FEFF              call 00425AB0
:00439143 8845FC                  mov byte ptr [ebp-04], al
:00439146 807DFC00                cmp byte ptr [ebp-04], 00
:0043914A 7408                    je 00439154
:0043914C 807DFC01                cmp byte ptr [ebp-04], 01
:00439150 743F                    je 00439191
:00439152 EB7A                    jmp 004391CE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043914A(C)
|
:00439154 8B4D08                  mov ecx, dword ptr [ebp+08]
:00439157 81E1FF000000            and ecx, 000000FF
:0043915D 6BC924                  imul ecx, 00000024
:00439160 81C1502C4B00            add ecx, 004B2C50
:00439166 E8A5D5FCFF              call 00406710
:0043916B 8BF0                    mov esi, eax
:0043916D 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00439170 81E1FF000000            and ecx, 000000FF
:00439176 6BC924                  imul ecx, 00000024
:00439179 81C1502C4B00            add ecx, 004B2C50
:0043917F E88CD5FCFF              call 00406710
:00439184 3BF0                    cmp esi, eax
:00439186 7407                    je 0043918F
:00439188 B801000000              mov eax, 00000001
:0043918D EB48                    jmp 004391D7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439186(C)
|
:0043918F EB44                    jmp 004391D5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439150(C)
|
:00439191 8B4D08                  mov ecx, dword ptr [ebp+08]
:00439194 81E1FF000000            and ecx, 000000FF
:0043919A 6BC924                  imul ecx, 00000024
:0043919D 81C1502C4B00            add ecx, 004B2C50
:004391A3 E868D5FCFF              call 00406710
:004391A8 8BF0                    mov esi, eax
:004391AA 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004391AD 81E1FF000000            and ecx, 000000FF
:004391B3 6BC924                  imul ecx, 00000024
:004391B6 81C1502C4B00            add ecx, 004B2C50
:004391BC E84FD5FCFF              call 00406710
:004391C1 3BF0                    cmp esi, eax
:004391C3 7507                    jne 004391CC
:004391C5 B801000000              mov eax, 00000001
:004391CA EB0B                    jmp 004391D7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004391C3(C)
|
:004391CC EB07                    jmp 004391D5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439152(U)
|
:004391CE B801000000              mov eax, 00000001
:004391D3 EB02                    jmp 004391D7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00439108(C), :00439126(C), :0043918F(U), :004391CC(U)
|
:004391D5 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043918D(U), :004391CA(U), :004391D3(U)
|
:004391D7 5E                      pop esi
:004391D8 8BE5                    mov esp, ebp
:004391DA 5D                      pop ebp
:004391DB C3                      ret



* Referenced by a CALL at Address:
|:0043A642   
|
:004391DC 55                      push ebp
:004391DD 8BEC                    mov ebp, esp
:004391DF 81ECA8000000            sub esp, 000000A8
:004391E5 898D5CFFFFFF            mov dword ptr [ebp+FFFFFF5C], ecx
:004391EB C68578FFFFFF00          mov byte ptr [ebp+FFFFFF78], 00
:004391F2 C6857CFFFFFFFF          mov byte ptr [ebp+FFFFFF7C], FF
:004391F9 C6458400                mov [ebp-7C], 00
:004391FD C6052C2C4B00FF          mov byte ptr [004B2C2C], FF
:00439204 C605402C4B00FF          mov byte ptr [004B2C40], FF
:0043920B C7458000000000          mov [ebp-80], 00000000
:00439212 EB09                    jmp 0043921D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043922B(U)
|
:00439214 8B4580                  mov eax, dword ptr [ebp-80]
:00439217 83C001                  add eax, 00000001
:0043921A 894580                  mov dword ptr [ebp-80], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439212(U)
|
:0043921D 837D8074                cmp dword ptr [ebp-80], 00000074
:00439221 730A                    jnb 0043922D
:00439223 8B4D80                  mov ecx, dword ptr [ebp-80]
:00439226 C6440D8CFF              mov [ebp+ecx-74], FF
:0043922B EBE7                    jmp 00439214

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439221(C)
|
:0043922D C74588ACC74A00          mov [ebp-78], 004AC7AC
:00439234 EB09                    jmp 0043923F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043928D(U), :00439511(U)
|
:00439236 8B5588                  mov edx, dword ptr [ebp-78]
:00439239 83C201                  add edx, 00000001
:0043923C 895588                  mov dword ptr [ebp-78], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439234(U)
|
:0043923F 8B4588                  mov eax, dword ptr [ebp-78]
:00439242 33C9                    xor ecx, ecx
:00439244 8A08                    mov cl, byte ptr [eax]
:00439246 81F9FF000000            cmp ecx, 000000FF
:0043924C 0F84C4020000            je 00439516
:00439252 8B5588                  mov edx, dword ptr [ebp-78]
:00439255 33C0                    xor eax, eax
:00439257 8A02                    mov al, byte ptr [edx]
:00439259 8BC8                    mov ecx, eax
:0043925B 6BC946                  imul ecx, 00000046
:0043925E 81C1C0F44A00            add ecx, 004AF4C0
:00439264 E827FAFDFF              call 00418C90
:00439269 88857CFFFFFF            mov byte ptr [ebp+FFFFFF7C], al
:0043926F 8B4D88                  mov ecx, dword ptr [ebp-78]
:00439272 8A11                    mov dl, byte ptr [ecx]
:00439274 52                      push edx
:00439275 E8FC020000              call 00439576
:0043927A 83C404                  add esp, 00000004
:0043927D 884584                  mov byte ptr [ebp-7C], al
:00439280 8B4584                  mov eax, dword ptr [ebp-7C]
:00439283 25FF000000              and eax, 000000FF
:00439288 83F802                  cmp eax, 00000002
:0043928B 7502                    jne 0043928F
:0043928D EBA7                    jmp 00439236

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043928B(C)
|
:0043928F C78574FFFFFF00000000    mov dword ptr [ebp+FFFFFF74], 00000000
:00439299 8B8D7CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF7C]
:0043929F 81E1FF000000            and ecx, 000000FF
:004392A5 81F9FF000000            cmp ecx, 000000FF
:004392AB 0F8531010000            jne 004393E2
:004392B1 8B5588                  mov edx, dword ptr [ebp-78]
:004392B4 33C0                    xor eax, eax
:004392B6 8A02                    mov al, byte ptr [edx]
:004392B8 8BC8                    mov ecx, eax
:004392BA 6BC946                  imul ecx, 00000046
:004392BD 81C1C0F44A00            add ecx, 004AF4C0
:004392C3 E888C8FEFF              call 00425B50
:004392C8 888570FFFFFF            mov byte ptr [ebp+FFFFFF70], al
:004392CE 8B4D88                  mov ecx, dword ptr [ebp-78]
:004392D1 8A11                    mov dl, byte ptr [ecx]
:004392D3 52                      push edx
:004392D4 E849020000              call 00439522
:004392D9 83C404                  add esp, 00000004
:004392DC 88856CFFFFFF            mov byte ptr [ebp+FFFFFF6C], al
:004392E2 68FF000000              push 000000FF
:004392E7 68FF000000              push 000000FF
:004392EC 8D458C                  lea eax, dword ptr [ebp-74]
:004392EF 50                      push eax
:004392F0 8A8D70FFFFFF            mov cl, byte ptr [ebp+FFFFFF70]
:004392F6 51                      push ecx
:004392F7 8A956CFFFFFF            mov dl, byte ptr [ebp+FFFFFF6C]
:004392FD 52                      push edx
:004392FE 8B4508                  mov eax, dword ptr [ebp+08]
:00439301 668B08                  mov cx, word ptr [eax]
:00439304 51                      push ecx
:00439305 8B8D5CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF5C]
:0043930B E82EC8FFFF              call 00435B3E
:00439310 898568FFFFFF            mov dword ptr [ebp+FFFFFF68], eax
:00439316 EB0F                    jmp 00439327

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004393A6(U)
|
:00439318 8B9568FFFFFF            mov edx, dword ptr [ebp+FFFFFF68]
:0043931E 83C201                  add edx, 00000001
:00439321 899568FFFFFF            mov dword ptr [ebp+FFFFFF68], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439316(U)
|
:00439327 8B8568FFFFFF            mov eax, dword ptr [ebp+FFFFFF68]
:0043932D 33C9                    xor ecx, ecx
:0043932F 8A08                    mov cl, byte ptr [eax]
:00439331 81F9FF000000            cmp ecx, 000000FF
:00439337 7472                    je 004393AB
:00439339 8B5508                  mov edx, dword ptr [ebp+08]
:0043933C 52                      push edx
:0043933D E84FC6FFFF              call 00435991
:00439342 83C404                  add esp, 00000004
:00439345 50                      push eax
:00439346 8B4508                  mov eax, dword ptr [ebp+08]
:00439349 668B08                  mov cx, word ptr [eax]
:0043934C 51                      push ecx
:0043934D 8B5588                  mov edx, dword ptr [ebp-78]
:00439350 8A02                    mov al, byte ptr [edx]
:00439352 50                      push eax
:00439353 8B8D68FFFFFF            mov ecx, dword ptr [ebp+FFFFFF68]
:00439359 8A11                    mov dl, byte ptr [ecx]
:0043935B 52                      push edx
:0043935C 8B8D5CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF5C]
:00439362 E847020000              call 004395AE
:00439367 8B8D74FFFFFF            mov ecx, dword ptr [ebp+FFFFFF74]
:0043936D 03C8                    add ecx, eax
:0043936F 898D74FFFFFF            mov dword ptr [ebp+FFFFFF74], ecx
:00439375 83BD74FFFFFF00          cmp dword ptr [ebp+FFFFFF74], 00000000
:0043937C 7628                    jbe 004393A6
:0043937E 8B9568FFFFFF            mov edx, dword ptr [ebp+FFFFFF68]
:00439384 33C0                    xor eax, eax
:00439386 8A02                    mov al, byte ptr [edx]
:00439388 8B8D5CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF5C]
:0043938E 33D2                    xor edx, edx
:00439390 8A5108                  mov dl, byte ptr [ecx+08]
:00439393 3BC2                    cmp eax, edx
:00439395 750F                    jne 004393A6
:00439397 8B8574FFFFFF            mov eax, dword ptr [ebp+FFFFFF74]
:0043939D 83C00A                  add eax, 0000000A
:004393A0 898574FFFFFF            mov dword ptr [ebp+FFFFFF74], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043937C(C), :00439395(C)
|
:004393A6 E96DFFFFFF              jmp 00439318

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439337(C)
|
:004393AB 8B8D78FFFFFF            mov ecx, dword ptr [ebp+FFFFFF78]
:004393B1 81E1FF000000            and ecx, 000000FF
:004393B7 3B8D74FFFFFF            cmp ecx, dword ptr [ebp+FFFFFF74]
:004393BD 731E                    jnb 004393DD
:004393BF 8A9574FFFFFF            mov dl, byte ptr [ebp+FFFFFF74]
:004393C5 889578FFFFFF            mov byte ptr [ebp+FFFFFF78], dl
:004393CB C6052C2C4B00FF          mov byte ptr [004B2C2C], FF
:004393D2 8B4588                  mov eax, dword ptr [ebp-78]
:004393D5 8A08                    mov cl, byte ptr [eax]
:004393D7 880D402C4B00            mov byte ptr [004B2C40], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004393BD(C)
|
:004393DD E92F010000              jmp 00439511

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004392AB(C)
|
:004393E2 6A00                    push 00000000
:004393E4 8B5584                  mov edx, dword ptr [ebp-7C]
:004393E7 81E2FF000000            and edx, 000000FF
:004393ED 80CA80                  or dl, 80
:004393F0 52                      push edx
:004393F1 8B857CFFFFFF            mov eax, dword ptr [ebp+FFFFFF7C]
:004393F7 25FF000000              and eax, 000000FF
:004393FC 0C80                    or al, 80
:004393FE 50                      push eax
:004393FF 8B4D08                  mov ecx, dword ptr [ebp+08]
:00439402 51                      push ecx
:00439403 8B8D5CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF5C]
:00439409 E878D1FFFF              call 00436586
:0043940E C78564FFFFFF48C74A00    mov dword ptr [ebp+FFFFFF64], 004AC748
:00439418 EB0F                    jmp 00439429

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043950C(U)
|
:0043941A 8B9564FFFFFF            mov edx, dword ptr [ebp+FFFFFF64]
:00439420 83C201                  add edx, 00000001
:00439423 899564FFFFFF            mov dword ptr [ebp+FFFFFF64], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439418(U)
|
:00439429 8B8564FFFFFF            mov eax, dword ptr [ebp+FFFFFF64]
:0043942F 33C9                    xor ecx, ecx
:00439431 8A08                    mov cl, byte ptr [eax]
:00439433 81F9FF000000            cmp ecx, 000000FF
:00439439 0F84D2000000            je 00439511
:0043943F 8B5508                  mov edx, dword ptr [ebp+08]
:00439442 52                      push edx
:00439443 E849C5FFFF              call 00435991
:00439448 83C404                  add esp, 00000004
:0043944B 50                      push eax
:0043944C 8B4508                  mov eax, dword ptr [ebp+08]
:0043944F 668B08                  mov cx, word ptr [eax]
:00439452 51                      push ecx
:00439453 8B5588                  mov edx, dword ptr [ebp-78]
:00439456 8A02                    mov al, byte ptr [edx]
:00439458 50                      push eax
:00439459 8B8D64FFFFFF            mov ecx, dword ptr [ebp+FFFFFF64]
:0043945F 8A11                    mov dl, byte ptr [ecx]
:00439461 52                      push edx
:00439462 8B8D5CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF5C]
:00439468 E841010000              call 004395AE
:0043946D 898560FFFFFF            mov dword ptr [ebp+FFFFFF60], eax
:00439473 81BD60FFFFFFFF000000    cmp dword ptr [ebp+FFFFFF60], 000000FF
:0043947D 7E0C                    jle 0043948B
:0043947F C78558FFFFFFFF000000    mov dword ptr [ebp+FFFFFF58], 000000FF
:00439489 EB0C                    jmp 00439497

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043947D(C)
|
:0043948B 8B8560FFFFFF            mov eax, dword ptr [ebp+FFFFFF60]
:00439491 898558FFFFFF            mov dword ptr [ebp+FFFFFF58], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439489(U)
|
:00439497 8B8D58FFFFFF            mov ecx, dword ptr [ebp+FFFFFF58]
:0043949D 898D60FFFFFF            mov dword ptr [ebp+FFFFFF60], ecx
:004394A3 83BD60FFFFFF00          cmp dword ptr [ebp+FFFFFF60], 00000000
:004394AA 7628                    jbe 004394D4
:004394AC 8B9564FFFFFF            mov edx, dword ptr [ebp+FFFFFF64]
:004394B2 33C0                    xor eax, eax
:004394B4 8A02                    mov al, byte ptr [edx]
:004394B6 8B8D5CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF5C]
:004394BC 33D2                    xor edx, edx
:004394BE 8A5108                  mov dl, byte ptr [ecx+08]
:004394C1 3BC2                    cmp eax, edx
:004394C3 750F                    jne 004394D4
:004394C5 8B8560FFFFFF            mov eax, dword ptr [ebp+FFFFFF60]
:004394CB 83C00A                  add eax, 0000000A
:004394CE 898560FFFFFF            mov dword ptr [ebp+FFFFFF60], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004394AA(C), :004394C3(C)
|
:004394D4 8B8D78FFFFFF            mov ecx, dword ptr [ebp+FFFFFF78]
:004394DA 81E1FF000000            and ecx, 000000FF
:004394E0 3B8D60FFFFFF            cmp ecx, dword ptr [ebp+FFFFFF60]
:004394E6 7324                    jnb 0043950C
:004394E8 8A9560FFFFFF            mov dl, byte ptr [ebp+FFFFFF60]
:004394EE 889578FFFFFF            mov byte ptr [ebp+FFFFFF78], dl
:004394F4 8B8564FFFFFF            mov eax, dword ptr [ebp+FFFFFF64]
:004394FA 8A08                    mov cl, byte ptr [eax]
:004394FC 880D2C2C4B00            mov byte ptr [004B2C2C], cl
:00439502 8B5588                  mov edx, dword ptr [ebp-78]
:00439505 8A02                    mov al, byte ptr [edx]
:00439507 A2402C4B00              mov byte ptr [004B2C40], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004394E6(C)
|
:0043950C E909FFFFFF              jmp 0043941A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004393DD(U), :00439439(C)
|
:00439511 E920FDFFFF              jmp 00439236

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043924C(C)
|
:00439516 8A8578FFFFFF            mov al, byte ptr [ebp+FFFFFF78]
:0043951C 8BE5                    mov esp, ebp
:0043951E 5D                      pop ebp
:0043951F C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:004392D4   , :00439674   
|
:00439522 55                      push ebp
:00439523 8BEC                    mov ebp, esp
:00439525 51                      push ecx
:00439526 C645FC00                mov [ebp-04], 00
:0043952A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043952D 81E1FF000000            and ecx, 000000FF
:00439533 6BC946                  imul ecx, 00000046
:00439536 81C1C0F44A00            add ecx, 004AF4C0
:0043953C E80FC6FEFF              call 00425B50
:00439541 25FF000000              and eax, 000000FF
:00439546 85C0                    test eax, eax
:00439548 7425                    je 0043956F
:0043954A 8B4508                  mov eax, dword ptr [ebp+08]
:0043954D 25FF000000              and eax, 000000FF
:00439552 83F827                  cmp eax, 00000027
:00439555 7C14                    jl 0043956B
:00439557 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043955A 81E1FF000000            and ecx, 000000FF
:00439560 83F939                  cmp ecx, 00000039
:00439563 7F06                    jg 0043956B
:00439565 C645FC02                mov [ebp-04], 02
:00439569 EB04                    jmp 0043956F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00439555(C), :00439563(C)
|
:0043956B C645FC01                mov [ebp-04], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00439548(C), :00439569(U)
|
:0043956F 8A45FC                  mov al, byte ptr [ebp-04]
:00439572 8BE5                    mov esp, ebp
:00439574 5D                      pop ebp
:00439575 C3                      ret



* Referenced by a CALL at Address:
|:00439275   
|
:00439576 55                      push ebp
:00439577 8BEC                    mov ebp, esp
:00439579 8B4508                  mov eax, dword ptr [ebp+08]
:0043957C 25FF000000              and eax, 000000FF
:00439581 83F826                  cmp eax, 00000026
:00439584 7F04                    jg 0043958A
:00439586 32C0                    xor al, al
:00439588 EB22                    jmp 004395AC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439584(C)
|
:0043958A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043958D 81E1FF000000            and ecx, 000000FF
:00439593 83F940                  cmp ecx, 00000040
:00439596 7C12                    jl 004395AA
:00439598 8B5508                  mov edx, dword ptr [ebp+08]
:0043959B 81E2FF000000            and edx, 000000FF
:004395A1 83FA43                  cmp edx, 00000043
:004395A4 7F04                    jg 004395AA
:004395A6 32C0                    xor al, al
:004395A8 EB02                    jmp 004395AC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00439596(C), :004395A4(C)
|
:004395AA B001                    mov al, 01

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00439588(U), :004395A8(U)
|
:004395AC 5D                      pop ebp
:004395AD C3                      ret



* Referenced by a CALL at Addresses:
|:00439362   , :00439468   
|
:004395AE 55                      push ebp
:004395AF 8BEC                    mov ebp, esp
:004395B1 81ECC0000000            sub esp, 000000C0
:004395B7 56                      push esi
:004395B8 898D50FFFFFF            mov dword ptr [ebp+FFFFFF50], ecx
:004395BE 8B8550FFFFFF            mov eax, dword ptr [ebp+FFFFFF50]
:004395C4 8B08                    mov ecx, dword ptr [eax]
:004395C6 6BC948                  imul ecx, 00000048
:004395C9 81C1681B4A00            add ecx, 004A1B68
:004395CF 898D54FFFFFF            mov dword ptr [ebp+FFFFFF54], ecx
:004395D5 8B4D08                  mov ecx, dword ptr [ebp+08]
:004395D8 81E1FF000000            and ecx, 000000FF
:004395DE 6BC924                  imul ecx, 00000024
:004395E1 81C1502C4B00            add ecx, 004B2C50
:004395E7 E884600200              call 0045F670
:004395EC 6BC048                  imul eax, 00000048
:004395EF 05681B4A00              add eax, 004A1B68
:004395F4 898574FFFFFF            mov dword ptr [ebp+FFFFFF74], eax
:004395FA 8B4D08                  mov ecx, dword ptr [ebp+08]
:004395FD 81E1FF000000            and ecx, 000000FF
:00439603 6BC924                  imul ecx, 00000024
:00439606 81C1502C4B00            add ecx, 004B2C50
:0043960C E84F9DFCFF              call 00403360
:00439611 668B10                  mov dx, word ptr [eax]
:00439614 66899568FFFFFF          mov word ptr [ebp+FFFFFF68], dx
:0043961B 8D8568FFFFFF            lea eax, dword ptr [ebp+FFFFFF68]
:00439621 50                      push eax
:00439622 E86AC3FFFF              call 00435991
:00439627 83C404                  add esp, 00000004
:0043962A 88855CFFFFFF            mov byte ptr [ebp+FFFFFF5C], al
:00439630 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00439633 81E1FF000000            and ecx, 000000FF
:00439639 6BC946                  imul ecx, 00000046
:0043963C 81C1C0F44A00            add ecx, 004AF4C0
:00439642 E849F6FDFF              call 00418C90
:00439647 888570FFFFFF            mov byte ptr [ebp+FFFFFF70], al
:0043964D 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00439650 81E1FF000000            and ecx, 000000FF
:00439656 6BC946                  imul ecx, 00000046
:00439659 81C1C0F44A00            add ecx, 004AF4C0
:0043965F E8ECC4FEFF              call 00425B50
:00439664 8845F8                  mov byte ptr [ebp-08], al
:00439667 8D4D84                  lea ecx, dword ptr [ebp-7C]
:0043966A 898D60FFFFFF            mov dword ptr [ebp+FFFFFF60], ecx
:00439670 8A550C                  mov dl, byte ptr [ebp+0C]
:00439673 52                      push edx
:00439674 E8A9FEFFFF              call 00439522
:00439679 83C404                  add esp, 00000004
:0043967C 888564FFFFFF            mov byte ptr [ebp+FFFFFF64], al
:00439682 C68558FFFFFF00          mov byte ptr [ebp+FFFFFF58], 00
:00439689 C7856CFFFFFF00000000    mov dword ptr [ebp+FFFFFF6C], 00000000
:00439693 8B4D08                  mov ecx, dword ptr [ebp+08]
:00439696 81E1FF000000            and ecx, 000000FF
:0043969C 6BC924                  imul ecx, 00000024
:0043969F 81C1502C4B00            add ecx, 004B2C50
:004396A5 E8E6950300              call 00472C90
:004396AA 8BF0                    mov esi, eax
:004396AC 6BF664                  imul esi, 00000064
:004396AF 8B8D74FFFFFF            mov ecx, dword ptr [ebp+FFFFFF74]
:004396B5 E861DBFCFF              call 0040721B
:004396BA 8BC8                    mov ecx, eax
:004396BC 8BC6                    mov eax, esi
:004396BE 33D2                    xor edx, edx
:004396C0 F7F1                    div ecx
:004396C2 884580                  mov byte ptr [ebp-80], al
:004396C5 C78578FFFFFF00000000    mov dword ptr [ebp+FFFFFF78], 00000000
:004396CF C7856CFFFFFF00000000    mov dword ptr [ebp+FFFFFF6C], 00000000
:004396D9 EB0F                    jmp 004396EA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004396FE(U)
|
:004396DB 8B956CFFFFFF            mov edx, dword ptr [ebp+FFFFFF6C]
:004396E1 83C201                  add edx, 00000001
:004396E4 89956CFFFFFF            mov dword ptr [ebp+FFFFFF6C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004396D9(U)
|
:004396EA 83BD6CFFFFFF74          cmp dword ptr [ebp+FFFFFF6C], 00000074
:004396F1 730D                    jnb 00439700
:004396F3 8B856CFFFFFF            mov eax, dword ptr [ebp+FFFFFF6C]
:004396F9 C6440584FF              mov [ebp+eax-7C], FF
:004396FE EBDB                    jmp 004396DB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004396F1(C)
|
:00439700 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:00439706 81E1FF000000            and ecx, 000000FF
:0043970C 81F9FF000000            cmp ecx, 000000FF
:00439712 743E                    je 00439752
:00439714 8B9564FFFFFF            mov edx, dword ptr [ebp+FFFFFF64]
:0043971A 81E2FF000000            and edx, 000000FF
:00439720 85D2                    test edx, edx
:00439722 742E                    je 00439752
:00439724 68FF000000              push 000000FF
:00439729 68FF000000              push 000000FF
:0043972E 8D4584                  lea eax, dword ptr [ebp-7C]
:00439731 50                      push eax
:00439732 8A4DF8                  mov cl, byte ptr [ebp-08]
:00439735 51                      push ecx
:00439736 8A9564FFFFFF            mov dl, byte ptr [ebp+FFFFFF64]
:0043973C 52                      push edx
:0043973D 8A4508                  mov al, byte ptr [ebp+08]
:00439740 50                      push eax
:00439741 8B8D50FFFFFF            mov ecx, dword ptr [ebp+FFFFFF50]
:00439747 E861C3FFFF              call 00435AAD
:0043974C 898560FFFFFF            mov dword ptr [ebp+FFFFFF60], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00439712(C), :00439722(C)
|
:00439752 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:00439758 81E1FF000000            and ecx, 000000FF
:0043975E 81F9FF000000            cmp ecx, 000000FF
:00439764 7425                    je 0043978B
:00439766 8A550C                  mov dl, byte ptr [ebp+0C]
:00439769 52                      push edx
:0043976A 8A4508                  mov al, byte ptr [ebp+08]
:0043976D 50                      push eax
:0043976E 8B8D50FFFFFF            mov ecx, dword ptr [ebp+FFFFFF50]
:00439774 8A5104                  mov dl, byte ptr [ecx+04]
:00439777 52                      push edx
:00439778 E872F9FFFF              call 004390EF
:0043977D 83C40C                  add esp, 0000000C
:00439780 85C0                    test eax, eax
:00439782 7507                    jne 0043978B
:00439784 33C0                    xor eax, eax
:00439786 E9B6090000              jmp 0043A141

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00439764(C), :00439782(C)
|
:0043978B C7857CFFFFFF00000000    mov dword ptr [ebp+FFFFFF7C], 00000000
:00439795 C745FC00000000          mov [ebp-04], 00000000
:0043979C 8B450C                  mov eax, dword ptr [ebp+0C]
:0043979F 25FF000000              and eax, 000000FF
:004397A4 89854CFFFFFF            mov dword ptr [ebp+FFFFFF4C], eax
:004397AA 83BD4CFFFFFF39          cmp dword ptr [ebp+FFFFFF4C], 00000039
:004397B1 0F8784090000            ja 0043A13B
:004397B7 8B954CFFFFFF            mov edx, dword ptr [ebp+FFFFFF4C]
:004397BD 33C9                    xor ecx, ecx
:004397BF 8A8A80A14300            mov cl, byte ptr [edx+0043A180]
:004397C5 FF248D48A14300          jmp dword ptr [4*ecx+0043A148]
:004397CC 8A450C                  mov al, byte ptr [ebp+0C]
:004397CF 50                      push eax
:004397D0 8A4D08                  mov cl, byte ptr [ebp+08]
:004397D3 51                      push ecx
:004397D4 8B9550FFFFFF            mov edx, dword ptr [ebp+FFFFFF50]
:004397DA 8A4204                  mov al, byte ptr [edx+04]
:004397DD 50                      push eax
:004397DE E80CF9FFFF              call 004390EF
:004397E3 83C40C                  add esp, 0000000C
:004397E6 85C0                    test eax, eax
:004397E8 750F                    jne 004397F9
:004397EA C7857CFFFFFF00000000    mov dword ptr [ebp+FFFFFF7C], 00000000
:004397F4 E9E7010000              jmp 004399E0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004397E8(C)
|
:004397F9 6A00                    push 00000000
:004397FB 8A4D0C                  mov cl, byte ptr [ebp+0C]
:004397FE 51                      push ecx
:004397FF 8B9574FFFFFF            mov edx, dword ptr [ebp+FFFFFF74]
:00439805 52                      push edx
:00439806 8B4508                  mov eax, dword ptr [ebp+08]
:00439809 25FF000000              and eax, 000000FF
:0043980E 6BC024                  imul eax, 00000024
:00439811 05502C4B00              add eax, 004B2C50
:00439816 50                      push eax
:00439817 8B8D50FFFFFF            mov ecx, dword ptr [ebp+FFFFFF50]
:0043981D E888270000              call 0043BFAA
:00439822 8945FC                  mov dword ptr [ebp-04], eax
:00439825 8B4D08                  mov ecx, dword ptr [ebp+08]
:00439828 81E1FF000000            and ecx, 000000FF
:0043982E 6BC924                  imul ecx, 00000024
:00439831 81C1502C4B00            add ecx, 004B2C50
:00439837 E854940300              call 00472C90
:0043983C 3945FC                  cmp dword ptr [ebp-04], eax
:0043983F 720F                    jb 00439850
:00439841 C7857CFFFFFF4C000000    mov dword ptr [ebp+FFFFFF7C], 0000004C
:0043984B E958010000              jmp 004399A8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043983F(C)
|
:00439850 8B75FC                  mov esi, dword ptr [ebp-04]
:00439853 6BF60A                  imul esi, 0000000A
:00439856 8B8D74FFFFFF            mov ecx, dword ptr [ebp+FFFFFF74]
:0043985C E8BAD9FCFF              call 0040721B
:00439861 8BC8                    mov ecx, eax
:00439863 8BC6                    mov eax, esi
:00439865 33D2                    xor edx, edx
:00439867 F7F1                    div ecx
:00439869 83F803                  cmp eax, 00000003
:0043986C 720C                    jb 0043987A
:0043986E C7857CFFFFFF1E000000    mov dword ptr [ebp+FFFFFF7C], 0000001E
:00439878 EB34                    jmp 004398AE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043986C(C)
|
:0043987A 8B75FC                  mov esi, dword ptr [ebp-04]
:0043987D 6BF60A                  imul esi, 0000000A
:00439880 8B8D74FFFFFF            mov ecx, dword ptr [ebp+FFFFFF74]
:00439886 E890D9FCFF              call 0040721B
:0043988B 8BC8                    mov ecx, eax
:0043988D 8BC6                    mov eax, esi
:0043988F 33D2                    xor edx, edx
:00439891 F7F1                    div ecx
:00439893 83F801                  cmp eax, 00000001
:00439896 720C                    jb 004398A4
:00439898 C7857CFFFFFF0A000000    mov dword ptr [ebp+FFFFFF7C], 0000000A
:004398A2 EB0A                    jmp 004398AE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439896(C)
|
:004398A4 C7857CFFFFFF01000000    mov dword ptr [ebp+FFFFFF7C], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00439878(U), :004398A2(U)
|
:004398AE 8B550C                  mov edx, dword ptr [ebp+0C]
:004398B1 81E2FF000000            and edx, 000000FF
:004398B7 899548FFFFFF            mov dword ptr [ebp+FFFFFF48], edx
:004398BD 8B8548FFFFFF            mov eax, dword ptr [ebp+FFFFFF48]
:004398C3 83E814                  sub eax, 00000014
:004398C6 898548FFFFFF            mov dword ptr [ebp+FFFFFF48], eax
:004398CC 83BD48FFFFFF10          cmp dword ptr [ebp+FFFFFF48], 00000010
:004398D3 0F87CF000000            ja 004399A8
:004398D9 8B9548FFFFFF            mov edx, dword ptr [ebp+FFFFFF48]
:004398DF 33C9                    xor ecx, ecx
:004398E1 8A8ACAA14300            mov cl, byte ptr [edx+0043A1CA]
:004398E7 FF248DBAA14300          jmp dword ptr [4*ecx+0043A1BA]
:004398EE 8B4580                  mov eax, dword ptr [ebp-80]
:004398F1 25FF000000              and eax, 000000FF
:004398F6 83F828                  cmp eax, 00000028
:004398F9 7C0F                    jl 0043990A
:004398FB 8B8D7CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF7C]
:00439901 83C108                  add ecx, 00000008
:00439904 898D7CFFFFFF            mov dword ptr [ebp+FFFFFF7C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004398F9(C)
|
:0043990A E999000000              jmp 004399A8
:0043990F 6A01                    push 00000001
:00439911 8B4D08                  mov ecx, dword ptr [ebp+08]
:00439914 81E1FF000000            and ecx, 000000FF
:0043991A 6BC924                  imul ecx, 00000024
:0043991D 81C1502C4B00            add ecx, 004B2C50
:00439923 E8485D0200              call 0045F670
:00439928 50                      push eax
:00439929 8B8D50FFFFFF            mov ecx, dword ptr [ebp+FFFFFF50]
:0043992F E83C5D0200              call 0045F670
:00439934 50                      push eax
:00439935 B9F05D4B00              mov ecx, 004B5DF0
:0043993A E88B160200              call 0045AFCA
:0043993F 85C0                    test eax, eax
:00439941 750F                    jne 00439952
:00439943 8B957CFFFFFF            mov edx, dword ptr [ebp+FFFFFF7C]
:00439949 83C20A                  add edx, 0000000A
:0043994C 89957CFFFFFF            mov dword ptr [ebp+FFFFFF7C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439941(C)
|
:00439952 EB54                    jmp 004399A8
:00439954 8B8D50FFFFFF            mov ecx, dword ptr [ebp+FFFFFF50]
:0043995A E831930300              call 00472C90
:0043995F 8BF0                    mov esi, eax
:00439961 8B8550FFFFFF            mov eax, dword ptr [ebp+FFFFFF50]
:00439967 8B08                    mov ecx, dword ptr [eax]
:00439969 6BC948                  imul ecx, 00000048
:0043996C 81C1681B4A00            add ecx, 004A1B68
:00439972 E8A4D8FCFF              call 0040721B
:00439977 3BF0                    cmp esi, eax
:00439979 730F                    jnb 0043998A
:0043997B 8B8D7CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF7C]
:00439981 83C105                  add ecx, 00000005
:00439984 898D7CFFFFFF            mov dword ptr [ebp+FFFFFF7C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439979(C)
|
:0043998A 8B8D50FFFFFF            mov ecx, dword ptr [ebp+FFFFFF50]
:00439990 E85F080000              call 0043A1F4
:00439995 85C0                    test eax, eax
:00439997 740F                    je 004399A8
:00439999 8B957CFFFFFF            mov edx, dword ptr [ebp+FFFFFF7C]
:0043999F 83C20A                  add edx, 0000000A
:004399A2 89957CFFFFFF            mov dword ptr [ebp+FFFFFF7C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043984B(U), :004398D3(C), :0043990A(U), :00439952(U), :00439997(C)
|
:004399A8 8B45F8                  mov eax, dword ptr [ebp-08]
:004399AB 25FF000000              and eax, 000000FF
:004399B0 85C0                    test eax, eax
:004399B2 742C                    je 004399E0
:004399B4 8A4D0C                  mov cl, byte ptr [ebp+0C]
:004399B7 51                      push ecx
:004399B8 8B9550FFFFFF            mov edx, dword ptr [ebp+FFFFFF50]
:004399BE 8A4204                  mov al, byte ptr [edx+04]
:004399C1 50                      push eax
:004399C2 6A00                    push 00000000
:004399C4 8B8D7CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF7C]
:004399CA 51                      push ecx
:004399CB 8B9560FFFFFF            mov edx, dword ptr [ebp+FFFFFF60]
:004399D1 52                      push edx
:004399D2 E8BFF3FFFF              call 00438D96
:004399D7 83C414                  add esp, 00000014
:004399DA 89857CFFFFFF            mov dword ptr [ebp+FFFFFF7C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004397F4(U), :004399B2(C)
|
:004399E0 E956070000              jmp 0043A13B
:004399E5 8A450C                  mov al, byte ptr [ebp+0C]
:004399E8 50                      push eax
:004399E9 8A4D08                  mov cl, byte ptr [ebp+08]
:004399EC 51                      push ecx
:004399ED 8B9550FFFFFF            mov edx, dword ptr [ebp+FFFFFF50]
:004399F3 8A4204                  mov al, byte ptr [edx+04]
:004399F6 50                      push eax
:004399F7 E8F3F6FFFF              call 004390EF
:004399FC 83C40C                  add esp, 0000000C
:004399FF 85C0                    test eax, eax
:00439A01 750F                    jne 00439A12
:00439A03 C7857CFFFFFF00000000    mov dword ptr [ebp+FFFFFF7C], 00000000
:00439A0D E997000000              jmp 00439AA9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439A01(C)
|
:00439A12 8A4D0C                  mov cl, byte ptr [ebp+0C]
:00439A15 51                      push ecx
:00439A16 8B5508                  mov edx, dword ptr [ebp+08]
:00439A19 81E2FF000000            and edx, 000000FF
:00439A1F 6BD224                  imul edx, 00000024
:00439A22 81C2502C4B00            add edx, 004B2C50
:00439A28 52                      push edx
:00439A29 6A00                    push 00000000
:00439A2B 8B8550FFFFFF            mov eax, dword ptr [ebp+FFFFFF50]
:00439A31 33C9                    xor ecx, ecx
:00439A33 8A4804                  mov cl, byte ptr [eax+04]
:00439A36 6BC924                  imul ecx, 00000024
:00439A39 81C1502C4B00            add ecx, 004B2C50
:00439A3F E8FB1C0000              call 0043B73F
:00439A44 83F823                  cmp eax, 00000023
:00439A47 7260                    jb 00439AA9
:00439A49 C7857CFFFFFF0F000000    mov dword ptr [ebp+FFFFFF7C], 0000000F
:00439A53 8B5580                  mov edx, dword ptr [ebp-80]
:00439A56 81E2FF000000            and edx, 000000FF
:00439A5C 83FA50                  cmp edx, 00000050
:00439A5F 7C0F                    jl 00439A70
:00439A61 8B857CFFFFFF            mov eax, dword ptr [ebp+FFFFFF7C]
:00439A67 83C00F                  add eax, 0000000F
:00439A6A 89857CFFFFFF            mov dword ptr [ebp+FFFFFF7C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439A5F(C)
|
:00439A70 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00439A73 81E1FF000000            and ecx, 000000FF
:00439A79 85C9                    test ecx, ecx
:00439A7B 742C                    je 00439AA9
:00439A7D 8A550C                  mov dl, byte ptr [ebp+0C]
:00439A80 52                      push edx
:00439A81 8B8550FFFFFF            mov eax, dword ptr [ebp+FFFFFF50]
:00439A87 8A4804                  mov cl, byte ptr [eax+04]
:00439A8A 51                      push ecx
:00439A8B 6A00                    push 00000000
:00439A8D 8B957CFFFFFF            mov edx, dword ptr [ebp+FFFFFF7C]
:00439A93 52                      push edx
:00439A94 8B8560FFFFFF            mov eax, dword ptr [ebp+FFFFFF60]
:00439A9A 50                      push eax
:00439A9B E8F6F2FFFF              call 00438D96
:00439AA0 83C414                  add esp, 00000014
:00439AA3 89857CFFFFFF            mov dword ptr [ebp+FFFFFF7C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00439A0D(U), :00439A47(C), :00439A7B(C)
|
:00439AA9 E98D060000              jmp 0043A13B
:00439AAE 8A4D0C                  mov cl, byte ptr [ebp+0C]
:00439AB1 51                      push ecx
:00439AB2 8A5508                  mov dl, byte ptr [ebp+08]
:00439AB5 52                      push edx
:00439AB6 8B8550FFFFFF            mov eax, dword ptr [ebp+FFFFFF50]
:00439ABC 8A4804                  mov cl, byte ptr [eax+04]
:00439ABF 51                      push ecx
:00439AC0 E82AF6FFFF              call 004390EF
:00439AC5 83C40C                  add esp, 0000000C
:00439AC8 85C0                    test eax, eax
:00439ACA 750C                    jne 00439AD8
:00439ACC C7857CFFFFFF00000000    mov dword ptr [ebp+FFFFFF7C], 00000000
:00439AD6 EB6D                    jmp 00439B45

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439ACA(C)
|
:00439AD8 8B4D08                  mov ecx, dword ptr [ebp+08]
:00439ADB 81E1FF000000            and ecx, 000000FF
:00439AE1 6BC924                  imul ecx, 00000024
:00439AE4 81C1502C4B00            add ecx, 004B2C50
:00439AEA E805070000              call 0043A1F4
:00439AEF 85C0                    test eax, eax
:00439AF1 7448                    je 00439B3B
:00439AF3 C7857CFFFFFF32000000    mov dword ptr [ebp+FFFFFF7C], 00000032
:00439AFD 8B550C                  mov edx, dword ptr [ebp+0C]
:00439B00 81E2FF000000            and edx, 000000FF
:00439B06 83FA28                  cmp edx, 00000028
:00439B09 7511                    jne 00439B1C
:00439B0B 8B857CFFFFFF            mov eax, dword ptr [ebp+FFFFFF7C]
:00439B11 83C005                  add eax, 00000005
:00439B14 89857CFFFFFF            mov dword ptr [ebp+FFFFFF7C], eax
:00439B1A EB1D                    jmp 00439B39

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439B09(C)
|
:00439B1C 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00439B1F 81E1FF000000            and ecx, 000000FF
:00439B25 83F92B                  cmp ecx, 0000002B
:00439B28 750F                    jne 00439B39
:00439B2A 8B957CFFFFFF            mov edx, dword ptr [ebp+FFFFFF7C]
:00439B30 83C20A                  add edx, 0000000A
:00439B33 89957CFFFFFF            mov dword ptr [ebp+FFFFFF7C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00439B1A(U), :00439B28(C)
|
:00439B39 EB0A                    jmp 00439B45

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439AF1(C)
|
:00439B3B C7857CFFFFFF00000000    mov dword ptr [ebp+FFFFFF7C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00439AD6(U), :00439B39(U)
|
:00439B45 E9F1050000              jmp 0043A13B
:00439B4A 8A450C                  mov al, byte ptr [ebp+0C]
:00439B4D 50                      push eax
:00439B4E 8A4D08                  mov cl, byte ptr [ebp+08]
:00439B51 51                      push ecx
:00439B52 8B9550FFFFFF            mov edx, dword ptr [ebp+FFFFFF50]
:00439B58 8A4204                  mov al, byte ptr [edx+04]
:00439B5B 50                      push eax
:00439B5C E88EF5FFFF              call 004390EF
:00439B61 83C40C                  add esp, 0000000C
:00439B64 85C0                    test eax, eax
:00439B66 750C                    jne 00439B74
:00439B68 C7857CFFFFFF00000000    mov dword ptr [ebp+FFFFFF7C], 00000000
:00439B72 EB6A                    jmp 00439BDE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439B66(C)
|
:00439B74 8B4D08                  mov ecx, dword ptr [ebp+08]
:00439B77 81E1FF000000            and ecx, 000000FF
:00439B7D 6BC924                  imul ecx, 00000024
:00439B80 81C1502C4B00            add ecx, 004B2C50
:00439B86 E869060000              call 0043A1F4
:00439B8B 85C0                    test eax, eax
:00439B8D 740C                    je 00439B9B
:00439B8F C7857CFFFFFF32000000    mov dword ptr [ebp+FFFFFF7C], 00000032
:00439B99 EB0A                    jmp 00439BA5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439B8D(C)
|
:00439B9B C7857CFFFFFF00000000    mov dword ptr [ebp+FFFFFF7C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439B99(U)
|
:00439BA5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00439BA8 81E1FF000000            and ecx, 000000FF
:00439BAE 85C9                    test ecx, ecx
:00439BB0 742C                    je 00439BDE
:00439BB2 8A550C                  mov dl, byte ptr [ebp+0C]
:00439BB5 52                      push edx
:00439BB6 8B8550FFFFFF            mov eax, dword ptr [ebp+FFFFFF50]
:00439BBC 8A4804                  mov cl, byte ptr [eax+04]
:00439BBF 51                      push ecx
:00439BC0 6A01                    push 00000001
:00439BC2 8B957CFFFFFF            mov edx, dword ptr [ebp+FFFFFF7C]
:00439BC8 52                      push edx
:00439BC9 8B8560FFFFFF            mov eax, dword ptr [ebp+FFFFFF60]
:00439BCF 50                      push eax
:00439BD0 E8C1F1FFFF              call 00438D96
:00439BD5 83C414                  add esp, 00000014
:00439BD8 89857CFFFFFF            mov dword ptr [ebp+FFFFFF7C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00439B72(U), :00439BB0(C)
|
:00439BDE E958050000              jmp 0043A13B
:00439BE3 8A4D0C                  mov cl, byte ptr [ebp+0C]
:00439BE6 51                      push ecx
:00439BE7 8A5508                  mov dl, byte ptr [ebp+08]
:00439BEA 52                      push edx
:00439BEB 8B8550FFFFFF            mov eax, dword ptr [ebp+FFFFFF50]
:00439BF1 8A4804                  mov cl, byte ptr [eax+04]
:00439BF4 51                      push ecx
:00439BF5 E8F5F4FFFF              call 004390EF
:00439BFA 83C40C                  add esp, 0000000C
:00439BFD 85C0                    test eax, eax
:00439BFF 750F                    jne 00439C10
:00439C01 C7857CFFFFFF00000000    mov dword ptr [ebp+FFFFFF7C], 00000000
:00439C0B E912010000              jmp 00439D22

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439BFF(C)
|
:00439C10 C7857CFFFFFF05000000    mov dword ptr [ebp+FFFFFF7C], 00000005
:00439C1A 8B4D08                  mov ecx, dword ptr [ebp+08]
:00439C1D 81E1FF000000            and ecx, 000000FF
:00439C23 6BC924                  imul ecx, 00000024
:00439C26 81C1502C4B00            add ecx, 004B2C50
:00439C2C E8FF43FEFF              call 0041E030
:00439C31 888544FFFFFF            mov byte ptr [ebp+FFFFFF44], al
:00439C37 80BD44FFFFFF02          cmp byte ptr [ebp+FFFFFF44], 02
:00439C3E 741B                    je 00439C5B
:00439C40 80BD44FFFFFF04          cmp byte ptr [ebp+FFFFFF44], 04
:00439C47 7465                    je 00439CAE
:00439C49 80BD44FFFFFF08          cmp byte ptr [ebp+FFFFFF44], 08
:00439C50 0F8484000000            je 00439CDA
:00439C56 E98E000000              jmp 00439CE9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439C3E(C)
|
:00439C5B 8B4D08                  mov ecx, dword ptr [ebp+08]
:00439C5E 81E1FF000000            and ecx, 000000FF
:00439C64 6BC924                  imul ecx, 00000024
:00439C67 81C1502C4B00            add ecx, 004B2C50
:00439C6D E85EBEFEFF              call 00425AD0
:00439C72 25FF000000              and eax, 000000FF
:00439C77 83F803                  cmp eax, 00000003
:00439C7A 7430                    je 00439CAC
:00439C7C 8B4D08                  mov ecx, dword ptr [ebp+08]
:00439C7F 81E1FF000000            and ecx, 000000FF
:00439C85 6BC924                  imul ecx, 00000024
:00439C88 81C1502C4B00            add ecx, 004B2C50
:00439C8E E83DBEFEFF              call 00425AD0
:00439C93 25FF000000              and eax, 000000FF
:00439C98 83F802                  cmp eax, 00000002
:00439C9B 740F                    je 00439CAC
:00439C9D 8B957CFFFFFF            mov edx, dword ptr [ebp+FFFFFF7C]
:00439CA3 83C219                  add edx, 00000019
:00439CA6 89957CFFFFFF            mov dword ptr [ebp+FFFFFF7C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00439C7A(C), :00439C9B(C)
|
:00439CAC EB3B                    jmp 00439CE9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439C47(C)
|
:00439CAE 8B4D08                  mov ecx, dword ptr [ebp+08]
:00439CB1 81E1FF000000            and ecx, 000000FF
:00439CB7 6BC924                  imul ecx, 00000024
:00439CBA 81C1502C4B00            add ecx, 004B2C50
:00439CC0 E828630000              call 0043FFED
:00439CC5 85C0                    test eax, eax
:00439CC7 740F                    je 00439CD8
:00439CC9 8B857CFFFFFF            mov eax, dword ptr [ebp+FFFFFF7C]
:00439CCF 83C01E                  add eax, 0000001E
:00439CD2 89857CFFFFFF            mov dword ptr [ebp+FFFFFF7C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439CC7(C)
|
:00439CD8 EB0F                    jmp 00439CE9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439C50(C)
|
:00439CDA 8B8D7CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF7C]
:00439CE0 83C123                  add ecx, 00000023
:00439CE3 898D7CFFFFFF            mov dword ptr [ebp+FFFFFF7C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00439C56(U), :00439CAC(U), :00439CD8(U)
|
:00439CE9 8B55F8                  mov edx, dword ptr [ebp-08]
:00439CEC 81E2FF000000            and edx, 000000FF
:00439CF2 85D2                    test edx, edx
:00439CF4 742C                    je 00439D22
:00439CF6 8A450C                  mov al, byte ptr [ebp+0C]
:00439CF9 50                      push eax
:00439CFA 8B8D50FFFFFF            mov ecx, dword ptr [ebp+FFFFFF50]
:00439D00 8A5104                  mov dl, byte ptr [ecx+04]
:00439D03 52                      push edx
:00439D04 6A05                    push 00000005
:00439D06 8B857CFFFFFF            mov eax, dword ptr [ebp+FFFFFF7C]
:00439D0C 50                      push eax
:00439D0D 8B8D60FFFFFF            mov ecx, dword ptr [ebp+FFFFFF60]
:00439D13 51                      push ecx
:00439D14 E87DF0FFFF              call 00438D96
:00439D19 83C414                  add esp, 00000014
:00439D1C 89857CFFFFFF            mov dword ptr [ebp+FFFFFF7C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00439C0B(U), :00439CF4(C)
|
:00439D22 E914040000              jmp 0043A13B
:00439D27 8A550C                  mov dl, byte ptr [ebp+0C]
:00439D2A 52                      push edx
:00439D2B 8A4508                  mov al, byte ptr [ebp+08]
:00439D2E 50                      push eax
:00439D2F 8B8D50FFFFFF            mov ecx, dword ptr [ebp+FFFFFF50]
:00439D35 8A5104                  mov dl, byte ptr [ecx+04]
:00439D38 52                      push edx
:00439D39 E8B1F3FFFF              call 004390EF
:00439D3E 83C40C                  add esp, 0000000C
:00439D41 85C0                    test eax, eax
:00439D43 750C                    jne 00439D51
:00439D45 C7857CFFFFFF00000000    mov dword ptr [ebp+FFFFFF7C], 00000000
:00439D4F EB59                    jmp 00439DAA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439D43(C)
|
:00439D51 8B8550FFFFFF            mov eax, dword ptr [ebp+FFFFFF50]
:00439D57 33C9                    xor ecx, ecx
:00439D59 8A4804                  mov cl, byte ptr [eax+04]
:00439D5C 6BC924                  imul ecx, 00000024
:00439D5F 81C1502C4B00            add ecx, 004B2C50
:00439D65 E8D68A0300              call 00472840
:00439D6A 8BF0                    mov esi, eax
:00439D6C 8B8D54FFFFFF            mov ecx, dword ptr [ebp+FFFFFF54]
:00439D72 E8D3D4FCFF              call 0040724A
:00439D77 33D2                    xor edx, edx
:00439D79 B905000000              mov ecx, 00000005
:00439D7E F7F1                    div ecx
:00439D80 3BF0                    cmp esi, eax
:00439D82 7726                    ja 00439DAA
:00439D84 8B4D08                  mov ecx, dword ptr [ebp+08]
:00439D87 81E1FF000000            and ecx, 000000FF
:00439D8D 6BC924                  imul ecx, 00000024
:00439D90 81C1502C4B00            add ecx, 004B2C50
:00439D96 E8A58A0300              call 00472840
:00439D9B 83F81E                  cmp eax, 0000001E
:00439D9E 720A                    jb 00439DAA
:00439DA0 C7857CFFFFFF14000000    mov dword ptr [ebp+FFFFFF7C], 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00439D4F(U), :00439D82(C), :00439D9E(C)
|
:00439DAA E98C030000              jmp 0043A13B
:00439DAF 8A550C                  mov dl, byte ptr [ebp+0C]
:00439DB2 52                      push edx
:00439DB3 8A4508                  mov al, byte ptr [ebp+08]
:00439DB6 50                      push eax
:00439DB7 8B8D50FFFFFF            mov ecx, dword ptr [ebp+FFFFFF50]
:00439DBD 8A5104                  mov dl, byte ptr [ecx+04]
:00439DC0 52                      push edx
:00439DC1 E829F3FFFF              call 004390EF
:00439DC6 83C40C                  add esp, 0000000C
:00439DC9 85C0                    test eax, eax
:00439DCB 750F                    jne 00439DDC
:00439DCD C7857CFFFFFF00000000    mov dword ptr [ebp+FFFFFF7C], 00000000
:00439DD7 E9A3000000              jmp 00439E7F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439DCB(C)
|
:00439DDC 8B8D74FFFFFF            mov ecx, dword ptr [ebp+FFFFFF74]
:00439DE2 E8E9D9FCFF              call 004077D0
:00439DE7 25FF000000              and eax, 000000FF
:00439DEC 898540FFFFFF            mov dword ptr [ebp+FFFFFF40], eax
:00439DF2 8B8540FFFFFF            mov eax, dword ptr [ebp+FFFFFF40]
:00439DF8 83E808                  sub eax, 00000008
:00439DFB 898540FFFFFF            mov dword ptr [ebp+FFFFFF40], eax
:00439E01 83BD40FFFFFF0C          cmp dword ptr [ebp+FFFFFF40], 0000000C
:00439E08 7775                    ja 00439E7F
:00439E0A 8B9540FFFFFF            mov edx, dword ptr [ebp+FFFFFF40]
:00439E10 33C9                    xor ecx, ecx
:00439E12 8A8AE7A14300            mov cl, byte ptr [edx+0043A1E7]
:00439E18 FF248DDBA14300          jmp dword ptr [4*ecx+0043A1DB]
:00439E1F 8A450C                  mov al, byte ptr [ebp+0C]
:00439E22 50                      push eax
:00439E23 8B4D08                  mov ecx, dword ptr [ebp+08]
:00439E26 81E1FF000000            and ecx, 000000FF
:00439E2C 6BC924                  imul ecx, 00000024
:00439E2F 81C1502C4B00            add ecx, 004B2C50
:00439E35 51                      push ecx
:00439E36 6A00                    push 00000000
:00439E38 8B9550FFFFFF            mov edx, dword ptr [ebp+FFFFFF50]
:00439E3E 33C0                    xor eax, eax
:00439E40 8A4204                  mov al, byte ptr [edx+04]
:00439E43 8BC8                    mov ecx, eax
:00439E45 6BC924                  imul ecx, 00000024
:00439E48 81C1502C4B00            add ecx, 004B2C50
:00439E4E E8EC180000              call 0043B73F
:00439E53 83F83C                  cmp eax, 0000003C
:00439E56 7227                    jb 00439E7F
:00439E58 C7857CFFFFFF0F000000    mov dword ptr [ebp+FFFFFF7C], 0000000F
:00439E62 8B4D80                  mov ecx, dword ptr [ebp-80]
:00439E65 81E1FF000000            and ecx, 000000FF
:00439E6B 83F950                  cmp ecx, 00000050
:00439E6E 7C0F                    jl 00439E7F
:00439E70 8B957CFFFFFF            mov edx, dword ptr [ebp+FFFFFF7C]
:00439E76 83C207                  add edx, 00000007
:00439E79 89957CFFFFFF            mov dword ptr [ebp+FFFFFF7C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00439DD7(U), :00439E08(C), :00439E56(C), :00439E6E(C)
|
:00439E7F E9B7020000              jmp 0043A13B
:00439E84 8A450C                  mov al, byte ptr [ebp+0C]
:00439E87 50                      push eax
:00439E88 8A4D08                  mov cl, byte ptr [ebp+08]
:00439E8B 51                      push ecx
:00439E8C 8B9550FFFFFF            mov edx, dword ptr [ebp+FFFFFF50]
:00439E92 8A4204                  mov al, byte ptr [edx+04]
:00439E95 50                      push eax
:00439E96 E854F2FFFF              call 004390EF
:00439E9B 83C40C                  add esp, 0000000C
:00439E9E 85C0                    test eax, eax
:00439EA0 750F                    jne 00439EB1
:00439EA2 C7857CFFFFFF00000000    mov dword ptr [ebp+FFFFFF7C], 00000000
:00439EAC E908010000              jmp 00439FB9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439EA0(C)
|
:00439EB1 8B4D08                  mov ecx, dword ptr [ebp+08]
:00439EB4 81E1FF000000            and ecx, 000000FF
:00439EBA 6BC924                  imul ecx, 00000024
:00439EBD 81C1502C4B00            add ecx, 004B2C50
:00439EC3 E878890300              call 00472840
:00439EC8 8BF0                    mov esi, eax
:00439ECA 8B8D74FFFFFF            mov ecx, dword ptr [ebp+FFFFFF74]
:00439ED0 E875D3FCFF              call 0040724A
:00439ED5 33D2                    xor edx, edx
:00439ED7 B905000000              mov ecx, 00000005
:00439EDC F7F1                    div ecx
:00439EDE 3BF0                    cmp esi, eax
:00439EE0 0F87D3000000            ja 00439FB9
:00439EE6 8B9550FFFFFF            mov edx, dword ptr [ebp+FFFFFF50]
:00439EEC 33C0                    xor eax, eax
:00439EEE 8A4204                  mov al, byte ptr [edx+04]
:00439EF1 8BC8                    mov ecx, eax
:00439EF3 6BC924                  imul ecx, 00000024
:00439EF6 81C1502C4B00            add ecx, 004B2C50
:00439EFC E83F890300              call 00472840
:00439F01 8BF0                    mov esi, eax
:00439F03 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00439F06 81E1FF000000            and ecx, 000000FF
:00439F0C 6BC946                  imul ecx, 00000046
:00439F0F 81C1C0F44A00            add ecx, 004AF4C0
:00439F15 E8B6BBFEFF              call 00425AD0
:00439F1A 25FF000000              and eax, 000000FF
:00439F1F 83C006                  add eax, 00000006
:00439F22 3BF0                    cmp esi, eax
:00439F24 0F828F000000            jb 00439FB9
:00439F2A 8B4D08                  mov ecx, dword ptr [ebp+08]
:00439F2D 81E1FF000000            and ecx, 000000FF
:00439F33 6BC924                  imul ecx, 00000024
:00439F36 81C1502C4B00            add ecx, 004B2C50
:00439F3C E82F150000              call 0043B470
:00439F41 25FF000000              and eax, 000000FF
:00439F46 83F809                  cmp eax, 00000009
:00439F49 750C                    jne 00439F57
:00439F4B C7857CFFFFFF01000000    mov dword ptr [ebp+FFFFFF7C], 00000001
:00439F55 EB62                    jmp 00439FB9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439F49(C)
|
:00439F57 8B4D08                  mov ecx, dword ptr [ebp+08]
:00439F5A 81E1FF000000            and ecx, 000000FF
:00439F60 6BC924                  imul ecx, 00000024
:00439F63 81C1502C4B00            add ecx, 004B2C50
:00439F69 E87F600000              call 0043FFED
:00439F6E 85C0                    test eax, eax
:00439F70 7511                    jne 00439F83
:00439F72 6A3C                    push 0000003C
:00439F74 8B8D74FFFFFF            mov ecx, dword ptr [ebp+FFFFFF74]
:00439F7A E88ADAFCFF              call 00407A09
:00439F7F 85C0                    test eax, eax
:00439F81 740C                    je 00439F8F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439F70(C)
|
:00439F83 C7857CFFFFFF0C000000    mov dword ptr [ebp+FFFFFF7C], 0000000C
:00439F8D EB2A                    jmp 00439FB9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439F81(C)
|
:00439F8F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00439F92 81E1FF000000            and ecx, 000000FF
:00439F98 6BC924                  imul ecx, 00000024
:00439F9B 81C1502C4B00            add ecx, 004B2C50
:00439FA1 E8CA140000              call 0043B470
:00439FA6 25FF000000              and eax, 000000FF
:00439FAB 85C0                    test eax, eax
:00439FAD 750A                    jne 00439FB9

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:00439FAF C7857CFFFFFF06000000    mov dword ptr [ebp+FFFFFF7C], 00000006

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00439EAC(U), :00439EE0(C), :00439F24(C), :00439F55(U), :00439F8D(U)
|:00439FAD(C)
|
:00439FB9 E97D010000              jmp 0043A13B
:00439FBE 8A4D0C                  mov cl, byte ptr [ebp+0C]
:00439FC1 51                      push ecx
:00439FC2 8A5508                  mov dl, byte ptr [ebp+08]
:00439FC5 52                      push edx
:00439FC6 8B8550FFFFFF            mov eax, dword ptr [ebp+FFFFFF50]
:00439FCC 8A4804                  mov cl, byte ptr [eax+04]
:00439FCF 51                      push ecx
:00439FD0 E81AF1FFFF              call 004390EF
:00439FD5 83C40C                  add esp, 0000000C
:00439FD8 85C0                    test eax, eax
:00439FDA 750F                    jne 00439FEB
:00439FDC C7857CFFFFFF00000000    mov dword ptr [ebp+FFFFFF7C], 00000000
:00439FE6 E950010000              jmp 0043A13B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439FDA(C)
|
:00439FEB 8B4D08                  mov ecx, dword ptr [ebp+08]
:00439FEE 81E1FF000000            and ecx, 000000FF
:00439FF4 6BC924                  imul ecx, 00000024
:00439FF7 81C1502C4B00            add ecx, 004B2C50
:00439FFD E8CEBAFEFF              call 00425AD0
:0043A002 25FF000000              and eax, 000000FF
:0043A007 83F803                  cmp eax, 00000003
:0043A00A 7421                    je 0043A02D
:0043A00C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043A00F 81E1FF000000            and ecx, 000000FF
:0043A015 6BC924                  imul ecx, 00000024
:0043A018 81C1502C4B00            add ecx, 004B2C50
:0043A01E E8ADBAFEFF              call 00425AD0
:0043A023 25FF000000              and eax, 000000FF
:0043A028 83F802                  cmp eax, 00000002
:0043A02B 750F                    jne 0043A03C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A00A(C)
|
:0043A02D C7857CFFFFFF00000000    mov dword ptr [ebp+FFFFFF7C], 00000000
:0043A037 E9FF000000              jmp 0043A13B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A02B(C)
|
:0043A03C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043A03F 81E1FF000000            and ecx, 000000FF
:0043A045 6BC924                  imul ecx, 00000024
:0043A048 81C1502C4B00            add ecx, 004B2C50
:0043A04E E81D140000              call 0043B470
:0043A053 25FF000000              and eax, 000000FF
:0043A058 83F809                  cmp eax, 00000009
:0043A05B 750F                    jne 0043A06C
:0043A05D C7857CFFFFFF00000000    mov dword ptr [ebp+FFFFFF7C], 00000000
:0043A067 E9CF000000              jmp 0043A13B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A05B(C)
|
:0043A06C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043A06F 81E1FF000000            and ecx, 000000FF
:0043A075 6BC924                  imul ecx, 00000024
:0043A078 81C1502C4B00            add ecx, 004B2C50
:0043A07E E8ED130000              call 0043B470
:0043A083 25FF000000              and eax, 000000FF
:0043A088 85C0                    test eax, eax
:0043A08A 750F                    jne 0043A09B
:0043A08C C7857CFFFFFF0F000000    mov dword ptr [ebp+FFFFFF7C], 0000000F
:0043A096 E9A0000000              jmp 0043A13B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A08A(C)
|
:0043A09B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043A09E 81E1FF000000            and ecx, 000000FF
:0043A0A4 6BC924                  imul ecx, 00000024
:0043A0A7 81C1502C4B00            add ecx, 004B2C50
:0043A0AD E8BE130000              call 0043B470
:0043A0B2 25FF000000              and eax, 000000FF
:0043A0B7 83F813                  cmp eax, 00000013
:0043A0BA 750C                    jne 0043A0C8
:0043A0BC C7857CFFFFFF0F000000    mov dword ptr [ebp+FFFFFF7C], 0000000F
:0043A0C6 EB73                    jmp 0043A13B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A0BA(C)
|
:0043A0C8 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043A0CB 81E1FF000000            and ecx, 000000FF
:0043A0D1 6BC924                  imul ecx, 00000024
:0043A0D4 81C1502C4B00            add ecx, 004B2C50
:0043A0DA E891130000              call 0043B470
:0043A0DF 25FF000000              and eax, 000000FF
:0043A0E4 83F805                  cmp eax, 00000005
:0043A0E7 7515                    jne 0043A0FE
:0043A0E9 6A04                    push 00000004
:0043A0EB E8235A0400              call 0047FB13
:0043A0F0 83C404                  add esp, 00000004
:0043A0F3 83C00A                  add eax, 0000000A
:0043A0F6 89857CFFFFFF            mov dword ptr [ebp+FFFFFF7C], eax
:0043A0FC EB3D                    jmp 0043A13B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A0E7(C)
|
:0043A0FE 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043A101 81E1FF000000            and ecx, 000000FF
:0043A107 6BC924                  imul ecx, 00000024
:0043A10A 81C1502C4B00            add ecx, 004B2C50
:0043A110 E85B130000              call 0043B470
:0043A115 25FF000000              and eax, 000000FF
:0043A11A 83F808                  cmp eax, 00000008
:0043A11D 750C                    jne 0043A12B
:0043A11F C7857CFFFFFF0A000000    mov dword ptr [ebp+FFFFFF7C], 0000000A
:0043A129 EB10                    jmp 0043A13B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A11D(C)
|
:0043A12B 6A05                    push 00000005
:0043A12D E8E1590400              call 0047FB13
:0043A132 83C404                  add esp, 00000004
:0043A135 89857CFFFFFF            mov dword ptr [ebp+FFFFFF7C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004397B1(C), :004399E0(U), :00439AA9(U), :00439B45(U), :00439BDE(U)
|:00439D22(U), :00439DAA(U), :00439E7F(U), :00439FB9(U), :00439FE6(U)
|:0043A037(U), :0043A067(U), :0043A096(U), :0043A0C6(U), :0043A0FC(U)
|:0043A129(U)
|
:0043A13B 8B857CFFFFFF            mov eax, dword ptr [ebp+FFFFFF7C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00439786(U)
|
:0043A141 5E                      pop esi
:0043A142 8BE5                    mov esp, ebp
:0043A144 5D                      pop ebp
:0043A145 C21000                  ret 0010



:0043A148 CC974300                DWORD 004397CC
:0043A14C CC974300                DWORD 004397CC
:0043A150 CC974300                DWORD 004397CC
:0043A154 279D4300                DWORD 00439D27
:0043A158 E5994300                DWORD 004399E5
:0043A15C CC974300                DWORD 004397CC
:0043A160 AF9D4300                DWORD 00439DAF
:0043A164 AE9A4300                DWORD 00439AAE
:0043A168 4A9B4300                DWORD 00439B4A
:0043A16C AE9A4300                DWORD 00439AAE
:0043A170 849E4300                DWORD 00439E84
:0043A174 E39B4300                DWORD 00439BE3
:0043A178 BE9F4300                DWORD 00439FBE
:0043A17C 3BA14300                DWORD 0043A13B


:0043A180 000000000000000000      BYTE  9 DUP(0)


:0043A189 0D01010101              or eax, 01010101
:0043A18E 0D02020202              or eax, 02020202
:0043A193 0202                    add al, byte ptr [edx]
:0043A195 0D030D0D0D              or eax, 0D0D0D03
:0043A19A 0D0D0D0D0D              or eax, 0D0D0D0D
:0043A19F 0404                    add al, 04
:0043A1A1 0505050506              add eax, 06050505
:0043A1A6 0D07070808              or eax, 08080707
:0043A1AB 090A                    or dword ptr [edx], ecx
:0043A1AD 0A0B                    or cl, byte ptr [ebx]
:0043A1AF 0B0D0D0D0D0D            or ecx, dword ptr [0D0D0D0D]
:0043A1B5 0D0D0D0D0C              or eax, 0C0D0D0D

:0043A1BA 54994300                DWORD 00439954
:0043A1BE EE984300                DWORD 004398EE
:0043A1C2 0F994300                DWORD 0043990F
:0043A1C6 A8994300                DWORD 004399A8


:0043A1CA 0003                    add byte ptr [ebx], al
:0043A1CC 0303                    add eax, dword ptr [ebx]
:0043A1CE 0303                    add eax, dword ptr [ebx]
:0043A1D0 0303                    add eax, dword ptr [ebx]
:0043A1D2 0303                    add eax, dword ptr [ebx]
:0043A1D4 0303                    add eax, dword ptr [ebx]
:0043A1D6 0301                    add eax, dword ptr [ecx]
:0043A1D8 0102                    add dword ptr [edx], eax
:0043A1DA 021F                    add bl, byte ptr [edi]
:0043A1DC 9E                      sahf
:0043A1DD 43                      inc ebx
:0043A1DE 001F                    add byte ptr [edi], bl
:0043A1E0 9E                      sahf
:0043A1E1 43                      inc ebx
:0043A1E2 007F9E                  add byte ptr [edi-62], bh
:0043A1E5 43                      inc ebx
:0043A1E6 0000000000              BYTE  5 DUP(0)


:0043A1EB 0202                    add al, byte ptr [edx]
:0043A1ED 0202                    add al, byte ptr [edx]
:0043A1EF 0202                    add al, byte ptr [edx]
:0043A1F1 0101                    add dword ptr [ecx], eax
:0043A1F3 01                      BYTE 01h


* Referenced by a CALL at Addresses:
|:00439990   , :00439AEA   , :00439B86   , :0043A3B4   , :0044DC0E   
|
:0043A1F4 55                      push ebp
:0043A1F5 8BEC                    mov ebp, esp
:0043A1F7 83EC08                  sub esp, 00000008
:0043A1FA 894DF8                  mov dword ptr [ebp-08], ecx
:0043A1FD 8B45F8                  mov eax, dword ptr [ebp-08]
:0043A200 8B08                    mov ecx, dword ptr [eax]
:0043A202 6BC948                  imul ecx, 00000048
:0043A205 81C1681B4A00            add ecx, 004A1B68
:0043A20B 894DFC                  mov dword ptr [ebp-04], ecx
:0043A20E 8B55F8                  mov edx, dword ptr [ebp-08]
:0043A211 837A1000                cmp dword ptr [edx+10], 00000000
:0043A215 7504                    jne 0043A21B
:0043A217 33C0                    xor eax, eax
:0043A219 EB6B                    jmp 0043A286

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A215(C)
|
:0043A21B 8B45F8                  mov eax, dword ptr [ebp-08]
:0043A21E 8138AE000000            cmp dword ptr [eax], 000000AE
:0043A224 731E                    jnb 0043A244
:0043A226 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043A229 E8EDCFFCFF              call 0040721B
:0043A22E D1E0                    shl eax, 1
:0043A230 33D2                    xor edx, edx
:0043A232 B905000000              mov ecx, 00000005
:0043A237 F7F1                    div ecx
:0043A239 8B55F8                  mov edx, dword ptr [ebp-08]
:0043A23C 3B4210                  cmp eax, dword ptr [edx+10]
:0043A23F 1BC0                    sbb eax, eax
:0043A241 40                      inc eax
:0043A242 EB42                    jmp 0043A286

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A224(C)
|
:0043A244 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043A247 E8C4C3FCFF              call 00406610
:0043A24C 25FF000000              and eax, 000000FF
:0043A251 83F831                  cmp eax, 00000031
:0043A254 742E                    je 0043A284
:0043A256 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043A259 E872D5FCFF              call 004077D0
:0043A25E 25FF000000              and eax, 000000FF
:0043A263 83F832                  cmp eax, 00000032
:0043A266 741C                    je 0043A284
:0043A268 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043A26B E8ABCFFCFF              call 0040721B
:0043A270 33D2                    xor edx, edx
:0043A272 B905000000              mov ecx, 00000005
:0043A277 F7F1                    div ecx
:0043A279 8B55F8                  mov edx, dword ptr [ebp-08]
:0043A27C 3B4210                  cmp eax, dword ptr [edx+10]
:0043A27F 1BC0                    sbb eax, eax
:0043A281 40                      inc eax
:0043A282 EB02                    jmp 0043A286

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043A254(C), :0043A266(C)
|
:0043A284 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043A219(U), :0043A242(U), :0043A282(U)
|
:0043A286 8BE5                    mov esp, ebp
:0043A288 5D                      pop ebp
:0043A289 C3                      ret



* Referenced by a CALL at Address:
|:0043AE07   
|
:0043A28A 55                      push ebp
:0043A28B 8BEC                    mov ebp, esp
:0043A28D 83EC20                  sub esp, 00000020
:0043A290 56                      push esi
:0043A291 894DE4                  mov dword ptr [ebp-1C], ecx
:0043A294 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043A297 E822560000              call 0043F8BE
:0043A29C 8845F8                  mov byte ptr [ebp-08], al
:0043A29F C605242C4B0000          mov byte ptr [004B2C24], 00
:0043A2A6 68FF000000              push 000000FF
:0043A2AB 33C0                    xor eax, eax
:0043A2AD A02C424B00              mov al, byte ptr [004B422C]
:0043A2B2 33C9                    xor ecx, ecx
:0043A2B4 8A0D2D424B00            mov cl, byte ptr [004B422D]
:0043A2BA 0FAFC1                  imul eax, ecx
:0043A2BD 50                      push eax
:0043A2BE B968AB4A00              mov ecx, 004AAB68
:0043A2C3 E8C83DFDFF              call 0040E090
:0043A2C8 50                      push eax
:0043A2C9 E8455A0400              call 0047FD13
:0043A2CE 83C40C                  add esp, 0000000C
:0043A2D1 C645FC00                mov [ebp-04], 00
:0043A2D5 EB09                    jmp 0043A2E0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A378(U)
|
:0043A2D7 8A55FC                  mov dl, byte ptr [ebp-04]
:0043A2DA 80C201                  add dl, 01
:0043A2DD 8855FC                  mov byte ptr [ebp-04], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A2D5(U)
|
:0043A2E0 8B45FC                  mov eax, dword ptr [ebp-04]
:0043A2E3 25FF000000              and eax, 000000FF
:0043A2E8 83F873                  cmp eax, 00000073
:0043A2EB 0F8D8C000000            jnl 0043A37D
:0043A2F1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043A2F4 81E1FF000000            and ecx, 000000FF
:0043A2FA 6BC924                  imul ecx, 00000024
:0043A2FD 81C1502C4B00            add ecx, 004B2C50
:0043A303 E808C4FCFF              call 00406710
:0043A308 8BF0                    mov esi, eax
:0043A30A 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043A30D E8FEC3FCFF              call 00406710
:0043A312 3BF0                    cmp esi, eax
:0043A314 7462                    je 0043A378
:0043A316 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043A319 81E1FF000000            and ecx, 000000FF
:0043A31F 6BC924                  imul ecx, 00000024
:0043A322 81C1502C4B00            add ecx, 004B2C50
:0043A328 E863E9FDFF              call 00418C90
:0043A32D 25FF000000              and eax, 000000FF
:0043A332 83F802                  cmp eax, 00000002
:0043A335 7541                    jne 0043A378
:0043A337 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043A33A 81E1FF000000            and ecx, 000000FF
:0043A340 6BC924                  imul ecx, 00000024
:0043A343 81C1502C4B00            add ecx, 004B2C50
:0043A349 E81290FCFF              call 00403360
:0043A34E 668B08                  mov cx, word ptr [eax]
:0043A351 66894DF4                mov word ptr [ebp-0C], cx
:0043A355 6A00                    push 00000000
:0043A357 6A00                    push 00000000
:0043A359 8A55F8                  mov dl, byte ptr [ebp-08]
:0043A35C 52                      push edx
:0043A35D 8D45F4                  lea eax, dword ptr [ebp-0C]
:0043A360 50                      push eax
:0043A361 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043A364 81E1FF000000            and ecx, 000000FF
:0043A36A 6BC924                  imul ecx, 00000024
:0043A36D 81C1502C4B00            add ecx, 004B2C50
:0043A373 E80EC2FFFF              call 00436586

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043A314(C), :0043A335(C)
|
:0043A378 E95AFFFFFF              jmp 0043A2D7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A2EB(C)
|
:0043A37D 6A00                    push 00000000
:0043A37F 33C9                    xor ecx, ecx
:0043A381 8A0D2C424B00            mov cl, byte ptr [004B422C]
:0043A387 33D2                    xor edx, edx
:0043A389 8A152D424B00            mov dl, byte ptr [004B422D]
:0043A38F 0FAFCA                  imul ecx, edx
:0043A392 51                      push ecx
:0043A393 6A04                    push 00000004
:0043A395 6A00                    push 00000000
:0043A397 6A00                    push 00000000
:0043A399 B968AB4A00              mov ecx, 004AAB68
:0043A39E E89D560400              call 0047FA40
:0043A3A3 0540060000              add eax, 00000640
:0043A3A8 50                      push eax
:0043A3A9 E865590400              call 0047FD13
:0043A3AE 83C40C                  add esp, 0000000C
:0043A3B1 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043A3B4 E83BFEFFFF              call 0043A1F4
:0043A3B9 85C0                    test eax, eax
:0043A3BB 0F84DB000000            je 0043A49C
:0043A3C1 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043A3C4 E807B7FEFF              call 00425AD0
:0043A3C9 25FF000000              and eax, 000000FF
:0043A3CE 83F802                  cmp eax, 00000002
:0043A3D1 0F84C5000000            je 0043A49C
:0043A3D7 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043A3DA E8F1B6FEFF              call 00425AD0
:0043A3DF 25FF000000              and eax, 000000FF
:0043A3E4 83F804                  cmp eax, 00000004
:0043A3E7 0F84AF000000            je 0043A49C
:0043A3ED 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0043A3F0 E81B530200              call 0045F710
:0043A3F5 C745EC00000000          mov [ebp-14], 00000000
:0043A3FC EB09                    jmp 0043A407

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A488(U)
|
:0043A3FE 8B45EC                  mov eax, dword ptr [ebp-14]
:0043A401 83C001                  add eax, 00000001
:0043A404 8945EC                  mov dword ptr [ebp-14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A3FC(U)
|
:0043A407 33C9                    xor ecx, ecx
:0043A409 8A0D2D424B00            mov cl, byte ptr [004B422D]
:0043A40F 394DEC                  cmp dword ptr [ebp-14], ecx
:0043A412 7379                    jnb 0043A48D
:0043A414 C745E800000000          mov [ebp-18], 00000000
:0043A41B EB09                    jmp 0043A426

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A486(U)
|
:0043A41D 8B55E8                  mov edx, dword ptr [ebp-18]
:0043A420 83C201                  add edx, 00000001
:0043A423 8955E8                  mov dword ptr [ebp-18], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A41B(U)
|
:0043A426 33C0                    xor eax, eax
:0043A428 A02C424B00              mov al, byte ptr [004B422C]
:0043A42D 3945E8                  cmp dword ptr [ebp-18], eax
:0043A430 7356                    jnb 0043A488
:0043A432 8A4DE8                  mov cl, byte ptr [ebp-18]
:0043A435 884DF0                  mov byte ptr [ebp-10], cl
:0043A438 8A55EC                  mov dl, byte ptr [ebp-14]
:0043A43B 8855F1                  mov byte ptr [ebp-0F], dl
:0043A43E 8D45F0                  lea eax, dword ptr [ebp-10]
:0043A441 50                      push eax
:0043A442 E879ADFFFF              call 004351C0
:0043A447 83C404                  add esp, 00000004
:0043A44A 85C0                    test eax, eax
:0043A44C 7438                    je 0043A486
:0043A44E 6A04                    push 00000004
:0043A450 6A00                    push 00000000
:0043A452 6A00                    push 00000000
:0043A454 B968AB4A00              mov ecx, 004AAB68
:0043A459 E8E2550400              call 0047FA40
:0043A45E 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043A461 8D940840060000          lea edx, dword ptr [eax+ecx+00000640]
:0043A468 33C0                    xor eax, eax
:0043A46A A02C424B00              mov al, byte ptr [004B422C]
:0043A46F 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043A472 0FAFC8                  imul ecx, eax
:0043A475 03D1                    add edx, ecx
:0043A477 8955E0                  mov dword ptr [ebp-20], edx
:0043A47A 8B55E0                  mov edx, dword ptr [ebp-20]
:0043A47D 8A02                    mov al, byte ptr [edx]
:0043A47F 0432                    add al, 32
:0043A481 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0043A484 8801                    mov byte ptr [ecx], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A44C(C)
|
:0043A486 EB95                    jmp 0043A41D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A430(C)
|
:0043A488 E971FFFFFF              jmp 0043A3FE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A412(C)
|
:0043A48D 8A15242C4B00            mov dl, byte ptr [004B2C24]
:0043A493 80CA01                  or dl, 01
:0043A496 8815242C4B00            mov byte ptr [004B2C24], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043A3BB(C), :0043A3D1(C), :0043A3E7(C)
|
:0043A49C C6054C2C4B0000          mov byte ptr [004B2C4C], 00
:0043A4A3 C605282C4B00FF          mov byte ptr [004B2C28], FF
:0043A4AA C605202C4B00FF          mov byte ptr [004B2C20], FF
:0043A4B1 C605442C4B00FF          mov byte ptr [004B2C44], FF
:0043A4B8 5E                      pop esi
:0043A4B9 8BE5                    mov esp, ebp
:0043A4BB 5D                      pop ebp
:0043A4BC C20400                  ret 0004



* Referenced by a CALL at Address:
|:0043A68D   
|
:0043A4BF 55                      push ebp
:0043A4C0 8BEC                    mov ebp, esp
:0043A4C2 83EC10                  sub esp, 00000010
:0043A4C5 894DF4                  mov dword ptr [ebp-0C], ecx
:0043A4C8 8B4508                  mov eax, dword ptr [ebp+08]
:0043A4CB 50                      push eax
:0043A4CC E8C0B4FFFF              call 00435991
:0043A4D1 83C404                  add esp, 00000004
:0043A4D4 8845F8                  mov byte ptr [ebp-08], al
:0043A4D7 C745FC00000000          mov [ebp-04], 00000000
:0043A4DE 8A4DF8                  mov cl, byte ptr [ebp-08]
:0043A4E1 884DF0                  mov byte ptr [ebp-10], cl
:0043A4E4 807DF012                cmp byte ptr [ebp-10], 12
:0043A4E8 7211                    jb 0043A4FB
:0043A4EA 807DF016                cmp byte ptr [ebp-10], 16
:0043A4EE 7602                    jbe 0043A4F2
:0043A4F0 EB09                    jmp 0043A4FB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A4EE(C)
|
:0043A4F2 C745FC08000000          mov [ebp-04], 00000008
:0043A4F9 EB25                    jmp 0043A520

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043A4E8(C), :0043A4F0(U)
|
:0043A4FB 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043A4FE E84A530000              call 0043F84D
:0043A503 25FF000000              and eax, 000000FF
:0043A508 83F80A                  cmp eax, 0000000A
:0043A50B 7E13                    jle 0043A520
:0043A50D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043A510 E838530000              call 0043F84D
:0043A515 25FF000000              and eax, 000000FF
:0043A51A 83E80A                  sub eax, 0000000A
:0043A51D 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043A4F9(U), :0043A50B(C)
|
:0043A520 8B45FC                  mov eax, dword ptr [ebp-04]
:0043A523 8BE5                    mov esp, ebp
:0043A525 5D                      pop ebp
:0043A526 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00438514   , :00438901   
|
:0043A529 55                      push ebp
:0043A52A 8BEC                    mov ebp, esp
:0043A52C 83EC20                  sub esp, 00000020
:0043A52F 894DEC                  mov dword ptr [ebp-14], ecx
:0043A532 6A04                    push 00000004
:0043A534 6A00                    push 00000000
:0043A536 6A00                    push 00000000
:0043A538 B968AB4A00              mov ecx, 004AAB68
:0043A53D E8FE540400              call 0047FA40
:0043A542 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043A545 33D2                    xor edx, edx
:0043A547 8A11                    mov dl, byte ptr [ecx]
:0043A549 8D841040060000          lea eax, dword ptr [eax+edx+00000640]
:0043A550 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043A553 33D2                    xor edx, edx
:0043A555 8A5101                  mov dl, byte ptr [ecx+01]
:0043A558 33C9                    xor ecx, ecx
:0043A55A 8A0D2C424B00            mov cl, byte ptr [004B422C]
:0043A560 0FAFD1                  imul edx, ecx
:0043A563 03C2                    add eax, edx
:0043A565 8945F8                  mov dword ptr [ebp-08], eax
:0043A568 C645F400                mov [ebp-0C], 00
:0043A56C C645FC00                mov [ebp-04], 00
:0043A570 8B5508                  mov edx, dword ptr [ebp+08]
:0043A573 52                      push edx
:0043A574 E80BB3FFFF              call 00435884
:0043A579 83C404                  add esp, 00000004
:0043A57C 25FF000000              and eax, 000000FF
:0043A581 3DFF000000              cmp eax, 000000FF
:0043A586 741B                    je 0043A5A3
:0043A588 8B45EC                  mov eax, dword ptr [ebp-14]
:0043A58B 83C006                  add eax, 00000006
:0043A58E 50                      push eax
:0043A58F 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043A592 51                      push ecx
:0043A593 E8880E0000              call 0043B420
:0043A598 83C408                  add esp, 00000008
:0043A59B 85C0                    test eax, eax
:0043A59D 0F8420020000            je 0043A7C3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A586(C)
|
:0043A5A3 6880000000              push 00000080
:0043A5A8 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043A5AB E840B5FEFF              call 00425AF0
:0043A5B0 85C0                    test eax, eax
:0043A5B2 0F8573010000            jne 0043A72B
:0043A5B8 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043A5BB E810B5FEFF              call 00425AD0
:0043A5C0 25FF000000              and eax, 000000FF
:0043A5C5 83F804                  cmp eax, 00000004
:0043A5C8 0F84B8000000            je 0043A686
:0043A5CE 6A04                    push 00000004
:0043A5D0 6A00                    push 00000000
:0043A5D2 6A00                    push 00000000
:0043A5D4 B968AB4A00              mov ecx, 004AAB68
:0043A5D9 E862540400              call 0047FA40
:0043A5DE 8B5508                  mov edx, dword ptr [ebp+08]
:0043A5E1 33C9                    xor ecx, ecx
:0043A5E3 8A0A                    mov cl, byte ptr [edx]
:0043A5E5 03C1                    add eax, ecx
:0043A5E7 8B5508                  mov edx, dword ptr [ebp+08]
:0043A5EA 33C9                    xor ecx, ecx
:0043A5EC 8A4A01                  mov cl, byte ptr [edx+01]
:0043A5EF 33D2                    xor edx, edx
:0043A5F1 8A152C424B00            mov dl, byte ptr [004B422C]
:0043A5F7 0FAFCA                  imul ecx, edx
:0043A5FA 33D2                    xor edx, edx
:0043A5FC 8A1408                  mov dl, byte ptr [eax+ecx]
:0043A5FF 81FAFF000000            cmp edx, 000000FF
:0043A605 7517                    jne 0043A61E
:0043A607 8B45EC                  mov eax, dword ptr [ebp-14]
:0043A60A 83C006                  add eax, 00000006
:0043A60D 50                      push eax
:0043A60E 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043A611 51                      push ecx
:0043A612 E8090E0000              call 0043B420
:0043A617 83C408                  add esp, 00000008
:0043A61A 85C0                    test eax, eax
:0043A61C 740F                    je 0043A62D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A605(C)
|
:0043A61E 8B5508                  mov edx, dword ptr [ebp+08]
:0043A621 52                      push edx
:0043A622 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043A625 E83BE3FFFF              call 00438965
:0043A62A 8845F4                  mov byte ptr [ebp-0C], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A61C(C)
|
:0043A62D 6A04                    push 00000004
:0043A62F 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043A632 E8A9C0FCFF              call 004066E0
:0043A637 85C0                    test eax, eax
:0043A639 750F                    jne 0043A64A
:0043A63B 8B4508                  mov eax, dword ptr [ebp+08]
:0043A63E 50                      push eax
:0043A63F 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043A642 E895EBFFFF              call 004391DC
:0043A647 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A639(C)
|
:0043A64A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043A64D 81E1FF000000            and ecx, 000000FF
:0043A653 8B55FC                  mov edx, dword ptr [ebp-04]
:0043A656 81E2FF000000            and edx, 000000FF
:0043A65C 3BCA                    cmp ecx, edx
:0043A65E 7E0D                    jle 0043A66D
:0043A660 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043A663 25FF000000              and eax, 000000FF
:0043A668 8945E8                  mov dword ptr [ebp-18], eax
:0043A66B EB0C                    jmp 0043A679

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A65E(C)
|
:0043A66D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043A670 81E1FF000000            and ecx, 000000FF
:0043A676 894DE8                  mov dword ptr [ebp-18], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A66B(U)
|
:0043A679 8B55F8                  mov edx, dword ptr [ebp-08]
:0043A67C 8A02                    mov al, byte ptr [edx]
:0043A67E 0245E8                  add al, byte ptr [ebp-18]
:0043A681 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043A684 8801                    mov byte ptr [ecx], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A5C8(C)
|
:0043A686 8B5508                  mov edx, dword ptr [ebp+08]
:0043A689 52                      push edx
:0043A68A 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043A68D E82DFEFFFF              call 0043A4BF
:0043A692 8945F0                  mov dword ptr [ebp-10], eax
:0043A695 8B45F8                  mov eax, dword ptr [ebp-08]
:0043A698 33C9                    xor ecx, ecx
:0043A69A 8A08                    mov cl, byte ptr [eax]
:0043A69C BAFF000000              mov edx, 000000FF
:0043A6A1 2BD1                    sub edx, ecx
:0043A6A3 3955F0                  cmp dword ptr [ebp-10], edx
:0043A6A6 7D08                    jge 0043A6B0
:0043A6A8 8B45F0                  mov eax, dword ptr [ebp-10]
:0043A6AB 8945E4                  mov dword ptr [ebp-1C], eax
:0043A6AE EB11                    jmp 0043A6C1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A6A6(C)
|
:0043A6B0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043A6B3 33D2                    xor edx, edx
:0043A6B5 8A11                    mov dl, byte ptr [ecx]
:0043A6B7 B8FF000000              mov eax, 000000FF
:0043A6BC 2BC2                    sub eax, edx
:0043A6BE 8945E4                  mov dword ptr [ebp-1C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A6AE(U)
|
:0043A6C1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043A6C4 8A11                    mov dl, byte ptr [ecx]
:0043A6C6 0255E4                  add dl, byte ptr [ebp-1C]
:0043A6C9 8B45F8                  mov eax, dword ptr [ebp-08]
:0043A6CC 8810                    mov byte ptr [eax], dl
:0043A6CE 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043A6D1 83C106                  add ecx, 00000006
:0043A6D4 51                      push ecx
:0043A6D5 8B5508                  mov edx, dword ptr [ebp+08]
:0043A6D8 52                      push edx
:0043A6D9 E8420D0000              call 0043B420
:0043A6DE 83C408                  add esp, 00000008
:0043A6E1 85C0                    test eax, eax
:0043A6E3 7446                    je 0043A72B
:0043A6E5 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043A6E8 25FF000000              and eax, 000000FF
:0043A6ED 85C0                    test eax, eax
:0043A6EF 753A                    jne 0043A72B
:0043A6F1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043A6F4 33D2                    xor edx, edx
:0043A6F6 8A11                    mov dl, byte ptr [ecx]
:0043A6F8 B8FF000000              mov eax, 000000FF
:0043A6FD 2BC2                    sub eax, edx
:0043A6FF 83F801                  cmp eax, 00000001
:0043A702 7E09                    jle 0043A70D
:0043A704 C745E001000000          mov [ebp-20], 00000001
:0043A70B EB11                    jmp 0043A71E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A702(C)
|
:0043A70D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043A710 33D2                    xor edx, edx
:0043A712 8A11                    mov dl, byte ptr [ecx]
:0043A714 B8FF000000              mov eax, 000000FF
:0043A719 2BC2                    sub eax, edx
:0043A71B 8945E0                  mov dword ptr [ebp-20], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A70B(U)
|
:0043A71E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043A721 8A11                    mov dl, byte ptr [ecx]
:0043A723 0255E0                  add dl, byte ptr [ebp-20]
:0043A726 8B45F8                  mov eax, dword ptr [ebp-08]
:0043A729 8810                    mov byte ptr [eax], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043A5B2(C), :0043A6E3(C), :0043A6EF(C)
|
:0043A72B 33C9                    xor ecx, ecx
:0043A72D 8A0D382C4B00            mov cl, byte ptr [004B2C38]
:0043A733 81F9FF000000            cmp ecx, 000000FF
:0043A739 741B                    je 0043A756
:0043A73B 68382C4B00              push 004B2C38
:0043A740 8B5508                  mov edx, dword ptr [ebp+08]
:0043A743 52                      push edx
:0043A744 E8D70C0000              call 0043B420
:0043A749 83C408                  add esp, 00000008
:0043A74C 85C0                    test eax, eax
:0043A74E 7406                    je 0043A756
:0043A750 8B45F8                  mov eax, dword ptr [ebp-08]
:0043A753 C60000                  mov byte ptr [eax], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043A739(C), :0043A74E(C)
|
:0043A756 33C9                    xor ecx, ecx
:0043A758 8A0D4C2C4B00            mov cl, byte ptr [004B2C4C]
:0043A75E 8B55F8                  mov edx, dword ptr [ebp-08]
:0043A761 33C0                    xor eax, eax
:0043A763 8A02                    mov al, byte ptr [edx]
:0043A765 3BC8                    cmp ecx, eax
:0043A767 7D5A                    jge 0043A7C3
:0043A769 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043A76C 81E1FF000000            and ecx, 000000FF
:0043A772 8B55F4                  mov edx, dword ptr [ebp-0C]
:0043A775 81E2FF000000            and edx, 000000FF
:0043A77B 3BCA                    cmp ecx, edx
:0043A77D 7E18                    jle 0043A797
:0043A77F A0402C4B00              mov al, byte ptr [004B2C40]
:0043A784 A2442C4B00              mov byte ptr [004B2C44], al
:0043A789 8A0D2C2C4B00            mov cl, byte ptr [004B2C2C]
:0043A78F 880D282C4B00            mov byte ptr [004B2C28], cl
:0043A795 EB13                    jmp 0043A7AA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A77D(C)
|
:0043A797 C605442C4B00FF          mov byte ptr [004B2C44], FF
:0043A79E 8A15302C4B00            mov dl, byte ptr [004B2C30]
:0043A7A4 8815282C4B00            mov byte ptr [004B2C28], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A795(U)
|
:0043A7AA 8B45F8                  mov eax, dword ptr [ebp-08]
:0043A7AD 8A08                    mov cl, byte ptr [eax]
:0043A7AF 880D4C2C4B00            mov byte ptr [004B2C4C], cl
:0043A7B5 8B5508                  mov edx, dword ptr [ebp+08]
:0043A7B8 52                      push edx
:0043A7B9 B9202C4B00              mov ecx, 004B2C20
:0043A7BE E8DDBDFCFF              call 004065A0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043A59D(C), :0043A767(C)
|
:0043A7C3 8BE5                    mov esp, ebp
:0043A7C5 5D                      pop ebp
:0043A7C6 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0043AF5C   , :0043AFA6   , :0043B1CD   , :0043B320   
|
:0043A7C9 55                      push ebp
:0043A7CA 8BEC                    mov ebp, esp
:0043A7CC 83EC10                  sub esp, 00000010
:0043A7CF 894DF0                  mov dword ptr [ebp-10], ecx
:0043A7D2 6A01                    push 00000001
:0043A7D4 68FF000000              push 000000FF
:0043A7D9 68FF000000              push 000000FF
:0043A7DE 6A08                    push 00000008
:0043A7E0 8A4508                  mov al, byte ptr [ebp+08]
:0043A7E3 50                      push eax
:0043A7E4 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043A7E7 83C106                  add ecx, 00000006
:0043A7EA 51                      push ecx
:0043A7EB 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043A7EE E815DBFFFF              call 00438308
:0043A7F3 8845FC                  mov byte ptr [ebp-04], al
:0043A7F6 8B55FC                  mov edx, dword ptr [ebp-04]
:0043A7F9 81E2FF000000            and edx, 000000FF
:0043A7FF 81FAFF000000            cmp edx, 000000FF
:0043A805 7430                    je 0043A837
:0043A807 C7051C2C4B0001000000    mov dword ptr [004B2C1C], 00000001
:0043A811 6A01                    push 00000001
:0043A813 68FF000000              push 000000FF
:0043A818 68FF000000              push 000000FF
:0043A81D 6A04                    push 00000004
:0043A81F 8A4508                  mov al, byte ptr [ebp+08]
:0043A822 50                      push eax
:0043A823 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043A826 83C106                  add ecx, 00000006
:0043A829 51                      push ecx
:0043A82A 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043A82D E8D6DAFFFF              call 00438308
:0043A832 E919010000              jmp 0043A950

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A805(C)
|
:0043A837 6A01                    push 00000001
:0043A839 68FF000000              push 000000FF
:0043A83E 68FF000000              push 000000FF
:0043A843 6A08                    push 00000008
:0043A845 68FF000000              push 000000FF
:0043A84A 8B55F0                  mov edx, dword ptr [ebp-10]
:0043A84D 83C206                  add edx, 00000006
:0043A850 52                      push edx
:0043A851 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043A854 E8AFDAFFFF              call 00438308
:0043A859 8845FC                  mov byte ptr [ebp-04], al
:0043A85C 8B45FC                  mov eax, dword ptr [ebp-04]
:0043A85F 25FF000000              and eax, 000000FF
:0043A864 3DFF000000              cmp eax, 000000FF
:0043A869 0F84D0000000            je 0043A93F
:0043A86F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043A872 81E1FF000000            and ecx, 000000FF
:0043A878 6BC924                  imul ecx, 00000024
:0043A87B 81C1502C4B00            add ecx, 004B2C50
:0043A881 E8DA8AFCFF              call 00403360
:0043A886 668B08                  mov cx, word ptr [eax]
:0043A889 66894DF4                mov word ptr [ebp-0C], cx
:0043A88D C645F800                mov [ebp-08], 00
:0043A891 6A01                    push 00000001
:0043A893 8B55F0                  mov edx, dword ptr [ebp-10]
:0043A896 8A4207                  mov al, byte ptr [edx+07]
:0043A899 50                      push eax
:0043A89A 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043A89D 8A5106                  mov dl, byte ptr [ecx+06]
:0043A8A0 52                      push edx
:0043A8A1 6A02                    push 00000002
:0043A8A3 68FF000000              push 000000FF
:0043A8A8 8D45F4                  lea eax, dword ptr [ebp-0C]
:0043A8AB 50                      push eax
:0043A8AC 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043A8AF E854DAFFFF              call 00438308
:0043A8B4 25FF000000              and eax, 000000FF
:0043A8B9 83F801                  cmp eax, 00000001
:0043A8BC 7435                    je 0043A8F3
:0043A8BE 6A00                    push 00000000
:0043A8C0 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043A8C3 8A5107                  mov dl, byte ptr [ecx+07]
:0043A8C6 52                      push edx
:0043A8C7 8B45F0                  mov eax, dword ptr [ebp-10]
:0043A8CA 8A4806                  mov cl, byte ptr [eax+06]
:0043A8CD 51                      push ecx
:0043A8CE 6A02                    push 00000002
:0043A8D0 68FF000000              push 000000FF
:0043A8D5 8D55F4                  lea edx, dword ptr [ebp-0C]
:0043A8D8 52                      push edx
:0043A8D9 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043A8DC E827DAFFFF              call 00438308
:0043A8E1 25FF000000              and eax, 000000FF
:0043A8E6 3DFF000000              cmp eax, 000000FF
:0043A8EB 7404                    je 0043A8F1
:0043A8ED C645F801                mov [ebp-08], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A8EB(C)
|
:0043A8F1 EB04                    jmp 0043A8F7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A8BC(C)
|
:0043A8F3 C645F801                mov [ebp-08], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A8F1(U)
|
:0043A8F7 8B45F8                  mov eax, dword ptr [ebp-08]
:0043A8FA 25FF000000              and eax, 000000FF
:0043A8FF 85C0                    test eax, eax
:0043A901 743A                    je 0043A93D
:0043A903 6A01                    push 00000001
:0043A905 8A4D08                  mov cl, byte ptr [ebp+08]
:0043A908 51                      push ecx
:0043A909 8B55F0                  mov edx, dword ptr [ebp-10]
:0043A90C 83C206                  add edx, 00000006
:0043A90F 52                      push edx
:0043A910 8D45F4                  lea eax, dword ptr [ebp-0C]
:0043A913 50                      push eax
:0043A914 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043A917 E812D5FFFF              call 00437E2E
:0043A91C 6A01                    push 00000001
:0043A91E 68FF000000              push 000000FF
:0043A923 68FF000000              push 000000FF
:0043A928 6A04                    push 00000004
:0043A92A 8A4D08                  mov cl, byte ptr [ebp+08]
:0043A92D 51                      push ecx
:0043A92E 8B55F0                  mov edx, dword ptr [ebp-10]
:0043A931 83C206                  add edx, 00000006
:0043A934 52                      push edx
:0043A935 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043A938 E8CBD9FFFF              call 00438308

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A901(C)
|
:0043A93D EB11                    jmp 0043A950

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A869(C)
|
:0043A93F 8B45F0                  mov eax, dword ptr [ebp-10]
:0043A942 83C006                  add eax, 00000006
:0043A945 50                      push eax
:0043A946 B9202C4B00              mov ecx, 004B2C20
:0043A94B E850BCFCFF              call 004065A0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043A832(U), :0043A93D(U)
|
:0043A950 8BE5                    mov esp, ebp
:0043A952 5D                      pop ebp
:0043A953 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0043B35A   
|
:0043A956 55                      push ebp
:0043A957 8BEC                    mov ebp, esp
:0043A959 83EC18                  sub esp, 00000018
:0043A95C 894DE8                  mov dword ptr [ebp-18], ecx
:0043A95F 8D4DEC                  lea ecx, dword ptr [ebp-14]
:0043A962 E8A94D0200              call 0045F710
:0043A967 C645FC00                mov [ebp-04], 00
:0043A96B 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043A96E E81DE3FDFF              call 00418C90
:0043A973 25FF000000              and eax, 000000FF
:0043A978 83F802                  cmp eax, 00000002
:0043A97B 7526                    jne 0043A9A3
:0043A97D 33C0                    xor eax, eax
:0043A97F A0202C4B00              mov al, byte ptr [004B2C20]
:0043A984 3DFF000000              cmp eax, 000000FF
:0043A989 7418                    je 0043A9A3
:0043A98B 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043A98E 83C106                  add ecx, 00000006
:0043A991 51                      push ecx
:0043A992 68202C4B00              push 004B2C20
:0043A997 E8840A0000              call 0043B420
:0043A99C 83C408                  add esp, 00000008
:0043A99F 85C0                    test eax, eax
:0043A9A1 7405                    je 0043A9A8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043A97B(C), :0043A989(C)
|
:0043A9A3 E94F010000              jmp 0043AAF7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A9A1(C)
|
:0043A9A8 6A00                    push 00000000
:0043A9AA 68FF000000              push 000000FF
:0043A9AF 68202C4B00              push 004B2C20
:0043A9B4 8B55E8                  mov edx, dword ptr [ebp-18]
:0043A9B7 83C206                  add edx, 00000006
:0043A9BA 52                      push edx
:0043A9BB 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043A9BE E86BD4FFFF              call 00437E2E
:0043A9C3 8945F0                  mov dword ptr [ebp-10], eax
:0043A9C6 8B45F0                  mov eax, dword ptr [ebp-10]
:0043A9C9 33C9                    xor ecx, ecx
:0043A9CB 8A08                    mov cl, byte ptr [eax]
:0043A9CD 81F9FF000000            cmp ecx, 000000FF
:0043A9D3 7505                    jne 0043A9DA
:0043A9D5 E91D010000              jmp 0043AAF7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A9D3(C)
|
:0043A9DA 6880000000              push 00000080
:0043A9DF 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043A9E2 E809B1FEFF              call 00425AF0
:0043A9E7 85C0                    test eax, eax
:0043A9E9 741A                    je 0043AA05
:0043A9EB 8B55E8                  mov edx, dword ptr [ebp-18]
:0043A9EE 8A4207                  mov al, byte ptr [edx+07]
:0043A9F1 50                      push eax
:0043A9F2 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043A9F5 8A5106                  mov dl, byte ptr [ecx+06]
:0043A9F8 52                      push edx
:0043A9F9 B950424B00              mov ecx, 004B4250
:0043A9FE E83CA60100              call 0045503F
:0043AA03 EB14                    jmp 0043AA19

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043A9E9(C)
|
:0043AA05 68FF000000              push 000000FF
:0043AA0A 68FF000000              push 000000FF
:0043AA0F 6A00                    push 00000000
:0043AA11 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043AA14 E86F6A0000              call 00441488

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AA03(U)
|
:0043AA19 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043AA1C E8C3800000              call 00442AE4
:0043AA21 C745F400000000          mov [ebp-0C], 00000000
:0043AA28 EB09                    jmp 0043AA33

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043AA81(U), :0043AAC5(U)
|
:0043AA2A 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043AA2D 83C001                  add eax, 00000001
:0043AA30 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AA28(U)
|
:0043AA33 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043AA36 83C106                  add ecx, 00000006
:0043AA39 51                      push ecx
:0043AA3A 68202C4B00              push 004B2C20
:0043AA3F E8DC090000              call 0043B420
:0043AA44 83C408                  add esp, 00000008
:0043AA47 85C0                    test eax, eax
:0043AA49 757F                    jne 0043AACA
:0043AA4B 8B55F0                  mov edx, dword ptr [ebp-10]
:0043AA4E 0355F4                  add edx, dword ptr [ebp-0C]
:0043AA51 8A02                    mov al, byte ptr [edx]
:0043AA53 8845F8                  mov byte ptr [ebp-08], al
:0043AA56 8A4DF8                  mov cl, byte ptr [ebp-08]
:0043AA59 51                      push ecx
:0043AA5A 8B55E8                  mov edx, dword ptr [ebp-18]
:0043AA5D 83C206                  add edx, 00000006
:0043AA60 52                      push edx
:0043AA61 E88FAFFFFF              call 004359F5
:0043AA66 83C408                  add esp, 00000008
:0043AA69 50                      push eax
:0043AA6A 8D4DEC                  lea ecx, dword ptr [ebp-14]
:0043AA6D E82EBBFCFF              call 004065A0
:0043AA72 8B45EC                  mov eax, dword ptr [ebp-14]
:0043AA75 25FF000000              and eax, 000000FF
:0043AA7A 3DFF000000              cmp eax, 000000FF
:0043AA7F 7502                    jne 0043AA83
:0043AA81 EBA7                    jmp 0043AA2A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AA7F(C)
|
:0043AA83 8A4DF8                  mov cl, byte ptr [ebp-08]
:0043AA86 51                      push ecx
:0043AA87 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043AA8A E88C750000              call 0044201B
:0043AA8F 8D55EC                  lea edx, dword ptr [ebp-14]
:0043AA92 52                      push edx
:0043AA93 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043AA96 83C106                  add ecx, 00000006
:0043AA99 E802BBFCFF              call 004065A0
:0043AA9E 6880000000              push 00000080
:0043AAA3 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043AAA6 E845B0FEFF              call 00425AF0
:0043AAAB 85C0                    test eax, eax
:0043AAAD 7516                    jne 0043AAC5
:0043AAAF 8B45FC                  mov eax, dword ptr [ebp-04]
:0043AAB2 25FF000000              and eax, 000000FF
:0043AAB7 83F864                  cmp eax, 00000064
:0043AABA 7C09                    jl 0043AAC5
:0043AABC 8A4DFC                  mov cl, byte ptr [ebp-04]
:0043AABF 80C101                  add cl, 01
:0043AAC2 884DFC                  mov byte ptr [ebp-04], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043AAAD(C), :0043AABA(C)
|
:0043AAC5 E960FFFFFF              jmp 0043AA2A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AA49(C)
|
:0043AACA 6880000000              push 00000080
:0043AACF 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043AAD2 E819B0FEFF              call 00425AF0
:0043AAD7 85C0                    test eax, eax
:0043AAD9 750A                    jne 0043AAE5
:0043AADB 6A04                    push 00000004
:0043AADD 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043AAE0 E8337C0000              call 00442718

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AAD9(C)
|
:0043AAE5 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043AAE8 E8CE7F0000              call 00442ABB
:0043AAED B9083D4B00              mov ecx, 004B3D08
:0043AAF2 E893FD0000              call 0044A88A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043A9A3(U), :0043A9D5(U)
|
:0043AAF7 8BE5                    mov esp, ebp
:0043AAF9 5D                      pop ebp
:0043AAFA C3                      ret



* Referenced by a CALL at Address:
|:0043B39B   
|
:0043AAFB 55                      push ebp
:0043AAFC 8BEC                    mov ebp, esp
:0043AAFE 83EC10                  sub esp, 00000010
:0043AB01 894DF0                  mov dword ptr [ebp-10], ecx
:0043AB04 68FF000000              push 000000FF
:0043AB09 6840060000              push 00000640
:0043AB0E 6A04                    push 00000004
:0043AB10 6A00                    push 00000000
:0043AB12 6A00                    push 00000000
:0043AB14 B938EB4A00              mov ecx, 004AEB38
:0043AB19 E8224F0400              call 0047FA40
:0043AB1E 05C0120000              add eax, 000012C0
:0043AB23 50                      push eax
:0043AB24 E8EA510400              call 0047FD13
:0043AB29 83C40C                  add esp, 0000000C
:0043AB2C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043AB2F E83C34FEFF              call 0041DF70
:0043AB34 8845FC                  mov byte ptr [ebp-04], al
:0043AB37 6A00                    push 00000000
:0043AB39 6A00                    push 00000000
:0043AB3B 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043AB3E E87B4D0000              call 0043F8BE
:0043AB43 50                      push eax
:0043AB44 8B45F0                  mov eax, dword ptr [ebp-10]
:0043AB47 83C006                  add eax, 00000006
:0043AB4A 50                      push eax
:0043AB4B 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043AB4E E833BAFFFF              call 00436586
:0043AB53 8845F8                  mov byte ptr [ebp-08], al
:0043AB56 6880000000              push 00000080
:0043AB5B 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043AB5E E88DAFFEFF              call 00425AF0
:0043AB63 85C0                    test eax, eax
:0043AB65 7512                    jne 0043AB79
:0043AB67 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043AB6A E861AFFEFF              call 00425AD0
:0043AB6F 25FF000000              and eax, 000000FF
:0043AB74 83F804                  cmp eax, 00000004
:0043AB77 7505                    jne 0043AB7E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AB65(C)
|
:0043AB79 E99A010000              jmp 0043AD18

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AB77(C)
|
:0043AB7E 6A00                    push 00000000
:0043AB80 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043AB83 8B09                    mov ecx, dword ptr [ecx]
:0043AB85 6BC948                  imul ecx, 00000048
:0043AB88 81C1681B4A00            add ecx, 004A1B68
:0043AB8E E85DBAFCFF              call 004065F0
:0043AB93 50                      push eax
:0043AB94 8B55F0                  mov edx, dword ptr [ebp-10]
:0043AB97 8B0A                    mov ecx, dword ptr [edx]
:0043AB99 6BC948                  imul ecx, 00000048
:0043AB9C 81C1681B4A00            add ecx, 004A1B68
:0043ABA2 E860CDFCFF              call 00407907
:0043ABA7 85C0                    test eax, eax
:0043ABA9 7505                    jne 0043ABB0
:0043ABAB E968010000              jmp 0043AD18

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043ABA9(C)
|
:0043ABB0 8B45F8                  mov eax, dword ptr [ebp-08]
:0043ABB3 25FF000000              and eax, 000000FF
:0043ABB8 3DFF000000              cmp eax, 000000FF
:0043ABBD 0F8455010000            je 0043AD18
:0043ABC3 6A02                    push 00000002
:0043ABC5 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043ABC8 E823AFFEFF              call 00425AF0
:0043ABCD 85C0                    test eax, eax
:0043ABCF 0F8543010000            jne 0043AD18
:0043ABD5 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043ABD8 E8F3AEFEFF              call 00425AD0
:0043ABDD 25FF000000              and eax, 000000FF
:0043ABE2 83F804                  cmp eax, 00000004
:0043ABE5 0F842D010000            je 0043AD18
:0043ABEB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043ABEE 81E1FF000000            and ecx, 000000FF
:0043ABF4 6BC924                  imul ecx, 00000024
:0043ABF7 81C1502C4B00            add ecx, 004B2C50
:0043ABFD E85E87FCFF              call 00403360
:0043AC02 668B08                  mov cx, word ptr [eax]
:0043AC05 66894DF4                mov word ptr [ebp-0C], cx
:0043AC09 8A55F8                  mov dl, byte ptr [ebp-08]
:0043AC0C 52                      push edx
:0043AC0D 8B45F0                  mov eax, dword ptr [ebp-10]
:0043AC10 8A4804                  mov cl, byte ptr [eax+04]
:0043AC13 51                      push ecx
:0043AC14 E810ACFFFF              call 00435829
:0043AC19 83C408                  add esp, 00000008
:0043AC1C 68FF000000              push 000000FF
:0043AC21 8A55F8                  mov dl, byte ptr [ebp-08]
:0043AC24 52                      push edx
:0043AC25 6A01                    push 00000001
:0043AC27 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043AC2A E859680000              call 00441488
:0043AC2F 8A45F8                  mov al, byte ptr [ebp-08]
:0043AC32 50                      push eax
:0043AC33 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043AC36 8A5104                  mov dl, byte ptr [ecx+04]
:0043AC39 52                      push edx
:0043AC3A B9F0274900              mov ecx, 004927F0
:0043AC3F E8ADB8FCFF              call 004064F1
:0043AC44 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043AC47 81E1FF000000            and ecx, 000000FF
:0043AC4D 6BC924                  imul ecx, 00000024
:0043AC50 81C1502C4B00            add ecx, 004B2C50
:0043AC56 E835800300              call 00472C90
:0043AC5B 85C0                    test eax, eax
:0043AC5D 0F8597000000            jne 0043ACFA
:0043AC63 6A2E                    push 0000002E
:0043AC65 8B45F0                  mov eax, dword ptr [ebp-10]
:0043AC68 8B08                    mov ecx, dword ptr [eax]
:0043AC6A 6BC948                  imul ecx, 00000048
:0043AC6D 81C1681B4A00            add ecx, 004A1B68
:0043AC73 E891CDFCFF              call 00407A09
:0043AC78 85C0                    test eax, eax
:0043AC7A 747E                    je 0043ACFA
:0043AC7C 68FF000000              push 000000FF
:0043AC81 6840060000              push 00000640
:0043AC86 6A04                    push 00000004
:0043AC88 6A00                    push 00000000
:0043AC8A 68C0120000              push 000012C0
:0043AC8F B938EB4A00              mov ecx, 004AEB38
:0043AC94 E8A74D0400              call 0047FA40
:0043AC99 50                      push eax
:0043AC9A E874500400              call 0047FD13
:0043AC9F 83C40C                  add esp, 0000000C
:0043ACA2 6A00                    push 00000000
:0043ACA4 6A00                    push 00000000
:0043ACA6 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043ACA9 E8104C0000              call 0043F8BE
:0043ACAE 50                      push eax
:0043ACAF 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043ACB2 83C106                  add ecx, 00000006
:0043ACB5 51                      push ecx
:0043ACB6 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043ACB9 E8C8B8FFFF              call 00436586
:0043ACBE 8845F8                  mov byte ptr [ebp-08], al
:0043ACC1 8B55F8                  mov edx, dword ptr [ebp-08]
:0043ACC4 81E2FF000000            and edx, 000000FF
:0043ACCA 81FAFF000000            cmp edx, 000000FF
:0043ACD0 7428                    je 0043ACFA
:0043ACD2 8A45F8                  mov al, byte ptr [ebp-08]
:0043ACD5 50                      push eax
:0043ACD6 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043ACD9 8A5104                  mov dl, byte ptr [ecx+04]
:0043ACDC 52                      push edx
:0043ACDD E847ABFFFF              call 00435829
:0043ACE2 83C408                  add esp, 00000008
:0043ACE5 8A45F8                  mov al, byte ptr [ebp-08]
:0043ACE8 50                      push eax
:0043ACE9 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043ACEC 8A5104                  mov dl, byte ptr [ecx+04]
:0043ACEF 52                      push edx
:0043ACF0 B9F0274900              mov ecx, 004927F0
:0043ACF5 E8F7B7FCFF              call 004064F1

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043AC5D(C), :0043AC7A(C), :0043ACD0(C)
|
:0043ACFA 6A02                    push 00000002
:0043ACFC 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043ACFF E8147A0000              call 00442718
:0043AD04 6A04                    push 00000004
:0043AD06 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043AD09 E80A7A0000              call 00442718
:0043AD0E B950424B00              mov ecx, 004B4250
:0043AD13 E8FB8D0100              call 00453B13

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043AB79(U), :0043ABAB(U), :0043ABBD(C), :0043ABCF(C), :0043ABE5(C)
|
:0043AD18 8BE5                    mov esp, ebp
:0043AD1A 5D                      pop ebp
:0043AD1B C3                      ret



* Referenced by a CALL at Addresses:
|:0044EB1F   , :004595D5   
|
:0043AD1C 55                      push ebp
:0043AD1D 8BEC                    mov ebp, esp
:0043AD1F 83EC1C                  sub esp, 0000001C
:0043AD22 894DEC                  mov dword ptr [ebp-14], ecx
:0043AD25 C645FCFF                mov [ebp-04], FF
:0043AD29 6880000000              push 00000080
:0043AD2E 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043AD31 E8BAADFEFF              call 00425AF0
:0043AD36 85C0                    test eax, eax
:0043AD38 7409                    je 0043AD43
:0043AD3A C745E864000000          mov [ebp-18], 00000064
:0043AD41 EB10                    jmp 0043AD53

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AD38(C)
|
:0043AD43 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043AD46 E8044A0000              call 0043F74F
:0043AD4B 25FF000000              and eax, 000000FF
:0043AD50 8945E8                  mov dword ptr [ebp-18], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AD41(U)
|
:0043AD53 8A45E8                  mov al, byte ptr [ebp-18]
:0043AD56 8845F8                  mov byte ptr [ebp-08], al
:0043AD59 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:0043AD5C E8AF490200              call 0045F710
:0043AD61 C605382C4B00FF          mov byte ptr [004B2C38], FF
:0043AD68 C7051C2C4B0000000000    mov dword ptr [004B2C1C], 00000000
:0043AD72 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043AD75 8B11                    mov edx, dword ptr [ecx]
:0043AD77 52                      push edx
:0043AD78 B9F05D4B00              mov ecx, 004B5DF0
:0043AD7D E8CE480200              call 0045F650
:0043AD82 8B45EC                  mov eax, dword ptr [ebp-14]
:0043AD85 33C9                    xor ecx, ecx
:0043AD87 8A4808                  mov cl, byte ptr [eax+08]
:0043AD8A 81F9FF000000            cmp ecx, 000000FF
:0043AD90 7433                    je 0043ADC5
:0043AD92 8B55EC                  mov edx, dword ptr [ebp-14]
:0043AD95 33C0                    xor eax, eax
:0043AD97 8A4208                  mov al, byte ptr [edx+08]
:0043AD9A 8BC8                    mov ecx, eax
:0043AD9C 6BC924                  imul ecx, 00000024
:0043AD9F 81C1502C4B00            add ecx, 004B2C50
:0043ADA5 E8E6DEFDFF              call 00418C90
:0043ADAA 25FF000000              and eax, 000000FF
:0043ADAF 83F802                  cmp eax, 00000002
:0043ADB2 7411                    je 0043ADC5
:0043ADB4 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043ADB7 C64108FF                mov [ecx+08], FF
:0043ADBB 6A01                    push 00000001
:0043ADBD 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043ADC0 E8A4780000              call 00442669

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043AD90(C), :0043ADB2(C)
|
:0043ADC5 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043ADC8 E8C3DEFDFF              call 00418C90
:0043ADCD 25FF000000              and eax, 000000FF
:0043ADD2 83F802                  cmp eax, 00000002
:0043ADD5 0F852D060000            jne 0043B408
:0043ADDB 6A02                    push 00000002
:0043ADDD 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043ADE0 E80BADFEFF              call 00425AF0
:0043ADE5 85C0                    test eax, eax
:0043ADE7 0F851B060000            jne 0043B408
:0043ADED 6A08                    push 00000008
:0043ADEF 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043ADF2 E8E9B8FCFF              call 004066E0
:0043ADF7 85C0                    test eax, eax
:0043ADF9 0F8509060000            jne 0043B408
:0043ADFF 68FF000000              push 000000FF
:0043AE04 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043AE07 E87EF4FFFF              call 0043A28A
:0043AE0C 33D2                    xor edx, edx
:0043AE0E 8A15242C4B00            mov dl, byte ptr [004B2C24]
:0043AE14 83E201                  and edx, 00000001
:0043AE17 85D2                    test edx, edx
:0043AE19 0F8491010000            je 0043AFB0
:0043AE1F 6880000000              push 00000080
:0043AE24 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043AE27 E8C4ACFEFF              call 00425AF0
:0043AE2C 85C0                    test eax, eax
:0043AE2E 0F857C010000            jne 0043AFB0
:0043AE34 8B45EC                  mov eax, dword ptr [ebp-14]
:0043AE37 33C9                    xor ecx, ecx
:0043AE39 8A4804                  mov cl, byte ptr [eax+04]
:0043AE3C 83F923                  cmp ecx, 00000023
:0043AE3F 0F846B010000            je 0043AFB0
:0043AE45 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043AE48 E8C3B8FCFF              call 00406710
:0043AE4D 85C0                    test eax, eax
:0043AE4F 7415                    je 0043AE66
:0043AE51 B9502C4B00              mov ecx, 004B2C50
:0043AE56 E80585FCFF              call 00403360
:0043AE5B 50                      push eax
:0043AE5C 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:0043AE5F E83CB7FCFF              call 004065A0
:0043AE64 EB2D                    jmp 0043AE93

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AE4F(C)
|
:0043AE66 B93C314B00              mov ecx, 004B313C
:0043AE6B E820DEFDFF              call 00418C90
:0043AE70 25FF000000              and eax, 000000FF
:0043AE75 83F802                  cmp eax, 00000002
:0043AE78 7515                    jne 0043AE8F
:0043AE7A B93C314B00              mov ecx, 004B313C
:0043AE7F E8DC84FCFF              call 00403360
:0043AE84 50                      push eax
:0043AE85 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:0043AE88 E813B7FCFF              call 004065A0
:0043AE8D EB04                    jmp 0043AE93

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AE78(C)
|
:0043AE8F C645F4FF                mov [ebp-0C], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043AE64(U), :0043AE8D(U)
|
:0043AE93 8B55F4                  mov edx, dword ptr [ebp-0C]
:0043AE96 81E2FF000000            and edx, 000000FF
:0043AE9C 81FAFF000000            cmp edx, 000000FF
:0043AEA2 0F84F7000000            je 0043AF9F
:0043AEA8 8B45EC                  mov eax, dword ptr [ebp-14]
:0043AEAB 8A4804                  mov cl, byte ptr [eax+04]
:0043AEAE 51                      push ecx
:0043AEAF 6A0A                    push 0000000A
:0043AEB1 8D55F4                  lea edx, dword ptr [ebp-0C]
:0043AEB4 52                      push edx
:0043AEB5 E8BED2FFFF              call 00438178
:0043AEBA 83C40C                  add esp, 0000000C
:0043AEBD 6A01                    push 00000001
:0043AEBF 8B45EC                  mov eax, dword ptr [ebp-14]
:0043AEC2 8A4807                  mov cl, byte ptr [eax+07]
:0043AEC5 51                      push ecx
:0043AEC6 8B55EC                  mov edx, dword ptr [ebp-14]
:0043AEC9 8A4206                  mov al, byte ptr [edx+06]
:0043AECC 50                      push eax
:0043AECD 6A02                    push 00000002
:0043AECF 68FF000000              push 000000FF
:0043AED4 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:0043AED7 51                      push ecx
:0043AED8 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043AEDB E828D4FFFF              call 00438308
:0043AEE0 25FF000000              and eax, 000000FF
:0043AEE5 83F801                  cmp eax, 00000001
:0043AEE8 7479                    je 0043AF63
:0043AEEA 6A00                    push 00000000
:0043AEEC 8B55EC                  mov edx, dword ptr [ebp-14]
:0043AEEF 8A4207                  mov al, byte ptr [edx+07]
:0043AEF2 50                      push eax
:0043AEF3 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043AEF6 8A5106                  mov dl, byte ptr [ecx+06]
:0043AEF9 52                      push edx
:0043AEFA 6A02                    push 00000002
:0043AEFC 68FF000000              push 000000FF
:0043AF01 8D45F4                  lea eax, dword ptr [ebp-0C]
:0043AF04 50                      push eax
:0043AF05 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043AF08 E8FBD3FFFF              call 00438308
:0043AF0D 25FF000000              and eax, 000000FF
:0043AF12 3DFF000000              cmp eax, 000000FF
:0043AF17 743C                    je 0043AF55
:0043AF19 6A01                    push 00000001
:0043AF1B 8A4DF8                  mov cl, byte ptr [ebp-08]
:0043AF1E 51                      push ecx
:0043AF1F 8B55EC                  mov edx, dword ptr [ebp-14]
:0043AF22 83C206                  add edx, 00000006
:0043AF25 52                      push edx
:0043AF26 8D45F4                  lea eax, dword ptr [ebp-0C]
:0043AF29 50                      push eax
:0043AF2A 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043AF2D E8FCCEFFFF              call 00437E2E
:0043AF32 6A01                    push 00000001
:0043AF34 68FF000000              push 000000FF
:0043AF39 68FF000000              push 000000FF
:0043AF3E 6A04                    push 00000004
:0043AF40 8A4DF8                  mov cl, byte ptr [ebp-08]
:0043AF43 51                      push ecx
:0043AF44 8B55EC                  mov edx, dword ptr [ebp-14]
:0043AF47 83C206                  add edx, 00000006
:0043AF4A 52                      push edx
:0043AF4B 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043AF4E E8B5D3FFFF              call 00438308
:0043AF53 EB0C                    jmp 0043AF61

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AF17(C)
|
:0043AF55 8A45F8                  mov al, byte ptr [ebp-08]
:0043AF58 50                      push eax
:0043AF59 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043AF5C E868F8FFFF              call 0043A7C9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AF53(U)
|
:0043AF61 EB3A                    jmp 0043AF9D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AEE8(C)
|
:0043AF63 6A01                    push 00000001
:0043AF65 8A4DF8                  mov cl, byte ptr [ebp-08]
:0043AF68 51                      push ecx
:0043AF69 8B55EC                  mov edx, dword ptr [ebp-14]
:0043AF6C 83C206                  add edx, 00000006
:0043AF6F 52                      push edx
:0043AF70 8D45F4                  lea eax, dword ptr [ebp-0C]
:0043AF73 50                      push eax
:0043AF74 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043AF77 E8B2CEFFFF              call 00437E2E
:0043AF7C 6A01                    push 00000001
:0043AF7E 68FF000000              push 000000FF
:0043AF83 68FF000000              push 000000FF
:0043AF88 6A04                    push 00000004
:0043AF8A 8A4DF8                  mov cl, byte ptr [ebp-08]
:0043AF8D 51                      push ecx
:0043AF8E 8B55EC                  mov edx, dword ptr [ebp-14]
:0043AF91 83C206                  add edx, 00000006
:0043AF94 52                      push edx
:0043AF95 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043AF98 E86BD3FFFF              call 00438308

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AF61(U)
|
:0043AF9D EB0C                    jmp 0043AFAB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AEA2(C)
|
:0043AF9F 8A45F8                  mov al, byte ptr [ebp-08]
:0043AFA2 50                      push eax
:0043AFA3 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043AFA6 E81EF8FFFF              call 0043A7C9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AF9D(U)
|
:0043AFAB E9A7030000              jmp 0043B357

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043AE19(C), :0043AE2E(C), :0043AE3F(C)
|
:0043AFB0 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043AFB3 E818ABFEFF              call 00425AD0
:0043AFB8 25FF000000              and eax, 000000FF
:0043AFBD 8945E4                  mov dword ptr [ebp-1C], eax
:0043AFC0 837DE404                cmp dword ptr [ebp-1C], 00000004
:0043AFC4 0F878D030000            ja 0043B357
:0043AFCA 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043AFCD FF248D0CB44300          jmp dword ptr [4*ecx+0043B40C]
:0043AFD4 8B55EC                  mov edx, dword ptr [ebp-14]
:0043AFD7 33C0                    xor eax, eax
:0043AFD9 8A4208                  mov al, byte ptr [edx+08]
:0043AFDC 3DFF000000              cmp eax, 000000FF
:0043AFE1 0F848B000000            je 0043B072
:0043AFE7 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043AFEA 33D2                    xor edx, edx
:0043AFEC 8A5108                  mov dl, byte ptr [ecx+08]
:0043AFEF 8BCA                    mov ecx, edx
:0043AFF1 6BC924                  imul ecx, 00000024
:0043AFF4 81C1502C4B00            add ecx, 004B2C50
:0043AFFA E86183FCFF              call 00403360
:0043AFFF 50                      push eax
:0043B000 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:0043B003 E898B5FCFF              call 004065A0
:0043B008 8B45EC                  mov eax, dword ptr [ebp-14]
:0043B00B 33C9                    xor ecx, ecx
:0043B00D 8A4808                  mov cl, byte ptr [eax+08]
:0043B010 6BC924                  imul ecx, 00000024
:0043B013 81C1502C4B00            add ecx, 004B2C50
:0043B019 E8B2AAFEFF              call 00425AD0
:0043B01E 25FF000000              and eax, 000000FF
:0043B023 85C0                    test eax, eax
:0043B025 7422                    je 0043B049
:0043B027 8B55EC                  mov edx, dword ptr [ebp-14]
:0043B02A 33C0                    xor eax, eax
:0043B02C 8A4208                  mov al, byte ptr [edx+08]
:0043B02F 8BC8                    mov ecx, eax
:0043B031 6BC924                  imul ecx, 00000024
:0043B034 81C1502C4B00            add ecx, 004B2C50
:0043B03A E891AAFEFF              call 00425AD0
:0043B03F 25FF000000              and eax, 000000FF
:0043B044 83F804                  cmp eax, 00000004
:0043B047 7527                    jne 0043B070

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B025(C)
|
:0043B049 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0043B04C 51                      push ecx
:0043B04D 8B55EC                  mov edx, dword ptr [ebp-14]
:0043B050 33C0                    xor eax, eax
:0043B052 8A4208                  mov al, byte ptr [edx+08]
:0043B055 8BC8                    mov ecx, eax
:0043B057 6BC924                  imul ecx, 00000024
:0043B05A 81C1502C4B00            add ecx, 004B2C50
:0043B060 E82B040000              call 0043B490
:0043B065 50                      push eax
:0043B066 B9382C4B00              mov ecx, 004B2C38
:0043B06B E830B5FCFF              call 004065A0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B047(C)
|
:0043B070 EB0F                    jmp 0043B081

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043AFE1(C)
|
:0043B072 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B075 83C109                  add ecx, 00000009
:0043B078 51                      push ecx
:0043B079 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:0043B07C E81FB5FCFF              call 004065A0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B070(U)
|
:0043B081 6880000000              push 00000080
:0043B086 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B089 E862AAFEFF              call 00425AF0
:0043B08E 85C0                    test eax, eax
:0043B090 0F857D010000            jne 0043B213
:0043B096 6A01                    push 00000001
:0043B098 68FF000000              push 000000FF
:0043B09D 68FF000000              push 000000FF
:0043B0A2 6A08                    push 00000008
:0043B0A4 8A55F8                  mov dl, byte ptr [ebp-08]
:0043B0A7 52                      push edx
:0043B0A8 8B45EC                  mov eax, dword ptr [ebp-14]
:0043B0AB 83C006                  add eax, 00000006
:0043B0AE 50                      push eax
:0043B0AF 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B0B2 E851D2FFFF              call 00438308
:0043B0B7 8845FC                  mov byte ptr [ebp-04], al
:0043B0BA 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B0BD 33D2                    xor edx, edx
:0043B0BF 8A5108                  mov dl, byte ptr [ecx+08]
:0043B0C2 81FAFF000000            cmp edx, 000000FF
:0043B0C8 744F                    je 0043B119
:0043B0CA 8B45FC                  mov eax, dword ptr [ebp-04]
:0043B0CD 25FF000000              and eax, 000000FF
:0043B0D2 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B0D5 33D2                    xor edx, edx
:0043B0D7 8A5108                  mov dl, byte ptr [ecx+08]
:0043B0DA 3BC2                    cmp eax, edx
:0043B0DC 753B                    jne 0043B119
:0043B0DE 8B45EC                  mov eax, dword ptr [ebp-14]
:0043B0E1 8A4804                  mov cl, byte ptr [eax+04]
:0043B0E4 51                      push ecx
:0043B0E5 6A14                    push 00000014
:0043B0E7 8D55F4                  lea edx, dword ptr [ebp-0C]
:0043B0EA 52                      push edx
:0043B0EB E888D0FFFF              call 00438178
:0043B0F0 83C40C                  add esp, 0000000C
:0043B0F3 6A01                    push 00000001
:0043B0F5 68FF000000              push 000000FF
:0043B0FA 68FF000000              push 000000FF
:0043B0FF 6A04                    push 00000004
:0043B101 8A45F8                  mov al, byte ptr [ebp-08]
:0043B104 50                      push eax
:0043B105 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B108 83C106                  add ecx, 00000006
:0043B10B 51                      push ecx
:0043B10C 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B10F E8F4D1FFFF              call 00438308
:0043B114 E9F5000000              jmp 0043B20E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043B0C8(C), :0043B0DC(C)
|
:0043B119 8B55EC                  mov edx, dword ptr [ebp-14]
:0043B11C 8A4204                  mov al, byte ptr [edx+04]
:0043B11F 50                      push eax
:0043B120 6A0A                    push 0000000A
:0043B122 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:0043B125 51                      push ecx
:0043B126 E84DD0FFFF              call 00438178
:0043B12B 83C40C                  add esp, 0000000C
:0043B12E 6A01                    push 00000001
:0043B130 8B55EC                  mov edx, dword ptr [ebp-14]
:0043B133 8A4207                  mov al, byte ptr [edx+07]
:0043B136 50                      push eax
:0043B137 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B13A 8A5106                  mov dl, byte ptr [ecx+06]
:0043B13D 52                      push edx
:0043B13E 6A02                    push 00000002
:0043B140 68FF000000              push 000000FF
:0043B145 8D45F4                  lea eax, dword ptr [ebp-0C]
:0043B148 50                      push eax
:0043B149 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B14C E8B7D1FFFF              call 00438308
:0043B151 25FF000000              and eax, 000000FF
:0043B156 83F801                  cmp eax, 00000001
:0043B159 7479                    je 0043B1D4
:0043B15B 6A00                    push 00000000
:0043B15D 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B160 8A5107                  mov dl, byte ptr [ecx+07]
:0043B163 52                      push edx
:0043B164 8B45EC                  mov eax, dword ptr [ebp-14]
:0043B167 8A4806                  mov cl, byte ptr [eax+06]
:0043B16A 51                      push ecx
:0043B16B 6A02                    push 00000002
:0043B16D 68FF000000              push 000000FF
:0043B172 8D55F4                  lea edx, dword ptr [ebp-0C]
:0043B175 52                      push edx
:0043B176 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B179 E88AD1FFFF              call 00438308
:0043B17E 25FF000000              and eax, 000000FF
:0043B183 3DFF000000              cmp eax, 000000FF
:0043B188 743C                    je 0043B1C6
:0043B18A 6A01                    push 00000001
:0043B18C 8A45F8                  mov al, byte ptr [ebp-08]
:0043B18F 50                      push eax
:0043B190 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B193 83C106                  add ecx, 00000006
:0043B196 51                      push ecx
:0043B197 8D55F4                  lea edx, dword ptr [ebp-0C]
:0043B19A 52                      push edx
:0043B19B 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B19E E88BCCFFFF              call 00437E2E
:0043B1A3 6A01                    push 00000001
:0043B1A5 68FF000000              push 000000FF
:0043B1AA 68FF000000              push 000000FF
:0043B1AF 6A04                    push 00000004
:0043B1B1 8A45F8                  mov al, byte ptr [ebp-08]
:0043B1B4 50                      push eax
:0043B1B5 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B1B8 83C106                  add ecx, 00000006
:0043B1BB 51                      push ecx
:0043B1BC 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B1BF E844D1FFFF              call 00438308
:0043B1C4 EB0C                    jmp 0043B1D2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B188(C)
|
:0043B1C6 8A55F8                  mov dl, byte ptr [ebp-08]
:0043B1C9 52                      push edx
:0043B1CA 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B1CD E8F7F5FFFF              call 0043A7C9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B1C4(U)
|
:0043B1D2 EB3A                    jmp 0043B20E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B159(C)
|
:0043B1D4 6A01                    push 00000001
:0043B1D6 8A45F8                  mov al, byte ptr [ebp-08]
:0043B1D9 50                      push eax
:0043B1DA 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B1DD 83C106                  add ecx, 00000006
:0043B1E0 51                      push ecx
:0043B1E1 8D55F4                  lea edx, dword ptr [ebp-0C]
:0043B1E4 52                      push edx
:0043B1E5 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B1E8 E841CCFFFF              call 00437E2E
:0043B1ED 6A01                    push 00000001
:0043B1EF 68FF000000              push 000000FF
:0043B1F4 68FF000000              push 000000FF
:0043B1F9 6A04                    push 00000004
:0043B1FB 8A45F8                  mov al, byte ptr [ebp-08]
:0043B1FE 50                      push eax
:0043B1FF 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B202 83C106                  add ecx, 00000006
:0043B205 51                      push ecx
:0043B206 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B209 E8FAD0FFFF              call 00438308

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043B114(U), :0043B1D2(U)
|
:0043B20E E996000000              jmp 0043B2A9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B090(C)
|
:0043B213 6A01                    push 00000001
:0043B215 8A55F5                  mov dl, byte ptr [ebp-0B]
:0043B218 52                      push edx
:0043B219 8A45F4                  mov al, byte ptr [ebp-0C]
:0043B21C 50                      push eax
:0043B21D 6A02                    push 00000002
:0043B21F 68FF000000              push 000000FF
:0043B224 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B227 83C106                  add ecx, 00000006
:0043B22A 51                      push ecx
:0043B22B 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B22E E8D5D0FFFF              call 00438308
:0043B233 25FF000000              and eax, 000000FF
:0043B238 83F801                  cmp eax, 00000001
:0043B23B 745E                    je 0043B29B
:0043B23D 6A00                    push 00000000
:0043B23F 8A55F5                  mov dl, byte ptr [ebp-0B]
:0043B242 52                      push edx
:0043B243 8A45F4                  mov al, byte ptr [ebp-0C]
:0043B246 50                      push eax
:0043B247 6A02                    push 00000002
:0043B249 68FF000000              push 000000FF
:0043B24E 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B251 83C106                  add ecx, 00000006
:0043B254 51                      push ecx
:0043B255 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B258 E8ABD0FFFF              call 00438308
:0043B25D 25FF000000              and eax, 000000FF
:0043B262 85C0                    test eax, eax
:0043B264 7410                    je 0043B276
:0043B266 8D55F4                  lea edx, dword ptr [ebp-0C]
:0043B269 52                      push edx
:0043B26A B9202C4B00              mov ecx, 004B2C20
:0043B26F E82CB3FCFF              call 004065A0
:0043B274 EB23                    jmp 0043B299

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B264(C)
|
:0043B276 8B45EC                  mov eax, dword ptr [ebp-14]
:0043B279 83C006                  add eax, 00000006
:0043B27C 50                      push eax
:0043B27D B9202C4B00              mov ecx, 004B2C20
:0043B282 E819B3FCFF              call 004065A0
:0043B287 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B28A 83C106                  add ecx, 00000006
:0043B28D 51                      push ecx
:0043B28E 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B291 83C109                  add ecx, 00000009
:0043B294 E807B3FCFF              call 004065A0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B274(U)
|
:0043B299 EB0E                    jmp 0043B2A9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B23B(C)
|
:0043B29B 8D55F4                  lea edx, dword ptr [ebp-0C]
:0043B29E 52                      push edx
:0043B29F B9202C4B00              mov ecx, 004B2C20
:0043B2A4 E8F7B2FCFF              call 004065A0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043B20E(U), :0043B299(U)
|
:0043B2A9 E9A9000000              jmp 0043B357
:0043B2AE 6A01                    push 00000001
:0043B2B0 68FF000000              push 000000FF
:0043B2B5 68FF000000              push 000000FF
:0043B2BA 6A08                    push 00000008
:0043B2BC 8A45F8                  mov al, byte ptr [ebp-08]
:0043B2BF 50                      push eax
:0043B2C0 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B2C3 83C106                  add ecx, 00000006
:0043B2C6 51                      push ecx
:0043B2C7 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B2CA E839D0FFFF              call 00438308
:0043B2CF 8845FC                  mov byte ptr [ebp-04], al
:0043B2D2 8B55FC                  mov edx, dword ptr [ebp-04]
:0043B2D5 81E2FF000000            and edx, 000000FF
:0043B2DB 81FAFF000000            cmp edx, 000000FF
:0043B2E1 7423                    je 0043B306
:0043B2E3 6A01                    push 00000001
:0043B2E5 68FF000000              push 000000FF
:0043B2EA 68FF000000              push 000000FF
:0043B2EF 6A04                    push 00000004
:0043B2F1 8A45F8                  mov al, byte ptr [ebp-08]
:0043B2F4 50                      push eax
:0043B2F5 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B2F8 83C106                  add ecx, 00000006
:0043B2FB 51                      push ecx
:0043B2FC 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B2FF E804D0FFFF              call 00438308
:0043B304 EB11                    jmp 0043B317

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B2E1(C)
|
:0043B306 8B55EC                  mov edx, dword ptr [ebp-14]
:0043B309 83C206                  add edx, 00000006
:0043B30C 52                      push edx
:0043B30D B9202C4B00              mov ecx, 004B2C20
:0043B312 E889B2FCFF              call 004065A0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B304(U)
|
:0043B317 EB3E                    jmp 0043B357
:0043B319 8A45F8                  mov al, byte ptr [ebp-08]
:0043B31C 50                      push eax
:0043B31D 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B320 E8A4F4FFFF              call 0043A7C9
:0043B325 EB30                    jmp 0043B357
:0043B327 6A01                    push 00000001
:0043B329 68FF000000              push 000000FF
:0043B32E 68FF000000              push 000000FF
:0043B333 6A04                    push 00000004
:0043B335 6A00                    push 00000000
:0043B337 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B33A 83C106                  add ecx, 00000006
:0043B33D 51                      push ecx
:0043B33E 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B341 E8C2CFFFFF              call 00438308
:0043B346 8B55EC                  mov edx, dword ptr [ebp-14]
:0043B349 83C206                  add edx, 00000006
:0043B34C 52                      push edx
:0043B34D B9202C4B00              mov ecx, 004B2C20
:0043B352 E849B2FCFF              call 004065A0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043AFAB(U), :0043AFC4(C), :0043B2A9(U), :0043B317(U), :0043B325(U)
|
:0043B357 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B35A E8F7F5FFFF              call 0043A956
:0043B35F 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B362 E8EB4E0000              call 00440252
:0043B367 6880000000              push 00000080
:0043B36C 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B36F E87CA7FEFF              call 00425AF0
:0043B374 85C0                    test eax, eax
:0043B376 7567                    jne 0043B3DF
:0043B378 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B37B E850A7FEFF              call 00425AD0
:0043B380 25FF000000              and eax, 000000FF
:0043B385 83F804                  cmp eax, 00000004
:0043B388 7455                    je 0043B3DF
:0043B38A 33C0                    xor eax, eax
:0043B38C A0442C4B00              mov al, byte ptr [004B2C44]
:0043B391 3DFF000000              cmp eax, 000000FF
:0043B396 750A                    jne 0043B3A2
:0043B398 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B39B E85BF7FFFF              call 0043AAFB
:0043B3A0 EB3D                    jmp 0043B3DF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B396(C)
|
:0043B3A2 8A0D442C4B00            mov cl, byte ptr [004B2C44]
:0043B3A8 51                      push ecx
:0043B3A9 8A15282C4B00            mov dl, byte ptr [004B2C28]
:0043B3AF 52                      push edx
:0043B3B0 6A02                    push 00000002
:0043B3B2 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B3B5 E8CE600000              call 00441488
:0043B3BA A0442C4B00              mov al, byte ptr [004B2C44]
:0043B3BF 50                      push eax
:0043B3C0 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B3C3 E8D1280000              call 0043DC99
:0043B3C8 33C9                    xor ecx, ecx
:0043B3CA 8A0D442C4B00            mov cl, byte ptr [004B2C44]
:0043B3D0 83F939                  cmp ecx, 00000039
:0043B3D3 750A                    jne 0043B3DF
:0043B3D5 C7050C424B0001000000    mov dword ptr [004B420C], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043B376(C), :0043B388(C), :0043B3A0(U), :0043B3D3(C)
|
:0043B3DF 6880000000              push 00000080
:0043B3E4 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B3E7 E804A7FEFF              call 00425AF0
:0043B3EC 85C0                    test eax, eax
:0043B3EE 7518                    jne 0043B408
:0043B3F0 6A04                    push 00000004
:0043B3F2 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B3F5 E8F6A6FEFF              call 00425AF0
:0043B3FA 85C0                    test eax, eax
:0043B3FC 740A                    je 0043B408
:0043B3FE 6A02                    push 00000002
:0043B400 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B403 E810730000              call 00442718

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043ADD5(C), :0043ADE7(C), :0043ADF9(C), :0043B3EE(C), :0043B3FC(C)
|
:0043B408 8BE5                    mov esp, ebp
:0043B40A 5D                      pop ebp
:0043B40B C3                      ret



:0043B40C D4AF4300                DWORD 0043AFD4
:0043B410 19B34300                DWORD 0043B319
:0043B414 27B34300                DWORD 0043B327
:0043B418 AEB24300                DWORD 0043B2AE
:0043B41C D4AF4300                DWORD 0043AFD4



* Referenced by a CALL at Addresses:
|:00437EBC   , :00437F7C   , :0043822D   , :00438381   , :00438654   
|:004388DA   , :0043A593   , :0043A612   , :0043A6D9   , :0043A744   
|:0043A997   , :0043AA3F   , :0043DA42   , :004402A3   , :00453FDB   
|:00454138   , :004561BD   
|
:0043B420 55                      push ebp
:0043B421 8BEC                    mov ebp, esp
:0043B423 51                      push ecx
:0043B424 8B4508                  mov eax, dword ptr [ebp+08]
:0043B427 33C9                    xor ecx, ecx
:0043B429 8A08                    mov cl, byte ptr [eax]
:0043B42B 8B550C                  mov edx, dword ptr [ebp+0C]
:0043B42E 33C0                    xor eax, eax
:0043B430 8A02                    mov al, byte ptr [edx]
:0043B432 3BC8                    cmp ecx, eax
:0043B434 751D                    jne 0043B453
:0043B436 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043B439 33D2                    xor edx, edx
:0043B43B 8A5101                  mov dl, byte ptr [ecx+01]
:0043B43E 8B450C                  mov eax, dword ptr [ebp+0C]
:0043B441 33C9                    xor ecx, ecx
:0043B443 8A4801                  mov cl, byte ptr [eax+01]
:0043B446 3BD1                    cmp edx, ecx
:0043B448 7509                    jne 0043B453
:0043B44A C745FC01000000          mov [ebp-04], 00000001
:0043B451 EB07                    jmp 0043B45A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043B434(C), :0043B448(C)
|
:0043B453 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B451(U)
|
:0043B45A 8B45FC                  mov eax, dword ptr [ebp-04]
:0043B45D 8BE5                    mov esp, ebp
:0043B45F 5D                      pop ebp
:0043B460 C3                      ret


:0043B461 CC                      int 03
:0043B462 CC                      int 03
:0043B463 CC                      int 03
:0043B464 CC                      int 03
:0043B465 CC                      int 03
:0043B466 CC                      int 03
:0043B467 CC                      int 03
:0043B468 CC                      int 03
:0043B469 CC                      int 03
:0043B46A CC                      int 03
:0043B46B CC                      int 03
:0043B46C CC                      int 03
:0043B46D CC                      int 03
:0043B46E CC                      int 03
:0043B46F CC                      int 03

* Referenced by a CALL at Addresses:
|:00439F3C   , :00439FA1   , :0043A04E   , :0043A07E   , :0043A0AD   
|:0043A0DA   , :0043A110   , :0043BB2C   , :0043BCB2   , :0043BD81   
|:0043C1AB   , :0043D21B   , :0043F7DB   , :0043F859   , :0043F886   
|:0043FF7A   , :0043FFF9   , :00440069   , :004400AE   , :004400ED   
|:004425EE   , :00442B5F   , :004449C2   , :00444B21   , :00459596   
|:0045B2DE   
|
:0043B470 55                      push ebp
:0043B471 8BEC                    mov ebp, esp
:0043B473 51                      push ecx
:0043B474 894DFC                  mov dword ptr [ebp-04], ecx
:0043B477 8B45FC                  mov eax, dword ptr [ebp-04]
:0043B47A 8B08                    mov ecx, dword ptr [eax]
:0043B47C 6BC948                  imul ecx, 00000048
:0043B47F 81C1681B4A00            add ecx, 004A1B68
:0043B485 E846C3FCFF              call 004077D0
:0043B48A 8BE5                    mov esp, ebp
:0043B48C 5D                      pop ebp
:0043B48D C3                      ret


:0043B48E CC                      int 03
:0043B48F CC                      int 03

* Referenced by a CALL at Addresses:
|:0043B060   , :00459541   
|
:0043B490 55                      push ebp
:0043B491 8BEC                    mov ebp, esp
:0043B493 51                      push ecx
:0043B494 894DFC                  mov dword ptr [ebp-04], ecx
:0043B497 8B45FC                  mov eax, dword ptr [ebp-04]
:0043B49A 668B4809                mov cx, word ptr [eax+09]
:0043B49E 8B5508                  mov edx, dword ptr [ebp+08]
:0043B4A1 66890A                  mov word ptr [edx], cx
:0043B4A4 8B4508                  mov eax, dword ptr [ebp+08]
:0043B4A7 8BE5                    mov esp, ebp
:0043B4A9 5D                      pop ebp
:0043B4AA C20400                  ret 0004


:0043B4AD CC                      int 03
:0043B4AE CC                      int 03
:0043B4AF CC                      int 03

* Referenced by a CALL at Addresses:
|:0042344F   , :0042363D   , :00423A40   , :00424662   , :0043BD1C   
|:0043BFF1   
|
:0043B4B0 55                      push ebp
:0043B4B1 8BEC                    mov ebp, esp
:0043B4B3 83EC08                  sub esp, 00000008
:0043B4B6 894DF8                  mov dword ptr [ebp-08], ecx
:0043B4B9 8B450C                  mov eax, dword ptr [ebp+0C]
:0043B4BC 25FF000000              and eax, 000000FF
:0043B4C1 83F801                  cmp eax, 00000001
:0043B4C4 7520                    jne 0043B4E6
:0043B4C6 8A4D10                  mov cl, byte ptr [ebp+10]
:0043B4C9 51                      push ecx
:0043B4CA 8B5508                  mov edx, dword ptr [ebp+08]
:0043B4CD 52                      push edx
:0043B4CE 6A00                    push 00000000
:0043B4D0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043B4D3 E835000000              call 0043B50D
:0043B4D8 50                      push eax
:0043B4D9 E854460400              call 0047FB32
:0043B4DE 83C404                  add esp, 00000004
:0043B4E1 8945FC                  mov dword ptr [ebp-04], eax
:0043B4E4 EB1E                    jmp 0043B504

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B4C4(C)
|
:0043B4E6 8A4510                  mov al, byte ptr [ebp+10]
:0043B4E9 50                      push eax
:0043B4EA 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043B4ED 51                      push ecx
:0043B4EE 6A00                    push 00000000
:0043B4F0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043B4F3 E847020000              call 0043B73F
:0043B4F8 50                      push eax
:0043B4F9 E834460400              call 0047FB32
:0043B4FE 83C404                  add esp, 00000004
:0043B501 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B4E4(U)
|
:0043B504 8B45FC                  mov eax, dword ptr [ebp-04]
:0043B507 8BE5                    mov esp, ebp
:0043B509 5D                      pop ebp
:0043B50A C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:0043B4D3   , :004406CF   
|
:0043B50D 55                      push ebp
:0043B50E 8BEC                    mov ebp, esp
:0043B510 83EC2C                  sub esp, 0000002C
:0043B513 56                      push esi
:0043B514 894DD8                  mov dword ptr [ebp-28], ecx
:0043B517 C745F800000000          mov [ebp-08], 00000000
:0043B51E C745E400000000          mov [ebp-1C], 00000000
:0043B525 837D0800                cmp dword ptr [ebp+08], 00000000
:0043B529 740D                    je 0043B538
:0043B52B 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0043B52E E87D0DFEFF              call 0041C2B0
:0043B533 8845D7                  mov byte ptr [ebp-29], al
:0043B536 EB09                    jmp 0043B541

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B529(C)
|
:0043B538 8B45D8                  mov eax, dword ptr [ebp-28]
:0043B53B 8A4804                  mov cl, byte ptr [eax+04]
:0043B53E 884DD7                  mov byte ptr [ebp-29], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B536(U)
|
:0043B541 8A55D7                  mov dl, byte ptr [ebp-29]
:0043B544 8855F4                  mov byte ptr [ebp-0C], dl
:0043B547 837D0800                cmp dword ptr [ebp+08], 00000000
:0043B54B 740B                    je 0043B558
:0043B54D 8B45D8                  mov eax, dword ptr [ebp-28]
:0043B550 8A4804                  mov cl, byte ptr [eax+04]
:0043B553 884DD6                  mov byte ptr [ebp-2A], cl
:0043B556 EB0B                    jmp 0043B563

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B54B(C)
|
:0043B558 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0043B55B E8500DFEFF              call 0041C2B0
:0043B560 8845D6                  mov byte ptr [ebp-2A], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B556(U)
|
:0043B563 8A55D6                  mov dl, byte ptr [ebp-2A]
:0043B566 8855FC                  mov byte ptr [ebp-04], dl
:0043B569 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043B56C 25FF000000              and eax, 000000FF
:0043B571 6BC024                  imul eax, 00000024
:0043B574 05502C4B00              add eax, 004B2C50
:0043B579 8945EC                  mov dword ptr [ebp-14], eax
:0043B57C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043B57F 81E1FF000000            and ecx, 000000FF
:0043B585 6BC924                  imul ecx, 00000024
:0043B588 81C1502C4B00            add ecx, 004B2C50
:0043B58E 894DDC                  mov dword ptr [ebp-24], ecx
:0043B591 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B594 E8D7400200              call 0045F670
:0043B599 6BC048                  imul eax, 00000048
:0043B59C 05681B4A00              add eax, 004A1B68
:0043B5A1 8945E0                  mov dword ptr [ebp-20], eax
:0043B5A4 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043B5A7 E8C4400200              call 0045F670
:0043B5AC 6BC048                  imul eax, 00000048
:0043B5AF 05681B4A00              add eax, 004A1B68
:0043B5B4 8945E8                  mov dword ptr [ebp-18], eax
:0043B5B7 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B5BA E89E4A0000              call 0044005D
:0043B5BF 85C0                    test eax, eax
:0043B5C1 7415                    je 0043B5D8
:0043B5C3 6A38                    push 00000038
:0043B5C5 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043B5C8 E83CC4FCFF              call 00407A09
:0043B5CD 85C0                    test eax, eax
:0043B5CF 7407                    je 0043B5D8
:0043B5D1 33C0                    xor eax, eax
:0043B5D3 E960010000              jmp 0043B738

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043B5C1(C), :0043B5CF(C)
|
:0043B5D8 6A08                    push 00000008
:0043B5DA 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043B5DD E8FEB0FCFF              call 004066E0
:0043B5E2 85C0                    test eax, eax
:0043B5E4 740A                    je 0043B5F0
:0043B5E6 B864000000              mov eax, 00000064
:0043B5EB E948010000              jmp 0043B738

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B5E4(C)
|
:0043B5F0 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043B5F3 E839400000              call 0043F631
:0043B5F8 8945F8                  mov dword ptr [ebp-08], eax
:0043B5FB 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043B5FE E82E400000              call 0043F631
:0043B603 8945E4                  mov dword ptr [ebp-1C], eax
:0043B606 8B55E4                  mov edx, dword ptr [ebp-1C]
:0043B609 D1E2                    shl edx, 1
:0043B60B 3955F8                  cmp dword ptr [ebp-08], edx
:0043B60E 720C                    jb 0043B61C
:0043B610 C745F064000000          mov [ebp-10], 00000064
:0043B617 E990000000              jmp 0043B6AC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B60E(C)
|
:0043B61C 8B45F8                  mov eax, dword ptr [ebp-08]
:0043B61F 3B45E4                  cmp eax, dword ptr [ebp-1C]
:0043B622 7220                    jb 0043B644
:0043B624 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043B627 51                      push ecx
:0043B628 8B55F8                  mov edx, dword ptr [ebp-08]
:0043B62B 52                      push edx
:0043B62C E86D440400              call 0047FA9E
:0043B631 83C408                  add esp, 00000008
:0043B634 6BC00A                  imul eax, 0000000A
:0043B637 33D2                    xor edx, edx
:0043B639 F775E4                  div [ebp-1C]
:0043B63C 83C05A                  add eax, 0000005A
:0043B63F 8945F0                  mov dword ptr [ebp-10], eax
:0043B642 EB68                    jmp 0043B6AC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B622(C)
|
:0043B644 8B45E4                  mov eax, dword ptr [ebp-1C]
:0043B647 D1E8                    shr eax, 1
:0043B649 3945F8                  cmp dword ptr [ebp-08], eax
:0043B64C 7226                    jb 0043B674
:0043B64E 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043B651 D1E9                    shr ecx, 1
:0043B653 51                      push ecx
:0043B654 8B55F8                  mov edx, dword ptr [ebp-08]
:0043B657 52                      push edx
:0043B658 E841440400              call 0047FA9E
:0043B65D 83C408                  add esp, 00000008
:0043B660 6BC01E                  imul eax, 0000001E
:0043B663 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043B666 D1E9                    shr ecx, 1
:0043B668 33D2                    xor edx, edx
:0043B66A F7F1                    div ecx
:0043B66C 83C03C                  add eax, 0000003C
:0043B66F 8945F0                  mov dword ptr [ebp-10], eax
:0043B672 EB38                    jmp 0043B6AC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B64C(C)
|
:0043B674 8B45E4                  mov eax, dword ptr [ebp-1C]
:0043B677 33D2                    xor edx, edx
:0043B679 B903000000              mov ecx, 00000003
:0043B67E F7F1                    div ecx
:0043B680 50                      push eax
:0043B681 8B55F8                  mov edx, dword ptr [ebp-08]
:0043B684 52                      push edx
:0043B685 E814440400              call 0047FA9E
:0043B68A 83C408                  add esp, 00000008
:0043B68D 8BC8                    mov ecx, eax
:0043B68F 6BC91E                  imul ecx, 0000001E
:0043B692 8B45E4                  mov eax, dword ptr [ebp-1C]
:0043B695 33D2                    xor edx, edx
:0043B697 BE03000000              mov esi, 00000003
:0043B69C F7F6                    div esi
:0043B69E 8BF0                    mov esi, eax
:0043B6A0 8BC1                    mov eax, ecx
:0043B6A2 33D2                    xor edx, edx
:0043B6A4 F7F6                    div esi
:0043B6A6 83C01E                  add eax, 0000001E
:0043B6A9 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043B617(U), :0043B642(U), :0043B672(U)
|
:0043B6AC 6A27                    push 00000027
:0043B6AE 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0043B6B1 E853C3FCFF              call 00407A09
:0043B6B6 85C0                    test eax, eax
:0043B6B8 7421                    je 0043B6DB
:0043B6BA 6A64                    push 00000064
:0043B6BC 6A27                    push 00000027
:0043B6BE 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0043B6C1 E82CC4FCFF              call 00407AF2
:0043B6C6 25FF000000              and eax, 000000FF
:0043B6CB 50                      push eax
:0043B6CC 8B55F0                  mov edx, dword ptr [ebp-10]
:0043B6CF 52                      push edx
:0043B6D0 E8B4430400              call 0047FA89
:0043B6D5 83C40C                  add esp, 0000000C
:0043B6D8 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B6B8(C)
|
:0043B6DB 6A35                    push 00000035
:0043B6DD 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043B6E0 E824C3FCFF              call 00407A09
:0043B6E5 85C0                    test eax, eax
:0043B6E7 741F                    je 0043B708
:0043B6E9 6A35                    push 00000035
:0043B6EB 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043B6EE E8FFC3FCFF              call 00407AF2
:0043B6F3 25FF000000              and eax, 000000FF
:0043B6F8 50                      push eax
:0043B6F9 8B45F0                  mov eax, dword ptr [ebp-10]
:0043B6FC 50                      push eax
:0043B6FD E89C430400              call 0047FA9E
:0043B702 83C408                  add esp, 00000008
:0043B705 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B6E7(C)
|
:0043B708 6A37                    push 00000037
:0043B70A 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043B70D E8F7C2FCFF              call 00407A09
:0043B712 85C0                    test eax, eax
:0043B714 741F                    je 0043B735
:0043B716 6A37                    push 00000037
:0043B718 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043B71B E8D2C3FCFF              call 00407AF2
:0043B720 25FF000000              and eax, 000000FF
:0043B725 50                      push eax
:0043B726 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043B729 51                      push ecx
:0043B72A E86F430400              call 0047FA9E
:0043B72F 83C408                  add esp, 00000008
:0043B732 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B714(C)
|
:0043B735 8B45F0                  mov eax, dword ptr [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043B5D3(U), :0043B5EB(U)
|
:0043B738 5E                      pop esi
:0043B739 8BE5                    mov esp, ebp
:0043B73B 5D                      pop ebp
:0043B73C C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:00439A3F   , :00439E4E   , :0043B4F3   , :004407E3   , :00440899   
|
:0043B73F 55                      push ebp
:0043B740 8BEC                    mov ebp, esp
:0043B742 83EC38                  sub esp, 00000038
:0043B745 56                      push esi
:0043B746 894DD4                  mov dword ptr [ebp-2C], ecx
:0043B749 C745F400000000          mov [ebp-0C], 00000000
:0043B750 C745E000000000          mov [ebp-20], 00000000
:0043B757 837D0800                cmp dword ptr [ebp+08], 00000000
:0043B75B 740D                    je 0043B76A
:0043B75D 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0043B760 E84B0BFEFF              call 0041C2B0
:0043B765 8845D3                  mov byte ptr [ebp-2D], al
:0043B768 EB09                    jmp 0043B773

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B75B(C)
|
:0043B76A 8B45D4                  mov eax, dword ptr [ebp-2C]
:0043B76D 8A4804                  mov cl, byte ptr [eax+04]
:0043B770 884DD3                  mov byte ptr [ebp-2D], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B768(U)
|
:0043B773 8A55D3                  mov dl, byte ptr [ebp-2D]
:0043B776 8855EC                  mov byte ptr [ebp-14], dl
:0043B779 837D0800                cmp dword ptr [ebp+08], 00000000
:0043B77D 740B                    je 0043B78A
:0043B77F 8B45D4                  mov eax, dword ptr [ebp-2C]
:0043B782 8A4804                  mov cl, byte ptr [eax+04]
:0043B785 884DD2                  mov byte ptr [ebp-2E], cl
:0043B788 EB0B                    jmp 0043B795

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B77D(C)
|
:0043B78A 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0043B78D E81E0BFEFF              call 0041C2B0
:0043B792 8845D2                  mov byte ptr [ebp-2E], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B788(U)
|
:0043B795 8A55D2                  mov dl, byte ptr [ebp-2E]
:0043B798 8855FC                  mov byte ptr [ebp-04], dl
:0043B79B 8B45EC                  mov eax, dword ptr [ebp-14]
:0043B79E 25FF000000              and eax, 000000FF
:0043B7A3 6BC024                  imul eax, 00000024
:0043B7A6 05502C4B00              add eax, 004B2C50
:0043B7AB 8945E8                  mov dword ptr [ebp-18], eax
:0043B7AE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043B7B1 81E1FF000000            and ecx, 000000FF
:0043B7B7 6BC924                  imul ecx, 00000024
:0043B7BA 81C1502C4B00            add ecx, 004B2C50
:0043B7C0 894DD8                  mov dword ptr [ebp-28], ecx
:0043B7C3 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043B7C6 E8A53E0200              call 0045F670
:0043B7CB 6BC048                  imul eax, 00000048
:0043B7CE 05681B4A00              add eax, 004A1B68
:0043B7D3 8945DC                  mov dword ptr [ebp-24], eax
:0043B7D6 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0043B7D9 E8923E0200              call 0045F670
:0043B7DE 6BC048                  imul eax, 00000048
:0043B7E1 05681B4A00              add eax, 004A1B68
:0043B7E6 8945E4                  mov dword ptr [ebp-1C], eax
:0043B7E9 8B4D10                  mov ecx, dword ptr [ebp+10]
:0043B7EC 81E1FF000000            and ecx, 000000FF
:0043B7F2 6BC946                  imul ecx, 00000046
:0043B7F5 81C1C0F44A00            add ecx, 004AF4C0
:0043B7FB E8202B0000              call 0043E320
:0043B800 8845F8                  mov byte ptr [ebp-08], al
:0043B803 6A00                    push 00000000
:0043B805 8A55FC                  mov dl, byte ptr [ebp-04]
:0043B808 52                      push edx
:0043B809 8A45EC                  mov al, byte ptr [ebp-14]
:0043B80C 50                      push eax
:0043B80D 8A4D10                  mov cl, byte ptr [ebp+10]
:0043B810 51                      push ecx
:0043B811 E80C4CFEFF              call 00420422
:0043B816 83C410                  add esp, 00000010
:0043B819 85C0                    test eax, eax
:0043B81B 7507                    jne 0043B824
:0043B81D 33C0                    xor eax, eax
:0043B81F E940030000              jmp 0043BB64

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B81B(C)
|
:0043B824 6A08                    push 00000008
:0043B826 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0043B829 E8B2AEFCFF              call 004066E0
:0043B82E 85C0                    test eax, eax
:0043B830 7425                    je 0043B857
:0043B832 8B5510                  mov edx, dword ptr [ebp+10]
:0043B835 81E2FF000000            and edx, 000000FF
:0043B83B 83FA09                  cmp edx, 00000009
:0043B83E 7417                    je 0043B857
:0043B840 8B4510                  mov eax, dword ptr [ebp+10]
:0043B843 25FF000000              and eax, 000000FF
:0043B848 83F815                  cmp eax, 00000015
:0043B84B 740A                    je 0043B857
:0043B84D B864000000              mov eax, 00000064
:0043B852 E90D030000              jmp 0043BB64

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043B830(C), :0043B83E(C), :0043B84B(C)
|
:0043B857 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043B85A E8843D0000              call 0043F5E3
:0043B85F 8BF0                    mov esi, eax
:0043B861 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043B864 E8163E0000              call 0043F67F
:0043B869 03F0                    add esi, eax
:0043B86B 8975F4                  mov dword ptr [ebp-0C], esi
:0043B86E 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0043B871 E86D3D0000              call 0043F5E3
:0043B876 8BF0                    mov esi, eax
:0043B878 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0043B87B E8FF3D0000              call 0043F67F
:0043B880 03F0                    add esi, eax
:0043B882 8975E0                  mov dword ptr [ebp-20], esi
:0043B885 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0043B888 D1E1                    shl ecx, 1
:0043B88A 394DF4                  cmp dword ptr [ebp-0C], ecx
:0043B88D 720C                    jb 0043B89B
:0043B88F C745F064000000          mov [ebp-10], 00000064
:0043B896 E990000000              jmp 0043B92B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B88D(C)
|
:0043B89B 8B55F4                  mov edx, dword ptr [ebp-0C]
:0043B89E 3B55E0                  cmp edx, dword ptr [ebp-20]
:0043B8A1 7220                    jb 0043B8C3
:0043B8A3 8B45E0                  mov eax, dword ptr [ebp-20]
:0043B8A6 50                      push eax
:0043B8A7 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043B8AA 51                      push ecx
:0043B8AB E8EE410400              call 0047FA9E
:0043B8B0 83C408                  add esp, 00000008
:0043B8B3 6BC00A                  imul eax, 0000000A
:0043B8B6 33D2                    xor edx, edx
:0043B8B8 F775E0                  div [ebp-20]
:0043B8BB 83C05A                  add eax, 0000005A
:0043B8BE 8945F0                  mov dword ptr [ebp-10], eax
:0043B8C1 EB68                    jmp 0043B92B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B8A1(C)
|
:0043B8C3 8B55E0                  mov edx, dword ptr [ebp-20]
:0043B8C6 D1EA                    shr edx, 1
:0043B8C8 3955F4                  cmp dword ptr [ebp-0C], edx
:0043B8CB 7226                    jb 0043B8F3
:0043B8CD 8B45E0                  mov eax, dword ptr [ebp-20]
:0043B8D0 D1E8                    shr eax, 1
:0043B8D2 50                      push eax
:0043B8D3 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043B8D6 51                      push ecx
:0043B8D7 E8C2410400              call 0047FA9E
:0043B8DC 83C408                  add esp, 00000008
:0043B8DF 6BC01E                  imul eax, 0000001E
:0043B8E2 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0043B8E5 D1E9                    shr ecx, 1
:0043B8E7 33D2                    xor edx, edx
:0043B8E9 F7F1                    div ecx
:0043B8EB 83C03C                  add eax, 0000003C
:0043B8EE 8945F0                  mov dword ptr [ebp-10], eax
:0043B8F1 EB38                    jmp 0043B92B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B8CB(C)
|
:0043B8F3 8B45E0                  mov eax, dword ptr [ebp-20]
:0043B8F6 33D2                    xor edx, edx
:0043B8F8 B903000000              mov ecx, 00000003
:0043B8FD F7F1                    div ecx
:0043B8FF 50                      push eax
:0043B900 8B55F4                  mov edx, dword ptr [ebp-0C]
:0043B903 52                      push edx
:0043B904 E895410400              call 0047FA9E
:0043B909 83C408                  add esp, 00000008
:0043B90C 8BC8                    mov ecx, eax
:0043B90E 6BC91E                  imul ecx, 0000001E
:0043B911 8B45E0                  mov eax, dword ptr [ebp-20]
:0043B914 33D2                    xor edx, edx
:0043B916 BE03000000              mov esi, 00000003
:0043B91B F7F6                    div esi
:0043B91D 8BF0                    mov esi, eax
:0043B91F 8BC1                    mov eax, ecx
:0043B921 33D2                    xor edx, edx
:0043B923 F7F6                    div esi
:0043B925 83C01E                  add eax, 0000001E
:0043B928 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043B896(U), :0043B8C1(U), :0043B8F1(U)
|
:0043B92B 6A34                    push 00000034
:0043B92D 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043B930 E8D4C0FCFF              call 00407A09
:0043B935 85C0                    test eax, eax
:0043B937 7421                    je 0043B95A
:0043B939 6A64                    push 00000064
:0043B93B 6A34                    push 00000034
:0043B93D 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043B940 E8ADC1FCFF              call 00407AF2
:0043B945 25FF000000              and eax, 000000FF
:0043B94A 50                      push eax
:0043B94B 8B55F0                  mov edx, dword ptr [ebp-10]
:0043B94E 52                      push edx
:0043B94F E835410400              call 0047FA89
:0043B954 83C40C                  add esp, 0000000C
:0043B957 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B937(C)
|
:0043B95A 6A36                    push 00000036
:0043B95C 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043B95F E8A5C0FCFF              call 00407A09
:0043B964 85C0                    test eax, eax
:0043B966 741F                    je 0043B987
:0043B968 6A36                    push 00000036
:0043B96A 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043B96D E880C1FCFF              call 00407AF2
:0043B972 25FF000000              and eax, 000000FF
:0043B977 50                      push eax
:0043B978 8B45F0                  mov eax, dword ptr [ebp-10]
:0043B97B 50                      push eax
:0043B97C E81D410400              call 0047FA9E
:0043B981 83C408                  add esp, 00000008
:0043B984 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B966(C)
|
:0043B987 6A37                    push 00000037
:0043B989 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043B98C E878C0FCFF              call 00407A09
:0043B991 85C0                    test eax, eax
:0043B993 741F                    je 0043B9B4
:0043B995 6A37                    push 00000037
:0043B997 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043B99A E853C1FCFF              call 00407AF2
:0043B99F 25FF000000              and eax, 000000FF
:0043B9A4 50                      push eax
:0043B9A5 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043B9A8 51                      push ecx
:0043B9A9 E8F0400400              call 0047FA9E
:0043B9AE 83C408                  add esp, 00000008
:0043B9B1 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043B993(C)
|
:0043B9B4 8B5510                  mov edx, dword ptr [ebp+10]
:0043B9B7 81E2FF000000            and edx, 000000FF
:0043B9BD 8955CC                  mov dword ptr [ebp-34], edx
:0043B9C0 837DCC43                cmp dword ptr [ebp-34], 00000043
:0043B9C4 0F8752010000            ja 0043BB1C
:0043B9CA 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0043B9CD 33C0                    xor eax, eax
:0043B9CF 8A8107BC4300            mov al, byte ptr [ecx+0043BC07]
:0043B9D5 FF24856BBB4300          jmp dword ptr [4*eax+0043BB6B]
:0043B9DC C745F064000000          mov [ebp-10], 00000064
:0043B9E3 E934010000              jmp 0043BB1C
:0043B9E8 837D0800                cmp dword ptr [ebp+08], 00000000
:0043B9EC 741A                    je 0043BA08
:0043B9EE 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0043B9F1 E83A26FEFF              call 0041E030
:0043B9F6 25FF000000              and eax, 000000FF
:0043B9FB 85C0                    test eax, eax
:0043B9FD 7509                    jne 0043BA08
:0043B9FF C745F000000000          mov [ebp-10], 00000000
:0043BA06 EB07                    jmp 0043BA0F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043B9EC(C), :0043B9FD(C)
|
:0043BA08 C745F064000000          mov [ebp-10], 00000064

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BA06(U)
|
:0043BA0F E908010000              jmp 0043BB1C
:0043BA14 E903010000              jmp 0043BB1C
:0043BA19 8B45F0                  mov eax, dword ptr [ebp-10]
:0043BA1C 6BC009                  imul eax, 00000009
:0043BA1F 33D2                    xor edx, edx
:0043BA21 B90A000000              mov ecx, 0000000A
:0043BA26 F7F1                    div ecx
:0043BA28 8945F0                  mov dword ptr [ebp-10], eax
:0043BA2B E9EC000000              jmp 0043BB1C
:0043BA30 837D0800                cmp dword ptr [ebp+08], 00000000
:0043BA34 741A                    je 0043BA50
:0043BA36 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0043BA39 E8F225FEFF              call 0041E030
:0043BA3E 25FF000000              and eax, 000000FF
:0043BA43 85C0                    test eax, eax
:0043BA45 7509                    jne 0043BA50
:0043BA47 C745F000000000          mov [ebp-10], 00000000
:0043BA4E EB12                    jmp 0043BA62

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043BA34(C), :0043BA45(C)
|
:0043BA50 8B45F0                  mov eax, dword ptr [ebp-10]
:0043BA53 6BC009                  imul eax, 00000009
:0043BA56 33D2                    xor edx, edx
:0043BA58 B90A000000              mov ecx, 0000000A
:0043BA5D F7F1                    div ecx
:0043BA5F 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BA4E(U)
|
:0043BA62 E9B5000000              jmp 0043BB1C
:0043BA67 8B45F0                  mov eax, dword ptr [ebp-10]
:0043BA6A C1E002                  shl eax, 02
:0043BA6D 33D2                    xor edx, edx
:0043BA6F B905000000              mov ecx, 00000005
:0043BA74 F7F1                    div ecx
:0043BA76 8945F0                  mov dword ptr [ebp-10], eax
:0043BA79 E99E000000              jmp 0043BB1C
:0043BA7E 8B45F0                  mov eax, dword ptr [ebp-10]
:0043BA81 6BC003                  imul eax, 00000003
:0043BA84 33D2                    xor edx, edx
:0043BA86 B905000000              mov ecx, 00000005
:0043BA8B F7F1                    div ecx
:0043BA8D 8945F0                  mov dword ptr [ebp-10], eax
:0043BA90 E987000000              jmp 0043BB1C
:0043BA95 8B55F0                  mov edx, dword ptr [ebp-10]
:0043BA98 D1EA                    shr edx, 1
:0043BA9A 8955F0                  mov dword ptr [ebp-10], edx
:0043BA9D EB7D                    jmp 0043BB1C
:0043BA9F 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0043BAA2 E80908FEFF              call 0041C2B0
:0043BAA7 25FF000000              and eax, 000000FF
:0043BAAC 85C0                    test eax, eax
:0043BAAE 7418                    je 0043BAC8
:0043BAB0 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0043BAB3 E8B83B0200              call 0045F670
:0043BAB8 8BF0                    mov esi, eax
:0043BABA B9902F4900              mov ecx, 00492F90
:0043BABF E86CABFCFF              call 00406630
:0043BAC4 3BF0                    cmp esi, eax
:0043BAC6 7509                    jne 0043BAD1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BAAE(C)
|
:0043BAC8 C745F000000000          mov [ebp-10], 00000000
:0043BACF EB0F                    jmp 0043BAE0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BAC6(C)
|
:0043BAD1 8B45F0                  mov eax, dword ptr [ebp-10]
:0043BAD4 33D2                    xor edx, edx
:0043BAD6 B903000000              mov ecx, 00000003
:0043BADB F7F1                    div ecx
:0043BADD 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BACF(U)
|
:0043BAE0 EB3A                    jmp 0043BB1C
:0043BAE2 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0043BAE5 E8C607FEFF              call 0041C2B0
:0043BAEA 25FF000000              and eax, 000000FF
:0043BAEF 85C0                    test eax, eax
:0043BAF1 7418                    je 0043BB0B
:0043BAF3 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0043BAF6 E8753B0200              call 0045F670
:0043BAFB 8BF0                    mov esi, eax
:0043BAFD B9902F4900              mov ecx, 00492F90
:0043BB02 E829ABFCFF              call 00406630
:0043BB07 3BF0                    cmp esi, eax
:0043BB09 7509                    jne 0043BB14

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BAF1(C)
|
:0043BB0B C745F000000000          mov [ebp-10], 00000000
:0043BB12 EB08                    jmp 0043BB1C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BB09(C)
|
:0043BB14 8B55F0                  mov edx, dword ptr [ebp-10]
:0043BB17 D1EA                    shr edx, 1
:0043BB19 8955F0                  mov dword ptr [ebp-10], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043B9C4(C), :0043B9E3(U), :0043BA0F(U), :0043BA14(U), :0043BA2B(U)
|:0043BA62(U), :0043BA79(U), :0043BA90(U), :0043BA9D(U), :0043BAE0(U)
|:0043BB12(U)
|
:0043BB1C 8B4510                  mov eax, dword ptr [ebp+10]
:0043BB1F 25FF000000              and eax, 000000FF
:0043BB24 83F814                  cmp eax, 00000014
:0043BB27 751D                    jne 0043BB46
:0043BB29 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043BB2C E83FF9FFFF              call 0043B470
:0043BB31 25FF000000              and eax, 000000FF
:0043BB36 83F80C                  cmp eax, 0000000C
:0043BB39 750B                    jne 0043BB46
:0043BB3B 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043BB3E 6BC903                  imul ecx, 00000003
:0043BB41 D1E9                    shr ecx, 1
:0043BB43 894DF0                  mov dword ptr [ebp-10], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043BB27(C), :0043BB39(C)
|
:0043BB46 837DF064                cmp dword ptr [ebp-10], 00000064
:0043BB4A 7609                    jbe 0043BB55
:0043BB4C C745C864000000          mov [ebp-38], 00000064
:0043BB53 EB06                    jmp 0043BB5B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BB4A(C)
|
:0043BB55 8B55F0                  mov edx, dword ptr [ebp-10]
:0043BB58 8955C8                  mov dword ptr [ebp-38], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BB53(U)
|
:0043BB5B 8B45C8                  mov eax, dword ptr [ebp-38]
:0043BB5E 8945F0                  mov dword ptr [ebp-10], eax
:0043BB61 8B45F0                  mov eax, dword ptr [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043B81F(U), :0043B852(U)
|
:0043BB64 5E                      pop esi
:0043BB65 8BE5                    mov esp, ebp
:0043BB67 5D                      pop ebp
:0043BB68 C20C00                  ret 000C



:0043BB6B 14BA4300                DWORD 0043BA14
:0043BB6F 19BA4300                DWORD 0043BA19
:0043BB73 67BA4300                DWORD 0043BA67
:0043BB77 7EBA4300                DWORD 0043BA7E
:0043BB7B 19BA4300                DWORD 0043BA19
:0043BB7F 67BA4300                DWORD 0043BA67
:0043BB83 9FBA4300                DWORD 0043BA9F
:0043BB87 19BA4300                DWORD 0043BA19
:0043BB8B 19BA4300                DWORD 0043BA19
:0043BB8F 19BA4300                DWORD 0043BA19
:0043BB93 67BA4300                DWORD 0043BA67
:0043BB97 7EBA4300                DWORD 0043BA7E
:0043BB9B E2BA4300                DWORD 0043BAE2
:0043BB9F 19BA4300                DWORD 0043BA19
:0043BBA3 67BA4300                DWORD 0043BA67
:0043BBA7 19BA4300                DWORD 0043BA19
:0043BBAB 67BA4300                DWORD 0043BA67
:0043BBAF 7EBA4300                DWORD 0043BA7E
:0043BBB3 67BA4300                DWORD 0043BA67
:0043BBB7 7EBA4300                DWORD 0043BA7E
:0043BBBB 67BA4300                DWORD 0043BA67
:0043BBBF 95BA4300                DWORD 0043BA95
:0043BBC3 19BA4300                DWORD 0043BA19
:0043BBC7 67BA4300                DWORD 0043BA67
:0043BBCB 7EBA4300                DWORD 0043BA7E
:0043BBCF 67BA4300                DWORD 0043BA67
:0043BBD3 DCB94300                DWORD 0043B9DC
:0043BBD7 E8B94300                DWORD 0043B9E8
:0043BBDB 30BA4300                DWORD 0043BA30
:0043BBDF DCB94300                DWORD 0043B9DC
:0043BBE3 19BA4300                DWORD 0043BA19
:0043BBE7 19BA4300                DWORD 0043BA19
:0043BBEB DCB94300                DWORD 0043B9DC
:0043BBEF 67BA4300                DWORD 0043BA67
:0043BBF3 DCB94300                DWORD 0043B9DC
:0043BBF7 67BA4300                DWORD 0043BA67
:0043BBFB DCB94300                DWORD 0043B9DC
:0043BBFF DCB94300                DWORD 0043B9DC
:0043BC03 1CBB4300                DWORD 0043BB1C


:0043BC07 0001                    add byte ptr [ecx], al
:0043BC09 0102                    add dword ptr [edx], eax
:0043BC0B 0326                    add esp, dword ptr [esi]
:0043BC0D 0404                    add al, 04
:0043BC0F 0506260726              add eax, 26072606
:0043BC14 0808                    or byte ptr [eax], cl
:0043BC16 260926                  or dword ptr es:[esi], esp
:0043BC19 0A26                    or ah, byte ptr [esi]
:0043BC1B 0B0C0D0D0E0F10          or ecx, dword ptr [ecx+100F0E0D]
:0043BC22 1011                    adc byte ptr [ecx], dl
:0043BC24 1213                    adc dl, byte ptr [ebx]
:0043BC26 1415                    adc al, 15
:0043BC28 16                      push ss
:0043BC29 17                      pop ss
:0043BC2A 17                      pop ss
:0043BC2B 1819                    sbb byte ptr [ecx], bl
:0043BC2D 1A1A                    sbb bl, byte ptr [edx]
:0043BC2F 1A1A                    sbb bl, byte ptr [edx]
:0043BC31 1A1A                    sbb bl, byte ptr [edx]
:0043BC33 1A1A                    sbb bl, byte ptr [edx]
:0043BC35 1B1C1D261E261F          sbb ebx, dword ptr [ebx+1F261E26]
:0043BC3C 2021                    and byte ptr [ecx], ah
:0043BC3E 2223                    and ah, byte ptr [ebx]
:0043BC40 2426                    and al, 26
:0043BC42 26                      BYTE 026h


:0043BC43 26                      BYTE 026h


:0043BC44 26                      BYTE 026h


:0043BC45 26                      BYTE 026h


:0043BC46 26                      BYTE 026h


:0043BC47 26                      BYTE 026h


:0043BC48 26                      BYTE 026h


:0043BC49 26                      BYTE 026h


:0043BC4A 25                      BYTE 25h


* Referenced by a CALL at Addresses:
|:00405EB4   , :00438ABF   , :00438EB8   , :004406AB   
|
:0043BC4B 55                      push ebp
:0043BC4C 8BEC                    mov ebp, esp
:0043BC4E 83EC3C                  sub esp, 0000003C
:0043BC51 894DD4                  mov dword ptr [ebp-2C], ecx
:0043BC54 8B4508                  mov eax, dword ptr [ebp+08]
:0043BC57 50                      push eax
:0043BC58 E82002FDFF              call 0040BE7D
:0043BC5D 83C404                  add esp, 00000004
:0043BC60 50                      push eax
:0043BC61 E870280000              call 0043E4D6
:0043BC66 83C404                  add esp, 00000004
:0043BC69 8845E4                  mov byte ptr [ebp-1C], al
:0043BC6C 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043BC6F 81E1FF000000            and ecx, 000000FF
:0043BC75 81F9FF000000            cmp ecx, 000000FF
:0043BC7B 7507                    jne 0043BC84
:0043BC7D 33C0                    xor eax, eax
:0043BC7F E90C030000              jmp 0043BF90

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BC7B(C)
|
:0043BC84 8B55E4                  mov edx, dword ptr [ebp-1C]
:0043BC87 81E2FF000000            and edx, 000000FF
:0043BC8D 6BD224                  imul edx, 00000024
:0043BC90 81C2502C4B00            add edx, 004B2C50
:0043BC96 8955DC                  mov dword ptr [ebp-24], edx
:0043BC99 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0043BC9C E8AC3B0000              call 0043F84D
:0043BCA1 8845F4                  mov byte ptr [ebp-0C], al
:0043BCA4 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043BCA7 E8A13B0000              call 0043F84D
:0043BCAC 8845E8                  mov byte ptr [ebp-18], al
:0043BCAF 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043BCB2 E8B9F7FFFF              call 0043B470
:0043BCB7 8845EC                  mov byte ptr [ebp-14], al
:0043BCBA C745FC00000000          mov [ebp-04], 00000000
:0043BCC1 C745F800000000          mov [ebp-08], 00000000
:0043BCC8 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0043BCCB E82E380000              call 0043F4FE
:0043BCD0 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043BCD3 81E1FF000000            and ecx, 000000FF
:0043BCD9 0FAFC1                  imul eax, ecx
:0043BCDC 33D2                    xor edx, edx
:0043BCDE B90A000000              mov ecx, 0000000A
:0043BCE3 F7F1                    div ecx
:0043BCE5 8945E0                  mov dword ptr [ebp-20], eax
:0043BCE8 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043BCEB E8A5380000              call 0043F595
:0043BCF0 8B55E8                  mov edx, dword ptr [ebp-18]
:0043BCF3 81E2FF000000            and edx, 000000FF
:0043BCF9 0FAFC2                  imul eax, edx
:0043BCFC 33D2                    xor edx, edx
:0043BCFE B90A000000              mov ecx, 0000000A
:0043BD03 F7F1                    div ecx
:0043BD05 8945F0                  mov dword ptr [ebp-10], eax
:0043BD08 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0043BD0C 741E                    je 0043BD2C
:0043BD0E 68FF000000              push 000000FF
:0043BD13 6A01                    push 00000001
:0043BD15 8B55DC                  mov edx, dword ptr [ebp-24]
:0043BD18 52                      push edx
:0043BD19 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0043BD1C E88FF7FFFF              call 0043B4B0
:0043BD21 85C0                    test eax, eax
:0043BD23 7507                    jne 0043BD2C
:0043BD25 33C0                    xor eax, eax
:0043BD27 E964020000              jmp 0043BF90

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043BD0C(C), :0043BD23(C)
|
:0043BD2C 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0043BD2F E8BC260000              call 0043E3F0
:0043BD34 25FF000000              and eax, 000000FF
:0043BD39 83C019                  add eax, 00000019
:0043BD3C 8945FC                  mov dword ptr [ebp-04], eax
:0043BD3F 8B45E0                  mov eax, dword ptr [ebp-20]
:0043BD42 3B45F0                  cmp eax, dword ptr [ebp-10]
:0043BD45 7212                    jb 0043BD59
:0043BD47 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0043BD4A 2B4DF0                  sub ecx, dword ptr [ebp-10]
:0043BD4D D1E9                    shr ecx, 1
:0043BD4F 8B55FC                  mov edx, dword ptr [ebp-04]
:0043BD52 03D1                    add edx, ecx
:0043BD54 8955FC                  mov dword ptr [ebp-04], edx
:0043BD57 EB25                    jmp 0043BD7E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BD45(C)
|
:0043BD59 8B45F0                  mov eax, dword ptr [ebp-10]
:0043BD5C 2B45E0                  sub eax, dword ptr [ebp-20]
:0043BD5F D1E8                    shr eax, 1
:0043BD61 50                      push eax
:0043BD62 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043BD65 51                      push ecx
:0043BD66 E8333D0400              call 0047FA9E
:0043BD6B 83C408                  add esp, 00000008
:0043BD6E 8945FC                  mov dword ptr [ebp-04], eax
:0043BD71 837DFC00                cmp dword ptr [ebp-04], 00000000
:0043BD75 7507                    jne 0043BD7E
:0043BD77 C745FC01000000          mov [ebp-04], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043BD57(U), :0043BD75(C)
|
:0043BD7E 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0043BD81 E8EAF6FFFF              call 0043B470
:0043BD86 25FF000000              and eax, 000000FF
:0043BD8B 8945D0                  mov dword ptr [ebp-30], eax
:0043BD8E 8B55D0                  mov edx, dword ptr [ebp-30]
:0043BD91 83EA01                  sub edx, 00000001
:0043BD94 8955D0                  mov dword ptr [ebp-30], edx
:0043BD97 837DD004                cmp dword ptr [ebp-30], 00000004
:0043BD9B 0F87F7000000            ja 0043BE98
:0043BDA1 8B45D0                  mov eax, dword ptr [ebp-30]
:0043BDA4 FF248596BF4300          jmp dword ptr [4*eax+0043BF96]
:0043BDAB 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043BDAE 81E1FF000000            and ecx, 000000FF
:0043BDB4 83F903                  cmp ecx, 00000003
:0043BDB7 741B                    je 0043BDD4
:0043BDB9 8B55EC                  mov edx, dword ptr [ebp-14]
:0043BDBC 81E2FF000000            and edx, 000000FF
:0043BDC2 83FA11                  cmp edx, 00000011
:0043BDC5 740D                    je 0043BDD4
:0043BDC7 8B45EC                  mov eax, dword ptr [ebp-14]
:0043BDCA 25FF000000              and eax, 000000FF
:0043BDCF 83F810                  cmp eax, 00000010
:0043BDD2 750B                    jne 0043BDDF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043BDB7(C), :0043BDC5(C)
|
:0043BDD4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043BDD7 6BC903                  imul ecx, 00000003
:0043BDDA D1E9                    shr ecx, 1
:0043BDDC 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BDD2(C)
|
:0043BDDF 6A3D                    push 0000003D
:0043BDE1 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043BDE4 E887380200              call 0045F670
:0043BDE9 8BC8                    mov ecx, eax
:0043BDEB 6BC948                  imul ecx, 00000048
:0043BDEE 81C1681B4A00            add ecx, 004A1B68
:0043BDF4 E810BCFCFF              call 00407A09
:0043BDF9 85C0                    test eax, eax
:0043BDFB 7436                    je 0043BE33
:0043BDFD 6A3D                    push 0000003D
:0043BDFF 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043BE02 E869380200              call 0045F670
:0043BE07 8BC8                    mov ecx, eax
:0043BE09 6BC948                  imul ecx, 00000048
:0043BE0C 81C1681B4A00            add ecx, 004A1B68
:0043BE12 E8DBBCFCFF              call 00407AF2
:0043BE17 25FF000000              and eax, 000000FF
:0043BE1C 8B55FC                  mov edx, dword ptr [ebp-04]
:0043BE1F 0FAFC2                  imul eax, edx
:0043BE22 33D2                    xor edx, edx
:0043BE24 B964000000              mov ecx, 00000064
:0043BE29 F7F1                    div ecx
:0043BE2B 8B55FC                  mov edx, dword ptr [ebp-04]
:0043BE2E 2BD0                    sub edx, eax
:0043BE30 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BDFB(C)
|
:0043BE33 EB63                    jmp 0043BE98
:0043BE35 8B45EC                  mov eax, dword ptr [ebp-14]
:0043BE38 25FF000000              and eax, 000000FF
:0043BE3D 83F803                  cmp eax, 00000003
:0043BE40 752F                    jne 0043BE71
:0043BE42 8B45FC                  mov eax, dword ptr [ebp-04]
:0043BE45 6BC003                  imul eax, 00000003
:0043BE48 33D2                    xor edx, edx
:0043BE4A B905000000              mov ecx, 00000005
:0043BE4F F7F1                    div ecx
:0043BE51 8945FC                  mov dword ptr [ebp-04], eax
:0043BE54 837DFC00                cmp dword ptr [ebp-04], 00000000
:0043BE58 7509                    jne 0043BE63
:0043BE5A C745CC01000000          mov [ebp-34], 00000001
:0043BE61 EB06                    jmp 0043BE69

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BE58(C)
|
:0043BE63 8B55FC                  mov edx, dword ptr [ebp-04]
:0043BE66 8955CC                  mov dword ptr [ebp-34], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BE61(U)
|
:0043BE69 8B45CC                  mov eax, dword ptr [ebp-34]
:0043BE6C 8945FC                  mov dword ptr [ebp-04], eax
:0043BE6F EB27                    jmp 0043BE98

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BE40(C)
|
:0043BE71 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043BE74 81E1FF000000            and ecx, 000000FF
:0043BE7A 83F902                  cmp ecx, 00000002
:0043BE7D 740E                    je 0043BE8D
:0043BE7F 8B55EC                  mov edx, dword ptr [ebp-14]
:0043BE82 81E2FF000000            and edx, 000000FF
:0043BE88 83FA05                  cmp edx, 00000005
:0043BE8B 750B                    jne 0043BE98

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BE7D(C)
|
:0043BE8D 8B45FC                  mov eax, dword ptr [ebp-04]
:0043BE90 6BC003                  imul eax, 00000003
:0043BE93 D1E8                    shr eax, 1
:0043BE95 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043BD9B(C), :0043BE33(U), :0043BE6F(U), :0043BE8B(C)
|
:0043BE98 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043BE9B 81E1FF000000            and ecx, 000000FF
:0043BEA1 83F903                  cmp ecx, 00000003
:0043BEA4 754A                    jne 0043BEF0
:0043BEA6 6A2D                    push 0000002D
:0043BEA8 8B55D4                  mov edx, dword ptr [ebp-2C]
:0043BEAB 8B0A                    mov ecx, dword ptr [edx]
:0043BEAD 6BC948                  imul ecx, 00000048
:0043BEB0 81C1681B4A00            add ecx, 004A1B68
:0043BEB6 E84EBBFCFF              call 00407A09
:0043BEBB 85C0                    test eax, eax
:0043BEBD 7431                    je 0043BEF0
:0043BEBF 6A2D                    push 0000002D
:0043BEC1 8B45D4                  mov eax, dword ptr [ebp-2C]
:0043BEC4 8B08                    mov ecx, dword ptr [eax]
:0043BEC6 6BC948                  imul ecx, 00000048
:0043BEC9 81C1681B4A00            add ecx, 004A1B68
:0043BECF E81EBCFCFF              call 00407AF2
:0043BED4 25FF000000              and eax, 000000FF
:0043BED9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043BEDC 0FAFC1                  imul eax, ecx
:0043BEDF 33D2                    xor edx, edx
:0043BEE1 B964000000              mov ecx, 00000064
:0043BEE6 F7F1                    div ecx
:0043BEE8 8B55FC                  mov edx, dword ptr [ebp-04]
:0043BEEB 03D0                    add edx, eax
:0043BEED 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043BEA4(C), :0043BEBD(C)
|
:0043BEF0 837D1000                cmp dword ptr [ebp+10], 00000000
:0043BEF4 7429                    je 0043BF1F
:0043BEF6 8B45FC                  mov eax, dword ptr [ebp-04]
:0043BEF9 6BC003                  imul eax, 00000003
:0043BEFC C1E802                  shr eax, 02
:0043BEFF 83F801                  cmp eax, 00000001
:0043BF02 7309                    jnb 0043BF0D
:0043BF04 C745C801000000          mov [ebp-38], 00000001
:0043BF0B EB0C                    jmp 0043BF19

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BF02(C)
|
:0043BF0D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043BF10 6BC903                  imul ecx, 00000003
:0043BF13 C1E902                  shr ecx, 02
:0043BF16 894DC8                  mov dword ptr [ebp-38], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BF0B(U)
|
:0043BF19 8B55C8                  mov edx, dword ptr [ebp-38]
:0043BF1C 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BEF4(C)
|
:0043BF1F 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0043BF23 7450                    je 0043BF75

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0043BF25 6A07                    push 00000007
:0043BF27 E8E73B0400              call 0047FB13
:0043BF2C 83C404                  add esp, 00000004
:0043BF2F 8945D8                  mov dword ptr [ebp-28], eax
:0043BF32 837DD802                cmp dword ptr [ebp-28], 00000002
:0043BF36 760F                    jbe 0043BF47
:0043BF38 8B45D8                  mov eax, dword ptr [ebp-28]
:0043BF3B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043BF3E 8D5401FE                lea edx, dword ptr [ecx+eax-02]
:0043BF42 8955FC                  mov dword ptr [ebp-04], edx
:0043BF45 EB2E                    jmp 0043BF75

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BF36(C)
|
:0043BF47 8B45D8                  mov eax, dword ptr [ebp-28]
:0043BF4A 50                      push eax
:0043BF4B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043BF4E 51                      push ecx
:0043BF4F E84A3B0400              call 0047FA9E
:0043BF54 83C408                  add esp, 00000008
:0043BF57 8945FC                  mov dword ptr [ebp-04], eax
:0043BF5A 837DFC00                cmp dword ptr [ebp-04], 00000000
:0043BF5E 7509                    jne 0043BF69
:0043BF60 C745C401000000          mov [ebp-3C], 00000001
:0043BF67 EB06                    jmp 0043BF6F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BF5E(C)
|
:0043BF69 8B55FC                  mov edx, dword ptr [ebp-04]
:0043BF6C 8955C4                  mov dword ptr [ebp-3C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BF67(U)
|
:0043BF6F 8B45C4                  mov eax, dword ptr [ebp-3C]
:0043BF72 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043BF23(C), :0043BF45(U)
|
:0043BF75 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043BF78 E8136D0300              call 00472C90
:0043BF7D 3945FC                  cmp dword ptr [ebp-04], eax
:0043BF80 760B                    jbe 0043BF8D
:0043BF82 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043BF85 E8066D0300              call 00472C90
:0043BF8A 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BF80(C)
|
:0043BF8D 8B45FC                  mov eax, dword ptr [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043BC7F(U), :0043BD27(U)
|
:0043BF90 8BE5                    mov esp, ebp
:0043BF92 5D                      pop ebp
:0043BF93 C20C00                  ret 000C



:0043BF96 35BE4300                DWORD 0043BE35
:0043BF9A ABBD4300                DWORD 0043BDAB
:0043BF9E 98BE4300                DWORD 0043BE98
:0043BFA2 ABBD4300                DWORD 0043BDAB
:0043BFA6 ABBD4300                DWORD 0043BDAB



* Referenced by a CALL at Addresses:
|:0042323F   , :004236B6   , :00423FFE   , :004240B5   , :004243FE   
|:00425104   , :0043981D   , :00440757   , :00440A62   
|
:0043BFAA 55                      push ebp
:0043BFAB 8BEC                    mov ebp, esp
:0043BFAD 83EC20                  sub esp, 00000020
:0043BFB0 894DE8                  mov dword ptr [ebp-18], ecx
:0043BFB3 C745FC00000000          mov [ebp-04], 00000000
:0043BFBA 8A4510                  mov al, byte ptr [ebp+10]
:0043BFBD 50                      push eax
:0043BFBE E8E9DB0000              call 00449BAC
:0043BFC3 83C404                  add esp, 00000004
:0043BFC6 85C0                    test eax, eax
:0043BFC8 7514                    jne 0043BFDE
:0043BFCA 8A4D10                  mov cl, byte ptr [ebp+10]
:0043BFCD 51                      push ecx
:0043BFCE E863DC0000              call 00449C36
:0043BFD3 83C404                  add esp, 00000004
:0043BFD6 85C0                    test eax, eax
:0043BFD8 0F8475030000            je 0043C353

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043BFC8(C)
|
:0043BFDE 837D1400                cmp dword ptr [ebp+14], 00000000
:0043BFE2 751E                    jne 0043C002
:0043BFE4 8A5510                  mov dl, byte ptr [ebp+10]
:0043BFE7 52                      push edx
:0043BFE8 6A02                    push 00000002
:0043BFEA 8B4508                  mov eax, dword ptr [ebp+08]
:0043BFED 50                      push eax
:0043BFEE 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043BFF1 E8BAF4FFFF              call 0043B4B0
:0043BFF6 85C0                    test eax, eax
:0043BFF8 7508                    jne 0043C002
:0043BFFA 8B45FC                  mov eax, dword ptr [ebp-04]
:0043BFFD E954030000              jmp 0043C356

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043BFE2(C), :0043BFF8(C)
|
:0043C002 6A00                    push 00000000
:0043C004 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043C007 E8A402FEFF              call 0041C2B0
:0043C00C 50                      push eax
:0043C00D 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043C010 8A5104                  mov dl, byte ptr [ecx+04]
:0043C013 52                      push edx
:0043C014 8A4510                  mov al, byte ptr [ebp+10]
:0043C017 50                      push eax
:0043C018 E80544FEFF              call 00420422
:0043C01D 83C410                  add esp, 00000010
:0043C020 85C0                    test eax, eax
:0043C022 7507                    jne 0043C02B
:0043C024 33C0                    xor eax, eax
:0043C026 E92B030000              jmp 0043C356

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C022(C)
|
:0043C02B 8B4D10                  mov ecx, dword ptr [ebp+10]
:0043C02E 81E1FF000000            and ecx, 000000FF
:0043C034 83F915                  cmp ecx, 00000015
:0043C037 740E                    je 0043C047
:0043C039 8B5510                  mov edx, dword ptr [ebp+10]
:0043C03C 81E2FF000000            and edx, 000000FF
:0043C042 83FA09                  cmp edx, 00000009
:0043C045 7513                    jne 0043C05A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C037(C)
|
:0043C047 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043C04A E8416C0300              call 00472C90
:0043C04F 8945FC                  mov dword ptr [ebp-04], eax
:0043C052 8B45FC                  mov eax, dword ptr [ebp-04]
:0043C055 E9FC020000              jmp 0043C356

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C045(C)
|
:0043C05A 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043C05D E881350000              call 0043F5E3
:0043C062 8945F0                  mov dword ptr [ebp-10], eax
:0043C065 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043C068 E876350000              call 0043F5E3
:0043C06D 8945F4                  mov dword ptr [ebp-0C], eax
:0043C070 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043C073 E878230000              call 0043E3F0
:0043C078 25FF000000              and eax, 000000FF
:0043C07D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043C080 8D540119                lea edx, dword ptr [ecx+eax+19]
:0043C084 8955FC                  mov dword ptr [ebp-04], edx
:0043C087 8B4510                  mov eax, dword ptr [ebp+10]
:0043C08A 25FF000000              and eax, 000000FF
:0043C08F 8945E4                  mov dword ptr [ebp-1C], eax
:0043C092 837DE441                cmp dword ptr [ebp-1C], 00000041
:0043C096 7751                    ja 0043C0E9
:0043C098 8B55E4                  mov edx, dword ptr [ebp-1C]
:0043C09B 33C9                    xor ecx, ecx
:0043C09D 8A8AD0C34300            mov cl, byte ptr [edx+0043C3D0]
:0043C0A3 FF248D5CC34300          jmp dword ptr [4*ecx+0043C35C]
:0043C0AA C745F802000000          mov [ebp-08], 00000002
:0043C0B1 EB3D                    jmp 0043C0F0
:0043C0B3 C745F804000000          mov [ebp-08], 00000004
:0043C0BA EB34                    jmp 0043C0F0
:0043C0BC C745F805000000          mov [ebp-08], 00000005
:0043C0C3 EB2B                    jmp 0043C0F0

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0043C0C5 C745F807000000          mov [ebp-08], 00000007
:0043C0CC EB22                    jmp 0043C0F0
:0043C0CE C745F809000000          mov [ebp-08], 00000009
:0043C0D5 EB19                    jmp 0043C0F0
:0043C0D7 C745F80A000000          mov [ebp-08], 0000000A
:0043C0DE EB10                    jmp 0043C0F0
:0043C0E0 C745F80C000000          mov [ebp-08], 0000000C
:0043C0E7 EB07                    jmp 0043C0F0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C096(C)
|
:0043C0E9 C745F800000000          mov [ebp-08], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043C0B1(U), :0043C0BA(U), :0043C0C3(U), :0043C0CC(U), :0043C0D5(U)
|:0043C0DE(U), :0043C0E7(U)
|
:0043C0F0 8B45F0                  mov eax, dword ptr [ebp-10]
:0043C0F3 3B45F4                  cmp eax, dword ptr [ebp-0C]
:0043C0F6 7219                    jb 0043C111
:0043C0F8 8B45F0                  mov eax, dword ptr [ebp-10]
:0043C0FB 2B45F4                  sub eax, dword ptr [ebp-0C]
:0043C0FE 33D2                    xor edx, edx
:0043C100 B903000000              mov ecx, 00000003
:0043C105 F7F1                    div ecx
:0043C107 8B55FC                  mov edx, dword ptr [ebp-04]
:0043C10A 03D0                    add edx, eax
:0043C10C 8955FC                  mov dword ptr [ebp-04], edx
:0043C10F EB1F                    jmp 0043C130

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C0F6(C)
|
:0043C111 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043C114 2B45F0                  sub eax, dword ptr [ebp-10]
:0043C117 33D2                    xor edx, edx
:0043C119 B903000000              mov ecx, 00000003
:0043C11E F7F1                    div ecx
:0043C120 50                      push eax
:0043C121 8B55FC                  mov edx, dword ptr [ebp-04]
:0043C124 52                      push edx
:0043C125 E874390400              call 0047FA9E
:0043C12A 83C408                  add esp, 00000008
:0043C12D 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C10F(U)
|
:0043C130 8B45FC                  mov eax, dword ptr [ebp-04]
:0043C133 0FAF45F8                imul eax, dword ptr [ebp-08]
:0043C137 33D2                    xor edx, edx
:0043C139 B90A000000              mov ecx, 0000000A
:0043C13E F7F1                    div ecx
:0043C140 8945FC                  mov dword ptr [ebp-04], eax
:0043C143 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0043C146 E8C5A4FCFF              call 00406610
:0043C14B 25FF000000              and eax, 000000FF
:0043C150 8945E0                  mov dword ptr [ebp-20], eax
:0043C153 8B55E0                  mov edx, dword ptr [ebp-20]
:0043C156 83EA27                  sub edx, 00000027
:0043C159 8955E0                  mov dword ptr [ebp-20], edx
:0043C15C 837DE00B                cmp dword ptr [ebp-20], 0000000B
:0043C160 7738                    ja 0043C19A
:0043C162 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0043C165 33C0                    xor eax, eax
:0043C167 8A8122C44300            mov al, byte ptr [ecx+0043C422]
:0043C16D FF248512C44300          jmp dword ptr [4*eax+0043C412]
:0043C174 8B45FC                  mov eax, dword ptr [ebp-04]
:0043C177 6BC00B                  imul eax, 0000000B
:0043C17A 33D2                    xor edx, edx
:0043C17C B90A000000              mov ecx, 0000000A
:0043C181 F7F1                    div ecx
:0043C183 8945FC                  mov dword ptr [ebp-04], eax
:0043C186 EB12                    jmp 0043C19A
:0043C188 8B45FC                  mov eax, dword ptr [ebp-04]
:0043C18B 6BC00D                  imul eax, 0000000D
:0043C18E 33D2                    xor edx, edx
:0043C190 B90A000000              mov ecx, 0000000A
:0043C195 F7F1                    div ecx
:0043C197 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043C160(C), :0043C186(U)
|
:0043C19A 8B5510                  mov edx, dword ptr [ebp+10]
:0043C19D 81E2FF000000            and edx, 000000FF
:0043C1A3 83FA14                  cmp edx, 00000014
:0043C1A6 751A                    jne 0043C1C2
:0043C1A8 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043C1AB E8C0F2FFFF              call 0043B470
:0043C1B0 25FF000000              and eax, 000000FF
:0043C1B5 83F80C                  cmp eax, 0000000C
:0043C1B8 7508                    jne 0043C1C2
:0043C1BA 8B45FC                  mov eax, dword ptr [ebp-04]
:0043C1BD D1E0                    shl eax, 1
:0043C1BF 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043C1A6(C), :0043C1B8(C)
|
:0043C1C2 8B4D10                  mov ecx, dword ptr [ebp+10]
:0043C1C5 81E1FF000000            and ecx, 000000FF
:0043C1CB 6BC946                  imul ecx, 00000046
:0043C1CE 81C1C0F44A00            add ecx, 004AF4C0
:0043C1D4 E847210000              call 0043E320
:0043C1D9 25FF000000              and eax, 000000FF
:0043C1DE 85C0                    test eax, eax
:0043C1E0 754A                    jne 0043C22C
:0043C1E2 6A2F                    push 0000002F
:0043C1E4 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043C1E7 8B09                    mov ecx, dword ptr [ecx]
:0043C1E9 6BC948                  imul ecx, 00000048
:0043C1EC 81C1681B4A00            add ecx, 004A1B68
:0043C1F2 E812B8FCFF              call 00407A09
:0043C1F7 85C0                    test eax, eax
:0043C1F9 7431                    je 0043C22C
:0043C1FB 6A2F                    push 0000002F
:0043C1FD 8B55E8                  mov edx, dword ptr [ebp-18]
:0043C200 8B0A                    mov ecx, dword ptr [edx]
:0043C202 6BC948                  imul ecx, 00000048
:0043C205 81C1681B4A00            add ecx, 004A1B68
:0043C20B E8E2B8FCFF              call 00407AF2
:0043C210 25FF000000              and eax, 000000FF
:0043C215 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043C218 0FAFC1                  imul eax, ecx
:0043C21B 33D2                    xor edx, edx
:0043C21D B964000000              mov ecx, 00000064
:0043C222 F7F1                    div ecx
:0043C224 8B55FC                  mov edx, dword ptr [ebp-04]
:0043C227 03D0                    add edx, eax
:0043C229 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043C1E0(C), :0043C1F9(C)
|
:0043C22C 8B4D10                  mov ecx, dword ptr [ebp+10]
:0043C22F 81E1FF000000            and ecx, 000000FF
:0043C235 6BC946                  imul ecx, 00000046
:0043C238 81C1C0F44A00            add ecx, 004AF4C0
:0043C23E E8DD200000              call 0043E320
:0043C243 25FF000000              and eax, 000000FF
:0043C248 83F803                  cmp eax, 00000003
:0043C24B 754A                    jne 0043C297
:0043C24D 6A30                    push 00000030
:0043C24F 8B45E8                  mov eax, dword ptr [ebp-18]
:0043C252 8B08                    mov ecx, dword ptr [eax]
:0043C254 6BC948                  imul ecx, 00000048
:0043C257 81C1681B4A00            add ecx, 004A1B68
:0043C25D E8A7B7FCFF              call 00407A09
:0043C262 85C0                    test eax, eax
:0043C264 7431                    je 0043C297
:0043C266 6A30                    push 00000030
:0043C268 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043C26B 8B09                    mov ecx, dword ptr [ecx]
:0043C26D 6BC948                  imul ecx, 00000048
:0043C270 81C1681B4A00            add ecx, 004A1B68
:0043C276 E877B8FCFF              call 00407AF2
:0043C27B 25FF000000              and eax, 000000FF
:0043C280 8B55FC                  mov edx, dword ptr [ebp-04]
:0043C283 0FAFC2                  imul eax, edx
:0043C286 33D2                    xor edx, edx
:0043C288 B964000000              mov ecx, 00000064
:0043C28D F7F1                    div ecx
:0043C28F 8B55FC                  mov edx, dword ptr [ebp-04]
:0043C292 03D0                    add edx, eax
:0043C294 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043C24B(C), :0043C264(C)
|
:0043C297 6A3B                    push 0000003B
:0043C299 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0043C29C E868B7FCFF              call 00407A09
:0043C2A1 85C0                    test eax, eax
:0043C2A3 7426                    je 0043C2CB
:0043C2A5 6A3B                    push 0000003B
:0043C2A7 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0043C2AA E843B8FCFF              call 00407AF2
:0043C2AF 25FF000000              and eax, 000000FF
:0043C2B4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043C2B7 0FAFC1                  imul eax, ecx
:0043C2BA 33D2                    xor edx, edx
:0043C2BC B964000000              mov ecx, 00000064
:0043C2C1 F7F1                    div ecx
:0043C2C3 8B55FC                  mov edx, dword ptr [ebp-04]
:0043C2C6 2BD0                    sub edx, eax
:0043C2C8 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C2A3(C)
|
:0043C2CB 837D1400                cmp dword ptr [ebp+14], 00000000
:0043C2CF 7535                    jne 0043C306

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0043C2D1 6A07                    push 00000007
:0043C2D3 E83B380400              call 0047FB13
:0043C2D8 83C404                  add esp, 00000004
:0043C2DB 8945EC                  mov dword ptr [ebp-14], eax
:0043C2DE 837DEC02                cmp dword ptr [ebp-14], 00000002
:0043C2E2 760F                    jbe 0043C2F3
:0043C2E4 8B45EC                  mov eax, dword ptr [ebp-14]
:0043C2E7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043C2EA 8D5401FE                lea edx, dword ptr [ecx+eax-02]
:0043C2EE 8955FC                  mov dword ptr [ebp-04], edx
:0043C2F1 EB13                    jmp 0043C306

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C2E2(C)
|
:0043C2F3 8B45EC                  mov eax, dword ptr [ebp-14]
:0043C2F6 50                      push eax
:0043C2F7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043C2FA 51                      push ecx
:0043C2FB E89E370400              call 0047FA9E
:0043C300 83C408                  add esp, 00000008
:0043C303 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043C2CF(C), :0043C2F1(U)
|
:0043C306 837DFC00                cmp dword ptr [ebp-04], 00000000
:0043C30A 7507                    jne 0043C313
:0043C30C C745FC01000000          mov [ebp-04], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C30A(C)
|
:0043C313 8B5510                  mov edx, dword ptr [ebp+10]
:0043C316 81E2FF000000            and edx, 000000FF
:0043C31C 83FA16                  cmp edx, 00000016
:0043C31F 751A                    jne 0043C33B
:0043C321 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043C324 E817650300              call 00472840
:0043C329 3945FC                  cmp dword ptr [ebp-04], eax
:0043C32C 760B                    jbe 0043C339
:0043C32E 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043C331 E80A650300              call 00472840
:0043C336 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C32C(C)
|
:0043C339 EB18                    jmp 0043C353

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C31F(C)
|
:0043C33B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043C33E E84D690300              call 00472C90
:0043C343 3945FC                  cmp dword ptr [ebp-04], eax
:0043C346 760B                    jbe 0043C353
:0043C348 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043C34B E840690300              call 00472C90
:0043C350 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043BFD8(C), :0043C339(U), :0043C346(C)
|
:0043C353 8B45FC                  mov eax, dword ptr [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043BFFD(U), :0043C026(U), :0043C055(U)
|
:0043C356 8BE5                    mov esp, ebp
:0043C358 5D                      pop ebp
:0043C359 C21000                  ret 0010



:0043C35C C5C04300                DWORD 0043C0C5
:0043C360 CEC04300                DWORD 0043C0CE
:0043C364 BCC04300                DWORD 0043C0BC
:0043C368 C5C04300                DWORD 0043C0C5
:0043C36C CEC04300                DWORD 0043C0CE
:0043C370 C5C04300                DWORD 0043C0C5
:0043C374 CEC04300                DWORD 0043C0CE
:0043C378 BCC04300                DWORD 0043C0BC
:0043C37C C5C04300                DWORD 0043C0C5
:0043C380 BCC04300                DWORD 0043C0BC
:0043C384 C5C04300                DWORD 0043C0C5
:0043C388 B3C04300                DWORD 0043C0B3
:0043C38C BCC04300                DWORD 0043C0BC
:0043C390 AAC04300                DWORD 0043C0AA
:0043C394 C5C04300                DWORD 0043C0C5
:0043C398 CEC04300                DWORD 0043C0CE
:0043C39C C5C04300                DWORD 0043C0C5
:0043C3A0 CEC04300                DWORD 0043C0CE
:0043C3A4 E0C04300                DWORD 0043C0E0
:0043C3A8 C5C04300                DWORD 0043C0C5
:0043C3AC BCC04300                DWORD 0043C0BC
:0043C3B0 C5C04300                DWORD 0043C0C5
:0043C3B4 B3C04300                DWORD 0043C0B3
:0043C3B8 BCC04300                DWORD 0043C0BC
:0043C3BC AAC04300                DWORD 0043C0AA
:0043C3C0 E0C04300                DWORD 0043C0E0
:0043C3C4 C5C04300                DWORD 0043C0C5
:0043C3C8 D7C04300                DWORD 0043C0D7
:0043C3CC E9C04300                DWORD 0043C0E9


:0043C3D0 0001                    add byte ptr [ecx], al
:0043C3D2 0203                    add al, byte ptr [ebx]
:0043C3D4 0405                    add al, 05
:0043C3D6 06                      push es
:0043C3D7 07                      pop es
:0043C3D8 081C09                  or byte ptr [ecx+ecx], bl
:0043C3DB 0A0B                    or cl, byte ptr [ebx]
:0043C3DD 0C0D                    or al, 0D
:0043C3DF 0E                      push cs
:0043C3E0 0F                      BYTE 0fh
:0043C3E1 1011                    adc byte ptr [ecx], dl
:0043C3E3 1213                    adc dl, byte ptr [ebx]
:0043C3E5 1C14                    sbb al, 14
:0043C3E7 1C1C                    sbb al, 1C
:0043C3E9 1C1C                    sbb al, 1C
:0043C3EB 1C1C                    sbb al, 1C
:0043C3ED 1C1C                    sbb al, 1C
:0043C3EF 1C1C                    sbb al, 1C
:0043C3F1 151617181C              adc eax, 1C181716
:0043C3F6 191C1C                  sbb dword ptr [esp+ebx], ebx
:0043C3F9 1C1C                    sbb al, 1C
:0043C3FB 1C1C                    sbb al, 1C
:0043C3FD 1C1C                    sbb al, 1C
:0043C3FF 1C1C                    sbb al, 1C
:0043C401 1C1C                    sbb al, 1C
:0043C403 1C1C                    sbb al, 1C
:0043C405 1C1C                    sbb al, 1C
:0043C407 1C1C                    sbb al, 1C
:0043C409 1C1C                    sbb al, 1C
:0043C40B 1C1C                    sbb al, 1C
:0043C40D 1C1C                    sbb al, 1C
:0043C40F 1C1A                    sbb al, 1A
:0043C411 1B74C143                sbb esi, dword ptr [ecx+8*eax+43]
:0043C415 0074C143                add byte ptr [ecx+8*eax+43], dh
:0043C419 0088C143009A            add byte ptr [eax+9A0043C1], cl
:0043C41F C1430000                rol dword ptr [ebx+00], 00
:0043C423 0303                    add eax, dword ptr [ebx]
:0043C425 0101                    add dword ptr [ecx], eax
:0043C427 0303                    add eax, dword ptr [ebx]
:0043C429 0303                    add eax, dword ptr [ebx]
:0043C42B 0302                    add eax, dword ptr [edx]
:0043C42D 02                      BYTE 02h


* Referenced by a CALL at Addresses:
|:0041CDAC   , :0041CEC5   , :004408D0   , :00440B93   
|
:0043C42E 55                      push ebp
:0043C42F 8BEC                    mov ebp, esp
:0043C431 83EC1C                  sub esp, 0000001C
:0043C434 894DEC                  mov dword ptr [ebp-14], ecx
:0043C437 8B45EC                  mov eax, dword ptr [ebp-14]
:0043C43A 8B08                    mov ecx, dword ptr [eax]
:0043C43C 6BC948                  imul ecx, 00000048
:0043C43F 81C1681B4A00            add ecx, 004A1B68
:0043C445 894DF0                  mov dword ptr [ebp-10], ecx
:0043C448 8B5508                  mov edx, dword ptr [ebp+08]
:0043C44B 81E2FF000000            and edx, 000000FF
:0043C451 6BD219                  imul edx, 00000019
:0043C454 81C240114A00            add edx, 004A1140
:0043C45A 8955F4                  mov dword ptr [ebp-0C], edx
:0043C45D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043C460 E8DBD0FCFF              call 00409540
:0043C465 8845FC                  mov byte ptr [ebp-04], al
:0043C468 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043C46B E80019FEFF              call 0041DD70
:0043C470 25FF000000              and eax, 000000FF
:0043C475 8945F8                  mov dword ptr [ebp-08], eax
:0043C478 8B45FC                  mov eax, dword ptr [ebp-04]
:0043C47B 25FF000000              and eax, 000000FF
:0043C480 83F83F                  cmp eax, 0000003F
:0043C483 7558                    jne 0043C4DD
:0043C485 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043C488 81E1FF000000            and ecx, 000000FF
:0043C48E 81F9FF000000            cmp ecx, 000000FF
:0043C494 7513                    jne 0043C4A9
:0043C496 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043C499 E87DADFCFF              call 0040721B
:0043C49E 8B55EC                  mov edx, dword ptr [ebp-14]
:0043C4A1 2B4210                  sub eax, dword ptr [edx+10]
:0043C4A4 8945F8                  mov dword ptr [ebp-08], eax
:0043C4A7 EB32                    jmp 0043C4DB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C494(C)
|
:0043C4A9 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043C4AC E86AADFCFF              call 0040721B
:0043C4B1 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043C4B4 2B4110                  sub eax, dword ptr [ecx+10]
:0043C4B7 3B45F8                  cmp eax, dword ptr [ebp-08]
:0043C4BA 7313                    jnb 0043C4CF
:0043C4BC 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043C4BF E857ADFCFF              call 0040721B
:0043C4C4 8B55EC                  mov edx, dword ptr [ebp-14]
:0043C4C7 2B4210                  sub eax, dword ptr [edx+10]
:0043C4CA 8945E8                  mov dword ptr [ebp-18], eax
:0043C4CD EB06                    jmp 0043C4D5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C4BA(C)
|
:0043C4CF 8B45F8                  mov eax, dword ptr [ebp-08]
:0043C4D2 8945E8                  mov dword ptr [ebp-18], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C4CD(U)
|
:0043C4D5 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043C4D8 894DF8                  mov dword ptr [ebp-08], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C4A7(U)
|
:0043C4DB EB62                    jmp 0043C53F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C483(C)
|
:0043C4DD 8B55FC                  mov edx, dword ptr [ebp-04]
:0043C4E0 81E2FF000000            and edx, 000000FF
:0043C4E6 83FA40                  cmp edx, 00000040
:0043C4E9 7554                    jne 0043C53F
:0043C4EB 8B45F8                  mov eax, dword ptr [ebp-08]
:0043C4EE 25FF000000              and eax, 000000FF
:0043C4F3 3DFF000000              cmp eax, 000000FF
:0043C4F8 7513                    jne 0043C50D
:0043C4FA 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043C4FD E848ADFCFF              call 0040724A
:0043C502 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043C505 2B4114                  sub eax, dword ptr [ecx+14]
:0043C508 8945F8                  mov dword ptr [ebp-08], eax
:0043C50B EB32                    jmp 0043C53F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C4F8(C)
|
:0043C50D 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043C510 E835ADFCFF              call 0040724A
:0043C515 8B55EC                  mov edx, dword ptr [ebp-14]
:0043C518 2B4214                  sub eax, dword ptr [edx+14]
:0043C51B 3B45F8                  cmp eax, dword ptr [ebp-08]
:0043C51E 7313                    jnb 0043C533
:0043C520 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043C523 E822ADFCFF              call 0040724A
:0043C528 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043C52B 2B4114                  sub eax, dword ptr [ecx+14]
:0043C52E 8945E4                  mov dword ptr [ebp-1C], eax
:0043C531 EB06                    jmp 0043C539

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C51E(C)
|
:0043C533 8B55F8                  mov edx, dword ptr [ebp-08]
:0043C536 8955E4                  mov dword ptr [ebp-1C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C531(U)
|
:0043C539 8B45E4                  mov eax, dword ptr [ebp-1C]
:0043C53C 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043C4DB(U), :0043C4E9(C), :0043C50B(U)
|
:0043C53F 8B45F8                  mov eax, dword ptr [ebp-08]
:0043C542 8BE5                    mov esp, ebp
:0043C544 5D                      pop ebp
:0043C545 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0042386D   , :00424130   , :00424629   , :004249A2   , :0044080D   
|:00440AF4   
|
:0043C548 55                      push ebp
:0043C549 8BEC                    mov ebp, esp
:0043C54B 83EC10                  sub esp, 00000010
:0043C54E 56                      push esi
:0043C54F 894DF4                  mov dword ptr [ebp-0C], ecx
:0043C552 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043C555 8B08                    mov ecx, dword ptr [eax]
:0043C557 6BC948                  imul ecx, 00000048
:0043C55A 81C1681B4A00            add ecx, 004A1B68
:0043C560 894DF8                  mov dword ptr [ebp-08], ecx
:0043C563 C745FC00000000          mov [ebp-04], 00000000
:0043C56A 8B5508                  mov edx, dword ptr [ebp+08]
:0043C56D 81E2FF000000            and edx, 000000FF
:0043C573 8955F0                  mov dword ptr [ebp-10], edx
:0043C576 8B45F0                  mov eax, dword ptr [ebp-10]
:0043C579 83E826                  sub eax, 00000026
:0043C57C 8945F0                  mov dword ptr [ebp-10], eax
:0043C57F 837DF01D                cmp dword ptr [ebp-10], 0000001D
:0043C583 0F87FA000000            ja 0043C683
:0043C589 8B55F0                  mov edx, dword ptr [ebp-10]
:0043C58C 33C9                    xor ecx, ecx
:0043C58E 8A8A1AC74300            mov cl, byte ptr [edx+0043C71A]
:0043C594 FF248DF6C64300          jmp dword ptr [4*ecx+0043C6F6]
:0043C59B 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0043C59E 81E1FF000000            and ecx, 000000FF
:0043C5A4 6BC924                  imul ecx, 00000024
:0043C5A7 81C1502C4B00            add ecx, 004B2C50
:0043C5AD E831300000              call 0043F5E3
:0043C5B2 33D2                    xor edx, edx
:0043C5B4 B90A000000              mov ecx, 0000000A
:0043C5B9 F7F1                    div ecx
:0043C5BB 83C028                  add eax, 00000028
:0043C5BE 8945FC                  mov dword ptr [ebp-04], eax
:0043C5C1 837D1000                cmp dword ptr [ebp+10], 00000000
:0043C5C5 752F                    jne 0043C5F6
:0043C5C7 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043C5CA E8B0300000              call 0043F67F
:0043C5CF 8BF0                    mov esi, eax

* Possible Reference to Dialog: DialogID_00C8 
                                  |
:0043C5D1 68C8000000              push 000000C8
:0043C5D6 E838350400              call 0047FB13
:0043C5DB 83C404                  add esp, 00000004
:0043C5DE 3BF0                    cmp esi, eax
:0043C5E0 7614                    jbe 0043C5F6

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0043C5E2 6A06                    push 00000006
:0043C5E4 E82A350400              call 0047FB13
:0043C5E9 83C404                  add esp, 00000004
:0043C5EC 8B55FC                  mov edx, dword ptr [ebp-04]
:0043C5EF 8D440205                lea eax, dword ptr [edx+eax+05]
:0043C5F3 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043C5C5(C), :0043C5E0(C)
|
:0043C5F6 E988000000              jmp 0043C683
:0043C5FB 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0043C5FE 81E1FF000000            and ecx, 000000FF
:0043C604 6BC924                  imul ecx, 00000024
:0043C607 81C1502C4B00            add ecx, 004B2C50
:0043C60D E8D12F0000              call 0043F5E3
:0043C612 D1E8                    shr eax, 1
:0043C614 83C046                  add eax, 00000046
:0043C617 8945FC                  mov dword ptr [ebp-04], eax
:0043C61A 837D1000                cmp dword ptr [ebp+10], 00000000
:0043C61E 752F                    jne 0043C64F
:0043C620 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043C623 E857300000              call 0043F67F
:0043C628 8BF0                    mov esi, eax

* Possible Reference to Dialog: DialogID_00C8 
                                  |
:0043C62A 68C8000000              push 000000C8
:0043C62F E8DF340400              call 0047FB13
:0043C634 83C404                  add esp, 00000004
:0043C637 3BF0                    cmp esi, eax
:0043C639 7614                    jbe 0043C64F

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0043C63B 6A06                    push 00000006
:0043C63D E8D1340400              call 0047FB13
:0043C642 83C404                  add esp, 00000004
:0043C645 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043C648 8D540105                lea edx, dword ptr [ecx+eax+05]
:0043C64C 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043C61E(C), :0043C639(C)
|
:0043C64F EB32                    jmp 0043C683
:0043C651 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043C654 E8C2ABFCFF              call 0040721B
:0043C659 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043C65C 2B4110                  sub eax, dword ptr [ecx+10]
:0043C65F 8945FC                  mov dword ptr [ebp-04], eax
:0043C662 EB1F                    jmp 0043C683
:0043C664 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043C667 81E1FF000000            and ecx, 000000FF
:0043C66D 6BC946                  imul ecx, 00000046
:0043C670 81C1C0F44A00            add ecx, 004AF4C0
:0043C676 E85594FEFF              call 00425AD0
:0043C67B 25FF000000              and eax, 000000FF
:0043C680 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043C583(C), :0043C5F6(U), :0043C64F(U), :0043C662(U)
|
:0043C683 8B5508                  mov edx, dword ptr [ebp+08]
:0043C686 81E2FF000000            and edx, 000000FF
:0043C68C 83FA2C                  cmp edx, 0000002C
:0043C68F 740D                    je 0043C69E
:0043C691 8B4508                  mov eax, dword ptr [ebp+08]
:0043C694 25FF000000              and eax, 000000FF
:0043C699 83F82D                  cmp eax, 0000002D
:0043C69C 7528                    jne 0043C6C6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C68F(C)
|
:0043C69E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043C6A1 8B75FC                  mov esi, dword ptr [ebp-04]
:0043C6A4 037114                  add esi, dword ptr [ecx+14]
:0043C6A7 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043C6AA E89BABFCFF              call 0040724A
:0043C6AF 3BF0                    cmp esi, eax
:0043C6B1 7611                    jbe 0043C6C4
:0043C6B3 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043C6B6 E88FABFCFF              call 0040724A
:0043C6BB 8B55F4                  mov edx, dword ptr [ebp-0C]
:0043C6BE 2B4214                  sub eax, dword ptr [edx+14]
:0043C6C1 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C6B1(C)
|
:0043C6C4 EB26                    jmp 0043C6EC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C69C(C)
|
:0043C6C6 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043C6C9 8B75FC                  mov esi, dword ptr [ebp-04]
:0043C6CC 037010                  add esi, dword ptr [eax+10]
:0043C6CF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043C6D2 E844ABFCFF              call 0040721B
:0043C6D7 3BF0                    cmp esi, eax
:0043C6D9 7611                    jbe 0043C6EC
:0043C6DB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043C6DE E838ABFCFF              call 0040721B
:0043C6E3 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043C6E6 2B4110                  sub eax, dword ptr [ecx+10]
:0043C6E9 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043C6C4(U), :0043C6D9(C)
|
:0043C6EC 8B45FC                  mov eax, dword ptr [ebp-04]
:0043C6EF 5E                      pop esi
:0043C6F0 8BE5                    mov esp, ebp
:0043C6F2 5D                      pop ebp
:0043C6F3 C20C00                  ret 000C



:0043C6F6 51C64300                DWORD 0043C651
:0043C6FA 9BC54300                DWORD 0043C59B
:0043C6FE FBC54300                DWORD 0043C5FB
:0043C702 9BC54300                DWORD 0043C59B
:0043C706 FBC54300                DWORD 0043C5FB
:0043C70A 64C64300                DWORD 0043C664
:0043C70E 51C64300                DWORD 0043C651
:0043C712 FBC54300                DWORD 0043C5FB
:0043C716 83C64300                DWORD 0043C683


:0043C71A 0001                    add byte ptr [ecx], al
:0043C71C 0203                    add al, byte ptr [ebx]
:0043C71E 0404                    add al, 04
:0043C720 0505080808              add eax, 08080805
:0043C725 0808                    or byte ptr [eax], cl
:0043C727 0808                    or byte ptr [eax], cl
:0043C729 0808                    or byte ptr [eax], cl
:0043C72B 0808                    or byte ptr [eax], cl
:0043C72D 0808                    or byte ptr [eax], cl
:0043C72F 0808                    or byte ptr [eax], cl
:0043C731 0808                    or byte ptr [eax], cl
:0043C733 0808                    or byte ptr [eax], cl
:0043C735 0806                    or byte ptr [esi], al
:0043C737 07                      pop es

* Referenced by a CALL at Addresses:
|:0043C836   , :0043C99A   , :0043C9A7   
|
:0043C738 55                      push ebp
:0043C739 8BEC                    mov ebp, esp
:0043C73B 51                      push ecx
:0043C73C 894DFC                  mov dword ptr [ebp-04], ecx
:0043C73F 837D0800                cmp dword ptr [ebp+08], 00000000
:0043C743 743E                    je 0043C783
:0043C745 6A14                    push 00000014
:0043C747 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043C74A E8212F0200              call 0045F670
:0043C74F 8BC8                    mov ecx, eax
:0043C751 6BC948                  imul ecx, 00000048
:0043C754 81C1681B4A00            add ecx, 004A1B68
:0043C75A E8AAB2FCFF              call 00407A09
:0043C75F 85C0                    test eax, eax
:0043C761 7404                    je 0043C767
:0043C763 B064                    mov al, 64
:0043C765 EB69                    jmp 0043C7D0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C761(C)
|
:0043C767 6A00                    push 00000000
:0043C769 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043C76C E8FF2E0200              call 0045F670
:0043C771 8BC8                    mov ecx, eax
:0043C773 6BC948                  imul ecx, 00000048
:0043C776 81C1681B4A00            add ecx, 004A1B68
:0043C77C E86F17FEFF              call 0041DEF0
:0043C781 EB4D                    jmp 0043C7D0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C743(C)
|
:0043C783 6A00                    push 00000000
:0043C785 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043C788 E8E32E0200              call 0045F670
:0043C78D 8BC8                    mov ecx, eax
:0043C78F 6BC948                  imul ecx, 00000048
:0043C792 81C1681B4A00            add ecx, 004A1B68
:0043C798 E85317FEFF              call 0041DEF0
:0043C79D 25FF000000              and eax, 000000FF
:0043C7A2 83F832                  cmp eax, 00000032
:0043C7A5 7E04                    jle 0043C7AB
:0043C7A7 B00A                    mov al, 0A
:0043C7A9 EB25                    jmp 0043C7D0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C7A5(C)
|
:0043C7AB 6A00                    push 00000000
:0043C7AD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043C7B0 E8BB2E0200              call 0045F670
:0043C7B5 8BC8                    mov ecx, eax
:0043C7B7 6BC948                  imul ecx, 00000048
:0043C7BA 81C1681B4A00            add ecx, 004A1B68
:0043C7C0 E82B17FEFF              call 0041DEF0
:0043C7C5 50                      push eax
:0043C7C6 6A3C                    push 0000003C
:0043C7C8 E803330400              call 0047FAD0
:0043C7CD 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043C765(U), :0043C781(U), :0043C7A9(U)
|
:0043C7D0 8BE5                    mov esp, ebp
:0043C7D2 5D                      pop ebp
:0043C7D3 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0044E915   , :0044EE16   
|
:0043C7D6 55                      push ebp
:0043C7D7 8BEC                    mov ebp, esp
:0043C7D9 83EC0C                  sub esp, 0000000C
:0043C7DC 894DF8                  mov dword ptr [ebp-08], ecx
:0043C7DF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043C7E2 E8A9C4FDFF              call 00418C90
:0043C7E7 25FF000000              and eax, 000000FF
:0043C7EC 83F802                  cmp eax, 00000002
:0043C7EF 7405                    je 0043C7F6
:0043C7F1 E97B010000              jmp 0043C971

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C7EF(C)
|
:0043C7F6 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043C7F9 E83218FEFF              call 0041E030
:0043C7FE 25FF000000              and eax, 000000FF
:0043C803 85C0                    test eax, eax
:0043C805 742A                    je 0043C831
:0043C807 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043C80A E8F9080000              call 0043D108
:0043C80F 85C0                    test eax, eax
:0043C811 741E                    je 0043C831
:0043C813 6A01                    push 00000001
:0043C815 689E000000              push 0000009E

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0043C81A 6A06                    push 00000006
:0043C81C 8B45F8                  mov eax, dword ptr [ebp-08]
:0043C81F 8B08                    mov ecx, dword ptr [eax]
:0043C821 51                      push ecx
:0043C822 B9F05D4B00              mov ecx, 004B5DF0
:0043C827 E830E20100              call 0045AA5C
:0043C82C E940010000              jmp 0043C971

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043C805(C), :0043C811(C)
|
:0043C831 6A01                    push 00000001
:0043C833 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043C836 E8FDFEFFFF              call 0043C738
:0043C83B 8845FC                  mov byte ptr [ebp-04], al
:0043C83E 6A02                    push 00000002
:0043C840 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043C843 E8989EFCFF              call 004066E0
:0043C848 85C0                    test eax, eax
:0043C84A 742F                    je 0043C87B
:0043C84C 8B55FC                  mov edx, dword ptr [ebp-04]
:0043C84F 81E2FF000000            and edx, 000000FF
:0043C855 52                      push edx
:0043C856 E8D7320400              call 0047FB32
:0043C85B 83C404                  add esp, 00000004
:0043C85E 85C0                    test eax, eax
:0043C860 7419                    je 0043C87B
:0043C862 6A01                    push 00000001
:0043C864 6882000000              push 00000082

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0043C869 6A06                    push 00000006
:0043C86B 8B45F8                  mov eax, dword ptr [ebp-08]
:0043C86E 8B08                    mov ecx, dword ptr [eax]
:0043C870 51                      push ecx
:0043C871 B9F05D4B00              mov ecx, 004B5DF0
:0043C876 E8E1E10100              call 0045AA5C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043C84A(C), :0043C860(C)
|
:0043C87B 6A04                    push 00000004
:0043C87D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043C880 E85B9EFCFF              call 004066E0
:0043C885 85C0                    test eax, eax
:0043C887 742F                    je 0043C8B8
:0043C889 8B55FC                  mov edx, dword ptr [ebp-04]
:0043C88C 81E2FF000000            and edx, 000000FF
:0043C892 52                      push edx
:0043C893 E89A320400              call 0047FB32
:0043C898 83C404                  add esp, 00000004
:0043C89B 85C0                    test eax, eax
:0043C89D 7419                    je 0043C8B8
:0043C89F 6A01                    push 00000001
:0043C8A1 6884000000              push 00000084

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0043C8A6 6A06                    push 00000006
:0043C8A8 8B45F8                  mov eax, dword ptr [ebp-08]
:0043C8AB 8B08                    mov ecx, dword ptr [eax]
:0043C8AD 51                      push ecx
:0043C8AE B9F05D4B00              mov ecx, 004B5DF0
:0043C8B3 E8A4E10100              call 0045AA5C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043C887(C), :0043C89D(C)
|
:0043C8B8 6A08                    push 00000008
:0043C8BA 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043C8BD E81E9EFCFF              call 004066E0
:0043C8C2 85C0                    test eax, eax
:0043C8C4 746E                    je 0043C934
:0043C8C6 8B55FC                  mov edx, dword ptr [ebp-04]
:0043C8C9 81E2FF000000            and edx, 000000FF
:0043C8CF 83FA64                  cmp edx, 00000064
:0043C8D2 7447                    je 0043C91B
:0043C8D4 6A0F                    push 0000000F
:0043C8D6 8A45FC                  mov al, byte ptr [ebp-04]
:0043C8D9 50                      push eax
:0043C8DA E8F1310400              call 0047FAD0
:0043C8DF 83C408                  add esp, 00000008
:0043C8E2 25FF000000              and eax, 000000FF
:0043C8E7 83F80A                  cmp eax, 0000000A
:0043C8EA 7D09                    jge 0043C8F5
:0043C8EC C745F40A000000          mov [ebp-0C], 0000000A
:0043C8F3 EB16                    jmp 0043C90B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C8EA(C)
|
:0043C8F5 6A0F                    push 0000000F
:0043C8F7 8A4DFC                  mov cl, byte ptr [ebp-04]
:0043C8FA 51                      push ecx
:0043C8FB E8D0310400              call 0047FAD0
:0043C900 83C408                  add esp, 00000008
:0043C903 25FF000000              and eax, 000000FF
:0043C908 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C8F3(U)
|
:0043C90B 8B55F4                  mov edx, dword ptr [ebp-0C]
:0043C90E 52                      push edx
:0043C90F E81E320400              call 0047FB32
:0043C914 83C404                  add esp, 00000004
:0043C917 85C0                    test eax, eax
:0043C919 7419                    je 0043C934

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C8D2(C)
|
:0043C91B 6A01                    push 00000001
:0043C91D 6888000000              push 00000088

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0043C922 6A06                    push 00000006
:0043C924 8B45F8                  mov eax, dword ptr [ebp-08]
:0043C927 8B08                    mov ecx, dword ptr [eax]
:0043C929 51                      push ecx
:0043C92A B9F05D4B00              mov ecx, 004B5DF0
:0043C92F E828E10100              call 0045AA5C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043C8C4(C), :0043C919(C)
|
:0043C934 6A10                    push 00000010
:0043C936 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043C939 E8A29DFCFF              call 004066E0
:0043C93E 85C0                    test eax, eax
:0043C940 742F                    je 0043C971
:0043C942 8B55FC                  mov edx, dword ptr [ebp-04]
:0043C945 81E2FF000000            and edx, 000000FF
:0043C94B 52                      push edx
:0043C94C E8E1310400              call 0047FB32
:0043C951 83C404                  add esp, 00000004
:0043C954 85C0                    test eax, eax
:0043C956 7419                    je 0043C971
:0043C958 6A01                    push 00000001
:0043C95A 6890000000              push 00000090

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0043C95F 6A06                    push 00000006
:0043C961 8B45F8                  mov eax, dword ptr [ebp-08]
:0043C964 8B08                    mov ecx, dword ptr [eax]
:0043C966 51                      push ecx
:0043C967 B9F05D4B00              mov ecx, 004B5DF0
:0043C96C E8EBE00100              call 0045AA5C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043C7F1(U), :0043C82C(U), :0043C940(C), :0043C956(C)
|
:0043C971 8BE5                    mov esp, ebp
:0043C973 5D                      pop ebp
:0043C974 C3                      ret



* Referenced by a CALL at Addresses:
|:0044E92C   , :0044EE2D   
|
:0043C975 55                      push ebp
:0043C976 8BEC                    mov ebp, esp
:0043C978 83EC0C                  sub esp, 0000000C
:0043C97B 894DF4                  mov dword ptr [ebp-0C], ecx
:0043C97E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043C981 E80AC3FDFF              call 00418C90
:0043C986 25FF000000              and eax, 000000FF
:0043C98B 83F802                  cmp eax, 00000002
:0043C98E 7405                    je 0043C995
:0043C990 E944040000              jmp 0043CDD9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C98E(C)
|
:0043C995 6A00                    push 00000000
:0043C997 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043C99A E899FDFFFF              call 0043C738
:0043C99F 8845F8                  mov byte ptr [ebp-08], al
:0043C9A2 6A01                    push 00000001
:0043C9A4 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043C9A7 E88CFDFFFF              call 0043C738
:0043C9AC 8845FC                  mov byte ptr [ebp-04], al
:0043C9AF 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043C9B2 33C9                    xor ecx, ecx
:0043C9B4 8A4818                  mov cl, byte ptr [eax+18]
:0043C9B7 83F905                  cmp ecx, 00000005
:0043C9BA 7C13                    jl 0043C9CF
:0043C9BC 8B55F4                  mov edx, dword ptr [ebp-0C]
:0043C9BF 8A4218                  mov al, byte ptr [edx+18]
:0043C9C2 2C01                    sub al, 01
:0043C9C4 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043C9C7 884118                  mov byte ptr [ecx+18], al
:0043C9CA E991000000              jmp 0043CA60

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C9BA(C)
|
:0043C9CF 8B55F4                  mov edx, dword ptr [ebp-0C]
:0043C9D2 33C0                    xor eax, eax
:0043C9D4 8A4218                  mov al, byte ptr [edx+18]
:0043C9D7 83F801                  cmp eax, 00000001
:0043C9DA 7F11                    jg 0043C9ED
:0043C9DC 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043C9DF 8A5118                  mov dl, byte ptr [ecx+18]
:0043C9E2 80C201                  add dl, 01
:0043C9E5 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043C9E8 885018                  mov byte ptr [eax+18], dl
:0043C9EB EB73                    jmp 0043CA60

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043C9DA(C)
|
:0043C9ED 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043C9F0 33D2                    xor edx, edx
:0043C9F2 8A5118                  mov dl, byte ptr [ecx+18]
:0043C9F5 83FA04                  cmp edx, 00000004
:0043C9F8 752D                    jne 0043CA27
:0043C9FA 8B45F8                  mov eax, dword ptr [ebp-08]
:0043C9FD 25FF000000              and eax, 000000FF
:0043CA02 50                      push eax
:0043CA03 E82A310400              call 0047FB32
:0043CA08 83C404                  add esp, 00000004
:0043CA0B 85C0                    test eax, eax
:0043CA0D 7418                    je 0043CA27
:0043CA0F 6A01                    push 00000001
:0043CA11 6A03                    push 00000003
:0043CA13 6A00                    push 00000000
:0043CA15 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043CA18 8B11                    mov edx, dword ptr [ecx]
:0043CA1A 52                      push edx
:0043CA1B B9F05D4B00              mov ecx, 004B5DF0
:0043CA20 E837E00100              call 0045AA5C
:0043CA25 EB39                    jmp 0043CA60

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043C9F8(C), :0043CA0D(C)
|
:0043CA27 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043CA2A 33C9                    xor ecx, ecx
:0043CA2C 8A4818                  mov cl, byte ptr [eax+18]
:0043CA2F 83F902                  cmp ecx, 00000002
:0043CA32 752C                    jne 0043CA60
:0043CA34 8B55FC                  mov edx, dword ptr [ebp-04]
:0043CA37 81E2FF000000            and edx, 000000FF
:0043CA3D 52                      push edx
:0043CA3E E8EF300400              call 0047FB32
:0043CA43 83C404                  add esp, 00000004
:0043CA46 85C0                    test eax, eax
:0043CA48 7416                    je 0043CA60
:0043CA4A 6A01                    push 00000001
:0043CA4C 6A03                    push 00000003
:0043CA4E 6A00                    push 00000000
:0043CA50 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043CA53 8B08                    mov ecx, dword ptr [eax]
:0043CA55 51                      push ecx
:0043CA56 B9F05D4B00              mov ecx, 004B5DF0
:0043CA5B E8FCDF0100              call 0045AA5C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043C9CA(U), :0043C9EB(U), :0043CA25(U), :0043CA32(C), :0043CA48(C)
|
:0043CA60 8B55F4                  mov edx, dword ptr [ebp-0C]
:0043CA63 33C0                    xor eax, eax
:0043CA65 8A4219                  mov al, byte ptr [edx+19]
:0043CA68 83F805                  cmp eax, 00000005
:0043CA6B 7C14                    jl 0043CA81
:0043CA6D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043CA70 8A5119                  mov dl, byte ptr [ecx+19]
:0043CA73 80EA01                  sub dl, 01
:0043CA76 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043CA79 885019                  mov byte ptr [eax+19], dl
:0043CA7C E992000000              jmp 0043CB13

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CA6B(C)
|
:0043CA81 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043CA84 33D2                    xor edx, edx
:0043CA86 8A5119                  mov dl, byte ptr [ecx+19]
:0043CA89 83FA01                  cmp edx, 00000001
:0043CA8C 7F11                    jg 0043CA9F
:0043CA8E 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043CA91 8A4819                  mov cl, byte ptr [eax+19]
:0043CA94 80C101                  add cl, 01
:0043CA97 8B55F4                  mov edx, dword ptr [ebp-0C]
:0043CA9A 884A19                  mov byte ptr [edx+19], cl
:0043CA9D EB74                    jmp 0043CB13

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CA8C(C)
|
:0043CA9F 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043CAA2 33C9                    xor ecx, ecx
:0043CAA4 8A4819                  mov cl, byte ptr [eax+19]
:0043CAA7 83F904                  cmp ecx, 00000004
:0043CAAA 752E                    jne 0043CADA
:0043CAAC 8B55F8                  mov edx, dword ptr [ebp-08]
:0043CAAF 81E2FF000000            and edx, 000000FF
:0043CAB5 52                      push edx
:0043CAB6 E877300400              call 0047FB32
:0043CABB 83C404                  add esp, 00000004
:0043CABE 85C0                    test eax, eax
:0043CAC0 7418                    je 0043CADA
:0043CAC2 6A01                    push 00000001
:0043CAC4 6A03                    push 00000003
:0043CAC6 6A01                    push 00000001
:0043CAC8 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043CACB 8B08                    mov ecx, dword ptr [eax]
:0043CACD 51                      push ecx
:0043CACE B9F05D4B00              mov ecx, 004B5DF0
:0043CAD3 E884DF0100              call 0045AA5C
:0043CAD8 EB39                    jmp 0043CB13

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043CAAA(C), :0043CAC0(C)
|
:0043CADA 8B55F4                  mov edx, dword ptr [ebp-0C]
:0043CADD 33C0                    xor eax, eax
:0043CADF 8A4219                  mov al, byte ptr [edx+19]
:0043CAE2 83F802                  cmp eax, 00000002
:0043CAE5 752C                    jne 0043CB13
:0043CAE7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043CAEA 81E1FF000000            and ecx, 000000FF
:0043CAF0 51                      push ecx
:0043CAF1 E83C300400              call 0047FB32
:0043CAF6 83C404                  add esp, 00000004
:0043CAF9 85C0                    test eax, eax
:0043CAFB 7416                    je 0043CB13
:0043CAFD 6A01                    push 00000001
:0043CAFF 6A03                    push 00000003
:0043CB01 6A01                    push 00000001
:0043CB03 8B55F4                  mov edx, dword ptr [ebp-0C]
:0043CB06 8B02                    mov eax, dword ptr [edx]
:0043CB08 50                      push eax
:0043CB09 B9F05D4B00              mov ecx, 004B5DF0
:0043CB0E E849DF0100              call 0045AA5C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043CA7C(U), :0043CA9D(U), :0043CAD8(U), :0043CAE5(C), :0043CAFB(C)
|
:0043CB13 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043CB16 33D2                    xor edx, edx
:0043CB18 8A511A                  mov dl, byte ptr [ecx+1A]
:0043CB1B 83FA05                  cmp edx, 00000005
:0043CB1E 7C14                    jl 0043CB34
:0043CB20 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043CB23 8A481A                  mov cl, byte ptr [eax+1A]
:0043CB26 80E901                  sub cl, 01
:0043CB29 8B55F4                  mov edx, dword ptr [ebp-0C]
:0043CB2C 884A1A                  mov byte ptr [edx+1A], cl
:0043CB2F E990000000              jmp 0043CBC4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CB1E(C)
|
:0043CB34 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043CB37 33C9                    xor ecx, ecx
:0043CB39 8A481A                  mov cl, byte ptr [eax+1A]
:0043CB3C 83F901                  cmp ecx, 00000001
:0043CB3F 7F10                    jg 0043CB51
:0043CB41 8B55F4                  mov edx, dword ptr [ebp-0C]
:0043CB44 8A421A                  mov al, byte ptr [edx+1A]
:0043CB47 0401                    add al, 01
:0043CB49 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043CB4C 88411A                  mov byte ptr [ecx+1A], al
:0043CB4F EB73                    jmp 0043CBC4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CB3F(C)
|
:0043CB51 8B55F4                  mov edx, dword ptr [ebp-0C]
:0043CB54 33C0                    xor eax, eax
:0043CB56 8A421A                  mov al, byte ptr [edx+1A]
:0043CB59 83F804                  cmp eax, 00000004
:0043CB5C 752E                    jne 0043CB8C
:0043CB5E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043CB61 81E1FF000000            and ecx, 000000FF
:0043CB67 51                      push ecx
:0043CB68 E8C52F0400              call 0047FB32
:0043CB6D 83C404                  add esp, 00000004
:0043CB70 85C0                    test eax, eax
:0043CB72 7418                    je 0043CB8C
:0043CB74 6A01                    push 00000001
:0043CB76 6A03                    push 00000003
:0043CB78 6A02                    push 00000002
:0043CB7A 8B55F4                  mov edx, dword ptr [ebp-0C]
:0043CB7D 8B02                    mov eax, dword ptr [edx]
:0043CB7F 50                      push eax
:0043CB80 B9F05D4B00              mov ecx, 004B5DF0
:0043CB85 E8D2DE0100              call 0045AA5C
:0043CB8A EB38                    jmp 0043CBC4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043CB5C(C), :0043CB72(C)
|
:0043CB8C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043CB8F 33D2                    xor edx, edx
:0043CB91 8A511A                  mov dl, byte ptr [ecx+1A]
:0043CB94 83FA02                  cmp edx, 00000002
:0043CB97 752B                    jne 0043CBC4
:0043CB99 8B45FC                  mov eax, dword ptr [ebp-04]
:0043CB9C 25FF000000              and eax, 000000FF
:0043CBA1 50                      push eax
:0043CBA2 E88B2F0400              call 0047FB32
:0043CBA7 83C404                  add esp, 00000004
:0043CBAA 85C0                    test eax, eax
:0043CBAC 7416                    je 0043CBC4
:0043CBAE 6A01                    push 00000001
:0043CBB0 6A03                    push 00000003
:0043CBB2 6A02                    push 00000002
:0043CBB4 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043CBB7 8B11                    mov edx, dword ptr [ecx]
:0043CBB9 52                      push edx
:0043CBBA B9F05D4B00              mov ecx, 004B5DF0
:0043CBBF E898DE0100              call 0045AA5C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043CB2F(U), :0043CB4F(U), :0043CB8A(U), :0043CB97(C), :0043CBAC(C)
|
:0043CBC4 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043CBC7 33C9                    xor ecx, ecx
:0043CBC9 8A481B                  mov cl, byte ptr [eax+1B]
:0043CBCC 83F905                  cmp ecx, 00000005
:0043CBCF 7C13                    jl 0043CBE4
:0043CBD1 8B55F4                  mov edx, dword ptr [ebp-0C]
:0043CBD4 8A421B                  mov al, byte ptr [edx+1B]
:0043CBD7 2C01                    sub al, 01
:0043CBD9 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043CBDC 88411B                  mov byte ptr [ecx+1B], al
:0043CBDF E991000000              jmp 0043CC75

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CBCF(C)
|
:0043CBE4 8B55F4                  mov edx, dword ptr [ebp-0C]
:0043CBE7 33C0                    xor eax, eax
:0043CBE9 8A421B                  mov al, byte ptr [edx+1B]
:0043CBEC 83F801                  cmp eax, 00000001
:0043CBEF 7F11                    jg 0043CC02
:0043CBF1 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043CBF4 8A511B                  mov dl, byte ptr [ecx+1B]
:0043CBF7 80C201                  add dl, 01
:0043CBFA 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043CBFD 88501B                  mov byte ptr [eax+1B], dl
:0043CC00 EB73                    jmp 0043CC75

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CBEF(C)
|
:0043CC02 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043CC05 33D2                    xor edx, edx
:0043CC07 8A511B                  mov dl, byte ptr [ecx+1B]
:0043CC0A 83FA04                  cmp edx, 00000004
:0043CC0D 752D                    jne 0043CC3C
:0043CC0F 8B45F8                  mov eax, dword ptr [ebp-08]
:0043CC12 25FF000000              and eax, 000000FF
:0043CC17 50                      push eax
:0043CC18 E8152F0400              call 0047FB32
:0043CC1D 83C404                  add esp, 00000004
:0043CC20 85C0                    test eax, eax
:0043CC22 7418                    je 0043CC3C
:0043CC24 6A01                    push 00000001
:0043CC26 6A03                    push 00000003
:0043CC28 6A03                    push 00000003
:0043CC2A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043CC2D 8B11                    mov edx, dword ptr [ecx]
:0043CC2F 52                      push edx
:0043CC30 B9F05D4B00              mov ecx, 004B5DF0
:0043CC35 E822DE0100              call 0045AA5C
:0043CC3A EB39                    jmp 0043CC75

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043CC0D(C), :0043CC22(C)
|
:0043CC3C 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043CC3F 33C9                    xor ecx, ecx
:0043CC41 8A481B                  mov cl, byte ptr [eax+1B]
:0043CC44 83F902                  cmp ecx, 00000002
:0043CC47 752C                    jne 0043CC75
:0043CC49 8B55FC                  mov edx, dword ptr [ebp-04]
:0043CC4C 81E2FF000000            and edx, 000000FF
:0043CC52 52                      push edx
:0043CC53 E8DA2E0400              call 0047FB32
:0043CC58 83C404                  add esp, 00000004
:0043CC5B 85C0                    test eax, eax
:0043CC5D 7416                    je 0043CC75
:0043CC5F 6A01                    push 00000001
:0043CC61 6A03                    push 00000003
:0043CC63 6A03                    push 00000003
:0043CC65 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043CC68 8B08                    mov ecx, dword ptr [eax]
:0043CC6A 51                      push ecx
:0043CC6B B9F05D4B00              mov ecx, 004B5DF0
:0043CC70 E8E7DD0100              call 0045AA5C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043CBDF(U), :0043CC00(U), :0043CC3A(U), :0043CC47(C), :0043CC5D(C)
|
:0043CC75 8B55F4                  mov edx, dword ptr [ebp-0C]
:0043CC78 33C0                    xor eax, eax
:0043CC7A 8A421C                  mov al, byte ptr [edx+1C]
:0043CC7D 83F805                  cmp eax, 00000005
:0043CC80 7C14                    jl 0043CC96
:0043CC82 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043CC85 8A511C                  mov dl, byte ptr [ecx+1C]
:0043CC88 80EA01                  sub dl, 01
:0043CC8B 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043CC8E 88501C                  mov byte ptr [eax+1C], dl
:0043CC91 E992000000              jmp 0043CD28

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CC80(C)
|
:0043CC96 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043CC99 33D2                    xor edx, edx
:0043CC9B 8A511C                  mov dl, byte ptr [ecx+1C]
:0043CC9E 83FA01                  cmp edx, 00000001
:0043CCA1 7F11                    jg 0043CCB4
:0043CCA3 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043CCA6 8A481C                  mov cl, byte ptr [eax+1C]
:0043CCA9 80C101                  add cl, 01
:0043CCAC 8B55F4                  mov edx, dword ptr [ebp-0C]
:0043CCAF 884A1C                  mov byte ptr [edx+1C], cl
:0043CCB2 EB74                    jmp 0043CD28

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CCA1(C)
|
:0043CCB4 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043CCB7 33C9                    xor ecx, ecx
:0043CCB9 8A481C                  mov cl, byte ptr [eax+1C]
:0043CCBC 83F904                  cmp ecx, 00000004
:0043CCBF 752E                    jne 0043CCEF
:0043CCC1 8B55F8                  mov edx, dword ptr [ebp-08]
:0043CCC4 81E2FF000000            and edx, 000000FF
:0043CCCA 52                      push edx
:0043CCCB E8622E0400              call 0047FB32
:0043CCD0 83C404                  add esp, 00000004
:0043CCD3 85C0                    test eax, eax
:0043CCD5 7418                    je 0043CCEF
:0043CCD7 6A01                    push 00000001
:0043CCD9 6A03                    push 00000003
:0043CCDB 6A04                    push 00000004
:0043CCDD 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043CCE0 8B08                    mov ecx, dword ptr [eax]
:0043CCE2 51                      push ecx
:0043CCE3 B9F05D4B00              mov ecx, 004B5DF0
:0043CCE8 E86FDD0100              call 0045AA5C
:0043CCED EB39                    jmp 0043CD28

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043CCBF(C), :0043CCD5(C)
|
:0043CCEF 8B55F4                  mov edx, dword ptr [ebp-0C]
:0043CCF2 33C0                    xor eax, eax
:0043CCF4 8A421C                  mov al, byte ptr [edx+1C]
:0043CCF7 83F802                  cmp eax, 00000002
:0043CCFA 752C                    jne 0043CD28
:0043CCFC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043CCFF 81E1FF000000            and ecx, 000000FF
:0043CD05 51                      push ecx
:0043CD06 E8272E0400              call 0047FB32
:0043CD0B 83C404                  add esp, 00000004
:0043CD0E 85C0                    test eax, eax
:0043CD10 7416                    je 0043CD28
:0043CD12 6A01                    push 00000001
:0043CD14 6A03                    push 00000003
:0043CD16 6A04                    push 00000004
:0043CD18 8B55F4                  mov edx, dword ptr [ebp-0C]
:0043CD1B 8B02                    mov eax, dword ptr [edx]
:0043CD1D 50                      push eax
:0043CD1E B9F05D4B00              mov ecx, 004B5DF0
:0043CD23 E834DD0100              call 0045AA5C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043CC91(U), :0043CCB2(U), :0043CCED(U), :0043CCFA(C), :0043CD10(C)
|
:0043CD28 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043CD2B 33D2                    xor edx, edx
:0043CD2D 8A511D                  mov dl, byte ptr [ecx+1D]
:0043CD30 83FA05                  cmp edx, 00000005
:0043CD33 7C14                    jl 0043CD49
:0043CD35 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043CD38 8A481D                  mov cl, byte ptr [eax+1D]
:0043CD3B 80E901                  sub cl, 01
:0043CD3E 8B55F4                  mov edx, dword ptr [ebp-0C]
:0043CD41 884A1D                  mov byte ptr [edx+1D], cl
:0043CD44 E990000000              jmp 0043CDD9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CD33(C)
|
:0043CD49 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043CD4C 33C9                    xor ecx, ecx
:0043CD4E 8A481D                  mov cl, byte ptr [eax+1D]
:0043CD51 83F901                  cmp ecx, 00000001
:0043CD54 7F10                    jg 0043CD66
:0043CD56 8B55F4                  mov edx, dword ptr [ebp-0C]
:0043CD59 8A421D                  mov al, byte ptr [edx+1D]
:0043CD5C 0401                    add al, 01
:0043CD5E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043CD61 88411D                  mov byte ptr [ecx+1D], al
:0043CD64 EB73                    jmp 0043CDD9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CD54(C)
|
:0043CD66 8B55F4                  mov edx, dword ptr [ebp-0C]
:0043CD69 33C0                    xor eax, eax
:0043CD6B 8A421D                  mov al, byte ptr [edx+1D]
:0043CD6E 83F804                  cmp eax, 00000004
:0043CD71 752E                    jne 0043CDA1
:0043CD73 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043CD76 81E1FF000000            and ecx, 000000FF
:0043CD7C 51                      push ecx
:0043CD7D E8B02D0400              call 0047FB32
:0043CD82 83C404                  add esp, 00000004
:0043CD85 85C0                    test eax, eax
:0043CD87 7418                    je 0043CDA1
:0043CD89 6A01                    push 00000001
:0043CD8B 6A03                    push 00000003
:0043CD8D 6A05                    push 00000005
:0043CD8F 8B55F4                  mov edx, dword ptr [ebp-0C]
:0043CD92 8B02                    mov eax, dword ptr [edx]
:0043CD94 50                      push eax
:0043CD95 B9F05D4B00              mov ecx, 004B5DF0
:0043CD9A E8BDDC0100              call 0045AA5C
:0043CD9F EB38                    jmp 0043CDD9

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043CD71(C), :0043CD87(C)
|
:0043CDA1 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043CDA4 33D2                    xor edx, edx
:0043CDA6 8A511D                  mov dl, byte ptr [ecx+1D]
:0043CDA9 83FA02                  cmp edx, 00000002
:0043CDAC 752B                    jne 0043CDD9
:0043CDAE 8B45FC                  mov eax, dword ptr [ebp-04]
:0043CDB1 25FF000000              and eax, 000000FF
:0043CDB6 50                      push eax
:0043CDB7 E8762D0400              call 0047FB32
:0043CDBC 83C404                  add esp, 00000004
:0043CDBF 85C0                    test eax, eax
:0043CDC1 7416                    je 0043CDD9
:0043CDC3 6A01                    push 00000001
:0043CDC5 6A03                    push 00000003
:0043CDC7 6A05                    push 00000005
:0043CDC9 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043CDCC 8B11                    mov edx, dword ptr [ecx]
:0043CDCE 52                      push edx
:0043CDCF B9F05D4B00              mov ecx, 004B5DF0
:0043CDD4 E883DC0100              call 0045AA5C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043C990(U), :0043CD44(U), :0043CD64(U), :0043CD9F(U), :0043CDAC(C)
|:0043CDC1(C)
|
:0043CDD9 8BE5                    mov esp, ebp
:0043CDDB 5D                      pop ebp
:0043CDDC C3                      ret



* Referenced by a CALL at Addresses:
|:0044E96C   , :0044EE6C   
|
:0043CDDD 55                      push ebp
:0043CDDE 8BEC                    mov ebp, esp
:0043CDE0 83EC20                  sub esp, 00000020
:0043CDE3 56                      push esi
:0043CDE4 894DE0                  mov dword ptr [ebp-20], ecx
:0043CDE7 8B45E0                  mov eax, dword ptr [ebp-20]
:0043CDEA 8B08                    mov ecx, dword ptr [eax]
:0043CDEC 6BC948                  imul ecx, 00000048
:0043CDEF 81C1681B4A00            add ecx, 004A1B68
:0043CDF5 894DE4                  mov dword ptr [ebp-1C], ecx
:0043CDF8 C745F800000000          mov [ebp-08], 00000000
:0043CDFF C745EC00000000          mov [ebp-14], 00000000
:0043CE06 C745E800000000          mov [ebp-18], 00000000
:0043CE0D C745F000000000          mov [ebp-10], 00000000
:0043CE14 C745FC00000000          mov [ebp-04], 00000000
:0043CE1B 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0043CE1E E86DBEFDFF              call 00418C90
:0043CE23 25FF000000              and eax, 000000FF
:0043CE28 83F802                  cmp eax, 00000002
:0043CE2B 7405                    je 0043CE32
:0043CE2D E97A020000              jmp 0043D0AC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CE2B(C)
|
:0043CE32 8B55E0                  mov edx, dword ptr [ebp-20]
:0043CE35 83C206                  add edx, 00000006
:0043CE38 52                      push edx
:0043CE39 E8538BFFFF              call 00435991
:0043CE3E 83C404                  add esp, 00000004
:0043CE41 8845F4                  mov byte ptr [ebp-0C], al
:0043CE44 8B45E0                  mov eax, dword ptr [ebp-20]
:0043CE47 83C006                  add eax, 00000006
:0043CE4A 50                      push eax
:0043CE4B E87083FFFF              call 004351C0
:0043CE50 83C404                  add esp, 00000004
:0043CE53 85C0                    test eax, eax
:0043CE55 7425                    je 0043CE7C
:0043CE57 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043CE5A E8BCA3FCFF              call 0040721B
:0043CE5F 8BF0                    mov esi, eax
:0043CE61 8A4DF4                  mov cl, byte ptr [ebp-0C]
:0043CE64 51                      push ecx
:0043CE65 E847020000              call 0043D0B1
:0043CE6A 83C404                  add esp, 00000004
:0043CE6D 0FAFC6                  imul eax, esi
:0043CE70 33D2                    xor edx, edx
:0043CE72 B964000000              mov ecx, 00000064
:0043CE77 F7F1                    div ecx
:0043CE79 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CE55(C)
|
:0043CE7C 6A12                    push 00000012
:0043CE7E 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043CE81 E883ABFCFF              call 00407A09
:0043CE86 85C0                    test eax, eax
:0043CE88 742A                    je 0043CEB4
:0043CE8A 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043CE8D E889A3FCFF              call 0040721B
:0043CE92 8BF0                    mov esi, eax
:0043CE94 6A12                    push 00000012
:0043CE96 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043CE99 E854ACFCFF              call 00407AF2
:0043CE9E 8AC8                    mov cl, al
:0043CEA0 81E1FF000000            and ecx, 000000FF
:0043CEA6 8BC6                    mov eax, esi
:0043CEA8 33D2                    xor edx, edx
:0043CEAA F7F1                    div ecx
:0043CEAC 8B55F8                  mov edx, dword ptr [ebp-08]
:0043CEAF 03D0                    add edx, eax
:0043CEB1 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CE88(C)
|
:0043CEB4 837DF800                cmp dword ptr [ebp-08], 00000000
:0043CEB8 7626                    jbe 0043CEE0
:0043CEBA 8B45E0                  mov eax, dword ptr [ebp-20]
:0043CEBD 8B7010                  mov esi, dword ptr [eax+10]
:0043CEC0 0375F8                  add esi, dword ptr [ebp-08]
:0043CEC3 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043CEC6 E850A3FCFF              call 0040721B
:0043CECB 3BF0                    cmp esi, eax
:0043CECD 7611                    jbe 0043CEE0
:0043CECF 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043CED2 E844A3FCFF              call 0040721B
:0043CED7 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0043CEDA 2B4110                  sub eax, dword ptr [ecx+10]
:0043CEDD 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043CEB8(C), :0043CECD(C)
|
:0043CEE0 6A13                    push 00000013
:0043CEE2 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043CEE5 E81FABFCFF              call 00407A09
:0043CEEA 85C0                    test eax, eax
:0043CEEC 7438                    je 0043CF26
:0043CEEE 6A13                    push 00000013
:0043CEF0 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043CEF3 E8FAABFCFF              call 00407AF2
:0043CEF8 25FF000000              and eax, 000000FF
:0043CEFD 8945EC                  mov dword ptr [ebp-14], eax
:0043CF00 8B55E0                  mov edx, dword ptr [ebp-20]
:0043CF03 8B7214                  mov esi, dword ptr [edx+14]
:0043CF06 0375EC                  add esi, dword ptr [ebp-14]
:0043CF09 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043CF0C E839A3FCFF              call 0040724A
:0043CF11 3BF0                    cmp esi, eax
:0043CF13 7611                    jbe 0043CF26
:0043CF15 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043CF18 E82DA3FCFF              call 0040724A
:0043CF1D 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0043CF20 2B4114                  sub eax, dword ptr [ecx+14]
:0043CF23 8945EC                  mov dword ptr [ebp-14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043CEEC(C), :0043CF13(C)
|
:0043CF26 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0043CF29 E826300000              call 0043FF54
:0043CF2E 85C0                    test eax, eax
:0043CF30 0F84BD000000            je 0043CFF3
:0043CF36 6A15                    push 00000015
:0043CF38 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043CF3B E8C9AAFCFF              call 00407A09
:0043CF40 85C0                    test eax, eax
:0043CF42 7431                    je 0043CF75
:0043CF44 6A15                    push 00000015
:0043CF46 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043CF49 E8A4ABFCFF              call 00407AF2
:0043CF4E 25FF000000              and eax, 000000FF
:0043CF53 8945E8                  mov dword ptr [ebp-18], eax
:0043CF56 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043CF59 E85FA3FCFF              call 004072BD
:0043CF5E 25FF000000              and eax, 000000FF
:0043CF63 8B55E8                  mov edx, dword ptr [ebp-18]
:0043CF66 0FAFC2                  imul eax, edx
:0043CF69 33D2                    xor edx, edx
:0043CF6B B90A000000              mov ecx, 0000000A
:0043CF70 F7F1                    div ecx
:0043CF72 8945E8                  mov dword ptr [ebp-18], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CF42(C)
|
:0043CF75 6A16                    push 00000016
:0043CF77 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043CF7A E88AAAFCFF              call 00407A09
:0043CF7F 85C0                    test eax, eax
:0043CF81 7431                    je 0043CFB4
:0043CF83 6A16                    push 00000016
:0043CF85 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043CF88 E865ABFCFF              call 00407AF2
:0043CF8D 25FF000000              and eax, 000000FF
:0043CF92 8945F0                  mov dword ptr [ebp-10], eax
:0043CF95 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043CF98 E820A3FCFF              call 004072BD
:0043CF9D 25FF000000              and eax, 000000FF
:0043CFA2 8B55F0                  mov edx, dword ptr [ebp-10]
:0043CFA5 0FAFC2                  imul eax, edx
:0043CFA8 33D2                    xor edx, edx
:0043CFAA B90A000000              mov ecx, 0000000A
:0043CFAF F7F1                    div ecx
:0043CFB1 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CF81(C)
|
:0043CFB4 6A17                    push 00000017
:0043CFB6 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043CFB9 E84BAAFCFF              call 00407A09
:0043CFBE 85C0                    test eax, eax
:0043CFC0 7431                    je 0043CFF3
:0043CFC2 6A17                    push 00000017
:0043CFC4 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043CFC7 E826ABFCFF              call 00407AF2
:0043CFCC 25FF000000              and eax, 000000FF
:0043CFD1 8945FC                  mov dword ptr [ebp-04], eax
:0043CFD4 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043CFD7 E8E1A2FCFF              call 004072BD
:0043CFDC 25FF000000              and eax, 000000FF
:0043CFE1 8B55FC                  mov edx, dword ptr [ebp-04]
:0043CFE4 0FAFC2                  imul eax, edx
:0043CFE7 33D2                    xor edx, edx
:0043CFE9 B90A000000              mov ecx, 0000000A
:0043CFEE F7F1                    div ecx
:0043CFF0 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043CF30(C), :0043CFC0(C)
|
:0043CFF3 837DF800                cmp dword ptr [ebp-08], 00000000
:0043CFF7 7718                    ja 0043D011
:0043CFF9 837DEC00                cmp dword ptr [ebp-14], 00000000
:0043CFFD 7712                    ja 0043D011
:0043CFFF 837DE800                cmp dword ptr [ebp-18], 00000000
:0043D003 770C                    ja 0043D011
:0043D005 837DF000                cmp dword ptr [ebp-10], 00000000
:0043D009 7706                    ja 0043D011
:0043D00B 837DFC00                cmp dword ptr [ebp-04], 00000000
:0043D00F 7646                    jbe 0043D057

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043CFF7(C), :0043CFFD(C), :0043D003(C), :0043D009(C)
|
:0043D011 8B55E0                  mov edx, dword ptr [ebp-20]
:0043D014 8A4207                  mov al, byte ptr [edx+07]
:0043D017 50                      push eax
:0043D018 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0043D01B 8A5106                  mov dl, byte ptr [ecx+06]
:0043D01E 52                      push edx
:0043D01F B950424B00              mov ecx, 004B4250
:0043D024 E816800100              call 0045503F
:0043D029 6A01                    push 00000001
:0043D02B 8B45FC                  mov eax, dword ptr [ebp-04]
:0043D02E 50                      push eax
:0043D02F 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043D032 51                      push ecx
:0043D033 8B55E8                  mov edx, dword ptr [ebp-18]
:0043D036 52                      push edx
:0043D037 8B45EC                  mov eax, dword ptr [ebp-14]
:0043D03A F7D8                    neg eax
:0043D03C 50                      push eax
:0043D03D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043D040 F7D9                    neg ecx
:0043D042 51                      push ecx
:0043D043 68FF000000              push 000000FF
:0043D048 8B55E0                  mov edx, dword ptr [ebp-20]
:0043D04B 8A4204                  mov al, byte ptr [edx+04]
:0043D04E 50                      push eax
:0043D04F E830390100              call 00450984
:0043D054 83C420                  add esp, 00000020

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D00F(C)
|
:0043D057 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0043D05A 8B5110                  mov edx, dword ptr [ecx+10]
:0043D05D 0355F8                  add edx, dword ptr [ebp-08]
:0043D060 8B45E0                  mov eax, dword ptr [ebp-20]
:0043D063 895010                  mov dword ptr [eax+10], edx
:0043D066 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0043D069 8B5114                  mov edx, dword ptr [ecx+14]
:0043D06C 0355EC                  add edx, dword ptr [ebp-14]
:0043D06F 8B45E0                  mov eax, dword ptr [ebp-20]
:0043D072 895014                  mov dword ptr [eax+14], edx
:0043D075 6A01                    push 00000001
:0043D077 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043D07A E8D195FCFF              call 00406650
:0043D07F 25FF000000              and eax, 000000FF
:0043D084 0345E8                  add eax, dword ptr [ebp-18]
:0043D087 50                      push eax
:0043D088 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043D08B E8C0B8FCFF              call 00408950
:0043D090 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043D093 51                      push ecx
:0043D094 6A00                    push 00000000
:0043D096 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043D099 E838B2FCFF              call 004082D6
:0043D09E 8B55FC                  mov edx, dword ptr [ebp-04]
:0043D0A1 52                      push edx
:0043D0A2 6A01                    push 00000001
:0043D0A4 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043D0A7 E82AB2FCFF              call 004082D6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CE2D(U)
|
:0043D0AC 5E                      pop esi
:0043D0AD 8BE5                    mov esp, ebp
:0043D0AF 5D                      pop ebp
:0043D0B0 C3                      ret



* Referenced by a CALL at Address:
|:0043CE65   
|
:0043D0B1 55                      push ebp
:0043D0B2 8BEC                    mov ebp, esp
:0043D0B4 51                      push ecx
:0043D0B5 8B4508                  mov eax, dword ptr [ebp+08]
:0043D0B8 25FF000000              and eax, 000000FF
:0043D0BD 8945FC                  mov dword ptr [ebp-04], eax
:0043D0C0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043D0C3 83E912                  sub ecx, 00000012
:0043D0C6 894DFC                  mov dword ptr [ebp-04], ecx
:0043D0C9 837DFC04                cmp dword ptr [ebp-04], 00000004
:0043D0CD 771F                    ja 0043D0EE
:0043D0CF 8B55FC                  mov edx, dword ptr [ebp-04]
:0043D0D2 FF2495F4D04300          jmp dword ptr [4*edx+0043D0F4]
:0043D0D9 B819000000              mov eax, 00000019
:0043D0DE EB10                    jmp 0043D0F0
:0043D0E0 B814000000              mov eax, 00000014
:0043D0E5 EB09                    jmp 0043D0F0
:0043D0E7 B80F000000              mov eax, 0000000F
:0043D0EC EB02                    jmp 0043D0F0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D0CD(C)
|
:0043D0EE 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043D0DE(U), :0043D0E5(U), :0043D0EC(U)
|
:0043D0F0 8BE5                    mov esp, ebp
:0043D0F2 5D                      pop ebp
:0043D0F3 C3                      ret



:0043D0F4 D9D04300                DWORD 0043D0D9
:0043D0F8 E0D04300                DWORD 0043D0E0
:0043D0FC E0D04300                DWORD 0043D0E0
:0043D100 E7D04300                DWORD 0043D0E7
:0043D104 E0D04300                DWORD 0043D0E0



* Referenced by a CALL at Address:
|:0043C80A   
|
:0043D108 55                      push ebp
:0043D109 8BEC                    mov ebp, esp
:0043D10B 6AFF                    push FFFFFFFF
:0043D10D 68CC534800              push 004853CC
:0043D112 64A100000000            mov eax, dword ptr fs:[00000000]
:0043D118 50                      push eax
:0043D119 64892500000000          mov dword ptr fs:[00000000], esp
:0043D120 81EC44010000            sub esp, 00000144
:0043D126 56                      push esi
:0043D127 898DB0FEFFFF            mov dword ptr [ebp+FFFFFEB0], ecx
:0043D12D 8B8DB0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEB0]
:0043D133 E82862FCFF              call 00403360
:0043D138 668B00                  mov ax, word ptr [eax]
:0043D13B 668985CCFEFFFF          mov word ptr [ebp+FFFFFECC], ax
:0043D142 68FF000000              push 000000FF
:0043D147 68FF000000              push 000000FF
:0043D14C 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:0043D152 E879BBFDFF              call 00418CD0
:0043D157 C785E0FEFFFF00000000    mov dword ptr [ebp+FFFFFEE0], 00000000
:0043D161 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0043D167 E84461FCFF              call 004032B0
:0043D16C C745FC00000000          mov [ebp-04], 00000000
:0043D173 C785D8FEFFFF00000000    mov dword ptr [ebp+FFFFFED8], 00000000
:0043D17D EB0F                    jmp 0043D18E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D500(U)
|
:0043D17F 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:0043D185 83C101                  add ecx, 00000001
:0043D188 898DD8FEFFFF            mov dword ptr [ebp+FFFFFED8], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D17D(U)
|
:0043D18E 83BDD8FEFFFF08          cmp dword ptr [ebp+FFFFFED8], 00000008
:0043D195 0F836A030000            jnb 0043D505
:0043D19B 8A95D8FEFFFF            mov dl, byte ptr [ebp+FFFFFED8]
:0043D1A1 52                      push edx
:0043D1A2 8D85CCFEFFFF            lea eax, dword ptr [ebp+FFFFFECC]
:0043D1A8 50                      push eax
:0043D1A9 E84788FFFF              call 004359F5
:0043D1AE 83C408                  add esp, 00000008
:0043D1B1 50                      push eax
:0043D1B2 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:0043D1B8 E8E393FCFF              call 004065A0
:0043D1BD 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:0043D1C3 81E1FF000000            and ecx, 000000FF
:0043D1C9 81F9FF000000            cmp ecx, 000000FF
:0043D1CF 0F842B030000            je 0043D500
:0043D1D5 8D95E8FEFFFF            lea edx, dword ptr [ebp+FFFFFEE8]
:0043D1DB 52                      push edx
:0043D1DC E8A386FFFF              call 00435884
:0043D1E1 83C404                  add esp, 00000004
:0043D1E4 8885DCFEFFFF            mov byte ptr [ebp+FFFFFEDC], al
:0043D1EA 8B85DCFEFFFF            mov eax, dword ptr [ebp+FFFFFEDC]
:0043D1F0 25FF000000              and eax, 000000FF
:0043D1F5 3DFF000000              cmp eax, 000000FF
:0043D1FA 0F8400030000            je 0043D500
:0043D200 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:0043D206 81E1FF000000            and ecx, 000000FF
:0043D20C 6BC924                  imul ecx, 00000024
:0043D20F 81C1502C4B00            add ecx, 004B2C50
:0043D215 894DF0                  mov dword ptr [ebp-10], ecx
:0043D218 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043D21B E850E2FFFF              call 0043B470
:0043D220 25FF000000              and eax, 000000FF
:0043D225 83F80C                  cmp eax, 0000000C
:0043D228 0F85D2020000            jne 0043D500
:0043D22E 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043D231 E8DA94FCFF              call 00406710
:0043D236 8BF0                    mov esi, eax
:0043D238 8B8DB0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEB0]
:0043D23E E8CD94FCFF              call 00406710
:0043D243 3BF0                    cmp esi, eax
:0043D245 0F85B5020000            jne 0043D500
:0043D24B 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043D24E E83DBAFDFF              call 00418C90
:0043D253 25FF000000              and eax, 000000FF
:0043D258 83F802                  cmp eax, 00000002
:0043D25B 0F859F020000            jne 0043D500

* Possible StringData Ref from Data Obj ->"UNIT_SPC.E5"
                                  |
:0043D261 68D0BB4800              push 0048BBD0
:0043D266 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0043D26C E8C428FEFF              call 0041FB35
:0043D271 6A04                    push 00000004
:0043D273 6A00                    push 00000000
:0043D275 6800690000              push 00006900
:0043D27A B9C8E44A00              mov ecx, 004AE4C8
:0043D27F E8BC270400              call 0047FA40
:0043D284 50                      push eax
:0043D285 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043D288 E823F0FDFF              call 0041C2B0
:0043D28D 25FF000000              and eax, 000000FF
:0043D292 50                      push eax
:0043D293 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043D296 E8AD290000              call 0043FC48
:0043D29B 25FF000000              and eax, 000000FF
:0043D2A0 50                      push eax
:0043D2A1 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0043D2A7 E8DD29FEFF              call 0041FC89
:0043D2AC 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0043D2B2 E80EC0FDFF              call 004192C5
:0043D2B7 6A04                    push 00000004
:0043D2B9 6A00                    push 00000000
:0043D2BB 6A00                    push 00000000
:0043D2BD B9C8E44A00              mov ecx, 004AE4C8
:0043D2C2 E879270400              call 0047FA40
:0043D2C7 8985D0FEFFFF            mov dword ptr [ebp+FFFFFED0], eax
:0043D2CD 6A04                    push 00000004
:0043D2CF 6A00                    push 00000000
:0043D2D1 6800690000              push 00006900
:0043D2D6 B9C8E44A00              mov ecx, 004AE4C8
:0043D2DB E860270400              call 0047FA40
:0043D2E0 8985E4FEFFFF            mov dword ptr [ebp+FFFFFEE4], eax
:0043D2E6 6800090000              push 00000900
:0043D2EB 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:0043D2F1 52                      push edx
:0043D2F2 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:0043D2F8 50                      push eax
:0043D2F9 E8FF290400              call 0047FCFD
:0043D2FE 83C40C                  add esp, 0000000C
:0043D301 6A04                    push 00000004
:0043D303 6A00                    push 00000000
:0043D305 6800100000              push 00001000
:0043D30A B9C8E44A00              mov ecx, 004AE4C8
:0043D30F E82C270400              call 0047FA40
:0043D314 8985D0FEFFFF            mov dword ptr [ebp+FFFFFED0], eax
:0043D31A 6A04                    push 00000004
:0043D31C 6A00                    push 00000000
:0043D31E 68007B0000              push 00007B00
:0043D323 B9C8E44A00              mov ecx, 004AE4C8
:0043D328 E813270400              call 0047FA40
:0043D32D 8985E4FEFFFF            mov dword ptr [ebp+FFFFFEE4], eax
:0043D333 6800090000              push 00000900
:0043D338 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:0043D33E 51                      push ecx
:0043D33F 8B95E4FEFFFF            mov edx, dword ptr [ebp+FFFFFEE4]
:0043D345 52                      push edx
:0043D346 E8B2290400              call 0047FCFD
:0043D34B 83C40C                  add esp, 0000000C
:0043D34E 6A04                    push 00000004
:0043D350 6A00                    push 00000000
:0043D352 6800200000              push 00002000
:0043D357 B9C8E44A00              mov ecx, 004AE4C8
:0043D35C E8DF260400              call 0047FA40
:0043D361 8985D0FEFFFF            mov dword ptr [ebp+FFFFFED0], eax
:0043D367 6A04                    push 00000004
:0043D369 6A00                    push 00000000
:0043D36B 6800720000              push 00007200
:0043D370 B9C8E44A00              mov ecx, 004AE4C8
:0043D375 E8C6260400              call 0047FA40
:0043D37A 8985E4FEFFFF            mov dword ptr [ebp+FFFFFEE4], eax
:0043D380 6800090000              push 00000900
:0043D385 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:0043D38B 50                      push eax
:0043D38C 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:0043D392 51                      push ecx
:0043D393 E865290400              call 0047FCFD
:0043D398 83C40C                  add esp, 0000000C
:0043D39B 6A04                    push 00000004
:0043D39D 6A00                    push 00000000
:0043D39F 6800300000              push 00003000
:0043D3A4 B9C8E44A00              mov ecx, 004AE4C8
:0043D3A9 E892260400              call 0047FA40
:0043D3AE 8985D0FEFFFF            mov dword ptr [ebp+FFFFFED0], eax
:0043D3B4 6A04                    push 00000004
:0043D3B6 6A00                    push 00000000
:0043D3B8 68007B0000              push 00007B00
:0043D3BD B9C8E44A00              mov ecx, 004AE4C8
:0043D3C2 E879260400              call 0047FA40
:0043D3C7 8985E4FEFFFF            mov dword ptr [ebp+FFFFFEE4], eax
:0043D3CD 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:0043D3D3 52                      push edx
:0043D3D4 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:0043D3DA 50                      push eax
:0043D3DB 6A30                    push 00000030
:0043D3DD 6A30                    push 00000030
:0043D3DF E86F1AFEFF              call 0041EE53
:0043D3E4 83C410                  add esp, 00000010
:0043D3E7 8A8DE9FEFFFF            mov cl, byte ptr [ebp+FFFFFEE9]
:0043D3ED 51                      push ecx
:0043D3EE 8A95E8FEFFFF            mov dl, byte ptr [ebp+FFFFFEE8]
:0043D3F4 52                      push edx
:0043D3F5 B950424B00              mov ecx, 004B4250
:0043D3FA E8407C0100              call 0045503F
:0043D3FF 668B85E8FEFFFF          mov ax, word ptr [ebp+FFFFFEE8]
:0043D406 50                      push eax
:0043D407 E872260100              call 0044FA7E
:0043D40C 83C404                  add esp, 00000004
:0043D40F 8985B8FEFFFF            mov dword ptr [ebp+FFFFFEB8], eax
:0043D415 8995BCFEFFFF            mov dword ptr [ebp+FFFFFEBC], edx
:0043D41B 8B8DB8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEB8]
:0043D421 898DC0FEFFFF            mov dword ptr [ebp+FFFFFEC0], ecx
:0043D427 8B95BCFEFFFF            mov edx, dword ptr [ebp+FFFFFEBC]
:0043D42D 8995C4FEFFFF            mov dword ptr [ebp+FFFFFEC4], edx
:0043D433 668B85E8FEFFFF          mov ax, word ptr [ebp+FFFFFEE8]
:0043D43A 50                      push eax
:0043D43B 8D8DC8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEC8]
:0043D441 51                      push ecx
:0043D442 E8D8250100              call 0044FA1F
:0043D447 83C408                  add esp, 00000008
:0043D44A C785D4FEFFFF00000000    mov dword ptr [ebp+FFFFFED4], 00000000
:0043D454 EB0F                    jmp 0043D465

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D4F1(U)
|
:0043D456 8B95D4FEFFFF            mov edx, dword ptr [ebp+FFFFFED4]
:0043D45C 83C201                  add edx, 00000001
:0043D45F 8995D4FEFFFF            mov dword ptr [ebp+FFFFFED4], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D454(U)
|
:0043D465 83BDD4FEFFFF04          cmp dword ptr [ebp+FFFFFED4], 00000004
:0043D46C 0F8784000000            ja 0043D4F6
:0043D472 E86411FEFF              call 0041E5DB
:0043D477 8B85C9FEFFFF            mov eax, dword ptr [ebp+FFFFFEC9]
:0043D47D 25FF000000              and eax, 000000FF
:0043D482 50                      push eax
:0043D483 8B8DC8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC8]
:0043D489 81E1FF000000            and ecx, 000000FF
:0043D48F 51                      push ecx
:0043D490 E86462FCFF              call 004036F9
:0043D495 83C408                  add esp, 00000008
:0043D498 6A04                    push 00000004
:0043D49A 6A00                    push 00000000
:0043D49C 8B85D4FEFFFF            mov eax, dword ptr [ebp+FFFFFED4]
:0043D4A2 33D2                    xor edx, edx
:0043D4A4 B904000000              mov ecx, 00000004
:0043D4A9 F7F1                    div ecx
:0043D4AB C1E20C                  shl edx, 0C
:0043D4AE 52                      push edx
:0043D4AF B9C8E44A00              mov ecx, 004AE4C8
:0043D4B4 E887250400              call 0047FA40
:0043D4B9 50                      push eax
:0043D4BA 8A95DCFEFFFF            mov dl, byte ptr [ebp+FFFFFEDC]
:0043D4C0 52                      push edx
:0043D4C1 6A30                    push 00000030
:0043D4C3 6A30                    push 00000030
:0043D4C5 8B85C4FEFFFF            mov eax, dword ptr [ebp+FFFFFEC4]
:0043D4CB 50                      push eax
:0043D4CC 8B8DC0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC0]
:0043D4D2 51                      push ecx
:0043D4D3 E8A43E0100              call 0045137C
:0043D4D8 83C418                  add esp, 00000018
:0043D4DB E81611FEFF              call 0041E5F6
:0043D4E0 6A02                    push 00000002
:0043D4E2 B9181B4B00              mov ecx, 004B1B18
:0043D4E7 E8545EFCFF              call 00403340
:0043D4EC E8EFEFFEFF              call 0042C4E0
:0043D4F1 E960FFFFFF              jmp 0043D456

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D46C(C)
|
:0043D4F6 C785E0FEFFFF01000000    mov dword ptr [ebp+FFFFFEE0], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043D1CF(C), :0043D1FA(C), :0043D228(C), :0043D245(C), :0043D25B(C)
|
:0043D500 E97AFCFFFF              jmp 0043D17F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D195(C)
|
:0043D505 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:0043D50B 8995B4FEFFFF            mov dword ptr [ebp+FFFFFEB4], edx
:0043D511 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0043D518 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0043D51E E8AD5DFCFF              call 004032D0
:0043D523 8B85B4FEFFFF            mov eax, dword ptr [ebp+FFFFFEB4]
:0043D529 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043D52C 64890D00000000          mov dword ptr fs:[00000000], ecx
:0043D533 5E                      pop esi
:0043D534 8BE5                    mov esp, ebp
:0043D536 5D                      pop ebp
:0043D537 C3                      ret



* Referenced by a CALL at Address:
|:0043DE4C   
|
:0043D538 55                      push ebp
:0043D539 8BEC                    mov ebp, esp
:0043D53B 83EC28                  sub esp, 00000028
:0043D53E 894DDC                  mov dword ptr [ebp-24], ecx
:0043D541 8D4DE8                  lea ecx, dword ptr [ebp-18]
:0043D544 E8C7210200              call 0045F710
:0043D549 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:0043D54C E8BF210200              call 0045F710
:0043D551 C645FCFF                mov [ebp-04], FF
:0043D555 C645E4FF                mov [ebp-1C], FF
:0043D559 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043D55C E85D230000              call 0043F8BE
:0043D561 8845E4                  mov byte ptr [ebp-1C], al
:0043D564 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043D567 E8A491FCFF              call 00406710
:0043D56C 85C0                    test eax, eax
:0043D56E 7514                    jne 0043D584
:0043D570 33C0                    xor eax, eax
:0043D572 A030424B00              mov al, byte ptr [004B4230]
:0043D577 83E004                  and eax, 00000004
:0043D57A 85C0                    test eax, eax
:0043D57C 7506                    jne 0043D584
:0043D57E C645FC00                mov [ebp-04], 00
:0043D582 EB5E                    jmp 0043D5E2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043D56E(C), :0043D57C(C)
|
:0043D584 6880000000              push 00000080
:0043D589 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043D58C E85F85FEFF              call 00425AF0
:0043D591 85C0                    test eax, eax
:0043D593 7512                    jne 0043D5A7
:0043D595 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043D598 E83385FEFF              call 00425AD0
:0043D59D 25FF000000              and eax, 000000FF
:0043D5A2 83F807                  cmp eax, 00000007
:0043D5A5 7415                    je 0043D5BC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D593(C)
|
:0043D5A7 33C9                    xor ecx, ecx
:0043D5A9 8A0D30424B00            mov cl, byte ptr [004B4230]
:0043D5AF 83E104                  and ecx, 00000004
:0043D5B2 85C9                    test ecx, ecx
:0043D5B4 7506                    jne 0043D5BC
:0043D5B6 C645FC01                mov [ebp-04], 01
:0043D5BA EB26                    jmp 0043D5E2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043D5A5(C), :0043D5B4(C)
|
:0043D5BC 6A08                    push 00000008
:0043D5BE 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043D5C1 E81A91FCFF              call 004066E0
:0043D5C6 85C0                    test eax, eax
:0043D5C8 7406                    je 0043D5D0
:0043D5CA C645FC05                mov [ebp-04], 05
:0043D5CE EB12                    jmp 0043D5E2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D5C8(C)
|
:0043D5D0 6A02                    push 00000002
:0043D5D2 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043D5D5 E81685FEFF              call 00425AF0
:0043D5DA 85C0                    test eax, eax
:0043D5DC 7404                    je 0043D5E2
:0043D5DE C645FC06                mov [ebp-04], 06

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043D582(U), :0043D5BA(U), :0043D5CE(U), :0043D5DC(C)
|
:0043D5E2 6A01                    push 00000001
:0043D5E4 68FF000000              push 000000FF
:0043D5E9 68FF000000              push 000000FF
:0043D5EE 6A00                    push 00000000
:0043D5F0 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043D5F3 E857210000              call 0043F74F
:0043D5F8 50                      push eax
:0043D5F9 8B55DC                  mov edx, dword ptr [ebp-24]
:0043D5FC 83C206                  add edx, 00000006
:0043D5FF 52                      push edx
:0043D600 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043D603 E800ADFFFF              call 00438308
:0043D608 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043D60B E844290000              call 0043FF54
:0043D610 85C0                    test eax, eax
:0043D612 7512                    jne 0043D626
:0043D614 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043D617 E8B484FEFF              call 00425AD0
:0043D61C 25FF000000              and eax, 000000FF
:0043D621 83F807                  cmp eax, 00000007
:0043D624 750E                    jne 0043D634

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D612(C)
|
:0043D626 6A01                    push 00000001
:0043D628 B950424B00              mov ecx, 004B4250
:0043D62D E8D1450100              call 00451C03
:0043D632 EB0C                    jmp 0043D640

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D624(C)
|
:0043D634 6A01                    push 00000001
:0043D636 B950424B00              mov ecx, 004B4250
:0043D63B E8B07AFFFF              call 004350F0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D632(U)
|
:0043D640 8B45E4                  mov eax, dword ptr [ebp-1C]
:0043D643 25FF000000              and eax, 000000FF
:0043D648 3DFF000000              cmp eax, 000000FF
:0043D64D 7418                    je 0043D667
:0043D64F 6A00                    push 00000000
:0043D651 8A4DE4                  mov cl, byte ptr [ebp-1C]
:0043D654 51                      push ecx
:0043D655 8B55DC                  mov edx, dword ptr [ebp-24]
:0043D658 668B4206                mov ax, word ptr [edx+06]
:0043D65C 50                      push eax
:0043D65D B950424B00              mov ecx, 004B4250
:0043D662 E875630100              call 004539DC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D64D(C)
|
:0043D667 B950424B00              mov ecx, 004B4250
:0043D66C E8A2640100              call 00453B13

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D7FC(U)
|
:0043D671 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043D674 81E1FF000000            and ecx, 000000FF
:0043D67A 81F9FF000000            cmp ecx, 000000FF
:0043D680 0F857B010000            jne 0043D801
:0043D686 B950424B00              mov ecx, 004B4250
:0043D68B E8FF6A0100              call 0045418F
:0043D690 50                      push eax
:0043D691 8D4DE8                  lea ecx, dword ptr [ebp-18]
:0043D694 E8078FFCFF              call 004065A0
:0043D699 8B55E8                  mov edx, dword ptr [ebp-18]
:0043D69C 81E2FF000000            and edx, 000000FF
:0043D6A2 81FAFF000000            cmp edx, 000000FF
:0043D6A8 7509                    jne 0043D6B3
:0043D6AA C645FC02                mov [ebp-04], 02
:0043D6AE E94E010000              jmp 0043D801

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D6A8(C)
|
:0043D6B3 8D45E8                  lea eax, dword ptr [ebp-18]
:0043D6B6 50                      push eax
:0043D6B7 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043D6BA E8E92A0000              call 004401A8
:0043D6BF 85C0                    test eax, eax
:0043D6C1 7449                    je 0043D70C
:0043D6C3 6A04                    push 00000004
:0043D6C5 6A00                    push 00000000
:0043D6C7 6A00                    push 00000000
:0043D6C9 B938EB4A00              mov ecx, 004AEB38
:0043D6CE E86D230400              call 0047FA40
:0043D6D3 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043D6D6 81E1FF000000            and ecx, 000000FF
:0043D6DC 8D9408C0120000          lea edx, dword ptr [eax+ecx+000012C0]
:0043D6E3 8B45E9                  mov eax, dword ptr [ebp-17]
:0043D6E6 25FF000000              and eax, 000000FF
:0043D6EB 33C9                    xor ecx, ecx
:0043D6ED 8A0D2C424B00            mov cl, byte ptr [004B422C]
:0043D6F3 0FAFC1                  imul eax, ecx
:0043D6F6 33C9                    xor ecx, ecx
:0043D6F8 8A0C02                  mov cl, byte ptr [edx+eax]
:0043D6FB 81F9FF000000            cmp ecx, 000000FF
:0043D701 7409                    je 0043D70C
:0043D703 C645FC04                mov [ebp-04], 04
:0043D707 E9F5000000              jmp 0043D801

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043D6C1(C), :0043D701(C)
|
:0043D70C 8D55E8                  lea edx, dword ptr [ebp-18]
:0043D70F 52                      push edx
:0043D710 E86F81FFFF              call 00435884
:0043D715 83C404                  add esp, 00000004
:0043D718 25FF000000              and eax, 000000FF
:0043D71D 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043D720 33D2                    xor edx, edx
:0043D722 8A5104                  mov dl, byte ptr [ecx+04]
:0043D725 3BC2                    cmp eax, edx
:0043D727 7509                    jne 0043D732
:0043D729 C645FC03                mov [ebp-04], 03
:0043D72D E9CF000000              jmp 0043D801

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D727(C)
|
:0043D732 33C0                    xor eax, eax
:0043D734 A030424B00              mov al, byte ptr [004B4230]
:0043D739 83E008                  and eax, 00000008
:0043D73C 85C0                    test eax, eax
:0043D73E 7436                    je 0043D776
:0043D740 8D4DE8                  lea ecx, dword ptr [ebp-18]
:0043D743 51                      push ecx
:0043D744 E83B81FFFF              call 00435884
:0043D749 83C404                  add esp, 00000004
:0043D74C 25FF000000              and eax, 000000FF
:0043D751 3DFF000000              cmp eax, 000000FF
:0043D756 7519                    jne 0043D771
:0043D758 6A00                    push 00000000
:0043D75A 6A00                    push 00000000
:0043D75C 8D55E8                  lea edx, dword ptr [ebp-18]
:0043D75F 52                      push edx
:0043D760 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043D763 E85879FFFF              call 004350C0
:0043D768 C645FC03                mov [ebp-04], 03
:0043D76C E990000000              jmp 0043D801

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D756(C)
|
:0043D771 E986000000              jmp 0043D7FC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D73E(C)
|
:0043D776 6A01                    push 00000001
:0043D778 6A02                    push 00000002
:0043D77A B9B0694B00              mov ecx, 004B69B0
:0043D77F E8F66E0300              call 0047467A
:0043D784 8D45E8                  lea eax, dword ptr [ebp-18]
:0043D787 50                      push eax
:0043D788 E8F780FFFF              call 00435884
:0043D78D 83C404                  add esp, 00000004
:0043D790 25FF000000              and eax, 000000FF
:0043D795 3DFF000000              cmp eax, 000000FF
:0043D79A 7451                    je 0043D7ED
:0043D79C 6A04                    push 00000004
:0043D79E 6A00                    push 00000000
:0043D7A0 6A00                    push 00000000
:0043D7A2 B938EB4A00              mov ecx, 004AEB38
:0043D7A7 E894220400              call 0047FA40
:0043D7AC 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043D7AF 81E1FF000000            and ecx, 000000FF
:0043D7B5 8D9408C0120000          lea edx, dword ptr [eax+ecx+000012C0]
:0043D7BC 8B45E9                  mov eax, dword ptr [ebp-17]
:0043D7BF 25FF000000              and eax, 000000FF
:0043D7C4 33C9                    xor ecx, ecx
:0043D7C6 8A0D2C424B00            mov cl, byte ptr [004B422C]
:0043D7CC 0FAFC1                  imul eax, ecx
:0043D7CF 33C9                    xor ecx, ecx
:0043D7D1 8A0C02                  mov cl, byte ptr [edx+eax]
:0043D7D4 81F9FF000000            cmp ecx, 000000FF
:0043D7DA 7411                    je 0043D7ED
:0043D7DC 68A8DF4800              push 0048DFA8
:0043D7E1 6A02                    push 00000002
:0043D7E3 E8B11EFFFF              call 0042F699
:0043D7E8 83C408                  add esp, 00000008
:0043D7EB EB0F                    jmp 0043D7FC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043D79A(C), :0043D7DA(C)
|

* Possible StringData Ref from Data Obj ->"ƶΧ"
                                  |
:0043D7ED 68C8DF4800              push 0048DFC8
:0043D7F2 6A02                    push 00000002
:0043D7F4 E8A01EFFFF              call 0042F699
:0043D7F9 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043D771(U), :0043D7EB(U)
|
:0043D7FC E970FEFFFF              jmp 0043D671

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043D680(C), :0043D6AE(U), :0043D707(U), :0043D72D(U), :0043D76C(U)
|
:0043D801 8B55FC                  mov edx, dword ptr [ebp-04]
:0043D804 81E2FF000000            and edx, 000000FF
:0043D80A 8955D8                  mov dword ptr [ebp-28], edx
:0043D80D 837DD806                cmp dword ptr [ebp-28], 00000006
:0043D811 0F876B010000            ja 0043D982
:0043D817 8B45D8                  mov eax, dword ptr [ebp-28]
:0043D81A FF2485BEDA4300          jmp dword ptr [4*eax+0043DABE]
:0043D821 B950424B00              mov ecx, 004B4250
:0043D826 E864690100              call 0045418F
:0043D82B 50                      push eax
:0043D82C 8D4DE8                  lea ecx, dword ptr [ebp-18]
:0043D82F E86C8DFCFF              call 004065A0
:0043D834 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043D837 81E1FF000000            and ecx, 000000FF
:0043D83D 81F9FF000000            cmp ecx, 000000FF
:0043D843 7510                    jne 0043D855
:0043D845 6A01                    push 00000001
:0043D847 6A01                    push 00000001
:0043D849 B9B0694B00              mov ecx, 004B69B0
:0043D84E E8276E0300              call 0047467A
:0043D853 EB1D                    jmp 0043D872

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D843(C)
|
:0043D855 6A01                    push 00000001
:0043D857 6A02                    push 00000002
:0043D859 B9B0694B00              mov ecx, 004B69B0
:0043D85E E8176E0300              call 0047467A

* Possible StringData Ref from Data Obj ->"ǵоӡ"
                                  |
:0043D863 68D8DF4800              push 0048DFD8
:0043D868 6A02                    push 00000002
:0043D86A E82A1EFFFF              call 0042F699
:0043D86F 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D853(U)
|
:0043D872 E90B010000              jmp 0043D982
:0043D877 B950424B00              mov ecx, 004B4250
:0043D87C E80E690100              call 0045418F
:0043D881 50                      push eax
:0043D882 8D4DE8                  lea ecx, dword ptr [ebp-18]
:0043D885 E8168DFCFF              call 004065A0
:0043D88A 8B55E8                  mov edx, dword ptr [ebp-18]
:0043D88D 81E2FF000000            and edx, 000000FF
:0043D893 81FAFF000000            cmp edx, 000000FF
:0043D899 7510                    jne 0043D8AB
:0043D89B 6A01                    push 00000001
:0043D89D 6A01                    push 00000001
:0043D89F B9B0694B00              mov ecx, 004B69B0
:0043D8A4 E8D16D0300              call 0047467A
:0043D8A9 EB1D                    jmp 0043D8C8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D899(C)
|
:0043D8AB 6A01                    push 00000001
:0043D8AD 6A02                    push 00000002
:0043D8AF B9B0694B00              mov ecx, 004B69B0
:0043D8B4 E8C16D0300              call 0047467A

* Possible StringData Ref from Data Obj ->"Ѿӡ"
                                  |
:0043D8B9 68E8DF4800              push 0048DFE8
:0043D8BE 6A02                    push 00000002
:0043D8C0 E8D41DFFFF              call 0042F699
:0043D8C5 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D8A9(U)
|
:0043D8C8 E9B5000000              jmp 0043D982
:0043D8CD 6A01                    push 00000001
:0043D8CF 6A01                    push 00000001
:0043D8D1 B9B0694B00              mov ecx, 004B69B0
:0043D8D6 E89F6D0300              call 0047467A
:0043D8DB E9A2000000              jmp 0043D982
:0043D8E0 B950424B00              mov ecx, 004B4250
:0043D8E5 E8A5680100              call 0045418F
:0043D8EA 50                      push eax
:0043D8EB 8D4DE8                  lea ecx, dword ptr [ebp-18]
:0043D8EE E8AD8CFCFF              call 004065A0
:0043D8F3 8B45E8                  mov eax, dword ptr [ebp-18]
:0043D8F6 25FF000000              and eax, 000000FF
:0043D8FB 3DFF000000              cmp eax, 000000FF
:0043D900 7510                    jne 0043D912
:0043D902 6A01                    push 00000001
:0043D904 6A01                    push 00000001
:0043D906 B9B0694B00              mov ecx, 004B69B0
:0043D90B E86A6D0300              call 0047467A
:0043D910 EB1D                    jmp 0043D92F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D900(C)
|
:0043D912 6A01                    push 00000001
:0043D914 6A02                    push 00000002
:0043D916 B9B0694B00              mov ecx, 004B69B0
:0043D91B E85A6D0300              call 0047467A

* Possible StringData Ref from Data Obj ->"ڻ״̬"
                                  |
:0043D920 68F8DF4800              push 0048DFF8
:0043D925 6A02                    push 00000002
:0043D927 E86D1DFFFF              call 0042F699
:0043D92C 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D910(U)
|
:0043D92F EB51                    jmp 0043D982
:0043D931 B950424B00              mov ecx, 004B4250
:0043D936 E854680100              call 0045418F
:0043D93B 50                      push eax
:0043D93C 8D4DE8                  lea ecx, dword ptr [ebp-18]
:0043D93F E85C8CFCFF              call 004065A0
:0043D944 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0043D947 81E1FF000000            and ecx, 000000FF
:0043D94D 81F9FF000000            cmp ecx, 000000FF
:0043D953 7510                    jne 0043D965
:0043D955 6A01                    push 00000001
:0043D957 6A01                    push 00000001
:0043D959 B9B0694B00              mov ecx, 004B69B0
:0043D95E E8176D0300              call 0047467A
:0043D963 EB1D                    jmp 0043D982

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D953(C)
|
:0043D965 6A01                    push 00000001
:0043D967 6A02                    push 00000002
:0043D969 B9B0694B00              mov ecx, 004B69B0
:0043D96E E8076D0300              call 0047467A

* Possible StringData Ref from Data Obj ->"Ѿжϡ"
                                  |
:0043D973 680CE04800              push 0048E00C
:0043D978 6A02                    push 00000002
:0043D97A E81A1DFFFF              call 0042F699
:0043D97F 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043D811(C), :0043D872(U), :0043D8C8(U), :0043D8DB(U), :0043D92F(U)
|:0043D963(U)
|
:0043D982 6A00                    push 00000000
:0043D984 B950424B00              mov ecx, 004B4250
:0043D989 E875420100              call 00451C03
:0043D98E 6A00                    push 00000000
:0043D990 B950424B00              mov ecx, 004B4250
:0043D995 E85677FFFF              call 004350F0
:0043D99A 6A00                    push 00000000
:0043D99C 68FF000000              push 000000FF
:0043D9A1 8B55DC                  mov edx, dword ptr [ebp-24]
:0043D9A4 668B4206                mov ax, word ptr [edx+06]
:0043D9A8 50                      push eax
:0043D9A9 B950424B00              mov ecx, 004B4250
:0043D9AE E829600100              call 004539DC
:0043D9B3 B950424B00              mov ecx, 004B4250
:0043D9B8 E856610100              call 00453B13
:0043D9BD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043D9C0 81E1FF000000            and ecx, 000000FF
:0043D9C6 83F903                  cmp ecx, 00000003
:0043D9C9 7518                    jne 0043D9E3
:0043D9CB 6A01                    push 00000001
:0043D9CD 6A00                    push 00000000
:0043D9CF B9B0694B00              mov ecx, 004B69B0
:0043D9D4 E8A16C0300              call 0047467A
:0043D9D9 B801000000              mov eax, 00000001
:0043D9DE E9D7000000              jmp 0043DABA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D9C9(C)
|
:0043D9E3 8B55FC                  mov edx, dword ptr [ebp-04]
:0043D9E6 81E2FF000000            and edx, 000000FF
:0043D9EC 83FA04                  cmp edx, 00000004
:0043D9EF 7407                    je 0043D9F8
:0043D9F1 33C0                    xor eax, eax
:0043D9F3 E9C2000000              jmp 0043DABA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043D9EF(C)
|
:0043D9F8 6A00                    push 00000000
:0043D9FA 68FF000000              push 000000FF
:0043D9FF 8D45E8                  lea eax, dword ptr [ebp-18]
:0043DA02 50                      push eax
:0043DA03 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043DA06 83C106                  add ecx, 00000006
:0043DA09 51                      push ecx
:0043DA0A 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043DA0D E81CA4FFFF              call 00437E2E
:0043DA12 8945EC                  mov dword ptr [ebp-14], eax
:0043DA15 8D4DE0                  lea ecx, dword ptr [ebp-20]
:0043DA18 E8F31C0200              call 0045F710
:0043DA1D 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043DA20 E8BF500000              call 00442AE4
:0043DA25 C745F000000000          mov [ebp-10], 00000000
:0043DA2C EB09                    jmp 0043DA37

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043DA84(U), :0043DAA1(U)
|
:0043DA2E 8B55F0                  mov edx, dword ptr [ebp-10]
:0043DA31 83C201                  add edx, 00000001
:0043DA34 8955F0                  mov dword ptr [ebp-10], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DA2C(U)
|
:0043DA37 8D45E8                  lea eax, dword ptr [ebp-18]
:0043DA3A 50                      push eax
:0043DA3B 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043DA3E 83C106                  add ecx, 00000006
:0043DA41 51                      push ecx
:0043DA42 E8D9D9FFFF              call 0043B420
:0043DA47 83C408                  add esp, 00000008
:0043DA4A 85C0                    test eax, eax
:0043DA4C 7555                    jne 0043DAA3
:0043DA4E 8B55EC                  mov edx, dword ptr [ebp-14]
:0043DA51 0355F0                  add edx, dword ptr [ebp-10]
:0043DA54 8A02                    mov al, byte ptr [edx]
:0043DA56 8845F8                  mov byte ptr [ebp-08], al
:0043DA59 8A4DF8                  mov cl, byte ptr [ebp-08]
:0043DA5C 51                      push ecx
:0043DA5D 8B55DC                  mov edx, dword ptr [ebp-24]
:0043DA60 83C206                  add edx, 00000006
:0043DA63 52                      push edx
:0043DA64 E88C7FFFFF              call 004359F5
:0043DA69 83C408                  add esp, 00000008
:0043DA6C 50                      push eax
:0043DA6D 8D4DE0                  lea ecx, dword ptr [ebp-20]
:0043DA70 E82B8BFCFF              call 004065A0
:0043DA75 8B45E0                  mov eax, dword ptr [ebp-20]
:0043DA78 25FF000000              and eax, 000000FF
:0043DA7D 3DFF000000              cmp eax, 000000FF
:0043DA82 7502                    jne 0043DA86
:0043DA84 EBA8                    jmp 0043DA2E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DA82(C)
|
:0043DA86 8A4DF8                  mov cl, byte ptr [ebp-08]
:0043DA89 51                      push ecx
:0043DA8A 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043DA8D E889450000              call 0044201B
:0043DA92 8D55E0                  lea edx, dword ptr [ebp-20]
:0043DA95 52                      push edx
:0043DA96 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043DA99 83C106                  add ecx, 00000006
:0043DA9C E8FF8AFCFF              call 004065A0
:0043DAA1 EB8B                    jmp 0043DA2E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DA4C(C)
|
:0043DAA3 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043DAA6 E810500000              call 00442ABB
:0043DAAB 6A04                    push 00000004
:0043DAAD 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043DAB0 E8634C0000              call 00442718
:0043DAB5 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043D9DE(U), :0043D9F3(U)
|
:0043DABA 8BE5                    mov esp, ebp
:0043DABC 5D                      pop ebp
:0043DABD C3                      ret



:0043DABE 21D84300                DWORD 0043D821
:0043DAC2 77D84300                DWORD 0043D877
:0043DAC6 CDD84300                DWORD 0043D8CD
:0043DACA 82D94300                DWORD 0043D982
:0043DACE 82D94300                DWORD 0043D982
:0043DAD2 E0D84300                DWORD 0043D8E0
:0043DAD6 31D94300                DWORD 0043D931



* Referenced by a CALL at Address:
|:0043E18E   
|
:0043DADA 55                      push ebp
:0043DADB 8BEC                    mov ebp, esp
:0043DADD 83EC0C                  sub esp, 0000000C
:0043DAE0 894DF4                  mov dword ptr [ebp-0C], ecx
:0043DAE3 C645F8FF                mov [ebp-08], FF
:0043DAE7 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043DAEA E8281E0000              call 0043F917
:0043DAEF 8845FC                  mov byte ptr [ebp-04], al
:0043DAF2 68FF000000              push 000000FF
:0043DAF7 6A01                    push 00000001
:0043DAF9 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043DAFC E8BD1D0000              call 0043F8BE
:0043DB01 50                      push eax
:0043DB02 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043DB05 8A4804                  mov cl, byte ptr [eax+04]
:0043DB08 51                      push ecx
:0043DB09 B950424B00              mov ecx, 004B4250
:0043DB0E E82A780100              call 0045533D
:0043DB13 8845F8                  mov byte ptr [ebp-08], al
:0043DB16 8B55F8                  mov edx, dword ptr [ebp-08]
:0043DB19 81E2FF000000            and edx, 000000FF
:0043DB1F 81FAFF000000            cmp edx, 000000FF
:0043DB25 0F84F2000000            je 0043DC1D
:0043DB2B 8A45F8                  mov al, byte ptr [ebp-08]
:0043DB2E 50                      push eax
:0043DB2F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043DB32 8A5104                  mov dl, byte ptr [ecx+04]
:0043DB35 52                      push edx
:0043DB36 E8EE7CFFFF              call 00435829
:0043DB3B 83C408                  add esp, 00000008
:0043DB3E 8A45F8                  mov al, byte ptr [ebp-08]
:0043DB41 50                      push eax
:0043DB42 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043DB45 8A5104                  mov dl, byte ptr [ecx+04]
:0043DB48 52                      push edx
:0043DB49 B9F0274900              mov ecx, 004927F0
:0043DB4E E89E89FCFF              call 004064F1
:0043DB53 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043DB56 81E1FF000000            and ecx, 000000FF
:0043DB5C 6BC924                  imul ecx, 00000024
:0043DB5F 81C1502C4B00            add ecx, 004B2C50
:0043DB65 E826510300              call 00472C90
:0043DB6A 85C0                    test eax, eax
:0043DB6C 0F8597000000            jne 0043DC09
:0043DB72 6A2E                    push 0000002E
:0043DB74 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043DB77 8B08                    mov ecx, dword ptr [eax]
:0043DB79 6BC948                  imul ecx, 00000048
:0043DB7C 81C1681B4A00            add ecx, 004A1B68
:0043DB82 E8829EFCFF              call 00407A09
:0043DB87 85C0                    test eax, eax
:0043DB89 747E                    je 0043DC09
:0043DB8B 68FF000000              push 000000FF
:0043DB90 6840060000              push 00000640
:0043DB95 6A04                    push 00000004
:0043DB97 6A00                    push 00000000
:0043DB99 68C0120000              push 000012C0
:0043DB9E B938EB4A00              mov ecx, 004AEB38
:0043DBA3 E8981E0400              call 0047FA40
:0043DBA8 50                      push eax
:0043DBA9 E865210400              call 0047FD13
:0043DBAE 83C40C                  add esp, 0000000C
:0043DBB1 6A00                    push 00000000
:0043DBB3 6A00                    push 00000000
:0043DBB5 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043DBB8 E8011D0000              call 0043F8BE
:0043DBBD 50                      push eax
:0043DBBE 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043DBC1 83C106                  add ecx, 00000006
:0043DBC4 51                      push ecx
:0043DBC5 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043DBC8 E8B989FFFF              call 00436586
:0043DBCD 8845F8                  mov byte ptr [ebp-08], al
:0043DBD0 8B55F8                  mov edx, dword ptr [ebp-08]
:0043DBD3 81E2FF000000            and edx, 000000FF
:0043DBD9 81FAFF000000            cmp edx, 000000FF
:0043DBDF 7428                    je 0043DC09
:0043DBE1 8A45F8                  mov al, byte ptr [ebp-08]
:0043DBE4 50                      push eax
:0043DBE5 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043DBE8 8A5104                  mov dl, byte ptr [ecx+04]
:0043DBEB 52                      push edx
:0043DBEC E8387CFFFF              call 00435829
:0043DBF1 83C408                  add esp, 00000008
:0043DBF4 8A45F8                  mov al, byte ptr [ebp-08]
:0043DBF7 50                      push eax
:0043DBF8 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043DBFB 8A5104                  mov dl, byte ptr [ecx+04]
:0043DBFE 52                      push edx
:0043DBFF B9F0274900              mov ecx, 004927F0
:0043DC04 E8E888FCFF              call 004064F1

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043DB6C(C), :0043DB89(C), :0043DBDF(C)
|

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0043DC09 6A06                    push 00000006
:0043DC0B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043DC0E E8054B0000              call 00442718
:0043DC13 B950424B00              mov ecx, 004B4250
:0043DC18 E8F65E0100              call 00453B13

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DB25(C)
|
:0043DC1D 8BE5                    mov esp, ebp
:0043DC1F 5D                      pop ebp
:0043DC20 C3                      ret



* Referenced by a CALL at Address:
|:0043E198   
|
:0043DC21 55                      push ebp
:0043DC22 8BEC                    mov ebp, esp
:0043DC24 83EC08                  sub esp, 00000008
:0043DC27 894DF8                  mov dword ptr [ebp-08], ecx
:0043DC2A 6A04                    push 00000004
:0043DC2C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043DC2F E8AC8AFCFF              call 004066E0
:0043DC34 85C0                    test eax, eax
:0043DC36 741F                    je 0043DC57
:0043DC38 6A01                    push 00000001
:0043DC3A 6A02                    push 00000002
:0043DC3C B9B0694B00              mov ecx, 004B69B0
:0043DC41 E8346A0300              call 0047467A

* Possible StringData Ref from Data Obj ->"ڽ״̬"
                                  |
:0043DC46 681CE04800              push 0048E01C
:0043DC4B 6A02                    push 00000002
:0043DC4D E8471AFFFF              call 0042F699
:0043DC52 83C408                  add esp, 00000008
:0043DC55 EB3E                    jmp 0043DC95

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043DC36(C), :0043DC93(U)
|
:0043DC57 6A02                    push 00000002
:0043DC59 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043DC5C E88F7EFEFF              call 00425AF0
:0043DC61 85C0                    test eax, eax
:0043DC63 7530                    jne 0043DC95
:0043DC65 8B45F8                  mov eax, dword ptr [ebp-08]
:0043DC68 50                      push eax
:0043DC69 E85D880200              call 004664CB
:0043DC6E 83C404                  add esp, 00000004
:0043DC71 8845FC                  mov byte ptr [ebp-04], al
:0043DC74 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043DC77 81E1FF000000            and ecx, 000000FF
:0043DC7D 81F9FF000000            cmp ecx, 000000FF
:0043DC83 7502                    jne 0043DC87
:0043DC85 EB0E                    jmp 0043DC95

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DC83(C)
|
:0043DC87 8A55FC                  mov dl, byte ptr [ebp-04]
:0043DC8A 52                      push edx
:0043DC8B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043DC8E E806000000              call 0043DC99
:0043DC93 EBC2                    jmp 0043DC57

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043DC55(U), :0043DC63(C), :0043DC85(U)
|
:0043DC95 8BE5                    mov esp, ebp
:0043DC97 5D                      pop ebp
:0043DC98 C3                      ret



* Referenced by a CALL at Addresses:
|:0043B3C3   , :0043DC8E   
|
:0043DC99 55                      push ebp
:0043DC9A 8BEC                    mov ebp, esp
:0043DC9C 83EC08                  sub esp, 00000008
:0043DC9F 894DF8                  mov dword ptr [ebp-08], ecx
:0043DCA2 8B45F8                  mov eax, dword ptr [ebp-08]
:0043DCA5 8A4804                  mov cl, byte ptr [eax+04]
:0043DCA8 51                      push ecx
:0043DCA9 8A5508                  mov dl, byte ptr [ebp+08]
:0043DCAC 52                      push edx
:0043DCAD B9F87A4900              mov ecx, 00497AF8
:0043DCB2 E87079FEFF              call 00425627
:0043DCB7 8945FC                  mov dword ptr [ebp-04], eax
:0043DCBA 837DFC00                cmp dword ptr [ebp-04], 00000000
:0043DCBE 7416                    je 0043DCD6

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0043DCC0 6A06                    push 00000006
:0043DCC2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043DCC5 E84E4A0000              call 00442718
:0043DCCA 6A00                    push 00000000
:0043DCCC B950424B00              mov ecx, 004B4250
:0043DCD1 E87E800100              call 00455D54

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DCBE(C)
|
:0043DCD6 8BE5                    mov esp, ebp
:0043DCD8 5D                      pop ebp
:0043DCD9 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0043E1A2   
|
:0043DCDC 55                      push ebp
:0043DCDD 8BEC                    mov ebp, esp
:0043DCDF 83EC0C                  sub esp, 0000000C
:0043DCE2 894DF4                  mov dword ptr [ebp-0C], ecx
:0043DCE5 C645FCFF                mov [ebp-04], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DD25(U)
|
:0043DCE9 6A02                    push 00000002
:0043DCEB 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043DCEE E8FD7DFEFF              call 00425AF0
:0043DCF3 85C0                    test eax, eax
:0043DCF5 7530                    jne 0043DD27
:0043DCF7 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043DCFA 50                      push eax
:0043DCFB E82B000000              call 0043DD2B
:0043DD00 83C404                  add esp, 00000004
:0043DD03 8845F8                  mov byte ptr [ebp-08], al
:0043DD06 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043DD09 81E1FF000000            and ecx, 000000FF
:0043DD0F 81F9FF000000            cmp ecx, 000000FF
:0043DD15 7502                    jne 0043DD19
:0043DD17 EB0E                    jmp 0043DD27

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DD15(C)
|
:0043DD19 8A55F8                  mov dl, byte ptr [ebp-08]
:0043DD1C 52                      push edx
:0043DD1D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043DD20 E883000000              call 0043DDA8
:0043DD25 EBC2                    jmp 0043DCE9

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043DCF5(C), :0043DD17(U)
|
:0043DD27 8BE5                    mov esp, ebp
:0043DD29 5D                      pop ebp
:0043DD2A C3                      ret



* Referenced by a CALL at Address:
|:0043DCFB   
|
:0043DD2B 55                      push ebp
:0043DD2C 8BEC                    mov ebp, esp
:0043DD2E 6AFF                    push FFFFFFFF
:0043DD30 68E2534800              push 004853E2
:0043DD35 64A100000000            mov eax, dword ptr fs:[00000000]
:0043DD3B 50                      push eax
:0043DD3C 64892500000000          mov dword ptr fs:[00000000], esp
:0043DD43 81EC04010000            sub esp, 00000104
:0043DD49 8D8DF4FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF4]
:0043DD4F E8EC050000              call 0043E340
:0043DD54 C745FC00000000          mov [ebp-04], 00000000
:0043DD5B 8B4508                  mov eax, dword ptr [ebp+08]
:0043DD5E 50                      push eax
:0043DD5F 8D8DF4FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF4]
:0043DD65 E8A64C0300              call 00472A10
:0043DD6A 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:0043DD70 51                      push ecx
:0043DD71 8D8DF4FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF4]
:0043DD77 E82D0E0300              call 0046EBA9
:0043DD7C 8985F0FEFFFF            mov dword ptr [ebp+FFFFFEF0], eax
:0043DD82 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0043DD89 8D8DF4FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF4]
:0043DD8F E80C060000              call 0043E3A0
:0043DD94 8B85F0FEFFFF            mov eax, dword ptr [ebp+FFFFFEF0]
:0043DD9A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043DD9D 64890D00000000          mov dword ptr fs:[00000000], ecx
:0043DDA4 8BE5                    mov esp, ebp
:0043DDA6 5D                      pop ebp
:0043DDA7 C3                      ret



* Referenced by a CALL at Address:
|:0043DD20   
|
:0043DDA8 55                      push ebp
:0043DDA9 8BEC                    mov ebp, esp
:0043DDAB 83EC08                  sub esp, 00000008
:0043DDAE 894DF8                  mov dword ptr [ebp-08], ecx
:0043DDB1 6A00                    push 00000000
:0043DDB3 6A01                    push 00000001
:0043DDB5 8B45F8                  mov eax, dword ptr [ebp-08]
:0043DDB8 8A4804                  mov cl, byte ptr [eax+04]
:0043DDBB 51                      push ecx
:0043DDBC 8A5508                  mov dl, byte ptr [ebp+08]
:0043DDBF 52                      push edx
:0043DDC0 B950774900              mov ecx, 00497750
:0043DDC5 E879FEFDFF              call 0041DC43
:0043DDCA 8945FC                  mov dword ptr [ebp-04], eax
:0043DDCD 837DFC00                cmp dword ptr [ebp-04], 00000000
:0043DDD1 740A                    je 0043DDDD

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0043DDD3 6A06                    push 00000006
:0043DDD5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043DDD8 E83B490000              call 00442718

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DDD1(C)
|
:0043DDDD 8BE5                    mov esp, ebp
:0043DDDF 5D                      pop ebp
:0043DDE0 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0044E418   
|
:0043DDE3 55                      push ebp
:0043DDE4 8BEC                    mov ebp, esp
:0043DDE6 83EC34                  sub esp, 00000034
:0043DDE9 53                      push ebx
:0043DDEA 894DD4                  mov dword ptr [ebp-2C], ecx
:0043DDED 8B45D4                  mov eax, dword ptr [ebp-2C]
:0043DDF0 668B4806                mov cx, word ptr [eax+06]
:0043DDF4 66894DF8                mov word ptr [ebp-08], cx
:0043DDF8 8B55D4                  mov edx, dword ptr [ebp-2C]
:0043DDFB 33C0                    xor eax, eax
:0043DDFD 8A420F                  mov al, byte ptr [edx+0F]
:0043DE00 8945FC                  mov dword ptr [ebp-04], eax
:0043DE03 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0043DE06 E86501FEFF              call 0041DF70
:0043DE0B 8845EC                  mov byte ptr [ebp-14], al
:0043DE0E C745E800000000          mov [ebp-18], 00000000
:0043DE15 C645F400                mov [ebp-0C], 00
:0043DE19 C645E400                mov [ebp-1C], 00
:0043DE1D B950424B00              mov ecx, 004B4250
:0043DE22 E80B600100              call 00453E32
:0043DE27 8B0D08754B00            mov ecx, dword ptr [004B7508]
:0043DE2D 51                      push ecx
:0043DE2E FF15C8624800            call dword ptr [004862C8]
:0043DE34 85C0                    test eax, eax
:0043DE36 7411                    je 0043DE49
:0043DE38 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0043DE3B E830180200              call 0045F670
:0043DE40 50                      push eax
:0043DE41 E84FB90300              call 00479795
:0043DE46 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DE36(C)
|
:0043DE49 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0043DE4C E8E7F6FFFF              call 0043D538
:0043DE51 85C0                    test eax, eax
:0043DE53 7507                    jne 0043DE5C
:0043DE55 33C0                    xor eax, eax
:0043DE57 E902040000              jmp 0043E25E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DE53(C)
|
:0043DE5C 8B55D4                  mov edx, dword ptr [ebp-2C]
:0043DE5F 8B02                    mov eax, dword ptr [edx]
:0043DE61 50                      push eax
:0043DE62 B9F05D4B00              mov ecx, 004B5DF0
:0043DE67 E8E4170200              call 0045F650
:0043DE6C B9083D4B00              mov ecx, 004B3D08
:0043DE71 E814CA0000              call 0044A88A
:0043DE76 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0043DE79 8A5107                  mov dl, byte ptr [ecx+07]
:0043DE7C 52                      push edx
:0043DE7D 8B45D4                  mov eax, dword ptr [ebp-2C]
:0043DE80 8A4806                  mov cl, byte ptr [eax+06]
:0043DE83 51                      push ecx
:0043DE84 B9985E4B00              mov ecx, 004B5E98
:0043DE89 E812DD0100              call 0045BBA0
:0043DE8E 6A00                    push 00000000
:0043DE90 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0043DE93 E8261A0000              call 0043F8BE
:0043DE98 50                      push eax
:0043DE99 8B55D4                  mov edx, dword ptr [ebp-2C]
:0043DE9C 8A4204                  mov al, byte ptr [edx+04]
:0043DE9F 50                      push eax
:0043DEA0 E8CE030000              call 0043E273
:0043DEA5 83C40C                  add esp, 0000000C
:0043DEA8 25FF000000              and eax, 000000FF
:0043DEAD 85C0                    test eax, eax
:0043DEAF 740C                    je 0043DEBD
:0043DEB1 6A01                    push 00000001
:0043DEB3 B9985E4B00              mov ecx, 004B5E98
:0043DEB8 E883050000              call 0043E440

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DEAF(C)
|
:0043DEBD 6A33                    push 00000033
:0043DEBF 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0043DEC2 8B09                    mov ecx, dword ptr [ecx]
:0043DEC4 6BC948                  imul ecx, 00000048
:0043DEC7 81C1681B4A00            add ecx, 004A1B68
:0043DECD E8379BFCFF              call 00407A09
:0043DED2 85C0                    test eax, eax
:0043DED4 0F8461010000            je 0043E03B
:0043DEDA 8D4DE0                  lea ecx, dword ptr [ebp-20]
:0043DEDD E82E180200              call 0045F710
:0043DEE2 C645D800                mov [ebp-28], 00
:0043DEE6 EB09                    jmp 0043DEF1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E036(U)
|
:0043DEE8 8A55D8                  mov dl, byte ptr [ebp-28]
:0043DEEB 80C201                  add dl, 01
:0043DEEE 8855D8                  mov byte ptr [ebp-28], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DEE6(U)
|
:0043DEF1 8B45D8                  mov eax, dword ptr [ebp-28]
:0043DEF4 25FF000000              and eax, 000000FF
:0043DEF9 83F804                  cmp eax, 00000004
:0043DEFC 0F8D39010000            jnl 0043E03B
:0043DF02 837DE800                cmp dword ptr [ebp-18], 00000000
:0043DF06 0F852F010000            jne 0043E03B
:0043DF0C 8A4DD8                  mov cl, byte ptr [ebp-28]
:0043DF0F 51                      push ecx
:0043DF10 8B55D4                  mov edx, dword ptr [ebp-2C]
:0043DF13 83C206                  add edx, 00000006
:0043DF16 52                      push edx
:0043DF17 E8D97AFFFF              call 004359F5
:0043DF1C 83C408                  add esp, 00000008
:0043DF1F 50                      push eax
:0043DF20 8D4DE0                  lea ecx, dword ptr [ebp-20]
:0043DF23 E87886FCFF              call 004065A0
:0043DF28 8B45E0                  mov eax, dword ptr [ebp-20]
:0043DF2B 25FF000000              and eax, 000000FF
:0043DF30 3DFF000000              cmp eax, 000000FF
:0043DF35 0F84FB000000            je 0043E036
:0043DF3B 8D4DE0                  lea ecx, dword ptr [ebp-20]
:0043DF3E 51                      push ecx
:0043DF3F E84079FFFF              call 00435884
:0043DF44 83C404                  add esp, 00000004
:0043DF47 8845DC                  mov byte ptr [ebp-24], al
:0043DF4A 8B55DC                  mov edx, dword ptr [ebp-24]
:0043DF4D 81E2FF000000            and edx, 000000FF
:0043DF53 81FAFF000000            cmp edx, 000000FF
:0043DF59 0F84D7000000            je 0043E036
:0043DF5F C645F000                mov [ebp-10], 00
:0043DF63 EB08                    jmp 0043DF6D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E031(U)
|
:0043DF65 8A45F0                  mov al, byte ptr [ebp-10]
:0043DF68 0401                    add al, 01
:0043DF6A 8845F0                  mov byte ptr [ebp-10], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DF63(U)
|
:0043DF6D 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043DF70 81E1FF000000            and ecx, 000000FF
:0043DF76 83F944                  cmp ecx, 00000044
:0043DF79 0F8DB7000000            jnl 0043E036
:0043DF7F 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043DF82 81E1FF000000            and ecx, 000000FF
:0043DF88 6BC924                  imul ecx, 00000024
:0043DF8B 81C1502C4B00            add ecx, 004B2C50
:0043DF91 E8DAFFFDFF              call 0041DF70
:0043DF96 25FF000000              and eax, 000000FF
:0043DF9B 50                      push eax
:0043DF9C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043DF9F 81E1FF000000            and ecx, 000000FF
:0043DFA5 6BC946                  imul ecx, 00000046
:0043DFA8 81C1C0F44A00            add ecx, 004AF4C0
:0043DFAE E8CDB5FCFF              call 00409580
:0043DFB3 25FF000000              and eax, 000000FF
:0043DFB8 85C0                    test eax, eax
:0043DFBA 7475                    je 0043E031
:0043DFBC 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043DFBF 81E1FF000000            and ecx, 000000FF
:0043DFC5 6BC924                  imul ecx, 00000024
:0043DFC8 81C1502C4B00            add ecx, 004B2C50
:0043DFCE E89DFFFDFF              call 0041DF70
:0043DFD3 25FF000000              and eax, 000000FF
:0043DFD8 50                      push eax
:0043DFD9 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043DFDC 81E1FF000000            and ecx, 000000FF
:0043DFE2 6BC946                  imul ecx, 00000046
:0043DFE5 81C1C0F44A00            add ecx, 004AF4C0
:0043DFEB E890B5FCFF              call 00409580
:0043DFF0 8AD8                    mov bl, al
:0043DFF2 81E3FF000000            and ebx, 000000FF
:0043DFF8 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043DFFB 81E1FF000000            and ecx, 000000FF
:0043E001 6BC924                  imul ecx, 00000024
:0043E004 81C1502C4B00            add ecx, 004B2C50
:0043E00A E861160200              call 0045F670
:0043E00F 8BC8                    mov ecx, eax
:0043E011 6BC948                  imul ecx, 00000048
:0043E014 81C1681B4A00            add ecx, 004A1B68
:0043E01A E8B185FCFF              call 004065D0
:0043E01F 25FF000000              and eax, 000000FF
:0043E024 3BD8                    cmp ebx, eax
:0043E026 7F09                    jg 0043E031
:0043E028 C745E801000000          mov [ebp-18], 00000001
:0043E02F EB05                    jmp 0043E036

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043DFBA(C), :0043E026(C)
|
:0043E031 E92FFFFFFF              jmp 0043DF65

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043DF35(C), :0043DF59(C), :0043DF79(C), :0043E02F(U)
|
:0043E036 E9ADFEFFFF              jmp 0043DEE8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043DED4(C), :0043DEFC(C), :0043DF06(C)
|
:0043E03B C645F000                mov [ebp-10], 00
:0043E03F EB09                    jmp 0043E04A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E0D9(U)
|
:0043E041 8A55F0                  mov dl, byte ptr [ebp-10]
:0043E044 80C201                  add dl, 01
:0043E047 8855F0                  mov byte ptr [ebp-10], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E03F(U)
|
:0043E04A 8B45F0                  mov eax, dword ptr [ebp-10]
:0043E04D 25FF000000              and eax, 000000FF
:0043E052 83F844                  cmp eax, 00000044
:0043E055 0F8D83000000            jnl 0043E0DE
:0043E05B 837DE800                cmp dword ptr [ebp-18], 00000000
:0043E05F 757D                    jne 0043E0DE
:0043E061 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043E064 81E1FF000000            and ecx, 000000FF
:0043E06A 51                      push ecx
:0043E06B 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043E06E 81E1FF000000            and ecx, 000000FF
:0043E074 6BC946                  imul ecx, 00000046
:0043E077 81C1C0F44A00            add ecx, 004AF4C0
:0043E07D E8FEB4FCFF              call 00409580
:0043E082 25FF000000              and eax, 000000FF
:0043E087 85C0                    test eax, eax
:0043E089 744E                    je 0043E0D9
:0043E08B 8B55EC                  mov edx, dword ptr [ebp-14]
:0043E08E 81E2FF000000            and edx, 000000FF
:0043E094 52                      push edx
:0043E095 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043E098 81E1FF000000            and ecx, 000000FF
:0043E09E 6BC946                  imul ecx, 00000046
:0043E0A1 81C1C0F44A00            add ecx, 004AF4C0
:0043E0A7 E8D4B4FCFF              call 00409580
:0043E0AC 8AD8                    mov bl, al
:0043E0AE 81E3FF000000            and ebx, 000000FF
:0043E0B4 8B45D4                  mov eax, dword ptr [ebp-2C]
:0043E0B7 8B08                    mov ecx, dword ptr [eax]
:0043E0B9 6BC948                  imul ecx, 00000048
:0043E0BC 81C1681B4A00            add ecx, 004A1B68
:0043E0C2 E80985FCFF              call 004065D0
:0043E0C7 25FF000000              and eax, 000000FF
:0043E0CC 3BD8                    cmp ebx, eax
:0043E0CE 7F09                    jg 0043E0D9
:0043E0D0 C745E801000000          mov [ebp-18], 00000001
:0043E0D7 EB05                    jmp 0043E0DE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043E089(C), :0043E0CE(C)
|
:0043E0D9 E963FFFFFF              jmp 0043E041

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043E055(C), :0043E05F(C), :0043E0D7(U)
|
:0043E0DE 837DE800                cmp dword ptr [ebp-18], 00000000
:0043E0E2 740C                    je 0043E0F0
:0043E0E4 6A01                    push 00000001
:0043E0E6 B9985E4B00              mov ecx, 004B5E98
:0043E0EB E82070FFFF              call 00435110

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E0E2(C)
|
:0043E0F0 B970074B00              mov ecx, 004B0770
:0043E0F5 E8F4F8FCFF              call 0040D9EE
:0043E0FA 85C0                    test eax, eax
:0043E0FC 740C                    je 0043E10A
:0043E0FE 6A01                    push 00000001
:0043E100 B9985E4B00              mov ecx, 004B5E98
:0043E105 E856030000              call 0043E460

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E0FC(C)
|
:0043E10A 6A01                    push 00000001
:0043E10C B9985E4B00              mov ecx, 004B5E98
:0043E111 E81A70FFFF              call 00435130

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E1B3(U)
|
:0043E116 6A02                    push 00000002
:0043E118 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0043E11B E8D079FEFF              call 00425AF0
:0043E120 85C0                    test eax, eax
:0043E122 0F8590000000            jne 0043E1B8
:0043E128 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043E12B 81E1FF000000            and ecx, 000000FF
:0043E131 81F9FF000000            cmp ecx, 000000FF
:0043E137 747F                    je 0043E1B8
:0043E139 E85C050200              call 0045E69A
:0043E13E 8845F4                  mov byte ptr [ebp-0C], al
:0043E141 6A00                    push 00000000
:0043E143 6A00                    push 00000000
:0043E145 6802020000              push 00000202
:0043E14A 8B15686A4B00            mov edx, dword ptr [004B6A68]
:0043E150 52                      push edx
:0043E151 FF15F4624800            call dword ptr [004862F4]
:0043E157 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043E15A 25FF000000              and eax, 000000FF
:0043E15F 3DFF000000              cmp eax, 000000FF
:0043E164 744D                    je 0043E1B3
:0043E166 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043E169 81E1FF000000            and ecx, 000000FF
:0043E16F 894DD0                  mov dword ptr [ebp-30], ecx
:0043E172 8B55D0                  mov edx, dword ptr [ebp-30]
:0043E175 83EA01                  sub edx, 00000001
:0043E178 8955D0                  mov dword ptr [ebp-30], edx
:0043E17B 837DD003                cmp dword ptr [ebp-30], 00000003
:0043E17F 7732                    ja 0043E1B3
:0043E181 8B45D0                  mov eax, dword ptr [ebp-30]
:0043E184 FF248563E24300          jmp dword ptr [4*eax+0043E263]
:0043E18B 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0043E18E E847F9FFFF              call 0043DADA
:0043E193 EB1E                    jmp 0043E1B3
:0043E195 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0043E198 E884FAFFFF              call 0043DC21
:0043E19D EB14                    jmp 0043E1B3
:0043E19F 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0043E1A2 E835FBFFFF              call 0043DCDC
:0043E1A7 EB0A                    jmp 0043E1B3

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0043E1A9 6A06                    push 00000006
:0043E1AB 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0043E1AE E865450000              call 00442718

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043E164(C), :0043E17F(C), :0043E193(U), :0043E19D(U), :0043E1A7(U)
|
:0043E1B3 E95EFFFFFF              jmp 0043E116

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043E122(C), :0043E137(C)
|
:0043E1B8 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043E1BB 81E1FF000000            and ecx, 000000FF
:0043E1C1 81F9FF000000            cmp ecx, 000000FF
:0043E1C7 7553                    jne 0043E21C
:0043E1C9 6A04                    push 00000004
:0043E1CB 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0043E1CE E8BD84FCFF              call 00406690
:0043E1D3 6A00                    push 00000000
:0043E1D5 6A00                    push 00000000
:0043E1D7 8D55F8                  lea edx, dword ptr [ebp-08]
:0043E1DA 52                      push edx
:0043E1DB 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0043E1DE E8DD6EFFFF              call 004350C0
:0043E1E3 8B45D4                  mov eax, dword ptr [ebp-2C]
:0043E1E6 8A4DFC                  mov cl, byte ptr [ebp-04]
:0043E1E9 88480F                  mov byte ptr [eax+0F], cl
:0043E1EC 8B55D4                  mov edx, dword ptr [ebp-2C]
:0043E1EF 33C0                    xor eax, eax
:0043E1F1 8A420F                  mov al, byte ptr [edx+0F]
:0043E1F4 83F801                  cmp eax, 00000001
:0043E1F7 750C                    jne 0043E205
:0043E1F9 6A01                    push 00000001
:0043E1FB 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0043E1FE E8311B0000              call 0043FD34
:0043E203 EB17                    jmp 0043E21C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E1F7(C)
|
:0043E205 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0043E208 33D2                    xor edx, edx
:0043E20A 8A510F                  mov dl, byte ptr [ecx+0F]
:0043E20D 83FA03                  cmp edx, 00000003
:0043E210 750A                    jne 0043E21C
:0043E212 6A00                    push 00000000
:0043E214 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0043E217 E8181B0000              call 0043FD34

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043E1C7(C), :0043E203(U), :0043E210(C)
|
:0043E21C 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0043E21F E8A51A0000              call 0043FCC9
:0043E224 B9083D4B00              mov ecx, 004B3D08
:0043E229 E85CC60000              call 0044A88A
:0043E22E 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043E231 25FF000000              and eax, 000000FF
:0043E236 3DFF000000              cmp eax, 000000FF
:0043E23B 7417                    je 0043E254
:0043E23D 6A02                    push 00000002
:0043E23F 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0043E242 E8A978FEFF              call 00425AF0
:0043E247 85C0                    test eax, eax
:0043E249 7409                    je 0043E254
:0043E24B C745CC01000000          mov [ebp-34], 00000001
:0043E252 EB07                    jmp 0043E25B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043E23B(C), :0043E249(C)
|
:0043E254 C745CC00000000          mov [ebp-34], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E252(U)
|
:0043E25B 8B45CC                  mov eax, dword ptr [ebp-34]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043DE57(U)
|
:0043E25E 5B                      pop ebx
:0043E25F 8BE5                    mov esp, ebp
:0043E261 5D                      pop ebp
:0043E262 C3                      ret



:0043E263 8BE14300                DWORD 0043E18B
:0043E267 95E14300                DWORD 0043E195
:0043E26B 9FE14300                DWORD 0043E19F
:0043E26F A9E14300                DWORD 0043E1A9



* Referenced by a CALL at Address:
|:0043DEA0   
|
:0043E273 55                      push ebp
:0043E274 8BEC                    mov ebp, esp
:0043E276 83EC0C                  sub esp, 0000000C
:0043E279 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043E27C 81E1FF000000            and ecx, 000000FF
:0043E282 6BC924                  imul ecx, 00000024
:0043E285 81C1502C4B00            add ecx, 004B2C50
:0043E28B E84078FEFF              call 00425AD0
:0043E290 25FF000000              and eax, 000000FF
:0043E295 83F807                  cmp eax, 00000007
:0043E298 7415                    je 0043E2AF
:0043E29A 33C0                    xor eax, eax
:0043E29C A030424B00              mov al, byte ptr [004B4230]
:0043E2A1 83E004                  and eax, 00000004
:0043E2A4 85C0                    test eax, eax
:0043E2A6 7507                    jne 0043E2AF
:0043E2A8 A0282C4B00              mov al, byte ptr [004B2C28]
:0043E2AD EB68                    jmp 0043E317

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043E298(C), :0043E2A6(C)
|
:0043E2AF C745FC01000000          mov [ebp-04], 00000001
:0043E2B6 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043E2B9 81E1FF000000            and ecx, 000000FF
:0043E2BF 6BC924                  imul ecx, 00000024
:0043E2C2 81C1502C4B00            add ecx, 004B2C50
:0043E2C8 E89350FCFF              call 00403360
:0043E2CD 668B08                  mov cx, word ptr [eax]
:0043E2D0 66894DF4                mov word ptr [ebp-0C], cx
:0043E2D4 6A00                    push 00000000
:0043E2D6 8A5510                  mov dl, byte ptr [ebp+10]
:0043E2D9 52                      push edx
:0043E2DA 8A450C                  mov al, byte ptr [ebp+0C]
:0043E2DD 50                      push eax
:0043E2DE 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:0043E2E1 51                      push ecx
:0043E2E2 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043E2E5 81E1FF000000            and ecx, 000000FF
:0043E2EB 6BC924                  imul ecx, 00000024
:0043E2EE 81C1502C4B00            add ecx, 004B2C50
:0043E2F4 E88D82FFFF              call 00436586
:0043E2F9 8845F8                  mov byte ptr [ebp-08], al
:0043E2FC 8B55F8                  mov edx, dword ptr [ebp-08]
:0043E2FF 81E2FF000000            and edx, 000000FF
:0043E305 81FAFF000000            cmp edx, 000000FF
:0043E30B 7507                    jne 0043E314
:0043E30D C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E30B(C)
|
:0043E314 8A45FC                  mov al, byte ptr [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E2AD(U)
|
:0043E317 8BE5                    mov esp, ebp
:0043E319 5D                      pop ebp
:0043E31A C3                      ret


:0043E31B CC                      int 03
:0043E31C CC                      int 03
:0043E31D CC                      int 03
:0043E31E CC                      int 03
:0043E31F CC                      int 03

* Referenced by a CALL at Addresses:
|:00403BD8   , :00403DE9   , :00405784   , :00421A93   , :0042211E   
|:00435207   , :0043523F   , :00435275   , :0043B7FB   , :0043C1D4   
|:0043C23E   , :0043E527   , :00441046   , :00441109   , :00451535   
|:00451760   , :004574C1   , :004576C1   , :0045793A   , :004653EB   
|:00465404   , :00465795   , :0046FB70   
|
:0043E320 55                      push ebp
:0043E321 8BEC                    mov ebp, esp
:0043E323 51                      push ecx
:0043E324 894DFC                  mov dword ptr [ebp-04], ecx
:0043E327 8B45FC                  mov eax, dword ptr [ebp-04]
:0043E32A 8A400F                  mov al, byte ptr [eax+0F]
:0043E32D 8BE5                    mov esp, ebp
:0043E32F 5D                      pop ebp
:0043E330 C3                      ret


:0043E331 CC                      int 03
:0043E332 CC                      int 03
:0043E333 CC                      int 03
:0043E334 CC                      int 03
:0043E335 CC                      int 03
:0043E336 CC                      int 03
:0043E337 CC                      int 03
:0043E338 CC                      int 03
:0043E339 CC                      int 03
:0043E33A CC                      int 03
:0043E33B CC                      int 03
:0043E33C CC                      int 03
:0043E33D CC                      int 03
:0043E33E CC                      int 03
:0043E33F CC                      int 03

* Referenced by a CALL at Address:
|:0043DD4F   
|
:0043E340 55                      push ebp
:0043E341 8BEC                    mov ebp, esp
:0043E343 6AFF                    push FFFFFFFF
:0043E345 68F9534800              push 004853F9
:0043E34A 64A100000000            mov eax, dword ptr fs:[00000000]
:0043E350 50                      push eax
:0043E351 64892500000000          mov dword ptr fs:[00000000], esp
:0043E358 51                      push ecx
:0043E359 894DF0                  mov dword ptr [ebp-10], ecx
:0043E35C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043E35F E87C00FDFF              call 0040E3E0
:0043E364 C745FC00000000          mov [ebp-04], 00000000
:0043E36B 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043E36E 83C124                  add ecx, 00000024
:0043E371 E89A000000              call 0043E410
:0043E376 8B45F0                  mov eax, dword ptr [ebp-10]
:0043E379 C70010674800            mov dword ptr [eax], 00486710
:0043E37F C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0043E386 8B45F0                  mov eax, dword ptr [ebp-10]
:0043E389 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043E38C 64890D00000000          mov dword ptr fs:[00000000], ecx
:0043E393 8BE5                    mov esp, ebp
:0043E395 5D                      pop ebp
:0043E396 C3                      ret


:0043E397 CC                      int 03
:0043E398 CC                      int 03
:0043E399 CC                      int 03
:0043E39A CC                      int 03
:0043E39B CC                      int 03
:0043E39C CC                      int 03
:0043E39D CC                      int 03
:0043E39E CC                      int 03
:0043E39F CC                      int 03

* Referenced by a CALL at Addresses:
|:0043DD8F   , :004853DC   
|
:0043E3A0 55                      push ebp
:0043E3A1 8BEC                    mov ebp, esp
:0043E3A3 6AFF                    push FFFFFFFF
:0043E3A5 6819544800              push 00485419
:0043E3AA 64A100000000            mov eax, dword ptr fs:[00000000]
:0043E3B0 50                      push eax
:0043E3B1 64892500000000          mov dword ptr fs:[00000000], esp
:0043E3B8 51                      push ecx
:0043E3B9 894DF0                  mov dword ptr [ebp-10], ecx
:0043E3BC C745FC00000000          mov [ebp-04], 00000000
:0043E3C3 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043E3C6 83C124                  add ecx, 00000024
:0043E3C9 E8C2730300              call 00475790
:0043E3CE C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0043E3D5 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043E3D8 E88300FDFF              call 0040E460
:0043E3DD 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043E3E0 64890D00000000          mov dword ptr fs:[00000000], ecx
:0043E3E7 8BE5                    mov esp, ebp
:0043E3E9 5D                      pop ebp
:0043E3EA C3                      ret


:0043E3EB CC                      int 03
:0043E3EC CC                      int 03
:0043E3ED CC                      int 03
:0043E3EE CC                      int 03
:0043E3EF CC                      int 03

* Referenced by a CALL at Addresses:
|:0043BD2F   , :0043C073   
|
:0043E3F0 55                      push ebp
:0043E3F1 8BEC                    mov ebp, esp
:0043E3F3 51                      push ecx
:0043E3F4 894DFC                  mov dword ptr [ebp-04], ecx
:0043E3F7 8B45FC                  mov eax, dword ptr [ebp-04]
:0043E3FA 8B08                    mov ecx, dword ptr [eax]
:0043E3FC 6BC948                  imul ecx, 00000048
:0043E3FF 81C1681B4A00            add ecx, 004A1B68
:0043E405 E8C681FCFF              call 004065D0
:0043E40A 8BE5                    mov esp, ebp
:0043E40C 5D                      pop ebp
:0043E40D C3                      ret


:0043E40E CC                      int 03
:0043E40F CC                      int 03

* Referenced by a CALL at Address:
|:0043E371   
|
:0043E410 55                      push ebp
:0043E411 8BEC                    mov ebp, esp
:0043E413 51                      push ecx
:0043E414 894DFC                  mov dword ptr [ebp-04], ecx
:0043E417 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043E41A E831FEFCFF              call 0040E250
:0043E41F 8B45FC                  mov eax, dword ptr [ebp-04]
:0043E422 C70038674800            mov dword ptr [eax], 00486738
:0043E428 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043E42B C7415000000000          mov [ecx+50], 00000000
:0043E432 8B45FC                  mov eax, dword ptr [ebp-04]
:0043E435 8BE5                    mov esp, ebp
:0043E437 5D                      pop ebp
:0043E438 C3                      ret


:0043E439 CC                      int 03
:0043E43A CC                      int 03
:0043E43B CC                      int 03
:0043E43C CC                      int 03
:0043E43D CC                      int 03
:0043E43E CC                      int 03
:0043E43F CC                      int 03

* Referenced by a CALL at Address:
|:0043DEB8   
|
:0043E440 55                      push ebp
:0043E441 8BEC                    mov ebp, esp
:0043E443 51                      push ecx
:0043E444 894DFC                  mov dword ptr [ebp-04], ecx
:0043E447 8B45FC                  mov eax, dword ptr [ebp-04]
:0043E44A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043E44D 894834                  mov dword ptr [eax+34], ecx
:0043E450 8BE5                    mov esp, ebp
:0043E452 5D                      pop ebp
:0043E453 C20400                  ret 0004


:0043E456 CC                      int 03
:0043E457 CC                      int 03
:0043E458 CC                      int 03
:0043E459 CC                      int 03
:0043E45A CC                      int 03
:0043E45B CC                      int 03
:0043E45C CC                      int 03
:0043E45D CC                      int 03
:0043E45E CC                      int 03
:0043E45F CC                      int 03

* Referenced by a CALL at Address:
|:0043E105   
|
:0043E460 55                      push ebp
:0043E461 8BEC                    mov ebp, esp
:0043E463 51                      push ecx
:0043E464 894DFC                  mov dword ptr [ebp-04], ecx
:0043E467 8B45FC                  mov eax, dword ptr [ebp-04]
:0043E46A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043E46D 89483C                  mov dword ptr [eax+3C], ecx
:0043E470 8BE5                    mov esp, ebp
:0043E472 5D                      pop ebp
:0043E473 C20400                  ret 0004


:0043E476 CC                      int 03
:0043E477 CC                      int 03
:0043E478 CC                      int 03
:0043E479 CC                      int 03
:0043E47A CC                      int 03
:0043E47B CC                      int 03
:0043E47C CC                      int 03
:0043E47D CC                      int 03
:0043E47E CC                      int 03
:0043E47F CC                      int 03
:0043E480 55                      push ebp
:0043E481 8BEC                    mov ebp, esp
:0043E483 E807000000              call 0043E48F
:0043E488 E81F000000              call 0043E4AC
:0043E48D 5D                      pop ebp
:0043E48E C3                      ret



* Referenced by a CALL at Address:
|:0043E483   
|
:0043E48F 55                      push ebp
:0043E490 8BEC                    mov ebp, esp
:0043E492 6810B54200              push 0042B510
:0043E497 68B0304400              push 004430B0
:0043E49C 6A73                    push 00000073
:0043E49E 6A24                    push 00000024
:0043E4A0 68502C4B00              push 004B2C50
:0043E4A5 E8962F0400              call 00481440
:0043E4AA 5D                      pop ebp
:0043E4AB C3                      ret



* Referenced by a CALL at Address:
|:0043E488   
|
:0043E4AC 55                      push ebp
:0043E4AD 8BEC                    mov ebp, esp
:0043E4AF 68BEE44300              push 0043E4BE
:0043E4B4 E8472C0400              call 00481100
:0043E4B9 83C404                  add esp, 00000004
:0043E4BC 5D                      pop ebp
:0043E4BD C3                      ret


:0043E4BE 55                      push ebp
:0043E4BF 8BEC                    mov ebp, esp
:0043E4C1 6810B54200              push 0042B510
:0043E4C6 6A73                    push 00000073
:0043E4C8 6A24                    push 00000024
:0043E4CA 68502C4B00              push 004B2C50
:0043E4CF E80C300400              call 004814E0
:0043E4D4 5D                      pop ebp
:0043E4D5 C3                      ret



* Referenced by a CALL at Address:
|:0045AA77   
|
:0043E4D6 55                      push ebp
:0043E4D7 8BEC                    mov ebp, esp
:0043E4D9 51                      push ecx
:0043E4DA C745FC00000000          mov [ebp-04], 00000000
:0043E4E1 EB09                    jmp 0043E4EC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E50D(U)
|
:0043E4E3 8B45FC                  mov eax, dword ptr [ebp-04]
:0043E4E6 83C001                  add eax, 00000001
:0043E4E9 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E4E1(U)
|
:0043E4EC 837DFC73                cmp dword ptr [ebp-04], 00000073
:0043E4F0 731D                    jnb 0043E50F
:0043E4F2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043E4F5 6BC924                  imul ecx, 00000024
:0043E4F8 81C1502C4B00            add ecx, 004B2C50
:0043E4FE E86D110200              call 0045F670
:0043E503 3B4508                  cmp eax, dword ptr [ebp+08]
:0043E506 7505                    jne 0043E50D
:0043E508 8A45FC                  mov al, byte ptr [ebp-04]
:0043E50B EB04                    jmp 0043E511

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E506(C)
|
:0043E50D EBD4                    jmp 0043E4E3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E4F0(C)
|
:0043E50F 0CFF                    or al, FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E50B(U)
|
:0043E511 8BE5                    mov esp, ebp
:0043E513 5D                      pop ebp
:0043E514 C3                      ret



* Referenced by a CALL at Addresses:
|:004047BC   , :0043E5EB   , :0043E5FF   , :00442147   , :004421C9   
|:00442252   , :004422E5   
|
:0043E515 55                      push ebp
:0043E516 8BEC                    mov ebp, esp
:0043E518 83EC08                  sub esp, 00000008
:0043E51B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043E51E 6BC924                  imul ecx, 00000024
:0043E521 81C1502C4B00            add ecx, 004B2C50
:0043E527 E8F4FDFFFF              call 0043E320
:0043E52C 25FF000000              and eax, 000000FF
:0043E531 8945FC                  mov dword ptr [ebp-04], eax
:0043E534 8B45FC                  mov eax, dword ptr [ebp-04]
:0043E537 8945F8                  mov dword ptr [ebp-08], eax
:0043E53A 837DF803                cmp dword ptr [ebp-08], 00000003
:0043E53E 771C                    ja 0043E55C
:0043E540 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043E543 FF248D62E54300          jmp dword ptr [4*ecx+0043E562]
:0043E54A 33C0                    xor eax, eax
:0043E54C EB10                    jmp 0043E55E
:0043E54E B801000000              mov eax, 00000001
:0043E553 EB09                    jmp 0043E55E
:0043E555 B802000000              mov eax, 00000002
:0043E55A EB02                    jmp 0043E55E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E53E(C)
|
:0043E55C 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043E54C(U), :0043E553(U), :0043E55A(U)
|
:0043E55E 8BE5                    mov esp, ebp
:0043E560 5D                      pop ebp
:0043E561 C3                      ret



:0043E562 4EE54300                DWORD 0043E54E
:0043E566 55E54300                DWORD 0043E555
:0043E56A 4AE54300                DWORD 0043E54A
:0043E56E 55E54300                DWORD 0043E555



* Referenced by a CALL at Addresses:
|:0043EB2C   , :0045722A   , :00459308   , :00477F98   
|
:0043E572 55                      push ebp
:0043E573 8BEC                    mov ebp, esp
:0043E575 83EC0C                  sub esp, 0000000C
:0043E578 C745F800000000          mov [ebp-08], 00000000
:0043E57F 6A02                    push 00000002
:0043E581 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043E584 6BC924                  imul ecx, 00000024
:0043E587 81C1502C4B00            add ecx, 004B2C50
:0043E58D E85E75FEFF              call 00425AF0
:0043E592 85C0                    test eax, eax
:0043E594 7520                    jne 0043E5B6
:0043E596 6A04                    push 00000004
:0043E598 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043E59B 6BC924                  imul ecx, 00000024
:0043E59E 81C1502C4B00            add ecx, 004B2C50
:0043E5A4 E84775FEFF              call 00425AF0
:0043E5A9 85C0                    test eax, eax
:0043E5AB 7509                    jne 0043E5B6
:0043E5AD C745F400000000          mov [ebp-0C], 00000000
:0043E5B4 EB07                    jmp 0043E5BD

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043E594(C), :0043E5AB(C)
|
:0043E5B6 C745F401000000          mov [ebp-0C], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E5B4(U)
|
:0043E5BD 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043E5C0 8945FC                  mov dword ptr [ebp-04], eax
:0043E5C3 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043E5C6 6BC924                  imul ecx, 00000024
:0043E5C9 81C1502C4B00            add ecx, 004B2C50
:0043E5CF E8861B0000              call 0044015A
:0043E5D4 85C0                    test eax, eax
:0043E5D6 7409                    je 0043E5E1
:0043E5D8 C745F809000000          mov [ebp-08], 00000009
:0043E5DF EB2B                    jmp 0043E60C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E5D6(C)
|
:0043E5E1 837DFC00                cmp dword ptr [ebp-04], 00000000
:0043E5E5 7414                    je 0043E5FB
:0043E5E7 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043E5EA 51                      push ecx
:0043E5EB E825FFFFFF              call 0043E515
:0043E5F0 83C404                  add esp, 00000004
:0043E5F3 83C006                  add eax, 00000006
:0043E5F6 8945F8                  mov dword ptr [ebp-08], eax
:0043E5F9 EB11                    jmp 0043E60C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E5E5(C)
|
:0043E5FB 8B5508                  mov edx, dword ptr [ebp+08]
:0043E5FE 52                      push edx
:0043E5FF E811FFFFFF              call 0043E515
:0043E604 83C404                  add esp, 00000004
:0043E607 D1E0                    shl eax, 1
:0043E609 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043E5DF(U), :0043E5F9(U)
|
:0043E60C 837DFC00                cmp dword ptr [ebp-04], 00000000
:0043E610 7566                    jne 0043E678
:0043E612 6A02                    push 00000002
:0043E614 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043E617 6BC924                  imul ecx, 00000024
:0043E61A 81C1502C4B00            add ecx, 004B2C50
:0043E620 E8BB80FCFF              call 004066E0
:0043E625 85C0                    test eax, eax
:0043E627 7427                    je 0043E650
:0043E629 B9083D4B00              mov ecx, 004B3D08
:0043E62E E89DDCFDFF              call 0041C2D0
:0043E633 25FF000000              and eax, 000000FF
:0043E638 99                      cdq
:0043E639 83E203                  and edx, 00000003
:0043E63C 03C2                    add eax, edx
:0043E63E C1F802                  sar eax, 02
:0043E641 85C0                    test eax, eax
:0043E643 7409                    je 0043E64E
:0043E645 8B45F8                  mov eax, dword ptr [ebp-08]
:0043E648 83C001                  add eax, 00000001
:0043E64B 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E643(C)
|
:0043E64E EB28                    jmp 0043E678

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E627(C)
|
:0043E650 B9083D4B00              mov ecx, 004B3D08
:0043E655 E876DCFDFF              call 0041C2D0
:0043E65A 25FF000000              and eax, 000000FF
:0043E65F 99                      cdq
:0043E660 33C2                    xor eax, edx
:0043E662 2BC2                    sub eax, edx
:0043E664 83E001                  and eax, 00000001
:0043E667 33C2                    xor eax, edx
:0043E669 2BC2                    sub eax, edx
:0043E66B 85C0                    test eax, eax
:0043E66D 7409                    je 0043E678
:0043E66F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043E672 83C101                  add ecx, 00000001
:0043E675 894DF8                  mov dword ptr [ebp-08], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043E610(C), :0043E64E(U), :0043E66D(C)
|
:0043E678 6A04                    push 00000004
:0043E67A 6A00                    push 00000000
:0043E67C 8B5508                  mov edx, dword ptr [ebp+08]
:0043E67F 69D200630000            imul edx, 00006300
:0043E685 8B45F8                  mov eax, dword ptr [ebp-08]
:0043E688 69C000090000            imul eax, 00000900
:0043E68E 03D0                    add edx, eax
:0043E690 52                      push edx
:0043E691 B980AB4A00              mov ecx, 004AAB80
:0043E696 E8A5130400              call 0047FA40
:0043E69B 8BE5                    mov esp, ebp
:0043E69D 5D                      pop ebp
:0043E69E C3                      ret



* Referenced by a CALL at Address:
|:0045AAD9   
|
:0043E69F 55                      push ebp
:0043E6A0 8BEC                    mov ebp, esp
:0043E6A2 83EC38                  sub esp, 00000038
:0043E6A5 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043E6A8 81E1FF000000            and ecx, 000000FF
:0043E6AE 6BC924                  imul ecx, 00000024
:0043E6B1 81C1502C4B00            add ecx, 004B2C50
:0043E6B7 E8A44CFCFF              call 00403360
:0043E6BC 668B00                  mov ax, word ptr [eax]
:0043E6BF 668945FC                mov word ptr [ebp-04], ax
:0043E6C3 8A4DFD                  mov cl, byte ptr [ebp-03]
:0043E6C6 51                      push ecx
:0043E6C7 8A55FC                  mov dl, byte ptr [ebp-04]
:0043E6CA 52                      push edx
:0043E6CB B950424B00              mov ecx, 004B4250
:0043E6D0 E86A690100              call 0045503F
:0043E6D5 668B45FC                mov ax, word ptr [ebp-04]
:0043E6D9 50                      push eax
:0043E6DA E89F130100              call 0044FA7E
:0043E6DF 83C404                  add esp, 00000004
:0043E6E2 8945E4                  mov dword ptr [ebp-1C], eax
:0043E6E5 8955E8                  mov dword ptr [ebp-18], edx
:0043E6E8 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0043E6EB 894DEC                  mov dword ptr [ebp-14], ecx
:0043E6EE 8B55E8                  mov edx, dword ptr [ebp-18]
:0043E6F1 8955F0                  mov dword ptr [ebp-10], edx
:0043E6F4 8B450C                  mov eax, dword ptr [ebp+0C]
:0043E6F7 25FF000000              and eax, 000000FF
:0043E6FC 8945E0                  mov dword ptr [ebp-20], eax
:0043E6FF 837DE006                cmp dword ptr [ebp-20], 00000006
:0043E703 0F876E030000            ja 0043EA77
:0043E709 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0043E70C FF248D03EB4300          jmp dword ptr [4*ecx+0043EB03]
:0043E713 8B5508                  mov edx, dword ptr [ebp+08]
:0043E716 81E2FF000000            and edx, 000000FF
:0043E71C 81FAFF000000            cmp edx, 000000FF
:0043E722 7421                    je 0043E745
:0043E724 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043E727 81E1FF000000            and ecx, 000000FF
:0043E72D 6BC924                  imul ecx, 00000024
:0043E730 81C1502C4B00            add ecx, 004B2C50
:0043E736 E855F8FDFF              call 0041DF90
:0043E73B 25FF000000              and eax, 000000FF
:0043E740 8945DC                  mov dword ptr [ebp-24], eax
:0043E743 EB07                    jmp 0043E74C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E722(C)
|
:0043E745 C745DC00000000          mov [ebp-24], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E743(U)
|
:0043E74C 8A45DC                  mov al, byte ptr [ebp-24]
:0043E74F 8845F8                  mov byte ptr [ebp-08], al
:0043E752 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043E755 81E1FF000000            and ecx, 000000FF
:0043E75B 8B5510                  mov edx, dword ptr [ebp+10]
:0043E75E 81E2FF000000            and edx, 000000FF
:0043E764 3BCA                    cmp ecx, edx
:0043E766 7E06                    jle 0043E76E
:0043E768 C645F427                mov [ebp-0C], 27
:0043E76C EB1F                    jmp 0043E78D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E766(C)
|
:0043E76E 8B45F8                  mov eax, dword ptr [ebp-08]
:0043E771 25FF000000              and eax, 000000FF
:0043E776 8B4D10                  mov ecx, dword ptr [ebp+10]
:0043E779 81E1FF000000            and ecx, 000000FF
:0043E77F 3BC1                    cmp eax, ecx
:0043E781 7D06                    jge 0043E789
:0043E783 C645F422                mov [ebp-0C], 22
:0043E787 EB04                    jmp 0043E78D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E781(C)
|
:0043E789 C645F4FF                mov [ebp-0C], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043E76C(U), :0043E787(U)
|
:0043E78D E9E9020000              jmp 0043EA7B
:0043E792 8B5508                  mov edx, dword ptr [ebp+08]
:0043E795 81E2FF000000            and edx, 000000FF
:0043E79B 81FAFF000000            cmp edx, 000000FF
:0043E7A1 7421                    je 0043E7C4
:0043E7A3 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043E7A6 81E1FF000000            and ecx, 000000FF
:0043E7AC 6BC924                  imul ecx, 00000024
:0043E7AF 81C1502C4B00            add ecx, 004B2C50
:0043E7B5 E8F6F7FDFF              call 0041DFB0
:0043E7BA 25FF000000              and eax, 000000FF
:0043E7BF 8945D8                  mov dword ptr [ebp-28], eax
:0043E7C2 EB07                    jmp 0043E7CB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E7A1(C)
|
:0043E7C4 C745D800000000          mov [ebp-28], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E7C2(U)
|
:0043E7CB 8A45D8                  mov al, byte ptr [ebp-28]
:0043E7CE 8845F8                  mov byte ptr [ebp-08], al
:0043E7D1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043E7D4 81E1FF000000            and ecx, 000000FF
:0043E7DA 8B5510                  mov edx, dword ptr [ebp+10]
:0043E7DD 81E2FF000000            and edx, 000000FF
:0043E7E3 3BCA                    cmp ecx, edx
:0043E7E5 7E06                    jle 0043E7ED
:0043E7E7 C645F428                mov [ebp-0C], 28
:0043E7EB EB1F                    jmp 0043E80C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E7E5(C)
|
:0043E7ED 8B45F8                  mov eax, dword ptr [ebp-08]
:0043E7F0 25FF000000              and eax, 000000FF
:0043E7F5 8B4D10                  mov ecx, dword ptr [ebp+10]
:0043E7F8 81E1FF000000            and ecx, 000000FF
:0043E7FE 3BC1                    cmp eax, ecx
:0043E800 7D06                    jge 0043E808
:0043E802 C645F423                mov [ebp-0C], 23
:0043E806 EB04                    jmp 0043E80C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E800(C)
|
:0043E808 C645F4FF                mov [ebp-0C], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043E7EB(U), :0043E806(U)
|
:0043E80C E96A020000              jmp 0043EA7B
:0043E811 8B5508                  mov edx, dword ptr [ebp+08]
:0043E814 81E2FF000000            and edx, 000000FF
:0043E81A 81FAFF000000            cmp edx, 000000FF
:0043E820 7421                    je 0043E843
:0043E822 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043E825 81E1FF000000            and ecx, 000000FF
:0043E82B 6BC924                  imul ecx, 00000024
:0043E82E 81C1502C4B00            add ecx, 004B2C50
:0043E834 E897F7FDFF              call 0041DFD0
:0043E839 25FF000000              and eax, 000000FF
:0043E83E 8945D4                  mov dword ptr [ebp-2C], eax
:0043E841 EB07                    jmp 0043E84A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E820(C)
|
:0043E843 C745D400000000          mov [ebp-2C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E841(U)
|
:0043E84A 8A45D4                  mov al, byte ptr [ebp-2C]
:0043E84D 8845F8                  mov byte ptr [ebp-08], al
:0043E850 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043E853 81E1FF000000            and ecx, 000000FF
:0043E859 8B5510                  mov edx, dword ptr [ebp+10]
:0043E85C 81E2FF000000            and edx, 000000FF
:0043E862 3BCA                    cmp ecx, edx
:0043E864 7E06                    jle 0043E86C
:0043E866 C645F427                mov [ebp-0C], 27
:0043E86A EB1F                    jmp 0043E88B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E864(C)
|
:0043E86C 8B45F8                  mov eax, dword ptr [ebp-08]
:0043E86F 25FF000000              and eax, 000000FF
:0043E874 8B4D10                  mov ecx, dword ptr [ebp+10]
:0043E877 81E1FF000000            and ecx, 000000FF
:0043E87D 3BC1                    cmp eax, ecx
:0043E87F 7D06                    jge 0043E887
:0043E881 C645F422                mov [ebp-0C], 22
:0043E885 EB04                    jmp 0043E88B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E87F(C)
|
:0043E887 C645F4FF                mov [ebp-0C], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043E86A(U), :0043E885(U)
|
:0043E88B E9EB010000              jmp 0043EA7B
:0043E890 8B5508                  mov edx, dword ptr [ebp+08]
:0043E893 81E2FF000000            and edx, 000000FF
:0043E899 81FAFF000000            cmp edx, 000000FF
:0043E89F 7421                    je 0043E8C2
:0043E8A1 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043E8A4 81E1FF000000            and ecx, 000000FF
:0043E8AA 6BC924                  imul ecx, 00000024
:0043E8AD 81C1502C4B00            add ecx, 004B2C50
:0043E8B3 E838F7FDFF              call 0041DFF0
:0043E8B8 25FF000000              and eax, 000000FF
:0043E8BD 8945D0                  mov dword ptr [ebp-30], eax
:0043E8C0 EB07                    jmp 0043E8C9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E89F(C)
|
:0043E8C2 C745D000000000          mov [ebp-30], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E8C0(U)
|
:0043E8C9 8A45D0                  mov al, byte ptr [ebp-30]
:0043E8CC 8845F8                  mov byte ptr [ebp-08], al
:0043E8CF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043E8D2 81E1FF000000            and ecx, 000000FF
:0043E8D8 8B5510                  mov edx, dword ptr [ebp+10]
:0043E8DB 81E2FF000000            and edx, 000000FF
:0043E8E1 3BCA                    cmp ecx, edx
:0043E8E3 7E06                    jle 0043E8EB
:0043E8E5 C645F429                mov [ebp-0C], 29
:0043E8E9 EB1F                    jmp 0043E90A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E8E3(C)
|
:0043E8EB 8B45F8                  mov eax, dword ptr [ebp-08]
:0043E8EE 25FF000000              and eax, 000000FF
:0043E8F3 8B4D10                  mov ecx, dword ptr [ebp+10]
:0043E8F6 81E1FF000000            and ecx, 000000FF
:0043E8FC 3BC1                    cmp eax, ecx
:0043E8FE 7D06                    jge 0043E906
:0043E900 C645F424                mov [ebp-0C], 24
:0043E904 EB04                    jmp 0043E90A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E8FE(C)
|
:0043E906 C645F4FF                mov [ebp-0C], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043E8E9(U), :0043E904(U)
|
:0043E90A E96C010000              jmp 0043EA7B
:0043E90F 8B5508                  mov edx, dword ptr [ebp+08]
:0043E912 81E2FF000000            and edx, 000000FF
:0043E918 81FAFF000000            cmp edx, 000000FF
:0043E91E 7421                    je 0043E941
:0043E920 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043E923 81E1FF000000            and ecx, 000000FF
:0043E929 6BC924                  imul ecx, 00000024
:0043E92C 81C1502C4B00            add ecx, 004B2C50
:0043E932 E8D9F6FDFF              call 0041E010
:0043E937 25FF000000              and eax, 000000FF
:0043E93C 8945CC                  mov dword ptr [ebp-34], eax
:0043E93F EB07                    jmp 0043E948

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E91E(C)
|
:0043E941 C745CC00000000          mov [ebp-34], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E93F(U)
|
:0043E948 8A45CC                  mov al, byte ptr [ebp-34]
:0043E94B 8845F8                  mov byte ptr [ebp-08], al
:0043E94E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043E951 81E1FF000000            and ecx, 000000FF
:0043E957 8B5510                  mov edx, dword ptr [ebp+10]
:0043E95A 81E2FF000000            and edx, 000000FF
:0043E960 3BCA                    cmp ecx, edx
:0043E962 7E06                    jle 0043E96A
:0043E964 C645F42A                mov [ebp-0C], 2A
:0043E968 EB1F                    jmp 0043E989

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E962(C)
|
:0043E96A 8B45F8                  mov eax, dword ptr [ebp-08]
:0043E96D 25FF000000              and eax, 000000FF
:0043E972 8B4D10                  mov ecx, dword ptr [ebp+10]
:0043E975 81E1FF000000            and ecx, 000000FF
:0043E97B 3BC1                    cmp eax, ecx
:0043E97D 7D06                    jge 0043E985
:0043E97F C645F425                mov [ebp-0C], 25
:0043E983 EB04                    jmp 0043E989

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E97D(C)
|
:0043E985 C645F4FF                mov [ebp-0C], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043E968(U), :0043E983(U)
|
:0043E989 E9ED000000              jmp 0043EA7B
:0043E98E 8B5508                  mov edx, dword ptr [ebp+08]
:0043E991 81E2FF000000            and edx, 000000FF
:0043E997 81FAFF000000            cmp edx, 000000FF
:0043E99D 7421                    je 0043E9C0
:0043E99F 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043E9A2 81E1FF000000            and ecx, 000000FF
:0043E9A8 6BC924                  imul ecx, 00000024
:0043E9AB 81C1502C4B00            add ecx, 004B2C50
:0043E9B1 E87A71FEFF              call 00425B30
:0043E9B6 25FF000000              and eax, 000000FF
:0043E9BB 8945C8                  mov dword ptr [ebp-38], eax
:0043E9BE EB07                    jmp 0043E9C7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E99D(C)
|
:0043E9C0 C745C800000000          mov [ebp-38], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E9BE(U)
|
:0043E9C7 8A45C8                  mov al, byte ptr [ebp-38]
:0043E9CA 8845F8                  mov byte ptr [ebp-08], al
:0043E9CD 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043E9D0 81E1FF000000            and ecx, 000000FF
:0043E9D6 8B5510                  mov edx, dword ptr [ebp+10]
:0043E9D9 81E2FF000000            and edx, 000000FF
:0043E9DF 3BCA                    cmp ecx, edx
:0043E9E1 7E06                    jle 0043E9E9
:0043E9E3 C645F42F                mov [ebp-0C], 2F
:0043E9E7 EB1F                    jmp 0043EA08

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E9E1(C)
|
:0043E9E9 8B45F8                  mov eax, dword ptr [ebp-08]
:0043E9EC 25FF000000              and eax, 000000FF
:0043E9F1 8B4D10                  mov ecx, dword ptr [ebp+10]
:0043E9F4 81E1FF000000            and ecx, 000000FF
:0043E9FA 3BC1                    cmp eax, ecx
:0043E9FC 7D06                    jge 0043EA04
:0043E9FE C645F42E                mov [ebp-0C], 2E
:0043EA02 EB04                    jmp 0043EA08

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E9FC(C)
|
:0043EA04 C645F4FF                mov [ebp-0C], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043E9E7(U), :0043EA02(U)
|
:0043EA08 EB71                    jmp 0043EA7B
:0043EA0A 8B5510                  mov edx, dword ptr [ebp+10]
:0043EA0D 81E2FF000000            and edx, 000000FF
:0043EA13 81E280000000            and edx, 00000080
:0043EA19 85D2                    test edx, edx
:0043EA1B 7406                    je 0043EA23
:0043EA1D C645F42C                mov [ebp-0C], 2C
:0043EA21 EB52                    jmp 0043EA75

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043EA1B(C)
|
:0043EA23 C645F4FF                mov [ebp-0C], FF
:0043EA27 8B4510                  mov eax, dword ptr [ebp+10]
:0043EA2A 25FF000000              and eax, 000000FF
:0043EA2F 83E002                  and eax, 00000002
:0043EA32 85C0                    test eax, eax
:0043EA34 7404                    je 0043EA3A
:0043EA36 C645F432                mov [ebp-0C], 32

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043EA34(C)
|
:0043EA3A 8B4D10                  mov ecx, dword ptr [ebp+10]
:0043EA3D 81E1FF000000            and ecx, 000000FF
:0043EA43 83E104                  and ecx, 00000004
:0043EA46 85C9                    test ecx, ecx
:0043EA48 7404                    je 0043EA4E
:0043EA4A C645F433                mov [ebp-0C], 33

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043EA48(C)
|
:0043EA4E 8B5510                  mov edx, dword ptr [ebp+10]
:0043EA51 81E2FF000000            and edx, 000000FF
:0043EA57 83E208                  and edx, 00000008
:0043EA5A 85D2                    test edx, edx
:0043EA5C 7404                    je 0043EA62
:0043EA5E C645F430                mov [ebp-0C], 30

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043EA5C(C)
|
:0043EA62 8B4510                  mov eax, dword ptr [ebp+10]
:0043EA65 25FF000000              and eax, 000000FF
:0043EA6A 83E010                  and eax, 00000010
:0043EA6D 85C0                    test eax, eax
:0043EA6F 7404                    je 0043EA75
:0043EA71 C645F431                mov [ebp-0C], 31

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043EA21(U), :0043EA6F(C)
|
:0043EA75 EB04                    jmp 0043EA7B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043E703(C)
|
:0043EA77 C645F4FF                mov [ebp-0C], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043E78D(U), :0043E80C(U), :0043E88B(U), :0043E90A(U), :0043E989(U)
|:0043EA08(U), :0043EA75(U)
|
:0043EA7B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043EA7E 81E1FF000000            and ecx, 000000FF
:0043EA84 81F9FF000000            cmp ecx, 000000FF
:0043EA8A 7453                    je 0043EADF
:0043EA8C 68004C0400              push 00044C00
:0043EA91 6A04                    push 00000004
:0043EA93 6A00                    push 00000000
:0043EA95 6A00                    push 00000000
:0043EA97 B9C8E44A00              mov ecx, 004AE4C8
:0043EA9C E89F0F0400              call 0047FA40
:0043EAA1 50                      push eax
:0043EAA2 8A55F4                  mov dl, byte ptr [ebp-0C]
:0043EAA5 52                      push edx

* Possible StringData Ref from Data Obj ->"MEFF.E5"
                                  |
:0043EAA6 68F8BB4800              push 0048BBF8
:0043EAAB B9B0174900              mov ecx, 004917B0
:0043EAB0 E8432AFCFF              call 004014F8
:0043EAB5 8A4508                  mov al, byte ptr [ebp+08]
:0043EAB8 50                      push eax
:0043EAB9 B9B0174900              mov ecx, 004917B0
:0043EABE E87933FCFF              call 00401E3C
:0043EAC3 85C0                    test eax, eax
:0043EAC5 740E                    je 0043EAD5
:0043EAC7 6A01                    push 00000001
:0043EAC9 6A00                    push 00000000
:0043EACB B9B0174900              mov ecx, 004917B0
:0043EAD0 E88733FCFF              call 00401E5C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043EAC5(C)
|
:0043EAD5 B9B0174900              mov ecx, 004917B0
:0043EADA E8CC2BFCFF              call 004016AB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043EA8A(C)
|
:0043EADF 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043EAE2 81E1FF000000            and ecx, 000000FF
:0043EAE8 6BC924                  imul ecx, 00000024
:0043EAEB 81C1502C4B00            add ecx, 004B2C50
:0043EAF1 E87A0B0200              call 0045F670
:0043EAF6 50                      push eax
:0043EAF7 E805AF0300              call 00479A01
:0043EAFC 83C404                  add esp, 00000004
:0043EAFF 8BE5                    mov esp, ebp
:0043EB01 5D                      pop ebp
:0043EB02 C3                      ret



:0043EB03 13E74300                DWORD 0043E713
:0043EB07 92E74300                DWORD 0043E792
:0043EB0B 11E84300                DWORD 0043E811
:0043EB0F 90E84300                DWORD 0043E890
:0043EB13 0FE94300                DWORD 0043E90F
:0043EB17 8EE94300                DWORD 0043E98E
:0043EB1B 0AEA4300                DWORD 0043EA0A



* Referenced by a CALL at Addresses:
|:004042CD   , :004044C4   , :00404793   , :00404893   , :004049C6   
|:00404D47   , :00404E3E   , :004050A2   , :004052D6   , :00405409   
|:004056A7   , :004056C8   , :00422AD0   , :00424E03   , :004424B7   
|:00442598   , :004425CF   , :0045262D   , :00458AC6   , :00458B91   
|
:0043EB1F 55                      push ebp
:0043EB20 8BEC                    mov ebp, esp
:0043EB22 81EC08090000            sub esp, 00000908
:0043EB28 8B4510                  mov eax, dword ptr [ebp+10]
:0043EB2B 50                      push eax
:0043EB2C E841FAFFFF              call 0043E572
:0043EB31 83C404                  add esp, 00000004
:0043EB34 8985F8F6FFFF            mov dword ptr [ebp+FFFFF6F8], eax
:0043EB3A 8B4D10                  mov ecx, dword ptr [ebp+10]
:0043EB3D 6BC924                  imul ecx, 00000024
:0043EB40 81C1502C4B00            add ecx, 004B2C50
:0043EB46 894DFC                  mov dword ptr [ebp-04], ecx
:0043EB49 6800090000              push 00000900
:0043EB4E 8D95FCF6FFFF            lea edx, dword ptr [ebp+FFFFF6FC]
:0043EB54 52                      push edx
:0043EB55 8B85F8F6FFFF            mov eax, dword ptr [ebp+FFFFF6F8]
:0043EB5B 50                      push eax
:0043EB5C E89C110400              call 0047FCFD
:0043EB61 83C40C                  add esp, 0000000C
:0043EB64 6A02                    push 00000002
:0043EB66 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043EB69 E8826FFEFF              call 00425AF0
:0043EB6E 85C0                    test eax, eax
:0043EB70 7441                    je 0043EBB3
:0043EB72 6A04                    push 00000004
:0043EB74 8B4D10                  mov ecx, dword ptr [ebp+10]
:0043EB77 6BC924                  imul ecx, 00000024
:0043EB7A 81C1502C4B00            add ecx, 004B2C50
:0043EB80 E86B6FFEFF              call 00425AF0
:0043EB85 85C0                    test eax, eax
:0043EB87 742A                    je 0043EBB3
:0043EB89 8B4D10                  mov ecx, dword ptr [ebp+10]
:0043EB8C 6BC924                  imul ecx, 00000024
:0043EB8F 81C1502C4B00            add ecx, 004B2C50
:0043EB95 E8F6400300              call 00472C90
:0043EB9A 85C0                    test eax, eax
:0043EB9C 7615                    jbe 0043EBB3
:0043EB9E 6A04                    push 00000004
:0043EBA0 6A30                    push 00000030
:0043EBA2 6A30                    push 00000030
:0043EBA4 8D8DFCF6FFFF            lea ecx, dword ptr [ebp+FFFFF6FC]
:0043EBAA 51                      push ecx
:0043EBAB E8D018FFFF              call 00430480
:0043EBB0 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043EB70(C), :0043EB87(C), :0043EB9C(C)
|
:0043EBB3 6A10                    push 00000010
:0043EBB5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043EBB8 E8237BFCFF              call 004066E0
:0043EBBD 85C0                    test eax, eax
:0043EBBF 7439                    je 0043EBFA
:0043EBC1 B9083D4B00              mov ecx, 004B3D08
:0043EBC6 E805D7FDFF              call 0041C2D0
:0043EBCB 25FF000000              and eax, 000000FF
:0043EBD0 99                      cdq
:0043EBD1 33C2                    xor eax, edx
:0043EBD3 2BC2                    sub eax, edx
:0043EBD5 83E003                  and eax, 00000003
:0043EBD8 33C2                    xor eax, edx
:0043EBDA 2BC2                    sub eax, edx
:0043EBDC 83F802                  cmp eax, 00000002
:0043EBDF 7C19                    jl 0043EBFA
:0043EBE1 6A04                    push 00000004
:0043EBE3 6A08                    push 00000008
:0043EBE5 6A04                    push 00000004
:0043EBE7 6A30                    push 00000030
:0043EBE9 6A30                    push 00000030
:0043EBEB 8D95FCF6FFFF            lea edx, dword ptr [ebp+FFFFF6FC]
:0043EBF1 52                      push edx
:0043EBF2 E84719FFFF              call 0043053E
:0043EBF7 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043EBBF(C), :0043EBDF(C)
|
:0043EBFA 8D85FCF6FFFF            lea eax, dword ptr [ebp+FFFFF6FC]
:0043EC00 50                      push eax
:0043EC01 8A4D10                  mov cl, byte ptr [ebp+10]
:0043EC04 51                      push ecx
:0043EC05 6A30                    push 00000030
:0043EC07 6A30                    push 00000030
:0043EC09 8B550C                  mov edx, dword ptr [ebp+0C]
:0043EC0C 52                      push edx
:0043EC0D 8B4508                  mov eax, dword ptr [ebp+08]
:0043EC10 50                      push eax
:0043EC11 E866270100              call 0045137C
:0043EC16 83C418                  add esp, 00000018
:0043EC19 6A08                    push 00000008
:0043EC1B 8B4D10                  mov ecx, dword ptr [ebp+10]
:0043EC1E 6BC924                  imul ecx, 00000024
:0043EC21 81C1502C4B00            add ecx, 004B2C50
:0043EC27 E8B47AFCFF              call 004066E0
:0043EC2C 85C0                    test eax, eax
:0043EC2E 0F84B6000000            je 0043ECEA
:0043EC34 6A04                    push 00000004
:0043EC36 8B4D10                  mov ecx, dword ptr [ebp+10]
:0043EC39 6BC924                  imul ecx, 00000024
:0043EC3C 81C1502C4B00            add ecx, 004B2C50
:0043EC42 E8997AFCFF              call 004066E0
:0043EC47 85C0                    test eax, eax
:0043EC49 0F849B000000            je 0043ECEA
:0043EC4F 6A02                    push 00000002
:0043EC51 8B4D10                  mov ecx, dword ptr [ebp+10]
:0043EC54 6BC924                  imul ecx, 00000024
:0043EC57 81C1502C4B00            add ecx, 004B2C50
:0043EC5D E87E7AFCFF              call 004066E0
:0043EC62 85C0                    test eax, eax
:0043EC64 0F8480000000            je 0043ECEA
:0043EC6A B9083D4B00              mov ecx, 004B3D08
:0043EC6F E85CD6FDFF              call 0041C2D0
:0043EC74 25FF000000              and eax, 000000FF
:0043EC79 99                      cdq
:0043EC7A 33C2                    xor eax, edx
:0043EC7C 2BC2                    sub eax, edx
:0043EC7E 83E001                  and eax, 00000001
:0043EC81 33C2                    xor eax, edx
:0043EC83 2BC2                    sub eax, edx
:0043EC85 85C0                    test eax, eax
:0043EC87 742F                    je 0043ECB8
:0043EC89 6A04                    push 00000004
:0043EC8B 6A04                    push 00000004
:0043EC8D 6A00                    push 00000000
:0043EC8F 68C0A20100              push 0001A2C0
:0043EC94 B950EB4A00              mov ecx, 004AEB50
:0043EC99 E8A20D0400              call 0047FA40
:0043EC9E 50                      push eax
:0043EC9F 6A10                    push 00000010
:0043ECA1 6A10                    push 00000010
:0043ECA3 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0043ECA6 51                      push ecx
:0043ECA7 8B5508                  mov edx, dword ptr [ebp+08]
:0043ECAA 83C204                  add edx, 00000004
:0043ECAD 52                      push edx
:0043ECAE E8602C0100              call 00451913
:0043ECB3 83C418                  add esp, 00000018
:0043ECB6 EB2D                    jmp 0043ECE5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043EC87(C)
|
:0043ECB8 6A04                    push 00000004
:0043ECBA 6A04                    push 00000004
:0043ECBC 6A00                    push 00000000
:0043ECBE 68C0A40100              push 0001A4C0
:0043ECC3 B950EB4A00              mov ecx, 004AEB50
:0043ECC8 E8730D0400              call 0047FA40
:0043ECCD 50                      push eax
:0043ECCE 6A10                    push 00000010
:0043ECD0 6A10                    push 00000010
:0043ECD2 8B450C                  mov eax, dword ptr [ebp+0C]
:0043ECD5 50                      push eax
:0043ECD6 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043ECD9 83C11C                  add ecx, 0000001C
:0043ECDC 51                      push ecx
:0043ECDD E8312C0100              call 00451913
:0043ECE2 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043ECB6(U)
|
:0043ECE5 E952030000              jmp 0043F03C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043EC2E(C), :0043EC49(C), :0043EC64(C)
|
:0043ECEA 6A08                    push 00000008
:0043ECEC 8B4D10                  mov ecx, dword ptr [ebp+10]
:0043ECEF 6BC924                  imul ecx, 00000024
:0043ECF2 81C1502C4B00            add ecx, 004B2C50
:0043ECF8 E8E379FCFF              call 004066E0
:0043ECFD 85C0                    test eax, eax
:0043ECFF 0F849B000000            je 0043EDA0
:0043ED05 6A02                    push 00000002
:0043ED07 8B4D10                  mov ecx, dword ptr [ebp+10]
:0043ED0A 6BC924                  imul ecx, 00000024
:0043ED0D 81C1502C4B00            add ecx, 004B2C50
:0043ED13 E8C879FCFF              call 004066E0
:0043ED18 85C0                    test eax, eax
:0043ED1A 0F8480000000            je 0043EDA0
:0043ED20 B9083D4B00              mov ecx, 004B3D08
:0043ED25 E8A6D5FDFF              call 0041C2D0
:0043ED2A 25FF000000              and eax, 000000FF
:0043ED2F 99                      cdq
:0043ED30 33C2                    xor eax, edx
:0043ED32 2BC2                    sub eax, edx
:0043ED34 83E001                  and eax, 00000001
:0043ED37 33C2                    xor eax, edx
:0043ED39 2BC2                    sub eax, edx
:0043ED3B 85C0                    test eax, eax
:0043ED3D 742F                    je 0043ED6E
:0043ED3F 6A04                    push 00000004
:0043ED41 6A04                    push 00000004
:0043ED43 6A00                    push 00000000
:0043ED45 68C0A20100              push 0001A2C0
:0043ED4A B950EB4A00              mov ecx, 004AEB50
:0043ED4F E8EC0C0400              call 0047FA40
:0043ED54 50                      push eax
:0043ED55 6A10                    push 00000010
:0043ED57 6A10                    push 00000010
:0043ED59 8B550C                  mov edx, dword ptr [ebp+0C]
:0043ED5C 52                      push edx
:0043ED5D 8B4508                  mov eax, dword ptr [ebp+08]
:0043ED60 83C004                  add eax, 00000004
:0043ED63 50                      push eax
:0043ED64 E8AA2B0100              call 00451913
:0043ED69 83C418                  add esp, 00000018
:0043ED6C EB2D                    jmp 0043ED9B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043ED3D(C)
|
:0043ED6E 6A04                    push 00000004
:0043ED70 6A04                    push 00000004
:0043ED72 6A00                    push 00000000
:0043ED74 68C0A40100              push 0001A4C0
:0043ED79 B950EB4A00              mov ecx, 004AEB50
:0043ED7E E8BD0C0400              call 0047FA40
:0043ED83 50                      push eax
:0043ED84 6A10                    push 00000010
:0043ED86 6A10                    push 00000010
:0043ED88 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0043ED8B 51                      push ecx
:0043ED8C 8B5508                  mov edx, dword ptr [ebp+08]
:0043ED8F 83C21C                  add edx, 0000001C
:0043ED92 52                      push edx
:0043ED93 E87B2B0100              call 00451913
:0043ED98 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043ED6C(U)
|
:0043ED9B E99C020000              jmp 0043F03C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043ECFF(C), :0043ED1A(C)
|
:0043EDA0 6A08                    push 00000008
:0043EDA2 8B4D10                  mov ecx, dword ptr [ebp+10]
:0043EDA5 6BC924                  imul ecx, 00000024
:0043EDA8 81C1502C4B00            add ecx, 004B2C50
:0043EDAE E82D79FCFF              call 004066E0
:0043EDB3 85C0                    test eax, eax
:0043EDB5 0F849B000000            je 0043EE56
:0043EDBB 6A04                    push 00000004
:0043EDBD 8B4D10                  mov ecx, dword ptr [ebp+10]
:0043EDC0 6BC924                  imul ecx, 00000024
:0043EDC3 81C1502C4B00            add ecx, 004B2C50
:0043EDC9 E81279FCFF              call 004066E0
:0043EDCE 85C0                    test eax, eax
:0043EDD0 0F8480000000            je 0043EE56
:0043EDD6 B9083D4B00              mov ecx, 004B3D08
:0043EDDB E8F0D4FDFF              call 0041C2D0
:0043EDE0 25FF000000              and eax, 000000FF
:0043EDE5 99                      cdq
:0043EDE6 33C2                    xor eax, edx
:0043EDE8 2BC2                    sub eax, edx
:0043EDEA 83E001                  and eax, 00000001
:0043EDED 33C2                    xor eax, edx
:0043EDEF 2BC2                    sub eax, edx
:0043EDF1 85C0                    test eax, eax
:0043EDF3 742F                    je 0043EE24
:0043EDF5 6A04                    push 00000004
:0043EDF7 6A04                    push 00000004
:0043EDF9 6A00                    push 00000000
:0043EDFB 68C0A20100              push 0001A2C0
:0043EE00 B950EB4A00              mov ecx, 004AEB50
:0043EE05 E8360C0400              call 0047FA40
:0043EE0A 50                      push eax
:0043EE0B 6A10                    push 00000010
:0043EE0D 6A10                    push 00000010
:0043EE0F 8B450C                  mov eax, dword ptr [ebp+0C]
:0043EE12 50                      push eax
:0043EE13 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043EE16 83C104                  add ecx, 00000004
:0043EE19 51                      push ecx
:0043EE1A E8F42A0100              call 00451913
:0043EE1F 83C418                  add esp, 00000018
:0043EE22 EB2D                    jmp 0043EE51

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043EDF3(C)
|
:0043EE24 6A04                    push 00000004
:0043EE26 6A04                    push 00000004
:0043EE28 6A00                    push 00000000
:0043EE2A 68C0A30100              push 0001A3C0
:0043EE2F B950EB4A00              mov ecx, 004AEB50
:0043EE34 E8070C0400              call 0047FA40
:0043EE39 50                      push eax
:0043EE3A 6A10                    push 00000010
:0043EE3C 6A10                    push 00000010
:0043EE3E 8B550C                  mov edx, dword ptr [ebp+0C]
:0043EE41 52                      push edx
:0043EE42 8B4508                  mov eax, dword ptr [ebp+08]
:0043EE45 83C01C                  add eax, 0000001C
:0043EE48 50                      push eax
:0043EE49 E8C52A0100              call 00451913
:0043EE4E 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043EE22(U)
|
:0043EE51 E9E6010000              jmp 0043F03C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043EDB5(C), :0043EDD0(C)
|
:0043EE56 6A02                    push 00000002
:0043EE58 8B4D10                  mov ecx, dword ptr [ebp+10]
:0043EE5B 6BC924                  imul ecx, 00000024
:0043EE5E 81C1502C4B00            add ecx, 004B2C50
:0043EE64 E87778FCFF              call 004066E0
:0043EE69 85C0                    test eax, eax
:0043EE6B 0F849B000000            je 0043EF0C
:0043EE71 6A04                    push 00000004
:0043EE73 8B4D10                  mov ecx, dword ptr [ebp+10]
:0043EE76 6BC924                  imul ecx, 00000024
:0043EE79 81C1502C4B00            add ecx, 004B2C50
:0043EE7F E85C78FCFF              call 004066E0
:0043EE84 85C0                    test eax, eax
:0043EE86 0F8480000000            je 0043EF0C
:0043EE8C B9083D4B00              mov ecx, 004B3D08
:0043EE91 E83AD4FDFF              call 0041C2D0
:0043EE96 25FF000000              and eax, 000000FF
:0043EE9B 99                      cdq
:0043EE9C 33C2                    xor eax, edx
:0043EE9E 2BC2                    sub eax, edx
:0043EEA0 83E001                  and eax, 00000001
:0043EEA3 33C2                    xor eax, edx
:0043EEA5 2BC2                    sub eax, edx
:0043EEA7 85C0                    test eax, eax
:0043EEA9 742F                    je 0043EEDA
:0043EEAB 6A04                    push 00000004
:0043EEAD 6A04                    push 00000004
:0043EEAF 6A00                    push 00000000
:0043EEB1 68C0A40100              push 0001A4C0
:0043EEB6 B950EB4A00              mov ecx, 004AEB50
:0043EEBB E8800B0400              call 0047FA40
:0043EEC0 50                      push eax
:0043EEC1 6A10                    push 00000010
:0043EEC3 6A10                    push 00000010
:0043EEC5 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0043EEC8 51                      push ecx
:0043EEC9 8B5508                  mov edx, dword ptr [ebp+08]
:0043EECC 83C204                  add edx, 00000004
:0043EECF 52                      push edx
:0043EED0 E83E2A0100              call 00451913
:0043EED5 83C418                  add esp, 00000018
:0043EED8 EB2D                    jmp 0043EF07

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043EEA9(C)
|
:0043EEDA 6A04                    push 00000004
:0043EEDC 6A04                    push 00000004
:0043EEDE 6A00                    push 00000000
:0043EEE0 68C0A30100              push 0001A3C0
:0043EEE5 B950EB4A00              mov ecx, 004AEB50
:0043EEEA E8510B0400              call 0047FA40
:0043EEEF 50                      push eax
:0043EEF0 6A10                    push 00000010
:0043EEF2 6A10                    push 00000010
:0043EEF4 8B450C                  mov eax, dword ptr [ebp+0C]
:0043EEF7 50                      push eax
:0043EEF8 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043EEFB 83C11C                  add ecx, 0000001C
:0043EEFE 51                      push ecx
:0043EEFF E80F2A0100              call 00451913
:0043EF04 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043EED8(U)
|
:0043EF07 E930010000              jmp 0043F03C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043EE6B(C), :0043EE86(C)
|
:0043EF0C 6A08                    push 00000008
:0043EF0E 8B4D10                  mov ecx, dword ptr [ebp+10]
:0043EF11 6BC924                  imul ecx, 00000024
:0043EF14 81C1502C4B00            add ecx, 004B2C50
:0043EF1A E8C177FCFF              call 004066E0
:0043EF1F 85C0                    test eax, eax
:0043EF21 7451                    je 0043EF74
:0043EF23 6A04                    push 00000004
:0043EF25 6A04                    push 00000004
:0043EF27 6A00                    push 00000000
:0043EF29 68C0A20100              push 0001A2C0
:0043EF2E B950EB4A00              mov ecx, 004AEB50
:0043EF33 E8080B0400              call 0047FA40
:0043EF38 50                      push eax
:0043EF39 6A10                    push 00000010
:0043EF3B 6A10                    push 00000010
:0043EF3D 8B550C                  mov edx, dword ptr [ebp+0C]
:0043EF40 52                      push edx
:0043EF41 B9083D4B00              mov ecx, 004B3D08
:0043EF46 E885D3FDFF              call 0041C2D0
:0043EF4B 25FF000000              and eax, 000000FF
:0043EF50 99                      cdq
:0043EF51 33C2                    xor eax, edx
:0043EF53 2BC2                    sub eax, edx
:0043EF55 83E001                  and eax, 00000001
:0043EF58 33C2                    xor eax, edx
:0043EF5A 2BC2                    sub eax, edx
:0043EF5C 6BC018                  imul eax, 00000018
:0043EF5F 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043EF62 8D540104                lea edx, dword ptr [ecx+eax+04]
:0043EF66 52                      push edx
:0043EF67 E8A7290100              call 00451913
:0043EF6C 83C418                  add esp, 00000018
:0043EF6F E9C8000000              jmp 0043F03C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043EF21(C)
|
:0043EF74 6A02                    push 00000002
:0043EF76 8B4D10                  mov ecx, dword ptr [ebp+10]
:0043EF79 6BC924                  imul ecx, 00000024
:0043EF7C 81C1502C4B00            add ecx, 004B2C50
:0043EF82 E85977FCFF              call 004066E0
:0043EF87 85C0                    test eax, eax
:0043EF89 744E                    je 0043EFD9
:0043EF8B 6A04                    push 00000004
:0043EF8D 6A04                    push 00000004
:0043EF8F 6A00                    push 00000000
:0043EF91 68C0A40100              push 0001A4C0
:0043EF96 B950EB4A00              mov ecx, 004AEB50
:0043EF9B E8A00A0400              call 0047FA40
:0043EFA0 50                      push eax
:0043EFA1 6A10                    push 00000010
:0043EFA3 6A10                    push 00000010
:0043EFA5 8B450C                  mov eax, dword ptr [ebp+0C]
:0043EFA8 50                      push eax
:0043EFA9 B9083D4B00              mov ecx, 004B3D08
:0043EFAE E81DD3FDFF              call 0041C2D0
:0043EFB3 25FF000000              and eax, 000000FF
:0043EFB8 99                      cdq
:0043EFB9 33C2                    xor eax, edx
:0043EFBB 2BC2                    sub eax, edx
:0043EFBD 83E001                  and eax, 00000001
:0043EFC0 33C2                    xor eax, edx
:0043EFC2 2BC2                    sub eax, edx
:0043EFC4 6BC018                  imul eax, 00000018
:0043EFC7 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043EFCA 8D540104                lea edx, dword ptr [ecx+eax+04]
:0043EFCE 52                      push edx
:0043EFCF E83F290100              call 00451913
:0043EFD4 83C418                  add esp, 00000018
:0043EFD7 EB63                    jmp 0043F03C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043EF89(C)
|
:0043EFD9 6A04                    push 00000004
:0043EFDB 8B4D10                  mov ecx, dword ptr [ebp+10]
:0043EFDE 6BC924                  imul ecx, 00000024
:0043EFE1 81C1502C4B00            add ecx, 004B2C50
:0043EFE7 E8F476FCFF              call 004066E0
:0043EFEC 85C0                    test eax, eax
:0043EFEE 744C                    je 0043F03C
:0043EFF0 6A04                    push 00000004
:0043EFF2 6A04                    push 00000004
:0043EFF4 6A00                    push 00000000
:0043EFF6 68C0A30100              push 0001A3C0
:0043EFFB B950EB4A00              mov ecx, 004AEB50
:0043F000 E83B0A0400              call 0047FA40
:0043F005 50                      push eax
:0043F006 6A10                    push 00000010
:0043F008 6A10                    push 00000010
:0043F00A 8B450C                  mov eax, dword ptr [ebp+0C]
:0043F00D 50                      push eax
:0043F00E B9083D4B00              mov ecx, 004B3D08
:0043F013 E8B8D2FDFF              call 0041C2D0
:0043F018 25FF000000              and eax, 000000FF
:0043F01D 99                      cdq
:0043F01E 33C2                    xor eax, edx
:0043F020 2BC2                    sub eax, edx
:0043F022 83E001                  and eax, 00000001
:0043F025 33C2                    xor eax, edx
:0043F027 2BC2                    sub eax, edx
:0043F029 6BC018                  imul eax, 00000018
:0043F02C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043F02F 8D540104                lea edx, dword ptr [ecx+eax+04]
:0043F033 52                      push edx
:0043F034 E8DA280100              call 00451913
:0043F039 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043ECE5(U), :0043ED9B(U), :0043EE51(U), :0043EF07(U), :0043EF6F(U)
|:0043EFD7(U), :0043EFEE(C)
|
:0043F03C 8BE5                    mov esp, ebp
:0043F03E 5D                      pop ebp
:0043F03F C3                      ret



* Referenced by a CALL at Addresses:
|:00442B6E   , :004595A5   
|
:0043F040 55                      push ebp
:0043F041 8BEC                    mov ebp, esp
:0043F043 83EC2C                  sub esp, 0000002C
:0043F046 68FF000000              push 000000FF
:0043F04B 68FF000000              push 000000FF
:0043F050 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:0043F053 E8789CFDFF              call 00418CD0
:0043F058 668B450C                mov ax, word ptr [ebp+0C]
:0043F05C 668945F8                mov word ptr [ebp-08], ax
:0043F060 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0043F063 E8A8060200              call 0045F710
:0043F068 C645F000                mov [ebp-10], 00
:0043F06C EB09                    jmp 0043F077

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043F0B1(U), :0043F1E7(U)
|
:0043F06E 8A4DF0                  mov cl, byte ptr [ebp-10]
:0043F071 80C101                  add cl, 01
:0043F074 884DF0                  mov byte ptr [ebp-10], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F06C(U)
|
:0043F077 8B55F0                  mov edx, dword ptr [ebp-10]
:0043F07A 81E2FF000000            and edx, 000000FF
:0043F080 83FA04                  cmp edx, 00000004
:0043F083 0F8D63010000            jnl 0043F1EC
:0043F089 8B45F8                  mov eax, dword ptr [ebp-08]
:0043F08C 25FF000000              and eax, 000000FF
:0043F091 3DFF000000              cmp eax, 000000FF
:0043F096 751B                    jne 0043F0B3
:0043F098 8A4DF0                  mov cl, byte ptr [ebp-10]
:0043F09B 51                      push ecx
:0043F09C 8D55F8                  lea edx, dword ptr [ebp-08]
:0043F09F 52                      push edx
:0043F0A0 E85069FFFF              call 004359F5
:0043F0A5 83C408                  add esp, 00000008
:0043F0A8 50                      push eax
:0043F0A9 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0043F0AC E8EF74FCFF              call 004065A0
:0043F0B1 EBBB                    jmp 0043F06E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F096(C)
|
:0043F0B3 8D45F8                  lea eax, dword ptr [ebp-08]
:0043F0B6 50                      push eax
:0043F0B7 E8C867FFFF              call 00435884
:0043F0BC 83C404                  add esp, 00000004
:0043F0BF 25FF000000              and eax, 000000FF
:0043F0C4 3DFF000000              cmp eax, 000000FF
:0043F0C9 7546                    jne 0043F111
:0043F0CB 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0043F0CE 51                      push ecx
:0043F0CF E8BD68FFFF              call 00435991
:0043F0D4 83C404                  add esp, 00000004
:0043F0D7 25FF000000              and eax, 000000FF
:0043F0DC 50                      push eax
:0043F0DD 8B4D10                  mov ecx, dword ptr [ebp+10]
:0043F0E0 81E1FF000000            and ecx, 000000FF
:0043F0E6 6BC93C                  imul ecx, 0000003C
:0043F0E9 81C1E0E44A00            add ecx, 004AE4E0
:0043F0EF E87C3F0000              call 00443070
:0043F0F4 25FF000000              and eax, 000000FF
:0043F0F9 3DFF000000              cmp eax, 000000FF
:0043F0FE 7411                    je 0043F111
:0043F100 8D55F8                  lea edx, dword ptr [ebp-08]
:0043F103 52                      push edx
:0043F104 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:0043F107 E89474FCFF              call 004065A0
:0043F10C E9DB000000              jmp 0043F1EC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043F0C9(C), :0043F0FE(C)
|
:0043F111 C645EC00                mov [ebp-14], 00
:0043F115 EB08                    jmp 0043F11F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F1B6(U)
|
:0043F117 8A45EC                  mov al, byte ptr [ebp-14]
:0043F11A 0401                    add al, 01
:0043F11C 8845EC                  mov byte ptr [ebp-14], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F115(U)
|
:0043F11F 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0043F122 81E1FF000000            and ecx, 000000FF
:0043F128 83F904                  cmp ecx, 00000004
:0043F12B 0F8D8A000000            jnl 0043F1BB
:0043F131 8A55EC                  mov dl, byte ptr [ebp-14]
:0043F134 52                      push edx
:0043F135 8D45F8                  lea eax, dword ptr [ebp-08]
:0043F138 50                      push eax
:0043F139 E8B768FFFF              call 004359F5
:0043F13E 83C408                  add esp, 00000008
:0043F141 50                      push eax
:0043F142 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0043F145 E85674FCFF              call 004065A0
:0043F14A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043F14D 81E1FF000000            and ecx, 000000FF
:0043F153 81F9FF000000            cmp ecx, 000000FF
:0043F159 745B                    je 0043F1B6
:0043F15B 8D55FC                  lea edx, dword ptr [ebp-04]
:0043F15E 52                      push edx
:0043F15F E82067FFFF              call 00435884
:0043F164 83C404                  add esp, 00000004
:0043F167 25FF000000              and eax, 000000FF
:0043F16C 3DFF000000              cmp eax, 000000FF
:0043F171 7543                    jne 0043F1B6
:0043F173 8D45FC                  lea eax, dword ptr [ebp-04]
:0043F176 50                      push eax
:0043F177 E81568FFFF              call 00435991
:0043F17C 83C404                  add esp, 00000004
:0043F17F 25FF000000              and eax, 000000FF
:0043F184 50                      push eax
:0043F185 8B4D10                  mov ecx, dword ptr [ebp+10]
:0043F188 81E1FF000000            and ecx, 000000FF
:0043F18E 6BC93C                  imul ecx, 0000003C
:0043F191 81C1E0E44A00            add ecx, 004AE4E0
:0043F197 E8D43E0000              call 00443070
:0043F19C 25FF000000              and eax, 000000FF
:0043F1A1 3DFF000000              cmp eax, 000000FF
:0043F1A6 740E                    je 0043F1B6
:0043F1A8 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0043F1AB 51                      push ecx
:0043F1AC 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:0043F1AF E8EC73FCFF              call 004065A0
:0043F1B4 EB05                    jmp 0043F1BB

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043F159(C), :0043F171(C), :0043F1A6(C)
|
:0043F1B6 E95CFFFFFF              jmp 0043F117

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043F12B(C), :0043F1B4(U)
|
:0043F1BB 8B55F4                  mov edx, dword ptr [ebp-0C]
:0043F1BE 81E2FF000000            and edx, 000000FF
:0043F1C4 81FAFF000000            cmp edx, 000000FF
:0043F1CA 7402                    je 0043F1CE
:0043F1CC EB1E                    jmp 0043F1EC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F1CA(C)
|
:0043F1CE 8A45F0                  mov al, byte ptr [ebp-10]
:0043F1D1 50                      push eax
:0043F1D2 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0043F1D5 51                      push ecx
:0043F1D6 E81A68FFFF              call 004359F5
:0043F1DB 83C408                  add esp, 00000008
:0043F1DE 50                      push eax
:0043F1DF 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0043F1E2 E8B973FCFF              call 004065A0
:0043F1E7 E982FEFFFF              jmp 0043F06E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043F083(C), :0043F10C(U), :0043F1CC(U)
|
:0043F1EC 8B55F4                  mov edx, dword ptr [ebp-0C]
:0043F1EF 81E2FF000000            and edx, 000000FF
:0043F1F5 81FAFF000000            cmp edx, 000000FF
:0043F1FB 0F8579010000            jne 0043F37A
:0043F201 C745E4FFFF0000          mov [ebp-1C], 0000FFFF
:0043F208 C645E000                mov [ebp-20], 00
:0043F20C EB08                    jmp 0043F216

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F375(U)
|
:0043F20E 8A45E0                  mov al, byte ptr [ebp-20]
:0043F211 0401                    add al, 01
:0043F213 8845E0                  mov byte ptr [ebp-20], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F20C(U)
|
:0043F216 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0043F219 81E1FF000000            and ecx, 000000FF
:0043F21F 33D2                    xor edx, edx
:0043F221 8A152D424B00            mov dl, byte ptr [004B422D]
:0043F227 3BCA                    cmp ecx, edx
:0043F229 0F8D4B010000            jnl 0043F37A
:0043F22F 8A45E0                  mov al, byte ptr [ebp-20]
:0043F232 8845F9                  mov byte ptr [ebp-07], al
:0043F235 C645DC00                mov [ebp-24], 00
:0043F239 EB09                    jmp 0043F244

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F370(U)
|
:0043F23B 8A4DDC                  mov cl, byte ptr [ebp-24]
:0043F23E 80C101                  add cl, 01
:0043F241 884DDC                  mov byte ptr [ebp-24], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F239(U)
|
:0043F244 8B55DC                  mov edx, dword ptr [ebp-24]
:0043F247 81E2FF000000            and edx, 000000FF
:0043F24D 33C0                    xor eax, eax
:0043F24F A02C424B00              mov al, byte ptr [004B422C]
:0043F254 3BD0                    cmp edx, eax
:0043F256 0F8D19010000            jnl 0043F375
:0043F25C 8A4DDC                  mov cl, byte ptr [ebp-24]
:0043F25F 884DF8                  mov byte ptr [ebp-08], cl
:0043F262 8D55F8                  lea edx, dword ptr [ebp-08]
:0043F265 52                      push edx
:0043F266 E81966FFFF              call 00435884
:0043F26B 83C404                  add esp, 00000004
:0043F26E 25FF000000              and eax, 000000FF
:0043F273 3DFF000000              cmp eax, 000000FF
:0043F278 0F85F2000000            jne 0043F370
:0043F27E 8D45F8                  lea eax, dword ptr [ebp-08]
:0043F281 50                      push eax
:0043F282 E80A67FFFF              call 00435991
:0043F287 83C404                  add esp, 00000004
:0043F28A 25FF000000              and eax, 000000FF
:0043F28F 50                      push eax
:0043F290 8B4D10                  mov ecx, dword ptr [ebp+10]
:0043F293 81E1FF000000            and ecx, 000000FF
:0043F299 6BC93C                  imul ecx, 0000003C
:0043F29C 81C1E0E44A00            add ecx, 004AE4E0
:0043F2A2 E8C93D0000              call 00443070
:0043F2A7 25FF000000              and eax, 000000FF
:0043F2AC 3DFF000000              cmp eax, 000000FF
:0043F2B1 0F84B9000000            je 0043F370
:0043F2B7 8B4D0D                  mov ecx, dword ptr [ebp+0D]
:0043F2BA 81E1FF000000            and ecx, 000000FF
:0043F2C0 8B55E0                  mov edx, dword ptr [ebp-20]
:0043F2C3 81E2FF000000            and edx, 000000FF
:0043F2C9 2BCA                    sub ecx, edx
:0043F2CB 85C9                    test ecx, ecx
:0043F2CD 7C18                    jl 0043F2E7
:0043F2CF 8B450D                  mov eax, dword ptr [ebp+0D]
:0043F2D2 25FF000000              and eax, 000000FF
:0043F2D7 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0043F2DA 81E1FF000000            and ecx, 000000FF
:0043F2E0 2BC1                    sub eax, ecx
:0043F2E2 8945D8                  mov dword ptr [ebp-28], eax
:0043F2E5 EB18                    jmp 0043F2FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F2CD(C)
|
:0043F2E7 8B550D                  mov edx, dword ptr [ebp+0D]
:0043F2EA 81E2FF000000            and edx, 000000FF
:0043F2F0 8B45E0                  mov eax, dword ptr [ebp-20]
:0043F2F3 25FF000000              and eax, 000000FF
:0043F2F8 2BD0                    sub edx, eax
:0043F2FA F7DA                    neg edx
:0043F2FC 8955D8                  mov dword ptr [ebp-28], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F2E5(U)
|
:0043F2FF 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0043F302 894DE8                  mov dword ptr [ebp-18], ecx
:0043F305 8B550C                  mov edx, dword ptr [ebp+0C]
:0043F308 81E2FF000000            and edx, 000000FF
:0043F30E 8B45DC                  mov eax, dword ptr [ebp-24]
:0043F311 25FF000000              and eax, 000000FF
:0043F316 2BD0                    sub edx, eax
:0043F318 85D2                    test edx, edx
:0043F31A 7C19                    jl 0043F335
:0043F31C 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0043F31F 81E1FF000000            and ecx, 000000FF
:0043F325 8B55DC                  mov edx, dword ptr [ebp-24]
:0043F328 81E2FF000000            and edx, 000000FF
:0043F32E 2BCA                    sub ecx, edx
:0043F330 894DD4                  mov dword ptr [ebp-2C], ecx
:0043F333 EB18                    jmp 0043F34D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F31A(C)
|
:0043F335 8B450C                  mov eax, dword ptr [ebp+0C]
:0043F338 25FF000000              and eax, 000000FF
:0043F33D 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0043F340 81E1FF000000            and ecx, 000000FF
:0043F346 2BC1                    sub eax, ecx
:0043F348 F7D8                    neg eax
:0043F34A 8945D4                  mov dword ptr [ebp-2C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F333(U)
|
:0043F34D 8B55E8                  mov edx, dword ptr [ebp-18]
:0043F350 0355D4                  add edx, dword ptr [ebp-2C]
:0043F353 8955E8                  mov dword ptr [ebp-18], edx
:0043F356 8B45E8                  mov eax, dword ptr [ebp-18]
:0043F359 3B45E4                  cmp eax, dword ptr [ebp-1C]
:0043F35C 7312                    jnb 0043F370
:0043F35E 8A4DDC                  mov cl, byte ptr [ebp-24]
:0043F361 884DF4                  mov byte ptr [ebp-0C], cl
:0043F364 8A55E0                  mov dl, byte ptr [ebp-20]
:0043F367 8855F5                  mov byte ptr [ebp-0B], dl
:0043F36A 8B45E8                  mov eax, dword ptr [ebp-18]
:0043F36D 8945E4                  mov dword ptr [ebp-1C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043F278(C), :0043F2B1(C), :0043F35C(C)
|
:0043F370 E9C6FEFFFF              jmp 0043F23B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F256(C)
|
:0043F375 E994FEFFFF              jmp 0043F20E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043F1FB(C), :0043F229(C)
|
:0043F37A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043F37D 668B55F4                mov dx, word ptr [ebp-0C]
:0043F381 668911                  mov word ptr [ecx], dx
:0043F384 8B4508                  mov eax, dword ptr [ebp+08]
:0043F387 8BE5                    mov esp, ebp
:0043F389 5D                      pop ebp
:0043F38A C3                      ret



* Referenced by a CALL at Addresses:
|:0043F4F2   , :004425F4   
|
:0043F38B 55                      push ebp
:0043F38C 8BEC                    mov ebp, esp
:0043F38E 83EC10                  sub esp, 00000010
:0043F391 8B4508                  mov eax, dword ptr [ebp+08]
:0043F394 25FF000000              and eax, 000000FF
:0043F399 83F814                  cmp eax, 00000014
:0043F39C 7505                    jne 0043F3A3
:0043F39E E9D5000000              jmp 0043F478

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F39C(C)
|
:0043F3A3 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0043F3A6 81E1FF000000            and ecx, 000000FF
:0043F3AC 81F9FF000000            cmp ecx, 000000FF
:0043F3B2 7517                    jne 0043F3CB
:0043F3B4 8B550D                  mov edx, dword ptr [ebp+0D]
:0043F3B7 81E2FF000000            and edx, 000000FF
:0043F3BD 81FAFF000000            cmp edx, 000000FF
:0043F3C3 7506                    jne 0043F3CB
:0043F3C5 C645FC1E                mov [ebp-04], 1E
:0043F3C9 EB0F                    jmp 0043F3DA

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043F3B2(C), :0043F3C3(C)
|
:0043F3CB 8D450C                  lea eax, dword ptr [ebp+0C]
:0043F3CE 50                      push eax
:0043F3CF E8BD65FFFF              call 00435991
:0043F3D4 83C404                  add esp, 00000004
:0043F3D7 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F3C9(U)
|
:0043F3DA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043F3DD 81E1FF000000            and ecx, 000000FF
:0043F3E3 894DF4                  mov dword ptr [ebp-0C], ecx
:0043F3E6 8B55F4                  mov edx, dword ptr [ebp-0C]
:0043F3E9 83EA02                  sub edx, 00000002
:0043F3EC 8955F4                  mov dword ptr [ebp-0C], edx
:0043F3EF 837DF40B                cmp dword ptr [ebp-0C], 0000000B
:0043F3F3 7736                    ja 0043F42B
:0043F3F5 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043F3F8 33C0                    xor eax, eax
:0043F3FA 8A8194F44300            mov al, byte ptr [ecx+0043F494]
:0043F400 FF24857CF44300          jmp dword ptr [4*eax+0043F47C]
:0043F407 C745F81B000000          mov [ebp-08], 0000001B
:0043F40E EB58                    jmp 0043F468
:0043F410 C745F81C000000          mov [ebp-08], 0000001C
:0043F417 EB4F                    jmp 0043F468
:0043F419 C745F81D000000          mov [ebp-08], 0000001D
:0043F420 EB46                    jmp 0043F468
:0043F422 C745F81A000000          mov [ebp-08], 0000001A
:0043F429 EB3D                    jmp 0043F468

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F3F3(C)
|
:0043F42B 8B5508                  mov edx, dword ptr [ebp+08]
:0043F42E 81E2FF000000            and edx, 000000FF
:0043F434 8955F0                  mov dword ptr [ebp-10], edx
:0043F437 837DF016                cmp dword ptr [ebp-10], 00000016
:0043F43B 7724                    ja 0043F461
:0043F43D 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043F440 33C0                    xor eax, eax
:0043F442 8A81BCF44300            mov al, byte ptr [ecx+0043F4BC]
:0043F448 FF2485A0F44300          jmp dword ptr [4*eax+0043F4A0]
:0043F44F C745F818000000          mov [ebp-08], 00000018
:0043F456 EB10                    jmp 0043F468
:0043F458 C745F819000000          mov [ebp-08], 00000019
:0043F45F EB07                    jmp 0043F468

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F43B(C)
|
:0043F461 C745F817000000          mov [ebp-08], 00000017

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043F40E(U), :0043F417(U), :0043F420(U), :0043F429(U), :0043F456(U)
|:0043F45F(U)
|
:0043F468 6A00                    push 00000000
:0043F46A 8B55F8                  mov edx, dword ptr [ebp-08]
:0043F46D 52                      push edx
:0043F46E B9B0694B00              mov ecx, 004B69B0
:0043F473 E802520300              call 0047467A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F39E(U)
|
:0043F478 8BE5                    mov esp, ebp
:0043F47A 5D                      pop ebp
:0043F47B C3                      ret



:0043F47C 07F44300                DWORD 0043F407
:0043F480 22F44300                DWORD 0043F422
:0043F484 19F44300                DWORD 0043F419
:0043F488 10F44300                DWORD 0043F410
:0043F48C 19F44300                DWORD 0043F419
:0043F490 2BF44300                DWORD 0043F42B


:0043F494 000505050501            add byte ptr [01050505], al
:0043F49A 0502030505              add eax, 05050302
:0043F49F 044F                    add al, 4F
:0043F4A1 F4                      hlt
:0043F4A2 43                      inc ebx
:0043F4A3 004FF4                  add byte ptr [edi-0C], cl
:0043F4A6 43                      inc ebx
:0043F4A7 0058F4                  add byte ptr [eax-0C], bl
:0043F4AA 43                      inc ebx
:0043F4AB 004FF4                  add byte ptr [edi-0C], cl
:0043F4AE 43                      inc ebx
:0043F4AF 004FF4                  add byte ptr [edi-0C], cl
:0043F4B2 43                      inc ebx
:0043F4B3 0058F4                  add byte ptr [eax-0C], bl
:0043F4B6 43                      inc ebx
:0043F4B7 0061F4                  add byte ptr [ecx-0C], ah
:0043F4BA 43                      inc ebx
:0043F4BB 0006                    add byte ptr [esi], al
:0043F4BD 0101                    add dword ptr [ecx], eax
:0043F4BF 06                      push es
:0043F4C0 06                      push es
:0043F4C1 0201                    add al, byte ptr [ecx]
:0043F4C3 0101                    add dword ptr [ecx], eax
:0043F4C5 0101                    add dword ptr [ecx], eax
:0043F4C7 0201                    add al, byte ptr [ecx]
:0043F4C9 06                      push es
:0043F4CA 06                      push es
:0043F4CB 0101                    add dword ptr [ecx], eax
:0043F4CD 0101                    add dword ptr [ecx], eax
:0043F4CF 0106                    add dword ptr [esi], eax
:0043F4D1 05                      BYTE 05h
:0043F4D2 05                      BYTE 05h


* Referenced by a CALL at Addresses:
|:004449C8   , :00444B27   
|
:0043F4D3 55                      push ebp
:0043F4D4 8BEC                    mov ebp, esp
:0043F4D6 51                      push ecx
:0043F4D7 68FF000000              push 000000FF
:0043F4DC 68FF000000              push 000000FF
:0043F4E1 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0043F4E4 E8E797FDFF              call 00418CD0
:0043F4E9 668B45FC                mov ax, word ptr [ebp-04]
:0043F4ED 50                      push eax
:0043F4EE 8A4D08                  mov cl, byte ptr [ebp+08]
:0043F4F1 51                      push ecx
:0043F4F2 E894FEFFFF              call 0043F38B
:0043F4F7 83C408                  add esp, 00000008
:0043F4FA 8BE5                    mov esp, ebp
:0043F4FC 5D                      pop ebp
:0043F4FD C3                      ret



* Referenced by a CALL at Addresses:
|:0043BCCB   , :00476CD1   , :0047A183   , :0047A19C   , :0047A9FD   
|
:0043F4FE 55                      push ebp
:0043F4FF 8BEC                    mov ebp, esp
:0043F501 83EC0C                  sub esp, 0000000C
:0043F504 894DF8                  mov dword ptr [ebp-08], ecx
:0043F507 8B45F8                  mov eax, dword ptr [ebp-08]
:0043F50A 8A4818                  mov cl, byte ptr [eax+18]
:0043F50D 51                      push ecx
:0043F50E 8B55F8                  mov edx, dword ptr [ebp-08]
:0043F511 8B0A                    mov ecx, dword ptr [edx]
:0043F513 6BC948                  imul ecx, 00000048
:0043F516 81C1681B4A00            add ecx, 004A1B68
:0043F51C E8057CFCFF              call 00407126
:0043F521 50                      push eax
:0043F522 E825000000              call 0043F54C
:0043F527 83C408                  add esp, 00000008
:0043F52A 8945FC                  mov dword ptr [ebp-04], eax
:0043F52D 817DFCE8030000          cmp dword ptr [ebp-04], 000003E8
:0043F534 7308                    jnb 0043F53E
:0043F536 8B45FC                  mov eax, dword ptr [ebp-04]
:0043F539 8945F4                  mov dword ptr [ebp-0C], eax
:0043F53C EB07                    jmp 0043F545

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F534(C)
|
:0043F53E C745F490010000          mov [ebp-0C], 00000190

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F53C(U)
|
:0043F545 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043F548 8BE5                    mov esp, ebp
:0043F54A 5D                      pop ebp
:0043F54B C3                      ret



* Referenced by a CALL at Addresses:
|:0043F522   , :0043F5B9   , :0043F607   , :0043F655   , :0043F6A3   
|
:0043F54C 55                      push ebp
:0043F54D 8BEC                    mov ebp, esp
:0043F54F 8B450C                  mov eax, dword ptr [ebp+0C]
:0043F552 25FF000000              and eax, 000000FF
:0043F557 83F804                  cmp eax, 00000004
:0043F55A 7C14                    jl 0043F570
:0043F55C 8B4508                  mov eax, dword ptr [ebp+08]
:0043F55F 6BC00C                  imul eax, 0000000C
:0043F562 33D2                    xor edx, edx
:0043F564 B90A000000              mov ecx, 0000000A
:0043F569 F7F1                    div ecx
:0043F56B 894508                  mov dword ptr [ebp+08], eax
:0043F56E EB20                    jmp 0043F590

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F55A(C)
|
:0043F570 8B550C                  mov edx, dword ptr [ebp+0C]
:0043F573 81E2FF000000            and edx, 000000FF
:0043F579 83FA02                  cmp edx, 00000002
:0043F57C 7F12                    jg 0043F590
:0043F57E 8B4508                  mov eax, dword ptr [ebp+08]
:0043F581 6BC007                  imul eax, 00000007
:0043F584 33D2                    xor edx, edx
:0043F586 B90A000000              mov ecx, 0000000A
:0043F58B F7F1                    div ecx
:0043F58D 894508                  mov dword ptr [ebp+08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043F56E(U), :0043F57C(C)
|
:0043F590 8B4508                  mov eax, dword ptr [ebp+08]
:0043F593 5D                      pop ebp
:0043F594 C3                      ret



* Referenced by a CALL at Addresses:
|:0043BCEB   , :00476D05   , :0047A1F8   , :0047A211   , :0047AB6B   
|
:0043F595 55                      push ebp
:0043F596 8BEC                    mov ebp, esp
:0043F598 83EC0C                  sub esp, 0000000C
:0043F59B 894DF8                  mov dword ptr [ebp-08], ecx
:0043F59E 8B45F8                  mov eax, dword ptr [ebp-08]
:0043F5A1 8A4819                  mov cl, byte ptr [eax+19]
:0043F5A4 51                      push ecx
:0043F5A5 8B55F8                  mov edx, dword ptr [ebp-08]
:0043F5A8 8B0A                    mov ecx, dword ptr [edx]
:0043F5AA 6BC948                  imul ecx, 00000048
:0043F5AD 81C1681B4A00            add ecx, 004A1B68
:0043F5B3 E89F7BFCFF              call 00407157
:0043F5B8 50                      push eax
:0043F5B9 E88EFFFFFF              call 0043F54C
:0043F5BE 83C408                  add esp, 00000008
:0043F5C1 8945FC                  mov dword ptr [ebp-04], eax
:0043F5C4 817DFCE8030000          cmp dword ptr [ebp-04], 000003E8
:0043F5CB 7308                    jnb 0043F5D5
:0043F5CD 8B45FC                  mov eax, dword ptr [ebp-04]
:0043F5D0 8945F4                  mov dword ptr [ebp-0C], eax
:0043F5D3 EB07                    jmp 0043F5DC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F5CB(C)
|
:0043F5D5 C745F490010000          mov [ebp-0C], 00000190

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F5D3(U)
|
:0043F5DC 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043F5DF 8BE5                    mov esp, ebp
:0043F5E1 5D                      pop ebp
:0043F5E2 C3                      ret



* Referenced by a CALL at Addresses:
|:0043B85A   , :0043B871   , :0043C05D   , :0043C068   , :0043C5AD   
|:0043C60D   , :00476CEB   , :0047A26B   , :0047A284   , :0047AAB4   
|
:0043F5E3 55                      push ebp
:0043F5E4 8BEC                    mov ebp, esp
:0043F5E6 83EC0C                  sub esp, 0000000C
:0043F5E9 894DF8                  mov dword ptr [ebp-08], ecx
:0043F5EC 8B45F8                  mov eax, dword ptr [ebp-08]
:0043F5EF 8A481A                  mov cl, byte ptr [eax+1A]
:0043F5F2 51                      push ecx
:0043F5F3 8B55F8                  mov edx, dword ptr [ebp-08]
:0043F5F6 8B0A                    mov ecx, dword ptr [edx]
:0043F5F8 6BC948                  imul ecx, 00000048
:0043F5FB 81C1681B4A00            add ecx, 004A1B68
:0043F601 E8827BFCFF              call 00407188
:0043F606 50                      push eax
:0043F607 E840FFFFFF              call 0043F54C
:0043F60C 83C408                  add esp, 00000008
:0043F60F 8945FC                  mov dword ptr [ebp-04], eax
:0043F612 817DFCE7030000          cmp dword ptr [ebp-04], 000003E7
:0043F619 7308                    jnb 0043F623
:0043F61B 8B45FC                  mov eax, dword ptr [ebp-04]
:0043F61E 8945F4                  mov dword ptr [ebp-0C], eax
:0043F621 EB07                    jmp 0043F62A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F619(C)
|
:0043F623 C745F490010000          mov [ebp-0C], 00000190

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F621(U)
|
:0043F62A 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043F62D 8BE5                    mov esp, ebp
:0043F62F 5D                      pop ebp
:0043F630 C3                      ret



* Referenced by a CALL at Addresses:
|:00405CF5   , :00405D10   , :0043B5F3   , :0043B5FE   , :00476D1F   
|:0047A2DE   , :0047A2F7   , :0047AC22   
|
:0043F631 55                      push ebp
:0043F632 8BEC                    mov ebp, esp
:0043F634 83EC0C                  sub esp, 0000000C
:0043F637 894DF8                  mov dword ptr [ebp-08], ecx
:0043F63A 8B45F8                  mov eax, dword ptr [ebp-08]
:0043F63D 8A481B                  mov cl, byte ptr [eax+1B]
:0043F640 51                      push ecx
:0043F641 8B55F8                  mov edx, dword ptr [ebp-08]
:0043F644 8B0A                    mov ecx, dword ptr [edx]
:0043F646 6BC948                  imul ecx, 00000048
:0043F649 81C1681B4A00            add ecx, 004A1B68
:0043F64F E8657BFCFF              call 004071B9
:0043F654 50                      push eax
:0043F655 E8F2FEFFFF              call 0043F54C
:0043F65A 83C408                  add esp, 00000008
:0043F65D 8945FC                  mov dword ptr [ebp-04], eax
:0043F660 817DFCE8030000          cmp dword ptr [ebp-04], 000003E8
:0043F667 7308                    jnb 0043F671
:0043F669 8B45FC                  mov eax, dword ptr [ebp-04]
:0043F66C 8945F4                  mov dword ptr [ebp-0C], eax
:0043F66F EB07                    jmp 0043F678

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F667(C)
|
:0043F671 C745F490010000          mov [ebp-0C], 00000190

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F66F(U)
|
:0043F678 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043F67B 8BE5                    mov esp, ebp
:0043F67D 5D                      pop ebp
:0043F67E C3                      ret



* Referenced by a CALL at Addresses:
|:00405D78   , :00405D93   , :0043B864   , :0043B87B   , :0043C5CA   
|:0043C623   , :00476D39   , :0047A350   , :0047A369   , :0047ACD9   
|
:0043F67F 55                      push ebp
:0043F680 8BEC                    mov ebp, esp
:0043F682 83EC0C                  sub esp, 0000000C
:0043F685 894DF8                  mov dword ptr [ebp-08], ecx
:0043F688 8B45F8                  mov eax, dword ptr [ebp-08]
:0043F68B 8A481C                  mov cl, byte ptr [eax+1C]
:0043F68E 51                      push ecx
:0043F68F 8B55F8                  mov edx, dword ptr [ebp-08]
:0043F692 8B0A                    mov ecx, dword ptr [edx]
:0043F694 6BC948                  imul ecx, 00000048
:0043F697 81C1681B4A00            add ecx, 004A1B68
:0043F69D E8487BFCFF              call 004071EA
:0043F6A2 50                      push eax
:0043F6A3 E8A4FEFFFF              call 0043F54C
:0043F6A8 83C408                  add esp, 00000008
:0043F6AB 8945FC                  mov dword ptr [ebp-04], eax
:0043F6AE 817DFCE8030000          cmp dword ptr [ebp-04], 000003E8
:0043F6B5 7308                    jnb 0043F6BF
:0043F6B7 8B45FC                  mov eax, dword ptr [ebp-04]
:0043F6BA 8945F4                  mov dword ptr [ebp-0C], eax
:0043F6BD EB07                    jmp 0043F6C6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F6B5(C)
|
:0043F6BF C745F490010000          mov [ebp-0C], 00000190

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F6BD(U)
|
:0043F6C6 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043F6C9 8BE5                    mov esp, ebp
:0043F6CB 5D                      pop ebp
:0043F6CC C3                      ret



* Referenced by a CALL at Addresses:
|:00405AFD   , :00414CC5   , :004162F5   , :0041CE32   , :0041D4BA   
|:0041D6A9   , :00422C2A   , :004230D3   , :004247D6   , :00424CED   
|:00434924   , :00434AC9   , :00434C9B   , :0044CEBB   , :0044D025   
|:0044E0AF   , :0045ACC2   
|
:0043F6CD 55                      push ebp
:0043F6CE 8BEC                    mov ebp, esp
:0043F6D0 83EC08                  sub esp, 00000008
:0043F6D3 894DF8                  mov dword ptr [ebp-08], ecx
:0043F6D6 8B45F8                  mov eax, dword ptr [ebp-08]
:0043F6D9 8B08                    mov ecx, dword ptr [eax]
:0043F6DB 6BC948                  imul ecx, 00000048
:0043F6DE 81C1681B4A00            add ecx, 004A1B68
:0043F6E4 E8327BFCFF              call 0040721B
:0043F6E9 8945FC                  mov dword ptr [ebp-04], eax
:0043F6EC 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043F6EF 3B4DFC                  cmp ecx, dword ptr [ebp-04]
:0043F6F2 760B                    jbe 0043F6FF
:0043F6F4 8B55F8                  mov edx, dword ptr [ebp-08]
:0043F6F7 8B45FC                  mov eax, dword ptr [ebp-04]
:0043F6FA 894210                  mov dword ptr [edx+10], eax
:0043F6FD EB09                    jmp 0043F708

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F6F2(C)
|
:0043F6FF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043F702 8B5508                  mov edx, dword ptr [ebp+08]
:0043F705 895110                  mov dword ptr [ecx+10], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F6FD(U)
|
:0043F708 8BE5                    mov esp, ebp
:0043F70A 5D                      pop ebp
:0043F70B C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00405B3F   , :00414CF4   , :0041CF58   , :0041D4D1   , :0041D6C6   
|:00422C5C   , :004230E2   , :0043493A   , :00434ADF   , :00434CB1   
|:0044CEE4   , :0044D04E   , :0045AD7F   
|
:0043F70E 55                      push ebp
:0043F70F 8BEC                    mov ebp, esp
:0043F711 83EC08                  sub esp, 00000008
:0043F714 894DF8                  mov dword ptr [ebp-08], ecx
:0043F717 8B45F8                  mov eax, dword ptr [ebp-08]
:0043F71A 8B08                    mov ecx, dword ptr [eax]
:0043F71C 6BC948                  imul ecx, 00000048
:0043F71F 81C1681B4A00            add ecx, 004A1B68
:0043F725 E8207BFCFF              call 0040724A
:0043F72A 8945FC                  mov dword ptr [ebp-04], eax
:0043F72D 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043F730 3B4DFC                  cmp ecx, dword ptr [ebp-04]
:0043F733 760B                    jbe 0043F740
:0043F735 8B55F8                  mov edx, dword ptr [ebp-08]
:0043F738 8B45FC                  mov eax, dword ptr [ebp-04]
:0043F73B 894214                  mov dword ptr [edx+14], eax
:0043F73E EB09                    jmp 0043F749

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F733(C)
|
:0043F740 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043F743 8B5508                  mov edx, dword ptr [ebp+08]
:0043F746 895114                  mov dword ptr [ecx+14], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F73E(U)
|
:0043F749 8BE5                    mov esp, ebp
:0043F74B 5D                      pop ebp
:0043F74C C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:004339FB   , :00433CE0   , :00433FB9   , :0043AD46   , :0043D5F3   
|
:0043F74F 55                      push ebp
:0043F750 8BEC                    mov ebp, esp
:0043F752 83EC08                  sub esp, 00000008
:0043F755 894DF8                  mov dword ptr [ebp-08], ecx
:0043F758 8B45F8                  mov eax, dword ptr [ebp-08]
:0043F75B 8B08                    mov ecx, dword ptr [eax]
:0043F75D 6BC948                  imul ecx, 00000048
:0043F760 81C1681B4A00            add ecx, 004A1B68
:0043F766 E8107BFCFF              call 0040727B
:0043F76B 8845FC                  mov byte ptr [ebp-04], al
:0043F76E 6A02                    push 00000002
:0043F770 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043F773 E8686FFCFF              call 004066E0
:0043F778 85C0                    test eax, eax
:0043F77A 7409                    je 0043F785
:0043F77C C645FC00                mov [ebp-04], 00
:0043F780 8A45FC                  mov al, byte ptr [ebp-04]
:0043F783 EB46                    jmp 0043F7CB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F77A(C)
|
:0043F785 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043F788 33D2                    xor edx, edx
:0043F78A 8A511D                  mov dl, byte ptr [ecx+1D]
:0043F78D 83FA04                  cmp edx, 00000004
:0043F790 7C18                    jl 0043F7AA
:0043F792 68FF000000              push 000000FF
:0043F797 6A02                    push 00000002
:0043F799 8A45FC                  mov al, byte ptr [ebp-04]
:0043F79C 50                      push eax
:0043F79D E813030400              call 0047FAB5
:0043F7A2 83C40C                  add esp, 0000000C
:0043F7A5 8845FC                  mov byte ptr [ebp-04], al
:0043F7A8 EB1E                    jmp 0043F7C8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F790(C)
|
:0043F7AA 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043F7AD 33D2                    xor edx, edx
:0043F7AF 8A511D                  mov dl, byte ptr [ecx+1D]
:0043F7B2 83FA02                  cmp edx, 00000002
:0043F7B5 7F11                    jg 0043F7C8
:0043F7B7 6A01                    push 00000001
:0043F7B9 8A45FC                  mov al, byte ptr [ebp-04]
:0043F7BC 50                      push eax
:0043F7BD E80E030400              call 0047FAD0
:0043F7C2 83C408                  add esp, 00000008
:0043F7C5 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043F7A8(U), :0043F7B5(C)
|
:0043F7C8 8A45FC                  mov al, byte ptr [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F783(U)
|
:0043F7CB 8BE5                    mov esp, ebp
:0043F7CD 5D                      pop ebp
:0043F7CE C3                      ret



* Referenced by a CALL at Addresses:
|:00437FF4   , :0043852F   , :0043874E   , :00440228   
|
:0043F7CF 55                      push ebp
:0043F7D0 8BEC                    mov ebp, esp
:0043F7D2 83EC0C                  sub esp, 0000000C
:0043F7D5 894DF4                  mov dword ptr [ebp-0C], ecx
:0043F7D8 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043F7DB E890BCFFFF              call 0043B470
:0043F7E0 8845FC                  mov byte ptr [ebp-04], al
:0043F7E3 8B45FC                  mov eax, dword ptr [ebp-04]
:0043F7E6 25FF000000              and eax, 000000FF
:0043F7EB 83F81B                  cmp eax, 0000001B
:0043F7EE 7C04                    jl 0043F7F4
:0043F7F0 0CFF                    or al, FF
:0043F7F2 EB53                    jmp 0043F847

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F7EE(C)
|
:0043F7F4 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043F7F7 81E1FF000000            and ecx, 000000FF
:0043F7FD 51                      push ecx
:0043F7FE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043F801 81E1FF000000            and ecx, 000000FF
:0043F807 6BC93C                  imul ecx, 0000003C
:0043F80A 81C1E0E44A00            add ecx, 004AE4E0
:0043F810 E85B380000              call 00443070
:0043F815 8845F8                  mov byte ptr [ebp-08], al
:0043F818 6A22                    push 00000022
:0043F81A 8B55F4                  mov edx, dword ptr [ebp-0C]
:0043F81D 8B0A                    mov ecx, dword ptr [edx]
:0043F81F 6BC948                  imul ecx, 00000048
:0043F822 81C1681B4A00            add ecx, 004A1B68
:0043F828 E8DC81FCFF              call 00407A09
:0043F82D 85C0                    test eax, eax
:0043F82F 7413                    je 0043F844
:0043F831 8B45F8                  mov eax, dword ptr [ebp-08]
:0043F834 25FF000000              and eax, 000000FF
:0043F839 3DFF000000              cmp eax, 000000FF
:0043F83E 7404                    je 0043F844
:0043F840 C645F801                mov [ebp-08], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043F82F(C), :0043F83E(C)
|
:0043F844 8A45F8                  mov al, byte ptr [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F7F2(U)
|
:0043F847 8BE5                    mov esp, ebp
:0043F849 5D                      pop ebp
:0043F84A C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:004381DD   , :0043A4FE   , :0043A510   , :0043BC9C   , :0043BCA7   
|:00440E13   
|
:0043F84D 55                      push ebp
:0043F84E 8BEC                    mov ebp, esp
:0043F850 83EC08                  sub esp, 00000008
:0043F853 894DF8                  mov dword ptr [ebp-08], ecx
:0043F856 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043F859 E812BCFFFF              call 0043B470
:0043F85E 25FF000000              and eax, 000000FF
:0043F863 83F81B                  cmp eax, 0000001B
:0043F866 7C04                    jl 0043F86C
:0043F868 32C0                    xor al, al
:0043F86A EB4E                    jmp 0043F8BA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F866(C)
|
:0043F86C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043F86F E8EC3AFCFF              call 00403360
:0043F874 50                      push eax
:0043F875 E81761FFFF              call 00435991
:0043F87A 83C404                  add esp, 00000004
:0043F87D 25FF000000              and eax, 000000FF
:0043F882 50                      push eax
:0043F883 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043F886 E8E5BBFFFF              call 0043B470
:0043F88B 8AC8                    mov cl, al
:0043F88D 81E1FF000000            and ecx, 000000FF
:0043F893 6BC93C                  imul ecx, 0000003C
:0043F896 81C1E0E44A00            add ecx, 004AE4E0
:0043F89C E8EF370000              call 00443090
:0043F8A1 8845FC                  mov byte ptr [ebp-04], al
:0043F8A4 8B45FC                  mov eax, dword ptr [ebp-04]
:0043F8A7 25FF000000              and eax, 000000FF
:0043F8AC 3DFF000000              cmp eax, 000000FF
:0043F8B1 7504                    jne 0043F8B7
:0043F8B3 C645FC00                mov [ebp-04], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F8B1(C)
|
:0043F8B7 8A45FC                  mov al, byte ptr [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F86A(U)
|
:0043F8BA 8BE5                    mov esp, ebp
:0043F8BC 5D                      pop ebp
:0043F8BD C3                      ret



* Referenced by a CALL at Addresses:
|:00406424   , :00433A2C   , :00433D11   , :00433FEA   , :00438971   
|:00438CE7   , :0043A297   , :0043AB3E   , :0043ACA9   , :0043D55C   
|:0043DAFC   , :0043DBB8   , :0043DE93   , :00441517   , :0044152D   
|:00441565   , :0044157B   , :0045B2D3   
|
:0043F8BE 55                      push ebp
:0043F8BF 8BEC                    mov ebp, esp
:0043F8C1 51                      push ecx
:0043F8C2 894DFC                  mov dword ptr [ebp-04], ecx
:0043F8C5 6A2A                    push 0000002A
:0043F8C7 8B45FC                  mov eax, dword ptr [ebp-04]
:0043F8CA 8B08                    mov ecx, dword ptr [eax]
:0043F8CC 6BC948                  imul ecx, 00000048
:0043F8CF 81C1681B4A00            add ecx, 004A1B68
:0043F8D5 E82F81FCFF              call 00407A09
:0043F8DA 85C0                    test eax, eax
:0043F8DC 7417                    je 0043F8F5
:0043F8DE 6A2A                    push 0000002A
:0043F8E0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043F8E3 8B09                    mov ecx, dword ptr [ecx]
:0043F8E5 6BC948                  imul ecx, 00000048
:0043F8E8 81C1681B4A00            add ecx, 004A1B68
:0043F8EE E8FF81FCFF              call 00407AF2
:0043F8F3 EB1E                    jmp 0043F913

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F8DC(C)
|
:0043F8F5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043F8F8 E873E6FDFF              call 0041DF70
:0043F8FD 8AC8                    mov cl, al
:0043F8FF 81E1FF000000            and ecx, 000000FF
:0043F905 6BC91B                  imul ecx, 0000001B
:0043F908 81C1A0BF4A00            add ecx, 004ABFA0
:0043F90E E88D000100              call 0044F9A0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F8F3(U)
|
:0043F913 8BE5                    mov esp, ebp
:0043F915 5D                      pop ebp
:0043F916 C3                      ret



* Referenced by a CALL at Addresses:
|:0043DAEA   , :004554CD   
|
:0043F917 55                      push ebp
:0043F918 8BEC                    mov ebp, esp
:0043F91A 51                      push ecx
:0043F91B 894DFC                  mov dword ptr [ebp-04], ecx
:0043F91E 8B45FC                  mov eax, dword ptr [ebp-04]
:0043F921 8B08                    mov ecx, dword ptr [eax]
:0043F923 6BC948                  imul ecx, 00000048
:0043F926 81C1681B4A00            add ecx, 004A1B68
:0043F92C E8E77EFCFF              call 00407818
:0043F931 8BE5                    mov esp, ebp
:0043F933 5D                      pop ebp
:0043F934 C3                      ret



* Referenced by a CALL at Address:
|:0045A649   
|
:0043F935 55                      push ebp
:0043F936 8BEC                    mov ebp, esp
:0043F938 83EC08                  sub esp, 00000008
:0043F93B 894DF8                  mov dword ptr [ebp-08], ecx
:0043F93E 8B45F8                  mov eax, dword ptr [ebp-08]
:0043F941 8B08                    mov ecx, dword ptr [eax]
:0043F943 6BC948                  imul ecx, 00000048
:0043F946 81C1681B4A00            add ecx, 004A1B68
:0043F94C E82F94FDFF              call 00418D80
:0043F951 25FF000000              and eax, 000000FF
:0043F956 8945FC                  mov dword ptr [ebp-04], eax
:0043F959 837DFC00                cmp dword ptr [ebp-04], 00000000
:0043F95D 7409                    je 0043F968
:0043F95F 817DFCFF000000          cmp dword ptr [ebp-04], 000000FF
:0043F966 7505                    jne 0043F96D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F95D(C)
|
:0043F968 8B45FC                  mov eax, dword ptr [ebp-04]
:0043F96B EB1D                    jmp 0043F98A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F966(C)
|
:0043F96D 68FF000000              push 000000FF
:0043F972 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043F975 8B09                    mov ecx, dword ptr [ecx]
:0043F977 6BC948                  imul ecx, 00000048
:0043F97A 81C1681B4A00            add ecx, 004A1B68
:0043F980 E82BE6FCFF              call 0040DFB0
:0043F985 B8FF000000              mov eax, 000000FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F96B(U)
|
:0043F98A 8BE5                    mov esp, ebp
:0043F98C 5D                      pop ebp
:0043F98D C3                      ret



* Referenced by a CALL at Addresses:
|:0041D2E6   , :0041D318   , :0041D34A   , :0041D379   , :0041D3A8   
|:00420D17   , :00420D28   , :00420D45   , :00420D53   , :00420D61   
|:00420D6F   , :00420D7D   , :00420D8B   , :00420DA5   , :00420DB3   
|:00420DC1   
|
:0043F98E 55                      push ebp
:0043F98F 8BEC                    mov ebp, esp
:0043F991 83EC08                  sub esp, 00000008
:0043F994 894DFC                  mov dword ptr [ebp-04], ecx
:0043F997 8B4508                  mov eax, dword ptr [ebp+08]
:0043F99A 25FF000000              and eax, 000000FF
:0043F99F 8945F8                  mov dword ptr [ebp-08], eax
:0043F9A2 837DF805                cmp dword ptr [ebp-08], 00000005
:0043F9A6 0F8706020000            ja 0043FBB2
:0043F9AC 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043F9AF FF248DB8FB4300          jmp dword ptr [4*ecx+0043FBB8]
:0043F9B6 8B55FC                  mov edx, dword ptr [ebp-04]
:0043F9B9 33C0                    xor eax, eax
:0043F9BB 8A4218                  mov al, byte ptr [edx+18]
:0043F9BE 83F803                  cmp eax, 00000003
:0043F9C1 7E15                    jle 0043F9D8
:0043F9C3 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0043F9C6 F7D9                    neg ecx
:0043F9C8 1BC9                    sbb ecx, ecx
:0043F9CA 83E103                  and ecx, 00000003
:0043F9CD 83C103                  add ecx, 00000003
:0043F9D0 8B55FC                  mov edx, dword ptr [ebp-04]
:0043F9D3 884A18                  mov byte ptr [edx+18], cl
:0043F9D6 EB2F                    jmp 0043FA07

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F9C1(C)
|
:0043F9D8 8B45FC                  mov eax, dword ptr [ebp-04]
:0043F9DB 33C9                    xor ecx, ecx
:0043F9DD 8A4818                  mov cl, byte ptr [eax+18]
:0043F9E0 83F903                  cmp ecx, 00000003
:0043F9E3 7512                    jne 0043F9F7
:0043F9E5 8B550C                  mov edx, dword ptr [ebp+0C]
:0043F9E8 F7DA                    neg edx
:0043F9EA 1BD2                    sbb edx, edx
:0043F9EC 83E206                  and edx, 00000006
:0043F9EF 8B45FC                  mov eax, dword ptr [ebp-04]
:0043F9F2 885018                  mov byte ptr [eax+18], dl
:0043F9F5 EB10                    jmp 0043FA07

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F9E3(C)
|
:0043F9F7 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0043F9FA F7D9                    neg ecx
:0043F9FC 1BC9                    sbb ecx, ecx
:0043F9FE 83E103                  and ecx, 00000003
:0043FA01 8B55FC                  mov edx, dword ptr [ebp-04]
:0043FA04 884A18                  mov byte ptr [edx+18], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043F9D6(U), :0043F9F5(U)
|
:0043FA07 E9A6010000              jmp 0043FBB2
:0043FA0C 8B45FC                  mov eax, dword ptr [ebp-04]
:0043FA0F 33C9                    xor ecx, ecx
:0043FA11 8A4819                  mov cl, byte ptr [eax+19]
:0043FA14 83F903                  cmp ecx, 00000003
:0043FA17 7E15                    jle 0043FA2E
:0043FA19 8B550C                  mov edx, dword ptr [ebp+0C]
:0043FA1C F7DA                    neg edx
:0043FA1E 1BD2                    sbb edx, edx
:0043FA20 83E203                  and edx, 00000003
:0043FA23 83C203                  add edx, 00000003
:0043FA26 8B45FC                  mov eax, dword ptr [ebp-04]
:0043FA29 885019                  mov byte ptr [eax+19], dl
:0043FA2C EB2F                    jmp 0043FA5D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043FA17(C)
|
:0043FA2E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043FA31 33D2                    xor edx, edx
:0043FA33 8A5119                  mov dl, byte ptr [ecx+19]
:0043FA36 83FA03                  cmp edx, 00000003
:0043FA39 7512                    jne 0043FA4D
:0043FA3B 8B450C                  mov eax, dword ptr [ebp+0C]
:0043FA3E F7D8                    neg eax
:0043FA40 1BC0                    sbb eax, eax
:0043FA42 83E006                  and eax, 00000006
:0043FA45 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043FA48 884119                  mov byte ptr [ecx+19], al
:0043FA4B EB10                    jmp 0043FA5D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043FA39(C)
|
:0043FA4D 8B550C                  mov edx, dword ptr [ebp+0C]
:0043FA50 F7DA                    neg edx
:0043FA52 1BD2                    sbb edx, edx
:0043FA54 83E203                  and edx, 00000003
:0043FA57 8B45FC                  mov eax, dword ptr [ebp-04]
:0043FA5A 885019                  mov byte ptr [eax+19], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043FA2C(U), :0043FA4B(U)
|
:0043FA5D E950010000              jmp 0043FBB2
:0043FA62 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043FA65 33D2                    xor edx, edx
:0043FA67 8A511A                  mov dl, byte ptr [ecx+1A]
:0043FA6A 83FA03                  cmp edx, 00000003
:0043FA6D 7E15                    jle 0043FA84
:0043FA6F 8B450C                  mov eax, dword ptr [ebp+0C]
:0043FA72 F7D8                    neg eax
:0043FA74 1BC0                    sbb eax, eax
:0043FA76 83E003                  and eax, 00000003
:0043FA79 83C003                  add eax, 00000003
:0043FA7C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043FA7F 88411A                  mov byte ptr [ecx+1A], al
:0043FA82 EB2F                    jmp 0043FAB3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043FA6D(C)
|
:0043FA84 8B55FC                  mov edx, dword ptr [ebp-04]
:0043FA87 33C0                    xor eax, eax
:0043FA89 8A421A                  mov al, byte ptr [edx+1A]
:0043FA8C 83F803                  cmp eax, 00000003
:0043FA8F 7512                    jne 0043FAA3
:0043FA91 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0043FA94 F7D9                    neg ecx
:0043FA96 1BC9                    sbb ecx, ecx
:0043FA98 83E106                  and ecx, 00000006
:0043FA9B 8B55FC                  mov edx, dword ptr [ebp-04]
:0043FA9E 884A1A                  mov byte ptr [edx+1A], cl
:0043FAA1 EB10                    jmp 0043FAB3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043FA8F(C)
|
:0043FAA3 8B450C                  mov eax, dword ptr [ebp+0C]
:0043FAA6 F7D8                    neg eax
:0043FAA8 1BC0                    sbb eax, eax
:0043FAAA 83E003                  and eax, 00000003
:0043FAAD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043FAB0 88411A                  mov byte ptr [ecx+1A], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043FA82(U), :0043FAA1(U)
|
:0043FAB3 E9FA000000              jmp 0043FBB2
:0043FAB8 8B55FC                  mov edx, dword ptr [ebp-04]
:0043FABB 33C0                    xor eax, eax
:0043FABD 8A421B                  mov al, byte ptr [edx+1B]
:0043FAC0 83F803                  cmp eax, 00000003
:0043FAC3 7E15                    jle 0043FADA
:0043FAC5 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0043FAC8 F7D9                    neg ecx
:0043FACA 1BC9                    sbb ecx, ecx
:0043FACC 83E103                  and ecx, 00000003
:0043FACF 83C103                  add ecx, 00000003
:0043FAD2 8B55FC                  mov edx, dword ptr [ebp-04]
:0043FAD5 884A1B                  mov byte ptr [edx+1B], cl
:0043FAD8 EB2F                    jmp 0043FB09

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043FAC3(C)
|
:0043FADA 8B45FC                  mov eax, dword ptr [ebp-04]
:0043FADD 33C9                    xor ecx, ecx
:0043FADF 8A481B                  mov cl, byte ptr [eax+1B]
:0043FAE2 83F903                  cmp ecx, 00000003
:0043FAE5 7512                    jne 0043FAF9
:0043FAE7 8B550C                  mov edx, dword ptr [ebp+0C]
:0043FAEA F7DA                    neg edx
:0043FAEC 1BD2                    sbb edx, edx
:0043FAEE 83E206                  and edx, 00000006
:0043FAF1 8B45FC                  mov eax, dword ptr [ebp-04]
:0043FAF4 88501B                  mov byte ptr [eax+1B], dl
:0043FAF7 EB10                    jmp 0043FB09

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043FAE5(C)
|
:0043FAF9 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0043FAFC F7D9                    neg ecx
:0043FAFE 1BC9                    sbb ecx, ecx
:0043FB00 83E103                  and ecx, 00000003
:0043FB03 8B55FC                  mov edx, dword ptr [ebp-04]
:0043FB06 884A1B                  mov byte ptr [edx+1B], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043FAD8(U), :0043FAF7(U)
|
:0043FB09 E9A4000000              jmp 0043FBB2
:0043FB0E 8B45FC                  mov eax, dword ptr [ebp-04]
:0043FB11 33C9                    xor ecx, ecx
:0043FB13 8A481C                  mov cl, byte ptr [eax+1C]
:0043FB16 83F903                  cmp ecx, 00000003
:0043FB19 7E15                    jle 0043FB30
:0043FB1B 8B550C                  mov edx, dword ptr [ebp+0C]
:0043FB1E F7DA                    neg edx
:0043FB20 1BD2                    sbb edx, edx
:0043FB22 83E203                  and edx, 00000003
:0043FB25 83C203                  add edx, 00000003
:0043FB28 8B45FC                  mov eax, dword ptr [ebp-04]
:0043FB2B 88501C                  mov byte ptr [eax+1C], dl
:0043FB2E EB2F                    jmp 0043FB5F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043FB19(C)
|
:0043FB30 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043FB33 33D2                    xor edx, edx
:0043FB35 8A511C                  mov dl, byte ptr [ecx+1C]
:0043FB38 83FA03                  cmp edx, 00000003
:0043FB3B 7512                    jne 0043FB4F
:0043FB3D 8B450C                  mov eax, dword ptr [ebp+0C]
:0043FB40 F7D8                    neg eax
:0043FB42 1BC0                    sbb eax, eax
:0043FB44 83E006                  and eax, 00000006
:0043FB47 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043FB4A 88411C                  mov byte ptr [ecx+1C], al
:0043FB4D EB10                    jmp 0043FB5F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043FB3B(C)
|
:0043FB4F 8B550C                  mov edx, dword ptr [ebp+0C]
:0043FB52 F7DA                    neg edx
:0043FB54 1BD2                    sbb edx, edx
:0043FB56 83E203                  and edx, 00000003
:0043FB59 8B45FC                  mov eax, dword ptr [ebp-04]
:0043FB5C 88501C                  mov byte ptr [eax+1C], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043FB2E(U), :0043FB4D(U)
|
:0043FB5F EB51                    jmp 0043FBB2
:0043FB61 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043FB64 33D2                    xor edx, edx
:0043FB66 8A511D                  mov dl, byte ptr [ecx+1D]
:0043FB69 83FA03                  cmp edx, 00000003
:0043FB6C 7E15                    jle 0043FB83
:0043FB6E 8B450C                  mov eax, dword ptr [ebp+0C]
:0043FB71 F7D8                    neg eax
:0043FB73 1BC0                    sbb eax, eax
:0043FB75 83E003                  and eax, 00000003
:0043FB78 83C003                  add eax, 00000003
:0043FB7B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043FB7E 88411D                  mov byte ptr [ecx+1D], al
:0043FB81 EB2F                    jmp 0043FBB2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043FB6C(C)
|
:0043FB83 8B55FC                  mov edx, dword ptr [ebp-04]
:0043FB86 33C0                    xor eax, eax
:0043FB88 8A421D                  mov al, byte ptr [edx+1D]
:0043FB8B 83F803                  cmp eax, 00000003
:0043FB8E 7512                    jne 0043FBA2
:0043FB90 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0043FB93 F7D9                    neg ecx
:0043FB95 1BC9                    sbb ecx, ecx
:0043FB97 83E106                  and ecx, 00000006
:0043FB9A 8B55FC                  mov edx, dword ptr [ebp-04]
:0043FB9D 884A1D                  mov byte ptr [edx+1D], cl
:0043FBA0 EB10                    jmp 0043FBB2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043FB8E(C)
|
:0043FBA2 8B450C                  mov eax, dword ptr [ebp+0C]
:0043FBA5 F7D8                    neg eax
:0043FBA7 1BC0                    sbb eax, eax
:0043FBA9 83E003                  and eax, 00000003
:0043FBAC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043FBAF 88411D                  mov byte ptr [ecx+1D], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043F9A6(C), :0043FA07(U), :0043FA5D(U), :0043FAB3(U), :0043FB09(U)
|:0043FB5F(U), :0043FB81(U), :0043FBA0(U)
|
:0043FBB2 8BE5                    mov esp, ebp
:0043FBB4 5D                      pop ebp
:0043FBB5 C20800                  ret 0008



:0043FBB8 B6F94300                DWORD 0043F9B6
:0043FBBC 0CFA4300                DWORD 0043FA0C
:0043FBC0 62FA4300                DWORD 0043FA62
:0043FBC4 B8FA4300                DWORD 0043FAB8
:0043FBC8 0EFB4300                DWORD 0043FB0E
:0043FBCC 61FB4300                DWORD 0043FB61



* Referenced by a CALL at Addresses:
|:00442775   , :0045A631   , :0045A63D   , :0045A660   , :0045A66C   
|
:0043FBD0 55                      push ebp
:0043FBD1 8BEC                    mov ebp, esp
:0043FBD3 51                      push ecx
:0043FBD4 894DFC                  mov dword ptr [ebp-04], ecx
:0043FBD7 8B4508                  mov eax, dword ptr [ebp+08]
:0043FBDA 25FF000000              and eax, 000000FF
:0043FBDF 85C0                    test eax, eax
:0043FBE1 7C19                    jl 0043FBFC
:0043FBE3 8B4D08                  mov ecx, dword ptr [ebp+08]
:0043FBE6 81E1FF000000            and ecx, 000000FF
:0043FBEC 83F903                  cmp ecx, 00000003
:0043FBEF 7F0B                    jg 0043FBFC
:0043FBF1 8B55FC                  mov edx, dword ptr [ebp-04]
:0043FBF4 8A4508                  mov al, byte ptr [ebp+08]
:0043FBF7 884205                  mov byte ptr [edx+05], al
:0043FBFA EB18                    jmp 0043FC14

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043FBE1(C), :0043FBEF(C)
|
:0043FBFC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043FBFF E8DC340000              call 004430E0
:0043FC04 50                      push eax

* Possible StringData Ref from Data Obj ->"Debug : UnitColor Set Error(%s)"
                                  |
:0043FC05 6830E04800              push 0048E030
:0043FC0A 6A00                    push 00000000
:0043FC0C E888FAFEFF              call 0042F699
:0043FC11 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043FBFA(U)
|
:0043FC14 8BE5                    mov esp, ebp
:0043FC16 5D                      pop ebp
:0043FC17 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:004403BE   , :0044A49A   , :0044C9CC   , :0044CAFB   , :0044D92E   
|:00450B07   , :00459FBB   , :0045A951   , :0045AEB8   , :00477ED4   
|:00477EF8   , :004787AC   
|
:0043FC1A 55                      push ebp
:0043FC1B 8BEC                    mov ebp, esp
:0043FC1D 51                      push ecx
:0043FC1E 894DFC                  mov dword ptr [ebp-04], ecx
:0043FC21 8B45FC                  mov eax, dword ptr [ebp-04]
:0043FC24 33C9                    xor ecx, ecx
:0043FC26 8A4805                  mov cl, byte ptr [eax+05]
:0043FC29 85C9                    test ecx, ecx
:0043FC2B 7C15                    jl 0043FC42
:0043FC2D 8B55FC                  mov edx, dword ptr [ebp-04]
:0043FC30 33C0                    xor eax, eax
:0043FC32 8A4205                  mov al, byte ptr [edx+05]
:0043FC35 83F803                  cmp eax, 00000003
:0043FC38 7F08                    jg 0043FC42
:0043FC3A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043FC3D 8A4105                  mov al, byte ptr [ecx+05]
:0043FC40 EB02                    jmp 0043FC44

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043FC2B(C), :0043FC38(C)
|
:0043FC42 32C0                    xor al, al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043FC40(U)
|
:0043FC44 8BE5                    mov esp, ebp
:0043FC46 5D                      pop ebp
:0043FC47 C3                      ret



* Referenced by a CALL at Addresses:
|:00403BC7   , :00403DCB   , :0041C7D1   , :0041D723   , :0041D7B2   
|:00421956   , :00422003   , :0043D296   , :0043FE8B   , :00441A3D   
|:00443E44   , :00443F96   , :00444136   , :0044432F   , :004444DB   
|:00444716   , :00444F2F   , :00445CB4   , :0044623E   , :00446646   
|:00446A1E   , :00446DE9   , :00447152   , :004475F1   , :0045792F   
|
:0043FC48 55                      push ebp
:0043FC49 8BEC                    mov ebp, esp
:0043FC4B 83EC10                  sub esp, 00000010
:0043FC4E 894DF4                  mov dword ptr [ebp-0C], ecx
:0043FC51 8B45F4                  mov eax, dword ptr [ebp-0C]
:0043FC54 8B08                    mov ecx, dword ptr [eax]
:0043FC56 6BC948                  imul ecx, 00000048
:0043FC59 81C1681B4A00            add ecx, 004A1B68
:0043FC5F E8E36CFCFF              call 00406947
:0043FC64 8845FC                  mov byte ptr [ebp-04], al
:0043FC67 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043FC6A 81E1FF000000            and ecx, 000000FF
:0043FC70 83F922                  cmp ecx, 00000022
:0043FC73 7D43                    jge 0043FCB8
:0043FC75 8B55F4                  mov edx, dword ptr [ebp-0C]
:0043FC78 33C0                    xor eax, eax
:0043FC7A 8A4205                  mov al, byte ptr [edx+05]
:0043FC7D 83F802                  cmp eax, 00000002
:0043FC80 7F0D                    jg 0043FC8F
:0043FC82 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043FC85 33D2                    xor edx, edx
:0043FC87 8A5105                  mov dl, byte ptr [ecx+05]
:0043FC8A 8955F0                  mov dword ptr [ebp-10], edx
:0043FC8D EB07                    jmp 0043FC96

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043FC80(C)
|
:0043FC8F C745F002000000          mov [ebp-10], 00000002

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043FC8D(U)
|
:0043FC96 8A45F0                  mov al, byte ptr [ebp-10]
:0043FC99 8845F8                  mov byte ptr [ebp-08], al
:0043FC9C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043FC9F 81E1FF000000            and ecx, 000000FF
:0043FCA5 6BC903                  imul ecx, 00000003
:0043FCA8 8B55F8                  mov edx, dword ptr [ebp-08]
:0043FCAB 81E2FF000000            and edx, 000000FF
:0043FCB1 03CA                    add ecx, edx
:0043FCB3 884DFC                  mov byte ptr [ebp-04], cl
:0043FCB6 EB08                    jmp 0043FCC0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043FC73(C)
|
:0043FCB8 8A45FC                  mov al, byte ptr [ebp-04]
:0043FCBB 0444                    add al, 44
:0043FCBD 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043FCB6(U)
|
:0043FCC0 8A45FC                  mov al, byte ptr [ebp-04]
:0043FCC3 8BE5                    mov esp, ebp
:0043FCC5 5D                      pop ebp
:0043FCC6 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0040585A   , :00414EA4   , :004150BE   , :00416F73   , :00416FAA   
|:0041CB6D   , :0041DB96   , :00421755   , :00421A78   , :0043E21F   
|:00441792   , :0044182E   , :00441AC2   , :00441AE9   , :00441D74   
|:00441DAE   , :00442ADB   , :00442BB6   , :00442BE6   , :0044EBA7   
|:0045737F   , :00457582   , :00457596   , :00457749   , :0045775D   
|:004585A8   , :0045943A   , :00459648   , :00459753   , :004598AB   
|:004598D9   , :00459D64   , :0045AD96   
|
:0043FCC9 55                      push ebp
:0043FCCA 8BEC                    mov ebp, esp
:0043FCCC 51                      push ecx
:0043FCCD 56                      push esi
:0043FCCE 894DFC                  mov dword ptr [ebp-04], ecx
:0043FCD1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043FCD4 E8B78FFDFF              call 00418C90
:0043FCD9 25FF000000              and eax, 000000FF
:0043FCDE 83F802                  cmp eax, 00000002
:0043FCE1 754C                    jne 0043FD2F
:0043FCE3 6A01                    push 00000001
:0043FCE5 6A01                    push 00000001
:0043FCE7 8B45FC                  mov eax, dword ptr [ebp-04]
:0043FCEA 33C9                    xor ecx, ecx
:0043FCEC 8A4807                  mov cl, byte ptr [eax+07]
:0043FCEF 8BF1                    mov esi, ecx
:0043FCF1 B950424B00              mov ecx, 004B4250
:0043FCF6 E8A91D0100              call 00451AA4
:0043FCFB 99                      cdq
:0043FCFC B930000000              mov ecx, 00000030
:0043FD01 F7F9                    idiv ecx
:0043FD03 2BF0                    sub esi, eax
:0043FD05 56                      push esi
:0043FD06 8B55FC                  mov edx, dword ptr [ebp-04]
:0043FD09 33C0                    xor eax, eax
:0043FD0B 8A4206                  mov al, byte ptr [edx+06]
:0043FD0E 8BF0                    mov esi, eax
:0043FD10 B950424B00              mov ecx, 004B4250
:0043FD15 E8791D0100              call 00451A93
:0043FD1A 99                      cdq
:0043FD1B B930000000              mov ecx, 00000030
:0043FD20 F7F9                    idiv ecx
:0043FD22 2BF0                    sub esi, eax
:0043FD24 56                      push esi
:0043FD25 B950424B00              mov ecx, 004B4250
:0043FD2A E860240100              call 0045218F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043FCE1(C)
|
:0043FD2F 5E                      pop esi
:0043FD30 8BE5                    mov esp, ebp
:0043FD32 5D                      pop ebp
:0043FD33 C3                      ret



* Referenced by a CALL at Addresses:
|:00435860   , :0043587B   , :0043E1FE   , :0043E217   , :0043FF2F   
|:004418AD   , :0044226A   , :004422FD   , :00442B47   , :00444CF4   
|:00444D0A   , :00446E9B   , :00446EB1   , :004498F4   , :00449906   
|:00449A72   , :00449A7F   , :00457705   , :0045771B   
|
:0043FD34 55                      push ebp
:0043FD35 8BEC                    mov ebp, esp
:0043FD37 83EC08                  sub esp, 00000008
:0043FD3A 894DF8                  mov dword ptr [ebp-08], ecx
:0043FD3D 6A08                    push 00000008
:0043FD3F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043FD42 E8A95DFEFF              call 00425AF0
:0043FD47 394508                  cmp dword ptr [ebp+08], eax
:0043FD4A 0F84D6000000            je 0043FE26
:0043FD50 6A04                    push 00000004
:0043FD52 6A00                    push 00000000
:0043FD54 8B45F8                  mov eax, dword ptr [ebp-08]
:0043FD57 33C9                    xor ecx, ecx
:0043FD59 8A4804                  mov cl, byte ptr [eax+04]
:0043FD5C 69C900630000            imul ecx, 00006300
:0043FD62 81C100240000            add ecx, 00002400
:0043FD68 51                      push ecx
:0043FD69 B980AB4A00              mov ecx, 004AAB80
:0043FD6E E8CDFC0300              call 0047FA40
:0043FD73 8945FC                  mov dword ptr [ebp-04], eax
:0043FD76 B990F44A00              mov ecx, 004AF490
:0043FD7B E810E3FCFF              call 0040E090
:0043FD80 50                      push eax
:0043FD81 8B55FC                  mov edx, dword ptr [ebp-04]
:0043FD84 52                      push edx
:0043FD85 6A60                    push 00000060
:0043FD87 6A30                    push 00000030
:0043FD89 E8C5F0FDFF              call 0041EE53
:0043FD8E 83C410                  add esp, 00000010
:0043FD91 6800120000              push 00001200
:0043FD96 8B45FC                  mov eax, dword ptr [ebp-04]
:0043FD99 50                      push eax
:0043FD9A B990F44A00              mov ecx, 004AF490
:0043FD9F E8ECE2FCFF              call 0040E090
:0043FDA4 50                      push eax
:0043FDA5 E853FF0300              call 0047FCFD
:0043FDAA 83C40C                  add esp, 0000000C
:0043FDAD 6A04                    push 00000004
:0043FDAF 6A00                    push 00000000
:0043FDB1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043FDB4 33D2                    xor edx, edx
:0043FDB6 8A5104                  mov dl, byte ptr [ecx+04]
:0043FDB9 69D200630000            imul edx, 00006300
:0043FDBF 81C200480000            add edx, 00004800
:0043FDC5 52                      push edx
:0043FDC6 B980AB4A00              mov ecx, 004AAB80
:0043FDCB E870FC0300              call 0047FA40
:0043FDD0 8945FC                  mov dword ptr [ebp-04], eax
:0043FDD3 B990F44A00              mov ecx, 004AF490
:0043FDD8 E8B3E2FCFF              call 0040E090
:0043FDDD 50                      push eax
:0043FDDE 8B45FC                  mov eax, dword ptr [ebp-04]
:0043FDE1 50                      push eax
:0043FDE2 6A30                    push 00000030
:0043FDE4 6A30                    push 00000030
:0043FDE6 E868F0FDFF              call 0041EE53
:0043FDEB 83C410                  add esp, 00000010
:0043FDEE 6800090000              push 00000900
:0043FDF3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0043FDF6 51                      push ecx
:0043FDF7 B990F44A00              mov ecx, 004AF490
:0043FDFC E88FE2FCFF              call 0040E090
:0043FE01 50                      push eax
:0043FE02 E8F6FE0300              call 0047FCFD
:0043FE07 83C40C                  add esp, 0000000C
:0043FE0A 837D0800                cmp dword ptr [ebp+08], 00000000
:0043FE0E 740C                    je 0043FE1C
:0043FE10 6A08                    push 00000008
:0043FE12 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043FE15 E8FE280000              call 00442718
:0043FE1A EB0A                    jmp 0043FE26

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043FE0E(C)
|
:0043FE1C 6A08                    push 00000008
:0043FE1E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0043FE21 E86A68FCFF              call 00406690

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0043FD4A(C), :0043FE1A(U)
|
:0043FE26 8BE5                    mov esp, ebp
:0043FE28 5D                      pop ebp
:0043FE29 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00414E8D   , :0041DB88   , :0044D346   , :0044D9AF   , :0045A674   
|
:0043FE2C 55                      push ebp
:0043FE2D 8BEC                    mov ebp, esp
:0043FE2F 6AFF                    push FFFFFFFF
:0043FE31 683C544800              push 0048543C
:0043FE36 64A100000000            mov eax, dword ptr fs:[00000000]
:0043FE3C 50                      push eax
:0043FE3D 64892500000000          mov dword ptr fs:[00000000], esp
:0043FE44 81EC14010000            sub esp, 00000114
:0043FE4A 898DE0FEFFFF            mov dword ptr [ebp+FFFFFEE0], ecx
:0043FE50 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0043FE56 E85534FCFF              call 004032B0
:0043FE5B C745FC00000000          mov [ebp-04], 00000000
:0043FE62 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:0043FE68 33C9                    xor ecx, ecx
:0043FE6A 8A4804                  mov cl, byte ptr [eax+04]
:0043FE6D 69C900630000            imul ecx, 00006300
:0043FE73 898DE8FEFFFF            mov dword ptr [ebp+FFFFFEE8], ecx
:0043FE79 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:0043FE7F 33C0                    xor eax, eax
:0043FE81 8A4204                  mov al, byte ptr [edx+04]
:0043FE84 50                      push eax
:0043FE85 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:0043FE8B E8B8FDFFFF              call 0043FC48
:0043FE90 8845F0                  mov byte ptr [ebp-10], al

* Possible StringData Ref from Data Obj ->"UNIT_MOV.E5"
                                  |
:0043FE93 68E0BB4800              push 0048BBE0
:0043FE98 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0043FE9E E892FCFDFF              call 0041FB35
:0043FEA3 6A04                    push 00000004
:0043FEA5 6A00                    push 00000000
:0043FEA7 6A00                    push 00000000
:0043FEA9 B9C8E44A00              mov ecx, 004AE4C8
:0043FEAE E88DFB0300              call 0047FA40
:0043FEB3 50                      push eax
:0043FEB4 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0043FEB7 81E1FF000000            and ecx, 000000FF
:0043FEBD 51                      push ecx
:0043FEBE 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0043FEC4 E8C0FDFDFF              call 0041FC89
:0043FEC9 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0043FECF E8F193FDFF              call 004192C5
:0043FED4 6800630000              push 00006300
:0043FED9 6A04                    push 00000004
:0043FEDB 6A00                    push 00000000
:0043FEDD 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:0043FEE3 52                      push edx
:0043FEE4 B980AB4A00              mov ecx, 004AAB80
:0043FEE9 E852FB0300              call 0047FA40
:0043FEEE 50                      push eax
:0043FEEF B9C8E44A00              mov ecx, 004AE4C8
:0043FEF4 E897E1FCFF              call 0040E090
:0043FEF9 50                      push eax
:0043FEFA E8FEFD0300              call 0047FCFD
:0043FEFF 83C40C                  add esp, 0000000C
:0043FF02 6A08                    push 00000008
:0043FF04 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:0043FF0A E8E15BFEFF              call 00425AF0
:0043FF0F 8985E4FEFFFF            mov dword ptr [ebp+FFFFFEE4], eax
:0043FF15 6A08                    push 00000008
:0043FF17 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:0043FF1D E86E67FCFF              call 00406690
:0043FF22 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:0043FF28 50                      push eax
:0043FF29 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:0043FF2F E800FEFFFF              call 0043FD34
:0043FF34 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0043FF3B 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0043FF41 E88A33FCFF              call 004032D0
:0043FF46 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043FF49 64890D00000000          mov dword ptr fs:[00000000], ecx
:0043FF50 8BE5                    mov esp, ebp
:0043FF52 5D                      pop ebp
:0043FF53 C3                      ret



* Referenced by a CALL at Addresses:
|:00403AE9   , :00405BFB   , :0040633F   , :004208B5   , :00421421   
|:00422CCE   , :00425245   , :0043CF29   , :0043D60B   , :00440C9C   
|:004417AB   , :0044924D   , :00449941   , :0044E7A0   , :004509C0   
|:00450A4C   
|
:0043FF54 55                      push ebp
:0043FF55 8BEC                    mov ebp, esp
:0043FF57 51                      push ecx
:0043FF58 894DFC                  mov dword ptr [ebp-04], ecx
:0043FF5B 8B45FC                  mov eax, dword ptr [ebp-04]
:0043FF5E 33C9                    xor ecx, ecx
:0043FF60 8A4805                  mov cl, byte ptr [eax+05]
:0043FF63 8BC1                    mov eax, ecx
:0043FF65 F7D8                    neg eax
:0043FF67 1BC0                    sbb eax, eax
:0043FF69 40                      inc eax
:0043FF6A 8BE5                    mov esp, ebp
:0043FF6C 5D                      pop ebp
:0043FF6D C3                      ret



* Referenced by a CALL at Addresses:
|:004423B7   , :0044DE65   
|
:0043FF6E 55                      push ebp
:0043FF6F 8BEC                    mov ebp, esp
:0043FF71 83EC10                  sub esp, 00000010
:0043FF74 894DF4                  mov dword ptr [ebp-0C], ecx
:0043FF77 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043FF7A E8F1B4FFFF              call 0043B470
:0043FF7F 8845F8                  mov byte ptr [ebp-08], al
:0043FF82 8B45F8                  mov eax, dword ptr [ebp-08]
:0043FF85 25FF000000              and eax, 000000FF
:0043FF8A 8945F0                  mov dword ptr [ebp-10], eax
:0043FF8D 837DF014                cmp dword ptr [ebp-10], 00000014
:0043FF91 771B                    ja 0043FFAE
:0043FF93 8B55F0                  mov edx, dword ptr [ebp-10]
:0043FF96 33C9                    xor ecx, ecx
:0043FF98 8A8AD8FF4300            mov cl, byte ptr [edx+0043FFD8]
:0043FF9E FF248DBCFF4300          jmp dword ptr [4*ecx+0043FFBC]
:0043FFA5 C745FC01000000          mov [ebp-04], 00000001
:0043FFAC EB07                    jmp 0043FFB5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043FF91(C)
|
:0043FFAE C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043FFAC(U)
|
:0043FFB5 8B45FC                  mov eax, dword ptr [ebp-04]
:0043FFB8 8BE5                    mov esp, ebp
:0043FFBA 5D                      pop ebp
:0043FFBB C3                      ret



:0043FFBC A5FF4300                DWORD 0043FFA5
:0043FFC0 A5FF4300                DWORD 0043FFA5
:0043FFC4 A5FF4300                DWORD 0043FFA5
:0043FFC8 A5FF4300                DWORD 0043FFA5
:0043FFCC A5FF4300                DWORD 0043FFA5
:0043FFD0 A5FF4300                DWORD 0043FFA5
:0043FFD4 AEFF4300                DWORD 0043FFAE


:0043FFD8 0006                    add byte ptr [esi], al
:0043FFDA 06                      push es
:0043FFDB 0101                    add dword ptr [ecx], eax
:0043FFDD 06                      push es
:0043FFDE 06                      push es
:0043FFDF 06                      push es
:0043FFE0 06                      push es
:0043FFE1 06                      push es
:0043FFE2 06                      push es
:0043FFE3 06                      push es
:0043FFE4 06                      push es
:0043FFE5 0302                    add eax, dword ptr [edx]
:0043FFE7 06                      push es
:0043FFE8 06                      push es
:0043FFE9 0406                    add al, 06
:0043FFEB 06                      push es
:0043FFEC 05                      BYTE 05h


* Referenced by a CALL at Addresses:
|:00420C20   , :00420D35   , :00420D95   , :00438C04   , :00439CC0   
|:00439F69   , :0044DCC8   
|
:0043FFED 55                      push ebp
:0043FFEE 8BEC                    mov ebp, esp
:0043FFF0 83EC10                  sub esp, 00000010
:0043FFF3 894DF4                  mov dword ptr [ebp-0C], ecx
:0043FFF6 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0043FFF9 E872B4FFFF              call 0043B470
:0043FFFE 8845F8                  mov byte ptr [ebp-08], al
:00440001 8B45F8                  mov eax, dword ptr [ebp-08]
:00440004 25FF000000              and eax, 000000FF
:00440009 8945F0                  mov dword ptr [ebp-10], eax
:0044000C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044000F 83E908                  sub ecx, 00000008
:00440012 894DF0                  mov dword ptr [ebp-10], ecx
:00440015 837DF00C                cmp dword ptr [ebp-10], 0000000C
:00440019 771B                    ja 00440036
:0044001B 8B45F0                  mov eax, dword ptr [ebp-10]
:0044001E 33D2                    xor edx, edx
:00440020 8A9050004400            mov dl, byte ptr [eax+00440050]
:00440026 FF249544004400          jmp dword ptr [4*edx+00440044]
:0044002D C745FC01000000          mov [ebp-04], 00000001
:00440034 EB07                    jmp 0044003D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440019(C)
|
:00440036 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440034(U)
|
:0044003D 8B45FC                  mov eax, dword ptr [ebp-04]
:00440040 8BE5                    mov esp, ebp
:00440042 5D                      pop ebp
:00440043 C3                      ret



:00440044 2D004400                DWORD 0044002D
:00440048 2D004400                DWORD 0044002D
:0044004C 36004400                DWORD 00440036


:00440050 000000                  BYTE  3 DUP(0)


:00440053 0202                    add al, byte ptr [edx]
:00440055 0200                    add al, byte ptr [eax]
:00440057 0202                    add al, byte ptr [edx]
:00440059 0201                    add al, byte ptr [ecx]
:0044005B 0101                    add dword ptr [ecx], eax

* Referenced by a CALL at Addresses:
|:0043B5BA   , :0044DDAC   
|
:0044005D 55                      push ebp
:0044005E 8BEC                    mov ebp, esp
:00440060 83EC10                  sub esp, 00000010
:00440063 894DF4                  mov dword ptr [ebp-0C], ecx
:00440066 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00440069 E802B4FFFF              call 0043B470
:0044006E 8845F8                  mov byte ptr [ebp-08], al
:00440071 8A45F8                  mov al, byte ptr [ebp-08]
:00440074 8845F0                  mov byte ptr [ebp-10], al
:00440077 807DF002                cmp byte ptr [ebp-10], 02
:0044007B 740E                    je 0044008B
:0044007D 807DF003                cmp byte ptr [ebp-10], 03
:00440081 7611                    jbe 00440094
:00440083 807DF005                cmp byte ptr [ebp-10], 05
:00440087 7602                    jbe 0044008B
:00440089 EB09                    jmp 00440094

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044007B(C), :00440087(C)
|
:0044008B C745FC01000000          mov [ebp-04], 00000001
:00440092 EB07                    jmp 0044009B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00440081(C), :00440089(U)
|
:00440094 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440092(U)
|
:0044009B 8B45FC                  mov eax, dword ptr [ebp-04]
:0044009E 8BE5                    mov esp, ebp
:004400A0 5D                      pop ebp
:004400A1 C3                      ret



* Referenced by a CALL at Addresses:
|:00404905   , :004049D7   , :00445E49   , :0044602C   
|
:004400A2 55                      push ebp
:004400A3 8BEC                    mov ebp, esp
:004400A5 83EC10                  sub esp, 00000010
:004400A8 894DF4                  mov dword ptr [ebp-0C], ecx
:004400AB 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004400AE E8BDB3FFFF              call 0043B470
:004400B3 8845F8                  mov byte ptr [ebp-08], al
:004400B6 8A45F8                  mov al, byte ptr [ebp-08]
:004400B9 8845F0                  mov byte ptr [ebp-10], al
:004400BC 807DF002                cmp byte ptr [ebp-10], 02
:004400C0 7408                    je 004400CA
:004400C2 807DF004                cmp byte ptr [ebp-10], 04
:004400C6 7402                    je 004400CA
:004400C8 EB09                    jmp 004400D3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004400C0(C), :004400C6(C)
|
:004400CA C745FC01000000          mov [ebp-04], 00000001
:004400D1 EB07                    jmp 004400DA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004400C8(U)
|
:004400D3 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004400D1(U)
|
:004400DA 8B45FC                  mov eax, dword ptr [ebp-04]
:004400DD 8BE5                    mov esp, ebp
:004400DF 5D                      pop ebp
:004400E0 C3                      ret



* Referenced by a CALL at Address:
|:004048E3   
|
:004400E1 55                      push ebp
:004400E2 8BEC                    mov ebp, esp
:004400E4 83EC10                  sub esp, 00000010
:004400E7 894DF4                  mov dword ptr [ebp-0C], ecx
:004400EA 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004400ED E87EB3FFFF              call 0043B470
:004400F2 8845F8                  mov byte ptr [ebp-08], al
:004400F5 8B45F8                  mov eax, dword ptr [ebp-08]
:004400F8 25FF000000              and eax, 000000FF
:004400FD 8945F0                  mov dword ptr [ebp-10], eax
:00440100 837DF012                cmp dword ptr [ebp-10], 00000012
:00440104 771B                    ja 00440121
:00440106 8B55F0                  mov edx, dword ptr [ebp-10]
:00440109 33C9                    xor ecx, ecx
:0044010B 8A8A47014400            mov cl, byte ptr [edx+00440147]
:00440111 FF248D2F014400          jmp dword ptr [4*ecx+0044012F]
:00440118 C745FC01000000          mov [ebp-04], 00000001
:0044011F EB07                    jmp 00440128

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440104(C)
|
:00440121 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044011F(U)
|
:00440128 8B45FC                  mov eax, dword ptr [ebp-04]
:0044012B 8BE5                    mov esp, ebp
:0044012D 5D                      pop ebp
:0044012E C3                      ret



:0044012F 18014400                DWORD 00440118
:00440133 18014400                DWORD 00440118
:00440137 18014400                DWORD 00440118
:0044013B 18014400                DWORD 00440118
:0044013F 18014400                DWORD 00440118
:00440143 21014400                DWORD 00440121


:00440147 0000                    add byte ptr [eax], al
:00440149 0505050505              add eax, 05050505
:0044014E 010502020505            add dword ptr [05050202], eax
:00440154 0503030505              add eax, 05050303
:00440159 04                      BYTE 04h


* Referenced by a CALL at Address:
|:0043E5CF   
|
:0044015A 55                      push ebp
:0044015B 8BEC                    mov ebp, esp
:0044015D 83EC08                  sub esp, 00000008
:00440160 894DF8                  mov dword ptr [ebp-08], ecx
:00440163 8B45F8                  mov eax, dword ptr [ebp-08]
:00440166 8B08                    mov ecx, dword ptr [eax]
:00440168 6BC948                  imul ecx, 00000048
:0044016B 81C1681B4A00            add ecx, 004A1B68
:00440171 E8A570FCFF              call 0040721B
:00440176 8945FC                  mov dword ptr [ebp-04], eax
:00440179 8B45FC                  mov eax, dword ptr [ebp-04]
:0044017C 33D2                    xor edx, edx
:0044017E B905000000              mov ecx, 00000005
:00440183 F7F1                    div ecx
:00440185 8B55F8                  mov edx, dword ptr [ebp-08]
:00440188 394210                  cmp dword ptr [edx+10], eax
:0044018B 720E                    jb 0044019B
:0044018D 6A20                    push 00000020
:0044018F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00440192 E85959FEFF              call 00425AF0
:00440197 85C0                    test eax, eax
:00440199 7407                    je 004401A2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044018B(C)
|
:0044019B B801000000              mov eax, 00000001
:004401A0 EB02                    jmp 004401A4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440199(C)
|
:004401A2 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004401A0(U)
|
:004401A4 8BE5                    mov esp, ebp
:004401A6 5D                      pop ebp
:004401A7 C3                      ret



* Referenced by a CALL at Addresses:
|:0043D6BA   , :004426AC   
|
:004401A8 55                      push ebp
:004401A9 8BEC                    mov ebp, esp
:004401AB 83EC0C                  sub esp, 0000000C
:004401AE 894DF8                  mov dword ptr [ebp-08], ecx
:004401B1 6A04                    push 00000004
:004401B3 6A00                    push 00000000
:004401B5 8B4508                  mov eax, dword ptr [ebp+08]
:004401B8 33C9                    xor ecx, ecx
:004401BA 8A08                    mov cl, byte ptr [eax]
:004401BC 8B5508                  mov edx, dword ptr [ebp+08]
:004401BF 33C0                    xor eax, eax
:004401C1 8A4201                  mov al, byte ptr [edx+01]
:004401C4 33D2                    xor edx, edx
:004401C6 8A152C424B00            mov dl, byte ptr [004B422C]
:004401CC 0FAFC2                  imul eax, edx
:004401CF 8D8401800C0000          lea eax, dword ptr [ecx+eax+00000C80]
:004401D6 50                      push eax
:004401D7 B938EB4A00              mov ecx, 004AEB38
:004401DC E85FF80300              call 0047FA40
:004401E1 8A08                    mov cl, byte ptr [eax]
:004401E3 884DFC                  mov byte ptr [ebp-04], cl
:004401E6 8B55FC                  mov edx, dword ptr [ebp-04]
:004401E9 81E2FF000000            and edx, 000000FF
:004401EF 81FAFF000000            cmp edx, 000000FF
:004401F5 7421                    je 00440218
:004401F7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004401FA 81E1FF000000            and ecx, 000000FF
:00440200 6BC924                  imul ecx, 00000024
:00440203 81C1502C4B00            add ecx, 004B2C50
:00440209 E8828AFDFF              call 00418C90
:0044020E 25FF000000              and eax, 000000FF
:00440213 83F801                  cmp eax, 00000001
:00440216 752A                    jne 00440242

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004401F5(C)
|
:00440218 8B4508                  mov eax, dword ptr [ebp+08]
:0044021B 50                      push eax
:0044021C E87057FFFF              call 00435991
:00440221 83C404                  add esp, 00000004
:00440224 50                      push eax
:00440225 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00440228 E8A2F5FFFF              call 0043F7CF
:0044022D 25FF000000              and eax, 000000FF
:00440232 3DFF000000              cmp eax, 000000FF
:00440237 7409                    je 00440242
:00440239 C745F401000000          mov [ebp-0C], 00000001
:00440240 EB07                    jmp 00440249

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00440216(C), :00440237(C)
|
:00440242 C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440240(U)
|
:00440249 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044024C 8BE5                    mov esp, ebp
:0044024E 5D                      pop ebp
:0044024F C20400                  ret 0004



* Referenced by a CALL at Address:
|:0043B362   
|
:00440252 55                      push ebp
:00440253 8BEC                    mov ebp, esp
:00440255 83EC08                  sub esp, 00000008
:00440258 894DF8                  mov dword ptr [ebp-08], ecx
:0044025B C745FC00000000          mov [ebp-04], 00000000
:00440262 8B45F8                  mov eax, dword ptr [ebp-08]
:00440265 33C9                    xor ecx, ecx
:00440267 8A4808                  mov cl, byte ptr [eax+08]
:0044026A 81F9FF000000            cmp ecx, 000000FF
:00440270 7423                    je 00440295
:00440272 8B55F8                  mov edx, dword ptr [ebp-08]
:00440275 8A4208                  mov al, byte ptr [edx+08]
:00440278 50                      push eax
:00440279 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044027C 8A5104                  mov dl, byte ptr [ecx+04]
:0044027F 52                      push edx
:00440280 E877000000              call 004402FC
:00440285 83C408                  add esp, 00000008
:00440288 85C0                    test eax, eax
:0044028A 7407                    je 00440293
:0044028C C745FC01000000          mov [ebp-04], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044028A(C)
|
:00440293 EB60                    jmp 004402F5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440270(C)
|
:00440295 8B45F8                  mov eax, dword ptr [ebp-08]
:00440298 83C006                  add eax, 00000006
:0044029B 50                      push eax
:0044029C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044029F 83C109                  add ecx, 00000009
:004402A2 51                      push ecx
:004402A3 E878B1FFFF              call 0043B420
:004402A8 83C408                  add esp, 00000008
:004402AB 85C0                    test eax, eax
:004402AD 7446                    je 004402F5
:004402AF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004402B2 E81958FEFF              call 00425AD0
:004402B7 25FF000000              and eax, 000000FF
:004402BC 85C0                    test eax, eax
:004402BE 7412                    je 004402D2
:004402C0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004402C3 E80858FEFF              call 00425AD0
:004402C8 25FF000000              and eax, 000000FF
:004402CD 83F804                  cmp eax, 00000004
:004402D0 751C                    jne 004402EE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004402BE(C)
|
:004402D2 8B55F8                  mov edx, dword ptr [ebp-08]
:004402D5 83C206                  add edx, 00000006
:004402D8 52                      push edx
:004402D9 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004402DC 83C109                  add ecx, 00000009
:004402DF E8BC62FCFF              call 004065A0
:004402E4 6A03                    push 00000003
:004402E6 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004402E9 E87B230000              call 00442669

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004402D0(C)
|
:004402EE C745FC01000000          mov [ebp-04], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00440293(U), :004402AD(C)
|
:004402F5 8B45FC                  mov eax, dword ptr [ebp-04]
:004402F8 8BE5                    mov esp, ebp
:004402FA 5D                      pop ebp
:004402FB C3                      ret



* Referenced by a CALL at Address:
|:00440280   
|
:004402FC 55                      push ebp
:004402FD 8BEC                    mov ebp, esp
:004402FF 83EC0C                  sub esp, 0000000C
:00440302 8B4D08                  mov ecx, dword ptr [ebp+08]
:00440305 81E1FF000000            and ecx, 000000FF
:0044030B 6BC924                  imul ecx, 00000024
:0044030E 81C1502C4B00            add ecx, 004B2C50
:00440314 E84730FCFF              call 00403360
:00440319 668B00                  mov ax, word ptr [eax]
:0044031C 668945F8                mov word ptr [ebp-08], ax
:00440320 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00440323 E8E8F30100              call 0045F710
:00440328 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0044032B 81E1FF000000            and ecx, 000000FF
:00440331 81F9FF000000            cmp ecx, 000000FF
:00440337 746B                    je 004403A4
:00440339 C645F400                mov [ebp-0C], 00
:0044033D EB09                    jmp 00440348

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004403A2(U)
|
:0044033F 8A55F4                  mov dl, byte ptr [ebp-0C]
:00440342 80C201                  add dl, 01
:00440345 8855F4                  mov byte ptr [ebp-0C], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044033D(U)
|
:00440348 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044034B 25FF000000              and eax, 000000FF
:00440350 83F804                  cmp eax, 00000004
:00440353 7D4F                    jge 004403A4
:00440355 8A4DF4                  mov cl, byte ptr [ebp-0C]
:00440358 51                      push ecx
:00440359 8D55F8                  lea edx, dword ptr [ebp-08]
:0044035C 52                      push edx
:0044035D E89356FFFF              call 004359F5
:00440362 83C408                  add esp, 00000008
:00440365 50                      push eax
:00440366 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00440369 E83262FCFF              call 004065A0
:0044036E 8B45FC                  mov eax, dword ptr [ebp-04]
:00440371 25FF000000              and eax, 000000FF
:00440376 3DFF000000              cmp eax, 000000FF
:0044037B 7425                    je 004403A2
:0044037D 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00440380 51                      push ecx
:00440381 E8FE54FFFF              call 00435884
:00440386 83C404                  add esp, 00000004
:00440389 25FF000000              and eax, 000000FF
:0044038E 8B550C                  mov edx, dword ptr [ebp+0C]
:00440391 81E2FF000000            and edx, 000000FF
:00440397 3BC2                    cmp eax, edx
:00440399 7507                    jne 004403A2
:0044039B B801000000              mov eax, 00000001
:004403A0 EB04                    jmp 004403A6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044037B(C), :00440399(C)
|
:004403A2 EB9B                    jmp 0044033F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00440337(C), :00440353(C)
|
:004403A4 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004403A0(U)
|
:004403A6 8BE5                    mov esp, ebp
:004403A8 5D                      pop ebp
:004403A9 C3                      ret



* Referenced by a CALL at Addresses:
|:0044058B   , :00443838   
|
:004403AA 55                      push ebp
:004403AB 8BEC                    mov ebp, esp
:004403AD 83EC10                  sub esp, 00000010
:004403B0 894DF4                  mov dword ptr [ebp-0C], ecx
:004403B3 C645FC12                mov [ebp-04], 12
:004403B7 C645F81F                mov [ebp-08], 1F
:004403BB 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004403BE E857F8FFFF              call 0043FC1A
:004403C3 25FF000000              and eax, 000000FF
:004403C8 8945F0                  mov dword ptr [ebp-10], eax
:004403CB 837DF003                cmp dword ptr [ebp-10], 00000003
:004403CF 7738                    ja 00440409
:004403D1 8B45F0                  mov eax, dword ptr [ebp-10]
:004403D4 FF24858E044400          jmp dword ptr [4*eax+0044048E]
:004403DB C645F82A                mov [ebp-08], 2A
:004403DF 837D0800                cmp dword ptr [ebp+08], 00000000
:004403E3 7412                    je 004403F7
:004403E5 6A02                    push 00000002
:004403E7 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004403EA E80157FEFF              call 00425AF0
:004403EF 85C0                    test eax, eax
:004403F1 7404                    je 004403F7
:004403F3 C645FC18                mov [ebp-04], 18

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004403E3(C), :004403F1(C)
|
:004403F7 EB10                    jmp 00440409
:004403F9 C645F8AD                mov [ebp-08], AD
:004403FD EB0A                    jmp 00440409
:004403FF C645F8AC                mov [ebp-08], AC
:00440403 EB04                    jmp 00440409
:00440405 C645F8AC                mov [ebp-08], AC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004403CF(C), :004403F7(U), :004403FD(U), :00440403(U)
|
:00440409 6A04                    push 00000004
:0044040B B9382F4900              mov ecx, 00492F38
:00440410 E821E9FCFF              call 0040ED36
:00440415 6A01                    push 00000001
:00440417 B9382F4900              mov ecx, 00492F38
:0044041C E8E9E8FCFF              call 0040ED0A
:00440421 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00440424 81E1FF000000            and ecx, 000000FF
:0044042A 51                      push ecx
:0044042B B9382F4900              mov ecx, 00492F38
:00440430 E84FE8FCFF              call 0040EC84
:00440435 8B55F8                  mov edx, dword ptr [ebp-08]
:00440438 81E2FF000000            and edx, 000000FF
:0044043E 52                      push edx
:0044043F B9382F4900              mov ecx, 00492F38
:00440444 E8ABE8FCFF              call 0040ECF4
:00440449 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044044C E88F2C0000              call 004430E0
:00440451 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:00440452 6850E04800              push 0048E050
:00440457 68382F4900              push 00492F38
:0044045C E83FF6FCFF              call 0040FAA0
:00440461 83C40C                  add esp, 0000000C
:00440464 6A12                    push 00000012
:00440466 B9382F4900              mov ecx, 00492F38
:0044046B E814E8FCFF              call 0040EC84
:00440470 6A00                    push 00000000
:00440472 B9382F4900              mov ecx, 00492F38
:00440477 E878E8FCFF              call 0040ECF4
:0044047C 6A00                    push 00000000
:0044047E B9382F4900              mov ecx, 00492F38
:00440483 E882E8FCFF              call 0040ED0A
:00440488 8BE5                    mov esp, ebp
:0044048A 5D                      pop ebp
:0044048B C20400                  ret 0004



:0044048E DB034400                DWORD 004403DB
:00440492 F9034400                DWORD 004403F9
:00440496 FF034400                DWORD 004403FF
:0044049A 05044400                DWORD 00440405



* Referenced by a CALL at Addresses:
|:00416F31   , :00433661   , :004338D1   , :0043466B   , :004414CB   
|:0044E30E   , :00454440   , :00454459   , :00455332   
|
:0044049E 55                      push ebp
:0044049F 8BEC                    mov ebp, esp
:004404A1 51                      push ecx
:004404A2 894DFC                  mov dword ptr [ebp-04], ecx
:004404A5 68FF000000              push 000000FF
:004404AA 68FF000000              push 000000FF
:004404AF 6A00                    push 00000000
:004404B1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004404B4 E804000000              call 004404BD
:004404B9 8BE5                    mov esp, ebp
:004404BB 5D                      pop ebp
:004404BC C3                      ret



* Referenced by a CALL at Addresses:
|:004404B4   , :004415DD   , :004416A2   , :00454427   
|
:004404BD 55                      push ebp
:004404BE 8BEC                    mov ebp, esp
:004404C0 83EC30                  sub esp, 00000030
:004404C3 56                      push esi
:004404C4 894DD8                  mov dword ptr [ebp-28], ecx
:004404C7 8B45D8                  mov eax, dword ptr [ebp-28]
:004404CA 8B08                    mov ecx, dword ptr [eax]
:004404CC 6BC948                  imul ecx, 00000048
:004404CF 81C1681B4A00            add ecx, 004A1B68
:004404D5 894DF0                  mov dword ptr [ebp-10], ecx
:004404D8 8A550C                  mov dl, byte ptr [ebp+0C]
:004404DB 52                      push edx
:004404DC 6A02                    push 00000002
:004404DE 6A04                    push 00000004
:004404E0 8B45D8                  mov eax, dword ptr [ebp-28]
:004404E3 668B4806                mov cx, word ptr [eax+06]
:004404E7 51                      push ecx
:004404E8 8D55E4                  lea edx, dword ptr [ebp-1C]
:004404EB 52                      push edx
:004404EC E85AF70000              call 0044FC4B
:004404F1 83C414                  add esp, 00000014
:004404F4 8A45E4                  mov al, byte ptr [ebp-1C]
:004404F7 8845F4                  mov byte ptr [ebp-0C], al
:004404FA 8A4DE5                  mov cl, byte ptr [ebp-1B]
:004404FD 884DF8                  mov byte ptr [ebp-08], cl
:00440500 E8D6E0FDFF              call 0041E5DB
:00440505 6A02                    push 00000002
:00440507 6A04                    push 00000004
:00440509 8A55F8                  mov dl, byte ptr [ebp-08]
:0044050C 52                      push edx
:0044050D 8A45F4                  mov al, byte ptr [ebp-0C]
:00440510 50                      push eax
:00440511 B950424B00              mov ecx, 004B4250
:00440516 E8FC360100              call 00453C17
:0044051B 6A1F                    push 0000001F
:0044051D 6A12                    push 00000012
:0044051F 6A00                    push 00000000
:00440521 E8CBCC0300              call 0047D1F1
:00440526 83C40C                  add esp, 0000000C
:00440529 8B75F4                  mov esi, dword ptr [ebp-0C]
:0044052C 81E6FF000000            and esi, 000000FF
:00440532 6BF630                  imul esi, 00000030
:00440535 B950424B00              mov ecx, 004B4250
:0044053A E810150100              call 00451A4F
:0044053F 03C6                    add eax, esi
:00440541 99                      cdq
:00440542 83E207                  and edx, 00000007
:00440545 03C2                    add eax, edx
:00440547 C1F803                  sar eax, 03
:0044054A 83C001                  add eax, 00000001
:0044054D 8945E0                  mov dword ptr [ebp-20], eax
:00440550 8B75F8                  mov esi, dword ptr [ebp-08]
:00440553 81E6FF000000            and esi, 000000FF
:00440559 6BF630                  imul esi, 00000030
:0044055C B950424B00              mov ecx, 004B4250
:00440561 E8FA140100              call 00451A60
:00440566 03F0                    add esi, eax
:00440568 8975EC                  mov dword ptr [ebp-14], esi
:0044056B 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0044056E 83C104                  add ecx, 00000004
:00440571 894DEC                  mov dword ptr [ebp-14], ecx
:00440574 8B55EC                  mov edx, dword ptr [ebp-14]
:00440577 52                      push edx
:00440578 8B45E0                  mov eax, dword ptr [ebp-20]
:0044057B 50                      push eax
:0044057C B9382F4900              mov ecx, 00492F38
:00440581 E851E6FCFF              call 0040EBD7
:00440586 6A01                    push 00000001
:00440588 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0044058B E81AFEFFFF              call 004403AA
:00440590 6A04                    push 00000004
:00440592 B9382F4900              mov ecx, 00492F38
:00440597 E89AE7FCFF              call 0040ED36
:0044059C 6A00                    push 00000000
:0044059E B9382F4900              mov ecx, 00492F38
:004405A3 E862E7FCFF              call 0040ED0A
:004405A8 6A12                    push 00000012
:004405AA B9382F4900              mov ecx, 00492F38
:004405AF E8D0E6FCFF              call 0040EC84
:004405B4 6A00                    push 00000000
:004405B6 B9382F4900              mov ecx, 00492F38
:004405BB E8FCE6FCFF              call 0040ECBC
:004405C0 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004405C3 51                      push ecx
:004405C4 8B55E0                  mov edx, dword ptr [ebp-20]
:004405C7 83C209                  add edx, 00000009
:004405CA 52                      push edx
:004405CB B9382F4900              mov ecx, 00492F38
:004405D0 E802E6FCFF              call 0040EBD7
:004405D5 8B4DD8                  mov ecx, dword ptr [ebp-28]
:004405D8 E893D9FDFF              call 0041DF70
:004405DD 25FF000000              and eax, 000000FF
:004405E2 8B0485A8BE4800          mov eax, dword ptr [4*eax+0048BEA8]
:004405E9 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:004405EA 6854E04800              push 0048E054
:004405EF 68382F4900              push 00492F38
:004405F4 E8A7F4FCFF              call 0040FAA0
:004405F9 83C40C                  add esp, 0000000C
:004405FC 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004405FF E8CC5FFCFF              call 004065D0
:00440604 25FF000000              and eax, 000000FF
:00440609 50                      push eax

* Possible StringData Ref from Data Obj ->" Lv%2u"
                                  |
:0044060A 6858E04800              push 0048E058
:0044060F 68382F4900              push 00492F38
:00440614 E887F4FCFF              call 0040FAA0
:00440619 83C40C                  add esp, 0000000C
:0044061C C745E800000000          mov [ebp-18], 00000000
:00440623 C745FC00000000          mov [ebp-04], 00000000
:0044062A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044062D 81E1FF000000            and ecx, 000000FF
:00440633 85C9                    test ecx, ecx
:00440635 7532                    jne 00440669
:00440637 8B55D8                  mov edx, dword ptr [ebp-28]
:0044063A 8B4210                  mov eax, dword ptr [edx+10]
:0044063D 50                      push eax
:0044063E 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00440641 51                      push ecx
:00440642 8B55EC                  mov edx, dword ptr [ebp-14]
:00440645 83C214                  add edx, 00000014
:00440648 8955EC                  mov dword ptr [ebp-14], edx
:0044064B 8B45EC                  mov eax, dword ptr [ebp-14]
:0044064E 50                      push eax
:0044064F 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00440652 8D14CD28000000          lea edx, dword ptr [8*ecx+00000028]
:00440659 52                      push edx
:0044065A 6A00                    push 00000000
:0044065C E83E0B0100              call 0045119F
:00440661 83C414                  add esp, 00000014
:00440664 E915030000              jmp 0044097E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440635(C)
|
:00440669 8B4508                  mov eax, dword ptr [ebp+08]
:0044066C 25FF000000              and eax, 000000FF
:00440671 8945D4                  mov dword ptr [ebp-2C], eax
:00440674 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00440677 83E901                  sub ecx, 00000001
:0044067A 894DD4                  mov dword ptr [ebp-2C], ecx
:0044067D 837DD403                cmp dword ptr [ebp-2C], 00000003
:00440681 0F87F7020000            ja 0044097E
:00440687 8B55D4                  mov edx, dword ptr [ebp-2C]
:0044068A FF2495790E4400          jmp dword ptr [4*edx+00440E79]
:00440691 6A00                    push 00000000
:00440693 6A00                    push 00000000
:00440695 8B45F0                  mov eax, dword ptr [ebp-10]
:00440698 50                      push eax
:00440699 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0044069C 81E1FF000000            and ecx, 000000FF
:004406A2 6BC924                  imul ecx, 00000024
:004406A5 81C1502C4B00            add ecx, 004B2C50
:004406AB E89BB5FFFF              call 0043BC4B
:004406B0 8945E8                  mov dword ptr [ebp-18], eax
:004406B3 8A4D10                  mov cl, byte ptr [ebp+10]
:004406B6 51                      push ecx
:004406B7 8B550C                  mov edx, dword ptr [ebp+0C]
:004406BA 81E2FF000000            and edx, 000000FF
:004406C0 6BD224                  imul edx, 00000024
:004406C3 81C2502C4B00            add edx, 004B2C50
:004406C9 52                      push edx
:004406CA 6A01                    push 00000001
:004406CC 8B4DD8                  mov ecx, dword ptr [ebp-28]
:004406CF E839AEFFFF              call 0043B50D
:004406D4 8945FC                  mov dword ptr [ebp-04], eax
:004406D7 6A01                    push 00000001
:004406D9 8B45D8                  mov eax, dword ptr [ebp-28]
:004406DC 8B4810                  mov ecx, dword ptr [eax+10]
:004406DF 2B4DE8                  sub ecx, dword ptr [ebp-18]
:004406E2 51                      push ecx
:004406E3 8B55D8                  mov edx, dword ptr [ebp-28]
:004406E6 8B4210                  mov eax, dword ptr [edx+10]
:004406E9 50                      push eax
:004406EA 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004406ED 51                      push ecx
:004406EE 8B55EC                  mov edx, dword ptr [ebp-14]
:004406F1 83C214                  add edx, 00000014
:004406F4 8955EC                  mov dword ptr [ebp-14], edx
:004406F7 8B45EC                  mov eax, dword ptr [ebp-14]
:004406FA 50                      push eax
:004406FB 8B4DE0                  mov ecx, dword ptr [ebp-20]
:004406FE 8D14CD28000000          lea edx, dword ptr [8*ecx+00000028]
:00440705 52                      push edx
:00440706 6A00                    push 00000000
:00440708 E8C8070100              call 00450ED5
:0044070D 83C41C                  add esp, 0000001C
:00440710 E969020000              jmp 0044097E
:00440715 8A4510                  mov al, byte ptr [ebp+10]
:00440718 50                      push eax
:00440719 E88E940000              call 00449BAC
:0044071E 83C404                  add esp, 00000004
:00440721 85C0                    test eax, eax
:00440723 7475                    je 0044079A
:00440725 6A01                    push 00000001
:00440727 8A4D10                  mov cl, byte ptr [ebp+10]
:0044072A 51                      push ecx
:0044072B 8B55F0                  mov edx, dword ptr [ebp-10]
:0044072E 52                      push edx
:0044072F 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00440732 E879BBFDFF              call 0041C2B0
:00440737 25FF000000              and eax, 000000FF
:0044073C 6BC024                  imul eax, 00000024
:0044073F 05502C4B00              add eax, 004B2C50
:00440744 50                      push eax
:00440745 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00440748 81E1FF000000            and ecx, 000000FF
:0044074E 6BC924                  imul ecx, 00000024
:00440751 81C1502C4B00            add ecx, 004B2C50
:00440757 E84EB8FFFF              call 0043BFAA
:0044075C 8945E8                  mov dword ptr [ebp-18], eax
:0044075F 6A02                    push 00000002
:00440761 8B45D8                  mov eax, dword ptr [ebp-28]
:00440764 8B4810                  mov ecx, dword ptr [eax+10]
:00440767 2B4DE8                  sub ecx, dword ptr [ebp-18]
:0044076A 51                      push ecx
:0044076B 8B55D8                  mov edx, dword ptr [ebp-28]
:0044076E 8B4210                  mov eax, dword ptr [edx+10]
:00440771 50                      push eax
:00440772 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00440775 51                      push ecx
:00440776 8B55EC                  mov edx, dword ptr [ebp-14]
:00440779 83C214                  add edx, 00000014
:0044077C 8955EC                  mov dword ptr [ebp-14], edx
:0044077F 8B45EC                  mov eax, dword ptr [ebp-14]
:00440782 50                      push eax
:00440783 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00440786 8D14CD28000000          lea edx, dword ptr [8*ecx+00000028]
:0044078D 52                      push edx
:0044078E 6A00                    push 00000000
:00440790 E840070100              call 00450ED5
:00440795 83C41C                  add esp, 0000001C
:00440798 EB2D                    jmp 004407C7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440723(C)
|
:0044079A 8B45D8                  mov eax, dword ptr [ebp-28]
:0044079D 8B4810                  mov ecx, dword ptr [eax+10]
:004407A0 51                      push ecx
:004407A1 8B55F0                  mov edx, dword ptr [ebp-10]
:004407A4 52                      push edx
:004407A5 8B45EC                  mov eax, dword ptr [ebp-14]
:004407A8 83C014                  add eax, 00000014
:004407AB 8945EC                  mov dword ptr [ebp-14], eax
:004407AE 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004407B1 51                      push ecx
:004407B2 8B55E0                  mov edx, dword ptr [ebp-20]
:004407B5 8D04D528000000          lea eax, dword ptr [8*edx+00000028]
:004407BC 50                      push eax
:004407BD 6A00                    push 00000000
:004407BF E8DB090100              call 0045119F
:004407C4 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440798(U)
|
:004407C7 8A4D10                  mov cl, byte ptr [ebp+10]
:004407CA 51                      push ecx
:004407CB 8B550C                  mov edx, dword ptr [ebp+0C]
:004407CE 81E2FF000000            and edx, 000000FF
:004407D4 6BD224                  imul edx, 00000024
:004407D7 81C2502C4B00            add edx, 004B2C50
:004407DD 52                      push edx
:004407DE 6A01                    push 00000001
:004407E0 8B4DD8                  mov ecx, dword ptr [ebp-28]
:004407E3 E857AFFFFF              call 0043B73F
:004407E8 8945FC                  mov dword ptr [ebp-04], eax
:004407EB E98E010000              jmp 0044097E
:004407F0 8A4510                  mov al, byte ptr [ebp+10]
:004407F3 50                      push eax
:004407F4 E85C940000              call 00449C55
:004407F9 83C404                  add esp, 00000004
:004407FC 85C0                    test eax, eax
:004407FE 7450                    je 00440850
:00440800 6A01                    push 00000001
:00440802 8A4D0C                  mov cl, byte ptr [ebp+0C]
:00440805 51                      push ecx
:00440806 8A5510                  mov dl, byte ptr [ebp+10]
:00440809 52                      push edx
:0044080A 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0044080D E836BDFFFF              call 0043C548
:00440812 8945E8                  mov dword ptr [ebp-18], eax
:00440815 6A03                    push 00000003
:00440817 8B45D8                  mov eax, dword ptr [ebp-28]
:0044081A 8B4810                  mov ecx, dword ptr [eax+10]
:0044081D 034DE8                  add ecx, dword ptr [ebp-18]
:00440820 51                      push ecx
:00440821 8B55D8                  mov edx, dword ptr [ebp-28]
:00440824 8B4210                  mov eax, dword ptr [edx+10]
:00440827 50                      push eax
:00440828 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044082B 51                      push ecx
:0044082C 8B55EC                  mov edx, dword ptr [ebp-14]
:0044082F 83C214                  add edx, 00000014
:00440832 8955EC                  mov dword ptr [ebp-14], edx
:00440835 8B45EC                  mov eax, dword ptr [ebp-14]
:00440838 50                      push eax
:00440839 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0044083C 8D14CD28000000          lea edx, dword ptr [8*ecx+00000028]
:00440843 52                      push edx
:00440844 6A00                    push 00000000
:00440846 E88A060100              call 00450ED5
:0044084B 83C41C                  add esp, 0000001C
:0044084E EB2D                    jmp 0044087D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004407FE(C)
|
:00440850 8B45D8                  mov eax, dword ptr [ebp-28]
:00440853 8B4810                  mov ecx, dword ptr [eax+10]
:00440856 51                      push ecx
:00440857 8B55F0                  mov edx, dword ptr [ebp-10]
:0044085A 52                      push edx
:0044085B 8B45EC                  mov eax, dword ptr [ebp-14]
:0044085E 83C014                  add eax, 00000014
:00440861 8945EC                  mov dword ptr [ebp-14], eax
:00440864 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00440867 51                      push ecx
:00440868 8B55E0                  mov edx, dword ptr [ebp-20]
:0044086B 8D04D528000000          lea eax, dword ptr [8*edx+00000028]
:00440872 50                      push eax
:00440873 6A00                    push 00000000
:00440875 E825090100              call 0045119F
:0044087A 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044084E(U)
|
:0044087D 8A4D10                  mov cl, byte ptr [ebp+10]
:00440880 51                      push ecx
:00440881 8B550C                  mov edx, dword ptr [ebp+0C]
:00440884 81E2FF000000            and edx, 000000FF
:0044088A 6BD224                  imul edx, 00000024
:0044088D 81C2502C4B00            add edx, 004B2C50
:00440893 52                      push edx
:00440894 6A01                    push 00000001
:00440896 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00440899 E8A1AEFFFF              call 0043B73F
:0044089E 8945FC                  mov dword ptr [ebp-04], eax
:004408A1 E9D8000000              jmp 0044097E
:004408A6 8B4D10                  mov ecx, dword ptr [ebp+10]
:004408A9 81E1FF000000            and ecx, 000000FF
:004408AF 6BC919                  imul ecx, 00000019
:004408B2 81C140114A00            add ecx, 004A1140
:004408B8 E8838CFCFF              call 00409540
:004408BD 25FF000000              and eax, 000000FF
:004408C2 83F83F                  cmp eax, 0000003F
:004408C5 754C                    jne 00440913
:004408C7 6A01                    push 00000001
:004408C9 8A4510                  mov al, byte ptr [ebp+10]
:004408CC 50                      push eax
:004408CD 8B4DD8                  mov ecx, dword ptr [ebp-28]
:004408D0 E859BBFFFF              call 0043C42E
:004408D5 8945E8                  mov dword ptr [ebp-18], eax
:004408D8 6A04                    push 00000004
:004408DA 8B4DD8                  mov ecx, dword ptr [ebp-28]
:004408DD 8B5110                  mov edx, dword ptr [ecx+10]
:004408E0 0355E8                  add edx, dword ptr [ebp-18]
:004408E3 52                      push edx
:004408E4 8B45D8                  mov eax, dword ptr [ebp-28]
:004408E7 8B4810                  mov ecx, dword ptr [eax+10]
:004408EA 51                      push ecx
:004408EB 8B55F0                  mov edx, dword ptr [ebp-10]
:004408EE 52                      push edx
:004408EF 8B45EC                  mov eax, dword ptr [ebp-14]
:004408F2 83C014                  add eax, 00000014
:004408F5 8945EC                  mov dword ptr [ebp-14], eax
:004408F8 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004408FB 51                      push ecx
:004408FC 8B55E0                  mov edx, dword ptr [ebp-20]
:004408FF 8D04D528000000          lea eax, dword ptr [8*edx+00000028]
:00440906 50                      push eax
:00440907 6A00                    push 00000000
:00440909 E8C7050100              call 00450ED5
:0044090E 83C41C                  add esp, 0000001C
:00440911 EB4C                    jmp 0044095F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004408C5(C)
|
:00440913 8B4D10                  mov ecx, dword ptr [ebp+10]
:00440916 81E1FF000000            and ecx, 000000FF
:0044091C 6BC919                  imul ecx, 00000019
:0044091F 81C140114A00            add ecx, 004A1140
:00440925 E846D4FDFF              call 0041DD70
:0044092A 25FF000000              and eax, 000000FF
:0044092F 8945E8                  mov dword ptr [ebp-18], eax
:00440932 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00440935 8B5110                  mov edx, dword ptr [ecx+10]
:00440938 52                      push edx
:00440939 8B45F0                  mov eax, dword ptr [ebp-10]
:0044093C 50                      push eax
:0044093D 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00440940 83C114                  add ecx, 00000014
:00440943 894DEC                  mov dword ptr [ebp-14], ecx
:00440946 8B55EC                  mov edx, dword ptr [ebp-14]
:00440949 52                      push edx
:0044094A 8B45E0                  mov eax, dword ptr [ebp-20]
:0044094D 8D0CC528000000          lea ecx, dword ptr [8*eax+00000028]
:00440954 51                      push ecx
:00440955 6A00                    push 00000000
:00440957 E843080100              call 0045119F
:0044095C 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440911(U)
|
:0044095F 6A01                    push 00000001
:00440961 8B55D8                  mov edx, dword ptr [ebp-28]
:00440964 8A4204                  mov al, byte ptr [edx+04]
:00440967 50                      push eax
:00440968 8A4D10                  mov cl, byte ptr [ebp+10]
:0044096B 51                      push ecx
:0044096C E878BBFDFF              call 0041C4E9
:00440971 83C40C                  add esp, 0000000C
:00440974 F7D8                    neg eax
:00440976 1BC0                    sbb eax, eax
:00440978 83E064                  and eax, 00000064
:0044097B 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00440664(U), :00440681(C), :00440710(U), :004407EB(U), :004408A1(U)
|
:0044097E 6A04                    push 00000004
:00440980 6A04                    push 00000004
:00440982 6A00                    push 00000000
:00440984 6880010000              push 00000180
:00440989 B950EB4A00              mov ecx, 004AEB50
:0044098E E8ADF00300              call 0047FA40
:00440993 50                      push eax
:00440994 6A18                    push 00000018
:00440996 6A18                    push 00000018
:00440998 8B55EC                  mov edx, dword ptr [ebp-14]
:0044099B 52                      push edx
:0044099C 8B45E0                  mov eax, dword ptr [ebp-20]
:0044099F 8D0CC508000000          lea ecx, dword ptr [8*eax+00000008]
:004409A6 51                      push ecx
:004409A7 E8670F0100              call 00451913
:004409AC 83C418                  add esp, 00000018
:004409AF 8B5508                  mov edx, dword ptr [ebp+08]
:004409B2 81E2FF000000            and edx, 000000FF
:004409B8 85D2                    test edx, edx
:004409BA 740D                    je 004409C9
:004409BC 8B4508                  mov eax, dword ptr [ebp+08]
:004409BF 25FF000000              and eax, 000000FF
:004409C4 83F801                  cmp eax, 00000001
:004409C7 7532                    jne 004409FB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004409BA(C)
|
:004409C9 8B4DD8                  mov ecx, dword ptr [ebp-28]
:004409CC 8B5114                  mov edx, dword ptr [ecx+14]
:004409CF 52                      push edx
:004409D0 8B45F0                  mov eax, dword ptr [ebp-10]
:004409D3 50                      push eax
:004409D4 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004409D7 83C118                  add ecx, 00000018
:004409DA 894DEC                  mov dword ptr [ebp-14], ecx
:004409DD 8B55EC                  mov edx, dword ptr [ebp-14]
:004409E0 52                      push edx
:004409E1 8B45E0                  mov eax, dword ptr [ebp-20]
:004409E4 8D0CC528000000          lea ecx, dword ptr [8*eax+00000028]
:004409EB 51                      push ecx
:004409EC 6A01                    push 00000001
:004409EE E8AC070100              call 0045119F
:004409F3 83C414                  add esp, 00000014
:004409F6 E908020000              jmp 00440C03

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004409C7(C)
|
:004409FB 8A5508                  mov dl, byte ptr [ebp+08]
:004409FE 8855D0                  mov byte ptr [ebp-30], dl
:00440A01 807DD002                cmp byte ptr [ebp-30], 02
:00440A05 7419                    je 00440A20
:00440A07 807DD003                cmp byte ptr [ebp-30], 03
:00440A0B 0F84C6000000            je 00440AD7
:00440A11 807DD004                cmp byte ptr [ebp-30], 04
:00440A15 0F844E010000            je 00440B69
:00440A1B E9E3010000              jmp 00440C03

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440A05(C)
|
:00440A20 8A4510                  mov al, byte ptr [ebp+10]
:00440A23 50                      push eax
:00440A24 E80D920000              call 00449C36
:00440A29 83C404                  add esp, 00000004
:00440A2C 85C0                    test eax, eax
:00440A2E 7475                    je 00440AA5
:00440A30 6A01                    push 00000001
:00440A32 8A4D10                  mov cl, byte ptr [ebp+10]
:00440A35 51                      push ecx
:00440A36 8B55F0                  mov edx, dword ptr [ebp-10]
:00440A39 52                      push edx
:00440A3A 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00440A3D E86EB8FDFF              call 0041C2B0
:00440A42 25FF000000              and eax, 000000FF
:00440A47 6BC024                  imul eax, 00000024
:00440A4A 05502C4B00              add eax, 004B2C50
:00440A4F 50                      push eax
:00440A50 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00440A53 81E1FF000000            and ecx, 000000FF
:00440A59 6BC924                  imul ecx, 00000024
:00440A5C 81C1502C4B00            add ecx, 004B2C50
:00440A62 E843B5FFFF              call 0043BFAA
:00440A67 8945E8                  mov dword ptr [ebp-18], eax
:00440A6A 6A02                    push 00000002
:00440A6C 8B45D8                  mov eax, dword ptr [ebp-28]
:00440A6F 8B4814                  mov ecx, dword ptr [eax+14]
:00440A72 2B4DE8                  sub ecx, dword ptr [ebp-18]
:00440A75 51                      push ecx
:00440A76 8B55D8                  mov edx, dword ptr [ebp-28]
:00440A79 8B4214                  mov eax, dword ptr [edx+14]
:00440A7C 50                      push eax
:00440A7D 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00440A80 51                      push ecx
:00440A81 8B55EC                  mov edx, dword ptr [ebp-14]
:00440A84 83C218                  add edx, 00000018
:00440A87 8955EC                  mov dword ptr [ebp-14], edx
:00440A8A 8B45EC                  mov eax, dword ptr [ebp-14]
:00440A8D 50                      push eax
:00440A8E 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00440A91 8D14CD28000000          lea edx, dword ptr [8*ecx+00000028]
:00440A98 52                      push edx
:00440A99 6A01                    push 00000001
:00440A9B E835040100              call 00450ED5
:00440AA0 83C41C                  add esp, 0000001C
:00440AA3 EB2D                    jmp 00440AD2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440A2E(C)
|
:00440AA5 8B45D8                  mov eax, dword ptr [ebp-28]
:00440AA8 8B4814                  mov ecx, dword ptr [eax+14]
:00440AAB 51                      push ecx
:00440AAC 8B55F0                  mov edx, dword ptr [ebp-10]
:00440AAF 52                      push edx
:00440AB0 8B45EC                  mov eax, dword ptr [ebp-14]
:00440AB3 83C018                  add eax, 00000018
:00440AB6 8945EC                  mov dword ptr [ebp-14], eax
:00440AB9 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00440ABC 51                      push ecx
:00440ABD 8B55E0                  mov edx, dword ptr [ebp-20]
:00440AC0 8D04D528000000          lea eax, dword ptr [8*edx+00000028]
:00440AC7 50                      push eax
:00440AC8 6A01                    push 00000001
:00440ACA E8D0060100              call 0045119F
:00440ACF 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440AA3(U)
|
:00440AD2 E92C010000              jmp 00440C03

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440A0B(C)
|
:00440AD7 8A4D10                  mov cl, byte ptr [ebp+10]
:00440ADA 51                      push ecx
:00440ADB E89A910000              call 00449C7A
:00440AE0 83C404                  add esp, 00000004
:00440AE3 85C0                    test eax, eax
:00440AE5 7450                    je 00440B37
:00440AE7 6A01                    push 00000001
:00440AE9 8A550C                  mov dl, byte ptr [ebp+0C]
:00440AEC 52                      push edx
:00440AED 8A4510                  mov al, byte ptr [ebp+10]
:00440AF0 50                      push eax
:00440AF1 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00440AF4 E84FBAFFFF              call 0043C548
:00440AF9 8945E8                  mov dword ptr [ebp-18], eax
:00440AFC 6A03                    push 00000003
:00440AFE 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00440B01 8B5114                  mov edx, dword ptr [ecx+14]
:00440B04 0355E8                  add edx, dword ptr [ebp-18]
:00440B07 52                      push edx
:00440B08 8B45D8                  mov eax, dword ptr [ebp-28]
:00440B0B 8B4814                  mov ecx, dword ptr [eax+14]
:00440B0E 51                      push ecx
:00440B0F 8B55F0                  mov edx, dword ptr [ebp-10]
:00440B12 52                      push edx
:00440B13 8B45EC                  mov eax, dword ptr [ebp-14]
:00440B16 83C018                  add eax, 00000018
:00440B19 8945EC                  mov dword ptr [ebp-14], eax
:00440B1C 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00440B1F 51                      push ecx
:00440B20 8B55E0                  mov edx, dword ptr [ebp-20]
:00440B23 8D04D528000000          lea eax, dword ptr [8*edx+00000028]
:00440B2A 50                      push eax
:00440B2B 6A01                    push 00000001
:00440B2D E8A3030100              call 00450ED5
:00440B32 83C41C                  add esp, 0000001C
:00440B35 EB2D                    jmp 00440B64

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440AE5(C)
|
:00440B37 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00440B3A 8B5114                  mov edx, dword ptr [ecx+14]
:00440B3D 52                      push edx
:00440B3E 8B45F0                  mov eax, dword ptr [ebp-10]
:00440B41 50                      push eax
:00440B42 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00440B45 83C118                  add ecx, 00000018
:00440B48 894DEC                  mov dword ptr [ebp-14], ecx
:00440B4B 8B55EC                  mov edx, dword ptr [ebp-14]
:00440B4E 52                      push edx
:00440B4F 8B45E0                  mov eax, dword ptr [ebp-20]
:00440B52 8D0CC528000000          lea ecx, dword ptr [8*eax+00000028]
:00440B59 51                      push ecx
:00440B5A 6A01                    push 00000001
:00440B5C E83E060100              call 0045119F
:00440B61 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440B35(U)
|
:00440B64 E99A000000              jmp 00440C03

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440A15(C)
|
:00440B69 8B4D10                  mov ecx, dword ptr [ebp+10]
:00440B6C 81E1FF000000            and ecx, 000000FF
:00440B72 6BC919                  imul ecx, 00000019
:00440B75 81C140114A00            add ecx, 004A1140
:00440B7B E8C089FCFF              call 00409540
:00440B80 25FF000000              and eax, 000000FF
:00440B85 83F840                  cmp eax, 00000040
:00440B88 754C                    jne 00440BD6
:00440B8A 6A01                    push 00000001
:00440B8C 8A5510                  mov dl, byte ptr [ebp+10]
:00440B8F 52                      push edx
:00440B90 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00440B93 E896B8FFFF              call 0043C42E
:00440B98 8945E8                  mov dword ptr [ebp-18], eax
:00440B9B 6A04                    push 00000004
:00440B9D 8B45D8                  mov eax, dword ptr [ebp-28]
:00440BA0 8B4814                  mov ecx, dword ptr [eax+14]
:00440BA3 034DE8                  add ecx, dword ptr [ebp-18]
:00440BA6 51                      push ecx
:00440BA7 8B55D8                  mov edx, dword ptr [ebp-28]
:00440BAA 8B4214                  mov eax, dword ptr [edx+14]
:00440BAD 50                      push eax
:00440BAE 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00440BB1 51                      push ecx
:00440BB2 8B55EC                  mov edx, dword ptr [ebp-14]
:00440BB5 83C218                  add edx, 00000018
:00440BB8 8955EC                  mov dword ptr [ebp-14], edx
:00440BBB 8B45EC                  mov eax, dword ptr [ebp-14]
:00440BBE 50                      push eax
:00440BBF 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00440BC2 8D14CD28000000          lea edx, dword ptr [8*ecx+00000028]
:00440BC9 52                      push edx
:00440BCA 6A01                    push 00000001
:00440BCC E804030100              call 00450ED5
:00440BD1 83C41C                  add esp, 0000001C
:00440BD4 EB2D                    jmp 00440C03

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440B88(C)
|
:00440BD6 8B45D8                  mov eax, dword ptr [ebp-28]
:00440BD9 8B4814                  mov ecx, dword ptr [eax+14]
:00440BDC 51                      push ecx
:00440BDD 8B55F0                  mov edx, dword ptr [ebp-10]
:00440BE0 52                      push edx
:00440BE1 8B45EC                  mov eax, dword ptr [ebp-14]
:00440BE4 83C018                  add eax, 00000018
:00440BE7 8945EC                  mov dword ptr [ebp-14], eax
:00440BEA 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00440BED 51                      push ecx
:00440BEE 8B55E0                  mov edx, dword ptr [ebp-20]
:00440BF1 8D04D528000000          lea eax, dword ptr [8*edx+00000028]
:00440BF8 50                      push eax
:00440BF9 6A01                    push 00000001
:00440BFB E89F050100              call 0045119F
:00440C00 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004409F6(U), :00440A1B(U), :00440AD2(U), :00440B64(U), :00440BD4(U)
|
:00440C03 6A04                    push 00000004
:00440C05 6A04                    push 00000004
:00440C07 6A00                    push 00000000
:00440C09 68C0030000              push 000003C0
:00440C0E B950EB4A00              mov ecx, 004AEB50
:00440C13 E828EE0300              call 0047FA40
:00440C18 50                      push eax
:00440C19 6A18                    push 00000018
:00440C1B 6A18                    push 00000018
:00440C1D 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00440C20 51                      push ecx
:00440C21 8B55E0                  mov edx, dword ptr [ebp-20]
:00440C24 8D04D508000000          lea eax, dword ptr [8*edx+00000008]
:00440C2B 50                      push eax
:00440C2C E8E20C0100              call 00451913
:00440C31 83C418                  add esp, 00000018
:00440C34 6A00                    push 00000000
:00440C36 B9382F4900              mov ecx, 00492F38
:00440C3B E8CAE0FCFF              call 0040ED0A
:00440C40 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00440C43 83C11B                  add ecx, 0000001B
:00440C46 894DEC                  mov dword ptr [ebp-14], ecx
:00440C49 8B55EC                  mov edx, dword ptr [ebp-14]
:00440C4C 52                      push edx
:00440C4D 8B45E0                  mov eax, dword ptr [ebp-20]
:00440C50 50                      push eax
:00440C51 B9382F4900              mov ecx, 00492F38
:00440C56 E87CDFFCFF              call 0040EBD7
:00440C5B 8B4D08                  mov ecx, dword ptr [ebp+08]
:00440C5E 81E1FF000000            and ecx, 000000FF
:00440C64 85C9                    test ecx, ecx
:00440C66 0F85C9010000            jne 00440E35
:00440C6C 8B55D8                  mov edx, dword ptr [ebp-28]
:00440C6F 83C206                  add edx, 00000006
:00440C72 52                      push edx
:00440C73 E8194DFFFF              call 00435991
:00440C78 83C404                  add esp, 00000004
:00440C7B 8845DC                  mov byte ptr [ebp-24], al
:00440C7E 8B45EC                  mov eax, dword ptr [ebp-14]
:00440C81 50                      push eax
:00440C82 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00440C85 83C101                  add ecx, 00000001
:00440C88 894DE0                  mov dword ptr [ebp-20], ecx
:00440C8B 8B55E0                  mov edx, dword ptr [ebp-20]
:00440C8E 52                      push edx
:00440C8F B9382F4900              mov ecx, 00492F38
:00440C94 E83EDFFCFF              call 0040EBD7
:00440C99 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00440C9C E8B3F2FFFF              call 0043FF54
:00440CA1 85C0                    test eax, eax
:00440CA3 0F84AD000000            je 00440D56
:00440CA9 6A12                    push 00000012
:00440CAB B9382F4900              mov ecx, 00492F38
:00440CB0 E8CFDFFCFF              call 0040EC84

* Possible StringData Ref from Data Obj ->"Exp"
                                  |
:00440CB5 6860E04800              push 0048E060
:00440CBA 68382F4900              push 00492F38
:00440CBF E8DCEDFCFF              call 0040FAA0
:00440CC4 83C408                  add esp, 00000008
:00440CC7 8B45EC                  mov eax, dword ptr [ebp-14]
:00440CCA 50                      push eax
:00440CCB 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00440CCE 83C105                  add ecx, 00000005
:00440CD1 894DE0                  mov dword ptr [ebp-20], ecx
:00440CD4 8B55E0                  mov edx, dword ptr [ebp-20]
:00440CD7 52                      push edx
:00440CD8 B9382F4900              mov ecx, 00492F38
:00440CDD E8F5DEFCFF              call 0040EBD7
:00440CE2 6A12                    push 00000012
:00440CE4 B9382F4900              mov ecx, 00492F38
:00440CE9 E896DFFCFF              call 0040EC84
:00440CEE 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00440CF1 E85A59FCFF              call 00406650
:00440CF6 25FF000000              and eax, 000000FF
:00440CFB 3DFF000000              cmp eax, 000000FF
:00440D00 7514                    jne 00440D16

* Possible StringData Ref from Data Obj ->"MAX"
                                  |
:00440D02 6864E04800              push 0048E064
:00440D07 68382F4900              push 00492F38
:00440D0C E88FEDFCFF              call 0040FAA0
:00440D11 83C408                  add esp, 00000008
:00440D14 EB20                    jmp 00440D36

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440D00(C)
|
:00440D16 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00440D19 E83259FCFF              call 00406650
:00440D1E 25FF000000              and eax, 000000FF
:00440D23 50                      push eax

* Possible StringData Ref from Data Obj ->"%3u"
                                  |
:00440D24 6868E04800              push 0048E068
:00440D29 68382F4900              push 00492F38
:00440D2E E86DEDFCFF              call 0040FAA0
:00440D33 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440D14(U)
|
:00440D36 8B45EC                  mov eax, dword ptr [ebp-14]
:00440D39 50                      push eax
:00440D3A 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00440D3D 83C105                  add ecx, 00000005
:00440D40 894DE0                  mov dword ptr [ebp-20], ecx
:00440D43 8B55E0                  mov edx, dword ptr [ebp-20]
:00440D46 52                      push edx
:00440D47 B9382F4900              mov ecx, 00492F38
:00440D4C E886DEFCFF              call 0040EBD7
:00440D51 E980000000              jmp 00440DD6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440CA3(C)
|
:00440D56 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00440D59 E8B259FCFF              call 00406710
:00440D5E 85C0                    test eax, eax
:00440D60 743B                    je 00440D9D
:00440D62 6A24                    push 00000024
:00440D64 B9382F4900              mov ecx, 00492F38
:00440D69 E816DFFCFF              call 0040EC84

* Possible StringData Ref from Data Obj ->"Ѿ"
                                  |
:00440D6E 686CE04800              push 0048E06C
:00440D73 68382F4900              push 00492F38
:00440D78 E823EDFCFF              call 0040FAA0
:00440D7D 83C408                  add esp, 00000008
:00440D80 8B45EC                  mov eax, dword ptr [ebp-14]
:00440D83 50                      push eax
:00440D84 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00440D87 83C10A                  add ecx, 0000000A
:00440D8A 894DE0                  mov dword ptr [ebp-20], ecx
:00440D8D 8B55E0                  mov edx, dword ptr [ebp-20]
:00440D90 52                      push edx
:00440D91 B9382F4900              mov ecx, 00492F38
:00440D96 E83CDEFCFF              call 0040EBD7
:00440D9B EB39                    jmp 00440DD6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440D60(C)
|
:00440D9D 6A35                    push 00000035
:00440D9F B9382F4900              mov ecx, 00492F38
:00440DA4 E8DBDEFCFF              call 0040EC84

* Possible StringData Ref from Data Obj ->"о"
                                  |
:00440DA9 6874E04800              push 0048E074
:00440DAE 68382F4900              push 00492F38
:00440DB3 E8E8ECFCFF              call 0040FAA0
:00440DB8 83C408                  add esp, 00000008
:00440DBB 8B45EC                  mov eax, dword ptr [ebp-14]
:00440DBE 50                      push eax
:00440DBF 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00440DC2 83C10A                  add ecx, 0000000A
:00440DC5 894DE0                  mov dword ptr [ebp-20], ecx
:00440DC8 8B55E0                  mov edx, dword ptr [ebp-20]
:00440DCB 52                      push edx
:00440DCC B9382F4900              mov ecx, 00492F38
:00440DD1 E801DEFCFF              call 0040EBD7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00440D51(U), :00440D9B(U)
|
:00440DD6 6A53                    push 00000053
:00440DD8 B9382F4900              mov ecx, 00492F38
:00440DDD E8A2DEFCFF              call 0040EC84
:00440DE2 8B45DC                  mov eax, dword ptr [ebp-24]
:00440DE5 25FF000000              and eax, 000000FF
:00440DEA 8B0C85B0BD4800          mov ecx, dword ptr [4*eax+0048BDB0]
:00440DF1 51                      push ecx

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:00440DF2 687CE04800              push 0048E07C
:00440DF7 68382F4900              push 00492F38
:00440DFC E89FECFCFF              call 0040FAA0
:00440E01 83C40C                  add esp, 0000000C
:00440E04 6A12                    push 00000012
:00440E06 B9382F4900              mov ecx, 00492F38
:00440E0B E874DEFCFF              call 0040EC84
:00440E10 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00440E13 E835EAFFFF              call 0043F84D
:00440E18 25FF000000              and eax, 000000FF
:00440E1D 6BC00A                  imul eax, 0000000A
:00440E20 50                      push eax

* Possible StringData Ref from Data Obj ->"%4u%%"
                                  |
:00440E21 6880E04800              push 0048E080
:00440E26 68382F4900              push 00492F38
:00440E2B E870ECFCFF              call 0040FAA0
:00440E30 83C40C                  add esp, 0000000C
:00440E33 EB20                    jmp 00440E55

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440C66(C)
|
:00440E35 8A5510                  mov dl, byte ptr [ebp+10]
:00440E38 52                      push edx
:00440E39 8A4508                  mov al, byte ptr [ebp+08]
:00440E3C 50                      push eax
:00440E3D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00440E40 51                      push ecx
:00440E41 8B55E8                  mov edx, dword ptr [ebp-18]
:00440E44 52                      push edx
:00440E45 8B45EC                  mov eax, dword ptr [ebp-14]
:00440E48 50                      push eax
:00440E49 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00440E4C 51                      push ecx
:00440E4D E837000000              call 00440E89
:00440E52 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440E33(U)
|
:00440E55 6A00                    push 00000000
:00440E57 B9382F4900              mov ecx, 00492F38
:00440E5C E8A9DEFCFF              call 0040ED0A
:00440E61 6A01                    push 00000001
:00440E63 B950424B00              mov ecx, 004B4250
:00440E68 E814300100              call 00453E81
:00440E6D E884D7FDFF              call 0041E5F6
:00440E72 5E                      pop esi
:00440E73 8BE5                    mov esp, ebp
:00440E75 5D                      pop ebp
:00440E76 C20C00                  ret 000C



:00440E79 91064400                DWORD 00440691
:00440E7D 15074400                DWORD 00440715
:00440E81 F0074400                DWORD 004407F0
:00440E85 A6084400                DWORD 004408A6



* Referenced by a CALL at Address:
|:00440E4D   
|
:00440E89 55                      push ebp
:00440E8A 8BEC                    mov ebp, esp
:00440E8C 83EC14                  sub esp, 00000014
:00440E8F 8B4518                  mov eax, dword ptr [ebp+18]
:00440E92 25FF000000              and eax, 000000FF
:00440E97 83F801                  cmp eax, 00000001
:00440E9A 0F85F1000000            jne 00440F91
:00440EA0 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00440EA3 51                      push ecx
:00440EA4 8B5508                  mov edx, dword ptr [ebp+08]
:00440EA7 83C201                  add edx, 00000001
:00440EAA 895508                  mov dword ptr [ebp+08], edx
:00440EAD 8B4508                  mov eax, dword ptr [ebp+08]
:00440EB0 50                      push eax
:00440EB1 B9382F4900              mov ecx, 00492F38
:00440EB6 E81CDDFCFF              call 0040EBD7
:00440EBB 6A24                    push 00000024
:00440EBD B9382F4900              mov ecx, 00492F38
:00440EC2 E8BDDDFCFF              call 0040EC84

* Possible StringData Ref from Data Obj ->""
                                  |
:00440EC7 6888E04800              push 0048E088
:00440ECC 68382F4900              push 00492F38
:00440ED1 E8CAEBFCFF              call 0040FAA0
:00440ED6 83C408                  add esp, 00000008
:00440ED9 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00440EDC 51                      push ecx
:00440EDD 8B5508                  mov edx, dword ptr [ebp+08]
:00440EE0 83C205                  add edx, 00000005
:00440EE3 895508                  mov dword ptr [ebp+08], edx
:00440EE6 8B4508                  mov eax, dword ptr [ebp+08]
:00440EE9 50                      push eax
:00440EEA B9382F4900              mov ecx, 00492F38
:00440EEF E8E3DCFCFF              call 0040EBD7
:00440EF4 6A12                    push 00000012
:00440EF6 B9382F4900              mov ecx, 00492F38
:00440EFB E884DDFCFF              call 0040EC84
:00440F00 8B4D10                  mov ecx, dword ptr [ebp+10]
:00440F03 51                      push ecx

* Possible StringData Ref from Data Obj ->"%3u"
                                  |
:00440F04 6890E04800              push 0048E090
:00440F09 68382F4900              push 00492F38
:00440F0E E88DEBFCFF              call 0040FAA0
:00440F13 83C40C                  add esp, 0000000C
:00440F16 8B550C                  mov edx, dword ptr [ebp+0C]
:00440F19 52                      push edx
:00440F1A 8B4508                  mov eax, dword ptr [ebp+08]
:00440F1D 83C006                  add eax, 00000006
:00440F20 894508                  mov dword ptr [ebp+08], eax
:00440F23 8B4D08                  mov ecx, dword ptr [ebp+08]
:00440F26 51                      push ecx
:00440F27 B9382F4900              mov ecx, 00492F38
:00440F2C E8A6DCFCFF              call 0040EBD7
:00440F31 6A43                    push 00000043
:00440F33 B9382F4900              mov ecx, 00492F38
:00440F38 E847DDFCFF              call 0040EC84

* Possible StringData Ref from Data Obj ->""
                                  |
:00440F3D 6894E04800              push 0048E094
:00440F42 68382F4900              push 00492F38
:00440F47 E854EBFCFF              call 0040FAA0
:00440F4C 83C408                  add esp, 00000008
:00440F4F 8B550C                  mov edx, dword ptr [ebp+0C]
:00440F52 52                      push edx
:00440F53 8B4508                  mov eax, dword ptr [ebp+08]
:00440F56 83C005                  add eax, 00000005
:00440F59 894508                  mov dword ptr [ebp+08], eax
:00440F5C 8B4D08                  mov ecx, dword ptr [ebp+08]
:00440F5F 51                      push ecx
:00440F60 B9382F4900              mov ecx, 00492F38
:00440F65 E86DDCFCFF              call 0040EBD7
:00440F6A 6A12                    push 00000012
:00440F6C B9382F4900              mov ecx, 00492F38
:00440F71 E80EDDFCFF              call 0040EC84
:00440F76 8B5514                  mov edx, dword ptr [ebp+14]
:00440F79 52                      push edx

* Possible StringData Ref from Data Obj ->"%3u%%"
                                  |
:00440F7A 689CE04800              push 0048E09C
:00440F7F 68382F4900              push 00492F38
:00440F84 E817EBFCFF              call 0040FAA0
:00440F89 83C40C                  add esp, 0000000C
:00440F8C E9A8040000              jmp 00441439

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440E9A(C)
|
:00440F91 8B4518                  mov eax, dword ptr [ebp+18]
:00440F94 25FF000000              and eax, 000000FF
:00440F99 83F802                  cmp eax, 00000002
:00440F9C 0F8544010000            jne 004410E6
:00440FA2 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00440FA5 51                      push ecx
:00440FA6 8B5508                  mov edx, dword ptr [ebp+08]
:00440FA9 83C201                  add edx, 00000001
:00440FAC 895508                  mov dword ptr [ebp+08], edx
:00440FAF 8B4508                  mov eax, dword ptr [ebp+08]
:00440FB2 50                      push eax
:00440FB3 B9382F4900              mov ecx, 00492F38
:00440FB8 E81ADCFCFF              call 0040EBD7
:00440FBD 6A24                    push 00000024
:00440FBF B9382F4900              mov ecx, 00492F38
:00440FC4 E8BBDCFCFF              call 0040EC84
:00440FC9 8A4D1C                  mov cl, byte ptr [ebp+1C]
:00440FCC 51                      push ecx
:00440FCD E8DA8B0000              call 00449BAC
:00440FD2 83C404                  add esp, 00000004
:00440FD5 85C0                    test eax, eax
:00440FD7 7510                    jne 00440FE9
:00440FD9 8A551C                  mov dl, byte ptr [ebp+1C]
:00440FDC 52                      push edx
:00440FDD E8548C0000              call 00449C36
:00440FE2 83C404                  add esp, 00000004
:00440FE5 85C0                    test eax, eax
:00440FE7 744B                    je 00441034

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440FD7(C)
|

* Possible StringData Ref from Data Obj ->""
                                  |
:00440FE9 68A4E04800              push 0048E0A4
:00440FEE 68382F4900              push 00492F38
:00440FF3 E8A8EAFCFF              call 0040FAA0
:00440FF8 83C408                  add esp, 00000008
:00440FFB 8B450C                  mov eax, dword ptr [ebp+0C]
:00440FFE 50                      push eax
:00440FFF 8B4D08                  mov ecx, dword ptr [ebp+08]
:00441002 83C105                  add ecx, 00000005
:00441005 51                      push ecx
:00441006 B9382F4900              mov ecx, 00492F38
:0044100B E8C7DBFCFF              call 0040EBD7
:00441010 6A12                    push 00000012
:00441012 B9382F4900              mov ecx, 00492F38
:00441017 E868DCFCFF              call 0040EC84
:0044101C 8B5510                  mov edx, dword ptr [ebp+10]
:0044101F 52                      push edx

* Possible StringData Ref from Data Obj ->"%3u"
                                  |
:00441020 68ACE04800              push 0048E0AC
:00441025 68382F4900              push 00492F38
:0044102A E871EAFCFF              call 0040FAA0
:0044102F 83C40C                  add esp, 0000000C
:00441032 EB37                    jmp 0044106B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440FE7(C)
|
:00441034 8B4D1C                  mov ecx, dword ptr [ebp+1C]
:00441037 81E1FF000000            and ecx, 000000FF
:0044103D 6BC946                  imul ecx, 00000046
:00441040 81C1C0F44A00            add ecx, 004AF4C0
:00441046 E8D5D2FFFF              call 0043E320
:0044104B 8845F8                  mov byte ptr [ebp-08], al
:0044104E 8B45F8                  mov eax, dword ptr [ebp-08]
:00441051 25FF000000              and eax, 000000FF
:00441056 8B0C8540BD4800          mov ecx, dword ptr [4*eax+0048BD40]
:0044105D 51                      push ecx
:0044105E 68382F4900              push 00492F38
:00441063 E838EAFCFF              call 0040FAA0
:00441068 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441032(U)
|
:0044106B 8B550C                  mov edx, dword ptr [ebp+0C]
:0044106E 52                      push edx
:0044106F 8B4508                  mov eax, dword ptr [ebp+08]
:00441072 83C00B                  add eax, 0000000B
:00441075 894508                  mov dword ptr [ebp+08], eax
:00441078 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044107B 51                      push ecx
:0044107C B9382F4900              mov ecx, 00492F38
:00441081 E851DBFCFF              call 0040EBD7
:00441086 6A43                    push 00000043
:00441088 B9382F4900              mov ecx, 00492F38
:0044108D E8F2DBFCFF              call 0040EC84

* Possible StringData Ref from Data Obj ->""
                                  |
:00441092 68B0E04800              push 0048E0B0
:00441097 68382F4900              push 00492F38
:0044109C E8FFE9FCFF              call 0040FAA0
:004410A1 83C408                  add esp, 00000008
:004410A4 8B550C                  mov edx, dword ptr [ebp+0C]
:004410A7 52                      push edx
:004410A8 8B4508                  mov eax, dword ptr [ebp+08]
:004410AB 83C005                  add eax, 00000005
:004410AE 894508                  mov dword ptr [ebp+08], eax
:004410B1 8B4D08                  mov ecx, dword ptr [ebp+08]
:004410B4 51                      push ecx
:004410B5 B9382F4900              mov ecx, 00492F38
:004410BA E818DBFCFF              call 0040EBD7
:004410BF 6A12                    push 00000012
:004410C1 B9382F4900              mov ecx, 00492F38
:004410C6 E8B9DBFCFF              call 0040EC84
:004410CB 8B5514                  mov edx, dword ptr [ebp+14]
:004410CE 52                      push edx

* Possible StringData Ref from Data Obj ->"%3u%%"
                                  |
:004410CF 68B8E04800              push 0048E0B8
:004410D4 68382F4900              push 00492F38
:004410D9 E8C2E9FCFF              call 0040FAA0
:004410DE 83C40C                  add esp, 0000000C
:004410E1 E953030000              jmp 00441439

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00440F9C(C)
|
:004410E6 8B4518                  mov eax, dword ptr [ebp+18]
:004410E9 25FF000000              and eax, 000000FF
:004410EE 83F803                  cmp eax, 00000003
:004410F1 0F857C010000            jne 00441273
:004410F7 8B4D1C                  mov ecx, dword ptr [ebp+1C]
:004410FA 81E1FF000000            and ecx, 000000FF
:00441100 6BC946                  imul ecx, 00000046
:00441103 81C1C0F44A00            add ecx, 004AF4C0
:00441109 E812D2FFFF              call 0043E320
:0044110E 8845F8                  mov byte ptr [ebp-08], al
:00441111 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00441114 51                      push ecx
:00441115 8B5508                  mov edx, dword ptr [ebp+08]
:00441118 83C201                  add edx, 00000001
:0044111B 895508                  mov dword ptr [ebp+08], edx
:0044111E 8B4508                  mov eax, dword ptr [ebp+08]
:00441121 50                      push eax
:00441122 B9382F4900              mov ecx, 00492F38
:00441127 E8ABDAFCFF              call 0040EBD7
:0044112C 6A35                    push 00000035
:0044112E B9382F4900              mov ecx, 00492F38
:00441133 E84CDBFCFF              call 0040EC84
:00441138 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044113B 81E1FF000000            and ecx, 000000FF
:00441141 894DF4                  mov dword ptr [ebp-0C], ecx
:00441144 8B55F4                  mov edx, dword ptr [ebp-0C]
:00441147 83EA0B                  sub edx, 0000000B
:0044114A 8955F4                  mov dword ptr [ebp-0C], edx
:0044114D 837DF410                cmp dword ptr [ebp-0C], 00000010
:00441151 0F87A1000000            ja 004411F8
:00441157 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044115A 33C0                    xor eax, eax
:0044115C 8A8151144400            mov al, byte ptr [ecx+00441451]
:00441162 FF24853D144400          jmp dword ptr [4*eax+0044143D]
:00441169 8B55F8                  mov edx, dword ptr [ebp-08]
:0044116C 81E2FF000000            and edx, 000000FF
:00441172 8B049540BD4800          mov eax, dword ptr [4*edx+0048BD40]
:00441179 50                      push eax
:0044117A 68382F4900              push 00492F38
:0044117F E81CE9FCFF              call 0040FAA0
:00441184 83C408                  add esp, 00000008
:00441187 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0044118A 51                      push ecx
:0044118B 8B55F8                  mov edx, dword ptr [ebp-08]
:0044118E 81E2FF000000            and edx, 000000FF
:00441194 8B049540BD4800          mov eax, dword ptr [4*edx+0048BD40]
:0044119B 50                      push eax
:0044119C E8B9EA0300              call 0047FC5A
:004411A1 83C404                  add esp, 00000004
:004411A4 8B4D08                  mov ecx, dword ptr [ebp+08]
:004411A7 8D540101                lea edx, dword ptr [ecx+eax+01]
:004411AB 52                      push edx
:004411AC B9382F4900              mov ecx, 00492F38
:004411B1 E821DAFCFF              call 0040EBD7
:004411B6 6A12                    push 00000012
:004411B8 B9382F4900              mov ecx, 00492F38
:004411BD E8C2DAFCFF              call 0040EC84
:004411C2 8B4510                  mov eax, dword ptr [ebp+10]
:004411C5 50                      push eax

* Possible StringData Ref from Data Obj ->"%3u"
                                  |
:004411C6 68C0E04800              push 0048E0C0
:004411CB 68382F4900              push 00492F38
:004411D0 E8CBE8FCFF              call 0040FAA0
:004411D5 83C40C                  add esp, 0000000C
:004411D8 EB1E                    jmp 004411F8
:004411DA 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004411DD 81E1FF000000            and ecx, 000000FF
:004411E3 8B148D40BD4800          mov edx, dword ptr [4*ecx+0048BD40]
:004411EA 52                      push edx
:004411EB 68382F4900              push 00492F38
:004411F0 E8ABE8FCFF              call 0040FAA0
:004411F5 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00441151(C), :004411D8(U)
|
:004411F8 8B450C                  mov eax, dword ptr [ebp+0C]
:004411FB 50                      push eax
:004411FC 8B4D08                  mov ecx, dword ptr [ebp+08]
:004411FF 83C10B                  add ecx, 0000000B
:00441202 894D08                  mov dword ptr [ebp+08], ecx
:00441205 8B5508                  mov edx, dword ptr [ebp+08]
:00441208 52                      push edx
:00441209 B9382F4900              mov ecx, 00492F38
:0044120E E8C4D9FCFF              call 0040EBD7
:00441213 6A43                    push 00000043
:00441215 B9382F4900              mov ecx, 00492F38
:0044121A E865DAFCFF              call 0040EC84

* Possible StringData Ref from Data Obj ->"Ч"
                                  |
:0044121F 68C4E04800              push 0048E0C4
:00441224 68382F4900              push 00492F38
:00441229 E872E8FCFF              call 0040FAA0
:0044122E 83C408                  add esp, 00000008
:00441231 8B450C                  mov eax, dword ptr [ebp+0C]
:00441234 50                      push eax
:00441235 8B4D08                  mov ecx, dword ptr [ebp+08]
:00441238 83C105                  add ecx, 00000005
:0044123B 894D08                  mov dword ptr [ebp+08], ecx
:0044123E 8B5508                  mov edx, dword ptr [ebp+08]
:00441241 52                      push edx
:00441242 B9382F4900              mov ecx, 00492F38
:00441247 E88BD9FCFF              call 0040EBD7
:0044124C 6A12                    push 00000012
:0044124E B9382F4900              mov ecx, 00492F38
:00441253 E82CDAFCFF              call 0040EC84
:00441258 8B4514                  mov eax, dword ptr [ebp+14]
:0044125B 50                      push eax

* Possible StringData Ref from Data Obj ->"%3u%%"
                                  |
:0044125C 68CCE04800              push 0048E0CC
:00441261 68382F4900              push 00492F38
:00441266 E835E8FCFF              call 0040FAA0
:0044126B 83C40C                  add esp, 0000000C
:0044126E E9C6010000              jmp 00441439

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004410F1(C)
|
:00441273 8B4D18                  mov ecx, dword ptr [ebp+18]
:00441276 81E1FF000000            and ecx, 000000FF
:0044127C 83F904                  cmp ecx, 00000004
:0044127F 0F85B4010000            jne 00441439
:00441285 8B4D1C                  mov ecx, dword ptr [ebp+1C]
:00441288 81E1FF000000            and ecx, 000000FF
:0044128E 6BC919                  imul ecx, 00000019
:00441291 81C140114A00            add ecx, 004A1140
:00441297 E8A482FCFF              call 00409540
:0044129C 8845FC                  mov byte ptr [ebp-04], al
:0044129F 8B550C                  mov edx, dword ptr [ebp+0C]
:004412A2 52                      push edx
:004412A3 8B4508                  mov eax, dword ptr [ebp+08]
:004412A6 83C001                  add eax, 00000001
:004412A9 894508                  mov dword ptr [ebp+08], eax
:004412AC 8B4D08                  mov ecx, dword ptr [ebp+08]
:004412AF 51                      push ecx
:004412B0 B9382F4900              mov ecx, 00492F38
:004412B5 E81DD9FCFF              call 0040EBD7
:004412BA 6A35                    push 00000035
:004412BC B9382F4900              mov ecx, 00492F38
:004412C1 E8BED9FCFF              call 0040EC84
:004412C6 8B55FC                  mov edx, dword ptr [ebp-04]
:004412C9 81E2FF000000            and edx, 000000FF
:004412CF 8B049508BC4800          mov eax, dword ptr [4*edx+0048BC08]
:004412D6 50                      push eax
:004412D7 68382F4900              push 00492F38
:004412DC E8BFE7FCFF              call 0040FAA0
:004412E1 83C408                  add esp, 00000008
:004412E4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004412E7 81E1FF000000            and ecx, 000000FF
:004412ED 894DF0                  mov dword ptr [ebp-10], ecx
:004412F0 8B55F0                  mov edx, dword ptr [ebp-10]
:004412F3 83EA3F                  sub edx, 0000003F
:004412F6 8955F0                  mov dword ptr [ebp-10], edx
:004412F9 837DF00D                cmp dword ptr [ebp-10], 0000000D
:004412FD 0F8736010000            ja 00441439
:00441303 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00441306 33C0                    xor eax, eax
:00441308 8A817A144400            mov al, byte ptr [ecx+0044147A]
:0044130E FF248562144400          jmp dword ptr [4*eax+00441462]
:00441315 8B550C                  mov edx, dword ptr [ebp+0C]
:00441318 52                      push edx
:00441319 8B45FC                  mov eax, dword ptr [ebp-04]
:0044131C 25FF000000              and eax, 000000FF
:00441321 8B0C8508BC4800          mov ecx, dword ptr [4*eax+0048BC08]
:00441328 51                      push ecx
:00441329 E82CE90300              call 0047FC5A
:0044132E 83C404                  add esp, 00000004
:00441331 8B5508                  mov edx, dword ptr [ebp+08]
:00441334 8D440201                lea eax, dword ptr [edx+eax+01]
:00441338 894508                  mov dword ptr [ebp+08], eax
:0044133B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044133E 51                      push ecx
:0044133F B9382F4900              mov ecx, 00492F38
:00441344 E88ED8FCFF              call 0040EBD7
:00441349 6A12                    push 00000012
:0044134B B9382F4900              mov ecx, 00492F38
:00441350 E82FD9FCFF              call 0040EC84
:00441355 8B5510                  mov edx, dword ptr [ebp+10]
:00441358 52                      push edx

* Possible StringData Ref from Data Obj ->"%3u"
                                  |
:00441359 68D4E04800              push 0048E0D4
:0044135E 68382F4900              push 00492F38
:00441363 E838E7FCFF              call 0040FAA0
:00441368 83C40C                  add esp, 0000000C
:0044136B E9C9000000              jmp 00441439
:00441370 8B450C                  mov eax, dword ptr [ebp+0C]
:00441373 50                      push eax
:00441374 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00441377 81E1FF000000            and ecx, 000000FF
:0044137D 8B148D08BC4800          mov edx, dword ptr [4*ecx+0048BC08]
:00441384 52                      push edx
:00441385 E8D0E80300              call 0047FC5A
:0044138A 83C404                  add esp, 00000004
:0044138D 8B4D08                  mov ecx, dword ptr [ebp+08]
:00441390 8D540101                lea edx, dword ptr [ecx+eax+01]
:00441394 895508                  mov dword ptr [ebp+08], edx
:00441397 8B4508                  mov eax, dword ptr [ebp+08]
:0044139A 50                      push eax
:0044139B B9382F4900              mov ecx, 00492F38
:004413A0 E832D8FCFF              call 0040EBD7
:004413A5 6A12                    push 00000012
:004413A7 B9382F4900              mov ecx, 00492F38
:004413AC E8D3D8FCFF              call 0040EC84
:004413B1 8B4510                  mov eax, dword ptr [ebp+10]
:004413B4 33D2                    xor edx, edx
:004413B6 B964000000              mov ecx, 00000064
:004413BB F7F1                    div ecx
:004413BD 50                      push eax

* Possible StringData Ref from Data Obj ->"%3u"
                                  |
:004413BE 68D8E04800              push 0048E0D8
:004413C3 68382F4900              push 00492F38
:004413C8 E8D3E6FCFF              call 0040FAA0
:004413CD 83C40C                  add esp, 0000000C
:004413D0 EB67                    jmp 00441439
:004413D2 8B550C                  mov edx, dword ptr [ebp+0C]
:004413D5 52                      push edx
:004413D6 8B45FC                  mov eax, dword ptr [ebp-04]
:004413D9 25FF000000              and eax, 000000FF
:004413DE 8B0C8508BC4800          mov ecx, dword ptr [4*eax+0048BC08]
:004413E5 51                      push ecx
:004413E6 E86FE80300              call 0047FC5A
:004413EB 83C404                  add esp, 00000004
:004413EE 8B5508                  mov edx, dword ptr [ebp+08]
:004413F1 8D440201                lea eax, dword ptr [edx+eax+01]
:004413F5 894508                  mov dword ptr [ebp+08], eax
:004413F8 8B4D08                  mov ecx, dword ptr [ebp+08]
:004413FB 51                      push ecx
:004413FC B9382F4900              mov ecx, 00492F38
:00441401 E8D1D7FCFF              call 0040EBD7
:00441406 6A12                    push 00000012
:00441408 B9382F4900              mov ecx, 00492F38
:0044140D E872D8FCFF              call 0040EC84
:00441412 837D1400                cmp dword ptr [ebp+14], 00000000
:00441416 7509                    jne 00441421

* Possible StringData Ref from Data Obj ->"Ч"
                                  |
:00441418 C745ECDCE04800          mov [ebp-14], 0048E0DC
:0044141F EB07                    jmp 00441428

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441416(C)
|

* Possible StringData Ref from Data Obj ->"Ч"
                                  |
:00441421 C745ECE4E04800          mov [ebp-14], 0048E0E4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044141F(U)
|
:00441428 8B55EC                  mov edx, dword ptr [ebp-14]
:0044142B 52                      push edx
:0044142C 68382F4900              push 00492F38
:00441431 E86AE6FCFF              call 0040FAA0
:00441436 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00440F8C(U), :004410E1(U), :0044126E(U), :0044127F(C), :004412FD(C)
|:0044136B(U), :004413D0(U)
|
:00441439 8BE5                    mov esp, ebp
:0044143B 5D                      pop ebp
:0044143C C3                      ret



:0044143D DA114400                DWORD 004411DA
:00441441 69114400                DWORD 00441169
:00441445 DA114400                DWORD 004411DA
:00441449 DA114400                DWORD 004411DA
:0044144D F8114400                DWORD 004411F8


:00441451 00000000                BYTE  4 DUP(0)


:00441455 0404                    add al, 04
:00441457 0404                    add al, 04
:00441459 0101                    add dword ptr [ecx], eax
:0044145B 0202                    add al, byte ptr [edx]
:0044145D 0404                    add al, 04
:0044145F 0404                    add al, 04
:00441461 0315134400D2            add edx, dword ptr [D2004413]
:00441467 13440015                adc eax, dword ptr [eax+eax+15]
:0044146B 13440070                adc eax, dword ptr [eax+eax+70]
:0044146F 134400D2                adc eax, dword ptr [eax+eax-2E]
:00441473 13440039                adc eax, dword ptr [eax+eax+39]
:00441477 1444                    adc al, 44
:00441479 000000                  BYTE  3 DUP(0)


:0044147C 0101                    add dword ptr [ecx], eax
:0044147E 0101                    add dword ptr [ecx], eax
:00441480 0102                    add dword ptr [edx], eax
:00441482 0202                    add al, byte ptr [edx]
:00441484 0202                    add al, byte ptr [edx]
:00441486 03                      BYTE 03h
:00441487 04                      BYTE 04h


* Referenced by a CALL at Addresses:
|:0043AA14   , :0043AC2A   , :0043B3B5   
|
:00441488 55                      push ebp
:00441489 8BEC                    mov ebp, esp
:0044148B 83EC0C                  sub esp, 0000000C
:0044148E 894DF4                  mov dword ptr [ebp-0C], ecx
:00441491 8B45F4                  mov eax, dword ptr [ebp-0C]
:00441494 8A4807                  mov cl, byte ptr [eax+07]
:00441497 51                      push ecx
:00441498 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044149B 8A4206                  mov al, byte ptr [edx+06]
:0044149E 50                      push eax
:0044149F B950424B00              mov ecx, 004B4250
:004414A4 E8963B0100              call 0045503F
:004414A9 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004414AC 83C106                  add ecx, 00000006
:004414AF 51                      push ecx
:004414B0 B950424B00              mov ecx, 004B4250
:004414B5 E819300100              call 004544D3
:004414BA 6A04                    push 00000004
:004414BC 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004414BF E82C46FEFF              call 00425AF0
:004414C4 85C0                    test eax, eax
:004414C6 7508                    jne 004414D0
:004414C8 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004414CB E8CEEFFFFF              call 0044049E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004414C6(C)
|
:004414D0 C745F802000000          mov [ebp-08], 00000002
:004414D7 C745FC00000000          mov [ebp-04], 00000000
:004414DE EB09                    jmp 004414E9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004416D0(U)
|
:004414E0 8B55FC                  mov edx, dword ptr [ebp-04]
:004414E3 83C201                  add edx, 00000001
:004414E6 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004414DE(U)
|
:004414E9 8B45FC                  mov eax, dword ptr [ebp-04]
:004414EC 3B45F8                  cmp eax, dword ptr [ebp-08]
:004414EF 0F8DE0010000            jnl 004416D5
:004414F5 8B4D08                  mov ecx, dword ptr [ebp+08]
:004414F8 81E1FF000000            and ecx, 000000FF
:004414FE 85C9                    test ecx, ecx
:00441500 7548                    jne 0044154A
:00441502 837DFC01                cmp dword ptr [ebp-04], 00000001
:00441506 7C3D                    jl 00441545
:00441508 6A01                    push 00000001
:0044150A B950424B00              mov ecx, 004B4250
:0044150F E8DC3BFFFF              call 004350F0
:00441514 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00441517 E8A2E3FFFF              call 0043F8BE
:0044151C 25FF000000              and eax, 000000FF
:00441521 3DFF000000              cmp eax, 000000FF
:00441526 741D                    je 00441545
:00441528 6A00                    push 00000000
:0044152A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044152D E88CE3FFFF              call 0043F8BE
:00441532 50                      push eax
:00441533 8B55F4                  mov edx, dword ptr [ebp-0C]
:00441536 668B4206                mov ax, word ptr [edx+06]
:0044153A 50                      push eax
:0044153B B950424B00              mov ecx, 004B4250
:00441540 E897240100              call 004539DC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00441506(C), :00441526(C)
|
:00441545 E95D010000              jmp 004416A7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441500(C)
|
:0044154A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044154D 81E1FF000000            and ecx, 000000FF
:00441553 83F901                  cmp ecx, 00000001
:00441556 0F858B000000            jne 004415E7
:0044155C 837DFC01                cmp dword ptr [ebp-04], 00000001
:00441560 7D33                    jge 00441595
:00441562 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00441565 E854E3FFFF              call 0043F8BE
:0044156A 25FF000000              and eax, 000000FF
:0044156F 3DFF000000              cmp eax, 000000FF
:00441574 741D                    je 00441593
:00441576 6A00                    push 00000000
:00441578 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044157B E83EE3FFFF              call 0043F8BE
:00441580 50                      push eax
:00441581 8B55F4                  mov edx, dword ptr [ebp-0C]
:00441584 668B4206                mov ax, word ptr [edx+06]
:00441588 50                      push eax
:00441589 B950424B00              mov ecx, 004B4250
:0044158E E849240100              call 004539DC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441574(C)
|
:00441593 EB4D                    jmp 004415E2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441560(C)
|
:00441595 B950424B00              mov ecx, 004B4250
:0044159A E893280100              call 00453E32
:0044159F 6A00                    push 00000000
:004415A1 8A4D0C                  mov cl, byte ptr [ebp+0C]
:004415A4 51                      push ecx
:004415A5 B950424B00              mov ecx, 004B4250
:004415AA E861390100              call 00454F10
:004415AF 8A550C                  mov dl, byte ptr [ebp+0C]
:004415B2 52                      push edx
:004415B3 B950424B00              mov ecx, 004B4250
:004415B8 E883240100              call 00453A40
:004415BD 68FF000000              push 000000FF
:004415C2 8B45F4                  mov eax, dword ptr [ebp-0C]
:004415C5 8A4804                  mov cl, byte ptr [eax+04]
:004415C8 51                      push ecx
:004415C9 6A01                    push 00000001
:004415CB 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004415CE 81E1FF000000            and ecx, 000000FF
:004415D4 6BC924                  imul ecx, 00000024
:004415D7 81C1502C4B00            add ecx, 004B2C50
:004415DD E8DBEEFFFF              call 004404BD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441593(U)
|
:004415E2 E9C0000000              jmp 004416A7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441556(C)
|
:004415E7 8B5508                  mov edx, dword ptr [ebp+08]
:004415EA 81E2FF000000            and edx, 000000FF
:004415F0 83FA02                  cmp edx, 00000002
:004415F3 0F85AE000000            jne 004416A7
:004415F9 837DFC01                cmp dword ptr [ebp-04], 00000001
:004415FD 7D51                    jge 00441650
:004415FF 8B4D10                  mov ecx, dword ptr [ebp+10]
:00441602 81E1FF000000            and ecx, 000000FF
:00441608 6BC946                  imul ecx, 00000046
:0044160B 81C1C0F44A00            add ecx, 004AF4C0
:00441611 E87A76FDFF              call 00418C90
:00441616 25FF000000              and eax, 000000FF
:0044161B 3DFF000000              cmp eax, 000000FF
:00441620 742C                    je 0044164E
:00441622 6A00                    push 00000000
:00441624 8B4D10                  mov ecx, dword ptr [ebp+10]
:00441627 81E1FF000000            and ecx, 000000FF
:0044162D 6BC946                  imul ecx, 00000046
:00441630 81C1C0F44A00            add ecx, 004AF4C0
:00441636 E85576FDFF              call 00418C90
:0044163B 50                      push eax
:0044163C 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044163F 668B4806                mov cx, word ptr [eax+06]
:00441643 51                      push ecx
:00441644 B950424B00              mov ecx, 004B4250
:00441649 E88E230100              call 004539DC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441620(C)
|
:0044164E EB57                    jmp 004416A7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004415FD(C)
|
:00441650 B950424B00              mov ecx, 004B4250
:00441655 E8D8270100              call 00453E32
:0044165A 6A00                    push 00000000
:0044165C 8A550C                  mov dl, byte ptr [ebp+0C]
:0044165F 52                      push edx
:00441660 B950424B00              mov ecx, 004B4250
:00441665 E8A6380100              call 00454F10
:0044166A 8A450C                  mov al, byte ptr [ebp+0C]
:0044166D 50                      push eax
:0044166E B950424B00              mov ecx, 004B4250
:00441673 E8C8230100              call 00453A40
:00441678 8A4D10                  mov cl, byte ptr [ebp+10]
:0044167B 51                      push ecx
:0044167C 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044167F 8A4204                  mov al, byte ptr [edx+04]
:00441682 50                      push eax
:00441683 8A4D10                  mov cl, byte ptr [ebp+10]
:00441686 51                      push ecx
:00441687 E892000000              call 0044171E
:0044168C 83C404                  add esp, 00000004
:0044168F 50                      push eax
:00441690 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00441693 81E1FF000000            and ecx, 000000FF
:00441699 6BC924                  imul ecx, 00000024
:0044169C 81C1502C4B00            add ecx, 004B2C50
:004416A2 E816EEFFFF              call 004404BD

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00441545(U), :004415E2(U), :004415F3(C), :0044164E(U)
|
:004416A7 B9083D4B00              mov ecx, 004B3D08
:004416AC E87F50FCFF              call 00406730
:004416B1 B950424B00              mov ecx, 004B4250
:004416B6 E858240100              call 00453B13
:004416BB E8ABAEFEFF              call 0042C56B
:004416C0 85C0                    test eax, eax
:004416C2 7402                    je 004416C6
:004416C4 EB0F                    jmp 004416D5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004416C2(C)
|
:004416C6 6A04                    push 00000004
:004416C8 E879AFFEFF              call 0042C646
:004416CD 83C404                  add esp, 00000004
:004416D0 E90BFEFFFF              jmp 004414E0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004414EF(C), :004416C4(U)
|
:004416D5 B950424B00              mov ecx, 004B4250
:004416DA E83D2F0100              call 0045461C
:004416DF B950424B00              mov ecx, 004B4250
:004416E4 E849270100              call 00453E32
:004416E9 6A00                    push 00000000
:004416EB B950424B00              mov ecx, 004B4250
:004416F0 E8FB39FFFF              call 004350F0
:004416F5 6A00                    push 00000000
:004416F7 68FF000000              push 000000FF
:004416FC 8B55F4                  mov edx, dword ptr [ebp-0C]
:004416FF 668B4206                mov ax, word ptr [edx+06]
:00441703 50                      push eax
:00441704 B950424B00              mov ecx, 004B4250
:00441709 E8CE220100              call 004539DC
:0044170E B950424B00              mov ecx, 004B4250
:00441713 E8FB230100              call 00453B13
:00441718 8BE5                    mov esp, ebp
:0044171A 5D                      pop ebp
:0044171B C20C00                  ret 000C



* Referenced by a CALL at Address:
|:00441687   
|
:0044171E 55                      push ebp
:0044171F 8BEC                    mov ebp, esp
:00441721 8B4508                  mov eax, dword ptr [ebp+08]
:00441724 25FF000000              and eax, 000000FF
:00441729 83F827                  cmp eax, 00000027
:0044172C 7C12                    jl 00441740
:0044172E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00441731 81E1FF000000            and ecx, 000000FF
:00441737 83F939                  cmp ecx, 00000039
:0044173A 7F04                    jg 00441740
:0044173C B003                    mov al, 03
:0044173E EB02                    jmp 00441742

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044172C(C), :0044173A(C)
|
:00441740 B002                    mov al, 02

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044173E(U)
|
:00441742 5D                      pop ebp
:00441743 C3                      ret



* Referenced by a CALL at Addresses:
|:0044CC7A   , :0044EF6A   , :0044EF9B   , :0045A593   , :0045A7F2   
|
:00441744 55                      push ebp
:00441745 8BEC                    mov ebp, esp
:00441747 83EC08                  sub esp, 00000008
:0044174A 894DF8                  mov dword ptr [ebp-08], ecx
:0044174D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00441750 E83B75FDFF              call 00418C90
:00441755 25FF000000              and eax, 000000FF
:0044175A 83F802                  cmp eax, 00000002
:0044175D 7405                    je 00441764
:0044175F E911020000              jmp 00441975

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044175D(C)
|
:00441764 837D0800                cmp dword ptr [ebp+08], 00000000
:00441768 7432                    je 0044179C
:0044176A 6A00                    push 00000000
:0044176C 8B45F8                  mov eax, dword ptr [ebp-08]
:0044176F 8A4804                  mov cl, byte ptr [eax+04]
:00441772 51                      push ecx
:00441773 B950424B00              mov ecx, 004B4250
:00441778 E893370100              call 00454F10
:0044177D 6A01                    push 00000001
:0044177F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00441782 E82F020000              call 004419B6
:00441787 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044178A E855130000              call 00442AE4
:0044178F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00441792 E832E5FFFF              call 0043FCC9
:00441797 E9E0000000              jmp 0044187C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441768(C)
|
:0044179C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044179F E88C170300              call 00472F30
:004417A4 85C0                    test eax, eax
:004417A6 741A                    je 004417C2
:004417A8 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004417AB E8A4E7FFFF              call 0043FF54
:004417B0 85C0                    test eax, eax
:004417B2 740E                    je 004417C2
:004417B4 8B55F8                  mov edx, dword ptr [ebp-08]
:004417B7 8B02                    mov eax, dword ptr [edx]
:004417B9 50                      push eax
:004417BA E8BC010000              call 0044197B
:004417BF 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004417A6(C), :004417B2(C)
|
:004417C2 837D0C00                cmp dword ptr [ebp+0C], 00000000
:004417C6 750C                    jne 004417D4
:004417C8 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004417CB E8A0DE0100              call 0045F670
:004417D0 85C0                    test eax, eax
:004417D2 7524                    jne 004417F8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004417C6(C)
|
:004417D4 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004417D7 8A5107                  mov dl, byte ptr [ecx+07]
:004417DA 52                      push edx
:004417DB 8B45F8                  mov eax, dword ptr [ebp-08]
:004417DE 8A4806                  mov cl, byte ptr [eax+06]
:004417E1 51                      push ecx
:004417E2 B950424B00              mov ecx, 004B4250
:004417E7 E853380100              call 0045503F
:004417EC 6A02                    push 00000002
:004417EE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004417F1 E8C0010000              call 004419B6
:004417F6 EB2B                    jmp 00441823

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004417D2(C)
|
:004417F8 6A00                    push 00000000
:004417FA 8B55F8                  mov edx, dword ptr [ebp-08]
:004417FD 8A4204                  mov al, byte ptr [edx+04]
:00441800 50                      push eax
:00441801 B950424B00              mov ecx, 004B4250
:00441806 E805370100              call 00454F10
:0044180B 6A01                    push 00000001
:0044180D 6A10                    push 00000010
:0044180F B9B0694B00              mov ecx, 004B69B0
:00441814 E8612E0300              call 0047467A
:00441819 6A00                    push 00000000
:0044181B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044181E E893010000              call 004419B6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004417F6(U)
|
:00441823 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00441826 E8B9120000              call 00442AE4
:0044182B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044182E E896E4FFFF              call 0043FCC9
:00441833 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00441836 8B11                    mov edx, dword ptr [ecx]
:00441838 52                      push edx
:00441839 E85289FDFF              call 0041A190
:0044183E 83C404                  add esp, 00000004
:00441841 85C0                    test eax, eax
:00441843 7437                    je 0044187C
:00441845 68FF000000              push 000000FF
:0044184A 6A01                    push 00000001
:0044184C 8B45F8                  mov eax, dword ptr [ebp-08]
:0044184F 8B08                    mov ecx, dword ptr [eax]
:00441851 6BC948                  imul ecx, 00000048
:00441854 81C1681B4A00            add ecx, 004A1B68
:0044185A E8610FFFFF              call 004327C0
:0044185F 50                      push eax
:00441860 E850E20300              call 0047FAB5
:00441865 83C40C                  add esp, 0000000C
:00441868 50                      push eax
:00441869 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044186C 8B09                    mov ecx, dword ptr [ecx]
:0044186E 6BC948                  imul ecx, 00000048
:00441871 81C1681B4A00            add ecx, 004A1B68
:00441877 E884180000              call 00443100

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00441797(U), :00441843(C)
|
:0044187C 6A03                    push 00000003
:0044187E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00441881 E89A180000              call 00443120
:00441886 8B55F8                  mov edx, dword ptr [ebp-08]
:00441889 C6421E00                mov [edx+1E], 00
:0044188D B9083D4B00              mov ecx, 004B3D08
:00441892 E8F38F0000              call 0044A88A
:00441897 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044189A E8D1DD0100              call 0045F670
:0044189F 50                      push eax
:004418A0 E85C810300              call 00479A01
:004418A5 83C404                  add esp, 00000004
:004418A8 6A00                    push 00000000
:004418AA 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004418AD E882E4FFFF              call 0043FD34
:004418B2 C645FC00                mov [ebp-04], 00
:004418B6 EB08                    jmp 004418C0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441970(U)
|
:004418B8 8A45FC                  mov al, byte ptr [ebp-04]
:004418BB 0401                    add al, 01
:004418BD 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004418B6(U)
|
:004418C0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004418C3 81E1FF000000            and ecx, 000000FF
:004418C9 83F973                  cmp ecx, 00000073
:004418CC 0F8DA3000000            jnl 00441975
:004418D2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004418D5 81E1FF000000            and ecx, 000000FF
:004418DB 6BC924                  imul ecx, 00000024
:004418DE 81C1502C4B00            add ecx, 004B2C50
:004418E4 E827AAFDFF              call 0041C310
:004418E9 25FF000000              and eax, 000000FF
:004418EE 8B55F8                  mov edx, dword ptr [ebp-08]
:004418F1 33C9                    xor ecx, ecx
:004418F3 8A4A04                  mov cl, byte ptr [edx+04]
:004418F6 3BC1                    cmp eax, ecx
:004418F8 7576                    jne 00441970
:004418FA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004418FD 81E1FF000000            and ecx, 000000FF
:00441903 6BC924                  imul ecx, 00000024
:00441906 81C1502C4B00            add ecx, 004B2C50
:0044190C E8BF41FEFF              call 00425AD0
:00441911 25FF000000              and eax, 000000FF
:00441916 85C0                    test eax, eax
:00441918 7421                    je 0044193B
:0044191A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044191D 81E1FF000000            and ecx, 000000FF
:00441923 6BC924                  imul ecx, 00000024
:00441926 81C1502C4B00            add ecx, 004B2C50
:0044192C E89F41FEFF              call 00425AD0
:00441931 25FF000000              and eax, 000000FF
:00441936 83F804                  cmp eax, 00000004
:00441939 7535                    jne 00441970

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441918(C)
|
:0044193B 68FF000000              push 000000FF
:00441940 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00441943 81E1FF000000            and ecx, 000000FF
:00441949 6BC924                  imul ecx, 00000024
:0044194C 81C1502C4B00            add ecx, 004B2C50
:00441952 E8E9170000              call 00443140
:00441957 6A01                    push 00000001
:00441959 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044195C 81E1FF000000            and ecx, 000000FF
:00441962 6BC924                  imul ecx, 00000024
:00441965 81C1502C4B00            add ecx, 004B2C50
:0044196B E8F90C0000              call 00442669

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004418F8(C), :00441939(C)
|
:00441970 E943FFFFFF              jmp 004418B8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044175F(U), :004418CC(C)
|
:00441975 8BE5                    mov esp, ebp
:00441977 5D                      pop ebp
:00441978 C20800                  ret 0008



* Referenced by a CALL at Address:
|:004417BA   
|
:0044197B 55                      push ebp
:0044197C 8BEC                    mov ebp, esp
:0044197E 81ECCC000000            sub esp, 000000CC
:00441984 837D081A                cmp dword ptr [ebp+08], 0000001A
:00441988 7328                    jnb 004419B2
:0044198A 8B4508                  mov eax, dword ptr [ebp+08]
:0044198D 50                      push eax
:0044198E 8D8D34FFFFFF            lea ecx, dword ptr [ebp+FFFFFF34]
:00441994 51                      push ecx
:00441995 E873A6FCFF              call 0040C00D
:0044199A 83C408                  add esp, 00000008
:0044199D 8B5508                  mov edx, dword ptr [ebp+08]
:004419A0 52                      push edx
:004419A1 8D8534FFFFFF            lea eax, dword ptr [ebp+FFFFFF34]
:004419A7 50                      push eax
:004419A8 B9F05D4B00              mov ecx, 004B5DF0
:004419AD E8AB7C0100              call 0045965D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441988(C)
|
:004419B2 8BE5                    mov esp, ebp
:004419B4 5D                      pop ebp
:004419B5 C3                      ret



* Referenced by a CALL at Addresses:
|:00441782   , :004417F1   , :0044181E   
|
:004419B6 55                      push ebp
:004419B7 8BEC                    mov ebp, esp
:004419B9 6AFF                    push FFFFFFFF
:004419BB 6852544800              push 00485452
:004419C0 64A100000000            mov eax, dword ptr fs:[00000000]
:004419C6 50                      push eax
:004419C7 64892500000000          mov dword ptr fs:[00000000], esp
:004419CE 81EC2C010000            sub esp, 0000012C
:004419D4 898DCCFEFFFF            mov dword ptr [ebp+FFFFFECC], ecx
:004419DA 8B85CCFEFFFF            mov eax, dword ptr [ebp+FFFFFECC]
:004419E0 668B4806                mov cx, word ptr [eax+06]
:004419E4 51                      push ecx
:004419E5 E894E00000              call 0044FA7E
:004419EA 83C404                  add esp, 00000004
:004419ED 8985D0FEFFFF            mov dword ptr [ebp+FFFFFED0], eax
:004419F3 8995D4FEFFFF            mov dword ptr [ebp+FFFFFED4], edx
:004419F9 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:004419FF 8995DCFEFFFF            mov dword ptr [ebp+FFFFFEDC], edx
:00441A05 8B85D4FEFFFF            mov eax, dword ptr [ebp+FFFFFED4]
:00441A0B 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:00441A11 8B8DCCFEFFFF            mov ecx, dword ptr [ebp+FFFFFECC]
:00441A17 668B5106                mov dx, word ptr [ecx+06]
:00441A1B 52                      push edx
:00441A1C 8D85D8FEFFFF            lea eax, dword ptr [ebp+FFFFFED8]
:00441A22 50                      push eax
:00441A23 E8F7DF0000              call 0044FA1F
:00441A28 83C408                  add esp, 00000008
:00441A2B 8B8DCCFEFFFF            mov ecx, dword ptr [ebp+FFFFFECC]
:00441A31 33D2                    xor edx, edx
:00441A33 8A5104                  mov dl, byte ptr [ecx+04]
:00441A36 52                      push edx
:00441A37 8B8DCCFEFFFF            mov ecx, dword ptr [ebp+FFFFFECC]
:00441A3D E806E2FFFF              call 0043FC48
:00441A42 8845F0                  mov byte ptr [ebp-10], al
:00441A45 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00441A4B E86018FCFF              call 004032B0
:00441A50 C745FC00000000          mov [ebp-04], 00000000
:00441A57 8A4508                  mov al, byte ptr [ebp+08]
:00441A5A 8885C8FEFFFF            mov byte ptr [ebp+FFFFFEC8], al
:00441A60 80BDC8FEFFFF00          cmp byte ptr [ebp+FFFFFEC8], 00
:00441A67 741F                    je 00441A88
:00441A69 80BDC8FEFFFF01          cmp byte ptr [ebp+FFFFFEC8], 01
:00441A70 0F8490000000            je 00441B06
:00441A76 80BDC8FEFFFF02          cmp byte ptr [ebp+FFFFFEC8], 02
:00441A7D 0F8428020000            je 00441CAB
:00441A83 E971050000              jmp 00441FF9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441A67(C)
|
:00441A88 C685E8FEFFFF00          mov byte ptr [ebp+FFFFFEE8], 00
:00441A8F EB0F                    jmp 00441AA0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441AFF(U)
|
:00441A91 8A8DE8FEFFFF            mov cl, byte ptr [ebp+FFFFFEE8]
:00441A97 80C101                  add cl, 01
:00441A9A 888DE8FEFFFF            mov byte ptr [ebp+FFFFFEE8], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441A8F(U)
|
:00441AA0 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:00441AA6 81E2FF000000            and edx, 000000FF
:00441AAC 83FA02                  cmp edx, 00000002
:00441AAF 7D50                    jge 00441B01
:00441AB1 8B8DCCFEFFFF            mov ecx, dword ptr [ebp+FFFFFECC]
:00441AB7 E828100000              call 00442AE4
:00441ABC 8B8DCCFEFFFF            mov ecx, dword ptr [ebp+FFFFFECC]
:00441AC2 E802E2FFFF              call 0043FCC9
:00441AC7 6A03                    push 00000003
:00441AC9 B9181B4B00              mov ecx, 004B1B18
:00441ACE E86D18FCFF              call 00403340
:00441AD3 E808AAFEFF              call 0042C4E0
:00441AD8 8B8DCCFEFFFF            mov ecx, dword ptr [ebp+FFFFFECC]
:00441ADE E8D80F0000              call 00442ABB
:00441AE3 8B8DCCFEFFFF            mov ecx, dword ptr [ebp+FFFFFECC]
:00441AE9 E8DBE1FFFF              call 0043FCC9
:00441AEE 6A03                    push 00000003
:00441AF0 B9181B4B00              mov ecx, 004B1B18
:00441AF5 E84618FCFF              call 00403340
:00441AFA E8E1A9FEFF              call 0042C4E0
:00441AFF EB90                    jmp 00441A91

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441AAF(C)
|
:00441B01 E9F3040000              jmp 00441FF9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441A70(C)
|

* Possible StringData Ref from Data Obj ->"UNIT_SPC.E5"
                                  |
:00441B06 68D0BB4800              push 0048BBD0
:00441B0B 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00441B11 E81FE0FDFF              call 0041FB35
:00441B16 6A04                    push 00000004
:00441B18 6A00                    push 00000000
:00441B1A 6800690000              push 00006900
:00441B1F B9C8E44A00              mov ecx, 004AE4C8
:00441B24 E817DF0300              call 0047FA40
:00441B29 50                      push eax
:00441B2A 8B45F0                  mov eax, dword ptr [ebp-10]
:00441B2D 25FF000000              and eax, 000000FF
:00441B32 50                      push eax
:00441B33 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00441B39 E84BE1FDFF              call 0041FC89
:00441B3E 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00441B44 E87C77FDFF              call 004192C5
:00441B49 6A01                    push 00000001

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:00441B4B 6A06                    push 00000006
:00441B4D B9B0694B00              mov ecx, 004B69B0
:00441B52 E8232B0300              call 0047467A
:00441B57 E87FCAFDFF              call 0041E5DB
:00441B5C 8B8DD9FEFFFF            mov ecx, dword ptr [ebp+FFFFFED9]
:00441B62 81E1FF000000            and ecx, 000000FF
:00441B68 51                      push ecx
:00441B69 8B95D8FEFFFF            mov edx, dword ptr [ebp+FFFFFED8]
:00441B6F 81E2FF000000            and edx, 000000FF
:00441B75 52                      push edx
:00441B76 E87E1BFCFF              call 004036F9
:00441B7B 83C408                  add esp, 00000008
:00441B7E 6A04                    push 00000004
:00441B80 6A00                    push 00000000
:00441B82 8B85CCFEFFFF            mov eax, dword ptr [ebp+FFFFFECC]
:00441B88 33C9                    xor ecx, ecx
:00441B8A 8A4804                  mov cl, byte ptr [eax+04]
:00441B8D 69C900630000            imul ecx, 00006300
:00441B93 81C100360000            add ecx, 00003600
:00441B99 51                      push ecx
:00441B9A B980AB4A00              mov ecx, 004AAB80
:00441B9F E89CDE0300              call 0047FA40
:00441BA4 50                      push eax
:00441BA5 8B95CCFEFFFF            mov edx, dword ptr [ebp+FFFFFECC]
:00441BAB 8A4204                  mov al, byte ptr [edx+04]
:00441BAE 50                      push eax
:00441BAF 6A30                    push 00000030
:00441BB1 6A30                    push 00000030
:00441BB3 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:00441BB9 51                      push ecx
:00441BBA 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:00441BC0 52                      push edx
:00441BC1 E8B6F70000              call 0045137C
:00441BC6 83C418                  add esp, 00000018
:00441BC9 E828CAFDFF              call 0041E5F6
:00441BCE 6A04                    push 00000004
:00441BD0 B9181B4B00              mov ecx, 004B1B18
:00441BD5 E86617FCFF              call 00403340
:00441BDA E801A9FEFF              call 0042C4E0
:00441BDF 6A01                    push 00000001
:00441BE1 6A11                    push 00000011
:00441BE3 B9B0694B00              mov ecx, 004B69B0
:00441BE8 E88D2A0300              call 0047467A
:00441BED C685E8FEFFFF00          mov byte ptr [ebp+FFFFFEE8], 00
:00441BF4 EB0E                    jmp 00441C04

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441CA1(U)
|
:00441BF6 8A85E8FEFFFF            mov al, byte ptr [ebp+FFFFFEE8]
:00441BFC 0401                    add al, 01
:00441BFE 8885E8FEFFFF            mov byte ptr [ebp+FFFFFEE8], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441BF4(U)
|
:00441C04 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00441C0A 81E1FF000000            and ecx, 000000FF
:00441C10 83F90C                  cmp ecx, 0000000C
:00441C13 0F8D8D000000            jnl 00441CA6
:00441C19 E8BDC9FDFF              call 0041E5DB
:00441C1E 8B95D9FEFFFF            mov edx, dword ptr [ebp+FFFFFED9]
:00441C24 81E2FF000000            and edx, 000000FF
:00441C2A 52                      push edx
:00441C2B 8B85D8FEFFFF            mov eax, dword ptr [ebp+FFFFFED8]
:00441C31 25FF000000              and eax, 000000FF
:00441C36 50                      push eax
:00441C37 E8BD1AFCFF              call 004036F9
:00441C3C 83C408                  add esp, 00000008
:00441C3F 6A04                    push 00000004
:00441C41 6A00                    push 00000000
:00441C43 6800690000              push 00006900
:00441C48 B9C8E44A00              mov ecx, 004AE4C8
:00441C4D E8EEDD0300              call 0047FA40
:00441C52 50                      push eax
:00441C53 8B8DCCFEFFFF            mov ecx, dword ptr [ebp+FFFFFECC]
:00441C59 8A5104                  mov dl, byte ptr [ecx+04]
:00441C5C 52                      push edx
:00441C5D 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:00441C63 25FF000000              and eax, 000000FF
:00441C68 C1E002                  shl eax, 02
:00441C6B B930000000              mov ecx, 00000030
:00441C70 2BC8                    sub ecx, eax
:00441C72 51                      push ecx
:00441C73 6A30                    push 00000030
:00441C75 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:00441C7B 52                      push edx
:00441C7C 8B85DCFEFFFF            mov eax, dword ptr [ebp+FFFFFEDC]
:00441C82 50                      push eax
:00441C83 E8F4F60000              call 0045137C
:00441C88 83C418                  add esp, 00000018
:00441C8B E866C9FDFF              call 0041E5F6
:00441C90 6A01                    push 00000001
:00441C92 B9181B4B00              mov ecx, 004B1B18
:00441C97 E8A416FCFF              call 00403340
:00441C9C E83FA8FEFF              call 0042C4E0
:00441CA1 E950FFFFFF              jmp 00441BF6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441C13(C)
|
:00441CA6 E94E030000              jmp 00441FF9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441A7D(C)
|
:00441CAB 6800090000              push 00000900
:00441CB0 6A04                    push 00000004
:00441CB2 6A00                    push 00000000
:00441CB4 6800690000              push 00006900
:00441CB9 B9C8E44A00              mov ecx, 004AE4C8
:00441CBE E87DDD0300              call 0047FA40
:00441CC3 50                      push eax
:00441CC4 6A04                    push 00000004
:00441CC6 6A00                    push 00000000
:00441CC8 8B8DCCFEFFFF            mov ecx, dword ptr [ebp+FFFFFECC]
:00441CCE 33D2                    xor edx, edx
:00441CD0 8A5104                  mov dl, byte ptr [ecx+04]
:00441CD3 69D200630000            imul edx, 00006300
:00441CD9 81C200510000            add edx, 00005100
:00441CDF 52                      push edx
:00441CE0 B980AB4A00              mov ecx, 004AAB80
:00441CE5 E856DD0300              call 0047FA40
:00441CEA 50                      push eax
:00441CEB E80DE00300              call 0047FCFD
:00441CF0 83C40C                  add esp, 0000000C
:00441CF3 6A20                    push 00000020
:00441CF5 8B8DCCFEFFFF            mov ecx, dword ptr [ebp+FFFFFECC]
:00441CFB E8180A0000              call 00442718
:00441D00 C685E4FEFFFF01          mov byte ptr [ebp+FFFFFEE4], 01
:00441D07 EB0E                    jmp 00441D17

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441DDD(U)
|
:00441D09 8A85E4FEFFFF            mov al, byte ptr [ebp+FFFFFEE4]
:00441D0F 0401                    add al, 01
:00441D11 8885E4FEFFFF            mov byte ptr [ebp+FFFFFEE4], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441D07(U)
|
:00441D17 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:00441D1D 81E1FF000000            and ecx, 000000FF
:00441D23 83F903                  cmp ecx, 00000003
:00441D26 0F8DB6000000            jnl 00441DE2
:00441D2C C685E8FEFFFF00          mov byte ptr [ebp+FFFFFEE8], 00
:00441D33 EB0F                    jmp 00441D44

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441DD8(U)
|
:00441D35 8A95E8FEFFFF            mov dl, byte ptr [ebp+FFFFFEE8]
:00441D3B 80C201                  add dl, 01
:00441D3E 8895E8FEFFFF            mov byte ptr [ebp+FFFFFEE8], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441D33(U)
|
:00441D44 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:00441D4A 25FF000000              and eax, 000000FF
:00441D4F 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:00441D55 81E1FF000000            and ecx, 000000FF
:00441D5B 8D540902                lea edx, dword ptr [ecx+ecx+02]
:00441D5F 3BC2                    cmp eax, edx
:00441D61 7D7A                    jge 00441DDD
:00441D63 8B8DCCFEFFFF            mov ecx, dword ptr [ebp+FFFFFECC]
:00441D69 E8760D0000              call 00442AE4
:00441D6E 8B8DCCFEFFFF            mov ecx, dword ptr [ebp+FFFFFECC]
:00441D74 E850DFFFFF              call 0043FCC9
:00441D79 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:00441D7F 25FF000000              and eax, 000000FF
:00441D84 D1E0                    shl eax, 1
:00441D86 B905000000              mov ecx, 00000005
:00441D8B 2BC8                    sub ecx, eax
:00441D8D 51                      push ecx
:00441D8E B9181B4B00              mov ecx, 004B1B18
:00441D93 E8A815FCFF              call 00403340
:00441D98 E843A7FEFF              call 0042C4E0
:00441D9D 8B8DCCFEFFFF            mov ecx, dword ptr [ebp+FFFFFECC]
:00441DA3 E8130D0000              call 00442ABB
:00441DA8 8B8DCCFEFFFF            mov ecx, dword ptr [ebp+FFFFFECC]
:00441DAE E816DFFFFF              call 0043FCC9
:00441DB3 8B95E4FEFFFF            mov edx, dword ptr [ebp+FFFFFEE4]
:00441DB9 81E2FF000000            and edx, 000000FF
:00441DBF D1E2                    shl edx, 1
:00441DC1 B805000000              mov eax, 00000005
:00441DC6 2BC2                    sub eax, edx
:00441DC8 50                      push eax
:00441DC9 B9181B4B00              mov ecx, 004B1B18
:00441DCE E86D15FCFF              call 00403340
:00441DD3 E808A7FEFF              call 0042C4E0
:00441DD8 E958FFFFFF              jmp 00441D35

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441D61(C)
|
:00441DDD E927FFFFFF              jmp 00441D09

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441D26(C)
|
:00441DE2 6A20                    push 00000020
:00441DE4 8B8DCCFEFFFF            mov ecx, dword ptr [ebp+FFFFFECC]
:00441DEA E8A148FCFF              call 00406690
:00441DEF 6A01                    push 00000001
:00441DF1 6A16                    push 00000016
:00441DF3 B9B0694B00              mov ecx, 004B69B0
:00441DF8 E87D280300              call 0047467A
:00441DFD C685E8FEFFFF00          mov byte ptr [ebp+FFFFFEE8], 00
:00441E04 EB0F                    jmp 00441E15

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441ED2(U)
|
:00441E06 8A8DE8FEFFFF            mov cl, byte ptr [ebp+FFFFFEE8]
:00441E0C 80C101                  add cl, 01
:00441E0F 888DE8FEFFFF            mov byte ptr [ebp+FFFFFEE8], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441E04(U)
|
:00441E15 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:00441E1B 81E2FF000000            and edx, 000000FF
:00441E21 83FA10                  cmp edx, 00000010
:00441E24 0F8DAD000000            jnl 00441ED7
:00441E2A E8ACC7FDFF              call 0041E5DB
:00441E2F 8B85D9FEFFFF            mov eax, dword ptr [ebp+FFFFFED9]
:00441E35 25FF000000              and eax, 000000FF
:00441E3A 50                      push eax
:00441E3B 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:00441E41 81E1FF000000            and ecx, 000000FF
:00441E47 51                      push ecx
:00441E48 E8AC18FCFF              call 004036F9
:00441E4D 83C408                  add esp, 00000008
:00441E50 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:00441E56 25FF000000              and eax, 000000FF
:00441E5B 99                      cdq
:00441E5C 2BC2                    sub eax, edx
:00441E5E D1F8                    sar eax, 1
:00441E60 83C001                  add eax, 00000001
:00441E63 50                      push eax
:00441E64 6A30                    push 00000030
:00441E66 6A30                    push 00000030
:00441E68 6A04                    push 00000004
:00441E6A 6A00                    push 00000000
:00441E6C 6800690000              push 00006900
:00441E71 B9C8E44A00              mov ecx, 004AE4C8
:00441E76 E8C5DB0300              call 0047FA40
:00441E7B 50                      push eax
:00441E7C E83FE5FEFF              call 004303C0
:00441E81 83C410                  add esp, 00000010
:00441E84 6A04                    push 00000004
:00441E86 6A00                    push 00000000
:00441E88 6800690000              push 00006900
:00441E8D B9C8E44A00              mov ecx, 004AE4C8
:00441E92 E8A9DB0300              call 0047FA40
:00441E97 50                      push eax
:00441E98 8B95CCFEFFFF            mov edx, dword ptr [ebp+FFFFFECC]
:00441E9E 8A4204                  mov al, byte ptr [edx+04]
:00441EA1 50                      push eax
:00441EA2 6A30                    push 00000030
:00441EA4 6A30                    push 00000030
:00441EA6 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:00441EAC 51                      push ecx
:00441EAD 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:00441EB3 52                      push edx
:00441EB4 E8C3F40000              call 0045137C
:00441EB9 83C418                  add esp, 00000018
:00441EBC E835C7FDFF              call 0041E5F6
:00441EC1 6A01                    push 00000001
:00441EC3 B9181B4B00              mov ecx, 004B1B18
:00441EC8 E87314FCFF              call 00403340
:00441ECD E80EA6FEFF              call 0042C4E0
:00441ED2 E92FFFFFFF              jmp 00441E06

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441E24(C)
|
:00441ED7 C685E8FEFFFF00          mov byte ptr [ebp+FFFFFEE8], 00
:00441EDE EB0E                    jmp 00441EEE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441FF4(U)
|
:00441EE0 8A85E8FEFFFF            mov al, byte ptr [ebp+FFFFFEE8]
:00441EE6 0401                    add al, 01
:00441EE8 8885E8FEFFFF            mov byte ptr [ebp+FFFFFEE8], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00441EDE(U)
|
:00441EEE 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00441EF4 81E1FF000000            and ecx, 000000FF
:00441EFA 83F910                  cmp ecx, 00000010
:00441EFD 0F8DF6000000            jnl 00441FF9
:00441F03 E8D3C6FDFF              call 0041E5DB
:00441F08 8B95D9FEFFFF            mov edx, dword ptr [ebp+FFFFFED9]
:00441F0E 81E2FF000000            and edx, 000000FF
:00441F14 52                      push edx
:00441F15 8B85D8FEFFFF            mov eax, dword ptr [ebp+FFFFFED8]
:00441F1B 25FF000000              and eax, 000000FF
:00441F20 50                      push eax
:00441F21 E8D317FCFF              call 004036F9
:00441F26 83C408                  add esp, 00000008
:00441F29 6A04                    push 00000004
:00441F2B 6A00                    push 00000000
:00441F2D 6A00                    push 00000000
:00441F2F B9C8E44A00              mov ecx, 004AE4C8
:00441F34 E807DB0300              call 0047FA40
:00441F39 50                      push eax
:00441F3A 6A30                    push 00000030
:00441F3C 6A30                    push 00000030
:00441F3E 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:00441F44 51                      push ecx
:00441F45 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:00441F4B 52                      push edx
:00441F4C E800C30300              call 0047E251
:00441F51 83C414                  add esp, 00000014
:00441F54 6A00                    push 00000000
:00441F56 6A00                    push 00000000
:00441F58 6A01                    push 00000001
:00441F5A 8A85E8FEFFFF            mov al, byte ptr [ebp+FFFFFEE8]
:00441F60 50                      push eax
:00441F61 6A04                    push 00000004
:00441F63 6A00                    push 00000000
:00441F65 6800090000              push 00000900
:00441F6A B9C8E44A00              mov ecx, 004AE4C8
:00441F6F E8CCDA0300              call 0047FA40
:00441F74 50                      push eax
:00441F75 6A04                    push 00000004
:00441F77 6A00                    push 00000000
:00441F79 6A00                    push 00000000
:00441F7B B9C8E44A00              mov ecx, 004AE4C8
:00441F80 E8BBDA0300              call 0047FA40
:00441F85 50                      push eax
:00441F86 6A04                    push 00000004
:00441F88 6A00                    push 00000000
:00441F8A 6800690000              push 00006900
:00441F8F B9C8E44A00              mov ecx, 004AE4C8
:00441F94 E8A7DA0300              call 0047FA40
:00441F99 50                      push eax
:00441F9A 6A30                    push 00000030
:00441F9C 6A30                    push 00000030
:00441F9E E8B7DDFEFF              call 0042FD5A
:00441FA3 83C424                  add esp, 00000024
:00441FA6 6A04                    push 00000004
:00441FA8 6A00                    push 00000000
:00441FAA 6800090000              push 00000900
:00441FAF B9C8E44A00              mov ecx, 004AE4C8
:00441FB4 E887DA0300              call 0047FA40
:00441FB9 50                      push eax
:00441FBA 8B8DCCFEFFFF            mov ecx, dword ptr [ebp+FFFFFECC]
:00441FC0 8A5104                  mov dl, byte ptr [ecx+04]
:00441FC3 52                      push edx
:00441FC4 6A30                    push 00000030
:00441FC6 6A30                    push 00000030
:00441FC8 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:00441FCE 50                      push eax
:00441FCF 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:00441FD5 51                      push ecx
:00441FD6 E8A1F30000              call 0045137C
:00441FDB 83C418                  add esp, 00000018
:00441FDE E813C6FDFF              call 0041E5F6
:00441FE3 6A01                    push 00000001
:00441FE5 B9181B4B00              mov ecx, 004B1B18
:00441FEA E85113FCFF              call 00403340
:00441FEF E8ECA4FEFF              call 0042C4E0
:00441FF4 E9E7FEFFFF              jmp 00441EE0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00441A83(U), :00441B01(U), :00441CA6(U), :00441EFD(C)
|
:00441FF9 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00442000 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00442006 E8C512FCFF              call 004032D0
:0044200B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044200E 64890D00000000          mov dword ptr fs:[00000000], ecx
:00442015 8BE5                    mov esp, ebp
:00442017 5D                      pop ebp
:00442018 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0043AA8A   , :0043DA8D   
|
:0044201B 55                      push ebp
:0044201C 8BEC                    mov ebp, esp
:0044201E 83EC64                  sub esp, 00000064
:00442021 53                      push ebx
:00442022 894DA0                  mov dword ptr [ebp-60], ecx
:00442025 B950424B00              mov ecx, 004B4250
:0044202A E864FA0000              call 00451A93
:0044202F 99                      cdq
:00442030 B930000000              mov ecx, 00000030
:00442035 F7F9                    idiv ecx
:00442037 8845EC                  mov byte ptr [ebp-14], al
:0044203A B950424B00              mov ecx, 004B4250
:0044203F E860FA0000              call 00451AA4
:00442044 99                      cdq
:00442045 B930000000              mov ecx, 00000030
:0044204A F7F9                    idiv ecx
:0044204C 8845E4                  mov byte ptr [ebp-1C], al
:0044204F 8B5DEC                  mov ebx, dword ptr [ebp-14]
:00442052 81E3FF000000            and ebx, 000000FF
:00442058 B950424B00              mov ecx, 004B4250
:0044205D E8E23D0100              call 00455E44
:00442062 99                      cdq
:00442063 B930000000              mov ecx, 00000030
:00442068 F7F9                    idiv ecx
:0044206A 03D8                    add ebx, eax
:0044206C 885DAC                  mov byte ptr [ebp-54], bl
:0044206F 8B5DE4                  mov ebx, dword ptr [ebp-1C]
:00442072 81E3FF000000            and ebx, 000000FF
:00442078 B950424B00              mov ecx, 004B4250
:0044207D E8E93D0100              call 00455E6B
:00442082 99                      cdq
:00442083 B930000000              mov ecx, 00000030
:00442088 F7F9                    idiv ecx
:0044208A 03D8                    add ebx, eax
:0044208C 885DB0                  mov byte ptr [ebp-50], bl
:0044208F 8B55A0                  mov edx, dword ptr [ebp-60]
:00442092 33C0                    xor eax, eax
:00442094 8A4206                  mov al, byte ptr [edx+06]
:00442097 8BD8                    mov ebx, eax
:00442099 B950424B00              mov ecx, 004B4250
:0044209E E8F0F90000              call 00451A93
:004420A3 99                      cdq
:004420A4 B930000000              mov ecx, 00000030
:004420A9 F7F9                    idiv ecx
:004420AB 2BD8                    sub ebx, eax
:004420AD 885DE8                  mov byte ptr [ebp-18], bl
:004420B0 8B55A0                  mov edx, dword ptr [ebp-60]
:004420B3 33C0                    xor eax, eax
:004420B5 8A4207                  mov al, byte ptr [edx+07]
:004420B8 8BD8                    mov ebx, eax
:004420BA B950424B00              mov ecx, 004B4250
:004420BF E8E0F90000              call 00451AA4
:004420C4 99                      cdq
:004420C5 B930000000              mov ecx, 00000030
:004420CA F7F9                    idiv ecx
:004420CC 2BD8                    sub ebx, eax
:004420CE 885DF0                  mov byte ptr [ebp-10], bl
:004420D1 8A55E8                  mov dl, byte ptr [ebp-18]
:004420D4 8855BC                  mov byte ptr [ebp-44], dl
:004420D7 8A45F0                  mov al, byte ptr [ebp-10]
:004420DA 8845B4                  mov byte ptr [ebp-4C], al
:004420DD 8A4D08                  mov cl, byte ptr [ebp+08]
:004420E0 51                      push ecx
:004420E1 8B55A0                  mov edx, dword ptr [ebp-60]
:004420E4 83C206                  add edx, 00000006
:004420E7 52                      push edx
:004420E8 E80839FFFF              call 004359F5
:004420ED 83C408                  add esp, 00000008
:004420F0 668B00                  mov ax, word ptr [eax]
:004420F3 668945B8                mov word ptr [ebp-48], ax
:004420F7 8B4DA0                  mov ecx, dword ptr [ebp-60]
:004420FA 83C106                  add ecx, 00000006
:004420FD 51                      push ecx
:004420FE E88137FFFF              call 00435884
:00442103 83C404                  add esp, 00000004
:00442106 8845C0                  mov byte ptr [ebp-40], al
:00442109 8D55B8                  lea edx, dword ptr [ebp-48]
:0044210C 52                      push edx
:0044210D E87237FFFF              call 00435884
:00442112 83C404                  add esp, 00000004
:00442115 8845D0                  mov byte ptr [ebp-30], al
:00442118 8B4508                  mov eax, dword ptr [ebp+08]
:0044211B 25FF000000              and eax, 000000FF
:00442120 89459C                  mov dword ptr [ebp-64], eax
:00442123 837D9C03                cmp dword ptr [ebp-64], 00000003
:00442127 0F872F020000            ja 0044235C
:0044212D 8B4D9C                  mov ecx, dword ptr [ebp-64]
:00442130 FF248D03264400          jmp dword ptr [4*ecx+00442603]
:00442137 8B55A0                  mov edx, dword ptr [ebp-60]
:0044213A C6420F00                mov [edx+0F], 00
:0044213E 8B45A0                  mov eax, dword ptr [ebp-60]
:00442141 33C9                    xor ecx, ecx
:00442143 8A4804                  mov cl, byte ptr [eax+04]
:00442146 51                      push ecx
:00442147 E8C9C3FFFF              call 0043E515
:0044214C 83C404                  add esp, 00000004
:0044214F 69C000090000            imul eax, 00000900
:00442155 D1E0                    shl eax, 1
:00442157 8945D4                  mov dword ptr [ebp-2C], eax
:0044215A 8B55A0                  mov edx, dword ptr [ebp-60]
:0044215D 33C0                    xor eax, eax
:0044215F 8A4207                  mov al, byte ptr [edx+07]
:00442162 83E801                  sub eax, 00000001
:00442165 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00442168 81E1FF000000            and ecx, 000000FF
:0044216E 3BC1                    cmp eax, ecx
:00442170 7F3A                    jg 004421AC
:00442172 8B55E4                  mov edx, dword ptr [ebp-1C]
:00442175 81E2FF000000            and edx, 000000FF
:0044217B 85D2                    test edx, edx
:0044217D 7E2D                    jle 004421AC
:0044217F 6A00                    push 00000000
:00442181 8B45E4                  mov eax, dword ptr [ebp-1C]
:00442184 25FF000000              and eax, 000000FF
:00442189 83E801                  sub eax, 00000001
:0044218C 50                      push eax
:0044218D 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00442190 81E1FF000000            and ecx, 000000FF
:00442196 51                      push ecx
:00442197 B950424B00              mov ecx, 004B4250
:0044219C E8DD290100              call 00454B7E
:004421A1 8A55B4                  mov dl, byte ptr [ebp-4C]
:004421A4 80C201                  add dl, 01
:004421A7 8855B4                  mov byte ptr [ebp-4C], dl
:004421AA EB08                    jmp 004421B4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00442170(C), :0044217D(C)
|
:004421AC 8A45F0                  mov al, byte ptr [ebp-10]
:004421AF 2C01                    sub al, 01
:004421B1 8845F0                  mov byte ptr [ebp-10], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004421AA(U)
|
:004421B4 E9A3010000              jmp 0044235C
:004421B9 8B4DA0                  mov ecx, dword ptr [ebp-60]
:004421BC C6410F02                mov [ecx+0F], 02
:004421C0 8B55A0                  mov edx, dword ptr [ebp-60]
:004421C3 33C0                    xor eax, eax
:004421C5 8A4204                  mov al, byte ptr [edx+04]
:004421C8 50                      push eax
:004421C9 E847C3FFFF              call 0043E515
:004421CE 83C404                  add esp, 00000004
:004421D1 69C000090000            imul eax, 00000900
:004421D7 D1E0                    shl eax, 1
:004421D9 8945D4                  mov dword ptr [ebp-2C], eax
:004421DC 8B4DA0                  mov ecx, dword ptr [ebp-60]
:004421DF 33D2                    xor edx, edx
:004421E1 8A5107                  mov dl, byte ptr [ecx+07]
:004421E4 83C201                  add edx, 00000001
:004421E7 8B45B0                  mov eax, dword ptr [ebp-50]
:004421EA 25FF000000              and eax, 000000FF
:004421EF 3BD0                    cmp edx, eax
:004421F1 7C42                    jl 00442235
:004421F3 8B4DB0                  mov ecx, dword ptr [ebp-50]
:004421F6 81E1FF000000            and ecx, 000000FF
:004421FC 33D2                    xor edx, edx
:004421FE 8A152D424B00            mov dl, byte ptr [004B422D]
:00442204 3BCA                    cmp ecx, edx
:00442206 7D2D                    jge 00442235
:00442208 6A00                    push 00000000
:0044220A 8B45E4                  mov eax, dword ptr [ebp-1C]
:0044220D 25FF000000              and eax, 000000FF
:00442212 83C001                  add eax, 00000001
:00442215 50                      push eax
:00442216 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00442219 81E1FF000000            and ecx, 000000FF
:0044221F 51                      push ecx
:00442220 B950424B00              mov ecx, 004B4250
:00442225 E854290100              call 00454B7E
:0044222A 8A55B4                  mov dl, byte ptr [ebp-4C]
:0044222D 80EA01                  sub dl, 01
:00442230 8855B4                  mov byte ptr [ebp-4C], dl
:00442233 EB08                    jmp 0044223D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004421F1(C), :00442206(C)
|
:00442235 8A45F0                  mov al, byte ptr [ebp-10]
:00442238 0401                    add al, 01
:0044223A 8845F0                  mov byte ptr [ebp-10], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442233(U)
|
:0044223D E91A010000              jmp 0044235C
:00442242 8B4DA0                  mov ecx, dword ptr [ebp-60]
:00442245 C6410F01                mov [ecx+0F], 01
:00442249 8B55A0                  mov edx, dword ptr [ebp-60]
:0044224C 33C0                    xor eax, eax
:0044224E 8A4204                  mov al, byte ptr [edx+04]
:00442251 50                      push eax
:00442252 E8BEC2FFFF              call 0043E515
:00442257 83C404                  add esp, 00000004
:0044225A 69C000090000            imul eax, 00000900
:00442260 D1E0                    shl eax, 1
:00442262 8945D4                  mov dword ptr [ebp-2C], eax
:00442265 6A01                    push 00000001
:00442267 8B4DA0                  mov ecx, dword ptr [ebp-60]
:0044226A E8C5DAFFFF              call 0043FD34
:0044226F 8B4DA0                  mov ecx, dword ptr [ebp-60]
:00442272 33D2                    xor edx, edx
:00442274 8A5106                  mov dl, byte ptr [ecx+06]
:00442277 83C201                  add edx, 00000001
:0044227A 8B45AC                  mov eax, dword ptr [ebp-54]
:0044227D 25FF000000              and eax, 000000FF
:00442282 3BD0                    cmp edx, eax
:00442284 7C42                    jl 004422C8
:00442286 8B4DAC                  mov ecx, dword ptr [ebp-54]
:00442289 81E1FF000000            and ecx, 000000FF
:0044228F 33D2                    xor edx, edx
:00442291 8A152C424B00            mov dl, byte ptr [004B422C]
:00442297 3BCA                    cmp ecx, edx
:00442299 7D2D                    jge 004422C8
:0044229B 6A00                    push 00000000
:0044229D 8B45E4                  mov eax, dword ptr [ebp-1C]
:004422A0 25FF000000              and eax, 000000FF
:004422A5 50                      push eax
:004422A6 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004422A9 81E1FF000000            and ecx, 000000FF
:004422AF 83C101                  add ecx, 00000001
:004422B2 51                      push ecx
:004422B3 B950424B00              mov ecx, 004B4250
:004422B8 E8C1280100              call 00454B7E
:004422BD 8A55BC                  mov dl, byte ptr [ebp-44]
:004422C0 80EA01                  sub dl, 01
:004422C3 8855BC                  mov byte ptr [ebp-44], dl
:004422C6 EB08                    jmp 004422D0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00442284(C), :00442299(C)
|
:004422C8 8A45E8                  mov al, byte ptr [ebp-18]
:004422CB 0401                    add al, 01
:004422CD 8845E8                  mov byte ptr [ebp-18], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004422C6(U)
|
:004422D0 E987000000              jmp 0044235C
:004422D5 8B4DA0                  mov ecx, dword ptr [ebp-60]
:004422D8 C6410F03                mov [ecx+0F], 03
:004422DC 8B55A0                  mov edx, dword ptr [ebp-60]
:004422DF 33C0                    xor eax, eax
:004422E1 8A4204                  mov al, byte ptr [edx+04]
:004422E4 50                      push eax
:004422E5 E82BC2FFFF              call 0043E515
:004422EA 83C404                  add esp, 00000004
:004422ED 69C000090000            imul eax, 00000900
:004422F3 D1E0                    shl eax, 1
:004422F5 8945D4                  mov dword ptr [ebp-2C], eax
:004422F8 6A00                    push 00000000
:004422FA 8B4DA0                  mov ecx, dword ptr [ebp-60]
:004422FD E832DAFFFF              call 0043FD34
:00442302 8B4DA0                  mov ecx, dword ptr [ebp-60]
:00442305 33D2                    xor edx, edx
:00442307 8A5106                  mov dl, byte ptr [ecx+06]
:0044230A 83EA01                  sub edx, 00000001
:0044230D 8B45EC                  mov eax, dword ptr [ebp-14]
:00442310 25FF000000              and eax, 000000FF
:00442315 3BD0                    cmp edx, eax
:00442317 7F3A                    jg 00442353
:00442319 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0044231C 81E1FF000000            and ecx, 000000FF
:00442322 85C9                    test ecx, ecx
:00442324 7E2D                    jle 00442353
:00442326 6A00                    push 00000000
:00442328 8B55E4                  mov edx, dword ptr [ebp-1C]
:0044232B 81E2FF000000            and edx, 000000FF
:00442331 52                      push edx
:00442332 8B45EC                  mov eax, dword ptr [ebp-14]
:00442335 25FF000000              and eax, 000000FF
:0044233A 83E801                  sub eax, 00000001
:0044233D 50                      push eax
:0044233E B950424B00              mov ecx, 004B4250
:00442343 E836280100              call 00454B7E
:00442348 8A4DBC                  mov cl, byte ptr [ebp-44]
:0044234B 80C101                  add cl, 01
:0044234E 884DBC                  mov byte ptr [ebp-44], cl
:00442351 EB09                    jmp 0044235C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00442317(C), :00442324(C)
|
:00442353 8A55E8                  mov dl, byte ptr [ebp-18]
:00442356 80EA01                  sub dl, 01
:00442359 8855E8                  mov byte ptr [ebp-18], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00442127(C), :004421B4(U), :0044223D(U), :004422D0(U), :00442351(U)
|
:0044235C 8B45BC                  mov eax, dword ptr [ebp-44]
:0044235F 25FF000000              and eax, 000000FF
:00442364 6BC030                  imul eax, 00000030
:00442367 8945DC                  mov dword ptr [ebp-24], eax
:0044236A 8B4DB4                  mov ecx, dword ptr [ebp-4C]
:0044236D 81E1FF000000            and ecx, 000000FF
:00442373 6BC930                  imul ecx, 00000030
:00442376 83C138                  add ecx, 00000038
:00442379 894DD8                  mov dword ptr [ebp-28], ecx
:0044237C 8B55E8                  mov edx, dword ptr [ebp-18]
:0044237F 81E2FF000000            and edx, 000000FF
:00442385 6BD230                  imul edx, 00000030
:00442388 8955CC                  mov dword ptr [ebp-34], edx
:0044238B 8B45F0                  mov eax, dword ptr [ebp-10]
:0044238E 25FF000000              and eax, 000000FF
:00442393 6BC030                  imul eax, 00000030
:00442396 83C038                  add eax, 00000038
:00442399 8945C4                  mov dword ptr [ebp-3C], eax
:0044239C C645FC30                mov [ebp-04], 30
:004423A0 C645FD0C                mov [ebp-03], 0C
:004423A4 C645FE06                mov [ebp-02], 06
:004423A8 C645C830                mov [ebp-38], 30
:004423AC C645C918                mov [ebp-37], 18
:004423B0 C645CA0C                mov [ebp-36], 0C
:004423B4 8B4DA0                  mov ecx, dword ptr [ebp-60]
:004423B7 E8B2DBFFFF              call 0043FF6E
:004423BC 85C0                    test eax, eax
:004423BE 7418                    je 004423D8
:004423C0 B970074B00              mov ecx, 004B0770
:004423C5 E8469FFDFF              call 0041C310
:004423CA 25FF000000              and eax, 000000FF
:004423CF 8A4C05C8                mov cl, byte ptr [ebp+eax-38]
:004423D3 884DF4                  mov byte ptr [ebp-0C], cl
:004423D6 EB16                    jmp 004423EE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004423BE(C)
|
:004423D8 B970074B00              mov ecx, 004B0770
:004423DD E82E9FFDFF              call 0041C310
:004423E2 25FF000000              and eax, 000000FF
:004423E7 8A5405FC                mov dl, byte ptr [ebp+eax-04]
:004423EB 8855F4                  mov byte ptr [ebp-0C], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004423D6(U)
|
:004423EE 6A04                    push 00000004
:004423F0 6A00                    push 00000000
:004423F2 6A00                    push 00000000
:004423F4 B980AB4A00              mov ecx, 004AAB80
:004423F9 E842D60300              call 0047FA40
:004423FE 8B4DA0                  mov ecx, dword ptr [ebp-60]
:00442401 33D2                    xor edx, edx
:00442403 8A5104                  mov dl, byte ptr [ecx+04]
:00442406 69D200630000            imul edx, 00006300
:0044240C 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0044240F 03C8                    add ecx, eax
:00442411 03D1                    add edx, ecx
:00442413 8955F8                  mov dword ptr [ebp-08], edx
:00442416 B9C8E44A00              mov ecx, 004AE4C8
:0044241B E870BCFCFF              call 0040E090
:00442420 50                      push eax
:00442421 6A30                    push 00000030
:00442423 6A30                    push 00000030
:00442425 8B55C4                  mov edx, dword ptr [ebp-3C]
:00442428 52                      push edx
:00442429 8B45CC                  mov eax, dword ptr [ebp-34]
:0044242C 50                      push eax
:0044242D E81FBE0300              call 0047E251
:00442432 83C414                  add esp, 00000014
:00442435 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00442438 81E1FF000000            and ecx, 000000FF
:0044243E 894DE0                  mov dword ptr [ebp-20], ecx
:00442441 EB11                    jmp 00442454

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004425E1(U)
|
:00442443 8B55F4                  mov edx, dword ptr [ebp-0C]
:00442446 81E2FF000000            and edx, 000000FF
:0044244C 8B45E0                  mov eax, dword ptr [ebp-20]
:0044244F 03C2                    add eax, edx
:00442451 8945E0                  mov dword ptr [ebp-20], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442441(U)
|
:00442454 837DE030                cmp dword ptr [ebp-20], 00000030
:00442458 0F8788010000            ja 004425E6
:0044245E 6A01                    push 00000001
:00442460 B9181B4B00              mov ecx, 004B1B18
:00442465 E8D60EFCFF              call 00403340
:0044246A E86CC1FDFF              call 0041E5DB
:0044246F 8B4DB4                  mov ecx, dword ptr [ebp-4C]
:00442472 81E1FF000000            and ecx, 000000FF
:00442478 51                      push ecx
:00442479 8B55BC                  mov edx, dword ptr [ebp-44]
:0044247C 81E2FF000000            and edx, 000000FF
:00442482 52                      push edx
:00442483 E87112FCFF              call 004036F9
:00442488 83C408                  add esp, 00000008
:0044248B 8B45C0                  mov eax, dword ptr [ebp-40]
:0044248E 25FF000000              and eax, 000000FF
:00442493 3DFF000000              cmp eax, 000000FF
:00442498 7425                    je 004424BF
:0044249A 8B4DA0                  mov ecx, dword ptr [ebp-60]
:0044249D 33D2                    xor edx, edx
:0044249F 8A510F                  mov dl, byte ptr [ecx+0F]
:004424A2 85D2                    test edx, edx
:004424A4 7419                    je 004424BF
:004424A6 8B45C0                  mov eax, dword ptr [ebp-40]
:004424A9 25FF000000              and eax, 000000FF
:004424AE 50                      push eax
:004424AF 8B4DD8                  mov ecx, dword ptr [ebp-28]
:004424B2 51                      push ecx
:004424B3 8B55DC                  mov edx, dword ptr [ebp-24]
:004424B6 52                      push edx
:004424B7 E863C6FFFF              call 0043EB1F
:004424BC 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00442498(C), :004424A4(C)
|
:004424BF 6A00                    push 00000000
:004424C1 B9C8E44A00              mov ecx, 004AE4C8
:004424C6 E8C5BBFCFF              call 0040E090
:004424CB 50                      push eax
:004424CC 6A30                    push 00000030
:004424CE 6A30                    push 00000030
:004424D0 8B45C4                  mov eax, dword ptr [ebp-3C]
:004424D3 50                      push eax
:004424D4 8B4DCC                  mov ecx, dword ptr [ebp-34]
:004424D7 51                      push ecx
:004424D8 E836F40000              call 00451913
:004424DD 83C418                  add esp, 00000018
:004424E0 8B55BC                  mov edx, dword ptr [ebp-44]
:004424E3 81E2FF000000            and edx, 000000FF
:004424E9 6BD230                  imul edx, 00000030
:004424EC 8B45E8                  mov eax, dword ptr [ebp-18]
:004424EF 25FF000000              and eax, 000000FF
:004424F4 8B4DBC                  mov ecx, dword ptr [ebp-44]
:004424F7 81E1FF000000            and ecx, 000000FF
:004424FD 2BC1                    sub eax, ecx
:004424FF 0FAF45E0                imul eax, dword ptr [ebp-20]
:00442503 03D0                    add edx, eax
:00442505 8955A8                  mov dword ptr [ebp-58], edx
:00442508 8B55B4                  mov edx, dword ptr [ebp-4C]
:0044250B 81E2FF000000            and edx, 000000FF
:00442511 6BD230                  imul edx, 00000030
:00442514 8B45F0                  mov eax, dword ptr [ebp-10]
:00442517 25FF000000              and eax, 000000FF
:0044251C 8B4DB4                  mov ecx, dword ptr [ebp-4C]
:0044251F 81E1FF000000            and ecx, 000000FF
:00442525 2BC1                    sub eax, ecx
:00442527 0FAF45E0                imul eax, dword ptr [ebp-20]
:0044252B 8D540238                lea edx, dword ptr [edx+eax+38]
:0044252F 8955A4                  mov dword ptr [ebp-5C], edx
:00442532 8B45E0                  mov eax, dword ptr [ebp-20]
:00442535 83E801                  sub eax, 00000001
:00442538 33D2                    xor edx, edx
:0044253A B918000000              mov ecx, 00000018
:0044253F F7F1                    div ecx
:00442541 69C000090000            imul eax, 00000900
:00442547 8B55F8                  mov edx, dword ptr [ebp-08]
:0044254A 03D0                    add edx, eax
:0044254C 52                      push edx
:0044254D 8B45A0                  mov eax, dword ptr [ebp-60]
:00442550 8A4804                  mov cl, byte ptr [eax+04]
:00442553 51                      push ecx
:00442554 6A30                    push 00000030
:00442556 6A30                    push 00000030
:00442558 8B55A4                  mov edx, dword ptr [ebp-5C]
:0044255B 52                      push edx
:0044255C 8B45A8                  mov eax, dword ptr [ebp-58]
:0044255F 50                      push eax
:00442560 E817EE0000              call 0045137C
:00442565 83C418                  add esp, 00000018
:00442568 8B4DD0                  mov ecx, dword ptr [ebp-30]
:0044256B 81E1FF000000            and ecx, 000000FF
:00442571 81F9FF000000            cmp ecx, 000000FF
:00442577 7427                    je 004425A0
:00442579 8B55A0                  mov edx, dword ptr [ebp-60]
:0044257C 33C0                    xor eax, eax
:0044257E 8A420F                  mov al, byte ptr [edx+0F]
:00442581 83F802                  cmp eax, 00000002
:00442584 751A                    jne 004425A0
:00442586 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00442589 81E1FF000000            and ecx, 000000FF
:0044258F 51                      push ecx
:00442590 8B55C4                  mov edx, dword ptr [ebp-3C]
:00442593 52                      push edx
:00442594 8B45CC                  mov eax, dword ptr [ebp-34]
:00442597 50                      push eax
:00442598 E882C5FFFF              call 0043EB1F
:0044259D 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00442577(C), :00442584(C)
|
:004425A0 8B4DC0                  mov ecx, dword ptr [ebp-40]
:004425A3 81E1FF000000            and ecx, 000000FF
:004425A9 81F9FF000000            cmp ecx, 000000FF
:004425AF 7426                    je 004425D7
:004425B1 8B55A0                  mov edx, dword ptr [ebp-60]
:004425B4 33C0                    xor eax, eax
:004425B6 8A420F                  mov al, byte ptr [edx+0F]
:004425B9 85C0                    test eax, eax
:004425BB 751A                    jne 004425D7
:004425BD 8B4DC0                  mov ecx, dword ptr [ebp-40]
:004425C0 81E1FF000000            and ecx, 000000FF
:004425C6 51                      push ecx
:004425C7 8B55D8                  mov edx, dword ptr [ebp-28]
:004425CA 52                      push edx
:004425CB 8B45DC                  mov eax, dword ptr [ebp-24]
:004425CE 50                      push eax
:004425CF E84BC5FFFF              call 0043EB1F
:004425D4 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004425AF(C), :004425BB(C)
|
:004425D7 E81AC0FDFF              call 0041E5F6
:004425DC E8FF9EFEFF              call 0042C4E0
:004425E1 E95DFEFFFF              jmp 00442443

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442458(C)
|
:004425E6 668B4DB8                mov cx, word ptr [ebp-48]
:004425EA 51                      push ecx
:004425EB 8B4DA0                  mov ecx, dword ptr [ebp-60]
:004425EE E87D8EFFFF              call 0043B470
:004425F3 50                      push eax
:004425F4 E892CDFFFF              call 0043F38B
:004425F9 83C408                  add esp, 00000008
:004425FC 5B                      pop ebx
:004425FD 8BE5                    mov esp, ebp
:004425FF 5D                      pop ebp
:00442600 C20400                  ret 0004



:00442603 37214400                DWORD 00442137
:00442607 42224400                DWORD 00442242
:0044260B B9214400                DWORD 004421B9
:0044260F D5224400                DWORD 004422D5



* Referenced by a CALL at Addresses:
|:0044D822   , :0045A604   
|
:00442613 55                      push ebp
:00442614 8BEC                    mov ebp, esp
:00442616 51                      push ecx
:00442617 894DFC                  mov dword ptr [ebp-04], ecx
:0044261A 8B45FC                  mov eax, dword ptr [ebp-04]
:0044261D C700FFFF0000            mov dword ptr [eax], 0000FFFF
:00442623 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00442626 8A5508                  mov dl, byte ptr [ebp+08]
:00442629 885104                  mov byte ptr [ecx+04], dl
:0044262C 8B45FC                  mov eax, dword ptr [ebp-04]
:0044262F C64006FF                mov [eax+06], FF
:00442633 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00442636 C64107FF                mov [ecx+07], FF
:0044263A 8B55FC                  mov edx, dword ptr [ebp-04]
:0044263D C64208FF                mov [edx+08], FF
:00442641 8B45FC                  mov eax, dword ptr [ebp-04]
:00442644 C6400E00                mov [eax+0E], 00
:00442648 6A00                    push 00000000
:0044264A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044264D E8CE0A0000              call 00443120
:00442652 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00442655 C6410D00                mov [ecx+0D], 00
:00442659 6A01                    push 00000001
:0044265B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044265E E84D66FDFF              call 00418CB0
:00442663 8BE5                    mov esp, ebp
:00442665 5D                      pop ebp
:00442666 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0043ADC0   , :004402E9   , :0044196B   , :0044D944   , :0045956A   
|:004595E1   , :00459E0A   , :0045A6A5   
|
:00442669 55                      push ebp
:0044266A 8BEC                    mov ebp, esp
:0044266C 51                      push ecx
:0044266D 894DFC                  mov dword ptr [ebp-04], ecx
:00442670 8B4508                  mov eax, dword ptr [ebp+08]
:00442673 25FF000000              and eax, 000000FF
:00442678 83F807                  cmp eax, 00000007
:0044267B 7F09                    jg 00442686
:0044267D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00442680 8A5508                  mov dl, byte ptr [ebp+08]
:00442683 88510E                  mov byte ptr [ecx+0E], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044267B(C)
|
:00442686 8BE5                    mov esp, ebp
:00442688 5D                      pop ebp
:00442689 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:004594D2   , :004595CD   , :0045A73C   , :0045B6E7   
|
:0044268C 55                      push ebp
:0044268D 8BEC                    mov ebp, esp
:0044268F 83EC08                  sub esp, 00000008
:00442692 894DF8                  mov dword ptr [ebp-08], ecx
:00442695 8A450C                  mov al, byte ptr [ebp+0C]
:00442698 50                      push eax
:00442699 8A4D08                  mov cl, byte ptr [ebp+08]
:0044269C 51                      push ecx
:0044269D 8D4DFC                  lea ecx, dword ptr [ebp-04]
:004426A0 E82B66FDFF              call 00418CD0
:004426A5 8D55FC                  lea edx, dword ptr [ebp-04]
:004426A8 52                      push edx
:004426A9 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004426AC E8F7DAFFFF              call 004401A8
:004426B1 85C0                    test eax, eax
:004426B3 741B                    je 004426D0
:004426B5 8B45F8                  mov eax, dword ptr [ebp-08]
:004426B8 8A4D08                  mov cl, byte ptr [ebp+08]
:004426BB 884809                  mov byte ptr [eax+09], cl
:004426BE 8B55F8                  mov edx, dword ptr [ebp-08]
:004426C1 8A450C                  mov al, byte ptr [ebp+0C]
:004426C4 88420A                  mov byte ptr [edx+0A], al
:004426C7 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004426CA C64108FF                mov [ecx+08], FF
:004426CE EB42                    jmp 00442712

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004426B3(C)
|
:004426D0 8B5508                  mov edx, dword ptr [ebp+08]
:004426D3 81E2FF000000            and edx, 000000FF
:004426D9 33C0                    xor eax, eax
:004426DB A02C424B00              mov al, byte ptr [004B422C]
:004426E0 3BD0                    cmp edx, eax
:004426E2 7D2E                    jge 00442712
:004426E4 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004426E7 81E1FF000000            and ecx, 000000FF
:004426ED 33D2                    xor edx, edx
:004426EF 8A152D424B00            mov dl, byte ptr [004B422D]
:004426F5 3BCA                    cmp ecx, edx
:004426F7 7D19                    jge 00442712
:004426F9 8B45F8                  mov eax, dword ptr [ebp-08]
:004426FC 8A4D08                  mov cl, byte ptr [ebp+08]
:004426FF 884809                  mov byte ptr [eax+09], cl
:00442702 8B55F8                  mov edx, dword ptr [ebp-08]
:00442705 8A450C                  mov al, byte ptr [ebp+0C]
:00442708 88420A                  mov byte ptr [edx+0A], al
:0044270B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044270E C64108FF                mov [ecx+08], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004426CE(U), :004426E2(C), :004426F7(C)
|
:00442712 8BE5                    mov esp, ebp
:00442714 5D                      pop ebp
:00442715 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:00404488   , :004055CD   , :0043AAE0   , :0043ACFF   , :0043AD09   
|:0043B403   , :0043DAB0   , :0043DC0E   , :0043DCC5   , :0043DDD8   
|:0043E1AE   , :0043FE15   , :00441CFB   , :0045758C   , :00457753   
|:00459560   , :00459603   , :0045974B   , :004598D1   , :0045A7E2   
|
:00442718 55                      push ebp
:00442719 8BEC                    mov ebp, esp
:0044271B 51                      push ecx
:0044271C 894DFC                  mov dword ptr [ebp-04], ecx
:0044271F 8B4508                  mov eax, dword ptr [ebp+08]
:00442722 25FF000000              and eax, 000000FF
:00442727 F7D0                    not eax
:00442729 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044272C 8A510D                  mov dl, byte ptr [ecx+0D]
:0044272F 22D0                    and dl, al
:00442731 8B45FC                  mov eax, dword ptr [ebp-04]
:00442734 88500D                  mov byte ptr [eax+0D], dl
:00442737 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044273A 8A510D                  mov dl, byte ptr [ecx+0D]
:0044273D 0A5508                  or dl, byte ptr [ebp+08]
:00442740 8B45FC                  mov eax, dword ptr [ebp-04]
:00442743 88500D                  mov byte ptr [eax+0D], dl
:00442746 8BE5                    mov esp, ebp
:00442748 5D                      pop ebp
:00442749 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0044CD4B   , :0044CDB0   , :0044CDFA   , :0044CF64   , :004592B6   
|:00459412   
|
:0044274C 55                      push ebp
:0044274D 8BEC                    mov ebp, esp
:0044274F 51                      push ecx
:00442750 894DFC                  mov dword ptr [ebp-04], ecx
:00442753 6A01                    push 00000001
:00442755 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00442758 E8C3090000              call 00443120
:0044275D 8B45FC                  mov eax, dword ptr [ebp-04]
:00442760 8B4D08                  mov ecx, dword ptr [ebp+08]
:00442763 8908                    mov dword ptr [eax], ecx
:00442765 8B550C                  mov edx, dword ptr [ebp+0C]
:00442768 52                      push edx
:00442769 E80D740000              call 00449B7B
:0044276E 83C404                  add esp, 00000004
:00442771 50                      push eax
:00442772 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00442775 E856D4FFFF              call 0043FBD0
:0044277A 8B450C                  mov eax, dword ptr [ebp+0C]
:0044277D 50                      push eax
:0044277E E865730000              call 00449AE8
:00442783 83C404                  add esp, 00000004
:00442786 50                      push eax
:00442787 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044278A E8E13EFCFF              call 00406670
:0044278F 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00442792 83E104                  and ecx, 00000004
:00442795 51                      push ecx
:00442796 8B550C                  mov edx, dword ptr [ebp+0C]
:00442799 83E208                  and edx, 00000008
:0044279C 52                      push edx
:0044279D 8A4514                  mov al, byte ptr [ebp+14]
:004427A0 50                      push eax
:004427A1 8A4D10                  mov cl, byte ptr [ebp+10]
:004427A4 51                      push ecx
:004427A5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004427A8 E856030000              call 00442B03
:004427AD 8B4D08                  mov ecx, dword ptr [ebp+08]
:004427B0 6BC948                  imul ecx, 00000048
:004427B3 81C1681B4A00            add ecx, 004A1B68
:004427B9 E85D4AFCFF              call 0040721B
:004427BE 8B55FC                  mov edx, dword ptr [ebp-04]
:004427C1 894210                  mov dword ptr [edx+10], eax
:004427C4 8B4D08                  mov ecx, dword ptr [ebp+08]
:004427C7 6BC948                  imul ecx, 00000048
:004427CA 81C1681B4A00            add ecx, 004A1B68
:004427D0 E8754AFCFF              call 0040724A
:004427D5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004427D8 894114                  mov dword ptr [ecx+14], eax
:004427DB 8B55FC                  mov edx, dword ptr [ebp-04]
:004427DE C6421803                mov [edx+18], 03
:004427E2 8B45FC                  mov eax, dword ptr [ebp-04]
:004427E5 C6401903                mov [eax+19], 03
:004427E9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004427EC C6411A03                mov [ecx+1A], 03
:004427F0 8B55FC                  mov edx, dword ptr [ebp-04]
:004427F3 C6421B03                mov [edx+1B], 03
:004427F7 8B45FC                  mov eax, dword ptr [ebp-04]
:004427FA C6401C03                mov [eax+1C], 03
:004427FE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00442801 C6411D03                mov [ecx+1D], 03
:00442805 8B55FC                  mov edx, dword ptr [ebp-04]
:00442808 C6421E00                mov [edx+1E], 00
:0044280C 8B4508                  mov eax, dword ptr [ebp+08]
:0044280F 50                      push eax
:00442810 E87B79FDFF              call 0041A190
:00442815 83C404                  add esp, 00000004
:00442818 85C0                    test eax, eax
:0044281A 7435                    je 00442851
:0044281C 68FF000000              push 000000FF
:00442821 6A01                    push 00000001
:00442823 8B4D08                  mov ecx, dword ptr [ebp+08]
:00442826 6BC948                  imul ecx, 00000048
:00442829 81C1681B4A00            add ecx, 004A1B68
:0044282F E86CFFFEFF              call 004327A0
:00442834 50                      push eax
:00442835 E87BD20300              call 0047FAB5
:0044283A 83C40C                  add esp, 0000000C
:0044283D 50                      push eax
:0044283E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00442841 6BC948                  imul ecx, 00000048
:00442844 81C1681B4A00            add ecx, 004A1B68
:0044284A E811090000              call 00443160
:0044284F EB39                    jmp 0044288A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044281A(C)
|
:00442851 6A00                    push 00000000
:00442853 8B4D08                  mov ecx, dword ptr [ebp+08]
:00442856 6BC948                  imul ecx, 00000048
:00442859 81C1681B4A00            add ecx, 004A1B68
:0044285F E8FC080000              call 00443160
:00442864 6A00                    push 00000000
:00442866 8B4D08                  mov ecx, dword ptr [ebp+08]
:00442869 6BC948                  imul ecx, 00000048
:0044286C 81C1681B4A00            add ecx, 004A1B68
:00442872 E809090000              call 00443180
:00442877 6A00                    push 00000000
:00442879 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044287C 6BC948                  imul ecx, 00000048
:0044287F 81C1681B4A00            add ecx, 004A1B68
:00442885 E876080000              call 00443100

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044284F(U)
|
:0044288A 8BE5                    mov esp, ebp
:0044288C 5D                      pop ebp
:0044288D C21000                  ret 0010



* Referenced by a CALL at Addresses:
|:0044CE1F   , :0044CF89   
|
:00442890 55                      push ebp
:00442891 8BEC                    mov ebp, esp
:00442893 83EC18                  sub esp, 00000018
:00442896 894DF0                  mov dword ptr [ebp-10], ecx
:00442899 8B45F0                  mov eax, dword ptr [ebp-10]
:0044289C 8B08                    mov ecx, dword ptr [eax]
:0044289E 6BC948                  imul ecx, 00000048
:004428A1 81C1681B4A00            add ecx, 004A1B68
:004428A7 894DF4                  mov dword ptr [ebp-0C], ecx
:004428AA 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004428AD E8BEB6FDFF              call 0041DF70
:004428B2 8845F8                  mov byte ptr [ebp-08], al
:004428B5 8B55F0                  mov edx, dword ptr [ebp-10]
:004428B8 813AAE000000            cmp dword ptr [edx], 000000AE
:004428BE 7232                    jb 004428F2
:004428C0 B970074B00              mov ecx, 004B0770
:004428C5 E8966CFCFF              call 00409560
:004428CA 25FF000000              and eax, 000000FF
:004428CF 8945EC                  mov dword ptr [ebp-14], eax
:004428D2 837DEC03                cmp dword ptr [ebp-14], 00000003
:004428D6 771A                    ja 004428F2
:004428D8 8B45EC                  mov eax, dword ptr [ebp-14]
:004428DB FF2485E9294400          jmp dword ptr [4*eax+004429E9]
:004428E2 C6450800                mov [ebp+08], 00
:004428E6 EB0A                    jmp 004428F2
:004428E8 C6450801                mov [ebp+08], 01
:004428EC EB04                    jmp 004428F2
:004428EE C6450802                mov [ebp+08], 02

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004428BE(C), :004428D6(C), :004428E6(U), :004428EC(U)
|
:004428F2 8A4D08                  mov cl, byte ptr [ebp+08]
:004428F5 884DE8                  mov byte ptr [ebp-18], cl
:004428F8 807DE800                cmp byte ptr [ebp-18], 00
:004428FC 0F8498000000            je 0044299A
:00442902 807DE801                cmp byte ptr [ebp-18], 01
:00442906 740B                    je 00442913
:00442908 807DE802                cmp byte ptr [ebp-18], 02
:0044290C 7437                    je 00442945
:0044290E E987000000              jmp 0044299A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442906(C)
|
:00442913 8B55F8                  mov edx, dword ptr [ebp-08]
:00442916 81E2FF000000            and edx, 000000FF
:0044291C 83FA26                  cmp edx, 00000026
:0044291F 7F22                    jg 00442943
:00442921 8B450C                  mov eax, dword ptr [ebp+0C]
:00442924 25FF000000              and eax, 000000FF
:00442929 83F80F                  cmp eax, 0000000F
:0044292C 7C15                    jl 00442943
:0044292E 8A4DF8                  mov cl, byte ptr [ebp-08]
:00442931 80C101                  add cl, 01
:00442934 884DF8                  mov byte ptr [ebp-08], cl
:00442937 8A55F8                  mov dl, byte ptr [ebp-08]
:0044293A 52                      push edx
:0044293B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044293E E8ADB6FCFF              call 0040DFF0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044291F(C), :0044292C(C)
|
:00442943 EB55                    jmp 0044299A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044290C(C)
|
:00442945 8B45F8                  mov eax, dword ptr [ebp-08]
:00442948 25FF000000              and eax, 000000FF
:0044294D 83F826                  cmp eax, 00000026
:00442950 7F48                    jg 0044299A
:00442952 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00442955 81E1FF000000            and ecx, 000000FF
:0044295B 83F91E                  cmp ecx, 0000001E
:0044295E 7C17                    jl 00442977
:00442960 8A55F8                  mov dl, byte ptr [ebp-08]
:00442963 80C202                  add dl, 02
:00442966 8855F8                  mov byte ptr [ebp-08], dl
:00442969 8A45F8                  mov al, byte ptr [ebp-08]
:0044296C 50                      push eax
:0044296D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00442970 E87BB6FCFF              call 0040DFF0
:00442975 EB23                    jmp 0044299A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044295E(C)
|
:00442977 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0044297A 81E1FF000000            and ecx, 000000FF
:00442980 83F90F                  cmp ecx, 0000000F
:00442983 7C15                    jl 0044299A
:00442985 8A55F8                  mov dl, byte ptr [ebp-08]
:00442988 80C201                  add dl, 01
:0044298B 8855F8                  mov byte ptr [ebp-08], dl
:0044298E 8A45F8                  mov al, byte ptr [ebp-08]
:00442991 50                      push eax
:00442992 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00442995 E856B6FCFF              call 0040DFF0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004428FC(C), :0044290E(U), :00442943(U), :00442950(C), :00442975(U)
|:00442983(C)
|
:0044299A 8A4D0C                  mov cl, byte ptr [ebp+0C]
:0044299D 51                      push ecx
:0044299E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004429A1 E86AB6FCFF              call 0040E010
:004429A6 C645FC00                mov [ebp-04], 00
:004429AA EB09                    jmp 004429B5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004429E1(U)
|
:004429AC 8A55FC                  mov dl, byte ptr [ebp-04]
:004429AF 80C201                  add dl, 01
:004429B2 8855FC                  mov byte ptr [ebp-04], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004429AA(U)
|
:004429B5 8B45FC                  mov eax, dword ptr [ebp-04]
:004429B8 25FF000000              and eax, 000000FF
:004429BD 83F807                  cmp eax, 00000007
:004429C0 7D21                    jge 004429E3
:004429C2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004429C5 81E1FF000000            and ecx, 000000FF
:004429CB 51                      push ecx
:004429CC 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004429CF E8F75FFCFF              call 004089CB
:004429D4 50                      push eax
:004429D5 8A55FC                  mov dl, byte ptr [ebp-04]
:004429D8 52                      push edx
:004429D9 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004429DC E83644FCFF              call 00406E17
:004429E1 EBC9                    jmp 004429AC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004429C0(C)
|
:004429E3 8BE5                    mov esp, ebp
:004429E5 5D                      pop ebp
:004429E6 C20800                  ret 0008



:004429E9 EE284400                DWORD 004428EE
:004429ED EE284400                DWORD 004428EE
:004429F1 EE284400                DWORD 004428EE
:004429F5 EE284400                DWORD 004428EE



* Referenced by a CALL at Addresses:
|:00416675   , :004166A8   , :004166DD   , :0044CE46   , :0044CE6D   
|:0044CE92   , :0044CFB0   , :0044CFD7   , :0044CFFC   
|
:004429F9 55                      push ebp
:004429FA 8BEC                    mov ebp, esp
:004429FC 51                      push ecx
:004429FD 894DFC                  mov dword ptr [ebp-04], ecx
:00442A00 817D0CFF000000          cmp dword ptr [ebp+0C], 000000FF
:00442A07 7413                    je 00442A1C
:00442A09 837D0C68                cmp dword ptr [ebp+0C], 00000068
:00442A0D 730D                    jnb 00442A1C
:00442A0F 8B4508                  mov eax, dword ptr [ebp+08]
:00442A12 25FF000000              and eax, 000000FF
:00442A17 83F802                  cmp eax, 00000002
:00442A1A 7E07                    jle 00442A23

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00442A07(C), :00442A0D(C)
|
:00442A1C 33C0                    xor eax, eax
:00442A1E E992000000              jmp 00442AB5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442A1A(C)
|
:00442A23 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00442A26 E86562FDFF              call 00418C90
:00442A2B 25FF000000              and eax, 000000FF
:00442A30 85C0                    test eax, eax
:00442A32 740B                    je 00442A3F
:00442A34 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00442A37 8139FFFF0000            cmp dword ptr [ecx], 0000FFFF
:00442A3D 7504                    jne 00442A43

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442A32(C)
|
:00442A3F 33C0                    xor eax, eax
:00442A41 EB72                    jmp 00442AB5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442A3D(C)
|
:00442A43 837D0C00                cmp dword ptr [ebp+0C], 00000000
:00442A47 751B                    jne 00442A64
:00442A49 6A00                    push 00000000
:00442A4B 8A5508                  mov dl, byte ptr [ebp+08]
:00442A4E 52                      push edx
:00442A4F 8B45FC                  mov eax, dword ptr [ebp-04]
:00442A52 8B08                    mov ecx, dword ptr [eax]
:00442A54 6BC948                  imul ecx, 00000048
:00442A57 81C1681B4A00            add ecx, 004A1B68
:00442A5D E88555FCFF              call 00407FE7
:00442A62 EB3E                    jmp 00442AA2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442A47(C)
|
:00442A64 837D0C01                cmp dword ptr [ebp+0C], 00000001
:00442A68 7519                    jne 00442A83
:00442A6A 8A4D08                  mov cl, byte ptr [ebp+08]
:00442A6D 51                      push ecx
:00442A6E 8B55FC                  mov edx, dword ptr [ebp-04]
:00442A71 8B0A                    mov ecx, dword ptr [edx]
:00442A73 6BC948                  imul ecx, 00000048
:00442A76 81C1681B4A00            add ecx, 004A1B68
:00442A7C E84353FCFF              call 00407DC4
:00442A81 EB1F                    jmp 00442AA2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442A68(C)
|
:00442A83 8A4510                  mov al, byte ptr [ebp+10]
:00442A86 50                      push eax
:00442A87 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00442A8A 51                      push ecx
:00442A8B 8A5508                  mov dl, byte ptr [ebp+08]
:00442A8E 52                      push edx
:00442A8F 8B45FC                  mov eax, dword ptr [ebp-04]
:00442A92 8B08                    mov ecx, dword ptr [eax]
:00442A94 6BC948                  imul ecx, 00000048
:00442A97 81C1681B4A00            add ecx, 004A1B68
:00442A9D E84A53FCFF              call 00407DEC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00442A62(U), :00442A81(U)
|
:00442AA2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00442AA5 8B11                    mov edx, dword ptr [ecx]
:00442AA7 52                      push edx
:00442AA8 E8546F0300              call 00479A01
:00442AAD 83C404                  add esp, 00000004
:00442AB0 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00442A1E(U), :00442A41(U)
|
:00442AB5 8BE5                    mov esp, ebp
:00442AB7 5D                      pop ebp
:00442AB8 C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:0043AAE8   , :0043DAA6   , :00441ADE   , :00441DA3   , :0045A68E   
|
:00442ABB 55                      push ebp
:00442ABC 8BEC                    mov ebp, esp
:00442ABE 51                      push ecx
:00442ABF 894DFC                  mov dword ptr [ebp-04], ecx
:00442AC2 8B45FC                  mov eax, dword ptr [ebp-04]
:00442AC5 8A4804                  mov cl, byte ptr [eax+04]
:00442AC8 51                      push ecx
:00442AC9 8B55FC                  mov edx, dword ptr [ebp-04]
:00442ACC 83C206                  add edx, 00000006
:00442ACF 52                      push edx
:00442AD0 E82B2EFFFF              call 00435900
:00442AD5 83C408                  add esp, 00000008
:00442AD8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00442ADB E8E9D1FFFF              call 0043FCC9
:00442AE0 8BE5                    mov esp, ebp
:00442AE2 5D                      pop ebp
:00442AE3 C3                      ret



* Referenced by a CALL at Addresses:
|:0043AA1C   , :0043DA20   , :0044178A   , :00441826   , :00441AB7   
|:00441D69   , :0045A5DF   
|
:00442AE4 55                      push ebp
:00442AE5 8BEC                    mov ebp, esp
:00442AE7 51                      push ecx
:00442AE8 894DFC                  mov dword ptr [ebp-04], ecx
:00442AEB 68FF000000              push 000000FF
:00442AF0 8B45FC                  mov eax, dword ptr [ebp-04]
:00442AF3 83C006                  add eax, 00000006
:00442AF6 50                      push eax
:00442AF7 E8042EFFFF              call 00435900
:00442AFC 83C408                  add esp, 00000008
:00442AFF 8BE5                    mov esp, ebp
:00442B01 5D                      pop ebp
:00442B02 C3                      ret



* Referenced by a CALL at Addresses:
|:00415088   , :004350DF   , :004427A8   , :004571D6   , :00457334   
|:004594E6   
|
:00442B03 55                      push ebp
:00442B04 8BEC                    mov ebp, esp
:00442B06 83EC10                  sub esp, 00000010
:00442B09 894DF0                  mov dword ptr [ebp-10], ecx
:00442B0C 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00442B0F E8FCCB0100              call 0045F710
:00442B14 837D1400                cmp dword ptr [ebp+14], 00000000
:00442B18 740A                    je 00442B24
:00442B1A B801000000              mov eax, 00000001
:00442B1F E9CC000000              jmp 00442BF0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442B18(C)
|
:00442B24 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00442B27 E86461FDFF              call 00418C90
:00442B2C 25FF000000              and eax, 000000FF
:00442B31 83F801                  cmp eax, 00000001
:00442B34 7557                    jne 00442B8D
:00442B36 6A02                    push 00000002
:00442B38 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00442B3B E8E0050000              call 00443120
:00442B40 8B4510                  mov eax, dword ptr [ebp+10]
:00442B43 50                      push eax
:00442B44 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00442B47 E8E8D1FFFF              call 0043FD34
:00442B4C 8A4D0C                  mov cl, byte ptr [ebp+0C]
:00442B4F 51                      push ecx
:00442B50 8A5508                  mov dl, byte ptr [ebp+08]
:00442B53 52                      push edx
:00442B54 8D4DF8                  lea ecx, dword ptr [ebp-08]
:00442B57 E87461FDFF              call 00418CD0
:00442B5C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00442B5F E80C89FFFF              call 0043B470
:00442B64 50                      push eax
:00442B65 668B45F8                mov ax, word ptr [ebp-08]
:00442B69 50                      push eax
:00442B6A 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:00442B6D 51                      push ecx
:00442B6E E8CDC4FFFF              call 0043F040
:00442B73 83C40C                  add esp, 0000000C
:00442B76 50                      push eax
:00442B77 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00442B7A E8213AFCFF              call 004065A0
:00442B7F 8A55FC                  mov dl, byte ptr [ebp-04]
:00442B82 885508                  mov byte ptr [ebp+08], dl
:00442B85 8A45FD                  mov al, byte ptr [ebp-03]
:00442B88 88450C                  mov byte ptr [ebp+0C], al
:00442B8B EB2E                    jmp 00442BBB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442B34(C)
|
:00442B8D 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00442B90 E8FB60FDFF              call 00418C90
:00442B95 25FF000000              and eax, 000000FF
:00442B9A 83F802                  cmp eax, 00000002
:00442B9D 751C                    jne 00442BBB
:00442B9F 68FF000000              push 000000FF
:00442BA4 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00442BA7 83C106                  add ecx, 00000006
:00442BAA 51                      push ecx
:00442BAB E8502DFFFF              call 00435900
:00442BB0 83C408                  add esp, 00000008
:00442BB3 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00442BB6 E80ED1FFFF              call 0043FCC9

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00442B8B(U), :00442B9D(C)
|
:00442BBB 8B55F0                  mov edx, dword ptr [ebp-10]
:00442BBE 8A4508                  mov al, byte ptr [ebp+08]
:00442BC1 884206                  mov byte ptr [edx+06], al
:00442BC4 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00442BC7 8A550C                  mov dl, byte ptr [ebp+0C]
:00442BCA 885107                  mov byte ptr [ecx+07], dl
:00442BCD 8B45F0                  mov eax, dword ptr [ebp-10]
:00442BD0 8A4804                  mov cl, byte ptr [eax+04]
:00442BD3 51                      push ecx
:00442BD4 8B55F0                  mov edx, dword ptr [ebp-10]
:00442BD7 83C206                  add edx, 00000006
:00442BDA 52                      push edx
:00442BDB E8202DFFFF              call 00435900
:00442BE0 83C408                  add esp, 00000008
:00442BE3 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00442BE6 E8DED0FFFF              call 0043FCC9
:00442BEB B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00442B1F(U)
|
:00442BF0 8BE5                    mov esp, ebp
:00442BF2 5D                      pop ebp
:00442BF3 C21000                  ret 0010



* Referenced by a CALL at Address:
|:0044F67A   
|
:00442BF6 55                      push ebp
:00442BF7 8BEC                    mov ebp, esp
:00442BF9 51                      push ecx
:00442BFA 894DFC                  mov dword ptr [ebp-04], ecx
:00442BFD 8B45FC                  mov eax, dword ptr [ebp-04]
:00442C00 8B08                    mov ecx, dword ptr [eax]
:00442C02 81E1FF000000            and ecx, 000000FF
:00442C08 8B5508                  mov edx, dword ptr [ebp+08]
:00442C0B 880A                    mov byte ptr [edx], cl
:00442C0D 8B4508                  mov eax, dword ptr [ebp+08]
:00442C10 83C001                  add eax, 00000001
:00442C13 894508                  mov dword ptr [ebp+08], eax
:00442C16 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00442C19 8B11                    mov edx, dword ptr [ecx]
:00442C1B C1EA08                  shr edx, 08
:00442C1E 8B4508                  mov eax, dword ptr [ebp+08]
:00442C21 8810                    mov byte ptr [eax], dl
:00442C23 8B4D08                  mov ecx, dword ptr [ebp+08]
:00442C26 83C101                  add ecx, 00000001
:00442C29 894D08                  mov dword ptr [ebp+08], ecx
:00442C2C 8B55FC                  mov edx, dword ptr [ebp-04]
:00442C2F 8B4210                  mov eax, dword ptr [edx+10]
:00442C32 25FF000000              and eax, 000000FF
:00442C37 8B4D08                  mov ecx, dword ptr [ebp+08]
:00442C3A 8801                    mov byte ptr [ecx], al
:00442C3C 8B5508                  mov edx, dword ptr [ebp+08]
:00442C3F 83C201                  add edx, 00000001
:00442C42 895508                  mov dword ptr [ebp+08], edx
:00442C45 8B45FC                  mov eax, dword ptr [ebp-04]
:00442C48 8B4810                  mov ecx, dword ptr [eax+10]
:00442C4B C1E908                  shr ecx, 08
:00442C4E 8B5508                  mov edx, dword ptr [ebp+08]
:00442C51 880A                    mov byte ptr [edx], cl
:00442C53 8B4508                  mov eax, dword ptr [ebp+08]
:00442C56 83C001                  add eax, 00000001
:00442C59 894508                  mov dword ptr [ebp+08], eax
:00442C5C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00442C5F 8B5114                  mov edx, dword ptr [ecx+14]
:00442C62 81E2FF000000            and edx, 000000FF
:00442C68 8B4508                  mov eax, dword ptr [ebp+08]
:00442C6B 8810                    mov byte ptr [eax], dl
:00442C6D 8B4D08                  mov ecx, dword ptr [ebp+08]
:00442C70 83C101                  add ecx, 00000001
:00442C73 894D08                  mov dword ptr [ebp+08], ecx
:00442C76 8B55FC                  mov edx, dword ptr [ebp-04]
:00442C79 8B4214                  mov eax, dword ptr [edx+14]
:00442C7C C1E808                  shr eax, 08
:00442C7F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00442C82 8801                    mov byte ptr [ecx], al
:00442C84 8B5508                  mov edx, dword ptr [ebp+08]
:00442C87 83C201                  add edx, 00000001
:00442C8A 895508                  mov dword ptr [ebp+08], edx
:00442C8D 8B4508                  mov eax, dword ptr [ebp+08]
:00442C90 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00442C93 8A5104                  mov dl, byte ptr [ecx+04]
:00442C96 8810                    mov byte ptr [eax], dl
:00442C98 8B4508                  mov eax, dword ptr [ebp+08]
:00442C9B 83C001                  add eax, 00000001
:00442C9E 894508                  mov dword ptr [ebp+08], eax
:00442CA1 8B4D08                  mov ecx, dword ptr [ebp+08]
:00442CA4 8B55FC                  mov edx, dword ptr [ebp-04]
:00442CA7 8A4205                  mov al, byte ptr [edx+05]
:00442CAA 8801                    mov byte ptr [ecx], al
:00442CAC 8B4D08                  mov ecx, dword ptr [ebp+08]
:00442CAF 83C101                  add ecx, 00000001
:00442CB2 894D08                  mov dword ptr [ebp+08], ecx
:00442CB5 8B5508                  mov edx, dword ptr [ebp+08]
:00442CB8 8B45FC                  mov eax, dword ptr [ebp-04]
:00442CBB 8A4806                  mov cl, byte ptr [eax+06]
:00442CBE 880A                    mov byte ptr [edx], cl
:00442CC0 8B5508                  mov edx, dword ptr [ebp+08]
:00442CC3 83C201                  add edx, 00000001
:00442CC6 895508                  mov dword ptr [ebp+08], edx
:00442CC9 8B4508                  mov eax, dword ptr [ebp+08]
:00442CCC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00442CCF 8A5107                  mov dl, byte ptr [ecx+07]
:00442CD2 8810                    mov byte ptr [eax], dl
:00442CD4 8B4508                  mov eax, dword ptr [ebp+08]
:00442CD7 83C001                  add eax, 00000001
:00442CDA 894508                  mov dword ptr [ebp+08], eax
:00442CDD 8B4D08                  mov ecx, dword ptr [ebp+08]
:00442CE0 8B55FC                  mov edx, dword ptr [ebp-04]
:00442CE3 8A4209                  mov al, byte ptr [edx+09]
:00442CE6 8801                    mov byte ptr [ecx], al
:00442CE8 8B4D08                  mov ecx, dword ptr [ebp+08]
:00442CEB 83C101                  add ecx, 00000001
:00442CEE 894D08                  mov dword ptr [ebp+08], ecx
:00442CF1 8B5508                  mov edx, dword ptr [ebp+08]
:00442CF4 8B45FC                  mov eax, dword ptr [ebp-04]
:00442CF7 8A480A                  mov cl, byte ptr [eax+0A]
:00442CFA 880A                    mov byte ptr [edx], cl
:00442CFC 8B5508                  mov edx, dword ptr [ebp+08]
:00442CFF 83C201                  add edx, 00000001
:00442D02 895508                  mov dword ptr [ebp+08], edx
:00442D05 8B4508                  mov eax, dword ptr [ebp+08]
:00442D08 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00442D0B 8A5108                  mov dl, byte ptr [ecx+08]
:00442D0E 8810                    mov byte ptr [eax], dl
:00442D10 8B4508                  mov eax, dword ptr [ebp+08]
:00442D13 83C001                  add eax, 00000001
:00442D16 894508                  mov dword ptr [ebp+08], eax
:00442D19 8B4D08                  mov ecx, dword ptr [ebp+08]
:00442D1C 8B55FC                  mov edx, dword ptr [ebp-04]
:00442D1F 8A420B                  mov al, byte ptr [edx+0B]
:00442D22 8801                    mov byte ptr [ecx], al
:00442D24 8B4D08                  mov ecx, dword ptr [ebp+08]
:00442D27 83C101                  add ecx, 00000001
:00442D2A 894D08                  mov dword ptr [ebp+08], ecx
:00442D2D 8B5508                  mov edx, dword ptr [ebp+08]
:00442D30 8B45FC                  mov eax, dword ptr [ebp-04]
:00442D33 8A480C                  mov cl, byte ptr [eax+0C]
:00442D36 880A                    mov byte ptr [edx], cl
:00442D38 8B5508                  mov edx, dword ptr [ebp+08]
:00442D3B 83C201                  add edx, 00000001
:00442D3E 895508                  mov dword ptr [ebp+08], edx
:00442D41 8B4508                  mov eax, dword ptr [ebp+08]
:00442D44 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00442D47 8A510D                  mov dl, byte ptr [ecx+0D]
:00442D4A 8810                    mov byte ptr [eax], dl
:00442D4C 8B4508                  mov eax, dword ptr [ebp+08]
:00442D4F 83C001                  add eax, 00000001
:00442D52 894508                  mov dword ptr [ebp+08], eax
:00442D55 8B4D08                  mov ecx, dword ptr [ebp+08]
:00442D58 8B55FC                  mov edx, dword ptr [ebp-04]
:00442D5B 8A420E                  mov al, byte ptr [edx+0E]
:00442D5E 8801                    mov byte ptr [ecx], al
:00442D60 8B4D08                  mov ecx, dword ptr [ebp+08]
:00442D63 83C101                  add ecx, 00000001
:00442D66 894D08                  mov dword ptr [ebp+08], ecx
:00442D69 8B5508                  mov edx, dword ptr [ebp+08]
:00442D6C 8B45FC                  mov eax, dword ptr [ebp-04]
:00442D6F 8A480F                  mov cl, byte ptr [eax+0F]
:00442D72 880A                    mov byte ptr [edx], cl
:00442D74 8B5508                  mov edx, dword ptr [ebp+08]
:00442D77 83C201                  add edx, 00000001
:00442D7A 895508                  mov dword ptr [ebp+08], edx
:00442D7D 8B4508                  mov eax, dword ptr [ebp+08]
:00442D80 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00442D83 8A5118                  mov dl, byte ptr [ecx+18]
:00442D86 8810                    mov byte ptr [eax], dl
:00442D88 8B4508                  mov eax, dword ptr [ebp+08]
:00442D8B 83C001                  add eax, 00000001
:00442D8E 894508                  mov dword ptr [ebp+08], eax
:00442D91 8B4D08                  mov ecx, dword ptr [ebp+08]
:00442D94 8B55FC                  mov edx, dword ptr [ebp-04]
:00442D97 8A4219                  mov al, byte ptr [edx+19]
:00442D9A 8801                    mov byte ptr [ecx], al
:00442D9C 8B4D08                  mov ecx, dword ptr [ebp+08]
:00442D9F 83C101                  add ecx, 00000001
:00442DA2 894D08                  mov dword ptr [ebp+08], ecx
:00442DA5 8B5508                  mov edx, dword ptr [ebp+08]
:00442DA8 8B45FC                  mov eax, dword ptr [ebp-04]
:00442DAB 8A481A                  mov cl, byte ptr [eax+1A]
:00442DAE 880A                    mov byte ptr [edx], cl
:00442DB0 8B5508                  mov edx, dword ptr [ebp+08]
:00442DB3 83C201                  add edx, 00000001
:00442DB6 895508                  mov dword ptr [ebp+08], edx
:00442DB9 8B4508                  mov eax, dword ptr [ebp+08]
:00442DBC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00442DBF 8A511B                  mov dl, byte ptr [ecx+1B]
:00442DC2 8810                    mov byte ptr [eax], dl
:00442DC4 8B4508                  mov eax, dword ptr [ebp+08]
:00442DC7 83C001                  add eax, 00000001
:00442DCA 894508                  mov dword ptr [ebp+08], eax
:00442DCD 8B4D08                  mov ecx, dword ptr [ebp+08]
:00442DD0 8B55FC                  mov edx, dword ptr [ebp-04]
:00442DD3 8A421C                  mov al, byte ptr [edx+1C]
:00442DD6 8801                    mov byte ptr [ecx], al
:00442DD8 8B4D08                  mov ecx, dword ptr [ebp+08]
:00442DDB 83C101                  add ecx, 00000001
:00442DDE 894D08                  mov dword ptr [ebp+08], ecx
:00442DE1 8B5508                  mov edx, dword ptr [ebp+08]
:00442DE4 8B45FC                  mov eax, dword ptr [ebp-04]
:00442DE7 8A481D                  mov cl, byte ptr [eax+1D]
:00442DEA 880A                    mov byte ptr [edx], cl
:00442DEC 8B5508                  mov edx, dword ptr [ebp+08]
:00442DEF 83C201                  add edx, 00000001
:00442DF2 895508                  mov dword ptr [ebp+08], edx
:00442DF5 8B4508                  mov eax, dword ptr [ebp+08]
:00442DF8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00442DFB 8A511E                  mov dl, byte ptr [ecx+1E]
:00442DFE 8810                    mov byte ptr [eax], dl
:00442E00 8B4508                  mov eax, dword ptr [ebp+08]
:00442E03 83C001                  add eax, 00000001
:00442E06 894508                  mov dword ptr [ebp+08], eax
:00442E09 8B4D08                  mov ecx, dword ptr [ebp+08]
:00442E0C 8B55FC                  mov edx, dword ptr [ebp-04]
:00442E0F 8A4220                  mov al, byte ptr [edx+20]
:00442E12 8801                    mov byte ptr [ecx], al
:00442E14 8B4D08                  mov ecx, dword ptr [ebp+08]
:00442E17 83C101                  add ecx, 00000001
:00442E1A 894D08                  mov dword ptr [ebp+08], ecx
:00442E1D 8B4508                  mov eax, dword ptr [ebp+08]
:00442E20 8BE5                    mov esp, ebp
:00442E22 5D                      pop ebp
:00442E23 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0044F75F   
|
:00442E26 55                      push ebp
:00442E27 8BEC                    mov ebp, esp
:00442E29 83EC08                  sub esp, 00000008
:00442E2C 894DF8                  mov dword ptr [ebp-08], ecx
:00442E2F 8B4508                  mov eax, dword ptr [ebp+08]
:00442E32 33C9                    xor ecx, ecx
:00442E34 8A08                    mov cl, byte ptr [eax]
:00442E36 894DFC                  mov dword ptr [ebp-04], ecx
:00442E39 8B5508                  mov edx, dword ptr [ebp+08]
:00442E3C 83C201                  add edx, 00000001
:00442E3F 895508                  mov dword ptr [ebp+08], edx
:00442E42 8B4508                  mov eax, dword ptr [ebp+08]
:00442E45 33C9                    xor ecx, ecx
:00442E47 8A08                    mov cl, byte ptr [eax]
:00442E49 C1E108                  shl ecx, 08
:00442E4C 8B55FC                  mov edx, dword ptr [ebp-04]
:00442E4F 03D1                    add edx, ecx
:00442E51 8955FC                  mov dword ptr [ebp-04], edx
:00442E54 8B4508                  mov eax, dword ptr [ebp+08]
:00442E57 83C001                  add eax, 00000001
:00442E5A 894508                  mov dword ptr [ebp+08], eax
:00442E5D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00442E60 8B55FC                  mov edx, dword ptr [ebp-04]
:00442E63 8911                    mov dword ptr [ecx], edx
:00442E65 8B4508                  mov eax, dword ptr [ebp+08]
:00442E68 33C9                    xor ecx, ecx
:00442E6A 8A08                    mov cl, byte ptr [eax]
:00442E6C 894DFC                  mov dword ptr [ebp-04], ecx
:00442E6F 8B5508                  mov edx, dword ptr [ebp+08]
:00442E72 83C201                  add edx, 00000001
:00442E75 895508                  mov dword ptr [ebp+08], edx
:00442E78 8B4508                  mov eax, dword ptr [ebp+08]
:00442E7B 33C9                    xor ecx, ecx
:00442E7D 8A08                    mov cl, byte ptr [eax]
:00442E7F C1E108                  shl ecx, 08
:00442E82 8B55FC                  mov edx, dword ptr [ebp-04]
:00442E85 03D1                    add edx, ecx
:00442E87 8955FC                  mov dword ptr [ebp-04], edx
:00442E8A 8B4508                  mov eax, dword ptr [ebp+08]
:00442E8D 83C001                  add eax, 00000001
:00442E90 894508                  mov dword ptr [ebp+08], eax
:00442E93 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00442E96 8B55FC                  mov edx, dword ptr [ebp-04]
:00442E99 895110                  mov dword ptr [ecx+10], edx
:00442E9C 8B4508                  mov eax, dword ptr [ebp+08]
:00442E9F 33C9                    xor ecx, ecx
:00442EA1 8A08                    mov cl, byte ptr [eax]
:00442EA3 894DFC                  mov dword ptr [ebp-04], ecx
:00442EA6 8B5508                  mov edx, dword ptr [ebp+08]
:00442EA9 83C201                  add edx, 00000001
:00442EAC 895508                  mov dword ptr [ebp+08], edx
:00442EAF 8B4508                  mov eax, dword ptr [ebp+08]
:00442EB2 33C9                    xor ecx, ecx
:00442EB4 8A08                    mov cl, byte ptr [eax]
:00442EB6 C1E108                  shl ecx, 08
:00442EB9 8B55FC                  mov edx, dword ptr [ebp-04]
:00442EBC 03D1                    add edx, ecx
:00442EBE 8955FC                  mov dword ptr [ebp-04], edx
:00442EC1 8B4508                  mov eax, dword ptr [ebp+08]
:00442EC4 83C001                  add eax, 00000001
:00442EC7 894508                  mov dword ptr [ebp+08], eax
:00442ECA 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00442ECD 8B55FC                  mov edx, dword ptr [ebp-04]
:00442ED0 895114                  mov dword ptr [ecx+14], edx
:00442ED3 8B45F8                  mov eax, dword ptr [ebp-08]
:00442ED6 8B4D08                  mov ecx, dword ptr [ebp+08]
:00442ED9 8A11                    mov dl, byte ptr [ecx]
:00442EDB 885004                  mov byte ptr [eax+04], dl
:00442EDE 8B4508                  mov eax, dword ptr [ebp+08]
:00442EE1 83C001                  add eax, 00000001
:00442EE4 894508                  mov dword ptr [ebp+08], eax
:00442EE7 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00442EEA 8B5508                  mov edx, dword ptr [ebp+08]
:00442EED 8A02                    mov al, byte ptr [edx]
:00442EEF 884105                  mov byte ptr [ecx+05], al
:00442EF2 8B4D08                  mov ecx, dword ptr [ebp+08]
:00442EF5 83C101                  add ecx, 00000001
:00442EF8 894D08                  mov dword ptr [ebp+08], ecx
:00442EFB 8B55F8                  mov edx, dword ptr [ebp-08]
:00442EFE 8B4508                  mov eax, dword ptr [ebp+08]
:00442F01 8A08                    mov cl, byte ptr [eax]
:00442F03 884A06                  mov byte ptr [edx+06], cl
:00442F06 8B5508                  mov edx, dword ptr [ebp+08]
:00442F09 83C201                  add edx, 00000001
:00442F0C 895508                  mov dword ptr [ebp+08], edx
:00442F0F 8B45F8                  mov eax, dword ptr [ebp-08]
:00442F12 8B4D08                  mov ecx, dword ptr [ebp+08]
:00442F15 8A11                    mov dl, byte ptr [ecx]
:00442F17 885007                  mov byte ptr [eax+07], dl
:00442F1A 8B4508                  mov eax, dword ptr [ebp+08]
:00442F1D 83C001                  add eax, 00000001
:00442F20 894508                  mov dword ptr [ebp+08], eax
:00442F23 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00442F26 8B5508                  mov edx, dword ptr [ebp+08]
:00442F29 8A02                    mov al, byte ptr [edx]
:00442F2B 884109                  mov byte ptr [ecx+09], al
:00442F2E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00442F31 83C101                  add ecx, 00000001
:00442F34 894D08                  mov dword ptr [ebp+08], ecx
:00442F37 8B55F8                  mov edx, dword ptr [ebp-08]
:00442F3A 8B4508                  mov eax, dword ptr [ebp+08]
:00442F3D 8A08                    mov cl, byte ptr [eax]
:00442F3F 884A0A                  mov byte ptr [edx+0A], cl
:00442F42 8B5508                  mov edx, dword ptr [ebp+08]
:00442F45 83C201                  add edx, 00000001
:00442F48 895508                  mov dword ptr [ebp+08], edx
:00442F4B 8B45F8                  mov eax, dword ptr [ebp-08]
:00442F4E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00442F51 8A11                    mov dl, byte ptr [ecx]
:00442F53 885008                  mov byte ptr [eax+08], dl
:00442F56 8B4508                  mov eax, dword ptr [ebp+08]
:00442F59 83C001                  add eax, 00000001
:00442F5C 894508                  mov dword ptr [ebp+08], eax
:00442F5F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00442F62 8B5508                  mov edx, dword ptr [ebp+08]
:00442F65 8A02                    mov al, byte ptr [edx]
:00442F67 88410B                  mov byte ptr [ecx+0B], al
:00442F6A 8B4D08                  mov ecx, dword ptr [ebp+08]
:00442F6D 83C101                  add ecx, 00000001
:00442F70 894D08                  mov dword ptr [ebp+08], ecx
:00442F73 8B55F8                  mov edx, dword ptr [ebp-08]
:00442F76 8B4508                  mov eax, dword ptr [ebp+08]
:00442F79 8A08                    mov cl, byte ptr [eax]
:00442F7B 884A0C                  mov byte ptr [edx+0C], cl
:00442F7E 8B5508                  mov edx, dword ptr [ebp+08]
:00442F81 83C201                  add edx, 00000001
:00442F84 895508                  mov dword ptr [ebp+08], edx
:00442F87 8B45F8                  mov eax, dword ptr [ebp-08]
:00442F8A 8B4D08                  mov ecx, dword ptr [ebp+08]
:00442F8D 8A11                    mov dl, byte ptr [ecx]
:00442F8F 88500D                  mov byte ptr [eax+0D], dl
:00442F92 8B4508                  mov eax, dword ptr [ebp+08]
:00442F95 83C001                  add eax, 00000001
:00442F98 894508                  mov dword ptr [ebp+08], eax
:00442F9B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00442F9E 8B5508                  mov edx, dword ptr [ebp+08]
:00442FA1 8A02                    mov al, byte ptr [edx]
:00442FA3 88410E                  mov byte ptr [ecx+0E], al
:00442FA6 8B4D08                  mov ecx, dword ptr [ebp+08]
:00442FA9 83C101                  add ecx, 00000001
:00442FAC 894D08                  mov dword ptr [ebp+08], ecx
:00442FAF 8B55F8                  mov edx, dword ptr [ebp-08]
:00442FB2 8B4508                  mov eax, dword ptr [ebp+08]
:00442FB5 8A08                    mov cl, byte ptr [eax]
:00442FB7 884A0F                  mov byte ptr [edx+0F], cl
:00442FBA 8B5508                  mov edx, dword ptr [ebp+08]
:00442FBD 83C201                  add edx, 00000001
:00442FC0 895508                  mov dword ptr [ebp+08], edx
:00442FC3 8B45F8                  mov eax, dword ptr [ebp-08]
:00442FC6 8B4D08                  mov ecx, dword ptr [ebp+08]
:00442FC9 8A11                    mov dl, byte ptr [ecx]
:00442FCB 885018                  mov byte ptr [eax+18], dl
:00442FCE 8B4508                  mov eax, dword ptr [ebp+08]
:00442FD1 83C001                  add eax, 00000001
:00442FD4 894508                  mov dword ptr [ebp+08], eax
:00442FD7 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00442FDA 8B5508                  mov edx, dword ptr [ebp+08]
:00442FDD 8A02                    mov al, byte ptr [edx]
:00442FDF 884119                  mov byte ptr [ecx+19], al
:00442FE2 8B4D08                  mov ecx, dword ptr [ebp+08]
:00442FE5 83C101                  add ecx, 00000001
:00442FE8 894D08                  mov dword ptr [ebp+08], ecx
:00442FEB 8B55F8                  mov edx, dword ptr [ebp-08]
:00442FEE 8B4508                  mov eax, dword ptr [ebp+08]
:00442FF1 8A08                    mov cl, byte ptr [eax]
:00442FF3 884A1A                  mov byte ptr [edx+1A], cl
:00442FF6 8B5508                  mov edx, dword ptr [ebp+08]
:00442FF9 83C201                  add edx, 00000001
:00442FFC 895508                  mov dword ptr [ebp+08], edx
:00442FFF 8B45F8                  mov eax, dword ptr [ebp-08]
:00443002 8B4D08                  mov ecx, dword ptr [ebp+08]
:00443005 8A11                    mov dl, byte ptr [ecx]
:00443007 88501B                  mov byte ptr [eax+1B], dl
:0044300A 8B4508                  mov eax, dword ptr [ebp+08]
:0044300D 83C001                  add eax, 00000001
:00443010 894508                  mov dword ptr [ebp+08], eax
:00443013 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00443016 8B5508                  mov edx, dword ptr [ebp+08]
:00443019 8A02                    mov al, byte ptr [edx]
:0044301B 88411C                  mov byte ptr [ecx+1C], al
:0044301E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00443021 83C101                  add ecx, 00000001
:00443024 894D08                  mov dword ptr [ebp+08], ecx
:00443027 8B55F8                  mov edx, dword ptr [ebp-08]
:0044302A 8B4508                  mov eax, dword ptr [ebp+08]
:0044302D 8A08                    mov cl, byte ptr [eax]
:0044302F 884A1D                  mov byte ptr [edx+1D], cl
:00443032 8B5508                  mov edx, dword ptr [ebp+08]
:00443035 83C201                  add edx, 00000001
:00443038 895508                  mov dword ptr [ebp+08], edx
:0044303B 8B45F8                  mov eax, dword ptr [ebp-08]
:0044303E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00443041 8A11                    mov dl, byte ptr [ecx]
:00443043 88501E                  mov byte ptr [eax+1E], dl
:00443046 8B4508                  mov eax, dword ptr [ebp+08]
:00443049 83C001                  add eax, 00000001
:0044304C 894508                  mov dword ptr [ebp+08], eax
:0044304F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00443052 33D2                    xor edx, edx
:00443054 8A11                    mov dl, byte ptr [ecx]
:00443056 8B45F8                  mov eax, dword ptr [ebp-08]
:00443059 895020                  mov dword ptr [eax+20], edx
:0044305C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044305F 83C101                  add ecx, 00000001
:00443062 894D08                  mov dword ptr [ebp+08], ecx
:00443065 8B4508                  mov eax, dword ptr [ebp+08]
:00443068 8BE5                    mov esp, ebp
:0044306A 5D                      pop ebp
:0044306B C20400                  ret 0004


:0044306E CC                      int 03
:0044306F CC                      int 03

* Referenced by a CALL at Addresses:
|:0043F0EF   , :0043F197   , :0043F2A2   , :0043F810   , :0046CC34   
|:0046CD80   
|
:00443070 55                      push ebp
:00443071 8BEC                    mov ebp, esp
:00443073 51                      push ecx
:00443074 894DFC                  mov dword ptr [ebp-04], ecx
:00443077 8B45FC                  mov eax, dword ptr [ebp-04]
:0044307A 034508                  add eax, dword ptr [ebp+08]
:0044307D 8A401E                  mov al, byte ptr [eax+1E]
:00443080 8BE5                    mov esp, ebp
:00443082 5D                      pop ebp
:00443083 C20400                  ret 0004


:00443086 CC                      int 03
:00443087 CC                      int 03
:00443088 CC                      int 03
:00443089 CC                      int 03
:0044308A CC                      int 03
:0044308B CC                      int 03
:0044308C CC                      int 03
:0044308D CC                      int 03
:0044308E CC                      int 03
:0044308F CC                      int 03

* Referenced by a CALL at Addresses:
|:0043F89C   , :0046CC61   
|
:00443090 55                      push ebp
:00443091 8BEC                    mov ebp, esp
:00443093 51                      push ecx
:00443094 894DFC                  mov dword ptr [ebp-04], ecx
:00443097 8B45FC                  mov eax, dword ptr [ebp-04]
:0044309A 034508                  add eax, dword ptr [ebp+08]
:0044309D 8A00                    mov al, byte ptr [eax]
:0044309F 8BE5                    mov esp, ebp
:004430A1 5D                      pop ebp
:004430A2 C20400                  ret 0004


:004430A5 CC                      int 03
:004430A6 CC                      int 03
:004430A7 CC                      int 03
:004430A8 CC                      int 03
:004430A9 CC                      int 03
:004430AA CC                      int 03
:004430AB CC                      int 03
:004430AC CC                      int 03
:004430AD CC                      int 03
:004430AE CC                      int 03
:004430AF CC                      int 03
:004430B0 55                      push ebp
:004430B1 8BEC                    mov ebp, esp
:004430B3 51                      push ecx
:004430B4 894DFC                  mov dword ptr [ebp-04], ecx
:004430B7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004430BA 83C106                  add ecx, 00000006
:004430BD E84EC60100              call 0045F710
:004430C2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004430C5 83C109                  add ecx, 00000009
:004430C8 E843C60100              call 0045F710
:004430CD 8B45FC                  mov eax, dword ptr [ebp-04]
:004430D0 C700FFFF0000            mov dword ptr [eax], 0000FFFF
:004430D6 8B45FC                  mov eax, dword ptr [ebp-04]
:004430D9 8BE5                    mov esp, ebp
:004430DB 5D                      pop ebp
:004430DC C3                      ret


:004430DD CC                      int 03
:004430DE CC                      int 03
:004430DF CC                      int 03

* Referenced by a CALL at Addresses:
|:0043FBFF   , :0044044C   , :004502CF   , :00450BA4   , :00465E42   
|
:004430E0 55                      push ebp
:004430E1 8BEC                    mov ebp, esp
:004430E3 51                      push ecx
:004430E4 894DFC                  mov dword ptr [ebp-04], ecx
:004430E7 8B45FC                  mov eax, dword ptr [ebp-04]
:004430EA 8B08                    mov ecx, dword ptr [eax]
:004430EC 6BC948                  imul ecx, 00000048
:004430EF 81C1681B4A00            add ecx, 004A1B68
:004430F5 E85D46FCFF              call 00407757
:004430FA 8BE5                    mov esp, ebp
:004430FC 5D                      pop ebp
:004430FD C3                      ret


:004430FE CC                      int 03
:004430FF CC                      int 03

* Referenced by a CALL at Addresses:
|:00441877   , :00442885   
|
:00443100 55                      push ebp
:00443101 8BEC                    mov ebp, esp
:00443103 51                      push ecx
:00443104 894DFC                  mov dword ptr [ebp-04], ecx
:00443107 8B45FC                  mov eax, dword ptr [ebp-04]
:0044310A 8A4D08                  mov cl, byte ptr [ebp+08]
:0044310D 884829                  mov byte ptr [eax+29], cl
:00443110 8BE5                    mov esp, ebp
:00443112 5D                      pop ebp
:00443113 C20400                  ret 0004


:00443116 CC                      int 03
:00443117 CC                      int 03
:00443118 CC                      int 03
:00443119 CC                      int 03
:0044311A CC                      int 03
:0044311B CC                      int 03
:0044311C CC                      int 03
:0044311D CC                      int 03
:0044311E CC                      int 03
:0044311F CC                      int 03

* Referenced by a CALL at Addresses:
|:00441881   , :0044264D   , :00442758   , :00442B3B   , :0045A60E   
|
:00443120 55                      push ebp
:00443121 8BEC                    mov ebp, esp
:00443123 51                      push ecx
:00443124 894DFC                  mov dword ptr [ebp-04], ecx
:00443127 8B45FC                  mov eax, dword ptr [ebp-04]
:0044312A 8A4D08                  mov cl, byte ptr [ebp+08]
:0044312D 88480C                  mov byte ptr [eax+0C], cl
:00443130 8BE5                    mov esp, ebp
:00443132 5D                      pop ebp
:00443133 C20400                  ret 0004


:00443136 CC                      int 03
:00443137 CC                      int 03
:00443138 CC                      int 03
:00443139 CC                      int 03
:0044313A CC                      int 03
:0044313B CC                      int 03
:0044313C CC                      int 03
:0044313D CC                      int 03
:0044313E CC                      int 03
:0044313F CC                      int 03

* Referenced by a CALL at Addresses:
|:0041B9FF   , :00441952   , :0045A7A7   
|
:00443140 55                      push ebp
:00443141 8BEC                    mov ebp, esp
:00443143 51                      push ecx
:00443144 894DFC                  mov dword ptr [ebp-04], ecx
:00443147 8B45FC                  mov eax, dword ptr [ebp-04]
:0044314A 8A4D08                  mov cl, byte ptr [ebp+08]
:0044314D 884808                  mov byte ptr [eax+08], cl
:00443150 8BE5                    mov esp, ebp
:00443152 5D                      pop ebp
:00443153 C20400                  ret 0004


:00443156 CC                      int 03
:00443157 CC                      int 03
:00443158 CC                      int 03
:00443159 CC                      int 03
:0044315A CC                      int 03
:0044315B CC                      int 03
:0044315C CC                      int 03
:0044315D CC                      int 03
:0044315E CC                      int 03
:0044315F CC                      int 03

* Referenced by a CALL at Addresses:
|:0044284A   , :0044285F   
|
:00443160 55                      push ebp
:00443161 8BEC                    mov ebp, esp
:00443163 51                      push ecx
:00443164 894DFC                  mov dword ptr [ebp-04], ecx
:00443167 8B45FC                  mov eax, dword ptr [ebp-04]
:0044316A 8A4D08                  mov cl, byte ptr [ebp+08]
:0044316D 884827                  mov byte ptr [eax+27], cl
:00443170 8BE5                    mov esp, ebp
:00443172 5D                      pop ebp
:00443173 C20400                  ret 0004


:00443176 CC                      int 03
:00443177 CC                      int 03
:00443178 CC                      int 03
:00443179 CC                      int 03
:0044317A CC                      int 03
:0044317B CC                      int 03
:0044317C CC                      int 03
:0044317D CC                      int 03
:0044317E CC                      int 03
:0044317F CC                      int 03

* Referenced by a CALL at Addresses:
|:00442872   , :0044ED32   
|
:00443180 55                      push ebp
:00443181 8BEC                    mov ebp, esp
:00443183 51                      push ecx
:00443184 894DFC                  mov dword ptr [ebp-04], ecx
:00443187 8B45FC                  mov eax, dword ptr [ebp-04]
:0044318A 8A4D08                  mov cl, byte ptr [ebp+08]
:0044318D 884828                  mov byte ptr [eax+28], cl
:00443190 8BE5                    mov esp, ebp
:00443192 5D                      pop ebp
:00443193 C20400                  ret 0004


:00443196 CC                      int 03
:00443197 CC                      int 03
:00443198 CC                      int 03
:00443199 CC                      int 03
:0044319A CC                      int 03
:0044319B CC                      int 03
:0044319C CC                      int 03
:0044319D CC                      int 03
:0044319E CC                      int 03
:0044319F CC                      int 03
:004431A0 55                      push ebp
:004431A1 8BEC                    mov ebp, esp
:004431A3 E802000000              call 004431AA
:004431A8 5D                      pop ebp
:004431A9 C3                      ret



* Referenced by a CALL at Address:
|:004431A3   
|
:004431AA 55                      push ebp
:004431AB 8BEC                    mov ebp, esp
:004431AD 5D                      pop ebp
:004431AE C3                      ret



* Referenced by a CALL at Addresses:
|:004177A8   , :004495ED   
|
:004431AF 55                      push ebp
:004431B0 8BEC                    mov ebp, esp
:004431B2 83EC4C                  sub esp, 0000004C
:004431B5 894DC8                  mov dword ptr [ebp-38], ecx
:004431B8 33C0                    xor eax, eax
:004431BA 837D0800                cmp dword ptr [ebp+08], 00000000
:004431BE 0F95C0                  setne al
:004431C1 6BC02C                  imul eax, 0000002C
:004431C4 8B4DC8                  mov ecx, dword ptr [ebp-38]
:004431C7 8D540104                lea edx, dword ptr [ecx+eax+04]
:004431CB 8955D4                  mov dword ptr [ebp-2C], edx
:004431CE 8B45D4                  mov eax, dword ptr [ebp-2C]
:004431D1 8B481C                  mov ecx, dword ptr [eax+1C]
:004431D4 894DF4                  mov dword ptr [ebp-0C], ecx
:004431D7 837D0800                cmp dword ptr [ebp+08], 00000000
:004431DB 740B                    je 004431E8
:004431DD 8B55D4                  mov edx, dword ptr [ebp-2C]
:004431E0 8B4218                  mov eax, dword ptr [edx+18]
:004431E3 8945C4                  mov dword ptr [ebp-3C], eax
:004431E6 EB0C                    jmp 004431F4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004431DB(C)
|
:004431E8 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:004431EB 8B5118                  mov edx, dword ptr [ecx+18]
:004431EE 83EA10                  sub edx, 00000010
:004431F1 8955C4                  mov dword ptr [ebp-3C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004431E6(U)
|
:004431F4 8B45C4                  mov eax, dword ptr [ebp-3C]
:004431F7 8945CC                  mov dword ptr [ebp-34], eax
:004431FA 837D0800                cmp dword ptr [ebp+08], 00000000
:004431FE 7411                    je 00443211
:00443200 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00443203 8B5118                  mov edx, dword ptr [ecx+18]
:00443206 81C240010000            add edx, 00000140
:0044320C 8955C0                  mov dword ptr [ebp-40], edx
:0044320F EB0C                    jmp 0044321D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004431FE(C)
|
:00443211 8B45D4                  mov eax, dword ptr [ebp-2C]
:00443214 8B4818                  mov ecx, dword ptr [eax+18]
:00443217 83E910                  sub ecx, 00000010
:0044321A 894DC0                  mov dword ptr [ebp-40], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044320F(U)
|
:0044321D 8B55C0                  mov edx, dword ptr [ebp-40]
:00443220 8955D8                  mov dword ptr [ebp-28], edx
:00443223 8B45D4                  mov eax, dword ptr [ebp-2C]
:00443226 8B4818                  mov ecx, dword ptr [eax+18]
:00443229 894DFC                  mov dword ptr [ebp-04], ecx
:0044322C 837D0800                cmp dword ptr [ebp+08], 00000000
:00443230 740B                    je 0044323D
:00443232 8B55D8                  mov edx, dword ptr [ebp-28]
:00443235 83EA10                  sub edx, 00000010
:00443238 8955BC                  mov dword ptr [ebp-44], edx
:0044323B EB0F                    jmp 0044324C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443230(C)
|
:0044323D 8B45D4                  mov eax, dword ptr [ebp-2C]
:00443240 8B4818                  mov ecx, dword ptr [eax+18]
:00443243 81C130010000            add ecx, 00000130
:00443249 894DBC                  mov dword ptr [ebp-44], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044323B(U)
|
:0044324C 8B55BC                  mov edx, dword ptr [ebp-44]
:0044324F 8955F0                  mov dword ptr [ebp-10], edx
:00443252 8B45FC                  mov eax, dword ptr [ebp-04]
:00443255 83C010                  add eax, 00000010
:00443258 8945E0                  mov dword ptr [ebp-20], eax
:0044325B 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0044325E 33D2                    xor edx, edx
:00443260 8A11                    mov dl, byte ptr [ecx]
:00443262 85D2                    test edx, edx
:00443264 7578                    jne 004432DE
:00443266 837D0800                cmp dword ptr [ebp+08], 00000000
:0044326A 743C                    je 004432A8
:0044326C 6A04                    push 00000004
:0044326E 6A00                    push 00000000
:00443270 6800700200              push 00027000
:00443275 B968AB4A00              mov ecx, 004AAB68
:0044327A E8C1C70300              call 0047FA40
:0044327F 50                      push eax
:00443280 6880000000              push 00000080
:00443285 6870020000              push 00000270
:0044328A 8B45C8                  mov eax, dword ptr [ebp-38]
:0044328D 8B4870                  mov ecx, dword ptr [eax+70]
:00443290 81C100010000            add ecx, 00000100
:00443296 51                      push ecx
:00443297 8B55C8                  mov edx, dword ptr [ebp-38]
:0044329A 8B4268                  mov eax, dword ptr [edx+68]
:0044329D 50                      push eax
:0044329E E8F8AD0300              call 0047E09B
:004432A3 83C414                  add esp, 00000014
:004432A6 EB31                    jmp 004432D9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044326A(C)
|
:004432A8 6A04                    push 00000004
:004432AA 6A00                    push 00000000
:004432AC 6A00                    push 00000000
:004432AE B968AB4A00              mov ecx, 004AAB68
:004432B3 E888C70300              call 0047FA40
:004432B8 50                      push eax
:004432B9 6880000000              push 00000080
:004432BE 6870020000              push 00000270
:004432C3 8B4DC8                  mov ecx, dword ptr [ebp-38]
:004432C6 8B5170                  mov edx, dword ptr [ecx+70]
:004432C9 52                      push edx
:004432CA 8B45C8                  mov eax, dword ptr [ebp-38]
:004432CD 8B4868                  mov ecx, dword ptr [eax+68]
:004432D0 51                      push ecx
:004432D1 E8C5AD0300              call 0047E09B
:004432D6 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004432A6(U)
|
:004432D9 E950020000              jmp 0044352E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443264(C)
|
:004432DE 6A00                    push 00000000
:004432E0 6A12                    push 00000012
:004432E2 6A04                    push 00000004
:004432E4 E8089F0300              call 0047D1F1
:004432E9 83C40C                  add esp, 0000000C
:004432EC E8EAB2FDFF              call 0041E5DB
:004432F1 6A04                    push 00000004
:004432F3 6A00                    push 00000000
:004432F5 8B5508                  mov edx, dword ptr [ebp+08]
:004432F8 F7DA                    neg edx
:004432FA 1BD2                    sbb edx, edx
:004432FC 81E200010000            and edx, 00000100
:00443302 81C2C0980100            add edx, 000198C0
:00443308 52                      push edx
:00443309 B950EB4A00              mov ecx, 004AEB50
:0044330E E82DC70300              call 0047FA40
:00443313 50                      push eax
:00443314 6A10                    push 00000010
:00443316 6A10                    push 00000010
:00443318 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044331B 83C018                  add eax, 00000018
:0044331E 50                      push eax
:0044331F 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00443322 51                      push ecx
:00443323 E873AD0300              call 0047E09B
:00443328 83C414                  add esp, 00000014
:0044332B 6A04                    push 00000004
:0044332D 6A00                    push 00000000
:0044332F 68C09A0100              push 00019AC0
:00443334 B950EB4A00              mov ecx, 004AEB50
:00443339 E802C70300              call 0047FA40
:0044333E 50                      push eax
:0044333F 6A40                    push 00000040
:00443341 6A10                    push 00000010
:00443343 8B55F4                  mov edx, dword ptr [ebp-0C]
:00443346 52                      push edx
:00443347 8B45FC                  mov eax, dword ptr [ebp-04]
:0044334A 50                      push eax
:0044334B E84BAD0300              call 0047E09B
:00443350 83C414                  add esp, 00000014
:00443353 6A04                    push 00000004
:00443355 6A00                    push 00000000
:00443357 68C09E0100              push 00019EC0
:0044335C B950EB4A00              mov ecx, 004AEB50
:00443361 E8DAC60300              call 0047FA40
:00443366 50                      push eax
:00443367 6A40                    push 00000040
:00443369 6A10                    push 00000010
:0044336B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044336E 51                      push ecx
:0044336F 8B55F0                  mov edx, dword ptr [ebp-10]
:00443372 52                      push edx
:00443373 E823AD0300              call 0047E09B
:00443378 83C414                  add esp, 00000014
:0044337B 6A00                    push 00000000
:0044337D 8B45F4                  mov eax, dword ptr [ebp-0C]
:00443380 83C03F                  add eax, 0000003F
:00443383 50                      push eax
:00443384 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00443387 81C120010000            add ecx, 00000120
:0044338D 51                      push ecx
:0044338E 8B55F4                  mov edx, dword ptr [ebp-0C]
:00443391 52                      push edx
:00443392 8B45E0                  mov eax, dword ptr [ebp-20]
:00443395 50                      push eax
:00443396 E828A80300              call 0047DBC3
:0044339B 83C414                  add esp, 00000014
:0044339E E853B2FDFF              call 0041E5F6
:004433A3 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004433A6 894DF8                  mov dword ptr [ebp-08], ecx
:004433A9 C645DC03                mov [ebp-24], 03
:004433AD 837D1000                cmp dword ptr [ebp+10], 00000000
:004433B1 7414                    je 004433C7
:004433B3 B970074B00              mov ecx, 004B0770
:004433B8 E8738FFDFF              call 0041C330
:004433BD 25FF000000              and eax, 000000FF
:004433C2 8945B8                  mov dword ptr [ebp-48], eax
:004433C5 EB07                    jmp 004433CE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004433B1(C)
|
:004433C7 C745B803000000          mov [ebp-48], 00000003

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004433C5(U)
|
:004433CE 8A55B8                  mov dl, byte ptr [ebp-48]
:004433D1 8855D0                  mov byte ptr [ebp-30], dl
:004433D4 C745EC01000000          mov [ebp-14], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044351F(U)
|
:004433DB 8B45F8                  mov eax, dword ptr [ebp-08]
:004433DE 33C9                    xor ecx, ecx
:004433E0 8A08                    mov cl, byte ptr [eax]
:004433E2 85C9                    test ecx, ecx
:004433E4 0F843A010000            je 00443524
:004433EA C745E405000000          mov [ebp-1C], 00000005
:004433F1 837DEC00                cmp dword ptr [ebp-14], 00000000
:004433F5 753A                    jne 00443431
:004433F7 E8DFB1FDFF              call 0041E5DB
:004433FC 6A00                    push 00000000
:004433FE 6A12                    push 00000012
:00443400 6A04                    push 00000004
:00443402 E8EA9D0300              call 0047D1F1
:00443407 83C40C                  add esp, 0000000C
:0044340A 6A00                    push 00000000
:0044340C 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044340F 83C23F                  add edx, 0000003F
:00443412 52                      push edx
:00443413 8B45E0                  mov eax, dword ptr [ebp-20]
:00443416 0520010000              add eax, 00000120
:0044341B 50                      push eax
:0044341C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044341F 51                      push ecx
:00443420 8B55E0                  mov edx, dword ptr [ebp-20]
:00443423 52                      push edx
:00443424 E89AA70300              call 0047DBC3
:00443429 83C414                  add esp, 00000014
:0044342C E8C5B1FDFF              call 0041E5F6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004433F5(C)
|
:00443431 6A00                    push 00000000
:00443433 6A00                    push 00000000
:00443435 6802020000              push 00000202
:0044343A A1686A4B00              mov eax, dword ptr [004B6A68]
:0044343F 50                      push eax
:00443440 FF15F4624800            call dword ptr [004862F4]
:00443446 6A04                    push 00000004
:00443448 B9382F4900              mov ecx, 00492F38
:0044344D E8E4B8FCFF              call 0040ED36
:00443452 6A1F                    push 0000001F
:00443454 B9382F4900              mov ecx, 00492F38
:00443459 E826B8FCFF              call 0040EC84
:0044345E C645E800                mov [ebp-18], 00
:00443462 EB09                    jmp 0044346D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004434BB(U)
|
:00443464 8A4DE8                  mov cl, byte ptr [ebp-18]
:00443467 80C101                  add cl, 01
:0044346A 884DE8                  mov byte ptr [ebp-18], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443462(U)
|
:0044346D 8B55F8                  mov edx, dword ptr [ebp-08]
:00443470 33C0                    xor eax, eax
:00443472 8A02                    mov al, byte ptr [edx]
:00443474 85C0                    test eax, eax
:00443476 7445                    je 004434BD
:00443478 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0044347B 81E1FF000000            and ecx, 000000FF
:00443481 8B55DC                  mov edx, dword ptr [ebp-24]
:00443484 81E2FF000000            and edx, 000000FF
:0044348A 3BCA                    cmp ecx, edx
:0044348C 7D2F                    jge 004434BD
:0044348E 6A01                    push 00000001
:00443490 8B45F8                  mov eax, dword ptr [ebp-08]
:00443493 50                      push eax
:00443494 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00443497 034DE4                  add ecx, dword ptr [ebp-1C]
:0044349A 51                      push ecx
:0044349B 8B55E0                  mov edx, dword ptr [ebp-20]
:0044349E C1EA03                  shr edx, 03
:004434A1 52                      push edx
:004434A2 E80994FEFF              call 0042C8B0
:004434A7 83C410                  add esp, 00000010
:004434AA 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004434AD 03C8                    add ecx, eax
:004434AF 894DF8                  mov dword ptr [ebp-08], ecx
:004434B2 8B55E4                  mov edx, dword ptr [ebp-1C]
:004434B5 83C214                  add edx, 00000014
:004434B8 8955E4                  mov dword ptr [ebp-1C], edx
:004434BB EBA7                    jmp 00443464

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00443476(C), :0044348C(C)
|
:004434BD B9B07F4900              mov ecx, 00497FB0
:004434C2 E89F2BFEFF              call 00426066
:004434C7 6A00                    push 00000000
:004434C9 6A00                    push 00000000
:004434CB 6802020000              push 00000202
:004434D0 A1686A4B00              mov eax, dword ptr [004B6A68]
:004434D5 50                      push eax
:004434D6 FF15F4624800            call dword ptr [004862F4]
:004434DC 8A4DD0                  mov cl, byte ptr [ebp-30]
:004434DF 884DB4                  mov byte ptr [ebp-4C], cl
:004434E2 807DB400                cmp byte ptr [ebp-4C], 00
:004434E6 740E                    je 004434F6
:004434E8 807DB401                cmp byte ptr [ebp-4C], 01
:004434EC 7414                    je 00443502
:004434EE 807DB402                cmp byte ptr [ebp-4C], 02
:004434F2 741A                    je 0044350E
:004434F4 EB22                    jmp 00443518

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004434E6(C)
|
:004434F6 6A05                    push 00000005
:004434F8 E84991FEFF              call 0042C646
:004434FD 83C404                  add esp, 00000004
:00443500 EB16                    jmp 00443518

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004434EC(C)
|
:00443502 6A0C                    push 0000000C
:00443504 E83D91FEFF              call 0042C646
:00443509 83C404                  add esp, 00000004
:0044350C EB0A                    jmp 00443518

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004434F2(C)
|
:0044350E 6A14                    push 00000014
:00443510 E83191FEFF              call 0042C646
:00443515 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004434F4(U), :00443500(U), :0044350C(U)
|
:00443518 C745EC00000000          mov [ebp-14], 00000000
:0044351F E9B7FEFFFF              jmp 004433DB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004433E4(C)
|
:00443524 B9B07F4900              mov ecx, 00497FB0
:00443529 E8382BFEFF              call 00426066

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004432D9(U)
|
:0044352E 8BE5                    mov esp, ebp
:00443530 5D                      pop ebp
:00443531 C20C00                  ret 000C



* Referenced by a CALL at Address:
|:00448B13   
|
:00443534 55                      push ebp
:00443535 8BEC                    mov ebp, esp
:00443537 83EC18                  sub esp, 00000018
:0044353A 894DE8                  mov dword ptr [ebp-18], ecx

* Possible StringData Ref from Data Obj ->"VS"
                                  |
:0044353D C745ECECE04800          mov [ebp-14], 0048E0EC
:00443544 8B45E8                  mov eax, dword ptr [ebp-18]
:00443547 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0044354A 8B506C                  mov edx, dword ptr [eax+6C]
:0044354D 2B5168                  sub edx, dword ptr [ecx+68]
:00443550 D1EA                    shr edx, 1
:00443552 8B45E8                  mov eax, dword ptr [ebp-18]
:00443555 8B4868                  mov ecx, dword ptr [eax+68]
:00443558 8D5411E0                lea edx, dword ptr [ecx+edx-20]
:0044355C 8955F0                  mov dword ptr [ebp-10], edx
:0044355F 8B45F0                  mov eax, dword ptr [ebp-10]
:00443562 83C040                  add eax, 00000040
:00443565 8945F8                  mov dword ptr [ebp-08], eax
:00443568 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0044356B 8B55E8                  mov edx, dword ptr [ebp-18]
:0044356E 8B4174                  mov eax, dword ptr [ecx+74]
:00443571 2B4270                  sub eax, dword ptr [edx+70]
:00443574 D1E8                    shr eax, 1
:00443576 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00443579 8B5170                  mov edx, dword ptr [ecx+70]
:0044357C 8D4402E0                lea eax, dword ptr [edx+eax-20]
:00443580 8945F4                  mov dword ptr [ebp-0C], eax
:00443583 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00443586 83C140                  add ecx, 00000040
:00443589 894DFC                  mov dword ptr [ebp-04], ecx
:0044358C E84AB0FDFF              call 0041E5DB
:00443591 6A00                    push 00000000
:00443593 8B55EC                  mov edx, dword ptr [ebp-14]
:00443596 52                      push edx
:00443597 6A1F                    push 0000001F
:00443599 6A03                    push 00000003
:0044359B 6A40                    push 00000040
:0044359D 83EC10                  sub esp, 00000010
:004435A0 8BC4                    mov eax, esp
:004435A2 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004435A5 8908                    mov dword ptr [eax], ecx
:004435A7 8B55F4                  mov edx, dword ptr [ebp-0C]
:004435AA 895004                  mov dword ptr [eax+04], edx
:004435AD 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004435B0 894808                  mov dword ptr [eax+08], ecx
:004435B3 8B55FC                  mov edx, dword ptr [ebp-04]
:004435B6 89500C                  mov dword ptr [eax+0C], edx
:004435B9 E83AB7FDFF              call 0041ECF8
:004435BE 83C424                  add esp, 00000024
:004435C1 6A00                    push 00000000
:004435C3 8B45EC                  mov eax, dword ptr [ebp-14]
:004435C6 50                      push eax
:004435C7 6A18                    push 00000018
:004435C9 6A02                    push 00000002
:004435CB 6A40                    push 00000040
:004435CD 83EC10                  sub esp, 00000010
:004435D0 8BCC                    mov ecx, esp
:004435D2 8B55F0                  mov edx, dword ptr [ebp-10]
:004435D5 8911                    mov dword ptr [ecx], edx
:004435D7 8B45F4                  mov eax, dword ptr [ebp-0C]
:004435DA 894104                  mov dword ptr [ecx+04], eax
:004435DD 8B55F8                  mov edx, dword ptr [ebp-08]
:004435E0 895108                  mov dword ptr [ecx+08], edx
:004435E3 8B45FC                  mov eax, dword ptr [ebp-04]
:004435E6 89410C                  mov dword ptr [ecx+0C], eax
:004435E9 E80AB7FDFF              call 0041ECF8
:004435EE 83C424                  add esp, 00000024
:004435F1 6A00                    push 00000000
:004435F3 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004435F6 51                      push ecx
:004435F7 6A15                    push 00000015
:004435F9 6A01                    push 00000001
:004435FB 6A40                    push 00000040
:004435FD 83EC10                  sub esp, 00000010
:00443600 8BD4                    mov edx, esp
:00443602 8B45F0                  mov eax, dword ptr [ebp-10]
:00443605 8902                    mov dword ptr [edx], eax
:00443607 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044360A 894A04                  mov dword ptr [edx+04], ecx
:0044360D 8B45F8                  mov eax, dword ptr [ebp-08]
:00443610 894208                  mov dword ptr [edx+08], eax
:00443613 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00443616 894A0C                  mov dword ptr [edx+0C], ecx
:00443619 E8DAB6FDFF              call 0041ECF8
:0044361E 83C424                  add esp, 00000024
:00443621 6A00                    push 00000000
:00443623 6A12                    push 00000012
:00443625 6A04                    push 00000004
:00443627 E80D9C0300              call 0047D239
:0044362C 83C40C                  add esp, 0000000C
:0044362F 6A00                    push 00000000
:00443631 6A01                    push 00000001
:00443633 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"VS"
                                  |
:00443635 68F0E04800              push 0048E0F0
:0044363A 6A40                    push 00000040
:0044363C 6A20                    push 00000020
:0044363E 8D55F0                  lea edx, dword ptr [ebp-10]
:00443641 52                      push edx
:00443642 E86DB3FDFF              call 0041E9B4
:00443647 83C41C                  add esp, 0000001C
:0044364A E8A7AFFDFF              call 0041E5F6
:0044364F 8BE5                    mov esp, ebp
:00443651 5D                      pop ebp
:00443652 C3                      ret



* Referenced by a CALL at Address:
|:00449089   
|
:00443653 55                      push ebp
:00443654 8BEC                    mov ebp, esp
:00443656 83EC18                  sub esp, 00000018
:00443659 894DE8                  mov dword ptr [ebp-18], ecx

* Possible StringData Ref from Data Obj ->"ʤ "
                                  |
:0044365C C745ECF4E04800          mov [ebp-14], 0048E0F4
:00443663 8B45E8                  mov eax, dword ptr [ebp-18]
:00443666 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00443669 8B506C                  mov edx, dword ptr [eax+6C]
:0044366C 2B5168                  sub edx, dword ptr [ecx+68]
:0044366F D1EA                    shr edx, 1
:00443671 8B45E8                  mov eax, dword ptr [ebp-18]
:00443674 8B4868                  mov ecx, dword ptr [eax+68]
:00443677 8D541188                lea edx, dword ptr [ecx+edx-78]
:0044367B 8955F0                  mov dword ptr [ebp-10], edx
:0044367E 8B45F0                  mov eax, dword ptr [ebp-10]
:00443681 05F0000000              add eax, 000000F0
:00443686 8945F8                  mov dword ptr [ebp-08], eax
:00443689 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0044368C 8B55E8                  mov edx, dword ptr [ebp-18]
:0044368F 8B4174                  mov eax, dword ptr [ecx+74]
:00443692 2B4270                  sub eax, dword ptr [edx+70]
:00443695 D1E8                    shr eax, 1
:00443697 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0044369A 8B5170                  mov edx, dword ptr [ecx+70]
:0044369D 8D4402D0                lea eax, dword ptr [edx+eax-30]
:004436A1 8945F4                  mov dword ptr [ebp-0C], eax
:004436A4 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004436A7 83C160                  add ecx, 00000060
:004436AA 894DFC                  mov dword ptr [ebp-04], ecx
:004436AD E829AFFDFF              call 0041E5DB
:004436B2 6A00                    push 00000000
:004436B4 8B55EC                  mov edx, dword ptr [ebp-14]
:004436B7 52                      push edx
:004436B8 6A1F                    push 0000001F
:004436BA 6A03                    push 00000003
:004436BC 6A60                    push 00000060
:004436BE 83EC10                  sub esp, 00000010
:004436C1 8BC4                    mov eax, esp
:004436C3 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004436C6 8908                    mov dword ptr [eax], ecx
:004436C8 8B55F4                  mov edx, dword ptr [ebp-0C]
:004436CB 895004                  mov dword ptr [eax+04], edx
:004436CE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004436D1 894808                  mov dword ptr [eax+08], ecx
:004436D4 8B55FC                  mov edx, dword ptr [ebp-04]
:004436D7 89500C                  mov dword ptr [eax+0C], edx
:004436DA E819B6FDFF              call 0041ECF8
:004436DF 83C424                  add esp, 00000024
:004436E2 6A00                    push 00000000
:004436E4 8B45EC                  mov eax, dword ptr [ebp-14]
:004436E7 50                      push eax
:004436E8 6A18                    push 00000018
:004436EA 6A02                    push 00000002
:004436EC 6A60                    push 00000060
:004436EE 83EC10                  sub esp, 00000010
:004436F1 8BCC                    mov ecx, esp
:004436F3 8B55F0                  mov edx, dword ptr [ebp-10]
:004436F6 8911                    mov dword ptr [ecx], edx
:004436F8 8B45F4                  mov eax, dword ptr [ebp-0C]
:004436FB 894104                  mov dword ptr [ecx+04], eax
:004436FE 8B55F8                  mov edx, dword ptr [ebp-08]
:00443701 895108                  mov dword ptr [ecx+08], edx
:00443704 8B45FC                  mov eax, dword ptr [ebp-04]
:00443707 89410C                  mov dword ptr [ecx+0C], eax
:0044370A E8E9B5FDFF              call 0041ECF8
:0044370F 83C424                  add esp, 00000024
:00443712 6A00                    push 00000000
:00443714 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00443717 51                      push ecx
:00443718 6A15                    push 00000015
:0044371A 6A01                    push 00000001
:0044371C 6A60                    push 00000060
:0044371E 83EC10                  sub esp, 00000010
:00443721 8BD4                    mov edx, esp
:00443723 8B45F0                  mov eax, dword ptr [ebp-10]
:00443726 8902                    mov dword ptr [edx], eax
:00443728 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044372B 894A04                  mov dword ptr [edx+04], ecx
:0044372E 8B45F8                  mov eax, dword ptr [ebp-08]
:00443731 894208                  mov dword ptr [edx+08], eax
:00443734 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00443737 894A0C                  mov dword ptr [edx+0C], ecx
:0044373A E8B9B5FDFF              call 0041ECF8
:0044373F 83C424                  add esp, 00000024
:00443742 6A00                    push 00000000
:00443744 6A12                    push 00000012
:00443746 6A04                    push 00000004
:00443748 E8EC9A0300              call 0047D239
:0044374D 83C40C                  add esp, 0000000C
:00443750 6A00                    push 00000000
:00443752 6A01                    push 00000001
:00443754 6A00                    push 00000000
:00443756 8B55EC                  mov edx, dword ptr [ebp-14]
:00443759 52                      push edx
:0044375A 6A60                    push 00000060
:0044375C 6A30                    push 00000030
:0044375E 8D45F0                  lea eax, dword ptr [ebp-10]
:00443761 50                      push eax
:00443762 E84DB2FDFF              call 0041E9B4
:00443767 83C41C                  add esp, 0000001C
:0044376A E887AEFDFF              call 0041E5F6
:0044376F 8BE5                    mov esp, ebp
:00443771 5D                      pop ebp
:00443772 C3                      ret



* Referenced by a CALL at Addresses:
|:00448AF2   , :00448B47   , :00448F45   , :00448F54   
|
:00443773 55                      push ebp
:00443774 8BEC                    mov ebp, esp
:00443776 83EC24                  sub esp, 00000024
:00443779 894DE0                  mov dword ptr [ebp-20], ecx
:0044377C 33C0                    xor eax, eax
:0044377E 837D0800                cmp dword ptr [ebp+08], 00000000
:00443782 0F95C0                  setne al
:00443785 6BC02C                  imul eax, 0000002C
:00443788 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0044378B 8D540104                lea edx, dword ptr [ecx+eax+04]
:0044378F 8955E4                  mov dword ptr [ebp-1C], edx
:00443792 837D0C00                cmp dword ptr [ebp+0C], 00000000
:00443796 0F84B2000000            je 0044384E
:0044379C 8B45E4                  mov eax, dword ptr [ebp-1C]
:0044379F 8B4810                  mov ecx, dword ptr [eax+10]
:004437A2 83C120                  add ecx, 00000020
:004437A5 C1E903                  shr ecx, 03
:004437A8 894DE8                  mov dword ptr [ebp-18], ecx
:004437AB 8B55E4                  mov edx, dword ptr [ebp-1C]
:004437AE 8B0A                    mov ecx, dword ptr [edx]
:004437B0 E8A23FFCFF              call 00407757
:004437B5 50                      push eax
:004437B6 E89FC40300              call 0047FC5A
:004437BB 83C404                  add esp, 00000004
:004437BE D1E8                    shr eax, 1
:004437C0 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004437C3 2BC8                    sub ecx, eax
:004437C5 894DE8                  mov dword ptr [ebp-18], ecx
:004437C8 837D0800                cmp dword ptr [ebp+08], 00000000
:004437CC 740E                    je 004437DC
:004437CE 8B55E4                  mov edx, dword ptr [ebp-1C]
:004437D1 8B4214                  mov eax, dword ptr [edx+14]
:004437D4 83E818                  sub eax, 00000018
:004437D7 8945DC                  mov dword ptr [ebp-24], eax
:004437DA EB0C                    jmp 004437E8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004437CC(C)
|
:004437DC 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004437DF 8B5114                  mov edx, dword ptr [ecx+14]
:004437E2 83C258                  add edx, 00000058
:004437E5 8955DC                  mov dword ptr [ebp-24], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004437DA(U)
|
:004437E8 8B45DC                  mov eax, dword ptr [ebp-24]
:004437EB 8945EC                  mov dword ptr [ebp-14], eax
:004437EE 6A04                    push 00000004
:004437F0 B9382F4900              mov ecx, 00492F38
:004437F5 E83CB5FCFF              call 0040ED36
:004437FA 6A01                    push 00000001
:004437FC B9382F4900              mov ecx, 00492F38
:00443801 E804B5FCFF              call 0040ED0A
:00443806 6A12                    push 00000012
:00443808 B9382F4900              mov ecx, 00492F38
:0044380D E872B4FCFF              call 0040EC84
:00443812 6A00                    push 00000000
:00443814 B9382F4900              mov ecx, 00492F38
:00443819 E89EB4FCFF              call 0040ECBC
:0044381E 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00443821 51                      push ecx
:00443822 8B55E8                  mov edx, dword ptr [ebp-18]
:00443825 52                      push edx
:00443826 B9382F4900              mov ecx, 00492F38
:0044382B E8A7B3FCFF              call 0040EBD7
:00443830 6A00                    push 00000000
:00443832 8B45E4                  mov eax, dword ptr [ebp-1C]
:00443835 8B4804                  mov ecx, dword ptr [eax+04]
:00443838 E86DCBFFFF              call 004403AA
:0044383D 6A00                    push 00000000
:0044383F B9382F4900              mov ecx, 00492F38
:00443844 E8C1B4FCFF              call 0040ED0A
:00443849 E9B9010000              jmp 00443A07

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443796(C)
|
:0044384E 837D0800                cmp dword ptr [ebp+08], 00000000
:00443852 7426                    je 0044387A
:00443854 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00443857 8B09                    mov ecx, dword ptr [ecx]
:00443859 E8F93EFCFF              call 00407757
:0044385E 50                      push eax
:0044385F E8F6C30300              call 0047FC5A
:00443864 83C404                  add esp, 00000004
:00443867 C1E005                  shl eax, 05
:0044386A 8B55E4                  mov edx, dword ptr [ebp-1C]
:0044386D 8B4A10                  mov ecx, dword ptr [edx+10]
:00443870 2BC8                    sub ecx, eax
:00443872 83E920                  sub ecx, 00000020
:00443875 894DF0                  mov dword ptr [ebp-10], ecx
:00443878 EB09                    jmp 00443883

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443852(C)
|
:0044387A 8B55E4                  mov edx, dword ptr [ebp-1C]
:0044387D 8B4218                  mov eax, dword ptr [edx+18]
:00443880 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443878(U)
|
:00443883 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00443886 8B09                    mov ecx, dword ptr [ecx]
:00443888 E8CA3EFCFF              call 00407757
:0044388D 50                      push eax
:0044388E E8C7C30300              call 0047FC5A
:00443893 83C404                  add esp, 00000004
:00443896 C1E005                  shl eax, 05
:00443899 8B55F0                  mov edx, dword ptr [ebp-10]
:0044389C 03D0                    add edx, eax
:0044389E 8955F8                  mov dword ptr [ebp-08], edx
:004438A1 8B45E4                  mov eax, dword ptr [ebp-1C]
:004438A4 8B481C                  mov ecx, dword ptr [eax+1C]
:004438A7 894DF4                  mov dword ptr [ebp-0C], ecx
:004438AA 8B55F4                  mov edx, dword ptr [ebp-0C]
:004438AD 83C240                  add edx, 00000040
:004438B0 8955FC                  mov dword ptr [ebp-04], edx
:004438B3 E823ADFDFF              call 0041E5DB
:004438B8 6A00                    push 00000000
:004438BA 8B45E4                  mov eax, dword ptr [ebp-1C]
:004438BD 8B08                    mov ecx, dword ptr [eax]
:004438BF E8933EFCFF              call 00407757
:004438C4 50                      push eax
:004438C5 8B4D08                  mov ecx, dword ptr [ebp+08]
:004438C8 F7D9                    neg ecx
:004438CA 1BC9                    sbb ecx, ecx
:004438CC 83E100                  and ecx, 00000000
:004438CF 83C118                  add ecx, 00000018
:004438D2 51                      push ecx

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:004438D3 6A07                    push 00000007
:004438D5 6A40                    push 00000040
:004438D7 83EC10                  sub esp, 00000010
:004438DA 8BD4                    mov edx, esp
:004438DC 8B45F0                  mov eax, dword ptr [ebp-10]
:004438DF 8902                    mov dword ptr [edx], eax
:004438E1 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004438E4 894A04                  mov dword ptr [edx+04], ecx
:004438E7 8B45F8                  mov eax, dword ptr [ebp-08]
:004438EA 894208                  mov dword ptr [edx+08], eax
:004438ED 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004438F0 894A0C                  mov dword ptr [edx+0C], ecx
:004438F3 E800B4FDFF              call 0041ECF8
:004438F8 83C424                  add esp, 00000024
:004438FB 6A00                    push 00000000
:004438FD 8B55E4                  mov edx, dword ptr [ebp-1C]
:00443900 8B0A                    mov ecx, dword ptr [edx]
:00443902 E8503EFCFF              call 00407757
:00443907 50                      push eax
:00443908 8B4508                  mov eax, dword ptr [ebp+08]
:0044390B F7D8                    neg eax
:0044390D 1BC0                    sbb eax, eax
:0044390F 83E000                  and eax, 00000000
:00443912 83C018                  add eax, 00000018
:00443915 50                      push eax

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:00443916 6A06                    push 00000006
:00443918 6A40                    push 00000040
:0044391A 83EC10                  sub esp, 00000010
:0044391D 8BCC                    mov ecx, esp
:0044391F 8B55F0                  mov edx, dword ptr [ebp-10]
:00443922 8911                    mov dword ptr [ecx], edx
:00443924 8B45F4                  mov eax, dword ptr [ebp-0C]
:00443927 894104                  mov dword ptr [ecx+04], eax
:0044392A 8B55F8                  mov edx, dword ptr [ebp-08]
:0044392D 895108                  mov dword ptr [ecx+08], edx
:00443930 8B45FC                  mov eax, dword ptr [ebp-04]
:00443933 89410C                  mov dword ptr [ecx+0C], eax
:00443936 E8BDB3FDFF              call 0041ECF8
:0044393B 83C424                  add esp, 00000024
:0044393E 6A00                    push 00000000
:00443940 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00443943 8B09                    mov ecx, dword ptr [ecx]
:00443945 E80D3EFCFF              call 00407757
:0044394A 50                      push eax
:0044394B 8B5508                  mov edx, dword ptr [ebp+08]
:0044394E F7DA                    neg edx
:00443950 1BD2                    sbb edx, edx
:00443952 80E27E                  and dl, 7E
:00443955 81C2AC000000            add edx, 000000AC
:0044395B 52                      push edx
:0044395C 6A02                    push 00000002
:0044395E 6A40                    push 00000040
:00443960 83EC10                  sub esp, 00000010
:00443963 8BC4                    mov eax, esp
:00443965 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00443968 8908                    mov dword ptr [eax], ecx
:0044396A 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044396D 895004                  mov dword ptr [eax+04], edx
:00443970 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00443973 894808                  mov dword ptr [eax+08], ecx
:00443976 8B55FC                  mov edx, dword ptr [ebp-04]
:00443979 89500C                  mov dword ptr [eax+0C], edx
:0044397C E877B3FDFF              call 0041ECF8
:00443981 83C424                  add esp, 00000024
:00443984 6A00                    push 00000000
:00443986 8B45E4                  mov eax, dword ptr [ebp-1C]
:00443989 8B08                    mov ecx, dword ptr [eax]
:0044398B E8C73DFCFF              call 00407757
:00443990 50                      push eax
:00443991 8B4D08                  mov ecx, dword ptr [ebp+08]
:00443994 F7D9                    neg ecx
:00443996 1BC9                    sbb ecx, ecx
:00443998 83E1EE                  and ecx, FFFFFFEE
:0044399B 83C13C                  add ecx, 0000003C
:0044399E 51                      push ecx
:0044399F 6A01                    push 00000001
:004439A1 6A40                    push 00000040
:004439A3 83EC10                  sub esp, 00000010
:004439A6 8BD4                    mov edx, esp
:004439A8 8B45F0                  mov eax, dword ptr [ebp-10]
:004439AB 8902                    mov dword ptr [edx], eax
:004439AD 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004439B0 894A04                  mov dword ptr [edx+04], ecx
:004439B3 8B45F8                  mov eax, dword ptr [ebp-08]
:004439B6 894208                  mov dword ptr [edx+08], eax
:004439B9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004439BC 894A0C                  mov dword ptr [edx+0C], ecx
:004439BF E834B3FDFF              call 0041ECF8
:004439C4 83C424                  add esp, 00000024
:004439C7 6A00                    push 00000000
:004439C9 8B5508                  mov edx, dword ptr [ebp+08]
:004439CC F7DA                    neg edx
:004439CE 1BD2                    sbb edx, edx
:004439D0 83E2EE                  and edx, FFFFFFEE
:004439D3 83C23A                  add edx, 0000003A
:004439D6 52                      push edx
:004439D7 6A04                    push 00000004
:004439D9 E85B980300              call 0047D239
:004439DE 83C40C                  add esp, 0000000C
:004439E1 6A00                    push 00000000
:004439E3 6A01                    push 00000001
:004439E5 6A00                    push 00000000
:004439E7 8B45E4                  mov eax, dword ptr [ebp-1C]
:004439EA 8B08                    mov ecx, dword ptr [eax]
:004439EC E8663DFCFF              call 00407757
:004439F1 50                      push eax
:004439F2 6A40                    push 00000040
:004439F4 6A20                    push 00000020
:004439F6 8D4DF0                  lea ecx, dword ptr [ebp-10]
:004439F9 51                      push ecx
:004439FA E8B5AFFDFF              call 0041E9B4
:004439FF 83C41C                  add esp, 0000001C
:00443A02 E8EFABFDFF              call 0041E5F6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443849(U)
|
:00443A07 8BE5                    mov esp, ebp
:00443A09 5D                      pop ebp
:00443A0A C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:00448AE3   , :00448B38   , :00448F27   , :00448F36   , :004491FE   
|:0044941B   
|
:00443A0D 55                      push ebp
:00443A0E 8BEC                    mov ebp, esp
:00443A10 83EC08                  sub esp, 00000008
:00443A13 894DF8                  mov dword ptr [ebp-08], ecx
:00443A16 33C0                    xor eax, eax
:00443A18 837D0800                cmp dword ptr [ebp+08], 00000000
:00443A1C 0F95C0                  setne al
:00443A1F 6BC02C                  imul eax, 0000002C
:00443A22 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00443A25 8D540104                lea edx, dword ptr [ecx+eax+04]
:00443A29 8955FC                  mov dword ptr [ebp-04], edx
:00443A2C 6A00                    push 00000000
:00443A2E 6A1F                    push 0000001F
:00443A30 6A04                    push 00000004
:00443A32 E8BA970300              call 0047D1F1
:00443A37 83C40C                  add esp, 0000000C
:00443A3A E89CABFDFF              call 0041E5DB
:00443A3F 8B45FC                  mov eax, dword ptr [ebp-04]
:00443A42 8B08                    mov ecx, dword ptr [eax]
:00443A44 E85E3BFCFF              call 004075A7
:00443A49 50                      push eax
:00443A4A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00443A4D 8B5114                  mov edx, dword ptr [ecx+14]
:00443A50 52                      push edx
:00443A51 8B45FC                  mov eax, dword ptr [ebp-04]
:00443A54 8B4810                  mov ecx, dword ptr [eax+10]
:00443A57 51                      push ecx
:00443A58 E884AEFDFF              call 0041E8E1
:00443A5D 83C40C                  add esp, 0000000C
:00443A60 837D0C00                cmp dword ptr [ebp+0C], 00000000
:00443A64 747C                    je 00443AE2
:00443A66 6A04                    push 00000004
:00443A68 6A00                    push 00000000
:00443A6A 6800400100              push 00014000
:00443A6F B9C8E44A00              mov ecx, 004AE4C8
:00443A74 E8C7BF0300              call 0047FA40
:00443A79 50                      push eax
:00443A7A 6A50                    push 00000050
:00443A7C 6A40                    push 00000040
:00443A7E 8B55FC                  mov edx, dword ptr [ebp-04]
:00443A81 8B4214                  mov eax, dword ptr [edx+14]
:00443A84 50                      push eax
:00443A85 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00443A88 8B5110                  mov edx, dword ptr [ecx+10]
:00443A8B 52                      push edx
:00443A8C E8C0A70300              call 0047E251
:00443A91 83C414                  add esp, 00000014
:00443A94 6A50                    push 00000050
:00443A96 6A40                    push 00000040
:00443A98 6A04                    push 00000004
:00443A9A 6A00                    push 00000000
:00443A9C 6800400100              push 00014000
:00443AA1 B9C8E44A00              mov ecx, 004AE4C8
:00443AA6 E895BF0300              call 0047FA40
:00443AAB 50                      push eax
:00443AAC E8C9CDFEFF              call 0043087A
:00443AB1 83C40C                  add esp, 0000000C
:00443AB4 6A04                    push 00000004
:00443AB6 6A00                    push 00000000
:00443AB8 6800400100              push 00014000
:00443ABD B9C8E44A00              mov ecx, 004AE4C8
:00443AC2 E879BF0300              call 0047FA40
:00443AC7 50                      push eax
:00443AC8 6A50                    push 00000050
:00443ACA 6A40                    push 00000040
:00443ACC 8B45FC                  mov eax, dword ptr [ebp-04]
:00443ACF 8B4814                  mov ecx, dword ptr [eax+14]
:00443AD2 51                      push ecx
:00443AD3 8B55FC                  mov edx, dword ptr [ebp-04]
:00443AD6 8B4210                  mov eax, dword ptr [edx+10]
:00443AD9 50                      push eax
:00443ADA E8BCA50300              call 0047E09B
:00443ADF 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443A64(C)
|
:00443AE2 E80FABFDFF              call 0041E5F6
:00443AE7 8BE5                    mov esp, ebp
:00443AE9 5D                      pop ebp
:00443AEA C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:00443D58   , :00443DCA   , :00443EF7   , :00444097   , :004441E9   
|:004442B5   , :00444430   , :0044464A   , :004448AD   , :00444A27   
|:00444B6A   , :00444C76   , :00444D78   , :00444E95   , :004450FC   
|:00445180   , :00445217   , :0044529B   , :00445332   , :004453B6   
|:00445504   , :00445577   , :0044560A   , :004457DB   , :004458A2   
|:00445A2A   , :00445BCB   , :00445E60   , :00445EDA   , :00446047   
|:004461A4   , :004463C3   , :004467F5   , :00446B6F   , :00446F60   
|:004472EF   , :00447779   , :004477B0   , :004478A8   , :0044824C   
|:0044906E   , :0044907C   , :004490AD   , :004490BB   , :0044920C   
|:00449429   
|
:00443AED 55                      push ebp
:00443AEE 8BEC                    mov ebp, esp
:00443AF0 83EC1C                  sub esp, 0000001C
:00443AF3 894DF0                  mov dword ptr [ebp-10], ecx
:00443AF6 6A00                    push 00000000
:00443AF8 6A12                    push 00000012
:00443AFA 6A04                    push 00000004
:00443AFC E8F0960300              call 0047D1F1
:00443B01 83C40C                  add esp, 0000000C
:00443B04 837D0C00                cmp dword ptr [ebp+0C], 00000000
:00443B08 743A                    je 00443B44
:00443B0A 6A04                    push 00000004
:00443B0C 6A00                    push 00000000
:00443B0E 6800400200              push 00024000
:00443B13 B9C8E44A00              mov ecx, 004AE4C8
:00443B18 E823BF0300              call 0047FA40
:00443B1D 50                      push eax
:00443B1E 6880000000              push 00000080
:00443B23 6870020000              push 00000270
:00443B28 8B45F0                  mov eax, dword ptr [ebp-10]
:00443B2B 8B8880000000            mov ecx, dword ptr [eax+00000080]
:00443B31 83E910                  sub ecx, 00000010
:00443B34 51                      push ecx
:00443B35 8B55F0                  mov edx, dword ptr [ebp-10]
:00443B38 8B4278                  mov eax, dword ptr [edx+78]
:00443B3B 50                      push eax
:00443B3C E85AA50300              call 0047E09B
:00443B41 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443B08(C)
|
:00443B44 837D0800                cmp dword ptr [ebp+08], 00000000
:00443B48 0F84C9000000            je 00443C17
:00443B4E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00443B51 33D2                    xor edx, edx
:00443B53 8A510C                  mov dl, byte ptr [ecx+0C]
:00443B56 81FAFF000000            cmp edx, 000000FF
:00443B5C 0F84B5000000            je 00443C17
:00443B62 8B4508                  mov eax, dword ptr [ebp+08]
:00443B65 83782460                cmp dword ptr [eax+24], 00000060
:00443B69 750B                    jne 00443B76
:00443B6B 8B4D08                  mov ecx, dword ptr [ebp+08]
:00443B6E 8B5120                  mov edx, dword ptr [ecx+20]
:00443B71 8955EC                  mov dword ptr [ebp-14], edx
:00443B74 EB0C                    jmp 00443B82

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443B69(C)
|
:00443B76 8B4508                  mov eax, dword ptr [ebp+08]
:00443B79 8B4820                  mov ecx, dword ptr [eax+20]
:00443B7C 83E910                  sub ecx, 00000010
:00443B7F 894DEC                  mov dword ptr [ebp-14], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443B74(U)
|
:00443B82 8B55EC                  mov edx, dword ptr [ebp-14]
:00443B85 8955F4                  mov dword ptr [ebp-0C], edx
:00443B88 8B4508                  mov eax, dword ptr [ebp+08]
:00443B8B 83782460                cmp dword ptr [eax+24], 00000060
:00443B8F 750E                    jne 00443B9F
:00443B91 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00443B94 8B9180000000            mov edx, dword ptr [ecx+00000080]
:00443B9A 8955E8                  mov dword ptr [ebp-18], edx
:00443B9D EB0F                    jmp 00443BAE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443B8F(C)
|
:00443B9F 8B45F0                  mov eax, dword ptr [ebp-10]
:00443BA2 8B8880000000            mov ecx, dword ptr [eax+00000080]
:00443BA8 83E910                  sub ecx, 00000010
:00443BAB 894DE8                  mov dword ptr [ebp-18], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443B9D(U)
|
:00443BAE 8B55E8                  mov edx, dword ptr [ebp-18]
:00443BB1 8955F8                  mov dword ptr [ebp-08], edx
:00443BB4 8B4508                  mov eax, dword ptr [ebp+08]
:00443BB7 33C9                    xor ecx, ecx
:00443BB9 8A480C                  mov cl, byte ptr [eax+0C]
:00443BBC 83F901                  cmp ecx, 00000001
:00443BBF 7518                    jne 00443BD9
:00443BC1 6A04                    push 00000004
:00443BC3 6A00                    push 00000000
:00443BC5 6800C00100              push 0001C000
:00443BCA B9C8E44A00              mov ecx, 004AE4C8
:00443BCF E86CBE0300              call 0047FA40
:00443BD4 8945E4                  mov dword ptr [ebp-1C], eax
:00443BD7 EB16                    jmp 00443BEF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443BBF(C)
|
:00443BD9 6A04                    push 00000004
:00443BDB 6A00                    push 00000000
:00443BDD 6800000200              push 00020000
:00443BE2 B9C8E44A00              mov ecx, 004AE4C8
:00443BE7 E854BE0300              call 0047FA40
:00443BEC 8945E4                  mov dword ptr [ebp-1C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443BD7(U)
|
:00443BEF 8B55E4                  mov edx, dword ptr [ebp-1C]
:00443BF2 8955FC                  mov dword ptr [ebp-04], edx
:00443BF5 8B45FC                  mov eax, dword ptr [ebp-04]
:00443BF8 50                      push eax
:00443BF9 8B4D08                  mov ecx, dword ptr [ebp+08]
:00443BFC 8B5124                  mov edx, dword ptr [ecx+24]
:00443BFF 52                      push edx
:00443C00 8B4508                  mov eax, dword ptr [ebp+08]
:00443C03 8B4824                  mov ecx, dword ptr [eax+24]
:00443C06 51                      push ecx
:00443C07 8B55F8                  mov edx, dword ptr [ebp-08]
:00443C0A 52                      push edx
:00443C0B 8B45F4                  mov eax, dword ptr [ebp-0C]
:00443C0E 50                      push eax
:00443C0F E887A40300              call 0047E09B
:00443C14 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00443B48(C), :00443B5C(C)
|
:00443C17 8BE5                    mov esp, ebp
:00443C19 5D                      pop ebp
:00443C1A C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:00443D7D   , :00443DEF   , :00443F25   , :004440C5   , :00444217   
|:004442DA   , :0044446A   , :0044468F   , :004448F2   , :00444A56   
|:00444B99   , :00444CAC   , :00444D9D   , :00444EC4   , :0044513E   
|:004451B4   , :00445259   , :004452CF   , :00445374   , :004453EA   
|:00445546   , :004455AB   , :0044563D   , :00445829   , :004458F0   
|:00445A60   , :00445C01   , :00445E9E   , :00445FAB   , :00446006   
|:0044611B   , :00446179   , :004461E5   , :0044643B   , :004464E3   
|:00446532   , :00446572   , :004465B9   , :004468BB   , :0044690A   
|:0044694A   , :00446991   , :00446BF0   , :00446C3F   , :00446C8E   
|:00446CD5   , :00446D15   , :00446D5C   , :00446FE3   , :0044702F   
|:0044708A   , :004470C5   , :004473E6   , :0044748E   , :004474DD   
|:0044751D   , :00447564   , :004477F4   , :0044783C   , :00447892   
|:004478F2   , :0044793F   , :00447986   , :004479D1   , :00447A2A   
|:00447A81   , :00447B29   , :00447B79   , :00447BCC   , :00447C19   
|:00447C69   , :00447CB0   , :00447CFB   , :00447D54   , :00447D9D   
|:00447E37   , :00447E84   , :00447ED4   , :00447F1B   , :00447F5B   
|:00447FA2   , :0044829D   , :004482D2   , :00448317   , :0044835D   
|:00449242   , :0044945F   , :0044959A   
|
:00443C1D 55                      push ebp
:00443C1E 8BEC                    mov ebp, esp
:00443C20 83EC0C                  sub esp, 0000000C
:00443C23 894DF8                  mov dword ptr [ebp-08], ecx
:00443C26 8B45F8                  mov eax, dword ptr [ebp-08]
:00443C29 8B4D08                  mov ecx, dword ptr [ebp+08]
:00443C2C 3B4878                  cmp ecx, dword ptr [eax+78]
:00443C2F 7309                    jnb 00443C3A
:00443C31 8B55F8                  mov edx, dword ptr [ebp-08]
:00443C34 8B4278                  mov eax, dword ptr [edx+78]
:00443C37 894508                  mov dword ptr [ebp+08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443C2F(C)
|
:00443C3A 8B4D08                  mov ecx, dword ptr [ebp+08]
:00443C3D 034D10                  add ecx, dword ptr [ebp+10]
:00443C40 8B55F8                  mov edx, dword ptr [ebp-08]
:00443C43 3B4A7C                  cmp ecx, dword ptr [edx+7C]
:00443C46 720F                    jb 00443C57
:00443C48 8B45F8                  mov eax, dword ptr [ebp-08]
:00443C4B 8B487C                  mov ecx, dword ptr [eax+7C]
:00443C4E 2B4D10                  sub ecx, dword ptr [ebp+10]
:00443C51 83E901                  sub ecx, 00000001
:00443C54 894D08                  mov dword ptr [ebp+08], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443C46(C)
|
:00443C57 8B551C                  mov edx, dword ptr [ebp+1C]
:00443C5A 8B4510                  mov eax, dword ptr [ebp+10]
:00443C5D 894224                  mov dword ptr [edx+24], eax
:00443C60 8B4D1C                  mov ecx, dword ptr [ebp+1C]
:00443C63 33D2                    xor edx, edx
:00443C65 8A510C                  mov dl, byte ptr [ecx+0C]
:00443C68 83FA01                  cmp edx, 00000001
:00443C6B 7518                    jne 00443C85
:00443C6D 6A04                    push 00000004
:00443C6F 6A00                    push 00000000
:00443C71 6800C00100              push 0001C000
:00443C76 B9C8E44A00              mov ecx, 004AE4C8
:00443C7B E8C0BD0300              call 0047FA40
:00443C80 8945F4                  mov dword ptr [ebp-0C], eax
:00443C83 EB16                    jmp 00443C9B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443C6B(C)
|
:00443C85 6A04                    push 00000004
:00443C87 6A00                    push 00000000
:00443C89 6800000200              push 00020000
:00443C8E B9C8E44A00              mov ecx, 004AE4C8
:00443C93 E8A8BD0300              call 0047FA40
:00443C98 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00443C83(U)
|
:00443C9B 8B45F4                  mov eax, dword ptr [ebp-0C]
:00443C9E 8945FC                  mov dword ptr [ebp-04], eax
:00443CA1 6800400000              push 00004000
:00443CA6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00443CA9 51                      push ecx
:00443CAA 8B5518                  mov edx, dword ptr [ebp+18]
:00443CAD 52                      push edx
:00443CAE E84AC00300              call 0047FCFD
:00443CB3 83C40C                  add esp, 0000000C
:00443CB6 6A00                    push 00000000
:00443CB8 6A12                    push 00000012
:00443CBA 6A04                    push 00000004
:00443CBC E830950300              call 0047D1F1
:00443CC1 83C40C                  add esp, 0000000C
:00443CC4 8B4518                  mov eax, dword ptr [ebp+18]
:00443CC7 50                      push eax
:00443CC8 8B4D14                  mov ecx, dword ptr [ebp+14]
:00443CCB 51                      push ecx
:00443CCC 8B5510                  mov edx, dword ptr [ebp+10]
:00443CCF 52                      push edx
:00443CD0 8B450C                  mov eax, dword ptr [ebp+0C]
:00443CD3 50                      push eax
:00443CD4 8B4D08                  mov ecx, dword ptr [ebp+08]
:00443CD7 51                      push ecx
:00443CD8 E8BEA30300              call 0047E09B
:00443CDD 83C414                  add esp, 00000014
:00443CE0 8BE5                    mov esp, ebp
:00443CE2 5D                      pop ebp
:00443CE3 C21800                  ret 0018



* Referenced by a CALL at Address:
|:00448583   
|
:00443CE6 55                      push ebp
:00443CE7 8BEC                    mov ebp, esp
:00443CE9 83EC0C                  sub esp, 0000000C
:00443CEC 894DF4                  mov dword ptr [ebp-0C], ecx
:00443CEF 6A04                    push 00000004
:00443CF1 6A00                    push 00000000
:00443CF3 6A00                    push 00000000
:00443CF5 B9C8E44A00              mov ecx, 004AE4C8
:00443CFA E841BD0300              call 0047FA40
:00443CFF 8945F8                  mov dword ptr [ebp-08], eax
:00443D02 6A04                    push 00000004
:00443D04 6A00                    push 00000000
:00443D06 8B4508                  mov eax, dword ptr [ebp+08]
:00443D09 33C9                    xor ecx, ecx
:00443D0B 8A480D                  mov cl, byte ptr [eax+0D]
:00443D0E 69C900630000            imul ecx, 00006300
:00443D14 81C100480000            add ecx, 00004800
:00443D1A 51                      push ecx
:00443D1B B980AB4A00              mov ecx, 004AAB80
:00443D20 E81BBD0300              call 0047FA40
:00443D25 8945FC                  mov dword ptr [ebp-04], eax
:00443D28 6A30                    push 00000030
:00443D2A 6A30                    push 00000030
:00443D2C 8B55F8                  mov edx, dword ptr [ebp-08]
:00443D2F 52                      push edx
:00443D30 8B45FC                  mov eax, dword ptr [ebp-04]
:00443D33 50                      push eax
:00443D34 E83DCDFEFF              call 00430A76
:00443D39 83C410                  add esp, 00000010
:00443D3C 6A01                    push 00000001
:00443D3E 6A08                    push 00000008
:00443D40 B9B0694B00              mov ecx, 004B69B0
:00443D45 E830090300              call 0047467A
:00443D4A E88CA8FDFF              call 0041E5DB
:00443D4F 6A01                    push 00000001
:00443D51 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00443D54 51                      push ecx
:00443D55 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00443D58 E890FDFFFF              call 00443AED
:00443D5D 8B5508                  mov edx, dword ptr [ebp+08]
:00443D60 52                      push edx
:00443D61 8B45F8                  mov eax, dword ptr [ebp-08]
:00443D64 50                      push eax
:00443D65 6A60                    push 00000060
:00443D67 6A60                    push 00000060
:00443D69 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00443D6C 8B9180000000            mov edx, dword ptr [ecx+00000080]
:00443D72 52                      push edx
:00443D73 8B4508                  mov eax, dword ptr [ebp+08]
:00443D76 8B4820                  mov ecx, dword ptr [eax+20]
:00443D79 51                      push ecx
:00443D7A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00443D7D E89BFEFFFF              call 00443C1D
:00443D82 E86FA8FDFF              call 0041E5F6
:00443D87 8BE5                    mov esp, ebp
:00443D89 5D                      pop ebp
:00443D8A C20800                  ret 0008



* Referenced by a CALL at Address:
|:00448685   
|
:00443D8D 55                      push ebp
:00443D8E 8BEC                    mov ebp, esp
:00443D90 83EC08                  sub esp, 00000008
:00443D93 894DF8                  mov dword ptr [ebp-08], ecx
:00443D96 6A04                    push 00000004
:00443D98 6A00                    push 00000000
:00443D9A 6A00                    push 00000000
:00443D9C B9C8E44A00              mov ecx, 004AE4C8
:00443DA1 E89ABC0300              call 0047FA40
:00443DA6 8945FC                  mov dword ptr [ebp-04], eax
:00443DA9 6800400000              push 00004000
:00443DAE 6A00                    push 00000000
:00443DB0 8B45FC                  mov eax, dword ptr [ebp-04]
:00443DB3 50                      push eax
:00443DB4 E877CD0300              call 00480B30
:00443DB9 83C40C                  add esp, 0000000C
:00443DBC E81AA8FDFF              call 0041E5DB
:00443DC1 6A01                    push 00000001
:00443DC3 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00443DC6 51                      push ecx
:00443DC7 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00443DCA E81EFDFFFF              call 00443AED
:00443DCF 8B5508                  mov edx, dword ptr [ebp+08]
:00443DD2 52                      push edx
:00443DD3 8B45FC                  mov eax, dword ptr [ebp-04]
:00443DD6 50                      push eax
:00443DD7 6A60                    push 00000060
:00443DD9 6A60                    push 00000060
:00443DDB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00443DDE 8B9180000000            mov edx, dword ptr [ecx+00000080]
:00443DE4 52                      push edx
:00443DE5 8B4508                  mov eax, dword ptr [ebp+08]
:00443DE8 8B4820                  mov ecx, dword ptr [eax+20]
:00443DEB 51                      push ecx
:00443DEC 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00443DEF E829FEFFFF              call 00443C1D
:00443DF4 E8FDA7FDFF              call 0041E5F6
:00443DF9 8BE5                    mov esp, ebp
:00443DFB 5D                      pop ebp
:00443DFC C20800                  ret 0008



* Referenced by a CALL at Address:
|:004485EC   
|
:00443DFF 55                      push ebp
:00443E00 8BEC                    mov ebp, esp
:00443E02 6AFF                    push FFFFFFFF
:00443E04 686C544800              push 0048546C
:00443E09 64A100000000            mov eax, dword ptr fs:[00000000]
:00443E0F 50                      push eax
:00443E10 64892500000000          mov dword ptr fs:[00000000], esp
:00443E17 81EC14010000            sub esp, 00000114
:00443E1D 898DE0FEFFFF            mov dword ptr [ebp+FFFFFEE0], ecx
:00443E23 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00443E29 E882F4FBFF              call 004032B0
:00443E2E C745FC00000000          mov [ebp-04], 00000000
:00443E35 8B4508                  mov eax, dword ptr [ebp+08]
:00443E38 33C9                    xor ecx, ecx
:00443E3A 8A480D                  mov cl, byte ptr [eax+0D]
:00443E3D 51                      push ecx
:00443E3E 8B5508                  mov edx, dword ptr [ebp+08]
:00443E41 8B4A04                  mov ecx, dword ptr [edx+04]
:00443E44 E8FFBDFFFF              call 0043FC48
:00443E49 8845F0                  mov byte ptr [ebp-10], al

* Possible StringData Ref from Data Obj ->"UNIT_SPC.E5"
                                  |
:00443E4C 68D0BB4800              push 0048BBD0
:00443E51 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00443E57 E8D9BCFDFF              call 0041FB35
:00443E5C 6A04                    push 00000004
:00443E5E 6A00                    push 00000000
:00443E60 6800780300              push 00037800
:00443E65 B9C8E44A00              mov ecx, 004AE4C8
:00443E6A E8D1BB0300              call 0047FA40
:00443E6F 50                      push eax
:00443E70 8B45F0                  mov eax, dword ptr [ebp-10]
:00443E73 25FF000000              and eax, 000000FF
:00443E78 50                      push eax
:00443E79 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00443E7F E805BEFDFF              call 0041FC89
:00443E84 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00443E8A E83654FDFF              call 004192C5
:00443E8F 6A04                    push 00000004
:00443E91 6A00                    push 00000000
:00443E93 6A00                    push 00000000
:00443E95 B9C8E44A00              mov ecx, 004AE4C8
:00443E9A E8A1BB0300              call 0047FA40
:00443E9F 8985E4FEFFFF            mov dword ptr [ebp+FFFFFEE4], eax
:00443EA5 6A04                    push 00000004
:00443EA7 6A00                    push 00000000
:00443EA9 68009C0300              push 00039C00
:00443EAE B9C8E44A00              mov ecx, 004AE4C8
:00443EB3 E888BB0300              call 0047FA40
:00443EB8 8985E8FEFFFF            mov dword ptr [ebp+FFFFFEE8], eax
:00443EBE 6A30                    push 00000030
:00443EC0 6A30                    push 00000030
:00443EC2 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:00443EC8 51                      push ecx
:00443EC9 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:00443ECF 52                      push edx
:00443ED0 E8A1CBFEFF              call 00430A76
:00443ED5 83C410                  add esp, 00000010
:00443ED8 6A01                    push 00000001
:00443EDA 6A08                    push 00000008
:00443EDC B9B0694B00              mov ecx, 004B69B0
:00443EE1 E894070300              call 0047467A
:00443EE6 E8F0A6FDFF              call 0041E5DB
:00443EEB 6A01                    push 00000001
:00443EED 8B450C                  mov eax, dword ptr [ebp+0C]
:00443EF0 50                      push eax
:00443EF1 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:00443EF7 E8F1FBFFFF              call 00443AED
:00443EFC 8B4D08                  mov ecx, dword ptr [ebp+08]
:00443EFF 51                      push ecx
:00443F00 8B95E4FEFFFF            mov edx, dword ptr [ebp+FFFFFEE4]
:00443F06 52                      push edx
:00443F07 6A60                    push 00000060
:00443F09 6A60                    push 00000060
:00443F0B 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:00443F11 8B8880000000            mov ecx, dword ptr [eax+00000080]
:00443F17 51                      push ecx
:00443F18 8B5508                  mov edx, dword ptr [ebp+08]
:00443F1B 8B4220                  mov eax, dword ptr [edx+20]
:00443F1E 50                      push eax
:00443F1F 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:00443F25 E8F3FCFFFF              call 00443C1D
:00443F2A E8C7A6FDFF              call 0041E5F6
:00443F2F C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00443F36 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00443F3C E88FF3FBFF              call 004032D0
:00443F41 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00443F44 64890D00000000          mov dword ptr fs:[00000000], ecx
:00443F4B 8BE5                    mov esp, ebp
:00443F4D 5D                      pop ebp
:00443F4E C20800                  ret 0008



* Referenced by a CALL at Address:
|:00448601   
|
:00443F51 55                      push ebp
:00443F52 8BEC                    mov ebp, esp
:00443F54 6AFF                    push FFFFFFFF
:00443F56 6882544800              push 00485482
:00443F5B 64A100000000            mov eax, dword ptr fs:[00000000]
:00443F61 50                      push eax
:00443F62 64892500000000          mov dword ptr fs:[00000000], esp
:00443F69 81EC18010000            sub esp, 00000118
:00443F6F 898DDCFEFFFF            mov dword ptr [ebp+FFFFFEDC], ecx
:00443F75 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00443F7B E830F3FBFF              call 004032B0
:00443F80 C745FC00000000          mov [ebp-04], 00000000
:00443F87 8B4508                  mov eax, dword ptr [ebp+08]
:00443F8A 33C9                    xor ecx, ecx
:00443F8C 8A480D                  mov cl, byte ptr [eax+0D]
:00443F8F 51                      push ecx
:00443F90 8B5508                  mov edx, dword ptr [ebp+08]
:00443F93 8B4A04                  mov ecx, dword ptr [edx+04]
:00443F96 E8ADBCFFFF              call 0043FC48
:00443F9B 8845F0                  mov byte ptr [ebp-10], al

* Possible StringData Ref from Data Obj ->"UNIT_SPC.E5"
                                  |
:00443F9E 68D0BB4800              push 0048BBD0
:00443FA3 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00443FA9 E887BBFDFF              call 0041FB35
:00443FAE 6A04                    push 00000004
:00443FB0 6A00                    push 00000000
:00443FB2 6800780300              push 00037800
:00443FB7 B9C8E44A00              mov ecx, 004AE4C8
:00443FBC E87FBA0300              call 0047FA40
:00443FC1 50                      push eax
:00443FC2 8B45F0                  mov eax, dword ptr [ebp-10]
:00443FC5 25FF000000              and eax, 000000FF
:00443FCA 50                      push eax
:00443FCB 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00443FD1 E8B3BCFDFF              call 0041FC89
:00443FD6 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00443FDC E8E452FDFF              call 004192C5
:00443FE1 6A04                    push 00000004
:00443FE3 6A00                    push 00000000
:00443FE5 6A00                    push 00000000
:00443FE7 B9C8E44A00              mov ecx, 004AE4C8
:00443FEC E84FBA0300              call 0047FA40
:00443FF1 8985E4FEFFFF            mov dword ptr [ebp+FFFFFEE4], eax
:00443FF7 6A04                    push 00000004
:00443FF9 6A00                    push 00000000
:00443FFB 68008A0300              push 00038A00
:00444000 B9C8E44A00              mov ecx, 004AE4C8
:00444005 E836BA0300              call 0047FA40
:0044400A 8985E8FEFFFF            mov dword ptr [ebp+FFFFFEE8], eax
:00444010 6A04                    push 00000004
:00444012 6A00                    push 00000000
:00444014 6800380400              push 00043800
:00444019 B9C8E44A00              mov ecx, 004AE4C8
:0044401E E81DBA0300              call 0047FA40
:00444023 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:00444029 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044402C 33D2                    xor edx, edx
:0044402E 8A510E                  mov dl, byte ptr [ecx+0E]
:00444031 83FA01                  cmp edx, 00000001
:00444034 751C                    jne 00444052
:00444036 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:0044403C 50                      push eax
:0044403D 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00444043 51                      push ecx
:00444044 6A30                    push 00000030
:00444046 6A30                    push 00000030
:00444048 E806AEFDFF              call 0041EE53
:0044404D 83C410                  add esp, 00000010
:00444050 EB0C                    jmp 0044405E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444034(C)
|
:00444052 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:00444058 8995E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444050(U)
|
:0044405E 6A30                    push 00000030
:00444060 6A30                    push 00000030
:00444062 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:00444068 50                      push eax
:00444069 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:0044406F 51                      push ecx
:00444070 E801CAFEFF              call 00430A76
:00444075 83C410                  add esp, 00000010
:00444078 6A01                    push 00000001
:0044407A 6A08                    push 00000008
:0044407C B9B0694B00              mov ecx, 004B69B0
:00444081 E8F4050300              call 0047467A
:00444086 E850A5FDFF              call 0041E5DB
:0044408B 6A01                    push 00000001
:0044408D 8B550C                  mov edx, dword ptr [ebp+0C]
:00444090 52                      push edx
:00444091 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:00444097 E851FAFFFF              call 00443AED
:0044409C 8B4508                  mov eax, dword ptr [ebp+08]
:0044409F 50                      push eax
:004440A0 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:004440A6 51                      push ecx
:004440A7 6A60                    push 00000060
:004440A9 6A60                    push 00000060
:004440AB 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:004440B1 8B8280000000            mov eax, dword ptr [edx+00000080]
:004440B7 50                      push eax
:004440B8 8B4D08                  mov ecx, dword ptr [ebp+08]
:004440BB 8B5120                  mov edx, dword ptr [ecx+20]
:004440BE 52                      push edx
:004440BF 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:004440C5 E853FBFFFF              call 00443C1D
:004440CA E827A5FDFF              call 0041E5F6
:004440CF C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:004440D6 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:004440DC E8EFF1FBFF              call 004032D0
:004440E1 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004440E4 64890D00000000          mov dword ptr fs:[00000000], ecx
:004440EB 8BE5                    mov esp, ebp
:004440ED 5D                      pop ebp
:004440EE C20800                  ret 0008



* Referenced by a CALL at Address:
|:00448616   
|
:004440F1 55                      push ebp
:004440F2 8BEC                    mov ebp, esp
:004440F4 6AFF                    push FFFFFFFF
:004440F6 6898544800              push 00485498
:004440FB 64A100000000            mov eax, dword ptr fs:[00000000]
:00444101 50                      push eax
:00444102 64892500000000          mov dword ptr fs:[00000000], esp
:00444109 81EC14010000            sub esp, 00000114
:0044410F 898DE0FEFFFF            mov dword ptr [ebp+FFFFFEE0], ecx
:00444115 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0044411B E890F1FBFF              call 004032B0
:00444120 C745FC00000000          mov [ebp-04], 00000000
:00444127 8B4508                  mov eax, dword ptr [ebp+08]
:0044412A 33C9                    xor ecx, ecx
:0044412C 8A480D                  mov cl, byte ptr [eax+0D]
:0044412F 51                      push ecx
:00444130 8B5508                  mov edx, dword ptr [ebp+08]
:00444133 8B4A04                  mov ecx, dword ptr [edx+04]
:00444136 E80DBBFFFF              call 0043FC48
:0044413B 8845F0                  mov byte ptr [ebp-10], al

* Possible StringData Ref from Data Obj ->"UNIT_SPC.E5"
                                  |
:0044413E 68D0BB4800              push 0048BBD0
:00444143 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00444149 E8E7B9FDFF              call 0041FB35
:0044414E 6A04                    push 00000004
:00444150 6A00                    push 00000000
:00444152 6800780300              push 00037800
:00444157 B9C8E44A00              mov ecx, 004AE4C8
:0044415C E8DFB80300              call 0047FA40
:00444161 50                      push eax
:00444162 8B45F0                  mov eax, dword ptr [ebp-10]
:00444165 25FF000000              and eax, 000000FF
:0044416A 50                      push eax
:0044416B 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00444171 E813BBFDFF              call 0041FC89
:00444176 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0044417C E84451FDFF              call 004192C5
:00444181 6A04                    push 00000004
:00444183 6A00                    push 00000000
:00444185 6A00                    push 00000000
:00444187 B9C8E44A00              mov ecx, 004AE4C8
:0044418C E8AFB80300              call 0047FA40
:00444191 8985E4FEFFFF            mov dword ptr [ebp+FFFFFEE4], eax
:00444197 6A04                    push 00000004
:00444199 6A00                    push 00000000
:0044419B 6800930300              push 00039300
:004441A0 B9C8E44A00              mov ecx, 004AE4C8
:004441A5 E896B80300              call 0047FA40
:004441AA 8985E8FEFFFF            mov dword ptr [ebp+FFFFFEE8], eax
:004441B0 6A30                    push 00000030
:004441B2 6A30                    push 00000030
:004441B4 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:004441BA 51                      push ecx
:004441BB 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:004441C1 52                      push edx
:004441C2 E8AFC8FEFF              call 00430A76
:004441C7 83C410                  add esp, 00000010
:004441CA 6A01                    push 00000001
:004441CC 6A08                    push 00000008
:004441CE B9B0694B00              mov ecx, 004B69B0
:004441D3 E8A2040300              call 0047467A
:004441D8 E8FEA3FDFF              call 0041E5DB
:004441DD 6A01                    push 00000001
:004441DF 8B450C                  mov eax, dword ptr [ebp+0C]
:004441E2 50                      push eax
:004441E3 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:004441E9 E8FFF8FFFF              call 00443AED
:004441EE 8B4D08                  mov ecx, dword ptr [ebp+08]
:004441F1 51                      push ecx
:004441F2 8B95E4FEFFFF            mov edx, dword ptr [ebp+FFFFFEE4]
:004441F8 52                      push edx
:004441F9 6A60                    push 00000060
:004441FB 6A60                    push 00000060
:004441FD 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:00444203 8B8880000000            mov ecx, dword ptr [eax+00000080]
:00444209 51                      push ecx
:0044420A 8B5508                  mov edx, dword ptr [ebp+08]
:0044420D 8B4220                  mov eax, dword ptr [edx+20]
:00444210 50                      push eax
:00444211 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:00444217 E801FAFFFF              call 00443C1D
:0044421C E8D5A3FDFF              call 0041E5F6
:00444221 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00444228 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0044422E E89DF0FBFF              call 004032D0
:00444233 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00444236 64890D00000000          mov dword ptr fs:[00000000], ecx
:0044423D 8BE5                    mov esp, ebp
:0044423F 5D                      pop ebp
:00444240 C20800                  ret 0008



* Referenced by a CALL at Address:
|:00448661   
|
:00444243 55                      push ebp
:00444244 8BEC                    mov ebp, esp
:00444246 83EC0C                  sub esp, 0000000C
:00444249 894DF4                  mov dword ptr [ebp-0C], ecx
:0044424C 6A04                    push 00000004
:0044424E 6A00                    push 00000000
:00444250 6A00                    push 00000000
:00444252 B9C8E44A00              mov ecx, 004AE4C8
:00444257 E8E4B70300              call 0047FA40
:0044425C 8945F8                  mov dword ptr [ebp-08], eax
:0044425F 6A04                    push 00000004
:00444261 6A00                    push 00000000
:00444263 8B4508                  mov eax, dword ptr [ebp+08]
:00444266 33C9                    xor ecx, ecx
:00444268 8A480D                  mov cl, byte ptr [eax+0D]
:0044426B 69C900630000            imul ecx, 00006300
:00444271 81C100510000            add ecx, 00005100
:00444277 51                      push ecx
:00444278 B980AB4A00              mov ecx, 004AAB80
:0044427D E8BEB70300              call 0047FA40
:00444282 8945FC                  mov dword ptr [ebp-04], eax
:00444285 6A30                    push 00000030
:00444287 6A30                    push 00000030
:00444289 8B55F8                  mov edx, dword ptr [ebp-08]
:0044428C 52                      push edx
:0044428D 8B45FC                  mov eax, dword ptr [ebp-04]
:00444290 50                      push eax
:00444291 E8E0C7FEFF              call 00430A76
:00444296 83C410                  add esp, 00000010
:00444299 6A01                    push 00000001
:0044429B 6A08                    push 00000008
:0044429D B9B0694B00              mov ecx, 004B69B0
:004442A2 E8D3030300              call 0047467A
:004442A7 E82FA3FDFF              call 0041E5DB
:004442AC 6A01                    push 00000001
:004442AE 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004442B1 51                      push ecx
:004442B2 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004442B5 E833F8FFFF              call 00443AED
:004442BA 8B5508                  mov edx, dword ptr [ebp+08]
:004442BD 52                      push edx
:004442BE 8B45F8                  mov eax, dword ptr [ebp-08]
:004442C1 50                      push eax
:004442C2 6A60                    push 00000060
:004442C4 6A60                    push 00000060
:004442C6 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004442C9 8B9180000000            mov edx, dword ptr [ecx+00000080]
:004442CF 52                      push edx
:004442D0 8B4508                  mov eax, dword ptr [ebp+08]
:004442D3 8B4820                  mov ecx, dword ptr [eax+20]
:004442D6 51                      push ecx
:004442D7 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004442DA E83EF9FFFF              call 00443C1D
:004442DF E812A3FDFF              call 0041E5F6
:004442E4 8BE5                    mov esp, ebp
:004442E6 5D                      pop ebp
:004442E7 C20800                  ret 0008



* Referenced by a CALL at Address:
|:0044862B   
|
:004442EA 55                      push ebp
:004442EB 8BEC                    mov ebp, esp
:004442ED 6AFF                    push FFFFFFFF
:004442EF 68AE544800              push 004854AE
:004442F4 64A100000000            mov eax, dword ptr fs:[00000000]
:004442FA 50                      push eax
:004442FB 64892500000000          mov dword ptr fs:[00000000], esp
:00444302 81EC18010000            sub esp, 00000118
:00444308 898DDCFEFFFF            mov dword ptr [ebp+FFFFFEDC], ecx
:0044430E 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00444314 E897EFFBFF              call 004032B0
:00444319 C745FC00000000          mov [ebp-04], 00000000
:00444320 8B4508                  mov eax, dword ptr [ebp+08]
:00444323 33C9                    xor ecx, ecx
:00444325 8A480D                  mov cl, byte ptr [eax+0D]
:00444328 51                      push ecx
:00444329 8B5508                  mov edx, dword ptr [ebp+08]
:0044432C 8B4A04                  mov ecx, dword ptr [edx+04]
:0044432F E814B9FFFF              call 0043FC48
:00444334 8845F0                  mov byte ptr [ebp-10], al

* Possible StringData Ref from Data Obj ->"UNIT_ATK.E5"
                                  |
:00444337 68C0BB4800              push 0048BBC0
:0044433C 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00444342 E8EEB7FDFF              call 0041FB35
:00444347 6A04                    push 00000004
:00444349 6A00                    push 00000000
:0044434B 6800780300              push 00037800
:00444350 B9C8E44A00              mov ecx, 004AE4C8
:00444355 E8E6B60300              call 0047FA40
:0044435A 50                      push eax
:0044435B 8B45F0                  mov eax, dword ptr [ebp-10]
:0044435E 25FF000000              and eax, 000000FF
:00444363 50                      push eax
:00444364 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0044436A E81AB9FDFF              call 0041FC89
:0044436F 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00444375 E84B4FFDFF              call 004192C5
:0044437A 6A04                    push 00000004
:0044437C 6A00                    push 00000000
:0044437E 6A00                    push 00000000
:00444380 B9C8E44A00              mov ecx, 004AE4C8
:00444385 E8B6B60300              call 0047FA40
:0044438A 8985E4FEFFFF            mov dword ptr [ebp+FFFFFEE4], eax
:00444390 6A04                    push 00000004
:00444392 6A00                    push 00000000
:00444394 6800F80300              push 0003F800
:00444399 B9C8E44A00              mov ecx, 004AE4C8
:0044439E E89DB60300              call 0047FA40
:004443A3 8985E8FEFFFF            mov dword ptr [ebp+FFFFFEE8], eax
:004443A9 6A04                    push 00000004
:004443AB 6A00                    push 00000000
:004443AD 6800380400              push 00043800
:004443B2 B9C8E44A00              mov ecx, 004AE4C8
:004443B7 E884B60300              call 0047FA40
:004443BC 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:004443C2 8B4D08                  mov ecx, dword ptr [ebp+08]
:004443C5 33D2                    xor edx, edx
:004443C7 8A510E                  mov dl, byte ptr [ecx+0E]
:004443CA 83FA01                  cmp edx, 00000001
:004443CD 751C                    jne 004443EB
:004443CF 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:004443D5 50                      push eax
:004443D6 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:004443DC 51                      push ecx
:004443DD 6A40                    push 00000040
:004443DF 6A40                    push 00000040
:004443E1 E86DAAFDFF              call 0041EE53
:004443E6 83C410                  add esp, 00000010
:004443E9 EB0C                    jmp 004443F7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004443CD(C)
|
:004443EB 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:004443F1 8995E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004443E9(U)
|
:004443F7 6A40                    push 00000040
:004443F9 6A40                    push 00000040
:004443FB 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:00444401 50                      push eax
:00444402 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:00444408 51                      push ecx
:00444409 E868C6FEFF              call 00430A76
:0044440E 83C410                  add esp, 00000010
:00444411 6A01                    push 00000001
:00444413 6A08                    push 00000008
:00444415 B9B0694B00              mov ecx, 004B69B0
:0044441A E85B020300              call 0047467A
:0044441F E8B7A1FDFF              call 0041E5DB
:00444424 6A01                    push 00000001
:00444426 8B550C                  mov edx, dword ptr [ebp+0C]
:00444429 52                      push edx
:0044442A 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:00444430 E8B8F6FFFF              call 00443AED
:00444435 8B4508                  mov eax, dword ptr [ebp+08]
:00444438 50                      push eax
:00444439 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:0044443F 51                      push ecx
:00444440 6880000000              push 00000080
:00444445 6880000000              push 00000080
:0044444A 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:00444450 8B8280000000            mov eax, dword ptr [edx+00000080]
:00444456 83E810                  sub eax, 00000010
:00444459 50                      push eax
:0044445A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044445D 8B5120                  mov edx, dword ptr [ecx+20]
:00444460 83EA10                  sub edx, 00000010
:00444463 52                      push edx
:00444464 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:0044446A E8AEF7FFFF              call 00443C1D
:0044446F E882A1FDFF              call 0041E5F6
:00444474 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0044447B 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00444481 E84AEEFBFF              call 004032D0
:00444486 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00444489 64890D00000000          mov dword ptr fs:[00000000], ecx
:00444490 8BE5                    mov esp, ebp
:00444492 5D                      pop ebp
:00444493 C20800                  ret 0008



* Referenced by a CALL at Address:
|:0044863D   
|
:00444496 55                      push ebp
:00444497 8BEC                    mov ebp, esp
:00444499 6AFF                    push FFFFFFFF
:0044449B 68C4544800              push 004854C4
:004444A0 64A100000000            mov eax, dword ptr fs:[00000000]
:004444A6 50                      push eax
:004444A7 64892500000000          mov dword ptr fs:[00000000], esp
:004444AE 81EC1C010000            sub esp, 0000011C
:004444B4 898DD8FEFFFF            mov dword ptr [ebp+FFFFFED8], ecx
:004444BA 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:004444C0 E8EBEDFBFF              call 004032B0
:004444C5 C745FC00000000          mov [ebp-04], 00000000
:004444CC 8B4508                  mov eax, dword ptr [ebp+08]
:004444CF 33C9                    xor ecx, ecx
:004444D1 8A480D                  mov cl, byte ptr [eax+0D]
:004444D4 51                      push ecx
:004444D5 8B5508                  mov edx, dword ptr [ebp+08]
:004444D8 8B4A04                  mov ecx, dword ptr [edx+04]
:004444DB E868B7FFFF              call 0043FC48
:004444E0 8845F0                  mov byte ptr [ebp-10], al

* Possible StringData Ref from Data Obj ->"UNIT_ATK.E5"
                                  |
:004444E3 68C0BB4800              push 0048BBC0
:004444E8 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:004444EE E842B6FDFF              call 0041FB35
:004444F3 6A04                    push 00000004
:004444F5 6A00                    push 00000000
:004444F7 6800780300              push 00037800
:004444FC B9C8E44A00              mov ecx, 004AE4C8
:00444501 E83AB50300              call 0047FA40
:00444506 50                      push eax
:00444507 8B45F0                  mov eax, dword ptr [ebp-10]
:0044450A 25FF000000              and eax, 000000FF
:0044450F 50                      push eax
:00444510 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00444516 E86EB7FDFF              call 0041FC89
:0044451B 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00444521 E89F4DFDFF              call 004192C5
:00444526 6A04                    push 00000004
:00444528 6A00                    push 00000000
:0044452A 6A00                    push 00000000
:0044452C B9C8E44A00              mov ecx, 004AE4C8
:00444531 E80AB50300              call 0047FA40
:00444536 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:0044453C 6A04                    push 00000004
:0044453E 6A00                    push 00000000
:00444540 6800F80300              push 0003F800
:00444545 B9C8E44A00              mov ecx, 004AE4C8
:0044454A E8F1B40300              call 0047FA40
:0044454F 8985E8FEFFFF            mov dword ptr [ebp+FFFFFEE8], eax
:00444555 6A04                    push 00000004
:00444557 6A00                    push 00000000
:00444559 6800380400              push 00043800
:0044455E B9C8E44A00              mov ecx, 004AE4C8
:00444563 E8D8B40300              call 0047FA40
:00444568 8985DCFEFFFF            mov dword ptr [ebp+FFFFFEDC], eax
:0044456E C785E4FEFFFF00000000    mov dword ptr [ebp+FFFFFEE4], 00000000
:00444578 EB0F                    jmp 00444589

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444602(U)
|
:0044457A 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:00444580 83C101                  add ecx, 00000001
:00444583 898DE4FEFFFF            mov dword ptr [ebp+FFFFFEE4], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444578(U)
|
:00444589 83BDE4FEFFFF04          cmp dword ptr [ebp+FFFFFEE4], 00000004
:00444590 7375                    jnb 00444607
:00444592 8B5508                  mov edx, dword ptr [ebp+08]
:00444595 33C0                    xor eax, eax
:00444597 8A420E                  mov al, byte ptr [edx+0E]
:0044459A 83F801                  cmp eax, 00000001
:0044459D 7527                    jne 004445C6
:0044459F 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:004445A5 51                      push ecx
:004445A6 8B95E4FEFFFF            mov edx, dword ptr [ebp+FFFFFEE4]
:004445AC C1E20C                  shl edx, 0C
:004445AF 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:004445B5 03C2                    add eax, edx
:004445B7 50                      push eax
:004445B8 6A40                    push 00000040
:004445BA 6A40                    push 00000040
:004445BC E892A8FDFF              call 0041EE53
:004445C1 83C410                  add esp, 00000010
:004445C4 EB17                    jmp 004445DD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044459D(C)
|
:004445C6 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:004445CC C1E10C                  shl ecx, 0C
:004445CF 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:004445D5 03D1                    add edx, ecx
:004445D7 8995DCFEFFFF            mov dword ptr [ebp+FFFFFEDC], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004445C4(U)
|
:004445DD 6A40                    push 00000040
:004445DF 6A40                    push 00000040
:004445E1 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:004445E7 C1E00E                  shl eax, 0E
:004445EA 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:004445F0 03C8                    add ecx, eax
:004445F2 51                      push ecx
:004445F3 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:004445F9 52                      push edx
:004445FA E877C4FEFF              call 00430A76
:004445FF 83C410                  add esp, 00000010
:00444602 E973FFFFFF              jmp 0044457A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444590(C)
|
:00444607 6A01                    push 00000001

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:00444609 6A07                    push 00000007
:0044460B B9B0694B00              mov ecx, 004B69B0
:00444610 E865000300              call 0047467A
:00444615 C785E4FEFFFF00000000    mov dword ptr [ebp+FFFFFEE4], 00000000
:0044461F EB0F                    jmp 00444630

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004446AA(U)
|
:00444621 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:00444627 83C001                  add eax, 00000001
:0044462A 8985E4FEFFFF            mov dword ptr [ebp+FFFFFEE4], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044461F(U)
|
:00444630 83BDE4FEFFFF04          cmp dword ptr [ebp+FFFFFEE4], 00000004
:00444637 7376                    jnb 004446AF
:00444639 E89D9FFDFF              call 0041E5DB
:0044463E 6A01                    push 00000001
:00444640 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00444643 51                      push ecx
:00444644 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:0044464A E89EF4FFFF              call 00443AED
:0044464F 8B5508                  mov edx, dword ptr [ebp+08]
:00444652 52                      push edx
:00444653 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:00444659 C1E00E                  shl eax, 0E
:0044465C 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:00444662 03C8                    add ecx, eax
:00444664 51                      push ecx
:00444665 6880000000              push 00000080
:0044466A 6880000000              push 00000080
:0044466F 8B95D8FEFFFF            mov edx, dword ptr [ebp+FFFFFED8]
:00444675 8B8280000000            mov eax, dword ptr [edx+00000080]
:0044467B 83E810                  sub eax, 00000010
:0044467E 50                      push eax
:0044467F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00444682 8B5120                  mov edx, dword ptr [ecx+20]
:00444685 83EA10                  sub edx, 00000010
:00444688 52                      push edx
:00444689 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:0044468F E889F5FFFF              call 00443C1D
:00444694 E85D9FFDFF              call 0041E5F6
:00444699 6A01                    push 00000001
:0044469B B9181B4B00              mov ecx, 004B1B18
:004446A0 E89BECFBFF              call 00403340
:004446A5 E8367EFEFF              call 0042C4E0
:004446AA E972FFFFFF              jmp 00444621

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444637(C)
|
:004446AF C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:004446B6 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:004446BC E80FECFBFF              call 004032D0
:004446C1 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004446C4 64890D00000000          mov dword ptr fs:[00000000], ecx
:004446CB 8BE5                    mov esp, ebp
:004446CD 5D                      pop ebp
:004446CE C20800                  ret 0008



* Referenced by a CALL at Address:
|:0044864F   
|
:004446D1 55                      push ebp
:004446D2 8BEC                    mov ebp, esp
:004446D4 6AFF                    push FFFFFFFF
:004446D6 68DA544800              push 004854DA
:004446DB 64A100000000            mov eax, dword ptr fs:[00000000]
:004446E1 50                      push eax
:004446E2 64892500000000          mov dword ptr fs:[00000000], esp
:004446E9 81EC20010000            sub esp, 00000120
:004446EF 898DD4FEFFFF            mov dword ptr [ebp+FFFFFED4], ecx
:004446F5 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:004446FB E8B0EBFBFF              call 004032B0
:00444700 C745FC00000000          mov [ebp-04], 00000000
:00444707 8B4508                  mov eax, dword ptr [ebp+08]
:0044470A 33C9                    xor ecx, ecx
:0044470C 8A480D                  mov cl, byte ptr [eax+0D]
:0044470F 51                      push ecx
:00444710 8B5508                  mov edx, dword ptr [ebp+08]
:00444713 8B4A04                  mov ecx, dword ptr [edx+04]
:00444716 E82DB5FFFF              call 0043FC48
:0044471B 8845F0                  mov byte ptr [ebp-10], al

* Possible StringData Ref from Data Obj ->"UNIT_ATK.E5"
                                  |
:0044471E 68C0BB4800              push 0048BBC0
:00444723 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00444729 E807B4FDFF              call 0041FB35
:0044472E 6A04                    push 00000004
:00444730 6A00                    push 00000000
:00444732 6800780300              push 00037800
:00444737 B9C8E44A00              mov ecx, 004AE4C8
:0044473C E8FFB20300              call 0047FA40
:00444741 50                      push eax
:00444742 8B45F0                  mov eax, dword ptr [ebp-10]
:00444745 25FF000000              and eax, 000000FF
:0044474A 50                      push eax
:0044474B 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00444751 E833B5FDFF              call 0041FC89
:00444756 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0044475C E8644BFDFF              call 004192C5
:00444761 6A04                    push 00000004
:00444763 6A00                    push 00000000
:00444765 6A00                    push 00000000
:00444767 B9C8E44A00              mov ecx, 004AE4C8
:0044476C E8CFB20300              call 0047FA40
:00444771 8985DCFEFFFF            mov dword ptr [ebp+FFFFFEDC], eax
:00444777 6A04                    push 00000004
:00444779 6A00                    push 00000000
:0044477B 6800F80300              push 0003F800
:00444780 B9C8E44A00              mov ecx, 004AE4C8
:00444785 E8B6B20300              call 0047FA40
:0044478A 8985E8FEFFFF            mov dword ptr [ebp+FFFFFEE8], eax
:00444790 6A04                    push 00000004
:00444792 6A00                    push 00000000
:00444794 6800380400              push 00043800
:00444799 B9C8E44A00              mov ecx, 004AE4C8
:0044479E E89DB20300              call 0047FA40
:004447A3 8985D8FEFFFF            mov dword ptr [ebp+FFFFFED8], eax
:004447A9 C785E4FEFFFF00000000    mov dword ptr [ebp+FFFFFEE4], 00000000
:004447B3 EB0F                    jmp 004447C4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044483D(U)
|
:004447B5 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:004447BB 83C101                  add ecx, 00000001
:004447BE 898DE4FEFFFF            mov dword ptr [ebp+FFFFFEE4], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004447B3(U)
|
:004447C4 83BDE4FEFFFF04          cmp dword ptr [ebp+FFFFFEE4], 00000004
:004447CB 7375                    jnb 00444842
:004447CD 8B5508                  mov edx, dword ptr [ebp+08]
:004447D0 33C0                    xor eax, eax
:004447D2 8A420E                  mov al, byte ptr [edx+0E]
:004447D5 83F801                  cmp eax, 00000001
:004447D8 7527                    jne 00444801
:004447DA 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:004447E0 51                      push ecx
:004447E1 8B95E4FEFFFF            mov edx, dword ptr [ebp+FFFFFEE4]
:004447E7 C1E20C                  shl edx, 0C
:004447EA 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:004447F0 03C2                    add eax, edx
:004447F2 50                      push eax
:004447F3 6A40                    push 00000040
:004447F5 6A40                    push 00000040
:004447F7 E857A6FDFF              call 0041EE53
:004447FC 83C410                  add esp, 00000010
:004447FF EB17                    jmp 00444818

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004447D8(C)
|
:00444801 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:00444807 C1E10C                  shl ecx, 0C
:0044480A 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:00444810 03D1                    add edx, ecx
:00444812 8995D8FEFFFF            mov dword ptr [ebp+FFFFFED8], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004447FF(U)
|
:00444818 6A40                    push 00000040
:0044481A 6A40                    push 00000040
:0044481C 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:00444822 C1E00E                  shl eax, 0E
:00444825 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:0044482B 03C8                    add ecx, eax
:0044482D 51                      push ecx
:0044482E 8B95D8FEFFFF            mov edx, dword ptr [ebp+FFFFFED8]
:00444834 52                      push edx
:00444835 E83CC2FEFF              call 00430A76
:0044483A 83C410                  add esp, 00000010
:0044483D E973FFFFFF              jmp 004447B5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004447CB(C)
|
:00444842 C785E0FEFFFF00000000    mov dword ptr [ebp+FFFFFEE0], 00000000
:0044484C EB0F                    jmp 0044485D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444912(U)
|
:0044484E 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:00444854 83C001                  add eax, 00000001
:00444857 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044484C(U)
|
:0044485D 83BDE0FEFFFF02          cmp dword ptr [ebp+FFFFFEE0], 00000002
:00444864 0F83AD000000            jnb 00444917
:0044486A 6A01                    push 00000001

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0044486C 6A07                    push 00000007
:0044486E B9B0694B00              mov ecx, 004B69B0
:00444873 E802FE0200              call 0047467A
:00444878 C785E4FEFFFF00000000    mov dword ptr [ebp+FFFFFEE4], 00000000
:00444882 EB0F                    jmp 00444893

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044490D(U)
|
:00444884 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:0044488A 83C101                  add ecx, 00000001
:0044488D 898DE4FEFFFF            mov dword ptr [ebp+FFFFFEE4], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444882(U)
|
:00444893 83BDE4FEFFFF04          cmp dword ptr [ebp+FFFFFEE4], 00000004
:0044489A 7376                    jnb 00444912
:0044489C E83A9DFDFF              call 0041E5DB
:004448A1 6A01                    push 00000001
:004448A3 8B550C                  mov edx, dword ptr [ebp+0C]
:004448A6 52                      push edx
:004448A7 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:004448AD E83BF2FFFF              call 00443AED
:004448B2 8B4508                  mov eax, dword ptr [ebp+08]
:004448B5 50                      push eax
:004448B6 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:004448BC C1E10E                  shl ecx, 0E
:004448BF 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:004448C5 03D1                    add edx, ecx
:004448C7 52                      push edx
:004448C8 6880000000              push 00000080
:004448CD 6880000000              push 00000080
:004448D2 8B85D4FEFFFF            mov eax, dword ptr [ebp+FFFFFED4]
:004448D8 8B8880000000            mov ecx, dword ptr [eax+00000080]
:004448DE 83E910                  sub ecx, 00000010
:004448E1 51                      push ecx
:004448E2 8B5508                  mov edx, dword ptr [ebp+08]
:004448E5 8B4220                  mov eax, dword ptr [edx+20]
:004448E8 83E810                  sub eax, 00000010
:004448EB 50                      push eax
:004448EC 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:004448F2 E826F3FFFF              call 00443C1D
:004448F7 E8FA9CFDFF              call 0041E5F6
:004448FC 6A02                    push 00000002
:004448FE B9181B4B00              mov ecx, 004B1B18
:00444903 E838EAFBFF              call 00403340
:00444908 E8D37BFEFF              call 0042C4E0
:0044490D E972FFFFFF              jmp 00444884

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044489A(C)
|
:00444912 E937FFFFFF              jmp 0044484E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444864(C)
|
:00444917 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0044491E 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00444924 E8A7E9FBFF              call 004032D0
:00444929 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044492C 64890D00000000          mov dword ptr fs:[00000000], ecx
:00444933 8BE5                    mov esp, ebp
:00444935 5D                      pop ebp
:00444936 C20800                  ret 0008



* Referenced by a CALL at Address:
|:004485C2   
|
:00444939 55                      push ebp
:0044493A 8BEC                    mov ebp, esp
:0044493C 83EC10                  sub esp, 00000010
:0044493F 894DF0                  mov dword ptr [ebp-10], ecx
:00444942 6A04                    push 00000004
:00444944 6A00                    push 00000000
:00444946 6A00                    push 00000000
:00444948 B9C8E44A00              mov ecx, 004AE4C8
:0044494D E8EEB00300              call 0047FA40
:00444952 8945F4                  mov dword ptr [ebp-0C], eax
:00444955 6A04                    push 00000004
:00444957 6A00                    push 00000000
:00444959 8B4508                  mov eax, dword ptr [ebp+08]
:0044495C 33C9                    xor ecx, ecx
:0044495E 8A480D                  mov cl, byte ptr [eax+0D]
:00444961 69C900630000            imul ecx, 00006300
:00444967 81C100240000            add ecx, 00002400
:0044496D 51                      push ecx
:0044496E B980AB4A00              mov ecx, 004AAB80
:00444973 E8C8B00300              call 0047FA40
:00444978 8945FC                  mov dword ptr [ebp-04], eax
:0044497B C745F800000000          mov [ebp-08], 00000000
:00444982 EB09                    jmp 0044498D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004449BA(U)
|
:00444984 8B55F8                  mov edx, dword ptr [ebp-08]
:00444987 83C201                  add edx, 00000001
:0044498A 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444982(U)
|
:0044498D 837DF802                cmp dword ptr [ebp-08], 00000002
:00444991 7329                    jnb 004449BC
:00444993 6A30                    push 00000030
:00444995 6A30                    push 00000030
:00444997 8B45F8                  mov eax, dword ptr [ebp-08]
:0044499A C1E00E                  shl eax, 0E
:0044499D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004449A0 03C8                    add ecx, eax
:004449A2 51                      push ecx
:004449A3 8B55F8                  mov edx, dword ptr [ebp-08]
:004449A6 69D200090000            imul edx, 00000900
:004449AC 8B45FC                  mov eax, dword ptr [ebp-04]
:004449AF 03C2                    add eax, edx
:004449B1 50                      push eax
:004449B2 E8BFC0FEFF              call 00430A76
:004449B7 83C410                  add esp, 00000010
:004449BA EBC8                    jmp 00444984

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444991(C)
|
:004449BC 8B4D08                  mov ecx, dword ptr [ebp+08]
:004449BF 8B4904                  mov ecx, dword ptr [ecx+04]
:004449C2 E8A96AFFFF              call 0043B470
:004449C7 50                      push eax
:004449C8 E806ABFFFF              call 0043F4D3
:004449CD 83C404                  add esp, 00000004
:004449D0 C745F800000000          mov [ebp-08], 00000000
:004449D7 EB09                    jmp 004449E2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444A71(U)
|
:004449D9 8B55F8                  mov edx, dword ptr [ebp-08]
:004449DC 83C201                  add edx, 00000001
:004449DF 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004449D7(U)
|
:004449E2 837DF804                cmp dword ptr [ebp-08], 00000004
:004449E6 0F838A000000            jnb 00444A76
:004449EC 8B4508                  mov eax, dword ptr [ebp+08]
:004449EF 33C9                    xor ecx, ecx
:004449F1 8A480E                  mov cl, byte ptr [eax+0E]
:004449F4 83F901                  cmp ecx, 00000001
:004449F7 7511                    jne 00444A0A
:004449F9 8B5508                  mov edx, dword ptr [ebp+08]
:004449FC 8B4220                  mov eax, dword ptr [edx+20]
:004449FF 83C008                  add eax, 00000008
:00444A02 8B4D08                  mov ecx, dword ptr [ebp+08]
:00444A05 894120                  mov dword ptr [ecx+20], eax
:00444A08 EB0F                    jmp 00444A19

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004449F7(C)
|
:00444A0A 8B5508                  mov edx, dword ptr [ebp+08]
:00444A0D 8B4220                  mov eax, dword ptr [edx+20]
:00444A10 83E808                  sub eax, 00000008
:00444A13 8B4D08                  mov ecx, dword ptr [ebp+08]
:00444A16 894120                  mov dword ptr [ecx+20], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444A08(U)
|
:00444A19 E8BD9BFDFF              call 0041E5DB
:00444A1E 6A01                    push 00000001
:00444A20 8B550C                  mov edx, dword ptr [ebp+0C]
:00444A23 52                      push edx
:00444A24 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00444A27 E8C1F0FFFF              call 00443AED
:00444A2C 8B4508                  mov eax, dword ptr [ebp+08]
:00444A2F 50                      push eax
:00444A30 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00444A33 D1E9                    shr ecx, 1
:00444A35 C1E10E                  shl ecx, 0E
:00444A38 8B55F4                  mov edx, dword ptr [ebp-0C]
:00444A3B 03D1                    add edx, ecx
:00444A3D 52                      push edx
:00444A3E 6A60                    push 00000060
:00444A40 6A60                    push 00000060
:00444A42 8B45F0                  mov eax, dword ptr [ebp-10]
:00444A45 8B8880000000            mov ecx, dword ptr [eax+00000080]
:00444A4B 51                      push ecx
:00444A4C 8B5508                  mov edx, dword ptr [ebp+08]
:00444A4F 8B4220                  mov eax, dword ptr [edx+20]
:00444A52 50                      push eax
:00444A53 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00444A56 E8C2F1FFFF              call 00443C1D
:00444A5B E8969BFDFF              call 0041E5F6
:00444A60 6A01                    push 00000001
:00444A62 B9181B4B00              mov ecx, 004B1B18
:00444A67 E8D4E8FBFF              call 00403340
:00444A6C E86F7AFEFF              call 0042C4E0
:00444A71 E963FFFFFF              jmp 004449D9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004449E6(C)
|
:00444A76 8BE5                    mov esp, ebp
:00444A78 5D                      pop ebp
:00444A79 C20800                  ret 0008



* Referenced by a CALL at Address:
|:004485AD   
|
:00444A7C 55                      push ebp
:00444A7D 8BEC                    mov ebp, esp
:00444A7F 83EC10                  sub esp, 00000010
:00444A82 894DF0                  mov dword ptr [ebp-10], ecx
:00444A85 6A04                    push 00000004
:00444A87 6A00                    push 00000000
:00444A89 6A00                    push 00000000
:00444A8B B9C8E44A00              mov ecx, 004AE4C8
:00444A90 E8ABAF0300              call 0047FA40
:00444A95 8945F4                  mov dword ptr [ebp-0C], eax
:00444A98 6A04                    push 00000004
:00444A9A 6A00                    push 00000000
:00444A9C 8B4508                  mov eax, dword ptr [ebp+08]
:00444A9F 33C9                    xor ecx, ecx
:00444AA1 8A480D                  mov cl, byte ptr [eax+0D]
:00444AA4 69C900630000            imul ecx, 00006300
:00444AAA 81C100240000            add ecx, 00002400
:00444AB0 51                      push ecx
:00444AB1 B980AB4A00              mov ecx, 004AAB80
:00444AB6 E885AF0300              call 0047FA40
:00444ABB 8945FC                  mov dword ptr [ebp-04], eax
:00444ABE C745F800000000          mov [ebp-08], 00000000
:00444AC5 EB09                    jmp 00444AD0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444AFD(U)
|
:00444AC7 8B55F8                  mov edx, dword ptr [ebp-08]
:00444ACA 83C201                  add edx, 00000001
:00444ACD 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444AC5(U)
|
:00444AD0 837DF802                cmp dword ptr [ebp-08], 00000002
:00444AD4 7329                    jnb 00444AFF
:00444AD6 6A30                    push 00000030
:00444AD8 6A30                    push 00000030
:00444ADA 8B45F8                  mov eax, dword ptr [ebp-08]
:00444ADD C1E00E                  shl eax, 0E
:00444AE0 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00444AE3 03C8                    add ecx, eax
:00444AE5 51                      push ecx
:00444AE6 8B55F8                  mov edx, dword ptr [ebp-08]
:00444AE9 69D200090000            imul edx, 00000900
:00444AEF 8B45FC                  mov eax, dword ptr [ebp-04]
:00444AF2 03C2                    add eax, edx
:00444AF4 50                      push eax
:00444AF5 E87CBFFEFF              call 00430A76
:00444AFA 83C410                  add esp, 00000010
:00444AFD EBC8                    jmp 00444AC7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444AD4(C)
|
:00444AFF C745F800000000          mov [ebp-08], 00000000
:00444B06 EB09                    jmp 00444B11

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444BB4(U)
|
:00444B08 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00444B0B 83C101                  add ecx, 00000001
:00444B0E 894DF8                  mov dword ptr [ebp-08], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444B06(U)
|
:00444B11 837DF804                cmp dword ptr [ebp-08], 00000004
:00444B15 0F839E000000            jnb 00444BB9
:00444B1B 8B5508                  mov edx, dword ptr [ebp+08]
:00444B1E 8B4A04                  mov ecx, dword ptr [edx+04]
:00444B21 E84A69FFFF              call 0043B470
:00444B26 50                      push eax
:00444B27 E8A7A9FFFF              call 0043F4D3
:00444B2C 83C404                  add esp, 00000004
:00444B2F 8B4508                  mov eax, dword ptr [ebp+08]
:00444B32 33C9                    xor ecx, ecx
:00444B34 8A480E                  mov cl, byte ptr [eax+0E]
:00444B37 83F901                  cmp ecx, 00000001
:00444B3A 7511                    jne 00444B4D
:00444B3C 8B5508                  mov edx, dword ptr [ebp+08]
:00444B3F 8B4220                  mov eax, dword ptr [edx+20]
:00444B42 83C018                  add eax, 00000018
:00444B45 8B4D08                  mov ecx, dword ptr [ebp+08]
:00444B48 894120                  mov dword ptr [ecx+20], eax
:00444B4B EB0F                    jmp 00444B5C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444B3A(C)
|
:00444B4D 8B5508                  mov edx, dword ptr [ebp+08]
:00444B50 8B4220                  mov eax, dword ptr [edx+20]
:00444B53 83E818                  sub eax, 00000018
:00444B56 8B4D08                  mov ecx, dword ptr [ebp+08]
:00444B59 894120                  mov dword ptr [ecx+20], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444B4B(U)
|
:00444B5C E87A9AFDFF              call 0041E5DB
:00444B61 6A01                    push 00000001
:00444B63 8B550C                  mov edx, dword ptr [ebp+0C]
:00444B66 52                      push edx
:00444B67 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00444B6A E87EEFFFFF              call 00443AED
:00444B6F 8B4508                  mov eax, dword ptr [ebp+08]
:00444B72 50                      push eax
:00444B73 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00444B76 D1E9                    shr ecx, 1
:00444B78 C1E10E                  shl ecx, 0E
:00444B7B 8B55F4                  mov edx, dword ptr [ebp-0C]
:00444B7E 03D1                    add edx, ecx
:00444B80 52                      push edx
:00444B81 6A60                    push 00000060
:00444B83 6A60                    push 00000060
:00444B85 8B45F0                  mov eax, dword ptr [ebp-10]
:00444B88 8B8880000000            mov ecx, dword ptr [eax+00000080]
:00444B8E 51                      push ecx
:00444B8F 8B5508                  mov edx, dword ptr [ebp+08]
:00444B92 8B4220                  mov eax, dword ptr [edx+20]
:00444B95 50                      push eax
:00444B96 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00444B99 E87FF0FFFF              call 00443C1D
:00444B9E E8539AFDFF              call 0041E5F6
:00444BA3 6A01                    push 00000001
:00444BA5 B9181B4B00              mov ecx, 004B1B18
:00444BAA E891E7FBFF              call 00403340
:00444BAF E82C79FEFF              call 0042C4E0
:00444BB4 E94FFFFFFF              jmp 00444B08

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444B15(C)
|
:00444BB9 8BE5                    mov esp, ebp
:00444BBB 5D                      pop ebp
:00444BBC C20800                  ret 0008



* Referenced by a CALL at Address:
|:00448673   
|
:00444BBF 55                      push ebp
:00444BC0 8BEC                    mov ebp, esp
:00444BC2 83EC10                  sub esp, 00000010
:00444BC5 894DF0                  mov dword ptr [ebp-10], ecx
:00444BC8 6A04                    push 00000004
:00444BCA 6A00                    push 00000000
:00444BCC 6A00                    push 00000000
:00444BCE B9C8E44A00              mov ecx, 004AE4C8
:00444BD3 E868AE0300              call 0047FA40
:00444BD8 8945F4                  mov dword ptr [ebp-0C], eax
:00444BDB 6A04                    push 00000004
:00444BDD 6A00                    push 00000000
:00444BDF 8B4508                  mov eax, dword ptr [ebp+08]
:00444BE2 33C9                    xor ecx, ecx
:00444BE4 8A480D                  mov cl, byte ptr [eax+0D]
:00444BE7 69C900630000            imul ecx, 00006300
:00444BED 81C100510000            add ecx, 00005100
:00444BF3 51                      push ecx
:00444BF4 B980AB4A00              mov ecx, 004AAB80
:00444BF9 E842AE0300              call 0047FA40
:00444BFE 8945FC                  mov dword ptr [ebp-04], eax
:00444C01 C745F800000000          mov [ebp-08], 00000000
:00444C08 EB09                    jmp 00444C13

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444C40(U)
|
:00444C0A 8B55F8                  mov edx, dword ptr [ebp-08]
:00444C0D 83C201                  add edx, 00000001
:00444C10 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444C08(U)
|
:00444C13 837DF802                cmp dword ptr [ebp-08], 00000002
:00444C17 7329                    jnb 00444C42
:00444C19 6A30                    push 00000030
:00444C1B 6A30                    push 00000030
:00444C1D 8B45F8                  mov eax, dword ptr [ebp-08]
:00444C20 C1E00E                  shl eax, 0E
:00444C23 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00444C26 03C8                    add ecx, eax
:00444C28 51                      push ecx
:00444C29 8B55F8                  mov edx, dword ptr [ebp-08]
:00444C2C 69D200090000            imul edx, 00000900
:00444C32 8B45FC                  mov eax, dword ptr [ebp-04]
:00444C35 03C2                    add eax, edx
:00444C37 50                      push eax
:00444C38 E839BEFEFF              call 00430A76
:00444C3D 83C410                  add esp, 00000010
:00444C40 EBC8                    jmp 00444C0A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444C17(C)
|
:00444C42 6A01                    push 00000001
:00444C44 6A08                    push 00000008
:00444C46 B9B0694B00              mov ecx, 004B69B0
:00444C4B E82AFA0200              call 0047467A
:00444C50 C745F800000000          mov [ebp-08], 00000000
:00444C57 EB09                    jmp 00444C62

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444CC7(U)
|
:00444C59 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00444C5C 83C101                  add ecx, 00000001
:00444C5F 894DF8                  mov dword ptr [ebp-08], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444C57(U)
|
:00444C62 837DF806                cmp dword ptr [ebp-08], 00000006
:00444C66 7361                    jnb 00444CC9
:00444C68 E86E99FDFF              call 0041E5DB
:00444C6D 6A01                    push 00000001
:00444C6F 8B550C                  mov edx, dword ptr [ebp+0C]
:00444C72 52                      push edx
:00444C73 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00444C76 E872EEFFFF              call 00443AED
:00444C7B 8B4508                  mov eax, dword ptr [ebp+08]
:00444C7E 50                      push eax
:00444C7F 8B45F8                  mov eax, dword ptr [ebp-08]
:00444C82 33D2                    xor edx, edx
:00444C84 B902000000              mov ecx, 00000002
:00444C89 F7F1                    div ecx
:00444C8B C1E20E                  shl edx, 0E
:00444C8E 8B45F4                  mov eax, dword ptr [ebp-0C]
:00444C91 03C2                    add eax, edx
:00444C93 50                      push eax
:00444C94 6A60                    push 00000060
:00444C96 6A60                    push 00000060
:00444C98 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00444C9B 8B9180000000            mov edx, dword ptr [ecx+00000080]
:00444CA1 52                      push edx
:00444CA2 8B4508                  mov eax, dword ptr [ebp+08]
:00444CA5 8B4820                  mov ecx, dword ptr [eax+20]
:00444CA8 51                      push ecx
:00444CA9 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00444CAC E86CEFFFFF              call 00443C1D
:00444CB1 E84099FDFF              call 0041E5F6
:00444CB6 6A08                    push 00000008
:00444CB8 B9181B4B00              mov ecx, 004B1B18
:00444CBD E87EE6FBFF              call 00403340
:00444CC2 E81978FEFF              call 0042C4E0
:00444CC7 EB90                    jmp 00444C59

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444C66(C)
|
:00444CC9 8BE5                    mov esp, ebp
:00444CCB 5D                      pop ebp
:00444CCC C20800                  ret 0008



* Referenced by a CALL at Address:
|:00448598   
|
:00444CCF 55                      push ebp
:00444CD0 8BEC                    mov ebp, esp
:00444CD2 83EC0C                  sub esp, 0000000C
:00444CD5 894DF4                  mov dword ptr [ebp-0C], ecx
:00444CD8 8B4508                  mov eax, dword ptr [ebp+08]
:00444CDB 33C9                    xor ecx, ecx
:00444CDD 8A480E                  mov cl, byte ptr [eax+0E]
:00444CE0 83F901                  cmp ecx, 00000001
:00444CE3 7516                    jne 00444CFB
:00444CE5 8B5508                  mov edx, dword ptr [ebp+08]
:00444CE8 C6420E03                mov [edx+0E], 03
:00444CEC 6A00                    push 00000000
:00444CEE 8B4508                  mov eax, dword ptr [ebp+08]
:00444CF1 8B4804                  mov ecx, dword ptr [eax+04]
:00444CF4 E83BB0FFFF              call 0043FD34
:00444CF9 EB14                    jmp 00444D0F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444CE3(C)
|
:00444CFB 8B4D08                  mov ecx, dword ptr [ebp+08]
:00444CFE C6410E01                mov [ecx+0E], 01
:00444D02 6A01                    push 00000001
:00444D04 8B5508                  mov edx, dword ptr [ebp+08]
:00444D07 8B4A04                  mov ecx, dword ptr [edx+04]
:00444D0A E825B0FFFF              call 0043FD34

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444CF9(U)
|
:00444D0F 6A04                    push 00000004
:00444D11 6A00                    push 00000000
:00444D13 6A00                    push 00000000
:00444D15 B9C8E44A00              mov ecx, 004AE4C8
:00444D1A E821AD0300              call 0047FA40
:00444D1F 8945F8                  mov dword ptr [ebp-08], eax
:00444D22 6A04                    push 00000004
:00444D24 6A00                    push 00000000
:00444D26 8B4508                  mov eax, dword ptr [ebp+08]
:00444D29 33C9                    xor ecx, ecx
:00444D2B 8A480D                  mov cl, byte ptr [eax+0D]
:00444D2E 69C900630000            imul ecx, 00006300
:00444D34 81C100480000            add ecx, 00004800
:00444D3A 51                      push ecx
:00444D3B B980AB4A00              mov ecx, 004AAB80
:00444D40 E8FBAC0300              call 0047FA40
:00444D45 8945FC                  mov dword ptr [ebp-04], eax
:00444D48 6A30                    push 00000030
:00444D4A 6A30                    push 00000030
:00444D4C 8B55F8                  mov edx, dword ptr [ebp-08]
:00444D4F 52                      push edx
:00444D50 8B45FC                  mov eax, dword ptr [ebp-04]
:00444D53 50                      push eax
:00444D54 E81DBDFEFF              call 00430A76
:00444D59 83C410                  add esp, 00000010
:00444D5C 6A01                    push 00000001

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:00444D5E 6A06                    push 00000006
:00444D60 B9B0694B00              mov ecx, 004B69B0
:00444D65 E810F90200              call 0047467A
:00444D6A E86C98FDFF              call 0041E5DB
:00444D6F 6A01                    push 00000001
:00444D71 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00444D74 51                      push ecx
:00444D75 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00444D78 E870EDFFFF              call 00443AED
:00444D7D 8B5508                  mov edx, dword ptr [ebp+08]
:00444D80 52                      push edx
:00444D81 8B45F8                  mov eax, dword ptr [ebp-08]
:00444D84 50                      push eax
:00444D85 6A60                    push 00000060
:00444D87 6A60                    push 00000060
:00444D89 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00444D8C 8B9180000000            mov edx, dword ptr [ecx+00000080]
:00444D92 52                      push edx
:00444D93 8B4508                  mov eax, dword ptr [ebp+08]
:00444D96 8B4820                  mov ecx, dword ptr [eax+20]
:00444D99 51                      push ecx
:00444D9A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00444D9D E87BEEFFFF              call 00443C1D
:00444DA2 E84F98FDFF              call 0041E5F6
:00444DA7 8BE5                    mov esp, ebp
:00444DA9 5D                      pop ebp
:00444DAA C20800                  ret 0008



* Referenced by a CALL at Address:
|:004485D7   
|
:00444DAD 55                      push ebp
:00444DAE 8BEC                    mov ebp, esp
:00444DB0 83EC10                  sub esp, 00000010
:00444DB3 894DF0                  mov dword ptr [ebp-10], ecx
:00444DB6 6A04                    push 00000004
:00444DB8 6A00                    push 00000000
:00444DBA 6A00                    push 00000000
:00444DBC B9C8E44A00              mov ecx, 004AE4C8
:00444DC1 E87AAC0300              call 0047FA40
:00444DC6 8945F4                  mov dword ptr [ebp-0C], eax
:00444DC9 6A04                    push 00000004
:00444DCB 6A00                    push 00000000
:00444DCD 8B4508                  mov eax, dword ptr [ebp+08]
:00444DD0 33C9                    xor ecx, ecx
:00444DD2 8A480D                  mov cl, byte ptr [eax+0D]
:00444DD5 69C900630000            imul ecx, 00006300
:00444DDB 81C100240000            add ecx, 00002400
:00444DE1 51                      push ecx
:00444DE2 B980AB4A00              mov ecx, 004AAB80
:00444DE7 E854AC0300              call 0047FA40
:00444DEC 8945FC                  mov dword ptr [ebp-04], eax
:00444DEF C745F800000000          mov [ebp-08], 00000000
:00444DF6 EB09                    jmp 00444E01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444E2E(U)
|
:00444DF8 8B55F8                  mov edx, dword ptr [ebp-08]
:00444DFB 83C201                  add edx, 00000001
:00444DFE 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444DF6(U)
|
:00444E01 837DF802                cmp dword ptr [ebp-08], 00000002
:00444E05 7329                    jnb 00444E30
:00444E07 6A30                    push 00000030
:00444E09 6A30                    push 00000030
:00444E0B 8B45F8                  mov eax, dword ptr [ebp-08]
:00444E0E C1E00E                  shl eax, 0E
:00444E11 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00444E14 03C8                    add ecx, eax
:00444E16 51                      push ecx
:00444E17 8B55F8                  mov edx, dword ptr [ebp-08]
:00444E1A 69D200090000            imul edx, 00000900
:00444E20 8B45FC                  mov eax, dword ptr [ebp-04]
:00444E23 03C2                    add eax, edx
:00444E25 50                      push eax
:00444E26 E84BBCFEFF              call 00430A76
:00444E2B 83C410                  add esp, 00000010
:00444E2E EBC8                    jmp 00444DF8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444E05(C)
|
:00444E30 6A01                    push 00000001

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:00444E32 6A06                    push 00000006
:00444E34 B9B0694B00              mov ecx, 004B69B0
:00444E39 E83CF80200              call 0047467A
:00444E3E C745F800000000          mov [ebp-08], 00000000
:00444E45 EB09                    jmp 00444E50

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444EDF(U)
|
:00444E47 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00444E4A 83C101                  add ecx, 00000001
:00444E4D 894DF8                  mov dword ptr [ebp-08], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444E45(U)
|
:00444E50 837DF804                cmp dword ptr [ebp-08], 00000004
:00444E54 0F838A000000            jnb 00444EE4
:00444E5A 8B5508                  mov edx, dword ptr [ebp+08]
:00444E5D 33C0                    xor eax, eax
:00444E5F 8A420E                  mov al, byte ptr [edx+0E]
:00444E62 83F801                  cmp eax, 00000001
:00444E65 7511                    jne 00444E78
:00444E67 8B4D08                  mov ecx, dword ptr [ebp+08]
:00444E6A 8B5120                  mov edx, dword ptr [ecx+20]
:00444E6D 83EA08                  sub edx, 00000008
:00444E70 8B4508                  mov eax, dword ptr [ebp+08]
:00444E73 895020                  mov dword ptr [eax+20], edx
:00444E76 EB0F                    jmp 00444E87

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444E65(C)
|
:00444E78 8B4D08                  mov ecx, dword ptr [ebp+08]
:00444E7B 8B5120                  mov edx, dword ptr [ecx+20]
:00444E7E 83C208                  add edx, 00000008
:00444E81 8B4508                  mov eax, dword ptr [ebp+08]
:00444E84 895020                  mov dword ptr [eax+20], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444E76(U)
|
:00444E87 E84F97FDFF              call 0041E5DB
:00444E8C 6A01                    push 00000001
:00444E8E 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00444E91 51                      push ecx
:00444E92 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00444E95 E853ECFFFF              call 00443AED
:00444E9A 8B5508                  mov edx, dword ptr [ebp+08]
:00444E9D 52                      push edx
:00444E9E 8B45F8                  mov eax, dword ptr [ebp-08]
:00444EA1 D1E8                    shr eax, 1
:00444EA3 C1E00E                  shl eax, 0E
:00444EA6 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00444EA9 03C8                    add ecx, eax
:00444EAB 51                      push ecx
:00444EAC 6A60                    push 00000060
:00444EAE 6A60                    push 00000060
:00444EB0 8B55F0                  mov edx, dword ptr [ebp-10]
:00444EB3 8B8280000000            mov eax, dword ptr [edx+00000080]
:00444EB9 50                      push eax
:00444EBA 8B4D08                  mov ecx, dword ptr [ebp+08]
:00444EBD 8B5120                  mov edx, dword ptr [ecx+20]
:00444EC0 52                      push edx
:00444EC1 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00444EC4 E854EDFFFF              call 00443C1D
:00444EC9 E82897FDFF              call 0041E5F6
:00444ECE 6A01                    push 00000001
:00444ED0 B9181B4B00              mov ecx, 004B1B18
:00444ED5 E866E4FBFF              call 00403340
:00444EDA E80176FEFF              call 0042C4E0
:00444EDF E963FFFFFF              jmp 00444E47

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444E54(C)
|
:00444EE4 8BE5                    mov esp, ebp
:00444EE6 5D                      pop ebp
:00444EE7 C20800                  ret 0008



* Referenced by a CALL at Address:
|:00448697   
|
:00444EEA 55                      push ebp
:00444EEB 8BEC                    mov ebp, esp
:00444EED 6AFF                    push FFFFFFFF
:00444EEF 68F0544800              push 004854F0
:00444EF4 64A100000000            mov eax, dword ptr fs:[00000000]
:00444EFA 50                      push eax
:00444EFB 64892500000000          mov dword ptr fs:[00000000], esp
:00444F02 81EC1C010000            sub esp, 0000011C
:00444F08 898DD8FEFFFF            mov dword ptr [ebp+FFFFFED8], ecx
:00444F0E 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00444F14 E897E3FBFF              call 004032B0
:00444F19 C745FC00000000          mov [ebp-04], 00000000
:00444F20 8B4508                  mov eax, dword ptr [ebp+08]
:00444F23 33C9                    xor ecx, ecx
:00444F25 8A480D                  mov cl, byte ptr [eax+0D]
:00444F28 51                      push ecx
:00444F29 8B5508                  mov edx, dword ptr [ebp+08]
:00444F2C 8B4A04                  mov ecx, dword ptr [edx+04]
:00444F2F E814ADFFFF              call 0043FC48
:00444F34 8845F0                  mov byte ptr [ebp-10], al

* Possible StringData Ref from Data Obj ->"UNIT_SPC.E5"
                                  |
:00444F37 68D0BB4800              push 0048BBD0
:00444F3C 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00444F42 E8EEABFDFF              call 0041FB35
:00444F47 6A04                    push 00000004
:00444F49 6A00                    push 00000000
:00444F4B 6800780300              push 00037800
:00444F50 B9C8E44A00              mov ecx, 004AE4C8
:00444F55 E8E6AA0300              call 0047FA40
:00444F5A 50                      push eax
:00444F5B 8B45F0                  mov eax, dword ptr [ebp-10]
:00444F5E 25FF000000              and eax, 000000FF
:00444F63 50                      push eax
:00444F64 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00444F6A E81AADFDFF              call 0041FC89
:00444F6F 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00444F75 E84B43FDFF              call 004192C5
:00444F7A 6A04                    push 00000004
:00444F7C 6A00                    push 00000000
:00444F7E 6A00                    push 00000000
:00444F80 B9C8E44A00              mov ecx, 004AE4C8
:00444F85 E8B6AA0300              call 0047FA40
:00444F8A 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:00444F90 6A04                    push 00000004
:00444F92 6A00                    push 00000000
:00444F94 6800780300              push 00037800
:00444F99 B9C8E44A00              mov ecx, 004AE4C8
:00444F9E E89DAA0300              call 0047FA40
:00444FA3 8985E8FEFFFF            mov dword ptr [ebp+FFFFFEE8], eax
:00444FA9 6A04                    push 00000004
:00444FAB 6A00                    push 00000000
:00444FAD 6800380400              push 00043800
:00444FB2 B9C8E44A00              mov ecx, 004AE4C8
:00444FB7 E884AA0300              call 0047FA40
:00444FBC 8985DCFEFFFF            mov dword ptr [ebp+FFFFFEDC], eax
:00444FC2 6A15                    push 00000015
:00444FC4 B9B8694B00              mov ecx, 004B69B8
:00444FC9 E830F60200              call 004745FE
:00444FCE C785E4FEFFFF00000000    mov dword ptr [ebp+FFFFFEE4], 00000000
:00444FD8 EB0F                    jmp 00444FE9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044508B(U)
|
:00444FDA 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:00444FE0 83C101                  add ecx, 00000001
:00444FE3 898DE4FEFFFF            mov dword ptr [ebp+FFFFFEE4], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444FD8(U)
|
:00444FE9 83BDE4FEFFFF04          cmp dword ptr [ebp+FFFFFEE4], 00000004
:00444FF0 0F839A000000            jnb 00445090
:00444FF6 83BDE4FEFFFF03          cmp dword ptr [ebp+FFFFFEE4], 00000003
:00444FFD 7521                    jne 00445020
:00444FFF 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:00445005 52                      push edx
:00445006 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:0044500C 0500120000              add eax, 00001200
:00445011 50                      push eax
:00445012 6A30                    push 00000030
:00445014 6A30                    push 00000030
:00445016 E8389EFDFF              call 0041EE53
:0044501B 83C410                  add esp, 00000010
:0044501E EB46                    jmp 00445066

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444FFD(C)
|
:00445020 83BDE4FEFFFF02          cmp dword ptr [ebp+FFFFFEE4], 00000002
:00445027 7514                    jne 0044503D
:00445029 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:0044502F 81C100090000            add ecx, 00000900
:00445035 898DDCFEFFFF            mov dword ptr [ebp+FFFFFEDC], ecx
:0044503B EB29                    jmp 00445066

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445027(C)
|
:0044503D 83BDE4FEFFFF01          cmp dword ptr [ebp+FFFFFEE4], 00000001
:00445044 7514                    jne 0044505A
:00445046 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:0044504C 81C200120000            add edx, 00001200
:00445052 8995DCFEFFFF            mov dword ptr [ebp+FFFFFEDC], edx
:00445058 EB0C                    jmp 00445066

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445044(C)
|
:0044505A 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:00445060 8985DCFEFFFF            mov dword ptr [ebp+FFFFFEDC], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044501E(U), :0044503B(U), :00445058(U)
|
:00445066 6A30                    push 00000030
:00445068 6A30                    push 00000030
:0044506A 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:00445070 C1E10E                  shl ecx, 0E
:00445073 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:00445079 03D1                    add edx, ecx
:0044507B 52                      push edx
:0044507C 8B85DCFEFFFF            mov eax, dword ptr [ebp+FFFFFEDC]
:00445082 50                      push eax
:00445083 E8EEB9FEFF              call 00430A76
:00445088 83C410                  add esp, 00000010
:0044508B E94AFFFFFF              jmp 00444FDA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444FF0(C)
|
:00445090 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00445096 81C100240000            add ecx, 00002400
:0044509C 898DDCFEFFFF            mov dword ptr [ebp+FFFFFEDC], ecx
:004450A2 6A30                    push 00000030
:004450A4 6A30                    push 00000030
:004450A6 8B95E4FEFFFF            mov edx, dword ptr [ebp+FFFFFEE4]
:004450AC C1E20E                  shl edx, 0E
:004450AF 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:004450B5 03C2                    add eax, edx
:004450B7 50                      push eax
:004450B8 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:004450BE 51                      push ecx
:004450BF E8B2B9FEFF              call 00430A76
:004450C4 83C410                  add esp, 00000010
:004450C7 C785E4FEFFFF00000000    mov dword ptr [ebp+FFFFFEE4], 00000000
:004450D1 EB0F                    jmp 004450E2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445159(U)
|
:004450D3 8B95E4FEFFFF            mov edx, dword ptr [ebp+FFFFFEE4]
:004450D9 83C201                  add edx, 00000001
:004450DC 8995E4FEFFFF            mov dword ptr [ebp+FFFFFEE4], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004450D1(U)
|
:004450E2 83BDE4FEFFFF10          cmp dword ptr [ebp+FFFFFEE4], 00000010
:004450E9 7773                    ja 0044515E
:004450EB E8EB94FDFF              call 0041E5DB
:004450F0 6A01                    push 00000001
:004450F2 8B450C                  mov eax, dword ptr [ebp+0C]
:004450F5 50                      push eax
:004450F6 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:004450FC E8ECE9FFFF              call 00443AED
:00445101 8B4D08                  mov ecx, dword ptr [ebp+08]
:00445104 51                      push ecx
:00445105 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:0044510B 33D2                    xor edx, edx
:0044510D B904000000              mov ecx, 00000004
:00445112 F7F1                    div ecx
:00445114 C1E20E                  shl edx, 0E
:00445117 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:0044511D 03C2                    add eax, edx
:0044511F 50                      push eax
:00445120 6A60                    push 00000060
:00445122 6A60                    push 00000060
:00445124 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:0044512A 8B9180000000            mov edx, dword ptr [ecx+00000080]
:00445130 52                      push edx
:00445131 8B4508                  mov eax, dword ptr [ebp+08]
:00445134 8B4820                  mov ecx, dword ptr [eax+20]
:00445137 51                      push ecx
:00445138 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:0044513E E8DAEAFFFF              call 00443C1D
:00445143 E8AE94FDFF              call 0041E5F6
:00445148 6A04                    push 00000004
:0044514A B9181B4B00              mov ecx, 004B1B18
:0044514F E8ECE1FBFF              call 00403340
:00445154 E88773FEFF              call 0042C4E0
:00445159 E975FFFFFF              jmp 004450D3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004450E9(C)
|
:0044515E 6A04                    push 00000004
:00445160 B9181B4B00              mov ecx, 004B1B18
:00445165 E8D6E1FBFF              call 00403340
:0044516A E87173FEFF              call 0042C4E0
:0044516F E86794FDFF              call 0041E5DB
:00445174 6A01                    push 00000001
:00445176 8B550C                  mov edx, dword ptr [ebp+0C]
:00445179 52                      push edx
:0044517A 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:00445180 E868E9FFFF              call 00443AED
:00445185 8B4508                  mov eax, dword ptr [ebp+08]
:00445188 50                      push eax
:00445189 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:0044518F 81C100000100            add ecx, 00010000
:00445195 51                      push ecx
:00445196 6A60                    push 00000060
:00445198 6A60                    push 00000060
:0044519A 8B95D8FEFFFF            mov edx, dword ptr [ebp+FFFFFED8]
:004451A0 8B8280000000            mov eax, dword ptr [edx+00000080]
:004451A6 50                      push eax
:004451A7 8B4D08                  mov ecx, dword ptr [ebp+08]
:004451AA 8B5120                  mov edx, dword ptr [ecx+20]
:004451AD 52                      push edx
:004451AE 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:004451B4 E864EAFFFF              call 00443C1D
:004451B9 E83894FDFF              call 0041E5F6
:004451BE 6A28                    push 00000028
:004451C0 B9181B4B00              mov ecx, 004B1B18
:004451C5 E876E1FBFF              call 00403340
:004451CA E81173FEFF              call 0042C4E0
:004451CF C785E4FEFFFF00000000    mov dword ptr [ebp+FFFFFEE4], 00000000
:004451D9 EB0F                    jmp 004451EA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445274(U)
|
:004451DB 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:004451E1 83C001                  add eax, 00000001
:004451E4 8985E4FEFFFF            mov dword ptr [ebp+FFFFFEE4], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004451D9(U)
|
:004451EA 83BDE4FEFFFF08          cmp dword ptr [ebp+FFFFFEE4], 00000008
:004451F1 0F8782000000            ja 00445279
:004451F7 8B4D08                  mov ecx, dword ptr [ebp+08]
:004451FA 8B5120                  mov edx, dword ptr [ecx+20]
:004451FD 83EA08                  sub edx, 00000008
:00445200 8B4508                  mov eax, dword ptr [ebp+08]
:00445203 895020                  mov dword ptr [eax+20], edx
:00445206 E8D093FDFF              call 0041E5DB
:0044520B 6A01                    push 00000001
:0044520D 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00445210 51                      push ecx
:00445211 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:00445217 E8D1E8FFFF              call 00443AED
:0044521C 8B5508                  mov edx, dword ptr [ebp+08]
:0044521F 52                      push edx
:00445220 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:00445226 33D2                    xor edx, edx
:00445228 B904000000              mov ecx, 00000004
:0044522D F7F1                    div ecx
:0044522F C1E20E                  shl edx, 0E
:00445232 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:00445238 03C2                    add eax, edx
:0044523A 50                      push eax
:0044523B 6A60                    push 00000060
:0044523D 6A60                    push 00000060
:0044523F 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:00445245 8B9180000000            mov edx, dword ptr [ecx+00000080]
:0044524B 52                      push edx
:0044524C 8B4508                  mov eax, dword ptr [ebp+08]
:0044524F 8B4820                  mov ecx, dword ptr [eax+20]
:00445252 51                      push ecx
:00445253 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:00445259 E8BFE9FFFF              call 00443C1D
:0044525E E89393FDFF              call 0041E5F6
:00445263 6A04                    push 00000004
:00445265 B9181B4B00              mov ecx, 004B1B18
:0044526A E8D1E0FBFF              call 00403340
:0044526F E86C72FEFF              call 0042C4E0
:00445274 E962FFFFFF              jmp 004451DB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004451F1(C)
|
:00445279 6A04                    push 00000004
:0044527B B9181B4B00              mov ecx, 004B1B18
:00445280 E8BBE0FBFF              call 00403340
:00445285 E85672FEFF              call 0042C4E0
:0044528A E84C93FDFF              call 0041E5DB
:0044528F 6A01                    push 00000001
:00445291 8B550C                  mov edx, dword ptr [ebp+0C]
:00445294 52                      push edx
:00445295 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:0044529B E84DE8FFFF              call 00443AED
:004452A0 8B4508                  mov eax, dword ptr [ebp+08]
:004452A3 50                      push eax
:004452A4 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:004452AA 81C100000100            add ecx, 00010000
:004452B0 51                      push ecx
:004452B1 6A60                    push 00000060
:004452B3 6A60                    push 00000060
:004452B5 8B95D8FEFFFF            mov edx, dword ptr [ebp+FFFFFED8]
:004452BB 8B8280000000            mov eax, dword ptr [edx+00000080]
:004452C1 50                      push eax
:004452C2 8B4D08                  mov ecx, dword ptr [ebp+08]
:004452C5 8B5120                  mov edx, dword ptr [ecx+20]
:004452C8 52                      push edx
:004452C9 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:004452CF E849E9FFFF              call 00443C1D
:004452D4 E81D93FDFF              call 0041E5F6
:004452D9 6A14                    push 00000014
:004452DB B9181B4B00              mov ecx, 004B1B18
:004452E0 E85BE0FBFF              call 00403340
:004452E5 E8F671FEFF              call 0042C4E0
:004452EA C785E4FEFFFF00000000    mov dword ptr [ebp+FFFFFEE4], 00000000
:004452F4 EB0F                    jmp 00445305

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044538F(U)
|
:004452F6 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:004452FC 83C001                  add eax, 00000001
:004452FF 8985E4FEFFFF            mov dword ptr [ebp+FFFFFEE4], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004452F4(U)
|
:00445305 83BDE4FEFFFF08          cmp dword ptr [ebp+FFFFFEE4], 00000008
:0044530C 0F8782000000            ja 00445394
:00445312 8B4D08                  mov ecx, dword ptr [ebp+08]
:00445315 8B5120                  mov edx, dword ptr [ecx+20]
:00445318 83C208                  add edx, 00000008
:0044531B 8B4508                  mov eax, dword ptr [ebp+08]
:0044531E 895020                  mov dword ptr [eax+20], edx
:00445321 E8B592FDFF              call 0041E5DB
:00445326 6A01                    push 00000001
:00445328 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0044532B 51                      push ecx
:0044532C 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:00445332 E8B6E7FFFF              call 00443AED
:00445337 8B5508                  mov edx, dword ptr [ebp+08]
:0044533A 52                      push edx
:0044533B 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:00445341 33D2                    xor edx, edx
:00445343 B904000000              mov ecx, 00000004
:00445348 F7F1                    div ecx
:0044534A C1E20E                  shl edx, 0E
:0044534D 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:00445353 03C2                    add eax, edx
:00445355 50                      push eax
:00445356 6A60                    push 00000060
:00445358 6A60                    push 00000060
:0044535A 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:00445360 8B9180000000            mov edx, dword ptr [ecx+00000080]
:00445366 52                      push edx
:00445367 8B4508                  mov eax, dword ptr [ebp+08]
:0044536A 8B4820                  mov ecx, dword ptr [eax+20]
:0044536D 51                      push ecx
:0044536E 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:00445374 E8A4E8FFFF              call 00443C1D
:00445379 E87892FDFF              call 0041E5F6
:0044537E 6A04                    push 00000004
:00445380 B9181B4B00              mov ecx, 004B1B18
:00445385 E8B6DFFBFF              call 00403340
:0044538A E85171FEFF              call 0042C4E0
:0044538F E962FFFFFF              jmp 004452F6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044530C(C)
|
:00445394 6A04                    push 00000004
:00445396 B9181B4B00              mov ecx, 004B1B18
:0044539B E8A0DFFBFF              call 00403340
:004453A0 E83B71FEFF              call 0042C4E0
:004453A5 E83192FDFF              call 0041E5DB
:004453AA 6A01                    push 00000001
:004453AC 8B550C                  mov edx, dword ptr [ebp+0C]
:004453AF 52                      push edx
:004453B0 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:004453B6 E832E7FFFF              call 00443AED
:004453BB 8B4508                  mov eax, dword ptr [ebp+08]
:004453BE 50                      push eax
:004453BF 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:004453C5 81C100000100            add ecx, 00010000
:004453CB 51                      push ecx
:004453CC 6A60                    push 00000060
:004453CE 6A60                    push 00000060
:004453D0 8B95D8FEFFFF            mov edx, dword ptr [ebp+FFFFFED8]
:004453D6 8B8280000000            mov eax, dword ptr [edx+00000080]
:004453DC 50                      push eax
:004453DD 8B4D08                  mov ecx, dword ptr [ebp+08]
:004453E0 8B5120                  mov edx, dword ptr [ecx+20]
:004453E3 52                      push edx
:004453E4 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:004453EA E82EE8FFFF              call 00443C1D
:004453EF E80292FDFF              call 0041E5F6
:004453F4 6A28                    push 00000028
:004453F6 B9181B4B00              mov ecx, 004B1B18
:004453FB E840DFFBFF              call 00403340
:00445400 E8DB70FEFF              call 0042C4E0
:00445405 6A04                    push 00000004
:00445407 6A00                    push 00000000
:00445409 8B4508                  mov eax, dword ptr [ebp+08]
:0044540C 33C9                    xor ecx, ecx
:0044540E 8A480D                  mov cl, byte ptr [eax+0D]
:00445411 69C900630000            imul ecx, 00006300
:00445417 51                      push ecx
:00445418 B980AB4A00              mov ecx, 004AAB80
:0044541D E81EA60300              call 0047FA40
:00445422 8985E8FEFFFF            mov dword ptr [ebp+FFFFFEE8], eax
:00445428 C785E4FEFFFF00000000    mov dword ptr [ebp+FFFFFEE4], 00000000
:00445432 EB0F                    jmp 00445443

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004454B7(U)
|
:00445434 8B95E4FEFFFF            mov edx, dword ptr [ebp+FFFFFEE4]
:0044543A 83C201                  add edx, 00000001
:0044543D 8995E4FEFFFF            mov dword ptr [ebp+FFFFFEE4], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445432(U)
|
:00445443 83BDE4FEFFFF03          cmp dword ptr [ebp+FFFFFEE4], 00000003
:0044544A 7370                    jnb 004454BC
:0044544C 83BDE4FEFFFF02          cmp dword ptr [ebp+FFFFFEE4], 00000002
:00445453 7338                    jnb 0044548D
:00445455 6A30                    push 00000030
:00445457 6A30                    push 00000030
:00445459 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:0044545F C1E00E                  shl eax, 0E
:00445462 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:00445468 03C8                    add ecx, eax
:0044546A 51                      push ecx
:0044546B 8B95E4FEFFFF            mov edx, dword ptr [ebp+FFFFFEE4]
:00445471 83C204                  add edx, 00000004
:00445474 69D200090000            imul edx, 00000900
:0044547A 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:00445480 03C2                    add eax, edx
:00445482 50                      push eax
:00445483 E8EEB5FEFF              call 00430A76
:00445488 83C410                  add esp, 00000010
:0044548B EB2A                    jmp 004454B7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445453(C)
|
:0044548D 6A30                    push 00000030
:0044548F 6A30                    push 00000030
:00445491 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:00445497 C1E10E                  shl ecx, 0E
:0044549A 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:004454A0 03D1                    add edx, ecx
:004454A2 52                      push edx
:004454A3 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:004454A9 0500510000              add eax, 00005100
:004454AE 50                      push eax
:004454AF E8C2B5FEFF              call 00430A76
:004454B4 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044548B(U)
|
:004454B7 E978FFFFFF              jmp 00445434

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044544A(C)
|
:004454BC C785E4FEFFFF00000000    mov dword ptr [ebp+FFFFFEE4], 00000000
:004454C6 EB0F                    jmp 004454D7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445561(U)
|
:004454C8 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:004454CE 83C101                  add ecx, 00000001
:004454D1 898DE4FEFFFF            mov dword ptr [ebp+FFFFFEE4], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004454C6(U)
|
:004454D7 83BDE4FEFFFF08          cmp dword ptr [ebp+FFFFFEE4], 00000008
:004454DE 0F8382000000            jnb 00445566
:004454E4 8B5508                  mov edx, dword ptr [ebp+08]
:004454E7 8B4220                  mov eax, dword ptr [edx+20]
:004454EA 83C010                  add eax, 00000010
:004454ED 8B4D08                  mov ecx, dword ptr [ebp+08]
:004454F0 894120                  mov dword ptr [ecx+20], eax
:004454F3 E8E390FDFF              call 0041E5DB
:004454F8 6A01                    push 00000001
:004454FA 8B550C                  mov edx, dword ptr [ebp+0C]
:004454FD 52                      push edx
:004454FE 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:00445504 E8E4E5FFFF              call 00443AED
:00445509 8B4508                  mov eax, dword ptr [ebp+08]
:0044550C 50                      push eax
:0044550D 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:00445513 33D2                    xor edx, edx
:00445515 B902000000              mov ecx, 00000002
:0044551A F7F1                    div ecx
:0044551C C1E20E                  shl edx, 0E
:0044551F 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:00445525 03C2                    add eax, edx
:00445527 50                      push eax
:00445528 6A60                    push 00000060
:0044552A 6A60                    push 00000060
:0044552C 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:00445532 8B9180000000            mov edx, dword ptr [ecx+00000080]
:00445538 52                      push edx
:00445539 8B4508                  mov eax, dword ptr [ebp+08]
:0044553C 8B4820                  mov ecx, dword ptr [eax+20]
:0044553F 51                      push ecx
:00445540 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:00445546 E8D2E6FFFF              call 00443C1D
:0044554B E8A690FDFF              call 0041E5F6
:00445550 6A02                    push 00000002
:00445552 B9181B4B00              mov ecx, 004B1B18
:00445557 E8E4DDFBFF              call 00403340
:0044555C E87F6FFEFF              call 0042C4E0
:00445561 E962FFFFFF              jmp 004454C8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004454DE(C)
|
:00445566 E87090FDFF              call 0041E5DB
:0044556B 6A01                    push 00000001
:0044556D 8B550C                  mov edx, dword ptr [ebp+0C]
:00445570 52                      push edx
:00445571 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:00445577 E871E5FFFF              call 00443AED
:0044557C 8B4508                  mov eax, dword ptr [ebp+08]
:0044557F 50                      push eax
:00445580 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:00445586 81C100800000            add ecx, 00008000
:0044558C 51                      push ecx
:0044558D 6A60                    push 00000060
:0044558F 6A60                    push 00000060
:00445591 8B95D8FEFFFF            mov edx, dword ptr [ebp+FFFFFED8]
:00445597 8B8280000000            mov eax, dword ptr [edx+00000080]
:0044559D 50                      push eax
:0044559E 8B4D08                  mov ecx, dword ptr [ebp+08]
:004455A1 8B5120                  mov edx, dword ptr [ecx+20]
:004455A4 52                      push edx
:004455A5 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:004455AB E86DE6FFFF              call 00443C1D
:004455B0 E84190FDFF              call 0041E5F6
:004455B5 6A28                    push 00000028
:004455B7 B9181B4B00              mov ecx, 004B1B18
:004455BC E87FDDFBFF              call 00403340
:004455C1 E81A6FFEFF              call 0042C4E0
:004455C6 C785E4FEFFFF00000000    mov dword ptr [ebp+FFFFFEE4], 00000000
:004455D0 EB0F                    jmp 004455E1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445658(U)
|
:004455D2 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:004455D8 83C001                  add eax, 00000001
:004455DB 8985E4FEFFFF            mov dword ptr [ebp+FFFFFEE4], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004455D0(U)
|
:004455E1 83BDE4FEFFFF04          cmp dword ptr [ebp+FFFFFEE4], 00000004
:004455E8 7373                    jnb 0044565D
:004455EA 8B4D08                  mov ecx, dword ptr [ebp+08]
:004455ED 8B5120                  mov edx, dword ptr [ecx+20]
:004455F0 83EA08                  sub edx, 00000008
:004455F3 8B4508                  mov eax, dword ptr [ebp+08]
:004455F6 895020                  mov dword ptr [eax+20], edx
:004455F9 E8DD8FFDFF              call 0041E5DB
:004455FE 6A01                    push 00000001
:00445600 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00445603 51                      push ecx
:00445604 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:0044560A E8DEE4FFFF              call 00443AED
:0044560F 8B5508                  mov edx, dword ptr [ebp+08]
:00445612 52                      push edx
:00445613 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:00445619 0500800000              add eax, 00008000
:0044561E 50                      push eax
:0044561F 6A60                    push 00000060
:00445621 6A60                    push 00000060
:00445623 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:00445629 8B9180000000            mov edx, dword ptr [ecx+00000080]
:0044562F 52                      push edx
:00445630 8B4508                  mov eax, dword ptr [ebp+08]
:00445633 8B4820                  mov ecx, dword ptr [eax+20]
:00445636 51                      push ecx
:00445637 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:0044563D E8DBE5FFFF              call 00443C1D
:00445642 E8AF8FFDFF              call 0041E5F6
:00445647 6A08                    push 00000008
:00445649 B9181B4B00              mov ecx, 004B1B18
:0044564E E8EDDCFBFF              call 00403340
:00445653 E8886EFEFF              call 0042C4E0
:00445658 E975FFFFFF              jmp 004455D2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004455E8(C)
|
:0044565D 6A28                    push 00000028
:0044565F B9181B4B00              mov ecx, 004B1B18
:00445664 E8D7DCFBFF              call 00403340
:00445669 E8726EFEFF              call 0042C4E0

* Possible StringData Ref from Data Obj ->"UNIT_ATK.E5"
                                  |
:0044566E 68C0BB4800              push 0048BBC0
:00445673 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00445679 E8B7A4FDFF              call 0041FB35
:0044567E 6A04                    push 00000004
:00445680 6A00                    push 00000000
:00445682 6800780300              push 00037800
:00445687 B9C8E44A00              mov ecx, 004AE4C8
:0044568C E8AFA30300              call 0047FA40
:00445691 50                      push eax
:00445692 8B55F0                  mov edx, dword ptr [ebp-10]
:00445695 81E2FF000000            and edx, 000000FF
:0044569B 52                      push edx
:0044569C 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:004456A2 E8E2A5FDFF              call 0041FC89
:004456A7 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:004456AD E8133CFDFF              call 004192C5
:004456B2 6A04                    push 00000004
:004456B4 6A00                    push 00000000
:004456B6 6800780300              push 00037800
:004456BB B9C8E44A00              mov ecx, 004AE4C8
:004456C0 E87BA30300              call 0047FA40
:004456C5 8985E8FEFFFF            mov dword ptr [ebp+FFFFFEE8], eax
:004456CB C785E4FEFFFF00000000    mov dword ptr [ebp+FFFFFEE4], 00000000
:004456D5 EB0F                    jmp 004456E6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044578E(U)
|
:004456D7 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:004456DD 83C001                  add eax, 00000001
:004456E0 8985E4FEFFFF            mov dword ptr [ebp+FFFFFEE4], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004456D5(U)
|
:004456E6 83BDE4FEFFFF04          cmp dword ptr [ebp+FFFFFEE4], 00000004
:004456ED 0F83A0000000            jnb 00445793
:004456F3 83BDE4FEFFFF03          cmp dword ptr [ebp+FFFFFEE4], 00000003
:004456FA 7522                    jne 0044571E
:004456FC 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:00445702 51                      push ecx
:00445703 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:00445709 81C200B00000            add edx, 0000B000
:0044570F 52                      push edx
:00445710 6A40                    push 00000040
:00445712 6A40                    push 00000040
:00445714 E83A97FDFF              call 0041EE53
:00445719 83C410                  add esp, 00000010
:0044571C EB4B                    jmp 00445769

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004456FA(C)
|
:0044571E 83BDE4FEFFFF02          cmp dword ptr [ebp+FFFFFEE4], 00000002
:00445725 7513                    jne 0044573A
:00445727 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:0044572D 0500700000              add eax, 00007000
:00445732 8985DCFEFFFF            mov dword ptr [ebp+FFFFFEDC], eax
:00445738 EB2F                    jmp 00445769

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445725(C)
|
:0044573A 83BDE4FEFFFF01          cmp dword ptr [ebp+FFFFFEE4], 00000001
:00445741 7514                    jne 00445757
:00445743 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00445749 81C100B00000            add ecx, 0000B000
:0044574F 898DDCFEFFFF            mov dword ptr [ebp+FFFFFEDC], ecx
:00445755 EB12                    jmp 00445769

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445741(C)
|
:00445757 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:0044575D 81C200300000            add edx, 00003000
:00445763 8995DCFEFFFF            mov dword ptr [ebp+FFFFFEDC], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044571C(U), :00445738(U), :00445755(U)
|
:00445769 6A40                    push 00000040
:0044576B 6A40                    push 00000040
:0044576D 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:00445773 C1E00E                  shl eax, 0E
:00445776 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:0044577C 03C8                    add ecx, eax
:0044577E 51                      push ecx
:0044577F 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:00445785 52                      push edx
:00445786 E8EBB2FEFF              call 00430A76
:0044578B 83C410                  add esp, 00000010
:0044578E E944FFFFFF              jmp 004456D7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004456ED(C)
|
:00445793 C785E4FEFFFF00000000    mov dword ptr [ebp+FFFFFEE4], 00000000
:0044579D EB0F                    jmp 004457AE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445844(U)
|
:0044579F 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:004457A5 83C001                  add eax, 00000001
:004457A8 8985E4FEFFFF            mov dword ptr [ebp+FFFFFEE4], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044579D(U)
|
:004457AE 83BDE4FEFFFF14          cmp dword ptr [ebp+FFFFFEE4], 00000014
:004457B5 0F838E000000            jnb 00445849
:004457BB 8B4D08                  mov ecx, dword ptr [ebp+08]
:004457BE 8B5120                  mov edx, dword ptr [ecx+20]
:004457C1 83EA04                  sub edx, 00000004
:004457C4 8B4508                  mov eax, dword ptr [ebp+08]
:004457C7 895020                  mov dword ptr [eax+20], edx
:004457CA E80C8EFDFF              call 0041E5DB
:004457CF 6A01                    push 00000001
:004457D1 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004457D4 51                      push ecx
:004457D5 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:004457DB E80DE3FFFF              call 00443AED
:004457E0 8B5508                  mov edx, dword ptr [ebp+08]
:004457E3 52                      push edx
:004457E4 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:004457EA 33D2                    xor edx, edx
:004457EC B904000000              mov ecx, 00000004
:004457F1 F7F1                    div ecx
:004457F3 C1E20E                  shl edx, 0E
:004457F6 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:004457FC 03C2                    add eax, edx
:004457FE 50                      push eax
:004457FF 6880000000              push 00000080
:00445804 6880000000              push 00000080
:00445809 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:0044580F 8B9180000000            mov edx, dword ptr [ecx+00000080]
:00445815 83EA10                  sub edx, 00000010
:00445818 52                      push edx
:00445819 8B4508                  mov eax, dword ptr [ebp+08]
:0044581C 8B4820                  mov ecx, dword ptr [eax+20]
:0044581F 83E910                  sub ecx, 00000010
:00445822 51                      push ecx
:00445823 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:00445829 E8EFE3FFFF              call 00443C1D
:0044582E E8C38DFDFF              call 0041E5F6
:00445833 6A02                    push 00000002
:00445835 B9181B4B00              mov ecx, 004B1B18
:0044583A E801DBFBFF              call 00403340
:0044583F E89C6CFEFF              call 0042C4E0
:00445844 E956FFFFFF              jmp 0044579F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004457B5(C)
|
:00445849 6A28                    push 00000028
:0044584B B9181B4B00              mov ecx, 004B1B18
:00445850 E8EBDAFBFF              call 00403340
:00445855 E8866CFEFF              call 0042C4E0
:0044585A C785E4FEFFFF00000000    mov dword ptr [ebp+FFFFFEE4], 00000000
:00445864 EB0F                    jmp 00445875

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044590B(U)
|
:00445866 8B95E4FEFFFF            mov edx, dword ptr [ebp+FFFFFEE4]
:0044586C 83C201                  add edx, 00000001
:0044586F 8995E4FEFFFF            mov dword ptr [ebp+FFFFFEE4], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445864(U)
|
:00445875 83BDE4FEFFFF12          cmp dword ptr [ebp+FFFFFEE4], 00000012
:0044587C 0F838E000000            jnb 00445910
:00445882 8B4508                  mov eax, dword ptr [ebp+08]
:00445885 8B4820                  mov ecx, dword ptr [eax+20]
:00445888 83C104                  add ecx, 00000004
:0044588B 8B5508                  mov edx, dword ptr [ebp+08]
:0044588E 894A20                  mov dword ptr [edx+20], ecx
:00445891 E8458DFDFF              call 0041E5DB
:00445896 6A01                    push 00000001
:00445898 8B450C                  mov eax, dword ptr [ebp+0C]
:0044589B 50                      push eax
:0044589C 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:004458A2 E846E2FFFF              call 00443AED
:004458A7 8B4D08                  mov ecx, dword ptr [ebp+08]
:004458AA 51                      push ecx
:004458AB 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:004458B1 33D2                    xor edx, edx
:004458B3 B904000000              mov ecx, 00000004
:004458B8 F7F1                    div ecx
:004458BA C1E20E                  shl edx, 0E
:004458BD 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:004458C3 03C2                    add eax, edx
:004458C5 50                      push eax
:004458C6 6880000000              push 00000080
:004458CB 6880000000              push 00000080
:004458D0 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:004458D6 8B9180000000            mov edx, dword ptr [ecx+00000080]
:004458DC 83EA10                  sub edx, 00000010
:004458DF 52                      push edx
:004458E0 8B4508                  mov eax, dword ptr [ebp+08]
:004458E3 8B4820                  mov ecx, dword ptr [eax+20]
:004458E6 83E910                  sub ecx, 00000010
:004458E9 51                      push ecx
:004458EA 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:004458F0 E828E3FFFF              call 00443C1D
:004458F5 E8FC8CFDFF              call 0041E5F6
:004458FA 6A02                    push 00000002
:004458FC B9181B4B00              mov ecx, 004B1B18
:00445901 E83ADAFBFF              call 00403340
:00445906 E8D56BFEFF              call 0042C4E0
:0044590B E956FFFFFF              jmp 00445866

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044587C(C)
|
:00445910 6A28                    push 00000028
:00445912 B9181B4B00              mov ecx, 004B1B18
:00445917 E824DAFBFF              call 00403340
:0044591C E8BF6BFEFF              call 0042C4E0
:00445921 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00445928 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0044592E E89DD9FBFF              call 004032D0
:00445933 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00445936 64890D00000000          mov dword ptr fs:[00000000], ecx
:0044593D 8BE5                    mov esp, ebp
:0044593F 5D                      pop ebp
:00445940 C20800                  ret 0008



* Referenced by a CALL at Address:
|:004486A9   
|
:00445943 55                      push ebp
:00445944 8BEC                    mov ebp, esp
:00445946 83EC20                  sub esp, 00000020
:00445949 894DE8                  mov dword ptr [ebp-18], ecx
:0044594C 6A14                    push 00000014
:0044594E B9B8694B00              mov ecx, 004B69B8
:00445953 E8A6EC0200              call 004745FE
:00445958 6A04                    push 00000004
:0044595A 6A00                    push 00000000
:0044595C 6A00                    push 00000000
:0044595E B9C8E44A00              mov ecx, 004AE4C8
:00445963 E8D8A00300              call 0047FA40
:00445968 8945F0                  mov dword ptr [ebp-10], eax
:0044596B 8B45F0                  mov eax, dword ptr [ebp-10]
:0044596E 0500800000              add eax, 00008000
:00445973 8945EC                  mov dword ptr [ebp-14], eax
:00445976 6A04                    push 00000004
:00445978 6A00                    push 00000000
:0044597A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044597D 33D2                    xor edx, edx
:0044597F 8A510D                  mov dl, byte ptr [ecx+0D]
:00445982 69D200630000            imul edx, 00006300
:00445988 52                      push edx
:00445989 B980AB4A00              mov ecx, 004AAB80
:0044598E E8ADA00300              call 0047FA40
:00445993 8945FC                  mov dword ptr [ebp-04], eax
:00445996 C745F800000000          mov [ebp-08], 00000000
:0044599D EB09                    jmp 004459A8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004459D5(U)
|
:0044599F 8B45F8                  mov eax, dword ptr [ebp-08]
:004459A2 83C001                  add eax, 00000001
:004459A5 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044599D(U)
|
:004459A8 837DF804                cmp dword ptr [ebp-08], 00000004
:004459AC 7329                    jnb 004459D7
:004459AE 6A30                    push 00000030
:004459B0 6A30                    push 00000030
:004459B2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004459B5 C1E10E                  shl ecx, 0E
:004459B8 8B55F0                  mov edx, dword ptr [ebp-10]
:004459BB 03D1                    add edx, ecx
:004459BD 52                      push edx
:004459BE 8B45F8                  mov eax, dword ptr [ebp-08]
:004459C1 69C000090000            imul eax, 00000900
:004459C7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004459CA 03C8                    add ecx, eax
:004459CC 51                      push ecx
:004459CD E8A4B0FEFF              call 00430A76
:004459D2 83C410                  add esp, 00000010
:004459D5 EBC8                    jmp 0044599F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004459AC(C)
|
:004459D7 6A14                    push 00000014
:004459D9 B9181B4B00              mov ecx, 004B1B18
:004459DE E85DD9FBFF              call 00403340
:004459E3 E8F86AFEFF              call 0042C4E0
:004459E8 C745F800000000          mov [ebp-08], 00000000
:004459EF EB09                    jmp 004459FA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445AD5(U)
|
:004459F1 8B55F8                  mov edx, dword ptr [ebp-08]
:004459F4 83C201                  add edx, 00000001
:004459F7 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004459EF(U)
|
:004459FA 837DF804                cmp dword ptr [ebp-08], 00000004
:004459FE 0F83D6000000            jnb 00445ADA
:00445A04 C745F400000000          mov [ebp-0C], 00000000
:00445A0B EB09                    jmp 00445A16

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445A95(U)
|
:00445A0D 8B45F4                  mov eax, dword ptr [ebp-0C]
:00445A10 83C001                  add eax, 00000001
:00445A13 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445A0B(U)
|
:00445A16 837DF406                cmp dword ptr [ebp-0C], 00000006
:00445A1A 737E                    jnb 00445A9A
:00445A1C E8BA8BFDFF              call 0041E5DB
:00445A21 6A01                    push 00000001
:00445A23 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00445A26 51                      push ecx
:00445A27 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00445A2A E8BEE0FFFF              call 00443AED
:00445A2F 8B5508                  mov edx, dword ptr [ebp+08]
:00445A32 52                      push edx
:00445A33 8B45F4                  mov eax, dword ptr [ebp-0C]
:00445A36 33D2                    xor edx, edx
:00445A38 B902000000              mov ecx, 00000002
:00445A3D F7F1                    div ecx
:00445A3F C1E20E                  shl edx, 0E
:00445A42 8B45F0                  mov eax, dword ptr [ebp-10]
:00445A45 03C2                    add eax, edx
:00445A47 50                      push eax
:00445A48 6A60                    push 00000060
:00445A4A 6A60                    push 00000060
:00445A4C 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00445A4F 8B9180000000            mov edx, dword ptr [ecx+00000080]
:00445A55 52                      push edx
:00445A56 8B4508                  mov eax, dword ptr [ebp+08]
:00445A59 8B4820                  mov ecx, dword ptr [eax+20]
:00445A5C 51                      push ecx
:00445A5D 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00445A60 E8B8E1FFFF              call 00443C1D
:00445A65 E88C8BFDFF              call 0041E5F6
:00445A6A 837DF400                cmp dword ptr [ebp-0C], 00000000
:00445A6E 7614                    jbe 00445A84
:00445A70 837DF403                cmp dword ptr [ebp-0C], 00000003
:00445A74 730E                    jnb 00445A84
:00445A76 6A08                    push 00000008
:00445A78 B9181B4B00              mov ecx, 004B1B18
:00445A7D E8BED8FBFF              call 00403340
:00445A82 EB0C                    jmp 00445A90

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00445A6E(C), :00445A74(C)
|
:00445A84 6A04                    push 00000004
:00445A86 B9181B4B00              mov ecx, 004B1B18
:00445A8B E8B0D8FBFF              call 00403340

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445A82(U)
|
:00445A90 E84B6AFEFF              call 0042C4E0
:00445A95 E973FFFFFF              jmp 00445A0D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445A1A(C)
|
:00445A9A 8B45F8                  mov eax, dword ptr [ebp-08]
:00445A9D 33D2                    xor edx, edx
:00445A9F B902000000              mov ecx, 00000002
:00445AA4 F7F1                    div ecx
:00445AA6 85D2                    test edx, edx
:00445AA8 740E                    je 00445AB8
:00445AAA 8B55EC                  mov edx, dword ptr [ebp-14]
:00445AAD 81EA00800000            sub edx, 00008000
:00445AB3 8955E4                  mov dword ptr [ebp-1C], edx
:00445AB6 EB06                    jmp 00445ABE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445AA8(C)
|
:00445AB8 8B45EC                  mov eax, dword ptr [ebp-14]
:00445ABB 8945E4                  mov dword ptr [ebp-1C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445AB6(U)
|
:00445ABE 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00445AC1 894DF0                  mov dword ptr [ebp-10], ecx
:00445AC4 6A0A                    push 0000000A
:00445AC6 B9181B4B00              mov ecx, 004B1B18
:00445ACB E870D8FBFF              call 00403340
:00445AD0 E80B6AFEFF              call 0042C4E0
:00445AD5 E917FFFFFF              jmp 004459F1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004459FE(C)
|
:00445ADA 6A04                    push 00000004
:00445ADC 6A00                    push 00000000
:00445ADE 6800380400              push 00043800
:00445AE3 B9C8E44A00              mov ecx, 004AE4C8
:00445AE8 E8539F0300              call 0047FA40
:00445AED 8945EC                  mov dword ptr [ebp-14], eax
:00445AF0 C745F800000000          mov [ebp-08], 00000000
:00445AF7 EB09                    jmp 00445B02

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445B78(U)
|
:00445AF9 8B55F8                  mov edx, dword ptr [ebp-08]
:00445AFC 83C201                  add edx, 00000001
:00445AFF 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445AF7(U)
|
:00445B02 837DF804                cmp dword ptr [ebp-08], 00000004
:00445B06 7375                    jnb 00445B7D
:00445B08 837DF802                cmp dword ptr [ebp-08], 00000002
:00445B0C 732C                    jnb 00445B3A
:00445B0E 6A30                    push 00000030
:00445B10 6A30                    push 00000030
:00445B12 8B45F8                  mov eax, dword ptr [ebp-08]
:00445B15 C1E00E                  shl eax, 0E
:00445B18 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00445B1B 03C8                    add ecx, eax
:00445B1D 51                      push ecx
:00445B1E 8B55F8                  mov edx, dword ptr [ebp-08]
:00445B21 83C204                  add edx, 00000004
:00445B24 69D200090000            imul edx, 00000900
:00445B2A 8B45FC                  mov eax, dword ptr [ebp-04]
:00445B2D 03C2                    add eax, edx
:00445B2F 50                      push eax
:00445B30 E841AFFEFF              call 00430A76
:00445B35 83C410                  add esp, 00000010
:00445B38 EB3E                    jmp 00445B78

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445B0C(C)
|
:00445B3A 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00445B3D 51                      push ecx
:00445B3E 8B55F8                  mov edx, dword ptr [ebp-08]
:00445B41 83C202                  add edx, 00000002
:00445B44 69D200090000            imul edx, 00000900
:00445B4A 8B45FC                  mov eax, dword ptr [ebp-04]
:00445B4D 03C2                    add eax, edx
:00445B4F 50                      push eax
:00445B50 6A30                    push 00000030
:00445B52 6A30                    push 00000030
:00445B54 E8FA92FDFF              call 0041EE53
:00445B59 83C410                  add esp, 00000010
:00445B5C 6A30                    push 00000030
:00445B5E 6A30                    push 00000030
:00445B60 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00445B63 C1E10E                  shl ecx, 0E
:00445B66 8B55F0                  mov edx, dword ptr [ebp-10]
:00445B69 03D1                    add edx, ecx
:00445B6B 52                      push edx
:00445B6C 8B45EC                  mov eax, dword ptr [ebp-14]
:00445B6F 50                      push eax
:00445B70 E801AFFEFF              call 00430A76
:00445B75 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445B38(U)
|
:00445B78 E97CFFFFFF              jmp 00445AF9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445B06(C)
|
:00445B7D 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00445B80 81C100800000            add ecx, 00008000
:00445B86 894DEC                  mov dword ptr [ebp-14], ecx
:00445B89 C745F800000000          mov [ebp-08], 00000000
:00445B90 EB09                    jmp 00445B9B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445C76(U)
|
:00445B92 8B55F8                  mov edx, dword ptr [ebp-08]
:00445B95 83C201                  add edx, 00000001
:00445B98 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445B90(U)
|
:00445B9B 837DF802                cmp dword ptr [ebp-08], 00000002
:00445B9F 0F83D6000000            jnb 00445C7B
:00445BA5 C745F400000000          mov [ebp-0C], 00000000
:00445BAC EB09                    jmp 00445BB7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445C36(U)
|
:00445BAE 8B45F4                  mov eax, dword ptr [ebp-0C]
:00445BB1 83C001                  add eax, 00000001
:00445BB4 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445BAC(U)
|
:00445BB7 837DF406                cmp dword ptr [ebp-0C], 00000006
:00445BBB 737E                    jnb 00445C3B
:00445BBD E8198AFDFF              call 0041E5DB
:00445BC2 6A01                    push 00000001
:00445BC4 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00445BC7 51                      push ecx
:00445BC8 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00445BCB E81DDFFFFF              call 00443AED
:00445BD0 8B5508                  mov edx, dword ptr [ebp+08]
:00445BD3 52                      push edx
:00445BD4 8B45F4                  mov eax, dword ptr [ebp-0C]
:00445BD7 33D2                    xor edx, edx
:00445BD9 B902000000              mov ecx, 00000002
:00445BDE F7F1                    div ecx
:00445BE0 C1E20E                  shl edx, 0E
:00445BE3 8B45F0                  mov eax, dword ptr [ebp-10]
:00445BE6 03C2                    add eax, edx
:00445BE8 50                      push eax
:00445BE9 6A60                    push 00000060
:00445BEB 6A60                    push 00000060
:00445BED 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00445BF0 8B9180000000            mov edx, dword ptr [ecx+00000080]
:00445BF6 52                      push edx
:00445BF7 8B4508                  mov eax, dword ptr [ebp+08]
:00445BFA 8B4820                  mov ecx, dword ptr [eax+20]
:00445BFD 51                      push ecx
:00445BFE 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00445C01 E817E0FFFF              call 00443C1D
:00445C06 E8EB89FDFF              call 0041E5F6
:00445C0B 837DF400                cmp dword ptr [ebp-0C], 00000000
:00445C0F 7614                    jbe 00445C25
:00445C11 837DF403                cmp dword ptr [ebp-0C], 00000003
:00445C15 730E                    jnb 00445C25
:00445C17 6A08                    push 00000008
:00445C19 B9181B4B00              mov ecx, 004B1B18
:00445C1E E81DD7FBFF              call 00403340
:00445C23 EB0C                    jmp 00445C31

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00445C0F(C), :00445C15(C)
|
:00445C25 6A04                    push 00000004
:00445C27 B9181B4B00              mov ecx, 004B1B18
:00445C2C E80FD7FBFF              call 00403340

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445C23(U)
|
:00445C31 E8AA68FEFF              call 0042C4E0
:00445C36 E973FFFFFF              jmp 00445BAE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445BBB(C)
|
:00445C3B 8B45F8                  mov eax, dword ptr [ebp-08]
:00445C3E 33D2                    xor edx, edx
:00445C40 B902000000              mov ecx, 00000002
:00445C45 F7F1                    div ecx
:00445C47 85D2                    test edx, edx
:00445C49 740E                    je 00445C59
:00445C4B 8B55EC                  mov edx, dword ptr [ebp-14]
:00445C4E 81EA00800000            sub edx, 00008000
:00445C54 8955E0                  mov dword ptr [ebp-20], edx
:00445C57 EB06                    jmp 00445C5F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445C49(C)
|
:00445C59 8B45EC                  mov eax, dword ptr [ebp-14]
:00445C5C 8945E0                  mov dword ptr [ebp-20], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445C57(U)
|
:00445C5F 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00445C62 894DF0                  mov dword ptr [ebp-10], ecx
:00445C65 6A0A                    push 0000000A
:00445C67 B9181B4B00              mov ecx, 004B1B18
:00445C6C E8CFD6FBFF              call 00403340
:00445C71 E86A68FEFF              call 0042C4E0
:00445C76 E917FFFFFF              jmp 00445B92

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445B9F(C)
|
:00445C7B 8BE5                    mov esp, ebp
:00445C7D 5D                      pop ebp
:00445C7E C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:004483D0   , :004484D1   , :004484F3   
|
:00445C81 55                      push ebp
:00445C82 8BEC                    mov ebp, esp
:00445C84 6AFF                    push FFFFFFFF
:00445C86 6806554800              push 00485506
:00445C8B 64A100000000            mov eax, dword ptr fs:[00000000]
:00445C91 50                      push eax
:00445C92 64892500000000          mov dword ptr fs:[00000000], esp
:00445C99 81EC1C010000            sub esp, 0000011C
:00445C9F 898DD8FEFFFF            mov dword ptr [ebp+FFFFFED8], ecx
:00445CA5 8B4508                  mov eax, dword ptr [ebp+08]
:00445CA8 33C9                    xor ecx, ecx
:00445CAA 8A480D                  mov cl, byte ptr [eax+0D]
:00445CAD 51                      push ecx
:00445CAE 8B5508                  mov edx, dword ptr [ebp+08]
:00445CB1 8B4A04                  mov ecx, dword ptr [edx+04]
:00445CB4 E88F9FFFFF              call 0043FC48
:00445CB9 8845F0                  mov byte ptr [ebp-10], al
:00445CBC 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00445CC2 E8E9D5FBFF              call 004032B0
:00445CC7 C745FC00000000          mov [ebp-04], 00000000

* Possible StringData Ref from Data Obj ->"UNIT_ATK.E5"
                                  |
:00445CCE 68C0BB4800              push 0048BBC0
:00445CD3 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00445CD9 E8579EFDFF              call 0041FB35
:00445CDE 6A04                    push 00000004
:00445CE0 6A00                    push 00000000
:00445CE2 6800780300              push 00037800
:00445CE7 B9C8E44A00              mov ecx, 004AE4C8
:00445CEC E84F9D0300              call 0047FA40
:00445CF1 50                      push eax
:00445CF2 8B45F0                  mov eax, dword ptr [ebp-10]
:00445CF5 25FF000000              and eax, 000000FF
:00445CFA 50                      push eax
:00445CFB 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00445D01 E8839FFDFF              call 0041FC89
:00445D06 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00445D0C E8B435FDFF              call 004192C5
:00445D11 6A04                    push 00000004
:00445D13 6A00                    push 00000000
:00445D15 6A00                    push 00000000
:00445D17 B9C8E44A00              mov ecx, 004AE4C8
:00445D1C E81F9D0300              call 0047FA40
:00445D21 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:00445D27 6A04                    push 00000004
:00445D29 6A00                    push 00000000
:00445D2B 6800F80300              push 0003F800
:00445D30 B9C8E44A00              mov ecx, 004AE4C8
:00445D35 E8069D0300              call 0047FA40
:00445D3A 8985E8FEFFFF            mov dword ptr [ebp+FFFFFEE8], eax
:00445D40 6A04                    push 00000004
:00445D42 6A00                    push 00000000
:00445D44 6800380400              push 00043800
:00445D49 B9C8E44A00              mov ecx, 004AE4C8
:00445D4E E8ED9C0300              call 0047FA40
:00445D53 8985DCFEFFFF            mov dword ptr [ebp+FFFFFEDC], eax
:00445D59 C785E4FEFFFF00000000    mov dword ptr [ebp+FFFFFEE4], 00000000
:00445D63 EB0F                    jmp 00445D74

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445DED(U)
|
:00445D65 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:00445D6B 83C101                  add ecx, 00000001
:00445D6E 898DE4FEFFFF            mov dword ptr [ebp+FFFFFEE4], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445D63(U)
|
:00445D74 83BDE4FEFFFF04          cmp dword ptr [ebp+FFFFFEE4], 00000004
:00445D7B 7375                    jnb 00445DF2
:00445D7D 8B5508                  mov edx, dword ptr [ebp+08]
:00445D80 33C0                    xor eax, eax
:00445D82 8A420E                  mov al, byte ptr [edx+0E]
:00445D85 83F801                  cmp eax, 00000001
:00445D88 7527                    jne 00445DB1
:00445D8A 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:00445D90 51                      push ecx
:00445D91 8B95E4FEFFFF            mov edx, dword ptr [ebp+FFFFFEE4]
:00445D97 C1E20C                  shl edx, 0C
:00445D9A 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:00445DA0 03C2                    add eax, edx
:00445DA2 50                      push eax
:00445DA3 6A40                    push 00000040
:00445DA5 6A40                    push 00000040
:00445DA7 E8A790FDFF              call 0041EE53
:00445DAC 83C410                  add esp, 00000010
:00445DAF EB17                    jmp 00445DC8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445D88(C)
|
:00445DB1 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:00445DB7 C1E10C                  shl ecx, 0C
:00445DBA 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:00445DC0 03D1                    add edx, ecx
:00445DC2 8995DCFEFFFF            mov dword ptr [ebp+FFFFFEDC], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445DAF(U)
|
:00445DC8 6A40                    push 00000040
:00445DCA 6A40                    push 00000040
:00445DCC 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:00445DD2 C1E00E                  shl eax, 0E
:00445DD5 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:00445DDB 03C8                    add ecx, eax
:00445DDD 51                      push ecx
:00445DDE 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:00445DE4 52                      push edx
:00445DE5 E88CACFEFF              call 00430A76
:00445DEA 83C410                  add esp, 00000010
:00445DED E973FFFFFF              jmp 00445D65

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445D7B(C)
|
:00445DF2 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00445DF9 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00445DFF E8CCD4FBFF              call 004032D0
:00445E04 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00445E07 64890D00000000          mov dword ptr fs:[00000000], ecx
:00445E0E 8BE5                    mov esp, ebp
:00445E10 5D                      pop ebp
:00445E11 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00446387   , :0044676E   , :00446B33   , :00446F24   , :004472B3   
|
:00445E14 55                      push ebp
:00445E15 8BEC                    mov ebp, esp
:00445E17 83EC0C                  sub esp, 0000000C
:00445E1A 894DF4                  mov dword ptr [ebp-0C], ecx
:00445E1D C745FC00000000          mov [ebp-04], 00000000
:00445E24 EB09                    jmp 00445E2F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446200(U)
|
:00445E26 8B45FC                  mov eax, dword ptr [ebp-04]
:00445E29 83C001                  add eax, 00000001
:00445E2C 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445E24(U)
|
:00445E2F 837DFC02                cmp dword ptr [ebp-04], 00000002
:00445E33 0F83CC030000            jnb 00446205
:00445E39 837DFC00                cmp dword ptr [ebp-04], 00000000
:00445E3D 0F85E3010000            jne 00446026
:00445E43 8B4D08                  mov ecx, dword ptr [ebp+08]
:00445E46 8B4904                  mov ecx, dword ptr [ecx+04]
:00445E49 E854A2FFFF              call 004400A2
:00445E4E 85C0                    test eax, eax
:00445E50 747A                    je 00445ECC
:00445E52 E88487FDFF              call 0041E5DB
:00445E57 6A01                    push 00000001
:00445E59 8B550C                  mov edx, dword ptr [ebp+0C]
:00445E5C 52                      push edx
:00445E5D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00445E60 E888DCFFFF              call 00443AED
:00445E65 8B4508                  mov eax, dword ptr [ebp+08]
:00445E68 50                      push eax
:00445E69 6A04                    push 00000004
:00445E6B 6A00                    push 00000000
:00445E6D 6A00                    push 00000000
:00445E6F B9C8E44A00              mov ecx, 004AE4C8
:00445E74 E8C79B0300              call 0047FA40
:00445E79 50                      push eax
:00445E7A 6880000000              push 00000080
:00445E7F 6880000000              push 00000080
:00445E84 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00445E87 8B9180000000            mov edx, dword ptr [ecx+00000080]
:00445E8D 83EA10                  sub edx, 00000010
:00445E90 52                      push edx
:00445E91 8B4508                  mov eax, dword ptr [ebp+08]
:00445E94 8B4820                  mov ecx, dword ptr [eax+20]
:00445E97 83E910                  sub ecx, 00000010
:00445E9A 51                      push ecx
:00445E9B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00445E9E E87ADDFFFF              call 00443C1D
:00445EA3 E84E87FDFF              call 0041E5F6
:00445EA8 6A01                    push 00000001
:00445EAA 6A25                    push 00000025
:00445EAC B9B0694B00              mov ecx, 004B69B0
:00445EB1 E8C4E70200              call 0047467A
:00445EB6 6A01                    push 00000001
:00445EB8 B9181B4B00              mov ecx, 004B1B18
:00445EBD E87ED4FBFF              call 00403340
:00445EC2 E81966FEFF              call 0042C4E0
:00445EC7 E955010000              jmp 00446021

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445E50(C)
|
:00445ECC E80A87FDFF              call 0041E5DB
:00445ED1 6A01                    push 00000001
:00445ED3 8B550C                  mov edx, dword ptr [ebp+0C]
:00445ED6 52                      push edx
:00445ED7 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00445EDA E80EDCFFFF              call 00443AED
:00445EDF 837D1000                cmp dword ptr [ebp+10], 00000000
:00445EE3 0F84E4000000            je 00445FCD
:00445EE9 6A01                    push 00000001
:00445EEB 6A21                    push 00000021
:00445EED B9B0694B00              mov ecx, 004B69B0
:00445EF2 E883E70200              call 0047467A
:00445EF7 C745F800000000          mov [ebp-08], 00000000
:00445EFE EB09                    jmp 00445F09

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445FC6(U)
|
:00445F00 8B45F8                  mov eax, dword ptr [ebp-08]
:00445F03 83C001                  add eax, 00000001
:00445F06 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445EFE(U)
|
:00445F09 837DF80C                cmp dword ptr [ebp-08], 0000000C
:00445F0D 0F83B8000000            jnb 00445FCB
:00445F13 6800400000              push 00004000
:00445F18 6A04                    push 00000004
:00445F1A 6A00                    push 00000000
:00445F1C 6800800100              push 00018000
:00445F21 B9C8E44A00              mov ecx, 004AE4C8
:00445F26 E8159B0300              call 0047FA40
:00445F2B 50                      push eax
:00445F2C 6A04                    push 00000004
:00445F2E 6A00                    push 00000000
:00445F30 6A00                    push 00000000
:00445F32 B9C8E44A00              mov ecx, 004AE4C8
:00445F37 E8049B0300              call 0047FA40
:00445F3C 50                      push eax
:00445F3D E8BB9D0300              call 0047FCFD
:00445F42 83C40C                  add esp, 0000000C
:00445F45 8A4DF8                  mov cl, byte ptr [ebp-08]
:00445F48 51                      push ecx
:00445F49 6880000000              push 00000080
:00445F4E 6880000000              push 00000080
:00445F53 6A04                    push 00000004
:00445F55 6A00                    push 00000000
:00445F57 6800800100              push 00018000
:00445F5C B9C8E44A00              mov ecx, 004AE4C8
:00445F61 E8DA9A0300              call 0047FA40
:00445F66 50                      push eax
:00445F67 E854A4FEFF              call 004303C0
:00445F6C 83C410                  add esp, 00000010
:00445F6F 8B5508                  mov edx, dword ptr [ebp+08]
:00445F72 52                      push edx
:00445F73 6A04                    push 00000004
:00445F75 6A00                    push 00000000
:00445F77 6800800100              push 00018000
:00445F7C B9C8E44A00              mov ecx, 004AE4C8
:00445F81 E8BA9A0300              call 0047FA40
:00445F86 50                      push eax
:00445F87 6880000000              push 00000080
:00445F8C 6880000000              push 00000080
:00445F91 8B45F4                  mov eax, dword ptr [ebp-0C]
:00445F94 8B8880000000            mov ecx, dword ptr [eax+00000080]
:00445F9A 83E910                  sub ecx, 00000010
:00445F9D 51                      push ecx
:00445F9E 8B5508                  mov edx, dword ptr [ebp+08]
:00445FA1 8B4220                  mov eax, dword ptr [edx+20]
:00445FA4 83E810                  sub eax, 00000010
:00445FA7 50                      push eax
:00445FA8 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00445FAB E86DDCFFFF              call 00443C1D
:00445FB0 E84186FDFF              call 0041E5F6
:00445FB5 6A01                    push 00000001
:00445FB7 B9181B4B00              mov ecx, 004B1B18
:00445FBC E87FD3FBFF              call 00403340
:00445FC1 E81A65FEFF              call 0042C4E0
:00445FC6 E935FFFFFF              jmp 00445F00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445F0D(C)
|
:00445FCB EB54                    jmp 00446021

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445EE3(C)
|
:00445FCD 8B4D08                  mov ecx, dword ptr [ebp+08]
:00445FD0 51                      push ecx
:00445FD1 6A04                    push 00000004
:00445FD3 6A00                    push 00000000
:00445FD5 6A00                    push 00000000
:00445FD7 B9C8E44A00              mov ecx, 004AE4C8
:00445FDC E85F9A0300              call 0047FA40
:00445FE1 50                      push eax
:00445FE2 6880000000              push 00000080
:00445FE7 6880000000              push 00000080
:00445FEC 8B55F4                  mov edx, dword ptr [ebp-0C]
:00445FEF 8B8280000000            mov eax, dword ptr [edx+00000080]
:00445FF5 83E810                  sub eax, 00000010
:00445FF8 50                      push eax
:00445FF9 8B4D08                  mov ecx, dword ptr [ebp+08]
:00445FFC 8B5120                  mov edx, dword ptr [ecx+20]
:00445FFF 83EA10                  sub edx, 00000010
:00446002 52                      push edx
:00446003 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00446006 E812DCFFFF              call 00443C1D
:0044600B E8E685FDFF              call 0041E5F6
:00446010 6A02                    push 00000002
:00446012 B9181B4B00              mov ecx, 004B1B18
:00446017 E824D3FBFF              call 00403340
:0044601C E8BF64FEFF              call 0042C4E0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00445EC7(U), :00445FCB(U)
|
:00446021 E9DA010000              jmp 00446200

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445E3D(C)
|
:00446026 8B4508                  mov eax, dword ptr [ebp+08]
:00446029 8B4804                  mov ecx, dword ptr [eax+04]
:0044602C E871A0FFFF              call 004400A2
:00446031 85C0                    test eax, eax
:00446033 0F845D010000            je 00446196
:00446039 E89D85FDFF              call 0041E5DB
:0044603E 6A01                    push 00000001
:00446040 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00446043 51                      push ecx
:00446044 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00446047 E8A1DAFFFF              call 00443AED
:0044604C 837D1000                cmp dword ptr [ebp+10], 00000000
:00446050 0F84E7000000            je 0044613D
:00446056 6A01                    push 00000001
:00446058 6A21                    push 00000021
:0044605A B9B0694B00              mov ecx, 004B69B0
:0044605F E816E60200              call 0047467A
:00446064 C745F800000000          mov [ebp-08], 00000000
:0044606B EB09                    jmp 00446076

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446136(U)
|
:0044606D 8B55F8                  mov edx, dword ptr [ebp-08]
:00446070 83C201                  add edx, 00000001
:00446073 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044606B(U)
|
:00446076 837DF80C                cmp dword ptr [ebp-08], 0000000C
:0044607A 0F83BB000000            jnb 0044613B
:00446080 6800400000              push 00004000
:00446085 6A04                    push 00000004
:00446087 6A00                    push 00000000
:00446089 6800800100              push 00018000
:0044608E B9C8E44A00              mov ecx, 004AE4C8
:00446093 E8A8990300              call 0047FA40
:00446098 50                      push eax
:00446099 6A04                    push 00000004
:0044609B 6A00                    push 00000000
:0044609D 6800400000              push 00004000
:004460A2 B9C8E44A00              mov ecx, 004AE4C8
:004460A7 E894990300              call 0047FA40
:004460AC 50                      push eax
:004460AD E84B9C0300              call 0047FCFD
:004460B2 83C40C                  add esp, 0000000C
:004460B5 8A45F8                  mov al, byte ptr [ebp-08]
:004460B8 50                      push eax
:004460B9 6880000000              push 00000080
:004460BE 6880000000              push 00000080
:004460C3 6A04                    push 00000004
:004460C5 6A00                    push 00000000
:004460C7 6800800100              push 00018000
:004460CC B9C8E44A00              mov ecx, 004AE4C8
:004460D1 E86A990300              call 0047FA40
:004460D6 50                      push eax
:004460D7 E8E4A2FEFF              call 004303C0
:004460DC 83C410                  add esp, 00000010
:004460DF 8B4D08                  mov ecx, dword ptr [ebp+08]
:004460E2 51                      push ecx
:004460E3 6A04                    push 00000004
:004460E5 6A00                    push 00000000
:004460E7 6800800100              push 00018000
:004460EC B9C8E44A00              mov ecx, 004AE4C8
:004460F1 E84A990300              call 0047FA40
:004460F6 50                      push eax
:004460F7 6880000000              push 00000080
:004460FC 6880000000              push 00000080
:00446101 8B55F4                  mov edx, dword ptr [ebp-0C]
:00446104 8B8280000000            mov eax, dword ptr [edx+00000080]
:0044610A 83E810                  sub eax, 00000010
:0044610D 50                      push eax
:0044610E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00446111 8B5120                  mov edx, dword ptr [ecx+20]
:00446114 83EA10                  sub edx, 00000010
:00446117 52                      push edx
:00446118 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044611B E8FDDAFFFF              call 00443C1D
:00446120 E8D184FDFF              call 0041E5F6
:00446125 6A01                    push 00000001
:00446127 B9181B4B00              mov ecx, 004B1B18
:0044612C E80FD2FBFF              call 00403340
:00446131 E8AA63FEFF              call 0042C4E0
:00446136 E932FFFFFF              jmp 0044606D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044607A(C)
|
:0044613B EB57                    jmp 00446194

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446050(C)
|
:0044613D 8B4508                  mov eax, dword ptr [ebp+08]
:00446140 50                      push eax
:00446141 6A04                    push 00000004
:00446143 6A00                    push 00000000
:00446145 6800400000              push 00004000
:0044614A B9C8E44A00              mov ecx, 004AE4C8
:0044614F E8EC980300              call 0047FA40
:00446154 50                      push eax
:00446155 6880000000              push 00000080
:0044615A 6880000000              push 00000080
:0044615F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00446162 8B9180000000            mov edx, dword ptr [ecx+00000080]
:00446168 83EA10                  sub edx, 00000010
:0044616B 52                      push edx
:0044616C 8B4508                  mov eax, dword ptr [ebp+08]
:0044616F 8B4820                  mov ecx, dword ptr [eax+20]
:00446172 83E910                  sub ecx, 00000010
:00446175 51                      push ecx
:00446176 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00446179 E89FDAFFFF              call 00443C1D
:0044617E E87384FDFF              call 0041E5F6
:00446183 6A08                    push 00000008
:00446185 B9181B4B00              mov ecx, 004B1B18
:0044618A E8B1D1FBFF              call 00403340
:0044618F E84C63FEFF              call 0042C4E0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044613B(U)
|
:00446194 EB6A                    jmp 00446200

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446033(C)
|
:00446196 E84084FDFF              call 0041E5DB
:0044619B 6A01                    push 00000001
:0044619D 8B550C                  mov edx, dword ptr [ebp+0C]
:004461A0 52                      push edx
:004461A1 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004461A4 E844D9FFFF              call 00443AED
:004461A9 8B4508                  mov eax, dword ptr [ebp+08]
:004461AC 50                      push eax
:004461AD 6A04                    push 00000004
:004461AF 6A00                    push 00000000
:004461B1 6800400000              push 00004000
:004461B6 B9C8E44A00              mov ecx, 004AE4C8
:004461BB E880980300              call 0047FA40
:004461C0 50                      push eax
:004461C1 6880000000              push 00000080
:004461C6 6880000000              push 00000080
:004461CB 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004461CE 8B9180000000            mov edx, dword ptr [ecx+00000080]
:004461D4 83EA10                  sub edx, 00000010
:004461D7 52                      push edx
:004461D8 8B4508                  mov eax, dword ptr [ebp+08]
:004461DB 8B4820                  mov ecx, dword ptr [eax+20]
:004461DE 83E910                  sub ecx, 00000010
:004461E1 51                      push ecx
:004461E2 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004461E5 E833DAFFFF              call 00443C1D
:004461EA E80784FDFF              call 0041E5F6
:004461EF 6A01                    push 00000001
:004461F1 B9181B4B00              mov ecx, 004B1B18
:004461F6 E845D1FBFF              call 00403340
:004461FB E8E062FEFF              call 0042C4E0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00446021(U), :00446194(U)
|
:00446200 E921FCFFFF              jmp 00445E26

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00445E33(C)
|
:00446205 8BE5                    mov esp, ebp
:00446207 5D                      pop ebp
:00446208 C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:00448402   , :0044841A   
|
:0044620B 55                      push ebp
:0044620C 8BEC                    mov ebp, esp
:0044620E 6AFF                    push FFFFFFFF
:00446210 681C554800              push 0048551C
:00446215 64A100000000            mov eax, dword ptr fs:[00000000]
:0044621B 50                      push eax
:0044621C 64892500000000          mov dword ptr fs:[00000000], esp
:00446223 81EC24010000            sub esp, 00000124
:00446229 898DD4FEFFFF            mov dword ptr [ebp+FFFFFED4], ecx
:0044622F 8B450C                  mov eax, dword ptr [ebp+0C]
:00446232 33C9                    xor ecx, ecx
:00446234 8A480D                  mov cl, byte ptr [eax+0D]
:00446237 51                      push ecx
:00446238 8B550C                  mov edx, dword ptr [ebp+0C]
:0044623B 8B4A04                  mov ecx, dword ptr [edx+04]
:0044623E E8059AFFFF              call 0043FC48
:00446243 8885E4FEFFFF            mov byte ptr [ebp+FFFFFEE4], al
:00446249 8B4508                  mov eax, dword ptr [ebp+08]
:0044624C 33C9                    xor ecx, ecx
:0044624E 8A480E                  mov cl, byte ptr [eax+0E]
:00446251 83E901                  sub ecx, 00000001
:00446254 F7D9                    neg ecx
:00446256 1BC9                    sbb ecx, ecx
:00446258 83E1C0                  and ecx, FFFFFFC0
:0044625B 83C120                  add ecx, 00000020
:0044625E 894DF0                  mov dword ptr [ebp-10], ecx
:00446261 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00446267 E844D0FBFF              call 004032B0
:0044626C C745FC00000000          mov [ebp-04], 00000000

* Possible StringData Ref from Data Obj ->"UNIT_SPC.E5"
                                  |
:00446273 68D0BB4800              push 0048BBD0
:00446278 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0044627E E8B298FDFF              call 0041FB35
:00446283 6A04                    push 00000004
:00446285 6A00                    push 00000000
:00446287 6800780300              push 00037800
:0044628C B9C8E44A00              mov ecx, 004AE4C8
:00446291 E8AA970300              call 0047FA40
:00446296 50                      push eax
:00446297 8B95E4FEFFFF            mov edx, dword ptr [ebp+FFFFFEE4]
:0044629D 81E2FF000000            and edx, 000000FF
:004462A3 52                      push edx
:004462A4 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:004462AA E8DA99FDFF              call 0041FC89
:004462AF 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:004462B5 E80B30FDFF              call 004192C5
:004462BA 6A04                    push 00000004
:004462BC 6A00                    push 00000000
:004462BE 6800400100              push 00014000
:004462C3 B9C8E44A00              mov ecx, 004AE4C8
:004462C8 E873970300              call 0047FA40
:004462CD 8985DCFEFFFF            mov dword ptr [ebp+FFFFFEDC], eax
:004462D3 837D1400                cmp dword ptr [ebp+14], 00000000
:004462D7 7469                    je 00446342
:004462D9 6A04                    push 00000004
:004462DB 6A00                    push 00000000
:004462DD 68008A0300              push 00038A00
:004462E2 B9C8E44A00              mov ecx, 004AE4C8
:004462E7 E854970300              call 0047FA40
:004462EC 8985E8FEFFFF            mov dword ptr [ebp+FFFFFEE8], eax
:004462F2 6A04                    push 00000004
:004462F4 6A00                    push 00000000
:004462F6 6800380400              push 00043800
:004462FB B9C8E44A00              mov ecx, 004AE4C8
:00446300 E83B970300              call 0047FA40
:00446305 8985D8FEFFFF            mov dword ptr [ebp+FFFFFED8], eax
:0044630B 8B4508                  mov eax, dword ptr [ebp+08]
:0044630E 33C9                    xor ecx, ecx
:00446310 8A480E                  mov cl, byte ptr [eax+0E]
:00446313 83F901                  cmp ecx, 00000001
:00446316 750E                    jne 00446326
:00446318 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:0044631E 8995D8FEFFFF            mov dword ptr [ebp+FFFFFED8], edx
:00446324 EB1A                    jmp 00446340

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446316(C)
|
:00446326 8B85D8FEFFFF            mov eax, dword ptr [ebp+FFFFFED8]
:0044632C 50                      push eax
:0044632D 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00446333 51                      push ecx
:00446334 6A30                    push 00000030
:00446336 6A30                    push 00000030
:00446338 E8168BFDFF              call 0041EE53
:0044633D 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446324(U)
|
:00446340 EB19                    jmp 0044635B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004462D7(C)
|
:00446342 6A04                    push 00000004
:00446344 6A00                    push 00000000
:00446346 6800930300              push 00039300
:0044634B B9C8E44A00              mov ecx, 004AE4C8
:00446350 E8EB960300              call 0047FA40
:00446355 8985D8FEFFFF            mov dword ptr [ebp+FFFFFED8], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446340(U)
|
:0044635B 6A30                    push 00000030
:0044635D 6A30                    push 00000030
:0044635F 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:00446365 52                      push edx
:00446366 8B85D8FEFFFF            mov eax, dword ptr [ebp+FFFFFED8]
:0044636C 50                      push eax
:0044636D E804A7FEFF              call 00430A76
:00446372 83C410                  add esp, 00000010
:00446375 8B4D10                  mov ecx, dword ptr [ebp+10]
:00446378 51                      push ecx
:00446379 8B550C                  mov edx, dword ptr [ebp+0C]
:0044637C 52                      push edx
:0044637D 8B4508                  mov eax, dword ptr [ebp+08]
:00446380 50                      push eax
:00446381 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:00446387 E888FAFFFF              call 00445E14
:0044638C C785E0FEFFFF00000000    mov dword ptr [ebp+FFFFFEE0], 00000000
:00446396 EB0F                    jmp 004463A7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004465D4(U)
|
:00446398 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:0044639E 83C101                  add ecx, 00000001
:004463A1 898DE0FEFFFF            mov dword ptr [ebp+FFFFFEE0], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446396(U)
|
:004463A7 83BDE0FEFFFF06          cmp dword ptr [ebp+FFFFFEE0], 00000006
:004463AE 0F8325020000            jnb 004465D9
:004463B4 E82282FDFF              call 0041E5DB
:004463B9 6A01                    push 00000001
:004463BB 6A00                    push 00000000
:004463BD 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:004463C3 E825D7FFFF              call 00443AED
:004463C8 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:004463CE 8995D0FEFFFF            mov dword ptr [ebp+FFFFFED0], edx
:004463D4 83BDD0FEFFFF05          cmp dword ptr [ebp+FFFFFED0], 00000005
:004463DB 0F87DD010000            ja 004465BE
:004463E1 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:004463E7 FF2485FB654400          jmp dword ptr [4*eax+004465FB]
:004463EE 837D1400                cmp dword ptr [ebp+14], 00000000
:004463F2 7451                    je 00446445
:004463F4 6A01                    push 00000001
:004463F6 6A1F                    push 0000001F
:004463F8 B9B0694B00              mov ecx, 004B69B0
:004463FD E878E20200              call 0047467A
:00446402 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00446405 51                      push ecx
:00446406 6A04                    push 00000004
:00446408 6A00                    push 00000000
:0044640A 6800400100              push 00014000
:0044640F B9C8E44A00              mov ecx, 004AE4C8
:00446414 E827960300              call 0047FA40
:00446419 50                      push eax
:0044641A 6A60                    push 00000060
:0044641C 6A60                    push 00000060
:0044641E 8B95D4FEFFFF            mov edx, dword ptr [ebp+FFFFFED4]
:00446424 8B8280000000            mov eax, dword ptr [edx+00000080]
:0044642A 50                      push eax
:0044642B 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0044642E 8B5120                  mov edx, dword ptr [ecx+20]
:00446431 0355F0                  add edx, dword ptr [ebp-10]
:00446434 52                      push edx
:00446435 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:0044643B E8DDD7FFFF              call 00443C1D
:00446440 E9A3000000              jmp 004464E8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004463F2(C)
|
:00446445 6A01                    push 00000001
:00446447 6A24                    push 00000024
:00446449 B9B0694B00              mov ecx, 004B69B0
:0044644E E827E20200              call 0047467A
:00446453 6800400000              push 00004000
:00446458 6A04                    push 00000004
:0044645A 6A00                    push 00000000
:0044645C 6800800100              push 00018000
:00446461 B9C8E44A00              mov ecx, 004AE4C8
:00446466 E8D5950300              call 0047FA40
:0044646B 50                      push eax
:0044646C 6A04                    push 00000004
:0044646E 6A00                    push 00000000
:00446470 6800400100              push 00014000
:00446475 B9C8E44A00              mov ecx, 004AE4C8
:0044647A E8C1950300              call 0047FA40
:0044647F 50                      push eax
:00446480 E878980300              call 0047FCFD
:00446485 83C40C                  add esp, 0000000C
:00446488 6A0C                    push 0000000C
:0044648A 6A60                    push 00000060
:0044648C 6A60                    push 00000060
:0044648E 6A04                    push 00000004
:00446490 6A00                    push 00000000
:00446492 6800800100              push 00018000
:00446497 B9C8E44A00              mov ecx, 004AE4C8
:0044649C E89F950300              call 0047FA40
:004464A1 50                      push eax
:004464A2 E8199FFEFF              call 004303C0
:004464A7 83C410                  add esp, 00000010
:004464AA 8B450C                  mov eax, dword ptr [ebp+0C]
:004464AD 50                      push eax
:004464AE 6A04                    push 00000004
:004464B0 6A00                    push 00000000
:004464B2 6800800100              push 00018000
:004464B7 B9C8E44A00              mov ecx, 004AE4C8
:004464BC E87F950300              call 0047FA40
:004464C1 50                      push eax
:004464C2 6A60                    push 00000060
:004464C4 6A60                    push 00000060
:004464C6 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:004464CC 8B9180000000            mov edx, dword ptr [ecx+00000080]
:004464D2 52                      push edx
:004464D3 8B450C                  mov eax, dword ptr [ebp+0C]
:004464D6 8B4820                  mov ecx, dword ptr [eax+20]
:004464D9 034DF0                  add ecx, dword ptr [ebp-10]
:004464DC 51                      push ecx
:004464DD 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:004464E3 E835D7FFFF              call 00443C1D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446440(U)
|
:004464E8 8B5508                  mov edx, dword ptr [ebp+08]
:004464EB 52                      push edx
:004464EC 6A04                    push 00000004
:004464EE 6A00                    push 00000000
:004464F0 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:004464F6 83C002                  add eax, 00000002
:004464F9 C1E00E                  shl eax, 0E
:004464FC 50                      push eax
:004464FD B9C8E44A00              mov ecx, 004AE4C8
:00446502 E839950300              call 0047FA40
:00446507 50                      push eax
:00446508 6880000000              push 00000080
:0044650D 6880000000              push 00000080
:00446512 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:00446518 8B9180000000            mov edx, dword ptr [ecx+00000080]
:0044651E 83EA10                  sub edx, 00000010
:00446521 52                      push edx
:00446522 8B4508                  mov eax, dword ptr [ebp+08]
:00446525 8B4820                  mov ecx, dword ptr [eax+20]
:00446528 83E910                  sub ecx, 00000010
:0044652B 51                      push ecx
:0044652C 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:00446532 E8E6D6FFFF              call 00443C1D
:00446537 E982000000              jmp 004465BE
:0044653C 8B550C                  mov edx, dword ptr [ebp+0C]
:0044653F 52                      push edx
:00446540 6A04                    push 00000004
:00446542 6A00                    push 00000000
:00446544 6800400100              push 00014000
:00446549 B9C8E44A00              mov ecx, 004AE4C8
:0044654E E8ED940300              call 0047FA40
:00446553 50                      push eax
:00446554 6A60                    push 00000060
:00446556 6A60                    push 00000060
:00446558 8B85D4FEFFFF            mov eax, dword ptr [ebp+FFFFFED4]
:0044655E 8B8880000000            mov ecx, dword ptr [eax+00000080]
:00446564 51                      push ecx
:00446565 8B550C                  mov edx, dword ptr [ebp+0C]
:00446568 8B4220                  mov eax, dword ptr [edx+20]
:0044656B 50                      push eax
:0044656C 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:00446572 E8A6D6FFFF              call 00443C1D
:00446577 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044657A 51                      push ecx
:0044657B 6A04                    push 00000004
:0044657D 6A00                    push 00000000
:0044657F 6800C00000              push 0000C000
:00446584 B9C8E44A00              mov ecx, 004AE4C8
:00446589 E8B2940300              call 0047FA40
:0044658E 50                      push eax
:0044658F 6880000000              push 00000080
:00446594 6880000000              push 00000080
:00446599 8B95D4FEFFFF            mov edx, dword ptr [ebp+FFFFFED4]
:0044659F 8B8280000000            mov eax, dword ptr [edx+00000080]
:004465A5 83E810                  sub eax, 00000010
:004465A8 50                      push eax
:004465A9 8B4D08                  mov ecx, dword ptr [ebp+08]
:004465AC 8B5120                  mov edx, dword ptr [ecx+20]
:004465AF 83EA10                  sub edx, 00000010
:004465B2 52                      push edx
:004465B3 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:004465B9 E85FD6FFFF              call 00443C1D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004463DB(C), :00446537(U)
|
:004465BE E83380FDFF              call 0041E5F6
:004465C3 6A01                    push 00000001
:004465C5 B9181B4B00              mov ecx, 004B1B18
:004465CA E871CDFBFF              call 00403340
:004465CF E80C5FFEFF              call 0042C4E0
:004465D4 E9BFFDFFFF              jmp 00446398

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004463AE(C)
|
:004465D9 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:004465E0 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:004465E6 E8E5CCFBFF              call 004032D0
:004465EB 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004465EE 64890D00000000          mov dword ptr fs:[00000000], ecx
:004465F5 8BE5                    mov esp, ebp
:004465F7 5D                      pop ebp
:004465F8 C21000                  ret 0010



:004465FB EE634400                DWORD 004463EE
:004465FF EE634400                DWORD 004463EE
:00446603 3C654400                DWORD 0044653C
:00446607 3C654400                DWORD 0044653C
:0044660B 3C654400                DWORD 0044653C
:0044660F 3C654400                DWORD 0044653C



* Referenced by a CALL at Address:
|:00448430   
|
:00446613 55                      push ebp
:00446614 8BEC                    mov ebp, esp
:00446616 6AFF                    push FFFFFFFF
:00446618 6832554800              push 00485532
:0044661D 64A100000000            mov eax, dword ptr fs:[00000000]
:00446623 50                      push eax
:00446624 64892500000000          mov dword ptr fs:[00000000], esp
:0044662B 81EC24010000            sub esp, 00000124
:00446631 898DD4FEFFFF            mov dword ptr [ebp+FFFFFED4], ecx
:00446637 8B450C                  mov eax, dword ptr [ebp+0C]
:0044663A 33C9                    xor ecx, ecx
:0044663C 8A480D                  mov cl, byte ptr [eax+0D]
:0044663F 51                      push ecx
:00446640 8B550C                  mov edx, dword ptr [ebp+0C]
:00446643 8B4A04                  mov ecx, dword ptr [edx+04]
:00446646 E8FD95FFFF              call 0043FC48
:0044664B 8885E4FEFFFF            mov byte ptr [ebp+FFFFFEE4], al
:00446651 8B4508                  mov eax, dword ptr [ebp+08]
:00446654 33C9                    xor ecx, ecx
:00446656 8A480E                  mov cl, byte ptr [eax+0E]
:00446659 83E901                  sub ecx, 00000001
:0044665C F7D9                    neg ecx
:0044665E 1BC9                    sbb ecx, ecx
:00446660 83E1C0                  and ecx, FFFFFFC0
:00446663 83C120                  add ecx, 00000020
:00446666 894DF0                  mov dword ptr [ebp-10], ecx
:00446669 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0044666F E83CCCFBFF              call 004032B0
:00446674 C745FC00000000          mov [ebp-04], 00000000

* Possible StringData Ref from Data Obj ->"UNIT_SPC.E5"
                                  |
:0044667B 68D0BB4800              push 0048BBD0
:00446680 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00446686 E8AA94FDFF              call 0041FB35
:0044668B 6A04                    push 00000004
:0044668D 6A00                    push 00000000
:0044668F 6800780300              push 00037800
:00446694 B9C8E44A00              mov ecx, 004AE4C8
:00446699 E8A2930300              call 0047FA40
:0044669E 50                      push eax
:0044669F 8B95E4FEFFFF            mov edx, dword ptr [ebp+FFFFFEE4]
:004466A5 81E2FF000000            and edx, 000000FF
:004466AB 52                      push edx
:004466AC 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:004466B2 E8D295FDFF              call 0041FC89
:004466B7 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:004466BD E8032CFDFF              call 004192C5
:004466C2 6A04                    push 00000004
:004466C4 6A00                    push 00000000
:004466C6 6800400100              push 00014000
:004466CB B9C8E44A00              mov ecx, 004AE4C8
:004466D0 E86B930300              call 0047FA40
:004466D5 8985DCFEFFFF            mov dword ptr [ebp+FFFFFEDC], eax
:004466DB 6A04                    push 00000004
:004466DD 6A00                    push 00000000
:004466DF 68008A0300              push 00038A00
:004466E4 B9C8E44A00              mov ecx, 004AE4C8
:004466E9 E852930300              call 0047FA40
:004466EE 8985E8FEFFFF            mov dword ptr [ebp+FFFFFEE8], eax
:004466F4 6A04                    push 00000004
:004466F6 6A00                    push 00000000
:004466F8 6800380400              push 00043800
:004466FD B9C8E44A00              mov ecx, 004AE4C8
:00446702 E839930300              call 0047FA40
:00446707 8985D8FEFFFF            mov dword ptr [ebp+FFFFFED8], eax
:0044670D 8B4508                  mov eax, dword ptr [ebp+08]
:00446710 33C9                    xor ecx, ecx
:00446712 8A480E                  mov cl, byte ptr [eax+0E]
:00446715 83F901                  cmp ecx, 00000001
:00446718 750E                    jne 00446728
:0044671A 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:00446720 8995D8FEFFFF            mov dword ptr [ebp+FFFFFED8], edx
:00446726 EB1A                    jmp 00446742

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446718(C)
|
:00446728 8B85D8FEFFFF            mov eax, dword ptr [ebp+FFFFFED8]
:0044672E 50                      push eax
:0044672F 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00446735 51                      push ecx
:00446736 6A30                    push 00000030
:00446738 6A30                    push 00000030
:0044673A E81487FDFF              call 0041EE53
:0044673F 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446726(U)
|
:00446742 6A30                    push 00000030
:00446744 6A30                    push 00000030
:00446746 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:0044674C 52                      push edx
:0044674D 8B85D8FEFFFF            mov eax, dword ptr [ebp+FFFFFED8]
:00446753 50                      push eax
:00446754 E81DA3FEFF              call 00430A76
:00446759 83C410                  add esp, 00000010
:0044675C 8B4D10                  mov ecx, dword ptr [ebp+10]
:0044675F 51                      push ecx
:00446760 8B550C                  mov edx, dword ptr [ebp+0C]
:00446763 52                      push edx
:00446764 8B4508                  mov eax, dword ptr [ebp+08]
:00446767 50                      push eax
:00446768 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:0044676E E8A1F6FFFF              call 00445E14
:00446773 C785E0FEFFFF00000000    mov dword ptr [ebp+FFFFFEE0], 00000000
:0044677D EB0F                    jmp 0044678E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004469AC(U)
|
:0044677F 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:00446785 83C101                  add ecx, 00000001
:00446788 898DE0FEFFFF            mov dword ptr [ebp+FFFFFEE0], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044677D(U)
|
:0044678E 83BDE0FEFFFF06          cmp dword ptr [ebp+FFFFFEE0], 00000006
:00446795 0F8316020000            jnb 004469B1
:0044679B 83BDE0FEFFFF01          cmp dword ptr [ebp+FFFFFEE0], 00000001
:004467A2 721A                    jb 004467BE
:004467A4 83BDE0FEFFFF02          cmp dword ptr [ebp+FFFFFEE0], 00000002
:004467AB 7711                    ja 004467BE
:004467AD 8B550C                  mov edx, dword ptr [ebp+0C]
:004467B0 8B4220                  mov eax, dword ptr [edx+20]
:004467B3 0345F0                  add eax, dword ptr [ebp-10]
:004467B6 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004467B9 894120                  mov dword ptr [ecx+20], eax
:004467BC EB28                    jmp 004467E6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004467A2(C), :004467AB(C)
|
:004467BE 83BDE0FEFFFF03          cmp dword ptr [ebp+FFFFFEE0], 00000003
:004467C5 721F                    jb 004467E6
:004467C7 83BDE0FEFFFF04          cmp dword ptr [ebp+FFFFFEE0], 00000004
:004467CE 7716                    ja 004467E6
:004467D0 8B45F0                  mov eax, dword ptr [ebp-10]
:004467D3 99                      cdq
:004467D4 2BC2                    sub eax, edx
:004467D6 D1F8                    sar eax, 1
:004467D8 8B550C                  mov edx, dword ptr [ebp+0C]
:004467DB 8B4A20                  mov ecx, dword ptr [edx+20]
:004467DE 03C8                    add ecx, eax
:004467E0 8B550C                  mov edx, dword ptr [ebp+0C]
:004467E3 894A20                  mov dword ptr [edx+20], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004467BC(U), :004467C5(C), :004467CE(C)
|
:004467E6 E8F07DFDFF              call 0041E5DB
:004467EB 6A01                    push 00000001
:004467ED 6A00                    push 00000000
:004467EF 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:004467F5 E8F3D2FFFF              call 00443AED
:004467FA 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:00446800 8985D0FEFFFF            mov dword ptr [ebp+FFFFFED0], eax
:00446806 83BDD0FEFFFF05          cmp dword ptr [ebp+FFFFFED0], 00000005
:0044680D 0F8783010000            ja 00446996
:00446813 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00446819 FF248DD3694400          jmp dword ptr [4*ecx+004469D3]
:00446820 6A01                    push 00000001
:00446822 6A1F                    push 0000001F
:00446824 B9B0694B00              mov ecx, 004B69B0
:00446829 E84CDE0200              call 0047467A
:0044682E 6800400000              push 00004000
:00446833 6A04                    push 00000004
:00446835 6A00                    push 00000000
:00446837 6800800100              push 00018000
:0044683C B9C8E44A00              mov ecx, 004AE4C8
:00446841 E8FA910300              call 0047FA40
:00446846 50                      push eax
:00446847 6A04                    push 00000004
:00446849 6A00                    push 00000000
:0044684B 6800400100              push 00014000
:00446850 B9C8E44A00              mov ecx, 004AE4C8
:00446855 E8E6910300              call 0047FA40
:0044685A 50                      push eax
:0044685B E89D940300              call 0047FCFD
:00446860 83C40C                  add esp, 0000000C
:00446863 6A0C                    push 0000000C
:00446865 6A60                    push 00000060
:00446867 6A60                    push 00000060
:00446869 6A04                    push 00000004
:0044686B 6A00                    push 00000000
:0044686D 6800800100              push 00018000
:00446872 B9C8E44A00              mov ecx, 004AE4C8
:00446877 E8C4910300              call 0047FA40
:0044687C 50                      push eax
:0044687D E83E9BFEFF              call 004303C0
:00446882 83C410                  add esp, 00000010
:00446885 8B550C                  mov edx, dword ptr [ebp+0C]
:00446888 52                      push edx
:00446889 6A04                    push 00000004
:0044688B 6A00                    push 00000000
:0044688D 6800800100              push 00018000
:00446892 B9C8E44A00              mov ecx, 004AE4C8
:00446897 E8A4910300              call 0047FA40
:0044689C 50                      push eax
:0044689D 6A60                    push 00000060
:0044689F 6A60                    push 00000060
:004468A1 8B85D4FEFFFF            mov eax, dword ptr [ebp+FFFFFED4]
:004468A7 8B8880000000            mov ecx, dword ptr [eax+00000080]
:004468AD 51                      push ecx
:004468AE 8B550C                  mov edx, dword ptr [ebp+0C]
:004468B1 8B4220                  mov eax, dword ptr [edx+20]
:004468B4 50                      push eax
:004468B5 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:004468BB E85DD3FFFF              call 00443C1D
:004468C0 8B4D08                  mov ecx, dword ptr [ebp+08]
:004468C3 51                      push ecx
:004468C4 6A04                    push 00000004
:004468C6 6A00                    push 00000000
:004468C8 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:004468CE 83C202                  add edx, 00000002
:004468D1 C1E20E                  shl edx, 0E
:004468D4 52                      push edx
:004468D5 B9C8E44A00              mov ecx, 004AE4C8
:004468DA E861910300              call 0047FA40
:004468DF 50                      push eax
:004468E0 6880000000              push 00000080
:004468E5 6880000000              push 00000080
:004468EA 8B85D4FEFFFF            mov eax, dword ptr [ebp+FFFFFED4]
:004468F0 8B8880000000            mov ecx, dword ptr [eax+00000080]
:004468F6 83E910                  sub ecx, 00000010
:004468F9 51                      push ecx
:004468FA 8B5508                  mov edx, dword ptr [ebp+08]
:004468FD 8B4220                  mov eax, dword ptr [edx+20]
:00446900 83E810                  sub eax, 00000010
:00446903 50                      push eax
:00446904 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:0044690A E80ED3FFFF              call 00443C1D
:0044690F E982000000              jmp 00446996
:00446914 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00446917 51                      push ecx
:00446918 6A04                    push 00000004
:0044691A 6A00                    push 00000000
:0044691C 6800400100              push 00014000
:00446921 B9C8E44A00              mov ecx, 004AE4C8
:00446926 E815910300              call 0047FA40
:0044692B 50                      push eax
:0044692C 6A60                    push 00000060
:0044692E 6A60                    push 00000060
:00446930 8B95D4FEFFFF            mov edx, dword ptr [ebp+FFFFFED4]
:00446936 8B8280000000            mov eax, dword ptr [edx+00000080]
:0044693C 50                      push eax
:0044693D 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00446940 8B5120                  mov edx, dword ptr [ecx+20]
:00446943 52                      push edx
:00446944 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:0044694A E8CED2FFFF              call 00443C1D
:0044694F 8B4508                  mov eax, dword ptr [ebp+08]
:00446952 50                      push eax
:00446953 6A04                    push 00000004
:00446955 6A00                    push 00000000
:00446957 6800C00000              push 0000C000
:0044695C B9C8E44A00              mov ecx, 004AE4C8
:00446961 E8DA900300              call 0047FA40
:00446966 50                      push eax
:00446967 6880000000              push 00000080
:0044696C 6880000000              push 00000080
:00446971 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:00446977 8B9180000000            mov edx, dword ptr [ecx+00000080]
:0044697D 83EA10                  sub edx, 00000010
:00446980 52                      push edx
:00446981 8B4508                  mov eax, dword ptr [ebp+08]
:00446984 8B4820                  mov ecx, dword ptr [eax+20]
:00446987 83E910                  sub ecx, 00000010
:0044698A 51                      push ecx
:0044698B 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:00446991 E887D2FFFF              call 00443C1D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044680D(C), :0044690F(U)
|
:00446996 E85B7CFDFF              call 0041E5F6
:0044699B 6A01                    push 00000001
:0044699D B9181B4B00              mov ecx, 004B1B18
:004469A2 E899C9FBFF              call 00403340
:004469A7 E8345BFEFF              call 0042C4E0
:004469AC E9CEFDFFFF              jmp 0044677F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446795(C)
|
:004469B1 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:004469B8 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:004469BE E80DC9FBFF              call 004032D0
:004469C3 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004469C6 64890D00000000          mov dword ptr fs:[00000000], ecx
:004469CD 8BE5                    mov esp, ebp
:004469CF 5D                      pop ebp
:004469D0 C20C00                  ret 000C



:004469D3 20684400                DWORD 00446820
:004469D7 20684400                DWORD 00446820
:004469DB 14694400                DWORD 00446914
:004469DF 14694400                DWORD 00446914
:004469E3 14694400                DWORD 00446914
:004469E7 14694400                DWORD 00446914



* Referenced by a CALL at Address:
|:00448446   
|
:004469EB 55                      push ebp
:004469EC 8BEC                    mov ebp, esp
:004469EE 6AFF                    push FFFFFFFF
:004469F0 6848554800              push 00485548
:004469F5 64A100000000            mov eax, dword ptr fs:[00000000]
:004469FB 50                      push eax
:004469FC 64892500000000          mov dword ptr fs:[00000000], esp
:00446A03 81EC24010000            sub esp, 00000124
:00446A09 898DD4FEFFFF            mov dword ptr [ebp+FFFFFED4], ecx
:00446A0F 8B450C                  mov eax, dword ptr [ebp+0C]
:00446A12 33C9                    xor ecx, ecx
:00446A14 8A480D                  mov cl, byte ptr [eax+0D]
:00446A17 51                      push ecx
:00446A18 8B550C                  mov edx, dword ptr [ebp+0C]
:00446A1B 8B4A04                  mov ecx, dword ptr [edx+04]
:00446A1E E82592FFFF              call 0043FC48
:00446A23 8885E0FEFFFF            mov byte ptr [ebp+FFFFFEE0], al
:00446A29 8B4508                  mov eax, dword ptr [ebp+08]
:00446A2C 33C9                    xor ecx, ecx
:00446A2E 8A480E                  mov cl, byte ptr [eax+0E]
:00446A31 83E901                  sub ecx, 00000001
:00446A34 F7D9                    neg ecx
:00446A36 1BC9                    sbb ecx, ecx
:00446A38 83E1B0                  and ecx, FFFFFFB0
:00446A3B 83C128                  add ecx, 00000028
:00446A3E 894DF0                  mov dword ptr [ebp-10], ecx
:00446A41 8B5508                  mov edx, dword ptr [ebp+08]
:00446A44 33C0                    xor eax, eax
:00446A46 8A420E                  mov al, byte ptr [edx+0E]
:00446A49 83E801                  sub eax, 00000001
:00446A4C F7D8                    neg eax
:00446A4E 1BC0                    sbb eax, eax
:00446A50 24E0                    and al, E0
:00446A52 83C010                  add eax, 00000010
:00446A55 8945EC                  mov dword ptr [ebp-14], eax
:00446A58 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:00446A5E E84DC8FBFF              call 004032B0
:00446A63 C745FC00000000          mov [ebp-04], 00000000
:00446A6A 6A04                    push 00000004
:00446A6C 6A00                    push 00000000
:00446A6E 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00446A71 33D2                    xor edx, edx
:00446A73 8A510D                  mov dl, byte ptr [ecx+0D]
:00446A76 69D200630000            imul edx, 00006300
:00446A7C 81C200240000            add edx, 00002400
:00446A82 52                      push edx
:00446A83 B980AB4A00              mov ecx, 004AAB80
:00446A88 E8B38F0300              call 0047FA40
:00446A8D 8985E4FEFFFF            mov dword ptr [ebp+FFFFFEE4], eax
:00446A93 6A04                    push 00000004
:00446A95 6A00                    push 00000000
:00446A97 6800000100              push 00010000
:00446A9C B9C8E44A00              mov ecx, 004AE4C8
:00446AA1 E89A8F0300              call 0047FA40
:00446AA6 8985D8FEFFFF            mov dword ptr [ebp+FFFFFED8], eax
:00446AAC 6A30                    push 00000030
:00446AAE 6A30                    push 00000030
:00446AB0 8B85D8FEFFFF            mov eax, dword ptr [ebp+FFFFFED8]
:00446AB6 50                      push eax
:00446AB7 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:00446ABD 51                      push ecx
:00446ABE E8B39FFEFF              call 00430A76
:00446AC3 83C410                  add esp, 00000010
:00446AC6 6A04                    push 00000004
:00446AC8 6A00                    push 00000000
:00446ACA 8B550C                  mov edx, dword ptr [ebp+0C]
:00446ACD 33C0                    xor eax, eax
:00446ACF 8A420D                  mov al, byte ptr [edx+0D]
:00446AD2 69C000630000            imul eax, 00006300
:00446AD8 05002D0000              add eax, 00002D00
:00446ADD 50                      push eax
:00446ADE B980AB4A00              mov ecx, 004AAB80
:00446AE3 E8588F0300              call 0047FA40
:00446AE8 8985E4FEFFFF            mov dword ptr [ebp+FFFFFEE4], eax
:00446AEE 6A04                    push 00000004
:00446AF0 6A00                    push 00000000
:00446AF2 6800400100              push 00014000
:00446AF7 B9C8E44A00              mov ecx, 004AE4C8
:00446AFC E83F8F0300              call 0047FA40
:00446B01 8985D8FEFFFF            mov dword ptr [ebp+FFFFFED8], eax
:00446B07 6A30                    push 00000030
:00446B09 6A30                    push 00000030
:00446B0B 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:00446B11 51                      push ecx
:00446B12 8B95E4FEFFFF            mov edx, dword ptr [ebp+FFFFFEE4]
:00446B18 52                      push edx
:00446B19 E8589FFEFF              call 00430A76
:00446B1E 83C410                  add esp, 00000010
:00446B21 8B4510                  mov eax, dword ptr [ebp+10]
:00446B24 50                      push eax
:00446B25 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00446B28 51                      push ecx
:00446B29 8B5508                  mov edx, dword ptr [ebp+08]
:00446B2C 52                      push edx
:00446B2D 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:00446B33 E8DCF2FFFF              call 00445E14
:00446B38 C785DCFEFFFF00000000    mov dword ptr [ebp+FFFFFEDC], 00000000
:00446B42 EB0F                    jmp 00446B53

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446D77(U)
|
:00446B44 8B85DCFEFFFF            mov eax, dword ptr [ebp+FFFFFEDC]
:00446B4A 83C001                  add eax, 00000001
:00446B4D 8985DCFEFFFF            mov dword ptr [ebp+FFFFFEDC], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446B42(U)
|
:00446B53 83BDDCFEFFFF06          cmp dword ptr [ebp+FFFFFEDC], 00000006
:00446B5A 0F831C020000            jnb 00446D7C
:00446B60 E8767AFDFF              call 0041E5DB
:00446B65 6A01                    push 00000001
:00446B67 6A00                    push 00000000
:00446B69 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:00446B6F E879CFFFFF              call 00443AED
:00446B74 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:00446B7A 898DD0FEFFFF            mov dword ptr [ebp+FFFFFED0], ecx
:00446B80 83BDD0FEFFFF05          cmp dword ptr [ebp+FFFFFED0], 00000005
:00446B87 0F87D4010000            ja 00446D61
:00446B8D 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:00446B93 FF24959E6D4400          jmp dword ptr [4*edx+00446D9E]
:00446B9A 6A01                    push 00000001

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:00446B9C 6A07                    push 00000007
:00446B9E B9B0694B00              mov ecx, 004B69B0
:00446BA3 E8D2DA0200              call 0047467A
:00446BA8 8B450C                  mov eax, dword ptr [ebp+0C]
:00446BAB 8B4820                  mov ecx, dword ptr [eax+20]
:00446BAE 034DF0                  add ecx, dword ptr [ebp-10]
:00446BB1 8B550C                  mov edx, dword ptr [ebp+0C]
:00446BB4 894A20                  mov dword ptr [edx+20], ecx
:00446BB7 8B450C                  mov eax, dword ptr [ebp+0C]
:00446BBA 50                      push eax
:00446BBB 6A04                    push 00000004
:00446BBD 6A00                    push 00000000
:00446BBF 6800000100              push 00010000
:00446BC4 B9C8E44A00              mov ecx, 004AE4C8
:00446BC9 E8728E0300              call 0047FA40
:00446BCE 50                      push eax
:00446BCF 6A60                    push 00000060
:00446BD1 6A60                    push 00000060
:00446BD3 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:00446BD9 8B9180000000            mov edx, dword ptr [ecx+00000080]
:00446BDF 52                      push edx
:00446BE0 8B450C                  mov eax, dword ptr [ebp+0C]
:00446BE3 8B4820                  mov ecx, dword ptr [eax+20]
:00446BE6 034DEC                  add ecx, dword ptr [ebp-14]
:00446BE9 51                      push ecx
:00446BEA 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:00446BF0 E828D0FFFF              call 00443C1D
:00446BF5 8B5508                  mov edx, dword ptr [ebp+08]
:00446BF8 52                      push edx
:00446BF9 6A04                    push 00000004
:00446BFB 6A00                    push 00000000
:00446BFD 8B85DCFEFFFF            mov eax, dword ptr [ebp+FFFFFEDC]
:00446C03 83C002                  add eax, 00000002
:00446C06 C1E00E                  shl eax, 0E
:00446C09 50                      push eax
:00446C0A B9C8E44A00              mov ecx, 004AE4C8
:00446C0F E82C8E0300              call 0047FA40
:00446C14 50                      push eax
:00446C15 6880000000              push 00000080
:00446C1A 6880000000              push 00000080
:00446C1F 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:00446C25 8B9180000000            mov edx, dword ptr [ecx+00000080]
:00446C2B 83EA10                  sub edx, 00000010
:00446C2E 52                      push edx
:00446C2F 8B4508                  mov eax, dword ptr [ebp+08]
:00446C32 8B4820                  mov ecx, dword ptr [eax+20]
:00446C35 83E910                  sub ecx, 00000010
:00446C38 51                      push ecx
:00446C39 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:00446C3F E8D9CFFFFF              call 00443C1D
:00446C44 E918010000              jmp 00446D61
:00446C49 8B550C                  mov edx, dword ptr [ebp+0C]
:00446C4C 8B4220                  mov eax, dword ptr [edx+20]
:00446C4F 0345EC                  add eax, dword ptr [ebp-14]
:00446C52 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00446C55 894120                  mov dword ptr [ecx+20], eax
:00446C58 8B550C                  mov edx, dword ptr [ebp+0C]
:00446C5B 52                      push edx
:00446C5C 6A04                    push 00000004
:00446C5E 6A00                    push 00000000
:00446C60 6800000100              push 00010000
:00446C65 B9C8E44A00              mov ecx, 004AE4C8
:00446C6A E8D18D0300              call 0047FA40
:00446C6F 50                      push eax
:00446C70 6A60                    push 00000060
:00446C72 6A60                    push 00000060
:00446C74 8B85D4FEFFFF            mov eax, dword ptr [ebp+FFFFFED4]
:00446C7A 8B8880000000            mov ecx, dword ptr [eax+00000080]
:00446C80 51                      push ecx
:00446C81 8B550C                  mov edx, dword ptr [ebp+0C]
:00446C84 8B4220                  mov eax, dword ptr [edx+20]
:00446C87 50                      push eax
:00446C88 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:00446C8E E88ACFFFFF              call 00443C1D
:00446C93 8B4D08                  mov ecx, dword ptr [ebp+08]
:00446C96 51                      push ecx
:00446C97 6A04                    push 00000004
:00446C99 6A00                    push 00000000
:00446C9B 6800C00000              push 0000C000
:00446CA0 B9C8E44A00              mov ecx, 004AE4C8
:00446CA5 E8968D0300              call 0047FA40
:00446CAA 50                      push eax
:00446CAB 6880000000              push 00000080
:00446CB0 6880000000              push 00000080
:00446CB5 8B95D4FEFFFF            mov edx, dword ptr [ebp+FFFFFED4]
:00446CBB 8B8280000000            mov eax, dword ptr [edx+00000080]
:00446CC1 83E810                  sub eax, 00000010
:00446CC4 50                      push eax
:00446CC5 8B4D08                  mov ecx, dword ptr [ebp+08]
:00446CC8 8B5120                  mov edx, dword ptr [ecx+20]
:00446CCB 83EA10                  sub edx, 00000010
:00446CCE 52                      push edx
:00446CCF 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:00446CD5 E843CFFFFF              call 00443C1D
:00446CDA E982000000              jmp 00446D61
:00446CDF 8B450C                  mov eax, dword ptr [ebp+0C]
:00446CE2 50                      push eax
:00446CE3 6A04                    push 00000004
:00446CE5 6A00                    push 00000000
:00446CE7 6800400100              push 00014000
:00446CEC B9C8E44A00              mov ecx, 004AE4C8
:00446CF1 E84A8D0300              call 0047FA40
:00446CF6 50                      push eax
:00446CF7 6A60                    push 00000060
:00446CF9 6A60                    push 00000060
:00446CFB 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:00446D01 8B9180000000            mov edx, dword ptr [ecx+00000080]
:00446D07 52                      push edx
:00446D08 8B450C                  mov eax, dword ptr [ebp+0C]
:00446D0B 8B4820                  mov ecx, dword ptr [eax+20]
:00446D0E 51                      push ecx
:00446D0F 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:00446D15 E803CFFFFF              call 00443C1D
:00446D1A 8B5508                  mov edx, dword ptr [ebp+08]
:00446D1D 52                      push edx
:00446D1E 6A04                    push 00000004
:00446D20 6A00                    push 00000000
:00446D22 6800C00000              push 0000C000
:00446D27 B9C8E44A00              mov ecx, 004AE4C8
:00446D2C E80F8D0300              call 0047FA40
:00446D31 50                      push eax
:00446D32 6880000000              push 00000080
:00446D37 6880000000              push 00000080
:00446D3C 8B85D4FEFFFF            mov eax, dword ptr [ebp+FFFFFED4]
:00446D42 8B8880000000            mov ecx, dword ptr [eax+00000080]
:00446D48 83E910                  sub ecx, 00000010
:00446D4B 51                      push ecx
:00446D4C 8B5508                  mov edx, dword ptr [ebp+08]
:00446D4F 8B4220                  mov eax, dword ptr [edx+20]
:00446D52 83E810                  sub eax, 00000010
:00446D55 50                      push eax
:00446D56 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:00446D5C E8BCCEFFFF              call 00443C1D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00446B87(C), :00446C44(U), :00446CDA(U)
|
:00446D61 E89078FDFF              call 0041E5F6
:00446D66 6A01                    push 00000001
:00446D68 B9181B4B00              mov ecx, 004B1B18
:00446D6D E8CEC5FBFF              call 00403340
:00446D72 E86957FEFF              call 0042C4E0
:00446D77 E9C8FDFFFF              jmp 00446B44

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446B5A(C)
|
:00446D7C C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00446D83 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:00446D89 E842C5FBFF              call 004032D0
:00446D8E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00446D91 64890D00000000          mov dword ptr fs:[00000000], ecx
:00446D98 8BE5                    mov esp, ebp
:00446D9A 5D                      pop ebp
:00446D9B C20C00                  ret 000C



:00446D9E 9A6B4400                DWORD 00446B9A
:00446DA2 9A6B4400                DWORD 00446B9A
:00446DA6 496C4400                DWORD 00446C49
:00446DAA DF6C4400                DWORD 00446CDF
:00446DAE DF6C4400                DWORD 00446CDF
:00446DB2 DF6C4400                DWORD 00446CDF



* Referenced by a CALL at Address:
|:0044845C   
|
:00446DB6 55                      push ebp
:00446DB7 8BEC                    mov ebp, esp
:00446DB9 6AFF                    push FFFFFFFF
:00446DBB 685E554800              push 0048555E
:00446DC0 64A100000000            mov eax, dword ptr fs:[00000000]
:00446DC6 50                      push eax
:00446DC7 64892500000000          mov dword ptr fs:[00000000], esp
:00446DCE 81EC20010000            sub esp, 00000120
:00446DD4 898DD8FEFFFF            mov dword ptr [ebp+FFFFFED8], ecx
:00446DDA 8B450C                  mov eax, dword ptr [ebp+0C]
:00446DDD 33C9                    xor ecx, ecx
:00446DDF 8A480D                  mov cl, byte ptr [eax+0D]
:00446DE2 51                      push ecx
:00446DE3 8B550C                  mov edx, dword ptr [ebp+0C]
:00446DE6 8B4A04                  mov ecx, dword ptr [edx+04]
:00446DE9 E85A8EFFFF              call 0043FC48
:00446DEE 8885E4FEFFFF            mov byte ptr [ebp+FFFFFEE4], al
:00446DF4 8B4508                  mov eax, dword ptr [ebp+08]
:00446DF7 33C9                    xor ecx, ecx
:00446DF9 8A480E                  mov cl, byte ptr [eax+0E]
:00446DFC 83E901                  sub ecx, 00000001
:00446DFF F7D9                    neg ecx
:00446E01 1BC9                    sbb ecx, ecx
:00446E03 81E180010000            and ecx, 00000180
:00446E09 81C140FFFFFF            add ecx, FFFFFF40
:00446E0F 894DF0                  mov dword ptr [ebp-10], ecx
:00446E12 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00446E18 E893C4FBFF              call 004032B0
:00446E1D C745FC00000000          mov [ebp-04], 00000000
:00446E24 6A04                    push 00000004
:00446E26 6A00                    push 00000000
:00446E28 8B550C                  mov edx, dword ptr [ebp+0C]
:00446E2B 33C0                    xor eax, eax
:00446E2D 8A420D                  mov al, byte ptr [edx+0D]
:00446E30 69C000630000            imul eax, 00006300
:00446E36 0500480000              add eax, 00004800
:00446E3B 50                      push eax
:00446E3C B980AB4A00              mov ecx, 004AAB80
:00446E41 E8FA8B0300              call 0047FA40
:00446E46 8985E8FEFFFF            mov dword ptr [ebp+FFFFFEE8], eax
:00446E4C 6A04                    push 00000004
:00446E4E 6A00                    push 00000000
:00446E50 6800000100              push 00010000
:00446E55 B9C8E44A00              mov ecx, 004AE4C8
:00446E5A E8E18B0300              call 0047FA40
:00446E5F 8985DCFEFFFF            mov dword ptr [ebp+FFFFFEDC], eax
:00446E65 6A30                    push 00000030
:00446E67 6A30                    push 00000030
:00446E69 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:00446E6F 51                      push ecx
:00446E70 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:00446E76 52                      push edx
:00446E77 E8FA9BFEFF              call 00430A76
:00446E7C 83C410                  add esp, 00000010
:00446E7F 8B4508                  mov eax, dword ptr [ebp+08]
:00446E82 33C9                    xor ecx, ecx
:00446E84 8A480E                  mov cl, byte ptr [eax+0E]
:00446E87 83F901                  cmp ecx, 00000001
:00446E8A 7516                    jne 00446EA2
:00446E8C 8B550C                  mov edx, dword ptr [ebp+0C]
:00446E8F C6420E01                mov [edx+0E], 01
:00446E93 6A01                    push 00000001
:00446E95 8B450C                  mov eax, dword ptr [ebp+0C]
:00446E98 8B4804                  mov ecx, dword ptr [eax+04]
:00446E9B E8948EFFFF              call 0043FD34
:00446EA0 EB14                    jmp 00446EB6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446E8A(C)
|
:00446EA2 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00446EA5 C6410E03                mov [ecx+0E], 03
:00446EA9 6A00                    push 00000000
:00446EAB 8B550C                  mov edx, dword ptr [ebp+0C]
:00446EAE 8B4A04                  mov ecx, dword ptr [edx+04]
:00446EB1 E87E8EFFFF              call 0043FD34

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446EA0(U)
|
:00446EB6 6A04                    push 00000004
:00446EB8 6A00                    push 00000000
:00446EBA 8B450C                  mov eax, dword ptr [ebp+0C]
:00446EBD 33C9                    xor ecx, ecx
:00446EBF 8A480D                  mov cl, byte ptr [eax+0D]
:00446EC2 69C900630000            imul ecx, 00006300
:00446EC8 81C100480000            add ecx, 00004800
:00446ECE 51                      push ecx
:00446ECF B980AB4A00              mov ecx, 004AAB80
:00446ED4 E8678B0300              call 0047FA40
:00446ED9 8985E8FEFFFF            mov dword ptr [ebp+FFFFFEE8], eax
:00446EDF 6A04                    push 00000004
:00446EE1 6A00                    push 00000000
:00446EE3 6800400100              push 00014000
:00446EE8 B9C8E44A00              mov ecx, 004AE4C8
:00446EED E84E8B0300              call 0047FA40
:00446EF2 8985DCFEFFFF            mov dword ptr [ebp+FFFFFEDC], eax
:00446EF8 6A30                    push 00000030
:00446EFA 6A30                    push 00000030
:00446EFC 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:00446F02 52                      push edx
:00446F03 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:00446F09 50                      push eax
:00446F0A E8679BFEFF              call 00430A76
:00446F0F 83C410                  add esp, 00000010
:00446F12 8B4D10                  mov ecx, dword ptr [ebp+10]
:00446F15 51                      push ecx
:00446F16 8B550C                  mov edx, dword ptr [ebp+0C]
:00446F19 52                      push edx
:00446F1A 8B4508                  mov eax, dword ptr [ebp+08]
:00446F1D 50                      push eax
:00446F1E 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:00446F24 E8EBEEFFFF              call 00445E14
:00446F29 C785E0FEFFFF00000000    mov dword ptr [ebp+FFFFFEE0], 00000000
:00446F33 EB0F                    jmp 00446F44

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004470E0(U)
|
:00446F35 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:00446F3B 83C101                  add ecx, 00000001
:00446F3E 898DE0FEFFFF            mov dword ptr [ebp+FFFFFEE0], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446F33(U)
|
:00446F44 83BDE0FEFFFF06          cmp dword ptr [ebp+FFFFFEE0], 00000006
:00446F4B 0F8394010000            jnb 004470E5
:00446F51 E88576FDFF              call 0041E5DB
:00446F56 6A01                    push 00000001
:00446F58 6A00                    push 00000000
:00446F5A 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:00446F60 E888CBFFFF              call 00443AED
:00446F65 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:00446F6B 8995D4FEFFFF            mov dword ptr [ebp+FFFFFED4], edx
:00446F71 83BDD4FEFFFF05          cmp dword ptr [ebp+FFFFFED4], 00000005
:00446F78 0F874C010000            ja 004470CA
:00446F7E 8B85D4FEFFFF            mov eax, dword ptr [ebp+FFFFFED4]
:00446F84 FF248507714400          jmp dword ptr [4*eax+00447107]
:00446F8B 6A01                    push 00000001

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:00446F8D 6A07                    push 00000007
:00446F8F B9B0694B00              mov ecx, 004B69B0
:00446F94 E8E1D60200              call 0047467A
:00446F99 8B4D08                  mov ecx, dword ptr [ebp+08]
:00446F9C 51                      push ecx
:00446F9D 6A04                    push 00000004
:00446F9F 6A00                    push 00000000
:00446FA1 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:00446FA7 83C202                  add edx, 00000002
:00446FAA C1E20E                  shl edx, 0E
:00446FAD 52                      push edx
:00446FAE B9C8E44A00              mov ecx, 004AE4C8
:00446FB3 E8888A0300              call 0047FA40
:00446FB8 50                      push eax
:00446FB9 6880000000              push 00000080
:00446FBE 6880000000              push 00000080
:00446FC3 8B85D8FEFFFF            mov eax, dword ptr [ebp+FFFFFED8]
:00446FC9 8B8880000000            mov ecx, dword ptr [eax+00000080]
:00446FCF 83E910                  sub ecx, 00000010
:00446FD2 51                      push ecx
:00446FD3 8B5508                  mov edx, dword ptr [ebp+08]
:00446FD6 8B4220                  mov eax, dword ptr [edx+20]
:00446FD9 83E810                  sub eax, 00000010
:00446FDC 50                      push eax
:00446FDD 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:00446FE3 E835CCFFFF              call 00443C1D
:00446FE8 E9DD000000              jmp 004470CA
:00446FED 8B4D08                  mov ecx, dword ptr [ebp+08]
:00446FF0 51                      push ecx
:00446FF1 6A04                    push 00000004
:00446FF3 6A00                    push 00000000
:00446FF5 6800C00000              push 0000C000
:00446FFA B9C8E44A00              mov ecx, 004AE4C8
:00446FFF E83C8A0300              call 0047FA40
:00447004 50                      push eax
:00447005 6880000000              push 00000080
:0044700A 6880000000              push 00000080
:0044700F 8B95D8FEFFFF            mov edx, dword ptr [ebp+FFFFFED8]
:00447015 8B8280000000            mov eax, dword ptr [edx+00000080]
:0044701B 83E810                  sub eax, 00000010
:0044701E 50                      push eax
:0044701F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00447022 8B5120                  mov edx, dword ptr [ecx+20]
:00447025 83EA10                  sub edx, 00000010
:00447028 52                      push edx
:00447029 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:0044702F E8E9CBFFFF              call 00443C1D
:00447034 E991000000              jmp 004470CA
:00447039 8B450C                  mov eax, dword ptr [ebp+0C]
:0044703C 8B4820                  mov ecx, dword ptr [eax+20]
:0044703F 034DF0                  add ecx, dword ptr [ebp-10]
:00447042 8B550C                  mov edx, dword ptr [ebp+0C]
:00447045 894A20                  mov dword ptr [edx+20], ecx
:00447048 8B4508                  mov eax, dword ptr [ebp+08]
:0044704B 50                      push eax
:0044704C 6A04                    push 00000004
:0044704E 6A00                    push 00000000
:00447050 6800C00000              push 0000C000
:00447055 B9C8E44A00              mov ecx, 004AE4C8
:0044705A E8E1890300              call 0047FA40
:0044705F 50                      push eax
:00447060 6880000000              push 00000080
:00447065 6880000000              push 00000080
:0044706A 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:00447070 8B9180000000            mov edx, dword ptr [ecx+00000080]
:00447076 83EA10                  sub edx, 00000010
:00447079 52                      push edx
:0044707A 8B4508                  mov eax, dword ptr [ebp+08]
:0044707D 8B4820                  mov ecx, dword ptr [eax+20]
:00447080 83E910                  sub ecx, 00000010
:00447083 51                      push ecx
:00447084 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:0044708A E88ECBFFFF              call 00443C1D
:0044708F 8B550C                  mov edx, dword ptr [ebp+0C]
:00447092 52                      push edx
:00447093 6A04                    push 00000004
:00447095 6A00                    push 00000000
:00447097 6800400100              push 00014000
:0044709C B9C8E44A00              mov ecx, 004AE4C8
:004470A1 E89A890300              call 0047FA40
:004470A6 50                      push eax
:004470A7 6A60                    push 00000060
:004470A9 6A60                    push 00000060
:004470AB 8B85D8FEFFFF            mov eax, dword ptr [ebp+FFFFFED8]
:004470B1 8B8880000000            mov ecx, dword ptr [eax+00000080]
:004470B7 51                      push ecx
:004470B8 8B550C                  mov edx, dword ptr [ebp+0C]
:004470BB 8B4220                  mov eax, dword ptr [edx+20]
:004470BE 50                      push eax
:004470BF 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:004470C5 E853CBFFFF              call 00443C1D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00446F78(C), :00446FE8(U), :00447034(U)
|
:004470CA E82775FDFF              call 0041E5F6
:004470CF 6A01                    push 00000001
:004470D1 B9181B4B00              mov ecx, 004B1B18
:004470D6 E865C2FBFF              call 00403340
:004470DB E80054FEFF              call 0042C4E0
:004470E0 E950FEFFFF              jmp 00446F35

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00446F4B(C)
|
:004470E5 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:004470EC 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:004470F2 E8D9C1FBFF              call 004032D0
:004470F7 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004470FA 64890D00000000          mov dword ptr fs:[00000000], ecx
:00447101 8BE5                    mov esp, ebp
:00447103 5D                      pop ebp
:00447104 C20C00                  ret 000C



:00447107 8B6F4400                DWORD 00446F8B
:0044710B 8B6F4400                DWORD 00446F8B
:0044710F ED6F4400                DWORD 00446FED
:00447113 ED6F4400                DWORD 00446FED
:00447117 ED6F4400                DWORD 00446FED
:0044711B 39704400                DWORD 00447039



* Referenced by a CALL at Address:
|:004484E5   
|
:0044711F 55                      push ebp
:00447120 8BEC                    mov ebp, esp
:00447122 6AFF                    push FFFFFFFF
:00447124 6874554800              push 00485574
:00447129 64A100000000            mov eax, dword ptr fs:[00000000]
:0044712F 50                      push eax
:00447130 64892500000000          mov dword ptr fs:[00000000], esp
:00447137 81EC28010000            sub esp, 00000128
:0044713D 898DD0FEFFFF            mov dword ptr [ebp+FFFFFED0], ecx
:00447143 8B450C                  mov eax, dword ptr [ebp+0C]
:00447146 33C9                    xor ecx, ecx
:00447148 8A480D                  mov cl, byte ptr [eax+0D]
:0044714B 51                      push ecx
:0044714C 8B550C                  mov edx, dword ptr [ebp+0C]
:0044714F 8B4A04                  mov ecx, dword ptr [edx+04]
:00447152 E8F18AFFFF              call 0043FC48
:00447157 8885E0FEFFFF            mov byte ptr [ebp+FFFFFEE0], al
:0044715D 8B4508                  mov eax, dword ptr [ebp+08]
:00447160 33C9                    xor ecx, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044711C(C)
|
:00447162 8A480E                  mov cl, byte ptr [eax+0E]
:00447165 83E901                  sub ecx, 00000001
:00447168 F7D9                    neg ecx
:0044716A 1BC9                    sbb ecx, ecx
:0044716C 83E1C0                  and ecx, FFFFFFC0
:0044716F 83C120                  add ecx, 00000020
:00447172 894DF0                  mov dword ptr [ebp-10], ecx
:00447175 8B5508                  mov edx, dword ptr [ebp+08]
:00447178 33C0                    xor eax, eax
:0044717A 8A420E                  mov al, byte ptr [edx+0E]
:0044717D 83E801                  sub eax, 00000001
:00447180 F7D8                    neg eax
:00447182 1BC0                    sbb eax, eax
:00447184 24C0                    and al, C0
:00447186 83C020                  add eax, 00000020
:00447189 8985E8FEFFFF            mov dword ptr [ebp+FFFFFEE8], eax
:0044718F 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00447195 E816C1FBFF              call 004032B0
:0044719A C745FC00000000          mov [ebp-04], 00000000

* Possible StringData Ref from Data Obj ->"UNIT_SPC.E5"
                                  |
:004471A1 68D0BB4800              push 0048BBD0
:004471A6 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:004471AC E88489FDFF              call 0041FB35
:004471B1 6A04                    push 00000004
:004471B3 6A00                    push 00000000
:004471B5 6800780300              push 00037800
:004471BA B9C8E44A00              mov ecx, 004AE4C8
:004471BF E87C880300              call 0047FA40
:004471C4 50                      push eax
:004471C5 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:004471CB 81E1FF000000            and ecx, 000000FF
:004471D1 51                      push ecx
:004471D2 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:004471D8 E8AC8AFDFF              call 0041FC89
:004471DD 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:004471E3 E8DD20FDFF              call 004192C5
:004471E8 6A04                    push 00000004
:004471EA 6A00                    push 00000000
:004471EC 6800000100              push 00010000
:004471F1 B9C8E44A00              mov ecx, 004AE4C8
:004471F6 E845880300              call 0047FA40
:004471FB 8985D8FEFFFF            mov dword ptr [ebp+FFFFFED8], eax
:00447201 837D1000                cmp dword ptr [ebp+10], 00000000
:00447205 7469                    je 00447270
:00447207 6A04                    push 00000004
:00447209 6A00                    push 00000000
:0044720B 68008A0300              push 00038A00
:00447210 B9C8E44A00              mov ecx, 004AE4C8
:00447215 E826880300              call 0047FA40
:0044721A 8985E4FEFFFF            mov dword ptr [ebp+FFFFFEE4], eax
:00447220 6A04                    push 00000004
:00447222 6A00                    push 00000000
:00447224 6800380400              push 00043800
:00447229 B9C8E44A00              mov ecx, 004AE4C8
:0044722E E80D880300              call 0047FA40
:00447233 8985D4FEFFFF            mov dword ptr [ebp+FFFFFED4], eax
:00447239 8B5508                  mov edx, dword ptr [ebp+08]
:0044723C 33C0                    xor eax, eax
:0044723E 8A420E                  mov al, byte ptr [edx+0E]
:00447241 83F801                  cmp eax, 00000001
:00447244 750E                    jne 00447254
:00447246 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:0044724C 898DD4FEFFFF            mov dword ptr [ebp+FFFFFED4], ecx
:00447252 EB1A                    jmp 0044726E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447244(C)
|
:00447254 8B95D4FEFFFF            mov edx, dword ptr [ebp+FFFFFED4]
:0044725A 52                      push edx
:0044725B 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:00447261 50                      push eax
:00447262 6A30                    push 00000030
:00447264 6A30                    push 00000030
:00447266 E8E87BFDFF              call 0041EE53
:0044726B 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447252(U)
|
:0044726E EB19                    jmp 00447289

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447205(C)
|
:00447270 6A04                    push 00000004
:00447272 6A00                    push 00000000
:00447274 6800930300              push 00039300
:00447279 B9C8E44A00              mov ecx, 004AE4C8
:0044727E E8BD870300              call 0047FA40
:00447283 8985D4FEFFFF            mov dword ptr [ebp+FFFFFED4], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044726E(U)
|
:00447289 6A30                    push 00000030
:0044728B 6A30                    push 00000030
:0044728D 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:00447293 51                      push ecx
:00447294 8B95D4FEFFFF            mov edx, dword ptr [ebp+FFFFFED4]
:0044729A 52                      push edx
:0044729B E8D697FEFF              call 00430A76
:004472A0 83C410                  add esp, 00000010
:004472A3 6A00                    push 00000000
:004472A5 8B450C                  mov eax, dword ptr [ebp+0C]
:004472A8 50                      push eax
:004472A9 8B4D08                  mov ecx, dword ptr [ebp+08]
:004472AC 51                      push ecx
:004472AD 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:004472B3 E85CEBFFFF              call 00445E14
:004472B8 C785DCFEFFFF00000000    mov dword ptr [ebp+FFFFFEDC], 00000000
:004472C2 EB0F                    jmp 004472D3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044757F(U)
|
:004472C4 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:004472CA 83C201                  add edx, 00000001
:004472CD 8995DCFEFFFF            mov dword ptr [ebp+FFFFFEDC], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004472C2(U)
|
:004472D3 83BDDCFEFFFF06          cmp dword ptr [ebp+FFFFFEDC], 00000006
:004472DA 0F83A4020000            jnb 00447584
:004472E0 E8F672FDFF              call 0041E5DB
:004472E5 6A01                    push 00000001
:004472E7 6A00                    push 00000000
:004472E9 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:004472EF E8F9C7FFFF              call 00443AED
:004472F4 8B85DCFEFFFF            mov eax, dword ptr [ebp+FFFFFEDC]
:004472FA 8985CCFEFFFF            mov dword ptr [ebp+FFFFFECC], eax
:00447300 83BDCCFEFFFF05          cmp dword ptr [ebp+FFFFFECC], 00000005
:00447307 0F875C020000            ja 00447569
:0044730D 8B8DCCFEFFFF            mov ecx, dword ptr [ebp+FFFFFECC]
:00447313 FF248DA6754400          jmp dword ptr [4*ecx+004475A6]
:0044731A 8B5508                  mov edx, dword ptr [ebp+08]
:0044731D 8B4220                  mov eax, dword ptr [edx+20]
:00447320 0385E8FEFFFF            add eax, dword ptr [ebp+FFFFFEE8]
:00447326 8B4D08                  mov ecx, dword ptr [ebp+08]
:00447329 894120                  mov dword ptr [ecx+20], eax
:0044732C 8B550C                  mov edx, dword ptr [ebp+0C]
:0044732F 8B4220                  mov eax, dword ptr [edx+20]
:00447332 0385E8FEFFFF            add eax, dword ptr [ebp+FFFFFEE8]
:00447338 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0044733B 894120                  mov dword ptr [ecx+20], eax
:0044733E 837D1000                cmp dword ptr [ebp+10], 00000000
:00447342 0F84A8000000            je 004473F0
:00447348 6A01                    push 00000001
:0044734A 6A1F                    push 0000001F
:0044734C B9B0694B00              mov ecx, 004B69B0
:00447351 E824D30200              call 0047467A
:00447356 6800400000              push 00004000
:0044735B 6A04                    push 00000004
:0044735D 6A00                    push 00000000
:0044735F 6800800100              push 00018000
:00447364 B9C8E44A00              mov ecx, 004AE4C8
:00447369 E8D2860300              call 0047FA40
:0044736E 50                      push eax
:0044736F 6A04                    push 00000004
:00447371 6A00                    push 00000000
:00447373 6800000100              push 00010000
:00447378 B9C8E44A00              mov ecx, 004AE4C8
:0044737D E8BE860300              call 0047FA40
:00447382 50                      push eax
:00447383 E875890300              call 0047FCFD
:00447388 83C40C                  add esp, 0000000C
:0044738B 6A0C                    push 0000000C
:0044738D 6A60                    push 00000060
:0044738F 6A60                    push 00000060
:00447391 6A04                    push 00000004
:00447393 6A00                    push 00000000
:00447395 6800800100              push 00018000
:0044739A B9C8E44A00              mov ecx, 004AE4C8
:0044739F E89C860300              call 0047FA40
:004473A4 50                      push eax
:004473A5 E81690FEFF              call 004303C0
:004473AA 83C410                  add esp, 00000010
:004473AD 8B550C                  mov edx, dword ptr [ebp+0C]
:004473B0 52                      push edx
:004473B1 6A04                    push 00000004
:004473B3 6A00                    push 00000000
:004473B5 6800800100              push 00018000
:004473BA B9C8E44A00              mov ecx, 004AE4C8
:004473BF E87C860300              call 0047FA40
:004473C4 50                      push eax
:004473C5 6A60                    push 00000060
:004473C7 6A60                    push 00000060
:004473C9 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:004473CF 8B8880000000            mov ecx, dword ptr [eax+00000080]
:004473D5 51                      push ecx
:004473D6 8B550C                  mov edx, dword ptr [ebp+0C]
:004473D9 8B4220                  mov eax, dword ptr [edx+20]
:004473DC 0345F0                  add eax, dword ptr [ebp-10]
:004473DF 50                      push eax
:004473E0 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:004473E6 E832C8FFFF              call 00443C1D
:004473EB E9A3000000              jmp 00447493

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447342(C)
|
:004473F0 6A01                    push 00000001
:004473F2 6A24                    push 00000024
:004473F4 B9B0694B00              mov ecx, 004B69B0
:004473F9 E87CD20200              call 0047467A
:004473FE 6800400000              push 00004000
:00447403 6A04                    push 00000004
:00447405 6A00                    push 00000000
:00447407 6800800100              push 00018000
:0044740C B9C8E44A00              mov ecx, 004AE4C8
:00447411 E82A860300              call 0047FA40
:00447416 50                      push eax
:00447417 6A04                    push 00000004
:00447419 6A00                    push 00000000
:0044741B 6800000100              push 00010000
:00447420 B9C8E44A00              mov ecx, 004AE4C8
:00447425 E816860300              call 0047FA40
:0044742A 50                      push eax
:0044742B E8CD880300              call 0047FCFD
:00447430 83C40C                  add esp, 0000000C
:00447433 6A0C                    push 0000000C
:00447435 6A60                    push 00000060
:00447437 6A60                    push 00000060
:00447439 6A04                    push 00000004
:0044743B 6A00                    push 00000000
:0044743D 6800800100              push 00018000
:00447442 B9C8E44A00              mov ecx, 004AE4C8
:00447447 E8F4850300              call 0047FA40
:0044744C 50                      push eax
:0044744D E86E8FFEFF              call 004303C0
:00447452 83C410                  add esp, 00000010
:00447455 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00447458 51                      push ecx
:00447459 6A04                    push 00000004
:0044745B 6A00                    push 00000000
:0044745D 6800800100              push 00018000
:00447462 B9C8E44A00              mov ecx, 004AE4C8
:00447467 E8D4850300              call 0047FA40
:0044746C 50                      push eax
:0044746D 6A60                    push 00000060
:0044746F 6A60                    push 00000060
:00447471 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:00447477 8B8280000000            mov eax, dword ptr [edx+00000080]
:0044747D 50                      push eax
:0044747E 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00447481 8B5120                  mov edx, dword ptr [ecx+20]
:00447484 0355F0                  add edx, dword ptr [ebp-10]
:00447487 52                      push edx
:00447488 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:0044748E E88AC7FFFF              call 00443C1D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004473EB(U)
|
:00447493 8B4508                  mov eax, dword ptr [ebp+08]
:00447496 50                      push eax
:00447497 6A04                    push 00000004
:00447499 6A00                    push 00000000
:0044749B 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:004474A1 83C102                  add ecx, 00000002
:004474A4 C1E10E                  shl ecx, 0E
:004474A7 51                      push ecx
:004474A8 B9C8E44A00              mov ecx, 004AE4C8
:004474AD E88E850300              call 0047FA40
:004474B2 50                      push eax
:004474B3 6880000000              push 00000080
:004474B8 6880000000              push 00000080
:004474BD 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:004474C3 8B8280000000            mov eax, dword ptr [edx+00000080]
:004474C9 83E810                  sub eax, 00000010
:004474CC 50                      push eax
:004474CD 8B4D08                  mov ecx, dword ptr [ebp+08]
:004474D0 8B5120                  mov edx, dword ptr [ecx+20]
:004474D3 83EA10                  sub edx, 00000010
:004474D6 52                      push edx
:004474D7 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:004474DD E83BC7FFFF              call 00443C1D
:004474E2 E982000000              jmp 00447569
:004474E7 8B450C                  mov eax, dword ptr [ebp+0C]
:004474EA 50                      push eax
:004474EB 6A04                    push 00000004
:004474ED 6A00                    push 00000000
:004474EF 6800000100              push 00010000
:004474F4 B9C8E44A00              mov ecx, 004AE4C8
:004474F9 E842850300              call 0047FA40
:004474FE 50                      push eax
:004474FF 6A60                    push 00000060
:00447501 6A60                    push 00000060
:00447503 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00447509 8B9180000000            mov edx, dword ptr [ecx+00000080]
:0044750F 52                      push edx
:00447510 8B450C                  mov eax, dword ptr [ebp+0C]
:00447513 8B4820                  mov ecx, dword ptr [eax+20]
:00447516 51                      push ecx
:00447517 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:0044751D E8FBC6FFFF              call 00443C1D
:00447522 8B5508                  mov edx, dword ptr [ebp+08]
:00447525 52                      push edx
:00447526 6A04                    push 00000004
:00447528 6A00                    push 00000000
:0044752A 6800C00000              push 0000C000
:0044752F B9C8E44A00              mov ecx, 004AE4C8
:00447534 E807850300              call 0047FA40
:00447539 50                      push eax
:0044753A 6880000000              push 00000080
:0044753F 6880000000              push 00000080
:00447544 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:0044754A 8B8880000000            mov ecx, dword ptr [eax+00000080]
:00447550 83E910                  sub ecx, 00000010
:00447553 51                      push ecx
:00447554 8B5508                  mov edx, dword ptr [ebp+08]
:00447557 8B4220                  mov eax, dword ptr [edx+20]
:0044755A 83E810                  sub eax, 00000010
:0044755D 50                      push eax
:0044755E 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00447564 E8B4C6FFFF              call 00443C1D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00447307(C), :004474E2(U)
|
:00447569 E88870FDFF              call 0041E5F6
:0044756E 6A01                    push 00000001
:00447570 B9181B4B00              mov ecx, 004B1B18
:00447575 E8C6BDFBFF              call 00403340
:0044757A E8614FFEFF              call 0042C4E0
:0044757F E940FDFFFF              jmp 004472C4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004472DA(C)
|
:00447584 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0044758B 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00447591 E83ABDFBFF              call 004032D0
:00447596 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00447599 64890D00000000          mov dword ptr fs:[00000000], ecx
:004475A0 8BE5                    mov esp, ebp
:004475A2 5D                      pop ebp
:004475A3 C20C00                  ret 000C



:004475A6 1A734400                DWORD 0044731A
:004475AA 3E734400                DWORD 0044733E
:004475AE E7744400                DWORD 004474E7
:004475B2 E7744400                DWORD 004474E7
:004475B6 E7744400                DWORD 004474E7
:004475BA E7744400                DWORD 004474E7



* Referenced by a CALL at Address:
|:00448507   
|
:004475BE 55                      push ebp
:004475BF 8BEC                    mov ebp, esp
:004475C1 6AFF                    push FFFFFFFF
:004475C3 688A554800              push 0048558A
:004475C8 64A100000000            mov eax, dword ptr fs:[00000000]
:004475CE 50                      push eax
:004475CF 64892500000000          mov dword ptr fs:[00000000], esp
:004475D6 81EC28010000            sub esp, 00000128
:004475DC 898DD0FEFFFF            mov dword ptr [ebp+FFFFFED0], ecx
:004475E2 8B450C                  mov eax, dword ptr [ebp+0C]
:004475E5 33C9                    xor ecx, ecx
:004475E7 8A480D                  mov cl, byte ptr [eax+0D]
:004475EA 51                      push ecx
:004475EB 8B550C                  mov edx, dword ptr [ebp+0C]
:004475EE 8B4A04                  mov ecx, dword ptr [edx+04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004475AB(C)
|
:004475F1 E85286FFFF              call 0043FC48
:004475F6 8885E0FEFFFF            mov byte ptr [ebp+FFFFFEE0], al
:004475FC 8B4508                  mov eax, dword ptr [ebp+08]
:004475FF 33C9                    xor ecx, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004475BB(C)
|
:00447601 8A480E                  mov cl, byte ptr [eax+0E]
:00447604 83E901                  sub ecx, 00000001
:00447607 F7D9                    neg ecx
:00447609 1BC9                    sbb ecx, ecx
:0044760B 83E1C0                  and ecx, FFFFFFC0
:0044760E 83C120                  add ecx, 00000020
:00447611 894DF0                  mov dword ptr [ebp-10], ecx
:00447614 8B5508                  mov edx, dword ptr [ebp+08]
:00447617 33C0                    xor eax, eax
:00447619 8A420E                  mov al, byte ptr [edx+0E]
:0044761C 83E801                  sub eax, 00000001
:0044761F F7D8                    neg eax
:00447621 1BC0                    sbb eax, eax
:00447623 2480                    and al, 80
:00447625 83C040                  add eax, 00000040
:00447628 8985E8FEFFFF            mov dword ptr [ebp+FFFFFEE8], eax
:0044762E 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00447634 E877BCFBFF              call 004032B0
:00447639 C745FC00000000          mov [ebp-04], 00000000

* Possible StringData Ref from Data Obj ->"UNIT_SPC.E5"
                                  |
:00447640 68D0BB4800              push 0048BBD0
:00447645 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0044764B E8E584FDFF              call 0041FB35
:00447650 6A04                    push 00000004
:00447652 6A00                    push 00000000
:00447654 6800780300              push 00037800
:00447659 B9C8E44A00              mov ecx, 004AE4C8
:0044765E E8DD830300              call 0047FA40
:00447663 50                      push eax
:00447664 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:0044766A 81E1FF000000            and ecx, 000000FF
:00447670 51                      push ecx
:00447671 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00447677 E80D86FDFF              call 0041FC89
:0044767C 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00447682 E83E1CFDFF              call 004192C5
:00447687 6A04                    push 00000004
:00447689 6A00                    push 00000000
:0044768B 6800000100              push 00010000
:00447690 B9C8E44A00              mov ecx, 004AE4C8
:00447695 E8A6830300              call 0047FA40
:0044769A 8985D8FEFFFF            mov dword ptr [ebp+FFFFFED8], eax
:004476A0 837D1000                cmp dword ptr [ebp+10], 00000000
:004476A4 7469                    je 0044770F
:004476A6 6A04                    push 00000004
:004476A8 6A00                    push 00000000
:004476AA 68008A0300              push 00038A00
:004476AF B9C8E44A00              mov ecx, 004AE4C8
:004476B4 E887830300              call 0047FA40
:004476B9 8985E4FEFFFF            mov dword ptr [ebp+FFFFFEE4], eax
:004476BF 6A04                    push 00000004
:004476C1 6A00                    push 00000000
:004476C3 6800380400              push 00043800
:004476C8 B9C8E44A00              mov ecx, 004AE4C8
:004476CD E86E830300              call 0047FA40
:004476D2 8985D4FEFFFF            mov dword ptr [ebp+FFFFFED4], eax
:004476D8 8B5508                  mov edx, dword ptr [ebp+08]
:004476DB 33C0                    xor eax, eax
:004476DD 8A420E                  mov al, byte ptr [edx+0E]
:004476E0 83F801                  cmp eax, 00000001
:004476E3 750E                    jne 004476F3
:004476E5 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:004476EB 898DD4FEFFFF            mov dword ptr [ebp+FFFFFED4], ecx
:004476F1 EB1A                    jmp 0044770D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004476E3(C)
|
:004476F3 8B95D4FEFFFF            mov edx, dword ptr [ebp+FFFFFED4]
:004476F9 52                      push edx
:004476FA 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:00447700 50                      push eax
:00447701 6A30                    push 00000030
:00447703 6A30                    push 00000030
:00447705 E84977FDFF              call 0041EE53
:0044770A 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004476F1(U)
|
:0044770D EB19                    jmp 00447728

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004476A4(C)
|
:0044770F 6A04                    push 00000004
:00447711 6A00                    push 00000000
:00447713 6800930300              push 00039300
:00447718 B9C8E44A00              mov ecx, 004AE4C8
:0044771D E81E830300              call 0047FA40
:00447722 8985D4FEFFFF            mov dword ptr [ebp+FFFFFED4], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044770D(U)
|
:00447728 6A30                    push 00000030
:0044772A 6A30                    push 00000030
:0044772C 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:00447732 51                      push ecx
:00447733 8B95D4FEFFFF            mov edx, dword ptr [ebp+FFFFFED4]
:00447739 52                      push edx
:0044773A E83793FEFF              call 00430A76
:0044773F 83C410                  add esp, 00000010
:00447742 C785DCFEFFFF00000000    mov dword ptr [ebp+FFFFFEDC], 00000000
:0044774C EB0F                    jmp 0044775D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447FBD(U)
|
:0044774E 8B85DCFEFFFF            mov eax, dword ptr [ebp+FFFFFEDC]
:00447754 83C001                  add eax, 00000001
:00447757 8985DCFEFFFF            mov dword ptr [ebp+FFFFFEDC], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044774C(U)
|
:0044775D 83BDDCFEFFFF08          cmp dword ptr [ebp+FFFFFEDC], 00000008
:00447764 0F8358080000            jnb 00447FC2
:0044776A E86C6EFDFF              call 0041E5DB
:0044776F 6A01                    push 00000001
:00447771 6A00                    push 00000000
:00447773 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00447779 E86FC3FFFF              call 00443AED
:0044777E 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:00447784 898DCCFEFFFF            mov dword ptr [ebp+FFFFFECC], ecx
:0044778A 83BDCCFEFFFF07          cmp dword ptr [ebp+FFFFFECC], 00000007
:00447791 0F8710080000            ja 00447FA7
:00447797 8B95CCFEFFFF            mov edx, dword ptr [ebp+FFFFFECC]
:0044779D FF2495E47F4400          jmp dword ptr [4*edx+00447FE4]
:004477A4 6A00                    push 00000000
:004477A6 8B450C                  mov eax, dword ptr [ebp+0C]
:004477A9 50                      push eax
:004477AA 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:004477B0 E838C3FFFF              call 00443AED
:004477B5 8B4D08                  mov ecx, dword ptr [ebp+08]
:004477B8 51                      push ecx
:004477B9 6A04                    push 00000004
:004477BB 6A00                    push 00000000
:004477BD 6A00                    push 00000000
:004477BF B9C8E44A00              mov ecx, 004AE4C8
:004477C4 E877820300              call 0047FA40
:004477C9 50                      push eax
:004477CA 6880000000              push 00000080
:004477CF 6880000000              push 00000080
:004477D4 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:004477DA 8B8280000000            mov eax, dword ptr [edx+00000080]
:004477E0 83E810                  sub eax, 00000010
:004477E3 50                      push eax
:004477E4 8B4D08                  mov ecx, dword ptr [ebp+08]
:004477E7 8B5120                  mov edx, dword ptr [ecx+20]
:004477EA 83EA10                  sub edx, 00000010
:004477ED 52                      push edx
:004477EE 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:004477F4 E824C4FFFF              call 00443C1D
:004477F9 8B4508                  mov eax, dword ptr [ebp+08]
:004477FC 50                      push eax
:004477FD 6A04                    push 00000004
:004477FF 6A00                    push 00000000
:00447801 6A00                    push 00000000
:00447803 B9C8E44A00              mov ecx, 004AE4C8
:00447808 E833820300              call 0047FA40
:0044780D 50                      push eax
:0044780E 6880000000              push 00000080
:00447813 6880000000              push 00000080
:00447818 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:0044781E 8B9180000000            mov edx, dword ptr [ecx+00000080]
:00447824 83EA10                  sub edx, 00000010
:00447827 52                      push edx
:00447828 8B4508                  mov eax, dword ptr [ebp+08]
:0044782B 8B4820                  mov ecx, dword ptr [eax+20]
:0044782E 8B55F0                  mov edx, dword ptr [ebp-10]
:00447831 8D4411F0                lea eax, dword ptr [ecx+edx-10]
:00447835 50                      push eax
:00447836 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:0044783C E8DCC3FFFF              call 00443C1D
:00447841 8B4D08                  mov ecx, dword ptr [ebp+08]
:00447844 8B5120                  mov edx, dword ptr [ecx+20]
:00447847 0395E8FEFFFF            add edx, dword ptr [ebp+FFFFFEE8]
:0044784D 8B4508                  mov eax, dword ptr [ebp+08]
:00447850 895020                  mov dword ptr [eax+20], edx
:00447853 8B4D08                  mov ecx, dword ptr [ebp+08]
:00447856 51                      push ecx
:00447857 6A04                    push 00000004
:00447859 6A00                    push 00000000
:0044785B 6A00                    push 00000000
:0044785D B9C8E44A00              mov ecx, 004AE4C8
:00447862 E8D9810300              call 0047FA40
:00447867 50                      push eax
:00447868 6880000000              push 00000080
:0044786D 6880000000              push 00000080
:00447872 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:00447878 8B8280000000            mov eax, dword ptr [edx+00000080]
:0044787E 83E810                  sub eax, 00000010
:00447881 50                      push eax
:00447882 8B4D08                  mov ecx, dword ptr [ebp+08]
:00447885 8B5120                  mov edx, dword ptr [ecx+20]
:00447888 83EA10                  sub edx, 00000010
:0044788B 52                      push edx
:0044788C 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00447892 E886C3FFFF              call 00443C1D
:00447897 E90B070000              jmp 00447FA7
:0044789C 6A00                    push 00000000
:0044789E 8B450C                  mov eax, dword ptr [ebp+0C]
:004478A1 50                      push eax
:004478A2 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:004478A8 E840C2FFFF              call 00443AED
:004478AD 8B4D08                  mov ecx, dword ptr [ebp+08]
:004478B0 51                      push ecx
:004478B1 6A04                    push 00000004
:004478B3 6A00                    push 00000000
:004478B5 6A00                    push 00000000
:004478B7 B9C8E44A00              mov ecx, 004AE4C8
:004478BC E87F810300              call 0047FA40
:004478C1 50                      push eax
:004478C2 6880000000              push 00000080
:004478C7 6880000000              push 00000080
:004478CC 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:004478D2 8B8280000000            mov eax, dword ptr [edx+00000080]
:004478D8 83E810                  sub eax, 00000010
:004478DB 50                      push eax
:004478DC 8B4D08                  mov ecx, dword ptr [ebp+08]
:004478DF 8B5120                  mov edx, dword ptr [ecx+20]
:004478E2 83EA10                  sub edx, 00000010
:004478E5 2B95E8FEFFFF            sub edx, dword ptr [ebp+FFFFFEE8]
:004478EB 52                      push edx
:004478EC 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:004478F2 E826C3FFFF              call 00443C1D
:004478F7 8B4508                  mov eax, dword ptr [ebp+08]
:004478FA 50                      push eax
:004478FB 6A04                    push 00000004
:004478FD 6A00                    push 00000000
:004478FF 6A00                    push 00000000
:00447901 B9C8E44A00              mov ecx, 004AE4C8
:00447906 E835810300              call 0047FA40
:0044790B 50                      push eax
:0044790C 6880000000              push 00000080
:00447911 6880000000              push 00000080
:00447916 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:0044791C 8B9180000000            mov edx, dword ptr [ecx+00000080]
:00447922 83EA10                  sub edx, 00000010
:00447925 52                      push edx
:00447926 8B4508                  mov eax, dword ptr [ebp+08]
:00447929 8B4820                  mov ecx, dword ptr [eax+20]
:0044792C 83E910                  sub ecx, 00000010
:0044792F 2B8DE8FEFFFF            sub ecx, dword ptr [ebp+FFFFFEE8]
:00447935 034DF0                  add ecx, dword ptr [ebp-10]
:00447938 51                      push ecx
:00447939 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:0044793F E8D9C2FFFF              call 00443C1D
:00447944 8B5508                  mov edx, dword ptr [ebp+08]
:00447947 52                      push edx
:00447948 6A04                    push 00000004
:0044794A 6A00                    push 00000000
:0044794C 6800400000              push 00004000
:00447951 B9C8E44A00              mov ecx, 004AE4C8
:00447956 E8E5800300              call 0047FA40
:0044795B 50                      push eax
:0044795C 6880000000              push 00000080
:00447961 6880000000              push 00000080
:00447966 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:0044796C 8B8880000000            mov ecx, dword ptr [eax+00000080]
:00447972 83E910                  sub ecx, 00000010
:00447975 51                      push ecx
:00447976 8B5508                  mov edx, dword ptr [ebp+08]
:00447979 8B4220                  mov eax, dword ptr [edx+20]
:0044797C 83E810                  sub eax, 00000010
:0044797F 50                      push eax
:00447980 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00447986 E892C2FFFF              call 00443C1D
:0044798B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044798E 51                      push ecx
:0044798F 6A04                    push 00000004
:00447991 6A00                    push 00000000
:00447993 6800400000              push 00004000
:00447998 B9C8E44A00              mov ecx, 004AE4C8
:0044799D E89E800300              call 0047FA40
:004479A2 50                      push eax
:004479A3 6880000000              push 00000080
:004479A8 6880000000              push 00000080
:004479AD 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:004479B3 8B8280000000            mov eax, dword ptr [edx+00000080]
:004479B9 83E810                  sub eax, 00000010
:004479BC 50                      push eax
:004479BD 8B4D08                  mov ecx, dword ptr [ebp+08]
:004479C0 8B5120                  mov edx, dword ptr [ecx+20]
:004479C3 8B45F0                  mov eax, dword ptr [ebp-10]
:004479C6 8D4C02F0                lea ecx, dword ptr [edx+eax-10]
:004479CA 51                      push ecx
:004479CB 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:004479D1 E847C2FFFF              call 00443C1D
:004479D6 8B5508                  mov edx, dword ptr [ebp+08]
:004479D9 8B4220                  mov eax, dword ptr [edx+20]
:004479DC 0385E8FEFFFF            add eax, dword ptr [ebp+FFFFFEE8]
:004479E2 8B4D08                  mov ecx, dword ptr [ebp+08]
:004479E5 894120                  mov dword ptr [ecx+20], eax
:004479E8 8B5508                  mov edx, dword ptr [ebp+08]
:004479EB 52                      push edx
:004479EC 6A04                    push 00000004
:004479EE 6A00                    push 00000000
:004479F0 6800400000              push 00004000
:004479F5 B9C8E44A00              mov ecx, 004AE4C8
:004479FA E841800300              call 0047FA40
:004479FF 50                      push eax
:00447A00 6880000000              push 00000080
:00447A05 6880000000              push 00000080
:00447A0A 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:00447A10 8B8880000000            mov ecx, dword ptr [eax+00000080]
:00447A16 83E910                  sub ecx, 00000010
:00447A19 51                      push ecx
:00447A1A 8B5508                  mov edx, dword ptr [ebp+08]
:00447A1D 8B4220                  mov eax, dword ptr [edx+20]
:00447A20 83E810                  sub eax, 00000010
:00447A23 50                      push eax
:00447A24 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00447A2A E8EEC1FFFF              call 00443C1D
:00447A2F E973050000              jmp 00447FA7
:00447A34 837D1000                cmp dword ptr [ebp+10], 00000000
:00447A38 7451                    je 00447A8B
:00447A3A 6A01                    push 00000001
:00447A3C 6A1F                    push 0000001F
:00447A3E B9B0694B00              mov ecx, 004B69B0
:00447A43 E832CC0200              call 0047467A
:00447A48 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00447A4B 51                      push ecx
:00447A4C 6A04                    push 00000004
:00447A4E 6A00                    push 00000000
:00447A50 6800000100              push 00010000
:00447A55 B9C8E44A00              mov ecx, 004AE4C8
:00447A5A E8E17F0300              call 0047FA40
:00447A5F 50                      push eax
:00447A60 6A60                    push 00000060
:00447A62 6A60                    push 00000060
:00447A64 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:00447A6A 8B8280000000            mov eax, dword ptr [edx+00000080]
:00447A70 50                      push eax
:00447A71 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00447A74 8B5120                  mov edx, dword ptr [ecx+20]
:00447A77 0355F0                  add edx, dword ptr [ebp-10]
:00447A7A 52                      push edx
:00447A7B 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00447A81 E897C1FFFF              call 00443C1D
:00447A86 E9A3000000              jmp 00447B2E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447A38(C)
|
:00447A8B 6A01                    push 00000001
:00447A8D 6A24                    push 00000024
:00447A8F B9B0694B00              mov ecx, 004B69B0
:00447A94 E8E1CB0200              call 0047467A
:00447A99 6800400000              push 00004000
:00447A9E 6A04                    push 00000004
:00447AA0 6A00                    push 00000000
:00447AA2 6800800100              push 00018000
:00447AA7 B9C8E44A00              mov ecx, 004AE4C8
:00447AAC E88F7F0300              call 0047FA40
:00447AB1 50                      push eax
:00447AB2 6A04                    push 00000004
:00447AB4 6A00                    push 00000000
:00447AB6 6800000100              push 00010000
:00447ABB B9C8E44A00              mov ecx, 004AE4C8
:00447AC0 E87B7F0300              call 0047FA40
:00447AC5 50                      push eax
:00447AC6 E832820300              call 0047FCFD
:00447ACB 83C40C                  add esp, 0000000C
:00447ACE 6A0C                    push 0000000C
:00447AD0 6A60                    push 00000060
:00447AD2 6A60                    push 00000060
:00447AD4 6A04                    push 00000004
:00447AD6 6A00                    push 00000000
:00447AD8 6800800100              push 00018000
:00447ADD B9C8E44A00              mov ecx, 004AE4C8
:00447AE2 E8597F0300              call 0047FA40
:00447AE7 50                      push eax
:00447AE8 E8D388FEFF              call 004303C0
:00447AED 83C410                  add esp, 00000010
:00447AF0 8B450C                  mov eax, dword ptr [ebp+0C]
:00447AF3 50                      push eax
:00447AF4 6A04                    push 00000004
:00447AF6 6A00                    push 00000000
:00447AF8 6800800100              push 00018000
:00447AFD B9C8E44A00              mov ecx, 004AE4C8
:00447B02 E8397F0300              call 0047FA40
:00447B07 50                      push eax
:00447B08 6A60                    push 00000060
:00447B0A 6A60                    push 00000060
:00447B0C 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00447B12 8B9180000000            mov edx, dword ptr [ecx+00000080]
:00447B18 52                      push edx
:00447B19 8B450C                  mov eax, dword ptr [ebp+0C]
:00447B1C 8B4820                  mov ecx, dword ptr [eax+20]
:00447B1F 034DF0                  add ecx, dword ptr [ebp-10]
:00447B22 51                      push ecx
:00447B23 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00447B29 E8EFC0FFFF              call 00443C1D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447A86(U)
|
:00447B2E 8B5508                  mov edx, dword ptr [ebp+08]
:00447B31 52                      push edx
:00447B32 6A04                    push 00000004
:00447B34 6A00                    push 00000000
:00447B36 6A00                    push 00000000
:00447B38 B9C8E44A00              mov ecx, 004AE4C8
:00447B3D E8FE7E0300              call 0047FA40
:00447B42 50                      push eax
:00447B43 6880000000              push 00000080
:00447B48 6880000000              push 00000080
:00447B4D 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:00447B53 8B8880000000            mov ecx, dword ptr [eax+00000080]
:00447B59 83E910                  sub ecx, 00000010
:00447B5C 51                      push ecx
:00447B5D 8B5508                  mov edx, dword ptr [ebp+08]
:00447B60 8B4220                  mov eax, dword ptr [edx+20]
:00447B63 83E810                  sub eax, 00000010
:00447B66 2B85E8FEFFFF            sub eax, dword ptr [ebp+FFFFFEE8]
:00447B6C 2B85E8FEFFFF            sub eax, dword ptr [ebp+FFFFFEE8]
:00447B72 50                      push eax
:00447B73 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00447B79 E89FC0FFFF              call 00443C1D
:00447B7E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00447B81 51                      push ecx
:00447B82 6A04                    push 00000004
:00447B84 6A00                    push 00000000
:00447B86 6A00                    push 00000000
:00447B88 B9C8E44A00              mov ecx, 004AE4C8
:00447B8D E8AE7E0300              call 0047FA40
:00447B92 50                      push eax
:00447B93 6880000000              push 00000080
:00447B98 6880000000              push 00000080
:00447B9D 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:00447BA3 8B8280000000            mov eax, dword ptr [edx+00000080]
:00447BA9 83E810                  sub eax, 00000010
:00447BAC 50                      push eax
:00447BAD 8B4D08                  mov ecx, dword ptr [ebp+08]
:00447BB0 8B5120                  mov edx, dword ptr [ecx+20]
:00447BB3 83EA10                  sub edx, 00000010
:00447BB6 2B95E8FEFFFF            sub edx, dword ptr [ebp+FFFFFEE8]
:00447BBC 2B95E8FEFFFF            sub edx, dword ptr [ebp+FFFFFEE8]
:00447BC2 0355F0                  add edx, dword ptr [ebp-10]
:00447BC5 52                      push edx
:00447BC6 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00447BCC E84CC0FFFF              call 00443C1D
:00447BD1 8B4508                  mov eax, dword ptr [ebp+08]
:00447BD4 50                      push eax
:00447BD5 6A04                    push 00000004
:00447BD7 6A00                    push 00000000
:00447BD9 6800400000              push 00004000
:00447BDE B9C8E44A00              mov ecx, 004AE4C8
:00447BE3 E8587E0300              call 0047FA40
:00447BE8 50                      push eax
:00447BE9 6880000000              push 00000080
:00447BEE 6880000000              push 00000080
:00447BF3 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00447BF9 8B9180000000            mov edx, dword ptr [ecx+00000080]
:00447BFF 83EA10                  sub edx, 00000010
:00447C02 52                      push edx
:00447C03 8B4508                  mov eax, dword ptr [ebp+08]
:00447C06 8B4820                  mov ecx, dword ptr [eax+20]
:00447C09 83E910                  sub ecx, 00000010
:00447C0C 2B8DE8FEFFFF            sub ecx, dword ptr [ebp+FFFFFEE8]
:00447C12 51                      push ecx
:00447C13 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00447C19 E8FFBFFFFF              call 00443C1D
:00447C1E 8B5508                  mov edx, dword ptr [ebp+08]
:00447C21 52                      push edx
:00447C22 6A04                    push 00000004
:00447C24 6A00                    push 00000000
:00447C26 6800400000              push 00004000
:00447C2B B9C8E44A00              mov ecx, 004AE4C8
:00447C30 E80B7E0300              call 0047FA40
:00447C35 50                      push eax
:00447C36 6880000000              push 00000080
:00447C3B 6880000000              push 00000080
:00447C40 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:00447C46 8B8880000000            mov ecx, dword ptr [eax+00000080]
:00447C4C 83E910                  sub ecx, 00000010
:00447C4F 51                      push ecx
:00447C50 8B5508                  mov edx, dword ptr [ebp+08]
:00447C53 8B4220                  mov eax, dword ptr [edx+20]
:00447C56 83E810                  sub eax, 00000010
:00447C59 2B85E8FEFFFF            sub eax, dword ptr [ebp+FFFFFEE8]
:00447C5F 0345F0                  add eax, dword ptr [ebp-10]
:00447C62 50                      push eax
:00447C63 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00447C69 E8AFBFFFFF              call 00443C1D
:00447C6E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00447C71 51                      push ecx
:00447C72 6A04                    push 00000004
:00447C74 6A00                    push 00000000
:00447C76 6800800000              push 00008000
:00447C7B B9C8E44A00              mov ecx, 004AE4C8
:00447C80 E8BB7D0300              call 0047FA40
:00447C85 50                      push eax
:00447C86 6880000000              push 00000080
:00447C8B 6880000000              push 00000080
:00447C90 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:00447C96 8B8280000000            mov eax, dword ptr [edx+00000080]
:00447C9C 83E810                  sub eax, 00000010
:00447C9F 50                      push eax
:00447CA0 8B4D08                  mov ecx, dword ptr [ebp+08]
:00447CA3 8B5120                  mov edx, dword ptr [ecx+20]
:00447CA6 83EA10                  sub edx, 00000010
:00447CA9 52                      push edx
:00447CAA 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00447CB0 E868BFFFFF              call 00443C1D
:00447CB5 8B4508                  mov eax, dword ptr [ebp+08]
:00447CB8 50                      push eax
:00447CB9 6A04                    push 00000004
:00447CBB 6A00                    push 00000000
:00447CBD 6800800000              push 00008000
:00447CC2 B9C8E44A00              mov ecx, 004AE4C8
:00447CC7 E8747D0300              call 0047FA40
:00447CCC 50                      push eax
:00447CCD 6880000000              push 00000080
:00447CD2 6880000000              push 00000080
:00447CD7 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00447CDD 8B9180000000            mov edx, dword ptr [ecx+00000080]
:00447CE3 83EA10                  sub edx, 00000010
:00447CE6 52                      push edx
:00447CE7 8B4508                  mov eax, dword ptr [ebp+08]
:00447CEA 8B4820                  mov ecx, dword ptr [eax+20]
:00447CED 8B55F0                  mov edx, dword ptr [ebp-10]
:00447CF0 8D4411F0                lea eax, dword ptr [ecx+edx-10]
:00447CF4 50                      push eax
:00447CF5 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00447CFB E81DBFFFFF              call 00443C1D
:00447D00 8B4D08                  mov ecx, dword ptr [ebp+08]
:00447D03 8B5120                  mov edx, dword ptr [ecx+20]
:00447D06 0395E8FEFFFF            add edx, dword ptr [ebp+FFFFFEE8]
:00447D0C 8B4508                  mov eax, dword ptr [ebp+08]
:00447D0F 895020                  mov dword ptr [eax+20], edx
:00447D12 8B4D08                  mov ecx, dword ptr [ebp+08]
:00447D15 51                      push ecx
:00447D16 6A04                    push 00000004
:00447D18 6A00                    push 00000000
:00447D1A 6800800000              push 00008000
:00447D1F B9C8E44A00              mov ecx, 004AE4C8
:00447D24 E8177D0300              call 0047FA40
:00447D29 50                      push eax
:00447D2A 6880000000              push 00000080
:00447D2F 6880000000              push 00000080
:00447D34 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:00447D3A 8B8280000000            mov eax, dword ptr [edx+00000080]
:00447D40 83E810                  sub eax, 00000010
:00447D43 50                      push eax
:00447D44 8B4D08                  mov ecx, dword ptr [ebp+08]
:00447D47 8B5120                  mov edx, dword ptr [ecx+20]
:00447D4A 83EA10                  sub edx, 00000010
:00447D4D 52                      push edx
:00447D4E 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00447D54 E8C4BEFFFF              call 00443C1D
:00447D59 E949020000              jmp 00447FA7
:00447D5E 837D1000                cmp dword ptr [ebp+10], 00000000
:00447D62 7443                    je 00447DA7
:00447D64 8B450C                  mov eax, dword ptr [ebp+0C]
:00447D67 50                      push eax
:00447D68 6A04                    push 00000004
:00447D6A 6A00                    push 00000000
:00447D6C 6800000100              push 00010000
:00447D71 B9C8E44A00              mov ecx, 004AE4C8
:00447D76 E8C57C0300              call 0047FA40
:00447D7B 50                      push eax
:00447D7C 6A60                    push 00000060
:00447D7E 6A60                    push 00000060
:00447D80 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00447D86 8B9180000000            mov edx, dword ptr [ecx+00000080]
:00447D8C 52                      push edx
:00447D8D 8B450C                  mov eax, dword ptr [ebp+0C]
:00447D90 8B4820                  mov ecx, dword ptr [eax+20]
:00447D93 034DF0                  add ecx, dword ptr [ebp-10]
:00447D96 51                      push ecx
:00447D97 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00447D9D E87BBEFFFF              call 00443C1D
:00447DA2 E995000000              jmp 00447E3C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447D62(C)
|
:00447DA7 6800400000              push 00004000
:00447DAC 6A04                    push 00000004
:00447DAE 6A00                    push 00000000
:00447DB0 6800800100              push 00018000
:00447DB5 B9C8E44A00              mov ecx, 004AE4C8
:00447DBA E8817C0300              call 0047FA40
:00447DBF 50                      push eax
:00447DC0 6A04                    push 00000004
:00447DC2 6A00                    push 00000000
:00447DC4 6800000100              push 00010000
:00447DC9 B9C8E44A00              mov ecx, 004AE4C8
:00447DCE E86D7C0300              call 0047FA40
:00447DD3 50                      push eax
:00447DD4 E8247F0300              call 0047FCFD
:00447DD9 83C40C                  add esp, 0000000C
:00447DDC 6A0C                    push 0000000C
:00447DDE 6A60                    push 00000060
:00447DE0 6A60                    push 00000060
:00447DE2 6A04                    push 00000004
:00447DE4 6A00                    push 00000000
:00447DE6 6800800100              push 00018000
:00447DEB B9C8E44A00              mov ecx, 004AE4C8
:00447DF0 E84B7C0300              call 0047FA40
:00447DF5 50                      push eax
:00447DF6 E8C585FEFF              call 004303C0
:00447DFB 83C410                  add esp, 00000010
:00447DFE 8B550C                  mov edx, dword ptr [ebp+0C]
:00447E01 52                      push edx
:00447E02 6A04                    push 00000004
:00447E04 6A00                    push 00000000
:00447E06 6800800100              push 00018000
:00447E0B B9C8E44A00              mov ecx, 004AE4C8
:00447E10 E82B7C0300              call 0047FA40
:00447E15 50                      push eax
:00447E16 6A60                    push 00000060
:00447E18 6A60                    push 00000060
:00447E1A 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:00447E20 8B8880000000            mov ecx, dword ptr [eax+00000080]
:00447E26 51                      push ecx
:00447E27 8B550C                  mov edx, dword ptr [ebp+0C]
:00447E2A 8B4220                  mov eax, dword ptr [edx+20]
:00447E2D 0345F0                  add eax, dword ptr [ebp-10]
:00447E30 50                      push eax
:00447E31 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00447E37 E8E1BDFFFF              call 00443C1D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447DA2(U)
|
:00447E3C 8B4D08                  mov ecx, dword ptr [ebp+08]
:00447E3F 51                      push ecx
:00447E40 6A04                    push 00000004
:00447E42 6A00                    push 00000000
:00447E44 6800800000              push 00008000
:00447E49 B9C8E44A00              mov ecx, 004AE4C8
:00447E4E E8ED7B0300              call 0047FA40
:00447E53 50                      push eax
:00447E54 6880000000              push 00000080
:00447E59 6880000000              push 00000080
:00447E5E 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:00447E64 8B8280000000            mov eax, dword ptr [edx+00000080]
:00447E6A 83E810                  sub eax, 00000010
:00447E6D 50                      push eax
:00447E6E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00447E71 8B5120                  mov edx, dword ptr [ecx+20]
:00447E74 83EA10                  sub edx, 00000010
:00447E77 2B95E8FEFFFF            sub edx, dword ptr [ebp+FFFFFEE8]
:00447E7D 52                      push edx
:00447E7E 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00447E84 E894BDFFFF              call 00443C1D
:00447E89 8B4508                  mov eax, dword ptr [ebp+08]
:00447E8C 50                      push eax
:00447E8D 6A04                    push 00000004
:00447E8F 6A00                    push 00000000
:00447E91 6800800000              push 00008000
:00447E96 B9C8E44A00              mov ecx, 004AE4C8
:00447E9B E8A07B0300              call 0047FA40
:00447EA0 50                      push eax
:00447EA1 6880000000              push 00000080
:00447EA6 6880000000              push 00000080
:00447EAB 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00447EB1 8B9180000000            mov edx, dword ptr [ecx+00000080]
:00447EB7 83EA10                  sub edx, 00000010
:00447EBA 52                      push edx
:00447EBB 8B4508                  mov eax, dword ptr [ebp+08]
:00447EBE 8B4820                  mov ecx, dword ptr [eax+20]
:00447EC1 83E910                  sub ecx, 00000010
:00447EC4 2B8DE8FEFFFF            sub ecx, dword ptr [ebp+FFFFFEE8]
:00447ECA 034DF0                  add ecx, dword ptr [ebp-10]
:00447ECD 51                      push ecx
:00447ECE 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00447ED4 E844BDFFFF              call 00443C1D
:00447ED9 8B5508                  mov edx, dword ptr [ebp+08]
:00447EDC 52                      push edx
:00447EDD 6A04                    push 00000004
:00447EDF 6A00                    push 00000000
:00447EE1 6800C00000              push 0000C000
:00447EE6 B9C8E44A00              mov ecx, 004AE4C8
:00447EEB E8507B0300              call 0047FA40
:00447EF0 50                      push eax
:00447EF1 6880000000              push 00000080
:00447EF6 6880000000              push 00000080
:00447EFB 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:00447F01 8B8880000000            mov ecx, dword ptr [eax+00000080]
:00447F07 83E910                  sub ecx, 00000010
:00447F0A 51                      push ecx
:00447F0B 8B5508                  mov edx, dword ptr [ebp+08]
:00447F0E 8B4220                  mov eax, dword ptr [edx+20]
:00447F11 83E810                  sub eax, 00000010
:00447F14 50                      push eax
:00447F15 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00447F1B E8FDBCFFFF              call 00443C1D
:00447F20 E982000000              jmp 00447FA7
:00447F25 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00447F28 51                      push ecx
:00447F29 6A04                    push 00000004
:00447F2B 6A00                    push 00000000
:00447F2D 6800000100              push 00010000
:00447F32 B9C8E44A00              mov ecx, 004AE4C8
:00447F37 E8047B0300              call 0047FA40
:00447F3C 50                      push eax
:00447F3D 6A60                    push 00000060
:00447F3F 6A60                    push 00000060
:00447F41 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:00447F47 8B8280000000            mov eax, dword ptr [edx+00000080]
:00447F4D 50                      push eax
:00447F4E 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00447F51 8B5120                  mov edx, dword ptr [ecx+20]
:00447F54 52                      push edx
:00447F55 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00447F5B E8BDBCFFFF              call 00443C1D
:00447F60 8B4508                  mov eax, dword ptr [ebp+08]
:00447F63 50                      push eax
:00447F64 6A04                    push 00000004
:00447F66 6A00                    push 00000000
:00447F68 6800C00000              push 0000C000
:00447F6D B9C8E44A00              mov ecx, 004AE4C8
:00447F72 E8C97A0300              call 0047FA40
:00447F77 50                      push eax
:00447F78 6880000000              push 00000080
:00447F7D 6880000000              push 00000080
:00447F82 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00447F88 8B9180000000            mov edx, dword ptr [ecx+00000080]
:00447F8E 83EA10                  sub edx, 00000010
:00447F91 52                      push edx
:00447F92 8B4508                  mov eax, dword ptr [ebp+08]
:00447F95 8B4820                  mov ecx, dword ptr [eax+20]
:00447F98 83E910                  sub ecx, 00000010
:00447F9B 51                      push ecx
:00447F9C 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00447FA2 E876BCFFFF              call 00443C1D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00447791(C), :00447897(U), :00447A2F(U), :00447D59(U), :00447F20(U)
|
:00447FA7 E84A66FDFF              call 0041E5F6
:00447FAC 6A01                    push 00000001
:00447FAE B9181B4B00              mov ecx, 004B1B18
:00447FB3 E888B3FBFF              call 00403340
:00447FB8 E82345FEFF              call 0042C4E0
:00447FBD E98CF7FFFF              jmp 0044774E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00447764(C)
|
:00447FC2 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00447FC9 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00447FCF E8FCB2FBFF              call 004032D0
:00447FD4 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00447FD7 64890D00000000          mov dword ptr fs:[00000000], ecx
:00447FDE 8BE5                    mov esp, ebp
:00447FE0 5D                      pop ebp
:00447FE1 C20C00                  ret 000C



:00447FE4 A4774400                DWORD 004477A4
:00447FE8 9C784400                DWORD 0044789C
:00447FEC 347A4400                DWORD 00447A34
:00447FF0 5E7D4400                DWORD 00447D5E
:00447FF4 257F4400                DWORD 00447F25
:00447FF8 257F4400                DWORD 00447F25
:00447FFC 257F4400                DWORD 00447F25
:00448000 257F4400                DWORD 00447F25



* Referenced by a CALL at Address:
|:00448519   
|
:00448004 55                      push ebp
:00448005 8BEC                    mov ebp, esp
:00448007 83EC18                  sub esp, 00000018
:0044800A 894DE8                  mov dword ptr [ebp-18], ecx
:0044800D 8B4508                  mov eax, dword ptr [ebp+08]
:00448010 33C9                    xor ecx, ecx
:00448012 8A480E                  mov cl, byte ptr [eax+0E]
:00448015 83E901                  sub ecx, 00000001
:00448018 F7D9                    neg ecx
:0044801A 1BC9                    sbb ecx, ecx
:0044801C 83E1D0                  and ecx, FFFFFFD0
:0044801F 83C118                  add ecx, 00000018
:00448022 894DFC                  mov dword ptr [ebp-04], ecx
:00448025 8B5508                  mov edx, dword ptr [ebp+08]
:00448028 33C0                    xor eax, eax
:0044802A 8A420E                  mov al, byte ptr [edx+0E]
:0044802D 83E801                  sub eax, 00000001
:00448030 F7D8                    neg eax
:00448032 1BC0                    sbb eax, eax
:00448034 24A0                    and al, A0
:00448036 83C030                  add eax, 00000030
:00448039 8945F8                  mov dword ptr [ebp-08], eax
:0044803C 6A04                    push 00000004
:0044803E 6A00                    push 00000000
:00448040 6A00                    push 00000000
:00448042 B9C8E44A00              mov ecx, 004AE4C8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448001(C)
|
:00448047 E8F4790300              call 0047FA40
:0044804C 8945EC                  mov dword ptr [ebp-14], eax
:0044804F 6A04                    push 00000004
:00448051 6A00                    push 00000000
:00448053 8B4D08                  mov ecx, dword ptr [ebp+08]
:00448056 33D2                    xor edx, edx
:00448058 8A510D                  mov dl, byte ptr [ecx+0D]
:0044805B 69D200630000            imul edx, 00006300
:00448061 81C200240000            add edx, 00002400
:00448067 52                      push edx
:00448068 B980AB4A00              mov ecx, 004AAB80
:0044806D E8CE790300              call 0047FA40
:00448072 8945F4                  mov dword ptr [ebp-0C], eax
:00448075 C745F000000000          mov [ebp-10], 00000000
:0044807C EB09                    jmp 00448087

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004480B4(U)
|
:0044807E 8B45F0                  mov eax, dword ptr [ebp-10]
:00448081 83C001                  add eax, 00000001
:00448084 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044807C(U)
|
:00448087 837DF002                cmp dword ptr [ebp-10], 00000002
:0044808B 7329                    jnb 004480B6
:0044808D 6A30                    push 00000030
:0044808F 6A30                    push 00000030
:00448091 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00448094 C1E10E                  shl ecx, 0E
:00448097 8B55EC                  mov edx, dword ptr [ebp-14]
:0044809A 03D1                    add edx, ecx
:0044809C 52                      push edx
:0044809D 8B45F0                  mov eax, dword ptr [ebp-10]
:004480A0 69C000090000            imul eax, 00000900
:004480A6 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004480A9 03C8                    add ecx, eax
:004480AB 51                      push ecx
:004480AC E8C589FEFF              call 00430A76
:004480B1 83C410                  add esp, 00000010
:004480B4 EBC8                    jmp 0044807E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044808B(C)
|
:004480B6 6800400000              push 00004000
:004480BB 6A04                    push 00000004
:004480BD 6A00                    push 00000000
:004480BF 6800400100              push 00014000
:004480C4 B9C8E44A00              mov ecx, 004AE4C8
:004480C9 E872790300              call 0047FA40
:004480CE 50                      push eax
:004480CF 6A04                    push 00000004
:004480D1 6A00                    push 00000000
:004480D3 6800400000              push 00004000
:004480D8 B9C8E44A00              mov ecx, 004AE4C8
:004480DD E85E790300              call 0047FA40
:004480E2 50                      push eax
:004480E3 E8157C0300              call 0047FCFD
:004480E8 83C40C                  add esp, 0000000C
:004480EB 6A0C                    push 0000000C
:004480ED 6A60                    push 00000060
:004480EF 6A60                    push 00000060
:004480F1 6A04                    push 00000004
:004480F3 6A00                    push 00000000
:004480F5 6800400100              push 00014000
:004480FA B9C8E44A00              mov ecx, 004AE4C8
:004480FF E83C790300              call 0047FA40
:00448104 50                      push eax
:00448105 E8B682FEFF              call 004303C0
:0044810A 83C410                  add esp, 00000010
:0044810D 6A04                    push 00000004
:0044810F 6A00                    push 00000000
:00448111 6800800000              push 00008000
:00448116 B9C8E44A00              mov ecx, 004AE4C8
:0044811B E820790300              call 0047FA40
:00448120 8945EC                  mov dword ptr [ebp-14], eax
:00448123 6A04                    push 00000004
:00448125 6A00                    push 00000000
:00448127 8B550C                  mov edx, dword ptr [ebp+0C]
:0044812A 33C0                    xor eax, eax
:0044812C 8A420D                  mov al, byte ptr [edx+0D]
:0044812F 69C000630000            imul eax, 00006300
:00448135 0500240000              add eax, 00002400
:0044813A 50                      push eax
:0044813B B980AB4A00              mov ecx, 004AAB80
:00448140 E8FB780300              call 0047FA40
:00448145 8945F4                  mov dword ptr [ebp-0C], eax
:00448148 C745F000000000          mov [ebp-10], 00000000
:0044814F EB09                    jmp 0044815A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448187(U)
|
:00448151 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00448154 83C101                  add ecx, 00000001
:00448157 894DF0                  mov dword ptr [ebp-10], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044814F(U)
|
:0044815A 837DF002                cmp dword ptr [ebp-10], 00000002
:0044815E 7329                    jnb 00448189
:00448160 6A30                    push 00000030
:00448162 6A30                    push 00000030
:00448164 8B55F0                  mov edx, dword ptr [ebp-10]
:00448167 C1E20E                  shl edx, 0E
:0044816A 8B45EC                  mov eax, dword ptr [ebp-14]
:0044816D 03C2                    add eax, edx
:0044816F 50                      push eax
:00448170 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00448173 69C900090000            imul ecx, 00000900
:00448179 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044817C 03D1                    add edx, ecx
:0044817E 52                      push edx
:0044817F E8F288FEFF              call 00430A76
:00448184 83C410                  add esp, 00000010
:00448187 EBC8                    jmp 00448151

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044815E(C)
|
:00448189 6800400000              push 00004000
:0044818E 6A04                    push 00000004
:00448190 6A00                    push 00000000
:00448192 6800800100              push 00018000
:00448197 B9C8E44A00              mov ecx, 004AE4C8
:0044819C E89F780300              call 0047FA40
:004481A1 50                      push eax
:004481A2 6A04                    push 00000004
:004481A4 6A00                    push 00000000
:004481A6 6800C00000              push 0000C000
:004481AB B9C8E44A00              mov ecx, 004AE4C8
:004481B0 E88B780300              call 0047FA40
:004481B5 50                      push eax
:004481B6 E8427B0300              call 0047FCFD
:004481BB 83C40C                  add esp, 0000000C
:004481BE 6A0C                    push 0000000C
:004481C0 6A60                    push 00000060
:004481C2 6A60                    push 00000060
:004481C4 6A04                    push 00000004
:004481C6 6A00                    push 00000000
:004481C8 6800800100              push 00018000
:004481CD B9C8E44A00              mov ecx, 004AE4C8
:004481D2 E869780300              call 0047FA40
:004481D7 50                      push eax
:004481D8 E8E381FEFF              call 004303C0
:004481DD 83C410                  add esp, 00000010
:004481E0 C745F000000000          mov [ebp-10], 00000000
:004481E7 EB09                    jmp 004481F2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448378(U)
|
:004481E9 8B45F0                  mov eax, dword ptr [ebp-10]
:004481EC 83C001                  add eax, 00000001
:004481EF 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004481E7(U)
|
:004481F2 837DF008                cmp dword ptr [ebp-10], 00000008
:004481F6 0F8381010000            jnb 0044837D
:004481FC 837DF004                cmp dword ptr [ebp-10], 00000004
:00448200 7320                    jnb 00448222
:00448202 8B4D08                  mov ecx, dword ptr [ebp+08]
:00448205 8B5120                  mov edx, dword ptr [ecx+20]
:00448208 0355FC                  add edx, dword ptr [ebp-04]
:0044820B 8B4508                  mov eax, dword ptr [ebp+08]
:0044820E 895020                  mov dword ptr [eax+20], edx
:00448211 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00448214 8B5120                  mov edx, dword ptr [ecx+20]
:00448217 2B55FC                  sub edx, dword ptr [ebp-04]
:0044821A 8B450C                  mov eax, dword ptr [ebp+0C]
:0044821D 895020                  mov dword ptr [eax+20], edx
:00448220 EB1E                    jmp 00448240

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448200(C)
|
:00448222 8B4D08                  mov ecx, dword ptr [ebp+08]
:00448225 8B5120                  mov edx, dword ptr [ecx+20]
:00448228 0355F8                  add edx, dword ptr [ebp-08]
:0044822B 8B4508                  mov eax, dword ptr [ebp+08]
:0044822E 895020                  mov dword ptr [eax+20], edx
:00448231 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00448234 8B5120                  mov edx, dword ptr [ecx+20]
:00448237 2B55F8                  sub edx, dword ptr [ebp-08]
:0044823A 8B450C                  mov eax, dword ptr [ebp+0C]
:0044823D 895020                  mov dword ptr [eax+20], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448220(U)
|
:00448240 E89663FDFF              call 0041E5DB
:00448245 6A01                    push 00000001
:00448247 6A00                    push 00000000
:00448249 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0044824C E89CB8FFFF              call 00443AED
:00448251 8B4D08                  mov ecx, dword ptr [ebp+08]
:00448254 8B550C                  mov edx, dword ptr [ebp+0C]
:00448257 8B4120                  mov eax, dword ptr [ecx+20]
:0044825A 3B4220                  cmp eax, dword ptr [edx+20]
:0044825D 757D                    jne 004482DC
:0044825F 6A01                    push 00000001
:00448261 6A1F                    push 0000001F
:00448263 B9B0694B00              mov ecx, 004B69B0
:00448268 E80DC40200              call 0047467A
:0044826D 8B4D08                  mov ecx, dword ptr [ebp+08]
:00448270 51                      push ecx
:00448271 6A04                    push 00000004
:00448273 6A00                    push 00000000
:00448275 6800400100              push 00014000
:0044827A B9C8E44A00              mov ecx, 004AE4C8
:0044827F E8BC770300              call 0047FA40
:00448284 50                      push eax
:00448285 6A60                    push 00000060
:00448287 6A60                    push 00000060
:00448289 8B55E8                  mov edx, dword ptr [ebp-18]
:0044828C 8B8280000000            mov eax, dword ptr [edx+00000080]
:00448292 50                      push eax
:00448293 8B4D08                  mov ecx, dword ptr [ebp+08]
:00448296 8B5120                  mov edx, dword ptr [ecx+20]
:00448299 52                      push edx
:0044829A 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0044829D E87BB9FFFF              call 00443C1D
:004482A2 8B450C                  mov eax, dword ptr [ebp+0C]
:004482A5 50                      push eax
:004482A6 6A04                    push 00000004
:004482A8 6A00                    push 00000000
:004482AA 6800800100              push 00018000
:004482AF B9C8E44A00              mov ecx, 004AE4C8
:004482B4 E887770300              call 0047FA40
:004482B9 50                      push eax
:004482BA 6A60                    push 00000060
:004482BC 6A60                    push 00000060
:004482BE 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004482C1 8B9180000000            mov edx, dword ptr [ecx+00000080]
:004482C7 52                      push edx
:004482C8 8B450C                  mov eax, dword ptr [ebp+0C]
:004482CB 8B4820                  mov ecx, dword ptr [eax+20]
:004482CE 51                      push ecx
:004482CF 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004482D2 E846B9FFFF              call 00443C1D
:004482D7 E986000000              jmp 00448362

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044825D(C)
|
:004482DC 8B5508                  mov edx, dword ptr [ebp+08]
:004482DF 52                      push edx
:004482E0 6A04                    push 00000004
:004482E2 6A00                    push 00000000
:004482E4 8B45F0                  mov eax, dword ptr [ebp-10]
:004482E7 33D2                    xor edx, edx
:004482E9 B902000000              mov ecx, 00000002
:004482EE F7F1                    div ecx
:004482F0 C1E20E                  shl edx, 0E
:004482F3 52                      push edx
:004482F4 B9C8E44A00              mov ecx, 004AE4C8
:004482F9 E842770300              call 0047FA40
:004482FE 50                      push eax
:004482FF 6A60                    push 00000060
:00448301 6A60                    push 00000060
:00448303 8B55E8                  mov edx, dword ptr [ebp-18]
:00448306 8B8280000000            mov eax, dword ptr [edx+00000080]
:0044830C 50                      push eax
:0044830D 8B4D08                  mov ecx, dword ptr [ebp+08]
:00448310 8B5120                  mov edx, dword ptr [ecx+20]
:00448313 52                      push edx
:00448314 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00448317 E801B9FFFF              call 00443C1D
:0044831C 8B450C                  mov eax, dword ptr [ebp+0C]
:0044831F 50                      push eax
:00448320 6A04                    push 00000004
:00448322 6A00                    push 00000000
:00448324 8B45F0                  mov eax, dword ptr [ebp-10]
:00448327 33D2                    xor edx, edx
:00448329 B902000000              mov ecx, 00000002
:0044832E F7F1                    div ecx
:00448330 C1E20E                  shl edx, 0E
:00448333 81C200800000            add edx, 00008000
:00448339 52                      push edx
:0044833A B9C8E44A00              mov ecx, 004AE4C8
:0044833F E8FC760300              call 0047FA40
:00448344 50                      push eax
:00448345 6A60                    push 00000060
:00448347 6A60                    push 00000060
:00448349 8B55E8                  mov edx, dword ptr [ebp-18]
:0044834C 8B8280000000            mov eax, dword ptr [edx+00000080]
:00448352 50                      push eax
:00448353 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00448356 8B5120                  mov edx, dword ptr [ecx+20]
:00448359 52                      push edx
:0044835A 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0044835D E8BBB8FFFF              call 00443C1D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004482D7(U)
|
:00448362 E88F62FDFF              call 0041E5F6
:00448367 6A01                    push 00000001
:00448369 B9181B4B00              mov ecx, 004B1B18
:0044836E E8CDAFFBFF              call 00403340
:00448373 E86841FEFF              call 0042C4E0
:00448378 E96CFEFFFF              jmp 004481E9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004481F6(C)
|
:0044837D 6A14                    push 00000014
:0044837F B9181B4B00              mov ecx, 004B1B18
:00448384 E8B7AFFBFF              call 00403340
:00448389 E85241FEFF              call 0042C4E0
:0044838E 8BE5                    mov esp, ebp
:00448390 5D                      pop ebp
:00448391 C20800                  ret 0008



* Referenced by a CALL at Address:
|:004178B8   
|
:00448394 55                      push ebp
:00448395 8BEC                    mov ebp, esp
:00448397 83EC10                  sub esp, 00000010
:0044839A 894DF4                  mov dword ptr [ebp-0C], ecx
:0044839D 33C0                    xor eax, eax
:0044839F 837D0800                cmp dword ptr [ebp+08], 00000000
:004483A3 0F95C0                  setne al
:004483A6 6BC02C                  imul eax, 0000002C
:004483A9 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004483AC 8D540104                lea edx, dword ptr [ecx+eax+04]
:004483B0 8955F8                  mov dword ptr [ebp-08], edx
:004483B3 33C0                    xor eax, eax
:004483B5 837D0800                cmp dword ptr [ebp+08], 00000000
:004483B9 0F94C0                  sete al
:004483BC 6BC02C                  imul eax, 0000002C
:004483BF 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004483C2 8D540104                lea edx, dword ptr [ecx+eax+04]
:004483C6 8955FC                  mov dword ptr [ebp-04], edx
:004483C9 8B45F8                  mov eax, dword ptr [ebp-08]
:004483CC 50                      push eax
:004483CD 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004483D0 E8ACD8FFFF              call 00445C81
:004483D5 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004483D8 81E1FF000000            and ecx, 000000FF
:004483DE 894DF0                  mov dword ptr [ebp-10], ecx
:004483E1 837DF004                cmp dword ptr [ebp-10], 00000004
:004483E5 777A                    ja 00448461
:004483E7 8B55F0                  mov edx, dword ptr [ebp-10]
:004483EA FF249567844400          jmp dword ptr [4*edx+00448467]
:004483F1 6A00                    push 00000000
:004483F3 8B4510                  mov eax, dword ptr [ebp+10]
:004483F6 50                      push eax
:004483F7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004483FA 51                      push ecx
:004483FB 8B55F8                  mov edx, dword ptr [ebp-08]
:004483FE 52                      push edx
:004483FF 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00448402 E804DEFFFF              call 0044620B
:00448407 EB58                    jmp 00448461
:00448409 6A01                    push 00000001
:0044840B 8B4510                  mov eax, dword ptr [ebp+10]
:0044840E 50                      push eax
:0044840F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00448412 51                      push ecx
:00448413 8B55F8                  mov edx, dword ptr [ebp-08]
:00448416 52                      push edx
:00448417 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044841A E8ECDDFFFF              call 0044620B
:0044841F EB40                    jmp 00448461
:00448421 8B4510                  mov eax, dword ptr [ebp+10]
:00448424 50                      push eax
:00448425 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00448428 51                      push ecx
:00448429 8B55F8                  mov edx, dword ptr [ebp-08]
:0044842C 52                      push edx
:0044842D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00448430 E8DEE1FFFF              call 00446613
:00448435 EB2A                    jmp 00448461
:00448437 8B4510                  mov eax, dword ptr [ebp+10]
:0044843A 50                      push eax
:0044843B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044843E 51                      push ecx
:0044843F 8B55F8                  mov edx, dword ptr [ebp-08]
:00448442 52                      push edx
:00448443 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00448446 E8A0E5FFFF              call 004469EB
:0044844B EB14                    jmp 00448461
:0044844D 8B4510                  mov eax, dword ptr [ebp+10]
:00448450 50                      push eax
:00448451 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00448454 51                      push ecx
:00448455 8B55F8                  mov edx, dword ptr [ebp-08]
:00448458 52                      push edx
:00448459 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044845C E855E9FFFF              call 00446DB6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004483E5(C), :00448407(U), :0044841F(U), :00448435(U), :0044844B(U)
|
:00448461 8BE5                    mov esp, ebp
:00448463 5D                      pop ebp
:00448464 C20C00                  ret 000C



:00448467 F1834400                DWORD 004483F1
:0044846B 09844400                DWORD 00448409
:0044846F 21844400                DWORD 00448421
:00448473 37844400                DWORD 00448437
:00448477 4D844400                DWORD 0044844D



* Referenced by a CALL at Address:
|:00417958   
|
:0044847B 55                      push ebp
:0044847C 8BEC                    mov ebp, esp
:0044847E 83EC10                  sub esp, 00000010
:00448481 894DF4                  mov dword ptr [ebp-0C], ecx
:00448484 33C0                    xor eax, eax
:00448486 837D0800                cmp dword ptr [ebp+08], 00000000
:0044848A 0F95C0                  setne al
:0044848D 6BC02C                  imul eax, 0000002C
:00448490 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00448493 8D540104                lea edx, dword ptr [ecx+eax+04]
:00448497 8955F8                  mov dword ptr [ebp-08], edx
:0044849A 33C0                    xor eax, eax
:0044849C 837D0800                cmp dword ptr [ebp+08], 00000000
:004484A0 0F94C0                  sete al
:004484A3 6BC02C                  imul eax, 0000002C
:004484A6 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004484A9 8D540104                lea edx, dword ptr [ecx+eax+04]
:004484AD 8955FC                  mov dword ptr [ebp-04], edx
:004484B0 8A450C                  mov al, byte ptr [ebp+0C]
:004484B3 8845F0                  mov byte ptr [ebp-10], al
:004484B6 807DF000                cmp byte ptr [ebp-10], 00
:004484BA 740E                    je 004484CA
:004484BC 807DF001                cmp byte ptr [ebp-10], 01
:004484C0 742A                    je 004484EC
:004484C2 807DF002                cmp byte ptr [ebp-10], 02
:004484C6 7446                    je 0044850E
:004484C8 EB54                    jmp 0044851E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004484BA(C)
|
:004484CA 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004484CD 51                      push ecx
:004484CE 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004484D1 E8ABD7FFFF              call 00445C81
:004484D6 8B5510                  mov edx, dword ptr [ebp+10]
:004484D9 52                      push edx
:004484DA 8B45FC                  mov eax, dword ptr [ebp-04]
:004484DD 50                      push eax
:004484DE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004484E1 51                      push ecx
:004484E2 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004484E5 E835ECFFFF              call 0044711F
:004484EA EB32                    jmp 0044851E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004484C0(C)
|
:004484EC 8B55F8                  mov edx, dword ptr [ebp-08]
:004484EF 52                      push edx
:004484F0 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004484F3 E889D7FFFF              call 00445C81
:004484F8 8B4510                  mov eax, dword ptr [ebp+10]
:004484FB 50                      push eax
:004484FC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004484FF 51                      push ecx
:00448500 8B55F8                  mov edx, dword ptr [ebp-08]
:00448503 52                      push edx
:00448504 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00448507 E8B2F0FFFF              call 004475BE
:0044850C EB10                    jmp 0044851E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004484C6(C)
|
:0044850E 8B45FC                  mov eax, dword ptr [ebp-04]
:00448511 50                      push eax
:00448512 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00448515 51                      push ecx
:00448516 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00448519 E8E6FAFFFF              call 00448004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004484C8(U), :004484EA(U), :0044850C(U)
|
:0044851E 8BE5                    mov esp, ebp
:00448520 5D                      pop ebp
:00448521 C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:00417818   , :004495DB   
|
:00448524 55                      push ebp
:00448525 8BEC                    mov ebp, esp
:00448527 83EC10                  sub esp, 00000010
:0044852A 894DF4                  mov dword ptr [ebp-0C], ecx
:0044852D 33C0                    xor eax, eax
:0044852F 837D0800                cmp dword ptr [ebp+08], 00000000
:00448533 0F95C0                  setne al
:00448536 6BC02C                  imul eax, 0000002C
:00448539 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044853C 8D540104                lea edx, dword ptr [ecx+eax+04]
:00448540 8955F8                  mov dword ptr [ebp-08], edx
:00448543 33C0                    xor eax, eax
:00448545 837D0800                cmp dword ptr [ebp+08], 00000000
:00448549 0F94C0                  sete al
:0044854C 6BC02C                  imul eax, 0000002C
:0044854F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00448552 8D540104                lea edx, dword ptr [ecx+eax+04]
:00448556 8955FC                  mov dword ptr [ebp-04], edx
:00448559 8B450C                  mov eax, dword ptr [ebp+0C]
:0044855C 25FF000000              and eax, 000000FF
:00448561 8945F0                  mov dword ptr [ebp-10], eax
:00448564 837DF00F                cmp dword ptr [ebp-10], 0000000F
:00448568 0F8740010000            ja 004486AE
:0044856E 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00448571 FF248DB4864400          jmp dword ptr [4*ecx+004486B4]
:00448578 8B55FC                  mov edx, dword ptr [ebp-04]
:0044857B 52                      push edx
:0044857C 8B45F8                  mov eax, dword ptr [ebp-08]
:0044857F 50                      push eax
:00448580 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00448583 E85EB7FFFF              call 00443CE6
:00448588 E921010000              jmp 004486AE
:0044858D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00448590 51                      push ecx
:00448591 8B55F8                  mov edx, dword ptr [ebp-08]
:00448594 52                      push edx
:00448595 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00448598 E832C7FFFF              call 00444CCF
:0044859D E90C010000              jmp 004486AE
:004485A2 8B45FC                  mov eax, dword ptr [ebp-04]
:004485A5 50                      push eax
:004485A6 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004485A9 51                      push ecx
:004485AA 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004485AD E8CAC4FFFF              call 00444A7C
:004485B2 E9F7000000              jmp 004486AE
:004485B7 8B55FC                  mov edx, dword ptr [ebp-04]
:004485BA 52                      push edx
:004485BB 8B45F8                  mov eax, dword ptr [ebp-08]
:004485BE 50                      push eax
:004485BF 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004485C2 E872C3FFFF              call 00444939
:004485C7 E9E2000000              jmp 004486AE
:004485CC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004485CF 51                      push ecx
:004485D0 8B55F8                  mov edx, dword ptr [ebp-08]
:004485D3 52                      push edx
:004485D4 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004485D7 E8D1C7FFFF              call 00444DAD
:004485DC E9CD000000              jmp 004486AE
:004485E1 8B45FC                  mov eax, dword ptr [ebp-04]
:004485E4 50                      push eax
:004485E5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004485E8 51                      push ecx
:004485E9 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004485EC E80EB8FFFF              call 00443DFF
:004485F1 E9B8000000              jmp 004486AE
:004485F6 8B55FC                  mov edx, dword ptr [ebp-04]
:004485F9 52                      push edx
:004485FA 8B45F8                  mov eax, dword ptr [ebp-08]
:004485FD 50                      push eax
:004485FE 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00448601 E84BB9FFFF              call 00443F51
:00448606 E9A3000000              jmp 004486AE
:0044860B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044860E 51                      push ecx
:0044860F 8B55F8                  mov edx, dword ptr [ebp-08]
:00448612 52                      push edx
:00448613 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00448616 E8D6BAFFFF              call 004440F1
:0044861B E98E000000              jmp 004486AE
:00448620 8B45FC                  mov eax, dword ptr [ebp-04]
:00448623 50                      push eax
:00448624 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00448627 51                      push ecx
:00448628 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044862B E8BABCFFFF              call 004442EA
:00448630 EB7C                    jmp 004486AE
:00448632 8B55FC                  mov edx, dword ptr [ebp-04]
:00448635 52                      push edx
:00448636 8B45F8                  mov eax, dword ptr [ebp-08]
:00448639 50                      push eax
:0044863A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044863D E854BEFFFF              call 00444496
:00448642 EB6A                    jmp 004486AE
:00448644 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00448647 51                      push ecx
:00448648 8B55F8                  mov edx, dword ptr [ebp-08]
:0044864B 52                      push edx
:0044864C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044864F E87DC0FFFF              call 004446D1
:00448654 EB58                    jmp 004486AE
:00448656 8B45FC                  mov eax, dword ptr [ebp-04]
:00448659 50                      push eax
:0044865A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044865D 51                      push ecx
:0044865E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00448661 E8DDBBFFFF              call 00444243
:00448666 EB46                    jmp 004486AE
:00448668 8B55FC                  mov edx, dword ptr [ebp-04]
:0044866B 52                      push edx
:0044866C 8B45F8                  mov eax, dword ptr [ebp-08]
:0044866F 50                      push eax
:00448670 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00448673 E847C5FFFF              call 00444BBF
:00448678 EB34                    jmp 004486AE
:0044867A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044867D 51                      push ecx
:0044867E 8B55F8                  mov edx, dword ptr [ebp-08]
:00448681 52                      push edx
:00448682 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00448685 E803B7FFFF              call 00443D8D
:0044868A EB22                    jmp 004486AE
:0044868C 8B45FC                  mov eax, dword ptr [ebp-04]
:0044868F 50                      push eax
:00448690 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00448693 51                      push ecx
:00448694 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00448697 E84EC8FFFF              call 00444EEA
:0044869C EB10                    jmp 004486AE
:0044869E 8B55FC                  mov edx, dword ptr [ebp-04]
:004486A1 52                      push edx
:004486A2 8B45F8                  mov eax, dword ptr [ebp-08]
:004486A5 50                      push eax
:004486A6 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004486A9 E895D2FFFF              call 00445943

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00448568(C), :00448588(U), :0044859D(U), :004485B2(U), :004485C7(U)
|:004485DC(U), :004485F1(U), :00448606(U), :0044861B(U), :00448630(U)
|:00448642(U), :00448654(U), :00448666(U), :00448678(U), :0044868A(U)
|:0044869C(U)
|
:004486AE 8BE5                    mov esp, ebp
:004486B0 5D                      pop ebp
:004486B1 C20800                  ret 0008



:004486B4 78854400                DWORD 00448578
:004486B8 8D854400                DWORD 0044858D
:004486BC A2854400                DWORD 004485A2
:004486C0 B7854400                DWORD 004485B7
:004486C4 CC854400                DWORD 004485CC
:004486C8 E1854400                DWORD 004485E1
:004486CC F6854400                DWORD 004485F6
:004486D0 0B864400                DWORD 0044860B
:004486D4 20864400                DWORD 00448620
:004486D8 32864400                DWORD 00448632
:004486DC 44864400                DWORD 00448644
:004486E0 56864400                DWORD 00448656
:004486E4 68864400                DWORD 00448668
:004486E8 7A864400                DWORD 0044867A
:004486EC 8C864400                DWORD 0044868C
:004486F0 9E864400                DWORD 0044869E



* Referenced by a CALL at Address:
|:00449A57   
|
:004486F4 55                      push ebp
:004486F5 8BEC                    mov ebp, esp
:004486F7 6AFF                    push FFFFFFFF
:004486F9 68A0554800              push 004855A0
:004486FE 64A100000000            mov eax, dword ptr fs:[00000000]
:00448704 50                      push eax
:00448705 64892500000000          mov dword ptr fs:[00000000], esp
:0044870C 81EC0C010000            sub esp, 0000010C
:00448712 898DE8FEFFFF            mov dword ptr [ebp+FFFFFEE8], ecx
:00448718 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0044871E E88DABFBFF              call 004032B0
:00448723 C745FC00000000          mov [ebp-04], 00000000
:0044872A E8AC5EFDFF              call 0041E5DB
:0044872F 6A00                    push 00000000
:00448731 6A01                    push 00000001
:00448733 6880010000              push 00000180
:00448738 6870020000              push 00000270
:0044873D 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:00448743 8B4870                  mov ecx, dword ptr [eax+70]
:00448746 51                      push ecx
:00448747 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:0044874D 8B4268                  mov eax, dword ptr [edx+68]
:00448750 50                      push eax
:00448751 B930694B00              mov ecx, 004B6930
:00448756 E8A7AA0200              call 00473202
:0044875B C785ECFEFFFF00000000    mov dword ptr [ebp+FFFFFEEC], 00000000
:00448765 EB0F                    jmp 00448776

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448837(U)
|
:00448767 8B8DECFEFFFF            mov ecx, dword ptr [ebp+FFFFFEEC]
:0044876D 83C101                  add ecx, 00000001
:00448770 898DECFEFFFF            mov dword ptr [ebp+FFFFFEEC], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448765(U)
|
:00448776 83BDECFEFFFF0C          cmp dword ptr [ebp+FFFFFEEC], 0000000C
:0044877D 0F83B9000000            jnb 0044883C
:00448783 6A00                    push 00000000
:00448785 8B95ECFEFFFF            mov edx, dword ptr [ebp+FFFFFEEC]
:0044878B D1EA                    shr edx, 1
:0044878D B819000000              mov eax, 00000019
:00448792 2BC2                    sub eax, edx
:00448794 50                      push eax
:00448795 6A04                    push 00000004
:00448797 E8554A0300              call 0047D1F1
:0044879C 83C40C                  add esp, 0000000C
:0044879F 68FFFF0000              push 0000FFFF
:004487A4 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:004487AA 8B5174                  mov edx, dword ptr [ecx+74]
:004487AD 8B85ECFEFFFF            mov eax, dword ptr [ebp+FFFFFEEC]
:004487B3 8D4C02F4                lea ecx, dword ptr [edx+eax-0C]
:004487B7 51                      push ecx
:004487B8 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:004487BE 8B426C                  mov eax, dword ptr [edx+6C]
:004487C1 83E801                  sub eax, 00000001
:004487C4 50                      push eax
:004487C5 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:004487CB 8B5174                  mov edx, dword ptr [ecx+74]
:004487CE 8B85ECFEFFFF            mov eax, dword ptr [ebp+FFFFFEEC]
:004487D4 8D4C02F4                lea ecx, dword ptr [edx+eax-0C]
:004487D8 51                      push ecx
:004487D9 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:004487DF 8B4268                  mov eax, dword ptr [edx+68]
:004487E2 50                      push eax
:004487E3 E8D64C0300              call 0047D4BE
:004487E8 83C414                  add esp, 00000014
:004487EB 68FFFF0000              push 0000FFFF
:004487F0 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:004487F6 8B5174                  mov edx, dword ptr [ecx+74]
:004487F9 83EA01                  sub edx, 00000001
:004487FC 52                      push edx
:004487FD 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:00448803 8B486C                  mov ecx, dword ptr [eax+6C]
:00448806 8B95ECFEFFFF            mov edx, dword ptr [ebp+FFFFFEEC]
:0044880C 8D4411F4                lea eax, dword ptr [ecx+edx-0C]
:00448810 50                      push eax
:00448811 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00448817 8B5170                  mov edx, dword ptr [ecx+70]
:0044881A 52                      push edx
:0044881B 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:00448821 8B486C                  mov ecx, dword ptr [eax+6C]
:00448824 8B95ECFEFFFF            mov edx, dword ptr [ebp+FFFFFEEC]
:0044882A 8D4411F4                lea eax, dword ptr [ecx+edx-0C]
:0044882E 50                      push eax
:0044882F E88A4C0300              call 0047D4BE
:00448834 83C414                  add esp, 00000014
:00448837 E92BFFFFFF              jmp 00448767

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044877D(C)
|
:0044883C C785ECFEFFFF00000000    mov dword ptr [ebp+FFFFFEEC], 00000000
:00448846 EB0F                    jmp 00448857

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448A9A(U)
|
:00448848 8B8DECFEFFFF            mov ecx, dword ptr [ebp+FFFFFEEC]
:0044884E 83C101                  add ecx, 00000001
:00448851 898DECFEFFFF            mov dword ptr [ebp+FFFFFEEC], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448846(U)
|
:00448857 83BDECFEFFFF08          cmp dword ptr [ebp+FFFFFEEC], 00000008
:0044885E 0F833B020000            jnb 00448A9F
:00448864 83BDECFEFFFF03          cmp dword ptr [ebp+FFFFFEEC], 00000003
:0044886B 0F83A7000000            jnb 00448918
:00448871 6A00                    push 00000000
:00448873 6A13                    push 00000013
:00448875 6A04                    push 00000004
:00448877 E875490300              call 0047D1F1
:0044887C 83C40C                  add esp, 0000000C
:0044887F 68FFFF0000              push 0000FFFF
:00448884 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:0044888A 8B4270                  mov eax, dword ptr [edx+70]
:0044888D 0385ECFEFFFF            add eax, dword ptr [ebp+FFFFFEEC]
:00448893 50                      push eax
:00448894 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:0044889A 8B516C                  mov edx, dword ptr [ecx+6C]
:0044889D 83EA01                  sub edx, 00000001
:004488A0 52                      push edx
:004488A1 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:004488A7 8B4870                  mov ecx, dword ptr [eax+70]
:004488AA 038DECFEFFFF            add ecx, dword ptr [ebp+FFFFFEEC]
:004488B0 51                      push ecx
:004488B1 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:004488B7 8B4268                  mov eax, dword ptr [edx+68]
:004488BA 0385ECFEFFFF            add eax, dword ptr [ebp+FFFFFEEC]
:004488C0 50                      push eax
:004488C1 E8F84B0300              call 0047D4BE
:004488C6 83C414                  add esp, 00000014
:004488C9 68FFFF0000              push 0000FFFF
:004488CE 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:004488D4 8B5174                  mov edx, dword ptr [ecx+74]
:004488D7 83EA01                  sub edx, 00000001
:004488DA 52                      push edx
:004488DB 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:004488E1 8B4868                  mov ecx, dword ptr [eax+68]
:004488E4 038DECFEFFFF            add ecx, dword ptr [ebp+FFFFFEEC]
:004488EA 51                      push ecx
:004488EB 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:004488F1 8B4270                  mov eax, dword ptr [edx+70]
:004488F4 0385ECFEFFFF            add eax, dword ptr [ebp+FFFFFEEC]
:004488FA 50                      push eax
:004488FB 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00448901 8B5168                  mov edx, dword ptr [ecx+68]
:00448904 0395ECFEFFFF            add edx, dword ptr [ebp+FFFFFEEC]
:0044890A 52                      push edx
:0044890B E8AE4B0300              call 0047D4BE
:00448910 83C414                  add esp, 00000014
:00448913 E982010000              jmp 00448A9A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044886B(C)
|
:00448918 83BDECFEFFFF05          cmp dword ptr [ebp+FFFFFEEC], 00000005
:0044891F 0F83AF000000            jnb 004489D4
:00448925 6A00                    push 00000000
:00448927 8B85ECFEFFFF            mov eax, dword ptr [ebp+FFFFFEEC]
:0044892D 83C011                  add eax, 00000011
:00448930 50                      push eax
:00448931 6A04                    push 00000004
:00448933 E8B9480300              call 0047D1F1
:00448938 83C40C                  add esp, 0000000C
:0044893B 68FFFF0000              push 0000FFFF
:00448940 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00448946 8B5170                  mov edx, dword ptr [ecx+70]
:00448949 0395ECFEFFFF            add edx, dword ptr [ebp+FFFFFEEC]
:0044894F 52                      push edx
:00448950 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:00448956 8B486C                  mov ecx, dword ptr [eax+6C]
:00448959 83E901                  sub ecx, 00000001
:0044895C 51                      push ecx
:0044895D 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:00448963 8B4270                  mov eax, dword ptr [edx+70]
:00448966 0385ECFEFFFF            add eax, dword ptr [ebp+FFFFFEEC]
:0044896C 50                      push eax
:0044896D 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00448973 8B5168                  mov edx, dword ptr [ecx+68]
:00448976 0395ECFEFFFF            add edx, dword ptr [ebp+FFFFFEEC]
:0044897C 52                      push edx
:0044897D E83C4B0300              call 0047D4BE
:00448982 83C414                  add esp, 00000014
:00448985 68FFFF0000              push 0000FFFF
:0044898A 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:00448990 8B4874                  mov ecx, dword ptr [eax+74]
:00448993 83E901                  sub ecx, 00000001
:00448996 51                      push ecx
:00448997 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:0044899D 8B4268                  mov eax, dword ptr [edx+68]
:004489A0 0385ECFEFFFF            add eax, dword ptr [ebp+FFFFFEEC]
:004489A6 50                      push eax
:004489A7 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:004489AD 8B5170                  mov edx, dword ptr [ecx+70]
:004489B0 0395ECFEFFFF            add edx, dword ptr [ebp+FFFFFEEC]
:004489B6 52                      push edx
:004489B7 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:004489BD 8B4868                  mov ecx, dword ptr [eax+68]
:004489C0 038DECFEFFFF            add ecx, dword ptr [ebp+FFFFFEEC]
:004489C6 51                      push ecx
:004489C7 E8F24A0300              call 0047D4BE
:004489CC 83C414                  add esp, 00000014
:004489CF E9C6000000              jmp 00448A9A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044891F(C)
|
:004489D4 6A00                    push 00000000
:004489D6 8B95ECFEFFFF            mov edx, dword ptr [ebp+FFFFFEEC]
:004489DC 83C211                  add edx, 00000011
:004489DF 52                      push edx
:004489E0 6A04                    push 00000004
:004489E2 E80A480300              call 0047D1F1
:004489E7 83C40C                  add esp, 0000000C
:004489EA 68FFFF0000              push 0000FFFF
:004489EF 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:004489F5 8B4870                  mov ecx, dword ptr [eax+70]
:004489F8 038DECFEFFFF            add ecx, dword ptr [ebp+FFFFFEEC]
:004489FE 51                      push ecx
:004489FF 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:00448A05 8B426C                  mov eax, dword ptr [edx+6C]
:00448A08 83E801                  sub eax, 00000001
:00448A0B 8B8DECFEFFFF            mov ecx, dword ptr [ebp+FFFFFEEC]
:00448A11 83E904                  sub ecx, 00000004
:00448A14 6BC903                  imul ecx, 00000003
:00448A17 2BC1                    sub eax, ecx
:00448A19 50                      push eax
:00448A1A 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:00448A20 8B4270                  mov eax, dword ptr [edx+70]
:00448A23 0385ECFEFFFF            add eax, dword ptr [ebp+FFFFFEEC]
:00448A29 50                      push eax
:00448A2A 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00448A30 8B5168                  mov edx, dword ptr [ecx+68]
:00448A33 0395ECFEFFFF            add edx, dword ptr [ebp+FFFFFEEC]
:00448A39 52                      push edx
:00448A3A E87F4A0300              call 0047D4BE
:00448A3F 83C414                  add esp, 00000014
:00448A42 68FFFF0000              push 0000FFFF
:00448A47 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:00448A4D 8B4874                  mov ecx, dword ptr [eax+74]
:00448A50 83E901                  sub ecx, 00000001
:00448A53 8B95ECFEFFFF            mov edx, dword ptr [ebp+FFFFFEEC]
:00448A59 83EA04                  sub edx, 00000004
:00448A5C 6BD203                  imul edx, 00000003
:00448A5F 2BCA                    sub ecx, edx
:00448A61 51                      push ecx
:00448A62 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:00448A68 8B4868                  mov ecx, dword ptr [eax+68]
:00448A6B 038DECFEFFFF            add ecx, dword ptr [ebp+FFFFFEEC]
:00448A71 51                      push ecx
:00448A72 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:00448A78 8B4270                  mov eax, dword ptr [edx+70]
:00448A7B 0385ECFEFFFF            add eax, dword ptr [ebp+FFFFFEEC]
:00448A81 50                      push eax
:00448A82 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00448A88 8B5168                  mov edx, dword ptr [ecx+68]
:00448A8B 0395ECFEFFFF            add edx, dword ptr [ebp+FFFFFEEC]
:00448A91 52                      push edx
:00448A92 E8274A0300              call 0047D4BE
:00448A97 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00448913(U), :004489CF(U)
|
:00448A9A E9A9FDFFFF              jmp 00448848

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044885E(C)
|
:00448A9F E8525BFDFF              call 0041E5F6
:00448AA4 B970074B00              mov ecx, 004B0770
:00448AA9 E80238FDFF              call 0041C2B0
:00448AAE 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00448AB4 884164                  mov byte ptr [ecx+64], al
:00448AB7 6A0A                    push 0000000A
:00448AB9 B9B8694B00              mov ecx, 004B69B8
:00448ABE E83BBB0200              call 004745FE
:00448AC3 6A0A                    push 0000000A
:00448AC5 B9181B4B00              mov ecx, 004B1B18
:00448ACA E871A8FBFF              call 00403340
:00448ACF E80C3AFEFF              call 0042C4E0
:00448AD4 E8025BFDFF              call 0041E5DB
:00448AD9 6A00                    push 00000000
:00448ADB 6A00                    push 00000000
:00448ADD 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00448AE3 E825AFFFFF              call 00443A0D
:00448AE8 6A00                    push 00000000
:00448AEA 6A00                    push 00000000
:00448AEC 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00448AF2 E87CACFFFF              call 00443773
:00448AF7 E8FA5AFDFF              call 0041E5F6
:00448AFC 6A14                    push 00000014
:00448AFE B9181B4B00              mov ecx, 004B1B18
:00448B03 E838A8FBFF              call 00403340
:00448B08 E8D339FEFF              call 0042C4E0
:00448B0D 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00448B13 E81CAAFFFF              call 00443534
:00448B18 6A14                    push 00000014
:00448B1A B9181B4B00              mov ecx, 004B1B18
:00448B1F E81CA8FBFF              call 00403340
:00448B24 E8B739FEFF              call 0042C4E0
:00448B29 E8AD5AFDFF              call 0041E5DB
:00448B2E 6A00                    push 00000000
:00448B30 6A01                    push 00000001
:00448B32 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00448B38 E8D0AEFFFF              call 00443A0D
:00448B3D 6A00                    push 00000000
:00448B3F 6A01                    push 00000001
:00448B41 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00448B47 E827ACFFFF              call 00443773
:00448B4C E8A55AFDFF              call 0041E5F6
:00448B51 6A4B                    push 0000004B
:00448B53 B9181B4B00              mov ecx, 004B1B18
:00448B58 E8E3A7FBFF              call 00403340
:00448B5D E87E39FEFF              call 0042C4E0
:00448B62 E8745AFDFF              call 0041E5DB

* Possible StringData Ref from Data Obj ->"LOGO.E5"
                                  |
:00448B67 68F0BA4800              push 0048BAF0
:00448B6C 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:00448B72 E8BE6FFDFF              call 0041FB35
:00448B77 6A04                    push 00000004
:00448B79 6A00                    push 00000000
:00448B7B 6A00                    push 00000000
:00448B7D B968AB4A00              mov ecx, 004AAB68
:00448B82 E8B96E0300              call 0047FA40
:00448B87 50                      push eax
:00448B88 6A05                    push 00000005
:00448B8A 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:00448B90 E8F470FDFF              call 0041FC89
:00448B95 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:00448B9B E82507FDFF              call 004192C5
:00448BA0 6A04                    push 00000004
:00448BA2 6A00                    push 00000000
:00448BA4 6A00                    push 00000000
:00448BA6 B968AB4A00              mov ecx, 004AAB68
:00448BAB E8906E0300              call 0047FA40
:00448BB0 50                      push eax
:00448BB1 6880010000              push 00000180
:00448BB6 6870020000              push 00000270
:00448BBB 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:00448BC1 8B4270                  mov eax, dword ptr [edx+70]
:00448BC4 50                      push eax
:00448BC5 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00448BCB 8B5168                  mov edx, dword ptr [ecx+68]
:00448BCE 52                      push edx
:00448BCF E8C7540300              call 0047E09B
:00448BD4 83C414                  add esp, 00000014
:00448BD7 C785ECFEFFFF00000000    mov dword ptr [ebp+FFFFFEEC], 00000000
:00448BE1 EB0F                    jmp 00448BF2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448CAF(U)
|
:00448BE3 8B85ECFEFFFF            mov eax, dword ptr [ebp+FFFFFEEC]
:00448BE9 83C001                  add eax, 00000001
:00448BEC 8985ECFEFFFF            mov dword ptr [ebp+FFFFFEEC], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448BE1(U)
|
:00448BF2 83BDECFEFFFF0C          cmp dword ptr [ebp+FFFFFEEC], 0000000C
:00448BF9 0F83B5000000            jnb 00448CB4
:00448BFF 6A00                    push 00000000
:00448C01 B91F000000              mov ecx, 0000001F
:00448C06 2B8DECFEFFFF            sub ecx, dword ptr [ebp+FFFFFEEC]
:00448C0C 51                      push ecx
:00448C0D 6A04                    push 00000004
:00448C0F E8DD450300              call 0047D1F1
:00448C14 83C40C                  add esp, 0000000C
:00448C17 68FFFF0000              push 0000FFFF
:00448C1C 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:00448C22 8B4274                  mov eax, dword ptr [edx+74]
:00448C25 8B8DECFEFFFF            mov ecx, dword ptr [ebp+FFFFFEEC]
:00448C2B 8D5408F4                lea edx, dword ptr [eax+ecx-0C]
:00448C2F 52                      push edx
:00448C30 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:00448C36 8B486C                  mov ecx, dword ptr [eax+6C]
:00448C39 83E901                  sub ecx, 00000001
:00448C3C 51                      push ecx
:00448C3D 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:00448C43 8B4274                  mov eax, dword ptr [edx+74]
:00448C46 8B8DECFEFFFF            mov ecx, dword ptr [ebp+FFFFFEEC]
:00448C4C 8D5408F4                lea edx, dword ptr [eax+ecx-0C]
:00448C50 52                      push edx
:00448C51 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:00448C57 8B4868                  mov ecx, dword ptr [eax+68]
:00448C5A 51                      push ecx
:00448C5B E85E480300              call 0047D4BE
:00448C60 83C414                  add esp, 00000014
:00448C63 68FFFF0000              push 0000FFFF
:00448C68 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:00448C6E 8B4274                  mov eax, dword ptr [edx+74]
:00448C71 83E801                  sub eax, 00000001
:00448C74 50                      push eax
:00448C75 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00448C7B 8B516C                  mov edx, dword ptr [ecx+6C]
:00448C7E 8B85ECFEFFFF            mov eax, dword ptr [ebp+FFFFFEEC]
:00448C84 8D4C02F4                lea ecx, dword ptr [edx+eax-0C]
:00448C88 51                      push ecx
:00448C89 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:00448C8F 8B4270                  mov eax, dword ptr [edx+70]
:00448C92 50                      push eax
:00448C93 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00448C99 8B516C                  mov edx, dword ptr [ecx+6C]
:00448C9C 8B85ECFEFFFF            mov eax, dword ptr [ebp+FFFFFEEC]
:00448CA2 8D4C02F4                lea ecx, dword ptr [edx+eax-0C]
:00448CA6 51                      push ecx
:00448CA7 E812480300              call 0047D4BE
:00448CAC 83C414                  add esp, 00000014
:00448CAF E92FFFFFFF              jmp 00448BE3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448BF9(C)
|
:00448CB4 C785ECFEFFFF00000000    mov dword ptr [ebp+FFFFFEEC], 00000000
:00448CBE EB0F                    jmp 00448CCF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448F18(U)
|
:00448CC0 8B95ECFEFFFF            mov edx, dword ptr [ebp+FFFFFEEC]
:00448CC6 83C201                  add edx, 00000001
:00448CC9 8995ECFEFFFF            mov dword ptr [ebp+FFFFFEEC], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448CBE(U)
|
:00448CCF 83BDECFEFFFF08          cmp dword ptr [ebp+FFFFFEEC], 00000008
:00448CD6 0F8341020000            jnb 00448F1D
:00448CDC 83BDECFEFFFF03          cmp dword ptr [ebp+FFFFFEEC], 00000003
:00448CE3 0F83A7000000            jnb 00448D90
:00448CE9 6A00                    push 00000000
:00448CEB 6A13                    push 00000013
:00448CED 6A04                    push 00000004
:00448CEF E8FD440300              call 0047D1F1
:00448CF4 83C40C                  add esp, 0000000C
:00448CF7 68FFFF0000              push 0000FFFF
:00448CFC 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:00448D02 8B4870                  mov ecx, dword ptr [eax+70]
:00448D05 038DECFEFFFF            add ecx, dword ptr [ebp+FFFFFEEC]
:00448D0B 51                      push ecx
:00448D0C 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:00448D12 8B426C                  mov eax, dword ptr [edx+6C]
:00448D15 83E801                  sub eax, 00000001
:00448D18 50                      push eax
:00448D19 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00448D1F 8B5170                  mov edx, dword ptr [ecx+70]
:00448D22 0395ECFEFFFF            add edx, dword ptr [ebp+FFFFFEEC]
:00448D28 52                      push edx
:00448D29 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:00448D2F 8B4868                  mov ecx, dword ptr [eax+68]
:00448D32 038DECFEFFFF            add ecx, dword ptr [ebp+FFFFFEEC]
:00448D38 51                      push ecx
:00448D39 E880470300              call 0047D4BE
:00448D3E 83C414                  add esp, 00000014
:00448D41 68FFFF0000              push 0000FFFF
:00448D46 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:00448D4C 8B4274                  mov eax, dword ptr [edx+74]
:00448D4F 83E801                  sub eax, 00000001
:00448D52 50                      push eax
:00448D53 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00448D59 8B5168                  mov edx, dword ptr [ecx+68]
:00448D5C 0395ECFEFFFF            add edx, dword ptr [ebp+FFFFFEEC]
:00448D62 52                      push edx
:00448D63 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:00448D69 8B4870                  mov ecx, dword ptr [eax+70]
:00448D6C 038DECFEFFFF            add ecx, dword ptr [ebp+FFFFFEEC]
:00448D72 51                      push ecx
:00448D73 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:00448D79 8B4268                  mov eax, dword ptr [edx+68]
:00448D7C 0385ECFEFFFF            add eax, dword ptr [ebp+FFFFFEEC]
:00448D82 50                      push eax
:00448D83 E836470300              call 0047D4BE
:00448D88 83C414                  add esp, 00000014
:00448D8B E988010000              jmp 00448F18

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448CE3(C)
|
:00448D90 83BDECFEFFFF05          cmp dword ptr [ebp+FFFFFEEC], 00000005
:00448D97 0F83AF000000            jnb 00448E4C
:00448D9D 6A00                    push 00000000
:00448D9F 8B8DECFEFFFF            mov ecx, dword ptr [ebp+FFFFFEEC]
:00448DA5 83C111                  add ecx, 00000011
:00448DA8 51                      push ecx
:00448DA9 6A04                    push 00000004
:00448DAB E841440300              call 0047D1F1
:00448DB0 83C40C                  add esp, 0000000C
:00448DB3 68FFFF0000              push 0000FFFF
:00448DB8 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:00448DBE 8B4270                  mov eax, dword ptr [edx+70]
:00448DC1 0385ECFEFFFF            add eax, dword ptr [ebp+FFFFFEEC]
:00448DC7 50                      push eax
:00448DC8 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00448DCE 8B516C                  mov edx, dword ptr [ecx+6C]
:00448DD1 83EA01                  sub edx, 00000001
:00448DD4 52                      push edx
:00448DD5 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:00448DDB 8B4870                  mov ecx, dword ptr [eax+70]
:00448DDE 038DECFEFFFF            add ecx, dword ptr [ebp+FFFFFEEC]
:00448DE4 51                      push ecx
:00448DE5 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:00448DEB 8B4268                  mov eax, dword ptr [edx+68]
:00448DEE 0385ECFEFFFF            add eax, dword ptr [ebp+FFFFFEEC]
:00448DF4 50                      push eax
:00448DF5 E8C4460300              call 0047D4BE
:00448DFA 83C414                  add esp, 00000014
:00448DFD 68FFFF0000              push 0000FFFF
:00448E02 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00448E08 8B5174                  mov edx, dword ptr [ecx+74]
:00448E0B 83EA01                  sub edx, 00000001
:00448E0E 52                      push edx
:00448E0F 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:00448E15 8B4868                  mov ecx, dword ptr [eax+68]
:00448E18 038DECFEFFFF            add ecx, dword ptr [ebp+FFFFFEEC]
:00448E1E 51                      push ecx
:00448E1F 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:00448E25 8B4270                  mov eax, dword ptr [edx+70]
:00448E28 0385ECFEFFFF            add eax, dword ptr [ebp+FFFFFEEC]
:00448E2E 50                      push eax
:00448E2F 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00448E35 8B5168                  mov edx, dword ptr [ecx+68]
:00448E38 0395ECFEFFFF            add edx, dword ptr [ebp+FFFFFEEC]
:00448E3E 52                      push edx
:00448E3F E87A460300              call 0047D4BE
:00448E44 83C414                  add esp, 00000014
:00448E47 E9CC000000              jmp 00448F18

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448D97(C)
|
:00448E4C 6A00                    push 00000000
:00448E4E 8B85ECFEFFFF            mov eax, dword ptr [ebp+FFFFFEEC]
:00448E54 83E805                  sub eax, 00000005
:00448E57 6BC003                  imul eax, 00000003
:00448E5A 83C016                  add eax, 00000016
:00448E5D 50                      push eax
:00448E5E 6A04                    push 00000004
:00448E60 E88C430300              call 0047D1F1
:00448E65 83C40C                  add esp, 0000000C
:00448E68 68FFFF0000              push 0000FFFF
:00448E6D 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00448E73 8B5170                  mov edx, dword ptr [ecx+70]
:00448E76 0395ECFEFFFF            add edx, dword ptr [ebp+FFFFFEEC]
:00448E7C 52                      push edx
:00448E7D 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:00448E83 8B486C                  mov ecx, dword ptr [eax+6C]
:00448E86 83E901                  sub ecx, 00000001
:00448E89 8B95ECFEFFFF            mov edx, dword ptr [ebp+FFFFFEEC]
:00448E8F 83EA04                  sub edx, 00000004
:00448E92 6BD203                  imul edx, 00000003
:00448E95 2BCA                    sub ecx, edx
:00448E97 51                      push ecx
:00448E98 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:00448E9E 8B4870                  mov ecx, dword ptr [eax+70]
:00448EA1 038DECFEFFFF            add ecx, dword ptr [ebp+FFFFFEEC]
:00448EA7 51                      push ecx
:00448EA8 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:00448EAE 8B4268                  mov eax, dword ptr [edx+68]
:00448EB1 0385ECFEFFFF            add eax, dword ptr [ebp+FFFFFEEC]
:00448EB7 50                      push eax
:00448EB8 E801460300              call 0047D4BE
:00448EBD 83C414                  add esp, 00000014
:00448EC0 68FFFF0000              push 0000FFFF
:00448EC5 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00448ECB 8B5174                  mov edx, dword ptr [ecx+74]
:00448ECE 83EA01                  sub edx, 00000001
:00448ED1 8B85ECFEFFFF            mov eax, dword ptr [ebp+FFFFFEEC]
:00448ED7 83E804                  sub eax, 00000004
:00448EDA 6BC003                  imul eax, 00000003
:00448EDD 2BD0                    sub edx, eax
:00448EDF 52                      push edx
:00448EE0 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00448EE6 8B5168                  mov edx, dword ptr [ecx+68]
:00448EE9 0395ECFEFFFF            add edx, dword ptr [ebp+FFFFFEEC]
:00448EEF 52                      push edx
:00448EF0 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:00448EF6 8B4870                  mov ecx, dword ptr [eax+70]
:00448EF9 038DECFEFFFF            add ecx, dword ptr [ebp+FFFFFEEC]
:00448EFF 51                      push ecx
:00448F00 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:00448F06 8B4268                  mov eax, dword ptr [edx+68]
:00448F09 0385ECFEFFFF            add eax, dword ptr [ebp+FFFFFEEC]
:00448F0F 50                      push eax
:00448F10 E8A9450300              call 0047D4BE
:00448F15 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00448D8B(U), :00448E47(U)
|
:00448F18 E9A3FDFFFF              jmp 00448CC0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00448CD6(C)
|
:00448F1D 6A00                    push 00000000
:00448F1F 6A00                    push 00000000
:00448F21 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00448F27 E8E1AAFFFF              call 00443A0D
:00448F2C 6A00                    push 00000000
:00448F2E 6A01                    push 00000001
:00448F30 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00448F36 E8D2AAFFFF              call 00443A0D
:00448F3B 6A01                    push 00000001
:00448F3D 6A00                    push 00000000
:00448F3F 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00448F45 E829A8FFFF              call 00443773
:00448F4A 6A01                    push 00000001
:00448F4C 6A01                    push 00000001
:00448F4E 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00448F54 E81AA8FFFF              call 00443773
:00448F59 E89856FDFF              call 0041E5F6
:00448F5E 6A04                    push 00000004
:00448F60 6A00                    push 00000000
:00448F62 6A00                    push 00000000
:00448F64 B968AB4A00              mov ecx, 004AAB68
:00448F69 E8D26A0300              call 0047FA40
:00448F6E 50                      push eax
:00448F6F 6880010000              push 00000180
:00448F74 6870020000              push 00000270
:00448F79 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00448F7F 8B5170                  mov edx, dword ptr [ecx+70]
:00448F82 52                      push edx
:00448F83 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:00448F89 8B4868                  mov ecx, dword ptr [eax+68]
:00448F8C 51                      push ecx
:00448F8D E8BF520300              call 0047E251
:00448F92 83C414                  add esp, 00000014
:00448F95 6A04                    push 00000004
:00448F97 6A00                    push 00000000
:00448F99 6800400200              push 00024000
:00448F9E B9C8E44A00              mov ecx, 004AE4C8
:00448FA3 E8986A0300              call 0047FA40
:00448FA8 50                      push eax
:00448FA9 6880000000              push 00000080
:00448FAE 6870020000              push 00000270
:00448FB3 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:00448FB9 8B8280000000            mov eax, dword ptr [edx+00000080]
:00448FBF 83E810                  sub eax, 00000010
:00448FC2 50                      push eax
:00448FC3 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00448FC9 8B5178                  mov edx, dword ptr [ecx+78]
:00448FCC 52                      push edx
:00448FCD E87F520300              call 0047E251
:00448FD2 83C414                  add esp, 00000014
:00448FD5 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00448FDC 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:00448FE2 E8E9A2FBFF              call 004032D0
:00448FE7 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00448FEA 64890D00000000          mov dword ptr fs:[00000000], ecx
:00448FF1 8BE5                    mov esp, ebp
:00448FF3 5D                      pop ebp
:00448FF4 C3                      ret



* Referenced by a CALL at Address:
|:004176B0   
|
:00448FF5 55                      push ebp
:00448FF6 8BEC                    mov ebp, esp
:00448FF8 83EC0C                  sub esp, 0000000C
:00448FFB 894DF4                  mov dword ptr [ebp-0C], ecx
:00448FFE 8B45F4                  mov eax, dword ptr [ebp-0C]
:00449001 83C030                  add eax, 00000030
:00449004 8945F8                  mov dword ptr [ebp-08], eax
:00449007 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044900A 83C104                  add ecx, 00000004
:0044900D 894DFC                  mov dword ptr [ebp-04], ecx
:00449010 6A14                    push 00000014
:00449012 B9181B4B00              mov ecx, 004B1B18
:00449017 E824A3FBFF              call 00403340
:0044901C E8BF34FEFF              call 0042C4E0
:00449021 E8B555FDFF              call 0041E5DB
:00449026 6A00                    push 00000000
:00449028 6A1F                    push 0000001F
:0044902A 6A04                    push 00000004
:0044902C E8C0410300              call 0047D1F1
:00449031 83C40C                  add esp, 0000000C
:00449034 6A04                    push 00000004
:00449036 6A00                    push 00000000
:00449038 6A00                    push 00000000
:0044903A B968AB4A00              mov ecx, 004AAB68
:0044903F E8FC690300              call 0047FA40
:00449044 50                      push eax
:00449045 6880010000              push 00000180
:0044904A 6870020000              push 00000270
:0044904F 8B55F4                  mov edx, dword ptr [ebp-0C]
:00449052 8B4270                  mov eax, dword ptr [edx+70]
:00449055 50                      push eax
:00449056 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00449059 8B5168                  mov edx, dword ptr [ecx+68]
:0044905C 52                      push edx
:0044905D E839500300              call 0047E09B
:00449062 83C414                  add esp, 00000014
:00449065 6A01                    push 00000001
:00449067 8B45F8                  mov eax, dword ptr [ebp-08]
:0044906A 50                      push eax
:0044906B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044906E E87AAAFFFF              call 00443AED
:00449073 6A00                    push 00000000
:00449075 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00449078 51                      push ecx
:00449079 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044907C E86CAAFFFF              call 00443AED
:00449081 E87055FDFF              call 0041E5F6
:00449086 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00449089 E8C5A5FFFF              call 00443653
:0044908E 6A14                    push 00000014
:00449090 B9181B4B00              mov ecx, 004B1B18
:00449095 E8A6A2FBFF              call 00403340
:0044909A E84134FEFF              call 0042C4E0
:0044909F E83755FDFF              call 0041E5DB
:004490A4 6A01                    push 00000001
:004490A6 8B55F8                  mov edx, dword ptr [ebp-08]
:004490A9 52                      push edx
:004490AA 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004490AD E83BAAFFFF              call 00443AED
:004490B2 6A00                    push 00000000
:004490B4 8B45FC                  mov eax, dword ptr [ebp-04]
:004490B7 50                      push eax
:004490B8 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004490BB E82DAAFFFF              call 00443AED
:004490C0 E83155FDFF              call 0041E5F6
:004490C5 6A0A                    push 0000000A
:004490C7 B9181B4B00              mov ecx, 004B1B18
:004490CC E86FA2FBFF              call 00403340
:004490D1 E80A34FEFF              call 0042C4E0
:004490D6 8BE5                    mov esp, ebp
:004490D8 5D                      pop ebp
:004490D9 C3                      ret



* Referenced by a CALL at Address:
|:004176F3   
|
:004490DA 55                      push ebp
:004490DB 8BEC                    mov ebp, esp
:004490DD 83EC34                  sub esp, 00000034
:004490E0 894DE4                  mov dword ptr [ebp-1C], ecx
:004490E3 8B45E4                  mov eax, dword ptr [ebp-1C]
:004490E6 83C030                  add eax, 00000030
:004490E9 8945F0                  mov dword ptr [ebp-10], eax
:004490EC 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004490EF 83C104                  add ecx, 00000004
:004490F2 894DF4                  mov dword ptr [ebp-0C], ecx
:004490F5 6A14                    push 00000014
:004490F7 B9181B4B00              mov ecx, 004B1B18
:004490FC E83FA2FBFF              call 00403340
:00449101 E8DA33FEFF              call 0042C4E0
:00449106 E8D054FDFF              call 0041E5DB
:0044910B 837D0800                cmp dword ptr [ebp+08], 00000000
:0044910F 0F841D020000            je 00449332
:00449115 8B55F4                  mov edx, dword ptr [ebp-0C]
:00449118 837A2460                cmp dword ptr [edx+24], 00000060
:0044911C 750B                    jne 00449129
:0044911E 8B45F4                  mov eax, dword ptr [ebp-0C]
:00449121 8B4820                  mov ecx, dword ptr [eax+20]
:00449124 894DE0                  mov dword ptr [ebp-20], ecx
:00449127 EB0C                    jmp 00449135

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044911C(C)
|
:00449129 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044912C 8B4220                  mov eax, dword ptr [edx+20]
:0044912F 83E810                  sub eax, 00000010
:00449132 8945E0                  mov dword ptr [ebp-20], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449127(U)
|
:00449135 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00449138 894DF8                  mov dword ptr [ebp-08], ecx
:0044913B 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044913E 837A2460                cmp dword ptr [edx+24], 00000060
:00449142 750E                    jne 00449152
:00449144 8B45E4                  mov eax, dword ptr [ebp-1C]
:00449147 8B8880000000            mov ecx, dword ptr [eax+00000080]
:0044914D 894DDC                  mov dword ptr [ebp-24], ecx
:00449150 EB0F                    jmp 00449161

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449142(C)
|
:00449152 8B55E4                  mov edx, dword ptr [ebp-1C]
:00449155 8B8280000000            mov eax, dword ptr [edx+00000080]
:0044915B 83E810                  sub eax, 00000010
:0044915E 8945DC                  mov dword ptr [ebp-24], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449150(U)
|
:00449161 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00449164 894DFC                  mov dword ptr [ebp-04], ecx
:00449167 6800400000              push 00004000
:0044916C 6A04                    push 00000004
:0044916E 6A00                    push 00000000
:00449170 6800800100              push 00018000
:00449175 B9C8E44A00              mov ecx, 004AE4C8
:0044917A E8C1680300              call 0047FA40
:0044917F 50                      push eax
:00449180 6A04                    push 00000004
:00449182 6A00                    push 00000000
:00449184 6800000200              push 00020000
:00449189 B9C8E44A00              mov ecx, 004AE4C8
:0044918E E8AD680300              call 0047FA40
:00449193 50                      push eax
:00449194 E8646B0300              call 0047FCFD
:00449199 83C40C                  add esp, 0000000C
:0044919C 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044919F 8B4224                  mov eax, dword ptr [edx+24]
:004491A2 50                      push eax
:004491A3 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004491A6 8B5124                  mov edx, dword ptr [ecx+24]
:004491A9 52                      push edx
:004491AA 6A04                    push 00000004
:004491AC 6A00                    push 00000000
:004491AE 6800800100              push 00018000
:004491B3 B9C8E44A00              mov ecx, 004AE4C8
:004491B8 E883680300              call 0047FA40
:004491BD 50                      push eax
:004491BE E8B776FEFF              call 0043087A
:004491C3 83C40C                  add esp, 0000000C
:004491C6 6A04                    push 00000004
:004491C8 6A00                    push 00000000
:004491CA 6A00                    push 00000000
:004491CC B968AB4A00              mov ecx, 004AAB68
:004491D1 E86A680300              call 0047FA40
:004491D6 50                      push eax
:004491D7 6880010000              push 00000180
:004491DC 6870020000              push 00000270
:004491E1 8B45E4                  mov eax, dword ptr [ebp-1C]
:004491E4 8B4870                  mov ecx, dword ptr [eax+70]
:004491E7 51                      push ecx
:004491E8 8B55E4                  mov edx, dword ptr [ebp-1C]
:004491EB 8B4268                  mov eax, dword ptr [edx+68]
:004491EE 50                      push eax
:004491EF E8A74E0300              call 0047E09B
:004491F4 83C414                  add esp, 00000014
:004491F7 6A01                    push 00000001
:004491F9 6A00                    push 00000000
:004491FB 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004491FE E80AA8FFFF              call 00443A0D
:00449203 6A01                    push 00000001
:00449205 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00449208 51                      push ecx
:00449209 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0044920C E8DCA8FFFF              call 00443AED
:00449211 8B55F4                  mov edx, dword ptr [ebp-0C]
:00449214 52                      push edx
:00449215 6A04                    push 00000004
:00449217 6A00                    push 00000000
:00449219 6800800100              push 00018000
:0044921E B9C8E44A00              mov ecx, 004AE4C8
:00449223 E818680300              call 0047FA40
:00449228 50                      push eax
:00449229 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044922C 8B4824                  mov ecx, dword ptr [eax+24]
:0044922F 51                      push ecx
:00449230 8B55F4                  mov edx, dword ptr [ebp-0C]
:00449233 8B4224                  mov eax, dword ptr [edx+24]
:00449236 50                      push eax
:00449237 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044923A 51                      push ecx
:0044923B 8B55F8                  mov edx, dword ptr [ebp-08]
:0044923E 52                      push edx
:0044923F 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00449242 E8D6A9FFFF              call 00443C1D
:00449247 8B45F0                  mov eax, dword ptr [ebp-10]
:0044924A 8B4804                  mov ecx, dword ptr [eax+04]
:0044924D E8026DFFFF              call 0043FF54
:00449252 85C0                    test eax, eax
:00449254 0F84D3000000            je 0044932D
:0044925A 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044925D 8B09                    mov ecx, dword ptr [ecx]
:0044925F E86CD3FBFF              call 004065D0
:00449264 25FF000000              and eax, 000000FF
:00449269 8945EC                  mov dword ptr [ebp-14], eax
:0044926C 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044926F 8B0A                    mov ecx, dword ptr [edx]
:00449271 E85AD3FBFF              call 004065D0
:00449276 25FF000000              and eax, 000000FF
:0044927B 8945E8                  mov dword ptr [ebp-18], eax
:0044927E 8B45EC                  mov eax, dword ptr [ebp-14]
:00449281 3B45E8                  cmp eax, dword ptr [ebp-18]
:00449284 733C                    jnb 004492C2
:00449286 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00449289 2B4DEC                  sub ecx, dword ptr [ebp-14]
:0044928C 8D14CD20000000          lea edx, dword ptr [8*ecx+00000020]
:00449293 81FAC8000000            cmp edx, 000000C8
:00449299 7609                    jbe 004492A4

* Possible Reference to Dialog: DialogID_00C8 
                                  |
:0044929B C745D8C8000000          mov [ebp-28], 000000C8
:004492A2 EB10                    jmp 004492B4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449299(C)
|
:004492A4 8B45E8                  mov eax, dword ptr [ebp-18]
:004492A7 2B45EC                  sub eax, dword ptr [ebp-14]
:004492AA 8D0CC520000000          lea ecx, dword ptr [8*eax+00000020]
:004492B1 894DD8                  mov dword ptr [ebp-28], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004492A2(U)
|
:004492B4 8B55E4                  mov edx, dword ptr [ebp-1C]
:004492B7 8B45D8                  mov eax, dword ptr [ebp-28]
:004492BA 898284000000            mov dword ptr [edx+00000084], eax
:004492C0 EB45                    jmp 00449307

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449284(C)
|
:004492C2 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004492C5 2B4DE8                  sub ecx, dword ptr [ebp-18]
:004492C8 C1E102                  shl ecx, 02
:004492CB 51                      push ecx
:004492CC 6A20                    push 00000020
:004492CE E8CB670300              call 0047FA9E
:004492D3 83C408                  add esp, 00000008
:004492D6 83F80A                  cmp eax, 0000000A
:004492D9 7309                    jnb 004492E4
:004492DB C745D40A000000          mov [ebp-2C], 0000000A
:004492E2 EB17                    jmp 004492FB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004492D9(C)
|
:004492E4 8B55EC                  mov edx, dword ptr [ebp-14]
:004492E7 2B55E8                  sub edx, dword ptr [ebp-18]
:004492EA C1E202                  shl edx, 02
:004492ED 52                      push edx
:004492EE 6A20                    push 00000020
:004492F0 E8A9670300              call 0047FA9E
:004492F5 83C408                  add esp, 00000008
:004492F8 8945D4                  mov dword ptr [ebp-2C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004492E2(U)
|
:004492FB 8B45E4                  mov eax, dword ptr [ebp-1C]
:004492FE 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00449301 898884000000            mov dword ptr [eax+00000084], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004492C0(U)
|
:00449307 B9902F4900              mov ecx, 00492F90
:0044930C E81FD3FBFF              call 00406630
:00449311 8B55F4                  mov edx, dword ptr [ebp-0C]
:00449314 394208                  cmp dword ptr [edx+08], eax
:00449317 7514                    jne 0044932D
:00449319 8B45E4                  mov eax, dword ptr [ebp-1C]
:0044931C 8B8884000000            mov ecx, dword ptr [eax+00000084]
:00449322 D1E1                    shl ecx, 1
:00449324 8B55E4                  mov edx, dword ptr [ebp-1C]
:00449327 898A84000000            mov dword ptr [edx+00000084], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00449254(C), :00449317(C)
|
:0044932D E932010000              jmp 00449464

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044910F(C)
|
:00449332 8B45F0                  mov eax, dword ptr [ebp-10]
:00449335 83782460                cmp dword ptr [eax+24], 00000060
:00449339 750B                    jne 00449346
:0044933B 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044933E 8B5120                  mov edx, dword ptr [ecx+20]
:00449341 8955D0                  mov dword ptr [ebp-30], edx
:00449344 EB0C                    jmp 00449352

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449339(C)
|
:00449346 8B45F0                  mov eax, dword ptr [ebp-10]
:00449349 8B4820                  mov ecx, dword ptr [eax+20]
:0044934C 83E910                  sub ecx, 00000010
:0044934F 894DD0                  mov dword ptr [ebp-30], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449344(U)
|
:00449352 8B55D0                  mov edx, dword ptr [ebp-30]
:00449355 8955F8                  mov dword ptr [ebp-08], edx
:00449358 8B45F0                  mov eax, dword ptr [ebp-10]
:0044935B 83782460                cmp dword ptr [eax+24], 00000060
:0044935F 750E                    jne 0044936F
:00449361 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00449364 8B9180000000            mov edx, dword ptr [ecx+00000080]
:0044936A 8955CC                  mov dword ptr [ebp-34], edx
:0044936D EB0F                    jmp 0044937E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044935F(C)
|
:0044936F 8B45E4                  mov eax, dword ptr [ebp-1C]
:00449372 8B8880000000            mov ecx, dword ptr [eax+00000080]
:00449378 83E910                  sub ecx, 00000010
:0044937B 894DCC                  mov dword ptr [ebp-34], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044936D(U)
|
:0044937E 8B55CC                  mov edx, dword ptr [ebp-34]
:00449381 8955FC                  mov dword ptr [ebp-04], edx
:00449384 6800400000              push 00004000
:00449389 6A04                    push 00000004
:0044938B 6A00                    push 00000000
:0044938D 6800800100              push 00018000
:00449392 B9C8E44A00              mov ecx, 004AE4C8
:00449397 E8A4660300              call 0047FA40
:0044939C 50                      push eax
:0044939D 6A04                    push 00000004
:0044939F 6A00                    push 00000000
:004493A1 6800C00100              push 0001C000
:004493A6 B9C8E44A00              mov ecx, 004AE4C8
:004493AB E890660300              call 0047FA40
:004493B0 50                      push eax
:004493B1 E847690300              call 0047FCFD
:004493B6 83C40C                  add esp, 0000000C
:004493B9 8B45F0                  mov eax, dword ptr [ebp-10]
:004493BC 8B4824                  mov ecx, dword ptr [eax+24]
:004493BF 51                      push ecx
:004493C0 8B55F0                  mov edx, dword ptr [ebp-10]
:004493C3 8B4224                  mov eax, dword ptr [edx+24]
:004493C6 50                      push eax
:004493C7 6A04                    push 00000004
:004493C9 6A00                    push 00000000
:004493CB 6800800100              push 00018000
:004493D0 B9C8E44A00              mov ecx, 004AE4C8
:004493D5 E866660300              call 0047FA40
:004493DA 50                      push eax
:004493DB E89A74FEFF              call 0043087A
:004493E0 83C40C                  add esp, 0000000C
:004493E3 6A04                    push 00000004
:004493E5 6A00                    push 00000000
:004493E7 6A00                    push 00000000
:004493E9 B968AB4A00              mov ecx, 004AAB68
:004493EE E84D660300              call 0047FA40
:004493F3 50                      push eax
:004493F4 6880010000              push 00000180
:004493F9 6870020000              push 00000270
:004493FE 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00449401 8B5170                  mov edx, dword ptr [ecx+70]
:00449404 52                      push edx
:00449405 8B45E4                  mov eax, dword ptr [ebp-1C]
:00449408 8B4868                  mov ecx, dword ptr [eax+68]
:0044940B 51                      push ecx
:0044940C E88A4C0300              call 0047E09B
:00449411 83C414                  add esp, 00000014
:00449414 6A01                    push 00000001
:00449416 6A01                    push 00000001
:00449418 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0044941B E8EDA5FFFF              call 00443A0D
:00449420 6A01                    push 00000001
:00449422 8B55F4                  mov edx, dword ptr [ebp-0C]
:00449425 52                      push edx
:00449426 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00449429 E8BFA6FFFF              call 00443AED
:0044942E 8B45F0                  mov eax, dword ptr [ebp-10]
:00449431 50                      push eax
:00449432 6A04                    push 00000004
:00449434 6A00                    push 00000000
:00449436 6800800100              push 00018000
:0044943B B9C8E44A00              mov ecx, 004AE4C8
:00449440 E8FB650300              call 0047FA40
:00449445 50                      push eax
:00449446 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00449449 8B5124                  mov edx, dword ptr [ecx+24]
:0044944C 52                      push edx
:0044944D 8B45F0                  mov eax, dword ptr [ebp-10]
:00449450 8B4824                  mov ecx, dword ptr [eax+24]
:00449453 51                      push ecx
:00449454 8B55FC                  mov edx, dword ptr [ebp-04]
:00449457 52                      push edx
:00449458 8B45F8                  mov eax, dword ptr [ebp-08]
:0044945B 50                      push eax
:0044945C 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0044945F E8B9A7FFFF              call 00443C1D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044932D(U)
|
:00449464 E88D51FDFF              call 0041E5F6
:00449469 6A14                    push 00000014
:0044946B B9181B4B00              mov ecx, 004B1B18
:00449470 E8CB9EFBFF              call 00403340
:00449475 E86630FEFF              call 0042C4E0
:0044947A 8BE5                    mov esp, ebp
:0044947C 5D                      pop ebp
:0044947D C20400                  ret 0004



* Referenced by a CALL at Address:
|:0041769A   
|
:00449480 55                      push ebp
:00449481 8BEC                    mov ebp, esp
:00449483 83EC18                  sub esp, 00000018
:00449486 894DE8                  mov dword ptr [ebp-18], ecx
:00449489 8B45E8                  mov eax, dword ptr [ebp-18]
:0044948C 833800                  cmp dword ptr [eax], 00000000
:0044948F 7505                    jne 00449496
:00449491 E95C010000              jmp 004495F2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044948F(C)
|
:00449496 33C9                    xor ecx, ecx
:00449498 837D0800                cmp dword ptr [ebp+08], 00000000
:0044949C 0F95C1                  setne cl
:0044949F 6BC92C                  imul ecx, 0000002C
:004494A2 8B55E8                  mov edx, dword ptr [ebp-18]
:004494A5 8D440A04                lea eax, dword ptr [edx+ecx+04]
:004494A9 8945EC                  mov dword ptr [ebp-14], eax
:004494AC 33C9                    xor ecx, ecx
:004494AE 837D0800                cmp dword ptr [ebp+08], 00000000
:004494B2 0F95C1                  setne cl
:004494B5 8B55EC                  mov edx, dword ptr [ebp-14]
:004494B8 884A0C                  mov byte ptr [edx+0C], cl
:004494BB 6A04                    push 00000004
:004494BD 6A00                    push 00000000
:004494BF 8B45EC                  mov eax, dword ptr [ebp-14]
:004494C2 33C9                    xor ecx, ecx
:004494C4 8A480D                  mov cl, byte ptr [eax+0D]
:004494C7 69C900630000            imul ecx, 00006300
:004494CD 81C100480000            add ecx, 00004800
:004494D3 51                      push ecx
:004494D4 B980AB4A00              mov ecx, 004AAB80
:004494D9 E862650300              call 0047FA40
:004494DE 8945FC                  mov dword ptr [ebp-04], eax
:004494E1 6A04                    push 00000004
:004494E3 6A00                    push 00000000
:004494E5 6800780300              push 00037800
:004494EA B9C8E44A00              mov ecx, 004AE4C8
:004494EF E84C650300              call 0047FA40
:004494F4 8945F0                  mov dword ptr [ebp-10], eax
:004494F7 6A04                    push 00000004
:004494F9 6A00                    push 00000000
:004494FB 6A00                    push 00000000
:004494FD B9C8E44A00              mov ecx, 004AE4C8
:00449502 E839650300              call 0047FA40
:00449507 8945F8                  mov dword ptr [ebp-08], eax
:0044950A 6A30                    push 00000030
:0044950C 6A30                    push 00000030
:0044950E 8B55F0                  mov edx, dword ptr [ebp-10]
:00449511 52                      push edx
:00449512 8B45FC                  mov eax, dword ptr [ebp-04]
:00449515 50                      push eax
:00449516 E85B75FEFF              call 00430A76
:0044951B 83C410                  add esp, 00000010
:0044951E 6A00                    push 00000000
:00449520 6A12                    push 00000012
:00449522 6A04                    push 00000004
:00449524 E8C83C0300              call 0047D1F1
:00449529 83C40C                  add esp, 0000000C
:0044952C C645F410                mov [ebp-0C], 10
:00449530 EB09                    jmp 0044953B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004495B0(U)
|
:00449532 8A4DF4                  mov cl, byte ptr [ebp-0C]
:00449535 80E901                  sub cl, 01
:00449538 884DF4                  mov byte ptr [ebp-0C], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449530(U)
|
:0044953B 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044953E 81E2FF000000            and edx, 000000FF
:00449544 85D2                    test edx, edx
:00449546 7E6A                    jle 004495B2
:00449548 6800240000              push 00002400
:0044954D 8B45F8                  mov eax, dword ptr [ebp-08]
:00449550 50                      push eax
:00449551 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00449554 51                      push ecx
:00449555 E8A3670300              call 0047FCFD
:0044955A 83C40C                  add esp, 0000000C
:0044955D 8B55F4                  mov edx, dword ptr [ebp-0C]
:00449560 81E2FF000000            and edx, 000000FF
:00449566 83EA01                  sub edx, 00000001
:00449569 52                      push edx
:0044956A 6A60                    push 00000060
:0044956C 6A60                    push 00000060
:0044956E 8B45F8                  mov eax, dword ptr [ebp-08]
:00449571 50                      push eax
:00449572 E8496EFEFF              call 004303C0
:00449577 83C410                  add esp, 00000010
:0044957A 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0044957D 51                      push ecx
:0044957E 8B55F8                  mov edx, dword ptr [ebp-08]
:00449581 52                      push edx
:00449582 6A60                    push 00000060
:00449584 6A60                    push 00000060
:00449586 8B45E8                  mov eax, dword ptr [ebp-18]
:00449589 8B8880000000            mov ecx, dword ptr [eax+00000080]
:0044958F 51                      push ecx
:00449590 8B55EC                  mov edx, dword ptr [ebp-14]
:00449593 8B4220                  mov eax, dword ptr [edx+20]
:00449596 50                      push eax
:00449597 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0044959A E87EA6FFFF              call 00443C1D
:0044959F 6A01                    push 00000001
:004495A1 B9181B4B00              mov ecx, 004B1B18
:004495A6 E8959DFBFF              call 00403340
:004495AB E8302FFEFF              call 0042C4E0
:004495B0 EB80                    jmp 00449532

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449546(C)
|
:004495B2 6A05                    push 00000005
:004495B4 B9181B4B00              mov ecx, 004B1B18
:004495B9 E8829DFBFF              call 00403340
:004495BE E81D2FFEFF              call 0042C4E0
:004495C3 8B4D10                  mov ecx, dword ptr [ebp+10]
:004495C6 81E1FF000000            and ecx, 000000FF
:004495CC 85C9                    test ecx, ecx
:004495CE 7410                    je 004495E0
:004495D0 8A5510                  mov dl, byte ptr [ebp+10]
:004495D3 52                      push edx
:004495D4 8B4508                  mov eax, dword ptr [ebp+08]
:004495D7 50                      push eax
:004495D8 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004495DB E844EFFFFF              call 00448524

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004495CE(C)
|
:004495E0 6A01                    push 00000001
:004495E2 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004495E5 51                      push ecx
:004495E6 8B5508                  mov edx, dword ptr [ebp+08]
:004495E9 52                      push edx
:004495EA 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004495ED E8BD9BFFFF              call 004431AF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449491(U)
|
:004495F2 8BE5                    mov esp, ebp
:004495F4 5D                      pop ebp
:004495F5 C20C00                  ret 000C



* Referenced by a CALL at Address:
|:00449A42   
|
:004495F8 55                      push ebp
:004495F9 8BEC                    mov ebp, esp
:004495FB 51                      push ecx
:004495FC 894DFC                  mov dword ptr [ebp-04], ecx
:004495FF 8B45FC                  mov eax, dword ptr [ebp-04]
:00449602 C64010FF                mov [eax+10], FF
:00449606 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00449609 C6413CFF                mov [ecx+3C], FF
:0044960D 8B55FC                  mov edx, dword ptr [ebp-04]
:00449610 8B420C                  mov eax, dword ptr [edx+0C]
:00449613 6BC048                  imul eax, 00000048
:00449616 05681B4A00              add eax, 004A1B68
:0044961B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044961E 894104                  mov dword ptr [ecx+04], eax
:00449621 8B55FC                  mov edx, dword ptr [ebp-04]
:00449624 8B4238                  mov eax, dword ptr [edx+38]
:00449627 6BC048                  imul eax, 00000048
:0044962A 05681B4A00              add eax, 004A1B68
:0044962F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00449632 894130                  mov dword ptr [ecx+30], eax
:00449635 8B55FC                  mov edx, dword ptr [ebp-04]
:00449638 8B4A04                  mov ecx, dword ptr [edx+04]
:0044963B E89CE40200              call 00477ADC
:00449640 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00449643 884111                  mov byte ptr [ecx+11], al
:00449646 8B55FC                  mov edx, dword ptr [ebp-04]
:00449649 8B4A30                  mov ecx, dword ptr [edx+30]
:0044964C E88BE40200              call 00477ADC
:00449651 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00449654 88413D                  mov byte ptr [ecx+3D], al
:00449657 8B55FC                  mov edx, dword ptr [ebp-04]
:0044965A 33C0                    xor eax, eax
:0044965C 8A4211                  mov al, byte ptr [edx+11]
:0044965F 3DFF000000              cmp eax, 000000FF
:00449664 7410                    je 00449676
:00449666 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00449669 33D2                    xor edx, edx
:0044966B 8A513D                  mov dl, byte ptr [ecx+3D]
:0044966E 81FAFF000000            cmp edx, 000000FF
:00449674 7507                    jne 0044967D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449664(C)
|
:00449676 33C0                    xor eax, eax
:00449678 E95F020000              jmp 004498DC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449674(C)
|
:0044967D 8B45FC                  mov eax, dword ptr [ebp-04]
:00449680 33C9                    xor ecx, ecx
:00449682 8A4811                  mov cl, byte ptr [eax+11]
:00449685 6BC924                  imul ecx, 00000024
:00449688 81C1502C4B00            add ecx, 004B2C50
:0044968E 8B55FC                  mov edx, dword ptr [ebp-04]
:00449691 894A08                  mov dword ptr [edx+08], ecx
:00449694 8B45FC                  mov eax, dword ptr [ebp-04]
:00449697 33C9                    xor ecx, ecx
:00449699 8A483D                  mov cl, byte ptr [eax+3D]
:0044969C 6BC924                  imul ecx, 00000024
:0044969F 81C1502C4B00            add ecx, 004B2C50
:004496A5 8B55FC                  mov edx, dword ptr [ebp-04]
:004496A8 894A34                  mov dword ptr [edx+34], ecx
:004496AB B950424B00              mov ecx, 004B4250
:004496B0 E88FC70000              call 00455E44
:004496B5 99                      cdq
:004496B6 B930000000              mov ecx, 00000030
:004496BB F7F9                    idiv ecx
:004496BD 8B55FC                  mov edx, dword ptr [ebp-04]
:004496C0 88425C                  mov byte ptr [edx+5C], al
:004496C3 B950424B00              mov ecx, 004B4250
:004496C8 E89EC70000              call 00455E6B
:004496CD 99                      cdq
:004496CE B930000000              mov ecx, 00000030
:004496D3 F7F9                    idiv ecx
:004496D5 8B55FC                  mov edx, dword ptr [ebp-04]
:004496D8 88425D                  mov byte ptr [edx+5D], al
:004496DB 8B45FC                  mov eax, dword ptr [ebp-04]
:004496DE C640620D                mov [eax+62], 0D
:004496E2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004496E5 C6416308                mov [ecx+63], 08
:004496E9 8B55FC                  mov edx, dword ptr [ebp-04]
:004496EC 33C0                    xor eax, eax
:004496EE 8A425C                  mov al, byte ptr [edx+5C]
:004496F1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004496F4 33D2                    xor edx, edx
:004496F6 8A5162                  mov dl, byte ptr [ecx+62]
:004496F9 2BC2                    sub eax, edx
:004496FB 99                      cdq
:004496FC 2BC2                    sub eax, edx
:004496FE D1F8                    sar eax, 1
:00449700 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00449703 88415E                  mov byte ptr [ecx+5E], al
:00449706 8B55FC                  mov edx, dword ptr [ebp-04]
:00449709 33C0                    xor eax, eax
:0044970B 8A425D                  mov al, byte ptr [edx+5D]
:0044970E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00449711 33D2                    xor edx, edx
:00449713 8A5163                  mov dl, byte ptr [ecx+63]
:00449716 2BC2                    sub eax, edx
:00449718 99                      cdq
:00449719 2BC2                    sub eax, edx
:0044971B D1F8                    sar eax, 1
:0044971D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00449720 88415F                  mov byte ptr [ecx+5F], al
:00449723 8B55FC                  mov edx, dword ptr [ebp-04]
:00449726 33C0                    xor eax, eax
:00449728 8A425E                  mov al, byte ptr [edx+5E]
:0044972B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044972E 33D2                    xor edx, edx
:00449730 8A5162                  mov dl, byte ptr [ecx+62]
:00449733 03C2                    add eax, edx
:00449735 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00449738 884160                  mov byte ptr [ecx+60], al
:0044973B 8B55FC                  mov edx, dword ptr [ebp-04]
:0044973E 33C0                    xor eax, eax
:00449740 8A425F                  mov al, byte ptr [edx+5F]
:00449743 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00449746 33D2                    xor edx, edx
:00449748 8A5163                  mov dl, byte ptr [ecx+63]
:0044974B 03C2                    add eax, edx
:0044974D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00449750 884161                  mov byte ptr [ecx+61], al
:00449753 B950424B00              mov ecx, 004B4250
:00449758 E8E7C60000              call 00455E44
:0044975D 99                      cdq
:0044975E 2BC2                    sub eax, edx
:00449760 D1F8                    sar eax, 1
:00449762 2D38010000              sub eax, 00000138
:00449767 8B55FC                  mov edx, dword ptr [ebp-04]
:0044976A 894268                  mov dword ptr [edx+68], eax
:0044976D 8B45FC                  mov eax, dword ptr [ebp-04]
:00449770 8B4868                  mov ecx, dword ptr [eax+68]
:00449773 81C170020000            add ecx, 00000270
:00449779 8B55FC                  mov edx, dword ptr [ebp-04]
:0044977C 894A6C                  mov dword ptr [edx+6C], ecx
:0044977F B950424B00              mov ecx, 004B4250
:00449784 E8E2C60000              call 00455E6B
:00449789 99                      cdq
:0044978A 2BC2                    sub eax, edx
:0044978C D1F8                    sar eax, 1
:0044978E 2D88000000              sub eax, 00000088
:00449793 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00449796 894170                  mov dword ptr [ecx+70], eax
:00449799 8B55FC                  mov edx, dword ptr [ebp-04]
:0044979C 8B4270                  mov eax, dword ptr [edx+70]
:0044979F 0580010000              add eax, 00000180
:004497A4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004497A7 894174                  mov dword ptr [ecx+74], eax
:004497AA 8B55FC                  mov edx, dword ptr [ebp-04]
:004497AD 8B45FC                  mov eax, dword ptr [ebp-04]
:004497B0 8B4868                  mov ecx, dword ptr [eax+68]
:004497B3 894A78                  mov dword ptr [edx+78], ecx
:004497B6 8B55FC                  mov edx, dword ptr [ebp-04]
:004497B9 8B45FC                  mov eax, dword ptr [ebp-04]
:004497BC 8B486C                  mov ecx, dword ptr [eax+6C]
:004497BF 894A7C                  mov dword ptr [edx+7C], ecx
:004497C2 8B55FC                  mov edx, dword ptr [ebp-04]
:004497C5 8B4268                  mov eax, dword ptr [edx+68]
:004497C8 83C018                  add eax, 00000018
:004497CB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004497CE 894114                  mov dword ptr [ecx+14], eax
:004497D1 8B55FC                  mov edx, dword ptr [ebp-04]
:004497D4 8B4270                  mov eax, dword ptr [edx+70]
:004497D7 83C018                  add eax, 00000018
:004497DA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004497DD 894118                  mov dword ptr [ecx+18], eax
:004497E0 8B55FC                  mov edx, dword ptr [ebp-04]
:004497E3 8B426C                  mov eax, dword ptr [edx+6C]
:004497E6 83E858                  sub eax, 00000058
:004497E9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004497EC 894140                  mov dword ptr [ecx+40], eax
:004497EF 8B55FC                  mov edx, dword ptr [ebp-04]
:004497F2 8B4274                  mov eax, dword ptr [edx+74]
:004497F5 83E868                  sub eax, 00000068
:004497F8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004497FB 894144                  mov dword ptr [ecx+44], eax
:004497FE 8B55FC                  mov edx, dword ptr [ebp-04]
:00449801 8B4214                  mov eax, dword ptr [edx+14]
:00449804 83C060                  add eax, 00000060
:00449807 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044980A 89411C                  mov dword ptr [ecx+1C], eax
:0044980D 8B55FC                  mov edx, dword ptr [ebp-04]
:00449810 8B4218                  mov eax, dword ptr [edx+18]
:00449813 83C008                  add eax, 00000008
:00449816 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00449819 894120                  mov dword ptr [ecx+20], eax
:0044981C 8B55FC                  mov edx, dword ptr [ebp-04]
:0044981F 8B4240                  mov eax, dword ptr [edx+40]
:00449822 2D60010000              sub eax, 00000160
:00449827 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044982A 894148                  mov dword ptr [ecx+48], eax
:0044982D 8B55FC                  mov edx, dword ptr [ebp-04]
:00449830 8B4244                  mov eax, dword ptr [edx+44]
:00449833 83C008                  add eax, 00000008
:00449836 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00449839 89414C                  mov dword ptr [ecx+4C], eax
:0044983C 8B55FC                  mov edx, dword ptr [ebp-04]
:0044983F 8B45FC                  mov eax, dword ptr [ebp-04]
:00449842 8B4A6C                  mov ecx, dword ptr [edx+6C]
:00449845 2B4868                  sub ecx, dword ptr [eax+68]
:00449848 D1E9                    shr ecx, 1
:0044984A 8B55FC                  mov edx, dword ptr [ebp-04]
:0044984D 8B4268                  mov eax, dword ptr [edx+68]
:00449850 8D8C0870FFFFFF          lea ecx, dword ptr [eax+ecx-00000090]
:00449857 8B55FC                  mov edx, dword ptr [ebp-04]
:0044985A 894A24                  mov dword ptr [edx+24], ecx
:0044985D 8B45FC                  mov eax, dword ptr [ebp-04]
:00449860 8B4824                  mov ecx, dword ptr [eax+24]
:00449863 81C1C0000000            add ecx, 000000C0
:00449869 8B55FC                  mov edx, dword ptr [ebp-04]
:0044986C 894A50                  mov dword ptr [edx+50], ecx
:0044986F 8B45FC                  mov eax, dword ptr [ebp-04]
:00449872 C7402860000000          mov [eax+28], 00000060
:00449879 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044987C C7415460000000          mov [ecx+54], 00000060
:00449883 8B55FC                  mov edx, dword ptr [ebp-04]
:00449886 8B45FC                  mov eax, dword ptr [ebp-04]
:00449889 8B4A74                  mov ecx, dword ptr [edx+74]
:0044988C 2B4870                  sub ecx, dword ptr [eax+70]
:0044988F D1E9                    shr ecx, 1
:00449891 8B55FC                  mov edx, dword ptr [ebp-04]
:00449894 8B4270                  mov eax, dword ptr [edx+70]
:00449897 8D4C08D0                lea ecx, dword ptr [eax+ecx-30]
:0044989B 8B55FC                  mov edx, dword ptr [ebp-04]
:0044989E 898A80000000            mov dword ptr [edx+00000080], ecx
:004498A4 6A08                    push 00000008
:004498A6 8B45FC                  mov eax, dword ptr [ebp-04]
:004498A9 8B4808                  mov ecx, dword ptr [eax+08]
:004498AC E83FC2FDFF              call 00425AF0
:004498B1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004498B4 89412C                  mov dword ptr [ecx+2C], eax
:004498B7 6A08                    push 00000008
:004498B9 8B55FC                  mov edx, dword ptr [ebp-04]
:004498BC 8B4A34                  mov ecx, dword ptr [edx+34]
:004498BF E82CC2FDFF              call 00425AF0
:004498C4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004498C7 894158                  mov dword ptr [ecx+58], eax
:004498CA 8B55FC                  mov edx, dword ptr [ebp-04]
:004498CD C7828400000000000000    mov dword ptr [ebx+00000084], 00000000
:004498D7 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449678(U)
|
:004498DC 8BE5                    mov esp, ebp
:004498DE 5D                      pop ebp
:004498DF C3                      ret



* Referenced by a CALL at Address:
|:004175F0   
|
:004498E0 55                      push ebp
:004498E1 8BEC                    mov ebp, esp
:004498E3 51                      push ecx
:004498E4 894DFC                  mov dword ptr [ebp-04], ecx
:004498E7 8B45FC                  mov eax, dword ptr [ebp-04]
:004498EA 8B482C                  mov ecx, dword ptr [eax+2C]
:004498ED 51                      push ecx
:004498EE 8B55FC                  mov edx, dword ptr [ebp-04]
:004498F1 8B4A08                  mov ecx, dword ptr [edx+08]
:004498F4 E83B64FFFF              call 0043FD34
:004498F9 8B45FC                  mov eax, dword ptr [ebp-04]
:004498FC 8B4858                  mov ecx, dword ptr [eax+58]
:004498FF 51                      push ecx
:00449900 8B55FC                  mov edx, dword ptr [ebp-04]
:00449903 8B4A34                  mov ecx, dword ptr [edx+34]
:00449906 E82964FFFF              call 0043FD34
:0044990B 8B45FC                  mov eax, dword ptr [ebp-04]
:0044990E C70000000000            mov dword ptr [eax], 00000000
:00449914 6A1E                    push 0000001E
:00449916 E82B2DFEFF              call 0042C646
:0044991B 83C404                  add esp, 00000004
:0044991E B950424B00              mov ecx, 004B4250
:00449923 E8EBA10000              call 00453B13
:00449928 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044992B 33D2                    xor edx, edx
:0044992D 8A5164                  mov dl, byte ptr [ecx+64]
:00449930 52                      push edx
:00449931 B9B8694B00              mov ecx, 004B69B8
:00449936 E8C3AC0200              call 004745FE
:0044993B 8B45FC                  mov eax, dword ptr [ebp-04]
:0044993E 8B4834                  mov ecx, dword ptr [eax+34]
:00449941 E80E66FFFF              call 0043FF54
:00449946 85C0                    test eax, eax
:00449948 7451                    je 0044999B
:0044994A 6A01                    push 00000001
:0044994C 6A00                    push 00000000
:0044994E 6A00                    push 00000000
:00449950 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00449953 8B9184000000            mov edx, dword ptr [ecx+00000084]
:00449959 52                      push edx
:0044995A 6A00                    push 00000000
:0044995C 6A00                    push 00000000
:0044995E 8B45FC                  mov eax, dword ptr [ebp-04]
:00449961 8A4811                  mov cl, byte ptr [eax+11]
:00449964 51                      push ecx
:00449965 8B55FC                  mov edx, dword ptr [ebp-04]
:00449968 8A423D                  mov al, byte ptr [edx+3D]
:0044996B 50                      push eax
:0044996C E813700000              call 00450984
:00449971 83C420                  add esp, 00000020
:00449974 6A01                    push 00000001
:00449976 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00449979 8B4930                  mov ecx, dword ptr [ecx+30]
:0044997C E8CFCCFBFF              call 00406650
:00449981 25FF000000              and eax, 000000FF
:00449986 8B55FC                  mov edx, dword ptr [ebp-04]
:00449989 038284000000            add eax, dword ptr [edx+00000084]
:0044998F 50                      push eax
:00449990 8B45FC                  mov eax, dword ptr [ebp-04]
:00449993 8B4830                  mov ecx, dword ptr [eax+30]
:00449996 E8B5EFFBFF              call 00408950

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449948(C)
|
:0044999B 8BE5                    mov esp, ebp
:0044999D 5D                      pop ebp
:0044999E C3                      ret



* Referenced by a CALL at Address:
|:004175DA   
|
:0044999F 55                      push ebp
:004499A0 8BEC                    mov ebp, esp
:004499A2 51                      push ecx
:004499A3 894DFC                  mov dword ptr [ebp-04], ecx
:004499A6 8B4508                  mov eax, dword ptr [ebp+08]
:004499A9 50                      push eax
:004499AA E8E107FDFF              call 0041A190
:004499AF 83C404                  add esp, 00000004
:004499B2 85C0                    test eax, eax
:004499B4 7414                    je 004499CA
:004499B6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004499B9 8B550C                  mov edx, dword ptr [ebp+0C]
:004499BC 89510C                  mov dword ptr [ecx+0C], edx
:004499BF 8B45FC                  mov eax, dword ptr [ebp-04]
:004499C2 8B4D08                  mov ecx, dword ptr [ebp+08]
:004499C5 894838                  mov dword ptr [eax+38], ecx
:004499C8 EB75                    jmp 00449A3F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004499B4(C)
|
:004499CA 8B550C                  mov edx, dword ptr [ebp+0C]
:004499CD 52                      push edx
:004499CE E8BD07FDFF              call 0041A190
:004499D3 83C404                  add esp, 00000004
:004499D6 85C0                    test eax, eax
:004499D8 7414                    je 004499EE
:004499DA 8B45FC                  mov eax, dword ptr [ebp-04]
:004499DD 8B4D08                  mov ecx, dword ptr [ebp+08]
:004499E0 89480C                  mov dword ptr [eax+0C], ecx
:004499E3 8B55FC                  mov edx, dword ptr [ebp-04]
:004499E6 8B450C                  mov eax, dword ptr [ebp+0C]
:004499E9 894238                  mov dword ptr [edx+38], eax
:004499EC EB51                    jmp 00449A3F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004499D8(C)
|
:004499EE 8B4D08                  mov ecx, dword ptr [ebp+08]
:004499F1 6BC948                  imul ecx, 00000048
:004499F4 81C1681B4A00            add ecx, 004A1B68
:004499FA E8DDE00200              call 00477ADC
:004499FF 8AC8                    mov cl, al
:00449A01 81E1FF000000            and ecx, 000000FF
:00449A07 6BC924                  imul ecx, 00000024
:00449A0A 81C1502C4B00            add ecx, 004B2C50
:00449A10 E8FBCCFBFF              call 00406710
:00449A15 85C0                    test eax, eax
:00449A17 7414                    je 00449A2D
:00449A19 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00449A1C 8B550C                  mov edx, dword ptr [ebp+0C]
:00449A1F 89510C                  mov dword ptr [ecx+0C], edx
:00449A22 8B45FC                  mov eax, dword ptr [ebp-04]
:00449A25 8B4D08                  mov ecx, dword ptr [ebp+08]
:00449A28 894838                  mov dword ptr [eax+38], ecx
:00449A2B EB12                    jmp 00449A3F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449A17(C)
|
:00449A2D 8B55FC                  mov edx, dword ptr [ebp-04]
:00449A30 8B4508                  mov eax, dword ptr [ebp+08]
:00449A33 89420C                  mov dword ptr [edx+0C], eax
:00449A36 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00449A39 8B550C                  mov edx, dword ptr [ebp+0C]
:00449A3C 895138                  mov dword ptr [ecx+38], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004499C8(U), :004499EC(U), :00449A2B(U)
|
:00449A3F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00449A42 E8B1FBFFFF              call 004495F8
:00449A47 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00449A4A 8901                    mov dword ptr [ecx], eax
:00449A4C 8B55FC                  mov edx, dword ptr [ebp-04]
:00449A4F 833A00                  cmp dword ptr [edx], 00000000
:00449A52 7430                    je 00449A84
:00449A54 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00449A57 E898ECFFFF              call 004486F4
:00449A5C 8B45FC                  mov eax, dword ptr [ebp-04]
:00449A5F C6401201                mov [eax+12], 01
:00449A63 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00449A66 C6413E03                mov [ecx+3E], 03
:00449A6A 6A01                    push 00000001
:00449A6C 8B55FC                  mov edx, dword ptr [ebp-04]
:00449A6F 8B4A08                  mov ecx, dword ptr [edx+08]
:00449A72 E8BD62FFFF              call 0043FD34
:00449A77 6A00                    push 00000000
:00449A79 8B45FC                  mov eax, dword ptr [ebp-04]
:00449A7C 8B4834                  mov ecx, dword ptr [eax+34]
:00449A7F E8B062FFFF              call 0043FD34

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449A52(C)
|
:00449A84 8BE5                    mov esp, ebp
:00449A86 5D                      pop ebp
:00449A87 C20800                  ret 0008


:00449A8A CC                      int 03
:00449A8B CC                      int 03
:00449A8C CC                      int 03
:00449A8D CC                      int 03
:00449A8E CC                      int 03
:00449A8F CC                      int 03
:00449A90 55                      push ebp
:00449A91 8BEC                    mov ebp, esp
:00449A93 E807000000              call 00449A9F
:00449A98 E811000000              call 00449AAE
:00449A9D 5D                      pop ebp
:00449A9E C3                      ret



* Referenced by a CALL at Address:
|:00449A93   
|
:00449A9F 55                      push ebp
:00449AA0 8BEC                    mov ebp, esp
:00449AA2 B9083D4B00              mov ecx, 004B3D08
:00449AA7 E8F45D0000              call 0044F8A0
:00449AAC 5D                      pop ebp
:00449AAD C3                      ret



* Referenced by a CALL at Address:
|:00449A98   
|
:00449AAE 55                      push ebp
:00449AAF 8BEC                    mov ebp, esp
:00449AB1 68C09A4400              push 00449AC0
:00449AB6 E845760300              call 00481100
:00449ABB 83C404                  add esp, 00000004
:00449ABE 5D                      pop ebp
:00449ABF C3                      ret


:00449AC0 55                      push ebp
:00449AC1 8BEC                    mov ebp, esp
:00449AC3 B9083D4B00              mov ecx, 004B3D08
:00449AC8 E8431AFEFF              call 0042B510
:00449ACD 5D                      pop ebp
:00449ACE C3                      ret


:00449ACF 55                      push ebp
:00449AD0 8BEC                    mov ebp, esp
:00449AD2 E802000000              call 00449AD9
:00449AD7 5D                      pop ebp
:00449AD8 C3                      ret



* Referenced by a CALL at Address:
|:00449AD2   
|
:00449AD9 55                      push ebp
:00449ADA 8BEC                    mov ebp, esp
:00449ADC B92C424B00              mov ecx, 004B422C
:00449AE1 E82A5C0100              call 0045F710
:00449AE6 5D                      pop ebp
:00449AE7 C3                      ret



* Referenced by a CALL at Address:
|:0044277E   
|
:00449AE8 55                      push ebp
:00449AE9 8BEC                    mov ebp, esp
:00449AEB 8B4508                  mov eax, dword ptr [ebp+08]
:00449AEE 83E008                  and eax, 00000008
:00449AF1 85C0                    test eax, eax
:00449AF3 7404                    je 00449AF9
:00449AF5 B001                    mov al, 01
:00449AF7 EB2C                    jmp 00449B25

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449AF3(C)
|
:00449AF9 8B4D08                  mov ecx, dword ptr [ebp+08]
:00449AFC 83E110                  and ecx, 00000010
:00449AFF 85C9                    test ecx, ecx
:00449B01 7404                    je 00449B07
:00449B03 B003                    mov al, 03
:00449B05 EB1E                    jmp 00449B25

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449B01(C)
|
:00449B07 8B5508                  mov edx, dword ptr [ebp+08]
:00449B0A 83E220                  and edx, 00000020
:00449B0D 85D2                    test edx, edx
:00449B0F 7404                    je 00449B15
:00449B11 32C0                    xor al, al
:00449B13 EB10                    jmp 00449B25

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449B0F(C)
|
:00449B15 8B4508                  mov eax, dword ptr [ebp+08]
:00449B18 83E040                  and eax, 00000040
:00449B1B 85C0                    test eax, eax
:00449B1D 7404                    je 00449B23
:00449B1F B002                    mov al, 02
:00449B21 EB02                    jmp 00449B25

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449B1D(C)
|
:00449B23 B002                    mov al, 02

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00449AF7(U), :00449B05(U), :00449B13(U), :00449B21(U)
|
:00449B25 5D                      pop ebp
:00449B26 C3                      ret



* Referenced by a CALL at Addresses:
|:004128E5   , :00412D05   , :00415F4B   , :0045925F   
|
:00449B27 55                      push ebp
:00449B28 8BEC                    mov ebp, esp
:00449B2A 51                      push ecx
:00449B2B 8B4508                  mov eax, dword ptr [ebp+08]
:00449B2E 25FF000000              and eax, 000000FF
:00449B33 8945FC                  mov dword ptr [ebp-04], eax
:00449B36 837DFC03                cmp dword ptr [ebp-04], 00000003
:00449B3A 7726                    ja 00449B62
:00449B3C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00449B3F FF248D6B9B4400          jmp dword ptr [4*ecx+00449B6B]
:00449B46 B808000000              mov eax, 00000008
:00449B4B EB1A                    jmp 00449B67
:00449B4D B810000000              mov eax, 00000010
:00449B52 EB13                    jmp 00449B67
:00449B54 B820000000              mov eax, 00000020
:00449B59 EB0C                    jmp 00449B67
:00449B5B B840000000              mov eax, 00000040
:00449B60 EB05                    jmp 00449B67

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449B3A(C)
|
:00449B62 B840000000              mov eax, 00000040

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00449B4B(U), :00449B52(U), :00449B59(U), :00449B60(U)
|
:00449B67 8BE5                    mov esp, ebp
:00449B69 5D                      pop ebp
:00449B6A C3                      ret



:00449B6B 549B4400                DWORD 00449B54
:00449B6F 469B4400                DWORD 00449B46
:00449B73 5B9B4400                DWORD 00449B5B
:00449B77 4D9B4400                DWORD 00449B4D



* Referenced by a CALL at Address:
|:00442769   
|
:00449B7B 55                      push ebp
:00449B7C 8BEC                    mov ebp, esp
:00449B7E 8B4508                  mov eax, dword ptr [ebp+08]
:00449B81 83E001                  and eax, 00000001
:00449B84 85C0                    test eax, eax
:00449B86 7412                    je 00449B9A
:00449B88 8B4D08                  mov ecx, dword ptr [ebp+08]
:00449B8B 83E102                  and ecx, 00000002
:00449B8E 85C9                    test ecx, ecx
:00449B90 7404                    je 00449B96
:00449B92 B003                    mov al, 03
:00449B94 EB14                    jmp 00449BAA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449B90(C)
|
:00449B96 B002                    mov al, 02
:00449B98 EB10                    jmp 00449BAA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449B86(C)
|
:00449B9A 8B5508                  mov edx, dword ptr [ebp+08]
:00449B9D 83E202                  and edx, 00000002
:00449BA0 85D2                    test edx, edx
:00449BA2 7404                    je 00449BA8
:00449BA4 B001                    mov al, 01
:00449BA6 EB02                    jmp 00449BAA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449BA2(C)
|
:00449BA8 32C0                    xor al, al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00449B94(U), :00449B98(U), :00449BA6(U)
|
:00449BAA 5D                      pop ebp
:00449BAB C3                      ret



* Referenced by a CALL at Addresses:
|:00420FA6   , :0043BFBE   , :00440719   , :00440FCD   
|
:00449BAC 55                      push ebp
:00449BAD 8BEC                    mov ebp, esp
:00449BAF 51                      push ecx
:00449BB0 8B4508                  mov eax, dword ptr [ebp+08]
:00449BB3 25FF000000              and eax, 000000FF
:00449BB8 8945FC                  mov dword ptr [ebp-04], eax
:00449BBB 837DFC41                cmp dword ptr [ebp-04], 00000041
:00449BBF 7719                    ja 00449BDA
:00449BC1 8B55FC                  mov edx, dword ptr [ebp-04]
:00449BC4 33C9                    xor ecx, ecx
:00449BC6 8A8AF49B4400            mov cl, byte ptr [edx+00449BF4]
:00449BCC FF248DE09B4400          jmp dword ptr [4*ecx+00449BE0]
:00449BD3 B801000000              mov eax, 00000001
:00449BD8 EB02                    jmp 00449BDC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449BBF(C)
|
:00449BDA 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449BD8(U)
|
:00449BDC 8BE5                    mov esp, ebp
:00449BDE 5D                      pop ebp
:00449BDF C3                      ret



:00449BE0 D39B4400                DWORD 00449BD3
:00449BE4 D39B4400                DWORD 00449BD3
:00449BE8 D39B4400                DWORD 00449BD3
:00449BEC D39B4400                DWORD 00449BD3
:00449BF0 DA9B4400                DWORD 00449BDA


:00449BF4 00000000000000000000    BYTE 10 DUP(0)
:00449BFE 00000000000000000000    BYTE 10 DUP(0)
:00449C08 0000                    BYTE 2 DUP(0)


:00449C0A 0404                    add al, 04
:00449C0C 0404                    add al, 04
:00449C0E 0404                    add al, 04
:00449C10 0404                    add al, 04
:00449C12 0404                    add al, 04
:00449C14 0401                    add al, 01
:00449C16 0101                    add dword ptr [ecx], eax
:00449C18 010402                  add dword ptr [edx+eax], eax
:00449C1B 0404                    add al, 04
:00449C1D 0404                    add al, 04
:00449C1F 0404                    add al, 04
:00449C21 0404                    add al, 04
:00449C23 0404                    add al, 04
:00449C25 0404                    add al, 04
:00449C27 0404                    add al, 04
:00449C29 0404                    add al, 04
:00449C2B 0404                    add al, 04
:00449C2D 0404                    add al, 04
:00449C2F 0404                    add al, 04
:00449C31 0404                    add al, 04
:00449C33 0403                    add al, 03
:00449C35 03                      BYTE 03h


* Referenced by a CALL at Addresses:
|:0043BFCE   , :00440A24   , :00440FDD   
|
:00449C36 55                      push ebp
:00449C37 8BEC                    mov ebp, esp
:00449C39 51                      push ecx
:00449C3A 8A4508                  mov al, byte ptr [ebp+08]
:00449C3D 8845FC                  mov byte ptr [ebp-04], al
:00449C40 807DFC16                cmp byte ptr [ebp-04], 16
:00449C44 7402                    je 00449C48
:00449C46 EB07                    jmp 00449C4F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449C44(C)
|
:00449C48 B801000000              mov eax, 00000001
:00449C4D EB02                    jmp 00449C51

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449C46(U)
|
:00449C4F 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449C4D(U)
|
:00449C51 8BE5                    mov esp, ebp
:00449C53 5D                      pop ebp
:00449C54 C3                      ret



* Referenced by a CALL at Address:
|:004407F4   
|
:00449C55 55                      push ebp
:00449C56 8BEC                    mov ebp, esp
:00449C58 51                      push ecx
:00449C59 8A4508                  mov al, byte ptr [ebp+08]
:00449C5C 8845FC                  mov byte ptr [ebp-04], al
:00449C5F 807DFC27                cmp byte ptr [ebp-04], 27
:00449C63 720F                    jb 00449C74
:00449C65 807DFC2B                cmp byte ptr [ebp-04], 2B
:00449C69 7602                    jbe 00449C6D
:00449C6B EB07                    jmp 00449C74

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449C69(C)
|
:00449C6D B801000000              mov eax, 00000001
:00449C72 EB02                    jmp 00449C76

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00449C63(C), :00449C6B(U)
|
:00449C74 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449C72(U)
|
:00449C76 8BE5                    mov esp, ebp
:00449C78 5D                      pop ebp
:00449C79 C3                      ret



* Referenced by a CALL at Address:
|:00440ADB   
|
:00449C7A 55                      push ebp
:00449C7B 8BEC                    mov ebp, esp
:00449C7D 51                      push ecx
:00449C7E 8A4508                  mov al, byte ptr [ebp+08]
:00449C81 8845FC                  mov byte ptr [ebp-04], al
:00449C84 807DFC2C                cmp byte ptr [ebp-04], 2C
:00449C88 720F                    jb 00449C99
:00449C8A 807DFC2D                cmp byte ptr [ebp-04], 2D
:00449C8E 7602                    jbe 00449C92
:00449C90 EB07                    jmp 00449C99

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449C8E(C)
|
:00449C92 B801000000              mov eax, 00000001
:00449C97 EB02                    jmp 00449C9B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00449C88(C), :00449C90(U)
|
:00449C99 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449C97(U)
|
:00449C9B 8BE5                    mov esp, ebp
:00449C9D 5D                      pop ebp
:00449C9E C3                      ret



* Referenced by a CALL at Address:
|:004750E5   
|
:00449C9F 55                      push ebp
:00449CA0 8BEC                    mov ebp, esp
:00449CA2 B9083D4B00              mov ecx, 004B3D08
:00449CA7 E850060000              call 0044A2FC
:00449CAC 5D                      pop ebp
:00449CAD C3                      ret



* Referenced by a CALL at Address:
|:00474DF6   
|
:00449CAE 55                      push ebp
:00449CAF 8BEC                    mov ebp, esp
:00449CB1 E86C1CFCFF              call 0040B922
:00449CB6 85C0                    test eax, eax
:00449CB8 7416                    je 00449CD0

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:00449CBA 6A06                    push 00000006
:00449CBC B9083D4B00              mov ecx, 004B3D08
:00449CC1 E85A21FCFF              call 0040BE20
:00449CC6 B950424B00              mov ecx, 004B4250
:00449CCB E862A10000              call 00453E32

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449CB8(C)
|
:00449CD0 5D                      pop ebp
:00449CD1 C3                      ret



* Referenced by a CALL at Address:
|:00474DFD   
|
:00449CD2 55                      push ebp
:00449CD3 8BEC                    mov ebp, esp
:00449CD5 E8481CFCFF              call 0040B922
:00449CDA 85C0                    test eax, eax
:00449CDC 740C                    je 00449CEA

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:00449CDE 6A07                    push 00000007
:00449CE0 B9083D4B00              mov ecx, 004B3D08
:00449CE5 E83621FCFF              call 0040BE20

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449CDC(C)
|
:00449CEA 5D                      pop ebp
:00449CEB C3                      ret



* Referenced by a CALL at Address:
|:00474D64   
|
:00449CEC 55                      push ebp
:00449CED 8BEC                    mov ebp, esp
:00449CEF 83EC0C                  sub esp, 0000000C
:00449CF2 E82B1CFCFF              call 0040B922
:00449CF7 85C0                    test eax, eax
:00449CF9 0F8493000000            je 00449D92
:00449CFF 33C0                    xor eax, eax
:00449D01 A0083D4B00              mov al, byte ptr [004B3D08]
:00449D06 83F83A                  cmp eax, 0000003A
:00449D09 0F8D83000000            jnl 00449D92
:00449D0F 6A00                    push 00000000
:00449D11 E8D0000000              call 00449DE6
:00449D16 83C404                  add esp, 00000004
:00449D19 B9902F4900              mov ecx, 00492F90
:00449D1E E84D26FDFF              call 0041C370
:00449D23 8945FC                  mov dword ptr [ebp-04], eax
:00449D26 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00449D29 51                      push ecx
:00449D2A E82B5F0300              call 0047FC5A
:00449D2F 83C404                  add esp, 00000004
:00449D32 8945F8                  mov dword ptr [ebp-08], eax
:00449D35 8B55FC                  mov edx, dword ptr [ebp-04]
:00449D38 0FBE02                  movsx eax, byte ptr [edx]
:00449D3B 85C0                    test eax, eax
:00449D3D 7411                    je 00449D50
:00449D3F 817DF8FA000000          cmp dword ptr [ebp-08], 000000FA
:00449D46 7308                    jnb 00449D50
:00449D48 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00449D4B 894DF4                  mov dword ptr [ebp-0C], ecx
:00449D4E EB07                    jmp 00449D57

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00449D3D(C), :00449D46(C)
|

* Possible StringData Ref from Data Obj ->"޷ʾ"
                                  |
:00449D50 C745F444E14800          mov [ebp-0C], 0048E144

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449D4E(U)
|
:00449D57 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"ʤ"
                                  |
:00449D59 6838E14800              push 0048E138
:00449D5E 8B55F4                  mov edx, dword ptr [ebp-0C]
:00449D61 52                      push edx
:00449D62 E8F2AD0200              call 00474B59
:00449D67 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449D7A(U)
|
:00449D6A 33C0                    xor eax, eax
:00449D6C A0707A4900              mov al, byte ptr [00497A70]
:00449D71 85C0                    test eax, eax
:00449D73 7E07                    jle 00449D7C
:00449D75 E87C48FDFF              call 0041E5F6
:00449D7A EBEE                    jmp 00449D6A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449D73(C)
|
:00449D7C 6A00                    push 00000000
:00449D7E B9F05D4B00              mov ecx, 004B5DF0
:00449D83 E846030100              call 0045A0CE
:00449D88 6A01                    push 00000001
:00449D8A E857000000              call 00449DE6
:00449D8F 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00449CF9(C), :00449D09(C)
|
:00449D92 8BE5                    mov esp, ebp
:00449D94 5D                      pop ebp
:00449D95 C3                      ret



* Referenced by a CALL at Addresses:
|:00411F2B   , :00474DEF   
|
:00449D96 55                      push ebp
:00449D97 8BEC                    mov ebp, esp
:00449D99 E8841BFCFF              call 0040B922
:00449D9E 85C0                    test eax, eax
:00449DA0 7442                    je 00449DE4
:00449DA2 A1D85F4B00              mov eax, dword ptr [004B5FD8]
:00449DA7 50                      push eax
:00449DA8 FF15C8624800            call dword ptr [004862C8]
:00449DAE 85C0                    test eax, eax
:00449DB0 740F                    je 00449DC1
:00449DB2 8B0DD85F4B00            mov ecx, dword ptr [004B5FD8]
:00449DB8 51                      push ecx
:00449DB9 FF15F8624800            call dword ptr [004862F8]
:00449DBF EB23                    jmp 00449DE4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449DB0(C)
|
:00449DC1 B9083D4B00              mov ecx, 004B3D08
:00449DC6 E8BF0A0000              call 0044A88A
:00449DCB 6A05                    push 00000005
:00449DCD 8B15D85F4B00            mov edx, dword ptr [004B5FD8]
:00449DD3 52                      push edx
:00449DD4 FF15E0624800            call dword ptr [004862E0]
:00449DDA B9083D4B00              mov ecx, 004B3D08
:00449DDF E8A60A0000              call 0044A88A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00449DA0(C), :00449DBF(U)
|
:00449DE4 5D                      pop ebp
:00449DE5 C3                      ret



* Referenced by a CALL at Addresses:
|:00449D11   , :00449D8A   , :0044D0D4   , :0044D45F   , :0044E3CD   
|:0044E4B0   , :0044E590   , :0044E5C0   , :0044E5EB   , :0044E6DC   
|:0044EE82   , :0044EEA1   
|
:00449DE6 55                      push ebp
:00449DE7 8BEC                    mov ebp, esp
:00449DE9 837D0800                cmp dword ptr [ebp+08], 00000000
:00449DED 743F                    je 00449E2E
:00449DEF 6A00                    push 00000000
:00449DF1 B9083D4B00              mov ecx, 004B3D08
:00449DF6 E8255B0000              call 0044F920
:00449DFB 50                      push eax
:00449DFC E8871E0300              call 0047BC88
:00449E01 83C408                  add esp, 00000008
:00449E04 B9083D4B00              mov ecx, 004B3D08
:00449E09 E8125B0000              call 0044F920
:00449E0E 50                      push eax
:00449E0F E8A8BB0200              call 004759BC
:00449E14 83C404                  add esp, 00000004
:00449E17 B9083D4B00              mov ecx, 004B3D08
:00449E1C E8FF5A0000              call 0044F920
:00449E21 50                      push eax
:00449E22 B9805F4B00              mov ecx, 004B5F80
:00449E27 E8345B0000              call 0044F960
:00449E2C EB22                    jmp 00449E50

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449DED(C)
|
:00449E2E 6A00                    push 00000000
:00449E30 6A00                    push 00000000
:00449E32 E8511E0300              call 0047BC88
:00449E37 83C408                  add esp, 00000008
:00449E3A 6A00                    push 00000000
:00449E3C E87BBB0200              call 004759BC
:00449E41 83C404                  add esp, 00000004
:00449E44 6A00                    push 00000000
:00449E46 B9805F4B00              mov ecx, 004B5F80
:00449E4B E8105B0000              call 0044F960

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449E2C(U)
|
:00449E50 5D                      pop ebp
:00449E51 C3                      ret



* Referenced by a CALL at Addresses:
|:0044D111   , :0044D4C9   
|
:00449E52 55                      push ebp
:00449E53 8BEC                    mov ebp, esp
:00449E55 81ECD0000000            sub esp, 000000D0
:00449E5B 898D30FFFFFF            mov dword ptr [ebp+FFFFFF30], ecx
:00449E61 8B8530FFFFFF            mov eax, dword ptr [ebp+FFFFFF30]
:00449E67 33C9                    xor ecx, ecx
:00449E69 8A08                    mov cl, byte ptr [eax]
:00449E6B 83F93A                  cmp ecx, 0000003A
:00449E6E 7D30                    jge 00449EA0
:00449E70 8B9530FFFFFF            mov edx, dword ptr [ebp+FFFFFF30]
:00449E76 33C0                    xor eax, eax
:00449E78 8A02                    mov al, byte ptr [edx]
:00449E7A 50                      push eax
:00449E7B 8D8D34FFFFFF            lea ecx, dword ptr [ebp+FFFFFF34]
:00449E81 51                      push ecx
:00449E82 E81D21FCFF              call 0040BFA4
:00449E87 83C408                  add esp, 00000008
:00449E8A 6A16                    push 00000016
:00449E8C 8D9534FFFFFF            lea edx, dword ptr [ebp+FFFFFF34]
:00449E92 52                      push edx
:00449E93 6858074B00              push 004B0758
:00449E98 E853690300              call 004807F0
:00449E9D 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00449E6E(C)
|
:00449EA0 8BE5                    mov esp, ebp
:00449EA2 5D                      pop ebp
:00449EA3 C3                      ret



* Referenced by a CALL at Address:
|:0044F0EE   
|
:00449EA4 55                      push ebp
:00449EA5 8BEC                    mov ebp, esp
:00449EA7 51                      push ecx
:00449EA8 894DFC                  mov dword ptr [ebp-04], ecx
:00449EAB E82B47FDFF              call 0041E5DB
:00449EB0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00449EB3 E8385A0000              call 0044F8F0
:00449EB8 50                      push eax
:00449EB9 E86FC30200              call 0047622D
:00449EBE 83C404                  add esp, 00000004
:00449EC1 E83047FDFF              call 0041E5F6
:00449EC6 8BE5                    mov esp, ebp
:00449EC8 5D                      pop ebp
:00449EC9 C3                      ret



* Referenced by a CALL at Addresses:
|:00417135   , :0044ED9F   , :0044F0E6   
|
:00449ECA 55                      push ebp
:00449ECB 8BEC                    mov ebp, esp
:00449ECD 51                      push ecx
:00449ECE 894DFC                  mov dword ptr [ebp-04], ecx
:00449ED1 8B45FC                  mov eax, dword ptr [ebp-04]
:00449ED4 8A4803                  mov cl, byte ptr [eax+03]
:00449ED7 51                      push ecx
:00449ED8 8B55FC                  mov edx, dword ptr [ebp-04]
:00449EDB 33C0                    xor eax, eax
:00449EDD 8A4202                  mov al, byte ptr [edx+02]
:00449EE0 83C001                  add eax, 00000001
:00449EE3 50                      push eax
:00449EE4 E834C40200              call 0047631D
:00449EE9 83C408                  add esp, 00000008
:00449EEC 8BE5                    mov esp, ebp
:00449EEE 5D                      pop ebp
:00449EEF C3                      ret



* Referenced by a CALL at Addresses:
|:0044A194   , :0044F0D6   
|
:00449EF0 55                      push ebp
:00449EF1 8BEC                    mov ebp, esp
:00449EF3 6AFF                    push FFFFFFFF
:00449EF5 68BC554800              push 004855BC
:00449EFA 64A100000000            mov eax, dword ptr fs:[00000000]
:00449F00 50                      push eax
:00449F01 64892500000000          mov dword ptr fs:[00000000], esp
:00449F08 81EC08010000            sub esp, 00000108
:00449F0E 898DECFEFFFF            mov dword ptr [ebp+FFFFFEEC], ecx
:00449F14 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:00449F1A E89193FBFF              call 004032B0
:00449F1F C745FC00000000          mov [ebp-04], 00000000

* Possible StringData Ref from Data Obj ->"WEATHER.E5"
                                  |
:00449F26 6800BC4800              push 0048BC00
:00449F2B 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:00449F31 E8FF5BFDFF              call 0041FB35
:00449F36 6A04                    push 00000004
:00449F38 6A00                    push 00000000
:00449F3A 68E0C70100              push 0001C7E0
:00449F3F B950EB4A00              mov ecx, 004AEB50
:00449F44 E8F75A0300              call 0047FA40
:00449F49 50                      push eax
:00449F4A 8B8DECFEFFFF            mov ecx, dword ptr [ebp+FFFFFEEC]
:00449F50 E87F020000              call 0044A1D4
:00449F55 25FF000000              and eax, 000000FF
:00449F5A 50                      push eax
:00449F5B 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:00449F61 E8235DFDFF              call 0041FC89
:00449F66 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:00449F6C E854F3FCFF              call 004192C5
:00449F71 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00449F78 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:00449F7E E84D93FBFF              call 004032D0
:00449F83 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00449F86 64890D00000000          mov dword ptr fs:[00000000], ecx
:00449F8D 8BE5                    mov esp, ebp
:00449F8F 5D                      pop ebp
:00449F90 C3                      ret



* Referenced by a CALL at Addresses:
|:00423C30   , :0044EFD9   
|
:00449F91 55                      push ebp
:00449F92 8BEC                    mov ebp, esp
:00449F94 6AFF                    push FFFFFFFF
:00449F96 68D2554800              push 004855D2
:00449F9B 64A100000000            mov eax, dword ptr fs:[00000000]
:00449FA1 50                      push eax
:00449FA2 64892500000000          mov dword ptr fs:[00000000], esp
:00449FA9 81EC1C010000            sub esp, 0000011C
:00449FAF 898DD8FEFFFF            mov dword ptr [ebp+FFFFFED8], ecx
:00449FB5 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:00449FBB E8F092FBFF              call 004032B0
:00449FC0 C745FC00000000          mov [ebp-04], 00000000
:00449FC7 6A08                    push 00000008
:00449FC9 E8455B0300              call 0047FB13
:00449FCE 83C404                  add esp, 00000004
:00449FD1 8885E8FEFFFF            mov byte ptr [ebp+FFFFFEE8], al
:00449FD7 8B85D8FEFFFF            mov eax, dword ptr [ebp+FFFFFED8]
:00449FDD 33C9                    xor ecx, ecx
:00449FDF 8A4804                  mov cl, byte ptr [eax+04]
:00449FE2 83C101                  add ecx, 00000001
:00449FE5 888DE4FEFFFF            mov byte ptr [ebp+FFFFFEE4], cl
:00449FEB 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:00449FF1 E8DE010000              call 0044A1D4
:00449FF6 8885ECFEFFFF            mov byte ptr [ebp+FFFFFEEC], al
:00449FFC 8B5508                  mov edx, dword ptr [ebp+08]
:00449FFF 81E2FF000000            and edx, 000000FF
:0044A005 83FA06                  cmp edx, 00000006
:0044A008 7D11                    jge 0044A01B
:0044A00A 8B85D8FEFFFF            mov eax, dword ptr [ebp+FFFFFED8]
:0044A010 8A4D08                  mov cl, byte ptr [ebp+08]
:0044A013 884804                  mov byte ptr [eax+04], cl
:0044A016 E9A6000000              jmp 0044A0C1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A008(C)
|
:0044A01B 8B95E4FEFFFF            mov edx, dword ptr [ebp+FFFFFEE4]
:0044A021 81E2FF000000            and edx, 000000FF
:0044A027 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:0044A02D 25FF000000              and eax, 000000FF
:0044A032 3BD0                    cmp edx, eax
:0044A034 7E11                    jle 0044A047
:0044A036 8A8DE4FEFFFF            mov cl, byte ptr [ebp+FFFFFEE4]
:0044A03C 80E901                  sub cl, 01
:0044A03F 888DE4FEFFFF            mov byte ptr [ebp+FFFFFEE4], cl
:0044A045 EB2A                    jmp 0044A071

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A034(C)
|
:0044A047 8B95E4FEFFFF            mov edx, dword ptr [ebp+FFFFFEE4]
:0044A04D 81E2FF000000            and edx, 000000FF
:0044A053 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:0044A059 25FF000000              and eax, 000000FF
:0044A05E 3BD0                    cmp edx, eax
:0044A060 7D0F                    jge 0044A071
:0044A062 8A8DE4FEFFFF            mov cl, byte ptr [ebp+FFFFFEE4]
:0044A068 80C101                  add cl, 01
:0044A06B 888DE4FEFFFF            mov byte ptr [ebp+FFFFFEE4], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044A045(U), :0044A060(C)
|
:0044A071 8B95E4FEFFFF            mov edx, dword ptr [ebp+FFFFFEE4]
:0044A077 81E2FF000000            and edx, 000000FF
:0044A07D 85D2                    test edx, edx
:0044A07F 750C                    jne 0044A08D
:0044A081 8B85D8FEFFFF            mov eax, dword ptr [ebp+FFFFFED8]
:0044A087 C6400405                mov [eax+04], 05
:0044A08B EB34                    jmp 0044A0C1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A07F(C)
|
:0044A08D 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:0044A093 81E1FF000000            and ecx, 000000FF
:0044A099 83F907                  cmp ecx, 00000007
:0044A09C 750C                    jne 0044A0AA
:0044A09E 8B95D8FEFFFF            mov edx, dword ptr [ebp+FFFFFED8]
:0044A0A4 C6420400                mov [edx+04], 00
:0044A0A8 EB17                    jmp 0044A0C1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A09C(C)
|
:0044A0AA 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:0044A0B0 25FF000000              and eax, 000000FF
:0044A0B5 83E801                  sub eax, 00000001
:0044A0B8 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:0044A0BE 884104                  mov byte ptr [ecx+04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044A016(U), :0044A08B(U), :0044A0A8(U)
|
:0044A0C1 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:0044A0C7 E808010000              call 0044A1D4
:0044A0CC 25FF000000              and eax, 000000FF
:0044A0D1 8B95ECFEFFFF            mov edx, dword ptr [ebp+FFFFFEEC]
:0044A0D7 81E2FF000000            and edx, 000000FF
:0044A0DD 3BC2                    cmp eax, edx
:0044A0DF 0F84CD000000            je 0044A1B2
:0044A0E5 68E7030000              push 000003E7
:0044A0EA A1686A4B00              mov eax, dword ptr [004B6A68]
:0044A0EF 50                      push eax
:0044A0F0 FF1550624800            call dword ptr [00486250]
:0044A0F6 68004C0400              push 00044C00
:0044A0FB 6A04                    push 00000004
:0044A0FD 6A00                    push 00000000
:0044A0FF 6A00                    push 00000000
:0044A101 B9C8E44A00              mov ecx, 004AE4C8
:0044A106 E835590300              call 0047FA40
:0044A10B 50                      push eax
:0044A10C 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:0044A112 E8BD000000              call 0044A1D4
:0044A117 25FF000000              and eax, 000000FF
:0044A11C 83C034                  add eax, 00000034
:0044A11F 50                      push eax

* Possible StringData Ref from Data Obj ->"MEFF.E5"
                                  |
:0044A120 68F8BB4800              push 0048BBF8
:0044A125 B9B0174900              mov ecx, 004917B0
:0044A12A E8C973FBFF              call 004014F8
:0044A12F A128684800              mov eax, dword ptr [00486828]
:0044A134 99                      cdq
:0044A135 2BC2                    sub eax, edx
:0044A137 D1F8                    sar eax, 1
:0044A139 8985DCFEFFFF            mov dword ptr [ebp+FFFFFEDC], eax
:0044A13F A12C684800              mov eax, dword ptr [0048682C]
:0044A144 99                      cdq
:0044A145 2BC2                    sub eax, edx
:0044A147 D1F8                    sar eax, 1
:0044A149 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:0044A14F 8D8DDCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEDC]
:0044A155 51                      push ecx
:0044A156 6A01                    push 00000001
:0044A158 B9B0174900              mov ecx, 004917B0
:0044A15D E84278FBFF              call 004019A4
:0044A162 6A04                    push 00000004
:0044A164 E87A290300              call 0047CAE3
:0044A169 83C404                  add esp, 00000004
:0044A16C 6A00                    push 00000000
:0044A16E 6A00                    push 00000000
:0044A170 B9B0174900              mov ecx, 004917B0
:0044A175 E8E27CFBFF              call 00401E5C
:0044A17A 6A00                    push 00000000
:0044A17C E862290300              call 0047CAE3
:0044A181 83C404                  add esp, 00000004
:0044A184 B9B0174900              mov ecx, 004917B0
:0044A189 E81D75FBFF              call 004016AB
:0044A18E 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:0044A194 E857FDFFFF              call 00449EF0
:0044A199 6A00                    push 00000000
:0044A19B 68F4010000              push 000001F4
:0044A1A0 68E7030000              push 000003E7
:0044A1A5 8B15686A4B00            mov edx, dword ptr [004B6A68]
:0044A1AB 52                      push edx
:0044A1AC FF15A8634800            call dword ptr [004863A8]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A0DF(C)
|
:0044A1B2 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0044A1B9 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0044A1BF E80C91FBFF              call 004032D0
:0044A1C4 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044A1C7 64890D00000000          mov dword ptr fs:[00000000], ecx
:0044A1CE 8BE5                    mov esp, ebp
:0044A1D0 5D                      pop ebp
:0044A1D1 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0041FF29   , :00420072   , :0042018D   , :004202A7   , :00449F50   
|:00449FF1   , :0044A0C7   , :0044A112   
|
:0044A1D4 55                      push ebp
:0044A1D5 8BEC                    mov ebp, esp
:0044A1D7 51                      push ecx
:0044A1D8 894DFC                  mov dword ptr [ebp-04], ecx
:0044A1DB 8B45FC                  mov eax, dword ptr [ebp-04]
:0044A1DE 33C9                    xor ecx, ecx
:0044A1E0 8A4811                  mov cl, byte ptr [eax+11]
:0044A1E3 6BC906                  imul ecx, 00000006
:0044A1E6 8B55FC                  mov edx, dword ptr [ebp-04]
:0044A1E9 33C0                    xor eax, eax
:0044A1EB 8A4204                  mov al, byte ptr [edx+04]
:0044A1EE 8A840100E14800          mov al, byte ptr [ecx+eax+0048E100]
:0044A1F5 8BE5                    mov esp, ebp
:0044A1F7 5D                      pop ebp
:0044A1F8 C3                      ret



* Referenced by a CALL at Addresses:
|:00423B65   , :00423B8B   , :00423BB1   
|
:0044A1F9 55                      push ebp
:0044A1FA 8BEC                    mov ebp, esp
:0044A1FC 83EC08                  sub esp, 00000008
:0044A1FF 894DF8                  mov dword ptr [ebp-08], ecx
:0044A202 C645FC00                mov [ebp-04], 00
:0044A206 8B4508                  mov eax, dword ptr [ebp+08]
:0044A209 25FF000000              and eax, 000000FF
:0044A20E 83F801                  cmp eax, 00000001
:0044A211 7F50                    jg 0044A263
:0044A213 C645FC00                mov [ebp-04], 00
:0044A217 EB09                    jmp 0044A222

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A25C(U)
|
:0044A219 8A4DFC                  mov cl, byte ptr [ebp-04]
:0044A21C 80C101                  add cl, 01
:0044A21F 884DFC                  mov byte ptr [ebp-04], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A217(U)
|
:0044A222 8B55FC                  mov edx, dword ptr [ebp-04]
:0044A225 81E2FF000000            and edx, 000000FF
:0044A22B 83FA06                  cmp edx, 00000006
:0044A22E 7D2E                    jge 0044A25E
:0044A230 8B45F8                  mov eax, dword ptr [ebp-08]
:0044A233 33C9                    xor ecx, ecx
:0044A235 8A4811                  mov cl, byte ptr [eax+11]
:0044A238 6BC906                  imul ecx, 00000006
:0044A23B 8B55FC                  mov edx, dword ptr [ebp-04]
:0044A23E 81E2FF000000            and edx, 000000FF
:0044A244 33C0                    xor eax, eax
:0044A246 8A841100E14800          mov al, byte ptr [ecx+edx+0048E100]
:0044A24D 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044A250 81E1FF000000            and ecx, 000000FF
:0044A256 3BC1                    cmp eax, ecx
:0044A258 7502                    jne 0044A25C
:0044A25A EB02                    jmp 0044A25E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A258(C)
|
:0044A25C EBBB                    jmp 0044A219

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044A22E(C), :0044A25A(U)
|
:0044A25E E990000000              jmp 0044A2F3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A211(C)
|
:0044A263 C645FC06                mov [ebp-04], 06
:0044A267 EB09                    jmp 0044A272

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A2EE(U)
|
:0044A269 8A55FC                  mov dl, byte ptr [ebp-04]
:0044A26C 80EA01                  sub dl, 01
:0044A26F 8855FC                  mov byte ptr [ebp-04], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A267(U)
|
:0044A272 8B45FC                  mov eax, dword ptr [ebp-04]
:0044A275 25FF000000              and eax, 000000FF
:0044A27A 85C0                    test eax, eax
:0044A27C 7E75                    jle 0044A2F3
:0044A27E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044A281 33D2                    xor edx, edx
:0044A283 8A5111                  mov dl, byte ptr [ecx+11]
:0044A286 6BD206                  imul edx, 00000006
:0044A289 8B45FC                  mov eax, dword ptr [ebp-04]
:0044A28C 25FF000000              and eax, 000000FF
:0044A291 33C9                    xor ecx, ecx
:0044A293 8A8C02FFE04800          mov cl, byte ptr [edx+eax+0048E0FF]
:0044A29A 83F902                  cmp ecx, 00000002
:0044A29D 7444                    je 0044A2E3
:0044A29F 8B55F8                  mov edx, dword ptr [ebp-08]
:0044A2A2 33C0                    xor eax, eax
:0044A2A4 8A4211                  mov al, byte ptr [edx+11]
:0044A2A7 6BC006                  imul eax, 00000006
:0044A2AA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044A2AD 81E1FF000000            and ecx, 000000FF
:0044A2B3 33D2                    xor edx, edx
:0044A2B5 8A9408FFE04800          mov dl, byte ptr [eax+ecx+0048E0FF]
:0044A2BC 83FA03                  cmp edx, 00000003
:0044A2BF 7422                    je 0044A2E3
:0044A2C1 8B45F8                  mov eax, dword ptr [ebp-08]
:0044A2C4 33C9                    xor ecx, ecx
:0044A2C6 8A4811                  mov cl, byte ptr [eax+11]
:0044A2C9 6BC906                  imul ecx, 00000006
:0044A2CC 8B55FC                  mov edx, dword ptr [ebp-04]
:0044A2CF 81E2FF000000            and edx, 000000FF
:0044A2D5 33C0                    xor eax, eax
:0044A2D7 8A8411FFE04800          mov al, byte ptr [ecx+edx+0048E0FF]
:0044A2DE 83F804                  cmp eax, 00000004
:0044A2E1 750B                    jne 0044A2EE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044A29D(C), :0044A2BF(C)
|
:0044A2E3 8A4DFC                  mov cl, byte ptr [ebp-04]
:0044A2E6 80E901                  sub cl, 01
:0044A2E9 884DFC                  mov byte ptr [ebp-04], cl
:0044A2EC EB05                    jmp 0044A2F3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A2E1(C)
|
:0044A2EE E976FFFFFF              jmp 0044A269

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044A25E(U), :0044A27C(C), :0044A2EC(U)
|
:0044A2F3 8A45FC                  mov al, byte ptr [ebp-04]
:0044A2F6 8BE5                    mov esp, ebp
:0044A2F8 5D                      pop ebp
:0044A2F9 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00449CA7   , :0044F0DE   
|
:0044A2FC 55                      push ebp
:0044A2FD 8BEC                    mov ebp, esp
:0044A2FF 6AFF                    push FFFFFFFF
:0044A301 68E8554800              push 004855E8
:0044A306 64A100000000            mov eax, dword ptr fs:[00000000]
:0044A30C 50                      push eax
:0044A30D 64892500000000          mov dword ptr fs:[00000000], esp
:0044A314 81EC08010000            sub esp, 00000108
:0044A31A 898DECFEFFFF            mov dword ptr [ebp+FFFFFEEC], ecx
:0044A320 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0044A326 E8858FFBFF              call 004032B0
:0044A32B C745FC00000000          mov [ebp-04], 00000000
:0044A332 8B85ECFEFFFF            mov eax, dword ptr [ebp+FFFFFEEC]
:0044A338 83781400                cmp dword ptr [eax+14], 00000000
:0044A33C 0F8494000000            je 0044A3D6
:0044A342 E87D470300              call 0047EAC4
:0044A347 6A04                    push 00000004
:0044A349 E895270300              call 0047CAE3
:0044A34E 83C404                  add esp, 00000004

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0044A351 6A07                    push 00000007
:0044A353 E8722E0300              call 0047D1CA
:0044A358 83C404                  add esp, 00000004
:0044A35B 6A00                    push 00000000
:0044A35D 6A1F                    push 0000001F
:0044A35F 6A00                    push 00000000
:0044A361 E88B2E0300              call 0047D1F1
:0044A366 83C40C                  add esp, 0000000C
:0044A369 6A04                    push 00000004
:0044A36B 6A00                    push 00000000
:0044A36D 8B8DECFEFFFF            mov ecx, dword ptr [ebp+FFFFFEEC]
:0044A373 33D2                    xor edx, edx
:0044A375 8A5118                  mov dl, byte ptr [ecx+18]
:0044A378 69D2302A0000            imul edx, 00002A30
:0044A37E 81C2E0C70100            add edx, 0001C7E0
:0044A384 52                      push edx
:0044A385 B950EB4A00              mov ecx, 004AEB50
:0044A38A E8B1560300              call 0047FA40
:0044A38F 50                      push eax
:0044A390 A12C684800              mov eax, dword ptr [0048682C]
:0044A395 50                      push eax
:0044A396 8B0D28684800            mov ecx, dword ptr [00486828]
:0044A39C 51                      push ecx
:0044A39D 6A00                    push 00000000
:0044A39F 6A00                    push 00000000
:0044A3A1 E8F53C0300              call 0047E09B
:0044A3A6 83C414                  add esp, 00000014
:0044A3A9 6A00                    push 00000000
:0044A3AB E833270300              call 0047CAE3
:0044A3B0 83C404                  add esp, 00000004
:0044A3B3 8B95ECFEFFFF            mov edx, dword ptr [ebp+FFFFFEEC]
:0044A3B9 33C0                    xor eax, eax
:0044A3BB 8A4218                  mov al, byte ptr [edx+18]
:0044A3BE 83C001                  add eax, 00000001
:0044A3C1 99                      cdq
:0044A3C2 33C2                    xor eax, edx
:0044A3C4 2BC2                    sub eax, edx
:0044A3C6 83E003                  and eax, 00000003
:0044A3C9 33C2                    xor eax, edx
:0044A3CB 2BC2                    sub eax, edx
:0044A3CD 8B8DECFEFFFF            mov ecx, dword ptr [ebp+FFFFFEEC]
:0044A3D3 884118                  mov byte ptr [ecx+18], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A33C(C)
|
:0044A3D6 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0044A3DD 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0044A3E3 E8E88EFBFF              call 004032D0
:0044A3E8 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044A3EB 64890D00000000          mov dword ptr fs:[00000000], ecx
:0044A3F2 8BE5                    mov esp, ebp
:0044A3F4 5D                      pop ebp
:0044A3F5 C3                      ret



* Referenced by a CALL at Address:
|:0044F093   
|
:0044A3F6 55                      push ebp
:0044A3F7 8BEC                    mov ebp, esp
:0044A3F9 51                      push ecx
:0044A3FA 894DFC                  mov dword ptr [ebp-04], ecx
:0044A3FD 8B45FC                  mov eax, dword ptr [ebp-04]
:0044A400 C7401401000000          mov [eax+14], 00000001
:0044A407 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044A40A C6411800                mov [ecx+18], 00
:0044A40E 6A00                    push 00000000
:0044A410 8B15DC5F4B00            mov edx, dword ptr [004B5FDC]
:0044A416 52                      push edx
:0044A417 FF15E0624800            call dword ptr [004862E0]
:0044A41D 8BE5                    mov esp, ebp
:0044A41F 5D                      pop ebp
:0044A420 C3                      ret



* Referenced by a CALL at Addresses:
|:0044EC1F   , :0044F00D   
|
:0044A421 55                      push ebp
:0044A422 8BEC                    mov ebp, esp
:0044A424 51                      push ecx
:0044A425 894DFC                  mov dword ptr [ebp-04], ecx
:0044A428 8B45FC                  mov eax, dword ptr [ebp-04]
:0044A42B C7401400000000          mov [eax+14], 00000000
:0044A432 8BE5                    mov esp, ebp
:0044A434 5D                      pop ebp
:0044A435 C3                      ret



* Referenced by a CALL at Address:
|:0044A920   
|
:0044A436 55                      push ebp
:0044A437 8BEC                    mov ebp, esp
:0044A439 83EC10                  sub esp, 00000010
:0044A43C 894DF4                  mov dword ptr [ebp-0C], ecx
:0044A43F 6A03                    push 00000003
:0044A441 E89D260300              call 0047CAE3
:0044A446 83C404                  add esp, 00000004

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0044A449 6A07                    push 00000007
:0044A44B E87A2D0300              call 0047D1CA
:0044A450 83C404                  add esp, 00000004
:0044A453 C745FC00000000          mov [ebp-04], 00000000
:0044A45A EB09                    jmp 0044A465

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A6AA(U)
|
:0044A45C 8B45FC                  mov eax, dword ptr [ebp-04]
:0044A45F 83C001                  add eax, 00000001
:0044A462 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A45A(U)
|
:0044A465 837DFC73                cmp dword ptr [ebp-04], 00000073
:0044A469 0F8D40020000            jnl 0044A6AF
:0044A46F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044A472 6BC924                  imul ecx, 00000024
:0044A475 81C1502C4B00            add ecx, 004B2C50
:0044A47B E810E8FCFF              call 00418C90
:0044A480 25FF000000              and eax, 000000FF
:0044A485 83F802                  cmp eax, 00000002
:0044A488 0F851C020000            jne 0044A6AA
:0044A48E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044A491 6BC924                  imul ecx, 00000024
:0044A494 81C1502C4B00            add ecx, 004B2C50
:0044A49A E87B57FFFF              call 0043FC1A
:0044A49F 25FF000000              and eax, 000000FF
:0044A4A4 8945F0                  mov dword ptr [ebp-10], eax
:0044A4A7 837DF003                cmp dword ptr [ebp-10], 00000003
:0044A4AB 7722                    ja 0044A4CF
:0044A4AD 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044A4B0 FF248DCBA64400          jmp dword ptr [4*ecx+0044A6CB]
:0044A4B7 C645F82A                mov [ebp-08], 2A
:0044A4BB EB16                    jmp 0044A4D3
:0044A4BD C645F8AD                mov [ebp-08], AD
:0044A4C1 EB10                    jmp 0044A4D3
:0044A4C3 C645F8AC                mov [ebp-08], AC
:0044A4C7 EB0A                    jmp 0044A4D3
:0044A4C9 C645F8AC                mov [ebp-08], AC
:0044A4CD EB04                    jmp 0044A4D3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A4AB(C)
|
:0044A4CF C645F8AC                mov [ebp-08], AC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044A4BB(U), :0044A4C1(U), :0044A4C7(U), :0044A4CD(U)
|
:0044A4D3 6A00                    push 00000000
:0044A4D5 8B55F8                  mov edx, dword ptr [ebp-08]
:0044A4D8 81E2FF000000            and edx, 000000FF
:0044A4DE 52                      push edx
:0044A4DF 6A04                    push 00000004
:0044A4E1 E80B2D0300              call 0047D1F1
:0044A4E6 83C40C                  add esp, 0000000C
:0044A4E9 6A00                    push 00000000
:0044A4EB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044A4EE 6BC924                  imul ecx, 00000024
:0044A4F1 81C1502C4B00            add ecx, 004B2C50
:0044A4F7 E8648EFBFF              call 00403360
:0044A4FC 33C9                    xor ecx, ecx
:0044A4FE 8A4801                  mov cl, byte ptr [eax+01]
:0044A501 83C101                  add ecx, 00000001
:0044A504 6BC906                  imul ecx, 00000006
:0044A507 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044A50A 33C0                    xor eax, eax
:0044A50C 8A8209050000            mov al, byte ptr [edx+00000509]
:0044A512 8D4C01FE                lea ecx, dword ptr [ecx+eax-02]
:0044A516 51                      push ecx
:0044A517 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044A51A 6BC924                  imul ecx, 00000024
:0044A51D 81C1502C4B00            add ecx, 004B2C50
:0044A523 E8388EFBFF              call 00403360
:0044A528 33D2                    xor edx, edx
:0044A52A 8A10                    mov dl, byte ptr [eax]
:0044A52C 83C201                  add edx, 00000001
:0044A52F 6BD206                  imul edx, 00000006
:0044A532 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044A535 33C9                    xor ecx, ecx
:0044A537 8A8808050000            mov cl, byte ptr [eax+00000508]
:0044A53D 8D540AFE                lea edx, dword ptr [edx+ecx-02]
:0044A541 52                      push edx
:0044A542 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044A545 6BC924                  imul ecx, 00000024
:0044A548 81C1502C4B00            add ecx, 004B2C50
:0044A54E E80D8EFBFF              call 00403360
:0044A553 33C9                    xor ecx, ecx
:0044A555 8A4801                  mov cl, byte ptr [eax+01]
:0044A558 6BC906                  imul ecx, 00000006
:0044A55B 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044A55E 33C0                    xor eax, eax
:0044A560 8A8209050000            mov al, byte ptr [edx+00000509]
:0044A566 03C8                    add ecx, eax
:0044A568 51                      push ecx
:0044A569 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044A56C 6BC924                  imul ecx, 00000024
:0044A56F 81C1502C4B00            add ecx, 004B2C50
:0044A575 E8E68DFBFF              call 00403360
:0044A57A 33C9                    xor ecx, ecx
:0044A57C 8A08                    mov cl, byte ptr [eax]
:0044A57E 6BC906                  imul ecx, 00000006
:0044A581 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044A584 33C0                    xor eax, eax
:0044A586 8A8208050000            mov al, byte ptr [edx+00000508]
:0044A58C 03C8                    add ecx, eax
:0044A58E 51                      push ecx
:0044A58F E82F360300              call 0047DBC3
:0044A594 83C414                  add esp, 00000014
:0044A597 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044A59A 81E1FF000000            and ecx, 000000FF
:0044A5A0 83F92A                  cmp ecx, 0000002A
:0044A5A3 0F8501010000            jne 0044A6AA
:0044A5A9 6A02                    push 00000002
:0044A5AB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044A5AE 6BC924                  imul ecx, 00000024
:0044A5B1 81C1502C4B00            add ecx, 004B2C50
:0044A5B7 E834B5FDFF              call 00425AF0
:0044A5BC 85C0                    test eax, eax
:0044A5BE 0F84E6000000            je 0044A6AA
:0044A5C4 6A04                    push 00000004
:0044A5C6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044A5C9 6BC924                  imul ecx, 00000024
:0044A5CC 81C1502C4B00            add ecx, 004B2C50
:0044A5D2 E819B5FDFF              call 00425AF0
:0044A5D7 85C0                    test eax, eax
:0044A5D9 0F84CB000000            je 0044A6AA
:0044A5DF 6A00                    push 00000000
:0044A5E1 8B55F8                  mov edx, dword ptr [ebp-08]
:0044A5E4 81E2FF000000            and edx, 000000FF
:0044A5EA 83C204                  add edx, 00000004
:0044A5ED 52                      push edx
:0044A5EE 6A04                    push 00000004
:0044A5F0 E8FC2B0300              call 0047D1F1
:0044A5F5 83C40C                  add esp, 0000000C
:0044A5F8 6A00                    push 00000000
:0044A5FA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044A5FD 6BC924                  imul ecx, 00000024
:0044A600 81C1502C4B00            add ecx, 004B2C50
:0044A606 E8558DFBFF              call 00403360
:0044A60B 33C9                    xor ecx, ecx
:0044A60D 8A4801                  mov cl, byte ptr [eax+01]
:0044A610 83C101                  add ecx, 00000001
:0044A613 6BC906                  imul ecx, 00000006
:0044A616 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044A619 33C0                    xor eax, eax
:0044A61B 8A8209050000            mov al, byte ptr [edx+00000509]
:0044A621 8D4C01FD                lea ecx, dword ptr [ecx+eax-03]
:0044A625 51                      push ecx
:0044A626 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044A629 6BC924                  imul ecx, 00000024
:0044A62C 81C1502C4B00            add ecx, 004B2C50
:0044A632 E8298DFBFF              call 00403360
:0044A637 33D2                    xor edx, edx
:0044A639 8A10                    mov dl, byte ptr [eax]
:0044A63B 83C201                  add edx, 00000001
:0044A63E 6BD206                  imul edx, 00000006
:0044A641 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044A644 33C9                    xor ecx, ecx
:0044A646 8A8808050000            mov cl, byte ptr [eax+00000508]
:0044A64C 8D540AFD                lea edx, dword ptr [edx+ecx-03]
:0044A650 52                      push edx
:0044A651 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044A654 6BC924                  imul ecx, 00000024
:0044A657 81C1502C4B00            add ecx, 004B2C50
:0044A65D E8FE8CFBFF              call 00403360
:0044A662 33C9                    xor ecx, ecx
:0044A664 8A4801                  mov cl, byte ptr [eax+01]
:0044A667 6BC906                  imul ecx, 00000006
:0044A66A 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044A66D 33C0                    xor eax, eax
:0044A66F 8A8209050000            mov al, byte ptr [edx+00000509]
:0044A675 8D4C0101                lea ecx, dword ptr [ecx+eax+01]
:0044A679 51                      push ecx
:0044A67A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044A67D 6BC924                  imul ecx, 00000024
:0044A680 81C1502C4B00            add ecx, 004B2C50
:0044A686 E8D58CFBFF              call 00403360
:0044A68B 33D2                    xor edx, edx
:0044A68D 8A10                    mov dl, byte ptr [eax]
:0044A68F 6BD206                  imul edx, 00000006
:0044A692 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044A695 33C9                    xor ecx, ecx
:0044A697 8A8808050000            mov cl, byte ptr [eax+00000508]
:0044A69D 8D540A01                lea edx, dword ptr [edx+ecx+01]
:0044A6A1 52                      push edx
:0044A6A2 E81C350300              call 0047DBC3
:0044A6A7 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044A488(C), :0044A5A3(C), :0044A5BE(C), :0044A5D9(C)
|
:0044A6AA E9ADFDFFFF              jmp 0044A45C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A469(C)
|
:0044A6AF 6A00                    push 00000000
:0044A6B1 6A1F                    push 0000001F
:0044A6B3 6A04                    push 00000004
:0044A6B5 E8372B0300              call 0047D1F1
:0044A6BA 83C40C                  add esp, 0000000C
:0044A6BD 6A00                    push 00000000
:0044A6BF E81F240300              call 0047CAE3
:0044A6C4 83C404                  add esp, 00000004
:0044A6C7 8BE5                    mov esp, ebp
:0044A6C9 5D                      pop ebp
:0044A6CA C3                      ret



:0044A6CB B7A44400                DWORD 0044A4B7
:0044A6CF BDA44400                DWORD 0044A4BD
:0044A6D3 C3A44400                DWORD 0044A4C3
:0044A6D7 C9A44400                DWORD 0044A4C9



* Referenced by a CALL at Addresses:
|:0044A935   , :0044F138   , :00454CE4   
|
:0044A6DB 55                      push ebp
:0044A6DC 8BEC                    mov ebp, esp
:0044A6DE 51                      push ecx
:0044A6DF 894DFC                  mov dword ptr [ebp-04], ecx
:0044A6E2 6A03                    push 00000003
:0044A6E4 E8FA230300              call 0047CAE3
:0044A6E9 83C404                  add esp, 00000004

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0044A6EC 6A07                    push 00000007
:0044A6EE E8D72A0300              call 0047D1CA
:0044A6F3 83C404                  add esp, 00000004
:0044A6F6 8B45FC                  mov eax, dword ptr [ebp-04]
:0044A6F9 83B81C05000000          cmp dword ptr [eax+0000051C], 00000000
:0044A700 743B                    je 0044A73D
:0044A702 6A01                    push 00000001
:0044A704 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044A707 81C10C050000            add ecx, 0000050C
:0044A70D 83EC10                  sub esp, 00000010
:0044A710 8BD4                    mov edx, esp
:0044A712 8B01                    mov eax, dword ptr [ecx]
:0044A714 8902                    mov dword ptr [edx], eax
:0044A716 8B4104                  mov eax, dword ptr [ecx+04]
:0044A719 894204                  mov dword ptr [edx+04], eax
:0044A71C 8B4108                  mov eax, dword ptr [ecx+08]
:0044A71F 894208                  mov dword ptr [edx+08], eax
:0044A722 8B490C                  mov ecx, dword ptr [ecx+0C]
:0044A725 894A0C                  mov dword ptr [edx+0C], ecx
:0044A728 E8CD6A0100              call 004611FA
:0044A72D 83C414                  add esp, 00000014
:0044A730 8B55FC                  mov edx, dword ptr [ebp-04]
:0044A733 C7821C05000000000000    mov dword ptr [ebx+0000051C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A700(C)
|
:0044A73D 8B45FC                  mov eax, dword ptr [ebp-04]
:0044A740 83B81C05000000          cmp dword ptr [eax+0000051C], 00000000
:0044A747 0F85E7000000            jne 0044A834
:0044A74D B950424B00              mov ecx, 004B4250
:0044A752 E851B60000              call 00455DA8
:0044A757 6BC006                  imul eax, 00000006
:0044A75A 99                      cdq
:0044A75B B930000000              mov ecx, 00000030
:0044A760 F7F9                    idiv ecx
:0044A762 8B55FC                  mov edx, dword ptr [ebp-04]
:0044A765 33C9                    xor ecx, ecx
:0044A767 8A8A08050000            mov cl, byte ptr [edx+00000508]
:0044A76D 03C1                    add eax, ecx
:0044A76F 8B55FC                  mov edx, dword ptr [ebp-04]
:0044A772 89820C050000            mov dword ptr [edx+0000050C], eax
:0044A778 B950424B00              mov ecx, 004B4250
:0044A77D E84DB60000              call 00455DCF
:0044A782 6BC006                  imul eax, 00000006
:0044A785 99                      cdq
:0044A786 B930000000              mov ecx, 00000030
:0044A78B F7F9                    idiv ecx
:0044A78D 8B55FC                  mov edx, dword ptr [ebp-04]
:0044A790 33C9                    xor ecx, ecx
:0044A792 8A8A09050000            mov cl, byte ptr [edx+00000509]
:0044A798 03C1                    add eax, ecx
:0044A79A 8B55FC                  mov edx, dword ptr [ebp-04]
:0044A79D 898210050000            mov dword ptr [edx+00000510], eax
:0044A7A3 B950424B00              mov ecx, 004B4250
:0044A7A8 E897B60000              call 00455E44
:0044A7AD 6BC006                  imul eax, 00000006
:0044A7B0 99                      cdq
:0044A7B1 B930000000              mov ecx, 00000030
:0044A7B6 F7F9                    idiv ecx
:0044A7B8 8B55FC                  mov edx, dword ptr [ebp-04]
:0044A7BB 8B8A0C050000            mov ecx, dword ptr [edx+0000050C]
:0044A7C1 8D5401FF                lea edx, dword ptr [ecx+eax-01]
:0044A7C5 8B45FC                  mov eax, dword ptr [ebp-04]
:0044A7C8 899014050000            mov dword ptr [eax+00000514], edx
:0044A7CE B950424B00              mov ecx, 004B4250
:0044A7D3 E893B60000              call 00455E6B
:0044A7D8 6BC006                  imul eax, 00000006
:0044A7DB 99                      cdq
:0044A7DC B930000000              mov ecx, 00000030
:0044A7E1 F7F9                    idiv ecx
:0044A7E3 8B55FC                  mov edx, dword ptr [ebp-04]
:0044A7E6 8B8A10050000            mov ecx, dword ptr [edx+00000510]
:0044A7EC 8D5401FF                lea edx, dword ptr [ecx+eax-01]
:0044A7F0 8B45FC                  mov eax, dword ptr [ebp-04]
:0044A7F3 899018050000            mov dword ptr [eax+00000518], edx
:0044A7F9 6A00                    push 00000000
:0044A7FB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044A7FE 81C10C050000            add ecx, 0000050C
:0044A804 83EC10                  sub esp, 00000010
:0044A807 8BD4                    mov edx, esp
:0044A809 8B01                    mov eax, dword ptr [ecx]
:0044A80B 8902                    mov dword ptr [edx], eax
:0044A80D 8B4104                  mov eax, dword ptr [ecx+04]
:0044A810 894204                  mov dword ptr [edx+04], eax
:0044A813 8B4108                  mov eax, dword ptr [ecx+08]
:0044A816 894208                  mov dword ptr [edx+08], eax
:0044A819 8B490C                  mov ecx, dword ptr [ecx+0C]
:0044A81C 894A0C                  mov dword ptr [edx+0C], ecx
:0044A81F E8D6690100              call 004611FA
:0044A824 83C414                  add esp, 00000014
:0044A827 8B55FC                  mov edx, dword ptr [ebp-04]
:0044A82A C7821C05000001000000    mov dword ptr [ebx+0000051C], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044A747(C)
|
:0044A834 6A00                    push 00000000
:0044A836 E8A8220300              call 0047CAE3
:0044A83B 83C404                  add esp, 00000004
:0044A83E 8BE5                    mov esp, ebp
:0044A840 5D                      pop ebp
:0044A841 C3                      ret



* Referenced by a CALL at Address:
|:00461180   
|
:0044A842 55                      push ebp
:0044A843 8BEC                    mov ebp, esp
:0044A845 51                      push ecx
:0044A846 894DFC                  mov dword ptr [ebp-04], ecx
:0044A849 8B45FC                  mov eax, dword ptr [ebp-04]
:0044A84C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044A84F 8B11                    mov edx, dword ptr [ecx]
:0044A851 89900C050000            mov dword ptr [eax+0000050C], edx
:0044A857 8B45FC                  mov eax, dword ptr [ebp-04]
:0044A85A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044A85D 8B5108                  mov edx, dword ptr [ecx+08]
:0044A860 899014050000            mov dword ptr [eax+00000514], edx
:0044A866 8B45FC                  mov eax, dword ptr [ebp-04]
:0044A869 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044A86C 8B5104                  mov edx, dword ptr [ecx+04]
:0044A86F 899010050000            mov dword ptr [eax+00000510], edx
:0044A875 8B45FC                  mov eax, dword ptr [ebp-04]
:0044A878 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044A87B 8B510C                  mov edx, dword ptr [ecx+0C]
:0044A87E 899018050000            mov dword ptr [eax+00000518], edx
:0044A884 8BE5                    mov esp, ebp
:0044A886 5D                      pop ebp
:0044A887 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:004150C8   , :0041630B   , :00433F0D   , :0043AAF2   , :0043DE71   
|:0043E229   , :00441892   , :00449DC6   , :00449DDF   , :0044AFA6   
|:0044F115   , :00457389   , :00459444   , :0045A6AF   
|
:0044A88A 55                      push ebp
:0044A88B 8BEC                    mov ebp, esp
:0044A88D 83EC0C                  sub esp, 0000000C
:0044A890 894DF4                  mov dword ptr [ebp-0C], ecx
:0044A893 B950424B00              mov ecx, 004B4250
:0044A898 E8DFB60000              call 00455F7C
:0044A89D 99                      cdq
:0044A89E B930000000              mov ecx, 00000030
:0044A8A3 F7F9                    idiv ecx
:0044A8A5 6BC006                  imul eax, 00000006
:0044A8A8 8945FC                  mov dword ptr [ebp-04], eax
:0044A8AB B950424B00              mov ecx, 004B4250
:0044A8B0 E8EEB60000              call 00455FA3
:0044A8B5 99                      cdq
:0044A8B6 B930000000              mov ecx, 00000030
:0044A8BB F7F9                    idiv ecx
:0044A8BD 6BC006                  imul eax, 00000006
:0044A8C0 8945F8                  mov dword ptr [ebp-08], eax
:0044A8C3 6A03                    push 00000003
:0044A8C5 E819220300              call 0047CAE3
:0044A8CA 83C404                  add esp, 00000004

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0044A8CD 6A07                    push 00000007
:0044A8CF E8F6280300              call 0047D1CA
:0044A8D4 83C404                  add esp, 00000004
:0044A8D7 6A00                    push 00000000
:0044A8D9 6A12                    push 00000012
:0044A8DB 6A00                    push 00000000
:0044A8DD E80F290300              call 0047D1F1
:0044A8E2 83C40C                  add esp, 0000000C
:0044A8E5 E8F13CFDFF              call 0041E5DB
:0044A8EA B978F44A00              mov ecx, 004AF478
:0044A8EF E89C37FCFF              call 0040E090
:0044A8F4 50                      push eax
:0044A8F5 8B55F8                  mov edx, dword ptr [ebp-08]
:0044A8F8 52                      push edx
:0044A8F9 8B45FC                  mov eax, dword ptr [ebp-04]
:0044A8FC 50                      push eax
:0044A8FD 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044A900 33D2                    xor edx, edx
:0044A902 8A9109050000            mov dl, byte ptr [ecx+00000509]
:0044A908 52                      push edx
:0044A909 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044A90C 33C9                    xor ecx, ecx
:0044A90E 8A8808050000            mov cl, byte ptr [eax+00000508]
:0044A914 51                      push ecx
:0044A915 E881370300              call 0047E09B
:0044A91A 83C414                  add esp, 00000014
:0044A91D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044A920 E811FBFFFF              call 0044A436
:0044A925 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044A928 C7821C05000000000000    mov dword ptr [ebx+0000051C], 00000000
:0044A932 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044A935 E8A1FDFFFF              call 0044A6DB
:0044A93A 6A03                    push 00000003
:0044A93C E8A2210300              call 0047CAE3
:0044A941 83C404                  add esp, 00000004
:0044A944 E8AD3CFDFF              call 0041E5F6
:0044A949 6A00                    push 00000000
:0044A94B E893210300              call 0047CAE3
:0044A950 83C404                  add esp, 00000004
:0044A953 6A00                    push 00000000
:0044A955 6A12                    push 00000012
:0044A957 6A04                    push 00000004
:0044A959 E893280300              call 0047D1F1
:0044A95E 83C40C                  add esp, 0000000C
:0044A961 A1686A4B00              mov eax, dword ptr [004B6A68]
:0044A966 50                      push eax
:0044A967 FF15CC624800            call dword ptr [004862CC]
:0044A96D 8BE5                    mov esp, ebp
:0044A96F 5D                      pop ebp
:0044A970 C3                      ret



* Referenced by a CALL at Address:
|:0044F09B   
|
:0044A971 55                      push ebp
:0044A972 8BEC                    mov ebp, esp
:0044A974 6AFF                    push FFFFFFFF
:0044A976 68FE554800              push 004855FE
:0044A97B 64A100000000            mov eax, dword ptr fs:[00000000]
:0044A981 50                      push eax
:0044A982 64892500000000          mov dword ptr fs:[00000000], esp
:0044A989 81EC78010000            sub esp, 00000178
:0044A98F 56                      push esi
:0044A990 898D7CFEFFFF            mov dword ptr [ebp+FFFFFE7C], ecx
:0044A996 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0044A99C E80F89FBFF              call 004032B0
:0044A9A1 C745FC00000000          mov [ebp-04], 00000000
:0044A9A8 8D85B4FEFFFF            lea eax, dword ptr [ebp+FFFFFEB4]
:0044A9AE 50                      push eax
:0044A9AF 8D8DA0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEA0]
:0044A9B5 51                      push ecx
:0044A9B6 E870420300              call 0047EC2B
:0044A9BB 83C408                  add esp, 00000008
:0044A9BE B950424B00              mov ecx, 004B4250
:0044A9C3 E87CB40000              call 00455E44
:0044A9C8 898598FEFFFF            mov dword ptr [ebp+FFFFFE98], eax
:0044A9CE C7859CFEFFFF00000000    mov dword ptr [ebp+FFFFFE9C], 00000000
:0044A9D8 8D9598FEFFFF            lea edx, dword ptr [ebp+FFFFFE98]
:0044A9DE 52                      push edx
:0044A9DF A1686A4B00              mov eax, dword ptr [004B6A68]
:0044A9E4 50                      push eax
:0044A9E5 FF1520634800            call dword ptr [00486320]
:0044A9EB C78584FEFFFF00000000    mov dword ptr [ebp+FFFFFE84], 00000000
:0044A9F5 C78588FEFFFF00000000    mov dword ptr [ebp+FFFFFE88], 00000000
:0044A9FF B950424B00              mov ecx, 004B4250
:0044AA04 E873B50000              call 00455F7C
:0044AA09 83E801                  sub eax, 00000001
:0044AA0C 6BC006                  imul eax, 00000006
:0044AA0F 99                      cdq
:0044AA10 B930000000              mov ecx, 00000030
:0044AA15 F7F9                    idiv ecx
:0044AA17 89858CFEFFFF            mov dword ptr [ebp+FFFFFE8C], eax
:0044AA1D B950424B00              mov ecx, 004B4250
:0044AA22 E87CB50000              call 00455FA3
:0044AA27 83E801                  sub eax, 00000001
:0044AA2A 6BC006                  imul eax, 00000006
:0044AA2D 99                      cdq
:0044AA2E B930000000              mov ecx, 00000030
:0044AA33 F7F9                    idiv ecx
:0044AA35 898590FEFFFF            mov dword ptr [ebp+FFFFFE90], eax
:0044AA3B 6A00                    push 00000000
:0044AA3D 6AF0                    push FFFFFFF0
:0044AA3F 8B15D85F4B00            mov edx, dword ptr [004B5FD8]
:0044AA45 52                      push edx
:0044AA46 FF15A0634800            call dword ptr [004863A0]
:0044AA4C 50                      push eax
:0044AA4D 8D8584FEFFFF            lea eax, dword ptr [ebp+FFFFFE84]
:0044AA53 50                      push eax
:0044AA54 FF15A4634800            call dword ptr [004863A4]
:0044AA5A 8B8D98FEFFFF            mov ecx, dword ptr [ebp+FFFFFE98]
:0044AA60 038D8CFEFFFF            add ecx, dword ptr [ebp+FFFFFE8C]
:0044AA66 2B8D84FEFFFF            sub ecx, dword ptr [ebp+FFFFFE84]
:0044AA6C 83C101                  add ecx, 00000001
:0044AA6F 3B8DA0FEFFFF            cmp ecx, dword ptr [ebp+FFFFFEA0]
:0044AA75 7E29                    jle 0044AAA0
:0044AA77 8B9598FEFFFF            mov edx, dword ptr [ebp+FFFFFE98]
:0044AA7D 03958CFEFFFF            add edx, dword ptr [ebp+FFFFFE8C]
:0044AA83 2B9584FEFFFF            sub edx, dword ptr [ebp+FFFFFE84]
:0044AA89 83C201                  add edx, 00000001
:0044AA8C 2B95A0FEFFFF            sub edx, dword ptr [ebp+FFFFFEA0]
:0044AA92 8B8598FEFFFF            mov eax, dword ptr [ebp+FFFFFE98]
:0044AA98 2BC2                    sub eax, edx
:0044AA9A 898598FEFFFF            mov dword ptr [ebp+FFFFFE98], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044AA75(C)
|
:0044AAA0 8B8D7CFEFFFF            mov ecx, dword ptr [ebp+FFFFFE7C]
:0044AAA6 C6810805000000          mov byte ptr [ecx+00000508], 00
:0044AAAD 8B957CFEFFFF            mov edx, dword ptr [ebp+FFFFFE7C]
:0044AAB3 C6820905000000          mov byte ptr [edx+00000509], 00
:0044AABA 6A00                    push 00000000
:0044AABC 8B8590FEFFFF            mov eax, dword ptr [ebp+FFFFFE90]
:0044AAC2 2B8588FEFFFF            sub eax, dword ptr [ebp+FFFFFE88]
:0044AAC8 83C001                  add eax, 00000001
:0044AACB 50                      push eax
:0044AACC 8B8D8CFEFFFF            mov ecx, dword ptr [ebp+FFFFFE8C]
:0044AAD2 2B8D84FEFFFF            sub ecx, dword ptr [ebp+FFFFFE84]
:0044AAD8 83C101                  add ecx, 00000001
:0044AADB 51                      push ecx
:0044AADC 8B959CFEFFFF            mov edx, dword ptr [ebp+FFFFFE9C]
:0044AAE2 52                      push edx
:0044AAE3 8B8598FEFFFF            mov eax, dword ptr [ebp+FFFFFE98]
:0044AAE9 50                      push eax
:0044AAEA 8B0DD85F4B00            mov ecx, dword ptr [004B5FD8]
:0044AAF0 51                      push ecx
:0044AAF1 FF15BC624800            call dword ptr [004862BC]
:0044AAF7 8D95A4FEFFFF            lea edx, dword ptr [ebp+FFFFFEA4]
:0044AAFD 52                      push edx
:0044AAFE A1D85F4B00              mov eax, dword ptr [004B5FD8]
:0044AB03 50                      push eax
:0044AB04 FF15EC624800            call dword ptr [004862EC]
:0044AB0A 8BB5B0FEFFFF            mov esi, dword ptr [ebp+FFFFFEB0]
:0044AB10 2BB5A8FEFFFF            sub esi, dword ptr [ebp+FFFFFEA8]
:0044AB16 83C601                  add esi, 00000001
:0044AB19 B950424B00              mov ecx, 004B4250
:0044AB1E E880B40000              call 00455FA3
:0044AB23 99                      cdq
:0044AB24 83E207                  and edx, 00000007
:0044AB27 03C2                    add eax, edx
:0044AB29 C1F803                  sar eax, 03
:0044AB2C 3BF0                    cmp esi, eax
:0044AB2E 0F8D91000000            jnl 0044ABC5
:0044AB34 8B0DD85F4B00            mov ecx, dword ptr [004B5FD8]
:0044AB3A 51                      push ecx
:0044AB3B FF1598624800            call dword ptr [00486298]
:0044AB41 898580FEFFFF            mov dword ptr [ebp+FFFFFE80], eax
:0044AB47 8D95B8FEFFFF            lea edx, dword ptr [ebp+FFFFFEB8]
:0044AB4D 52                      push edx
:0044AB4E 8B8580FEFFFF            mov eax, dword ptr [ebp+FFFFFE80]
:0044AB54 50                      push eax
:0044AB55 FF158C604800            call dword ptr [0048608C]
:0044AB5B 8B8D80FEFFFF            mov ecx, dword ptr [ebp+FFFFFE80]
:0044AB61 51                      push ecx
:0044AB62 8B15D85F4B00            mov edx, dword ptr [004B5FD8]
:0044AB68 52                      push edx
:0044AB69 FF159C624800            call dword ptr [0048629C]
:0044AB6F 8B85B8FEFFFF            mov eax, dword ptr [ebp+FFFFFEB8]
:0044AB75 0385C8FEFFFF            add eax, dword ptr [ebp+FFFFFEC8]
:0044AB7B 898594FEFFFF            mov dword ptr [ebp+FFFFFE94], eax
:0044AB81 6A00                    push 00000000
:0044AB83 8B8D90FEFFFF            mov ecx, dword ptr [ebp+FFFFFE90]
:0044AB89 2B8D88FEFFFF            sub ecx, dword ptr [ebp+FFFFFE88]
:0044AB8F 8B9594FEFFFF            mov edx, dword ptr [ebp+FFFFFE94]
:0044AB95 8D441101                lea eax, dword ptr [ecx+edx+01]
:0044AB99 50                      push eax
:0044AB9A 8B8D8CFEFFFF            mov ecx, dword ptr [ebp+FFFFFE8C]
:0044ABA0 2B8D84FEFFFF            sub ecx, dword ptr [ebp+FFFFFE84]
:0044ABA6 83C101                  add ecx, 00000001
:0044ABA9 51                      push ecx
:0044ABAA 8B959CFEFFFF            mov edx, dword ptr [ebp+FFFFFE9C]
:0044ABB0 52                      push edx
:0044ABB1 8B8598FEFFFF            mov eax, dword ptr [ebp+FFFFFE98]
:0044ABB7 50                      push eax
:0044ABB8 8B0DD85F4B00            mov ecx, dword ptr [004B5FD8]
:0044ABBE 51                      push ecx
:0044ABBF FF15BC624800            call dword ptr [004862BC]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044AB2E(C)
|

* Possible StringData Ref from Data Obj ->"SMLMAP.E5"
                                  |
:0044ABC5 68A8BB4800              push 0048BBA8
:0044ABCA 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0044ABD0 E8604FFDFF              call 0041FB35
:0044ABD5 6A04                    push 00000004
:0044ABD7 6A00                    push 00000000
:0044ABD9 6A00                    push 00000000
:0044ABDB B978F44A00              mov ecx, 004AF478
:0044ABE0 E85B4E0300              call 0047FA40
:0044ABE5 50                      push eax
:0044ABE6 8B957CFEFFFF            mov edx, dword ptr [ebp+FFFFFE7C]
:0044ABEC 33C0                    xor eax, eax
:0044ABEE 8A02                    mov al, byte ptr [edx]
:0044ABF0 50                      push eax
:0044ABF1 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0044ABF7 E88D50FDFF              call 0041FC89
:0044ABFC 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0044AC02 E8BEE6FCFF              call 004192C5
:0044AC07 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0044AC0E 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0044AC14 E8B786FBFF              call 004032D0
:0044AC19 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044AC1C 64890D00000000          mov dword ptr fs:[00000000], ecx
:0044AC23 5E                      pop esi
:0044AC24 8BE5                    mov esp, ebp
:0044AC26 5D                      pop ebp
:0044AC27 C3                      ret



* Referenced by a CALL at Addresses:
|:0044E8C2   , :0044EDB9   
|
:0044AC28 55                      push ebp
:0044AC29 8BEC                    mov ebp, esp
:0044AC2B 83EC40                  sub esp, 00000040
:0044AC2E 894DC0                  mov dword ptr [ebp-40], ecx
:0044AC31 B950424B00              mov ecx, 004B4250
:0044AC36 E809B20000              call 00455E44
:0044AC3B 99                      cdq
:0044AC3C B930000000              mov ecx, 00000030
:0044AC41 F7F9                    idiv ecx
:0044AC43 8845E4                  mov byte ptr [ebp-1C], al
:0044AC46 B950424B00              mov ecx, 004B4250
:0044AC4B E81BB20000              call 00455E6B
:0044AC50 99                      cdq
:0044AC51 B930000000              mov ecx, 00000030
:0044AC56 F7F9                    idiv ecx
:0044AC58 8845E0                  mov byte ptr [ebp-20], al

* Possible StringData Ref from Data Obj ->"Ҿ׶"
                                  |
:0044AC5B C745E854E14800          mov [ebp-18], 0048E154

* Possible StringData Ref from Data Obj ->"о׶"
                                  |
:0044AC62 C745EC60E14800          mov [ebp-14], 0048E160
:0044AC69 8B550C                  mov edx, dword ptr [ebp+0C]
:0044AC6C F7DA                    neg edx
:0044AC6E 1BD2                    sbb edx, edx
:0044AC70 83E212                  and edx, 00000012
:0044AC73 83C22D                  add edx, 0000002D
:0044AC76 52                      push edx
:0044AC77 B950424B00              mov ecx, 004B4250
:0044AC7C E869700000              call 00451CEA
:0044AC81 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0044AC85 7446                    je 0044ACCD
:0044AC87 8A45E4                  mov al, byte ptr [ebp-1C]
:0044AC8A 8845DC                  mov byte ptr [ebp-24], al
:0044AC8D EB09                    jmp 0044AC98

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044ACC9(U)
|
:0044AC8F 8A4DDC                  mov cl, byte ptr [ebp-24]
:0044AC92 80E901                  sub cl, 01
:0044AC95 884DDC                  mov byte ptr [ebp-24], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044AC8D(U)
|
:0044AC98 8B55DC                  mov edx, dword ptr [ebp-24]
:0044AC9B 81E2FF000000            and edx, 000000FF
:0044ACA1 85D2                    test edx, edx
:0044ACA3 7E26                    jle 0044ACCB
:0044ACA5 E81A3E0300              call 0047EAC4
:0044ACAA 8A45E0                  mov al, byte ptr [ebp-20]
:0044ACAD 50                      push eax
:0044ACAE 6A01                    push 00000001
:0044ACB0 6A00                    push 00000000
:0044ACB2 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0044ACB5 81E1FF000000            and ecx, 000000FF
:0044ACBB 83E901                  sub ecx, 00000001
:0044ACBE 51                      push ecx
:0044ACBF B950424B00              mov ecx, 004B4250
:0044ACC4 E87F8E0000              call 00453B48
:0044ACC9 EBC4                    jmp 0044AC8F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044ACA3(C)
|
:0044ACCB EB41                    jmp 0044AD0E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044AC85(C)
|
:0044ACCD C645DC00                mov [ebp-24], 00
:0044ACD1 EB09                    jmp 0044ACDC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044AD0C(U)
|
:0044ACD3 8A55DC                  mov dl, byte ptr [ebp-24]
:0044ACD6 80C201                  add dl, 01
:0044ACD9 8855DC                  mov byte ptr [ebp-24], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044ACD1(U)
|
:0044ACDC 8B45DC                  mov eax, dword ptr [ebp-24]
:0044ACDF 25FF000000              and eax, 000000FF
:0044ACE4 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0044ACE7 81E1FF000000            and ecx, 000000FF
:0044ACED 3BC1                    cmp eax, ecx
:0044ACEF 7D1D                    jge 0044AD0E
:0044ACF1 E8CE3D0300              call 0047EAC4
:0044ACF6 8A55E0                  mov dl, byte ptr [ebp-20]
:0044ACF9 52                      push edx
:0044ACFA 6A01                    push 00000001
:0044ACFC 6A00                    push 00000000
:0044ACFE 8A45DC                  mov al, byte ptr [ebp-24]
:0044AD01 50                      push eax
:0044AD02 B950424B00              mov ecx, 004B4250
:0044AD07 E83C8E0000              call 00453B48
:0044AD0C EBC5                    jmp 0044ACD3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044ACCB(U), :0044ACEF(C)
|
:0044AD0E 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0044AD11 81E1FF000000            and ecx, 000000FF
:0044AD17 6BC930                  imul ecx, 00000030
:0044AD1A 81F9C0030000            cmp ecx, 000003C0
:0044AD20 7C10                    jl 0044AD32
:0044AD22 C745D840000000          mov [ebp-28], 00000040
:0044AD29 C745C402000000          mov [ebp-3C], 00000002
:0044AD30 EB32                    jmp 0044AD64

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044AD20(C)
|
:0044AD32 8B55E4                  mov edx, dword ptr [ebp-1C]
:0044AD35 81E2FF000000            and edx, 000000FF
:0044AD3B 6BD230                  imul edx, 00000030
:0044AD3E 81FAD0020000            cmp edx, 000002D0
:0044AD44 7C10                    jl 0044AD56
:0044AD46 C745D840000000          mov [ebp-28], 00000040
:0044AD4D C745C402000000          mov [ebp-3C], 00000002
:0044AD54 EB0E                    jmp 0044AD64

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044AD44(C)
|
:0044AD56 C745D830000000          mov [ebp-28], 00000030
:0044AD5D C745C401000000          mov [ebp-3C], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044AD30(U), :0044AD54(U)
|
:0044AD64 8D45F0                  lea eax, dword ptr [ebp-10]
:0044AD67 50                      push eax
:0044AD68 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:0044AD6E 51                      push ecx
:0044AD6F FF15EC624800            call dword ptr [004862EC]
:0044AD75 E86138FDFF              call 0041E5DB
:0044AD7A 6A01                    push 00000001
:0044AD7C 33D2                    xor edx, edx
:0044AD7E 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0044AD82 0F95C2                  setne dl
:0044AD85 8B4495E8                mov eax, dword ptr [ebp+4*edx-18]
:0044AD89 50                      push eax
:0044AD8A 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0044AD8D F7D9                    neg ecx
:0044AD8F 1BC9                    sbb ecx, ecx
:0044AD91 83E110                  and ecx, 00000010
:0044AD94 83C12A                  add ecx, 0000002A
:0044AD97 51                      push ecx
:0044AD98 6A02                    push 00000002
:0044AD9A 8B55D8                  mov edx, dword ptr [ebp-28]
:0044AD9D 52                      push edx
:0044AD9E 83EC10                  sub esp, 00000010
:0044ADA1 8BC4                    mov eax, esp
:0044ADA3 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044ADA6 8908                    mov dword ptr [eax], ecx
:0044ADA8 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044ADAB 895004                  mov dword ptr [eax+04], edx
:0044ADAE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044ADB1 894808                  mov dword ptr [eax+08], ecx
:0044ADB4 8B55FC                  mov edx, dword ptr [ebp-04]
:0044ADB7 89500C                  mov dword ptr [eax+0C], edx
:0044ADBA E8393FFDFF              call 0041ECF8
:0044ADBF 83C424                  add esp, 00000024
:0044ADC2 6A01                    push 00000001
:0044ADC4 33C0                    xor eax, eax
:0044ADC6 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0044ADCA 0F95C0                  setne al
:0044ADCD 8B4C85E8                mov ecx, dword ptr [ebp+4*eax-18]
:0044ADD1 51                      push ecx
:0044ADD2 8B550C                  mov edx, dword ptr [ebp+0C]
:0044ADD5 F7DA                    neg edx
:0044ADD7 1BD2                    sbb edx, edx
:0044ADD9 83E211                  and edx, 00000011
:0044ADDC 83C224                  add edx, 00000024
:0044ADDF 52                      push edx
:0044ADE0 6A01                    push 00000001
:0044ADE2 8B45D8                  mov eax, dword ptr [ebp-28]
:0044ADE5 50                      push eax
:0044ADE6 83EC10                  sub esp, 00000010
:0044ADE9 8BCC                    mov ecx, esp
:0044ADEB 8B55F0                  mov edx, dword ptr [ebp-10]
:0044ADEE 8911                    mov dword ptr [ecx], edx
:0044ADF0 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044ADF3 894104                  mov dword ptr [ecx+04], eax
:0044ADF6 8B55F8                  mov edx, dword ptr [ebp-08]
:0044ADF9 895108                  mov dword ptr [ecx+08], edx
:0044ADFC 8B45FC                  mov eax, dword ptr [ebp-04]
:0044ADFF 89410C                  mov dword ptr [ecx+0C], eax
:0044AE02 E8F13EFDFF              call 0041ECF8
:0044AE07 83C424                  add esp, 00000024
:0044AE0A 6A00                    push 00000000
:0044AE0C 6A12                    push 00000012
:0044AE0E 6A04                    push 00000004
:0044AE10 E824240300              call 0047D239
:0044AE15 83C40C                  add esp, 0000000C
:0044AE18 6A00                    push 00000000
:0044AE1A 6A00                    push 00000000
:0044AE1C 6A01                    push 00000001
:0044AE1E 33C9                    xor ecx, ecx
:0044AE20 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0044AE24 0F95C1                  setne cl
:0044AE27 8B548DE8                mov edx, dword ptr [ebp+4*ecx-18]
:0044AE2B 52                      push edx
:0044AE2C 8B45D8                  mov eax, dword ptr [ebp-28]
:0044AE2F 50                      push eax
:0044AE30 8B45D8                  mov eax, dword ptr [ebp-28]
:0044AE33 99                      cdq
:0044AE34 2BC2                    sub eax, edx
:0044AE36 D1F8                    sar eax, 1
:0044AE38 50                      push eax
:0044AE39 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0044AE3C 51                      push ecx
:0044AE3D E8723BFDFF              call 0041E9B4
:0044AE42 83C41C                  add esp, 0000001C
:0044AE45 E8AC37FDFF              call 0041E5F6
:0044AE4A 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0044AE4E 0F8501010000            jne 0044AF55
:0044AE54 6A0A                    push 0000000A
:0044AE56 B9181B4B00              mov ecx, 004B1B18
:0044AE5B E8E084FBFF              call 00403340
:0044AE60 E87B16FEFF              call 0042C4E0
:0044AE65 8B55D8                  mov edx, dword ptr [ebp-28]
:0044AE68 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044AE6B 8D4C5010                lea ecx, dword ptr [eax+2*edx+10]
:0044AE6F 894DF4                  mov dword ptr [ebp-0C], ecx
:0044AE72 8B5508                  mov edx, dword ptr [ebp+08]
:0044AE75 81E2FF000000            and edx, 000000FF
:0044AE7B 8B45C0                  mov eax, dword ptr [ebp-40]
:0044AE7E 33C9                    xor ecx, ecx
:0044AE80 8A4803                  mov cl, byte ptr [eax+03]
:0044AE83 3BD1                    cmp edx, ecx
:0044AE85 7C14                    jl 0044AE9B

* Possible StringData Ref from Data Obj ->"ջغ"
                                  |
:0044AE87 686CE14800              push 0048E16C
:0044AE8C 8D55C8                  lea edx, dword ptr [ebp-38]
:0044AE8F 52                      push edx
:0044AE90 FF15C0624800            call dword ptr [004862C0]
:0044AE96 83C408                  add esp, 00000008
:0044AE99 EB1B                    jmp 0044AEB6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044AE85(C)
|
:0044AE9B 8B4508                  mov eax, dword ptr [ebp+08]
:0044AE9E 25FF000000              and eax, 000000FF
:0044AEA3 50                      push eax

* Possible StringData Ref from Data Obj ->"%2uغ"
                                  |
:0044AEA4 6878E14800              push 0048E178
:0044AEA9 8D4DC8                  lea ecx, dword ptr [ebp-38]
:0044AEAC 51                      push ecx
:0044AEAD FF15C0624800            call dword ptr [004862C0]
:0044AEB3 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044AE99(U)
|
:0044AEB6 E82037FDFF              call 0041E5DB
:0044AEBB 6A01                    push 00000001
:0044AEBD 8D55C8                  lea edx, dword ptr [ebp-38]
:0044AEC0 52                      push edx
:0044AEC1 6A1F                    push 0000001F
:0044AEC3 6A02                    push 00000002
:0044AEC5 8B45D8                  mov eax, dword ptr [ebp-28]
:0044AEC8 50                      push eax
:0044AEC9 83EC10                  sub esp, 00000010
:0044AECC 8BCC                    mov ecx, esp
:0044AECE 8B55F0                  mov edx, dword ptr [ebp-10]
:0044AED1 8911                    mov dword ptr [ecx], edx
:0044AED3 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044AED6 894104                  mov dword ptr [ecx+04], eax
:0044AED9 8B55F8                  mov edx, dword ptr [ebp-08]
:0044AEDC 895108                  mov dword ptr [ecx+08], edx
:0044AEDF 8B45FC                  mov eax, dword ptr [ebp-04]
:0044AEE2 89410C                  mov dword ptr [ecx+0C], eax
:0044AEE5 E80E3EFDFF              call 0041ECF8
:0044AEEA 83C424                  add esp, 00000024
:0044AEED 6A01                    push 00000001
:0044AEEF 8D4DC8                  lea ecx, dword ptr [ebp-38]
:0044AEF2 51                      push ecx
:0044AEF3 6A18                    push 00000018
:0044AEF5 6A01                    push 00000001
:0044AEF7 8B55D8                  mov edx, dword ptr [ebp-28]
:0044AEFA 52                      push edx
:0044AEFB 83EC10                  sub esp, 00000010
:0044AEFE 8BC4                    mov eax, esp
:0044AF00 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044AF03 8908                    mov dword ptr [eax], ecx
:0044AF05 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044AF08 895004                  mov dword ptr [eax+04], edx
:0044AF0B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044AF0E 894808                  mov dword ptr [eax+08], ecx
:0044AF11 8B55FC                  mov edx, dword ptr [ebp-04]
:0044AF14 89500C                  mov dword ptr [eax+0C], edx
:0044AF17 E8DC3DFDFF              call 0041ECF8
:0044AF1C 83C424                  add esp, 00000024
:0044AF1F 6A00                    push 00000000
:0044AF21 6A12                    push 00000012
:0044AF23 6A04                    push 00000004
:0044AF25 E80F230300              call 0047D239
:0044AF2A 83C40C                  add esp, 0000000C
:0044AF2D 6A00                    push 00000000
:0044AF2F 6A00                    push 00000000
:0044AF31 6A01                    push 00000001
:0044AF33 8D45C8                  lea eax, dword ptr [ebp-38]
:0044AF36 50                      push eax
:0044AF37 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0044AF3A 51                      push ecx
:0044AF3B 8B45D8                  mov eax, dword ptr [ebp-28]
:0044AF3E 99                      cdq
:0044AF3F 2BC2                    sub eax, edx
:0044AF41 D1F8                    sar eax, 1
:0044AF43 50                      push eax
:0044AF44 8D55F0                  lea edx, dword ptr [ebp-10]
:0044AF47 52                      push edx
:0044AF48 E8673AFDFF              call 0041E9B4
:0044AF4D 83C41C                  add esp, 0000001C
:0044AF50 E8A136FDFF              call 0041E5F6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044AE4E(C)
|
:0044AF55 6A14                    push 00000014
:0044AF57 B9181B4B00              mov ecx, 004B1B18
:0044AF5C E8DF83FBFF              call 00403340
:0044AF61 E87A15FEFF              call 0042C4E0
:0044AF66 837D1000                cmp dword ptr [ebp+10], 00000000
:0044AF6A 7537                    jne 0044AFA3
:0044AF6C C645DC00                mov [ebp-24], 00
:0044AF70 EB08                    jmp 0044AF7A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044AFA1(U)
|
:0044AF72 8A45DC                  mov al, byte ptr [ebp-24]
:0044AF75 0401                    add al, 01
:0044AF77 8845DC                  mov byte ptr [ebp-24], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044AF70(U)
|
:0044AF7A 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0044AF7D 81E1FF000000            and ecx, 000000FF
:0044AF83 83F973                  cmp ecx, 00000073
:0044AF86 7D1B                    jge 0044AFA3

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0044AF88 6A06                    push 00000006
:0044AF8A 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0044AF8D 81E1FF000000            and ecx, 000000FF
:0044AF93 6BC924                  imul ecx, 00000024
:0044AF96 81C1502C4B00            add ecx, 004B2C50
:0044AF9C E8EFB6FBFF              call 00406690
:0044AFA1 EBCF                    jmp 0044AF72

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044AF6A(C), :0044AF86(C)
|
:0044AFA3 8B4DC0                  mov ecx, dword ptr [ebp-40]
:0044AFA6 E8DFF8FFFF              call 0044A88A
:0044AFAB B950424B00              mov ecx, 004B4250
:0044AFB0 E8F66D0000              call 00451DAB
:0044AFB5 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0044AFB9 7444                    je 0044AFFF
:0044AFBB 8A55E4                  mov dl, byte ptr [ebp-1C]
:0044AFBE 8855DC                  mov byte ptr [ebp-24], dl
:0044AFC1 EB08                    jmp 0044AFCB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044AFFB(U)
|
:0044AFC3 8A45DC                  mov al, byte ptr [ebp-24]
:0044AFC6 2C01                    sub al, 01
:0044AFC8 8845DC                  mov byte ptr [ebp-24], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044AFC1(U)
|
:0044AFCB 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0044AFCE 81E1FF000000            and ecx, 000000FF
:0044AFD4 85C9                    test ecx, ecx
:0044AFD6 7E25                    jle 0044AFFD
:0044AFD8 E8E73A0300              call 0047EAC4
:0044AFDD 8A55E0                  mov dl, byte ptr [ebp-20]
:0044AFE0 52                      push edx
:0044AFE1 6A01                    push 00000001
:0044AFE3 6A00                    push 00000000
:0044AFE5 8B45DC                  mov eax, dword ptr [ebp-24]
:0044AFE8 25FF000000              and eax, 000000FF
:0044AFED 83E801                  sub eax, 00000001
:0044AFF0 50                      push eax
:0044AFF1 B950424B00              mov ecx, 004B4250
:0044AFF6 E84D8B0000              call 00453B48
:0044AFFB EBC6                    jmp 0044AFC3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044AFD6(C)
|
:0044AFFD EB41                    jmp 0044B040

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044AFB9(C)
|
:0044AFFF C645DC00                mov [ebp-24], 00
:0044B003 EB09                    jmp 0044B00E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B03E(U)
|
:0044B005 8A4DDC                  mov cl, byte ptr [ebp-24]
:0044B008 80C101                  add cl, 01
:0044B00B 884DDC                  mov byte ptr [ebp-24], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B003(U)
|
:0044B00E 8B55DC                  mov edx, dword ptr [ebp-24]
:0044B011 81E2FF000000            and edx, 000000FF
:0044B017 8B45E4                  mov eax, dword ptr [ebp-1C]
:0044B01A 25FF000000              and eax, 000000FF
:0044B01F 3BD0                    cmp edx, eax
:0044B021 7D1D                    jge 0044B040
:0044B023 E89C3A0300              call 0047EAC4
:0044B028 8A4DE0                  mov cl, byte ptr [ebp-20]
:0044B02B 51                      push ecx
:0044B02C 6A01                    push 00000001
:0044B02E 6A00                    push 00000000
:0044B030 8A55DC                  mov dl, byte ptr [ebp-24]
:0044B033 52                      push edx
:0044B034 B950424B00              mov ecx, 004B4250
:0044B039 E80A8B0000              call 00453B48
:0044B03E EBC5                    jmp 0044B005

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044AFFD(U), :0044B021(C)
|
:0044B040 8BE5                    mov esp, ebp
:0044B042 5D                      pop ebp
:0044B043 C20C00                  ret 000C



* Referenced by a CALL at Address:
|:0044BA61   
|
:0044B046 55                      push ebp
:0044B047 8BEC                    mov ebp, esp
:0044B049 6AFF                    push FFFFFFFF
:0044B04B 6814564800              push 00485614
:0044B050 64A100000000            mov eax, dword ptr fs:[00000000]
:0044B056 50                      push eax
:0044B057 64892500000000          mov dword ptr fs:[00000000], esp
:0044B05E 81EC28010000            sub esp, 00000128
:0044B064 898DCCFEFFFF            mov dword ptr [ebp+FFFFFECC], ecx
:0044B06A 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0044B070 E83B82FBFF              call 004032B0
:0044B075 C745FC00000000          mov [ebp-04], 00000000

* Possible StringData Ref from Data Obj ->"սƷ"
                                  |
:0044B07C C745F084E14800          mov [ebp-10], 0048E184
:0044B083 C685D8FEFFFF00          mov byte ptr [ebp+FFFFFED8], 00
:0044B08A C785E4FEFFFF00000000    mov dword ptr [ebp+FFFFFEE4], 00000000
:0044B094 EB0F                    jmp 0044B0A5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B0D1(U)
|
:0044B096 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:0044B09C 83C001                  add eax, 00000001
:0044B09F 8985E4FEFFFF            mov dword ptr [ebp+FFFFFEE4], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B094(U)
|
:0044B0A5 83BDE4FEFFFF03          cmp dword ptr [ebp+FFFFFEE4], 00000003
:0044B0AC 7325                    jnb 0044B0D3
:0044B0AE 8B4D10                  mov ecx, dword ptr [ebp+10]
:0044B0B1 038DE4FEFFFF            add ecx, dword ptr [ebp+FFFFFEE4]
:0044B0B7 33D2                    xor edx, edx
:0044B0B9 8A11                    mov dl, byte ptr [ecx]
:0044B0BB 81FAFF000000            cmp edx, 000000FF
:0044B0C1 740E                    je 0044B0D1
:0044B0C3 8A85D8FEFFFF            mov al, byte ptr [ebp+FFFFFED8]
:0044B0C9 0401                    add al, 01
:0044B0CB 8885D8FEFFFF            mov byte ptr [ebp+FFFFFED8], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B0C1(C)
|
:0044B0D1 EBC3                    jmp 0044B096

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B0AC(C)
|
:0044B0D3 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:0044B0D9 81E1FF000000            and ecx, 000000FF
:0044B0DF 85C9                    test ecx, ecx
:0044B0E1 0F8E9F040000            jle 0044B586
:0044B0E7 C785E0FEFFFFF0000000    mov dword ptr [ebp+FFFFFEE0], 000000F0
:0044B0F1 C785D4FEFFFF30000000    mov dword ptr [ebp+FFFFFED4], 00000030
:0044B0FB B950424B00              mov ecx, 004B4250
:0044B100 E80E8A0000              call 00453B13
:0044B105 8B550C                  mov edx, dword ptr [ebp+0C]
:0044B108 C1E202                  shl edx, 02
:0044B10B 8B4508                  mov eax, dword ptr [ebp+08]
:0044B10E 8B4804                  mov ecx, dword ptr [eax+04]
:0044B111 2BCA                    sub ecx, edx
:0044B113 8B5508                  mov edx, dword ptr [ebp+08]
:0044B116 894A04                  mov dword ptr [edx+04], ecx
:0044B119 8B450C                  mov eax, dword ptr [ebp+0C]
:0044B11C C1E002                  shl eax, 02
:0044B11F 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044B122 8B510C                  mov edx, dword ptr [ecx+0C]
:0044B125 2BD0                    sub edx, eax
:0044B127 8B4508                  mov eax, dword ptr [ebp+08]
:0044B12A 89500C                  mov dword ptr [eax+0C], edx
:0044B12D E8A934FDFF              call 0041E5DB
:0044B132 6A01                    push 00000001
:0044B134 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044B137 51                      push ecx
:0044B138 6A3A                    push 0000003A
:0044B13A 6A02                    push 00000002
:0044B13C 8B550C                  mov edx, dword ptr [ebp+0C]
:0044B13F 52                      push edx
:0044B140 83EC10                  sub esp, 00000010
:0044B143 8B4508                  mov eax, dword ptr [ebp+08]
:0044B146 8BCC                    mov ecx, esp
:0044B148 8B10                    mov edx, dword ptr [eax]
:0044B14A 8911                    mov dword ptr [ecx], edx
:0044B14C 8B5004                  mov edx, dword ptr [eax+04]
:0044B14F 895104                  mov dword ptr [ecx+04], edx
:0044B152 8B5008                  mov edx, dword ptr [eax+08]
:0044B155 895108                  mov dword ptr [ecx+08], edx
:0044B158 8B400C                  mov eax, dword ptr [eax+0C]
:0044B15B 89410C                  mov dword ptr [ecx+0C], eax
:0044B15E E8953BFDFF              call 0041ECF8
:0044B163 83C424                  add esp, 00000024
:0044B166 6A01                    push 00000001
:0044B168 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044B16B 51                      push ecx
:0044B16C 6A37                    push 00000037
:0044B16E 6A01                    push 00000001
:0044B170 8B550C                  mov edx, dword ptr [ebp+0C]
:0044B173 52                      push edx
:0044B174 83EC10                  sub esp, 00000010
:0044B177 8B4508                  mov eax, dword ptr [ebp+08]
:0044B17A 8BCC                    mov ecx, esp
:0044B17C 8B10                    mov edx, dword ptr [eax]
:0044B17E 8911                    mov dword ptr [ecx], edx
:0044B180 8B5004                  mov edx, dword ptr [eax+04]
:0044B183 895104                  mov dword ptr [ecx+04], edx
:0044B186 8B5008                  mov edx, dword ptr [eax+08]
:0044B189 895108                  mov dword ptr [ecx+08], edx
:0044B18C 8B400C                  mov eax, dword ptr [eax+0C]
:0044B18F 89410C                  mov dword ptr [ecx+0C], eax
:0044B192 E8613BFDFF              call 0041ECF8
:0044B197 83C424                  add esp, 00000024
:0044B19A 6A00                    push 00000000
:0044B19C 6A12                    push 00000012
:0044B19E 6A04                    push 00000004
:0044B1A0 E894200300              call 0047D239
:0044B1A5 83C40C                  add esp, 0000000C
:0044B1A8 6A00                    push 00000000
:0044B1AA 6A00                    push 00000000
:0044B1AC 6A01                    push 00000001
:0044B1AE 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044B1B1 51                      push ecx
:0044B1B2 8B550C                  mov edx, dword ptr [ebp+0C]
:0044B1B5 52                      push edx
:0044B1B6 8B450C                  mov eax, dword ptr [ebp+0C]
:0044B1B9 99                      cdq
:0044B1BA 2BC2                    sub eax, edx
:0044B1BC D1F8                    sar eax, 1
:0044B1BE 50                      push eax
:0044B1BF 8B4508                  mov eax, dword ptr [ebp+08]
:0044B1C2 50                      push eax
:0044B1C3 E8EC37FDFF              call 0041E9B4
:0044B1C8 83C41C                  add esp, 0000001C
:0044B1CB E82634FDFF              call 0041E5F6
:0044B1D0 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044B1D3 8B510C                  mov edx, dword ptr [ecx+0C]
:0044B1D6 8B450C                  mov eax, dword ptr [ebp+0C]
:0044B1D9 8D0C42                  lea ecx, dword ptr [edx+2*eax]
:0044B1DC 8B5508                  mov edx, dword ptr [ebp+08]
:0044B1DF 894A0C                  mov dword ptr [edx+0C], ecx
:0044B1E2 8B4508                  mov eax, dword ptr [ebp+08]
:0044B1E5 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044B1E8 8B4008                  mov eax, dword ptr [eax+08]
:0044B1EB 2B01                    sub eax, dword ptr [ecx]
:0044B1ED 99                      cdq
:0044B1EE 2BC2                    sub eax, edx
:0044B1F0 D1F8                    sar eax, 1
:0044B1F2 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:0044B1F8 D1EA                    shr edx, 1
:0044B1FA 2BC2                    sub eax, edx
:0044B1FC 8985DCFEFFFF            mov dword ptr [ebp+FFFFFEDC], eax
:0044B202 8B4508                  mov eax, dword ptr [ebp+08]
:0044B205 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044B208 8B400C                  mov eax, dword ptr [eax+0C]
:0044B20B 2B4104                  sub eax, dword ptr [ecx+04]
:0044B20E 99                      cdq
:0044B20F 2BC2                    sub eax, edx
:0044B211 D1F8                    sar eax, 1
:0044B213 8985E8FEFFFF            mov dword ptr [ebp+FFFFFEE8], eax
:0044B219 8B95D8FEFFFF            mov edx, dword ptr [ebp+FFFFFED8]
:0044B21F 81E2FF000000            and edx, 000000FF
:0044B225 83FA03                  cmp edx, 00000003
:0044B228 7D0F                    jge 0044B239
:0044B22A 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:0044B230 83C060                  add eax, 00000060
:0044B233 8985E8FEFFFF            mov dword ptr [ebp+FFFFFEE8], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B228(C)
|
:0044B239 C785D0FEFFFF00000000    mov dword ptr [ebp+FFFFFED0], 00000000
:0044B243 EB0F                    jmp 0044B254

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044B275(U), :0044B566(U)
|
:0044B245 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:0044B24B 83C101                  add ecx, 00000001
:0044B24E 898DD0FEFFFF            mov dword ptr [ebp+FFFFFED0], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B243(U)
|
:0044B254 83BDD0FEFFFF03          cmp dword ptr [ebp+FFFFFED0], 00000003
:0044B25B 0F830A030000            jnb 0044B56B
:0044B261 8B5510                  mov edx, dword ptr [ebp+10]
:0044B264 0395D0FEFFFF            add edx, dword ptr [ebp+FFFFFED0]
:0044B26A 33C0                    xor eax, eax
:0044B26C 8A02                    mov al, byte ptr [edx]
:0044B26E 3DFF000000              cmp eax, 000000FF
:0044B273 7502                    jne 0044B277
:0044B275 EBCE                    jmp 0044B245

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B273(C)
|
:0044B277 6A14                    push 00000014
:0044B279 B9181B4B00              mov ecx, 004B1B18
:0044B27E E8BD80FBFF              call 00403340
:0044B283 E85812FEFF              call 0042C4E0
:0044B288 E84E33FDFF              call 0041E5DB
:0044B28D C785E4FEFFFF00000000    mov dword ptr [ebp+FFFFFEE4], 00000000
:0044B297 EB0F                    jmp 0044B2A8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B2EA(U)
|
:0044B299 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:0044B29F 83C101                  add ecx, 00000001
:0044B2A2 898DE4FEFFFF            mov dword ptr [ebp+FFFFFEE4], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B297(U)
|
:0044B2A8 83BDE4FEFFFF05          cmp dword ptr [ebp+FFFFFEE4], 00000005
:0044B2AF 733B                    jnb 0044B2EC
:0044B2B1 6A04                    push 00000004
:0044B2B3 6A00                    push 00000000
:0044B2B5 68C08D0100              push 00018DC0
:0044B2BA B950EB4A00              mov ecx, 004AEB50
:0044B2BF E87C470300              call 0047FA40
:0044B2C4 50                      push eax
:0044B2C5 6A30                    push 00000030
:0044B2C7 6A30                    push 00000030
:0044B2C9 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:0044B2CF 52                      push edx
:0044B2D0 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:0044B2D6 6BC030                  imul eax, 00000030
:0044B2D9 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:0044B2DF 03C8                    add ecx, eax
:0044B2E1 51                      push ecx
:0044B2E2 E8B42D0300              call 0047E09B
:0044B2E7 83C414                  add esp, 00000014
:0044B2EA EBAD                    jmp 0044B299

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B2AF(C)
|
:0044B2EC C785E4FEFFFF00000000    mov dword ptr [ebp+FFFFFEE4], 00000000
:0044B2F6 EB0F                    jmp 0044B307

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B3CC(U)
|
:0044B2F8 8B95E4FEFFFF            mov edx, dword ptr [ebp+FFFFFEE4]
:0044B2FE 83C201                  add edx, 00000001
:0044B301 8995E4FEFFFF            mov dword ptr [ebp+FFFFFEE4], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B2F6(U)
|
:0044B307 83BDE4FEFFFF03          cmp dword ptr [ebp+FFFFFEE4], 00000003
:0044B30E 0F83BD000000            jnb 0044B3D1
:0044B314 6A00                    push 00000000
:0044B316 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:0044B31C 8D8C0083000000          lea ecx, dword ptr [eax+eax+00000083]
:0044B323 51                      push ecx
:0044B324 6A04                    push 00000004
:0044B326 E8C61E0300              call 0047D1F1
:0044B32B 83C40C                  add esp, 0000000C
:0044B32E 68FFFF0000              push 0000FFFF
:0044B333 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:0044B339 0395D4FEFFFF            add edx, dword ptr [ebp+FFFFFED4]
:0044B33F 0395E4FEFFFF            add edx, dword ptr [ebp+FFFFFEE4]
:0044B345 52                      push edx
:0044B346 8B85DCFEFFFF            mov eax, dword ptr [ebp+FFFFFEDC]
:0044B34C 0385E0FEFFFF            add eax, dword ptr [ebp+FFFFFEE0]
:0044B352 50                      push eax
:0044B353 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:0044B359 038DD4FEFFFF            add ecx, dword ptr [ebp+FFFFFED4]
:0044B35F 038DE4FEFFFF            add ecx, dword ptr [ebp+FFFFFEE4]
:0044B365 51                      push ecx
:0044B366 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:0044B36C 0395E4FEFFFF            add edx, dword ptr [ebp+FFFFFEE4]
:0044B372 52                      push edx
:0044B373 E846210300              call 0047D4BE
:0044B378 83C414                  add esp, 00000014
:0044B37B 68FFFF0000              push 0000FFFF
:0044B380 8B85D4FEFFFF            mov eax, dword ptr [ebp+FFFFFED4]
:0044B386 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:0044B38C 8D540102                lea edx, dword ptr [ecx+eax+02]
:0044B390 52                      push edx
:0044B391 8B85DCFEFFFF            mov eax, dword ptr [ebp+FFFFFEDC]
:0044B397 0385E0FEFFFF            add eax, dword ptr [ebp+FFFFFEE0]
:0044B39D 0385E4FEFFFF            add eax, dword ptr [ebp+FFFFFEE4]
:0044B3A3 50                      push eax
:0044B3A4 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:0044B3AA 038DE4FEFFFF            add ecx, dword ptr [ebp+FFFFFEE4]
:0044B3B0 51                      push ecx
:0044B3B1 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:0044B3B7 0395E0FEFFFF            add edx, dword ptr [ebp+FFFFFEE0]
:0044B3BD 0395E4FEFFFF            add edx, dword ptr [ebp+FFFFFEE4]
:0044B3C3 52                      push edx
:0044B3C4 E8F5200300              call 0047D4BE
:0044B3C9 83C414                  add esp, 00000014
:0044B3CC E927FFFFFF              jmp 0044B2F8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B30E(C)
|
:0044B3D1 6A00                    push 00000000
:0044B3D3 6880000000              push 00000080
:0044B3D8 6A04                    push 00000004
:0044B3DA E8121E0300              call 0047D1F1
:0044B3DF 83C40C                  add esp, 0000000C
:0044B3E2 68FFFF0000              push 0000FFFF
:0044B3E7 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:0044B3ED 83E801                  sub eax, 00000001
:0044B3F0 50                      push eax
:0044B3F1 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:0044B3F7 038DE0FEFFFF            add ecx, dword ptr [ebp+FFFFFEE0]
:0044B3FD 51                      push ecx
:0044B3FE 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:0044B404 83EA01                  sub edx, 00000001
:0044B407 52                      push edx
:0044B408 8B85DCFEFFFF            mov eax, dword ptr [ebp+FFFFFEDC]
:0044B40E 50                      push eax
:0044B40F E8AA200300              call 0047D4BE
:0044B414 83C414                  add esp, 00000014
:0044B417 68FFFF0000              push 0000FFFF
:0044B41C 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:0044B422 038DD4FEFFFF            add ecx, dword ptr [ebp+FFFFFED4]
:0044B428 51                      push ecx
:0044B429 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:0044B42F 83EA01                  sub edx, 00000001
:0044B432 52                      push edx
:0044B433 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:0044B439 83E801                  sub eax, 00000001
:0044B43C 50                      push eax
:0044B43D 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:0044B443 83E901                  sub ecx, 00000001
:0044B446 51                      push ecx
:0044B447 E872200300              call 0047D4BE
:0044B44C 83C414                  add esp, 00000014

* Possible StringData Ref from Data Obj ->"ITEM.E5"
                                  |
:0044B44F 68F0BB4800              push 0048BBF0
:0044B454 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0044B45A E8D646FDFF              call 0041FB35
:0044B45F 6A04                    push 00000004
:0044B461 6A00                    push 00000000
:0044B463 6800690000              push 00006900
:0044B468 B9C8E44A00              mov ecx, 004AE4C8
:0044B46D E8CE450300              call 0047FA40
:0044B472 50                      push eax
:0044B473 8B5510                  mov edx, dword ptr [ebp+10]
:0044B476 0395D0FEFFFF            add edx, dword ptr [ebp+FFFFFED0]
:0044B47C 33C0                    xor eax, eax
:0044B47E 8A02                    mov al, byte ptr [edx]
:0044B480 50                      push eax
:0044B481 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0044B487 E8FD47FDFF              call 0041FC89
:0044B48C 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0044B492 E82EDEFCFF              call 004192C5
:0044B497 6A04                    push 00000004
:0044B499 6A04                    push 00000004
:0044B49B 6A00                    push 00000000
:0044B49D 6800690000              push 00006900
:0044B4A2 B9C8E44A00              mov ecx, 004AE4C8
:0044B4A7 E894450300              call 0047FA40
:0044B4AC 50                      push eax
:0044B4AD 6A20                    push 00000020
:0044B4AF 6A20                    push 00000020
:0044B4B1 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:0044B4B7 83C108                  add ecx, 00000008
:0044B4BA 51                      push ecx
:0044B4BB 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:0044B4C1 83C210                  add edx, 00000010
:0044B4C4 52                      push edx
:0044B4C5 E849640000              call 00451913
:0044B4CA 83C418                  add esp, 00000018
:0044B4CD 6A04                    push 00000004
:0044B4CF B9382F4900              mov ecx, 00492F38
:0044B4D4 E85D38FCFF              call 0040ED36
:0044B4D9 6A00                    push 00000000
:0044B4DB B9382F4900              mov ecx, 00492F38
:0044B4E0 E82538FCFF              call 0040ED0A
:0044B4E5 68AC000000              push 000000AC
:0044B4EA B9382F4900              mov ecx, 00492F38
:0044B4EF E89037FCFF              call 0040EC84
:0044B4F4 6A00                    push 00000000
:0044B4F6 B9382F4900              mov ecx, 00492F38
:0044B4FB E8BC37FCFF              call 0040ECBC
:0044B500 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:0044B506 83C010                  add eax, 00000010
:0044B509 50                      push eax
:0044B50A 8B85DCFEFFFF            mov eax, dword ptr [ebp+FFFFFEDC]
:0044B510 99                      cdq
:0044B511 83E207                  and edx, 00000007
:0044B514 03C2                    add eax, edx
:0044B516 C1F803                  sar eax, 03
:0044B519 83C00A                  add eax, 0000000A
:0044B51C 50                      push eax
:0044B51D B9382F4900              mov ecx, 00492F38
:0044B522 E8B036FCFF              call 0040EBD7
:0044B527 8B4D10                  mov ecx, dword ptr [ebp+10]
:0044B52A 038DD0FEFFFF            add ecx, dword ptr [ebp+FFFFFED0]
:0044B530 33D2                    xor edx, edx
:0044B532 8A11                    mov dl, byte ptr [ecx]
:0044B534 8BCA                    mov ecx, edx
:0044B536 6BC919                  imul ecx, 00000019
:0044B539 81C140114A00            add ecx, 004A1140
:0044B53F E8CC410100              call 0045F710
:0044B544 50                      push eax
:0044B545 68382F4900              push 00492F38
:0044B54A E85145FCFF              call 0040FAA0
:0044B54F 83C408                  add esp, 00000008
:0044B552 E89F30FDFF              call 0041E5F6
:0044B557 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:0044B55D 83C060                  add eax, 00000060
:0044B560 8985E8FEFFFF            mov dword ptr [ebp+FFFFFEE8], eax
:0044B566 E9DAFCFFFF              jmp 0044B245

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B25B(C)
|
:0044B56B 6A14                    push 00000014
:0044B56D B9181B4B00              mov ecx, 004B1B18
:0044B572 E8C97DFBFF              call 00403340
:0044B577 E8640FFEFF              call 0042C4E0
:0044B57C 6A1E                    push 0000001E
:0044B57E E8C310FEFF              call 0042C646
:0044B583 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B0E1(C)
|
:0044B586 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0044B58D 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0044B593 E8387DFBFF              call 004032D0
:0044B598 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044B59B 64890D00000000          mov dword ptr fs:[00000000], ecx
:0044B5A2 8BE5                    mov esp, ebp
:0044B5A4 5D                      pop ebp
:0044B5A5 C20C00                  ret 000C



* Referenced by a CALL at Address:
|:00416B17   
|
:0044B5A8 55                      push ebp
:0044B5A9 8BEC                    mov ebp, esp
:0044B5AB 83EC44                  sub esp, 00000044
:0044B5AE 894DC0                  mov dword ptr [ebp-40], ecx
:0044B5B1 B950424B00              mov ecx, 004B4250
:0044B5B6 E889A80000              call 00455E44
:0044B5BB 99                      cdq
:0044B5BC B930000000              mov ecx, 00000030
:0044B5C1 F7F9                    idiv ecx
:0044B5C3 8845E8                  mov byte ptr [ebp-18], al
:0044B5C6 B950424B00              mov ecx, 004B4250
:0044B5CB E89BA80000              call 00455E6B
:0044B5D0 99                      cdq
:0044B5D1 B930000000              mov ecx, 00000030
:0044B5D6 F7F9                    idiv ecx
:0044B5D8 8845E4                  mov byte ptr [ebp-1C], al
:0044B5DB 837D1000                cmp dword ptr [ebp+10], 00000000
:0044B5DF 7409                    je 0044B5EA

* Possible StringData Ref from Data Obj ->"ȫս"
                                  |
:0044B5E1 C745BC8CE14800          mov [ebp-44], 0048E18C
:0044B5E8 EB07                    jmp 0044B5F1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B5DF(C)
|

* Possible StringData Ref from Data Obj ->"ս"
                                  |
:0044B5EA C745BC9CE14800          mov [ebp-44], 0048E19C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B5E8(U)
|
:0044B5F1 8B55BC                  mov edx, dword ptr [ebp-44]
:0044B5F4 8955EC                  mov dword ptr [ebp-14], edx
:0044B5F7 6A1F                    push 0000001F
:0044B5F9 B950424B00              mov ecx, 004B4250
:0044B5FE E8E7660000              call 00451CEA
:0044B603 C645E000                mov [ebp-20], 00
:0044B607 EB08                    jmp 0044B611

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B674(U)
|
:0044B609 8A45E0                  mov al, byte ptr [ebp-20]
:0044B60C 0401                    add al, 01
:0044B60E 8845E0                  mov byte ptr [ebp-20], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B607(U)
|
:0044B611 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0044B614 81E1FF000000            and ecx, 000000FF
:0044B61A 8B45E8                  mov eax, dword ptr [ebp-18]
:0044B61D 25FF000000              and eax, 000000FF
:0044B622 99                      cdq
:0044B623 2BC2                    sub eax, edx
:0044B625 D1F8                    sar eax, 1
:0044B627 3BC8                    cmp ecx, eax
:0044B629 7D4B                    jge 0044B676
:0044B62B E894340300              call 0047EAC4
:0044B630 8A55E4                  mov dl, byte ptr [ebp-1C]
:0044B633 52                      push edx
:0044B634 6A01                    push 00000001
:0044B636 6A00                    push 00000000
:0044B638 8A45E0                  mov al, byte ptr [ebp-20]
:0044B63B 50                      push eax
:0044B63C B950424B00              mov ecx, 004B4250
:0044B641 E802850000              call 00453B48
:0044B646 E879340300              call 0047EAC4
:0044B64B 8A4DE4                  mov cl, byte ptr [ebp-1C]
:0044B64E 51                      push ecx
:0044B64F 6A01                    push 00000001
:0044B651 6A00                    push 00000000
:0044B653 8B55E8                  mov edx, dword ptr [ebp-18]
:0044B656 81E2FF000000            and edx, 000000FF
:0044B65C 8B45E0                  mov eax, dword ptr [ebp-20]
:0044B65F 25FF000000              and eax, 000000FF
:0044B664 83C001                  add eax, 00000001
:0044B667 2BD0                    sub edx, eax
:0044B669 52                      push edx
:0044B66A B950424B00              mov ecx, 004B4250
:0044B66F E8D4840000              call 00453B48
:0044B674 EB93                    jmp 0044B609

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B629(C)
|
:0044B676 8B45E8                  mov eax, dword ptr [ebp-18]
:0044B679 25FF000000              and eax, 000000FF
:0044B67E 99                      cdq
:0044B67F 33C2                    xor eax, edx
:0044B681 2BC2                    sub eax, edx
:0044B683 83E001                  and eax, 00000001
:0044B686 33C2                    xor eax, edx
:0044B688 2BC2                    sub eax, edx
:0044B68A 85C0                    test eax, eax
:0044B68C 7425                    je 0044B6B3
:0044B68E E831340300              call 0047EAC4
:0044B693 8A4DE4                  mov cl, byte ptr [ebp-1C]
:0044B696 51                      push ecx
:0044B697 6A01                    push 00000001
:0044B699 6A00                    push 00000000
:0044B69B 8B45E8                  mov eax, dword ptr [ebp-18]
:0044B69E 25FF000000              and eax, 000000FF
:0044B6A3 99                      cdq
:0044B6A4 2BC2                    sub eax, edx
:0044B6A6 D1F8                    sar eax, 1
:0044B6A8 50                      push eax
:0044B6A9 B950424B00              mov ecx, 004B4250
:0044B6AE E895840000              call 00453B48

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B68C(C)
|
:0044B6B3 6A09                    push 00000009
:0044B6B5 B9B8694B00              mov ecx, 004B69B8
:0044B6BA E83F8F0200              call 004745FE
:0044B6BF 8B55E8                  mov edx, dword ptr [ebp-18]
:0044B6C2 81E2FF000000            and edx, 000000FF
:0044B6C8 6BD230                  imul edx, 00000030
:0044B6CB 81FAC0030000            cmp edx, 000003C0
:0044B6D1 7C10                    jl 0044B6E3
:0044B6D3 C745CC40000000          mov [ebp-34], 00000040
:0044B6DA C745C802000000          mov [ebp-38], 00000002
:0044B6E1 EB30                    jmp 0044B713

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B6D1(C)
|
:0044B6E3 8B45E8                  mov eax, dword ptr [ebp-18]
:0044B6E6 25FF000000              and eax, 000000FF
:0044B6EB 6BC030                  imul eax, 00000030
:0044B6EE 3DD0020000              cmp eax, 000002D0
:0044B6F3 7C10                    jl 0044B705
:0044B6F5 C745CC40000000          mov [ebp-34], 00000040
:0044B6FC C745C802000000          mov [ebp-38], 00000002
:0044B703 EB0E                    jmp 0044B713

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B6F3(C)
|
:0044B705 C745CC30000000          mov [ebp-34], 00000030
:0044B70C C745C801000000          mov [ebp-38], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044B6E1(U), :0044B703(U)
|
:0044B713 837D1000                cmp dword ptr [ebp+10], 00000000
:0044B717 0F8496010000            je 0044B8B3
:0044B71D 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0044B720 51                      push ecx
:0044B721 8B15686A4B00            mov edx, dword ptr [004B6A68]
:0044B727 52                      push edx
:0044B728 FF15EC624800            call dword ptr [004862EC]
:0044B72E E8A82EFDFF              call 0041E5DB
:0044B733 6A01                    push 00000001
:0044B735 8B45EC                  mov eax, dword ptr [ebp-14]
:0044B738 50                      push eax
:0044B739 6A18                    push 00000018
:0044B73B 6A02                    push 00000002
:0044B73D 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0044B740 51                      push ecx
:0044B741 83EC10                  sub esp, 00000010
:0044B744 8BD4                    mov edx, esp
:0044B746 8B45F0                  mov eax, dword ptr [ebp-10]
:0044B749 8902                    mov dword ptr [edx], eax
:0044B74B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044B74E 894A04                  mov dword ptr [edx+04], ecx
:0044B751 8B45F8                  mov eax, dword ptr [ebp-08]
:0044B754 894208                  mov dword ptr [edx+08], eax
:0044B757 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044B75A 894A0C                  mov dword ptr [edx+0C], ecx
:0044B75D E89635FDFF              call 0041ECF8
:0044B762 83C424                  add esp, 00000024
:0044B765 6A01                    push 00000001
:0044B767 8B55EC                  mov edx, dword ptr [ebp-14]
:0044B76A 52                      push edx
:0044B76B 6A15                    push 00000015
:0044B76D 6A01                    push 00000001
:0044B76F 8B45CC                  mov eax, dword ptr [ebp-34]
:0044B772 50                      push eax
:0044B773 83EC10                  sub esp, 00000010
:0044B776 8BCC                    mov ecx, esp
:0044B778 8B55F0                  mov edx, dword ptr [ebp-10]
:0044B77B 8911                    mov dword ptr [ecx], edx
:0044B77D 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044B780 894104                  mov dword ptr [ecx+04], eax
:0044B783 8B55F8                  mov edx, dword ptr [ebp-08]
:0044B786 895108                  mov dword ptr [ecx+08], edx
:0044B789 8B45FC                  mov eax, dword ptr [ebp-04]
:0044B78C 89410C                  mov dword ptr [ecx+0C], eax
:0044B78F E86435FDFF              call 0041ECF8
:0044B794 83C424                  add esp, 00000024
:0044B797 6A00                    push 00000000
:0044B799 6A12                    push 00000012
:0044B79B 6A04                    push 00000004
:0044B79D E8971A0300              call 0047D239
:0044B7A2 83C40C                  add esp, 0000000C
:0044B7A5 6A00                    push 00000000
:0044B7A7 6A00                    push 00000000
:0044B7A9 6A01                    push 00000001
:0044B7AB 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0044B7AE 51                      push ecx
:0044B7AF 8B55CC                  mov edx, dword ptr [ebp-34]
:0044B7B2 52                      push edx
:0044B7B3 8B45CC                  mov eax, dword ptr [ebp-34]
:0044B7B6 99                      cdq
:0044B7B7 2BC2                    sub eax, edx
:0044B7B9 D1F8                    sar eax, 1
:0044B7BB 50                      push eax
:0044B7BC 8D45F0                  lea eax, dword ptr [ebp-10]
:0044B7BF 50                      push eax
:0044B7C0 E8EF31FDFF              call 0041E9B4
:0044B7C5 83C41C                  add esp, 0000001C
:0044B7C8 E8292EFDFF              call 0041E5F6
:0044B7CD 6A0A                    push 0000000A
:0044B7CF B9181B4B00              mov ecx, 004B1B18
:0044B7D4 E8677BFBFF              call 00403340
:0044B7D9 E8020DFEFF              call 0042C4E0

* Possible StringData Ref from Data Obj ->"ʵͳһҵ"
                                  |
:0044B7DE C745C4A8E14800          mov [ebp-3C], 0048E1A8
:0044B7E5 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0044B7E8 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044B7EB 8D048A                  lea eax, dword ptr [edx+4*ecx]
:0044B7EE 8945F4                  mov dword ptr [ebp-0C], eax
:0044B7F1 E8E52DFDFF              call 0041E5DB
:0044B7F6 6A01                    push 00000001
:0044B7F8 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:0044B7FB 51                      push ecx
:0044B7FC 68AD000000              push 000000AD
:0044B801 6A02                    push 00000002
:0044B803 8B55CC                  mov edx, dword ptr [ebp-34]
:0044B806 52                      push edx
:0044B807 83EC10                  sub esp, 00000010
:0044B80A 8BC4                    mov eax, esp
:0044B80C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044B80F 8908                    mov dword ptr [eax], ecx
:0044B811 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044B814 895004                  mov dword ptr [eax+04], edx
:0044B817 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044B81A 894808                  mov dword ptr [eax+08], ecx
:0044B81D 8B55FC                  mov edx, dword ptr [ebp-04]
:0044B820 89500C                  mov dword ptr [eax+0C], edx
:0044B823 E8D034FDFF              call 0041ECF8
:0044B828 83C424                  add esp, 00000024
:0044B82B 6A01                    push 00000001
:0044B82D 8B45C4                  mov eax, dword ptr [ebp-3C]
:0044B830 50                      push eax
:0044B831 6A25                    push 00000025
:0044B833 6A01                    push 00000001
:0044B835 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0044B838 51                      push ecx
:0044B839 83EC10                  sub esp, 00000010
:0044B83C 8BD4                    mov edx, esp
:0044B83E 8B45F0                  mov eax, dword ptr [ebp-10]
:0044B841 8902                    mov dword ptr [edx], eax
:0044B843 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044B846 894A04                  mov dword ptr [edx+04], ecx
:0044B849 8B45F8                  mov eax, dword ptr [ebp-08]
:0044B84C 894208                  mov dword ptr [edx+08], eax
:0044B84F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044B852 894A0C                  mov dword ptr [edx+0C], ecx
:0044B855 E89E34FDFF              call 0041ECF8
:0044B85A 83C424                  add esp, 00000024
:0044B85D 6A00                    push 00000000
:0044B85F 6A43                    push 00000043
:0044B861 6A04                    push 00000004
:0044B863 E8D1190300              call 0047D239
:0044B868 83C40C                  add esp, 0000000C
:0044B86B 6A00                    push 00000000
:0044B86D 6A00                    push 00000000
:0044B86F 6A01                    push 00000001
:0044B871 8B55C4                  mov edx, dword ptr [ebp-3C]
:0044B874 52                      push edx
:0044B875 8B45CC                  mov eax, dword ptr [ebp-34]
:0044B878 50                      push eax
:0044B879 8B45CC                  mov eax, dword ptr [ebp-34]
:0044B87C 99                      cdq
:0044B87D 2BC2                    sub eax, edx
:0044B87F D1F8                    sar eax, 1
:0044B881 50                      push eax
:0044B882 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0044B885 51                      push ecx
:0044B886 E82931FDFF              call 0041E9B4
:0044B88B 83C41C                  add esp, 0000001C
:0044B88E E8632DFDFF              call 0041E5F6
:0044B893 6A14                    push 00000014
:0044B895 B9181B4B00              mov ecx, 004B1B18
:0044B89A E8A17AFBFF              call 00403340
:0044B89F E83C0CFEFF              call 0042C4E0
:0044B8A4 6A1E                    push 0000001E
:0044B8A6 E89B0DFEFF              call 0042C646
:0044B8AB 83C404                  add esp, 00000004
:0044B8AE E9B3010000              jmp 0044BA66

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B717(C)
|
:0044B8B3 8D55F0                  lea edx, dword ptr [ebp-10]
:0044B8B6 52                      push edx
:0044B8B7 A1686A4B00              mov eax, dword ptr [004B6A68]
:0044B8BC 50                      push eax
:0044B8BD FF15EC624800            call dword ptr [004862EC]
:0044B8C3 E8132DFDFF              call 0041E5DB
:0044B8C8 6A01                    push 00000001
:0044B8CA 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0044B8CD 51                      push ecx
:0044B8CE 6A18                    push 00000018
:0044B8D0 6A02                    push 00000002
:0044B8D2 8B55CC                  mov edx, dword ptr [ebp-34]
:0044B8D5 52                      push edx
:0044B8D6 83EC10                  sub esp, 00000010
:0044B8D9 8BC4                    mov eax, esp
:0044B8DB 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044B8DE 8908                    mov dword ptr [eax], ecx
:0044B8E0 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044B8E3 895004                  mov dword ptr [eax+04], edx
:0044B8E6 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044B8E9 894808                  mov dword ptr [eax+08], ecx
:0044B8EC 8B55FC                  mov edx, dword ptr [ebp-04]
:0044B8EF 89500C                  mov dword ptr [eax+0C], edx
:0044B8F2 E80134FDFF              call 0041ECF8
:0044B8F7 83C424                  add esp, 00000024
:0044B8FA 6A01                    push 00000001
:0044B8FC 8B45EC                  mov eax, dword ptr [ebp-14]
:0044B8FF 50                      push eax
:0044B900 6A15                    push 00000015
:0044B902 6A01                    push 00000001
:0044B904 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0044B907 51                      push ecx
:0044B908 83EC10                  sub esp, 00000010
:0044B90B 8BD4                    mov edx, esp
:0044B90D 8B45F0                  mov eax, dword ptr [ebp-10]
:0044B910 8902                    mov dword ptr [edx], eax
:0044B912 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044B915 894A04                  mov dword ptr [edx+04], ecx
:0044B918 8B45F8                  mov eax, dword ptr [ebp-08]
:0044B91B 894208                  mov dword ptr [edx+08], eax
:0044B91E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044B921 894A0C                  mov dword ptr [edx+0C], ecx
:0044B924 E8CF33FDFF              call 0041ECF8
:0044B929 83C424                  add esp, 00000024
:0044B92C 6A00                    push 00000000
:0044B92E 6A12                    push 00000012
:0044B930 6A04                    push 00000004
:0044B932 E802190300              call 0047D239
:0044B937 83C40C                  add esp, 0000000C
:0044B93A 6A00                    push 00000000
:0044B93C 6A00                    push 00000000
:0044B93E 6A01                    push 00000001
:0044B940 8B55EC                  mov edx, dword ptr [ebp-14]
:0044B943 52                      push edx
:0044B944 8B45CC                  mov eax, dword ptr [ebp-34]
:0044B947 50                      push eax
:0044B948 8B45CC                  mov eax, dword ptr [ebp-34]
:0044B94B 99                      cdq
:0044B94C 2BC2                    sub eax, edx
:0044B94E D1F8                    sar eax, 1
:0044B950 50                      push eax
:0044B951 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0044B954 51                      push ecx
:0044B955 E85A30FDFF              call 0041E9B4
:0044B95A 83C41C                  add esp, 0000001C
:0044B95D E8942CFDFF              call 0041E5F6
:0044B962 6A14                    push 00000014
:0044B964 B9181B4B00              mov ecx, 004B1B18
:0044B969 E8D279FBFF              call 00403340
:0044B96E E86D0BFEFF              call 0042C4E0
:0044B973 8B55CC                  mov edx, dword ptr [ebp-34]
:0044B976 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044B979 8D0C90                  lea ecx, dword ptr [eax+4*edx]
:0044B97C 894DF4                  mov dword ptr [ebp-0C], ecx
:0044B97F 8B5508                  mov edx, dword ptr [ebp+08]
:0044B982 52                      push edx

* Possible StringData Ref from Data Obj ->"   %5u"
                                  |
:0044B983 68BCE14800              push 0048E1BC
:0044B988 8D45D0                  lea eax, dword ptr [ebp-30]
:0044B98B 50                      push eax
:0044B98C FF15C0624800            call dword ptr [004862C0]
:0044B992 83C40C                  add esp, 0000000C
:0044B995 E8412CFDFF              call 0041E5DB
:0044B99A 6A01                    push 00000001
:0044B99C 8D4DD0                  lea ecx, dword ptr [ebp-30]
:0044B99F 51                      push ecx
:0044B9A0 68AD000000              push 000000AD
:0044B9A5 6A02                    push 00000002
:0044B9A7 8B55CC                  mov edx, dword ptr [ebp-34]
:0044B9AA 52                      push edx
:0044B9AB 83EC10                  sub esp, 00000010
:0044B9AE 8BC4                    mov eax, esp
:0044B9B0 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044B9B3 8908                    mov dword ptr [eax], ecx
:0044B9B5 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044B9B8 895004                  mov dword ptr [eax+04], edx
:0044B9BB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044B9BE 894808                  mov dword ptr [eax+08], ecx
:0044B9C1 8B55FC                  mov edx, dword ptr [ebp-04]
:0044B9C4 89500C                  mov dword ptr [eax+0C], edx
:0044B9C7 E82C33FDFF              call 0041ECF8
:0044B9CC 83C424                  add esp, 00000024
:0044B9CF 6A01                    push 00000001
:0044B9D1 8D45D0                  lea eax, dword ptr [ebp-30]
:0044B9D4 50                      push eax
:0044B9D5 6A25                    push 00000025
:0044B9D7 6A01                    push 00000001
:0044B9D9 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0044B9DC 51                      push ecx
:0044B9DD 83EC10                  sub esp, 00000010
:0044B9E0 8BD4                    mov edx, esp
:0044B9E2 8B45F0                  mov eax, dword ptr [ebp-10]
:0044B9E5 8902                    mov dword ptr [edx], eax
:0044B9E7 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044B9EA 894A04                  mov dword ptr [edx+04], ecx
:0044B9ED 8B45F8                  mov eax, dword ptr [ebp-08]
:0044B9F0 894208                  mov dword ptr [edx+08], eax
:0044B9F3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044B9F6 894A0C                  mov dword ptr [edx+0C], ecx
:0044B9F9 E8FA32FDFF              call 0041ECF8
:0044B9FE 83C424                  add esp, 00000024
:0044BA01 6A00                    push 00000000
:0044BA03 6A43                    push 00000043
:0044BA05 6A04                    push 00000004
:0044BA07 E82D180300              call 0047D239
:0044BA0C 83C40C                  add esp, 0000000C
:0044BA0F 6A00                    push 00000000
:0044BA11 6A00                    push 00000000
:0044BA13 6A01                    push 00000001
:0044BA15 8D55D0                  lea edx, dword ptr [ebp-30]
:0044BA18 52                      push edx
:0044BA19 8B45CC                  mov eax, dword ptr [ebp-34]
:0044BA1C 50                      push eax
:0044BA1D 8B45CC                  mov eax, dword ptr [ebp-34]
:0044BA20 99                      cdq
:0044BA21 2BC2                    sub eax, edx
:0044BA23 D1F8                    sar eax, 1
:0044BA25 50                      push eax
:0044BA26 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0044BA29 51                      push ecx
:0044BA2A E8852FFDFF              call 0041E9B4
:0044BA2F 83C41C                  add esp, 0000001C
:0044BA32 E8BF2BFDFF              call 0041E5F6
:0044BA37 6A14                    push 00000014
:0044BA39 B9181B4B00              mov ecx, 004B1B18
:0044BA3E E8FD78FBFF              call 00403340
:0044BA43 E8980AFEFF              call 0042C4E0
:0044BA48 6A1E                    push 0000001E
:0044BA4A E8F70BFEFF              call 0042C646
:0044BA4F 83C404                  add esp, 00000004
:0044BA52 8B550C                  mov edx, dword ptr [ebp+0C]
:0044BA55 52                      push edx
:0044BA56 8B45CC                  mov eax, dword ptr [ebp-34]
:0044BA59 50                      push eax
:0044BA5A 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0044BA5D 51                      push ecx
:0044BA5E 8B4DC0                  mov ecx, dword ptr [ebp-40]
:0044BA61 E8E0F5FFFF              call 0044B046

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B8AE(U)
|
:0044BA66 B950424B00              mov ecx, 004B4250
:0044BA6B E83B630000              call 00451DAB
:0044BA70 8A55E4                  mov dl, byte ptr [ebp-1C]
:0044BA73 8855E0                  mov byte ptr [ebp-20], dl
:0044BA76 EB08                    jmp 0044BA80

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044BAB0(U)
|
:0044BA78 8A45E0                  mov al, byte ptr [ebp-20]
:0044BA7B 2C01                    sub al, 01
:0044BA7D 8845E0                  mov byte ptr [ebp-20], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044BA76(U)
|
:0044BA80 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0044BA83 81E1FF000000            and ecx, 000000FF
:0044BA89 85C9                    test ecx, ecx
:0044BA8B 7E25                    jle 0044BAB2
:0044BA8D E832300300              call 0047EAC4
:0044BA92 6A01                    push 00000001
:0044BA94 8A55E8                  mov dl, byte ptr [ebp-18]
:0044BA97 52                      push edx
:0044BA98 8B45E0                  mov eax, dword ptr [ebp-20]
:0044BA9B 25FF000000              and eax, 000000FF
:0044BAA0 83E801                  sub eax, 00000001
:0044BAA3 50                      push eax
:0044BAA4 6A00                    push 00000000
:0044BAA6 B950424B00              mov ecx, 004B4250
:0044BAAB E898800000              call 00453B48
:0044BAB0 EBC6                    jmp 0044BA78

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044BA8B(C)
|
:0044BAB2 B950424B00              mov ecx, 004B4250
:0044BAB7 E857800000              call 00453B13
:0044BABC 8BE5                    mov esp, ebp
:0044BABE 5D                      pop ebp
:0044BABF C20C00                  ret 000C



* Referenced by a CALL at Address:
|:00416CAF   
|
:0044BAC2 55                      push ebp
:0044BAC3 8BEC                    mov ebp, esp
:0044BAC5 83EC2C                  sub esp, 0000002C
:0044BAC8 894DD4                  mov dword ptr [ebp-2C], ecx
:0044BACB B950424B00              mov ecx, 004B4250
:0044BAD0 E86FA30000              call 00455E44
:0044BAD5 99                      cdq
:0044BAD6 B930000000              mov ecx, 00000030
:0044BADB F7F9                    idiv ecx
:0044BADD 8845E8                  mov byte ptr [ebp-18], al
:0044BAE0 B950424B00              mov ecx, 004B4250
:0044BAE5 E881A30000              call 00455E6B
:0044BAEA 99                      cdq
:0044BAEB B930000000              mov ecx, 00000030
:0044BAF0 F7F9                    idiv ecx
:0044BAF2 8845E4                  mov byte ptr [ebp-1C], al

* Possible StringData Ref from Data Obj ->"ʼս"
                                  |
:0044BAF5 C745ECC8E14800          mov [ebp-14], 0048E1C8
:0044BAFC 6A1F                    push 0000001F
:0044BAFE B950424B00              mov ecx, 004B4250
:0044BB03 E8E2610000              call 00451CEA
:0044BB08 C645E000                mov [ebp-20], 00
:0044BB0C EB09                    jmp 0044BB17

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044BB7A(U)
|
:0044BB0E 8A55E0                  mov dl, byte ptr [ebp-20]
:0044BB11 80C201                  add dl, 01
:0044BB14 8855E0                  mov byte ptr [ebp-20], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044BB0C(U)
|
:0044BB17 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0044BB1A 81E1FF000000            and ecx, 000000FF
:0044BB20 8B45E8                  mov eax, dword ptr [ebp-18]
:0044BB23 25FF000000              and eax, 000000FF
:0044BB28 99                      cdq
:0044BB29 2BC2                    sub eax, edx
:0044BB2B D1F8                    sar eax, 1
:0044BB2D 3BC8                    cmp ecx, eax
:0044BB2F 7D4B                    jge 0044BB7C
:0044BB31 E88E2F0300              call 0047EAC4
:0044BB36 8A55E4                  mov dl, byte ptr [ebp-1C]
:0044BB39 52                      push edx
:0044BB3A 6A01                    push 00000001
:0044BB3C 6A00                    push 00000000
:0044BB3E 8A45E0                  mov al, byte ptr [ebp-20]
:0044BB41 50                      push eax
:0044BB42 B950424B00              mov ecx, 004B4250
:0044BB47 E8FC7F0000              call 00453B48
:0044BB4C E8732F0300              call 0047EAC4
:0044BB51 8A4DE4                  mov cl, byte ptr [ebp-1C]
:0044BB54 51                      push ecx
:0044BB55 6A01                    push 00000001
:0044BB57 6A00                    push 00000000
:0044BB59 8B55E8                  mov edx, dword ptr [ebp-18]
:0044BB5C 81E2FF000000            and edx, 000000FF
:0044BB62 8B45E0                  mov eax, dword ptr [ebp-20]
:0044BB65 25FF000000              and eax, 000000FF
:0044BB6A 83C001                  add eax, 00000001
:0044BB6D 2BD0                    sub edx, eax
:0044BB6F 52                      push edx
:0044BB70 B950424B00              mov ecx, 004B4250
:0044BB75 E8CE7F0000              call 00453B48
:0044BB7A EB92                    jmp 0044BB0E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044BB2F(C)
|
:0044BB7C 8B45E8                  mov eax, dword ptr [ebp-18]
:0044BB7F 25FF000000              and eax, 000000FF
:0044BB84 99                      cdq
:0044BB85 33C2                    xor eax, edx
:0044BB87 2BC2                    sub eax, edx
:0044BB89 83E001                  and eax, 00000001
:0044BB8C 33C2                    xor eax, edx
:0044BB8E 2BC2                    sub eax, edx
:0044BB90 85C0                    test eax, eax
:0044BB92 7425                    je 0044BBB9
:0044BB94 E82B2F0300              call 0047EAC4
:0044BB99 8A4DE4                  mov cl, byte ptr [ebp-1C]
:0044BB9C 51                      push ecx
:0044BB9D 6A01                    push 00000001
:0044BB9F 6A00                    push 00000000
:0044BBA1 8B45E8                  mov eax, dword ptr [ebp-18]
:0044BBA4 25FF000000              and eax, 000000FF
:0044BBA9 99                      cdq
:0044BBAA 2BC2                    sub eax, edx
:0044BBAC D1F8                    sar eax, 1
:0044BBAE 50                      push eax
:0044BBAF B950424B00              mov ecx, 004B4250
:0044BBB4 E88F7F0000              call 00453B48

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044BB92(C)
|
:0044BBB9 8B55E8                  mov edx, dword ptr [ebp-18]
:0044BBBC 81E2FF000000            and edx, 000000FF
:0044BBC2 6BD230                  imul edx, 00000030
:0044BBC5 81FAC0030000            cmp edx, 000003C0
:0044BBCB 7C10                    jl 0044BBDD
:0044BBCD C745DC40000000          mov [ebp-24], 00000040
:0044BBD4 C745D802000000          mov [ebp-28], 00000002
:0044BBDB EB30                    jmp 0044BC0D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044BBCB(C)
|
:0044BBDD 8B45E8                  mov eax, dword ptr [ebp-18]
:0044BBE0 25FF000000              and eax, 000000FF
:0044BBE5 6BC030                  imul eax, 00000030
:0044BBE8 3DD0020000              cmp eax, 000002D0
:0044BBED 7C10                    jl 0044BBFF
:0044BBEF C745DC40000000          mov [ebp-24], 00000040
:0044BBF6 C745D802000000          mov [ebp-28], 00000002
:0044BBFD EB0E                    jmp 0044BC0D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044BBED(C)
|
:0044BBFF C745DC30000000          mov [ebp-24], 00000030
:0044BC06 C745D802000000          mov [ebp-28], 00000002

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044BBDB(U), :0044BBFD(U)
|
:0044BC0D 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0044BC10 51                      push ecx
:0044BC11 8B15686A4B00            mov edx, dword ptr [004B6A68]
:0044BC17 52                      push edx
:0044BC18 FF15EC624800            call dword ptr [004862EC]
:0044BC1E E8B829FDFF              call 0041E5DB
:0044BC23 6A01                    push 00000001
:0044BC25 8B45EC                  mov eax, dword ptr [ebp-14]
:0044BC28 50                      push eax
:0044BC29 6A18                    push 00000018
:0044BC2B 6A02                    push 00000002
:0044BC2D 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0044BC30 51                      push ecx
:0044BC31 83EC10                  sub esp, 00000010
:0044BC34 8BD4                    mov edx, esp
:0044BC36 8B45F0                  mov eax, dword ptr [ebp-10]
:0044BC39 8902                    mov dword ptr [edx], eax
:0044BC3B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044BC3E 894A04                  mov dword ptr [edx+04], ecx
:0044BC41 8B45F8                  mov eax, dword ptr [ebp-08]
:0044BC44 894208                  mov dword ptr [edx+08], eax
:0044BC47 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044BC4A 894A0C                  mov dword ptr [edx+0C], ecx
:0044BC4D E8A630FDFF              call 0041ECF8
:0044BC52 83C424                  add esp, 00000024
:0044BC55 6A01                    push 00000001
:0044BC57 8B55EC                  mov edx, dword ptr [ebp-14]
:0044BC5A 52                      push edx
:0044BC5B 6A15                    push 00000015
:0044BC5D 6A01                    push 00000001
:0044BC5F 8B45DC                  mov eax, dword ptr [ebp-24]
:0044BC62 50                      push eax
:0044BC63 83EC10                  sub esp, 00000010
:0044BC66 8BCC                    mov ecx, esp
:0044BC68 8B55F0                  mov edx, dword ptr [ebp-10]
:0044BC6B 8911                    mov dword ptr [ecx], edx
:0044BC6D 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044BC70 894104                  mov dword ptr [ecx+04], eax
:0044BC73 8B55F8                  mov edx, dword ptr [ebp-08]
:0044BC76 895108                  mov dword ptr [ecx+08], edx
:0044BC79 8B45FC                  mov eax, dword ptr [ebp-04]
:0044BC7C 89410C                  mov dword ptr [ecx+0C], eax
:0044BC7F E87430FDFF              call 0041ECF8
:0044BC84 83C424                  add esp, 00000024
:0044BC87 6A00                    push 00000000
:0044BC89 6A12                    push 00000012
:0044BC8B 6A04                    push 00000004
:0044BC8D E8A7150300              call 0047D239
:0044BC92 83C40C                  add esp, 0000000C
:0044BC95 6A00                    push 00000000
:0044BC97 6A00                    push 00000000
:0044BC99 6A01                    push 00000001
:0044BC9B 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0044BC9E 51                      push ecx
:0044BC9F 8B55DC                  mov edx, dword ptr [ebp-24]
:0044BCA2 52                      push edx
:0044BCA3 8B45DC                  mov eax, dword ptr [ebp-24]
:0044BCA6 99                      cdq
:0044BCA7 2BC2                    sub eax, edx
:0044BCA9 D1F8                    sar eax, 1
:0044BCAB 50                      push eax
:0044BCAC 8D45F0                  lea eax, dword ptr [ebp-10]
:0044BCAF 50                      push eax
:0044BCB0 E8FF2CFDFF              call 0041E9B4
:0044BCB5 83C41C                  add esp, 0000001C
:0044BCB8 E83929FDFF              call 0041E5F6
:0044BCBD 6A14                    push 00000014
:0044BCBF B9181B4B00              mov ecx, 004B1B18
:0044BCC4 E87776FBFF              call 00403340
:0044BCC9 E81208FEFF              call 0042C4E0
:0044BCCE B950424B00              mov ecx, 004B4250
:0044BCD3 E8D3600000              call 00451DAB
:0044BCD8 C645E000                mov [ebp-20], 00
:0044BCDC EB09                    jmp 0044BCE7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044BD17(U)
|
:0044BCDE 8A4DE0                  mov cl, byte ptr [ebp-20]
:0044BCE1 80C101                  add cl, 01
:0044BCE4 884DE0                  mov byte ptr [ebp-20], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044BCDC(U)
|
:0044BCE7 8B55E0                  mov edx, dword ptr [ebp-20]
:0044BCEA 81E2FF000000            and edx, 000000FF
:0044BCF0 8B45E4                  mov eax, dword ptr [ebp-1C]
:0044BCF3 25FF000000              and eax, 000000FF
:0044BCF8 3BD0                    cmp edx, eax
:0044BCFA 7D1D                    jge 0044BD19
:0044BCFC E8C32D0300              call 0047EAC4
:0044BD01 6A01                    push 00000001
:0044BD03 8A4DE8                  mov cl, byte ptr [ebp-18]
:0044BD06 51                      push ecx
:0044BD07 8A55E0                  mov dl, byte ptr [ebp-20]
:0044BD0A 52                      push edx
:0044BD0B 6A00                    push 00000000
:0044BD0D B950424B00              mov ecx, 004B4250
:0044BD12 E8317E0000              call 00453B48
:0044BD17 EBC5                    jmp 0044BCDE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044BCFA(C)
|
:0044BD19 B950424B00              mov ecx, 004B4250
:0044BD1E E8F07D0000              call 00453B13
:0044BD23 8BE5                    mov esp, ebp
:0044BD25 5D                      pop ebp
:0044BD26 C3                      ret



* Referenced by a CALL at Address:
|:00413C48   
|
:0044BD27 55                      push ebp
:0044BD28 8BEC                    mov ebp, esp
:0044BD2A 83EC4C                  sub esp, 0000004C
:0044BD2D 894DB4                  mov dword ptr [ebp-4C], ecx
:0044BD30 B950424B00              mov ecx, 004B4250
:0044BD35 E80AA10000              call 00455E44
:0044BD3A 99                      cdq
:0044BD3B B930000000              mov ecx, 00000030
:0044BD40 F7F9                    idiv ecx
:0044BD42 8845EC                  mov byte ptr [ebp-14], al
:0044BD45 B950424B00              mov ecx, 004B4250
:0044BD4A E81CA10000              call 00455E6B
:0044BD4F 99                      cdq
:0044BD50 B930000000              mov ecx, 00000030
:0044BD55 F7F9                    idiv ecx
:0044BD57 8845E8                  mov byte ptr [ebp-18], al

* Possible StringData Ref from Data Obj ->"ʤ"
                                  |
:0044BD5A C745C0D4E14800          mov [ebp-40], 0048E1D4
:0044BD61 6A1F                    push 0000001F
:0044BD63 B950424B00              mov ecx, 004B4250
:0044BD68 E87D5F0000              call 00451CEA
:0044BD6D C645E400                mov [ebp-1C], 00
:0044BD71 EB09                    jmp 0044BD7C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044BDAC(U)
|
:0044BD73 8A55E4                  mov dl, byte ptr [ebp-1C]
:0044BD76 80C201                  add dl, 01
:0044BD79 8855E4                  mov byte ptr [ebp-1C], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044BD71(U)
|
:0044BD7C 8B45E4                  mov eax, dword ptr [ebp-1C]
:0044BD7F 25FF000000              and eax, 000000FF
:0044BD84 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0044BD87 81E1FF000000            and ecx, 000000FF
:0044BD8D 3BC1                    cmp eax, ecx
:0044BD8F 7D1D                    jge 0044BDAE
:0044BD91 E82E2D0300              call 0047EAC4
:0044BD96 6A01                    push 00000001
:0044BD98 8A55EC                  mov dl, byte ptr [ebp-14]
:0044BD9B 52                      push edx
:0044BD9C 8A45E4                  mov al, byte ptr [ebp-1C]
:0044BD9F 50                      push eax
:0044BDA0 6A00                    push 00000000
:0044BDA2 B950424B00              mov ecx, 004B4250
:0044BDA7 E89C7D0000              call 00453B48
:0044BDAC EBC5                    jmp 0044BD73

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044BD8F(C)
|
:0044BDAE 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0044BDB1 81E1FF000000            and ecx, 000000FF
:0044BDB7 6BC930                  imul ecx, 00000030
:0044BDBA 81F9C0030000            cmp ecx, 000003C0
:0044BDC0 7C10                    jl 0044BDD2
:0044BDC2 C745BC40000000          mov [ebp-44], 00000040
:0044BDC9 C745B802000000          mov [ebp-48], 00000002
:0044BDD0 EB32                    jmp 0044BE04

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044BDC0(C)
|
:0044BDD2 8B55EC                  mov edx, dword ptr [ebp-14]
:0044BDD5 81E2FF000000            and edx, 000000FF
:0044BDDB 6BD230                  imul edx, 00000030
:0044BDDE 81FAD0020000            cmp edx, 000002D0
:0044BDE4 7C10                    jl 0044BDF6
:0044BDE6 C745BC30000000          mov [ebp-44], 00000030
:0044BDED C745B802000000          mov [ebp-48], 00000002
:0044BDF4 EB0E                    jmp 0044BE04

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044BDE4(C)
|
:0044BDF6 C745BC20000000          mov [ebp-44], 00000020
:0044BDFD C745B801000000          mov [ebp-48], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044BDD0(U), :0044BDF4(U)
|
:0044BE04 8D45F0                  lea eax, dword ptr [ebp-10]
:0044BE07 50                      push eax
:0044BE08 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:0044BE0E 51                      push ecx
:0044BE0F FF15EC624800            call dword ptr [004862EC]
:0044BE15 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044BE18 83C248                  add edx, 00000048
:0044BE1B 8955F4                  mov dword ptr [ebp-0C], edx
:0044BE1E 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044BE21 0345BC                  add eax, dword ptr [ebp-44]
:0044BE24 8945FC                  mov dword ptr [ebp-04], eax
:0044BE27 E8AF27FDFF              call 0041E5DB
:0044BE2C 6A00                    push 00000000
:0044BE2E 8B4DC0                  mov ecx, dword ptr [ebp-40]
:0044BE31 51                      push ecx
:0044BE32 6A2A                    push 0000002A
:0044BE34 6A02                    push 00000002
:0044BE36 8B55BC                  mov edx, dword ptr [ebp-44]
:0044BE39 52                      push edx
:0044BE3A 83EC10                  sub esp, 00000010
:0044BE3D 8BC4                    mov eax, esp
:0044BE3F 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044BE42 8908                    mov dword ptr [eax], ecx
:0044BE44 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044BE47 895004                  mov dword ptr [eax+04], edx
:0044BE4A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044BE4D 894808                  mov dword ptr [eax+08], ecx
:0044BE50 8B55FC                  mov edx, dword ptr [ebp-04]
:0044BE53 89500C                  mov dword ptr [eax+0C], edx
:0044BE56 E89D2EFDFF              call 0041ECF8
:0044BE5B 83C424                  add esp, 00000024
:0044BE5E 6A00                    push 00000000
:0044BE60 8B45C0                  mov eax, dword ptr [ebp-40]
:0044BE63 50                      push eax
:0044BE64 6A28                    push 00000028
:0044BE66 6A01                    push 00000001
:0044BE68 8B4DBC                  mov ecx, dword ptr [ebp-44]
:0044BE6B 51                      push ecx
:0044BE6C 83EC10                  sub esp, 00000010
:0044BE6F 8BD4                    mov edx, esp
:0044BE71 8B45F0                  mov eax, dword ptr [ebp-10]
:0044BE74 8902                    mov dword ptr [edx], eax
:0044BE76 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044BE79 894A04                  mov dword ptr [edx+04], ecx
:0044BE7C 8B45F8                  mov eax, dword ptr [ebp-08]
:0044BE7F 894208                  mov dword ptr [edx+08], eax
:0044BE82 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044BE85 894A0C                  mov dword ptr [edx+0C], ecx
:0044BE88 E86B2EFDFF              call 0041ECF8
:0044BE8D 83C424                  add esp, 00000024
:0044BE90 6A00                    push 00000000
:0044BE92 6A12                    push 00000012
:0044BE94 6A04                    push 00000004
:0044BE96 E89E130300              call 0047D239
:0044BE9B 83C40C                  add esp, 0000000C
:0044BE9E 6A00                    push 00000000
:0044BEA0 6A00                    push 00000000
:0044BEA2 6A00                    push 00000000
:0044BEA4 8B55C0                  mov edx, dword ptr [ebp-40]
:0044BEA7 52                      push edx
:0044BEA8 8B45BC                  mov eax, dword ptr [ebp-44]
:0044BEAB 50                      push eax
:0044BEAC 8B45BC                  mov eax, dword ptr [ebp-44]
:0044BEAF 99                      cdq
:0044BEB0 2BC2                    sub eax, edx
:0044BEB2 D1F8                    sar eax, 1
:0044BEB4 50                      push eax
:0044BEB5 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0044BEB8 51                      push ecx
:0044BEB9 E8F62AFDFF              call 0041E9B4
:0044BEBE 83C41C                  add esp, 0000001C
:0044BEC1 E83027FDFF              call 0041E5F6
:0044BEC6 6A14                    push 00000014
:0044BEC8 B9181B4B00              mov ecx, 004B1B18
:0044BECD E86E74FBFF              call 00403340
:0044BED2 E80906FEFF              call 0042C4E0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C039(U)
|
:0044BED7 8B5508                  mov edx, dword ptr [ebp+08]
:0044BEDA 33C0                    xor eax, eax
:0044BEDC 8A02                    mov al, byte ptr [edx]
:0044BEDE 85C0                    test eax, eax
:0044BEE0 0F8458010000            je 0044C03E
:0044BEE6 C645E400                mov [ebp-1C], 00
:0044BEEA EB09                    jmp 0044BEF5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044BF5F(U)
|
:0044BEEC 8A4DE4                  mov cl, byte ptr [ebp-1C]
:0044BEEF 80C101                  add cl, 01
:0044BEF2 884DE4                  mov byte ptr [ebp-1C], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044BEEA(U)
|
:0044BEF5 8B55E4                  mov edx, dword ptr [ebp-1C]
:0044BEF8 81E2FF000000            and edx, 000000FF
:0044BEFE 83FA1E                  cmp edx, 0000001E
:0044BF01 7D5E                    jge 0044BF61
:0044BF03 8B45E4                  mov eax, dword ptr [ebp-1C]
:0044BF06 25FF000000              and eax, 000000FF
:0044BF0B 83F802                  cmp eax, 00000002
:0044BF0E 7D10                    jge 0044BF20
:0044BF10 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0044BF13 81E1FF000000            and ecx, 000000FF
:0044BF19 C6440DC420              mov [ebp+ecx-3C], 20
:0044BF1E EB3F                    jmp 0044BF5F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044BF0E(C)
|
:0044BF20 8B5508                  mov edx, dword ptr [ebp+08]
:0044BF23 33C0                    xor eax, eax
:0044BF25 8A02                    mov al, byte ptr [edx]
:0044BF27 85C0                    test eax, eax
:0044BF29 7502                    jne 0044BF2D
:0044BF2B EB34                    jmp 0044BF61

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044BF29(C)
|
:0044BF2D 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044BF30 33D2                    xor edx, edx
:0044BF32 8A11                    mov dl, byte ptr [ecx]
:0044BF34 83FA0A                  cmp edx, 0000000A
:0044BF37 750B                    jne 0044BF44
:0044BF39 8B4508                  mov eax, dword ptr [ebp+08]
:0044BF3C 83C001                  add eax, 00000001
:0044BF3F 894508                  mov dword ptr [ebp+08], eax
:0044BF42 EB1D                    jmp 0044BF61

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044BF37(C)
|
:0044BF44 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0044BF47 81E1FF000000            and ecx, 000000FF
:0044BF4D 8B5508                  mov edx, dword ptr [ebp+08]
:0044BF50 8A02                    mov al, byte ptr [edx]
:0044BF52 88440DC4                mov byte ptr [ebp+ecx-3C], al
:0044BF56 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044BF59 83C101                  add ecx, 00000001
:0044BF5C 894D08                  mov dword ptr [ebp+08], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044BF1E(U)
|
:0044BF5F EB8B                    jmp 0044BEEC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044BF01(C), :0044BF2B(U), :0044BF42(U)
|
:0044BF61 8B55E4                  mov edx, dword ptr [ebp-1C]
:0044BF64 81E2FF000000            and edx, 000000FF
:0044BF6A C64415C400              mov [ebp+edx-3C], 00
:0044BF6F 8B45BC                  mov eax, dword ptr [ebp-44]
:0044BF72 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044BF75 8D540110                lea edx, dword ptr [ecx+eax+10]
:0044BF79 8955F4                  mov dword ptr [ebp-0C], edx
:0044BF7C 8B45BC                  mov eax, dword ptr [ebp-44]
:0044BF7F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044BF82 8D540110                lea edx, dword ptr [ecx+eax+10]
:0044BF86 8955FC                  mov dword ptr [ebp-04], edx
:0044BF89 E84D26FDFF              call 0041E5DB
:0044BF8E 6A00                    push 00000000
:0044BF90 8D45C4                  lea eax, dword ptr [ebp-3C]
:0044BF93 50                      push eax
:0044BF94 6A18                    push 00000018
:0044BF96 6A02                    push 00000002
:0044BF98 8B4DBC                  mov ecx, dword ptr [ebp-44]
:0044BF9B 51                      push ecx
:0044BF9C 83EC10                  sub esp, 00000010
:0044BF9F 8BD4                    mov edx, esp
:0044BFA1 8B45F0                  mov eax, dword ptr [ebp-10]
:0044BFA4 8902                    mov dword ptr [edx], eax
:0044BFA6 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044BFA9 894A04                  mov dword ptr [edx+04], ecx
:0044BFAC 8B45F8                  mov eax, dword ptr [ebp-08]
:0044BFAF 894208                  mov dword ptr [edx+08], eax
:0044BFB2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044BFB5 894A0C                  mov dword ptr [edx+0C], ecx
:0044BFB8 E83B2DFDFF              call 0041ECF8
:0044BFBD 83C424                  add esp, 00000024
:0044BFC0 6A00                    push 00000000
:0044BFC2 8D55C4                  lea edx, dword ptr [ebp-3C]
:0044BFC5 52                      push edx
:0044BFC6 6A15                    push 00000015
:0044BFC8 6A01                    push 00000001
:0044BFCA 8B45BC                  mov eax, dword ptr [ebp-44]
:0044BFCD 50                      push eax
:0044BFCE 83EC10                  sub esp, 00000010
:0044BFD1 8BCC                    mov ecx, esp
:0044BFD3 8B55F0                  mov edx, dword ptr [ebp-10]
:0044BFD6 8911                    mov dword ptr [ecx], edx
:0044BFD8 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044BFDB 894104                  mov dword ptr [ecx+04], eax
:0044BFDE 8B55F8                  mov edx, dword ptr [ebp-08]
:0044BFE1 895108                  mov dword ptr [ecx+08], edx
:0044BFE4 8B45FC                  mov eax, dword ptr [ebp-04]
:0044BFE7 89410C                  mov dword ptr [ecx+0C], eax
:0044BFEA E8092DFDFF              call 0041ECF8
:0044BFEF 83C424                  add esp, 00000024
:0044BFF2 6A00                    push 00000000
:0044BFF4 6A12                    push 00000012
:0044BFF6 6A04                    push 00000004
:0044BFF8 E83C120300              call 0047D239
:0044BFFD 83C40C                  add esp, 0000000C
:0044C000 6A00                    push 00000000
:0044C002 6A00                    push 00000000
:0044C004 6A00                    push 00000000
:0044C006 8D4DC4                  lea ecx, dword ptr [ebp-3C]
:0044C009 51                      push ecx
:0044C00A 8B55BC                  mov edx, dword ptr [ebp-44]
:0044C00D 52                      push edx
:0044C00E 8B45BC                  mov eax, dword ptr [ebp-44]
:0044C011 99                      cdq
:0044C012 2BC2                    sub eax, edx
:0044C014 D1F8                    sar eax, 1
:0044C016 50                      push eax
:0044C017 8D45F0                  lea eax, dword ptr [ebp-10]
:0044C01A 50                      push eax
:0044C01B E89429FDFF              call 0041E9B4
:0044C020 83C41C                  add esp, 0000001C
:0044C023 E8CE25FDFF              call 0041E5F6
:0044C028 6A14                    push 00000014
:0044C02A B9181B4B00              mov ecx, 004B1B18
:0044C02F E80C73FBFF              call 00403340
:0044C034 E8A704FEFF              call 0042C4E0
:0044C039 E999FEFFFF              jmp 0044BED7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044BEE0(C)
|
:0044C03E 8B4DBC                  mov ecx, dword ptr [ebp-44]
:0044C041 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044C044 8D440A40                lea eax, dword ptr [edx+ecx+40]
:0044C048 8945F4                  mov dword ptr [ebp-0C], eax
:0044C04B 8B4DBC                  mov ecx, dword ptr [ebp-44]
:0044C04E 8B55FC                  mov edx, dword ptr [ebp-04]
:0044C051 8D440A40                lea eax, dword ptr [edx+ecx+40]
:0044C055 8945FC                  mov dword ptr [ebp-04], eax
:0044C058 8B4DB4                  mov ecx, dword ptr [ebp-4C]
:0044C05B 33D2                    xor edx, edx
:0044C05D 8A5103                  mov dl, byte ptr [ecx+03]
:0044C060 52                      push edx

* Possible StringData Ref from Data Obj ->"ƻغ%3u"
                                  |
:0044C061 68E0E14800              push 0048E1E0
:0044C066 8D45C4                  lea eax, dword ptr [ebp-3C]
:0044C069 50                      push eax
:0044C06A FF15C0624800            call dword ptr [004862C0]
:0044C070 83C40C                  add esp, 0000000C
:0044C073 E86325FDFF              call 0041E5DB
:0044C078 6A00                    push 00000000
:0044C07A 8D4DC4                  lea ecx, dword ptr [ebp-3C]
:0044C07D 51                      push ecx
:0044C07E 6A1F                    push 0000001F
:0044C080 6A02                    push 00000002
:0044C082 8B55BC                  mov edx, dword ptr [ebp-44]
:0044C085 52                      push edx
:0044C086 83EC10                  sub esp, 00000010
:0044C089 8BC4                    mov eax, esp
:0044C08B 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044C08E 8908                    mov dword ptr [eax], ecx
:0044C090 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044C093 895004                  mov dword ptr [eax+04], edx
:0044C096 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044C099 894808                  mov dword ptr [eax+08], ecx
:0044C09C 8B55FC                  mov edx, dword ptr [ebp-04]
:0044C09F 89500C                  mov dword ptr [eax+0C], edx
:0044C0A2 E8512CFDFF              call 0041ECF8
:0044C0A7 83C424                  add esp, 00000024
:0044C0AA 6A00                    push 00000000
:0044C0AC 8D45C4                  lea eax, dword ptr [ebp-3C]
:0044C0AF 50                      push eax
:0044C0B0 6A18                    push 00000018
:0044C0B2 6A01                    push 00000001
:0044C0B4 8B4DBC                  mov ecx, dword ptr [ebp-44]
:0044C0B7 51                      push ecx
:0044C0B8 83EC10                  sub esp, 00000010
:0044C0BB 8BD4                    mov edx, esp
:0044C0BD 8B45F0                  mov eax, dword ptr [ebp-10]
:0044C0C0 8902                    mov dword ptr [edx], eax
:0044C0C2 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044C0C5 894A04                  mov dword ptr [edx+04], ecx
:0044C0C8 8B45F8                  mov eax, dword ptr [ebp-08]
:0044C0CB 894208                  mov dword ptr [edx+08], eax
:0044C0CE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044C0D1 894A0C                  mov dword ptr [edx+0C], ecx
:0044C0D4 E81F2CFDFF              call 0041ECF8
:0044C0D9 83C424                  add esp, 00000024
:0044C0DC 6A00                    push 00000000
:0044C0DE 6A12                    push 00000012
:0044C0E0 6A04                    push 00000004
:0044C0E2 E852110300              call 0047D239
:0044C0E7 83C40C                  add esp, 0000000C
:0044C0EA 6A00                    push 00000000
:0044C0EC 6A00                    push 00000000
:0044C0EE 6A00                    push 00000000
:0044C0F0 8D55C4                  lea edx, dword ptr [ebp-3C]
:0044C0F3 52                      push edx
:0044C0F4 8B45BC                  mov eax, dword ptr [ebp-44]
:0044C0F7 50                      push eax
:0044C0F8 8B45BC                  mov eax, dword ptr [ebp-44]
:0044C0FB 99                      cdq
:0044C0FC 2BC2                    sub eax, edx
:0044C0FE D1F8                    sar eax, 1
:0044C100 50                      push eax
:0044C101 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0044C104 51                      push ecx
:0044C105 E8AA28FDFF              call 0041E9B4
:0044C10A 83C41C                  add esp, 0000001C
:0044C10D E8E424FDFF              call 0041E5F6
:0044C112 6A14                    push 00000014
:0044C114 B9181B4B00              mov ecx, 004B1B18
:0044C119 E82272FBFF              call 00403340
:0044C11E E8BD03FEFF              call 0042C4E0
:0044C123 6A14                    push 00000014
:0044C125 E81C05FEFF              call 0042C646
:0044C12A 83C404                  add esp, 00000004
:0044C12D B950424B00              mov ecx, 004B4250
:0044C132 E8745C0000              call 00451DAB
:0044C137 C645E400                mov [ebp-1C], 00
:0044C13B EB09                    jmp 0044C146

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C176(U)
|
:0044C13D 8A55E4                  mov dl, byte ptr [ebp-1C]
:0044C140 80C201                  add dl, 01
:0044C143 8855E4                  mov byte ptr [ebp-1C], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C13B(U)
|
:0044C146 8B45E4                  mov eax, dword ptr [ebp-1C]
:0044C149 25FF000000              and eax, 000000FF
:0044C14E 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0044C151 81E1FF000000            and ecx, 000000FF
:0044C157 3BC1                    cmp eax, ecx
:0044C159 7D1D                    jge 0044C178
:0044C15B E864290300              call 0047EAC4
:0044C160 6A01                    push 00000001
:0044C162 8A55EC                  mov dl, byte ptr [ebp-14]
:0044C165 52                      push edx
:0044C166 8A45E4                  mov al, byte ptr [ebp-1C]
:0044C169 50                      push eax
:0044C16A 6A00                    push 00000000
:0044C16C B950424B00              mov ecx, 004B4250
:0044C171 E8D2790000              call 00453B48
:0044C176 EBC5                    jmp 0044C13D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C159(C)
|
:0044C178 B950424B00              mov ecx, 004B4250
:0044C17D E891790000              call 00453B13
:0044C182 8BE5                    mov esp, ebp
:0044C184 5D                      pop ebp
:0044C185 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0044D2B0   , :0044D7A9   
|
:0044C188 55                      push ebp
:0044C189 8BEC                    mov ebp, esp
:0044C18B 51                      push ecx
:0044C18C 894DFC                  mov dword ptr [ebp-04], ecx
:0044C18F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044C192 E834000000              call 0044C1CB
:0044C197 68FF000000              push 000000FF
:0044C19C 6840060000              push 00000640
:0044C1A1 6A04                    push 00000004
:0044C1A3 6A00                    push 00000000
:0044C1A5 68401F0000              push 00001F40
:0044C1AA B938EB4A00              mov ecx, 004AEB38
:0044C1AF E88C380300              call 0047FA40
:0044C1B4 50                      push eax
:0044C1B5 E8593B0300              call 0047FD13
:0044C1BA 83C40C                  add esp, 0000000C
:0044C1BD B9F05D4B00              mov ecx, 004B5DF0
:0044C1C2 E81FAC0000              call 00456DE6
:0044C1C7 8BE5                    mov esp, ebp
:0044C1C9 5D                      pop ebp
:0044C1CA C3                      ret



* Referenced by a CALL at Address:
|:0044C192   
|
:0044C1CB 55                      push ebp
:0044C1CC 8BEC                    mov ebp, esp
:0044C1CE 6AFF                    push FFFFFFFF
:0044C1D0 682A564800              push 0048562A
:0044C1D5 64A100000000            mov eax, dword ptr fs:[00000000]
:0044C1DB 50                      push eax
:0044C1DC 64892500000000          mov dword ptr fs:[00000000], esp
:0044C1E3 81EC08010000            sub esp, 00000108
:0044C1E9 898DECFEFFFF            mov dword ptr [ebp+FFFFFEEC], ecx
:0044C1EF 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0044C1F5 E8B670FBFF              call 004032B0
:0044C1FA C745FC00000000          mov [ebp-04], 00000000

* Possible StringData Ref from Data Obj ->"HEXZMAP.E5"
                                  |
:0044C201 6898BB4800              push 0048BB98
:0044C206 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0044C20C E82439FDFF              call 0041FB35
:0044C211 B9C8E44A00              mov ecx, 004AE4C8
:0044C216 E8751EFCFF              call 0040E090
:0044C21B 50                      push eax
:0044C21C 8B85ECFEFFFF            mov eax, dword ptr [ebp+FFFFFEEC]
:0044C222 33C9                    xor ecx, ecx
:0044C224 8A08                    mov cl, byte ptr [eax]
:0044C226 51                      push ecx
:0044C227 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0044C22D E8573AFDFF              call 0041FC89
:0044C232 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0044C238 E888D0FCFF              call 004192C5
:0044C23D 6A04                    push 00000004
:0044C23F 6A00                    push 00000000
:0044C241 6A00                    push 00000000
:0044C243 B9C8E44A00              mov ecx, 004AE4C8
:0044C248 E8F3370300              call 0047FA40
:0044C24D 33D2                    xor edx, edx
:0044C24F 8A10                    mov dl, byte ptr [eax]
:0044C251 8BC2                    mov eax, edx
:0044C253 99                      cdq
:0044C254 B903000000              mov ecx, 00000003
:0044C259 F7F9                    idiv ecx
:0044C25B A22C424B00              mov byte ptr [004B422C], al
:0044C260 6A04                    push 00000004
:0044C262 6A00                    push 00000000
:0044C264 6A01                    push 00000001
:0044C266 B9C8E44A00              mov ecx, 004AE4C8
:0044C26B E8D0370300              call 0047FA40
:0044C270 33D2                    xor edx, edx
:0044C272 8A10                    mov dl, byte ptr [eax]
:0044C274 8BC2                    mov eax, edx
:0044C276 99                      cdq
:0044C277 B903000000              mov ecx, 00000003
:0044C27C F7F9                    idiv ecx
:0044C27E A22D424B00              mov byte ptr [004B422D], al
:0044C283 33D2                    xor edx, edx
:0044C285 8A152C424B00            mov dl, byte ptr [004B422C]
:0044C28B 33C0                    xor eax, eax
:0044C28D A02D424B00              mov al, byte ptr [004B422D]
:0044C292 0FAFD0                  imul edx, eax
:0044C295 52                      push edx
:0044C296 6A04                    push 00000004
:0044C298 6A00                    push 00000000
:0044C29A 6840060000              push 00000640
:0044C29F B938EB4A00              mov ecx, 004AEB38
:0044C2A4 E897370300              call 0047FA40
:0044C2A9 50                      push eax
:0044C2AA 6A04                    push 00000004
:0044C2AC 6A00                    push 00000000
:0044C2AE 6A02                    push 00000002
:0044C2B0 B9C8E44A00              mov ecx, 004AE4C8
:0044C2B5 E886370300              call 0047FA40
:0044C2BA 50                      push eax
:0044C2BB E83D3A0300              call 0047FCFD
:0044C2C0 83C40C                  add esp, 0000000C
:0044C2C3 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0044C2CA 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0044C2D0 E8FB6FFBFF              call 004032D0
:0044C2D5 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044C2D8 64890D00000000          mov dword ptr fs:[00000000], ecx
:0044C2DF 8BE5                    mov esp, ebp
:0044C2E1 5D                      pop ebp
:0044C2E2 C3                      ret



* Referenced by a CALL at Addresses:
|:0044D29A   , :0044D6E9   
|
:0044C2E3 55                      push ebp
:0044C2E4 8BEC                    mov ebp, esp
:0044C2E6 83EC0C                  sub esp, 0000000C
:0044C2E9 894DF4                  mov dword ptr [ebp-0C], ecx

* Possible StringData Ref from Data Obj ->"HM00.E5"
                                  |
:0044C2EC C745F8F0E14800          mov [ebp-08], 0048E1F0
:0044C2F3 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044C2F6 8A4D08                  mov cl, byte ptr [ebp+08]
:0044C2F9 8808                    mov byte ptr [eax], cl
:0044C2FB 8B55F8                  mov edx, dword ptr [ebp-08]
:0044C2FE 83C202                  add edx, 00000002
:0044C301 8955FC                  mov dword ptr [ebp-04], edx
:0044C304 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044C307 33C9                    xor ecx, ecx
:0044C309 8A08                    mov cl, byte ptr [eax]
:0044C30B 8BC1                    mov eax, ecx
:0044C30D 99                      cdq
:0044C30E B90A000000              mov ecx, 0000000A
:0044C313 F7F9                    idiv ecx
:0044C315 83C030                  add eax, 00000030
:0044C318 8B55FC                  mov edx, dword ptr [ebp-04]
:0044C31B 8802                    mov byte ptr [edx], al
:0044C31D 8B45FC                  mov eax, dword ptr [ebp-04]
:0044C320 83C001                  add eax, 00000001
:0044C323 8945FC                  mov dword ptr [ebp-04], eax
:0044C326 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044C329 33C0                    xor eax, eax
:0044C32B 8A01                    mov al, byte ptr [ecx]
:0044C32D 99                      cdq
:0044C32E B90A000000              mov ecx, 0000000A
:0044C333 F7F9                    idiv ecx
:0044C335 83C230                  add edx, 00000030
:0044C338 8B45FC                  mov eax, dword ptr [ebp-04]
:0044C33B 8810                    mov byte ptr [eax], dl
:0044C33D B9A8E44A00              mov ecx, 004AE4A8
:0044C342 E8491DFCFF              call 0040E090
:0044C347 50                      push eax
:0044C348 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044C34B 51                      push ecx
:0044C34C B958754B00              mov ecx, 004B7558
:0044C351 E85E020300              call 0047C5B4
:0044C356 8B5508                  mov edx, dword ptr [ebp+08]
:0044C359 81E2FF000000            and edx, 000000FF
:0044C35F 8915ECBA4800            mov dword ptr [0048BAEC], edx
:0044C365 8BE5                    mov esp, ebp
:0044C367 5D                      pop ebp
:0044C368 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0044D2A5   , :0044D82F   
|
:0044C36B 55                      push ebp
:0044C36C 8BEC                    mov ebp, esp
:0044C36E 51                      push ecx
:0044C36F 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C385(U)
|
:0044C372 B958754B00              mov ecx, 004B7558
:0044C377 E8A5010300              call 0047C521
:0044C37C 85C0                    test eax, eax
:0044C37E 7507                    jne 0044C387
:0044C380 E83F270300              call 0047EAC4
:0044C385 EBEB                    jmp 0044C372

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C37E(C)
|
:0044C387 8BE5                    mov esp, ebp
:0044C389 5D                      pop ebp
:0044C38A C3                      ret



* Referenced by a CALL at Addresses:
|:0044D368   , :0044D9C5   , :0044E197   
|
:0044C38B 55                      push ebp
:0044C38C 8BEC                    mov ebp, esp
:0044C38E 83EC10                  sub esp, 00000010
:0044C391 894DF0                  mov dword ptr [ebp-10], ecx
:0044C394 C745FC00000000          mov [ebp-04], 00000000
:0044C39B 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0044C39E E86D330100              call 0045F710
:0044C3A3 C645F900                mov [ebp-07], 00
:0044C3A7 8A45F9                  mov al, byte ptr [ebp-07]
:0044C3AA 8845F8                  mov byte ptr [ebp-08], al
:0044C3AD C645F400                mov [ebp-0C], 00
:0044C3B1 EB09                    jmp 0044C3BC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C418(U)
|
:0044C3B3 8A4DF4                  mov cl, byte ptr [ebp-0C]
:0044C3B6 80C101                  add cl, 01
:0044C3B9 884DF4                  mov byte ptr [ebp-0C], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C3B1(U)
|
:0044C3BC 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044C3BF 81E2FF000000            and edx, 000000FF
:0044C3C5 83FA0F                  cmp edx, 0000000F
:0044C3C8 7D50                    jge 0044C41A
:0044C3CA 837DFC00                cmp dword ptr [ebp-04], 00000000
:0044C3CE 754A                    jne 0044C41A
:0044C3D0 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044C3D3 81E1FF000000            and ecx, 000000FF
:0044C3D9 6BC924                  imul ecx, 00000024
:0044C3DC 81C1502C4B00            add ecx, 004B2C50
:0044C3E2 E8A9C8FCFF              call 00418C90
:0044C3E7 25FF000000              and eax, 000000FF
:0044C3EC 83F802                  cmp eax, 00000002
:0044C3EF 7527                    jne 0044C418
:0044C3F1 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044C3F4 81E1FF000000            and ecx, 000000FF
:0044C3FA 6BC924                  imul ecx, 00000024
:0044C3FD 81C1502C4B00            add ecx, 004B2C50
:0044C403 E8586FFBFF              call 00403360
:0044C408 50                      push eax
:0044C409 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0044C40C E88FA1FBFF              call 004065A0
:0044C411 C745FC01000000          mov [ebp-04], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C3EF(C)
|
:0044C418 EB99                    jmp 0044C3B3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044C3C8(C), :0044C3CE(C)
|
:0044C41A 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0044C41E 0F84E7000000            je 0044C50B
:0044C424 837DFC00                cmp dword ptr [ebp-04], 00000000
:0044C428 0F85DD000000            jne 0044C50B
:0044C42E C645F40F                mov [ebp-0C], 0F
:0044C432 EB08                    jmp 0044C43C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C498(U)
|
:0044C434 8A45F4                  mov al, byte ptr [ebp-0C]
:0044C437 0401                    add al, 01
:0044C439 8845F4                  mov byte ptr [ebp-0C], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C432(U)
|
:0044C43C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044C43F 81E1FF000000            and ecx, 000000FF
:0044C445 83F923                  cmp ecx, 00000023
:0044C448 7D50                    jge 0044C49A
:0044C44A 837DFC00                cmp dword ptr [ebp-04], 00000000
:0044C44E 754A                    jne 0044C49A
:0044C450 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044C453 81E1FF000000            and ecx, 000000FF
:0044C459 6BC924                  imul ecx, 00000024
:0044C45C 81C1502C4B00            add ecx, 004B2C50
:0044C462 E829C8FCFF              call 00418C90
:0044C467 25FF000000              and eax, 000000FF
:0044C46C 83F802                  cmp eax, 00000002
:0044C46F 7527                    jne 0044C498
:0044C471 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044C474 81E1FF000000            and ecx, 000000FF
:0044C47A 6BC924                  imul ecx, 00000024
:0044C47D 81C1502C4B00            add ecx, 004B2C50
:0044C483 E8D86EFBFF              call 00403360
:0044C488 50                      push eax
:0044C489 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0044C48C E80FA1FBFF              call 004065A0
:0044C491 C745FC01000000          mov [ebp-04], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C46F(C)
|
:0044C498 EB9A                    jmp 0044C434

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044C448(C), :0044C44E(C)
|
:0044C49A C645F423                mov [ebp-0C], 23
:0044C49E EB09                    jmp 0044C4A9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C504(U)
|
:0044C4A0 8A55F4                  mov dl, byte ptr [ebp-0C]
:0044C4A3 80C201                  add dl, 01
:0044C4A6 8855F4                  mov byte ptr [ebp-0C], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C49E(U)
|
:0044C4A9 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044C4AC 25FF000000              and eax, 000000FF
:0044C4B1 83F873                  cmp eax, 00000073
:0044C4B4 7D50                    jge 0044C506
:0044C4B6 837DFC00                cmp dword ptr [ebp-04], 00000000
:0044C4BA 754A                    jne 0044C506
:0044C4BC 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044C4BF 81E1FF000000            and ecx, 000000FF
:0044C4C5 6BC924                  imul ecx, 00000024
:0044C4C8 81C1502C4B00            add ecx, 004B2C50
:0044C4CE E8BDC7FCFF              call 00418C90
:0044C4D3 25FF000000              and eax, 000000FF
:0044C4D8 83F802                  cmp eax, 00000002
:0044C4DB 7527                    jne 0044C504
:0044C4DD 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044C4E0 81E1FF000000            and ecx, 000000FF
:0044C4E6 6BC924                  imul ecx, 00000024
:0044C4E9 81C1502C4B00            add ecx, 004B2C50
:0044C4EF E86C6EFBFF              call 00403360
:0044C4F4 50                      push eax
:0044C4F5 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0044C4F8 E8A3A0FBFF              call 004065A0
:0044C4FD C745FC01000000          mov [ebp-04], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C4DB(C)
|
:0044C504 EB9A                    jmp 0044C4A0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044C4B4(C), :0044C4BA(C)
|
:0044C506 E9E3000000              jmp 0044C5EE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044C41E(C), :0044C428(C)
|
:0044C50B 837DFC00                cmp dword ptr [ebp-04], 00000000
:0044C50F 0F85D9000000            jne 0044C5EE
:0044C515 C645F423                mov [ebp-0C], 23
:0044C519 EB09                    jmp 0044C524

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C580(U)
|
:0044C51B 8A4DF4                  mov cl, byte ptr [ebp-0C]
:0044C51E 80C101                  add cl, 01
:0044C521 884DF4                  mov byte ptr [ebp-0C], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C519(U)
|
:0044C524 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044C527 81E2FF000000            and edx, 000000FF
:0044C52D 83FA73                  cmp edx, 00000073
:0044C530 7D50                    jge 0044C582
:0044C532 837DFC00                cmp dword ptr [ebp-04], 00000000
:0044C536 754A                    jne 0044C582
:0044C538 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044C53B 81E1FF000000            and ecx, 000000FF
:0044C541 6BC924                  imul ecx, 00000024
:0044C544 81C1502C4B00            add ecx, 004B2C50
:0044C54A E841C7FCFF              call 00418C90
:0044C54F 25FF000000              and eax, 000000FF
:0044C554 83F802                  cmp eax, 00000002
:0044C557 7527                    jne 0044C580
:0044C559 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044C55C 81E1FF000000            and ecx, 000000FF
:0044C562 6BC924                  imul ecx, 00000024
:0044C565 81C1502C4B00            add ecx, 004B2C50
:0044C56B E8F06DFBFF              call 00403360
:0044C570 50                      push eax
:0044C571 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0044C574 E827A0FBFF              call 004065A0
:0044C579 C745FC01000000          mov [ebp-04], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C557(C)
|
:0044C580 EB99                    jmp 0044C51B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044C530(C), :0044C536(C)
|
:0044C582 C645F40F                mov [ebp-0C], 0F
:0044C586 EB08                    jmp 0044C590

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C5EC(U)
|
:0044C588 8A45F4                  mov al, byte ptr [ebp-0C]
:0044C58B 0401                    add al, 01
:0044C58D 8845F4                  mov byte ptr [ebp-0C], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C586(U)
|
:0044C590 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044C593 81E1FF000000            and ecx, 000000FF
:0044C599 83F923                  cmp ecx, 00000023
:0044C59C 7D50                    jge 0044C5EE
:0044C59E 837DFC00                cmp dword ptr [ebp-04], 00000000
:0044C5A2 754A                    jne 0044C5EE
:0044C5A4 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044C5A7 81E1FF000000            and ecx, 000000FF
:0044C5AD 6BC924                  imul ecx, 00000024
:0044C5B0 81C1502C4B00            add ecx, 004B2C50
:0044C5B6 E8D5C6FCFF              call 00418C90
:0044C5BB 25FF000000              and eax, 000000FF
:0044C5C0 83F802                  cmp eax, 00000002
:0044C5C3 7527                    jne 0044C5EC
:0044C5C5 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044C5C8 81E1FF000000            and ecx, 000000FF
:0044C5CE 6BC924                  imul ecx, 00000024
:0044C5D1 81C1502C4B00            add ecx, 004B2C50
:0044C5D7 E8846DFBFF              call 00403360
:0044C5DC 50                      push eax
:0044C5DD 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0044C5E0 E8BB9FFBFF              call 004065A0
:0044C5E5 C745FC01000000          mov [ebp-04], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C5C3(C)
|
:0044C5EC EB9A                    jmp 0044C588

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044C506(U), :0044C50F(C), :0044C59C(C), :0044C5A2(C)
|
:0044C5EE 8B5508                  mov edx, dword ptr [ebp+08]
:0044C5F1 668B45F8                mov ax, word ptr [ebp-08]
:0044C5F5 668902                  mov word ptr [edx], ax
:0044C5F8 8B4508                  mov eax, dword ptr [ebp+08]
:0044C5FB 8BE5                    mov esp, ebp
:0044C5FD 5D                      pop ebp
:0044C5FE C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0044E60A   , :0044E8D1   , :0044E98B   , :0044EBAF   , :0044EDD2   
|:0045B6C5   
|
:0044C601 55                      push ebp
:0044C602 8BEC                    mov ebp, esp
:0044C604 83EC0C                  sub esp, 0000000C
:0044C607 894DF4                  mov dword ptr [ebp-0C], ecx
:0044C60A B9902F4900              mov ecx, 00492F90
:0044C60F E87C43FCFF              call 00410990
:0044C614 8945FC                  mov dword ptr [ebp-04], eax
:0044C617 C745F800000000          mov [ebp-08], 00000000
:0044C61E EB09                    jmp 0044C629

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C652(U)
|
:0044C620 8B45F8                  mov eax, dword ptr [ebp-08]
:0044C623 83C001                  add eax, 00000001
:0044C626 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C61E(U)
|
:0044C629 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044C62C 3B4DFC                  cmp ecx, dword ptr [ebp-04]
:0044C62F 7D23                    jge 0044C654
:0044C631 6A00                    push 00000000
:0044C633 B9902F4900              mov ecx, 00492F90
:0044C638 E884BAFCFF              call 004180C1
:0044C63D E882240300              call 0047EAC4
:0044C642 B9902F4900              mov ecx, 00492F90
:0044C647 E864310000              call 0044F7B0
:0044C64C 85C0                    test eax, eax
:0044C64E 7502                    jne 0044C652
:0044C650 EB02                    jmp 0044C654

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C64E(C)
|
:0044C652 EBCC                    jmp 0044C620

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044C62F(C), :0044C650(U)
|
:0044C654 8BE5                    mov esp, ebp
:0044C656 5D                      pop ebp
:0044C657 C3                      ret



* Referenced by a CALL at Address:
|:00411D6C   
|
:0044C658 55                      push ebp
:0044C659 8BEC                    mov ebp, esp
:0044C65B 83EC08                  sub esp, 00000008
:0044C65E 894DF8                  mov dword ptr [ebp-08], ecx
:0044C661 8B45F8                  mov eax, dword ptr [ebp-08]
:0044C664 33C9                    xor ecx, ecx
:0044C666 8A4801                  mov cl, byte ptr [eax+01]
:0044C669 85C9                    test ecx, ecx
:0044C66B 740A                    je 0044C677
:0044C66D B801000000              mov eax, 00000001
:0044C672 E9D2000000              jmp 0044C749

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C66B(C)
|
:0044C677 C645FC23                mov [ebp-04], 23
:0044C67B EB09                    jmp 0044C686

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C712(U)
|
:0044C67D 8A55FC                  mov dl, byte ptr [ebp-04]
:0044C680 80C201                  add dl, 01
:0044C683 8855FC                  mov byte ptr [ebp-04], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C67B(U)
|
:0044C686 8B45FC                  mov eax, dword ptr [ebp-04]
:0044C689 25FF000000              and eax, 000000FF
:0044C68E 83F873                  cmp eax, 00000073
:0044C691 0F8F80000000            jg 0044C717
:0044C697 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044C69A 81E1FF000000            and ecx, 000000FF
:0044C6A0 6BC924                  imul ecx, 00000024
:0044C6A3 81C1502C4B00            add ecx, 004B2C50
:0044C6A9 E8E2C5FCFF              call 00418C90
:0044C6AE 25FF000000              and eax, 000000FF
:0044C6B3 83F803                  cmp eax, 00000003
:0044C6B6 7421                    je 0044C6D9
:0044C6B8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044C6BB 81E1FF000000            and ecx, 000000FF
:0044C6C1 6BC924                  imul ecx, 00000024
:0044C6C4 81C1502C4B00            add ecx, 004B2C50
:0044C6CA E8C1C5FCFF              call 00418C90
:0044C6CF 25FF000000              and eax, 000000FF
:0044C6D4 83F804                  cmp eax, 00000004
:0044C6D7 7539                    jne 0044C712

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C6B6(C)
|
:0044C6D9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044C6DC 81E1FF000000            and ecx, 000000FF
:0044C6E2 6BC924                  imul ecx, 00000024
:0044C6E5 81C1502C4B00            add ecx, 004B2C50
:0044C6EB E8802F0100              call 0045F670
:0044C6F0 50                      push eax
:0044C6F1 B9902F4900              mov ecx, 00492F90
:0044C6F6 E8D5300000              call 0044F7D0
:0044C6FB 85C0                    test eax, eax
:0044C6FD 7413                    je 0044C712
:0044C6FF 6A01                    push 00000001
:0044C701 B9902F4900              mov ecx, 00492F90
:0044C706 E835310000              call 0044F840
:0044C70B B801000000              mov eax, 00000001
:0044C710 EB37                    jmp 0044C749

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044C6D7(C), :0044C6FD(C)
|
:0044C712 E966FFFFFF              jmp 0044C67D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C691(C)
|
:0044C717 6A00                    push 00000000
:0044C719 6A00                    push 00000000
:0044C71B 6A00                    push 00000000
:0044C71D 6A00                    push 00000000
:0044C71F 6A00                    push 00000000
:0044C721 6A05                    push 00000005
:0044C723 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044C726 E8BB010000              call 0044C8E6
:0044C72B 25FF000000              and eax, 000000FF
:0044C730 85C0                    test eax, eax
:0044C732 7513                    jne 0044C747
:0044C734 6A01                    push 00000001
:0044C736 B9902F4900              mov ecx, 00492F90
:0044C73B E800310000              call 0044F840
:0044C740 B801000000              mov eax, 00000001
:0044C745 EB02                    jmp 0044C749

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C732(C)
|
:0044C747 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044C672(U), :0044C710(U), :0044C745(U)
|
:0044C749 8BE5                    mov esp, ebp
:0044C74B 5D                      pop ebp
:0044C74C C3                      ret



* Referenced by a CALL at Address:
|:00411D97   
|
:0044C74D 55                      push ebp
:0044C74E 8BEC                    mov ebp, esp
:0044C750 83EC0C                  sub esp, 0000000C
:0044C753 894DF4                  mov dword ptr [ebp-0C], ecx
:0044C756 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044C759 33C9                    xor ecx, ecx
:0044C75B 8A4801                  mov cl, byte ptr [eax+01]
:0044C75E 85C9                    test ecx, ecx
:0044C760 740A                    je 0044C76C
:0044C762 B801000000              mov eax, 00000001
:0044C767 E976010000              jmp 0044C8E2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C760(C)
|
:0044C76C C645FC00                mov [ebp-04], 00
:0044C770 EB09                    jmp 0044C77B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C80A(U)
|
:0044C772 8A55FC                  mov dl, byte ptr [ebp-04]
:0044C775 80C201                  add dl, 01
:0044C778 8855FC                  mov byte ptr [ebp-04], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C770(U)
|
:0044C77B 8B45FC                  mov eax, dword ptr [ebp-04]
:0044C77E 25FF000000              and eax, 000000FF
:0044C783 83F823                  cmp eax, 00000023
:0044C786 0F8F83000000            jg 0044C80F
:0044C78C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044C78F 81E1FF000000            and ecx, 000000FF
:0044C795 6BC924                  imul ecx, 00000024
:0044C798 81C1502C4B00            add ecx, 004B2C50
:0044C79E E8EDC4FCFF              call 00418C90
:0044C7A3 25FF000000              and eax, 000000FF
:0044C7A8 83F803                  cmp eax, 00000003
:0044C7AB 7421                    je 0044C7CE
:0044C7AD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044C7B0 81E1FF000000            and ecx, 000000FF
:0044C7B6 6BC924                  imul ecx, 00000024
:0044C7B9 81C1502C4B00            add ecx, 004B2C50
:0044C7BF E8CCC4FCFF              call 00418C90
:0044C7C4 25FF000000              and eax, 000000FF
:0044C7C9 83F804                  cmp eax, 00000004
:0044C7CC 753C                    jne 0044C80A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C7AB(C)
|
:0044C7CE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044C7D1 81E1FF000000            and ecx, 000000FF
:0044C7D7 6BC924                  imul ecx, 00000024
:0044C7DA 81C1502C4B00            add ecx, 004B2C50
:0044C7E0 E88B2E0100              call 0045F670
:0044C7E5 50                      push eax
:0044C7E6 B9902F4900              mov ecx, 00492F90
:0044C7EB E870300000              call 0044F860
:0044C7F0 85C0                    test eax, eax
:0044C7F2 7416                    je 0044C80A
:0044C7F4 6A01                    push 00000001
:0044C7F6 B9902F4900              mov ecx, 00492F90
:0044C7FB E880300000              call 0044F880
:0044C800 B801000000              mov eax, 00000001
:0044C805 E9D8000000              jmp 0044C8E2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044C7CC(C), :0044C7F2(C)
|
:0044C80A E963FFFFFF              jmp 0044C772

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C786(C)
|
:0044C80F B9502C4B00              mov ecx, 004B2C50
:0044C814 E8572E0100              call 0045F670
:0044C819 85C0                    test eax, eax
:0044C81B 0F858F000000            jne 0044C8B0
:0044C821 C645F800                mov [ebp-08], 00
:0044C825 C645FC00                mov [ebp-04], 00
:0044C829 EB09                    jmp 0044C834

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C88C(U)
|
:0044C82B 8A4DFC                  mov cl, byte ptr [ebp-04]
:0044C82E 80C101                  add cl, 01
:0044C831 884DFC                  mov byte ptr [ebp-04], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C829(U)
|
:0044C834 8B55FC                  mov edx, dword ptr [ebp-04]
:0044C837 81E2FF000000            and edx, 000000FF
:0044C83D 83FA0F                  cmp edx, 0000000F
:0044C840 7F4C                    jg 0044C88E
:0044C842 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044C845 81E1FF000000            and ecx, 000000FF
:0044C84B 6BC924                  imul ecx, 00000024
:0044C84E 81C1502C4B00            add ecx, 004B2C50
:0044C854 E837C4FCFF              call 00418C90
:0044C859 25FF000000              and eax, 000000FF
:0044C85E 83F802                  cmp eax, 00000002
:0044C861 7421                    je 0044C884
:0044C863 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044C866 81E1FF000000            and ecx, 000000FF
:0044C86C 6BC924                  imul ecx, 00000024
:0044C86F 81C1502C4B00            add ecx, 004B2C50
:0044C875 E816C4FCFF              call 00418C90
:0044C87A 25FF000000              and eax, 000000FF
:0044C87F 83F801                  cmp eax, 00000001
:0044C882 7508                    jne 0044C88C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C861(C)
|
:0044C884 8A45F8                  mov al, byte ptr [ebp-08]
:0044C887 0401                    add al, 01
:0044C889 8845F8                  mov byte ptr [ebp-08], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C882(C)
|
:0044C88C EB9D                    jmp 0044C82B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C840(C)
|
:0044C88E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044C891 81E1FF000000            and ecx, 000000FF
:0044C897 85C9                    test ecx, ecx
:0044C899 7513                    jne 0044C8AE
:0044C89B 6A01                    push 00000001
:0044C89D B9902F4900              mov ecx, 00492F90
:0044C8A2 E8D92F0000              call 0044F880
:0044C8A7 B801000000              mov eax, 00000001
:0044C8AC EB34                    jmp 0044C8E2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C899(C)
|
:0044C8AE EB30                    jmp 0044C8E0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C81B(C)
|
:0044C8B0 6A00                    push 00000000
:0044C8B2 6A00                    push 00000000
:0044C8B4 6A00                    push 00000000
:0044C8B6 6A00                    push 00000000
:0044C8B8 6A00                    push 00000000
:0044C8BA 6A00                    push 00000000
:0044C8BC 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044C8BF E822000000              call 0044C8E6
:0044C8C4 25FF000000              and eax, 000000FF
:0044C8C9 85C0                    test eax, eax
:0044C8CB 7513                    jne 0044C8E0
:0044C8CD 6A01                    push 00000001
:0044C8CF B9902F4900              mov ecx, 00492F90
:0044C8D4 E8A72F0000              call 0044F880
:0044C8D9 B801000000              mov eax, 00000001
:0044C8DE EB02                    jmp 0044C8E2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044C8AE(U), :0044C8CB(C)
|
:0044C8E0 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044C767(U), :0044C805(U), :0044C8AC(U), :0044C8DE(U)
|
:0044C8E2 8BE5                    mov esp, ebp
:0044C8E4 5D                      pop ebp
:0044C8E5 C3                      ret



* Referenced by a CALL at Addresses:
|:00411605   , :0044C726   , :0044C8BF   
|
:0044C8E6 55                      push ebp
:0044C8E7 8BEC                    mov ebp, esp
:0044C8E9 83EC44                  sub esp, 00000044
:0044C8EC 894DD4                  mov dword ptr [ebp-2C], ecx
:0044C8EF C645FC00                mov [ebp-04], 00
:0044C8F3 8B450C                  mov eax, dword ptr [ebp+0C]
:0044C8F6 25FF000000              and eax, 000000FF
:0044C8FB 83F801                  cmp eax, 00000001
:0044C8FE 0F8599010000            jne 0044CA9D
:0044C904 8D4DEC                  lea ecx, dword ptr [ebp-14]
:0044C907 E8042E0100              call 0045F710
:0044C90C 8A4D14                  mov cl, byte ptr [ebp+14]
:0044C90F 884DF0                  mov byte ptr [ebp-10], cl
:0044C912 EB09                    jmp 0044C91D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044CA93(U)
|
:0044C914 8A55F0                  mov dl, byte ptr [ebp-10]
:0044C917 80C201                  add dl, 01
:0044C91A 8855F0                  mov byte ptr [ebp-10], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C912(U)
|
:0044C91D 8B45F0                  mov eax, dword ptr [ebp-10]
:0044C920 25FF000000              and eax, 000000FF
:0044C925 8B4D1C                  mov ecx, dword ptr [ebp+1C]
:0044C928 81E1FF000000            and ecx, 000000FF
:0044C92E 3BC1                    cmp eax, ecx
:0044C930 0F8F62010000            jg 0044CA98
:0044C936 8A5510                  mov dl, byte ptr [ebp+10]
:0044C939 8855F4                  mov byte ptr [ebp-0C], dl
:0044C93C EB08                    jmp 0044C946

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044CA8E(U)
|
:0044C93E 8A45F4                  mov al, byte ptr [ebp-0C]
:0044C941 0401                    add al, 01
:0044C943 8845F4                  mov byte ptr [ebp-0C], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C93C(U)
|
:0044C946 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044C949 81E1FF000000            and ecx, 000000FF
:0044C94F 8B5518                  mov edx, dword ptr [ebp+18]
:0044C952 81E2FF000000            and edx, 000000FF
:0044C958 3BCA                    cmp ecx, edx
:0044C95A 0F8F33010000            jg 0044CA93
:0044C960 8A45F4                  mov al, byte ptr [ebp-0C]
:0044C963 8845EC                  mov byte ptr [ebp-14], al
:0044C966 8A4DF0                  mov cl, byte ptr [ebp-10]
:0044C969 884DED                  mov byte ptr [ebp-13], cl
:0044C96C 8D55EC                  lea edx, dword ptr [ebp-14]
:0044C96F 52                      push edx
:0044C970 E80F8FFEFF              call 00435884
:0044C975 83C404                  add esp, 00000004
:0044C978 8845F8                  mov byte ptr [ebp-08], al
:0044C97B 8B45F8                  mov eax, dword ptr [ebp-08]
:0044C97E 25FF000000              and eax, 000000FF
:0044C983 3DFF000000              cmp eax, 000000FF
:0044C988 0F8400010000            je 0044CA8E
:0044C98E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044C991 81E1FF000000            and ecx, 000000FF
:0044C997 6BC924                  imul ecx, 00000024
:0044C99A 81C1502C4B00            add ecx, 004B2C50
:0044C9A0 E8EBC2FCFF              call 00418C90
:0044C9A5 25FF000000              and eax, 000000FF
:0044C9AA 83F802                  cmp eax, 00000002
:0044C9AD 0F85DB000000            jne 0044CA8E
:0044C9B3 C745E400000000          mov [ebp-1C], 00000000
:0044C9BA 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044C9BD 81E1FF000000            and ecx, 000000FF
:0044C9C3 6BC924                  imul ecx, 00000024
:0044C9C6 81C1502C4B00            add ecx, 004B2C50
:0044C9CC E84932FFFF              call 0043FC1A
:0044C9D1 8845E8                  mov byte ptr [ebp-18], al
:0044C9D4 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044C9D7 81E1FF000000            and ecx, 000000FF
:0044C9DD 894DD0                  mov dword ptr [ebp-30], ecx
:0044C9E0 837DD006                cmp dword ptr [ebp-30], 00000006
:0044C9E4 0F8793000000            ja 0044CA7D
:0044C9EA 8B55D0                  mov edx, dword ptr [ebp-30]
:0044C9ED FF2495CBCB4400          jmp dword ptr [4*edx+0044CBCB]
:0044C9F4 8B4508                  mov eax, dword ptr [ebp+08]
:0044C9F7 25FF000000              and eax, 000000FF
:0044C9FC 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0044C9FF 81E1FF000000            and ecx, 000000FF
:0044CA05 33D2                    xor edx, edx
:0044CA07 3BC1                    cmp eax, ecx
:0044CA09 0F94C2                  sete dl
:0044CA0C 8955E4                  mov dword ptr [ebp-1C], edx
:0044CA0F EB6C                    jmp 0044CA7D
:0044CA11 8B45E8                  mov eax, dword ptr [ebp-18]
:0044CA14 25FF000000              and eax, 000000FF
:0044CA19 85C0                    test eax, eax
:0044CA1B 7417                    je 0044CA34
:0044CA1D 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0044CA20 81E1FF000000            and ecx, 000000FF
:0044CA26 83F901                  cmp ecx, 00000001
:0044CA29 7409                    je 0044CA34
:0044CA2B C745CC00000000          mov [ebp-34], 00000000
:0044CA32 EB07                    jmp 0044CA3B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044CA1B(C), :0044CA29(C)
|
:0044CA34 C745CC01000000          mov [ebp-34], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044CA32(U)
|
:0044CA3B 8B55CC                  mov edx, dword ptr [ebp-34]
:0044CA3E 8955E4                  mov dword ptr [ebp-1C], edx
:0044CA41 EB3A                    jmp 0044CA7D
:0044CA43 8B45E8                  mov eax, dword ptr [ebp-18]
:0044CA46 25FF000000              and eax, 000000FF
:0044CA4B 83F802                  cmp eax, 00000002
:0044CA4E 7417                    je 0044CA67
:0044CA50 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0044CA53 81E1FF000000            and ecx, 000000FF
:0044CA59 83F903                  cmp ecx, 00000003
:0044CA5C 7409                    je 0044CA67
:0044CA5E C745C800000000          mov [ebp-38], 00000000
:0044CA65 EB07                    jmp 0044CA6E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044CA4E(C), :0044CA5C(C)
|
:0044CA67 C745C801000000          mov [ebp-38], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044CA65(U)
|
:0044CA6E 8B55C8                  mov edx, dword ptr [ebp-38]
:0044CA71 8955E4                  mov dword ptr [ebp-1C], edx
:0044CA74 EB07                    jmp 0044CA7D
:0044CA76 C745E401000000          mov [ebp-1C], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044C9E4(C), :0044CA0F(U), :0044CA41(U), :0044CA74(U)
|
:0044CA7D 33C0                    xor eax, eax
:0044CA7F 837DE400                cmp dword ptr [ebp-1C], 00000000
:0044CA83 0F95C0                  setne al
:0044CA86 8A4DFC                  mov cl, byte ptr [ebp-04]
:0044CA89 02C8                    add cl, al
:0044CA8B 884DFC                  mov byte ptr [ebp-04], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044C988(C), :0044C9AD(C)
|
:0044CA8E E9ABFEFFFF              jmp 0044C93E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C95A(C)
|
:0044CA93 E97CFEFFFF              jmp 0044C914

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C930(C)
|
:0044CA98 E925010000              jmp 0044CBC2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044C8FE(C)
|
:0044CA9D C645E000                mov [ebp-20], 00
:0044CAA1 EB09                    jmp 0044CAAC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044CBBD(U)
|
:0044CAA3 8A55E0                  mov dl, byte ptr [ebp-20]
:0044CAA6 80C201                  add dl, 01
:0044CAA9 8855E0                  mov byte ptr [ebp-20], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044CAA1(U)
|
:0044CAAC 8B45E0                  mov eax, dword ptr [ebp-20]
:0044CAAF 25FF000000              and eax, 000000FF
:0044CAB4 83F873                  cmp eax, 00000073
:0044CAB7 0F8D05010000            jnl 0044CBC2
:0044CABD 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0044CAC0 81E1FF000000            and ecx, 000000FF
:0044CAC6 6BC924                  imul ecx, 00000024
:0044CAC9 81C1502C4B00            add ecx, 004B2C50
:0044CACF E8BCC1FCFF              call 00418C90
:0044CAD4 25FF000000              and eax, 000000FF
:0044CAD9 83F802                  cmp eax, 00000002
:0044CADC 0F85DB000000            jne 0044CBBD
:0044CAE2 C745D800000000          mov [ebp-28], 00000000
:0044CAE9 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0044CAEC 81E1FF000000            and ecx, 000000FF
:0044CAF2 6BC924                  imul ecx, 00000024
:0044CAF5 81C1502C4B00            add ecx, 004B2C50
:0044CAFB E81A31FFFF              call 0043FC1A
:0044CB00 8845DC                  mov byte ptr [ebp-24], al
:0044CB03 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044CB06 81E1FF000000            and ecx, 000000FF
:0044CB0C 894DC4                  mov dword ptr [ebp-3C], ecx
:0044CB0F 837DC406                cmp dword ptr [ebp-3C], 00000006
:0044CB13 0F8793000000            ja 0044CBAC
:0044CB19 8B55C4                  mov edx, dword ptr [ebp-3C]
:0044CB1C FF2495E7CB4400          jmp dword ptr [4*edx+0044CBE7]
:0044CB23 8B4508                  mov eax, dword ptr [ebp+08]
:0044CB26 25FF000000              and eax, 000000FF
:0044CB2B 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0044CB2E 81E1FF000000            and ecx, 000000FF
:0044CB34 33D2                    xor edx, edx
:0044CB36 3BC1                    cmp eax, ecx
:0044CB38 0F94C2                  sete dl
:0044CB3B 8955D8                  mov dword ptr [ebp-28], edx
:0044CB3E EB6C                    jmp 0044CBAC
:0044CB40 8B45DC                  mov eax, dword ptr [ebp-24]
:0044CB43 25FF000000              and eax, 000000FF
:0044CB48 85C0                    test eax, eax
:0044CB4A 7417                    je 0044CB63
:0044CB4C 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0044CB4F 81E1FF000000            and ecx, 000000FF
:0044CB55 83F901                  cmp ecx, 00000001
:0044CB58 7409                    je 0044CB63
:0044CB5A C745C000000000          mov [ebp-40], 00000000
:0044CB61 EB07                    jmp 0044CB6A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044CB4A(C), :0044CB58(C)
|
:0044CB63 C745C001000000          mov [ebp-40], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044CB61(U)
|
:0044CB6A 8B55C0                  mov edx, dword ptr [ebp-40]
:0044CB6D 8955D8                  mov dword ptr [ebp-28], edx
:0044CB70 EB3A                    jmp 0044CBAC
:0044CB72 8B45DC                  mov eax, dword ptr [ebp-24]
:0044CB75 25FF000000              and eax, 000000FF
:0044CB7A 83F802                  cmp eax, 00000002
:0044CB7D 7417                    je 0044CB96
:0044CB7F 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0044CB82 81E1FF000000            and ecx, 000000FF
:0044CB88 83F903                  cmp ecx, 00000003
:0044CB8B 7409                    je 0044CB96
:0044CB8D C745BC00000000          mov [ebp-44], 00000000
:0044CB94 EB07                    jmp 0044CB9D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044CB7D(C), :0044CB8B(C)
|
:0044CB96 C745BC01000000          mov [ebp-44], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044CB94(U)
|
:0044CB9D 8B55BC                  mov edx, dword ptr [ebp-44]
:0044CBA0 8955D8                  mov dword ptr [ebp-28], edx
:0044CBA3 EB07                    jmp 0044CBAC
:0044CBA5 C745D801000000          mov [ebp-28], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044CB13(C), :0044CB3E(U), :0044CB70(U), :0044CBA3(U)
|
:0044CBAC 33C0                    xor eax, eax
:0044CBAE 837DD800                cmp dword ptr [ebp-28], 00000000
:0044CBB2 0F95C0                  setne al
:0044CBB5 8A4DFC                  mov cl, byte ptr [ebp-04]
:0044CBB8 02C8                    add cl, al
:0044CBBA 884DFC                  mov byte ptr [ebp-04], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044CADC(C)
|
:0044CBBD E9E1FEFFFF              jmp 0044CAA3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044CA98(U), :0044CAB7(C)
|
:0044CBC2 8A45FC                  mov al, byte ptr [ebp-04]
:0044CBC5 8BE5                    mov esp, ebp
:0044CBC7 5D                      pop ebp
:0044CBC8 C21800                  ret 0018



:0044CBCB F4C94400                DWORD 0044C9F4
:0044CBCF F4C94400                DWORD 0044C9F4
:0044CBD3 F4C94400                DWORD 0044C9F4
:0044CBD7 F4C94400                DWORD 0044C9F4
:0044CBDB 11CA4400                DWORD 0044CA11
:0044CBDF 43CA4400                DWORD 0044CA43
:0044CBE3 76CA4400                DWORD 0044CA76
:0044CBE7 23CB4400                DWORD 0044CB23
:0044CBEB 23CB4400                DWORD 0044CB23
:0044CBEF 23CB4400                DWORD 0044CB23
:0044CBF3 23CB4400                DWORD 0044CB23
:0044CBF7 40CB4400                DWORD 0044CB40
:0044CBFB 72CB4400                DWORD 0044CB72
:0044CBFF A5CB4400                DWORD 0044CBA5



* Referenced by a CALL at Addresses:
|:00415789   , :0044E5F6   , :0044EB67   
|
:0044CC03 55                      push ebp
:0044CC04 8BEC                    mov ebp, esp
:0044CC06 83EC08                  sub esp, 00000008
:0044CC09 894DF8                  mov dword ptr [ebp-08], ecx
:0044CC0C C645FC00                mov [ebp-04], 00
:0044CC10 EB08                    jmp 0044CC1A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044CC7F(U)
|
:0044CC12 8A45FC                  mov al, byte ptr [ebp-04]
:0044CC15 0401                    add al, 01
:0044CC17 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044CC10(U)
|
:0044CC1A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044CC1D 81E1FF000000            and ecx, 000000FF
:0044CC23 83F973                  cmp ecx, 00000073
:0044CC26 7D59                    jge 0044CC81
:0044CC28 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044CC2B 81E1FF000000            and ecx, 000000FF
:0044CC31 6BC924                  imul ecx, 00000024
:0044CC34 81C1502C4B00            add ecx, 004B2C50
:0044CC3A E851C0FCFF              call 00418C90
:0044CC3F 25FF000000              and eax, 000000FF
:0044CC44 83F802                  cmp eax, 00000002
:0044CC47 7536                    jne 0044CC7F
:0044CC49 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044CC4C 81E1FF000000            and ecx, 000000FF
:0044CC52 6BC924                  imul ecx, 00000024
:0044CC55 81C1502C4B00            add ecx, 004B2C50
:0044CC5B E830600200              call 00472C90
:0044CC60 85C0                    test eax, eax
:0044CC62 751B                    jne 0044CC7F
:0044CC64 6A00                    push 00000000
:0044CC66 6A00                    push 00000000
:0044CC68 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044CC6B 81E1FF000000            and ecx, 000000FF
:0044CC71 6BC924                  imul ecx, 00000024
:0044CC74 81C1502C4B00            add ecx, 004B2C50
:0044CC7A E8C54AFFFF              call 00441744

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044CC47(C), :0044CC62(C)
|
:0044CC7F EB91                    jmp 0044CC12

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044CC26(C)
|
:0044CC81 8BE5                    mov esp, ebp
:0044CC83 5D                      pop ebp
:0044CC84 C3                      ret



* Referenced by a CALL at Address:
|:0044D89B   
|
:0044CC85 55                      push ebp
:0044CC86 8BEC                    mov ebp, esp
:0044CC88 83EC28                  sub esp, 00000028
:0044CC8B 894DD8                  mov dword ptr [ebp-28], ecx
:0044CC8E C745E0FFFF0000          mov [ebp-20], 0000FFFF
:0044CC95 C745F800000000          mov [ebp-08], 00000000
:0044CC9C C645E400                mov [ebp-1C], 00
:0044CCA0 C645F00F                mov [ebp-10], 0F
:0044CCA4 C645EC23                mov [ebp-14], 23
:0044CCA8 B9C8E44A00              mov ecx, 004AE4C8
:0044CCAD E8DE13FCFF              call 0040E090
:0044CCB2 50                      push eax
:0044CCB3 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"DATA.E5"
                                  |
:0044CCB5 6860BB4800              push 0048BB60
:0044CCBA E85FE8FCFF              call 0041B51E
:0044CCBF 83C40C                  add esp, 0000000C
:0044CCC2 C745F400000000          mov [ebp-0C], 00000000
:0044CCC9 EB09                    jmp 0044CCD4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044CD18(U), :0044D089(U)
|
:0044CCCB 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044CCCE 83C001                  add eax, 00000001
:0044CCD1 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044CCC9(U)
|
:0044CCD4 837DF473                cmp dword ptr [ebp-0C], 00000073
:0044CCD8 0F83B0030000            jnb 0044D08E
:0044CCDE 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044CCE1 51                      push ecx
:0044CCE2 B9902F4900              mov ecx, 00492F90
:0044CCE7 E8E4C0FCFF              call 00418DD0
:0044CCEC 8945E8                  mov dword ptr [ebp-18], eax
:0044CCEF 8B55E8                  mov edx, dword ptr [ebp-18]
:0044CCF2 8955FC                  mov dword ptr [ebp-04], edx
:0044CCF5 8B45FC                  mov eax, dword ptr [ebp-04]
:0044CCF8 8B08                    mov ecx, dword ptr [eax]
:0044CCFA 894DE0                  mov dword ptr [ebp-20], ecx
:0044CCFD 8B55FC                  mov edx, dword ptr [ebp-04]
:0044CD00 83C204                  add edx, 00000004
:0044CD03 8955DC                  mov dword ptr [ebp-24], edx
:0044CD06 8B45FC                  mov eax, dword ptr [ebp-04]
:0044CD09 8B4808                  mov ecx, dword ptr [eax+08]
:0044CD0C 894DF8                  mov dword ptr [ebp-08], ecx
:0044CD0F 817DE0FFFF0000          cmp dword ptr [ebp-20], 0000FFFF
:0044CD16 7502                    jne 0044CD1A
:0044CD18 EBB1                    jmp 0044CCCB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044CD16(C)
|
:0044CD1A 8B55F8                  mov edx, dword ptr [ebp-08]
:0044CD1D 83E203                  and edx, 00000003
:0044CD20 85D2                    test edx, edx
:0044CD22 7539                    jne 0044CD5D
:0044CD24 8B45DC                  mov eax, dword ptr [ebp-24]
:0044CD27 8A4801                  mov cl, byte ptr [eax+01]
:0044CD2A 51                      push ecx
:0044CD2B 8B55DC                  mov edx, dword ptr [ebp-24]
:0044CD2E 8A02                    mov al, byte ptr [edx]
:0044CD30 50                      push eax
:0044CD31 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044CD34 51                      push ecx
:0044CD35 8B55E0                  mov edx, dword ptr [ebp-20]
:0044CD38 52                      push edx
:0044CD39 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0044CD3C 81E1FF000000            and ecx, 000000FF
:0044CD42 6BC924                  imul ecx, 00000024
:0044CD45 81C1502C4B00            add ecx, 004B2C50
:0044CD4B E8FC59FFFF              call 0044274C
:0044CD50 8A45E4                  mov al, byte ptr [ebp-1C]
:0044CD53 0401                    add al, 01
:0044CD55 8845E4                  mov byte ptr [ebp-1C], al
:0044CD58 E92C030000              jmp 0044D089

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044CD22(C)
|
:0044CD5D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044CD60 83E101                  and ecx, 00000001
:0044CD63 85C9                    test ecx, ecx
:0044CD65 0F85B9010000            jne 0044CF24
:0044CD6B 8B55F8                  mov edx, dword ptr [ebp-08]
:0044CD6E 83E202                  and edx, 00000002
:0044CD71 85D2                    test edx, edx
:0044CD73 0F84AB010000            je 0044CF24
:0044CD79 8B45E0                  mov eax, dword ptr [ebp-20]
:0044CD7C 50                      push eax
:0044CD7D E80ED4FCFF              call 0041A190
:0044CD82 83C404                  add esp, 00000004
:0044CD85 85C0                    test eax, eax
:0044CD87 7431                    je 0044CDBA
:0044CD89 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0044CD8C 8A5101                  mov dl, byte ptr [ecx+01]
:0044CD8F 52                      push edx
:0044CD90 8B45DC                  mov eax, dword ptr [ebp-24]
:0044CD93 8A08                    mov cl, byte ptr [eax]
:0044CD95 51                      push ecx
:0044CD96 8B55F8                  mov edx, dword ptr [ebp-08]
:0044CD99 52                      push edx
:0044CD9A 8B45E0                  mov eax, dword ptr [ebp-20]
:0044CD9D 50                      push eax
:0044CD9E 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044CDA1 81E1FF000000            and ecx, 000000FF
:0044CDA7 6BC924                  imul ecx, 00000024
:0044CDAA 81C1502C4B00            add ecx, 004B2C50
:0044CDB0 E89759FFFF              call 0044274C
:0044CDB5 E92F010000              jmp 0044CEE9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044CD87(C)
|
:0044CDBA 6A00                    push 00000000
:0044CDBC 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0044CDBF 51                      push ecx
:0044CDC0 B9C8E44A00              mov ecx, 004AE4C8
:0044CDC5 E8C612FCFF              call 0040E090
:0044CDCA 50                      push eax
:0044CDCB E836E8FCFF              call 0041B606
:0044CDD0 83C40C                  add esp, 0000000C
:0044CDD3 8B55DC                  mov edx, dword ptr [ebp-24]
:0044CDD6 8A4201                  mov al, byte ptr [edx+01]
:0044CDD9 50                      push eax
:0044CDDA 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0044CDDD 8A11                    mov dl, byte ptr [ecx]
:0044CDDF 52                      push edx
:0044CDE0 8B45F8                  mov eax, dword ptr [ebp-08]
:0044CDE3 50                      push eax
:0044CDE4 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0044CDE7 51                      push ecx
:0044CDE8 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044CDEB 81E1FF000000            and ecx, 000000FF
:0044CDF1 6BC924                  imul ecx, 00000024
:0044CDF4 81C1502C4B00            add ecx, 004B2C50
:0044CDFA E84D59FFFF              call 0044274C
:0044CDFF 8B55E8                  mov edx, dword ptr [ebp-18]
:0044CE02 8A4211                  mov al, byte ptr [edx+11]
:0044CE05 50                      push eax
:0044CE06 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0044CE09 8A5110                  mov dl, byte ptr [ecx+10]
:0044CE0C 52                      push edx
:0044CE0D 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044CE10 81E1FF000000            and ecx, 000000FF
:0044CE16 6BC924                  imul ecx, 00000024
:0044CE19 81C1502C4B00            add ecx, 004B2C50
:0044CE1F E86C5AFFFF              call 00442890
:0044CE24 8B45E8                  mov eax, dword ptr [ebp-18]
:0044CE27 8A4820                  mov cl, byte ptr [eax+20]
:0044CE2A 51                      push ecx
:0044CE2B 8B55E8                  mov edx, dword ptr [ebp-18]
:0044CE2E 8B4214                  mov eax, dword ptr [edx+14]
:0044CE31 50                      push eax
:0044CE32 6A00                    push 00000000
:0044CE34 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044CE37 81E1FF000000            and ecx, 000000FF
:0044CE3D 6BC924                  imul ecx, 00000024
:0044CE40 81C1502C4B00            add ecx, 004B2C50
:0044CE46 E8AE5BFFFF              call 004429F9
:0044CE4B 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0044CE4E 8A5121                  mov dl, byte ptr [ecx+21]
:0044CE51 52                      push edx
:0044CE52 8B45E8                  mov eax, dword ptr [ebp-18]
:0044CE55 8B4818                  mov ecx, dword ptr [eax+18]
:0044CE58 51                      push ecx
:0044CE59 6A01                    push 00000001
:0044CE5B 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044CE5E 81E1FF000000            and ecx, 000000FF
:0044CE64 6BC924                  imul ecx, 00000024
:0044CE67 81C1502C4B00            add ecx, 004B2C50
:0044CE6D E8875BFFFF              call 004429F9
:0044CE72 68FF000000              push 000000FF
:0044CE77 8B55E8                  mov edx, dword ptr [ebp-18]
:0044CE7A 8B421C                  mov eax, dword ptr [edx+1C]
:0044CE7D 50                      push eax
:0044CE7E 6A02                    push 00000002
:0044CE80 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044CE83 81E1FF000000            and ecx, 000000FF
:0044CE89 6BC924                  imul ecx, 00000024
:0044CE8C 81C1502C4B00            add ecx, 004B2C50
:0044CE92 E8625BFFFF              call 004429F9
:0044CE97 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0044CE9A 6BC948                  imul ecx, 00000048
:0044CE9D 81C1681B4A00            add ecx, 004A1B68
:0044CEA3 E873A3FBFF              call 0040721B
:0044CEA8 50                      push eax
:0044CEA9 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044CEAC 81E1FF000000            and ecx, 000000FF
:0044CEB2 6BC924                  imul ecx, 00000024
:0044CEB5 81C1502C4B00            add ecx, 004B2C50
:0044CEBB E80D28FFFF              call 0043F6CD
:0044CEC0 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0044CEC3 6BC948                  imul ecx, 00000048
:0044CEC6 81C1681B4A00            add ecx, 004A1B68
:0044CECC E879A3FBFF              call 0040724A
:0044CED1 50                      push eax
:0044CED2 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044CED5 81E1FF000000            and ecx, 000000FF
:0044CEDB 6BC924                  imul ecx, 00000024
:0044CEDE 81C1502C4B00            add ecx, 004B2C50
:0044CEE4 E82528FFFF              call 0043F70E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044CDB5(U)
|
:0044CEE9 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0044CEEC 8A510F                  mov dl, byte ptr [ecx+0F]
:0044CEEF 52                      push edx
:0044CEF0 8B45E8                  mov eax, dword ptr [ebp-18]
:0044CEF3 8A480E                  mov cl, byte ptr [eax+0E]
:0044CEF6 51                      push ecx
:0044CEF7 8B55E8                  mov edx, dword ptr [ebp-18]
:0044CEFA 33C0                    xor eax, eax
:0044CEFC 668B420E                mov ax, word ptr [edx+0E]
:0044CF00 50                      push eax
:0044CF01 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0044CF04 8A510C                  mov dl, byte ptr [ecx+0C]
:0044CF07 52                      push edx
:0044CF08 8B45E0                  mov eax, dword ptr [ebp-20]
:0044CF0B 50                      push eax
:0044CF0C B9F05D4B00              mov ecx, 004B5DF0
:0044CF11 E875CE0000              call 00459D8B
:0044CF16 8A4DF0                  mov cl, byte ptr [ebp-10]
:0044CF19 80C101                  add cl, 01
:0044CF1C 884DF0                  mov byte ptr [ebp-10], cl
:0044CF1F E965010000              jmp 0044D089

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044CD65(C), :0044CD73(C)
|
:0044CF24 6A00                    push 00000000
:0044CF26 8B55E0                  mov edx, dword ptr [ebp-20]
:0044CF29 52                      push edx
:0044CF2A B9C8E44A00              mov ecx, 004AE4C8
:0044CF2F E85C11FCFF              call 0040E090
:0044CF34 50                      push eax
:0044CF35 E8CCE6FCFF              call 0041B606
:0044CF3A 83C40C                  add esp, 0000000C
:0044CF3D 8B45DC                  mov eax, dword ptr [ebp-24]
:0044CF40 8A4801                  mov cl, byte ptr [eax+01]
:0044CF43 51                      push ecx
:0044CF44 8B55DC                  mov edx, dword ptr [ebp-24]
:0044CF47 8A02                    mov al, byte ptr [edx]
:0044CF49 50                      push eax
:0044CF4A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044CF4D 51                      push ecx
:0044CF4E 8B55E0                  mov edx, dword ptr [ebp-20]
:0044CF51 52                      push edx
:0044CF52 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0044CF55 81E1FF000000            and ecx, 000000FF
:0044CF5B 6BC924                  imul ecx, 00000024
:0044CF5E 81C1502C4B00            add ecx, 004B2C50
:0044CF64 E8E357FFFF              call 0044274C
:0044CF69 8B45E8                  mov eax, dword ptr [ebp-18]
:0044CF6C 8A4811                  mov cl, byte ptr [eax+11]
:0044CF6F 51                      push ecx
:0044CF70 8B55E8                  mov edx, dword ptr [ebp-18]
:0044CF73 8A4210                  mov al, byte ptr [edx+10]
:0044CF76 50                      push eax
:0044CF77 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0044CF7A 81E1FF000000            and ecx, 000000FF
:0044CF80 6BC924                  imul ecx, 00000024
:0044CF83 81C1502C4B00            add ecx, 004B2C50
:0044CF89 E80259FFFF              call 00442890
:0044CF8E 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0044CF91 8A5120                  mov dl, byte ptr [ecx+20]
:0044CF94 52                      push edx
:0044CF95 8B45E8                  mov eax, dword ptr [ebp-18]
:0044CF98 8B4814                  mov ecx, dword ptr [eax+14]
:0044CF9B 51                      push ecx
:0044CF9C 6A00                    push 00000000
:0044CF9E 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0044CFA1 81E1FF000000            and ecx, 000000FF
:0044CFA7 6BC924                  imul ecx, 00000024
:0044CFAA 81C1502C4B00            add ecx, 004B2C50
:0044CFB0 E8445AFFFF              call 004429F9
:0044CFB5 8B55E8                  mov edx, dword ptr [ebp-18]
:0044CFB8 8A4221                  mov al, byte ptr [edx+21]
:0044CFBB 50                      push eax
:0044CFBC 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0044CFBF 8B5118                  mov edx, dword ptr [ecx+18]
:0044CFC2 52                      push edx
:0044CFC3 6A01                    push 00000001
:0044CFC5 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0044CFC8 81E1FF000000            and ecx, 000000FF
:0044CFCE 6BC924                  imul ecx, 00000024
:0044CFD1 81C1502C4B00            add ecx, 004B2C50
:0044CFD7 E81D5AFFFF              call 004429F9
:0044CFDC 68FF000000              push 000000FF
:0044CFE1 8B45E8                  mov eax, dword ptr [ebp-18]
:0044CFE4 8B481C                  mov ecx, dword ptr [eax+1C]
:0044CFE7 51                      push ecx
:0044CFE8 6A02                    push 00000002
:0044CFEA 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0044CFED 81E1FF000000            and ecx, 000000FF
:0044CFF3 6BC924                  imul ecx, 00000024
:0044CFF6 81C1502C4B00            add ecx, 004B2C50
:0044CFFC E8F859FFFF              call 004429F9
:0044D001 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0044D004 6BC948                  imul ecx, 00000048
:0044D007 81C1681B4A00            add ecx, 004A1B68
:0044D00D E809A2FBFF              call 0040721B
:0044D012 50                      push eax
:0044D013 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0044D016 81E1FF000000            and ecx, 000000FF
:0044D01C 6BC924                  imul ecx, 00000024
:0044D01F 81C1502C4B00            add ecx, 004B2C50
:0044D025 E8A326FFFF              call 0043F6CD
:0044D02A 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0044D02D 6BC948                  imul ecx, 00000048
:0044D030 81C1681B4A00            add ecx, 004A1B68
:0044D036 E80FA2FBFF              call 0040724A
:0044D03B 50                      push eax
:0044D03C 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0044D03F 81E1FF000000            and ecx, 000000FF
:0044D045 6BC924                  imul ecx, 00000024
:0044D048 81C1502C4B00            add ecx, 004B2C50
:0044D04E E8BB26FFFF              call 0043F70E
:0044D053 8B55E8                  mov edx, dword ptr [ebp-18]
:0044D056 8A420F                  mov al, byte ptr [edx+0F]
:0044D059 50                      push eax
:0044D05A 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0044D05D 8A510E                  mov dl, byte ptr [ecx+0E]
:0044D060 52                      push edx
:0044D061 8B45E8                  mov eax, dword ptr [ebp-18]
:0044D064 33C9                    xor ecx, ecx
:0044D066 668B480E                mov cx, word ptr [eax+0E]
:0044D06A 51                      push ecx
:0044D06B 8B55E8                  mov edx, dword ptr [ebp-18]
:0044D06E 8A420C                  mov al, byte ptr [edx+0C]
:0044D071 50                      push eax
:0044D072 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0044D075 51                      push ecx
:0044D076 B9F05D4B00              mov ecx, 004B5DF0
:0044D07B E80BCD0000              call 00459D8B
:0044D080 8A55EC                  mov dl, byte ptr [ebp-14]
:0044D083 80C201                  add dl, 01
:0044D086 8855EC                  mov byte ptr [ebp-14], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044CD58(U), :0044CF1F(U)
|
:0044D089 E93DFCFFFF              jmp 0044CCCB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044CCD8(C)
|
:0044D08E 8BE5                    mov esp, ebp
:0044D090 5D                      pop ebp
:0044D091 C3                      ret



* Referenced by a CALL at Address:
|:0044F070   
|
:0044D092 55                      push ebp
:0044D093 8BEC                    mov ebp, esp
:0044D095 6AFF                    push FFFFFFFF
:0044D097 6840564800              push 00485640
:0044D09C 64A100000000            mov eax, dword ptr fs:[00000000]
:0044D0A2 50                      push eax
:0044D0A3 64892500000000          mov dword ptr fs:[00000000], esp
:0044D0AA 81EC24010000            sub esp, 00000124
:0044D0B0 898DD0FEFFFF            mov dword ptr [ebp+FFFFFED0], ecx
:0044D0B6 8D8DDCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEDC]
:0044D0BC E8EF61FBFF              call 004032B0
:0044D0C1 C745FC00000000          mov [ebp-04], 00000000
:0044D0C8 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:0044D0CE C6400100                mov [eax+01], 00
:0044D0D2 6A00                    push 00000000
:0044D0D4 E80DCDFFFF              call 00449DE6
:0044D0D9 83C404                  add esp, 00000004
:0044D0DC 6A0E                    push 0000000E
:0044D0DE E838E7FDFF              call 0042B81B
:0044D0E3 83C404                  add esp, 00000004
:0044D0E6 B9B8694B00              mov ecx, 004B69B8
:0044D0EB E829750200              call 00474619
:0044D0F0 B9B0694B00              mov ecx, 004B69B0
:0044D0F5 E858750200              call 00474652
:0044D0FA 6A04                    push 00000004
:0044D0FC B9B0694B00              mov ecx, 004B69B0
:0044D101 E8C4750200              call 004746CA
:0044D106 E8CECA0200              call 00479BD9
:0044D10B 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:0044D111 E83CCDFFFF              call 00449E52
:0044D116 C60534424B0000          mov byte ptr [004B4234], 00
:0044D11D 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:0044D123 C6411000                mov [ecx+10], 00
:0044D127 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:0044D12D C7820005000000000000    mov dword ptr [ebx+00000500], 00000000
:0044D137 E804020300              call 0047D340
:0044D13C 6A01                    push 00000001
:0044D13E 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:0044D144 660FB608                movzx cx, byte ptr [eax]
:0044D148 51                      push ecx
:0044D149 E8020FFDFF              call 0041E050
:0044D14E 83C408                  add esp, 00000008

* Possible StringData Ref from Data Obj ->"LOGO.E5"
                                  |
:0044D151 68F0BA4800              push 0048BAF0
:0044D156 8D8DDCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEDC]
:0044D15C E8D429FDFF              call 0041FB35
:0044D161 6A04                    push 00000004
:0044D163 6A00                    push 00000000
:0044D165 6A00                    push 00000000
:0044D167 B968AB4A00              mov ecx, 004AAB68
:0044D16C E8CF280300              call 0047FA40
:0044D171 50                      push eax
:0044D172 6A04                    push 00000004
:0044D174 8D8DDCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEDC]
:0044D17A E80A2BFDFF              call 0041FC89
:0044D17F 8D8DDCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEDC]
:0044D185 E83BC1FCFF              call 004192C5
:0044D18A 6A04                    push 00000004
:0044D18C 6A00                    push 00000000
:0044D18E 6A00                    push 00000000
:0044D190 B968AB4A00              mov ecx, 004AAB68
:0044D195 E8A6280300              call 0047FA40
:0044D19A 50                      push eax
:0044D19B 6890010000              push 00000190
:0044D1A0 6880020000              push 00000280
:0044D1A5 6A38                    push 00000038
:0044D1A7 6A00                    push 00000000
:0044D1A9 E8ED0E0300              call 0047E09B
:0044D1AE 83C414                  add esp, 00000014
:0044D1B1 6A04                    push 00000004
:0044D1B3 B9382F4900              mov ecx, 00492F38
:0044D1B8 E8791BFCFF              call 0040ED36
:0044D1BD 8D55E4                  lea edx, dword ptr [ebp-1C]
:0044D1C0 52                      push edx
:0044D1C1 A1686A4B00              mov eax, dword ptr [004B6A68]
:0044D1C6 50                      push eax
:0044D1C7 FF15EC624800            call dword ptr [004862EC]
:0044D1CD 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0044D1D0 83C138                  add ecx, 00000038
:0044D1D3 894DE8                  mov dword ptr [ebp-18], ecx
:0044D1D6 6A01                    push 00000001
:0044D1D8 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:0044D1DE E80D270000              call 0044F8F0
:0044D1E3 50                      push eax
:0044D1E4 6A18                    push 00000018
:0044D1E6 6A02                    push 00000002
:0044D1E8 6A40                    push 00000040
:0044D1EA 83EC10                  sub esp, 00000010
:0044D1ED 8BD4                    mov edx, esp
:0044D1EF 8B45E4                  mov eax, dword ptr [ebp-1C]
:0044D1F2 8902                    mov dword ptr [edx], eax
:0044D1F4 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0044D1F7 894A04                  mov dword ptr [edx+04], ecx
:0044D1FA 8B45EC                  mov eax, dword ptr [ebp-14]
:0044D1FD 894208                  mov dword ptr [edx+08], eax
:0044D200 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044D203 894A0C                  mov dword ptr [edx+0C], ecx
:0044D206 E8ED1AFDFF              call 0041ECF8
:0044D20B 83C424                  add esp, 00000024
:0044D20E 6A01                    push 00000001
:0044D210 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:0044D216 E8D5260000              call 0044F8F0
:0044D21B 50                      push eax
:0044D21C 6A15                    push 00000015
:0044D21E 6A01                    push 00000001
:0044D220 6A40                    push 00000040
:0044D222 83EC10                  sub esp, 00000010
:0044D225 8BD4                    mov edx, esp
:0044D227 8B45E4                  mov eax, dword ptr [ebp-1C]
:0044D22A 8902                    mov dword ptr [edx], eax
:0044D22C 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0044D22F 894A04                  mov dword ptr [edx+04], ecx
:0044D232 8B45EC                  mov eax, dword ptr [ebp-14]
:0044D235 894208                  mov dword ptr [edx+08], eax
:0044D238 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044D23B 894A0C                  mov dword ptr [edx+0C], ecx
:0044D23E E8B51AFDFF              call 0041ECF8
:0044D243 83C424                  add esp, 00000024
:0044D246 6A12                    push 00000012
:0044D248 B9382F4900              mov ecx, 00492F38
:0044D24D E8321AFCFF              call 0040EC84
:0044D252 6A00                    push 00000000
:0044D254 6A00                    push 00000000
:0044D256 6A01                    push 00000001
:0044D258 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:0044D25E E88D260000              call 0044F8F0
:0044D263 50                      push eax
:0044D264 6A40                    push 00000040
:0044D266 6A20                    push 00000020
:0044D268 8D55E4                  lea edx, dword ptr [ebp-1C]
:0044D26B 52                      push edx
:0044D26C E84317FDFF              call 0041E9B4
:0044D271 83C41C                  add esp, 0000001C
:0044D274 E88C11FDFF              call 0041E405
:0044D279 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:0044D27F 33C9                    xor ecx, ecx
:0044D281 8A08                    mov cl, byte ptr [eax]
:0044D283 3B0DECBA4800            cmp ecx, dword ptr [0048BAEC]
:0044D289 7414                    je 0044D29F
:0044D28B 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:0044D291 8A02                    mov al, byte ptr [edx]
:0044D293 50                      push eax
:0044D294 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:0044D29A E844F0FFFF              call 0044C2E3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044D289(C)
|
:0044D29F 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:0044D2A5 E8C1F0FFFF              call 0044C36B
:0044D2AA 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:0044D2B0 E8D3EEFFFF              call 0044C188
:0044D2B5 E80813FDFF              call 0041E5C2
:0044D2BA 6880010000              push 00000180
:0044D2BF 6870020000              push 00000270
:0044D2C4 6A38                    push 00000038
:0044D2C6 6A00                    push 00000000
:0044D2C8 B950424B00              mov ecx, 004B4250
:0044D2CD E8E3470000              call 00451AB5
:0044D2D2 E8C8E80200              call 0047BB9F
:0044D2D7 B970074B00              mov ecx, 004B0770
:0044D2DC E82FD6FDFF              call 0042A910
:0044D2E1 2500400000              and eax, 00004000
:0044D2E6 85C0                    test eax, eax
:0044D2E8 7405                    je 0044D2EF
:0044D2EA E87CE90200              call 0047BC6B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044D2E8(C)
|
:0044D2EF C60530424B0000          mov byte ptr [004B4230], 00
:0044D2F6 C785D8FEFFFF00000000    mov dword ptr [ebp+FFFFFED8], 00000000
:0044D300 EB0F                    jmp 0044D311

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044D34B(U)
|
:0044D302 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:0044D308 83C101                  add ecx, 00000001
:0044D30B 898DD8FEFFFF            mov dword ptr [ebp+FFFFFED8], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044D300(U)
|
:0044D311 83BDD8FEFFFF73          cmp dword ptr [ebp+FFFFFED8], 00000073
:0044D318 7333                    jnb 0044D34D
:0044D31A 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:0044D320 6BC924                  imul ecx, 00000024
:0044D323 81C1502C4B00            add ecx, 004B2C50
:0044D329 E862B9FCFF              call 00418C90
:0044D32E 25FF000000              and eax, 000000FF
:0044D333 85C0                    test eax, eax
:0044D335 7414                    je 0044D34B
:0044D337 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:0044D33D 6BC924                  imul ecx, 00000024
:0044D340 81C1502C4B00            add ecx, 004B2C50
:0044D346 E8E12AFFFF              call 0043FE2C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044D335(C)
|
:0044D34B EBB5                    jmp 0044D302

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044D318(C)
|
:0044D34D E88912FDFF              call 0041E5DB
:0044D352 6A00                    push 00000000
:0044D354 E863860200              call 004759BC
:0044D359 83C404                  add esp, 00000004
:0044D35C 6A01                    push 00000001
:0044D35E 8D55E0                  lea edx, dword ptr [ebp-20]
:0044D361 52                      push edx
:0044D362 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:0044D368 E81EF0FFFF              call 0044C38B
:0044D36D 8A45E1                  mov al, byte ptr [ebp-1F]
:0044D370 50                      push eax
:0044D371 8A4DE0                  mov cl, byte ptr [ebp-20]
:0044D374 51                      push ecx
:0044D375 B950424B00              mov ecx, 004B4250
:0044D37A E8C07C0000              call 0045503F
:0044D37F B950424B00              mov ecx, 004B4250
:0044D384 E890830000              call 00455719
:0044D389 B950424B00              mov ecx, 004B4250
:0044D38E E880670000              call 00453B13
:0044D393 E85E12FDFF              call 0041E5F6
:0044D398 E86810FDFF              call 0041E405
:0044D39D E8B5F1FDFF              call 0042C557
:0044D3A2 B9B0694B00              mov ecx, 004B69B0
:0044D3A7 E8A6720200              call 00474652
:0044D3AC B970074B00              mov ecx, 004B0770
:0044D3B1 E8FAEEFCFF              call 0041C2B0
:0044D3B6 25FF000000              and eax, 000000FF
:0044D3BB 50                      push eax
:0044D3BC B9B8694B00              mov ecx, 004B69B8
:0044D3C1 E838720200              call 004745FE
:0044D3C6 6A05                    push 00000005
:0044D3C8 B9181B4B00              mov ecx, 004B1B18
:0044D3CD E86E5FFBFF              call 00403340
:0044D3D2 E809F1FDFF              call 0042C4E0
:0044D3D7 6A00                    push 00000000
:0044D3D9 E83DE4FDFF              call 0042B81B
:0044D3DE 83C404                  add esp, 00000004
:0044D3E1 8B15686A4B00            mov edx, dword ptr [004B6A68]
:0044D3E7 52                      push edx
:0044D3E8 FF15CC624800            call dword ptr [004862CC]
:0044D3EE A1686A4B00              mov eax, dword ptr [004B6A68]
:0044D3F3 50                      push eax
:0044D3F4 FF15A8624800            call dword ptr [004862A8]
:0044D3FA C685D4FEFFFF00          mov byte ptr [ebp+FFFFFED4], 00
:0044D401 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0044D408 8D8DDCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEDC]
:0044D40E E8BD5EFBFF              call 004032D0
:0044D413 8A85D4FEFFFF            mov al, byte ptr [ebp+FFFFFED4]
:0044D419 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044D41C 64890D00000000          mov dword ptr fs:[00000000], ecx
:0044D423 8BE5                    mov esp, ebp
:0044D425 5D                      pop ebp
:0044D426 C3                      ret



* Referenced by a CALL at Address:
|:0044F07A   
|
:0044D427 55                      push ebp
:0044D428 8BEC                    mov ebp, esp
:0044D42A 6AFF                    push FFFFFFFF
:0044D42C 6856564800              push 00485656
:0044D431 64A100000000            mov eax, dword ptr fs:[00000000]
:0044D437 50                      push eax
:0044D438 64892500000000          mov dword ptr fs:[00000000], esp
:0044D43F 81EC24010000            sub esp, 00000124
:0044D445 898DD0FEFFFF            mov dword ptr [ebp+FFFFFED0], ecx
:0044D44B 8D8DE0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE0]
:0044D451 E85A5EFBFF              call 004032B0
:0044D456 C745FC00000000          mov [ebp-04], 00000000
:0044D45D 6A00                    push 00000000
:0044D45F E882C9FFFF              call 00449DE6
:0044D464 83C404                  add esp, 00000004
:0044D467 6A0E                    push 0000000E
:0044D469 E8ADE3FDFF              call 0042B81B
:0044D46E 83C404                  add esp, 00000004
:0044D471 B9B8694B00              mov ecx, 004B69B8
:0044D476 E89E710200              call 00474619
:0044D47B B9B0694B00              mov ecx, 004B69B0
:0044D480 E8CD710200              call 00474652
:0044D485 6A04                    push 00000004
:0044D487 B9B0694B00              mov ecx, 004B69B0
:0044D48C E839720200              call 004746CA
:0044D491 A1F05F4B00              mov eax, dword ptr [004B5FF0]
:0044D496 50                      push eax
:0044D497 FF15C8624800            call dword ptr [004862C8]
:0044D49D 85C0                    test eax, eax
:0044D49F 740A                    je 0044D4AB
:0044D4A1 B928604B00              mov ecx, 004B6028
:0044D4A6 E8F3360100              call 00460B9E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044D49F(C)
|
:0044D4AB E829C70200              call 00479BD9
:0044D4B0 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:0044D4B6 8A11                    mov dl, byte ptr [ecx]
:0044D4B8 52                      push edx
:0044D4B9 B970074B00              mov ecx, 004B0770
:0044D4BE E84DEFFDFF              call 0042C410
:0044D4C3 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:0044D4C9 E884C9FFFF              call 00449E52
:0044D4CE C60534424B0000          mov byte ptr [004B4234], 00
:0044D4D5 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:0044D4DB C6400500                mov [eax+05], 00
:0044D4DF 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:0044D4E5 C6410100                mov [ecx+01], 00
:0044D4E9 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:0044D4EF C6420200                mov [edx+02], 00
:0044D4F3 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:0044D4F9 C6401000                mov [eax+10], 00
:0044D4FD 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:0044D503 C7410800000000          mov [ecx+08], 00000000
:0044D50A 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:0044D510 C6420C00                mov [edx+0C], 00
:0044D514 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:0044D51A C6400D00                mov [eax+0D], 00
:0044D51E 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:0044D524 C6410E00                mov [ecx+0E], 00
:0044D528 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:0044D52E C6420F00                mov [edx+0F], 00
:0044D532 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:0044D538 C780FC04000000000000    mov dword ptr [ebx+000004FC], 00000000
:0044D542 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:0044D548 8A15216E4900            mov dl, byte ptr [00496E21]
:0044D54E 885111                  mov byte ptr [ecx+11], dl
:0044D551 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:0044D557 8A0D226E4900            mov cl, byte ptr [00496E22]
:0044D55D 884804                  mov byte ptr [eax+04], cl
:0044D560 B9902F4900              mov ecx, 00492F90
:0044D565 E896230000              call 0044F900
:0044D56A 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:0044D570 884203                  mov byte ptr [edx+03], al
:0044D573 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:0044D579 C7800005000000000000    mov dword ptr [ebx+00000500], 00000000
:0044D583 C705E4BA4800FFFF0000    mov dword ptr [0048BAE4], 0000FFFF
:0044D58D C705E0BA4800FFFF0000    mov dword ptr [0048BAE0], 0000FFFF
:0044D597 E8A4FD0200              call 0047D340
:0044D59C 6A01                    push 00000001
:0044D59E 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:0044D5A4 660FB611                movzx dx, byte ptr [ecx]
:0044D5A8 52                      push edx
:0044D5A9 E8A20AFDFF              call 0041E050
:0044D5AE 83C408                  add esp, 00000008

* Possible StringData Ref from Data Obj ->"LOGO.E5"
                                  |
:0044D5B1 68F0BA4800              push 0048BAF0
:0044D5B6 8D8DE0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE0]
:0044D5BC E87425FDFF              call 0041FB35
:0044D5C1 6A04                    push 00000004
:0044D5C3 6A00                    push 00000000
:0044D5C5 6A00                    push 00000000
:0044D5C7 B968AB4A00              mov ecx, 004AAB68
:0044D5CC E86F240300              call 0047FA40
:0044D5D1 50                      push eax
:0044D5D2 6A04                    push 00000004
:0044D5D4 8D8DE0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE0]
:0044D5DA E8AA26FDFF              call 0041FC89
:0044D5DF 8D8DE0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE0]
:0044D5E5 E8DBBCFCFF              call 004192C5
:0044D5EA 6A04                    push 00000004
:0044D5EC 6A00                    push 00000000
:0044D5EE 6A00                    push 00000000
:0044D5F0 B968AB4A00              mov ecx, 004AAB68
:0044D5F5 E846240300              call 0047FA40
:0044D5FA 50                      push eax
:0044D5FB 6890010000              push 00000190
:0044D600 6880020000              push 00000280
:0044D605 6A38                    push 00000038
:0044D607 6A00                    push 00000000
:0044D609 E88D0A0300              call 0047E09B
:0044D60E 83C414                  add esp, 00000014
:0044D611 6A04                    push 00000004
:0044D613 B9382F4900              mov ecx, 00492F38
:0044D618 E81917FCFF              call 0040ED36
:0044D61D 8D45E4                  lea eax, dword ptr [ebp-1C]
:0044D620 50                      push eax
:0044D621 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:0044D627 51                      push ecx
:0044D628 FF15EC624800            call dword ptr [004862EC]
:0044D62E 8B55E8                  mov edx, dword ptr [ebp-18]
:0044D631 83C238                  add edx, 00000038
:0044D634 8955E8                  mov dword ptr [ebp-18], edx
:0044D637 6A01                    push 00000001
:0044D639 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:0044D63F E8AC220000              call 0044F8F0
:0044D644 50                      push eax
:0044D645 6A18                    push 00000018
:0044D647 6A02                    push 00000002
:0044D649 6A40                    push 00000040
:0044D64B 83EC10                  sub esp, 00000010
:0044D64E 8BC4                    mov eax, esp
:0044D650 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0044D653 8908                    mov dword ptr [eax], ecx
:0044D655 8B55E8                  mov edx, dword ptr [ebp-18]
:0044D658 895004                  mov dword ptr [eax+04], edx
:0044D65B 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0044D65E 894808                  mov dword ptr [eax+08], ecx
:0044D661 8B55F0                  mov edx, dword ptr [ebp-10]
:0044D664 89500C                  mov dword ptr [eax+0C], edx
:0044D667 E88C16FDFF              call 0041ECF8
:0044D66C 83C424                  add esp, 00000024
:0044D66F 6A01                    push 00000001
:0044D671 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:0044D677 E874220000              call 0044F8F0
:0044D67C 50                      push eax
:0044D67D 6A15                    push 00000015
:0044D67F 6A01                    push 00000001
:0044D681 6A40                    push 00000040
:0044D683 83EC10                  sub esp, 00000010
:0044D686 8BC4                    mov eax, esp
:0044D688 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0044D68B 8908                    mov dword ptr [eax], ecx
:0044D68D 8B55E8                  mov edx, dword ptr [ebp-18]
:0044D690 895004                  mov dword ptr [eax+04], edx
:0044D693 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0044D696 894808                  mov dword ptr [eax+08], ecx
:0044D699 8B55F0                  mov edx, dword ptr [ebp-10]
:0044D69C 89500C                  mov dword ptr [eax+0C], edx
:0044D69F E85416FDFF              call 0041ECF8
:0044D6A4 83C424                  add esp, 00000024
:0044D6A7 6A12                    push 00000012
:0044D6A9 B9382F4900              mov ecx, 00492F38
:0044D6AE E8D115FCFF              call 0040EC84
:0044D6B3 6A00                    push 00000000
:0044D6B5 6A00                    push 00000000
:0044D6B7 6A01                    push 00000001
:0044D6B9 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:0044D6BF E82C220000              call 0044F8F0
:0044D6C4 50                      push eax
:0044D6C5 6A40                    push 00000040
:0044D6C7 6A20                    push 00000020
:0044D6C9 8D45E4                  lea eax, dword ptr [ebp-1C]
:0044D6CC 50                      push eax
:0044D6CD E8E212FDFF              call 0041E9B4
:0044D6D2 83C41C                  add esp, 0000001C
:0044D6D5 E82B0DFDFF              call 0041E405
:0044D6DA 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:0044D6E0 8A11                    mov dl, byte ptr [ecx]
:0044D6E2 52                      push edx
:0044D6E3 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:0044D6E9 E8F5EBFFFF              call 0044C2E3
:0044D6EE C685DCFEFFFF00          mov byte ptr [ebp+FFFFFEDC], 00
:0044D6F5 EB0E                    jmp 0044D705

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044D79E(U)
|
:0044D6F7 8A85DCFEFFFF            mov al, byte ptr [ebp+FFFFFEDC]
:0044D6FD 0401                    add al, 01
:0044D6FF 8885DCFEFFFF            mov byte ptr [ebp+FFFFFEDC], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044D6F5(U)
|
:0044D705 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:0044D70B 81E1FF000000            and ecx, 000000FF
:0044D711 81F9FA000000            cmp ecx, 000000FA
:0044D717 0F8D86000000            jnl 0044D7A3
:0044D71D 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:0044D723 81E2FF000000            and edx, 000000FF
:0044D729 6BD205                  imul edx, 00000005
:0044D72C 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:0044D732 C6441019FF              mov [eax+edx+19], FF
:0044D737 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:0044D73D 81E1FF000000            and ecx, 000000FF
:0044D743 6BC905                  imul ecx, 00000005
:0044D746 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:0044D74C C6440A1AFF              mov [edx+ecx+1A], FF
:0044D751 8B85DCFEFFFF            mov eax, dword ptr [ebp+FFFFFEDC]
:0044D757 25FF000000              and eax, 000000FF
:0044D75C 6BC005                  imul eax, 00000005
:0044D75F 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:0044D765 C644011BFF              mov [ecx+eax+1B], FF
:0044D76A 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:0044D770 81E2FF000000            and edx, 000000FF
:0044D776 6BD205                  imul edx, 00000005
:0044D779 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:0044D77F C644101CFF              mov [eax+edx+1C], FF
:0044D784 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:0044D78A 81E1FF000000            and ecx, 000000FF
:0044D790 6BC905                  imul ecx, 00000005
:0044D793 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:0044D799 C6440A1DFF              mov [edx+ecx+1D], FF
:0044D79E E954FFFFFF              jmp 0044D6F7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044D717(C)
|
:0044D7A3 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:0044D7A9 E8DAE9FFFF              call 0044C188
:0044D7AE B9F05D4B00              mov ecx, 004B5DF0
:0044D7B3 E827880000              call 00455FDF
:0044D7B8 68FF000000              push 000000FF
:0044D7BD 6840060000              push 00000640
:0044D7C2 6A04                    push 00000004
:0044D7C4 6A00                    push 00000000
:0044D7C6 68800C0000              push 00000C80
:0044D7CB B938EB4A00              mov ecx, 004AEB38
:0044D7D0 E86B220300              call 0047FA40
:0044D7D5 50                      push eax
:0044D7D6 E838250300              call 0047FD13
:0044D7DB 83C40C                  add esp, 0000000C
:0044D7DE C685DCFEFFFF00          mov byte ptr [ebp+FFFFFEDC], 00
:0044D7E5 EB0E                    jmp 0044D7F5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044D827(U)
|
:0044D7E7 8A85DCFEFFFF            mov al, byte ptr [ebp+FFFFFEDC]
:0044D7ED 0401                    add al, 01
:0044D7EF 8885DCFEFFFF            mov byte ptr [ebp+FFFFFEDC], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044D7E5(U)
|
:0044D7F5 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:0044D7FB 81E1FF000000            and ecx, 000000FF
:0044D801 83F973                  cmp ecx, 00000073
:0044D804 7D23                    jge 0044D829
:0044D806 8A95DCFEFFFF            mov dl, byte ptr [ebp+FFFFFEDC]
:0044D80C 52                      push edx
:0044D80D 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:0044D813 81E1FF000000            and ecx, 000000FF
:0044D819 6BC924                  imul ecx, 00000024
:0044D81C 81C1502C4B00            add ecx, 004B2C50
:0044D822 E8EC4DFFFF              call 00442613
:0044D827 EBBE                    jmp 0044D7E7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044D804(C)
|
:0044D829 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:0044D82F E837EBFFFF              call 0044C36B
:0044D834 6A1E                    push 0000001E
:0044D836 B9181B4B00              mov ecx, 004B1B18
:0044D83B E8005BFBFF              call 00403340
:0044D840 E89BECFDFF              call 0042C4E0
:0044D845 E8780DFDFF              call 0041E5C2
:0044D84A 6880010000              push 00000180
:0044D84F 6870020000              push 00000270
:0044D854 6A38                    push 00000038
:0044D856 6A00                    push 00000000
:0044D858 B950424B00              mov ecx, 004B4250
:0044D85D E853420000              call 00451AB5
:0044D862 E838E30200              call 0047BB9F
:0044D867 B970074B00              mov ecx, 004B0770
:0044D86C E89FD0FDFF              call 0042A910
:0044D871 2500400000              and eax, 00004000
:0044D876 85C0                    test eax, eax
:0044D878 7405                    je 0044D87F
:0044D87A E8ECE30200              call 0047BC6B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044D878(C)
|
:0044D87F C60530424B0000          mov byte ptr [004B4230], 00
:0044D886 E8500DFDFF              call 0041E5DB
:0044D88B 6A00                    push 00000000
:0044D88D E82A810200              call 004759BC
:0044D892 83C404                  add esp, 00000004
:0044D895 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:0044D89B E8E5F3FFFF              call 0044CC85
:0044D8A0 C685DCFEFFFF00          mov byte ptr [ebp+FFFFFEDC], 00
:0044D8A7 EB0E                    jmp 0044D8B7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044D949(U)
|
:0044D8A9 8A85DCFEFFFF            mov al, byte ptr [ebp+FFFFFEDC]
:0044D8AF 0401                    add al, 01
:0044D8B1 8885DCFEFFFF            mov byte ptr [ebp+FFFFFEDC], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044D8A7(U)
|
:0044D8B7 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:0044D8BD 81E1FF000000            and ecx, 000000FF
:0044D8C3 83F973                  cmp ecx, 00000073
:0044D8C6 0F8D82000000            jnl 0044D94E
:0044D8CC 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:0044D8D2 81E2FF000000            and edx, 000000FF
:0044D8D8 6BD224                  imul edx, 00000024
:0044D8DB 81C2502C4B00            add edx, 004B2C50
:0044D8E1 8995D4FEFFFF            mov dword ptr [ebp+FFFFFED4], edx
:0044D8E7 6880000000              push 00000080
:0044D8EC 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:0044D8F2 E8998DFBFF              call 00406690
:0044D8F7 6A1E                    push 0000001E
:0044D8F9 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:0044D8FF E89CB4FCFF              call 00418DA0
:0044D904 8B85DCFEFFFF            mov eax, dword ptr [ebp+FFFFFEDC]
:0044D90A 25FF000000              and eax, 000000FF
:0044D90F 83F823                  cmp eax, 00000023
:0044D912 7D35                    jge 0044D949
:0044D914 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:0044D91A E871B3FCFF              call 00418C90
:0044D91F 25FF000000              and eax, 000000FF
:0044D924 85C0                    test eax, eax
:0044D926 7421                    je 0044D949
:0044D928 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:0044D92E E8E722FFFF              call 0043FC1A
:0044D933 25FF000000              and eax, 000000FF
:0044D938 85C0                    test eax, eax
:0044D93A 750D                    jne 0044D949

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0044D93C 6A07                    push 00000007
:0044D93E 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:0044D944 E8204DFFFF              call 00442669

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044D912(C), :0044D926(C), :0044D93A(C)
|
:0044D949 E95BFFFFFF              jmp 0044D8A9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044D8C6(C)
|
:0044D94E C685DCFEFFFF00          mov byte ptr [ebp+FFFFFEDC], 00
:0044D955 EB0F                    jmp 0044D966

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044D9B4(U)
|
:0044D957 8A8DDCFEFFFF            mov cl, byte ptr [ebp+FFFFFEDC]
:0044D95D 80C101                  add cl, 01
:0044D960 888DDCFEFFFF            mov byte ptr [ebp+FFFFFEDC], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044D955(U)
|
:0044D966 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:0044D96C 81E2FF000000            and edx, 000000FF
:0044D972 83FA73                  cmp edx, 00000073
:0044D975 7D3F                    jge 0044D9B6
:0044D977 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:0044D97D 81E1FF000000            and ecx, 000000FF
:0044D983 6BC924                  imul ecx, 00000024
:0044D986 81C1502C4B00            add ecx, 004B2C50
:0044D98C E8FFB2FCFF              call 00418C90
:0044D991 25FF000000              and eax, 000000FF
:0044D996 85C0                    test eax, eax
:0044D998 741A                    je 0044D9B4
:0044D99A 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:0044D9A0 81E1FF000000            and ecx, 000000FF
:0044D9A6 6BC924                  imul ecx, 00000024
:0044D9A9 81C1502C4B00            add ecx, 004B2C50
:0044D9AF E87824FFFF              call 0043FE2C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044D998(C)
|
:0044D9B4 EBA1                    jmp 0044D957

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044D975(C)
|
:0044D9B6 6A00                    push 00000000
:0044D9B8 8D85D8FEFFFF            lea eax, dword ptr [ebp+FFFFFED8]
:0044D9BE 50                      push eax
:0044D9BF 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:0044D9C5 E8C1E9FFFF              call 0044C38B
:0044D9CA 8A8DD9FEFFFF            mov cl, byte ptr [ebp+FFFFFED9]
:0044D9D0 51                      push ecx
:0044D9D1 8A95D8FEFFFF            mov dl, byte ptr [ebp+FFFFFED8]
:0044D9D7 52                      push edx
:0044D9D8 B950424B00              mov ecx, 004B4250
:0044D9DD E85D760000              call 0045503F
:0044D9E2 B950424B00              mov ecx, 004B4250
:0044D9E7 E82D7D0000              call 00455719
:0044D9EC B950424B00              mov ecx, 004B4250
:0044D9F1 E81D610000              call 00453B13
:0044D9F6 E8FB0BFDFF              call 0041E5F6
:0044D9FB B9B0694B00              mov ecx, 004B69B0
:0044DA00 E84D6C0200              call 00474652
:0044DA05 6A00                    push 00000000
:0044DA07 E80FDEFDFF              call 0042B81B
:0044DA0C 83C404                  add esp, 00000004
:0044DA0F A1686A4B00              mov eax, dword ptr [004B6A68]
:0044DA14 50                      push eax
:0044DA15 FF15A8624800            call dword ptr [004862A8]
:0044DA1B E837EBFDFF              call 0042C557
:0044DA20 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:0044DA26 C7811C05000000000000    mov dword ptr [ebx+0000051C], 00000000
:0044DA30 B950424B00              mov ecx, 004B4250
:0044DA35 E80A840000              call 00455E44
:0044DA3A 50                      push eax
:0044DA3B B950424B00              mov ecx, 004B4250
:0044DA40 E85E840000              call 00455EA3
:0044DA45 B950424B00              mov ecx, 004B4250
:0044DA4A E81C840000              call 00455E6B
:0044DA4F 50                      push eax
:0044DA50 B950424B00              mov ecx, 004B4250
:0044DA55 E870840000              call 00455ECA
:0044DA5A C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0044DA61 8D8DE0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE0]
:0044DA67 E86458FBFF              call 004032D0
:0044DA6C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044DA6F 64890D00000000          mov dword ptr fs:[00000000], ecx
:0044DA76 8BE5                    mov esp, ebp
:0044DA78 5D                      pop ebp
:0044DA79 C3                      ret



* Referenced by a CALL at Addresses:
|:0044E9B3   , :0044EBD9   
|
:0044DA7A 55                      push ebp
:0044DA7B 8BEC                    mov ebp, esp
:0044DA7D 83EC20                  sub esp, 00000020
:0044DA80 894DE8                  mov dword ptr [ebp-18], ecx
:0044DA83 837D0800                cmp dword ptr [ebp+08], 00000000
:0044DA87 740A                    je 0044DA93
:0044DA89 C645F800                mov [ebp-08], 00
:0044DA8D C645F023                mov [ebp-10], 23
:0044DA91 EB08                    jmp 0044DA9B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044DA87(C)
|
:0044DA93 C645F823                mov [ebp-08], 23
:0044DA97 C645F073                mov [ebp-10], 73

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044DA91(U)
|
:0044DA9B 8A45F8                  mov al, byte ptr [ebp-08]
:0044DA9E 8845F4                  mov byte ptr [ebp-0C], al
:0044DAA1 EB09                    jmp 0044DAAC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044DADD(U)
|
:0044DAA3 8A4DF4                  mov cl, byte ptr [ebp-0C]
:0044DAA6 80C101                  add cl, 01
:0044DAA9 884DF4                  mov byte ptr [ebp-0C], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044DAA1(U)
|
:0044DAAC 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044DAAF 81E2FF000000            and edx, 000000FF
:0044DAB5 8B45F0                  mov eax, dword ptr [ebp-10]
:0044DAB8 25FF000000              and eax, 000000FF
:0044DABD 3BD0                    cmp edx, eax
:0044DABF 7D1E                    jge 0044DADF
:0044DAC1 68FF000000              push 000000FF
:0044DAC6 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044DAC9 81E1FF000000            and ecx, 000000FF
:0044DACF 6BC924                  imul ecx, 00000024
:0044DAD2 81C1502C4B00            add ecx, 004B2C50
:0044DAD8 E8A31E0000              call 0044F980
:0044DADD EBC4                    jmp 0044DAA3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044DABF(C)
|
:0044DADF C645FC00                mov [ebp-04], 00
:0044DAE3 8A4DF8                  mov cl, byte ptr [ebp-08]
:0044DAE6 884DF4                  mov byte ptr [ebp-0C], cl
:0044DAE9 EB09                    jmp 0044DAF4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044DB2E(U), :0044DBAA(U)
|
:0044DAEB 8A55F4                  mov dl, byte ptr [ebp-0C]
:0044DAEE 80C201                  add dl, 01
:0044DAF1 8855F4                  mov byte ptr [ebp-0C], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044DAE9(U)
|
:0044DAF4 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044DAF7 25FF000000              and eax, 000000FF
:0044DAFC 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044DAFF 81E1FF000000            and ecx, 000000FF
:0044DB05 3BC1                    cmp eax, ecx
:0044DB07 0F8DA2000000            jnl 0044DBAF
:0044DB0D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044DB10 81E1FF000000            and ecx, 000000FF
:0044DB16 6BC924                  imul ecx, 00000024
:0044DB19 81C1502C4B00            add ecx, 004B2C50
:0044DB1F E86CB1FCFF              call 00418C90
:0044DB24 25FF000000              and eax, 000000FF
:0044DB29 83F802                  cmp eax, 00000002
:0044DB2C 7402                    je 0044DB30
:0044DB2E EBBB                    jmp 0044DAEB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044DB2C(C)
|
:0044DB30 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044DB33 81E1FF000000            and ecx, 000000FF
:0044DB39 6BC924                  imul ecx, 00000024
:0044DB3C 81C1502C4B00            add ecx, 004B2C50
:0044DB42 E81958FBFF              call 00403360
:0044DB47 668B10                  mov dx, word ptr [eax]
:0044DB4A 668955EC                mov word ptr [ebp-14], dx
:0044DB4E 8D45EC                  lea eax, dword ptr [ebp-14]
:0044DB51 50                      push eax
:0044DB52 E86976FEFF              call 004351C0
:0044DB57 83C404                  add esp, 00000004
:0044DB5A 85C0                    test eax, eax
:0044DB5C 744C                    je 0044DBAA
:0044DB5E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044DB61 81E1FF000000            and ecx, 000000FF
:0044DB67 6BC924                  imul ecx, 00000024
:0044DB6A 81C1502C4B00            add ecx, 004B2C50
:0044DB70 E83B7FFDFF              call 00425AB0
:0044DB75 25FF000000              and eax, 000000FF
:0044DB7A 3DFF000000              cmp eax, 000000FF
:0044DB7F 7529                    jne 0044DBAA
:0044DB81 8A4DFC                  mov cl, byte ptr [ebp-04]
:0044DB84 884DE7                  mov byte ptr [ebp-19], cl
:0044DB87 8A55E7                  mov dl, byte ptr [ebp-19]
:0044DB8A 52                      push edx
:0044DB8B 8A45FC                  mov al, byte ptr [ebp-04]
:0044DB8E 0401                    add al, 01
:0044DB90 8845FC                  mov byte ptr [ebp-04], al
:0044DB93 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044DB96 81E1FF000000            and ecx, 000000FF
:0044DB9C 6BC924                  imul ecx, 00000024
:0044DB9F 81C1502C4B00            add ecx, 004B2C50
:0044DBA5 E8D61D0000              call 0044F980

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044DB5C(C), :0044DB7F(C)
|
:0044DBAA E93CFFFFFF              jmp 0044DAEB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044DB07(C)
|
:0044DBAF 8A4DF8                  mov cl, byte ptr [ebp-08]
:0044DBB2 884DF4                  mov byte ptr [ebp-0C], cl
:0044DBB5 EB09                    jmp 0044DBC0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044DBFA(U), :0044DC64(U)
|
:0044DBB7 8A55F4                  mov dl, byte ptr [ebp-0C]
:0044DBBA 80C201                  add dl, 01
:0044DBBD 8855F4                  mov byte ptr [ebp-0C], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044DBB5(U)
|
:0044DBC0 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044DBC3 25FF000000              and eax, 000000FF
:0044DBC8 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044DBCB 81E1FF000000            and ecx, 000000FF
:0044DBD1 3BC1                    cmp eax, ecx
:0044DBD3 0F8D90000000            jnl 0044DC69
:0044DBD9 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044DBDC 81E1FF000000            and ecx, 000000FF
:0044DBE2 6BC924                  imul ecx, 00000024
:0044DBE5 81C1502C4B00            add ecx, 004B2C50
:0044DBEB E8A0B0FCFF              call 00418C90
:0044DBF0 25FF000000              and eax, 000000FF
:0044DBF5 83F802                  cmp eax, 00000002
:0044DBF8 7402                    je 0044DBFC
:0044DBFA EBBB                    jmp 0044DBB7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044DBF8(C)
|
:0044DBFC 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044DBFF 81E1FF000000            and ecx, 000000FF
:0044DC05 6BC924                  imul ecx, 00000024
:0044DC08 81C1502C4B00            add ecx, 004B2C50
:0044DC0E E8E1C5FEFF              call 0043A1F4
:0044DC13 85C0                    test eax, eax
:0044DC15 744D                    je 0044DC64
:0044DC17 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044DC1A 81E1FF000000            and ecx, 000000FF
:0044DC20 6BC924                  imul ecx, 00000024
:0044DC23 81C1502C4B00            add ecx, 004B2C50
:0044DC29 E8827EFDFF              call 00425AB0
:0044DC2E 25FF000000              and eax, 000000FF
:0044DC33 3DFF000000              cmp eax, 000000FF
:0044DC38 752A                    jne 0044DC64
:0044DC3A 8A55FC                  mov dl, byte ptr [ebp-04]
:0044DC3D 8855E6                  mov byte ptr [ebp-1A], dl
:0044DC40 8A45E6                  mov al, byte ptr [ebp-1A]
:0044DC43 50                      push eax
:0044DC44 8A4DFC                  mov cl, byte ptr [ebp-04]
:0044DC47 80C101                  add cl, 01
:0044DC4A 884DFC                  mov byte ptr [ebp-04], cl
:0044DC4D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044DC50 81E1FF000000            and ecx, 000000FF
:0044DC56 6BC924                  imul ecx, 00000024
:0044DC59 81C1502C4B00            add ecx, 004B2C50
:0044DC5F E81C1D0000              call 0044F980

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044DC15(C), :0044DC38(C)
|
:0044DC64 E94EFFFFFF              jmp 0044DBB7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044DBD3(C)
|
:0044DC69 8A55F8                  mov dl, byte ptr [ebp-08]
:0044DC6C 8855F4                  mov byte ptr [ebp-0C], dl
:0044DC6F EB08                    jmp 0044DC79

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044DCB4(U), :0044DD48(U)
|
:0044DC71 8A45F4                  mov al, byte ptr [ebp-0C]
:0044DC74 0401                    add al, 01
:0044DC76 8845F4                  mov byte ptr [ebp-0C], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044DC6F(U)
|
:0044DC79 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044DC7C 81E1FF000000            and ecx, 000000FF
:0044DC82 8B55F0                  mov edx, dword ptr [ebp-10]
:0044DC85 81E2FF000000            and edx, 000000FF
:0044DC8B 3BCA                    cmp ecx, edx
:0044DC8D 0F8DBA000000            jnl 0044DD4D
:0044DC93 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044DC96 81E1FF000000            and ecx, 000000FF
:0044DC9C 6BC924                  imul ecx, 00000024
:0044DC9F 81C1502C4B00            add ecx, 004B2C50
:0044DCA5 E8E6AFFCFF              call 00418C90
:0044DCAA 25FF000000              and eax, 000000FF
:0044DCAF 83F802                  cmp eax, 00000002
:0044DCB2 7402                    je 0044DCB6
:0044DCB4 EBBB                    jmp 0044DC71

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044DCB2(C)
|
:0044DCB6 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044DCB9 81E1FF000000            and ecx, 000000FF
:0044DCBF 6BC924                  imul ecx, 00000024
:0044DCC2 81C1502C4B00            add ecx, 004B2C50
:0044DCC8 E82023FFFF              call 0043FFED
:0044DCCD 85C0                    test eax, eax
:0044DCCF 7477                    je 0044DD48
:0044DCD1 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044DCD4 81E1FF000000            and ecx, 000000FF
:0044DCDA 6BC924                  imul ecx, 00000024
:0044DCDD 81C1502C4B00            add ecx, 004B2C50
:0044DCE3 E88802FDFF              call 0041DF70
:0044DCE8 50                      push eax
:0044DCE9 E8188CFBFF              call 00406906
:0044DCEE 83C404                  add esp, 00000004
:0044DCF1 25FF000000              and eax, 000000FF
:0044DCF6 83F809                  cmp eax, 00000009
:0044DCF9 744D                    je 0044DD48
:0044DCFB 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044DCFE 81E1FF000000            and ecx, 000000FF
:0044DD04 6BC924                  imul ecx, 00000024
:0044DD07 81C1502C4B00            add ecx, 004B2C50
:0044DD0D E89E7DFDFF              call 00425AB0
:0044DD12 25FF000000              and eax, 000000FF
:0044DD17 3DFF000000              cmp eax, 000000FF
:0044DD1C 752A                    jne 0044DD48
:0044DD1E 8A45FC                  mov al, byte ptr [ebp-04]
:0044DD21 8845E5                  mov byte ptr [ebp-1B], al
:0044DD24 8A4DE5                  mov cl, byte ptr [ebp-1B]
:0044DD27 51                      push ecx
:0044DD28 8A55FC                  mov dl, byte ptr [ebp-04]
:0044DD2B 80C201                  add dl, 01
:0044DD2E 8855FC                  mov byte ptr [ebp-04], dl
:0044DD31 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044DD34 81E1FF000000            and ecx, 000000FF
:0044DD3A 6BC924                  imul ecx, 00000024
:0044DD3D 81C1502C4B00            add ecx, 004B2C50
:0044DD43 E8381C0000              call 0044F980

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044DCCF(C), :0044DCF9(C), :0044DD1C(C)
|
:0044DD48 E924FFFFFF              jmp 0044DC71

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044DC8D(C)
|
:0044DD4D 8A45F8                  mov al, byte ptr [ebp-08]
:0044DD50 8845F4                  mov byte ptr [ebp-0C], al
:0044DD53 EB09                    jmp 0044DD5E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044DD98(U), :0044DE01(U)
|
:0044DD55 8A4DF4                  mov cl, byte ptr [ebp-0C]
:0044DD58 80C101                  add cl, 01
:0044DD5B 884DF4                  mov byte ptr [ebp-0C], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044DD53(U)
|
:0044DD5E 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044DD61 81E2FF000000            and edx, 000000FF
:0044DD67 8B45F0                  mov eax, dword ptr [ebp-10]
:0044DD6A 25FF000000              and eax, 000000FF
:0044DD6F 3BD0                    cmp edx, eax
:0044DD71 0F8D8F000000            jnl 0044DE06
:0044DD77 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044DD7A 81E1FF000000            and ecx, 000000FF
:0044DD80 6BC924                  imul ecx, 00000024
:0044DD83 81C1502C4B00            add ecx, 004B2C50
:0044DD89 E802AFFCFF              call 00418C90
:0044DD8E 25FF000000              and eax, 000000FF
:0044DD93 83F802                  cmp eax, 00000002
:0044DD96 7402                    je 0044DD9A
:0044DD98 EBBB                    jmp 0044DD55

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044DD96(C)
|
:0044DD9A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044DD9D 81E1FF000000            and ecx, 000000FF
:0044DDA3 6BC924                  imul ecx, 00000024
:0044DDA6 81C1502C4B00            add ecx, 004B2C50
:0044DDAC E8AC22FFFF              call 0044005D
:0044DDB1 85C0                    test eax, eax
:0044DDB3 744C                    je 0044DE01
:0044DDB5 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044DDB8 81E1FF000000            and ecx, 000000FF
:0044DDBE 6BC924                  imul ecx, 00000024
:0044DDC1 81C1502C4B00            add ecx, 004B2C50
:0044DDC7 E8E47CFDFF              call 00425AB0
:0044DDCC 25FF000000              and eax, 000000FF
:0044DDD1 3DFF000000              cmp eax, 000000FF
:0044DDD6 7529                    jne 0044DE01
:0044DDD8 8A4DFC                  mov cl, byte ptr [ebp-04]
:0044DDDB 884DE4                  mov byte ptr [ebp-1C], cl
:0044DDDE 8A55E4                  mov dl, byte ptr [ebp-1C]
:0044DDE1 52                      push edx
:0044DDE2 8A45FC                  mov al, byte ptr [ebp-04]
:0044DDE5 0401                    add al, 01
:0044DDE7 8845FC                  mov byte ptr [ebp-04], al
:0044DDEA 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044DDED 81E1FF000000            and ecx, 000000FF
:0044DDF3 6BC924                  imul ecx, 00000024
:0044DDF6 81C1502C4B00            add ecx, 004B2C50
:0044DDFC E87F1B0000              call 0044F980

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044DDB3(C), :0044DDD6(C)
|
:0044DE01 E94FFFFFFF              jmp 0044DD55

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044DD71(C)
|
:0044DE06 8A4DF8                  mov cl, byte ptr [ebp-08]
:0044DE09 884DF4                  mov byte ptr [ebp-0C], cl
:0044DE0C EB09                    jmp 0044DE17

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044DE51(U), :0044DEBB(U)
|
:0044DE0E 8A55F4                  mov dl, byte ptr [ebp-0C]
:0044DE11 80C201                  add dl, 01
:0044DE14 8855F4                  mov byte ptr [ebp-0C], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044DE0C(U)
|
:0044DE17 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044DE1A 25FF000000              and eax, 000000FF
:0044DE1F 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044DE22 81E1FF000000            and ecx, 000000FF
:0044DE28 3BC1                    cmp eax, ecx
:0044DE2A 0F8D90000000            jnl 0044DEC0
:0044DE30 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044DE33 81E1FF000000            and ecx, 000000FF
:0044DE39 6BC924                  imul ecx, 00000024
:0044DE3C 81C1502C4B00            add ecx, 004B2C50
:0044DE42 E849AEFCFF              call 00418C90
:0044DE47 25FF000000              and eax, 000000FF
:0044DE4C 83F802                  cmp eax, 00000002
:0044DE4F 7402                    je 0044DE53
:0044DE51 EBBB                    jmp 0044DE0E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044DE4F(C)
|
:0044DE53 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044DE56 81E1FF000000            and ecx, 000000FF
:0044DE5C 6BC924                  imul ecx, 00000024
:0044DE5F 81C1502C4B00            add ecx, 004B2C50
:0044DE65 E80421FFFF              call 0043FF6E
:0044DE6A 85C0                    test eax, eax
:0044DE6C 744D                    je 0044DEBB
:0044DE6E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044DE71 81E1FF000000            and ecx, 000000FF
:0044DE77 6BC924                  imul ecx, 00000024
:0044DE7A 81C1502C4B00            add ecx, 004B2C50
:0044DE80 E82B7CFDFF              call 00425AB0
:0044DE85 25FF000000              and eax, 000000FF
:0044DE8A 3DFF000000              cmp eax, 000000FF
:0044DE8F 752A                    jne 0044DEBB
:0044DE91 8A55FC                  mov dl, byte ptr [ebp-04]
:0044DE94 8855E3                  mov byte ptr [ebp-1D], dl
:0044DE97 8A45E3                  mov al, byte ptr [ebp-1D]
:0044DE9A 50                      push eax
:0044DE9B 8A4DFC                  mov cl, byte ptr [ebp-04]
:0044DE9E 80C101                  add cl, 01
:0044DEA1 884DFC                  mov byte ptr [ebp-04], cl
:0044DEA4 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044DEA7 81E1FF000000            and ecx, 000000FF
:0044DEAD 6BC924                  imul ecx, 00000024
:0044DEB0 81C1502C4B00            add ecx, 004B2C50
:0044DEB6 E8C51A0000              call 0044F980

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044DE6C(C), :0044DE8F(C)
|
:0044DEBB E94EFFFFFF              jmp 0044DE0E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044DE2A(C)
|
:0044DEC0 8A55F8                  mov dl, byte ptr [ebp-08]
:0044DEC3 8855F4                  mov byte ptr [ebp-0C], dl
:0044DEC6 EB08                    jmp 0044DED0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044DF07(U), :0044DF56(U)
|
:0044DEC8 8A45F4                  mov al, byte ptr [ebp-0C]
:0044DECB 0401                    add al, 01
:0044DECD 8845F4                  mov byte ptr [ebp-0C], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044DEC6(U)
|
:0044DED0 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044DED3 81E1FF000000            and ecx, 000000FF
:0044DED9 8B55F0                  mov edx, dword ptr [ebp-10]
:0044DEDC 81E2FF000000            and edx, 000000FF
:0044DEE2 3BCA                    cmp ecx, edx
:0044DEE4 7D75                    jge 0044DF5B
:0044DEE6 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044DEE9 81E1FF000000            and ecx, 000000FF
:0044DEEF 6BC924                  imul ecx, 00000024
:0044DEF2 81C1502C4B00            add ecx, 004B2C50
:0044DEF8 E893ADFCFF              call 00418C90
:0044DEFD 25FF000000              and eax, 000000FF
:0044DF02 83F802                  cmp eax, 00000002
:0044DF05 7402                    je 0044DF09
:0044DF07 EBBF                    jmp 0044DEC8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044DF05(C)
|
:0044DF09 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044DF0C 81E1FF000000            and ecx, 000000FF
:0044DF12 6BC924                  imul ecx, 00000024
:0044DF15 81C1502C4B00            add ecx, 004B2C50
:0044DF1B E8907BFDFF              call 00425AB0
:0044DF20 25FF000000              and eax, 000000FF
:0044DF25 3DFF000000              cmp eax, 000000FF
:0044DF2A 752A                    jne 0044DF56
:0044DF2C 8A45FC                  mov al, byte ptr [ebp-04]
:0044DF2F 8845E2                  mov byte ptr [ebp-1E], al
:0044DF32 8A4DE2                  mov cl, byte ptr [ebp-1E]
:0044DF35 51                      push ecx
:0044DF36 8A55FC                  mov dl, byte ptr [ebp-04]
:0044DF39 80C201                  add dl, 01
:0044DF3C 8855FC                  mov byte ptr [ebp-04], dl
:0044DF3F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044DF42 81E1FF000000            and ecx, 000000FF
:0044DF48 6BC924                  imul ecx, 00000024
:0044DF4B 81C1502C4B00            add ecx, 004B2C50
:0044DF51 E82A1A0000              call 0044F980

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044DF2A(C)
|
:0044DF56 E96DFFFFFF              jmp 0044DEC8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044DEE4(C)
|
:0044DF5B 8BE5                    mov esp, ebp
:0044DF5D 5D                      pop ebp
:0044DF5E C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0044E938   , :0044EE39   
|
:0044DF61 55                      push ebp
:0044DF62 8BEC                    mov ebp, esp
:0044DF64 83EC1C                  sub esp, 0000001C
:0044DF67 894DE8                  mov dword ptr [ebp-18], ecx
:0044DF6A 8B4508                  mov eax, dword ptr [ebp+08]
:0044DF6D F7D8                    neg eax
:0044DF6F 1BC0                    sbb eax, eax
:0044DF71 83E023                  and eax, 00000023
:0044DF74 8945F4                  mov dword ptr [ebp-0C], eax
:0044DF77 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044DF7A F7D9                    neg ecx
:0044DF7C 1BC9                    sbb ecx, ecx
:0044DF7E 83E150                  and ecx, 00000050
:0044DF81 83C123                  add ecx, 00000023
:0044DF84 894DEC                  mov dword ptr [ebp-14], ecx
:0044DF87 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0044DF8A E881170100              call 0045F710
:0044DF8F C745F800000000          mov [ebp-08], 00000000
:0044DF96 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044DF99 8955F0                  mov dword ptr [ebp-10], edx
:0044DF9C EB09                    jmp 0044DFA7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044E0CE(U)
|
:0044DF9E 8B45F0                  mov eax, dword ptr [ebp-10]
:0044DFA1 83C001                  add eax, 00000001
:0044DFA4 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044DF9C(U)
|
:0044DFA7 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044DFAA 3B4DEC                  cmp ecx, dword ptr [ebp-14]
:0044DFAD 0F8320010000            jnb 0044E0D3
:0044DFB3 6A10                    push 00000010
:0044DFB5 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044DFB8 6BC924                  imul ecx, 00000024
:0044DFBB 81C1502C4B00            add ecx, 004B2C50
:0044DFC1 E81A87FBFF              call 004066E0
:0044DFC6 85C0                    test eax, eax
:0044DFC8 0F8400010000            je 0044E0CE
:0044DFCE 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044DFD1 6BC924                  imul ecx, 00000024
:0044DFD4 81C1502C4B00            add ecx, 004B2C50
:0044DFDA E891160100              call 0045F670
:0044DFDF 8BC8                    mov ecx, eax
:0044DFE1 6BC948                  imul ecx, 00000048
:0044DFE4 81C1681B4A00            add ecx, 004A1B68
:0044DFEA E82C92FBFF              call 0040721B
:0044DFEF 33D2                    xor edx, edx
:0044DFF1 B90A000000              mov ecx, 0000000A
:0044DFF6 F7F1                    div ecx
:0044DFF8 8945F8                  mov dword ptr [ebp-08], eax
:0044DFFB 837DF800                cmp dword ptr [ebp-08], 00000000
:0044DFFF 7509                    jne 0044E00A
:0044E001 C745E401000000          mov [ebp-1C], 00000001
:0044E008 EB06                    jmp 0044E010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044DFFF(C)
|
:0044E00A 8B55F8                  mov edx, dword ptr [ebp-08]
:0044E00D 8955E4                  mov dword ptr [ebp-1C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044E008(U)
|
:0044E010 8B45E4                  mov eax, dword ptr [ebp-1C]
:0044E013 8945F8                  mov dword ptr [ebp-08], eax
:0044E016 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044E019 6BC924                  imul ecx, 00000024
:0044E01C 81C1502C4B00            add ecx, 004B2C50
:0044E022 E8694C0200              call 00472C90
:0044E027 3B45F8                  cmp eax, dword ptr [ebp-08]
:0044E02A 7717                    ja 0044E043
:0044E02C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044E02F 6BC924                  imul ecx, 00000024
:0044E032 81C1502C4B00            add ecx, 004B2C50
:0044E038 E8534C0200              call 00472C90
:0044E03D 83E801                  sub eax, 00000001
:0044E040 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044E02A(C)
|
:0044E043 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044E046 6BC924                  imul ecx, 00000024
:0044E049 81C1502C4B00            add ecx, 004B2C50
:0044E04F E80C53FBFF              call 00403360
:0044E054 50                      push eax
:0044E055 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0044E058 E84385FBFF              call 004065A0
:0044E05D 8A4DFD                  mov cl, byte ptr [ebp-03]
:0044E060 51                      push ecx
:0044E061 8A55FC                  mov dl, byte ptr [ebp-04]
:0044E064 52                      push edx
:0044E065 B950424B00              mov ecx, 004B4250
:0044E06A E8D06F0000              call 0045503F
:0044E06F 6A01                    push 00000001
:0044E071 6A00                    push 00000000
:0044E073 6A00                    push 00000000
:0044E075 6A00                    push 00000000
:0044E077 6A00                    push 00000000
:0044E079 8B45F8                  mov eax, dword ptr [ebp-08]
:0044E07C 50                      push eax
:0044E07D 68FF000000              push 000000FF
:0044E082 8A4DF0                  mov cl, byte ptr [ebp-10]
:0044E085 51                      push ecx
:0044E086 E8F9280000              call 00450984
:0044E08B 83C420                  add esp, 00000020
:0044E08E 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044E091 6BC924                  imul ecx, 00000024
:0044E094 81C1502C4B00            add ecx, 004B2C50
:0044E09A E8F14B0200              call 00472C90
:0044E09F 2B45F8                  sub eax, dword ptr [ebp-08]
:0044E0A2 50                      push eax
:0044E0A3 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044E0A6 6BC924                  imul ecx, 00000024
:0044E0A9 81C1502C4B00            add ecx, 004B2C50
:0044E0AF E81916FFFF              call 0043F6CD
:0044E0B4 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044E0B7 6BC924                  imul ecx, 00000024
:0044E0BA 81C1502C4B00            add ecx, 004B2C50
:0044E0C0 E8AB150100              call 0045F670
:0044E0C5 50                      push eax
:0044E0C6 E836B90200              call 00479A01
:0044E0CB 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044DFC8(C)
|
:0044E0CE E9CBFEFFFF              jmp 0044DF9E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044DFAD(C)
|
:0044E0D3 8BE5                    mov esp, ebp
:0044E0D5 5D                      pop ebp
:0044E0D6 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0044EE8D   
|
:0044E0D9 55                      push ebp
:0044E0DA 8BEC                    mov ebp, esp
:0044E0DC 83EC38                  sub esp, 00000038
:0044E0DF 894DC8                  mov dword ptr [ebp-38], ecx
:0044E0E2 C645ECFF                mov [ebp-14], FF
:0044E0E6 C645DCFF                mov [ebp-24], FF
:0044E0EA 8D4DE0                  lea ecx, dword ptr [ebp-20]
:0044E0ED E81E160100              call 0045F710
:0044E0F2 C745F401000000          mov [ebp-0C], 00000001
:0044E0F9 C745E400000000          mov [ebp-1C], 00000000
:0044E100 8B45C8                  mov eax, dword ptr [ebp-38]
:0044E103 33C9                    xor ecx, ecx
:0044E105 8A4801                  mov cl, byte ptr [eax+01]
:0044E108 85C9                    test ecx, ecx
:0044E10A 7405                    je 0044E111
:0044E10C E9F1050000              jmp 0044E702

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044E10A(C)
|
:0044E111 C745F000000000          mov [ebp-10], 00000000
:0044E118 EB09                    jmp 0044E123

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044E18C(U)
|
:0044E11A 8B55F0                  mov edx, dword ptr [ebp-10]
:0044E11D 83C201                  add edx, 00000001
:0044E120 8955F0                  mov dword ptr [ebp-10], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044E118(U)
|
:0044E123 837DF023                cmp dword ptr [ebp-10], 00000023
:0044E127 7365                    jnb 0044E18E
:0044E129 8B45C8                  mov eax, dword ptr [ebp-38]
:0044E12C 33C9                    xor ecx, ecx
:0044E12E 8A4801                  mov cl, byte ptr [eax+01]
:0044E131 85C9                    test ecx, ecx
:0044E133 7559                    jne 0044E18E
:0044E135 6880000000              push 00000080
:0044E13A 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044E13D 6BC924                  imul ecx, 00000024
:0044E140 81C1502C4B00            add ecx, 004B2C50
:0044E146 E8A579FDFF              call 00425AF0
:0044E14B 85C0                    test eax, eax
:0044E14D 753D                    jne 0044E18C
:0044E14F 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044E152 6BC924                  imul ecx, 00000024
:0044E155 81C1502C4B00            add ecx, 004B2C50
:0044E15B E87079FDFF              call 00425AD0
:0044E160 25FF000000              and eax, 000000FF
:0044E165 83F807                  cmp eax, 00000007
:0044E168 7522                    jne 0044E18C
:0044E16A 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044E16D 6BC924                  imul ecx, 00000024
:0044E170 81C1502C4B00            add ecx, 004B2C50
:0044E176 E815ABFCFF              call 00418C90
:0044E17B 25FF000000              and eax, 000000FF
:0044E180 83F802                  cmp eax, 00000002
:0044E183 7507                    jne 0044E18C
:0044E185 C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044E14D(C), :0044E168(C), :0044E183(C)
|
:0044E18C EB8C                    jmp 0044E11A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044E127(C), :0044E133(C)
|
:0044E18E 6A01                    push 00000001
:0044E190 8D55FC                  lea edx, dword ptr [ebp-04]
:0044E193 52                      push edx
:0044E194 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0044E197 E8EFE1FFFF              call 0044C38B
:0044E19C 8A45FD                  mov al, byte ptr [ebp-03]
:0044E19F 50                      push eax
:0044E1A0 8A4DFC                  mov cl, byte ptr [ebp-04]
:0044E1A3 51                      push ecx
:0044E1A4 B950424B00              mov ecx, 004B4250
:0044E1A9 E8916E0000              call 0045503F
:0044E1AE 8B55C8                  mov edx, dword ptr [ebp-38]
:0044E1B1 C6420500                mov [edx+05], 00
:0044E1B5 6A01                    push 00000001
:0044E1B7 E800780200              call 004759BC
:0044E1BC 83C404                  add esp, 00000004
:0044E1BF 6A00                    push 00000000
:0044E1C1 E855D6FDFF              call 0042B81B
:0044E1C6 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044E6E9(U)
|
:0044E1C9 837DF400                cmp dword ptr [ebp-0C], 00000000
:0044E1CD FF2514D04C00            jmp dword ptr [004CD014]
:0044E1D3 E8EC080300              call 0047EAC4
:0044E1D8 C745F000000000          mov [ebp-10], 00000000
:0044E1DF EB09                    jmp 0044E1EA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044E6E4(U)
|
:0044E1E1 8B45F0                  mov eax, dword ptr [ebp-10]
:0044E1E4 83C001                  add eax, 00000001
:0044E1E7 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044E1DF(U)
|
:0044E1EA 837DF400                cmp dword ptr [ebp-0C], 00000000
:0044E1EE 0F85F5040000            jne 0044E6E9
:0044E1F4 E8CB080300              call 0047EAC4
:0044E1F9 B950424B00              mov ecx, 004B4250
:0044E1FE E8A55C0000              call 00453EA8
:0044E203 B950424B00              mov ecx, 004B4250
:0044E208 E8FC640000              call 00454709
:0044E20D 8945E8                  mov dword ptr [ebp-18], eax
:0044E210 B9181B4B00              mov ecx, 004B1B18
:0044E215 E8D615FEFF              call 0042F7F0
:0044E21A 85C0                    test eax, eax
:0044E21C 742E                    je 0044E24C
:0044E21E 837DE800                cmp dword ptr [ebp-18], 00000000
:0044E222 7528                    jne 0044E24C
:0044E224 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0044E227 33D2                    xor edx, edx
:0044E229 8A5101                  mov dl, byte ptr [ecx+01]
:0044E22C 85D2                    test edx, edx
:0044E22E 751C                    jne 0044E24C
:0044E230 6A04                    push 00000004
:0044E232 E894E2FDFF              call 0042C4CB
:0044E237 83C404                  add esp, 00000004
:0044E23A 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0044E23D E8EE84FBFF              call 00406730
:0044E242 B950424B00              mov ecx, 004B4250
:0044E247 E8C7580000              call 00453B13

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044E21C(C), :0044E222(C), :0044E22E(C)
|
:0044E24C B950424B00              mov ecx, 004B4250
:0044E251 E8AD5D0000              call 00454003
:0044E256 50                      push eax
:0044E257 8D4DE0                  lea ecx, dword ptr [ebp-20]
:0044E25A E84183FBFF              call 004065A0
:0044E25F 8D45E0                  lea eax, dword ptr [ebp-20]
:0044E262 50                      push eax
:0044E263 E81C76FEFF              call 00435884
:0044E268 83C404                  add esp, 00000004
:0044E26B 8845D8                  mov byte ptr [ebp-28], al
:0044E26E 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0044E271 81E1FF000000            and ecx, 000000FF
:0044E277 81F9FF000000            cmp ecx, 000000FF
:0044E27D 0F84C1000000            je 0044E344
:0044E283 8B55EC                  mov edx, dword ptr [ebp-14]
:0044E286 81E2FF000000            and edx, 000000FF
:0044E28C 8B45D8                  mov eax, dword ptr [ebp-28]
:0044E28F 25FF000000              and eax, 000000FF
:0044E294 3BD0                    cmp edx, eax
:0044E296 0F84A8000000            je 0044E344
:0044E29C B950424B00              mov ecx, 004B4250
:0044E2A1 E8F15B0000              call 00453E97
:0044E2A6 85C0                    test eax, eax
:0044E2A8 740E                    je 0044E2B8
:0044E2AA B950424B00              mov ecx, 004B4250
:0044E2AF E87E5B0000              call 00453E32
:0044E2B4 C645ECFF                mov [ebp-14], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044E2A8(C)
|
:0044E2B8 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0044E2BB 81E1FF000000            and ecx, 000000FF
:0044E2C1 81F9FF000000            cmp ecx, 000000FF
:0044E2C7 747B                    je 0044E344
:0044E2C9 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0044E2CC 81E1FF000000            and ecx, 000000FF
:0044E2D2 6BC924                  imul ecx, 00000024
:0044E2D5 81C1502C4B00            add ecx, 004B2C50
:0044E2DB E8B0A9FCFF              call 00418C90
:0044E2E0 25FF000000              and eax, 000000FF
:0044E2E5 83F802                  cmp eax, 00000002
:0044E2E8 755A                    jne 0044E344
:0044E2EA 33D2                    xor edx, edx
:0044E2EC 8A1534424B00            mov dl, byte ptr [004B4234]
:0044E2F2 85D2                    test edx, edx
:0044E2F4 754E                    jne 0044E344
:0044E2F6 8A45D8                  mov al, byte ptr [ebp-28]
:0044E2F9 8845EC                  mov byte ptr [ebp-14], al
:0044E2FC 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0044E2FF 81E1FF000000            and ecx, 000000FF
:0044E305 6BC924                  imul ecx, 00000024
:0044E308 81C1502C4B00            add ecx, 004B2C50
:0044E30E E88B21FFFF              call 0044049E
:0044E313 8B0D08754B00            mov ecx, dword ptr [004B7508]
:0044E319 51                      push ecx
:0044E31A FF15C8624800            call dword ptr [004862C8]
:0044E320 85C0                    test eax, eax
:0044E322 7420                    je 0044E344
:0044E324 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0044E327 81E1FF000000            and ecx, 000000FF
:0044E32D 6BC924                  imul ecx, 00000024
:0044E330 81C1502C4B00            add ecx, 004B2C50
:0044E336 E835130100              call 0045F670
:0044E33B 50                      push eax
:0044E33C E854B40200              call 00479795
:0044E341 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044E27D(C), :0044E296(C), :0044E2C7(C), :0044E2E8(C), :0044E2F4(C)
|:0044E322(C)
|
:0044E344 8B55D8                  mov edx, dword ptr [ebp-28]
:0044E347 81E2FF000000            and edx, 000000FF
:0044E34D 81FAFF000000            cmp edx, 000000FF
:0044E353 7554                    jne 0044E3A9
:0044E355 8B45C8                  mov eax, dword ptr [ebp-38]
:0044E358 83B80005000000          cmp dword ptr [eax+00000500], 00000000
:0044E35F 741F                    je 0044E380
:0044E361 8B4DE1                  mov ecx, dword ptr [ebp-1F]
:0044E364 81E1FF000000            and ecx, 000000FF
:0044E36A 81F9FF000000            cmp ecx, 000000FF
:0044E370 750E                    jne 0044E380
:0044E372 FF1560624800            call dword ptr [00486260]
:0044E378 3905686A4B00            cmp dword ptr [004B6A68], eax
:0044E37E 7429                    je 0044E3A9

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044E35F(C), :0044E370(C)
|
:0044E380 C645ECFF                mov [ebp-14], FF
:0044E384 B950424B00              mov ecx, 004B4250
:0044E389 E8095B0000              call 00453E97
:0044E38E 85C0                    test eax, eax
:0044E390 7417                    je 0044E3A9
:0044E392 B950424B00              mov ecx, 004B4250
:0044E397 E8965A0000              call 00453E32
:0044E39C 8B55C8                  mov edx, dword ptr [ebp-38]
:0044E39F C7820005000000000000    mov dword ptr [ebx+00000500], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044E353(C), :0044E37E(C), :0044E390(C)
|
:0044E3A9 E816070300              call 0047EAC4
:0044E3AE E8B8E1FDFF              call 0042C56B
:0044E3B3 83F801                  cmp eax, 00000001
:0044E3B6 0F85FC000000            jne 0044E4B8
:0044E3BC 33C0                    xor eax, eax
:0044E3BE A034424B00              mov al, byte ptr [004B4234]
:0044E3C3 85C0                    test eax, eax
:0044E3C5 0F85ED000000            jne 0044E4B8
:0044E3CB 6A00                    push 00000000
:0044E3CD E814BAFFFF              call 00449DE6
:0044E3D2 83C404                  add esp, 00000004
:0044E3D5 6A01                    push 00000001
:0044E3D7 6A00                    push 00000000
:0044E3D9 B9B0694B00              mov ecx, 004B69B0
:0044E3DE E897620200              call 0047467A
:0044E3E3 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0044E3E6 81E1FF000000            and ecx, 000000FF
:0044E3EC 81F9FF000000            cmp ecx, 000000FF
:0044E3F2 0F8489000000            je 0044E481
:0044E3F8 8B55EC                  mov edx, dword ptr [ebp-14]
:0044E3FB 81E2FF000000            and edx, 000000FF
:0044E401 83FA73                  cmp edx, 00000073
:0044E404 7D7B                    jge 0044E481
:0044E406 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0044E409 81E1FF000000            and ecx, 000000FF
:0044E40F 6BC924                  imul ecx, 00000024
:0044E412 81C1502C4B00            add ecx, 004B2C50
:0044E418 E8C6F9FEFF              call 0043DDE3
:0044E41D 8945E4                  mov dword ptr [ebp-1C], eax
:0044E420 6A00                    push 00000000
:0044E422 6A00                    push 00000000
:0044E424 6802020000              push 00000202
:0044E429 A1686A4B00              mov eax, dword ptr [004B6A68]
:0044E42E 50                      push eax
:0044E42F FF15F4624800            call dword ptr [004862F4]
:0044E435 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0044E438 81E1FF000000            and ecx, 000000FF
:0044E43E 6BC924                  imul ecx, 00000024
:0044E441 81C1502C4B00            add ecx, 004B2C50
:0044E447 E824120100              call 0045F670
:0044E44C 50                      push eax
:0044E44D B9F05D4B00              mov ecx, 004B5DF0
:0044E452 E8F9110100              call 0045F650
:0044E457 8A4DEC                  mov cl, byte ptr [ebp-14]
:0044E45A 51                      push ecx
:0044E45B B9F05D4B00              mov ecx, 004B5DF0
:0044E460 E899D10000              call 0045B5FE
:0044E465 C645ECFF                mov [ebp-14], FF
:0044E469 6A00                    push 00000000
:0044E46B 6A00                    push 00000000
:0044E46D 6802020000              push 00000202
:0044E472 8B15686A4B00            mov edx, dword ptr [004B6A68]
:0044E478 52                      push edx
:0044E479 FF15F4624800            call dword ptr [004862F4]
:0044E47F EB2D                    jmp 0044E4AE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044E3F2(C), :0044E404(C)
|
:0044E481 8B45EC                  mov eax, dword ptr [ebp-14]
:0044E484 25FF000000              and eax, 000000FF
:0044E489 3DFF000000              cmp eax, 000000FF
:0044E48E 751E                    jne 0044E4AE
:0044E490 6A01                    push 00000001
:0044E492 8D4DE0                  lea ecx, dword ptr [ebp-20]
:0044E495 51                      push ecx
:0044E496 B950424B00              mov ecx, 004B4250
:0044E49B E8CD720000              call 0045576D
:0044E4A0 6A01                    push 00000001
:0044E4A2 6A01                    push 00000001
:0044E4A4 B9B0694B00              mov ecx, 004B69B0
:0044E4A9 E8CC610200              call 0047467A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044E47F(U), :0044E48E(C)
|
:0044E4AE 6A01                    push 00000001
:0044E4B0 E831B9FFFF              call 00449DE6
:0044E4B5 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044E3B6(C), :0044E3C5(C)
|
:0044E4B8 B9083D4B00              mov ecx, 004B3D08
:0044E4BD E8DE140000              call 0044F9A0
:0044E4C2 25FF000000              and eax, 000000FF
:0044E4C7 8945F8                  mov dword ptr [ebp-08], eax
:0044E4CA 837DF807                cmp dword ptr [ebp-08], 00000007
:0044E4CE 752C                    jne 0044E4FC
:0044E4D0 6A00                    push 00000000
:0044E4D2 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0044E4D5 E846D9FBFF              call 0040BE20
:0044E4DA E827020000              call 0044E706
:0044E4DF 85C0                    test eax, eax
:0044E4E1 740C                    je 0044E4EF

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0044E4E3 6A06                    push 00000006
:0044E4E5 B9083D4B00              mov ecx, 004B3D08
:0044E4EA E831D9FBFF              call 0040BE20

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044E4E1(C)
|
:0044E4EF 8B55C8                  mov edx, dword ptr [ebp-38]
:0044E4F2 C7820005000001000000    mov dword ptr [ebx+00000500], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044E4CE(C)
|
:0044E4FC E86AE0FDFF              call 0042C56B
:0044E501 83F802                  cmp eax, 00000002
:0044E504 7559                    jne 0044E55F
:0044E506 8D45E0                  lea eax, dword ptr [ebp-20]
:0044E509 50                      push eax
:0044E50A E87573FEFF              call 00435884
:0044E50F 83C404                  add esp, 00000004
:0044E512 8845D4                  mov byte ptr [ebp-2C], al
:0044E515 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0044E518 81E1FF000000            and ecx, 000000FF
:0044E51E 81F9FF000000            cmp ecx, 000000FF
:0044E524 742F                    je 0044E555
:0044E526 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0044E529 81E1FF000000            and ecx, 000000FF
:0044E52F 6BC924                  imul ecx, 00000024
:0044E532 81C1502C4B00            add ecx, 004B2C50
:0044E538 E833110100              call 0045F670
:0044E53D 50                      push eax
:0044E53E E852B20200              call 00479795
:0044E543 83C404                  add esp, 00000004
:0044E546 8B1508754B00            mov edx, dword ptr [004B7508]
:0044E54C 52                      push edx
:0044E54D FF15CC624800            call dword ptr [004862CC]
:0044E553 EB0A                    jmp 0044E55F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044E524(C)
|

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0044E555 6A06                    push 00000006
:0044E557 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0044E55A E8C1D8FBFF              call 0040BE20

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044E504(C), :0044E553(U)
|
:0044E55F 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0044E562 E839140000              call 0044F9A0
:0044E567 25FF000000              and eax, 000000FF
:0044E56C 83F806                  cmp eax, 00000006
:0044E56F 7557                    jne 0044E5C8
:0044E571 8B45EC                  mov eax, dword ptr [ebp-14]
:0044E574 25FF000000              and eax, 000000FF
:0044E579 3DFF000000              cmp eax, 000000FF
:0044E57E 740E                    je 0044E58E
:0044E580 B950424B00              mov ecx, 004B4250
:0044E585 E8A8580000              call 00453E32
:0044E58A C645ECFF                mov [ebp-14], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044E57E(C)
|
:0044E58E 6A00                    push 00000000
:0044E590 E851B8FFFF              call 00449DE6
:0044E595 83C404                  add esp, 00000004
:0044E598 B950424B00              mov ecx, 004B4250
:0044E59D E87A600000              call 0045461C

* Possible StringData Ref from Data Obj ->"вӵ"
                                  |
:0044E5A2 6820E14800              push 0048E120
:0044E5A7 6A01                    push 00000001
:0044E5A9 E8EB10FEFF              call 0042F699
:0044E5AE 83C408                  add esp, 00000008
:0044E5B1 8945F4                  mov dword ptr [ebp-0C], eax
:0044E5B4 6A00                    push 00000000
:0044E5B6 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0044E5B9 E862D8FBFF              call 0040BE20
:0044E5BE 6A01                    push 00000001
:0044E5C0 E821B8FFFF              call 00449DE6
:0044E5C5 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044E56F(C)
|
:0044E5C8 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0044E5CB E8D0130000              call 0044F9A0
:0044E5D0 25FF000000              and eax, 000000FF
:0044E5D5 83F805                  cmp eax, 00000005
:0044E5D8 7505                    jne 0044E5DF
:0044E5DA E923010000              jmp 0044E702

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044E5D8(C)
|
:0044E5DF 837DE400                cmp dword ptr [ebp-1C], 00000000
:0044E5E3 0F84FB000000            je 0044E6E4
:0044E5E9 6A00                    push 00000000
:0044E5EB E8F6B7FFFF              call 00449DE6
:0044E5F0 83C404                  add esp, 00000004
:0044E5F3 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0044E5F6 E808E6FFFF              call 0044CC03
:0044E5FB 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0044E5FE 33D2                    xor edx, edx
:0044E600 8A5101                  mov dl, byte ptr [ecx+01]
:0044E603 85D2                    test edx, edx
:0044E605 7508                    jne 0044E60F
:0044E607 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0044E60A E8F2DFFFFF              call 0044C601

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044E605(C)
|
:0044E60F 8B45C8                  mov eax, dword ptr [ebp-38]
:0044E612 33C9                    xor ecx, ecx
:0044E614 8A4801                  mov cl, byte ptr [eax+01]
:0044E617 85C9                    test ecx, ecx
:0044E619 7405                    je 0044E620
:0044E61B E9E2000000              jmp 0044E702

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044E619(C)
|
:0044E620 C645D000                mov [ebp-30], 00
:0044E624 C745CC00000000          mov [ebp-34], 00000000
:0044E62B EB09                    jmp 0044E636

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044E6A8(U)
|
:0044E62D 8B55CC                  mov edx, dword ptr [ebp-34]
:0044E630 83C201                  add edx, 00000001
:0044E633 8955CC                  mov dword ptr [ebp-34], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044E62B(U)
|
:0044E636 837DCC23                cmp dword ptr [ebp-34], 00000023
:0044E63A 736E                    jnb 0044E6AA
:0044E63C 6A02                    push 00000002
:0044E63E 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0044E641 6BC924                  imul ecx, 00000024
:0044E644 81C1502C4B00            add ecx, 004B2C50
:0044E64A E8A174FDFF              call 00425AF0
:0044E64F 85C0                    test eax, eax
:0044E651 7555                    jne 0044E6A8
:0044E653 6A08                    push 00000008
:0044E655 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0044E658 6BC924                  imul ecx, 00000024
:0044E65B 81C1502C4B00            add ecx, 004B2C50
:0044E661 E87A80FBFF              call 004066E0
:0044E666 85C0                    test eax, eax
:0044E668 753E                    jne 0044E6A8
:0044E66A 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0044E66D 6BC924                  imul ecx, 00000024
:0044E670 81C1502C4B00            add ecx, 004B2C50
:0044E676 E815A6FCFF              call 00418C90
:0044E67B 25FF000000              and eax, 000000FF
:0044E680 83F802                  cmp eax, 00000002
:0044E683 7523                    jne 0044E6A8
:0044E685 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0044E688 6BC924                  imul ecx, 00000024
:0044E68B 81C1502C4B00            add ecx, 004B2C50
:0044E691 E83A74FDFF              call 00425AD0
:0044E696 25FF000000              and eax, 000000FF
:0044E69B 83F807                  cmp eax, 00000007
:0044E69E 7508                    jne 0044E6A8
:0044E6A0 8A45D0                  mov al, byte ptr [ebp-30]
:0044E6A3 0401                    add al, 01
:0044E6A5 8845D0                  mov byte ptr [ebp-30], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044E651(C), :0044E668(C), :0044E683(C), :0044E69E(C)
|
:0044E6A8 EB83                    jmp 0044E62D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044E63A(C)
|
:0044E6AA 8B4DD0                  mov ecx, dword ptr [ebp-30]
:0044E6AD 81E1FF000000            and ecx, 000000FF
:0044E6B3 85C9                    test ecx, ecx
:0044E6B5 751C                    jne 0044E6D3
:0044E6B7 B950424B00              mov ecx, 004B4250
:0044E6BC E85B5F0000              call 0045461C

* Possible StringData Ref from Data Obj ->"вӵ"
                                  |
:0044E6C1 6820E14800              push 0048E120
:0044E6C6 6A01                    push 00000001
:0044E6C8 E8CC0FFEFF              call 0042F699
:0044E6CD 83C408                  add esp, 00000008
:0044E6D0 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044E6B5(C)
|
:0044E6D3 C745E400000000          mov [ebp-1C], 00000000
:0044E6DA 6A01                    push 00000001
:0044E6DC E805B7FFFF              call 00449DE6
:0044E6E1 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044E5E3(C)
|
:0044E6E4 E9F8FAFFFF              jmp 0044E1E1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044E1EE(C)
|
:0044E6E9 E9DBFAFFFF              jmp 0044E1C9
:0044E6EE B950424B00              mov ecx, 004B4250
:0044E6F3 E8245F0000              call 0045461C
:0044E6F8 B950424B00              mov ecx, 004B4250
:0044E6FD E817700000              call 00455719

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044E10C(U), :0044E5DA(U), :0044E61B(U)
|
:0044E702 8BE5                    mov esp, ebp
:0044E704 5D                      pop ebp
:0044E705 C3                      ret



* Referenced by a CALL at Address:
|:0044E4DA   
|
:0044E706 55                      push ebp
:0044E707 8BEC                    mov ebp, esp
:0044E709 83EC2C                  sub esp, 0000002C
:0044E70C C645D800                mov [ebp-28], 00
:0044E710 C745D400000000          mov [ebp-2C], 00000000
:0044E717 EB09                    jmp 0044E722

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044E7D8(U)
|
:0044E719 8B45D4                  mov eax, dword ptr [ebp-2C]
:0044E71C 83C001                  add eax, 00000001
:0044E71F 8945D4                  mov dword ptr [ebp-2C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044E717(U)
|
:0044E722 837DD423                cmp dword ptr [ebp-2C], 00000023
:0044E726 0F83B1000000            jnb 0044E7DD
:0044E72C 6A02                    push 00000002
:0044E72E 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0044E731 6BC924                  imul ecx, 00000024
:0044E734 81C1502C4B00            add ecx, 004B2C50
:0044E73A E8B173FDFF              call 00425AF0
:0044E73F 85C0                    test eax, eax
:0044E741 0F8591000000            jne 0044E7D8
:0044E747 6A04                    push 00000004
:0044E749 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0044E74C 6BC924                  imul ecx, 00000024
:0044E74F 81C1502C4B00            add ecx, 004B2C50
:0044E755 E89673FDFF              call 00425AF0
:0044E75A 85C0                    test eax, eax
:0044E75C 757A                    jne 0044E7D8
:0044E75E 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0044E761 6BC924                  imul ecx, 00000024
:0044E764 81C1502C4B00            add ecx, 004B2C50
:0044E76A E821A5FCFF              call 00418C90
:0044E76F 25FF000000              and eax, 000000FF
:0044E774 83F802                  cmp eax, 00000002
:0044E777 755F                    jne 0044E7D8
:0044E779 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0044E77C 6BC924                  imul ecx, 00000024
:0044E77F 81C1502C4B00            add ecx, 004B2C50
:0044E785 E84673FDFF              call 00425AD0
:0044E78A 25FF000000              and eax, 000000FF
:0044E78F 83F807                  cmp eax, 00000007
:0044E792 7544                    jne 0044E7D8
:0044E794 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0044E797 6BC924                  imul ecx, 00000024
:0044E79A 81C1502C4B00            add ecx, 004B2C50
:0044E7A0 E8AF17FFFF              call 0043FF54
:0044E7A5 85C0                    test eax, eax
:0044E7A7 742F                    je 0044E7D8
:0044E7A9 6A08                    push 00000008
:0044E7AB 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0044E7AE 6BC924                  imul ecx, 00000024
:0044E7B1 81C1502C4B00            add ecx, 004B2C50
:0044E7B7 E8247FFBFF              call 004066E0
:0044E7BC 85C0                    test eax, eax
:0044E7BE 7518                    jne 0044E7D8
:0044E7C0 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0044E7C3 81E1FF000000            and ecx, 000000FF
:0044E7C9 8A55D4                  mov dl, byte ptr [ebp-2C]
:0044E7CC 88540DDC                mov byte ptr [ebp+ecx-24], dl
:0044E7D0 8A45D8                  mov al, byte ptr [ebp-28]
:0044E7D3 0401                    add al, 01
:0044E7D5 8845D8                  mov byte ptr [ebp-28], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044E741(C), :0044E75C(C), :0044E777(C), :0044E792(C), :0044E7A7(C)
|:0044E7BE(C)
|
:0044E7D8 E93CFFFFFF              jmp 0044E719

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044E726(C)
|
:0044E7DD 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0044E7E0 81E1FF000000            and ecx, 000000FF
:0044E7E6 85C9                    test ecx, ecx
:0044E7E8 7516                    jne 0044E800

* Possible StringData Ref from Data Obj ->"ûпжĲӡ"
                                  |
:0044E7EA 68F8E14800              push 0048E1F8
:0044E7EF 6A00                    push 00000000
:0044E7F1 E8A30EFEFF              call 0042F699
:0044E7F6 83C408                  add esp, 00000008
:0044E7F9 B801000000              mov eax, 00000001
:0044E7FE EB4D                    jmp 0044E84D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044E7E8(C)
|
:0044E800 8A1538424B00            mov dl, byte ptr [004B4238]
:0044E806 80C201                  add dl, 01
:0044E809 881538424B00            mov byte ptr [004B4238], dl
:0044E80F 33C0                    xor eax, eax
:0044E811 A038424B00              mov al, byte ptr [004B4238]
:0044E816 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0044E819 81E1FF000000            and ecx, 000000FF
:0044E81F 3BC1                    cmp eax, ecx
:0044E821 7C07                    jl 0044E82A
:0044E823 C60538424B0000          mov byte ptr [004B4238], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044E821(C)
|
:0044E82A B950424B00              mov ecx, 004B4250
:0044E82F E8FE550000              call 00453E32
:0044E834 33D2                    xor edx, edx
:0044E836 8A1538424B00            mov dl, byte ptr [004B4238]
:0044E83C 8A4415DC                mov al, byte ptr [ebp+edx-24]
:0044E840 50                      push eax
:0044E841 B950424B00              mov ecx, 004B4250
:0044E846 E84D6A0000              call 00455298
:0044E84B 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044E7FE(U)
|
:0044E84D 8BE5                    mov esp, ebp
:0044E84F 5D                      pop ebp
:0044E850 C3                      ret



* Referenced by a CALL at Address:
|:0044EEBA   
|
:0044E851 55                      push ebp
:0044E852 8BEC                    mov ebp, esp
:0044E854 83EC1C                  sub esp, 0000001C
:0044E857 894DE4                  mov dword ptr [ebp-1C], ecx
:0044E85A 8B45E4                  mov eax, dword ptr [ebp-1C]
:0044E85D C7800405000000000000    mov dword ptr [ebx+00000504], 00000000
:0044E867 C645F400                mov [ebp-0C], 00
:0044E86B EB09                    jmp 0044E876

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044EBF4(U)
|
:0044E86D 8A4DF4                  mov cl, byte ptr [ebp-0C]
:0044E870 80C101                  add cl, 01
:0044E873 884DF4                  mov byte ptr [ebp-0C], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044E86B(U)
|
:0044E876 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044E879 81E2FF000000            and edx, 000000FF
:0044E87F 83FA02                  cmp edx, 00000002
:0044E882 0F8D71030000            jnl 0044EBF9
:0044E888 8B45E4                  mov eax, dword ptr [ebp-1C]
:0044E88B 33C9                    xor ecx, ecx
:0044E88D 8A4801                  mov cl, byte ptr [eax+01]
:0044E890 85C9                    test ecx, ecx
:0044E892 0F8561030000            jne 0044EBF9
:0044E898 E827020300              call 0047EAC4
:0044E89D 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044E8A0 81E2FF000000            and edx, 000000FF
:0044E8A6 83FA01                  cmp edx, 00000001
:0044E8A9 0F85C6000000            jne 0044E975
:0044E8AF 6A00                    push 00000000
:0044E8B1 6A01                    push 00000001
:0044E8B3 8B45E4                  mov eax, dword ptr [ebp-1C]
:0044E8B6 33C9                    xor ecx, ecx
:0044E8B8 8A4802                  mov cl, byte ptr [eax+02]
:0044E8BB 83C101                  add ecx, 00000001
:0044E8BE 51                      push ecx
:0044E8BF 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0044E8C2 E861C3FFFF              call 0044AC28
:0044E8C7 8B55E4                  mov edx, dword ptr [ebp-1C]
:0044E8CA C6421002                mov [edx+10], 02
:0044E8CE 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0044E8D1 E82BDDFFFF              call 0044C601
:0044E8D6 8B45E4                  mov eax, dword ptr [ebp-1C]
:0044E8D9 33C9                    xor ecx, ecx
:0044E8DB 8A4801                  mov cl, byte ptr [eax+01]
:0044E8DE 85C9                    test ecx, ecx
:0044E8E0 7405                    je 0044E8E7
:0044E8E2 E912030000              jmp 0044EBF9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044E8E0(C)
|
:0044E8E7 C645F023                mov [ebp-10], 23
:0044E8EB EB09                    jmp 0044E8F6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044E931(U)
|
:0044E8ED 8A55F0                  mov dl, byte ptr [ebp-10]
:0044E8F0 80C201                  add dl, 01
:0044E8F3 8855F0                  mov byte ptr [ebp-10], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044E8EB(U)
|
:0044E8F6 8B45F0                  mov eax, dword ptr [ebp-10]
:0044E8F9 25FF000000              and eax, 000000FF
:0044E8FE 83F873                  cmp eax, 00000073
:0044E901 7D30                    jge 0044E933
:0044E903 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044E906 81E1FF000000            and ecx, 000000FF
:0044E90C 6BC924                  imul ecx, 00000024
:0044E90F 81C1502C4B00            add ecx, 004B2C50
:0044E915 E8BCDEFEFF              call 0043C7D6
:0044E91A 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044E91D 81E1FF000000            and ecx, 000000FF
:0044E923 6BC924                  imul ecx, 00000024
:0044E926 81C1502C4B00            add ecx, 004B2C50
:0044E92C E844E0FEFF              call 0043C975
:0044E931 EBBA                    jmp 0044E8ED

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044E901(C)
|
:0044E933 6A01                    push 00000001
:0044E935 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0044E938 E824F6FFFF              call 0044DF61
:0044E93D C645F023                mov [ebp-10], 23
:0044E941 EB09                    jmp 0044E94C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044E971(U)
|
:0044E943 8A4DF0                  mov cl, byte ptr [ebp-10]
:0044E946 80C101                  add cl, 01
:0044E949 884DF0                  mov byte ptr [ebp-10], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044E941(U)
|
:0044E94C 8B55F0                  mov edx, dword ptr [ebp-10]
:0044E94F 81E2FF000000            and edx, 000000FF
:0044E955 83FA73                  cmp edx, 00000073
:0044E958 7D19                    jge 0044E973
:0044E95A 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044E95D 81E1FF000000            and ecx, 000000FF
:0044E963 6BC924                  imul ecx, 00000024
:0044E966 81C1502C4B00            add ecx, 004B2C50
:0044E96C E86CE4FEFF              call 0043CDDD
:0044E971 EBD0                    jmp 0044E943

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044E958(C)
|
:0044E973 EB2C                    jmp 0044E9A1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044E8A9(C)
|
:0044E975 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044E978 25FF000000              and eax, 000000FF
:0044E97D 85C0                    test eax, eax
:0044E97F 7520                    jne 0044E9A1
:0044E981 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0044E984 C6411001                mov [ecx+10], 01
:0044E988 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0044E98B E871DCFFFF              call 0044C601
:0044E990 8B55E4                  mov edx, dword ptr [ebp-1C]
:0044E993 33C0                    xor eax, eax
:0044E995 8A4201                  mov al, byte ptr [edx+01]
:0044E998 85C0                    test eax, eax
:0044E99A 7405                    je 0044E9A1
:0044E99C E958020000              jmp 0044EBF9

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044E973(U), :0044E97F(C), :0044E99A(C)
|
:0044E9A1 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044E9A4 81E1FF000000            and ecx, 000000FF
:0044E9AA F7D9                    neg ecx
:0044E9AC 1BC9                    sbb ecx, ecx
:0044E9AE 41                      inc ecx
:0044E9AF 51                      push ecx
:0044E9B0 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0044E9B3 E8C2F0FFFF              call 0044DA7A
:0044E9B8 C745E800000000          mov [ebp-18], 00000000
:0044E9BF C645FC00                mov [ebp-04], 00
:0044E9C3 EB09                    jmp 0044E9CE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044EBEF(U)
|
:0044E9C5 8A55FC                  mov dl, byte ptr [ebp-04]
:0044E9C8 80C201                  add dl, 01
:0044E9CB 8855FC                  mov byte ptr [ebp-04], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044E9C3(U)
|
:0044E9CE 8B45E4                  mov eax, dword ptr [ebp-1C]
:0044E9D1 33C9                    xor ecx, ecx
:0044E9D3 8A4801                  mov cl, byte ptr [eax+01]
:0044E9D6 85C9                    test ecx, ecx
:0044E9D8 0F8516020000            jne 0044EBF4
:0044E9DE 0FBE55FC                movsx edx, byte ptr [ebp-04]
:0044E9E2 83FA73                  cmp edx, 00000073
:0044E9E5 0F8D09020000            jnl 0044EBF4
:0044E9EB E8D4000300              call 0047EAC4
:0044E9F0 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044E9F3 25FF000000              and eax, 000000FF
:0044E9F8 F7D8                    neg eax
:0044E9FA 1BC0                    sbb eax, eax
:0044E9FC 83E023                  and eax, 00000023
:0044E9FF 8845EC                  mov byte ptr [ebp-14], al
:0044EA02 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044EA05 81E1FF000000            and ecx, 000000FF
:0044EA0B F7D9                    neg ecx
:0044EA0D 1AC9                    sbb cl, cl
:0044EA0F 80E150                  and cl, 50
:0044EA12 80C123                  add cl, 23
:0044EA15 884DF8                  mov byte ptr [ebp-08], cl
:0044EA18 8A55EC                  mov dl, byte ptr [ebp-14]
:0044EA1B 8855F0                  mov byte ptr [ebp-10], dl
:0044EA1E EB08                    jmp 0044EA28

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044EA63(U), :0044EBB6(U)
|
:0044EA20 8A45F0                  mov al, byte ptr [ebp-10]
:0044EA23 0401                    add al, 01
:0044EA25 8845F0                  mov byte ptr [ebp-10], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044EA1E(U)
|
:0044EA28 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044EA2B 81E1FF000000            and ecx, 000000FF
:0044EA31 8B55F8                  mov edx, dword ptr [ebp-08]
:0044EA34 81E2FF000000            and edx, 000000FF
:0044EA3A 3BCA                    cmp ecx, edx
:0044EA3C 0F8D79010000            jnl 0044EBBB
:0044EA42 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044EA45 81E1FF000000            and ecx, 000000FF
:0044EA4B 6BC924                  imul ecx, 00000024
:0044EA4E 81C1502C4B00            add ecx, 004B2C50
:0044EA54 E837A2FCFF              call 00418C90
:0044EA59 25FF000000              and eax, 000000FF
:0044EA5E 83F802                  cmp eax, 00000002
:0044EA61 7402                    je 0044EA65
:0044EA63 EBBB                    jmp 0044EA20

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044EA61(C)
|
:0044EA65 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044EA68 81E1FF000000            and ecx, 000000FF
:0044EA6E 6BC924                  imul ecx, 00000024
:0044EA71 81C1502C4B00            add ecx, 004B2C50
:0044EA77 E83470FDFF              call 00425AB0
:0044EA7C 25FF000000              and eax, 000000FF
:0044EA81 0FBE4DFC                movsx ecx, byte ptr [ebp-04]
:0044EA85 3BC1                    cmp eax, ecx
:0044EA87 0F8529010000            jne 0044EBB6
:0044EA8D 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044EA90 81E1FF000000            and ecx, 000000FF
:0044EA96 6BC924                  imul ecx, 00000024
:0044EA99 81C1502C4B00            add ecx, 004B2C50
:0044EA9F E82C70FDFF              call 00425AD0
:0044EAA4 25FF000000              and eax, 000000FF
:0044EAA9 83F807                  cmp eax, 00000007
:0044EAAC 0F8404010000            je 0044EBB6
:0044EAB2 6A04                    push 00000004
:0044EAB4 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044EAB7 81E1FF000000            and ecx, 000000FF
:0044EABD 6BC924                  imul ecx, 00000024
:0044EAC0 81C1502C4B00            add ecx, 004B2C50
:0044EAC6 E82570FDFF              call 00425AF0
:0044EACB 85C0                    test eax, eax
:0044EACD 0F85E3000000            jne 0044EBB6
:0044EAD3 6A02                    push 00000002
:0044EAD5 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044EAD8 81E1FF000000            and ecx, 000000FF
:0044EADE 6BC924                  imul ecx, 00000024
:0044EAE1 81C1502C4B00            add ecx, 004B2C50
:0044EAE7 E80470FDFF              call 00425AF0
:0044EAEC 85C0                    test eax, eax
:0044EAEE 0F85C2000000            jne 0044EBB6
:0044EAF4 33D2                    xor edx, edx
:0044EAF6 8A1530424B00            mov dl, byte ptr [004B4230]
:0044EAFC 83E204                  and edx, 00000004
:0044EAFF 85D2                    test edx, edx
:0044EB01 7561                    jne 0044EB64
:0044EB03 6A00                    push 00000000
:0044EB05 E811CDFDFF              call 0042B81B
:0044EB0A 83C404                  add esp, 00000004
:0044EB0D 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044EB10 81E1FF000000            and ecx, 000000FF
:0044EB16 6BC924                  imul ecx, 00000024
:0044EB19 81C1502C4B00            add ecx, 004B2C50
:0044EB1F E8F8C1FEFF              call 0043AD1C
:0044EB24 6A00                    push 00000000
:0044EB26 6A00                    push 00000000
:0044EB28 6802020000              push 00000202
:0044EB2D A1686A4B00              mov eax, dword ptr [004B6A68]
:0044EB32 50                      push eax
:0044EB33 FF15F4624800            call dword ptr [004862F4]
:0044EB39 6A02                    push 00000002
:0044EB3B 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044EB3E 81E1FF000000            and ecx, 000000FF
:0044EB44 6BC924                  imul ecx, 00000024
:0044EB47 81C1502C4B00            add ecx, 004B2C50
:0044EB4D E89E6FFDFF              call 00425AF0
:0044EB52 85C0                    test eax, eax
:0044EB54 740E                    je 0044EB64
:0044EB56 8A4DF0                  mov cl, byte ptr [ebp-10]
:0044EB59 51                      push ecx
:0044EB5A B9F05D4B00              mov ecx, 004B5DF0
:0044EB5F E89ACA0000              call 0045B5FE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044EB01(C), :0044EB54(C)
|
:0044EB64 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0044EB67 E897E0FFFF              call 0044CC03
:0044EB6C 8B55E4                  mov edx, dword ptr [ebp-1C]
:0044EB6F 33C0                    xor eax, eax
:0044EB71 8A4201                  mov al, byte ptr [edx+01]
:0044EB74 85C0                    test eax, eax
:0044EB76 753C                    jne 0044EBB4
:0044EB78 6A02                    push 00000002
:0044EB7A 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044EB7D 81E1FF000000            and ecx, 000000FF
:0044EB83 6BC924                  imul ecx, 00000024
:0044EB86 81C1502C4B00            add ecx, 004B2C50
:0044EB8C E85F6FFDFF              call 00425AF0
:0044EB91 85C0                    test eax, eax
:0044EB93 741F                    je 0044EBB4
:0044EB95 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044EB98 81E1FF000000            and ecx, 000000FF
:0044EB9E 6BC924                  imul ecx, 00000024
:0044EBA1 81C1502C4B00            add ecx, 004B2C50
:0044EBA7 E81D11FFFF              call 0043FCC9
:0044EBAC 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0044EBAF E84DDAFFFF              call 0044C601

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044EB76(C), :0044EB93(C)
|
:0044EBB4 EB05                    jmp 0044EBBB

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044EA87(C), :0044EAAC(C), :0044EACD(C), :0044EAEE(C)
|
:0044EBB6 E965FEFFFF              jmp 0044EA20

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044EA3C(C), :0044EBB4(U)
|
:0044EBBB 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0044EBBE 83B90405000000          cmp dword ptr [ecx+00000504], 00000000
:0044EBC5 7428                    je 0044EBEF
:0044EBC7 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044EBCA 81E2FF000000            and edx, 000000FF
:0044EBD0 F7DA                    neg edx
:0044EBD2 1BD2                    sbb edx, edx
:0044EBD4 42                      inc edx
:0044EBD5 52                      push edx
:0044EBD6 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0044EBD9 E89CEEFFFF              call 0044DA7A
:0044EBDE 8B45E4                  mov eax, dword ptr [ebp-1C]
:0044EBE1 C7800405000000000000    mov dword ptr [ebx+00000504], 00000000
:0044EBEB C645FCFF                mov [ebp-04], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044EBC5(C)
|
:0044EBEF E9D1FDFFFF              jmp 0044E9C5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044E9D8(C), :0044E9E5(C)
|
:0044EBF4 E974FCFFFF              jmp 0044E86D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044E882(C), :0044E892(C), :0044E8E2(U), :0044E99C(U)
|
:0044EBF9 8BE5                    mov esp, ebp
:0044EBFB 5D                      pop ebp
:0044EBFC C3                      ret



* Referenced by a CALL at Address:
|:0044F042   
|
:0044EBFD 55                      push ebp
:0044EBFE 8BEC                    mov ebp, esp
:0044EC00 83EC0C                  sub esp, 0000000C
:0044EC03 894DF4                  mov dword ptr [ebp-0C], ecx
:0044EC06 6A00                    push 00000000
:0044EC08 B9C06B4B00              mov ecx, 004B6BC0
:0044EC0D E864750200              call 00476176
:0044EC12 6A00                    push 00000000
:0044EC14 E8A36D0200              call 004759BC
:0044EC19 83C404                  add esp, 00000004
:0044EC1C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044EC1F E8FDB7FFFF              call 0044A421
:0044EC24 E8C8AF0200              call 00479BF1
:0044EC29 A1686A4B00              mov eax, dword ptr [004B6A68]
:0044EC2E 50                      push eax
:0044EC2F FF15A8624800            call dword ptr [004862A8]
:0044EC35 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044EC38 33D2                    xor edx, edx
:0044EC3A 8A5101                  mov dl, byte ptr [ecx+01]
:0044EC3D 83FA02                  cmp edx, 00000002
:0044EC40 0F8511010000            jne 0044ED57
:0044EC46 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044EC6D(U)
|
:0044EC4D 837DFC04                cmp dword ptr [ebp-04], 00000004
:0044EC51 741C                    je 0044EC6F
:0044EC53 837DFC02                cmp dword ptr [ebp-04], 00000002
:0044EC57 7416                    je 0044EC6F
:0044EC59 6A00                    push 00000000
:0044EC5B B9902F4900              mov ecx, 00492F90
:0044EC60 E85C94FCFF              call 004180C1
:0044EC65 8945FC                  mov dword ptr [ebp-04], eax
:0044EC68 E857FE0200              call 0047EAC4
:0044EC6D EBDE                    jmp 0044EC4D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044EC51(C), :0044EC57(C)
|
:0044EC6F C645F800                mov [ebp-08], 00
:0044EC73 EB08                    jmp 0044EC7D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044ED37(U)
|
:0044EC75 8A45F8                  mov al, byte ptr [ebp-08]
:0044EC78 0401                    add al, 01
:0044EC7A 8845F8                  mov byte ptr [ebp-08], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044EC73(U)
|
:0044EC7D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044EC80 81E1FF000000            and ecx, 000000FF
:0044EC86 83F923                  cmp ecx, 00000023
:0044EC89 0F8DAD000000            jnl 0044ED3C
:0044EC8F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044EC92 81E1FF000000            and ecx, 000000FF
:0044EC98 6BC924                  imul ecx, 00000024
:0044EC9B 81C1502C4B00            add ecx, 004B2C50
:0044ECA1 E8EA9FFCFF              call 00418C90
:0044ECA6 25FF000000              and eax, 000000FF
:0044ECAB 83F802                  cmp eax, 00000002
:0044ECAE 0F8583000000            jne 0044ED37
:0044ECB4 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044ECB7 81E1FF000000            and ecx, 000000FF
:0044ECBD 6BC924                  imul ecx, 00000024
:0044ECC0 81C1502C4B00            add ecx, 004B2C50
:0044ECC6 E8A5090100              call 0045F670
:0044ECCB 50                      push eax
:0044ECCC E8BFB4FCFF              call 0041A190
:0044ECD1 83C404                  add esp, 00000004
:0044ECD4 85C0                    test eax, eax
:0044ECD6 745F                    je 0044ED37
:0044ECD8 68FF000000              push 000000FF
:0044ECDD 6A01                    push 00000001
:0044ECDF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044ECE2 81E1FF000000            and ecx, 000000FF
:0044ECE8 6BC924                  imul ecx, 00000024
:0044ECEB 81C1502C4B00            add ecx, 004B2C50
:0044ECF1 E87A090100              call 0045F670
:0044ECF6 8BC8                    mov ecx, eax
:0044ECF8 6BC948                  imul ecx, 00000048
:0044ECFB 81C1681B4A00            add ecx, 004A1B68
:0044ED01 E8BA0C0000              call 0044F9C0
:0044ED06 50                      push eax
:0044ED07 E8A90D0300              call 0047FAB5
:0044ED0C 83C40C                  add esp, 0000000C
:0044ED0F 50                      push eax
:0044ED10 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044ED13 81E1FF000000            and ecx, 000000FF
:0044ED19 6BC924                  imul ecx, 00000024
:0044ED1C 81C1502C4B00            add ecx, 004B2C50
:0044ED22 E849090100              call 0045F670
:0044ED27 8BC8                    mov ecx, eax
:0044ED29 6BC948                  imul ecx, 00000048
:0044ED2C 81C1681B4A00            add ecx, 004A1B68
:0044ED32 E84944FFFF              call 00443180

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044ECAE(C), :0044ECD6(C)
|
:0044ED37 E939FFFFFF              jmp 0044EC75

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044EC89(C)
|
:0044ED3C E877770200              call 004764B8
:0044ED41 E8B1C70200              call 0047B4F7
:0044ED46 E810000000              call 0044ED5B
:0044ED4B 6A00                    push 00000000
:0044ED4D B9902F4900              mov ecx, 00492F90
:0044ED52 E86A93FCFF              call 004180C1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044EC40(C)
|
:0044ED57 8BE5                    mov esp, ebp
:0044ED59 5D                      pop ebp
:0044ED5A C3                      ret



* Referenced by a CALL at Address:
|:0044ED46   
|
:0044ED5B 55                      push ebp
:0044ED5C 8BEC                    mov ebp, esp
:0044ED5E E82CF9FCFF              call 0041E68F
:0044ED63 E881F4FCFF              call 0041E1E9
:0044ED68 6A04                    push 00000004
:0044ED6A B93CC64A00              mov ecx, 004AC63C
:0044ED6F E88CD0FBFF              call 0040BE00

* Possible StringData Ref from Data Obj ->""
                                  |
:0044ED74 6810E24800              push 0048E210
:0044ED79 6A01                    push 00000001
:0044ED7B E81909FEFF              call 0042F699
:0044ED80 83C408                  add esp, 00000008
:0044ED83 85C0                    test eax, eax
:0044ED85 7405                    je 0044ED8C
:0044ED87 E8DAB6FCFF              call 0041A466

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044ED85(C)
|
:0044ED8C E891F4FCFF              call 0041E222
:0044ED91 5D                      pop ebp
:0044ED92 C3                      ret



* Referenced by a CALL at Address:
|:0044EFF1   
|
:0044ED93 55                      push ebp
:0044ED94 8BEC                    mov ebp, esp
:0044ED96 83EC08                  sub esp, 00000008
:0044ED99 894DF8                  mov dword ptr [ebp-08], ecx
:0044ED9C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044ED9F E826B1FFFF              call 00449ECA
:0044EDA4 8B4508                  mov eax, dword ptr [ebp+08]
:0044EDA7 50                      push eax
:0044EDA8 6A00                    push 00000000
:0044EDAA 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044EDAD 33D2                    xor edx, edx
:0044EDAF 8A5102                  mov dl, byte ptr [ecx+02]
:0044EDB2 83C201                  add edx, 00000001
:0044EDB5 52                      push edx
:0044EDB6 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044EDB9 E86ABEFFFF              call 0044AC28
:0044EDBE 837D0800                cmp dword ptr [ebp+08], 00000000
:0044EDC2 0F85AB000000            jne 0044EE73
:0044EDC8 8B45F8                  mov eax, dword ptr [ebp-08]
:0044EDCB C6401000                mov [eax+10], 00
:0044EDCF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044EDD2 E82AD8FFFF              call 0044C601
:0044EDD7 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044EDDA 33D2                    xor edx, edx
:0044EDDC 8A5101                  mov dl, byte ptr [ecx+01]
:0044EDDF 85D2                    test edx, edx
:0044EDE1 7405                    je 0044EDE8
:0044EDE3 E9D7000000              jmp 0044EEBF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044EDE1(C)
|
:0044EDE8 C645FC00                mov [ebp-04], 00
:0044EDEC EB08                    jmp 0044EDF6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044EE32(U)
|
:0044EDEE 8A45FC                  mov al, byte ptr [ebp-04]
:0044EDF1 0401                    add al, 01
:0044EDF3 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044EDEC(U)
|
:0044EDF6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044EDF9 81E1FF000000            and ecx, 000000FF
:0044EDFF 83F923                  cmp ecx, 00000023
:0044EE02 7D30                    jge 0044EE34
:0044EE04 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044EE07 81E1FF000000            and ecx, 000000FF
:0044EE0D 6BC924                  imul ecx, 00000024
:0044EE10 81C1502C4B00            add ecx, 004B2C50
:0044EE16 E8BBD9FEFF              call 0043C7D6
:0044EE1B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044EE1E 81E1FF000000            and ecx, 000000FF
:0044EE24 6BC924                  imul ecx, 00000024
:0044EE27 81C1502C4B00            add ecx, 004B2C50
:0044EE2D E843DBFEFF              call 0043C975
:0044EE32 EBBA                    jmp 0044EDEE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044EE02(C)
|
:0044EE34 6A00                    push 00000000
:0044EE36 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044EE39 E823F1FFFF              call 0044DF61
:0044EE3E C645FC00                mov [ebp-04], 00
:0044EE42 EB09                    jmp 0044EE4D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044EE71(U)
|
:0044EE44 8A55FC                  mov dl, byte ptr [ebp-04]
:0044EE47 80C201                  add dl, 01
:0044EE4A 8855FC                  mov byte ptr [ebp-04], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044EE42(U)
|
:0044EE4D 8B45FC                  mov eax, dword ptr [ebp-04]
:0044EE50 25FF000000              and eax, 000000FF
:0044EE55 83F823                  cmp eax, 00000023
:0044EE58 7D19                    jge 0044EE73
:0044EE5A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044EE5D 81E1FF000000            and ecx, 000000FF
:0044EE63 6BC924                  imul ecx, 00000024
:0044EE66 81C1502C4B00            add ecx, 004B2C50
:0044EE6C E86CDFFEFF              call 0043CDDD
:0044EE71 EBD1                    jmp 0044EE44

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044EDC2(C), :0044EE58(C)
|
:0044EE73 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044EE76 C7812005000001000000    mov dword ptr [ebx+00000520], 00000001
:0044EE80 6A01                    push 00000001
:0044EE82 E85FAFFFFF              call 00449DE6
:0044EE87 83C404                  add esp, 00000004
:0044EE8A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044EE8D E847F2FFFF              call 0044E0D9
:0044EE92 8B55F8                  mov edx, dword ptr [ebp-08]
:0044EE95 C7822005000000000000    mov dword ptr [ebx+00000520], 00000000
:0044EE9F 6A00                    push 00000000
:0044EEA1 E840AFFFFF              call 00449DE6
:0044EEA6 83C404                  add esp, 00000004
:0044EEA9 8B45F8                  mov eax, dword ptr [ebp-08]
:0044EEAC 33C9                    xor ecx, ecx
:0044EEAE 8A4801                  mov cl, byte ptr [eax+01]
:0044EEB1 85C9                    test ecx, ecx
:0044EEB3 7402                    je 0044EEB7
:0044EEB5 EB08                    jmp 0044EEBF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044EEB3(C)
|
:0044EEB7 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044EEBA E892F9FFFF              call 0044E851

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044EDE3(U), :0044EEB5(U)
|
:0044EEBF 8BE5                    mov esp, ebp
:0044EEC1 5D                      pop ebp
:0044EEC2 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0044F144   
|
:0044EEC5 55                      push ebp
:0044EEC6 8BEC                    mov ebp, esp
:0044EEC8 83EC0C                  sub esp, 0000000C
:0044EECB 894DF4                  mov dword ptr [ebp-0C], ecx
:0044EECE EB0F                    jmp 0044EEDF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044F03A(U)
|
:0044EED0 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044EED3 8A4802                  mov cl, byte ptr [eax+02]
:0044EED6 80C101                  add cl, 01
:0044EED9 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044EEDC 884A02                  mov byte ptr [edx+02], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044EECE(U)
|
:0044EEDF 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044EEE2 33C9                    xor ecx, ecx
:0044EEE4 8A4801                  mov cl, byte ptr [eax+01]
:0044EEE7 85C9                    test ecx, ecx
:0044EEE9 0F8550010000            jne 0044F03F
:0044EEEF 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044EEF2 33C0                    xor eax, eax
:0044EEF4 8A4202                  mov al, byte ptr [edx+02]
:0044EEF7 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044EEFA 33D2                    xor edx, edx
:0044EEFC 8A5103                  mov dl, byte ptr [ecx+03]
:0044EEFF 3BC2                    cmp eax, edx
:0044EF01 0F8CA5000000            jl 0044EFAC

* Possible StringData Ref from Data Obj ->"Ϊսʱˡ"
                                  |
:0044EF07 6820E24800              push 0048E220
:0044EF0C 6A02                    push 00000002
:0044EF0E E88607FEFF              call 0042F699
:0044EF13 83C408                  add esp, 00000008
:0044EF16 C745F800000000          mov [ebp-08], 00000000
:0044EF1D C645FC00                mov [ebp-04], 00
:0044EF21 EB08                    jmp 0044EF2B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044EF76(U)
|
:0044EF23 8A45FC                  mov al, byte ptr [ebp-04]
:0044EF26 0401                    add al, 01
:0044EF28 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044EF21(U)
|
:0044EF2B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044EF2E 81E1FF000000            and ecx, 000000FF
:0044EF34 83F923                  cmp ecx, 00000023
:0044EF37 7D3F                    jge 0044EF78
:0044EF39 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044EF3C 81E1FF000000            and ecx, 000000FF
:0044EF42 6BC924                  imul ecx, 00000024
:0044EF45 81C1502C4B00            add ecx, 004B2C50
:0044EF4B E820070100              call 0045F670
:0044EF50 85C0                    test eax, eax
:0044EF52 7522                    jne 0044EF76
:0044EF54 6A00                    push 00000000
:0044EF56 6A00                    push 00000000
:0044EF58 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044EF5B 81E1FF000000            and ecx, 000000FF
:0044EF61 6BC924                  imul ecx, 00000024
:0044EF64 81C1502C4B00            add ecx, 004B2C50
:0044EF6A E8D527FFFF              call 00441744
:0044EF6F C745F801000000          mov [ebp-08], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044EF52(C)
|
:0044EF76 EBAB                    jmp 0044EF23

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044EF37(C)
|
:0044EF78 837DF800                cmp dword ptr [ebp-08], 00000000
:0044EF7C 7522                    jne 0044EFA0
:0044EF7E B9502C4B00              mov ecx, 004B2C50
:0044EF83 E8089DFCFF              call 00418C90
:0044EF88 25FF000000              and eax, 000000FF
:0044EF8D 83F802                  cmp eax, 00000002
:0044EF90 750E                    jne 0044EFA0
:0044EF92 6A00                    push 00000000
:0044EF94 6A00                    push 00000000
:0044EF96 B9502C4B00              mov ecx, 004B2C50
:0044EF9B E8A427FFFF              call 00441744

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044EF7C(C), :0044EF90(C)
|
:0044EFA0 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044EFA3 C6420103                mov [edx+01], 03
:0044EFA7 E993000000              jmp 0044F03F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044EF01(C)
|
:0044EFAC C60538424B0000          mov byte ptr [004B4238], 00
:0044EFB3 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044EFB6 33C9                    xor ecx, ecx
:0044EFB8 8A4801                  mov cl, byte ptr [eax+01]
:0044EFBB 85C9                    test ecx, ecx
:0044EFBD 751F                    jne 0044EFDE
:0044EFBF 837D0800                cmp dword ptr [ebp+08], 00000000
:0044EFC3 7519                    jne 0044EFDE
:0044EFC5 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044EFC8 33C0                    xor eax, eax
:0044EFCA 8A4202                  mov al, byte ptr [edx+02]
:0044EFCD 85C0                    test eax, eax
:0044EFCF 740D                    je 0044EFDE
:0044EFD1 68FF000000              push 000000FF
:0044EFD6 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044EFD9 E8B3AFFFFF              call 00449F91

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044EFBD(C), :0044EFC3(C), :0044EFCF(C)
|
:0044EFDE 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044EFE1 33D2                    xor edx, edx
:0044EFE3 8A5101                  mov dl, byte ptr [ecx+01]
:0044EFE6 85D2                    test edx, edx
:0044EFE8 7550                    jne 0044F03A
:0044EFEA 8B4508                  mov eax, dword ptr [ebp+08]
:0044EFED 50                      push eax
:0044EFEE 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044EFF1 E89DFDFFFF              call 0044ED93
:0044EFF6 C7450800000000          mov [ebp+08], 00000000
:0044EFFD 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044F000 33D2                    xor edx, edx
:0044F002 8A5101                  mov dl, byte ptr [ecx+01]
:0044F005 83FA05                  cmp edx, 00000005
:0044F008 7530                    jne 0044F03A
:0044F00A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044F00D E80FB4FFFF              call 0044A421
:0044F012 E8DAAB0200              call 00479BF1
:0044F017 6A00                    push 00000000
:0044F019 B9C06B4B00              mov ecx, 004B6BC0
:0044F01E E853710200              call 00476176
:0044F023 E89AF5FCFF              call 0041E5C2
:0044F028 E8CAC40200              call 0047B4F7
:0044F02D E886740200              call 004764B8
:0044F032 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044F035 8A4001                  mov al, byte ptr [eax+01]
:0044F038 EB13                    jmp 0044F04D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044EFE8(C), :0044F008(C)
|
:0044F03A E991FEFFFF              jmp 0044EED0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044EEE9(C), :0044EFA7(U)
|
:0044F03F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044F042 E8B6FBFFFF              call 0044EBFD
:0044F047 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044F04A 8A4101                  mov al, byte ptr [ecx+01]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044F038(U)
|
:0044F04D 8BE5                    mov esp, ebp
:0044F04F 5D                      pop ebp
:0044F050 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0042C31E   
|
:0044F053 55                      push ebp
:0044F054 8BEC                    mov ebp, esp
:0044F056 83EC08                  sub esp, 00000008
:0044F059 894DF8                  mov dword ptr [ebp-08], ecx
:0044F05C A138774900              mov eax, dword ptr [00497738]
:0044F061 8945FC                  mov dword ptr [ebp-04], eax
:0044F064 833D3877490000          cmp dword ptr [00497738], 00000000
:0044F06B 740A                    je 0044F077
:0044F06D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044F070 E81DE0FFFF              call 0044D092
:0044F075 EB08                    jmp 0044F07F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044F06B(C)
|
:0044F077 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044F07A E8A8E3FFFF              call 0044D427

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044F075(U)
|
:0044F07F C60594AB4A0000          mov byte ptr [004AAB94], 00
:0044F086 C7053877490000000000    mov dword ptr [00497738], 00000000
:0044F090 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044F093 E85EB3FFFF              call 0044A3F6
:0044F098 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044F09B E8D1B8FFFF              call 0044A971
:0044F0A0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044F0A3 33D2                    xor edx, edx
:0044F0A5 8A5101                  mov dl, byte ptr [ecx+01]
:0044F0A8 85D2                    test edx, edx
:0044F0AA 7527                    jne 0044F0D3
:0044F0AC 837DFC00                cmp dword ptr [ebp-04], 00000000
:0044F0B0 7521                    jne 0044F0D3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044F0D1(U)
|
:0044F0B2 B9902F4900              mov ecx, 00492F90
:0044F0B7 E8F4060000              call 0044F7B0
:0044F0BC 85C0                    test eax, eax
:0044F0BE 7413                    je 0044F0D3
:0044F0C0 6A00                    push 00000000
:0044F0C2 B9902F4900              mov ecx, 00492F90
:0044F0C7 E8F58FFCFF              call 004180C1
:0044F0CC E8F3F90200              call 0047EAC4
:0044F0D1 EBDF                    jmp 0044F0B2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044F0AA(C), :0044F0B0(C), :0044F0BE(C)
|
:0044F0D3 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044F0D6 E815AEFFFF              call 00449EF0
:0044F0DB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044F0DE E819B2FFFF              call 0044A2FC
:0044F0E3 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044F0E6 E8DFADFFFF              call 00449ECA
:0044F0EB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044F0EE E8B1ADFFFF              call 00449EA4
:0044F0F3 6A01                    push 00000001
:0044F0F5 B9C06B4B00              mov ecx, 004B6BC0
:0044F0FA E877700200              call 00476176
:0044F0FF B970074B00              mov ecx, 004B0770
:0044F104 E807B8FDFF              call 0042A910
:0044F109 2500800000              and eax, 00008000
:0044F10E 85C0                    test eax, eax
:0044F110 742B                    je 0044F13D
:0044F112 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044F115 E870B7FFFF              call 0044A88A
:0044F11A 6A08                    push 00000008
:0044F11C A1D85F4B00              mov eax, dword ptr [004B5FD8]
:0044F121 50                      push eax
:0044F122 FF15E0624800            call dword ptr [004862E0]
:0044F128 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044F12B C7811C05000000000000    mov dword ptr [ebx+0000051C], 00000000
:0044F135 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044F138 E89EB5FFFF              call 0044A6DB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044F110(C)
|
:0044F13D 8B55FC                  mov edx, dword ptr [ebp-04]
:0044F140 52                      push edx
:0044F141 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044F144 E87CFDFFFF              call 0044EEC5
:0044F149 8B45F8                  mov eax, dword ptr [ebp-08]
:0044F14C 8A4001                  mov al, byte ptr [eax+01]
:0044F14F 8BE5                    mov esp, ebp
:0044F151 5D                      pop ebp
:0044F152 C3                      ret



* Referenced by a CALL at Address:
|:0044F64A   
|
:0044F153 55                      push ebp
:0044F154 8BEC                    mov ebp, esp
:0044F156 83EC08                  sub esp, 00000008
:0044F159 894DF8                  mov dword ptr [ebp-08], ecx
:0044F15C 8B4508                  mov eax, dword ptr [ebp+08]
:0044F15F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044F162 8A11                    mov dl, byte ptr [ecx]
:0044F164 8810                    mov byte ptr [eax], dl
:0044F166 8B4508                  mov eax, dword ptr [ebp+08]
:0044F169 83C001                  add eax, 00000001
:0044F16C 894508                  mov dword ptr [ebp+08], eax
:0044F16F 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044F172 8B55F8                  mov edx, dword ptr [ebp-08]
:0044F175 8A4201                  mov al, byte ptr [edx+01]
:0044F178 8801                    mov byte ptr [ecx], al
:0044F17A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044F17D 83C101                  add ecx, 00000001
:0044F180 894D08                  mov dword ptr [ebp+08], ecx
:0044F183 8B5508                  mov edx, dword ptr [ebp+08]
:0044F186 8B45F8                  mov eax, dword ptr [ebp-08]
:0044F189 8A4802                  mov cl, byte ptr [eax+02]
:0044F18C 880A                    mov byte ptr [edx], cl
:0044F18E 8B5508                  mov edx, dword ptr [ebp+08]
:0044F191 83C201                  add edx, 00000001
:0044F194 895508                  mov dword ptr [ebp+08], edx
:0044F197 8B4508                  mov eax, dword ptr [ebp+08]
:0044F19A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044F19D 8A5103                  mov dl, byte ptr [ecx+03]
:0044F1A0 8810                    mov byte ptr [eax], dl
:0044F1A2 8B4508                  mov eax, dword ptr [ebp+08]
:0044F1A5 83C001                  add eax, 00000001
:0044F1A8 894508                  mov dword ptr [ebp+08], eax
:0044F1AB 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044F1AE 8B55F8                  mov edx, dword ptr [ebp-08]
:0044F1B1 8A4208                  mov al, byte ptr [edx+08]
:0044F1B4 8801                    mov byte ptr [ecx], al
:0044F1B6 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044F1B9 83C101                  add ecx, 00000001
:0044F1BC 894D08                  mov dword ptr [ebp+08], ecx
:0044F1BF 8B5508                  mov edx, dword ptr [ebp+08]
:0044F1C2 8B45F8                  mov eax, dword ptr [ebp-08]
:0044F1C5 8A480C                  mov cl, byte ptr [eax+0C]
:0044F1C8 880A                    mov byte ptr [edx], cl
:0044F1CA 8B5508                  mov edx, dword ptr [ebp+08]
:0044F1CD 83C201                  add edx, 00000001
:0044F1D0 895508                  mov dword ptr [ebp+08], edx
:0044F1D3 8B4508                  mov eax, dword ptr [ebp+08]
:0044F1D6 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044F1D9 8A510D                  mov dl, byte ptr [ecx+0D]
:0044F1DC 8810                    mov byte ptr [eax], dl
:0044F1DE 8B4508                  mov eax, dword ptr [ebp+08]
:0044F1E1 83C001                  add eax, 00000001
:0044F1E4 894508                  mov dword ptr [ebp+08], eax
:0044F1E7 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044F1EA 8B55F8                  mov edx, dword ptr [ebp-08]
:0044F1ED 8A420E                  mov al, byte ptr [edx+0E]
:0044F1F0 8801                    mov byte ptr [ecx], al
:0044F1F2 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044F1F5 83C101                  add ecx, 00000001
:0044F1F8 894D08                  mov dword ptr [ebp+08], ecx
:0044F1FB 8B5508                  mov edx, dword ptr [ebp+08]
:0044F1FE 8B45F8                  mov eax, dword ptr [ebp-08]
:0044F201 8A480F                  mov cl, byte ptr [eax+0F]
:0044F204 880A                    mov byte ptr [edx], cl
:0044F206 8B5508                  mov edx, dword ptr [ebp+08]
:0044F209 83C201                  add edx, 00000001
:0044F20C 895508                  mov dword ptr [ebp+08], edx
:0044F20F 8B4508                  mov eax, dword ptr [ebp+08]
:0044F212 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044F215 8A5111                  mov dl, byte ptr [ecx+11]
:0044F218 8810                    mov byte ptr [eax], dl
:0044F21A 8B4508                  mov eax, dword ptr [ebp+08]
:0044F21D 83C001                  add eax, 00000001
:0044F220 894508                  mov dword ptr [ebp+08], eax
:0044F223 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044F226 8B55F8                  mov edx, dword ptr [ebp-08]
:0044F229 8A4204                  mov al, byte ptr [edx+04]
:0044F22C 8801                    mov byte ptr [ecx], al
:0044F22E 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044F231 83C101                  add ecx, 00000001
:0044F234 894D08                  mov dword ptr [ebp+08], ecx
:0044F237 8B5508                  mov edx, dword ptr [ebp+08]
:0044F23A 8B45F8                  mov eax, dword ptr [ebp-08]
:0044F23D 8A4805                  mov cl, byte ptr [eax+05]
:0044F240 880A                    mov byte ptr [edx], cl
:0044F242 8B5508                  mov edx, dword ptr [ebp+08]
:0044F245 83C201                  add edx, 00000001
:0044F248 895508                  mov dword ptr [ebp+08], edx
:0044F24B 8B4508                  mov eax, dword ptr [ebp+08]
:0044F24E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044F251 8A9100050000            mov dl, byte ptr [ecx+00000500]
:0044F257 8810                    mov byte ptr [eax], dl
:0044F259 8B4508                  mov eax, dword ptr [ebp+08]
:0044F25C 83C001                  add eax, 00000001
:0044F25F 894508                  mov dword ptr [ebp+08], eax
:0044F262 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044F265 8B55F8                  mov edx, dword ptr [ebp-08]
:0044F268 8A8204050000            mov al, byte ptr [edx+00000504]
:0044F26E 8801                    mov byte ptr [ecx], al
:0044F270 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044F273 83C101                  add ecx, 00000001
:0044F276 894D08                  mov dword ptr [ebp+08], ecx
:0044F279 8B55F8                  mov edx, dword ptr [ebp-08]
:0044F27C 8B82FC040000            mov eax, dword ptr [edx+000004FC]
:0044F282 25FF000000              and eax, 000000FF
:0044F287 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044F28A 8801                    mov byte ptr [ecx], al
:0044F28C 8B5508                  mov edx, dword ptr [ebp+08]
:0044F28F 83C201                  add edx, 00000001
:0044F292 895508                  mov dword ptr [ebp+08], edx
:0044F295 8B45F8                  mov eax, dword ptr [ebp-08]
:0044F298 8B88FC040000            mov ecx, dword ptr [eax+000004FC]
:0044F29E C1E908                  shr ecx, 08
:0044F2A1 8B5508                  mov edx, dword ptr [ebp+08]
:0044F2A4 880A                    mov byte ptr [edx], cl
:0044F2A6 8B4508                  mov eax, dword ptr [ebp+08]
:0044F2A9 83C001                  add eax, 00000001
:0044F2AC 894508                  mov dword ptr [ebp+08], eax
:0044F2AF C645FC00                mov [ebp-04], 00
:0044F2B3 EB09                    jmp 0044F2BE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044F376(U)
|
:0044F2B5 8A4DFC                  mov cl, byte ptr [ebp-04]
:0044F2B8 80C101                  add cl, 01
:0044F2BB 884DFC                  mov byte ptr [ebp-04], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044F2B3(U)
|
:0044F2BE 8B55FC                  mov edx, dword ptr [ebp-04]
:0044F2C1 81E2FF000000            and edx, 000000FF
:0044F2C7 81FAFA000000            cmp edx, 000000FA
:0044F2CD 0F8DA8000000            jnl 0044F37B
:0044F2D3 8B45FC                  mov eax, dword ptr [ebp-04]
:0044F2D6 25FF000000              and eax, 000000FF
:0044F2DB 6BC005                  imul eax, 00000005
:0044F2DE 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044F2E1 8B55F8                  mov edx, dword ptr [ebp-08]
:0044F2E4 8A440219                mov al, byte ptr [edx+eax+19]
:0044F2E8 8801                    mov byte ptr [ecx], al
:0044F2EA 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044F2ED 83C101                  add ecx, 00000001
:0044F2F0 894D08                  mov dword ptr [ebp+08], ecx
:0044F2F3 8B55FC                  mov edx, dword ptr [ebp-04]
:0044F2F6 81E2FF000000            and edx, 000000FF
:0044F2FC 6BD205                  imul edx, 00000005
:0044F2FF 8B4508                  mov eax, dword ptr [ebp+08]
:0044F302 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044F305 8A54111A                mov dl, byte ptr [ecx+edx+1A]
:0044F309 8810                    mov byte ptr [eax], dl
:0044F30B 8B4508                  mov eax, dword ptr [ebp+08]
:0044F30E 83C001                  add eax, 00000001
:0044F311 894508                  mov dword ptr [ebp+08], eax
:0044F314 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044F317 81E1FF000000            and ecx, 000000FF
:0044F31D 6BC905                  imul ecx, 00000005
:0044F320 8B5508                  mov edx, dword ptr [ebp+08]
:0044F323 8B45F8                  mov eax, dword ptr [ebp-08]
:0044F326 8A4C081B                mov cl, byte ptr [eax+ecx+1B]
:0044F32A 880A                    mov byte ptr [edx], cl
:0044F32C 8B5508                  mov edx, dword ptr [ebp+08]
:0044F32F 83C201                  add edx, 00000001
:0044F332 895508                  mov dword ptr [ebp+08], edx
:0044F335 8B45FC                  mov eax, dword ptr [ebp-04]
:0044F338 25FF000000              and eax, 000000FF
:0044F33D 6BC005                  imul eax, 00000005
:0044F340 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044F343 8B55F8                  mov edx, dword ptr [ebp-08]
:0044F346 8A44021C                mov al, byte ptr [edx+eax+1C]
:0044F34A 8801                    mov byte ptr [ecx], al
:0044F34C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044F34F 83C101                  add ecx, 00000001
:0044F352 894D08                  mov dword ptr [ebp+08], ecx
:0044F355 8B55FC                  mov edx, dword ptr [ebp-04]
:0044F358 81E2FF000000            and edx, 000000FF
:0044F35E 6BD205                  imul edx, 00000005
:0044F361 8B4508                  mov eax, dword ptr [ebp+08]
:0044F364 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044F367 8A54111D                mov dl, byte ptr [ecx+edx+1D]
:0044F36B 8810                    mov byte ptr [eax], dl
:0044F36D 8B4508                  mov eax, dword ptr [ebp+08]
:0044F370 83C001                  add eax, 00000001
:0044F373 894508                  mov dword ptr [ebp+08], eax
:0044F376 E93AFFFFFF              jmp 0044F2B5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044F2CD(C)
|
:0044F37B 8B4508                  mov eax, dword ptr [ebp+08]
:0044F37E 8BE5                    mov esp, ebp
:0044F380 5D                      pop ebp
:0044F381 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0044F72F   
|
:0044F384 55                      push ebp
:0044F385 8BEC                    mov ebp, esp
:0044F387 83EC0C                  sub esp, 0000000C
:0044F38A 894DF4                  mov dword ptr [ebp-0C], ecx
:0044F38D 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044F390 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044F393 8A11                    mov dl, byte ptr [ecx]
:0044F395 8810                    mov byte ptr [eax], dl
:0044F397 8B4508                  mov eax, dword ptr [ebp+08]
:0044F39A 83C001                  add eax, 00000001
:0044F39D 894508                  mov dword ptr [ebp+08], eax
:0044F3A0 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044F3A3 8B5508                  mov edx, dword ptr [ebp+08]
:0044F3A6 8A02                    mov al, byte ptr [edx]
:0044F3A8 884101                  mov byte ptr [ecx+01], al
:0044F3AB 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044F3AE 83C101                  add ecx, 00000001
:0044F3B1 894D08                  mov dword ptr [ebp+08], ecx
:0044F3B4 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044F3B7 8B4508                  mov eax, dword ptr [ebp+08]
:0044F3BA 8A08                    mov cl, byte ptr [eax]
:0044F3BC 884A02                  mov byte ptr [edx+02], cl
:0044F3BF 8B5508                  mov edx, dword ptr [ebp+08]
:0044F3C2 83C201                  add edx, 00000001
:0044F3C5 895508                  mov dword ptr [ebp+08], edx
:0044F3C8 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044F3CB 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044F3CE 8A11                    mov dl, byte ptr [ecx]
:0044F3D0 885003                  mov byte ptr [eax+03], dl
:0044F3D3 8B4508                  mov eax, dword ptr [ebp+08]
:0044F3D6 83C001                  add eax, 00000001
:0044F3D9 894508                  mov dword ptr [ebp+08], eax
:0044F3DC 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044F3DF 33D2                    xor edx, edx
:0044F3E1 8A11                    mov dl, byte ptr [ecx]
:0044F3E3 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044F3E6 895008                  mov dword ptr [eax+08], edx
:0044F3E9 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044F3EC 83C101                  add ecx, 00000001
:0044F3EF 894D08                  mov dword ptr [ebp+08], ecx
:0044F3F2 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044F3F5 8B4508                  mov eax, dword ptr [ebp+08]
:0044F3F8 8A08                    mov cl, byte ptr [eax]
:0044F3FA 884A0C                  mov byte ptr [edx+0C], cl
:0044F3FD 8B5508                  mov edx, dword ptr [ebp+08]
:0044F400 83C201                  add edx, 00000001
:0044F403 895508                  mov dword ptr [ebp+08], edx
:0044F406 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044F409 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044F40C 8A11                    mov dl, byte ptr [ecx]
:0044F40E 88500D                  mov byte ptr [eax+0D], dl
:0044F411 8B4508                  mov eax, dword ptr [ebp+08]
:0044F414 83C001                  add eax, 00000001
:0044F417 894508                  mov dword ptr [ebp+08], eax
:0044F41A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044F41D 8B5508                  mov edx, dword ptr [ebp+08]
:0044F420 8A02                    mov al, byte ptr [edx]
:0044F422 88410E                  mov byte ptr [ecx+0E], al
:0044F425 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044F428 83C101                  add ecx, 00000001
:0044F42B 894D08                  mov dword ptr [ebp+08], ecx
:0044F42E 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044F431 8B4508                  mov eax, dword ptr [ebp+08]
:0044F434 8A08                    mov cl, byte ptr [eax]
:0044F436 884A0F                  mov byte ptr [edx+0F], cl
:0044F439 8B5508                  mov edx, dword ptr [ebp+08]
:0044F43C 83C201                  add edx, 00000001
:0044F43F 895508                  mov dword ptr [ebp+08], edx
:0044F442 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044F445 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044F448 8A11                    mov dl, byte ptr [ecx]
:0044F44A 885011                  mov byte ptr [eax+11], dl
:0044F44D 8B4508                  mov eax, dword ptr [ebp+08]
:0044F450 83C001                  add eax, 00000001
:0044F453 894508                  mov dword ptr [ebp+08], eax
:0044F456 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044F459 8B5508                  mov edx, dword ptr [ebp+08]
:0044F45C 8A02                    mov al, byte ptr [edx]
:0044F45E 884104                  mov byte ptr [ecx+04], al
:0044F461 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044F464 83C101                  add ecx, 00000001
:0044F467 894D08                  mov dword ptr [ebp+08], ecx
:0044F46A 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044F46D 8B4508                  mov eax, dword ptr [ebp+08]
:0044F470 8A08                    mov cl, byte ptr [eax]
:0044F472 884A05                  mov byte ptr [edx+05], cl
:0044F475 8B5508                  mov edx, dword ptr [ebp+08]
:0044F478 83C201                  add edx, 00000001
:0044F47B 895508                  mov dword ptr [ebp+08], edx
:0044F47E 8B4508                  mov eax, dword ptr [ebp+08]
:0044F481 33C9                    xor ecx, ecx
:0044F483 8A08                    mov cl, byte ptr [eax]
:0044F485 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044F488 898A00050000            mov dword ptr [edx+00000500], ecx
:0044F48E 8B4508                  mov eax, dword ptr [ebp+08]
:0044F491 83C001                  add eax, 00000001
:0044F494 894508                  mov dword ptr [ebp+08], eax
:0044F497 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044F49A 33D2                    xor edx, edx
:0044F49C 8A11                    mov dl, byte ptr [ecx]
:0044F49E 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044F4A1 899004050000            mov dword ptr [eax+00000504], edx
:0044F4A7 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044F4AA 83C101                  add ecx, 00000001
:0044F4AD 894D08                  mov dword ptr [ebp+08], ecx
:0044F4B0 8B5508                  mov edx, dword ptr [ebp+08]
:0044F4B3 33C0                    xor eax, eax
:0044F4B5 8A02                    mov al, byte ptr [edx]
:0044F4B7 8945FC                  mov dword ptr [ebp-04], eax
:0044F4BA 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044F4BD 83C101                  add ecx, 00000001
:0044F4C0 894D08                  mov dword ptr [ebp+08], ecx
:0044F4C3 8B5508                  mov edx, dword ptr [ebp+08]
:0044F4C6 33C0                    xor eax, eax
:0044F4C8 8A02                    mov al, byte ptr [edx]
:0044F4CA C1E008                  shl eax, 08
:0044F4CD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044F4D0 03C8                    add ecx, eax
:0044F4D2 894DFC                  mov dword ptr [ebp-04], ecx
:0044F4D5 8B5508                  mov edx, dword ptr [ebp+08]
:0044F4D8 83C201                  add edx, 00000001
:0044F4DB 895508                  mov dword ptr [ebp+08], edx
:0044F4DE 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044F4E1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044F4E4 8988FC040000            mov dword ptr [eax+000004FC], ecx
:0044F4EA C645F800                mov [ebp-08], 00
:0044F4EE EB09                    jmp 0044F4F9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044F5B0(U)
|
:0044F4F0 8A55F8                  mov dl, byte ptr [ebp-08]
:0044F4F3 80C201                  add dl, 01
:0044F4F6 8855F8                  mov byte ptr [ebp-08], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044F4EE(U)
|
:0044F4F9 8B45F8                  mov eax, dword ptr [ebp-08]
:0044F4FC 25FF000000              and eax, 000000FF
:0044F501 3DFA000000              cmp eax, 000000FA
:0044F506 0F8DA9000000            jnl 0044F5B5
:0044F50C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044F50F 81E1FF000000            and ecx, 000000FF
:0044F515 6BC905                  imul ecx, 00000005
:0044F518 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044F51B 8B4508                  mov eax, dword ptr [ebp+08]
:0044F51E 8A00                    mov al, byte ptr [eax]
:0044F520 88440A19                mov byte ptr [edx+ecx+19], al
:0044F524 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044F527 83C101                  add ecx, 00000001
:0044F52A 894D08                  mov dword ptr [ebp+08], ecx
:0044F52D 8B55F8                  mov edx, dword ptr [ebp-08]
:0044F530 81E2FF000000            and edx, 000000FF
:0044F536 6BD205                  imul edx, 00000005
:0044F539 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044F53C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044F53F 8A09                    mov cl, byte ptr [ecx]
:0044F541 884C101A                mov byte ptr [eax+edx+1A], cl
:0044F545 8B5508                  mov edx, dword ptr [ebp+08]
:0044F548 83C201                  add edx, 00000001
:0044F54B 895508                  mov dword ptr [ebp+08], edx
:0044F54E 8B45F8                  mov eax, dword ptr [ebp-08]
:0044F551 25FF000000              and eax, 000000FF
:0044F556 6BC005                  imul eax, 00000005
:0044F559 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044F55C 8B5508                  mov edx, dword ptr [ebp+08]
:0044F55F 8A12                    mov dl, byte ptr [edx]
:0044F561 8854011B                mov byte ptr [ecx+eax+1B], dl
:0044F565 8B4508                  mov eax, dword ptr [ebp+08]
:0044F568 83C001                  add eax, 00000001
:0044F56B 894508                  mov dword ptr [ebp+08], eax
:0044F56E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044F571 81E1FF000000            and ecx, 000000FF
:0044F577 6BC905                  imul ecx, 00000005
:0044F57A 8B55F4                  mov edx, dword ptr [ebp-0C]
:0044F57D 8B4508                  mov eax, dword ptr [ebp+08]
:0044F580 8A00                    mov al, byte ptr [eax]
:0044F582 88440A1C                mov byte ptr [edx+ecx+1C], al
:0044F586 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044F589 83C101                  add ecx, 00000001
:0044F58C 894D08                  mov dword ptr [ebp+08], ecx
:0044F58F 8B55F8                  mov edx, dword ptr [ebp-08]
:0044F592 81E2FF000000            and edx, 000000FF
:0044F598 6BD205                  imul edx, 00000005
:0044F59B 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044F59E 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044F5A1 8A09                    mov cl, byte ptr [ecx]
:0044F5A3 884C101D                mov byte ptr [eax+edx+1D], cl
:0044F5A7 8B5508                  mov edx, dword ptr [ebp+08]
:0044F5AA 83C201                  add edx, 00000001
:0044F5AD 895508                  mov dword ptr [ebp+08], edx
:0044F5B0 E93BFFFFFF              jmp 0044F4F0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044F506(C)
|
:0044F5B5 8B4508                  mov eax, dword ptr [ebp+08]
:0044F5B8 8BE5                    mov esp, ebp
:0044F5BA 5D                      pop ebp
:0044F5BB C20400                  ret 0004



* Referenced by a CALL at Address:
|:0041B495   
|
:0044F5BE 55                      push ebp
:0044F5BF 8BEC                    mov ebp, esp
:0044F5C1 83EC14                  sub esp, 00000014
:0044F5C4 894DEC                  mov dword ptr [ebp-14], ecx
:0044F5C7 6A0E                    push 0000000E
:0044F5C9 E84DC2FDFF              call 0042B81B
:0044F5CE 83C404                  add esp, 00000004
:0044F5D1 6A04                    push 00000004
:0044F5D3 6A00                    push 00000000
:0044F5D5 6A00                    push 00000000
:0044F5D7 B990F44A00              mov ecx, 004AF490
:0044F5DC E85F040300              call 0047FA40
:0044F5E1 8945F0                  mov dword ptr [ebp-10], eax
:0044F5E4 8B45F0                  mov eax, dword ptr [ebp-10]
:0044F5E7 8945FC                  mov dword ptr [ebp-04], eax
:0044F5EA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044F5ED C60105                  mov byte ptr [ecx], 05
:0044F5F0 8B55FC                  mov edx, dword ptr [ebp-04]
:0044F5F3 83C201                  add edx, 00000001
:0044F5F6 8955FC                  mov dword ptr [ebp-04], edx
:0044F5F9 B9681B4A00              mov ecx, 004A1B68
:0044F5FE E8CD6FFBFF              call 004065D0
:0044F603 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044F606 884101                  mov byte ptr [ecx+01], al
:0044F609 8B55EC                  mov edx, dword ptr [ebp-14]
:0044F60C 33C0                    xor eax, eax
:0044F60E 8A4202                  mov al, byte ptr [edx+02]
:0044F611 83C001                  add eax, 00000001
:0044F614 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044F617 884102                  mov byte ptr [ecx+02], al
:0044F61A 8B55F0                  mov edx, dword ptr [ebp-10]
:0044F61D 83C205                  add edx, 00000005
:0044F620 8955FC                  mov dword ptr [ebp-04], edx
:0044F623 B9902F4900              mov ecx, 00492F90
:0044F628 E843CDFCFF              call 0041C370
:0044F62D 50                      push eax
:0044F62E 8B45FC                  mov eax, dword ptr [ebp-04]
:0044F631 50                      push eax
:0044F632 E846060300              call 0047FC7D
:0044F637 83C408                  add esp, 00000008
:0044F63A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044F63D 83C11E                  add ecx, 0000001E
:0044F640 894DFC                  mov dword ptr [ebp-04], ecx
:0044F643 8B55FC                  mov edx, dword ptr [ebp-04]
:0044F646 52                      push edx
:0044F647 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0044F64A E804FBFFFF              call 0044F153
:0044F64F 8945FC                  mov dword ptr [ebp-04], eax
:0044F652 C745F400000000          mov [ebp-0C], 00000000
:0044F659 EB09                    jmp 0044F664

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044F682(U)
|
:0044F65B 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044F65E 83C001                  add eax, 00000001
:0044F661 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044F659(U)
|
:0044F664 837DF473                cmp dword ptr [ebp-0C], 00000073
:0044F668 731A                    jnb 0044F684
:0044F66A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044F66D 51                      push ecx
:0044F66E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044F671 6BC924                  imul ecx, 00000024
:0044F674 81C1502C4B00            add ecx, 004B2C50
:0044F67A E87735FFFF              call 00442BF6
:0044F67F 8945FC                  mov dword ptr [ebp-04], eax
:0044F682 EBD7                    jmp 0044F65B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044F668(C)
|
:0044F684 C745F840060000          mov [ebp-08], 00000640
:0044F68B 8B55F8                  mov edx, dword ptr [ebp-08]
:0044F68E 52                      push edx
:0044F68F 8B45FC                  mov eax, dword ptr [ebp-04]
:0044F692 50                      push eax
:0044F693 6A04                    push 00000004
:0044F695 6A00                    push 00000000
:0044F697 68800C0000              push 00000C80
:0044F69C B938EB4A00              mov ecx, 004AEB38
:0044F6A1 E89A030300              call 0047FA40
:0044F6A6 50                      push eax
:0044F6A7 E851060300              call 0047FCFD
:0044F6AC 83C40C                  add esp, 0000000C
:0044F6AF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044F6B2 034DF8                  add ecx, dword ptr [ebp-08]
:0044F6B5 894DFC                  mov dword ptr [ebp-04], ecx
:0044F6B8 8B55FC                  mov edx, dword ptr [ebp-04]
:0044F6BB 2B55F0                  sub edx, dword ptr [ebp-10]
:0044F6BE 8955F8                  mov dword ptr [ebp-08], edx
:0044F6C1 8B45F8                  mov eax, dword ptr [ebp-08]
:0044F6C4 50                      push eax
:0044F6C5 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044F6C8 51                      push ecx
:0044F6C9 6A00                    push 00000000
:0044F6CB 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044F6CE E8C79BFCFF              call 0041929A
:0044F6D3 8945F8                  mov dword ptr [ebp-08], eax
:0044F6D6 6A00                    push 00000000
:0044F6D8 E83EC1FDFF              call 0042B81B
:0044F6DD 83C404                  add esp, 00000004
:0044F6E0 8BE5                    mov esp, ebp
:0044F6E2 5D                      pop ebp
:0044F6E3 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0041B0DD   
|
:0044F6E6 55                      push ebp
:0044F6E7 8BEC                    mov ebp, esp
:0044F6E9 83EC14                  sub esp, 00000014
:0044F6EC 894DEC                  mov dword ptr [ebp-14], ecx
:0044F6EF 6A0E                    push 0000000E
:0044F6F1 E825C1FDFF              call 0042B81B
:0044F6F6 83C404                  add esp, 00000004
:0044F6F9 6A04                    push 00000004
:0044F6FB 6A00                    push 00000000
:0044F6FD 6A00                    push 00000000
:0044F6FF B990F44A00              mov ecx, 004AF490
:0044F704 E837030300              call 0047FA40
:0044F709 8945F0                  mov dword ptr [ebp-10], eax
:0044F70C 6800500000              push 00005000
:0044F711 8B45F0                  mov eax, dword ptr [ebp-10]
:0044F714 50                      push eax
:0044F715 6A00                    push 00000000
:0044F717 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044F71A E8659AFCFF              call 00419184
:0044F71F 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044F722 83C123                  add ecx, 00000023
:0044F725 894DFC                  mov dword ptr [ebp-04], ecx
:0044F728 8B55FC                  mov edx, dword ptr [ebp-04]
:0044F72B 52                      push edx
:0044F72C 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0044F72F E850FCFFFF              call 0044F384
:0044F734 8945FC                  mov dword ptr [ebp-04], eax
:0044F737 C745F400000000          mov [ebp-0C], 00000000
:0044F73E EB09                    jmp 0044F749

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044F767(U)
|
:0044F740 8B45F4                  mov eax, dword ptr [ebp-0C]
:0044F743 83C001                  add eax, 00000001
:0044F746 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044F73E(U)
|
:0044F749 837DF473                cmp dword ptr [ebp-0C], 00000073
:0044F74D 731A                    jnb 0044F769
:0044F74F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044F752 51                      push ecx
:0044F753 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0044F756 6BC924                  imul ecx, 00000024
:0044F759 81C1502C4B00            add ecx, 004B2C50
:0044F75F E8C236FFFF              call 00442E26
:0044F764 8945FC                  mov dword ptr [ebp-04], eax
:0044F767 EBD7                    jmp 0044F740

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044F74D(C)
|
:0044F769 C745F840060000          mov [ebp-08], 00000640
:0044F770 8B55F8                  mov edx, dword ptr [ebp-08]
:0044F773 52                      push edx
:0044F774 6A04                    push 00000004
:0044F776 6A00                    push 00000000
:0044F778 68800C0000              push 00000C80
:0044F77D B938EB4A00              mov ecx, 004AEB38
:0044F782 E8B9020300              call 0047FA40
:0044F787 50                      push eax
:0044F788 8B45FC                  mov eax, dword ptr [ebp-04]
:0044F78B 50                      push eax
:0044F78C E86C050300              call 0047FCFD
:0044F791 83C40C                  add esp, 0000000C
:0044F794 6A00                    push 00000000
:0044F796 E880C0FDFF              call 0042B81B
:0044F79B 83C404                  add esp, 00000004
:0044F79E 8BE5                    mov esp, ebp
:0044F7A0 5D                      pop ebp
:0044F7A1 C20400                  ret 0004


:0044F7A4 CC                      int 03
:0044F7A5 CC                      int 03
:0044F7A6 CC                      int 03
:0044F7A7 CC                      int 03
:0044F7A8 CC                      int 03
:0044F7A9 CC                      int 03
:0044F7AA CC                      int 03
:0044F7AB CC                      int 03
:0044F7AC CC                      int 03
:0044F7AD CC                      int 03
:0044F7AE CC                      int 03
:0044F7AF CC                      int 03

* Referenced by a CALL at Addresses:
|:0044C647   , :0044F0B7   , :0046427B   , :0046429B   
|
:0044F7B0 55                      push ebp
:0044F7B1 8BEC                    mov ebp, esp
:0044F7B3 51                      push ecx
:0044F7B4 894DFC                  mov dword ptr [ebp-04], ecx
:0044F7B7 8B45FC                  mov eax, dword ptr [ebp-04]
:0044F7BA 8B4008                  mov eax, dword ptr [eax+08]
:0044F7BD 8BE5                    mov esp, ebp
:0044F7BF 5D                      pop ebp
:0044F7C0 C3                      ret


:0044F7C1 CC                      int 03
:0044F7C2 CC                      int 03
:0044F7C3 CC                      int 03
:0044F7C4 CC                      int 03
:0044F7C5 CC                      int 03
:0044F7C6 CC                      int 03
:0044F7C7 CC                      int 03
:0044F7C8 CC                      int 03
:0044F7C9 CC                      int 03
:0044F7CA CC                      int 03
:0044F7CB CC                      int 03
:0044F7CC CC                      int 03
:0044F7CD CC                      int 03
:0044F7CE CC                      int 03
:0044F7CF CC                      int 03

* Referenced by a CALL at Address:
|:0044C6F6   
|
:0044F7D0 55                      push ebp
:0044F7D1 8BEC                    mov ebp, esp
:0044F7D3 51                      push ecx
:0044F7D4 894DFC                  mov dword ptr [ebp-04], ecx
:0044F7D7 8B4508                  mov eax, dword ptr [ebp+08]
:0044F7DA 50                      push eax
:0044F7DB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044F7DE 81C1043D0000            add ecx, 00003D04
:0044F7E4 E807000000              call 0044F7F0
:0044F7E9 8BE5                    mov esp, ebp
:0044F7EB 5D                      pop ebp
:0044F7EC C20400                  ret 0004


:0044F7EF CC                      int 03

* Referenced by a CALL at Addresses:
|:0044F7E4   , :0044F874   
|
:0044F7F0 55                      push ebp
:0044F7F1 8BEC                    mov ebp, esp
:0044F7F3 83EC08                  sub esp, 00000008
:0044F7F6 894DFC                  mov dword ptr [ebp-04], ecx
:0044F7F9 8B45FC                  mov eax, dword ptr [ebp-04]
:0044F7FC 33C9                    xor ecx, ecx
:0044F7FE 668B08                  mov cx, word ptr [eax]
:0044F801 83E101                  and ecx, 00000001
:0044F804 85C9                    test ecx, ecx
:0044F806 741F                    je 0044F827
:0044F808 8B5508                  mov edx, dword ptr [ebp+08]
:0044F80B 81E2FFFF0000            and edx, 0000FFFF
:0044F811 8B45FC                  mov eax, dword ptr [ebp-04]
:0044F814 33C9                    xor ecx, ecx
:0044F816 668B4802                mov cx, word ptr [eax+02]
:0044F81A 3BD1                    cmp edx, ecx
:0044F81C 7509                    jne 0044F827
:0044F81E C745F801000000          mov [ebp-08], 00000001
:0044F825 EB07                    jmp 0044F82E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044F806(C), :0044F81C(C)
|
:0044F827 C745F800000000          mov [ebp-08], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044F825(U)
|
:0044F82E 8B45F8                  mov eax, dword ptr [ebp-08]
:0044F831 8BE5                    mov esp, ebp
:0044F833 5D                      pop ebp
:0044F834 C20400                  ret 0004


:0044F837 CC                      int 03
:0044F838 CC                      int 03
:0044F839 CC                      int 03
:0044F83A CC                      int 03
:0044F83B CC                      int 03
:0044F83C CC                      int 03
:0044F83D CC                      int 03
:0044F83E CC                      int 03
:0044F83F CC                      int 03

* Referenced by a CALL at Addresses:
|:0044C706   , :0044C73B   
|
:0044F840 55                      push ebp
:0044F841 8BEC                    mov ebp, esp
:0044F843 51                      push ecx
:0044F844 894DFC                  mov dword ptr [ebp-04], ecx
:0044F847 6A04                    push 00000004
:0044F849 8D4508                  lea eax, dword ptr [ebp+08]
:0044F84C 50                      push eax
:0044F84D 6A05                    push 00000005
:0044F84F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044F852 E82008FCFF              call 00410077
:0044F857 8BE5                    mov esp, ebp
:0044F859 5D                      pop ebp
:0044F85A C20400                  ret 0004


:0044F85D CC                      int 03
:0044F85E CC                      int 03
:0044F85F CC                      int 03

* Referenced by a CALL at Address:
|:0044C7EB   
|
:0044F860 55                      push ebp
:0044F861 8BEC                    mov ebp, esp
:0044F863 51                      push ecx
:0044F864 894DFC                  mov dword ptr [ebp-04], ecx
:0044F867 8B4508                  mov eax, dword ptr [ebp+08]
:0044F86A 50                      push eax
:0044F86B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044F86E 81C1083D0000            add ecx, 00003D08
:0044F874 E877FFFFFF              call 0044F7F0
:0044F879 8BE5                    mov esp, ebp
:0044F87B 5D                      pop ebp
:0044F87C C20400                  ret 0004


:0044F87F CC                      int 03

* Referenced by a CALL at Addresses:
|:0044C7FB   , :0044C8A2   , :0044C8D4   
|
:0044F880 55                      push ebp
:0044F881 8BEC                    mov ebp, esp
:0044F883 51                      push ecx
:0044F884 894DFC                  mov dword ptr [ebp-04], ecx
:0044F887 6A04                    push 00000004
:0044F889 8D4508                  lea eax, dword ptr [ebp+08]
:0044F88C 50                      push eax

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0044F88D 6A06                    push 00000006
:0044F88F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044F892 E8E007FCFF              call 00410077
:0044F897 8BE5                    mov esp, ebp
:0044F899 5D                      pop ebp
:0044F89A C20400                  ret 0004


:0044F89D CC                      int 03
:0044F89E CC                      int 03
:0044F89F CC                      int 03

* Referenced by a CALL at Address:
|:00449AA7   
|
:0044F8A0 55                      push ebp
:0044F8A1 8BEC                    mov ebp, esp
:0044F8A3 51                      push ecx
:0044F8A4 894DFC                  mov dword ptr [ebp-04], ecx
:0044F8A7 6840F94400              push 0044F940
:0044F8AC 68FA000000              push 000000FA
:0044F8B1 6A05                    push 00000005
:0044F8B3 8B45FC                  mov eax, dword ptr [ebp-04]
:0044F8B6 83C019                  add eax, 00000019
:0044F8B9 50                      push eax
:0044F8BA E8C13AFBFF              call 00403380
:0044F8BF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044F8C2 81C108050000            add ecx, 00000508
:0044F8C8 E843FE0000              call 0045F710
:0044F8CD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044F8D0 C7812005000000000000    mov dword ptr [ebx+00000520], 00000000
:0044F8DA 8B55FC                  mov edx, dword ptr [ebp-04]
:0044F8DD C7421400000000          mov [edx+14], 00000000
:0044F8E4 8B45FC                  mov eax, dword ptr [ebp-04]
:0044F8E7 8BE5                    mov esp, ebp
:0044F8E9 5D                      pop ebp
:0044F8EA C3                      ret


:0044F8EB CC                      int 03
:0044F8EC CC                      int 03
:0044F8ED CC                      int 03
:0044F8EE CC                      int 03
:0044F8EF CC                      int 03

* Referenced by a CALL at Addresses:
|:00449EB3   , :0044D1DE   , :0044D216   , :0044D25E   , :0044D63F   
|:0044D677   , :0044D6BF   
|
:0044F8F0 55                      push ebp
:0044F8F1 8BEC                    mov ebp, esp
:0044F8F3 51                      push ecx
:0044F8F4 894DFC                  mov dword ptr [ebp-04], ecx
:0044F8F7 B858074B00              mov eax, 004B0758
:0044F8FC 8BE5                    mov esp, ebp
:0044F8FE 5D                      pop ebp
:0044F8FF C3                      ret



* Referenced by a CALL at Address:
|:0044D565   
|
:0044F900 55                      push ebp
:0044F901 8BEC                    mov ebp, esp
:0044F903 51                      push ecx
:0044F904 894DFC                  mov dword ptr [ebp-04], ecx
:0044F907 8B45FC                  mov eax, dword ptr [ebp-04]
:0044F90A 33C9                    xor ecx, ecx
:0044F90C 8A880E3D0000            mov cl, byte ptr [eax+00003D0E]
:0044F912 8BC1                    mov eax, ecx
:0044F914 8BE5                    mov esp, ebp
:0044F916 5D                      pop ebp
:0044F917 C3                      ret


:0044F918 CC                      int 03
:0044F919 CC                      int 03
:0044F91A CC                      int 03
:0044F91B CC                      int 03
:0044F91C CC                      int 03
:0044F91D CC                      int 03
:0044F91E CC                      int 03
:0044F91F CC                      int 03

* Referenced by a CALL at Addresses:
|:00449DF6   , :00449E09   , :00449E1C   , :004604BE   
|
:0044F920 55                      push ebp
:0044F921 8BEC                    mov ebp, esp
:0044F923 51                      push ecx
:0044F924 894DFC                  mov dword ptr [ebp-04], ecx
:0044F927 8B45FC                  mov eax, dword ptr [ebp-04]
:0044F92A 8B8020050000            mov eax, dword ptr [eax+00000520]
:0044F930 8BE5                    mov esp, ebp
:0044F932 5D                      pop ebp
:0044F933 C3                      ret


:0044F934 CC                      int 03
:0044F935 CC                      int 03
:0044F936 CC                      int 03
:0044F937 CC                      int 03
:0044F938 CC                      int 03
:0044F939 CC                      int 03
:0044F93A CC                      int 03
:0044F93B CC                      int 03
:0044F93C CC                      int 03
:0044F93D CC                      int 03
:0044F93E CC                      int 03
:0044F93F CC                      int 03
:0044F940 55                      push ebp
:0044F941 8BEC                    mov ebp, esp
:0044F943 51                      push ecx
:0044F944 894DFC                  mov dword ptr [ebp-04], ecx
:0044F947 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0044F94A E8C1FD0000              call 0045F710
:0044F94F 8B45FC                  mov eax, dword ptr [ebp-04]
:0044F952 8BE5                    mov esp, ebp
:0044F954 5D                      pop ebp
:0044F955 C3                      ret


:0044F956 CC                      int 03
:0044F957 CC                      int 03
:0044F958 CC                      int 03
:0044F959 CC                      int 03
:0044F95A CC                      int 03
:0044F95B CC                      int 03
:0044F95C CC                      int 03
:0044F95D CC                      int 03
:0044F95E CC                      int 03
:0044F95F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040638F   , :0042533E   , :00449E27   , :00449E4B   , :0046AA75   
|:0046AB87   , :0046C170   , :0046C48D   
|
:0044F960 55                      push ebp
:0044F961 8BEC                    mov ebp, esp
:0044F963 51                      push ecx
:0044F964 894DFC                  mov dword ptr [ebp-04], ecx
:0044F967 8B45FC                  mov eax, dword ptr [ebp-04]
:0044F96A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044F96D 894804                  mov dword ptr [eax+04], ecx
:0044F970 8BE5                    mov esp, ebp
:0044F972 5D                      pop ebp
:0044F973 C20400                  ret 0004


:0044F976 CC                      int 03
:0044F977 CC                      int 03
:0044F978 CC                      int 03
:0044F979 CC                      int 03
:0044F97A CC                      int 03
:0044F97B CC                      int 03
:0044F97C CC                      int 03
:0044F97D CC                      int 03
:0044F97E CC                      int 03
:0044F97F CC                      int 03

* Referenced by a CALL at Addresses:
|:0044DAD8   , :0044DBA5   , :0044DC5F   , :0044DD43   , :0044DDFC   
|:0044DEB6   , :0044DF51   
|
:0044F980 55                      push ebp
:0044F981 8BEC                    mov ebp, esp
:0044F983 51                      push ecx
:0044F984 894DFC                  mov dword ptr [ebp-04], ecx
:0044F987 8B45FC                  mov eax, dword ptr [ebp-04]
:0044F98A 8A4D08                  mov cl, byte ptr [ebp+08]
:0044F98D 88480B                  mov byte ptr [eax+0B], cl
:0044F990 8BE5                    mov esp, ebp
:0044F992 5D                      pop ebp
:0044F993 C20400                  ret 0004


:0044F996 CC                      int 03
:0044F997 CC                      int 03
:0044F998 CC                      int 03
:0044F999 CC                      int 03
:0044F99A CC                      int 03
:0044F99B CC                      int 03
:0044F99C CC                      int 03
:0044F99D CC                      int 03
:0044F99E CC                      int 03
:0044F99F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040BC42   , :0041B299   , :0042888C   , :0043F90E   , :0044E4BD   
|:0044E562   , :0044E5CB   , :0045B614   , :00478158   
|
:0044F9A0 55                      push ebp
:0044F9A1 8BEC                    mov ebp, esp
:0044F9A3 51                      push ecx
:0044F9A4 894DFC                  mov dword ptr [ebp-04], ecx
:0044F9A7 8B45FC                  mov eax, dword ptr [ebp-04]
:0044F9AA 8A4001                  mov al, byte ptr [eax+01]
:0044F9AD 8BE5                    mov esp, ebp
:0044F9AF 5D                      pop ebp
:0044F9B0 C3                      ret


:0044F9B1 CC                      int 03
:0044F9B2 CC                      int 03
:0044F9B3 CC                      int 03
:0044F9B4 CC                      int 03
:0044F9B5 CC                      int 03
:0044F9B6 CC                      int 03
:0044F9B7 CC                      int 03
:0044F9B8 CC                      int 03
:0044F9B9 CC                      int 03
:0044F9BA CC                      int 03
:0044F9BB CC                      int 03
:0044F9BC CC                      int 03
:0044F9BD CC                      int 03
:0044F9BE CC                      int 03
:0044F9BF CC                      int 03

* Referenced by a CALL at Address:
|:0044ED01   
|
:0044F9C0 55                      push ebp
:0044F9C1 8BEC                    mov ebp, esp
:0044F9C3 51                      push ecx
:0044F9C4 894DFC                  mov dword ptr [ebp-04], ecx
:0044F9C7 8B45FC                  mov eax, dword ptr [ebp-04]
:0044F9CA 8A4028                  mov al, byte ptr [eax+28]
:0044F9CD 8BE5                    mov esp, ebp
:0044F9CF 5D                      pop ebp
:0044F9D0 C3                      ret


:0044F9D1 CC                      int 03
:0044F9D2 CC                      int 03
:0044F9D3 CC                      int 03
:0044F9D4 CC                      int 03
:0044F9D5 CC                      int 03
:0044F9D6 CC                      int 03
:0044F9D7 CC                      int 03
:0044F9D8 CC                      int 03
:0044F9D9 CC                      int 03
:0044F9DA CC                      int 03
:0044F9DB CC                      int 03
:0044F9DC CC                      int 03
:0044F9DD CC                      int 03
:0044F9DE CC                      int 03
:0044F9DF CC                      int 03
:0044F9E0 55                      push ebp
:0044F9E1 8BEC                    mov ebp, esp
:0044F9E3 E807000000              call 0044F9EF
:0044F9E8 E811000000              call 0044F9FE
:0044F9ED 5D                      pop ebp
:0044F9EE C3                      ret



* Referenced by a CALL at Address:
|:0044F9E3   
|
:0044F9EF 55                      push ebp
:0044F9F0 8BEC                    mov ebp, esp
:0044F9F2 B950424B00              mov ecx, 004B4250
:0044F9F7 E80B200000              call 00451A07
:0044F9FC 5D                      pop ebp
:0044F9FD C3                      ret



* Referenced by a CALL at Address:
|:0044F9E8   
|
:0044F9FE 55                      push ebp
:0044F9FF 8BEC                    mov ebp, esp
:0044FA01 6810FA4400              push 0044FA10
:0044FA06 E8F5160300              call 00481100
:0044FA0B 83C404                  add esp, 00000004
:0044FA0E 5D                      pop ebp
:0044FA0F C3                      ret


:0044FA10 55                      push ebp
:0044FA11 8BEC                    mov ebp, esp
:0044FA13 B950424B00              mov ecx, 004B4250
:0044FA18 E827200000              call 00451A44
:0044FA1D 5D                      pop ebp
:0044FA1E C3                      ret



* Referenced by a CALL at Addresses:
|:0041C8F5   , :0041CB23   , :0041D85F   , :00421B60   , :00422277   
|:00422A8D   , :00433733   , :0043379A   , :0043D442   , :00441A23   
|:00457214   , :004592F2   
|
:0044FA1F 55                      push ebp
:0044FA20 8BEC                    mov ebp, esp
:0044FA22 51                      push ecx
:0044FA23 53                      push ebx
:0044FA24 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0044FA27 E8E4FC0000              call 0045F710
:0044FA2C 8B5D0C                  mov ebx, dword ptr [ebp+0C]
:0044FA2F 81E3FF000000            and ebx, 000000FF
:0044FA35 B950424B00              mov ecx, 004B4250
:0044FA3A E854200000              call 00451A93
:0044FA3F 99                      cdq
:0044FA40 B930000000              mov ecx, 00000030
:0044FA45 F7F9                    idiv ecx
:0044FA47 2BD8                    sub ebx, eax
:0044FA49 885DFC                  mov byte ptr [ebp-04], bl
:0044FA4C 8B5D0D                  mov ebx, dword ptr [ebp+0D]
:0044FA4F 81E3FF000000            and ebx, 000000FF
:0044FA55 B950424B00              mov ecx, 004B4250
:0044FA5A E845200000              call 00451AA4
:0044FA5F 99                      cdq
:0044FA60 B930000000              mov ecx, 00000030
:0044FA65 F7F9                    idiv ecx
:0044FA67 2BD8                    sub ebx, eax
:0044FA69 885DFD                  mov byte ptr [ebp-03], bl
:0044FA6C 8B5508                  mov edx, dword ptr [ebp+08]
:0044FA6F 668B45FC                mov ax, word ptr [ebp-04]
:0044FA73 668902                  mov word ptr [edx], ax
:0044FA76 8B4508                  mov eax, dword ptr [ebp+08]
:0044FA79 5B                      pop ebx
:0044FA7A 8BE5                    mov esp, ebp
:0044FA7C 5D                      pop ebp
:0044FA7D C3                      ret



* Referenced by a CALL at Addresses:
|:00401D16   , :0041414D   , :0041C8B0   , :0041CADE   , :0041D81A   
|:0042159E   , :00421B70   , :00422242   , :00422A4A   , :00424DCE   
|:00424FDD   , :0043D407   , :0043E6DA   , :004419E5   , :004571F1   
|:004592CF   , :00459AC7   
|
:0044FA7E 55                      push ebp
:0044FA7F 8BEC                    mov ebp, esp
:0044FA81 83EC08                  sub esp, 00000008
:0044FA84 56                      push esi
:0044FA85 8B7508                  mov esi, dword ptr [ebp+08]
:0044FA88 81E6FF000000            and esi, 000000FF
:0044FA8E B950424B00              mov ecx, 004B4250
:0044FA93 E8FB1F0000              call 00451A93
:0044FA98 99                      cdq
:0044FA99 B930000000              mov ecx, 00000030
:0044FA9E F7F9                    idiv ecx
:0044FAA0 2BF0                    sub esi, eax
:0044FAA2 8975F8                  mov dword ptr [ebp-08], esi
:0044FAA5 8B7509                  mov esi, dword ptr [ebp+09]
:0044FAA8 81E6FF000000            and esi, 000000FF
:0044FAAE B950424B00              mov ecx, 004B4250
:0044FAB3 E8EC1F0000              call 00451AA4
:0044FAB8 99                      cdq
:0044FAB9 B930000000              mov ecx, 00000030
:0044FABE F7F9                    idiv ecx
:0044FAC0 2BF0                    sub esi, eax
:0044FAC2 8975FC                  mov dword ptr [ebp-04], esi
:0044FAC5 8B55F8                  mov edx, dword ptr [ebp-08]
:0044FAC8 6BD230                  imul edx, 00000030
:0044FACB 8955F8                  mov dword ptr [ebp-08], edx
:0044FACE 8B45FC                  mov eax, dword ptr [ebp-04]
:0044FAD1 6BC030                  imul eax, 00000030
:0044FAD4 8945FC                  mov dword ptr [ebp-04], eax
:0044FAD7 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044FADA 894DF8                  mov dword ptr [ebp-08], ecx
:0044FADD 8B55FC                  mov edx, dword ptr [ebp-04]
:0044FAE0 83C238                  add edx, 00000038
:0044FAE3 8955FC                  mov dword ptr [ebp-04], edx
:0044FAE6 8B45F8                  mov eax, dword ptr [ebp-08]
:0044FAE9 8B55FC                  mov edx, dword ptr [ebp-04]
:0044FAEC 5E                      pop esi
:0044FAED 8BE5                    mov esp, ebp
:0044FAEF 5D                      pop ebp
:0044FAF0 C3                      ret



* Referenced by a CALL at Addresses:
|:00404359   , :004043B7   , :004054F2   , :00405526   , :00422355   
|:00422392   , :00422418   , :00422459   
|
:0044FAF1 55                      push ebp
:0044FAF2 8BEC                    mov ebp, esp
:0044FAF4 83EC24                  sub esp, 00000024
:0044FAF7 56                      push esi
:0044FAF8 8B4D08                  mov ecx, dword ptr [ebp+08]
:0044FAFB 81E1FF000000            and ecx, 000000FF
:0044FB01 6BC924                  imul ecx, 00000024
:0044FB04 81C1502C4B00            add ecx, 004B2C50
:0044FB0A E85138FBFF              call 00403360
:0044FB0F 668B00                  mov ax, word ptr [eax]
:0044FB12 668945F4                mov word ptr [ebp-0C], ax
:0044FB16 8D4DDC                  lea ecx, dword ptr [ebp-24]
:0044FB19 51                      push ecx
:0044FB1A E83B010300              call 0047FC5A
:0044FB1F 83C404                  add esp, 00000004
:0044FB22 8845FC                  mov byte ptr [ebp-04], al
:0044FB25 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0044FB29 7505                    jne 0044FB30
:0044FB2B E916010000              jmp 0044FC46

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044FB29(C)
|
:0044FB30 8B75F4                  mov esi, dword ptr [ebp-0C]
:0044FB33 81E6FF000000            and esi, 000000FF
:0044FB39 6BF630                  imul esi, 00000030
:0044FB3C B950424B00              mov ecx, 004B4250
:0044FB41 E84D1F0000              call 00451A93
:0044FB46 2BF0                    sub esi, eax
:0044FB48 8975F8                  mov dword ptr [ebp-08], esi
:0044FB4B 8B75F5                  mov esi, dword ptr [ebp-0B]
:0044FB4E 81E6FF000000            and esi, 000000FF
:0044FB54 6BF630                  imul esi, 00000030
:0044FB57 B950424B00              mov ecx, 004B4250
:0044FB5C E8431F0000              call 00451AA4
:0044FB61 2BF0                    sub esi, eax
:0044FB63 8975F0                  mov dword ptr [ebp-10], esi
:0044FB66 8B550C                  mov edx, dword ptr [ebp+0C]
:0044FB69 52                      push edx
:0044FB6A 8D45DC                  lea eax, dword ptr [ebp-24]
:0044FB6D 50                      push eax
:0044FB6E E8A1F5FDFF              call 0042F114
:0044FB73 83C408                  add esp, 00000008
:0044FB76 837DF800                cmp dword ptr [ebp-08], 00000000
:0044FB7A 7C24                    jl 0044FBA0
:0044FB7C B950424B00              mov ecx, 004B4250
:0044FB81 E8BE620000              call 00455E44
:0044FB86 3945F8                  cmp dword ptr [ebp-08], eax
:0044FB89 7D15                    jge 0044FBA0
:0044FB8B 837DF000                cmp dword ptr [ebp-10], 00000000
:0044FB8F 7C0F                    jl 0044FBA0
:0044FB91 B950424B00              mov ecx, 004B4250
:0044FB96 E8D0620000              call 00455E6B
:0044FB9B 3945F0                  cmp dword ptr [ebp-10], eax
:0044FB9E 7C05                    jl 0044FBA5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044FB7A(C), :0044FB89(C), :0044FB8F(C)
|
:0044FBA0 E9A1000000              jmp 0044FC46

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044FB9E(C)
|
:0044FBA5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044FBA8 894DF8                  mov dword ptr [ebp-08], ecx
:0044FBAB 8B55F0                  mov edx, dword ptr [ebp-10]
:0044FBAE 83C238                  add edx, 00000038
:0044FBB1 8955F0                  mov dword ptr [ebp-10], edx
:0044FBB4 6A04                    push 00000004
:0044FBB6 B9382F4900              mov ecx, 00492F38
:0044FBBB E876F1FBFF              call 0040ED36
:0044FBC0 8B4510                  mov eax, dword ptr [ebp+10]
:0044FBC3 25FF000000              and eax, 000000FF
:0044FBC8 50                      push eax
:0044FBC9 B9382F4900              mov ecx, 00492F38
:0044FBCE E8B1F0FBFF              call 0040EC84
:0044FBD3 6A00                    push 00000000
:0044FBD5 B9382F4900              mov ecx, 00492F38
:0044FBDA E8DDF0FBFF              call 0040ECBC
:0044FBDF 6A01                    push 00000001
:0044FBE1 B9382F4900              mov ecx, 00492F38
:0044FBE6 E81FF1FBFF              call 0040ED0A
:0044FBEB 8B4D14                  mov ecx, dword ptr [ebp+14]
:0044FBEE 81E1FF000000            and ecx, 000000FF
:0044FBF4 51                      push ecx
:0044FBF5 B9382F4900              mov ecx, 00492F38
:0044FBFA E8F5F0FBFF              call 0040ECF4
:0044FBFF 8B55F0                  mov edx, dword ptr [ebp-10]
:0044FC02 52                      push edx
:0044FC03 8B45F8                  mov eax, dword ptr [ebp-08]
:0044FC06 99                      cdq
:0044FC07 83E207                  and edx, 00000007
:0044FC0A 03C2                    add eax, edx
:0044FC0C C1F803                  sar eax, 03
:0044FC0F 50                      push eax
:0044FC10 B9382F4900              mov ecx, 00492F38
:0044FC15 E8BDEFFBFF              call 0040EBD7
:0044FC1A E8BCE9FCFF              call 0041E5DB
:0044FC1F 8B450C                  mov eax, dword ptr [ebp+0C]
:0044FC22 50                      push eax
:0044FC23 6870E24800              push 0048E270
:0044FC28 68382F4900              push 00492F38
:0044FC2D E86EFEFBFF              call 0040FAA0
:0044FC32 83C40C                  add esp, 0000000C
:0044FC35 E8BCE9FCFF              call 0041E5F6
:0044FC3A 6A00                    push 00000000
:0044FC3C B9382F4900              mov ecx, 00492F38
:0044FC41 E8C4F0FBFF              call 0040ED0A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044FB2B(U), :0044FBA0(U)
|
:0044FC46 5E                      pop esi
:0044FC47 8BE5                    mov esp, ebp
:0044FC49 5D                      pop ebp
:0044FC4A C3                      ret



* Referenced by a CALL at Addresses:
|:004404EC   , :0045008E   , :00450A66   
|
:0044FC4B 55                      push ebp
:0044FC4C 8BEC                    mov ebp, esp
:0044FC4E 83EC38                  sub esp, 00000038
:0044FC51 53                      push ebx
:0044FC52 56                      push esi
:0044FC53 8B5D0C                  mov ebx, dword ptr [ebp+0C]
:0044FC56 81E3FF000000            and ebx, 000000FF
:0044FC5C B950424B00              mov ecx, 004B4250
:0044FC61 E82D1E0000              call 00451A93
:0044FC66 99                      cdq
:0044FC67 B930000000              mov ecx, 00000030
:0044FC6C F7F9                    idiv ecx
:0044FC6E 2BD8                    sub ebx, eax
:0044FC70 885DF8                  mov byte ptr [ebp-08], bl
:0044FC73 8B5D0D                  mov ebx, dword ptr [ebp+0D]
:0044FC76 81E3FF000000            and ebx, 000000FF
:0044FC7C B950424B00              mov ecx, 004B4250
:0044FC81 E81E1E0000              call 00451AA4
:0044FC86 99                      cdq
:0044FC87 B930000000              mov ecx, 00000030
:0044FC8C F7F9                    idiv ecx
:0044FC8E 2BD8                    sub ebx, eax
:0044FC90 885DFC                  mov byte ptr [ebp-04], bl
:0044FC93 B950424B00              mov ecx, 004B4250
:0044FC98 E8A7610000              call 00455E44
:0044FC9D 99                      cdq
:0044FC9E B930000000              mov ecx, 00000030
:0044FCA3 F7F9                    idiv ecx
:0044FCA5 99                      cdq
:0044FCA6 2BC2                    sub eax, edx
:0044FCA8 D1F8                    sar eax, 1
:0044FCAA 8845EC                  mov byte ptr [ebp-14], al
:0044FCAD B950424B00              mov ecx, 004B4250
:0044FCB2 E8B4610000              call 00455E6B
:0044FCB7 99                      cdq
:0044FCB8 B930000000              mov ecx, 00000030
:0044FCBD F7F9                    idiv ecx
:0044FCBF 99                      cdq
:0044FCC0 2BC2                    sub eax, edx
:0044FCC2 D1F8                    sar eax, 1
:0044FCC4 8845F0                  mov byte ptr [ebp-10], al
:0044FCC7 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:0044FCCA E841FA0000              call 0045F710
:0044FCCF 8B5518                  mov edx, dword ptr [ebp+18]
:0044FCD2 81E2FF000000            and edx, 000000FF
:0044FCD8 81FAFF000000            cmp edx, 000000FF
:0044FCDE 0F84C6020000            je 0044FFAA
:0044FCE4 8A45F8                  mov al, byte ptr [ebp-08]
:0044FCE7 8845E4                  mov byte ptr [ebp-1C], al
:0044FCEA 8A4DFC                  mov cl, byte ptr [ebp-04]
:0044FCED 884DE8                  mov byte ptr [ebp-18], cl
:0044FCF0 8B4D18                  mov ecx, dword ptr [ebp+18]
:0044FCF3 81E1FF000000            and ecx, 000000FF
:0044FCF9 6BC924                  imul ecx, 00000024
:0044FCFC 81C1502C4B00            add ecx, 004B2C50
:0044FD02 E85936FBFF              call 00403360
:0044FD07 668B10                  mov dx, word ptr [eax]
:0044FD0A 668955E0                mov word ptr [ebp-20], dx
:0044FD0E 8B5DE0                  mov ebx, dword ptr [ebp-20]
:0044FD11 81E3FF000000            and ebx, 000000FF
:0044FD17 B950424B00              mov ecx, 004B4250
:0044FD1C E8721D0000              call 00451A93
:0044FD21 99                      cdq
:0044FD22 B930000000              mov ecx, 00000030
:0044FD27 F7F9                    idiv ecx
:0044FD29 2BD8                    sub ebx, eax
:0044FD2B 885DD8                  mov byte ptr [ebp-28], bl
:0044FD2E 8B5DE1                  mov ebx, dword ptr [ebp-1F]
:0044FD31 81E3FF000000            and ebx, 000000FF
:0044FD37 B950424B00              mov ecx, 004B4250
:0044FD3C E8631D0000              call 00451AA4
:0044FD41 99                      cdq
:0044FD42 B930000000              mov ecx, 00000030
:0044FD47 F7F9                    idiv ecx
:0044FD49 2BD8                    sub ebx, eax
:0044FD4B 885DDC                  mov byte ptr [ebp-24], bl
:0044FD4E 8B55E4                  mov edx, dword ptr [ebp-1C]
:0044FD51 81E2FF000000            and edx, 000000FF
:0044FD57 8B45EC                  mov eax, dword ptr [ebp-14]
:0044FD5A 25FF000000              and eax, 000000FF
:0044FD5F 3BD0                    cmp edx, eax
:0044FD61 7D09                    jge 0044FD6C
:0044FD63 C745D401000000          mov [ebp-2C], 00000001
:0044FD6A EB0E                    jmp 0044FD7A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044FD61(C)
|
:0044FD6C 8B4D10                  mov ecx, dword ptr [ebp+10]
:0044FD6F 81E1FF000000            and ecx, 000000FF
:0044FD75 F7D9                    neg ecx
:0044FD77 894DD4                  mov dword ptr [ebp-2C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044FD6A(U)
|
:0044FD7A 8A55F8                  mov dl, byte ptr [ebp-08]
:0044FD7D 0255D4                  add dl, byte ptr [ebp-2C]
:0044FD80 8855F8                  mov byte ptr [ebp-08], dl
:0044FD83 8B45E8                  mov eax, dword ptr [ebp-18]
:0044FD86 25FF000000              and eax, 000000FF
:0044FD8B 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0044FD8E 81E1FF000000            and ecx, 000000FF
:0044FD94 3BC1                    cmp eax, ecx
:0044FD96 7D09                    jge 0044FDA1
:0044FD98 C745D000000000          mov [ebp-30], 00000000
:0044FD9F EB11                    jmp 0044FDB2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044FD96(C)
|
:0044FDA1 8B5514                  mov edx, dword ptr [ebp+14]
:0044FDA4 81E2FF000000            and edx, 000000FF
:0044FDAA 83EA01                  sub edx, 00000001
:0044FDAD F7DA                    neg edx
:0044FDAF 8955D0                  mov dword ptr [ebp-30], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044FD9F(U)
|
:0044FDB2 8A45FC                  mov al, byte ptr [ebp-04]
:0044FDB5 0245D0                  add al, byte ptr [ebp-30]
:0044FDB8 8845FC                  mov byte ptr [ebp-04], al
:0044FDBB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044FDBE 81E1FF000000            and ecx, 000000FF
:0044FDC4 8B55D8                  mov edx, dword ptr [ebp-28]
:0044FDC7 81E2FF000000            and edx, 000000FF
:0044FDCD 3BCA                    cmp ecx, edx
:0044FDCF 0F8FD3010000            jg 0044FFA8
:0044FDD5 8B45D8                  mov eax, dword ptr [ebp-28]
:0044FDD8 25FF000000              and eax, 000000FF
:0044FDDD 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044FDE0 81E1FF000000            and ecx, 000000FF
:0044FDE6 8B5510                  mov edx, dword ptr [ebp+10]
:0044FDE9 81E2FF000000            and edx, 000000FF
:0044FDEF 03CA                    add ecx, edx
:0044FDF1 3BC1                    cmp eax, ecx
:0044FDF3 0F8DAF010000            jnl 0044FFA8
:0044FDF9 8B45FC                  mov eax, dword ptr [ebp-04]
:0044FDFC 25FF000000              and eax, 000000FF
:0044FE01 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0044FE04 81E1FF000000            and ecx, 000000FF
:0044FE0A 3BC1                    cmp eax, ecx
:0044FE0C 0F8F96010000            jg 0044FFA8
:0044FE12 8B55DC                  mov edx, dword ptr [ebp-24]
:0044FE15 81E2FF000000            and edx, 000000FF
:0044FE1B 8B45FC                  mov eax, dword ptr [ebp-04]
:0044FE1E 25FF000000              and eax, 000000FF
:0044FE23 8B4D14                  mov ecx, dword ptr [ebp+14]
:0044FE26 81E1FF000000            and ecx, 000000FF
:0044FE2C 03C1                    add eax, ecx
:0044FE2E 3BD0                    cmp edx, eax
:0044FE30 0F8D72010000            jnl 0044FFA8
:0044FE36 8B55E4                  mov edx, dword ptr [ebp-1C]
:0044FE39 81E2FF000000            and edx, 000000FF
:0044FE3F 8B45EC                  mov eax, dword ptr [ebp-14]
:0044FE42 25FF000000              and eax, 000000FF
:0044FE47 3BD0                    cmp edx, eax
:0044FE49 7D2B                    jge 0044FE76
:0044FE4B 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0044FE4E 81E1FF000000            and ecx, 000000FF
:0044FE54 8B5510                  mov edx, dword ptr [ebp+10]
:0044FE57 81E2FF000000            and edx, 000000FF
:0044FE5D 3BCA                    cmp ecx, edx
:0044FE5F 7C15                    jl 0044FE76
:0044FE61 8B4510                  mov eax, dword ptr [ebp+10]
:0044FE64 25FF000000              and eax, 000000FF
:0044FE69 83C001                  add eax, 00000001
:0044FE6C 8A4DF8                  mov cl, byte ptr [ebp-08]
:0044FE6F 2AC8                    sub cl, al
:0044FE71 884DF8                  mov byte ptr [ebp-08], cl
:0044FE74 EB53                    jmp 0044FEC9

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044FE49(C), :0044FE5F(C)
|
:0044FE76 8B55E4                  mov edx, dword ptr [ebp-1C]
:0044FE79 81E2FF000000            and edx, 000000FF
:0044FE7F 8B45EC                  mov eax, dword ptr [ebp-14]
:0044FE82 25FF000000              and eax, 000000FF
:0044FE87 3BD0                    cmp edx, eax
:0044FE89 7C3E                    jl 0044FEC9
:0044FE8B B950424B00              mov ecx, 004B4250
:0044FE90 E8AF5F0000              call 00455E44
:0044FE95 99                      cdq
:0044FE96 B930000000              mov ecx, 00000030
:0044FE9B F7F9                    idiv ecx
:0044FE9D 8B55E4                  mov edx, dword ptr [ebp-1C]
:0044FEA0 81E2FF000000            and edx, 000000FF
:0044FEA6 2BC2                    sub eax, edx
:0044FEA8 8B4D10                  mov ecx, dword ptr [ebp+10]
:0044FEAB 81E1FF000000            and ecx, 000000FF
:0044FEB1 3BC1                    cmp eax, ecx
:0044FEB3 7E14                    jle 0044FEC9
:0044FEB5 8B5510                  mov edx, dword ptr [ebp+10]
:0044FEB8 81E2FF000000            and edx, 000000FF
:0044FEBE 83C201                  add edx, 00000001
:0044FEC1 8A45F8                  mov al, byte ptr [ebp-08]
:0044FEC4 02C2                    add al, dl
:0044FEC6 8845F8                  mov byte ptr [ebp-08], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044FE74(U), :0044FE89(C), :0044FEB3(C), :0044FFA3(U)
|
:0044FEC9 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044FECC 81E1FF000000            and ecx, 000000FF
:0044FED2 8B55D8                  mov edx, dword ptr [ebp-28]
:0044FED5 81E2FF000000            and edx, 000000FF
:0044FEDB 3BCA                    cmp ecx, edx
:0044FEDD 0F8FC5000000            jg 0044FFA8
:0044FEE3 8B45D8                  mov eax, dword ptr [ebp-28]
:0044FEE6 25FF000000              and eax, 000000FF
:0044FEEB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044FEEE 81E1FF000000            and ecx, 000000FF
:0044FEF4 8B5510                  mov edx, dword ptr [ebp+10]
:0044FEF7 81E2FF000000            and edx, 000000FF
:0044FEFD 03CA                    add ecx, edx
:0044FEFF 3BC1                    cmp eax, ecx
:0044FF01 0F8DA1000000            jnl 0044FFA8
:0044FF07 8B45FC                  mov eax, dword ptr [ebp-04]
:0044FF0A 25FF000000              and eax, 000000FF
:0044FF0F 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0044FF12 81E1FF000000            and ecx, 000000FF
:0044FF18 3BC1                    cmp eax, ecx
:0044FF1A 0F8F88000000            jg 0044FFA8
:0044FF20 8B55DC                  mov edx, dword ptr [ebp-24]
:0044FF23 81E2FF000000            and edx, 000000FF
:0044FF29 8B45FC                  mov eax, dword ptr [ebp-04]
:0044FF2C 25FF000000              and eax, 000000FF
:0044FF31 8B4D14                  mov ecx, dword ptr [ebp+14]
:0044FF34 81E1FF000000            and ecx, 000000FF
:0044FF3A 03C1                    add eax, ecx
:0044FF3C 3BD0                    cmp edx, eax
:0044FF3E 7D68                    jge 0044FFA8
:0044FF40 8B55E8                  mov edx, dword ptr [ebp-18]
:0044FF43 81E2FF000000            and edx, 000000FF
:0044FF49 8B45F0                  mov eax, dword ptr [ebp-10]
:0044FF4C 25FF000000              and eax, 000000FF
:0044FF51 3BD0                    cmp edx, eax
:0044FF53 7D37                    jge 0044FF8C
:0044FF55 8A4DFC                  mov cl, byte ptr [ebp-04]
:0044FF58 80C101                  add cl, 01
:0044FF5B 884DFC                  mov byte ptr [ebp-04], cl
:0044FF5E 8B75FC                  mov esi, dword ptr [ebp-04]
:0044FF61 81E6FF000000            and esi, 000000FF
:0044FF67 8B5514                  mov edx, dword ptr [ebp+14]
:0044FF6A 81E2FF000000            and edx, 000000FF
:0044FF70 03F2                    add esi, edx
:0044FF72 B950424B00              mov ecx, 004B4250
:0044FF77 E8C85E0000              call 00455E44
:0044FF7C 99                      cdq
:0044FF7D B930000000              mov ecx, 00000030
:0044FF82 F7F9                    idiv ecx
:0044FF84 3BF0                    cmp esi, eax
:0044FF86 7C02                    jl 0044FF8A
:0044FF88 EB1E                    jmp 0044FFA8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044FF86(C)
|
:0044FF8A EB17                    jmp 0044FFA3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044FF53(C)
|
:0044FF8C 8A55FC                  mov dl, byte ptr [ebp-04]
:0044FF8F 80EA01                  sub dl, 01
:0044FF92 8855FC                  mov byte ptr [ebp-04], dl
:0044FF95 8B45FC                  mov eax, dword ptr [ebp-04]
:0044FF98 25FF000000              and eax, 000000FF
:0044FF9D 85C0                    test eax, eax
:0044FF9F 7F02                    jg 0044FFA3
:0044FFA1 EB05                    jmp 0044FFA8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044FF8A(U), :0044FF9F(C)
|
:0044FFA3 E921FFFFFF              jmp 0044FEC9

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044FDCF(C), :0044FDF3(C), :0044FE0C(C), :0044FE30(C), :0044FEDD(C)
|:0044FF01(C), :0044FF1A(C), :0044FF3E(C), :0044FF88(U), :0044FFA1(U)
|
:0044FFA8 EB6D                    jmp 00450017

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044FCDE(C)
|
:0044FFAA 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0044FFAD 81E1FF000000            and ecx, 000000FF
:0044FFB3 8B55EC                  mov edx, dword ptr [ebp-14]
:0044FFB6 81E2FF000000            and edx, 000000FF
:0044FFBC 3BCA                    cmp ecx, edx
:0044FFBE 7D09                    jge 0044FFC9
:0044FFC0 C745CC01000000          mov [ebp-34], 00000001
:0044FFC7 EB0D                    jmp 0044FFD6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044FFBE(C)
|
:0044FFC9 8B4510                  mov eax, dword ptr [ebp+10]
:0044FFCC 25FF000000              and eax, 000000FF
:0044FFD1 F7D8                    neg eax
:0044FFD3 8945CC                  mov dword ptr [ebp-34], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044FFC7(U)
|
:0044FFD6 8A4DF8                  mov cl, byte ptr [ebp-08]
:0044FFD9 024DCC                  add cl, byte ptr [ebp-34]
:0044FFDC 884DF8                  mov byte ptr [ebp-08], cl
:0044FFDF 8B55FC                  mov edx, dword ptr [ebp-04]
:0044FFE2 81E2FF000000            and edx, 000000FF
:0044FFE8 8B45F0                  mov eax, dword ptr [ebp-10]
:0044FFEB 25FF000000              and eax, 000000FF
:0044FFF0 3BD0                    cmp edx, eax
:0044FFF2 7D09                    jge 0044FFFD
:0044FFF4 C745C800000000          mov [ebp-38], 00000000
:0044FFFB EB11                    jmp 0045000E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044FFF2(C)
|
:0044FFFD 8B4D14                  mov ecx, dword ptr [ebp+14]
:00450000 81E1FF000000            and ecx, 000000FF
:00450006 83E901                  sub ecx, 00000001
:00450009 F7D9                    neg ecx
:0045000B 894DC8                  mov dword ptr [ebp-38], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044FFFB(U)
|
:0045000E 8A55FC                  mov dl, byte ptr [ebp-04]
:00450011 0255C8                  add dl, byte ptr [ebp-38]
:00450014 8855FC                  mov byte ptr [ebp-04], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044FFA8(U)
|
:00450017 8A45F8                  mov al, byte ptr [ebp-08]
:0045001A 8845F4                  mov byte ptr [ebp-0C], al
:0045001D 8A4DFC                  mov cl, byte ptr [ebp-04]
:00450020 884DF5                  mov byte ptr [ebp-0B], cl
:00450023 8B5508                  mov edx, dword ptr [ebp+08]
:00450026 668B45F4                mov ax, word ptr [ebp-0C]
:0045002A 668902                  mov word ptr [edx], ax
:0045002D 8B4508                  mov eax, dword ptr [ebp+08]
:00450030 5E                      pop esi
:00450031 5B                      pop ebx
:00450032 8BE5                    mov esp, ebp
:00450034 5D                      pop ebp
:00450035 C3                      ret



* Referenced by a CALL at Address:
|:004509E9   
|
:00450036 55                      push ebp
:00450037 8BEC                    mov ebp, esp
:00450039 83EC48                  sub esp, 00000048
:0045003C 56                      push esi
:0045003D 8B4D08                  mov ecx, dword ptr [ebp+08]
:00450040 81E1FF000000            and ecx, 000000FF
:00450046 6BC924                  imul ecx, 00000024
:00450049 81C1502C4B00            add ecx, 004B2C50
:0045004F E81CF60000              call 0045F670
:00450054 6BC048                  imul eax, 00000048
:00450057 05681B4A00              add eax, 004A1B68
:0045005C 8945C4                  mov dword ptr [ebp-3C], eax
:0045005F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00450062 81E1FF000000            and ecx, 000000FF
:00450068 6BC924                  imul ecx, 00000024
:0045006B 81C1502C4B00            add ecx, 004B2C50
:00450071 E8EA32FBFF              call 00403360
:00450076 668B00                  mov ax, word ptr [eax]
:00450079 668945CC                mov word ptr [ebp-34], ax
:0045007D 8A4D0C                  mov cl, byte ptr [ebp+0C]
:00450080 51                      push ecx
:00450081 6A03                    push 00000003
:00450083 6A04                    push 00000004
:00450085 668B55CC                mov dx, word ptr [ebp-34]
:00450089 52                      push edx
:0045008A 8D45D8                  lea eax, dword ptr [ebp-28]
:0045008D 50                      push eax
:0045008E E8B8FBFFFF              call 0044FC4B
:00450093 83C414                  add esp, 00000014
:00450096 8A4DD8                  mov cl, byte ptr [ebp-28]
:00450099 884DEC                  mov byte ptr [ebp-14], cl
:0045009C 8A55D9                  mov dl, byte ptr [ebp-27]
:0045009F 8855F8                  mov byte ptr [ebp-08], dl
:004500A2 8B75EC                  mov esi, dword ptr [ebp-14]
:004500A5 81E6FF000000            and esi, 000000FF
:004500AB 6BF630                  imul esi, 00000030
:004500AE B950424B00              mov ecx, 004B4250
:004500B3 E897190000              call 00451A4F
:004500B8 03C6                    add eax, esi
:004500BA 99                      cdq
:004500BB 83E207                  and edx, 00000007
:004500BE 03C2                    add eax, edx
:004500C0 C1F803                  sar eax, 03
:004500C3 83C001                  add eax, 00000001
:004500C6 8945D0                  mov dword ptr [ebp-30], eax
:004500C9 8B75F8                  mov esi, dword ptr [ebp-08]
:004500CC 81E6FF000000            and esi, 000000FF
:004500D2 6BF630                  imul esi, 00000030
:004500D5 B950424B00              mov ecx, 004B4250
:004500DA E881190000              call 00451A60
:004500DF 03F0                    add esi, eax
:004500E1 8975E0                  mov dword ptr [ebp-20], esi
:004500E4 6A00                    push 00000000
:004500E6 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:004500E9 E80265FBFF              call 004065F0
:004500EE 25FF000000              and eax, 000000FF
:004500F3 33C9                    xor ecx, ecx
:004500F5 3DFF000000              cmp eax, 000000FF
:004500FA 0F95C1                  setne cl
:004500FD 894DE4                  mov dword ptr [ebp-1C], ecx
:00450100 6A01                    push 00000001
:00450102 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:00450105 E8E664FBFF              call 004065F0
:0045010A 25FF000000              and eax, 000000FF
:0045010F 33D2                    xor edx, edx
:00450111 3DFF000000              cmp eax, 000000FF
:00450116 0F95C2                  setne dl
:00450119 8955D4                  mov dword ptr [ebp-2C], edx
:0045011C C745FC00000000          mov [ebp-04], 00000000
:00450123 C745E800000000          mov [ebp-18], 00000000
:0045012A 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:0045012D E81E65FBFF              call 00406650
:00450132 25FF000000              and eax, 000000FF
:00450137 3DFF000000              cmp eax, 000000FF
:0045013C 7509                    jne 00450147
:0045013E C7451800000000          mov [ebp+18], 00000000
:00450145 EB2E                    jmp 00450175

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045013C(C)
|
:00450147 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:0045014A E80165FBFF              call 00406650
:0045014F 25FF000000              and eax, 000000FF
:00450154 8B4D18                  mov ecx, dword ptr [ebp+18]
:00450157 03C8                    add ecx, eax
:00450159 83F97D                  cmp ecx, 0000007D
:0045015C 7617                    jbe 00450175
:0045015E 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:00450161 E8EA64FBFF              call 00406650
:00450166 25FF000000              and eax, 000000FF
:0045016B BA7D000000              mov edx, 0000007D
:00450170 2BD0                    sub edx, eax
:00450172 895518                  mov dword ptr [ebp+18], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00450145(U), :0045015C(C)
|
:00450175 837DE400                cmp dword ptr [ebp-1C], 00000000
:00450179 7416                    je 00450191
:0045017B 6A00                    push 00000000
:0045017D 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:00450180 E8FB94FBFF              call 00409680
:00450185 25FF000000              and eax, 000000FF
:0045018A 3DFF000000              cmp eax, 000000FF
:0045018F 7510                    jne 004501A1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00450179(C)
|
:00450191 C745FC01000000          mov [ebp-04], 00000001
:00450198 C7451C00000000          mov [ebp+1C], 00000000
:0045019F EB38                    jmp 004501D9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045018F(C)
|
:004501A1 837DE400                cmp dword ptr [ebp-1C], 00000000
:004501A5 7432                    je 004501D9
:004501A7 6A00                    push 00000000
:004501A9 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:004501AC E8CF94FBFF              call 00409680
:004501B1 25FF000000              and eax, 000000FF
:004501B6 8B4D1C                  mov ecx, dword ptr [ebp+1C]
:004501B9 03C8                    add ecx, eax
:004501BB 83F964                  cmp ecx, 00000064
:004501BE 7619                    jbe 004501D9
:004501C0 6A00                    push 00000000
:004501C2 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:004501C5 E8B694FBFF              call 00409680
:004501CA 25FF000000              and eax, 000000FF
:004501CF BA64000000              mov edx, 00000064
:004501D4 2BD0                    sub edx, eax
:004501D6 89551C                  mov dword ptr [ebp+1C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045019F(U), :004501A5(C), :004501BE(C)
|
:004501D9 837DD400                cmp dword ptr [ebp-2C], 00000000
:004501DD 7416                    je 004501F5
:004501DF 6A01                    push 00000001
:004501E1 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:004501E4 E89794FBFF              call 00409680
:004501E9 25FF000000              and eax, 000000FF
:004501EE 3DFF000000              cmp eax, 000000FF
:004501F3 7510                    jne 00450205

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004501DD(C)
|
:004501F5 C745E801000000          mov [ebp-18], 00000001
:004501FC C7452000000000          mov [ebp+20], 00000000
:00450203 EB38                    jmp 0045023D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004501F3(C)
|
:00450205 837DD400                cmp dword ptr [ebp-2C], 00000000
:00450209 7432                    je 0045023D
:0045020B 6A01                    push 00000001
:0045020D 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:00450210 E86B94FBFF              call 00409680
:00450215 25FF000000              and eax, 000000FF
:0045021A 8B4D20                  mov ecx, dword ptr [ebp+20]
:0045021D 03C8                    add ecx, eax
:0045021F 83F964                  cmp ecx, 00000064
:00450222 7619                    jbe 0045023D
:00450224 6A01                    push 00000001
:00450226 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:00450229 E85294FBFF              call 00409680
:0045022E 25FF000000              and eax, 000000FF
:00450233 BA64000000              mov edx, 00000064
:00450238 2BD0                    sub edx, eax
:0045023A 895520                  mov dword ptr [ebp+20], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00450203(U), :00450209(C), :00450222(C)
|
:0045023D E899E3FCFF              call 0041E5DB
:00450242 6A03                    push 00000003
:00450244 6A04                    push 00000004
:00450246 8A45F8                  mov al, byte ptr [ebp-08]
:00450249 50                      push eax
:0045024A 8A4DEC                  mov cl, byte ptr [ebp-14]
:0045024D 51                      push ecx
:0045024E B950424B00              mov ecx, 004B4250
:00450253 E8BF390000              call 00453C17
:00450258 6A01                    push 00000001
:0045025A B950424B00              mov ecx, 004B4250
:0045025F E81D3C0000              call 00453E81
:00450264 8D55CC                  lea edx, dword ptr [ebp-34]
:00450267 52                      push edx
:00450268 B950424B00              mov ecx, 004B4250
:0045026D E861420000              call 004544D3
:00450272 6A04                    push 00000004
:00450274 B9382F4900              mov ecx, 00492F38
:00450279 E8B8EAFBFF              call 0040ED36
:0045027E 6A01                    push 00000001
:00450280 B9382F4900              mov ecx, 00492F38
:00450285 E880EAFBFF              call 0040ED0A
:0045028A 6A12                    push 00000012
:0045028C B9382F4900              mov ecx, 00492F38
:00450291 E8EEE9FBFF              call 0040EC84
:00450296 6A2A                    push 0000002A
:00450298 B9382F4900              mov ecx, 00492F38
:0045029D E852EAFBFF              call 0040ECF4
:004502A2 8B45E0                  mov eax, dword ptr [ebp-20]
:004502A5 83C008                  add eax, 00000008
:004502A8 8945E0                  mov dword ptr [ebp-20], eax
:004502AB 8B4DE0                  mov ecx, dword ptr [ebp-20]
:004502AE 51                      push ecx
:004502AF 8B55D0                  mov edx, dword ptr [ebp-30]
:004502B2 52                      push edx
:004502B3 B9382F4900              mov ecx, 00492F38
:004502B8 E81AE9FBFF              call 0040EBD7
:004502BD 8B4D08                  mov ecx, dword ptr [ebp+08]
:004502C0 81E1FF000000            and ecx, 000000FF
:004502C6 6BC924                  imul ecx, 00000024
:004502C9 81C1502C4B00            add ecx, 004B2C50
:004502CF E80C2EFFFF              call 004430E0
:004502D4 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:004502D5 6874E24800              push 0048E274
:004502DA 68382F4900              push 00492F38
:004502DF E8BCF7FBFF              call 0040FAA0
:004502E4 83C40C                  add esp, 0000000C
:004502E7 6A00                    push 00000000
:004502E9 B9382F4900              mov ecx, 00492F38
:004502EE E817EAFBFF              call 0040ED0A
:004502F3 6A1F                    push 0000001F
:004502F5 B9382F4900              mov ecx, 00492F38
:004502FA E8F5E9FBFF              call 0040ECF4
:004502FF 8B45E0                  mov eax, dword ptr [ebp-20]
:00450302 50                      push eax
:00450303 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00450306 83C109                  add ecx, 00000009
:00450309 51                      push ecx
:0045030A B9382F4900              mov ecx, 00492F38
:0045030F E8C3E8FBFF              call 0040EBD7
:00450314 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:00450317 E8B462FBFF              call 004065D0
:0045031C 25FF000000              and eax, 000000FF
:00450321 50                      push eax

* Possible StringData Ref from Data Obj ->"Lv%2u"
                                  |
:00450322 6878E24800              push 0048E278
:00450327 68382F4900              push 00492F38
:0045032C E86FF7FBFF              call 0040FAA0
:00450331 83C40C                  add esp, 0000000C
:00450334 8B55E0                  mov edx, dword ptr [ebp-20]
:00450337 52                      push edx
:00450338 8B45D0                  mov eax, dword ptr [ebp-30]
:0045033B 83C00E                  add eax, 0000000E
:0045033E 50                      push eax
:0045033F B9382F4900              mov ecx, 00492F38
:00450344 E88EE8FBFF              call 0040EBD7
:00450349 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045034C 81E1FF000000            and ecx, 000000FF
:00450352 6BC924                  imul ecx, 00000024
:00450355 81C1502C4B00            add ecx, 004B2C50
:0045035B E810DCFCFF              call 0041DF70
:00450360 25FF000000              and eax, 000000FF
:00450365 8B0C85A8BE4800          mov ecx, dword ptr [4*eax+0048BEA8]
:0045036C 51                      push ecx

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:0045036D 6880E24800              push 0048E280
:00450372 68382F4900              push 00492F38
:00450377 E824F7FBFF              call 0040FAA0
:0045037C 83C40C                  add esp, 0000000C
:0045037F 6A04                    push 00000004
:00450381 6A04                    push 00000004
:00450383 6A00                    push 00000000
:00450385 6880010000              push 00000180
:0045038A B950EB4A00              mov ecx, 004AEB50
:0045038F E8ACF60200              call 0047FA40
:00450394 50                      push eax
:00450395 6A18                    push 00000018
:00450397 6A18                    push 00000018
:00450399 8B55E0                  mov edx, dword ptr [ebp-20]
:0045039C 83C220                  add edx, 00000020
:0045039F 52                      push edx
:004503A0 8B45D0                  mov eax, dword ptr [ebp-30]
:004503A3 8D0CC508000000          lea ecx, dword ptr [8*eax+00000008]
:004503AA 51                      push ecx
:004503AB E863150000              call 00451913
:004503B0 83C418                  add esp, 00000018
:004503B3 6A04                    push 00000004
:004503B5 6A04                    push 00000004
:004503B7 6A00                    push 00000000
:004503B9 68C0030000              push 000003C0
:004503BE B950EB4A00              mov ecx, 004AEB50
:004503C3 E878F60200              call 0047FA40
:004503C8 50                      push eax
:004503C9 6A18                    push 00000018
:004503CB 6A18                    push 00000018
:004503CD 8B55E0                  mov edx, dword ptr [ebp-20]
:004503D0 83C238                  add edx, 00000038
:004503D3 52                      push edx
:004503D4 8B45D0                  mov eax, dword ptr [ebp-30]
:004503D7 8D0CC508000000          lea ecx, dword ptr [8*eax+00000008]
:004503DE 51                      push ecx
:004503DF E82F150000              call 00451913
:004503E4 83C418                  add esp, 00000018
:004503E7 6A04                    push 00000004
:004503E9 6A04                    push 00000004
:004503EB 6A00                    push 00000000
:004503ED 6800060000              push 00000600
:004503F2 B950EB4A00              mov ecx, 004AEB50
:004503F7 E844F60200              call 0047FA40
:004503FC 50                      push eax
:004503FD 6A18                    push 00000018
:004503FF 6A18                    push 00000018
:00450401 8B55E0                  mov edx, dword ptr [ebp-20]
:00450404 83C250                  add edx, 00000050
:00450407 52                      push edx
:00450408 8B45D0                  mov eax, dword ptr [ebp-30]
:0045040B 8D0CC508000000          lea ecx, dword ptr [8*eax+00000008]
:00450412 51                      push ecx
:00450413 E8FB140000              call 00451913
:00450418 83C418                  add esp, 00000018
:0045041B 837DE400                cmp dword ptr [ebp-1C], 00000000
:0045041F 7434                    je 00450455
:00450421 6A04                    push 00000004
:00450423 6A04                    push 00000004
:00450425 6A00                    push 00000000
:00450427 68C0A90100              push 0001A9C0
:0045042C B950EB4A00              mov ecx, 004AEB50
:00450431 E80AF60200              call 0047FA40
:00450436 50                      push eax
:00450437 6A10                    push 00000010
:00450439 6A10                    push 00000010
:0045043B 8B55E0                  mov edx, dword ptr [ebp-20]
:0045043E 83C270                  add edx, 00000070
:00450441 52                      push edx
:00450442 8B45D0                  mov eax, dword ptr [ebp-30]
:00450445 8D0CC510000000          lea ecx, dword ptr [8*eax+00000010]
:0045044C 51                      push ecx
:0045044D E8C1140000              call 00451913
:00450452 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045041F(C)
|
:00450455 837DD400                cmp dword ptr [ebp-2C], 00000000
:00450459 7434                    je 0045048F
:0045045B 6A04                    push 00000004
:0045045D 6A04                    push 00000004
:0045045F 6A00                    push 00000000
:00450461 68C0AA0100              push 0001AAC0
:00450466 B950EB4A00              mov ecx, 004AEB50
:0045046B E8D0F50200              call 0047FA40
:00450470 50                      push eax
:00450471 6A10                    push 00000010
:00450473 6A10                    push 00000010
:00450475 8B55E0                  mov edx, dword ptr [ebp-20]
:00450478 83C270                  add edx, 00000070
:0045047B 52                      push edx
:0045047C 8B45D0                  mov eax, dword ptr [ebp-30]
:0045047F 8D0CC568000000          lea ecx, dword ptr [8*eax+00000068]
:00450486 51                      push ecx
:00450487 E887140000              call 00451913
:0045048C 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00450459(C)
|
:0045048F 6A04                    push 00000004
:00450491 6A00                    push 00000000
:00450493 6800690000              push 00006900
:00450498 B9C8E44A00              mov ecx, 004AE4C8
:0045049D E89EF50200              call 0047FA40
:004504A2 50                      push eax

* Possible Ref to Menu: APPMENU, Item: "_8"
                                  |
:004504A3 6A68                    push 00000068
:004504A5 6898000000              push 00000098
:004504AA 8B55E0                  mov edx, dword ptr [ebp-20]
:004504AD 83C220                  add edx, 00000020
:004504B0 52                      push edx
:004504B1 8B45D0                  mov eax, dword ptr [ebp-30]
:004504B4 8D0CC528000000          lea ecx, dword ptr [8*eax+00000028]
:004504BB 51                      push ecx
:004504BC E890DD0200              call 0047E251
:004504C1 83C414                  add esp, 00000014
:004504C4 8B4D08                  mov ecx, dword ptr [ebp+08]
:004504C7 81E1FF000000            and ecx, 000000FF
:004504CD 6BC924                  imul ecx, 00000024
:004504D0 81C1502C4B00            add ecx, 004B2C50
:004504D6 E8B5270200              call 00472C90
:004504DB 50                      push eax
:004504DC 8B55C4                  mov edx, dword ptr [ebp-3C]
:004504DF 52                      push edx
:004504E0 8B45E0                  mov eax, dword ptr [ebp-20]
:004504E3 83C020                  add eax, 00000020
:004504E6 50                      push eax
:004504E7 8B4DD0                  mov ecx, dword ptr [ebp-30]
:004504EA 8D14CD28000000          lea edx, dword ptr [8*ecx+00000028]
:004504F1 52                      push edx
:004504F2 6A00                    push 00000000
:004504F4 E8A60C0000              call 0045119F
:004504F9 83C414                  add esp, 00000014
:004504FC 8B4D08                  mov ecx, dword ptr [ebp+08]
:004504FF 81E1FF000000            and ecx, 000000FF
:00450505 6BC924                  imul ecx, 00000024
:00450508 81C1502C4B00            add ecx, 004B2C50
:0045050E E82D230200              call 00472840
:00450513 50                      push eax
:00450514 8B45C4                  mov eax, dword ptr [ebp-3C]
:00450517 50                      push eax
:00450518 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0045051B 83C138                  add ecx, 00000038
:0045051E 51                      push ecx
:0045051F 8B55D0                  mov edx, dword ptr [ebp-30]
:00450522 8D04D528000000          lea eax, dword ptr [8*edx+00000028]
:00450529 50                      push eax
:0045052A 6A01                    push 00000001
:0045052C E86E0C0000              call 0045119F
:00450531 83C414                  add esp, 00000014
:00450534 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:00450537 E81461FBFF              call 00406650
:0045053C 25FF000000              and eax, 000000FF
:00450541 50                      push eax
:00450542 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:00450545 51                      push ecx
:00450546 8B55E0                  mov edx, dword ptr [ebp-20]
:00450549 83C250                  add edx, 00000050
:0045054C 52                      push edx
:0045054D 8B45D0                  mov eax, dword ptr [ebp-30]
:00450550 8D0CC528000000          lea ecx, dword ptr [8*eax+00000028]
:00450557 51                      push ecx
:00450558 6A02                    push 00000002
:0045055A E8400C0000              call 0045119F
:0045055F 83C414                  add esp, 00000014
:00450562 6A00                    push 00000000
:00450564 B9382F4900              mov ecx, 00492F38
:00450569 E89CE7FBFF              call 0040ED0A
:0045056E 6A1F                    push 0000001F
:00450570 B9382F4900              mov ecx, 00492F38
:00450575 E87AE7FBFF              call 0040ECF4
:0045057A 837DE400                cmp dword ptr [ebp-1C], 00000000
:0045057E 7454                    je 004505D4
:00450580 8B55E0                  mov edx, dword ptr [ebp-20]
:00450583 83C270                  add edx, 00000070
:00450586 52                      push edx
:00450587 8B45D0                  mov eax, dword ptr [ebp-30]
:0045058A 83C005                  add eax, 00000005
:0045058D 50                      push eax
:0045058E B9382F4900              mov ecx, 00492F38
:00450593 E83FE6FBFF              call 0040EBD7
:00450598 837DFC00                cmp dword ptr [ebp-04], 00000000
:0045059C 7414                    je 004505B2

* Possible StringData Ref from Data Obj ->"MAX"
                                  |
:0045059E 6884E24800              push 0048E284
:004505A3 68382F4900              push 00492F38
:004505A8 E8F3F4FBFF              call 0040FAA0
:004505AD 83C408                  add esp, 00000008
:004505B0 EB22                    jmp 004505D4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045059C(C)
|
:004505B2 6A00                    push 00000000
:004505B4 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:004505B7 E8C490FBFF              call 00409680
:004505BC 25FF000000              and eax, 000000FF
:004505C1 50                      push eax

* Possible StringData Ref from Data Obj ->"%3u"
                                  |
:004505C2 6888E24800              push 0048E288
:004505C7 68382F4900              push 00492F38
:004505CC E8CFF4FBFF              call 0040FAA0
:004505D1 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045057E(C), :004505B0(U)
|
:004505D4 837DD400                cmp dword ptr [ebp-2C], 00000000
:004505D8 7454                    je 0045062E
:004505DA 8B4DE0                  mov ecx, dword ptr [ebp-20]
:004505DD 83C170                  add ecx, 00000070
:004505E0 51                      push ecx
:004505E1 8B55D0                  mov edx, dword ptr [ebp-30]
:004505E4 83C210                  add edx, 00000010
:004505E7 52                      push edx
:004505E8 B9382F4900              mov ecx, 00492F38
:004505ED E8E5E5FBFF              call 0040EBD7
:004505F2 837DE800                cmp dword ptr [ebp-18], 00000000
:004505F6 7414                    je 0045060C

* Possible StringData Ref from Data Obj ->"MAX"
                                  |
:004505F8 688CE24800              push 0048E28C
:004505FD 68382F4900              push 00492F38
:00450602 E899F4FBFF              call 0040FAA0
:00450607 83C408                  add esp, 00000008
:0045060A EB22                    jmp 0045062E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004505F6(C)
|
:0045060C 6A01                    push 00000001
:0045060E 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:00450611 E86A90FBFF              call 00409680
:00450616 25FF000000              and eax, 000000FF
:0045061B 50                      push eax

* Possible StringData Ref from Data Obj ->"%3u"
                                  |
:0045061C 6890E24800              push 0048E290
:00450621 68382F4900              push 00492F38
:00450626 E875F4FBFF              call 0040FAA0
:0045062B 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004505D8(C), :0045060A(U)
|
:0045062E E8C3DFFCFF              call 0041E5F6
:00450633 837D1000                cmp dword ptr [ebp+10], 00000000
:00450637 7510                    jne 00450649
:00450639 837D1400                cmp dword ptr [ebp+14], 00000000
:0045063D 750A                    jne 00450649
:0045063F 837D1800                cmp dword ptr [ebp+18], 00000000
:00450643 0F846B010000            je 004507B4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00450637(C), :0045063D(C)
|
:00450649 8B4510                  mov eax, dword ptr [ebp+10]
:0045064C 99                      cdq
:0045064D 83E203                  and edx, 00000003
:00450650 03C2                    add eax, edx
:00450652 C1F802                  sar eax, 02
:00450655 8945C0                  mov dword ptr [ebp-40], eax
:00450658 8B4514                  mov eax, dword ptr [ebp+14]
:0045065B 99                      cdq
:0045065C 83E203                  and edx, 00000003
:0045065F 03C2                    add eax, edx
:00450661 C1F802                  sar eax, 02
:00450664 8945BC                  mov dword ptr [ebp-44], eax
:00450667 8B4518                  mov eax, dword ptr [ebp+18]
:0045066A C1E802                  shr eax, 02
:0045066D 8945B8                  mov dword ptr [ebp-48], eax
:00450670 C745DC04000000          mov [ebp-24], 00000004
:00450677 EB09                    jmp 00450682

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045079E(U)
|
:00450679 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0045067C 83E901                  sub ecx, 00000001
:0045067F 894DDC                  mov dword ptr [ebp-24], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00450677(U)
|
:00450682 837DDC00                cmp dword ptr [ebp-24], 00000000
:00450686 0F8C17010000            jl 004507A3
:0045068C 6A01                    push 00000001
:0045068E B9181B4B00              mov ecx, 004B1B18
:00450693 E8A82CFBFF              call 00403340
:00450698 E843BEFDFF              call 0042C4E0
:0045069D E839DFFCFF              call 0041E5DB
:004506A2 6A04                    push 00000004
:004506A4 6A00                    push 00000000
:004506A6 6800690000              push 00006900
:004506AB B9C8E44A00              mov ecx, 004AE4C8
:004506B0 E88BF30200              call 0047FA40
:004506B5 50                      push eax
:004506B6 6A48                    push 00000048
:004506B8 6898000000              push 00000098
:004506BD 8B55E0                  mov edx, dword ptr [ebp-20]
:004506C0 83C220                  add edx, 00000020
:004506C3 52                      push edx
:004506C4 8B45D0                  mov eax, dword ptr [ebp-30]
:004506C7 8D0CC528000000          lea ecx, dword ptr [8*eax+00000028]
:004506CE 51                      push ecx
:004506CF E8C7D90200              call 0047E09B
:004506D4 83C414                  add esp, 00000014
:004506D7 8B4D08                  mov ecx, dword ptr [ebp+08]
:004506DA 81E1FF000000            and ecx, 000000FF
:004506E0 6BC924                  imul ecx, 00000024
:004506E3 81C1502C4B00            add ecx, 004B2C50
:004506E9 E8A2250200              call 00472C90
:004506EE 2B4510                  sub eax, dword ptr [ebp+10]
:004506F1 8B55C0                  mov edx, dword ptr [ebp-40]
:004506F4 0FAF55DC                imul edx, dword ptr [ebp-24]
:004506F8 03C2                    add eax, edx
:004506FA 50                      push eax
:004506FB 8B45C4                  mov eax, dword ptr [ebp-3C]
:004506FE 50                      push eax
:004506FF 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00450702 83C120                  add ecx, 00000020
:00450705 51                      push ecx
:00450706 8B55D0                  mov edx, dword ptr [ebp-30]
:00450709 8D04D528000000          lea eax, dword ptr [8*edx+00000028]
:00450710 50                      push eax
:00450711 6A00                    push 00000000
:00450713 E8870A0000              call 0045119F
:00450718 83C414                  add esp, 00000014
:0045071B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045071E 81E1FF000000            and ecx, 000000FF
:00450724 6BC924                  imul ecx, 00000024
:00450727 81C1502C4B00            add ecx, 004B2C50
:0045072D E80E210200              call 00472840
:00450732 2B4514                  sub eax, dword ptr [ebp+14]
:00450735 8B4DBC                  mov ecx, dword ptr [ebp-44]
:00450738 0FAF4DDC                imul ecx, dword ptr [ebp-24]
:0045073C 03C1                    add eax, ecx
:0045073E 50                      push eax
:0045073F 8B55C4                  mov edx, dword ptr [ebp-3C]
:00450742 52                      push edx
:00450743 8B45E0                  mov eax, dword ptr [ebp-20]
:00450746 83C038                  add eax, 00000038
:00450749 50                      push eax
:0045074A 8B4DD0                  mov ecx, dword ptr [ebp-30]
:0045074D 8D14CD28000000          lea edx, dword ptr [8*ecx+00000028]
:00450754 52                      push edx
:00450755 6A01                    push 00000001
:00450757 E8430A0000              call 0045119F
:0045075C 83C414                  add esp, 00000014
:0045075F 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:00450762 E8E95EFBFF              call 00406650
:00450767 25FF000000              and eax, 000000FF
:0045076C 034518                  add eax, dword ptr [ebp+18]
:0045076F 8B4DB8                  mov ecx, dword ptr [ebp-48]
:00450772 0FAF4DDC                imul ecx, dword ptr [ebp-24]
:00450776 2BC1                    sub eax, ecx
:00450778 50                      push eax
:00450779 8B55C4                  mov edx, dword ptr [ebp-3C]
:0045077C 52                      push edx
:0045077D 8B45E0                  mov eax, dword ptr [ebp-20]
:00450780 83C050                  add eax, 00000050
:00450783 50                      push eax
:00450784 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00450787 8D14CD28000000          lea edx, dword ptr [8*ecx+00000028]
:0045078E 52                      push edx
:0045078F 6A02                    push 00000002
:00450791 E8090A0000              call 0045119F
:00450796 83C414                  add esp, 00000014
:00450799 E858DEFCFF              call 0041E5F6
:0045079E E9D6FEFFFF              jmp 00450679

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00450686(C)
|
:004507A3 6A04                    push 00000004
:004507A5 B9181B4B00              mov ecx, 004B1B18
:004507AA E8912BFBFF              call 00403340
:004507AF E82CBDFDFF              call 0042C4E0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00450643(C)
|
:004507B4 6A00                    push 00000000
:004507B6 B9382F4900              mov ecx, 00492F38
:004507BB E84AE5FBFF              call 0040ED0A
:004507C0 6A1F                    push 0000001F
:004507C2 B9382F4900              mov ecx, 00492F38
:004507C7 E828E5FBFF              call 0040ECF4
:004507CC 8B451C                  mov eax, dword ptr [ebp+1C]
:004507CF 33D2                    xor edx, edx
:004507D1 B903000000              mov ecx, 00000003
:004507D6 F7F1                    div ecx
:004507D8 8945F0                  mov dword ptr [ebp-10], eax
:004507DB 8B4520                  mov eax, dword ptr [ebp+20]
:004507DE 33D2                    xor edx, edx
:004507E0 B903000000              mov ecx, 00000003
:004507E5 F7F1                    div ecx
:004507E7 8945F4                  mov dword ptr [ebp-0C], eax
:004507EA 837D1C00                cmp dword ptr [ebp+1C], 00000000
:004507EE 770A                    ja 004507FA
:004507F0 837D2000                cmp dword ptr [ebp+20], 00000000
:004507F4 0F8642010000            jbe 0045093C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004507EE(C)
|
:004507FA C745DC03000000          mov [ebp-24], 00000003
:00450801 EB09                    jmp 0045080C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00450937(U)
|
:00450803 8B55DC                  mov edx, dword ptr [ebp-24]
:00450806 83EA01                  sub edx, 00000001
:00450809 8955DC                  mov dword ptr [ebp-24], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00450801(U)
|
:0045080C 837DDC00                cmp dword ptr [ebp-24], 00000000
:00450810 0F8C26010000            jl 0045093C
:00450816 6A01                    push 00000001
:00450818 B9181B4B00              mov ecx, 004B1B18
:0045081D E81E2BFBFF              call 00403340
:00450822 E8B9BCFDFF              call 0042C4E0
:00450827 E8AFDDFCFF              call 0041E5DB
:0045082C 6A04                    push 00000004
:0045082E 6A00                    push 00000000
:00450830 6800690000              push 00006900
:00450835 B9C8E44A00              mov ecx, 004AE4C8
:0045083A E801F20200              call 0047FA40
:0045083F 05C02A0000              add eax, 00002AC0
:00450844 50                      push eax
:00450845 6A20                    push 00000020
:00450847 6898000000              push 00000098
:0045084C 8B45E0                  mov eax, dword ptr [ebp-20]
:0045084F 83C068                  add eax, 00000068
:00450852 50                      push eax
:00450853 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00450856 8D14CD28000000          lea edx, dword ptr [8*ecx+00000028]
:0045085D 52                      push edx
:0045085E E838D80200              call 0047E09B
:00450863 83C414                  add esp, 00000014
:00450866 837DE400                cmp dword ptr [ebp-1C], 00000000
:0045086A 7460                    je 004508CC
:0045086C 8B45E0                  mov eax, dword ptr [ebp-20]
:0045086F 83C070                  add eax, 00000070
:00450872 50                      push eax
:00450873 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00450876 83C105                  add ecx, 00000005
:00450879 51                      push ecx
:0045087A B9382F4900              mov ecx, 00492F38
:0045087F E853E3FBFF              call 0040EBD7
:00450884 837DFC00                cmp dword ptr [ebp-04], 00000000
:00450888 7414                    je 0045089E

* Possible StringData Ref from Data Obj ->"MAX"
                                  |
:0045088A 6894E24800              push 0048E294
:0045088F 68382F4900              push 00492F38
:00450894 E807F2FBFF              call 0040FAA0
:00450899 83C408                  add esp, 00000008
:0045089C EB2E                    jmp 004508CC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00450888(C)
|
:0045089E 6A00                    push 00000000
:004508A0 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:004508A3 E8D88DFBFF              call 00409680
:004508A8 25FF000000              and eax, 000000FF
:004508AD 03451C                  add eax, dword ptr [ebp+1C]
:004508B0 8B55F0                  mov edx, dword ptr [ebp-10]
:004508B3 0FAF55DC                imul edx, dword ptr [ebp-24]
:004508B7 2BC2                    sub eax, edx
:004508B9 50                      push eax

* Possible StringData Ref from Data Obj ->"%3u"
                                  |
:004508BA 6898E24800              push 0048E298
:004508BF 68382F4900              push 00492F38
:004508C4 E8D7F1FBFF              call 0040FAA0
:004508C9 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045086A(C), :0045089C(U)
|
:004508CC 837DD400                cmp dword ptr [ebp-2C], 00000000
:004508D0 7460                    je 00450932
:004508D2 8B45E0                  mov eax, dword ptr [ebp-20]
:004508D5 83C070                  add eax, 00000070
:004508D8 50                      push eax
:004508D9 8B4DD0                  mov ecx, dword ptr [ebp-30]
:004508DC 83C110                  add ecx, 00000010
:004508DF 51                      push ecx
:004508E0 B9382F4900              mov ecx, 00492F38
:004508E5 E8EDE2FBFF              call 0040EBD7
:004508EA 837DE800                cmp dword ptr [ebp-18], 00000000
:004508EE 7414                    je 00450904

* Possible StringData Ref from Data Obj ->"MAX"
                                  |
:004508F0 689CE24800              push 0048E29C
:004508F5 68382F4900              push 00492F38
:004508FA E8A1F1FBFF              call 0040FAA0
:004508FF 83C408                  add esp, 00000008
:00450902 EB2E                    jmp 00450932

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004508EE(C)
|
:00450904 6A01                    push 00000001
:00450906 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:00450909 E8728DFBFF              call 00409680
:0045090E 25FF000000              and eax, 000000FF
:00450913 034520                  add eax, dword ptr [ebp+20]
:00450916 8B55F4                  mov edx, dword ptr [ebp-0C]
:00450919 0FAF55DC                imul edx, dword ptr [ebp-24]
:0045091D 2BC2                    sub eax, edx
:0045091F 50                      push eax

* Possible StringData Ref from Data Obj ->"%3u"
                                  |
:00450920 68A0E24800              push 0048E2A0
:00450925 68382F4900              push 00492F38
:0045092A E871F1FBFF              call 0040FAA0
:0045092F 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004508D0(C), :00450902(U)
|
:00450932 E8BFDCFCFF              call 0041E5F6
:00450937 E9C7FEFFFF              jmp 00450803

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004507F4(C), :00450810(C)
|
:0045093C 6A00                    push 00000000
:0045093E B9382F4900              mov ecx, 00492F38
:00450943 E8C2E3FBFF              call 0040ED0A
:00450948 8B4524                  mov eax, dword ptr [ebp+24]
:0045094B F7D8                    neg eax
:0045094D 1BC0                    sbb eax, eax
:0045094F 83E004                  and eax, 00000004
:00450952 83C004                  add eax, 00000004
:00450955 8945C8                  mov dword ptr [ebp-38], eax
:00450958 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0045095B 51                      push ecx
:0045095C B9181B4B00              mov ecx, 004B1B18
:00450961 E8DA29FBFF              call 00403340
:00450966 E875BBFDFF              call 0042C4E0
:0045096B B950424B00              mov ecx, 004B4250
:00450970 E8A73C0000              call 0045461C
:00450975 B950424B00              mov ecx, 004B4250
:0045097A E8B3340000              call 00453E32
:0045097F 5E                      pop esi
:00450980 8BE5                    mov esp, ebp
:00450982 5D                      pop ebp
:00450983 C3                      ret



* Referenced by a CALL at Addresses:
|:00405AB8   , :00405C9C   , :0041CE15   , :0041CF33   , :00422BF5   
|:004230B6   , :0043D04F   , :0044996C   , :0044E086   
|
:00450984 55                      push ebp
:00450985 8BEC                    mov ebp, esp
:00450987 83EC34                  sub esp, 00000034
:0045098A 56                      push esi
:0045098B 837D1000                cmp dword ptr [ebp+10], 00000000
:0045098F 751D                    jne 004509AE
:00450991 837D1400                cmp dword ptr [ebp+14], 00000000
:00450995 7517                    jne 004509AE
:00450997 837D1800                cmp dword ptr [ebp+18], 00000000
:0045099B 7511                    jne 004509AE
:0045099D 837D1C00                cmp dword ptr [ebp+1C], 00000000
:004509A1 750B                    jne 004509AE
:004509A3 837D2000                cmp dword ptr [ebp+20], 00000000
:004509A7 7505                    jne 004509AE
:004509A9 E922050000              jmp 00450ED0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045098F(C), :00450995(C), :0045099B(C), :004509A1(C), :004509A7(C)
|
:004509AE 8B4D08                  mov ecx, dword ptr [ebp+08]
:004509B1 81E1FF000000            and ecx, 000000FF
:004509B7 6BC924                  imul ecx, 00000024
:004509BA 81C1502C4B00            add ecx, 004B2C50
:004509C0 E88FF5FEFF              call 0043FF54
:004509C5 85C0                    test eax, eax
:004509C7 742D                    je 004509F6
:004509C9 8B4524                  mov eax, dword ptr [ebp+24]
:004509CC 50                      push eax
:004509CD 8B4D20                  mov ecx, dword ptr [ebp+20]
:004509D0 51                      push ecx
:004509D1 8B551C                  mov edx, dword ptr [ebp+1C]
:004509D4 52                      push edx
:004509D5 8B4518                  mov eax, dword ptr [ebp+18]
:004509D8 50                      push eax
:004509D9 8B4D14                  mov ecx, dword ptr [ebp+14]
:004509DC 51                      push ecx
:004509DD 8B5510                  mov edx, dword ptr [ebp+10]
:004509E0 52                      push edx
:004509E1 8A450C                  mov al, byte ptr [ebp+0C]
:004509E4 50                      push eax
:004509E5 8A4D08                  mov cl, byte ptr [ebp+08]
:004509E8 51                      push ecx
:004509E9 E848F6FFFF              call 00450036
:004509EE 83C420                  add esp, 00000020
:004509F1 E9DA040000              jmp 00450ED0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004509C7(C)
|
:004509F6 8B4D08                  mov ecx, dword ptr [ebp+08]
:004509F9 81E1FF000000            and ecx, 000000FF
:004509FF 6BC924                  imul ecx, 00000024
:00450A02 81C1502C4B00            add ecx, 004B2C50
:00450A08 E863EC0000              call 0045F670
:00450A0D 6BC048                  imul eax, 00000048
:00450A10 05681B4A00              add eax, 004A1B68
:00450A15 8945E0                  mov dword ptr [ebp-20], eax
:00450A18 8B4D08                  mov ecx, dword ptr [ebp+08]
:00450A1B 81E1FF000000            and ecx, 000000FF
:00450A21 6BC924                  imul ecx, 00000024
:00450A24 81C1502C4B00            add ecx, 004B2C50
:00450A2A E83129FBFF              call 00403360
:00450A2F 668B10                  mov dx, word ptr [eax]
:00450A32 668955E8                mov word ptr [ebp-18], dx
:00450A36 8A450C                  mov al, byte ptr [ebp+0C]
:00450A39 50                      push eax
:00450A3A 8B4D08                  mov ecx, dword ptr [ebp+08]
:00450A3D 81E1FF000000            and ecx, 000000FF
:00450A43 6BC924                  imul ecx, 00000024
:00450A46 81C1502C4B00            add ecx, 004B2C50
:00450A4C E803F5FEFF              call 0043FF54
:00450A51 F7D8                    neg eax
:00450A53 1BC0                    sbb eax, eax
:00450A55 F7D8                    neg eax
:00450A57 83C002                  add eax, 00000002
:00450A5A 50                      push eax
:00450A5B 6A04                    push 00000004
:00450A5D 668B4DE8                mov cx, word ptr [ebp-18]
:00450A61 51                      push ecx
:00450A62 8D55F0                  lea edx, dword ptr [ebp-10]
:00450A65 52                      push edx
:00450A66 E8E0F1FFFF              call 0044FC4B
:00450A6B 83C414                  add esp, 00000014
:00450A6E 8A45F0                  mov al, byte ptr [ebp-10]
:00450A71 8845F8                  mov byte ptr [ebp-08], al
:00450A74 8A4DF1                  mov cl, byte ptr [ebp-0F]
:00450A77 884DFC                  mov byte ptr [ebp-04], cl
:00450A7A 8B75F8                  mov esi, dword ptr [ebp-08]
:00450A7D 81E6FF000000            and esi, 000000FF
:00450A83 6BF630                  imul esi, 00000030
:00450A86 B950424B00              mov ecx, 004B4250
:00450A8B E8BF0F0000              call 00451A4F
:00450A90 03C6                    add eax, esi
:00450A92 99                      cdq
:00450A93 83E207                  and edx, 00000007
:00450A96 03C2                    add eax, edx
:00450A98 C1F803                  sar eax, 03
:00450A9B 83C001                  add eax, 00000001
:00450A9E 8945EC                  mov dword ptr [ebp-14], eax
:00450AA1 8B75FC                  mov esi, dword ptr [ebp-04]
:00450AA4 81E6FF000000            and esi, 000000FF
:00450AAA 6BF630                  imul esi, 00000030
:00450AAD B950424B00              mov ecx, 004B4250
:00450AB2 E8A90F0000              call 00451A60
:00450AB7 03F0                    add esi, eax
:00450AB9 8975F4                  mov dword ptr [ebp-0C], esi
:00450ABC E81ADBFCFF              call 0041E5DB
:00450AC1 6A02                    push 00000002
:00450AC3 6A04                    push 00000004
:00450AC5 8A55FC                  mov dl, byte ptr [ebp-04]
:00450AC8 52                      push edx
:00450AC9 8A45F8                  mov al, byte ptr [ebp-08]
:00450ACC 50                      push eax
:00450ACD B950424B00              mov ecx, 004B4250
:00450AD2 E840310000              call 00453C17
:00450AD7 6A01                    push 00000001
:00450AD9 B950424B00              mov ecx, 004B4250
:00450ADE E89E330000              call 00453E81
:00450AE3 8D4DE8                  lea ecx, dword ptr [ebp-18]
:00450AE6 51                      push ecx
:00450AE7 B950424B00              mov ecx, 004B4250
:00450AEC E8E2390000              call 004544D3
:00450AF1 C645DC1F                mov [ebp-24], 1F
:00450AF5 8B4D08                  mov ecx, dword ptr [ebp+08]
:00450AF8 81E1FF000000            and ecx, 000000FF
:00450AFE 6BC924                  imul ecx, 00000024
:00450B01 81C1502C4B00            add ecx, 004B2C50
:00450B07 E80EF1FEFF              call 0043FC1A
:00450B0C 8845CC                  mov byte ptr [ebp-34], al
:00450B0F 807DCC01                cmp byte ptr [ebp-34], 01
:00450B13 740E                    je 00450B23
:00450B15 807DCC02                cmp byte ptr [ebp-34], 02
:00450B19 740E                    je 00450B29
:00450B1B 807DCC03                cmp byte ptr [ebp-34], 03
:00450B1F 740E                    je 00450B2F
:00450B21 EB10                    jmp 00450B33

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00450B13(C)
|
:00450B23 C645DCAD                mov [ebp-24], AD
:00450B27 EB0A                    jmp 00450B33

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00450B19(C)
|
:00450B29 C645DCAC                mov [ebp-24], AC
:00450B2D EB04                    jmp 00450B33

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00450B1F(C)
|
:00450B2F C645DCAC                mov [ebp-24], AC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00450B21(U), :00450B27(U), :00450B2D(U)
|
:00450B33 6A04                    push 00000004
:00450B35 B9382F4900              mov ecx, 00492F38
:00450B3A E8F7E1FBFF              call 0040ED36
:00450B3F 6A01                    push 00000001
:00450B41 B9382F4900              mov ecx, 00492F38
:00450B46 E8BFE1FBFF              call 0040ED0A
:00450B4B 6A00                    push 00000000
:00450B4D B9382F4900              mov ecx, 00492F38
:00450B52 E865E1FBFF              call 0040ECBC
:00450B57 6A12                    push 00000012
:00450B59 B9382F4900              mov ecx, 00492F38
:00450B5E E821E1FBFF              call 0040EC84
:00450B63 8B55DC                  mov edx, dword ptr [ebp-24]
:00450B66 81E2FF000000            and edx, 000000FF
:00450B6C 52                      push edx
:00450B6D B9382F4900              mov ecx, 00492F38
:00450B72 E87DE1FBFF              call 0040ECF4
:00450B77 8B45F4                  mov eax, dword ptr [ebp-0C]
:00450B7A 83C008                  add eax, 00000008
:00450B7D 8945F4                  mov dword ptr [ebp-0C], eax
:00450B80 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00450B83 51                      push ecx
:00450B84 8B55EC                  mov edx, dword ptr [ebp-14]
:00450B87 52                      push edx
:00450B88 B9382F4900              mov ecx, 00492F38
:00450B8D E845E0FBFF              call 0040EBD7
:00450B92 8B4D08                  mov ecx, dword ptr [ebp+08]
:00450B95 81E1FF000000            and ecx, 000000FF
:00450B9B 6BC924                  imul ecx, 00000024
:00450B9E 81C1502C4B00            add ecx, 004B2C50
:00450BA4 E83725FFFF              call 004430E0
:00450BA9 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:00450BAA 68A4E24800              push 0048E2A4
:00450BAF 68382F4900              push 00492F38
:00450BB4 E8E7EEFBFF              call 0040FAA0
:00450BB9 83C40C                  add esp, 0000000C
:00450BBC 6A00                    push 00000000
:00450BBE B9382F4900              mov ecx, 00492F38
:00450BC3 E842E1FBFF              call 0040ED0A
:00450BC8 6A1F                    push 0000001F
:00450BCA B9382F4900              mov ecx, 00492F38
:00450BCF E820E1FBFF              call 0040ECF4
:00450BD4 8B45F4                  mov eax, dword ptr [ebp-0C]
:00450BD7 50                      push eax
:00450BD8 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00450BDB 83C109                  add ecx, 00000009
:00450BDE 51                      push ecx
:00450BDF B9382F4900              mov ecx, 00492F38
:00450BE4 E8EEDFFBFF              call 0040EBD7
:00450BE9 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00450BEC E8DF59FBFF              call 004065D0
:00450BF1 25FF000000              and eax, 000000FF
:00450BF6 50                      push eax

* Possible StringData Ref from Data Obj ->"Lv%2u"
                                  |
:00450BF7 68A8E24800              push 0048E2A8
:00450BFC 68382F4900              push 00492F38
:00450C01 E89AEEFBFF              call 0040FAA0
:00450C06 83C40C                  add esp, 0000000C
:00450C09 8B55F4                  mov edx, dword ptr [ebp-0C]
:00450C0C 52                      push edx
:00450C0D 8B45EC                  mov eax, dword ptr [ebp-14]
:00450C10 83C00E                  add eax, 0000000E
:00450C13 50                      push eax
:00450C14 B9382F4900              mov ecx, 00492F38
:00450C19 E8B9DFFBFF              call 0040EBD7
:00450C1E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00450C21 81E1FF000000            and ecx, 000000FF
:00450C27 6BC924                  imul ecx, 00000024
:00450C2A 81C1502C4B00            add ecx, 004B2C50
:00450C30 E83BD3FCFF              call 0041DF70
:00450C35 25FF000000              and eax, 000000FF
:00450C3A 8B0C85A8BE4800          mov ecx, dword ptr [4*eax+0048BEA8]
:00450C41 51                      push ecx

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:00450C42 68B0E24800              push 0048E2B0
:00450C47 68382F4900              push 00492F38
:00450C4C E84FEEFBFF              call 0040FAA0
:00450C51 83C40C                  add esp, 0000000C
:00450C54 6A04                    push 00000004
:00450C56 6A04                    push 00000004
:00450C58 6A00                    push 00000000
:00450C5A 6880010000              push 00000180
:00450C5F B950EB4A00              mov ecx, 004AEB50
:00450C64 E8D7ED0200              call 0047FA40
:00450C69 50                      push eax
:00450C6A 6A18                    push 00000018
:00450C6C 6A18                    push 00000018
:00450C6E 8B55F4                  mov edx, dword ptr [ebp-0C]
:00450C71 83C220                  add edx, 00000020
:00450C74 52                      push edx
:00450C75 8B45EC                  mov eax, dword ptr [ebp-14]
:00450C78 8D0CC508000000          lea ecx, dword ptr [8*eax+00000008]
:00450C7F 51                      push ecx
:00450C80 E88E0C0000              call 00451913
:00450C85 83C418                  add esp, 00000018
:00450C88 6A04                    push 00000004
:00450C8A 6A04                    push 00000004
:00450C8C 6A00                    push 00000000
:00450C8E 68C0030000              push 000003C0
:00450C93 B950EB4A00              mov ecx, 004AEB50
:00450C98 E8A3ED0200              call 0047FA40
:00450C9D 50                      push eax
:00450C9E 6A18                    push 00000018
:00450CA0 6A18                    push 00000018
:00450CA2 8B55F4                  mov edx, dword ptr [ebp-0C]
:00450CA5 83C238                  add edx, 00000038
:00450CA8 52                      push edx
:00450CA9 8B45EC                  mov eax, dword ptr [ebp-14]
:00450CAC 8D0CC508000000          lea ecx, dword ptr [8*eax+00000008]
:00450CB3 51                      push ecx
:00450CB4 E85A0C0000              call 00451913
:00450CB9 83C418                  add esp, 00000018
:00450CBC 6A04                    push 00000004
:00450CBE 6A00                    push 00000000
:00450CC0 6800690000              push 00006900
:00450CC5 B9C8E44A00              mov ecx, 004AE4C8
:00450CCA E871ED0200              call 0047FA40
:00450CCF 50                      push eax
:00450CD0 6A30                    push 00000030
:00450CD2 6898000000              push 00000098
:00450CD7 8B55F4                  mov edx, dword ptr [ebp-0C]
:00450CDA 83C220                  add edx, 00000020
:00450CDD 52                      push edx
:00450CDE 8B45EC                  mov eax, dword ptr [ebp-14]
:00450CE1 8D0CC528000000          lea ecx, dword ptr [8*eax+00000028]
:00450CE8 51                      push ecx
:00450CE9 E863D50200              call 0047E251
:00450CEE 83C414                  add esp, 00000014
:00450CF1 8B4D08                  mov ecx, dword ptr [ebp+08]
:00450CF4 81E1FF000000            and ecx, 000000FF
:00450CFA 6BC924                  imul ecx, 00000024
:00450CFD 81C1502C4B00            add ecx, 004B2C50
:00450D03 E8881F0200              call 00472C90
:00450D08 50                      push eax
:00450D09 8B55E0                  mov edx, dword ptr [ebp-20]
:00450D0C 52                      push edx
:00450D0D 8B45F4                  mov eax, dword ptr [ebp-0C]
:00450D10 83C020                  add eax, 00000020
:00450D13 50                      push eax
:00450D14 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00450D17 8D14CD28000000          lea edx, dword ptr [8*ecx+00000028]
:00450D1E 52                      push edx
:00450D1F 6A00                    push 00000000
:00450D21 E879040000              call 0045119F
:00450D26 83C414                  add esp, 00000014
:00450D29 8B4D08                  mov ecx, dword ptr [ebp+08]
:00450D2C 81E1FF000000            and ecx, 000000FF
:00450D32 6BC924                  imul ecx, 00000024
:00450D35 81C1502C4B00            add ecx, 004B2C50
:00450D3B E8001B0200              call 00472840
:00450D40 50                      push eax
:00450D41 8B45E0                  mov eax, dword ptr [ebp-20]
:00450D44 50                      push eax
:00450D45 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00450D48 83C138                  add ecx, 00000038
:00450D4B 51                      push ecx
:00450D4C 8B55EC                  mov edx, dword ptr [ebp-14]
:00450D4F 8D04D528000000          lea eax, dword ptr [8*edx+00000028]
:00450D56 50                      push eax
:00450D57 6A01                    push 00000001
:00450D59 E841040000              call 0045119F
:00450D5E 83C414                  add esp, 00000014
:00450D61 E890D8FCFF              call 0041E5F6
:00450D66 837D1000                cmp dword ptr [ebp+10], 00000000
:00450D6A 750A                    jne 00450D76
:00450D6C 837D1400                cmp dword ptr [ebp+14], 00000000
:00450D70 0F8417010000            je 00450E8D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00450D6A(C)
|
:00450D76 8B4510                  mov eax, dword ptr [ebp+10]
:00450D79 99                      cdq
:00450D7A 83E203                  and edx, 00000003
:00450D7D 03C2                    add eax, edx
:00450D7F C1F802                  sar eax, 02
:00450D82 8945D8                  mov dword ptr [ebp-28], eax
:00450D85 8B4514                  mov eax, dword ptr [ebp+14]
:00450D88 99                      cdq
:00450D89 83E203                  and edx, 00000003
:00450D8C 03C2                    add eax, edx
:00450D8E C1F802                  sar eax, 02
:00450D91 8945D4                  mov dword ptr [ebp-2C], eax
:00450D94 C745D004000000          mov [ebp-30], 00000004
:00450D9B EB09                    jmp 00450DA6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00450E88(U)
|
:00450D9D 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00450DA0 83E901                  sub ecx, 00000001
:00450DA3 894DD0                  mov dword ptr [ebp-30], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00450D9B(U)
|
:00450DA6 837DD000                cmp dword ptr [ebp-30], 00000000
:00450DAA 0F8CDD000000            jl 00450E8D
:00450DB0 6A01                    push 00000001
:00450DB2 B9181B4B00              mov ecx, 004B1B18
:00450DB7 E88425FBFF              call 00403340
:00450DBC E81FB7FDFF              call 0042C4E0
:00450DC1 E815D8FCFF              call 0041E5DB
:00450DC6 6A04                    push 00000004
:00450DC8 6A00                    push 00000000
:00450DCA 6800690000              push 00006900
:00450DCF B9C8E44A00              mov ecx, 004AE4C8
:00450DD4 E867EC0200              call 0047FA40
:00450DD9 50                      push eax
:00450DDA 6A30                    push 00000030
:00450DDC 6898000000              push 00000098
:00450DE1 8B55F4                  mov edx, dword ptr [ebp-0C]
:00450DE4 83C220                  add edx, 00000020
:00450DE7 52                      push edx
:00450DE8 8B45EC                  mov eax, dword ptr [ebp-14]
:00450DEB 8D0CC528000000          lea ecx, dword ptr [8*eax+00000028]
:00450DF2 51                      push ecx
:00450DF3 E8A3D20200              call 0047E09B
:00450DF8 83C414                  add esp, 00000014
:00450DFB 8B4D08                  mov ecx, dword ptr [ebp+08]
:00450DFE 81E1FF000000            and ecx, 000000FF
:00450E04 6BC924                  imul ecx, 00000024
:00450E07 81C1502C4B00            add ecx, 004B2C50
:00450E0D E87E1E0200              call 00472C90
:00450E12 2B4510                  sub eax, dword ptr [ebp+10]
:00450E15 8B55D8                  mov edx, dword ptr [ebp-28]
:00450E18 0FAF55D0                imul edx, dword ptr [ebp-30]
:00450E1C 03C2                    add eax, edx
:00450E1E 50                      push eax
:00450E1F 8B45E0                  mov eax, dword ptr [ebp-20]
:00450E22 50                      push eax
:00450E23 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00450E26 83C120                  add ecx, 00000020
:00450E29 51                      push ecx
:00450E2A 8B55EC                  mov edx, dword ptr [ebp-14]
:00450E2D 8D04D528000000          lea eax, dword ptr [8*edx+00000028]
:00450E34 50                      push eax
:00450E35 6A00                    push 00000000
:00450E37 E863030000              call 0045119F
:00450E3C 83C414                  add esp, 00000014
:00450E3F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00450E42 81E1FF000000            and ecx, 000000FF
:00450E48 6BC924                  imul ecx, 00000024
:00450E4B 81C1502C4B00            add ecx, 004B2C50
:00450E51 E8EA190200              call 00472840
:00450E56 2B4514                  sub eax, dword ptr [ebp+14]
:00450E59 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00450E5C 0FAF4DD0                imul ecx, dword ptr [ebp-30]
:00450E60 03C1                    add eax, ecx
:00450E62 50                      push eax
:00450E63 8B55E0                  mov edx, dword ptr [ebp-20]
:00450E66 52                      push edx
:00450E67 8B45F4                  mov eax, dword ptr [ebp-0C]
:00450E6A 83C038                  add eax, 00000038
:00450E6D 50                      push eax
:00450E6E 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00450E71 8D14CD28000000          lea edx, dword ptr [8*ecx+00000028]
:00450E78 52                      push edx
:00450E79 6A01                    push 00000001
:00450E7B E81F030000              call 0045119F
:00450E80 83C414                  add esp, 00000014
:00450E83 E86ED7FCFF              call 0041E5F6
:00450E88 E910FFFFFF              jmp 00450D9D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00450D70(C), :00450DAA(C)
|
:00450E8D 6A00                    push 00000000
:00450E8F B9382F4900              mov ecx, 00492F38
:00450E94 E871DEFBFF              call 0040ED0A
:00450E99 8B4524                  mov eax, dword ptr [ebp+24]
:00450E9C F7D8                    neg eax
:00450E9E 1BC0                    sbb eax, eax
:00450EA0 83E004                  and eax, 00000004
:00450EA3 83C004                  add eax, 00000004
:00450EA6 8945E4                  mov dword ptr [ebp-1C], eax
:00450EA9 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00450EAC 51                      push ecx
:00450EAD B9181B4B00              mov ecx, 004B1B18
:00450EB2 E88924FBFF              call 00403340
:00450EB7 E824B6FDFF              call 0042C4E0
:00450EBC B950424B00              mov ecx, 004B4250
:00450EC1 E856370000              call 0045461C
:00450EC6 B950424B00              mov ecx, 004B4250
:00450ECB E8622F0000              call 00453E32

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004509A9(U), :004509F1(U)
|
:00450ED0 5E                      pop esi
:00450ED1 8BE5                    mov esp, ebp
:00450ED3 5D                      pop ebp
:00450ED4 C3                      ret



* Referenced by a CALL at Addresses:
|:00440708   , :00440790   , :00440846   , :00440909   , :00440A9B   
|:00440B2D   , :00440BCC   
|
:00450ED5 55                      push ebp
:00450ED6 8BEC                    mov ebp, esp
:00450ED8 83EC20                  sub esp, 00000020
:00450EDB 8B4510                  mov eax, dword ptr [ebp+10]
:00450EDE 8D0CC540000000          lea ecx, dword ptr [8*eax+00000040]
:00450EE5 C1E903                  shr ecx, 03
:00450EE8 894DF8                  mov dword ptr [ebp-08], ecx
:00450EEB 8B5520                  mov edx, dword ptr [ebp+20]
:00450EEE 81E2FF000000            and edx, 000000FF
:00450EF4 83FA03                  cmp edx, 00000003
:00450EF7 7416                    je 00450F0F
:00450EF9 8B4520                  mov eax, dword ptr [ebp+20]
:00450EFC 25FF000000              and eax, 000000FF
:00450F01 83F804                  cmp eax, 00000004
:00450F04 7409                    je 00450F0F
:00450F06 C745EC00000000          mov [ebp-14], 00000000
:00450F0D EB07                    jmp 00450F16

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00450EF7(C), :00450F04(C)
|
:00450F0F C745EC01000000          mov [ebp-14], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00450F0D(U)
|
:00450F16 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00450F19 894DF4                  mov dword ptr [ebp-0C], ecx
:00450F1C E8BAD6FCFF              call 0041E5DB
:00450F21 8B55F4                  mov edx, dword ptr [ebp-0C]
:00450F24 F7DA                    neg edx
:00450F26 1BD2                    sbb edx, edx
:00450F28 81E200010000            and edx, 00000100
:00450F2E 8955FC                  mov dword ptr [ebp-04], edx
:00450F31 6A1F                    push 0000001F
:00450F33 6A00                    push 00000000
:00450F35 6A08                    push 00000008
:00450F37 6880000000              push 00000080
:00450F3C 8B45F8                  mov eax, dword ptr [ebp-08]
:00450F3F 50                      push eax
:00450F40 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00450F43 51                      push ecx
:00450F44 E85AD7FCFF              call 0041E6A3
:00450F49 83C418                  add esp, 00000018
:00450F4C 6A04                    push 00000004
:00450F4E 6A00                    push 00000000
:00450F50 8B55FC                  mov edx, dword ptr [ebp-04]
:00450F53 52                      push edx
:00450F54 B950EB4A00              mov ecx, 004AEB50
:00450F59 E8E2EA0200              call 0047FA40
:00450F5E 50                      push eax
:00450F5F 6A08                    push 00000008
:00450F61 6A08                    push 00000008
:00450F63 E825C40200              call 0047D38D
:00450F68 83C40C                  add esp, 0000000C
:00450F6B 837DF400                cmp dword ptr [ebp-0C], 00000000
:00450F6F 7408                    je 00450F79
:00450F71 8B451C                  mov eax, dword ptr [ebp+1C]
:00450F74 8945E8                  mov dword ptr [ebp-18], eax
:00450F77 EB06                    jmp 00450F7F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00450F6F(C)
|
:00450F79 8B4D18                  mov ecx, dword ptr [ebp+18]
:00450F7C 894DE8                  mov dword ptr [ebp-18], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00450F77(U)
|
:00450F7F 8B55E8                  mov edx, dword ptr [ebp-18]
:00450F82 52                      push edx
:00450F83 8B4508                  mov eax, dword ptr [ebp+08]
:00450F86 50                      push eax
:00450F87 8B4D14                  mov ecx, dword ptr [ebp+14]
:00450F8A 51                      push ecx
:00450F8B E88C010000              call 0045111C
:00450F90 83C40C                  add esp, 0000000C
:00450F93 8945F0                  mov dword ptr [ebp-10], eax
:00450F96 837DF000                cmp dword ptr [ebp-10], 00000000
:00450F9A 7424                    je 00450FC0
:00450F9C 6A02                    push 00000002
:00450F9E 8B55F8                  mov edx, dword ptr [ebp-08]
:00450FA1 83C207                  add edx, 00000007
:00450FA4 52                      push edx
:00450FA5 8B45F0                  mov eax, dword ptr [ebp-10]
:00450FA8 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00450FAB 8D5401FF                lea edx, dword ptr [ecx+eax-01]
:00450FAF 52                      push edx
:00450FB0 8B45F8                  mov eax, dword ptr [ebp-08]
:00450FB3 50                      push eax
:00450FB4 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00450FB7 51                      push ecx
:00450FB8 E806CC0200              call 0047DBC3
:00450FBD 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00450F9A(C)
|
:00450FC0 8B5508                  mov edx, dword ptr [ebp+08]
:00450FC3 F7DA                    neg edx
:00450FC5 1BD2                    sbb edx, edx
:00450FC7 83E2C0                  and edx, FFFFFFC0
:00450FCA 81C280000000            add edx, 00000080
:00450FD0 8955FC                  mov dword ptr [ebp-04], edx
:00450FD3 6A04                    push 00000004
:00450FD5 6A00                    push 00000000
:00450FD7 8B45FC                  mov eax, dword ptr [ebp-04]
:00450FDA 50                      push eax
:00450FDB B950EB4A00              mov ecx, 004AEB50
:00450FE0 E85BEA0200              call 0047FA40
:00450FE5 50                      push eax
:00450FE6 6A08                    push 00000008
:00450FE8 6A08                    push 00000008
:00450FEA E89EC30200              call 0047D38D
:00450FEF 83C40C                  add esp, 0000000C
:00450FF2 837DF400                cmp dword ptr [ebp-0C], 00000000
:00450FF6 7408                    je 00451000
:00450FF8 8B4D18                  mov ecx, dword ptr [ebp+18]
:00450FFB 894DE4                  mov dword ptr [ebp-1C], ecx
:00450FFE EB06                    jmp 00451006

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00450FF6(C)
|
:00451000 8B551C                  mov edx, dword ptr [ebp+1C]
:00451003 8955E4                  mov dword ptr [ebp-1C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00450FFE(U)
|
:00451006 8B45E4                  mov eax, dword ptr [ebp-1C]
:00451009 50                      push eax
:0045100A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045100D 51                      push ecx
:0045100E 8B5514                  mov edx, dword ptr [ebp+14]
:00451011 52                      push edx
:00451012 E805010000              call 0045111C
:00451017 83C40C                  add esp, 0000000C
:0045101A 8945F0                  mov dword ptr [ebp-10], eax
:0045101D 837DF000                cmp dword ptr [ebp-10], 00000000
:00451021 7424                    je 00451047
:00451023 6A02                    push 00000002
:00451025 8B45F8                  mov eax, dword ptr [ebp-08]
:00451028 83C007                  add eax, 00000007
:0045102B 50                      push eax
:0045102C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0045102F 8B550C                  mov edx, dword ptr [ebp+0C]
:00451032 8D440AFF                lea eax, dword ptr [edx+ecx-01]
:00451036 50                      push eax
:00451037 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045103A 51                      push ecx
:0045103B 8B550C                  mov edx, dword ptr [ebp+0C]
:0045103E 52                      push edx
:0045103F E87FCB0200              call 0047DBC3
:00451044 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451021(C)
|
:00451047 E8AAD5FCFF              call 0041E5F6
:0045104C 6A04                    push 00000004
:0045104E B9382F4900              mov ecx, 00492F38
:00451053 E8DEDCFBFF              call 0040ED36
:00451058 6A01                    push 00000001
:0045105A B9382F4900              mov ecx, 00492F38
:0045105F E8A6DCFBFF              call 0040ED0A
:00451064 6A00                    push 00000000
:00451066 B9382F4900              mov ecx, 00492F38
:0045106B E84CDCFBFF              call 0040ECBC
:00451070 6A1F                    push 0000001F
:00451072 B9382F4900              mov ecx, 00492F38
:00451077 E878DCFBFF              call 0040ECF4
:0045107C 6A12                    push 00000012
:0045107E B9382F4900              mov ecx, 00492F38
:00451083 E8FCDBFBFF              call 0040EC84
:00451088 8B4508                  mov eax, dword ptr [ebp+08]
:0045108B 8945E0                  mov dword ptr [ebp-20], eax
:0045108E 837DE000                cmp dword ptr [ebp-20], 00000000
:00451092 7408                    je 0045109C
:00451094 837DE001                cmp dword ptr [ebp-20], 00000001
:00451098 743B                    je 004510D5
:0045109A EB70                    jmp 0045110C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451092(C)
|
:0045109C 8B4D10                  mov ecx, dword ptr [ebp+10]
:0045109F 51                      push ecx
:004510A0 8B550C                  mov edx, dword ptr [ebp+0C]
:004510A3 C1EA03                  shr edx, 03
:004510A6 83C203                  add edx, 00000003
:004510A9 52                      push edx
:004510AA B9382F4900              mov ecx, 00492F38
:004510AF E823DBFBFF              call 0040EBD7
:004510B4 8B4D14                  mov ecx, dword ptr [ebp+14]
:004510B7 E85F61FBFF              call 0040721B
:004510BC 50                      push eax
:004510BD 8B4518                  mov eax, dword ptr [ebp+18]
:004510C0 50                      push eax

* Possible StringData Ref from Data Obj ->"%4u /%4u"
                                  |
:004510C1 68B4E24800              push 0048E2B4
:004510C6 68382F4900              push 00492F38
:004510CB E8D0E9FBFF              call 0040FAA0
:004510D0 83C410                  add esp, 00000010
:004510D3 EB37                    jmp 0045110C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451098(C)
|
:004510D5 8B4D10                  mov ecx, dword ptr [ebp+10]
:004510D8 51                      push ecx
:004510D9 8B550C                  mov edx, dword ptr [ebp+0C]
:004510DC C1EA03                  shr edx, 03
:004510DF 83C203                  add edx, 00000003
:004510E2 52                      push edx
:004510E3 B9382F4900              mov ecx, 00492F38
:004510E8 E8EADAFBFF              call 0040EBD7
:004510ED 8B4D14                  mov ecx, dword ptr [ebp+14]
:004510F0 E85561FBFF              call 0040724A
:004510F5 50                      push eax
:004510F6 8B4518                  mov eax, dword ptr [ebp+18]
:004510F9 50                      push eax

* Possible StringData Ref from Data Obj ->"%4u /%4u"
                                  |
:004510FA 68C0E24800              push 0048E2C0
:004510FF 68382F4900              push 00492F38
:00451104 E897E9FBFF              call 0040FAA0
:00451109 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045109A(U), :004510D3(U)
|
:0045110C 6A00                    push 00000000
:0045110E B9382F4900              mov ecx, 00492F38
:00451113 E8F2DBFBFF              call 0040ED0A
:00451118 8BE5                    mov esp, ebp
:0045111A 5D                      pop ebp
:0045111B C3                      ret



* Referenced by a CALL at Addresses:
|:00450F8B   , :00451012   , :0045120D   
|
:0045111C 55                      push ebp
:0045111D 8BEC                    mov ebp, esp
:0045111F 83EC0C                  sub esp, 0000000C
:00451122 8B450C                  mov eax, dword ptr [ebp+0C]
:00451125 8945F4                  mov dword ptr [ebp-0C], eax
:00451128 837DF400                cmp dword ptr [ebp-0C], 00000000
:0045112C 740E                    je 0045113C
:0045112E 837DF401                cmp dword ptr [ebp-0C], 00000001
:00451132 7415                    je 00451149
:00451134 837DF402                cmp dword ptr [ebp-0C], 00000002
:00451138 741C                    je 00451156
:0045113A EB3B                    jmp 00451177

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045112C(C)
|
:0045113C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045113F E8D760FBFF              call 0040721B
:00451144 8945F8                  mov dword ptr [ebp-08], eax
:00451147 EB35                    jmp 0045117E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451132(C)
|
:00451149 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045114C E8F960FBFF              call 0040724A
:00451151 8945F8                  mov dword ptr [ebp-08], eax
:00451154 EB28                    jmp 0045117E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451138(C)
|
:00451156 C745F87D000000          mov [ebp-08], 0000007D
:0045115D 8B4D10                  mov ecx, dword ptr [ebp+10]
:00451160 81E1FF000000            and ecx, 000000FF
:00451166 81F9FF000000            cmp ecx, 000000FF
:0045116C 7507                    jne 00451175
:0045116E C745107D000000          mov [ebp+10], 0000007D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045116C(C)
|
:00451175 EB07                    jmp 0045117E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045113A(U)
|
:00451177 C745F864000000          mov [ebp-08], 00000064

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00451147(U), :00451154(U), :00451175(U)
|
:0045117E 8B4510                  mov eax, dword ptr [ebp+10]
:00451181 6BC064                  imul eax, 00000064
:00451184 33D2                    xor edx, edx
:00451186 F775F8                  div [ebp-08]
:00451189 C1E007                  shl eax, 07
:0045118C 33D2                    xor edx, edx
:0045118E B964000000              mov ecx, 00000064
:00451193 F7F1                    div ecx
:00451195 8945FC                  mov dword ptr [ebp-04], eax
:00451198 8B45FC                  mov eax, dword ptr [ebp-04]
:0045119B 8BE5                    mov esp, ebp
:0045119D 5D                      pop ebp
:0045119E C3                      ret



* Referenced by a CALL at Addresses:
|:0044065C   , :004407BF   , :00440875   , :00440957   , :004409EE   
|:00440ACA   , :00440B5C   , :00440BFB   , :004504F4   , :0045052C   
|:0045055A   , :00450713   , :00450757   , :00450791   , :00450D21   
|:00450D59   , :00450E37   , :00450E7B   
|
:0045119F 55                      push ebp
:004511A0 8BEC                    mov ebp, esp
:004511A2 83EC10                  sub esp, 00000010
:004511A5 8B4510                  mov eax, dword ptr [ebp+10]
:004511A8 8D0CC540000000          lea ecx, dword ptr [8*eax+00000040]
:004511AF C1E903                  shr ecx, 03
:004511B2 894DF8                  mov dword ptr [ebp-08], ecx
:004511B5 8B5508                  mov edx, dword ptr [ebp+08]
:004511B8 8B049540E24800          mov eax, dword ptr [4*edx+0048E240]
:004511BF 8945FC                  mov dword ptr [ebp-04], eax
:004511C2 E814D4FCFF              call 0041E5DB
:004511C7 6A1F                    push 0000001F
:004511C9 6A00                    push 00000000
:004511CB 6A08                    push 00000008
:004511CD 6880000000              push 00000080
:004511D2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004511D5 51                      push ecx
:004511D6 8B550C                  mov edx, dword ptr [ebp+0C]
:004511D9 52                      push edx
:004511DA E8C4D4FCFF              call 0041E6A3
:004511DF 83C418                  add esp, 00000018
:004511E2 6A04                    push 00000004
:004511E4 6A00                    push 00000000
:004511E6 8B45FC                  mov eax, dword ptr [ebp-04]
:004511E9 50                      push eax
:004511EA B950EB4A00              mov ecx, 004AEB50
:004511EF E84CE80200              call 0047FA40
:004511F4 50                      push eax
:004511F5 6A08                    push 00000008
:004511F7 6A08                    push 00000008
:004511F9 E88FC10200              call 0047D38D
:004511FE 83C40C                  add esp, 0000000C
:00451201 8B4D18                  mov ecx, dword ptr [ebp+18]
:00451204 51                      push ecx
:00451205 8B5508                  mov edx, dword ptr [ebp+08]
:00451208 52                      push edx
:00451209 8B4514                  mov eax, dword ptr [ebp+14]
:0045120C 50                      push eax
:0045120D E80AFFFFFF              call 0045111C
:00451212 83C40C                  add esp, 0000000C
:00451215 8945F4                  mov dword ptr [ebp-0C], eax
:00451218 837DF400                cmp dword ptr [ebp-0C], 00000000
:0045121C 7424                    je 00451242
:0045121E 6A02                    push 00000002
:00451220 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00451223 83C107                  add ecx, 00000007
:00451226 51                      push ecx
:00451227 8B55F4                  mov edx, dword ptr [ebp-0C]
:0045122A 8B450C                  mov eax, dword ptr [ebp+0C]
:0045122D 8D4C10FF                lea ecx, dword ptr [eax+edx-01]
:00451231 51                      push ecx
:00451232 8B55F8                  mov edx, dword ptr [ebp-08]
:00451235 52                      push edx
:00451236 8B450C                  mov eax, dword ptr [ebp+0C]
:00451239 50                      push eax
:0045123A E884C90200              call 0047DBC3
:0045123F 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045121C(C)
|
:00451242 E8AFD3FCFF              call 0041E5F6
:00451247 6A04                    push 00000004
:00451249 B9382F4900              mov ecx, 00492F38
:0045124E E8E3DAFBFF              call 0040ED36
:00451253 6A01                    push 00000001
:00451255 B9382F4900              mov ecx, 00492F38
:0045125A E8ABDAFBFF              call 0040ED0A
:0045125F 6A00                    push 00000000
:00451261 B9382F4900              mov ecx, 00492F38
:00451266 E851DAFBFF              call 0040ECBC
:0045126B 6A12                    push 00000012
:0045126D B9382F4900              mov ecx, 00492F38
:00451272 E80DDAFBFF              call 0040EC84
:00451277 6A1F                    push 0000001F
:00451279 B9382F4900              mov ecx, 00492F38
:0045127E E871DAFBFF              call 0040ECF4
:00451283 8B4D08                  mov ecx, dword ptr [ebp+08]
:00451286 894DF0                  mov dword ptr [ebp-10], ecx
:00451289 837DF000                cmp dword ptr [ebp-10], 00000000
:0045128D 7411                    je 004512A0
:0045128F 837DF001                cmp dword ptr [ebp-10], 00000001
:00451293 7447                    je 004512DC
:00451295 837DF002                cmp dword ptr [ebp-10], 00000002
:00451299 747A                    je 00451315
:0045129B E9CC000000              jmp 0045136C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045128D(C)
|
:004512A0 8B5510                  mov edx, dword ptr [ebp+10]
:004512A3 52                      push edx
:004512A4 8B450C                  mov eax, dword ptr [ebp+0C]
:004512A7 C1E803                  shr eax, 03
:004512AA 83C003                  add eax, 00000003
:004512AD 50                      push eax
:004512AE B9382F4900              mov ecx, 00492F38
:004512B3 E81FD9FBFF              call 0040EBD7
:004512B8 8B4D14                  mov ecx, dword ptr [ebp+14]
:004512BB E85B5FFBFF              call 0040721B
:004512C0 50                      push eax
:004512C1 8B4D18                  mov ecx, dword ptr [ebp+18]
:004512C4 51                      push ecx

* Possible StringData Ref from Data Obj ->"%4u /%4u"
                                  |
:004512C5 68CCE24800              push 0048E2CC
:004512CA 68382F4900              push 00492F38
:004512CF E8CCE7FBFF              call 0040FAA0
:004512D4 83C410                  add esp, 00000010
:004512D7 E990000000              jmp 0045136C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451293(C)
|
:004512DC 8B5510                  mov edx, dword ptr [ebp+10]
:004512DF 52                      push edx
:004512E0 8B450C                  mov eax, dword ptr [ebp+0C]
:004512E3 C1E803                  shr eax, 03
:004512E6 83C003                  add eax, 00000003
:004512E9 50                      push eax
:004512EA B9382F4900              mov ecx, 00492F38
:004512EF E8E3D8FBFF              call 0040EBD7
:004512F4 8B4D14                  mov ecx, dword ptr [ebp+14]
:004512F7 E84E5FFBFF              call 0040724A
:004512FC 50                      push eax
:004512FD 8B4D18                  mov ecx, dword ptr [ebp+18]
:00451300 51                      push ecx

* Possible StringData Ref from Data Obj ->"%4u /%4u"
                                  |
:00451301 68D8E24800              push 0048E2D8
:00451306 68382F4900              push 00492F38
:0045130B E890E7FBFF              call 0040FAA0
:00451310 83C410                  add esp, 00000010
:00451313 EB57                    jmp 0045136C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451299(C)
|
:00451315 8B5510                  mov edx, dword ptr [ebp+10]
:00451318 52                      push edx
:00451319 8B450C                  mov eax, dword ptr [ebp+0C]
:0045131C C1E803                  shr eax, 03
:0045131F 83C003                  add eax, 00000003
:00451322 50                      push eax
:00451323 B9382F4900              mov ecx, 00492F38
:00451328 E8AAD8FBFF              call 0040EBD7
:0045132D 8B4D18                  mov ecx, dword ptr [ebp+18]
:00451330 81E1FF000000            and ecx, 000000FF
:00451336 81F9FF000000            cmp ecx, 000000FF
:0045133C 7516                    jne 00451354
:0045133E 6A7D                    push 0000007D

* Possible StringData Ref from Data Obj ->"    MAX   "
                                  |
:00451340 68E4E24800              push 0048E2E4
:00451345 68382F4900              push 00492F38
:0045134A E851E7FBFF              call 0040FAA0
:0045134F 83C40C                  add esp, 0000000C
:00451352 EB18                    jmp 0045136C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045133C(C)
|
:00451354 6A7D                    push 0000007D
:00451356 8B5518                  mov edx, dword ptr [ebp+18]
:00451359 52                      push edx

* Possible StringData Ref from Data Obj ->"%4u /%4u"
                                  |
:0045135A 68F0E24800              push 0048E2F0
:0045135F 68382F4900              push 00492F38
:00451364 E837E7FBFF              call 0040FAA0
:00451369 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045129B(U), :004512D7(U), :00451313(U), :00451352(U)
|
:0045136C 6A00                    push 00000000
:0045136E B9382F4900              mov ecx, 00492F38
:00451373 E892D9FBFF              call 0040ED0A
:00451378 8BE5                    mov esp, ebp
:0045137A 5D                      pop ebp
:0045137B C3                      ret



* Referenced by a CALL at Addresses:
|:00404301   , :004047F6   , :004048CD   , :00404A47   , :00404AF0   
|:00404B39   , :00404BBC   , :00404C64   , :00404CAA   , :00404D84   
|:00404EC7   , :00404F89   , :00404FE8   , :00405115   , :004051DD   
|:0040521A   , :00405310   , :0040534D   , :00405446   , :00405483   
|:004054C0   , :0041C965   , :0041CA1B   , :0041CABF   , :0041D919   
|:0041DA22   , :00421C11   , :004222DB   , :0043D4D3   , :0043EC11   
|:00441BC1   , :00441C83   , :00441EB4   , :00441FD6   , :00442560   
|:004572ED   , :00457AB0   , :00457C6C   , :00457D57   , :00457E42   
|:00458000   , :00458278   , :00458542   , :00458732   , :00458879   
|:004589C9   , :00458B22   , :00458E35   , :00458EA0   , :004590B6   
|:004593CC   
|
:0045137C 55                      push ebp
:0045137D 8BEC                    mov ebp, esp
:0045137F B80C200000              mov eax, 0000200C
:00451384 E8D7FD0200              call 00481160
:00451389 56                      push esi
:0045138A 8B4510                  mov eax, dword ptr [ebp+10]
:0045138D 0FAF4514                imul eax, dword ptr [ebp+14]
:00451391 50                      push eax
:00451392 8D8DFCEFFFFF            lea ecx, dword ptr [ebp+FFFFEFFC]
:00451398 51                      push ecx
:00451399 8B551C                  mov edx, dword ptr [ebp+1C]
:0045139C 52                      push edx
:0045139D E85BE90200              call 0047FCFD
:004513A2 83C40C                  add esp, 0000000C
:004513A5 8B4D18                  mov ecx, dword ptr [ebp+18]
:004513A8 81E1FF000000            and ecx, 000000FF
:004513AE 6BC924                  imul ecx, 00000024
:004513B1 81C1502C4B00            add ecx, 004B2C50
:004513B7 E8A41FFBFF              call 00403360
:004513BC 50                      push eax
:004513BD E8CF45FEFF              call 00435991
:004513C2 83C404                  add esp, 00000004
:004513C5 8845FC                  mov byte ptr [ebp-04], al
:004513C8 8B45FC                  mov eax, dword ptr [ebp-04]
:004513CB 25FF000000              and eax, 000000FF
:004513D0 83F80A                  cmp eax, 0000000A
:004513D3 740E                    je 004513E3
:004513D5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004513D8 81E1FF000000            and ecx, 000000FF
:004513DE 83F909                  cmp ecx, 00000009
:004513E1 7544                    jne 00451427

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004513D3(C)
|
:004513E3 6A00                    push 00000000
:004513E5 8B5514                  mov edx, dword ptr [ebp+14]
:004513E8 52                      push edx
:004513E9 8B4510                  mov eax, dword ptr [ebp+10]
:004513EC 50                      push eax
:004513ED 6A04                    push 00000004
:004513EF 6A00                    push 00000000
:004513F1 8B4D10                  mov ecx, dword ptr [ebp+10]
:004513F4 83E940                  sub ecx, 00000040
:004513F7 F7D9                    neg ecx
:004513F9 1BC9                    sbb ecx, ecx
:004513FB 81E100DCFFFF            and ecx, FFFFDC00
:00451401 81C1C04B0000            add ecx, 00004BC0
:00451407 51                      push ecx
:00451408 B950EB4A00              mov ecx, 004AEB50
:0045140D E82EE60200              call 0047FA40
:00451412 50                      push eax
:00451413 8D95FCEFFFFF            lea edx, dword ptr [ebp+FFFFEFFC]
:00451419 52                      push edx
:0045141A E8E8F5FDFF              call 00430A07
:0045141F 83C414                  add esp, 00000014
:00451422 E9EB000000              jmp 00451512

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004513E1(C)
|
:00451427 8B45FC                  mov eax, dword ptr [ebp-04]
:0045142A 25FF000000              and eax, 000000FF
:0045142F 83F802                  cmp eax, 00000002
:00451432 7542                    jne 00451476
:00451434 6A00                    push 00000000
:00451436 8B4D14                  mov ecx, dword ptr [ebp+14]
:00451439 51                      push ecx
:0045143A 8B5510                  mov edx, dword ptr [ebp+10]
:0045143D 52                      push edx
:0045143E 6A04                    push 00000004
:00451440 6A00                    push 00000000
:00451442 8B4510                  mov eax, dword ptr [ebp+10]
:00451445 83E840                  sub eax, 00000040
:00451448 F7D8                    neg eax
:0045144A 1BC0                    sbb eax, eax
:0045144C 2500D5FFFF              and eax, FFFFD500
:00451451 05C05B0000              add eax, 00005BC0
:00451456 50                      push eax
:00451457 B950EB4A00              mov ecx, 004AEB50
:0045145C E8DFE50200              call 0047FA40
:00451461 50                      push eax
:00451462 8D8DFCEFFFFF            lea ecx, dword ptr [ebp+FFFFEFFC]
:00451468 51                      push ecx
:00451469 E899F5FDFF              call 00430A07
:0045146E 83C414                  add esp, 00000014
:00451471 E99C000000              jmp 00451512

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451432(C)
|
:00451476 8B55FC                  mov edx, dword ptr [ebp-04]
:00451479 81E2FF000000            and edx, 000000FF
:0045147F 83FA01                  cmp edx, 00000001
:00451482 7541                    jne 004514C5
:00451484 6A00                    push 00000000
:00451486 8B4514                  mov eax, dword ptr [ebp+14]
:00451489 50                      push eax
:0045148A 8B4D10                  mov ecx, dword ptr [ebp+10]
:0045148D 51                      push ecx
:0045148E 6A04                    push 00000004
:00451490 6A00                    push 00000000
:00451492 8B5510                  mov edx, dword ptr [ebp+10]
:00451495 83EA40                  sub edx, 00000040
:00451498 F7DA                    neg edx
:0045149A 1BD2                    sbb edx, edx
:0045149C 81E200CEFFFF            and edx, FFFFCE00
:004514A2 81C2C06B0000            add edx, 00006BC0
:004514A8 52                      push edx
:004514A9 B950EB4A00              mov ecx, 004AEB50
:004514AE E88DE50200              call 0047FA40
:004514B3 50                      push eax
:004514B4 8D85FCEFFFFF            lea eax, dword ptr [ebp+FFFFEFFC]
:004514BA 50                      push eax
:004514BB E847F5FDFF              call 00430A07
:004514C0 83C414                  add esp, 00000014
:004514C3 EB4D                    jmp 00451512

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451482(C)
|
:004514C5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004514C8 81E1FF000000            and ecx, 000000FF
:004514CE 83F907                  cmp ecx, 00000007
:004514D1 753F                    jne 00451512
:004514D3 6A00                    push 00000000
:004514D5 8B5514                  mov edx, dword ptr [ebp+14]
:004514D8 52                      push edx
:004514D9 8B4510                  mov eax, dword ptr [ebp+10]
:004514DC 50                      push eax
:004514DD 6A04                    push 00000004
:004514DF 6A00                    push 00000000
:004514E1 8B4D10                  mov ecx, dword ptr [ebp+10]
:004514E4 83E940                  sub ecx, 00000040
:004514E7 F7D9                    neg ecx
:004514E9 1BC9                    sbb ecx, ecx
:004514EB 81E100C7FFFF            and ecx, FFFFC700
:004514F1 81C1C07B0000            add ecx, 00007BC0
:004514F7 51                      push ecx
:004514F8 B950EB4A00              mov ecx, 004AEB50
:004514FD E83EE50200              call 0047FA40
:00451502 50                      push eax
:00451503 8D95FCEFFFFF            lea edx, dword ptr [ebp+FFFFEFFC]
:00451509 52                      push edx
:0045150A E8F8F4FDFF              call 00430A07
:0045150F 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00451422(U), :00451471(U), :004514C3(U), :004514D1(C)
|
:00451512 8B45FC                  mov eax, dword ptr [ebp-04]
:00451515 25FF000000              and eax, 000000FF
:0045151A 83F80D                  cmp eax, 0000000D
:0045151D 0F85F8010000            jne 0045171B
:00451523 8B4D18                  mov ecx, dword ptr [ebp+18]
:00451526 81E1FF000000            and ecx, 000000FF
:0045152C 6BC924                  imul ecx, 00000024
:0045152F 81C1502C4B00            add ecx, 004B2C50
:00451535 E8E6CDFEFF              call 0043E320
:0045153A 25FF000000              and eax, 000000FF
:0045153F 8985F8DFFFFF            mov dword ptr [ebp+FFFFDFF8], eax
:00451545 83BDF8DFFFFF03          cmp dword ptr [ebp+FFFFDFF8], 00000003
:0045154C 0F87A9010000            ja 004516FB
:00451552 8B8DF8DFFFFF            mov ecx, dword ptr [ebp+FFFFDFF8]
:00451558 FF248DF3184500          jmp dword ptr [4*ecx+004518F3]
:0045155F 8B5510                  mov edx, dword ptr [ebp+10]
:00451562 0FAF5514                imul edx, dword ptr [ebp+14]
:00451566 52                      push edx
:00451567 8D85FCDFFFFF            lea eax, dword ptr [ebp+FFFFDFFC]
:0045156D 50                      push eax
:0045156E 6A04                    push 00000004
:00451570 6A00                    push 00000000
:00451572 8B7510                  mov esi, dword ptr [ebp+10]
:00451575 83EE40                  sub esi, 00000040
:00451578 F7DE                    neg esi
:0045157A 1BF6                    sbb esi, esi
:0045157C 81E600CAFFFF            and esi, FFFFCA00
:00451582 81C6C02D0100            add esi, 00012DC0
:00451588 B9083D4B00              mov ecx, 004B3D08
:0045158D E83EADFCFF              call 0041C2D0
:00451592 25FF000000              and eax, 000000FF
:00451597 99                      cdq
:00451598 33C2                    xor eax, edx
:0045159A 2BC2                    sub eax, edx
:0045159C 83E001                  and eax, 00000001
:0045159F 33C2                    xor eax, edx
:004515A1 2BC2                    sub eax, edx
:004515A3 8B4D10                  mov ecx, dword ptr [ebp+10]
:004515A6 0FAF4D14                imul ecx, dword ptr [ebp+14]
:004515AA 0FAFC1                  imul eax, ecx
:004515AD 03F0                    add esi, eax
:004515AF 56                      push esi
:004515B0 B950EB4A00              mov ecx, 004AEB50
:004515B5 E886E40200              call 0047FA40
:004515BA 50                      push eax
:004515BB E83DE70200              call 0047FCFD
:004515C0 83C40C                  add esp, 0000000C
:004515C3 E933010000              jmp 004516FB
:004515C8 8B5510                  mov edx, dword ptr [ebp+10]
:004515CB 0FAF5514                imul edx, dword ptr [ebp+14]
:004515CF 52                      push edx
:004515D0 8D85FCDFFFFF            lea eax, dword ptr [ebp+FFFFDFFC]
:004515D6 50                      push eax
:004515D7 6A04                    push 00000004
:004515D9 6A00                    push 00000000
:004515DB 8B7510                  mov esi, dword ptr [ebp+10]
:004515DE 83EE40                  sub esi, 00000040
:004515E1 F7DE                    neg esi
:004515E3 1BF6                    sbb esi, esi
:004515E5 81E600BCFFFF            and esi, FFFFBC00
:004515EB 81C6C04D0100            add esi, 00014DC0
:004515F1 B9083D4B00              mov ecx, 004B3D08
:004515F6 E8D5ACFCFF              call 0041C2D0
:004515FB 25FF000000              and eax, 000000FF
:00451600 99                      cdq
:00451601 33C2                    xor eax, edx
:00451603 2BC2                    sub eax, edx
:00451605 83E001                  and eax, 00000001
:00451608 33C2                    xor eax, edx
:0045160A 2BC2                    sub eax, edx
:0045160C 8B4D10                  mov ecx, dword ptr [ebp+10]
:0045160F 0FAF4D14                imul ecx, dword ptr [ebp+14]
:00451613 0FAFC1                  imul eax, ecx
:00451616 03F0                    add esi, eax
:00451618 56                      push esi
:00451619 B950EB4A00              mov ecx, 004AEB50
:0045161E E81DE40200              call 0047FA40
:00451623 50                      push eax
:00451624 E8D4E60200              call 0047FCFD
:00451629 83C40C                  add esp, 0000000C
:0045162C E9CA000000              jmp 004516FB
:00451631 8B5510                  mov edx, dword ptr [ebp+10]
:00451634 0FAF5514                imul edx, dword ptr [ebp+14]
:00451638 52                      push edx
:00451639 8D85FCDFFFFF            lea eax, dword ptr [ebp+FFFFDFFC]
:0045163F 50                      push eax
:00451640 6A04                    push 00000004
:00451642 6A00                    push 00000000
:00451644 8B7510                  mov esi, dword ptr [ebp+10]
:00451647 83EE40                  sub esi, 00000040
:0045164A F7DE                    neg esi
:0045164C 1BF6                    sbb esi, esi
:0045164E 81E600AEFFFF            and esi, FFFFAE00
:00451654 81C6C06D0100            add esi, 00016DC0
:0045165A B9083D4B00              mov ecx, 004B3D08
:0045165F E86CACFCFF              call 0041C2D0
:00451664 25FF000000              and eax, 000000FF
:00451669 99                      cdq
:0045166A 33C2                    xor eax, edx
:0045166C 2BC2                    sub eax, edx
:0045166E 83E001                  and eax, 00000001
:00451671 33C2                    xor eax, edx
:00451673 2BC2                    sub eax, edx
:00451675 8B4D10                  mov ecx, dword ptr [ebp+10]
:00451678 0FAF4D14                imul ecx, dword ptr [ebp+14]
:0045167C 0FAFC1                  imul eax, ecx
:0045167F 03F0                    add esi, eax
:00451681 56                      push esi
:00451682 B950EB4A00              mov ecx, 004AEB50
:00451687 E8B4E30200              call 0047FA40
:0045168C 50                      push eax
:0045168D E86BE60200              call 0047FCFD
:00451692 83C40C                  add esp, 0000000C
:00451695 EB64                    jmp 004516FB
:00451697 8D95FCDFFFFF            lea edx, dword ptr [ebp+FFFFDFFC]
:0045169D 52                      push edx
:0045169E 6A04                    push 00000004
:004516A0 6A00                    push 00000000
:004516A2 8B7510                  mov esi, dword ptr [ebp+10]
:004516A5 83EE40                  sub esi, 00000040
:004516A8 F7DE                    neg esi
:004516AA 1BF6                    sbb esi, esi
:004516AC 81E600AEFFFF            and esi, FFFFAE00
:004516B2 81C6C06D0100            add esi, 00016DC0
:004516B8 B9083D4B00              mov ecx, 004B3D08
:004516BD E80EACFCFF              call 0041C2D0
:004516C2 25FF000000              and eax, 000000FF
:004516C7 99                      cdq
:004516C8 33C2                    xor eax, edx
:004516CA 2BC2                    sub eax, edx
:004516CC 83E001                  and eax, 00000001
:004516CF 33C2                    xor eax, edx
:004516D1 2BC2                    sub eax, edx
:004516D3 8B4D10                  mov ecx, dword ptr [ebp+10]
:004516D6 0FAF4D14                imul ecx, dword ptr [ebp+14]
:004516DA 0FAFC1                  imul eax, ecx
:004516DD 03F0                    add esi, eax
:004516DF 56                      push esi
:004516E0 B950EB4A00              mov ecx, 004AEB50
:004516E5 E856E30200              call 0047FA40
:004516EA 50                      push eax
:004516EB 8B5514                  mov edx, dword ptr [ebp+14]
:004516EE 52                      push edx
:004516EF 8B4510                  mov eax, dword ptr [ebp+10]
:004516F2 50                      push eax
:004516F3 E85BD7FCFF              call 0041EE53
:004516F8 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045154C(C), :004515C3(U), :0045162C(U), :00451695(U)
|
:004516FB 6A00                    push 00000000
:004516FD 8B4D14                  mov ecx, dword ptr [ebp+14]
:00451700 51                      push ecx
:00451701 8B5510                  mov edx, dword ptr [ebp+10]
:00451704 52                      push edx
:00451705 8D85FCDFFFFF            lea eax, dword ptr [ebp+FFFFDFFC]
:0045170B 50                      push eax
:0045170C 8D8DFCEFFFFF            lea ecx, dword ptr [ebp+FFFFEFFC]
:00451712 51                      push ecx
:00451713 E8EFF2FDFF              call 00430A07
:00451718 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045151D(C)
|
:0045171B 6A04                    push 00000004
:0045171D 8D95FCEFFFFF            lea edx, dword ptr [ebp+FFFFEFFC]
:00451723 52                      push edx
:00451724 8B4514                  mov eax, dword ptr [ebp+14]
:00451727 50                      push eax
:00451728 8B4D10                  mov ecx, dword ptr [ebp+10]
:0045172B 51                      push ecx
:0045172C 8B550C                  mov edx, dword ptr [ebp+0C]
:0045172F 52                      push edx
:00451730 8B4508                  mov eax, dword ptr [ebp+08]
:00451733 50                      push eax
:00451734 E8DA010000              call 00451913
:00451739 83C418                  add esp, 00000018
:0045173C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045173F 81E1FF000000            and ecx, 000000FF
:00451745 83F90D                  cmp ecx, 0000000D
:00451748 0F85A0010000            jne 004518EE
:0045174E 8B4D18                  mov ecx, dword ptr [ebp+18]
:00451751 81E1FF000000            and ecx, 000000FF
:00451757 6BC924                  imul ecx, 00000024
:0045175A 81C1502C4B00            add ecx, 004B2C50
:00451760 E8BBCBFEFF              call 0043E320
:00451765 25FF000000              and eax, 000000FF
:0045176A 8985F4DFFFFF            mov dword ptr [ebp+FFFFDFF4], eax
:00451770 83BDF4DFFFFF03          cmp dword ptr [ebp+FFFFDFF4], 00000003
:00451777 0F8740010000            ja 004518BD
:0045177D 8B95F4DFFFFF            mov edx, dword ptr [ebp+FFFFDFF4]
:00451783 FF249503194500          jmp dword ptr [4*edx+00451903]
:0045178A 6800090000              push 00000900
:0045178F 8D85FCEFFFFF            lea eax, dword ptr [ebp+FFFFEFFC]
:00451795 50                      push eax
:00451796 6A04                    push 00000004
:00451798 6A00                    push 00000000
:0045179A B9083D4B00              mov ecx, 004B3D08
:0045179F E82CABFCFF              call 0041C2D0
:004517A4 25FF000000              and eax, 000000FF
:004517A9 99                      cdq
:004517AA 33C2                    xor eax, edx
:004517AC 2BC2                    sub eax, edx
:004517AE 83E001                  and eax, 00000001
:004517B1 33C2                    xor eax, edx
:004517B3 2BC2                    sub eax, edx
:004517B5 69C000090000            imul eax, 00000900
:004517BB 05C0C10000              add eax, 0000C1C0
:004517C0 50                      push eax
:004517C1 B950EB4A00              mov ecx, 004AEB50
:004517C6 E875E20200              call 0047FA40
:004517CB 50                      push eax
:004517CC E82CE50200              call 0047FCFD
:004517D1 83C40C                  add esp, 0000000C
:004517D4 E9E4000000              jmp 004518BD
:004517D9 6800090000              push 00000900
:004517DE 8D8DFCEFFFFF            lea ecx, dword ptr [ebp+FFFFEFFC]
:004517E4 51                      push ecx
:004517E5 6A04                    push 00000004
:004517E7 6A00                    push 00000000
:004517E9 B9083D4B00              mov ecx, 004B3D08
:004517EE E8DDAAFCFF              call 0041C2D0
:004517F3 25FF000000              and eax, 000000FF
:004517F8 99                      cdq
:004517F9 33C2                    xor eax, edx
:004517FB 2BC2                    sub eax, edx
:004517FD 83E001                  and eax, 00000001
:00451800 33C2                    xor eax, edx
:00451802 2BC2                    sub eax, edx
:00451804 69C000090000            imul eax, 00000900
:0045180A 05C0D30000              add eax, 0000D3C0
:0045180F 50                      push eax
:00451810 B950EB4A00              mov ecx, 004AEB50
:00451815 E826E20200              call 0047FA40
:0045181A 50                      push eax
:0045181B E8DDE40200              call 0047FCFD
:00451820 83C40C                  add esp, 0000000C
:00451823 E995000000              jmp 004518BD
:00451828 6800090000              push 00000900
:0045182D 8D95FCEFFFFF            lea edx, dword ptr [ebp+FFFFEFFC]
:00451833 52                      push edx
:00451834 6A04                    push 00000004
:00451836 6A00                    push 00000000
:00451838 B9083D4B00              mov ecx, 004B3D08
:0045183D E88EAAFCFF              call 0041C2D0
:00451842 25FF000000              and eax, 000000FF
:00451847 99                      cdq
:00451848 33C2                    xor eax, edx
:0045184A 2BC2                    sub eax, edx
:0045184C 83E001                  and eax, 00000001
:0045184F 33C2                    xor eax, edx
:00451851 2BC2                    sub eax, edx
:00451853 69C000090000            imul eax, 00000900
:00451859 05C0E50000              add eax, 0000E5C0
:0045185E 50                      push eax
:0045185F B950EB4A00              mov ecx, 004AEB50
:00451864 E8D7E10200              call 0047FA40
:00451869 50                      push eax
:0045186A E88EE40200              call 0047FCFD
:0045186F 83C40C                  add esp, 0000000C
:00451872 EB49                    jmp 004518BD
:00451874 8D85FCEFFFFF            lea eax, dword ptr [ebp+FFFFEFFC]
:0045187A 50                      push eax
:0045187B 6A04                    push 00000004
:0045187D 6A00                    push 00000000
:0045187F B9083D4B00              mov ecx, 004B3D08
:00451884 E847AAFCFF              call 0041C2D0
:00451889 25FF000000              and eax, 000000FF
:0045188E 99                      cdq
:0045188F 33C2                    xor eax, edx
:00451891 2BC2                    sub eax, edx
:00451893 83E001                  and eax, 00000001
:00451896 33C2                    xor eax, edx
:00451898 2BC2                    sub eax, edx
:0045189A 69C000090000            imul eax, 00000900
:004518A0 05C0E50000              add eax, 0000E5C0
:004518A5 50                      push eax
:004518A6 B950EB4A00              mov ecx, 004AEB50
:004518AB E890E10200              call 0047FA40
:004518B0 50                      push eax
:004518B1 6A30                    push 00000030
:004518B3 6A30                    push 00000030
:004518B5 E899D5FCFF              call 0041EE53
:004518BA 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00451777(C), :004517D4(U), :00451823(U), :00451872(U)
|
:004518BD 6A04                    push 00000004
:004518BF 8D8DFCEFFFFF            lea ecx, dword ptr [ebp+FFFFEFFC]
:004518C5 51                      push ecx
:004518C6 6A30                    push 00000030
:004518C8 6A30                    push 00000030
:004518CA 8B5514                  mov edx, dword ptr [ebp+14]
:004518CD 83EA30                  sub edx, 00000030
:004518D0 D1EA                    shr edx, 1
:004518D2 8B450C                  mov eax, dword ptr [ebp+0C]
:004518D5 03C2                    add eax, edx
:004518D7 50                      push eax
:004518D8 8B4D10                  mov ecx, dword ptr [ebp+10]
:004518DB 83E930                  sub ecx, 00000030
:004518DE D1E9                    shr ecx, 1
:004518E0 8B5508                  mov edx, dword ptr [ebp+08]
:004518E3 03D1                    add edx, ecx
:004518E5 52                      push edx
:004518E6 E828000000              call 00451913
:004518EB 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451748(C)
|
:004518EE 5E                      pop esi
:004518EF 8BE5                    mov esp, ebp
:004518F1 5D                      pop ebp
:004518F2 C3                      ret



:004518F3 C8154500                DWORD 004515C8
:004518F7 97164500                DWORD 00451697
:004518FB 5F154500                DWORD 0045155F
:004518FF 31164500                DWORD 00451631
:00451903 D9174500                DWORD 004517D9
:00451907 74184500                DWORD 00451874
:0045190B 8A174500                DWORD 0045178A
:0045190F 28184500                DWORD 00451828



* Referenced by a CALL at Addresses:
|:0040378A   , :0040473B   , :00404771   , :0040483B   , :00404871   
|:0040496E   , :004049A4   , :00404CEF   , :00404D25   , :00404DC9   
|:00404DFF   , :0040502D   , :00405063   , :0040525F   , :00405295   
|:00405392   , :004053C8   , :0040564F   , :00405685   , :0041C99B   
|:0041CA4E   , :0041CC23   , :00421CAD   , :0043ECAE   , :0043ECDD   
|:0043ED64   , :0043ED93   , :0043EE1A   , :0043EE49   , :0043EED0   
|:0043EEFF   , :0043EF67   , :0043EFCF   , :0043F034   , :004409A7   
|:00440C2C   , :004424D8   , :0044B4C5   , :004503AB   , :004503DF   
|:00450413   , :0045044D   , :00450487   , :00450C80   , :00450CB4   
|:00451734   , :004518E6   , :004523CF   , :0045245D   , :00452485   
|:0045252A   , :004525AA   , :004525E2   , :00452668   , :004527AB   
|:004527FF   , :00452850   , :0045287C   , :00455962   , :00455AE2   
|:00455B2A   , :00455B6D   , :00455BB0   , :00455BF3   , :00458239   
|:00458503   , :0045859D   , :00459BA4   , :00459BE0   
|
:00451913 55                      push ebp
:00451914 8BEC                    mov ebp, esp
:00451916 B950424B00              mov ecx, 004B4250
:0045191B E863440000              call 00455D83
:00451920 85C0                    test eax, eax
:00451922 7461                    je 00451985
:00451924 B950424B00              mov ecx, 004B4250
:00451929 E83D450000              call 00455E6B
:0045192E 83C038                  add eax, 00000038
:00451931 50                      push eax
:00451932 B950424B00              mov ecx, 004B4250
:00451937 E808450000              call 00455E44
:0045193C 50                      push eax
:0045193D 6A38                    push 00000038
:0045193F 6A00                    push 00000000
:00451941 E83BB90200              call 0047D281
:00451946 83C410                  add esp, 00000010
:00451949 6A00                    push 00000000
:0045194B 6A00                    push 00000000
:0045194D 8B451C                  mov eax, dword ptr [ebp+1C]
:00451950 50                      push eax
:00451951 E89BB80200              call 0047D1F1
:00451956 83C40C                  add esp, 0000000C
:00451959 8B4D18                  mov ecx, dword ptr [ebp+18]
:0045195C 51                      push ecx
:0045195D 8B5514                  mov edx, dword ptr [ebp+14]
:00451960 52                      push edx
:00451961 8B4510                  mov eax, dword ptr [ebp+10]
:00451964 50                      push eax
:00451965 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00451968 51                      push ecx
:00451969 8B5508                  mov edx, dword ptr [ebp+08]
:0045196C 52                      push edx
:0045196D E829C70200              call 0047E09B
:00451972 83C414                  add esp, 00000014
:00451975 6A00                    push 00000000
:00451977 6A00                    push 00000000
:00451979 6A00                    push 00000000
:0045197B E871B80200              call 0047D1F1
:00451980 83C40C                  add esp, 0000000C
:00451983 EB5F                    jmp 004519E4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451922(C)
|
:00451985 B950424B00              mov ecx, 004B4250
:0045198A E8DC440000              call 00455E6B
:0045198F 83C028                  add eax, 00000028
:00451992 50                      push eax
:00451993 B950424B00              mov ecx, 004B4250
:00451998 E8A7440000              call 00455E44
:0045199D 50                      push eax
:0045199E 6A28                    push 00000028
:004519A0 6A00                    push 00000000
:004519A2 E8DAB80200              call 0047D281
:004519A7 83C410                  add esp, 00000010
:004519AA 6A00                    push 00000000
:004519AC 6A00                    push 00000000
:004519AE 8B451C                  mov eax, dword ptr [ebp+1C]
:004519B1 50                      push eax
:004519B2 E83AB80200              call 0047D1F1
:004519B7 83C40C                  add esp, 0000000C
:004519BA 8B4D18                  mov ecx, dword ptr [ebp+18]
:004519BD 51                      push ecx
:004519BE 8B5514                  mov edx, dword ptr [ebp+14]
:004519C1 52                      push edx
:004519C2 8B4510                  mov eax, dword ptr [ebp+10]
:004519C5 50                      push eax
:004519C6 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004519C9 51                      push ecx
:004519CA 8B5508                  mov edx, dword ptr [ebp+08]
:004519CD 52                      push edx
:004519CE E8C8C60200              call 0047E09B
:004519D3 83C414                  add esp, 00000014
:004519D6 6A00                    push 00000000
:004519D8 6A00                    push 00000000
:004519DA 6A00                    push 00000000
:004519DC E810B80200              call 0047D1F1
:004519E1 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451983(U)
|
:004519E4 5D                      pop ebp
:004519E5 C3                      ret



* Referenced by a CALL at Addresses:
|:004046C7   , :004046FB   , :00405619   , :00421BC5   , :00458203   
|:004584CD   
|
:004519E6 55                      push ebp
:004519E7 8BEC                    mov ebp, esp
:004519E9 8B4518                  mov eax, dword ptr [ebp+18]
:004519EC 50                      push eax
:004519ED 8B4D14                  mov ecx, dword ptr [ebp+14]
:004519F0 51                      push ecx
:004519F1 8B5510                  mov edx, dword ptr [ebp+10]
:004519F4 52                      push edx
:004519F5 8B450C                  mov eax, dword ptr [ebp+0C]
:004519F8 50                      push eax
:004519F9 8B4D08                  mov ecx, dword ptr [ebp+08]
:004519FC 51                      push ecx
:004519FD E84FC80200              call 0047E251
:00451A02 83C414                  add esp, 00000014
:00451A05 5D                      pop ebp
:00451A06 C3                      ret



* Referenced by a CALL at Address:
|:0044F9F7   
|
:00451A07 55                      push ebp
:00451A08 8BEC                    mov ebp, esp
:00451A0A 51                      push ecx
:00451A0B 894DFC                  mov dword ptr [ebp-04], ecx
:00451A0E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00451A11 83C144                  add ecx, 00000044
:00451A14 E8F7DC0000              call 0045F710
:00451A19 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00451A1C 83C146                  add ecx, 00000046
:00451A1F E8ECDC0000              call 0045F710
:00451A24 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00451A27 83C154                  add ecx, 00000054
:00451A2A E8E1DC0000              call 0045F710
:00451A2F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00451A32 81C1861B0000            add ecx, 00001B86
:00451A38 E8D3DC0000              call 0045F710
:00451A3D 8B45FC                  mov eax, dword ptr [ebp-04]
:00451A40 8BE5                    mov esp, ebp
:00451A42 5D                      pop ebp
:00451A43 C3                      ret



* Referenced by a CALL at Address:
|:0044FA18   
|
:00451A44 55                      push ebp
:00451A45 8BEC                    mov ebp, esp
:00451A47 51                      push ecx
:00451A48 894DFC                  mov dword ptr [ebp-04], ecx
:00451A4B 8BE5                    mov esp, ebp
:00451A4D 5D                      pop ebp
:00451A4E C3                      ret



* Referenced by a CALL at Addresses:
|:0042CF6E   , :0042CF9E   , :0044053A   , :004500B3   , :00450A8B   
|:0045B962   , :0046621B   
|
:00451A4F 55                      push ebp
:00451A50 8BEC                    mov ebp, esp
:00451A52 51                      push ecx
:00451A53 894DFC                  mov dword ptr [ebp-04], ecx
:00451A56 8B45FC                  mov eax, dword ptr [ebp-04]
:00451A59 8B403C                  mov eax, dword ptr [eax+3C]
:00451A5C 8BE5                    mov esp, ebp
:00451A5E 5D                      pop ebp
:00451A5F C3                      ret



* Referenced by a CALL at Addresses:
|:0042CF86   , :0042CFB6   , :00440561   , :004500DA   , :00450AB2   
|:0045B98D   , :0046624C   , :0047B77A   , :0047BAE7   , :0047BFFD   
|
:00451A60 55                      push ebp
:00451A61 8BEC                    mov ebp, esp
:00451A63 51                      push ecx
:00451A64 894DFC                  mov dword ptr [ebp-04], ecx
:00451A67 8B45FC                  mov eax, dword ptr [ebp-04]
:00451A6A 8B4040                  mov eax, dword ptr [eax+40]
:00451A6D 8BE5                    mov esp, ebp
:00451A6F 5D                      pop ebp
:00451A70 C3                      ret


:00451A71 55                      push ebp
:00451A72 8BEC                    mov ebp, esp
:00451A74 51                      push ecx
:00451A75 894DFC                  mov dword ptr [ebp-04], ecx
:00451A78 8B45FC                  mov eax, dword ptr [ebp-04]
:00451A7B 83C044                  add eax, 00000044
:00451A7E 8BE5                    mov esp, ebp
:00451A80 5D                      pop ebp
:00451A81 C3                      ret


:00451A82 55                      push ebp
:00451A83 8BEC                    mov ebp, esp
:00451A85 51                      push ecx
:00451A86 894DFC                  mov dword ptr [ebp-04], ecx
:00451A89 8B45FC                  mov eax, dword ptr [ebp-04]
:00451A8C 83C046                  add eax, 00000046
:00451A8F 8BE5                    mov esp, ebp
:00451A91 5D                      pop ebp
:00451A92 C3                      ret



* Referenced by a CALL at Addresses:
|:00403704   , :00404214   , :0040454B   , :00404597   , :0042CCCB   
|:0043FD15   , :0044202A   , :0044209E   , :0044FA3A   , :0044FA93   
|:0044FB41   , :0044FC61   , :0044FD1C   , :004578C2   , :0045A306   
|:0045A34A   , :0045B97B   , :00466230   
|
:00451A93 55                      push ebp
:00451A94 8BEC                    mov ebp, esp
:00451A96 51                      push ecx
:00451A97 894DFC                  mov dword ptr [ebp-04], ecx
:00451A9A 8B45FC                  mov eax, dword ptr [ebp-04]
:00451A9D 8B4004                  mov eax, dword ptr [eax+04]
:00451AA0 8BE5                    mov esp, ebp
:00451AA2 5D                      pop ebp
:00451AA3 C3                      ret



* Referenced by a CALL at Addresses:
|:0040371E   , :00404238   , :00404571   , :004045BD   , :0042CCF1   
|:0043FCF6   , :0044203F   , :004420BF   , :0044FA5A   , :0044FAB3   
|:0044FB5C   , :0044FC81   , :0044FD3C   , :004578E8   , :0045A328   
|:0045A36C   , :0045B9A7   , :00466261   
|
:00451AA4 55                      push ebp
:00451AA5 8BEC                    mov ebp, esp
:00451AA7 51                      push ecx
:00451AA8 894DFC                  mov dword ptr [ebp-04], ecx
:00451AAB 8B45FC                  mov eax, dword ptr [ebp-04]
:00451AAE 8B4008                  mov eax, dword ptr [eax+08]
:00451AB1 8BE5                    mov esp, ebp
:00451AB3 5D                      pop ebp
:00451AB4 C3                      ret



* Referenced by a CALL at Addresses:
|:0044D2CD   , :0044D85D   
|
:00451AB5 55                      push ebp
:00451AB6 8BEC                    mov ebp, esp
:00451AB8 83EC0C                  sub esp, 0000000C
:00451ABB 894DFC                  mov dword ptr [ebp-04], ecx
:00451ABE 8B45FC                  mov eax, dword ptr [ebp-04]
:00451AC1 8B4D08                  mov ecx, dword ptr [ebp+08]
:00451AC4 89483C                  mov dword ptr [eax+3C], ecx
:00451AC7 8B55FC                  mov edx, dword ptr [ebp-04]
:00451ACA 8B450C                  mov eax, dword ptr [ebp+0C]
:00451ACD 894240                  mov dword ptr [edx+40], eax
:00451AD0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00451AD3 8B5510                  mov edx, dword ptr [ebp+10]
:00451AD6 895114                  mov dword ptr [ecx+14], edx
:00451AD9 8B45FC                  mov eax, dword ptr [ebp-04]
:00451ADC 8B4D14                  mov ecx, dword ptr [ebp+14]
:00451ADF 894818                  mov dword ptr [eax+18], ecx
:00451AE2 8B55FC                  mov edx, dword ptr [ebp-04]
:00451AE5 C7420400000000          mov [edx+04], 00000000
:00451AEC 8B45FC                  mov eax, dword ptr [ebp-04]
:00451AEF C7400800000000          mov [eax+08], 00000000
:00451AF6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00451AF9 C7414800000000          mov [ecx+48], 00000000
:00451B00 8B55FC                  mov edx, dword ptr [ebp-04]
:00451B03 C7424C00000000          mov [edx+4C], 00000000
:00451B0A 8B45FC                  mov eax, dword ptr [ebp-04]
:00451B0D C7405000000000          mov [eax+50], 00000000
:00451B14 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00451B17 C64154FF                mov [ecx+54], FF
:00451B1B 8B55FC                  mov edx, dword ptr [ebp-04]
:00451B1E C64255FF                mov [edx+55], FF
:00451B22 8B45FC                  mov eax, dword ptr [ebp-04]
:00451B25 C74058FFFF0000          mov [eax+58], 0000FFFF
:00451B2C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00451B2F C7415CFFFF0000          mov [ecx+5C], 0000FFFF
:00451B36 8B55FC                  mov edx, dword ptr [ebp-04]
:00451B39 C6426000                mov [edx+60], 00
:00451B3D 8B45FC                  mov eax, dword ptr [ebp-04]
:00451B40 C6406100                mov [eax+61], 00
:00451B44 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00451B47 C70101000000            mov dword ptr [ecx], 00000001
:00451B4D 8B55FC                  mov edx, dword ptr [ebp-04]
:00451B50 C7426400000000          mov [edx+64], 00000000
:00451B57 8B45FC                  mov eax, dword ptr [ebp-04]
:00451B5A C7406800000000          mov [eax+68], 00000000
:00451B61 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00451B64 C6416CFF                mov [ecx+6C], FF
:00451B68 8B55FC                  mov edx, dword ptr [ebp-04]
:00451B6B C6426DFF                mov [edx+6D], FF
:00451B6F 8B45FC                  mov eax, dword ptr [ebp-04]
:00451B72 C6406EFF                mov [eax+6E], FF
:00451B76 33C9                    xor ecx, ecx
:00451B78 8A0D2C424B00            mov cl, byte ptr [004B422C]
:00451B7E 6BC930                  imul ecx, 00000030
:00451B81 8B55FC                  mov edx, dword ptr [ebp-04]
:00451B84 894A34                  mov dword ptr [edx+34], ecx
:00451B87 33C0                    xor eax, eax
:00451B89 A02D424B00              mov al, byte ptr [004B422D]
:00451B8E 6BC030                  imul eax, 00000030
:00451B91 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00451B94 894138                  mov dword ptr [ecx+38], eax
:00451B97 8B55FC                  mov edx, dword ptr [ebp-04]
:00451B9A 8B45FC                  mov eax, dword ptr [ebp-04]
:00451B9D 8B4A2C                  mov ecx, dword ptr [edx+2C]
:00451BA0 3B4834                  cmp ecx, dword ptr [eax+34]
:00451BA3 7D0B                    jge 00451BB0
:00451BA5 8B55FC                  mov edx, dword ptr [ebp-04]
:00451BA8 8B422C                  mov eax, dword ptr [edx+2C]
:00451BAB 8945F8                  mov dword ptr [ebp-08], eax
:00451BAE EB09                    jmp 00451BB9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451BA3(C)
|
:00451BB0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00451BB3 8B5134                  mov edx, dword ptr [ecx+34]
:00451BB6 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451BAE(U)
|
:00451BB9 8B45FC                  mov eax, dword ptr [ebp-04]
:00451BBC 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00451BBF 894824                  mov dword ptr [eax+24], ecx
:00451BC2 8B55FC                  mov edx, dword ptr [ebp-04]
:00451BC5 8B4238                  mov eax, dword ptr [edx+38]
:00451BC8 83C038                  add eax, 00000038
:00451BCB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00451BCE 394130                  cmp dword ptr [ecx+30], eax
:00451BD1 7D0B                    jge 00451BDE
:00451BD3 8B55FC                  mov edx, dword ptr [ebp-04]
:00451BD6 8B4230                  mov eax, dword ptr [edx+30]
:00451BD9 8945F4                  mov dword ptr [ebp-0C], eax
:00451BDC EB0C                    jmp 00451BEA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451BD1(C)
|
:00451BDE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00451BE1 8B5138                  mov edx, dword ptr [ecx+38]
:00451BE4 83C238                  add edx, 00000038
:00451BE7 8955F4                  mov dword ptr [ebp-0C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451BDC(U)
|
:00451BEA 8B45FC                  mov eax, dword ptr [ebp-04]
:00451BED 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00451BF0 894828                  mov dword ptr [eax+28], ecx
:00451BF3 8B55FC                  mov edx, dword ptr [ebp-04]
:00451BF6 C682851B0000FF          mov byte ptr [edx+00001B85], FF
:00451BFD 8BE5                    mov esp, ebp
:00451BFF 5D                      pop ebp
:00451C00 C21000                  ret 0010



* Referenced by a CALL at Addresses:
|:00433D04   , :00433E4C   , :00433FDD   , :00434065   , :0043D62D   
|:0043D989   
|
:00451C03 55                      push ebp
:00451C04 8BEC                    mov ebp, esp
:00451C06 51                      push ecx
:00451C07 894DFC                  mov dword ptr [ebp-04], ecx
:00451C0A 8B45FC                  mov eax, dword ptr [ebp-04]
:00451C0D 8B4D08                  mov ecx, dword ptr [ebp+08]
:00451C10 894864                  mov dword ptr [eax+64], ecx
:00451C13 8BE5                    mov esp, ebp
:00451C15 5D                      pop ebp
:00451C16 C20400                  ret 0004


:00451C19 55                      push ebp
:00451C1A 8BEC                    mov ebp, esp
:00451C1C 51                      push ecx
:00451C1D 894DFC                  mov dword ptr [ebp-04], ecx
:00451C20 8B45FC                  mov eax, dword ptr [ebp-04]
:00451C23 8B4064                  mov eax, dword ptr [eax+64]
:00451C26 8BE5                    mov esp, ebp
:00451C28 5D                      pop ebp
:00451C29 C3                      ret



* Referenced by a CALL at Address:
|:0045A3B0   
|
:00451C2A 55                      push ebp
:00451C2B 8BEC                    mov ebp, esp
:00451C2D 83EC10                  sub esp, 00000010
:00451C30 894DF4                  mov dword ptr [ebp-0C], ecx
:00451C33 8B45F4                  mov eax, dword ptr [ebp-0C]
:00451C36 8A4D08                  mov cl, byte ptr [ebp+08]
:00451C39 88486C                  mov byte ptr [eax+6C], cl
:00451C3C C645FC00                mov [ebp-04], 00
:00451C40 EB09                    jmp 00451C4B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451CCD(U)
|
:00451C42 8A55FC                  mov dl, byte ptr [ebp-04]
:00451C45 80C201                  add dl, 01
:00451C48 8855FC                  mov byte ptr [ebp-04], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451C40(U)
|
:00451C4B 8B45FC                  mov eax, dword ptr [ebp-04]
:00451C4E 25FF000000              and eax, 000000FF
:00451C53 83F830                  cmp eax, 00000030
:00451C56 7D7A                    jge 00451CD2
:00451C58 C645F800                mov [ebp-08], 00
:00451C5C EB09                    jmp 00451C67

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451CCB(U)
|
:00451C5E 8A4DF8                  mov cl, byte ptr [ebp-08]
:00451C61 80C101                  add cl, 01
:00451C64 884DF8                  mov byte ptr [ebp-08], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451C5C(U)
|
:00451C67 8B55F8                  mov edx, dword ptr [ebp-08]
:00451C6A 81E2FF000000            and edx, 000000FF
:00451C70 83FA30                  cmp edx, 00000030
:00451C73 7D58                    jge 00451CCD
:00451C75 8B45FC                  mov eax, dword ptr [ebp-04]
:00451C78 25FF000000              and eax, 000000FF
:00451C7D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00451C80 81E1FF000000            and ecx, 000000FF
:00451C86 03C1                    add eax, ecx
:00451C88 99                      cdq
:00451C89 33C2                    xor eax, edx
:00451C8B 2BC2                    sub eax, edx
:00451C8D 83E001                  and eax, 00000001
:00451C90 33C2                    xor eax, edx
:00451C92 2BC2                    sub eax, edx
:00451C94 85C0                    test eax, eax
:00451C96 7409                    je 00451CA1
:00451C98 C745F000000000          mov [ebp-10], 00000000
:00451C9F EB0B                    jmp 00451CAC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451C96(C)
|
:00451CA1 8B55F4                  mov edx, dword ptr [ebp-0C]
:00451CA4 33C0                    xor eax, eax
:00451CA6 8A426C                  mov al, byte ptr [edx+6C]
:00451CA9 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451C9F(U)
|
:00451CAC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00451CAF 81E1FF000000            and ecx, 000000FF
:00451CB5 6BC930                  imul ecx, 00000030
:00451CB8 8B55F8                  mov edx, dword ptr [ebp-08]
:00451CBB 81E2FF000000            and edx, 000000FF
:00451CC1 0355F4                  add edx, dword ptr [ebp-0C]
:00451CC4 8A45F0                  mov al, byte ptr [ebp-10]
:00451CC7 88440A6F                mov byte ptr [edx+ecx+6F], al
:00451CCB EB91                    jmp 00451C5E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451C73(C)
|
:00451CCD E970FFFFFF              jmp 00451C42

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451C56(C)
|
:00451CD2 8BE5                    mov esp, ebp
:00451CD4 5D                      pop ebp
:00451CD5 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0045A40C   
|
:00451CD8 55                      push ebp
:00451CD9 8BEC                    mov ebp, esp
:00451CDB 51                      push ecx
:00451CDC 894DFC                  mov dword ptr [ebp-04], ecx
:00451CDF 8B45FC                  mov eax, dword ptr [ebp-04]
:00451CE2 C6406CFF                mov [eax+6C], FF
:00451CE6 8BE5                    mov esp, ebp
:00451CE8 5D                      pop ebp
:00451CE9 C3                      ret



* Referenced by a CALL at Addresses:
|:0044AC7C   , :0044B5FE   , :0044BB03   , :0044BD68   
|
:00451CEA 55                      push ebp
:00451CEB 8BEC                    mov ebp, esp
:00451CED 83EC10                  sub esp, 00000010
:00451CF0 894DF4                  mov dword ptr [ebp-0C], ecx
:00451CF3 8B45F4                  mov eax, dword ptr [ebp-0C]
:00451CF6 8A4D08                  mov cl, byte ptr [ebp+08]
:00451CF9 88486D                  mov byte ptr [eax+6D], cl
:00451CFC 8B5508                  mov edx, dword ptr [ebp+08]
:00451CFF 81E2FF000000            and edx, 000000FF
:00451D05 85D2                    test edx, edx
:00451D07 7504                    jne 00451D0D
:00451D09 C645081F                mov [ebp+08], 1F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451D07(C)
|
:00451D0D C645FC00                mov [ebp-04], 00
:00451D11 EB08                    jmp 00451D1B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451DA0(U)
|
:00451D13 8A45FC                  mov al, byte ptr [ebp-04]
:00451D16 0401                    add al, 01
:00451D18 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451D11(U)
|
:00451D1B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00451D1E 81E1FF000000            and ecx, 000000FF
:00451D24 83F930                  cmp ecx, 00000030
:00451D27 7D7C                    jge 00451DA5
:00451D29 C645F800                mov [ebp-08], 00
:00451D2D EB09                    jmp 00451D38

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451D9E(U)
|
:00451D2F 8A55F8                  mov dl, byte ptr [ebp-08]
:00451D32 80C201                  add dl, 01
:00451D35 8855F8                  mov byte ptr [ebp-08], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451D2D(U)
|
:00451D38 8B45F8                  mov eax, dword ptr [ebp-08]
:00451D3B 25FF000000              and eax, 000000FF
:00451D40 83F830                  cmp eax, 00000030
:00451D43 7D5B                    jge 00451DA0
:00451D45 8B45FC                  mov eax, dword ptr [ebp-04]
:00451D48 25FF000000              and eax, 000000FF
:00451D4D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00451D50 81E1FF000000            and ecx, 000000FF
:00451D56 03C1                    add eax, ecx
:00451D58 99                      cdq
:00451D59 33C2                    xor eax, edx
:00451D5B 2BC2                    sub eax, edx
:00451D5D 83E001                  and eax, 00000001
:00451D60 33C2                    xor eax, edx
:00451D62 2BC2                    sub eax, edx
:00451D64 85C0                    test eax, eax
:00451D66 7409                    je 00451D71
:00451D68 C745F000000000          mov [ebp-10], 00000000
:00451D6F EB0C                    jmp 00451D7D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451D66(C)
|
:00451D71 8B5508                  mov edx, dword ptr [ebp+08]
:00451D74 81E2FF000000            and edx, 000000FF
:00451D7A 8955F0                  mov dword ptr [ebp-10], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451D6F(U)
|
:00451D7D 8B45FC                  mov eax, dword ptr [ebp-04]
:00451D80 25FF000000              and eax, 000000FF
:00451D85 6BC030                  imul eax, 00000030
:00451D88 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00451D8B 81E1FF000000            and ecx, 000000FF
:00451D91 034DF4                  add ecx, dword ptr [ebp-0C]
:00451D94 8A55F0                  mov dl, byte ptr [ebp-10]
:00451D97 8894016F090000          mov byte ptr [ecx+eax+0000096F], dl
:00451D9E EB8F                    jmp 00451D2F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451D43(C)
|
:00451DA0 E96EFFFFFF              jmp 00451D13

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451D27(C)
|
:00451DA5 8BE5                    mov esp, ebp
:00451DA7 5D                      pop ebp
:00451DA8 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0044AFB0   , :0044BA6B   , :0044BCD3   , :0044C132   
|
:00451DAB 55                      push ebp
:00451DAC 8BEC                    mov ebp, esp
:00451DAE 51                      push ecx
:00451DAF 894DFC                  mov dword ptr [ebp-04], ecx
:00451DB2 8B45FC                  mov eax, dword ptr [ebp-04]
:00451DB5 C6406DFF                mov [eax+6D], FF
:00451DB9 8BE5                    mov esp, ebp
:00451DBB 5D                      pop ebp
:00451DBC C3                      ret



* Referenced by a CALL at Addresses:
|:0045240D   , :004524C4   
|
:00451DBD 55                      push ebp
:00451DBE 8BEC                    mov ebp, esp
:00451DC0 83EC0C                  sub esp, 0000000C
:00451DC3 56                      push esi
:00451DC4 894DF4                  mov dword ptr [ebp-0C], ecx
:00451DC7 8B45F4                  mov eax, dword ptr [ebp-0C]
:00451DCA 33C9                    xor ecx, ecx
:00451DCC 8A486E                  mov cl, byte ptr [eax+6E]
:00451DCF 8B5510                  mov edx, dword ptr [ebp+10]
:00451DD2 81E2FF000000            and edx, 000000FF
:00451DD8 3BCA                    cmp ecx, edx
:00451DDA 0F848D000000            je 00451E6D
:00451DE0 8B45F4                  mov eax, dword ptr [ebp-0C]
:00451DE3 8A4D10                  mov cl, byte ptr [ebp+10]
:00451DE6 88486E                  mov byte ptr [eax+6E], cl
:00451DE9 6800090000              push 00000900
:00451DEE 6A00                    push 00000000
:00451DF0 8B55F4                  mov edx, dword ptr [ebp-0C]
:00451DF3 81C26F120000            add edx, 0000126F
:00451DF9 52                      push edx
:00451DFA E831ED0200              call 00480B30
:00451DFF 83C40C                  add esp, 0000000C
:00451E02 C745FC00000000          mov [ebp-04], 00000000
:00451E09 EB09                    jmp 00451E14

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451E6B(U)
|
:00451E0B 8B45FC                  mov eax, dword ptr [ebp-04]
:00451E0E 83C001                  add eax, 00000001
:00451E11 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451E09(U)
|
:00451E14 837DFC30                cmp dword ptr [ebp-04], 00000030
:00451E18 7353                    jnb 00451E6D
:00451E1A C745F800000000          mov [ebp-08], 00000000
:00451E21 EB09                    jmp 00451E2C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451E69(U)
|
:00451E23 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00451E26 83C101                  add ecx, 00000001
:00451E29 894DF8                  mov dword ptr [ebp-08], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451E21(U)
|
:00451E2C 837DF830                cmp dword ptr [ebp-08], 00000030
:00451E30 7339                    jnb 00451E6B
:00451E32 8B45FC                  mov eax, dword ptr [ebp-04]
:00451E35 33D2                    xor edx, edx
:00451E37 B902000000              mov ecx, 00000002
:00451E3C F7F1                    div ecx
:00451E3E 8BCA                    mov ecx, edx
:00451E40 8B45F8                  mov eax, dword ptr [ebp-08]
:00451E43 33D2                    xor edx, edx
:00451E45 BE02000000              mov esi, 00000002
:00451E4A F7F6                    div esi
:00451E4C 3BCA                    cmp ecx, edx
:00451E4E 7519                    jne 00451E69
:00451E50 8B55FC                  mov edx, dword ptr [ebp-04]
:00451E53 6BD230                  imul edx, 00000030
:00451E56 0355F8                  add edx, dword ptr [ebp-08]
:00451E59 8B45F4                  mov eax, dword ptr [ebp-0C]
:00451E5C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00451E5F 8A496E                  mov cl, byte ptr [ecx+6E]
:00451E62 888C106F120000          mov byte ptr [eax+edx+0000126F], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451E4E(C)
|
:00451E69 EBB8                    jmp 00451E23

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451E30(C)
|
:00451E6B EB9E                    jmp 00451E0B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00451DDA(C), :00451E18(C)
|
:00451E6D 6A00                    push 00000000
:00451E6F 6A1F                    push 0000001F
:00451E71 6A04                    push 00000004
:00451E73 E879B30200              call 0047D1F1
:00451E78 83C40C                  add esp, 0000000C
:00451E7B 8B55F4                  mov edx, dword ptr [ebp-0C]
:00451E7E 81C26F120000            add edx, 0000126F
:00451E84 52                      push edx
:00451E85 6A30                    push 00000030
:00451E87 6A30                    push 00000030
:00451E89 8B450C                  mov eax, dword ptr [ebp+0C]
:00451E8C 50                      push eax
:00451E8D 8B4D08                  mov ecx, dword ptr [ebp+08]
:00451E90 51                      push ecx
:00451E91 E805C20200              call 0047E09B
:00451E96 83C414                  add esp, 00000014
:00451E99 5E                      pop esi
:00451E9A 8BE5                    mov esp, ebp
:00451E9C 5D                      pop ebp
:00451E9D C20C00                  ret 000C


:00451EA0 55                      push ebp
:00451EA1 8BEC                    mov ebp, esp
:00451EA3 51                      push ecx
:00451EA4 894DFC                  mov dword ptr [ebp-04], ecx
:00451EA7 8B45FC                  mov eax, dword ptr [ebp-04]
:00451EAA 8A4D08                  mov cl, byte ptr [ebp+08]
:00451EAD 88886F1B0000            mov byte ptr [eax+00001B6F], cl
:00451EB3 8BE5                    mov esp, ebp
:00451EB5 5D                      pop ebp
:00451EB6 C20400                  ret 0004


:00451EB9 55                      push ebp
:00451EBA 8BEC                    mov ebp, esp
:00451EBC 51                      push ecx
:00451EBD 894DFC                  mov dword ptr [ebp-04], ecx
:00451EC0 8B45FC                  mov eax, dword ptr [ebp-04]
:00451EC3 8A806F1B0000            mov al, byte ptr [eax+00001B6F]
:00451EC9 8BE5                    mov esp, ebp
:00451ECB 5D                      pop ebp
:00451ECC C3                      ret



* Referenced by a CALL at Address:
|:0045253D   
|
:00451ECD 55                      push ebp
:00451ECE 8BEC                    mov ebp, esp
:00451ED0 83EC18                  sub esp, 00000018
:00451ED3 894DEC                  mov dword ptr [ebp-14], ecx
:00451ED6 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00451ED9 E832D80000              call 0045F710
:00451EDE C745F400000000          mov [ebp-0C], 00000000
:00451EE5 8B45EC                  mov eax, dword ptr [ebp-14]
:00451EE8 83C054                  add eax, 00000054
:00451EEB 50                      push eax
:00451EEC 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00451EEF E8AC46FBFF              call 004065A0
:00451EF4 8B4508                  mov eax, dword ptr [ebp+08]
:00451EF7 33D2                    xor edx, edx
:00451EF9 B930000000              mov ecx, 00000030
:00451EFE F7F1                    div ecx
:00451F00 8845F8                  mov byte ptr [ebp-08], al
:00451F03 8B450C                  mov eax, dword ptr [ebp+0C]
:00451F06 33D2                    xor edx, edx
:00451F08 B930000000              mov ecx, 00000030
:00451F0D F7F1                    div ecx
:00451F0F 8845FC                  mov byte ptr [ebp-04], al
:00451F12 8B55EC                  mov edx, dword ptr [ebp-14]
:00451F15 8A4261                  mov al, byte ptr [edx+61]
:00451F18 8845E8                  mov byte ptr [ebp-18], al
:00451F1B 807DE801                cmp byte ptr [ebp-18], 01
:00451F1F 7419                    je 00451F3A
:00451F21 807DE802                cmp byte ptr [ebp-18], 02
:00451F25 0F84B0000000            je 00451FDB
:00451F2B 807DE803                cmp byte ptr [ebp-18], 03
:00451F2F 0F8414010000            je 00452049
:00451F35 E91A020000              jmp 00452154

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451F1F(C)
|
:00451F3A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00451F3D 81E1FF000000            and ecx, 000000FF
:00451F43 8B55F0                  mov edx, dword ptr [ebp-10]
:00451F46 81E2FF000000            and edx, 000000FF
:00451F4C 3BCA                    cmp ecx, edx
:00451F4E 7539                    jne 00451F89
:00451F50 8B45F1                  mov eax, dword ptr [ebp-0F]
:00451F53 25FF000000              and eax, 000000FF
:00451F58 83E801                  sub eax, 00000001
:00451F5B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00451F5E 81E1FF000000            and ecx, 000000FF
:00451F64 3BC1                    cmp eax, ecx
:00451F66 7F21                    jg 00451F89
:00451F68 8B55FC                  mov edx, dword ptr [ebp-04]
:00451F6B 81E2FF000000            and edx, 000000FF
:00451F71 8B45F1                  mov eax, dword ptr [ebp-0F]
:00451F74 25FF000000              and eax, 000000FF
:00451F79 83C001                  add eax, 00000001
:00451F7C 3BD0                    cmp edx, eax
:00451F7E 7F09                    jg 00451F89
:00451F80 C745F401000000          mov [ebp-0C], 00000001
:00451F87 EB4D                    jmp 00451FD6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00451F4E(C), :00451F66(C), :00451F7E(C)
|
:00451F89 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00451F8C 81E1FF000000            and ecx, 000000FF
:00451F92 8B55F1                  mov edx, dword ptr [ebp-0F]
:00451F95 81E2FF000000            and edx, 000000FF
:00451F9B 3BCA                    cmp ecx, edx
:00451F9D 7537                    jne 00451FD6
:00451F9F 8B45F0                  mov eax, dword ptr [ebp-10]
:00451FA2 25FF000000              and eax, 000000FF
:00451FA7 83E801                  sub eax, 00000001
:00451FAA 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00451FAD 81E1FF000000            and ecx, 000000FF
:00451FB3 3BC1                    cmp eax, ecx
:00451FB5 7F1F                    jg 00451FD6
:00451FB7 8B55F8                  mov edx, dword ptr [ebp-08]
:00451FBA 81E2FF000000            and edx, 000000FF
:00451FC0 8B45F0                  mov eax, dword ptr [ebp-10]
:00451FC3 25FF000000              and eax, 000000FF
:00451FC8 83C001                  add eax, 00000001
:00451FCB 3BD0                    cmp edx, eax
:00451FCD 7F07                    jg 00451FD6
:00451FCF C745F401000000          mov [ebp-0C], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00451F87(U), :00451F9D(C), :00451FB5(C), :00451FCD(C)
|
:00451FD6 E9AB010000              jmp 00452186

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451F25(C)
|
:00451FDB 8B4DF1                  mov ecx, dword ptr [ebp-0F]
:00451FDE 81E1FF000000            and ecx, 000000FF
:00451FE4 83E901                  sub ecx, 00000001
:00451FE7 8B55FC                  mov edx, dword ptr [ebp-04]
:00451FEA 81E2FF000000            and edx, 000000FF
:00451FF0 3BCA                    cmp ecx, edx
:00451FF2 7F50                    jg 00452044
:00451FF4 8B45FC                  mov eax, dword ptr [ebp-04]
:00451FF7 25FF000000              and eax, 000000FF
:00451FFC 8B4DF1                  mov ecx, dword ptr [ebp-0F]
:00451FFF 81E1FF000000            and ecx, 000000FF
:00452005 83C101                  add ecx, 00000001
:00452008 3BC1                    cmp eax, ecx
:0045200A 7F38                    jg 00452044
:0045200C 8B55F0                  mov edx, dword ptr [ebp-10]
:0045200F 81E2FF000000            and edx, 000000FF
:00452015 83EA01                  sub edx, 00000001
:00452018 8B45F8                  mov eax, dword ptr [ebp-08]
:0045201B 25FF000000              and eax, 000000FF
:00452020 3BD0                    cmp edx, eax
:00452022 7F20                    jg 00452044
:00452024 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00452027 81E1FF000000            and ecx, 000000FF
:0045202D 8B55F0                  mov edx, dword ptr [ebp-10]
:00452030 81E2FF000000            and edx, 000000FF
:00452036 83C201                  add edx, 00000001
:00452039 3BCA                    cmp ecx, edx
:0045203B 7F07                    jg 00452044
:0045203D C745F401000000          mov [ebp-0C], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00451FF2(C), :0045200A(C), :00452022(C), :0045203B(C)
|
:00452044 E93D010000              jmp 00452186

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451F2F(C)
|
:00452049 8B45F8                  mov eax, dword ptr [ebp-08]
:0045204C 25FF000000              and eax, 000000FF
:00452051 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00452054 81E1FF000000            and ecx, 000000FF
:0045205A 3BC1                    cmp eax, ecx
:0045205C 753D                    jne 0045209B
:0045205E 8B55F1                  mov edx, dword ptr [ebp-0F]
:00452061 81E2FF000000            and edx, 000000FF
:00452067 83EA02                  sub edx, 00000002
:0045206A 8B45FC                  mov eax, dword ptr [ebp-04]
:0045206D 25FF000000              and eax, 000000FF
:00452072 3BD0                    cmp edx, eax
:00452074 7F25                    jg 0045209B
:00452076 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00452079 81E1FF000000            and ecx, 000000FF
:0045207F 8B55F1                  mov edx, dword ptr [ebp-0F]
:00452082 81E2FF000000            and edx, 000000FF
:00452088 83C202                  add edx, 00000002
:0045208B 3BCA                    cmp ecx, edx
:0045208D 7F0C                    jg 0045209B
:0045208F C745F401000000          mov [ebp-0C], 00000001
:00452096 E9B7000000              jmp 00452152

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045205C(C), :00452074(C), :0045208D(C)
|
:0045209B 8B45FC                  mov eax, dword ptr [ebp-04]
:0045209E 25FF000000              and eax, 000000FF
:004520A3 8B4DF1                  mov ecx, dword ptr [ebp-0F]
:004520A6 81E1FF000000            and ecx, 000000FF
:004520AC 3BC1                    cmp eax, ecx
:004520AE 753A                    jne 004520EA
:004520B0 8B55F0                  mov edx, dword ptr [ebp-10]
:004520B3 81E2FF000000            and edx, 000000FF
:004520B9 83EA02                  sub edx, 00000002
:004520BC 8B45F8                  mov eax, dword ptr [ebp-08]
:004520BF 25FF000000              and eax, 000000FF
:004520C4 3BD0                    cmp edx, eax
:004520C6 7F22                    jg 004520EA
:004520C8 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004520CB 81E1FF000000            and ecx, 000000FF
:004520D1 8B55F0                  mov edx, dword ptr [ebp-10]
:004520D4 81E2FF000000            and edx, 000000FF
:004520DA 83C202                  add edx, 00000002
:004520DD 3BCA                    cmp ecx, edx
:004520DF 7F09                    jg 004520EA
:004520E1 C745F401000000          mov [ebp-0C], 00000001
:004520E8 EB68                    jmp 00452152

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004520AE(C), :004520C6(C), :004520DF(C)
|
:004520EA 8B45F1                  mov eax, dword ptr [ebp-0F]
:004520ED 25FF000000              and eax, 000000FF
:004520F2 83E801                  sub eax, 00000001
:004520F5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004520F8 81E1FF000000            and ecx, 000000FF
:004520FE 3BC1                    cmp eax, ecx
:00452100 7F50                    jg 00452152
:00452102 8B55FC                  mov edx, dword ptr [ebp-04]
:00452105 81E2FF000000            and edx, 000000FF
:0045210B 8B45F1                  mov eax, dword ptr [ebp-0F]
:0045210E 25FF000000              and eax, 000000FF
:00452113 83C001                  add eax, 00000001
:00452116 3BD0                    cmp edx, eax
:00452118 7F38                    jg 00452152
:0045211A 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0045211D 81E1FF000000            and ecx, 000000FF
:00452123 83E901                  sub ecx, 00000001
:00452126 8B55F8                  mov edx, dword ptr [ebp-08]
:00452129 81E2FF000000            and edx, 000000FF
:0045212F 3BCA                    cmp ecx, edx
:00452131 7F1F                    jg 00452152
:00452133 8B45F8                  mov eax, dword ptr [ebp-08]
:00452136 25FF000000              and eax, 000000FF
:0045213B 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0045213E 81E1FF000000            and ecx, 000000FF
:00452144 83C101                  add ecx, 00000001
:00452147 3BC1                    cmp eax, ecx
:00452149 7F07                    jg 00452152
:0045214B C745F401000000          mov [ebp-0C], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00452096(U), :004520E8(U), :00452100(C), :00452118(C), :00452131(C)
|:00452149(C)
|
:00452152 EB32                    jmp 00452186

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451F35(U)
|
:00452154 8B55F8                  mov edx, dword ptr [ebp-08]
:00452157 81E2FF000000            and edx, 000000FF
:0045215D 8B45F0                  mov eax, dword ptr [ebp-10]
:00452160 25FF000000              and eax, 000000FF
:00452165 3BD0                    cmp edx, eax
:00452167 751D                    jne 00452186
:00452169 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045216C 81E1FF000000            and ecx, 000000FF
:00452172 8B55F1                  mov edx, dword ptr [ebp-0F]
:00452175 81E2FF000000            and edx, 000000FF
:0045217B 3BCA                    cmp ecx, edx
:0045217D 7507                    jne 00452186
:0045217F C745F401000000          mov [ebp-0C], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00451FD6(U), :00452044(U), :00452152(U), :00452167(C), :0045217D(C)
|
:00452186 8B45F4                  mov eax, dword ptr [ebp-0C]
:00452189 8BE5                    mov esp, ebp
:0045218B 5D                      pop ebp
:0045218C C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0043FD2A   , :00453B3F   , :00453B62   , :00455870   , :004579CC   
|:00458B72   , :0045A3F1   , :0045A44D   
|
:0045218F 55                      push ebp
:00452190 8BEC                    mov ebp, esp
:00452192 83EC38                  sub esp, 00000038
:00452195 53                      push ebx
:00452196 56                      push esi
:00452197 894DC8                  mov dword ptr [ebp-38], ecx
:0045219A 8B45C8                  mov eax, dword ptr [ebp-38]
:0045219D 8B4004                  mov eax, dword ptr [eax+04]
:004521A0 99                      cdq
:004521A1 B930000000              mov ecx, 00000030
:004521A6 F7F9                    idiv ecx
:004521A8 25FF000000              and eax, 000000FF
:004521AD 8B5508                  mov edx, dword ptr [ebp+08]
:004521B0 81E2FF000000            and edx, 000000FF
:004521B6 03C2                    add eax, edx
:004521B8 8845DC                  mov byte ptr [ebp-24], al
:004521BB 8B45C8                  mov eax, dword ptr [ebp-38]
:004521BE 8B4008                  mov eax, dword ptr [eax+08]
:004521C1 99                      cdq
:004521C2 B930000000              mov ecx, 00000030
:004521C7 F7F9                    idiv ecx
:004521C9 25FF000000              and eax, 000000FF
:004521CE 8B550C                  mov edx, dword ptr [ebp+0C]
:004521D1 81E2FF000000            and edx, 000000FF
:004521D7 03C2                    add eax, edx
:004521D9 8845D8                  mov byte ptr [ebp-28], al
:004521DC 6A04                    push 00000004
:004521DE 6A00                    push 00000000
:004521E0 6A00                    push 00000000
:004521E2 B9A8E44A00              mov ecx, 004AE4A8
:004521E7 E854D80200              call 0047FA40
:004521EC 8B4DDC                  mov ecx, dword ptr [ebp-24]
:004521EF 81E1FF000000            and ecx, 000000FF
:004521F5 8B55D8                  mov edx, dword ptr [ebp-28]
:004521F8 81E2FF000000            and edx, 000000FF
:004521FE 33DB                    xor ebx, ebx
:00452200 8A1D2C424B00            mov bl, byte ptr [004B422C]
:00452206 0FAFD3                  imul edx, ebx
:00452209 03CA                    add ecx, edx
:0045220B 69C900090000            imul ecx, 00000900
:00452211 03C1                    add eax, ecx
:00452213 8945D0                  mov dword ptr [ebp-30], eax
:00452216 6A04                    push 00000004
:00452218 6A00                    push 00000000
:0045221A 6A00                    push 00000000
:0045221C B938EB4A00              mov ecx, 004AEB38
:00452221 E81AD80200              call 0047FA40
:00452226 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00452229 81E1FF000000            and ecx, 000000FF
:0045222F 8B55D8                  mov edx, dword ptr [ebp-28]
:00452232 81E2FF000000            and edx, 000000FF
:00452238 33DB                    xor ebx, ebx
:0045223A 8A1D2C424B00            mov bl, byte ptr [004B422C]
:00452240 0FAFD3                  imul edx, ebx
:00452243 03CA                    add ecx, edx
:00452245 8D8408800C0000          lea eax, dword ptr [eax+ecx+00000C80]
:0045224C 8945D4                  mov dword ptr [ebp-2C], eax
:0045224F 6A04                    push 00000004
:00452251 6A00                    push 00000000
:00452253 6A00                    push 00000000
:00452255 B938EB4A00              mov ecx, 004AEB38
:0045225A E8E1D70200              call 0047FA40
:0045225F 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00452262 81E1FF000000            and ecx, 000000FF
:00452268 8B55D8                  mov edx, dword ptr [ebp-28]
:0045226B 81E2FF000000            and edx, 000000FF
:00452271 33DB                    xor ebx, ebx
:00452273 8A1D2C424B00            mov bl, byte ptr [004B422C]
:00452279 0FAFD3                  imul edx, ebx
:0045227C 03CA                    add ecx, edx
:0045227E 8D8408C0120000          lea eax, dword ptr [eax+ecx+000012C0]
:00452285 8945E4                  mov dword ptr [ebp-1C], eax
:00452288 6A04                    push 00000004
:0045228A 6A00                    push 00000000
:0045228C 6A00                    push 00000000
:0045228E B938EB4A00              mov ecx, 004AEB38
:00452293 E8A8D70200              call 0047FA40
:00452298 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0045229B 81E1FF000000            and ecx, 000000FF
:004522A1 8B55D8                  mov edx, dword ptr [ebp-28]
:004522A4 81E2FF000000            and edx, 000000FF
:004522AA 33DB                    xor ebx, ebx
:004522AC 8A1D2C424B00            mov bl, byte ptr [004B422C]
:004522B2 0FAFD3                  imul edx, ebx
:004522B5 03CA                    add ecx, edx
:004522B7 8D8408401F0000          lea eax, dword ptr [eax+ecx+00001F40]
:004522BE 8945E8                  mov dword ptr [ebp-18], eax
:004522C1 6A04                    push 00000004
:004522C3 6A00                    push 00000000
:004522C5 6A00                    push 00000000
:004522C7 B9A8F44A00              mov ecx, 004AF4A8
:004522CC E86FD70200              call 0047FA40
:004522D1 8B4DDC                  mov ecx, dword ptr [ebp-24]
:004522D4 81E1FF000000            and ecx, 000000FF
:004522DA 8B55D8                  mov edx, dword ptr [ebp-28]
:004522DD 81E2FF000000            and edx, 000000FF
:004522E3 33DB                    xor ebx, ebx
:004522E5 8A1D2C424B00            mov bl, byte ptr [004B422C]
:004522EB 0FAFD3                  imul edx, ebx
:004522EE 03CA                    add ecx, edx
:004522F0 03C1                    add eax, ecx
:004522F2 8945E0                  mov dword ptr [ebp-20], eax
:004522F5 8B4508                  mov eax, dword ptr [ebp+08]
:004522F8 25FF000000              and eax, 000000FF
:004522FD 6BC030                  imul eax, 00000030
:00452300 8945F0                  mov dword ptr [ebp-10], eax
:00452303 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00452306 81E1FF000000            and ecx, 000000FF
:0045230C 6BC930                  imul ecx, 00000030
:0045230F 894DEC                  mov dword ptr [ebp-14], ecx
:00452312 8B5510                  mov edx, dword ptr [ebp+10]
:00452315 81E2FF000000            and edx, 000000FF
:0045231B 6BD230                  imul edx, 00000030
:0045231E 8B45F0                  mov eax, dword ptr [ebp-10]
:00452321 03C2                    add eax, edx
:00452323 8945F4                  mov dword ptr [ebp-0C], eax
:00452326 8B4D14                  mov ecx, dword ptr [ebp+14]
:00452329 81E1FF000000            and ecx, 000000FF
:0045232F 6BC930                  imul ecx, 00000030
:00452332 8B55EC                  mov edx, dword ptr [ebp-14]
:00452335 03D1                    add edx, ecx
:00452337 8955F8                  mov dword ptr [ebp-08], edx
:0045233A E89CC2FCFF              call 0041E5DB
:0045233F 8B45EC                  mov eax, dword ptr [ebp-14]
:00452342 8945FC                  mov dword ptr [ebp-04], eax
:00452345 EB09                    jmp 00452350

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00452732(U)
|
:00452347 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045234A 83C130                  add ecx, 00000030
:0045234D 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00452345(U)
|
:00452350 8B55FC                  mov edx, dword ptr [ebp-04]
:00452353 3B55F8                  cmp edx, dword ptr [ebp-08]
:00452356 0F8DDB030000            jnl 00452737
:0045235C E863C70200              call 0047EAC4
:00452361 8B45F0                  mov eax, dword ptr [ebp-10]
:00452364 8945CC                  mov dword ptr [ebp-34], eax
:00452367 EB09                    jmp 00452372

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004526A0(U)
|
:00452369 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0045236C 83C130                  add ecx, 00000030
:0045236F 894DCC                  mov dword ptr [ebp-34], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00452367(U)
|
:00452372 8B55CC                  mov edx, dword ptr [ebp-34]
:00452375 3B55F4                  cmp edx, dword ptr [ebp-0C]
:00452378 0F8D27030000            jnl 004526A5
:0045237E E841C70200              call 0047EAC4
:00452383 8B45FC                  mov eax, dword ptr [ebp-04]
:00452386 50                      push eax
:00452387 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0045238A 51                      push ecx
:0045238B 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0045238E E8DA170000              call 00453B6D
:00452393 85C0                    test eax, eax
:00452395 0F85D5020000            jne 00452670
:0045239B 8B55C8                  mov edx, dword ptr [ebp-38]
:0045239E 837A6400                cmp dword ptr [edx+64], 00000000
:004523A2 750D                    jne 004523B1
:004523A4 8B45C8                  mov eax, dword ptr [ebp-38]
:004523A7 83786800                cmp dword ptr [eax+68], 00000000
:004523AB 0F84B6000000            je 00452467

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004523A2(C)
|
:004523B1 6A00                    push 00000000
:004523B3 8B4DD0                  mov ecx, dword ptr [ebp-30]
:004523B6 51                      push ecx
:004523B7 6A30                    push 00000030
:004523B9 6A30                    push 00000030
:004523BB 8B55C8                  mov edx, dword ptr [ebp-38]
:004523BE 8B45FC                  mov eax, dword ptr [ebp-04]
:004523C1 034240                  add eax, dword ptr [edx+40]
:004523C4 50                      push eax
:004523C5 8B4DC8                  mov ecx, dword ptr [ebp-38]
:004523C8 8B55CC                  mov edx, dword ptr [ebp-34]
:004523CB 03513C                  add edx, dword ptr [ecx+3C]
:004523CE 52                      push edx
:004523CF E83FF5FFFF              call 00451913
:004523D4 83C418                  add esp, 00000018
:004523D7 8B45E4                  mov eax, dword ptr [ebp-1C]
:004523DA 33C9                    xor ecx, ecx
:004523DC 8A08                    mov cl, byte ptr [eax]
:004523DE 81F9FF000000            cmp ecx, 000000FF
:004523E4 742C                    je 00452412
:004523E6 8B55C8                  mov edx, dword ptr [ebp-38]
:004523E9 8B4264                  mov eax, dword ptr [edx+64]
:004523EC F7D8                    neg eax
:004523EE 1BC0                    sbb eax, eax
:004523F0 24E2                    and al, E2
:004523F2 83C05A                  add eax, 0000005A
:004523F5 50                      push eax
:004523F6 8B4DC8                  mov ecx, dword ptr [ebp-38]
:004523F9 8B55FC                  mov edx, dword ptr [ebp-04]
:004523FC 035140                  add edx, dword ptr [ecx+40]
:004523FF 52                      push edx
:00452400 8B45C8                  mov eax, dword ptr [ebp-38]
:00452403 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00452406 03483C                  add ecx, dword ptr [eax+3C]
:00452409 51                      push ecx
:0045240A 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0045240D E8ABF9FFFF              call 00451DBD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004523E4(C)
|
:00452412 8B55C8                  mov edx, dword ptr [ebp-38]
:00452415 33C0                    xor eax, eax
:00452417 8A82851B0000            mov al, byte ptr [edx+00001B85]
:0045241D 3DFF000000              cmp eax, 000000FF
:00452422 7441                    je 00452465
:00452424 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00452427 33D2                    xor edx, edx
:00452429 8A11                    mov dl, byte ptr [ecx]
:0045242B 85D2                    test edx, edx
:0045242D 7436                    je 00452465
:0045242F 6A04                    push 00000004
:00452431 6A04                    push 00000004
:00452433 6A00                    push 00000000
:00452435 68C00C0000              push 00000CC0
:0045243A B950EB4A00              mov ecx, 004AEB50
:0045243F E8FCD50200              call 0047FA40
:00452444 50                      push eax
:00452445 6A30                    push 00000030
:00452447 6A30                    push 00000030
:00452449 8B45C8                  mov eax, dword ptr [ebp-38]
:0045244C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045244F 034840                  add ecx, dword ptr [eax+40]
:00452452 51                      push ecx
:00452453 8B55C8                  mov edx, dword ptr [ebp-38]
:00452456 8B45CC                  mov eax, dword ptr [ebp-34]
:00452459 03423C                  add eax, dword ptr [edx+3C]
:0045245C 50                      push eax
:0045245D E8B1F4FFFF              call 00451913
:00452462 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00452422(C), :0045242D(C)
|
:00452465 EB62                    jmp 004524C9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004523AB(C)
|
:00452467 6A00                    push 00000000
:00452469 8B4DD0                  mov ecx, dword ptr [ebp-30]
:0045246C 51                      push ecx
:0045246D 6A30                    push 00000030
:0045246F 6A30                    push 00000030
:00452471 8B55C8                  mov edx, dword ptr [ebp-38]
:00452474 8B45FC                  mov eax, dword ptr [ebp-04]
:00452477 034240                  add eax, dword ptr [edx+40]
:0045247A 50                      push eax
:0045247B 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0045247E 8B55CC                  mov edx, dword ptr [ebp-34]
:00452481 03513C                  add edx, dword ptr [ecx+3C]
:00452484 52                      push edx
:00452485 E889F4FFFF              call 00451913
:0045248A 83C418                  add esp, 00000018
:0045248D 8B45C8                  mov eax, dword ptr [ebp-38]
:00452490 33C9                    xor ecx, ecx
:00452492 8A88851B0000            mov cl, byte ptr [eax+00001B85]
:00452498 81F9FF000000            cmp ecx, 000000FF
:0045249E 7429                    je 004524C9
:004524A0 8B55E0                  mov edx, dword ptr [ebp-20]
:004524A3 33C0                    xor eax, eax
:004524A5 8A02                    mov al, byte ptr [edx]
:004524A7 85C0                    test eax, eax
:004524A9 741E                    je 004524C9
:004524AB 6A28                    push 00000028
:004524AD 8B4DC8                  mov ecx, dword ptr [ebp-38]
:004524B0 8B55FC                  mov edx, dword ptr [ebp-04]
:004524B3 035140                  add edx, dword ptr [ecx+40]
:004524B6 52                      push edx
:004524B7 8B45C8                  mov eax, dword ptr [ebp-38]
:004524BA 8B4DCC                  mov ecx, dword ptr [ebp-34]
:004524BD 03483C                  add ecx, dword ptr [eax+3C]
:004524C0 51                      push ecx
:004524C1 8B4DC8                  mov ecx, dword ptr [ebp-38]
:004524C4 E8F4F8FFFF              call 00451DBD

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00452465(U), :0045249E(C), :004524A9(C)
|
:004524C9 8B55E8                  mov edx, dword ptr [ebp-18]
:004524CC 33C0                    xor eax, eax
:004524CE 8A02                    mov al, byte ptr [edx]
:004524D0 3DFF000000              cmp eax, 000000FF
:004524D5 7422                    je 004524F9
:004524D7 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004524DA 8A11                    mov dl, byte ptr [ecx]
:004524DC 52                      push edx
:004524DD 8B45C8                  mov eax, dword ptr [ebp-38]
:004524E0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004524E3 034840                  add ecx, dword ptr [eax+40]
:004524E6 51                      push ecx
:004524E7 8B55C8                  mov edx, dword ptr [ebp-38]
:004524EA 8B45CC                  mov eax, dword ptr [ebp-34]
:004524ED 03423C                  add eax, dword ptr [edx+3C]
:004524F0 50                      push eax
:004524F1 E84E020000              call 00452744
:004524F6 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004524D5(C)
|
:004524F9 8B4DC8                  mov ecx, dword ptr [ebp-38]
:004524FC 33D2                    xor edx, edx
:004524FE 8A516C                  mov dl, byte ptr [ecx+6C]
:00452501 81FAFF000000            cmp edx, 000000FF
:00452507 7429                    je 00452532
:00452509 6A04                    push 00000004
:0045250B 8B45C8                  mov eax, dword ptr [ebp-38]
:0045250E 83C06F                  add eax, 0000006F
:00452511 50                      push eax
:00452512 6A30                    push 00000030
:00452514 6A30                    push 00000030
:00452516 8B4DC8                  mov ecx, dword ptr [ebp-38]
:00452519 8B55FC                  mov edx, dword ptr [ebp-04]
:0045251C 035140                  add edx, dword ptr [ecx+40]
:0045251F 52                      push edx
:00452520 8B45C8                  mov eax, dword ptr [ebp-38]
:00452523 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00452526 03483C                  add ecx, dword ptr [eax+3C]
:00452529 51                      push ecx
:0045252A E8E4F3FFFF              call 00451913
:0045252F 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00452507(C)
|
:00452532 8B55FC                  mov edx, dword ptr [ebp-04]
:00452535 52                      push edx
:00452536 8B45CC                  mov eax, dword ptr [ebp-34]
:00452539 50                      push eax
:0045253A 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0045253D E88BF9FFFF              call 00451ECD
:00452542 85C0                    test eax, eax
:00452544 0F84A0000000            je 004525EA
:0045254A 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0045254D 33D2                    xor edx, edx
:0045254F 8A5154                  mov dl, byte ptr [ecx+54]
:00452552 8BCA                    mov ecx, edx
:00452554 8B45CC                  mov eax, dword ptr [ebp-34]
:00452557 99                      cdq
:00452558 BE30000000              mov esi, 00000030
:0045255D F7FE                    idiv esi
:0045255F 3BC8                    cmp ecx, eax
:00452561 7551                    jne 004525B4
:00452563 8B55C8                  mov edx, dword ptr [ebp-38]
:00452566 33C0                    xor eax, eax
:00452568 8A4255                  mov al, byte ptr [edx+55]
:0045256B 8BC8                    mov ecx, eax
:0045256D 8B45FC                  mov eax, dword ptr [ebp-04]
:00452570 99                      cdq
:00452571 BE30000000              mov esi, 00000030
:00452576 F7FE                    idiv esi
:00452578 3BC8                    cmp ecx, eax
:0045257A 7538                    jne 004525B4
:0045257C 6A04                    push 00000004
:0045257E 6A04                    push 00000004
:00452580 6A00                    push 00000000
:00452582 68C01E0000              push 00001EC0
:00452587 B950EB4A00              mov ecx, 004AEB50
:0045258C E8AFD40200              call 0047FA40
:00452591 50                      push eax
:00452592 6A30                    push 00000030
:00452594 6A30                    push 00000030
:00452596 8B55C8                  mov edx, dword ptr [ebp-38]
:00452599 8B45FC                  mov eax, dword ptr [ebp-04]
:0045259C 034240                  add eax, dword ptr [edx+40]
:0045259F 50                      push eax
:004525A0 8B4DC8                  mov ecx, dword ptr [ebp-38]
:004525A3 8B55CC                  mov edx, dword ptr [ebp-34]
:004525A6 03513C                  add edx, dword ptr [ecx+3C]
:004525A9 52                      push edx
:004525AA E864F3FFFF              call 00451913
:004525AF 83C418                  add esp, 00000018
:004525B2 EB36                    jmp 004525EA

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00452561(C), :0045257A(C)
|
:004525B4 6A04                    push 00000004
:004525B6 6A04                    push 00000004
:004525B8 6A00                    push 00000000
:004525BA 68C0150000              push 000015C0
:004525BF B950EB4A00              mov ecx, 004AEB50
:004525C4 E877D40200              call 0047FA40
:004525C9 50                      push eax
:004525CA 6A30                    push 00000030
:004525CC 6A30                    push 00000030
:004525CE 8B45C8                  mov eax, dword ptr [ebp-38]
:004525D1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004525D4 034840                  add ecx, dword ptr [eax+40]
:004525D7 51                      push ecx
:004525D8 8B55C8                  mov edx, dword ptr [ebp-38]
:004525DB 8B45CC                  mov eax, dword ptr [ebp-34]
:004525DE 03423C                  add eax, dword ptr [edx+3C]
:004525E1 50                      push eax
:004525E2 E82CF3FFFF              call 00451913
:004525E7 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00452544(C), :004525B2(U)
|
:004525EA 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:004525ED 33D2                    xor edx, edx
:004525EF 8A11                    mov dl, byte ptr [ecx]
:004525F1 81FAFF000000            cmp edx, 000000FF
:004525F7 743C                    je 00452635
:004525F9 8B45D4                  mov eax, dword ptr [ebp-2C]
:004525FC 33C9                    xor ecx, ecx
:004525FE 8A08                    mov cl, byte ptr [eax]
:00452600 83F973                  cmp ecx, 00000073
:00452603 7D30                    jge 00452635
:00452605 8B55C8                  mov edx, dword ptr [ebp-38]
:00452608 33C0                    xor eax, eax
:0045260A 8A426D                  mov al, byte ptr [edx+6D]
:0045260D 85C0                    test eax, eax
:0045260F 7424                    je 00452635
:00452611 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00452614 33D2                    xor edx, edx
:00452616 8A11                    mov dl, byte ptr [ecx]
:00452618 52                      push edx
:00452619 8B45C8                  mov eax, dword ptr [ebp-38]
:0045261C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045261F 034840                  add ecx, dword ptr [eax+40]
:00452622 51                      push ecx
:00452623 8B55C8                  mov edx, dword ptr [ebp-38]
:00452626 8B45CC                  mov eax, dword ptr [ebp-34]
:00452629 03423C                  add eax, dword ptr [edx+3C]
:0045262C 50                      push eax
:0045262D E8EDC4FEFF              call 0043EB1F
:00452632 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004525F7(C), :00452603(C), :0045260F(C)
|
:00452635 8B4DC8                  mov ecx, dword ptr [ebp-38]
:00452638 33D2                    xor edx, edx
:0045263A 8A516D                  mov dl, byte ptr [ecx+6D]
:0045263D 81FAFF000000            cmp edx, 000000FF
:00452643 742B                    je 00452670
:00452645 6A04                    push 00000004
:00452647 8B45C8                  mov eax, dword ptr [ebp-38]
:0045264A 056F090000              add eax, 0000096F
:0045264F 50                      push eax
:00452650 6A30                    push 00000030
:00452652 6A30                    push 00000030
:00452654 8B4DC8                  mov ecx, dword ptr [ebp-38]
:00452657 8B55FC                  mov edx, dword ptr [ebp-04]
:0045265A 035140                  add edx, dword ptr [ecx+40]
:0045265D 52                      push edx
:0045265E 8B45C8                  mov eax, dword ptr [ebp-38]
:00452661 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00452664 03483C                  add ecx, dword ptr [eax+3C]
:00452667 51                      push ecx
:00452668 E8A6F2FFFF              call 00451913
:0045266D 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00452395(C), :00452643(C)
|
:00452670 8B55D0                  mov edx, dword ptr [ebp-30]
:00452673 81C200090000            add edx, 00000900
:00452679 8955D0                  mov dword ptr [ebp-30], edx
:0045267C 8B45D4                  mov eax, dword ptr [ebp-2C]
:0045267F 83C001                  add eax, 00000001
:00452682 8945D4                  mov dword ptr [ebp-2C], eax
:00452685 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00452688 83C101                  add ecx, 00000001
:0045268B 894DE4                  mov dword ptr [ebp-1C], ecx
:0045268E 8B55E0                  mov edx, dword ptr [ebp-20]
:00452691 83C201                  add edx, 00000001
:00452694 8955E0                  mov dword ptr [ebp-20], edx
:00452697 8B45E8                  mov eax, dword ptr [ebp-18]
:0045269A 83C001                  add eax, 00000001
:0045269D 8945E8                  mov dword ptr [ebp-18], eax
:004526A0 E9C4FCFFFF              jmp 00452369

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00452378(C)
|
:004526A5 33C9                    xor ecx, ecx
:004526A7 8A0D2C424B00            mov cl, byte ptr [004B422C]
:004526AD 8B5510                  mov edx, dword ptr [ebp+10]
:004526B0 81E2FF000000            and edx, 000000FF
:004526B6 2BCA                    sub ecx, edx
:004526B8 69C900090000            imul ecx, 00000900
:004526BE 8B45D0                  mov eax, dword ptr [ebp-30]
:004526C1 03C1                    add eax, ecx
:004526C3 8945D0                  mov dword ptr [ebp-30], eax
:004526C6 33C9                    xor ecx, ecx
:004526C8 8A0D2C424B00            mov cl, byte ptr [004B422C]
:004526CE 8B5510                  mov edx, dword ptr [ebp+10]
:004526D1 81E2FF000000            and edx, 000000FF
:004526D7 2BCA                    sub ecx, edx
:004526D9 8B45D4                  mov eax, dword ptr [ebp-2C]
:004526DC 03C1                    add eax, ecx
:004526DE 8945D4                  mov dword ptr [ebp-2C], eax
:004526E1 33C9                    xor ecx, ecx
:004526E3 8A0D2C424B00            mov cl, byte ptr [004B422C]
:004526E9 8B5510                  mov edx, dword ptr [ebp+10]
:004526EC 81E2FF000000            and edx, 000000FF
:004526F2 2BCA                    sub ecx, edx
:004526F4 8B45E4                  mov eax, dword ptr [ebp-1C]
:004526F7 03C1                    add eax, ecx
:004526F9 8945E4                  mov dword ptr [ebp-1C], eax
:004526FC 33C9                    xor ecx, ecx
:004526FE 8A0D2C424B00            mov cl, byte ptr [004B422C]
:00452704 8B5510                  mov edx, dword ptr [ebp+10]
:00452707 81E2FF000000            and edx, 000000FF
:0045270D 2BCA                    sub ecx, edx
:0045270F 8B45E0                  mov eax, dword ptr [ebp-20]
:00452712 03C1                    add eax, ecx
:00452714 8945E0                  mov dword ptr [ebp-20], eax
:00452717 33C9                    xor ecx, ecx
:00452719 8A0D2C424B00            mov cl, byte ptr [004B422C]
:0045271F 8B5510                  mov edx, dword ptr [ebp+10]
:00452722 81E2FF000000            and edx, 000000FF
:00452728 2BCA                    sub ecx, edx
:0045272A 8B45E8                  mov eax, dword ptr [ebp-18]
:0045272D 03C1                    add eax, ecx
:0045272F 8945E8                  mov dword ptr [ebp-18], eax
:00452732 E910FCFFFF              jmp 00452347

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00452356(C)
|
:00452737 E8BABEFCFF              call 0041E5F6
:0045273C 5E                      pop esi
:0045273D 5B                      pop ebx
:0045273E 8BE5                    mov esp, ebp
:00452740 5D                      pop ebp
:00452741 C21000                  ret 0010



* Referenced by a CALL at Address:
|:004524F1   
|
:00452744 55                      push ebp
:00452745 8BEC                    mov ebp, esp
:00452747 51                      push ecx
:00452748 8B4510                  mov eax, dword ptr [ebp+10]
:0045274B 25FF000000              and eax, 000000FF
:00452750 8945FC                  mov dword ptr [ebp-04], eax
:00452753 837DFC03                cmp dword ptr [ebp-04], 00000003
:00452757 0F8727010000            ja 00452884
:0045275D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00452760 FF248D88284500          jmp dword ptr [4*ecx+00452888]
:00452767 6A04                    push 00000004
:00452769 6A04                    push 00000004
:0045276B 6A00                    push 00000000
:0045276D B9083D4B00              mov ecx, 004B3D08
:00452772 E8599BFCFF              call 0041C2D0
:00452777 25FF000000              and eax, 000000FF
:0045277C 99                      cdq
:0045277D 33C2                    xor eax, edx
:0045277F 2BC2                    sub eax, edx
:00452781 83E003                  and eax, 00000003
:00452784 33C2                    xor eax, edx
:00452786 2BC2                    sub eax, edx
:00452788 69C000090000            imul eax, 00000900
:0045278E 05C08B0000              add eax, 00008BC0
:00452793 50                      push eax
:00452794 B950EB4A00              mov ecx, 004AEB50
:00452799 E8A2D20200              call 0047FA40
:0045279E 50                      push eax
:0045279F 6A30                    push 00000030
:004527A1 6A30                    push 00000030
:004527A3 8B550C                  mov edx, dword ptr [ebp+0C]
:004527A6 52                      push edx
:004527A7 8B4508                  mov eax, dword ptr [ebp+08]
:004527AA 50                      push eax
:004527AB E863F1FFFF              call 00451913
:004527B0 83C418                  add esp, 00000018
:004527B3 E9CC000000              jmp 00452884
:004527B8 6A04                    push 00000004
:004527BA 6A04                    push 00000004
:004527BC 6A00                    push 00000000
:004527BE B9083D4B00              mov ecx, 004B3D08
:004527C3 E8089BFCFF              call 0041C2D0
:004527C8 25FF000000              and eax, 000000FF
:004527CD 99                      cdq
:004527CE 33C2                    xor eax, edx
:004527D0 2BC2                    sub eax, edx
:004527D2 83E001                  and eax, 00000001
:004527D5 33C2                    xor eax, edx
:004527D7 2BC2                    sub eax, edx
:004527D9 F7D8                    neg eax
:004527DB 1BC0                    sbb eax, eax
:004527DD 2500090000              and eax, 00000900
:004527E2 05C0AF0000              add eax, 0000AFC0
:004527E7 50                      push eax
:004527E8 B950EB4A00              mov ecx, 004AEB50
:004527ED E84ED20200              call 0047FA40
:004527F2 50                      push eax
:004527F3 6A30                    push 00000030
:004527F5 6A30                    push 00000030
:004527F7 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004527FA 51                      push ecx
:004527FB 8B5508                  mov edx, dword ptr [ebp+08]
:004527FE 52                      push edx
:004527FF E80FF1FFFF              call 00451913
:00452804 83C418                  add esp, 00000018
:00452807 EB7B                    jmp 00452884
:00452809 6A04                    push 00000004
:0045280B 6A04                    push 00000004
:0045280D 6A00                    push 00000000
:0045280F B9083D4B00              mov ecx, 004B3D08
:00452814 E8B79AFCFF              call 0041C2D0
:00452819 25FF000000              and eax, 000000FF
:0045281E 99                      cdq
:0045281F 33C2                    xor eax, edx
:00452821 2BC2                    sub eax, edx
:00452823 83E001                  and eax, 00000001
:00452826 33C2                    xor eax, edx
:00452828 2BC2                    sub eax, edx
:0045282A F7D8                    neg eax
:0045282C 1BC0                    sbb eax, eax
:0045282E 2500090000              and eax, 00000900
:00452833 05E0B50100              add eax, 0001B5E0
:00452838 50                      push eax
:00452839 B950EB4A00              mov ecx, 004AEB50
:0045283E E8FDD10200              call 0047FA40
:00452843 50                      push eax
:00452844 6A30                    push 00000030
:00452846 6A30                    push 00000030
:00452848 8B450C                  mov eax, dword ptr [ebp+0C]
:0045284B 50                      push eax
:0045284C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045284F 51                      push ecx
:00452850 E8BEF0FFFF              call 00451913
:00452855 83C418                  add esp, 00000018
:00452858 EB2A                    jmp 00452884
:0045285A 6A04                    push 00000004
:0045285C 6A04                    push 00000004
:0045285E 6A00                    push 00000000
:00452860 68C01E0000              push 00001EC0
:00452865 B950EB4A00              mov ecx, 004AEB50
:0045286A E8D1D10200              call 0047FA40
:0045286F 50                      push eax
:00452870 6A30                    push 00000030
:00452872 6A30                    push 00000030
:00452874 8B550C                  mov edx, dword ptr [ebp+0C]
:00452877 52                      push edx
:00452878 8B4508                  mov eax, dword ptr [ebp+08]
:0045287B 50                      push eax
:0045287C E892F0FFFF              call 00451913
:00452881 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00452757(C), :004527B3(U), :00452807(U), :00452858(U)
|
:00452884 8BE5                    mov esp, ebp
:00452886 5D                      pop ebp
:00452887 C3                      ret



:00452888 67274500                DWORD 00452767
:0045288C B8274500                DWORD 004527B8
:00452890 09284500                DWORD 00452809
:00452894 5A284500                DWORD 0045285A



* Referenced by a CALL at Address:
|:00453A35   
|
:00452898 55                      push ebp
:00452899 8BEC                    mov ebp, esp
:0045289B 83EC2C                  sub esp, 0000002C
:0045289E 894DF0                  mov dword ptr [ebp-10], ecx
:004528A1 C745F400000000          mov [ebp-0C], 00000000
:004528A8 837D0800                cmp dword ptr [ebp+08], 00000000
:004528AC 741C                    je 004528CA
:004528AE 8B45F0                  mov eax, dword ptr [ebp-10]
:004528B1 8A88871B0000            mov cl, byte ptr [eax+00001B87]
:004528B7 51                      push ecx
:004528B8 8B55F0                  mov edx, dword ptr [ebp-10]
:004528BB 8A82861B0000            mov al, byte ptr [edx+00001B86]
:004528C1 50                      push eax
:004528C2 E8790F0000              call 00453840
:004528C7 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004528AC(C)
|
:004528CA 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004528CD 33D2                    xor edx, edx
:004528CF 8A91851B0000            mov dl, byte ptr [ecx+00001B85]
:004528D5 8955EC                  mov dword ptr [ebp-14], edx
:004528D8 837DEC0F                cmp dword ptr [ebp-14], 0000000F
:004528DC 0F87180F0000            ja 004537FA
:004528E2 8B45EC                  mov eax, dword ptr [ebp-14]
:004528E5 FF248500384500          jmp dword ptr [4*eax+00453800]
:004528EC 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004528EF 668B91861B0000          mov dx, word ptr [ecx+00001B86]
:004528F6 52                      push edx
:004528F7 E8A30F0000              call 0045389F
:004528FC 83C404                  add esp, 00000004
:004528FF E9F60E0000              jmp 004537FA
:00452904 8B45F0                  mov eax, dword ptr [ebp-10]
:00452907 668B88861B0000          mov cx, word ptr [eax+00001B86]
:0045290E 51                      push ecx
:0045290F E88B0F0000              call 0045389F
:00452914 83C404                  add esp, 00000004
:00452917 8B55F0                  mov edx, dword ptr [ebp-10]
:0045291A 668B82861B0000          mov ax, word ptr [edx+00001B86]
:00452921 50                      push eax
:00452922 E8EC0F0000              call 00453913
:00452927 83C404                  add esp, 00000004
:0045292A E9CB0E0000              jmp 004537FA
:0045292F 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00452932 668B91861B0000          mov dx, word ptr [ecx+00001B86]
:00452939 52                      push edx
:0045293A E8D40F0000              call 00453913
:0045293F 83C404                  add esp, 00000004
:00452942 8B45F0                  mov eax, dword ptr [ebp-10]
:00452945 8A88871B0000            mov cl, byte ptr [eax+00001B87]
:0045294B 51                      push ecx
:0045294C 8B55F0                  mov edx, dword ptr [ebp-10]
:0045294F 33C0                    xor eax, eax
:00452951 8A82861B0000            mov al, byte ptr [edx+00001B86]
:00452957 83E802                  sub eax, 00000002
:0045295A 50                      push eax
:0045295B E8E00E0000              call 00453840
:00452960 83C408                  add esp, 00000008
:00452963 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00452966 8A91871B0000            mov dl, byte ptr [ecx+00001B87]
:0045296C 52                      push edx
:0045296D 8B45F0                  mov eax, dword ptr [ebp-10]
:00452970 33C9                    xor ecx, ecx
:00452972 8A88861B0000            mov cl, byte ptr [eax+00001B86]
:00452978 83C102                  add ecx, 00000002
:0045297B 51                      push ecx
:0045297C E8BF0E0000              call 00453840
:00452981 83C408                  add esp, 00000008
:00452984 8B55F0                  mov edx, dword ptr [ebp-10]
:00452987 33C0                    xor eax, eax
:00452989 8A82871B0000            mov al, byte ptr [edx+00001B87]
:0045298F 83E802                  sub eax, 00000002
:00452992 50                      push eax
:00452993 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00452996 8A91861B0000            mov dl, byte ptr [ecx+00001B86]
:0045299C 52                      push edx
:0045299D E89E0E0000              call 00453840
:004529A2 83C408                  add esp, 00000008
:004529A5 8B45F0                  mov eax, dword ptr [ebp-10]
:004529A8 33C9                    xor ecx, ecx
:004529AA 8A88871B0000            mov cl, byte ptr [eax+00001B87]
:004529B0 83C102                  add ecx, 00000002
:004529B3 51                      push ecx
:004529B4 8B55F0                  mov edx, dword ptr [ebp-10]
:004529B7 8A82861B0000            mov al, byte ptr [edx+00001B86]
:004529BD 50                      push eax
:004529BE E87D0E0000              call 00453840
:004529C3 83C408                  add esp, 00000008
:004529C6 E92F0E0000              jmp 004537FA
:004529CB 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004529CE 668B91861B0000          mov dx, word ptr [ecx+00001B86]
:004529D5 52                      push edx
:004529D6 E8380F0000              call 00453913
:004529DB 83C404                  add esp, 00000004
:004529DE C745F400000000          mov [ebp-0C], 00000000
:004529E5 EB09                    jmp 004529F0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00452A4A(U)
|
:004529E7 8B45F4                  mov eax, dword ptr [ebp-0C]
:004529EA 83C001                  add eax, 00000001
:004529ED 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004529E5(U)
|
:004529F0 837DF403                cmp dword ptr [ebp-0C], 00000003
:004529F4 7356                    jnb 00452A4C
:004529F6 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004529F9 33D2                    xor edx, edx
:004529FB 8A91871B0000            mov dl, byte ptr [ecx+00001B87]
:00452A01 83EA02                  sub edx, 00000002
:00452A04 52                      push edx
:00452A05 8B45F0                  mov eax, dword ptr [ebp-10]
:00452A08 33C9                    xor ecx, ecx
:00452A0A 8A88861B0000            mov cl, byte ptr [eax+00001B86]
:00452A10 8B55F4                  mov edx, dword ptr [ebp-0C]
:00452A13 8D4411FF                lea eax, dword ptr [ecx+edx-01]
:00452A17 50                      push eax
:00452A18 E8230E0000              call 00453840
:00452A1D 83C408                  add esp, 00000008
:00452A20 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00452A23 33D2                    xor edx, edx
:00452A25 8A91871B0000            mov dl, byte ptr [ecx+00001B87]
:00452A2B 83C202                  add edx, 00000002
:00452A2E 52                      push edx
:00452A2F 8B45F0                  mov eax, dword ptr [ebp-10]
:00452A32 33C9                    xor ecx, ecx
:00452A34 8A88861B0000            mov cl, byte ptr [eax+00001B86]
:00452A3A 8B55F4                  mov edx, dword ptr [ebp-0C]
:00452A3D 8D4411FF                lea eax, dword ptr [ecx+edx-01]
:00452A41 50                      push eax
:00452A42 E8F90D0000              call 00453840
:00452A47 83C408                  add esp, 00000008
:00452A4A EB9B                    jmp 004529E7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004529F4(C)
|
:00452A4C C745F400000000          mov [ebp-0C], 00000000
:00452A53 EB09                    jmp 00452A5E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00452AB8(U)
|
:00452A55 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00452A58 83C101                  add ecx, 00000001
:00452A5B 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00452A53(U)
|
:00452A5E 837DF403                cmp dword ptr [ebp-0C], 00000003
:00452A62 7356                    jnb 00452ABA
:00452A64 8B55F0                  mov edx, dword ptr [ebp-10]
:00452A67 33C0                    xor eax, eax
:00452A69 8A82871B0000            mov al, byte ptr [edx+00001B87]
:00452A6F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00452A72 8D5408FF                lea edx, dword ptr [eax+ecx-01]
:00452A76 52                      push edx
:00452A77 8B45F0                  mov eax, dword ptr [ebp-10]
:00452A7A 33C9                    xor ecx, ecx
:00452A7C 8A88861B0000            mov cl, byte ptr [eax+00001B86]
:00452A82 83C102                  add ecx, 00000002
:00452A85 51                      push ecx
:00452A86 E8B50D0000              call 00453840
:00452A8B 83C408                  add esp, 00000008
:00452A8E 8B55F0                  mov edx, dword ptr [ebp-10]
:00452A91 33C0                    xor eax, eax
:00452A93 8A82871B0000            mov al, byte ptr [edx+00001B87]
:00452A99 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00452A9C 8D5408FF                lea edx, dword ptr [eax+ecx-01]
:00452AA0 52                      push edx
:00452AA1 8B45F0                  mov eax, dword ptr [ebp-10]
:00452AA4 33C9                    xor ecx, ecx
:00452AA6 8A88861B0000            mov cl, byte ptr [eax+00001B86]
:00452AAC 83E902                  sub ecx, 00000002
:00452AAF 51                      push ecx
:00452AB0 E88B0D0000              call 00453840
:00452AB5 83C408                  add esp, 00000008
:00452AB8 EB9B                    jmp 00452A55

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00452A62(C)
|
:00452ABA 8B55F0                  mov edx, dword ptr [ebp-10]
:00452ABD 8A82871B0000            mov al, byte ptr [edx+00001B87]
:00452AC3 50                      push eax
:00452AC4 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00452AC7 33D2                    xor edx, edx
:00452AC9 8A91861B0000            mov dl, byte ptr [ecx+00001B86]
:00452ACF 83EA03                  sub edx, 00000003
:00452AD2 52                      push edx
:00452AD3 E8680D0000              call 00453840
:00452AD8 83C408                  add esp, 00000008
:00452ADB 8B45F0                  mov eax, dword ptr [ebp-10]
:00452ADE 8A88871B0000            mov cl, byte ptr [eax+00001B87]
:00452AE4 51                      push ecx
:00452AE5 8B55F0                  mov edx, dword ptr [ebp-10]
:00452AE8 33C0                    xor eax, eax
:00452AEA 8A82861B0000            mov al, byte ptr [edx+00001B86]
:00452AF0 83C003                  add eax, 00000003
:00452AF3 50                      push eax
:00452AF4 E8470D0000              call 00453840
:00452AF9 83C408                  add esp, 00000008
:00452AFC 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00452AFF 33D2                    xor edx, edx
:00452B01 8A91871B0000            mov dl, byte ptr [ecx+00001B87]
:00452B07 83EA03                  sub edx, 00000003
:00452B0A 52                      push edx
:00452B0B 8B45F0                  mov eax, dword ptr [ebp-10]
:00452B0E 8A88861B0000            mov cl, byte ptr [eax+00001B86]
:00452B14 51                      push ecx
:00452B15 E8260D0000              call 00453840
:00452B1A 83C408                  add esp, 00000008
:00452B1D 8B55F0                  mov edx, dword ptr [ebp-10]
:00452B20 33C0                    xor eax, eax
:00452B22 8A82871B0000            mov al, byte ptr [edx+00001B87]
:00452B28 83C003                  add eax, 00000003
:00452B2B 50                      push eax
:00452B2C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00452B2F 8A91861B0000            mov dl, byte ptr [ecx+00001B86]
:00452B35 52                      push edx
:00452B36 E8050D0000              call 00453840
:00452B3B 83C408                  add esp, 00000008
:00452B3E E9B70C0000              jmp 004537FA
:00452B43 8B45F0                  mov eax, dword ptr [ebp-10]
:00452B46 668B88861B0000          mov cx, word ptr [eax+00001B86]
:00452B4D 51                      push ecx
:00452B4E E8C00D0000              call 00453913
:00452B53 83C404                  add esp, 00000004
:00452B56 C745F400000000          mov [ebp-0C], 00000000
:00452B5D EB09                    jmp 00452B68

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00452BC2(U)
|
:00452B5F 8B55F4                  mov edx, dword ptr [ebp-0C]
:00452B62 83C201                  add edx, 00000001
:00452B65 8955F4                  mov dword ptr [ebp-0C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00452B5D(U)
|
:00452B68 837DF403                cmp dword ptr [ebp-0C], 00000003
:00452B6C 7356                    jnb 00452BC4
:00452B6E 8B45F0                  mov eax, dword ptr [ebp-10]
:00452B71 33C9                    xor ecx, ecx
:00452B73 8A88871B0000            mov cl, byte ptr [eax+00001B87]
:00452B79 83E902                  sub ecx, 00000002
:00452B7C 51                      push ecx
:00452B7D 8B55F0                  mov edx, dword ptr [ebp-10]
:00452B80 33C0                    xor eax, eax
:00452B82 8A82861B0000            mov al, byte ptr [edx+00001B86]
:00452B88 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00452B8B 8D5408FF                lea edx, dword ptr [eax+ecx-01]
:00452B8F 52                      push edx
:00452B90 E8AB0C0000              call 00453840
:00452B95 83C408                  add esp, 00000008
:00452B98 8B45F0                  mov eax, dword ptr [ebp-10]
:00452B9B 33C9                    xor ecx, ecx
:00452B9D 8A88871B0000            mov cl, byte ptr [eax+00001B87]
:00452BA3 83C102                  add ecx, 00000002
:00452BA6 51                      push ecx
:00452BA7 8B55F0                  mov edx, dword ptr [ebp-10]
:00452BAA 33C0                    xor eax, eax
:00452BAC 8A82861B0000            mov al, byte ptr [edx+00001B86]
:00452BB2 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00452BB5 8D5408FF                lea edx, dword ptr [eax+ecx-01]
:00452BB9 52                      push edx
:00452BBA E8810C0000              call 00453840
:00452BBF 83C408                  add esp, 00000008
:00452BC2 EB9B                    jmp 00452B5F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00452B6C(C)
|
:00452BC4 C745F400000000          mov [ebp-0C], 00000000
:00452BCB EB09                    jmp 00452BD6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00452C30(U)
|
:00452BCD 8B45F4                  mov eax, dword ptr [ebp-0C]
:00452BD0 83C001                  add eax, 00000001
:00452BD3 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00452BCB(U)
|
:00452BD6 837DF403                cmp dword ptr [ebp-0C], 00000003
:00452BDA 7356                    jnb 00452C32
:00452BDC 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00452BDF 33D2                    xor edx, edx
:00452BE1 8A91871B0000            mov dl, byte ptr [ecx+00001B87]
:00452BE7 8B45F4                  mov eax, dword ptr [ebp-0C]
:00452BEA 8D4C02FF                lea ecx, dword ptr [edx+eax-01]
:00452BEE 51                      push ecx
:00452BEF 8B55F0                  mov edx, dword ptr [ebp-10]
:00452BF2 33C0                    xor eax, eax
:00452BF4 8A82861B0000            mov al, byte ptr [edx+00001B86]
:00452BFA 83C002                  add eax, 00000002
:00452BFD 50                      push eax
:00452BFE E83D0C0000              call 00453840
:00452C03 83C408                  add esp, 00000008
:00452C06 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00452C09 33D2                    xor edx, edx
:00452C0B 8A91871B0000            mov dl, byte ptr [ecx+00001B87]
:00452C11 8B45F4                  mov eax, dword ptr [ebp-0C]
:00452C14 8D4C02FF                lea ecx, dword ptr [edx+eax-01]
:00452C18 51                      push ecx
:00452C19 8B55F0                  mov edx, dword ptr [ebp-10]
:00452C1C 33C0                    xor eax, eax
:00452C1E 8A82861B0000            mov al, byte ptr [edx+00001B86]
:00452C24 83E802                  sub eax, 00000002
:00452C27 50                      push eax
:00452C28 E8130C0000              call 00453840
:00452C2D 83C408                  add esp, 00000008
:00452C30 EB9B                    jmp 00452BCD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00452BDA(C)
|
:00452C32 C745F400000000          mov [ebp-0C], 00000000
:00452C39 EB09                    jmp 00452C44

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00452C9E(U)
|
:00452C3B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00452C3E 83C101                  add ecx, 00000001
:00452C41 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00452C39(U)
|
:00452C44 837DF403                cmp dword ptr [ebp-0C], 00000003
:00452C48 7356                    jnb 00452CA0
:00452C4A 8B55F0                  mov edx, dword ptr [ebp-10]
:00452C4D 33C0                    xor eax, eax
:00452C4F 8A82871B0000            mov al, byte ptr [edx+00001B87]
:00452C55 83E803                  sub eax, 00000003
:00452C58 50                      push eax
:00452C59 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00452C5C 33D2                    xor edx, edx
:00452C5E 8A91861B0000            mov dl, byte ptr [ecx+00001B86]
:00452C64 8B45F4                  mov eax, dword ptr [ebp-0C]
:00452C67 8D4C02FF                lea ecx, dword ptr [edx+eax-01]
:00452C6B 51                      push ecx
:00452C6C E8CF0B0000              call 00453840
:00452C71 83C408                  add esp, 00000008
:00452C74 8B55F0                  mov edx, dword ptr [ebp-10]
:00452C77 33C0                    xor eax, eax
:00452C79 8A82871B0000            mov al, byte ptr [edx+00001B87]
:00452C7F 83C003                  add eax, 00000003
:00452C82 50                      push eax
:00452C83 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00452C86 33D2                    xor edx, edx
:00452C88 8A91861B0000            mov dl, byte ptr [ecx+00001B86]
:00452C8E 8B45F4                  mov eax, dword ptr [ebp-0C]
:00452C91 8D4C02FF                lea ecx, dword ptr [edx+eax-01]
:00452C95 51                      push ecx
:00452C96 E8A50B0000              call 00453840
:00452C9B 83C408                  add esp, 00000008
:00452C9E EB9B                    jmp 00452C3B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00452C48(C)
|
:00452CA0 C745F400000000          mov [ebp-0C], 00000000
:00452CA7 EB09                    jmp 00452CB2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00452D0C(U)
|
:00452CA9 8B55F4                  mov edx, dword ptr [ebp-0C]
:00452CAC 83C201                  add edx, 00000001
:00452CAF 8955F4                  mov dword ptr [ebp-0C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00452CA7(U)
|
:00452CB2 837DF403                cmp dword ptr [ebp-0C], 00000003
:00452CB6 7356                    jnb 00452D0E
:00452CB8 8B45F0                  mov eax, dword ptr [ebp-10]
:00452CBB 33C9                    xor ecx, ecx
:00452CBD 8A88871B0000            mov cl, byte ptr [eax+00001B87]
:00452CC3 8B55F4                  mov edx, dword ptr [ebp-0C]
:00452CC6 8D4411FF                lea eax, dword ptr [ecx+edx-01]
:00452CCA 50                      push eax
:00452CCB 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00452CCE 33D2                    xor edx, edx
:00452CD0 8A91861B0000            mov dl, byte ptr [ecx+00001B86]
:00452CD6 83C203                  add edx, 00000003
:00452CD9 52                      push edx
:00452CDA E8610B0000              call 00453840
:00452CDF 83C408                  add esp, 00000008
:00452CE2 8B45F0                  mov eax, dword ptr [ebp-10]
:00452CE5 33C9                    xor ecx, ecx
:00452CE7 8A88871B0000            mov cl, byte ptr [eax+00001B87]
:00452CED 8B55F4                  mov edx, dword ptr [ebp-0C]
:00452CF0 8D4411FF                lea eax, dword ptr [ecx+edx-01]
:00452CF4 50                      push eax
:00452CF5 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00452CF8 33D2                    xor edx, edx
:00452CFA 8A91861B0000            mov dl, byte ptr [ecx+00001B86]
:00452D00 83EA03                  sub edx, 00000003
:00452D03 52                      push edx
:00452D04 E8370B0000              call 00453840
:00452D09 83C408                  add esp, 00000008
:00452D0C EB9B                    jmp 00452CA9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00452CB6(C)
|
:00452D0E 8B45F0                  mov eax, dword ptr [ebp-10]
:00452D11 33C9                    xor ecx, ecx
:00452D13 8A88871B0000            mov cl, byte ptr [eax+00001B87]
:00452D19 83E902                  sub ecx, 00000002
:00452D1C 51                      push ecx
:00452D1D 8B55F0                  mov edx, dword ptr [ebp-10]
:00452D20 33C0                    xor eax, eax
:00452D22 8A82861B0000            mov al, byte ptr [edx+00001B86]
:00452D28 83E802                  sub eax, 00000002
:00452D2B 50                      push eax
:00452D2C E80F0B0000              call 00453840
:00452D31 83C408                  add esp, 00000008
:00452D34 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00452D37 33D2                    xor edx, edx
:00452D39 8A91871B0000            mov dl, byte ptr [ecx+00001B87]
:00452D3F 83C202                  add edx, 00000002
:00452D42 52                      push edx
:00452D43 8B45F0                  mov eax, dword ptr [ebp-10]
:00452D46 33C9                    xor ecx, ecx
:00452D48 8A88861B0000            mov cl, byte ptr [eax+00001B86]
:00452D4E 83C102                  add ecx, 00000002
:00452D51 51                      push ecx
:00452D52 E8E90A0000              call 00453840
:00452D57 83C408                  add esp, 00000008
:00452D5A 8B55F0                  mov edx, dword ptr [ebp-10]
:00452D5D 33C0                    xor eax, eax
:00452D5F 8A82871B0000            mov al, byte ptr [edx+00001B87]
:00452D65 83E802                  sub eax, 00000002
:00452D68 50                      push eax
:00452D69 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00452D6C 33D2                    xor edx, edx
:00452D6E 8A91861B0000            mov dl, byte ptr [ecx+00001B86]
:00452D74 83C202                  add edx, 00000002
:00452D77 52                      push edx
:00452D78 E8C30A0000              call 00453840
:00452D7D 83C408                  add esp, 00000008
:00452D80 8B45F0                  mov eax, dword ptr [ebp-10]
:00452D83 33C9                    xor ecx, ecx
:00452D85 8A88871B0000            mov cl, byte ptr [eax+00001B87]
:00452D8B 83C102                  add ecx, 00000002
:00452D8E 51                      push ecx
:00452D8F 8B55F0                  mov edx, dword ptr [ebp-10]
:00452D92 33C0                    xor eax, eax
:00452D94 8A82861B0000            mov al, byte ptr [edx+00001B86]
:00452D9A 83E802                  sub eax, 00000002
:00452D9D 50                      push eax
:00452D9E E89D0A0000              call 00453840
:00452DA3 83C408                  add esp, 00000008
:00452DA6 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00452DA9 8A91871B0000            mov dl, byte ptr [ecx+00001B87]
:00452DAF 52                      push edx
:00452DB0 8B45F0                  mov eax, dword ptr [ebp-10]
:00452DB3 33C9                    xor ecx, ecx
:00452DB5 8A88861B0000            mov cl, byte ptr [eax+00001B86]
:00452DBB 83E904                  sub ecx, 00000004
:00452DBE 51                      push ecx
:00452DBF E87C0A0000              call 00453840
:00452DC4 83C408                  add esp, 00000008
:00452DC7 8B55F0                  mov edx, dword ptr [ebp-10]
:00452DCA 8A82871B0000            mov al, byte ptr [edx+00001B87]
:00452DD0 50                      push eax
:00452DD1 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00452DD4 33D2                    xor edx, edx
:00452DD6 8A91861B0000            mov dl, byte ptr [ecx+00001B86]
:00452DDC 83C204                  add edx, 00000004
:00452DDF 52                      push edx
:00452DE0 E85B0A0000              call 00453840
:00452DE5 83C408                  add esp, 00000008
:00452DE8 8B45F0                  mov eax, dword ptr [ebp-10]
:00452DEB 33C9                    xor ecx, ecx
:00452DED 8A88871B0000            mov cl, byte ptr [eax+00001B87]
:00452DF3 83E904                  sub ecx, 00000004
:00452DF6 51                      push ecx
:00452DF7 8B55F0                  mov edx, dword ptr [ebp-10]
:00452DFA 8A82861B0000            mov al, byte ptr [edx+00001B86]
:00452E00 50                      push eax
:00452E01 E83A0A0000              call 00453840
:00452E06 83C408                  add esp, 00000008
:00452E09 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00452E0C 33D2                    xor edx, edx
:00452E0E 8A91871B0000            mov dl, byte ptr [ecx+00001B87]
:00452E14 83C204                  add edx, 00000004
:00452E17 52                      push edx
:00452E18 8B45F0                  mov eax, dword ptr [ebp-10]
:00452E1B 8A88861B0000            mov cl, byte ptr [eax+00001B86]
:00452E21 51                      push ecx
:00452E22 E8190A0000              call 00453840
:00452E27 83C408                  add esp, 00000008
:00452E2A E9CB090000              jmp 004537FA
:00452E2F 8B55F0                  mov edx, dword ptr [ebp-10]
:00452E32 668B82861B0000          mov ax, word ptr [edx+00001B86]
:00452E39 50                      push eax
:00452E3A E8600A0000              call 0045389F
:00452E3F 83C404                  add esp, 00000004
:00452E42 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00452E45 8A91871B0000            mov dl, byte ptr [ecx+00001B87]
:00452E4B 52                      push edx
:00452E4C 8B45F0                  mov eax, dword ptr [ebp-10]
:00452E4F 33C9                    xor ecx, ecx
:00452E51 8A88861B0000            mov cl, byte ptr [eax+00001B86]
:00452E57 83E902                  sub ecx, 00000002
:00452E5A 51                      push ecx
:00452E5B E8E0090000              call 00453840
:00452E60 83C408                  add esp, 00000008
:00452E63 8B55F0                  mov edx, dword ptr [ebp-10]
:00452E66 8A82871B0000            mov al, byte ptr [edx+00001B87]
:00452E6C 50                      push eax
:00452E6D 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00452E70 33D2                    xor edx, edx
:00452E72 8A91861B0000            mov dl, byte ptr [ecx+00001B86]
:00452E78 83C202                  add edx, 00000002
:00452E7B 52                      push edx
:00452E7C E8BF090000              call 00453840
:00452E81 83C408                  add esp, 00000008
:00452E84 8B45F0                  mov eax, dword ptr [ebp-10]
:00452E87 33C9                    xor ecx, ecx
:00452E89 8A88871B0000            mov cl, byte ptr [eax+00001B87]
:00452E8F 83E902                  sub ecx, 00000002
:00452E92 51                      push ecx
:00452E93 8B55F0                  mov edx, dword ptr [ebp-10]
:00452E96 8A82861B0000            mov al, byte ptr [edx+00001B86]
:00452E9C 50                      push eax
:00452E9D E89E090000              call 00453840
:00452EA2 83C408                  add esp, 00000008
:00452EA5 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00452EA8 33D2                    xor edx, edx
:00452EAA 8A91871B0000            mov dl, byte ptr [ecx+00001B87]
:00452EB0 83C202                  add edx, 00000002
:00452EB3 52                      push edx
:00452EB4 8B45F0                  mov eax, dword ptr [ebp-10]
:00452EB7 8A88861B0000            mov cl, byte ptr [eax+00001B86]
:00452EBD 51                      push ecx
:00452EBE E87D090000              call 00453840
:00452EC3 83C408                  add esp, 00000008
:00452EC6 E92F090000              jmp 004537FA
:00452ECB 8B55F0                  mov edx, dword ptr [ebp-10]
:00452ECE 668B82861B0000          mov ax, word ptr [edx+00001B86]
:00452ED5 50                      push eax
:00452ED6 E8C4090000              call 0045389F
:00452EDB 83C404                  add esp, 00000004
:00452EDE 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00452EE1 668B91861B0000          mov dx, word ptr [ecx+00001B86]
:00452EE8 52                      push edx
:00452EE9 E8250A0000              call 00453913
:00452EEE 83C404                  add esp, 00000004
:00452EF1 8B45F0                  mov eax, dword ptr [ebp-10]
:00452EF4 8A88871B0000            mov cl, byte ptr [eax+00001B87]
:00452EFA 51                      push ecx
:00452EFB 8B55F0                  mov edx, dword ptr [ebp-10]
:00452EFE 33C0                    xor eax, eax
:00452F00 8A82861B0000            mov al, byte ptr [edx+00001B86]
:00452F06 83E802                  sub eax, 00000002
:00452F09 50                      push eax
:00452F0A E831090000              call 00453840
:00452F0F 83C408                  add esp, 00000008
:00452F12 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00452F15 8A91871B0000            mov dl, byte ptr [ecx+00001B87]
:00452F1B 52                      push edx
:00452F1C 8B45F0                  mov eax, dword ptr [ebp-10]
:00452F1F 33C9                    xor ecx, ecx
:00452F21 8A88861B0000            mov cl, byte ptr [eax+00001B86]
:00452F27 83C102                  add ecx, 00000002
:00452F2A 51                      push ecx
:00452F2B E810090000              call 00453840
:00452F30 83C408                  add esp, 00000008
:00452F33 8B55F0                  mov edx, dword ptr [ebp-10]
:00452F36 33C0                    xor eax, eax
:00452F38 8A82871B0000            mov al, byte ptr [edx+00001B87]
:00452F3E 83E802                  sub eax, 00000002
:00452F41 50                      push eax
:00452F42 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00452F45 8A91861B0000            mov dl, byte ptr [ecx+00001B86]
:00452F4B 52                      push edx
:00452F4C E8EF080000              call 00453840
:00452F51 83C408                  add esp, 00000008
:00452F54 8B45F0                  mov eax, dword ptr [ebp-10]
:00452F57 33C9                    xor ecx, ecx
:00452F59 8A88871B0000            mov cl, byte ptr [eax+00001B87]
:00452F5F 83C102                  add ecx, 00000002
:00452F62 51                      push ecx
:00452F63 8B55F0                  mov edx, dword ptr [ebp-10]
:00452F66 8A82861B0000            mov al, byte ptr [edx+00001B86]
:00452F6C 50                      push eax
:00452F6D E8CE080000              call 00453840
:00452F72 83C408                  add esp, 00000008
:00452F75 E980080000              jmp 004537FA
:00452F7A C745F8FCFFFFFF          mov [ebp-08], FFFFFFFC
:00452F81 EB09                    jmp 00452F8C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045300B(U)
|
:00452F83 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00452F86 83C101                  add ecx, 00000001
:00452F89 894DF8                  mov dword ptr [ebp-08], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00452F81(U)
|
:00452F8C 837DF805                cmp dword ptr [ebp-08], 00000005
:00452F90 7D7E                    jge 00453010
:00452F92 C745FCFCFFFFFF          mov [ebp-04], FFFFFFFC
:00452F99 EB09                    jmp 00452FA4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00453009(U)
|
:00452F9B 8B55FC                  mov edx, dword ptr [ebp-04]
:00452F9E 83C201                  add edx, 00000001
:00452FA1 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00452F99(U)
|
:00452FA4 837DFC05                cmp dword ptr [ebp-04], 00000005
:00452FA8 7D61                    jge 0045300B
:00452FAA 837DF800                cmp dword ptr [ebp-08], 00000000
:00452FAE 7C08                    jl 00452FB8
:00452FB0 8B45F8                  mov eax, dword ptr [ebp-08]
:00452FB3 8945E8                  mov dword ptr [ebp-18], eax
:00452FB6 EB08                    jmp 00452FC0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00452FAE(C)
|
:00452FB8 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00452FBB F7D9                    neg ecx
:00452FBD 894DE8                  mov dword ptr [ebp-18], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00452FB6(U)
|
:00452FC0 837DFC00                cmp dword ptr [ebp-04], 00000000
:00452FC4 7C08                    jl 00452FCE
:00452FC6 8B55FC                  mov edx, dword ptr [ebp-04]
:00452FC9 8955E4                  mov dword ptr [ebp-1C], edx
:00452FCC EB08                    jmp 00452FD6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00452FC4(C)
|
:00452FCE 8B45FC                  mov eax, dword ptr [ebp-04]
:00452FD1 F7D8                    neg eax
:00452FD3 8945E4                  mov dword ptr [ebp-1C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00452FCC(U)
|
:00452FD6 B904000000              mov ecx, 00000004
:00452FDB 2B4DE8                  sub ecx, dword ptr [ebp-18]
:00452FDE 3B4DE4                  cmp ecx, dword ptr [ebp-1C]
:00452FE1 7526                    jne 00453009
:00452FE3 8B55F0                  mov edx, dword ptr [ebp-10]
:00452FE6 33C0                    xor eax, eax
:00452FE8 8A82871B0000            mov al, byte ptr [edx+00001B87]
:00452FEE 0345F8                  add eax, dword ptr [ebp-08]
:00452FF1 50                      push eax
:00452FF2 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00452FF5 33D2                    xor edx, edx
:00452FF7 8A91861B0000            mov dl, byte ptr [ecx+00001B86]
:00452FFD 0355FC                  add edx, dword ptr [ebp-04]
:00453000 52                      push edx
:00453001 E83A080000              call 00453840
:00453006 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00452FE1(C)
|
:00453009 EB90                    jmp 00452F9B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00452FA8(C)
|
:0045300B E973FFFFFF              jmp 00452F83

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00452F90(C)
|
:00453010 E9E5070000              jmp 004537FA
:00453015 C745F8FCFFFFFF          mov [ebp-08], FFFFFFFC
:0045301C EB09                    jmp 00453027

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004530A6(U)
|
:0045301E 8B45F8                  mov eax, dword ptr [ebp-08]
:00453021 83C001                  add eax, 00000001
:00453024 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045301C(U)
|
:00453027 837DF805                cmp dword ptr [ebp-08], 00000005
:0045302B 7D7E                    jge 004530AB
:0045302D C745FCFCFFFFFF          mov [ebp-04], FFFFFFFC
:00453034 EB09                    jmp 0045303F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004530A4(U)
|
:00453036 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00453039 83C101                  add ecx, 00000001
:0045303C 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00453034(U)
|
:0045303F 837DFC05                cmp dword ptr [ebp-04], 00000005
:00453043 7D61                    jge 004530A6
:00453045 837DF800                cmp dword ptr [ebp-08], 00000000
:00453049 7C08                    jl 00453053
:0045304B 8B55F8                  mov edx, dword ptr [ebp-08]
:0045304E 8955E0                  mov dword ptr [ebp-20], edx
:00453051 EB08                    jmp 0045305B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00453049(C)
|
:00453053 8B45F8                  mov eax, dword ptr [ebp-08]
:00453056 F7D8                    neg eax
:00453058 8945E0                  mov dword ptr [ebp-20], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00453051(U)
|
:0045305B 837DFC00                cmp dword ptr [ebp-04], 00000000
:0045305F 7C08                    jl 00453069
:00453061 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00453064 894DDC                  mov dword ptr [ebp-24], ecx
:00453067 EB08                    jmp 00453071

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045305F(C)
|
:00453069 8B55FC                  mov edx, dword ptr [ebp-04]
:0045306C F7DA                    neg edx
:0045306E 8955DC                  mov dword ptr [ebp-24], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00453067(U)
|
:00453071 B804000000              mov eax, 00000004
:00453076 2B45E0                  sub eax, dword ptr [ebp-20]
:00453079 3B45DC                  cmp eax, dword ptr [ebp-24]
:0045307C 7526                    jne 004530A4
:0045307E 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00453081 33D2                    xor edx, edx
:00453083 8A91871B0000            mov dl, byte ptr [ecx+00001B87]
:00453089 0355F8                  add edx, dword ptr [ebp-08]
:0045308C 52                      push edx
:0045308D 8B45F0                  mov eax, dword ptr [ebp-10]
:00453090 33C9                    xor ecx, ecx
:00453092 8A88861B0000            mov cl, byte ptr [eax+00001B86]
:00453098 034DFC                  add ecx, dword ptr [ebp-04]
:0045309B 51                      push ecx
:0045309C E89F070000              call 00453840
:004530A1 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045307C(C)
|
:004530A4 EB90                    jmp 00453036

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00453043(C)
|
:004530A6 E973FFFFFF              jmp 0045301E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045302B(C)
|
:004530AB C745F8FBFFFFFF          mov [ebp-08], FFFFFFFB
:004530B2 EB09                    jmp 004530BD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045313C(U)
|
:004530B4 8B55F8                  mov edx, dword ptr [ebp-08]
:004530B7 83C201                  add edx, 00000001
:004530BA 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004530B2(U)
|
:004530BD 837DF806                cmp dword ptr [ebp-08], 00000006
:004530C1 7D7E                    jge 00453141
:004530C3 C745FCFBFFFFFF          mov [ebp-04], FFFFFFFB
:004530CA EB09                    jmp 004530D5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045313A(U)
|
:004530CC 8B45FC                  mov eax, dword ptr [ebp-04]
:004530CF 83C001                  add eax, 00000001
:004530D2 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004530CA(U)
|
:004530D5 837DFC06                cmp dword ptr [ebp-04], 00000006
:004530D9 7D61                    jge 0045313C
:004530DB 837DF800                cmp dword ptr [ebp-08], 00000000
:004530DF 7C08                    jl 004530E9
:004530E1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004530E4 894DD8                  mov dword ptr [ebp-28], ecx
:004530E7 EB08                    jmp 004530F1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004530DF(C)
|
:004530E9 8B55F8                  mov edx, dword ptr [ebp-08]
:004530EC F7DA                    neg edx
:004530EE 8955D8                  mov dword ptr [ebp-28], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004530E7(U)
|
:004530F1 837DFC00                cmp dword ptr [ebp-04], 00000000
:004530F5 7C08                    jl 004530FF
:004530F7 8B45FC                  mov eax, dword ptr [ebp-04]
:004530FA 8945D4                  mov dword ptr [ebp-2C], eax
:004530FD EB08                    jmp 00453107

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004530F5(C)
|
:004530FF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00453102 F7D9                    neg ecx
:00453104 894DD4                  mov dword ptr [ebp-2C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004530FD(U)
|
:00453107 BA05000000              mov edx, 00000005
:0045310C 2B55D8                  sub edx, dword ptr [ebp-28]
:0045310F 3B55D4                  cmp edx, dword ptr [ebp-2C]
:00453112 7526                    jne 0045313A
:00453114 8B45F0                  mov eax, dword ptr [ebp-10]
:00453117 33C9                    xor ecx, ecx
:00453119 8A88871B0000            mov cl, byte ptr [eax+00001B87]
:0045311F 034DF8                  add ecx, dword ptr [ebp-08]
:00453122 51                      push ecx
:00453123 8B55F0                  mov edx, dword ptr [ebp-10]
:00453126 33C0                    xor eax, eax
:00453128 8A82861B0000            mov al, byte ptr [edx+00001B86]
:0045312E 0345FC                  add eax, dword ptr [ebp-04]
:00453131 50                      push eax
:00453132 E809070000              call 00453840
:00453137 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00453112(C)
|
:0045313A EB90                    jmp 004530CC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004530D9(C)
|
:0045313C E973FFFFFF              jmp 004530B4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004530C1(C)
|
:00453141 E9B4060000              jmp 004537FA
:00453146 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00453149 8A91871B0000            mov dl, byte ptr [ecx+00001B87]
:0045314F 52                      push edx
:00453150 8B45F0                  mov eax, dword ptr [ebp-10]
:00453153 33C9                    xor ecx, ecx
:00453155 8A88861B0000            mov cl, byte ptr [eax+00001B86]
:0045315B 83E902                  sub ecx, 00000002
:0045315E 51                      push ecx
:0045315F E8DC060000              call 00453840
:00453164 83C408                  add esp, 00000008
:00453167 8B55F0                  mov edx, dword ptr [ebp-10]
:0045316A 8A82871B0000            mov al, byte ptr [edx+00001B87]
:00453170 50                      push eax
:00453171 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00453174 33D2                    xor edx, edx
:00453176 8A91861B0000            mov dl, byte ptr [ecx+00001B86]
:0045317C 83C202                  add edx, 00000002
:0045317F 52                      push edx
:00453180 E8BB060000              call 00453840
:00453185 83C408                  add esp, 00000008
:00453188 8B45F0                  mov eax, dword ptr [ebp-10]
:0045318B 33C9                    xor ecx, ecx
:0045318D 8A88871B0000            mov cl, byte ptr [eax+00001B87]
:00453193 83E902                  sub ecx, 00000002
:00453196 51                      push ecx
:00453197 8B55F0                  mov edx, dword ptr [ebp-10]
:0045319A 8A82861B0000            mov al, byte ptr [edx+00001B86]
:004531A0 50                      push eax
:004531A1 E89A060000              call 00453840
:004531A6 83C408                  add esp, 00000008
:004531A9 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004531AC 33D2                    xor edx, edx
:004531AE 8A91871B0000            mov dl, byte ptr [ecx+00001B87]
:004531B4 83C202                  add edx, 00000002
:004531B7 52                      push edx
:004531B8 8B45F0                  mov eax, dword ptr [ebp-10]
:004531BB 8A88861B0000            mov cl, byte ptr [eax+00001B86]
:004531C1 51                      push ecx
:004531C2 E879060000              call 00453840
:004531C7 83C408                  add esp, 00000008
:004531CA E92B060000              jmp 004537FA
:004531CF E8A4070000              call 00453978
:004531D4 E921060000              jmp 004537FA
:004531D9 8B55F0                  mov edx, dword ptr [ebp-10]
:004531DC 668B82861B0000          mov ax, word ptr [edx+00001B86]
:004531E3 50                      push eax
:004531E4 E8B6060000              call 0045389F
:004531E9 83C404                  add esp, 00000004
:004531EC 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004531EF 668B91861B0000          mov dx, word ptr [ecx+00001B86]
:004531F6 52                      push edx
:004531F7 E817070000              call 00453913
:004531FC 83C404                  add esp, 00000004
:004531FF C745F400000000          mov [ebp-0C], 00000000
:00453206 EB09                    jmp 00453211

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045326B(U)
|
:00453208 8B45F4                  mov eax, dword ptr [ebp-0C]
:0045320B 83C001                  add eax, 00000001
:0045320E 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00453206(U)
|
:00453211 837DF403                cmp dword ptr [ebp-0C], 00000003
:00453215 7356                    jnb 0045326D
:00453217 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0045321A 33D2                    xor edx, edx
:0045321C 8A91871B0000            mov dl, byte ptr [ecx+00001B87]
:00453222 83EA02                  sub edx, 00000002
:00453225 52                      push edx
:00453226 8B45F0                  mov eax, dword ptr [ebp-10]
:00453229 33C9                    xor ecx, ecx
:0045322B 8A88861B0000            mov cl, byte ptr [eax+00001B86]
:00453231 8B55F4                  mov edx, dword ptr [ebp-0C]
:00453234 8D4411FF                lea eax, dword ptr [ecx+edx-01]
:00453238 50                      push eax
:00453239 E802060000              call 00453840
:0045323E 83C408                  add esp, 00000008
:00453241 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00453244 33D2                    xor edx, edx
:00453246 8A91871B0000            mov dl, byte ptr [ecx+00001B87]
:0045324C 83C202                  add edx, 00000002
:0045324F 52                      push edx
:00453250 8B45F0                  mov eax, dword ptr [ebp-10]
:00453253 33C9                    xor ecx, ecx
:00453255 8A88861B0000            mov cl, byte ptr [eax+00001B86]
:0045325B 8B55F4                  mov edx, dword ptr [ebp-0C]
:0045325E 8D4411FF                lea eax, dword ptr [ecx+edx-01]
:00453262 50                      push eax
:00453263 E8D8050000              call 00453840
:00453268 83C408                  add esp, 00000008
:0045326B EB9B                    jmp 00453208

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00453215(C)
|
:0045326D C745F400000000          mov [ebp-0C], 00000000
:00453274 EB09                    jmp 0045327F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004532D9(U)
|
:00453276 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00453279 83C101                  add ecx, 00000001
:0045327C 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00453274(U)
|
:0045327F 837DF403                cmp dword ptr [ebp-0C], 00000003
:00453283 7356                    jnb 004532DB
:00453285 8B55F0                  mov edx, dword ptr [ebp-10]
:00453288 33C0                    xor eax, eax
:0045328A 8A82871B0000            mov al, byte ptr [edx+00001B87]
:00453290 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00453293 8D5408FF                lea edx, dword ptr [eax+ecx-01]
:00453297 52                      push edx
:00453298 8B45F0                  mov eax, dword ptr [ebp-10]
:0045329B 33C9                    xor ecx, ecx
:0045329D 8A88861B0000            mov cl, byte ptr [eax+00001B86]
:004532A3 83C102                  add ecx, 00000002
:004532A6 51                      push ecx
:004532A7 E894050000              call 00453840
:004532AC 83C408                  add esp, 00000008
:004532AF 8B55F0                  mov edx, dword ptr [ebp-10]
:004532B2 33C0                    xor eax, eax
:004532B4 8A82871B0000            mov al, byte ptr [edx+00001B87]
:004532BA 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004532BD 8D5408FF                lea edx, dword ptr [eax+ecx-01]
:004532C1 52                      push edx
:004532C2 8B45F0                  mov eax, dword ptr [ebp-10]
:004532C5 33C9                    xor ecx, ecx
:004532C7 8A88861B0000            mov cl, byte ptr [eax+00001B86]
:004532CD 83E902                  sub ecx, 00000002
:004532D0 51                      push ecx
:004532D1 E86A050000              call 00453840
:004532D6 83C408                  add esp, 00000008
:004532D9 EB9B                    jmp 00453276

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00453283(C)
|
:004532DB 8B55F0                  mov edx, dword ptr [ebp-10]
:004532DE 8A82871B0000            mov al, byte ptr [edx+00001B87]
:004532E4 50                      push eax
:004532E5 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004532E8 33D2                    xor edx, edx
:004532EA 8A91861B0000            mov dl, byte ptr [ecx+00001B86]
:004532F0 83EA03                  sub edx, 00000003
:004532F3 52                      push edx
:004532F4 E847050000              call 00453840
:004532F9 83C408                  add esp, 00000008
:004532FC 8B45F0                  mov eax, dword ptr [ebp-10]
:004532FF 8A88871B0000            mov cl, byte ptr [eax+00001B87]
:00453305 51                      push ecx
:00453306 8B55F0                  mov edx, dword ptr [ebp-10]
:00453309 33C0                    xor eax, eax
:0045330B 8A82861B0000            mov al, byte ptr [edx+00001B86]
:00453311 83C003                  add eax, 00000003
:00453314 50                      push eax
:00453315 E826050000              call 00453840
:0045331A 83C408                  add esp, 00000008
:0045331D 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00453320 33D2                    xor edx, edx
:00453322 8A91871B0000            mov dl, byte ptr [ecx+00001B87]
:00453328 83EA03                  sub edx, 00000003
:0045332B 52                      push edx
:0045332C 8B45F0                  mov eax, dword ptr [ebp-10]
:0045332F 8A88861B0000            mov cl, byte ptr [eax+00001B86]
:00453335 51                      push ecx
:00453336 E805050000              call 00453840
:0045333B 83C408                  add esp, 00000008
:0045333E 8B55F0                  mov edx, dword ptr [ebp-10]
:00453341 33C0                    xor eax, eax
:00453343 8A82871B0000            mov al, byte ptr [edx+00001B87]
:00453349 83C003                  add eax, 00000003
:0045334C 50                      push eax
:0045334D 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00453350 8A91861B0000            mov dl, byte ptr [ecx+00001B86]
:00453356 52                      push edx
:00453357 E8E4040000              call 00453840
:0045335C 83C408                  add esp, 00000008
:0045335F E996040000              jmp 004537FA
:00453364 8B45F0                  mov eax, dword ptr [ebp-10]
:00453367 668B88861B0000          mov cx, word ptr [eax+00001B86]
:0045336E 51                      push ecx
:0045336F E82B050000              call 0045389F
:00453374 83C404                  add esp, 00000004
:00453377 8B55F0                  mov edx, dword ptr [ebp-10]
:0045337A 668B82861B0000          mov ax, word ptr [edx+00001B86]
:00453381 50                      push eax
:00453382 E88C050000              call 00453913
:00453387 83C404                  add esp, 00000004
:0045338A C745F400000000          mov [ebp-0C], 00000000
:00453391 EB09                    jmp 0045339C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004533F6(U)
|
:00453393 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00453396 83C101                  add ecx, 00000001
:00453399 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00453391(U)
|
:0045339C 837DF403                cmp dword ptr [ebp-0C], 00000003
:004533A0 7356                    jnb 004533F8
:004533A2 8B55F0                  mov edx, dword ptr [ebp-10]
:004533A5 33C0                    xor eax, eax
:004533A7 8A82871B0000            mov al, byte ptr [edx+00001B87]
:004533AD 83E802                  sub eax, 00000002
:004533B0 50                      push eax
:004533B1 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004533B4 33D2                    xor edx, edx
:004533B6 8A91861B0000            mov dl, byte ptr [ecx+00001B86]
:004533BC 8B45F4                  mov eax, dword ptr [ebp-0C]
:004533BF 8D4C02FF                lea ecx, dword ptr [edx+eax-01]
:004533C3 51                      push ecx
:004533C4 E877040000              call 00453840
:004533C9 83C408                  add esp, 00000008
:004533CC 8B55F0                  mov edx, dword ptr [ebp-10]
:004533CF 33C0                    xor eax, eax
:004533D1 8A82871B0000            mov al, byte ptr [edx+00001B87]
:004533D7 83C002                  add eax, 00000002
:004533DA 50                      push eax
:004533DB 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004533DE 33D2                    xor edx, edx
:004533E0 8A91861B0000            mov dl, byte ptr [ecx+00001B86]
:004533E6 8B45F4                  mov eax, dword ptr [ebp-0C]
:004533E9 8D4C02FF                lea ecx, dword ptr [edx+eax-01]
:004533ED 51                      push ecx
:004533EE E84D040000              call 00453840
:004533F3 83C408                  add esp, 00000008
:004533F6 EB9B                    jmp 00453393

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004533A0(C)
|
:004533F8 C745F400000000          mov [ebp-0C], 00000000
:004533FF EB09                    jmp 0045340A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00453464(U)
|
:00453401 8B55F4                  mov edx, dword ptr [ebp-0C]
:00453404 83C201                  add edx, 00000001
:00453407 8955F4                  mov dword ptr [ebp-0C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004533FF(U)
|
:0045340A 837DF403                cmp dword ptr [ebp-0C], 00000003
:0045340E 7356                    jnb 00453466
:00453410 8B45F0                  mov eax, dword ptr [ebp-10]
:00453413 33C9                    xor ecx, ecx
:00453415 8A88871B0000            mov cl, byte ptr [eax+00001B87]
:0045341B 8B55F4                  mov edx, dword ptr [ebp-0C]
:0045341E 8D4411FF                lea eax, dword ptr [ecx+edx-01]
:00453422 50                      push eax
:00453423 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00453426 33D2                    xor edx, edx
:00453428 8A91861B0000            mov dl, byte ptr [ecx+00001B86]
:0045342E 83C202                  add edx, 00000002
:00453431 52                      push edx
:00453432 E809040000              call 00453840
:00453437 83C408                  add esp, 00000008
:0045343A 8B45F0                  mov eax, dword ptr [ebp-10]
:0045343D 33C9                    xor ecx, ecx
:0045343F 8A88871B0000            mov cl, byte ptr [eax+00001B87]
:00453445 8B55F4                  mov edx, dword ptr [ebp-0C]
:00453448 8D4411FF                lea eax, dword ptr [ecx+edx-01]
:0045344C 50                      push eax
:0045344D 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00453450 33D2                    xor edx, edx
:00453452 8A91861B0000            mov dl, byte ptr [ecx+00001B86]
:00453458 83EA02                  sub edx, 00000002
:0045345B 52                      push edx
:0045345C E8DF030000              call 00453840
:00453461 83C408                  add esp, 00000008
:00453464 EB9B                    jmp 00453401

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045340E(C)
|
:00453466 C745F400000000          mov [ebp-0C], 00000000
:0045346D EB09                    jmp 00453478

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004534D2(U)
|
:0045346F 8B45F4                  mov eax, dword ptr [ebp-0C]
:00453472 83C001                  add eax, 00000001
:00453475 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045346D(U)
|
:00453478 837DF403                cmp dword ptr [ebp-0C], 00000003
:0045347C 7356                    jnb 004534D4
:0045347E 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00453481 33D2                    xor edx, edx
:00453483 8A91871B0000            mov dl, byte ptr [ecx+00001B87]
:00453489 83EA03                  sub edx, 00000003
:0045348C 52                      push edx
:0045348D 8B45F0                  mov eax, dword ptr [ebp-10]
:00453490 33C9                    xor ecx, ecx
:00453492 8A88861B0000            mov cl, byte ptr [eax+00001B86]
:00453498 8B55F4                  mov edx, dword ptr [ebp-0C]
:0045349B 8D4411FF                lea eax, dword ptr [ecx+edx-01]
:0045349F 50                      push eax
:004534A0 E89B030000              call 00453840
:004534A5 83C408                  add esp, 00000008
:004534A8 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004534AB 33D2                    xor edx, edx
:004534AD 8A91871B0000            mov dl, byte ptr [ecx+00001B87]
:004534B3 83C203                  add edx, 00000003
:004534B6 52                      push edx
:004534B7 8B45F0                  mov eax, dword ptr [ebp-10]
:004534BA 33C9                    xor ecx, ecx
:004534BC 8A88861B0000            mov cl, byte ptr [eax+00001B86]
:004534C2 8B55F4                  mov edx, dword ptr [ebp-0C]
:004534C5 8D4411FF                lea eax, dword ptr [ecx+edx-01]
:004534C9 50                      push eax
:004534CA E871030000              call 00453840
:004534CF 83C408                  add esp, 00000008
:004534D2 EB9B                    jmp 0045346F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045347C(C)
|
:004534D4 C745F400000000          mov [ebp-0C], 00000000
:004534DB EB09                    jmp 004534E6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00453540(U)
|
:004534DD 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004534E0 83C101                  add ecx, 00000001
:004534E3 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004534DB(U)
|
:004534E6 837DF403                cmp dword ptr [ebp-0C], 00000003
:004534EA 7356                    jnb 00453542
:004534EC 8B55F0                  mov edx, dword ptr [ebp-10]
:004534EF 33C0                    xor eax, eax
:004534F1 8A82871B0000            mov al, byte ptr [edx+00001B87]
:004534F7 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004534FA 8D5408FF                lea edx, dword ptr [eax+ecx-01]
:004534FE 52                      push edx
:004534FF 8B45F0                  mov eax, dword ptr [ebp-10]
:00453502 33C9                    xor ecx, ecx
:00453504 8A88861B0000            mov cl, byte ptr [eax+00001B86]
:0045350A 83C103                  add ecx, 00000003
:0045350D 51                      push ecx
:0045350E E82D030000              call 00453840
:00453513 83C408                  add esp, 00000008
:00453516 8B55F0                  mov edx, dword ptr [ebp-10]
:00453519 33C0                    xor eax, eax
:0045351B 8A82871B0000            mov al, byte ptr [edx+00001B87]
:00453521 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00453524 8D5408FF                lea edx, dword ptr [eax+ecx-01]
:00453528 52                      push edx
:00453529 8B45F0                  mov eax, dword ptr [ebp-10]
:0045352C 33C9                    xor ecx, ecx
:0045352E 8A88861B0000            mov cl, byte ptr [eax+00001B86]
:00453534 83E903                  sub ecx, 00000003
:00453537 51                      push ecx
:00453538 E803030000              call 00453840
:0045353D 83C408                  add esp, 00000008
:00453540 EB9B                    jmp 004534DD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004534EA(C)
|
:00453542 8B55F0                  mov edx, dword ptr [ebp-10]
:00453545 33C0                    xor eax, eax
:00453547 8A82871B0000            mov al, byte ptr [edx+00001B87]
:0045354D 83E802                  sub eax, 00000002
:00453550 50                      push eax
:00453551 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00453554 33D2                    xor edx, edx
:00453556 8A91861B0000            mov dl, byte ptr [ecx+00001B86]
:0045355C 83EA02                  sub edx, 00000002
:0045355F 52                      push edx
:00453560 E8DB020000              call 00453840
:00453565 83C408                  add esp, 00000008
:00453568 8B45F0                  mov eax, dword ptr [ebp-10]
:0045356B 33C9                    xor ecx, ecx
:0045356D 8A88871B0000            mov cl, byte ptr [eax+00001B87]
:00453573 83C102                  add ecx, 00000002
:00453576 51                      push ecx
:00453577 8B55F0                  mov edx, dword ptr [ebp-10]
:0045357A 33C0                    xor eax, eax
:0045357C 8A82861B0000            mov al, byte ptr [edx+00001B86]
:00453582 83C002                  add eax, 00000002
:00453585 50                      push eax
:00453586 E8B5020000              call 00453840
:0045358B 83C408                  add esp, 00000008
:0045358E 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00453591 33D2                    xor edx, edx
:00453593 8A91871B0000            mov dl, byte ptr [ecx+00001B87]
:00453599 83EA02                  sub edx, 00000002
:0045359C 52                      push edx
:0045359D 8B45F0                  mov eax, dword ptr [ebp-10]
:004535A0 33C9                    xor ecx, ecx
:004535A2 8A88861B0000            mov cl, byte ptr [eax+00001B86]
:004535A8 83C102                  add ecx, 00000002
:004535AB 51                      push ecx
:004535AC E88F020000              call 00453840
:004535B1 83C408                  add esp, 00000008
:004535B4 8B55F0                  mov edx, dword ptr [ebp-10]
:004535B7 33C0                    xor eax, eax
:004535B9 8A82871B0000            mov al, byte ptr [edx+00001B87]
:004535BF 83C002                  add eax, 00000002
:004535C2 50                      push eax
:004535C3 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004535C6 33D2                    xor edx, edx
:004535C8 8A91861B0000            mov dl, byte ptr [ecx+00001B86]
:004535CE 83EA02                  sub edx, 00000002
:004535D1 52                      push edx
:004535D2 E869020000              call 00453840
:004535D7 83C408                  add esp, 00000008
:004535DA 8B45F0                  mov eax, dword ptr [ebp-10]
:004535DD 8A88871B0000            mov cl, byte ptr [eax+00001B87]
:004535E3 51                      push ecx
:004535E4 8B55F0                  mov edx, dword ptr [ebp-10]
:004535E7 33C0                    xor eax, eax
:004535E9 8A82861B0000            mov al, byte ptr [edx+00001B86]
:004535EF 83E804                  sub eax, 00000004
:004535F2 50                      push eax
:004535F3 E848020000              call 00453840
:004535F8 83C408                  add esp, 00000008
:004535FB 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004535FE 8A91871B0000            mov dl, byte ptr [ecx+00001B87]
:00453604 52                      push edx
:00453605 8B45F0                  mov eax, dword ptr [ebp-10]
:00453608 33C9                    xor ecx, ecx
:0045360A 8A88861B0000            mov cl, byte ptr [eax+00001B86]
:00453610 83C104                  add ecx, 00000004
:00453613 51                      push ecx
:00453614 E827020000              call 00453840
:00453619 83C408                  add esp, 00000008
:0045361C 8B55F0                  mov edx, dword ptr [ebp-10]
:0045361F 33C0                    xor eax, eax
:00453621 8A82871B0000            mov al, byte ptr [edx+00001B87]
:00453627 83E804                  sub eax, 00000004
:0045362A 50                      push eax
:0045362B 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0045362E 8A91861B0000            mov dl, byte ptr [ecx+00001B86]
:00453634 52                      push edx
:00453635 E806020000              call 00453840
:0045363A 83C408                  add esp, 00000008
:0045363D 8B45F0                  mov eax, dword ptr [ebp-10]
:00453640 33C9                    xor ecx, ecx
:00453642 8A88871B0000            mov cl, byte ptr [eax+00001B87]
:00453648 83C104                  add ecx, 00000004
:0045364B 51                      push ecx
:0045364C 8B55F0                  mov edx, dword ptr [ebp-10]
:0045364F 8A82861B0000            mov al, byte ptr [edx+00001B86]
:00453655 50                      push eax
:00453656 E8E5010000              call 00453840
:0045365B 83C408                  add esp, 00000008
:0045365E E997010000              jmp 004537FA
:00453663 C745F400000000          mov [ebp-0C], 00000000
:0045366A EB09                    jmp 00453675

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00453727(U)
|
:0045366C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0045366F 83C101                  add ecx, 00000001
:00453672 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045366A(U)
|
:00453675 837DF403                cmp dword ptr [ebp-0C], 00000003
:00453679 0F83AD000000            jnb 0045372C
:0045367F 8B55F0                  mov edx, dword ptr [ebp-10]
:00453682 33C0                    xor eax, eax
:00453684 8A82871B0000            mov al, byte ptr [edx+00001B87]
:0045368A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0045368D 8D5408FF                lea edx, dword ptr [eax+ecx-01]
:00453691 52                      push edx
:00453692 8B45F0                  mov eax, dword ptr [ebp-10]
:00453695 33C9                    xor ecx, ecx
:00453697 8A88861B0000            mov cl, byte ptr [eax+00001B86]
:0045369D 83E903                  sub ecx, 00000003
:004536A0 51                      push ecx
:004536A1 E89A010000              call 00453840
:004536A6 83C408                  add esp, 00000008
:004536A9 8B55F0                  mov edx, dword ptr [ebp-10]
:004536AC 33C0                    xor eax, eax
:004536AE 8A82871B0000            mov al, byte ptr [edx+00001B87]
:004536B4 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004536B7 8D5408FF                lea edx, dword ptr [eax+ecx-01]
:004536BB 52                      push edx
:004536BC 8B45F0                  mov eax, dword ptr [ebp-10]
:004536BF 33C9                    xor ecx, ecx
:004536C1 8A88861B0000            mov cl, byte ptr [eax+00001B86]
:004536C7 83C103                  add ecx, 00000003
:004536CA 51                      push ecx
:004536CB E870010000              call 00453840
:004536D0 83C408                  add esp, 00000008
:004536D3 8B55F0                  mov edx, dword ptr [ebp-10]
:004536D6 33C0                    xor eax, eax
:004536D8 8A82871B0000            mov al, byte ptr [edx+00001B87]
:004536DE 83E803                  sub eax, 00000003
:004536E1 50                      push eax
:004536E2 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004536E5 33D2                    xor edx, edx
:004536E7 8A91861B0000            mov dl, byte ptr [ecx+00001B86]
:004536ED 8B45F4                  mov eax, dword ptr [ebp-0C]
:004536F0 8D4C02FF                lea ecx, dword ptr [edx+eax-01]
:004536F4 51                      push ecx
:004536F5 E846010000              call 00453840
:004536FA 83C408                  add esp, 00000008
:004536FD 8B55F0                  mov edx, dword ptr [ebp-10]
:00453700 33C0                    xor eax, eax
:00453702 8A82871B0000            mov al, byte ptr [edx+00001B87]
:00453708 83C003                  add eax, 00000003
:0045370B 50                      push eax
:0045370C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0045370F 33D2                    xor edx, edx
:00453711 8A91861B0000            mov dl, byte ptr [ecx+00001B86]
:00453717 8B45F4                  mov eax, dword ptr [ebp-0C]
:0045371A 8D4C02FF                lea ecx, dword ptr [edx+eax-01]
:0045371E 51                      push ecx
:0045371F E81C010000              call 00453840
:00453724 83C408                  add esp, 00000008
:00453727 E940FFFFFF              jmp 0045366C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00453679(C)
|
:0045372C E9C9000000              jmp 004537FA
:00453731 C745F400000000          mov [ebp-0C], 00000000
:00453738 EB09                    jmp 00453743

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004537F5(U)
|
:0045373A 8B55F4                  mov edx, dword ptr [ebp-0C]
:0045373D 83C201                  add edx, 00000001
:00453740 8955F4                  mov dword ptr [ebp-0C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00453738(U)
|
:00453743 837DF405                cmp dword ptr [ebp-0C], 00000005
:00453747 0F83AD000000            jnb 004537FA
:0045374D 8B45F0                  mov eax, dword ptr [ebp-10]
:00453750 33C9                    xor ecx, ecx
:00453752 8A88871B0000            mov cl, byte ptr [eax+00001B87]
:00453758 83E903                  sub ecx, 00000003
:0045375B 51                      push ecx
:0045375C 8B55F0                  mov edx, dword ptr [ebp-10]
:0045375F 33C0                    xor eax, eax
:00453761 8A82861B0000            mov al, byte ptr [edx+00001B86]
:00453767 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0045376A 8D5408FE                lea edx, dword ptr [eax+ecx-02]
:0045376E 52                      push edx
:0045376F E8CC000000              call 00453840
:00453774 83C408                  add esp, 00000008
:00453777 8B45F0                  mov eax, dword ptr [ebp-10]
:0045377A 33C9                    xor ecx, ecx
:0045377C 8A88871B0000            mov cl, byte ptr [eax+00001B87]
:00453782 83C103                  add ecx, 00000003
:00453785 51                      push ecx
:00453786 8B55F0                  mov edx, dword ptr [ebp-10]
:00453789 33C0                    xor eax, eax
:0045378B 8A82861B0000            mov al, byte ptr [edx+00001B86]
:00453791 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00453794 8D5408FE                lea edx, dword ptr [eax+ecx-02]
:00453798 52                      push edx
:00453799 E8A2000000              call 00453840
:0045379E 83C408                  add esp, 00000008
:004537A1 8B45F0                  mov eax, dword ptr [ebp-10]
:004537A4 33C9                    xor ecx, ecx
:004537A6 8A88871B0000            mov cl, byte ptr [eax+00001B87]
:004537AC 8B55F4                  mov edx, dword ptr [ebp-0C]
:004537AF 8D4411FE                lea eax, dword ptr [ecx+edx-02]
:004537B3 50                      push eax
:004537B4 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004537B7 33D2                    xor edx, edx
:004537B9 8A91861B0000            mov dl, byte ptr [ecx+00001B86]
:004537BF 83EA03                  sub edx, 00000003
:004537C2 52                      push edx
:004537C3 E878000000              call 00453840
:004537C8 83C408                  add esp, 00000008
:004537CB 8B45F0                  mov eax, dword ptr [ebp-10]
:004537CE 33C9                    xor ecx, ecx
:004537D0 8A88871B0000            mov cl, byte ptr [eax+00001B87]
:004537D6 8B55F4                  mov edx, dword ptr [ebp-0C]
:004537D9 8D4411FE                lea eax, dword ptr [ecx+edx-02]
:004537DD 50                      push eax
:004537DE 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004537E1 33D2                    xor edx, edx
:004537E3 8A91861B0000            mov dl, byte ptr [ecx+00001B86]
:004537E9 83C203                  add edx, 00000003
:004537EC 52                      push edx
:004537ED E84E000000              call 00453840
:004537F2 83C408                  add esp, 00000008
:004537F5 E940FFFFFF              jmp 0045373A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004528DC(C), :004528FF(U), :0045292A(U), :004529C6(U), :00452B3E(U)
|:00452E2A(U), :00452EC6(U), :00452F75(U), :00453010(U), :00453141(U)
|:004531CA(U), :004531D4(U), :0045335F(U), :0045365E(U), :0045372C(U)
|:00453747(C)
|
:004537FA 8BE5                    mov esp, ebp
:004537FC 5D                      pop ebp
:004537FD C20400                  ret 0004



:00453800 EC284500                DWORD 004528EC
:00453804 04294500                DWORD 00452904
:00453808 2F294500                DWORD 0045292F
:0045380C CB294500                DWORD 004529CB
:00453810 432B4500                DWORD 00452B43
:00453814 2F2E4500                DWORD 00452E2F
:00453818 CB2E4500                DWORD 00452ECB
:0045381C 7A2F4500                DWORD 00452F7A
:00453820 15304500                DWORD 00453015
:00453824 46314500                DWORD 00453146
:00453828 CF314500                DWORD 004531CF
:0045382C FA374500                DWORD 004537FA
:00453830 D9314500                DWORD 004531D9
:00453834 64334500                DWORD 00453364
:00453838 63364500                DWORD 00453663
:0045383C 31374500                DWORD 00453731



* Referenced by a CALL at Addresses:
|:004528C2   , :0045295B   , :0045297C   , :0045299D   , :004529BE   
|:00452A18   , :00452A42   , :00452A86   , :00452AB0   , :00452AD3   
|:00452AF4   , :00452B15   , :00452B36   , :00452B90   , :00452BBA   
|:00452BFE   , :00452C28   , :00452C6C   , :00452C96   , :00452CDA   
|:00452D04   , :00452D2C   , :00452D52   , :00452D78   , :00452D9E   
|:00452DBF   , :00452DE0   , :00452E01   , :00452E22   , :00452E5B   
|:00452E7C   , :00452E9D   , :00452EBE   , :00452F0A   , :00452F2B   
|:00452F4C   , :00452F6D   , :00453001   , :0045309C   , :00453132   
|:0045315F   , :00453180   , :004531A1   , :004531C2   , :00453239   
|:00453263   , :004532A7   , :004532D1   , :004532F4   , :00453315   
|:00453336   , :00453357   , :004533C4   , :004533EE   , :00453432   
|:0045345C   , :004534A0   , :004534CA   , :0045350E   , :00453538   
|:00453560   , :00453586   , :004535AC   , :004535D2   , :004535F3   
|:00453614   , :00453635   , :00453656   , :004536A1   , :004536CB   
|:004536F5   , :0045371F   , :0045376F   , :00453799   , :004537C3   
|:004537ED   , :00453905   , :0045396A   , :004539CC   
|
:00453840 55                      push ebp
:00453841 8BEC                    mov ebp, esp
:00453843 8B4508                  mov eax, dword ptr [ebp+08]
:00453846 25FF000000              and eax, 000000FF
:0045384B 33C9                    xor ecx, ecx
:0045384D 8A0D2C424B00            mov cl, byte ptr [004B422C]
:00453853 3BC1                    cmp eax, ecx
:00453855 7D14                    jge 0045386B
:00453857 8B550C                  mov edx, dword ptr [ebp+0C]
:0045385A 81E2FF000000            and edx, 000000FF
:00453860 33C0                    xor eax, eax
:00453862 A02D424B00              mov al, byte ptr [004B422D]
:00453867 3BD0                    cmp edx, eax
:00453869 7C02                    jl 0045386D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00453855(C)
|
:0045386B EB30                    jmp 0045389D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00453869(C)
|
:0045386D 6A04                    push 00000004
:0045386F 6A00                    push 00000000
:00453871 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00453874 81E1FF000000            and ecx, 000000FF
:0045387A 33D2                    xor edx, edx
:0045387C 8A152C424B00            mov dl, byte ptr [004B422C]
:00453882 0FAFCA                  imul ecx, edx
:00453885 8B4508                  mov eax, dword ptr [ebp+08]
:00453888 25FF000000              and eax, 000000FF
:0045388D 03C8                    add ecx, eax
:0045388F 51                      push ecx
:00453890 B9A8F44A00              mov ecx, 004AF4A8
:00453895 E8A6C10200              call 0047FA40
:0045389A C60001                  mov byte ptr [eax], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045386B(U)
|
:0045389D 5D                      pop ebp
:0045389E C3                      ret



* Referenced by a CALL at Addresses:
|:004528F7   , :0045290F   , :00452E3A   , :00452ED6   , :004531E4   
|:0045336F   
|
:0045389F 55                      push ebp
:004538A0 8BEC                    mov ebp, esp
:004538A2 83EC08                  sub esp, 00000008
:004538A5 68FF000000              push 000000FF
:004538AA 68FF000000              push 000000FF
:004538AF 8D4DFC                  lea ecx, dword ptr [ebp-04]
:004538B2 E81954FCFF              call 00418CD0
:004538B7 C645F800                mov [ebp-08], 00
:004538BB EB08                    jmp 004538C5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045390D(U)
|
:004538BD 8A45F8                  mov al, byte ptr [ebp-08]
:004538C0 0401                    add al, 01
:004538C2 8845F8                  mov byte ptr [ebp-08], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004538BB(U)
|
:004538C5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004538C8 81E1FF000000            and ecx, 000000FF
:004538CE 83F904                  cmp ecx, 00000004
:004538D1 7D3C                    jge 0045390F
:004538D3 8A55F8                  mov dl, byte ptr [ebp-08]
:004538D6 52                      push edx
:004538D7 8D4508                  lea eax, dword ptr [ebp+08]
:004538DA 50                      push eax
:004538DB E81521FEFF              call 004359F5
:004538E0 83C408                  add esp, 00000008
:004538E3 50                      push eax
:004538E4 8D4DFC                  lea ecx, dword ptr [ebp-04]
:004538E7 E8B42CFBFF              call 004065A0
:004538EC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004538EF 81E1FF000000            and ecx, 000000FF
:004538F5 81F9FF000000            cmp ecx, 000000FF
:004538FB 7410                    je 0045390D
:004538FD 8A55FD                  mov dl, byte ptr [ebp-03]
:00453900 52                      push edx
:00453901 8A45FC                  mov al, byte ptr [ebp-04]
:00453904 50                      push eax
:00453905 E836FFFFFF              call 00453840
:0045390A 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004538FB(C)
|
:0045390D EBAE                    jmp 004538BD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004538D1(C)
|
:0045390F 8BE5                    mov esp, ebp
:00453911 5D                      pop ebp
:00453912 C3                      ret



* Referenced by a CALL at Addresses:
|:00452922   , :0045293A   , :004529D6   , :00452B4E   , :00452EE9   
|:004531F7   , :00453382   
|
:00453913 55                      push ebp
:00453914 8BEC                    mov ebp, esp
:00453916 51                      push ecx
:00453917 C645FC00                mov [ebp-04], 00
:0045391B EB08                    jmp 00453925

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00453972(U)
|
:0045391D 8A45FC                  mov al, byte ptr [ebp-04]
:00453920 0401                    add al, 01
:00453922 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045391B(U)
|
:00453925 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00453928 81E1FF000000            and ecx, 000000FF
:0045392E 83F904                  cmp ecx, 00000004
:00453931 7D41                    jge 00453974
:00453933 8B5509                  mov edx, dword ptr [ebp+09]
:00453936 81E2FF000000            and edx, 000000FF
:0045393C 8B45FC                  mov eax, dword ptr [ebp-04]
:0045393F 25FF000000              and eax, 000000FF
:00453944 D1E0                    shl eax, 1
:00453946 03148554E24800          add edx, dword ptr [4*eax+0048E254]
:0045394D 52                      push edx
:0045394E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00453951 81E1FF000000            and ecx, 000000FF
:00453957 8B55FC                  mov edx, dword ptr [ebp-04]
:0045395A 81E2FF000000            and edx, 000000FF
:00453960 D1E2                    shl edx, 1
:00453962 030C9550E24800          add ecx, dword ptr [4*edx+0048E250]
:00453969 51                      push ecx
:0045396A E8D1FEFFFF              call 00453840
:0045396F 83C408                  add esp, 00000008
:00453972 EBA9                    jmp 0045391D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00453931(C)
|
:00453974 8BE5                    mov esp, ebp
:00453976 5D                      pop ebp
:00453977 C3                      ret



* Referenced by a CALL at Address:
|:004531CF   
|
:00453978 55                      push ebp
:00453979 8BEC                    mov ebp, esp
:0045397B 83EC08                  sub esp, 00000008
:0045397E C645F800                mov [ebp-08], 00
:00453982 EB08                    jmp 0045398C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004539D6(U)
|
:00453984 8A45F8                  mov al, byte ptr [ebp-08]
:00453987 0401                    add al, 01
:00453989 8845F8                  mov byte ptr [ebp-08], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00453982(U)
|
:0045398C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045398F 81E1FF000000            and ecx, 000000FF
:00453995 33D2                    xor edx, edx
:00453997 8A152D424B00            mov dl, byte ptr [004B422D]
:0045399D 3BCA                    cmp ecx, edx
:0045399F 7D37                    jge 004539D8
:004539A1 C645FC00                mov [ebp-04], 00
:004539A5 EB08                    jmp 004539AF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004539D4(U)
|
:004539A7 8A45FC                  mov al, byte ptr [ebp-04]
:004539AA 0401                    add al, 01
:004539AC 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004539A5(U)
|
:004539AF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004539B2 81E1FF000000            and ecx, 000000FF
:004539B8 33D2                    xor edx, edx
:004539BA 8A152C424B00            mov dl, byte ptr [004B422C]
:004539C0 3BCA                    cmp ecx, edx
:004539C2 7D12                    jge 004539D6
:004539C4 8A45F8                  mov al, byte ptr [ebp-08]
:004539C7 50                      push eax
:004539C8 8A4DFC                  mov cl, byte ptr [ebp-04]
:004539CB 51                      push ecx
:004539CC E86FFEFFFF              call 00453840
:004539D1 83C408                  add esp, 00000008
:004539D4 EBD1                    jmp 004539A7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004539C2(C)
|
:004539D6 EBAC                    jmp 00453984

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045399F(C)
|
:004539D8 8BE5                    mov esp, ebp
:004539DA 5D                      pop ebp
:004539DB C3                      ret



* Referenced by a CALL at Addresses:
|:00433A46   , :00433B2A   , :00433D2B   , :00433E6C   , :00434004   
|:00434085   , :0043D662   , :0043D9AE   , :00441540   , :0044158E   
|:00441649   , :00441709   , :0045545A   , :004556B8   
|
:004539DC 55                      push ebp
:004539DD 8BEC                    mov ebp, esp
:004539DF 51                      push ecx
:004539E0 894DFC                  mov dword ptr [ebp-04], ecx
:004539E3 8B45FC                  mov eax, dword ptr [ebp-04]
:004539E6 8A4D0C                  mov cl, byte ptr [ebp+0C]
:004539E9 8888851B0000            mov byte ptr [eax+00001B85], cl
:004539EF 8D5508                  lea edx, dword ptr [ebp+08]
:004539F2 52                      push edx
:004539F3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004539F6 81C1861B0000            add ecx, 00001B86
:004539FC E89F2BFBFF              call 004065A0
:00453A01 6A00                    push 00000000
:00453A03 6840060000              push 00000640
:00453A08 B9A8F44A00              mov ecx, 004AF4A8
:00453A0D E87EA6FBFF              call 0040E090
:00453A12 50                      push eax
:00453A13 E8FBC20200              call 0047FD13
:00453A18 83C40C                  add esp, 0000000C
:00453A1B 8B45FC                  mov eax, dword ptr [ebp-04]
:00453A1E 33C9                    xor ecx, ecx
:00453A20 8A88851B0000            mov cl, byte ptr [eax+00001B85]
:00453A26 81F9FF000000            cmp ecx, 000000FF
:00453A2C 740C                    je 00453A3A
:00453A2E 8B5510                  mov edx, dword ptr [ebp+10]
:00453A31 52                      push edx
:00453A32 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00453A35 E85EEEFFFF              call 00452898

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00453A2C(C)
|
:00453A3A 8BE5                    mov esp, ebp
:00453A3C 5D                      pop ebp
:00453A3D C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:00416F5C   , :00416F93   , :004415B8   , :00441673   
|
:00453A40 55                      push ebp
:00453A41 8BEC                    mov ebp, esp
:00453A43 83EC08                  sub esp, 00000008
:00453A46 894DF8                  mov dword ptr [ebp-08], ecx
:00453A49 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00453A4C E8BFBC0000              call 0045F710
:00453A51 6A00                    push 00000000
:00453A53 6840060000              push 00000640
:00453A58 B9A8F44A00              mov ecx, 004AF4A8
:00453A5D E82EA6FBFF              call 0040E090
:00453A62 50                      push eax
:00453A63 E8ABC20200              call 0047FD13
:00453A68 83C40C                  add esp, 0000000C
:00453A6B 8B4508                  mov eax, dword ptr [ebp+08]
:00453A6E 25FF000000              and eax, 000000FF
:00453A73 3DFF000000              cmp eax, 000000FF
:00453A78 750F                    jne 00453A89
:00453A7A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00453A7D C681851B0000FF          mov byte ptr [ecx+00001B85], FF
:00453A84 E984000000              jmp 00453B0D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00453A78(C)
|
:00453A89 8B55F8                  mov edx, dword ptr [ebp-08]
:00453A8C C682851B000000          mov byte ptr [edx+00001B85], 00
:00453A93 8B4D08                  mov ecx, dword ptr [ebp+08]
:00453A96 81E1FF000000            and ecx, 000000FF
:00453A9C 6BC924                  imul ecx, 00000024
:00453A9F 81C1502C4B00            add ecx, 004B2C50
:00453AA5 E8B6F8FAFF              call 00403360
:00453AAA 50                      push eax
:00453AAB 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00453AAE E8ED2AFBFF              call 004065A0
:00453AB3 8B45FC                  mov eax, dword ptr [ebp-04]
:00453AB6 25FF000000              and eax, 000000FF
:00453ABB 33C9                    xor ecx, ecx
:00453ABD 8A0D2C424B00            mov cl, byte ptr [004B422C]
:00453AC3 3BC1                    cmp eax, ecx
:00453AC5 7D14                    jge 00453ADB
:00453AC7 8B55FD                  mov edx, dword ptr [ebp-03]
:00453ACA 81E2FF000000            and edx, 000000FF
:00453AD0 33C0                    xor eax, eax
:00453AD2 A02D424B00              mov al, byte ptr [004B422D]
:00453AD7 3BD0                    cmp edx, eax
:00453AD9 7C02                    jl 00453ADD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00453AC5(C)
|
:00453ADB EB30                    jmp 00453B0D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00453AD9(C)
|
:00453ADD 6A04                    push 00000004
:00453ADF 6A00                    push 00000000
:00453AE1 8B4DFD                  mov ecx, dword ptr [ebp-03]
:00453AE4 81E1FF000000            and ecx, 000000FF
:00453AEA 33D2                    xor edx, edx
:00453AEC 8A152C424B00            mov dl, byte ptr [004B422C]
:00453AF2 0FAFCA                  imul ecx, edx
:00453AF5 8B45FC                  mov eax, dword ptr [ebp-04]
:00453AF8 25FF000000              and eax, 000000FF
:00453AFD 03C8                    add ecx, eax
:00453AFF 51                      push ecx
:00453B00 B9A8F44A00              mov ecx, 004AF4A8
:00453B05 E836BF0200              call 0047FA40
:00453B0A C60001                  mov byte ptr [eax], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00453A84(U), :00453ADB(U)
|
:00453B0D 8BE5                    mov esp, ebp
:00453B0F 5D                      pop ebp
:00453B10 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00416301   , :00422506   , :00424AB4   , :00433A5A   , :00433B34   
|:00433D3F   , :00433E76   , :00433F03   , :0043400E   , :0043409F   
|:00434517   , :0043AD13   , :0043D66C   , :0043D9B8   , :0043DC18   
|:004416B6   , :00441713   , :00449923   , :0044B100   , :0044BAB7   
|:0044BD1E   , :0044C17D   , :0044D38E   , :0044D9F1   , :0044E247   
|:004542CC   , :00454CC5   , :00455462   , :004556C8   , :00455D2B   
|:0045972A   
|
:00453B13 55                      push ebp
:00453B14 8BEC                    mov ebp, esp
:00453B16 51                      push ecx
:00453B17 894DFC                  mov dword ptr [ebp-04], ecx
:00453B1A 8B45FC                  mov eax, dword ptr [ebp-04]
:00453B1D 8B4018                  mov eax, dword ptr [eax+18]
:00453B20 99                      cdq
:00453B21 B930000000              mov ecx, 00000030
:00453B26 F7F9                    idiv ecx
:00453B28 50                      push eax
:00453B29 8B55FC                  mov edx, dword ptr [ebp-04]
:00453B2C 8B4214                  mov eax, dword ptr [edx+14]
:00453B2F 99                      cdq
:00453B30 B930000000              mov ecx, 00000030
:00453B35 F7F9                    idiv ecx
:00453B37 50                      push eax
:00453B38 6A00                    push 00000000
:00453B3A 6A00                    push 00000000
:00453B3C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00453B3F E84BE6FFFF              call 0045218F
:00453B44 8BE5                    mov esp, ebp
:00453B46 5D                      pop ebp
:00453B47 C3                      ret



* Referenced by a CALL at Addresses:
|:00433784   , :004337EB   , :0044ACC4   , :0044AD07   , :0044AFF6   
|:0044B039   , :0044B641   , :0044B66F   , :0044B6AE   , :0044BAAB   
|:0044BB47   , :0044BB75   , :0044BBB4   , :0044BD12   , :0044BDA7   
|:0044C171   , :00453E73   , :00454610   , :004546FB   , :004564E0   
|:0045675C   , :0045693A   , :00456CCE   
|
:00453B48 55                      push ebp
:00453B49 8BEC                    mov ebp, esp
:00453B4B 51                      push ecx
:00453B4C 894DFC                  mov dword ptr [ebp-04], ecx
:00453B4F 8A4514                  mov al, byte ptr [ebp+14]
:00453B52 50                      push eax
:00453B53 8A4D10                  mov cl, byte ptr [ebp+10]
:00453B56 51                      push ecx
:00453B57 8A550C                  mov dl, byte ptr [ebp+0C]
:00453B5A 52                      push edx
:00453B5B 8A4508                  mov al, byte ptr [ebp+08]
:00453B5E 50                      push eax
:00453B5F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00453B62 E828E6FFFF              call 0045218F
:00453B67 8BE5                    mov esp, ebp
:00453B69 5D                      pop ebp
:00453B6A C21000                  ret 0010



* Referenced by a CALL at Address:
|:0045238E   
|
:00453B6D 55                      push ebp
:00453B6E 8BEC                    mov ebp, esp
:00453B70 83EC0C                  sub esp, 0000000C
:00453B73 53                      push ebx
:00453B74 894DF4                  mov dword ptr [ebp-0C], ecx
:00453B77 8B45F4                  mov eax, dword ptr [ebp-0C]
:00453B7A 83785000                cmp dword ptr [eax+50], 00000000
:00453B7E 0F848A000000            je 00453C0E
:00453B84 8B4508                  mov eax, dword ptr [ebp+08]
:00453B87 99                      cdq
:00453B88 B930000000              mov ecx, 00000030
:00453B8D F7F9                    idiv ecx
:00453B8F 8845F8                  mov byte ptr [ebp-08], al
:00453B92 8B450C                  mov eax, dword ptr [ebp+0C]
:00453B95 99                      cdq
:00453B96 B930000000              mov ecx, 00000030
:00453B9B F7F9                    idiv ecx
:00453B9D 8845FC                  mov byte ptr [ebp-04], al
:00453BA0 8B55F4                  mov edx, dword ptr [ebp-0C]
:00453BA3 33C0                    xor eax, eax
:00453BA5 8A4244                  mov al, byte ptr [edx+44]
:00453BA8 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00453BAB 81E1FF000000            and ecx, 000000FF
:00453BB1 3BC1                    cmp eax, ecx
:00453BB3 7F59                    jg 00453C0E
:00453BB5 8B55F8                  mov edx, dword ptr [ebp-08]
:00453BB8 81E2FF000000            and edx, 000000FF
:00453BBE 8B45F4                  mov eax, dword ptr [ebp-0C]
:00453BC1 33C9                    xor ecx, ecx
:00453BC3 8A4844                  mov cl, byte ptr [eax+44]
:00453BC6 8B45F4                  mov eax, dword ptr [ebp-0C]
:00453BC9 33DB                    xor ebx, ebx
:00453BCB 8A5846                  mov bl, byte ptr [eax+46]
:00453BCE 03CB                    add ecx, ebx
:00453BD0 3BD1                    cmp edx, ecx
:00453BD2 7D3A                    jge 00453C0E
:00453BD4 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00453BD7 33D2                    xor edx, edx
:00453BD9 8A5145                  mov dl, byte ptr [ecx+45]
:00453BDC 8B45FC                  mov eax, dword ptr [ebp-04]
:00453BDF 25FF000000              and eax, 000000FF
:00453BE4 3BD0                    cmp edx, eax
:00453BE6 7F26                    jg 00453C0E
:00453BE8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00453BEB 81E1FF000000            and ecx, 000000FF
:00453BF1 8B55F4                  mov edx, dword ptr [ebp-0C]
:00453BF4 33C0                    xor eax, eax
:00453BF6 8A4245                  mov al, byte ptr [edx+45]
:00453BF9 8B55F4                  mov edx, dword ptr [ebp-0C]
:00453BFC 33DB                    xor ebx, ebx
:00453BFE 8A5A47                  mov bl, byte ptr [edx+47]
:00453C01 03C3                    add eax, ebx
:00453C03 3BC8                    cmp ecx, eax
:00453C05 7D07                    jge 00453C0E
:00453C07 B801000000              mov eax, 00000001
:00453C0C EB02                    jmp 00453C10

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00453B7E(C), :00453BB3(C), :00453BD2(C), :00453BE6(C), :00453C05(C)
|
:00453C0E 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00453C0C(U)
|
:00453C10 5B                      pop ebx
:00453C11 8BE5                    mov esp, ebp
:00453C13 5D                      pop ebp
:00453C14 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:00440516   , :00450253   , :00450AD2   , :0045593B   
|
:00453C17 55                      push ebp
:00453C18 8BEC                    mov ebp, esp
:00453C1A 83EC18                  sub esp, 00000018
:00453C1D 894DE8                  mov dword ptr [ebp-18], ecx
:00453C20 8B45E8                  mov eax, dword ptr [ebp-18]
:00453C23 8A4D08                  mov cl, byte ptr [ebp+08]
:00453C26 884844                  mov byte ptr [eax+44], cl
:00453C29 8B55E8                  mov edx, dword ptr [ebp-18]
:00453C2C 8A450C                  mov al, byte ptr [ebp+0C]
:00453C2F 884245                  mov byte ptr [edx+45], al
:00453C32 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00453C35 8A5510                  mov dl, byte ptr [ebp+10]
:00453C38 885146                  mov byte ptr [ecx+46], dl
:00453C3B 8B45E8                  mov eax, dword ptr [ebp-18]
:00453C3E 8A4D14                  mov cl, byte ptr [ebp+14]
:00453C41 884847                  mov byte ptr [eax+47], cl
:00453C44 8B5510                  mov edx, dword ptr [ebp+10]
:00453C47 81E2FF000000            and edx, 000000FF
:00453C4D 6BD230                  imul edx, 00000030
:00453C50 8955F4                  mov dword ptr [ebp-0C], edx
:00453C53 8B4514                  mov eax, dword ptr [ebp+14]
:00453C56 25FF000000              and eax, 000000FF
:00453C5B 6BC030                  imul eax, 00000030
:00453C5E 8945F0                  mov dword ptr [ebp-10], eax
:00453C61 8B4D08                  mov ecx, dword ptr [ebp+08]
:00453C64 81E1FF000000            and ecx, 000000FF
:00453C6A 6BC930                  imul ecx, 00000030
:00453C6D 8B55E8                  mov edx, dword ptr [ebp-18]
:00453C70 034A3C                  add ecx, dword ptr [edx+3C]
:00453C73 894DEC                  mov dword ptr [ebp-14], ecx
:00453C76 8B450C                  mov eax, dword ptr [ebp+0C]
:00453C79 25FF000000              and eax, 000000FF
:00453C7E 6BC030                  imul eax, 00000030
:00453C81 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00453C84 034140                  add eax, dword ptr [ecx+40]
:00453C87 8945FC                  mov dword ptr [ebp-04], eax
:00453C8A E84CA9FCFF              call 0041E5DB
:00453C8F 6A00                    push 00000000
:00453C91 6A1F                    push 0000001F
:00453C93 6A04                    push 00000004
:00453C95 E857950200              call 0047D1F1
:00453C9A 83C40C                  add esp, 0000000C
:00453C9D 6A04                    push 00000004
:00453C9F 6A00                    push 00000000
:00453CA1 6800690000              push 00006900
:00453CA6 B9C8E44A00              mov ecx, 004AE4C8
:00453CAB E890BD0200              call 0047FA40
:00453CB0 50                      push eax
:00453CB1 8B55F0                  mov edx, dword ptr [ebp-10]
:00453CB4 52                      push edx
:00453CB5 8B45F4                  mov eax, dword ptr [ebp-0C]
:00453CB8 50                      push eax
:00453CB9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00453CBC 51                      push ecx
:00453CBD 8B55EC                  mov edx, dword ptr [ebp-14]
:00453CC0 52                      push edx
:00453CC1 E88BA50200              call 0047E251
:00453CC6 83C414                  add esp, 00000014
:00453CC9 6A04                    push 00000004
:00453CCB 8B45F0                  mov eax, dword ptr [ebp-10]
:00453CCE 50                      push eax
:00453CCF 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00453CD2 51                      push ecx
:00453CD3 6A04                    push 00000004
:00453CD5 6A00                    push 00000000
:00453CD7 6800690000              push 00006900
:00453CDC B9C8E44A00              mov ecx, 004AE4C8
:00453CE1 E85ABD0200              call 0047FA40
:00453CE6 50                      push eax
:00453CE7 E894C7FDFF              call 00430480
:00453CEC 83C410                  add esp, 00000010
:00453CEF 6A04                    push 00000004
:00453CF1 6A00                    push 00000000
:00453CF3 6800690000              push 00006900
:00453CF8 B9C8E44A00              mov ecx, 004AE4C8
:00453CFD E83EBD0200              call 0047FA40
:00453D02 50                      push eax
:00453D03 8B55F0                  mov edx, dword ptr [ebp-10]
:00453D06 52                      push edx
:00453D07 8B45F4                  mov eax, dword ptr [ebp-0C]
:00453D0A 50                      push eax
:00453D0B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00453D0E 51                      push ecx
:00453D0F 8B55EC                  mov edx, dword ptr [ebp-14]
:00453D12 52                      push edx
:00453D13 E883A30200              call 0047E09B
:00453D18 83C414                  add esp, 00000014
:00453D1B C745F800000000          mov [ebp-08], 00000000
:00453D22 EB09                    jmp 00453D2D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00453E22(U)
|
:00453D24 8B45F8                  mov eax, dword ptr [ebp-08]
:00453D27 83C001                  add eax, 00000001
:00453D2A 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00453D22(U)
|
:00453D2D 837DF803                cmp dword ptr [ebp-08], 00000003
:00453D31 0F83F0000000            jnb 00453E27
:00453D37 6A00                    push 00000000
:00453D39 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00453D3C 83C11D                  add ecx, 0000001D
:00453D3F 51                      push ecx
:00453D40 6A04                    push 00000004
:00453D42 E8AA940200              call 0047D1F1
:00453D47 83C40C                  add esp, 0000000C
:00453D4A 68FFFF0000              push 0000FFFF
:00453D4F 8B55FC                  mov edx, dword ptr [ebp-04]
:00453D52 0355F0                  add edx, dword ptr [ebp-10]
:00453D55 8B45F8                  mov eax, dword ptr [ebp-08]
:00453D58 8D4C02FD                lea ecx, dword ptr [edx+eax-03]
:00453D5C 51                      push ecx
:00453D5D 8B55F4                  mov edx, dword ptr [ebp-0C]
:00453D60 8B45EC                  mov eax, dword ptr [ebp-14]
:00453D63 8D4C10FF                lea ecx, dword ptr [eax+edx-01]
:00453D67 51                      push ecx
:00453D68 8B55FC                  mov edx, dword ptr [ebp-04]
:00453D6B 0355F0                  add edx, dword ptr [ebp-10]
:00453D6E 8B45F8                  mov eax, dword ptr [ebp-08]
:00453D71 8D4C02FD                lea ecx, dword ptr [edx+eax-03]
:00453D75 51                      push ecx
:00453D76 8B55EC                  mov edx, dword ptr [ebp-14]
:00453D79 52                      push edx
:00453D7A E83F970200              call 0047D4BE
:00453D7F 83C414                  add esp, 00000014
:00453D82 68FFFF0000              push 0000FFFF
:00453D87 8B45F0                  mov eax, dword ptr [ebp-10]
:00453D8A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00453D8D 8D5401FF                lea edx, dword ptr [ecx+eax-01]
:00453D91 52                      push edx
:00453D92 8B45EC                  mov eax, dword ptr [ebp-14]
:00453D95 0345F4                  add eax, dword ptr [ebp-0C]
:00453D98 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00453D9B 8D5408FD                lea edx, dword ptr [eax+ecx-03]
:00453D9F 52                      push edx
:00453DA0 8B45FC                  mov eax, dword ptr [ebp-04]
:00453DA3 50                      push eax
:00453DA4 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00453DA7 034DF4                  add ecx, dword ptr [ebp-0C]
:00453DAA 8B55F8                  mov edx, dword ptr [ebp-08]
:00453DAD 8D4411FD                lea eax, dword ptr [ecx+edx-03]
:00453DB1 50                      push eax
:00453DB2 E807970200              call 0047D4BE
:00453DB7 83C414                  add esp, 00000014
:00453DBA 837DF801                cmp dword ptr [ebp-08], 00000001
:00453DBE 7362                    jnb 00453E22
:00453DC0 6A00                    push 00000000
:00453DC2 6A18                    push 00000018
:00453DC4 6A04                    push 00000004
:00453DC6 E826940200              call 0047D1F1
:00453DCB 83C40C                  add esp, 0000000C
:00453DCE 68FFFF0000              push 0000FFFF
:00453DD3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00453DD6 034DF8                  add ecx, dword ptr [ebp-08]
:00453DD9 51                      push ecx
:00453DDA 8B55F4                  mov edx, dword ptr [ebp-0C]
:00453DDD 8B45EC                  mov eax, dword ptr [ebp-14]
:00453DE0 8D4C10FF                lea ecx, dword ptr [eax+edx-01]
:00453DE4 51                      push ecx
:00453DE5 8B55FC                  mov edx, dword ptr [ebp-04]
:00453DE8 0355F8                  add edx, dword ptr [ebp-08]
:00453DEB 52                      push edx
:00453DEC 8B45EC                  mov eax, dword ptr [ebp-14]
:00453DEF 50                      push eax
:00453DF0 E8C9960200              call 0047D4BE
:00453DF5 83C414                  add esp, 00000014
:00453DF8 68FFFF0000              push 0000FFFF
:00453DFD 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00453E00 8B55FC                  mov edx, dword ptr [ebp-04]
:00453E03 8D440AFF                lea eax, dword ptr [edx+ecx-01]
:00453E07 50                      push eax
:00453E08 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00453E0B 034DF8                  add ecx, dword ptr [ebp-08]
:00453E0E 51                      push ecx
:00453E0F 8B55FC                  mov edx, dword ptr [ebp-04]
:00453E12 52                      push edx
:00453E13 8B45EC                  mov eax, dword ptr [ebp-14]
:00453E16 0345F8                  add eax, dword ptr [ebp-08]
:00453E19 50                      push eax
:00453E1A E89F960200              call 0047D4BE
:00453E1F 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00453DBE(C)
|
:00453E22 E9FDFEFFFF              jmp 00453D24

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00453D31(C)
|
:00453E27 E8CAA7FCFF              call 0041E5F6
:00453E2C 8BE5                    mov esp, ebp
:00453E2E 5D                      pop ebp
:00453E2F C21000                  ret 0010



* Referenced by a CALL at Addresses:
|:00416FCA   , :004336FA   , :00433A50   , :00433D35   , :0043450D   
|:004346F7   , :0043DE22   , :0044159A   , :00441655   , :004416E4   
|:00449CCB   , :0044E2AF   , :0044E397   , :0044E585   , :0044E82F   
|:0045097A   , :00450ECB   , :00454200   , :0045431A   , :004544B0   
|:00454B5A   , :00455C2E   , :0047AE2C   , :0047BFC5   
|
:00453E32 55                      push ebp
:00453E33 8BEC                    mov ebp, esp
:00453E35 51                      push ecx
:00453E36 894DFC                  mov dword ptr [ebp-04], ecx
:00453E39 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00453E3C E856000000              call 00453E97
:00453E41 85C0                    test eax, eax
:00453E43 7438                    je 00453E7D
:00453E45 E891A7FCFF              call 0041E5DB
:00453E4A 6A00                    push 00000000
:00453E4C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00453E4F E82D000000              call 00453E81
:00453E54 8B45FC                  mov eax, dword ptr [ebp-04]
:00453E57 8A4847                  mov cl, byte ptr [eax+47]
:00453E5A 51                      push ecx
:00453E5B 8B55FC                  mov edx, dword ptr [ebp-04]
:00453E5E 8A4246                  mov al, byte ptr [edx+46]
:00453E61 50                      push eax
:00453E62 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00453E65 8A5145                  mov dl, byte ptr [ecx+45]
:00453E68 52                      push edx
:00453E69 8B45FC                  mov eax, dword ptr [ebp-04]
:00453E6C 8A4844                  mov cl, byte ptr [eax+44]
:00453E6F 51                      push ecx
:00453E70 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00453E73 E8D0FCFFFF              call 00453B48
:00453E78 E879A7FCFF              call 0041E5F6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00453E43(C)
|
:00453E7D 8BE5                    mov esp, ebp
:00453E7F 5D                      pop ebp
:00453E80 C3                      ret



* Referenced by a CALL at Addresses:
|:00440E68   , :0045025F   , :00450ADE   , :00453E4F   , :00455C23   
|:00455CD5   , :00455D41   
|
:00453E81 55                      push ebp
:00453E82 8BEC                    mov ebp, esp
:00453E84 51                      push ecx
:00453E85 894DFC                  mov dword ptr [ebp-04], ecx
:00453E88 8B45FC                  mov eax, dword ptr [ebp-04]
:00453E8B 8B4D08                  mov ecx, dword ptr [ebp+08]
:00453E8E 894850                  mov dword ptr [eax+50], ecx
:00453E91 8BE5                    mov esp, ebp
:00453E93 5D                      pop ebp
:00453E94 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0044E2A1   , :0044E389   , :00453E3C   , :0047BFB7   
|
:00453E97 55                      push ebp
:00453E98 8BEC                    mov ebp, esp
:00453E9A 51                      push ecx
:00453E9B 894DFC                  mov dword ptr [ebp-04], ecx
:00453E9E 8B45FC                  mov eax, dword ptr [ebp-04]
:00453EA1 8B4050                  mov eax, dword ptr [eax+50]
:00453EA4 8BE5                    mov esp, ebp
:00453EA6 5D                      pop ebp
:00453EA7 C3                      ret



* Referenced by a CALL at Addresses:
|:0044E1FE   , :00454208   , :004542A0   , :00455D19   
|
:00453EA8 55                      push ebp
:00453EA9 8BEC                    mov ebp, esp
:00453EAB 51                      push ecx
:00453EAC 894DFC                  mov dword ptr [ebp-04], ecx
:00453EAF B9B07F4900              mov ecx, 00497FB0
:00453EB4 E8091DFDFF              call 00425BC2
:00453EB9 B9B07F4900              mov ecx, 00497FB0
:00453EBE E8631DFDFF              call 00425C26
:00453EC3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00453EC6 8981701B0000            mov dword ptr [ecx+00001B70], eax
:00453ECC B9B07F4900              mov ecx, 00497FB0
:00453ED1 E8611DFDFF              call 00425C37
:00453ED6 8B55FC                  mov edx, dword ptr [ebp-04]
:00453ED9 8982741B0000            mov dword ptr [edx+00001B74], eax
:00453EDF 8BE5                    mov esp, ebp
:00453EE1 5D                      pop ebp
:00453EE2 C3                      ret


:00453EE3 55                      push ebp
:00453EE4 8BEC                    mov ebp, esp
:00453EE6 83EC10                  sub esp, 00000010
:00453EE9 894DF0                  mov dword ptr [ebp-10], ecx
:00453EEC 33C0                    xor eax, eax
:00453EEE A0E05D4B00              mov al, byte ptr [004B5DE0]
:00453EF3 83E001                  and eax, 00000001
:00453EF6 85C0                    test eax, eax
:00453EF8 7526                    jne 00453F20
:00453EFA 8A0DE05D4B00            mov cl, byte ptr [004B5DE0]
:00453F00 80C901                  or cl, 01
:00453F03 880DE05D4B00            mov byte ptr [004B5DE0], cl
:00453F09 B9DC5D4B00              mov ecx, 004B5DDC
:00453F0E E8FDB70000              call 0045F710
:00453F13 68FE3F4500              push 00453FFE
:00453F18 E8E3D10200              call 00481100
:00453F1D 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00453EF8(C)
|
:00453F20 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00453F23 E8E8B70000              call 0045F710
:00453F28 8B55F0                  mov edx, dword ptr [ebp-10]
:00453F2B 8B82701B0000            mov eax, dword ptr [edx+00001B70]
:00453F31 8945F8                  mov dword ptr [ebp-08], eax
:00453F34 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00453F37 8B91741B0000            mov edx, dword ptr [ecx+00001B74]
:00453F3D 8955F4                  mov dword ptr [ebp-0C], edx
:00453F40 8B45F0                  mov eax, dword ptr [ebp-10]
:00453F43 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00453F46 3B483C                  cmp ecx, dword ptr [eax+3C]
:00453F49 7C2D                    jl 00453F78
:00453F4B 8B55F0                  mov edx, dword ptr [ebp-10]
:00453F4E 8B45F4                  mov eax, dword ptr [ebp-0C]
:00453F51 3B4240                  cmp eax, dword ptr [edx+40]
:00453F54 7C22                    jl 00453F78
:00453F56 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00453F59 8B513C                  mov edx, dword ptr [ecx+3C]
:00453F5C 8B45F0                  mov eax, dword ptr [ebp-10]
:00453F5F 035014                  add edx, dword ptr [eax+14]
:00453F62 3955F8                  cmp dword ptr [ebp-08], edx
:00453F65 7D11                    jge 00453F78
:00453F67 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00453F6A 8B5140                  mov edx, dword ptr [ecx+40]
:00453F6D 8B45F0                  mov eax, dword ptr [ebp-10]
:00453F70 035018                  add edx, dword ptr [eax+18]
:00453F73 3955F4                  cmp dword ptr [ebp-0C], edx
:00453F76 7C0A                    jl 00453F82

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00453F49(C), :00453F54(C), :00453F65(C)
|
:00453F78 C645FCFF                mov [ebp-04], FF
:00453F7C C645FDFF                mov [ebp-03], FF
:00453F80 EB3A                    jmp 00453FBC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00453F76(C)
|
:00453F82 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00453F85 8B45F8                  mov eax, dword ptr [ebp-08]
:00453F88 2B413C                  sub eax, dword ptr [ecx+3C]
:00453F8B 99                      cdq
:00453F8C 83E20F                  and edx, 0000000F
:00453F8F 03C2                    add eax, edx
:00453F91 C1F804                  sar eax, 04
:00453F94 99                      cdq
:00453F95 B903000000              mov ecx, 00000003
:00453F9A F7F9                    idiv ecx
:00453F9C 8845FC                  mov byte ptr [ebp-04], al
:00453F9F 8B55F0                  mov edx, dword ptr [ebp-10]
:00453FA2 8B45F4                  mov eax, dword ptr [ebp-0C]
:00453FA5 2B4240                  sub eax, dword ptr [edx+40]
:00453FA8 99                      cdq
:00453FA9 83E20F                  and edx, 0000000F
:00453FAC 03C2                    add eax, edx
:00453FAE C1F804                  sar eax, 04
:00453FB1 99                      cdq
:00453FB2 B903000000              mov ecx, 00000003
:00453FB7 F7F9                    idiv ecx
:00453FB9 8845FD                  mov byte ptr [ebp-03], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00453F80(U)
|
:00453FBC 8B55F0                  mov edx, dword ptr [ebp-10]
:00453FBF 33C0                    xor eax, eax
:00453FC1 8A4254                  mov al, byte ptr [edx+54]
:00453FC4 3DFF000000              cmp eax, 000000FF
:00453FC9 7507                    jne 00453FD2
:00453FCB C605DC5D4B00FF          mov byte ptr [004B5DDC], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00453FC9(C)
|
:00453FD2 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00453FD5 51                      push ecx
:00453FD6 68DC5D4B00              push 004B5DDC
:00453FDB E84074FEFF              call 0043B420
:00453FE0 83C408                  add esp, 00000008
:00453FE3 85C0                    test eax, eax
:00453FE5 750E                    jne 00453FF5
:00453FE7 8D55FC                  lea edx, dword ptr [ebp-04]
:00453FEA 52                      push edx
:00453FEB B9DC5D4B00              mov ecx, 004B5DDC
:00453FF0 E8AB25FBFF              call 004065A0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00453FE5(C)
|
:00453FF5 B8DC5D4B00              mov eax, 004B5DDC
:00453FFA 8BE5                    mov esp, ebp
:00453FFC 5D                      pop ebp
:00453FFD C3                      ret


:00453FFE 55                      push ebp
:00453FFF 8BEC                    mov ebp, esp
:00454001 5D                      pop ebp
:00454002 C3                      ret



* Referenced by a CALL at Addresses:
|:0044E251   , :00454210   , :004542DE   , :00454731   
|
:00454003 55                      push ebp
:00454004 8BEC                    mov ebp, esp
:00454006 83EC20                  sub esp, 00000020
:00454009 894DE0                  mov dword ptr [ebp-20], ecx
:0045400C 33C0                    xor eax, eax
:0045400E A0E45D4B00              mov al, byte ptr [004B5DE4]
:00454013 83E001                  and eax, 00000001
:00454016 85C0                    test eax, eax
:00454018 7526                    jne 00454040
:0045401A 8A0DE45D4B00            mov cl, byte ptr [004B5DE4]
:00454020 80C901                  or cl, 01
:00454023 880DE45D4B00            mov byte ptr [004B5DE4], cl
:00454029 B948424B00              mov ecx, 004B4248
:0045402E E8DDB60000              call 0045F710
:00454033 688A414500              push 0045418A
:00454038 E8C3D00200              call 00481100
:0045403D 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454018(C)
|
:00454040 8B55E0                  mov edx, dword ptr [ebp-20]
:00454043 8B82701B0000            mov eax, dword ptr [edx+00001B70]
:00454049 8945E8                  mov dword ptr [ebp-18], eax
:0045404C 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0045404F 8B91741B0000            mov edx, dword ptr [ecx+00001B74]
:00454055 8955E4                  mov dword ptr [ebp-1C], edx
:00454058 8D4DEC                  lea ecx, dword ptr [ebp-14]
:0045405B E8B0B60000              call 0045F710
:00454060 8D45F0                  lea eax, dword ptr [ebp-10]
:00454063 50                      push eax
:00454064 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:0045406A 51                      push ecx
:0045406B FF15EC624800            call dword ptr [004862EC]
:00454071 8B55E0                  mov edx, dword ptr [ebp-20]
:00454074 8B45E8                  mov eax, dword ptr [ebp-18]
:00454077 3B423C                  cmp eax, dword ptr [edx+3C]
:0045407A 7C2D                    jl 004540A9
:0045407C 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0045407F 8B55E4                  mov edx, dword ptr [ebp-1C]
:00454082 3B5140                  cmp edx, dword ptr [ecx+40]
:00454085 7C22                    jl 004540A9
:00454087 8B45E0                  mov eax, dword ptr [ebp-20]
:0045408A 8B483C                  mov ecx, dword ptr [eax+3C]
:0045408D 8B55E0                  mov edx, dword ptr [ebp-20]
:00454090 034A14                  add ecx, dword ptr [edx+14]
:00454093 394DE8                  cmp dword ptr [ebp-18], ecx
:00454096 7D11                    jge 004540A9
:00454098 8B45E0                  mov eax, dword ptr [ebp-20]
:0045409B 8B4840                  mov ecx, dword ptr [eax+40]
:0045409E 8B55E0                  mov edx, dword ptr [ebp-20]
:004540A1 034A18                  add ecx, dword ptr [edx+18]
:004540A4 394DE4                  cmp dword ptr [ebp-1C], ecx
:004540A7 7C0A                    jl 004540B3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045407A(C), :00454085(C), :00454096(C)
|
:004540A9 C645ECFF                mov [ebp-14], FF
:004540AD C645EDFF                mov [ebp-13], FF
:004540B1 EB66                    jmp 00454119

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004540A7(C)
|
:004540B3 8B45E8                  mov eax, dword ptr [ebp-18]
:004540B6 3B45F8                  cmp eax, dword ptr [ebp-08]
:004540B9 7D08                    jge 004540C3
:004540BB 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004540BE 3B4DFC                  cmp ecx, dword ptr [ebp-04]
:004540C1 7C0A                    jl 004540CD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004540B9(C)
|
:004540C3 C645ECFF                mov [ebp-14], FF
:004540C7 C645EDFF                mov [ebp-13], FF
:004540CB EB4C                    jmp 00454119

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004540C1(C)
|
:004540CD FF1560624800            call dword ptr [00486260]
:004540D3 3905686A4B00            cmp dword ptr [004B6A68], eax
:004540D9 740A                    je 004540E5
:004540DB C645ECFF                mov [ebp-14], FF
:004540DF C645EDFF                mov [ebp-13], FF
:004540E3 EB34                    jmp 00454119

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004540D9(C)
|
:004540E5 8B55E0                  mov edx, dword ptr [ebp-20]
:004540E8 8B45E8                  mov eax, dword ptr [ebp-18]
:004540EB 2B423C                  sub eax, dword ptr [edx+3C]
:004540EE 8B4DE0                  mov ecx, dword ptr [ebp-20]
:004540F1 034104                  add eax, dword ptr [ecx+04]
:004540F4 99                      cdq
:004540F5 B930000000              mov ecx, 00000030
:004540FA F7F9                    idiv ecx
:004540FC 8845EC                  mov byte ptr [ebp-14], al
:004540FF 8B55E0                  mov edx, dword ptr [ebp-20]
:00454102 8B45E4                  mov eax, dword ptr [ebp-1C]
:00454105 2B4240                  sub eax, dword ptr [edx+40]
:00454108 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0045410B 034108                  add eax, dword ptr [ecx+08]
:0045410E 99                      cdq
:0045410F B930000000              mov ecx, 00000030
:00454114 F7F9                    idiv ecx
:00454116 8845ED                  mov byte ptr [ebp-13], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004540B1(U), :004540CB(U), :004540E3(U)
|
:00454119 8B55E0                  mov edx, dword ptr [ebp-20]
:0045411C 33C0                    xor eax, eax
:0045411E 8A4254                  mov al, byte ptr [edx+54]
:00454121 3DFF000000              cmp eax, 000000FF
:00454126 7507                    jne 0045412F
:00454128 C60548424B00FF          mov byte ptr [004B4248], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454126(C)
|
:0045412F 8D4DEC                  lea ecx, dword ptr [ebp-14]
:00454132 51                      push ecx
:00454133 6848424B00              push 004B4248
:00454138 E8E372FEFF              call 0043B420
:0045413D 83C408                  add esp, 00000008
:00454140 85C0                    test eax, eax
:00454142 753D                    jne 00454181
:00454144 33D2                    xor edx, edx
:00454146 8A1548424B00            mov dl, byte ptr [004B4248]
:0045414C 81FAFF000000            cmp edx, 000000FF
:00454152 7408                    je 0045415C
:00454154 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00454157 E8C0040000              call 0045461C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454152(C)
|
:0045415C 8D45EC                  lea eax, dword ptr [ebp-14]
:0045415F 50                      push eax
:00454160 B948424B00              mov ecx, 004B4248
:00454165 E83624FBFF              call 004065A0
:0045416A E86CA4FCFF              call 0041E5DB
:0045416F 6848424B00              push 004B4248
:00454174 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00454177 E857030000              call 004544D3
:0045417C E875A4FCFF              call 0041E5F6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454142(C)
|
:00454181 B848424B00              mov eax, 004B4248
:00454186 8BE5                    mov esp, ebp
:00454188 5D                      pop ebp
:00454189 C3                      ret


:0045418A 55                      push ebp
:0045418B 8BEC                    mov ebp, esp
:0045418D 5D                      pop ebp
:0045418E C3                      ret



* Referenced by a CALL at Addresses:
|:0043D68B   , :0043D826   , :0043D87C   , :0043D8E5   , :0043D936   
|
:0045418F 55                      push ebp
:00454190 8BEC                    mov ebp, esp
:00454192 51                      push ecx
:00454193 894DFC                  mov dword ptr [ebp-04], ecx
:00454196 68FF000000              push 000000FF
:0045419B 6A00                    push 00000000
:0045419D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004541A0 E804000000              call 004541A9
:004541A5 8BE5                    mov esp, ebp
:004541A7 5D                      pop ebp
:004541A8 C3                      ret



* Referenced by a CALL at Addresses:
|:004541A0   , :00455527   
|
:004541A9 55                      push ebp
:004541AA 8BEC                    mov ebp, esp
:004541AC 83EC20                  sub esp, 00000020
:004541AF 56                      push esi
:004541B0 894DE8                  mov dword ptr [ebp-18], ecx
:004541B3 33C0                    xor eax, eax
:004541B5 A040424B00              mov al, byte ptr [004B4240]
:004541BA 83E001                  and eax, 00000001
:004541BD 85C0                    test eax, eax
:004541BF 7526                    jne 004541E7
:004541C1 8A0D40424B00            mov cl, byte ptr [004B4240]
:004541C7 80C901                  or cl, 01
:004541CA 880D40424B00            mov byte ptr [004B4240], cl
:004541D0 B944424B00              mov ecx, 004B4244
:004541D5 E836B50000              call 0045F710

* Possible StringData Ref from Code Obj ->"U]UVME3ɊUB0"
                                  |
:004541DA 68CE444500              push 004544CE
:004541DF E81CCF0200              call 00481100
:004541E4 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004541BF(C)
|
:004541E7 C645FCFF                mov [ebp-04], FF
:004541EB C645F0FF                mov [ebp-10], FF
:004541EF C745F401000000          mov [ebp-0C], 00000001
:004541F6 C745F800000000          mov [ebp-08], 00000000
:004541FD 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00454200 E82DFCFFFF              call 00453E32
:00454205 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00454208 E89BFCFFFF              call 00453EA8
:0045420D 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00454210 E8EEFDFFFF              call 00454003
:00454215 50                      push eax
:00454216 B944424B00              mov ecx, 004B4244
:0045421B E88023FBFF              call 004065A0
:00454220 6844424B00              push 004B4244
:00454225 E85A16FEFF              call 00435884
:0045422A 83C404                  add esp, 00000004
:0045422D 8845F0                  mov byte ptr [ebp-10], al
:00454230 8B5508                  mov edx, dword ptr [ebp+08]
:00454233 81E2FF000000            and edx, 000000FF
:00454239 85D2                    test edx, edx
:0045423B 7508                    jne 00454245
:0045423D 8A45F0                  mov al, byte ptr [ebp-10]
:00454240 8845E7                  mov byte ptr [ebp-19], al
:00454243 EB04                    jmp 00454249

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045423B(C)
|
:00454245 C645E7FF                mov [ebp-19], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454243(U)
|
:00454249 8A4DE7                  mov cl, byte ptr [ebp-19]
:0045424C 884DFC                  mov byte ptr [ebp-04], cl
:0045424F 6A00                    push 00000000
:00454251 6A00                    push 00000000
:00454253 6802020000              push 00000202
:00454258 8B15686A4B00            mov edx, dword ptr [004B6A68]
:0045425E 52                      push edx
:0045425F FF15F4624800            call dword ptr [004862F4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004544A8(U)
|
:00454265 E80183FDFF              call 0042C56B
:0045426A 83F801                  cmp eax, 00000001
:0045426D 7529                    jne 00454298
:0045426F E8F782FDFF              call 0042C56B
:00454274 83F801                  cmp eax, 00000001
:00454277 751F                    jne 00454298
:00454279 33C0                    xor eax, eax
:0045427B A034424B00              mov al, byte ptr [004B4234]
:00454280 85C0                    test eax, eax
:00454282 7514                    jne 00454298
:00454284 33C9                    xor ecx, ecx
:00454286 8A0D44424B00            mov cl, byte ptr [004B4244]
:0045428C 81F9FF000000            cmp ecx, 000000FF
:00454292 0F8515020000            jne 004544AD

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045426D(C), :00454277(C), :00454282(C)
|
:00454298 E827A80200              call 0047EAC4
:0045429D 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004542A0 E803FCFFFF              call 00453EA8
:004542A5 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004542A8 E85C040000              call 00454709
:004542AD 85C0                    test eax, eax
:004542AF 752A                    jne 004542DB
:004542B1 B9181B4B00              mov ecx, 004B1B18
:004542B6 E835B5FDFF              call 0042F7F0
:004542BB 85C0                    test eax, eax
:004542BD 741C                    je 004542DB
:004542BF B9083D4B00              mov ecx, 004B3D08
:004542C4 E86724FBFF              call 00406730
:004542C9 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004542CC E842F8FFFF              call 00453B13
:004542D1 6A04                    push 00000004
:004542D3 E8F381FDFF              call 0042C4CB
:004542D8 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004542AF(C), :004542BD(C)
|
:004542DB 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004542DE E820FDFFFF              call 00454003
:004542E3 50                      push eax
:004542E4 B944424B00              mov ecx, 004B4244
:004542E9 E8B222FBFF              call 004065A0
:004542EE 6844424B00              push 004B4244
:004542F3 E88C15FEFF              call 00435884
:004542F8 83C404                  add esp, 00000004
:004542FB 8845F0                  mov byte ptr [ebp-10], al
:004542FE 8B55FC                  mov edx, dword ptr [ebp-04]
:00454301 81E2FF000000            and edx, 000000FF
:00454307 8B45F0                  mov eax, dword ptr [ebp-10]
:0045430A 25FF000000              and eax, 000000FF
:0045430F 3BD0                    cmp edx, eax
:00454311 0F847E010000            je 00454495
:00454317 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0045431A E813FBFFFF              call 00453E32
:0045431F 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00454322 81E1FF000000            and ecx, 000000FF
:00454328 81F9FF000000            cmp ecx, 000000FF
:0045432E 0F845B010000            je 0045448F
:00454334 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00454337 81E1FF000000            and ecx, 000000FF
:0045433D 6BC924                  imul ecx, 00000024
:00454340 81C1502C4B00            add ecx, 004B2C50
:00454346 E84549FCFF              call 00418C90
:0045434B 25FF000000              and eax, 000000FF
:00454350 83F802                  cmp eax, 00000002
:00454353 0F8536010000            jne 0045448F
:00454359 6A04                    push 00000004
:0045435B 6A00                    push 00000000
:0045435D 33D2                    xor edx, edx
:0045435F 8A1544424B00            mov dl, byte ptr [004B4244]
:00454365 33C0                    xor eax, eax
:00454367 A045424B00              mov al, byte ptr [004B4245]
:0045436C 33C9                    xor ecx, ecx
:0045436E 8A0D2C424B00            mov cl, byte ptr [004B422C]
:00454374 0FAFC1                  imul eax, ecx
:00454377 8D9402C0120000          lea edx, dword ptr [edx+eax+000012C0]
:0045437E 52                      push edx
:0045437F B938EB4A00              mov ecx, 004AEB38
:00454384 E8B7B60200              call 0047FA40
:00454389 33C9                    xor ecx, ecx
:0045438B 8A08                    mov cl, byte ptr [eax]
:0045438D 81F9FF000000            cmp ecx, 000000FF
:00454393 0F84AE000000            je 00454447
:00454399 8B5508                  mov edx, dword ptr [ebp+08]
:0045439C 81E2FF000000            and edx, 000000FF
:004543A2 83FA03                  cmp edx, 00000003
:004543A5 7416                    je 004543BD
:004543A7 8B4508                  mov eax, dword ptr [ebp+08]
:004543AA 25FF000000              and eax, 000000FF
:004543AF 83F804                  cmp eax, 00000004
:004543B2 7409                    je 004543BD
:004543B4 C745E000000000          mov [ebp-20], 00000000
:004543BB EB07                    jmp 004543C4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004543A5(C), :004543B2(C)
|
:004543BD C745E001000000          mov [ebp-20], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004543BB(U)
|
:004543C4 8B4DE0                  mov ecx, dword ptr [ebp-20]
:004543C7 894DEC                  mov dword ptr [ebp-14], ecx
:004543CA 33D2                    xor edx, edx
:004543CC 8A15D85D4B00            mov dl, byte ptr [004B5DD8]
:004543D2 8BCA                    mov ecx, edx
:004543D4 6BC924                  imul ecx, 00000024
:004543D7 81C1502C4B00            add ecx, 004B2C50
:004543DD E82E23FBFF              call 00406710
:004543E2 8BF0                    mov esi, eax
:004543E4 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004543E7 81E1FF000000            and ecx, 000000FF
:004543ED 6BC924                  imul ecx, 00000024
:004543F0 81C1502C4B00            add ecx, 004B2C50
:004543F6 E81523FBFF              call 00406710
:004543FB 33C9                    xor ecx, ecx
:004543FD 3BF0                    cmp esi, eax
:004543FF 0F94C1                  sete cl
:00454402 394DEC                  cmp dword ptr [ebp-14], ecx
:00454405 7527                    jne 0045442E
:00454407 8A550C                  mov dl, byte ptr [ebp+0C]
:0045440A 52                      push edx
:0045440B A0D85D4B00              mov al, byte ptr [004B5DD8]
:00454410 50                      push eax
:00454411 8A4D08                  mov cl, byte ptr [ebp+08]
:00454414 51                      push ecx
:00454415 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00454418 81E1FF000000            and ecx, 000000FF
:0045441E 6BC924                  imul ecx, 00000024
:00454421 81C1502C4B00            add ecx, 004B2C50
:00454427 E891C0FEFF              call 004404BD
:0045442C EB17                    jmp 00454445

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454405(C)
|
:0045442E 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00454431 81E1FF000000            and ecx, 000000FF
:00454437 6BC924                  imul ecx, 00000024
:0045443A 81C1502C4B00            add ecx, 004B2C50
:00454440 E859C0FEFF              call 0044049E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045442C(U)
|
:00454445 EB17                    jmp 0045445E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454393(C)
|
:00454447 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0045444A 81E1FF000000            and ecx, 000000FF
:00454450 6BC924                  imul ecx, 00000024
:00454453 81C1502C4B00            add ecx, 004B2C50
:00454459 E840C0FEFF              call 0044049E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454445(U)
|
:0045445E 8B1508754B00            mov edx, dword ptr [004B7508]
:00454464 52                      push edx
:00454465 FF15C8624800            call dword ptr [004862C8]
:0045446B 85C0                    test eax, eax
:0045446D 7420                    je 0045448F
:0045446F 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00454472 81E1FF000000            and ecx, 000000FF
:00454478 6BC924                  imul ecx, 00000024
:0045447B 81C1502C4B00            add ecx, 004B2C50
:00454481 E8EAB10000              call 0045F670
:00454486 50                      push eax
:00454487 E809530200              call 00479795
:0045448C 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045432E(C), :00454353(C), :0045446D(C)
|
:0045448F 8A45F0                  mov al, byte ptr [ebp-10]
:00454492 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454311(C)
|
:00454495 E8D180FDFF              call 0042C56B
:0045449A 83F802                  cmp eax, 00000002
:0045449D 7509                    jne 004544A8
:0045449F C745F400000000          mov [ebp-0C], 00000000
:004544A6 EB05                    jmp 004544AD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045449D(C)
|
:004544A8 E9B8FDFFFF              jmp 00454265

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00454292(C), :004544A6(U)
|
:004544AD 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004544B0 E87DF9FFFF              call 00453E32
:004544B5 837DF400                cmp dword ptr [ebp-0C], 00000000
:004544B9 7507                    jne 004544C2
:004544BB C60544424B00FF          mov byte ptr [004B4244], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004544B9(C)
|
:004544C2 B844424B00              mov eax, 004B4244
:004544C7 5E                      pop esi
:004544C8 8BE5                    mov esp, ebp
:004544CA 5D                      pop ebp
:004544CB C20800                  ret 0008


:004544CE 55                      push ebp
:004544CF 8BEC                    mov ebp, esp
:004544D1 5D                      pop ebp
:004544D2 C3                      ret



* Referenced by a CALL at Addresses:
|:00424DA3   , :004414B5   , :0045026D   , :00450AEC   , :00454177   
|:0045531B   , :004558A1   
|
:004544D3 55                      push ebp
:004544D4 8BEC                    mov ebp, esp
:004544D6 83EC18                  sub esp, 00000018
:004544D9 56                      push esi
:004544DA 894DEC                  mov dword ptr [ebp-14], ecx
:004544DD 8B4508                  mov eax, dword ptr [ebp+08]
:004544E0 33C9                    xor ecx, ecx
:004544E2 8A08                    mov cl, byte ptr [eax]
:004544E4 8B55EC                  mov edx, dword ptr [ebp-14]
:004544E7 8B4204                  mov eax, dword ptr [edx+04]
:004544EA 99                      cdq
:004544EB BE30000000              mov esi, 00000030
:004544F0 F7FE                    idiv esi
:004544F2 2BC8                    sub ecx, eax
:004544F4 894DF8                  mov dword ptr [ebp-08], ecx
:004544F7 8B4508                  mov eax, dword ptr [ebp+08]
:004544FA 33C9                    xor ecx, ecx
:004544FC 8A4801                  mov cl, byte ptr [eax+01]
:004544FF 8B55EC                  mov edx, dword ptr [ebp-14]
:00454502 8B4208                  mov eax, dword ptr [edx+08]
:00454505 99                      cdq
:00454506 BE30000000              mov esi, 00000030
:0045450B F7FE                    idiv esi
:0045450D 2BC8                    sub ecx, eax
:0045450F 894DFC                  mov dword ptr [ebp-04], ecx
:00454512 837DF800                cmp dword ptr [ebp-08], 00000000
:00454516 0F8CF9000000            jl 00454615
:0045451C 8B45EC                  mov eax, dword ptr [ebp-14]
:0045451F 8B4014                  mov eax, dword ptr [eax+14]
:00454522 99                      cdq
:00454523 B930000000              mov ecx, 00000030
:00454528 F7F9                    idiv ecx
:0045452A 3945F8                  cmp dword ptr [ebp-08], eax
:0045452D 0F8DE2000000            jnl 00454615
:00454533 837DFC00                cmp dword ptr [ebp-04], 00000000
:00454537 0F8CD8000000            jl 00454615
:0045453D 8B55EC                  mov edx, dword ptr [ebp-14]
:00454540 8B4218                  mov eax, dword ptr [edx+18]
:00454543 99                      cdq
:00454544 B930000000              mov ecx, 00000030
:00454549 F7F9                    idiv ecx
:0045454B 3945FC                  cmp dword ptr [ebp-04], eax
:0045454E 0F8DC1000000            jnl 00454615
:00454554 8B55EC                  mov edx, dword ptr [ebp-14]
:00454557 8A45F8                  mov al, byte ptr [ebp-08]
:0045455A 884254                  mov byte ptr [edx+54], al
:0045455D 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00454560 8A55FC                  mov dl, byte ptr [ebp-04]
:00454563 885155                  mov byte ptr [ecx+55], dl
:00454566 8B45EC                  mov eax, dword ptr [ebp-14]
:00454569 8A4861                  mov cl, byte ptr [eax+61]
:0045456C 884DE8                  mov byte ptr [ebp-18], cl
:0045456F 807DE800                cmp byte ptr [ebp-18], 00
:00454573 767E                    jbe 004545F3
:00454575 807DE802                cmp byte ptr [ebp-18], 02
:00454579 7608                    jbe 00454583
:0045457B 807DE803                cmp byte ptr [ebp-18], 03
:0045457F 743A                    je 004545BB
:00454581 EB70                    jmp 004545F3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454579(C)
|
:00454583 6A01                    push 00000001
:00454585 8A55F8                  mov dl, byte ptr [ebp-08]
:00454588 52                      push edx
:00454589 E842B50200              call 0047FAD0
:0045458E 83C408                  add esp, 00000008
:00454591 25FF000000              and eax, 000000FF
:00454596 8945F8                  mov dword ptr [ebp-08], eax
:00454599 6A01                    push 00000001
:0045459B 8A45FC                  mov al, byte ptr [ebp-04]
:0045459E 50                      push eax
:0045459F E82CB50200              call 0047FAD0
:004545A4 83C408                  add esp, 00000008
:004545A7 25FF000000              and eax, 000000FF
:004545AC 8945FC                  mov dword ptr [ebp-04], eax
:004545AF C645F003                mov [ebp-10], 03
:004545B3 8A4DF0                  mov cl, byte ptr [ebp-10]
:004545B6 884DF4                  mov byte ptr [ebp-0C], cl
:004545B9 EB42                    jmp 004545FD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045457F(C)
|
:004545BB 6A02                    push 00000002
:004545BD 8A55F8                  mov dl, byte ptr [ebp-08]
:004545C0 52                      push edx
:004545C1 E80AB50200              call 0047FAD0
:004545C6 83C408                  add esp, 00000008
:004545C9 25FF000000              and eax, 000000FF
:004545CE 8945F8                  mov dword ptr [ebp-08], eax
:004545D1 6A02                    push 00000002
:004545D3 8A45FC                  mov al, byte ptr [ebp-04]
:004545D6 50                      push eax
:004545D7 E8F4B40200              call 0047FAD0
:004545DC 83C408                  add esp, 00000008
:004545DF 25FF000000              and eax, 000000FF
:004545E4 8945FC                  mov dword ptr [ebp-04], eax
:004545E7 C645F005                mov [ebp-10], 05
:004545EB 8A4DF0                  mov cl, byte ptr [ebp-10]
:004545EE 884DF4                  mov byte ptr [ebp-0C], cl
:004545F1 EB0A                    jmp 004545FD

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00454573(C), :00454581(U)
|
:004545F3 C645F001                mov [ebp-10], 01
:004545F7 8A55F0                  mov dl, byte ptr [ebp-10]
:004545FA 8855F4                  mov byte ptr [ebp-0C], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004545B9(U), :004545F1(U)
|
:004545FD 8A45F0                  mov al, byte ptr [ebp-10]
:00454600 50                      push eax
:00454601 8A4DF4                  mov cl, byte ptr [ebp-0C]
:00454604 51                      push ecx
:00454605 8A55FC                  mov dl, byte ptr [ebp-04]
:00454608 52                      push edx
:00454609 8A45F8                  mov al, byte ptr [ebp-08]
:0045460C 50                      push eax
:0045460D 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00454610 E833F5FFFF              call 00453B48

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00454516(C), :0045452D(C), :00454537(C), :0045454E(C)
|
:00454615 5E                      pop esi
:00454616 8BE5                    mov esp, ebp
:00454618 5D                      pop ebp
:00454619 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00421A06   , :00423CE4   , :004416DA   , :0044E59D   , :0044E6BC   
|:0044E6F3   , :00450970   , :00450EC1   , :00454157   , :00454D1D   
|:004552FF   , :004556C0   , :00455859   , :0046116F   
|
:0045461C 55                      push ebp
:0045461D 8BEC                    mov ebp, esp
:0045461F 83EC18                  sub esp, 00000018
:00454622 894DEC                  mov dword ptr [ebp-14], ecx
:00454625 8B45EC                  mov eax, dword ptr [ebp-14]
:00454628 8A4854                  mov cl, byte ptr [eax+54]
:0045462B 884DF8                  mov byte ptr [ebp-08], cl
:0045462E 8B55EC                  mov edx, dword ptr [ebp-14]
:00454631 8A4255                  mov al, byte ptr [edx+55]
:00454634 8845FC                  mov byte ptr [ebp-04], al
:00454637 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0045463A C64154FF                mov [ecx+54], FF
:0045463E 8B55EC                  mov edx, dword ptr [ebp-14]
:00454641 C64255FF                mov [edx+55], FF
:00454645 8B45EC                  mov eax, dword ptr [ebp-14]
:00454648 8A4861                  mov cl, byte ptr [eax+61]
:0045464B 884DE8                  mov byte ptr [ebp-18], cl
:0045464E 807DE800                cmp byte ptr [ebp-18], 00
:00454652 766A                    jbe 004546BE
:00454654 807DE802                cmp byte ptr [ebp-18], 02
:00454658 7608                    jbe 00454662
:0045465A 807DE803                cmp byte ptr [ebp-18], 03
:0045465E 7430                    je 00454690
:00454660 EB5C                    jmp 004546BE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454658(C)
|
:00454662 6A01                    push 00000001
:00454664 8A55F8                  mov dl, byte ptr [ebp-08]
:00454667 52                      push edx
:00454668 E863B40200              call 0047FAD0
:0045466D 83C408                  add esp, 00000008
:00454670 8845F8                  mov byte ptr [ebp-08], al
:00454673 6A01                    push 00000001
:00454675 8A45FC                  mov al, byte ptr [ebp-04]
:00454678 50                      push eax
:00454679 E852B40200              call 0047FAD0
:0045467E 83C408                  add esp, 00000008
:00454681 8845FC                  mov byte ptr [ebp-04], al
:00454684 C645F003                mov [ebp-10], 03
:00454688 8A4DF0                  mov cl, byte ptr [ebp-10]
:0045468B 884DF4                  mov byte ptr [ebp-0C], cl
:0045468E EB38                    jmp 004546C8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045465E(C)
|
:00454690 6A02                    push 00000002
:00454692 8A55F8                  mov dl, byte ptr [ebp-08]
:00454695 52                      push edx
:00454696 E835B40200              call 0047FAD0
:0045469B 83C408                  add esp, 00000008
:0045469E 8845F8                  mov byte ptr [ebp-08], al
:004546A1 6A02                    push 00000002
:004546A3 8A45FC                  mov al, byte ptr [ebp-04]
:004546A6 50                      push eax
:004546A7 E824B40200              call 0047FAD0
:004546AC 83C408                  add esp, 00000008
:004546AF 8845FC                  mov byte ptr [ebp-04], al
:004546B2 C645F005                mov [ebp-10], 05
:004546B6 8A4DF0                  mov cl, byte ptr [ebp-10]
:004546B9 884DF4                  mov byte ptr [ebp-0C], cl
:004546BC EB0A                    jmp 004546C8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00454652(C), :00454660(U)
|
:004546BE C645F001                mov [ebp-10], 01
:004546C2 8A55F0                  mov dl, byte ptr [ebp-10]
:004546C5 8855F4                  mov byte ptr [ebp-0C], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045468E(U), :004546BC(U)
|
:004546C8 8B45F8                  mov eax, dword ptr [ebp-08]
:004546CB 25FF000000              and eax, 000000FF
:004546D0 3DFF000000              cmp eax, 000000FF
:004546D5 7429                    je 00454700
:004546D7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004546DA 81E1FF000000            and ecx, 000000FF
:004546E0 81F9FF000000            cmp ecx, 000000FF
:004546E6 7418                    je 00454700
:004546E8 8A55F0                  mov dl, byte ptr [ebp-10]
:004546EB 52                      push edx
:004546EC 8A45F4                  mov al, byte ptr [ebp-0C]
:004546EF 50                      push eax
:004546F0 8A4DFC                  mov cl, byte ptr [ebp-04]
:004546F3 51                      push ecx
:004546F4 8A55F8                  mov dl, byte ptr [ebp-08]
:004546F7 52                      push edx
:004546F8 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004546FB E848F4FFFF              call 00453B48

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004546D5(C), :004546E6(C)
|
:00454700 E87D210200              call 00476882
:00454705 8BE5                    mov esp, ebp
:00454707 5D                      pop ebp
:00454708 C3                      ret



* Referenced by a CALL at Addresses:
|:0044E208   , :004542A8   
|
:00454709 55                      push ebp
:0045470A 8BEC                    mov ebp, esp
:0045470C 83EC34                  sub esp, 00000034
:0045470F 56                      push esi
:00454710 894DCC                  mov dword ptr [ebp-34], ecx
:00454713 C745E400000000          mov [ebp-1C], 00000000
:0045471A C645E800                mov [ebp-18], 00
:0045471E C645DC00                mov [ebp-24], 00
:00454722 C645D400                mov [ebp-2C], 00
:00454726 8D4DD0                  lea ecx, dword ptr [ebp-30]
:00454729 E8E2AF0000              call 0045F710
:0045472E 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00454731 E8CDF8FFFF              call 00454003
:00454736 50                      push eax
:00454737 8D4DD0                  lea ecx, dword ptr [ebp-30]
:0045473A E8611EFBFF              call 004065A0
:0045473F 8D45F0                  lea eax, dword ptr [ebp-10]
:00454742 50                      push eax
:00454743 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:00454749 51                      push ecx
:0045474A FF15EC624800            call dword ptr [004862EC]
:00454750 E8017A0200              call 0047C156
:00454755 85C0                    test eax, eax
:00454757 7412                    je 0045476B
:00454759 6A0C                    push 0000000C
:0045475B E8BB70FDFF              call 0042B81B
:00454760 83C404                  add esp, 00000004
:00454763 8B45E4                  mov eax, dword ptr [ebp-1C]
:00454766 E90E040000              jmp 00454B79

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454757(C)
|
:0045476B 8B55CC                  mov edx, dword ptr [ebp-34]
:0045476E 8B82701B0000            mov eax, dword ptr [edx+00001B70]
:00454774 3B45F0                  cmp eax, dword ptr [ebp-10]
:00454777 7E3D                    jle 004547B6
:00454779 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0045477C 8B91701B0000            mov edx, dword ptr [ecx+00001B70]
:00454782 3B55F8                  cmp edx, dword ptr [ebp-08]
:00454785 7D2F                    jge 004547B6
:00454787 8B45CC                  mov eax, dword ptr [ebp-34]
:0045478A 83B8741B000004          cmp dword ptr [eax+00001B74], 00000004
:00454791 7C23                    jl 004547B6
:00454793 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00454796 8B55CC                  mov edx, dword ptr [ebp-34]
:00454799 8B81741B0000            mov eax, dword ptr [ecx+00001B74]
:0045479F 3B4240                  cmp eax, dword ptr [edx+40]
:004547A2 7D12                    jge 004547B6
:004547A4 6A0C                    push 0000000C
:004547A6 E87070FDFF              call 0042B81B
:004547AB 83C404                  add esp, 00000004
:004547AE 8B45E4                  mov eax, dword ptr [ebp-1C]
:004547B1 E9C3030000              jmp 00454B79

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00454777(C), :00454785(C), :00454791(C), :004547A2(C)
|
:004547B6 FF1560624800            call dword ptr [00486260]
:004547BC 3905686A4B00            cmp dword ptr [004B6A68], eax
:004547C2 7408                    je 004547CC
:004547C4 8B45E4                  mov eax, dword ptr [ebp-1C]
:004547C7 E9AD030000              jmp 00454B79

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004547C2(C)
|
:004547CC 8B4DCC                  mov ecx, dword ptr [ebp-34]
:004547CF 8B55CC                  mov edx, dword ptr [ebp-34]
:004547D2 8B81701B0000            mov eax, dword ptr [ecx+00001B70]
:004547D8 3B423C                  cmp eax, dword ptr [edx+3C]
:004547DB 7C49                    jl 00454826
:004547DD 8B4DCC                  mov ecx, dword ptr [ebp-34]
:004547E0 8B513C                  mov edx, dword ptr [ecx+3C]
:004547E3 83C230                  add edx, 00000030
:004547E6 8B45CC                  mov eax, dword ptr [ebp-34]
:004547E9 3990701B0000            cmp dword ptr [eax+00001B70], edx
:004547EF 7D35                    jge 00454826
:004547F1 8B4DCC                  mov ecx, dword ptr [ebp-34]
:004547F4 8B55CC                  mov edx, dword ptr [ebp-34]
:004547F7 8B81741B0000            mov eax, dword ptr [ecx+00001B74]
:004547FD 3B4240                  cmp eax, dword ptr [edx+40]
:00454800 7C24                    jl 00454826
:00454802 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00454805 8B5140                  mov edx, dword ptr [ecx+40]
:00454808 8B45CC                  mov eax, dword ptr [ebp-34]
:0045480B 035014                  add edx, dword ptr [eax+14]
:0045480E 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00454811 3991741B0000            cmp dword ptr [ecx+00001B74], edx
:00454817 7D0D                    jge 00454826
:00454819 8B55CC                  mov edx, dword ptr [ebp-34]
:0045481C 837A0400                cmp dword ptr [edx+04], 00000000
:00454820 7E04                    jle 00454826
:00454822 C645DC06                mov [ebp-24], 06

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004547DB(C), :004547EF(C), :00454800(C), :00454817(C), :00454820(C)
|
:00454826 8B45CC                  mov eax, dword ptr [ebp-34]
:00454829 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0045482C 8B90741B0000            mov edx, dword ptr [eax+00001B74]
:00454832 3B5140                  cmp edx, dword ptr [ecx+40]
:00454835 7C49                    jl 00454880
:00454837 8B45CC                  mov eax, dword ptr [ebp-34]
:0045483A 8B4840                  mov ecx, dword ptr [eax+40]
:0045483D 83C130                  add ecx, 00000030
:00454840 8B55CC                  mov edx, dword ptr [ebp-34]
:00454843 398A741B0000            cmp dword ptr [edx+00001B74], ecx
:00454849 7D35                    jge 00454880
:0045484B 8B45CC                  mov eax, dword ptr [ebp-34]
:0045484E 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00454851 8B90701B0000            mov edx, dword ptr [eax+00001B70]
:00454857 3B513C                  cmp edx, dword ptr [ecx+3C]
:0045485A 7C24                    jl 00454880
:0045485C 8B45CC                  mov eax, dword ptr [ebp-34]
:0045485F 8B483C                  mov ecx, dword ptr [eax+3C]
:00454862 8B55CC                  mov edx, dword ptr [ebp-34]
:00454865 034A14                  add ecx, dword ptr [edx+14]
:00454868 8B45CC                  mov eax, dword ptr [ebp-34]
:0045486B 3988701B0000            cmp dword ptr [eax+00001B70], ecx
:00454871 7D0D                    jge 00454880
:00454873 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00454876 83790800                cmp dword ptr [ecx+08], 00000000
:0045487A 7E04                    jle 00454880
:0045487C C645D404                mov [ebp-2C], 04

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00454835(C), :00454849(C), :0045485A(C), :00454871(C), :0045487A(C)
|
:00454880 8B55CC                  mov edx, dword ptr [ebp-34]
:00454883 8B423C                  mov eax, dword ptr [edx+3C]
:00454886 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00454889 8B5114                  mov edx, dword ptr [ecx+14]
:0045488C 8D4410D0                lea eax, dword ptr [eax+edx-30]
:00454890 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00454893 3981701B0000            cmp dword ptr [ecx+00001B70], eax
:00454899 7C5C                    jl 004548F7
:0045489B 8B55CC                  mov edx, dword ptr [ebp-34]
:0045489E 8B423C                  mov eax, dword ptr [edx+3C]
:004548A1 8B4DCC                  mov ecx, dword ptr [ebp-34]
:004548A4 034114                  add eax, dword ptr [ecx+14]
:004548A7 8B55CC                  mov edx, dword ptr [ebp-34]
:004548AA 3982701B0000            cmp dword ptr [edx+00001B70], eax
:004548B0 7D45                    jge 004548F7
:004548B2 8B45CC                  mov eax, dword ptr [ebp-34]
:004548B5 8B4DCC                  mov ecx, dword ptr [ebp-34]
:004548B8 8B90741B0000            mov edx, dword ptr [eax+00001B74]
:004548BE 3B5140                  cmp edx, dword ptr [ecx+40]
:004548C1 7C34                    jl 004548F7
:004548C3 8B45CC                  mov eax, dword ptr [ebp-34]
:004548C6 8B4840                  mov ecx, dword ptr [eax+40]
:004548C9 8B55CC                  mov edx, dword ptr [ebp-34]
:004548CC 034A18                  add ecx, dword ptr [edx+18]
:004548CF 8B45CC                  mov eax, dword ptr [ebp-34]
:004548D2 3988741B0000            cmp dword ptr [eax+00001B74], ecx
:004548D8 7D1D                    jge 004548F7
:004548DA 33C9                    xor ecx, ecx
:004548DC 8A0D2C424B00            mov cl, byte ptr [004B422C]
:004548E2 6BC930                  imul ecx, 00000030
:004548E5 8B55CC                  mov edx, dword ptr [ebp-34]
:004548E8 2B4A14                  sub ecx, dword ptr [edx+14]
:004548EB 8B45CC                  mov eax, dword ptr [ebp-34]
:004548EE 394804                  cmp dword ptr [eax+04], ecx
:004548F1 7D04                    jge 004548F7
:004548F3 C645DC02                mov [ebp-24], 02

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00454899(C), :004548B0(C), :004548C1(C), :004548D8(C), :004548F1(C)
|
:004548F7 8B4DCC                  mov ecx, dword ptr [ebp-34]
:004548FA 8B5140                  mov edx, dword ptr [ecx+40]
:004548FD 8B45CC                  mov eax, dword ptr [ebp-34]
:00454900 8B4818                  mov ecx, dword ptr [eax+18]
:00454903 8D540AD0                lea edx, dword ptr [edx+ecx-30]
:00454907 8B45CC                  mov eax, dword ptr [ebp-34]
:0045490A 3990741B0000            cmp dword ptr [eax+00001B74], edx
:00454910 7C5B                    jl 0045496D
:00454912 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00454915 8B5140                  mov edx, dword ptr [ecx+40]
:00454918 8B45CC                  mov eax, dword ptr [ebp-34]
:0045491B 035018                  add edx, dword ptr [eax+18]
:0045491E 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00454921 3991741B0000            cmp dword ptr [ecx+00001B74], edx
:00454927 7D44                    jge 0045496D
:00454929 8B55CC                  mov edx, dword ptr [ebp-34]
:0045492C 8B45CC                  mov eax, dword ptr [ebp-34]
:0045492F 8B8A701B0000            mov ecx, dword ptr [edx+00001B70]
:00454935 3B483C                  cmp ecx, dword ptr [eax+3C]
:00454938 7C33                    jl 0045496D
:0045493A 8B55CC                  mov edx, dword ptr [ebp-34]
:0045493D 8B423C                  mov eax, dword ptr [edx+3C]
:00454940 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00454943 034114                  add eax, dword ptr [ecx+14]
:00454946 8B55CC                  mov edx, dword ptr [ebp-34]
:00454949 3982701B0000            cmp dword ptr [edx+00001B70], eax
:0045494F 7D1C                    jge 0045496D
:00454951 33C0                    xor eax, eax
:00454953 A02D424B00              mov al, byte ptr [004B422D]
:00454958 6BC030                  imul eax, 00000030
:0045495B 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0045495E 2B4118                  sub eax, dword ptr [ecx+18]
:00454961 8B55CC                  mov edx, dword ptr [ebp-34]
:00454964 394208                  cmp dword ptr [edx+08], eax
:00454967 7D04                    jge 0045496D
:00454969 C645D408                mov [ebp-2C], 08

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00454910(C), :00454927(C), :00454938(C), :0045494F(C), :00454967(C)
|
:0045496D 8B45DC                  mov eax, dword ptr [ebp-24]
:00454970 25FF000000              and eax, 000000FF
:00454975 85C0                    test eax, eax
:00454977 7508                    jne 00454981
:00454979 8A4DD4                  mov cl, byte ptr [ebp-2C]
:0045497C 884DE8                  mov byte ptr [ebp-18], cl
:0045497F EB52                    jmp 004549D3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454977(C)
|
:00454981 8B55D4                  mov edx, dword ptr [ebp-2C]
:00454984 81E2FF000000            and edx, 000000FF
:0045498A 85D2                    test edx, edx
:0045498C 7508                    jne 00454996
:0045498E 8A45DC                  mov al, byte ptr [ebp-24]
:00454991 8845E8                  mov byte ptr [ebp-18], al
:00454994 EB3D                    jmp 004549D3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045498C(C)
|
:00454996 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00454999 81E1FF000000            and ecx, 000000FF
:0045499F 83F908                  cmp ecx, 00000008
:004549A2 7514                    jne 004549B8
:004549A4 8B55DC                  mov edx, dword ptr [ebp-24]
:004549A7 81E2FF000000            and edx, 000000FF
:004549AD 83FA02                  cmp edx, 00000002
:004549B0 7506                    jne 004549B8
:004549B2 C645E809                mov [ebp-18], 09
:004549B6 EB1B                    jmp 004549D3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004549A2(C), :004549B0(C)
|
:004549B8 8B45DC                  mov eax, dword ptr [ebp-24]
:004549BB 25FF000000              and eax, 000000FF
:004549C0 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:004549C3 81E1FF000000            and ecx, 000000FF
:004549C9 03C1                    add eax, ecx
:004549CB 99                      cdq
:004549CC 2BC2                    sub eax, edx
:004549CE D1F8                    sar eax, 1
:004549D0 8845E8                  mov byte ptr [ebp-18], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045497F(U), :00454994(U), :004549B6(U)
|
:004549D3 8B55E8                  mov edx, dword ptr [ebp-18]
:004549D6 81E2FF000000            and edx, 000000FF
:004549DC 52                      push edx
:004549DD E8396EFDFF              call 0042B81B
:004549E2 83C404                  add esp, 00000004
:004549E5 8A45E8                  mov al, byte ptr [ebp-18]
:004549E8 A234424B00              mov byte ptr [004B4234], al
:004549ED 8B4DCC                  mov ecx, dword ptr [ebp-34]
:004549F0 8B4104                  mov eax, dword ptr [ecx+04]
:004549F3 99                      cdq
:004549F4 B930000000              mov ecx, 00000030
:004549F9 F7F9                    idiv ecx
:004549FB 8945E0                  mov dword ptr [ebp-20], eax
:004549FE 8B55CC                  mov edx, dword ptr [ebp-34]
:00454A01 8B4208                  mov eax, dword ptr [edx+08]
:00454A04 99                      cdq
:00454A05 B930000000              mov ecx, 00000030
:00454A0A F7F9                    idiv ecx
:00454A0C 8945D8                  mov dword ptr [ebp-28], eax
:00454A0F E8577BFDFF              call 0042C56B
:00454A14 83F801                  cmp eax, 00000001
:00454A17 7506                    jne 00454A1F
:00454A19 C645EC08                mov [ebp-14], 08
:00454A1D EB04                    jmp 00454A23

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454A17(C)
|
:00454A1F C645EC01                mov [ebp-14], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454A1D(U)
|
:00454A23 8B55E8                  mov edx, dword ptr [ebp-18]
:00454A26 81E2FF000000            and edx, 000000FF
:00454A2C 85D2                    test edx, edx
:00454A2E 0F8411010000            je 00454B45
:00454A34 8B45DC                  mov eax, dword ptr [ebp-24]
:00454A37 25FF000000              and eax, 000000FF
:00454A3C 83F802                  cmp eax, 00000002
:00454A3F 754D                    jne 00454A8E
:00454A41 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00454A44 81E1FF000000            and ecx, 000000FF
:00454A4A 8B55E0                  mov edx, dword ptr [ebp-20]
:00454A4D 03D1                    add edx, ecx
:00454A4F 8955E0                  mov dword ptr [ebp-20], edx
:00454A52 33C0                    xor eax, eax
:00454A54 A02C424B00              mov al, byte ptr [004B422C]
:00454A59 8BC8                    mov ecx, eax
:00454A5B 8B55CC                  mov edx, dword ptr [ebp-34]
:00454A5E 8B4214                  mov eax, dword ptr [edx+14]
:00454A61 99                      cdq
:00454A62 BE30000000              mov esi, 00000030
:00454A67 F7FE                    idiv esi
:00454A69 2BC8                    sub ecx, eax
:00454A6B 394DE0                  cmp dword ptr [ebp-20], ecx
:00454A6E 7E1C                    jle 00454A8C
:00454A70 33C0                    xor eax, eax
:00454A72 A02C424B00              mov al, byte ptr [004B422C]
:00454A77 8BC8                    mov ecx, eax
:00454A79 8B55CC                  mov edx, dword ptr [ebp-34]
:00454A7C 8B4214                  mov eax, dword ptr [edx+14]
:00454A7F 99                      cdq
:00454A80 BE30000000              mov esi, 00000030
:00454A85 F7FE                    idiv esi
:00454A87 2BC8                    sub ecx, eax
:00454A89 894DE0                  mov dword ptr [ebp-20], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454A6E(C)
|
:00454A8C EB2B                    jmp 00454AB9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454A3F(C)
|
:00454A8E 8B45DC                  mov eax, dword ptr [ebp-24]
:00454A91 25FF000000              and eax, 000000FF
:00454A96 83F806                  cmp eax, 00000006
:00454A99 751E                    jne 00454AB9
:00454A9B 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00454A9E 81E1FF000000            and ecx, 000000FF
:00454AA4 8B55E0                  mov edx, dword ptr [ebp-20]
:00454AA7 2BD1                    sub edx, ecx
:00454AA9 8955E0                  mov dword ptr [ebp-20], edx
:00454AAC 837DE000                cmp dword ptr [ebp-20], 00000000
:00454AB0 7D07                    jge 00454AB9
:00454AB2 C745E000000000          mov [ebp-20], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00454A8C(U), :00454A99(C), :00454AB0(C)
|
:00454AB9 8B45D4                  mov eax, dword ptr [ebp-2C]
:00454ABC 25FF000000              and eax, 000000FF
:00454AC1 83F808                  cmp eax, 00000008
:00454AC4 754D                    jne 00454B13
:00454AC6 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00454AC9 81E1FF000000            and ecx, 000000FF
:00454ACF 8B55D8                  mov edx, dword ptr [ebp-28]
:00454AD2 03D1                    add edx, ecx
:00454AD4 8955D8                  mov dword ptr [ebp-28], edx
:00454AD7 33C0                    xor eax, eax
:00454AD9 A02D424B00              mov al, byte ptr [004B422D]
:00454ADE 8BC8                    mov ecx, eax
:00454AE0 8B55CC                  mov edx, dword ptr [ebp-34]
:00454AE3 8B4218                  mov eax, dword ptr [edx+18]
:00454AE6 99                      cdq
:00454AE7 BE30000000              mov esi, 00000030
:00454AEC F7FE                    idiv esi
:00454AEE 2BC8                    sub ecx, eax
:00454AF0 394DD8                  cmp dword ptr [ebp-28], ecx
:00454AF3 7E1C                    jle 00454B11
:00454AF5 33C0                    xor eax, eax
:00454AF7 A02D424B00              mov al, byte ptr [004B422D]
:00454AFC 8BC8                    mov ecx, eax
:00454AFE 8B55CC                  mov edx, dword ptr [ebp-34]
:00454B01 8B4218                  mov eax, dword ptr [edx+18]
:00454B04 99                      cdq
:00454B05 BE30000000              mov esi, 00000030
:00454B0A F7FE                    idiv esi
:00454B0C 2BC8                    sub ecx, eax
:00454B0E 894DD8                  mov dword ptr [ebp-28], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454AF3(C)
|
:00454B11 EB2B                    jmp 00454B3E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454AC4(C)
|
:00454B13 8B45D4                  mov eax, dword ptr [ebp-2C]
:00454B16 25FF000000              and eax, 000000FF
:00454B1B 83F804                  cmp eax, 00000004
:00454B1E 751E                    jne 00454B3E
:00454B20 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00454B23 81E1FF000000            and ecx, 000000FF
:00454B29 8B55D8                  mov edx, dword ptr [ebp-28]
:00454B2C 2BD1                    sub edx, ecx
:00454B2E 8955D8                  mov dword ptr [ebp-28], edx
:00454B31 837DD800                cmp dword ptr [ebp-28], 00000000
:00454B35 7D07                    jge 00454B3E
:00454B37 C745D800000000          mov [ebp-28], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00454B11(U), :00454B1E(C), :00454B35(C)
|
:00454B3E C745E401000000          mov [ebp-1C], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454A2E(C)
|
:00454B45 837DE400                cmp dword ptr [ebp-1C], 00000000
:00454B49 742B                    je 00454B76
:00454B4B 6A02                    push 00000002
:00454B4D B9181B4B00              mov ecx, 004B1B18
:00454B52 E8E9E7FAFF              call 00403340
:00454B57 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00454B5A E8D3F2FFFF              call 00453E32
:00454B5F 6A00                    push 00000000
:00454B61 8B45D8                  mov eax, dword ptr [ebp-28]
:00454B64 50                      push eax
:00454B65 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00454B68 51                      push ecx
:00454B69 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00454B6C E80D000000              call 00454B7E
:00454B71 E86A79FDFF              call 0042C4E0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454B49(C)
|
:00454B76 8B45E4                  mov eax, dword ptr [ebp-1C]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00454766(U), :004547B1(U), :004547C7(U)
|
:00454B79 5E                      pop esi
:00454B7A 8BE5                    mov esp, ebp
:00454B7C 5D                      pop ebp
:00454B7D C3                      ret



* Referenced by a CALL at Addresses:
|:0044219C   , :00442225   , :004422B8   , :00442343   , :00454B6C   
|:00454F00   , :0047C0C8   
|
:00454B7E 55                      push ebp
:00454B7F 8BEC                    mov ebp, esp
:00454B81 83EC14                  sub esp, 00000014
:00454B84 894DEC                  mov dword ptr [ebp-14], ecx
:00454B87 8B4508                  mov eax, dword ptr [ebp+08]
:00454B8A 8945F4                  mov dword ptr [ebp-0C], eax
:00454B8D 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00454B90 894DF0                  mov dword ptr [ebp-10], ecx
:00454B93 8B5510                  mov edx, dword ptr [ebp+10]
:00454B96 81E2FF000000            and edx, 000000FF
:00454B9C 83FA01                  cmp edx, 00000001
:00454B9F 0F85DE000000            jne 00454C83
:00454BA5 8B45EC                  mov eax, dword ptr [ebp-14]
:00454BA8 8B4014                  mov eax, dword ptr [eax+14]
:00454BAB 99                      cdq
:00454BAC 83E20F                  and edx, 0000000F
:00454BAF 03C2                    add eax, edx
:00454BB1 C1F804                  sar eax, 04
:00454BB4 8B4D08                  mov ecx, dword ptr [ebp+08]
:00454BB7 2BC8                    sub ecx, eax
:00454BB9 894DF4                  mov dword ptr [ebp-0C], ecx
:00454BBC 8B55EC                  mov edx, dword ptr [ebp-14]
:00454BBF 8B4218                  mov eax, dword ptr [edx+18]
:00454BC2 99                      cdq
:00454BC3 83E20F                  and edx, 0000000F
:00454BC6 03C2                    add eax, edx
:00454BC8 C1F804                  sar eax, 04
:00454BCB 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00454BCE 2BC8                    sub ecx, eax
:00454BD0 894DF0                  mov dword ptr [ebp-10], ecx
:00454BD3 837DF400                cmp dword ptr [ebp-0C], 00000000
:00454BD7 7D07                    jge 00454BE0
:00454BD9 C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454BD7(C)
|
:00454BE0 837DF000                cmp dword ptr [ebp-10], 00000000
:00454BE4 7D07                    jge 00454BED
:00454BE6 C745F000000000          mov [ebp-10], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454BE4(C)
|
:00454BED 8B55EC                  mov edx, dword ptr [ebp-14]
:00454BF0 8B4214                  mov eax, dword ptr [edx+14]
:00454BF3 99                      cdq
:00454BF4 83E20F                  and edx, 0000000F
:00454BF7 03C2                    add eax, edx
:00454BF9 C1F804                  sar eax, 04
:00454BFC 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00454BFF 03C8                    add ecx, eax
:00454C01 33D2                    xor edx, edx
:00454C03 8A152C424B00            mov dl, byte ptr [004B422C]
:00454C09 6BD203                  imul edx, 00000003
:00454C0C 3BCA                    cmp ecx, edx
:00454C0E 7E29                    jle 00454C39
:00454C10 8B45EC                  mov eax, dword ptr [ebp-14]
:00454C13 8B4014                  mov eax, dword ptr [eax+14]
:00454C16 99                      cdq
:00454C17 83E20F                  and edx, 0000000F
:00454C1A 03C2                    add eax, edx
:00454C1C C1F804                  sar eax, 04
:00454C1F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00454C22 03C8                    add ecx, eax
:00454C24 33D2                    xor edx, edx
:00454C26 8A152C424B00            mov dl, byte ptr [004B422C]
:00454C2C 6BD203                  imul edx, 00000003
:00454C2F 2BCA                    sub ecx, edx
:00454C31 8B45F4                  mov eax, dword ptr [ebp-0C]
:00454C34 2BC1                    sub eax, ecx
:00454C36 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454C0E(C)
|
:00454C39 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00454C3C 8B4118                  mov eax, dword ptr [ecx+18]
:00454C3F 99                      cdq
:00454C40 83E20F                  and edx, 0000000F
:00454C43 03C2                    add eax, edx
:00454C45 C1F804                  sar eax, 04
:00454C48 8B55F0                  mov edx, dword ptr [ebp-10]
:00454C4B 03D0                    add edx, eax
:00454C4D 33C0                    xor eax, eax
:00454C4F A02D424B00              mov al, byte ptr [004B422D]
:00454C54 6BC003                  imul eax, 00000003
:00454C57 3BD0                    cmp edx, eax
:00454C59 7E28                    jle 00454C83
:00454C5B 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00454C5E 8B4118                  mov eax, dword ptr [ecx+18]
:00454C61 99                      cdq
:00454C62 83E20F                  and edx, 0000000F
:00454C65 03C2                    add eax, edx
:00454C67 C1F804                  sar eax, 04
:00454C6A 8B55F0                  mov edx, dword ptr [ebp-10]
:00454C6D 03D0                    add edx, eax
:00454C6F 33C0                    xor eax, eax
:00454C71 A02D424B00              mov al, byte ptr [004B422D]
:00454C76 6BC003                  imul eax, 00000003
:00454C79 2BD0                    sub edx, eax
:00454C7B 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00454C7E 2BCA                    sub ecx, edx
:00454C80 894DF0                  mov dword ptr [ebp-10], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00454B9F(C), :00454C59(C)
|
:00454C83 8B55F4                  mov edx, dword ptr [ebp-0C]
:00454C86 6BD230                  imul edx, 00000030
:00454C89 8955F8                  mov dword ptr [ebp-08], edx
:00454C8C 8B45F0                  mov eax, dword ptr [ebp-10]
:00454C8F 6BC030                  imul eax, 00000030
:00454C92 8945FC                  mov dword ptr [ebp-04], eax
:00454C95 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00454C98 8B5104                  mov edx, dword ptr [ecx+04]
:00454C9B 3B55F8                  cmp edx, dword ptr [ebp-08]
:00454C9E 750B                    jne 00454CAB
:00454CA0 8B45EC                  mov eax, dword ptr [ebp-14]
:00454CA3 8B4808                  mov ecx, dword ptr [eax+08]
:00454CA6 3B4DFC                  cmp ecx, dword ptr [ebp-04]
:00454CA9 7424                    je 00454CCF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454C9E(C)
|
:00454CAB E82B99FCFF              call 0041E5DB
:00454CB0 8B55EC                  mov edx, dword ptr [ebp-14]
:00454CB3 8B45F8                  mov eax, dword ptr [ebp-08]
:00454CB6 894204                  mov dword ptr [edx+04], eax
:00454CB9 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00454CBC 8B55FC                  mov edx, dword ptr [ebp-04]
:00454CBF 895108                  mov dword ptr [ecx+08], edx
:00454CC2 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00454CC5 E849EEFFFF              call 00453B13
:00454CCA E82799FCFF              call 0041E5F6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454CA9(C)
|
:00454CCF A1D85F4B00              mov eax, dword ptr [004B5FD8]
:00454CD4 50                      push eax
:00454CD5 FF15C8624800            call dword ptr [004862C8]
:00454CDB 85C0                    test eax, eax
:00454CDD 740A                    je 00454CE9
:00454CDF B9083D4B00              mov ecx, 004B3D08
:00454CE4 E8F259FFFF              call 0044A6DB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454CDD(C)
|
:00454CE9 8BE5                    mov esp, ebp
:00454CEB 5D                      pop ebp
:00454CEC C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:00455033   , :00455118   , :0045528D   , :00455764   
|
:00454CEF 55                      push ebp
:00454CF0 8BEC                    mov ebp, esp
:00454CF2 83EC2C                  sub esp, 0000002C
:00454CF5 894DE4                  mov dword ptr [ebp-1C], ecx
:00454CF8 8B45E4                  mov eax, dword ptr [ebp-1C]
:00454CFB 8B4004                  mov eax, dword ptr [eax+04]
:00454CFE 99                      cdq
:00454CFF B930000000              mov ecx, 00000030
:00454D04 F7F9                    idiv ecx
:00454D06 8845F0                  mov byte ptr [ebp-10], al
:00454D09 8B55E4                  mov edx, dword ptr [ebp-1C]
:00454D0C 8B4208                  mov eax, dword ptr [edx+08]
:00454D0F 99                      cdq
:00454D10 B930000000              mov ecx, 00000030
:00454D15 F7F9                    idiv ecx
:00454D17 8845F4                  mov byte ptr [ebp-0C], al
:00454D1A 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00454D1D E8FAF8FFFF              call 0045461C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454F05(U)
|
:00454D22 8B55F0                  mov edx, dword ptr [ebp-10]
:00454D25 81E2FF000000            and edx, 000000FF
:00454D2B 8B4508                  mov eax, dword ptr [ebp+08]
:00454D2E 25FF000000              and eax, 000000FF
:00454D33 3BD0                    cmp edx, eax
:00454D35 751A                    jne 00454D51
:00454D37 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00454D3A 81E1FF000000            and ecx, 000000FF
:00454D40 8B550C                  mov edx, dword ptr [ebp+0C]
:00454D43 81E2FF000000            and edx, 000000FF
:00454D49 3BCA                    cmp ecx, edx
:00454D4B 0F84B9010000            je 00454F0A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454D35(C)
|
:00454D51 8B45F0                  mov eax, dword ptr [ebp-10]
:00454D54 25FF000000              and eax, 000000FF
:00454D59 8B4D08                  mov ecx, dword ptr [ebp+08]
:00454D5C 81E1FF000000            and ecx, 000000FF
:00454D62 2BC1                    sub eax, ecx
:00454D64 85C0                    test eax, eax
:00454D66 7C18                    jl 00454D80
:00454D68 8B55F0                  mov edx, dword ptr [ebp-10]
:00454D6B 81E2FF000000            and edx, 000000FF
:00454D71 8B4508                  mov eax, dword ptr [ebp+08]
:00454D74 25FF000000              and eax, 000000FF
:00454D79 2BD0                    sub edx, eax
:00454D7B 8955E0                  mov dword ptr [ebp-20], edx
:00454D7E EB19                    jmp 00454D99

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454D66(C)
|
:00454D80 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00454D83 81E1FF000000            and ecx, 000000FF
:00454D89 8B5508                  mov edx, dword ptr [ebp+08]
:00454D8C 81E2FF000000            and edx, 000000FF
:00454D92 2BCA                    sub ecx, edx
:00454D94 F7D9                    neg ecx
:00454D96 894DE0                  mov dword ptr [ebp-20], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454D7E(U)
|
:00454D99 8A45E0                  mov al, byte ptr [ebp-20]
:00454D9C 8845FC                  mov byte ptr [ebp-04], al
:00454D9F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00454DA2 81E1FF000000            and ecx, 000000FF
:00454DA8 8B550C                  mov edx, dword ptr [ebp+0C]
:00454DAB 81E2FF000000            and edx, 000000FF
:00454DB1 2BCA                    sub ecx, edx
:00454DB3 85C9                    test ecx, ecx
:00454DB5 7C18                    jl 00454DCF
:00454DB7 8B45F4                  mov eax, dword ptr [ebp-0C]
:00454DBA 25FF000000              and eax, 000000FF
:00454DBF 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00454DC2 81E1FF000000            and ecx, 000000FF
:00454DC8 2BC1                    sub eax, ecx
:00454DCA 8945DC                  mov dword ptr [ebp-24], eax
:00454DCD EB18                    jmp 00454DE7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454DB5(C)
|
:00454DCF 8B55F4                  mov edx, dword ptr [ebp-0C]
:00454DD2 81E2FF000000            and edx, 000000FF
:00454DD8 8B450C                  mov eax, dword ptr [ebp+0C]
:00454DDB 25FF000000              and eax, 000000FF
:00454DE0 2BD0                    sub edx, eax
:00454DE2 F7DA                    neg edx
:00454DE4 8955DC                  mov dword ptr [ebp-24], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454DCD(U)
|
:00454DE7 8A4DDC                  mov cl, byte ptr [ebp-24]
:00454DEA 884DF8                  mov byte ptr [ebp-08], cl
:00454DED 8B45FC                  mov eax, dword ptr [ebp-04]
:00454DF0 25FF000000              and eax, 000000FF
:00454DF5 99                      cdq
:00454DF6 83E203                  and edx, 00000003
:00454DF9 03C2                    add eax, edx
:00454DFB C1F802                  sar eax, 02
:00454DFE 83C001                  add eax, 00000001
:00454E01 83F804                  cmp eax, 00000004
:00454E04 7E09                    jle 00454E0F
:00454E06 C745D804000000          mov [ebp-28], 00000004
:00454E0D EB17                    jmp 00454E26

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454E04(C)
|
:00454E0F 8B45FC                  mov eax, dword ptr [ebp-04]
:00454E12 25FF000000              and eax, 000000FF
:00454E17 99                      cdq
:00454E18 83E203                  and edx, 00000003
:00454E1B 03C2                    add eax, edx
:00454E1D C1F802                  sar eax, 02
:00454E20 83C001                  add eax, 00000001
:00454E23 8945D8                  mov dword ptr [ebp-28], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454E0D(U)
|
:00454E26 8A55D8                  mov dl, byte ptr [ebp-28]
:00454E29 8855EC                  mov byte ptr [ebp-14], dl
:00454E2C 8B45F8                  mov eax, dword ptr [ebp-08]
:00454E2F 25FF000000              and eax, 000000FF
:00454E34 99                      cdq
:00454E35 83E203                  and edx, 00000003
:00454E38 03C2                    add eax, edx
:00454E3A C1F802                  sar eax, 02
:00454E3D 83C001                  add eax, 00000001
:00454E40 83F804                  cmp eax, 00000004
:00454E43 7E09                    jle 00454E4E
:00454E45 C745D404000000          mov [ebp-2C], 00000004
:00454E4C EB17                    jmp 00454E65

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454E43(C)
|
:00454E4E 8B45F8                  mov eax, dword ptr [ebp-08]
:00454E51 25FF000000              and eax, 000000FF
:00454E56 99                      cdq
:00454E57 83E203                  and edx, 00000003
:00454E5A 03C2                    add eax, edx
:00454E5C C1F802                  sar eax, 02
:00454E5F 83C001                  add eax, 00000001
:00454E62 8945D4                  mov dword ptr [ebp-2C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454E4C(U)
|
:00454E65 8A45D4                  mov al, byte ptr [ebp-2C]
:00454E68 8845E8                  mov byte ptr [ebp-18], al
:00454E6B 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00454E6E 81E1FF000000            and ecx, 000000FF
:00454E74 8B5508                  mov edx, dword ptr [ebp+08]
:00454E77 81E2FF000000            and edx, 000000FF
:00454E7D 3BCA                    cmp ecx, edx
:00454E7F 7D09                    jge 00454E8A
:00454E81 8A45F0                  mov al, byte ptr [ebp-10]
:00454E84 0245EC                  add al, byte ptr [ebp-14]
:00454E87 8845F0                  mov byte ptr [ebp-10], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454E7F(C)
|
:00454E8A 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00454E8D 81E1FF000000            and ecx, 000000FF
:00454E93 8B5508                  mov edx, dword ptr [ebp+08]
:00454E96 81E2FF000000            and edx, 000000FF
:00454E9C 3BCA                    cmp ecx, edx
:00454E9E 7E09                    jle 00454EA9
:00454EA0 8A45F0                  mov al, byte ptr [ebp-10]
:00454EA3 2A45EC                  sub al, byte ptr [ebp-14]
:00454EA6 8845F0                  mov byte ptr [ebp-10], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454E9E(C)
|
:00454EA9 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00454EAC 81E1FF000000            and ecx, 000000FF
:00454EB2 8B550C                  mov edx, dword ptr [ebp+0C]
:00454EB5 81E2FF000000            and edx, 000000FF
:00454EBB 3BCA                    cmp ecx, edx
:00454EBD 7D09                    jge 00454EC8
:00454EBF 8A45F4                  mov al, byte ptr [ebp-0C]
:00454EC2 0245E8                  add al, byte ptr [ebp-18]
:00454EC5 8845F4                  mov byte ptr [ebp-0C], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454EBD(C)
|
:00454EC8 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00454ECB 81E1FF000000            and ecx, 000000FF
:00454ED1 8B550C                  mov edx, dword ptr [ebp+0C]
:00454ED4 81E2FF000000            and edx, 000000FF
:00454EDA 3BCA                    cmp ecx, edx
:00454EDC 7E09                    jle 00454EE7
:00454EDE 8A45F4                  mov al, byte ptr [ebp-0C]
:00454EE1 2A45E8                  sub al, byte ptr [ebp-18]
:00454EE4 8845F4                  mov byte ptr [ebp-0C], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454EDC(C)
|
:00454EE7 6A00                    push 00000000
:00454EE9 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00454EEC 81E1FF000000            and ecx, 000000FF
:00454EF2 51                      push ecx
:00454EF3 8B55F0                  mov edx, dword ptr [ebp-10]
:00454EF6 81E2FF000000            and edx, 000000FF
:00454EFC 52                      push edx
:00454EFD 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00454F00 E879FCFFFF              call 00454B7E
:00454F05 E918FEFFFF              jmp 00454D22

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454D4B(C)
|
:00454F0A 8BE5                    mov esp, ebp
:00454F0C 5D                      pop ebp
:00454F0D C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0042255A   , :0042307F   , :004415AA   , :00441665   , :00441778   
|:00441806   
|
:00454F10 55                      push ebp
:00454F11 8BEC                    mov ebp, esp
:00454F13 83EC18                  sub esp, 00000018
:00454F16 56                      push esi
:00454F17 894DE8                  mov dword ptr [ebp-18], ecx
:00454F1A 8B4D08                  mov ecx, dword ptr [ebp+08]
:00454F1D 81E1FF000000            and ecx, 000000FF
:00454F23 6BC924                  imul ecx, 00000024
:00454F26 81C1502C4B00            add ecx, 004B2C50
:00454F2C E82FE4FAFF              call 00403360
:00454F31 668B00                  mov ax, word ptr [eax]
:00454F34 668945EC                mov word ptr [ebp-14], ax
:00454F38 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00454F3B 8B4104                  mov eax, dword ptr [ecx+04]
:00454F3E 99                      cdq
:00454F3F B930000000              mov ecx, 00000030
:00454F44 F7F9                    idiv ecx
:00454F46 8845F4                  mov byte ptr [ebp-0C], al
:00454F49 8B55E8                  mov edx, dword ptr [ebp-18]
:00454F4C 8B4208                  mov eax, dword ptr [edx+08]
:00454F4F 99                      cdq
:00454F50 B930000000              mov ecx, 00000030
:00454F55 F7F9                    idiv ecx
:00454F57 8845F0                  mov byte ptr [ebp-10], al
:00454F5A 8A55F4                  mov dl, byte ptr [ebp-0C]
:00454F5D 8855FC                  mov byte ptr [ebp-04], dl
:00454F60 8A45F0                  mov al, byte ptr [ebp-10]
:00454F63 8845F8                  mov byte ptr [ebp-08], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454F7C(U)
|
:00454F66 0FBE4DEC                movsx ecx, byte ptr [ebp-14]
:00454F6A 0FBE55F4                movsx edx, byte ptr [ebp-0C]
:00454F6E 2BCA                    sub ecx, edx
:00454F70 85C9                    test ecx, ecx
:00454F72 7D0A                    jge 00454F7E
:00454F74 8A45F4                  mov al, byte ptr [ebp-0C]
:00454F77 2C01                    sub al, 01
:00454F79 8845F4                  mov byte ptr [ebp-0C], al
:00454F7C EBE8                    jmp 00454F66

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00454F72(C), :00454FA3(U)
|
:00454F7E 0FBE4DEC                movsx ecx, byte ptr [ebp-14]
:00454F82 0FBE55F4                movsx edx, byte ptr [ebp-0C]
:00454F86 2BCA                    sub ecx, edx
:00454F88 8B45E8                  mov eax, dword ptr [ebp-18]
:00454F8B 8B4014                  mov eax, dword ptr [eax+14]
:00454F8E 99                      cdq
:00454F8F BE30000000              mov esi, 00000030
:00454F94 F7FE                    idiv esi
:00454F96 3BC8                    cmp ecx, eax
:00454F98 7C0B                    jl 00454FA5
:00454F9A 8A4DF4                  mov cl, byte ptr [ebp-0C]
:00454F9D 80C101                  add cl, 01
:00454FA0 884DF4                  mov byte ptr [ebp-0C], cl
:00454FA3 EBD9                    jmp 00454F7E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00454F98(C), :00454FBC(U)
|
:00454FA5 0FBE55ED                movsx edx, byte ptr [ebp-13]
:00454FA9 0FBE45F0                movsx eax, byte ptr [ebp-10]
:00454FAD 2BD0                    sub edx, eax
:00454FAF 85D2                    test edx, edx
:00454FB1 7D0B                    jge 00454FBE
:00454FB3 8A4DF0                  mov cl, byte ptr [ebp-10]
:00454FB6 80E901                  sub cl, 01
:00454FB9 884DF0                  mov byte ptr [ebp-10], cl
:00454FBC EBE7                    jmp 00454FA5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00454FB1(C), :00454FE3(U)
|
:00454FBE 0FBE4DED                movsx ecx, byte ptr [ebp-13]
:00454FC2 0FBE55F0                movsx edx, byte ptr [ebp-10]
:00454FC6 2BCA                    sub ecx, edx
:00454FC8 8B45E8                  mov eax, dword ptr [ebp-18]
:00454FCB 8B4018                  mov eax, dword ptr [eax+18]
:00454FCE 99                      cdq
:00454FCF BE30000000              mov esi, 00000030
:00454FD4 F7FE                    idiv esi
:00454FD6 3BC8                    cmp ecx, eax
:00454FD8 7C0B                    jl 00454FE5
:00454FDA 8A4DF0                  mov cl, byte ptr [ebp-10]
:00454FDD 80C101                  add cl, 01
:00454FE0 884DF0                  mov byte ptr [ebp-10], cl
:00454FE3 EBD9                    jmp 00454FBE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454FD8(C)
|
:00454FE5 8B55FC                  mov edx, dword ptr [ebp-04]
:00454FE8 81E2FF000000            and edx, 000000FF
:00454FEE 8B45F4                  mov eax, dword ptr [ebp-0C]
:00454FF1 25FF000000              and eax, 000000FF
:00454FF6 3BD0                    cmp edx, eax
:00454FF8 7516                    jne 00455010
:00454FFA 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00454FFD 81E1FF000000            and ecx, 000000FF
:00455003 8B55F0                  mov edx, dword ptr [ebp-10]
:00455006 81E2FF000000            and edx, 000000FF
:0045500C 3BCA                    cmp ecx, edx
:0045500E 7428                    je 00455038

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00454FF8(C)
|
:00455010 837D0C00                cmp dword ptr [ebp+0C], 00000000
:00455014 7412                    je 00455028
:00455016 8A45ED                  mov al, byte ptr [ebp-13]
:00455019 50                      push eax
:0045501A 8A4DEC                  mov cl, byte ptr [ebp-14]
:0045501D 51                      push ecx
:0045501E 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00455021 E819000000              call 0045503F
:00455026 EB10                    jmp 00455038

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00455014(C)
|
:00455028 8A55F0                  mov dl, byte ptr [ebp-10]
:0045502B 52                      push edx
:0045502C 8A45F4                  mov al, byte ptr [ebp-0C]
:0045502F 50                      push eax
:00455030 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00455033 E8B7FCFFFF              call 00454CEF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045500E(C), :00455026(U)
|
:00455038 5E                      pop esi
:00455039 8BE5                    mov esp, ebp
:0045503B 5D                      pop ebp
:0045503C C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:00414143   , :004142A4   , :004150AD   , :00416F1A   , :0042157D   
|:00421693   , :004219F7   , :00424D76   , :0043A9FE   , :0043D024   
|:0043D3FA   , :0043E6D0   , :004414A4   , :004417E7   , :0044D37A   
|:0044D9DD   , :0044E06A   , :0044E1A9   , :00455021   , :0045530F   
|:00456410   , :0045689F   , :004571B5   , :00457357   , :00457377   
|:00457513   , :0045767A   , :004578AC   , :00459296   , :00459432   
|:004596FA   , :0045987D   , :0045A2FC   
|
:0045503F 55                      push ebp
:00455040 8BEC                    mov ebp, esp
:00455042 83EC14                  sub esp, 00000014
:00455045 894DEC                  mov dword ptr [ebp-14], ecx
:00455048 8B45EC                  mov eax, dword ptr [ebp-14]
:0045504B 8B4014                  mov eax, dword ptr [eax+14]
:0045504E 99                      cdq
:0045504F B930000000              mov ecx, 00000030
:00455054 F7F9                    idiv ecx
:00455056 8845FC                  mov byte ptr [ebp-04], al
:00455059 8B55EC                  mov edx, dword ptr [ebp-14]
:0045505C 8B4218                  mov eax, dword ptr [edx+18]
:0045505F 99                      cdq
:00455060 B930000000              mov ecx, 00000030
:00455065 F7F9                    idiv ecx
:00455067 8845F8                  mov byte ptr [ebp-08], al
:0045506A 8B45FC                  mov eax, dword ptr [ebp-04]
:0045506D 25FF000000              and eax, 000000FF
:00455072 99                      cdq
:00455073 2BC2                    sub eax, edx
:00455075 D1F8                    sar eax, 1
:00455077 50                      push eax
:00455078 8A5508                  mov dl, byte ptr [ebp+08]
:0045507B 52                      push edx
:0045507C E84FAA0200              call 0047FAD0
:00455081 83C408                  add esp, 00000008
:00455084 8845F4                  mov byte ptr [ebp-0C], al
:00455087 8B45F8                  mov eax, dword ptr [ebp-08]
:0045508A 25FF000000              and eax, 000000FF
:0045508F 99                      cdq
:00455090 2BC2                    sub eax, edx
:00455092 D1F8                    sar eax, 1
:00455094 50                      push eax
:00455095 8A450C                  mov al, byte ptr [ebp+0C]
:00455098 50                      push eax
:00455099 E832AA0200              call 0047FAD0
:0045509E 83C408                  add esp, 00000008
:004550A1 8845F0                  mov byte ptr [ebp-10], al
:004550A4 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004550A7 81E1FF000000            and ecx, 000000FF
:004550AD 8B55FC                  mov edx, dword ptr [ebp-04]
:004550B0 81E2FF000000            and edx, 000000FF
:004550B6 03CA                    add ecx, edx
:004550B8 33C0                    xor eax, eax
:004550BA A02C424B00              mov al, byte ptr [004B422C]
:004550BF 3BC8                    cmp ecx, eax
:004550C1 7E16                    jle 004550D9
:004550C3 33C9                    xor ecx, ecx
:004550C5 8A0D2C424B00            mov cl, byte ptr [004B422C]
:004550CB 8B55FC                  mov edx, dword ptr [ebp-04]
:004550CE 81E2FF000000            and edx, 000000FF
:004550D4 2BCA                    sub ecx, edx
:004550D6 884DF4                  mov byte ptr [ebp-0C], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004550C1(C)
|
:004550D9 8B45F0                  mov eax, dword ptr [ebp-10]
:004550DC 25FF000000              and eax, 000000FF
:004550E1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004550E4 81E1FF000000            and ecx, 000000FF
:004550EA 03C1                    add eax, ecx
:004550EC 33D2                    xor edx, edx
:004550EE 8A152D424B00            mov dl, byte ptr [004B422D]
:004550F4 3BC2                    cmp eax, edx
:004550F6 7E15                    jle 0045510D
:004550F8 33C0                    xor eax, eax
:004550FA A02D424B00              mov al, byte ptr [004B422D]
:004550FF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00455102 81E1FF000000            and ecx, 000000FF
:00455108 2BC1                    sub eax, ecx
:0045510A 8845F0                  mov byte ptr [ebp-10], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004550F6(C)
|
:0045510D 8A55F0                  mov dl, byte ptr [ebp-10]
:00455110 52                      push edx
:00455111 8A45F4                  mov al, byte ptr [ebp-0C]
:00455114 50                      push eax
:00455115 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00455118 E8D2FBFFFF              call 00454CEF
:0045511D 8BE5                    mov esp, ebp
:0045511F 5D                      pop ebp
:00455120 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:00405816   , :0041CDF2   , :0041CF0B   
|
:00455123 55                      push ebp
:00455124 8BEC                    mov ebp, esp
:00455126 83EC18                  sub esp, 00000018
:00455129 894DE8                  mov dword ptr [ebp-18], ecx
:0045512C 8B45E8                  mov eax, dword ptr [ebp-18]
:0045512F 8B4014                  mov eax, dword ptr [eax+14]
:00455132 99                      cdq
:00455133 B930000000              mov ecx, 00000030
:00455138 F7F9                    idiv ecx
:0045513A 8845FC                  mov byte ptr [ebp-04], al
:0045513D 8B55E8                  mov edx, dword ptr [ebp-18]
:00455140 8B4218                  mov eax, dword ptr [edx+18]
:00455143 99                      cdq
:00455144 B930000000              mov ecx, 00000030
:00455149 F7F9                    idiv ecx
:0045514B 8845F8                  mov byte ptr [ebp-08], al
:0045514E 8B4D10                  mov ecx, dword ptr [ebp+10]
:00455151 81E1FF000000            and ecx, 000000FF
:00455157 6BC924                  imul ecx, 00000024
:0045515A 81C1502C4B00            add ecx, 004B2C50
:00455160 E8FBE1FAFF              call 00403360
:00455165 668B10                  mov dx, word ptr [eax]
:00455168 668955F4                mov word ptr [ebp-0C], dx
:0045516C 8B45FC                  mov eax, dword ptr [ebp-04]
:0045516F 25FF000000              and eax, 000000FF
:00455174 99                      cdq
:00455175 2BC2                    sub eax, edx
:00455177 D1F8                    sar eax, 1
:00455179 50                      push eax
:0045517A 8A4508                  mov al, byte ptr [ebp+08]
:0045517D 50                      push eax
:0045517E E84DA90200              call 0047FAD0
:00455183 83C408                  add esp, 00000008
:00455186 8845F0                  mov byte ptr [ebp-10], al
:00455189 8B45F8                  mov eax, dword ptr [ebp-08]
:0045518C 25FF000000              and eax, 000000FF
:00455191 99                      cdq
:00455192 2BC2                    sub eax, edx
:00455194 D1F8                    sar eax, 1
:00455196 50                      push eax
:00455197 8A4D0C                  mov cl, byte ptr [ebp+0C]
:0045519A 51                      push ecx
:0045519B E830A90200              call 0047FAD0
:004551A0 83C408                  add esp, 00000008
:004551A3 8845EC                  mov byte ptr [ebp-14], al
:004551A6 8B55F0                  mov edx, dword ptr [ebp-10]
:004551A9 81E2FF000000            and edx, 000000FF
:004551AF 8B45FC                  mov eax, dword ptr [ebp-04]
:004551B2 25FF000000              and eax, 000000FF
:004551B7 03D0                    add edx, eax
:004551B9 33C9                    xor ecx, ecx
:004551BB 8A0D2C424B00            mov cl, byte ptr [004B422C]
:004551C1 3BD1                    cmp edx, ecx
:004551C3 7E15                    jle 004551DA
:004551C5 33D2                    xor edx, edx
:004551C7 8A152C424B00            mov dl, byte ptr [004B422C]
:004551CD 8B45FC                  mov eax, dword ptr [ebp-04]
:004551D0 25FF000000              and eax, 000000FF
:004551D5 2BD0                    sub edx, eax
:004551D7 8855F0                  mov byte ptr [ebp-10], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004551C3(C)
|
:004551DA 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004551DD 81E1FF000000            and ecx, 000000FF
:004551E3 8B55F8                  mov edx, dword ptr [ebp-08]
:004551E6 81E2FF000000            and edx, 000000FF
:004551EC 03CA                    add ecx, edx
:004551EE 33C0                    xor eax, eax
:004551F0 A02D424B00              mov al, byte ptr [004B422D]
:004551F5 3BC8                    cmp ecx, eax
:004551F7 7E16                    jle 0045520F
:004551F9 33C9                    xor ecx, ecx
:004551FB 8A0D2D424B00            mov cl, byte ptr [004B422D]
:00455201 8B55F8                  mov edx, dword ptr [ebp-08]
:00455204 81E2FF000000            and edx, 000000FF
:0045520A 2BCA                    sub ecx, edx
:0045520C 884DEC                  mov byte ptr [ebp-14], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004551F7(C), :00455226(U)
|
:0045520F 0FBE45F4                movsx eax, byte ptr [ebp-0C]
:00455213 0FBE4DF0                movsx ecx, byte ptr [ebp-10]
:00455217 2BC1                    sub eax, ecx
:00455219 85C0                    test eax, eax
:0045521B 7D0B                    jge 00455228
:0045521D 8A55F0                  mov dl, byte ptr [ebp-10]
:00455220 80EA01                  sub dl, 01
:00455223 8855F0                  mov byte ptr [ebp-10], dl
:00455226 EBE7                    jmp 0045520F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045521B(C), :00455247(U)
|
:00455228 0FBE45F4                movsx eax, byte ptr [ebp-0C]
:0045522C 0FBE4DF0                movsx ecx, byte ptr [ebp-10]
:00455230 2BC1                    sub eax, ecx
:00455232 8B55FC                  mov edx, dword ptr [ebp-04]
:00455235 81E2FF000000            and edx, 000000FF
:0045523B 3BC2                    cmp eax, edx
:0045523D 7C0A                    jl 00455249
:0045523F 8A45F0                  mov al, byte ptr [ebp-10]
:00455242 0401                    add al, 01
:00455244 8845F0                  mov byte ptr [ebp-10], al
:00455247 EBDF                    jmp 00455228

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045523D(C), :0045525F(U)
|
:00455249 0FBE4DF5                movsx ecx, byte ptr [ebp-0B]
:0045524D 0FBE55EC                movsx edx, byte ptr [ebp-14]
:00455251 2BCA                    sub ecx, edx
:00455253 85C9                    test ecx, ecx
:00455255 7D0A                    jge 00455261
:00455257 8A45EC                  mov al, byte ptr [ebp-14]
:0045525A 2C01                    sub al, 01
:0045525C 8845EC                  mov byte ptr [ebp-14], al
:0045525F EBE8                    jmp 00455249

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00455255(C), :00455280(U)
|
:00455261 0FBE4DF5                movsx ecx, byte ptr [ebp-0B]
:00455265 0FBE55EC                movsx edx, byte ptr [ebp-14]
:00455269 2BCA                    sub ecx, edx
:0045526B 8B45F8                  mov eax, dword ptr [ebp-08]
:0045526E 25FF000000              and eax, 000000FF
:00455273 3BC8                    cmp ecx, eax
:00455275 7C0B                    jl 00455282
:00455277 8A4DEC                  mov cl, byte ptr [ebp-14]
:0045527A 80C101                  add cl, 01
:0045527D 884DEC                  mov byte ptr [ebp-14], cl
:00455280 EBDF                    jmp 00455261

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00455275(C)
|
:00455282 8A55EC                  mov dl, byte ptr [ebp-14]
:00455285 52                      push edx
:00455286 8A45F0                  mov al, byte ptr [ebp-10]
:00455289 50                      push eax
:0045528A 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0045528D E85DFAFFFF              call 00454CEF
:00455292 8BE5                    mov esp, ebp
:00455294 5D                      pop ebp
:00455295 C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:0044E846   , :0047AE3A   
|
:00455298 55                      push ebp
:00455299 8BEC                    mov ebp, esp
:0045529B 83EC08                  sub esp, 00000008
:0045529E 894DF8                  mov dword ptr [ebp-08], ecx
:004552A1 8D4DFC                  lea ecx, dword ptr [ebp-04]
:004552A4 E867A40000              call 0045F710
:004552A9 8B4D08                  mov ecx, dword ptr [ebp+08]
:004552AC 81E1FF000000            and ecx, 000000FF
:004552B2 6BC924                  imul ecx, 00000024
:004552B5 81C1502C4B00            add ecx, 004B2C50
:004552BB E8D039FCFF              call 00418C90
:004552C0 25FF000000              and eax, 000000FF
:004552C5 83F802                  cmp eax, 00000002
:004552C8 756D                    jne 00455337

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004552DA(U)
|
:004552CA 33C0                    xor eax, eax
:004552CC A0707A4900              mov al, byte ptr [00497A70]
:004552D1 85C0                    test eax, eax
:004552D3 7E07                    jle 004552DC
:004552D5 E81C93FCFF              call 0041E5F6
:004552DA EBEE                    jmp 004552CA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004552D3(C)
|
:004552DC 8B4D08                  mov ecx, dword ptr [ebp+08]
:004552DF 81E1FF000000            and ecx, 000000FF
:004552E5 6BC924                  imul ecx, 00000024
:004552E8 81C1502C4B00            add ecx, 004B2C50
:004552EE E86DE0FAFF              call 00403360
:004552F3 50                      push eax
:004552F4 8D4DFC                  lea ecx, dword ptr [ebp-04]
:004552F7 E8A412FBFF              call 004065A0
:004552FC 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004552FF E818F3FFFF              call 0045461C
:00455304 8A4DFD                  mov cl, byte ptr [ebp-03]
:00455307 51                      push ecx
:00455308 8A55FC                  mov dl, byte ptr [ebp-04]
:0045530B 52                      push edx
:0045530C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045530F E82BFDFFFF              call 0045503F
:00455314 8D45FC                  lea eax, dword ptr [ebp-04]
:00455317 50                      push eax
:00455318 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045531B E8B3F1FFFF              call 004544D3
:00455320 8B4D08                  mov ecx, dword ptr [ebp+08]
:00455323 81E1FF000000            and ecx, 000000FF
:00455329 6BC924                  imul ecx, 00000024
:0045532C 81C1502C4B00            add ecx, 004B2C50
:00455332 E867B1FEFF              call 0044049E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004552C8(C)
|
:00455337 8BE5                    mov esp, ebp
:00455339 5D                      pop ebp
:0045533A C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0041CD09   , :0041CE61   , :0041CF85   , :0041D0C8   , :0041D3FC   
|:0041D536   , :00423165   , :0042338D   , :0042357B   , :004237B4   
|:00423987   , :00423F03   , :00424EC9   , :0043DB0E   
|
:0045533D 55                      push ebp
:0045533E 8BEC                    mov ebp, esp
:00455340 83EC18                  sub esp, 00000018
:00455343 56                      push esi
:00455344 894DE8                  mov dword ptr [ebp-18], ecx
:00455347 C745F801000000          mov [ebp-08], 00000001
:0045534E C745FC00000000          mov [ebp-04], 00000000
:00455355 C645ECFF                mov [ebp-14], FF
:00455359 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:0045535C E8AFA30000              call 0045F710
:00455361 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00455364 E8A7A30000              call 0045F710
:00455369 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045536C 81E1FF000000            and ecx, 000000FF
:00455372 6BC924                  imul ecx, 00000024
:00455375 81C1502C4B00            add ecx, 004B2C50
:0045537B E85007FDFF              call 00425AD0
:00455380 25FF000000              and eax, 000000FF
:00455385 83F807                  cmp eax, 00000007
:00455388 7418                    je 004553A2
:0045538A 33C0                    xor eax, eax
:0045538C A030424B00              mov al, byte ptr [004B4230]
:00455391 83E004                  and eax, 00000004
:00455394 85C0                    test eax, eax
:00455396 750A                    jne 004553A2
:00455398 A0282C4B00              mov al, byte ptr [004B2C28]
:0045539D E970030000              jmp 00455712

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00455388(C), :00455396(C)
|
:004553A2 8B4D10                  mov ecx, dword ptr [ebp+10]
:004553A5 81E1FF000000            and ecx, 000000FF
:004553AB 83F903                  cmp ecx, 00000003
:004553AE 740E                    je 004553BE
:004553B0 8B5510                  mov edx, dword ptr [ebp+10]
:004553B3 81E2FF000000            and edx, 000000FF
:004553B9 83FA04                  cmp edx, 00000004
:004553BC 7507                    jne 004553C5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004553AE(C)
|
:004553BE C745FC01000000          mov [ebp-04], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004553BC(C)
|
:004553C5 8B4D08                  mov ecx, dword ptr [ebp+08]
:004553C8 81E1FF000000            and ecx, 000000FF
:004553CE 6BC924                  imul ecx, 00000024
:004553D1 81C1502C4B00            add ecx, 004B2C50
:004553D7 E884DFFAFF              call 00403360
:004553DC 50                      push eax
:004553DD 8D4DF0                  lea ecx, dword ptr [ebp-10]
:004553E0 E8BB11FBFF              call 004065A0
:004553E5 68FF000000              push 000000FF
:004553EA 6840060000              push 00000640
:004553EF 6A04                    push 00000004
:004553F1 6A00                    push 00000000
:004553F3 68C0120000              push 000012C0
:004553F8 B938EB4A00              mov ecx, 004AEB38
:004553FD E83EA60200              call 0047FA40
:00455402 50                      push eax
:00455403 E80BA90200              call 0047FD13
:00455408 83C40C                  add esp, 0000000C
:0045540B 6A00                    push 00000000
:0045540D 33C0                    xor eax, eax
:0045540F 837DFC00                cmp dword ptr [ebp-04], 00000000
:00455413 0F95C0                  setne al
:00455416 50                      push eax
:00455417 8A4D0C                  mov cl, byte ptr [ebp+0C]
:0045541A 51                      push ecx
:0045541B 8D55F0                  lea edx, dword ptr [ebp-10]
:0045541E 52                      push edx
:0045541F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00455422 81E1FF000000            and ecx, 000000FF
:00455428 6BC924                  imul ecx, 00000024
:0045542B 81C1502C4B00            add ecx, 004B2C50
:00455431 E85011FEFF              call 00436586
:00455436 8845EC                  mov byte ptr [ebp-14], al
:00455439 8B450C                  mov eax, dword ptr [ebp+0C]
:0045543C 25FF000000              and eax, 000000FF
:00455441 3DFF000000              cmp eax, 000000FF
:00455446 7417                    je 0045545F
:00455448 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045544B 51                      push ecx
:0045544C 8A550C                  mov dl, byte ptr [ebp+0C]
:0045544F 52                      push edx
:00455450 668B45F0                mov ax, word ptr [ebp-10]
:00455454 50                      push eax
:00455455 B950424B00              mov ecx, 004B4250
:0045545A E87DE5FFFF              call 004539DC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00455446(C)
|
:0045545F 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00455462 E8ACE6FFFF              call 00453B13
:00455467 8A4D08                  mov cl, byte ptr [ebp+08]
:0045546A 880DD85D4B00            mov byte ptr [004B5DD8], cl
:00455470 8B55EC                  mov edx, dword ptr [ebp-14]
:00455473 81E2FF000000            and edx, 000000FF
:00455479 81FAFF000000            cmp edx, 000000FF
:0045547F 752D                    jne 004554AE
:00455481 837DFC00                cmp dword ptr [ebp-04], 00000000
:00455485 7411                    je 00455498

* Possible StringData Ref from Data Obj ->"ΧûҾӡ"
                                  |
:00455487 68FCE24800              push 0048E2FC
:0045548C 6A02                    push 00000002
:0045548E E806A2FDFF              call 0042F699
:00455493 83C408                  add esp, 00000008
:00455496 EB0F                    jmp 004554A7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00455485(C)
|

* Possible StringData Ref from Data Obj ->"Χûеоӡ"
                                  |
:00455498 6814E34800              push 0048E314
:0045549D 6A02                    push 00000002
:0045549F E8F5A1FDFF              call 0042F699
:004554A4 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00455496(U)
|
:004554A7 C745F800000000          mov [ebp-08], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045547F(C)
|
:004554AE 8B4510                  mov eax, dword ptr [ebp+10]
:004554B1 25FF000000              and eax, 000000FF
:004554B6 83F801                  cmp eax, 00000001
:004554B9 751F                    jne 004554DA
:004554BB 8B4D08                  mov ecx, dword ptr [ebp+08]
:004554BE 81E1FF000000            and ecx, 000000FF
:004554C4 6BC924                  imul ecx, 00000024
:004554C7 81C1502C4B00            add ecx, 004B2C50
:004554CD E845A4FEFF              call 0043F917
:004554D2 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004554D5 884161                  mov byte ptr [ecx+61], al
:004554D8 EB38                    jmp 00455512

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004554B9(C)
|
:004554DA 8B5510                  mov edx, dword ptr [ebp+10]
:004554DD 81E2FF000000            and edx, 000000FF
:004554E3 83FA02                  cmp edx, 00000002
:004554E6 740D                    je 004554F5
:004554E8 8B4510                  mov eax, dword ptr [ebp+10]
:004554EB 25FF000000              and eax, 000000FF
:004554F0 83F803                  cmp eax, 00000003
:004554F3 751D                    jne 00455512

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004554E6(C)
|
:004554F5 8B4D14                  mov ecx, dword ptr [ebp+14]
:004554F8 81E1FF000000            and ecx, 000000FF
:004554FE 6BC946                  imul ecx, 00000046
:00455501 81C1C0F44A00            add ecx, 004AF4C0
:00455507 E84406FDFF              call 00425B50
:0045550C 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0045550F 884161                  mov byte ptr [ecx+61], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004554D8(U), :004554F3(C), :004556A2(U)
|
:00455512 837DF800                cmp dword ptr [ebp-08], 00000000
:00455516 0F848B010000            je 004556A7
:0045551C 8A5514                  mov dl, byte ptr [ebp+14]
:0045551F 52                      push edx
:00455520 8A4510                  mov al, byte ptr [ebp+10]
:00455523 50                      push eax
:00455524 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00455527 E87DECFFFF              call 004541A9
:0045552C 50                      push eax
:0045552D 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:00455530 E86B10FBFF              call 004065A0
:00455535 E88A950200              call 0047EAC4
:0045553A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0045553D 81E1FF000000            and ecx, 000000FF
:00455543 81F9FF000000            cmp ecx, 000000FF
:00455549 7510                    jne 0045555B
:0045554B C745F800000000          mov [ebp-08], 00000000
:00455552 C645ECFF                mov [ebp-14], FF
:00455556 E94C010000              jmp 004556A7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00455549(C)
|
:0045555B 6A04                    push 00000004
:0045555D 6A00                    push 00000000
:0045555F 8B55F4                  mov edx, dword ptr [ebp-0C]
:00455562 81E2FF000000            and edx, 000000FF
:00455568 8B45F5                  mov eax, dword ptr [ebp-0B]
:0045556B 25FF000000              and eax, 000000FF
:00455570 33C9                    xor ecx, ecx
:00455572 8A0D2C424B00            mov cl, byte ptr [004B422C]
:00455578 0FAFC1                  imul eax, ecx
:0045557B 8D9402C0120000          lea edx, dword ptr [edx+eax+000012C0]
:00455582 52                      push edx
:00455583 B938EB4A00              mov ecx, 004AEB38
:00455588 E8B3A40200              call 0047FA40
:0045558D 33C9                    xor ecx, ecx
:0045558F 8A08                    mov cl, byte ptr [eax]
:00455591 81F9FF000000            cmp ecx, 000000FF
:00455597 0F84E8000000            je 00455685
:0045559D 8D55F4                  lea edx, dword ptr [ebp-0C]
:004555A0 52                      push edx
:004555A1 E8DE02FEFF              call 00435884
:004555A6 83C404                  add esp, 00000004
:004555A9 8845EC                  mov byte ptr [ebp-14], al
:004555AC 8B45EC                  mov eax, dword ptr [ebp-14]
:004555AF 25FF000000              and eax, 000000FF
:004555B4 3DFF000000              cmp eax, 000000FF
:004555B9 0F84C4000000            je 00455683
:004555BF 837DFC00                cmp dword ptr [ebp-04], 00000000
:004555C3 7460                    je 00455625
:004555C5 8B4D08                  mov ecx, dword ptr [ebp+08]
:004555C8 81E1FF000000            and ecx, 000000FF
:004555CE 6BC924                  imul ecx, 00000024
:004555D1 81C1502C4B00            add ecx, 004B2C50
:004555D7 E83411FBFF              call 00406710
:004555DC 8BF0                    mov esi, eax
:004555DE 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004555E1 81E1FF000000            and ecx, 000000FF
:004555E7 6BC924                  imul ecx, 00000024
:004555EA 81C1502C4B00            add ecx, 004B2C50
:004555F0 E81B11FBFF              call 00406710
:004555F5 3BF0                    cmp esi, eax
:004555F7 7423                    je 0045561C
:004555F9 6A01                    push 00000001
:004555FB 6A02                    push 00000002
:004555FD B9B0694B00              mov ecx, 004B69B0
:00455602 E873F00100              call 0047467A

* Possible StringData Ref from Data Obj ->"ǵоӡ"
                                  |
:00455607 682CE34800              push 0048E32C
:0045560C 6A02                    push 00000002
:0045560E E886A0FDFF              call 0042F699
:00455613 83C408                  add esp, 00000008
:00455616 C645ECFF                mov [ebp-14], FF
:0045561A EB07                    jmp 00455623

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004555F7(C)
|
:0045561C C745F800000000          mov [ebp-08], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045561A(U)
|
:00455623 EB5E                    jmp 00455683

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004555C3(C)
|
:00455625 8B4D08                  mov ecx, dword ptr [ebp+08]
:00455628 81E1FF000000            and ecx, 000000FF
:0045562E 6BC924                  imul ecx, 00000024
:00455631 81C1502C4B00            add ecx, 004B2C50
:00455637 E8D410FBFF              call 00406710
:0045563C 8BF0                    mov esi, eax
:0045563E 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00455641 81E1FF000000            and ecx, 000000FF
:00455647 6BC924                  imul ecx, 00000024
:0045564A 81C1502C4B00            add ecx, 004B2C50
:00455650 E8BB10FBFF              call 00406710
:00455655 3BF0                    cmp esi, eax
:00455657 7523                    jne 0045567C
:00455659 6A01                    push 00000001
:0045565B 6A02                    push 00000002
:0045565D B9B0694B00              mov ecx, 004B69B0
:00455662 E813F00100              call 0047467A

* Possible StringData Ref from Data Obj ->"ܹҾӡ"
                                  |
:00455667 683CE34800              push 0048E33C
:0045566C 6A02                    push 00000002
:0045566E E826A0FDFF              call 0042F699
:00455673 83C408                  add esp, 00000008
:00455676 C645ECFF                mov [ebp-14], FF
:0045567A EB07                    jmp 00455683

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00455657(C)
|
:0045567C C745F800000000          mov [ebp-08], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004555B9(C), :00455623(U), :0045567A(U)
|
:00455683 EB1D                    jmp 004556A2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00455597(C)
|
:00455685 6A01                    push 00000001
:00455687 6A02                    push 00000002
:00455689 B9B0694B00              mov ecx, 004B69B0
:0045568E E8E7EF0100              call 0047467A

* Possible StringData Ref from Data Obj ->"ڷΧ֮ڡ"
                                  |
:00455693 6850E34800              push 0048E350
:00455698 6A02                    push 00000002
:0045569A E8FA9FFDFF              call 0042F699
:0045569F 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00455683(U)
|
:004556A2 E96BFEFFFF              jmp 00455512

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00455516(C), :00455556(U)
|
:004556A7 6A00                    push 00000000
:004556A9 68FF000000              push 000000FF
:004556AE 668B4DF0                mov cx, word ptr [ebp-10]
:004556B2 51                      push ecx
:004556B3 B950424B00              mov ecx, 004B4250
:004556B8 E81FE3FFFF              call 004539DC
:004556BD 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004556C0 E857EFFFFF              call 0045461C
:004556C5 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004556C8 E846E4FFFF              call 00453B13
:004556CD 8B55EC                  mov edx, dword ptr [ebp-14]
:004556D0 81E2FF000000            and edx, 000000FF
:004556D6 81FAFF000000            cmp edx, 000000FF
:004556DC 7513                    jne 004556F1
:004556DE 6A01                    push 00000001
:004556E0 6A01                    push 00000001
:004556E2 B9B0694B00              mov ecx, 004B69B0
:004556E7 E88EEF0100              call 0047467A
:004556EC E80F6FFDFF              call 0042C600

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004556DC(C)
|
:004556F1 8B45E8                  mov eax, dword ptr [ebp-18]
:004556F4 C6406100                mov [eax+61], 00
:004556F8 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004556FB C781781B000000000000    mov dword ptr [ebx+00001B78], 00000000
:00455705 6A00                    push 00000000
:00455707 E80F61FDFF              call 0042B81B
:0045570C 83C404                  add esp, 00000004
:0045570F 8A45EC                  mov al, byte ptr [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045539D(U)
|
:00455712 5E                      pop esi
:00455713 8BE5                    mov esp, ebp
:00455715 5D                      pop ebp
:00455716 C21000                  ret 0010



* Referenced by a CALL at Addresses:
|:0044D384   , :0044D9E7   , :0044E6FD   
|
:00455719 55                      push ebp
:0045571A 8BEC                    mov ebp, esp
:0045571C 51                      push ecx
:0045571D 894DFC                  mov dword ptr [ebp-04], ecx
:00455720 8B45FC                  mov eax, dword ptr [ebp-04]
:00455723 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00455726 8B5104                  mov edx, dword ptr [ecx+04]
:00455729 895048                  mov dword ptr [eax+48], edx
:0045572C 8B45FC                  mov eax, dword ptr [ebp-04]
:0045572F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00455732 8B5108                  mov edx, dword ptr [ecx+08]
:00455735 89504C                  mov dword ptr [eax+4C], edx
:00455738 8BE5                    mov esp, ebp
:0045573A 5D                      pop ebp
:0045573B C3                      ret


:0045573C 55                      push ebp
:0045573D 8BEC                    mov ebp, esp
:0045573F 51                      push ecx
:00455740 894DFC                  mov dword ptr [ebp-04], ecx
:00455743 8B45FC                  mov eax, dword ptr [ebp-04]
:00455746 8B404C                  mov eax, dword ptr [eax+4C]
:00455749 99                      cdq
:0045574A B930000000              mov ecx, 00000030
:0045574F F7F9                    idiv ecx
:00455751 50                      push eax
:00455752 8B55FC                  mov edx, dword ptr [ebp-04]
:00455755 8B4248                  mov eax, dword ptr [edx+48]
:00455758 99                      cdq
:00455759 B930000000              mov ecx, 00000030
:0045575E F7F9                    idiv ecx
:00455760 50                      push eax
:00455761 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00455764 E886F5FFFF              call 00454CEF
:00455769 8BE5                    mov esp, ebp
:0045576B 5D                      pop ebp
:0045576C C3                      ret



* Referenced by a CALL at Addresses:
|:004343C0   , :0044E49B   
|
:0045576D 55                      push ebp
:0045576E 8BEC                    mov ebp, esp
:00455770 81EC24010000            sub esp, 00000124
:00455776 56                      push esi
:00455777 898DDCFEFFFF            mov dword ptr [ebp+FFFFFEDC], ecx
:0045577D 8B4508                  mov eax, dword ptr [ebp+08]
:00455780 33C9                    xor ecx, ecx
:00455782 8A08                    mov cl, byte ptr [eax]
:00455784 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:0045578A 8B4204                  mov eax, dword ptr [edx+04]
:0045578D 99                      cdq
:0045578E BE30000000              mov esi, 00000030
:00455793 F7FE                    idiv esi
:00455795 2BC8                    sub ecx, eax
:00455797 884DF4                  mov byte ptr [ebp-0C], cl
:0045579A 8B4508                  mov eax, dword ptr [ebp+08]
:0045579D 33C9                    xor ecx, ecx
:0045579F 8A4801                  mov cl, byte ptr [eax+01]
:004557A2 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:004557A8 8B4208                  mov eax, dword ptr [edx+08]
:004557AB 99                      cdq
:004557AC BE30000000              mov esi, 00000030
:004557B1 F7FE                    idiv esi
:004557B3 2BC8                    sub ecx, eax
:004557B5 884DF8                  mov byte ptr [ebp-08], cl
:004557B8 8B85DCFEFFFF            mov eax, dword ptr [ebp+FFFFFEDC]
:004557BE 8B4014                  mov eax, dword ptr [eax+14]
:004557C1 99                      cdq
:004557C2 B930000000              mov ecx, 00000030
:004557C7 F7F9                    idiv ecx
:004557C9 99                      cdq
:004557CA 2BC2                    sub eax, edx
:004557CC D1F8                    sar eax, 1
:004557CE 8885E0FEFFFF            mov byte ptr [ebp+FFFFFEE0], al
:004557D4 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:004557DA 8B4214                  mov eax, dword ptr [edx+14]
:004557DD 99                      cdq
:004557DE B930000000              mov ecx, 00000030
:004557E3 F7F9                    idiv ecx
:004557E5 99                      cdq
:004557E6 2BC2                    sub eax, edx
:004557E8 D1F8                    sar eax, 1
:004557EA 8845EC                  mov byte ptr [ebp-14], al
:004557ED 8B55F4                  mov edx, dword ptr [ebp-0C]
:004557F0 81E2FF000000            and edx, 000000FF
:004557F6 6BD230                  imul edx, 00000030
:004557F9 8B85DCFEFFFF            mov eax, dword ptr [ebp+FFFFFEDC]
:004557FF 03503C                  add edx, dword ptr [eax+3C]
:00455802 8995E4FEFFFF            mov dword ptr [ebp+FFFFFEE4], edx
:00455808 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045580B 81E1FF000000            and ecx, 000000FF
:00455811 6BC930                  imul ecx, 00000030
:00455814 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:0045581A 034A40                  add ecx, dword ptr [edx+40]
:0045581D 894DF0                  mov dword ptr [ebp-10], ecx
:00455820 8B4508                  mov eax, dword ptr [ebp+08]
:00455823 50                      push eax
:00455824 E86801FEFF              call 00435991
:00455829 83C404                  add esp, 00000004
:0045582C 8845FC                  mov byte ptr [ebp-04], al
:0045582F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00455832 33D2                    xor edx, edx
:00455834 8A11                    mov dl, byte ptr [ecx]
:00455836 81FAFF000000            cmp edx, 000000FF
:0045583C 7515                    jne 00455853
:0045583E 8B4508                  mov eax, dword ptr [ebp+08]
:00455841 33C9                    xor ecx, ecx
:00455843 8A4801                  mov cl, byte ptr [eax+01]
:00455846 81F9FF000000            cmp ecx, 000000FF
:0045584C 7505                    jne 00455853
:0045584E E9E0030000              jmp 00455C33

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045583C(C), :0045584C(C)
|
:00455853 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:00455859 E8BEEDFFFF              call 0045461C
:0045585E 6A01                    push 00000001
:00455860 6A01                    push 00000001
:00455862 8A55F8                  mov dl, byte ptr [ebp-08]
:00455865 52                      push edx
:00455866 8A45F4                  mov al, byte ptr [ebp-0C]
:00455869 50                      push eax
:0045586A 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:00455870 E81AC9FFFF              call 0045218F
:00455875 B9C8E44A00              mov ecx, 004AE4C8
:0045587A E81188FBFF              call 0040E090
:0045587F 50                      push eax
:00455880 6A30                    push 00000030
:00455882 6A30                    push 00000030
:00455884 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00455887 51                      push ecx
:00455888 8B95E4FEFFFF            mov edx, dword ptr [ebp+FFFFFEE4]
:0045588E 52                      push edx
:0045588F E8BD890200              call 0047E251
:00455894 83C414                  add esp, 00000014
:00455897 8B4508                  mov eax, dword ptr [ebp+08]
:0045589A 50                      push eax
:0045589B 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:004558A1 E82DECFFFF              call 004544D3
:004558A6 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004558A9 81E1FF000000            and ecx, 000000FF
:004558AF 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:004558B5 81E2FF000000            and edx, 000000FF
:004558BB 33C0                    xor eax, eax
:004558BD 3BCA                    cmp ecx, edx
:004558BF 0F9DC0                  setnl al
:004558C2 48                      dec eax
:004558C3 83E004                  and eax, 00000004
:004558C6 83C0FD                  add eax, FFFFFFFD
:004558C9 8A4DF4                  mov cl, byte ptr [ebp-0C]
:004558CC 02C8                    add cl, al
:004558CE 884DF4                  mov byte ptr [ebp-0C], cl
:004558D1 8B55F8                  mov edx, dword ptr [ebp-08]
:004558D4 81E2FF000000            and edx, 000000FF
:004558DA 8B45EC                  mov eax, dword ptr [ebp-14]
:004558DD 25FF000000              and eax, 000000FF
:004558E2 33C9                    xor ecx, ecx
:004558E4 3BD0                    cmp edx, eax
:004558E6 0F9CC1                  setl cl
:004558E9 49                      dec ecx
:004558EA 8A55F8                  mov dl, byte ptr [ebp-08]
:004558ED 02D1                    add dl, cl
:004558EF 8855F8                  mov byte ptr [ebp-08], dl
:004558F2 8B45F4                  mov eax, dword ptr [ebp-0C]
:004558F5 25FF000000              and eax, 000000FF
:004558FA 6BC030                  imul eax, 00000030
:004558FD 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:00455903 03413C                  add eax, dword ptr [ecx+3C]
:00455906 8985E4FEFFFF            mov dword ptr [ebp+FFFFFEE4], eax
:0045590C 8B55F8                  mov edx, dword ptr [ebp-08]
:0045590F 81E2FF000000            and edx, 000000FF
:00455915 6BD230                  imul edx, 00000030
:00455918 8B85DCFEFFFF            mov eax, dword ptr [ebp+FFFFFEDC]
:0045591E 035040                  add edx, dword ptr [eax+40]
:00455921 8955F0                  mov dword ptr [ebp-10], edx
:00455924 E8B28CFCFF              call 0041E5DB
:00455929 6A02                    push 00000002
:0045592B 6A03                    push 00000003
:0045592D 8A4DF8                  mov cl, byte ptr [ebp-08]
:00455930 51                      push ecx
:00455931 8A55F4                  mov dl, byte ptr [ebp-0C]
:00455934 52                      push edx
:00455935 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:0045593B E8D7E2FFFF              call 00453C17
:00455940 6A00                    push 00000000
:00455942 B9C8E44A00              mov ecx, 004AE4C8
:00455947 E84487FBFF              call 0040E090
:0045594C 50                      push eax
:0045594D 6A30                    push 00000030
:0045594F 6A30                    push 00000030
:00455951 8B45F0                  mov eax, dword ptr [ebp-10]
:00455954 83C008                  add eax, 00000008
:00455957 50                      push eax
:00455958 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:0045595E 83C108                  add ecx, 00000008
:00455961 51                      push ecx
:00455962 E8ACBFFFFF              call 00451913
:00455967 83C418                  add esp, 00000018
:0045596A 6A04                    push 00000004
:0045596C B9382F4900              mov ecx, 00492F38
:00455971 E8C093FBFF              call 0040ED36
:00455976 6A12                    push 00000012
:00455978 B9382F4900              mov ecx, 00492F38
:0045597D E80293FBFF              call 0040EC84
:00455982 6A00                    push 00000000
:00455984 B9382F4900              mov ecx, 00492F38
:00455989 E82E93FBFF              call 0040ECBC
:0045598E 8B55F0                  mov edx, dword ptr [ebp-10]
:00455991 83C20C                  add edx, 0000000C
:00455994 52                      push edx
:00455995 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:0045599B 83C040                  add eax, 00000040
:0045599E 99                      cdq
:0045599F 83E207                  and edx, 00000007
:004559A2 03C2                    add eax, edx
:004559A4 C1F803                  sar eax, 03
:004559A7 50                      push eax
:004559A8 B9382F4900              mov ecx, 00492F38
:004559AD E82592FBFF              call 0040EBD7
:004559B2 8B45FC                  mov eax, dword ptr [ebp-04]
:004559B5 25FF000000              and eax, 000000FF
:004559BA 8B0C85B0BD4800          mov ecx, dword ptr [4*eax+0048BDB0]
:004559C1 51                      push ecx

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:004559C2 6860E34800              push 0048E360
:004559C7 68382F4900              push 00492F38
:004559CC E8CFA0FBFF              call 0040FAA0
:004559D1 83C40C                  add esp, 0000000C
:004559D4 8B55F0                  mov edx, dword ptr [ebp-10]
:004559D7 83C228                  add edx, 00000028
:004559DA 52                      push edx
:004559DB 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:004559E1 83C040                  add eax, 00000040
:004559E4 99                      cdq
:004559E5 83E207                  and edx, 00000007
:004559E8 03C2                    add eax, edx
:004559EA C1F803                  sar eax, 03
:004559ED 50                      push eax
:004559EE B9382F4900              mov ecx, 00492F38
:004559F3 E8DF91FBFF              call 0040EBD7
:004559F8 8A45FC                  mov al, byte ptr [ebp-04]
:004559FB 50                      push eax
:004559FC E881F7FDFF              call 00435182
:00455A01 83C404                  add esp, 00000004
:00455A04 85C0                    test eax, eax
:00455A06 7420                    je 00455A28
:00455A08 6A35                    push 00000035
:00455A0A B9382F4900              mov ecx, 00492F38
:00455A0F E87092FBFF              call 0040EC84

* Possible StringData Ref from Data Obj ->"Իָ"
                                  |
:00455A14 6864E34800              push 0048E364
:00455A19 68382F4900              push 00492F38
:00455A1E E87DA0FBFF              call 0040FAA0
:00455A23 83C408                  add esp, 00000008
:00455A26 EB2E                    jmp 00455A56

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00455A06(C)
|
:00455A28 8A4DFC                  mov cl, byte ptr [ebp-04]
:00455A2B 51                      push ecx
:00455A2C E809020000              call 00455C3A
:00455A31 83C404                  add esp, 00000004
:00455A34 85C0                    test eax, eax
:00455A36 741E                    je 00455A56
:00455A38 6A15                    push 00000015
:00455A3A B9382F4900              mov ecx, 00492F38
:00455A3F E84092FBFF              call 0040EC84

* Possible StringData Ref from Data Obj ->"޷ƶ"
                                  |
:00455A44 6870E34800              push 0048E370
:00455A49 68382F4900              push 00492F38
:00455A4E E84DA0FBFF              call 0040FAA0
:00455A53 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00455A26(U), :00455A36(C)
|
:00455A56 6A12                    push 00000012
:00455A58 B9382F4900              mov ecx, 00492F38
:00455A5D E82292FBFF              call 0040EC84
:00455A62 C745E800000000          mov [ebp-18], 00000000
:00455A69 EB09                    jmp 00455A74

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00455AEA(U)
|
:00455A6B 8B55E8                  mov edx, dword ptr [ebp-18]
:00455A6E 83C201                  add edx, 00000001
:00455A71 8955E8                  mov dword ptr [ebp-18], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00455A69(U)
|
:00455A74 837DE804                cmp dword ptr [ebp-18], 00000004
:00455A78 7375                    jnb 00455AEF
:00455A7A 6800010000              push 00000100
:00455A7F 8D85E8FEFFFF            lea eax, dword ptr [ebp+FFFFFEE8]
:00455A85 50                      push eax
:00455A86 6A04                    push 00000004
:00455A88 6A00                    push 00000000
:00455A8A 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00455A8D C1E108                  shl ecx, 08
:00455A90 81C1C0A50100            add ecx, 0001A5C0
:00455A96 51                      push ecx
:00455A97 B950EB4A00              mov ecx, 004AEB50
:00455A9C E89F9F0200              call 0047FA40
:00455AA1 50                      push eax
:00455AA2 E856A20200              call 0047FCFD
:00455AA7 83C40C                  add esp, 0000000C
:00455AAA 6A10                    push 00000010
:00455AAC 6A10                    push 00000010
:00455AAE 8D95E8FEFFFF            lea edx, dword ptr [ebp+FFFFFEE8]
:00455AB4 52                      push edx
:00455AB5 E8C0ADFDFF              call 0043087A
:00455ABA 83C40C                  add esp, 0000000C
:00455ABD 6A04                    push 00000004
:00455ABF 8D85E8FEFFFF            lea eax, dword ptr [ebp+FFFFFEE8]
:00455AC5 50                      push eax
:00455AC6 6A10                    push 00000010
:00455AC8 6A10                    push 00000010
:00455ACA 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00455ACD 83C144                  add ecx, 00000044
:00455AD0 51                      push ecx
:00455AD1 8B55E8                  mov edx, dword ptr [ebp-18]
:00455AD4 C1E205                  shl edx, 05
:00455AD7 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:00455ADD 8D4C1010                lea ecx, dword ptr [eax+edx+10]
:00455AE1 51                      push ecx
:00455AE2 E82CBEFFFF              call 00451913
:00455AE7 83C418                  add esp, 00000018
:00455AEA E97CFFFFFF              jmp 00455A6B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00455A78(C)
|
:00455AEF 8A55FC                  mov dl, byte ptr [ebp-04]
:00455AF2 52                      push edx
:00455AF3 E8BEAFFCFF              call 00420AB6
:00455AF8 83C404                  add esp, 00000004
:00455AFB 85C0                    test eax, eax
:00455AFD 7433                    je 00455B32
:00455AFF 6A04                    push 00000004
:00455B01 6A04                    push 00000004
:00455B03 6A00                    push 00000000
:00455B05 68C0A50100              push 0001A5C0
:00455B0A B950EB4A00              mov ecx, 004AEB50
:00455B0F E82C9F0200              call 0047FA40
:00455B14 50                      push eax
:00455B15 6A10                    push 00000010
:00455B17 6A10                    push 00000010
:00455B19 8B45F0                  mov eax, dword ptr [ebp-10]
:00455B1C 83C044                  add eax, 00000044
:00455B1F 50                      push eax
:00455B20 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:00455B26 83C110                  add ecx, 00000010
:00455B29 51                      push ecx
:00455B2A E8E4BDFFFF              call 00451913
:00455B2F 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00455AFD(C)
|
:00455B32 8A55FC                  mov dl, byte ptr [ebp-04]
:00455B35 52                      push edx
:00455B36 E8DCAFFCFF              call 00420B17
:00455B3B 83C404                  add esp, 00000004
:00455B3E 85C0                    test eax, eax
:00455B40 7433                    je 00455B75
:00455B42 6A04                    push 00000004
:00455B44 6A04                    push 00000004
:00455B46 6A00                    push 00000000
:00455B48 68C0A60100              push 0001A6C0
:00455B4D B950EB4A00              mov ecx, 004AEB50
:00455B52 E8E99E0200              call 0047FA40
:00455B57 50                      push eax
:00455B58 6A10                    push 00000010
:00455B5A 6A10                    push 00000010
:00455B5C 8B45F0                  mov eax, dword ptr [ebp-10]
:00455B5F 83C044                  add eax, 00000044
:00455B62 50                      push eax
:00455B63 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:00455B69 83C130                  add ecx, 00000030
:00455B6C 51                      push ecx
:00455B6D E8A1BDFFFF              call 00451913
:00455B72 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00455B40(C)
|
:00455B75 8A55FC                  mov dl, byte ptr [ebp-04]
:00455B78 52                      push edx
:00455B79 E81AB0FCFF              call 00420B98
:00455B7E 83C404                  add esp, 00000004
:00455B81 85C0                    test eax, eax
:00455B83 7433                    je 00455BB8
:00455B85 6A04                    push 00000004
:00455B87 6A04                    push 00000004
:00455B89 6A00                    push 00000000
:00455B8B 68C0A70100              push 0001A7C0
:00455B90 B950EB4A00              mov ecx, 004AEB50
:00455B95 E8A69E0200              call 0047FA40
:00455B9A 50                      push eax
:00455B9B 6A10                    push 00000010
:00455B9D 6A10                    push 00000010
:00455B9F 8B45F0                  mov eax, dword ptr [ebp-10]
:00455BA2 83C044                  add eax, 00000044
:00455BA5 50                      push eax
:00455BA6 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:00455BAC 83C150                  add ecx, 00000050
:00455BAF 51                      push ecx
:00455BB0 E85EBDFFFF              call 00451913
:00455BB5 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00455B83(C)
|
:00455BB8 8A55FC                  mov dl, byte ptr [ebp-04]
:00455BBB 52                      push edx
:00455BBC E881AFFCFF              call 00420B42
:00455BC1 83C404                  add esp, 00000004
:00455BC4 85C0                    test eax, eax
:00455BC6 7433                    je 00455BFB
:00455BC8 6A04                    push 00000004
:00455BCA 6A04                    push 00000004
:00455BCC 6A00                    push 00000000
:00455BCE 68C0A80100              push 0001A8C0
:00455BD3 B950EB4A00              mov ecx, 004AEB50
:00455BD8 E8639E0200              call 0047FA40
:00455BDD 50                      push eax
:00455BDE 6A10                    push 00000010
:00455BE0 6A10                    push 00000010
:00455BE2 8B45F0                  mov eax, dword ptr [ebp-10]
:00455BE5 83C044                  add eax, 00000044
:00455BE8 50                      push eax
:00455BE9 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:00455BEF 83C170                  add ecx, 00000070
:00455BF2 51                      push ecx
:00455BF3 E81BBDFFFF              call 00451913
:00455BF8 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00455BC6(C)
|
:00455BFB E8F689FCFF              call 0041E5F6
:00455C00 837D0C00                cmp dword ptr [ebp+0C], 00000000
:00455C04 742D                    je 00455C33
:00455C06 E8F569FDFF              call 0042C600
:00455C0B 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:00455C11 E89C000000              call 00455CB2
:00455C16 E8E569FDFF              call 0042C600
:00455C1B 6A01                    push 00000001
:00455C1D 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:00455C23 E859E2FFFF              call 00453E81
:00455C28 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:00455C2E E8FFE1FFFF              call 00453E32

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045584E(U), :00455C04(C)
|
:00455C33 5E                      pop esi
:00455C34 8BE5                    mov esp, ebp
:00455C36 5D                      pop ebp
:00455C37 C20800                  ret 0008



* Referenced by a CALL at Address:
|:00455A2C   
|
:00455C3A 55                      push ebp
:00455C3B 8BEC                    mov ebp, esp
:00455C3D 83EC08                  sub esp, 00000008
:00455C40 C745FC00000000          mov [ebp-04], 00000000
:00455C47 8B4508                  mov eax, dword ptr [ebp+08]
:00455C4A 25FF000000              and eax, 000000FF
:00455C4F 8945F8                  mov dword ptr [ebp-08], eax
:00455C52 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00455C55 83E905                  sub ecx, 00000005
:00455C58 894DF8                  mov dword ptr [ebp-08], ecx
:00455C5B 837DF818                cmp dword ptr [ebp-08], 00000018
:00455C5F 7719                    ja 00455C7A
:00455C61 8B45F8                  mov eax, dword ptr [ebp-08]
:00455C64 33D2                    xor edx, edx
:00455C66 8A90995C4500            mov dl, byte ptr [eax+00455C99]
:00455C6C FF2495815C4500          jmp dword ptr [4*edx+00455C81]
:00455C73 C745FC01000000          mov [ebp-04], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00455C5F(C)
|
:00455C7A 8B45FC                  mov eax, dword ptr [ebp-04]
:00455C7D 8BE5                    mov esp, ebp
:00455C7F 5D                      pop ebp
:00455C80 C3                      ret



:00455C81 735C4500                DWORD 00455C73
:00455C85 735C4500                DWORD 00455C73
:00455C89 735C4500                DWORD 00455C73
:00455C8D 735C4500                DWORD 00455C73
:00455C91 735C4500                DWORD 00455C73
:00455C95 7A5C4500                DWORD 00455C7A


:00455C99 0000                    add byte ptr [eax], al
:00455C9B 0505050501              add eax, 01050505
:00455CA0 010502020503            add dword ptr [03050202], eax
:00455CA6 0505050505              add eax, 05050505
:00455CAB 0505040404              add eax, 04040405
:00455CB0 0404                    add al, 04

* Referenced by a CALL at Address:
|:00455C11   
|
:00455CB2 55                      push ebp
:00455CB3 8BEC                    mov ebp, esp
:00455CB5 83EC08                  sub esp, 00000008
:00455CB8 894DF8                  mov dword ptr [ebp-08], ecx
:00455CBB C645FC0A                mov [ebp-04], 0A
:00455CBF 8B45FC                  mov eax, dword ptr [ebp-04]
:00455CC2 25FF000000              and eax, 000000FF
:00455CC7 50                      push eax
:00455CC8 E84E5BFDFF              call 0042B81B
:00455CCD 83C404                  add esp, 00000004
:00455CD0 6A01                    push 00000001
:00455CD2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00455CD5 E8A7E1FFFF              call 00453E81
:00455CDA 6A04                    push 00000004
:00455CDC E8EA67FDFF              call 0042C4CB
:00455CE1 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00455D3A(U)
|
:00455CE4 E88268FDFF              call 0042C56B
:00455CE9 85C0                    test eax, eax
:00455CEB 754F                    jne 00455D3C
:00455CED B9181B4B00              mov ecx, 004B1B18
:00455CF2 E8F99AFDFF              call 0042F7F0
:00455CF7 85C0                    test eax, eax
:00455CF9 743F                    je 00455D3A
:00455CFB 8A4DFC                  mov cl, byte ptr [ebp-04]
:00455CFE 80F101                  xor cl, 01
:00455D01 884DFC                  mov byte ptr [ebp-04], cl
:00455D04 8B55FC                  mov edx, dword ptr [ebp-04]
:00455D07 81E2FF000000            and edx, 000000FF
:00455D0D 52                      push edx
:00455D0E E8085BFDFF              call 0042B81B
:00455D13 83C404                  add esp, 00000004
:00455D16 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00455D19 E88AE1FFFF              call 00453EA8
:00455D1E B9083D4B00              mov ecx, 004B3D08
:00455D23 E8080AFBFF              call 00406730
:00455D28 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00455D2B E8E3DDFFFF              call 00453B13
:00455D30 6A04                    push 00000004
:00455D32 E89467FDFF              call 0042C4CB
:00455D37 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00455CF9(C)
|
:00455D3A EBA8                    jmp 00455CE4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00455CEB(C)
|
:00455D3C 6A00                    push 00000000
:00455D3E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00455D41 E83BE1FFFF              call 00453E81
:00455D46 6A00                    push 00000000
:00455D48 E8CE5AFDFF              call 0042B81B
:00455D4D 83C404                  add esp, 00000004
:00455D50 8BE5                    mov esp, ebp
:00455D52 5D                      pop ebp
:00455D53 C3                      ret



* Referenced by a CALL at Address:
|:0043DCD1   
|
:00455D54 55                      push ebp
:00455D55 8BEC                    mov ebp, esp
:00455D57 51                      push ecx
:00455D58 894DFC                  mov dword ptr [ebp-04], ecx
:00455D5B 8B45FC                  mov eax, dword ptr [ebp-04]
:00455D5E 8A4D08                  mov cl, byte ptr [ebp+08]
:00455D61 884861                  mov byte ptr [eax+61], cl
:00455D64 8BE5                    mov esp, ebp
:00455D66 5D                      pop ebp
:00455D67 C20400                  ret 0004


:00455D6A 55                      push ebp
:00455D6B 8BEC                    mov ebp, esp
:00455D6D 51                      push ecx
:00455D6E 894DFC                  mov dword ptr [ebp-04], ecx
:00455D71 8B45FC                  mov eax, dword ptr [ebp-04]
:00455D74 8B4D08                  mov ecx, dword ptr [ebp+08]
:00455D77 8988781B0000            mov dword ptr [eax+00001B78], ecx
:00455D7D 8BE5                    mov esp, ebp
:00455D7F 5D                      pop ebp
:00455D80 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0045191B   , :0047BDFE   , :0047BFA5   
|
:00455D83 55                      push ebp
:00455D84 8BEC                    mov ebp, esp
:00455D86 51                      push ecx
:00455D87 894DFC                  mov dword ptr [ebp-04], ecx
:00455D8A 8B45FC                  mov eax, dword ptr [ebp-04]
:00455D8D 8B00                    mov eax, dword ptr [eax]
:00455D8F 8BE5                    mov esp, ebp
:00455D91 5D                      pop ebp
:00455D92 C3                      ret



* Referenced by a CALL at Addresses:
|:0047B4B1   , :0047B619   
|
:00455D93 55                      push ebp
:00455D94 8BEC                    mov ebp, esp
:00455D96 51                      push ecx
:00455D97 894DFC                  mov dword ptr [ebp-04], ecx
:00455D9A 8B45FC                  mov eax, dword ptr [ebp-04]
:00455D9D 8B4D08                  mov ecx, dword ptr [ebp+08]
:00455DA0 8908                    mov dword ptr [eax], ecx
:00455DA2 8BE5                    mov esp, ebp
:00455DA4 5D                      pop ebp
:00455DA5 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0044A752   , :00456423   , :004568B2   , :0047C031   , :0047C0B5   
|
:00455DA8 55                      push ebp
:00455DA9 8BEC                    mov ebp, esp
:00455DAB 51                      push ecx
:00455DAC 894DFC                  mov dword ptr [ebp-04], ecx
:00455DAF 8B45FC                  mov eax, dword ptr [ebp-04]
:00455DB2 8B4004                  mov eax, dword ptr [eax+04]
:00455DB5 8BE5                    mov esp, ebp
:00455DB7 5D                      pop ebp
:00455DB8 C3                      ret



* Referenced by a CALL at Addresses:
|:004611AC   , :0047B54C   , :0047C05E   
|
:00455DB9 55                      push ebp
:00455DBA 8BEC                    mov ebp, esp
:00455DBC 51                      push ecx
:00455DBD 894DFC                  mov dword ptr [ebp-04], ecx
:00455DC0 8B45FC                  mov eax, dword ptr [ebp-04]
:00455DC3 8B4D08                  mov ecx, dword ptr [ebp+08]
:00455DC6 894804                  mov dword ptr [eax+04], ecx
:00455DC9 8BE5                    mov esp, ebp
:00455DCB 5D                      pop ebp
:00455DCC C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0044A77D   , :00456443   , :004568D2   , :0047C068   , :0047C0A2   
|
:00455DCF 55                      push ebp
:00455DD0 8BEC                    mov ebp, esp
:00455DD2 51                      push ecx
:00455DD3 894DFC                  mov dword ptr [ebp-04], ecx
:00455DD6 8B45FC                  mov eax, dword ptr [ebp-04]
:00455DD9 8B4008                  mov eax, dword ptr [eax+08]
:00455DDC 8BE5                    mov esp, ebp
:00455DDE 5D                      pop ebp
:00455DDF C3                      ret



* Referenced by a CALL at Addresses:
|:004611D9   , :0047B558   , :0047C096   
|
:00455DE0 55                      push ebp
:00455DE1 8BEC                    mov ebp, esp
:00455DE3 51                      push ecx
:00455DE4 894DFC                  mov dword ptr [ebp-04], ecx
:00455DE7 8B45FC                  mov eax, dword ptr [ebp-04]
:00455DEA 8B4D08                  mov ecx, dword ptr [ebp+08]
:00455DED 894808                  mov dword ptr [eax+08], ecx
:00455DF0 8BE5                    mov esp, ebp
:00455DF2 5D                      pop ebp
:00455DF3 C20400                  ret 0004


:00455DF6 55                      push ebp
:00455DF7 8BEC                    mov ebp, esp
:00455DF9 51                      push ecx
:00455DFA 894DFC                  mov dword ptr [ebp-04], ecx
:00455DFD 8B45FC                  mov eax, dword ptr [ebp-04]
:00455E00 8B400C                  mov eax, dword ptr [eax+0C]
:00455E03 8BE5                    mov esp, ebp
:00455E05 5D                      pop ebp
:00455E06 C3                      ret



* Referenced by a CALL at Address:
|:0047B499   
|
:00455E07 55                      push ebp
:00455E08 8BEC                    mov ebp, esp
:00455E0A 51                      push ecx
:00455E0B 894DFC                  mov dword ptr [ebp-04], ecx
:00455E0E 8B45FC                  mov eax, dword ptr [ebp-04]
:00455E11 8B4D08                  mov ecx, dword ptr [ebp+08]
:00455E14 89480C                  mov dword ptr [eax+0C], ecx
:00455E17 8BE5                    mov esp, ebp
:00455E19 5D                      pop ebp
:00455E1A C20400                  ret 0004


:00455E1D 55                      push ebp
:00455E1E 8BEC                    mov ebp, esp
:00455E20 51                      push ecx
:00455E21 894DFC                  mov dword ptr [ebp-04], ecx
:00455E24 8B45FC                  mov eax, dword ptr [ebp-04]
:00455E27 8B4010                  mov eax, dword ptr [eax+10]
:00455E2A 8BE5                    mov esp, ebp
:00455E2C 5D                      pop ebp
:00455E2D C3                      ret



* Referenced by a CALL at Address:
|:0047B4A5   
|
:00455E2E 55                      push ebp
:00455E2F 8BEC                    mov ebp, esp
:00455E31 51                      push ecx
:00455E32 894DFC                  mov dword ptr [ebp-04], ecx
:00455E35 8B45FC                  mov eax, dword ptr [ebp-04]
:00455E38 8B4D08                  mov ecx, dword ptr [ebp+08]
:00455E3B 894810                  mov dword ptr [eax+10], ecx
:00455E3E 8BE5                    mov esp, ebp
:00455E40 5D                      pop ebp
:00455E41 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00401DB2   , :0040859D   , :00414188   , :00421540   , :0042CBB7   
|:0042CE71   , :0042D652   , :0042DE2E   , :0042F464   , :0044205D   
|:004496B0   , :00449758   , :0044A7A8   , :0044A9C3   , :0044AC36   
|:0044B5B6   , :0044BAD0   , :0044BD35   , :0044DA35   , :0044FB81   
|:0044FC98   , :0044FE90   , :0044FF77   , :00451937   , :00451998   
|:0045B9EC   , :0045F1DF   , :00460ABF   , :0046628B   , :0047B6DC   
|:0047BD47   , :0047BD76   , :0047BE10   
|
:00455E44 55                      push ebp
:00455E45 8BEC                    mov ebp, esp
:00455E47 51                      push ecx
:00455E48 894DFC                  mov dword ptr [ebp-04], ecx
:00455E4B 8B45FC                  mov eax, dword ptr [ebp-04]
:00455E4E 8B4014                  mov eax, dword ptr [eax+14]
:00455E51 8BE5                    mov esp, ebp
:00455E53 5D                      pop ebp
:00455E54 C3                      ret



* Referenced by a CALL at Addresses:
|:0047B4C2   , :0047B5F9   , :0047BDB0   , :0047BFF3   
|
:00455E55 55                      push ebp
:00455E56 8BEC                    mov ebp, esp
:00455E58 51                      push ecx
:00455E59 894DFC                  mov dword ptr [ebp-04], ecx
:00455E5C 8B45FC                  mov eax, dword ptr [ebp-04]
:00455E5F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00455E62 894814                  mov dword ptr [eax+14], ecx
:00455E65 8BE5                    mov esp, ebp
:00455E67 5D                      pop ebp
:00455E68 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00401DE1   , :004085B5   , :004141A5   , :00421552   , :0042CBCF   
|:0042D645   , :0042DE21   , :0042F476   , :0044207D   , :004496C8   
|:00449784   , :0044A7D3   , :0044AC4B   , :0044B5CB   , :0044BAE5   
|:0044BD4A   , :0044DA4A   , :0044FB96   , :0044FCB2   , :00451929   
|:0045198A   , :0045BA3B   , :0045BA49   , :0045F1C3   , :004662DA   
|:004662E8   , :0047B6D1   , :0047BD5C   , :0047BD8B   , :0047BE20   
|
:00455E6B 55                      push ebp
:00455E6C 8BEC                    mov ebp, esp
:00455E6E 51                      push ecx
:00455E6F 894DFC                  mov dword ptr [ebp-04], ecx
:00455E72 8B45FC                  mov eax, dword ptr [ebp-04]
:00455E75 8B4018                  mov eax, dword ptr [eax+18]
:00455E78 8BE5                    mov esp, ebp
:00455E7A 5D                      pop ebp
:00455E7B C3                      ret



* Referenced by a CALL at Addresses:
|:0047B4EE   , :0047B60D   , :0047BDC5   , :0047C00D   
|
:00455E7C 55                      push ebp
:00455E7D 8BEC                    mov ebp, esp
:00455E7F 51                      push ecx
:00455E80 894DFC                  mov dword ptr [ebp-04], ecx
:00455E83 8B45FC                  mov eax, dword ptr [ebp-04]
:00455E86 8B4D08                  mov ecx, dword ptr [ebp+08]
:00455E89 894818                  mov dword ptr [eax+18], ecx
:00455E8C 8BE5                    mov esp, ebp
:00455E8E 5D                      pop ebp
:00455E8F C20400                  ret 0004



* Referenced by a CALL at Address:
|:0047BDA5   
|
:00455E92 55                      push ebp
:00455E93 8BEC                    mov ebp, esp
:00455E95 51                      push ecx
:00455E96 894DFC                  mov dword ptr [ebp-04], ecx
:00455E99 8B45FC                  mov eax, dword ptr [ebp-04]
:00455E9C 8B401C                  mov eax, dword ptr [eax+1C]
:00455E9F 8BE5                    mov esp, ebp
:00455EA1 5D                      pop ebp
:00455EA2 C3                      ret



* Referenced by a CALL at Addresses:
|:0044DA40   , :0047BD52   , :0047BD81   
|
:00455EA3 55                      push ebp
:00455EA4 8BEC                    mov ebp, esp
:00455EA6 51                      push ecx
:00455EA7 894DFC                  mov dword ptr [ebp-04], ecx
:00455EAA 8B45FC                  mov eax, dword ptr [ebp-04]
:00455EAD 8B4D08                  mov ecx, dword ptr [ebp+08]
:00455EB0 89481C                  mov dword ptr [eax+1C], ecx
:00455EB3 8BE5                    mov esp, ebp
:00455EB5 5D                      pop ebp
:00455EB6 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0047BDBA   
|
:00455EB9 55                      push ebp
:00455EBA 8BEC                    mov ebp, esp
:00455EBC 51                      push ecx
:00455EBD 894DFC                  mov dword ptr [ebp-04], ecx
:00455EC0 8B45FC                  mov eax, dword ptr [ebp-04]
:00455EC3 8B4020                  mov eax, dword ptr [eax+20]
:00455EC6 8BE5                    mov esp, ebp
:00455EC8 5D                      pop ebp
:00455EC9 C3                      ret



* Referenced by a CALL at Addresses:
|:0044DA55   , :0047BD67   , :0047BD96   
|
:00455ECA 55                      push ebp
:00455ECB 8BEC                    mov ebp, esp
:00455ECD 51                      push ecx
:00455ECE 894DFC                  mov dword ptr [ebp-04], ecx
:00455ED1 8B45FC                  mov eax, dword ptr [ebp-04]
:00455ED4 8B4D08                  mov ecx, dword ptr [ebp+08]
:00455ED7 894820                  mov dword ptr [eax+20], ecx
:00455EDA 8BE5                    mov esp, ebp
:00455EDC 5D                      pop ebp
:00455EDD C20400                  ret 0004



* Referenced by a CALL at Address:
|:0047B678   
|
:00455EE0 55                      push ebp
:00455EE1 8BEC                    mov ebp, esp
:00455EE3 51                      push ecx
:00455EE4 894DFC                  mov dword ptr [ebp-04], ecx
:00455EE7 8B45FC                  mov eax, dword ptr [ebp-04]
:00455EEA 8B4024                  mov eax, dword ptr [eax+24]
:00455EED 8BE5                    mov esp, ebp
:00455EEF 5D                      pop ebp
:00455EF0 C3                      ret



* Referenced by a CALL at Addresses:
|:0047B455   , :0047B590   
|
:00455EF1 55                      push ebp
:00455EF2 8BEC                    mov ebp, esp
:00455EF4 51                      push ecx
:00455EF5 894DFC                  mov dword ptr [ebp-04], ecx
:00455EF8 8B45FC                  mov eax, dword ptr [ebp-04]
:00455EFB 8B4D08                  mov ecx, dword ptr [ebp+08]
:00455EFE 894824                  mov dword ptr [eax+24], ecx
:00455F01 8BE5                    mov esp, ebp
:00455F03 5D                      pop ebp
:00455F04 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0047B688   
|
:00455F07 55                      push ebp
:00455F08 8BEC                    mov ebp, esp
:00455F0A 51                      push ecx
:00455F0B 894DFC                  mov dword ptr [ebp-04], ecx
:00455F0E 8B45FC                  mov eax, dword ptr [ebp-04]
:00455F11 8B4028                  mov eax, dword ptr [eax+28]
:00455F14 8BE5                    mov esp, ebp
:00455F16 5D                      pop ebp
:00455F17 C3                      ret



* Referenced by a CALL at Addresses:
|:0047B47F   , :0047B5C7   
|
:00455F18 55                      push ebp
:00455F19 8BEC                    mov ebp, esp
:00455F1B 51                      push ecx
:00455F1C 894DFC                  mov dword ptr [ebp-04], ecx
:00455F1F 8B45FC                  mov eax, dword ptr [ebp-04]
:00455F22 8B4D08                  mov ecx, dword ptr [ebp+08]
:00455F25 894828                  mov dword ptr [eax+28], ecx
:00455F28 8BE5                    mov esp, ebp
:00455F2A 5D                      pop ebp
:00455F2B C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0047B562   , :0047B57F   , :0047B7B9   , :0047B7C8   , :0047B82D   
|:0047B83C   
|
:00455F2E 55                      push ebp
:00455F2F 8BEC                    mov ebp, esp
:00455F31 51                      push ecx
:00455F32 894DFC                  mov dword ptr [ebp-04], ecx
:00455F35 8B45FC                  mov eax, dword ptr [ebp-04]
:00455F38 8B402C                  mov eax, dword ptr [eax+2C]
:00455F3B 8BE5                    mov esp, ebp
:00455F3D 5D                      pop ebp
:00455F3E C3                      ret



* Referenced by a CALL at Addresses:
|:0047B447   , :0047B745   
|
:00455F3F 55                      push ebp
:00455F40 8BEC                    mov ebp, esp
:00455F42 51                      push ecx
:00455F43 894DFC                  mov dword ptr [ebp-04], ecx
:00455F46 8B45FC                  mov eax, dword ptr [ebp-04]
:00455F49 8B4D08                  mov ecx, dword ptr [ebp+08]
:00455F4C 89482C                  mov dword ptr [eax+2C], ecx
:00455F4F 8BE5                    mov esp, ebp
:00455F51 5D                      pop ebp
:00455F52 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0047B59A   , :0047B5B6   , :0047B89D   , :0047B8AC   , :0047B911   
|:0047B920   
|
:00455F55 55                      push ebp
:00455F56 8BEC                    mov ebp, esp
:00455F58 51                      push ecx
:00455F59 894DFC                  mov dword ptr [ebp-04], ecx
:00455F5C 8B45FC                  mov eax, dword ptr [ebp-04]
:00455F5F 8B4030                  mov eax, dword ptr [eax+30]
:00455F62 8BE5                    mov esp, ebp
:00455F64 5D                      pop ebp
:00455F65 C3                      ret



* Referenced by a CALL at Addresses:
|:0047B471   , :0047B753   
|
:00455F66 55                      push ebp
:00455F67 8BEC                    mov ebp, esp
:00455F69 51                      push ecx
:00455F6A 894DFC                  mov dword ptr [ebp-04], ecx
:00455F6D 8B45FC                  mov eax, dword ptr [ebp-04]
:00455F70 8B4D08                  mov ecx, dword ptr [ebp+08]
:00455F73 894830                  mov dword ptr [eax+30], ecx
:00455F76 8BE5                    mov esp, ebp
:00455F78 5D                      pop ebp
:00455F79 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0044A898   , :0044AA04   , :00460E70   , :0047B96D   , :0047B98B   
|:0047C017   
|
:00455F7C 55                      push ebp
:00455F7D 8BEC                    mov ebp, esp
:00455F7F 51                      push ecx
:00455F80 894DFC                  mov dword ptr [ebp-04], ecx
:00455F83 8B45FC                  mov eax, dword ptr [ebp-04]
:00455F86 8B4034                  mov eax, dword ptr [eax+34]
:00455F89 8BE5                    mov esp, ebp
:00455F8B 5D                      pop ebp
:00455F8C C3                      ret



* Referenced by a CALL at Addresses:
|:0047B463   , :0047B5D8   
|
:00455F8D 55                      push ebp
:00455F8E 8BEC                    mov ebp, esp
:00455F90 51                      push ecx
:00455F91 894DFC                  mov dword ptr [ebp-04], ecx
:00455F94 8B45FC                  mov eax, dword ptr [ebp-04]
:00455F97 8B4D08                  mov ecx, dword ptr [ebp+08]
:00455F9A 894834                  mov dword ptr [eax+34], ecx
:00455F9D 8BE5                    mov esp, ebp
:00455F9F 5D                      pop ebp
:00455FA0 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0044A8B0   , :0044AA22   , :0044AB1E   , :00460E95   , :0047B9B1   
|:0047B9DA   , :0047C024   
|
:00455FA3 55                      push ebp
:00455FA4 8BEC                    mov ebp, esp
:00455FA6 51                      push ecx
:00455FA7 894DFC                  mov dword ptr [ebp-04], ecx
:00455FAA 8B45FC                  mov eax, dword ptr [ebp-04]
:00455FAD 8B4038                  mov eax, dword ptr [eax+38]
:00455FB0 8BE5                    mov esp, ebp
:00455FB2 5D                      pop ebp
:00455FB3 C3                      ret



* Referenced by a CALL at Addresses:
|:0047B48D   , :0047B5E8   
|
:00455FB4 55                      push ebp
:00455FB5 8BEC                    mov ebp, esp
:00455FB7 51                      push ecx
:00455FB8 894DFC                  mov dword ptr [ebp-04], ecx
:00455FBB 8B45FC                  mov eax, dword ptr [ebp-04]
:00455FBE 8B4D08                  mov ecx, dword ptr [ebp+08]
:00455FC1 894838                  mov dword ptr [eax+38], ecx
:00455FC4 8BE5                    mov esp, ebp
:00455FC6 5D                      pop ebp
:00455FC7 C20400                  ret 0004


:00455FCA CC                      int 03
:00455FCB CC                      int 03
:00455FCC CC                      int 03
:00455FCD CC                      int 03
:00455FCE CC                      int 03
:00455FCF CC                      int 03
:00455FD0 55                      push ebp
:00455FD1 8BEC                    mov ebp, esp
:00455FD3 E802000000              call 00455FDA
:00455FD8 5D                      pop ebp
:00455FD9 C3                      ret



* Referenced by a CALL at Address:
|:00455FD3   
|
:00455FDA 55                      push ebp
:00455FDB 8BEC                    mov ebp, esp
:00455FDD 5D                      pop ebp
:00455FDE C3                      ret



* Referenced by a CALL at Address:
|:0044D7B3   
|
:00455FDF 55                      push ebp
:00455FE0 8BEC                    mov ebp, esp
:00455FE2 51                      push ecx
:00455FE3 894DFC                  mov dword ptr [ebp-04], ecx
:00455FE6 8B45FC                  mov eax, dword ptr [ebp-04]
:00455FE9 C700FFFF0000            mov dword ptr [eax], 0000FFFF
:00455FEF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00455FF2 C74104FFFF0000          mov [ecx+04], 0000FFFF
:00455FF9 8BE5                    mov esp, ebp
:00455FFB 5D                      pop ebp
:00455FFC C3                      ret



* Referenced by a CALL at Addresses:
|:004157A8   , :004158A3   
|
:00455FFD 55                      push ebp
:00455FFE 8BEC                    mov ebp, esp
:00456000 51                      push ecx
:00456001 894DFC                  mov dword ptr [ebp-04], ecx
:00456004 E81959FBFF              call 0040B922
:00456009 85C0                    test eax, eax
:0045600B 7415                    je 00456022
:0045600D 8A4508                  mov al, byte ptr [ebp+08]
:00456010 50                      push eax
:00456011 B9083D4B00              mov ecx, 004B3D08
:00456016 E8055EFBFF              call 0040BE20
:0045601B B801000000              mov eax, 00000001
:00456020 EB03                    jmp 00456025

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045600B(C)
|
:00456022 83C8FF                  or eax, FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00456020(U)
|
:00456025 8BE5                    mov esp, ebp
:00456027 5D                      pop ebp
:00456028 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:004113B6   , :004120D3   , :0041326F   , :004136DA   , :00414BE0   
|:00414D99   , :00415305   , :004156FD   , :00459A5C   
|
:0045602B 55                      push ebp
:0045602C 8BEC                    mov ebp, esp
:0045602E 83EC08                  sub esp, 00000008
:00456031 894DF8                  mov dword ptr [ebp-08], ecx
:00456034 8B45F8                  mov eax, dword ptr [ebp-08]
:00456037 8B08                    mov ecx, dword ptr [eax]
:00456039 51                      push ecx
:0045603A E83A000000              call 00456079
:0045603F 83C404                  add esp, 00000004
:00456042 8945FC                  mov dword ptr [ebp-04], eax
:00456045 837DFCFF                cmp dword ptr [ebp-04], FFFFFFFF
:00456049 7425                    je 00456070
:0045604B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045604E E83D2CFCFF              call 00418C90
:00456053 25FF000000              and eax, 000000FF
:00456058 83F802                  cmp eax, 00000002
:0045605B 7513                    jne 00456070
:0045605D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00456060 E82BCC0100              call 00472C90
:00456065 85C0                    test eax, eax
:00456067 7607                    jbe 00456070
:00456069 8B55F8                  mov edx, dword ptr [ebp-08]
:0045606C 8B02                    mov eax, dword ptr [edx]
:0045606E EB05                    jmp 00456075

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00456049(C), :0045605B(C), :00456067(C)
|
:00456070 B8FFFF0000              mov eax, 0000FFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045606E(U)
|
:00456075 8BE5                    mov esp, ebp
:00456077 5D                      pop ebp
:00456078 C3                      ret



* Referenced by a CALL at Addresses:
|:0045603A   , :00456100   , :00457102   , :004591CA   , :0045949C   
|:00459D98   , :0045A47B   , :0045A6CC   , :0045A75E   , :0045A778   
|:0045A7C4   
|
:00456079 55                      push ebp
:0045607A 8BEC                    mov ebp, esp
:0045607C 51                      push ecx
:0045607D C645FC00                mov [ebp-04], 00
:00456081 EB08                    jmp 0045608B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004560E7(U)
|
:00456083 8A45FC                  mov al, byte ptr [ebp-04]
:00456086 0401                    add al, 01
:00456088 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00456081(U)
|
:0045608B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045608E 81E1FF000000            and ecx, 000000FF
:00456094 83F973                  cmp ecx, 00000073
:00456097 7D50                    jge 004560E9
:00456099 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045609C 81E1FF000000            and ecx, 000000FF
:004560A2 6BC924                  imul ecx, 00000024
:004560A5 81C1502C4B00            add ecx, 004B2C50
:004560AB E8C0950000              call 0045F670
:004560B0 3B4508                  cmp eax, dword ptr [ebp+08]
:004560B3 7532                    jne 004560E7
:004560B5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004560B8 81E1FF000000            and ecx, 000000FF
:004560BE 6BC924                  imul ecx, 00000024
:004560C1 81C1502C4B00            add ecx, 004B2C50
:004560C7 E8C42BFCFF              call 00418C90
:004560CC 25FF000000              and eax, 000000FF
:004560D1 85C0                    test eax, eax
:004560D3 7412                    je 004560E7
:004560D5 8B45FC                  mov eax, dword ptr [ebp-04]
:004560D8 25FF000000              and eax, 000000FF
:004560DD 6BC024                  imul eax, 00000024
:004560E0 05502C4B00              add eax, 004B2C50
:004560E5 EB05                    jmp 004560EC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004560B3(C), :004560D3(C)
|
:004560E7 EB9A                    jmp 00456083

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00456097(C)
|
:004560E9 83C8FF                  or eax, FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004560E5(U)
|
:004560EC 8BE5                    mov esp, ebp
:004560EE 5D                      pop ebp
:004560EF C3                      ret



* Referenced by a CALL at Address:
|:00459A49   
|
:004560F0 55                      push ebp
:004560F1 8BEC                    mov ebp, esp
:004560F3 83EC08                  sub esp, 00000008
:004560F6 894DF8                  mov dword ptr [ebp-08], ecx
:004560F9 8B45F8                  mov eax, dword ptr [ebp-08]
:004560FC 8B4804                  mov ecx, dword ptr [eax+04]
:004560FF 51                      push ecx
:00456100 E874FFFFFF              call 00456079
:00456105 83C404                  add esp, 00000004
:00456108 8945FC                  mov dword ptr [ebp-04], eax
:0045610B 837DFCFF                cmp dword ptr [ebp-04], FFFFFFFF
:0045610F 7426                    je 00456137
:00456111 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00456114 E8772BFCFF              call 00418C90
:00456119 25FF000000              and eax, 000000FF
:0045611E 83F802                  cmp eax, 00000002
:00456121 7514                    jne 00456137
:00456123 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00456126 E865CB0100              call 00472C90
:0045612B 85C0                    test eax, eax
:0045612D 7608                    jbe 00456137
:0045612F 8B55F8                  mov edx, dword ptr [ebp-08]
:00456132 8B4204                  mov eax, dword ptr [edx+04]
:00456135 EB05                    jmp 0045613C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045610F(C), :00456121(C), :0045612D(C)
|
:00456137 B8FFFF0000              mov eax, 0000FFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00456135(U)
|
:0045613C 8BE5                    mov esp, ebp
:0045613E 5D                      pop ebp
:0045613F C3                      ret



* Referenced by a CALL at Addresses:
|:0041402D   , :0041685B   
|
:00456140 55                      push ebp
:00456141 8BEC                    mov ebp, esp
:00456143 6AFF                    push FFFFFFFF
:00456145 686C564800              push 0048566C
:0045614A 64A100000000            mov eax, dword ptr fs:[00000000]
:00456150 50                      push eax
:00456151 64892500000000          mov dword ptr fs:[00000000], esp
:00456158 81EC38010000            sub esp, 00000138
:0045615E 53                      push ebx
:0045615F 898DC4FEFFFF            mov dword ptr [ebp+FFFFFEC4], ecx
:00456165 8A450C                  mov al, byte ptr [ebp+0C]
:00456168 50                      push eax
:00456169 8A4D08                  mov cl, byte ptr [ebp+08]
:0045616C 51                      push ecx
:0045616D 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00456170 E85B2BFCFF              call 00418CD0
:00456175 C745E400000000          mov [ebp-1C], 00000000
:0045617C C745E000000000          mov [ebp-20], 00000000
:00456183 EB09                    jmp 0045618E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004561CB(U)
|
:00456185 8B55E0                  mov edx, dword ptr [ebp-20]
:00456188 83C201                  add edx, 00000001
:0045618B 8955E0                  mov dword ptr [ebp-20], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00456183(U)
|
:0045618E 817DE0FA000000          cmp dword ptr [ebp-20], 000000FA
:00456195 7336                    jnb 004561CD
:00456197 8B45E0                  mov eax, dword ptr [ebp-20]
:0045619A 6BC005                  imul eax, 00000005
:0045619D 33C9                    xor ecx, ecx
:0045619F 8A88253D4B00            mov cl, byte ptr [eax+004B3D25]
:004561A5 81F9FF000000            cmp ecx, 000000FF
:004561AB 741C                    je 004561C9
:004561AD 8D55F0                  lea edx, dword ptr [ebp-10]
:004561B0 52                      push edx
:004561B1 8B45E0                  mov eax, dword ptr [ebp-20]
:004561B4 6BC005                  imul eax, 00000005
:004561B7 05213D4B00              add eax, 004B3D21
:004561BC 50                      push eax
:004561BD E85E52FEFF              call 0043B420
:004561C2 83C408                  add esp, 00000008
:004561C5 85C0                    test eax, eax
:004561C7 7402                    je 004561CB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004561AB(C)
|
:004561C9 EB02                    jmp 004561CD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004561C7(C)
|
:004561CB EBB8                    jmp 00456185

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00456195(C), :004561C9(U)
|
:004561CD 817DE0FA000000          cmp dword ptr [ebp-20], 000000FA
:004561D4 7205                    jb 004561DB
:004561D6 E9D5050000              jmp 004567B0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004561D4(C)
|
:004561DB 8A4D14                  mov cl, byte ptr [ebp+14]
:004561DE 888DC0FEFFFF            mov byte ptr [ebp+FFFFFEC0], cl
:004561E4 80BDC0FEFFFF00          cmp byte ptr [ebp+FFFFFEC0], 00
:004561EB 7414                    je 00456201
:004561ED 80BDC0FEFFFF00          cmp byte ptr [ebp+FFFFFEC0], 00
:004561F4 7615                    jbe 0045620B
:004561F6 80BDC0FEFFFF02          cmp byte ptr [ebp+FFFFFEC0], 02
:004561FD 7608                    jbe 00456207
:004561FF EB0A                    jmp 0045620B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004561EB(C)
|
:00456201 C645101A                mov [ebp+10], 1A
:00456205 EB04                    jmp 0045620B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004561FD(C)
|
:00456207 C645101B                mov [ebp+10], 1B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004561F4(C), :004561FF(U), :00456205(U)
|
:0045620B 8D55F0                  lea edx, dword ptr [ebp-10]
:0045620E 52                      push edx
:0045620F 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00456212 6BC905                  imul ecx, 00000005
:00456215 81C1213D4B00            add ecx, 004B3D21
:0045621B E88003FBFF              call 004065A0
:00456220 8B45E0                  mov eax, dword ptr [ebp-20]
:00456223 6BC005                  imul eax, 00000005
:00456226 8A4D10                  mov cl, byte ptr [ebp+10]
:00456229 8888233D4B00            mov byte ptr [eax+004B3D23], cl
:0045622F 6A04                    push 00000004
:00456231 6A00                    push 00000000
:00456233 6A00                    push 00000000
:00456235 B938EB4A00              mov ecx, 004AEB38
:0045623A E801980200              call 0047FA40
:0045623F 8B5508                  mov edx, dword ptr [ebp+08]
:00456242 81E2FF000000            and edx, 000000FF
:00456248 8D841040060000          lea eax, dword ptr [eax+edx+00000640]
:0045624F 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00456252 81E1FF000000            and ecx, 000000FF
:00456258 33D2                    xor edx, edx
:0045625A 8A152C424B00            mov dl, byte ptr [004B422C]
:00456260 0FAFCA                  imul ecx, edx
:00456263 8B55E0                  mov edx, dword ptr [ebp-20]
:00456266 6BD205                  imul edx, 00000005
:00456269 8A0408                  mov al, byte ptr [eax+ecx]
:0045626C 8882243D4B00            mov byte ptr [edx+004B3D24], al
:00456272 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00456275 6BC905                  imul ecx, 00000005
:00456278 8A5514                  mov dl, byte ptr [ebp+14]
:0045627B 8891253D4B00            mov byte ptr [ecx+004B3D25], dl
:00456281 6A04                    push 00000004
:00456283 6A00                    push 00000000
:00456285 6A00                    push 00000000
:00456287 B938EB4A00              mov ecx, 004AEB38
:0045628C E8AF970200              call 0047FA40
:00456291 8B4D08                  mov ecx, dword ptr [ebp+08]
:00456294 81E1FF000000            and ecx, 000000FF
:0045629A 8D940840060000          lea edx, dword ptr [eax+ecx+00000640]
:004562A1 8B450C                  mov eax, dword ptr [ebp+0C]
:004562A4 25FF000000              and eax, 000000FF
:004562A9 33C9                    xor ecx, ecx
:004562AB 8A0D2C424B00            mov cl, byte ptr [004B422C]
:004562B1 0FAFC1                  imul eax, ecx
:004562B4 8A4D10                  mov cl, byte ptr [ebp+10]
:004562B7 880C02                  mov byte ptr [edx+eax], cl
:004562BA 8B5510                  mov edx, dword ptr [ebp+10]
:004562BD 81E2FF000000            and edx, 000000FF
:004562C3 83FA11                  cmp edx, 00000011
:004562C6 0F852B010000            jne 004563F7
:004562CC C645DCFF                mov [ebp-24], FF
:004562D0 EB08                    jmp 004562DA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045635D(U)
|
:004562D2 8A45DC                  mov al, byte ptr [ebp-24]
:004562D5 0402                    add al, 02
:004562D7 8845DC                  mov byte ptr [ebp-24], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004562D0(U)
|
:004562DA 0FBE4DDC                movsx ecx, byte ptr [ebp-24]
:004562DE 83F901                  cmp ecx, 00000001
:004562E1 7F7F                    jg 00456362
:004562E3 8B55F0                  mov edx, dword ptr [ebp-10]
:004562E6 81E2FF000000            and edx, 000000FF
:004562EC 0FBE45DC                movsx eax, byte ptr [ebp-24]
:004562F0 03D0                    add edx, eax
:004562F2 85D2                    test edx, edx
:004562F4 7C67                    jl 0045635D
:004562F6 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004562F9 81E1FF000000            and ecx, 000000FF
:004562FF 0FBE55DC                movsx edx, byte ptr [ebp-24]
:00456303 03CA                    add ecx, edx
:00456305 33C0                    xor eax, eax
:00456307 A02C424B00              mov al, byte ptr [004B422C]
:0045630C 3BC8                    cmp ecx, eax
:0045630E 7D4D                    jge 0045635D
:00456310 6A04                    push 00000004
:00456312 6A00                    push 00000000
:00456314 6A00                    push 00000000
:00456316 B938EB4A00              mov ecx, 004AEB38
:0045631B E820970200              call 0047FA40
:00456320 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00456323 81E1FF000000            and ecx, 000000FF
:00456329 0FBE55DC                movsx edx, byte ptr [ebp-24]
:0045632D 03CA                    add ecx, edx
:0045632F 8D840840060000          lea eax, dword ptr [eax+ecx+00000640]
:00456336 8B4DF1                  mov ecx, dword ptr [ebp-0F]
:00456339 81E1FF000000            and ecx, 000000FF
:0045633F 33D2                    xor edx, edx
:00456341 8A152C424B00            mov dl, byte ptr [004B422C]
:00456347 0FAFCA                  imul ecx, edx
:0045634A 33D2                    xor edx, edx
:0045634C 8A1408                  mov dl, byte ptr [eax+ecx]
:0045634F 83FA11                  cmp edx, 00000011
:00456352 7509                    jne 0045635D
:00456354 C745E401000000          mov [ebp-1C], 00000001
:0045635B EB05                    jmp 00456362

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004562F4(C), :0045630E(C), :00456352(C)
|
:0045635D E970FFFFFF              jmp 004562D2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004562E1(C), :0045635B(U)
|
:00456362 C645DCFF                mov [ebp-24], FF
:00456366 EB08                    jmp 00456370

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004563F2(U)
|
:00456368 8A45DC                  mov al, byte ptr [ebp-24]
:0045636B 0402                    add al, 02
:0045636D 8845DC                  mov byte ptr [ebp-24], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00456366(U)
|
:00456370 0FBE4DDC                movsx ecx, byte ptr [ebp-24]
:00456374 83F901                  cmp ecx, 00000001
:00456377 7F7E                    jg 004563F7
:00456379 8B55F1                  mov edx, dword ptr [ebp-0F]
:0045637C 81E2FF000000            and edx, 000000FF
:00456382 0FBE45DC                movsx eax, byte ptr [ebp-24]
:00456386 03D0                    add edx, eax
:00456388 85D2                    test edx, edx
:0045638A 7C66                    jl 004563F2
:0045638C 8B4DF1                  mov ecx, dword ptr [ebp-0F]
:0045638F 81E1FF000000            and ecx, 000000FF
:00456395 0FBE55DC                movsx edx, byte ptr [ebp-24]
:00456399 03CA                    add ecx, edx
:0045639B 33C0                    xor eax, eax
:0045639D A02D424B00              mov al, byte ptr [004B422D]
:004563A2 3BC8                    cmp ecx, eax
:004563A4 7D4C                    jge 004563F2
:004563A6 6A04                    push 00000004
:004563A8 6A00                    push 00000000
:004563AA 6A00                    push 00000000
:004563AC B938EB4A00              mov ecx, 004AEB38
:004563B1 E88A960200              call 0047FA40
:004563B6 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004563B9 81E1FF000000            and ecx, 000000FF
:004563BF 8D940840060000          lea edx, dword ptr [eax+ecx+00000640]
:004563C6 8B45F1                  mov eax, dword ptr [ebp-0F]
:004563C9 25FF000000              and eax, 000000FF
:004563CE 0FBE4DDC                movsx ecx, byte ptr [ebp-24]
:004563D2 03C1                    add eax, ecx
:004563D4 33C9                    xor ecx, ecx
:004563D6 8A0D2C424B00            mov cl, byte ptr [004B422C]
:004563DC 0FAFC1                  imul eax, ecx
:004563DF 33C9                    xor ecx, ecx
:004563E1 8A0C02                  mov cl, byte ptr [edx+eax]
:004563E4 83F911                  cmp ecx, 00000011
:004563E7 7509                    jne 004563F2
:004563E9 C745E401000000          mov [ebp-1C], 00000001
:004563F0 EB05                    jmp 004563F7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045638A(C), :004563A4(C), :004563E7(C)
|
:004563F2 E971FFFFFF              jmp 00456368

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004562C6(C), :00456377(C), :004563F0(U)
|
:004563F7 837D1800                cmp dword ptr [ebp+18], 00000000
:004563FB 7418                    je 00456415
:004563FD 837D1C00                cmp dword ptr [ebp+1C], 00000000
:00456401 7512                    jne 00456415
:00456403 8A55F1                  mov dl, byte ptr [ebp-0F]
:00456406 52                      push edx
:00456407 8A45F0                  mov al, byte ptr [ebp-10]
:0045640A 50                      push eax
:0045640B B950424B00              mov ecx, 004B4250
:00456410 E82AECFFFF              call 0045503F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004563FB(C), :00456401(C)
|
:00456415 8B5D08                  mov ebx, dword ptr [ebp+08]
:00456418 81E3FF000000            and ebx, 000000FF
:0045641E B950424B00              mov ecx, 004B4250
:00456423 E880F9FFFF              call 00455DA8
:00456428 99                      cdq
:00456429 B930000000              mov ecx, 00000030
:0045642E F7F9                    idiv ecx
:00456430 2BD8                    sub ebx, eax
:00456432 885DE8                  mov byte ptr [ebp-18], bl
:00456435 8B5D0C                  mov ebx, dword ptr [ebp+0C]
:00456438 81E3FF000000            and ebx, 000000FF
:0045643E B950424B00              mov ecx, 004B4250
:00456443 E887F9FFFF              call 00455DCF
:00456448 99                      cdq
:00456449 B930000000              mov ecx, 00000030
:0045644E F7F9                    idiv ecx
:00456450 2BD8                    sub ebx, eax
:00456452 885DEC                  mov byte ptr [ebp-14], bl
:00456455 8B5514                  mov edx, dword ptr [ebp+14]
:00456458 81E2FF000000            and edx, 000000FF
:0045645E 83FA04                  cmp edx, 00000004
:00456461 0F8D9A000000            jnl 00456501
:00456467 8B4514                  mov eax, dword ptr [ebp+14]
:0045646A 25FF000000              and eax, 000000FF
:0045646F 85C0                    test eax, eax
:00456471 740E                    je 00456481
:00456473 8B4D14                  mov ecx, dword ptr [ebp+14]
:00456476 81E1FF000000            and ecx, 000000FF
:0045647C 83F902                  cmp ecx, 00000002
:0045647F 7514                    jne 00456495

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00456471(C)
|
:00456481 837D1C00                cmp dword ptr [ebp+1C], 00000000
:00456485 750E                    jne 00456495
:00456487 6A00                    push 00000000
:00456489 6A13                    push 00000013
:0045648B B9B0694B00              mov ecx, 004B69B0
:00456490 E8E5E10100              call 0047467A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045647F(C), :00456485(C)
|
:00456495 6A04                    push 00000004
:00456497 6A00                    push 00000000
:00456499 6A00                    push 00000000
:0045649B B938EB4A00              mov ecx, 004AEB38
:004564A0 E89B950200              call 0047FA40
:004564A5 8B5508                  mov edx, dword ptr [ebp+08]
:004564A8 81E2FF000000            and edx, 000000FF
:004564AE 8D8410401F0000          lea eax, dword ptr [eax+edx+00001F40]
:004564B5 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004564B8 81E1FF000000            and ecx, 000000FF
:004564BE 33D2                    xor edx, edx
:004564C0 8A152C424B00            mov dl, byte ptr [004B422C]
:004564C6 0FAFCA                  imul ecx, edx
:004564C9 8A5514                  mov dl, byte ptr [ebp+14]
:004564CC 881408                  mov byte ptr [eax+ecx], dl
:004564CF 6A01                    push 00000001
:004564D1 6A01                    push 00000001
:004564D3 8A45EC                  mov al, byte ptr [ebp-14]
:004564D6 50                      push eax
:004564D7 8A4DE8                  mov cl, byte ptr [ebp-18]
:004564DA 51                      push ecx
:004564DB B950424B00              mov ecx, 004B4250
:004564E0 E863D6FFFF              call 00453B48
:004564E5 837D1C00                cmp dword ptr [ebp+1C], 00000000
:004564E9 7511                    jne 004564FC
:004564EB 6A01                    push 00000001
:004564ED B9181B4B00              mov ecx, 004B1B18
:004564F2 E849CEFAFF              call 00403340
:004564F7 E8E45FFDFF              call 0042C4E0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004564E9(C)
|
:004564FC E9AF020000              jmp 004567B0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00456461(C)
|
:00456501 8D8DD8FEFFFF            lea ecx, dword ptr [ebp+FFFFFED8]
:00456507 E8A4CDFAFF              call 004032B0
:0045650C C745FC00000000          mov [ebp-04], 00000000

* Possible StringData Ref from Data Obj ->"GATE.E5"
                                  |
:00456513 68B8BB4800              push 0048BBB8
:00456518 8D8DD8FEFFFF            lea ecx, dword ptr [ebp+FFFFFED8]
:0045651E E81296FCFF              call 0041FB35
:00456523 6A04                    push 00000004
:00456525 6A00                    push 00000000
:00456527 6A00                    push 00000000
:00456529 B9C8E44A00              mov ecx, 004AE4C8
:0045652E E80D950200              call 0047FA40
:00456533 50                      push eax
:00456534 8B5514                  mov edx, dword ptr [ebp+14]
:00456537 81E2FF000000            and edx, 000000FF
:0045653D 8D4412F8                lea eax, dword ptr [edx+edx-08]
:00456541 50                      push eax
:00456542 8D8DD8FEFFFF            lea ecx, dword ptr [ebp+FFFFFED8]
:00456548 E83C97FCFF              call 0041FC89
:0045654D 8D8DD8FEFFFF            lea ecx, dword ptr [ebp+FFFFFED8]
:00456553 E86D2DFCFF              call 004192C5
:00456558 6A04                    push 00000004
:0045655A 6A00                    push 00000000
:0045655C 6A00                    push 00000000
:0045655E B9C8E44A00              mov ecx, 004AE4C8
:00456563 E8D8940200              call 0047FA40
:00456568 8985D4FEFFFF            mov dword ptr [ebp+FFFFFED4], eax
:0045656E C685D0FEFFFFFF          mov byte ptr [ebp+FFFFFED0], FF
:00456575 EB0F                    jmp 00456586

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004566AC(U)
|
:00456577 8A8DD0FEFFFF            mov cl, byte ptr [ebp+FFFFFED0]
:0045657D 80C101                  add cl, 01
:00456580 888DD0FEFFFF            mov byte ptr [ebp+FFFFFED0], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00456575(U)
|
:00456586 0FBE95D0FEFFFF          movsx edx, byte ptr [ebp+FFFFFED0]
:0045658D 83FA01                  cmp edx, 00000001
:00456590 0F8F1B010000            jg 004566B1
:00456596 C685C8FEFFFFFF          mov byte ptr [ebp+FFFFFEC8], FF
:0045659D EB0E                    jmp 004565AD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004566A7(U)
|
:0045659F 8A85C8FEFFFF            mov al, byte ptr [ebp+FFFFFEC8]
:004565A5 0401                    add al, 01
:004565A7 8885C8FEFFFF            mov byte ptr [ebp+FFFFFEC8], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045659D(U)
|
:004565AD 0FBE8DC8FEFFFF          movsx ecx, byte ptr [ebp+FFFFFEC8]
:004565B4 83F901                  cmp ecx, 00000001
:004565B7 0F8FEF000000            jg 004566AC
:004565BD 8B55F0                  mov edx, dword ptr [ebp-10]
:004565C0 81E2FF000000            and edx, 000000FF
:004565C6 0FBE85C8FEFFFF          movsx eax, byte ptr [ebp+FFFFFEC8]
:004565CD 03D0                    add edx, eax
:004565CF 85D2                    test edx, edx
:004565D1 0F8CBE000000            jl 00456695
:004565D7 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004565DA 81E1FF000000            and ecx, 000000FF
:004565E0 0FBE95C8FEFFFF          movsx edx, byte ptr [ebp+FFFFFEC8]
:004565E7 03CA                    add ecx, edx
:004565E9 33C0                    xor eax, eax
:004565EB A02C424B00              mov al, byte ptr [004B422C]
:004565F0 3BC8                    cmp ecx, eax
:004565F2 0F8D9D000000            jnl 00456695
:004565F8 8B4DF1                  mov ecx, dword ptr [ebp-0F]
:004565FB 81E1FF000000            and ecx, 000000FF
:00456601 0FBE95D0FEFFFF          movsx edx, byte ptr [ebp+FFFFFED0]
:00456608 03CA                    add ecx, edx
:0045660A 85C9                    test ecx, ecx
:0045660C 0F8C83000000            jl 00456695
:00456612 8B45F1                  mov eax, dword ptr [ebp-0F]
:00456615 25FF000000              and eax, 000000FF
:0045661A 0FBE8DD0FEFFFF          movsx ecx, byte ptr [ebp+FFFFFED0]
:00456621 03C1                    add eax, ecx
:00456623 33D2                    xor edx, edx
:00456625 8A152D424B00            mov dl, byte ptr [004B422D]
:0045662B 3BC2                    cmp eax, edx
:0045662D 7D66                    jge 00456695
:0045662F 6A04                    push 00000004
:00456631 6A00                    push 00000000
:00456633 8B45F1                  mov eax, dword ptr [ebp-0F]
:00456636 25FF000000              and eax, 000000FF
:0045663B 0FBE8DD0FEFFFF          movsx ecx, byte ptr [ebp+FFFFFED0]
:00456642 03C1                    add eax, ecx
:00456644 33D2                    xor edx, edx
:00456646 8A152C424B00            mov dl, byte ptr [004B422C]
:0045664C 0FAFC2                  imul eax, edx
:0045664F 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00456652 81E1FF000000            and ecx, 000000FF
:00456658 0FBE95C8FEFFFF          movsx edx, byte ptr [ebp+FFFFFEC8]
:0045665F 03CA                    add ecx, edx
:00456661 03C1                    add eax, ecx
:00456663 69C000090000            imul eax, 00000900
:00456669 50                      push eax
:0045666A B9A8E44A00              mov ecx, 004AE4A8
:0045666F E8CC930200              call 0047FA40
:00456674 8985CCFEFFFF            mov dword ptr [ebp+FFFFFECC], eax
:0045667A 6800090000              push 00000900
:0045667F 8B85CCFEFFFF            mov eax, dword ptr [ebp+FFFFFECC]
:00456685 50                      push eax
:00456686 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:0045668C 51                      push ecx
:0045668D E86B960200              call 0047FCFD
:00456692 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004565D1(C), :004565F2(C), :0045660C(C), :0045662D(C)
|
:00456695 8B95D4FEFFFF            mov edx, dword ptr [ebp+FFFFFED4]
:0045669B 81C200090000            add edx, 00000900
:004566A1 8995D4FEFFFF            mov dword ptr [ebp+FFFFFED4], edx
:004566A7 E9F3FEFFFF              jmp 0045659F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004565B7(C)
|
:004566AC E9C6FEFFFF              jmp 00456577

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00456590(C)
|
:004566B1 837D1C00                cmp dword ptr [ebp+1C], 00000000
:004566B5 757E                    jne 00456735
:004566B7 8A4510                  mov al, byte ptr [ebp+10]
:004566BA 8885BCFEFFFF            mov byte ptr [ebp+FFFFFEBC], al
:004566C0 80BDBCFEFFFF0C          cmp byte ptr [ebp+FFFFFEBC], 0C
:004566C7 745E                    je 00456727
:004566C9 80BDBCFEFFFF0F          cmp byte ptr [ebp+FFFFFEBC], 0F
:004566D0 7445                    je 00456717
:004566D2 80BDBCFEFFFF11          cmp byte ptr [ebp+FFFFFEBC], 11
:004566D9 7402                    je 004566DD
:004566DB EB58                    jmp 00456735

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004566D9(C)
|
:004566DD 837DE400                cmp dword ptr [ebp-1C], 00000000
:004566E1 7532                    jne 00456715
:004566E3 6A00                    push 00000000
:004566E5 6A12                    push 00000012
:004566E7 B9B0694B00              mov ecx, 004B69B0
:004566EC E889DF0100              call 0047467A
:004566F1 B970074B00              mov ecx, 004B0770
:004566F6 E81542FDFF              call 0042A910
:004566FB 2500100000              and eax, 00001000
:00456700 85C0                    test eax, eax
:00456702 7411                    je 00456715
:00456704 6A1E                    push 0000001E
:00456706 B9181B4B00              mov ecx, 004B1B18
:0045670B E830CCFAFF              call 00403340
:00456710 E8CB5DFDFF              call 0042C4E0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004566E1(C), :00456702(C)
|
:00456715 EB1E                    jmp 00456735

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004566D0(C)
|
:00456717 6A00                    push 00000000
:00456719 6A0F                    push 0000000F
:0045671B B9B0694B00              mov ecx, 004B69B0
:00456720 E855DF0100              call 0047467A
:00456725 EB0E                    jmp 00456735

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004566C7(C)
|
:00456727 6A00                    push 00000000
:00456729 6A10                    push 00000010
:0045672B B9B0694B00              mov ecx, 004B69B0
:00456730 E845DF0100              call 0047467A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004566B5(C), :004566DB(U), :00456715(U), :00456725(U)
|
:00456735 6A03                    push 00000003
:00456737 6A03                    push 00000003
:00456739 6A01                    push 00000001
:0045673B 8A4DEC                  mov cl, byte ptr [ebp-14]
:0045673E 51                      push ecx
:0045673F E88C930200              call 0047FAD0
:00456744 83C408                  add esp, 00000008
:00456747 50                      push eax
:00456748 6A01                    push 00000001
:0045674A 8A55E8                  mov dl, byte ptr [ebp-18]
:0045674D 52                      push edx
:0045674E E87D930200              call 0047FAD0
:00456753 83C408                  add esp, 00000008
:00456756 50                      push eax
:00456757 B950424B00              mov ecx, 004B4250
:0045675C E8E7D3FFFF              call 00453B48
:00456761 837D1C00                cmp dword ptr [ebp+1C], 00000000
:00456765 7537                    jne 0045679E
:00456767 8B4510                  mov eax, dword ptr [ebp+10]
:0045676A 25FF000000              and eax, 000000FF
:0045676F 83F811                  cmp eax, 00000011
:00456772 752A                    jne 0045679E
:00456774 837DE400                cmp dword ptr [ebp-1C], 00000000
:00456778 7424                    je 0045679E
:0045677A B970074B00              mov ecx, 004B0770
:0045677F E88C41FDFF              call 0042A910
:00456784 2500100000              and eax, 00001000
:00456789 85C0                    test eax, eax
:0045678B 7411                    je 0045679E
:0045678D 6A32                    push 00000032
:0045678F B9181B4B00              mov ecx, 004B1B18
:00456794 E8A7CBFAFF              call 00403340
:00456799 E8425DFDFF              call 0042C4E0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00456765(C), :00456772(C), :00456778(C), :0045678B(C)
|
:0045679E C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:004567A5 8D8DD8FEFFFF            lea ecx, dword ptr [ebp+FFFFFED8]
:004567AB E820CBFAFF              call 004032D0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004561D6(U), :004564FC(U)
|
:004567B0 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004567B3 64890D00000000          mov dword ptr fs:[00000000], ecx
:004567BA 5B                      pop ebx
:004567BB 8BE5                    mov esp, ebp
:004567BD 5D                      pop ebp
:004567BE C21800                  ret 0018



* Referenced by a CALL at Addresses:
|:0041404D   , :0041687D   
|
:004567C1 55                      push ebp
:004567C2 8BEC                    mov ebp, esp
:004567C4 6AFF                    push FFFFFFFF
:004567C6 6882564800              push 00485682
:004567CB 64A100000000            mov eax, dword ptr fs:[00000000]
:004567D1 50                      push eax
:004567D2 64892500000000          mov dword ptr fs:[00000000], esp
:004567D9 81EC34010000            sub esp, 00000134
:004567DF 53                      push ebx
:004567E0 56                      push esi
:004567E1 898DC0FEFFFF            mov dword ptr [ebp+FFFFFEC0], ecx
:004567E7 8A450C                  mov al, byte ptr [ebp+0C]
:004567EA 50                      push eax
:004567EB 8A4D08                  mov cl, byte ptr [ebp+08]
:004567EE 51                      push ecx
:004567EF 8D4DF0                  lea ecx, dword ptr [ebp-10]
:004567F2 E8D924FCFF              call 00418CD0
:004567F7 C745E801000000          mov [ebp-18], 00000001
:004567FE C645EC00                mov [ebp-14], 00
:00456802 EB09                    jmp 0045680D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00456DCF(U)
|
:00456804 8A55EC                  mov dl, byte ptr [ebp-14]
:00456807 80C201                  add dl, 01
:0045680A 8855EC                  mov byte ptr [ebp-14], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00456802(U)
|
:0045680D 8B45EC                  mov eax, dword ptr [ebp-14]
:00456810 25FF000000              and eax, 000000FF
:00456815 3DFA000000              cmp eax, 000000FA
:0045681A 0F8DB4050000            jnl 00456DD4
:00456820 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00456823 81E1FF000000            and ecx, 000000FF
:00456829 6BC905                  imul ecx, 00000005
:0045682C 33D2                    xor edx, edx
:0045682E 8A91213D4B00            mov dl, byte ptr [ecx+004B3D21]
:00456834 8B4508                  mov eax, dword ptr [ebp+08]
:00456837 25FF000000              and eax, 000000FF
:0045683C 3BD0                    cmp edx, eax
:0045683E 0F858B050000            jne 00456DCF
:00456844 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00456847 81E1FF000000            and ecx, 000000FF
:0045684D 6BC905                  imul ecx, 00000005
:00456850 33D2                    xor edx, edx
:00456852 8A91223D4B00            mov dl, byte ptr [ecx+004B3D22]
:00456858 8B450C                  mov eax, dword ptr [ebp+0C]
:0045685B 25FF000000              and eax, 000000FF
:00456860 3BD0                    cmp edx, eax
:00456862 0F8567050000            jne 00456DCF
:00456868 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0045686B 81E1FF000000            and ecx, 000000FF
:00456871 6BC905                  imul ecx, 00000005
:00456874 33D2                    xor edx, edx
:00456876 8A91253D4B00            mov dl, byte ptr [ecx+004B3D25]
:0045687C 8B4510                  mov eax, dword ptr [ebp+10]
:0045687F 25FF000000              and eax, 000000FF
:00456884 3BD0                    cmp edx, eax
:00456886 0F8543050000            jne 00456DCF
:0045688C 837D1400                cmp dword ptr [ebp+14], 00000000
:00456890 7412                    je 004568A4
:00456892 8A4DF1                  mov cl, byte ptr [ebp-0F]
:00456895 51                      push ecx
:00456896 8A55F0                  mov dl, byte ptr [ebp-10]
:00456899 52                      push edx
:0045689A B950424B00              mov ecx, 004B4250
:0045689F E89BE7FFFF              call 0045503F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00456890(C)
|
:004568A4 8B5D08                  mov ebx, dword ptr [ebp+08]
:004568A7 81E3FF000000            and ebx, 000000FF
:004568AD B950424B00              mov ecx, 004B4250
:004568B2 E8F1F4FFFF              call 00455DA8
:004568B7 99                      cdq
:004568B8 B930000000              mov ecx, 00000030
:004568BD F7F9                    idiv ecx
:004568BF 2BD8                    sub ebx, eax
:004568C1 885DE0                  mov byte ptr [ebp-20], bl
:004568C4 8B5D0C                  mov ebx, dword ptr [ebp+0C]
:004568C7 81E3FF000000            and ebx, 000000FF
:004568CD B950424B00              mov ecx, 004B4250
:004568D2 E8F8F4FFFF              call 00455DCF
:004568D7 99                      cdq
:004568D8 B930000000              mov ecx, 00000030
:004568DD F7F9                    idiv ecx
:004568DF 2BD8                    sub ebx, eax
:004568E1 885DE4                  mov byte ptr [ebp-1C], bl
:004568E4 8B5510                  mov edx, dword ptr [ebp+10]
:004568E7 81E2FF000000            and edx, 000000FF
:004568ED 83FA04                  cmp edx, 00000004
:004568F0 7D52                    jge 00456944
:004568F2 6A04                    push 00000004
:004568F4 6A00                    push 00000000
:004568F6 6A00                    push 00000000
:004568F8 B938EB4A00              mov ecx, 004AEB38
:004568FD E83E910200              call 0047FA40
:00456902 8B4D08                  mov ecx, dword ptr [ebp+08]
:00456905 81E1FF000000            and ecx, 000000FF
:0045690B 8D9408401F0000          lea edx, dword ptr [eax+ecx+00001F40]
:00456912 8B450C                  mov eax, dword ptr [ebp+0C]
:00456915 25FF000000              and eax, 000000FF
:0045691A 33C9                    xor ecx, ecx
:0045691C 8A0D2C424B00            mov cl, byte ptr [004B422C]
:00456922 0FAFC1                  imul eax, ecx
:00456925 C60402FF                mov byte ptr [edx+eax], FF
:00456929 6A01                    push 00000001
:0045692B 6A01                    push 00000001
:0045692D 8A55E4                  mov dl, byte ptr [ebp-1C]
:00456930 52                      push edx
:00456931 8A45E0                  mov al, byte ptr [ebp-20]
:00456934 50                      push eax
:00456935 B950424B00              mov ecx, 004B4250
:0045693A E809D2FFFF              call 00453B48
:0045693F E9E4030000              jmp 00456D28

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004568F0(C)
|
:00456944 8D8DDCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEDC]
:0045694A E861C9FAFF              call 004032B0
:0045694F C745FC00000000          mov [ebp-04], 00000000

* Possible StringData Ref from Data Obj ->"GATE.E5"
                                  |
:00456956 68B8BB4800              push 0048BBB8
:0045695B 8D8DDCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEDC]
:00456961 E8CF91FCFF              call 0041FB35
:00456966 6A04                    push 00000004
:00456968 6A00                    push 00000000
:0045696A 6A00                    push 00000000
:0045696C B9C8E44A00              mov ecx, 004AE4C8
:00456971 E8CA900200              call 0047FA40
:00456976 50                      push eax
:00456977 8B4D10                  mov ecx, dword ptr [ebp+10]
:0045697A 81E1FF000000            and ecx, 000000FF
:00456980 8D5409F9                lea edx, dword ptr [ecx+ecx-07]
:00456984 52                      push edx
:00456985 8D8DDCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEDC]
:0045698B E8F992FCFF              call 0041FC89
:00456990 8D8DDCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEDC]
:00456996 E82A29FCFF              call 004192C5
:0045699B 6A04                    push 00000004
:0045699D 6A00                    push 00000000
:0045699F 6A00                    push 00000000
:004569A1 B9C8E44A00              mov ecx, 004AE4C8
:004569A6 E895900200              call 0047FA40
:004569AB 8985D8FEFFFF            mov dword ptr [ebp+FFFFFED8], eax
:004569B1 C685D4FEFFFFFF          mov byte ptr [ebp+FFFFFED4], FF
:004569B8 EB0E                    jmp 004569C8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00456AEF(U)
|
:004569BA 8A85D4FEFFFF            mov al, byte ptr [ebp+FFFFFED4]
:004569C0 0401                    add al, 01
:004569C2 8885D4FEFFFF            mov byte ptr [ebp+FFFFFED4], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004569B8(U)
|
:004569C8 0FBE8DD4FEFFFF          movsx ecx, byte ptr [ebp+FFFFFED4]
:004569CF 83F901                  cmp ecx, 00000001
:004569D2 0F8F1C010000            jg 00456AF4
:004569D8 C685CCFEFFFFFF          mov byte ptr [ebp+FFFFFECC], FF
:004569DF EB0F                    jmp 004569F0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00456AEA(U)
|
:004569E1 8A95CCFEFFFF            mov dl, byte ptr [ebp+FFFFFECC]
:004569E7 80C201                  add dl, 01
:004569EA 8895CCFEFFFF            mov byte ptr [ebp+FFFFFECC], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004569DF(U)
|
:004569F0 0FBE85CCFEFFFF          movsx eax, byte ptr [ebp+FFFFFECC]
:004569F7 83F801                  cmp eax, 00000001
:004569FA 0F8FEF000000            jg 00456AEF
:00456A00 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00456A03 81E1FF000000            and ecx, 000000FF
:00456A09 0FBE95CCFEFFFF          movsx edx, byte ptr [ebp+FFFFFECC]
:00456A10 03CA                    add ecx, edx
:00456A12 85C9                    test ecx, ecx
:00456A14 0F8CBE000000            jl 00456AD8
:00456A1A 8B45F0                  mov eax, dword ptr [ebp-10]
:00456A1D 25FF000000              and eax, 000000FF
:00456A22 0FBE8DCCFEFFFF          movsx ecx, byte ptr [ebp+FFFFFECC]
:00456A29 03C1                    add eax, ecx
:00456A2B 33D2                    xor edx, edx
:00456A2D 8A152C424B00            mov dl, byte ptr [004B422C]
:00456A33 3BC2                    cmp eax, edx
:00456A35 0F8D9D000000            jnl 00456AD8
:00456A3B 8B45F1                  mov eax, dword ptr [ebp-0F]
:00456A3E 25FF000000              and eax, 000000FF
:00456A43 0FBE8DD4FEFFFF          movsx ecx, byte ptr [ebp+FFFFFED4]
:00456A4A 03C1                    add eax, ecx
:00456A4C 85C0                    test eax, eax
:00456A4E 0F8C84000000            jl 00456AD8
:00456A54 8B55F1                  mov edx, dword ptr [ebp-0F]
:00456A57 81E2FF000000            and edx, 000000FF
:00456A5D 0FBE85D4FEFFFF          movsx eax, byte ptr [ebp+FFFFFED4]
:00456A64 03D0                    add edx, eax
:00456A66 33C9                    xor ecx, ecx
:00456A68 8A0D2D424B00            mov cl, byte ptr [004B422D]
:00456A6E 3BD1                    cmp edx, ecx
:00456A70 7D66                    jge 00456AD8
:00456A72 6A04                    push 00000004
:00456A74 6A00                    push 00000000
:00456A76 8B55F1                  mov edx, dword ptr [ebp-0F]
:00456A79 81E2FF000000            and edx, 000000FF
:00456A7F 0FBE85D4FEFFFF          movsx eax, byte ptr [ebp+FFFFFED4]
:00456A86 03D0                    add edx, eax
:00456A88 33C9                    xor ecx, ecx
:00456A8A 8A0D2C424B00            mov cl, byte ptr [004B422C]
:00456A90 0FAFD1                  imul edx, ecx
:00456A93 8B45F0                  mov eax, dword ptr [ebp-10]
:00456A96 25FF000000              and eax, 000000FF
:00456A9B 0FBE8DCCFEFFFF          movsx ecx, byte ptr [ebp+FFFFFECC]
:00456AA2 03C1                    add eax, ecx
:00456AA4 03D0                    add edx, eax
:00456AA6 69D200090000            imul edx, 00000900
:00456AAC 52                      push edx
:00456AAD B9A8E44A00              mov ecx, 004AE4A8
:00456AB2 E8898F0200              call 0047FA40
:00456AB7 8985D0FEFFFF            mov dword ptr [ebp+FFFFFED0], eax
:00456ABD 6800090000              push 00000900
:00456AC2 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:00456AC8 52                      push edx
:00456AC9 8B85D8FEFFFF            mov eax, dword ptr [ebp+FFFFFED8]
:00456ACF 50                      push eax
:00456AD0 E828920200              call 0047FCFD
:00456AD5 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00456A14(C), :00456A35(C), :00456A4E(C), :00456A70(C)
|
:00456AD8 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:00456ADE 81C100090000            add ecx, 00000900
:00456AE4 898DD8FEFFFF            mov dword ptr [ebp+FFFFFED8], ecx
:00456AEA E9F2FEFFFF              jmp 004569E1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004569FA(C)
|
:00456AEF E9C6FEFFFF              jmp 004569BA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004569D2(C)
|
:00456AF4 8B55EC                  mov edx, dword ptr [ebp-14]
:00456AF7 81E2FF000000            and edx, 000000FF
:00456AFD 6BD205                  imul edx, 00000005
:00456B00 33C0                    xor eax, eax
:00456B02 8A82233D4B00            mov al, byte ptr [edx+004B3D23]
:00456B08 83F811                  cmp eax, 00000011
:00456B0B 0F8596010000            jne 00456CA7
:00456B11 C685C8FEFFFFFF          mov byte ptr [ebp+FFFFFEC8], FF
:00456B18 EB0F                    jmp 00456B29

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00456BBB(U)
|
:00456B1A 8A8DC8FEFFFF            mov cl, byte ptr [ebp+FFFFFEC8]
:00456B20 80C102                  add cl, 02
:00456B23 888DC8FEFFFF            mov byte ptr [ebp+FFFFFEC8], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00456B18(U)
|
:00456B29 0FBE95C8FEFFFF          movsx edx, byte ptr [ebp+FFFFFEC8]
:00456B30 83FA01                  cmp edx, 00000001
:00456B33 0F8F87000000            jg 00456BC0
:00456B39 8B45F0                  mov eax, dword ptr [ebp-10]
:00456B3C 25FF000000              and eax, 000000FF
:00456B41 0FBE8DC8FEFFFF          movsx ecx, byte ptr [ebp+FFFFFEC8]
:00456B48 03C1                    add eax, ecx
:00456B4A 85C0                    test eax, eax
:00456B4C 7C6D                    jl 00456BBB
:00456B4E 8B55F0                  mov edx, dword ptr [ebp-10]
:00456B51 81E2FF000000            and edx, 000000FF
:00456B57 0FBE85C8FEFFFF          movsx eax, byte ptr [ebp+FFFFFEC8]
:00456B5E 03D0                    add edx, eax
:00456B60 33C9                    xor ecx, ecx
:00456B62 8A0D2C424B00            mov cl, byte ptr [004B422C]
:00456B68 3BD1                    cmp edx, ecx
:00456B6A 7D4F                    jge 00456BBB
:00456B6C 6A04                    push 00000004
:00456B6E 6A00                    push 00000000
:00456B70 6A00                    push 00000000
:00456B72 B938EB4A00              mov ecx, 004AEB38
:00456B77 E8C48E0200              call 0047FA40
:00456B7C 8B55F0                  mov edx, dword ptr [ebp-10]
:00456B7F 81E2FF000000            and edx, 000000FF
:00456B85 0FBE8DC8FEFFFF          movsx ecx, byte ptr [ebp+FFFFFEC8]
:00456B8C 03D1                    add edx, ecx
:00456B8E 8D941040060000          lea edx, dword ptr [eax+edx+00000640]
:00456B95 8B45F1                  mov eax, dword ptr [ebp-0F]
:00456B98 25FF000000              and eax, 000000FF
:00456B9D 33C9                    xor ecx, ecx
:00456B9F 8A0D2C424B00            mov cl, byte ptr [004B422C]
:00456BA5 0FAFC1                  imul eax, ecx
:00456BA8 33C9                    xor ecx, ecx
:00456BAA 8A0C02                  mov cl, byte ptr [edx+eax]
:00456BAD 83F911                  cmp ecx, 00000011
:00456BB0 7509                    jne 00456BBB
:00456BB2 C745E800000000          mov [ebp-18], 00000000
:00456BB9 EB05                    jmp 00456BC0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00456B4C(C), :00456B6A(C), :00456BB0(C)
|
:00456BBB E95AFFFFFF              jmp 00456B1A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00456B33(C), :00456BB9(U)
|
:00456BC0 C685C4FEFFFFFF          mov byte ptr [ebp+FFFFFEC4], FF
:00456BC7 EB0F                    jmp 00456BD8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00456C6A(U)
|
:00456BC9 8A95C4FEFFFF            mov dl, byte ptr [ebp+FFFFFEC4]
:00456BCF 80C202                  add dl, 02
:00456BD2 8895C4FEFFFF            mov byte ptr [ebp+FFFFFEC4], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00456BC7(U)
|
:00456BD8 0FBE85C4FEFFFF          movsx eax, byte ptr [ebp+FFFFFEC4]
:00456BDF 83F801                  cmp eax, 00000001
:00456BE2 0F8F87000000            jg 00456C6F
:00456BE8 8B4DF1                  mov ecx, dword ptr [ebp-0F]
:00456BEB 81E1FF000000            and ecx, 000000FF
:00456BF1 0FBE95C4FEFFFF          movsx edx, byte ptr [ebp+FFFFFEC4]
:00456BF8 03CA                    add ecx, edx
:00456BFA 85C9                    test ecx, ecx
:00456BFC 7C6C                    jl 00456C6A
:00456BFE 8B45F1                  mov eax, dword ptr [ebp-0F]
:00456C01 25FF000000              and eax, 000000FF
:00456C06 0FBE8DC4FEFFFF          movsx ecx, byte ptr [ebp+FFFFFEC4]
:00456C0D 03C1                    add eax, ecx
:00456C0F 33D2                    xor edx, edx
:00456C11 8A152D424B00            mov dl, byte ptr [004B422D]
:00456C17 3BC2                    cmp eax, edx
:00456C19 7D4F                    jge 00456C6A
:00456C1B 6A04                    push 00000004
:00456C1D 6A00                    push 00000000
:00456C1F 6A00                    push 00000000
:00456C21 B938EB4A00              mov ecx, 004AEB38
:00456C26 E8158E0200              call 0047FA40
:00456C2B 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00456C2E 81E1FF000000            and ecx, 000000FF
:00456C34 8D940840060000          lea edx, dword ptr [eax+ecx+00000640]
:00456C3B 8B45F1                  mov eax, dword ptr [ebp-0F]
:00456C3E 25FF000000              and eax, 000000FF
:00456C43 0FBE8DC4FEFFFF          movsx ecx, byte ptr [ebp+FFFFFEC4]
:00456C4A 03C1                    add eax, ecx
:00456C4C 33C9                    xor ecx, ecx
:00456C4E 8A0D2C424B00            mov cl, byte ptr [004B422C]
:00456C54 0FAFC1                  imul eax, ecx
:00456C57 33C9                    xor ecx, ecx
:00456C59 8A0C02                  mov cl, byte ptr [edx+eax]
:00456C5C 83F911                  cmp ecx, 00000011
:00456C5F 7509                    jne 00456C6A
:00456C61 C745E800000000          mov [ebp-18], 00000000
:00456C68 EB05                    jmp 00456C6F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00456BFC(C), :00456C19(C), :00456C5F(C)
|
:00456C6A E95AFFFFFF              jmp 00456BC9

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00456BE2(C), :00456C68(U)
|
:00456C6F 837DE800                cmp dword ptr [ebp-18], 00000000
:00456C73 7532                    jne 00456CA7
:00456C75 6A00                    push 00000000
:00456C77 6A12                    push 00000012
:00456C79 B9B0694B00              mov ecx, 004B69B0
:00456C7E E8F7D90100              call 0047467A
:00456C83 B970074B00              mov ecx, 004B0770
:00456C88 E8833CFDFF              call 0042A910
:00456C8D 2500100000              and eax, 00001000
:00456C92 85C0                    test eax, eax
:00456C94 7411                    je 00456CA7
:00456C96 6A1E                    push 0000001E
:00456C98 B9181B4B00              mov ecx, 004B1B18
:00456C9D E89EC6FAFF              call 00403340
:00456CA2 E83958FDFF              call 0042C4E0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00456B0B(C), :00456C73(C), :00456C94(C)
|
:00456CA7 6A03                    push 00000003
:00456CA9 6A03                    push 00000003
:00456CAB 6A01                    push 00000001
:00456CAD 8A55E4                  mov dl, byte ptr [ebp-1C]
:00456CB0 52                      push edx
:00456CB1 E81A8E0200              call 0047FAD0
:00456CB6 83C408                  add esp, 00000008
:00456CB9 50                      push eax
:00456CBA 6A01                    push 00000001
:00456CBC 8A45E0                  mov al, byte ptr [ebp-20]
:00456CBF 50                      push eax
:00456CC0 E80B8E0200              call 0047FAD0
:00456CC5 83C408                  add esp, 00000008
:00456CC8 50                      push eax
:00456CC9 B950424B00              mov ecx, 004B4250
:00456CCE E875CEFFFF              call 00453B48
:00456CD3 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00456CD6 81E1FF000000            and ecx, 000000FF
:00456CDC 6BC905                  imul ecx, 00000005
:00456CDF 33D2                    xor edx, edx
:00456CE1 8A91233D4B00            mov dl, byte ptr [ecx+004B3D23]
:00456CE7 83FA11                  cmp edx, 00000011
:00456CEA 752A                    jne 00456D16
:00456CEC 837DE800                cmp dword ptr [ebp-18], 00000000
:00456CF0 7424                    je 00456D16
:00456CF2 B970074B00              mov ecx, 004B0770
:00456CF7 E8143CFDFF              call 0042A910
:00456CFC 2500100000              and eax, 00001000
:00456D01 85C0                    test eax, eax
:00456D03 7411                    je 00456D16
:00456D05 6A32                    push 00000032
:00456D07 B9181B4B00              mov ecx, 004B1B18
:00456D0C E82FC6FAFF              call 00403340
:00456D11 E8CA57FDFF              call 0042C4E0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00456CEA(C), :00456CF0(C), :00456D03(C)
|
:00456D16 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00456D1D 8D8DDCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEDC]
:00456D23 E8A8C5FAFF              call 004032D0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045693F(U)
|
:00456D28 8B75EC                  mov esi, dword ptr [ebp-14]
:00456D2B 81E6FF000000            and esi, 000000FF
:00456D31 6BF605                  imul esi, 00000005
:00456D34 6A04                    push 00000004
:00456D36 6A00                    push 00000000
:00456D38 6A00                    push 00000000
:00456D3A B938EB4A00              mov ecx, 004AEB38
:00456D3F E8FC8C0200              call 0047FA40
:00456D44 8B4D08                  mov ecx, dword ptr [ebp+08]
:00456D47 81E1FF000000            and ecx, 000000FF
:00456D4D 8D940840060000          lea edx, dword ptr [eax+ecx+00000640]
:00456D54 8B450C                  mov eax, dword ptr [ebp+0C]
:00456D57 25FF000000              and eax, 000000FF
:00456D5C 33C9                    xor ecx, ecx
:00456D5E 8A0D2C424B00            mov cl, byte ptr [004B422C]
:00456D64 0FAFC1                  imul eax, ecx
:00456D67 8A8E243D4B00            mov cl, byte ptr [esi+004B3D24]
:00456D6D 880C02                  mov byte ptr [edx+eax], cl
:00456D70 8B55EC                  mov edx, dword ptr [ebp-14]
:00456D73 81E2FF000000            and edx, 000000FF
:00456D79 6BD205                  imul edx, 00000005
:00456D7C C682213D4B00FF          mov byte ptr [edx+004B3D21], FF
:00456D83 8B45EC                  mov eax, dword ptr [ebp-14]
:00456D86 25FF000000              and eax, 000000FF
:00456D8B 6BC005                  imul eax, 00000005
:00456D8E C680223D4B00FF          mov byte ptr [eax+004B3D22], FF
:00456D95 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00456D98 81E1FF000000            and ecx, 000000FF
:00456D9E 6BC905                  imul ecx, 00000005
:00456DA1 C681233D4B00FF          mov byte ptr [ecx+004B3D23], FF
:00456DA8 8B55EC                  mov edx, dword ptr [ebp-14]
:00456DAB 81E2FF000000            and edx, 000000FF
:00456DB1 6BD205                  imul edx, 00000005
:00456DB4 C682243D4B00FF          mov byte ptr [edx+004B3D24], FF
:00456DBB 8B45EC                  mov eax, dword ptr [ebp-14]
:00456DBE 25FF000000              and eax, 000000FF
:00456DC3 6BC005                  imul eax, 00000005
:00456DC6 C680253D4B00FF          mov byte ptr [eax+004B3D25], FF
:00456DCD EB05                    jmp 00456DD4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045683E(C), :00456862(C), :00456886(C)
|
:00456DCF E930FAFFFF              jmp 00456804

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045681A(C), :00456DCD(U)
|
:00456DD4 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00456DD7 64890D00000000          mov dword ptr fs:[00000000], ecx
:00456DDE 5E                      pop esi
:00456DDF 5B                      pop ebx
:00456DE0 8BE5                    mov esp, ebp
:00456DE2 5D                      pop ebp
:00456DE3 C21000                  ret 0010



* Referenced by a CALL at Address:
|:0044C1C2   
|
:00456DE6 55                      push ebp
:00456DE7 8BEC                    mov ebp, esp
:00456DE9 6AFF                    push FFFFFFFF
:00456DEB 6898564800              push 00485698
:00456DF0 64A100000000            mov eax, dword ptr fs:[00000000]
:00456DF6 50                      push eax
:00456DF7 64892500000000          mov dword ptr fs:[00000000], esp
:00456DFE 81EC24010000            sub esp, 00000124
:00456E04 56                      push esi
:00456E05 898DD0FEFFFF            mov dword ptr [ebp+FFFFFED0], ecx
:00456E0B C645F000                mov [ebp-10], 00
:00456E0F EB08                    jmp 00456E19

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004570DA(U)
|
:00456E11 8A45F0                  mov al, byte ptr [ebp-10]
:00456E14 0401                    add al, 01
:00456E16 8845F0                  mov byte ptr [ebp-10], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00456E0F(U)
|
:00456E19 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00456E1C 81E1FF000000            and ecx, 000000FF
:00456E22 81F9FA000000            cmp ecx, 000000FA
:00456E28 0F8DB1020000            jnl 004570DF
:00456E2E 8B55F0                  mov edx, dword ptr [ebp-10]
:00456E31 81E2FF000000            and edx, 000000FF
:00456E37 6BD205                  imul edx, 00000005
:00456E3A 8A82223D4B00            mov al, byte ptr [edx+004B3D22]
:00456E40 50                      push eax
:00456E41 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00456E44 81E1FF000000            and ecx, 000000FF
:00456E4A 6BC905                  imul ecx, 00000005
:00456E4D 8A91213D4B00            mov dl, byte ptr [ecx+004B3D21]
:00456E53 52                      push edx
:00456E54 8D4DE8                  lea ecx, dword ptr [ebp-18]
:00456E57 E8741EFCFF              call 00418CD0
:00456E5C 8B45F0                  mov eax, dword ptr [ebp-10]
:00456E5F 25FF000000              and eax, 000000FF
:00456E64 6BC005                  imul eax, 00000005
:00456E67 8A88253D4B00            mov cl, byte ptr [eax+004B3D25]
:00456E6D 884DEC                  mov byte ptr [ebp-14], cl
:00456E70 8B55EC                  mov edx, dword ptr [ebp-14]
:00456E73 81E2FF000000            and edx, 000000FF
:00456E79 81FAFF000000            cmp edx, 000000FF
:00456E7F 0F8455020000            je 004570DA
:00456E85 8B45EC                  mov eax, dword ptr [ebp-14]
:00456E88 25FF000000              and eax, 000000FF
:00456E8D 83F804                  cmp eax, 00000004
:00456E90 7D3E                    jge 00456ED0
:00456E92 6A04                    push 00000004
:00456E94 6A00                    push 00000000
:00456E96 6A00                    push 00000000
:00456E98 B938EB4A00              mov ecx, 004AEB38
:00456E9D E89E8B0200              call 0047FA40
:00456EA2 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00456EA5 81E1FF000000            and ecx, 000000FF
:00456EAB 8D9408401F0000          lea edx, dword ptr [eax+ecx+00001F40]
:00456EB2 8B45E9                  mov eax, dword ptr [ebp-17]
:00456EB5 25FF000000              and eax, 000000FF
:00456EBA 33C9                    xor ecx, ecx
:00456EBC 8A0D2C424B00            mov cl, byte ptr [004B422C]
:00456EC2 0FAFC1                  imul eax, ecx
:00456EC5 8A4DEC                  mov cl, byte ptr [ebp-14]
:00456EC8 880C02                  mov byte ptr [edx+eax], cl
:00456ECB E9C2010000              jmp 00457092

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00456E90(C)
|
:00456ED0 8D8DE4FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE4]
:00456ED6 E8D5C3FAFF              call 004032B0
:00456EDB C745FC00000000          mov [ebp-04], 00000000

* Possible StringData Ref from Data Obj ->"GATE.E5"
                                  |
:00456EE2 68B8BB4800              push 0048BBB8
:00456EE7 8D8DE4FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE4]
:00456EED E8438CFCFF              call 0041FB35
:00456EF2 6A04                    push 00000004
:00456EF4 6A00                    push 00000000
:00456EF6 6A00                    push 00000000
:00456EF8 B9C8E44A00              mov ecx, 004AE4C8
:00456EFD E83E8B0200              call 0047FA40
:00456F02 50                      push eax
:00456F03 8B55EC                  mov edx, dword ptr [ebp-14]
:00456F06 81E2FF000000            and edx, 000000FF
:00456F0C 8D4412F8                lea eax, dword ptr [edx+edx-08]
:00456F10 50                      push eax
:00456F11 8D8DE4FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE4]
:00456F17 E86D8DFCFF              call 0041FC89
:00456F1C 8D8DE4FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE4]
:00456F22 E89E23FCFF              call 004192C5
:00456F27 6A04                    push 00000004
:00456F29 6A00                    push 00000000
:00456F2B 6A00                    push 00000000
:00456F2D B9C8E44A00              mov ecx, 004AE4C8
:00456F32 E8098B0200              call 0047FA40
:00456F37 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:00456F3D C685DCFEFFFFFF          mov byte ptr [ebp+FFFFFEDC], FF
:00456F44 EB0F                    jmp 00456F55

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045707B(U)
|
:00456F46 8A8DDCFEFFFF            mov cl, byte ptr [ebp+FFFFFEDC]
:00456F4C 80C101                  add cl, 01
:00456F4F 888DDCFEFFFF            mov byte ptr [ebp+FFFFFEDC], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00456F44(U)
|
:00456F55 0FBE95DCFEFFFF          movsx edx, byte ptr [ebp+FFFFFEDC]
:00456F5C 83FA01                  cmp edx, 00000001
:00456F5F 0F8F1B010000            jg 00457080
:00456F65 C685D4FEFFFFFF          mov byte ptr [ebp+FFFFFED4], FF
:00456F6C EB0E                    jmp 00456F7C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00457076(U)
|
:00456F6E 8A85D4FEFFFF            mov al, byte ptr [ebp+FFFFFED4]
:00456F74 0401                    add al, 01
:00456F76 8885D4FEFFFF            mov byte ptr [ebp+FFFFFED4], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00456F6C(U)
|
:00456F7C 0FBE8DD4FEFFFF          movsx ecx, byte ptr [ebp+FFFFFED4]
:00456F83 83F901                  cmp ecx, 00000001
:00456F86 0F8FEF000000            jg 0045707B
:00456F8C 8B55E8                  mov edx, dword ptr [ebp-18]
:00456F8F 81E2FF000000            and edx, 000000FF
:00456F95 0FBE85D4FEFFFF          movsx eax, byte ptr [ebp+FFFFFED4]
:00456F9C 03D0                    add edx, eax
:00456F9E 85D2                    test edx, edx
:00456FA0 0F8CBE000000            jl 00457064
:00456FA6 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00456FA9 81E1FF000000            and ecx, 000000FF
:00456FAF 0FBE95D4FEFFFF          movsx edx, byte ptr [ebp+FFFFFED4]
:00456FB6 03CA                    add ecx, edx
:00456FB8 33C0                    xor eax, eax
:00456FBA A02C424B00              mov al, byte ptr [004B422C]
:00456FBF 3BC8                    cmp ecx, eax
:00456FC1 0F8D9D000000            jnl 00457064
:00456FC7 8B4DE9                  mov ecx, dword ptr [ebp-17]
:00456FCA 81E1FF000000            and ecx, 000000FF
:00456FD0 0FBE95DCFEFFFF          movsx edx, byte ptr [ebp+FFFFFEDC]
:00456FD7 03CA                    add ecx, edx
:00456FD9 85C9                    test ecx, ecx
:00456FDB 0F8C83000000            jl 00457064
:00456FE1 8B45E9                  mov eax, dword ptr [ebp-17]
:00456FE4 25FF000000              and eax, 000000FF
:00456FE9 0FBE8DDCFEFFFF          movsx ecx, byte ptr [ebp+FFFFFEDC]
:00456FF0 03C1                    add eax, ecx
:00456FF2 33D2                    xor edx, edx
:00456FF4 8A152D424B00            mov dl, byte ptr [004B422D]
:00456FFA 3BC2                    cmp eax, edx
:00456FFC 7D66                    jge 00457064
:00456FFE 6A04                    push 00000004
:00457000 6A00                    push 00000000
:00457002 8B45E9                  mov eax, dword ptr [ebp-17]
:00457005 25FF000000              and eax, 000000FF
:0045700A 0FBE8DDCFEFFFF          movsx ecx, byte ptr [ebp+FFFFFEDC]
:00457011 03C1                    add eax, ecx
:00457013 33D2                    xor edx, edx
:00457015 8A152C424B00            mov dl, byte ptr [004B422C]
:0045701B 0FAFC2                  imul eax, edx
:0045701E 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00457021 81E1FF000000            and ecx, 000000FF
:00457027 0FBE95D4FEFFFF          movsx edx, byte ptr [ebp+FFFFFED4]
:0045702E 03CA                    add ecx, edx
:00457030 03C1                    add eax, ecx
:00457032 69C000090000            imul eax, 00000900
:00457038 50                      push eax
:00457039 B9A8E44A00              mov ecx, 004AE4A8
:0045703E E8FD890200              call 0047FA40
:00457043 8985D8FEFFFF            mov dword ptr [ebp+FFFFFED8], eax
:00457049 6800090000              push 00000900
:0045704E 8B85D8FEFFFF            mov eax, dword ptr [ebp+FFFFFED8]
:00457054 50                      push eax
:00457055 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:0045705B 51                      push ecx
:0045705C E89C8C0200              call 0047FCFD
:00457061 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00456FA0(C), :00456FC1(C), :00456FDB(C), :00456FFC(C)
|
:00457064 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:0045706A 81C200090000            add edx, 00000900
:00457070 8995E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], edx
:00457076 E9F3FEFFFF              jmp 00456F6E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00456F86(C)
|
:0045707B E9C6FEFFFF              jmp 00456F46

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00456F5F(C)
|
:00457080 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00457087 8D8DE4FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE4]
:0045708D E83EC2FAFF              call 004032D0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00456ECB(U)
|
:00457092 8B75F0                  mov esi, dword ptr [ebp-10]
:00457095 81E6FF000000            and esi, 000000FF
:0045709B 6BF605                  imul esi, 00000005
:0045709E 6A04                    push 00000004
:004570A0 6A00                    push 00000000
:004570A2 6A00                    push 00000000
:004570A4 B938EB4A00              mov ecx, 004AEB38
:004570A9 E892890200              call 0047FA40
:004570AE 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004570B1 81E1FF000000            and ecx, 000000FF
:004570B7 8D940840060000          lea edx, dword ptr [eax+ecx+00000640]
:004570BE 8B45E9                  mov eax, dword ptr [ebp-17]
:004570C1 25FF000000              and eax, 000000FF
:004570C6 33C9                    xor ecx, ecx
:004570C8 8A0D2C424B00            mov cl, byte ptr [004B422C]
:004570CE 0FAFC1                  imul eax, ecx
:004570D1 8A8E233D4B00            mov cl, byte ptr [esi+004B3D23]
:004570D7 880C02                  mov byte ptr [edx+eax], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00456E7F(C)
|
:004570DA E932FDFFFF              jmp 00456E11

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00456E28(C)
|
:004570DF 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004570E2 64890D00000000          mov dword ptr fs:[00000000], ecx
:004570E9 5E                      pop esi
:004570EA 8BE5                    mov esp, ebp
:004570EC 5D                      pop ebp
:004570ED C3                      ret



* Referenced by a CALL at Addresses:
|:0041310E   , :00414FFE   
|
:004570EE 55                      push ebp
:004570EF 8BEC                    mov ebp, esp
:004570F1 83EC38                  sub esp, 00000038
:004570F4 894DC8                  mov dword ptr [ebp-38], ecx
:004570F7 C745F4FFFFFFFF          mov [ebp-0C], FFFFFFFF
:004570FE 8B4508                  mov eax, dword ptr [ebp+08]
:00457101 50                      push eax
:00457102 E872EFFFFF              call 00456079
:00457107 83C404                  add esp, 00000004
:0045710A 8945E8                  mov dword ptr [ebp-18], eax
:0045710D C645FCFF                mov [ebp-04], FF
:00457111 837DE8FF                cmp dword ptr [ebp-18], FFFFFFFF
:00457115 0F849D020000            je 004573B8
:0045711B 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0045711E E86D1BFCFF              call 00418C90
:00457123 25FF000000              and eax, 000000FF
:00457128 83F801                  cmp eax, 00000001
:0045712B 0F8580020000            jne 004573B1
:00457131 C745F000000000          mov [ebp-10], 00000000
:00457138 EB09                    jmp 00457143

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00457172(U)
|
:0045713A 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0045713D 83C101                  add ecx, 00000001
:00457140 894DF0                  mov dword ptr [ebp-10], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00457138(U)
|
:00457143 837DF073                cmp dword ptr [ebp-10], 00000073
:00457147 732B                    jnb 00457174
:00457149 8B55F0                  mov edx, dword ptr [ebp-10]
:0045714C 52                      push edx
:0045714D B9902F4900              mov ecx, 00492F90
:00457152 E8791CFCFF              call 00418DD0
:00457157 8945EC                  mov dword ptr [ebp-14], eax
:0045715A 8B45EC                  mov eax, dword ptr [ebp-14]
:0045715D 8945F8                  mov dword ptr [ebp-08], eax
:00457160 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00457163 8B11                    mov edx, dword ptr [ecx]
:00457165 3B5508                  cmp edx, dword ptr [ebp+08]
:00457168 7508                    jne 00457172
:0045716A 8A45F0                  mov al, byte ptr [ebp-10]
:0045716D 8845FC                  mov byte ptr [ebp-04], al
:00457170 EB02                    jmp 00457174

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00457168(C)
|
:00457172 EBC6                    jmp 0045713A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00457147(C), :00457170(U)
|
:00457174 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00457177 81E1FF000000            and ecx, 000000FF
:0045717D 81F9FF000000            cmp ecx, 000000FF
:00457183 0F841F020000            je 004573A8
:00457189 8B55F8                  mov edx, dword ptr [ebp-08]
:0045718C 668B4204                mov ax, word ptr [edx+04]
:00457190 668945E4                mov word ptr [ebp-1C], ax
:00457194 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00457197 51                      push ecx
:00457198 E824020000              call 004573C1
:0045719D 83C404                  add esp, 00000004
:004571A0 85C0                    test eax, eax
:004571A2 0F8475010000            je 0045731D
:004571A8 8A55E5                  mov dl, byte ptr [ebp-1B]
:004571AB 52                      push edx
:004571AC 8A45E4                  mov al, byte ptr [ebp-1C]
:004571AF 50                      push eax
:004571B0 B950424B00              mov ecx, 004B4250
:004571B5 E885DEFFFF              call 0045503F
:004571BA E81C74FCFF              call 0041E5DB
:004571BF 6A00                    push 00000000
:004571C1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004571C4 8B5108                  mov edx, dword ptr [ecx+08]
:004571C7 83E208                  and edx, 00000008
:004571CA 52                      push edx
:004571CB 8A45E5                  mov al, byte ptr [ebp-1B]
:004571CE 50                      push eax
:004571CF 8A4DE4                  mov cl, byte ptr [ebp-1C]
:004571D2 51                      push ecx
:004571D3 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004571D6 E828B9FEFF              call 00442B03
:004571DB 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004571DE E87DC1FAFF              call 00403360
:004571E3 50                      push eax
:004571E4 8D4DE4                  lea ecx, dword ptr [ebp-1C]
:004571E7 E8B4F3FAFF              call 004065A0
:004571EC 668B55E4                mov dx, word ptr [ebp-1C]
:004571F0 52                      push edx
:004571F1 E88888FFFF              call 0044FA7E
:004571F6 83C404                  add esp, 00000004
:004571F9 8945CC                  mov dword ptr [ebp-34], eax
:004571FC 8955D0                  mov dword ptr [ebp-30], edx
:004571FF 8B45CC                  mov eax, dword ptr [ebp-34]
:00457202 8945D4                  mov dword ptr [ebp-2C], eax
:00457205 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00457208 894DD8                  mov dword ptr [ebp-28], ecx
:0045720B 668B55E4                mov dx, word ptr [ebp-1C]
:0045720F 52                      push edx
:00457210 8D45DC                  lea eax, dword ptr [ebp-24]
:00457213 50                      push eax
:00457214 E80688FFFF              call 0044FA1F
:00457219 83C408                  add esp, 00000008
:0045721C 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0045721F E88C50FCFF              call 0041C2B0
:00457224 25FF000000              and eax, 000000FF
:00457229 50                      push eax
:0045722A E84373FEFF              call 0043E572
:0045722F 83C404                  add esp, 00000004
:00457232 8945E0                  mov dword ptr [ebp-20], eax
:00457235 6A01                    push 00000001
:00457237 6A2A                    push 0000002A
:00457239 B9B0694B00              mov ecx, 004B69B0
:0045723E E837D40100              call 0047467A
:00457243 C745F004000000          mov [ebp-10], 00000004
:0045724A EB09                    jmp 00457255

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00457316(U)
|
:0045724C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0045724F 83C104                  add ecx, 00000004
:00457252 894DF0                  mov dword ptr [ebp-10], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045724A(U)
|
:00457255 837DF030                cmp dword ptr [ebp-10], 00000030
:00457259 0F87BC000000            ja 0045731B
:0045725F 6A00                    push 00000000
:00457261 6800090000              push 00000900
:00457266 B9C8E44A00              mov ecx, 004AE4C8
:0045726B E8206EFBFF              call 0040E090
:00457270 50                      push eax
:00457271 E89D8A0200              call 0047FD13
:00457276 83C40C                  add esp, 0000000C
:00457279 8B55F0                  mov edx, dword ptr [ebp-10]
:0045727C 6BD230                  imul edx, 00000030
:0045727F 52                      push edx
:00457280 6A04                    push 00000004
:00457282 6A00                    push 00000000
:00457284 B830000000              mov eax, 00000030
:00457289 2B45F0                  sub eax, dword ptr [ebp-10]
:0045728C 6BC030                  imul eax, 00000030
:0045728F 50                      push eax
:00457290 B9C8E44A00              mov ecx, 004AE4C8
:00457295 E8A6870200              call 0047FA40
:0045729A 50                      push eax
:0045729B 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0045729E 51                      push ecx
:0045729F E8598A0200              call 0047FCFD
:004572A4 83C40C                  add esp, 0000000C
:004572A7 E82F73FCFF              call 0041E5DB
:004572AC 8B55DD                  mov edx, dword ptr [ebp-23]
:004572AF 81E2FF000000            and edx, 000000FF
:004572B5 52                      push edx
:004572B6 8B45DC                  mov eax, dword ptr [ebp-24]
:004572B9 25FF000000              and eax, 000000FF
:004572BE 50                      push eax
:004572BF E835C4FAFF              call 004036F9
:004572C4 83C408                  add esp, 00000008
:004572C7 6A04                    push 00000004
:004572C9 6A00                    push 00000000
:004572CB 6A00                    push 00000000
:004572CD B9C8E44A00              mov ecx, 004AE4C8
:004572D2 E869870200              call 0047FA40
:004572D7 50                      push eax
:004572D8 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004572DB E8D04FFCFF              call 0041C2B0
:004572E0 50                      push eax
:004572E1 6A30                    push 00000030
:004572E3 6A30                    push 00000030
:004572E5 8B4DD8                  mov ecx, dword ptr [ebp-28]
:004572E8 51                      push ecx
:004572E9 8B55D4                  mov edx, dword ptr [ebp-2C]
:004572EC 52                      push edx
:004572ED E88AA0FFFF              call 0045137C
:004572F2 83C418                  add esp, 00000018
:004572F5 E8FC72FCFF              call 0041E5F6
:004572FA 837DF004                cmp dword ptr [ebp-10], 00000004
:004572FE 7505                    jne 00457305
:00457300 E8F172FCFF              call 0041E5F6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004572FE(C)
|
:00457305 6A01                    push 00000001
:00457307 B9181B4B00              mov ecx, 004B1B18
:0045730C E82FC0FAFF              call 00403340
:00457311 E8CA51FDFF              call 0042C4E0
:00457316 E931FFFFFF              jmp 0045724C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00457259(C)
|
:0045731B EB67                    jmp 00457384

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004571A2(C)
|
:0045731D 6A00                    push 00000000
:0045731F 8B45F8                  mov eax, dword ptr [ebp-08]
:00457322 8B4808                  mov ecx, dword ptr [eax+08]
:00457325 83E108                  and ecx, 00000008
:00457328 51                      push ecx
:00457329 8A55E5                  mov dl, byte ptr [ebp-1B]
:0045732C 52                      push edx
:0045732D 8A45E4                  mov al, byte ptr [ebp-1C]
:00457330 50                      push eax
:00457331 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00457334 E8CAB7FEFF              call 00442B03
:00457339 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0045733C E81FC0FAFF              call 00403360
:00457341 50                      push eax
:00457342 8D4DE4                  lea ecx, dword ptr [ebp-1C]
:00457345 E856F2FAFF              call 004065A0
:0045734A 8A4DE5                  mov cl, byte ptr [ebp-1B]
:0045734D 51                      push ecx
:0045734E 8A55E4                  mov dl, byte ptr [ebp-1C]
:00457351 52                      push edx
:00457352 B950424B00              mov ecx, 004B4250
:00457357 E8E3DCFFFF              call 0045503F
:0045735C 6A01                    push 00000001
:0045735E 6A0F                    push 0000000F
:00457360 B9B0694B00              mov ecx, 004B69B0
:00457365 E810D30100              call 0047467A
:0045736A 8A45E5                  mov al, byte ptr [ebp-1B]
:0045736D 50                      push eax
:0045736E 8A4DE4                  mov cl, byte ptr [ebp-1C]
:00457371 51                      push ecx
:00457372 B950424B00              mov ecx, 004B4250
:00457377 E8C3DCFFFF              call 0045503F
:0045737C 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0045737F E84589FEFF              call 0043FCC9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045731B(U)
|
:00457384 B9083D4B00              mov ecx, 004B3D08
:00457389 E8FC34FFFF              call 0044A88A
:0045738E 6A04                    push 00000004
:00457390 B9181B4B00              mov ecx, 004B1B18
:00457395 E8A6BFFAFF              call 00403340
:0045739A E84151FDFF              call 0042C4E0
:0045739F C745F401000000          mov [ebp-0C], 00000001
:004573A6 EB07                    jmp 004573AF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00457183(C)
|
:004573A8 C745F4FFFFFFFF          mov [ebp-0C], FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004573A6(U)
|
:004573AF EB07                    jmp 004573B8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045712B(C)
|
:004573B1 C745F4FFFFFFFF          mov [ebp-0C], FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00457115(C), :004573AF(U)
|
:004573B8 8B45F4                  mov eax, dword ptr [ebp-0C]
:004573BB 8BE5                    mov esp, ebp
:004573BD 5D                      pop ebp
:004573BE C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:00457198   , :00459279   
|
:004573C1 55                      push ebp
:004573C2 8BEC                    mov ebp, esp
:004573C4 83EC0C                  sub esp, 0000000C
:004573C7 8B4D08                  mov ecx, dword ptr [ebp+08]
:004573CA E8A1820000              call 0045F670
:004573CF 8945F8                  mov dword ptr [ebp-08], eax
:004573D2 8B4D08                  mov ecx, dword ptr [ebp+08]
:004573D5 E8966BFCFF              call 0041DF70
:004573DA 8845FC                  mov byte ptr [ebp-04], al
:004573DD C745F400000000          mov [ebp-0C], 00000000
:004573E4 817DF8A2000000          cmp dword ptr [ebp-08], 000000A2
:004573EB 7212                    jb 004573FF
:004573ED 817DF8A9000000          cmp dword ptr [ebp-08], 000000A9
:004573F4 7709                    ja 004573FF
:004573F6 C745F401000000          mov [ebp-0C], 00000001
:004573FD EB22                    jmp 00457421

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004573EB(C), :004573F4(C)
|
:004573FF 8B45FC                  mov eax, dword ptr [ebp-04]
:00457402 25FF000000              and eax, 000000FF
:00457407 83F831                  cmp eax, 00000031
:0045740A 740E                    je 0045741A
:0045740C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045740F 81E1FF000000            and ecx, 000000FF
:00457415 83F932                  cmp ecx, 00000032
:00457418 7507                    jne 00457421

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045740A(C)
|
:0045741A C745F401000000          mov [ebp-0C], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004573FD(U), :00457418(C)
|
:00457421 8B45F4                  mov eax, dword ptr [ebp-0C]
:00457424 8BE5                    mov esp, ebp
:00457426 5D                      pop ebp
:00457427 C3                      ret



* Referenced by a CALL at Addresses:
|:0041611B   , :00433432   , :004335A5   , :004335D5   , :00433873   
|:00433901   , :004339C0   , :00433A76   , :00433C26   , :00433CA5   
|:00433D6F   , :00433EC4   , :00433F29   , :004341FC   , :00434218   
|:00434234   , :00434264   , :0043437D   , :004343EB   , :0043456C   
|:0043459C   , :00434687   , :00434737   , :00434767   , :00434D4E   
|:00434D7E   
|
:00457428 55                      push ebp
:00457429 8BEC                    mov ebp, esp
:0045742B 83EC1C                  sub esp, 0000001C
:0045742E 894DE8                  mov dword ptr [ebp-18], ecx
:00457431 C745FC00000000          mov [ebp-04], 00000000
:00457438 C745F400000000          mov [ebp-0C], 00000000
:0045743F 817D0800020000          cmp dword ptr [ebp+08], 00000200
:00457446 7205                    jb 0045744D
:00457448 E92C030000              jmp 00457779

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00457446(C)
|
:0045744D C645F000                mov [ebp-10], 00
:00457451 EB08                    jmp 0045745B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045749C(U)
|
:00457453 8A45F0                  mov al, byte ptr [ebp-10]
:00457456 0401                    add al, 01
:00457458 8845F0                  mov byte ptr [ebp-10], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00457451(U)
|
:0045745B 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0045745E 81E1FF000000            and ecx, 000000FF
:00457464 83F973                  cmp ecx, 00000073
:00457467 7D35                    jge 0045749E
:00457469 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0045746C 81E1FF000000            and ecx, 000000FF
:00457472 6BC924                  imul ecx, 00000024
:00457475 81C1502C4B00            add ecx, 004B2C50
:0045747B E8F0810000              call 0045F670
:00457480 3B4508                  cmp eax, dword ptr [ebp+08]
:00457483 7517                    jne 0045749C
:00457485 8B55F0                  mov edx, dword ptr [ebp-10]
:00457488 81E2FF000000            and edx, 000000FF
:0045748E 6BD224                  imul edx, 00000024
:00457491 81C2502C4B00            add edx, 004B2C50
:00457497 8955FC                  mov dword ptr [ebp-04], edx
:0045749A EB02                    jmp 0045749E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00457483(C)
|
:0045749C EBB5                    jmp 00457453

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00457467(C), :0045749A(U)
|
:0045749E 837DFC00                cmp dword ptr [ebp-04], 00000000
:004574A2 0F84D1020000            je 00457779
:004574A8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004574AB E8E017FCFF              call 00418C90
:004574B0 25FF000000              and eax, 000000FF
:004574B5 83F802                  cmp eax, 00000002
:004574B8 0F85BB020000            jne 00457779
:004574BE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004574C1 E85A6EFEFF              call 0043E320
:004574C6 8845F8                  mov byte ptr [ebp-08], al
:004574C9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004574CC E88FBEFAFF              call 00403360
:004574D1 668B00                  mov ax, word ptr [eax]
:004574D4 668945EC                mov word ptr [ebp-14], ax
:004574D8 817D0CFFFF0000          cmp dword ptr [ebp+0C], 0000FFFF
:004574DF 0F85D2000000            jne 004575B7
:004574E5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004574E8 81E1FF000000            and ecx, 000000FF
:004574EE 8B5510                  mov edx, dword ptr [ebp+10]
:004574F1 81E2FF000000            and edx, 000000FF
:004574F7 3BCA                    cmp ecx, edx
:004574F9 7505                    jne 00457500
:004574FB E979020000              jmp 00457779

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004574F9(C)
|
:00457500 837D1800                cmp dword ptr [ebp+18], 00000000
:00457504 7423                    je 00457529
:00457506 8A45ED                  mov al, byte ptr [ebp-13]
:00457509 50                      push eax
:0045750A 8A4DEC                  mov cl, byte ptr [ebp-14]
:0045750D 51                      push ecx
:0045750E B950424B00              mov ecx, 004B4250
:00457513 E827DBFFFF              call 0045503F
:00457518 6A08                    push 00000008
:0045751A B9181B4B00              mov ecx, 004B1B18
:0045751F E81CBEFAFF              call 00403340
:00457524 E8B74FFDFF              call 0042C4E0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00457504(C)
|
:00457529 6A01                    push 00000001

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0045752B 6A06                    push 00000006
:0045752D B9B0694B00              mov ecx, 004B69B0
:00457532 E843D10100              call 0047467A
:00457537 8A5510                  mov dl, byte ptr [ebp+10]
:0045753A 52                      push edx
:0045753B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045753E E82DF1FAFF              call 00406670
:00457543 68FF000000              push 000000FF
:00457548 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045754B E8604DFCFF              call 0041C2B0
:00457550 50                      push eax
:00457551 E8D3E2FDFF              call 00435829
:00457556 83C408                  add esp, 00000008
:00457559 6A02                    push 00000002
:0045755B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045755E E88DE5FCFF              call 00425AF0
:00457563 85C0                    test eax, eax
:00457565 742C                    je 00457593
:00457567 6A04                    push 00000004
:00457569 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045756C E87FE5FCFF              call 00425AF0
:00457571 85C0                    test eax, eax
:00457573 741E                    je 00457593

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:00457575 6A06                    push 00000006
:00457577 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045757A E811F1FAFF              call 00406690
:0045757F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00457582 E84287FEFF              call 0043FCC9

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:00457587 6A06                    push 00000006
:00457589 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045758C E887B1FEFF              call 00442718
:00457591 EB08                    jmp 0045759B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00457565(C), :00457573(C)
|
:00457593 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00457596 E82E87FEFF              call 0043FCC9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00457591(U)
|
:0045759B 837D1C00                cmp dword ptr [ebp+1C], 00000000
:0045759F 7411                    je 004575B2
:004575A1 6A08                    push 00000008
:004575A3 B9181B4B00              mov ecx, 004B1B18
:004575A8 E893BDFAFF              call 00403340
:004575AD E82E4FFDFF              call 0042C4E0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045759F(C)
|
:004575B2 E9C2010000              jmp 00457779

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004574DF(C)
|
:004575B7 817D0800020000          cmp dword ptr [ebp+08], 00000200
:004575BE 0F83B5010000            jnb 00457779
:004575C4 C645F000                mov [ebp-10], 00
:004575C8 EB08                    jmp 004575D2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00457613(U)
|
:004575CA 8A45F0                  mov al, byte ptr [ebp-10]
:004575CD 0401                    add al, 01
:004575CF 8845F0                  mov byte ptr [ebp-10], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004575C8(U)
|
:004575D2 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004575D5 81E1FF000000            and ecx, 000000FF
:004575DB 83F973                  cmp ecx, 00000073
:004575DE 7D35                    jge 00457615
:004575E0 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004575E3 81E1FF000000            and ecx, 000000FF
:004575E9 6BC924                  imul ecx, 00000024
:004575EC 81C1502C4B00            add ecx, 004B2C50
:004575F2 E879800000              call 0045F670
:004575F7 3B450C                  cmp eax, dword ptr [ebp+0C]
:004575FA 7517                    jne 00457613
:004575FC 8B55F0                  mov edx, dword ptr [ebp-10]
:004575FF 81E2FF000000            and edx, 000000FF
:00457605 6BD224                  imul edx, 00000024
:00457608 81C2502C4B00            add edx, 004B2C50
:0045760E 8955F4                  mov dword ptr [ebp-0C], edx
:00457611 EB02                    jmp 00457615

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004575FA(C)
|
:00457613 EBB5                    jmp 004575CA

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004575DE(C), :00457611(U)
|
:00457615 837DF400                cmp dword ptr [ebp-0C], 00000000
:00457619 0F845A010000            je 00457779
:0045761F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00457622 E86916FCFF              call 00418C90
:00457627 25FF000000              and eax, 000000FF
:0045762C 83F802                  cmp eax, 00000002
:0045762F 0F8544010000            jne 00457779
:00457635 6A00                    push 00000000
:00457637 6A00                    push 00000000
:00457639 6A00                    push 00000000
:0045763B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0045763E E86D4CFCFF              call 0041C2B0
:00457643 50                      push eax
:00457644 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00457647 E8644CFCFF              call 0041C2B0
:0045764C 50                      push eax
:0045764D E888DBFDFF              call 004351DA
:00457652 83C414                  add esp, 00000014
:00457655 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00457658 81E1FF000000            and ecx, 000000FF
:0045765E 3BC1                    cmp eax, ecx
:00457660 7505                    jne 00457667
:00457662 E912010000              jmp 00457779

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00457660(C)
|
:00457667 837D1800                cmp dword ptr [ebp+18], 00000000
:0045766B 7423                    je 00457690
:0045766D 8A55ED                  mov dl, byte ptr [ebp-13]
:00457670 52                      push edx
:00457671 8A45EC                  mov al, byte ptr [ebp-14]
:00457674 50                      push eax
:00457675 B950424B00              mov ecx, 004B4250
:0045767A E8C0D9FFFF              call 0045503F
:0045767F 6A08                    push 00000008
:00457681 B9181B4B00              mov ecx, 004B1B18
:00457686 E8B5BCFAFF              call 00403340
:0045768B E8504EFDFF              call 0042C4E0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045766B(C)
|
:00457690 6A01                    push 00000001

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:00457692 6A06                    push 00000006
:00457694 B9B0694B00              mov ecx, 004B69B0
:00457699 E8DCCF0100              call 0047467A
:0045769E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004576A1 E80A4CFCFF              call 0041C2B0
:004576A6 50                      push eax
:004576A7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004576AA E8014CFCFF              call 0041C2B0
:004576AF 50                      push eax
:004576B0 E874E1FDFF              call 00435829
:004576B5 83C408                  add esp, 00000008
:004576B8 837D1400                cmp dword ptr [ebp+14], 00000000
:004576BC 7462                    je 00457720
:004576BE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004576C1 E85A6CFEFF              call 0043E320
:004576C6 25FF000000              and eax, 000000FF
:004576CB 8945E4                  mov dword ptr [ebp-1C], eax
:004576CE 837DE403                cmp dword ptr [ebp-1C], 00000003
:004576D2 774C                    ja 00457720
:004576D4 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004576D7 FF248D7F774500          jmp dword ptr [4*ecx+0045777F]
:004576DE 6A00                    push 00000000
:004576E0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004576E3 E888EFFAFF              call 00406670
:004576E8 EB36                    jmp 00457720
:004576EA 6A02                    push 00000002
:004576EC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004576EF E87CEFFAFF              call 00406670
:004576F4 EB2A                    jmp 00457720
:004576F6 6A03                    push 00000003
:004576F8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004576FB E870EFFAFF              call 00406670
:00457700 6A00                    push 00000000
:00457702 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00457705 E82A86FEFF              call 0043FD34
:0045770A EB14                    jmp 00457720
:0045770C 6A01                    push 00000001
:0045770E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00457711 E85AEFFAFF              call 00406670
:00457716 6A01                    push 00000001
:00457718 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045771B E81486FEFF              call 0043FD34

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004576BC(C), :004576D2(C), :004576E8(U), :004576F4(U), :0045770A(U)
|
:00457720 6A02                    push 00000002
:00457722 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00457725 E8C6E3FCFF              call 00425AF0
:0045772A 85C0                    test eax, eax
:0045772C 742C                    je 0045775A
:0045772E 6A04                    push 00000004
:00457730 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00457733 E8B8E3FCFF              call 00425AF0
:00457738 85C0                    test eax, eax
:0045773A 741E                    je 0045775A

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0045773C 6A06                    push 00000006
:0045773E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00457741 E84AEFFAFF              call 00406690
:00457746 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00457749 E87B85FEFF              call 0043FCC9

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0045774E 6A06                    push 00000006
:00457750 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00457753 E8C0AFFEFF              call 00442718
:00457758 EB08                    jmp 00457762

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045772C(C), :0045773A(C)
|
:0045775A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045775D E86785FEFF              call 0043FCC9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00457758(U)
|
:00457762 837D1C00                cmp dword ptr [ebp+1C], 00000000
:00457766 7411                    je 00457779
:00457768 6A08                    push 00000008
:0045776A B9181B4B00              mov ecx, 004B1B18
:0045776F E8CCBBFAFF              call 00403340
:00457774 E8674DFDFF              call 0042C4E0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00457448(U), :004574A2(C), :004574B8(C), :004574FB(U), :004575B2(U)
|:004575BE(C), :00457619(C), :0045762F(C), :00457662(U), :00457766(C)
|
:00457779 8BE5                    mov esp, ebp
:0045777B 5D                      pop ebp
:0045777C C21800                  ret 0018



:0045777F EA764500                DWORD 004576EA
:00457783 F6764500                DWORD 004576F6
:00457787 DE764500                DWORD 004576DE
:0045778B 0C774500                DWORD 0045770C



* Referenced by a CALL at Addresses:
|:004074F3   , :00408499   , :004084B9   , :004084CD   , :00408503   
|:00408517   , :0040853C   , :00408550   , :00408564   , :0041625C   
|:0041D6E5   , :0043368A   , :004336B3   , :004336DC   , :0043393E   
|:00433967   , :00433990   , :00433A9F   , :00433AC8   , :00433B49   
|:00433B72   , :00433BAB   , :00433D98   , :00433DC1   , :00434037   
|:004340F8   , :00434121   , :0043414A   , :00434182   , :004341CC   
|:0043428D   , :004342B6   , :00434414   , :0043443D   , :00434466   
|:0043448F   , :004344B8   , :004344E1   , :004346B0   , :004346D9   
|:00434790   , :004347B9   , :004347E2   , :00434839   , :00434862   
|:004348CC   , :00434900   , :0043494C   , :004349DE   , :00434A07   
|:00434A71   , :00434AA5   , :00434AF1   , :00434B83   , :00434BAC   
|:00434C31   , :00434C65   , :00434CC3   , :00434DA7   , :00434DD0   
|:00434DF9   , :00434E63   , :00434E97   , :00459A8A   
|
:0045778F 55                      push ebp
:00457790 8BEC                    mov ebp, esp
:00457792 6AFF                    push FFFFFFFF
:00457794 68AE564800              push 004856AE
:00457799 64A100000000            mov eax, dword ptr fs:[00000000]
:0045779F 50                      push eax
:004577A0 64892500000000          mov dword ptr fs:[00000000], esp
:004577A7 81EC50010000            sub esp, 00000150
:004577AD 56                      push esi
:004577AE 898DB8FEFFFF            mov dword ptr [ebp+FFFFFEB8], ecx
:004577B4 C745F000000000          mov [ebp-10], 00000000
:004577BB 8D8DC4FEFFFF            lea ecx, dword ptr [ebp+FFFFFEC4]
:004577C1 E84A7F0000              call 0045F710
:004577C6 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:004577CC E8DFBAFAFF              call 004032B0
:004577D1 C745FC00000000          mov [ebp-04], 00000000
:004577D8 817D0800020000          cmp dword ptr [ebp+08], 00000200
:004577DF 7217                    jb 004577F8
:004577E1 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:004577E8 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:004577EE E8DDBAFAFF              call 004032D0
:004577F3 E924190000              jmp 0045911C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004577DF(C)
|
:004577F8 C685D4FEFFFF00          mov byte ptr [ebp+FFFFFED4], 00
:004577FF EB0E                    jmp 0045780F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00457863(U)
|
:00457801 8A85D4FEFFFF            mov al, byte ptr [ebp+FFFFFED4]
:00457807 0401                    add al, 01
:00457809 8885D4FEFFFF            mov byte ptr [ebp+FFFFFED4], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004577FF(U)
|
:0045780F 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:00457815 81E1FF000000            and ecx, 000000FF
:0045781B 83F973                  cmp ecx, 00000073
:0045781E 7D45                    jge 00457865
:00457820 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:00457826 81E1FF000000            and ecx, 000000FF
:0045782C 6BC924                  imul ecx, 00000024
:0045782F 81C1502C4B00            add ecx, 004B2C50
:00457835 E8367E0000              call 0045F670
:0045783A 3B4508                  cmp eax, dword ptr [ebp+08]
:0045783D 7524                    jne 00457863
:0045783F 8A95D4FEFFFF            mov dl, byte ptr [ebp+FFFFFED4]
:00457845 8895D8FEFFFF            mov byte ptr [ebp+FFFFFED8], dl
:0045784B 8B85D4FEFFFF            mov eax, dword ptr [ebp+FFFFFED4]
:00457851 25FF000000              and eax, 000000FF
:00457856 6BC024                  imul eax, 00000024
:00457859 05502C4B00              add eax, 004B2C50
:0045785E 8945F0                  mov dword ptr [ebp-10], eax
:00457861 EB02                    jmp 00457865

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045783D(C)
|
:00457863 EB9C                    jmp 00457801

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045781E(C), :00457861(U)
|
:00457865 837DF000                cmp dword ptr [ebp-10], 00000000
:00457869 0F849B180000            je 0045910A
:0045786F 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00457872 E81914FCFF              call 00418C90
:00457877 25FF000000              and eax, 000000FF
:0045787C 83F802                  cmp eax, 00000002
:0045787F 0F8585180000            jne 0045910A
:00457885 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00457888 E8D3BAFAFF              call 00403360
:0045788D 50                      push eax
:0045788E 8D8DC4FEFFFF            lea ecx, dword ptr [ebp+FFFFFEC4]
:00457894 E807EDFAFF              call 004065A0
:00457899 8A8DC5FEFFFF            mov cl, byte ptr [ebp+FFFFFEC5]
:0045789F 51                      push ecx
:004578A0 8A95C4FEFFFF            mov dl, byte ptr [ebp+FFFFFEC4]
:004578A6 52                      push edx
:004578A7 B950424B00              mov ecx, 004B4250
:004578AC E88ED7FFFF              call 0045503F
:004578B1 8BB5C4FEFFFF            mov esi, dword ptr [ebp+FFFFFEC4]
:004578B7 81E6FF000000            and esi, 000000FF
:004578BD B950424B00              mov ecx, 004B4250
:004578C2 E8CCA1FFFF              call 00451A93
:004578C7 99                      cdq
:004578C8 B930000000              mov ecx, 00000030
:004578CD F7F9                    idiv ecx
:004578CF 2BF0                    sub esi, eax
:004578D1 89B5E4FEFFFF            mov dword ptr [ebp+FFFFFEE4], esi
:004578D7 8BB5C5FEFFFF            mov esi, dword ptr [ebp+FFFFFEC5]
:004578DD 81E6FF000000            and esi, 000000FF
:004578E3 B950424B00              mov ecx, 004B4250
:004578E8 E8B7A1FFFF              call 00451AA4
:004578ED 99                      cdq
:004578EE B930000000              mov ecx, 00000030
:004578F3 F7F9                    idiv ecx
:004578F5 2BF0                    sub esi, eax
:004578F7 89B5DCFEFFFF            mov dword ptr [ebp+FFFFFEDC], esi
:004578FD 8B95E4FEFFFF            mov edx, dword ptr [ebp+FFFFFEE4]
:00457903 6BD230                  imul edx, 00000030
:00457906 8995C8FEFFFF            mov dword ptr [ebp+FFFFFEC8], edx
:0045790C 8B85DCFEFFFF            mov eax, dword ptr [ebp+FFFFFEDC]
:00457912 6BC030                  imul eax, 00000030
:00457915 83C038                  add eax, 00000038
:00457918 8985C0FEFFFF            mov dword ptr [ebp+FFFFFEC0], eax
:0045791E 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00457921 E88A49FCFF              call 0041C2B0
:00457926 25FF000000              and eax, 000000FF
:0045792B 50                      push eax
:0045792C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0045792F E81483FEFF              call 0043FC48
:00457934 8845EC                  mov byte ptr [ebp-14], al
:00457937 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0045793A E8E169FEFF              call 0043E320
:0045793F 8885BCFEFFFF            mov byte ptr [ebp+FFFFFEBC], al
:00457945 837D1000                cmp dword ptr [ebp+10], 00000000
:00457949 742C                    je 00457977
:0045794B 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0045794E 81E1FF000000            and ecx, 000000FF
:00457954 85C9                    test ecx, ecx
:00457956 741F                    je 00457977
:00457958 8B550C                  mov edx, dword ptr [ebp+0C]
:0045795B 81E2FF000000            and edx, 000000FF
:00457961 83FA0B                  cmp edx, 0000000B
:00457964 7411                    je 00457977
:00457966 6A08                    push 00000008
:00457968 B9181B4B00              mov ecx, 004B1B18
:0045796D E8CEB9FAFF              call 00403340
:00457972 E8694BFDFF              call 0042C4E0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00457949(C), :00457956(C), :00457964(C)
|
:00457977 8B450C                  mov eax, dword ptr [ebp+0C]
:0045797A 25FF000000              and eax, 000000FF
:0045797F 8985B4FEFFFF            mov dword ptr [ebp+FFFFFEB4], eax
:00457985 83BDB4FEFFFF0C          cmp dword ptr [ebp+FFFFFEB4], 0000000C
:0045798C 0F8747170000            ja 004590D9
:00457992 8B8DB4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEB4]
:00457998 FF248D2D914500          jmp dword ptr [4*ecx+0045912D]
:0045799F 6A03                    push 00000003
:004579A1 6A03                    push 00000003
:004579A3 6A01                    push 00000001
:004579A5 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:004579AB 52                      push edx
:004579AC E8ED800200              call 0047FA9E
:004579B1 83C408                  add esp, 00000008
:004579B4 50                      push eax
:004579B5 6A01                    push 00000001
:004579B7 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:004579BD 50                      push eax
:004579BE E8DB800200              call 0047FA9E
:004579C3 83C408                  add esp, 00000008
:004579C6 50                      push eax
:004579C7 B950424B00              mov ecx, 004B4250
:004579CC E8BEA7FFFF              call 0045218F
:004579D1 E903170000              jmp 004590D9

* Possible StringData Ref from Data Obj ->"UNIT_SPC.E5"
                                  |
:004579D6 68D0BB4800              push 0048BBD0
:004579DB 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:004579E1 E84F81FCFF              call 0041FB35
:004579E6 6A04                    push 00000004
:004579E8 6A00                    push 00000000
:004579EA 6800690000              push 00006900
:004579EF B9C8E44A00              mov ecx, 004AE4C8
:004579F4 E847800200              call 0047FA40
:004579F9 50                      push eax
:004579FA 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004579FD 81E1FF000000            and ecx, 000000FF
:00457A03 51                      push ecx
:00457A04 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:00457A0A E87A82FCFF              call 0041FC89
:00457A0F 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:00457A15 E8AB18FCFF              call 004192C5
:00457A1A 6A04                    push 00000004
:00457A1C 6A00                    push 00000000
:00457A1E 6800400000              push 00004000
:00457A23 B9C8E44A00              mov ecx, 004AE4C8
:00457A28 E813800200              call 0047FA40
:00457A2D 8985D0FEFFFF            mov dword ptr [ebp+FFFFFED0], eax
:00457A33 6A04                    push 00000004
:00457A35 6A00                    push 00000000
:00457A37 68008D0000              push 00008D00
:00457A3C B9C8E44A00              mov ecx, 004AE4C8
:00457A41 E8FA7F0200              call 0047FA40
:00457A46 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:00457A4C 6800090000              push 00000900
:00457A51 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:00457A57 52                      push edx
:00457A58 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:00457A5E 50                      push eax
:00457A5F E899820200              call 0047FCFD
:00457A64 83C40C                  add esp, 0000000C
:00457A67 6A01                    push 00000001
:00457A69 6A08                    push 00000008
:00457A6B B9B0694B00              mov ecx, 004B69B0
:00457A70 E805CC0100              call 0047467A
:00457A75 E8616BFCFF              call 0041E5DB
:00457A7A 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:00457A80 51                      push ecx
:00457A81 8B95E4FEFFFF            mov edx, dword ptr [ebp+FFFFFEE4]
:00457A87 52                      push edx
:00457A88 E86CBCFAFF              call 004036F9
:00457A8D 83C408                  add esp, 00000008
:00457A90 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:00457A96 50                      push eax
:00457A97 8A8DD8FEFFFF            mov cl, byte ptr [ebp+FFFFFED8]
:00457A9D 51                      push ecx
:00457A9E 6A30                    push 00000030
:00457AA0 6A30                    push 00000030
:00457AA2 8B95C0FEFFFF            mov edx, dword ptr [ebp+FFFFFEC0]
:00457AA8 52                      push edx
:00457AA9 8B85C8FEFFFF            mov eax, dword ptr [ebp+FFFFFEC8]
:00457AAF 50                      push eax
:00457AB0 E8C798FFFF              call 0045137C
:00457AB5 83C418                  add esp, 00000018
:00457AB8 E8396BFCFF              call 0041E5F6
:00457ABD E917160000              jmp 004590D9

* Possible StringData Ref from Data Obj ->"UNIT_SPC.E5"
                                  |
:00457AC2 68D0BB4800              push 0048BBD0
:00457AC7 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:00457ACD E86380FCFF              call 0041FB35
:00457AD2 6A04                    push 00000004
:00457AD4 6A00                    push 00000000
:00457AD6 6800690000              push 00006900
:00457ADB B9C8E44A00              mov ecx, 004AE4C8
:00457AE0 E85B7F0200              call 0047FA40
:00457AE5 50                      push eax
:00457AE6 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00457AE9 81E1FF000000            and ecx, 000000FF
:00457AEF 51                      push ecx
:00457AF0 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:00457AF6 E88E81FCFF              call 0041FC89
:00457AFB 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:00457B01 E8BF17FCFF              call 004192C5
:00457B06 6A04                    push 00000004
:00457B08 6A00                    push 00000000
:00457B0A 6800400000              push 00004000
:00457B0F B9C8E44A00              mov ecx, 004AE4C8
:00457B14 E8277F0200              call 0047FA40
:00457B19 8985D0FEFFFF            mov dword ptr [ebp+FFFFFED0], eax
:00457B1F 8B95BCFEFFFF            mov edx, dword ptr [ebp+FFFFFEBC]
:00457B25 81E2FF000000            and edx, 000000FF
:00457B2B 8995B0FEFFFF            mov dword ptr [ebp+FFFFFEB0], edx
:00457B31 83BDB0FEFFFF03          cmp dword ptr [ebp+FFFFFEB0], 00000003
:00457B38 0F87E5000000            ja 00457C23
:00457B3E 8B85B0FEFFFF            mov eax, dword ptr [ebp+FFFFFEB0]
:00457B44 FF248561914500          jmp dword ptr [4*eax+00459161]
:00457B4B 6A04                    push 00000004
:00457B4D 6A00                    push 00000000
:00457B4F 6800720000              push 00007200
:00457B54 B9C8E44A00              mov ecx, 004AE4C8
:00457B59 E8E27E0200              call 0047FA40
:00457B5E 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:00457B64 6800090000              push 00000900
:00457B69 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00457B6F 51                      push ecx
:00457B70 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:00457B76 52                      push edx
:00457B77 E881810200              call 0047FCFD
:00457B7C 83C40C                  add esp, 0000000C
:00457B7F E99F000000              jmp 00457C23
:00457B84 6A04                    push 00000004
:00457B86 6A00                    push 00000000
:00457B88 68007B0000              push 00007B00
:00457B8D B9C8E44A00              mov ecx, 004AE4C8
:00457B92 E8A97E0200              call 0047FA40
:00457B97 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:00457B9D 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:00457BA3 50                      push eax
:00457BA4 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:00457BAA 51                      push ecx
:00457BAB 6A30                    push 00000030
:00457BAD 6A30                    push 00000030
:00457BAF E89F72FCFF              call 0041EE53
:00457BB4 83C410                  add esp, 00000010
:00457BB7 EB6A                    jmp 00457C23
:00457BB9 6A04                    push 00000004
:00457BBB 6A00                    push 00000000
:00457BBD 68007B0000              push 00007B00
:00457BC2 B9C8E44A00              mov ecx, 004AE4C8
:00457BC7 E8747E0200              call 0047FA40
:00457BCC 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:00457BD2 6800090000              push 00000900
:00457BD7 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:00457BDD 52                      push edx
:00457BDE 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:00457BE4 50                      push eax
:00457BE5 E813810200              call 0047FCFD
:00457BEA 83C40C                  add esp, 0000000C
:00457BED EB34                    jmp 00457C23
:00457BEF 6A04                    push 00000004
:00457BF1 6A00                    push 00000000
:00457BF3 6800690000              push 00006900
:00457BF8 B9C8E44A00              mov ecx, 004AE4C8
:00457BFD E83E7E0200              call 0047FA40
:00457C02 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:00457C08 6800090000              push 00000900
:00457C0D 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00457C13 51                      push ecx
:00457C14 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:00457C1A 52                      push edx
:00457C1B E8DD800200              call 0047FCFD
:00457C20 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00457B38(C), :00457B7F(U), :00457BB7(U), :00457BED(U)
|
:00457C23 6A01                    push 00000001
:00457C25 6A08                    push 00000008
:00457C27 B9B0694B00              mov ecx, 004B69B0
:00457C2C E849CA0100              call 0047467A
:00457C31 E8A569FCFF              call 0041E5DB
:00457C36 8B85DCFEFFFF            mov eax, dword ptr [ebp+FFFFFEDC]
:00457C3C 50                      push eax
:00457C3D 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:00457C43 51                      push ecx
:00457C44 E8B0BAFAFF              call 004036F9
:00457C49 83C408                  add esp, 00000008
:00457C4C 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:00457C52 52                      push edx
:00457C53 8A85D8FEFFFF            mov al, byte ptr [ebp+FFFFFED8]
:00457C59 50                      push eax
:00457C5A 6A30                    push 00000030
:00457C5C 6A30                    push 00000030
:00457C5E 8B8DC0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC0]
:00457C64 51                      push ecx
:00457C65 8B95C8FEFFFF            mov edx, dword ptr [ebp+FFFFFEC8]
:00457C6B 52                      push edx
:00457C6C E80B97FFFF              call 0045137C
:00457C71 83C418                  add esp, 00000018
:00457C74 E87D69FCFF              call 0041E5F6
:00457C79 E95B140000              jmp 004590D9

* Possible StringData Ref from Data Obj ->"UNIT_SPC.E5"
                                  |
:00457C7E 68D0BB4800              push 0048BBD0
:00457C83 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:00457C89 E8A77EFCFF              call 0041FB35
:00457C8E 6A04                    push 00000004
:00457C90 6A00                    push 00000000
:00457C92 6800690000              push 00006900
:00457C97 B9C8E44A00              mov ecx, 004AE4C8
:00457C9C E89F7D0200              call 0047FA40
:00457CA1 50                      push eax
:00457CA2 8B45EC                  mov eax, dword ptr [ebp-14]
:00457CA5 25FF000000              and eax, 000000FF
:00457CAA 50                      push eax
:00457CAB 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:00457CB1 E8D37FFCFF              call 0041FC89
:00457CB6 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:00457CBC E80416FCFF              call 004192C5
:00457CC1 6A04                    push 00000004
:00457CC3 6A00                    push 00000000
:00457CC5 6800400000              push 00004000
:00457CCA B9C8E44A00              mov ecx, 004AE4C8
:00457CCF E86C7D0200              call 0047FA40
:00457CD4 8985D0FEFFFF            mov dword ptr [ebp+FFFFFED0], eax
:00457CDA 6A04                    push 00000004
:00457CDC 6A00                    push 00000000
:00457CDE 6800840000              push 00008400
:00457CE3 B9C8E44A00              mov ecx, 004AE4C8
:00457CE8 E8537D0200              call 0047FA40
:00457CED 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:00457CF3 6800090000              push 00000900
:00457CF8 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00457CFE 51                      push ecx
:00457CFF 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:00457D05 52                      push edx
:00457D06 E8F27F0200              call 0047FCFD
:00457D0B 83C40C                  add esp, 0000000C
:00457D0E 6A01                    push 00000001
:00457D10 6A08                    push 00000008
:00457D12 B9B0694B00              mov ecx, 004B69B0
:00457D17 E85EC90100              call 0047467A
:00457D1C E8BA68FCFF              call 0041E5DB
:00457D21 8B85DCFEFFFF            mov eax, dword ptr [ebp+FFFFFEDC]
:00457D27 50                      push eax
:00457D28 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:00457D2E 51                      push ecx
:00457D2F E8C5B9FAFF              call 004036F9
:00457D34 83C408                  add esp, 00000008
:00457D37 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:00457D3D 52                      push edx
:00457D3E 8A85D8FEFFFF            mov al, byte ptr [ebp+FFFFFED8]
:00457D44 50                      push eax
:00457D45 6A30                    push 00000030
:00457D47 6A30                    push 00000030
:00457D49 8B8DC0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC0]
:00457D4F 51                      push ecx
:00457D50 8B95C8FEFFFF            mov edx, dword ptr [ebp+FFFFFEC8]
:00457D56 52                      push edx
:00457D57 E82096FFFF              call 0045137C
:00457D5C 83C418                  add esp, 00000018
:00457D5F E89268FCFF              call 0041E5F6
:00457D64 E970130000              jmp 004590D9

* Possible StringData Ref from Data Obj ->"UNIT_MOV.E5"
                                  |
:00457D69 68E0BB4800              push 0048BBE0
:00457D6E 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:00457D74 E8BC7DFCFF              call 0041FB35
:00457D79 6A04                    push 00000004
:00457D7B 6A00                    push 00000000
:00457D7D 6800690000              push 00006900
:00457D82 B9C8E44A00              mov ecx, 004AE4C8
:00457D87 E8B47C0200              call 0047FA40
:00457D8C 50                      push eax
:00457D8D 8B45EC                  mov eax, dword ptr [ebp-14]
:00457D90 25FF000000              and eax, 000000FF
:00457D95 50                      push eax
:00457D96 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:00457D9C E8E87EFCFF              call 0041FC89
:00457DA1 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:00457DA7 E81915FCFF              call 004192C5
:00457DAC 6A04                    push 00000004
:00457DAE 6A00                    push 00000000
:00457DB0 6800400000              push 00004000
:00457DB5 B9C8E44A00              mov ecx, 004AE4C8
:00457DBA E8817C0200              call 0047FA40
:00457DBF 8985D0FEFFFF            mov dword ptr [ebp+FFFFFED0], eax
:00457DC5 6A04                    push 00000004
:00457DC7 6A00                    push 00000000
:00457DC9 6800BA0000              push 0000BA00
:00457DCE B9C8E44A00              mov ecx, 004AE4C8
:00457DD3 E8687C0200              call 0047FA40
:00457DD8 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:00457DDE 6800090000              push 00000900
:00457DE3 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00457DE9 51                      push ecx
:00457DEA 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:00457DF0 52                      push edx
:00457DF1 E8077F0200              call 0047FCFD
:00457DF6 83C40C                  add esp, 0000000C
:00457DF9 6A01                    push 00000001
:00457DFB 6A08                    push 00000008
:00457DFD B9B0694B00              mov ecx, 004B69B0
:00457E02 E873C80100              call 0047467A
:00457E07 E8CF67FCFF              call 0041E5DB
:00457E0C 8B85DCFEFFFF            mov eax, dword ptr [ebp+FFFFFEDC]
:00457E12 50                      push eax
:00457E13 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:00457E19 51                      push ecx
:00457E1A E8DAB8FAFF              call 004036F9
:00457E1F 83C408                  add esp, 00000008
:00457E22 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:00457E28 52                      push edx
:00457E29 8A85D8FEFFFF            mov al, byte ptr [ebp+FFFFFED8]
:00457E2F 50                      push eax
:00457E30 6A30                    push 00000030
:00457E32 6A30                    push 00000030
:00457E34 8B8DC0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC0]
:00457E3A 51                      push ecx
:00457E3B 8B95C8FEFFFF            mov edx, dword ptr [ebp+FFFFFEC8]
:00457E41 52                      push edx
:00457E42 E83595FFFF              call 0045137C
:00457E47 83C418                  add esp, 00000018
:00457E4A E8A767FCFF              call 0041E5F6
:00457E4F E985120000              jmp 004590D9

* Possible StringData Ref from Data Obj ->"UNIT_ATK.E5"
                                  |
:00457E54 68C0BB4800              push 0048BBC0
:00457E59 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:00457E5F E8D17CFCFF              call 0041FB35
:00457E64 6A04                    push 00000004
:00457E66 6A00                    push 00000000
:00457E68 6800690000              push 00006900
:00457E6D B9C8E44A00              mov ecx, 004AE4C8
:00457E72 E8C97B0200              call 0047FA40
:00457E77 50                      push eax
:00457E78 8B45EC                  mov eax, dword ptr [ebp-14]
:00457E7B 25FF000000              and eax, 000000FF
:00457E80 50                      push eax
:00457E81 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:00457E87 E8FD7DFCFF              call 0041FC89
:00457E8C 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:00457E92 E82E14FCFF              call 004192C5
:00457E97 6A04                    push 00000004
:00457E99 6A00                    push 00000000
:00457E9B 6A00                    push 00000000
:00457E9D B9C8E44A00              mov ecx, 004AE4C8
:00457EA2 E8997B0200              call 0047FA40
:00457EA7 8985D0FEFFFF            mov dword ptr [ebp+FFFFFED0], eax
:00457EAD 8B8DBCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEBC]
:00457EB3 81E1FF000000            and ecx, 000000FF
:00457EB9 898DACFEFFFF            mov dword ptr [ebp+FFFFFEAC], ecx
:00457EBF 83BDACFEFFFF03          cmp dword ptr [ebp+FFFFFEAC], 00000003
:00457EC6 0F87E5000000            ja 00457FB1
:00457ECC 8B95ACFEFFFF            mov edx, dword ptr [ebp+FFFFFEAC]
:00457ED2 FF249571914500          jmp dword ptr [4*edx+00459171]
:00457ED9 6A04                    push 00000004
:00457EDB 6A00                    push 00000000
:00457EDD 6800A90000              push 0000A900
:00457EE2 B9C8E44A00              mov ecx, 004AE4C8
:00457EE7 E8547B0200              call 0047FA40
:00457EEC 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:00457EF2 6800100000              push 00001000
:00457EF7 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:00457EFD 50                      push eax
:00457EFE 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:00457F04 51                      push ecx
:00457F05 E8F37D0200              call 0047FCFD
:00457F0A 83C40C                  add esp, 0000000C
:00457F0D E99F000000              jmp 00457FB1
:00457F12 6A04                    push 00000004
:00457F14 6A00                    push 00000000
:00457F16 6800E90000              push 0000E900
:00457F1B B9C8E44A00              mov ecx, 004AE4C8
:00457F20 E81B7B0200              call 0047FA40
:00457F25 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:00457F2B 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:00457F31 52                      push edx
:00457F32 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:00457F38 50                      push eax
:00457F39 6A40                    push 00000040
:00457F3B 6A40                    push 00000040
:00457F3D E8116FFCFF              call 0041EE53
:00457F42 83C410                  add esp, 00000010
:00457F45 EB6A                    jmp 00457FB1
:00457F47 6A04                    push 00000004
:00457F49 6A00                    push 00000000
:00457F4B 6800E90000              push 0000E900
:00457F50 B9C8E44A00              mov ecx, 004AE4C8
:00457F55 E8E67A0200              call 0047FA40
:00457F5A 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:00457F60 6800100000              push 00001000
:00457F65 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00457F6B 51                      push ecx
:00457F6C 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:00457F72 52                      push edx
:00457F73 E8857D0200              call 0047FCFD
:00457F78 83C40C                  add esp, 0000000C
:00457F7B EB34                    jmp 00457FB1
:00457F7D 6A04                    push 00000004
:00457F7F 6A00                    push 00000000
:00457F81 6800690000              push 00006900
:00457F86 B9C8E44A00              mov ecx, 004AE4C8
:00457F8B E8B07A0200              call 0047FA40
:00457F90 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:00457F96 6800100000              push 00001000
:00457F9B 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:00457FA1 50                      push eax
:00457FA2 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:00457FA8 51                      push ecx
:00457FA9 E84F7D0200              call 0047FCFD
:00457FAE 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00457EC6(C), :00457F0D(U), :00457F45(U), :00457F7B(U)
|
:00457FB1 6A01                    push 00000001
:00457FB3 6A08                    push 00000008
:00457FB5 B9B0694B00              mov ecx, 004B69B0
:00457FBA E8BBC60100              call 0047467A
:00457FBF E81766FCFF              call 0041E5DB
:00457FC4 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:00457FCA 52                      push edx
:00457FCB 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:00457FD1 50                      push eax
:00457FD2 E822B7FAFF              call 004036F9
:00457FD7 83C408                  add esp, 00000008
:00457FDA 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00457FE0 51                      push ecx
:00457FE1 8A95D8FEFFFF            mov dl, byte ptr [ebp+FFFFFED8]
:00457FE7 52                      push edx
:00457FE8 6A40                    push 00000040
:00457FEA 6A40                    push 00000040
:00457FEC 8B85C0FEFFFF            mov eax, dword ptr [ebp+FFFFFEC0]
:00457FF2 83E808                  sub eax, 00000008
:00457FF5 50                      push eax
:00457FF6 8B8DC8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC8]
:00457FFC 83E908                  sub ecx, 00000008
:00457FFF 51                      push ecx
:00458000 E87793FFFF              call 0045137C
:00458005 83C418                  add esp, 00000018
:00458008 E8E965FCFF              call 0041E5F6
:0045800D E9C7100000              jmp 004590D9

* Possible StringData Ref from Data Obj ->"UNIT_ATK.E5"
                                  |
:00458012 68C0BB4800              push 0048BBC0
:00458017 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:0045801D E8137BFCFF              call 0041FB35
:00458022 6A04                    push 00000004
:00458024 6A00                    push 00000000
:00458026 6800690000              push 00006900
:0045802B B9C8E44A00              mov ecx, 004AE4C8
:00458030 E80B7A0200              call 0047FA40
:00458035 50                      push eax
:00458036 8B55EC                  mov edx, dword ptr [ebp-14]
:00458039 81E2FF000000            and edx, 000000FF
:0045803F 52                      push edx
:00458040 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:00458046 E83E7CFCFF              call 0041FC89
:0045804B 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:00458051 E86F12FCFF              call 004192C5
:00458056 6A04                    push 00000004
:00458058 6A00                    push 00000000
:0045805A 6A00                    push 00000000
:0045805C B9C8E44A00              mov ecx, 004AE4C8
:00458061 E8DA790200              call 0047FA40
:00458066 8985D0FEFFFF            mov dword ptr [ebp+FFFFFED0], eax
:0045806C 8B85BCFEFFFF            mov eax, dword ptr [ebp+FFFFFEBC]
:00458072 25FF000000              and eax, 000000FF
:00458077 8985A8FEFFFF            mov dword ptr [ebp+FFFFFEA8], eax
:0045807D 83BDA8FEFFFF03          cmp dword ptr [ebp+FFFFFEA8], 00000003
:00458084 0F87E8000000            ja 00458172
:0045808A 8B8DA8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEA8]
:00458090 FF248D81914500          jmp dword ptr [4*ecx+00459181]
:00458097 6A04                    push 00000004
:00458099 6A00                    push 00000000
:0045809B 6800A90000              push 0000A900
:004580A0 B9C8E44A00              mov ecx, 004AE4C8
:004580A5 E896790200              call 0047FA40
:004580AA 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:004580B0 6800400000              push 00004000
:004580B5 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:004580BB 52                      push edx
:004580BC 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:004580C2 50                      push eax
:004580C3 E8357C0200              call 0047FCFD
:004580C8 83C40C                  add esp, 0000000C
:004580CB E9A2000000              jmp 00458172
:004580D0 6A04                    push 00000004
:004580D2 6A00                    push 00000000
:004580D4 6800E90000              push 0000E900
:004580D9 B9C8E44A00              mov ecx, 004AE4C8
:004580DE E85D790200              call 0047FA40
:004580E3 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:004580E9 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:004580EF 51                      push ecx
:004580F0 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:004580F6 52                      push edx
:004580F7 6800010000              push 00000100
:004580FC 6A40                    push 00000040
:004580FE E8506DFCFF              call 0041EE53
:00458103 83C410                  add esp, 00000010
:00458106 EB6A                    jmp 00458172
:00458108 6A04                    push 00000004
:0045810A 6A00                    push 00000000
:0045810C 6800E90000              push 0000E900
:00458111 B9C8E44A00              mov ecx, 004AE4C8
:00458116 E825790200              call 0047FA40
:0045811B 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:00458121 6800400000              push 00004000
:00458126 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:0045812C 50                      push eax
:0045812D 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:00458133 51                      push ecx
:00458134 E8C47B0200              call 0047FCFD
:00458139 83C40C                  add esp, 0000000C
:0045813C EB34                    jmp 00458172
:0045813E 6A04                    push 00000004
:00458140 6A00                    push 00000000
:00458142 6800690000              push 00006900
:00458147 B9C8E44A00              mov ecx, 004AE4C8
:0045814C E8EF780200              call 0047FA40
:00458151 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:00458157 6800400000              push 00004000
:0045815C 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:00458162 52                      push edx
:00458163 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:00458169 50                      push eax
:0045816A E88E7B0200              call 0047FCFD
:0045816F 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00458084(C), :004580CB(U), :00458106(U), :0045813C(U)
|
:00458172 6A01                    push 00000001

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:00458174 6A07                    push 00000007
:00458176 B9B0694B00              mov ecx, 004B69B0
:0045817B E8FAC40100              call 0047467A
:00458180 C685D4FEFFFF00          mov byte ptr [ebp+FFFFFED4], 00
:00458187 EB0F                    jmp 00458198

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00458296(U)
|
:00458189 8A8DD4FEFFFF            mov cl, byte ptr [ebp+FFFFFED4]
:0045818F 80C101                  add cl, 01
:00458192 888DD4FEFFFF            mov byte ptr [ebp+FFFFFED4], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00458187(U)
|
:00458198 8B95D4FEFFFF            mov edx, dword ptr [ebp+FFFFFED4]
:0045819E 81E2FF000000            and edx, 000000FF
:004581A4 83FA04                  cmp edx, 00000004
:004581A7 0F8DEE000000            jnl 0045829B
:004581AD E82964FCFF              call 0041E5DB
:004581B2 8B85D4FEFFFF            mov eax, dword ptr [ebp+FFFFFED4]
:004581B8 25FF000000              and eax, 000000FF
:004581BD 85C0                    test eax, eax
:004581BF 754A                    jne 0045820B
:004581C1 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:004581C7 51                      push ecx
:004581C8 8B95E4FEFFFF            mov edx, dword ptr [ebp+FFFFFEE4]
:004581CE 52                      push edx
:004581CF E825B5FAFF              call 004036F9
:004581D4 83C408                  add esp, 00000008
:004581D7 6A04                    push 00000004
:004581D9 6A00                    push 00000000
:004581DB 6800490000              push 00004900
:004581E0 B9C8E44A00              mov ecx, 004AE4C8
:004581E5 E856780200              call 0047FA40
:004581EA 50                      push eax
:004581EB 6A40                    push 00000040
:004581ED 6A40                    push 00000040
:004581EF 8B85C0FEFFFF            mov eax, dword ptr [ebp+FFFFFEC0]
:004581F5 83E808                  sub eax, 00000008
:004581F8 50                      push eax
:004581F9 8B8DC8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC8]
:004581FF 83E908                  sub ecx, 00000008
:00458202 51                      push ecx
:00458203 E8DE97FFFF              call 004519E6
:00458208 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004581BF(C)
|
:0045820B 6A00                    push 00000000
:0045820D 6A04                    push 00000004
:0045820F 6A00                    push 00000000
:00458211 6800490000              push 00004900
:00458216 B9C8E44A00              mov ecx, 004AE4C8
:0045821B E820780200              call 0047FA40
:00458220 50                      push eax
:00458221 6A40                    push 00000040
:00458223 6A40                    push 00000040
:00458225 8B95C0FEFFFF            mov edx, dword ptr [ebp+FFFFFEC0]
:0045822B 83EA08                  sub edx, 00000008
:0045822E 52                      push edx
:0045822F 8B85C8FEFFFF            mov eax, dword ptr [ebp+FFFFFEC8]
:00458235 83E808                  sub eax, 00000008
:00458238 50                      push eax
:00458239 E8D596FFFF              call 00451913
:0045823E 83C418                  add esp, 00000018
:00458241 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:00458247 81E1FF000000            and ecx, 000000FF
:0045824D C1E10C                  shl ecx, 0C
:00458250 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:00458256 03D1                    add edx, ecx
:00458258 52                      push edx
:00458259 8A85D8FEFFFF            mov al, byte ptr [ebp+FFFFFED8]
:0045825F 50                      push eax
:00458260 6A40                    push 00000040
:00458262 6A40                    push 00000040
:00458264 8B8DC0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC0]
:0045826A 83E908                  sub ecx, 00000008
:0045826D 51                      push ecx
:0045826E 8B95C8FEFFFF            mov edx, dword ptr [ebp+FFFFFEC8]
:00458274 83EA08                  sub edx, 00000008
:00458277 52                      push edx
:00458278 E8FF90FFFF              call 0045137C
:0045827D 83C418                  add esp, 00000018
:00458280 E87163FCFF              call 0041E5F6
:00458285 6A01                    push 00000001
:00458287 B9181B4B00              mov ecx, 004B1B18
:0045828C E8AFB0FAFF              call 00403340
:00458291 E84A42FDFF              call 0042C4E0
:00458296 E9EEFEFFFF              jmp 00458189

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004581A7(C)
|
:0045829B E9390E0000              jmp 004590D9

* Possible StringData Ref from Data Obj ->"UNIT_ATK.E5"
                                  |
:004582A0 68C0BB4800              push 0048BBC0
:004582A5 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:004582AB E88578FCFF              call 0041FB35
:004582B0 6A04                    push 00000004
:004582B2 6A00                    push 00000000
:004582B4 6800690000              push 00006900
:004582B9 B9C8E44A00              mov ecx, 004AE4C8
:004582BE E87D770200              call 0047FA40
:004582C3 50                      push eax
:004582C4 8B45EC                  mov eax, dword ptr [ebp-14]
:004582C7 25FF000000              and eax, 000000FF
:004582CC 50                      push eax
:004582CD 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:004582D3 E8B179FCFF              call 0041FC89
:004582D8 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:004582DE E8E20FFCFF              call 004192C5
:004582E3 6A04                    push 00000004
:004582E5 6A00                    push 00000000
:004582E7 6A00                    push 00000000
:004582E9 B9C8E44A00              mov ecx, 004AE4C8
:004582EE E84D770200              call 0047FA40
:004582F3 8985D0FEFFFF            mov dword ptr [ebp+FFFFFED0], eax
:004582F9 8B8DBCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEBC]
:004582FF 81E1FF000000            and ecx, 000000FF
:00458305 898DA4FEFFFF            mov dword ptr [ebp+FFFFFEA4], ecx
:0045830B 83BDA4FEFFFF03          cmp dword ptr [ebp+FFFFFEA4], 00000003
:00458312 0F87E8000000            ja 00458400
:00458318 8B95A4FEFFFF            mov edx, dword ptr [ebp+FFFFFEA4]
:0045831E FF249591914500          jmp dword ptr [4*edx+00459191]
:00458325 6A04                    push 00000004
:00458327 6A00                    push 00000000
:00458329 6800A90000              push 0000A900
:0045832E B9C8E44A00              mov ecx, 004AE4C8
:00458333 E808770200              call 0047FA40
:00458338 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:0045833E 6800400000              push 00004000
:00458343 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:00458349 50                      push eax
:0045834A 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:00458350 51                      push ecx
:00458351 E8A7790200              call 0047FCFD
:00458356 83C40C                  add esp, 0000000C
:00458359 E9A2000000              jmp 00458400
:0045835E 6A04                    push 00000004
:00458360 6A00                    push 00000000
:00458362 6800E90000              push 0000E900
:00458367 B9C8E44A00              mov ecx, 004AE4C8
:0045836C E8CF760200              call 0047FA40
:00458371 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:00458377 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:0045837D 52                      push edx
:0045837E 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:00458384 50                      push eax
:00458385 6800010000              push 00000100
:0045838A 6A40                    push 00000040
:0045838C E8C26AFCFF              call 0041EE53
:00458391 83C410                  add esp, 00000010
:00458394 EB6A                    jmp 00458400
:00458396 6A04                    push 00000004
:00458398 6A00                    push 00000000
:0045839A 6800E90000              push 0000E900
:0045839F B9C8E44A00              mov ecx, 004AE4C8
:004583A4 E897760200              call 0047FA40
:004583A9 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:004583AF 6800400000              push 00004000
:004583B4 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:004583BA 51                      push ecx
:004583BB 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:004583C1 52                      push edx
:004583C2 E836790200              call 0047FCFD
:004583C7 83C40C                  add esp, 0000000C
:004583CA EB34                    jmp 00458400
:004583CC 6A04                    push 00000004
:004583CE 6A00                    push 00000000
:004583D0 6800690000              push 00006900
:004583D5 B9C8E44A00              mov ecx, 004AE4C8
:004583DA E861760200              call 0047FA40
:004583DF 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:004583E5 6800400000              push 00004000
:004583EA 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:004583F0 50                      push eax
:004583F1 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:004583F7 51                      push ecx
:004583F8 E800790200              call 0047FCFD
:004583FD 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00458312(C), :00458359(U), :00458394(U), :004583CA(U)
|
:00458400 C685CCFEFFFF00          mov byte ptr [ebp+FFFFFECC], 00
:00458407 EB0F                    jmp 00458418

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00458565(U)
|
:00458409 8A95CCFEFFFF            mov dl, byte ptr [ebp+FFFFFECC]
:0045840F 80C201                  add dl, 01
:00458412 8895CCFEFFFF            mov byte ptr [ebp+FFFFFECC], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00458407(U)
|
:00458418 8B85CCFEFFFF            mov eax, dword ptr [ebp+FFFFFECC]
:0045841E 25FF000000              and eax, 000000FF
:00458423 83F802                  cmp eax, 00000002
:00458426 0F8D3E010000            jnl 0045856A
:0045842C 6A01                    push 00000001

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0045842E 6A07                    push 00000007
:00458430 B9B0694B00              mov ecx, 004B69B0
:00458435 E840C20100              call 0047467A
:0045843A C685D4FEFFFF00          mov byte ptr [ebp+FFFFFED4], 00
:00458441 EB0F                    jmp 00458452

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00458560(U)
|
:00458443 8A8DD4FEFFFF            mov cl, byte ptr [ebp+FFFFFED4]
:00458449 80C101                  add cl, 01
:0045844C 888DD4FEFFFF            mov byte ptr [ebp+FFFFFED4], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00458441(U)
|
:00458452 8B95D4FEFFFF            mov edx, dword ptr [ebp+FFFFFED4]
:00458458 81E2FF000000            and edx, 000000FF
:0045845E 83FA04                  cmp edx, 00000004
:00458461 0F8DFE000000            jnl 00458565
:00458467 E86F61FCFF              call 0041E5DB
:0045846C 8B85CCFEFFFF            mov eax, dword ptr [ebp+FFFFFECC]
:00458472 25FF000000              and eax, 000000FF
:00458477 85C0                    test eax, eax
:00458479 755A                    jne 004584D5
:0045847B 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:00458481 81E1FF000000            and ecx, 000000FF
:00458487 85C9                    test ecx, ecx
:00458489 754A                    jne 004584D5
:0045848B 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:00458491 52                      push edx
:00458492 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:00458498 50                      push eax
:00458499 E85BB2FAFF              call 004036F9
:0045849E 83C408                  add esp, 00000008
:004584A1 6A04                    push 00000004
:004584A3 6A00                    push 00000000
:004584A5 6800490000              push 00004900
:004584AA B9C8E44A00              mov ecx, 004AE4C8
:004584AF E88C750200              call 0047FA40
:004584B4 50                      push eax
:004584B5 6A40                    push 00000040
:004584B7 6A40                    push 00000040
:004584B9 8B8DC0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC0]
:004584BF 83E908                  sub ecx, 00000008
:004584C2 51                      push ecx
:004584C3 8B95C8FEFFFF            mov edx, dword ptr [ebp+FFFFFEC8]
:004584C9 83EA08                  sub edx, 00000008
:004584CC 52                      push edx
:004584CD E81495FFFF              call 004519E6
:004584D2 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00458479(C), :00458489(C)
|
:004584D5 6A00                    push 00000000
:004584D7 6A04                    push 00000004
:004584D9 6A00                    push 00000000
:004584DB 6800490000              push 00004900
:004584E0 B9C8E44A00              mov ecx, 004AE4C8
:004584E5 E856750200              call 0047FA40
:004584EA 50                      push eax
:004584EB 6A40                    push 00000040
:004584ED 6A40                    push 00000040
:004584EF 8B85C0FEFFFF            mov eax, dword ptr [ebp+FFFFFEC0]
:004584F5 83E808                  sub eax, 00000008
:004584F8 50                      push eax
:004584F9 8B8DC8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC8]
:004584FF 83E908                  sub ecx, 00000008
:00458502 51                      push ecx
:00458503 E80B94FFFF              call 00451913
:00458508 83C418                  add esp, 00000018
:0045850B 8B95D4FEFFFF            mov edx, dword ptr [ebp+FFFFFED4]
:00458511 81E2FF000000            and edx, 000000FF
:00458517 C1E20C                  shl edx, 0C
:0045851A 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:00458520 03C2                    add eax, edx
:00458522 50                      push eax
:00458523 8A8DD8FEFFFF            mov cl, byte ptr [ebp+FFFFFED8]
:00458529 51                      push ecx
:0045852A 6A40                    push 00000040
:0045852C 6A40                    push 00000040
:0045852E 8B95C0FEFFFF            mov edx, dword ptr [ebp+FFFFFEC0]
:00458534 83EA08                  sub edx, 00000008
:00458537 52                      push edx
:00458538 8B85C8FEFFFF            mov eax, dword ptr [ebp+FFFFFEC8]
:0045853E 83E808                  sub eax, 00000008
:00458541 50                      push eax
:00458542 E8358EFFFF              call 0045137C
:00458547 83C418                  add esp, 00000018
:0045854A E8A760FCFF              call 0041E5F6
:0045854F 6A02                    push 00000002
:00458551 B9181B4B00              mov ecx, 004B1B18
:00458556 E8E5ADFAFF              call 00403340
:0045855B E8803FFDFF              call 0042C4E0
:00458560 E9DEFEFFFF              jmp 00458443

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00458461(C)
|
:00458565 E99FFEFFFF              jmp 00458409

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00458426(C)
|
:0045856A E86C60FCFF              call 0041E5DB
:0045856F 6A00                    push 00000000
:00458571 6A04                    push 00000004
:00458573 6A00                    push 00000000
:00458575 6800490000              push 00004900
:0045857A B9C8E44A00              mov ecx, 004AE4C8
:0045857F E8BC740200              call 0047FA40
:00458584 50                      push eax
:00458585 6A40                    push 00000040
:00458587 6A40                    push 00000040
:00458589 8B8DC0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC0]
:0045858F 83E908                  sub ecx, 00000008
:00458592 51                      push ecx
:00458593 8B95C8FEFFFF            mov edx, dword ptr [ebp+FFFFFEC8]
:00458599 83EA08                  sub edx, 00000008
:0045859C 52                      push edx
:0045859D E87193FFFF              call 00451913
:004585A2 83C418                  add esp, 00000018
:004585A5 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004585A8 E81C77FEFF              call 0043FCC9
:004585AD E84460FCFF              call 0041E5F6
:004585B2 E9220B0000              jmp 004590D9

* Possible StringData Ref from Data Obj ->"UNIT_MOV.E5"
                                  |
:004585B7 68E0BB4800              push 0048BBE0
:004585BC 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:004585C2 E86E75FCFF              call 0041FB35
:004585C7 6A04                    push 00000004
:004585C9 6A00                    push 00000000
:004585CB 6800690000              push 00006900
:004585D0 B9C8E44A00              mov ecx, 004AE4C8
:004585D5 E866740200              call 0047FA40
:004585DA 50                      push eax
:004585DB 8B45EC                  mov eax, dword ptr [ebp-14]
:004585DE 25FF000000              and eax, 000000FF
:004585E3 50                      push eax
:004585E4 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:004585EA E89A76FCFF              call 0041FC89
:004585EF 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:004585F5 E8CB0CFCFF              call 004192C5
:004585FA 6A04                    push 00000004
:004585FC 6A00                    push 00000000
:004585FE 6A00                    push 00000000
:00458600 B9C8E44A00              mov ecx, 004AE4C8
:00458605 E836740200              call 0047FA40
:0045860A 8985D0FEFFFF            mov dword ptr [ebp+FFFFFED0], eax
:00458610 6A04                    push 00000004
:00458612 6A00                    push 00000000
:00458614 68008D0000              push 00008D00
:00458619 B9C8E44A00              mov ecx, 004AE4C8
:0045861E E81D740200              call 0047FA40
:00458623 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:00458629 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:0045862F 51                      push ecx
:00458630 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:00458636 52                      push edx
:00458637 6A60                    push 00000060
:00458639 6A30                    push 00000030
:0045863B E81368FCFF              call 0041EE53
:00458640 83C410                  add esp, 00000010
:00458643 6A04                    push 00000004
:00458645 6A00                    push 00000000
:00458647 68008D0000              push 00008D00
:0045864C B9C8E44A00              mov ecx, 004AE4C8
:00458651 E8EA730200              call 0047FA40
:00458656 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:0045865C 6800120000              push 00001200
:00458661 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:00458667 0500120000              add eax, 00001200
:0045866C 50                      push eax
:0045866D 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:00458673 51                      push ecx
:00458674 E884760200              call 0047FCFD
:00458679 83C40C                  add esp, 0000000C
:0045867C 6A01                    push 00000001

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0045867E 6A06                    push 00000006
:00458680 B9B0694B00              mov ecx, 004B69B0
:00458685 E8F0BF0100              call 0047467A
:0045868A C685D4FEFFFF00          mov byte ptr [ebp+FFFFFED4], 00
:00458691 EB0F                    jmp 004586A2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00458750(U)
|
:00458693 8A95D4FEFFFF            mov dl, byte ptr [ebp+FFFFFED4]
:00458699 80C201                  add dl, 01
:0045869C 8895D4FEFFFF            mov byte ptr [ebp+FFFFFED4], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00458691(U)
|
:004586A2 8B85D4FEFFFF            mov eax, dword ptr [ebp+FFFFFED4]
:004586A8 25FF000000              and eax, 000000FF
:004586AD 83F808                  cmp eax, 00000008
:004586B0 0F8D9F000000            jnl 00458755
:004586B6 E8205FFCFF              call 0041E5DB
:004586BB 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:004586C1 51                      push ecx
:004586C2 8B95E4FEFFFF            mov edx, dword ptr [ebp+FFFFFEE4]
:004586C8 52                      push edx
:004586C9 E82BB0FAFF              call 004036F9
:004586CE 83C408                  add esp, 00000008
:004586D1 8B85D4FEFFFF            mov eax, dword ptr [ebp+FFFFFED4]
:004586D7 25FF000000              and eax, 000000FF
:004586DC 99                      cdq
:004586DD 33C2                    xor eax, edx
:004586DF 2BC2                    sub eax, edx
:004586E1 83E001                  and eax, 00000001
:004586E4 33C2                    xor eax, edx
:004586E6 2BC2                    sub eax, edx
:004586E8 F7D8                    neg eax
:004586EA 1BC0                    sbb eax, eax
:004586EC 2500090000              and eax, 00000900
:004586F1 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:004586F7 03C8                    add ecx, eax
:004586F9 8B85D4FEFFFF            mov eax, dword ptr [ebp+FFFFFED4]
:004586FF 25FF000000              and eax, 000000FF
:00458704 99                      cdq
:00458705 83E203                  and edx, 00000003
:00458708 03C2                    add eax, edx
:0045870A C1F802                  sar eax, 02
:0045870D F7D8                    neg eax
:0045870F 1BC0                    sbb eax, eax
:00458711 2500120000              and eax, 00001200
:00458716 03C8                    add ecx, eax
:00458718 51                      push ecx
:00458719 8A95D8FEFFFF            mov dl, byte ptr [ebp+FFFFFED8]
:0045871F 52                      push edx
:00458720 6A30                    push 00000030
:00458722 6A30                    push 00000030
:00458724 8B85C0FEFFFF            mov eax, dword ptr [ebp+FFFFFEC0]
:0045872A 50                      push eax
:0045872B 8B8DC8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC8]
:00458731 51                      push ecx
:00458732 E8458CFFFF              call 0045137C
:00458737 83C418                  add esp, 00000018
:0045873A E8B75EFCFF              call 0041E5F6
:0045873F 6A02                    push 00000002
:00458741 B9181B4B00              mov ecx, 004B1B18
:00458746 E8F5ABFAFF              call 00403340
:0045874B E8903DFDFF              call 0042C4E0
:00458750 E93EFFFFFF              jmp 00458693

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004586B0(C)
|
:00458755 6A04                    push 00000004
:00458757 6A00                    push 00000000
:00458759 68007B0000              push 00007B00
:0045875E B9C8E44A00              mov ecx, 004AE4C8
:00458763 E8D8720200              call 0047FA40
:00458768 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:0045876E 6800120000              push 00001200
:00458773 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:00458779 52                      push edx
:0045877A 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:00458780 50                      push eax
:00458781 E877750200              call 0047FCFD
:00458786 83C40C                  add esp, 0000000C
:00458789 6A04                    push 00000004
:0045878B 6A00                    push 00000000
:0045878D 6800690000              push 00006900
:00458792 B9C8E44A00              mov ecx, 004AE4C8
:00458797 E8A4720200              call 0047FA40
:0045879C 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:004587A2 6800120000              push 00001200
:004587A7 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:004587AD 81C100120000            add ecx, 00001200
:004587B3 51                      push ecx
:004587B4 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:004587BA 52                      push edx
:004587BB E83D750200              call 0047FCFD
:004587C0 83C40C                  add esp, 0000000C
:004587C3 6A01                    push 00000001

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:004587C5 6A06                    push 00000006
:004587C7 B9B0694B00              mov ecx, 004B69B0
:004587CC E8A9BE0100              call 0047467A
:004587D1 C685D4FEFFFF00          mov byte ptr [ebp+FFFFFED4], 00
:004587D8 EB0E                    jmp 004587E8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00458897(U)
|
:004587DA 8A85D4FEFFFF            mov al, byte ptr [ebp+FFFFFED4]
:004587E0 0401                    add al, 01
:004587E2 8885D4FEFFFF            mov byte ptr [ebp+FFFFFED4], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004587D8(U)
|
:004587E8 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:004587EE 81E1FF000000            and ecx, 000000FF
:004587F4 83F908                  cmp ecx, 00000008
:004587F7 0F8D9F000000            jnl 0045889C
:004587FD E8D95DFCFF              call 0041E5DB
:00458802 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:00458808 52                      push edx
:00458809 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:0045880F 50                      push eax
:00458810 E8E4AEFAFF              call 004036F9
:00458815 83C408                  add esp, 00000008
:00458818 8B85D4FEFFFF            mov eax, dword ptr [ebp+FFFFFED4]
:0045881E 25FF000000              and eax, 000000FF
:00458823 99                      cdq
:00458824 33C2                    xor eax, edx
:00458826 2BC2                    sub eax, edx
:00458828 83E001                  and eax, 00000001
:0045882B 33C2                    xor eax, edx
:0045882D 2BC2                    sub eax, edx
:0045882F F7D8                    neg eax
:00458831 1BC0                    sbb eax, eax
:00458833 2500090000              and eax, 00000900
:00458838 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:0045883E 03C8                    add ecx, eax
:00458840 8B85D4FEFFFF            mov eax, dword ptr [ebp+FFFFFED4]
:00458846 25FF000000              and eax, 000000FF
:0045884B 99                      cdq
:0045884C 83E203                  and edx, 00000003
:0045884F 03C2                    add eax, edx
:00458851 C1F802                  sar eax, 02
:00458854 F7D8                    neg eax
:00458856 1BC0                    sbb eax, eax
:00458858 2500120000              and eax, 00001200
:0045885D 03C8                    add ecx, eax
:0045885F 51                      push ecx
:00458860 8A95D8FEFFFF            mov dl, byte ptr [ebp+FFFFFED8]
:00458866 52                      push edx
:00458867 6A30                    push 00000030
:00458869 6A30                    push 00000030
:0045886B 8B85C0FEFFFF            mov eax, dword ptr [ebp+FFFFFEC0]
:00458871 50                      push eax
:00458872 8B8DC8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC8]
:00458878 51                      push ecx
:00458879 E8FE8AFFFF              call 0045137C
:0045887E 83C418                  add esp, 00000018
:00458881 E8705DFCFF              call 0041E5F6
:00458886 6A02                    push 00000002
:00458888 B9181B4B00              mov ecx, 004B1B18
:0045888D E8AEAAFAFF              call 00403340
:00458892 E8493CFDFF              call 0042C4E0
:00458897 E93EFFFFFF              jmp 004587DA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004587F7(C)
|
:0045889C E938080000              jmp 004590D9

* Possible StringData Ref from Data Obj ->"UNIT_MOV.E5"
                                  |
:004588A1 68E0BB4800              push 0048BBE0
:004588A6 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:004588AC E88472FCFF              call 0041FB35
:004588B1 6A04                    push 00000004
:004588B3 6A00                    push 00000000
:004588B5 6800690000              push 00006900
:004588BA B9C8E44A00              mov ecx, 004AE4C8
:004588BF E87C710200              call 0047FA40
:004588C4 50                      push eax
:004588C5 8B55EC                  mov edx, dword ptr [ebp-14]
:004588C8 81E2FF000000            and edx, 000000FF
:004588CE 52                      push edx
:004588CF 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:004588D5 E8AF73FCFF              call 0041FC89
:004588DA 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:004588E0 E8E009FCFF              call 004192C5
:004588E5 6A04                    push 00000004
:004588E7 6A00                    push 00000000
:004588E9 6800400000              push 00004000
:004588EE B9C8E44A00              mov ecx, 004AE4C8
:004588F3 E848710200              call 0047FA40
:004588F8 8985D0FEFFFF            mov dword ptr [ebp+FFFFFED0], eax
:004588FE 6A04                    push 00000004
:00458900 6A00                    push 00000000
:00458902 6800BA0000              push 0000BA00
:00458907 B9C8E44A00              mov ecx, 004AE4C8
:0045890C E82F710200              call 0047FA40
:00458911 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:00458917 6800120000              push 00001200
:0045891C 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:00458922 50                      push eax
:00458923 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:00458929 51                      push ecx
:0045892A E8CE730200              call 0047FCFD
:0045892F 83C40C                  add esp, 0000000C
:00458932 6A01                    push 00000001
:00458934 6A08                    push 00000008
:00458936 B9B0694B00              mov ecx, 004B69B0
:0045893B E83ABD0100              call 0047467A
:00458940 C685D4FEFFFF00          mov byte ptr [ebp+FFFFFED4], 00
:00458947 EB0F                    jmp 00458958

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004589E7(U)
|
:00458949 8A95D4FEFFFF            mov dl, byte ptr [ebp+FFFFFED4]
:0045894F 80C201                  add dl, 01
:00458952 8895D4FEFFFF            mov byte ptr [ebp+FFFFFED4], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00458947(U)
|
:00458958 8B85D4FEFFFF            mov eax, dword ptr [ebp+FFFFFED4]
:0045895E 25FF000000              and eax, 000000FF
:00458963 83F806                  cmp eax, 00000006
:00458966 0F8D80000000            jnl 004589EC
:0045896C E86A5CFCFF              call 0041E5DB
:00458971 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:00458977 51                      push ecx
:00458978 8B95E4FEFFFF            mov edx, dword ptr [ebp+FFFFFEE4]
:0045897E 52                      push edx
:0045897F E875ADFAFF              call 004036F9
:00458984 83C408                  add esp, 00000008
:00458987 8B85D4FEFFFF            mov eax, dword ptr [ebp+FFFFFED4]
:0045898D 25FF000000              and eax, 000000FF
:00458992 99                      cdq
:00458993 33C2                    xor eax, edx
:00458995 2BC2                    sub eax, edx
:00458997 83E001                  and eax, 00000001
:0045899A 33C2                    xor eax, edx
:0045899C 2BC2                    sub eax, edx
:0045899E F7D8                    neg eax
:004589A0 1BC0                    sbb eax, eax
:004589A2 2500090000              and eax, 00000900
:004589A7 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:004589AD 03C8                    add ecx, eax
:004589AF 51                      push ecx
:004589B0 8A95D8FEFFFF            mov dl, byte ptr [ebp+FFFFFED8]
:004589B6 52                      push edx
:004589B7 6A30                    push 00000030
:004589B9 6A30                    push 00000030
:004589BB 8B85C0FEFFFF            mov eax, dword ptr [ebp+FFFFFEC0]
:004589C1 50                      push eax
:004589C2 8B8DC8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC8]
:004589C8 51                      push ecx
:004589C9 E8AE89FFFF              call 0045137C
:004589CE 83C418                  add esp, 00000018
:004589D1 E8205CFCFF              call 0041E5F6
:004589D6 6A08                    push 00000008
:004589D8 B9181B4B00              mov ecx, 004B1B18
:004589DD E85EA9FAFF              call 00403340
:004589E2 E8F93AFDFF              call 0042C4E0
:004589E7 E95DFFFFFF              jmp 00458949

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00458966(C)
|
:004589EC E9E8060000              jmp 004590D9

* Possible StringData Ref from Data Obj ->"UNIT_SPC.E5"
                                  |
:004589F1 68D0BB4800              push 0048BBD0
:004589F6 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:004589FC E83471FCFF              call 0041FB35
:00458A01 6A04                    push 00000004
:00458A03 6A00                    push 00000000
:00458A05 6800690000              push 00006900
:00458A0A B9C8E44A00              mov ecx, 004AE4C8
:00458A0F E82C700200              call 0047FA40
:00458A14 50                      push eax
:00458A15 8B55EC                  mov edx, dword ptr [ebp-14]
:00458A18 81E2FF000000            and edx, 000000FF
:00458A1E 52                      push edx
:00458A1F 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:00458A25 E85F72FCFF              call 0041FC89
:00458A2A 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:00458A30 E89008FCFF              call 004192C5
:00458A35 6A04                    push 00000004
:00458A37 6A00                    push 00000000
:00458A39 6800400000              push 00004000
:00458A3E B9C8E44A00              mov ecx, 004AE4C8
:00458A43 E8F86F0200              call 0047FA40
:00458A48 8985D0FEFFFF            mov dword ptr [ebp+FFFFFED0], eax
:00458A4E 6A04                    push 00000004
:00458A50 6A00                    push 00000000
:00458A52 6800840000              push 00008400
:00458A57 B9C8E44A00              mov ecx, 004AE4C8
:00458A5C E8DF6F0200              call 0047FA40
:00458A61 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:00458A67 6800090000              push 00000900
:00458A6C 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:00458A72 50                      push eax
:00458A73 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:00458A79 51                      push ecx
:00458A7A E87E720200              call 0047FCFD
:00458A7F 83C40C                  add esp, 0000000C
:00458A82 6A01                    push 00000001
:00458A84 6A08                    push 00000008
:00458A86 B9B0694B00              mov ecx, 004B69B0
:00458A8B E8EABB0100              call 0047467A
:00458A90 E8465BFCFF              call 0041E5DB
:00458A95 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:00458A9B 52                      push edx
:00458A9C 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:00458AA2 50                      push eax
:00458AA3 E851ACFAFF              call 004036F9
:00458AA8 83C408                  add esp, 00000008
:00458AAB 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:00458AB1 81E1FF000000            and ecx, 000000FF
:00458AB7 51                      push ecx
:00458AB8 8B95C0FEFFFF            mov edx, dword ptr [ebp+FFFFFEC0]
:00458ABE 52                      push edx
:00458ABF 8B85C8FEFFFF            mov eax, dword ptr [ebp+FFFFFEC8]
:00458AC5 50                      push eax
:00458AC6 E85460FEFF              call 0043EB1F
:00458ACB 83C40C                  add esp, 0000000C
:00458ACE E8235BFCFF              call 0041E5F6
:00458AD3 6A02                    push 00000002
:00458AD5 B9181B4B00              mov ecx, 004B1B18
:00458ADA E861A8FAFF              call 00403340
:00458ADF E8FC39FDFF              call 0042C4E0
:00458AE4 E8F25AFCFF              call 0041E5DB
:00458AE9 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:00458AEF 51                      push ecx
:00458AF0 8B95E4FEFFFF            mov edx, dword ptr [ebp+FFFFFEE4]
:00458AF6 52                      push edx
:00458AF7 E8FDABFAFF              call 004036F9
:00458AFC 83C408                  add esp, 00000008
:00458AFF 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:00458B05 50                      push eax
:00458B06 8A8DD8FEFFFF            mov cl, byte ptr [ebp+FFFFFED8]
:00458B0C 51                      push ecx
:00458B0D 6A30                    push 00000030
:00458B0F 6A30                    push 00000030
:00458B11 8B95C0FEFFFF            mov edx, dword ptr [ebp+FFFFFEC0]
:00458B17 83EA04                  sub edx, 00000004
:00458B1A 52                      push edx
:00458B1B 8B85C8FEFFFF            mov eax, dword ptr [ebp+FFFFFEC8]
:00458B21 50                      push eax
:00458B22 E85588FFFF              call 0045137C
:00458B27 83C418                  add esp, 00000018
:00458B2A E8C75AFCFF              call 0041E5F6
:00458B2F 6A03                    push 00000003
:00458B31 B9181B4B00              mov ecx, 004B1B18
:00458B36 E805A8FAFF              call 00403340
:00458B3B E8A039FDFF              call 0042C4E0
:00458B40 E8965AFCFF              call 0041E5DB
:00458B45 6A03                    push 00000003
:00458B47 6A03                    push 00000003
:00458B49 6A01                    push 00000001
:00458B4B 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:00458B51 51                      push ecx
:00458B52 E8476F0200              call 0047FA9E
:00458B57 83C408                  add esp, 00000008
:00458B5A 50                      push eax
:00458B5B 6A01                    push 00000001
:00458B5D 8B95E4FEFFFF            mov edx, dword ptr [ebp+FFFFFEE4]
:00458B63 52                      push edx
:00458B64 E8356F0200              call 0047FA9E
:00458B69 83C408                  add esp, 00000008
:00458B6C 50                      push eax
:00458B6D B950424B00              mov ecx, 004B4250
:00458B72 E81896FFFF              call 0045218F
:00458B77 8B85D8FEFFFF            mov eax, dword ptr [ebp+FFFFFED8]
:00458B7D 25FF000000              and eax, 000000FF
:00458B82 50                      push eax
:00458B83 8B8DC0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC0]
:00458B89 51                      push ecx
:00458B8A 8B95C8FEFFFF            mov edx, dword ptr [ebp+FFFFFEC8]
:00458B90 52                      push edx
:00458B91 E8895FFEFF              call 0043EB1F
:00458B96 83C40C                  add esp, 0000000C
:00458B99 E8585AFCFF              call 0041E5F6
:00458B9E E936050000              jmp 004590D9

* Possible StringData Ref from Data Obj ->"UNIT_MOV.E5"
                                  |
:00458BA3 68E0BB4800              push 0048BBE0
:00458BA8 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:00458BAE E8826FFCFF              call 0041FB35
:00458BB3 6A04                    push 00000004
:00458BB5 6A00                    push 00000000
:00458BB7 6800690000              push 00006900
:00458BBC B9C8E44A00              mov ecx, 004AE4C8
:00458BC1 E87A6E0200              call 0047FA40
:00458BC6 50                      push eax
:00458BC7 8B45EC                  mov eax, dword ptr [ebp-14]
:00458BCA 25FF000000              and eax, 000000FF
:00458BCF 50                      push eax
:00458BD0 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:00458BD6 E8AE70FCFF              call 0041FC89
:00458BDB 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:00458BE1 E8DF06FCFF              call 004192C5
:00458BE6 6A04                    push 00000004
:00458BE8 6A00                    push 00000000
:00458BEA 6A00                    push 00000000
:00458BEC B9C8E44A00              mov ecx, 004AE4C8
:00458BF1 E84A6E0200              call 0047FA40
:00458BF6 8985D0FEFFFF            mov dword ptr [ebp+FFFFFED0], eax
:00458BFC 6A04                    push 00000004
:00458BFE 6A00                    push 00000000
:00458C00 68009F0000              push 00009F00
:00458C05 B9C8E44A00              mov ecx, 004AE4C8
:00458C0A E8316E0200              call 0047FA40
:00458C0F 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:00458C15 6800090000              push 00000900
:00458C1A 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00458C20 51                      push ecx
:00458C21 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:00458C27 52                      push edx
:00458C28 E8D0700200              call 0047FCFD
:00458C2D 83C40C                  add esp, 0000000C
:00458C30 6A04                    push 00000004
:00458C32 6A00                    push 00000000
:00458C34 6800100000              push 00001000
:00458C39 B9C8E44A00              mov ecx, 004AE4C8
:00458C3E E8FD6D0200              call 0047FA40
:00458C43 8985D0FEFFFF            mov dword ptr [ebp+FFFFFED0], eax
:00458C49 6A04                    push 00000004
:00458C4B 6A00                    push 00000000
:00458C4D 6800B10000              push 0000B100
:00458C52 B9C8E44A00              mov ecx, 004AE4C8
:00458C57 E8E46D0200              call 0047FA40
:00458C5C 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:00458C62 6800090000              push 00000900
:00458C67 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:00458C6D 50                      push eax
:00458C6E 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:00458C74 51                      push ecx
:00458C75 E883700200              call 0047FCFD
:00458C7A 83C40C                  add esp, 0000000C
:00458C7D 6A04                    push 00000004
:00458C7F 6A00                    push 00000000
:00458C81 6800200000              push 00002000
:00458C86 B9C8E44A00              mov ecx, 004AE4C8
:00458C8B E8B06D0200              call 0047FA40
:00458C90 8985D0FEFFFF            mov dword ptr [ebp+FFFFFED0], eax
:00458C96 6A04                    push 00000004
:00458C98 6A00                    push 00000000
:00458C9A 6800A80000              push 0000A800
:00458C9F B9C8E44A00              mov ecx, 004AE4C8
:00458CA4 E8976D0200              call 0047FA40
:00458CA9 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:00458CAF 6800090000              push 00000900
:00458CB4 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:00458CBA 52                      push edx
:00458CBB 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:00458CC1 50                      push eax
:00458CC2 E836700200              call 0047FCFD
:00458CC7 83C40C                  add esp, 0000000C
:00458CCA 6A04                    push 00000004
:00458CCC 6A00                    push 00000000
:00458CCE 6800300000              push 00003000
:00458CD3 B9C8E44A00              mov ecx, 004AE4C8
:00458CD8 E8636D0200              call 0047FA40
:00458CDD 8985D0FEFFFF            mov dword ptr [ebp+FFFFFED0], eax
:00458CE3 6A04                    push 00000004
:00458CE5 6A00                    push 00000000
:00458CE7 6800B10000              push 0000B100
:00458CEC B9C8E44A00              mov ecx, 004AE4C8
:00458CF1 E84A6D0200              call 0047FA40
:00458CF6 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:00458CFC 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00458D02 51                      push ecx
:00458D03 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:00458D09 52                      push edx
:00458D0A 6A30                    push 00000030
:00458D0C 6A30                    push 00000030
:00458D0E E84061FCFF              call 0041EE53
:00458D13 83C410                  add esp, 00000010

* Possible StringData Ref from Data Obj ->"UNIT_SPC.E5"
                                  |
:00458D16 68D0BB4800              push 0048BBD0
:00458D1B 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:00458D21 E80F6EFCFF              call 0041FB35
:00458D26 6A04                    push 00000004
:00458D28 6A00                    push 00000000
:00458D2A 6800690000              push 00006900
:00458D2F B9C8E44A00              mov ecx, 004AE4C8
:00458D34 E8076D0200              call 0047FA40
:00458D39 50                      push eax
:00458D3A 8B45EC                  mov eax, dword ptr [ebp-14]
:00458D3D 25FF000000              and eax, 000000FF
:00458D42 50                      push eax
:00458D43 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:00458D49 E83B6FFCFF              call 0041FC89
:00458D4E 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:00458D54 E86C05FCFF              call 004192C5
:00458D59 6A04                    push 00000004
:00458D5B 6A00                    push 00000000
:00458D5D 6800400000              push 00004000
:00458D62 B9C8E44A00              mov ecx, 004AE4C8
:00458D67 E8D46C0200              call 0047FA40
:00458D6C 8985D0FEFFFF            mov dword ptr [ebp+FFFFFED0], eax
:00458D72 6A04                    push 00000004
:00458D74 6A00                    push 00000000
:00458D76 68008D0000              push 00008D00
:00458D7B B9C8E44A00              mov ecx, 004AE4C8
:00458D80 E8BB6C0200              call 0047FA40
:00458D85 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:00458D8B 6800090000              push 00000900
:00458D90 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00458D96 51                      push ecx
:00458D97 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:00458D9D 52                      push edx
:00458D9E E85A6F0200              call 0047FCFD
:00458DA3 83C40C                  add esp, 0000000C
:00458DA6 C685D4FEFFFF00          mov byte ptr [ebp+FFFFFED4], 00
:00458DAD EB0E                    jmp 00458DBD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00458E53(U)
|
:00458DAF 8A85D4FEFFFF            mov al, byte ptr [ebp+FFFFFED4]
:00458DB5 0401                    add al, 01
:00458DB7 8885D4FEFFFF            mov byte ptr [ebp+FFFFFED4], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00458DAD(U)
|
:00458DBD 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:00458DC3 81E1FF000000            and ecx, 000000FF
:00458DC9 83F908                  cmp ecx, 00000008
:00458DCC 0F8F86000000            jg 00458E58
:00458DD2 E80458FCFF              call 0041E5DB
:00458DD7 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:00458DDD 52                      push edx
:00458DDE 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:00458DE4 50                      push eax
:00458DE5 E80FA9FAFF              call 004036F9
:00458DEA 83C408                  add esp, 00000008
:00458DED 6A04                    push 00000004
:00458DEF 6A00                    push 00000000
:00458DF1 6A00                    push 00000000
:00458DF3 B9C8E44A00              mov ecx, 004AE4C8
:00458DF8 E8436C0200              call 0047FA40
:00458DFD 8BC8                    mov ecx, eax
:00458DFF 8B85D4FEFFFF            mov eax, dword ptr [ebp+FFFFFED4]
:00458E05 25FF000000              and eax, 000000FF
:00458E0A 99                      cdq
:00458E0B 33C2                    xor eax, edx
:00458E0D 2BC2                    sub eax, edx
:00458E0F 83E003                  and eax, 00000003
:00458E12 33C2                    xor eax, edx
:00458E14 2BC2                    sub eax, edx
:00458E16 C1E00C                  shl eax, 0C
:00458E19 03C8                    add ecx, eax
:00458E1B 51                      push ecx
:00458E1C 8A95D8FEFFFF            mov dl, byte ptr [ebp+FFFFFED8]
:00458E22 52                      push edx
:00458E23 6A30                    push 00000030
:00458E25 6A30                    push 00000030
:00458E27 8B85C0FEFFFF            mov eax, dword ptr [ebp+FFFFFEC0]
:00458E2D 50                      push eax
:00458E2E 8B8DC8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC8]
:00458E34 51                      push ecx
:00458E35 E84285FFFF              call 0045137C
:00458E3A 83C418                  add esp, 00000018
:00458E3D E8B457FCFF              call 0041E5F6
:00458E42 6A02                    push 00000002
:00458E44 B9181B4B00              mov ecx, 004B1B18
:00458E49 E8F2A4FAFF              call 00403340
:00458E4E E88D36FDFF              call 0042C4E0
:00458E53 E957FFFFFF              jmp 00458DAF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00458DCC(C)
|
:00458E58 E87E57FCFF              call 0041E5DB
:00458E5D 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:00458E63 52                      push edx
:00458E64 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:00458E6A 50                      push eax
:00458E6B E889A8FAFF              call 004036F9
:00458E70 83C408                  add esp, 00000008
:00458E73 6A04                    push 00000004
:00458E75 6A00                    push 00000000
:00458E77 6800400000              push 00004000
:00458E7C B9C8E44A00              mov ecx, 004AE4C8
:00458E81 E8BA6B0200              call 0047FA40
:00458E86 50                      push eax
:00458E87 8A8DD8FEFFFF            mov cl, byte ptr [ebp+FFFFFED8]
:00458E8D 51                      push ecx
:00458E8E 6A30                    push 00000030
:00458E90 6A30                    push 00000030
:00458E92 8B95C0FEFFFF            mov edx, dword ptr [ebp+FFFFFEC0]
:00458E98 52                      push edx
:00458E99 8B85C8FEFFFF            mov eax, dword ptr [ebp+FFFFFEC8]
:00458E9F 50                      push eax
:00458EA0 E8D784FFFF              call 0045137C
:00458EA5 83C418                  add esp, 00000018
:00458EA8 E84957FCFF              call 0041E5F6
:00458EAD E927020000              jmp 004590D9

* Possible StringData Ref from Data Obj ->"UNIT_MOV.E5"
                                  |
:00458EB2 68E0BB4800              push 0048BBE0
:00458EB7 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:00458EBD E8736CFCFF              call 0041FB35
:00458EC2 6A04                    push 00000004
:00458EC4 6A00                    push 00000000
:00458EC6 6800690000              push 00006900
:00458ECB B9C8E44A00              mov ecx, 004AE4C8
:00458ED0 E86B6B0200              call 0047FA40
:00458ED5 50                      push eax
:00458ED6 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00458ED9 81E1FF000000            and ecx, 000000FF
:00458EDF 51                      push ecx
:00458EE0 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:00458EE6 E89E6DFCFF              call 0041FC89
:00458EEB 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:00458EF1 E8CF03FCFF              call 004192C5
:00458EF6 6A04                    push 00000004
:00458EF8 6A00                    push 00000000
:00458EFA 6A00                    push 00000000
:00458EFC B9C8E44A00              mov ecx, 004AE4C8
:00458F01 E83A6B0200              call 0047FA40
:00458F06 8985D0FEFFFF            mov dword ptr [ebp+FFFFFED0], eax
:00458F0C 6A04                    push 00000004
:00458F0E 6A00                    push 00000000
:00458F10 68009F0000              push 00009F00
:00458F15 B9C8E44A00              mov ecx, 004AE4C8
:00458F1A E8216B0200              call 0047FA40
:00458F1F 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:00458F25 6800090000              push 00000900
:00458F2A 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:00458F30 52                      push edx
:00458F31 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:00458F37 50                      push eax
:00458F38 E8C06D0200              call 0047FCFD
:00458F3D 83C40C                  add esp, 0000000C
:00458F40 6A04                    push 00000004
:00458F42 6A00                    push 00000000
:00458F44 6800100000              push 00001000
:00458F49 B9C8E44A00              mov ecx, 004AE4C8
:00458F4E E8ED6A0200              call 0047FA40
:00458F53 8985D0FEFFFF            mov dword ptr [ebp+FFFFFED0], eax
:00458F59 6A04                    push 00000004
:00458F5B 6A00                    push 00000000
:00458F5D 6800B10000              push 0000B100
:00458F62 B9C8E44A00              mov ecx, 004AE4C8
:00458F67 E8D46A0200              call 0047FA40
:00458F6C 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:00458F72 6800090000              push 00000900
:00458F77 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00458F7D 51                      push ecx
:00458F7E 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:00458F84 52                      push edx
:00458F85 E8736D0200              call 0047FCFD
:00458F8A 83C40C                  add esp, 0000000C
:00458F8D 6A04                    push 00000004
:00458F8F 6A00                    push 00000000
:00458F91 6800200000              push 00002000
:00458F96 B9C8E44A00              mov ecx, 004AE4C8
:00458F9B E8A06A0200              call 0047FA40
:00458FA0 8985D0FEFFFF            mov dword ptr [ebp+FFFFFED0], eax
:00458FA6 6A04                    push 00000004
:00458FA8 6A00                    push 00000000
:00458FAA 6800A80000              push 0000A800
:00458FAF B9C8E44A00              mov ecx, 004AE4C8
:00458FB4 E8876A0200              call 0047FA40
:00458FB9 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:00458FBF 6800090000              push 00000900
:00458FC4 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:00458FCA 50                      push eax
:00458FCB 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:00458FD1 51                      push ecx
:00458FD2 E8266D0200              call 0047FCFD
:00458FD7 83C40C                  add esp, 0000000C
:00458FDA 6A04                    push 00000004
:00458FDC 6A00                    push 00000000
:00458FDE 6800300000              push 00003000
:00458FE3 B9C8E44A00              mov ecx, 004AE4C8
:00458FE8 E8536A0200              call 0047FA40
:00458FED 8985D0FEFFFF            mov dword ptr [ebp+FFFFFED0], eax
:00458FF3 6A04                    push 00000004
:00458FF5 6A00                    push 00000000
:00458FF7 6800B10000              push 0000B100
:00458FFC B9C8E44A00              mov ecx, 004AE4C8
:00459001 E83A6A0200              call 0047FA40
:00459006 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:0045900C 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:00459012 52                      push edx
:00459013 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:00459019 50                      push eax
:0045901A 6A30                    push 00000030
:0045901C 6A30                    push 00000030
:0045901E E8305EFCFF              call 0041EE53
:00459023 83C410                  add esp, 00000010
:00459026 C685D4FEFFFF00          mov byte ptr [ebp+FFFFFED4], 00
:0045902D EB0F                    jmp 0045903E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004590D4(U)
|
:0045902F 8A8DD4FEFFFF            mov cl, byte ptr [ebp+FFFFFED4]
:00459035 80C101                  add cl, 01
:00459038 888DD4FEFFFF            mov byte ptr [ebp+FFFFFED4], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045902D(U)
|
:0045903E 8B95D4FEFFFF            mov edx, dword ptr [ebp+FFFFFED4]
:00459044 81E2FF000000            and edx, 000000FF
:0045904A 83FA04                  cmp edx, 00000004
:0045904D 0F8F86000000            jg 004590D9
:00459053 E88355FCFF              call 0041E5DB
:00459058 8B85DCFEFFFF            mov eax, dword ptr [ebp+FFFFFEDC]
:0045905E 50                      push eax
:0045905F 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:00459065 51                      push ecx
:00459066 E88EA6FAFF              call 004036F9
:0045906B 83C408                  add esp, 00000008
:0045906E 6A04                    push 00000004
:00459070 6A00                    push 00000000
:00459072 6A00                    push 00000000
:00459074 B9C8E44A00              mov ecx, 004AE4C8
:00459079 E8C2690200              call 0047FA40
:0045907E 8BC8                    mov ecx, eax
:00459080 8B85D4FEFFFF            mov eax, dword ptr [ebp+FFFFFED4]
:00459086 25FF000000              and eax, 000000FF
:0045908B 99                      cdq
:0045908C 33C2                    xor eax, edx
:0045908E 2BC2                    sub eax, edx
:00459090 83E003                  and eax, 00000003
:00459093 33C2                    xor eax, edx
:00459095 2BC2                    sub eax, edx
:00459097 C1E00C                  shl eax, 0C
:0045909A 03C8                    add ecx, eax
:0045909C 51                      push ecx
:0045909D 8A95D8FEFFFF            mov dl, byte ptr [ebp+FFFFFED8]
:004590A3 52                      push edx
:004590A4 6A30                    push 00000030
:004590A6 6A30                    push 00000030
:004590A8 8B85C0FEFFFF            mov eax, dword ptr [ebp+FFFFFEC0]
:004590AE 50                      push eax
:004590AF 8B8DC8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC8]
:004590B5 51                      push ecx
:004590B6 E8C182FFFF              call 0045137C
:004590BB 83C418                  add esp, 00000018
:004590BE E83355FCFF              call 0041E5F6
:004590C3 6A02                    push 00000002
:004590C5 B9181B4B00              mov ecx, 004B1B18
:004590CA E871A2FAFF              call 00403340
:004590CF E80C34FDFF              call 0042C4E0
:004590D4 E956FFFFFF              jmp 0045902F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045798C(C), :004579D1(U), :00457ABD(U), :00457C79(U), :00457D64(U)
|:00457E4F(U), :0045800D(U), :0045829B(U), :004585B2(U), :0045889C(U)
|:004589EC(U), :00458B9E(U), :00458EAD(U), :0045904D(C)
|
:004590D9 837D1400                cmp dword ptr [ebp+14], 00000000
:004590DD 742B                    je 0045910A
:004590DF 8B550C                  mov edx, dword ptr [ebp+0C]
:004590E2 81E2FF000000            and edx, 000000FF
:004590E8 85D2                    test edx, edx
:004590EA 741E                    je 0045910A
:004590EC 8B450C                  mov eax, dword ptr [ebp+0C]
:004590EF 25FF000000              and eax, 000000FF
:004590F4 83F80B                  cmp eax, 0000000B
:004590F7 7411                    je 0045910A
:004590F9 6A08                    push 00000008
:004590FB B9181B4B00              mov ecx, 004B1B18
:00459100 E83BA2FAFF              call 00403340
:00459105 E8D633FDFF              call 0042C4E0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00457869(C), :0045787F(C), :004590DD(C), :004590EA(C), :004590F7(C)
|
:0045910A C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00459111 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:00459117 E8B4A1FAFF              call 004032D0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004577F3(U)
|
:0045911C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0045911F 64890D00000000          mov dword ptr fs:[00000000], ecx
:00459126 5E                      pop esi
:00459127 8BE5                    mov esp, ebp
:00459129 5D                      pop ebp
:0045912A C21000                  ret 0010



:0045912D 9F794500                DWORD 0045799F
:00459131 D6794500                DWORD 004579D6
:00459135 C27A4500                DWORD 00457AC2
:00459139 7E7C4500                DWORD 00457C7E
:0045913D 697D4500                DWORD 00457D69
:00459141 547E4500                DWORD 00457E54
:00459145 12804500                DWORD 00458012
:00459149 A0824500                DWORD 004582A0
:0045914D B7854500                DWORD 004585B7
:00459151 A1884500                DWORD 004588A1
:00459155 F1894500                DWORD 004589F1
:00459159 A38B4500                DWORD 00458BA3
:0045915D B28E4500                DWORD 00458EB2
:00459161 4B7B4500                DWORD 00457B4B
:00459165 847B4500                DWORD 00457B84
:00459169 EF7B4500                DWORD 00457BEF
:0045916D B97B4500                DWORD 00457BB9
:00459171 D97E4500                DWORD 00457ED9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045912E(C)
|
:00459175 127F4500                DWORD 00457F12

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00459132(C)
|
:00459179 7D7F4500                DWORD 00457F7D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00459136(C)
|
:0045917D 477F4500                DWORD 00457F47
:00459181 97804500                DWORD 00458097
:00459185 D0804500                DWORD 004580D0
:00459189 3E814500                DWORD 0045813E
:0045918D 08814500                DWORD 00458108
:00459191 25834500                DWORD 00458325
:00459195 5E834500                DWORD 0045835E
:00459199 CC834500                DWORD 004583CC
:0045919D 96834500                DWORD 00458396



* Referenced by a CALL at Address:
|:00415AC2   
|
:004591A1 55                      push ebp
:004591A2 8BEC                    mov ebp, esp
:004591A4 83EC3C                  sub esp, 0000003C
:004591A7 894DC4                  mov dword ptr [ebp-3C], ecx
:004591AA C745F4FFFFFFFF          mov [ebp-0C], FFFFFFFF
:004591B1 C645FCFF                mov [ebp-04], FF
:004591B5 817D0800020000          cmp dword ptr [ebp+08], 00000200
:004591BC 7208                    jb 004591C6
:004591BE 83C8FF                  or eax, FFFFFFFF
:004591C1 E9BB020000              jmp 00459481

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004591BC(C)
|
:004591C6 8B4508                  mov eax, dword ptr [ebp+08]
:004591C9 50                      push eax
:004591CA E8AACEFFFF              call 00456079
:004591CF 83C404                  add esp, 00000004
:004591D2 8945EC                  mov dword ptr [ebp-14], eax
:004591D5 837DECFF                cmp dword ptr [ebp-14], FFFFFFFF
:004591D9 0F8483020000            je 00459462
:004591DF 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004591E2 E8A9FAFBFF              call 00418C90
:004591E7 25FF000000              and eax, 000000FF
:004591EC 83F803                  cmp eax, 00000003
:004591EF 0F8566020000            jne 0045945B
:004591F5 C745E800000000          mov [ebp-18], 00000000
:004591FC EB09                    jmp 00459207

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00459236(U)
|
:004591FE 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00459201 83C101                  add ecx, 00000001
:00459204 894DE8                  mov dword ptr [ebp-18], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004591FC(U)
|
:00459207 837DE873                cmp dword ptr [ebp-18], 00000073
:0045920B 732B                    jnb 00459238
:0045920D 8B55E8                  mov edx, dword ptr [ebp-18]
:00459210 52                      push edx
:00459211 B9902F4900              mov ecx, 00492F90
:00459216 E8B5FBFBFF              call 00418DD0
:0045921B 8945F0                  mov dword ptr [ebp-10], eax
:0045921E 8B45F0                  mov eax, dword ptr [ebp-10]
:00459221 8945F8                  mov dword ptr [ebp-08], eax
:00459224 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00459227 8B11                    mov edx, dword ptr [ecx]
:00459229 3B5508                  cmp edx, dword ptr [ebp+08]
:0045922C 7508                    jne 00459236
:0045922E 8A45E8                  mov al, byte ptr [ebp-18]
:00459231 8845FC                  mov byte ptr [ebp-04], al
:00459234 EB02                    jmp 00459238

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045922C(C)
|
:00459236 EBC6                    jmp 004591FE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045920B(C), :00459234(U)
|
:00459238 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045923B 81E1FF000000            and ecx, 000000FF
:00459241 81F9FF000000            cmp ecx, 000000FF
:00459247 0F8405020000            je 00459452
:0045924D 8B55F8                  mov edx, dword ptr [ebp-08]
:00459250 8B4208                  mov eax, dword ptr [edx+08]
:00459253 2483                    and al, 83
:00459255 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00459258 894108                  mov dword ptr [ecx+08], eax
:0045925B 8A5514                  mov dl, byte ptr [ebp+14]
:0045925E 52                      push edx
:0045925F E8C308FFFF              call 00449B27
:00459264 83C404                  add esp, 00000004
:00459267 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045926A 8B5108                  mov edx, dword ptr [ecx+08]
:0045926D 0BD0                    or edx, eax
:0045926F 8B45F8                  mov eax, dword ptr [ebp-08]
:00459272 895008                  mov dword ptr [eax+08], edx
:00459275 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00459278 51                      push ecx
:00459279 E843E1FFFF              call 004573C1
:0045927E 83C404                  add esp, 00000004
:00459281 85C0                    test eax, eax
:00459283 0F8473010000            je 004593FC
:00459289 8A5510                  mov dl, byte ptr [ebp+10]
:0045928C 52                      push edx
:0045928D 8A450C                  mov al, byte ptr [ebp+0C]
:00459290 50                      push eax
:00459291 B950424B00              mov ecx, 004B4250
:00459296 E8A4BDFFFF              call 0045503F
:0045929B E83B53FCFF              call 0041E5DB
:004592A0 8A4D10                  mov cl, byte ptr [ebp+10]
:004592A3 51                      push ecx
:004592A4 8A550C                  mov dl, byte ptr [ebp+0C]
:004592A7 52                      push edx
:004592A8 8B45F8                  mov eax, dword ptr [ebp-08]
:004592AB 8B4808                  mov ecx, dword ptr [eax+08]
:004592AE 51                      push ecx
:004592AF 8B5508                  mov edx, dword ptr [ebp+08]
:004592B2 52                      push edx
:004592B3 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004592B6 E89194FEFF              call 0044274C
:004592BB 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004592BE E89DA0FAFF              call 00403360
:004592C3 668B00                  mov ax, word ptr [eax]
:004592C6 668945D0                mov word ptr [ebp-30], ax
:004592CA 668B4DD0                mov cx, word ptr [ebp-30]
:004592CE 51                      push ecx
:004592CF E8AA67FFFF              call 0044FA7E
:004592D4 83C404                  add esp, 00000004
:004592D7 8945C8                  mov dword ptr [ebp-38], eax
:004592DA 8955CC                  mov dword ptr [ebp-34], edx
:004592DD 8B55C8                  mov edx, dword ptr [ebp-38]
:004592E0 8955D4                  mov dword ptr [ebp-2C], edx
:004592E3 8B45CC                  mov eax, dword ptr [ebp-34]
:004592E6 8945D8                  mov dword ptr [ebp-28], eax
:004592E9 668B4DD0                mov cx, word ptr [ebp-30]
:004592ED 51                      push ecx
:004592EE 8D55DC                  lea edx, dword ptr [ebp-24]
:004592F1 52                      push edx
:004592F2 E82867FFFF              call 0044FA1F
:004592F7 83C408                  add esp, 00000008
:004592FA 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004592FD E8AE2FFCFF              call 0041C2B0
:00459302 25FF000000              and eax, 000000FF
:00459307 50                      push eax
:00459308 E86552FEFF              call 0043E572
:0045930D 83C404                  add esp, 00000004
:00459310 8945E4                  mov dword ptr [ebp-1C], eax
:00459313 6A01                    push 00000001
:00459315 6A2A                    push 0000002A
:00459317 B9B0694B00              mov ecx, 004B69B0
:0045931C E859B30100              call 0047467A
:00459321 C745E004000000          mov [ebp-20], 00000004
:00459328 EB09                    jmp 00459333

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004593F5(U)
|
:0045932A 8B45E0                  mov eax, dword ptr [ebp-20]
:0045932D 83C004                  add eax, 00000004
:00459330 8945E0                  mov dword ptr [ebp-20], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00459328(U)
|
:00459333 837DE030                cmp dword ptr [ebp-20], 00000030
:00459337 0F87BD000000            ja 004593FA
:0045933D 6A00                    push 00000000
:0045933F 6800090000              push 00000900
:00459344 B9C8E44A00              mov ecx, 004AE4C8
:00459349 E8424DFBFF              call 0040E090
:0045934E 50                      push eax
:0045934F E8BF690200              call 0047FD13
:00459354 83C40C                  add esp, 0000000C
:00459357 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0045935A 6BC930                  imul ecx, 00000030
:0045935D 51                      push ecx
:0045935E 6A04                    push 00000004
:00459360 6A00                    push 00000000
:00459362 BA30000000              mov edx, 00000030
:00459367 2B55E0                  sub edx, dword ptr [ebp-20]
:0045936A 6BD230                  imul edx, 00000030
:0045936D 52                      push edx
:0045936E B9C8E44A00              mov ecx, 004AE4C8
:00459373 E8C8660200              call 0047FA40
:00459378 50                      push eax
:00459379 8B45E4                  mov eax, dword ptr [ebp-1C]
:0045937C 50                      push eax
:0045937D E87B690200              call 0047FCFD
:00459382 83C40C                  add esp, 0000000C
:00459385 E85152FCFF              call 0041E5DB
:0045938A 8B4DDD                  mov ecx, dword ptr [ebp-23]
:0045938D 81E1FF000000            and ecx, 000000FF
:00459393 51                      push ecx
:00459394 8B55DC                  mov edx, dword ptr [ebp-24]
:00459397 81E2FF000000            and edx, 000000FF
:0045939D 52                      push edx
:0045939E E856A3FAFF              call 004036F9
:004593A3 83C408                  add esp, 00000008
:004593A6 6A04                    push 00000004
:004593A8 6A00                    push 00000000
:004593AA 6A00                    push 00000000
:004593AC B9C8E44A00              mov ecx, 004AE4C8
:004593B1 E88A660200              call 0047FA40
:004593B6 50                      push eax
:004593B7 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004593BA E8F12EFCFF              call 0041C2B0
:004593BF 50                      push eax
:004593C0 6A30                    push 00000030
:004593C2 6A30                    push 00000030
:004593C4 8B45D8                  mov eax, dword ptr [ebp-28]
:004593C7 50                      push eax
:004593C8 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:004593CB 51                      push ecx
:004593CC E8AB7FFFFF              call 0045137C
:004593D1 83C418                  add esp, 00000018
:004593D4 E81D52FCFF              call 0041E5F6
:004593D9 837DE004                cmp dword ptr [ebp-20], 00000004
:004593DD 7505                    jne 004593E4
:004593DF E81252FCFF              call 0041E5F6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004593DD(C)
|
:004593E4 6A01                    push 00000001
:004593E6 B9181B4B00              mov ecx, 004B1B18
:004593EB E8509FFAFF              call 00403340
:004593F0 E8EB30FDFF              call 0042C4E0
:004593F5 E930FFFFFF              jmp 0045932A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00459337(C)
|
:004593FA EB43                    jmp 0045943F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00459283(C)
|
:004593FC 8A5510                  mov dl, byte ptr [ebp+10]
:004593FF 52                      push edx
:00459400 8A450C                  mov al, byte ptr [ebp+0C]
:00459403 50                      push eax
:00459404 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00459407 8B5108                  mov edx, dword ptr [ecx+08]
:0045940A 52                      push edx
:0045940B 8B4508                  mov eax, dword ptr [ebp+08]
:0045940E 50                      push eax
:0045940F 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00459412 E83593FEFF              call 0044274C
:00459417 6A01                    push 00000001
:00459419 6A0F                    push 0000000F
:0045941B B9B0694B00              mov ecx, 004B69B0
:00459420 E855B20100              call 0047467A
:00459425 8A4D10                  mov cl, byte ptr [ebp+10]
:00459428 51                      push ecx
:00459429 8A550C                  mov dl, byte ptr [ebp+0C]
:0045942C 52                      push edx
:0045942D B950424B00              mov ecx, 004B4250
:00459432 E808BCFFFF              call 0045503F
:00459437 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0045943A E88A68FEFF              call 0043FCC9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004593FA(U)
|
:0045943F B9083D4B00              mov ecx, 004B3D08
:00459444 E84114FFFF              call 0044A88A
:00459449 C745F401000000          mov [ebp-0C], 00000001
:00459450 EB07                    jmp 00459459

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00459247(C)
|
:00459452 C745F4FFFFFFFF          mov [ebp-0C], FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00459450(U)
|
:00459459 EB07                    jmp 00459462

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004591EF(C)
|
:0045945B C745F401000000          mov [ebp-0C], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004591D9(C), :00459459(U)
|
:00459462 837DF401                cmp dword ptr [ebp-0C], 00000001
:00459466 7405                    je 0045946D
:00459468 8B45F4                  mov eax, dword ptr [ebp-0C]
:0045946B EB14                    jmp 00459481

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00459466(C)
|
:0045946D 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00459470 E8FB610000              call 0045F670
:00459475 50                      push eax
:00459476 E886050200              call 00479A01
:0045947B 83C404                  add esp, 00000004
:0045947E 8B45F4                  mov eax, dword ptr [ebp-0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004591C1(U), :0045946B(U)
|
:00459481 8BE5                    mov esp, ebp
:00459483 5D                      pop ebp
:00459484 C21000                  ret 0010



* Referenced by a CALL at Addresses:
|:00413468   , :00433857   , :00433C0A   , :00433EA8   , :00434550   
|
:00459487 55                      push ebp
:00459488 8BEC                    mov ebp, esp
:0045948A 83EC20                  sub esp, 00000020
:0045948D 894DE0                  mov dword ptr [ebp-20], ecx
:00459490 8D4DF8                  lea ecx, dword ptr [ebp-08]
:00459493 E878620000              call 0045F710
:00459498 8B4508                  mov eax, dword ptr [ebp+08]
:0045949B 50                      push eax
:0045949C E8D8CBFFFF              call 00456079
:004594A1 83C404                  add esp, 00000004
:004594A4 8945FC                  mov dword ptr [ebp-04], eax
:004594A7 837DFCFF                cmp dword ptr [ebp-04], FFFFFFFF
:004594AB 7508                    jne 004594B5
:004594AD 83C8FF                  or eax, FFFFFFFF
:004594B0 E9A2010000              jmp 00459657

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004594AB(C)
|
:004594B5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004594B8 E8D3F7FBFF              call 00418C90
:004594BD 25FF000000              and eax, 000000FF
:004594C2 83F803                  cmp eax, 00000003
:004594C5 752C                    jne 004594F3
:004594C7 8A4D10                  mov cl, byte ptr [ebp+10]
:004594CA 51                      push ecx
:004594CB 8A550C                  mov dl, byte ptr [ebp+0C]
:004594CE 52                      push edx
:004594CF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004594D2 E8B591FEFF              call 0044268C
:004594D7 6A00                    push 00000000
:004594D9 6A00                    push 00000000
:004594DB 8A4510                  mov al, byte ptr [ebp+10]
:004594DE 50                      push eax
:004594DF 8A4D0C                  mov cl, byte ptr [ebp+0C]
:004594E2 51                      push ecx
:004594E3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004594E6 E81896FEFF              call 00442B03
:004594EB 83C8FF                  or eax, FFFFFFFF
:004594EE E964010000              jmp 00459657

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004594C5(C)
|
:004594F3 8B550C                  mov edx, dword ptr [ebp+0C]
:004594F6 81E2FF000000            and edx, 000000FF
:004594FC 33C0                    xor eax, eax
:004594FE A02C424B00              mov al, byte ptr [004B422C]
:00459503 3BD0                    cmp edx, eax
:00459505 0F8D49010000            jnl 00459654
:0045950B 8B4D10                  mov ecx, dword ptr [ebp+10]
:0045950E 81E1FF000000            and ecx, 000000FF
:00459514 33D2                    xor edx, edx
:00459516 8A152D424B00            mov dl, byte ptr [004B422D]
:0045951C 3BCA                    cmp ecx, edx
:0045951E 0F8D30010000            jnl 00459654
:00459524 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00459527 E8A4C5FCFF              call 00425AD0
:0045952C 8845E8                  mov byte ptr [ebp-18], al
:0045952F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00459532 E819C6FCFF              call 00425B50
:00459537 8845F4                  mov byte ptr [ebp-0C], al
:0045953A 8D45EC                  lea eax, dword ptr [ebp-14]
:0045953D 50                      push eax
:0045953E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00459541 E84A1FFEFF              call 0043B490
:00459546 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00459549 E8C2610000              call 0045F710

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0045954E 6A06                    push 00000006
:00459550 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00459553 E838D1FAFF              call 00406690
:00459558 6880000000              push 00000080
:0045955D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00459560 E8B391FEFF              call 00442718
:00459565 6A00                    push 00000000
:00459567 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045956A E8FA90FEFF              call 00442669
:0045956F 8A4D0C                  mov cl, byte ptr [ebp+0C]
:00459572 884DF0                  mov byte ptr [ebp-10], cl
:00459575 8A5510                  mov dl, byte ptr [ebp+10]
:00459578 8855F1                  mov byte ptr [ebp-0F], dl
:0045957B 8D45F0                  lea eax, dword ptr [ebp-10]
:0045957E 50                      push eax
:0045957F E800C3FDFF              call 00435884
:00459584 83C404                  add esp, 00000004
:00459587 25FF000000              and eax, 000000FF
:0045958C 3DFF000000              cmp eax, 000000FF
:00459591 742F                    je 004595C2
:00459593 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00459596 E8D51EFEFF              call 0043B470
:0045959B 50                      push eax
:0045959C 668B4DF0                mov cx, word ptr [ebp-10]
:004595A0 51                      push ecx
:004595A1 8D55E4                  lea edx, dword ptr [ebp-1C]
:004595A4 52                      push edx
:004595A5 E8965AFEFF              call 0043F040
:004595AA 83C40C                  add esp, 0000000C
:004595AD 50                      push eax
:004595AE 8D4DF8                  lea ecx, dword ptr [ebp-08]
:004595B1 E8EACFFAFF              call 004065A0
:004595B6 8A45F8                  mov al, byte ptr [ebp-08]
:004595B9 88450C                  mov byte ptr [ebp+0C], al
:004595BC 8A4DF9                  mov cl, byte ptr [ebp-07]
:004595BF 884D10                  mov byte ptr [ebp+10], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00459591(C)
|
:004595C2 8A5510                  mov dl, byte ptr [ebp+10]
:004595C5 52                      push edx
:004595C6 8A450C                  mov al, byte ptr [ebp+0C]
:004595C9 50                      push eax
:004595CA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004595CD E8BA90FEFF              call 0044268C
:004595D2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004595D5 E84217FEFF              call 0043AD1C
:004595DA 8A4DE8                  mov cl, byte ptr [ebp-18]
:004595DD 51                      push ecx
:004595DE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004595E1 E88390FEFF              call 00442669
:004595E6 6880000000              push 00000080
:004595EB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004595EE E89DD0FAFF              call 00406690
:004595F3 8B55F4                  mov edx, dword ptr [ebp-0C]
:004595F6 81E2FF000000            and edx, 000000FF
:004595FC 83E2F7                  and edx, FFFFFFF7
:004595FF 52                      push edx
:00459600 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00459603 E81091FEFF              call 00442718
:00459608 8D45EC                  lea eax, dword ptr [ebp-14]
:0045960B 50                      push eax
:0045960C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045960F E8BC200000              call 0045B6D0
:00459614 817D14FFFF0000          cmp dword ptr [ebp+14], 0000FFFF
:0045961B 7430                    je 0045964D
:0045961D 837D1403                cmp dword ptr [ebp+14], 00000003
:00459621 772A                    ja 0045964D
:00459623 8A4D14                  mov cl, byte ptr [ebp+14]
:00459626 51                      push ecx
:00459627 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045962A E841D0FAFF              call 00406670
:0045962F 68FF000000              push 000000FF
:00459634 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00459637 E8742CFCFF              call 0041C2B0
:0045963C 50                      push eax
:0045963D E8E7C1FDFF              call 00435829
:00459642 83C408                  add esp, 00000008
:00459645 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00459648 E87C66FEFF              call 0043FCC9

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045961B(C), :00459621(C)
|
:0045964D B801000000              mov eax, 00000001
:00459652 EB03                    jmp 00459657

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00459505(C), :0045951E(C)
|
:00459654 83C8FF                  or eax, FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004594B0(U), :004594EE(U), :00459652(U)
|
:00459657 8BE5                    mov esp, ebp
:00459659 5D                      pop ebp
:0045965A C21000                  ret 0010



* Referenced by a CALL at Addresses:
|:00405875   , :004138B9   , :004333CB   , :004333E4   , :00433416   
|:00433443   , :00433462   , :00433476   , :0043348C   , :004334A0   
|:004334B4   , :004334DD   , :004334F5   , :00433509   , :00433521   
|:00433535   , :00433559   , :0043356D   , :004335B9   , :004335E9   
|:004335FD   , :00433675   , :0043369E   , :004336C7   , :004336F0   
|:0043371D   , :0043380F   , :00433887   , :004338E5   , :00433915   
|:00433929   , :00433952   , :0043397B   , :004339A4   , :004339D4   
|:00433A8A   , :00433AB3   , :00433ADC   , :00433AF0   , :00433B5D   
|:00433B86   , :00433BBF   , :00433C3A   , :00433CB9   , :00433D53   
|:00433D83   , :00433DAC   , :00433DD5   , :00433E40   , :00433ED8   
|:00433F3D   , :00433F6E   , :00433F92   , :00434022   , :0043404B   
|:0043410C   , :00434135   , :0043415E   , :00434196   , :004341E0   
|:00434248   , :00434278   , :004342A1   , :004342CA   , :004342DE   
|:00434391   , :004343FF   , :00434428   , :00434451   , :0043447A   
|:004344A3   , :004344CC   , :004344F5   , :00434580   , :004345B0   
|:0043469B   , :004346C4   , :004346ED   , :0043471B   , :0043474B   
|:0043477B   , :004347A4   , :004347CD   , :004347F6   , :00434824   
|:0043484D   , :00434876   , :004348A3   , :004348B7   , :0043495F   
|:00434973   , :004349C9   , :004349F2   , :00434A1B   , :00434A48   
|:00434A5C   , :00434B04   , :00434B18   , :00434B6E   , :00434B97   
|:00434BC0   , :00434C08   , :00434C1C   , :00434CD6   , :00434CEA   
|:00434D2A   , :00434D62   , :00434D92   , :00434DBB   , :00434DE4   
|:00434E0D   , :00434E3A   , :00434E4E   , :00434F3B   , :00434F4F   
|:004419AD   
|
:0045965D 55                      push ebp
:0045965E 8BEC                    mov ebp, esp
:00459660 83EC10                  sub esp, 00000010
:00459663 894DF0                  mov dword ptr [ebp-10], ecx
:00459666 C745FC00000000          mov [ebp-04], 00000000
:0045966D C645F800                mov [ebp-08], 00
:00459671 EB08                    jmp 0045967B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004596BC(U)
|
:00459673 8A45F8                  mov al, byte ptr [ebp-08]
:00459676 0401                    add al, 01
:00459678 8845F8                  mov byte ptr [ebp-08], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00459671(U)
|
:0045967B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045967E 81E1FF000000            and ecx, 000000FF
:00459684 83F973                  cmp ecx, 00000073
:00459687 7D35                    jge 004596BE
:00459689 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045968C 81E1FF000000            and ecx, 000000FF
:00459692 6BC924                  imul ecx, 00000024
:00459695 81C1502C4B00            add ecx, 004B2C50
:0045969B E8D05F0000              call 0045F670
:004596A0 3B450C                  cmp eax, dword ptr [ebp+0C]
:004596A3 7517                    jne 004596BC
:004596A5 8B55F8                  mov edx, dword ptr [ebp-08]
:004596A8 81E2FF000000            and edx, 000000FF
:004596AE 6BD224                  imul edx, 00000024
:004596B1 81C2502C4B00            add edx, 004B2C50
:004596B7 8955FC                  mov dword ptr [ebp-04], edx
:004596BA EB02                    jmp 004596BE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004596A3(C)
|
:004596BC EBB5                    jmp 00459673

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00459687(C), :004596BA(U)
|
:004596BE 837DFC00                cmp dword ptr [ebp-04], 00000000
:004596C2 0F84A9000000            je 00459771
:004596C8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004596CB E8C0F5FBFF              call 00418C90
:004596D0 25FF000000              and eax, 000000FF
:004596D5 83F802                  cmp eax, 00000002
:004596D8 0F8593000000            jne 00459771
:004596DE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004596E1 E87A9CFAFF              call 00403360
:004596E6 668B00                  mov ax, word ptr [eax]
:004596E9 668945F4                mov word ptr [ebp-0C], ax
:004596ED 8A4DF5                  mov cl, byte ptr [ebp-0B]
:004596F0 51                      push ecx
:004596F1 8A55F4                  mov dl, byte ptr [ebp-0C]
:004596F4 52                      push edx
:004596F5 B950424B00              mov ecx, 004B4250
:004596FA E840B9FFFF              call 0045503F
:004596FF 6A02                    push 00000002
:00459701 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00459704 E8E7C3FCFF              call 00425AF0
:00459709 85C0                    test eax, eax
:0045970B 744D                    je 0045975A
:0045970D 6A04                    push 00000004
:0045970F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00459712 E8D9C3FCFF              call 00425AF0
:00459717 85C0                    test eax, eax
:00459719 743F                    je 0045975A

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0045971B 6A06                    push 00000006
:0045971D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00459720 E86BCFFAFF              call 00406690
:00459725 B950424B00              mov ecx, 004B4250
:0045972A E8E4A3FFFF              call 00453B13
:0045972F E8232EFDFF              call 0042C557
:00459734 6A00                    push 00000000
:00459736 8B450C                  mov eax, dword ptr [ebp+0C]
:00459739 50                      push eax
:0045973A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045973D 51                      push ecx
:0045973E E8AE3EFDFF              call 0042D5F1
:00459743 83C40C                  add esp, 0000000C

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:00459746 6A06                    push 00000006
:00459748 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045974B E8C88FFEFF              call 00442718
:00459750 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00459753 E87165FEFF              call 0043FCC9
:00459758 EB17                    jmp 00459771

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045970B(C), :00459719(C)
|
:0045975A E8F82DFDFF              call 0042C557
:0045975F 6A00                    push 00000000
:00459761 8B550C                  mov edx, dword ptr [ebp+0C]
:00459764 52                      push edx
:00459765 8B4508                  mov eax, dword ptr [ebp+08]
:00459768 50                      push eax
:00459769 E8833EFDFF              call 0042D5F1
:0045976E 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004596C2(C), :004596D8(C), :00459758(U)
|
:00459771 8BE5                    mov esp, ebp
:00459773 5D                      pop ebp
:00459774 C20800                  ret 0008



* Referenced by a CALL at Address:
|:004139F7   
|
:00459777 55                      push ebp
:00459778 8BEC                    mov ebp, esp
:0045977A 83EC10                  sub esp, 00000010
:0045977D 894DF0                  mov dword ptr [ebp-10], ecx
:00459780 C745FC00000000          mov [ebp-04], 00000000
:00459787 C645F800                mov [ebp-08], 00
:0045978B EB08                    jmp 00459795

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004597D6(U)
|
:0045978D 8A45F8                  mov al, byte ptr [ebp-08]
:00459790 0401                    add al, 01
:00459792 8845F8                  mov byte ptr [ebp-08], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045978B(U)
|
:00459795 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00459798 81E1FF000000            and ecx, 000000FF
:0045979E 83F973                  cmp ecx, 00000073
:004597A1 7D35                    jge 004597D8
:004597A3 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004597A6 81E1FF000000            and ecx, 000000FF
:004597AC 6BC924                  imul ecx, 00000024
:004597AF 81C1502C4B00            add ecx, 004B2C50
:004597B5 E8B65E0000              call 0045F670
:004597BA 3B450C                  cmp eax, dword ptr [ebp+0C]
:004597BD 7517                    jne 004597D6
:004597BF 8B55F8                  mov edx, dword ptr [ebp-08]
:004597C2 81E2FF000000            and edx, 000000FF
:004597C8 6BD224                  imul edx, 00000024
:004597CB 81C2502C4B00            add edx, 004B2C50
:004597D1 8955FC                  mov dword ptr [ebp-04], edx
:004597D4 EB02                    jmp 004597D8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004597BD(C)
|
:004597D6 EBB5                    jmp 0045978D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004597A1(C), :004597D4(U)
|
:004597D8 837DFC00                cmp dword ptr [ebp-04], 00000000
:004597DC 7412                    je 004597F0
:004597DE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004597E1 E8AAF4FBFF              call 00418C90
:004597E6 25FF000000              and eax, 000000FF
:004597EB 83F802                  cmp eax, 00000002
:004597EE 7451                    je 00459841

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004597DC(C)
|
:004597F0 C645F800                mov [ebp-08], 00
:004597F4 EB08                    jmp 004597FE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045983F(U)
|
:004597F6 8A45F8                  mov al, byte ptr [ebp-08]
:004597F9 0401                    add al, 01
:004597FB 8845F8                  mov byte ptr [ebp-08], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004597F4(U)
|
:004597FE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00459801 81E1FF000000            and ecx, 000000FF
:00459807 83F973                  cmp ecx, 00000073
:0045980A 7D35                    jge 00459841
:0045980C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045980F 81E1FF000000            and ecx, 000000FF
:00459815 6BC924                  imul ecx, 00000024
:00459818 81C1502C4B00            add ecx, 004B2C50
:0045981E E84D5E0000              call 0045F670
:00459823 3B4510                  cmp eax, dword ptr [ebp+10]
:00459826 7517                    jne 0045983F
:00459828 8B55F8                  mov edx, dword ptr [ebp-08]
:0045982B 81E2FF000000            and edx, 000000FF
:00459831 6BD224                  imul edx, 00000024
:00459834 81C2502C4B00            add edx, 004B2C50
:0045983A 8955FC                  mov dword ptr [ebp-04], edx
:0045983D EB02                    jmp 00459841

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00459826(C)
|
:0045983F EBB5                    jmp 004597F6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004597EE(C), :0045980A(C), :0045983D(U)
|
:00459841 837DFC00                cmp dword ptr [ebp-04], 00000000
:00459845 0F84B3000000            je 004598FE
:0045984B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045984E E83DF4FBFF              call 00418C90
:00459853 25FF000000              and eax, 000000FF
:00459858 83F802                  cmp eax, 00000002
:0045985B 0F859D000000            jne 004598FE
:00459861 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00459864 E8F79AFAFF              call 00403360
:00459869 668B00                  mov ax, word ptr [eax]
:0045986C 668945F4                mov word ptr [ebp-0C], ax
:00459870 8A4DF5                  mov cl, byte ptr [ebp-0B]
:00459873 51                      push ecx
:00459874 8A55F4                  mov dl, byte ptr [ebp-0C]
:00459877 52                      push edx
:00459878 B950424B00              mov ecx, 004B4250
:0045987D E8BDB7FFFF              call 0045503F
:00459882 6A02                    push 00000002
:00459884 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00459887 E864C2FCFF              call 00425AF0
:0045988C 85C0                    test eax, eax
:0045988E 7450                    je 004598E0
:00459890 6A04                    push 00000004
:00459892 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00459895 E856C2FCFF              call 00425AF0
:0045989A 85C0                    test eax, eax
:0045989C 7442                    je 004598E0

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0045989E 6A06                    push 00000006
:004598A0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004598A3 E8E8CDFAFF              call 00406690
:004598A8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004598AB E81964FEFF              call 0043FCC9
:004598B0 E8A22CFDFF              call 0042C557
:004598B5 6A00                    push 00000000
:004598B7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004598BA E8B15D0000              call 0045F670
:004598BF 50                      push eax
:004598C0 8B4508                  mov eax, dword ptr [ebp+08]
:004598C3 50                      push eax
:004598C4 E8283DFDFF              call 0042D5F1
:004598C9 83C40C                  add esp, 0000000C

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:004598CC 6A06                    push 00000006
:004598CE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004598D1 E8428EFEFF              call 00442718
:004598D6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004598D9 E8EB63FEFF              call 0043FCC9
:004598DE EB1C                    jmp 004598FC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045988E(C), :0045989C(C)
|
:004598E0 E8722CFDFF              call 0042C557
:004598E5 6A00                    push 00000000
:004598E7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004598EA E8815D0000              call 0045F670
:004598EF 50                      push eax
:004598F0 8B4D08                  mov ecx, dword ptr [ebp+08]
:004598F3 51                      push ecx
:004598F4 E8F83CFDFF              call 0042D5F1
:004598F9 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004598DE(U)
|
:004598FC EB17                    jmp 00459915

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00459845(C), :0045985B(C)
|
:004598FE E8542CFDFF              call 0042C557
:00459903 6A00                    push 00000000
:00459905 8B5510                  mov edx, dword ptr [ebp+10]
:00459908 52                      push edx
:00459909 8B4508                  mov eax, dword ptr [ebp+08]
:0045990C 50                      push eax
:0045990D E8DF3CFDFF              call 0042D5F1
:00459912 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004598FC(U)
|
:00459915 8BE5                    mov esp, ebp
:00459917 5D                      pop ebp
:00459918 C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:004145AC   , :00416C50   
|
:0045991B 55                      push ebp
:0045991C 8BEC                    mov ebp, esp
:0045991E 6AFF                    push FFFFFFFF
:00459920 68C4564800              push 004856C4
:00459925 64A100000000            mov eax, dword ptr fs:[00000000]
:0045992B 50                      push eax
:0045992C 64892500000000          mov dword ptr fs:[00000000], esp
:00459933 81EC300A0000            sub esp, 00000A30
:00459939 898DC8F5FFFF            mov dword ptr [ebp+FFFFF5C8], ecx
:0045993F C785ECFEFFFFFFFF0000    mov dword ptr [ebp+FFFFFEEC], 0000FFFF
:00459949 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0045994F E85C99FAFF              call 004032B0
:00459954 C745FC00000000          mov [ebp-04], 00000000
:0045995B 837D1000                cmp dword ptr [ebp+10], 00000000
:0045995F 0F84AF020000            je 00459C14
:00459965 817D1400020000          cmp dword ptr [ebp+14], 00000200
:0045996C 0F83B6000000            jnb 00459A28
:00459972 C685E8FEFFFF00          mov byte ptr [ebp+FFFFFEE8], 00
:00459979 EB0E                    jmp 00459989

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00459A21(U)
|
:0045997B 8A85E8FEFFFF            mov al, byte ptr [ebp+FFFFFEE8]
:00459981 0401                    add al, 01
:00459983 8885E8FEFFFF            mov byte ptr [ebp+FFFFFEE8], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00459979(U)
|
:00459989 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:0045998F 81E1FF000000            and ecx, 000000FF
:00459995 83F973                  cmp ecx, 00000073
:00459998 0F8D88000000            jnl 00459A26
:0045999E 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:004599A4 81E1FF000000            and ecx, 000000FF
:004599AA 6BC924                  imul ecx, 00000024
:004599AD 81C1502C4B00            add ecx, 004B2C50
:004599B3 E8B85C0000              call 0045F670
:004599B8 3B4514                  cmp eax, dword ptr [ebp+14]
:004599BB 7564                    jne 00459A21
:004599BD 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:004599C3 81E1FF000000            and ecx, 000000FF
:004599C9 6BC924                  imul ecx, 00000024
:004599CC 81C1502C4B00            add ecx, 004B2C50
:004599D2 E8B9F2FBFF              call 00418C90
:004599D7 25FF000000              and eax, 000000FF
:004599DC 83F802                  cmp eax, 00000002
:004599DF 7540                    jne 00459A21
:004599E1 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:004599E7 81E1FF000000            and ecx, 000000FF
:004599ED 6BC924                  imul ecx, 00000024
:004599F0 81C1502C4B00            add ecx, 004B2C50
:004599F6 E895920100              call 00472C90
:004599FB 85C0                    test eax, eax
:004599FD 7622                    jbe 00459A21
:004599FF 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00459A05 81E1FF000000            and ecx, 000000FF
:00459A0B 6BC924                  imul ecx, 00000024
:00459A0E 81C1502C4B00            add ecx, 004B2C50
:00459A14 E8575C0000              call 0045F670
:00459A19 8985ECFEFFFF            mov dword ptr [ebp+FFFFFEEC], eax
:00459A1F EB05                    jmp 00459A26

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004599BB(C), :004599DF(C), :004599FD(C)
|
:00459A21 E955FFFFFF              jmp 0045997B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00459998(C), :00459A1F(U)
|
:00459A26 EB3F                    jmp 00459A67

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045996C(C)
|
:00459A28 817D1400040000          cmp dword ptr [ebp+14], 00000400
:00459A2F 7236                    jb 00459A67
:00459A31 817D1403040000          cmp dword ptr [ebp+14], 00000403
:00459A38 772D                    ja 00459A67
:00459A3A 817D1403040000          cmp dword ptr [ebp+14], 00000403
:00459A41 7513                    jne 00459A56
:00459A43 8B8DC8F5FFFF            mov ecx, dword ptr [ebp+FFFFF5C8]
:00459A49 E8A2C6FFFF              call 004560F0
:00459A4E 8985ECFEFFFF            mov dword ptr [ebp+FFFFFEEC], eax
:00459A54 EB11                    jmp 00459A67

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00459A41(C)
|
:00459A56 8B8DC8F5FFFF            mov ecx, dword ptr [ebp+FFFFF5C8]
:00459A5C E8CAC5FFFF              call 0045602B
:00459A61 8985ECFEFFFF            mov dword ptr [ebp+FFFFFEEC], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00459A26(U), :00459A2F(C), :00459A38(C), :00459A54(U)
|
:00459A67 81BDECFEFFFFFFFF0000    cmp dword ptr [ebp+FFFFFEEC], 0000FFFF
:00459A71 0F849D010000            je 00459C14
:00459A77 6A00                    push 00000000
:00459A79 6A00                    push 00000000
:00459A7B 6A01                    push 00000001
:00459A7D 8B95ECFEFFFF            mov edx, dword ptr [ebp+FFFFFEEC]
:00459A83 52                      push edx
:00459A84 8B8DC8F5FFFF            mov ecx, dword ptr [ebp+FFFFF5C8]
:00459A8A E800DDFFFF              call 0045778F
:00459A8F 8B8DECFEFFFF            mov ecx, dword ptr [ebp+FFFFFEEC]
:00459A95 6BC948                  imul ecx, 00000048
:00459A98 81C1681B4A00            add ecx, 004A1B68
:00459A9E E839E00100              call 00477ADC
:00459AA3 8885E8FEFFFF            mov byte ptr [ebp+FFFFFEE8], al
:00459AA9 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:00459AAF 81E1FF000000            and ecx, 000000FF
:00459AB5 6BC924                  imul ecx, 00000024
:00459AB8 81C1502C4B00            add ecx, 004B2C50
:00459ABE E89D98FAFF              call 00403360
:00459AC3 668B00                  mov ax, word ptr [eax]
:00459AC6 50                      push eax
:00459AC7 E8B25FFFFF              call 0044FA7E
:00459ACC 83C404                  add esp, 00000004
:00459ACF 8985CCF5FFFF            mov dword ptr [ebp+FFFFF5CC], eax
:00459AD5 8995D0F5FFFF            mov dword ptr [ebp+FFFFF5D0], edx
:00459ADB 8B8DCCF5FFFF            mov ecx, dword ptr [ebp+FFFFF5CC]
:00459AE1 898DE0FEFFFF            mov dword ptr [ebp+FFFFFEE0], ecx
:00459AE7 8B95D0F5FFFF            mov edx, dword ptr [ebp+FFFFF5D0]
:00459AED 8995E4FEFFFF            mov dword ptr [ebp+FFFFFEE4], edx
:00459AF3 8D85E0F5FFFF            lea eax, dword ptr [ebp+FFFFF5E0]
:00459AF9 50                      push eax
:00459AFA 6A30                    push 00000030
:00459AFC 6A30                    push 00000030
:00459AFE 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:00459B04 51                      push ecx
:00459B05 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:00459B0B 52                      push edx
:00459B0C E840470200              call 0047E251
:00459B11 83C414                  add esp, 00000014

* Possible StringData Ref from Data Obj ->"ITEM.E5"
                                  |
:00459B14 68F0BB4800              push 0048BBF0
:00459B19 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:00459B1F E81160FCFF              call 0041FB35
:00459B24 6A04                    push 00000004
:00459B26 6A00                    push 00000000
:00459B28 6800690000              push 00006900
:00459B2D B9C8E44A00              mov ecx, 004AE4C8
:00459B32 E8095F0200              call 0047FA40
:00459B37 50                      push eax
:00459B38 8B4508                  mov eax, dword ptr [ebp+08]
:00459B3B 50                      push eax
:00459B3C 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:00459B42 E84261FCFF              call 0041FC89
:00459B47 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:00459B4D E873F7FBFF              call 004192C5
:00459B52 6A01                    push 00000001
:00459B54 6A0E                    push 0000000E
:00459B56 B9B0694B00              mov ecx, 004B69B0
:00459B5B E81AAB0100              call 0047467A
:00459B60 C785DCF5FFFF00000000    mov dword ptr [ebp+FFFFF5DC], 00000000
:00459B6A EB0F                    jmp 00459B7B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00459BFE(U)
|
:00459B6C 8B8DDCF5FFFF            mov ecx, dword ptr [ebp+FFFFF5DC]
:00459B72 83C101                  add ecx, 00000001
:00459B75 898DDCF5FFFF            mov dword ptr [ebp+FFFFF5DC], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00459B6A(U)
|
:00459B7B 83BDDCF5FFFF08          cmp dword ptr [ebp+FFFFF5DC], 00000008
:00459B82 737F                    jnb 00459C03
:00459B84 E8524AFCFF              call 0041E5DB
:00459B89 6A04                    push 00000004
:00459B8B 8D95E0F5FFFF            lea edx, dword ptr [ebp+FFFFF5E0]
:00459B91 52                      push edx
:00459B92 6A30                    push 00000030
:00459B94 6A30                    push 00000030
:00459B96 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:00459B9C 50                      push eax
:00459B9D 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:00459BA3 51                      push ecx
:00459BA4 E86A7DFFFF              call 00451913
:00459BA9 83C418                  add esp, 00000018
:00459BAC 6A04                    push 00000004
:00459BAE 6A04                    push 00000004
:00459BB0 6A00                    push 00000000
:00459BB2 6800690000              push 00006900
:00459BB7 B9C8E44A00              mov ecx, 004AE4C8
:00459BBC E87F5E0200              call 0047FA40
:00459BC1 50                      push eax
:00459BC2 6A20                    push 00000020
:00459BC4 6A20                    push 00000020
:00459BC6 8B95E4FEFFFF            mov edx, dword ptr [ebp+FFFFFEE4]
:00459BCC 83C207                  add edx, 00000007
:00459BCF 2B95DCF5FFFF            sub edx, dword ptr [ebp+FFFFF5DC]
:00459BD5 52                      push edx
:00459BD6 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:00459BDC 83C008                  add eax, 00000008
:00459BDF 50                      push eax
:00459BE0 E82E7DFFFF              call 00451913
:00459BE5 83C418                  add esp, 00000018
:00459BE8 6A01                    push 00000001
:00459BEA B9181B4B00              mov ecx, 004B1B18
:00459BEF E84C97FAFF              call 00403340
:00459BF4 E8E728FDFF              call 0042C4E0
:00459BF9 E8F849FCFF              call 0041E5F6
:00459BFE E969FFFFFF              jmp 00459B6C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00459B82(C)
|
:00459C03 6A05                    push 00000005
:00459C05 B9181B4B00              mov ecx, 004B1B18
:00459C0A E83197FAFF              call 00403340
:00459C0F E8CC28FDFF              call 0042C4E0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045995F(C), :00459A71(C)
|
:00459C14 837D1800                cmp dword ptr [ebp+18], 00000000
:00459C18 741C                    je 00459C36
:00459C1A 8B4D08                  mov ecx, dword ptr [ebp+08]
:00459C1D 51                      push ecx
:00459C1E E89522FBFF              call 0040BEB8
:00459C23 83C404                  add esp, 00000004
:00459C26 50                      push eax

* Possible StringData Ref from Data Obj ->"õ%s"
                                  |
:00459C27 689CE34800              push 0048E39C
:00459C2C 6A02                    push 00000002
:00459C2E E8665AFDFF              call 0042F699
:00459C33 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00459C18(C)
|
:00459C36 8B4D08                  mov ecx, dword ptr [ebp+08]
:00459C39 6BC919                  imul ecx, 00000019
:00459C3C 81C140114A00            add ecx, 004A1140
:00459C42 E8A32AFBFF              call 0040C6EA
:00459C47 25FF000000              and eax, 000000FF
:00459C4C 83F803                  cmp eax, 00000003
:00459C4F 7513                    jne 00459C64
:00459C51 8A5508                  mov dl, byte ptr [ebp+08]
:00459C54 52                      push edx
:00459C55 B970074B00              mov ecx, 004B0770
:00459C5A E8E63DFBFF              call 0040DA45
:00459C5F E9C9000000              jmp 00459D2D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00459C4F(C)
|
:00459C64 8B4D08                  mov ecx, dword ptr [ebp+08]
:00459C67 6BC919                  imul ecx, 00000019
:00459C6A 81C140114A00            add ecx, 004A1140
:00459C70 E8F92AFBFF              call 0040C76E
:00459C75 F7D8                    neg eax
:00459C77 1BC0                    sbb eax, eax
:00459C79 83E006                  and eax, 00000006
:00459C7C 83C003                  add eax, 00000003
:00459C7F 8885D8F5FFFF            mov byte ptr [ebp+FFFFF5D8], al
:00459C85 C685D4F5FFFF00          mov byte ptr [ebp+FFFFF5D4], 00
:00459C8C 8B450C                  mov eax, dword ptr [ebp+0C]
:00459C8F 25FF000000              and eax, 000000FF
:00459C94 8B8DD8F5FFFF            mov ecx, dword ptr [ebp+FFFFF5D8]
:00459C9A 81E1FF000000            and ecx, 000000FF
:00459CA0 3BC1                    cmp eax, ecx
:00459CA2 7C10                    jl 00459CB4
:00459CA4 8A95D8F5FFFF            mov dl, byte ptr [ebp+FFFFF5D8]
:00459CAA 88550C                  mov byte ptr [ebp+0C], dl
:00459CAD C685D4F5FFFFFF          mov byte ptr [ebp+FFFFF5D4], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00459CA2(C)
|
:00459CB4 8B4D08                  mov ecx, dword ptr [ebp+08]
:00459CB7 6BC919                  imul ecx, 00000019
:00459CBA 81C140114A00            add ecx, 004A1140
:00459CC0 E8252AFBFF              call 0040C6EA
:00459CC5 25FF000000              and eax, 000000FF
:00459CCA 83F802                  cmp eax, 00000002
:00459CCD 7509                    jne 00459CD8
:00459CCF C685C7F5FFFFFF          mov byte ptr [ebp+FFFFF5C7], FF
:00459CD6 EB0C                    jmp 00459CE4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00459CCD(C)
|
:00459CD8 8A85D4F5FFFF            mov al, byte ptr [ebp+FFFFF5D4]
:00459CDE 8885C7F5FFFF            mov byte ptr [ebp+FFFFF5C7], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00459CD6(U)
|
:00459CE4 8B4D08                  mov ecx, dword ptr [ebp+08]
:00459CE7 6BC919                  imul ecx, 00000019
:00459CEA 81C140114A00            add ecx, 004A1140
:00459CF0 E8F529FBFF              call 0040C6EA
:00459CF5 25FF000000              and eax, 000000FF
:00459CFA 83F802                  cmp eax, 00000002
:00459CFD 7509                    jne 00459D08
:00459CFF C685C6F5FFFFFF          mov byte ptr [ebp+FFFFF5C6], FF
:00459D06 EB09                    jmp 00459D11

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00459CFD(C)
|
:00459D08 8A4D0C                  mov cl, byte ptr [ebp+0C]
:00459D0B 888DC6F5FFFF            mov byte ptr [ebp+FFFFF5C6], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00459D06(U)
|
:00459D11 8A95C7F5FFFF            mov dl, byte ptr [ebp+FFFFF5C7]
:00459D17 52                      push edx
:00459D18 8A85C6F5FFFF            mov al, byte ptr [ebp+FFFFF5C6]
:00459D1E 50                      push eax
:00459D1F 8A4D08                  mov cl, byte ptr [ebp+08]
:00459D22 51                      push ecx
:00459D23 B970074B00              mov ecx, 004B0770
:00459D28 E86F3AFBFF              call 0040D79C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00459C5F(U)
|
:00459D2D 837D1000                cmp dword ptr [ebp+10], 00000000
:00459D31 7436                    je 00459D69
:00459D33 81BDECFEFFFFFFFF0000    cmp dword ptr [ebp+FFFFFEEC], 0000FFFF
:00459D3D 742A                    je 00459D69
:00459D3F 8B8DECFEFFFF            mov ecx, dword ptr [ebp+FFFFFEEC]
:00459D45 6BC948                  imul ecx, 00000048
:00459D48 81C1681B4A00            add ecx, 004A1B68
:00459D4E E889DD0100              call 00477ADC
:00459D53 8AC8                    mov cl, al
:00459D55 81E1FF000000            and ecx, 000000FF
:00459D5B 6BC924                  imul ecx, 00000024
:00459D5E 81C1502C4B00            add ecx, 004B2C50
:00459D64 E8605FFEFF              call 0043FCC9

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00459D31(C), :00459D3D(C)
|
:00459D69 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00459D70 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:00459D76 E85595FAFF              call 004032D0
:00459D7B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00459D7E 64890D00000000          mov dword ptr fs:[00000000], ecx
:00459D85 8BE5                    mov esp, ebp
:00459D87 5D                      pop ebp
:00459D88 C21400                  ret 0014



* Referenced by a CALL at Addresses:
|:004148BA   , :0044CF11   , :0044D07B   , :0045A09D   
|
:00459D8B 55                      push ebp
:00459D8C 8BEC                    mov ebp, esp
:00459D8E 83EC0C                  sub esp, 0000000C
:00459D91 894DF8                  mov dword ptr [ebp-08], ecx
:00459D94 8B4508                  mov eax, dword ptr [ebp+08]
:00459D97 50                      push eax
:00459D98 E8DCC2FFFF              call 00456079
:00459D9D 83C404                  add esp, 00000004
:00459DA0 8945FC                  mov dword ptr [ebp-04], eax
:00459DA3 837DFCFF                cmp dword ptr [ebp-04], FFFFFFFF
:00459DA7 7508                    jne 00459DB1
:00459DA9 83C8FF                  or eax, FFFFFFFF
:00459DAC E9A6000000              jmp 00459E57

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00459DA7(C)
|
:00459DB1 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00459DB4 81E1FF000000            and ecx, 000000FF
:00459DBA 85C9                    test ecx, ecx
:00459DBC 7C0E                    jl 00459DCC
:00459DBE 8B550C                  mov edx, dword ptr [ebp+0C]
:00459DC1 81E2FF000000            and edx, 000000FF
:00459DC7 83FA06                  cmp edx, 00000006
:00459DCA 7E08                    jle 00459DD4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00459DBC(C)
|
:00459DCC 83C8FF                  or eax, FFFFFFFF
:00459DCF E983000000              jmp 00459E57

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00459DCA(C)
|
:00459DD4 8B4508                  mov eax, dword ptr [ebp+08]
:00459DD7 50                      push eax
:00459DD8 E8B303FCFF              call 0041A190
:00459DDD 83C404                  add esp, 00000004
:00459DE0 85C0                    test eax, eax
:00459DE2 7405                    je 00459DE9
:00459DE4 83C8FF                  or eax, FFFFFFFF
:00459DE7 EB6E                    jmp 00459E57

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00459DE2(C)
|
:00459DE9 6880000000              push 00000080
:00459DEE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00459DF1 E89AC8FAFF              call 00406690
:00459DF6 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00459DF9 81E1FF000000            and ecx, 000000FF
:00459DFF 8A148D80E34800          mov dl, byte ptr [4*ecx+0048E380]
:00459E06 52                      push edx
:00459E07 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00459E0A E85A88FEFF              call 00442669
:00459E0F 8B450C                  mov eax, dword ptr [ebp+0C]
:00459E12 25FF000000              and eax, 000000FF
:00459E17 8945F4                  mov dword ptr [ebp-0C], eax
:00459E1A 837DF406                cmp dword ptr [ebp-0C], 00000006
:00459E1E 7732                    ja 00459E52
:00459E20 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00459E23 FF248D5D9E4500          jmp dword ptr [4*ecx+00459E5D]
:00459E2A EB26                    jmp 00459E52
:00459E2C 8B5510                  mov edx, dword ptr [ebp+10]
:00459E2F 52                      push edx
:00459E30 8B4508                  mov eax, dword ptr [ebp+08]
:00459E33 50                      push eax
:00459E34 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00459E37 E815090000              call 0045A751
:00459E3C EB14                    jmp 00459E52
:00459E3E 8A4D18                  mov cl, byte ptr [ebp+18]
:00459E41 51                      push ecx
:00459E42 8A5514                  mov dl, byte ptr [ebp+14]
:00459E45 52                      push edx
:00459E46 8B4508                  mov eax, dword ptr [ebp+08]
:00459E49 50                      push eax
:00459E4A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00459E4D E86D080000              call 0045A6BF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00459E1E(C), :00459E2A(U), :00459E3C(U)
|
:00459E52 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00459DAC(U), :00459DCF(U), :00459DE7(U)
|
:00459E57 8BE5                    mov esp, ebp
:00459E59 5D                      pop ebp
:00459E5A C21400                  ret 0014



:00459E5D 2A9E4500                DWORD 00459E2A
:00459E61 529E4500                DWORD 00459E52
:00459E65 529E4500                DWORD 00459E52
:00459E69 2C9E4500                DWORD 00459E2C
:00459E6D 3E9E4500                DWORD 00459E3E
:00459E71 2C9E4500                DWORD 00459E2C
:00459E75 3E9E4500                DWORD 00459E3E



* Referenced by a CALL at Address:
|:004148F0   
|
:00459E79 55                      push ebp
:00459E7A 8BEC                    mov ebp, esp
:00459E7C 83EC30                  sub esp, 00000030
:00459E7F 894DE4                  mov dword ptr [ebp-1C], ecx
:00459E82 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00459E85 E886580000              call 0045F710
:00459E8A 33C0                    xor eax, eax
:00459E8C A02C424B00              mov al, byte ptr [004B422C]
:00459E91 83E801                  sub eax, 00000001
:00459E94 8B4D10                  mov ecx, dword ptr [ebp+10]
:00459E97 81E1FF000000            and ecx, 000000FF
:00459E9D 3BC1                    cmp eax, ecx
:00459E9F 7D10                    jge 00459EB1
:00459EA1 33D2                    xor edx, edx
:00459EA3 8A152C424B00            mov dl, byte ptr [004B422C]
:00459EA9 83EA01                  sub edx, 00000001
:00459EAC 8955E0                  mov dword ptr [ebp-20], edx
:00459EAF EB0B                    jmp 00459EBC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00459E9F(C)
|
:00459EB1 8B4510                  mov eax, dword ptr [ebp+10]
:00459EB4 25FF000000              and eax, 000000FF
:00459EB9 8945E0                  mov dword ptr [ebp-20], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00459EAF(U)
|
:00459EBC 8A4DE0                  mov cl, byte ptr [ebp-20]
:00459EBF 884D10                  mov byte ptr [ebp+10], cl
:00459EC2 33D2                    xor edx, edx
:00459EC4 8A152D424B00            mov dl, byte ptr [004B422D]
:00459ECA 83EA01                  sub edx, 00000001
:00459ECD 8B4514                  mov eax, dword ptr [ebp+14]
:00459ED0 25FF000000              and eax, 000000FF
:00459ED5 3BD0                    cmp edx, eax
:00459ED7 7D10                    jge 00459EE9
:00459ED9 33C9                    xor ecx, ecx
:00459EDB 8A0D2D424B00            mov cl, byte ptr [004B422D]
:00459EE1 83E901                  sub ecx, 00000001
:00459EE4 894DDC                  mov dword ptr [ebp-24], ecx
:00459EE7 EB0C                    jmp 00459EF5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00459ED7(C)
|
:00459EE9 8B5514                  mov edx, dword ptr [ebp+14]
:00459EEC 81E2FF000000            and edx, 000000FF
:00459EF2 8955DC                  mov dword ptr [ebp-24], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00459EE7(U)
|
:00459EF5 8A45DC                  mov al, byte ptr [ebp-24]
:00459EF8 884514                  mov byte ptr [ebp+14], al
:00459EFB 8A4D0C                  mov cl, byte ptr [ebp+0C]
:00459EFE 884DF4                  mov byte ptr [ebp-0C], cl
:00459F01 EB09                    jmp 00459F0C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A0A7(U)
|
:00459F03 8A55F4                  mov dl, byte ptr [ebp-0C]
:00459F06 80C201                  add dl, 01
:00459F09 8855F4                  mov byte ptr [ebp-0C], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00459F01(U)
|
:00459F0C 8B45F4                  mov eax, dword ptr [ebp-0C]
:00459F0F 25FF000000              and eax, 000000FF
:00459F14 8B4D14                  mov ecx, dword ptr [ebp+14]
:00459F17 81E1FF000000            and ecx, 000000FF
:00459F1D 3BC1                    cmp eax, ecx
:00459F1F 0F8F87010000            jg 0045A0AC
:00459F25 8A5508                  mov dl, byte ptr [ebp+08]
:00459F28 8855F8                  mov byte ptr [ebp-08], dl
:00459F2B EB08                    jmp 00459F35

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A0A2(U)
|
:00459F2D 8A45F8                  mov al, byte ptr [ebp-08]
:00459F30 0401                    add al, 01
:00459F32 8845F8                  mov byte ptr [ebp-08], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00459F2B(U)
|
:00459F35 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00459F38 81E1FF000000            and ecx, 000000FF
:00459F3E 8B5510                  mov edx, dword ptr [ebp+10]
:00459F41 81E2FF000000            and edx, 000000FF
:00459F47 3BCA                    cmp ecx, edx
:00459F49 0F8F58010000            jg 0045A0A7
:00459F4F 8A45F8                  mov al, byte ptr [ebp-08]
:00459F52 8845F0                  mov byte ptr [ebp-10], al
:00459F55 8A4DF4                  mov cl, byte ptr [ebp-0C]
:00459F58 884DF1                  mov byte ptr [ebp-0F], cl
:00459F5B 8D55F0                  lea edx, dword ptr [ebp-10]
:00459F5E 52                      push edx
:00459F5F E820B9FDFF              call 00435884
:00459F64 83C404                  add esp, 00000004
:00459F67 8845FC                  mov byte ptr [ebp-04], al
:00459F6A 8B45FC                  mov eax, dword ptr [ebp-04]
:00459F6D 25FF000000              and eax, 000000FF
:00459F72 3DFF000000              cmp eax, 000000FF
:00459F77 0F8425010000            je 0045A0A2
:00459F7D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00459F80 81E1FF000000            and ecx, 000000FF
:00459F86 6BC924                  imul ecx, 00000024
:00459F89 81C1502C4B00            add ecx, 004B2C50
:00459F8F E8FCECFBFF              call 00418C90
:00459F94 25FF000000              and eax, 000000FF
:00459F99 83F802                  cmp eax, 00000002
:00459F9C 0F8500010000            jne 0045A0A2
:00459FA2 C745E800000000          mov [ebp-18], 00000000
:00459FA9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00459FAC 81E1FF000000            and ecx, 000000FF
:00459FB2 6BC924                  imul ecx, 00000024
:00459FB5 81C1502C4B00            add ecx, 004B2C50
:00459FBB E85A5CFEFF              call 0043FC1A
:00459FC0 8845EC                  mov byte ptr [ebp-14], al
:00459FC3 8B4D18                  mov ecx, dword ptr [ebp+18]
:00459FC6 81E1FF000000            and ecx, 000000FF
:00459FCC 894DD8                  mov dword ptr [ebp-28], ecx
:00459FCF 837DD806                cmp dword ptr [ebp-28], 00000006
:00459FD3 0F8793000000            ja 0045A06C
:00459FD9 8B55D8                  mov edx, dword ptr [ebp-28]
:00459FDC FF2495B2A04500          jmp dword ptr [4*edx+0045A0B2]
:00459FE3 8B4518                  mov eax, dword ptr [ebp+18]
:00459FE6 25FF000000              and eax, 000000FF
:00459FEB 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00459FEE 81E1FF000000            and ecx, 000000FF
:00459FF4 33D2                    xor edx, edx
:00459FF6 3BC1                    cmp eax, ecx
:00459FF8 0F94C2                  sete dl
:00459FFB 8955E8                  mov dword ptr [ebp-18], edx
:00459FFE EB6C                    jmp 0045A06C
:0045A000 8B45EC                  mov eax, dword ptr [ebp-14]
:0045A003 25FF000000              and eax, 000000FF
:0045A008 85C0                    test eax, eax
:0045A00A 7417                    je 0045A023
:0045A00C 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0045A00F 81E1FF000000            and ecx, 000000FF
:0045A015 83F901                  cmp ecx, 00000001
:0045A018 7409                    je 0045A023
:0045A01A C745D400000000          mov [ebp-2C], 00000000
:0045A021 EB07                    jmp 0045A02A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045A00A(C), :0045A018(C)
|
:0045A023 C745D401000000          mov [ebp-2C], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A021(U)
|
:0045A02A 8B55D4                  mov edx, dword ptr [ebp-2C]
:0045A02D 8955E8                  mov dword ptr [ebp-18], edx
:0045A030 EB3A                    jmp 0045A06C
:0045A032 8B45EC                  mov eax, dword ptr [ebp-14]
:0045A035 25FF000000              and eax, 000000FF
:0045A03A 83F802                  cmp eax, 00000002
:0045A03D 7417                    je 0045A056
:0045A03F 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0045A042 81E1FF000000            and ecx, 000000FF
:0045A048 83F903                  cmp ecx, 00000003
:0045A04B 7409                    je 0045A056
:0045A04D C745D000000000          mov [ebp-30], 00000000
:0045A054 EB07                    jmp 0045A05D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045A03D(C), :0045A04B(C)
|
:0045A056 C745D001000000          mov [ebp-30], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A054(U)
|
:0045A05D 8B55D0                  mov edx, dword ptr [ebp-30]
:0045A060 8955E8                  mov dword ptr [ebp-18], edx
:0045A063 EB07                    jmp 0045A06C
:0045A065 C745E801000000          mov [ebp-18], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00459FD3(C), :00459FFE(U), :0045A030(U), :0045A063(U)
|
:0045A06C 837DE800                cmp dword ptr [ebp-18], 00000000
:0045A070 7430                    je 0045A0A2
:0045A072 8A4528                  mov al, byte ptr [ebp+28]
:0045A075 50                      push eax
:0045A076 8A4D24                  mov cl, byte ptr [ebp+24]
:0045A079 51                      push ecx
:0045A07A 8B5520                  mov edx, dword ptr [ebp+20]
:0045A07D 52                      push edx
:0045A07E 8A451C                  mov al, byte ptr [ebp+1C]
:0045A081 50                      push eax
:0045A082 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045A085 81E1FF000000            and ecx, 000000FF
:0045A08B 6BC924                  imul ecx, 00000024
:0045A08E 81C1502C4B00            add ecx, 004B2C50
:0045A094 E8D7550000              call 0045F670
:0045A099 50                      push eax
:0045A09A 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0045A09D E8E9FCFFFF              call 00459D8B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00459F77(C), :00459F9C(C), :0045A070(C)
|
:0045A0A2 E986FEFFFF              jmp 00459F2D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00459F49(C)
|
:0045A0A7 E957FEFFFF              jmp 00459F03

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00459F1F(C)
|
:0045A0AC 8BE5                    mov esp, ebp
:0045A0AE 5D                      pop ebp
:0045A0AF C22400                  ret 0024



:0045A0B2 E39F4500                DWORD 00459FE3
:0045A0B6 E39F4500                DWORD 00459FE3
:0045A0BA E39F4500                DWORD 00459FE3
:0045A0BE E39F4500                DWORD 00459FE3
:0045A0C2 00A04500                DWORD 0045A000
:0045A0C6 32A04500                DWORD 0045A032
:0045A0CA 65A04500                DWORD 0045A065



* Referenced by a CALL at Addresses:
|:00416DEC   , :00449D83   
|
:0045A0CE 55                      push ebp
:0045A0CF 8BEC                    mov ebp, esp
:0045A0D1 83EC30                  sub esp, 00000030
:0045A0D4 894DE0                  mov dword ptr [ebp-20], ecx
:0045A0D7 A0143D4B00              mov al, byte ptr [004B3D14]
:0045A0DC 8845EC                  mov byte ptr [ebp-14], al
:0045A0DF 8A0D153D4B00            mov cl, byte ptr [004B3D15]
:0045A0E5 884DE8                  mov byte ptr [ebp-18], cl
:0045A0E8 8A15163D4B00            mov dl, byte ptr [004B3D16]
:0045A0EE 8855F8                  mov byte ptr [ebp-08], dl
:0045A0F1 A0173D4B00              mov al, byte ptr [004B3D17]
:0045A0F6 8845FC                  mov byte ptr [ebp-04], al
:0045A0F9 833D103D4B0000          cmp dword ptr [004B3D10], 00000000
:0045A100 750A                    jne 0045A10C
:0045A102 837D0800                cmp dword ptr [ebp+08], 00000000
:0045A106 0F845C030000            je 0045A468

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A100(C)
|
:0045A10C 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0045A10F 81E1FF000000            and ecx, 000000FF
:0045A115 33D2                    xor edx, edx
:0045A117 8A152C424B00            mov dl, byte ptr [004B422C]
:0045A11D 83EA01                  sub edx, 00000001
:0045A120 3BCA                    cmp ecx, edx
:0045A122 7D0D                    jge 0045A131
:0045A124 8B45EC                  mov eax, dword ptr [ebp-14]
:0045A127 25FF000000              and eax, 000000FF
:0045A12C 8945DC                  mov dword ptr [ebp-24], eax
:0045A12F EB0E                    jmp 0045A13F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A122(C)
|
:0045A131 33C9                    xor ecx, ecx
:0045A133 8A0D2C424B00            mov cl, byte ptr [004B422C]
:0045A139 83E901                  sub ecx, 00000001
:0045A13C 894DDC                  mov dword ptr [ebp-24], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A12F(U)
|
:0045A13F 8A55DC                  mov dl, byte ptr [ebp-24]
:0045A142 8855EC                  mov byte ptr [ebp-14], dl
:0045A145 8B45E8                  mov eax, dword ptr [ebp-18]
:0045A148 25FF000000              and eax, 000000FF
:0045A14D 33C9                    xor ecx, ecx
:0045A14F 8A0D2D424B00            mov cl, byte ptr [004B422D]
:0045A155 83E901                  sub ecx, 00000001
:0045A158 3BC1                    cmp eax, ecx
:0045A15A 7D0E                    jge 0045A16A
:0045A15C 8B55E8                  mov edx, dword ptr [ebp-18]
:0045A15F 81E2FF000000            and edx, 000000FF
:0045A165 8955D8                  mov dword ptr [ebp-28], edx
:0045A168 EB0D                    jmp 0045A177

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A15A(C)
|
:0045A16A 33C0                    xor eax, eax
:0045A16C A02D424B00              mov al, byte ptr [004B422D]
:0045A171 83E801                  sub eax, 00000001
:0045A174 8945D8                  mov dword ptr [ebp-28], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A168(U)
|
:0045A177 8A4DD8                  mov cl, byte ptr [ebp-28]
:0045A17A 884DE8                  mov byte ptr [ebp-18], cl
:0045A17D 8B55F8                  mov edx, dword ptr [ebp-08]
:0045A180 81E2FF000000            and edx, 000000FF
:0045A186 33C0                    xor eax, eax
:0045A188 A02C424B00              mov al, byte ptr [004B422C]
:0045A18D 83E801                  sub eax, 00000001
:0045A190 3BD0                    cmp edx, eax
:0045A192 7D0E                    jge 0045A1A2
:0045A194 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045A197 81E1FF000000            and ecx, 000000FF
:0045A19D 894DD4                  mov dword ptr [ebp-2C], ecx
:0045A1A0 EB0E                    jmp 0045A1B0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A192(C)
|
:0045A1A2 33D2                    xor edx, edx
:0045A1A4 8A152C424B00            mov dl, byte ptr [004B422C]
:0045A1AA 83EA01                  sub edx, 00000001
:0045A1AD 8955D4                  mov dword ptr [ebp-2C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A1A0(U)
|
:0045A1B0 8A45D4                  mov al, byte ptr [ebp-2C]
:0045A1B3 8845F8                  mov byte ptr [ebp-08], al
:0045A1B6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045A1B9 81E1FF000000            and ecx, 000000FF
:0045A1BF 33D2                    xor edx, edx
:0045A1C1 8A152D424B00            mov dl, byte ptr [004B422D]
:0045A1C7 83EA01                  sub edx, 00000001
:0045A1CA 3BCA                    cmp ecx, edx
:0045A1CC 7D0D                    jge 0045A1DB
:0045A1CE 8B45FC                  mov eax, dword ptr [ebp-04]
:0045A1D1 25FF000000              and eax, 000000FF
:0045A1D6 8945D0                  mov dword ptr [ebp-30], eax
:0045A1D9 EB0E                    jmp 0045A1E9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A1CC(C)
|
:0045A1DB 33C9                    xor ecx, ecx
:0045A1DD 8A0D2D424B00            mov cl, byte ptr [004B422D]
:0045A1E3 83E901                  sub ecx, 00000001
:0045A1E6 894DD0                  mov dword ptr [ebp-30], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A1D9(U)
|
:0045A1E9 8A55D0                  mov dl, byte ptr [ebp-30]
:0045A1EC 8855FC                  mov byte ptr [ebp-04], dl
:0045A1EF 8B45EC                  mov eax, dword ptr [ebp-14]
:0045A1F2 25FF000000              and eax, 000000FF
:0045A1F7 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045A1FA 81E1FF000000            and ecx, 000000FF
:0045A200 3BC1                    cmp eax, ecx
:0045A202 7F15                    jg 0045A219
:0045A204 8B55E8                  mov edx, dword ptr [ebp-18]
:0045A207 81E2FF000000            and edx, 000000FF
:0045A20D 8B45FC                  mov eax, dword ptr [ebp-04]
:0045A210 25FF000000              and eax, 000000FF
:0045A215 3BD0                    cmp edx, eax
:0045A217 7E05                    jle 0045A21E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A202(C)
|
:0045A219 E94A020000              jmp 0045A468

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A217(C)
|
:0045A21E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045A221 81E1FF000000            and ecx, 000000FF
:0045A227 8B55EC                  mov edx, dword ptr [ebp-14]
:0045A22A 81E2FF000000            and edx, 000000FF
:0045A230 2BCA                    sub ecx, edx
:0045A232 83F902                  cmp ecx, 00000002
:0045A235 7E4A                    jle 0045A281
:0045A237 8B45F8                  mov eax, dword ptr [ebp-08]
:0045A23A 25FF000000              and eax, 000000FF
:0045A23F 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0045A242 81E1FF000000            and ecx, 000000FF
:0045A248 2BC1                    sub eax, ecx
:0045A24A 99                      cdq
:0045A24B 2BC2                    sub eax, edx
:0045A24D 8BC8                    mov ecx, eax
:0045A24F D1F9                    sar ecx, 1
:0045A251 8B45F8                  mov eax, dword ptr [ebp-08]
:0045A254 25FF000000              and eax, 000000FF
:0045A259 8B55EC                  mov edx, dword ptr [ebp-14]
:0045A25C 81E2FF000000            and edx, 000000FF
:0045A262 2BC2                    sub eax, edx
:0045A264 99                      cdq
:0045A265 33C2                    xor eax, edx
:0045A267 2BC2                    sub eax, edx
:0045A269 83E001                  and eax, 00000001
:0045A26C 33C2                    xor eax, edx
:0045A26E 2BC2                    sub eax, edx
:0045A270 03C8                    add ecx, eax
:0045A272 8B45EC                  mov eax, dword ptr [ebp-14]
:0045A275 25FF000000              and eax, 000000FF
:0045A27A 03C8                    add ecx, eax
:0045A27C 884DF4                  mov byte ptr [ebp-0C], cl
:0045A27F EB06                    jmp 0045A287

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A235(C)
|
:0045A281 8A4DEC                  mov cl, byte ptr [ebp-14]
:0045A284 884DF4                  mov byte ptr [ebp-0C], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A27F(U)
|
:0045A287 8B55FC                  mov edx, dword ptr [ebp-04]
:0045A28A 81E2FF000000            and edx, 000000FF
:0045A290 8B45E8                  mov eax, dword ptr [ebp-18]
:0045A293 25FF000000              and eax, 000000FF
:0045A298 2BD0                    sub edx, eax
:0045A29A 83FA02                  cmp edx, 00000002
:0045A29D 7E4A                    jle 0045A2E9
:0045A29F 8B45FC                  mov eax, dword ptr [ebp-04]
:0045A2A2 25FF000000              and eax, 000000FF
:0045A2A7 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0045A2AA 81E1FF000000            and ecx, 000000FF
:0045A2B0 2BC1                    sub eax, ecx
:0045A2B2 99                      cdq
:0045A2B3 2BC2                    sub eax, edx
:0045A2B5 8BC8                    mov ecx, eax
:0045A2B7 D1F9                    sar ecx, 1
:0045A2B9 8B45FC                  mov eax, dword ptr [ebp-04]
:0045A2BC 25FF000000              and eax, 000000FF
:0045A2C1 8B55E8                  mov edx, dword ptr [ebp-18]
:0045A2C4 81E2FF000000            and edx, 000000FF
:0045A2CA 2BC2                    sub eax, edx
:0045A2CC 99                      cdq
:0045A2CD 33C2                    xor eax, edx
:0045A2CF 2BC2                    sub eax, edx
:0045A2D1 83E001                  and eax, 00000001
:0045A2D4 33C2                    xor eax, edx
:0045A2D6 2BC2                    sub eax, edx
:0045A2D8 03C8                    add ecx, eax
:0045A2DA 8B45E8                  mov eax, dword ptr [ebp-18]
:0045A2DD 25FF000000              and eax, 000000FF
:0045A2E2 03C8                    add ecx, eax
:0045A2E4 884DF0                  mov byte ptr [ebp-10], cl
:0045A2E7 EB06                    jmp 0045A2EF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A29D(C)
|
:0045A2E9 8A4DE8                  mov cl, byte ptr [ebp-18]
:0045A2EC 884DF0                  mov byte ptr [ebp-10], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A2E7(U)
|
:0045A2EF 8A55F0                  mov dl, byte ptr [ebp-10]
:0045A2F2 52                      push edx
:0045A2F3 8A45F4                  mov al, byte ptr [ebp-0C]
:0045A2F6 50                      push eax
:0045A2F7 B950424B00              mov ecx, 004B4250
:0045A2FC E83EADFFFF              call 0045503F
:0045A301 B950424B00              mov ecx, 004B4250
:0045A306 E88877FFFF              call 00451A93
:0045A30B 99                      cdq
:0045A30C B930000000              mov ecx, 00000030
:0045A311 F7F9                    idiv ecx
:0045A313 50                      push eax
:0045A314 8A55EC                  mov dl, byte ptr [ebp-14]
:0045A317 52                      push edx
:0045A318 E8B3570200              call 0047FAD0
:0045A31D 83C408                  add esp, 00000008
:0045A320 8845EC                  mov byte ptr [ebp-14], al
:0045A323 B950424B00              mov ecx, 004B4250
:0045A328 E87777FFFF              call 00451AA4
:0045A32D 99                      cdq
:0045A32E B930000000              mov ecx, 00000030
:0045A333 F7F9                    idiv ecx
:0045A335 50                      push eax
:0045A336 8A55E8                  mov dl, byte ptr [ebp-18]
:0045A339 52                      push edx
:0045A33A E891570200              call 0047FAD0
:0045A33F 83C408                  add esp, 00000008
:0045A342 8845E8                  mov byte ptr [ebp-18], al
:0045A345 B950424B00              mov ecx, 004B4250
:0045A34A E84477FFFF              call 00451A93
:0045A34F 99                      cdq
:0045A350 B930000000              mov ecx, 00000030
:0045A355 F7F9                    idiv ecx
:0045A357 50                      push eax
:0045A358 8A55F8                  mov dl, byte ptr [ebp-08]
:0045A35B 52                      push edx
:0045A35C E86F570200              call 0047FAD0
:0045A361 83C408                  add esp, 00000008
:0045A364 8845F8                  mov byte ptr [ebp-08], al
:0045A367 B950424B00              mov ecx, 004B4250
:0045A36C E83377FFFF              call 00451AA4
:0045A371 99                      cdq
:0045A372 B930000000              mov ecx, 00000030
:0045A377 F7F9                    idiv ecx
:0045A379 50                      push eax
:0045A37A 8A55FC                  mov dl, byte ptr [ebp-04]
:0045A37D 52                      push edx
:0045A37E E84D570200              call 0047FAD0
:0045A383 83C408                  add esp, 00000008
:0045A386 8845FC                  mov byte ptr [ebp-04], al
:0045A389 C645E400                mov [ebp-1C], 00
:0045A38D EB08                    jmp 0045A397

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A463(U)
|
:0045A38F 8A45E4                  mov al, byte ptr [ebp-1C]
:0045A392 0401                    add al, 01
:0045A394 8845E4                  mov byte ptr [ebp-1C], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A38D(U)
|
:0045A397 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0045A39A 81E1FF000000            and ecx, 000000FF
:0045A3A0 83F903                  cmp ecx, 00000003
:0045A3A3 0F8DBF000000            jnl 0045A468
:0045A3A9 6A28                    push 00000028
:0045A3AB B950424B00              mov ecx, 004B4250
:0045A3B0 E87578FFFF              call 00451C2A
:0045A3B5 8B55FC                  mov edx, dword ptr [ebp-04]
:0045A3B8 81E2FF000000            and edx, 000000FF
:0045A3BE 8B45E8                  mov eax, dword ptr [ebp-18]
:0045A3C1 25FF000000              and eax, 000000FF
:0045A3C6 2BD0                    sub edx, eax
:0045A3C8 83C201                  add edx, 00000001
:0045A3CB 52                      push edx
:0045A3CC 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045A3CF 81E1FF000000            and ecx, 000000FF
:0045A3D5 8B55EC                  mov edx, dword ptr [ebp-14]
:0045A3D8 81E2FF000000            and edx, 000000FF
:0045A3DE 2BCA                    sub ecx, edx
:0045A3E0 83C101                  add ecx, 00000001
:0045A3E3 51                      push ecx
:0045A3E4 8A45E8                  mov al, byte ptr [ebp-18]
:0045A3E7 50                      push eax
:0045A3E8 8A4DEC                  mov cl, byte ptr [ebp-14]
:0045A3EB 51                      push ecx
:0045A3EC B950424B00              mov ecx, 004B4250
:0045A3F1 E8997DFFFF              call 0045218F
:0045A3F6 6A0A                    push 0000000A
:0045A3F8 B9181B4B00              mov ecx, 004B1B18
:0045A3FD E83E8FFAFF              call 00403340
:0045A402 E8D920FDFF              call 0042C4E0
:0045A407 B950424B00              mov ecx, 004B4250
:0045A40C E8C778FFFF              call 00451CD8
:0045A411 8B55FC                  mov edx, dword ptr [ebp-04]
:0045A414 81E2FF000000            and edx, 000000FF
:0045A41A 8B45E8                  mov eax, dword ptr [ebp-18]
:0045A41D 25FF000000              and eax, 000000FF
:0045A422 2BD0                    sub edx, eax
:0045A424 83C201                  add edx, 00000001
:0045A427 52                      push edx
:0045A428 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045A42B 81E1FF000000            and ecx, 000000FF
:0045A431 8B55EC                  mov edx, dword ptr [ebp-14]
:0045A434 81E2FF000000            and edx, 000000FF
:0045A43A 2BCA                    sub ecx, edx
:0045A43C 83C101                  add ecx, 00000001
:0045A43F 51                      push ecx
:0045A440 8A45E8                  mov al, byte ptr [ebp-18]
:0045A443 50                      push eax
:0045A444 8A4DEC                  mov cl, byte ptr [ebp-14]
:0045A447 51                      push ecx
:0045A448 B950424B00              mov ecx, 004B4250
:0045A44D E83D7DFFFF              call 0045218F
:0045A452 6A0A                    push 0000000A
:0045A454 B9181B4B00              mov ecx, 004B1B18
:0045A459 E8E28EFAFF              call 00403340
:0045A45E E87D20FDFF              call 0042C4E0
:0045A463 E927FFFFFF              jmp 0045A38F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045A106(C), :0045A219(U), :0045A3A3(C)
|
:0045A468 8BE5                    mov esp, ebp
:0045A46A 5D                      pop ebp
:0045A46B C20400                  ret 0004


:0045A46E 55                      push ebp
:0045A46F 8BEC                    mov ebp, esp
:0045A471 83EC14                  sub esp, 00000014
:0045A474 894DEC                  mov dword ptr [ebp-14], ecx
:0045A477 8B4508                  mov eax, dword ptr [ebp+08]
:0045A47A 50                      push eax
:0045A47B E8F9BBFFFF              call 00456079
:0045A480 83C404                  add esp, 00000004
:0045A483 8945F4                  mov dword ptr [ebp-0C], eax
:0045A486 C745FC00000000          mov [ebp-04], 00000000
:0045A48D 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045A490 6BC948                  imul ecx, 00000048
:0045A493 81C1681B4A00            add ecx, 004A1B68
:0045A499 E8E2E8FBFF              call 00418D80
:0045A49E 25FF000000              and eax, 000000FF
:0045A4A3 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0045A4A6 81E1FF000000            and ecx, 000000FF
:0045A4AC 3BC1                    cmp eax, ecx
:0045A4AE 750A                    jne 0045A4BA
:0045A4B0 B801000000              mov eax, 00000001
:0045A4B5 E9FF010000              jmp 0045A6B9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A4AE(C)
|
:0045A4BA 837DF4FF                cmp dword ptr [ebp-0C], FFFFFFFF
:0045A4BE 7508                    jne 0045A4C8
:0045A4C0 83C8FF                  or eax, FFFFFFFF
:0045A4C3 E9F1010000              jmp 0045A6B9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A4BE(C)
|
:0045A4C8 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0045A4CB E8C0E7FBFF              call 00418C90
:0045A4D0 25FF000000              and eax, 000000FF
:0045A4D5 83F803                  cmp eax, 00000003
:0045A4D8 751F                    jne 0045A4F9
:0045A4DA 8A550C                  mov dl, byte ptr [ebp+0C]
:0045A4DD 52                      push edx
:0045A4DE 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045A4E1 6BC948                  imul ecx, 00000048
:0045A4E4 81C1681B4A00            add ecx, 004A1B68
:0045A4EA E8C13AFBFF              call 0040DFB0
:0045A4EF B801000000              mov eax, 00000001
:0045A4F4 E9C0010000              jmp 0045A6B9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A4D8(C)
|
:0045A4F9 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0045A4FC E80FC2FAFF              call 00406710
:0045A501 8945F8                  mov dword ptr [ebp-08], eax
:0045A504 837DF800                cmp dword ptr [ebp-08], 00000000
:0045A508 7414                    je 0045A51E
:0045A50A 8B450C                  mov eax, dword ptr [ebp+0C]
:0045A50D 25FF000000              and eax, 000000FF
:0045A512 85C0                    test eax, eax
:0045A514 7508                    jne 0045A51E
:0045A516 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0045A519 894DFC                  mov dword ptr [ebp-04], ecx
:0045A51C EB68                    jmp 0045A586

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045A508(C), :0045A514(C)
|
:0045A51E 8B55F8                  mov edx, dword ptr [ebp-08]
:0045A521 F7DA                    neg edx
:0045A523 1BD2                    sbb edx, edx
:0045A525 83E223                  and edx, 00000023
:0045A528 8855F0                  mov byte ptr [ebp-10], dl
:0045A52B EB08                    jmp 0045A535

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A584(U)
|
:0045A52D 8A45F0                  mov al, byte ptr [ebp-10]
:0045A530 0401                    add al, 01
:0045A532 8845F0                  mov byte ptr [ebp-10], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A52B(U)
|
:0045A535 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0045A538 81E1FF000000            and ecx, 000000FF
:0045A53E 8B55F8                  mov edx, dword ptr [ebp-08]
:0045A541 F7DA                    neg edx
:0045A543 1BD2                    sbb edx, edx
:0045A545 83E250                  and edx, 00000050
:0045A548 83C223                  add edx, 00000023
:0045A54B 3BCA                    cmp ecx, edx
:0045A54D 7D37                    jge 0045A586
:0045A54F 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0045A552 81E1FF000000            and ecx, 000000FF
:0045A558 6BC924                  imul ecx, 00000024
:0045A55B 81C1502C4B00            add ecx, 004B2C50
:0045A561 E82AE7FBFF              call 00418C90
:0045A566 25FF000000              and eax, 000000FF
:0045A56B 85C0                    test eax, eax
:0045A56D 7515                    jne 0045A584
:0045A56F 8B45F0                  mov eax, dword ptr [ebp-10]
:0045A572 25FF000000              and eax, 000000FF
:0045A577 6BC024                  imul eax, 00000024
:0045A57A 05502C4B00              add eax, 004B2C50
:0045A57F 8945FC                  mov dword ptr [ebp-04], eax
:0045A582 EB02                    jmp 0045A586

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A56D(C)
|
:0045A584 EBA7                    jmp 0045A52D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045A51C(U), :0045A54D(C), :0045A582(U)
|
:0045A586 837DFC00                cmp dword ptr [ebp-04], 00000000
:0045A58A 7529                    jne 0045A5B5
:0045A58C 6A00                    push 00000000
:0045A58E 6A00                    push 00000000
:0045A590 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0045A593 E8AC71FEFF              call 00441744
:0045A598 8A4D0C                  mov cl, byte ptr [ebp+0C]
:0045A59B 51                      push ecx
:0045A59C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045A59F 6BC948                  imul ecx, 00000048
:0045A5A2 81C1681B4A00            add ecx, 004A1B68
:0045A5A8 E8033AFBFF              call 0040DFB0
:0045A5AD 83C8FF                  or eax, FFFFFFFF
:0045A5B0 E904010000              jmp 0045A6B9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A58A(C)
|
:0045A5B5 8A550C                  mov dl, byte ptr [ebp+0C]
:0045A5B8 52                      push edx
:0045A5B9 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045A5BC 6BC948                  imul ecx, 00000048
:0045A5BF 81C1681B4A00            add ecx, 004A1B68
:0045A5C5 E8E639FBFF              call 0040DFB0
:0045A5CA 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0045A5CD E8BEE6FBFF              call 00418C90
:0045A5D2 25FF000000              and eax, 000000FF
:0045A5D7 83F802                  cmp eax, 00000002
:0045A5DA 7508                    jne 0045A5E4
:0045A5DC 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0045A5DF E80085FEFF              call 00442AE4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A5DA(C)
|
:0045A5E4 8B45FC                  mov eax, dword ptr [ebp-04]
:0045A5E7 3B45F4                  cmp eax, dword ptr [ebp-0C]
:0045A5EA 7427                    je 0045A613
:0045A5EC 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0045A5EF 51                      push ecx
:0045A5F0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045A5F3 E808110000              call 0045B700
:0045A5F8 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0045A5FB E8B01CFCFF              call 0041C2B0
:0045A600 50                      push eax
:0045A601 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0045A604 E80A80FEFF              call 00442613
:0045A609 6A00                    push 00000000
:0045A60B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0045A60E E80D8BFEFF              call 00443120

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A5EA(C)
|
:0045A613 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045A616 E8F5C0FAFF              call 00406710
:0045A61B 85C0                    test eax, eax
:0045A61D 7425                    je 0045A644
:0045A61F 8B550C                  mov edx, dword ptr [ebp+0C]
:0045A622 81E2FF000000            and edx, 000000FF
:0045A628 85D2                    test edx, edx
:0045A62A 750C                    jne 0045A638
:0045A62C 6A00                    push 00000000
:0045A62E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045A631 E89A55FEFF              call 0043FBD0
:0045A636 EB0A                    jmp 0045A642

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A62A(C)
|
:0045A638 6A01                    push 00000001
:0045A63A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045A63D E88E55FEFF              call 0043FBD0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A636(U)
|
:0045A642 EB2D                    jmp 0045A671

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A61D(C)
|
:0045A644 B93C314B00              mov ecx, 004B313C
:0045A649 E8E752FEFF              call 0043F935
:0045A64E 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0045A651 81E1FF000000            and ecx, 000000FF
:0045A657 3BC1                    cmp eax, ecx
:0045A659 750C                    jne 0045A667
:0045A65B 6A02                    push 00000002
:0045A65D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045A660 E86B55FEFF              call 0043FBD0
:0045A665 EB0A                    jmp 0045A671

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A659(C)
|
:0045A667 6A03                    push 00000003
:0045A669 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045A66C E85F55FEFF              call 0043FBD0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045A642(U), :0045A665(U)
|
:0045A671 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045A674 E8B357FEFF              call 0043FE2C
:0045A679 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045A67C E80FE6FBFF              call 00418C90
:0045A681 25FF000000              and eax, 000000FF
:0045A686 83F802                  cmp eax, 00000002
:0045A689 7529                    jne 0045A6B4
:0045A68B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045A68E E82884FEFF              call 00442ABB
:0045A693 8B550C                  mov edx, dword ptr [ebp+0C]
:0045A696 81E2FF000000            and edx, 000000FF
:0045A69C 85D2                    test edx, edx
:0045A69E 750A                    jne 0045A6AA

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0045A6A0 6A07                    push 00000007
:0045A6A2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045A6A5 E8BF7FFEFF              call 00442669

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A69E(C)
|
:0045A6AA B9083D4B00              mov ecx, 004B3D08
:0045A6AF E8D601FFFF              call 0044A88A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A689(C)
|
:0045A6B4 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045A4B5(U), :0045A4C3(U), :0045A4F4(U), :0045A5B0(U)
|
:0045A6B9 8BE5                    mov esp, ebp
:0045A6BB 5D                      pop ebp
:0045A6BC C20800                  ret 0008



* Referenced by a CALL at Address:
|:00459E4D   
|
:0045A6BF 55                      push ebp
:0045A6C0 8BEC                    mov ebp, esp
:0045A6C2 83EC08                  sub esp, 00000008
:0045A6C5 894DF8                  mov dword ptr [ebp-08], ecx
:0045A6C8 8B4508                  mov eax, dword ptr [ebp+08]
:0045A6CB 50                      push eax
:0045A6CC E8A8B9FFFF              call 00456079
:0045A6D1 83C404                  add esp, 00000004
:0045A6D4 8945FC                  mov dword ptr [ebp-04], eax
:0045A6D7 837DFCFF                cmp dword ptr [ebp-04], FFFFFFFF
:0045A6DB 7505                    jne 0045A6E2
:0045A6DD 83C8FF                  or eax, FFFFFFFF
:0045A6E0 EB69                    jmp 0045A74B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A6DB(C)
|
:0045A6E2 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0045A6E5 81E1FF000000            and ecx, 000000FF
:0045A6EB 85C9                    test ecx, ecx
:0045A6ED 7C59                    jl 0045A748
:0045A6EF 8B5510                  mov edx, dword ptr [ebp+10]
:0045A6F2 81E2FF000000            and edx, 000000FF
:0045A6F8 85D2                    test edx, edx
:0045A6FA 7C4C                    jl 0045A748
:0045A6FC 8B450C                  mov eax, dword ptr [ebp+0C]
:0045A6FF 25FF000000              and eax, 000000FF
:0045A704 33C9                    xor ecx, ecx
:0045A706 8A0D2C424B00            mov cl, byte ptr [004B422C]
:0045A70C 3BC1                    cmp eax, ecx
:0045A70E 7D38                    jge 0045A748
:0045A710 8B5510                  mov edx, dword ptr [ebp+10]
:0045A713 81E2FF000000            and edx, 000000FF
:0045A719 33C0                    xor eax, eax
:0045A71B A02D424B00              mov al, byte ptr [004B422D]
:0045A720 3BD0                    cmp edx, eax
:0045A722 7D24                    jge 0045A748
:0045A724 6880000000              push 00000080
:0045A729 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045A72C E85FBFFAFF              call 00406690
:0045A731 8A4D10                  mov cl, byte ptr [ebp+10]
:0045A734 51                      push ecx
:0045A735 8A550C                  mov dl, byte ptr [ebp+0C]
:0045A738 52                      push edx
:0045A739 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045A73C E84B7FFEFF              call 0044268C
:0045A741 B801000000              mov eax, 00000001
:0045A746 EB03                    jmp 0045A74B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045A6ED(C), :0045A6FA(C), :0045A70E(C), :0045A722(C)
|
:0045A748 83C8FF                  or eax, FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045A6E0(U), :0045A746(U)
|
:0045A74B 8BE5                    mov esp, ebp
:0045A74D 5D                      pop ebp
:0045A74E C20C00                  ret 000C



* Referenced by a CALL at Address:
|:00459E37   
|
:0045A751 55                      push ebp
:0045A752 8BEC                    mov ebp, esp
:0045A754 83EC0C                  sub esp, 0000000C
:0045A757 894DF4                  mov dword ptr [ebp-0C], ecx
:0045A75A 8B4508                  mov eax, dword ptr [ebp+08]
:0045A75D 50                      push eax
:0045A75E E816B9FFFF              call 00456079
:0045A763 83C404                  add esp, 00000004
:0045A766 8945FC                  mov dword ptr [ebp-04], eax
:0045A769 837DFCFF                cmp dword ptr [ebp-04], FFFFFFFF
:0045A76D 7505                    jne 0045A774
:0045A76F 83C8FF                  or eax, FFFFFFFF
:0045A772 EB3D                    jmp 0045A7B1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A76D(C)
|
:0045A774 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0045A777 51                      push ecx
:0045A778 E8FCB8FFFF              call 00456079
:0045A77D 83C404                  add esp, 00000004
:0045A780 8945F8                  mov dword ptr [ebp-08], eax
:0045A783 837DF8FF                cmp dword ptr [ebp-08], FFFFFFFF
:0045A787 7505                    jne 0045A78E
:0045A789 83C8FF                  or eax, FFFFFFFF
:0045A78C EB23                    jmp 0045A7B1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A787(C)
|
:0045A78E 6880000000              push 00000080
:0045A793 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045A796 E8F5BEFAFF              call 00406690
:0045A79B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045A79E E80D1BFCFF              call 0041C2B0
:0045A7A3 50                      push eax
:0045A7A4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045A7A7 E89489FEFF              call 00443140
:0045A7AC B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045A772(U), :0045A78C(U)
|
:0045A7B1 8BE5                    mov esp, ebp
:0045A7B3 5D                      pop ebp
:0045A7B4 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0041328B   , :00415720   , :0045AA2B   
|
:0045A7B7 55                      push ebp
:0045A7B8 8BEC                    mov ebp, esp
:0045A7BA 83EC08                  sub esp, 00000008
:0045A7BD 894DF8                  mov dword ptr [ebp-08], ecx
:0045A7C0 8B4508                  mov eax, dword ptr [ebp+08]
:0045A7C3 50                      push eax
:0045A7C4 E8B0B8FFFF              call 00456079
:0045A7C9 83C404                  add esp, 00000004
:0045A7CC 8945FC                  mov dword ptr [ebp-04], eax
:0045A7CF 837DFCFF                cmp dword ptr [ebp-04], FFFFFFFF
:0045A7D3 7505                    jne 0045A7DA
:0045A7D5 83C8FF                  or eax, FFFFFFFF
:0045A7D8 EB2F                    jmp 0045A809

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A7D3(C)
|
:0045A7DA 6880000000              push 00000080
:0045A7DF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045A7E2 E8317FFEFF              call 00442718
:0045A7E7 8B4D10                  mov ecx, dword ptr [ebp+10]
:0045A7EA 51                      push ecx
:0045A7EB 8B550C                  mov edx, dword ptr [ebp+0C]
:0045A7EE 52                      push edx
:0045A7EF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045A7F2 E84D6FFEFF              call 00441744
:0045A7F7 6880000000              push 00000080
:0045A7FC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045A7FF E88CBEFAFF              call 00406690
:0045A804 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A7D8(U)
|
:0045A809 8BE5                    mov esp, ebp
:0045A80B 5D                      pop ebp
:0045A80C C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:004132C6   , :00415763   
|
:0045A80F 55                      push ebp
:0045A810 8BEC                    mov ebp, esp
:0045A812 83EC30                  sub esp, 00000030
:0045A815 894DE4                  mov dword ptr [ebp-1C], ecx
:0045A818 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0045A81B E8F04E0000              call 0045F710
:0045A820 33C0                    xor eax, eax
:0045A822 A02C424B00              mov al, byte ptr [004B422C]
:0045A827 83E801                  sub eax, 00000001
:0045A82A 8B4D10                  mov ecx, dword ptr [ebp+10]
:0045A82D 81E1FF000000            and ecx, 000000FF
:0045A833 3BC1                    cmp eax, ecx
:0045A835 7D10                    jge 0045A847
:0045A837 33D2                    xor edx, edx
:0045A839 8A152C424B00            mov dl, byte ptr [004B422C]
:0045A83F 83EA01                  sub edx, 00000001
:0045A842 8955E0                  mov dword ptr [ebp-20], edx
:0045A845 EB0B                    jmp 0045A852

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A835(C)
|
:0045A847 8B4510                  mov eax, dword ptr [ebp+10]
:0045A84A 25FF000000              and eax, 000000FF
:0045A84F 8945E0                  mov dword ptr [ebp-20], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A845(U)
|
:0045A852 8A4DE0                  mov cl, byte ptr [ebp-20]
:0045A855 884D10                  mov byte ptr [ebp+10], cl
:0045A858 33D2                    xor edx, edx
:0045A85A 8A152D424B00            mov dl, byte ptr [004B422D]
:0045A860 83EA01                  sub edx, 00000001
:0045A863 8B4514                  mov eax, dword ptr [ebp+14]
:0045A866 25FF000000              and eax, 000000FF
:0045A86B 3BD0                    cmp edx, eax
:0045A86D 7D10                    jge 0045A87F
:0045A86F 33C9                    xor ecx, ecx
:0045A871 8A0D2D424B00            mov cl, byte ptr [004B422D]
:0045A877 83E901                  sub ecx, 00000001
:0045A87A 894DDC                  mov dword ptr [ebp-24], ecx
:0045A87D EB0C                    jmp 0045A88B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A86D(C)
|
:0045A87F 8B5514                  mov edx, dword ptr [ebp+14]
:0045A882 81E2FF000000            and edx, 000000FF
:0045A888 8955DC                  mov dword ptr [ebp-24], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A87D(U)
|
:0045A88B 8A45DC                  mov al, byte ptr [ebp-24]
:0045A88E 884514                  mov byte ptr [ebp+14], al
:0045A891 8A4D0C                  mov cl, byte ptr [ebp+0C]
:0045A894 884DF4                  mov byte ptr [ebp-0C], cl
:0045A897 EB09                    jmp 0045A8A2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045AA35(U)
|
:0045A899 8A55F4                  mov dl, byte ptr [ebp-0C]
:0045A89C 80C201                  add dl, 01
:0045A89F 8855F4                  mov byte ptr [ebp-0C], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A897(U)
|
:0045A8A2 8B45F4                  mov eax, dword ptr [ebp-0C]
:0045A8A5 25FF000000              and eax, 000000FF
:0045A8AA 8B4D14                  mov ecx, dword ptr [ebp+14]
:0045A8AD 81E1FF000000            and ecx, 000000FF
:0045A8B3 3BC1                    cmp eax, ecx
:0045A8B5 0F8F7F010000            jg 0045AA3A
:0045A8BB 8A5508                  mov dl, byte ptr [ebp+08]
:0045A8BE 8855F8                  mov byte ptr [ebp-08], dl
:0045A8C1 EB08                    jmp 0045A8CB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045AA30(U)
|
:0045A8C3 8A45F8                  mov al, byte ptr [ebp-08]
:0045A8C6 0401                    add al, 01
:0045A8C8 8845F8                  mov byte ptr [ebp-08], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A8C1(U)
|
:0045A8CB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045A8CE 81E1FF000000            and ecx, 000000FF
:0045A8D4 8B5510                  mov edx, dword ptr [ebp+10]
:0045A8D7 81E2FF000000            and edx, 000000FF
:0045A8DD 3BCA                    cmp ecx, edx
:0045A8DF 0F8F50010000            jg 0045AA35
:0045A8E5 8A45F8                  mov al, byte ptr [ebp-08]
:0045A8E8 8845F0                  mov byte ptr [ebp-10], al
:0045A8EB 8A4DF4                  mov cl, byte ptr [ebp-0C]
:0045A8EE 884DF1                  mov byte ptr [ebp-0F], cl
:0045A8F1 8D55F0                  lea edx, dword ptr [ebp-10]
:0045A8F4 52                      push edx
:0045A8F5 E88AAFFDFF              call 00435884
:0045A8FA 83C404                  add esp, 00000004
:0045A8FD 8845FC                  mov byte ptr [ebp-04], al
:0045A900 8B45FC                  mov eax, dword ptr [ebp-04]
:0045A903 25FF000000              and eax, 000000FF
:0045A908 3DFF000000              cmp eax, 000000FF
:0045A90D 0F841D010000            je 0045AA30
:0045A913 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045A916 81E1FF000000            and ecx, 000000FF
:0045A91C 6BC924                  imul ecx, 00000024
:0045A91F 81C1502C4B00            add ecx, 004B2C50
:0045A925 E866E3FBFF              call 00418C90
:0045A92A 25FF000000              and eax, 000000FF
:0045A92F 83F802                  cmp eax, 00000002
:0045A932 0F85F8000000            jne 0045AA30
:0045A938 C745E800000000          mov [ebp-18], 00000000
:0045A93F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045A942 81E1FF000000            and ecx, 000000FF
:0045A948 6BC924                  imul ecx, 00000024
:0045A94B 81C1502C4B00            add ecx, 004B2C50
:0045A951 E8C452FEFF              call 0043FC1A
:0045A956 8845EC                  mov byte ptr [ebp-14], al
:0045A959 8B4D18                  mov ecx, dword ptr [ebp+18]
:0045A95C 81E1FF000000            and ecx, 000000FF
:0045A962 894DD8                  mov dword ptr [ebp-28], ecx
:0045A965 837DD806                cmp dword ptr [ebp-28], 00000006
:0045A969 0F8793000000            ja 0045AA02
:0045A96F 8B55D8                  mov edx, dword ptr [ebp-28]
:0045A972 FF249540AA4500          jmp dword ptr [4*edx+0045AA40]
:0045A979 8B4518                  mov eax, dword ptr [ebp+18]
:0045A97C 25FF000000              and eax, 000000FF
:0045A981 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0045A984 81E1FF000000            and ecx, 000000FF
:0045A98A 33D2                    xor edx, edx
:0045A98C 3BC1                    cmp eax, ecx
:0045A98E 0F94C2                  sete dl
:0045A991 8955E8                  mov dword ptr [ebp-18], edx
:0045A994 EB6C                    jmp 0045AA02
:0045A996 8B45EC                  mov eax, dword ptr [ebp-14]
:0045A999 25FF000000              and eax, 000000FF
:0045A99E 85C0                    test eax, eax
:0045A9A0 7417                    je 0045A9B9
:0045A9A2 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0045A9A5 81E1FF000000            and ecx, 000000FF
:0045A9AB 83F901                  cmp ecx, 00000001
:0045A9AE 7409                    je 0045A9B9
:0045A9B0 C745D400000000          mov [ebp-2C], 00000000
:0045A9B7 EB07                    jmp 0045A9C0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045A9A0(C), :0045A9AE(C)
|
:0045A9B9 C745D401000000          mov [ebp-2C], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A9B7(U)
|
:0045A9C0 8B55D4                  mov edx, dword ptr [ebp-2C]
:0045A9C3 8955E8                  mov dword ptr [ebp-18], edx
:0045A9C6 EB3A                    jmp 0045AA02
:0045A9C8 8B45EC                  mov eax, dword ptr [ebp-14]
:0045A9CB 25FF000000              and eax, 000000FF
:0045A9D0 83F802                  cmp eax, 00000002
:0045A9D3 7417                    je 0045A9EC
:0045A9D5 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0045A9D8 81E1FF000000            and ecx, 000000FF
:0045A9DE 83F903                  cmp ecx, 00000003
:0045A9E1 7409                    je 0045A9EC
:0045A9E3 C745D000000000          mov [ebp-30], 00000000
:0045A9EA EB07                    jmp 0045A9F3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045A9D3(C), :0045A9E1(C)
|
:0045A9EC C745D001000000          mov [ebp-30], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A9EA(U)
|
:0045A9F3 8B55D0                  mov edx, dword ptr [ebp-30]
:0045A9F6 8955E8                  mov dword ptr [ebp-18], edx
:0045A9F9 EB07                    jmp 0045AA02
:0045A9FB C745E801000000          mov [ebp-18], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045A969(C), :0045A994(U), :0045A9C6(U), :0045A9F9(U)
|
:0045AA02 837DE800                cmp dword ptr [ebp-18], 00000000
:0045AA06 7428                    je 0045AA30
:0045AA08 8B4520                  mov eax, dword ptr [ebp+20]
:0045AA0B 50                      push eax
:0045AA0C 8B4D1C                  mov ecx, dword ptr [ebp+1C]
:0045AA0F 51                      push ecx
:0045AA10 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045AA13 81E1FF000000            and ecx, 000000FF
:0045AA19 6BC924                  imul ecx, 00000024
:0045AA1C 81C1502C4B00            add ecx, 004B2C50
:0045AA22 E8494C0000              call 0045F670
:0045AA27 50                      push eax
:0045AA28 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0045AA2B E887FDFFFF              call 0045A7B7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045A90D(C), :0045A932(C), :0045AA06(C)
|
:0045AA30 E98EFEFFFF              jmp 0045A8C3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A8DF(C)
|
:0045AA35 E95FFEFFFF              jmp 0045A899

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045A8B5(C)
|
:0045AA3A 8BE5                    mov esp, ebp
:0045AA3C 5D                      pop ebp
:0045AA3D C21C00                  ret 001C



:0045AA40 79A94500                DWORD 0045A979
:0045AA44 79A94500                DWORD 0045A979
:0045AA48 79A94500                DWORD 0045A979
:0045AA4C 79A94500                DWORD 0045A979
:0045AA50 96A94500                DWORD 0045A996
:0045AA54 C8A94500                DWORD 0045A9C8
:0045AA58 FBA94500                DWORD 0045A9FB



* Referenced by a CALL at Addresses:
|:004153F4   , :00415467   , :004154CD   , :00415535   , :0043C827   
|:0043C876   , :0043C8B3   , :0043C92F   , :0043C96C   , :0043CA20   
|:0043CA5B   , :0043CAD3   , :0043CB0E   , :0043CB85   , :0043CBBF   
|:0043CC35   , :0043CC70   , :0043CCE8   , :0043CD23   , :0043CD9A   
|:0043CDD4   , :0045AF99   
|
:0045AA5C 55                      push ebp
:0045AA5D 8BEC                    mov ebp, esp
:0045AA5F 83EC24                  sub esp, 00000024
:0045AA62 894DF0                  mov dword ptr [ebp-10], ecx
:0045AA65 817D0800020000          cmp dword ptr [ebp+08], 00000200
:0045AA6C 7605                    jbe 0045AA73
:0045AA6E E948030000              jmp 0045ADBB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045AA6C(C)
|
:0045AA73 8B4508                  mov eax, dword ptr [ebp+08]
:0045AA76 50                      push eax
:0045AA77 E85A3AFEFF              call 0043E4D6
:0045AA7C 83C404                  add esp, 00000004
:0045AA7F 8845FC                  mov byte ptr [ebp-04], al
:0045AA82 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045AA85 81E1FF000000            and ecx, 000000FF
:0045AA8B 81F9FF000000            cmp ecx, 000000FF
:0045AA91 7421                    je 0045AAB4
:0045AA93 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045AA96 81E1FF000000            and ecx, 000000FF
:0045AA9C 6BC924                  imul ecx, 00000024
:0045AA9F 81C1502C4B00            add ecx, 004B2C50
:0045AAA5 E8E6E1FBFF              call 00418C90
:0045AAAA 25FF000000              and eax, 000000FF
:0045AAAF 83F802                  cmp eax, 00000002
:0045AAB2 7405                    je 0045AAB9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045AA91(C)
|
:0045AAB4 E902030000              jmp 0045ADBB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045AAB2(C)
|
:0045AAB9 837D1400                cmp dword ptr [ebp+14], 00000000
:0045AABD 7422                    je 0045AAE1
:0045AABF 8B550C                  mov edx, dword ptr [ebp+0C]
:0045AAC2 81E2FF000000            and edx, 000000FF
:0045AAC8 83FA06                  cmp edx, 00000006
:0045AACB 7F14                    jg 0045AAE1
:0045AACD 8A4510                  mov al, byte ptr [ebp+10]
:0045AAD0 50                      push eax
:0045AAD1 8A4D0C                  mov cl, byte ptr [ebp+0C]
:0045AAD4 51                      push ecx
:0045AAD5 8A55FC                  mov dl, byte ptr [ebp-04]
:0045AAD8 52                      push edx
:0045AAD9 E8C13BFEFF              call 0043E69F
:0045AADE 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045AABD(C), :0045AACB(C)
|
:0045AAE1 8B450C                  mov eax, dword ptr [ebp+0C]
:0045AAE4 25FF000000              and eax, 000000FF
:0045AAE9 8945EC                  mov dword ptr [ebp-14], eax
:0045AAEC 837DEC08                cmp dword ptr [ebp-14], 00000008
:0045AAF0 0F878E020000            ja 0045AD84
:0045AAF6 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0045AAF9 FF248DC1AD4500          jmp dword ptr [4*ecx+0045ADC1]
:0045AB00 8A5510                  mov dl, byte ptr [ebp+10]
:0045AB03 52                      push edx
:0045AB04 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045AB07 81E1FF000000            and ecx, 000000FF
:0045AB0D 6BC924                  imul ecx, 00000024
:0045AB10 81C1502C4B00            add ecx, 004B2C50
:0045AB16 E8350D0000              call 0045B850
:0045AB1B E964020000              jmp 0045AD84
:0045AB20 8A4510                  mov al, byte ptr [ebp+10]
:0045AB23 50                      push eax
:0045AB24 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045AB27 81E1FF000000            and ecx, 000000FF
:0045AB2D 6BC924                  imul ecx, 00000024
:0045AB30 81C1502C4B00            add ecx, 004B2C50
:0045AB36 E8350D0000              call 0045B870
:0045AB3B E944020000              jmp 0045AD84
:0045AB40 8A4D10                  mov cl, byte ptr [ebp+10]
:0045AB43 51                      push ecx
:0045AB44 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045AB47 81E1FF000000            and ecx, 000000FF
:0045AB4D 6BC924                  imul ecx, 00000024
:0045AB50 81C1502C4B00            add ecx, 004B2C50
:0045AB56 E8350D0000              call 0045B890
:0045AB5B E924020000              jmp 0045AD84
:0045AB60 8A5510                  mov dl, byte ptr [ebp+10]
:0045AB63 52                      push edx
:0045AB64 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045AB67 81E1FF000000            and ecx, 000000FF
:0045AB6D 6BC924                  imul ecx, 00000024
:0045AB70 81C1502C4B00            add ecx, 004B2C50
:0045AB76 E8350D0000              call 0045B8B0
:0045AB7B E904020000              jmp 0045AD84
:0045AB80 8A4510                  mov al, byte ptr [ebp+10]
:0045AB83 50                      push eax
:0045AB84 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045AB87 81E1FF000000            and ecx, 000000FF
:0045AB8D 6BC924                  imul ecx, 00000024
:0045AB90 81C1502C4B00            add ecx, 004B2C50
:0045AB96 E8350D0000              call 0045B8D0
:0045AB9B E9E4010000              jmp 0045AD84
:0045ABA0 8A4D10                  mov cl, byte ptr [ebp+10]
:0045ABA3 51                      push ecx
:0045ABA4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045ABA7 81E1FF000000            and ecx, 000000FF
:0045ABAD 6BC924                  imul ecx, 00000024
:0045ABB0 81C1502C4B00            add ecx, 004B2C50
:0045ABB6 E8350D0000              call 0045B8F0
:0045ABBB E9C4010000              jmp 0045AD84
:0045ABC0 8B5510                  mov edx, dword ptr [ebp+10]
:0045ABC3 81E2FF000000            and edx, 000000FF
:0045ABC9 81E280000000            and edx, 00000080
:0045ABCF 85D2                    test edx, edx
:0045ABD1 741D                    je 0045ABF0
:0045ABD3 8A4510                  mov al, byte ptr [ebp+10]
:0045ABD6 50                      push eax
:0045ABD7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045ABDA 81E1FF000000            and ecx, 000000FF
:0045ABE0 6BC924                  imul ecx, 00000024
:0045ABE3 81C1502C4B00            add ecx, 004B2C50
:0045ABE9 E8B2E1FBFF              call 00418DA0
:0045ABEE EB1B                    jmp 0045AC0B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045ABD1(C)
|
:0045ABF0 8A4D10                  mov cl, byte ptr [ebp+10]
:0045ABF3 51                      push ecx
:0045ABF4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045ABF7 81E1FF000000            and ecx, 000000FF
:0045ABFD 6BC924                  imul ecx, 00000024
:0045AC00 81C1502C4B00            add ecx, 004B2C50
:0045AC06 E8B5BAFAFF              call 004066C0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045ABEE(U)
|
:0045AC0B E974010000              jmp 0045AD84
:0045AC10 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045AC13 81E1FF000000            and ecx, 000000FF
:0045AC19 6BC924                  imul ecx, 00000024
:0045AC1C 81C1502C4B00            add ecx, 004B2C50
:0045AC22 E869800100              call 00472C90
:0045AC27 8B5510                  mov edx, dword ptr [ebp+10]
:0045AC2A 81E2FF000000            and edx, 000000FF
:0045AC30 3BC2                    cmp eax, edx
:0045AC32 7D1C                    jge 0045AC50
:0045AC34 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045AC37 81E1FF000000            and ecx, 000000FF
:0045AC3D 6BC924                  imul ecx, 00000024
:0045AC40 81C1502C4B00            add ecx, 004B2C50
:0045AC46 E845800100              call 00472C90
:0045AC4B 8945E8                  mov dword ptr [ebp-18], eax
:0045AC4E EB0B                    jmp 0045AC5B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045AC32(C)
|
:0045AC50 8B4510                  mov eax, dword ptr [ebp+10]
:0045AC53 25FF000000              and eax, 000000FF
:0045AC58 8945E8                  mov dword ptr [ebp-18], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045AC4E(U)
|
:0045AC5B 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0045AC5E 894DF4                  mov dword ptr [ebp-0C], ecx
:0045AC61 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045AC64 81E1FF000000            and ecx, 000000FF
:0045AC6A 6BC924                  imul ecx, 00000024
:0045AC6D 81C1502C4B00            add ecx, 004B2C50
:0045AC73 E818800100              call 00472C90
:0045AC78 2B45F4                  sub eax, dword ptr [ebp-0C]
:0045AC7B 83F801                  cmp eax, 00000001
:0045AC7E 761F                    jbe 0045AC9F
:0045AC80 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045AC83 81E1FF000000            and ecx, 000000FF
:0045AC89 6BC924                  imul ecx, 00000024
:0045AC8C 81C1502C4B00            add ecx, 004B2C50
:0045AC92 E8F97F0100              call 00472C90
:0045AC97 2B45F4                  sub eax, dword ptr [ebp-0C]
:0045AC9A 8945E4                  mov dword ptr [ebp-1C], eax
:0045AC9D EB07                    jmp 0045ACA6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045AC7E(C)
|
:0045AC9F C745E401000000          mov [ebp-1C], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045AC9D(U)
|
:0045ACA6 8B55E4                  mov edx, dword ptr [ebp-1C]
:0045ACA9 8955F8                  mov dword ptr [ebp-08], edx
:0045ACAC 8B45F8                  mov eax, dword ptr [ebp-08]
:0045ACAF 50                      push eax
:0045ACB0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045ACB3 81E1FF000000            and ecx, 000000FF
:0045ACB9 6BC924                  imul ecx, 00000024
:0045ACBC 81C1502C4B00            add ecx, 004B2C50
:0045ACC2 E8064AFEFF              call 0043F6CD
:0045ACC7 E9B8000000              jmp 0045AD84
:0045ACCC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045ACCF 81E1FF000000            and ecx, 000000FF
:0045ACD5 6BC924                  imul ecx, 00000024
:0045ACD8 81C1502C4B00            add ecx, 004B2C50
:0045ACDE E85D7B0100              call 00472840
:0045ACE3 8B4D10                  mov ecx, dword ptr [ebp+10]
:0045ACE6 81E1FF000000            and ecx, 000000FF
:0045ACEC 3BC1                    cmp eax, ecx
:0045ACEE 7D1C                    jge 0045AD0C
:0045ACF0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045ACF3 81E1FF000000            and ecx, 000000FF
:0045ACF9 6BC924                  imul ecx, 00000024
:0045ACFC 81C1502C4B00            add ecx, 004B2C50
:0045AD02 E8397B0100              call 00472840
:0045AD07 8945E0                  mov dword ptr [ebp-20], eax
:0045AD0A EB0C                    jmp 0045AD18

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045ACEE(C)
|
:0045AD0C 8B5510                  mov edx, dword ptr [ebp+10]
:0045AD0F 81E2FF000000            and edx, 000000FF
:0045AD15 8955E0                  mov dword ptr [ebp-20], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045AD0A(U)
|
:0045AD18 8B45E0                  mov eax, dword ptr [ebp-20]
:0045AD1B 8945F4                  mov dword ptr [ebp-0C], eax
:0045AD1E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045AD21 81E1FF000000            and ecx, 000000FF
:0045AD27 6BC924                  imul ecx, 00000024
:0045AD2A 81C1502C4B00            add ecx, 004B2C50
:0045AD30 E80B7B0100              call 00472840
:0045AD35 2B45F4                  sub eax, dword ptr [ebp-0C]
:0045AD38 83F801                  cmp eax, 00000001
:0045AD3B 761F                    jbe 0045AD5C
:0045AD3D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045AD40 81E1FF000000            and ecx, 000000FF
:0045AD46 6BC924                  imul ecx, 00000024
:0045AD49 81C1502C4B00            add ecx, 004B2C50
:0045AD4F E8EC7A0100              call 00472840
:0045AD54 2B45F4                  sub eax, dword ptr [ebp-0C]
:0045AD57 8945DC                  mov dword ptr [ebp-24], eax
:0045AD5A EB07                    jmp 0045AD63

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045AD3B(C)
|
:0045AD5C C745DC01000000          mov [ebp-24], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045AD5A(U)
|
:0045AD63 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0045AD66 894DF8                  mov dword ptr [ebp-08], ecx
:0045AD69 8B55F8                  mov edx, dword ptr [ebp-08]
:0045AD6C 52                      push edx
:0045AD6D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045AD70 81E1FF000000            and ecx, 000000FF
:0045AD76 6BC924                  imul ecx, 00000024
:0045AD79 81C1502C4B00            add ecx, 004B2C50
:0045AD7F E88A49FEFF              call 0043F70E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045AAF0(C), :0045AB1B(U), :0045AB3B(U), :0045AB5B(U), :0045AB7B(U)
|:0045AB9B(U), :0045ABBB(U), :0045AC0B(U), :0045ACC7(U)
|
:0045AD84 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045AD87 81E1FF000000            and ecx, 000000FF
:0045AD8D 6BC924                  imul ecx, 00000024
:0045AD90 81C1502C4B00            add ecx, 004B2C50
:0045AD96 E82E4FFEFF              call 0043FCC9
:0045AD9B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045AD9E 81E1FF000000            and ecx, 000000FF
:0045ADA4 6BC924                  imul ecx, 00000024
:0045ADA7 81C1502C4B00            add ecx, 004B2C50
:0045ADAD E8BE480000              call 0045F670
:0045ADB2 50                      push eax
:0045ADB3 E849EC0100              call 00479A01
:0045ADB8 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045AA6E(U), :0045AAB4(U)
|
:0045ADBB 8BE5                    mov esp, ebp
:0045ADBD 5D                      pop ebp
:0045ADBE C21000                  ret 0010



:0045ADC1 00AB4500                DWORD 0045AB00
:0045ADC5 20AB4500                DWORD 0045AB20
:0045ADC9 40AB4500                DWORD 0045AB40
:0045ADCD 60AB4500                DWORD 0045AB60
:0045ADD1 80AB4500                DWORD 0045AB80
:0045ADD5 A0AB4500                DWORD 0045ABA0
:0045ADD9 C0AB4500                DWORD 0045ABC0
:0045ADDD 10AC4500                DWORD 0045AC10
:0045ADE1 CCAC4500                DWORD 0045ACCC



* Referenced by a CALL at Addresses:
|:0041542D   , :0041549E   , :00415505   , :0041556D   
|
:0045ADE5 55                      push ebp
:0045ADE6 8BEC                    mov ebp, esp
:0045ADE8 83EC2C                  sub esp, 0000002C
:0045ADEB 894DE0                  mov dword ptr [ebp-20], ecx
:0045ADEE 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0045ADF1 E81A490000              call 0045F710
:0045ADF6 8A450C                  mov al, byte ptr [ebp+0C]
:0045ADF9 8845F4                  mov byte ptr [ebp-0C], al
:0045ADFC EB09                    jmp 0045AE07

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045AFA3(U)
|
:0045ADFE 8A4DF4                  mov cl, byte ptr [ebp-0C]
:0045AE01 80C101                  add cl, 01
:0045AE04 884DF4                  mov byte ptr [ebp-0C], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045ADFC(U)
|
:0045AE07 8B55F4                  mov edx, dword ptr [ebp-0C]
:0045AE0A 81E2FF000000            and edx, 000000FF
:0045AE10 8B4514                  mov eax, dword ptr [ebp+14]
:0045AE13 25FF000000              and eax, 000000FF
:0045AE18 3BD0                    cmp edx, eax
:0045AE1A 0F8F88010000            jg 0045AFA8
:0045AE20 8A4D08                  mov cl, byte ptr [ebp+08]
:0045AE23 884DF8                  mov byte ptr [ebp-08], cl
:0045AE26 EB09                    jmp 0045AE31

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045AF9E(U)
|
:0045AE28 8A55F8                  mov dl, byte ptr [ebp-08]
:0045AE2B 80C201                  add dl, 01
:0045AE2E 8855F8                  mov byte ptr [ebp-08], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045AE26(U)
|
:0045AE31 8B45F8                  mov eax, dword ptr [ebp-08]
:0045AE34 25FF000000              and eax, 000000FF
:0045AE39 8B4D10                  mov ecx, dword ptr [ebp+10]
:0045AE3C 81E1FF000000            and ecx, 000000FF
:0045AE42 3BC1                    cmp eax, ecx
:0045AE44 0F8F59010000            jg 0045AFA3
:0045AE4A 8A55F8                  mov dl, byte ptr [ebp-08]
:0045AE4D 8855F0                  mov byte ptr [ebp-10], dl
:0045AE50 8A45F4                  mov al, byte ptr [ebp-0C]
:0045AE53 8845F1                  mov byte ptr [ebp-0F], al
:0045AE56 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0045AE59 51                      push ecx
:0045AE5A E825AAFDFF              call 00435884
:0045AE5F 83C404                  add esp, 00000004
:0045AE62 8845FC                  mov byte ptr [ebp-04], al
:0045AE65 8B55FC                  mov edx, dword ptr [ebp-04]
:0045AE68 81E2FF000000            and edx, 000000FF
:0045AE6E 81FAFF000000            cmp edx, 000000FF
:0045AE74 0F8424010000            je 0045AF9E
:0045AE7A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045AE7D 81E1FF000000            and ecx, 000000FF
:0045AE83 6BC924                  imul ecx, 00000024
:0045AE86 81C1502C4B00            add ecx, 004B2C50
:0045AE8C E8FFDDFBFF              call 00418C90
:0045AE91 25FF000000              and eax, 000000FF
:0045AE96 83F802                  cmp eax, 00000002
:0045AE99 0F85FF000000            jne 0045AF9E
:0045AE9F C745E800000000          mov [ebp-18], 00000000
:0045AEA6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045AEA9 81E1FF000000            and ecx, 000000FF
:0045AEAF 6BC924                  imul ecx, 00000024
:0045AEB2 81C1502C4B00            add ecx, 004B2C50
:0045AEB8 E85D4DFEFF              call 0043FC1A
:0045AEBD 8845EC                  mov byte ptr [ebp-14], al
:0045AEC0 8B4518                  mov eax, dword ptr [ebp+18]
:0045AEC3 25FF000000              and eax, 000000FF
:0045AEC8 8945DC                  mov dword ptr [ebp-24], eax
:0045AECB 837DDC06                cmp dword ptr [ebp-24], 00000006
:0045AECF 0F8793000000            ja 0045AF68
:0045AED5 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0045AED8 FF248DAEAF4500          jmp dword ptr [4*ecx+0045AFAE]
:0045AEDF 8B5518                  mov edx, dword ptr [ebp+18]
:0045AEE2 81E2FF000000            and edx, 000000FF
:0045AEE8 8B45EC                  mov eax, dword ptr [ebp-14]
:0045AEEB 25FF000000              and eax, 000000FF
:0045AEF0 33C9                    xor ecx, ecx
:0045AEF2 3BD0                    cmp edx, eax
:0045AEF4 0F94C1                  sete cl
:0045AEF7 894DE8                  mov dword ptr [ebp-18], ecx
:0045AEFA EB6C                    jmp 0045AF68
:0045AEFC 8B55EC                  mov edx, dword ptr [ebp-14]
:0045AEFF 81E2FF000000            and edx, 000000FF
:0045AF05 85D2                    test edx, edx
:0045AF07 7416                    je 0045AF1F
:0045AF09 8B45EC                  mov eax, dword ptr [ebp-14]
:0045AF0C 25FF000000              and eax, 000000FF
:0045AF11 83F801                  cmp eax, 00000001
:0045AF14 7409                    je 0045AF1F
:0045AF16 C745D800000000          mov [ebp-28], 00000000
:0045AF1D EB07                    jmp 0045AF26

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045AF07(C), :0045AF14(C)
|
:0045AF1F C745D801000000          mov [ebp-28], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045AF1D(U)
|
:0045AF26 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0045AF29 894DE8                  mov dword ptr [ebp-18], ecx
:0045AF2C EB3A                    jmp 0045AF68
:0045AF2E 8B55EC                  mov edx, dword ptr [ebp-14]
:0045AF31 81E2FF000000            and edx, 000000FF
:0045AF37 83FA02                  cmp edx, 00000002
:0045AF3A 7416                    je 0045AF52
:0045AF3C 8B45EC                  mov eax, dword ptr [ebp-14]
:0045AF3F 25FF000000              and eax, 000000FF
:0045AF44 83F803                  cmp eax, 00000003
:0045AF47 7409                    je 0045AF52
:0045AF49 C745D400000000          mov [ebp-2C], 00000000
:0045AF50 EB07                    jmp 0045AF59

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045AF3A(C), :0045AF47(C)
|
:0045AF52 C745D401000000          mov [ebp-2C], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045AF50(U)
|
:0045AF59 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0045AF5C 894DE8                  mov dword ptr [ebp-18], ecx
:0045AF5F EB07                    jmp 0045AF68
:0045AF61 C745E801000000          mov [ebp-18], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045AECF(C), :0045AEFA(U), :0045AF2C(U), :0045AF5F(U)
|
:0045AF68 837DE800                cmp dword ptr [ebp-18], 00000000
:0045AF6C 7430                    je 0045AF9E
:0045AF6E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045AF71 81E1FF000000            and ecx, 000000FF
:0045AF77 6BC924                  imul ecx, 00000024
:0045AF7A 81C1502C4B00            add ecx, 004B2C50
:0045AF80 E8EB460000              call 0045F670
:0045AF85 8945E4                  mov dword ptr [ebp-1C], eax
:0045AF88 6A01                    push 00000001
:0045AF8A 8A5520                  mov dl, byte ptr [ebp+20]
:0045AF8D 52                      push edx
:0045AF8E 8A451C                  mov al, byte ptr [ebp+1C]
:0045AF91 50                      push eax
:0045AF92 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0045AF95 51                      push ecx
:0045AF96 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0045AF99 E8BEFAFFFF              call 0045AA5C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045AE74(C), :0045AE99(C), :0045AF6C(C)
|
:0045AF9E E985FEFFFF              jmp 0045AE28

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045AE44(C)
|
:0045AFA3 E956FEFFFF              jmp 0045ADFE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045AE1A(C)
|
:0045AFA8 8BE5                    mov esp, ebp
:0045AFAA 5D                      pop ebp
:0045AFAB C21C00                  ret 001C



:0045AFAE DFAE4500                DWORD 0045AEDF
:0045AFB2 DFAE4500                DWORD 0045AEDF
:0045AFB6 DFAE4500                DWORD 0045AEDF
:0045AFBA DFAE4500                DWORD 0045AEDF
:0045AFBE FCAE4500                DWORD 0045AEFC
:0045AFC2 2EAF4500                DWORD 0045AF2E
:0045AFC6 61AF4500                DWORD 0045AF61



* Referenced by a CALL at Addresses:
|:00411B3A   , :0043993A   
|
:0045AFCA 55                      push ebp
:0045AFCB 8BEC                    mov ebp, esp
:0045AFCD 83EC1C                  sub esp, 0000001C
:0045AFD0 56                      push esi
:0045AFD1 894DE4                  mov dword ptr [ebp-1C], ecx
:0045AFD4 C745F000000000          mov [ebp-10], 00000000
:0045AFDB 8D4DE8                  lea ecx, dword ptr [ebp-18]
:0045AFDE E82D470000              call 0045F710
:0045AFE3 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0045AFE6 E825470000              call 0045F710
:0045AFEB E83209FBFF              call 0040B922
:0045AFF0 85C0                    test eax, eax
:0045AFF2 0F84A6020000            je 0045B29E
:0045AFF8 817D0C00020000          cmp dword ptr [ebp+0C], 00000200
:0045AFFF 0F82F6000000            jb 0045B0FB
:0045B005 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045B008 6BC948                  imul ecx, 00000048
:0045B00B 81C1681B4A00            add ecx, 004A1B68
:0045B011 E8C6CA0100              call 00477ADC
:0045B016 8845F4                  mov byte ptr [ebp-0C], al
:0045B019 8B45F4                  mov eax, dword ptr [ebp-0C]
:0045B01C 25FF000000              and eax, 000000FF
:0045B021 3DFF000000              cmp eax, 000000FF
:0045B026 743C                    je 0045B064
:0045B028 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0045B02B 81E1FF000000            and ecx, 000000FF
:0045B031 6BC924                  imul ecx, 00000024
:0045B034 81C1502C4B00            add ecx, 004B2C50
:0045B03A E851DCFBFF              call 00418C90
:0045B03F 25FF000000              and eax, 000000FF
:0045B044 83F802                  cmp eax, 00000002
:0045B047 751B                    jne 0045B064
:0045B049 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0045B04C 81E1FF000000            and ecx, 000000FF
:0045B052 6BC924                  imul ecx, 00000024
:0045B055 81C1502C4B00            add ecx, 004B2C50
:0045B05B E8307C0100              call 00472C90
:0045B060 85C0                    test eax, eax
:0045B062 7708                    ja 0045B06C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045B026(C), :0045B047(C)
|
:0045B064 8B45F0                  mov eax, dword ptr [ebp-10]
:0045B067 E935020000              jmp 0045B2A1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B062(C)
|
:0045B06C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0045B06F 81E1FF000000            and ecx, 000000FF
:0045B075 6BC924                  imul ecx, 00000024
:0045B078 81C1502C4B00            add ecx, 004B2C50
:0045B07E E8DD82FAFF              call 00403360
:0045B083 50                      push eax
:0045B084 8D4DE8                  lea ecx, dword ptr [ebp-18]
:0045B087 E814B5FAFF              call 004065A0
:0045B08C C645EC00                mov [ebp-14], 00
:0045B090 EB09                    jmp 0045B09B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B0F4(U)
|
:0045B092 8A4DEC                  mov cl, byte ptr [ebp-14]
:0045B095 80C101                  add cl, 01
:0045B098 884DEC                  mov byte ptr [ebp-14], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B090(U)
|
:0045B09B 8B55EC                  mov edx, dword ptr [ebp-14]
:0045B09E 81E2FF000000            and edx, 000000FF
:0045B0A4 83FA08                  cmp edx, 00000008
:0045B0A7 7D4D                    jge 0045B0F6
:0045B0A9 8A45EC                  mov al, byte ptr [ebp-14]
:0045B0AC 50                      push eax
:0045B0AD 8D4DE8                  lea ecx, dword ptr [ebp-18]
:0045B0B0 51                      push ecx
:0045B0B1 E83FA9FDFF              call 004359F5
:0045B0B6 83C408                  add esp, 00000008
:0045B0B9 50                      push eax
:0045B0BA 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0045B0BD E8DEB4FAFF              call 004065A0
:0045B0C2 8B55FC                  mov edx, dword ptr [ebp-04]
:0045B0C5 81E2FF000000            and edx, 000000FF
:0045B0CB 81FAFF000000            cmp edx, 000000FF
:0045B0D1 7421                    je 0045B0F4
:0045B0D3 8A45FD                  mov al, byte ptr [ebp-03]
:0045B0D6 50                      push eax
:0045B0D7 8A4DFC                  mov cl, byte ptr [ebp-04]
:0045B0DA 51                      push ecx
:0045B0DB 8B550C                  mov edx, dword ptr [ebp+0C]
:0045B0DE 52                      push edx
:0045B0DF 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0045B0E2 E88A020000              call 0045B371
:0045B0E7 85C0                    test eax, eax
:0045B0E9 7409                    je 0045B0F4
:0045B0EB C745F001000000          mov [ebp-10], 00000001
:0045B0F2 EB02                    jmp 0045B0F6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045B0D1(C), :0045B0E9(C)
|
:0045B0F4 EB9C                    jmp 0045B092

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045B0A7(C), :0045B0F2(U)
|
:0045B0F6 E9A3010000              jmp 0045B29E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045AFFF(C)
|
:0045B0FB 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045B0FE 6BC948                  imul ecx, 00000048
:0045B101 81C1681B4A00            add ecx, 004A1B68
:0045B107 E8D0C90100              call 00477ADC
:0045B10C 8845F4                  mov byte ptr [ebp-0C], al
:0045B10F 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0045B112 6BC948                  imul ecx, 00000048
:0045B115 81C1681B4A00            add ecx, 004A1B68
:0045B11B E8BCC90100              call 00477ADC
:0045B120 8845F8                  mov byte ptr [ebp-08], al
:0045B123 8B45F4                  mov eax, dword ptr [ebp-0C]
:0045B126 25FF000000              and eax, 000000FF
:0045B12B 3DFF000000              cmp eax, 000000FF
:0045B130 7411                    je 0045B143
:0045B132 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045B135 81E1FF000000            and ecx, 000000FF
:0045B13B 81F9FF000000            cmp ecx, 000000FF
:0045B141 7508                    jne 0045B14B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B130(C)
|
:0045B143 8B45F0                  mov eax, dword ptr [ebp-10]
:0045B146 E956010000              jmp 0045B2A1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B141(C)
|
:0045B14B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0045B14E 81E1FF000000            and ecx, 000000FF
:0045B154 6BC924                  imul ecx, 00000024
:0045B157 81C1502C4B00            add ecx, 004B2C50
:0045B15D E82EDBFBFF              call 00418C90
:0045B162 25FF000000              and eax, 000000FF
:0045B167 83F802                  cmp eax, 00000002
:0045B16A 7521                    jne 0045B18D
:0045B16C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045B16F 81E1FF000000            and ecx, 000000FF
:0045B175 6BC924                  imul ecx, 00000024
:0045B178 81C1502C4B00            add ecx, 004B2C50
:0045B17E E80DDBFBFF              call 00418C90
:0045B183 25FF000000              and eax, 000000FF
:0045B188 83F802                  cmp eax, 00000002
:0045B18B 7408                    je 0045B195

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B16A(C)
|
:0045B18D 8B45F0                  mov eax, dword ptr [ebp-10]
:0045B190 E90C010000              jmp 0045B2A1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B18B(C)
|
:0045B195 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0045B198 81E1FF000000            and ecx, 000000FF
:0045B19E 6BC924                  imul ecx, 00000024
:0045B1A1 81C1502C4B00            add ecx, 004B2C50
:0045B1A7 E8E47A0100              call 00472C90
:0045B1AC 85C0                    test eax, eax
:0045B1AE 761B                    jbe 0045B1CB
:0045B1B0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045B1B3 81E1FF000000            and ecx, 000000FF
:0045B1B9 6BC924                  imul ecx, 00000024
:0045B1BC 81C1502C4B00            add ecx, 004B2C50
:0045B1C2 E8C97A0100              call 00472C90
:0045B1C7 85C0                    test eax, eax
:0045B1C9 7708                    ja 0045B1D3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B1AE(C)
|
:0045B1CB 8B45F0                  mov eax, dword ptr [ebp-10]
:0045B1CE E9CE000000              jmp 0045B2A1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B1C9(C)
|
:0045B1D3 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0045B1D6 81E1FF000000            and ecx, 000000FF
:0045B1DC 6BC924                  imul ecx, 00000024
:0045B1DF 81C1502C4B00            add ecx, 004B2C50
:0045B1E5 E87681FAFF              call 00403360
:0045B1EA 50                      push eax
:0045B1EB 8D4DE8                  lea ecx, dword ptr [ebp-18]
:0045B1EE E8ADB3FAFF              call 004065A0
:0045B1F3 C645EC00                mov [ebp-14], 00
:0045B1F7 EB09                    jmp 0045B202

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B299(U)
|
:0045B1F9 8A55EC                  mov dl, byte ptr [ebp-14]
:0045B1FC 80C201                  add dl, 01
:0045B1FF 8855EC                  mov byte ptr [ebp-14], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B1F7(U)
|
:0045B202 8B45EC                  mov eax, dword ptr [ebp-14]
:0045B205 25FF000000              and eax, 000000FF
:0045B20A 83F808                  cmp eax, 00000008
:0045B20D 0F8D8B000000            jnl 0045B29E
:0045B213 8A4DEC                  mov cl, byte ptr [ebp-14]
:0045B216 51                      push ecx
:0045B217 8D55E8                  lea edx, dword ptr [ebp-18]
:0045B21A 52                      push edx
:0045B21B E8D5A7FDFF              call 004359F5
:0045B220 83C408                  add esp, 00000008
:0045B223 50                      push eax
:0045B224 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0045B227 E874B3FAFF              call 004065A0
:0045B22C 8B45FC                  mov eax, dword ptr [ebp-04]
:0045B22F 25FF000000              and eax, 000000FF
:0045B234 3DFF000000              cmp eax, 000000FF
:0045B239 745E                    je 0045B299
:0045B23B 8B75F8                  mov esi, dword ptr [ebp-08]
:0045B23E 81E6FF000000            and esi, 000000FF
:0045B244 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0045B247 51                      push ecx
:0045B248 E837A6FDFF              call 00435884
:0045B24D 83C404                  add esp, 00000004
:0045B250 25FF000000              and eax, 000000FF
:0045B255 3BF0                    cmp esi, eax
:0045B257 7540                    jne 0045B299
:0045B259 837D1000                cmp dword ptr [ebp+10], 00000000
:0045B25D 7409                    je 0045B268
:0045B25F C745F001000000          mov [ebp-10], 00000001
:0045B266 EB36                    jmp 0045B29E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B25D(C)
|
:0045B268 8A55F8                  mov dl, byte ptr [ebp-08]
:0045B26B 52                      push edx
:0045B26C 8A45F4                  mov al, byte ptr [ebp-0C]
:0045B26F 50                      push eax
:0045B270 E833000000              call 0045B2A8
:0045B275 83C408                  add esp, 00000008
:0045B278 85C0                    test eax, eax
:0045B27A 741D                    je 0045B299
:0045B27C 8A4DF4                  mov cl, byte ptr [ebp-0C]
:0045B27F 51                      push ecx
:0045B280 8A55F8                  mov dl, byte ptr [ebp-08]
:0045B283 52                      push edx
:0045B284 E81F000000              call 0045B2A8
:0045B289 83C408                  add esp, 00000008
:0045B28C 85C0                    test eax, eax
:0045B28E 7409                    je 0045B299
:0045B290 C745F001000000          mov [ebp-10], 00000001
:0045B297 EB05                    jmp 0045B29E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045B239(C), :0045B257(C), :0045B27A(C), :0045B28E(C)
|
:0045B299 E95BFFFFFF              jmp 0045B1F9

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045AFF2(C), :0045B0F6(U), :0045B20D(C), :0045B266(U), :0045B297(U)
|
:0045B29E 8B45F0                  mov eax, dword ptr [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045B067(U), :0045B146(U), :0045B190(U), :0045B1CE(U)
|
:0045B2A1 5E                      pop esi
:0045B2A2 8BE5                    mov esp, ebp
:0045B2A4 5D                      pop ebp
:0045B2A5 C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:0045B270   , :0045B284   
|
:0045B2A8 55                      push ebp
:0045B2A9 8BEC                    mov ebp, esp
:0045B2AB 83EC18                  sub esp, 00000018
:0045B2AE 8B4508                  mov eax, dword ptr [ebp+08]
:0045B2B1 25FF000000              and eax, 000000FF
:0045B2B6 6BC024                  imul eax, 00000024
:0045B2B9 05502C4B00              add eax, 004B2C50
:0045B2BE 8945F8                  mov dword ptr [ebp-08], eax
:0045B2C1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045B2C4 E89780FAFF              call 00403360
:0045B2C9 668B08                  mov cx, word ptr [eax]
:0045B2CC 66894DEC                mov word ptr [ebp-14], cx
:0045B2D0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045B2D3 E8E645FEFF              call 0043F8BE
:0045B2D8 8845E8                  mov byte ptr [ebp-18], al
:0045B2DB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045B2DE E88D01FEFF              call 0043B470
:0045B2E3 8845FC                  mov byte ptr [ebp-04], al
:0045B2E6 C745F400000000          mov [ebp-0C], 00000000
:0045B2ED 8B55FC                  mov edx, dword ptr [ebp-04]
:0045B2F0 81E2FF000000            and edx, 000000FF
:0045B2F6 83FA02                  cmp edx, 00000002
:0045B2F9 741B                    je 0045B316
:0045B2FB 8B45FC                  mov eax, dword ptr [ebp-04]
:0045B2FE 25FF000000              and eax, 000000FF
:0045B303 83F804                  cmp eax, 00000004
:0045B306 740E                    je 0045B316
:0045B308 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045B30B 81E1FF000000            and ecx, 000000FF
:0045B311 83F905                  cmp ecx, 00000005
:0045B314 7504                    jne 0045B31A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045B2F9(C), :0045B306(C)
|
:0045B316 C645E801                mov [ebp-18], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B314(C)
|
:0045B31A 6A00                    push 00000000
:0045B31C 6A00                    push 00000000
:0045B31E 8A55E8                  mov dl, byte ptr [ebp-18]
:0045B321 52                      push edx
:0045B322 8D45EC                  lea eax, dword ptr [ebp-14]
:0045B325 50                      push eax
:0045B326 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045B329 E858B2FDFF              call 00436586
:0045B32E C745F048C74A00          mov [ebp-10], 004AC748
:0045B335 EB09                    jmp 0045B340

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B368(U)
|
:0045B337 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0045B33A 83C101                  add ecx, 00000001
:0045B33D 894DF0                  mov dword ptr [ebp-10], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B335(U)
|
:0045B340 8B55F0                  mov edx, dword ptr [ebp-10]
:0045B343 33C0                    xor eax, eax
:0045B345 8A02                    mov al, byte ptr [edx]
:0045B347 3DFF000000              cmp eax, 000000FF
:0045B34C 741C                    je 0045B36A
:0045B34E 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0045B351 33D2                    xor edx, edx
:0045B353 8A11                    mov dl, byte ptr [ecx]
:0045B355 8B450C                  mov eax, dword ptr [ebp+0C]
:0045B358 25FF000000              and eax, 000000FF
:0045B35D 3BD0                    cmp edx, eax
:0045B35F 7507                    jne 0045B368
:0045B361 C745F401000000          mov [ebp-0C], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B35F(C)
|
:0045B368 EBCD                    jmp 0045B337

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B34C(C)
|
:0045B36A 8B45F4                  mov eax, dword ptr [ebp-0C]
:0045B36D 8BE5                    mov esp, ebp
:0045B36F 5D                      pop ebp
:0045B370 C3                      ret



* Referenced by a CALL at Addresses:
|:00411C20   , :0045B0E2   
|
:0045B371 55                      push ebp
:0045B372 8BEC                    mov ebp, esp
:0045B374 83EC18                  sub esp, 00000018
:0045B377 894DEC                  mov dword ptr [ebp-14], ecx
:0045B37A C745F800000000          mov [ebp-08], 00000000
:0045B381 E89C05FBFF              call 0040B922
:0045B386 85C0                    test eax, eax
:0045B388 7409                    je 0045B393
:0045B38A 817D08FFFF0000          cmp dword ptr [ebp+08], 0000FFFF
:0045B391 7508                    jne 0045B39B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B388(C)
|
:0045B393 8B45F8                  mov eax, dword ptr [ebp-08]
:0045B396 E904010000              jmp 0045B49F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B391(C)
|
:0045B39B 8B450C                  mov eax, dword ptr [ebp+0C]
:0045B39E 25FF000000              and eax, 000000FF
:0045B3A3 33C9                    xor ecx, ecx
:0045B3A5 8A0D2C424B00            mov cl, byte ptr [004B422C]
:0045B3AB 3BC1                    cmp eax, ecx
:0045B3AD 0F8DE9000000            jnl 0045B49C
:0045B3B3 8B5510                  mov edx, dword ptr [ebp+10]
:0045B3B6 81E2FF000000            and edx, 000000FF
:0045B3BC 33C0                    xor eax, eax
:0045B3BE A02D424B00              mov al, byte ptr [004B422D]
:0045B3C3 3BD0                    cmp edx, eax
:0045B3C5 0F8DD1000000            jnl 0045B49C
:0045B3CB 8A4D10                  mov cl, byte ptr [ebp+10]
:0045B3CE 51                      push ecx
:0045B3CF 8A550C                  mov dl, byte ptr [ebp+0C]
:0045B3D2 52                      push edx
:0045B3D3 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0045B3D6 E8F5D8FBFF              call 00418CD0
:0045B3DB 8D45F0                  lea eax, dword ptr [ebp-10]
:0045B3DE 50                      push eax
:0045B3DF E8A0A4FDFF              call 00435884
:0045B3E4 83C404                  add esp, 00000004
:0045B3E7 8845F4                  mov byte ptr [ebp-0C], al
:0045B3EA 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0045B3ED 81E1FF000000            and ecx, 000000FF
:0045B3F3 81F9FF000000            cmp ecx, 000000FF
:0045B3F9 0F849D000000            je 0045B49C
:0045B3FF 8B55F4                  mov edx, dword ptr [ebp-0C]
:0045B402 81E2FF000000            and edx, 000000FF
:0045B408 6BD224                  imul edx, 00000024
:0045B40B 81C2502C4B00            add edx, 004B2C50
:0045B411 8955FC                  mov dword ptr [ebp-04], edx
:0045B414 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045B417 E874D8FBFF              call 00418C90
:0045B41C 25FF000000              and eax, 000000FF
:0045B421 83F802                  cmp eax, 00000002
:0045B424 7576                    jne 0045B49C
:0045B426 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045B429 E862780100              call 00472C90
:0045B42E 85C0                    test eax, eax
:0045B430 766A                    jbe 0045B49C
:0045B432 8B4508                  mov eax, dword ptr [ebp+08]
:0045B435 8945E8                  mov dword ptr [ebp-18], eax
:0045B438 817DE800040000          cmp dword ptr [ebp-18], 00000400
:0045B43F 7414                    je 0045B455
:0045B441 817DE801040000          cmp dword ptr [ebp-18], 00000401
:0045B448 7414                    je 0045B45E
:0045B44A 817DE802040000          cmp dword ptr [ebp-18], 00000402
:0045B451 7420                    je 0045B473
:0045B453 EB33                    jmp 0045B488

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B43F(C)
|
:0045B455 C745F801000000          mov [ebp-08], 00000001
:0045B45C EB3E                    jmp 0045B49C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B448(C)
|
:0045B45E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045B461 E8AAB2FAFF              call 00406710
:0045B466 85C0                    test eax, eax
:0045B468 7407                    je 0045B471
:0045B46A C745F801000000          mov [ebp-08], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B468(C)
|
:0045B471 EB29                    jmp 0045B49C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B451(C)
|
:0045B473 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045B476 E895B2FAFF              call 00406710
:0045B47B 85C0                    test eax, eax
:0045B47D 7507                    jne 0045B486
:0045B47F C745F801000000          mov [ebp-08], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B47D(C)
|
:0045B486 EB14                    jmp 0045B49C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B453(U)
|
:0045B488 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045B48B E8E0410000              call 0045F670
:0045B490 394508                  cmp dword ptr [ebp+08], eax
:0045B493 7507                    jne 0045B49C
:0045B495 C745F801000000          mov [ebp-08], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045B3AD(C), :0045B3C5(C), :0045B3F9(C), :0045B424(C), :0045B430(C)
|:0045B45C(U), :0045B471(U), :0045B486(U), :0045B493(C)
|
:0045B49C 8B45F8                  mov eax, dword ptr [ebp-08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B396(U)
|
:0045B49F 8BE5                    mov esp, ebp
:0045B4A1 5D                      pop ebp
:0045B4A2 C20C00                  ret 000C



* Referenced by a CALL at Address:
|:00411D4D   
|
:0045B4A5 55                      push ebp
:0045B4A6 8BEC                    mov ebp, esp
:0045B4A8 83EC1C                  sub esp, 0000001C
:0045B4AB 894DE8                  mov dword ptr [ebp-18], ecx
:0045B4AE 8D4DEC                  lea ecx, dword ptr [ebp-14]
:0045B4B1 E85A420000              call 0045F710
:0045B4B6 E86704FBFF              call 0040B922
:0045B4BB 85C0                    test eax, eax
:0045B4BD 7409                    je 0045B4C8
:0045B4BF 817D08FFFF0000          cmp dword ptr [ebp+08], 0000FFFF
:0045B4C6 7507                    jne 0045B4CF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B4BD(C)
|
:0045B4C8 33C0                    xor eax, eax
:0045B4CA E929010000              jmp 0045B5F8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B4C6(C)
|
:0045B4CF 8A4510                  mov al, byte ptr [ebp+10]
:0045B4D2 8845F0                  mov byte ptr [ebp-10], al
:0045B4D5 EB09                    jmp 0045B4E0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B5F1(U)
|
:0045B4D7 8A4DF0                  mov cl, byte ptr [ebp-10]
:0045B4DA 80C101                  add cl, 01
:0045B4DD 884DF0                  mov byte ptr [ebp-10], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B4D5(U)
|
:0045B4E0 8B55F0                  mov edx, dword ptr [ebp-10]
:0045B4E3 81E2FF000000            and edx, 000000FF
:0045B4E9 8B4518                  mov eax, dword ptr [ebp+18]
:0045B4EC 25FF000000              and eax, 000000FF
:0045B4F1 3BD0                    cmp edx, eax
:0045B4F3 0F8FFD000000            jg 0045B5F6
:0045B4F9 8A4D0C                  mov cl, byte ptr [ebp+0C]
:0045B4FC 884DF8                  mov byte ptr [ebp-08], cl
:0045B4FF EB09                    jmp 0045B50A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B5EC(U)
|
:0045B501 8A55F8                  mov dl, byte ptr [ebp-08]
:0045B504 80C201                  add dl, 01
:0045B507 8855F8                  mov byte ptr [ebp-08], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B4FF(U)
|
:0045B50A 8B45F8                  mov eax, dword ptr [ebp-08]
:0045B50D 25FF000000              and eax, 000000FF
:0045B512 8B4D14                  mov ecx, dword ptr [ebp+14]
:0045B515 81E1FF000000            and ecx, 000000FF
:0045B51B 3BC1                    cmp eax, ecx
:0045B51D 0F8FCE000000            jg 0045B5F1
:0045B523 8A55F8                  mov dl, byte ptr [ebp-08]
:0045B526 8855EC                  mov byte ptr [ebp-14], dl
:0045B529 8A45F0                  mov al, byte ptr [ebp-10]
:0045B52C 8845ED                  mov byte ptr [ebp-13], al
:0045B52F 8D4DEC                  lea ecx, dword ptr [ebp-14]
:0045B532 51                      push ecx
:0045B533 E84CA3FDFF              call 00435884
:0045B538 83C404                  add esp, 00000004
:0045B53B 8845F4                  mov byte ptr [ebp-0C], al
:0045B53E 8B55F4                  mov edx, dword ptr [ebp-0C]
:0045B541 81E2FF000000            and edx, 000000FF
:0045B547 81FAFF000000            cmp edx, 000000FF
:0045B54D 0F8499000000            je 0045B5EC
:0045B553 8B45F4                  mov eax, dword ptr [ebp-0C]
:0045B556 25FF000000              and eax, 000000FF
:0045B55B 6BC024                  imul eax, 00000024
:0045B55E 05502C4B00              add eax, 004B2C50
:0045B563 8945FC                  mov dword ptr [ebp-04], eax
:0045B566 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045B569 E822D7FBFF              call 00418C90
:0045B56E 25FF000000              and eax, 000000FF
:0045B573 83F802                  cmp eax, 00000002
:0045B576 7574                    jne 0045B5EC
:0045B578 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045B57B E810770100              call 00472C90
:0045B580 85C0                    test eax, eax
:0045B582 7668                    jbe 0045B5EC
:0045B584 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045B587 894DE4                  mov dword ptr [ebp-1C], ecx
:0045B58A 817DE400040000          cmp dword ptr [ebp-1C], 00000400
:0045B591 7414                    je 0045B5A7
:0045B593 817DE401040000          cmp dword ptr [ebp-1C], 00000401
:0045B59A 7412                    je 0045B5AE
:0045B59C 817DE402040000          cmp dword ptr [ebp-1C], 00000402
:0045B5A3 741E                    je 0045B5C3
:0045B5A5 EB31                    jmp 0045B5D8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B591(C)
|
:0045B5A7 B801000000              mov eax, 00000001
:0045B5AC EB4A                    jmp 0045B5F8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B59A(C)
|
:0045B5AE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045B5B1 E85AB1FAFF              call 00406710
:0045B5B6 85C0                    test eax, eax
:0045B5B8 7407                    je 0045B5C1
:0045B5BA B801000000              mov eax, 00000001
:0045B5BF EB37                    jmp 0045B5F8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B5B8(C)
|
:0045B5C1 EB29                    jmp 0045B5EC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B5A3(C)
|
:0045B5C3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045B5C6 E845B1FAFF              call 00406710
:0045B5CB 85C0                    test eax, eax
:0045B5CD 7507                    jne 0045B5D6
:0045B5CF B801000000              mov eax, 00000001
:0045B5D4 EB22                    jmp 0045B5F8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B5CD(C)
|
:0045B5D6 EB14                    jmp 0045B5EC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B5A5(U)
|
:0045B5D8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045B5DB E890400000              call 0045F670
:0045B5E0 394508                  cmp dword ptr [ebp+08], eax
:0045B5E3 7507                    jne 0045B5EC
:0045B5E5 B801000000              mov eax, 00000001
:0045B5EA EB0C                    jmp 0045B5F8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045B54D(C), :0045B576(C), :0045B582(C), :0045B5C1(U), :0045B5D6(U)
|:0045B5E3(C)
|
:0045B5EC E910FFFFFF              jmp 0045B501

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B51D(C)
|
:0045B5F1 E9E1FEFFFF              jmp 0045B4D7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B4F3(C)
|
:0045B5F6 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045B4CA(U), :0045B5AC(U), :0045B5BF(U), :0045B5D4(U), :0045B5EA(U)
|
:0045B5F8 8BE5                    mov esp, ebp
:0045B5FA 5D                      pop ebp
:0045B5FB C21400                  ret 0014



* Referenced by a CALL at Addresses:
|:0044E460   , :0044EB5F   
|
:0045B5FE 55                      push ebp
:0045B5FF 8BEC                    mov ebp, esp
:0045B601 83EC18                  sub esp, 00000018
:0045B604 894DE8                  mov dword ptr [ebp-18], ecx
:0045B607 8D4DEC                  lea ecx, dword ptr [ebp-14]
:0045B60A E801410000              call 0045F710
:0045B60F B9083D4B00              mov ecx, 004B3D08
:0045B614 E88743FFFF              call 0044F9A0
:0045B619 25FF000000              and eax, 000000FF
:0045B61E 85C0                    test eax, eax
:0045B620 7521                    jne 0045B643
:0045B622 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045B625 81E1FF000000            and ecx, 000000FF
:0045B62B 6BC924                  imul ecx, 00000024
:0045B62E 81C1502C4B00            add ecx, 004B2C50
:0045B634 E857D6FBFF              call 00418C90
:0045B639 25FF000000              and eax, 000000FF
:0045B63E 83F802                  cmp eax, 00000002
:0045B641 7405                    je 0045B648

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B620(C)
|
:0045B643 E982000000              jmp 0045B6CA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B641(C)
|
:0045B648 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045B64B 81E1FF000000            and ecx, 000000FF
:0045B651 6BC924                  imul ecx, 00000024
:0045B654 81C1502C4B00            add ecx, 004B2C50
:0045B65A E811400000              call 0045F670
:0045B65F 8945FC                  mov dword ptr [ebp-04], eax
:0045B662 8B45FC                  mov eax, dword ptr [ebp-04]
:0045B665 8945F0                  mov dword ptr [ebp-10], eax
:0045B668 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045B66B 81E1FF000000            and ecx, 000000FF
:0045B671 6BC924                  imul ecx, 00000024
:0045B674 81C1502C4B00            add ecx, 004B2C50
:0045B67A E8E17CFAFF              call 00403360
:0045B67F 50                      push eax
:0045B680 8D4DEC                  lea ecx, dword ptr [ebp-14]
:0045B683 E818AFFAFF              call 004065A0
:0045B688 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0045B68B 81E1FF000000            and ecx, 000000FF
:0045B691 894DF4                  mov dword ptr [ebp-0C], ecx
:0045B694 8B55ED                  mov edx, dword ptr [ebp-13]
:0045B697 81E2FF000000            and edx, 000000FF
:0045B69D 8955F8                  mov dword ptr [ebp-08], edx
:0045B6A0 83EC0C                  sub esp, 0000000C
:0045B6A3 8BC4                    mov eax, esp
:0045B6A5 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0045B6A8 8908                    mov dword ptr [eax], ecx
:0045B6AA 8B55F4                  mov edx, dword ptr [ebp-0C]
:0045B6AD 895004                  mov dword ptr [eax+04], edx
:0045B6B0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045B6B3 894808                  mov dword ptr [eax+08], ecx
:0045B6B6 B9902F4900              mov ecx, 00492F90
:0045B6BB E850020000              call 0045B910
:0045B6C0 B9083D4B00              mov ecx, 004B3D08
:0045B6C5 E8370FFFFF              call 0044C601

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B643(U)
|
:0045B6CA 8BE5                    mov esp, ebp
:0045B6CC 5D                      pop ebp
:0045B6CD C20400                  ret 0004



* Referenced by a CALL at Address:
|:0045960F   
|
:0045B6D0 55                      push ebp
:0045B6D1 8BEC                    mov ebp, esp
:0045B6D3 51                      push ecx
:0045B6D4 894DFC                  mov dword ptr [ebp-04], ecx
:0045B6D7 8B4508                  mov eax, dword ptr [ebp+08]
:0045B6DA 8A4801                  mov cl, byte ptr [eax+01]
:0045B6DD 51                      push ecx
:0045B6DE 8B5508                  mov edx, dword ptr [ebp+08]
:0045B6E1 8A02                    mov al, byte ptr [edx]
:0045B6E3 50                      push eax
:0045B6E4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045B6E7 E8A06FFEFF              call 0044268C
:0045B6EC 8BE5                    mov esp, ebp
:0045B6EE 5D                      pop ebp
:0045B6EF C20400                  ret 0004


:0045B6F2 CC                      int 03
:0045B6F3 CC                      int 03
:0045B6F4 CC                      int 03
:0045B6F5 CC                      int 03
:0045B6F6 CC                      int 03
:0045B6F7 CC                      int 03
:0045B6F8 CC                      int 03
:0045B6F9 CC                      int 03
:0045B6FA CC                      int 03
:0045B6FB CC                      int 03
:0045B6FC CC                      int 03
:0045B6FD CC                      int 03
:0045B6FE CC                      int 03
:0045B6FF CC                      int 03

* Referenced by a CALL at Address:
|:0045A5F3   
|
:0045B700 55                      push ebp
:0045B701 8BEC                    mov ebp, esp
:0045B703 83EC08                  sub esp, 00000008
:0045B706 894DFC                  mov dword ptr [ebp-04], ecx
:0045B709 8B45FC                  mov eax, dword ptr [ebp-04]
:0045B70C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045B70F 8B11                    mov edx, dword ptr [ecx]
:0045B711 8910                    mov dword ptr [eax], edx
:0045B713 8B4508                  mov eax, dword ptr [ebp+08]
:0045B716 83C006                  add eax, 00000006
:0045B719 50                      push eax
:0045B71A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045B71D 83C106                  add ecx, 00000006
:0045B720 E87BAEFAFF              call 004065A0
:0045B725 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045B728 8B5508                  mov edx, dword ptr [ebp+08]
:0045B72B 8A4208                  mov al, byte ptr [edx+08]
:0045B72E 884108                  mov byte ptr [ecx+08], al
:0045B731 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045B734 83C109                  add ecx, 00000009
:0045B737 51                      push ecx
:0045B738 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045B73B 83C109                  add ecx, 00000009
:0045B73E E85DAEFAFF              call 004065A0
:0045B743 8B55FC                  mov edx, dword ptr [ebp-04]
:0045B746 8B4508                  mov eax, dword ptr [ebp+08]
:0045B749 8A480C                  mov cl, byte ptr [eax+0C]
:0045B74C 884A0C                  mov byte ptr [edx+0C], cl
:0045B74F 8B55FC                  mov edx, dword ptr [ebp-04]
:0045B752 8B4508                  mov eax, dword ptr [ebp+08]
:0045B755 8A480D                  mov cl, byte ptr [eax+0D]
:0045B758 884A0D                  mov byte ptr [edx+0D], cl
:0045B75B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045B75E E8ADAFFAFF              call 00406710
:0045B763 85C0                    test eax, eax
:0045B765 7425                    je 0045B78C
:0045B767 8B55FC                  mov edx, dword ptr [ebp-04]
:0045B76A 8B0A                    mov ecx, dword ptr [edx]
:0045B76C 6BC948                  imul ecx, 00000048
:0045B76F 81C1681B4A00            add ecx, 004A1B68
:0045B775 E806D6FBFF              call 00418D80
:0045B77A 25FF000000              and eax, 000000FF
:0045B77F 85C0                    test eax, eax
:0045B781 7509                    jne 0045B78C

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0045B783 C745F807000000          mov [ebp-08], 00000007
:0045B78A EB07                    jmp 0045B793

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045B765(C), :0045B781(C)
|
:0045B78C C745F803000000          mov [ebp-08], 00000003

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B78A(U)
|
:0045B793 8B45FC                  mov eax, dword ptr [ebp-04]
:0045B796 8A4DF8                  mov cl, byte ptr [ebp-08]
:0045B799 88480E                  mov byte ptr [eax+0E], cl
:0045B79C 8B55FC                  mov edx, dword ptr [ebp-04]
:0045B79F 8B4508                  mov eax, dword ptr [ebp+08]
:0045B7A2 8A480B                  mov cl, byte ptr [eax+0B]
:0045B7A5 884A0B                  mov byte ptr [edx+0B], cl
:0045B7A8 8B55FC                  mov edx, dword ptr [ebp-04]
:0045B7AB 8B4508                  mov eax, dword ptr [ebp+08]
:0045B7AE 8A480F                  mov cl, byte ptr [eax+0F]
:0045B7B1 884A0F                  mov byte ptr [edx+0F], cl
:0045B7B4 8B55FC                  mov edx, dword ptr [ebp-04]
:0045B7B7 8B4508                  mov eax, dword ptr [ebp+08]
:0045B7BA 8B4810                  mov ecx, dword ptr [eax+10]
:0045B7BD 894A10                  mov dword ptr [edx+10], ecx
:0045B7C0 8B55FC                  mov edx, dword ptr [ebp-04]
:0045B7C3 8B4508                  mov eax, dword ptr [ebp+08]
:0045B7C6 8B4814                  mov ecx, dword ptr [eax+14]
:0045B7C9 894A14                  mov dword ptr [edx+14], ecx
:0045B7CC 8B55FC                  mov edx, dword ptr [ebp-04]
:0045B7CF 8B4508                  mov eax, dword ptr [ebp+08]
:0045B7D2 8A4818                  mov cl, byte ptr [eax+18]
:0045B7D5 884A18                  mov byte ptr [edx+18], cl
:0045B7D8 8B55FC                  mov edx, dword ptr [ebp-04]
:0045B7DB 8B4508                  mov eax, dword ptr [ebp+08]
:0045B7DE 8A4819                  mov cl, byte ptr [eax+19]
:0045B7E1 884A19                  mov byte ptr [edx+19], cl
:0045B7E4 8B55FC                  mov edx, dword ptr [ebp-04]
:0045B7E7 8B4508                  mov eax, dword ptr [ebp+08]
:0045B7EA 8A481A                  mov cl, byte ptr [eax+1A]
:0045B7ED 884A1A                  mov byte ptr [edx+1A], cl
:0045B7F0 8B55FC                  mov edx, dword ptr [ebp-04]
:0045B7F3 8B4508                  mov eax, dword ptr [ebp+08]
:0045B7F6 8A481B                  mov cl, byte ptr [eax+1B]
:0045B7F9 884A1B                  mov byte ptr [edx+1B], cl
:0045B7FC 8B55FC                  mov edx, dword ptr [ebp-04]
:0045B7FF 8B4508                  mov eax, dword ptr [ebp+08]
:0045B802 8A481C                  mov cl, byte ptr [eax+1C]
:0045B805 884A1C                  mov byte ptr [edx+1C], cl
:0045B808 8B55FC                  mov edx, dword ptr [ebp-04]
:0045B80B 8B4508                  mov eax, dword ptr [ebp+08]
:0045B80E 8A481D                  mov cl, byte ptr [eax+1D]
:0045B811 884A1D                  mov byte ptr [edx+1D], cl
:0045B814 8B55FC                  mov edx, dword ptr [ebp-04]
:0045B817 8B4508                  mov eax, dword ptr [ebp+08]
:0045B81A 8A481E                  mov cl, byte ptr [eax+1E]
:0045B81D 884A1E                  mov byte ptr [edx+1E], cl
:0045B820 8B55FC                  mov edx, dword ptr [ebp-04]
:0045B823 8B4508                  mov eax, dword ptr [ebp+08]
:0045B826 8B4820                  mov ecx, dword ptr [eax+20]
:0045B829 894A20                  mov dword ptr [edx+20], ecx
:0045B82C 8B55FC                  mov edx, dword ptr [ebp-04]
:0045B82F 8B4508                  mov eax, dword ptr [ebp+08]
:0045B832 8A4805                  mov cl, byte ptr [eax+05]
:0045B835 884A05                  mov byte ptr [edx+05], cl
:0045B838 8B45FC                  mov eax, dword ptr [ebp-04]
:0045B83B 8BE5                    mov esp, ebp
:0045B83D 5D                      pop ebp
:0045B83E C20400                  ret 0004


:0045B841 CC                      int 03
:0045B842 CC                      int 03
:0045B843 CC                      int 03
:0045B844 CC                      int 03
:0045B845 CC                      int 03
:0045B846 CC                      int 03
:0045B847 CC                      int 03
:0045B848 CC                      int 03
:0045B849 CC                      int 03
:0045B84A CC                      int 03
:0045B84B CC                      int 03
:0045B84C CC                      int 03
:0045B84D CC                      int 03
:0045B84E CC                      int 03
:0045B84F CC                      int 03

* Referenced by a CALL at Addresses:
|:0041D35B   , :0045AB16   
|
:0045B850 55                      push ebp
:0045B851 8BEC                    mov ebp, esp
:0045B853 51                      push ecx
:0045B854 894DFC                  mov dword ptr [ebp-04], ecx
:0045B857 8B45FC                  mov eax, dword ptr [ebp-04]
:0045B85A 8A4D08                  mov cl, byte ptr [ebp+08]
:0045B85D 884818                  mov byte ptr [eax+18], cl
:0045B860 8BE5                    mov esp, ebp
:0045B862 5D                      pop ebp
:0045B863 C20400                  ret 0004


:0045B866 CC                      int 03
:0045B867 CC                      int 03
:0045B868 CC                      int 03
:0045B869 CC                      int 03
:0045B86A CC                      int 03
:0045B86B CC                      int 03
:0045B86C CC                      int 03
:0045B86D CC                      int 03
:0045B86E CC                      int 03
:0045B86F CC                      int 03

* Referenced by a CALL at Addresses:
|:0041D38A   , :0045AB36   
|
:0045B870 55                      push ebp
:0045B871 8BEC                    mov ebp, esp
:0045B873 51                      push ecx
:0045B874 894DFC                  mov dword ptr [ebp-04], ecx
:0045B877 8B45FC                  mov eax, dword ptr [ebp-04]
:0045B87A 8A4D08                  mov cl, byte ptr [ebp+08]
:0045B87D 884819                  mov byte ptr [eax+19], cl
:0045B880 8BE5                    mov esp, ebp
:0045B882 5D                      pop ebp
:0045B883 C20400                  ret 0004


:0045B886 CC                      int 03
:0045B887 CC                      int 03
:0045B888 CC                      int 03
:0045B889 CC                      int 03
:0045B88A CC                      int 03
:0045B88B CC                      int 03
:0045B88C CC                      int 03
:0045B88D CC                      int 03
:0045B88E CC                      int 03
:0045B88F CC                      int 03

* Referenced by a CALL at Address:
|:0045AB56   
|
:0045B890 55                      push ebp
:0045B891 8BEC                    mov ebp, esp
:0045B893 51                      push ecx
:0045B894 894DFC                  mov dword ptr [ebp-04], ecx
:0045B897 8B45FC                  mov eax, dword ptr [ebp-04]
:0045B89A 8A4D08                  mov cl, byte ptr [ebp+08]
:0045B89D 88481A                  mov byte ptr [eax+1A], cl
:0045B8A0 8BE5                    mov esp, ebp
:0045B8A2 5D                      pop ebp
:0045B8A3 C20400                  ret 0004


:0045B8A6 CC                      int 03
:0045B8A7 CC                      int 03
:0045B8A8 CC                      int 03
:0045B8A9 CC                      int 03
:0045B8AA CC                      int 03
:0045B8AB CC                      int 03
:0045B8AC CC                      int 03
:0045B8AD CC                      int 03
:0045B8AE CC                      int 03
:0045B8AF CC                      int 03

* Referenced by a CALL at Address:
|:0045AB76   
|
:0045B8B0 55                      push ebp
:0045B8B1 8BEC                    mov ebp, esp
:0045B8B3 51                      push ecx
:0045B8B4 894DFC                  mov dword ptr [ebp-04], ecx
:0045B8B7 8B45FC                  mov eax, dword ptr [ebp-04]
:0045B8BA 8A4D08                  mov cl, byte ptr [ebp+08]
:0045B8BD 88481B                  mov byte ptr [eax+1B], cl
:0045B8C0 8BE5                    mov esp, ebp
:0045B8C2 5D                      pop ebp
:0045B8C3 C20400                  ret 0004


:0045B8C6 CC                      int 03
:0045B8C7 CC                      int 03
:0045B8C8 CC                      int 03
:0045B8C9 CC                      int 03
:0045B8CA CC                      int 03
:0045B8CB CC                      int 03
:0045B8CC CC                      int 03
:0045B8CD CC                      int 03
:0045B8CE CC                      int 03
:0045B8CF CC                      int 03

* Referenced by a CALL at Address:
|:0045AB96   
|
:0045B8D0 55                      push ebp
:0045B8D1 8BEC                    mov ebp, esp
:0045B8D3 51                      push ecx
:0045B8D4 894DFC                  mov dword ptr [ebp-04], ecx
:0045B8D7 8B45FC                  mov eax, dword ptr [ebp-04]
:0045B8DA 8A4D08                  mov cl, byte ptr [ebp+08]
:0045B8DD 88481C                  mov byte ptr [eax+1C], cl
:0045B8E0 8BE5                    mov esp, ebp
:0045B8E2 5D                      pop ebp
:0045B8E3 C20400                  ret 0004


:0045B8E6 CC                      int 03
:0045B8E7 CC                      int 03
:0045B8E8 CC                      int 03
:0045B8E9 CC                      int 03
:0045B8EA CC                      int 03
:0045B8EB CC                      int 03
:0045B8EC CC                      int 03
:0045B8ED CC                      int 03
:0045B8EE CC                      int 03
:0045B8EF CC                      int 03

* Referenced by a CALL at Address:
|:0045ABB6   
|
:0045B8F0 55                      push ebp
:0045B8F1 8BEC                    mov ebp, esp
:0045B8F3 51                      push ecx
:0045B8F4 894DFC                  mov dword ptr [ebp-04], ecx
:0045B8F7 8B45FC                  mov eax, dword ptr [ebp-04]
:0045B8FA 8A4D08                  mov cl, byte ptr [ebp+08]
:0045B8FD 88481D                  mov byte ptr [eax+1D], cl
:0045B900 8BE5                    mov esp, ebp
:0045B902 5D                      pop ebp
:0045B903 C20400                  ret 0004


:0045B906 CC                      int 03
:0045B907 CC                      int 03
:0045B908 CC                      int 03
:0045B909 CC                      int 03
:0045B90A CC                      int 03
:0045B90B CC                      int 03
:0045B90C CC                      int 03
:0045B90D CC                      int 03
:0045B90E CC                      int 03
:0045B90F CC                      int 03

* Referenced by a CALL at Address:
|:0045B6BB   
|
:0045B910 55                      push ebp
:0045B911 8BEC                    mov ebp, esp
:0045B913 51                      push ecx
:0045B914 894DFC                  mov dword ptr [ebp-04], ecx
:0045B917 6A0C                    push 0000000C
:0045B919 8D4508                  lea eax, dword ptr [ebp+08]
:0045B91C 50                      push eax
:0045B91D 6A03                    push 00000003
:0045B91F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045B922 E85047FBFF              call 00410077
:0045B927 8BE5                    mov esp, ebp
:0045B929 5D                      pop ebp
:0045B92A C20C00                  ret 000C


:0045B92D CC                      int 03
:0045B92E CC                      int 03
:0045B92F CC                      int 03

* Referenced by a CALL at Address:
|:0045BBFA   
|
:0045B930 55                      push ebp
:0045B931 8BEC                    mov ebp, esp
:0045B933 51                      push ecx
:0045B934 56                      push esi
:0045B935 894DFC                  mov dword ptr [ebp-04], ecx
:0045B938 8B4508                  mov eax, dword ptr [ebp+08]
:0045B93B 25FF000000              and eax, 000000FF
:0045B940 3DFF000000              cmp eax, 000000FF
:0045B945 7516                    jne 0045B95D
:0045B947 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045B94A C7410830000000          mov [ecx+08], 00000030
:0045B951 8B55FC                  mov edx, dword ptr [ebp-04]
:0045B954 C7420C30000000          mov [edx+0C], 00000030
:0045B95B EB57                    jmp 0045B9B4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B945(C)
|
:0045B95D B950424B00              mov ecx, 004B4250
:0045B962 E8E860FFFF              call 00451A4F
:0045B967 8BF0                    mov esi, eax
:0045B969 8B4508                  mov eax, dword ptr [ebp+08]
:0045B96C 25FF000000              and eax, 000000FF
:0045B971 6BC030                  imul eax, 00000030
:0045B974 03F0                    add esi, eax
:0045B976 B950424B00              mov ecx, 004B4250
:0045B97B E81361FFFF              call 00451A93
:0045B980 2BF0                    sub esi, eax
:0045B982 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045B985 897108                  mov dword ptr [ecx+08], esi
:0045B988 B950424B00              mov ecx, 004B4250
:0045B98D E8CE60FFFF              call 00451A60
:0045B992 8BF0                    mov esi, eax
:0045B994 8B550C                  mov edx, dword ptr [ebp+0C]
:0045B997 81E2FF000000            and edx, 000000FF
:0045B99D 6BD230                  imul edx, 00000030
:0045B9A0 03F2                    add esi, edx
:0045B9A2 B950424B00              mov ecx, 004B4250
:0045B9A7 E8F860FFFF              call 00451AA4
:0045B9AC 2BF0                    sub esi, eax
:0045B9AE 8B45FC                  mov eax, dword ptr [ebp-04]
:0045B9B1 89700C                  mov dword ptr [eax+0C], esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B95B(U)
|
:0045B9B4 5E                      pop esi
:0045B9B5 8BE5                    mov esp, ebp
:0045B9B7 5D                      pop ebp
:0045B9B8 C20800                  ret 0008



* Referenced by a CALL at Address:
|:0045BAF7   
|
:0045B9BB 55                      push ebp
:0045B9BC 8BEC                    mov ebp, esp
:0045B9BE 83EC1C                  sub esp, 0000001C
:0045B9C1 56                      push esi
:0045B9C2 894DE4                  mov dword ptr [ebp-1C], ecx
:0045B9C5 8D45F0                  lea eax, dword ptr [ebp-10]
:0045B9C8 50                      push eax
:0045B9C9 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0045B9CC 8B11                    mov edx, dword ptr [ecx]
:0045B9CE 52                      push edx
:0045B9CF FF1598634800            call dword ptr [00486398]
:0045B9D5 8B45E4                  mov eax, dword ptr [ebp-1C]
:0045B9D8 8B4808                  mov ecx, dword ptr [eax+08]
:0045B9DB 894DE8                  mov dword ptr [ebp-18], ecx
:0045B9DE 8B55E4                  mov edx, dword ptr [ebp-1C]
:0045B9E1 8B420C                  mov eax, dword ptr [edx+0C]
:0045B9E4 8945EC                  mov dword ptr [ebp-14], eax
:0045B9E7 B950424B00              mov ecx, 004B4250
:0045B9EC E853A4FFFF              call 00455E44
:0045B9F1 99                      cdq
:0045B9F2 2BC2                    sub eax, edx
:0045B9F4 D1F8                    sar eax, 1
:0045B9F6 3945E8                  cmp dword ptr [ebp-18], eax
:0045B9F9 7D0B                    jge 0045BA06
:0045B9FB 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0045B9FE 83C140                  add ecx, 00000040
:0045BA01 894DE8                  mov dword ptr [ebp-18], ecx
:0045BA04 EB11                    jmp 0045BA17

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045B9F9(C)
|
:0045BA06 8B55F8                  mov edx, dword ptr [ebp-08]
:0045BA09 83C210                  add edx, 00000010
:0045BA0C 2B55F0                  sub edx, dword ptr [ebp-10]
:0045BA0F 8B45E8                  mov eax, dword ptr [ebp-18]
:0045BA12 2BC2                    sub eax, edx
:0045BA14 8945E8                  mov dword ptr [ebp-18], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045BA04(U)
|
:0045BA17 8B45FC                  mov eax, dword ptr [ebp-04]
:0045BA1A 2B45F4                  sub eax, dword ptr [ebp-0C]
:0045BA1D 83E830                  sub eax, 00000030
:0045BA20 99                      cdq
:0045BA21 2BC2                    sub eax, edx
:0045BA23 D1F8                    sar eax, 1
:0045BA25 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0045BA28 2BC8                    sub ecx, eax
:0045BA2A 894DEC                  mov dword ptr [ebp-14], ecx
:0045BA2D 8B75EC                  mov esi, dword ptr [ebp-14]
:0045BA30 0375FC                  add esi, dword ptr [ebp-04]
:0045BA33 2B75F4                  sub esi, dword ptr [ebp-0C]
:0045BA36 B950424B00              mov ecx, 004B4250
:0045BA3B E82BA4FFFF              call 00455E6B
:0045BA40 3BF0                    cmp esi, eax
:0045BA42 7E15                    jle 0045BA59
:0045BA44 B950424B00              mov ecx, 004B4250
:0045BA49 E81DA4FFFF              call 00455E6B
:0045BA4E 8B55FC                  mov edx, dword ptr [ebp-04]
:0045BA51 2B55F4                  sub edx, dword ptr [ebp-0C]
:0045BA54 2BC2                    sub eax, edx
:0045BA56 8945EC                  mov dword ptr [ebp-14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045BA42(C)
|
:0045BA59 837DEC00                cmp dword ptr [ebp-14], 00000000
:0045BA5D 7D07                    jge 0045BA66
:0045BA5F C745EC00000000          mov [ebp-14], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045BA5D(C)
|
:0045BA66 8D45E8                  lea eax, dword ptr [ebp-18]
:0045BA69 50                      push eax
:0045BA6A 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0045BA6D 8B11                    mov edx, dword ptr [ecx]
:0045BA6F 52                      push edx
:0045BA70 FF159C634800            call dword ptr [0048639C]
:0045BA76 50                      push eax
:0045BA77 FF1520634800            call dword ptr [00486320]
:0045BA7D 6A0D                    push 0000000D
:0045BA7F 6A00                    push 00000000
:0045BA81 6A00                    push 00000000
:0045BA83 8B45EC                  mov eax, dword ptr [ebp-14]
:0045BA86 50                      push eax
:0045BA87 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0045BA8A 51                      push ecx
:0045BA8B 6A00                    push 00000000
:0045BA8D 8B55E4                  mov edx, dword ptr [ebp-1C]
:0045BA90 8B02                    mov eax, dword ptr [edx]
:0045BA92 50                      push eax
:0045BA93 FF1580624800            call dword ptr [00486280]
:0045BA99 5E                      pop esi
:0045BA9A 8BE5                    mov esp, ebp
:0045BA9C 5D                      pop ebp
:0045BA9D C3                      ret



* Referenced by a CALL at Addresses:
|:0045BAC2   , :0045BBE7   
|
:0045BA9E 55                      push ebp
:0045BA9F 8BEC                    mov ebp, esp
:0045BAA1 51                      push ecx
:0045BAA2 894DFC                  mov dword ptr [ebp-04], ecx
:0045BAA5 8B45FC                  mov eax, dword ptr [ebp-04]
:0045BAA8 8A4D08                  mov cl, byte ptr [ebp+08]
:0045BAAB 884804                  mov byte ptr [eax+04], cl
:0045BAAE 8BE5                    mov esp, ebp
:0045BAB0 5D                      pop ebp
:0045BAB1 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0045BC6D   , :0045BC7C   , :0045BC8B   , :0045BC9A   , :0045BCFC   
|
:0045BAB4 55                      push ebp
:0045BAB5 8BEC                    mov ebp, esp
:0045BAB7 51                      push ecx
:0045BAB8 894DFC                  mov dword ptr [ebp-04], ecx
:0045BABB 8A4508                  mov al, byte ptr [ebp+08]
:0045BABE 50                      push eax
:0045BABF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045BAC2 E8D7FFFFFF              call 0045BA9E
:0045BAC7 6A00                    push 00000000
:0045BAC9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045BACC 8B11                    mov edx, dword ptr [ecx]
:0045BACE 52                      push edx
:0045BACF FF15D4624800            call dword ptr [004862D4]
:0045BAD5 8BE5                    mov esp, ebp
:0045BAD7 5D                      pop ebp
:0045BAD8 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0045BCE1   
|
:0045BADB 55                      push ebp
:0045BADC 8BEC                    mov ebp, esp
:0045BADE 51                      push ecx
:0045BADF 894DFC                  mov dword ptr [ebp-04], ecx
:0045BAE2 8B4508                  mov eax, dword ptr [ebp+08]
:0045BAE5 50                      push eax
:0045BAE6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045BAE9 83C124                  add ecx, 00000024
:0045BAEC E85F3B0000              call 0045F650
:0045BAF1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045BAF4 83C124                  add ecx, 00000024
:0045BAF7 E8BFFEFFFF              call 0045B9BB
:0045BAFC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045BAFF C7414001000000          mov [ecx+40], 00000001
:0045BB06 8B55FC                  mov edx, dword ptr [ebp-04]
:0045BB09 8B4234                  mov eax, dword ptr [edx+34]
:0045BB0C 50                      push eax

* Possible Reference to Dialog: DialogID_0117, CONTROL_ID:0507, ";"
                                  |
:0045BB0D 6807050000              push 00000507
:0045BB12 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045BB15 83C124                  add ecx, 00000024
:0045BB18 E8533B0000              call 0045F670
:0045BB1D 50                      push eax
:0045BB1E FF15DC624800            call dword ptr [004862DC]
:0045BB24 50                      push eax
:0045BB25 FF15E8624800            call dword ptr [004862E8]
:0045BB2B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045BB2E 8B5138                  mov edx, dword ptr [ecx+38]
:0045BB31 52                      push edx

* Possible Reference to Dialog: DialogID_0117, CONTROL_ID:0508, "Ve"
                                  |
:0045BB32 6808050000              push 00000508
:0045BB37 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045BB3A 83C124                  add ecx, 00000024
:0045BB3D E82E3B0000              call 0045F670
:0045BB42 50                      push eax
:0045BB43 FF15DC624800            call dword ptr [004862DC]
:0045BB49 50                      push eax
:0045BB4A FF15E8624800            call dword ptr [004862E8]
:0045BB50 8B45FC                  mov eax, dword ptr [ebp-04]
:0045BB53 8B483C                  mov ecx, dword ptr [eax+3C]
:0045BB56 51                      push ecx

* Possible Reference to Dialog: DialogID_0117, CONTROL_ID:0509, "Sw"
                                  |
:0045BB57 6809050000              push 00000509
:0045BB5C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045BB5F 83C124                  add ecx, 00000024
:0045BB62 E8093B0000              call 0045F670
:0045BB67 50                      push eax
:0045BB68 FF15DC624800            call dword ptr [004862DC]
:0045BB6E 50                      push eax
:0045BB6F FF15E8624800            call dword ptr [004862E8]
:0045BB75 8B55FC                  mov edx, dword ptr [ebp-04]
:0045BB78 8B4240                  mov eax, dword ptr [edx+40]
:0045BB7B 50                      push eax

* Possible Reference to Dialog: DialogID_0117, CONTROL_ID:050B, ""
                                  |
:0045BB7C 680B050000              push 0000050B
:0045BB81 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045BB84 83C124                  add ecx, 00000024
:0045BB87 E8E43A0000              call 0045F670
:0045BB8C 50                      push eax
:0045BB8D FF15DC624800            call dword ptr [004862DC]
:0045BB93 50                      push eax
:0045BB94 FF15E8624800            call dword ptr [004862E8]
:0045BB9A 8BE5                    mov esp, ebp
:0045BB9C 5D                      pop ebp
:0045BB9D C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:004340B6   , :0043DE89   
|
:0045BBA0 55                      push ebp
:0045BBA1 8BEC                    mov ebp, esp
:0045BBA3 51                      push ecx
:0045BBA4 894DFC                  mov dword ptr [ebp-04], ecx
:0045BBA7 8B45FC                  mov eax, dword ptr [ebp-04]
:0045BBAA C7403400000000          mov [eax+34], 00000000
:0045BBB1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045BBB4 C7413800000000          mov [ecx+38], 00000000
:0045BBBB 8B55FC                  mov edx, dword ptr [ebp-04]
:0045BBBE C7423C00000000          mov [edx+3C], 00000000
:0045BBC5 8B45FC                  mov eax, dword ptr [ebp-04]
:0045BBC8 C7404000000000          mov [eax+40], 00000000
:0045BBCF 6A00                    push 00000000
:0045BBD1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045BBD4 83C124                  add ecx, 00000024
:0045BBD7 E8743A0000              call 0045F650
:0045BBDC 68FF000000              push 000000FF
:0045BBE1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045BBE4 83C124                  add ecx, 00000024
:0045BBE7 E8B2FEFFFF              call 0045BA9E
:0045BBEC 8A4D0C                  mov cl, byte ptr [ebp+0C]
:0045BBEF 51                      push ecx
:0045BBF0 8A5508                  mov dl, byte ptr [ebp+08]
:0045BBF3 52                      push edx
:0045BBF4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045BBF7 83C124                  add ecx, 00000024
:0045BBFA E831FDFFFF              call 0045B930
:0045BBFF 8BE5                    mov esp, ebp
:0045BC01 5D                      pop ebp
:0045BC02 C20800                  ret 0008



* Referenced by a CALL at Address:
|:0045E6A2   
|
:0045BC05 55                      push ebp
:0045BC06 8BEC                    mov ebp, esp
:0045BC08 51                      push ecx
:0045BC09 894DFC                  mov dword ptr [ebp-04], ecx
:0045BC0C A1686A4B00              mov eax, dword ptr [004B6A68]
:0045BC11 50                      push eax

* Possible Reference to Dialog: DialogID_0117 
                                  |
:0045BC12 6817010000              push 00000117
:0045BC17 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045BC1A E879140100              call 0046D098
:0045BC1F 8BE5                    mov esp, ebp
:0045BC21 5D                      pop ebp
:0045BC22 C3                      ret


:0045BC23 55                      push ebp
:0045BC24 8BEC                    mov ebp, esp
:0045BC26 83EC0C                  sub esp, 0000000C
:0045BC29 894DFC                  mov dword ptr [ebp-04], ecx
:0045BC2C 8B4508                  mov eax, dword ptr [ebp+08]
:0045BC2F 8945F8                  mov dword ptr [ebp-08], eax
:0045BC32 817DF811010000          cmp dword ptr [ebp-08], 00000111
:0045BC39 7402                    je 0045BC3D
:0045BC3B EB62                    jmp 0045BC9F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045BC39(C)
|
:0045BC3D 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0045BC40 81E1FFFF0000            and ecx, 0000FFFF
:0045BC46 894DF4                  mov dword ptr [ebp-0C], ecx
:0045BC49 8B55F4                  mov edx, dword ptr [ebp-0C]
:0045BC4C 81EA07050000            sub edx, 00000507
:0045BC52 8955F4                  mov dword ptr [ebp-0C], edx
:0045BC55 837DF404                cmp dword ptr [ebp-0C], 00000004
:0045BC59 7744                    ja 0045BC9F
:0045BC5B 8B45F4                  mov eax, dword ptr [ebp-0C]
:0045BC5E FF2485BCBC4500          jmp dword ptr [4*eax+0045BCBC]
:0045BC65 6A01                    push 00000001
:0045BC67 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045BC6A 83C124                  add ecx, 00000024
:0045BC6D E842FEFFFF              call 0045BAB4
:0045BC72 EB2B                    jmp 0045BC9F
:0045BC74 6A02                    push 00000002
:0045BC76 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045BC79 83C124                  add ecx, 00000024
:0045BC7C E833FEFFFF              call 0045BAB4
:0045BC81 EB1C                    jmp 0045BC9F
:0045BC83 6A03                    push 00000003
:0045BC85 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045BC88 83C124                  add ecx, 00000024
:0045BC8B E824FEFFFF              call 0045BAB4
:0045BC90 EB0D                    jmp 0045BC9F
:0045BC92 6A04                    push 00000004
:0045BC94 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045BC97 83C124                  add ecx, 00000024
:0045BC9A E815FEFFFF              call 0045BAB4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045BC3B(U), :0045BC59(C), :0045BC72(U), :0045BC81(U), :0045BC90(U)
|
:0045BC9F 8B4D10                  mov ecx, dword ptr [ebp+10]
:0045BCA2 51                      push ecx
:0045BCA3 8B550C                  mov edx, dword ptr [ebp+0C]
:0045BCA6 52                      push edx
:0045BCA7 8B4508                  mov eax, dword ptr [ebp+08]
:0045BCAA 50                      push eax
:0045BCAB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045BCAE 8B11                    mov edx, dword ptr [ecx]
:0045BCB0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045BCB3 FF5204                  call [edx+04]
:0045BCB6 8BE5                    mov esp, ebp
:0045BCB8 5D                      pop ebp
:0045BCB9 C20C00                  ret 000C



:0045BCBC 65BC4500                DWORD 0045BC65
:0045BCC0 74BC4500                DWORD 0045BC74
:0045BCC4 83BC4500                DWORD 0045BC83
:0045BCC8 9FBC4500                DWORD 0045BC9F
:0045BCCC 92BC4500                DWORD 0045BC92


:0045BCD0 55                      push ebp
:0045BCD1 8BEC                    mov ebp, esp
:0045BCD3 51                      push ecx
:0045BCD4 894DFC                  mov dword ptr [ebp-04], ecx
:0045BCD7 8B45FC                  mov eax, dword ptr [ebp-04]
:0045BCDA 8B4804                  mov ecx, dword ptr [eax+04]
:0045BCDD 51                      push ecx
:0045BCDE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045BCE1 E8F5FDFFFF              call 0045BADB
:0045BCE6 8BE5                    mov esp, ebp
:0045BCE8 5D                      pop ebp
:0045BCE9 C3                      ret


:0045BCEA 55                      push ebp
:0045BCEB 8BEC                    mov ebp, esp
:0045BCED 51                      push ecx
:0045BCEE 894DFC                  mov dword ptr [ebp-04], ecx
:0045BCF1 68FF000000              push 000000FF
:0045BCF6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045BCF9 83C124                  add ecx, 00000024
:0045BCFC E8B3FDFFFF              call 0045BAB4
:0045BD01 8BE5                    mov esp, ebp
:0045BD03 5D                      pop ebp
:0045BD04 C3                      ret


:0045BD05 55                      push ebp
:0045BD06 8BEC                    mov ebp, esp
:0045BD08 83EC14                  sub esp, 00000014
:0045BD0B 894DF0                  mov dword ptr [ebp-10], ecx
:0045BD0E 8B450C                  mov eax, dword ptr [ebp+0C]
:0045BD11 50                      push eax
:0045BD12 FF1594634800            call dword ptr [00486394]
:0045BD18 8945EC                  mov dword ptr [ebp-14], eax
:0045BD1B 817DEC07050000          cmp dword ptr [ebp-14], 00000507
:0045BD22 7F11                    jg 0045BD35
:0045BD24 817DEC07050000          cmp dword ptr [ebp-14], 00000507
:0045BD2B 7425                    je 0045BD52
:0045BD2D 837DEC02                cmp dword ptr [ebp-14], 00000002
:0045BD31 7443                    je 0045BD76
:0045BD33 EB59                    jmp 0045BD8E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045BD22(C)
|
:0045BD35 817DEC08050000          cmp dword ptr [ebp-14], 00000508
:0045BD3C 741D                    je 0045BD5B
:0045BD3E 817DEC09050000          cmp dword ptr [ebp-14], 00000509
:0045BD45 741D                    je 0045BD64
:0045BD47 817DEC0B050000          cmp dword ptr [ebp-14], 0000050B
:0045BD4E 741D                    je 0045BD6D
:0045BD50 EB3C                    jmp 0045BD8E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045BD2B(C)
|
:0045BD52 C745F400000000          mov [ebp-0C], 00000000
:0045BD59 EB33                    jmp 0045BD8E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045BD3C(C)
|
:0045BD5B C745F401000000          mov [ebp-0C], 00000001
:0045BD62 EB2A                    jmp 0045BD8E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045BD45(C)
|
:0045BD64 C745F402000000          mov [ebp-0C], 00000002
:0045BD6B EB21                    jmp 0045BD8E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045BD4E(C)
|
:0045BD6D C745F403000000          mov [ebp-0C], 00000003
:0045BD74 EB18                    jmp 0045BD8E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045BD31(C)
|
:0045BD76 6A00                    push 00000000
:0045BD78 6A00                    push 00000000
:0045BD7A 6A01                    push 00000001
:0045BD7C 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0045BD7F 51                      push ecx
:0045BD80 8B5508                  mov edx, dword ptr [ebp+08]
:0045BD83 52                      push edx
:0045BD84 E8F85B0100              call 00471981
:0045BD89 83C414                  add esp, 00000014
:0045BD8C EB2F                    jmp 0045BDBD

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045BD33(U), :0045BD50(U), :0045BD59(U), :0045BD62(U), :0045BD6B(U)
|:0045BD74(U)
|
:0045BD8E 8B45F4                  mov eax, dword ptr [ebp-0C]
:0045BD91 50                      push eax
:0045BD92 B91C2E4900              mov ecx, 00492E1C
:0045BD97 E8D4380000              call 0045F670
:0045BD9C 50                      push eax
:0045BD9D 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0045BDA0 E899F9FAFF              call 0040B73E
:0045BDA5 6A00                    push 00000000
:0045BDA7 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0045BDAA 51                      push ecx
:0045BDAB 6A01                    push 00000001
:0045BDAD 8B550C                  mov edx, dword ptr [ebp+0C]
:0045BDB0 52                      push edx
:0045BDB1 8B4508                  mov eax, dword ptr [ebp+08]
:0045BDB4 50                      push eax
:0045BDB5 E8C75B0100              call 00471981
:0045BDBA 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045BD8C(U)
|
:0045BDBD 8BE5                    mov esp, ebp
:0045BDBF 5D                      pop ebp
:0045BDC0 C20800                  ret 0008



* Referenced by a CALL at Address:
|:0045DF16   
|
:0045BDC3 55                      push ebp
:0045BDC4 8BEC                    mov ebp, esp
:0045BDC6 83EC10                  sub esp, 00000010
:0045BDC9 C745F801000000          mov [ebp-08], 00000001
:0045BDD0 EB09                    jmp 0045BDDB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045BE64(U)
|
:0045BDD2 8B45F8                  mov eax, dword ptr [ebp-08]
:0045BDD5 83C001                  add eax, 00000001
:0045BDD8 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045BDD0(U)
|
:0045BDDB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045BDDE 3B4D0C                  cmp ecx, dword ptr [ebp+0C]
:0045BDE1 0F8D82000000            jnl 0045BE69
:0045BDE7 8B55F8                  mov edx, dword ptr [ebp-08]
:0045BDEA 8955F4                  mov dword ptr [ebp-0C], edx
:0045BDED EB09                    jmp 0045BDF8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045BE62(U)
|
:0045BDEF 8B45F4                  mov eax, dword ptr [ebp-0C]
:0045BDF2 83E801                  sub eax, 00000001
:0045BDF5 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045BDED(U)
|
:0045BDF8 837DF400                cmp dword ptr [ebp-0C], 00000000
:0045BDFC 7E66                    jle 0045BE64
:0045BDFE 8B4D18                  mov ecx, dword ptr [ebp+18]
:0045BE01 51                      push ecx
:0045BE02 8B5508                  mov edx, dword ptr [ebp+08]
:0045BE05 0355F4                  add edx, dword ptr [ebp-0C]
:0045BE08 8A02                    mov al, byte ptr [edx]
:0045BE0A 50                      push eax
:0045BE0B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045BE0E 034DF4                  add ecx, dword ptr [ebp-0C]
:0045BE11 8A51FF                  mov dl, byte ptr [ecx-01]
:0045BE14 52                      push edx
:0045BE15 FF5510                  call [ebp+10]
:0045BE18 83C40C                  add esp, 0000000C
:0045BE1B 8945F0                  mov dword ptr [ebp-10], eax
:0045BE1E 837D1400                cmp dword ptr [ebp+14], 00000000
:0045BE22 7406                    je 0045BE2A
:0045BE24 837DF000                cmp dword ptr [ebp-10], 00000000
:0045BE28 7C0C                    jl 0045BE36

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045BE22(C)
|
:0045BE2A 837D1400                cmp dword ptr [ebp+14], 00000000
:0045BE2E 7530                    jne 0045BE60
:0045BE30 837DF000                cmp dword ptr [ebp-10], 00000000
:0045BE34 7E2A                    jle 0045BE60

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045BE28(C)
|
:0045BE36 8B4508                  mov eax, dword ptr [ebp+08]
:0045BE39 0345F4                  add eax, dword ptr [ebp-0C]
:0045BE3C 8A48FF                  mov cl, byte ptr [eax-01]
:0045BE3F 884DFC                  mov byte ptr [ebp-04], cl
:0045BE42 8B5508                  mov edx, dword ptr [ebp+08]
:0045BE45 0355F4                  add edx, dword ptr [ebp-0C]
:0045BE48 8B4508                  mov eax, dword ptr [ebp+08]
:0045BE4B 0345F4                  add eax, dword ptr [ebp-0C]
:0045BE4E 8A08                    mov cl, byte ptr [eax]
:0045BE50 884AFF                  mov byte ptr [edx-01], cl
:0045BE53 8B5508                  mov edx, dword ptr [ebp+08]
:0045BE56 0355F4                  add edx, dword ptr [ebp-0C]
:0045BE59 8A45FC                  mov al, byte ptr [ebp-04]
:0045BE5C 8802                    mov byte ptr [edx], al
:0045BE5E EB02                    jmp 0045BE62

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045BE2E(C), :0045BE34(C)
|
:0045BE60 EB02                    jmp 0045BE64

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045BE5E(U)
|
:0045BE62 EB8B                    jmp 0045BDEF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045BDFC(C), :0045BE60(U)
|
:0045BE64 E969FFFFFF              jmp 0045BDD2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045BDE1(C)
|
:0045BE69 8BE5                    mov esp, ebp
:0045BE6B 5D                      pop ebp
:0045BE6C C3                      ret



* Referenced by a CALL at Address:
|:0045E702   
|
:0045BE6D 55                      push ebp
:0045BE6E 8BEC                    mov ebp, esp
:0045BE70 51                      push ecx
:0045BE71 894DFC                  mov dword ptr [ebp-04], ecx
:0045BE74 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045BE77 83C138                  add ecx, 00000038
:0045BE7A E8A1F6FCFF              call 0042B520
:0045BE7F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045BE82 83C14C                  add ecx, 0000004C
:0045BE85 E896F6FCFF              call 0042B520
:0045BE8A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045BE8D 83C160                  add ecx, 00000060
:0045BE90 E88BF6FCFF              call 0042B520
:0045BE95 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045BE98 83C174                  add ecx, 00000074
:0045BE9B E880F6FCFF              call 0042B520
:0045BEA0 6A26                    push 00000026
:0045BEA2 6A00                    push 00000000
:0045BEA4 6A00                    push 00000000
:0045BEA6 6A00                    push 00000000
:0045BEA8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045BEAB 81C114010000            add ecx, 00000114
:0045BEB1 E83D550000              call 004613F3
:0045BEB6 6A26                    push 00000026
:0045BEB8 6A00                    push 00000000
:0045BEBA 6A00                    push 00000000
:0045BEBC 6A00                    push 00000000
:0045BEBE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045BEC1 81C134010000            add ecx, 00000134
:0045BEC7 E827550000              call 004613F3
:0045BECC 6A26                    push 00000026
:0045BECE 6A00                    push 00000000
:0045BED0 6A00                    push 00000000
:0045BED2 6A00                    push 00000000
:0045BED4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045BED7 81C154010000            add ecx, 00000154
:0045BEDD E811550000              call 004613F3
:0045BEE2 6A26                    push 00000026
:0045BEE4 6A00                    push 00000000
:0045BEE6 6A00                    push 00000000
:0045BEE8 6A00                    push 00000000
:0045BEEA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045BEED 81C174010000            add ecx, 00000174
:0045BEF3 E8FB540000              call 004613F3
:0045BEF8 6A26                    push 00000026
:0045BEFA 6A00                    push 00000000
:0045BEFC 6A00                    push 00000000
:0045BEFE 6A00                    push 00000000
:0045BF00 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045BF03 81C194010000            add ecx, 00000194
:0045BF09 E8E5540000              call 004613F3
:0045BF0E 6A26                    push 00000026
:0045BF10 6A00                    push 00000000
:0045BF12 6A00                    push 00000000
:0045BF14 6A00                    push 00000000
:0045BF16 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045BF19 81C1B4010000            add ecx, 000001B4
:0045BF1F E8CF540000              call 004613F3
:0045BF24 6A26                    push 00000026
:0045BF26 6A00                    push 00000000
:0045BF28 6A00                    push 00000000
:0045BF2A 6A00                    push 00000000
:0045BF2C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045BF2F 81C1D4010000            add ecx, 000001D4
:0045BF35 E8B9540000              call 004613F3
:0045BF3A 6A26                    push 00000026
:0045BF3C 6A00                    push 00000000
:0045BF3E 6A00                    push 00000000
:0045BF40 6A00                    push 00000000
:0045BF42 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045BF45 81C1F4010000            add ecx, 000001F4
:0045BF4B E8A3540000              call 004613F3
:0045BF50 8B45FC                  mov eax, dword ptr [ebp-04]
:0045BF53 C70000000000            mov dword ptr [eax], 00000000
:0045BF59 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045BF5C C64108FF                mov [ecx+08], FF
:0045BF60 8B55FC                  mov edx, dword ptr [ebp-04]
:0045BF63 C64209FF                mov [edx+09], FF
:0045BF67 8B45FC                  mov eax, dword ptr [ebp-04]
:0045BF6A C7400400000000          mov [eax+04], 00000000
:0045BF71 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045BF74 C7818800000000000000    mov dword ptr [ebx+00000088], 00000000
:0045BF7E 8B55FC                  mov edx, dword ptr [ebp-04]
:0045BF81 C68204010000FF          mov byte ptr [edx+00000104], FF
:0045BF88 6A01                    push 00000001
:0045BF8A 68000E0100              push 00010E00
:0045BF8F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045BF92 83C138                  add ecx, 00000038
:0045BF95 E8DB390200              call 0047F975
:0045BF9A 85C0                    test eax, eax
:0045BF9C 750D                    jne 0045BFAB

* Possible StringData Ref from Data Obj ->"SelectBushouClass::Can't Alloc "
                                        ->"Memory!!"
                                  |
:0045BF9E 68B8E34800              push 0048E3B8
:0045BFA3 E898F5FCFF              call 0042B540
:0045BFA8 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045BF9C(C)
|
:0045BFAB 6A01                    push 00000001
:0045BFAD 6800A40100              push 0001A400
:0045BFB2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045BFB5 83C14C                  add ecx, 0000004C
:0045BFB8 E8B8390200              call 0047F975
:0045BFBD 85C0                    test eax, eax
:0045BFBF 750D                    jne 0045BFCE

* Possible StringData Ref from Data Obj ->"SelectBushouClass::Can't Alloc "
                                        ->"Memory!!"
                                  |
:0045BFC1 68E0E34800              push 0048E3E0
:0045BFC6 E875F5FCFF              call 0042B540
:0045BFCB 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045BFBF(C)
|
:0045BFCE 6A01                    push 00000001
:0045BFD0 6800870000              push 00008700
:0045BFD5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045BFD8 83C160                  add ecx, 00000060
:0045BFDB E895390200              call 0047F975
:0045BFE0 85C0                    test eax, eax
:0045BFE2 750D                    jne 0045BFF1

* Possible StringData Ref from Data Obj ->"SelectBushouClass::Can't Alloc "
                                        ->"Memory!!"
                                  |
:0045BFE4 6808E44800              push 0048E408
:0045BFE9 E852F5FCFF              call 0042B540
:0045BFEE 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045BFE2(C)
|
:0045BFF1 6A01                    push 00000001
:0045BFF3 68C40E0000              push 00000EC4
:0045BFF8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045BFFB 83C174                  add ecx, 00000074
:0045BFFE E872390200              call 0047F975
:0045C003 85C0                    test eax, eax
:0045C005 750D                    jne 0045C014

* Possible StringData Ref from Data Obj ->"SelectBushouClass::Can't Alloc "
                                        ->"Memory!!"
                                  |
:0045C007 6830E44800              push 0048E430
:0045C00C E82FF5FCFF              call 0042B540
:0045C011 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045C005(C)
|
:0045C014 8B45FC                  mov eax, dword ptr [ebp-04]
:0045C017 8BE5                    mov esp, ebp
:0045C019 5D                      pop ebp
:0045C01A C3                      ret



* Referenced by a CALL at Address:
|:0045F68A   
|
:0045C01B 55                      push ebp
:0045C01C 8BEC                    mov ebp, esp
:0045C01E 51                      push ecx
:0045C01F 894DFC                  mov dword ptr [ebp-04], ecx
:0045C022 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045C025 83C138                  add ecx, 00000038
:0045C028 E889390200              call 0047F9B6
:0045C02D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045C030 83C14C                  add ecx, 0000004C
:0045C033 E87E390200              call 0047F9B6
:0045C038 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045C03B 83C160                  add ecx, 00000060
:0045C03E E873390200              call 0047F9B6
:0045C043 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045C046 83C174                  add ecx, 00000074
:0045C049 E868390200              call 0047F9B6
:0045C04E 8BE5                    mov esp, ebp
:0045C050 5D                      pop ebp
:0045C051 C3                      ret



* Referenced by a CALL at Addresses:
|:0045F343   , :0045F4CC   
|
:0045C052 55                      push ebp
:0045C053 8BEC                    mov ebp, esp
:0045C055 51                      push ecx
:0045C056 894DFC                  mov dword ptr [ebp-04], ecx
:0045C059 8B45FC                  mov eax, dword ptr [ebp-04]
:0045C05C 33C9                    xor ecx, ecx
:0045C05E 8A4808                  mov cl, byte ptr [eax+08]
:0045C061 8B55FC                  mov edx, dword ptr [ebp-04]
:0045C064 3B8A10010000            cmp ecx, dword ptr [edx+00000110]
:0045C06A 720E                    jb 0045C07A
:0045C06C 8B45FC                  mov eax, dword ptr [ebp-04]
:0045C06F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045C072 8A5108                  mov dl, byte ptr [ecx+08]
:0045C075 885009                  mov byte ptr [eax+09], dl
:0045C078 EB07                    jmp 0045C081

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045C06A(C)
|
:0045C07A 8B45FC                  mov eax, dword ptr [ebp-04]
:0045C07D C64009FF                mov [eax+09], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045C078(U)
|
:0045C081 8BE5                    mov esp, ebp
:0045C083 5D                      pop ebp
:0045C084 C3                      ret



* Referenced by a CALL at Address:
|:0045E9DE   
|
:0045C085 55                      push ebp
:0045C086 8BEC                    mov ebp, esp
:0045C088 51                      push ecx
:0045C089 894DFC                  mov dword ptr [ebp-04], ecx
:0045C08C 8B45FC                  mov eax, dword ptr [ebp-04]
:0045C08F 8A4D08                  mov cl, byte ptr [ebp+08]
:0045C092 884809                  mov byte ptr [eax+09], cl
:0045C095 8B55FC                  mov edx, dword ptr [ebp-04]
:0045C098 33C0                    xor eax, eax
:0045C09A 8A4209                  mov al, byte ptr [edx+09]
:0045C09D 3DFF000000              cmp eax, 000000FF
:0045C0A2 7429                    je 0045C0CD
:0045C0A4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045C0A7 E842000000              call 0045C0EE
:0045C0AC 85C0                    test eax, eax
:0045C0AE 741D                    je 0045C0CD
:0045C0B0 6A01                    push 00000001
:0045C0B2 6A01                    push 00000001
:0045C0B4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045C0B7 8B9188000000            mov edx, dword ptr [ecx+00000088]
:0045C0BD 52                      push edx
:0045C0BE FF15DC624800            call dword ptr [004862DC]
:0045C0C4 50                      push eax
:0045C0C5 FF15E8624800            call dword ptr [004862E8]
:0045C0CB EB1B                    jmp 0045C0E8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045C0A2(C), :0045C0AE(C)
|
:0045C0CD 6A00                    push 00000000
:0045C0CF 6A01                    push 00000001
:0045C0D1 8B45FC                  mov eax, dword ptr [ebp-04]
:0045C0D4 8B8888000000            mov ecx, dword ptr [eax+00000088]
:0045C0DA 51                      push ecx
:0045C0DB FF15DC624800            call dword ptr [004862DC]
:0045C0E1 50                      push eax
:0045C0E2 FF15E8624800            call dword ptr [004862E8]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045C0CB(U)
|
:0045C0E8 8BE5                    mov esp, ebp
:0045C0EA 5D                      pop ebp
:0045C0EB C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0045C0A7   , :0045C550   , :0045DA5E   
|
:0045C0EE 55                      push ebp
:0045C0EF 8BEC                    mov ebp, esp
:0045C0F1 51                      push ecx
:0045C0F2 894DFC                  mov dword ptr [ebp-04], ecx
:0045C0F5 8B45FC                  mov eax, dword ptr [ebp-04]
:0045C0F8 8B800C010000            mov eax, dword ptr [eax+0000010C]
:0045C0FE D1E0                    shl eax, 1
:0045C100 33D2                    xor edx, edx
:0045C102 B903000000              mov ecx, 00000003
:0045C107 F7F1                    div ecx
:0045C109 8B55FC                  mov edx, dword ptr [ebp-04]
:0045C10C 398208010000            cmp dword ptr [edx+00000108], eax
:0045C112 1BC0                    sbb eax, eax
:0045C114 40                      inc eax
:0045C115 8BE5                    mov esp, ebp
:0045C117 5D                      pop ebp
:0045C118 C3                      ret



* Referenced by a CALL at Address:
|:0045E797   
|
:0045C119 55                      push ebp
:0045C11A 8BEC                    mov ebp, esp
:0045C11C 6AFF                    push FFFFFFFF
:0045C11E 68DC564800              push 004856DC
:0045C123 64A100000000            mov eax, dword ptr fs:[00000000]
:0045C129 50                      push eax
:0045C12A 64892500000000          mov dword ptr fs:[00000000], esp
:0045C131 81EC20010000            sub esp, 00000120
:0045C137 898DD4FEFFFF            mov dword ptr [ebp+FFFFFED4], ecx
:0045C13D C785E8FEFFFF00000000    mov dword ptr [ebp+FFFFFEE8], 00000000
:0045C147 C785E0FEFFFF00000000    mov dword ptr [ebp+FFFFFEE0], 00000000
:0045C151 C785ECFEFFFF00000000    mov dword ptr [ebp+FFFFFEEC], 00000000
:0045C15B C785E4FEFFFF00000000    mov dword ptr [ebp+FFFFFEE4], 00000000
:0045C165 8B85D4FEFFFF            mov eax, dword ptr [ebp+FFFFFED4]
:0045C16B C6400800                mov [eax+08], 00
:0045C16F 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:0045C175 C64109FF                mov [ecx+09], FF
:0045C179 8B95D4FEFFFF            mov edx, dword ptr [ebp+FFFFFED4]
:0045C17F C7828800000000000000    mov dword ptr [ebx+00000088], 00000000
:0045C189 8B85D4FEFFFF            mov eax, dword ptr [ebp+FFFFFED4]
:0045C18F 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045C192 8908                    mov dword ptr [eax], ecx
:0045C194 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0045C19A E81171FAFF              call 004032B0
:0045C19F C745FC00000000          mov [ebp-04], 00000000

* Possible StringData Ref from Data Obj ->"UNIT_MOV.E5"
                                  |
:0045C1A6 68E0BB4800              push 0048BBE0
:0045C1AB 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0045C1B1 E87F39FCFF              call 0041FB35

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045C2C2(U)
|
:0045C1B6 8B5508                  mov edx, dword ptr [ebp+08]
:0045C1B9 833A00                  cmp dword ptr [edx], 00000000
:0045C1BC 0F8405010000            je 0045C2C7
:0045C1C2 8B4508                  mov eax, dword ptr [ebp+08]
:0045C1C5 8B08                    mov ecx, dword ptr [eax]
:0045C1C7 E87BA7FAFF              call 00406947
:0045C1CC 8885D8FEFFFF            mov byte ptr [ebp+FFFFFED8], al
:0045C1D2 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:0045C1D8 81E1FF000000            and ecx, 000000FF
:0045C1DE 83F922                  cmp ecx, 00000022
:0045C1E1 7D17                    jge 0045C1FA
:0045C1E3 8B95D8FEFFFF            mov edx, dword ptr [ebp+FFFFFED8]
:0045C1E9 81E2FF000000            and edx, 000000FF
:0045C1EF 6BD203                  imul edx, 00000003
:0045C1F2 8895D8FEFFFF            mov byte ptr [ebp+FFFFFED8], dl
:0045C1F8 EB0E                    jmp 0045C208

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045C1E1(C)
|
:0045C1FA 8A85D8FEFFFF            mov al, byte ptr [ebp+FFFFFED8]
:0045C200 0444                    add al, 44
:0045C202 8885D8FEFFFF            mov byte ptr [ebp+FFFFFED8], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045C1F8(U)
|
:0045C208 B9C8E44A00              mov ecx, 004AE4C8
:0045C20D E87E1EFBFF              call 0040E090
:0045C212 50                      push eax
:0045C213 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:0045C219 81E1FF000000            and ecx, 000000FF
:0045C21F 51                      push ecx
:0045C220 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0045C226 E85E3AFCFF              call 0041FC89
:0045C22B 6800090000              push 00000900
:0045C230 6A04                    push 00000004
:0045C232 6A00                    push 00000000
:0045C234 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:0045C23A 69D200090000            imul edx, 00000900
:0045C240 52                      push edx
:0045C241 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:0045C247 83C138                  add ecx, 00000038
:0045C24A E8F1370200              call 0047FA40
:0045C24F 50                      push eax
:0045C250 6A04                    push 00000004
:0045C252 6A00                    push 00000000
:0045C254 6800360000              push 00003600
:0045C259 B9C8E44A00              mov ecx, 004AE4C8
:0045C25E E8DD370200              call 0047FA40
:0045C263 50                      push eax
:0045C264 E8943A0200              call 0047FCFD
:0045C269 83C40C                  add esp, 0000000C
:0045C26C 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:0045C272 3B450C                  cmp eax, dword ptr [ebp+0C]
:0045C275 732E                    jnb 0045C2A5

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0045C277 6A06                    push 00000006
:0045C279 6A30                    push 00000030
:0045C27B 6A30                    push 00000030
:0045C27D 6A04                    push 00000004
:0045C27F 6A00                    push 00000000
:0045C281 8B8DE8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE8]
:0045C287 69C900090000            imul ecx, 00000900
:0045C28D 51                      push ecx
:0045C28E 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:0045C294 83C138                  add ecx, 00000038
:0045C297 E8A4370200              call 0047FA40
:0045C29C 50                      push eax
:0045C29D E8DE41FDFF              call 00430480
:0045C2A2 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045C275(C)
|
:0045C2A5 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:0045C2AB 83C201                  add edx, 00000001
:0045C2AE 8995E8FEFFFF            mov dword ptr [ebp+FFFFFEE8], edx
:0045C2B4 8B4508                  mov eax, dword ptr [ebp+08]
:0045C2B7 83C004                  add eax, 00000004
:0045C2BA 894508                  mov dword ptr [ebp+08], eax
:0045C2BD E802280200              call 0047EAC4
:0045C2C2 E9EFFEFFFF              jmp 0045C1B6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045C1BC(C)
|
:0045C2C7 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0045C2CD E8F3CFFBFF              call 004192C5
:0045C2D2 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:0045C2D8 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:0045C2DE 895104                  mov dword ptr [ecx+04], edx
:0045C2E1 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:0045C2E7 E808150000              call 0045D7F4
:0045C2EC C785E0FEFFFF00000000    mov dword ptr [ebp+FFFFFEE0], 00000000
:0045C2F6 EB0F                    jmp 0045C307

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045C348(U)
|
:0045C2F8 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:0045C2FE 83C001                  add eax, 00000001
:0045C301 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045C2F6(U)
|
:0045C307 83BDE0FEFFFF1E          cmp dword ptr [ebp+FFFFFEE0], 0000001E
:0045C30E 733A                    jnb 0045C34A
:0045C310 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:0045C316 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:0045C31C 3B5104                  cmp edx, dword ptr [ecx+04]
:0045C31F 7317                    jnb 0045C338
:0045C321 8B85D4FEFFFF            mov eax, dword ptr [ebp+FFFFFED4]
:0045C327 0385E0FEFFFF            add eax, dword ptr [ebp+FFFFFEE0]
:0045C32D 8A8DE0FEFFFF            mov cl, byte ptr [ebp+FFFFFEE0]
:0045C333 88480A                  mov byte ptr [eax+0A], cl
:0045C336 EB10                    jmp 0045C348

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045C31F(C)
|
:0045C338 8B95D4FEFFFF            mov edx, dword ptr [ebp+FFFFFED4]
:0045C33E 0395E0FEFFFF            add edx, dword ptr [ebp+FFFFFEE0]
:0045C344 C6420AFF                mov [edx+0A], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045C336(U)
|
:0045C348 EBAE                    jmp 0045C2F8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045C30E(C)
|
:0045C34A C785E0FEFFFF00000000    mov dword ptr [ebp+FFFFFEE0], 00000000
:0045C354 EB0F                    jmp 0045C365

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045C3A0(U)
|
:0045C356 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:0045C35C 83C001                  add eax, 00000001
:0045C35F 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045C354(U)
|
:0045C365 83BDE0FEFFFF0F          cmp dword ptr [ebp+FFFFFEE0], 0000000F
:0045C36C 7334                    jnb 0045C3A2
:0045C36E 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:0045C374 3B4D0C                  cmp ecx, dword ptr [ebp+0C]
:0045C377 7317                    jnb 0045C390
:0045C379 8B95D4FEFFFF            mov edx, dword ptr [ebp+FFFFFED4]
:0045C37F 0395E0FEFFFF            add edx, dword ptr [ebp+FFFFFEE0]
:0045C385 8A85E0FEFFFF            mov al, byte ptr [ebp+FFFFFEE0]
:0045C38B 884228                  mov byte ptr [edx+28], al
:0045C38E EB10                    jmp 0045C3A0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045C377(C)
|
:0045C390 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:0045C396 038DE0FEFFFF            add ecx, dword ptr [ebp+FFFFFEE0]
:0045C39C C64128FF                mov [ecx+28], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045C38E(U)
|
:0045C3A0 EBB4                    jmp 0045C356

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045C36C(C)
|
:0045C3A2 8B15B4E34800            mov edx, dword ptr [0048E3B4]
:0045C3A8 52                      push edx
:0045C3A9 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:0045C3AF E8E81A0000              call 0045DE9C
:0045C3B4 A1A8E34800              mov eax, dword ptr [0048E3A8]
:0045C3B9 3B05B4E34800            cmp eax, dword ptr [0048E3B4]
:0045C3BF 740B                    je 0045C3CC
:0045C3C1 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:0045C3C7 E804340000              call 0045F7D0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045C3BF(C)
|
:0045C3CC 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:0045C3D2 8B5510                  mov edx, dword ptr [ebp+10]
:0045C3D5 89910C010000            mov dword ptr [ecx+0000010C], edx
:0045C3DB 8B85D4FEFFFF            mov eax, dword ptr [ebp+FFFFFED4]
:0045C3E1 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0045C3E4 898810010000            mov dword ptr [eax+00000110], ecx
:0045C3EA 8B95D4FEFFFF            mov edx, dword ptr [ebp+FFFFFED4]
:0045C3F0 8B85D4FEFFFF            mov eax, dword ptr [ebp+FFFFFED4]
:0045C3F6 8B8A0C010000            mov ecx, dword ptr [edx+0000010C]
:0045C3FC 3B4804                  cmp ecx, dword ptr [eax+04]
:0045C3FF 7615                    jbe 0045C416
:0045C401 8B95D4FEFFFF            mov edx, dword ptr [ebp+FFFFFED4]
:0045C407 8B85D4FEFFFF            mov eax, dword ptr [ebp+FFFFFED4]
:0045C40D 8B4804                  mov ecx, dword ptr [eax+04]
:0045C410 898A0C010000            mov dword ptr [edx+0000010C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045C3FF(C)
|
:0045C416 C785DCFEFFFF00000000    mov dword ptr [ebp+FFFFFEDC], 00000000
:0045C420 EB0F                    jmp 0045C431

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045C45C(U)
|
:0045C422 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:0045C428 83C201                  add edx, 00000001
:0045C42B 8995DCFEFFFF            mov dword ptr [ebp+FFFFFEDC], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045C420(U)
|
:0045C431 8B85D4FEFFFF            mov eax, dword ptr [ebp+FFFFFED4]
:0045C437 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:0045C43D 3B8810010000            cmp ecx, dword ptr [eax+00000110]
:0045C443 7319                    jnb 0045C45E
:0045C445 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:0045C44B 8B85D4FEFFFF            mov eax, dword ptr [ebp+FFFFFED4]
:0045C451 C784908C00000001000000  mov dword ptr [eax+4*edx+0000008C], 00000001
:0045C45C EBC4                    jmp 0045C422

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045C443(C)
|
:0045C45E 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:0045C464 8B95D4FEFFFF            mov edx, dword ptr [ebp+FFFFFED4]
:0045C46A 8B8210010000            mov eax, dword ptr [edx+00000110]
:0045C470 898108010000            mov dword ptr [ecx+00000108], eax
:0045C476 C785E0FEFFFF00000000    mov dword ptr [ebp+FFFFFEE0], 00000000
:0045C480 EB0F                    jmp 0045C491

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045C4C5(U)
|
:0045C482 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:0045C488 83C101                  add ecx, 00000001
:0045C48B 898DE0FEFFFF            mov dword ptr [ebp+FFFFFEE0], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045C480(U)
|
:0045C491 8B95D4FEFFFF            mov edx, dword ptr [ebp+FFFFFED4]
:0045C497 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:0045C49D 3B4204                  cmp eax, dword ptr [edx+04]
:0045C4A0 7325                    jnb 0045C4C7
:0045C4A2 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:0045C4A8 8B11                    mov edx, dword ptr [ecx]
:0045C4AA 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:0045C4B0 8B0C82                  mov ecx, dword ptr [edx+4*eax]
:0045C4B3 E848D0FAFF              call 00409500
:0045C4B8 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:0045C4BE 89048DF06C4B00          mov dword ptr [4*ecx+004B6CF0], eax
:0045C4C5 EBBB                    jmp 0045C482

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045C4A0(C)
|
:0045C4C7 8B95D4FEFFFF            mov edx, dword ptr [ebp+FFFFFED4]
:0045C4CD 8B4204                  mov eax, dword ptr [edx+04]
:0045C4D0 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax
:0045C4D6 EB0F                    jmp 0045C4E7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045C504(U)
|
:0045C4D8 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:0045C4DE 83C101                  add ecx, 00000001
:0045C4E1 898DE0FEFFFF            mov dword ptr [ebp+FFFFFEE0], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045C4D6(U)
|
:0045C4E7 81BDE0FEFFFF00020000    cmp dword ptr [ebp+FFFFFEE0], 00000200
:0045C4F1 7313                    jnb 0045C506
:0045C4F3 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:0045C4F9 C70495F06C4B00FFFF0000  mov dword ptr [4*edx+004B6CF0], 0000FFFF
:0045C504 EBD2                    jmp 0045C4D8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045C4F1(C)
|
:0045C506 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0045C50D 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0045C513 E8B86DFAFF              call 004032D0
:0045C518 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0045C51B 64890D00000000          mov dword ptr fs:[00000000], ecx
:0045C522 8BE5                    mov esp, ebp
:0045C524 5D                      pop ebp
:0045C525 C20C00                  ret 000C



* Referenced by a CALL at Address:
|:0045E92D   
|
:0045C528 55                      push ebp
:0045C529 8BEC                    mov ebp, esp
:0045C52B 51                      push ecx
:0045C52C 894DFC                  mov dword ptr [ebp-04], ecx
:0045C52F 837D0800                cmp dword ptr [ebp+08], 00000000
:0045C533 740C                    je 0045C541
:0045C535 8B45FC                  mov eax, dword ptr [ebp-04]
:0045C538 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045C53B 898888000000            mov dword ptr [eax+00000088], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045C533(C)
|
:0045C541 8B55FC                  mov edx, dword ptr [ebp-04]
:0045C544 83BA0801000000          cmp dword ptr [edx+00000108], 00000000
:0045C54B 7627                    jbe 0045C574
:0045C54D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045C550 E899FBFFFF              call 0045C0EE
:0045C555 85C0                    test eax, eax
:0045C557 741B                    je 0045C574
:0045C559 6A01                    push 00000001
:0045C55B 6A01                    push 00000001
:0045C55D 8B45FC                  mov eax, dword ptr [ebp-04]
:0045C560 8B8888000000            mov ecx, dword ptr [eax+00000088]
:0045C566 51                      push ecx
:0045C567 FF15DC624800            call dword ptr [004862DC]
:0045C56D 50                      push eax
:0045C56E FF15E8624800            call dword ptr [004862E8]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045C54B(C), :0045C557(C)
|
:0045C574 8BE5                    mov esp, ebp
:0045C576 5D                      pop ebp
:0045C577 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0045DA0C   , :0045F2DD   
|
:0045C57A 55                      push ebp
:0045C57B 8BEC                    mov ebp, esp
:0045C57D 83EC10                  sub esp, 00000010
:0045C580 894DF0                  mov dword ptr [ebp-10], ecx
:0045C583 C745F800000000          mov [ebp-08], 00000000
:0045C58A 8B450C                  mov eax, dword ptr [ebp+0C]
:0045C58D 83E808                  sub eax, 00000008
:0045C590 89450C                  mov dword ptr [ebp+0C], eax
:0045C593 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045C596 83E908                  sub ecx, 00000008
:0045C599 894D08                  mov dword ptr [ebp+08], ecx
:0045C59C 8B4508                  mov eax, dword ptr [ebp+08]
:0045C59F 33D2                    xor edx, edx
:0045C5A1 B938000000              mov ecx, 00000038
:0045C5A6 F7F1                    div ecx
:0045C5A8 8945FC                  mov dword ptr [ebp-04], eax
:0045C5AB 8B450C                  mov eax, dword ptr [ebp+0C]
:0045C5AE 33D2                    xor edx, edx
:0045C5B0 B948000000              mov ecx, 00000048
:0045C5B5 F7F1                    div ecx
:0045C5B7 8945F4                  mov dword ptr [ebp-0C], eax
:0045C5BA 837DFC00                cmp dword ptr [ebp-04], 00000000
:0045C5BE 7244                    jb 0045C604
:0045C5C0 837DFC07                cmp dword ptr [ebp-04], 00000007
:0045C5C4 733E                    jnb 0045C604
:0045C5C6 837DF400                cmp dword ptr [ebp-0C], 00000000
:0045C5CA 7238                    jb 0045C604
:0045C5CC 837DF404                cmp dword ptr [ebp-0C], 00000004
:0045C5D0 7332                    jnb 0045C604
:0045C5D2 8B55F4                  mov edx, dword ptr [ebp-0C]
:0045C5D5 6BD207                  imul edx, 00000007
:0045C5D8 8B45FC                  mov eax, dword ptr [ebp-04]
:0045C5DB 03C2                    add eax, edx
:0045C5DD 8945F8                  mov dword ptr [ebp-08], eax
:0045C5E0 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0045C5E3 8B55F8                  mov edx, dword ptr [ebp-08]
:0045C5E6 3B5104                  cmp edx, dword ptr [ecx+04]
:0045C5E9 7209                    jb 0045C5F4
:0045C5EB C745F8FF000000          mov [ebp-08], 000000FF
:0045C5F2 EB0E                    jmp 0045C602

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045C5E9(C)
|
:0045C5F4 8B45F0                  mov eax, dword ptr [ebp-10]
:0045C5F7 0345F8                  add eax, dword ptr [ebp-08]
:0045C5FA 33C9                    xor ecx, ecx
:0045C5FC 8A480A                  mov cl, byte ptr [eax+0A]
:0045C5FF 894DF8                  mov dword ptr [ebp-08], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045C5F2(U)
|
:0045C602 EB07                    jmp 0045C60B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045C5BE(C), :0045C5C4(C), :0045C5CA(C), :0045C5D0(C)
|
:0045C604 C745F8FF000000          mov [ebp-08], 000000FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045C602(U)
|
:0045C60B 8A45F8                  mov al, byte ptr [ebp-08]
:0045C60E 8BE5                    mov esp, ebp
:0045C610 5D                      pop ebp
:0045C611 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0045DA36   , :0045F4A4   
|
:0045C614 55                      push ebp
:0045C615 8BEC                    mov ebp, esp
:0045C617 83EC10                  sub esp, 00000010
:0045C61A 894DF0                  mov dword ptr [ebp-10], ecx
:0045C61D C745F800000000          mov [ebp-08], 00000000
:0045C624 8B4508                  mov eax, dword ptr [ebp+08]
:0045C627 33D2                    xor edx, edx
:0045C629 B932000000              mov ecx, 00000032
:0045C62E F7F1                    div ecx
:0045C630 8945FC                  mov dword ptr [ebp-04], eax
:0045C633 8B550C                  mov edx, dword ptr [ebp+0C]
:0045C636 C1EA06                  shr edx, 06
:0045C639 8955F4                  mov dword ptr [ebp-0C], edx
:0045C63C 837DFC00                cmp dword ptr [ebp-04], 00000000
:0045C640 7245                    jb 0045C687
:0045C642 837DFC08                cmp dword ptr [ebp-04], 00000008
:0045C646 733F                    jnb 0045C687
:0045C648 837DF400                cmp dword ptr [ebp-0C], 00000000
:0045C64C 7239                    jb 0045C687
:0045C64E 837DF402                cmp dword ptr [ebp-0C], 00000002
:0045C652 7333                    jnb 0045C687
:0045C654 8B45F4                  mov eax, dword ptr [ebp-0C]
:0045C657 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045C65A 8D14C1                  lea edx, dword ptr [ecx+8*eax]
:0045C65D 8955F8                  mov dword ptr [ebp-08], edx
:0045C660 8B45F0                  mov eax, dword ptr [ebp-10]
:0045C663 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045C666 3B8808010000            cmp ecx, dword ptr [eax+00000108]
:0045C66C 7209                    jb 0045C677
:0045C66E C745F8FF000000          mov [ebp-08], 000000FF
:0045C675 EB0E                    jmp 0045C685

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045C66C(C)
|
:0045C677 8B55F0                  mov edx, dword ptr [ebp-10]
:0045C67A 0355F8                  add edx, dword ptr [ebp-08]
:0045C67D 33C0                    xor eax, eax
:0045C67F 8A4228                  mov al, byte ptr [edx+28]
:0045C682 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045C675(U)
|
:0045C685 EB07                    jmp 0045C68E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045C640(C), :0045C646(C), :0045C64C(C), :0045C652(C)
|
:0045C687 C745F8FF000000          mov [ebp-08], 000000FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045C685(U)
|
:0045C68E 8A45F8                  mov al, byte ptr [ebp-08]
:0045C691 8BE5                    mov esp, ebp
:0045C693 5D                      pop ebp
:0045C694 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0045CB7A   , :0045CC94   , :0045E964   
|
:0045C697 55                      push ebp
:0045C698 8BEC                    mov ebp, esp
:0045C69A 83EC08                  sub esp, 00000008
:0045C69D 894DF8                  mov dword ptr [ebp-08], ecx
:0045C6A0 8B45F8                  mov eax, dword ptr [ebp-08]
:0045C6A3 83B88800000000          cmp dword ptr [eax+00000088], 00000000
:0045C6AA 7505                    jne 0045C6B1
:0045C6AC E934040000              jmp 0045CAE5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045C6AA(C)
|
:0045C6B1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045C6B4 33D2                    xor edx, edx
:0045C6B6 8A5108                  mov dl, byte ptr [ecx+08]
:0045C6B9 81FAFF000000            cmp edx, 000000FF
:0045C6BF 7505                    jne 0045C6C6
:0045C6C1 E91F040000              jmp 0045CAE5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045C6BF(C)
|
:0045C6C6 8B45F8                  mov eax, dword ptr [ebp-08]
:0045C6C9 33C9                    xor ecx, ecx
:0045C6CB 8A4808                  mov cl, byte ptr [eax+08]
:0045C6CE 8B55F8                  mov edx, dword ptr [ebp-08]
:0045C6D1 8B02                    mov eax, dword ptr [edx]
:0045C6D3 8B0C88                  mov ecx, dword ptr [eax+4*ecx]
:0045C6D6 894DFC                  mov dword ptr [ebp-04], ecx
:0045C6D9 6A04                    push 00000004
:0045C6DB 6A00                    push 00000000
:0045C6DD 6A00                    push 00000000
:0045C6DF B910114A00              mov ecx, 004A1110
:0045C6E4 E857330200              call 0047FA40
:0045C6E9 50                      push eax
:0045C6EA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045C6ED E8B5AEFAFF              call 004075A7
:0045C6F2 50                      push eax
:0045C6F3 B938C54A00              mov ecx, 004AC538
:0045C6F8 E88C35FCFF              call 0041FC89
:0045C6FD 6A10                    push 00000010
:0045C6FF E8DF030200              call 0047CAE3
:0045C704 83C404                  add esp, 00000004

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0045C707 6A07                    push 00000007
:0045C709 E8BC0A0200              call 0047D1CA
:0045C70E 83C404                  add esp, 00000004
:0045C711 6A00                    push 00000000
:0045C713 6A12                    push 00000012
:0045C715 6A04                    push 00000004
:0045C717 E8D50A0200              call 0047D1F1
:0045C71C 83C40C                  add esp, 0000000C
:0045C71F B910114A00              mov ecx, 004A1110
:0045C724 E86719FBFF              call 0040E090
:0045C729 50                      push eax
:0045C72A 8B15EC684800            mov edx, dword ptr [004868EC]
:0045C730 52                      push edx
:0045C731 A1E8684800              mov eax, dword ptr [004868E8]
:0045C736 50                      push eax
:0045C737 6A00                    push 00000000
:0045C739 6A00                    push 00000000
:0045C73B E85B190200              call 0047E09B
:0045C740 83C414                  add esp, 00000014
:0045C743 6A00                    push 00000000
:0045C745 E899030200              call 0047CAE3
:0045C74A 83C404                  add esp, 00000004
:0045C74D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045C750 E802B0FAFF              call 00407757
:0045C755 50                      push eax
:0045C756 6873040000              push 00000473
:0045C75B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045C75E 8B9188000000            mov edx, dword ptr [ecx+00000088]
:0045C764 52                      push edx
:0045C765 FF15D8624800            call dword ptr [004862D8]
:0045C76B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045C76E E89D9EFAFF              call 00406610
:0045C773 25FF000000              and eax, 000000FF
:0045C778 8B0485A8BE4800          mov eax, dword ptr [4*eax+0048BEA8]
:0045C77F 50                      push eax
:0045C780 6875040000              push 00000475
:0045C785 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045C788 8B9188000000            mov edx, dword ptr [ecx+00000088]
:0045C78E 52                      push edx
:0045C78F FF15D8624800            call dword ptr [004862D8]
:0045C795 6A00                    push 00000000
:0045C797 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045C79A E8319EFAFF              call 004065D0
:0045C79F 25FF000000              and eax, 000000FF
:0045C7A4 50                      push eax
:0045C7A5 68F9030000              push 000003F9
:0045C7AA 8B45F8                  mov eax, dword ptr [ebp-08]
:0045C7AD 8B8888000000            mov ecx, dword ptr [eax+00000088]
:0045C7B3 51                      push ecx
:0045C7B4 FF15E4624800            call dword ptr [004862E4]
:0045C7BA 6A00                    push 00000000
:0045C7BC 6A01                    push 00000001
:0045C7BE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045C7C1 E86A16FCFF              call 0041DE30
:0045C7C6 25FF000000              and eax, 000000FF
:0045C7CB 50                      push eax

* Possible Reference to Dialog: DialogID_011A, CONTROL_ID:03FA, ""
                                  |
:0045C7CC 68FA030000              push 000003FA
:0045C7D1 8B55F8                  mov edx, dword ptr [ebp-08]
:0045C7D4 8B8288000000            mov eax, dword ptr [edx+00000088]
:0045C7DA 50                      push eax
:0045C7DB FF15E4624800            call dword ptr [004862E4]
:0045C7E1 6A00                    push 00000000
:0045C7E3 6A01                    push 00000001
:0045C7E5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045C7E8 E8C316FCFF              call 0041DEB0
:0045C7ED 25FF000000              and eax, 000000FF
:0045C7F2 50                      push eax

* Possible Reference to Dialog: DialogID_011C, CONTROL_ID:0561, "A"
                                  |
:0045C7F3 6861050000              push 00000561
:0045C7F8 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045C7FB 8B9188000000            mov edx, dword ptr [ecx+00000088]
:0045C801 52                      push edx
:0045C802 FF15E4624800            call dword ptr [004862E4]
:0045C808 6A00                    push 00000000
:0045C80A 6A01                    push 00000001
:0045C80C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045C80F E85C16FCFF              call 0041DE70
:0045C814 25FF000000              and eax, 000000FF
:0045C819 50                      push eax

* Possible Reference to Dialog: DialogID_011C, CONTROL_ID:03F1, "A"
                                  |
:0045C81A 68F1030000              push 000003F1
:0045C81F 8B45F8                  mov eax, dword ptr [ebp-08]
:0045C822 8B8888000000            mov ecx, dword ptr [eax+00000088]
:0045C828 51                      push ecx
:0045C829 FF15E4624800            call dword ptr [004862E4]
:0045C82F 6A00                    push 00000000
:0045C831 6A01                    push 00000001
:0045C833 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045C836 E8F516FCFF              call 0041DF30
:0045C83B 25FF000000              and eax, 000000FF
:0045C840 50                      push eax

* Possible Reference to Dialog: DialogID_011C, CONTROL_ID:0562, "A"
                                  |
:0045C841 6862050000              push 00000562
:0045C846 8B55F8                  mov edx, dword ptr [ebp-08]
:0045C849 8B8288000000            mov eax, dword ptr [edx+00000088]
:0045C84F 50                      push eax
:0045C850 FF15E4624800            call dword ptr [004862E4]
:0045C856 6A00                    push 00000000
:0045C858 6A01                    push 00000001
:0045C85A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045C85D E88E16FCFF              call 0041DEF0
:0045C862 25FF000000              and eax, 000000FF
:0045C867 50                      push eax

* Possible Reference to Dialog: DialogID_011C, CONTROL_ID:0563, "A"
                                  |
:0045C868 6863050000              push 00000563
:0045C86D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045C870 8B9188000000            mov edx, dword ptr [ecx+00000088]
:0045C876 52                      push edx
:0045C877 FF15E4624800            call dword ptr [004862E4]
:0045C87D 6A00                    push 00000000
:0045C87F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045C882 E894A9FAFF              call 0040721B
:0045C887 50                      push eax
:0045C888 68FE030000              push 000003FE
:0045C88D 8B45F8                  mov eax, dword ptr [ebp-08]
:0045C890 8B8888000000            mov ecx, dword ptr [eax+00000088]
:0045C896 51                      push ecx
:0045C897 FF15E4624800            call dword ptr [004862E4]
:0045C89D 68F4010000              push 000001F4
:0045C8A2 6A00                    push 00000000
:0045C8A4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045C8A7 E86FA9FAFF              call 0040721B
:0045C8AC 50                      push eax
:0045C8AD 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045C8B0 81C114010000            add ecx, 00000114
:0045C8B6 E88D4B0000              call 00461448
:0045C8BB 6A00                    push 00000000
:0045C8BD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045C8C0 E885A9FAFF              call 0040724A
:0045C8C5 50                      push eax
:0045C8C6 68F3030000              push 000003F3
:0045C8CB 8B55F8                  mov edx, dword ptr [ebp-08]
:0045C8CE 8B8288000000            mov eax, dword ptr [edx+00000088]
:0045C8D4 50                      push eax
:0045C8D5 FF15E4624800            call dword ptr [004862E4]
:0045C8DB 68FA000000              push 000000FA
:0045C8E0 6A00                    push 00000000
:0045C8E2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045C8E5 E860A9FAFF              call 0040724A
:0045C8EA 50                      push eax
:0045C8EB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045C8EE 81C134010000            add ecx, 00000134
:0045C8F4 E84F4B0000              call 00461448
:0045C8F9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045C8FC E84F9DFAFF              call 00406650
:0045C901 25FF000000              and eax, 000000FF
:0045C906 3DFF000000              cmp eax, 000000FF
:0045C90B 7530                    jne 0045C93D
:0045C90D 68D46A4800              push 00486AD4
:0045C912 68F5030000              push 000003F5
:0045C917 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045C91A 8B9188000000            mov edx, dword ptr [ecx+00000088]
:0045C920 52                      push edx
:0045C921 FF15D8624800            call dword ptr [004862D8]
:0045C927 6A64                    push 00000064
:0045C929 6A00                    push 00000000
:0045C92B 6A64                    push 00000064
:0045C92D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045C930 81C154010000            add ecx, 00000154
:0045C936 E80D4B0000              call 00461448
:0045C93B EB45                    jmp 0045C982

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045C90B(C)
|
:0045C93D 6A00                    push 00000000
:0045C93F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045C942 E8099DFAFF              call 00406650
:0045C947 25FF000000              and eax, 000000FF
:0045C94C 50                      push eax
:0045C94D 68F5030000              push 000003F5
:0045C952 8B45F8                  mov eax, dword ptr [ebp-08]
:0045C955 8B8888000000            mov ecx, dword ptr [eax+00000088]
:0045C95B 51                      push ecx
:0045C95C FF15E4624800            call dword ptr [004862E4]
:0045C962 6A64                    push 00000064
:0045C964 6A00                    push 00000000
:0045C966 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045C969 E8E29CFAFF              call 00406650
:0045C96E 25FF000000              and eax, 000000FF
:0045C973 50                      push eax
:0045C974 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045C977 81C154010000            add ecx, 00000154
:0045C97D E8C64A0000              call 00461448

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045C93B(U)
|
:0045C982 6A00                    push 00000000
:0045C984 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045C987 E89AA7FAFF              call 00407126
:0045C98C 50                      push eax
:0045C98D 68EE030000              push 000003EE
:0045C992 8B55F8                  mov edx, dword ptr [ebp-08]
:0045C995 8B8288000000            mov eax, dword ptr [edx+00000088]
:0045C99B 50                      push eax
:0045C99C FF15E4624800            call dword ptr [004862E4]
:0045C9A2 6890010000              push 00000190
:0045C9A7 6A00                    push 00000000
:0045C9A9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045C9AC E875A7FAFF              call 00407126
:0045C9B1 50                      push eax
:0045C9B2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045C9B5 81C174010000            add ecx, 00000174
:0045C9BB E8884A0000              call 00461448
:0045C9C0 6A00                    push 00000000
:0045C9C2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045C9C5 E8BEA7FAFF              call 00407188
:0045C9CA 50                      push eax
:0045C9CB 68FF030000              push 000003FF
:0045C9D0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045C9D3 8B9188000000            mov edx, dword ptr [ecx+00000088]
:0045C9D9 52                      push edx
:0045C9DA FF15E4624800            call dword ptr [004862E4]
:0045C9E0 6890010000              push 00000190
:0045C9E5 6A00                    push 00000000
:0045C9E7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045C9EA E899A7FAFF              call 00407188
:0045C9EF 50                      push eax
:0045C9F0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045C9F3 81C194010000            add ecx, 00000194
:0045C9F9 E84A4A0000              call 00461448
:0045C9FE 6A00                    push 00000000
:0045CA00 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045CA03 E84FA7FAFF              call 00407157
:0045CA08 50                      push eax
:0045CA09 6800040000              push 00000400
:0045CA0E 8B45F8                  mov eax, dword ptr [ebp-08]
:0045CA11 8B8888000000            mov ecx, dword ptr [eax+00000088]
:0045CA17 51                      push ecx
:0045CA18 FF15E4624800            call dword ptr [004862E4]
:0045CA1E 6890010000              push 00000190
:0045CA23 6A00                    push 00000000
:0045CA25 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045CA28 E82AA7FAFF              call 00407157
:0045CA2D 50                      push eax
:0045CA2E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045CA31 81C1B4010000            add ecx, 000001B4
:0045CA37 E80C4A0000              call 00461448
:0045CA3C 6A00                    push 00000000
:0045CA3E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045CA41 E873A7FAFF              call 004071B9
:0045CA46 50                      push eax
:0045CA47 68F4030000              push 000003F4
:0045CA4C 8B55F8                  mov edx, dword ptr [ebp-08]
:0045CA4F 8B8288000000            mov eax, dword ptr [edx+00000088]
:0045CA55 50                      push eax
:0045CA56 FF15E4624800            call dword ptr [004862E4]
:0045CA5C 6890010000              push 00000190
:0045CA61 6A00                    push 00000000
:0045CA63 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045CA66 E84EA7FAFF              call 004071B9
:0045CA6B 50                      push eax
:0045CA6C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045CA6F 81C1D4010000            add ecx, 000001D4
:0045CA75 E8CE490000              call 00461448
:0045CA7A 6A00                    push 00000000
:0045CA7C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045CA7F E866A7FAFF              call 004071EA
:0045CA84 50                      push eax
:0045CA85 68EF030000              push 000003EF
:0045CA8A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045CA8D 8B9188000000            mov edx, dword ptr [ecx+00000088]
:0045CA93 52                      push edx
:0045CA94 FF15E4624800            call dword ptr [004862E4]
:0045CA9A 6890010000              push 00000190
:0045CA9F 6A00                    push 00000000
:0045CAA1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045CAA4 E841A7FAFF              call 004071EA
:0045CAA9 50                      push eax
:0045CAAA 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045CAAD 81C1F4010000            add ecx, 000001F4
:0045CAB3 E890490000              call 00461448
:0045CAB8 6A00                    push 00000000
:0045CABA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045CABD E8B9A7FAFF              call 0040727B
:0045CAC2 25FF000000              and eax, 000000FF
:0045CAC7 50                      push eax

* Possible Reference to Dialog: DialogID_00B2, CONTROL_ID:03F0, "99"
                                  |
:0045CAC8 68F0030000              push 000003F0
:0045CACD 8B45F8                  mov eax, dword ptr [ebp-08]
:0045CAD0 8B8888000000            mov ecx, dword ptr [eax+00000088]
:0045CAD6 51                      push ecx
:0045CAD7 FF15E4624800            call dword ptr [004862E4]
:0045CADD 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045CAE0 E8BD0A0000              call 0045D5A2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045C6AC(U), :0045C6C1(U)
|
:0045CAE5 8BE5                    mov esp, ebp
:0045CAE7 5D                      pop ebp
:0045CAE8 C3                      ret



* Referenced by a CALL at Addresses:
|:0045DA4A   , :0045F2EF   , :0045F4B6   
|
:0045CAE9 55                      push ebp
:0045CAEA 8BEC                    mov ebp, esp
:0045CAEC 83EC10                  sub esp, 00000010
:0045CAEF 56                      push esi
:0045CAF0 894DF0                  mov dword ptr [ebp-10], ecx
:0045CAF3 8B45F0                  mov eax, dword ptr [ebp-10]
:0045CAF6 33C9                    xor ecx, ecx
:0045CAF8 8A4808                  mov cl, byte ptr [eax+08]
:0045CAFB 81F9FF000000            cmp ecx, 000000FF
:0045CB01 7426                    je 0045CB29
:0045CB03 8B55F0                  mov edx, dword ptr [ebp-10]
:0045CB06 33C0                    xor eax, eax
:0045CB08 8A4208                  mov al, byte ptr [edx+08]
:0045CB0B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045CB0E 81E1FF000000            and ecx, 000000FF
:0045CB14 3BC1                    cmp eax, ecx
:0045CB16 7411                    je 0045CB29
:0045CB18 8B55F0                  mov edx, dword ptr [ebp-10]
:0045CB1B 33C0                    xor eax, eax
:0045CB1D 8A4208                  mov al, byte ptr [edx+08]
:0045CB20 50                      push eax
:0045CB21 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0045CB24 E844030000              call 0045CE6D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045CB01(C), :0045CB16(C)
|
:0045CB29 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045CB2C 81E1FF000000            and ecx, 000000FF
:0045CB32 81F9FF000000            cmp ecx, 000000FF
:0045CB38 750C                    jne 0045CB46
:0045CB3A 8B55F0                  mov edx, dword ptr [ebp-10]
:0045CB3D C64208FF                mov [edx+08], FF
:0045CB41 E953010000              jmp 0045CC99

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045CB38(C)
|
:0045CB46 8B4508                  mov eax, dword ptr [ebp+08]
:0045CB49 25FF000000              and eax, 000000FF
:0045CB4E 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0045CB51 3B8110010000            cmp eax, dword ptr [ecx+00000110]
:0045CB57 732B                    jnb 0045CB84
:0045CB59 8B55F0                  mov edx, dword ptr [ebp-10]
:0045CB5C 33C0                    xor eax, eax
:0045CB5E 8A4208                  mov al, byte ptr [edx+08]
:0045CB61 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045CB64 81E1FF000000            and ecx, 000000FF
:0045CB6A 3BC1                    cmp eax, ecx
:0045CB6C 7411                    je 0045CB7F
:0045CB6E 8B55F0                  mov edx, dword ptr [ebp-10]
:0045CB71 8A4508                  mov al, byte ptr [ebp+08]
:0045CB74 884208                  mov byte ptr [edx+08], al
:0045CB77 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0045CB7A E818FBFFFF              call 0045C697

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045CB6C(C)
|
:0045CB7F E915010000              jmp 0045CC99

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045CB57(C)
|
:0045CB84 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045CB87 81E1FF000000            and ecx, 000000FF
:0045CB8D 51                      push ecx
:0045CB8E 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0045CB91 E80C080000              call 0045D3A2
:0045CB96 8945FC                  mov dword ptr [ebp-04], eax
:0045CB99 8B5508                  mov edx, dword ptr [ebp+08]
:0045CB9C 81E2FF000000            and edx, 000000FF
:0045CBA2 52                      push edx
:0045CBA3 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0045CBA6 E821080000              call 0045D3CC
:0045CBAB 8945F8                  mov dword ptr [ebp-08], eax
:0045CBAE 8B4508                  mov eax, dword ptr [ebp+08]
:0045CBB1 25FF000000              and eax, 000000FF
:0045CBB6 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0045CBB9 8B11                    mov edx, dword ptr [ecx]
:0045CBBB 8B0482                  mov eax, dword ptr [edx+4*eax]
:0045CBBE 8945F4                  mov dword ptr [ebp-0C], eax

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0045CBC1 6A07                    push 00000007
:0045CBC3 E81BFF0100              call 0047CAE3
:0045CBC8 83C404                  add esp, 00000004
:0045CBCB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045CBCE 83C130                  add ecx, 00000030
:0045CBD1 51                      push ecx
:0045CBD2 8B75FC                  mov esi, dword ptr [ebp-04]
:0045CBD5 C1EE03                  shr esi, 03
:0045CBD8 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0045CBDB E877ABFAFF              call 00407757
:0045CBE0 50                      push eax
:0045CBE1 E874300200              call 0047FC5A
:0045CBE6 83C404                  add esp, 00000004

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0045CBE9 BA07000000              mov edx, 00000007
:0045CBEE 2BD0                    sub edx, eax
:0045CBF0 D1EA                    shr edx, 1
:0045CBF2 03F2                    add esi, edx
:0045CBF4 56                      push esi
:0045CBF5 B9382F4900              mov ecx, 00492F38
:0045CBFA E8D81FFBFF              call 0040EBD7
:0045CBFF 6A04                    push 00000004
:0045CC01 B9382F4900              mov ecx, 00492F38
:0045CC06 E82B21FBFF              call 0040ED36
:0045CC0B 6A01                    push 00000001
:0045CC0D B9382F4900              mov ecx, 00492F38
:0045CC12 E8F320FBFF              call 0040ED0A
:0045CC17 6A12                    push 00000012
:0045CC19 B9382F4900              mov ecx, 00492F38
:0045CC1E E86120FBFF              call 0040EC84
:0045CC23 6A28                    push 00000028
:0045CC25 B9382F4900              mov ecx, 00492F38
:0045CC2A E8C520FBFF              call 0040ECF4
:0045CC2F 6A00                    push 00000000
:0045CC31 B9382F4900              mov ecx, 00492F38
:0045CC36 E88120FBFF              call 0040ECBC
:0045CC3B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0045CC3E E814ABFAFF              call 00407757
:0045CC43 50                      push eax
:0045CC44 68382F4900              push 00492F38
:0045CC49 E8522EFBFF              call 0040FAA0
:0045CC4E 83C408                  add esp, 00000008
:0045CC51 6A1F                    push 0000001F
:0045CC53 B9382F4900              mov ecx, 00492F38
:0045CC58 E89720FBFF              call 0040ECF4
:0045CC5D 6A00                    push 00000000
:0045CC5F B9382F4900              mov ecx, 00492F38
:0045CC64 E8A120FBFF              call 0040ED0A
:0045CC69 6A00                    push 00000000
:0045CC6B E873FE0100              call 0047CAE3
:0045CC70 83C404                  add esp, 00000004
:0045CC73 8B45F0                  mov eax, dword ptr [ebp-10]
:0045CC76 33C9                    xor ecx, ecx
:0045CC78 8A4808                  mov cl, byte ptr [eax+08]
:0045CC7B 8B5508                  mov edx, dword ptr [ebp+08]
:0045CC7E 81E2FF000000            and edx, 000000FF
:0045CC84 3BCA                    cmp ecx, edx
:0045CC86 7411                    je 0045CC99
:0045CC88 8B45F0                  mov eax, dword ptr [ebp-10]
:0045CC8B 8A4D08                  mov cl, byte ptr [ebp+08]
:0045CC8E 884808                  mov byte ptr [eax+08], cl
:0045CC91 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0045CC94 E8FEF9FFFF              call 0045C697

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045CB41(U), :0045CB7F(U), :0045CC86(C)
|
:0045CC99 5E                      pop esi
:0045CC9A 8BE5                    mov esp, ebp
:0045CC9C 5D                      pop ebp
:0045CC9D C20400                  ret 0004



* Referenced by a CALL at Address:
|:0045D930   
|
:0045CCA0 55                      push ebp
:0045CCA1 8BEC                    mov ebp, esp
:0045CCA3 83EC10                  sub esp, 00000010
:0045CCA6 894DF0                  mov dword ptr [ebp-10], ecx
:0045CCA9 6A08                    push 00000008
:0045CCAB E833FE0100              call 0047CAE3
:0045CCB0 83C404                  add esp, 00000004
:0045CCB3 E82319FCFF              call 0041E5DB
:0045CCB8 C745FC00000000          mov [ebp-04], 00000000
:0045CCBF 8B4508                  mov eax, dword ptr [ebp+08]
:0045CCC2 50                      push eax
:0045CCC3 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0045CCC6 E829070000              call 0045D3F4
:0045CCCB 8945F8                  mov dword ptr [ebp-08], eax
:0045CCCE 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045CCD1 51                      push ecx
:0045CCD2 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0045CCD5 E83B070000              call 0045D415
:0045CCDA 8945F4                  mov dword ptr [ebp-0C], eax
:0045CCDD 6A00                    push 00000000
:0045CCDF 6A1F                    push 0000001F
:0045CCE1 6A00                    push 00000000
:0045CCE3 E809050200              call 0047D1F1
:0045CCE8 83C40C                  add esp, 0000000C
:0045CCEB 6A04                    push 00000004
:0045CCED 6A00                    push 00000000
:0045CCEF 8B5508                  mov edx, dword ptr [ebp+08]
:0045CCF2 69D200090000            imul edx, 00000900
:0045CCF8 52                      push edx
:0045CCF9 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0045CCFC 83C160                  add ecx, 00000060
:0045CCFF E83C2D0200              call 0047FA40
:0045CD04 8945FC                  mov dword ptr [ebp-04], eax
:0045CD07 8B45FC                  mov eax, dword ptr [ebp-04]
:0045CD0A 50                      push eax
:0045CD0B 6A30                    push 00000030
:0045CD0D 6A30                    push 00000030
:0045CD0F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0045CD12 51                      push ecx
:0045CD13 8B55F8                  mov edx, dword ptr [ebp-08]
:0045CD16 52                      push edx
:0045CD17 E87F130200              call 0047E09B
:0045CD1C 83C414                  add esp, 00000014
:0045CD1F E8D218FCFF              call 0041E5F6
:0045CD24 6A00                    push 00000000
:0045CD26 E8B8FD0100              call 0047CAE3
:0045CD2B 83C404                  add esp, 00000004
:0045CD2E 8BE5                    mov esp, ebp
:0045CD30 5D                      pop ebp
:0045CD31 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0045CE55   , :0045D8EE   , :0045D987   
|
:0045CD34 55                      push ebp
:0045CD35 8BEC                    mov ebp, esp
:0045CD37 83EC10                  sub esp, 00000010
:0045CD3A 894DF0                  mov dword ptr [ebp-10], ecx
:0045CD3D 6A08                    push 00000008
:0045CD3F E89FFD0100              call 0047CAE3
:0045CD44 83C404                  add esp, 00000004
:0045CD47 E88F18FCFF              call 0041E5DB
:0045CD4C C745FC00000000          mov [ebp-04], 00000000
:0045CD53 8B4508                  mov eax, dword ptr [ebp+08]
:0045CD56 50                      push eax
:0045CD57 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0045CD5A E895060000              call 0045D3F4
:0045CD5F 8945F8                  mov dword ptr [ebp-08], eax
:0045CD62 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045CD65 51                      push ecx
:0045CD66 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0045CD69 E8A7060000              call 0045D415
:0045CD6E 8945F4                  mov dword ptr [ebp-0C], eax
:0045CD71 6A00                    push 00000000
:0045CD73 6A1F                    push 0000001F
:0045CD75 6A00                    push 00000000
:0045CD77 E875040200              call 0047D1F1
:0045CD7C 83C40C                  add esp, 0000000C
:0045CD7F 6A04                    push 00000004
:0045CD81 6A00                    push 00000000
:0045CD83 8B5508                  mov edx, dword ptr [ebp+08]
:0045CD86 69D200090000            imul edx, 00000900
:0045CD8C 52                      push edx
:0045CD8D 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0045CD90 83C160                  add ecx, 00000060
:0045CD93 E8A82C0200              call 0047FA40
:0045CD98 8945FC                  mov dword ptr [ebp-04], eax
:0045CD9B 8B45FC                  mov eax, dword ptr [ebp-04]
:0045CD9E 50                      push eax
:0045CD9F 6A30                    push 00000030
:0045CDA1 6A30                    push 00000030
:0045CDA3 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0045CDA6 51                      push ecx
:0045CDA7 8B55F8                  mov edx, dword ptr [ebp-08]
:0045CDAA 52                      push edx
:0045CDAB E8EB120200              call 0047E09B
:0045CDB0 83C414                  add esp, 00000014
:0045CDB3 6A00                    push 00000000
:0045CDB5 6A1F                    push 0000001F
:0045CDB7 6A04                    push 00000004
:0045CDB9 E833040200              call 0047D1F1
:0045CDBE 83C40C                  add esp, 0000000C
:0045CDC1 6A04                    push 00000004
:0045CDC3 6A00                    push 00000000
:0045CDC5 8B45F0                  mov eax, dword ptr [ebp-10]
:0045CDC8 034508                  add eax, dword ptr [ebp+08]
:0045CDCB 33C9                    xor ecx, ecx
:0045CDCD 8A4828                  mov cl, byte ptr [eax+28]
:0045CDD0 69C900090000            imul ecx, 00000900
:0045CDD6 51                      push ecx
:0045CDD7 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0045CDDA 83C138                  add ecx, 00000038
:0045CDDD E85E2C0200              call 0047FA40
:0045CDE2 8945FC                  mov dword ptr [ebp-04], eax
:0045CDE5 8B55FC                  mov edx, dword ptr [ebp-04]
:0045CDE8 52                      push edx
:0045CDE9 6A30                    push 00000030
:0045CDEB 6A30                    push 00000030
:0045CDED 8B45F4                  mov eax, dword ptr [ebp-0C]
:0045CDF0 50                      push eax
:0045CDF1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045CDF4 51                      push ecx
:0045CDF5 E8A1120200              call 0047E09B
:0045CDFA 83C414                  add esp, 00000014
:0045CDFD 6A00                    push 00000000
:0045CDFF 6A1F                    push 0000001F
:0045CE01 6A00                    push 00000000
:0045CE03 E8E9030200              call 0047D1F1
:0045CE08 83C40C                  add esp, 0000000C
:0045CE0B E8E617FCFF              call 0041E5F6
:0045CE10 6A00                    push 00000000
:0045CE12 E8CCFC0100              call 0047CAE3
:0045CE17 83C404                  add esp, 00000004
:0045CE1A 8BE5                    mov esp, ebp
:0045CE1C 5D                      pop ebp
:0045CE1D C20400                  ret 0004



* Referenced by a CALL at Address:
|:0045E94E   
|
:0045CE20 55                      push ebp
:0045CE21 8BEC                    mov ebp, esp
:0045CE23 83EC08                  sub esp, 00000008
:0045CE26 894DF8                  mov dword ptr [ebp-08], ecx
:0045CE29 E8AD17FCFF              call 0041E5DB
:0045CE2E C745FC00000000          mov [ebp-04], 00000000
:0045CE35 EB09                    jmp 0045CE40

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045CE5A(U)
|
:0045CE37 8B45FC                  mov eax, dword ptr [ebp-04]
:0045CE3A 83C001                  add eax, 00000001
:0045CE3D 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045CE35(U)
|
:0045CE40 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045CE43 8B55FC                  mov edx, dword ptr [ebp-04]
:0045CE46 3B9108010000            cmp edx, dword ptr [ecx+00000108]
:0045CE4C 730E                    jnb 0045CE5C
:0045CE4E 8B45FC                  mov eax, dword ptr [ebp-04]
:0045CE51 50                      push eax
:0045CE52 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045CE55 E8DAFEFFFF              call 0045CD34
:0045CE5A EBDB                    jmp 0045CE37

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045CE4C(C)
|
:0045CE5C E89517FCFF              call 0041E5F6
:0045CE61 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045CE64 E83C0C0000              call 0045DAA5
:0045CE69 8BE5                    mov esp, ebp
:0045CE6B 5D                      pop ebp
:0045CE6C C3                      ret



* Referenced by a CALL at Addresses:
|:0045CB24   , :0045D249   , :0045D9B0   
|
:0045CE6D 55                      push ebp
:0045CE6E 8BEC                    mov ebp, esp
:0045CE70 81EC18090000            sub esp, 00000918
:0045CE76 56                      push esi
:0045CE77 898DE8F6FFFF            mov dword ptr [ebp+FFFFF6E8], ecx
:0045CE7D 817D08FF000000          cmp dword ptr [ebp+08], 000000FF
:0045CE84 7505                    jne 0045CE8B
:0045CE86 E985030000              jmp 0045D210

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045CE84(C)
|
:0045CE8B 8B85E8F6FFFF            mov eax, dword ptr [ebp+FFFFF6E8]
:0045CE91 8B08                    mov ecx, dword ptr [eax]
:0045CE93 8B5508                  mov edx, dword ptr [ebp+08]
:0045CE96 833C9100                cmp dword ptr [ecx+4*edx], 00000000
:0045CE9A 7505                    jne 0045CEA1
:0045CE9C E96F030000              jmp 0045D210

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045CE9A(C)
|

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0045CEA1 6A07                    push 00000007
:0045CEA3 E83BFC0100              call 0047CAE3
:0045CEA8 83C404                  add esp, 00000004
:0045CEAB E82B17FCFF              call 0041E5DB
:0045CEB0 C745FC00000000          mov [ebp-04], 00000000
:0045CEB7 C745F000000000          mov [ebp-10], 00000000
:0045CEBE 8B4508                  mov eax, dword ptr [ebp+08]
:0045CEC1 50                      push eax
:0045CEC2 8B8DE8F6FFFF            mov ecx, dword ptr [ebp+FFFFF6E8]
:0045CEC8 E8D5040000              call 0045D3A2
:0045CECD 8945F8                  mov dword ptr [ebp-08], eax
:0045CED0 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045CED3 51                      push ecx
:0045CED4 8B8DE8F6FFFF            mov ecx, dword ptr [ebp+FFFFF6E8]
:0045CEDA E8ED040000              call 0045D3CC
:0045CEDF 8945F4                  mov dword ptr [ebp-0C], eax
:0045CEE2 6A00                    push 00000000
:0045CEE4 6A1F                    push 0000001F
:0045CEE6 6A00                    push 00000000
:0045CEE8 E804030200              call 0047D1F1
:0045CEED 83C40C                  add esp, 0000000C
:0045CEF0 6A04                    push 00000004
:0045CEF2 6A00                    push 00000000
:0045CEF4 8B5508                  mov edx, dword ptr [ebp+08]
:0045CEF7 52                      push edx
:0045CEF8 8B8DE8F6FFFF            mov ecx, dword ptr [ebp+FFFFF6E8]
:0045CEFE E8BA030000              call 0045D2BD
:0045CF03 69C0000E0000            imul eax, 00000E00
:0045CF09 50                      push eax
:0045CF0A 8B8DE8F6FFFF            mov ecx, dword ptr [ebp+FFFFF6E8]
:0045CF10 83C14C                  add ecx, 0000004C
:0045CF13 E8282B0200              call 0047FA40
:0045CF18 8945F0                  mov dword ptr [ebp-10], eax
:0045CF1B 8B45F0                  mov eax, dword ptr [ebp-10]
:0045CF1E 50                      push eax
:0045CF1F 6A40                    push 00000040
:0045CF21 6A38                    push 00000038
:0045CF23 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0045CF26 51                      push ecx
:0045CF27 8B55F8                  mov edx, dword ptr [ebp-08]
:0045CF2A 52                      push edx
:0045CF2B E86B110200              call 0047E09B
:0045CF30 83C414                  add esp, 00000014
:0045CF33 8B4508                  mov eax, dword ptr [ebp+08]
:0045CF36 50                      push eax
:0045CF37 8B8DE8F6FFFF            mov ecx, dword ptr [ebp+FFFFF6E8]
:0045CF3D E80E040000              call 0045D350
:0045CF42 8945F8                  mov dword ptr [ebp-08], eax
:0045CF45 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045CF48 51                      push ecx
:0045CF49 8B8DE8F6FFFF            mov ecx, dword ptr [ebp+FFFFF6E8]
:0045CF4F E826040000              call 0045D37A
:0045CF54 8945F4                  mov dword ptr [ebp-0C], eax
:0045CF57 6A00                    push 00000000
:0045CF59 6A1F                    push 0000001F
:0045CF5B 6A04                    push 00000004
:0045CF5D E88F020200              call 0047D1F1
:0045CF62 83C40C                  add esp, 0000000C
:0045CF65 6A04                    push 00000004
:0045CF67 6A00                    push 00000000
:0045CF69 8B5508                  mov edx, dword ptr [ebp+08]
:0045CF6C 69D200090000            imul edx, 00000900
:0045CF72 52                      push edx
:0045CF73 8B8DE8F6FFFF            mov ecx, dword ptr [ebp+FFFFF6E8]
:0045CF79 83C138                  add ecx, 00000038
:0045CF7C E8BF2A0200              call 0047FA40
:0045CF81 8945FC                  mov dword ptr [ebp-04], eax
:0045CF84 8B4508                  mov eax, dword ptr [ebp+08]
:0045CF87 8B8DE8F6FFFF            mov ecx, dword ptr [ebp+FFFFF6E8]
:0045CF8D 83BC818C00000000        cmp dword ptr [ecx+4*eax+0000008C], 00000000
:0045CF95 744D                    je 0045CFE4
:0045CF97 8D95ECF6FFFF            lea edx, dword ptr [ebp+FFFFF6EC]
:0045CF9D 52                      push edx
:0045CF9E 6A30                    push 00000030
:0045CFA0 6A30                    push 00000030
:0045CFA2 8B45F4                  mov eax, dword ptr [ebp-0C]
:0045CFA5 50                      push eax
:0045CFA6 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045CFA9 51                      push ecx
:0045CFAA E8A2120200              call 0047E251
:0045CFAF 83C414                  add esp, 00000014

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0045CFB2 6A06                    push 00000006
:0045CFB4 6A00                    push 00000000
:0045CFB6 6A00                    push 00000000
:0045CFB8 6A0B                    push 0000000B
:0045CFBA 6A04                    push 00000004
:0045CFBC 8D95ECF6FFFF            lea edx, dword ptr [ebp+FFFFF6EC]
:0045CFC2 52                      push edx
:0045CFC3 8D85ECF6FFFF            lea eax, dword ptr [ebp+FFFFF6EC]
:0045CFC9 50                      push eax
:0045CFCA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045CFCD 51                      push ecx
:0045CFCE 6A30                    push 00000030
:0045CFD0 6A30                    push 00000030
:0045CFD2 8B55F4                  mov edx, dword ptr [ebp-0C]
:0045CFD5 52                      push edx
:0045CFD6 8B45F8                  mov eax, dword ptr [ebp-08]
:0045CFD9 50                      push eax
:0045CFDA E82F33FDFF              call 0043030E
:0045CFDF 83C430                  add esp, 00000030
:0045CFE2 EB18                    jmp 0045CFFC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045CF95(C)
|
:0045CFE4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045CFE7 51                      push ecx
:0045CFE8 6A30                    push 00000030
:0045CFEA 6A30                    push 00000030
:0045CFEC 8B55F4                  mov edx, dword ptr [ebp-0C]
:0045CFEF 52                      push edx
:0045CFF0 8B45F8                  mov eax, dword ptr [ebp-08]
:0045CFF3 50                      push eax
:0045CFF4 E8A2100200              call 0047E09B
:0045CFF9 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045CFE2(U)
|
:0045CFFC 8B8DE8F6FFFF            mov ecx, dword ptr [ebp+FFFFF6E8]
:0045D002 8B11                    mov edx, dword ptr [ecx]
:0045D004 8B4508                  mov eax, dword ptr [ebp+08]
:0045D007 8B0C82                  mov ecx, dword ptr [edx+4*eax]
:0045D00A 894DEC                  mov dword ptr [ebp-14], ecx
:0045D00D 8B55F4                  mov edx, dword ptr [ebp-0C]
:0045D010 83C220                  add edx, 00000020
:0045D013 52                      push edx
:0045D014 8B45F8                  mov eax, dword ptr [ebp-08]
:0045D017 C1E803                  shr eax, 03
:0045D01A 50                      push eax
:0045D01B B9382F4900              mov ecx, 00492F38
:0045D020 E8B21BFBFF              call 0040EBD7
:0045D025 6A04                    push 00000004
:0045D027 B9382F4900              mov ecx, 00492F38
:0045D02C E8051DFBFF              call 0040ED36
:0045D031 6A01                    push 00000001
:0045D033 B9382F4900              mov ecx, 00492F38
:0045D038 E8CD1CFBFF              call 0040ED0A
:0045D03D 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045D040 8B95E8F6FFFF            mov edx, dword ptr [ebp+FFFFF6E8]
:0045D046 83BC8A8C00000000        cmp dword ptr [edx+4*ecx+0000008C], 00000000
:0045D04E 7445                    je 0045D095
:0045D050 8B85E8F6FFFF            mov eax, dword ptr [ebp+FFFFF6E8]
:0045D056 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045D059 3B8810010000            cmp ecx, dword ptr [eax+00000110]
:0045D05F 731A                    jnb 0045D07B
:0045D061 6A28                    push 00000028
:0045D063 B9382F4900              mov ecx, 00492F38
:0045D068 E8871CFBFF              call 0040ECF4
:0045D06D 6A12                    push 00000012
:0045D06F B9382F4900              mov ecx, 00492F38
:0045D074 E80B1CFBFF              call 0040EC84
:0045D079 EB18                    jmp 0045D093

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045D05F(C)
|
:0045D07B 6A1F                    push 0000001F
:0045D07D B9382F4900              mov ecx, 00492F38
:0045D082 E86D1CFBFF              call 0040ECF4
:0045D087 6A12                    push 00000012
:0045D089 B9382F4900              mov ecx, 00492F38
:0045D08E E8F11BFBFF              call 0040EC84

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045D079(U)
|
:0045D093 EB18                    jmp 0045D0AD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045D04E(C)
|
:0045D095 6A3A                    push 0000003A
:0045D097 B9382F4900              mov ecx, 00492F38
:0045D09C E8531CFBFF              call 0040ECF4
:0045D0A1 6A12                    push 00000012
:0045D0A3 B9382F4900              mov ecx, 00492F38
:0045D0A8 E8D71BFBFF              call 0040EC84

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045D093(U)
|
:0045D0AD 6A00                    push 00000000
:0045D0AF B9382F4900              mov ecx, 00492F38
:0045D0B4 E8031CFBFF              call 0040ECBC
:0045D0B9 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0045D0BC E80F95FAFF              call 004065D0
:0045D0C1 25FF000000              and eax, 000000FF
:0045D0C6 50                      push eax

* Possible StringData Ref from Data Obj ->"Lv. %2d"
                                  |
:0045D0C7 6858E44800              push 0048E458
:0045D0CC 68382F4900              push 00492F38
:0045D0D1 E8CA29FBFF              call 0040FAA0
:0045D0D6 83C40C                  add esp, 0000000C
:0045D0D9 8B5508                  mov edx, dword ptr [ebp+08]
:0045D0DC 52                      push edx
:0045D0DD 8B8DE8F6FFFF            mov ecx, dword ptr [ebp+FFFFF6E8]
:0045D0E3 E8BA020000              call 0045D3A2
:0045D0E8 8945F8                  mov dword ptr [ebp-08], eax
:0045D0EB 8B4508                  mov eax, dword ptr [ebp+08]
:0045D0EE 50                      push eax
:0045D0EF 8B8DE8F6FFFF            mov ecx, dword ptr [ebp+FFFFF6E8]
:0045D0F5 E8D2020000              call 0045D3CC
:0045D0FA 8945F4                  mov dword ptr [ebp-0C], eax
:0045D0FD 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0045D100 83C130                  add ecx, 00000030
:0045D103 51                      push ecx
:0045D104 8B75F8                  mov esi, dword ptr [ebp-08]
:0045D107 C1EE03                  shr esi, 03
:0045D10A 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0045D10D E845A6FAFF              call 00407757
:0045D112 50                      push eax
:0045D113 E8422B0200              call 0047FC5A
:0045D118 83C404                  add esp, 00000004

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0045D11B BA07000000              mov edx, 00000007
:0045D120 2BD0                    sub edx, eax
:0045D122 D1EA                    shr edx, 1
:0045D124 03F2                    add esi, edx
:0045D126 56                      push esi
:0045D127 B9382F4900              mov ecx, 00492F38
:0045D12C E8A61AFBFF              call 0040EBD7
:0045D131 6A04                    push 00000004
:0045D133 B9382F4900              mov ecx, 00492F38
:0045D138 E8F91BFBFF              call 0040ED36
:0045D13D 6A00                    push 00000000
:0045D13F B9382F4900              mov ecx, 00492F38
:0045D144 E8731BFBFF              call 0040ECBC
:0045D149 8B4508                  mov eax, dword ptr [ebp+08]
:0045D14C 8B8DE8F6FFFF            mov ecx, dword ptr [ebp+FFFFF6E8]
:0045D152 83BC818C00000000        cmp dword ptr [ecx+4*eax+0000008C], 00000000
:0045D15A 7445                    je 0045D1A1
:0045D15C 8B95E8F6FFFF            mov edx, dword ptr [ebp+FFFFF6E8]
:0045D162 8B4508                  mov eax, dword ptr [ebp+08]
:0045D165 3B8210010000            cmp eax, dword ptr [edx+00000110]
:0045D16B 731A                    jnb 0045D187
:0045D16D 6A00                    push 00000000
:0045D16F B9382F4900              mov ecx, 00492F38
:0045D174 E8911BFBFF              call 0040ED0A
:0045D179 6A12                    push 00000012
:0045D17B B9382F4900              mov ecx, 00492F38
:0045D180 E8FF1AFBFF              call 0040EC84
:0045D185 EB18                    jmp 0045D19F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045D16B(C)
|
:0045D187 6A00                    push 00000000
:0045D189 B9382F4900              mov ecx, 00492F38
:0045D18E E8771BFBFF              call 0040ED0A
:0045D193 6A12                    push 00000012
:0045D195 B9382F4900              mov ecx, 00492F38
:0045D19A E8E51AFBFF              call 0040EC84

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045D185(U)
|
:0045D19F EB18                    jmp 0045D1B9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045D15A(C)
|
:0045D1A1 6A00                    push 00000000
:0045D1A3 B9382F4900              mov ecx, 00492F38
:0045D1A8 E85D1BFBFF              call 0040ED0A
:0045D1AD 6A12                    push 00000012
:0045D1AF B9382F4900              mov ecx, 00492F38
:0045D1B4 E8CB1AFBFF              call 0040EC84

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045D19F(U)
|
:0045D1B9 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0045D1BC E896A5FAFF              call 00407757
:0045D1C1 50                      push eax
:0045D1C2 68382F4900              push 00492F38
:0045D1C7 E8D428FBFF              call 0040FAA0
:0045D1CC 83C408                  add esp, 00000008
:0045D1CF 6A12                    push 00000012
:0045D1D1 B9382F4900              mov ecx, 00492F38
:0045D1D6 E8A91AFBFF              call 0040EC84
:0045D1DB 6A1F                    push 0000001F
:0045D1DD B9382F4900              mov ecx, 00492F38
:0045D1E2 E80D1BFBFF              call 0040ECF4
:0045D1E7 6A00                    push 00000000
:0045D1E9 B9382F4900              mov ecx, 00492F38
:0045D1EE E8171BFBFF              call 0040ED0A
:0045D1F3 E8FE13FCFF              call 0041E5F6
:0045D1F8 6A00                    push 00000000
:0045D1FA 6A1F                    push 0000001F
:0045D1FC 6A00                    push 00000000
:0045D1FE E8EEFF0100              call 0047D1F1
:0045D203 83C40C                  add esp, 0000000C
:0045D206 6A00                    push 00000000
:0045D208 E8D6F80100              call 0047CAE3
:0045D20D 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045CE86(U), :0045CE9C(U)
|
:0045D210 5E                      pop esi
:0045D211 8BE5                    mov esp, ebp
:0045D213 5D                      pop ebp
:0045D214 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0045E11E   , :0045E943   
|
:0045D217 55                      push ebp
:0045D218 8BEC                    mov ebp, esp
:0045D21A 83EC08                  sub esp, 00000008
:0045D21D 894DF8                  mov dword ptr [ebp-08], ecx
:0045D220 E8B613FCFF              call 0041E5DB
:0045D225 C745FC00000000          mov [ebp-04], 00000000
:0045D22C EB09                    jmp 0045D237

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045D24E(U)
|
:0045D22E 8B45FC                  mov eax, dword ptr [ebp-04]
:0045D231 83C001                  add eax, 00000001
:0045D234 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045D22C(U)
|
:0045D237 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045D23A 8B55FC                  mov edx, dword ptr [ebp-04]
:0045D23D 3B5104                  cmp edx, dword ptr [ecx+04]
:0045D240 730E                    jnb 0045D250
:0045D242 8B45FC                  mov eax, dword ptr [ebp-04]
:0045D245 50                      push eax
:0045D246 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045D249 E81FFCFFFF              call 0045CE6D
:0045D24E EBDE                    jmp 0045D22E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045D240(C)
|

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0045D250 6A07                    push 00000007
:0045D252 E88CF80100              call 0047CAE3
:0045D257 83C404                  add esp, 00000004
:0045D25A E89713FCFF              call 0041E5F6
:0045D25F 6A00                    push 00000000
:0045D261 E87DF80100              call 0047CAE3
:0045D266 83C404                  add esp, 00000004
:0045D269 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045D26C E834080000              call 0045DAA5
:0045D271 8BE5                    mov esp, ebp
:0045D273 5D                      pop ebp
:0045D274 C3                      ret


:0045D275 55                      push ebp
:0045D276 8BEC                    mov ebp, esp
:0045D278 51                      push ecx
:0045D279 894DFC                  mov dword ptr [ebp-04], ecx
:0045D27C 6A00                    push 00000000
:0045D27E 6A01                    push 00000001
:0045D280 6811010000              push 00000111
:0045D285 8B45FC                  mov eax, dword ptr [ebp-04]
:0045D288 8B8888000000            mov ecx, dword ptr [eax+00000088]
:0045D28E 51                      push ecx
:0045D28F FF15F4624800            call dword ptr [004862F4]
:0045D295 8BE5                    mov esp, ebp
:0045D297 5D                      pop ebp
:0045D298 C3                      ret


:0045D299 55                      push ebp
:0045D29A 8BEC                    mov ebp, esp
:0045D29C 51                      push ecx
:0045D29D 894DFC                  mov dword ptr [ebp-04], ecx
:0045D2A0 6A00                    push 00000000
:0045D2A2 6A02                    push 00000002
:0045D2A4 6811010000              push 00000111
:0045D2A9 8B45FC                  mov eax, dword ptr [ebp-04]
:0045D2AC 8B8888000000            mov ecx, dword ptr [eax+00000088]
:0045D2B2 51                      push ecx
:0045D2B3 FF15F4624800            call dword ptr [004862F4]
:0045D2B9 8BE5                    mov esp, ebp
:0045D2BB 5D                      pop ebp
:0045D2BC C3                      ret



* Referenced by a CALL at Addresses:
|:0045CEFE   , :0045D35E   , :0045D388   , :0045D3B0   , :0045D3DA   
|
:0045D2BD 55                      push ebp
:0045D2BE 8BEC                    mov ebp, esp
:0045D2C0 83EC08                  sub esp, 00000008
:0045D2C3 894DF8                  mov dword ptr [ebp-08], ecx
:0045D2C6 C745FC00000000          mov [ebp-04], 00000000
:0045D2CD EB09                    jmp 0045D2D8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045D2F8(U)
|
:0045D2CF 8B45FC                  mov eax, dword ptr [ebp-04]
:0045D2D2 83C001                  add eax, 00000001
:0045D2D5 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045D2CD(U)
|
:0045D2D8 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045D2DB 8B55FC                  mov edx, dword ptr [ebp-04]
:0045D2DE 3B5104                  cmp edx, dword ptr [ecx+04]
:0045D2E1 7317                    jnb 0045D2FA
:0045D2E3 8B45F8                  mov eax, dword ptr [ebp-08]
:0045D2E6 0345FC                  add eax, dword ptr [ebp-04]
:0045D2E9 33C9                    xor ecx, ecx
:0045D2EB 8A480A                  mov cl, byte ptr [eax+0A]
:0045D2EE 394D08                  cmp dword ptr [ebp+08], ecx
:0045D2F1 7505                    jne 0045D2F8
:0045D2F3 8B45FC                  mov eax, dword ptr [ebp-04]
:0045D2F6 EB07                    jmp 0045D2FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045D2F1(C)
|
:0045D2F8 EBD5                    jmp 0045D2CF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045D2E1(C)
|
:0045D2FA B8FF000000              mov eax, 000000FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045D2F6(U)
|
:0045D2FF 8BE5                    mov esp, ebp
:0045D301 5D                      pop ebp
:0045D302 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0045D89D   
|
:0045D305 55                      push ebp
:0045D306 8BEC                    mov ebp, esp
:0045D308 83EC08                  sub esp, 00000008
:0045D30B 894DF8                  mov dword ptr [ebp-08], ecx
:0045D30E C745FC00000000          mov [ebp-04], 00000000
:0045D315 EB09                    jmp 0045D320

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045D343(U)
|
:0045D317 8B45FC                  mov eax, dword ptr [ebp-04]
:0045D31A 83C001                  add eax, 00000001
:0045D31D 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045D315(U)
|
:0045D320 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045D323 8B55FC                  mov edx, dword ptr [ebp-04]
:0045D326 3B9108010000            cmp edx, dword ptr [ecx+00000108]
:0045D32C 7317                    jnb 0045D345
:0045D32E 8B45F8                  mov eax, dword ptr [ebp-08]
:0045D331 0345FC                  add eax, dword ptr [ebp-04]
:0045D334 33C9                    xor ecx, ecx
:0045D336 8A4828                  mov cl, byte ptr [eax+28]
:0045D339 394D08                  cmp dword ptr [ebp+08], ecx
:0045D33C 7505                    jne 0045D343
:0045D33E 8B45FC                  mov eax, dword ptr [ebp-04]
:0045D341 EB07                    jmp 0045D34A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045D33C(C)
|
:0045D343 EBD2                    jmp 0045D317

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045D32C(C)
|
:0045D345 B8FF000000              mov eax, 000000FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045D341(U)
|
:0045D34A 8BE5                    mov esp, ebp
:0045D34C 5D                      pop ebp
:0045D34D C20400                  ret 0004



* Referenced by a CALL at Address:
|:0045CF3D   
|
:0045D350 55                      push ebp
:0045D351 8BEC                    mov ebp, esp
:0045D353 51                      push ecx
:0045D354 894DFC                  mov dword ptr [ebp-04], ecx
:0045D357 8B4508                  mov eax, dword ptr [ebp+08]
:0045D35A 50                      push eax
:0045D35B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045D35E E85AFFFFFF              call 0045D2BD
:0045D363 33D2                    xor edx, edx

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0045D365 B907000000              mov ecx, 00000007
:0045D36A F7F1                    div ecx
:0045D36C 8BC2                    mov eax, edx
:0045D36E 6BC038                  imul eax, 00000038
:0045D371 83C008                  add eax, 00000008
:0045D374 8BE5                    mov esp, ebp
:0045D376 5D                      pop ebp
:0045D377 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0045CF4F   
|
:0045D37A 55                      push ebp
:0045D37B 8BEC                    mov ebp, esp
:0045D37D 51                      push ecx
:0045D37E 894DFC                  mov dword ptr [ebp-04], ecx
:0045D381 8B4508                  mov eax, dword ptr [ebp+08]
:0045D384 50                      push eax
:0045D385 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045D388 E830FFFFFF              call 0045D2BD
:0045D38D 33D2                    xor edx, edx

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0045D38F B907000000              mov ecx, 00000007
:0045D394 F7F1                    div ecx
:0045D396 6BC048                  imul eax, 00000048
:0045D399 83C008                  add eax, 00000008
:0045D39C 8BE5                    mov esp, ebp
:0045D39E 5D                      pop ebp
:0045D39F C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0045CB91   , :0045CEC8   , :0045D0E3   , :0045DB65   
|
:0045D3A2 55                      push ebp
:0045D3A3 8BEC                    mov ebp, esp
:0045D3A5 51                      push ecx
:0045D3A6 894DFC                  mov dword ptr [ebp-04], ecx
:0045D3A9 8B4508                  mov eax, dword ptr [ebp+08]
:0045D3AC 50                      push eax
:0045D3AD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045D3B0 E808FFFFFF              call 0045D2BD
:0045D3B5 33D2                    xor edx, edx

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0045D3B7 B907000000              mov ecx, 00000007
:0045D3BC F7F1                    div ecx
:0045D3BE 8BC2                    mov eax, edx
:0045D3C0 6BC038                  imul eax, 00000038
:0045D3C3 83C008                  add eax, 00000008
:0045D3C6 8BE5                    mov esp, ebp
:0045D3C8 5D                      pop ebp
:0045D3C9 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0045CBA6   , :0045CEDA   , :0045D0F5   , :0045DB7C   
|
:0045D3CC 55                      push ebp
:0045D3CD 8BEC                    mov ebp, esp
:0045D3CF 51                      push ecx
:0045D3D0 894DFC                  mov dword ptr [ebp-04], ecx
:0045D3D3 8B4508                  mov eax, dword ptr [ebp+08]
:0045D3D6 50                      push eax
:0045D3D7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045D3DA E8DEFEFFFF              call 0045D2BD
:0045D3DF 33D2                    xor edx, edx

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0045D3E1 B907000000              mov ecx, 00000007
:0045D3E6 F7F1                    div ecx
:0045D3E8 6BC048                  imul eax, 00000048
:0045D3EB 83C008                  add eax, 00000008
:0045D3EE 8BE5                    mov esp, ebp
:0045D3F0 5D                      pop ebp
:0045D3F1 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0045CCC6   , :0045CD5A   , :0045DC93   
|
:0045D3F4 55                      push ebp
:0045D3F5 8BEC                    mov ebp, esp
:0045D3F7 51                      push ecx
:0045D3F8 894DFC                  mov dword ptr [ebp-04], ecx
:0045D3FB 8B4508                  mov eax, dword ptr [ebp+08]
:0045D3FE 33D2                    xor edx, edx
:0045D400 B908000000              mov ecx, 00000008
:0045D405 F7F1                    div ecx
:0045D407 8BC2                    mov eax, edx
:0045D409 6BC032                  imul eax, 00000032
:0045D40C 83C001                  add eax, 00000001
:0045D40F 8BE5                    mov esp, ebp
:0045D411 5D                      pop ebp
:0045D412 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0045CCD5   , :0045CD69   , :0045DCA2   
|
:0045D415 55                      push ebp
:0045D416 8BEC                    mov ebp, esp
:0045D418 51                      push ecx
:0045D419 894DFC                  mov dword ptr [ebp-04], ecx
:0045D41C 8B4508                  mov eax, dword ptr [ebp+08]
:0045D41F C1E803                  shr eax, 03
:0045D422 C1E006                  shl eax, 06
:0045D425 83C001                  add eax, 00000001
:0045D428 8BE5                    mov esp, ebp
:0045D42A 5D                      pop ebp
:0045D42B C20400                  ret 0004



* Referenced by a CALL at Address:
|:0045EA32   
|
:0045D42E 55                      push ebp
:0045D42F 8BEC                    mov ebp, esp
:0045D431 83EC18                  sub esp, 00000018
:0045D434 894DEC                  mov dword ptr [ebp-14], ecx
:0045D437 8D45F0                  lea eax, dword ptr [ebp-10]
:0045D43A 50                      push eax
:0045D43B 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0045D43E 51                      push ecx
:0045D43F FF15EC624800            call dword ptr [004862EC]
:0045D445 8B550C                  mov edx, dword ptr [ebp+0C]
:0045D448 52                      push edx
:0045D449 FF1594634800            call dword ptr [00486394]
:0045D44F 8945E8                  mov dword ptr [ebp-18], eax
:0045D452 8B45E8                  mov eax, dword ptr [ebp-18]
:0045D455 2D60050000              sub eax, 00000560
:0045D45A 8945E8                  mov dword ptr [ebp-18], eax
:0045D45D 837DE80A                cmp dword ptr [ebp-18], 0000000A
:0045D461 0F8709010000            ja 0045D570
:0045D467 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0045D46A FF248D76D54500          jmp dword ptr [4*ecx+0045D576]
:0045D471 6A01                    push 00000001
:0045D473 685C5F4B00              push 004B5F5C
:0045D478 8D55F0                  lea edx, dword ptr [ebp-10]
:0045D47B 52                      push edx
:0045D47C 8B4508                  mov eax, dword ptr [ebp+08]
:0045D47F 50                      push eax
:0045D480 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0045D483 81C114010000            add ecx, 00000114
:0045D489 E8E13F0000              call 0046146F
:0045D48E E9DD000000              jmp 0045D570
:0045D493 6A03                    push 00000003
:0045D495 68605F4B00              push 004B5F60
:0045D49A 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0045D49D 51                      push ecx
:0045D49E 8B5508                  mov edx, dword ptr [ebp+08]
:0045D4A1 52                      push edx
:0045D4A2 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0045D4A5 81C134010000            add ecx, 00000134
:0045D4AB E8BF3F0000              call 0046146F
:0045D4B0 E9BB000000              jmp 0045D570
:0045D4B5 6A05                    push 00000005
:0045D4B7 68645F4B00              push 004B5F64
:0045D4BC 8D45F0                  lea eax, dword ptr [ebp-10]
:0045D4BF 50                      push eax
:0045D4C0 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045D4C3 51                      push ecx
:0045D4C4 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0045D4C7 81C154010000            add ecx, 00000154
:0045D4CD E89D3F0000              call 0046146F
:0045D4D2 E999000000              jmp 0045D570

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0045D4D7 6A06                    push 00000006
:0045D4D9 68685F4B00              push 004B5F68
:0045D4DE 8D55F0                  lea edx, dword ptr [ebp-10]
:0045D4E1 52                      push edx
:0045D4E2 8B4508                  mov eax, dword ptr [ebp+08]
:0045D4E5 50                      push eax
:0045D4E6 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0045D4E9 81C174010000            add ecx, 00000174
:0045D4EF E87B3F0000              call 0046146F
:0045D4F4 EB7A                    jmp 0045D570

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0045D4F6 6A06                    push 00000006
:0045D4F8 686C5F4B00              push 004B5F6C
:0045D4FD 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0045D500 51                      push ecx
:0045D501 8B5508                  mov edx, dword ptr [ebp+08]
:0045D504 52                      push edx
:0045D505 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0045D508 81C194010000            add ecx, 00000194
:0045D50E E85C3F0000              call 0046146F
:0045D513 EB5B                    jmp 0045D570

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0045D515 6A06                    push 00000006
:0045D517 68705F4B00              push 004B5F70
:0045D51C 8D45F0                  lea eax, dword ptr [ebp-10]
:0045D51F 50                      push eax
:0045D520 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045D523 51                      push ecx
:0045D524 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0045D527 81C1B4010000            add ecx, 000001B4
:0045D52D E83D3F0000              call 0046146F
:0045D532 EB3C                    jmp 0045D570

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0045D534 6A06                    push 00000006
:0045D536 68745F4B00              push 004B5F74
:0045D53B 8D55F0                  lea edx, dword ptr [ebp-10]
:0045D53E 52                      push edx
:0045D53F 8B4508                  mov eax, dword ptr [ebp+08]
:0045D542 50                      push eax
:0045D543 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0045D546 81C1D4010000            add ecx, 000001D4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045D576(C)
|
:0045D54C E81E3F0000              call 0046146F
:0045D551 EB1D                    jmp 0045D570

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0045D553 6A06                    push 00000006
:0045D555 68785F4B00              push 004B5F78
:0045D55A 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0045D55D 51                      push ecx
:0045D55E 8B5508                  mov edx, dword ptr [ebp+08]
:0045D561 52                      push edx
:0045D562 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0045D565 81C1F4010000            add ecx, 000001F4
:0045D56B E8FF3E0000              call 0046146F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045D461(C), :0045D48E(U), :0045D4B0(U), :0045D4D2(U), :0045D4F4(U)
|:0045D513(U), :0045D532(U), :0045D551(U)
|
:0045D570 8BE5                    mov esp, ebp
:0045D572 5D                      pop ebp
:0045D573 C20800                  ret 0008



:0045D576 71D44500                DWORD 0045D471
:0045D57A 70D54500                DWORD 0045D570
:0045D57E 70D54500                DWORD 0045D570
:0045D582 70D54500                DWORD 0045D570
:0045D586 93D44500                DWORD 0045D493
:0045D58A B5D44500                DWORD 0045D4B5
:0045D58E D7D44500                DWORD 0045D4D7
:0045D592 F6D44500                DWORD 0045D4F6
:0045D596 15D54500                DWORD 0045D515
:0045D59A 34D54500                DWORD 0045D534
:0045D59E 53D54500                DWORD 0045D553



* Referenced by a CALL at Address:
|:0045CAE0   
|
:0045D5A2 55                      push ebp
:0045D5A3 8BEC                    mov ebp, esp
:0045D5A5 83EC18                  sub esp, 00000018
:0045D5A8 894DE8                  mov dword ptr [ebp-18], ecx
:0045D5AB 6860050000              push 00000560
:0045D5B0 8B45E8                  mov eax, dword ptr [ebp-18]
:0045D5B3 8B8888000000            mov ecx, dword ptr [eax+00000088]
:0045D5B9 51                      push ecx
:0045D5BA FF15DC624800            call dword ptr [004862DC]
:0045D5C0 8945EC                  mov dword ptr [ebp-14], eax
:0045D5C3 8D55F0                  lea edx, dword ptr [ebp-10]
:0045D5C6 52                      push edx
:0045D5C7 8B45EC                  mov eax, dword ptr [ebp-14]
:0045D5CA 50                      push eax
:0045D5CB E89A450000              call 00461B6A
:0045D5D0 83C408                  add esp, 00000008
:0045D5D3 6A00                    push 00000000
:0045D5D5 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0045D5D8 51                      push ecx
:0045D5D9 8B55E8                  mov edx, dword ptr [ebp-18]
:0045D5DC 8B8288000000            mov eax, dword ptr [edx+00000088]
:0045D5E2 50                      push eax
:0045D5E3 FF15A4624800            call dword ptr [004862A4]

* Possible Reference to Dialog: DialogID_011A, CONTROL_ID:0564, ""
                                  |
:0045D5E9 6864050000              push 00000564
:0045D5EE 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0045D5F1 8B9188000000            mov edx, dword ptr [ecx+00000088]
:0045D5F7 52                      push edx
:0045D5F8 FF15DC624800            call dword ptr [004862DC]
:0045D5FE 8945EC                  mov dword ptr [ebp-14], eax
:0045D601 8D45F0                  lea eax, dword ptr [ebp-10]
:0045D604 50                      push eax
:0045D605 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0045D608 51                      push ecx
:0045D609 E85C450000              call 00461B6A
:0045D60E 83C408                  add esp, 00000008
:0045D611 6A00                    push 00000000
:0045D613 8D55F0                  lea edx, dword ptr [ebp-10]
:0045D616 52                      push edx
:0045D617 8B45E8                  mov eax, dword ptr [ebp-18]
:0045D61A 8B8888000000            mov ecx, dword ptr [eax+00000088]
:0045D620 51                      push ecx
:0045D621 FF15A4624800            call dword ptr [004862A4]
:0045D627 6865050000              push 00000565
:0045D62C 8B55E8                  mov edx, dword ptr [ebp-18]
:0045D62F 8B8288000000            mov eax, dword ptr [edx+00000088]
:0045D635 50                      push eax
:0045D636 FF15DC624800            call dword ptr [004862DC]
:0045D63C 8945EC                  mov dword ptr [ebp-14], eax
:0045D63F 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0045D642 51                      push ecx
:0045D643 8B55EC                  mov edx, dword ptr [ebp-14]
:0045D646 52                      push edx
:0045D647 E81E450000              call 00461B6A
:0045D64C 83C408                  add esp, 00000008
:0045D64F 6A00                    push 00000000
:0045D651 8D45F0                  lea eax, dword ptr [ebp-10]
:0045D654 50                      push eax
:0045D655 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0045D658 8B9188000000            mov edx, dword ptr [ecx+00000088]
:0045D65E 52                      push edx
:0045D65F FF15A4624800            call dword ptr [004862A4]

* Possible Reference to Dialog: DialogID_00B2, CONTROL_ID:0566, ""
                                  |
:0045D665 6866050000              push 00000566
:0045D66A 8B45E8                  mov eax, dword ptr [ebp-18]
:0045D66D 8B8888000000            mov ecx, dword ptr [eax+00000088]
:0045D673 51                      push ecx
:0045D674 FF15DC624800            call dword ptr [004862DC]
:0045D67A 8945EC                  mov dword ptr [ebp-14], eax
:0045D67D 8D55F0                  lea edx, dword ptr [ebp-10]
:0045D680 52                      push edx
:0045D681 8B45EC                  mov eax, dword ptr [ebp-14]
:0045D684 50                      push eax
:0045D685 E8E0440000              call 00461B6A
:0045D68A 83C408                  add esp, 00000008
:0045D68D 6A00                    push 00000000
:0045D68F 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0045D692 51                      push ecx
:0045D693 8B55E8                  mov edx, dword ptr [ebp-18]
:0045D696 8B8288000000            mov eax, dword ptr [edx+00000088]
:0045D69C 50                      push eax
:0045D69D FF15A4624800            call dword ptr [004862A4]

* Possible Reference to Dialog: DialogID_00B2, CONTROL_ID:0567, ""
                                  |
:0045D6A3 6867050000              push 00000567
:0045D6A8 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0045D6AB 8B9188000000            mov edx, dword ptr [ecx+00000088]
:0045D6B1 52                      push edx
:0045D6B2 FF15DC624800            call dword ptr [004862DC]
:0045D6B8 8945EC                  mov dword ptr [ebp-14], eax
:0045D6BB 8D45F0                  lea eax, dword ptr [ebp-10]
:0045D6BE 50                      push eax
:0045D6BF 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0045D6C2 51                      push ecx
:0045D6C3 E8A2440000              call 00461B6A
:0045D6C8 83C408                  add esp, 00000008
:0045D6CB 6A00                    push 00000000
:0045D6CD 8D55F0                  lea edx, dword ptr [ebp-10]
:0045D6D0 52                      push edx
:0045D6D1 8B45E8                  mov eax, dword ptr [ebp-18]
:0045D6D4 8B8888000000            mov ecx, dword ptr [eax+00000088]
:0045D6DA 51                      push ecx
:0045D6DB FF15A4624800            call dword ptr [004862A4]

* Possible Reference to Dialog: DialogID_00B2, CONTROL_ID:0568, ""
                                  |
:0045D6E1 6868050000              push 00000568
:0045D6E6 8B55E8                  mov edx, dword ptr [ebp-18]
:0045D6E9 8B8288000000            mov eax, dword ptr [edx+00000088]
:0045D6EF 50                      push eax
:0045D6F0 FF15DC624800            call dword ptr [004862DC]
:0045D6F6 8945EC                  mov dword ptr [ebp-14], eax
:0045D6F9 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0045D6FC 51                      push ecx
:0045D6FD 8B55EC                  mov edx, dword ptr [ebp-14]
:0045D700 52                      push edx
:0045D701 E864440000              call 00461B6A
:0045D706 83C408                  add esp, 00000008
:0045D709 6A00                    push 00000000
:0045D70B 8D45F0                  lea eax, dword ptr [ebp-10]
:0045D70E 50                      push eax
:0045D70F 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0045D712 8B9188000000            mov edx, dword ptr [ecx+00000088]
:0045D718 52                      push edx
:0045D719 FF15A4624800            call dword ptr [004862A4]

* Possible Reference to Dialog: DialogID_00B2, CONTROL_ID:0569, ""
                                  |
:0045D71F 6869050000              push 00000569
:0045D724 8B45E8                  mov eax, dword ptr [ebp-18]
:0045D727 8B8888000000            mov ecx, dword ptr [eax+00000088]
:0045D72D 51                      push ecx
:0045D72E FF15DC624800            call dword ptr [004862DC]
:0045D734 8945EC                  mov dword ptr [ebp-14], eax
:0045D737 8D55F0                  lea edx, dword ptr [ebp-10]
:0045D73A 52                      push edx
:0045D73B 8B45EC                  mov eax, dword ptr [ebp-14]
:0045D73E 50                      push eax
:0045D73F E826440000              call 00461B6A
:0045D744 83C408                  add esp, 00000008
:0045D747 6A00                    push 00000000
:0045D749 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0045D74C 51                      push ecx
:0045D74D 8B55E8                  mov edx, dword ptr [ebp-18]
:0045D750 8B8288000000            mov eax, dword ptr [edx+00000088]
:0045D756 50                      push eax
:0045D757 FF15A4624800            call dword ptr [004862A4]

* Possible Reference to Dialog: DialogID_00B2, CONTROL_ID:056A, ""
                                  |
:0045D75D 686A050000              push 0000056A
:0045D762 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0045D765 8B9188000000            mov edx, dword ptr [ecx+00000088]
:0045D76B 52                      push edx
:0045D76C FF15DC624800            call dword ptr [004862DC]
:0045D772 8945EC                  mov dword ptr [ebp-14], eax
:0045D775 8D45F0                  lea eax, dword ptr [ebp-10]
:0045D778 50                      push eax
:0045D779 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0045D77C 51                      push ecx
:0045D77D E8E8430000              call 00461B6A
:0045D782 83C408                  add esp, 00000008
:0045D785 6A00                    push 00000000
:0045D787 8D55F0                  lea edx, dword ptr [ebp-10]
:0045D78A 52                      push edx
:0045D78B 8B45E8                  mov eax, dword ptr [ebp-18]
:0045D78E 8B8888000000            mov ecx, dword ptr [eax+00000088]
:0045D794 51                      push ecx
:0045D795 FF15A4624800            call dword ptr [004862A4]
:0045D79B 8B55E8                  mov edx, dword ptr [ebp-18]
:0045D79E 8B8288000000            mov eax, dword ptr [edx+00000088]
:0045D7A4 50                      push eax
:0045D7A5 FF15A8624800            call dword ptr [004862A8]
:0045D7AB 8BE5                    mov esp, ebp
:0045D7AD 5D                      pop ebp
:0045D7AE C3                      ret



* Referenced by a CALL at Addresses:
|:0045F3DB   , :0045F515   
|
:0045D7AF 55                      push ebp
:0045D7B0 8BEC                    mov ebp, esp
:0045D7B2 51                      push ecx
:0045D7B3 894DFC                  mov dword ptr [ebp-04], ecx
:0045D7B6 8B45FC                  mov eax, dword ptr [ebp-04]
:0045D7B9 33C9                    xor ecx, ecx
:0045D7BB 8A4808                  mov cl, byte ptr [eax+08]
:0045D7BE 81F9FF000000            cmp ecx, 000000FF
:0045D7C4 742A                    je 0045D7F0
:0045D7C6 8B55FC                  mov edx, dword ptr [ebp-04]
:0045D7C9 33C0                    xor eax, eax
:0045D7CB 8A4208                  mov al, byte ptr [edx+08]
:0045D7CE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045D7D1 8B11                    mov edx, dword ptr [ecx]
:0045D7D3 8B0C82                  mov ecx, dword ptr [edx+4*eax]
:0045D7D6 E825BDFAFF              call 00409500
:0045D7DB 50                      push eax
:0045D7DC E8B4BF0100              call 00479795
:0045D7E1 83C404                  add esp, 00000004
:0045D7E4 A108754B00              mov eax, dword ptr [004B7508]
:0045D7E9 50                      push eax
:0045D7EA FF15CC624800            call dword ptr [004862CC]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045D7C4(C)
|
:0045D7F0 8BE5                    mov esp, ebp
:0045D7F2 5D                      pop ebp
:0045D7F3 C3                      ret



* Referenced by a CALL at Addresses:
|:0045C2E7   , :0045E9E9   
|
:0045D7F4 55                      push ebp
:0045D7F5 8BEC                    mov ebp, esp
:0045D7F7 83EC08                  sub esp, 00000008
:0045D7FA 894DF8                  mov dword ptr [ebp-08], ecx
:0045D7FD C745FC00000000          mov [ebp-04], 00000000
:0045D804 EB09                    jmp 0045D80F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045D826(U)
|
:0045D806 8B45FC                  mov eax, dword ptr [ebp-04]
:0045D809 83C001                  add eax, 00000001
:0045D80C 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045D804(U)
|
:0045D80F 837DFC1E                cmp dword ptr [ebp-04], 0000001E
:0045D813 7313                    jnb 0045D828
:0045D815 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045D818 8B55F8                  mov edx, dword ptr [ebp-08]
:0045D81B C7848A8C00000000000000  mov dword ptr [edx+4*ecx+0000008C], 00000000
:0045D826 EBDE                    jmp 0045D806

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045D813(C)
|
:0045D828 C745FC00000000          mov [ebp-04], 00000000
:0045D82F EB09                    jmp 0045D83A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045D84A(U)
|
:0045D831 8B45FC                  mov eax, dword ptr [ebp-04]
:0045D834 83C001                  add eax, 00000001
:0045D837 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045D82F(U)
|
:0045D83A 837DFC0F                cmp dword ptr [ebp-04], 0000000F
:0045D83E 730C                    jnb 0045D84C
:0045D840 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045D843 034DFC                  add ecx, dword ptr [ebp-04]
:0045D846 C64128FF                mov [ecx+28], FF
:0045D84A EBE5                    jmp 0045D831

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045D83E(C)
|
:0045D84C 8B55F8                  mov edx, dword ptr [ebp-08]
:0045D84F C7820801000000000000    mov dword ptr [ebx+00000108], 00000000
:0045D859 8BE5                    mov esp, ebp
:0045D85B 5D                      pop ebp
:0045D85C C3                      ret



* Referenced by a CALL at Addresses:
|:0045F376   , :0045F4FF   
|
:0045D85D 55                      push ebp
:0045D85E 8BEC                    mov ebp, esp
:0045D860 83EC24                  sub esp, 00000024
:0045D863 894DDC                  mov dword ptr [ebp-24], ecx
:0045D866 8B4508                  mov eax, dword ptr [ebp+08]
:0045D869 50                      push eax
:0045D86A 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0045D86D E87E1F0000              call 0045F7F0
:0045D872 85C0                    test eax, eax
:0045D874 0F84BD000000            je 0045D937
:0045D87A 6A01                    push 00000001
:0045D87C 6A01                    push 00000001
:0045D87E B9B0694B00              mov ecx, 004B69B0
:0045D883 E8F26D0100              call 0047467A
:0045D888 6A00                    push 00000000
:0045D88A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045D88D 51                      push ecx
:0045D88E 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0045D891 E87A1F0000              call 0045F810
:0045D896 8B5508                  mov edx, dword ptr [ebp+08]
:0045D899 52                      push edx
:0045D89A 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0045D89D E863FAFFFF              call 0045D305
:0045D8A2 8945E0                  mov dword ptr [ebp-20], eax
:0045D8A5 817DE0FF000000          cmp dword ptr [ebp-20], 000000FF
:0045D8AC 7505                    jne 0045D8B3
:0045D8AE E9EC010000              jmp 0045DA9F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045D8AC(C)
|
:0045D8B3 8B45E0                  mov eax, dword ptr [ebp-20]
:0045D8B6 8945E4                  mov dword ptr [ebp-1C], eax
:0045D8B9 EB09                    jmp 0045D8C4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045D8F3(U)
|
:0045D8BB 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0045D8BE 83C101                  add ecx, 00000001
:0045D8C1 894DE4                  mov dword ptr [ebp-1C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045D8B9(U)
|
:0045D8C4 8B55DC                  mov edx, dword ptr [ebp-24]
:0045D8C7 8B8208010000            mov eax, dword ptr [edx+00000108]
:0045D8CD 83E801                  sub eax, 00000001
:0045D8D0 3945E4                  cmp dword ptr [ebp-1C], eax
:0045D8D3 7320                    jnb 0045D8F5
:0045D8D5 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0045D8D8 034DE4                  add ecx, dword ptr [ebp-1C]
:0045D8DB 8B55DC                  mov edx, dword ptr [ebp-24]
:0045D8DE 0355E4                  add edx, dword ptr [ebp-1C]
:0045D8E1 8A4229                  mov al, byte ptr [edx+29]
:0045D8E4 884128                  mov byte ptr [ecx+28], al
:0045D8E7 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0045D8EA 51                      push ecx
:0045D8EB 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0045D8EE E841F4FFFF              call 0045CD34
:0045D8F3 EBC6                    jmp 0045D8BB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045D8D3(C)
|
:0045D8F5 6A01                    push 00000001
:0045D8F7 8B55DC                  mov edx, dword ptr [ebp-24]
:0045D8FA 8B8208010000            mov eax, dword ptr [edx+00000108]
:0045D900 50                      push eax
:0045D901 E898210200              call 0047FA9E
:0045D906 83C408                  add esp, 00000008
:0045D909 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0045D90C 898108010000            mov dword ptr [ecx+00000108], eax
:0045D912 8B55DC                  mov edx, dword ptr [ebp-24]
:0045D915 8B8208010000            mov eax, dword ptr [edx+00000108]
:0045D91B 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0045D91E C6440128FF              mov [ecx+eax+28], FF
:0045D923 8B55DC                  mov edx, dword ptr [ebp-24]
:0045D926 8B8208010000            mov eax, dword ptr [edx+00000108]
:0045D92C 50                      push eax
:0045D92D 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0045D930 E86BF3FFFF              call 0045CCA0
:0045D935 EB6A                    jmp 0045D9A1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045D874(C)
|
:0045D937 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0045D93A 8B55DC                  mov edx, dword ptr [ebp-24]
:0045D93D 8B8108010000            mov eax, dword ptr [ecx+00000108]
:0045D943 3B820C010000            cmp eax, dword ptr [edx+0000010C]
:0045D949 7356                    jnb 0045D9A1
:0045D94B 6A01                    push 00000001
:0045D94D 6A0F                    push 0000000F
:0045D94F B9B0694B00              mov ecx, 004B69B0
:0045D954 E8216D0100              call 0047467A
:0045D959 6A01                    push 00000001
:0045D95B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045D95E 51                      push ecx
:0045D95F 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0045D962 E8A91E0000              call 0045F810
:0045D967 8B55DC                  mov edx, dword ptr [ebp-24]
:0045D96A 8B8208010000            mov eax, dword ptr [edx+00000108]
:0045D970 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0045D973 8A5508                  mov dl, byte ptr [ebp+08]
:0045D976 88540128                mov byte ptr [ecx+eax+28], dl
:0045D97A 8B45DC                  mov eax, dword ptr [ebp-24]
:0045D97D 8B8808010000            mov ecx, dword ptr [eax+00000108]
:0045D983 51                      push ecx
:0045D984 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0045D987 E8A8F3FFFF              call 0045CD34
:0045D98C 8B55DC                  mov edx, dword ptr [ebp-24]
:0045D98F 8B8208010000            mov eax, dword ptr [edx+00000108]
:0045D995 83C001                  add eax, 00000001
:0045D998 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0045D99B 898108010000            mov dword ptr [ecx+00000108], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045D935(U), :0045D949(C)
|
:0045D9A1 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0045D9A4 E8FC000000              call 0045DAA5
:0045D9A9 8B5508                  mov edx, dword ptr [ebp+08]
:0045D9AC 52                      push edx
:0045D9AD 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0045D9B0 E8B8F4FFFF              call 0045CE6D
:0045D9B5 8D45E8                  lea eax, dword ptr [ebp-18]
:0045D9B8 50                      push eax
:0045D9B9 FF1568624800            call dword ptr [00486268]
:0045D9BF 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0045D9C2 51                      push ecx
:0045D9C3 8B15E85F4B00            mov edx, dword ptr [004B5FE8]
:0045D9C9 52                      push edx
:0045D9CA FF1598634800            call dword ptr [00486398]
:0045D9D0 8B45F0                  mov eax, dword ptr [ebp-10]
:0045D9D3 3B45E8                  cmp eax, dword ptr [ebp-18]
:0045D9D6 7F43                    jg 0045DA1B
:0045D9D8 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0045D9DB 3B4DF8                  cmp ecx, dword ptr [ebp-08]
:0045D9DE 7D3B                    jge 0045DA1B
:0045D9E0 8B55F4                  mov edx, dword ptr [ebp-0C]
:0045D9E3 3B55EC                  cmp edx, dword ptr [ebp-14]
:0045D9E6 7F33                    jg 0045DA1B
:0045D9E8 8B45EC                  mov eax, dword ptr [ebp-14]
:0045D9EB 3B45FC                  cmp eax, dword ptr [ebp-04]
:0045D9EE 7D2B                    jge 0045DA1B
:0045D9F0 8D4DE8                  lea ecx, dword ptr [ebp-18]
:0045D9F3 51                      push ecx
:0045D9F4 8B15E85F4B00            mov edx, dword ptr [004B5FE8]
:0045D9FA 52                      push edx
:0045D9FB FF1564624800            call dword ptr [00486264]
:0045DA01 8B45EC                  mov eax, dword ptr [ebp-14]
:0045DA04 50                      push eax
:0045DA05 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0045DA08 51                      push ecx
:0045DA09 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0045DA0C E869EBFFFF              call 0045C57A
:0045DA11 25FF000000              and eax, 000000FF
:0045DA16 894508                  mov dword ptr [ebp+08], eax
:0045DA19 EB28                    jmp 0045DA43

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045D9D6(C), :0045D9DE(C), :0045D9E6(C), :0045D9EE(C)
|
:0045DA1B 8D55E8                  lea edx, dword ptr [ebp-18]
:0045DA1E 52                      push edx
:0045DA1F A1EC5F4B00              mov eax, dword ptr [004B5FEC]
:0045DA24 50                      push eax
:0045DA25 FF1564624800            call dword ptr [00486264]
:0045DA2B 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0045DA2E 51                      push ecx
:0045DA2F 8B55E8                  mov edx, dword ptr [ebp-18]
:0045DA32 52                      push edx
:0045DA33 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0045DA36 E8D9EBFFFF              call 0045C614
:0045DA3B 25FF000000              and eax, 000000FF
:0045DA40 894508                  mov dword ptr [ebp+08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045DA19(U)
|
:0045DA43 8A4508                  mov al, byte ptr [ebp+08]
:0045DA46 50                      push eax
:0045DA47 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0045DA4A E89AF0FFFF              call 0045CAE9
:0045DA4F 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0045DA52 83B90801000000          cmp dword ptr [ecx+00000108], 00000000
:0045DA59 7629                    jbe 0045DA84
:0045DA5B 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0045DA5E E88BE6FFFF              call 0045C0EE
:0045DA63 85C0                    test eax, eax
:0045DA65 741D                    je 0045DA84
:0045DA67 6A01                    push 00000001
:0045DA69 6A01                    push 00000001
:0045DA6B 8B55DC                  mov edx, dword ptr [ebp-24]
:0045DA6E 8B8288000000            mov eax, dword ptr [edx+00000088]
:0045DA74 50                      push eax
:0045DA75 FF15DC624800            call dword ptr [004862DC]
:0045DA7B 50                      push eax
:0045DA7C FF15E8624800            call dword ptr [004862E8]
:0045DA82 EB1B                    jmp 0045DA9F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045DA59(C), :0045DA65(C)
|
:0045DA84 6A00                    push 00000000
:0045DA86 6A01                    push 00000001
:0045DA88 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0045DA8B 8B9188000000            mov edx, dword ptr [ecx+00000088]
:0045DA91 52                      push edx
:0045DA92 FF15DC624800            call dword ptr [004862DC]
:0045DA98 50                      push eax
:0045DA99 FF15E8624800            call dword ptr [004862E8]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045D8AE(U), :0045DA82(U)
|
:0045DA9F 8BE5                    mov esp, ebp
:0045DAA1 5D                      pop ebp
:0045DAA2 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0045CE64   , :0045D26C   , :0045D9A4   
|
:0045DAA5 55                      push ebp
:0045DAA6 8BEC                    mov ebp, esp
:0045DAA8 83EC1C                  sub esp, 0000001C
:0045DAAB 894DE4                  mov dword ptr [ebp-1C], ecx
:0045DAAE 8B45E4                  mov eax, dword ptr [ebp-1C]
:0045DAB1 8B880C010000            mov ecx, dword ptr [eax+0000010C]
:0045DAB7 51                      push ecx
:0045DAB8 8B55E4                  mov edx, dword ptr [ebp-1C]
:0045DABB 8B8208010000            mov eax, dword ptr [edx+00000108]
:0045DAC1 50                      push eax

* Possible StringData Ref from Data Obj ->"佫  - %2d/%2d"
                                  |
:0045DAC2 6860E44800              push 0048E460
:0045DAC7 8D4DE8                  lea ecx, dword ptr [ebp-18]
:0045DACA 51                      push ecx
:0045DACB FF15C0624800            call dword ptr [004862C0]
:0045DAD1 83C410                  add esp, 00000010
:0045DAD4 8D55E8                  lea edx, dword ptr [ebp-18]
:0045DAD7 52                      push edx
:0045DAD8 6A00                    push 00000000
:0045DADA 6A0C                    push 0000000C
:0045DADC 686C050000              push 0000056C
:0045DAE1 8B45E4                  mov eax, dword ptr [ebp-1C]
:0045DAE4 8B8888000000            mov ecx, dword ptr [eax+00000088]
:0045DAEA 51                      push ecx
:0045DAEB FF1590634800            call dword ptr [00486390]
:0045DAF1 8BE5                    mov esp, ebp
:0045DAF3 5D                      pop ebp
:0045DAF4 C3                      ret



* Referenced by a CALL at Address:
|:0045E938   
|
:0045DAF5 55                      push ebp
:0045DAF6 8BEC                    mov ebp, esp
:0045DAF8 83EC14                  sub esp, 00000014
:0045DAFB 894DEC                  mov dword ptr [ebp-14], ecx
:0045DAFE C745FC00000000          mov [ebp-04], 00000000
:0045DB05 C745F800000000          mov [ebp-08], 00000000
:0045DB0C C745F400000000          mov [ebp-0C], 00000000

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0045DB13 6A07                    push 00000007
:0045DB15 E8C9EF0100              call 0047CAE3
:0045DB1A 83C404                  add esp, 00000004
:0045DB1D C745F000000000          mov [ebp-10], 00000000
:0045DB24 EB09                    jmp 0045DB2F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045DB9C(U)
|
:0045DB26 8B45F0                  mov eax, dword ptr [ebp-10]
:0045DB29 83C001                  add eax, 00000001
:0045DB2C 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045DB24(U)
|
:0045DB2F 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0045DB32 8B55F0                  mov edx, dword ptr [ebp-10]
:0045DB35 3B5104                  cmp edx, dword ptr [ecx+04]
:0045DB38 7364                    jnb 0045DB9E
:0045DB3A 6A04                    push 00000004
:0045DB3C 6A00                    push 00000000
:0045DB3E 8B45F0                  mov eax, dword ptr [ebp-10]
:0045DB41 69C0000E0000            imul eax, 00000E00
:0045DB47 50                      push eax
:0045DB48 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0045DB4B 83C14C                  add ecx, 0000004C
:0045DB4E E8ED1E0200              call 0047FA40
:0045DB53 8945FC                  mov dword ptr [ebp-04], eax
:0045DB56 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0045DB59 034DF0                  add ecx, dword ptr [ebp-10]
:0045DB5C 33D2                    xor edx, edx
:0045DB5E 8A510A                  mov dl, byte ptr [ecx+0A]
:0045DB61 52                      push edx
:0045DB62 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0045DB65 E838F8FFFF              call 0045D3A2
:0045DB6A 8945F8                  mov dword ptr [ebp-08], eax
:0045DB6D 8B45EC                  mov eax, dword ptr [ebp-14]
:0045DB70 0345F0                  add eax, dword ptr [ebp-10]
:0045DB73 33C9                    xor ecx, ecx
:0045DB75 8A480A                  mov cl, byte ptr [eax+0A]
:0045DB78 51                      push ecx
:0045DB79 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0045DB7C E84BF8FFFF              call 0045D3CC
:0045DB81 8945F4                  mov dword ptr [ebp-0C], eax
:0045DB84 8B55FC                  mov edx, dword ptr [ebp-04]
:0045DB87 52                      push edx
:0045DB88 6A40                    push 00000040
:0045DB8A 6A38                    push 00000038
:0045DB8C 8B45F4                  mov eax, dword ptr [ebp-0C]
:0045DB8F 50                      push eax
:0045DB90 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045DB93 51                      push ecx
:0045DB94 E8B8060200              call 0047E251
:0045DB99 83C414                  add esp, 00000014
:0045DB9C EB88                    jmp 0045DB26

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045DB38(C)
|
:0045DB9E 6A04                    push 00000004
:0045DBA0 6A00                    push 00000000
:0045DBA2 6A00                    push 00000000
:0045DBA4 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0045DBA7 83C174                  add ecx, 00000074
:0045DBAA E8911E0200              call 0047FA40
:0045DBAF 8945FC                  mov dword ptr [ebp-04], eax
:0045DBB2 C745F000000000          mov [ebp-10], 00000000
:0045DBB9 EB09                    jmp 0045DBC4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045DC4B(U)
|
:0045DBBB 8B55F0                  mov edx, dword ptr [ebp-10]
:0045DBBE 83C201                  add edx, 00000001
:0045DBC1 8955F0                  mov dword ptr [ebp-10], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045DBB9(U)
|
:0045DBC4 837DF002                cmp dword ptr [ebp-10], 00000002
:0045DBC8 0F8382000000            jnb 0045DC50
:0045DBCE 8B45FC                  mov eax, dword ptr [ebp-04]
:0045DBD1 50                      push eax
:0045DBD2 6A10                    push 00000010
:0045DBD4 6A58                    push 00000058
:0045DBD6 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0045DBD9 C1E104                  shl ecx, 04
:0045DBDC 8B919C674800            mov edx, dword ptr [ecx+0048679C]
:0045DBE2 83C204                  add edx, 00000004
:0045DBE5 52                      push edx
:0045DBE6 8B45F0                  mov eax, dword ptr [ebp-10]
:0045DBE9 C1E004                  shl eax, 04
:0045DBEC 8B8898674800            mov ecx, dword ptr [eax+00486798]
:0045DBF2 83C102                  add ecx, 00000002
:0045DBF5 51                      push ecx
:0045DBF6 E856060200              call 0047E251
:0045DBFB 83C414                  add esp, 00000014
:0045DBFE 6A00                    push 00000000
:0045DC00 6A3D                    push 0000003D
:0045DC02 68F0000000              push 000000F0
:0045DC07 6A70                    push 00000070
:0045DC09 6A00                    push 00000000
:0045DC0B 6A10                    push 00000010
:0045DC0D 6A58                    push 00000058
:0045DC0F 8B55FC                  mov edx, dword ptr [ebp-04]
:0045DC12 52                      push edx
:0045DC13 E8922AFDFF              call 004306AA
:0045DC18 83C420                  add esp, 00000020
:0045DC1B 8B45FC                  mov eax, dword ptr [ebp-04]
:0045DC1E 50                      push eax
:0045DC1F 6A10                    push 00000010
:0045DC21 6A58                    push 00000058
:0045DC23 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0045DC26 C1E104                  shl ecx, 04
:0045DC29 8B919C674800            mov edx, dword ptr [ecx+0048679C]
:0045DC2F 83C204                  add edx, 00000004
:0045DC32 52                      push edx
:0045DC33 8B45F0                  mov eax, dword ptr [ebp-10]
:0045DC36 C1E004                  shl eax, 04
:0045DC39 8B8898674800            mov ecx, dword ptr [eax+00486798]
:0045DC3F 83C102                  add ecx, 00000002
:0045DC42 51                      push ecx
:0045DC43 E853040200              call 0047E09B
:0045DC48 83C414                  add esp, 00000014
:0045DC4B E96BFFFFFF              jmp 0045DBBB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045DBC8(C)
|
:0045DC50 8B55FC                  mov edx, dword ptr [ebp-04]
:0045DC53 52                      push edx
:0045DC54 6A2A                    push 0000002A
:0045DC56 6A5A                    push 0000005A
:0045DC58 68F4000000              push 000000F4
:0045DC5D 682C010000              push 0000012C
:0045DC62 E8EA050200              call 0047E251
:0045DC67 83C414                  add esp, 00000014
:0045DC6A 6A08                    push 00000008
:0045DC6C E872EE0100              call 0047CAE3
:0045DC71 83C404                  add esp, 00000004
:0045DC74 C745F000000000          mov [ebp-10], 00000000
:0045DC7B EB09                    jmp 0045DC86

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045DCDE(U)
|
:0045DC7D 8B45F0                  mov eax, dword ptr [ebp-10]
:0045DC80 83C001                  add eax, 00000001
:0045DC83 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045DC7B(U)
|
:0045DC86 837DF00F                cmp dword ptr [ebp-10], 0000000F
:0045DC8A 7354                    jnb 0045DCE0
:0045DC8C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0045DC8F 51                      push ecx
:0045DC90 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0045DC93 E85CF7FFFF              call 0045D3F4
:0045DC98 8945F8                  mov dword ptr [ebp-08], eax
:0045DC9B 8B55F0                  mov edx, dword ptr [ebp-10]
:0045DC9E 52                      push edx
:0045DC9F 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0045DCA2 E86EF7FFFF              call 0045D415
:0045DCA7 8945F4                  mov dword ptr [ebp-0C], eax
:0045DCAA 6A04                    push 00000004
:0045DCAC 6A00                    push 00000000
:0045DCAE 8B45F0                  mov eax, dword ptr [ebp-10]
:0045DCB1 69C000090000            imul eax, 00000900
:0045DCB7 50                      push eax
:0045DCB8 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0045DCBB 83C160                  add ecx, 00000060
:0045DCBE E87D1D0200              call 0047FA40
:0045DCC3 8945FC                  mov dword ptr [ebp-04], eax
:0045DCC6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045DCC9 51                      push ecx
:0045DCCA 6A30                    push 00000030
:0045DCCC 6A30                    push 00000030
:0045DCCE 8B55F4                  mov edx, dword ptr [ebp-0C]
:0045DCD1 52                      push edx
:0045DCD2 8B45F8                  mov eax, dword ptr [ebp-08]
:0045DCD5 50                      push eax
:0045DCD6 E876050200              call 0047E251
:0045DCDB 83C414                  add esp, 00000014
:0045DCDE EB9D                    jmp 0045DC7D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045DC8A(C)
|
:0045DCE0 6A00                    push 00000000
:0045DCE2 E8FCED0100              call 0047CAE3
:0045DCE7 83C404                  add esp, 00000004
:0045DCEA 8BE5                    mov esp, ebp
:0045DCEC 5D                      pop ebp
:0045DCED C3                      ret


:0045DCEE 55                      push ebp
:0045DCEF 8BEC                    mov ebp, esp
:0045DCF1 83EC08                  sub esp, 00000008
:0045DCF4 56                      push esi
:0045DCF5 8B4508                  mov eax, dword ptr [ebp+08]
:0045DCF8 25FF000000              and eax, 000000FF
:0045DCFD 8B4D10                  mov ecx, dword ptr [ebp+10]
:0045DD00 8B1481                  mov edx, dword ptr [ecx+4*eax]
:0045DD03 8955FC                  mov dword ptr [ebp-04], edx
:0045DD06 8B450C                  mov eax, dword ptr [ebp+0C]
:0045DD09 25FF000000              and eax, 000000FF
:0045DD0E 8B4D10                  mov ecx, dword ptr [ebp+10]
:0045DD11 8B1481                  mov edx, dword ptr [ecx+4*eax]
:0045DD14 8955F8                  mov dword ptr [ebp-08], edx
:0045DD17 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045DD1A E8F1CBFCFF              call 0042A910
:0045DD1F 8BF0                    mov esi, eax
:0045DD21 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045DD24 E8E7CBFCFF              call 0042A910
:0045DD29 2BF0                    sub esi, eax
:0045DD2B 8BC6                    mov eax, esi
:0045DD2D 5E                      pop esi
:0045DD2E 8BE5                    mov esp, ebp
:0045DD30 5D                      pop ebp
:0045DD31 C3                      ret


:0045DD32 55                      push ebp
:0045DD33 8BEC                    mov ebp, esp
:0045DD35 83EC08                  sub esp, 00000008
:0045DD38 53                      push ebx
:0045DD39 8B4508                  mov eax, dword ptr [ebp+08]
:0045DD3C 25FF000000              and eax, 000000FF
:0045DD41 8B4D10                  mov ecx, dword ptr [ebp+10]
:0045DD44 8B1481                  mov edx, dword ptr [ecx+4*eax]
:0045DD47 8955FC                  mov dword ptr [ebp-04], edx
:0045DD4A 8B450C                  mov eax, dword ptr [ebp+0C]
:0045DD4D 25FF000000              and eax, 000000FF
:0045DD52 8B4D10                  mov ecx, dword ptr [ebp+10]
:0045DD55 8B1481                  mov edx, dword ptr [ecx+4*eax]
:0045DD58 8955F8                  mov dword ptr [ebp-08], edx
:0045DD5B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045DD5E E80F9BFAFF              call 00407872
:0045DD63 8AD8                    mov bl, al
:0045DD65 81E3FF000000            and ebx, 000000FF
:0045DD6B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045DD6E E8FF9AFAFF              call 00407872
:0045DD73 25FF000000              and eax, 000000FF
:0045DD78 2BD8                    sub ebx, eax
:0045DD7A 8BC3                    mov eax, ebx
:0045DD7C 5B                      pop ebx
:0045DD7D 8BE5                    mov esp, ebp
:0045DD7F 5D                      pop ebp
:0045DD80 C3                      ret


:0045DD81 55                      push ebp
:0045DD82 8BEC                    mov ebp, esp
:0045DD84 83EC08                  sub esp, 00000008
:0045DD87 53                      push ebx
:0045DD88 8B4508                  mov eax, dword ptr [ebp+08]
:0045DD8B 25FF000000              and eax, 000000FF
:0045DD90 8B4D10                  mov ecx, dword ptr [ebp+10]
:0045DD93 8B1481                  mov edx, dword ptr [ecx+4*eax]
:0045DD96 8955FC                  mov dword ptr [ebp-04], edx
:0045DD99 8B450C                  mov eax, dword ptr [ebp+0C]
:0045DD9C 25FF000000              and eax, 000000FF
:0045DDA1 8B4D10                  mov ecx, dword ptr [ebp+10]
:0045DDA4 8B1481                  mov edx, dword ptr [ecx+4*eax]
:0045DDA7 8955F8                  mov dword ptr [ebp-08], edx
:0045DDAA 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045DDAD E81E88FAFF              call 004065D0
:0045DDB2 8AD8                    mov bl, al
:0045DDB4 81E3FF000000            and ebx, 000000FF
:0045DDBA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045DDBD E80E88FAFF              call 004065D0
:0045DDC2 25FF000000              and eax, 000000FF
:0045DDC7 2BD8                    sub ebx, eax
:0045DDC9 8BC3                    mov eax, ebx
:0045DDCB 5B                      pop ebx
:0045DDCC 8BE5                    mov esp, ebp
:0045DDCE 5D                      pop ebp
:0045DDCF C3                      ret


:0045DDD0 55                      push ebp
:0045DDD1 8BEC                    mov ebp, esp
:0045DDD3 83EC08                  sub esp, 00000008
:0045DDD6 56                      push esi
:0045DDD7 8B4508                  mov eax, dword ptr [ebp+08]
:0045DDDA 25FF000000              and eax, 000000FF
:0045DDDF 8B4D10                  mov ecx, dword ptr [ebp+10]
:0045DDE2 8B1481                  mov edx, dword ptr [ecx+4*eax]
:0045DDE5 8955FC                  mov dword ptr [ebp-04], edx
:0045DDE8 8B450C                  mov eax, dword ptr [ebp+0C]
:0045DDEB 25FF000000              and eax, 000000FF
:0045DDF0 8B4D10                  mov ecx, dword ptr [ebp+10]
:0045DDF3 8B1481                  mov edx, dword ptr [ecx+4*eax]
:0045DDF6 8955F8                  mov dword ptr [ebp-08], edx
:0045DDF9 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045DDFC E82593FAFF              call 00407126
:0045DE01 8BF0                    mov esi, eax
:0045DE03 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045DE06 E81B93FAFF              call 00407126
:0045DE0B 2BF0                    sub esi, eax
:0045DE0D 8BC6                    mov eax, esi
:0045DE0F 5E                      pop esi
:0045DE10 8BE5                    mov esp, ebp
:0045DE12 5D                      pop ebp
:0045DE13 C3                      ret


:0045DE14 55                      push ebp
:0045DE15 8BEC                    mov ebp, esp
:0045DE17 83EC08                  sub esp, 00000008
:0045DE1A 56                      push esi
:0045DE1B 8B4508                  mov eax, dword ptr [ebp+08]
:0045DE1E 25FF000000              and eax, 000000FF
:0045DE23 8B4D10                  mov ecx, dword ptr [ebp+10]
:0045DE26 8B1481                  mov edx, dword ptr [ecx+4*eax]
:0045DE29 8955FC                  mov dword ptr [ebp-04], edx
:0045DE2C 8B450C                  mov eax, dword ptr [ebp+0C]
:0045DE2F 25FF000000              and eax, 000000FF
:0045DE34 8B4D10                  mov ecx, dword ptr [ebp+10]
:0045DE37 8B1481                  mov edx, dword ptr [ecx+4*eax]
:0045DE3A 8955F8                  mov dword ptr [ebp-08], edx
:0045DE3D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045DE40 E84393FAFF              call 00407188
:0045DE45 8BF0                    mov esi, eax
:0045DE47 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045DE4A E83993FAFF              call 00407188
:0045DE4F 2BF0                    sub esi, eax
:0045DE51 8BC6                    mov eax, esi
:0045DE53 5E                      pop esi
:0045DE54 8BE5                    mov esp, ebp
:0045DE56 5D                      pop ebp
:0045DE57 C3                      ret


:0045DE58 55                      push ebp
:0045DE59 8BEC                    mov ebp, esp
:0045DE5B 83EC08                  sub esp, 00000008
:0045DE5E 56                      push esi
:0045DE5F 8B4508                  mov eax, dword ptr [ebp+08]
:0045DE62 25FF000000              and eax, 000000FF
:0045DE67 8B4D10                  mov ecx, dword ptr [ebp+10]
:0045DE6A 8B1481                  mov edx, dword ptr [ecx+4*eax]
:0045DE6D 8955FC                  mov dword ptr [ebp-04], edx
:0045DE70 8B450C                  mov eax, dword ptr [ebp+0C]
:0045DE73 25FF000000              and eax, 000000FF
:0045DE78 8B4D10                  mov ecx, dword ptr [ebp+10]
:0045DE7B 8B1481                  mov edx, dword ptr [ecx+4*eax]
:0045DE7E 8955F8                  mov dword ptr [ebp-08], edx
:0045DE81 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045DE84 E8CE92FAFF              call 00407157
:0045DE89 8BF0                    mov esi, eax
:0045DE8B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045DE8E E8C492FAFF              call 00407157
:0045DE93 2BF0                    sub esi, eax
:0045DE95 8BC6                    mov eax, esi
:0045DE97 5E                      pop esi
:0045DE98 8BE5                    mov esp, ebp
:0045DE9A 5D                      pop ebp
:0045DE9B C3                      ret



* Referenced by a CALL at Addresses:
|:0045C3AF   , :0045F7E0   
|
:0045DE9C 55                      push ebp
:0045DE9D 8BEC                    mov ebp, esp
:0045DE9F 83EC0C                  sub esp, 0000000C
:0045DEA2 894DF8                  mov dword ptr [ebp-08], ecx
:0045DEA5 C745FC00000000          mov [ebp-04], 00000000
:0045DEAC 8B4508                  mov eax, dword ptr [ebp+08]
:0045DEAF 8945F4                  mov dword ptr [ebp-0C], eax
:0045DEB2 837DF405                cmp dword ptr [ebp-0C], 00000005
:0045DEB6 773E                    ja 0045DEF6
:0045DEB8 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0045DEBB FF248D24DF4500          jmp dword ptr [4*ecx+0045DF24]
:0045DEC2 C745FCEEDC4500          mov [ebp-04], 0045DCEE
:0045DEC9 EB2B                    jmp 0045DEF6
:0045DECB C745FC32DD4500          mov [ebp-04], 0045DD32
:0045DED2 EB22                    jmp 0045DEF6
:0045DED4 C745FC81DD4500          mov [ebp-04], 0045DD81
:0045DEDB EB19                    jmp 0045DEF6
:0045DEDD C745FCD0DD4500          mov [ebp-04], 0045DDD0
:0045DEE4 EB10                    jmp 0045DEF6
:0045DEE6 C745FC14DE4500          mov [ebp-04], 0045DE14
:0045DEED EB07                    jmp 0045DEF6
:0045DEEF C745FC58DE4500          mov [ebp-04], 0045DE58

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045DEB6(C), :0045DEC9(U), :0045DED2(U), :0045DEDB(U), :0045DEE4(U)
|:0045DEED(U)
|
:0045DEF6 837DFC00                cmp dword ptr [ebp-04], 00000000
:0045DEFA 7422                    je 0045DF1E
:0045DEFC 8B55F8                  mov edx, dword ptr [ebp-08]
:0045DEFF 8B02                    mov eax, dword ptr [edx]
:0045DF01 50                      push eax
:0045DF02 6A00                    push 00000000
:0045DF04 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045DF07 51                      push ecx
:0045DF08 8B55F8                  mov edx, dword ptr [ebp-08]
:0045DF0B 8B4204                  mov eax, dword ptr [edx+04]
:0045DF0E 50                      push eax
:0045DF0F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045DF12 83C10A                  add ecx, 0000000A
:0045DF15 51                      push ecx
:0045DF16 E8A8DEFFFF              call 0045BDC3
:0045DF1B 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045DEFA(C)
|
:0045DF1E 8BE5                    mov esp, ebp
:0045DF20 5D                      pop ebp
:0045DF21 C20400                  ret 0004



:0045DF24 C2DE4500                DWORD 0045DEC2
:0045DF28 CBDE4500                DWORD 0045DECB
:0045DF2C D4DE4500                DWORD 0045DED4
:0045DF30 DDDE4500                DWORD 0045DEDD
:0045DF34 E6DE4500                DWORD 0045DEE6
:0045DF38 EFDE4500                DWORD 0045DEEF



* Referenced by a CALL at Addresses:
|:0045DFB6   , :0045E020   , :0045E081   
|
:0045DF3C 55                      push ebp
:0045DF3D 8BEC                    mov ebp, esp
:0045DF3F 83EC08                  sub esp, 00000008
:0045DF42 894DF8                  mov dword ptr [ebp-08], ecx
:0045DF45 C645FC00                mov [ebp-04], 00
:0045DF49 EB08                    jmp 0045DF53

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045DF8A(U)
|
:0045DF4B 8A45FC                  mov al, byte ptr [ebp-04]
:0045DF4E 0401                    add al, 01
:0045DF50 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045DF49(U)
|
:0045DF53 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045DF56 81E1FF000000            and ecx, 000000FF
:0045DF5C 83F902                  cmp ecx, 00000002
:0045DF5F 7D2B                    jge 0045DF8C
:0045DF61 8B5508                  mov edx, dword ptr [ebp+08]
:0045DF64 8B4204                  mov eax, dword ptr [edx+04]
:0045DF67 50                      push eax
:0045DF68 8B0A                    mov ecx, dword ptr [edx]
:0045DF6A 51                      push ecx
:0045DF6B 8B55FC                  mov edx, dword ptr [ebp-04]
:0045DF6E 81E2FF000000            and edx, 000000FF
:0045DF74 C1E204                  shl edx, 04
:0045DF77 81C298674800            add edx, 00486798
:0045DF7D 52                      push edx
:0045DF7E FF158C634800            call dword ptr [0048638C]
:0045DF84 85C0                    test eax, eax
:0045DF86 7402                    je 0045DF8A
:0045DF88 EB02                    jmp 0045DF8C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045DF86(C)
|
:0045DF8A EBBF                    jmp 0045DF4B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045DF5F(C), :0045DF88(U)
|
:0045DF8C 8B45FC                  mov eax, dword ptr [ebp-04]
:0045DF8F 25FF000000              and eax, 000000FF
:0045DF94 83F802                  cmp eax, 00000002
:0045DF97 7C04                    jl 0045DF9D
:0045DF99 C645FCFF                mov [ebp-04], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045DF97(C)
|
:0045DF9D 8A45FC                  mov al, byte ptr [ebp-04]
:0045DFA0 8BE5                    mov esp, ebp
:0045DFA2 5D                      pop ebp
:0045DFA3 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0045F29D   
|
:0045DFA6 55                      push ebp
:0045DFA7 8BEC                    mov ebp, esp
:0045DFA9 83EC08                  sub esp, 00000008
:0045DFAC 894DF8                  mov dword ptr [ebp-08], ecx
:0045DFAF 8B4508                  mov eax, dword ptr [ebp+08]
:0045DFB2 50                      push eax
:0045DFB3 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045DFB6 E881FFFFFF              call 0045DF3C
:0045DFBB 8845FC                  mov byte ptr [ebp-04], al
:0045DFBE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045DFC1 81E1FF000000            and ecx, 000000FF
:0045DFC7 83F902                  cmp ecx, 00000002
:0045DFCA 7D2D                    jge 0045DFF9
:0045DFCC 8B15E85F4B00            mov edx, dword ptr [004B5FE8]
:0045DFD2 52                      push edx
:0045DFD3 FF1588634800            call dword ptr [00486388]
:0045DFD9 8B45F8                  mov eax, dword ptr [ebp-08]
:0045DFDC 8A4DFC                  mov cl, byte ptr [ebp-04]
:0045DFDF 888804010000            mov byte ptr [eax+00000104], cl
:0045DFE5 6A00                    push 00000000
:0045DFE7 B9B0694B00              mov ecx, 004B69B0
:0045DFEC E8BC660100              call 004746AD
:0045DFF1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045DFF4 E800040000              call 0045E3F9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045DFCA(C)
|
:0045DFF9 8A45FC                  mov al, byte ptr [ebp-04]
:0045DFFC 8BE5                    mov esp, ebp
:0045DFFE 5D                      pop ebp
:0045DFFF C20400                  ret 0004



* Referenced by a CALL at Address:
|:0045F31F   
|
:0045E002 55                      push ebp
:0045E003 8BEC                    mov ebp, esp
:0045E005 83EC08                  sub esp, 00000008
:0045E008 894DF8                  mov dword ptr [ebp-08], ecx
:0045E00B FF1584634800            call dword ptr [00486384]
:0045E011 3905E85F4B00            cmp dword ptr [004B5FE8], eax
:0045E017 7511                    jne 0045E02A
:0045E019 8B4508                  mov eax, dword ptr [ebp+08]
:0045E01C 50                      push eax
:0045E01D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045E020 E817FFFFFF              call 0045DF3C
:0045E025 8845FC                  mov byte ptr [ebp-04], al
:0045E028 EB04                    jmp 0045E02E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E017(C)
|
:0045E02A C645FCFF                mov [ebp-04], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E028(U)
|
:0045E02E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045E031 81E1FF000000            and ecx, 000000FF
:0045E037 8B55F8                  mov edx, dword ptr [ebp-08]
:0045E03A 33C0                    xor eax, eax
:0045E03C 8A8204010000            mov al, byte ptr [edx+00000104]
:0045E042 3BC8                    cmp ecx, eax
:0045E044 7414                    je 0045E05A
:0045E046 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045E049 8A55FC                  mov dl, byte ptr [ebp-04]
:0045E04C 889104010000            mov byte ptr [ecx+00000104], dl
:0045E052 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045E055 E89F030000              call 0045E3F9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E044(C)
|
:0045E05A 8A45FC                  mov al, byte ptr [ebp-04]
:0045E05D 8BE5                    mov esp, ebp
:0045E05F 5D                      pop ebp
:0045E060 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0045F3A6   , :0045F3C5   
|
:0045E063 55                      push ebp
:0045E064 8BEC                    mov ebp, esp
:0045E066 83EC08                  sub esp, 00000008
:0045E069 894DF8                  mov dword ptr [ebp-08], ecx
:0045E06C FF1584634800            call dword ptr [00486384]
:0045E072 3905E85F4B00            cmp dword ptr [004B5FE8], eax
:0045E078 7517                    jne 0045E091
:0045E07A 8B4508                  mov eax, dword ptr [ebp+08]
:0045E07D 50                      push eax
:0045E07E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045E081 E8B6FEFFFF              call 0045DF3C
:0045E086 8845FC                  mov byte ptr [ebp-04], al
:0045E089 FF1580634800            call dword ptr [00486380]
:0045E08F EB04                    jmp 0045E095

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E078(C)
|
:0045E091 C645FCFF                mov [ebp-04], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E08F(U)
|
:0045E095 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045E098 81E1FF000000            and ecx, 000000FF
:0045E09E 83F902                  cmp ecx, 00000002
:0045E0A1 0F8D86000000            jnl 0045E12D
:0045E0A7 8B55F8                  mov edx, dword ptr [ebp-08]
:0045E0AA C68204010000FF          mov byte ptr [edx+00000104], FF
:0045E0B1 8B45FC                  mov eax, dword ptr [ebp-04]
:0045E0B4 25FF000000              and eax, 000000FF
:0045E0B9 83F801                  cmp eax, 00000001
:0045E0BC 7540                    jne 0045E0FE
:0045E0BE 833DA8E3480002          cmp dword ptr [0048E3A8], 00000002
:0045E0C5 7C37                    jl 0045E0FE
:0045E0C7 833DA8E3480006          cmp dword ptr [0048E3A8], 00000006
:0045E0CE 7D2E                    jge 0045E0FE
:0045E0D0 8B0DA8E34800            mov ecx, dword ptr [0048E3A8]
:0045E0D6 83C101                  add ecx, 00000001
:0045E0D9 890DA8E34800            mov dword ptr [0048E3A8], ecx
:0045E0DF 833DA8E3480006          cmp dword ptr [0048E3A8], 00000006
:0045E0E6 7C0A                    jl 0045E0F2
:0045E0E8 C705A8E3480002000000    mov dword ptr [0048E3A8], 00000002

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E0E6(C)
|
:0045E0F2 8B15A8E34800            mov edx, dword ptr [0048E3A8]
:0045E0F8 8915B4E34800            mov dword ptr [0048E3B4], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045E0BC(C), :0045E0C5(C), :0045E0CE(C)
|
:0045E0FE 8B45FC                  mov eax, dword ptr [ebp-04]
:0045E101 25FF000000              and eax, 000000FF
:0045E106 8B0C85B0E34800          mov ecx, dword ptr [4*eax+0048E3B0]
:0045E10D 890DA8E34800            mov dword ptr [0048E3A8], ecx
:0045E113 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045E116 E8B5160000              call 0045F7D0
:0045E11B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045E11E E8F4F0FFFF              call 0045D217
:0045E123 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045E126 E8CE020000              call 0045E3F9
:0045E12B EB22                    jmp 0045E14F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E0A1(C)
|
:0045E12D 8B55F8                  mov edx, dword ptr [ebp-08]
:0045E130 33C0                    xor eax, eax
:0045E132 8A8204010000            mov al, byte ptr [edx+00000104]
:0045E138 83F802                  cmp eax, 00000002
:0045E13B 7D12                    jge 0045E14F
:0045E13D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045E140 C68104010000FF          mov byte ptr [ecx+00000104], FF
:0045E147 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045E14A E8AA020000              call 0045E3F9

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045E12B(U), :0045E13B(C)
|
:0045E14F 8A45FC                  mov al, byte ptr [ebp-04]
:0045E152 8BE5                    mov esp, ebp
:0045E154 5D                      pop ebp
:0045E155 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0045E5F3   , :0045E617   , :0045E63D   
|
:0045E158 55                      push ebp
:0045E159 8BEC                    mov ebp, esp
:0045E15B 83EC18                  sub esp, 00000018
:0045E15E 894DE8                  mov dword ptr [ebp-18], ecx
:0045E161 C745F800000000          mov [ebp-08], 00000000
:0045E168 C745FC00000000          mov [ebp-04], 00000000
:0045E16F 837D1400                cmp dword ptr [ebp+14], 00000000
:0045E173 0F84F3000000            je 0045E26C
:0045E179 6A00                    push 00000000
:0045E17B E8702E0200              call 00480FF0
:0045E180 83C404                  add esp, 00000004
:0045E183 8945F4                  mov dword ptr [ebp-0C], eax
:0045E186 6880050000              push 00000580
:0045E18B E8502E0200              call 00480FE0
:0045E190 83C404                  add esp, 00000004
:0045E193 8945F8                  mov dword ptr [ebp-08], eax
:0045E196 6880050000              push 00000580
:0045E19B E8402E0200              call 00480FE0
:0045E1A0 83C404                  add esp, 00000004
:0045E1A3 8945FC                  mov dword ptr [ebp-04], eax
:0045E1A6 8B45F4                  mov eax, dword ptr [ebp-0C]
:0045E1A9 50                      push eax
:0045E1AA E8412E0200              call 00480FF0
:0045E1AF 83C404                  add esp, 00000004
:0045E1B2 837DF800                cmp dword ptr [ebp-08], 00000000
:0045E1B6 0F84B0000000            je 0045E26C
:0045E1BC 837DFC00                cmp dword ptr [ebp-04], 00000000
:0045E1C0 0F84A6000000            je 0045E26C
:0045E1C6 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045E1C9 51                      push ecx
:0045E1CA 6A10                    push 00000010
:0045E1CC 6A58                    push 00000058
:0045E1CE 8B5508                  mov edx, dword ptr [ebp+08]
:0045E1D1 81E2FF000000            and edx, 000000FF
:0045E1D7 C1E204                  shl edx, 04
:0045E1DA 8B829C674800            mov eax, dword ptr [edx+0048679C]
:0045E1E0 50                      push eax
:0045E1E1 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045E1E4 81E1FF000000            and ecx, 000000FF
:0045E1EA C1E104                  shl ecx, 04
:0045E1ED 8B9198674800            mov edx, dword ptr [ecx+00486798]
:0045E1F3 52                      push edx
:0045E1F4 E858000200              call 0047E251
:0045E1F9 83C414                  add esp, 00000014
:0045E1FC 8B45FC                  mov eax, dword ptr [ebp-04]
:0045E1FF 50                      push eax
:0045E200 6A10                    push 00000010
:0045E202 6A58                    push 00000058
:0045E204 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045E207 81E1FF000000            and ecx, 000000FF
:0045E20D C1E104                  shl ecx, 04
:0045E210 8B919C674800            mov edx, dword ptr [ecx+0048679C]
:0045E216 83C204                  add edx, 00000004
:0045E219 52                      push edx
:0045E21A 8B4508                  mov eax, dword ptr [ebp+08]
:0045E21D 25FF000000              and eax, 000000FF
:0045E222 C1E004                  shl eax, 04
:0045E225 8B8898674800            mov ecx, dword ptr [eax+00486798]
:0045E22B 83C102                  add ecx, 00000002
:0045E22E 51                      push ecx
:0045E22F E81D000200              call 0047E251
:0045E234 83C414                  add esp, 00000014
:0045E237 8B55FC                  mov edx, dword ptr [ebp-04]
:0045E23A 52                      push edx
:0045E23B 6A10                    push 00000010
:0045E23D 6A58                    push 00000058
:0045E23F 8B4508                  mov eax, dword ptr [ebp+08]
:0045E242 25FF000000              and eax, 000000FF
:0045E247 C1E004                  shl eax, 04
:0045E24A 8B889C674800            mov ecx, dword ptr [eax+0048679C]
:0045E250 51                      push ecx
:0045E251 8B5508                  mov edx, dword ptr [ebp+08]
:0045E254 81E2FF000000            and edx, 000000FF
:0045E25A C1E204                  shl edx, 04
:0045E25D 8B8298674800            mov eax, dword ptr [edx+00486798]
:0045E263 50                      push eax
:0045E264 E832FE0100              call 0047E09B
:0045E269 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045E173(C), :0045E1B6(C), :0045E1C0(C)
|
:0045E26C 6A00                    push 00000000
:0045E26E 6A1F                    push 0000001F
:0045E270 6A00                    push 00000000
:0045E272 E87AEF0100              call 0047D1F1
:0045E277 83C40C                  add esp, 0000000C
:0045E27A 6A04                    push 00000004
:0045E27C B9382F4900              mov ecx, 00492F38
:0045E281 E8B00AFBFF              call 0040ED36
:0045E286 6A00                    push 00000000
:0045E288 B9382F4900              mov ecx, 00492F38
:0045E28D E8780AFBFF              call 0040ED0A
:0045E292 8B4D10                  mov ecx, dword ptr [ebp+10]
:0045E295 81E1FF000000            and ecx, 000000FF
:0045E29B 51                      push ecx
:0045E29C B9382F4900              mov ecx, 00492F38
:0045E2A1 E8DE09FBFF              call 0040EC84
:0045E2A6 8B5508                  mov edx, dword ptr [ebp+08]
:0045E2A9 81E2FF000000            and edx, 000000FF
:0045E2AF C1E204                  shl edx, 04
:0045E2B2 8B829C674800            mov eax, dword ptr [edx+0048679C]
:0045E2B8 50                      push eax
:0045E2B9 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045E2BC 81E1FF000000            and ecx, 000000FF
:0045E2C2 C1E104                  shl ecx, 04
:0045E2C5 8B8198674800            mov eax, dword ptr [ecx+00486798]
:0045E2CB 83C004                  add eax, 00000004
:0045E2CE 99                      cdq
:0045E2CF 83E207                  and edx, 00000007
:0045E2D2 03C2                    add eax, edx
:0045E2D4 C1F803                  sar eax, 03
:0045E2D7 50                      push eax
:0045E2D8 B9382F4900              mov ecx, 00492F38
:0045E2DD E8F508FBFF              call 0040EBD7
:0045E2E2 8B550C                  mov edx, dword ptr [ebp+0C]
:0045E2E5 52                      push edx
:0045E2E6 68382F4900              push 00492F38
:0045E2EB E8B017FBFF              call 0040FAA0
:0045E2F0 83C408                  add esp, 00000008
:0045E2F3 6A12                    push 00000012
:0045E2F5 B9382F4900              mov ecx, 00492F38
:0045E2FA E88509FBFF              call 0040EC84
:0045E2FF 837D1400                cmp dword ptr [ebp+14], 00000000
:0045E303 0F84BA000000            je 0045E3C3
:0045E309 837DF800                cmp dword ptr [ebp-08], 00000000
:0045E30D 0F84B0000000            je 0045E3C3
:0045E313 837DFC00                cmp dword ptr [ebp-04], 00000000
:0045E317 0F84A6000000            je 0045E3C3
:0045E31D 8B45FC                  mov eax, dword ptr [ebp-04]
:0045E320 50                      push eax
:0045E321 6A10                    push 00000010
:0045E323 6A58                    push 00000058
:0045E325 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045E328 81E1FF000000            and ecx, 000000FF
:0045E32E C1E104                  shl ecx, 04
:0045E331 8B919C674800            mov edx, dword ptr [ecx+0048679C]
:0045E337 52                      push edx
:0045E338 8B4508                  mov eax, dword ptr [ebp+08]
:0045E33B 25FF000000              and eax, 000000FF
:0045E340 C1E004                  shl eax, 04
:0045E343 8B8898674800            mov ecx, dword ptr [eax+00486798]
:0045E349 51                      push ecx
:0045E34A E802FF0100              call 0047E251
:0045E34F 83C414                  add esp, 00000014
:0045E352 8B55F8                  mov edx, dword ptr [ebp-08]
:0045E355 52                      push edx
:0045E356 6A10                    push 00000010
:0045E358 6A58                    push 00000058
:0045E35A 8B4508                  mov eax, dword ptr [ebp+08]
:0045E35D 25FF000000              and eax, 000000FF
:0045E362 C1E004                  shl eax, 04
:0045E365 8B889C674800            mov ecx, dword ptr [eax+0048679C]
:0045E36B 51                      push ecx
:0045E36C 8B5508                  mov edx, dword ptr [ebp+08]
:0045E36F 81E2FF000000            and edx, 000000FF
:0045E375 C1E204                  shl edx, 04
:0045E378 8B8298674800            mov eax, dword ptr [edx+00486798]
:0045E37E 50                      push eax
:0045E37F E817FD0100              call 0047E09B
:0045E384 83C414                  add esp, 00000014
:0045E387 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045E38A 51                      push ecx
:0045E38B 6A10                    push 00000010
:0045E38D 6A58                    push 00000058
:0045E38F 8B5508                  mov edx, dword ptr [ebp+08]
:0045E392 81E2FF000000            and edx, 000000FF
:0045E398 C1E204                  shl edx, 04
:0045E39B 8B829C674800            mov eax, dword ptr [edx+0048679C]
:0045E3A1 83C004                  add eax, 00000004
:0045E3A4 50                      push eax
:0045E3A5 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045E3A8 81E1FF000000            and ecx, 000000FF
:0045E3AE C1E104                  shl ecx, 04
:0045E3B1 8B9198674800            mov edx, dword ptr [ecx+00486798]
:0045E3B7 83C202                  add edx, 00000002
:0045E3BA 52                      push edx
:0045E3BB E8DBFC0100              call 0047E09B
:0045E3C0 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045E303(C), :0045E30D(C), :0045E317(C)
|
:0045E3C3 837DF800                cmp dword ptr [ebp-08], 00000000
:0045E3C7 7412                    je 0045E3DB
:0045E3C9 8B45F8                  mov eax, dword ptr [ebp-08]
:0045E3CC 8945F0                  mov dword ptr [ebp-10], eax
:0045E3CF 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0045E3D2 51                      push ecx
:0045E3D3 E8482C0200              call 00481020
:0045E3D8 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E3C7(C)
|
:0045E3DB 837DF800                cmp dword ptr [ebp-08], 00000000
:0045E3DF 7412                    je 0045E3F3
:0045E3E1 8B55FC                  mov edx, dword ptr [ebp-04]
:0045E3E4 8955EC                  mov dword ptr [ebp-14], edx
:0045E3E7 8B45EC                  mov eax, dword ptr [ebp-14]
:0045E3EA 50                      push eax
:0045E3EB E8302C0200              call 00481020
:0045E3F0 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E3DF(C)
|
:0045E3F3 8BE5                    mov esp, ebp
:0045E3F5 5D                      pop ebp
:0045E3F6 C21000                  ret 0010



* Referenced by a CALL at Addresses:
|:0045DFF4   , :0045E055   , :0045E126   , :0045E14A   , :0045E959   
|
:0045E3F9 55                      push ebp
:0045E3FA 8BEC                    mov ebp, esp
:0045E3FC 83EC70                  sub esp, 00000070
:0045E3FF 56                      push esi
:0045E400 894D90                  mov dword ptr [ebp-70], ecx

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0045E403 6A07                    push 00000007
:0045E405 E8D9E60100              call 0047CAE3
:0045E40A 83C404                  add esp, 00000004
:0045E40D E8C901FCFF              call 0041E5DB
:0045E412 6A04                    push 00000004
:0045E414 6A00                    push 00000000
:0045E416 6A00                    push 00000000
:0045E418 8B4D90                  mov ecx, dword ptr [ebp-70]
:0045E41B 83C174                  add ecx, 00000074
:0045E41E E81D160200              call 0047FA40
:0045E423 50                      push eax
:0045E424 6A2A                    push 0000002A
:0045E426 6A5A                    push 0000005A
:0045E428 68F4000000              push 000000F4
:0045E42D 682C010000              push 0000012C
:0045E432 E864FC0100              call 0047E09B
:0045E437 83C414                  add esp, 00000014
:0045E43A 687C5F4B00              push 004B5F7C
:0045E43F 8D4598                  lea eax, dword ptr [ebp-68]
:0045E442 50                      push eax
:0045E443 E8DA1F0200              call 00480422
:0045E448 83C408                  add esp, 00000008
:0045E44B 6890674800              push 00486790
:0045E450 68B86A4800              push 00486AB8

* Possible StringData Ref from Data Obj ->"%s%s"
                                  |
:0045E455 6874E44800              push 0048E474
:0045E45A 8D4DA3                  lea ecx, dword ptr [ebp-5D]
:0045E45D 51                      push ecx
:0045E45E E8BF1F0200              call 00480422
:0045E463 83C410                  add esp, 00000010
:0045E466 C745E402000000          mov [ebp-1C], 00000002
:0045E46D EB09                    jmp 0045E478

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E561(U)
|
:0045E46F 8B55E4                  mov edx, dword ptr [ebp-1C]
:0045E472 83C201                  add edx, 00000001
:0045E475 8955E4                  mov dword ptr [ebp-1C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E46D(U)
|
:0045E478 837DE406                cmp dword ptr [ebp-1C], 00000006
:0045E47C 0F8DE4000000            jnl 0045E566
:0045E482 6890674800              push 00486790
:0045E487 E8342F0200              call 004813C0
:0045E48C 83C404                  add esp, 00000004
:0045E48F BE0A000000              mov esi, 0000000A
:0045E494 2BF0                    sub esi, eax
:0045E496 8B45E4                  mov eax, dword ptr [ebp-1C]
:0045E499 8B0C85B0674800          mov ecx, dword ptr [4*eax+004867B0]
:0045E4A0 51                      push ecx
:0045E4A1 E81A2F0200              call 004813C0
:0045E4A6 83C404                  add esp, 00000004
:0045E4A9 2BF0                    sub esi, eax
:0045E4AB 83EE01                  sub esi, 00000001
:0045E4AE D1EE                    shr esi, 1
:0045E4B0 8975DC                  mov dword ptr [ebp-24], esi
:0045E4B3 6890674800              push 00486790
:0045E4B8 E8032F0200              call 004813C0
:0045E4BD 83C404                  add esp, 00000004
:0045E4C0 BE0A000000              mov esi, 0000000A
:0045E4C5 2BF0                    sub esi, eax
:0045E4C7 8B55E4                  mov edx, dword ptr [ebp-1C]
:0045E4CA 8B0495B0674800          mov eax, dword ptr [4*edx+004867B0]
:0045E4D1 50                      push eax
:0045E4D2 E8E92E0200              call 004813C0
:0045E4D7 83C404                  add esp, 00000004
:0045E4DA 2BF0                    sub esi, eax
:0045E4DC 83EE02                  sub esi, 00000002
:0045E4DF 2B75DC                  sub esi, dword ptr [ebp-24]
:0045E4E2 8975E0                  mov dword ptr [ebp-20], esi
:0045E4E5 C7459400000000          mov [ebp-6C], 00000000
:0045E4EC EB09                    jmp 0045E4F7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E52F(U)
|
:0045E4EE 8B4D94                  mov ecx, dword ptr [ebp-6C]
:0045E4F1 83C101                  add ecx, 00000001
:0045E4F4 894D94                  mov dword ptr [ebp-6C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E4EC(U)
|
:0045E4F7 837D9402                cmp dword ptr [ebp-6C], 00000002
:0045E4FB 7D34                    jge 0045E531
:0045E4FD 8B5594                  mov edx, dword ptr [ebp-6C]
:0045E500 8B4495DC                mov eax, dword ptr [ebp+4*edx-24]
:0045E504 50                      push eax
:0045E505 6A20                    push 00000020
:0045E507 8B4D94                  mov ecx, dword ptr [ebp-6C]
:0045E50A 6BC90A                  imul ecx, 0000000A
:0045E50D 8D540DEC                lea edx, dword ptr [ebp+ecx-14]
:0045E511 52                      push edx
:0045E512 E819260200              call 00480B30
:0045E517 83C40C                  add esp, 0000000C
:0045E51A 8B4594                  mov eax, dword ptr [ebp-6C]
:0045E51D 6BC00A                  imul eax, 0000000A
:0045E520 8D4C05EC                lea ecx, dword ptr [ebp+eax-14]
:0045E524 8B5594                  mov edx, dword ptr [ebp-6C]
:0045E527 8B4495DC                mov eax, dword ptr [ebp+4*edx-24]
:0045E52B C6040100                mov byte ptr [ecx+eax], 00
:0045E52F EBBD                    jmp 0045E4EE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E4FB(C)
|
:0045E531 6890674800              push 00486790
:0045E536 8D4DF6                  lea ecx, dword ptr [ebp-0A]
:0045E539 51                      push ecx
:0045E53A 8B55E4                  mov edx, dword ptr [ebp-1C]
:0045E53D 8B0495B0674800          mov eax, dword ptr [4*edx+004867B0]
:0045E544 50                      push eax
:0045E545 8D4DEC                  lea ecx, dword ptr [ebp-14]
:0045E548 51                      push ecx

* Possible StringData Ref from Data Obj ->"<%s%s%s>%s"
                                  |
:0045E549 687CE44800              push 0048E47C
:0045E54E 8B55E4                  mov edx, dword ptr [ebp-1C]
:0045E551 6BD20B                  imul edx, 0000000B
:0045E554 8D441598                lea eax, dword ptr [ebp+edx-68]
:0045E558 50                      push eax
:0045E559 E8C41E0200              call 00480422
:0045E55E 83C418                  add esp, 00000018
:0045E561 E909FFFFFF              jmp 0045E46F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E47C(C)
|
:0045E566 6A04                    push 00000004
:0045E568 6A00                    push 00000000
:0045E56A 6A00                    push 00000000
:0045E56C 8B4D90                  mov ecx, dword ptr [ebp-70]
:0045E56F 83C174                  add ecx, 00000074
:0045E572 E8C9140200              call 0047FA40
:0045E577 50                      push eax
:0045E578 6A2A                    push 0000002A
:0045E57A 6A5A                    push 0000005A
:0045E57C 68F4000000              push 000000F4
:0045E581 682C010000              push 0000012C
:0045E586 E810FB0100              call 0047E09B
:0045E58B 83C414                  add esp, 00000014
:0045E58E C745E400000000          mov [ebp-1C], 00000000
:0045E595 EB09                    jmp 0045E5A0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E642(U)
|
:0045E597 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0045E59A 83C101                  add ecx, 00000001
:0045E59D 894DE4                  mov dword ptr [ebp-1C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E595(U)
|
:0045E5A0 837DE402                cmp dword ptr [ebp-1C], 00000002
:0045E5A4 0F8D9D000000            jnl 0045E647
:0045E5AA 8B55E4                  mov edx, dword ptr [ebp-1C]
:0045E5AD 8B0495B0E34800          mov eax, dword ptr [4*edx+0048E3B0]
:0045E5B4 3B05A8E34800            cmp eax, dword ptr [0048E3A8]
:0045E5BA 7506                    jne 0045E5C2
:0045E5BC C645E812                mov [ebp-18], 12
:0045E5C0 EB04                    jmp 0045E5C6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E5BA(C)
|
:0045E5C2 C645E818                mov [ebp-18], 18

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E5C0(U)
|
:0045E5C6 8B4D90                  mov ecx, dword ptr [ebp-70]
:0045E5C9 33D2                    xor edx, edx
:0045E5CB 8A9104010000            mov dl, byte ptr [ecx+00000104]
:0045E5D1 3955E4                  cmp dword ptr [ebp-1C], edx
:0045E5D4 7448                    je 0045E61E
:0045E5D6 6A01                    push 00000001
:0045E5D8 6A1F                    push 0000001F
:0045E5DA 8B45E4                  mov eax, dword ptr [ebp-1C]
:0045E5DD 8B0C85B0E34800          mov ecx, dword ptr [4*eax+0048E3B0]
:0045E5E4 6BC90B                  imul ecx, 0000000B
:0045E5E7 8D540D98                lea edx, dword ptr [ebp+ecx-68]
:0045E5EB 52                      push edx
:0045E5EC 8A45E4                  mov al, byte ptr [ebp-1C]
:0045E5EF 50                      push eax
:0045E5F0 8B4D90                  mov ecx, dword ptr [ebp-70]
:0045E5F3 E860FBFFFF              call 0045E158
:0045E5F8 6A00                    push 00000000
:0045E5FA 8A4DE8                  mov cl, byte ptr [ebp-18]
:0045E5FD 51                      push ecx
:0045E5FE 8B55E4                  mov edx, dword ptr [ebp-1C]
:0045E601 8B0495B0E34800          mov eax, dword ptr [4*edx+0048E3B0]
:0045E608 6BC00B                  imul eax, 0000000B
:0045E60B 8D4C0598                lea ecx, dword ptr [ebp+eax-68]
:0045E60F 51                      push ecx
:0045E610 8A55E4                  mov dl, byte ptr [ebp-1C]
:0045E613 52                      push edx
:0045E614 8B4D90                  mov ecx, dword ptr [ebp-70]
:0045E617 E83CFBFFFF              call 0045E158
:0045E61C EB24                    jmp 0045E642

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E5D4(C)
|
:0045E61E 6A01                    push 00000001
:0045E620 8A45E8                  mov al, byte ptr [ebp-18]
:0045E623 50                      push eax
:0045E624 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0045E627 8B148DB0E34800          mov edx, dword ptr [4*ecx+0048E3B0]
:0045E62E 6BD20B                  imul edx, 0000000B
:0045E631 8D441598                lea eax, dword ptr [ebp+edx-68]
:0045E635 50                      push eax
:0045E636 8A4DE4                  mov cl, byte ptr [ebp-1C]
:0045E639 51                      push ecx
:0045E63A 8B4D90                  mov ecx, dword ptr [ebp-70]
:0045E63D E816FBFFFF              call 0045E158

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E61C(U)
|
:0045E642 E950FFFFFF              jmp 0045E597

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E5A4(C)
|
:0045E647 E8AAFFFBFF              call 0041E5F6
:0045E64C 6A00                    push 00000000
:0045E64E E890E40100              call 0047CAE3
:0045E653 83C404                  add esp, 00000004
:0045E656 5E                      pop esi
:0045E657 8BE5                    mov esp, ebp
:0045E659 5D                      pop ebp
:0045E65A C3                      ret


:0045E65B 55                      push ebp
:0045E65C 8BEC                    mov ebp, esp
:0045E65E E807000000              call 0045E66A
:0045E663 E811000000              call 0045E679
:0045E668 5D                      pop ebp
:0045E669 C3                      ret



* Referenced by a CALL at Address:
|:0045E65E   
|
:0045E66A 55                      push ebp
:0045E66B 8BEC                    mov ebp, esp
:0045E66D B9985E4B00              mov ecx, 004B5E98
:0045E672 E839100000              call 0045F6B0
:0045E677 5D                      pop ebp
:0045E678 C3                      ret



* Referenced by a CALL at Address:
|:0045E663   
|
:0045E679 55                      push ebp
:0045E67A 8BEC                    mov ebp, esp
:0045E67C 688BE64500              push 0045E68B
:0045E681 E87A2A0200              call 00481100
:0045E686 83C404                  add esp, 00000004
:0045E689 5D                      pop ebp
:0045E68A C3                      ret


:0045E68B 55                      push ebp
:0045E68C 8BEC                    mov ebp, esp
:0045E68E B9985E4B00              mov ecx, 004B5E98
:0045E693 E888100000              call 0045F720
:0045E698 5D                      pop ebp
:0045E699 C3                      ret



* Referenced by a CALL at Addresses:
|:004340D3   , :0043E139   
|
:0045E69A 55                      push ebp
:0045E69B 8BEC                    mov ebp, esp
:0045E69D B9985E4B00              mov ecx, 004B5E98
:0045E6A2 E85ED5FFFF              call 0045BC05
:0045E6A7 B9BC5E4B00              mov ecx, 004B5EBC
:0045E6AC E8FFDBFBFF              call 0041C2B0
:0045E6B1 5D                      pop ebp
:0045E6B2 C3                      ret



* Referenced by a CALL at Address:
|:004187E0   
|
:0045E6B3 55                      push ebp
:0045E6B4 8BEC                    mov ebp, esp
:0045E6B6 6AFF                    push FFFFFFFF
:0045E6B8 68F1564800              push 004856F1
:0045E6BD 64A100000000            mov eax, dword ptr fs:[00000000]
:0045E6C3 50                      push eax
:0045E6C4 64892500000000          mov dword ptr fs:[00000000], esp
:0045E6CB 83EC28                  sub esp, 00000028
:0045E6CE C745E800000000          mov [ebp-18], 00000000
:0045E6D5 6A00                    push 00000000
:0045E6D7 E814290200              call 00480FF0
:0045E6DC 83C404                  add esp, 00000004
:0045E6DF 8945F0                  mov dword ptr [ebp-10], eax
:0045E6E2 6814020000              push 00000214
:0045E6E7 E8F4280200              call 00480FE0
:0045E6EC 83C404                  add esp, 00000004
:0045E6EF 8945E0                  mov dword ptr [ebp-20], eax
:0045E6F2 C745FC00000000          mov [ebp-04], 00000000
:0045E6F9 837DE000                cmp dword ptr [ebp-20], 00000000
:0045E6FD 740D                    je 0045E70C
:0045E6FF 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0045E702 E866D7FFFF              call 0045BE6D
:0045E707 8945D0                  mov dword ptr [ebp-30], eax
:0045E70A EB07                    jmp 0045E713

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E6FD(C)
|
:0045E70C C745D000000000          mov [ebp-30], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E70A(U)
|
:0045E713 8B45D0                  mov eax, dword ptr [ebp-30]
:0045E716 8945DC                  mov dword ptr [ebp-24], eax
:0045E719 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0045E720 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0045E723 890D845E4B00            mov dword ptr [004B5E84], ecx
:0045E729 8B55F0                  mov edx, dword ptr [ebp-10]
:0045E72C 52                      push edx
:0045E72D E8BE280200              call 00480FF0
:0045E732 83C404                  add esp, 00000004
:0045E735 833D845E4B0000          cmp dword ptr [004B5E84], 00000000
:0045E73C 751F                    jne 0045E75D
:0045E73E 6A30                    push 00000030

* Possible StringData Ref from Data Obj ->"ѡ佫"
                                  |
:0045E740 6888E44800              push 0048E488

* Possible StringData Ref from Data Obj ->"ѡ佫׼δɡ"
                                  |
:0045E745 6898E44800              push 0048E498
:0045E74A A1686A4B00              mov eax, dword ptr [004B6A68]
:0045E74F 50                      push eax
:0045E750 FF15C4624800            call dword ptr [004862C4]
:0045E756 33C0                    xor eax, eax
:0045E758 E912010000              jmp 0045E86F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E73C(C)
|
:0045E75D C745E800000000          mov [ebp-18], 00000000
:0045E764 EB09                    jmp 0045E76F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E783(U)
|
:0045E766 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0045E769 83C101                  add ecx, 00000001
:0045E76C 894DE8                  mov dword ptr [ebp-18], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E764(U)
|
:0045E76F 837DE81F                cmp dword ptr [ebp-18], 0000001F
:0045E773 7310                    jnb 0045E785
:0045E775 8B55E8                  mov edx, dword ptr [ebp-18]
:0045E778 C70495085E4B0000000000  mov dword ptr [4*edx+004B5E08], 00000000
:0045E783 EBE1                    jmp 0045E766

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E773(C)
|
:0045E785 8B4510                  mov eax, dword ptr [ebp+10]
:0045E788 50                      push eax
:0045E789 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0045E78C 51                      push ecx
:0045E78D 8B5508                  mov edx, dword ptr [ebp+08]
:0045E790 52                      push edx
:0045E791 8B0D845E4B00            mov ecx, dword ptr [004B5E84]
:0045E797 E87DD9FFFF              call 0045C119
:0045E79C 6A00                    push 00000000
:0045E79E 687DE84500              push 0045E87D
:0045E7A3 A1686A4B00              mov eax, dword ptr [004B6A68]
:0045E7A8 50                      push eax

* Possible Reference to Dialog: DialogID_00EC 
                                  |
:0045E7A9 68EC000000              push 000000EC
:0045E7AE 8B0D606A4B00            mov ecx, dword ptr [004B6A60]
:0045E7B4 51                      push ecx
:0045E7B5 FF15A0624800            call dword ptr [004862A0]
:0045E7BB C645E400                mov [ebp-1C], 00
:0045E7BF EB09                    jmp 0045E7CA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E834(U)
|
:0045E7C1 8A55E4                  mov dl, byte ptr [ebp-1C]
:0045E7C4 80C201                  add dl, 01
:0045E7C7 8855E4                  mov byte ptr [ebp-1C], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E7BF(U)
|
:0045E7CA 8B45E4                  mov eax, dword ptr [ebp-1C]
:0045E7CD 25FF000000              and eax, 000000FF
:0045E7D2 83F80F                  cmp eax, 0000000F
:0045E7D5 7D5F                    jge 0045E836
:0045E7D7 8A4DE4                  mov cl, byte ptr [ebp-1C]
:0045E7DA 51                      push ecx
:0045E7DB 8B0D845E4B00            mov ecx, dword ptr [004B5E84]
:0045E7E1 E8AA0F0000              call 0045F790
:0045E7E6 8845EC                  mov byte ptr [ebp-14], al
:0045E7E9 8B55EC                  mov edx, dword ptr [ebp-14]
:0045E7EC 81E2FF000000            and edx, 000000FF
:0045E7F2 81FAFF000000            cmp edx, 000000FF
:0045E7F8 7426                    je 0045E820
:0045E7FA 8B45EC                  mov eax, dword ptr [ebp-14]
:0045E7FD 25FF000000              and eax, 000000FF
:0045E802 50                      push eax
:0045E803 8B0D845E4B00            mov ecx, dword ptr [004B5E84]
:0045E809 E822100000              call 0045F830
:0045E80E 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0045E811 81E1FF000000            and ecx, 000000FF
:0045E817 89048D085E4B00          mov dword ptr [4*ecx+004B5E08], eax
:0045E81E EB14                    jmp 0045E834

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E7F8(C)
|
:0045E820 8B55E4                  mov edx, dword ptr [ebp-1C]
:0045E823 81E2FF000000            and edx, 000000FF
:0045E829 C70495085E4B0000000000  mov dword ptr [4*edx+004B5E08], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E81E(U)
|
:0045E834 EB8B                    jmp 0045E7C1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E7D5(C)
|
:0045E836 C705445E4B0000000000    mov dword ptr [004B5E44], 00000000
:0045E840 A1845E4B00              mov eax, dword ptr [004B5E84]
:0045E845 8945D4                  mov dword ptr [ebp-2C], eax
:0045E848 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0045E84B 894DD8                  mov dword ptr [ebp-28], ecx
:0045E84E 837DD800                cmp dword ptr [ebp-28], 00000000
:0045E852 740F                    je 0045E863
:0045E854 6A01                    push 00000001
:0045E856 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0045E859 E8220E0000              call 0045F680
:0045E85E 8945CC                  mov dword ptr [ebp-34], eax
:0045E861 EB07                    jmp 0045E86A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E852(C)
|
:0045E863 C745CC00000000          mov [ebp-34], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E861(U)
|
:0045E86A B8085E4B00              mov eax, 004B5E08

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E758(U)
|
:0045E86F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0045E872 64890D00000000          mov dword ptr fs:[00000000], ecx
:0045E879 8BE5                    mov esp, ebp
:0045E87B 5D                      pop ebp
:0045E87C C3                      ret


:0045E87D 55                      push ebp
:0045E87E 8BEC                    mov ebp, esp
:0045E880 51                      push ecx
:0045E881 8B450C                  mov eax, dword ptr [ebp+0C]
:0045E884 8945FC                  mov dword ptr [ebp-04], eax
:0045E887 817DFC10010000          cmp dword ptr [ebp-04], 00000110
:0045E88E 7718                    ja 0045E8A8
:0045E890 817DFC10010000          cmp dword ptr [ebp-04], 00000110
:0045E897 747E                    je 0045E917
:0045E899 837DFC2B                cmp dword ptr [ebp-04], 0000002B
:0045E89D 0F84E4010000            je 0045EA87
:0045E8A3 E9EF010000              jmp 0045EA97

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E88E(C)
|
:0045E8A8 817DFC35010000          cmp dword ptr [ebp-04], 00000135
:0045E8AF 771F                    ja 0045E8D0
:0045E8B1 817DFC35010000          cmp dword ptr [ebp-04], 00000135
:0045E8B8 0F847B010000            je 0045EA39
:0045E8BE 817DFC11010000          cmp dword ptr [ebp-04], 00000111
:0045E8C5 0F84B5000000            je 0045E980
:0045E8CB E9C7010000              jmp 0045EA97

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E8AF(C)
|
:0045E8D0 817DFC0F030000          cmp dword ptr [ebp-04], 0000030F
:0045E8D7 772C                    ja 0045E905
:0045E8D9 817DFC0F030000          cmp dword ptr [ebp-04], 0000030F
:0045E8E0 0F8481010000            je 0045EA67
:0045E8E6 817DFC36010000          cmp dword ptr [ebp-04], 00000136
:0045E8ED 0F845E010000            je 0045EA51
:0045E8F3 817DFC38010000          cmp dword ptr [ebp-04], 00000138
:0045E8FA 0F8410010000            je 0045EA10
:0045E900 E992010000              jmp 0045EA97

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E8D7(C)
|
:0045E905 817DFC11030000          cmp dword ptr [ebp-04], 00000311
:0045E90C 0F8463010000            je 0045EA75
:0045E912 E980010000              jmp 0045EA97

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E897(C)
|
:0045E917 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045E91A 51                      push ecx
:0045E91B E87F010000              call 0045EA9F
:0045E920 83C404                  add esp, 00000004
:0045E923 8B5508                  mov edx, dword ptr [ebp+08]
:0045E926 52                      push edx
:0045E927 8B0D845E4B00            mov ecx, dword ptr [004B5E84]
:0045E92D E8F6DBFFFF              call 0045C528
:0045E932 8B0D845E4B00            mov ecx, dword ptr [004B5E84]
:0045E938 E8B8F1FFFF              call 0045DAF5
:0045E93D 8B0D845E4B00            mov ecx, dword ptr [004B5E84]
:0045E943 E8CFE8FFFF              call 0045D217
:0045E948 8B0D845E4B00            mov ecx, dword ptr [004B5E84]
:0045E94E E8CDE4FFFF              call 0045CE20
:0045E953 8B0D845E4B00            mov ecx, dword ptr [004B5E84]
:0045E959 E89BFAFFFF              call 0045E3F9
:0045E95E 8B0D845E4B00            mov ecx, dword ptr [004B5E84]
:0045E964 E82EDDFFFF              call 0045C697
:0045E969 A1686A4B00              mov eax, dword ptr [004B6A68]
:0045E96E 50                      push eax
:0045E96F 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045E972 51                      push ecx
:0045E973 E82E3A0000              call 004623A6
:0045E978 83C408                  add esp, 00000008
:0045E97B E917010000              jmp 0045EA97

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E8C5(C)
|
:0045E980 8B5510                  mov edx, dword ptr [ebp+10]
:0045E983 81E2FFFF0000            and edx, 0000FFFF
:0045E989 83FA01                  cmp edx, 00000001
:0045E98C 7537                    jne 0045E9C5
:0045E98E 6A02                    push 00000002
:0045E990 B9181B4B00              mov ecx, 004B1B18
:0045E995 E8A649FAFF              call 00403340
:0045E99A E841DBFCFF              call 0042C4E0
:0045E99F 6A01                    push 00000001
:0045E9A1 6A05                    push 00000005
:0045E9A3 B9B0694B00              mov ecx, 004B69B0
:0045E9A8 E8CD5C0100              call 0047467A
:0045E9AD 8B4508                  mov eax, dword ptr [ebp+08]
:0045E9B0 50                      push eax
:0045E9B1 E82A070000              call 0045F0E0
:0045E9B6 83C404                  add esp, 00000004
:0045E9B9 6A00                    push 00000000
:0045E9BB 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045E9BE 51                      push ecx
:0045E9BF FF15D4624800            call dword ptr [004862D4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E98C(C)
|
:0045E9C5 8B5510                  mov edx, dword ptr [ebp+10]
:0045E9C8 81E2FFFF0000            and edx, 0000FFFF
:0045E9CE 83FA02                  cmp edx, 00000002
:0045E9D1 7538                    jne 0045EA0B
:0045E9D3 68FF000000              push 000000FF
:0045E9D8 8B0D845E4B00            mov ecx, dword ptr [004B5E84]
:0045E9DE E8A2D6FFFF              call 0045C085
:0045E9E3 8B0D845E4B00            mov ecx, dword ptr [004B5E84]
:0045E9E9 E806EEFFFF              call 0045D7F4
:0045E9EE 8B4508                  mov eax, dword ptr [ebp+08]
:0045E9F1 50                      push eax
:0045E9F2 E8E9060000              call 0045F0E0
:0045E9F7 83C404                  add esp, 00000004
:0045E9FA E8C17E0100              call 004768C0
:0045E9FF 6A00                    push 00000000
:0045EA01 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045EA04 51                      push ecx
:0045EA05 FF15D4624800            call dword ptr [004862D4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E9D1(C)
|
:0045EA0B E987000000              jmp 0045EA97

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E8FA(C)
|
:0045EA10 6A00                    push 00000000
:0045EA12 6A01                    push 00000001
:0045EA14 8B5514                  mov edx, dword ptr [ebp+14]
:0045EA17 52                      push edx
:0045EA18 8B4510                  mov eax, dword ptr [ebp+10]
:0045EA1B 50                      push eax
:0045EA1C E86A2B0100              call 0047158B
:0045EA21 83C410                  add esp, 00000010
:0045EA24 8B4D14                  mov ecx, dword ptr [ebp+14]
:0045EA27 51                      push ecx
:0045EA28 8B5510                  mov edx, dword ptr [ebp+10]
:0045EA2B 52                      push edx
:0045EA2C 8B0D845E4B00            mov ecx, dword ptr [004B5E84]
:0045EA32 E8F7E9FFFF              call 0045D42E
:0045EA37 EB5E                    jmp 0045EA97

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E8B8(C)
|
:0045EA39 6A00                    push 00000000
:0045EA3B 6A00                    push 00000000
:0045EA3D 6A01                    push 00000001
:0045EA3F 8B4514                  mov eax, dword ptr [ebp+14]
:0045EA42 50                      push eax
:0045EA43 8B4D10                  mov ecx, dword ptr [ebp+10]
:0045EA46 51                      push ecx
:0045EA47 E8352F0100              call 00471981
:0045EA4C 83C414                  add esp, 00000014
:0045EA4F EB46                    jmp 0045EA97

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E8ED(C)
|
:0045EA51 6A00                    push 00000000
:0045EA53 6A01                    push 00000001
:0045EA55 8B5514                  mov edx, dword ptr [ebp+14]
:0045EA58 52                      push edx
:0045EA59 8B4510                  mov eax, dword ptr [ebp+10]
:0045EA5C 50                      push eax
:0045EA5D E829280100              call 0047128B
:0045EA62 83C410                  add esp, 00000010
:0045EA65 EB30                    jmp 0045EA97

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E8E0(C)
|
:0045EA67 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045EA6A 51                      push ecx
:0045EA6B E8BB3A0100              call 0047252B
:0045EA70 83C404                  add esp, 00000004
:0045EA73 EB22                    jmp 0045EA97

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E90C(C)
|
:0045EA75 8B5510                  mov edx, dword ptr [ebp+10]
:0045EA78 52                      push edx
:0045EA79 8B4508                  mov eax, dword ptr [ebp+08]
:0045EA7C 50                      push eax
:0045EA7D E8FC3A0100              call 0047257E
:0045EA82 83C408                  add esp, 00000008
:0045EA85 EB10                    jmp 0045EA97

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E89D(C)
|
:0045EA87 6A00                    push 00000000
:0045EA89 6A01                    push 00000001
:0045EA8B 8B4D14                  mov ecx, dword ptr [ebp+14]
:0045EA8E 51                      push ecx
:0045EA8F E84A350100              call 00471FDE
:0045EA94 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045E8A3(U), :0045E8CB(U), :0045E900(U), :0045E912(U), :0045E97B(U)
|:0045EA0B(U), :0045EA37(U), :0045EA4F(U), :0045EA65(U), :0045EA73(U)
|:0045EA85(U)
|
:0045EA97 33C0                    xor eax, eax
:0045EA99 8BE5                    mov esp, ebp
:0045EA9B 5D                      pop ebp
:0045EA9C C21000                  ret 0010



* Referenced by a CALL at Address:
|:0045E91B   
|
:0045EA9F 55                      push ebp
:0045EAA0 8BEC                    mov ebp, esp
:0045EAA2 6AFF                    push FFFFFFFF
:0045EAA4 6807574800              push 00485707
:0045EAA9 64A100000000            mov eax, dword ptr fs:[00000000]
:0045EAAF 50                      push eax
:0045EAB0 64892500000000          mov dword ptr fs:[00000000], esp
:0045EAB7 81EC2C010000            sub esp, 0000012C
:0045EABD 6A00                    push 00000000
:0045EABF A1E85F4B00              mov eax, dword ptr [004B5FE8]
:0045EAC4 50                      push eax
:0045EAC5 FF15E0624800            call dword ptr [004862E0]
:0045EACB 8D8DC8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEC8]
:0045EAD1 51                      push ecx
:0045EAD2 8B5508                  mov edx, dword ptr [ebp+08]
:0045EAD5 52                      push edx
:0045EAD6 FF15EC624800            call dword ptr [004862EC]
:0045EADC A16C684800              mov eax, dword ptr [0048686C]
:0045EAE1 8B0D5C684800            mov ecx, dword ptr [0048685C]
:0045EAE7 8D540104                lea edx, dword ptr [ecx+eax+04]
:0045EAEB 8B85D4FEFFFF            mov eax, dword ptr [ebp+FFFFFED4]
:0045EAF1 2BC2                    sub eax, edx
:0045EAF3 8945F0                  mov dword ptr [ebp-10], eax
:0045EAF6 8D8DC8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEC8]
:0045EAFC 51                      push ecx
:0045EAFD 686C050000              push 0000056C
:0045EB02 8B5508                  mov edx, dword ptr [ebp+08]
:0045EB05 52                      push edx
:0045EB06 FF15DC624800            call dword ptr [004862DC]
:0045EB0C 50                      push eax
:0045EB0D FF15EC624800            call dword ptr [004862EC]
:0045EB13 8B45F0                  mov eax, dword ptr [ebp-10]
:0045EB16 2B85CCFEFFFF            sub eax, dword ptr [ebp+FFFFFECC]
:0045EB1C 8945F0                  mov dword ptr [ebp-10], eax
:0045EB1F 686C050000              push 0000056C
:0045EB24 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045EB27 51                      push ecx
:0045EB28 FF15DC624800            call dword ptr [004862DC]
:0045EB2E 8985E4FEFFFF            mov dword ptr [ebp+FFFFFEE4], eax
:0045EB34 8D95C8FEFFFF            lea edx, dword ptr [ebp+FFFFFEC8]
:0045EB3A 52                      push edx
:0045EB3B 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:0045EB41 50                      push eax
:0045EB42 FF15EC624800            call dword ptr [004862EC]
:0045EB48 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:0045EB4E 2B8DCCFEFFFF            sub ecx, dword ptr [ebp+FFFFFECC]
:0045EB54 8B55F0                  mov edx, dword ptr [ebp-10]
:0045EB57 2BD1                    sub edx, ecx
:0045EB59 8955F0                  mov dword ptr [ebp-10], edx
:0045EB5C 33C0                    xor eax, eax
:0045EB5E 837DF000                cmp dword ptr [ebp-10], 00000000
:0045EB62 0F9CC0                  setl al
:0045EB65 48                      dec eax
:0045EB66 2345F0                  and eax, dword ptr [ebp-10]
:0045EB69 8945F0                  mov dword ptr [ebp-10], eax
:0045EB6C 683F040000              push 0000043F
:0045EB71 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045EB74 51                      push ecx
:0045EB75 FF15DC624800            call dword ptr [004862DC]
:0045EB7B 8985E4FEFFFF            mov dword ptr [ebp+FFFFFEE4], eax
:0045EB81 8D95C8FEFFFF            lea edx, dword ptr [ebp+FFFFFEC8]
:0045EB87 52                      push edx
:0045EB88 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:0045EB8E 50                      push eax
:0045EB8F E8D62F0000              call 00461B6A
:0045EB94 83C408                  add esp, 00000008
:0045EB97 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:0045EB9D 0385C8FEFFFF            add eax, dword ptr [ebp+FFFFFEC8]
:0045EBA3 2B0558684800            sub eax, dword ptr [00486858]
:0045EBA9 83E802                  sub eax, 00000002
:0045EBAC 99                      cdq
:0045EBAD 2BC2                    sub eax, edx
:0045EBAF D1F8                    sar eax, 1
:0045EBB1 8985DCFEFFFF            mov dword ptr [ebp+FFFFFEDC], eax
:0045EBB7 8B45F0                  mov eax, dword ptr [ebp-10]
:0045EBBA 99                      cdq
:0045EBBB 2BC2                    sub eax, edx
:0045EBBD D1F8                    sar eax, 1
:0045EBBF 8985D8FEFFFF            mov dword ptr [ebp+FFFFFED8], eax
:0045EBC5 6A00                    push 00000000
:0045EBC7 8B0D5C684800            mov ecx, dword ptr [0048685C]
:0045EBCD 83C102                  add ecx, 00000002
:0045EBD0 51                      push ecx
:0045EBD1 8B1558684800            mov edx, dword ptr [00486858]
:0045EBD7 83C202                  add edx, 00000002
:0045EBDA 52                      push edx
:0045EBDB 8B85D8FEFFFF            mov eax, dword ptr [ebp+FFFFFED8]
:0045EBE1 50                      push eax
:0045EBE2 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:0045EBE8 51                      push ecx
:0045EBE9 8B95E4FEFFFF            mov edx, dword ptr [ebp+FFFFFEE4]
:0045EBEF 52                      push edx
:0045EBF0 FF15BC624800            call dword ptr [004862BC]

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0045EBF6 6A07                    push 00000007
:0045EBF8 E8E6DE0100              call 0047CAE3
:0045EBFD 83C404                  add esp, 00000004

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0045EC00 6A07                    push 00000007
:0045EC02 E8C3E50100              call 0047D1CA
:0045EC07 83C404                  add esp, 00000004
:0045EC0A 6A00                    push 00000000
:0045EC0C 6A1F                    push 0000001F
:0045EC0E 6A00                    push 00000000
:0045EC10 E8DCE50100              call 0047D1F1
:0045EC15 83C40C                  add esp, 0000000C
:0045EC18 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0045EC1E E88D46FAFF              call 004032B0
:0045EC23 C745FC00000000          mov [ebp-04], 00000000

* Possible StringData Ref from Data Obj ->"U_SELECT.E5"
                                  |
:0045EC2A 6888BB4800              push 0048BB88
:0045EC2F 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0045EC35 E8FB0EFCFF              call 0041FB35
:0045EC3A 6A04                    push 00000004
:0045EC3C 6A00                    push 00000000
:0045EC3E 6800B80B00              push 000BB800
:0045EC43 B980AB4A00              mov ecx, 004AAB80
:0045EC48 E8F30D0200              call 0047FA40
:0045EC4D 50                      push eax
:0045EC4E 6A03                    push 00000003
:0045EC50 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0045EC56 E82E10FCFF              call 0041FC89
:0045EC5B 6A04                    push 00000004
:0045EC5D 6A00                    push 00000000
:0045EC5F 6800B80B00              push 000BB800
:0045EC64 B980AB4A00              mov ecx, 004AAB80
:0045EC69 E8D20D0200              call 0047FA40
:0045EC6E 50                      push eax
:0045EC6F A15C684800              mov eax, dword ptr [0048685C]
:0045EC74 50                      push eax
:0045EC75 8B0D58684800            mov ecx, dword ptr [00486858]
:0045EC7B 51                      push ecx
:0045EC7C 6A00                    push 00000000
:0045EC7E 6A00                    push 00000000
:0045EC80 E816F40100              call 0047E09B
:0045EC85 83C414                  add esp, 00000014
:0045EC88 8B95E4FEFFFF            mov edx, dword ptr [ebp+FFFFFEE4]
:0045EC8E 52                      push edx
:0045EC8F A1E85F4B00              mov eax, dword ptr [004B5FE8]
:0045EC94 50                      push eax
:0045EC95 FF157C634800            call dword ptr [0048637C]
:0045EC9B 85C0                    test eax, eax
:0045EC9D 7516                    jne 0045ECB5
:0045EC9F 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"Err"
                                  |
:0045ECA1 68B8E44800              push 0048E4B8

* Possible StringData Ref from Data Obj ->"Err"
                                  |
:0045ECA6 68BCE44800              push 0048E4BC
:0045ECAB 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045ECAE 51                      push ecx
:0045ECAF FF15C4624800            call dword ptr [004862C4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045EC9D(C)
|
:0045ECB5 6A00                    push 00000000
:0045ECB7 8B155C684800            mov edx, dword ptr [0048685C]
:0045ECBD 52                      push edx
:0045ECBE A158684800              mov eax, dword ptr [00486858]
:0045ECC3 50                      push eax
:0045ECC4 6A00                    push 00000000
:0045ECC6 6A00                    push 00000000
:0045ECC8 8B0DE85F4B00            mov ecx, dword ptr [004B5FE8]
:0045ECCE 51                      push ecx
:0045ECCF FF15BC624800            call dword ptr [004862BC]
:0045ECD5 8B155C684800            mov edx, dword ptr [0048685C]
:0045ECDB 8B85D8FEFFFF            mov eax, dword ptr [ebp+FFFFFED8]
:0045ECE1 8D4C1002                lea ecx, dword ptr [eax+edx+02]
:0045ECE5 898DD8FEFFFF            mov dword ptr [ebp+FFFFFED8], ecx
:0045ECEB 686C050000              push 0000056C
:0045ECF0 8B5508                  mov edx, dword ptr [ebp+08]
:0045ECF3 52                      push edx
:0045ECF4 FF15DC624800            call dword ptr [004862DC]
:0045ECFA 8985E4FEFFFF            mov dword ptr [ebp+FFFFFEE4], eax
:0045ED00 8D85C8FEFFFF            lea eax, dword ptr [ebp+FFFFFEC8]
:0045ED06 50                      push eax
:0045ED07 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:0045ED0D 51                      push ecx
:0045ED0E FF15EC624800            call dword ptr [004862EC]
:0045ED14 6A00                    push 00000000
:0045ED16 8B95D4FEFFFF            mov edx, dword ptr [ebp+FFFFFED4]
:0045ED1C 52                      push edx
:0045ED1D 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:0045ED23 50                      push eax
:0045ED24 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:0045ED2A 51                      push ecx
:0045ED2B 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:0045ED31 52                      push edx
:0045ED32 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:0045ED38 50                      push eax
:0045ED39 FF15BC624800            call dword ptr [004862BC]
:0045ED3F 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:0045ED45 038DD4FEFFFF            add ecx, dword ptr [ebp+FFFFFED4]
:0045ED4B 898DD8FEFFFF            mov dword ptr [ebp+FFFFFED8], ecx
:0045ED51 6841040000              push 00000441
:0045ED56 8B5508                  mov edx, dword ptr [ebp+08]
:0045ED59 52                      push edx
:0045ED5A FF15DC624800            call dword ptr [004862DC]
:0045ED60 8985E4FEFFFF            mov dword ptr [ebp+FFFFFEE4], eax
:0045ED66 8D85C8FEFFFF            lea eax, dword ptr [ebp+FFFFFEC8]
:0045ED6C 50                      push eax
:0045ED6D 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:0045ED73 51                      push ecx
:0045ED74 FF15EC624800            call dword ptr [004862EC]
:0045ED7A 6A00                    push 00000000
:0045ED7C 8B156C684800            mov edx, dword ptr [0048686C]
:0045ED82 83C202                  add edx, 00000002
:0045ED85 52                      push edx
:0045ED86 A168684800              mov eax, dword ptr [00486868]
:0045ED8B 83C002                  add eax, 00000002
:0045ED8E 50                      push eax
:0045ED8F 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:0045ED95 51                      push ecx
:0045ED96 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:0045ED9C 52                      push edx
:0045ED9D 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:0045EDA3 50                      push eax
:0045EDA4 FF15BC624800            call dword ptr [004862BC]
:0045EDAA 6A08                    push 00000008
:0045EDAC E832DD0100              call 0047CAE3
:0045EDB1 83C404                  add esp, 00000004

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0045EDB4 6A07                    push 00000007
:0045EDB6 E80FE40100              call 0047D1CA
:0045EDBB 83C404                  add esp, 00000004
:0045EDBE 6A00                    push 00000000
:0045EDC0 6A1F                    push 0000001F
:0045EDC2 6A00                    push 00000000
:0045EDC4 E828E40100              call 0047D1F1
:0045EDC9 83C40C                  add esp, 0000000C
:0045EDCC 6A04                    push 00000004
:0045EDCE 6A00                    push 00000000
:0045EDD0 6800B80B00              push 000BB800
:0045EDD5 B980AB4A00              mov ecx, 004AAB80
:0045EDDA E8610C0200              call 0047FA40
:0045EDDF 50                      push eax
:0045EDE0 6A04                    push 00000004
:0045EDE2 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0045EDE8 E89C0EFCFF              call 0041FC89
:0045EDED 6A04                    push 00000004
:0045EDEF 6A00                    push 00000000
:0045EDF1 6800B80B00              push 000BB800
:0045EDF6 B980AB4A00              mov ecx, 004AAB80
:0045EDFB E8400C0200              call 0047FA40
:0045EE00 50                      push eax
:0045EE01 8B0D6C684800            mov ecx, dword ptr [0048686C]
:0045EE07 51                      push ecx
:0045EE08 8B1568684800            mov edx, dword ptr [00486868]
:0045EE0E 52                      push edx
:0045EE0F 6A00                    push 00000000
:0045EE11 6A00                    push 00000000
:0045EE13 E883F20100              call 0047E09B
:0045EE18 83C414                  add esp, 00000014
:0045EE1B 6A00                    push 00000000
:0045EE1D 6A1F                    push 0000001F
:0045EE1F 6A04                    push 00000004
:0045EE21 E8CBE30100              call 0047D1F1
:0045EE26 83C40C                  add esp, 0000000C
:0045EE29 C785E0FEFFFF00000000    mov dword ptr [ebp+FFFFFEE0], 00000000
:0045EE33 EB0F                    jmp 0045EE44

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045EE81(U)
|
:0045EE35 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:0045EE3B 83C001                  add eax, 00000001
:0045EE3E 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045EE33(U)
|
:0045EE44 83BDE0FEFFFF02          cmp dword ptr [ebp+FFFFFEE0], 00000002
:0045EE4B 7736                    ja 0045EE83
:0045EE4D 6A04                    push 00000004
:0045EE4F 6A00                    push 00000000
:0045EE51 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:0045EE57 69C9800C0000            imul ecx, 00000C80
:0045EE5D 81C100B80B00            add ecx, 000BB800
:0045EE63 51                      push ecx
:0045EE64 B980AB4A00              mov ecx, 004AAB80
:0045EE69 E8D20B0200              call 0047FA40
:0045EE6E 50                      push eax
:0045EE6F 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:0045EE75 52                      push edx
:0045EE76 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0045EE7C E8080EFCFF              call 0041FC89
:0045EE81 EBB2                    jmp 0045EE35

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045EE4B(C)
|
:0045EE83 C785E0FEFFFF00000000    mov dword ptr [ebp+FFFFFEE0], 00000000
:0045EE8D EB0F                    jmp 0045EE9E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045EF6D(U)
|
:0045EE8F 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:0045EE95 83C001                  add eax, 00000001
:0045EE98 8985E0FEFFFF            mov dword ptr [ebp+FFFFFEE0], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045EE8D(U)
|
:0045EE9E 8B0D845E4B00            mov ecx, dword ptr [004B5E84]
:0045EEA4 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:0045EEAA 3B910C010000            cmp edx, dword ptr [ecx+0000010C]
:0045EEB0 0F83BC000000            jnb 0045EF72
:0045EEB6 A1845E4B00              mov eax, dword ptr [004B5E84]
:0045EEBB 8B8DE0FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE0]
:0045EEC1 3B8810010000            cmp ecx, dword ptr [eax+00000110]
:0045EEC7 731B                    jnb 0045EEE4
:0045EEC9 6A04                    push 00000004
:0045EECB 6A00                    push 00000000
:0045EECD 6800D10B00              push 000BD100
:0045EED2 B980AB4A00              mov ecx, 004AAB80
:0045EED7 E8640B0200              call 0047FA40
:0045EEDC 8985E8FEFFFF            mov dword ptr [ebp+FFFFFEE8], eax
:0045EEE2 EB53                    jmp 0045EF37

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045EEC7(C)
|
:0045EEE4 8B15845E4B00            mov edx, dword ptr [004B5E84]
:0045EEEA 8B820C010000            mov eax, dword ptr [edx+0000010C]
:0045EEF0 D1E0                    shl eax, 1
:0045EEF2 33D2                    xor edx, edx
:0045EEF4 B903000000              mov ecx, 00000003
:0045EEF9 F7F1                    div ecx
:0045EEFB 3985E0FEFFFF            cmp dword ptr [ebp+FFFFFEE0], eax
:0045EF01 731B                    jnb 0045EF1E
:0045EF03 6A04                    push 00000004
:0045EF05 6A00                    push 00000000
:0045EF07 6880C40B00              push 000BC480
:0045EF0C B980AB4A00              mov ecx, 004AAB80
:0045EF11 E82A0B0200              call 0047FA40
:0045EF16 8985E8FEFFFF            mov dword ptr [ebp+FFFFFEE8], eax
:0045EF1C EB19                    jmp 0045EF37

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045EF01(C)
|
:0045EF1E 6A04                    push 00000004
:0045EF20 6A00                    push 00000000
:0045EF22 6800B80B00              push 000BB800
:0045EF27 B980AB4A00              mov ecx, 004AAB80
:0045EF2C E80F0B0200              call 0047FA40
:0045EF31 8985E8FEFFFF            mov dword ptr [ebp+FFFFFEE8], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045EEE2(U), :0045EF1C(U)
|
:0045EF37 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:0045EF3D 52                      push edx
:0045EF3E 6A32                    push 00000032
:0045EF40 6A32                    push 00000032
:0045EF42 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:0045EF48 C1E803                  shr eax, 03
:0045EF4B C1E006                  shl eax, 06
:0045EF4E 83C00D                  add eax, 0000000D
:0045EF51 50                      push eax
:0045EF52 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:0045EF58 33D2                    xor edx, edx
:0045EF5A B908000000              mov ecx, 00000008
:0045EF5F F7F1                    div ecx
:0045EF61 6BD232                  imul edx, 00000032
:0045EF64 52                      push edx
:0045EF65 E831F10100              call 0047E09B
:0045EF6A 83C414                  add esp, 00000014
:0045EF6D E91DFFFFFF              jmp 0045EE8F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045EEB0(C)
|
:0045EF72 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0045EF78 E848A3FBFF              call 004192C5
:0045EF7D 8B95E4FEFFFF            mov edx, dword ptr [ebp+FFFFFEE4]
:0045EF83 52                      push edx
:0045EF84 A1EC5F4B00              mov eax, dword ptr [004B5FEC]
:0045EF89 50                      push eax
:0045EF8A FF157C634800            call dword ptr [0048637C]
:0045EF90 85C0                    test eax, eax
:0045EF92 7516                    jne 0045EFAA
:0045EF94 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"Err"
                                  |
:0045EF96 68C0E44800              push 0048E4C0

* Possible StringData Ref from Data Obj ->"Err"
                                  |
:0045EF9B 68C4E44800              push 0048E4C4
:0045EFA0 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045EFA3 51                      push ecx
:0045EFA4 FF15C4624800            call dword ptr [004862C4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045EF92(C)
|
:0045EFAA 6A00                    push 00000000
:0045EFAC 8B156C684800            mov edx, dword ptr [0048686C]
:0045EFB2 52                      push edx
:0045EFB3 A168684800              mov eax, dword ptr [00486868]
:0045EFB8 50                      push eax
:0045EFB9 6A00                    push 00000000
:0045EFBB 6A00                    push 00000000
:0045EFBD 8B0DEC5F4B00            mov ecx, dword ptr [004B5FEC]
:0045EFC3 51                      push ecx
:0045EFC4 FF15BC624800            call dword ptr [004862BC]
:0045EFCA 6A00                    push 00000000
:0045EFCC E812DB0100              call 0047CAE3
:0045EFD1 83C404                  add esp, 00000004
:0045EFD4 6A05                    push 00000005
:0045EFD6 8B15E85F4B00            mov edx, dword ptr [004B5FE8]
:0045EFDC 52                      push edx
:0045EFDD FF15E0624800            call dword ptr [004862E0]
:0045EFE3 6A05                    push 00000005
:0045EFE5 A1EC5F4B00              mov eax, dword ptr [004B5FEC]
:0045EFEA 50                      push eax
:0045EFEB FF15E0624800            call dword ptr [004862E0]
:0045EFF1 6834040000              push 00000434
:0045EFF6 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045EFF9 51                      push ecx
:0045EFFA FF15DC624800            call dword ptr [004862DC]
:0045F000 50                      push eax
:0045F001 8B150C604B00            mov edx, dword ptr [004B600C]
:0045F007 52                      push edx
:0045F008 FF157C634800            call dword ptr [0048637C]
:0045F00E 8D85C8FEFFFF            lea eax, dword ptr [ebp+FFFFFEC8]
:0045F014 50                      push eax
:0045F015 6834040000              push 00000434
:0045F01A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045F01D 51                      push ecx
:0045F01E FF15DC624800            call dword ptr [004862DC]
:0045F024 50                      push eax
:0045F025 E8402B0000              call 00461B6A
:0045F02A 83C408                  add esp, 00000008
:0045F02D 6A0C                    push 0000000C
:0045F02F 8B15EC684800            mov edx, dword ptr [004868EC]
:0045F035 83C202                  add edx, 00000002
:0045F038 52                      push edx
:0045F039 A1E8684800              mov eax, dword ptr [004868E8]
:0045F03E 83C002                  add eax, 00000002
:0045F041 50                      push eax
:0045F042 8B8DD4FEFFFF            mov ecx, dword ptr [ebp+FFFFFED4]
:0045F048 8B95CCFEFFFF            mov edx, dword ptr [ebp+FFFFFECC]
:0045F04E 8D440AFE                lea eax, dword ptr [edx+ecx-02]
:0045F052 2B05EC684800            sub eax, dword ptr [004868EC]
:0045F058 99                      cdq
:0045F059 2BC2                    sub eax, edx
:0045F05B D1F8                    sar eax, 1
:0045F05D 50                      push eax
:0045F05E 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:0045F064 8B8DC8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC8]
:0045F06A 8D4401FE                lea eax, dword ptr [ecx+eax-02]
:0045F06E 2B05E8684800            sub eax, dword ptr [004868E8]
:0045F074 99                      cdq
:0045F075 2BC2                    sub eax, edx
:0045F077 D1F8                    sar eax, 1
:0045F079 50                      push eax
:0045F07A 6A00                    push 00000000
:0045F07C 6834040000              push 00000434
:0045F081 8B5508                  mov edx, dword ptr [ebp+08]
:0045F084 52                      push edx
:0045F085 FF15DC624800            call dword ptr [004862DC]
:0045F08B 50                      push eax
:0045F08C FF1580624800            call dword ptr [00486280]
:0045F092 6A00                    push 00000000
:0045F094 A1EC684800              mov eax, dword ptr [004868EC]
:0045F099 50                      push eax
:0045F09A 8B0DE8684800            mov ecx, dword ptr [004868E8]
:0045F0A0 51                      push ecx
:0045F0A1 6A00                    push 00000000
:0045F0A3 6A00                    push 00000000
:0045F0A5 8B150C604B00            mov edx, dword ptr [004B600C]
:0045F0AB 52                      push edx
:0045F0AC FF15BC624800            call dword ptr [004862BC]
:0045F0B2 6A05                    push 00000005
:0045F0B4 A10C604B00              mov eax, dword ptr [004B600C]
:0045F0B9 50                      push eax
:0045F0BA FF15E0624800            call dword ptr [004862E0]
:0045F0C0 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0045F0C7 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0045F0CD E8FE41FAFF              call 004032D0
:0045F0D2 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0045F0D5 64890D00000000          mov dword ptr fs:[00000000], ecx
:0045F0DC 8BE5                    mov esp, ebp
:0045F0DE 5D                      pop ebp
:0045F0DF C3                      ret



* Referenced by a CALL at Addresses:
|:0045E9B1   , :0045E9F2   
|
:0045F0E0 55                      push ebp
:0045F0E1 8BEC                    mov ebp, esp
:0045F0E3 6A00                    push 00000000
:0045F0E5 A1E85F4B00              mov eax, dword ptr [004B5FE8]
:0045F0EA 50                      push eax
:0045F0EB FF15E0624800            call dword ptr [004862E0]

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0045F0F1 6A07                    push 00000007
:0045F0F3 E8EBD90100              call 0047CAE3
:0045F0F8 83C404                  add esp, 00000004
:0045F0FB E840E20100              call 0047D340
:0045F100 6A00                    push 00000000
:0045F102 6A1F                    push 0000001F
:0045F104 6A00                    push 00000000
:0045F106 E8E6E00100              call 0047D1F1
:0045F10B 83C40C                  add esp, 0000000C
:0045F10E 6A00                    push 00000000
:0045F110 E8CED90100              call 0047CAE3
:0045F115 83C404                  add esp, 00000004
:0045F118 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:0045F11E 51                      push ecx
:0045F11F 8B15E85F4B00            mov edx, dword ptr [004B5FE8]
:0045F125 52                      push edx
:0045F126 FF157C634800            call dword ptr [0048637C]
:0045F12C 6A00                    push 00000000
:0045F12E A1EC5F4B00              mov eax, dword ptr [004B5FEC]
:0045F133 50                      push eax
:0045F134 FF15E0624800            call dword ptr [004862E0]
:0045F13A 6A08                    push 00000008
:0045F13C E8A2D90100              call 0047CAE3
:0045F141 83C404                  add esp, 00000004
:0045F144 E8F7E10100              call 0047D340
:0045F149 6A00                    push 00000000
:0045F14B 6A1F                    push 0000001F
:0045F14D 6A00                    push 00000000
:0045F14F E89DE00100              call 0047D1F1
:0045F154 83C40C                  add esp, 0000000C
:0045F157 6A00                    push 00000000
:0045F159 E885D90100              call 0047CAE3
:0045F15E 83C404                  add esp, 00000004
:0045F161 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:0045F167 51                      push ecx
:0045F168 8B15EC5F4B00            mov edx, dword ptr [004B5FEC]
:0045F16E 52                      push edx
:0045F16F FF157C634800            call dword ptr [0048637C]
:0045F175 6A00                    push 00000000
:0045F177 A10C604B00              mov eax, dword ptr [004B600C]
:0045F17C 50                      push eax
:0045F17D FF15E0624800            call dword ptr [004862E0]
:0045F183 6A10                    push 00000010
:0045F185 E859D90100              call 0047CAE3
:0045F18A 83C404                  add esp, 00000004
:0045F18D E8AEE10100              call 0047D340
:0045F192 6A00                    push 00000000
:0045F194 6A1F                    push 0000001F
:0045F196 6A00                    push 00000000
:0045F198 E854E00100              call 0047D1F1
:0045F19D 83C40C                  add esp, 0000000C
:0045F1A0 6A00                    push 00000000
:0045F1A2 E83CD90100              call 0047CAE3
:0045F1A7 83C404                  add esp, 00000004
:0045F1AA 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:0045F1B0 51                      push ecx
:0045F1B1 8B150C604B00            mov edx, dword ptr [004B600C]
:0045F1B7 52                      push edx
:0045F1B8 FF157C634800            call dword ptr [0048637C]
:0045F1BE B950424B00              mov ecx, 004B4250
:0045F1C3 E8A36CFFFF              call 00455E6B
:0045F1C8 83C007                  add eax, 00000007
:0045F1CB 99                      cdq
:0045F1CC B930000000              mov ecx, 00000030
:0045F1D1 F7F9                    idiv ecx
:0045F1D3 6BC030                  imul eax, 00000030
:0045F1D6 83C028                  add eax, 00000028
:0045F1D9 50                      push eax
:0045F1DA B950424B00              mov ecx, 004B4250
:0045F1DF E8606CFFFF              call 00455E44
:0045F1E4 83C02F                  add eax, 0000002F
:0045F1E7 99                      cdq
:0045F1E8 B930000000              mov ecx, 00000030
:0045F1ED F7F9                    idiv ecx
:0045F1EF 6BC030                  imul eax, 00000030
:0045F1F2 50                      push eax
:0045F1F3 6A28                    push 00000028
:0045F1F5 6A00                    push 00000000
:0045F1F7 E885E00100              call 0047D281
:0045F1FC 83C410                  add esp, 00000010
:0045F1FF 5D                      pop ebp
:0045F200 C3                      ret


:0045F201 55                      push ebp
:0045F202 8BEC                    mov ebp, esp
:0045F204 83EC28                  sub esp, 00000028
:0045F207 8B450C                  mov eax, dword ptr [ebp+0C]
:0045F20A 8945D8                  mov dword ptr [ebp-28], eax
:0045F20D 817DD800020000          cmp dword ptr [ebp-28], 00000200
:0045F214 771B                    ja 0045F231
:0045F216 817DD800020000          cmp dword ptr [ebp-28], 00000200
:0045F21D 0F8484000000            je 0045F2A7
:0045F223 817DD811010000          cmp dword ptr [ebp-28], 00000111
:0045F22A 742D                    je 0045F259
:0045F22C E9AF010000              jmp 0045F3E0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045F214(C)
|
:0045F231 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0045F234 81E901020000            sub ecx, 00000201
:0045F23A 894DD8                  mov dword ptr [ebp-28], ecx
:0045F23D 837DD814                cmp dword ptr [ebp-28], 00000014
:0045F241 0F8799010000            ja 0045F3E0
:0045F247 8B45D8                  mov eax, dword ptr [ebp-28]
:0045F24A 33D2                    xor edx, edx
:0045F24C 8A9012F44500            mov dl, byte ptr [eax+0045F412]
:0045F252 FF2495FEF34500          jmp dword ptr [4*edx+0045F3FE]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045F22A(C)
|
:0045F259 8B4D14                  mov ecx, dword ptr [ebp+14]
:0045F25C 51                      push ecx
:0045F25D 8B5510                  mov edx, dword ptr [ebp+10]
:0045F260 52                      push edx
:0045F261 8B450C                  mov eax, dword ptr [ebp+0C]
:0045F264 50                      push eax
:0045F265 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045F268 51                      push ecx
:0045F269 FF1578634800            call dword ptr [00486378]
:0045F26F E984010000              jmp 0045F3F8
:0045F274 8B5514                  mov edx, dword ptr [ebp+14]
:0045F277 81E2FFFF0000            and edx, 0000FFFF
:0045F27D 8955F8                  mov dword ptr [ebp-08], edx
:0045F280 8B4514                  mov eax, dword ptr [ebp+14]
:0045F283 C1E810                  shr eax, 10
:0045F286 25FFFF0000              and eax, 0000FFFF
:0045F28B 25FFFF0000              and eax, 0000FFFF
:0045F290 8945FC                  mov dword ptr [ebp-04], eax
:0045F293 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0045F296 51                      push ecx
:0045F297 8B0D845E4B00            mov ecx, dword ptr [004B5E84]
:0045F29D E804EDFFFF              call 0045DFA6
:0045F2A2 E939010000              jmp 0045F3E0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045F21D(C)
|
:0045F2A7 833D845E4B0000          cmp dword ptr [004B5E84], 00000000
:0045F2AE 7474                    je 0045F324
:0045F2B0 FF1584634800            call dword ptr [00486384]
:0045F2B6 3B4508                  cmp eax, dword ptr [ebp+08]
:0045F2B9 743B                    je 0045F2F6
:0045F2BB 8B5514                  mov edx, dword ptr [ebp+14]
:0045F2BE C1EA10                  shr edx, 10
:0045F2C1 81E2FFFF0000            and edx, 0000FFFF
:0045F2C7 81E2FFFF0000            and edx, 0000FFFF
:0045F2CD 52                      push edx
:0045F2CE 8B4514                  mov eax, dword ptr [ebp+14]
:0045F2D1 25FFFF0000              and eax, 0000FFFF
:0045F2D6 50                      push eax
:0045F2D7 8B0D845E4B00            mov ecx, dword ptr [004B5E84]
:0045F2DD E898D2FFFF              call 0045C57A
:0045F2E2 8845F4                  mov byte ptr [ebp-0C], al
:0045F2E5 8A4DF4                  mov cl, byte ptr [ebp-0C]
:0045F2E8 51                      push ecx
:0045F2E9 8B0D845E4B00            mov ecx, dword ptr [004B5E84]
:0045F2EF E8F5D7FFFF              call 0045CAE9
:0045F2F4 EB2E                    jmp 0045F324

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045F2B9(C)
|
:0045F2F6 8B5514                  mov edx, dword ptr [ebp+14]
:0045F2F9 81E2FFFF0000            and edx, 0000FFFF
:0045F2FF 8955EC                  mov dword ptr [ebp-14], edx
:0045F302 8B4514                  mov eax, dword ptr [ebp+14]
:0045F305 C1E810                  shr eax, 10
:0045F308 25FFFF0000              and eax, 0000FFFF
:0045F30D 25FFFF0000              and eax, 0000FFFF
:0045F312 8945F0                  mov dword ptr [ebp-10], eax
:0045F315 8D4DEC                  lea ecx, dword ptr [ebp-14]
:0045F318 51                      push ecx
:0045F319 8B0D845E4B00            mov ecx, dword ptr [004B5E84]
:0045F31F E8DEECFFFF              call 0045E002

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045F2AE(C), :0045F2F4(U)
|
:0045F324 E9B7000000              jmp 0045F3E0
:0045F329 833D845E4B0000          cmp dword ptr [004B5E84], 00000000
:0045F330 7479                    je 0045F3AB
:0045F332 FF1584634800            call dword ptr [00486384]
:0045F338 3B4508                  cmp eax, dword ptr [ebp+08]
:0045F33B 7440                    je 0045F37D
:0045F33D 8B0D845E4B00            mov ecx, dword ptr [004B5E84]
:0045F343 E80ACDFFFF              call 0045C052
:0045F348 8B0D845E4B00            mov ecx, dword ptr [004B5E84]
:0045F34E E85D040000              call 0045F7B0
:0045F353 25FF000000              and eax, 000000FF
:0045F358 3DFF000000              cmp eax, 000000FF
:0045F35D 741C                    je 0045F37B
:0045F35F 8B0D845E4B00            mov ecx, dword ptr [004B5E84]
:0045F365 E846040000              call 0045F7B0
:0045F36A 25FF000000              and eax, 000000FF
:0045F36F 50                      push eax
:0045F370 8B0D845E4B00            mov ecx, dword ptr [004B5E84]
:0045F376 E8E2E4FFFF              call 0045D85D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045F35D(C)
|
:0045F37B EB2E                    jmp 0045F3AB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045F33B(C)
|
:0045F37D 8B5514                  mov edx, dword ptr [ebp+14]
:0045F380 81E2FFFF0000            and edx, 0000FFFF
:0045F386 8955E4                  mov dword ptr [ebp-1C], edx
:0045F389 8B4514                  mov eax, dword ptr [ebp+14]
:0045F38C C1E810                  shr eax, 10
:0045F38F 25FFFF0000              and eax, 0000FFFF
:0045F394 25FFFF0000              and eax, 0000FFFF
:0045F399 8945E8                  mov dword ptr [ebp-18], eax
:0045F39C 8D4DE4                  lea ecx, dword ptr [ebp-1C]
:0045F39F 51                      push ecx
:0045F3A0 8B0D845E4B00            mov ecx, dword ptr [004B5E84]
:0045F3A6 E8B8ECFFFF              call 0045E063

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045F330(C), :0045F37B(U)
|
:0045F3AB EB33                    jmp 0045F3E0
:0045F3AD C745DCFFFFFFFF          mov [ebp-24], FFFFFFFF
:0045F3B4 C745E0FFFFFFFF          mov [ebp-20], FFFFFFFF
:0045F3BB 8D55DC                  lea edx, dword ptr [ebp-24]
:0045F3BE 52                      push edx
:0045F3BF 8B0D845E4B00            mov ecx, dword ptr [004B5E84]
:0045F3C5 E899ECFFFF              call 0045E063
:0045F3CA EB14                    jmp 0045F3E0
:0045F3CC 833D845E4B0000          cmp dword ptr [004B5E84], 00000000
:0045F3D3 740B                    je 0045F3E0
:0045F3D5 8B0D845E4B00            mov ecx, dword ptr [004B5E84]
:0045F3DB E8CFE3FFFF              call 0045D7AF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045F22C(U), :0045F241(C), :0045F2A2(U), :0045F324(U), :0045F3AB(U)
|:0045F3CA(U), :0045F3D3(C)
|
:0045F3E0 8B4514                  mov eax, dword ptr [ebp+14]
:0045F3E3 50                      push eax
:0045F3E4 8B4D10                  mov ecx, dword ptr [ebp+10]
:0045F3E7 51                      push ecx
:0045F3E8 8B550C                  mov edx, dword ptr [ebp+0C]
:0045F3EB 52                      push edx
:0045F3EC 8B4508                  mov eax, dword ptr [ebp+08]
:0045F3EF 50                      push eax
:0045F3F0 E86AFB0100              call 0047EF5F
:0045F3F5 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045F26F(U)
|
:0045F3F8 8BE5                    mov esp, ebp
:0045F3FA 5D                      pop ebp
:0045F3FB C21000                  ret 0010



:0045F3FE 74F24500                DWORD 0045F274
:0045F402 29F34500                DWORD 0045F329
:0045F406 CCF34500                DWORD 0045F3CC
:0045F40A ADF34500                DWORD 0045F3AD
:0045F40E E0F34500                DWORD 0045F3E0


:0045F412 0001                    add byte ptr [ecx], al
:0045F414 0404                    add al, 04
:0045F416 020404                  add al, byte ptr [esp+eax]
:0045F419 0404                    add al, 04
:0045F41B 0404                    add al, 04
:0045F41D 0404                    add al, 04
:0045F41F 0404                    add al, 04
:0045F421 0404                    add al, 04
:0045F423 0404                    add al, 04
:0045F425 0403                    add al, 03
:0045F427 55                      push ebp
:0045F428 8BEC                    mov ebp, esp
:0045F42A 83EC08                  sub esp, 00000008
:0045F42D 8B450C                  mov eax, dword ptr [ebp+0C]
:0045F430 8945F8                  mov dword ptr [ebp-08], eax
:0045F433 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045F436 81E911010000            sub ecx, 00000111
:0045F43C 894DF8                  mov dword ptr [ebp-08], ecx
:0045F43F 817DF8F4000000          cmp dword ptr [ebp-08], 000000F4
:0045F446 0F87CE000000            ja 0045F51A
:0045F44C 8B45F8                  mov eax, dword ptr [ebp-08]
:0045F44F 33D2                    xor edx, edx
:0045F451 8A904CF54500            mov dl, byte ptr [eax+0045F54C]
:0045F457 FF249538F54500          jmp dword ptr [4*edx+0045F538]
:0045F45E 8B4D14                  mov ecx, dword ptr [ebp+14]
:0045F461 51                      push ecx
:0045F462 8B5510                  mov edx, dword ptr [ebp+10]
:0045F465 52                      push edx
:0045F466 8B450C                  mov eax, dword ptr [ebp+0C]
:0045F469 50                      push eax
:0045F46A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045F46D 51                      push ecx
:0045F46E FF1578634800            call dword ptr [00486378]
:0045F474 E9B9000000              jmp 0045F532
:0045F479 833D845E4B0000          cmp dword ptr [004B5E84], 00000000
:0045F480 7439                    je 0045F4BB
:0045F482 8B5514                  mov edx, dword ptr [ebp+14]
:0045F485 C1EA10                  shr edx, 10
:0045F488 81E2FFFF0000            and edx, 0000FFFF
:0045F48E 81E2FFFF0000            and edx, 0000FFFF
:0045F494 52                      push edx
:0045F495 8B4514                  mov eax, dword ptr [ebp+14]
:0045F498 25FFFF0000              and eax, 0000FFFF
:0045F49D 50                      push eax
:0045F49E 8B0D845E4B00            mov ecx, dword ptr [004B5E84]
:0045F4A4 E86BD1FFFF              call 0045C614
:0045F4A9 8845FC                  mov byte ptr [ebp-04], al
:0045F4AC 8A4DFC                  mov cl, byte ptr [ebp-04]
:0045F4AF 51                      push ecx
:0045F4B0 8B0D845E4B00            mov ecx, dword ptr [004B5E84]
:0045F4B6 E82ED6FFFF              call 0045CAE9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045F480(C)
|
:0045F4BB EB5D                    jmp 0045F51A
:0045F4BD 833D845E4B0000          cmp dword ptr [004B5E84], 00000000
:0045F4C4 743E                    je 0045F504
:0045F4C6 8B0D845E4B00            mov ecx, dword ptr [004B5E84]
:0045F4CC E881CBFFFF              call 0045C052
:0045F4D1 8B0D845E4B00            mov ecx, dword ptr [004B5E84]
:0045F4D7 E8D4020000              call 0045F7B0
:0045F4DC 25FF000000              and eax, 000000FF
:0045F4E1 3DFF000000              cmp eax, 000000FF
:0045F4E6 741C                    je 0045F504
:0045F4E8 8B0D845E4B00            mov ecx, dword ptr [004B5E84]
:0045F4EE E8BD020000              call 0045F7B0
:0045F4F3 25FF000000              and eax, 000000FF
:0045F4F8 50                      push eax
:0045F4F9 8B0D845E4B00            mov ecx, dword ptr [004B5E84]
:0045F4FF E859E3FFFF              call 0045D85D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045F4C4(C), :0045F4E6(C)
|
:0045F504 EB14                    jmp 0045F51A
:0045F506 833D845E4B0000          cmp dword ptr [004B5E84], 00000000
:0045F50D 740B                    je 0045F51A
:0045F50F 8B0D845E4B00            mov ecx, dword ptr [004B5E84]
:0045F515 E895E2FFFF              call 0045D7AF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045F446(C), :0045F4BB(U), :0045F504(U), :0045F50D(C)
|
:0045F51A 8B5514                  mov edx, dword ptr [ebp+14]
:0045F51D 52                      push edx
:0045F51E 8B4510                  mov eax, dword ptr [ebp+10]
:0045F521 50                      push eax
:0045F522 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0045F525 51                      push ecx
:0045F526 8B5508                  mov edx, dword ptr [ebp+08]
:0045F529 52                      push edx
:0045F52A E830FA0100              call 0047EF5F
:0045F52F 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045F474(U)
|
:0045F532 8BE5                    mov esp, ebp
:0045F534 5D                      pop ebp
:0045F535 C21000                  ret 0010



:0045F538 5EF44500                DWORD 0045F45E
:0045F53C 79F44500                DWORD 0045F479
:0045F540 BDF44500                DWORD 0045F4BD
:0045F544 06F54500                DWORD 0045F506
:0045F548 1AF54500                DWORD 0045F51A


:0045F54C 000404                  add byte ptr [esp+eax], al
:0045F54F 0404                    add al, 04
:0045F551 0404                    add al, 04
:0045F553 0404                    add al, 04
:0045F555 0404                    add al, 04
:0045F557 0404                    add al, 04
:0045F559 0404                    add al, 04
:0045F55B 0404                    add al, 04
:0045F55D 0404                    add al, 04
:0045F55F 0404                    add al, 04
:0045F561 0404                    add al, 04
:0045F563 0404                    add al, 04
:0045F565 0404                    add al, 04
:0045F567 0404                    add al, 04
:0045F569 0404                    add al, 04
:0045F56B 0404                    add al, 04
:0045F56D 0404                    add al, 04
:0045F56F 0404                    add al, 04
:0045F571 0404                    add al, 04
:0045F573 0404                    add al, 04
:0045F575 0404                    add al, 04
:0045F577 0404                    add al, 04
:0045F579 0404                    add al, 04
:0045F57B 0404                    add al, 04
:0045F57D 0404                    add al, 04
:0045F57F 0404                    add al, 04
:0045F581 0404                    add al, 04
:0045F583 0404                    add al, 04
:0045F585 0404                    add al, 04
:0045F587 0404                    add al, 04
:0045F589 0404                    add al, 04
:0045F58B 0404                    add al, 04
:0045F58D 0404                    add al, 04
:0045F58F 0404                    add al, 04
:0045F591 0404                    add al, 04
:0045F593 0404                    add al, 04
:0045F595 0404                    add al, 04
:0045F597 0404                    add al, 04
:0045F599 0404                    add al, 04
:0045F59B 0404                    add al, 04
:0045F59D 0404                    add al, 04
:0045F59F 0404                    add al, 04
:0045F5A1 0404                    add al, 04
:0045F5A3 0404                    add al, 04
:0045F5A5 0404                    add al, 04
:0045F5A7 0404                    add al, 04
:0045F5A9 0404                    add al, 04
:0045F5AB 0404                    add al, 04
:0045F5AD 0404                    add al, 04
:0045F5AF 0404                    add al, 04
:0045F5B1 0404                    add al, 04
:0045F5B3 0404                    add al, 04
:0045F5B5 0404                    add al, 04
:0045F5B7 0404                    add al, 04
:0045F5B9 0404                    add al, 04
:0045F5BB 0404                    add al, 04
:0045F5BD 0404                    add al, 04
:0045F5BF 0404                    add al, 04
:0045F5C1 0404                    add al, 04
:0045F5C3 0404                    add al, 04
:0045F5C5 0404                    add al, 04
:0045F5C7 0404                    add al, 04
:0045F5C9 0404                    add al, 04
:0045F5CB 0404                    add al, 04
:0045F5CD 0404                    add al, 04
:0045F5CF 0404                    add al, 04
:0045F5D1 0404                    add al, 04
:0045F5D3 0404                    add al, 04
:0045F5D5 0404                    add al, 04
:0045F5D7 0404                    add al, 04
:0045F5D9 0404                    add al, 04
:0045F5DB 0404                    add al, 04
:0045F5DD 0404                    add al, 04
:0045F5DF 0404                    add al, 04
:0045F5E1 0404                    add al, 04
:0045F5E3 0404                    add al, 04
:0045F5E5 0404                    add al, 04
:0045F5E7 0404                    add al, 04
:0045F5E9 0404                    add al, 04
:0045F5EB 0404                    add al, 04
:0045F5ED 0404                    add al, 04
:0045F5EF 0404                    add al, 04
:0045F5F1 0404                    add al, 04
:0045F5F3 0404                    add al, 04
:0045F5F5 0404                    add al, 04
:0045F5F7 0404                    add al, 04
:0045F5F9 0404                    add al, 04
:0045F5FB 0404                    add al, 04
:0045F5FD 0404                    add al, 04
:0045F5FF 0404                    add al, 04
:0045F601 0404                    add al, 04
:0045F603 0404                    add al, 04
:0045F605 0404                    add al, 04
:0045F607 0404                    add al, 04
:0045F609 0404                    add al, 04
:0045F60B 0404                    add al, 04
:0045F60D 0404                    add al, 04
:0045F60F 0404                    add al, 04
:0045F611 0404                    add al, 04
:0045F613 0404                    add al, 04
:0045F615 0404                    add al, 04
:0045F617 0404                    add al, 04
:0045F619 0404                    add al, 04
:0045F61B 0404                    add al, 04
:0045F61D 0404                    add al, 04
:0045F61F 0404                    add al, 04
:0045F621 0404                    add al, 04
:0045F623 0404                    add al, 04
:0045F625 0404                    add al, 04
:0045F627 0404                    add al, 04
:0045F629 0404                    add al, 04
:0045F62B 0404                    add al, 04
:0045F62D 0404                    add al, 04
:0045F62F 0404                    add al, 04
:0045F631 0404                    add al, 04
:0045F633 0404                    add al, 04
:0045F635 0404                    add al, 04
:0045F637 0404                    add al, 04
:0045F639 0404                    add al, 04
:0045F63B 010402                  add dword ptr [edx+eax], eax
:0045F63E 0404                    add al, 04
:0045F640 03CC                    add ecx, esp
:0045F642 CC                      int 03
:0045F643 CC                      int 03
:0045F644 CC                      int 03
:0045F645 CC                      int 03
:0045F646 CC                      int 03
:0045F647 CC                      int 03
:0045F648 CC                      int 03
:0045F649 CC                      int 03
:0045F64A CC                      int 03
:0045F64B CC                      int 03
:0045F64C CC                      int 03
:0045F64D CC                      int 03
:0045F64E CC                      int 03
:0045F64F CC                      int 03

* Referenced by a CALL at Addresses:
|:0043AD7D   , :0043DE67   , :0044E452   , :0045BAEC   , :0045BBD7   
|:0046CE3A   , :0046CE6A   , :0046CEC7   , :0046CEF7   , :0046CF54   
|:0046CF84   
|
:0045F650 55                      push ebp
:0045F651 8BEC                    mov ebp, esp
:0045F653 51                      push ecx
:0045F654 894DFC                  mov dword ptr [ebp-04], ecx
:0045F657 8B45FC                  mov eax, dword ptr [ebp-04]
:0045F65A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045F65D 8908                    mov dword ptr [eax], ecx
:0045F65F 8BE5                    mov esp, ebp
:0045F661 5D                      pop ebp
:0045F662 C20400                  ret 0004


:0045F665 CC                      int 03
:0045F666 CC                      int 03
:0045F667 CC                      int 03
:0045F668 CC                      int 03
:0045F669 CC                      int 03
:0045F66A CC                      int 03
:0045F66B CC                      int 03
:0045F66C CC                      int 03
:0045F66D CC                      int 03
:0045F66E CC                      int 03
:0045F66F CC                      int 03

* Referenced by a CALL at Addresses:
|:004037D2   , :004038C4   , :004039B3   , :00403ABB   , :00403B5A   
|:00404451   , :00405593   , :00405B6D   , :00405BCF   , :00405E8B   
|:00406232   , :004063DB   , :004137CA   , :00415342   , :004162DC   
|:0041661D   , :00416EA4   , :0041990B   , :0041C5F8   , :0041C63B   
|:0041C6B8   , :0041CD45   , :0041CFC1   , :0041D104   , :0041D438   
|:0041D593   , :0041DC19   , :0041DCEB   , :0041DCFF   , :0041FEE5   
|:0042046F   , :00420747   , :0042079D   , :00420DC9   , :00420EA8   
|:00420F83   , :00421087   , :004211C1   , :00421332   , :004213D9   
|:0042148A   , :00422CA0   , :00422D88   , :00422DB0   , :0042312B   
|:00423219   , :00423691   , :00423E2F   , :00423E66   , :00423FD8   
|:0042408F   , :004243D8   , :004250DE   , :0042522C   , :00425333   
|:00437D70   , :00438A42   , :00438BC2   , :00438E8E   , :00438F56   
|:004395E7   , :00439923   , :0043992F   , :0043B594   , :0043B5A7   
|:0043B7C6   , :0043B7D9   , :0043BAB3   , :0043BAF6   , :0043BDE4   
|:0043BE02   , :0043C74A   , :0043C76C   , :0043C788   , :0043C7B0   
|:0043DE3B   , :0043E00A   , :0043E4FE   , :0043EAF1   , :004417CB   
|:0044189A   , :0044C6EB   , :0044C7E0   , :0044C814   , :0044DFDA   
|:0044E0C0   , :0044E336   , :0044E447   , :0044E538   , :0044ECC6   
|:0044ECF1   , :0044ED22   , :0044EF4B   , :0045004F   , :00450A08   
|:00454481   , :004560AB   , :004573CA   , :0045747B   , :004575F2   
|:00457835   , :00459470   , :0045969B   , :004597B5   , :0045981E   
|:004598BA   , :004598EA   , :004599B3   , :00459A14   , :0045A094   
|:0045AA22   , :0045ADAD   , :0045AF80   , :0045B48B   , :0045B5DB   
|:0045B65A   , :0045BB18   , :0045BB3D   , :0045BB62   , :0045BB87   
|:0045BD97   , :004655C7   , :00465B31   , :00465CCF   , :00465DA2   
|:00465E66   , :0046647B   , :0046649C   , :004676FB   , :004684AF   
|:00468585   , :00469CC6   , :0046C943   , :0046C991   , :0046C9DF   
|:0046CA2D   , :0046FB40   , :00470147   , :00470556   , :004705BF   
|:004722A2   , :00477807   , :00477836   , :00477865   , :00477B41   
|:0047970D   , :004798B2   
|
:0045F670 55                      push ebp
:0045F671 8BEC                    mov ebp, esp
:0045F673 51                      push ecx
:0045F674 894DFC                  mov dword ptr [ebp-04], ecx
:0045F677 8B45FC                  mov eax, dword ptr [ebp-04]
:0045F67A 8B00                    mov eax, dword ptr [eax]
:0045F67C 8BE5                    mov esp, ebp
:0045F67E 5D                      pop ebp
:0045F67F C3                      ret



* Referenced by a CALL at Address:
|:0045E859   
|
:0045F680 55                      push ebp
:0045F681 8BEC                    mov ebp, esp
:0045F683 51                      push ecx
:0045F684 894DFC                  mov dword ptr [ebp-04], ecx
:0045F687 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045F68A E88CC9FFFF              call 0045C01B
:0045F68F 8B4508                  mov eax, dword ptr [ebp+08]
:0045F692 83E001                  and eax, 00000001
:0045F695 85C0                    test eax, eax
:0045F697 740C                    je 0045F6A5
:0045F699 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045F69C 51                      push ecx
:0045F69D E87E190200              call 00481020
:0045F6A2 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045F697(C)
|
:0045F6A5 8B45FC                  mov eax, dword ptr [ebp-04]
:0045F6A8 8BE5                    mov esp, ebp
:0045F6AA 5D                      pop ebp
:0045F6AB C20400                  ret 0004


:0045F6AE CC                      int 03
:0045F6AF CC                      int 03

* Referenced by a CALL at Address:
|:0045E672   
|
:0045F6B0 55                      push ebp
:0045F6B1 8BEC                    mov ebp, esp
:0045F6B3 6AFF                    push FFFFFFFF
:0045F6B5 682C574800              push 0048572C
:0045F6BA 64A100000000            mov eax, dword ptr fs:[00000000]
:0045F6C0 50                      push eax
:0045F6C1 64892500000000          mov dword ptr fs:[00000000], esp
:0045F6C8 51                      push ecx
:0045F6C9 894DF0                  mov dword ptr [ebp-10], ecx
:0045F6CC 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0045F6CF 83C124                  add ecx, 00000024
:0045F6D2 E839000000              call 0045F710
:0045F6D7 C745FC00000000          mov [ebp-04], 00000000
:0045F6DE 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0045F6E1 E8FAECFAFF              call 0040E3E0
:0045F6E6 8B45F0                  mov eax, dword ptr [ebp-10]
:0045F6E9 C700C8674800            mov dword ptr [eax], 004867C8
:0045F6EF C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0045F6F6 8B45F0                  mov eax, dword ptr [ebp-10]
:0045F6F9 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0045F6FC 64890D00000000          mov dword ptr fs:[00000000], ecx
:0045F703 8BE5                    mov esp, ebp
:0045F705 5D                      pop ebp
:0045F706 C3                      ret


:0045F707 CC                      int 03
:0045F708 CC                      int 03
:0045F709 CC                      int 03
:0045F70A CC                      int 03
:0045F70B CC                      int 03
:0045F70C CC                      int 03
:0045F70D CC                      int 03
:0045F70E CC                      int 03
:0045F70F CC                      int 03

* Referenced by a CALL at Addresses:
|:00406590   , :00407584   , :004086BC   , :004086E8   , :0040BED1   
|:00418ACD   , :0041DB65   , :0041DD5D   , :00420037   , :0042004F   
|:00420152   , :0042016A   , :0042026C   , :00420284   , :00420387   
|:0042039F   , :00421C4E   , :00421F6E   , :0042545F   , :00425467   
|:00425AA0   , :0042B087   , :0042B2D0   , :0042B52A   , :00433352   
|:00433545   , :004337FB   , :00433BD1   , :004341A8   , :00435162   
|:0043517B   , :00435A1A   , :00435D13   , :0043653A   , :00437D66   
|:00437E3A   , :00437E42   , :0043832E   , :00438336   , :0043A3F0   
|:0043A962   , :0043AD5C   , :0043D544   , :0043D54C   , :0043DA18   
|:0043DEDD   , :0043F063   , :00440323   , :00442B0F   , :004430BD   
|:004430C8   , :00449AE1   , :0044B53F   , :0044C39E   , :0044C907   
|:0044DF8A   , :0044E0ED   , :0044F8C8   , :0044F94A   , :0044FA27   
|:0044FCCA   , :00451A14   , :00451A1F   , :00451A2A   , :00451A38   
|:00451ED9   , :00453A4C   , :00453F0E   , :00453F23   , :0045402E   
|:0045405B   , :004541D5   , :00454729   , :004552A4   , :0045535C   
|:00455364   , :004577C1   , :00459493   , :00459549   , :00459E85   
|:0045A81B   , :0045ADF1   , :0045AFDE   , :0045AFE6   , :0045B4B1   
|:0045B60A   , :0045F6D2   , :00465724   , :00465B6C   , :004678D4   
|:004685D3   , :004697AA   , :0046B0C0   , :0046B0F3   , :0046B218   
|:0046B230   , :0046DE22   , :0046DE77   , :0046E0E8   , :0046E2D2   
|:0046E311   , :0046FACE   , :004704D9   , :00476F01   , :004770B3   
|:00477265   
|
:0045F710 55                      push ebp
:0045F711 8BEC                    mov ebp, esp
:0045F713 51                      push ecx
:0045F714 894DFC                  mov dword ptr [ebp-04], ecx
:0045F717 8B45FC                  mov eax, dword ptr [ebp-04]
:0045F71A 8BE5                    mov esp, ebp
:0045F71C 5D                      pop ebp
:0045F71D C3                      ret


:0045F71E CC                      int 03
:0045F71F CC                      int 03

* Referenced by a CALL at Address:
|:0045E693   
|
:0045F720 55                      push ebp
:0045F721 8BEC                    mov ebp, esp
:0045F723 6AFF                    push FFFFFFFF
:0045F725 6861574800              push 00485761
:0045F72A 64A100000000            mov eax, dword ptr fs:[00000000]
:0045F730 50                      push eax
:0045F731 64892500000000          mov dword ptr fs:[00000000], esp
:0045F738 83EC08                  sub esp, 00000008
:0045F73B 894DF0                  mov dword ptr [ebp-10], ecx
:0045F73E 8B45F0                  mov eax, dword ptr [ebp-10]
:0045F741 C700C8674800            mov dword ptr [eax], 004867C8
:0045F747 C745FC00000000          mov [ebp-04], 00000000
:0045F74E 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0045F751 E80AEDFAFF              call 0040E460
:0045F756 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0045F75D 837DF000                cmp dword ptr [ebp-10], 00000000
:0045F761 740B                    je 0045F76E
:0045F763 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0045F766 83C124                  add ecx, 00000024
:0045F769 894DEC                  mov dword ptr [ebp-14], ecx
:0045F76C EB07                    jmp 0045F775

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045F761(C)
|
:0045F76E C745EC00000000          mov [ebp-14], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045F76C(U)
|
:0045F775 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0045F778 E893BDFCFF              call 0042B510
:0045F77D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0045F780 64890D00000000          mov dword ptr fs:[00000000], ecx
:0045F787 8BE5                    mov esp, ebp
:0045F789 5D                      pop ebp
:0045F78A C3                      ret


:0045F78B CC                      int 03
:0045F78C CC                      int 03
:0045F78D CC                      int 03
:0045F78E CC                      int 03
:0045F78F CC                      int 03

* Referenced by a CALL at Address:
|:0045E7E1   
|
:0045F790 55                      push ebp
:0045F791 8BEC                    mov ebp, esp
:0045F793 51                      push ecx
:0045F794 894DFC                  mov dword ptr [ebp-04], ecx
:0045F797 8B4508                  mov eax, dword ptr [ebp+08]
:0045F79A 25FF000000              and eax, 000000FF
:0045F79F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045F7A2 8A440128                mov al, byte ptr [ecx+eax+28]
:0045F7A6 8BE5                    mov esp, ebp
:0045F7A8 5D                      pop ebp
:0045F7A9 C20400                  ret 0004


:0045F7AC CC                      int 03
:0045F7AD CC                      int 03
:0045F7AE CC                      int 03
:0045F7AF CC                      int 03

* Referenced by a CALL at Addresses:
|:0045F34E   , :0045F365   , :0045F4D7   , :0045F4EE   
|
:0045F7B0 55                      push ebp
:0045F7B1 8BEC                    mov ebp, esp
:0045F7B3 51                      push ecx
:0045F7B4 894DFC                  mov dword ptr [ebp-04], ecx
:0045F7B7 8B45FC                  mov eax, dword ptr [ebp-04]
:0045F7BA 8A4009                  mov al, byte ptr [eax+09]
:0045F7BD 8BE5                    mov esp, ebp
:0045F7BF 5D                      pop ebp
:0045F7C0 C3                      ret


:0045F7C1 CC                      int 03
:0045F7C2 CC                      int 03
:0045F7C3 CC                      int 03
:0045F7C4 CC                      int 03
:0045F7C5 CC                      int 03
:0045F7C6 CC                      int 03
:0045F7C7 CC                      int 03
:0045F7C8 CC                      int 03
:0045F7C9 CC                      int 03
:0045F7CA CC                      int 03
:0045F7CB CC                      int 03
:0045F7CC CC                      int 03
:0045F7CD CC                      int 03
:0045F7CE CC                      int 03
:0045F7CF CC                      int 03

* Referenced by a CALL at Addresses:
|:0045C3C7   , :0045E116   
|
:0045F7D0 55                      push ebp
:0045F7D1 8BEC                    mov ebp, esp
:0045F7D3 51                      push ecx
:0045F7D4 894DFC                  mov dword ptr [ebp-04], ecx
:0045F7D7 A1A8E34800              mov eax, dword ptr [0048E3A8]
:0045F7DC 50                      push eax
:0045F7DD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045F7E0 E8B7E6FFFF              call 0045DE9C
:0045F7E5 8BE5                    mov esp, ebp
:0045F7E7 5D                      pop ebp
:0045F7E8 C3                      ret


:0045F7E9 CC                      int 03
:0045F7EA CC                      int 03
:0045F7EB CC                      int 03
:0045F7EC CC                      int 03
:0045F7ED CC                      int 03
:0045F7EE CC                      int 03
:0045F7EF CC                      int 03

* Referenced by a CALL at Address:
|:0045D86D   
|
:0045F7F0 55                      push ebp
:0045F7F1 8BEC                    mov ebp, esp
:0045F7F3 51                      push ecx
:0045F7F4 894DFC                  mov dword ptr [ebp-04], ecx
:0045F7F7 8B4508                  mov eax, dword ptr [ebp+08]
:0045F7FA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045F7FD 8B84818C000000          mov eax, dword ptr [ecx+4*eax+0000008C]
:0045F804 8BE5                    mov esp, ebp
:0045F806 5D                      pop ebp
:0045F807 C20400                  ret 0004


:0045F80A CC                      int 03
:0045F80B CC                      int 03
:0045F80C CC                      int 03
:0045F80D CC                      int 03
:0045F80E CC                      int 03
:0045F80F CC                      int 03

* Referenced by a CALL at Addresses:
|:0045D891   , :0045D962   
|
:0045F810 55                      push ebp
:0045F811 8BEC                    mov ebp, esp
:0045F813 51                      push ecx
:0045F814 894DFC                  mov dword ptr [ebp-04], ecx
:0045F817 8B4508                  mov eax, dword ptr [ebp+08]
:0045F81A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0045F81D 8B550C                  mov edx, dword ptr [ebp+0C]
:0045F820 8994818C000000          mov dword ptr [ecx+4*eax+0000008C], edx
:0045F827 8BE5                    mov esp, ebp
:0045F829 5D                      pop ebp
:0045F82A C20800                  ret 0008


:0045F82D CC                      int 03
:0045F82E CC                      int 03
:0045F82F CC                      int 03

* Referenced by a CALL at Address:
|:0045E809   
|
:0045F830 55                      push ebp
:0045F831 8BEC                    mov ebp, esp
:0045F833 51                      push ecx
:0045F834 894DFC                  mov dword ptr [ebp-04], ecx
:0045F837 8B45FC                  mov eax, dword ptr [ebp-04]
:0045F83A 8B08                    mov ecx, dword ptr [eax]
:0045F83C 8B5508                  mov edx, dword ptr [ebp+08]
:0045F83F 8B0491                  mov eax, dword ptr [ecx+4*edx]
:0045F842 8BE5                    mov esp, ebp
:0045F844 5D                      pop ebp
:0045F845 C20400                  ret 0004


:0045F848 CC                      int 03
:0045F849 CC                      int 03
:0045F84A CC                      int 03
:0045F84B CC                      int 03
:0045F84C CC                      int 03
:0045F84D CC                      int 03
:0045F84E CC                      int 03
:0045F84F CC                      int 03
:0045F850 55                      push ebp
:0045F851 8BEC                    mov ebp, esp
:0045F853 E807000000              call 0045F85F
:0045F858 E811000000              call 0045F86E
:0045F85D 5D                      pop ebp
:0045F85E C3                      ret



* Referenced by a CALL at Address:
|:0045F853   
|
:0045F85F 55                      push ebp
:0045F860 8BEC                    mov ebp, esp
:0045F862 B9805F4B00              mov ecx, 004B5F80
:0045F867 E8B4230000              call 00461C20
:0045F86C 5D                      pop ebp
:0045F86D C3                      ret



* Referenced by a CALL at Address:
|:0045F858   
|
:0045F86E 55                      push ebp
:0045F86F 8BEC                    mov ebp, esp
:0045F871 6880F84500              push 0045F880
:0045F876 E885180200              call 00481100
:0045F87B 83C404                  add esp, 00000004
:0045F87E 5D                      pop ebp
:0045F87F C3                      ret


:0045F880 55                      push ebp
:0045F881 8BEC                    mov ebp, esp
:0045F883 B9805F4B00              mov ecx, 004B5F80
:0045F888 E883BCFCFF              call 0042B510
:0045F88D 5D                      pop ebp
:0045F88E C3                      ret


:0045F88F 55                      push ebp
:0045F890 8BEC                    mov ebp, esp
:0045F892 E807000000              call 0045F89E
:0045F897 E811000000              call 0045F8AD
:0045F89C 5D                      pop ebp
:0045F89D C3                      ret



* Referenced by a CALL at Address:
|:0045F892   
|
:0045F89E 55                      push ebp
:0045F89F 8BEC                    mov ebp, esp
:0045F8A1 B928604B00              mov ecx, 004B6028
:0045F8A6 E895230000              call 00461C40
:0045F8AB 5D                      pop ebp
:0045F8AC C3                      ret



* Referenced by a CALL at Address:
|:0045F897   
|
:0045F8AD 55                      push ebp
:0045F8AE 8BEC                    mov ebp, esp
:0045F8B0 68BFF84500              push 0045F8BF
:0045F8B5 E846180200              call 00481100
:0045F8BA 83C404                  add esp, 00000004
:0045F8BD 5D                      pop ebp
:0045F8BE C3                      ret


:0045F8BF 55                      push ebp
:0045F8C0 8BEC                    mov ebp, esp
:0045F8C2 B928604B00              mov ecx, 004B6028
:0045F8C7 E844BCFCFF              call 0042B510
:0045F8CC 5D                      pop ebp
:0045F8CD C3                      ret



* Referenced by a CALL at Address:
|:00475566   
|
:0045F8CE 55                      push ebp
:0045F8CF 8BEC                    mov ebp, esp
:0045F8D1 83EC14                  sub esp, 00000014
:0045F8D4 8B4508                  mov eax, dword ptr [ebp+08]
:0045F8D7 50                      push eax
:0045F8D8 E8E1020000              call 0045FBBE
:0045F8DD 83C404                  add esp, 00000004
:0045F8E0 85C0                    test eax, eax
:0045F8E2 7507                    jne 0045F8EB
:0045F8E4 33C0                    xor eax, eax
:0045F8E6 E9CF020000              jmp 0045FBBA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045F8E2(C)
|
:0045F8EB 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045F8EE 51                      push ecx
:0045F8EF E833030000              call 0045FC27
:0045F8F4 83C404                  add esp, 00000004
:0045F8F7 85C0                    test eax, eax
:0045F8F9 7507                    jne 0045F902
:0045F8FB 33C0                    xor eax, eax
:0045F8FD E9B8020000              jmp 0045FBBA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045F8F9(C)
|
:0045F902 8B5508                  mov edx, dword ptr [ebp+08]
:0045F905 52                      push edx
:0045F906 E885030000              call 0045FC90
:0045F90B 83C404                  add esp, 00000004
:0045F90E 85C0                    test eax, eax
:0045F910 7507                    jne 0045F919
:0045F912 33C0                    xor eax, eax
:0045F914 E9A1020000              jmp 0045FBBA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045F910(C)
|
:0045F919 8B4508                  mov eax, dword ptr [ebp+08]
:0045F91C 50                      push eax
:0045F91D E8E2030000              call 0045FD04
:0045F922 83C404                  add esp, 00000004
:0045F925 85C0                    test eax, eax
:0045F927 7507                    jne 0045F930
:0045F929 33C0                    xor eax, eax
:0045F92B E98A020000              jmp 0045FBBA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045F927(C)
|
:0045F930 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045F933 51                      push ecx
:0045F934 E834040000              call 0045FD6D
:0045F939 83C404                  add esp, 00000004
:0045F93C 85C0                    test eax, eax
:0045F93E 7507                    jne 0045F947
:0045F940 33C0                    xor eax, eax
:0045F942 E973020000              jmp 0045FBBA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045F93E(C)
|
:0045F947 8B5508                  mov edx, dword ptr [ebp+08]
:0045F94A 52                      push edx
:0045F94B E886040000              call 0045FDD6
:0045F950 83C404                  add esp, 00000004
:0045F953 85C0                    test eax, eax
:0045F955 7507                    jne 0045F95E
:0045F957 33C0                    xor eax, eax
:0045F959 E95C020000              jmp 0045FBBA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045F955(C)
|
:0045F95E 8B4508                  mov eax, dword ptr [ebp+08]
:0045F961 50                      push eax
:0045F962 E8D8040000              call 0045FE3F
:0045F967 83C404                  add esp, 00000004
:0045F96A 85C0                    test eax, eax
:0045F96C 7507                    jne 0045F975
:0045F96E 33C0                    xor eax, eax
:0045F970 E945020000              jmp 0045FBBA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045F96C(C)
|
:0045F975 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045F978 51                      push ecx
:0045F979 E893050000              call 0045FF11
:0045F97E 83C404                  add esp, 00000004
:0045F981 85C0                    test eax, eax
:0045F983 7507                    jne 0045F98C
:0045F985 33C0                    xor eax, eax
:0045F987 E92E020000              jmp 0045FBBA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045F983(C)
|
:0045F98C 8B5508                  mov edx, dword ptr [ebp+08]
:0045F98F 52                      push edx
:0045F990 E8DC050000              call 0045FF71
:0045F995 83C404                  add esp, 00000004
:0045F998 85C0                    test eax, eax
:0045F99A 7507                    jne 0045F9A3
:0045F99C 33C0                    xor eax, eax
:0045F99E E917020000              jmp 0045FBBA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045F99A(C)
|
:0045F9A3 8B4508                  mov eax, dword ptr [ebp+08]
:0045F9A6 50                      push eax
:0045F9A7 E825060000              call 0045FFD1
:0045F9AC 83C404                  add esp, 00000004
:0045F9AF 85C0                    test eax, eax
:0045F9B1 7507                    jne 0045F9BA
:0045F9B3 33C0                    xor eax, eax
:0045F9B5 E900020000              jmp 0045FBBA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045F9B1(C)
|
:0045F9BA 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045F9BD 51                      push ecx
:0045F9BE E877060000              call 0046003A
:0045F9C3 83C404                  add esp, 00000004
:0045F9C6 85C0                    test eax, eax
:0045F9C8 7507                    jne 0045F9D1
:0045F9CA 33C0                    xor eax, eax
:0045F9CC E9E9010000              jmp 0045FBBA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045F9C8(C)
|
:0045F9D1 8B5508                  mov edx, dword ptr [ebp+08]
:0045F9D4 52                      push edx
:0045F9D5 E8C9060000              call 004600A3
:0045F9DA 83C404                  add esp, 00000004
:0045F9DD 85C0                    test eax, eax
:0045F9DF 7507                    jne 0045F9E8
:0045F9E1 33C0                    xor eax, eax
:0045F9E3 E9D2010000              jmp 0045FBBA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045F9DF(C)
|
:0045F9E8 8B4508                  mov eax, dword ptr [ebp+08]
:0045F9EB 50                      push eax
:0045F9EC E812070000              call 00460103
:0045F9F1 83C404                  add esp, 00000004
:0045F9F4 85C0                    test eax, eax
:0045F9F6 7507                    jne 0045F9FF
:0045F9F8 33C0                    xor eax, eax
:0045F9FA E9BB010000              jmp 0045FBBA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045F9F6(C)
|
:0045F9FF 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045FA02 51                      push ecx
:0045FA03 E85B070000              call 00460163
:0045FA08 83C404                  add esp, 00000004
:0045FA0B 85C0                    test eax, eax
:0045FA0D 7507                    jne 0045FA16
:0045FA0F 33C0                    xor eax, eax
:0045FA11 E9A4010000              jmp 0045FBBA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045FA0D(C)
|
:0045FA16 8B5508                  mov edx, dword ptr [ebp+08]
:0045FA19 52                      push edx
:0045FA1A E889040000              call 0045FEA8
:0045FA1F 83C404                  add esp, 00000004
:0045FA22 85C0                    test eax, eax
:0045FA24 7507                    jne 0045FA2D
:0045FA26 33C0                    xor eax, eax
:0045FA28 E98D010000              jmp 0045FBBA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045FA24(C)
|
:0045FA2D 8B4508                  mov eax, dword ptr [ebp+08]
:0045FA30 50                      push eax
:0045FA31 E88D070000              call 004601C3
:0045FA36 83C404                  add esp, 00000004
:0045FA39 85C0                    test eax, eax
:0045FA3B 7507                    jne 0045FA44
:0045FA3D 33C0                    xor eax, eax
:0045FA3F E976010000              jmp 0045FBBA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045FA3B(C)
|
:0045FA44 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045FA47 51                      push ecx
:0045FA48 E8DF070000              call 0046022C
:0045FA4D 83C404                  add esp, 00000004
:0045FA50 85C0                    test eax, eax
:0045FA52 7507                    jne 0045FA5B
:0045FA54 33C0                    xor eax, eax
:0045FA56 E95F010000              jmp 0045FBBA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045FA52(C)
|
:0045FA5B C745F800000000          mov [ebp-08], 00000000
:0045FA62 EB09                    jmp 0045FA6D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045FBA6(U)
|
:0045FA64 8B55F8                  mov edx, dword ptr [ebp-08]
:0045FA67 83C201                  add edx, 00000001
:0045FA6A 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045FA62(U)
|
:0045FA6D 837DF815                cmp dword ptr [ebp-08], 00000015
:0045FA71 0F8D34010000            jnl 0045FBAB
:0045FA77 8B45F8                  mov eax, dword ptr [ebp-08]
:0045FA7A C1E004                  shl eax, 04
:0045FA7D 8B88F0674800            mov ecx, dword ptr [eax+004867F0]
:0045FA83 894DF0                  mov dword ptr [ebp-10], ecx
:0045FA86 8B55F8                  mov edx, dword ptr [ebp-08]
:0045FA89 C1E204                  shl edx, 04
:0045FA8C 8B82F4674800            mov eax, dword ptr [edx+004867F4]
:0045FA92 8945F4                  mov dword ptr [ebp-0C], eax
:0045FA95 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0045FA98 51                      push ecx
:0045FA99 8B15686A4B00            mov edx, dword ptr [004B6A68]
:0045FA9F 52                      push edx
:0045FAA0 FF1520634800            call dword ptr [00486320]
:0045FAA6 8B45F0                  mov eax, dword ptr [ebp-10]
:0045FAA9 030558E84800            add eax, dword ptr [0048E858]
:0045FAAF 8945FC                  mov dword ptr [ebp-04], eax
:0045FAB2 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0045FAB5 030D5CE84800            add ecx, dword ptr [0048E85C]
:0045FABB 894DEC                  mov dword ptr [ebp-14], ecx
:0045FABE 837DF802                cmp dword ptr [ebp-08], 00000002
:0045FAC2 744B                    je 0045FB0F
:0045FAC4 6A00                    push 00000000
:0045FAC6 8B5508                  mov edx, dword ptr [ebp+08]
:0045FAC9 52                      push edx
:0045FACA 6A00                    push 00000000
:0045FACC A1686A4B00              mov eax, dword ptr [004B6A68]
:0045FAD1 50                      push eax
:0045FAD2 6800000080              push 80000000
:0045FAD7 6800000080              push 80000000
:0045FADC 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0045FADF 51                      push ecx
:0045FAE0 33D2                    xor edx, edx
:0045FAE2 2B1558E84800            sub edx, dword ptr [0048E858]
:0045FAE8 52                      push edx
:0045FAE9 6800000054              push 54000000
:0045FAEE 6A00                    push 00000000
:0045FAF0 8B45F8                  mov eax, dword ptr [ebp-08]
:0045FAF3 8B0C85C8E44800          mov ecx, dword ptr [4*eax+0048E4C8]
:0045FAFA 51                      push ecx
:0045FAFB 6A00                    push 00000000
:0045FAFD FF1574634800            call dword ptr [00486374]
:0045FB03 8B55F8                  mov edx, dword ptr [ebp-08]
:0045FB06 890495D05F4B00          mov dword ptr [4*edx+004B5FD0], eax
:0045FB0D EB4D                    jmp 0045FB5C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045FAC2(C)
|
:0045FB0F 6A00                    push 00000000
:0045FB11 8B4508                  mov eax, dword ptr [ebp+08]
:0045FB14 50                      push eax
:0045FB15 6A00                    push 00000000
:0045FB17 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:0045FB1D 51                      push ecx
:0045FB1E 6800000080              push 80000000
:0045FB23 6800000080              push 80000000
:0045FB28 8B55EC                  mov edx, dword ptr [ebp-14]
:0045FB2B 52                      push edx
:0045FB2C 33C0                    xor eax, eax
:0045FB2E 2B0558E84800            sub eax, dword ptr [0048E858]
:0045FB34 50                      push eax
:0045FB35 680000C880              push 80C80000

* Possible StringData Ref from Data Obj ->"սСͼ"
                                  |
:0045FB3A 6820E54800              push 0048E520
:0045FB3F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045FB42 8B148DC8E44800          mov edx, dword ptr [4*ecx+0048E4C8]
:0045FB49 52                      push edx
:0045FB4A 6A00                    push 00000000
:0045FB4C FF1574634800            call dword ptr [00486374]
:0045FB52 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045FB55 89048DD05F4B00          mov dword ptr [4*ecx+004B5FD0], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045FB0D(U)
|
:0045FB5C 8B55F8                  mov edx, dword ptr [ebp-08]
:0045FB5F 833C95D05F4B0000        cmp dword ptr [4*edx+004B5FD0], 00000000
:0045FB67 750E                    jne 0045FB77
:0045FB69 6A00                    push 00000000
:0045FB6B E873CF0100              call 0047CAE3
:0045FB70 83C404                  add esp, 00000004
:0045FB73 33C0                    xor eax, eax
:0045FB75 EB43                    jmp 0045FBBA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045FB67(C)
|
:0045FB77 6A00                    push 00000000
:0045FB79 8B45F8                  mov eax, dword ptr [ebp-08]
:0045FB7C C1E004                  shl eax, 04
:0045FB7F 8B88FC674800            mov ecx, dword ptr [eax+004867FC]
:0045FB85 51                      push ecx
:0045FB86 8B55F8                  mov edx, dword ptr [ebp-08]
:0045FB89 C1E204                  shl edx, 04
:0045FB8C 8B82F8674800            mov eax, dword ptr [edx+004867F8]
:0045FB92 50                      push eax
:0045FB93 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0045FB96 8B148DD05F4B00          mov edx, dword ptr [4*ecx+004B5FD0]
:0045FB9D 52                      push edx
:0045FB9E E8E5CE0100              call 0047CA88
:0045FBA3 83C410                  add esp, 00000010
:0045FBA6 E9B9FEFFFF              jmp 0045FA64

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045FA71(C)
|
:0045FBAB 6A00                    push 00000000
:0045FBAD E831CF0100              call 0047CAE3
:0045FBB2 83C404                  add esp, 00000004
:0045FBB5 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045F8E6(U), :0045F8FD(U), :0045F914(U), :0045F92B(U), :0045F942(U)
|:0045F959(U), :0045F970(U), :0045F987(U), :0045F99E(U), :0045F9B5(U)
|:0045F9CC(U), :0045F9E3(U), :0045F9FA(U), :0045FA11(U), :0045FA28(U)
|:0045FA3F(U), :0045FA56(U), :0045FB75(U)
|
:0045FBBA 8BE5                    mov esp, ebp
:0045FBBC 5D                      pop ebp
:0045FBBD C3                      ret



* Referenced by a CALL at Address:
|:0045F8D8   
|
:0045FBBE 55                      push ebp
:0045FBBF 8BEC                    mov ebp, esp
:0045FBC1 83EC28                  sub esp, 00000028
:0045FBC4 C745D803000000          mov [ebp-28], 00000003

* Possible StringData Ref from Code Obj ->"UQEE}"
                                  |
:0045FBCB C745DC2B034600          mov [ebp-24], 0046032B
:0045FBD2 C745E000000000          mov [ebp-20], 00000000
:0045FBD9 C745E400000000          mov [ebp-1C], 00000000
:0045FBE0 8B4508                  mov eax, dword ptr [ebp+08]
:0045FBE3 8945E8                  mov dword ptr [ebp-18], eax
:0045FBE6 C745EC00000000          mov [ebp-14], 00000000
:0045FBED 68007F0000              push 00007F00
:0045FBF2 6A00                    push 00000000
:0045FBF4 FF15B0634800            call dword ptr [004863B0]
:0045FBFA 8945F0                  mov dword ptr [ebp-10], eax

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0045FBFD C745F406000000          mov [ebp-0C], 00000006
:0045FC04 C745F800000000          mov [ebp-08], 00000000

* Possible StringData Ref from Data Obj ->"SoldierFace"
                                  |
:0045FC0B 8B0DC8E44800            mov ecx, dword ptr [0048E4C8]
:0045FC11 894DFC                  mov dword ptr [ebp-04], ecx
:0045FC14 8D55D8                  lea edx, dword ptr [ebp-28]
:0045FC17 52                      push edx
:0045FC18 FF1570634800            call dword ptr [00486370]
:0045FC1E 25FFFF0000              and eax, 0000FFFF
:0045FC23 8BE5                    mov esp, ebp
:0045FC25 5D                      pop ebp
:0045FC26 C3                      ret



* Referenced by a CALL at Address:
|:0045F8EF   
|
:0045FC27 55                      push ebp
:0045FC28 8BEC                    mov ebp, esp
:0045FC2A 83EC28                  sub esp, 00000028
:0045FC2D C745D803000000          mov [ebp-28], 00000003

* Possible StringData Ref from Code Obj ->"UQEE}"
                                  |
:0045FC34 C745DC76034600          mov [ebp-24], 00460376
:0045FC3B C745E000000000          mov [ebp-20], 00000000
:0045FC42 C745E400000000          mov [ebp-1C], 00000000
:0045FC49 8B4508                  mov eax, dword ptr [ebp+08]
:0045FC4C 8945E8                  mov dword ptr [ebp-18], eax
:0045FC4F C745EC00000000          mov [ebp-14], 00000000
:0045FC56 68007F0000              push 00007F00
:0045FC5B 6A00                    push 00000000
:0045FC5D FF15B0634800            call dword ptr [004863B0]
:0045FC63 8945F0                  mov dword ptr [ebp-10], eax

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0045FC66 C745F406000000          mov [ebp-0C], 00000006
:0045FC6D C745F800000000          mov [ebp-08], 00000000

* Possible StringData Ref from Data Obj ->"SoldierChar"
                                  |
:0045FC74 8B0DCCE44800            mov ecx, dword ptr [0048E4CC]
:0045FC7A 894DFC                  mov dword ptr [ebp-04], ecx
:0045FC7D 8D55D8                  lea edx, dword ptr [ebp-28]
:0045FC80 52                      push edx
:0045FC81 FF1570634800            call dword ptr [00486370]
:0045FC87 25FFFF0000              and eax, 0000FFFF
:0045FC8C 8BE5                    mov esp, ebp
:0045FC8E 5D                      pop ebp
:0045FC8F C3                      ret



* Referenced by a CALL at Address:
|:0045F906   
|
:0045FC90 55                      push ebp
:0045FC91 8BEC                    mov ebp, esp
:0045FC93 83EC28                  sub esp, 00000028
:0045FC96 C745D803000000          mov [ebp-28], 00000003

* Possible StringData Ref from Code Obj ->"UEE}w}tl}tf"
                                  |
:0045FC9D C745DCC1034600          mov [ebp-24], 004603C1
:0045FCA4 C745E000000000          mov [ebp-20], 00000000
:0045FCAB C745E400000000          mov [ebp-1C], 00000000
:0045FCB2 8B4508                  mov eax, dword ptr [ebp+08]
:0045FCB5 8945E8                  mov dword ptr [ebp-18], eax
:0045FCB8 6889000000              push 00000089
:0045FCBD 8B4D08                  mov ecx, dword ptr [ebp+08]
:0045FCC0 51                      push ecx
:0045FCC1 FF156C634800            call dword ptr [0048636C]
:0045FCC7 8945EC                  mov dword ptr [ebp-14], eax
:0045FCCA 68007F0000              push 00007F00
:0045FCCF 6A00                    push 00000000
:0045FCD1 FF15B0634800            call dword ptr [004863B0]
:0045FCD7 8945F0                  mov dword ptr [ebp-10], eax

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0045FCDA C745F406000000          mov [ebp-0C], 00000006
:0045FCE1 C745F800000000          mov [ebp-08], 00000000

* Possible StringData Ref from Data Obj ->"SmallMap"
                                  |
:0045FCE8 8B15D0E44800            mov edx, dword ptr [0048E4D0]
:0045FCEE 8955FC                  mov dword ptr [ebp-04], edx
:0045FCF1 8D45D8                  lea eax, dword ptr [ebp-28]
:0045FCF4 50                      push eax
:0045FCF5 FF1570634800            call dword ptr [00486370]
:0045FCFB 25FFFF0000              and eax, 0000FFFF
:0045FD00 8BE5                    mov esp, ebp
:0045FD02 5D                      pop ebp
:0045FD03 C3                      ret



* Referenced by a CALL at Address:
|:0045F91D   
|
:0045FD04 55                      push ebp
:0045FD05 8BEC                    mov ebp, esp
:0045FD07 83EC28                  sub esp, 00000028
:0045FD0A C745D803000000          mov [ebp-28], 00000003

* Possible StringData Ref from Code Obj ->"UQEE}"
                                  |
:0045FD11 C745DC11054600          mov [ebp-24], 00460511
:0045FD18 C745E000000000          mov [ebp-20], 00000000
:0045FD1F C745E400000000          mov [ebp-1C], 00000000
:0045FD26 8B4508                  mov eax, dword ptr [ebp+08]
:0045FD29 8945E8                  mov dword ptr [ebp-18], eax
:0045FD2C C745EC00000000          mov [ebp-14], 00000000
:0045FD33 68007F0000              push 00007F00
:0045FD38 6A00                    push 00000000
:0045FD3A FF15B0634800            call dword ptr [004863B0]
:0045FD40 8945F0                  mov dword ptr [ebp-10], eax

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0045FD43 C745F406000000          mov [ebp-0C], 00000006
:0045FD4A C745F800000000          mov [ebp-08], 00000000

* Possible StringData Ref from Data Obj ->"Weather"
                                  |
:0045FD51 8B0DD4E44800            mov ecx, dword ptr [0048E4D4]
:0045FD57 894DFC                  mov dword ptr [ebp-04], ecx
:0045FD5A 8D55D8                  lea edx, dword ptr [ebp-28]
:0045FD5D 52                      push edx
:0045FD5E FF1570634800            call dword ptr [00486370]
:0045FD64 25FFFF0000              and eax, 0000FFFF
:0045FD69 8BE5                    mov esp, ebp
:0045FD6B 5D                      pop ebp
:0045FD6C C3                      ret



* Referenced by a CALL at Address:
|:0045F934   
|
:0045FD6D 55                      push ebp
:0045FD6E 8BEC                    mov ebp, esp
:0045FD70 83EC28                  sub esp, 00000028
:0045FD73 C745D803000000          mov [ebp-28], 00000003

* Possible StringData Ref from Code Obj ->"UQEE}"
                                  |
:0045FD7A C745DC5C054600          mov [ebp-24], 0046055C
:0045FD81 C745E000000000          mov [ebp-20], 00000000
:0045FD88 C745E400000000          mov [ebp-1C], 00000000
:0045FD8F 8B4508                  mov eax, dword ptr [ebp+08]
:0045FD92 8945E8                  mov dword ptr [ebp-18], eax
:0045FD95 C745EC00000000          mov [ebp-14], 00000000
:0045FD9C 68007F0000              push 00007F00
:0045FDA1 6A00                    push 00000000
:0045FDA3 FF15B0634800            call dword ptr [004863B0]
:0045FDA9 8945F0                  mov dword ptr [ebp-10], eax

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0045FDAC C745F406000000          mov [ebp-0C], 00000006
:0045FDB3 C745F800000000          mov [ebp-08], 00000000

* Possible StringData Ref from Data Obj ->"Effect"
                                  |
:0045FDBA 8B0DD8E44800            mov ecx, dword ptr [0048E4D8]
:0045FDC0 894DFC                  mov dword ptr [ebp-04], ecx
:0045FDC3 8D55D8                  lea edx, dword ptr [ebp-28]
:0045FDC6 52                      push edx
:0045FDC7 FF1570634800            call dword ptr [00486370]
:0045FDCD 25FFFF0000              and eax, 0000FFFF
:0045FDD2 8BE5                    mov esp, ebp
:0045FDD4 5D                      pop ebp
:0045FDD5 C3                      ret



* Referenced by a CALL at Address:
|:0045F94B   
|
:0045FDD6 55                      push ebp
:0045FDD7 8BEC                    mov ebp, esp
:0045FDD9 83EC28                  sub esp, 00000028
:0045FDDC C745D803000000          mov [ebp-28], 00000003

* Possible StringData Ref from Code Obj ->"UQEE}"
                                  |
:0045FDE3 C745DCA7054600          mov [ebp-24], 004605A7
:0045FDEA C745E000000000          mov [ebp-20], 00000000
:0045FDF1 C745E400000000          mov [ebp-1C], 00000000
:0045FDF8 8B4508                  mov eax, dword ptr [ebp+08]
:0045FDFB 8945E8                  mov dword ptr [ebp-18], eax
:0045FDFE C745EC00000000          mov [ebp-14], 00000000
:0045FE05 68007F0000              push 00007F00
:0045FE0A 6A00                    push 00000000
:0045FE0C FF15B0634800            call dword ptr [004863B0]
:0045FE12 8945F0                  mov dword ptr [ebp-10], eax

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0045FE15 C745F406000000          mov [ebp-0C], 00000006
:0045FE1C C745F800000000          mov [ebp-08], 00000000

* Possible StringData Ref from Data Obj ->"Influence"
                                  |
:0045FE23 8B0DDCE44800            mov ecx, dword ptr [0048E4DC]
:0045FE29 894DFC                  mov dword ptr [ebp-04], ecx
:0045FE2C 8D55D8                  lea edx, dword ptr [ebp-28]
:0045FE2F 52                      push edx
:0045FE30 FF1570634800            call dword ptr [00486370]
:0045FE36 25FFFF0000              and eax, 0000FFFF
:0045FE3B 8BE5                    mov esp, ebp
:0045FE3D 5D                      pop ebp
:0045FE3E C3                      ret



* Referenced by a CALL at Address:
|:0045F962   
|
:0045FE3F 55                      push ebp
:0045FE40 8BEC                    mov ebp, esp
:0045FE42 83EC28                  sub esp, 00000028
:0045FE45 C745D80B000000          mov [ebp-28], 0000000B
:0045FE4C C745DC01F24500          mov [ebp-24], 0045F201
:0045FE53 C745E000000000          mov [ebp-20], 00000000
:0045FE5A C745E400000000          mov [ebp-1C], 00000000
:0045FE61 8B4508                  mov eax, dword ptr [ebp+08]
:0045FE64 8945E8                  mov dword ptr [ebp-18], eax
:0045FE67 C745EC00000000          mov [ebp-14], 00000000
:0045FE6E 68007F0000              push 00007F00
:0045FE73 6A00                    push 00000000
:0045FE75 FF15B0634800            call dword ptr [004863B0]
:0045FE7B 8945F0                  mov dword ptr [ebp-10], eax

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0045FE7E C745F406000000          mov [ebp-0C], 00000006
:0045FE85 C745F800000000          mov [ebp-08], 00000000

* Possible StringData Ref from Data Obj ->"ButaiSlct"
                                  |
:0045FE8C 8B0DE0E44800            mov ecx, dword ptr [0048E4E0]
:0045FE92 894DFC                  mov dword ptr [ebp-04], ecx
:0045FE95 8D55D8                  lea edx, dword ptr [ebp-28]
:0045FE98 52                      push edx
:0045FE99 FF1570634800            call dword ptr [00486370]
:0045FE9F 25FFFF0000              and eax, 0000FFFF
:0045FEA4 8BE5                    mov esp, ebp
:0045FEA6 5D                      pop ebp
:0045FEA7 C3                      ret



* Referenced by a CALL at Address:
|:0045FA1A   
|
:0045FEA8 55                      push ebp
:0045FEA9 8BEC                    mov ebp, esp
:0045FEAB 83EC28                  sub esp, 00000028
:0045FEAE C745D80B000000          mov [ebp-28], 0000000B
:0045FEB5 C745DC27F44500          mov [ebp-24], 0045F427
:0045FEBC C745E000000000          mov [ebp-20], 00000000
:0045FEC3 C745E400000000          mov [ebp-1C], 00000000
:0045FECA 8B4508                  mov eax, dword ptr [ebp+08]
:0045FECD 8945E8                  mov dword ptr [ebp-18], eax
:0045FED0 C745EC00000000          mov [ebp-14], 00000000
:0045FED7 68007F0000              push 00007F00
:0045FEDC 6A00                    push 00000000
:0045FEDE FF15B0634800            call dword ptr [004863B0]
:0045FEE4 8945F0                  mov dword ptr [ebp-10], eax

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0045FEE7 C745F406000000          mov [ebp-0C], 00000006
:0045FEEE C745F800000000          mov [ebp-08], 00000000

* Possible StringData Ref from Data Obj ->"GoButaiSlct"
                                  |
:0045FEF5 8B0DE4E44800            mov ecx, dword ptr [0048E4E4]
:0045FEFB 894DFC                  mov dword ptr [ebp-04], ecx
:0045FEFE 8D55D8                  lea edx, dword ptr [ebp-28]
:0045FF01 52                      push edx
:0045FF02 FF1570634800            call dword ptr [00486370]
:0045FF08 25FFFF0000              and eax, 0000FFFF
:0045FF0D 8BE5                    mov esp, ebp
:0045FF0F 5D                      pop ebp
:0045FF10 C3                      ret



* Referenced by a CALL at Address:
|:0045F979   
|
:0045FF11 55                      push ebp
:0045FF12 8BEC                    mov ebp, esp
:0045FF14 83EC28                  sub esp, 00000028
:0045FF17 C745D80B000000          mov [ebp-28], 0000000B

* Possible StringData Ref from Code Obj ->"UQEE}"
                                  |
:0045FF1E C745DCF2054600          mov [ebp-24], 004605F2
:0045FF25 C745E000000000          mov [ebp-20], 00000000
:0045FF2C C745E400000000          mov [ebp-1C], 00000000
:0045FF33 8B4508                  mov eax, dword ptr [ebp+08]
:0045FF36 8945E8                  mov dword ptr [ebp-18], eax
:0045FF39 C745EC00000000          mov [ebp-14], 00000000
:0045FF40 C745F000000000          mov [ebp-10], 00000000

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0045FF47 C745F406000000          mov [ebp-0C], 00000006
:0045FF4E C745F800000000          mov [ebp-08], 00000000

* Possible StringData Ref from Data Obj ->"NamePut"
                                  |
:0045FF55 8B0DE8E44800            mov ecx, dword ptr [0048E4E8]
:0045FF5B 894DFC                  mov dword ptr [ebp-04], ecx
:0045FF5E 8D55D8                  lea edx, dword ptr [ebp-28]
:0045FF61 52                      push edx
:0045FF62 FF1570634800            call dword ptr [00486370]
:0045FF68 25FFFF0000              and eax, 0000FFFF
:0045FF6D 8BE5                    mov esp, ebp
:0045FF6F 5D                      pop ebp
:0045FF70 C3                      ret



* Referenced by a CALL at Address:
|:0045F990   
|
:0045FF71 55                      push ebp
:0045FF72 8BEC                    mov ebp, esp
:0045FF74 83EC28                  sub esp, 00000028
:0045FF77 C745D80B000000          mov [ebp-28], 0000000B

* Possible StringData Ref from Code Obj ->"UQEE}"
                                  |
:0045FF7E C745DC3D064600          mov [ebp-24], 0046063D
:0045FF85 C745E000000000          mov [ebp-20], 00000000
:0045FF8C C745E400000000          mov [ebp-1C], 00000000
:0045FF93 8B4508                  mov eax, dword ptr [ebp+08]
:0045FF96 8945E8                  mov dword ptr [ebp-18], eax
:0045FF99 C745EC00000000          mov [ebp-14], 00000000
:0045FFA0 C745F000000000          mov [ebp-10], 00000000

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0045FFA7 C745F406000000          mov [ebp-0C], 00000006
:0045FFAE C745F800000000          mov [ebp-08], 00000000

* Possible StringData Ref from Data Obj ->"Practice"
                                  |
:0045FFB5 8B0DECE44800            mov ecx, dword ptr [0048E4EC]
:0045FFBB 894DFC                  mov dword ptr [ebp-04], ecx
:0045FFBE 8D55D8                  lea edx, dword ptr [ebp-28]
:0045FFC1 52                      push edx
:0045FFC2 FF1570634800            call dword ptr [00486370]
:0045FFC8 25FFFF0000              and eax, 0000FFFF
:0045FFCD 8BE5                    mov esp, ebp
:0045FFCF 5D                      pop ebp
:0045FFD0 C3                      ret



* Referenced by a CALL at Address:
|:0045F9A7   
|
:0045FFD1 55                      push ebp
:0045FFD2 8BEC                    mov ebp, esp
:0045FFD4 83EC28                  sub esp, 00000028
:0045FFD7 C745D803000000          mov [ebp-28], 00000003

* Possible StringData Ref from Code Obj ->"UQEE}"
                                  |
:0045FFDE C745DC88064600          mov [ebp-24], 00460688
:0045FFE5 C745E000000000          mov [ebp-20], 00000000
:0045FFEC C745E400000000          mov [ebp-1C], 00000000
:0045FFF3 8B4508                  mov eax, dword ptr [ebp+08]
:0045FFF6 8945E8                  mov dword ptr [ebp-18], eax
:0045FFF9 C745EC00000000          mov [ebp-14], 00000000
:00460000 68007F0000              push 00007F00
:00460005 6A00                    push 00000000
:00460007 FF15B0634800            call dword ptr [004863B0]
:0046000D 8945F0                  mov dword ptr [ebp-10], eax

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:00460010 C745F406000000          mov [ebp-0C], 00000006
:00460017 C745F800000000          mov [ebp-08], 00000000

* Possible StringData Ref from Data Obj ->"MgcEffect"
                                  |
:0046001E 8B0DF0E44800            mov ecx, dword ptr [0048E4F0]
:00460024 894DFC                  mov dword ptr [ebp-04], ecx
:00460027 8D55D8                  lea edx, dword ptr [ebp-28]
:0046002A 52                      push edx
:0046002B FF1570634800            call dword ptr [00486370]
:00460031 25FFFF0000              and eax, 0000FFFF
:00460036 8BE5                    mov esp, ebp
:00460038 5D                      pop ebp
:00460039 C3                      ret



* Referenced by a CALL at Address:
|:0045F9BE   
|
:0046003A 55                      push ebp
:0046003B 8BEC                    mov ebp, esp
:0046003D 83EC28                  sub esp, 00000028
:00460040 C745D803000000          mov [ebp-28], 00000003

* Possible StringData Ref from Code Obj ->"UQEE}"
                                  |
:00460047 C745DCD3064600          mov [ebp-24], 004606D3
:0046004E C745E000000000          mov [ebp-20], 00000000
:00460055 C745E400000000          mov [ebp-1C], 00000000
:0046005C 8B4508                  mov eax, dword ptr [ebp+08]
:0046005F 8945E8                  mov dword ptr [ebp-18], eax
:00460062 C745EC00000000          mov [ebp-14], 00000000
:00460069 68007F0000              push 00007F00
:0046006E 6A00                    push 00000000
:00460070 FF15B0634800            call dword ptr [004863B0]
:00460076 8945F0                  mov dword ptr [ebp-10], eax

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:00460079 C745F406000000          mov [ebp-0C], 00000006
:00460080 C745F800000000          mov [ebp-08], 00000000

* Possible StringData Ref from Data Obj ->"MgcInfluence"
                                  |
:00460087 8B0DF4E44800            mov ecx, dword ptr [0048E4F4]
:0046008D 894DFC                  mov dword ptr [ebp-04], ecx
:00460090 8D55D8                  lea edx, dword ptr [ebp-28]
:00460093 52                      push edx
:00460094 FF1570634800            call dword ptr [00486370]
:0046009A 25FFFF0000              and eax, 0000FFFF
:0046009F 8BE5                    mov esp, ebp
:004600A1 5D                      pop ebp
:004600A2 C3                      ret



* Referenced by a CALL at Address:
|:0045F9D5   
|
:004600A3 55                      push ebp
:004600A4 8BEC                    mov ebp, esp
:004600A6 83EC28                  sub esp, 00000028
:004600A9 C745D80B000000          mov [ebp-28], 0000000B

* Possible StringData Ref from Code Obj ->"UQEE}"
                                  |
:004600B0 C745DC1E074600          mov [ebp-24], 0046071E
:004600B7 C745E000000000          mov [ebp-20], 00000000
:004600BE C745E400000000          mov [ebp-1C], 00000000
:004600C5 8B4508                  mov eax, dword ptr [ebp+08]
:004600C8 8945E8                  mov dword ptr [ebp-18], eax
:004600CB C745EC00000000          mov [ebp-14], 00000000
:004600D2 C745F000000000          mov [ebp-10], 00000000

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:004600D9 C745F406000000          mov [ebp-0C], 00000006
:004600E0 C745F800000000          mov [ebp-08], 00000000

* Possible StringData Ref from Data Obj ->"PracMesBox"
                                  |
:004600E7 8B0DF8E44800            mov ecx, dword ptr [0048E4F8]
:004600ED 894DFC                  mov dword ptr [ebp-04], ecx
:004600F0 8D55D8                  lea edx, dword ptr [ebp-28]
:004600F3 52                      push edx
:004600F4 FF1570634800            call dword ptr [00486370]
:004600FA 25FFFF0000              and eax, 0000FFFF
:004600FF 8BE5                    mov esp, ebp
:00460101 5D                      pop ebp
:00460102 C3                      ret



* Referenced by a CALL at Address:
|:0045F9EC   
|
:00460103 55                      push ebp
:00460104 8BEC                    mov ebp, esp
:00460106 83EC28                  sub esp, 00000028
:00460109 C745D80B000000          mov [ebp-28], 0000000B

* Possible StringData Ref from Code Obj ->"UQEE}"
                                  |
:00460110 C745DC69074600          mov [ebp-24], 00460769
:00460117 C745E000000000          mov [ebp-20], 00000000
:0046011E C745E400000000          mov [ebp-1C], 00000000
:00460125 8B4508                  mov eax, dword ptr [ebp+08]
:00460128 8945E8                  mov dword ptr [ebp-18], eax
:0046012B C745EC00000000          mov [ebp-14], 00000000
:00460132 C745F000000000          mov [ebp-10], 00000000

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:00460139 C745F406000000          mov [ebp-0C], 00000006
:00460140 C745F800000000          mov [ebp-08], 00000000

* Possible StringData Ref from Data Obj ->"TokugiEff"
                                  |
:00460147 8B0DFCE44800            mov ecx, dword ptr [0048E4FC]
:0046014D 894DFC                  mov dword ptr [ebp-04], ecx
:00460150 8D55D8                  lea edx, dword ptr [ebp-28]
:00460153 52                      push edx
:00460154 FF1570634800            call dword ptr [00486370]
:0046015A 25FFFF0000              and eax, 0000FFFF
:0046015F 8BE5                    mov esp, ebp
:00460161 5D                      pop ebp
:00460162 C3                      ret



* Referenced by a CALL at Address:
|:0045FA03   
|
:00460163 55                      push ebp
:00460164 8BEC                    mov ebp, esp
:00460166 83EC28                  sub esp, 00000028
:00460169 C745D80B000000          mov [ebp-28], 0000000B

* Possible StringData Ref from Code Obj ->"UQEE}"
                                  |
:00460170 C745DCB4074600          mov [ebp-24], 004607B4
:00460177 C745E000000000          mov [ebp-20], 00000000
:0046017E C745E400000000          mov [ebp-1C], 00000000
:00460185 8B4508                  mov eax, dword ptr [ebp+08]
:00460188 8945E8                  mov dword ptr [ebp-18], eax
:0046018B C745EC00000000          mov [ebp-14], 00000000
:00460192 C745F000000000          mov [ebp-10], 00000000

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:00460199 C745F406000000          mov [ebp-0C], 00000006
:004601A0 C745F800000000          mov [ebp-08], 00000000

* Possible StringData Ref from Data Obj ->"TokugiInf"
                                  |
:004601A7 8B0D00E54800            mov ecx, dword ptr [0048E500]
:004601AD 894DFC                  mov dword ptr [ebp-04], ecx
:004601B0 8D55D8                  lea edx, dword ptr [ebp-28]
:004601B3 52                      push edx
:004601B4 FF1570634800            call dword ptr [00486370]
:004601BA 25FFFF0000              and eax, 0000FFFF
:004601BF 8BE5                    mov esp, ebp
:004601C1 5D                      pop ebp
:004601C2 C3                      ret



* Referenced by a CALL at Address:
|:0045FA31   
|
:004601C3 55                      push ebp
:004601C4 8BEC                    mov ebp, esp
:004601C6 83EC28                  sub esp, 00000028
:004601C9 C745D803000000          mov [ebp-28], 00000003
:004601D0 C745DC95024600          mov [ebp-24], 00460295
:004601D7 C745E000000000          mov [ebp-20], 00000000
:004601DE C745E400000000          mov [ebp-1C], 00000000
:004601E5 8B4508                  mov eax, dword ptr [ebp+08]
:004601E8 8945E8                  mov dword ptr [ebp-18], eax
:004601EB C745EC00000000          mov [ebp-14], 00000000
:004601F2 68007F0000              push 00007F00
:004601F7 6A00                    push 00000000
:004601F9 FF15B0634800            call dword ptr [004863B0]
:004601FF 8945F0                  mov dword ptr [ebp-10], eax

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:00460202 C745F406000000          mov [ebp-0C], 00000006
:00460209 C745F800000000          mov [ebp-08], 00000000

* Possible StringData Ref from Data Obj ->"HexMapName"
                                  |
:00460210 8B0D0CE54800            mov ecx, dword ptr [0048E50C]
:00460216 894DFC                  mov dword ptr [ebp-04], ecx
:00460219 8D55D8                  lea edx, dword ptr [ebp-28]
:0046021C 52                      push edx
:0046021D FF1570634800            call dword ptr [00486370]
:00460223 25FFFF0000              and eax, 0000FFFF
:00460228 8BE5                    mov esp, ebp
:0046022A 5D                      pop ebp
:0046022B C3                      ret



* Referenced by a CALL at Address:
|:0045FA48   
|
:0046022C 55                      push ebp
:0046022D 8BEC                    mov ebp, esp
:0046022F 83EC28                  sub esp, 00000028
:00460232 C745D803000000          mov [ebp-28], 00000003

* Possible StringData Ref from Code Obj ->"UQEE}"
                                  |
:00460239 C745DCE0024600          mov [ebp-24], 004602E0
:00460240 C745E000000000          mov [ebp-20], 00000000
:00460247 C745E400000000          mov [ebp-1C], 00000000
:0046024E 8B4508                  mov eax, dword ptr [ebp+08]
:00460251 8945E8                  mov dword ptr [ebp-18], eax
:00460254 C745EC00000000          mov [ebp-14], 00000000
:0046025B 68007F0000              push 00007F00
:00460260 6A00                    push 00000000
:00460262 FF15B0634800            call dword ptr [004863B0]
:00460268 8945F0                  mov dword ptr [ebp-10], eax

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0046026B C745F406000000          mov [ebp-0C], 00000006
:00460272 C745F800000000          mov [ebp-08], 00000000

* Possible StringData Ref from Data Obj ->"HexTurnName"
                                  |
:00460279 8B0D10E54800            mov ecx, dword ptr [0048E510]
:0046027F 894DFC                  mov dword ptr [ebp-04], ecx
:00460282 8D55D8                  lea edx, dword ptr [ebp-28]
:00460285 52                      push edx
:00460286 FF1570634800            call dword ptr [00486370]
:0046028C 25FFFF0000              and eax, 0000FFFF
:00460291 8BE5                    mov esp, ebp
:00460293 5D                      pop ebp
:00460294 C3                      ret


:00460295 55                      push ebp
:00460296 8BEC                    mov ebp, esp
:00460298 51                      push ecx
:00460299 8B450C                  mov eax, dword ptr [ebp+0C]
:0046029C 8945FC                  mov dword ptr [ebp-04], eax
:0046029F 817DFC11010000          cmp dword ptr [ebp-04], 00000111
:004602A6 7402                    je 004602AA
:004602A8 EB18                    jmp 004602C2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004602A6(C)
|
:004602AA 8B4D14                  mov ecx, dword ptr [ebp+14]
:004602AD 51                      push ecx
:004602AE 8B5510                  mov edx, dword ptr [ebp+10]
:004602B1 52                      push edx
:004602B2 8B450C                  mov eax, dword ptr [ebp+0C]
:004602B5 50                      push eax
:004602B6 8B4D08                  mov ecx, dword ptr [ebp+08]
:004602B9 51                      push ecx
:004602BA FF1578634800            call dword ptr [00486378]
:004602C0 EB18                    jmp 004602DA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004602A8(U)
|
:004602C2 8B5514                  mov edx, dword ptr [ebp+14]
:004602C5 52                      push edx
:004602C6 8B4510                  mov eax, dword ptr [ebp+10]
:004602C9 50                      push eax
:004602CA 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004602CD 51                      push ecx
:004602CE 8B5508                  mov edx, dword ptr [ebp+08]
:004602D1 52                      push edx
:004602D2 E888EC0100              call 0047EF5F
:004602D7 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004602C0(U)
|
:004602DA 8BE5                    mov esp, ebp
:004602DC 5D                      pop ebp
:004602DD C21000                  ret 0010


:004602E0 55                      push ebp
:004602E1 8BEC                    mov ebp, esp
:004602E3 51                      push ecx
:004602E4 8B450C                  mov eax, dword ptr [ebp+0C]
:004602E7 8945FC                  mov dword ptr [ebp-04], eax
:004602EA 817DFC11010000          cmp dword ptr [ebp-04], 00000111
:004602F1 7402                    je 004602F5
:004602F3 EB18                    jmp 0046030D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004602F1(C)
|
:004602F5 8B4D14                  mov ecx, dword ptr [ebp+14]
:004602F8 51                      push ecx
:004602F9 8B5510                  mov edx, dword ptr [ebp+10]
:004602FC 52                      push edx
:004602FD 8B450C                  mov eax, dword ptr [ebp+0C]
:00460300 50                      push eax
:00460301 8B4D08                  mov ecx, dword ptr [ebp+08]
:00460304 51                      push ecx
:00460305 FF1578634800            call dword ptr [00486378]
:0046030B EB18                    jmp 00460325

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004602F3(U)
|
:0046030D 8B5514                  mov edx, dword ptr [ebp+14]
:00460310 52                      push edx
:00460311 8B4510                  mov eax, dword ptr [ebp+10]
:00460314 50                      push eax
:00460315 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00460318 51                      push ecx
:00460319 8B5508                  mov edx, dword ptr [ebp+08]
:0046031C 52                      push edx
:0046031D E83DEC0100              call 0047EF5F
:00460322 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046030B(U)
|
:00460325 8BE5                    mov esp, ebp
:00460327 5D                      pop ebp
:00460328 C21000                  ret 0010


:0046032B 55                      push ebp
:0046032C 8BEC                    mov ebp, esp
:0046032E 51                      push ecx
:0046032F 8B450C                  mov eax, dword ptr [ebp+0C]
:00460332 8945FC                  mov dword ptr [ebp-04], eax
:00460335 817DFC11010000          cmp dword ptr [ebp-04], 00000111
:0046033C 7402                    je 00460340
:0046033E EB18                    jmp 00460358

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046033C(C)
|
:00460340 8B4D14                  mov ecx, dword ptr [ebp+14]
:00460343 51                      push ecx
:00460344 8B5510                  mov edx, dword ptr [ebp+10]
:00460347 52                      push edx
:00460348 8B450C                  mov eax, dword ptr [ebp+0C]
:0046034B 50                      push eax
:0046034C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046034F 51                      push ecx
:00460350 FF1578634800            call dword ptr [00486378]
:00460356 EB18                    jmp 00460370

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046033E(U)
|
:00460358 8B5514                  mov edx, dword ptr [ebp+14]
:0046035B 52                      push edx
:0046035C 8B4510                  mov eax, dword ptr [ebp+10]
:0046035F 50                      push eax
:00460360 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00460363 51                      push ecx
:00460364 8B5508                  mov edx, dword ptr [ebp+08]
:00460367 52                      push edx
:00460368 E8F2EB0100              call 0047EF5F
:0046036D 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00460356(U)
|
:00460370 8BE5                    mov esp, ebp
:00460372 5D                      pop ebp
:00460373 C21000                  ret 0010


:00460376 55                      push ebp
:00460377 8BEC                    mov ebp, esp
:00460379 51                      push ecx
:0046037A 8B450C                  mov eax, dword ptr [ebp+0C]
:0046037D 8945FC                  mov dword ptr [ebp-04], eax
:00460380 817DFC11010000          cmp dword ptr [ebp-04], 00000111
:00460387 7402                    je 0046038B
:00460389 EB18                    jmp 004603A3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00460387(C)
|
:0046038B 8B4D14                  mov ecx, dword ptr [ebp+14]
:0046038E 51                      push ecx
:0046038F 8B5510                  mov edx, dword ptr [ebp+10]
:00460392 52                      push edx
:00460393 8B450C                  mov eax, dword ptr [ebp+0C]
:00460396 50                      push eax
:00460397 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046039A 51                      push ecx
:0046039B FF1578634800            call dword ptr [00486378]
:004603A1 EB18                    jmp 004603BB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00460389(U)
|
:004603A3 8B5514                  mov edx, dword ptr [ebp+14]
:004603A6 52                      push edx
:004603A7 8B4510                  mov eax, dword ptr [ebp+10]
:004603AA 50                      push eax
:004603AB 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004603AE 51                      push ecx
:004603AF 8B5508                  mov edx, dword ptr [ebp+08]
:004603B2 52                      push edx
:004603B3 E8A7EB0100              call 0047EF5F
:004603B8 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004603A1(U)
|
:004603BB 8BE5                    mov esp, ebp
:004603BD 5D                      pop ebp
:004603BE C21000                  ret 0010


:004603C1 55                      push ebp
:004603C2 8BEC                    mov ebp, esp
:004603C4 83EC08                  sub esp, 00000008
:004603C7 8B450C                  mov eax, dword ptr [ebp+0C]
:004603CA 8945FC                  mov dword ptr [ebp-04], eax
:004603CD 837DFC10                cmp dword ptr [ebp-04], 00000010
:004603D1 7711                    ja 004603E4
:004603D3 837DFC10                cmp dword ptr [ebp-04], 00000010
:004603D7 746C                    je 00460445
:004603D9 837DFC02                cmp dword ptr [ebp-04], 00000002
:004603DD 7466                    je 00460445
:004603DF E90F010000              jmp 004604F3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004603D1(C)
|
:004603E4 817DFC00020000          cmp dword ptr [ebp-04], 00000200
:004603EB 771B                    ja 00460408
:004603ED 817DFC00020000          cmp dword ptr [ebp-04], 00000200
:004603F4 0F8493000000            je 0046048D
:004603FA 817DFC11010000          cmp dword ptr [ebp-04], 00000111
:00460401 7455                    je 00460458
:00460403 E9EB000000              jmp 004604F3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004603EB(C)
|
:00460408 817DFC01020000          cmp dword ptr [ebp-04], 00000201
:0046040F 0F84A4000000            je 004604B9
:00460415 817DFC02020000          cmp dword ptr [ebp-04], 00000202
:0046041C 0F84C7000000            je 004604E9
:00460422 817DFC11030000          cmp dword ptr [ebp-04], 00000311
:00460429 7405                    je 00460430
:0046042B E9C3000000              jmp 004604F3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00460429(C)
|
:00460430 8B4D10                  mov ecx, dword ptr [ebp+10]
:00460433 51                      push ecx
:00460434 8B5508                  mov edx, dword ptr [ebp+08]
:00460437 52                      push edx
:00460438 E841210100              call 0047257E
:0046043D 83C408                  add esp, 00000008
:00460440 E9AE000000              jmp 004604F3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004603D7(C), :004603DD(C)
|
:00460445 6A00                    push 00000000
:00460447 8B4508                  mov eax, dword ptr [ebp+08]
:0046044A 50                      push eax
:0046044B FF15E0624800            call dword ptr [004862E0]
:00460451 33C0                    xor eax, eax
:00460453 E9B3000000              jmp 0046050B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00460401(C)
|
:00460458 8B4D10                  mov ecx, dword ptr [ebp+10]
:0046045B 894DF8                  mov dword ptr [ebp-08], ecx
:0046045E 817DF8BD9C0000          cmp dword ptr [ebp-08], 00009CBD
:00460465 7402                    je 00460469
:00460467 EB0C                    jmp 00460475

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00460465(C)
|
:00460469 6A00                    push 00000000
:0046046B 8B5508                  mov edx, dword ptr [ebp+08]
:0046046E 52                      push edx
:0046046F FF15E0624800            call dword ptr [004862E0]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00460467(U)
|
:00460475 8B4514                  mov eax, dword ptr [ebp+14]
:00460478 50                      push eax
:00460479 8B4D10                  mov ecx, dword ptr [ebp+10]
:0046047C 51                      push ecx
:0046047D 8B550C                  mov edx, dword ptr [ebp+0C]
:00460480 52                      push edx
:00460481 8B4508                  mov eax, dword ptr [ebp+08]
:00460484 50                      push eax
:00460485 FF1578634800            call dword ptr [00486378]
:0046048B EB7E                    jmp 0046050B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004603F4(C)
|
:0046048D 8B4D10                  mov ecx, dword ptr [ebp+10]
:00460490 83E101                  and ecx, 00000001
:00460493 85C9                    test ecx, ecx
:00460495 7420                    je 004604B7
:00460497 B9805F4B00              mov ecx, 004B5F80
:0046049C E8CF9CFBFF              call 0041A170
:004604A1 85C0                    test eax, eax
:004604A3 7412                    je 004604B7
:004604A5 8B5514                  mov edx, dword ptr [ebp+14]
:004604A8 52                      push edx
:004604A9 8B4508                  mov eax, dword ptr [ebp+08]
:004604AC 50                      push eax
:004604AD B9805F4B00              mov ecx, 004B5F80
:004604B2 E80B0A0000              call 00460EC2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00460495(C), :004604A3(C)
|
:004604B7 EB3A                    jmp 004604F3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046040F(C)
|
:004604B9 B9083D4B00              mov ecx, 004B3D08
:004604BE E85DF4FEFF              call 0044F920
:004604C3 85C0                    test eax, eax
:004604C5 7420                    je 004604E7
:004604C7 B9805F4B00              mov ecx, 004B5F80
:004604CC E89F9CFBFF              call 0041A170
:004604D1 85C0                    test eax, eax
:004604D3 7412                    je 004604E7
:004604D5 8B4D14                  mov ecx, dword ptr [ebp+14]
:004604D8 51                      push ecx
:004604D9 8B5508                  mov edx, dword ptr [ebp+08]
:004604DC 52                      push edx
:004604DD B9805F4B00              mov ecx, 004B5F80
:004604E2 E8CA070000              call 00460CB1

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004604C5(C), :004604D3(C)
|
:004604E7 EB0A                    jmp 004604F3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046041C(C)
|
:004604E9 B9805F4B00              mov ecx, 004B5F80
:004604EE E8640C0000              call 00461157

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004603DF(U), :00460403(U), :0046042B(U), :00460440(U), :004604B7(U)
|:004604E7(U)
|
:004604F3 8B4514                  mov eax, dword ptr [ebp+14]
:004604F6 50                      push eax
:004604F7 8B4D10                  mov ecx, dword ptr [ebp+10]
:004604FA 51                      push ecx
:004604FB 8B550C                  mov edx, dword ptr [ebp+0C]
:004604FE 52                      push edx
:004604FF 8B4508                  mov eax, dword ptr [ebp+08]
:00460502 50                      push eax
:00460503 E857EA0100              call 0047EF5F
:00460508 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00460453(U), :0046048B(U)
|
:0046050B 8BE5                    mov esp, ebp
:0046050D 5D                      pop ebp
:0046050E C21000                  ret 0010


:00460511 55                      push ebp
:00460512 8BEC                    mov ebp, esp
:00460514 51                      push ecx
:00460515 8B450C                  mov eax, dword ptr [ebp+0C]
:00460518 8945FC                  mov dword ptr [ebp-04], eax
:0046051B 817DFC11010000          cmp dword ptr [ebp-04], 00000111
:00460522 7402                    je 00460526
:00460524 EB18                    jmp 0046053E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00460522(C)
|
:00460526 8B4D14                  mov ecx, dword ptr [ebp+14]
:00460529 51                      push ecx
:0046052A 8B5510                  mov edx, dword ptr [ebp+10]
:0046052D 52                      push edx
:0046052E 8B450C                  mov eax, dword ptr [ebp+0C]
:00460531 50                      push eax
:00460532 8B4D08                  mov ecx, dword ptr [ebp+08]
:00460535 51                      push ecx
:00460536 FF1578634800            call dword ptr [00486378]
:0046053C EB18                    jmp 00460556

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00460524(U)
|
:0046053E 8B5514                  mov edx, dword ptr [ebp+14]
:00460541 52                      push edx
:00460542 8B4510                  mov eax, dword ptr [ebp+10]
:00460545 50                      push eax
:00460546 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00460549 51                      push ecx
:0046054A 8B5508                  mov edx, dword ptr [ebp+08]
:0046054D 52                      push edx
:0046054E E80CEA0100              call 0047EF5F
:00460553 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046053C(U)
|
:00460556 8BE5                    mov esp, ebp
:00460558 5D                      pop ebp
:00460559 C21000                  ret 0010


:0046055C 55                      push ebp
:0046055D 8BEC                    mov ebp, esp
:0046055F 51                      push ecx
:00460560 8B450C                  mov eax, dword ptr [ebp+0C]
:00460563 8945FC                  mov dword ptr [ebp-04], eax
:00460566 817DFC11010000          cmp dword ptr [ebp-04], 00000111
:0046056D 7402                    je 00460571
:0046056F EB18                    jmp 00460589

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046056D(C)
|
:00460571 8B4D14                  mov ecx, dword ptr [ebp+14]
:00460574 51                      push ecx
:00460575 8B5510                  mov edx, dword ptr [ebp+10]
:00460578 52                      push edx
:00460579 8B450C                  mov eax, dword ptr [ebp+0C]
:0046057C 50                      push eax
:0046057D 8B4D08                  mov ecx, dword ptr [ebp+08]
:00460580 51                      push ecx
:00460581 FF1578634800            call dword ptr [00486378]
:00460587 EB18                    jmp 004605A1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046056F(U)
|
:00460589 8B5514                  mov edx, dword ptr [ebp+14]
:0046058C 52                      push edx
:0046058D 8B4510                  mov eax, dword ptr [ebp+10]
:00460590 50                      push eax
:00460591 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00460594 51                      push ecx
:00460595 8B5508                  mov edx, dword ptr [ebp+08]
:00460598 52                      push edx
:00460599 E8C1E90100              call 0047EF5F
:0046059E 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00460587(U)
|
:004605A1 8BE5                    mov esp, ebp
:004605A3 5D                      pop ebp
:004605A4 C21000                  ret 0010


:004605A7 55                      push ebp
:004605A8 8BEC                    mov ebp, esp
:004605AA 51                      push ecx
:004605AB 8B450C                  mov eax, dword ptr [ebp+0C]
:004605AE 8945FC                  mov dword ptr [ebp-04], eax
:004605B1 817DFC11010000          cmp dword ptr [ebp-04], 00000111
:004605B8 7402                    je 004605BC
:004605BA EB18                    jmp 004605D4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004605B8(C)
|
:004605BC 8B4D14                  mov ecx, dword ptr [ebp+14]
:004605BF 51                      push ecx
:004605C0 8B5510                  mov edx, dword ptr [ebp+10]
:004605C3 52                      push edx
:004605C4 8B450C                  mov eax, dword ptr [ebp+0C]
:004605C7 50                      push eax
:004605C8 8B4D08                  mov ecx, dword ptr [ebp+08]
:004605CB 51                      push ecx
:004605CC FF1578634800            call dword ptr [00486378]
:004605D2 EB18                    jmp 004605EC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004605BA(U)
|
:004605D4 8B5514                  mov edx, dword ptr [ebp+14]
:004605D7 52                      push edx
:004605D8 8B4510                  mov eax, dword ptr [ebp+10]
:004605DB 50                      push eax
:004605DC 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004605DF 51                      push ecx
:004605E0 8B5508                  mov edx, dword ptr [ebp+08]
:004605E3 52                      push edx
:004605E4 E876E90100              call 0047EF5F
:004605E9 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004605D2(U)
|
:004605EC 8BE5                    mov esp, ebp
:004605EE 5D                      pop ebp
:004605EF C21000                  ret 0010


:004605F2 55                      push ebp
:004605F3 8BEC                    mov ebp, esp
:004605F5 51                      push ecx
:004605F6 8B450C                  mov eax, dword ptr [ebp+0C]
:004605F9 8945FC                  mov dword ptr [ebp-04], eax
:004605FC 817DFC11010000          cmp dword ptr [ebp-04], 00000111
:00460603 7402                    je 00460607
:00460605 EB18                    jmp 0046061F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00460603(C)
|
:00460607 8B4D14                  mov ecx, dword ptr [ebp+14]
:0046060A 51                      push ecx
:0046060B 8B5510                  mov edx, dword ptr [ebp+10]
:0046060E 52                      push edx
:0046060F 8B450C                  mov eax, dword ptr [ebp+0C]
:00460612 50                      push eax
:00460613 8B4D08                  mov ecx, dword ptr [ebp+08]
:00460616 51                      push ecx
:00460617 FF1578634800            call dword ptr [00486378]
:0046061D EB18                    jmp 00460637

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00460605(U)
|
:0046061F 8B5514                  mov edx, dword ptr [ebp+14]
:00460622 52                      push edx
:00460623 8B4510                  mov eax, dword ptr [ebp+10]
:00460626 50                      push eax
:00460627 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046062A 51                      push ecx
:0046062B 8B5508                  mov edx, dword ptr [ebp+08]
:0046062E 52                      push edx
:0046062F E82BE90100              call 0047EF5F
:00460634 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046061D(U)
|
:00460637 8BE5                    mov esp, ebp
:00460639 5D                      pop ebp
:0046063A C21000                  ret 0010


:0046063D 55                      push ebp
:0046063E 8BEC                    mov ebp, esp
:00460640 51                      push ecx
:00460641 8B450C                  mov eax, dword ptr [ebp+0C]
:00460644 8945FC                  mov dword ptr [ebp-04], eax
:00460647 817DFC11010000          cmp dword ptr [ebp-04], 00000111
:0046064E 7402                    je 00460652
:00460650 EB18                    jmp 0046066A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046064E(C)
|
:00460652 8B4D14                  mov ecx, dword ptr [ebp+14]
:00460655 51                      push ecx
:00460656 8B5510                  mov edx, dword ptr [ebp+10]
:00460659 52                      push edx
:0046065A 8B450C                  mov eax, dword ptr [ebp+0C]
:0046065D 50                      push eax
:0046065E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00460661 51                      push ecx
:00460662 FF1578634800            call dword ptr [00486378]
:00460668 EB18                    jmp 00460682

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00460650(U)
|
:0046066A 8B5514                  mov edx, dword ptr [ebp+14]
:0046066D 52                      push edx
:0046066E 8B4510                  mov eax, dword ptr [ebp+10]
:00460671 50                      push eax
:00460672 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00460675 51                      push ecx
:00460676 8B5508                  mov edx, dword ptr [ebp+08]
:00460679 52                      push edx
:0046067A E8E0E80100              call 0047EF5F
:0046067F 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00460668(U)
|
:00460682 8BE5                    mov esp, ebp
:00460684 5D                      pop ebp
:00460685 C21000                  ret 0010


:00460688 55                      push ebp
:00460689 8BEC                    mov ebp, esp
:0046068B 51                      push ecx
:0046068C 8B450C                  mov eax, dword ptr [ebp+0C]
:0046068F 8945FC                  mov dword ptr [ebp-04], eax
:00460692 817DFC11010000          cmp dword ptr [ebp-04], 00000111
:00460699 7402                    je 0046069D
:0046069B EB18                    jmp 004606B5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00460699(C)
|
:0046069D 8B4D14                  mov ecx, dword ptr [ebp+14]
:004606A0 51                      push ecx
:004606A1 8B5510                  mov edx, dword ptr [ebp+10]
:004606A4 52                      push edx
:004606A5 8B450C                  mov eax, dword ptr [ebp+0C]
:004606A8 50                      push eax
:004606A9 8B4D08                  mov ecx, dword ptr [ebp+08]
:004606AC 51                      push ecx
:004606AD FF1578634800            call dword ptr [00486378]
:004606B3 EB18                    jmp 004606CD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046069B(U)
|
:004606B5 8B5514                  mov edx, dword ptr [ebp+14]
:004606B8 52                      push edx
:004606B9 8B4510                  mov eax, dword ptr [ebp+10]
:004606BC 50                      push eax
:004606BD 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004606C0 51                      push ecx
:004606C1 8B5508                  mov edx, dword ptr [ebp+08]
:004606C4 52                      push edx
:004606C5 E895E80100              call 0047EF5F
:004606CA 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004606B3(U)
|
:004606CD 8BE5                    mov esp, ebp
:004606CF 5D                      pop ebp
:004606D0 C21000                  ret 0010


:004606D3 55                      push ebp
:004606D4 8BEC                    mov ebp, esp
:004606D6 51                      push ecx
:004606D7 8B450C                  mov eax, dword ptr [ebp+0C]
:004606DA 8945FC                  mov dword ptr [ebp-04], eax
:004606DD 817DFC11010000          cmp dword ptr [ebp-04], 00000111
:004606E4 7402                    je 004606E8
:004606E6 EB18                    jmp 00460700

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004606E4(C)
|
:004606E8 8B4D14                  mov ecx, dword ptr [ebp+14]
:004606EB 51                      push ecx
:004606EC 8B5510                  mov edx, dword ptr [ebp+10]
:004606EF 52                      push edx
:004606F0 8B450C                  mov eax, dword ptr [ebp+0C]
:004606F3 50                      push eax
:004606F4 8B4D08                  mov ecx, dword ptr [ebp+08]
:004606F7 51                      push ecx
:004606F8 FF1578634800            call dword ptr [00486378]
:004606FE EB18                    jmp 00460718

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004606E6(U)
|
:00460700 8B5514                  mov edx, dword ptr [ebp+14]
:00460703 52                      push edx
:00460704 8B4510                  mov eax, dword ptr [ebp+10]
:00460707 50                      push eax
:00460708 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046070B 51                      push ecx
:0046070C 8B5508                  mov edx, dword ptr [ebp+08]
:0046070F 52                      push edx
:00460710 E84AE80100              call 0047EF5F
:00460715 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004606FE(U)
|
:00460718 8BE5                    mov esp, ebp
:0046071A 5D                      pop ebp
:0046071B C21000                  ret 0010


:0046071E 55                      push ebp
:0046071F 8BEC                    mov ebp, esp
:00460721 51                      push ecx
:00460722 8B450C                  mov eax, dword ptr [ebp+0C]
:00460725 8945FC                  mov dword ptr [ebp-04], eax
:00460728 817DFC11010000          cmp dword ptr [ebp-04], 00000111
:0046072F 7402                    je 00460733
:00460731 EB18                    jmp 0046074B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046072F(C)
|
:00460733 8B4D14                  mov ecx, dword ptr [ebp+14]
:00460736 51                      push ecx
:00460737 8B5510                  mov edx, dword ptr [ebp+10]
:0046073A 52                      push edx
:0046073B 8B450C                  mov eax, dword ptr [ebp+0C]
:0046073E 50                      push eax
:0046073F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00460742 51                      push ecx
:00460743 FF1578634800            call dword ptr [00486378]
:00460749 EB18                    jmp 00460763

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00460731(U)
|
:0046074B 8B5514                  mov edx, dword ptr [ebp+14]
:0046074E 52                      push edx
:0046074F 8B4510                  mov eax, dword ptr [ebp+10]
:00460752 50                      push eax
:00460753 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00460756 51                      push ecx
:00460757 8B5508                  mov edx, dword ptr [ebp+08]
:0046075A 52                      push edx
:0046075B E8FFE70100              call 0047EF5F
:00460760 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00460749(U)
|
:00460763 8BE5                    mov esp, ebp
:00460765 5D                      pop ebp
:00460766 C21000                  ret 0010


:00460769 55                      push ebp
:0046076A 8BEC                    mov ebp, esp
:0046076C 51                      push ecx
:0046076D 8B450C                  mov eax, dword ptr [ebp+0C]
:00460770 8945FC                  mov dword ptr [ebp-04], eax
:00460773 817DFC11010000          cmp dword ptr [ebp-04], 00000111
:0046077A 7402                    je 0046077E
:0046077C EB18                    jmp 00460796

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046077A(C)
|
:0046077E 8B4D14                  mov ecx, dword ptr [ebp+14]
:00460781 51                      push ecx
:00460782 8B5510                  mov edx, dword ptr [ebp+10]
:00460785 52                      push edx
:00460786 8B450C                  mov eax, dword ptr [ebp+0C]
:00460789 50                      push eax
:0046078A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046078D 51                      push ecx
:0046078E FF1578634800            call dword ptr [00486378]
:00460794 EB18                    jmp 004607AE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046077C(U)
|
:00460796 8B5514                  mov edx, dword ptr [ebp+14]
:00460799 52                      push edx
:0046079A 8B4510                  mov eax, dword ptr [ebp+10]
:0046079D 50                      push eax
:0046079E 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004607A1 51                      push ecx
:004607A2 8B5508                  mov edx, dword ptr [ebp+08]
:004607A5 52                      push edx
:004607A6 E8B4E70100              call 0047EF5F
:004607AB 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00460794(U)
|
:004607AE 8BE5                    mov esp, ebp
:004607B0 5D                      pop ebp
:004607B1 C21000                  ret 0010


:004607B4 55                      push ebp
:004607B5 8BEC                    mov ebp, esp
:004607B7 51                      push ecx
:004607B8 8B450C                  mov eax, dword ptr [ebp+0C]
:004607BB 8945FC                  mov dword ptr [ebp-04], eax
:004607BE 817DFC11010000          cmp dword ptr [ebp-04], 00000111
:004607C5 7402                    je 004607C9
:004607C7 EB18                    jmp 004607E1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004607C5(C)
|
:004607C9 8B4D14                  mov ecx, dword ptr [ebp+14]
:004607CC 51                      push ecx
:004607CD 8B5510                  mov edx, dword ptr [ebp+10]
:004607D0 52                      push edx
:004607D1 8B450C                  mov eax, dword ptr [ebp+0C]
:004607D4 50                      push eax
:004607D5 8B4D08                  mov ecx, dword ptr [ebp+08]
:004607D8 51                      push ecx
:004607D9 FF1578634800            call dword ptr [00486378]
:004607DF EB18                    jmp 004607F9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004607C7(U)
|
:004607E1 8B5514                  mov edx, dword ptr [ebp+14]
:004607E4 52                      push edx
:004607E5 8B4510                  mov eax, dword ptr [ebp+10]
:004607E8 50                      push eax
:004607E9 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004607EC 51                      push ecx
:004607ED 8B5508                  mov edx, dword ptr [ebp+08]
:004607F0 52                      push edx
:004607F1 E869E70100              call 0047EF5F
:004607F6 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004607DF(U)
|
:004607F9 8BE5                    mov esp, ebp
:004607FB 5D                      pop ebp
:004607FC C21000                  ret 0010



* Referenced by a CALL at Addresses:
|:0042B641   , :0042BFAB   , :00479BCD   
|
:004607FF 55                      push ebp
:00460800 8BEC                    mov ebp, esp
:00460802 51                      push ecx
:00460803 C745FC00000000          mov [ebp-04], 00000000
:0046080A EB09                    jmp 00460815

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00460853(U)
|
:0046080C 8B45FC                  mov eax, dword ptr [ebp-04]
:0046080F 83C001                  add eax, 00000001
:00460812 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046080A(U)
|
:00460815 837DFC15                cmp dword ptr [ebp-04], 00000015
:00460819 7D3A                    jge 00460855
:0046081B 837DFC02                cmp dword ptr [ebp-04], 00000002
:0046081F 7415                    je 00460836
:00460821 6A00                    push 00000000
:00460823 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00460826 8B148DD05F4B00          mov edx, dword ptr [4*ecx+004B5FD0]
:0046082D 52                      push edx
:0046082E FF15E0624800            call dword ptr [004862E0]
:00460834 EB1D                    jmp 00460853

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046081F(C)
|
:00460836 6A00                    push 00000000
:00460838 68BD9C0000              push 00009CBD
:0046083D 6811010000              push 00000111
:00460842 8B45FC                  mov eax, dword ptr [ebp-04]
:00460845 8B0C85D05F4B00          mov ecx, dword ptr [4*eax+004B5FD0]
:0046084C 51                      push ecx
:0046084D FF15F4624800            call dword ptr [004862F4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00460834(U)
|
:00460853 EBB7                    jmp 0046080C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00460819(C)
|
:00460855 6A00                    push 00000000
:00460857 E887C20100              call 0047CAE3
:0046085C 83C404                  add esp, 00000004
:0046085F 8BE5                    mov esp, ebp
:00460861 5D                      pop ebp
:00460862 C3                      ret



* Referenced by a CALL at Address:
|:00478921   
|
:00460863 55                      push ebp
:00460864 8BEC                    mov ebp, esp
:00460866 83EC10                  sub esp, 00000010
:00460869 6834040000              push 00000434
:0046086E A108754B00              mov eax, dword ptr [004B7508]
:00460873 50                      push eax
:00460874 FF15DC624800            call dword ptr [004862DC]
:0046087A 50                      push eax
:0046087B 8B0DD05F4B00            mov ecx, dword ptr [004B5FD0]
:00460881 51                      push ecx
:00460882 FF157C634800            call dword ptr [0048637C]
:00460888 8D55F0                  lea edx, dword ptr [ebp-10]
:0046088B 52                      push edx
:0046088C 6834040000              push 00000434
:00460891 A108754B00              mov eax, dword ptr [004B7508]
:00460896 50                      push eax
:00460897 FF15DC624800            call dword ptr [004862DC]
:0046089D 50                      push eax
:0046089E E8C7120000              call 00461B6A
:004608A3 83C408                  add esp, 00000008
:004608A6 6A0C                    push 0000000C
:004608A8 8B0DFC674800            mov ecx, dword ptr [004867FC]
:004608AE 83C102                  add ecx, 00000002
:004608B1 51                      push ecx
:004608B2 8B15F8674800            mov edx, dword ptr [004867F8]
:004608B8 83C202                  add edx, 00000002
:004608BB 52                      push edx
:004608BC 8B45FC                  mov eax, dword ptr [ebp-04]
:004608BF 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004608C2 8D4401FE                lea eax, dword ptr [ecx+eax-02]
:004608C6 2B05FC674800            sub eax, dword ptr [004867FC]
:004608CC 99                      cdq
:004608CD 2BC2                    sub eax, edx
:004608CF D1F8                    sar eax, 1
:004608D1 50                      push eax
:004608D2 8B55F8                  mov edx, dword ptr [ebp-08]
:004608D5 8B45F0                  mov eax, dword ptr [ebp-10]
:004608D8 8D4410FE                lea eax, dword ptr [eax+edx-02]
:004608DC 2B05F8674800            sub eax, dword ptr [004867F8]
:004608E2 99                      cdq
:004608E3 2BC2                    sub eax, edx
:004608E5 D1F8                    sar eax, 1
:004608E7 50                      push eax
:004608E8 6A00                    push 00000000
:004608EA 6834040000              push 00000434
:004608EF 8B0D08754B00            mov ecx, dword ptr [004B7508]
:004608F5 51                      push ecx
:004608F6 FF15DC624800            call dword ptr [004862DC]
:004608FC 50                      push eax
:004608FD FF1580624800            call dword ptr [00486280]
:00460903 6A00                    push 00000000
:00460905 8B15FC674800            mov edx, dword ptr [004867FC]
:0046090B 52                      push edx
:0046090C A1F8674800              mov eax, dword ptr [004867F8]
:00460911 50                      push eax
:00460912 6A00                    push 00000000
:00460914 6A00                    push 00000000
:00460916 8B0DD05F4B00            mov ecx, dword ptr [004B5FD0]
:0046091C 51                      push ecx
:0046091D FF15BC624800            call dword ptr [004862BC]
:00460923 6A05                    push 00000005
:00460925 8B15D05F4B00            mov edx, dword ptr [004B5FD0]
:0046092B 52                      push edx
:0046092C FF15E0624800            call dword ptr [004862E0]
:00460932 8BE5                    mov esp, ebp
:00460934 5D                      pop ebp
:00460935 C3                      ret



* Referenced by a CALL at Address:
|:00429F7D   
|
:00460936 55                      push ebp
:00460937 8BEC                    mov ebp, esp
:00460939 83EC28                  sub esp, 00000028
:0046093C 56                      push esi
:0046093D 894DD8                  mov dword ptr [ebp-28], ecx
:00460940 668B450C                mov ax, word ptr [ebp+0C]
:00460944 50                      push eax
:00460945 E85E61FCFF              call 00426AA8
:0046094A 83C404                  add esp, 00000004
:0046094D 8945E8                  mov dword ptr [ebp-18], eax
:00460950 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00460953 E8C8A0FCFF              call 0042AA20
:00460958 668945E4                mov word ptr [ebp-1C], ax
:0046095C 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0046095F E86CA4FCFF              call 0042ADD0
:00460964 668945E0                mov word ptr [ebp-20], ax
:00460968 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0046096B E880A4FCFF              call 0042ADF0
:00460970 50                      push eax
:00460971 8D4DE0                  lea ecx, dword ptr [ebp-20]
:00460974 51                      push ecx
:00460975 8D55E4                  lea edx, dword ptr [ebp-1C]
:00460978 52                      push edx
:00460979 E84769FCFF              call 004272C5
:0046097E 83C40C                  add esp, 0000000C
:00460981 8D45F0                  lea eax, dword ptr [ebp-10]
:00460984 50                      push eax
:00460985 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:0046098B 51                      push ecx
:0046098C FF15EC624800            call dword ptr [004862EC]
:00460992 8B5508                  mov edx, dword ptr [ebp+08]
:00460995 52                      push edx
:00460996 FF1520614800            call dword ptr [00486120]
:0046099C 8945EC                  mov dword ptr [ebp-14], eax
:0046099F 837DEC00                cmp dword ptr [ebp-14], 00000000
:004609A3 7444                    je 004609E9
:004609A5 B970074B00              mov ecx, 004B0770
:004609AA E8B2C8FAFF              call 0040D261
:004609AF 85C0                    test eax, eax
:004609B1 7436                    je 004609E9
:004609B3 8B45E0                  mov eax, dword ptr [ebp-20]
:004609B6 25FFFF0000              and eax, 0000FFFF
:004609BB 83F828                  cmp eax, 00000028
:004609BE 7C29                    jl 004609E9
:004609C0 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004609C3 81E1FFFF0000            and ecx, 0000FFFF
:004609C9 3B4DF0                  cmp ecx, dword ptr [ebp-10]
:004609CC 7C1B                    jl 004609E9
:004609CE 8B55E4                  mov edx, dword ptr [ebp-1C]
:004609D1 81E2FFFF0000            and edx, 0000FFFF
:004609D7 3B55F8                  cmp edx, dword ptr [ebp-08]
:004609DA 7F0D                    jg 004609E9
:004609DC 8B45E0                  mov eax, dword ptr [ebp-20]
:004609DF 25FFFF0000              and eax, 0000FFFF
:004609E4 3B45FC                  cmp eax, dword ptr [ebp-04]
:004609E7 7E21                    jle 00460A0A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004609A3(C), :004609B1(C), :004609BE(C), :004609CC(C), :004609DA(C)
|
:004609E9 8B4DD8                  mov ecx, dword ptr [ebp-28]
:004609EC E8AD010000              call 00460B9E
:004609F1 6844604B00              push 004B6044
:004609F6 8B4DD8                  mov ecx, dword ptr [ebp-28]
:004609F9 83C10C                  add ecx, 0000000C
:004609FC 51                      push ecx
:004609FD E87BF20100              call 0047FC7D
:00460A02 83C408                  add esp, 00000008
:00460A05 E98D010000              jmp 00460B97

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004609E7(C)
|
:00460A0A 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00460A0D E85A020000              call 00460C6C
:00460A12 8B55EC                  mov edx, dword ptr [ebp-14]
:00460A15 52                      push edx
:00460A16 8B4508                  mov eax, dword ptr [ebp+08]
:00460A19 50                      push eax
:00460A1A 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00460A1D E8A9010000              call 00460BCB
:00460A22 8945DC                  mov dword ptr [ebp-24], eax
:00460A25 B9B07F4900              mov ecx, 00497FB0
:00460A2A E8DE51FCFF              call 00425C0D
:00460A2F 83F801                  cmp eax, 00000001
:00460A32 750D                    jne 00460A41
:00460A34 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00460A37 E862010000              call 00460B9E
:00460A3C E956010000              jmp 00460B97

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00460A32(C)
|
:00460A41 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00460A44 81E1FFFF0000            and ecx, 0000FFFF
:00460A4A 83C108                  add ecx, 00000008
:00460A4D 8B55D8                  mov edx, dword ptr [ebp-28]
:00460A50 390A                    cmp dword ptr [edx], ecx
:00460A52 7F55                    jg 00460AA9
:00460A54 8B45E4                  mov eax, dword ptr [ebp-1C]
:00460A57 25FFFF0000              and eax, 0000FFFF
:00460A5C 83E808                  sub eax, 00000008
:00460A5F 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00460A62 3901                    cmp dword ptr [ecx], eax
:00460A64 7C43                    jl 00460AA9
:00460A66 8B55E0                  mov edx, dword ptr [ebp-20]
:00460A69 81E2FFFF0000            and edx, 0000FFFF
:00460A6F 83C208                  add edx, 00000008
:00460A72 8B45D8                  mov eax, dword ptr [ebp-28]
:00460A75 395004                  cmp dword ptr [eax+04], edx
:00460A78 7F2F                    jg 00460AA9
:00460A7A 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00460A7D 81E1FFFF0000            and ecx, 0000FFFF
:00460A83 83E908                  sub ecx, 00000008
:00460A86 8B55D8                  mov edx, dword ptr [ebp-28]
:00460A89 394A04                  cmp dword ptr [edx+04], ecx
:00460A8C 7C1B                    jl 00460AA9
:00460A8E 8B45D8                  mov eax, dword ptr [ebp-28]
:00460A91 83C00C                  add eax, 0000000C
:00460A94 50                      push eax
:00460A95 8B4D08                  mov ecx, dword ptr [ebp+08]
:00460A98 51                      push ecx
:00460A99 E825F20100              call 0047FCC3
:00460A9E 83C408                  add esp, 00000008
:00460AA1 85C0                    test eax, eax
:00460AA3 0F84EE000000            je 00460B97

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00460A52(C), :00460A64(C), :00460A78(C), :00460A8C(C)
|
:00460AA9 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00460AAC E8ED000000              call 00460B9E
:00460AB1 8B75E4                  mov esi, dword ptr [ebp-1C]
:00460AB4 81E6FFFF0000            and esi, 0000FFFF
:00460ABA B950424B00              mov ecx, 004B4250
:00460ABF E88053FFFF              call 00455E44
:00460AC4 2B45DC                  sub eax, dword ptr [ebp-24]
:00460AC7 83E820                  sub eax, 00000020
:00460ACA 3BF0                    cmp esi, eax
:00460ACC 7C13                    jl 00460AE1
:00460ACE 8B55E4                  mov edx, dword ptr [ebp-1C]
:00460AD1 81E2FFFF0000            and edx, 0000FFFF
:00460AD7 2B55DC                  sub edx, dword ptr [ebp-24]
:00460ADA 83EA28                  sub edx, 00000028
:00460ADD 668955E4                mov word ptr [ebp-1C], dx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00460ACC(C)
|
:00460AE1 8B45E0                  mov eax, dword ptr [ebp-20]
:00460AE4 25FFFF0000              and eax, 0000FFFF
:00460AE9 83E820                  sub eax, 00000020
:00460AEC 83F828                  cmp eax, 00000028
:00460AEF 7D1E                    jge 00460B0F
:00460AF1 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00460AF4 81E1FFFF0000            and ecx, 0000FFFF
:00460AFA 83E920                  sub ecx, 00000020
:00460AFD BA28000000              mov edx, 00000028
:00460B02 2BD1                    sub edx, ecx
:00460B04 668B45E0                mov ax, word ptr [ebp-20]
:00460B08 6603C2                  add ax, dx
:00460B0B 668945E0                mov word ptr [ebp-20], ax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00460AEF(C)
|
:00460B0F 6A00                    push 00000000
:00460B11 8B0D7C684800            mov ecx, dword ptr [0048687C]
:00460B17 51                      push ecx
:00460B18 8B55DC                  mov edx, dword ptr [ebp-24]
:00460B1B 52                      push edx
:00460B1C 8B45E0                  mov eax, dword ptr [ebp-20]
:00460B1F 25FFFF0000              and eax, 0000FFFF
:00460B24 83E820                  sub eax, 00000020
:00460B27 50                      push eax
:00460B28 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00460B2B 81E1FFFF0000            and ecx, 0000FFFF
:00460B31 83C120                  add ecx, 00000020
:00460B34 51                      push ecx
:00460B35 8B15F05F4B00            mov edx, dword ptr [004B5FF0]
:00460B3B 52                      push edx
:00460B3C FF15BC624800            call dword ptr [004862BC]
:00460B42 8B45D8                  mov eax, dword ptr [ebp-28]
:00460B45 83780800                cmp dword ptr [eax+08], 00000000
:00460B49 744C                    je 00460B97
:00460B4B 6A05                    push 00000005
:00460B4D 8B0DF05F4B00            mov ecx, dword ptr [004B5FF0]
:00460B53 51                      push ecx
:00460B54 FF15E0624800            call dword ptr [004862E0]
:00460B5A 8B55D8                  mov edx, dword ptr [ebp-28]
:00460B5D C7420800000000          mov [edx+08], 00000000
:00460B64 6848604B00              push 004B6048
:00460B69 8B45D8                  mov eax, dword ptr [ebp-28]
:00460B6C 83C00C                  add eax, 0000000C
:00460B6F 50                      push eax
:00460B70 E808F10100              call 0047FC7D
:00460B75 83C408                  add esp, 00000008
:00460B78 8B4D08                  mov ecx, dword ptr [ebp+08]
:00460B7B 51                      push ecx
:00460B7C 8B55D8                  mov edx, dword ptr [ebp-28]
:00460B7F 83C20C                  add edx, 0000000C
:00460B82 52                      push edx
:00460B83 E8F5F00100              call 0047FC7D
:00460B88 83C408                  add esp, 00000008
:00460B8B A1F05F4B00              mov eax, dword ptr [004B5FF0]
:00460B90 50                      push eax
:00460B91 FF15A8624800            call dword ptr [004862A8]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00460A05(U), :00460A3C(U), :00460AA3(C), :00460B49(C)
|
:00460B97 5E                      pop esi
:00460B98 8BE5                    mov esp, ebp
:00460B9A 5D                      pop ebp
:00460B9B C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:00429ABF   , :00429F89   , :00429FE3   , :0044D4A6   , :004609EC   
|:00460A37   , :00460AAC   
|
:00460B9E 55                      push ebp
:00460B9F 8BEC                    mov ebp, esp
:00460BA1 51                      push ecx
:00460BA2 894DFC                  mov dword ptr [ebp-04], ecx
:00460BA5 8B45FC                  mov eax, dword ptr [ebp-04]
:00460BA8 83780800                cmp dword ptr [eax+08], 00000000
:00460BAC 7519                    jne 00460BC7
:00460BAE 6A00                    push 00000000
:00460BB0 8B0DF05F4B00            mov ecx, dword ptr [004B5FF0]
:00460BB6 51                      push ecx
:00460BB7 FF15E0624800            call dword ptr [004862E0]
:00460BBD 8B55FC                  mov edx, dword ptr [ebp-04]
:00460BC0 C7420801000000          mov [edx+08], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00460BAC(C)
|
:00460BC7 8BE5                    mov esp, ebp
:00460BC9 5D                      pop ebp
:00460BCA C3                      ret



* Referenced by a CALL at Address:
|:00460A1D   
|
:00460BCB 55                      push ebp
:00460BCC 8BEC                    mov ebp, esp
:00460BCE 83EC08                  sub esp, 00000008
:00460BD1 894DF8                  mov dword ptr [ebp-08], ecx
:00460BD4 6A09                    push 00000009
:00460BD6 E808BF0100              call 0047CAE3
:00460BDB 83C404                  add esp, 00000004

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:00460BDE 6A07                    push 00000007
:00460BE0 E8E5C50100              call 0047D1CA
:00460BE5 83C404                  add esp, 00000004
:00460BE8 E8EED9FBFF              call 0041E5DB
:00460BED 6A02                    push 00000002
:00460BEF 6A01                    push 00000001
:00460BF1 B9382F4900              mov ecx, 00492F38
:00460BF6 E8DCDFFAFF              call 0040EBD7
:00460BFB 6A1F                    push 0000001F
:00460BFD B9382F4900              mov ecx, 00492F38
:00460C02 E87DE0FAFF              call 0040EC84
:00460C07 6A12                    push 00000012
:00460C09 B9382F4900              mov ecx, 00492F38
:00460C0E E8A9E0FAFF              call 0040ECBC
:00460C13 8B4508                  mov eax, dword ptr [ebp+08]
:00460C16 50                      push eax
:00460C17 68382F4900              push 00492F38
:00460C1C E87FEEFAFF              call 0040FAA0
:00460C21 83C408                  add esp, 00000008
:00460C24 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00460C27 8D14CD10000000          lea edx, dword ptr [8*ecx+00000010]
:00460C2E 8955FC                  mov dword ptr [ebp-04], edx
:00460C31 6A3A                    push 0000003A
:00460C33 6A01                    push 00000001
:00460C35 A17C684800              mov eax, dword ptr [0048687C]
:00460C3A 50                      push eax
:00460C3B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00460C3E 51                      push ecx
:00460C3F 8B1574684800            mov edx, dword ptr [00486874]
:00460C45 52                      push edx
:00460C46 A170684800              mov eax, dword ptr [00486870]
:00460C4B 50                      push eax
:00460C4C E852DAFBFF              call 0041E6A3
:00460C51 83C418                  add esp, 00000018
:00460C54 E89DD9FBFF              call 0041E5F6
:00460C59 6A00                    push 00000000
:00460C5B E883BE0100              call 0047CAE3
:00460C60 83C404                  add esp, 00000004
:00460C63 8B45FC                  mov eax, dword ptr [ebp-04]
:00460C66 8BE5                    mov esp, ebp
:00460C68 5D                      pop ebp
:00460C69 C20800                  ret 0008



* Referenced by a CALL at Address:
|:00460A0D   
|
:00460C6C 55                      push ebp
:00460C6D 8BEC                    mov ebp, esp
:00460C6F 51                      push ecx
:00460C70 894DFC                  mov dword ptr [ebp-04], ecx
:00460C73 6A09                    push 00000009
:00460C75 E869BE0100              call 0047CAE3
:00460C7A 83C404                  add esp, 00000004
:00460C7D 6A12                    push 00000012
:00460C7F 6A00                    push 00000000
:00460C81 A17C684800              mov eax, dword ptr [0048687C]
:00460C86 50                      push eax
:00460C87 8B0D78684800            mov ecx, dword ptr [00486878]
:00460C8D 51                      push ecx
:00460C8E 8B1574684800            mov edx, dword ptr [00486874]
:00460C94 52                      push edx
:00460C95 A170684800              mov eax, dword ptr [00486870]
:00460C9A 50                      push eax
:00460C9B E803DAFBFF              call 0041E6A3
:00460CA0 83C418                  add esp, 00000018
:00460CA3 6A00                    push 00000000
:00460CA5 E839BE0100              call 0047CAE3
:00460CAA 83C404                  add esp, 00000004
:00460CAD 8BE5                    mov esp, ebp
:00460CAF 5D                      pop ebp
:00460CB0 C3                      ret



* Referenced by a CALL at Address:
|:004604E2   
|
:00460CB1 55                      push ebp
:00460CB2 8BEC                    mov ebp, esp
:00460CB4 51                      push ecx
:00460CB5 894DFC                  mov dword ptr [ebp-04], ecx
:00460CB8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00460CBB E899000000              call 00460D59
:00460CC0 8B450C                  mov eax, dword ptr [ebp+0C]
:00460CC3 25FFFF0000              and eax, 0000FFFF
:00460CC8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00460CCB 894110                  mov dword ptr [ecx+10], eax
:00460CCE 8B550C                  mov edx, dword ptr [ebp+0C]
:00460CD1 C1EA10                  shr edx, 10
:00460CD4 81E2FFFF0000            and edx, 0000FFFF
:00460CDA 81E2FFFF0000            and edx, 0000FFFF
:00460CE0 8B45FC                  mov eax, dword ptr [ebp-04]
:00460CE3 895014                  mov dword ptr [eax+14], edx
:00460CE6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00460CE9 8B55FC                  mov edx, dword ptr [ebp-04]
:00460CEC 8B4110                  mov eax, dword ptr [ecx+10]
:00460CEF 3B4228                  cmp eax, dword ptr [edx+28]
:00460CF2 7C57                    jl 00460D4B
:00460CF4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00460CF7 8B55FC                  mov edx, dword ptr [ebp-04]
:00460CFA 8B4110                  mov eax, dword ptr [ecx+10]
:00460CFD 3B4230                  cmp eax, dword ptr [edx+30]
:00460D00 7F49                    jg 00460D4B
:00460D02 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00460D05 8B55FC                  mov edx, dword ptr [ebp-04]
:00460D08 8B4114                  mov eax, dword ptr [ecx+14]
:00460D0B 3B422C                  cmp eax, dword ptr [edx+2C]
:00460D0E 7C3B                    jl 00460D4B
:00460D10 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00460D13 8B55FC                  mov edx, dword ptr [ebp-04]
:00460D16 8B4114                  mov eax, dword ptr [ecx+14]
:00460D19 3B4234                  cmp eax, dword ptr [edx+34]
:00460D1C 7F2D                    jg 00460D4B
:00460D1E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00460D21 51                      push ecx
:00460D22 FF1588634800            call dword ptr [00486388]
:00460D28 8B55FC                  mov edx, dword ptr [ebp-04]
:00460D2B 8B45FC                  mov eax, dword ptr [ebp-04]
:00460D2E 8B4810                  mov ecx, dword ptr [eax+10]
:00460D31 894A08                  mov dword ptr [edx+08], ecx
:00460D34 8B55FC                  mov edx, dword ptr [ebp-04]
:00460D37 8B45FC                  mov eax, dword ptr [ebp-04]
:00460D3A 8B4814                  mov ecx, dword ptr [eax+14]
:00460D3D 894A0C                  mov dword ptr [edx+0C], ecx
:00460D40 8B55FC                  mov edx, dword ptr [ebp-04]
:00460D43 C70201000000            mov dword ptr [edx], 00000001
:00460D49 EB08                    jmp 00460D53

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00460CF2(C), :00460D00(C), :00460D0E(C), :00460D1C(C)
|
:00460D4B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00460D4E E806000000              call 00460D59

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00460D49(U)
|
:00460D53 8BE5                    mov esp, ebp
:00460D55 5D                      pop ebp
:00460D56 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:00460CBB   , :00460D4E   , :00461106   , :004611E1   , :00461C34   
|
:00460D59 55                      push ebp
:00460D5A 8BEC                    mov ebp, esp
:00460D5C 51                      push ecx
:00460D5D 894DFC                  mov dword ptr [ebp-04], ecx
:00460D60 8B45FC                  mov eax, dword ptr [ebp-04]
:00460D63 C7401000000000          mov [eax+10], 00000000
:00460D6A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00460D6D C7411400000000          mov [ecx+14], 00000000
:00460D74 8B55FC                  mov edx, dword ptr [ebp-04]
:00460D77 C7420800000000          mov [edx+08], 00000000
:00460D7E 8B45FC                  mov eax, dword ptr [ebp-04]
:00460D81 C7400C00000000          mov [eax+0C], 00000000
:00460D88 B9083D4B00              mov ecx, 004B3D08
:00460D8D E8FE0E0000              call 00461C90
:00460D92 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00460D95 8B10                    mov edx, dword ptr [eax]
:00460D97 895138                  mov dword ptr [ecx+38], edx
:00460D9A B9083D4B00              mov ecx, 004B3D08
:00460D9F E8EC0E0000              call 00461C90
:00460DA4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00460DA7 8B5004                  mov edx, dword ptr [eax+04]
:00460DAA 89513C                  mov dword ptr [ecx+3C], edx
:00460DAD B9083D4B00              mov ecx, 004B3D08
:00460DB2 E8D90E0000              call 00461C90
:00460DB7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00460DBA 8B5008                  mov edx, dword ptr [eax+08]
:00460DBD 895140                  mov dword ptr [ecx+40], edx
:00460DC0 B9083D4B00              mov ecx, 004B3D08
:00460DC5 E8C60E0000              call 00461C90
:00460DCA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00460DCD 8B500C                  mov edx, dword ptr [eax+0C]
:00460DD0 895144                  mov dword ptr [ecx+44], edx
:00460DD3 B9083D4B00              mov ecx, 004B3D08
:00460DD8 E8B30E0000              call 00461C90
:00460DDD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00460DE0 8B10                    mov edx, dword ptr [eax]
:00460DE2 895128                  mov dword ptr [ecx+28], edx
:00460DE5 B9083D4B00              mov ecx, 004B3D08
:00460DEA E8A10E0000              call 00461C90
:00460DEF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00460DF2 8B5004                  mov edx, dword ptr [eax+04]
:00460DF5 89512C                  mov dword ptr [ecx+2C], edx
:00460DF8 B9083D4B00              mov ecx, 004B3D08
:00460DFD E88E0E0000              call 00461C90
:00460E02 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00460E05 8B5008                  mov edx, dword ptr [eax+08]
:00460E08 895130                  mov dword ptr [ecx+30], edx
:00460E0B B9083D4B00              mov ecx, 004B3D08
:00460E10 E87B0E0000              call 00461C90
:00460E15 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00460E18 8B500C                  mov edx, dword ptr [eax+0C]
:00460E1B 895134                  mov dword ptr [ecx+34], edx
:00460E1E 8B45FC                  mov eax, dword ptr [ebp-04]
:00460E21 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00460E24 8B5030                  mov edx, dword ptr [eax+30]
:00460E27 2B5128                  sub edx, dword ptr [ecx+28]
:00460E2A 8B45FC                  mov eax, dword ptr [ebp-04]
:00460E2D 895048                  mov dword ptr [eax+48], edx
:00460E30 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00460E33 8B55FC                  mov edx, dword ptr [ebp-04]
:00460E36 8B4134                  mov eax, dword ptr [ecx+34]
:00460E39 2B422C                  sub eax, dword ptr [edx+2C]
:00460E3C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00460E3F 89414C                  mov dword ptr [ecx+4C], eax
:00460E42 B9083D4B00              mov ecx, 004B3D08
:00460E47 E8240E0000              call 00461C70
:00460E4C 33D2                    xor edx, edx
:00460E4E 8A10                    mov dl, byte ptr [eax]
:00460E50 8B45FC                  mov eax, dword ptr [ebp-04]
:00460E53 895018                  mov dword ptr [eax+18], edx
:00460E56 B9083D4B00              mov ecx, 004B3D08
:00460E5B E8100E0000              call 00461C70
:00460E60 33C9                    xor ecx, ecx
:00460E62 8A4801                  mov cl, byte ptr [eax+01]
:00460E65 8B55FC                  mov edx, dword ptr [ebp-04]
:00460E68 894A1C                  mov dword ptr [edx+1C], ecx
:00460E6B B950424B00              mov ecx, 004B4250
:00460E70 E80751FFFF              call 00455F7C
:00460E75 6BC006                  imul eax, 00000006
:00460E78 99                      cdq
:00460E79 B930000000              mov ecx, 00000030
:00460E7E F7F9                    idiv ecx
:00460E80 8B55FC                  mov edx, dword ptr [ebp-04]
:00460E83 8B4A18                  mov ecx, dword ptr [edx+18]
:00460E86 8D5401FF                lea edx, dword ptr [ecx+eax-01]
:00460E8A 8B45FC                  mov eax, dword ptr [ebp-04]
:00460E8D 895020                  mov dword ptr [eax+20], edx
:00460E90 B950424B00              mov ecx, 004B4250
:00460E95 E80951FFFF              call 00455FA3
:00460E9A 6BC006                  imul eax, 00000006
:00460E9D 99                      cdq
:00460E9E B930000000              mov ecx, 00000030
:00460EA3 F7F9                    idiv ecx
:00460EA5 8B55FC                  mov edx, dword ptr [ebp-04]
:00460EA8 8B4A1C                  mov ecx, dword ptr [edx+1C]
:00460EAB 8D5401FF                lea edx, dword ptr [ecx+eax-01]
:00460EAF 8B45FC                  mov eax, dword ptr [ebp-04]
:00460EB2 895024                  mov dword ptr [eax+24], edx
:00460EB5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00460EB8 C70100000000            mov dword ptr [ecx], 00000000
:00460EBE 8BE5                    mov esp, ebp
:00460EC0 5D                      pop ebp
:00460EC1 C3                      ret



* Referenced by a CALL at Address:
|:004604B2   
|
:00460EC2 55                      push ebp
:00460EC3 8BEC                    mov ebp, esp
:00460EC5 83EC08                  sub esp, 00000008
:00460EC8 894DF8                  mov dword ptr [ebp-08], ecx
:00460ECB 8B45F8                  mov eax, dword ptr [ebp-08]
:00460ECE 833800                  cmp dword ptr [eax], 00000000
:00460ED1 0F847A020000            je 00461151
:00460ED7 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00460EDA 81E1FFFF0000            and ecx, 0000FFFF
:00460EE0 8B55F8                  mov edx, dword ptr [ebp-08]
:00460EE3 894A10                  mov dword ptr [edx+10], ecx
:00460EE6 8B450C                  mov eax, dword ptr [ebp+0C]
:00460EE9 C1E810                  shr eax, 10
:00460EEC 25FFFF0000              and eax, 0000FFFF
:00460EF1 25FFFF0000              and eax, 0000FFFF
:00460EF6 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00460EF9 894114                  mov dword ptr [ecx+14], eax
:00460EFC 8B55F8                  mov edx, dword ptr [ebp-08]
:00460EFF 8B45F8                  mov eax, dword ptr [ebp-08]
:00460F02 8B4A08                  mov ecx, dword ptr [edx+08]
:00460F05 3B4810                  cmp ecx, dword ptr [eax+10]
:00460F08 7512                    jne 00460F1C
:00460F0A 8B55F8                  mov edx, dword ptr [ebp-08]
:00460F0D 8B45F8                  mov eax, dword ptr [ebp-08]
:00460F10 8B4A0C                  mov ecx, dword ptr [edx+0C]
:00460F13 3B4814                  cmp ecx, dword ptr [eax+14]
:00460F16 0F842B020000            je 00461147

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00460F08(C)
|
:00460F1C 6A03                    push 00000003
:00460F1E E8C0BB0100              call 0047CAE3
:00460F23 83C404                  add esp, 00000004
:00460F26 6A01                    push 00000001
:00460F28 8B55F8                  mov edx, dword ptr [ebp-08]
:00460F2B 83C238                  add edx, 00000038
:00460F2E 83EC10                  sub esp, 00000010
:00460F31 8BC4                    mov eax, esp
:00460F33 8B0A                    mov ecx, dword ptr [edx]
:00460F35 8908                    mov dword ptr [eax], ecx
:00460F37 8B4A04                  mov ecx, dword ptr [edx+04]
:00460F3A 894804                  mov dword ptr [eax+04], ecx
:00460F3D 8B4A08                  mov ecx, dword ptr [edx+08]
:00460F40 894808                  mov dword ptr [eax+08], ecx
:00460F43 8B520C                  mov edx, dword ptr [edx+0C]
:00460F46 89500C                  mov dword ptr [eax+0C], edx
:00460F49 E8AC020000              call 004611FA
:00460F4E 83C414                  add esp, 00000014
:00460F51 8B45F8                  mov eax, dword ptr [ebp-08]
:00460F54 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00460F57 8B4010                  mov eax, dword ptr [eax+10]
:00460F5A 2B4108                  sub eax, dword ptr [ecx+08]
:00460F5D 99                      cdq

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:00460F5E B906000000              mov ecx, 00000006
:00460F63 F7F9                    idiv ecx
:00460F65 6BC006                  imul eax, 00000006
:00460F68 8945FC                  mov dword ptr [ebp-04], eax
:00460F6B 8B55F8                  mov edx, dword ptr [ebp-08]
:00460F6E 8B4228                  mov eax, dword ptr [edx+28]
:00460F71 0345FC                  add eax, dword ptr [ebp-04]
:00460F74 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00460F77 894138                  mov dword ptr [ecx+38], eax
:00460F7A 8B55F8                  mov edx, dword ptr [ebp-08]
:00460F7D 8B4230                  mov eax, dword ptr [edx+30]
:00460F80 0345FC                  add eax, dword ptr [ebp-04]
:00460F83 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00460F86 894140                  mov dword ptr [ecx+40], eax
:00460F89 8B55F8                  mov edx, dword ptr [ebp-08]
:00460F8C 8B45F8                  mov eax, dword ptr [ebp-08]
:00460F8F 8B4A38                  mov ecx, dword ptr [edx+38]
:00460F92 3B4818                  cmp ecx, dword ptr [eax+18]
:00460F95 7D20                    jge 00460FB7
:00460F97 8B55F8                  mov edx, dword ptr [ebp-08]
:00460F9A 8B45F8                  mov eax, dword ptr [ebp-08]
:00460F9D 8B4818                  mov ecx, dword ptr [eax+18]
:00460FA0 894A38                  mov dword ptr [edx+38], ecx
:00460FA3 8B55F8                  mov edx, dword ptr [ebp-08]
:00460FA6 8B4238                  mov eax, dword ptr [edx+38]
:00460FA9 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00460FAC 034148                  add eax, dword ptr [ecx+48]
:00460FAF 8B55F8                  mov edx, dword ptr [ebp-08]
:00460FB2 894240                  mov dword ptr [edx+40], eax
:00460FB5 EB2C                    jmp 00460FE3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00460F95(C)
|
:00460FB7 8B45F8                  mov eax, dword ptr [ebp-08]
:00460FBA 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00460FBD 8B5040                  mov edx, dword ptr [eax+40]
:00460FC0 3B5120                  cmp edx, dword ptr [ecx+20]
:00460FC3 7E1E                    jle 00460FE3
:00460FC5 8B45F8                  mov eax, dword ptr [ebp-08]
:00460FC8 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00460FCB 8B5120                  mov edx, dword ptr [ecx+20]
:00460FCE 895040                  mov dword ptr [eax+40], edx
:00460FD1 8B45F8                  mov eax, dword ptr [ebp-08]
:00460FD4 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00460FD7 8B5040                  mov edx, dword ptr [eax+40]
:00460FDA 2B5148                  sub edx, dword ptr [ecx+48]
:00460FDD 8B45F8                  mov eax, dword ptr [ebp-08]
:00460FE0 895038                  mov dword ptr [eax+38], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00460FB5(U), :00460FC3(C)
|
:00460FE3 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00460FE6 8B55F8                  mov edx, dword ptr [ebp-08]
:00460FE9 8B4114                  mov eax, dword ptr [ecx+14]
:00460FEC 2B420C                  sub eax, dword ptr [edx+0C]
:00460FEF 99                      cdq

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:00460FF0 B906000000              mov ecx, 00000006
:00460FF5 F7F9                    idiv ecx
:00460FF7 6BC006                  imul eax, 00000006
:00460FFA 8945FC                  mov dword ptr [ebp-04], eax
:00460FFD 8B55F8                  mov edx, dword ptr [ebp-08]
:00461000 8B422C                  mov eax, dword ptr [edx+2C]
:00461003 0345FC                  add eax, dword ptr [ebp-04]
:00461006 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00461009 89413C                  mov dword ptr [ecx+3C], eax
:0046100C 8B55F8                  mov edx, dword ptr [ebp-08]
:0046100F 8B4234                  mov eax, dword ptr [edx+34]
:00461012 0345FC                  add eax, dword ptr [ebp-04]
:00461015 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00461018 894144                  mov dword ptr [ecx+44], eax
:0046101B 8B55F8                  mov edx, dword ptr [ebp-08]
:0046101E 8B45F8                  mov eax, dword ptr [ebp-08]
:00461021 8B4A3C                  mov ecx, dword ptr [edx+3C]
:00461024 3B481C                  cmp ecx, dword ptr [eax+1C]
:00461027 7D20                    jge 00461049
:00461029 8B55F8                  mov edx, dword ptr [ebp-08]
:0046102C 8B45F8                  mov eax, dword ptr [ebp-08]
:0046102F 8B481C                  mov ecx, dword ptr [eax+1C]
:00461032 894A3C                  mov dword ptr [edx+3C], ecx
:00461035 8B55F8                  mov edx, dword ptr [ebp-08]
:00461038 8B423C                  mov eax, dword ptr [edx+3C]
:0046103B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046103E 03414C                  add eax, dword ptr [ecx+4C]
:00461041 8B55F8                  mov edx, dword ptr [ebp-08]
:00461044 894244                  mov dword ptr [edx+44], eax
:00461047 EB2C                    jmp 00461075

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00461027(C)
|
:00461049 8B45F8                  mov eax, dword ptr [ebp-08]
:0046104C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046104F 8B5044                  mov edx, dword ptr [eax+44]
:00461052 3B5124                  cmp edx, dword ptr [ecx+24]
:00461055 7E1E                    jle 00461075
:00461057 8B45F8                  mov eax, dword ptr [ebp-08]
:0046105A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046105D 8B5124                  mov edx, dword ptr [ecx+24]
:00461060 895044                  mov dword ptr [eax+44], edx
:00461063 8B45F8                  mov eax, dword ptr [ebp-08]
:00461066 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00461069 8B5044                  mov edx, dword ptr [eax+44]
:0046106C 2B514C                  sub edx, dword ptr [ecx+4C]
:0046106F 8B45F8                  mov eax, dword ptr [ebp-08]
:00461072 89503C                  mov dword ptr [eax+3C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00461047(U), :00461055(C)
|
:00461075 6A00                    push 00000000
:00461077 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046107A 83C138                  add ecx, 00000038
:0046107D 83EC10                  sub esp, 00000010
:00461080 8BD4                    mov edx, esp
:00461082 8B01                    mov eax, dword ptr [ecx]
:00461084 8902                    mov dword ptr [edx], eax
:00461086 8B4104                  mov eax, dword ptr [ecx+04]
:00461089 894204                  mov dword ptr [edx+04], eax
:0046108C 8B4108                  mov eax, dword ptr [ecx+08]
:0046108F 894208                  mov dword ptr [edx+08], eax
:00461092 8B490C                  mov ecx, dword ptr [ecx+0C]
:00461095 894A0C                  mov dword ptr [edx+0C], ecx
:00461098 E85D010000              call 004611FA
:0046109D 83C414                  add esp, 00000014
:004610A0 8B55F8                  mov edx, dword ptr [ebp-08]
:004610A3 8B45F8                  mov eax, dword ptr [ebp-08]
:004610A6 8B4A10                  mov ecx, dword ptr [edx+10]
:004610A9 3B4818                  cmp ecx, dword ptr [eax+18]
:004610AC 7C2A                    jl 004610D8
:004610AE 8B55F8                  mov edx, dword ptr [ebp-08]
:004610B1 8B45F8                  mov eax, dword ptr [ebp-08]
:004610B4 8B4A10                  mov ecx, dword ptr [edx+10]
:004610B7 3B4820                  cmp ecx, dword ptr [eax+20]
:004610BA 7F1C                    jg 004610D8
:004610BC 8B55F8                  mov edx, dword ptr [ebp-08]
:004610BF 8B45F8                  mov eax, dword ptr [ebp-08]
:004610C2 8B4A14                  mov ecx, dword ptr [edx+14]
:004610C5 3B481C                  cmp ecx, dword ptr [eax+1C]
:004610C8 7C0E                    jl 004610D8
:004610CA 8B55F8                  mov edx, dword ptr [ebp-08]
:004610CD 8B45F8                  mov eax, dword ptr [ebp-08]
:004610D0 8B4A14                  mov ecx, dword ptr [edx+14]
:004610D3 3B4824                  cmp ecx, dword ptr [eax+24]
:004610D6 7E6F                    jle 00461147

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004610AC(C), :004610BA(C), :004610C8(C)
|
:004610D8 6A01                    push 00000001
:004610DA 8B55F8                  mov edx, dword ptr [ebp-08]
:004610DD 83C238                  add edx, 00000038
:004610E0 83EC10                  sub esp, 00000010
:004610E3 8BC4                    mov eax, esp
:004610E5 8B0A                    mov ecx, dword ptr [edx]
:004610E7 8908                    mov dword ptr [eax], ecx
:004610E9 8B4A04                  mov ecx, dword ptr [edx+04]
:004610EC 894804                  mov dword ptr [eax+04], ecx
:004610EF 8B4A08                  mov ecx, dword ptr [edx+08]
:004610F2 894808                  mov dword ptr [eax+08], ecx
:004610F5 8B520C                  mov edx, dword ptr [edx+0C]
:004610F8 89500C                  mov dword ptr [eax+0C], edx
:004610FB E8FA000000              call 004611FA
:00461100 83C414                  add esp, 00000014
:00461103 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00461106 E84EFCFFFF              call 00460D59
:0046110B 6A00                    push 00000000
:0046110D 8B45F8                  mov eax, dword ptr [ebp-08]
:00461110 83C038                  add eax, 00000038
:00461113 83EC10                  sub esp, 00000010
:00461116 8BCC                    mov ecx, esp
:00461118 8B10                    mov edx, dword ptr [eax]
:0046111A 8911                    mov dword ptr [ecx], edx
:0046111C 8B5004                  mov edx, dword ptr [eax+04]
:0046111F 895104                  mov dword ptr [ecx+04], edx
:00461122 8B5008                  mov edx, dword ptr [eax+08]
:00461125 895108                  mov dword ptr [ecx+08], edx
:00461128 8B400C                  mov eax, dword ptr [eax+0C]
:0046112B 89410C                  mov dword ptr [ecx+0C], eax
:0046112E E8C7000000              call 004611FA
:00461133 83C414                  add esp, 00000014
:00461136 FF1584634800            call dword ptr [00486384]
:0046113C 3B4508                  cmp eax, dword ptr [ebp+08]
:0046113F 7506                    jne 00461147
:00461141 FF1580634800            call dword ptr [00486380]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00460F16(C), :004610D6(C), :0046113F(C)
|
:00461147 6A00                    push 00000000
:00461149 E895B90100              call 0047CAE3
:0046114E 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00460ED1(C)
|
:00461151 8BE5                    mov esp, ebp
:00461153 5D                      pop ebp
:00461154 C20800                  ret 0008



* Referenced by a CALL at Address:
|:004604EE   
|
:00461157 55                      push ebp
:00461158 8BEC                    mov ebp, esp
:0046115A 51                      push ecx
:0046115B 894DFC                  mov dword ptr [ebp-04], ecx
:0046115E 8B45FC                  mov eax, dword ptr [ebp-04]
:00461161 833800                  cmp dword ptr [eax], 00000000
:00461164 0F8482000000            je 004611EC
:0046116A B950424B00              mov ecx, 004B4250
:0046116F E8A834FFFF              call 0045461C
:00461174 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00461177 83C138                  add ecx, 00000038
:0046117A 51                      push ecx
:0046117B B9083D4B00              mov ecx, 004B3D08
:00461180 E8BD96FEFF              call 0044A842
:00461185 B9083D4B00              mov ecx, 004B3D08
:0046118A E8E10A0000              call 00461C70
:0046118F 33D2                    xor edx, edx
:00461191 8A10                    mov dl, byte ptr [eax]
:00461193 8B45FC                  mov eax, dword ptr [ebp-04]
:00461196 8B4038                  mov eax, dword ptr [eax+38]
:00461199 2BC2                    sub eax, edx
:0046119B 6BC030                  imul eax, 00000030
:0046119E 99                      cdq

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0046119F B906000000              mov ecx, 00000006
:004611A4 F7F9                    idiv ecx
:004611A6 50                      push eax
:004611A7 B950424B00              mov ecx, 004B4250
:004611AC E8084CFFFF              call 00455DB9
:004611B1 B9083D4B00              mov ecx, 004B3D08
:004611B6 E8B50A0000              call 00461C70
:004611BB 33D2                    xor edx, edx
:004611BD 8A5001                  mov dl, byte ptr [eax+01]
:004611C0 8B45FC                  mov eax, dword ptr [ebp-04]
:004611C3 8B403C                  mov eax, dword ptr [eax+3C]
:004611C6 2BC2                    sub eax, edx
:004611C8 6BC030                  imul eax, 00000030
:004611CB 99                      cdq

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:004611CC B906000000              mov ecx, 00000006
:004611D1 F7F9                    idiv ecx
:004611D3 50                      push eax
:004611D4 B950424B00              mov ecx, 004B4250
:004611D9 E8024CFFFF              call 00455DE0
:004611DE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004611E1 E873FBFFFF              call 00460D59
:004611E6 FF1580634800            call dword ptr [00486380]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00461164(C)
|
:004611EC 6A00                    push 00000000
:004611EE E8F0B80100              call 0047CAE3
:004611F3 83C404                  add esp, 00000004
:004611F6 8BE5                    mov esp, ebp
:004611F8 5D                      pop ebp
:004611F9 C3                      ret



* Referenced by a CALL at Addresses:
|:0044A728   , :0044A81F   , :00460F49   , :00461098   , :004610FB   
|:0046112E   
|
:004611FA 55                      push ebp
:004611FB 8BEC                    mov ebp, esp
:004611FD A1D85F4B00              mov eax, dword ptr [004B5FD8]
:00461202 50                      push eax
:00461203 FF15C8624800            call dword ptr [004862C8]
:00461209 85C0                    test eax, eax
:0046120B 7505                    jne 00461212
:0046120D E9DF010000              jmp 004613F1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046120B(C)
|
:00461212 E8C4D3FBFF              call 0041E5DB
:00461217 6A00                    push 00000000
:00461219 6A12                    push 00000012
:0046121B 6A00                    push 00000000
:0046121D E8CFBF0100              call 0047D1F1
:00461222 83C40C                  add esp, 0000000C
:00461225 837D1800                cmp dword ptr [ebp+18], 00000000
:00461229 0F84CD000000            je 004612FC
:0046122F 6A04                    push 00000004
:00461231 6A00                    push 00000000
:00461233 6A00                    push 00000000
:00461235 B978F44A00              mov ecx, 004AF478
:0046123A E801E80100              call 0047FA40
:0046123F 05000E0100              add eax, 00010E00
:00461244 50                      push eax
:00461245 6A01                    push 00000001
:00461247 8B4D10                  mov ecx, dword ptr [ebp+10]
:0046124A 2B4D08                  sub ecx, dword ptr [ebp+08]
:0046124D 83C101                  add ecx, 00000001
:00461250 51                      push ecx
:00461251 8B550C                  mov edx, dword ptr [ebp+0C]
:00461254 52                      push edx
:00461255 8B4508                  mov eax, dword ptr [ebp+08]
:00461258 50                      push eax
:00461259 E83DCE0100              call 0047E09B
:0046125E 83C414                  add esp, 00000014
:00461261 6A04                    push 00000004
:00461263 6A00                    push 00000000
:00461265 6A00                    push 00000000
:00461267 B978F44A00              mov ecx, 004AF478
:0046126C E8CFE70100              call 0047FA40
:00461271 0500130100              add eax, 00011300
:00461276 50                      push eax
:00461277 6A01                    push 00000001
:00461279 8B4D10                  mov ecx, dword ptr [ebp+10]
:0046127C 2B4D08                  sub ecx, dword ptr [ebp+08]
:0046127F 83C101                  add ecx, 00000001
:00461282 51                      push ecx
:00461283 8B5514                  mov edx, dword ptr [ebp+14]
:00461286 52                      push edx
:00461287 8B4508                  mov eax, dword ptr [ebp+08]
:0046128A 50                      push eax
:0046128B E80BCE0100              call 0047E09B
:00461290 83C414                  add esp, 00000014
:00461293 6A04                    push 00000004
:00461295 6A00                    push 00000000
:00461297 6A00                    push 00000000
:00461299 B978F44A00              mov ecx, 004AF478
:0046129E E89DE70100              call 0047FA40
:004612A3 0500180100              add eax, 00011800
:004612A8 50                      push eax
:004612A9 8B4D14                  mov ecx, dword ptr [ebp+14]
:004612AC 2B4D0C                  sub ecx, dword ptr [ebp+0C]
:004612AF 83C101                  add ecx, 00000001
:004612B2 51                      push ecx
:004612B3 6A01                    push 00000001
:004612B5 8B550C                  mov edx, dword ptr [ebp+0C]
:004612B8 52                      push edx
:004612B9 8B4508                  mov eax, dword ptr [ebp+08]
:004612BC 50                      push eax
:004612BD E8D9CD0100              call 0047E09B
:004612C2 83C414                  add esp, 00000014
:004612C5 6A04                    push 00000004
:004612C7 6A00                    push 00000000
:004612C9 6A00                    push 00000000
:004612CB B978F44A00              mov ecx, 004AF478
:004612D0 E86BE70100              call 0047FA40
:004612D5 05001D0100              add eax, 00011D00
:004612DA 50                      push eax
:004612DB 8B4D14                  mov ecx, dword ptr [ebp+14]
:004612DE 2B4D0C                  sub ecx, dword ptr [ebp+0C]
:004612E1 83C101                  add ecx, 00000001
:004612E4 51                      push ecx
:004612E5 6A01                    push 00000001
:004612E7 8B550C                  mov edx, dword ptr [ebp+0C]
:004612EA 52                      push edx
:004612EB 8B4510                  mov eax, dword ptr [ebp+10]
:004612EE 50                      push eax
:004612EF E8A7CD0100              call 0047E09B
:004612F4 83C414                  add esp, 00000014
:004612F7 E9E2000000              jmp 004613DE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00461229(C)
|
:004612FC 6A04                    push 00000004
:004612FE 6A00                    push 00000000
:00461300 6A00                    push 00000000
:00461302 B978F44A00              mov ecx, 004AF478
:00461307 E834E70100              call 0047FA40
:0046130C 05000E0100              add eax, 00010E00
:00461311 50                      push eax
:00461312 6A01                    push 00000001
:00461314 8B4D10                  mov ecx, dword ptr [ebp+10]
:00461317 2B4D08                  sub ecx, dword ptr [ebp+08]
:0046131A 83C101                  add ecx, 00000001
:0046131D 51                      push ecx
:0046131E 8B550C                  mov edx, dword ptr [ebp+0C]
:00461321 52                      push edx
:00461322 8B4508                  mov eax, dword ptr [ebp+08]
:00461325 50                      push eax
:00461326 E826CF0100              call 0047E251
:0046132B 83C414                  add esp, 00000014
:0046132E 6A04                    push 00000004
:00461330 6A00                    push 00000000
:00461332 6A00                    push 00000000
:00461334 B978F44A00              mov ecx, 004AF478
:00461339 E802E70100              call 0047FA40
:0046133E 0500130100              add eax, 00011300
:00461343 50                      push eax
:00461344 6A01                    push 00000001
:00461346 8B4D10                  mov ecx, dword ptr [ebp+10]
:00461349 2B4D08                  sub ecx, dword ptr [ebp+08]
:0046134C 83C101                  add ecx, 00000001
:0046134F 51                      push ecx
:00461350 8B5514                  mov edx, dword ptr [ebp+14]
:00461353 52                      push edx
:00461354 8B4508                  mov eax, dword ptr [ebp+08]
:00461357 50                      push eax
:00461358 E8F4CE0100              call 0047E251
:0046135D 83C414                  add esp, 00000014
:00461360 6A04                    push 00000004
:00461362 6A00                    push 00000000
:00461364 6A00                    push 00000000
:00461366 B978F44A00              mov ecx, 004AF478
:0046136B E8D0E60100              call 0047FA40
:00461370 0500180100              add eax, 00011800
:00461375 50                      push eax
:00461376 8B4D14                  mov ecx, dword ptr [ebp+14]
:00461379 2B4D0C                  sub ecx, dword ptr [ebp+0C]
:0046137C 83C101                  add ecx, 00000001
:0046137F 51                      push ecx
:00461380 6A01                    push 00000001
:00461382 8B550C                  mov edx, dword ptr [ebp+0C]
:00461385 52                      push edx
:00461386 8B4508                  mov eax, dword ptr [ebp+08]
:00461389 50                      push eax
:0046138A E8C2CE0100              call 0047E251
:0046138F 83C414                  add esp, 00000014
:00461392 6A04                    push 00000004
:00461394 6A00                    push 00000000
:00461396 6A00                    push 00000000
:00461398 B978F44A00              mov ecx, 004AF478
:0046139D E89EE60100              call 0047FA40
:004613A2 05001D0100              add eax, 00011D00
:004613A7 50                      push eax
:004613A8 8B4D14                  mov ecx, dword ptr [ebp+14]
:004613AB 2B4D0C                  sub ecx, dword ptr [ebp+0C]
:004613AE 83C101                  add ecx, 00000001
:004613B1 51                      push ecx
:004613B2 6A01                    push 00000001
:004613B4 8B550C                  mov edx, dword ptr [ebp+0C]
:004613B7 52                      push edx
:004613B8 8B4510                  mov eax, dword ptr [ebp+10]
:004613BB 50                      push eax
:004613BC E890CE0100              call 0047E251
:004613C1 83C414                  add esp, 00000014
:004613C4 6A01                    push 00000001
:004613C6 8B4D14                  mov ecx, dword ptr [ebp+14]
:004613C9 51                      push ecx
:004613CA 8B5510                  mov edx, dword ptr [ebp+10]
:004613CD 52                      push edx
:004613CE 8B450C                  mov eax, dword ptr [ebp+0C]
:004613D1 50                      push eax
:004613D2 8B4D08                  mov ecx, dword ptr [ebp+08]
:004613D5 51                      push ecx
:004613D6 E8E8C70100              call 0047DBC3
:004613DB 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004612F7(U)
|
:004613DE 6A00                    push 00000000
:004613E0 6A1F                    push 0000001F
:004613E2 6A00                    push 00000000
:004613E4 E808BE0100              call 0047D1F1
:004613E9 83C40C                  add esp, 0000000C
:004613EC E805D2FBFF              call 0041E5F6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046120D(U)
|
:004613F1 5D                      pop ebp
:004613F2 C3                      ret



* Referenced by a CALL at Addresses:
|:0045BEB1   , :0045BEC7   , :0045BEDD   , :0045BEF3   , :0045BF09   
|:0045BF1F   , :0045BF35   , :0045BF4B   , :004701CE   , :00472AE9   
|:00473002   , :00476DED   , :0047770B   , :004795E7   
|
:004613F3 55                      push ebp
:004613F4 8BEC                    mov ebp, esp
:004613F6 51                      push ecx
:004613F7 894DFC                  mov dword ptr [ebp-04], ecx
:004613FA 8B4510                  mov eax, dword ptr [ebp+10]
:004613FD 50                      push eax
:004613FE 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00461401 51                      push ecx
:00461402 8B5508                  mov edx, dword ptr [ebp+08]
:00461405 52                      push edx
:00461406 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00461409 E83A000000              call 00461448
:0046140E 8B45FC                  mov eax, dword ptr [ebp-04]
:00461411 8B4D14                  mov ecx, dword ptr [ebp+14]
:00461414 89480C                  mov dword ptr [eax+0C], ecx
:00461417 8B55FC                  mov edx, dword ptr [ebp-04]
:0046141A C7421080000000          mov [edx+10], 00000080
:00461421 8B45FC                  mov eax, dword ptr [ebp-04]
:00461424 C74014FF00FF02          mov [eax+14], 02FF00FF
:0046142B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046142E C7411800000000          mov [ecx+18], 00000000
:00461435 8B55FC                  mov edx, dword ptr [ebp-04]
:00461438 C7421C00FFFF02          mov [edx+1C], 02FFFF00
:0046143F 8B45FC                  mov eax, dword ptr [ebp-04]
:00461442 8BE5                    mov esp, ebp
:00461444 5D                      pop ebp
:00461445 C21000                  ret 0010



* Referenced by a CALL at Addresses:
|:0045C8B6   , :0045C8F4   , :0045C936   , :0045C97D   , :0045C9BB   
|:0045C9F9   , :0045CA37   , :0045CA75   , :0045CAB3   , :00461409   
|:00465EA3   , :004695E7   , :00476E1B   , :0047772D   , :00479615   
|
:00461448 55                      push ebp
:00461449 8BEC                    mov ebp, esp
:0046144B 51                      push ecx
:0046144C 894DFC                  mov dword ptr [ebp-04], ecx
:0046144F 8B45FC                  mov eax, dword ptr [ebp-04]
:00461452 8B4D08                  mov ecx, dword ptr [ebp+08]
:00461455 8908                    mov dword ptr [eax], ecx
:00461457 8B55FC                  mov edx, dword ptr [ebp-04]
:0046145A 8B450C                  mov eax, dword ptr [ebp+0C]
:0046145D 894204                  mov dword ptr [edx+04], eax
:00461460 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00461463 8B5510                  mov edx, dword ptr [ebp+10]
:00461466 895108                  mov dword ptr [ecx+08], edx
:00461469 8BE5                    mov esp, ebp
:0046146B 5D                      pop ebp
:0046146C C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:0045D489   , :0045D4AB   , :0045D4CD   , :0045D4EF   , :0045D50E   
|:0045D52D   , :0045D54C   , :0045D56B   , :00466439   , :0046A721   
|:004701F0   , :00476E34   , :00477741   , :0047962F   
|
:0046146F 55                      push ebp
:00461470 8BEC                    mov ebp, esp
:00461472 6AFF                    push FFFFFFFF
:00461474 6879574800              push 00485779
:00461479 64A100000000            mov eax, dword ptr fs:[00000000]
:0046147F 50                      push eax
:00461480 64892500000000          mov dword ptr fs:[00000000], esp
:00461487 81EC88000000            sub esp, 00000088
:0046148D 898D70FFFFFF            mov dword ptr [ebp+FFFFFF70], ecx
:00461493 A11CE64800              mov eax, dword ptr [0048E61C]
:00461498 8945E8                  mov dword ptr [ebp-18], eax
:0046149B 8B0D20E64800            mov ecx, dword ptr [0048E620]
:004614A1 894DEC                  mov dword ptr [ebp-14], ecx
:004614A4 8A1524E64800            mov dl, byte ptr [0048E624]
:004614AA 8855F0                  mov byte ptr [ebp-10], dl
:004614AD 8B4514                  mov eax, dword ptr [ebp+14]
:004614B0 89856CFFFFFF            mov dword ptr [ebp+FFFFFF6C], eax
:004614B6 8B8D6CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF6C]
:004614BC 83E901                  sub ecx, 00000001
:004614BF 898D6CFFFFFF            mov dword ptr [ebp+FFFFFF6C], ecx
:004614C5 83BD6CFFFFFF08          cmp dword ptr [ebp+FFFFFF6C], 00000008
:004614CC 0F87E7010000            ja 004616B9
:004614D2 8B956CFFFFFF            mov edx, dword ptr [ebp+FFFFFF6C]
:004614D8 FF2495461B4600          jmp dword ptr [4*edx+00461B46]

* Possible Reference to Dialog: DialogID_0140 
                                  |
:004614DF C7458440010000          mov [ebp-7C], 00000140
:004614E6 C7857CFFFFFF0000FF02    mov dword ptr [ebp+FFFFFF7C], 02FF0000
:004614F0 C745B8FFFFFFFF          mov [ebp-48], FFFFFFFF
:004614F7 6A12                    push 00000012
:004614F9 FF1564634800            call dword ptr [00486364]
:004614FF 898574FFFFFF            mov dword ptr [ebp+FFFFFF74], eax
:00461505 E9E5010000              jmp 004616EF
:0046150A C74584C0000000          mov [ebp-7C], 000000C0
:00461511 C7857CFFFFFFFFFF0002    mov dword ptr [ebp+FFFFFF7C], 0200FFFF
:0046151B C745B8FFFFFFFF          mov [ebp-48], FFFFFFFF
:00461522 6A12                    push 00000012
:00461524 FF1564634800            call dword ptr [00486364]
:0046152A 898574FFFFFF            mov dword ptr [ebp+FFFFFF74], eax
:00461530 E9BA010000              jmp 004616EF
:00461535 C74584C0000000          mov [ebp-7C], 000000C0
:0046153C C7857CFFFFFFFFFF0002    mov dword ptr [ebp+FFFFFF7C], 0200FFFF
:00461546 C745B800000000          mov [ebp-48], 00000000
:0046154D C78574FFFFFFFFFF0002    mov dword ptr [ebp+FFFFFF74], 0200FFFF
:00461557 E993010000              jmp 004616EF
:0046155C C74584C0000000          mov [ebp-7C], 000000C0
:00461563 C7857CFFFFFFFFFF0002    mov dword ptr [ebp+FFFFFF7C], 0200FFFF
:0046156D C745B800010000          mov [ebp-48], 00000100
:00461574 C78574FFFFFF80000002    mov dword ptr [ebp+FFFFFF74], 02000080
:0046157E 837D1000                cmp dword ptr [ebp+10], 00000000
:00461582 752A                    jne 004615AE
:00461584 8B8570FFFFFF            mov eax, dword ptr [ebp+FFFFFF70]
:0046158A 8B08                    mov ecx, dword ptr [eax]
:0046158C 51                      push ecx
:0046158D 8B9570FFFFFF            mov edx, dword ptr [ebp+FFFFFF70]
:00461593 8B4204                  mov eax, dword ptr [edx+04]
:00461596 50                      push eax

* Possible StringData Ref from Data Obj ->"%3d/%3d "
                                  |
:00461597 6828E64800              push 0048E628
:0046159C 8D4DE8                  lea ecx, dword ptr [ebp-18]
:0046159F 51                      push ecx
:004615A0 E87DEE0100              call 00480422
:004615A5 83C410                  add esp, 00000010
:004615A8 8D55E8                  lea edx, dword ptr [ebp-18]
:004615AB 895510                  mov dword ptr [ebp+10], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00461582(C)
|
:004615AE E93C010000              jmp 004616EF
:004615B3 C7458480000000          mov [ebp-7C], 00000080
:004615BA C7857CFFFFFF0000FF02    mov dword ptr [ebp+FFFFFF7C], 02FF0000
:004615C4 C745B8FFFFFFFF          mov [ebp-48], FFFFFFFF
:004615CB 6A12                    push 00000012
:004615CD FF1564634800            call dword ptr [00486364]
:004615D3 898574FFFFFF            mov dword ptr [ebp+FFFFFF74], eax
:004615D9 E911010000              jmp 004616EF
:004615DE C7458440000000          mov [ebp-7C], 00000040
:004615E5 C7857CFFFFFF0000FF02    mov dword ptr [ebp+FFFFFF7C], 02FF0000
:004615EF C745B8FFFFFFFF          mov [ebp-48], FFFFFFFF
:004615F6 6A12                    push 00000012
:004615F8 FF1564634800            call dword ptr [00486364]
:004615FE 898574FFFFFF            mov dword ptr [ebp+FFFFFF74], eax
:00461604 E9E6000000              jmp 004616EF
:00461609 C7458440000000          mov [ebp-7C], 00000040
:00461610 C7857CFFFFFF0000FF02    mov dword ptr [ebp+FFFFFF7C], 02FF0000
:0046161A C745B800000000          mov [ebp-48], 00000000
:00461621 C78574FFFFFFFFFF0002    mov dword ptr [ebp+FFFFFF74], 0200FFFF
:0046162B 837D1000                cmp dword ptr [ebp+10], 00000000
:0046162F 752B                    jne 0046165C
:00461631 8B8570FFFFFF            mov eax, dword ptr [ebp+FFFFFF70]
:00461637 8B4808                  mov ecx, dword ptr [eax+08]
:0046163A 51                      push ecx
:0046163B 8B9570FFFFFF            mov edx, dword ptr [ebp+FFFFFF70]
:00461641 8B4204                  mov eax, dword ptr [edx+04]
:00461644 50                      push eax

* Possible StringData Ref from Data Obj ->"%3d/%3d "
                                  |
:00461645 6834E64800              push 0048E634
:0046164A 8D4DE8                  lea ecx, dword ptr [ebp-18]
:0046164D 51                      push ecx
:0046164E E8CFED0100              call 00480422
:00461653 83C410                  add esp, 00000010
:00461656 8D55E8                  lea edx, dword ptr [ebp-18]
:00461659 895510                  mov dword ptr [ebp+10], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046162F(C)
|
:0046165C E98E000000              jmp 004616EF

* Possible Reference to Dialog: DialogID_0140 
                                  |
:00461661 C7458440010000          mov [ebp-7C], 00000140
:00461668 C7857CFFFFFF0000FF02    mov dword ptr [ebp+FFFFFF7C], 02FF0000
:00461672 C745B8FFFFFFFF          mov [ebp-48], FFFFFFFF
:00461679 6A12                    push 00000012
:0046167B FF1564634800            call dword ptr [00486364]
:00461681 898574FFFFFF            mov dword ptr [ebp+FFFFFF74], eax
:00461687 8B8570FFFFFF            mov eax, dword ptr [ebp+FFFFFF70]
:0046168D 8138FF000000            cmp dword ptr [eax], 000000FF
:00461693 7522                    jne 004616B7
:00461695 837D1000                cmp dword ptr [ebp+10], 00000000
:00461699 751C                    jne 004616B7
:0046169B 68D46A4800              push 00486AD4

* Possible StringData Ref from Data Obj ->"%s "
                                  |
:004616A0 6840E64800              push 0048E640
:004616A5 8D4DE8                  lea ecx, dword ptr [ebp-18]
:004616A8 51                      push ecx
:004616A9 E874ED0100              call 00480422
:004616AE 83C40C                  add esp, 0000000C
:004616B1 8D55E8                  lea edx, dword ptr [ebp-18]
:004616B4 895510                  mov dword ptr [ebp+10], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00461693(C), :00461699(C)
|
:004616B7 EB36                    jmp 004616EF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004614CC(C)
|
:004616B9 8B8570FFFFFF            mov eax, dword ptr [ebp+FFFFFF70]
:004616BF 8B4810                  mov ecx, dword ptr [eax+10]
:004616C2 894D84                  mov dword ptr [ebp-7C], ecx
:004616C5 8B9570FFFFFF            mov edx, dword ptr [ebp+FFFFFF70]
:004616CB 8B4214                  mov eax, dword ptr [edx+14]
:004616CE 89857CFFFFFF            mov dword ptr [ebp+FFFFFF7C], eax
:004616D4 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:004616DA 8B5118                  mov edx, dword ptr [ecx+18]
:004616DD 8955B8                  mov dword ptr [ebp-48], edx
:004616E0 8B8570FFFFFF            mov eax, dword ptr [ebp+FFFFFF70]
:004616E6 8B481C                  mov ecx, dword ptr [eax+1C]
:004616E9 898D74FFFFFF            mov dword ptr [ebp+FFFFFF74], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00461505(U), :00461530(U), :00461557(U), :004615AE(U), :004615D9(U)
|:00461604(U), :0046165C(U), :004616B7(U)
|
:004616EF 8B550C                  mov edx, dword ptr [ebp+0C]
:004616F2 8B02                    mov eax, dword ptr [edx]
:004616F4 8945BC                  mov dword ptr [ebp-44], eax
:004616F7 8B4A04                  mov ecx, dword ptr [edx+04]
:004616FA 894DC0                  mov dword ptr [ebp-40], ecx
:004616FD 8B4208                  mov eax, dword ptr [edx+08]
:00461700 8945C4                  mov dword ptr [ebp-3C], eax
:00461703 8B4A0C                  mov ecx, dword ptr [edx+0C]
:00461706 894DC8                  mov dword ptr [ebp-38], ecx
:00461709 6A0F                    push 0000000F
:0046170B FF1564634800            call dword ptr [00486364]
:00461711 50                      push eax
:00461712 FF1568604800            call dword ptr [00486068]
:00461718 8945E0                  mov dword ptr [ebp-20], eax
:0046171B 8B55E0                  mov edx, dword ptr [ebp-20]
:0046171E 52                      push edx
:0046171F 8B450C                  mov eax, dword ptr [ebp+0C]
:00461722 50                      push eax
:00461723 8B4D08                  mov ecx, dword ptr [ebp+08]
:00461726 51                      push ecx
:00461727 FF15F0624800            call dword ptr [004862F0]
:0046172D 8B55E0                  mov edx, dword ptr [ebp-20]
:00461730 52                      push edx
:00461731 FF1548604800            call dword ptr [00486048]
:00461737 8B45C8                  mov eax, dword ptr [ebp-38]
:0046173A 50                      push eax
:0046173B 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:0046173E 51                      push ecx
:0046173F 8B55C0                  mov edx, dword ptr [ebp-40]
:00461742 52                      push edx
:00461743 8B45BC                  mov eax, dword ptr [ebp-44]
:00461746 50                      push eax
:00461747 FF15D0604800            call dword ptr [004860D0]
:0046174D 894580                  mov dword ptr [ebp-80], eax
:00461750 8B4D80                  mov ecx, dword ptr [ebp-80]
:00461753 51                      push ecx
:00461754 8B5508                  mov edx, dword ptr [ebp+08]
:00461757 52                      push edx
:00461758 FF1598604800            call dword ptr [00486098]
:0046175E 8B45BC                  mov eax, dword ptr [ebp-44]
:00461761 8945A8                  mov dword ptr [ebp-58], eax
:00461764 8B4DC0                  mov ecx, dword ptr [ebp-40]
:00461767 894DAC                  mov dword ptr [ebp-54], ecx
:0046176A 8B55C4                  mov edx, dword ptr [ebp-3C]
:0046176D 8955B0                  mov dword ptr [ebp-50], edx
:00461770 8B45C8                  mov eax, dword ptr [ebp-38]
:00461773 8945B4                  mov dword ptr [ebp-4C], eax
:00461776 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:0046177C 83790800                cmp dword ptr [ecx+08], 00000000
:00461780 7422                    je 004617A4
:00461782 8B55C4                  mov edx, dword ptr [ebp-3C]
:00461785 2B55BC                  sub edx, dword ptr [ebp-44]
:00461788 8B8570FFFFFF            mov eax, dword ptr [ebp+FFFFFF70]
:0046178E 0FAF5004                imul edx, dword ptr [eax+04]
:00461792 8B45BC                  mov eax, dword ptr [ebp-44]
:00461795 03C2                    add eax, edx
:00461797 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:0046179D 99                      cdq
:0046179E F77908                  idiv [ecx+08]
:004617A1 8945B0                  mov dword ptr [ebp-50], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00461780(C)
|
:004617A4 8D4D88                  lea ecx, dword ptr [ebp-78]
:004617A7 E884A0FAFF              call 0040B830
:004617AC C745FC00000000          mov [ebp-04], 00000000
:004617B3 837DB800                cmp dword ptr [ebp-48], 00000000
:004617B7 7C41                    jl 004617FA
:004617B9 6A08                    push 00000008
:004617BB 6A08                    push 00000008
:004617BD 6A04                    push 00000004
:004617BF 6A00                    push 00000000
:004617C1 8B55B8                  mov edx, dword ptr [ebp-48]
:004617C4 52                      push edx
:004617C5 B950EB4A00              mov ecx, 004AEB50
:004617CA E871E20100              call 0047FA40
:004617CF 50                      push eax
:004617D0 8D4D88                  lea ecx, dword ptr [ebp-78]
:004617D3 E8C57FFAFF              call 0040979D
:004617D8 8B45B4                  mov eax, dword ptr [ebp-4C]
:004617DB 2B45AC                  sub eax, dword ptr [ebp-54]
:004617DE 50                      push eax
:004617DF 8B4DB0                  mov ecx, dword ptr [ebp-50]
:004617E2 2B4DA8                  sub ecx, dword ptr [ebp-58]
:004617E5 51                      push ecx
:004617E6 8B55AC                  mov edx, dword ptr [ebp-54]
:004617E9 52                      push edx
:004617EA 8B45A8                  mov eax, dword ptr [ebp-58]
:004617ED 50                      push eax
:004617EE 8B4D08                  mov ecx, dword ptr [ebp+08]
:004617F1 51                      push ecx
:004617F2 8D4D88                  lea ecx, dword ptr [ebp-78]
:004617F5 E85A89FAFF              call 0040A154

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004617B7(C)
|
:004617FA 8B9570FFFFFF            mov edx, dword ptr [ebp+FFFFFF70]
:00461800 837A0400                cmp dword ptr [edx+04], 00000000
:00461804 743B                    je 00461841
:00461806 8B45A8                  mov eax, dword ptr [ebp-58]
:00461809 8945D0                  mov dword ptr [ebp-30], eax
:0046180C 8B4DAC                  mov ecx, dword ptr [ebp-54]
:0046180F 894DD4                  mov dword ptr [ebp-2C], ecx
:00461812 8B55B0                  mov edx, dword ptr [ebp-50]
:00461815 8955D8                  mov dword ptr [ebp-28], edx
:00461818 8B45B4                  mov eax, dword ptr [ebp-4C]
:0046181B 8945DC                  mov dword ptr [ebp-24], eax
:0046181E 8B4DB0                  mov ecx, dword ptr [ebp-50]
:00461821 2B4DA8                  sub ecx, dword ptr [ebp-58]
:00461824 8B9570FFFFFF            mov edx, dword ptr [ebp+FFFFFF70]
:0046182A 0FAF0A                  imul ecx, dword ptr [edx]
:0046182D 8B45A8                  mov eax, dword ptr [ebp-58]
:00461830 03C1                    add eax, ecx
:00461832 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:00461838 99                      cdq
:00461839 F77904                  idiv [ecx+04]
:0046183C 8945D8                  mov dword ptr [ebp-28], eax
:0046183F EB5F                    jmp 004618A0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00461804(C)
|
:00461841 8B9570FFFFFF            mov edx, dword ptr [ebp+FFFFFF70]
:00461847 837A0800                cmp dword ptr [edx+08], 00000000
:0046184B 743B                    je 00461888
:0046184D 8B45BC                  mov eax, dword ptr [ebp-44]
:00461850 8945D0                  mov dword ptr [ebp-30], eax
:00461853 8B4DC0                  mov ecx, dword ptr [ebp-40]
:00461856 894DD4                  mov dword ptr [ebp-2C], ecx
:00461859 8B55C4                  mov edx, dword ptr [ebp-3C]
:0046185C 8955D8                  mov dword ptr [ebp-28], edx
:0046185F 8B45C8                  mov eax, dword ptr [ebp-38]
:00461862 8945DC                  mov dword ptr [ebp-24], eax
:00461865 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:00461868 2B4DBC                  sub ecx, dword ptr [ebp-44]
:0046186B 8B9570FFFFFF            mov edx, dword ptr [ebp+FFFFFF70]
:00461871 0FAF0A                  imul ecx, dword ptr [edx]
:00461874 8B45BC                  mov eax, dword ptr [ebp-44]
:00461877 03C1                    add eax, ecx
:00461879 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:0046187F 99                      cdq
:00461880 F77908                  idiv [ecx+08]
:00461883 8945D8                  mov dword ptr [ebp-28], eax
:00461886 EB18                    jmp 004618A0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046184B(C)
|
:00461888 8B55BC                  mov edx, dword ptr [ebp-44]
:0046188B 8955D0                  mov dword ptr [ebp-30], edx
:0046188E 8B45C0                  mov eax, dword ptr [ebp-40]
:00461891 8945D4                  mov dword ptr [ebp-2C], eax
:00461894 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:00461897 894DD8                  mov dword ptr [ebp-28], ecx
:0046189A 8B55C8                  mov edx, dword ptr [ebp-38]
:0046189D 8955DC                  mov dword ptr [ebp-24], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046183F(U), :00461886(U)
|
:004618A0 837D8400                cmp dword ptr [ebp-7C], 00000000
:004618A4 7C41                    jl 004618E7
:004618A6 6A08                    push 00000008
:004618A8 6A08                    push 00000008
:004618AA 6A04                    push 00000004
:004618AC 6A00                    push 00000000
:004618AE 8B4584                  mov eax, dword ptr [ebp-7C]
:004618B1 50                      push eax
:004618B2 B950EB4A00              mov ecx, 004AEB50
:004618B7 E884E10100              call 0047FA40
:004618BC 50                      push eax
:004618BD 8D4D88                  lea ecx, dword ptr [ebp-78]
:004618C0 E8D87EFAFF              call 0040979D
:004618C5 8B4DDC                  mov ecx, dword ptr [ebp-24]
:004618C8 2B4DD4                  sub ecx, dword ptr [ebp-2C]
:004618CB 51                      push ecx
:004618CC 8B55D8                  mov edx, dword ptr [ebp-28]
:004618CF 2B55D0                  sub edx, dword ptr [ebp-30]
:004618D2 52                      push edx
:004618D3 8B45D4                  mov eax, dword ptr [ebp-2C]
:004618D6 50                      push eax
:004618D7 8B4DD0                  mov ecx, dword ptr [ebp-30]
:004618DA 51                      push ecx
:004618DB 8B5508                  mov edx, dword ptr [ebp+08]
:004618DE 52                      push edx
:004618DF 8D4D88                  lea ecx, dword ptr [ebp-78]
:004618E2 E86D88FAFF              call 0040A154

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004618A4(C)
|
:004618E7 837D1000                cmp dword ptr [ebp+10], 00000000
:004618EB 7552                    jne 0046193F
:004618ED 8B8570FFFFFF            mov eax, dword ptr [ebp+FFFFFF70]
:004618F3 83780400                cmp dword ptr [eax+04], 00000000
:004618F7 7426                    je 0046191F
:004618F9 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:004618FF 8B5104                  mov edx, dword ptr [ecx+04]
:00461902 52                      push edx
:00461903 8B8570FFFFFF            mov eax, dword ptr [ebp+FFFFFF70]
:00461909 8B08                    mov ecx, dword ptr [eax]
:0046190B 51                      push ecx

* Possible StringData Ref from Data Obj ->"%3d/%3d "
                                  |
:0046190C 6844E64800              push 0048E644
:00461911 8D55E8                  lea edx, dword ptr [ebp-18]
:00461914 52                      push edx
:00461915 E808EB0100              call 00480422
:0046191A 83C410                  add esp, 00000010
:0046191D EB1A                    jmp 00461939

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004618F7(C)
|
:0046191F 8B8570FFFFFF            mov eax, dword ptr [ebp+FFFFFF70]
:00461925 8B08                    mov ecx, dword ptr [eax]
:00461927 51                      push ecx

* Possible StringData Ref from Data Obj ->"%3d "
                                  |
:00461928 6850E64800              push 0048E650
:0046192D 8D55E8                  lea edx, dword ptr [ebp-18]
:00461930 52                      push edx
:00461931 E8ECEA0100              call 00480422
:00461936 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046191D(U)
|
:00461939 8D45E8                  lea eax, dword ptr [ebp-18]
:0046193C 894510                  mov dword ptr [ebp+10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004618EB(C)
|
:0046193F 6A01                    push 00000001
:00461941 8B4D08                  mov ecx, dword ptr [ebp+08]
:00461944 51                      push ecx
:00461945 FF1594604800            call dword ptr [00486094]
:0046194B 898578FFFFFF            mov dword ptr [ebp+FFFFFF78], eax

* Possible StringData Ref from Data Obj ->""
                                  |
:00461951 6858E64800              push 0048E658
:00461956 6A00                    push 00000000
:00461958 6A00                    push 00000000
:0046195A 6A00                    push 00000000
:0046195C 6A04                    push 00000004
:0046195E 6886000000              push 00000086
:00461963 6A00                    push 00000000
:00461965 6A00                    push 00000000
:00461967 6A00                    push 00000000
:00461969 6890010000              push 00000190
:0046196E 6A00                    push 00000000
:00461970 6A00                    push 00000000
:00461972 6A00                    push 00000000
:00461974 6A48                    push 00000048
:00461976 6A5A                    push 0000005A
:00461978 8B5508                  mov edx, dword ptr [ebp+08]
:0046197B 52                      push edx
:0046197C FF153C604800            call dword ptr [0048603C]
:00461982 50                      push eax
:00461983 6A09                    push 00000009
:00461985 FF15E8604800            call dword ptr [004860E8]
:0046198B 6BC0FF                  imul eax, FFFFFFFF
:0046198E 50                      push eax
:0046198F FF1588604800            call dword ptr [00486088]
:00461995 8945CC                  mov dword ptr [ebp-34], eax
:00461998 8B45CC                  mov eax, dword ptr [ebp-34]
:0046199B 50                      push eax
:0046199C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046199F 51                      push ecx
:004619A0 FF156C604800            call dword ptr [0048606C]
:004619A6 8945A4                  mov dword ptr [ebp-5C], eax
:004619A9 8B55C8                  mov edx, dword ptr [ebp-38]
:004619AC 52                      push edx
:004619AD 8B45C4                  mov eax, dword ptr [ebp-3C]
:004619B0 50                      push eax
:004619B1 8B4DC0                  mov ecx, dword ptr [ebp-40]
:004619B4 51                      push ecx
:004619B5 8B55B0                  mov edx, dword ptr [ebp-50]
:004619B8 52                      push edx
:004619B9 8B4580                  mov eax, dword ptr [ebp-80]
:004619BC 50                      push eax
:004619BD FF159C604800            call dword ptr [0048609C]
:004619C3 8B4D80                  mov ecx, dword ptr [ebp-80]
:004619C6 51                      push ecx
:004619C7 8B5508                  mov edx, dword ptr [ebp+08]
:004619CA 52                      push edx
:004619CB FF1598604800            call dword ptr [00486098]
:004619D1 6A08                    push 00000008
:004619D3 FF1564634800            call dword ptr [00486364]
:004619D9 50                      push eax
:004619DA 8B4508                  mov eax, dword ptr [ebp+08]
:004619DD 50                      push eax
:004619DE FF1584604800            call dword ptr [00486084]
:004619E4 8945E4                  mov dword ptr [ebp-1C], eax
:004619E7 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:004619ED 8B510C                  mov edx, dword ptr [ecx+0C]
:004619F0 52                      push edx
:004619F1 8D45BC                  lea eax, dword ptr [ebp-44]
:004619F4 50                      push eax
:004619F5 8B4D10                  mov ecx, dword ptr [ebp+10]
:004619F8 51                      push ecx
:004619F9 E85CE20100              call 0047FC5A
:004619FE 83C404                  add esp, 00000004
:00461A01 50                      push eax
:00461A02 8B5510                  mov edx, dword ptr [ebp+10]
:00461A05 52                      push edx
:00461A06 8B4508                  mov eax, dword ptr [ebp+08]
:00461A09 50                      push eax
:00461A0A FF1568634800            call dword ptr [00486368]
:00461A10 8B4DB4                  mov ecx, dword ptr [ebp-4C]
:00461A13 51                      push ecx
:00461A14 8B55B0                  mov edx, dword ptr [ebp-50]
:00461A17 52                      push edx
:00461A18 8B45AC                  mov eax, dword ptr [ebp-54]
:00461A1B 50                      push eax
:00461A1C 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00461A1F 51                      push ecx
:00461A20 8B5580                  mov edx, dword ptr [ebp-80]
:00461A23 52                      push edx
:00461A24 FF159C604800            call dword ptr [0048609C]
:00461A2A 8B4580                  mov eax, dword ptr [ebp-80]
:00461A2D 50                      push eax
:00461A2E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00461A31 51                      push ecx
:00461A32 FF1598604800            call dword ptr [00486098]
:00461A38 8B9574FFFFFF            mov edx, dword ptr [ebp+FFFFFF74]
:00461A3E 52                      push edx
:00461A3F 8B4508                  mov eax, dword ptr [ebp+08]
:00461A42 50                      push eax
:00461A43 FF1584604800            call dword ptr [00486084]
:00461A49 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:00461A4F 8B510C                  mov edx, dword ptr [ecx+0C]
:00461A52 52                      push edx
:00461A53 8D45BC                  lea eax, dword ptr [ebp-44]
:00461A56 50                      push eax
:00461A57 8B4D10                  mov ecx, dword ptr [ebp+10]
:00461A5A 51                      push ecx
:00461A5B E8FAE10100              call 0047FC5A
:00461A60 83C404                  add esp, 00000004
:00461A63 50                      push eax
:00461A64 8B5510                  mov edx, dword ptr [ebp+10]
:00461A67 52                      push edx
:00461A68 8B4508                  mov eax, dword ptr [ebp+08]
:00461A6B 50                      push eax
:00461A6C FF1568634800            call dword ptr [00486368]
:00461A72 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00461A75 51                      push ecx
:00461A76 8B55D8                  mov edx, dword ptr [ebp-28]
:00461A79 52                      push edx
:00461A7A 8B45D4                  mov eax, dword ptr [ebp-2C]
:00461A7D 50                      push eax
:00461A7E 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00461A81 51                      push ecx
:00461A82 8B5580                  mov edx, dword ptr [ebp-80]
:00461A85 52                      push edx
:00461A86 FF159C604800            call dword ptr [0048609C]
:00461A8C 8B4580                  mov eax, dword ptr [ebp-80]
:00461A8F 50                      push eax
:00461A90 8B4D08                  mov ecx, dword ptr [ebp+08]
:00461A93 51                      push ecx
:00461A94 FF1598604800            call dword ptr [00486098]
:00461A9A 8B957CFFFFFF            mov edx, dword ptr [ebp+FFFFFF7C]
:00461AA0 52                      push edx
:00461AA1 8B4508                  mov eax, dword ptr [ebp+08]
:00461AA4 50                      push eax
:00461AA5 FF1584604800            call dword ptr [00486084]
:00461AAB 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:00461AB1 8B510C                  mov edx, dword ptr [ecx+0C]
:00461AB4 52                      push edx
:00461AB5 8D45BC                  lea eax, dword ptr [ebp-44]
:00461AB8 50                      push eax
:00461AB9 8B4D10                  mov ecx, dword ptr [ebp+10]
:00461ABC 51                      push ecx
:00461ABD E898E10100              call 0047FC5A
:00461AC2 83C404                  add esp, 00000004
:00461AC5 50                      push eax
:00461AC6 8B5510                  mov edx, dword ptr [ebp+10]
:00461AC9 52                      push edx
:00461ACA 8B4508                  mov eax, dword ptr [ebp+08]
:00461ACD 50                      push eax
:00461ACE FF1568634800            call dword ptr [00486368]
:00461AD4 6A00                    push 00000000
:00461AD6 6A00                    push 00000000
:00461AD8 6A00                    push 00000000
:00461ADA 6A00                    push 00000000
:00461ADC 8B4D80                  mov ecx, dword ptr [ebp-80]
:00461ADF 51                      push ecx
:00461AE0 FF159C604800            call dword ptr [0048609C]
:00461AE6 8B5580                  mov edx, dword ptr [ebp-80]
:00461AE9 52                      push edx
:00461AEA 8B4508                  mov eax, dword ptr [ebp+08]
:00461AED 50                      push eax
:00461AEE FF1598604800            call dword ptr [00486098]
:00461AF4 8B4DA4                  mov ecx, dword ptr [ebp-5C]
:00461AF7 51                      push ecx
:00461AF8 8B5508                  mov edx, dword ptr [ebp+08]
:00461AFB 52                      push edx
:00461AFC FF156C604800            call dword ptr [0048606C]
:00461B02 8B45CC                  mov eax, dword ptr [ebp-34]
:00461B05 50                      push eax
:00461B06 FF1548604800            call dword ptr [00486048]
:00461B0C 8B8D78FFFFFF            mov ecx, dword ptr [ebp+FFFFFF78]
:00461B12 51                      push ecx
:00461B13 8B5508                  mov edx, dword ptr [ebp+08]
:00461B16 52                      push edx
:00461B17 FF1594604800            call dword ptr [00486094]
:00461B1D 8B4580                  mov eax, dword ptr [ebp-80]
:00461B20 50                      push eax
:00461B21 FF1548604800            call dword ptr [00486048]
:00461B27 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00461B2E 8D4D88                  lea ecx, dword ptr [ebp-78]
:00461B31 E85A9DFAFF              call 0040B890
:00461B36 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00461B39 64890D00000000          mov dword ptr fs:[00000000], ecx
:00461B40 8BE5                    mov esp, ebp
:00461B42 5D                      pop ebp
:00461B43 C21000                  ret 0010



:00461B46 B3154600                DWORD 004615B3
:00461B4A DF144600                DWORD 004614DF
:00461B4E DE154600                DWORD 004615DE
:00461B52 DF144600                DWORD 004614DF
:00461B56 61164600                DWORD 00461661
:00461B5A 0A154600                DWORD 0046150A
:00461B5E 35154600                DWORD 00461535
:00461B62 5C154600                DWORD 0046155C
:00461B66 09164600                DWORD 00461609



* Referenced by a CALL at Addresses:
|:0045D5CB   , :0045D609   , :0045D647   , :0045D685   , :0045D6C3   
|:0045D701   , :0045D73F   , :0045D77D   , :0045EB8F   , :0045F025   
|:0046089E   , :00469611   , :00469A7E   , :00469AB0   , :00469D1A   
|:0046FEB6   , :0046FF71   , :00470832   , :00470F0D   , :00470F91   
|:0047232D   , :004780A7   , :00478201   
|
:00461B6A 55                      push ebp
:00461B6B 8BEC                    mov ebp, esp
:00461B6D 83EC10                  sub esp, 00000010
:00461B70 8B4508                  mov eax, dword ptr [ebp+08]
:00461B73 50                      push eax
:00461B74 FF159C634800            call dword ptr [0048639C]
:00461B7A 8945F8                  mov dword ptr [ebp-08], eax
:00461B7D C745F000000000          mov [ebp-10], 00000000
:00461B84 C745F400000000          mov [ebp-0C], 00000000
:00461B8B C745FC01000000          mov [ebp-04], 00000001
:00461B92 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00461B95 51                      push ecx
:00461B96 8B5508                  mov edx, dword ptr [ebp+08]
:00461B99 52                      push edx
:00461B9A FF1520634800            call dword ptr [00486320]
:00461BA0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00461BA3 0FAFC8                  imul ecx, eax
:00461BA6 894DFC                  mov dword ptr [ebp-04], ecx
:00461BA9 8D55F0                  lea edx, dword ptr [ebp-10]
:00461BAC 52                      push edx
:00461BAD 8B45F8                  mov eax, dword ptr [ebp-08]
:00461BB0 50                      push eax
:00461BB1 FF1564624800            call dword ptr [00486264]
:00461BB7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00461BBA 0FAFC8                  imul ecx, eax
:00461BBD 894DFC                  mov dword ptr [ebp-04], ecx
:00461BC0 8B550C                  mov edx, dword ptr [ebp+0C]
:00461BC3 52                      push edx
:00461BC4 8B4508                  mov eax, dword ptr [ebp+08]
:00461BC7 50                      push eax
:00461BC8 FF15EC624800            call dword ptr [004862EC]
:00461BCE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00461BD1 0FAFC8                  imul ecx, eax
:00461BD4 894DFC                  mov dword ptr [ebp-04], ecx
:00461BD7 8B550C                  mov edx, dword ptr [ebp+0C]
:00461BDA 8B02                    mov eax, dword ptr [edx]
:00461BDC 0345F0                  add eax, dword ptr [ebp-10]
:00461BDF 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00461BE2 8901                    mov dword ptr [ecx], eax
:00461BE4 8B550C                  mov edx, dword ptr [ebp+0C]
:00461BE7 8B4208                  mov eax, dword ptr [edx+08]
:00461BEA 0345F0                  add eax, dword ptr [ebp-10]
:00461BED 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00461BF0 894108                  mov dword ptr [ecx+08], eax
:00461BF3 8B550C                  mov edx, dword ptr [ebp+0C]
:00461BF6 8B4204                  mov eax, dword ptr [edx+04]
:00461BF9 0345F4                  add eax, dword ptr [ebp-0C]
:00461BFC 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00461BFF 894104                  mov dword ptr [ecx+04], eax
:00461C02 8B550C                  mov edx, dword ptr [ebp+0C]
:00461C05 8B420C                  mov eax, dword ptr [edx+0C]
:00461C08 0345F4                  add eax, dword ptr [ebp-0C]
:00461C0B 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00461C0E 89410C                  mov dword ptr [ecx+0C], eax
:00461C11 8B45FC                  mov eax, dword ptr [ebp-04]
:00461C14 8BE5                    mov esp, ebp
:00461C16 5D                      pop ebp
:00461C17 C3                      ret


:00461C18 CC                      int 03
:00461C19 CC                      int 03
:00461C1A CC                      int 03
:00461C1B CC                      int 03
:00461C1C CC                      int 03
:00461C1D CC                      int 03
:00461C1E CC                      int 03
:00461C1F CC                      int 03

* Referenced by a CALL at Address:
|:0045F867   
|
:00461C20 55                      push ebp
:00461C21 8BEC                    mov ebp, esp
:00461C23 51                      push ecx
:00461C24 894DFC                  mov dword ptr [ebp-04], ecx
:00461C27 8B45FC                  mov eax, dword ptr [ebp-04]
:00461C2A C7400401000000          mov [eax+04], 00000001
:00461C31 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00461C34 E820F1FFFF              call 00460D59
:00461C39 8B45FC                  mov eax, dword ptr [ebp-04]
:00461C3C 8BE5                    mov esp, ebp
:00461C3E 5D                      pop ebp
:00461C3F C3                      ret



* Referenced by a CALL at Address:
|:0045F8A6   
|
:00461C40 55                      push ebp
:00461C41 8BEC                    mov ebp, esp
:00461C43 51                      push ecx
:00461C44 894DFC                  mov dword ptr [ebp-04], ecx
:00461C47 8B45FC                  mov eax, dword ptr [ebp-04]
:00461C4A C7400801000000          mov [eax+08], 00000001
:00461C51 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00461C54 C70100000000            mov dword ptr [ecx], 00000000
:00461C5A 8B55FC                  mov edx, dword ptr [ebp-04]
:00461C5D C7420400000000          mov [edx+04], 00000000
:00461C64 8B45FC                  mov eax, dword ptr [ebp-04]
:00461C67 8BE5                    mov esp, ebp
:00461C69 5D                      pop ebp
:00461C6A C3                      ret


:00461C6B CC                      int 03
:00461C6C CC                      int 03
:00461C6D CC                      int 03
:00461C6E CC                      int 03
:00461C6F CC                      int 03

* Referenced by a CALL at Addresses:
|:00460E47   , :00460E5B   , :0046118A   , :004611B6   
|
:00461C70 55                      push ebp
:00461C71 8BEC                    mov ebp, esp
:00461C73 51                      push ecx
:00461C74 894DFC                  mov dword ptr [ebp-04], ecx
:00461C77 8B45FC                  mov eax, dword ptr [ebp-04]
:00461C7A 0508050000              add eax, 00000508
:00461C7F 8BE5                    mov esp, ebp
:00461C81 5D                      pop ebp
:00461C82 C3                      ret


:00461C83 CC                      int 03
:00461C84 CC                      int 03
:00461C85 CC                      int 03
:00461C86 CC                      int 03
:00461C87 CC                      int 03
:00461C88 CC                      int 03
:00461C89 CC                      int 03
:00461C8A CC                      int 03
:00461C8B CC                      int 03
:00461C8C CC                      int 03
:00461C8D CC                      int 03
:00461C8E CC                      int 03
:00461C8F CC                      int 03

* Referenced by a CALL at Addresses:
|:00460D8D   , :00460D9F   , :00460DB2   , :00460DC5   , :00460DD8   
|:00460DEA   , :00460DFD   , :00460E10   
|
:00461C90 55                      push ebp
:00461C91 8BEC                    mov ebp, esp
:00461C93 51                      push ecx
:00461C94 894DFC                  mov dword ptr [ebp-04], ecx
:00461C97 8B45FC                  mov eax, dword ptr [ebp-04]
:00461C9A 050C050000              add eax, 0000050C
:00461C9F 8BE5                    mov esp, ebp
:00461CA1 5D                      pop ebp
:00461CA2 C3                      ret


:00461CA3 CC                      int 03
:00461CA4 CC                      int 03
:00461CA5 CC                      int 03
:00461CA6 CC                      int 03
:00461CA7 CC                      int 03
:00461CA8 CC                      int 03
:00461CA9 CC                      int 03
:00461CAA CC                      int 03
:00461CAB CC                      int 03
:00461CAC CC                      int 03
:00461CAD CC                      int 03
:00461CAE CC                      int 03
:00461CAF CC                      int 03

* Referenced by a CALL at Address:
|:0041995F   
|
:00461CB0 55                      push ebp
:00461CB1 8BEC                    mov ebp, esp
:00461CB3 6AFF                    push FFFFFFFF
:00461CB5 689C574800              push 0048579C
:00461CBA 64A100000000            mov eax, dword ptr fs:[00000000]
:00461CC0 50                      push eax
:00461CC1 64892500000000          mov dword ptr fs:[00000000], esp
:00461CC8 81EC6C070000            sub esp, 0000076C
:00461CCE 8D8D88F8FFFF            lea ecx, dword ptr [ebp+FFFFF888]
:00461CD4 E8CCA20000              call 0046BFA5
:00461CD9 C745FC00000000          mov [ebp-04], 00000000
:00461CE0 A1686A4B00              mov eax, dword ptr [004B6A68]
:00461CE5 50                      push eax
:00461CE6 8B0D606A4B00            mov ecx, dword ptr [004B6A60]
:00461CEC 51                      push ecx
:00461CED 8D8D88F8FFFF            lea ecx, dword ptr [ebp+FFFFF888]
:00461CF3 E838A30000              call 0046C030
:00461CF8 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00461CFF 8D8D88F8FFFF            lea ecx, dword ptr [ebp+FFFFF888]
:00461D05 E8F6080100              call 00472600
:00461D0A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00461D0D 64890D00000000          mov dword ptr fs:[00000000], ecx
:00461D14 8BE5                    mov esp, ebp
:00461D16 5D                      pop ebp
:00461D17 C3                      ret



* Referenced by a CALL at Addresses:
|:00419847   , :004198D4   
|
:00461D18 55                      push ebp
:00461D19 8BEC                    mov ebp, esp
:00461D1B 6AFF                    push FFFFFFFF
:00461D1D 68BE574800              push 004857BE
:00461D22 64A100000000            mov eax, dword ptr fs:[00000000]
:00461D28 50                      push eax
:00461D29 64892500000000          mov dword ptr fs:[00000000], esp
:00461D30 81EC100A0000            sub esp, 00000A10
:00461D36 8B4508                  mov eax, dword ptr [ebp+08]
:00461D39 8985E4F5FFFF            mov dword ptr [ebp+FFFFF5E4], eax
:00461D3F 83BDE4F5FFFF00          cmp dword ptr [ebp+FFFFF5E4], 00000000
:00461D46 740B                    je 00461D53
:00461D48 83BDE4F5FFFF01          cmp dword ptr [ebp+FFFFF5E4], 00000001
:00461D4F 7441                    je 00461D92
:00461D51 EB7B                    jmp 00461DCE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00461D46(C)
|
:00461D53 8D8D6CFDFFFF            lea ecx, dword ptr [ebp+FFFFFD6C]
:00461D59 E8B98B0000              call 0046A917
:00461D5E C745FC00000000          mov [ebp-04], 00000000
:00461D65 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:00461D6B 51                      push ecx
:00461D6C 8B15606A4B00            mov edx, dword ptr [004B6A60]
:00461D72 52                      push edx
:00461D73 8D8D6CFDFFFF            lea ecx, dword ptr [ebp+FFFFFD6C]
:00461D79 E84F8C0000              call 0046A9CD
:00461D7E C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00461D85 8D8D6CFDFFFF            lea ecx, dword ptr [ebp+FFFFFD6C]
:00461D8B E840090100              call 004726D0
:00461D90 EB3C                    jmp 00461DCE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00461D4F(C)
|
:00461D92 8D8DE8F5FFFF            lea ecx, dword ptr [ebp+FFFFF5E8]
:00461D98 E8230B0100              call 004728C0
:00461D9D C745FC01000000          mov [ebp-04], 00000001
:00461DA4 A1686A4B00              mov eax, dword ptr [004B6A68]
:00461DA9 50                      push eax
:00461DAA 8B0D606A4B00            mov ecx, dword ptr [004B6A60]
:00461DB0 51                      push ecx
:00461DB1 8D8DE8F5FFFF            lea ecx, dword ptr [ebp+FFFFF5E8]
:00461DB7 E8DD990000              call 0046B799
:00461DBC C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00461DC3 8D8DE8F5FFFF            lea ecx, dword ptr [ebp+FFFFF5E8]
:00461DC9 E882090100              call 00472750

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00461D51(U), :00461D90(U)
|
:00461DCE 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00461DD1 64890D00000000          mov dword ptr fs:[00000000], ecx
:00461DD8 8BE5                    mov esp, ebp
:00461DDA 5D                      pop ebp
:00461DDB C3                      ret



* Referenced by a CALL at Addresses:
|:00469592   , :004697DC   , :00469877   , :0046E0A2   , :0046E18C   
|:0047105F   , :00476F1C   , :00477002   , :004770CE   , :004771B4   
|:00477280   , :0047730E   
|
:00461DDC 55                      push ebp
:00461DDD 8BEC                    mov ebp, esp
:00461DDF 81EC04010000            sub esp, 00000104
:00461DE5 8D4510                  lea eax, dword ptr [ebp+10]
:00461DE8 8985FCFEFFFF            mov dword ptr [ebp+FFFFFEFC], eax
:00461DEE 8B8DFCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEFC]
:00461DF4 51                      push ecx
:00461DF5 8B550C                  mov edx, dword ptr [ebp+0C]
:00461DF8 52                      push edx
:00461DF9 8D8500FFFFFF            lea eax, dword ptr [ebp+FFFFFF00]
:00461DFF 50                      push eax
:00461E00 FF155C634800            call dword ptr [0048635C]
:00461E06 8D8D00FFFFFF            lea ecx, dword ptr [ebp+FFFFFF00]
:00461E0C 51                      push ecx
:00461E0D 8B5508                  mov edx, dword ptr [ebp+08]
:00461E10 52                      push edx
:00461E11 FF1560634800            call dword ptr [00486360]
:00461E17 8BE5                    mov esp, ebp
:00461E19 5D                      pop ebp
:00461E1A C3                      ret



* Referenced by a CALL at Addresses:
|:00468FAA   , :00468FBE   , :00468FD8   , :00468FEC   , :00469006   
|:0046901A   , :00469034   , :00469048   , :00469062   , :00469076   
|:00469090   , :004690A4   , :004690BE   , :004690D2   , :004690EC   
|:00469100   
|
:00461E1B 55                      push ebp
:00461E1C 8BEC                    mov ebp, esp
:00461E1E 51                      push ecx
:00461E1F C745FC00000000          mov [ebp-04], 00000000
:00461E26 817D08FF000000          cmp dword ptr [ebp+08], 000000FF
:00461E2D 7507                    jne 00461E36
:00461E2F 33C0                    xor eax, eax
:00461E31 E9B9000000              jmp 00461EEF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00461E2D(C)
|
:00461E36 8B4508                  mov eax, dword ptr [ebp+08]
:00461E39 50                      push eax
:00461E3A E8DB49FAFF              call 0040681A
:00461E3F 83C404                  add esp, 00000004
:00461E42 25FF000000              and eax, 000000FF
:00461E47 394510                  cmp dword ptr [ebp+10], eax
:00461E4A 7557                    jne 00461EA3
:00461E4C 8B4D08                  mov ecx, dword ptr [ebp+08]
:00461E4F 6BC919                  imul ecx, 00000019
:00461E52 81C140114A00            add ecx, 004A1140
:00461E58 E8EFA8FAFF              call 0040C74C
:00461E5D 85C0                    test eax, eax
:00461E5F 7424                    je 00461E85
:00461E61 8A4D0C                  mov cl, byte ptr [ebp+0C]
:00461E64 51                      push ecx
:00461E65 8B4D08                  mov ecx, dword ptr [ebp+08]
:00461E68 6BC919                  imul ecx, 00000019
:00461E6B 81C140114A00            add ecx, 004A1140
:00461E71 E8FEA7FAFF              call 0040C674
:00461E76 25FF000000              and eax, 000000FF
:00461E7B 8B55FC                  mov edx, dword ptr [ebp-04]
:00461E7E 03D0                    add edx, eax
:00461E80 8955FC                  mov dword ptr [ebp-04], edx
:00461E83 EB1E                    jmp 00461EA3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00461E5F(C)
|
:00461E85 8B4D08                  mov ecx, dword ptr [ebp+08]
:00461E88 6BC919                  imul ecx, 00000019
:00461E8B 81C140114A00            add ecx, 004A1140
:00461E91 E8DABEFBFF              call 0041DD70
:00461E96 25FF000000              and eax, 000000FF
:00461E9B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00461E9E 03C8                    add ecx, eax
:00461EA0 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00461E4A(C), :00461E83(U)
|
:00461EA3 8B4D08                  mov ecx, dword ptr [ebp+08]
:00461EA6 6BC919                  imul ecx, 00000019
:00461EA9 81C140114A00            add ecx, 004A1140
:00461EAF E8BAA8FAFF              call 0040C76E
:00461EB4 85C0                    test eax, eax
:00461EB6 7434                    je 00461EEC
:00461EB8 8B5508                  mov edx, dword ptr [ebp+08]
:00461EBB 52                      push edx
:00461EBC E8CD48FAFF              call 0040678E
:00461EC1 83C404                  add esp, 00000004
:00461EC4 25FF000000              and eax, 000000FF
:00461EC9 394510                  cmp dword ptr [ebp+10], eax
:00461ECC 751E                    jne 00461EEC
:00461ECE 8B4D08                  mov ecx, dword ptr [ebp+08]
:00461ED1 6BC919                  imul ecx, 00000019
:00461ED4 81C140114A00            add ecx, 004A1140
:00461EDA E8D1BEFBFF              call 0041DDB0
:00461EDF 25FF000000              and eax, 000000FF
:00461EE4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00461EE7 03C8                    add ecx, eax
:00461EE9 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00461EB6(C), :00461ECC(C)
|
:00461EEC 8B45FC                  mov eax, dword ptr [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00461E31(U)
|
:00461EEF 8BE5                    mov esp, ebp
:00461EF1 5D                      pop ebp
:00461EF2 C3                      ret



* Referenced by a CALL at Addresses:
|:004620F3   , :004621B1   , :00470519   
|
:00461EF3 55                      push ebp
:00461EF4 8BEC                    mov ebp, esp
:00461EF6 83EC0C                  sub esp, 0000000C
:00461EF9 817D0CFF000000          cmp dword ptr [ebp+0C], 000000FF
:00461F00 7430                    je 00461F32
:00461F02 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00461F05 6BC919                  imul ecx, 00000019
:00461F08 81C140114A00            add ecx, 004A1140
:00461F0E E85BA8FAFF              call 0040C76E
:00461F13 85C0                    test eax, eax
:00461F15 7531                    jne 00461F48
:00461F17 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00461F1A 6BC919                  imul ecx, 00000019
:00461F1D 81C140114A00            add ecx, 004A1140
:00461F23 E81876FAFF              call 00409540
:00461F28 25FF000000              and eax, 000000FF
:00461F2D 83F812                  cmp eax, 00000012
:00461F30 7D16                    jge 00461F48

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00461F00(C)
|
:00461F32 68FC684B00              push 004B68FC
:00461F37 8B4508                  mov eax, dword ptr [ebp+08]
:00461F3A 50                      push eax
:00461F3B E83DDD0100              call 0047FC7D
:00461F40 83C408                  add esp, 00000008
:00461F43 E9B9000000              jmp 00462001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00461F15(C), :00461F30(C)
|
:00461F48 8D4DF8                  lea ecx, dword ptr [ebp-08]
:00461F4B 51                      push ecx
:00461F4C 8B550C                  mov edx, dword ptr [ebp+0C]
:00461F4F 52                      push edx
:00461F50 E866020000              call 004621BB
:00461F55 83C408                  add esp, 00000008
:00461F58 8945F4                  mov dword ptr [ebp-0C], eax
:00461F5B 837DF400                cmp dword ptr [ebp-0C], 00000000
:00461F5F 752D                    jne 00461F8E
:00461F61 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00461F64 6BC919                  imul ecx, 00000019
:00461F67 81C140114A00            add ecx, 004A1140
:00461F6D E8A0A8FAFF              call 0040C812
:00461F72 25FF000000              and eax, 000000FF
:00461F77 8B048550BC4800          mov eax, dword ptr [4*eax+0048BC50]
:00461F7E 50                      push eax
:00461F7F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00461F82 51                      push ecx
:00461F83 FF15C0624800            call dword ptr [004862C0]
:00461F89 83C408                  add esp, 00000008
:00461F8C EB73                    jmp 00462001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00461F5F(C)
|
:00461F8E 817DF4FF000000          cmp dword ptr [ebp-0C], 000000FF
:00461F95 7536                    jne 00461FCD
:00461F97 8D55F8                  lea edx, dword ptr [ebp-08]
:00461F9A 52                      push edx
:00461F9B 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00461F9E 6BC919                  imul ecx, 00000019
:00461FA1 81C140114A00            add ecx, 004A1140
:00461FA7 E866A8FAFF              call 0040C812
:00461FAC 25FF000000              and eax, 000000FF
:00461FB1 8B048550BC4800          mov eax, dword ptr [4*eax+0048BC50]
:00461FB8 50                      push eax

* Possible StringData Ref from Data Obj ->"%s (%s)"
                                  |
:00461FB9 6860E64800              push 0048E660
:00461FBE 8B4D08                  mov ecx, dword ptr [ebp+08]
:00461FC1 51                      push ecx
:00461FC2 FF15C0624800            call dword ptr [004862C0]
:00461FC8 83C410                  add esp, 00000010
:00461FCB EB34                    jmp 00462001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00461F95(C)
|
:00461FCD 8D55F8                  lea edx, dword ptr [ebp-08]
:00461FD0 52                      push edx
:00461FD1 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00461FD4 6BC919                  imul ecx, 00000019
:00461FD7 81C140114A00            add ecx, 004A1140
:00461FDD E830A8FAFF              call 0040C812
:00461FE2 25FF000000              and eax, 000000FF
:00461FE7 8B048550BC4800          mov eax, dword ptr [4*eax+0048BC50]
:00461FEE 50                      push eax

* Possible StringData Ref from Data Obj ->"%s %s"
                                  |
:00461FEF 6868E64800              push 0048E668
:00461FF4 8B4D08                  mov ecx, dword ptr [ebp+08]
:00461FF7 51                      push ecx
:00461FF8 FF15C0624800            call dword ptr [004862C0]
:00461FFE 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00461F43(U), :00461F8C(U), :00461FCB(U)
|
:00462001 8BE5                    mov esp, ebp
:00462003 5D                      pop ebp
:00462004 C3                      ret



* Referenced by a CALL at Addresses:
|:0040C9E0   , :004697F0   , :00476F98   , :0047714A   , :004772A7   
|
:00462005 55                      push ebp
:00462006 8BEC                    mov ebp, esp
:00462008 51                      push ecx
:00462009 817D0CFF000000          cmp dword ptr [ebp+0C], 000000FF
:00462010 7517                    jne 00462029
:00462012 6800694B00              push 004B6900
:00462017 8B4508                  mov eax, dword ptr [ebp+08]
:0046201A 50                      push eax
:0046201B FF15C0624800            call dword ptr [004862C0]
:00462021 83C408                  add esp, 00000008
:00462024 E9D2000000              jmp 004620FB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00462010(C)
|
:00462029 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046202C 51                      push ecx
:0046202D E8E847FAFF              call 0040681A
:00462032 83C404                  add esp, 00000004
:00462035 8845FC                  mov byte ptr [ebp-04], al
:00462038 807DFC00                cmp byte ptr [ebp-04], 00
:0046203C 7411                    je 0046204F
:0046203E 807DFC01                cmp byte ptr [ebp-04], 01
:00462042 743F                    je 00462083
:00462044 807DFC02                cmp byte ptr [ebp-04], 02
:00462048 746D                    je 004620B7
:0046204A E99C000000              jmp 004620EB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046203C(C)
|
:0046204F 8A5510                  mov dl, byte ptr [ebp+10]
:00462052 52                      push edx
:00462053 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00462056 6BC919                  imul ecx, 00000019
:00462059 81C140114A00            add ecx, 004A1140
:0046205F E810A6FAFF              call 0040C674
:00462064 25FF000000              and eax, 000000FF
:00462069 50                      push eax
:0046206A 68E06A4800              push 00486AE0

* Possible StringData Ref from Data Obj ->"%s +%u"
                                  |
:0046206F 6870E64800              push 0048E670
:00462074 8B4508                  mov eax, dword ptr [ebp+08]
:00462077 50                      push eax
:00462078 FF15C0624800            call dword ptr [004862C0]
:0046207E 83C410                  add esp, 00000010
:00462081 EB78                    jmp 004620FB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00462042(C)
|
:00462083 8A4D10                  mov cl, byte ptr [ebp+10]
:00462086 51                      push ecx
:00462087 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046208A 6BC919                  imul ecx, 00000019
:0046208D 81C140114A00            add ecx, 004A1140
:00462093 E8DCA5FAFF              call 0040C674
:00462098 25FF000000              and eax, 000000FF
:0046209D 50                      push eax
:0046209E 68006B4800              push 00486B00

* Possible StringData Ref from Data Obj ->"%s +%u"
                                  |
:004620A3 6878E64800              push 0048E678
:004620A8 8B5508                  mov edx, dword ptr [ebp+08]
:004620AB 52                      push edx
:004620AC FF15C0624800            call dword ptr [004862C0]
:004620B2 83C410                  add esp, 00000010
:004620B5 EB44                    jmp 004620FB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00462048(C)
|
:004620B7 8A4510                  mov al, byte ptr [ebp+10]
:004620BA 50                      push eax
:004620BB 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004620BE 6BC919                  imul ecx, 00000019
:004620C1 81C140114A00            add ecx, 004A1140
:004620C7 E8A8A5FAFF              call 0040C674
:004620CC 25FF000000              and eax, 000000FF
:004620D1 50                      push eax
:004620D2 68F06A4800              push 00486AF0

* Possible StringData Ref from Data Obj ->"%s +%u"
                                  |
:004620D7 6880E64800              push 0048E680
:004620DC 8B4D08                  mov ecx, dword ptr [ebp+08]
:004620DF 51                      push ecx
:004620E0 FF15C0624800            call dword ptr [004862C0]
:004620E6 83C410                  add esp, 00000010
:004620E9 EB10                    jmp 004620FB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046204A(U)
|
:004620EB 8B550C                  mov edx, dword ptr [ebp+0C]
:004620EE 52                      push edx
:004620EF 8B4508                  mov eax, dword ptr [ebp+08]
:004620F2 50                      push eax
:004620F3 E8FBFDFFFF              call 00461EF3
:004620F8 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00462024(U), :00462081(U), :004620B5(U), :004620E9(U)
|
:004620FB 8BE5                    mov esp, ebp
:004620FD 5D                      pop ebp
:004620FE C3                      ret



* Referenced by a CALL at Address:
|:00467A9B   
|
:004620FF 55                      push ebp
:00462100 8BEC                    mov ebp, esp
:00462102 817D0CFF000000          cmp dword ptr [ebp+0C], 000000FF
:00462109 7513                    jne 0046211E

* Possible StringData Ref from Data Obj ->"--"
                                  |
:0046210B 6888E64800              push 0048E688
:00462110 8B4508                  mov eax, dword ptr [ebp+08]
:00462113 50                      push eax
:00462114 E864DB0100              call 0047FC7D
:00462119 83C408                  add esp, 00000008
:0046211C EB54                    jmp 00462172

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00462109(C)
|
:0046211E 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00462121 6BC919                  imul ecx, 00000019
:00462124 81C140114A00            add ecx, 004A1140
:0046212A E81DA6FAFF              call 0040C74C
:0046212F 85C0                    test eax, eax
:00462131 742F                    je 00462162
:00462133 8A4D10                  mov cl, byte ptr [ebp+10]
:00462136 51                      push ecx
:00462137 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046213A 6BC919                  imul ecx, 00000019
:0046213D 81C140114A00            add ecx, 004A1140
:00462143 E82CA5FAFF              call 0040C674
:00462148 25FF000000              and eax, 000000FF
:0046214D 50                      push eax

* Possible StringData Ref from Data Obj ->"+%d"
                                  |
:0046214E 688CE64800              push 0048E68C
:00462153 8B5508                  mov edx, dword ptr [ebp+08]
:00462156 52                      push edx
:00462157 FF15C0624800            call dword ptr [004862C0]
:0046215D 83C40C                  add esp, 0000000C
:00462160 EB10                    jmp 00462172

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00462131(C)
|
:00462162 8B4508                  mov eax, dword ptr [ebp+08]
:00462165 50                      push eax
:00462166 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00462169 51                      push ecx
:0046216A E84C000000              call 004621BB
:0046216F 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046211C(U), :00462160(U)
|
:00462172 5D                      pop ebp
:00462173 C3                      ret



* Referenced by a CALL at Addresses:
|:0040CA09   , :00469651   
|
:00462174 55                      push ebp
:00462175 8BEC                    mov ebp, esp
:00462177 817D0CFF000000          cmp dword ptr [ebp+0C], 000000FF
:0046217E 7415                    je 00462195
:00462180 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00462183 6BC919                  imul ecx, 00000019
:00462186 81C140114A00            add ecx, 004A1140
:0046218C E8DDA5FAFF              call 0040C76E
:00462191 85C0                    test eax, eax
:00462193 7514                    jne 004621A9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046217E(C)
|
:00462195 6804694B00              push 004B6904
:0046219A 8B4508                  mov eax, dword ptr [ebp+08]
:0046219D 50                      push eax
:0046219E FF15C0624800            call dword ptr [004862C0]
:004621A4 83C408                  add esp, 00000008
:004621A7 EB10                    jmp 004621B9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00462193(C)
|
:004621A9 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004621AC 51                      push ecx
:004621AD 8B5508                  mov edx, dword ptr [ebp+08]
:004621B0 52                      push edx
:004621B1 E83DFDFFFF              call 00461EF3
:004621B6 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004621A7(U)
|
:004621B9 5D                      pop ebp
:004621BA C3                      ret



* Referenced by a CALL at Addresses:
|:00461F50   , :0046216A   , :0046736B   , :004673C8   
|
:004621BB 55                      push ebp
:004621BC 8BEC                    mov ebp, esp
:004621BE 83EC08                  sub esp, 00000008
:004621C1 8B4D08                  mov ecx, dword ptr [ebp+08]
:004621C4 6BC919                  imul ecx, 00000019
:004621C7 81C140114A00            add ecx, 004A1140
:004621CD E89CA5FAFF              call 0040C76E
:004621D2 85C0                    test eax, eax
:004621D4 741B                    je 004621F1
:004621D6 8B4D08                  mov ecx, dword ptr [ebp+08]
:004621D9 6BC919                  imul ecx, 00000019
:004621DC 81C140114A00            add ecx, 004A1140
:004621E2 E8C9BBFBFF              call 0041DDB0
:004621E7 25FF000000              and eax, 000000FF
:004621EC 8945FC                  mov dword ptr [ebp-04], eax
:004621EF EB19                    jmp 0046220A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004621D4(C)
|
:004621F1 8B4D08                  mov ecx, dword ptr [ebp+08]
:004621F4 6BC919                  imul ecx, 00000019
:004621F7 81C140114A00            add ecx, 004A1140
:004621FD E86EBBFBFF              call 0041DD70
:00462202 25FF000000              and eax, 000000FF
:00462207 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004621EF(U)
|
:0046220A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046220D 6BC919                  imul ecx, 00000019
:00462210 81C140114A00            add ecx, 004A1140
:00462216 E8F7A5FAFF              call 0040C812
:0046221B 25FF000000              and eax, 000000FF
:00462220 83C012                  add eax, 00000012
:00462223 8945F8                  mov dword ptr [ebp-08], eax
:00462226 8B45F8                  mov eax, dword ptr [ebp-08]
:00462229 83E812                  sub eax, 00000012
:0046222C 8945F8                  mov dword ptr [ebp-08], eax
:0046222F 837DF83A                cmp dword ptr [ebp-08], 0000003A
:00462233 0F87E3000000            ja 0046231C
:00462239 8B55F8                  mov edx, dword ptr [ebp-08]
:0046223C 33C9                    xor ecx, ecx
:0046223E 8A8A6B234600            mov cl, byte ptr [edx+0046236B]
:00462244 FF248D23234600          jmp dword ptr [4*ecx+00462323]
:0046224B C745FC00000000          mov [ebp-04], 00000000
:00462252 837D0C00                cmp dword ptr [ebp+0C], 00000000
:00462256 7411                    je 00462269

* Possible StringData Ref from Data Obj ->"--"
                                  |
:00462258 6890E64800              push 0048E690
:0046225D 8B450C                  mov eax, dword ptr [ebp+0C]
:00462260 50                      push eax
:00462261 E817DA0100              call 0047FC7D
:00462266 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00462256(C)
|
:00462269 E9AE000000              jmp 0046231C
:0046226E 837D0C00                cmp dword ptr [ebp+0C], 00000000
:00462272 7416                    je 0046228A
:00462274 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00462277 51                      push ecx

* Possible StringData Ref from Data Obj ->"+%d%%"
                                  |
:00462278 6894E64800              push 0048E694
:0046227D 8B550C                  mov edx, dword ptr [ebp+0C]
:00462280 52                      push edx
:00462281 FF15C0624800            call dword ptr [004862C0]
:00462287 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00462272(C)
|
:0046228A E98D000000              jmp 0046231C
:0046228F 837D0C00                cmp dword ptr [ebp+0C], 00000000
:00462293 7416                    je 004622AB
:00462295 8B45FC                  mov eax, dword ptr [ebp-04]
:00462298 50                      push eax

* Possible StringData Ref from Data Obj ->"-%d%%"
                                  |
:00462299 689CE64800              push 0048E69C
:0046229E 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004622A1 51                      push ecx
:004622A2 FF15C0624800            call dword ptr [004862C0]
:004622A8 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00462293(C)
|
:004622AB EB6F                    jmp 0046231C
:004622AD 837D0C00                cmp dword ptr [ebp+0C], 00000000
:004622B1 7469                    je 0046231C
:004622B3 817DFCFF000000          cmp dword ptr [ebp-04], 000000FF
:004622BA 7513                    jne 004622CF

* Possible StringData Ref from Data Obj ->"ALL"
                                  |
:004622BC 68A4E64800              push 0048E6A4
:004622C1 8B550C                  mov edx, dword ptr [ebp+0C]
:004622C4 52                      push edx
:004622C5 E8B3D90100              call 0047FC7D
:004622CA 83C408                  add esp, 00000008
:004622CD EB4D                    jmp 0046231C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004622BA(C)
|
:004622CF 837DFC00                cmp dword ptr [ebp-04], 00000000
:004622D3 7E18                    jle 004622ED
:004622D5 8B45FC                  mov eax, dword ptr [ebp-04]
:004622D8 50                      push eax

* Possible StringData Ref from Data Obj ->"+%d"
                                  |
:004622D9 68A8E64800              push 0048E6A8
:004622DE 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004622E1 51                      push ecx
:004622E2 FF15C0624800            call dword ptr [004862C0]
:004622E8 83C40C                  add esp, 0000000C
:004622EB EB2F                    jmp 0046231C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004622D3(C)
|
:004622ED 837DFC00                cmp dword ptr [ebp-04], 00000000
:004622F1 7513                    jne 00462306

* Possible StringData Ref from Data Obj ->"--"
                                  |
:004622F3 68ACE64800              push 0048E6AC
:004622F8 8B550C                  mov edx, dword ptr [ebp+0C]
:004622FB 52                      push edx
:004622FC E87CD90100              call 0047FC7D
:00462301 83C408                  add esp, 00000008
:00462304 EB16                    jmp 0046231C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004622F1(C)
|
:00462306 8B45FC                  mov eax, dword ptr [ebp-04]
:00462309 50                      push eax

* Possible StringData Ref from Data Obj ->"%d"
                                  |
:0046230A 68B0E64800              push 0048E6B0
:0046230F 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00462312 51                      push ecx
:00462313 FF15C0624800            call dword ptr [004862C0]
:00462319 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00462233(C), :00462269(U), :0046228A(U), :004622AB(U), :004622B1(C)
|:004622CD(U), :004622EB(U), :00462304(U)
|
:0046231C 8B45FC                  mov eax, dword ptr [ebp-04]
:0046231F 8BE5                    mov esp, ebp
:00462321 5D                      pop ebp
:00462322 C3                      ret



:00462323 4B224600                DWORD 0046224B
:00462327 AD224600                DWORD 004622AD
:0046232B 4B224600                DWORD 0046224B
:0046232F AD224600                DWORD 004622AD
:00462333 4B224600                DWORD 0046224B
:00462337 6E224600                DWORD 0046226E
:0046233B 4B224600                DWORD 0046224B
:0046233F 6E224600                DWORD 0046226E
:00462343 4B224600                DWORD 0046224B
:00462347 8F224600                DWORD 0046228F
:0046234B 4B224600                DWORD 0046224B
:0046234F 8F224600                DWORD 0046228F
:00462353 4B224600                DWORD 0046224B
:00462357 AD224600                DWORD 004622AD
:0046235B 4B224600                DWORD 0046224B
:0046235F AD224600                DWORD 004622AD
:00462363 4B224600                DWORD 0046224B
:00462367 1C234600                DWORD 0046231C


:0046236B 000000000000            BYTE  6 DUP(0)


:00462371 0101                    add dword ptr [ecx], eax
:00462373 0101                    add dword ptr [ecx], eax
:00462375 0101                    add dword ptr [ecx], eax
:00462377 0102                    add dword ptr [edx], eax
:00462379 030404                  add eax, dword ptr [esp+eax]
:0046237C 0404                    add al, 04
:0046237E 0404                    add al, 04
:00462380 0506060606              add eax, 06060606
:00462385 06                      push es
:00462386 06                      push es
:00462387 06                      push es
:00462388 06                      push es
:00462389 06                      push es
:0046238A 06                      push es
:0046238B 06                      push es
:0046238C 06                      push es
:0046238D 07                      pop es
:0046238E 07                      pop es
:0046238F 07                      pop es
:00462390 07                      pop es
:00462391 0808                    or byte ptr [eax], cl
:00462393 0809                    or byte ptr [ecx], cl
:00462395 0A0B                    or cl, byte ptr [ebx]
:00462397 0C0D                    or al, 0D
:00462399 0D0E0E0E0E              or eax, 0E0E0E0E
:0046239E 0E                      push cs
:0046239F 0F                      BYTE 0fh
:004623A0 0F                      BYTE 0fh
:004623A1 0F                      BYTE 0fh
:004623A2 0F                      BYTE 0fh
:004623A3 0F                      BYTE 0fh
:004623A4 1010                    adc byte ptr [eax], dl

* Referenced by a CALL at Addresses:
|:0045E973   , :00468251   , :0046AECE   , :0046B947   , :0046C4AD   
|:0046ECAC   , :0046EFD0   , :0046F2DB   , :0046F975   , :00471027   
|:0047A415   
|
:004623A6 55                      push ebp
:004623A7 8BEC                    mov ebp, esp
:004623A9 83EC28                  sub esp, 00000028
:004623AC 8D45D8                  lea eax, dword ptr [ebp-28]
:004623AF 50                      push eax
:004623B0 8B4D08                  mov ecx, dword ptr [ebp+08]
:004623B3 51                      push ecx
:004623B4 FF1598634800            call dword ptr [00486398]
:004623BA 8B550C                  mov edx, dword ptr [ebp+0C]
:004623BD 52                      push edx
:004623BE FF15C8624800            call dword ptr [004862C8]
:004623C4 85C0                    test eax, eax
:004623C6 740E                    je 004623D6
:004623C8 8B450C                  mov eax, dword ptr [ebp+0C]
:004623CB 50                      push eax
:004623CC FF1554634800            call dword ptr [00486354]
:004623D2 85C0                    test eax, eax
:004623D4 7412                    je 004623E8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004623C6(C)
|
:004623D6 6A00                    push 00000000
:004623D8 8D4DF0                  lea ecx, dword ptr [ebp-10]
:004623DB 51                      push ecx
:004623DC 6A00                    push 00000000
:004623DE 6A30                    push 00000030
:004623E0 FF1558634800            call dword ptr [00486358]
:004623E6 EB0E                    jmp 004623F6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004623D4(C)
|
:004623E8 8D55F0                  lea edx, dword ptr [ebp-10]
:004623EB 52                      push edx
:004623EC 8B450C                  mov eax, dword ptr [ebp+0C]
:004623EF 50                      push eax
:004623F0 FF1598634800            call dword ptr [00486398]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004623E6(U)
|
:004623F6 8B45F8                  mov eax, dword ptr [ebp-08]
:004623F9 0345F0                  add eax, dword ptr [ebp-10]
:004623FC 8B4DE0                  mov ecx, dword ptr [ebp-20]
:004623FF 2B4DD8                  sub ecx, dword ptr [ebp-28]
:00462402 2BC1                    sub eax, ecx
:00462404 99                      cdq
:00462405 2BC2                    sub eax, edx
:00462407 D1F8                    sar eax, 1
:00462409 8945EC                  mov dword ptr [ebp-14], eax
:0046240C 8B45FC                  mov eax, dword ptr [ebp-04]
:0046240F 0345F4                  add eax, dword ptr [ebp-0C]
:00462412 8B55E4                  mov edx, dword ptr [ebp-1C]
:00462415 2B55DC                  sub edx, dword ptr [ebp-24]
:00462418 2BC2                    sub eax, edx
:0046241A 99                      cdq
:0046241B 2BC2                    sub eax, edx
:0046241D D1F8                    sar eax, 1
:0046241F 8945E8                  mov dword ptr [ebp-18], eax
:00462422 6A00                    push 00000000
:00462424 8D45F0                  lea eax, dword ptr [ebp-10]
:00462427 50                      push eax
:00462428 6A00                    push 00000000
:0046242A 6A30                    push 00000030
:0046242C FF1558634800            call dword ptr [00486358]
:00462432 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00462435 3B4DF0                  cmp ecx, dword ptr [ebp-10]
:00462438 7D06                    jge 00462440
:0046243A 8B55F0                  mov edx, dword ptr [ebp-10]
:0046243D 8955EC                  mov dword ptr [ebp-14], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00462438(C)
|
:00462440 8B45E8                  mov eax, dword ptr [ebp-18]
:00462443 3B45F4                  cmp eax, dword ptr [ebp-0C]
:00462446 7D06                    jge 0046244E
:00462448 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046244B 894DE8                  mov dword ptr [ebp-18], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00462446(C)
|
:0046244E 8B55EC                  mov edx, dword ptr [ebp-14]
:00462451 0355E0                  add edx, dword ptr [ebp-20]
:00462454 2B55D8                  sub edx, dword ptr [ebp-28]
:00462457 3955F8                  cmp dword ptr [ebp-08], edx
:0046245A 7D0E                    jge 0046246A
:0046245C 8B45E0                  mov eax, dword ptr [ebp-20]
:0046245F 2B45D8                  sub eax, dword ptr [ebp-28]
:00462462 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00462465 2BC8                    sub ecx, eax
:00462467 894DEC                  mov dword ptr [ebp-14], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046245A(C)
|
:0046246A 8B55E8                  mov edx, dword ptr [ebp-18]
:0046246D 0355E4                  add edx, dword ptr [ebp-1C]
:00462470 2B55DC                  sub edx, dword ptr [ebp-24]
:00462473 3955FC                  cmp dword ptr [ebp-04], edx
:00462476 7D0E                    jge 00462486
:00462478 8B45E4                  mov eax, dword ptr [ebp-1C]
:0046247B 2B45DC                  sub eax, dword ptr [ebp-24]
:0046247E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00462481 2BC8                    sub ecx, eax
:00462483 894DE8                  mov dword ptr [ebp-18], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00462476(C)
|
:00462486 6A05                    push 00000005
:00462488 6A00                    push 00000000
:0046248A 6A00                    push 00000000
:0046248C 8B55E8                  mov edx, dword ptr [ebp-18]
:0046248F 52                      push edx
:00462490 8B45EC                  mov eax, dword ptr [ebp-14]
:00462493 50                      push eax
:00462494 6A00                    push 00000000
:00462496 8B4D08                  mov ecx, dword ptr [ebp+08]
:00462499 51                      push ecx
:0046249A FF1580624800            call dword ptr [00486280]
:004624A0 8BE5                    mov esp, ebp
:004624A2 5D                      pop ebp
:004624A3 C3                      ret



* Referenced by a CALL at Addresses:
|:00462598   , :00462615   
|
:004624A4 55                      push ebp
:004624A5 8BEC                    mov ebp, esp
:004624A7 51                      push ecx
:004624A8 894DFC                  mov dword ptr [ebp-04], ecx
:004624AB 8B45FC                  mov eax, dword ptr [ebp-04]
:004624AE C70000000000            mov dword ptr [eax], 00000000
:004624B4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004624B7 8B5508                  mov edx, dword ptr [ebp+08]
:004624BA 895104                  mov dword ptr [ecx+04], edx
:004624BD 8B45FC                  mov eax, dword ptr [ebp-04]
:004624C0 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004624C3 894808                  mov dword ptr [eax+08], ecx
:004624C6 8B45FC                  mov eax, dword ptr [ebp-04]
:004624C9 8BE5                    mov esp, ebp
:004624CB 5D                      pop ebp
:004624CC C20800                  ret 0008



* Referenced by a CALL at Address:
|:004727CA   
|
:004624CF 55                      push ebp
:004624D0 8BEC                    mov ebp, esp
:004624D2 83EC10                  sub esp, 00000010
:004624D5 894DF4                  mov dword ptr [ebp-0C], ecx
:004624D8 8B45F4                  mov eax, dword ptr [ebp-0C]
:004624DB 833800                  cmp dword ptr [eax], 00000000
:004624DE 742A                    je 0046250A
:004624E0 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004624E3 8B11                    mov edx, dword ptr [ecx]
:004624E5 8955F8                  mov dword ptr [ebp-08], edx
:004624E8 8B45F8                  mov eax, dword ptr [ebp-08]
:004624EB 8945FC                  mov dword ptr [ebp-04], eax
:004624EE 837DFC00                cmp dword ptr [ebp-04], 00000000
:004624F2 740F                    je 00462503
:004624F4 6A01                    push 00000001
:004624F6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004624F9 E8C2020100              call 004727C0
:004624FE 8945F0                  mov dword ptr [ebp-10], eax
:00462501 EB07                    jmp 0046250A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004624F2(C)
|
:00462503 C745F000000000          mov [ebp-10], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004624DE(C), :00462501(U)
|
:0046250A 8BE5                    mov esp, ebp
:0046250C 5D                      pop ebp
:0046250D C3                      ret



* Referenced by a CALL at Address:
|:004727FA   
|
:0046250E 55                      push ebp
:0046250F 8BEC                    mov ebp, esp
:00462511 83EC10                  sub esp, 00000010
:00462514 894DF4                  mov dword ptr [ebp-0C], ecx
:00462517 8B45F4                  mov eax, dword ptr [ebp-0C]
:0046251A 833800                  cmp dword ptr [eax], 00000000
:0046251D 742A                    je 00462549
:0046251F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00462522 8B11                    mov edx, dword ptr [ecx]
:00462524 8955F8                  mov dword ptr [ebp-08], edx
:00462527 8B45F8                  mov eax, dword ptr [ebp-08]
:0046252A 8945FC                  mov dword ptr [ebp-04], eax
:0046252D 837DFC00                cmp dword ptr [ebp-04], 00000000
:00462531 740F                    je 00462542
:00462533 6A01                    push 00000001
:00462535 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00462538 E883020100              call 004727C0
:0046253D 8945F0                  mov dword ptr [ebp-10], eax
:00462540 EB07                    jmp 00462549

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00462531(C)
|
:00462542 C745F000000000          mov [ebp-10], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046251D(C), :00462540(U)
|
:00462549 8BE5                    mov esp, ebp
:0046254B 5D                      pop ebp
:0046254C C3                      ret



* Referenced by a CALL at Addresses:
|:004628A9   , :0046D17F   
|
:0046254D 55                      push ebp
:0046254E 8BEC                    mov ebp, esp
:00462550 6AFF                    push FFFFFFFF
:00462552 68DE574800              push 004857DE
:00462557 64A100000000            mov eax, dword ptr fs:[00000000]
:0046255D 50                      push eax
:0046255E 64892500000000          mov dword ptr fs:[00000000], esp
:00462565 83EC20                  sub esp, 00000020
:00462568 894DDC                  mov dword ptr [ebp-24], ecx
:0046256B 8B45DC                  mov eax, dword ptr [ebp-24]
:0046256E 833800                  cmp dword ptr [eax], 00000000
:00462571 7552                    jne 004625C5
:00462573 6A0C                    push 0000000C
:00462575 E866EA0100              call 00480FE0
:0046257A 83C404                  add esp, 00000004
:0046257D 8945EC                  mov dword ptr [ebp-14], eax
:00462580 C745FC00000000          mov [ebp-04], 00000000
:00462587 837DEC00                cmp dword ptr [ebp-14], 00000000
:0046258B 7415                    je 004625A2
:0046258D 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00462590 51                      push ecx
:00462591 8B5508                  mov edx, dword ptr [ebp+08]
:00462594 52                      push edx
:00462595 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00462598 E807FFFFFF              call 004624A4
:0046259D 8945D8                  mov dword ptr [ebp-28], eax
:004625A0 EB07                    jmp 004625A9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046258B(C)
|
:004625A2 C745D800000000          mov [ebp-28], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004625A0(U)
|
:004625A9 8B45D8                  mov eax, dword ptr [ebp-28]
:004625AC 8945E8                  mov dword ptr [ebp-18], eax
:004625AF C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:004625B6 8B4DDC                  mov ecx, dword ptr [ebp-24]
:004625B9 8B55E8                  mov edx, dword ptr [ebp-18]
:004625BC 8911                    mov dword ptr [ecx], edx
:004625BE B801000000              mov eax, 00000001
:004625C3 EB7B                    jmp 00462640

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00462571(C)
|
:004625C5 8B45DC                  mov eax, dword ptr [ebp-24]
:004625C8 8B08                    mov ecx, dword ptr [eax]
:004625CA 894DF0                  mov dword ptr [ebp-10], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004625EE(U)
|
:004625CD 8B55F0                  mov edx, dword ptr [ebp-10]
:004625D0 8B4508                  mov eax, dword ptr [ebp+08]
:004625D3 3B4204                  cmp eax, dword ptr [edx+04]
:004625D6 7504                    jne 004625DC
:004625D8 33C0                    xor eax, eax
:004625DA EB64                    jmp 00462640

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004625D6(C)
|
:004625DC 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004625DF 833900                  cmp dword ptr [ecx], 00000000
:004625E2 7502                    jne 004625E6
:004625E4 EB0A                    jmp 004625F0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004625E2(C)
|
:004625E6 8B55F0                  mov edx, dword ptr [ebp-10]
:004625E9 8B02                    mov eax, dword ptr [edx]
:004625EB 8945F0                  mov dword ptr [ebp-10], eax
:004625EE EBDD                    jmp 004625CD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004625E4(U)
|
:004625F0 6A0C                    push 0000000C
:004625F2 E8E9E90100              call 00480FE0
:004625F7 83C404                  add esp, 00000004
:004625FA 8945E4                  mov dword ptr [ebp-1C], eax
:004625FD C745FC01000000          mov [ebp-04], 00000001
:00462604 837DE400                cmp dword ptr [ebp-1C], 00000000
:00462608 7415                    je 0046261F
:0046260A 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046260D 51                      push ecx
:0046260E 8B5508                  mov edx, dword ptr [ebp+08]
:00462611 52                      push edx
:00462612 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00462615 E88AFEFFFF              call 004624A4
:0046261A 8945D4                  mov dword ptr [ebp-2C], eax
:0046261D EB07                    jmp 00462626

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00462608(C)
|
:0046261F C745D400000000          mov [ebp-2C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046261D(U)
|
:00462626 8B45D4                  mov eax, dword ptr [ebp-2C]
:00462629 8945E0                  mov dword ptr [ebp-20], eax
:0046262C C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00462633 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00462636 8B55E0                  mov edx, dword ptr [ebp-20]
:00462639 8911                    mov dword ptr [ecx], edx
:0046263B B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004625C3(U), :004625DA(U)
|
:00462640 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00462643 64890D00000000          mov dword ptr fs:[00000000], ecx
:0046264A 8BE5                    mov esp, ebp
:0046264C 5D                      pop ebp
:0046264D C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0046291D   , :00462948   , :0046D1A4   , :0046D1F0   
|
:00462650 55                      push ebp
:00462651 8BEC                    mov ebp, esp
:00462653 83EC08                  sub esp, 00000008
:00462656 894DF8                  mov dword ptr [ebp-08], ecx
:00462659 8B45F8                  mov eax, dword ptr [ebp-08]
:0046265C 8B08                    mov ecx, dword ptr [eax]
:0046265E 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046268C(U)
|
:00462661 837DFC00                cmp dword ptr [ebp-04], 00000000
:00462665 7427                    je 0046268E
:00462667 8B55FC                  mov edx, dword ptr [ebp-04]
:0046266A 8B4508                  mov eax, dword ptr [ebp+08]
:0046266D 3B4204                  cmp eax, dword ptr [edx+04]
:00462670 7512                    jne 00462684
:00462672 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00462675 8B55FC                  mov edx, dword ptr [ebp-04]
:00462678 8B4208                  mov eax, dword ptr [edx+08]
:0046267B 8901                    mov dword ptr [ecx], eax
:0046267D B801000000              mov eax, 00000001
:00462682 EB0C                    jmp 00462690

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00462670(C)
|
:00462684 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00462687 8B11                    mov edx, dword ptr [ecx]
:00462689 8955FC                  mov dword ptr [ebp-04], edx
:0046268C EBD3                    jmp 00462661

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00462665(C)
|
:0046268E 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00462682(U)
|
:00462690 8BE5                    mov esp, ebp
:00462692 5D                      pop ebp
:00462693 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:004628DB   , :0046D21B   
|
:00462696 55                      push ebp
:00462697 8BEC                    mov ebp, esp
:00462699 83EC24                  sub esp, 00000024
:0046269C 894DE4                  mov dword ptr [ebp-1C], ecx
:0046269F 8B45E4                  mov eax, dword ptr [ebp-1C]
:004626A2 8B08                    mov ecx, dword ptr [eax]
:004626A4 894DFC                  mov dword ptr [ebp-04], ecx
:004626A7 8B55FC                  mov edx, dword ptr [ebp-04]
:004626AA 8B4204                  mov eax, dword ptr [edx+04]
:004626AD 3B4508                  cmp eax, dword ptr [ebp+08]
:004626B0 7542                    jne 004626F4
:004626B2 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004626B5 8B55FC                  mov edx, dword ptr [ebp-04]
:004626B8 8B02                    mov eax, dword ptr [edx]
:004626BA 8901                    mov dword ptr [ecx], eax
:004626BC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004626BF C70100000000            mov dword ptr [ecx], 00000000
:004626C5 8B55FC                  mov edx, dword ptr [ebp-04]
:004626C8 8955F0                  mov dword ptr [ebp-10], edx
:004626CB 8B45F0                  mov eax, dword ptr [ebp-10]
:004626CE 8945F4                  mov dword ptr [ebp-0C], eax
:004626D1 837DF400                cmp dword ptr [ebp-0C], 00000000
:004626D5 740F                    je 004626E6
:004626D7 6A01                    push 00000001
:004626D9 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004626DC E8DF000100              call 004727C0
:004626E1 8945E0                  mov dword ptr [ebp-20], eax
:004626E4 EB07                    jmp 004626ED

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004626D5(C)
|
:004626E6 C745E000000000          mov [ebp-20], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004626E4(U)
|
:004626ED B801000000              mov eax, 00000001
:004626F2 EB6B                    jmp 0046275F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004626B0(C), :0046275B(U)
|
:004626F4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004626F7 833900                  cmp dword ptr [ecx], 00000000
:004626FA 7461                    je 0046275D
:004626FC 8B55FC                  mov edx, dword ptr [ebp-04]
:004626FF 8B02                    mov eax, dword ptr [edx]
:00462701 8B4804                  mov ecx, dword ptr [eax+04]
:00462704 3B4D08                  cmp ecx, dword ptr [ebp+08]
:00462707 754A                    jne 00462753
:00462709 8B55FC                  mov edx, dword ptr [ebp-04]
:0046270C 8B02                    mov eax, dword ptr [edx]
:0046270E 8945F8                  mov dword ptr [ebp-08], eax
:00462711 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00462714 8B55F8                  mov edx, dword ptr [ebp-08]
:00462717 8B02                    mov eax, dword ptr [edx]
:00462719 8901                    mov dword ptr [ecx], eax
:0046271B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046271E C70100000000            mov dword ptr [ecx], 00000000
:00462724 8B55F8                  mov edx, dword ptr [ebp-08]
:00462727 8955E8                  mov dword ptr [ebp-18], edx
:0046272A 8B45E8                  mov eax, dword ptr [ebp-18]
:0046272D 8945EC                  mov dword ptr [ebp-14], eax
:00462730 837DEC00                cmp dword ptr [ebp-14], 00000000
:00462734 740F                    je 00462745
:00462736 6A01                    push 00000001
:00462738 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0046273B E880000100              call 004727C0
:00462740 8945DC                  mov dword ptr [ebp-24], eax
:00462743 EB07                    jmp 0046274C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00462734(C)
|
:00462745 C745DC00000000          mov [ebp-24], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00462743(U)
|
:0046274C B801000000              mov eax, 00000001
:00462751 EB0C                    jmp 0046275F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00462707(C)
|
:00462753 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00462756 8B11                    mov edx, dword ptr [ecx]
:00462758 8955FC                  mov dword ptr [ebp-04], edx
:0046275B EB97                    jmp 004626F4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004626FA(C)
|
:0046275D 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004626F2(U), :00462751(U)
|
:0046275F 8BE5                    mov esp, ebp
:00462761 5D                      pop ebp
:00462762 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0040E29A   , :0040E41A   , :00463341   , :00463BCC   , :0047282A   
|:0047B2EF   , :0047B36F   , :0047B3CA   
|
:00462765 55                      push ebp
:00462766 8BEC                    mov ebp, esp
:00462768 51                      push ecx
:00462769 894DFC                  mov dword ptr [ebp-04], ecx
:0046276C 8B45FC                  mov eax, dword ptr [ebp-04]
:0046276F C700006F4800            mov dword ptr [eax], 00486F00
:00462775 8B0DC8684B00            mov ecx, dword ptr [004B68C8]
:0046277B 83C101                  add ecx, 00000001
:0046277E 890DC8684B00            mov dword ptr [004B68C8], ecx
:00462784 8B55FC                  mov edx, dword ptr [ebp-04]
:00462787 C7420400000000          mov [edx+04], 00000000
:0046278E 8B45FC                  mov eax, dword ptr [ebp-04]
:00462791 C7400800000000          mov [eax+08], 00000000
:00462798 8B45FC                  mov eax, dword ptr [ebp-04]
:0046279B 8BE5                    mov esp, ebp
:0046279D 5D                      pop ebp
:0046279E C3                      ret



* Referenced by a CALL at Addresses:
|:0040E1FA   , :00463CE8   , :0046E3B5   , :0047B158   , :0047B1A8   
|:00485800   , :00485813   , :00485826   , :0048595F   , :00485CA3   
|:00485CC3   , :00485D83   , :00485DA3   
|
:0046279F 55                      push ebp
:004627A0 8BEC                    mov ebp, esp
:004627A2 83EC10                  sub esp, 00000010
:004627A5 894DF4                  mov dword ptr [ebp-0C], ecx
:004627A8 8B45F4                  mov eax, dword ptr [ebp-0C]
:004627AB C700006F4800            mov dword ptr [eax], 00486F00
:004627B1 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004627B4 E805010000              call 004628BE
:004627B9 8B0DC8684B00            mov ecx, dword ptr [004B68C8]
:004627BF 83E901                  sub ecx, 00000001
:004627C2 890DC8684B00            mov dword ptr [004B68C8], ecx
:004627C8 833DC8684B0000          cmp dword ptr [004B68C8], 00000000
:004627CF 7535                    jne 00462806
:004627D1 8B15CC684B00            mov edx, dword ptr [004B68CC]
:004627D7 8955F8                  mov dword ptr [ebp-08], edx
:004627DA 8B45F8                  mov eax, dword ptr [ebp-08]
:004627DD 8945FC                  mov dword ptr [ebp-04], eax
:004627E0 837DFC00                cmp dword ptr [ebp-04], 00000000
:004627E4 740F                    je 004627F5
:004627E6 6A01                    push 00000001
:004627E8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004627EB E800000100              call 004727F0
:004627F0 8945F0                  mov dword ptr [ebp-10], eax
:004627F3 EB07                    jmp 004627FC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004627E4(C)
|
:004627F5 C745F000000000          mov [ebp-10], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004627F3(U)
|
:004627FC C705CC684B0000000000    mov dword ptr [004B68CC], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004627CF(C)
|
:00462806 8BE5                    mov esp, ebp
:00462808 5D                      pop ebp
:00462809 C3                      ret



* Referenced by a CALL at Addresses:
|:00462A96   , :00462FF7   , :00463609   , :00463644   , :00464A8E   
|:00464B88   , :0046827B   , :00469CBC   , :0046AF15   , :0046B988   
|:0046E73E   , :0046ED39   , :0046F1AB   , :0046FB12   , :00470123   
|:004704B5   , :004777FD   , :0047782C   , :0047785B   , :00478FF0   
|
:0046280A 55                      push ebp
:0046280B 8BEC                    mov ebp, esp
:0046280D 6AFF                    push FFFFFFFF
:0046280F 68F3574800              push 004857F3
:00462814 64A100000000            mov eax, dword ptr fs:[00000000]
:0046281A 50                      push eax
:0046281B 64892500000000          mov dword ptr fs:[00000000], esp
:00462822 83EC10                  sub esp, 00000010
:00462825 894DE8                  mov dword ptr [ebp-18], ecx
:00462828 833DCC684B0000          cmp dword ptr [004B68CC], 00000000
:0046282F 7544                    jne 00462875
:00462831 6A04                    push 00000004
:00462833 E8A8E70100              call 00480FE0
:00462838 83C404                  add esp, 00000004
:0046283B 8945F0                  mov dword ptr [ebp-10], eax
:0046283E C745FC00000000          mov [ebp-04], 00000000
:00462845 837DF000                cmp dword ptr [ebp-10], 00000000
:00462849 740D                    je 00462858
:0046284B 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046284E E86D90FAFF              call 0040B8C0
:00462853 8945E4                  mov dword ptr [ebp-1C], eax
:00462856 EB07                    jmp 0046285F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00462849(C)
|
:00462858 C745E400000000          mov [ebp-1C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00462856(U)
|
:0046285F 8B45E4                  mov eax, dword ptr [ebp-1C]
:00462862 8945EC                  mov dword ptr [ebp-14], eax
:00462865 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0046286C 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0046286F 890DCC684B00            mov dword ptr [004B68CC], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046282F(C)
|
:00462875 8B55E8                  mov edx, dword ptr [ebp-18]
:00462878 8B4508                  mov eax, dword ptr [ebp+08]
:0046287B 894208                  mov dword ptr [edx+08], eax
:0046287E 6834294600              push 00462934
:00462883 6AFC                    push FFFFFFFC
:00462885 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00462888 8B5108                  mov edx, dword ptr [ecx+08]
:0046288B 52                      push edx
:0046288C FF1550634800            call dword ptr [00486350]
:00462892 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00462895 894104                  mov dword ptr [ecx+04], eax
:00462898 8B55E8                  mov edx, dword ptr [ebp-18]
:0046289B 52                      push edx
:0046289C 8B45E8                  mov eax, dword ptr [ebp-18]
:0046289F 8B4808                  mov ecx, dword ptr [eax+08]
:004628A2 51                      push ecx
:004628A3 8B0DCC684B00            mov ecx, dword ptr [004B68CC]
:004628A9 E89FFCFFFF              call 0046254D
:004628AE 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004628B1 64890D00000000          mov dword ptr fs:[00000000], ecx
:004628B8 8BE5                    mov esp, ebp
:004628BA 5D                      pop ebp
:004628BB C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:004627B4   , :0046296F   , :0046E775   
|
:004628BE 55                      push ebp
:004628BF 8BEC                    mov ebp, esp
:004628C1 51                      push ecx
:004628C2 894DFC                  mov dword ptr [ebp-04], ecx
:004628C5 8B45FC                  mov eax, dword ptr [ebp-04]
:004628C8 83780400                cmp dword ptr [eax+04], 00000000
:004628CC 7432                    je 00462900
:004628CE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004628D1 8B5108                  mov edx, dword ptr [ecx+08]
:004628D4 52                      push edx
:004628D5 8B0DCC684B00            mov ecx, dword ptr [004B68CC]
:004628DB E8B6FDFFFF              call 00462696
:004628E0 8B45FC                  mov eax, dword ptr [ebp-04]
:004628E3 8B4804                  mov ecx, dword ptr [eax+04]
:004628E6 51                      push ecx
:004628E7 6AFC                    push FFFFFFFC
:004628E9 8B55FC                  mov edx, dword ptr [ebp-04]
:004628EC 8B4208                  mov eax, dword ptr [edx+08]
:004628EF 50                      push eax
:004628F0 FF1550634800            call dword ptr [00486350]
:004628F6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004628F9 C7410400000000          mov [ecx+04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004628CC(C)
|
:00462900 8BE5                    mov esp, ebp
:00462902 5D                      pop ebp
:00462903 C3                      ret



* Referenced by a CALL at Address:
|:0046E7EE   
|
:00462904 55                      push ebp
:00462905 8BEC                    mov ebp, esp
:00462907 51                      push ecx
:00462908 C745FC00000000          mov [ebp-04], 00000000
:0046290F 8D45FC                  lea eax, dword ptr [ebp-04]
:00462912 50                      push eax
:00462913 8B4D08                  mov ecx, dword ptr [ebp+08]
:00462916 51                      push ecx
:00462917 8B0DCC684B00            mov ecx, dword ptr [004B68CC]
:0046291D E82EFDFFFF              call 00462650
:00462922 85C0                    test eax, eax
:00462924 7507                    jne 0046292D
:00462926 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00462924(C)
|
:0046292D 8B45FC                  mov eax, dword ptr [ebp-04]
:00462930 8BE5                    mov esp, ebp
:00462932 5D                      pop ebp
:00462933 C3                      ret


:00462934 55                      push ebp
:00462935 8BEC                    mov ebp, esp
:00462937 83EC08                  sub esp, 00000008
:0046293A 8D45F8                  lea eax, dword ptr [ebp-08]
:0046293D 50                      push eax
:0046293E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00462941 51                      push ecx
:00462942 8B0DCC684B00            mov ecx, dword ptr [004B68CC]
:00462948 E803FDFFFF              call 00462650
:0046294D 8B5514                  mov edx, dword ptr [ebp+14]
:00462950 52                      push edx
:00462951 8B4510                  mov eax, dword ptr [ebp+10]
:00462954 50                      push eax
:00462955 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00462958 51                      push ecx
:00462959 8B55F8                  mov edx, dword ptr [ebp-08]
:0046295C 8B02                    mov eax, dword ptr [edx]
:0046295E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00462961 FF10                    call dword ptr [eax]
:00462963 8945FC                  mov dword ptr [ebp-04], eax
:00462966 837D0C02                cmp dword ptr [ebp+0C], 00000002
:0046296A 7512                    jne 0046297E
:0046296C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046296F E84AFFFFFF              call 004628BE
:00462974 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00462977 C7410800000000          mov [ecx+08], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046296A(C)
|
:0046297E 8B45FC                  mov eax, dword ptr [ebp-04]
:00462981 8BE5                    mov esp, ebp
:00462983 5D                      pop ebp
:00462984 C21000                  ret 0010


:00462987 55                      push ebp
:00462988 8BEC                    mov ebp, esp
:0046298A 83EC0C                  sub esp, 0000000C
:0046298D 894DF8                  mov dword ptr [ebp-08], ecx
:00462990 C745FC00000000          mov [ebp-04], 00000000
:00462997 8B4508                  mov eax, dword ptr [ebp+08]
:0046299A 8945F4                  mov dword ptr [ebp-0C], eax
:0046299D 837DF414                cmp dword ptr [ebp-0C], 00000014
:004629A1 7402                    je 004629A5
:004629A3 EB12                    jmp 004629B7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004629A1(C)
|
:004629A5 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004629A8 51                      push ecx
:004629A9 8B55F8                  mov edx, dword ptr [ebp-08]
:004629AC 8B02                    mov eax, dword ptr [edx]
:004629AE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004629B1 FF5008                  call [eax+08]
:004629B4 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004629A3(U)
|
:004629B7 837DFC00                cmp dword ptr [ebp-04], 00000000
:004629BB 7405                    je 004629C2
:004629BD 8B45FC                  mov eax, dword ptr [ebp-04]
:004629C0 EB17                    jmp 004629D9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004629BB(C)
|
:004629C2 8B4D10                  mov ecx, dword ptr [ebp+10]
:004629C5 51                      push ecx
:004629C6 8B550C                  mov edx, dword ptr [ebp+0C]
:004629C9 52                      push edx
:004629CA 8B4508                  mov eax, dword ptr [ebp+08]
:004629CD 50                      push eax
:004629CE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004629D1 8B11                    mov edx, dword ptr [ecx]
:004629D3 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004629D6 FF5204                  call [edx+04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004629C0(U)
|
:004629D9 8BE5                    mov esp, ebp
:004629DB 5D                      pop ebp
:004629DC C20C00                  ret 000C


:004629DF 55                      push ebp
:004629E0 8BEC                    mov ebp, esp
:004629E2 51                      push ecx
:004629E3 894DFC                  mov dword ptr [ebp-04], ecx
:004629E6 8B4510                  mov eax, dword ptr [ebp+10]
:004629E9 50                      push eax
:004629EA 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004629ED 51                      push ecx
:004629EE 8B5508                  mov edx, dword ptr [ebp+08]
:004629F1 52                      push edx
:004629F2 8B45FC                  mov eax, dword ptr [ebp-04]
:004629F5 8B4808                  mov ecx, dword ptr [eax+08]
:004629F8 51                      push ecx
:004629F9 8B55FC                  mov edx, dword ptr [ebp-04]
:004629FC 8B4204                  mov eax, dword ptr [edx+04]
:004629FF 50                      push eax
:00462A00 FF154C634800            call dword ptr [0048634C]
:00462A06 8BE5                    mov esp, ebp
:00462A08 5D                      pop ebp
:00462A09 C20C00                  ret 000C


:00462A0C 55                      push ebp
:00462A0D 8BEC                    mov ebp, esp
:00462A0F 51                      push ecx
:00462A10 894DFC                  mov dword ptr [ebp-04], ecx
:00462A13 6A00                    push 00000000
:00462A15 6A01                    push 00000001
:00462A17 6A00                    push 00000000
:00462A19 8B45FC                  mov eax, dword ptr [ebp-04]
:00462A1C 8B4808                  mov ecx, dword ptr [eax+08]
:00462A1F 51                      push ecx
:00462A20 8B5508                  mov edx, dword ptr [ebp+08]
:00462A23 52                      push edx
:00462A24 E875E60000              call 0047109E
:00462A29 83C414                  add esp, 00000014
:00462A2C 8BE5                    mov esp, ebp
:00462A2E 5D                      pop ebp
:00462A2F C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00475DA5   , :00475DD6   , :00475E03   , :004760F4   , :0047612C   
|:00476165   
|
:00462A32 55                      push ebp
:00462A33 8BEC                    mov ebp, esp
:00462A35 51                      push ecx
:00462A36 894DFC                  mov dword ptr [ebp-04], ecx
:00462A39 6A00                    push 00000000
:00462A3B A1606A4B00              mov eax, dword ptr [004B6A60]
:00462A40 50                      push eax
:00462A41 6A00                    push 00000000
:00462A43 8B4D08                  mov ecx, dword ptr [ebp+08]
:00462A46 51                      push ecx
:00462A47 8B5520                  mov edx, dword ptr [ebp+20]
:00462A4A 83C202                  add edx, 00000002
:00462A4D 52                      push edx
:00462A4E 8B451C                  mov eax, dword ptr [ebp+1C]
:00462A51 83C002                  add eax, 00000002
:00462A54 50                      push eax
:00462A55 8B4D18                  mov ecx, dword ptr [ebp+18]
:00462A58 51                      push ecx
:00462A59 8B5514                  mov edx, dword ptr [ebp+14]
:00462A5C 52                      push edx
:00462A5D 680E100050              push 5000100E
:00462A62 6808694B00              push 004B6908

* Possible StringData Ref from Data Obj ->"STATIC"
                                  |
:00462A67 68B4E64800              push 0048E6B4
:00462A6C 6A00                    push 00000000
:00462A6E FF1574634800            call dword ptr [00486374]
:00462A74 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00462A77 894108                  mov dword ptr [ecx+08], eax
:00462A7A 8B55FC                  mov edx, dword ptr [ebp-04]
:00462A7D 8B4510                  mov eax, dword ptr [ebp+10]
:00462A80 894210                  mov dword ptr [edx+10], eax
:00462A83 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00462A86 83790800                cmp dword ptr [ecx+08], 00000000
:00462A8A 7461                    je 00462AED
:00462A8C 8B55FC                  mov edx, dword ptr [ebp-04]
:00462A8F 8B4208                  mov eax, dword ptr [edx+08]
:00462A92 50                      push eax
:00462A93 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00462A96 E86FFDFFFF              call 0046280A
:00462A9B 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00462A9E 51                      push ecx
:00462A9F FF1548634800            call dword ptr [00486348]
:00462AA5 85C0                    test eax, eax
:00462AA7 7444                    je 00462AED
:00462AA9 8B55FC                  mov edx, dword ptr [ebp-04]
:00462AAC 8B450C                  mov eax, dword ptr [ebp+0C]
:00462AAF 89420C                  mov dword ptr [edx+0C], eax
:00462AB2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00462AB5 8B5108                  mov edx, dword ptr [ecx+08]
:00462AB8 52                      push edx
:00462AB9 8B45FC                  mov eax, dword ptr [ebp-04]
:00462ABC 8B480C                  mov ecx, dword ptr [eax+0C]
:00462ABF 51                      push ecx
:00462AC0 FF157C634800            call dword ptr [0048637C]
:00462AC6 6A00                    push 00000000
:00462AC8 8B5520                  mov edx, dword ptr [ebp+20]
:00462ACB 52                      push edx
:00462ACC 8B451C                  mov eax, dword ptr [ebp+1C]
:00462ACF 50                      push eax
:00462AD0 6A00                    push 00000000
:00462AD2 6A00                    push 00000000
:00462AD4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00462AD7 8B510C                  mov edx, dword ptr [ecx+0C]
:00462ADA 52                      push edx
:00462ADB FF15BC624800            call dword ptr [004862BC]
:00462AE1 8B4524                  mov eax, dword ptr [ebp+24]
:00462AE4 50                      push eax
:00462AE5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00462AE8 E83F000000              call 00462B2C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00462A8A(C), :00462AA7(C)
|
:00462AED 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00462AF0 8B4108                  mov eax, dword ptr [ecx+08]
:00462AF3 8BE5                    mov esp, ebp
:00462AF5 5D                      pop ebp
:00462AF6 C22000                  ret 0020



* Referenced by a CALL at Address:
|:00462F57   
|
:00462AF9 55                      push ebp
:00462AFA 8BEC                    mov ebp, esp
:00462AFC 51                      push ecx
:00462AFD 894DFC                  mov dword ptr [ebp-04], ecx
:00462B00 6A00                    push 00000000
:00462B02 8B45FC                  mov eax, dword ptr [ebp-04]
:00462B05 8B480C                  mov ecx, dword ptr [eax+0C]
:00462B08 51                      push ecx
:00462B09 FF15E0624800            call dword ptr [004862E0]
:00462B0F 6A00                    push 00000000
:00462B11 8B55FC                  mov edx, dword ptr [ebp-04]
:00462B14 8B420C                  mov eax, dword ptr [edx+0C]
:00462B17 50                      push eax
:00462B18 FF157C634800            call dword ptr [0048637C]
:00462B1E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00462B21 C7410C00000000          mov [ecx+0C], 00000000
:00462B28 8BE5                    mov esp, ebp
:00462B2A 5D                      pop ebp
:00462B2B C3                      ret



* Referenced by a CALL at Addresses:
|:00462AE8   , :00475E96   , :00475EA5   , :00475EB7   , :004761A5   
|:004761B4   , :004761C6   
|
:00462B2C 55                      push ebp
:00462B2D 8BEC                    mov ebp, esp
:00462B2F 51                      push ecx
:00462B30 894DFC                  mov dword ptr [ebp-04], ecx
:00462B33 837D0800                cmp dword ptr [ebp+08], 00000000
:00462B37 7424                    je 00462B5D
:00462B39 8B45FC                  mov eax, dword ptr [ebp-04]
:00462B3C 83781400                cmp dword ptr [eax+14], 00000000
:00462B40 7511                    jne 00462B53
:00462B42 6A05                    push 00000005
:00462B44 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00462B47 8B510C                  mov edx, dword ptr [ecx+0C]
:00462B4A 52                      push edx
:00462B4B FF15E0624800            call dword ptr [004862E0]
:00462B51 EB08                    jmp 00462B5B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00462B40(C)
|
:00462B53 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00462B56 E883000000              call 00462BDE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00462B51(U)
|
:00462B5B EB7B                    jmp 00462BD8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00462B37(C)
|
:00462B5D 6A00                    push 00000000
:00462B5F 8B45FC                  mov eax, dword ptr [ebp-04]
:00462B62 8B480C                  mov ecx, dword ptr [eax+0C]
:00462B65 51                      push ecx
:00462B66 FF15E0624800            call dword ptr [004862E0]
:00462B6C 8B55FC                  mov edx, dword ptr [ebp-04]
:00462B6F 837A1400                cmp dword ptr [edx+14], 00000000
:00462B73 7E63                    jle 00462BD8
:00462B75 6A00                    push 00000000
:00462B77 6A00                    push 00000000
:00462B79 6873010000              push 00000173
:00462B7E 8B45FC                  mov eax, dword ptr [ebp-04]
:00462B81 8B4808                  mov ecx, dword ptr [eax+08]
:00462B84 51                      push ecx
:00462B85 FF15F4624800            call dword ptr [004862F4]
:00462B8B 85C0                    test eax, eax
:00462B8D 7449                    je 00462BD8
:00462B8F 6A00                    push 00000000
:00462B91 6A00                    push 00000000
:00462B93 6872010000              push 00000172
:00462B98 8B55FC                  mov edx, dword ptr [ebp-04]
:00462B9B 8B4208                  mov eax, dword ptr [edx+08]
:00462B9E 50                      push eax
:00462B9F FF15F4624800            call dword ptr [004862F4]
:00462BA5 6A26                    push 00000026
:00462BA7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00462BAA 83C118                  add ecx, 00000018
:00462BAD E85F70FAFF              call 00409C11
:00462BB2 83C002                  add eax, 00000002
:00462BB5 50                      push eax
:00462BB6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00462BB9 83C118                  add ecx, 00000018
:00462BBC E83170FAFF              call 00409BF2
:00462BC1 83C002                  add eax, 00000002
:00462BC4 50                      push eax
:00462BC5 6A00                    push 00000000
:00462BC7 6A00                    push 00000000
:00462BC9 6A00                    push 00000000
:00462BCB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00462BCE 8B5108                  mov edx, dword ptr [ecx+08]
:00462BD1 52                      push edx
:00462BD2 FF1580624800            call dword ptr [00486280]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00462B5B(U), :00462B73(C), :00462B8D(C)
|
:00462BD8 8BE5                    mov esp, ebp
:00462BDA 5D                      pop ebp
:00462BDB C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00462B56   , :00462DB1   
|
:00462BDE 55                      push ebp
:00462BDF 8BEC                    mov ebp, esp
:00462BE1 83EC24                  sub esp, 00000024
:00462BE4 894DDC                  mov dword ptr [ebp-24], ecx
:00462BE7 8D45EC                  lea eax, dword ptr [ebp-14]
:00462BEA 50                      push eax
:00462BEB 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00462BEE 8B5108                  mov edx, dword ptr [ecx+08]
:00462BF1 52                      push edx
:00462BF2 FF15EC624800            call dword ptr [004862EC]
:00462BF8 6A00                    push 00000000
:00462BFA E8F1E30100              call 00480FF0
:00462BFF 83C404                  add esp, 00000004
:00462C02 8945FC                  mov dword ptr [ebp-04], eax
:00462C05 8B45F4                  mov eax, dword ptr [ebp-0C]
:00462C08 2B45EC                  sub eax, dword ptr [ebp-14]
:00462C0B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00462C0E 2B4DF0                  sub ecx, dword ptr [ebp-10]
:00462C11 0FAFC1                  imul eax, ecx
:00462C14 50                      push eax
:00462C15 E8C6E30100              call 00480FE0
:00462C1A 83C404                  add esp, 00000004
:00462C1D 8945E8                  mov dword ptr [ebp-18], eax
:00462C20 8B55FC                  mov edx, dword ptr [ebp-04]
:00462C23 52                      push edx
:00462C24 E8C7E30100              call 00480FF0
:00462C29 83C404                  add esp, 00000004
:00462C2C 837DE800                cmp dword ptr [ebp-18], 00000000
:00462C30 0F84BA000000            je 00462CF0
:00462C36 8B45DC                  mov eax, dword ptr [ebp-24]
:00462C39 8B4810                  mov ecx, dword ptr [eax+10]
:00462C3C 51                      push ecx
:00462C3D E8A19E0100              call 0047CAE3
:00462C42 83C404                  add esp, 00000004
:00462C45 8B55E8                  mov edx, dword ptr [ebp-18]
:00462C48 52                      push edx
:00462C49 8B45F8                  mov eax, dword ptr [ebp-08]
:00462C4C 2B45F0                  sub eax, dword ptr [ebp-10]
:00462C4F 50                      push eax
:00462C50 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00462C53 2B4DEC                  sub ecx, dword ptr [ebp-14]
:00462C56 51                      push ecx
:00462C57 6A00                    push 00000000
:00462C59 6A00                    push 00000000
:00462C5B E8F1B50100              call 0047E251
:00462C60 83C414                  add esp, 00000014
:00462C63 8B55F8                  mov edx, dword ptr [ebp-08]
:00462C66 2B55F0                  sub edx, dword ptr [ebp-10]
:00462C69 52                      push edx
:00462C6A 8B45F4                  mov eax, dword ptr [ebp-0C]
:00462C6D 2B45EC                  sub eax, dword ptr [ebp-14]
:00462C70 50                      push eax
:00462C71 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00462C74 51                      push ecx
:00462C75 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00462C78 83C118                  add ecx, 00000018
:00462C7B E81D6BFAFF              call 0040979D
:00462C80 8B55DC                  mov edx, dword ptr [ebp-24]
:00462C83 8B4208                  mov eax, dword ptr [edx+08]
:00462C86 50                      push eax
:00462C87 FF1598624800            call dword ptr [00486298]
:00462C8D 8945E4                  mov dword ptr [ebp-1C], eax
:00462C90 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00462C93 51                      push ecx
:00462C94 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00462C97 83C118                  add ecx, 00000018
:00462C9A E8696EFAFF              call 00409B08
:00462C9F 50                      push eax
:00462CA0 6A00                    push 00000000
:00462CA2 6872010000              push 00000172
:00462CA7 8B55DC                  mov edx, dword ptr [ebp-24]
:00462CAA 8B4208                  mov eax, dword ptr [edx+08]
:00462CAD 50                      push eax
:00462CAE FF15F4624800            call dword ptr [004862F4]
:00462CB4 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00462CB7 51                      push ecx
:00462CB8 8B55DC                  mov edx, dword ptr [ebp-24]
:00462CBB 8B4208                  mov eax, dword ptr [edx+08]
:00462CBE 50                      push eax
:00462CBF FF159C624800            call dword ptr [0048629C]
:00462CC5 6A00                    push 00000000
:00462CC7 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00462CCA 8B510C                  mov edx, dword ptr [ecx+0C]
:00462CCD 52                      push edx
:00462CCE FF15E0624800            call dword ptr [004862E0]
:00462CD4 6A00                    push 00000000
:00462CD6 E8089E0100              call 0047CAE3
:00462CDB 83C404                  add esp, 00000004
:00462CDE 8B45E8                  mov eax, dword ptr [ebp-18]
:00462CE1 8945E0                  mov dword ptr [ebp-20], eax
:00462CE4 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00462CE7 51                      push ecx
:00462CE8 E833E30100              call 00481020
:00462CED 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00462C30(C)
|
:00462CF0 8BE5                    mov esp, ebp
:00462CF2 5D                      pop ebp
:00462CF3 C3                      ret



* Referenced by a CALL at Address:
|:00462DFC   
|
:00462CF4 55                      push ebp
:00462CF5 8BEC                    mov ebp, esp
:00462CF7 51                      push ecx
:00462CF8 894DFC                  mov dword ptr [ebp-04], ecx
:00462CFB 6A00                    push 00000000
:00462CFD 6A00                    push 00000000
:00462CFF 6873010000              push 00000173
:00462D04 8B45FC                  mov eax, dword ptr [ebp-04]
:00462D07 8B4808                  mov ecx, dword ptr [eax+08]
:00462D0A 51                      push ecx
:00462D0B FF15F4624800            call dword ptr [004862F4]
:00462D11 85C0                    test eax, eax
:00462D13 7458                    je 00462D6D
:00462D15 6A05                    push 00000005
:00462D17 8B55FC                  mov edx, dword ptr [ebp-04]
:00462D1A 8B420C                  mov eax, dword ptr [edx+0C]
:00462D1D 50                      push eax
:00462D1E FF15E0624800            call dword ptr [004862E0]
:00462D24 6A00                    push 00000000
:00462D26 6A00                    push 00000000
:00462D28 6872010000              push 00000172
:00462D2D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00462D30 8B5108                  mov edx, dword ptr [ecx+08]
:00462D33 52                      push edx
:00462D34 FF15F4624800            call dword ptr [004862F4]
:00462D3A 6A26                    push 00000026
:00462D3C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00462D3F 83C118                  add ecx, 00000018
:00462D42 E8CA6EFAFF              call 00409C11
:00462D47 83C002                  add eax, 00000002
:00462D4A 50                      push eax
:00462D4B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00462D4E 83C118                  add ecx, 00000018
:00462D51 E89C6EFAFF              call 00409BF2
:00462D56 83C002                  add eax, 00000002
:00462D59 50                      push eax
:00462D5A 6A00                    push 00000000
:00462D5C 6A00                    push 00000000
:00462D5E 6A00                    push 00000000
:00462D60 8B45FC                  mov eax, dword ptr [ebp-04]
:00462D63 8B4808                  mov ecx, dword ptr [eax+08]
:00462D66 51                      push ecx
:00462D67 FF1580624800            call dword ptr [00486280]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00462D13(C)
|
:00462D6D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00462D70 83C118                  add ecx, 00000018
:00462D73 E8326FFAFF              call 00409CAA
:00462D78 8BE5                    mov esp, ebp
:00462D7A 5D                      pop ebp
:00462D7B C3                      ret



* Referenced by a CALL at Addresses:
|:00475F07   , :00475F12   , :00475F20   
|
:00462D7C 55                      push ebp
:00462D7D 8BEC                    mov ebp, esp
:00462D7F 51                      push ecx
:00462D80 894DFC                  mov dword ptr [ebp-04], ecx
:00462D83 8B45FC                  mov eax, dword ptr [ebp-04]
:00462D86 8B4808                  mov ecx, dword ptr [eax+08]
:00462D89 51                      push ecx
:00462D8A FF1548634800            call dword ptr [00486348]
:00462D90 85C0                    test eax, eax
:00462D92 7422                    je 00462DB6
:00462D94 8B55FC                  mov edx, dword ptr [ebp-04]
:00462D97 8B420C                  mov eax, dword ptr [edx+0C]
:00462D9A 50                      push eax
:00462D9B FF15C8624800            call dword ptr [004862C8]
:00462DA1 85C0                    test eax, eax
:00462DA3 7411                    je 00462DB6
:00462DA5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00462DA8 83791400                cmp dword ptr [ecx+14], 00000000
:00462DAC 7508                    jne 00462DB6
:00462DAE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00462DB1 E828FEFFFF              call 00462BDE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00462D92(C), :00462DA3(C), :00462DAC(C)
|
:00462DB6 8B55FC                  mov edx, dword ptr [ebp-04]
:00462DB9 8B4214                  mov eax, dword ptr [edx+14]
:00462DBC 83C001                  add eax, 00000001
:00462DBF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00462DC2 894114                  mov dword ptr [ecx+14], eax
:00462DC5 8BE5                    mov esp, ebp
:00462DC7 5D                      pop ebp
:00462DC8 C3                      ret



* Referenced by a CALL at Addresses:
|:00475F70   , :00475F7B   , :00475F89   
|
:00462DC9 55                      push ebp
:00462DCA 8BEC                    mov ebp, esp
:00462DCC 51                      push ecx
:00462DCD 894DFC                  mov dword ptr [ebp-04], ecx
:00462DD0 8B45FC                  mov eax, dword ptr [ebp-04]
:00462DD3 8B4814                  mov ecx, dword ptr [eax+14]
:00462DD6 83E901                  sub ecx, 00000001
:00462DD9 8B55FC                  mov edx, dword ptr [ebp-04]
:00462DDC 894A14                  mov dword ptr [edx+14], ecx
:00462DDF 8B45FC                  mov eax, dword ptr [ebp-04]
:00462DE2 83781400                cmp dword ptr [eax+14], 00000000
:00462DE6 751B                    jne 00462E03
:00462DE8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00462DEB 8B5108                  mov edx, dword ptr [ecx+08]
:00462DEE 52                      push edx
:00462DEF FF1548634800            call dword ptr [00486348]
:00462DF5 85C0                    test eax, eax
:00462DF7 740A                    je 00462E03
:00462DF9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00462DFC E8F3FEFFFF              call 00462CF4
:00462E01 EB13                    jmp 00462E16

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00462DE6(C), :00462DF7(C)
|
:00462E03 8B45FC                  mov eax, dword ptr [ebp-04]
:00462E06 83781400                cmp dword ptr [eax+14], 00000000
:00462E0A 7D0A                    jge 00462E16
:00462E0C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00462E0F C7411400000000          mov [ecx+14], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00462E01(U), :00462E0A(C)
|
:00462E16 8BE5                    mov esp, ebp
:00462E18 5D                      pop ebp
:00462E19 C3                      ret



* Referenced by a CALL at Addresses:
|:00476001   , :0047600E   , :0047601E   
|
:00462E1A 55                      push ebp
:00462E1B 8BEC                    mov ebp, esp
:00462E1D 83EC24                  sub esp, 00000024
:00462E20 894DDC                  mov dword ptr [ebp-24], ecx
:00462E23 8B45DC                  mov eax, dword ptr [ebp-24]
:00462E26 83781400                cmp dword ptr [eax+14], 00000000
:00462E2A 0F8E09010000            jle 00462F39
:00462E30 8D4DEC                  lea ecx, dword ptr [ebp-14]
:00462E33 51                      push ecx
:00462E34 8B55DC                  mov edx, dword ptr [ebp-24]
:00462E37 8B4208                  mov eax, dword ptr [edx+08]
:00462E3A 50                      push eax
:00462E3B FF15EC624800            call dword ptr [004862EC]
:00462E41 6A00                    push 00000000
:00462E43 E8A8E10100              call 00480FF0
:00462E48 83C404                  add esp, 00000004
:00462E4B 8945FC                  mov dword ptr [ebp-04], eax
:00462E4E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00462E51 2B4DEC                  sub ecx, dword ptr [ebp-14]
:00462E54 8B55F8                  mov edx, dword ptr [ebp-08]
:00462E57 2B55F0                  sub edx, dword ptr [ebp-10]
:00462E5A 0FAFCA                  imul ecx, edx
:00462E5D 51                      push ecx
:00462E5E E87DE10100              call 00480FE0
:00462E63 83C404                  add esp, 00000004
:00462E66 8945E8                  mov dword ptr [ebp-18], eax
:00462E69 8B45FC                  mov eax, dword ptr [ebp-04]
:00462E6C 50                      push eax
:00462E6D E87EE10100              call 00480FF0
:00462E72 83C404                  add esp, 00000004
:00462E75 837DE800                cmp dword ptr [ebp-18], 00000000
:00462E79 0F84BA000000            je 00462F39
:00462E7F 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00462E82 8B5110                  mov edx, dword ptr [ecx+10]
:00462E85 52                      push edx
:00462E86 E8589C0100              call 0047CAE3
:00462E8B 83C404                  add esp, 00000004
:00462E8E 8B45E8                  mov eax, dword ptr [ebp-18]
:00462E91 50                      push eax
:00462E92 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00462E95 2B4DF0                  sub ecx, dword ptr [ebp-10]
:00462E98 51                      push ecx
:00462E99 8B55F4                  mov edx, dword ptr [ebp-0C]
:00462E9C 2B55EC                  sub edx, dword ptr [ebp-14]
:00462E9F 52                      push edx
:00462EA0 6A00                    push 00000000
:00462EA2 6A00                    push 00000000
:00462EA4 E8A8B30100              call 0047E251
:00462EA9 83C414                  add esp, 00000014
:00462EAC 8B45F8                  mov eax, dword ptr [ebp-08]
:00462EAF 2B45F0                  sub eax, dword ptr [ebp-10]
:00462EB2 50                      push eax
:00462EB3 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00462EB6 2B4DEC                  sub ecx, dword ptr [ebp-14]
:00462EB9 51                      push ecx
:00462EBA 8B55E8                  mov edx, dword ptr [ebp-18]
:00462EBD 52                      push edx
:00462EBE 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00462EC1 83C118                  add ecx, 00000018
:00462EC4 E8966AFAFF              call 0040995F
:00462EC9 8B45DC                  mov eax, dword ptr [ebp-24]
:00462ECC 8B4808                  mov ecx, dword ptr [eax+08]
:00462ECF 51                      push ecx
:00462ED0 FF1598624800            call dword ptr [00486298]
:00462ED6 8945E4                  mov dword ptr [ebp-1C], eax
:00462ED9 8B55E4                  mov edx, dword ptr [ebp-1C]
:00462EDC 52                      push edx
:00462EDD 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00462EE0 83C118                  add ecx, 00000018
:00462EE3 E8206CFAFF              call 00409B08
:00462EE8 50                      push eax
:00462EE9 6A00                    push 00000000
:00462EEB 6872010000              push 00000172
:00462EF0 8B45DC                  mov eax, dword ptr [ebp-24]
:00462EF3 8B4808                  mov ecx, dword ptr [eax+08]
:00462EF6 51                      push ecx
:00462EF7 FF15F4624800            call dword ptr [004862F4]
:00462EFD 8B55E4                  mov edx, dword ptr [ebp-1C]
:00462F00 52                      push edx
:00462F01 8B45DC                  mov eax, dword ptr [ebp-24]
:00462F04 8B4808                  mov ecx, dword ptr [eax+08]
:00462F07 51                      push ecx
:00462F08 FF159C624800            call dword ptr [0048629C]
:00462F0E 6A00                    push 00000000
:00462F10 8B55DC                  mov edx, dword ptr [ebp-24]
:00462F13 8B420C                  mov eax, dword ptr [edx+0C]
:00462F16 50                      push eax
:00462F17 FF15E0624800            call dword ptr [004862E0]
:00462F1D 6A00                    push 00000000
:00462F1F E8BF9B0100              call 0047CAE3
:00462F24 83C404                  add esp, 00000004
:00462F27 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00462F2A 894DE0                  mov dword ptr [ebp-20], ecx
:00462F2D 8B55E0                  mov edx, dword ptr [ebp-20]
:00462F30 52                      push edx
:00462F31 E8EAE00100              call 00481020
:00462F36 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00462E2A(C), :00462E79(C)
|
:00462F39 8BE5                    mov esp, ebp
:00462F3B 5D                      pop ebp
:00462F3C C3                      ret


:00462F3D 55                      push ebp
:00462F3E 8BEC                    mov ebp, esp
:00462F40 83EC08                  sub esp, 00000008
:00462F43 894DFC                  mov dword ptr [ebp-04], ecx
:00462F46 8B4508                  mov eax, dword ptr [ebp+08]
:00462F49 8945F8                  mov dword ptr [ebp-08], eax
:00462F4C 837DF802                cmp dword ptr [ebp-08], 00000002
:00462F50 7402                    je 00462F54
:00462F52 EB08                    jmp 00462F5C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00462F50(C)
|
:00462F54 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00462F57 E89DFBFFFF              call 00462AF9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00462F52(U)
|
:00462F5C 8B4D10                  mov ecx, dword ptr [ebp+10]
:00462F5F 51                      push ecx
:00462F60 8B550C                  mov edx, dword ptr [ebp+0C]
:00462F63 52                      push edx
:00462F64 8B4508                  mov eax, dword ptr [ebp+08]
:00462F67 50                      push eax
:00462F68 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00462F6B 8B11                    mov edx, dword ptr [ecx]
:00462F6D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00462F70 FF5204                  call [edx+04]
:00462F73 8BE5                    mov esp, ebp
:00462F75 5D                      pop ebp
:00462F76 C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:00475E26   , :00475E49   
|
:00462F79 55                      push ebp
:00462F7A 8BEC                    mov ebp, esp
:00462F7C 83EC08                  sub esp, 00000008
:00462F7F 894DF8                  mov dword ptr [ebp-08], ecx
:00462F82 8B450C                  mov eax, dword ptr [ebp+0C]
:00462F85 50                      push eax
:00462F86 8B0D606A4B00            mov ecx, dword ptr [004B6A60]
:00462F8C 51                      push ecx
:00462F8D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00462F90 83C110                  add ecx, 00000010
:00462F93 E88567FAFF              call 0040971D
:00462F98 6A00                    push 00000000
:00462F9A 8B15606A4B00            mov edx, dword ptr [004B6A60]
:00462FA0 52                      push edx
:00462FA1 6A00                    push 00000000
:00462FA3 8B4508                  mov eax, dword ptr [ebp+08]
:00462FA6 50                      push eax
:00462FA7 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00462FAA 83C110                  add ecx, 00000010
:00462FAD E85F6CFAFF              call 00409C11
:00462FB2 50                      push eax
:00462FB3 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00462FB6 83C110                  add ecx, 00000010
:00462FB9 E8346CFAFF              call 00409BF2
:00462FBE 50                      push eax
:00462FBF 8B4D14                  mov ecx, dword ptr [ebp+14]
:00462FC2 51                      push ecx
:00462FC3 8B5510                  mov edx, dword ptr [ebp+10]
:00462FC6 52                      push edx
:00462FC7 680E000040              push 4000000E
:00462FCC 680C694B00              push 004B690C

* Possible StringData Ref from Data Obj ->"STATIC"
                                  |
:00462FD1 68BCE64800              push 0048E6BC
:00462FD6 6A00                    push 00000000
:00462FD8 FF1574634800            call dword ptr [00486374]
:00462FDE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00462FE1 894108                  mov dword ptr [ecx+08], eax
:00462FE4 8B55F8                  mov edx, dword ptr [ebp-08]
:00462FE7 837A0800                cmp dword ptr [edx+08], 00000000
:00462FEB 7461                    je 0046304E
:00462FED 8B45F8                  mov eax, dword ptr [ebp-08]
:00462FF0 8B4808                  mov ecx, dword ptr [eax+08]
:00462FF3 51                      push ecx
:00462FF4 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00462FF7 E80EF8FFFF              call 0046280A
:00462FFC 8B55F8                  mov edx, dword ptr [ebp-08]
:00462FFF 837A0C00                cmp dword ptr [edx+0C], 00000000
:00463003 750D                    jne 00463012
:00463005 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00463008 83C110                  add ecx, 00000010
:0046300B E80C75FAFF              call 0040A51C
:00463010 EB30                    jmp 00463042

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00463003(C)
|
:00463012 8B45F8                  mov eax, dword ptr [ebp-08]
:00463015 8B4808                  mov ecx, dword ptr [eax+08]
:00463018 51                      push ecx
:00463019 FF1598624800            call dword ptr [00486298]
:0046301F 8945FC                  mov dword ptr [ebp-04], eax
:00463022 8B55FC                  mov edx, dword ptr [ebp-04]
:00463025 52                      push edx
:00463026 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00463029 83C110                  add ecx, 00000010
:0046302C E8D76AFAFF              call 00409B08
:00463031 8B45FC                  mov eax, dword ptr [ebp-04]
:00463034 50                      push eax
:00463035 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00463038 8B5108                  mov edx, dword ptr [ecx+08]
:0046303B 52                      push edx
:0046303C FF159C624800            call dword ptr [0048629C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00463010(U)
|
:00463042 8B4518                  mov eax, dword ptr [ebp+18]
:00463045 50                      push eax
:00463046 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00463049 E80C000000              call 0046305A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00462FEB(C)
|
:0046304E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00463051 8B4108                  mov eax, dword ptr [ecx+08]
:00463054 8BE5                    mov esp, ebp
:00463056 5D                      pop ebp
:00463057 C21400                  ret 0014



* Referenced by a CALL at Addresses:
|:00463049   , :00475EC9   , :00475EDB   
|
:0046305A 55                      push ebp
:0046305B 8BEC                    mov ebp, esp
:0046305D 51                      push ecx
:0046305E 894DFC                  mov dword ptr [ebp-04], ecx
:00463061 837D0800                cmp dword ptr [ebp+08], 00000000
:00463065 7411                    je 00463078
:00463067 6A05                    push 00000005
:00463069 8B45FC                  mov eax, dword ptr [ebp-04]
:0046306C 8B4808                  mov ecx, dword ptr [eax+08]
:0046306F 51                      push ecx
:00463070 FF15E0624800            call dword ptr [004862E0]
:00463076 EB0F                    jmp 00463087

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00463065(C)
|
:00463078 6A00                    push 00000000
:0046307A 8B55FC                  mov edx, dword ptr [ebp-04]
:0046307D 8B4208                  mov eax, dword ptr [edx+08]
:00463080 50                      push eax
:00463081 FF15E0624800            call dword ptr [004862E0]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00463076(U)
|
:00463087 8BE5                    mov esp, ebp
:00463089 5D                      pop ebp
:0046308A C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00475F2E   , :00475F3C   
|
:0046308D 55                      push ebp
:0046308E 8BEC                    mov ebp, esp
:00463090 83EC08                  sub esp, 00000008
:00463093 894DF8                  mov dword ptr [ebp-08], ecx
:00463096 8B45F8                  mov eax, dword ptr [ebp-08]
:00463099 8B4808                  mov ecx, dword ptr [eax+08]
:0046309C 51                      push ecx
:0046309D FF1548634800            call dword ptr [00486348]
:004630A3 85C0                    test eax, eax
:004630A5 7457                    je 004630FE
:004630A7 8B55F8                  mov edx, dword ptr [ebp-08]
:004630AA 837A0C00                cmp dword ptr [edx+0C], 00000000
:004630AE 754E                    jne 004630FE
:004630B0 8B45F8                  mov eax, dword ptr [ebp-08]
:004630B3 8B4808                  mov ecx, dword ptr [eax+08]
:004630B6 51                      push ecx
:004630B7 FF1598624800            call dword ptr [00486298]
:004630BD 8945FC                  mov dword ptr [ebp-04], eax
:004630C0 8B55FC                  mov edx, dword ptr [ebp-04]
:004630C3 52                      push edx
:004630C4 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004630C7 83C110                  add ecx, 00000010
:004630CA E8396AFAFF              call 00409B08
:004630CF 8B45FC                  mov eax, dword ptr [ebp-04]
:004630D2 50                      push eax
:004630D3 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004630D6 8B5108                  mov edx, dword ptr [ecx+08]
:004630D9 52                      push edx
:004630DA FF159C624800            call dword ptr [0048629C]
:004630E0 6A00                    push 00000000
:004630E2 6A00                    push 00000000
:004630E4 8B45F8                  mov eax, dword ptr [ebp-08]
:004630E7 8B4808                  mov ecx, dword ptr [eax+08]
:004630EA 51                      push ecx
:004630EB FF15A4624800            call dword ptr [004862A4]
:004630F1 8B55F8                  mov edx, dword ptr [ebp-08]
:004630F4 8B4208                  mov eax, dword ptr [edx+08]
:004630F7 50                      push eax
:004630F8 FF15A8624800            call dword ptr [004862A8]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004630A5(C), :004630AE(C)
|
:004630FE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00463101 8B510C                  mov edx, dword ptr [ecx+0C]
:00463104 83C201                  add edx, 00000001
:00463107 8B45F8                  mov eax, dword ptr [ebp-08]
:0046310A 89500C                  mov dword ptr [eax+0C], edx
:0046310D 8BE5                    mov esp, ebp
:0046310F 5D                      pop ebp
:00463110 C3                      ret



* Referenced by a CALL at Addresses:
|:00475FB0   , :00475FBE   
|
:00463111 55                      push ebp
:00463112 8BEC                    mov ebp, esp
:00463114 51                      push ecx
:00463115 894DFC                  mov dword ptr [ebp-04], ecx
:00463118 8B45FC                  mov eax, dword ptr [ebp-04]
:0046311B 8B480C                  mov ecx, dword ptr [eax+0C]
:0046311E 83E901                  sub ecx, 00000001
:00463121 8B55FC                  mov edx, dword ptr [ebp-04]
:00463124 894A0C                  mov dword ptr [edx+0C], ecx
:00463127 8B45FC                  mov eax, dword ptr [ebp-04]
:0046312A 83780C00                cmp dword ptr [eax+0C], 00000000
:0046312E 753C                    jne 0046316C
:00463130 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00463133 8B5108                  mov edx, dword ptr [ecx+08]
:00463136 52                      push edx
:00463137 FF1548634800            call dword ptr [00486348]
:0046313D 85C0                    test eax, eax
:0046313F 742B                    je 0046316C
:00463141 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00463144 83C110                  add ecx, 00000010
:00463147 E8D073FAFF              call 0040A51C
:0046314C 6A00                    push 00000000
:0046314E 6A00                    push 00000000
:00463150 8B45FC                  mov eax, dword ptr [ebp-04]
:00463153 8B4808                  mov ecx, dword ptr [eax+08]
:00463156 51                      push ecx
:00463157 FF15A4624800            call dword ptr [004862A4]
:0046315D 8B55FC                  mov edx, dword ptr [ebp-04]
:00463160 8B4208                  mov eax, dword ptr [edx+08]
:00463163 50                      push eax
:00463164 FF15A8624800            call dword ptr [004862A8]
:0046316A EB13                    jmp 0046317F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046312E(C), :0046313F(C)
|
:0046316C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046316F 83790C00                cmp dword ptr [ecx+0C], 00000000
:00463173 7D0A                    jge 0046317F
:00463175 8B55FC                  mov edx, dword ptr [ebp-04]
:00463178 C7420C00000000          mov [edx+0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046316A(U), :00463173(C)
|
:0046317F 8BE5                    mov esp, ebp
:00463181 5D                      pop ebp
:00463182 C3                      ret



* Referenced by a CALL at Address:
|:00476058   
|
:00463183 55                      push ebp
:00463184 8BEC                    mov ebp, esp
:00463186 83EC0C                  sub esp, 0000000C
:00463189 894DF4                  mov dword ptr [ebp-0C], ecx
:0046318C 8B45F4                  mov eax, dword ptr [ebp-0C]
:0046318F 8B4808                  mov ecx, dword ptr [eax+08]
:00463192 51                      push ecx
:00463193 FF15C8624800            call dword ptr [004862C8]
:00463199 85C0                    test eax, eax
:0046319B 0F840A010000            je 004632AB
:004631A1 8B55F4                  mov edx, dword ptr [ebp-0C]
:004631A4 8B4208                  mov eax, dword ptr [edx+08]
:004631A7 50                      push eax
:004631A8 FF1598624800            call dword ptr [00486298]
:004631AE 8945FC                  mov dword ptr [ebp-04], eax
:004631B1 837D0800                cmp dword ptr [ebp+08], 00000000
:004631B5 0F84C8000000            je 00463283
:004631BB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004631BE 51                      push ecx
:004631BF FF1564604800            call dword ptr [00486064]
:004631C5 8945F8                  mov dword ptr [ebp-08], eax
:004631C8 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004631CB 83C110                  add ecx, 00000010
:004631CE E86DF60000              call 00472840
:004631D3 50                      push eax
:004631D4 8B55F8                  mov edx, dword ptr [ebp-08]
:004631D7 52                      push edx
:004631D8 FF156C604800            call dword ptr [0048606C]
:004631DE 6809005500              push 00550009
:004631E3 6A00                    push 00000000
:004631E5 6A00                    push 00000000
:004631E7 8B45F8                  mov eax, dword ptr [ebp-08]
:004631EA 50                      push eax
:004631EB 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004631EE 83C110                  add ecx, 00000010
:004631F1 E81B6AFAFF              call 00409C11
:004631F6 50                      push eax
:004631F7 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004631FA 83C110                  add ecx, 00000010
:004631FD E8F069FAFF              call 00409BF2
:00463202 50                      push eax
:00463203 6A00                    push 00000000
:00463205 6A00                    push 00000000
:00463207 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046320A 51                      push ecx
:0046320B FF1570604800            call dword ptr [00486070]
:00463211 68C6008800              push 008800C6
:00463216 6A00                    push 00000000
:00463218 6A00                    push 00000000
:0046321A 8B55F8                  mov edx, dword ptr [ebp-08]
:0046321D 52                      push edx
:0046321E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00463221 83C110                  add ecx, 00000010
:00463224 E8E869FAFF              call 00409C11
:00463229 50                      push eax
:0046322A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046322D 83C110                  add ecx, 00000010
:00463230 E8BD69FAFF              call 00409BF2
:00463235 50                      push eax
:00463236 6A00                    push 00000000
:00463238 6A00                    push 00000000
:0046323A 8B45FC                  mov eax, dword ptr [ebp-04]
:0046323D 50                      push eax
:0046323E FF1570604800            call dword ptr [00486070]
:00463244 6809005500              push 00550009
:00463249 6A00                    push 00000000
:0046324B 6A00                    push 00000000
:0046324D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00463250 51                      push ecx
:00463251 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00463254 83C110                  add ecx, 00000010
:00463257 E8B569FAFF              call 00409C11
:0046325C 50                      push eax
:0046325D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00463260 83C110                  add ecx, 00000010
:00463263 E88A69FAFF              call 00409BF2
:00463268 50                      push eax
:00463269 6A00                    push 00000000
:0046326B 6A00                    push 00000000
:0046326D 8B55FC                  mov edx, dword ptr [ebp-04]
:00463270 52                      push edx
:00463271 FF1570604800            call dword ptr [00486070]
:00463277 8B45F8                  mov eax, dword ptr [ebp-08]
:0046327A 50                      push eax
:0046327B FF15A0604800            call dword ptr [004860A0]
:00463281 EB17                    jmp 0046329A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004631B5(C)
|
:00463283 6A01                    push 00000001
:00463285 6A00                    push 00000000
:00463287 6A00                    push 00000000
:00463289 6A00                    push 00000000
:0046328B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046328E 51                      push ecx
:0046328F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00463292 83C110                  add ecx, 00000010
:00463295 E8286FFAFF              call 0040A1C2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00463281(U)
|
:0046329A 8B55FC                  mov edx, dword ptr [ebp-04]
:0046329D 52                      push edx
:0046329E 8B45F4                  mov eax, dword ptr [ebp-0C]
:004632A1 8B4808                  mov ecx, dword ptr [eax+08]
:004632A4 51                      push ecx
:004632A5 FF159C624800            call dword ptr [0048629C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046319B(C)
|
:004632AB 8BE5                    mov esp, ebp
:004632AD 5D                      pop ebp
:004632AE C20400                  ret 0004


:004632B1 55                      push ebp
:004632B2 8BEC                    mov ebp, esp
:004632B4 83EC48                  sub esp, 00000048
:004632B7 894DBC                  mov dword ptr [ebp-44], ecx
:004632BA 8B4508                  mov eax, dword ptr [ebp+08]
:004632BD 8945B8                  mov dword ptr [ebp-48], eax
:004632C0 837DB80F                cmp dword ptr [ebp-48], 0000000F
:004632C4 7402                    je 004632C8
:004632C6 EB3D                    jmp 00463305

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004632C4(C)
|
:004632C8 8D4DC0                  lea ecx, dword ptr [ebp-40]
:004632CB 51                      push ecx
:004632CC 8B55BC                  mov edx, dword ptr [ebp-44]
:004632CF 8B4208                  mov eax, dword ptr [edx+08]
:004632D2 50                      push eax
:004632D3 FF1540634800            call dword ptr [00486340]
:004632D9 6A01                    push 00000001
:004632DB 6A00                    push 00000000
:004632DD 6A00                    push 00000000
:004632DF 6A00                    push 00000000
:004632E1 8B4DC0                  mov ecx, dword ptr [ebp-40]
:004632E4 51                      push ecx
:004632E5 8B4DBC                  mov ecx, dword ptr [ebp-44]
:004632E8 83C110                  add ecx, 00000010
:004632EB E8D26EFAFF              call 0040A1C2
:004632F0 8D55C0                  lea edx, dword ptr [ebp-40]
:004632F3 52                      push edx
:004632F4 8B45BC                  mov eax, dword ptr [ebp-44]
:004632F7 8B4808                  mov ecx, dword ptr [eax+08]
:004632FA 51                      push ecx
:004632FB FF1544634800            call dword ptr [00486344]
:00463301 33C0                    xor eax, eax
:00463303 EB17                    jmp 0046331C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004632C6(U)
|
:00463305 8B5510                  mov edx, dword ptr [ebp+10]
:00463308 52                      push edx
:00463309 8B450C                  mov eax, dword ptr [ebp+0C]
:0046330C 50                      push eax
:0046330D 8B4D08                  mov ecx, dword ptr [ebp+08]
:00463310 51                      push ecx
:00463311 8B55BC                  mov edx, dword ptr [ebp-44]
:00463314 8B02                    mov eax, dword ptr [edx]
:00463316 8B4DBC                  mov ecx, dword ptr [ebp-44]
:00463319 FF5004                  call [eax+04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00463303(U)
|
:0046331C 8BE5                    mov esp, ebp
:0046331E 5D                      pop ebp
:0046331F C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:0040DEF1   , :00472994   , :00475865   , :00476E5B   , :00476E65   
|:00476E6F   
|
:00463322 55                      push ebp
:00463323 8BEC                    mov ebp, esp
:00463325 6AFF                    push FFFFFFFF
:00463327 6806584800              push 00485806
:0046332C 64A100000000            mov eax, dword ptr fs:[00000000]
:00463332 50                      push eax
:00463333 64892500000000          mov dword ptr fs:[00000000], esp
:0046333A 51                      push ecx
:0046333B 894DF0                  mov dword ptr [ebp-10], ecx
:0046333E 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00463341 E81FF4FFFF              call 00462765
:00463346 C745FC00000000          mov [ebp-04], 00000000
:0046334D 6A00                    push 00000000
:0046334F 6A00                    push 00000000
:00463351 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00463354 83C10C                  add ecx, 0000000C
:00463357 E8E283FAFF              call 0040B73E
:0046335C 8B45F0                  mov eax, dword ptr [ebp-10]
:0046335F C700106F4800            mov dword ptr [eax], 00486F10
:00463365 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0046336C 8B45F0                  mov eax, dword ptr [ebp-10]
:0046336F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00463372 64890D00000000          mov dword ptr fs:[00000000], ecx
:00463379 8BE5                    mov esp, ebp
:0046337B 5D                      pop ebp
:0046337C C3                      ret



* Referenced by a CALL at Addresses:
|:0046342B   , :00469CDC   , :00477812   , :00477841   , :00477870   
|
:0046337D 55                      push ebp
:0046337E 8BEC                    mov ebp, esp
:00463380 51                      push ecx
:00463381 894DFC                  mov dword ptr [ebp-04], ecx
:00463384 8B45FC                  mov eax, dword ptr [ebp-04]
:00463387 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046338A 89480C                  mov dword ptr [eax+0C], ecx
:0046338D 8B55FC                  mov edx, dword ptr [ebp-04]
:00463390 837A0C00                cmp dword ptr [edx+0C], 00000000
:00463394 7433                    je 004633C9

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:00463396 6A06                    push 00000006
:00463398 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046339B 83C10C                  add ecx, 0000000C
:0046339E E81984FAFF              call 0040B7BC
:004633A3 83C002                  add eax, 00000002
:004633A6 50                      push eax
:004633A7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004633AA 83C10C                  add ecx, 0000000C
:004633AD E8DB83FAFF              call 0040B78D
:004633B2 83C002                  add eax, 00000002
:004633B5 50                      push eax
:004633B6 6A00                    push 00000000
:004633B8 6A00                    push 00000000
:004633BA 6A00                    push 00000000
:004633BC 8B45FC                  mov eax, dword ptr [ebp-04]
:004633BF 8B4808                  mov ecx, dword ptr [eax+08]
:004633C2 51                      push ecx
:004633C3 FF1580624800            call dword ptr [00486280]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00463394(C)
|
:004633C9 8BE5                    mov esp, ebp
:004633CB 5D                      pop ebp
:004633CC C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00463437   , :00469799   , :00469841   , :00476FDE   , :00477079   
|:00477190   , :0047722B   , :004772ED   , :00477331   
|
:004633CF 55                      push ebp
:004633D0 8BEC                    mov ebp, esp
:004633D2 51                      push ecx
:004633D3 894DFC                  mov dword ptr [ebp-04], ecx
:004633D6 8B45FC                  mov eax, dword ptr [ebp-04]
:004633D9 8B4D08                  mov ecx, dword ptr [ebp+08]
:004633DC 894810                  mov dword ptr [eax+10], ecx
:004633DF 8B55FC                  mov edx, dword ptr [ebp-04]
:004633E2 837A0C00                cmp dword ptr [edx+0C], 00000000
:004633E6 742F                    je 00463417
:004633E8 8B45FC                  mov eax, dword ptr [ebp-04]
:004633EB 8B4808                  mov ecx, dword ptr [eax+08]
:004633EE 51                      push ecx
:004633EF FF15C8624800            call dword ptr [004862C8]
:004633F5 85C0                    test eax, eax
:004633F7 741E                    je 00463417
:004633F9 6A01                    push 00000001
:004633FB 6A00                    push 00000000
:004633FD 8B55FC                  mov edx, dword ptr [ebp-04]
:00463400 8B4208                  mov eax, dword ptr [edx+08]
:00463403 50                      push eax
:00463404 FF15A4624800            call dword ptr [004862A4]
:0046340A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046340D 8B5108                  mov edx, dword ptr [ecx+08]
:00463410 52                      push edx
:00463411 FF15A8624800            call dword ptr [004862A8]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004633E6(C), :004633F7(C)
|
:00463417 8BE5                    mov esp, ebp
:00463419 5D                      pop ebp
:0046341A C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0046FB52   , :00470153   , :00470562   , :004705CB   
|
:0046341D 55                      push ebp
:0046341E 8BEC                    mov ebp, esp
:00463420 51                      push ecx
:00463421 894DFC                  mov dword ptr [ebp-04], ecx
:00463424 8B4508                  mov eax, dword ptr [ebp+08]
:00463427 50                      push eax
:00463428 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046342B E84DFFFFFF              call 0046337D
:00463430 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00463433 51                      push ecx
:00463434 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00463437 E893FFFFFF              call 004633CF
:0046343C 8BE5                    mov esp, ebp
:0046343E 5D                      pop ebp
:0046343F C20800                  ret 0008


:00463442 55                      push ebp
:00463443 8BEC                    mov ebp, esp
:00463445 83EC60                  sub esp, 00000060
:00463448 894DA4                  mov dword ptr [ebp-5C], ecx
:0046344B 8B4508                  mov eax, dword ptr [ebp+08]
:0046344E 8945A0                  mov dword ptr [ebp-60], eax
:00463451 837DA00A                cmp dword ptr [ebp-60], 0000000A
:00463455 7415                    je 0046346C
:00463457 837DA00F                cmp dword ptr [ebp-60], 0000000F
:0046345B 7425                    je 00463482
:0046345D 837DA014                cmp dword ptr [ebp-60], 00000014
:00463461 0F84BA000000            je 00463521
:00463467 E915010000              jmp 00463581

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00463455(C)
|
:0046346C 6A01                    push 00000001
:0046346E 6A00                    push 00000000
:00463470 8B4DA4                  mov ecx, dword ptr [ebp-5C]
:00463473 8B5108                  mov edx, dword ptr [ecx+08]
:00463476 52                      push edx
:00463477 FF15A4624800            call dword ptr [004862A4]
:0046347D E9FF000000              jmp 00463581

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046345B(C)
|
:00463482 8D45C0                  lea eax, dword ptr [ebp-40]
:00463485 50                      push eax
:00463486 8B4DA4                  mov ecx, dword ptr [ebp-5C]
:00463489 8B5108                  mov edx, dword ptr [ecx+08]
:0046348C 52                      push edx
:0046348D FF1540634800            call dword ptr [00486340]
:00463493 8B45A4                  mov eax, dword ptr [ebp-5C]
:00463496 83780C00                cmp dword ptr [eax+0C], 00000000
:0046349A 7470                    je 0046350C
:0046349C 8B4DA4                  mov ecx, dword ptr [ebp-5C]
:0046349F 8B5108                  mov edx, dword ptr [ecx+08]
:004634A2 52                      push edx
:004634A3 FF1534634800            call dword ptr [00486334]
:004634A9 85C0                    test eax, eax
:004634AB 7415                    je 004634C2
:004634AD 6A00                    push 00000000
:004634AF 6A00                    push 00000000
:004634B1 8B45C0                  mov eax, dword ptr [ebp-40]
:004634B4 50                      push eax
:004634B5 8B4DA4                  mov ecx, dword ptr [ebp-5C]
:004634B8 83C10C                  add ecx, 0000000C
:004634BB E89F82FAFF              call 0040B75F
:004634C0 EB4A                    jmp 0046350C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004634AB(C)
|
:004634C2 8B4DA4                  mov ecx, dword ptr [ebp-5C]
:004634C5 83C10C                  add ecx, 0000000C
:004634C8 E83F83FAFF              call 0040B80C
:004634CD 8945BC                  mov dword ptr [ebp-44], eax
:004634D0 6A23                    push 00000023
:004634D2 8B4DA4                  mov ecx, dword ptr [ebp-5C]
:004634D5 83C10C                  add ecx, 0000000C
:004634D8 E8DF82FAFF              call 0040B7BC
:004634DD 50                      push eax
:004634DE 8B4DA4                  mov ecx, dword ptr [ebp-5C]
:004634E1 83C10C                  add ecx, 0000000C
:004634E4 E8A482FAFF              call 0040B78D
:004634E9 50                      push eax
:004634EA 6A00                    push 00000000
:004634EC 6A00                    push 00000000
:004634EE 6A00                    push 00000000
:004634F0 8B4DBC                  mov ecx, dword ptr [ebp-44]
:004634F3 51                      push ecx
:004634F4 6A00                    push 00000000
:004634F6 6A00                    push 00000000
:004634F8 8B55C0                  mov edx, dword ptr [ebp-40]
:004634FB 52                      push edx
:004634FC FF1538634800            call dword ptr [00486338]
:00463502 8B45BC                  mov eax, dword ptr [ebp-44]
:00463505 50                      push eax
:00463506 FF153C634800            call dword ptr [0048633C]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046349A(C), :004634C0(U)
|
:0046350C 8D4DC0                  lea ecx, dword ptr [ebp-40]
:0046350F 51                      push ecx
:00463510 8B55A4                  mov edx, dword ptr [ebp-5C]
:00463513 8B4208                  mov eax, dword ptr [edx+08]
:00463516 50                      push eax
:00463517 FF1544634800            call dword ptr [00486344]
:0046351D 33C0                    xor eax, eax
:0046351F EB77                    jmp 00463598

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00463461(C)
|
:00463521 6A00                    push 00000000
:00463523 6A01                    push 00000001
:00463525 6A00                    push 00000000
:00463527 8B4DA4                  mov ecx, dword ptr [ebp-5C]
:0046352A 8B5108                  mov edx, dword ptr [ecx+08]
:0046352D 52                      push edx
:0046352E 8B450C                  mov eax, dword ptr [ebp+0C]
:00463531 50                      push eax
:00463532 E867DB0000              call 0047109E
:00463537 83C414                  add esp, 00000014
:0046353A 85C0                    test eax, eax
:0046353C 753F                    jne 0046357D
:0046353E 6A0F                    push 0000000F
:00463540 FF1564634800            call dword ptr [00486364]
:00463546 50                      push eax
:00463547 FF1568604800            call dword ptr [00486068]
:0046354D 8945A8                  mov dword ptr [ebp-58], eax
:00463550 8D4DAC                  lea ecx, dword ptr [ebp-54]
:00463553 51                      push ecx
:00463554 8B55A4                  mov edx, dword ptr [ebp-5C]
:00463557 8B4208                  mov eax, dword ptr [edx+08]
:0046355A 50                      push eax
:0046355B FF15EC624800            call dword ptr [004862EC]
:00463561 8B4DA8                  mov ecx, dword ptr [ebp-58]
:00463564 51                      push ecx
:00463565 8D55AC                  lea edx, dword ptr [ebp-54]
:00463568 52                      push edx
:00463569 8B450C                  mov eax, dword ptr [ebp+0C]
:0046356C 50                      push eax
:0046356D FF15F0624800            call dword ptr [004862F0]
:00463573 8B4DA8                  mov ecx, dword ptr [ebp-58]
:00463576 51                      push ecx
:00463577 FF1548604800            call dword ptr [00486048]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046353C(C)
|
:0046357D 33C0                    xor eax, eax
:0046357F EB17                    jmp 00463598

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00463467(U), :0046347D(U)
|
:00463581 8B5510                  mov edx, dword ptr [ebp+10]
:00463584 52                      push edx
:00463585 8B450C                  mov eax, dword ptr [ebp+0C]
:00463588 50                      push eax
:00463589 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046358C 51                      push ecx
:0046358D 8B55A4                  mov edx, dword ptr [ebp-5C]
:00463590 8B02                    mov eax, dword ptr [edx]
:00463592 8B4DA4                  mov ecx, dword ptr [ebp-5C]
:00463595 FF5004                  call [eax+04]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046351F(U), :0046357F(U)
|
:00463598 8BE5                    mov esp, ebp
:0046359A 5D                      pop ebp
:0046359B C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:00475D67   , :004760AC   
|
:0046359E 55                      push ebp
:0046359F 8BEC                    mov ebp, esp
:004635A1 51                      push ecx
:004635A2 894DFC                  mov dword ptr [ebp-04], ecx
:004635A5 8B45FC                  mov eax, dword ptr [ebp-04]
:004635A8 8B4808                  mov ecx, dword ptr [eax+08]
:004635AB 51                      push ecx
:004635AC FF1548634800            call dword ptr [00486348]
:004635B2 85C0                    test eax, eax
:004635B4 7574                    jne 0046362A
:004635B6 8B5538                  mov edx, dword ptr [ebp+38]
:004635B9 52                      push edx
:004635BA 8B4534                  mov eax, dword ptr [ebp+34]
:004635BD 50                      push eax
:004635BE 8B4D30                  mov ecx, dword ptr [ebp+30]
:004635C1 51                      push ecx
:004635C2 8B552C                  mov edx, dword ptr [ebp+2C]
:004635C5 52                      push edx
:004635C6 8B4528                  mov eax, dword ptr [ebp+28]
:004635C9 50                      push eax
:004635CA 8B4D24                  mov ecx, dword ptr [ebp+24]
:004635CD 51                      push ecx
:004635CE 8B5520                  mov edx, dword ptr [ebp+20]
:004635D1 52                      push edx
:004635D2 8B451C                  mov eax, dword ptr [ebp+1C]
:004635D5 50                      push eax
:004635D6 8B4D18                  mov ecx, dword ptr [ebp+18]
:004635D9 51                      push ecx
:004635DA 8B5514                  mov edx, dword ptr [ebp+14]
:004635DD 52                      push edx
:004635DE 8B4510                  mov eax, dword ptr [ebp+10]
:004635E1 50                      push eax
:004635E2 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004635E5 51                      push ecx
:004635E6 8B5508                  mov edx, dword ptr [ebp+08]
:004635E9 52                      push edx
:004635EA FF1514604800            call dword ptr [00486014]
:004635F0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004635F3 894108                  mov dword ptr [ecx+08], eax
:004635F6 8B55FC                  mov edx, dword ptr [ebp-04]
:004635F9 837A0800                cmp dword ptr [edx+08], 00000000
:004635FD 740F                    je 0046360E
:004635FF 8B45FC                  mov eax, dword ptr [ebp-04]
:00463602 8B4808                  mov ecx, dword ptr [eax+08]
:00463605 51                      push ecx
:00463606 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00463609 E8FCF1FFFF              call 0046280A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004635FD(C)
|
:0046360E 8B55FC                  mov edx, dword ptr [ebp-04]
:00463611 C7420C00000000          mov [edx+0C], 00000000
:00463618 8B45FC                  mov eax, dword ptr [ebp-04]
:0046361B 8B4D20                  mov ecx, dword ptr [ebp+20]
:0046361E 894810                  mov dword ptr [eax+10], ecx
:00463621 8B55FC                  mov edx, dword ptr [ebp-04]
:00463624 8B4524                  mov eax, dword ptr [ebp+24]
:00463627 894214                  mov dword ptr [edx+14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004635B4(C)
|
:0046362A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046362D 8B4108                  mov eax, dword ptr [ecx+08]
:00463630 8BE5                    mov esp, ebp
:00463632 5D                      pop ebp
:00463633 C23400                  ret 0034


:00463636 55                      push ebp
:00463637 8BEC                    mov ebp, esp
:00463639 51                      push ecx
:0046363A 894DFC                  mov dword ptr [ebp-04], ecx
:0046363D 8B4508                  mov eax, dword ptr [ebp+08]
:00463640 50                      push eax
:00463641 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00463644 E8C1F1FFFF              call 0046280A
:00463649 8BE5                    mov esp, ebp
:0046364B 5D                      pop ebp
:0046364C C20400                  ret 0004



* Referenced by a CALL at Address:
|:004764CE   
|
:0046364F 55                      push ebp
:00463650 8BEC                    mov ebp, esp
:00463652 51                      push ecx
:00463653 894DFC                  mov dword ptr [ebp-04], ecx
:00463656 8B45FC                  mov eax, dword ptr [ebp-04]
:00463659 8B4808                  mov ecx, dword ptr [eax+08]
:0046365C 51                      push ecx
:0046365D FF1554624800            call dword ptr [00486254]
:00463663 8B55FC                  mov edx, dword ptr [ebp-04]
:00463666 C7420C00000000          mov [edx+0C], 00000000
:0046366D 8B45FC                  mov eax, dword ptr [ebp-04]
:00463670 C7401000000000          mov [eax+10], 00000000
:00463677 8BE5                    mov esp, ebp
:00463679 5D                      pop ebp
:0046367A C3                      ret



* Referenced by a CALL at Address:
|:004760C3   
|
:0046367B 55                      push ebp
:0046367C 8BEC                    mov ebp, esp
:0046367E 51                      push ecx
:0046367F 894DFC                  mov dword ptr [ebp-04], ecx
:00463682 8B45FC                  mov eax, dword ptr [ebp-04]
:00463685 8B4D08                  mov ecx, dword ptr [ebp+08]
:00463688 89480C                  mov dword ptr [eax+0C], ecx
:0046368B 8BE5                    mov esp, ebp
:0046368D 5D                      pop ebp
:0046368E C20400                  ret 0004


:00463691 55                      push ebp
:00463692 8BEC                    mov ebp, esp
:00463694 83EC2C                  sub esp, 0000002C
:00463697 894DD8                  mov dword ptr [ebp-28], ecx
:0046369A 8B4508                  mov eax, dword ptr [ebp+08]
:0046369D 8945D4                  mov dword ptr [ebp-2C], eax
:004636A0 837DD405                cmp dword ptr [ebp-2C], 00000005
:004636A4 741F                    je 004636C5
:004636A6 817DD401020000          cmp dword ptr [ebp-2C], 00000201
:004636AD 0F84A6000000            je 00463759
:004636B3 817DD411030000          cmp dword ptr [ebp-2C], 00000311
:004636BA 0F8421010000            je 004637E1
:004636C0 E92F010000              jmp 004637F4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004636A4(C)
|
:004636C5 8B4DD8                  mov ecx, dword ptr [ebp-28]
:004636C8 83790C00                cmp dword ptr [ecx+0C], 00000000
:004636CC 0F8E82000000            jle 00463754
:004636D2 668B5510                mov dx, word ptr [ebp+10]
:004636D6 668955E8                mov word ptr [ebp-18], dx
:004636DA 8B4510                  mov eax, dword ptr [ebp+10]
:004636DD C1E810                  shr eax, 10
:004636E0 25FFFF0000              and eax, 0000FFFF
:004636E5 668945E4                mov word ptr [ebp-1C], ax
:004636E9 8D4DEC                  lea ecx, dword ptr [ebp-14]
:004636EC 51                      push ecx
:004636ED 8B55D8                  mov edx, dword ptr [ebp-28]
:004636F0 8B4208                  mov eax, dword ptr [edx+08]
:004636F3 50                      push eax
:004636F4 FF159C634800            call dword ptr [0048639C]
:004636FA 50                      push eax
:004636FB FF15EC624800            call dword ptr [004862EC]
:00463701 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00463704 2B4DEC                  sub ecx, dword ptr [ebp-14]
:00463707 894DFC                  mov dword ptr [ebp-04], ecx
:0046370A 8B55E8                  mov edx, dword ptr [ebp-18]
:0046370D 81E2FFFF0000            and edx, 0000FFFF
:00463713 3B55FC                  cmp edx, dword ptr [ebp-04]
:00463716 7515                    jne 0046372D
:00463718 8B45E4                  mov eax, dword ptr [ebp-1C]
:0046371B 25FFFF0000              and eax, 0000FFFF
:00463720 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00463723 8B510C                  mov edx, dword ptr [ecx+0C]
:00463726 83EA02                  sub edx, 00000002
:00463729 3BC2                    cmp eax, edx
:0046372B 7420                    je 0046374D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00463716(C)
|

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0046372D 6A06                    push 00000006
:0046372F 8B45D8                  mov eax, dword ptr [ebp-28]
:00463732 8B480C                  mov ecx, dword ptr [eax+0C]
:00463735 51                      push ecx
:00463736 8B55FC                  mov edx, dword ptr [ebp-04]
:00463739 52                      push edx
:0046373A 6A00                    push 00000000
:0046373C 6A00                    push 00000000
:0046373E 6A00                    push 00000000
:00463740 8B45D8                  mov eax, dword ptr [ebp-28]
:00463743 8B4808                  mov ecx, dword ptr [eax+08]
:00463746 51                      push ecx
:00463747 FF1580624800            call dword ptr [00486280]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046372B(C)
|
:0046374D 33C0                    xor eax, eax
:0046374F E9B7000000              jmp 0046380B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004636CC(C)
|
:00463754 E99B000000              jmp 004637F4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004636AD(C)
|
:00463759 8B5510                  mov edx, dword ptr [ebp+10]
:0046375C 52                      push edx
:0046375D 8B450C                  mov eax, dword ptr [ebp+0C]
:00463760 50                      push eax
:00463761 8B4D08                  mov ecx, dword ptr [ebp+08]
:00463764 51                      push ecx
:00463765 8B55D8                  mov edx, dword ptr [ebp-28]
:00463768 8B02                    mov eax, dword ptr [edx]
:0046376A 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0046376D FF5004                  call [eax+04]
:00463770 8945E0                  mov dword ptr [ebp-20], eax
:00463773 C745DC00000000          mov [ebp-24], 00000000
:0046377A EB09                    jmp 00463785

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004637DA(U)
|
:0046377C 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0046377F 83C101                  add ecx, 00000001
:00463782 894DDC                  mov dword ptr [ebp-24], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046377A(U)
|
:00463785 8B55D8                  mov edx, dword ptr [ebp-28]
:00463788 8B45DC                  mov eax, dword ptr [ebp-24]
:0046378B 3B4214                  cmp eax, dword ptr [edx+14]
:0046378E 7D4C                    jge 004637DC
:00463790 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00463793 6BC914                  imul ecx, 00000014
:00463796 8B55D8                  mov edx, dword ptr [ebp-28]
:00463799 8B4210                  mov eax, dword ptr [edx+10]
:0046379C 837C080400              cmp dword ptr [eax+ecx+04], 00000000
:004637A1 7437                    je 004637DA
:004637A3 6A00                    push 00000000
:004637A5 8B4DDC                  mov ecx, dword ptr [ebp-24]
:004637A8 6BC914                  imul ecx, 00000014
:004637AB 8B55D8                  mov edx, dword ptr [ebp-28]
:004637AE 8B4210                  mov eax, dword ptr [edx+10]
:004637B1 8B4C0804                mov ecx, dword ptr [eax+ecx+04]
:004637B5 51                      push ecx
:004637B6 680B040000              push 0000040B
:004637BB 8B55D8                  mov edx, dword ptr [ebp-28]
:004637BE 8B4208                  mov eax, dword ptr [edx+08]
:004637C1 50                      push eax
:004637C2 FF15F4624800            call dword ptr [004862F4]
:004637C8 85C0                    test eax, eax
:004637CA 740E                    je 004637DA
:004637CC 6A00                    push 00000000
:004637CE B9B0694B00              mov ecx, 004B69B0
:004637D3 E8D50E0100              call 004746AD
:004637D8 EB02                    jmp 004637DC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004637A1(C), :004637CA(C)
|
:004637DA EBA0                    jmp 0046377C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046378E(C), :004637D8(U)
|
:004637DC 8B45E0                  mov eax, dword ptr [ebp-20]
:004637DF EB2A                    jmp 0046380B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004636BA(C)
|
:004637E1 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004637E4 51                      push ecx
:004637E5 8B55D8                  mov edx, dword ptr [ebp-28]
:004637E8 8B4208                  mov eax, dword ptr [edx+08]
:004637EB 50                      push eax
:004637EC E88DED0000              call 0047257E
:004637F1 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004636C0(U), :00463754(U)
|
:004637F4 8B4D10                  mov ecx, dword ptr [ebp+10]
:004637F7 51                      push ecx
:004637F8 8B550C                  mov edx, dword ptr [ebp+0C]
:004637FB 52                      push edx
:004637FC 8B4508                  mov eax, dword ptr [ebp+08]
:004637FF 50                      push eax
:00463800 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00463803 8B11                    mov edx, dword ptr [ecx]
:00463805 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00463808 FF5204                  call [edx+04]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046374F(U), :004637DF(U)
|
:0046380B 8BE5                    mov esp, ebp
:0046380D 5D                      pop ebp
:0046380E C20C00                  ret 000C


:00463811 55                      push ebp
:00463812 8BEC                    mov ebp, esp
:00463814 83EC14                  sub esp, 00000014
:00463817 894DF0                  mov dword ptr [ebp-10], ecx
:0046381A C745FC00000000          mov [ebp-04], 00000000
:00463821 8B4508                  mov eax, dword ptr [ebp+08]
:00463824 8945EC                  mov dword ptr [ebp-14], eax
:00463827 837DEC20                cmp dword ptr [ebp-14], 00000020
:0046382B 7711                    ja 0046383E
:0046382D 837DEC20                cmp dword ptr [ebp-14], 00000020
:00463831 7423                    je 00463856
:00463833 837DEC14                cmp dword ptr [ebp-14], 00000014
:00463837 7424                    je 0046385D
:00463839 E993000000              jmp 004638D1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046382B(C)
|
:0046383E 817DEC00020000          cmp dword ptr [ebp-14], 00000200
:00463845 0F8286000000            jb 004638D1
:0046384B 817DEC03020000          cmp dword ptr [ebp-14], 00000203
:00463852 761D                    jbe 00463871
:00463854 EB7B                    jmp 004638D1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00463831(C)
|
:00463856 33C0                    xor eax, eax
:00463858 E996000000              jmp 004638F3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00463837(C)
|
:0046385D 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00463860 51                      push ecx
:00463861 8B55F0                  mov edx, dword ptr [ebp-10]
:00463864 8B02                    mov eax, dword ptr [edx]
:00463866 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00463869 FF5008                  call [eax+08]
:0046386C 8945FC                  mov dword ptr [ebp-04], eax
:0046386F EB60                    jmp 004638D1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00463852(C)
|
:00463871 8B4D10                  mov ecx, dword ptr [ebp+10]
:00463874 81E1FFFF0000            and ecx, 0000FFFF
:0046387A 894DF4                  mov dword ptr [ebp-0C], ecx
:0046387D 8B5510                  mov edx, dword ptr [ebp+10]
:00463880 C1EA10                  shr edx, 10
:00463883 81E2FFFF0000            and edx, 0000FFFF
:00463889 81E2FFFF0000            and edx, 0000FFFF
:0046388F 8955F8                  mov dword ptr [ebp-08], edx
:00463892 8D45F4                  lea eax, dword ptr [ebp-0C]
:00463895 50                      push eax
:00463896 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00463899 E85B000000              call 004638F9
:0046389E 85C0                    test eax, eax
:004638A0 7C2F                    jl 004638D1
:004638A2 817D0801020000          cmp dword ptr [ebp+08], 00000201
:004638A9 750C                    jne 004638B7
:004638AB 6A00                    push 00000000
:004638AD B9B0694B00              mov ecx, 004B69B0
:004638B2 E8F60D0100              call 004746AD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004638A9(C)
|
:004638B7 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004638BA 81E1FFFF0000            and ecx, 0000FFFF
:004638C0 8B55F8                  mov edx, dword ptr [ebp-08]
:004638C3 81E2FFFF0000            and edx, 0000FFFF
:004638C9 C1E210                  shl edx, 10
:004638CC 0BCA                    or ecx, edx
:004638CE 894D10                  mov dword ptr [ebp+10], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00463839(U), :00463845(C), :00463854(U), :0046386F(U), :004638A0(C)
|
:004638D1 837DFC00                cmp dword ptr [ebp-04], 00000000
:004638D5 7405                    je 004638DC
:004638D7 8B45FC                  mov eax, dword ptr [ebp-04]
:004638DA EB17                    jmp 004638F3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004638D5(C)
|
:004638DC 8B4510                  mov eax, dword ptr [ebp+10]
:004638DF 50                      push eax
:004638E0 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004638E3 51                      push ecx
:004638E4 8B5508                  mov edx, dword ptr [ebp+08]
:004638E7 52                      push edx
:004638E8 8B45F0                  mov eax, dword ptr [ebp-10]
:004638EB 8B10                    mov edx, dword ptr [eax]
:004638ED 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004638F0 FF5204                  call [edx+04]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00463858(U), :004638DA(U)
|
:004638F3 8BE5                    mov esp, ebp
:004638F5 5D                      pop ebp
:004638F6 C20C00                  ret 000C



* Referenced by a CALL at Address:
|:00463899   
|
:004638F9 55                      push ebp
:004638FA 8BEC                    mov ebp, esp
:004638FC 83EC44                  sub esp, 00000044
:004638FF 894DBC                  mov dword ptr [ebp-44], ecx
:00463902 8B4508                  mov eax, dword ptr [ebp+08]
:00463905 8B08                    mov ecx, dword ptr [eax]
:00463907 894DF0                  mov dword ptr [ebp-10], ecx
:0046390A 8B5508                  mov edx, dword ptr [ebp+08]
:0046390D 8B4204                  mov eax, dword ptr [edx+04]
:00463910 8945F4                  mov dword ptr [ebp-0C], eax
:00463913 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00463916 51                      push ecx
:00463917 6A00                    push 00000000
:00463919 6806120000              push 00001206
:0046391E 8B55BC                  mov edx, dword ptr [ebp-44]
:00463921 8B4208                  mov eax, dword ptr [edx+08]
:00463924 50                      push eax
:00463925 FF15F4624800            call dword ptr [004862F4]
:0046392B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046392E 83E101                  and ecx, 00000001
:00463931 83F901                  cmp ecx, 00000001
:00463934 0F8494000000            je 004639CE
:0046393A C745EC00000000          mov [ebp-14], 00000000
:00463941 C745C001000000          mov [ebp-40], 00000001
:00463948 6A00                    push 00000000
:0046394A 6A00                    push 00000000
:0046394C 6800120000              push 00001200
:00463951 8B55BC                  mov edx, dword ptr [ebp-44]
:00463954 8B4208                  mov eax, dword ptr [edx+08]
:00463957 50                      push eax
:00463958 FF15F4624800            call dword ptr [004862F4]
:0046395E 8945E4                  mov dword ptr [ebp-1C], eax
:00463961 C745E800000000          mov [ebp-18], 00000000
:00463968 EB09                    jmp 00463973

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004639CC(U)
|
:0046396A 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0046396D 83C101                  add ecx, 00000001
:00463970 894DE8                  mov dword ptr [ebp-18], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00463968(U)
|
:00463973 8B55E8                  mov edx, dword ptr [ebp-18]
:00463976 3B55E4                  cmp edx, dword ptr [ebp-1C]
:00463979 7D53                    jge 004639CE
:0046397B 8D45C0                  lea eax, dword ptr [ebp-40]
:0046397E 50                      push eax
:0046397F 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00463982 51                      push ecx
:00463983 6803120000              push 00001203
:00463988 8B55BC                  mov edx, dword ptr [ebp-44]
:0046398B 8B4208                  mov eax, dword ptr [edx+08]
:0046398E 50                      push eax
:0046398F FF15F4624800            call dword ptr [004862F4]
:00463995 8B4D08                  mov ecx, dword ptr [ebp+08]
:00463998 8B55EC                  mov edx, dword ptr [ebp-14]
:0046399B 3B11                    cmp edx, dword ptr [ecx]
:0046399D 7F24                    jg 004639C3
:0046399F 8B45EC                  mov eax, dword ptr [ebp-14]
:004639A2 0345C4                  add eax, dword ptr [ebp-3C]
:004639A5 8B4D08                  mov ecx, dword ptr [ebp+08]
:004639A8 3901                    cmp dword ptr [ecx], eax
:004639AA 7D17                    jge 004639C3
:004639AC 8B45C4                  mov eax, dword ptr [ebp-3C]
:004639AF 99                      cdq
:004639B0 2BC2                    sub eax, edx
:004639B2 D1F8                    sar eax, 1
:004639B4 8B55EC                  mov edx, dword ptr [ebp-14]
:004639B7 03D0                    add edx, eax
:004639B9 8B4508                  mov eax, dword ptr [ebp+08]
:004639BC 8910                    mov dword ptr [eax], edx
:004639BE 8B45E8                  mov eax, dword ptr [ebp-18]
:004639C1 EB0E                    jmp 004639D1

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046399D(C), :004639AA(C)
|
:004639C3 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004639C6 034DC4                  add ecx, dword ptr [ebp-3C]
:004639C9 894DEC                  mov dword ptr [ebp-14], ecx
:004639CC EB9C                    jmp 0046396A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00463934(C), :00463979(C)
|
:004639CE 83C8FF                  or eax, FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004639C1(U)
|
:004639D1 8BE5                    mov esp, ebp
:004639D3 5D                      pop ebp
:004639D4 C20400                  ret 0004



* Referenced by a CALL at Address:
|:00464B9E   
|
:004639D7 55                      push ebp
:004639D8 8BEC                    mov ebp, esp
:004639DA 83EC30                  sub esp, 00000030
:004639DD 894DD0                  mov dword ptr [ebp-30], ecx
:004639E0 6A00                    push 00000000
:004639E2 6A00                    push 00000000
:004639E4 6800120000              push 00001200
:004639E9 8B45D0                  mov eax, dword ptr [ebp-30]
:004639EC 8B4808                  mov ecx, dword ptr [eax+08]
:004639EF 51                      push ecx
:004639F0 FF15F4624800            call dword ptr [004862F4]
:004639F6 8945FC                  mov dword ptr [ebp-04], eax
:004639F9 C745D404000000          mov [ebp-2C], 00000004
:00463A00 C745F800000000          mov [ebp-08], 00000000
:00463A07 EB09                    jmp 00463A12

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00463A60(U)
|
:00463A09 8B55F8                  mov edx, dword ptr [ebp-08]
:00463A0C 83C201                  add edx, 00000001
:00463A0F 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00463A07(U)
|
:00463A12 8B45F8                  mov eax, dword ptr [ebp-08]
:00463A15 3B45FC                  cmp eax, dword ptr [ebp-04]
:00463A18 7D48                    jge 00463A62
:00463A1A 8D4DD4                  lea ecx, dword ptr [ebp-2C]
:00463A1D 51                      push ecx
:00463A1E 8B55F8                  mov edx, dword ptr [ebp-08]
:00463A21 52                      push edx
:00463A22 6803120000              push 00001203
:00463A27 8B45D0                  mov eax, dword ptr [ebp-30]
:00463A2A 8B4808                  mov ecx, dword ptr [eax+08]
:00463A2D 51                      push ecx
:00463A2E FF15F4624800            call dword ptr [004862F4]
:00463A34 8B55E8                  mov edx, dword ptr [ebp-18]
:00463A37 80E6BF                  and dh, BF
:00463A3A 8955E8                  mov dword ptr [ebp-18], edx
:00463A3D 8B45E8                  mov eax, dword ptr [ebp-18]
:00463A40 80CC80                  or ah, 80
:00463A43 8945E8                  mov dword ptr [ebp-18], eax
:00463A46 8D4DD4                  lea ecx, dword ptr [ebp-2C]
:00463A49 51                      push ecx
:00463A4A 8B55F8                  mov edx, dword ptr [ebp-08]
:00463A4D 52                      push edx
:00463A4E 6804120000              push 00001204
:00463A53 8B45D0                  mov eax, dword ptr [ebp-30]
:00463A56 8B4808                  mov ecx, dword ptr [eax+08]
:00463A59 51                      push ecx
:00463A5A FF15F4624800            call dword ptr [004862F4]
:00463A60 EBA7                    jmp 00463A09

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00463A18(C)
|
:00463A62 8BE5                    mov esp, ebp
:00463A64 5D                      pop ebp
:00463A65 C3                      ret


:00463A66 55                      push ebp
:00463A67 8BEC                    mov ebp, esp
:00463A69 83EC64                  sub esp, 00000064
:00463A6C 894DA0                  mov dword ptr [ebp-60], ecx
:00463A6F 8B4508                  mov eax, dword ptr [ebp+08]
:00463A72 833864                  cmp dword ptr [eax], 00000064
:00463A75 0F852A010000            jne 00463BA5

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:00463A7B C745A406000000          mov [ebp-5C], 00000006
:00463A82 8D4DDC                  lea ecx, dword ptr [ebp-24]
:00463A85 894DAC                  mov dword ptr [ebp-54], ecx
:00463A88 C745B420000000          mov [ebp-4C], 00000020
:00463A8F 8D55A4                  lea edx, dword ptr [ebp-5C]
:00463A92 52                      push edx
:00463A93 8B4508                  mov eax, dword ptr [ebp+08]
:00463A96 8B4808                  mov ecx, dword ptr [eax+08]
:00463A99 51                      push ecx
:00463A9A 6803120000              push 00001203
:00463A9F 8B55A0                  mov edx, dword ptr [ebp-60]
:00463AA2 8B4208                  mov eax, dword ptr [edx+08]
:00463AA5 50                      push eax
:00463AA6 FF15F4624800            call dword ptr [004862F4]
:00463AAC C745FC24810100          mov [ebp-04], 00018124
:00463AB3 8B4DB8                  mov ecx, dword ptr [ebp-48]
:00463AB6 83E103                  and ecx, 00000003
:00463AB9 894D9C                  mov dword ptr [ebp-64], ecx
:00463ABC 837D9C00                cmp dword ptr [ebp-64], 00000000
:00463AC0 740E                    je 00463AD0
:00463AC2 837D9C01                cmp dword ptr [ebp-64], 00000001
:00463AC6 7410                    je 00463AD8
:00463AC8 837D9C02                cmp dword ptr [ebp-64], 00000002
:00463ACC 7414                    je 00463AE2
:00463ACE EB1D                    jmp 00463AED

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00463AC0(C)
|
:00463AD0 8B55FC                  mov edx, dword ptr [ebp-04]
:00463AD3 8955FC                  mov dword ptr [ebp-04], edx
:00463AD6 EB1B                    jmp 00463AF3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00463AC6(C)
|
:00463AD8 8B45FC                  mov eax, dword ptr [ebp-04]
:00463ADB 0C02                    or al, 02
:00463ADD 8945FC                  mov dword ptr [ebp-04], eax
:00463AE0 EB11                    jmp 00463AF3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00463ACC(C)
|
:00463AE2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00463AE5 83C901                  or ecx, 00000001
:00463AE8 894DFC                  mov dword ptr [ebp-04], ecx
:00463AEB EB06                    jmp 00463AF3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00463ACE(U)
|
:00463AED 8B55FC                  mov edx, dword ptr [ebp-04]
:00463AF0 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00463AD6(U), :00463AE0(U), :00463AEB(U)
|
:00463AF3 C745C814000000          mov [ebp-38], 00000014
:00463AFA C745CC01000000          mov [ebp-34], 00000001
:00463B01 C745D005000000          mov [ebp-30], 00000005
:00463B08 C745D405000000          mov [ebp-2C], 00000005
:00463B0F 6A00                    push 00000000
:00463B11 6A01                    push 00000001
:00463B13 8B4508                  mov eax, dword ptr [ebp+08]
:00463B16 83C01C                  add eax, 0000001C
:00463B19 50                      push eax
:00463B1A 8B4DA0                  mov ecx, dword ptr [ebp-60]
:00463B1D 8B5108                  mov edx, dword ptr [ecx+08]
:00463B20 52                      push edx
:00463B21 8B4508                  mov eax, dword ptr [ebp+08]
:00463B24 8B4818                  mov ecx, dword ptr [eax+18]
:00463B27 51                      push ecx
:00463B28 E871D50000              call 0047109E
:00463B2D 83C414                  add esp, 00000014
:00463B30 B9202E4900              mov ecx, 00492E20
:00463B35 E87E75FAFF              call 0040B0B8
:00463B3A 85C0                    test eax, eax
:00463B3C 7431                    je 00463B6F
:00463B3E 6A01                    push 00000001
:00463B40 8D55C8                  lea edx, dword ptr [ebp-38]
:00463B43 52                      push edx
:00463B44 8B4508                  mov eax, dword ptr [ebp+08]
:00463B47 83C01C                  add eax, 0000001C
:00463B4A 50                      push eax
:00463B4B 6A08                    push 00000008
:00463B4D FF1564634800            call dword ptr [00486364]
:00463B53 50                      push eax
:00463B54 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00463B57 51                      push ecx
:00463B58 6AFF                    push FFFFFFFF
:00463B5A 8B55AC                  mov edx, dword ptr [ebp-54]
:00463B5D 52                      push edx
:00463B5E 8B4508                  mov eax, dword ptr [ebp+08]
:00463B61 8B4818                  mov ecx, dword ptr [eax+18]
:00463B64 51                      push ecx
:00463B65 E8A7D80000              call 00471411
:00463B6A 83C420                  add esp, 00000020
:00463B6D EB2F                    jmp 00463B9E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00463B3C(C)
|
:00463B6F 6A00                    push 00000000
:00463B71 8D55C8                  lea edx, dword ptr [ebp-38]
:00463B74 52                      push edx
:00463B75 8B4508                  mov eax, dword ptr [ebp+08]
:00463B78 83C01C                  add eax, 0000001C
:00463B7B 50                      push eax
:00463B7C 6A08                    push 00000008
:00463B7E FF1564634800            call dword ptr [00486364]
:00463B84 50                      push eax
:00463B85 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00463B88 51                      push ecx
:00463B89 6AFF                    push FFFFFFFF
:00463B8B 8B55AC                  mov edx, dword ptr [ebp-54]
:00463B8E 52                      push edx
:00463B8F 8B4508                  mov eax, dword ptr [ebp+08]
:00463B92 8B4818                  mov ecx, dword ptr [eax+18]
:00463B95 51                      push ecx
:00463B96 E876D80000              call 00471411
:00463B9B 83C420                  add esp, 00000020

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00463B6D(U)
|
:00463B9E B801000000              mov eax, 00000001
:00463BA3 EB02                    jmp 00463BA7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00463A75(C)
|
:00463BA5 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00463BA3(U)
|
:00463BA7 8BE5                    mov esp, ebp
:00463BA9 5D                      pop ebp
:00463BAA C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0040E25A   , :0041C3FA   , :00472B4A   , :0047581A   , :00479C66   
|
:00463BAD 55                      push ebp
:00463BAE 8BEC                    mov ebp, esp
:00463BB0 6AFF                    push FFFFFFFF
:00463BB2 6819584800              push 00485819
:00463BB7 64A100000000            mov eax, dword ptr fs:[00000000]
:00463BBD 50                      push eax
:00463BBE 64892500000000          mov dword ptr fs:[00000000], esp
:00463BC5 51                      push ecx
:00463BC6 894DF0                  mov dword ptr [ebp-10], ecx
:00463BC9 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00463BCC E894EBFFFF              call 00462765
:00463BD1 C745FC00000000          mov [ebp-04], 00000000
:00463BD8 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00463BDB 83C140                  add ecx, 00000040
:00463BDE E83DEC0000              call 00472820
:00463BE3 8B45F0                  mov eax, dword ptr [ebp-10]
:00463BE6 C700206F4800            mov dword ptr [eax], 00486F20
:00463BEC 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00463BEF C7410C00000000          mov [ecx+0C], 00000000
:00463BF6 8B55F0                  mov edx, dword ptr [ebp-10]
:00463BF9 C7421000000000          mov [edx+10], 00000000
:00463C00 8B45F0                  mov eax, dword ptr [ebp-10]
:00463C03 C6401400                mov [eax+14], 00
:00463C07 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00463C0A C7411800000000          mov [ecx+18], 00000000
:00463C11 8B55F0                  mov edx, dword ptr [ebp-10]
:00463C14 C7421CFFFFFFFF          mov [edx+1C], FFFFFFFF
:00463C1B 8B45F0                  mov eax, dword ptr [ebp-10]
:00463C1E C7402000000000          mov [eax+20], 00000000
:00463C25 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00463C28 C7412400000000          mov [ecx+24], 00000000
:00463C2F 8B55F0                  mov edx, dword ptr [ebp-10]
:00463C32 C7422813000001          mov [edx+28], 01000013
:00463C39 8B45F0                  mov eax, dword ptr [ebp-10]
:00463C3C C7402C15000001          mov [eax+2C], 01000015
:00463C43 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00463C46 C741301E000001          mov [ecx+30], 0100001E
:00463C4D 8B55F0                  mov edx, dword ptr [ebp-10]
:00463C50 C7423400000000          mov [edx+34], 00000000
:00463C57 8B45F0                  mov eax, dword ptr [ebp-10]
:00463C5A C74038AA000001          mov [eax+38], 010000AA
:00463C61 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00463C64 C7414C00000000          mov [ecx+4C], 00000000
:00463C6B C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00463C72 8B45F0                  mov eax, dword ptr [ebp-10]
:00463C75 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00463C78 64890D00000000          mov dword ptr fs:[00000000], ecx
:00463C7F 8BE5                    mov esp, ebp
:00463C81 5D                      pop ebp
:00463C82 C3                      ret



* Referenced by a CALL at Addresses:
|:0047583A   , :00485D59   
|
:00463C83 55                      push ebp
:00463C84 8BEC                    mov ebp, esp
:00463C86 6AFF                    push FFFFFFFF
:00463C88 6838584800              push 00485838
:00463C8D 64A100000000            mov eax, dword ptr fs:[00000000]
:00463C93 50                      push eax
:00463C94 64892500000000          mov dword ptr fs:[00000000], esp
:00463C9B 83EC08                  sub esp, 00000008
:00463C9E 894DEC                  mov dword ptr [ebp-14], ecx
:00463CA1 8B45EC                  mov eax, dword ptr [ebp-14]
:00463CA4 C700206F4800            mov dword ptr [eax], 00486F20
:00463CAA C745FC01000000          mov [ebp-04], 00000001
:00463CB1 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00463CB4 83791800                cmp dword ptr [ecx+18], 00000000
:00463CB8 7415                    je 00463CCF
:00463CBA 8B55EC                  mov edx, dword ptr [ebp-14]
:00463CBD 8B4218                  mov eax, dword ptr [edx+18]
:00463CC0 8945F0                  mov dword ptr [ebp-10], eax
:00463CC3 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00463CC6 51                      push ecx
:00463CC7 E854D30100              call 00481020
:00463CCC 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00463CB8(C)
|
:00463CCF C645FC00                mov [ebp-04], 00
:00463CD3 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00463CD6 83C140                  add ecx, 00000040
:00463CD9 E812A5FAFF              call 0040E1F0
:00463CDE C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00463CE5 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00463CE8 E8B2EAFFFF              call 0046279F
:00463CED 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00463CF0 64890D00000000          mov dword ptr fs:[00000000], ecx
:00463CF7 8BE5                    mov esp, ebp
:00463CF9 5D                      pop ebp
:00463CFA C3                      ret



* Referenced by a CALL at Addresses:
|:0041A569   , :004658F3   , :00465A98   , :00467E90   , :00467F83   
|:00468068   , :004687DF   , :00468B85   , :0046B378   , :0046B627   
|:0046BC2E   , :0046C592   , :00479CEB   
|
:00463CFB 55                      push ebp
:00463CFC 8BEC                    mov ebp, esp
:00463CFE 83EC0C                  sub esp, 0000000C
:00463D01 56                      push esi
:00463D02 894DF4                  mov dword ptr [ebp-0C], ecx
:00463D05 8B45F4                  mov eax, dword ptr [ebp-0C]
:00463D08 83781800                cmp dword ptr [eax+18], 00000000
:00463D0C 7415                    je 00463D23
:00463D0E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00463D11 8B5118                  mov edx, dword ptr [ecx+18]
:00463D14 8955F8                  mov dword ptr [ebp-08], edx
:00463D17 8B45F8                  mov eax, dword ptr [ebp-08]
:00463D1A 50                      push eax
:00463D1B E800D30100              call 00481020
:00463D20 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00463D0C(C)
|
:00463D23 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00463D26 8A5508                  mov dl, byte ptr [ebp+08]
:00463D29 885114                  mov byte ptr [ecx+14], dl
:00463D2C 8B4508                  mov eax, dword ptr [ebp+08]
:00463D2F 25FF000000              and eax, 000000FF
:00463D34 C1E002                  shl eax, 02
:00463D37 50                      push eax
:00463D38 E8A3D20100              call 00480FE0
:00463D3D 83C404                  add esp, 00000004
:00463D40 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00463D43 894118                  mov dword ptr [ecx+18], eax
:00463D46 C745FC00000000          mov [ebp-04], 00000000
:00463D4D EB09                    jmp 00463D58

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00463D7A(U)
|
:00463D4F 8B55FC                  mov edx, dword ptr [ebp-04]
:00463D52 83C201                  add edx, 00000001
:00463D55 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00463D4D(U)
|
:00463D58 8B4508                  mov eax, dword ptr [ebp+08]
:00463D5B 25FF000000              and eax, 000000FF
:00463D60 3945FC                  cmp dword ptr [ebp-04], eax
:00463D63 7D17                    jge 00463D7C
:00463D65 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00463D68 8B5118                  mov edx, dword ptr [ecx+18]
:00463D6B 8B45FC                  mov eax, dword ptr [ebp-04]
:00463D6E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00463D71 8B750C                  mov esi, dword ptr [ebp+0C]
:00463D74 8B0C8E                  mov ecx, dword ptr [esi+4*ecx]
:00463D77 890C82                  mov dword ptr [edx+4*eax], ecx
:00463D7A EBD3                    jmp 00463D4F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00463D63(C)
|
:00463D7C 5E                      pop esi
:00463D7D 8BE5                    mov esp, ebp
:00463D7F 5D                      pop ebp
:00463D80 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0041A971   , :004642EF   , :004659D6   , :00465E20   , :004668C5   
|:00466A57   , :00466B11   , :00466C6B   , :00466D41   , :00466E93   
|:0046BB57   , :0046C780   , :0046F286   , :00473097   , :00479D74   
|
:00463D83 55                      push ebp
:00463D84 8BEC                    mov ebp, esp
:00463D86 83EC2C                  sub esp, 0000002C
:00463D89 894DD4                  mov dword ptr [ebp-2C], ecx
:00463D8C C745D80F000000          mov [ebp-28], 0000000F
:00463D93 C745E400000000          mov [ebp-1C], 00000000
:00463D9A C745E800000000          mov [ebp-18], 00000000
:00463DA1 C745E000000000          mov [ebp-20], 00000000
:00463DA8 C745ECFFFFFFFF          mov [ebp-14], FFFFFFFF
:00463DAF C745F020000000          mov [ebp-10], 00000020
:00463DB6 8B4508                  mov eax, dword ptr [ebp+08]
:00463DB9 25FF000000              and eax, 000000FF
:00463DBE 8945DC                  mov dword ptr [ebp-24], eax
:00463DC1 C745F4FFFFFFFF          mov [ebp-0C], FFFFFFFF
:00463DC8 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00463DCB 894DF8                  mov dword ptr [ebp-08], ecx
:00463DCE 8D55D8                  lea edx, dword ptr [ebp-28]
:00463DD1 52                      push edx
:00463DD2 6A00                    push 00000000
:00463DD4 6807100000              push 00001007
:00463DD9 8B45D4                  mov eax, dword ptr [ebp-2C]
:00463DDC 8B4810                  mov ecx, dword ptr [eax+10]
:00463DDF 51                      push ecx
:00463DE0 FF15F4624800            call dword ptr [004862F4]
:00463DE6 83F8FF                  cmp eax, FFFFFFFF
:00463DE9 7504                    jne 00463DEF
:00463DEB 33C0                    xor eax, eax
:00463DED EB05                    jmp 00463DF4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00463DE9(C)
|
:00463DEF B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00463DED(U)
|
:00463DF4 8BE5                    mov esp, ebp
:00463DF6 5D                      pop ebp
:00463DF7 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0046435F   , :0046B175   , :0046B567   , :0046BD5C   , :0046BD6A   
|
:00463DFA 55                      push ebp
:00463DFB 8BEC                    mov ebp, esp
:00463DFD 83EC08                  sub esp, 00000008
:00463E00 894DF8                  mov dword ptr [ebp-08], ecx
:00463E03 8B4508                  mov eax, dword ptr [ebp+08]
:00463E06 50                      push eax
:00463E07 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00463E0A E8CB010000              call 00463FDA
:00463E0F 8945FC                  mov dword ptr [ebp-04], eax
:00463E12 837DFCFF                cmp dword ptr [ebp-04], FFFFFFFF
:00463E16 7504                    jne 00463E1C
:00463E18 33C0                    xor eax, eax
:00463E1A EB45                    jmp 00463E61

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00463E16(C)
|
:00463E1C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00463E1F E812010000              call 00463F36
:00463E24 6A00                    push 00000000
:00463E26 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00463E29 51                      push ecx
:00463E2A 6808100000              push 00001008
:00463E2F 8B55F8                  mov edx, dword ptr [ebp-08]
:00463E32 8B4210                  mov eax, dword ptr [edx+10]
:00463E35 50                      push eax
:00463E36 FF15F4624800            call dword ptr [004862F4]
:00463E3C 6A00                    push 00000000
:00463E3E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00463E41 51                      push ecx
:00463E42 682A100000              push 0000102A
:00463E47 8B55F8                  mov edx, dword ptr [ebp-08]
:00463E4A 8B4210                  mov eax, dword ptr [edx+10]
:00463E4D 50                      push eax
:00463E4E FF15F4624800            call dword ptr [004862F4]
:00463E54 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00463E57 E80B010000              call 00463F67
:00463E5C B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00463E1A(U)
|
:00463E61 8BE5                    mov esp, ebp
:00463E63 5D                      pop ebp
:00463E64 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0046531A   , :0046855E   , :004685EE   , :00468995   , :0046B11A   
|:0046B4E3   
|
:00463E67 55                      push ebp
:00463E68 8BEC                    mov ebp, esp
:00463E6A 51                      push ecx
:00463E6B 894DFC                  mov dword ptr [ebp-04], ecx
:00463E6E 8B45FC                  mov eax, dword ptr [ebp-04]
:00463E71 8B4820                  mov ecx, dword ptr [eax+20]
:00463E74 83C101                  add ecx, 00000001
:00463E77 8B55FC                  mov edx, dword ptr [ebp-04]
:00463E7A 894A20                  mov dword ptr [edx+20], ecx
:00463E7D FF1584634800            call dword ptr [00486384]
:00463E83 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00463E86 3B4110                  cmp eax, dword ptr [ecx+10]
:00463E89 7506                    jne 00463E91
:00463E8B FF1580634800            call dword ptr [00486380]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00463E89(C)
|
:00463E91 8BE5                    mov esp, ebp
:00463E93 5D                      pop ebp
:00463E94 C3                      ret



* Referenced by a CALL at Addresses:
|:0046536F   , :0046859D   , :00468700   , :0046870F   , :004689C3   
|:0046B31F   , :0046B50B   
|
:00463E95 55                      push ebp
:00463E96 8BEC                    mov ebp, esp
:00463E98 51                      push ecx
:00463E99 894DFC                  mov dword ptr [ebp-04], ecx
:00463E9C 8B45FC                  mov eax, dword ptr [ebp-04]
:00463E9F 8B4820                  mov ecx, dword ptr [eax+20]
:00463EA2 83E901                  sub ecx, 00000001
:00463EA5 8B55FC                  mov edx, dword ptr [ebp-04]
:00463EA8 894A20                  mov dword ptr [edx+20], ecx
:00463EAB 8B45FC                  mov eax, dword ptr [ebp-04]
:00463EAE 83782000                cmp dword ptr [eax+20], 00000000
:00463EB2 7F15                    jg 00463EC9
:00463EB4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00463EB7 C7412000000000          mov [ecx+20], 00000000
:00463EBE 8B55FC                  mov edx, dword ptr [ebp-04]
:00463EC1 8B02                    mov eax, dword ptr [edx]
:00463EC3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00463EC6 FF5040                  call [eax+40]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00463EB2(C)
|
:00463EC9 8BE5                    mov esp, ebp
:00463ECB 5D                      pop ebp
:00463ECC C3                      ret



* Referenced by a CALL at Addresses:
|:00464EA9   , :00464F9A   , :0046514F   , :00465300   
|
:00463ECD 55                      push ebp
:00463ECE 8BEC                    mov ebp, esp
:00463ED0 83EC0C                  sub esp, 0000000C
:00463ED3 894DF8                  mov dword ptr [ebp-08], ecx
:00463ED6 8B45F8                  mov eax, dword ptr [ebp-08]
:00463ED9 8B480C                  mov ecx, dword ptr [eax+0C]
:00463EDC 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00463F04(U)
|
:00463EDF 6AF0                    push FFFFFFF0
:00463EE1 8B55FC                  mov edx, dword ptr [ebp-04]
:00463EE4 52                      push edx
:00463EE5 FF15A0634800            call dword ptr [004863A0]
:00463EEB 2500000040              and eax, 40000000
:00463EF0 3D00000040              cmp eax, 40000000
:00463EF5 750F                    jne 00463F06
:00463EF7 8B45FC                  mov eax, dword ptr [ebp-04]
:00463EFA 50                      push eax
:00463EFB FF159C634800            call dword ptr [0048639C]
:00463F01 8945FC                  mov dword ptr [ebp-04], eax
:00463F04 EBD9                    jmp 00463EDF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00463EF5(C)
|
:00463F06 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00463F09 83792000                cmp dword ptr [ecx+20], 00000000
:00463F0D 7519                    jne 00463F28
:00463F0F 8B55FC                  mov edx, dword ptr [ebp-04]
:00463F12 52                      push edx
:00463F13 E8CEA80000              call 0046E7E6
:00463F18 83C404                  add esp, 00000004
:00463F1B 85C0                    test eax, eax
:00463F1D 7509                    jne 00463F28
:00463F1F C745F401000000          mov [ebp-0C], 00000001
:00463F26 EB07                    jmp 00463F2F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00463F0D(C), :00463F1D(C)
|
:00463F28 C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00463F26(U)
|
:00463F2F 8B45F4                  mov eax, dword ptr [ebp-0C]
:00463F32 8BE5                    mov esp, ebp
:00463F34 5D                      pop ebp
:00463F35 C3                      ret



* Referenced by a CALL at Addresses:
|:00463E1F   , :0046B166   , :0046B55B   , :0046BD1D   
|
:00463F36 55                      push ebp
:00463F37 8BEC                    mov ebp, esp
:00463F39 51                      push ecx
:00463F3A 894DFC                  mov dword ptr [ebp-04], ecx
:00463F3D 8B45FC                  mov eax, dword ptr [ebp-04]
:00463F40 8B4824                  mov ecx, dword ptr [eax+24]
:00463F43 8B55FC                  mov edx, dword ptr [ebp-04]
:00463F46 8B4224                  mov eax, dword ptr [edx+24]
:00463F49 83C001                  add eax, 00000001
:00463F4C 8B55FC                  mov edx, dword ptr [ebp-04]
:00463F4F 894224                  mov dword ptr [edx+24], eax
:00463F52 85C9                    test ecx, ecx
:00463F54 750D                    jne 00463F63
:00463F56 8B45FC                  mov eax, dword ptr [ebp-04]
:00463F59 8B480C                  mov ecx, dword ptr [eax+0C]
:00463F5C 51                      push ecx
:00463F5D FF1530634800            call dword ptr [00486330]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00463F54(C)
|
:00463F63 8BE5                    mov esp, ebp
:00463F65 5D                      pop ebp
:00463F66 C3                      ret



* Referenced by a CALL at Addresses:
|:00463E57   , :0046B18B   , :0046B577   , :0046BD81   
|
:00463F67 55                      push ebp
:00463F68 8BEC                    mov ebp, esp
:00463F6A 51                      push ecx
:00463F6B 894DFC                  mov dword ptr [ebp-04], ecx
:00463F6E 8B45FC                  mov eax, dword ptr [ebp-04]
:00463F71 8B4824                  mov ecx, dword ptr [eax+24]
:00463F74 83E901                  sub ecx, 00000001
:00463F77 8B55FC                  mov edx, dword ptr [ebp-04]
:00463F7A 894A24                  mov dword ptr [edx+24], ecx
:00463F7D 8B45FC                  mov eax, dword ptr [ebp-04]
:00463F80 83782400                cmp dword ptr [eax+24], 00000000
:00463F84 7F12                    jg 00463F98
:00463F86 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00463F89 C7412400000000          mov [ecx+24], 00000000
:00463F90 6A00                    push 00000000
:00463F92 FF1530634800            call dword ptr [00486330]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00463F84(C)
|
:00463F98 8BE5                    mov esp, ebp
:00463F9A 5D                      pop ebp
:00463F9B C3                      ret



* Referenced by a CALL at Addresses:
|:00465615   , :00465883   , :0046636F   , :00466456   , :004670FA   
|:0046715C   , :00467737   , :0046777F   , :00467F11   , :00468405   
|:00468697   , :0046884A   , :0046888E   , :00468A9D   , :00468BEF   
|:00468C20   , :0046B3EA   , :0046B42F   , :0046B681   , :0046B752   
|:0046BCA8   , :0046C7B3   , :0047A662   , :0047ADFA   
|
:00463F9C 55                      push ebp
:00463F9D 8BEC                    mov ebp, esp
:00463F9F 83EC2C                  sub esp, 0000002C
:00463FA2 894DD4                  mov dword ptr [ebp-2C], ecx
:00463FA5 C745D804000000          mov [ebp-28], 00000004
:00463FAC 8B4508                  mov eax, dword ptr [ebp+08]
:00463FAF 8945DC                  mov dword ptr [ebp-24], eax
:00463FB2 C745E000000000          mov [ebp-20], 00000000
:00463FB9 8D4DD8                  lea ecx, dword ptr [ebp-28]
:00463FBC 51                      push ecx
:00463FBD 6A00                    push 00000000
:00463FBF 6805100000              push 00001005
:00463FC4 8B55D4                  mov edx, dword ptr [ebp-2C]
:00463FC7 8B4210                  mov eax, dword ptr [edx+10]
:00463FCA 50                      push eax
:00463FCB FF15F4624800            call dword ptr [004862F4]
:00463FD1 8B45F8                  mov eax, dword ptr [ebp-08]
:00463FD4 8BE5                    mov esp, ebp
:00463FD6 5D                      pop ebp
:00463FD7 C20400                  ret 0004



* Referenced by a CALL at Address:
|:00463E0A   
|
:00463FDA 55                      push ebp
:00463FDB 8BEC                    mov ebp, esp
:00463FDD 83EC1C                  sub esp, 0000001C
:00463FE0 894DE4                  mov dword ptr [ebp-1C], ecx
:00463FE3 C745E801000000          mov [ebp-18], 00000001
:00463FEA 8B4508                  mov eax, dword ptr [ebp+08]
:00463FED 8945F0                  mov dword ptr [ebp-10], eax
:00463FF0 8D4DE8                  lea ecx, dword ptr [ebp-18]
:00463FF3 51                      push ecx
:00463FF4 6AFF                    push FFFFFFFF
:00463FF6 680D100000              push 0000100D
:00463FFB 8B55E4                  mov edx, dword ptr [ebp-1C]
:00463FFE 8B4210                  mov eax, dword ptr [edx+10]
:00464001 50                      push eax
:00464002 FF15F4624800            call dword ptr [004862F4]
:00464008 8BE5                    mov esp, ebp
:0046400A 5D                      pop ebp
:0046400B C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:004642F9   , :004647D0   , :004649E1   
|
:0046400E 55                      push ebp
:0046400F 8BEC                    mov ebp, esp
:00464011 51                      push ecx
:00464012 894DFC                  mov dword ptr [ebp-04], ecx
:00464015 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00464018 E8A383FBFF              call 0041C3C0
:0046401D 85C0                    test eax, eax
:0046401F 7504                    jne 00464025
:00464021 33C0                    xor eax, eax
:00464023 EB16                    jmp 0046403B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046401F(C)
|
:00464025 6A00                    push 00000000
:00464027 6A00                    push 00000000
:00464029 6827100000              push 00001027
:0046402E 8B45FC                  mov eax, dword ptr [ebp-04]
:00464031 8B4810                  mov ecx, dword ptr [eax+10]
:00464034 51                      push ecx
:00464035 FF15F4624800            call dword ptr [004862F4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464023(U)
|
:0046403B 8BE5                    mov esp, ebp
:0046403D 5D                      pop ebp
:0046403E C3                      ret



* Referenced by a CALL at Addresses:
|:00468781   , :0046BBD7   
|
:0046403F 55                      push ebp
:00464040 8BEC                    mov ebp, esp
:00464042 51                      push ecx
:00464043 894DFC                  mov dword ptr [ebp-04], ecx
:00464046 6A00                    push 00000000
:00464048 6A00                    push 00000000
:0046404A 682A100000              push 0000102A
:0046404F 8B45FC                  mov eax, dword ptr [ebp-04]
:00464052 8B4810                  mov ecx, dword ptr [eax+10]
:00464055 51                      push ecx
:00464056 FF15F4624800            call dword ptr [004862F4]
:0046405C 8BE5                    mov esp, ebp
:0046405E 5D                      pop ebp
:0046405F C3                      ret



* Referenced by a CALL at Addresses:
|:004686F8   , :00468B0A   , :0046B585   
|
:00464060 55                      push ebp
:00464061 8BEC                    mov ebp, esp
:00464063 83EC20                  sub esp, 00000020
:00464066 894DE0                  mov dword ptr [ebp-20], ecx
:00464069 C745E801000000          mov [ebp-18], 00000001
:00464070 8B4508                  mov eax, dword ptr [ebp+08]
:00464073 8945F0                  mov dword ptr [ebp-10], eax
:00464076 8D4DE8                  lea ecx, dword ptr [ebp-18]
:00464079 51                      push ecx
:0046407A 6AFF                    push FFFFFFFF
:0046407C 680D100000              push 0000100D
:00464081 8B55E0                  mov edx, dword ptr [ebp-20]
:00464084 8B4210                  mov eax, dword ptr [edx+10]
:00464087 50                      push eax
:00464088 FF15F4624800            call dword ptr [004862F4]
:0046408E 8945E4                  mov dword ptr [ebp-1C], eax
:00464091 837DE4FF                cmp dword ptr [ebp-1C], FFFFFFFF
:00464095 7504                    jne 0046409B
:00464097 33C0                    xor eax, eax
:00464099 EB2C                    jmp 004640C7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464095(C)
|
:0046409B 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0046409E 51                      push ecx
:0046409F 8B55E4                  mov edx, dword ptr [ebp-1C]
:004640A2 52                      push edx
:004640A3 6815100000              push 00001015
:004640A8 8B45E0                  mov eax, dword ptr [ebp-20]
:004640AB 8B4810                  mov ecx, dword ptr [eax+10]
:004640AE 51                      push ecx
:004640AF FF15F4624800            call dword ptr [004862F4]
:004640B5 8B55E0                  mov edx, dword ptr [ebp-20]
:004640B8 8B4210                  mov eax, dword ptr [edx+10]
:004640BB 50                      push eax
:004640BC FF15A8624800            call dword ptr [004862A8]
:004640C2 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464099(U)
|
:004640C7 8BE5                    mov esp, ebp
:004640C9 5D                      pop ebp
:004640CA C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:004655BD   , :004659E3   , :00466721   , :0046801F   , :004680A9   
|:0046882B   , :00468BC8   , :0046B180   , :0046B3C4   , :0046B56F   
|:0046B668   , :0046BC84   , :0046BD89   , :0046BF9A   , :0046C78D   
|:00479D98   
|
:004640CD 55                      push ebp
:004640CE 8BEC                    mov ebp, esp
:004640D0 83EC2C                  sub esp, 0000002C
:004640D3 894DD4                  mov dword ptr [ebp-2C], ecx
:004640D6 C745E400000000          mov [ebp-1C], 00000000
:004640DD C745DC00000000          mov [ebp-24], 00000000
:004640E4 C745EC00000000          mov [ebp-14], 00000000
:004640EB EB09                    jmp 004640F6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046413A(U)
|
:004640ED 8B45EC                  mov eax, dword ptr [ebp-14]
:004640F0 83C001                  add eax, 00000001
:004640F3 8945EC                  mov dword ptr [ebp-14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004640EB(U)
|
:004640F6 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:004640F9 33D2                    xor edx, edx
:004640FB 8A5114                  mov dl, byte ptr [ecx+14]
:004640FE 3955EC                  cmp dword ptr [ebp-14], edx
:00464101 7D39                    jge 0046413C
:00464103 6A00                    push 00000000
:00464105 8B45EC                  mov eax, dword ptr [ebp-14]
:00464108 50                      push eax
:00464109 681D100000              push 0000101D
:0046410E 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00464111 8B5110                  mov edx, dword ptr [ecx+10]
:00464114 52                      push edx
:00464115 FF15F4624800            call dword ptr [004862F4]
:0046411B 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0046411E 03C8                    add ecx, eax
:00464120 894DE4                  mov dword ptr [ebp-1C], ecx
:00464123 8B55EC                  mov edx, dword ptr [ebp-14]
:00464126 52                      push edx
:00464127 8B45D4                  mov eax, dword ptr [ebp-2C]
:0046412A 8B10                    mov edx, dword ptr [eax]
:0046412C 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0046412F FF5214                  call [edx+14]
:00464132 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00464135 03C8                    add ecx, eax
:00464137 894DDC                  mov dword ptr [ebp-24], ecx
:0046413A EBB1                    jmp 004640ED

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464101(C)
|
:0046413C 8D55F0                  lea edx, dword ptr [ebp-10]
:0046413F 52                      push edx
:00464140 8B45D4                  mov eax, dword ptr [ebp-2C]
:00464143 8B4810                  mov ecx, dword ptr [eax+10]
:00464146 51                      push ecx
:00464147 FF15EC624800            call dword ptr [004862EC]
:0046414D 8B55F8                  mov edx, dword ptr [ebp-08]
:00464150 2B55F0                  sub edx, dword ptr [ebp-10]
:00464153 3955E4                  cmp dword ptr [ebp-1C], edx
:00464156 0F84D9000000            je 00464235
:0046415C 6A00                    push 00000000
:0046415E 8B45D4                  mov eax, dword ptr [ebp-2C]
:00464161 8B4810                  mov ecx, dword ptr [eax+10]
:00464164 51                      push ecx
:00464165 FF15E0624800            call dword ptr [004862E0]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464221(U)
|
:0046416B 8B55F8                  mov edx, dword ptr [ebp-08]
:0046416E 2B55F0                  sub edx, dword ptr [ebp-10]
:00464171 2B55E4                  sub edx, dword ptr [ebp-1C]
:00464174 8955E8                  mov dword ptr [ebp-18], edx
:00464177 837DE800                cmp dword ptr [ebp-18], 00000000
:0046417B 0F84A5000000            je 00464226
:00464181 8B45F8                  mov eax, dword ptr [ebp-08]
:00464184 2B45F0                  sub eax, dword ptr [ebp-10]
:00464187 8945D8                  mov dword ptr [ebp-28], eax
:0046418A 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0046418D 33D2                    xor edx, edx
:0046418F 8A5114                  mov dl, byte ptr [ecx+14]
:00464192 83EA01                  sub edx, 00000001
:00464195 8955EC                  mov dword ptr [ebp-14], edx
:00464198 EB09                    jmp 004641A3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464205(U)
|
:0046419A 8B45EC                  mov eax, dword ptr [ebp-14]
:0046419D 83E801                  sub eax, 00000001
:004641A0 8945EC                  mov dword ptr [ebp-14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464198(U)
|
:004641A3 837DEC00                cmp dword ptr [ebp-14], 00000000
:004641A7 7C5E                    jl 00464207
:004641A9 8B4DDC                  mov ecx, dword ptr [ebp-24]
:004641AC 51                      push ecx
:004641AD 8B55F8                  mov edx, dword ptr [ebp-08]
:004641B0 2B55F0                  sub edx, dword ptr [ebp-10]
:004641B3 52                      push edx
:004641B4 8B45EC                  mov eax, dword ptr [ebp-14]
:004641B7 50                      push eax
:004641B8 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:004641BB 8B11                    mov edx, dword ptr [ecx]
:004641BD 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:004641C0 FF5214                  call [edx+14]
:004641C3 50                      push eax
:004641C4 FF15E8604800            call dword ptr [004860E8]
:004641CA 8945E0                  mov dword ptr [ebp-20], eax
:004641CD 8B45D8                  mov eax, dword ptr [ebp-28]
:004641D0 2B45E0                  sub eax, dword ptr [ebp-20]
:004641D3 8945D8                  mov dword ptr [ebp-28], eax
:004641D6 837DEC00                cmp dword ptr [ebp-14], 00000000
:004641DA 7509                    jne 004641E5
:004641DC 8B4DE0                  mov ecx, dword ptr [ebp-20]
:004641DF 034DD8                  add ecx, dword ptr [ebp-28]
:004641E2 894DE0                  mov dword ptr [ebp-20], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004641DA(C)
|
:004641E5 8B55E0                  mov edx, dword ptr [ebp-20]
:004641E8 81E2FFFF0000            and edx, 0000FFFF
:004641EE 52                      push edx
:004641EF 8B45EC                  mov eax, dword ptr [ebp-14]
:004641F2 50                      push eax
:004641F3 681E100000              push 0000101E
:004641F8 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:004641FB 8B5110                  mov edx, dword ptr [ecx+10]
:004641FE 52                      push edx
:004641FF FF15F4624800            call dword ptr [004862F4]
:00464205 EB93                    jmp 0046419A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004641A7(C)
|
:00464207 8D45F0                  lea eax, dword ptr [ebp-10]
:0046420A 50                      push eax
:0046420B 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0046420E 8B5110                  mov edx, dword ptr [ecx+10]
:00464211 52                      push edx
:00464212 FF15EC624800            call dword ptr [004862EC]
:00464218 8B45E4                  mov eax, dword ptr [ebp-1C]
:0046421B 0345E8                  add eax, dword ptr [ebp-18]
:0046421E 8945E4                  mov dword ptr [ebp-1C], eax
:00464221 E945FFFFFF              jmp 0046416B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046417B(C)
|
:00464226 6A05                    push 00000005
:00464228 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0046422B 8B5110                  mov edx, dword ptr [ecx+10]
:0046422E 52                      push edx
:0046422F FF15E0624800            call dword ptr [004862E0]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464156(C)
|
:00464235 8BE5                    mov esp, ebp
:00464237 5D                      pop ebp
:00464238 C3                      ret



* Referenced by a CALL at Addresses:
|:00464418   , :004644F5   , :004647BF   , :004649D0   
|
:00464239 55                      push ebp
:0046423A 8BEC                    mov ebp, esp
:0046423C 83EC18                  sub esp, 00000018
:0046423F 894DEC                  mov dword ptr [ebp-14], ecx
:00464242 6A00                    push 00000000
:00464244 6A00                    push 00000000
:00464246 6804100000              push 00001004
:0046424B 8B45EC                  mov eax, dword ptr [ebp-14]
:0046424E 8B4810                  mov ecx, dword ptr [eax+10]
:00464251 51                      push ecx
:00464252 FF15F4624800            call dword ptr [004862F4]
:00464258 8945F4                  mov dword ptr [ebp-0C], eax
:0046425B C745F800000000          mov [ebp-08], 00000000
:00464262 837DF400                cmp dword ptr [ebp-0C], 00000000
:00464266 0F858A000000            jne 004642F6
:0046426C 8B55EC                  mov edx, dword ptr [ebp-14]
:0046426F 837A4C00                cmp dword ptr [edx+4C], 00000000
:00464273 7E73                    jle 004642E8
:00464275 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00464278 83C140                  add ecx, 00000040
:0046427B E830B5FEFF              call 0044F7B0
:00464280 8945F0                  mov dword ptr [ebp-10], eax
:00464283 8B45F0                  mov eax, dword ptr [ebp-10]
:00464286 50                      push eax
:00464287 FF1548634800            call dword ptr [00486348]
:0046428D 85C0                    test eax, eax
:0046428F 7524                    jne 004642B5
:00464291 8B4D08                  mov ecx, dword ptr [ebp+08]
:00464294 51                      push ecx
:00464295 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00464298 83C140                  add ecx, 00000040
:0046429B E810B5FEFF              call 0044F7B0
:004642A0 50                      push eax
:004642A1 FF15EC624800            call dword ptr [004862EC]
:004642A7 8B5508                  mov edx, dword ptr [ebp+08]
:004642AA 8B4508                  mov eax, dword ptr [ebp+08]
:004642AD 8B4804                  mov ecx, dword ptr [eax+04]
:004642B0 894A0C                  mov dword ptr [edx+0C], ecx
:004642B3 EB1A                    jmp 004642CF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046428F(C)
|
:004642B5 8B5508                  mov edx, dword ptr [ebp+08]
:004642B8 52                      push edx
:004642B9 8B45F0                  mov eax, dword ptr [ebp-10]
:004642BC 50                      push eax
:004642BD FF15EC624800            call dword ptr [004862EC]
:004642C3 8B4D08                  mov ecx, dword ptr [ebp+08]
:004642C6 8B5508                  mov edx, dword ptr [ebp+08]
:004642C9 8B420C                  mov eax, dword ptr [edx+0C]
:004642CC 894104                  mov dword ptr [ecx+04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004642B3(U)
|
:004642CF 8B4D08                  mov ecx, dword ptr [ebp+08]
:004642D2 8B510C                  mov edx, dword ptr [ecx+0C]
:004642D5 8B45EC                  mov eax, dword ptr [ebp-14]
:004642D8 03504C                  add edx, dword ptr [eax+4C]
:004642DB 8B4D08                  mov ecx, dword ptr [ebp+08]
:004642DE 89510C                  mov dword ptr [ecx+0C], edx
:004642E1 B801000000              mov eax, 00000001
:004642E6 EB7F                    jmp 00464367

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464273(C)
|
:004642E8 6A00                    push 00000000
:004642EA 6A00                    push 00000000
:004642EC 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004642EF E88FFAFFFF              call 00463D83
:004642F4 EB0B                    jmp 00464301

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464266(C)
|
:004642F6 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004642F9 E810FDFFFF              call 0046400E
:004642FE 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004642F4(U)
|
:00464301 837D0800                cmp dword ptr [ebp+08], 00000000
:00464305 7411                    je 00464318
:00464307 8B5508                  mov edx, dword ptr [ebp+08]
:0046430A C70200000000            mov dword ptr [edx], 00000000
:00464310 8B4508                  mov eax, dword ptr [ebp+08]
:00464313 8945E8                  mov dword ptr [ebp-18], eax
:00464316 EB07                    jmp 0046431F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464305(C)
|
:00464318 C745E800000000          mov [ebp-18], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464316(U)
|
:0046431F 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00464322 51                      push ecx
:00464323 8B55F8                  mov edx, dword ptr [ebp-08]
:00464326 52                      push edx
:00464327 680E100000              push 0000100E
:0046432C 8B45EC                  mov eax, dword ptr [ebp-14]
:0046432F 8B4810                  mov ecx, dword ptr [eax+10]
:00464332 51                      push ecx
:00464333 FF15F4624800            call dword ptr [004862F4]
:00464339 8945FC                  mov dword ptr [ebp-04], eax
:0046433C 837DFC00                cmp dword ptr [ebp-04], 00000000
:00464340 7412                    je 00464354
:00464342 8B5508                  mov edx, dword ptr [ebp+08]
:00464345 8B4508                  mov eax, dword ptr [ebp+08]
:00464348 8B4A0C                  mov ecx, dword ptr [edx+0C]
:0046434B 2B4804                  sub ecx, dword ptr [eax+04]
:0046434E 8B55EC                  mov edx, dword ptr [ebp-14]
:00464351 894A4C                  mov dword ptr [edx+4C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464340(C)
|
:00464354 837DF400                cmp dword ptr [ebp-0C], 00000000
:00464358 750A                    jne 00464364
:0046435A 6A00                    push 00000000
:0046435C 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0046435F E896FAFFFF              call 00463DFA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464358(C)
|
:00464364 8B45FC                  mov eax, dword ptr [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004642E6(U)
|
:00464367 8BE5                    mov esp, ebp
:00464369 5D                      pop ebp
:0046436A C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0041A92F   , :0047A612   
|
:0046436D 55                      push ebp
:0046436E 8BEC                    mov ebp, esp
:00464370 83EC0C                  sub esp, 0000000C
:00464373 894DF4                  mov dword ptr [ebp-0C], ecx
:00464376 8B45F4                  mov eax, dword ptr [ebp-0C]
:00464379 8B4810                  mov ecx, dword ptr [eax+10]
:0046437C 51                      push ecx
:0046437D FF1598624800            call dword ptr [00486298]
:00464383 8945FC                  mov dword ptr [ebp-04], eax
:00464386 6A00                    push 00000000
:00464388 6A00                    push 00000000
:0046438A 6A00                    push 00000000
:0046438C 6A48                    push 00000048
:0046438E 6A5A                    push 0000005A
:00464390 8B55FC                  mov edx, dword ptr [ebp-04]
:00464393 52                      push edx
:00464394 FF153C604800            call dword ptr [0048603C]
:0046439A 50                      push eax
:0046439B 6A09                    push 00000009
:0046439D FF15E8604800            call dword ptr [004860E8]
:004643A3 83C001                  add eax, 00000001
:004643A6 50                      push eax
:004643A7 6A01                    push 00000001
:004643A9 FF1500604800            call dword ptr [00486000]
:004643AF 8945F8                  mov dword ptr [ebp-08], eax
:004643B2 8B45F8                  mov eax, dword ptr [ebp-08]
:004643B5 50                      push eax
:004643B6 6A01                    push 00000001
:004643B8 6803100000              push 00001003
:004643BD 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004643C0 8B5110                  mov edx, dword ptr [ecx+10]
:004643C3 52                      push edx
:004643C4 FF15F4624800            call dword ptr [004862F4]
:004643CA 8B45FC                  mov eax, dword ptr [ebp-04]
:004643CD 50                      push eax
:004643CE 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004643D1 8B5110                  mov edx, dword ptr [ecx+10]
:004643D4 52                      push edx
:004643D5 FF159C624800            call dword ptr [0048629C]
:004643DB 8BE5                    mov esp, ebp
:004643DD 5D                      pop ebp
:004643DE C3                      ret



* Referenced by a CALL at Address:
|:0046EF29   
|
:004643DF 55                      push ebp
:004643E0 8BEC                    mov ebp, esp
:004643E2 83EC30                  sub esp, 00000030
:004643E5 894DD0                  mov dword ptr [ebp-30], ecx
:004643E8 6A00                    push 00000000
:004643EA 6A00                    push 00000000
:004643EC 8B45D0                  mov eax, dword ptr [ebp-30]
:004643EF 8B4810                  mov ecx, dword ptr [eax+10]
:004643F2 51                      push ecx
:004643F3 FF152C634800            call dword ptr [0048632C]
:004643F9 8D55E0                  lea edx, dword ptr [ebp-20]
:004643FC 52                      push edx
:004643FD 8B45D0                  mov eax, dword ptr [ebp-30]
:00464400 8B4810                  mov ecx, dword ptr [eax+10]
:00464403 51                      push ecx
:00464404 FF15EC624800            call dword ptr [004862EC]
:0046440A C745DC00000000          mov [ebp-24], 00000000
:00464411 8D55F0                  lea edx, dword ptr [ebp-10]
:00464414 52                      push edx
:00464415 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00464418 E81CFEFFFF              call 00464239
:0046441D 85C0                    test eax, eax
:0046441F 747C                    je 0046449D
:00464421 8B45FC                  mov eax, dword ptr [ebp-04]
:00464424 2B45F4                  sub eax, dword ptr [ebp-0C]
:00464427 8945D8                  mov dword ptr [ebp-28], eax
:0046442A 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0046442D 2B4DE4                  sub ecx, dword ptr [ebp-1C]
:00464430 894DD4                  mov dword ptr [ebp-2C], ecx
:00464433 837D0800                cmp dword ptr [ebp+08], 00000000
:00464437 7F1B                    jg 00464454
:00464439 8B45D4                  mov eax, dword ptr [ebp-2C]
:0046443C 2B45F4                  sub eax, dword ptr [ebp-0C]
:0046443F 99                      cdq
:00464440 F77DD8                  idiv [ebp-28]
:00464443 0FAF45D8                imul eax, dword ptr [ebp-28]
:00464447 8B55D4                  mov edx, dword ptr [ebp-2C]
:0046444A 2B55F4                  sub edx, dword ptr [ebp-0C]
:0046444D 2BC2                    sub eax, edx
:0046444F 8945DC                  mov dword ptr [ebp-24], eax
:00464452 EB12                    jmp 00464466

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464437(C)
|
:00464454 8B4508                  mov eax, dword ptr [ebp+08]
:00464457 0FAF45D8                imul eax, dword ptr [ebp-28]
:0046445B 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0046445E 2B4DF4                  sub ecx, dword ptr [ebp-0C]
:00464461 2BC1                    sub eax, ecx
:00464463 8945DC                  mov dword ptr [ebp-24], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464452(U)
|
:00464466 8D55E0                  lea edx, dword ptr [ebp-20]
:00464469 52                      push edx
:0046446A 8B45D0                  mov eax, dword ptr [ebp-30]
:0046446D 8B4810                  mov ecx, dword ptr [eax+10]
:00464470 51                      push ecx
:00464471 FF1598634800            call dword ptr [00486398]
:00464477 6A0E                    push 0000000E
:00464479 8B55EC                  mov edx, dword ptr [ebp-14]
:0046447C 2B55E4                  sub edx, dword ptr [ebp-1C]
:0046447F 0355DC                  add edx, dword ptr [ebp-24]
:00464482 52                      push edx
:00464483 8B45E8                  mov eax, dword ptr [ebp-18]
:00464486 2B45E0                  sub eax, dword ptr [ebp-20]
:00464489 50                      push eax
:0046448A 6A00                    push 00000000
:0046448C 6A00                    push 00000000
:0046448E 6A00                    push 00000000
:00464490 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00464493 8B5110                  mov edx, dword ptr [ecx+10]
:00464496 52                      push edx
:00464497 FF1580624800            call dword ptr [00486280]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046441F(C)
|
:0046449D 8B45DC                  mov eax, dword ptr [ebp-24]
:004644A0 8BE5                    mov esp, ebp
:004644A2 5D                      pop ebp
:004644A3 C20400                  ret 0004


:004644A6 55                      push ebp
:004644A7 8BEC                    mov ebp, esp
:004644A9 83EC34                  sub esp, 00000034
:004644AC 894DCC                  mov dword ptr [ebp-34], ecx
:004644AF 8D45E4                  lea eax, dword ptr [ebp-1C]
:004644B2 50                      push eax
:004644B3 FF1568624800            call dword ptr [00486268]
:004644B9 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004644BC 51                      push ecx
:004644BD 8B55E4                  mov edx, dword ptr [ebp-1C]
:004644C0 52                      push edx
:004644C1 FF1528634800            call dword ptr [00486328]
:004644C7 8B4DCC                  mov ecx, dword ptr [ebp-34]
:004644CA 3B4110                  cmp eax, dword ptr [ecx+10]
:004644CD 7405                    je 004644D4
:004644CF 83C8FF                  or eax, FFFFFFFF
:004644D2 EB5D                    jmp 00464531

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004644CD(C)
|
:004644D4 8D55E4                  lea edx, dword ptr [ebp-1C]
:004644D7 52                      push edx
:004644D8 8B45CC                  mov eax, dword ptr [ebp-34]
:004644DB 8B4810                  mov ecx, dword ptr [eax+10]
:004644DE 51                      push ecx
:004644DF FF1564624800            call dword ptr [00486264]
:004644E5 85C0                    test eax, eax
:004644E7 7505                    jne 004644EE
:004644E9 83C8FF                  or eax, FFFFFFFF
:004644EC EB43                    jmp 00464531

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004644E7(C)
|
:004644EE 8D55F0                  lea edx, dword ptr [ebp-10]
:004644F1 52                      push edx
:004644F2 8B4DCC                  mov ecx, dword ptr [ebp-34]
:004644F5 E83FFDFFFF              call 00464239
:004644FA 8B45E8                  mov eax, dword ptr [ebp-18]
:004644FD 3B45F4                  cmp eax, dword ptr [ebp-0C]
:00464500 7D05                    jge 00464507
:00464502 83C8FF                  or eax, FFFFFFFF
:00464505 EB2A                    jmp 00464531

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464500(C)
|
:00464507 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0046450A 894DD0                  mov dword ptr [ebp-30], ecx
:0046450D 8B55E8                  mov edx, dword ptr [ebp-18]
:00464510 8955D4                  mov dword ptr [ebp-2C], edx
:00464513 8D45D0                  lea eax, dword ptr [ebp-30]
:00464516 50                      push eax
:00464517 6A00                    push 00000000
:00464519 6812100000              push 00001012
:0046451E 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00464521 8B5110                  mov edx, dword ptr [ecx+10]
:00464524 52                      push edx
:00464525 FF15F4624800            call dword ptr [004862F4]
:0046452B 8945EC                  mov dword ptr [ebp-14], eax
:0046452E 8B45DC                  mov eax, dword ptr [ebp-24]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004644D2(U), :004644EC(U), :00464505(U)
|
:00464531 8BE5                    mov esp, ebp
:00464533 5D                      pop ebp
:00464534 C3                      ret



* Referenced by a CALL at Address:
|:00464FA8   
|
:00464535 55                      push ebp
:00464536 8BEC                    mov ebp, esp
:00464538 83EC08                  sub esp, 00000008
:0046453B 894DF8                  mov dword ptr [ebp-08], ecx
:0046453E C745FC00000000          mov [ebp-04], 00000000
:00464545 EB09                    jmp 00464550

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046457C(U)
|
:00464547 8B45FC                  mov eax, dword ptr [ebp-04]
:0046454A 83C001                  add eax, 00000001
:0046454D 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464545(U)
|
:00464550 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00464553 E8687EFBFF              call 0041C3C0
:00464558 3945FC                  cmp dword ptr [ebp-04], eax
:0046455B 7D21                    jge 0046457E
:0046455D 6A02                    push 00000002
:0046455F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00464562 51                      push ecx
:00464563 682C100000              push 0000102C
:00464568 8B55F8                  mov edx, dword ptr [ebp-08]
:0046456B 8B4210                  mov eax, dword ptr [edx+10]
:0046456E 50                      push eax
:0046456F FF15F4624800            call dword ptr [004862F4]
:00464575 83F802                  cmp eax, 00000002
:00464578 7502                    jne 0046457C
:0046457A EB02                    jmp 0046457E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464578(C)
|
:0046457C EBC9                    jmp 00464547

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046455B(C), :0046457A(U)
|
:0046457E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00464581 E83A7EFBFF              call 0041C3C0
:00464586 3945FC                  cmp dword ptr [ebp-04], eax
:00464589 7507                    jne 00464592
:0046458B C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464589(C)
|
:00464592 8B45FC                  mov eax, dword ptr [ebp-04]
:00464595 8BE5                    mov esp, ebp
:00464597 5D                      pop ebp
:00464598 C3                      ret



* Referenced by a CALL at Address:
|:004670C5   
|
:00464599 55                      push ebp
:0046459A 8BEC                    mov ebp, esp
:0046459C 83EC08                  sub esp, 00000008
:0046459F 894DF8                  mov dword ptr [ebp-08], ecx
:004645A2 6A02                    push 00000002
:004645A4 8B4508                  mov eax, dword ptr [ebp+08]
:004645A7 8B4808                  mov ecx, dword ptr [eax+08]
:004645AA 51                      push ecx
:004645AB 682C100000              push 0000102C
:004645B0 8B55F8                  mov edx, dword ptr [ebp-08]
:004645B3 8B4210                  mov eax, dword ptr [edx+10]
:004645B6 50                      push eax
:004645B7 FF15F4624800            call dword ptr [004862F4]
:004645BD 33C9                    xor ecx, ecx
:004645BF 83F802                  cmp eax, 00000002
:004645C2 0F94C1                  sete cl
:004645C5 894DFC                  mov dword ptr [ebp-04], ecx
:004645C8 837DFC00                cmp dword ptr [ebp-04], 00000000
:004645CC 7454                    je 00464622
:004645CE 8B5508                  mov edx, dword ptr [ebp+08]
:004645D1 8B4208                  mov eax, dword ptr [edx+08]
:004645D4 50                      push eax
:004645D5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004645D8 8B11                    mov edx, dword ptr [ecx]
:004645DA 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004645DD FF5220                  call [edx+20]
:004645E0 85C0                    test eax, eax
:004645E2 7420                    je 00464604
:004645E4 68FFFFFF00              push 00FFFFFF
:004645E9 8B4508                  mov eax, dword ptr [ebp+08]
:004645EC 8B4818                  mov ecx, dword ptr [eax+18]
:004645EF 51                      push ecx
:004645F0 FF1584604800            call dword ptr [00486084]
:004645F6 8B55F8                  mov edx, dword ptr [ebp-08]
:004645F9 8B45F8                  mov eax, dword ptr [ebp-08]
:004645FC 8B4838                  mov ecx, dword ptr [eax+38]
:004645FF 894A3C                  mov dword ptr [edx+3C], ecx
:00464602 EB1C                    jmp 00464620

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004645E2(C)
|
:00464604 6818000001              push 01000018
:00464609 8B5508                  mov edx, dword ptr [ebp+08]
:0046460C 8B4218                  mov eax, dword ptr [edx+18]
:0046460F 50                      push eax
:00464610 FF1584604800            call dword ptr [00486084]
:00464616 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00464619 C7413C14000001          mov [ecx+3C], 01000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464602(U)
|
:00464620 EB6A                    jmp 0046468C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004645CC(C)
|
:00464622 8B5508                  mov edx, dword ptr [ebp+08]
:00464625 8B4208                  mov eax, dword ptr [edx+08]
:00464628 50                      push eax
:00464629 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046462C 8B11                    mov edx, dword ptr [ecx]
:0046462E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00464631 FF5220                  call [edx+20]
:00464634 85C0                    test eax, eax
:00464636 7426                    je 0046465E
:00464638 8B4508                  mov eax, dword ptr [ebp+08]
:0046463B 8B4008                  mov eax, dword ptr [eax+08]
:0046463E 33D2                    xor edx, edx
:00464640 B902000000              mov ecx, 00000002
:00464645 F7F1                    div ecx
:00464647 8B45F8                  mov eax, dword ptr [ebp-08]
:0046464A 8B4C9030                mov ecx, dword ptr [eax+4*edx+30]
:0046464E 51                      push ecx
:0046464F 8B5508                  mov edx, dword ptr [ebp+08]
:00464652 8B4218                  mov eax, dword ptr [edx+18]
:00464655 50                      push eax
:00464656 FF1584604800            call dword ptr [00486084]
:0046465C EB12                    jmp 00464670

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464636(C)
|
:0046465E 6818000001              push 01000018
:00464663 8B4D08                  mov ecx, dword ptr [ebp+08]
:00464666 8B5118                  mov edx, dword ptr [ecx+18]
:00464669 52                      push edx
:0046466A FF1584604800            call dword ptr [00486084]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046465C(U)
|
:00464670 8B4508                  mov eax, dword ptr [ebp+08]
:00464673 8B4008                  mov eax, dword ptr [eax+08]
:00464676 33D2                    xor edx, edx
:00464678 B902000000              mov ecx, 00000002
:0046467D F7F1                    div ecx
:0046467F 8B45F8                  mov eax, dword ptr [ebp-08]
:00464682 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00464685 8B549128                mov edx, dword ptr [ecx+4*edx+28]
:00464689 89503C                  mov dword ptr [eax+3C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464620(U)
|
:0046468C 8B45F8                  mov eax, dword ptr [ebp-08]
:0046468F 8B483C                  mov ecx, dword ptr [eax+3C]
:00464692 51                      push ecx
:00464693 8B5508                  mov edx, dword ptr [ebp+08]
:00464696 8B4208                  mov eax, dword ptr [edx+08]
:00464699 50                      push eax
:0046469A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046469D 8B5118                  mov edx, dword ptr [ecx+18]
:004646A0 52                      push edx
:004646A1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004646A4 E806000000              call 004646AF
:004646A9 8BE5                    mov esp, ebp
:004646AB 5D                      pop ebp
:004646AC C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:004646A4   , :00464A37   
|
:004646AF 55                      push ebp
:004646B0 8BEC                    mov ebp, esp
:004646B2 83EC44                  sub esp, 00000044
:004646B5 894DBC                  mov dword ptr [ebp-44], ecx
:004646B8 33C0                    xor eax, eax
:004646BA A050604B00              mov al, byte ptr [004B6050]
:004646BF 83E001                  and eax, 00000001
:004646C2 85C0                    test eax, eax
:004646C4 7554                    jne 0046471A
:004646C6 8A0D50604B00            mov cl, byte ptr [004B6050]
:004646CC 80C901                  or cl, 01
:004646CF 880D50604B00            mov byte ptr [004B6050], cl
:004646D5 6A05                    push 00000005
:004646D7 6A02                    push 00000002
:004646D9 B968614B00              mov ecx, 004B6168
:004646DE E89F65FAFF              call 0040AC82
:004646E3 6A05                    push 00000005
:004646E5 6A02                    push 00000002
:004646E7 B974624B00              mov ecx, 004B6274
:004646EC E89165FAFF              call 0040AC82
:004646F1 6A05                    push 00000005
:004646F3 6A02                    push 00000002
:004646F5 B980634B00              mov ecx, 004B6380
:004646FA E88365FAFF              call 0040AC82
:004646FF 6A05                    push 00000005
:00464701 6A02                    push 00000002
:00464703 B98C644B00              mov ecx, 004B648C
:00464708 E87565FAFF              call 0040AC82

* Possible StringData Ref from Code Obj ->"Uh@"
                                  |
:0046470D 6894494600              push 00464994
:00464712 E8E9C90100              call 00481100
:00464717 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004646C4(C)
|
:0046471A 8B55BC                  mov edx, dword ptr [ebp-44]
:0046471D 8B4510                  mov eax, dword ptr [ebp+10]
:00464720 3B4228                  cmp eax, dword ptr [edx+28]
:00464723 7509                    jne 0046472E
:00464725 C745C468614B00          mov [ebp-3C], 004B6168
:0046472C EB2D                    jmp 0046475B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464723(C)
|
:0046472E 8B4DBC                  mov ecx, dword ptr [ebp-44]
:00464731 8B5510                  mov edx, dword ptr [ebp+10]
:00464734 3B512C                  cmp edx, dword ptr [ecx+2C]
:00464737 7509                    jne 00464742
:00464739 C745C474624B00          mov [ebp-3C], 004B6274
:00464740 EB19                    jmp 0046475B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464737(C)
|
:00464742 817D10AA000001          cmp dword ptr [ebp+10], 010000AA
:00464749 7509                    jne 00464754
:0046474B C745C480634B00          mov [ebp-3C], 004B6380
:00464752 EB07                    jmp 0046475B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464749(C)
|
:00464754 C745C48C644B00          mov [ebp-3C], 004B648C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046472C(U), :00464740(U), :00464752(U)
|
:0046475B 8B45BC                  mov eax, dword ptr [ebp-44]
:0046475E 8B480C                  mov ecx, dword ptr [eax+0C]
:00464761 894DE0                  mov dword ptr [ebp-20], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464789(U)
|
:00464764 6AF0                    push FFFFFFF0
:00464766 8B55E0                  mov edx, dword ptr [ebp-20]
:00464769 52                      push edx
:0046476A FF15A0634800            call dword ptr [004863A0]
:00464770 2500000040              and eax, 40000000
:00464775 3D00000040              cmp eax, 40000000
:0046477A 750F                    jne 0046478B
:0046477C 8B45E0                  mov eax, dword ptr [ebp-20]
:0046477F 50                      push eax
:00464780 FF159C634800            call dword ptr [0048639C]
:00464786 8945E0                  mov dword ptr [ebp-20], eax
:00464789 EBD9                    jmp 00464764

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046477A(C)
|
:0046478B C745CC00000000          mov [ebp-34], 00000000
:00464792 C745D000000000          mov [ebp-30], 00000000
:00464799 8D4DCC                  lea ecx, dword ptr [ebp-34]
:0046479C 51                      push ecx
:0046479D 8B55BC                  mov edx, dword ptr [ebp-44]
:004647A0 8B4210                  mov eax, dword ptr [edx+10]
:004647A3 50                      push eax
:004647A4 FF1520634800            call dword ptr [00486320]
:004647AA 8D4DCC                  lea ecx, dword ptr [ebp-34]
:004647AD 51                      push ecx
:004647AE 8B55E0                  mov edx, dword ptr [ebp-20]
:004647B1 52                      push edx
:004647B2 FF1564624800            call dword ptr [00486264]
:004647B8 8D45E4                  lea eax, dword ptr [ebp-1C]
:004647BB 50                      push eax
:004647BC 8B4DBC                  mov ecx, dword ptr [ebp-44]
:004647BF E875FAFFFF              call 00464239
:004647C4 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004647C7 2B4DE8                  sub ecx, dword ptr [ebp-18]
:004647CA 894DD8                  mov dword ptr [ebp-28], ecx
:004647CD 8B4DBC                  mov ecx, dword ptr [ebp-44]
:004647D0 E839F8FFFF              call 0046400E
:004647D5 8945D4                  mov dword ptr [ebp-2C], eax
:004647D8 8B55D4                  mov edx, dword ptr [ebp-2C]
:004647DB 3B550C                  cmp edx, dword ptr [ebp+0C]
:004647DE 7F7E                    jg 0046485E
:004647E0 8B450C                  mov eax, dword ptr [ebp+0C]
:004647E3 2B45D4                  sub eax, dword ptr [ebp-2C]
:004647E6 8B4DD8                  mov ecx, dword ptr [ebp-28]
:004647E9 0FAFC8                  imul ecx, eax
:004647EC 8B55E8                  mov edx, dword ptr [ebp-18]
:004647EF 03D1                    add edx, ecx
:004647F1 8955E8                  mov dword ptr [ebp-18], edx
:004647F4 8B450C                  mov eax, dword ptr [ebp+0C]
:004647F7 2B45D4                  sub eax, dword ptr [ebp-2C]
:004647FA 8B4DD8                  mov ecx, dword ptr [ebp-28]
:004647FD 0FAFC8                  imul ecx, eax
:00464800 8B55F0                  mov edx, dword ptr [ebp-10]
:00464803 03D1                    add edx, ecx
:00464805 8955F0                  mov dword ptr [ebp-10], edx
:00464808 8B45D8                  mov eax, dword ptr [ebp-28]
:0046480B 0FAF45D4                imul eax, dword ptr [ebp-2C]
:0046480F 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00464812 03C8                    add ecx, eax
:00464814 894DD0                  mov dword ptr [ebp-30], ecx
:00464817 6A00                    push 00000000
:00464819 8D55CC                  lea edx, dword ptr [ebp-34]
:0046481C 52                      push edx
:0046481D 8D45E4                  lea eax, dword ptr [ebp-1C]
:00464820 50                      push eax
:00464821 8B4D10                  mov ecx, dword ptr [ebp+10]
:00464824 51                      push ecx
:00464825 8B5508                  mov edx, dword ptr [ebp+08]
:00464828 52                      push edx
:00464829 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:0046482C E8F664FAFF              call 0040AD27
:00464831 85C0                    test eax, eax
:00464833 7529                    jne 0046485E
:00464835 8B4510                  mov eax, dword ptr [ebp+10]
:00464838 50                      push eax
:00464839 FF1568604800            call dword ptr [00486068]
:0046483F 8945C0                  mov dword ptr [ebp-40], eax
:00464842 8B4DC0                  mov ecx, dword ptr [ebp-40]
:00464845 51                      push ecx
:00464846 8D55E4                  lea edx, dword ptr [ebp-1C]
:00464849 52                      push edx
:0046484A 8B4508                  mov eax, dword ptr [ebp+08]
:0046484D 50                      push eax
:0046484E FF15F0624800            call dword ptr [004862F0]
:00464854 8B4DC0                  mov ecx, dword ptr [ebp-40]
:00464857 51                      push ecx
:00464858 FF1548604800            call dword ptr [00486048]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004647DE(C), :00464833(C)
|
:0046485E 68FFFFFF00              push 00FFFFFF
:00464863 6A01                    push 00000001
:00464865 6A00                    push 00000000
:00464867 FF15C8604800            call dword ptr [004860C8]
:0046486D 8945FC                  mov dword ptr [ebp-04], eax
:00464870 817D1015000001          cmp dword ptr [ebp+10], 01000015
:00464877 7514                    jne 0046488D
:00464879 68A0A0A400              push 00A4A0A0
:0046487E 6A01                    push 00000001
:00464880 6A00                    push 00000000
:00464882 FF15C8604800            call dword ptr [004860C8]
:00464888 8945F4                  mov dword ptr [ebp-0C], eax
:0046488B EB12                    jmp 0046489F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464877(C)
|
:0046488D 68C0C0C000              push 00C0C0C0
:00464892 6A01                    push 00000001
:00464894 6A00                    push 00000000
:00464896 FF15C8604800            call dword ptr [004860C8]
:0046489C 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046488B(U)
|
:0046489F 8B55F4                  mov edx, dword ptr [ebp-0C]
:004648A2 52                      push edx
:004648A3 8B4508                  mov eax, dword ptr [ebp+08]
:004648A6 50                      push eax
:004648A7 FF156C604800            call dword ptr [0048606C]
:004648AD 8945C8                  mov dword ptr [ebp-38], eax
:004648B0 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004648B3 894DDC                  mov dword ptr [ebp-24], ecx
:004648B6 C745F800000000          mov [ebp-08], 00000000
:004648BD EB09                    jmp 004648C8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464967(U)
|
:004648BF 8B55F8                  mov edx, dword ptr [ebp-08]
:004648C2 83C201                  add edx, 00000001
:004648C5 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004648BD(U)
|
:004648C8 8B45BC                  mov eax, dword ptr [ebp-44]
:004648CB 33C9                    xor ecx, ecx
:004648CD 8A4814                  mov cl, byte ptr [eax+14]
:004648D0 394DF8                  cmp dword ptr [ebp-08], ecx
:004648D3 0F8D93000000            jnl 0046496C
:004648D9 8B55FC                  mov edx, dword ptr [ebp-04]
:004648DC 52                      push edx
:004648DD 8B4508                  mov eax, dword ptr [ebp+08]
:004648E0 50                      push eax
:004648E1 FF156C604800            call dword ptr [0048606C]
:004648E7 6A00                    push 00000000
:004648E9 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004648EC 51                      push ecx
:004648ED 8B55DC                  mov edx, dword ptr [ebp-24]
:004648F0 52                      push edx
:004648F1 8B4508                  mov eax, dword ptr [ebp+08]
:004648F4 50                      push eax
:004648F5 FF15CC604800            call dword ptr [004860CC]
:004648FB 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004648FE 51                      push ecx
:004648FF 8B55DC                  mov edx, dword ptr [ebp-24]
:00464902 52                      push edx
:00464903 8B4508                  mov eax, dword ptr [ebp+08]
:00464906 50                      push eax
:00464907 FF15C4604800            call dword ptr [004860C4]
:0046490D 6A00                    push 00000000
:0046490F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00464912 51                      push ecx
:00464913 681D100000              push 0000101D
:00464918 8B55BC                  mov edx, dword ptr [ebp-44]
:0046491B 8B4210                  mov eax, dword ptr [edx+10]
:0046491E 50                      push eax
:0046491F FF15F4624800            call dword ptr [004862F4]
:00464925 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00464928 03C8                    add ecx, eax
:0046492A 894DDC                  mov dword ptr [ebp-24], ecx
:0046492D 8B55F4                  mov edx, dword ptr [ebp-0C]
:00464930 52                      push edx
:00464931 8B4508                  mov eax, dword ptr [ebp+08]
:00464934 50                      push eax
:00464935 FF156C604800            call dword ptr [0048606C]
:0046493B 6A00                    push 00000000
:0046493D 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00464940 51                      push ecx
:00464941 8B55DC                  mov edx, dword ptr [ebp-24]
:00464944 83EA01                  sub edx, 00000001
:00464947 52                      push edx
:00464948 8B4508                  mov eax, dword ptr [ebp+08]
:0046494B 50                      push eax
:0046494C FF15CC604800            call dword ptr [004860CC]
:00464952 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00464955 51                      push ecx
:00464956 8B55DC                  mov edx, dword ptr [ebp-24]
:00464959 83EA01                  sub edx, 00000001
:0046495C 52                      push edx
:0046495D 8B4508                  mov eax, dword ptr [ebp+08]
:00464960 50                      push eax
:00464961 FF15C4604800            call dword ptr [004860C4]
:00464967 E953FFFFFF              jmp 004648BF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004648D3(C)
|
:0046496C 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0046496F 51                      push ecx
:00464970 8B5508                  mov edx, dword ptr [ebp+08]
:00464973 52                      push edx
:00464974 FF156C604800            call dword ptr [0048606C]
:0046497A 8B45FC                  mov eax, dword ptr [ebp-04]
:0046497D 50                      push eax
:0046497E FF1548604800            call dword ptr [00486048]
:00464984 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00464987 51                      push ecx
:00464988 FF1548604800            call dword ptr [00486048]
:0046498E 8BE5                    mov esp, ebp
:00464990 5D                      pop ebp
:00464991 C20C00                  ret 000C


:00464994 55                      push ebp
:00464995 8BEC                    mov ebp, esp

* Possible StringData Ref from Code Obj ->"UjhOH"
                                  |
:00464997 68BCAC4000              push 0040ACBC
:0046499C 6A04                    push 00000004
:0046499E 680C010000              push 0000010C
:004649A3 6868614B00              push 004B6168
:004649A8 E833CB0100              call 004814E0
:004649AD 5D                      pop ebp
:004649AE C3                      ret



* Referenced by a CALL at Address:
|:00465215   
|
:004649AF 55                      push ebp
:004649B0 8BEC                    mov ebp, esp
:004649B2 83EC30                  sub esp, 00000030
:004649B5 894DD0                  mov dword ptr [ebp-30], ecx
:004649B8 8D45D4                  lea eax, dword ptr [ebp-2C]
:004649BB 50                      push eax
:004649BC 8B4DD0                  mov ecx, dword ptr [ebp-30]
:004649BF 8B5110                  mov edx, dword ptr [ecx+10]
:004649C2 52                      push edx
:004649C3 FF15EC624800            call dword ptr [004862EC]
:004649C9 8D45F0                  lea eax, dword ptr [ebp-10]
:004649CC 50                      push eax
:004649CD 8B4DD0                  mov ecx, dword ptr [ebp-30]
:004649D0 E864F8FFFF              call 00464239
:004649D5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004649D8 2B4DF4                  sub ecx, dword ptr [ebp-0C]
:004649DB 894DEC                  mov dword ptr [ebp-14], ecx
:004649DE 8B4DD0                  mov ecx, dword ptr [ebp-30]
:004649E1 E828F6FFFF              call 0046400E
:004649E6 8945E8                  mov dword ptr [ebp-18], eax
:004649E9 8B55E0                  mov edx, dword ptr [ebp-20]
:004649EC 2B55F4                  sub edx, dword ptr [ebp-0C]
:004649EF 8B45EC                  mov eax, dword ptr [ebp-14]
:004649F2 8D4402FF                lea eax, dword ptr [edx+eax-01]
:004649F6 99                      cdq
:004649F7 F77DEC                  idiv [ebp-14]
:004649FA 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004649FD 03C8                    add ecx, eax
:004649FF 894DE4                  mov dword ptr [ebp-1C], ecx
:00464A02 EB09                    jmp 00464A0D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464A3C(U)
|
:00464A04 8B55E8                  mov edx, dword ptr [ebp-18]
:00464A07 83C201                  add edx, 00000001
:00464A0A 8955E8                  mov dword ptr [ebp-18], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464A02(U)
|
:00464A0D 8B45E8                  mov eax, dword ptr [ebp-18]
:00464A10 3B45E4                  cmp eax, dword ptr [ebp-1C]
:00464A13 7D29                    jge 00464A3E
:00464A15 8B45E8                  mov eax, dword ptr [ebp-18]
:00464A18 99                      cdq
:00464A19 33C2                    xor eax, edx
:00464A1B 2BC2                    sub eax, edx
:00464A1D 83E001                  and eax, 00000001
:00464A20 33C2                    xor eax, edx
:00464A22 2BC2                    sub eax, edx
:00464A24 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00464A27 8B548128                mov edx, dword ptr [ecx+4*eax+28]
:00464A2B 52                      push edx
:00464A2C 8B45E8                  mov eax, dword ptr [ebp-18]
:00464A2F 50                      push eax
:00464A30 8B4D08                  mov ecx, dword ptr [ebp+08]
:00464A33 51                      push ecx
:00464A34 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00464A37 E873FCFFFF              call 004646AF
:00464A3C EBC6                    jmp 00464A04

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464A13(C)
|
:00464A3E 8BE5                    mov esp, ebp
:00464A40 5D                      pop ebp
:00464A41 C20400                  ret 0004



* Referenced by a CALL at Address:
|:00464B60   
|
:00464A44 55                      push ebp
:00464A45 8BEC                    mov ebp, esp
:00464A47 83EC10                  sub esp, 00000010
:00464A4A 894DF0                  mov dword ptr [ebp-10], ecx
:00464A4D C745F400000000          mov [ebp-0C], 00000000
:00464A54 C745F800000000          mov [ebp-08], 00000000
:00464A5B 8B45F8                  mov eax, dword ptr [ebp-08]
:00464A5E 50                      push eax
:00464A5F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00464A62 51                      push ecx
:00464A63 8B55F0                  mov edx, dword ptr [ebp-10]
:00464A66 8B4210                  mov eax, dword ptr [edx+10]
:00464A69 50                      push eax
:00464A6A FF1524634800            call dword ptr [00486324]
:00464A70 8945FC                  mov dword ptr [ebp-04], eax
:00464A73 837DFC00                cmp dword ptr [ebp-04], 00000000
:00464A77 741A                    je 00464A93
:00464A79 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00464A7C 8B55FC                  mov edx, dword ptr [ebp-04]
:00464A7F 3B5110                  cmp edx, dword ptr [ecx+10]
:00464A82 740F                    je 00464A93
:00464A84 8B45FC                  mov eax, dword ptr [ebp-04]
:00464A87 50                      push eax
:00464A88 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00464A8B 83C140                  add ecx, 00000040
:00464A8E E877DDFFFF              call 0046280A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00464A77(C), :00464A82(C)
|
:00464A93 8BE5                    mov esp, ebp
:00464A95 5D                      pop ebp
:00464A96 C3                      ret



* Referenced by a CALL at Addresses:
|:00478663   , :0047867F   
|
:00464A97 55                      push ebp
:00464A98 8BEC                    mov ebp, esp
:00464A9A 83EC18                  sub esp, 00000018
:00464A9D 894DF0                  mov dword ptr [ebp-10], ecx
:00464AA0 8B450C                  mov eax, dword ptr [ebp+0C]
:00464AA3 8945EC                  mov dword ptr [ebp-14], eax
:00464AA6 837DEC2B                cmp dword ptr [ebp-14], 0000002B
:00464AAA 7719                    ja 00464AC5
:00464AAC 837DEC2B                cmp dword ptr [ebp-14], 0000002B
:00464AB0 0F8410010000            je 00464BC6
:00464AB6 837DEC02                cmp dword ptr [ebp-14], 00000002
:00464ABA 0F84F6000000            je 00464BB6
:00464AC0 E95E020000              jmp 00464D23

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464AAA(C)
|
:00464AC5 817DEC10010000          cmp dword ptr [ebp-14], 00000110
:00464ACC 7718                    ja 00464AE6
:00464ACE 817DEC10010000          cmp dword ptr [ebp-14], 00000110
:00464AD5 7463                    je 00464B3A
:00464AD7 837DEC4E                cmp dword ptr [ebp-14], 0000004E
:00464ADB 0F84B3010000            je 00464C94
:00464AE1 E93D020000              jmp 00464D23

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464ACC(C)
|
:00464AE6 817DEC0F030000          cmp dword ptr [ebp-14], 0000030F
:00464AED 7739                    ja 00464B28
:00464AEF 817DEC0F030000          cmp dword ptr [ebp-14], 0000030F
:00464AF6 0F841F010000            je 00464C1B
:00464AFC 817DEC35010000          cmp dword ptr [ebp-14], 00000135
:00464B03 0F8457010000            je 00464C60
:00464B09 817DEC36010000          cmp dword ptr [ebp-14], 00000136
:00464B10 0F8465010000            je 00464C7B
:00464B16 817DEC38010000          cmp dword ptr [ebp-14], 00000138
:00464B1D 0F8424010000            je 00464C47
:00464B23 E9FB010000              jmp 00464D23

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464AED(C)
|
:00464B28 817DEC11030000          cmp dword ptr [ebp-14], 00000311
:00464B2F 0F84FA000000            je 00464C2F
:00464B35 E9E9010000              jmp 00464D23

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464AD5(C)
|
:00464B3A 8B4D08                  mov ecx, dword ptr [ebp+08]
:00464B3D 51                      push ecx
:00464B3E 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00464B41 E83ADD0000              call 00472880
:00464B46 8B5514                  mov edx, dword ptr [ebp+14]
:00464B49 52                      push edx
:00464B4A 8B4508                  mov eax, dword ptr [ebp+08]
:00464B4D 50                      push eax
:00464B4E FF15DC624800            call dword ptr [004862DC]
:00464B54 50                      push eax
:00464B55 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00464B58 E843DD0000              call 004728A0
:00464B5D 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00464B60 E8DFFEFFFF              call 00464A44
:00464B65 6813000001              push 01000013
:00464B6A 6A00                    push 00000000
:00464B6C 6801100000              push 00001001
:00464B71 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00464B74 8B5110                  mov edx, dword ptr [ecx+10]
:00464B77 52                      push edx
:00464B78 FF15F4624800            call dword ptr [004862F4]
:00464B7E 8B45F0                  mov eax, dword ptr [ebp-10]
:00464B81 8B4810                  mov ecx, dword ptr [eax+10]
:00464B84 51                      push ecx
:00464B85 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00464B88 E87DDCFFFF              call 0046280A
:00464B8D 8B55F0                  mov edx, dword ptr [ebp-10]
:00464B90 8B02                    mov eax, dword ptr [edx]
:00464B92 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00464B95 FF5028                  call [eax+28]
:00464B98 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00464B9B 83C140                  add ecx, 00000040
:00464B9E E834EEFFFF              call 004639D7
:00464BA3 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00464BA6 8B5510                  mov edx, dword ptr [ebp+10]
:00464BA9 33C0                    xor eax, eax
:00464BAB 3B5110                  cmp edx, dword ptr [ecx+10]
:00464BAE 0F94C0                  sete al
:00464BB1 E96F010000              jmp 00464D25

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464ABA(C)
|
:00464BB6 8B45F0                  mov eax, dword ptr [ebp-10]
:00464BB9 8B10                    mov edx, dword ptr [eax]
:00464BBB 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00464BBE FF5244                  call [edx+44]
:00464BC1 E95D010000              jmp 00464D23

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464AB0(C)
|
:00464BC6 8B4514                  mov eax, dword ptr [ebp+14]
:00464BC9 8945F8                  mov dword ptr [ebp-08], eax
:00464BCC 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00464BCF 8B55F8                  mov edx, dword ptr [ebp-08]
:00464BD2 8B4110                  mov eax, dword ptr [ecx+10]
:00464BD5 3B4214                  cmp eax, dword ptr [edx+14]
:00464BD8 752C                    jne 00464C06
:00464BDA 6A01                    push 00000001
:00464BDC 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00464BDF 8B5118                  mov edx, dword ptr [ecx+18]
:00464BE2 52                      push edx
:00464BE3 B9082E4900              mov ecx, 00492E08
:00464BE8 E85369FAFF              call 0040B540
:00464BED 8B45F8                  mov eax, dword ptr [ebp-08]
:00464BF0 50                      push eax
:00464BF1 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00464BF4 8B11                    mov edx, dword ptr [ecx]
:00464BF6 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00464BF9 FF522C                  call [edx+2C]
:00464BFC B801000000              mov eax, 00000001
:00464C01 E91F010000              jmp 00464D25

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464BD8(C)
|
:00464C06 6A00                    push 00000000
:00464C08 6A01                    push 00000001
:00464C0A 8B4514                  mov eax, dword ptr [ebp+14]
:00464C0D 50                      push eax
:00464C0E E8CBD30000              call 00471FDE
:00464C13 83C40C                  add esp, 0000000C
:00464C16 E90A010000              jmp 00464D25

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464AF6(C)
|
:00464C1B 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00464C1E 8B510C                  mov edx, dword ptr [ecx+0C]
:00464C21 52                      push edx
:00464C22 E804D90000              call 0047252B
:00464C27 83C404                  add esp, 00000004
:00464C2A E9F4000000              jmp 00464D23

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464B2F(C)
|
:00464C2F 8B4510                  mov eax, dword ptr [ebp+10]
:00464C32 50                      push eax
:00464C33 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00464C36 8B510C                  mov edx, dword ptr [ecx+0C]
:00464C39 52                      push edx
:00464C3A E83FD90000              call 0047257E
:00464C3F 83C408                  add esp, 00000008
:00464C42 E9DC000000              jmp 00464D23

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464B1D(C)
|
:00464C47 6A00                    push 00000000
:00464C49 6A01                    push 00000001
:00464C4B 8B4514                  mov eax, dword ptr [ebp+14]
:00464C4E 50                      push eax
:00464C4F 8B4D10                  mov ecx, dword ptr [ebp+10]
:00464C52 51                      push ecx
:00464C53 E833C90000              call 0047158B
:00464C58 83C410                  add esp, 00000010
:00464C5B E9C3000000              jmp 00464D23

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464B03(C)
|
:00464C60 6A00                    push 00000000
:00464C62 6A00                    push 00000000
:00464C64 6A01                    push 00000001
:00464C66 8B5514                  mov edx, dword ptr [ebp+14]
:00464C69 52                      push edx
:00464C6A 8B4510                  mov eax, dword ptr [ebp+10]
:00464C6D 50                      push eax
:00464C6E E80ECD0000              call 00471981
:00464C73 83C414                  add esp, 00000014
:00464C76 E9A8000000              jmp 00464D23

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464B10(C)
|
:00464C7B 6A00                    push 00000000
:00464C7D 6A01                    push 00000001
:00464C7F 8B4D14                  mov ecx, dword ptr [ebp+14]
:00464C82 51                      push ecx
:00464C83 8B5510                  mov edx, dword ptr [ebp+10]
:00464C86 52                      push edx
:00464C87 E8FFC50000              call 0047128B
:00464C8C 83C410                  add esp, 00000010
:00464C8F E98F000000              jmp 00464D23

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464ADB(C)
|
:00464C94 8B4514                  mov eax, dword ptr [ebp+14]
:00464C97 8945FC                  mov dword ptr [ebp-04], eax
:00464C9A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00464C9D 8B55F0                  mov edx, dword ptr [ebp-10]
:00464CA0 8B01                    mov eax, dword ptr [ecx]
:00464CA2 3B4210                  cmp eax, dword ptr [edx+10]
:00464CA5 757C                    jne 00464D23
:00464CA7 8B4D14                  mov ecx, dword ptr [ebp+14]
:00464CAA 894DF4                  mov dword ptr [ebp-0C], ecx
:00464CAD 8B55FC                  mov edx, dword ptr [ebp-04]
:00464CB0 8B4208                  mov eax, dword ptr [edx+08]
:00464CB3 8945E8                  mov dword ptr [ebp-18], eax
:00464CB6 837DE894                cmp dword ptr [ebp-18], FFFFFF94
:00464CBA 740E                    je 00464CCA
:00464CBC 837DE89B                cmp dword ptr [ebp-18], FFFFFF9B
:00464CC0 741C                    je 00464CDE
:00464CC2 837DE8F8                cmp dword ptr [ebp-18], FFFFFFF8
:00464CC6 7449                    je 00464D11
:00464CC8 EB52                    jmp 00464D1C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464CBA(C)
|
:00464CCA 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00464CCD 8B5110                  mov edx, dword ptr [ecx+10]
:00464CD0 52                      push edx
:00464CD1 8B45F0                  mov eax, dword ptr [ebp-10]
:00464CD4 8B10                    mov edx, dword ptr [eax]
:00464CD6 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00464CD9 FF523C                  call [edx+3C]
:00464CDC EB3E                    jmp 00464D1C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464CC0(C)
|
:00464CDE 6A01                    push 00000001
:00464CE0 8B45F4                  mov eax, dword ptr [ebp-0C]
:00464CE3 8B480C                  mov ecx, dword ptr [eax+0C]
:00464CE6 51                      push ecx
:00464CE7 682C100000              push 0000102C
:00464CEC 8B55FC                  mov edx, dword ptr [ebp-04]
:00464CEF 8B02                    mov eax, dword ptr [edx]
:00464CF1 50                      push eax
:00464CF2 FF15F4624800            call dword ptr [004862F4]
:00464CF8 83F801                  cmp eax, 00000001
:00464CFB 7512                    jne 00464D0F
:00464CFD 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00464D00 8B510C                  mov edx, dword ptr [ecx+0C]
:00464D03 52                      push edx
:00464D04 8B45F0                  mov eax, dword ptr [ebp-10]
:00464D07 8B10                    mov edx, dword ptr [eax]
:00464D09 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00464D0C FF5230                  call [edx+30]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464CFB(C)
|
:00464D0F EB0B                    jmp 00464D1C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464CC6(C)
|
:00464D11 8B45F0                  mov eax, dword ptr [ebp-10]
:00464D14 8B10                    mov edx, dword ptr [eax]
:00464D16 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00464D19 FF5240                  call [edx+40]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00464CC8(U), :00464CDC(U), :00464D0F(U)
|
:00464D1C B801000000              mov eax, 00000001
:00464D21 EB02                    jmp 00464D25

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00464AC0(U), :00464AE1(U), :00464B23(U), :00464B35(U), :00464BC1(U)
|:00464C2A(U), :00464C42(U), :00464C5B(U), :00464C76(U), :00464C8F(U)
|:00464CA5(C)
|
:00464D23 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00464BB1(U), :00464C01(U), :00464C16(U), :00464D21(U)
|
:00464D25 8BE5                    mov esp, ebp
:00464D27 5D                      pop ebp
:00464D28 C21000                  ret 0010



* Referenced by a CALL at Addresses:
|:004659EF   , :00465E34   , :00467FC7   , :00468823   , :00468BC0   
|:0046B3BC   , :0046BC72   , :00479D90   
|
:00464D2B 55                      push ebp
:00464D2C 8BEC                    mov ebp, esp
:00464D2E 51                      push ecx
:00464D2F 894DFC                  mov dword ptr [ebp-04], ecx
:00464D32 837D0C00                cmp dword ptr [ebp+0C], 00000000
:00464D36 740B                    je 00464D43
:00464D38 8B45FC                  mov eax, dword ptr [ebp-04]
:00464D3B 8B4D08                  mov ecx, dword ptr [ebp+08]
:00464D3E 89481C                  mov dword ptr [eax+1C], ecx
:00464D41 EB0A                    jmp 00464D4D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464D36(C)
|
:00464D43 8B55FC                  mov edx, dword ptr [ebp-04]
:00464D46 C7421CFFFFFFFF          mov [edx+1C], FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464D41(U)
|
:00464D4D 8B4508                  mov eax, dword ptr [ebp+08]
:00464D50 50                      push eax
:00464D51 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00464D54 8B11                    mov edx, dword ptr [ecx]
:00464D56 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00464D59 FF523C                  call [edx+3C]
:00464D5C 8BE5                    mov esp, ebp
:00464D5E 5D                      pop ebp
:00464D5F C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0041AC67   , :00465820   , :00467DEA   , :0046CB06   , :0047AD81   
|
:00464D62 55                      push ebp
:00464D63 8BEC                    mov ebp, esp
:00464D65 83EC0C                  sub esp, 0000000C
:00464D68 894DF4                  mov dword ptr [ebp-0C], ecx
:00464D6B 8B4508                  mov eax, dword ptr [ebp+08]
:00464D6E 8B4818                  mov ecx, dword ptr [eax+18]
:00464D71 51                      push ecx
:00464D72 FF15B8604800            call dword ptr [004860B8]
:00464D78 8945F8                  mov dword ptr [ebp-08], eax
:00464D7B C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00464D82 B9202E4900              mov ecx, 00492E20
:00464D87 E82C63FAFF              call 0040B0B8
:00464D8C 85C0                    test eax, eax
:00464D8E 7427                    je 00464DB7
:00464D90 817DF8FFFFFF00          cmp dword ptr [ebp-08], 00FFFFFF
:00464D97 741C                    je 00464DB5
:00464D99 8B55F4                  mov edx, dword ptr [ebp-0C]
:00464D9C 817A3C15000001          cmp dword ptr [edx+3C], 01000015
:00464DA3 7509                    jne 00464DAE
:00464DA5 C745FC13000001          mov [ebp-04], 01000013
:00464DAC EB07                    jmp 00464DB5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464DA3(C)
|
:00464DAE C745FCFFFFFF00          mov [ebp-04], 00FFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00464D97(C), :00464DAC(U)
|
:00464DB5 EB3B                    jmp 00464DF2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464D8E(C)
|
:00464DB7 8B4508                  mov eax, dword ptr [ebp+08]
:00464DBA 8B4808                  mov ecx, dword ptr [eax+08]
:00464DBD 51                      push ecx
:00464DBE 8B55F4                  mov edx, dword ptr [ebp-0C]
:00464DC1 8B02                    mov eax, dword ptr [edx]
:00464DC3 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00464DC6 FF5020                  call [eax+20]
:00464DC9 85C0                    test eax, eax
:00464DCB 7525                    jne 00464DF2
:00464DCD 817DF8FFFFFF00          cmp dword ptr [ebp-08], 00FFFFFF
:00464DD4 741C                    je 00464DF2
:00464DD6 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00464DD9 81793C15000001          cmp dword ptr [ecx+3C], 01000015
:00464DE0 7509                    jne 00464DEB
:00464DE2 C745FC13000001          mov [ebp-04], 01000013
:00464DE9 EB07                    jmp 00464DF2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464DE0(C)
|
:00464DEB C745FCFFFFFF00          mov [ebp-04], 00FFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00464DB5(U), :00464DCB(C), :00464DD4(C), :00464DE9(U)
|
:00464DF2 6A00                    push 00000000
:00464DF4 8B55FC                  mov edx, dword ptr [ebp-04]
:00464DF7 52                      push edx
:00464DF8 8B45F8                  mov eax, dword ptr [ebp-08]
:00464DFB 50                      push eax
:00464DFC 8B4D14                  mov ecx, dword ptr [ebp+14]
:00464DFF 51                      push ecx
:00464E00 8B5510                  mov edx, dword ptr [ebp+10]
:00464E03 52                      push edx
:00464E04 6AFF                    push FFFFFFFF
:00464E06 8B450C                  mov eax, dword ptr [ebp+0C]
:00464E09 50                      push eax
:00464E0A 8B4D08                  mov ecx, dword ptr [ebp+08]
:00464E0D 8B5118                  mov edx, dword ptr [ecx+18]
:00464E10 52                      push edx
:00464E11 E8F6C40000              call 0047130C
:00464E16 83C420                  add esp, 00000020
:00464E19 8BE5                    mov esp, ebp
:00464E1B 5D                      pop ebp
:00464E1C C21000                  ret 0010


:00464E1F 55                      push ebp
:00464E20 8BEC                    mov ebp, esp
:00464E22 83EC14                  sub esp, 00000014
:00464E25 894DEC                  mov dword ptr [ebp-14], ecx
:00464E28 8B45EC                  mov eax, dword ptr [ebp-14]
:00464E2B 8B481C                  mov ecx, dword ptr [eax+1C]
:00464E2E 33D2                    xor edx, edx
:00464E30 3B4D08                  cmp ecx, dword ptr [ebp+08]
:00464E33 0F94C2                  sete dl
:00464E36 8955F0                  mov dword ptr [ebp-10], edx
:00464E39 8B45EC                  mov eax, dword ptr [ebp-14]
:00464E3C 8945F4                  mov dword ptr [ebp-0C], eax
:00464E3F 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00464E42 894DF8                  mov dword ptr [ebp-08], ecx
:00464E45 8B55EC                  mov edx, dword ptr [ebp-14]
:00464E48 8B4218                  mov eax, dword ptr [edx+18]
:00464E4B 8B4D08                  mov ecx, dword ptr [ebp+08]
:00464E4E 8B1488                  mov edx, dword ptr [eax+4*ecx]
:00464E51 8955FC                  mov dword ptr [ebp-04], edx

* Possible StringData Ref from Code Obj ->"UEEMQREPMQU
EPE"
                                        ->"My"
                                  |
:00464E54 68C3CF4600              push 0046CFC3
:00464E59 8D45F4                  lea eax, dword ptr [ebp-0C]
:00464E5C 50                      push eax
:00464E5D 6830100000              push 00001030
:00464E62 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00464E65 8B5110                  mov edx, dword ptr [ecx+10]
:00464E68 52                      push edx
:00464E69 FF15F4624800            call dword ptr [004862F4]
:00464E6F 837DF000                cmp dword ptr [ebp-10], 00000000
:00464E73 740C                    je 00464E81
:00464E75 8B45EC                  mov eax, dword ptr [ebp-14]
:00464E78 C7401CFFFFFFFF          mov [eax+1C], FFFFFFFF
:00464E7F EB09                    jmp 00464E8A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464E73(C)
|
:00464E81 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00464E84 8B5508                  mov edx, dword ptr [ebp+08]
:00464E87 89511C                  mov dword ptr [ecx+1C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464E7F(U)
|
:00464E8A 8BE5                    mov esp, ebp
:00464E8C 5D                      pop ebp
:00464E8D C20400                  ret 0004


:00464E90 55                      push ebp
:00464E91 8BEC                    mov ebp, esp
:00464E93 83EC30                  sub esp, 00000030
:00464E96 894DD0                  mov dword ptr [ebp-30], ecx
:00464E99 8B450C                  mov eax, dword ptr [ebp+0C]
:00464E9C 25FFFF0000              and eax, 0000FFFF
:00464EA1 83F8FF                  cmp eax, FFFFFFFF
:00464EA4 740C                    je 00464EB2
:00464EA6 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00464EA9 E81FF0FFFF              call 00463ECD
:00464EAE 85C0                    test eax, eax
:00464EB0 7507                    jne 00464EB9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464EA4(C)
|
:00464EB2 33C0                    xor eax, eax
:00464EB4 E9CF000000              jmp 00464F88

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464EB0(C)
|
:00464EB9 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00464EBC 8B5508                  mov edx, dword ptr [ebp+08]
:00464EBF 3B5110                  cmp edx, dword ptr [ecx+10]
:00464EC2 742E                    je 00464EF2
:00464EC4 8B45D0                  mov eax, dword ptr [ebp-30]
:00464EC7 8B10                    mov edx, dword ptr [eax]
:00464EC9 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00464ECC FF5240                  call [edx+40]
:00464ECF 8B4510                  mov eax, dword ptr [ebp+10]
:00464ED2 25FFFF0000              and eax, 0000FFFF
:00464ED7 3D05020000              cmp eax, 00000205
:00464EDC 750D                    jne 00464EEB
:00464EDE 6AFF                    push FFFFFFFF
:00464EE0 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00464EE3 8B11                    mov edx, dword ptr [ecx]
:00464EE5 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00464EE8 FF5238                  call [edx+38]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464EDC(C)
|
:00464EEB 33C0                    xor eax, eax
:00464EED E996000000              jmp 00464F88

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464EC2(C)
|
:00464EF2 8B45D0                  mov eax, dword ptr [ebp-30]
:00464EF5 8B10                    mov edx, dword ptr [eax]
:00464EF7 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00464EFA FF5210                  call [edx+10]
:00464EFD 8945FC                  mov dword ptr [ebp-04], eax
:00464F00 837DFCFF                cmp dword ptr [ebp-04], FFFFFFFF
:00464F04 7E59                    jle 00464F5F
:00464F06 6A02                    push 00000002
:00464F08 8B45FC                  mov eax, dword ptr [ebp-04]
:00464F0B 50                      push eax
:00464F0C 682C100000              push 0000102C
:00464F11 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00464F14 8B5110                  mov edx, dword ptr [ecx+10]
:00464F17 52                      push edx
:00464F18 FF15F4624800            call dword ptr [004862F4]
:00464F1E 83F802                  cmp eax, 00000002
:00464F21 7428                    je 00464F4B
:00464F23 C745E403000000          mov [ebp-1C], 00000003
:00464F2A C745E003000000          mov [ebp-20], 00000003
:00464F31 8D45D4                  lea eax, dword ptr [ebp-2C]
:00464F34 50                      push eax
:00464F35 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00464F38 51                      push ecx
:00464F39 682B100000              push 0000102B
:00464F3E 8B55D0                  mov edx, dword ptr [ebp-30]
:00464F41 8B4210                  mov eax, dword ptr [edx+10]
:00464F44 50                      push eax
:00464F45 FF15F4624800            call dword ptr [004862F4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464F21(C)
|
:00464F4B 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00464F4E 8B5110                  mov edx, dword ptr [ecx+10]
:00464F51 52                      push edx
:00464F52 FF1588634800            call dword ptr [00486388]
:00464F58 B801000000              mov eax, 00000001
:00464F5D EB29                    jmp 00464F88

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464F04(C)
|
:00464F5F 8B45D0                  mov eax, dword ptr [ebp-30]
:00464F62 8B10                    mov edx, dword ptr [eax]
:00464F64 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00464F67 FF5240                  call [edx+40]
:00464F6A 8B4510                  mov eax, dword ptr [ebp+10]
:00464F6D 25FFFF0000              and eax, 0000FFFF
:00464F72 3D05020000              cmp eax, 00000205
:00464F77 750D                    jne 00464F86
:00464F79 6AFF                    push FFFFFFFF
:00464F7B 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00464F7E 8B11                    mov edx, dword ptr [ecx]
:00464F80 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00464F83 FF5238                  call [edx+38]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464F77(C)
|
:00464F86 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00464EB4(U), :00464EED(U), :00464F5D(U)
|
:00464F88 8BE5                    mov esp, ebp
:00464F8A 5D                      pop ebp
:00464F8B C20C00                  ret 000C


:00464F8E 55                      push ebp
:00464F8F 8BEC                    mov ebp, esp
:00464F91 83EC30                  sub esp, 00000030
:00464F94 894DD0                  mov dword ptr [ebp-30], ecx
:00464F97 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00464F9A E82EEFFFFF              call 00463ECD
:00464F9F 85C0                    test eax, eax
:00464FA1 7502                    jne 00464FA5
:00464FA3 EB46                    jmp 00464FEB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00464FA1(C)
|
:00464FA5 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00464FA8 E888F5FFFF              call 00464535
:00464FAD 8945FC                  mov dword ptr [ebp-04], eax
:00464FB0 837DFC00                cmp dword ptr [ebp-04], 00000000
:00464FB4 7C35                    jl 00464FEB
:00464FB6 C745E403000000          mov [ebp-1C], 00000003
:00464FBD C745E000000000          mov [ebp-20], 00000000
:00464FC4 8D45D4                  lea eax, dword ptr [ebp-2C]
:00464FC7 50                      push eax
:00464FC8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00464FCB 51                      push ecx
:00464FCC 682B100000              push 0000102B
:00464FD1 8B55D0                  mov edx, dword ptr [ebp-30]
:00464FD4 8B4210                  mov eax, dword ptr [edx+10]
:00464FD7 50                      push eax
:00464FD8 FF15F4624800            call dword ptr [004862F4]
:00464FDE 6AFF                    push FFFFFFFF
:00464FE0 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00464FE3 8B11                    mov edx, dword ptr [ecx]
:00464FE5 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00464FE8 FF5230                  call [edx+30]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00464FA3(U), :00464FB4(C)
|
:00464FEB 8BE5                    mov esp, ebp
:00464FED 5D                      pop ebp
:00464FEE C3                      ret



* Referenced by a CALL at Address:
|:0046CC09   
|
:00464FEF 55                      push ebp
:00464FF0 8BEC                    mov ebp, esp
:00464FF2 83EC08                  sub esp, 00000008
:00464FF5 894DF8                  mov dword ptr [ebp-08], ecx
:00464FF8 8B45F8                  mov eax, dword ptr [ebp-08]
:00464FFB C7400C00000000          mov [eax+0C], 00000000
:00465002 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00465005 C7411000000000          mov [ecx+10], 00000000
:0046500C 8B55F8                  mov edx, dword ptr [ebp-08]
:0046500F C6421400                mov [edx+14], 00
:00465013 8B45F8                  mov eax, dword ptr [ebp-08]
:00465016 83781800                cmp dword ptr [eax+18], 00000000
:0046501A 7415                    je 00465031
:0046501C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046501F 8B5118                  mov edx, dword ptr [ecx+18]
:00465022 8955FC                  mov dword ptr [ebp-04], edx
:00465025 8B45FC                  mov eax, dword ptr [ebp-04]
:00465028 50                      push eax
:00465029 E8F2BF0100              call 00481020
:0046502E 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046501A(C)
|
:00465031 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00465034 C7411800000000          mov [ecx+18], 00000000
:0046503B 8B55F8                  mov edx, dword ptr [ebp-08]
:0046503E C7421CFFFFFFFF          mov [edx+1C], FFFFFFFF
:00465045 8B45F8                  mov eax, dword ptr [ebp-08]
:00465048 C7402000000000          mov [eax+20], 00000000
:0046504F 8BE5                    mov esp, ebp
:00465051 5D                      pop ebp
:00465052 C3                      ret


:00465053 55                      push ebp
:00465054 8BEC                    mov ebp, esp
:00465056 83EC18                  sub esp, 00000018
:00465059 894DF0                  mov dword ptr [ebp-10], ecx
:0046505C C745FC00000000          mov [ebp-04], 00000000
:00465063 8B4508                  mov eax, dword ptr [ebp+08]
:00465066 8945EC                  mov dword ptr [ebp-14], eax
:00465069 837DEC20                cmp dword ptr [ebp-14], 00000020
:0046506D 7711                    ja 00465080
:0046506F 837DEC20                cmp dword ptr [ebp-14], 00000020
:00465073 7461                    je 004650D6
:00465075 837DEC14                cmp dword ptr [ebp-14], 00000014
:00465079 7444                    je 004650BF
:0046507B E935010000              jmp 004651B5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046506D(C)
|
:00465080 837DEC4E                cmp dword ptr [ebp-14], 0000004E
:00465084 7719                    ja 0046509F
:00465086 837DEC4E                cmp dword ptr [ebp-14], 0000004E
:0046508A 0F84F2000000            je 00465182
:00465090 837DEC2B                cmp dword ptr [ebp-14], 0000002B
:00465094 0F848C000000            je 00465126
:0046509A E916010000              jmp 004651B5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00465084(C)
|
:0046509F 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004650A2 81E900020000            sub ecx, 00000200
:004650A8 894DEC                  mov dword ptr [ebp-14], ecx
:004650AB 837DEC05                cmp dword ptr [ebp-14], 00000005
:004650AF 0F8700010000            ja 004651B5
:004650B5 8B55EC                  mov edx, dword ptr [ebp-14]
:004650B8 FF2495DF514600          jmp dword ptr [4*edx+004651DF]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00465079(C)
|
:004650BF 8B450C                  mov eax, dword ptr [ebp+0C]
:004650C2 50                      push eax
:004650C3 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004650C6 8B11                    mov edx, dword ptr [ecx]
:004650C8 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004650CB FF5208                  call [edx+08]
:004650CE 8945FC                  mov dword ptr [ebp-04], eax
:004650D1 E9DF000000              jmp 004651B5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00465073(C)
|
:004650D6 8B4510                  mov eax, dword ptr [ebp+10]
:004650D9 C1E810                  shr eax, 10
:004650DC 25FFFF0000              and eax, 0000FFFF
:004650E1 50                      push eax
:004650E2 668B4D10                mov cx, word ptr [ebp+10]
:004650E6 51                      push ecx
:004650E7 8B550C                  mov edx, dword ptr [ebp+0C]
:004650EA 52                      push edx
:004650EB 8B45F0                  mov eax, dword ptr [ebp-10]
:004650EE 8B10                    mov edx, dword ptr [eax]
:004650F0 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004650F3 FF5248                  call [edx+48]
:004650F6 8945FC                  mov dword ptr [ebp-04], eax
:004650F9 E9B7000000              jmp 004651B5
:004650FE 8B4510                  mov eax, dword ptr [ebp+10]
:00465101 C1E810                  shr eax, 10
:00465104 25FFFF0000              and eax, 0000FFFF
:00465109 50                      push eax
:0046510A 668B4D10                mov cx, word ptr [ebp+10]
:0046510E 51                      push ecx
:0046510F 8B550C                  mov edx, dword ptr [ebp+0C]
:00465112 52                      push edx
:00465113 8B45F0                  mov eax, dword ptr [ebp-10]
:00465116 8B10                    mov edx, dword ptr [eax]
:00465118 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046511B FF524C                  call [edx+4C]
:0046511E 8945FC                  mov dword ptr [ebp-04], eax
:00465121 E98F000000              jmp 004651B5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00465094(C)
|
:00465126 8B4510                  mov eax, dword ptr [ebp+10]
:00465129 8945F8                  mov dword ptr [ebp-08], eax
:0046512C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046512F 833964                  cmp dword ptr [ecx], 00000064
:00465132 7516                    jne 0046514A
:00465134 8B55F8                  mov edx, dword ptr [ebp-08]
:00465137 52                      push edx
:00465138 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046513B 83C140                  add ecx, 00000040
:0046513E 8B45F0                  mov eax, dword ptr [ebp-10]
:00465141 8B5040                  mov edx, dword ptr [eax+40]
:00465144 FF5210                  call [edx+10]
:00465147 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00465132(C)
|
:0046514A EB69                    jmp 004651B5
:0046514C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046514F E879EDFFFF              call 00463ECD
:00465154 85C0                    test eax, eax
:00465156 740D                    je 00465165
:00465158 8B45F0                  mov eax, dword ptr [ebp-10]
:0046515B 8B4810                  mov ecx, dword ptr [eax+10]
:0046515E 51                      push ecx
:0046515F FF151C634800            call dword ptr [0048631C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00465156(C)
|
:00465165 33C0                    xor eax, eax
:00465167 EB70                    jmp 004651D9
:00465169 8B5510                  mov edx, dword ptr [ebp+10]
:0046516C 52                      push edx
:0046516D 8B450C                  mov eax, dword ptr [ebp+0C]
:00465170 50                      push eax
:00465171 8B4D08                  mov ecx, dword ptr [ebp+08]
:00465174 51                      push ecx
:00465175 8B55F0                  mov edx, dword ptr [ebp-10]
:00465178 8B02                    mov eax, dword ptr [edx]
:0046517A 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046517D FF5050                  call [eax+50]
:00465180 EB33                    jmp 004651B5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046508A(C)
|
:00465182 8B4D10                  mov ecx, dword ptr [ebp+10]
:00465185 894DF4                  mov dword ptr [ebp-0C], ecx
:00465188 8B55F4                  mov edx, dword ptr [ebp-0C]
:0046518B 8B4208                  mov eax, dword ptr [edx+08]
:0046518E 8945E8                  mov dword ptr [ebp-18], eax
:00465191 817DE8CCFEFFFF          cmp dword ptr [ebp-18], FFFFFECC
:00465198 7414                    je 004651AE
:0046519A 817DE8CDFEFFFF          cmp dword ptr [ebp-18], FFFFFECD
:004651A1 7612                    jbe 004651B5
:004651A3 817DE8CFFEFFFF          cmp dword ptr [ebp-18], FFFFFECF
:004651AA 7602                    jbe 004651AE
:004651AC EB07                    jmp 004651B5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00465198(C), :004651AA(C)
|
:004651AE B801000000              mov eax, 00000001
:004651B3 EB24                    jmp 004651D9

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046507B(U), :0046509A(U), :004650AF(C), :004650D1(U), :004650F9(U)
|:00465121(U), :0046514A(U), :00465180(U), :004651A1(C), :004651AC(U)
|
:004651B5 837DFC00                cmp dword ptr [ebp-04], 00000000
:004651B9 7407                    je 004651C2
:004651BB B801000000              mov eax, 00000001
:004651C0 EB17                    jmp 004651D9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004651B9(C)
|
:004651C2 8B4D10                  mov ecx, dword ptr [ebp+10]
:004651C5 51                      push ecx
:004651C6 8B550C                  mov edx, dword ptr [ebp+0C]
:004651C9 52                      push edx
:004651CA 8B4508                  mov eax, dword ptr [ebp+08]
:004651CD 50                      push eax
:004651CE 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004651D1 8B11                    mov edx, dword ptr [ecx]
:004651D3 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004651D6 FF5204                  call [edx+04]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00465167(U), :004651B3(U), :004651C0(U)
|
:004651D9 8BE5                    mov esp, ebp
:004651DB 5D                      pop ebp
:004651DC C20C00                  ret 000C



:004651DF FE504600                DWORD 004650FE
:004651E3 4C514600                DWORD 0046514C
:004651E7 69514600                DWORD 00465169
:004651EB B5514600                DWORD 004651B5
:004651EF 4C514600                DWORD 0046514C
:004651F3 69514600                DWORD 00465169


:004651F7 55                      push ebp
:004651F8 8BEC                    mov ebp, esp
:004651FA 51                      push ecx
:004651FB 894DFC                  mov dword ptr [ebp-04], ecx
:004651FE 6A01                    push 00000001
:00465200 8B4508                  mov eax, dword ptr [ebp+08]
:00465203 50                      push eax
:00465204 B9082E4900              mov ecx, 00492E08
:00465209 E83263FAFF              call 0040B540
:0046520E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00465211 51                      push ecx
:00465212 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00465215 E895F7FFFF              call 004649AF
:0046521A B801000000              mov eax, 00000001
:0046521F 8BE5                    mov esp, ebp
:00465221 5D                      pop ebp
:00465222 C20400                  ret 0004


:00465225 55                      push ebp
:00465226 8BEC                    mov ebp, esp
:00465228 83EC30                  sub esp, 00000030
:0046522B 894DD0                  mov dword ptr [ebp-30], ecx
:0046522E FF1584634800            call dword ptr [00486384]
:00465234 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00465237 3B4110                  cmp eax, dword ptr [ecx+10]
:0046523A 7575                    jne 004652B1
:0046523C 8B55D0                  mov edx, dword ptr [ebp-30]
:0046523F 8B02                    mov eax, dword ptr [edx]
:00465241 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00465244 FF5010                  call [eax+10]
:00465247 8945FC                  mov dword ptr [ebp-04], eax
:0046524A 837DFCFF                cmp dword ptr [ebp-04], FFFFFFFF
:0046524E 7E4C                    jle 0046529C
:00465250 6A02                    push 00000002
:00465252 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00465255 51                      push ecx
:00465256 682C100000              push 0000102C
:0046525B 8B55D0                  mov edx, dword ptr [ebp-30]
:0046525E 8B4210                  mov eax, dword ptr [edx+10]
:00465261 50                      push eax
:00465262 FF15F4624800            call dword ptr [004862F4]
:00465268 83F802                  cmp eax, 00000002
:0046526B 7428                    je 00465295
:0046526D C745E403000000          mov [ebp-1C], 00000003
:00465274 C745E003000000          mov [ebp-20], 00000003
:0046527B 8D4DD4                  lea ecx, dword ptr [ebp-2C]
:0046527E 51                      push ecx
:0046527F 8B55FC                  mov edx, dword ptr [ebp-04]
:00465282 52                      push edx
:00465283 682B100000              push 0000102B
:00465288 8B45D0                  mov eax, dword ptr [ebp-30]
:0046528B 8B4810                  mov ecx, dword ptr [eax+10]
:0046528E 51                      push ecx
:0046528F FF15F4624800            call dword ptr [004862F4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046526B(C)
|
:00465295 B801000000              mov eax, 00000001
:0046529A EB17                    jmp 004652B3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046524E(C)
|
:0046529C FF1580634800            call dword ptr [00486380]
:004652A2 8B55D0                  mov edx, dword ptr [ebp-30]
:004652A5 8B02                    mov eax, dword ptr [edx]
:004652A7 8B4DD0                  mov ecx, dword ptr [ebp-30]
:004652AA FF5040                  call [eax+40]
:004652AD 33C0                    xor eax, eax
:004652AF EB02                    jmp 004652B3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046523A(C)
|
:004652B1 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046529A(U), :004652AF(U)
|
:004652B3 8BE5                    mov esp, ebp
:004652B5 5D                      pop ebp
:004652B6 C20C00                  ret 000C


:004652B9 55                      push ebp
:004652BA 8BEC                    mov ebp, esp
:004652BC 83EC10                  sub esp, 00000010
:004652BF 894DF4                  mov dword ptr [ebp-0C], ecx
:004652C2 8B45F4                  mov eax, dword ptr [ebp-0C]
:004652C5 8B480C                  mov ecx, dword ptr [eax+0C]
:004652C8 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004652F0(U)
|
:004652CB 6AF0                    push FFFFFFF0
:004652CD 8B55FC                  mov edx, dword ptr [ebp-04]
:004652D0 52                      push edx
:004652D1 FF15A0634800            call dword ptr [004863A0]
:004652D7 2500000040              and eax, 40000000
:004652DC 3D00000040              cmp eax, 40000000
:004652E1 750F                    jne 004652F2
:004652E3 8B45FC                  mov eax, dword ptr [ebp-04]
:004652E6 50                      push eax
:004652E7 FF159C634800            call dword ptr [0048639C]
:004652ED 8945FC                  mov dword ptr [ebp-04], eax
:004652F0 EBD9                    jmp 004652CB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004652E1(C)
|
:004652F2 FF1560624800            call dword ptr [00486260]
:004652F8 3B45FC                  cmp eax, dword ptr [ebp-04]
:004652FB 7579                    jne 00465376
:004652FD 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00465300 E8C8EBFFFF              call 00463ECD
:00465305 85C0                    test eax, eax
:00465307 746D                    je 00465376
:00465309 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046530C 8B11                    mov edx, dword ptr [ecx]
:0046530E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00465311 FF5210                  call [edx+10]
:00465314 8945F8                  mov dword ptr [ebp-08], eax
:00465317 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046531A E848EBFFFF              call 00463E67
:0046531F 8B4508                  mov eax, dword ptr [ebp+08]
:00465322 8945F0                  mov dword ptr [ebp-10], eax
:00465325 817DF002020000          cmp dword ptr [ebp-10], 00000202
:0046532C 740B                    je 00465339
:0046532E 817DF005020000          cmp dword ptr [ebp-10], 00000205
:00465335 7426                    je 0046535D
:00465337 EB33                    jmp 0046536C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046532C(C)
|
:00465339 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046533C 51                      push ecx
:0046533D 8B55F4                  mov edx, dword ptr [ebp-0C]
:00465340 8B02                    mov eax, dword ptr [edx]
:00465342 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00465345 FF5020                  call [eax+20]
:00465348 85C0                    test eax, eax
:0046534A 740F                    je 0046535B
:0046534C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046534F 51                      push ecx
:00465350 8B55F4                  mov edx, dword ptr [ebp-0C]
:00465353 8B02                    mov eax, dword ptr [edx]
:00465355 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00465358 FF5034                  call [eax+34]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046534A(C)
|
:0046535B EB0F                    jmp 0046536C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00465335(C)
|
:0046535D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00465360 51                      push ecx
:00465361 8B55F4                  mov edx, dword ptr [ebp-0C]
:00465364 8B02                    mov eax, dword ptr [edx]
:00465366 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00465369 FF5038                  call [eax+38]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00465337(U), :0046535B(U)
|
:0046536C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046536F E821EBFFFF              call 00463E95
:00465374 EB16                    jmp 0046538C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004652FB(C), :00465307(C)
|
:00465376 8B4D10                  mov ecx, dword ptr [ebp+10]
:00465379 51                      push ecx
:0046537A 8B550C                  mov edx, dword ptr [ebp+0C]
:0046537D 52                      push edx
:0046537E 8B4508                  mov eax, dword ptr [ebp+08]
:00465381 50                      push eax
:00465382 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00465385 51                      push ecx
:00465386 FF15F4624800            call dword ptr [004862F4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00465374(U)
|
:0046538C 8BE5                    mov esp, ebp
:0046538E 5D                      pop ebp
:0046538F C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:0041ACAF   , :0041ACDA   , :00466363   , :00467F05   , :004684E5   
|:00468BE3   , :0046B408   , :0046B69F   
|
:00465392 55                      push ebp
:00465393 8BEC                    mov ebp, esp
:00465395 51                      push ecx
:00465396 894DFC                  mov dword ptr [ebp-04], ecx
:00465399 6A00                    push 00000000
:0046539B B9B0694B00              mov ecx, 004B69B0
:004653A0 E808F30000              call 004746AD
:004653A5 8BE5                    mov esp, ebp
:004653A7 5D                      pop ebp
:004653A8 C3                      ret


:004653A9 55                      push ebp
:004653AA 8BEC                    mov ebp, esp
:004653AC 83EC0C                  sub esp, 0000000C
:004653AF 53                      push ebx
:004653B0 894DF8                  mov dword ptr [ebp-08], ecx
:004653B3 C745FC00000000          mov [ebp-04], 00000000
:004653BA 8B4510                  mov eax, dword ptr [ebp+10]
:004653BD 8945F4                  mov dword ptr [ebp-0C], eax
:004653C0 837DF400                cmp dword ptr [ebp-0C], 00000000
:004653C4 740E                    je 004653D4
:004653C6 837DF401                cmp dword ptr [ebp-0C], 00000001
:004653CA 7413                    je 004653DF
:004653CC 837DF402                cmp dword ptr [ebp-0C], 00000002
:004653D0 7443                    je 00465415
:004653D2 EB75                    jmp 00465449

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004653C4(C)
|
:004653D4 8B4D08                  mov ecx, dword ptr [ebp+08]
:004653D7 2B4D0C                  sub ecx, dword ptr [ebp+0C]
:004653DA 894DFC                  mov dword ptr [ebp-04], ecx
:004653DD EB6A                    jmp 00465449

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004653CA(C)
|
:004653DF 8B4D08                  mov ecx, dword ptr [ebp+08]
:004653E2 6BC946                  imul ecx, 00000046
:004653E5 81C1C0F44A00            add ecx, 004AF4C0
:004653EB E8308FFDFF              call 0043E320
:004653F0 8AD8                    mov bl, al
:004653F2 81E3FF000000            and ebx, 000000FF
:004653F8 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004653FB 6BC946                  imul ecx, 00000046
:004653FE 81C1C0F44A00            add ecx, 004AF4C0
:00465404 E8178FFDFF              call 0043E320
:00465409 25FF000000              and eax, 000000FF
:0046540E 2BD8                    sub ebx, eax
:00465410 895DFC                  mov dword ptr [ebp-04], ebx
:00465413 EB34                    jmp 00465449

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004653D0(C)
|
:00465415 8B4D08                  mov ecx, dword ptr [ebp+08]
:00465418 6BC946                  imul ecx, 00000046
:0046541B 81C1C0F44A00            add ecx, 004AF4C0
:00465421 E8AA06FCFF              call 00425AD0
:00465426 8AD8                    mov bl, al
:00465428 81E3FF000000            and ebx, 000000FF
:0046542E 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00465431 6BC946                  imul ecx, 00000046
:00465434 81C1C0F44A00            add ecx, 004AF4C0
:0046543A E89106FCFF              call 00425AD0
:0046543F 25FF000000              and eax, 000000FF
:00465444 2BD8                    sub ebx, eax
:00465446 895DFC                  mov dword ptr [ebp-04], ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004653D2(U), :004653DD(U), :00465413(U)
|
:00465449 8B45FC                  mov eax, dword ptr [ebp-04]
:0046544C 5B                      pop ebx
:0046544D 8BE5                    mov esp, ebp
:0046544F 5D                      pop ebp
:00465450 C20C00                  ret 000C


:00465453 55                      push ebp
:00465454 8BEC                    mov ebp, esp
:00465456 83EC08                  sub esp, 00000008
:00465459 894DFC                  mov dword ptr [ebp-04], ecx
:0046545C 8B45FC                  mov eax, dword ptr [ebp-04]
:0046545F 8B4818                  mov ecx, dword ptr [eax+18]
:00465462 8B5508                  mov edx, dword ptr [ebp+08]
:00465465 8B0491                  mov eax, dword ptr [ecx+4*edx]
:00465468 8945F8                  mov dword ptr [ebp-08], eax
:0046546B 837DF800                cmp dword ptr [ebp-08], 00000000
:0046546F 740E                    je 0046547F
:00465471 837DF801                cmp dword ptr [ebp-08], 00000001
:00465475 7426                    je 0046549D
:00465477 837DF802                cmp dword ptr [ebp-08], 00000002
:0046547B 743E                    je 004654BB
:0046547D EB5A                    jmp 004654D9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046546F(C)
|
:0046547F 68286C4800              push 00486C28
:00465484 6A00                    push 00000000
:00465486 6811100000              push 00001011
:0046548B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046548E 8B5110                  mov edx, dword ptr [ecx+10]
:00465491 52                      push edx
:00465492 FF15F4624800            call dword ptr [004862F4]
:00465498 83C016                  add eax, 00000016
:0046549B EB3E                    jmp 004654DB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00465475(C)
|
:0046549D 68386C4800              push 00486C38
:004654A2 6A00                    push 00000000
:004654A4 6811100000              push 00001011
:004654A9 8B45FC                  mov eax, dword ptr [ebp-04]
:004654AC 8B4810                  mov ecx, dword ptr [eax+10]
:004654AF 51                      push ecx
:004654B0 FF15F4624800            call dword ptr [004862F4]
:004654B6 83C00C                  add eax, 0000000C
:004654B9 EB20                    jmp 004654DB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046547B(C)
|
:004654BB 68446C4800              push 00486C44
:004654C0 6A00                    push 00000000
:004654C2 6811100000              push 00001011
:004654C7 8B55FC                  mov edx, dword ptr [ebp-04]
:004654CA 8B4210                  mov eax, dword ptr [edx+10]
:004654CD 50                      push eax
:004654CE FF15F4624800            call dword ptr [004862F4]
:004654D4 83C00C                  add eax, 0000000C
:004654D7 EB02                    jmp 004654DB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046547D(U)
|
:004654D9 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046549B(U), :004654B9(U), :004654D7(U)
|
:004654DB 8BE5                    mov esp, ebp
:004654DD 5D                      pop ebp
:004654DE C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:004658FB   , :00465AA3   
|
:004654E1 55                      push ebp
:004654E2 8BEC                    mov ebp, esp
:004654E4 83EC3C                  sub esp, 0000003C
:004654E7 894DC8                  mov dword ptr [ebp-38], ecx
:004654EA C745CC0F000000          mov [ebp-34], 0000000F
:004654F1 8D45F0                  lea eax, dword ptr [ebp-10]
:004654F4 8945D8                  mov dword ptr [ebp-28], eax
:004654F7 C745EC00000000          mov [ebp-14], 00000000
:004654FE EB09                    jmp 00465509

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004655B5(U)
|
:00465500 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00465503 83C101                  add ecx, 00000001
:00465506 894DEC                  mov dword ptr [ebp-14], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004654FE(U)
|
:00465509 8B55C8                  mov edx, dword ptr [ebp-38]
:0046550C 33C0                    xor eax, eax
:0046550E 8A4214                  mov al, byte ptr [edx+14]
:00465511 3945EC                  cmp dword ptr [ebp-14], eax
:00465514 0F8DA0000000            jnl 004655BA
:0046551A 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0046551D 51                      push ecx
:0046551E 8B55C8                  mov edx, dword ptr [ebp-38]
:00465521 8B02                    mov eax, dword ptr [edx]
:00465523 8B4DC8                  mov ecx, dword ptr [ebp-38]
:00465526 FF5014                  call [eax+14]
:00465529 8945D4                  mov dword ptr [ebp-2C], eax
:0046552C 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0046552F 8B5118                  mov edx, dword ptr [ecx+18]
:00465532 8B45EC                  mov eax, dword ptr [ebp-14]
:00465535 8B0C82                  mov ecx, dword ptr [edx+4*eax]
:00465538 894DC4                  mov dword ptr [ebp-3C], ecx
:0046553B 837DC400                cmp dword ptr [ebp-3C], 00000000
:0046553F 740E                    je 0046554F
:00465541 837DC401                cmp dword ptr [ebp-3C], 00000001
:00465545 7422                    je 00465569
:00465547 837DC402                cmp dword ptr [ebp-3C], 00000002
:0046554B 7436                    je 00465583
:0046554D EB4C                    jmp 0046559B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046553F(C)
|
:0046554F 68906B4800              push 00486B90
:00465554 8D55F0                  lea edx, dword ptr [ebp-10]
:00465557 52                      push edx
:00465558 E833BC0100              call 00481190
:0046555D 83C408                  add esp, 00000008
:00465560 C745D000000000          mov [ebp-30], 00000000
:00465567 EB32                    jmp 0046559B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00465545(C)
|
:00465569 68986B4800              push 00486B98
:0046556E 8D45F0                  lea eax, dword ptr [ebp-10]
:00465571 50                      push eax
:00465572 E819BC0100              call 00481190
:00465577 83C408                  add esp, 00000008
:0046557A C745D002000000          mov [ebp-30], 00000002
:00465581 EB18                    jmp 0046559B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046554B(C)
|
:00465583 68A06B4800              push 00486BA0
:00465588 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0046558B 51                      push ecx
:0046558C E8FFBB0100              call 00481190
:00465591 83C408                  add esp, 00000008
:00465594 C745D001000000          mov [ebp-30], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046554D(U), :00465567(U), :00465581(U)
|
:0046559B 8D55CC                  lea edx, dword ptr [ebp-34]
:0046559E 52                      push edx
:0046559F 8B45EC                  mov eax, dword ptr [ebp-14]
:004655A2 50                      push eax
:004655A3 681B100000              push 0000101B
:004655A8 8B4DC8                  mov ecx, dword ptr [ebp-38]
:004655AB 8B5110                  mov edx, dword ptr [ecx+10]
:004655AE 52                      push edx
:004655AF FF15F4624800            call dword ptr [004862F4]
:004655B5 E946FFFFFF              jmp 00465500

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00465514(C)
|
:004655BA 8B4DC8                  mov ecx, dword ptr [ebp-38]
:004655BD E80BEBFFFF              call 004640CD
:004655C2 B90C2E4900              mov ecx, 00492E0C
:004655C7 E8A4A0FFFF              call 0045F670
:004655CC 50                      push eax
:004655CD 6A01                    push 00000001
:004655CF 6803100000              push 00001003
:004655D4 8B45C8                  mov eax, dword ptr [ebp-38]
:004655D7 8B4810                  mov ecx, dword ptr [eax+10]
:004655DA 51                      push ecx
:004655DB FF15F4624800            call dword ptr [004862F4]
:004655E1 8BE5                    mov esp, ebp
:004655E3 5D                      pop ebp
:004655E4 C3                      ret


:004655E5 55                      push ebp
:004655E6 8BEC                    mov ebp, esp
:004655E8 83EC68                  sub esp, 00000068
:004655EB 894DA0                  mov dword ptr [ebp-60], ecx
:004655EE 8B4508                  mov eax, dword ptr [ebp+08]
:004655F1 83C01C                  add eax, 0000001C
:004655F4 8B08                    mov ecx, dword ptr [eax]
:004655F6 894DC8                  mov dword ptr [ebp-38], ecx
:004655F9 8B5004                  mov edx, dword ptr [eax+04]
:004655FC 8955CC                  mov dword ptr [ebp-34], edx
:004655FF 8B4808                  mov ecx, dword ptr [eax+08]
:00465602 894DD0                  mov dword ptr [ebp-30], ecx
:00465605 8B500C                  mov edx, dword ptr [eax+0C]
:00465608 8955D4                  mov dword ptr [ebp-2C], edx
:0046560B 8B4508                  mov eax, dword ptr [ebp+08]
:0046560E 8B4808                  mov ecx, dword ptr [eax+08]
:00465611 51                      push ecx
:00465612 8B4DA0                  mov ecx, dword ptr [ebp-60]
:00465615 E882E9FFFF              call 00463F9C
:0046561A 6BC046                  imul eax, 00000046
:0046561D 05C0F44A00              add eax, 004AF4C0
:00465622 8945A4                  mov dword ptr [ebp-5C], eax
:00465625 8B5508                  mov edx, dword ptr [ebp+08]
:00465628 52                      push edx
:00465629 8B45A0                  mov eax, dword ptr [ebp-60]
:0046562C 8B10                    mov edx, dword ptr [eax]
:0046562E 8B4DA0                  mov ecx, dword ptr [ebp-60]
:00465631 FF5218                  call [edx+18]
:00465634 C745A801000000          mov [ebp-58], 00000001
:0046563B C745F800000000          mov [ebp-08], 00000000
:00465642 EB09                    jmp 0046564D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046582E(U)
|
:00465644 8B45F8                  mov eax, dword ptr [ebp-08]
:00465647 83C001                  add eax, 00000001
:0046564A 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00465642(U)
|
:0046564D 8B4DA0                  mov ecx, dword ptr [ebp-60]
:00465650 33D2                    xor edx, edx
:00465652 8A5114                  mov dl, byte ptr [ecx+14]
:00465655 3955F8                  cmp dword ptr [ebp-08], edx
:00465658 0F8DD5010000            jnl 00465833
:0046565E 8D45A8                  lea eax, dword ptr [ebp-58]
:00465661 50                      push eax
:00465662 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00465665 51                      push ecx
:00465666 6819100000              push 00001019
:0046566B 8B55A0                  mov edx, dword ptr [ebp-60]
:0046566E 8B4210                  mov eax, dword ptr [edx+10]
:00465671 50                      push eax
:00465672 FF15F4624800            call dword ptr [004862F4]
:00465678 C745FC24800000          mov [ebp-04], 00008024
:0046567F 8B4DAC                  mov ecx, dword ptr [ebp-54]
:00465682 83E103                  and ecx, 00000003
:00465685 894D9C                  mov dword ptr [ebp-64], ecx
:00465688 837D9C00                cmp dword ptr [ebp-64], 00000000
:0046568C 740E                    je 0046569C
:0046568E 837D9C01                cmp dword ptr [ebp-64], 00000001
:00465692 7410                    je 004656A4
:00465694 837D9C02                cmp dword ptr [ebp-64], 00000002
:00465698 7414                    je 004656AE
:0046569A EB1D                    jmp 004656B9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046568C(C)
|
:0046569C 8B55FC                  mov edx, dword ptr [ebp-04]
:0046569F 8955FC                  mov dword ptr [ebp-04], edx
:004656A2 EB1B                    jmp 004656BF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00465692(C)
|
:004656A4 8B45FC                  mov eax, dword ptr [ebp-04]
:004656A7 0C02                    or al, 02
:004656A9 8945FC                  mov dword ptr [ebp-04], eax
:004656AC EB11                    jmp 004656BF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00465698(C)
|
:004656AE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004656B1 83C901                  or ecx, 00000001
:004656B4 894DFC                  mov dword ptr [ebp-04], ecx
:004656B7 EB06                    jmp 004656BF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046569A(U)
|
:004656B9 8B55FC                  mov edx, dword ptr [ebp-04]
:004656BC 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004656A2(U), :004656AC(U), :004656B7(U)
|
:004656BF 6A00                    push 00000000
:004656C1 8B45F8                  mov eax, dword ptr [ebp-08]
:004656C4 50                      push eax
:004656C5 681D100000              push 0000101D
:004656CA 8B4DA0                  mov ecx, dword ptr [ebp-60]
:004656CD 8B5110                  mov edx, dword ptr [ecx+10]
:004656D0 52                      push edx
:004656D1 FF15F4624800            call dword ptr [004862F4]
:004656D7 8B4DC8                  mov ecx, dword ptr [ebp-38]
:004656DA 8D5401FB                lea edx, dword ptr [ecx+eax-05]
:004656DE 8955D0                  mov dword ptr [ebp-30], edx
:004656E1 8B45C8                  mov eax, dword ptr [ebp-38]
:004656E4 83C005                  add eax, 00000005
:004656E7 8945C8                  mov dword ptr [ebp-38], eax
:004656EA 8B4DA0                  mov ecx, dword ptr [ebp-60]
:004656ED 8B5118                  mov edx, dword ptr [ecx+18]
:004656F0 8B45F8                  mov eax, dword ptr [ebp-08]
:004656F3 8B0C82                  mov ecx, dword ptr [edx+4*eax]
:004656F6 894D98                  mov dword ptr [ebp-68], ecx
:004656F9 837D9800                cmp dword ptr [ebp-68], 00000000
:004656FD 7419                    je 00465718
:004656FF 837D9801                cmp dword ptr [ebp-68], 00000001
:00465703 0F8489000000            je 00465792
:00465709 837D9802                cmp dword ptr [ebp-68], 00000002
:0046570D 0F84A3000000            je 004657B6
:00465713 E9F5000000              jmp 0046580D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004656FD(C)
|
:00465718 8B55C8                  mov edx, dword ptr [ebp-38]
:0046571B 83EA05                  sub edx, 00000005
:0046571E 8955C8                  mov dword ptr [ebp-38], edx
:00465721 8B4DA4                  mov ecx, dword ptr [ebp-5C]
:00465724 E8E79FFFFF              call 0045F710
:00465729 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:0046572A 68C4E64800              push 0048E6C4
:0046572F 8D45D8                  lea eax, dword ptr [ebp-28]
:00465732 50                      push eax
:00465733 FF15C0624800            call dword ptr [004862C0]
:00465739 83C40C                  add esp, 0000000C
:0046573C 6A01                    push 00000001
:0046573E 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00465741 8B55CC                  mov edx, dword ptr [ebp-34]
:00465744 8D440AF0                lea eax, dword ptr [edx+ecx-10]
:00465748 99                      cdq
:00465749 2BC2                    sub eax, edx
:0046574B D1F8                    sar eax, 1
:0046574D 50                      push eax
:0046574E 8B45C8                  mov eax, dword ptr [ebp-38]
:00465751 83C001                  add eax, 00000001
:00465754 50                      push eax
:00465755 8B4D08                  mov ecx, dword ptr [ebp+08]
:00465758 8B5118                  mov edx, dword ptr [ecx+18]
:0046575B 52                      push edx
:0046575C 8B4DA4                  mov ecx, dword ptr [ebp-5C]
:0046575F E8CC6BFBFF              call 0041C330
:00465764 25FF000000              and eax, 000000FF
:00465769 50                      push eax
:0046576A 6A00                    push 00000000
:0046576C 6A01                    push 00000001
:0046576E 6802100000              push 00001002
:00465773 8B45A0                  mov eax, dword ptr [ebp-60]
:00465776 8B4810                  mov ecx, dword ptr [eax+10]
:00465779 51                      push ecx
:0046577A FF15F4624800            call dword ptr [004862F4]
:00465780 50                      push eax
:00465781 FF150C604800            call dword ptr [0048600C]
:00465787 8B55C8                  mov edx, dword ptr [ebp-38]
:0046578A 83C211                  add edx, 00000011
:0046578D 8955C8                  mov dword ptr [ebp-38], edx
:00465790 EB7B                    jmp 0046580D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00465703(C)
|
:00465792 8B4DA4                  mov ecx, dword ptr [ebp-5C]
:00465795 E8868BFDFF              call 0043E320
:0046579A 25FF000000              and eax, 000000FF
:0046579F 8B048540BD4800          mov eax, dword ptr [4*eax+0048BD40]
:004657A6 50                      push eax
:004657A7 8D4DD8                  lea ecx, dword ptr [ebp-28]
:004657AA 51                      push ecx
:004657AB FF15C0624800            call dword ptr [004862C0]
:004657B1 83C408                  add esp, 00000008
:004657B4 EB57                    jmp 0046580D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046570D(C)
|
:004657B6 8B55A0                  mov edx, dword ptr [ebp-60]
:004657B9 8B02                    mov eax, dword ptr [edx]
:004657BB 8B4DA0                  mov ecx, dword ptr [ebp-60]
:004657BE FF5054                  call [eax+54]
:004657C1 85C0                    test eax, eax
:004657C3 7428                    je 004657ED
:004657C5 8B4D08                  mov ecx, dword ptr [ebp+08]
:004657C8 8B5108                  mov edx, dword ptr [ecx+08]
:004657CB 52                      push edx
:004657CC 8B45A0                  mov eax, dword ptr [ebp-60]
:004657CF 8B10                    mov edx, dword ptr [eax]
:004657D1 8B4DA0                  mov ecx, dword ptr [ebp-60]
:004657D4 FF5220                  call [edx+20]
:004657D7 85C0                    test eax, eax
:004657D9 7512                    jne 004657ED
:004657DB 6880000000              push 00000080
:004657E0 8B4508                  mov eax, dword ptr [ebp+08]
:004657E3 8B4818                  mov ecx, dword ptr [eax+18]
:004657E6 51                      push ecx
:004657E7 FF1584604800            call dword ptr [00486084]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004657C3(C), :004657D9(C)
|
:004657ED 8B4DA4                  mov ecx, dword ptr [ebp-5C]
:004657F0 E8DB02FCFF              call 00425AD0
:004657F5 25FF000000              and eax, 000000FF
:004657FA 50                      push eax

* Possible StringData Ref from Data Obj ->"%u"
                                  |
:004657FB 68C8E64800              push 0048E6C8
:00465800 8D55D8                  lea edx, dword ptr [ebp-28]
:00465803 52                      push edx
:00465804 FF15C0624800            call dword ptr [004862C0]
:0046580A 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00465713(U), :00465790(U), :004657B4(U)
|
:0046580D 8B45FC                  mov eax, dword ptr [ebp-04]
:00465810 50                      push eax
:00465811 8D4DC8                  lea ecx, dword ptr [ebp-38]
:00465814 51                      push ecx
:00465815 8D55D8                  lea edx, dword ptr [ebp-28]
:00465818 52                      push edx
:00465819 8B4508                  mov eax, dword ptr [ebp+08]
:0046581C 50                      push eax
:0046581D 8B4DA0                  mov ecx, dword ptr [ebp-60]
:00465820 E83DF5FFFF              call 00464D62
:00465825 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00465828 83C105                  add ecx, 00000005
:0046582B 894DC8                  mov dword ptr [ebp-38], ecx
:0046582E E911FEFFFF              jmp 00465644

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00465658(C)
|
:00465833 8BE5                    mov esp, ebp
:00465835 5D                      pop ebp
:00465836 C20400                  ret 0004


:00465839 55                      push ebp
:0046583A 8BEC                    mov ebp, esp
:0046583C 6AFF                    push FFFFFFFF
:0046583E 684E584800              push 0048584E
:00465843 64A100000000            mov eax, dword ptr fs:[00000000]
:00465849 50                      push eax
:0046584A 64892500000000          mov dword ptr fs:[00000000], esp
:00465851 B840200000              mov eax, 00002040
:00465856 E805B90100              call 00481160
:0046585B 898DB4DFFFFF            mov dword ptr [ebp+FFFFDFB4], ecx
:00465861 837D0800                cmp dword ptr [ebp+08], 00000000
:00465865 7C49                    jl 004658B0
:00465867 8D8DB8DFFFFF            lea ecx, dword ptr [ebp+FFFFDFB8]
:0046586D E8EED00000              call 00472960
:00465872 C745FC00000000          mov [ebp-04], 00000000
:00465879 8B4508                  mov eax, dword ptr [ebp+08]
:0046587C 50                      push eax
:0046587D 8B8DB4DFFFFF            mov ecx, dword ptr [ebp+FFFFDFB4]
:00465883 E814E7FFFF              call 00463F9C
:00465888 50                      push eax
:00465889 8B8DB4DFFFFF            mov ecx, dword ptr [ebp+FFFFDFB4]
:0046588F 8B510C                  mov edx, dword ptr [ecx+0C]
:00465892 52                      push edx
:00465893 8D8DB8DFFFFF            lea ecx, dword ptr [ebp+FFFFDFB8]
:00465899 E8EFA70000              call 0047008D
:0046589E C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:004658A5 8D8DB8DFFFFF            lea ecx, dword ptr [ebp+FFFFDFB8]
:004658AB E810D10000              call 004729C0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00465865(C)
|
:004658B0 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004658B3 64890D00000000          mov dword ptr fs:[00000000], ecx
:004658BA 8BE5                    mov esp, ebp
:004658BC 5D                      pop ebp
:004658BD C20400                  ret 0004



* Referenced by a CALL at Address:
|:00478636   
|
:004658C0 55                      push ebp
:004658C1 8BEC                    mov ebp, esp
:004658C3 83EC1C                  sub esp, 0000001C
:004658C6 53                      push ebx
:004658C7 894DE4                  mov dword ptr [ebp-1C], ecx
:004658CA 8B45E4                  mov eax, dword ptr [ebp-1C]
:004658CD 33C9                    xor ecx, ecx
:004658CF 8A4814                  mov cl, byte ptr [eax+14]
:004658D2 85C9                    test ecx, ecx
:004658D4 752C                    jne 00465902
:004658D6 C745F400000000          mov [ebp-0C], 00000000
:004658DD C745F802000000          mov [ebp-08], 00000002
:004658E4 C645FC02                mov [ebp-04], 02
:004658E8 8D55F4                  lea edx, dword ptr [ebp-0C]
:004658EB 52                      push edx
:004658EC 8A45FC                  mov al, byte ptr [ebp-04]
:004658EF 50                      push eax
:004658F0 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004658F3 E803E4FFFF              call 00463CFB
:004658F8 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004658FB E8E1FBFFFF              call 004654E1
:00465900 EB16                    jmp 00465918

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004658D4(C)
|
:00465902 6A00                    push 00000000
:00465904 6A00                    push 00000000
:00465906 6809100000              push 00001009
:0046590B 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0046590E 8B5110                  mov edx, dword ptr [ecx+10]
:00465911 52                      push edx
:00465912 FF15F4624800            call dword ptr [004862F4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00465900(U)
|
:00465918 813D04754B00FFFF0000    cmp dword ptr [004B7504], 0000FFFF
:00465922 0F84CC000000            je 004659F4
:00465928 A104754B00              mov eax, dword ptr [004B7504]
:0046592D 8B0C85F06C4B00          mov ecx, dword ptr [4*eax+004B6CF0]
:00465934 6BC948                  imul ecx, 00000048
:00465937 81C1681B4A00            add ecx, 004A1B68
:0046593D E8CE0CFAFF              call 00406610
:00465942 8845EC                  mov byte ptr [ebp-14], al
:00465945 C645F000                mov [ebp-10], 00
:00465949 C745E800000000          mov [ebp-18], 00000000
:00465950 EB09                    jmp 0046595B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004659DB(U)
|
:00465952 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00465955 83C101                  add ecx, 00000001
:00465958 894DE8                  mov dword ptr [ebp-18], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00465950(U)
|
:0046595B 837DE844                cmp dword ptr [ebp-18], 00000044
:0046595F 7D7F                    jge 004659E0
:00465961 8B55EC                  mov edx, dword ptr [ebp-14]
:00465964 81E2FF000000            and edx, 000000FF
:0046596A 52                      push edx
:0046596B 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0046596E 6BC946                  imul ecx, 00000046
:00465971 81C1C0F44A00            add ecx, 004AF4C0
:00465977 E8043CFAFF              call 00409580
:0046597C 25FF000000              and eax, 000000FF
:00465981 85C0                    test eax, eax
:00465983 7456                    je 004659DB
:00465985 8B45EC                  mov eax, dword ptr [ebp-14]
:00465988 25FF000000              and eax, 000000FF
:0046598D 50                      push eax
:0046598E 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00465991 6BC946                  imul ecx, 00000046
:00465994 81C1C0F44A00            add ecx, 004AF4C0
:0046599A E8E13BFAFF              call 00409580
:0046599F 8AD8                    mov bl, al
:004659A1 81E3FF000000            and ebx, 000000FF
:004659A7 8B0D04754B00            mov ecx, dword ptr [004B7504]
:004659AD 8B0C8DF06C4B00          mov ecx, dword ptr [4*ecx+004B6CF0]
:004659B4 6BC948                  imul ecx, 00000048
:004659B7 81C1681B4A00            add ecx, 004A1B68
:004659BD E80E0CFAFF              call 004065D0
:004659C2 25FF000000              and eax, 000000FF
:004659C7 3BD8                    cmp ebx, eax
:004659C9 7F10                    jg 004659DB
:004659CB 8B55E8                  mov edx, dword ptr [ebp-18]
:004659CE 52                      push edx
:004659CF 8A45F0                  mov al, byte ptr [ebp-10]
:004659D2 50                      push eax
:004659D3 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004659D6 E8A8E3FFFF              call 00463D83

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00465983(C), :004659C9(C)
|
:004659DB E972FFFFFF              jmp 00465952

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046595F(C)
|
:004659E0 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004659E3 E8E5E6FFFF              call 004640CD
:004659E8 6A00                    push 00000000
:004659EA 6A00                    push 00000000
:004659EC 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004659EF E837F3FFFF              call 00464D2B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00465922(C)
|
:004659F4 5B                      pop ebx
:004659F5 8BE5                    mov esp, ebp
:004659F7 5D                      pop ebp
:004659F8 C3                      ret


:004659F9 55                      push ebp
:004659FA 8BEC                    mov ebp, esp
:004659FC 83EC08                  sub esp, 00000008
:004659FF 56                      push esi
:00465A00 894DFC                  mov dword ptr [ebp-04], ecx
:00465A03 837D0800                cmp dword ptr [ebp+08], 00000000
:00465A07 7C26                    jl 00465A2F
:00465A09 8B4508                  mov eax, dword ptr [ebp+08]
:00465A0C 50                      push eax
:00465A0D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00465A10 E8310A0000              call 00466446
:00465A15 8BF0                    mov esi, eax
:00465A17 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00465A1A 8B4950                  mov ecx, dword ptr [ecx+50]
:00465A1D E81ECE0000              call 00472840
:00465A22 3BF0                    cmp esi, eax
:00465A24 7709                    ja 00465A2F
:00465A26 C745F801000000          mov [ebp-08], 00000001
:00465A2D EB07                    jmp 00465A36

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00465A07(C), :00465A24(C)
|
:00465A2F C745F800000000          mov [ebp-08], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00465A2D(U)
|
:00465A36 8B45F8                  mov eax, dword ptr [ebp-08]
:00465A39 5E                      pop esi
:00465A3A 8BE5                    mov esp, ebp
:00465A3C 5D                      pop ebp
:00465A3D C20400                  ret 0004


:00465A40 55                      push ebp
:00465A41 8BEC                    mov ebp, esp
:00465A43 81EC6C010000            sub esp, 0000016C
:00465A49 53                      push ebx
:00465A4A 898D98FEFFFF            mov dword ptr [ebp+FFFFFE98], ecx
:00465A50 8B8598FEFFFF            mov eax, dword ptr [ebp+FFFFFE98]
:00465A56 33C9                    xor ecx, ecx
:00465A58 8A4814                  mov cl, byte ptr [eax+14]
:00465A5B 85C9                    test ecx, ecx
:00465A5D 754B                    jne 00465AAA
:00465A5F C785B4FEFFFF00000000    mov dword ptr [ebp+FFFFFEB4], 00000000
:00465A69 C785B8FEFFFF01000000    mov dword ptr [ebp+FFFFFEB8], 00000001
:00465A73 C785BCFEFFFF02000000    mov dword ptr [ebp+FFFFFEBC], 00000002
:00465A7D C685C0FEFFFF03          mov byte ptr [ebp+FFFFFEC0], 03
:00465A84 8D95B4FEFFFF            lea edx, dword ptr [ebp+FFFFFEB4]
:00465A8A 52                      push edx
:00465A8B 8A85C0FEFFFF            mov al, byte ptr [ebp+FFFFFEC0]
:00465A91 50                      push eax
:00465A92 8B8D98FEFFFF            mov ecx, dword ptr [ebp+FFFFFE98]
:00465A98 E85EE2FFFF              call 00463CFB
:00465A9D 8B8D98FEFFFF            mov ecx, dword ptr [ebp+FFFFFE98]
:00465AA3 E839FAFFFF              call 004654E1
:00465AA8 EB19                    jmp 00465AC3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00465A5D(C)
|
:00465AAA 6A00                    push 00000000
:00465AAC 6A00                    push 00000000
:00465AAE 6809100000              push 00001009
:00465AB3 8B8D98FEFFFF            mov ecx, dword ptr [ebp+FFFFFE98]
:00465AB9 8B5110                  mov edx, dword ptr [ecx+10]
:00465ABC 52                      push edx
:00465ABD FF15F4624800            call dword ptr [004862F4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00465AA8(U)
|
:00465AC3 8B8598FEFFFF            mov eax, dword ptr [ebp+FFFFFE98]
:00465AC9 8B4850                  mov ecx, dword ptr [eax+50]
:00465ACC E89F84FBFF              call 0041DF70
:00465AD1 8885D8FEFFFF            mov byte ptr [ebp+FFFFFED8], al
:00465AD7 C685DCFEFFFF00          mov byte ptr [ebp+FFFFFEDC], 00
:00465ADE C685C4FEFFFF00          mov byte ptr [ebp+FFFFFEC4], 00
:00465AE5 C685C4FEFFFF00          mov byte ptr [ebp+FFFFFEC4], 00
:00465AEC EB0F                    jmp 00465AFD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00465B24(U)
|
:00465AEE 8A8DC4FEFFFF            mov cl, byte ptr [ebp+FFFFFEC4]
:00465AF4 80C101                  add cl, 01
:00465AF7 888DC4FEFFFF            mov byte ptr [ebp+FFFFFEC4], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00465AEC(U)
|
:00465AFD 8B95C4FEFFFF            mov edx, dword ptr [ebp+FFFFFEC4]
:00465B03 81E2FF000000            and edx, 000000FF
:00465B09 83FA44                  cmp edx, 00000044
:00465B0C 7D18                    jge 00465B26
:00465B0E 8B85C4FEFFFF            mov eax, dword ptr [ebp+FFFFFEC4]
:00465B14 25FF000000              and eax, 000000FF
:00465B19 C78485E0FEFFFF00000000  mov dword ptr [ebp+4*eax-00000120], 00000000
:00465B24 EBC8                    jmp 00465AEE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00465B0C(C)
|
:00465B26 6A33                    push 00000033
:00465B28 8B8D98FEFFFF            mov ecx, dword ptr [ebp+FFFFFE98]
:00465B2E 8B4950                  mov ecx, dword ptr [ecx+50]
:00465B31 E83A9BFFFF              call 0045F670
:00465B36 8BC8                    mov ecx, eax
:00465B38 6BC948                  imul ecx, 00000048
:00465B3B 81C1681B4A00            add ecx, 004A1B68
:00465B41 E8C31EFAFF              call 00407A09
:00465B46 85C0                    test eax, eax
:00465B48 0F84C0010000            je 00465D0E
:00465B4E 8B9598FEFFFF            mov edx, dword ptr [ebp+FFFFFE98]
:00465B54 8B4A50                  mov ecx, dword ptr [edx+50]
:00465B57 E804D8F9FF              call 00403360
:00465B5C 668B00                  mov ax, word ptr [eax]
:00465B5F 668985ACFEFFFF          mov word ptr [ebp+FFFFFEAC], ax
:00465B66 8D8DB0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEB0]
:00465B6C E89F9BFFFF              call 0045F710
:00465B71 C685A4FEFFFF00          mov byte ptr [ebp+FFFFFEA4], 00
:00465B78 EB0F                    jmp 00465B89

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00465D09(U)
|
:00465B7A 8A8DA4FEFFFF            mov cl, byte ptr [ebp+FFFFFEA4]
:00465B80 80C101                  add cl, 01
:00465B83 888DA4FEFFFF            mov byte ptr [ebp+FFFFFEA4], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00465B78(U)
|
:00465B89 8B95A4FEFFFF            mov edx, dword ptr [ebp+FFFFFEA4]
:00465B8F 81E2FF000000            and edx, 000000FF
:00465B95 83FA04                  cmp edx, 00000004
:00465B98 0F8D70010000            jnl 00465D0E
:00465B9E 8A85A4FEFFFF            mov al, byte ptr [ebp+FFFFFEA4]
:00465BA4 50                      push eax
:00465BA5 8D8DACFEFFFF            lea ecx, dword ptr [ebp+FFFFFEAC]
:00465BAB 51                      push ecx
:00465BAC E844FEFCFF              call 004359F5
:00465BB1 83C408                  add esp, 00000008
:00465BB4 50                      push eax
:00465BB5 8D8DB0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEB0]
:00465BBB E8E009FAFF              call 004065A0
:00465BC0 8B95B0FEFFFF            mov edx, dword ptr [ebp+FFFFFEB0]
:00465BC6 81E2FF000000            and edx, 000000FF
:00465BCC 81FAFF000000            cmp edx, 000000FF
:00465BD2 0F8431010000            je 00465D09
:00465BD8 8D85B0FEFFFF            lea eax, dword ptr [ebp+FFFFFEB0]
:00465BDE 50                      push eax
:00465BDF E8A0FCFCFF              call 00435884
:00465BE4 83C404                  add esp, 00000004
:00465BE7 8885A8FEFFFF            mov byte ptr [ebp+FFFFFEA8], al
:00465BED 8B8DA8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEA8]
:00465BF3 81E1FF000000            and ecx, 000000FF
:00465BF9 81F9FF000000            cmp ecx, 000000FF
:00465BFF 0F8404010000            je 00465D09
:00465C05 C685C4FEFFFF00          mov byte ptr [ebp+FFFFFEC4], 00
:00465C0C EB0F                    jmp 00465C1D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00465D04(U)
|
:00465C0E 8A95C4FEFFFF            mov dl, byte ptr [ebp+FFFFFEC4]
:00465C14 80C201                  add dl, 01
:00465C17 8895C4FEFFFF            mov byte ptr [ebp+FFFFFEC4], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00465C0C(U)
|
:00465C1D 8B85C4FEFFFF            mov eax, dword ptr [ebp+FFFFFEC4]
:00465C23 25FF000000              and eax, 000000FF
:00465C28 83F844                  cmp eax, 00000044
:00465C2B 0F8DD8000000            jnl 00465D09
:00465C31 8B8DA8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEA8]
:00465C37 81E1FF000000            and ecx, 000000FF
:00465C3D 6BC924                  imul ecx, 00000024
:00465C40 81C1502C4B00            add ecx, 004B2C50
:00465C46 E82583FBFF              call 0041DF70
:00465C4B 25FF000000              and eax, 000000FF
:00465C50 50                      push eax
:00465C51 8B8DC4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC4]
:00465C57 81E1FF000000            and ecx, 000000FF
:00465C5D 6BC946                  imul ecx, 00000046
:00465C60 81C1C0F44A00            add ecx, 004AF4C0
:00465C66 E81539FAFF              call 00409580
:00465C6B 25FF000000              and eax, 000000FF
:00465C70 85C0                    test eax, eax
:00465C72 0F848C000000            je 00465D04
:00465C78 8B8DA8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEA8]
:00465C7E 81E1FF000000            and ecx, 000000FF
:00465C84 6BC924                  imul ecx, 00000024
:00465C87 81C1502C4B00            add ecx, 004B2C50
:00465C8D E8DE82FBFF              call 0041DF70
:00465C92 25FF000000              and eax, 000000FF
:00465C97 50                      push eax
:00465C98 8B8DC4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC4]
:00465C9E 81E1FF000000            and ecx, 000000FF
:00465CA4 6BC946                  imul ecx, 00000046
:00465CA7 81C1C0F44A00            add ecx, 004AF4C0
:00465CAD E8CE38FAFF              call 00409580
:00465CB2 8AD8                    mov bl, al
:00465CB4 81E3FF000000            and ebx, 000000FF
:00465CBA 8B8DA8FEFFFF            mov ecx, dword ptr [ebp+FFFFFEA8]
:00465CC0 81E1FF000000            and ecx, 000000FF
:00465CC6 6BC924                  imul ecx, 00000024
:00465CC9 81C1502C4B00            add ecx, 004B2C50
:00465CCF E89C99FFFF              call 0045F670
:00465CD4 8BC8                    mov ecx, eax
:00465CD6 6BC948                  imul ecx, 00000048
:00465CD9 81C1681B4A00            add ecx, 004A1B68
:00465CDF E8EC08FAFF              call 004065D0
:00465CE4 25FF000000              and eax, 000000FF
:00465CE9 3BD8                    cmp ebx, eax
:00465CEB 7F17                    jg 00465D04
:00465CED 8B8DC4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC4]
:00465CF3 81E1FF000000            and ecx, 000000FF
:00465CF9 C7848DE0FEFFFF01000000  mov dword ptr [ebp+4*ecx-00000120], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00465C72(C), :00465CEB(C)
|
:00465D04 E905FFFFFF              jmp 00465C0E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00465BD2(C), :00465BFF(C), :00465C2B(C)
|
:00465D09 E96CFEFFFF              jmp 00465B7A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00465B48(C), :00465B98(C)
|
:00465D0E C685C4FEFFFF00          mov byte ptr [ebp+FFFFFEC4], 00
:00465D15 EB0F                    jmp 00465D26

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00465E25(U)
|
:00465D17 8A95C4FEFFFF            mov dl, byte ptr [ebp+FFFFFEC4]
:00465D1D 80C201                  add dl, 01
:00465D20 8895C4FEFFFF            mov byte ptr [ebp+FFFFFEC4], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00465D15(U)
|
:00465D26 8B85C4FEFFFF            mov eax, dword ptr [ebp+FFFFFEC4]
:00465D2C 25FF000000              and eax, 000000FF
:00465D31 83F844                  cmp eax, 00000044
:00465D34 0F8DF0000000            jnl 00465E2A
:00465D3A 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:00465D40 81E1FF000000            and ecx, 000000FF
:00465D46 51                      push ecx
:00465D47 8B8DC4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC4]
:00465D4D 81E1FF000000            and ecx, 000000FF
:00465D53 6BC946                  imul ecx, 00000046
:00465D56 81C1C0F44A00            add ecx, 004AF4C0
:00465D5C E81F38FAFF              call 00409580
:00465D61 25FF000000              and eax, 000000FF
:00465D66 85C0                    test eax, eax
:00465D68 746D                    je 00465DD7
:00465D6A 8B95D8FEFFFF            mov edx, dword ptr [ebp+FFFFFED8]
:00465D70 81E2FF000000            and edx, 000000FF
:00465D76 52                      push edx
:00465D77 8B8DC4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC4]
:00465D7D 81E1FF000000            and ecx, 000000FF
:00465D83 6BC946                  imul ecx, 00000046
:00465D86 81C1C0F44A00            add ecx, 004AF4C0
:00465D8C E8EF37FAFF              call 00409580
:00465D91 8AD8                    mov bl, al
:00465D93 81E3FF000000            and ebx, 000000FF
:00465D99 8B8598FEFFFF            mov eax, dword ptr [ebp+FFFFFE98]
:00465D9F 8B4850                  mov ecx, dword ptr [eax+50]
:00465DA2 E8C998FFFF              call 0045F670
:00465DA7 8BC8                    mov ecx, eax
:00465DA9 6BC948                  imul ecx, 00000048
:00465DAC 81C1681B4A00            add ecx, 004A1B68
:00465DB2 E81908FAFF              call 004065D0
:00465DB7 25FF000000              and eax, 000000FF
:00465DBC 3BD8                    cmp ebx, eax
:00465DBE 7F17                    jg 00465DD7
:00465DC0 8B8DC4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEC4]
:00465DC6 81E1FF000000            and ecx, 000000FF
:00465DCC C7848DE0FEFFFF01000000  mov dword ptr [ebp+4*ecx-00000120], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00465D68(C), :00465DBE(C)
|
:00465DD7 8B95C4FEFFFF            mov edx, dword ptr [ebp+FFFFFEC4]
:00465DDD 81E2FF000000            and edx, 000000FF
:00465DE3 83BC95E0FEFFFF00        cmp dword ptr [ebp+4*edx-00000120], 00000000
:00465DEB 7438                    je 00465E25
:00465DED 8B85C4FEFFFF            mov eax, dword ptr [ebp+FFFFFEC4]
:00465DF3 25FF000000              and eax, 000000FF
:00465DF8 50                      push eax
:00465DF9 8A8DDCFEFFFF            mov cl, byte ptr [ebp+FFFFFEDC]
:00465DFF 888D97FEFFFF            mov byte ptr [ebp+FFFFFE97], cl
:00465E05 8A9597FEFFFF            mov dl, byte ptr [ebp+FFFFFE97]
:00465E0B 52                      push edx
:00465E0C 8A85DCFEFFFF            mov al, byte ptr [ebp+FFFFFEDC]
:00465E12 0401                    add al, 01
:00465E14 8885DCFEFFFF            mov byte ptr [ebp+FFFFFEDC], al
:00465E1A 8B8D98FEFFFF            mov ecx, dword ptr [ebp+FFFFFE98]
:00465E20 E85EDFFFFF              call 00463D83

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00465DEB(C)
|
:00465E25 E9EDFEFFFF              jmp 00465D17

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00465D34(C)
|
:00465E2A 6A00                    push 00000000
:00465E2C 6A00                    push 00000000
:00465E2E 8B8D98FEFFFF            mov ecx, dword ptr [ebp+FFFFFE98]
:00465E34 E8F2EEFFFF              call 00464D2B
:00465E39 8B8D98FEFFFF            mov ecx, dword ptr [ebp+FFFFFE98]
:00465E3F 8B4950                  mov ecx, dword ptr [ecx+50]
:00465E42 E899D2FDFF              call 004430E0
:00465E47 50                      push eax

* Possible Reference to Dialog: DialogID_011A, CONTROL_ID:03EA, "Name"
                                  |
:00465E48 68EA030000              push 000003EA
:00465E4D 8B9598FEFFFF            mov edx, dword ptr [ebp+FFFFFE98]
:00465E53 8B420C                  mov eax, dword ptr [edx+0C]
:00465E56 50                      push eax
:00465E57 FF15D8624800            call dword ptr [004862D8]
:00465E5D 8B8D98FEFFFF            mov ecx, dword ptr [ebp+FFFFFE98]
:00465E63 8B4950                  mov ecx, dword ptr [ecx+50]
:00465E66 E80598FFFF              call 0045F670
:00465E6B 8BC8                    mov ecx, eax
:00465E6D 6BC948                  imul ecx, 00000048
:00465E70 81C1681B4A00            add ecx, 004A1B68
:00465E76 E8CF13FAFF              call 0040724A
:00465E7B 50                      push eax
:00465E7C 8B9598FEFFFF            mov edx, dword ptr [ebp+FFFFFE98]
:00465E82 8B4A50                  mov ecx, dword ptr [edx+50]
:00465E85 E8B6C90000              call 00472840
:00465E8A 50                      push eax
:00465E8B 8B8598FEFFFF            mov eax, dword ptr [ebp+FFFFFE98]
:00465E91 8B4850                  mov ecx, dword ptr [eax+50]
:00465E94 E8A7C90000              call 00472840
:00465E99 50                      push eax
:00465E9A 8B8D98FEFFFF            mov ecx, dword ptr [ebp+FFFFFE98]
:00465EA0 83C154                  add ecx, 00000054
:00465EA3 E8A0B5FFFF              call 00461448
:00465EA8 8B8D98FEFFFF            mov ecx, dword ptr [ebp+FFFFFE98]
:00465EAE 8B5110                  mov edx, dword ptr [ecx+10]
:00465EB1 52                      push edx
:00465EB2 8B8598FEFFFF            mov eax, dword ptr [ebp+FFFFFE98]
:00465EB8 8B480C                  mov ecx, dword ptr [eax+0C]
:00465EBB 51                      push ecx
:00465EBC 8B9598FEFFFF            mov edx, dword ptr [ebp+FFFFFE98]
:00465EC2 8B4250                  mov eax, dword ptr [edx+50]
:00465EC5 50                      push eax
:00465EC6 E82E010000              call 00465FF9
:00465ECB 83C40C                  add esp, 0000000C
:00465ECE 89859CFEFFFF            mov dword ptr [ebp+FFFFFE9C], eax
:00465ED4 8995A0FEFFFF            mov dword ptr [ebp+FFFFFEA0], edx
:00465EDA 8B8D9CFEFFFF            mov ecx, dword ptr [ebp+FFFFFE9C]
:00465EE0 898DD0FEFFFF            mov dword ptr [ebp+FFFFFED0], ecx
:00465EE6 8B95A0FEFFFF            mov edx, dword ptr [ebp+FFFFFEA0]
:00465EEC 8995D4FEFFFF            mov dword ptr [ebp+FFFFFED4], edx
:00465EF2 8D45F0                  lea eax, dword ptr [ebp-10]
:00465EF5 50                      push eax

* Possible Reference to Dialog: DialogID_011A, CONTROL_ID:05CD, "MP"
                                  |
:00465EF6 68CD050000              push 000005CD
:00465EFB 8B8D98FEFFFF            mov ecx, dword ptr [ebp+FFFFFE98]
:00465F01 8B510C                  mov edx, dword ptr [ecx+0C]
:00465F04 52                      push edx
:00465F05 FF15DC624800            call dword ptr [004862DC]
:00465F0B 50                      push eax
:00465F0C FF1598634800            call dword ptr [00486398]
:00465F12 8B45F0                  mov eax, dword ptr [ebp-10]
:00465F15 8985C8FEFFFF            mov dword ptr [ebp+FFFFFEC8], eax
:00465F1B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00465F1E 898DCCFEFFFF            mov dword ptr [ebp+FFFFFECC], ecx
:00465F24 8D95C8FEFFFF            lea edx, dword ptr [ebp+FFFFFEC8]
:00465F2A 52                      push edx
:00465F2B 8B8598FEFFFF            mov eax, dword ptr [ebp+FFFFFE98]
:00465F31 8B480C                  mov ecx, dword ptr [eax+0C]
:00465F34 51                      push ecx
:00465F35 FF1564624800            call dword ptr [00486264]
:00465F3B 6A0D                    push 0000000D
:00465F3D 6A00                    push 00000000
:00465F3F 6A00                    push 00000000
:00465F41 8B95CCFEFFFF            mov edx, dword ptr [ebp+FFFFFECC]
:00465F47 52                      push edx
:00465F48 8B85C8FEFFFF            mov eax, dword ptr [ebp+FFFFFEC8]
:00465F4E 0385D0FEFFFF            add eax, dword ptr [ebp+FFFFFED0]
:00465F54 50                      push eax
:00465F55 6A00                    push 00000000

* Possible Reference to Dialog: DialogID_011A, CONTROL_ID:05CD, "MP"
                                  |
:00465F57 68CD050000              push 000005CD
:00465F5C 8B8D98FEFFFF            mov ecx, dword ptr [ebp+FFFFFE98]
:00465F62 8B510C                  mov edx, dword ptr [ecx+0C]
:00465F65 52                      push edx
:00465F66 FF15DC624800            call dword ptr [004862DC]
:00465F6C 50                      push eax
:00465F6D FF1580624800            call dword ptr [00486280]
:00465F73 8D45F0                  lea eax, dword ptr [ebp-10]
:00465F76 50                      push eax

* Possible Reference to Dialog: DialogID_011A, CONTROL_ID:0564, ""
                                  |
:00465F77 6864050000              push 00000564
:00465F7C 8B8D98FEFFFF            mov ecx, dword ptr [ebp+FFFFFE98]
:00465F82 8B510C                  mov edx, dword ptr [ecx+0C]
:00465F85 52                      push edx
:00465F86 FF15DC624800            call dword ptr [004862DC]
:00465F8C 50                      push eax
:00465F8D FF1598634800            call dword ptr [00486398]
:00465F93 8B45F0                  mov eax, dword ptr [ebp-10]
:00465F96 8985C8FEFFFF            mov dword ptr [ebp+FFFFFEC8], eax
:00465F9C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00465F9F 898DCCFEFFFF            mov dword ptr [ebp+FFFFFECC], ecx
:00465FA5 8D95C8FEFFFF            lea edx, dword ptr [ebp+FFFFFEC8]
:00465FAB 52                      push edx
:00465FAC 8B8598FEFFFF            mov eax, dword ptr [ebp+FFFFFE98]
:00465FB2 8B480C                  mov ecx, dword ptr [eax+0C]
:00465FB5 51                      push ecx
:00465FB6 FF1564624800            call dword ptr [00486264]
:00465FBC 6A0D                    push 0000000D
:00465FBE 6A00                    push 00000000
:00465FC0 6A00                    push 00000000
:00465FC2 8B95CCFEFFFF            mov edx, dword ptr [ebp+FFFFFECC]
:00465FC8 52                      push edx
:00465FC9 8B85C8FEFFFF            mov eax, dword ptr [ebp+FFFFFEC8]
:00465FCF 0385D0FEFFFF            add eax, dword ptr [ebp+FFFFFED0]
:00465FD5 50                      push eax
:00465FD6 6A00                    push 00000000

* Possible Reference to Dialog: DialogID_011A, CONTROL_ID:0564, ""
                                  |
:00465FD8 6864050000              push 00000564
:00465FDD 8B8D98FEFFFF            mov ecx, dword ptr [ebp+FFFFFE98]
:00465FE3 8B510C                  mov edx, dword ptr [ecx+0C]
:00465FE6 52                      push edx
:00465FE7 FF15DC624800            call dword ptr [004862DC]
:00465FED 50                      push eax
:00465FEE FF1580624800            call dword ptr [00486280]
:00465FF4 5B                      pop ebx
:00465FF5 8BE5                    mov esp, ebp
:00465FF7 5D                      pop ebp
:00465FF8 C3                      ret



* Referenced by a CALL at Addresses:
|:00465EC6   , :00467EE3   
|
:00465FF9 55                      push ebp
:00465FFA 8BEC                    mov ebp, esp
:00465FFC 83EC70                  sub esp, 00000070
:00465FFF 56                      push esi
:00466000 57                      push edi
:00466001 6A00                    push 00000000
:00466003 6A00                    push 00000000
:00466005 6804100000              push 00001004
:0046600A 8B4510                  mov eax, dword ptr [ebp+10]
:0046600D 50                      push eax
:0046600E FF15F4624800            call dword ptr [004862F4]
:00466014 8945EC                  mov dword ptr [ebp-14], eax
:00466017 837DEC00                cmp dword ptr [ebp-14], 00000000
:0046601B 7554                    jne 00466071
:0046601D C745A00F000000          mov [ebp-60], 0000000F
:00466024 C745AC00000000          mov [ebp-54], 00000000
:0046602B C745B000000000          mov [ebp-50], 00000000
:00466032 C745A800000000          mov [ebp-58], 00000000
:00466039 C745B4FFFFFFFF          mov [ebp-4C], FFFFFFFF
:00466040 C745B820000000          mov [ebp-48], 00000020
:00466047 C745A400000000          mov [ebp-5C], 00000000
:0046604E C745BCFFFFFFFF          mov [ebp-44], FFFFFFFF
:00466055 C745C000000000          mov [ebp-40], 00000000
:0046605C 8D4DA0                  lea ecx, dword ptr [ebp-60]
:0046605F 51                      push ecx
:00466060 6A00                    push 00000000
:00466062 6807100000              push 00001007
:00466067 8B5510                  mov edx, dword ptr [ebp+10]
:0046606A 52                      push edx
:0046606B FF15F4624800            call dword ptr [004862F4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046601B(C)
|
:00466071 8D45F0                  lea eax, dword ptr [ebp-10]
:00466074 85C0                    test eax, eax
:00466076 740F                    je 00466087
:00466078 C745F000000000          mov [ebp-10], 00000000
:0046607F 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00466082 894D90                  mov dword ptr [ebp-70], ecx
:00466085 EB07                    jmp 0046608E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00466076(C)
|
:00466087 C7459000000000          mov [ebp-70], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00466085(U)
|
:0046608E 8B5590                  mov edx, dword ptr [ebp-70]
:00466091 52                      push edx
:00466092 6A00                    push 00000000
:00466094 680E100000              push 0000100E
:00466099 8B4510                  mov eax, dword ptr [ebp+10]
:0046609C 50                      push eax
:0046609D FF15F4624800            call dword ptr [004862F4]
:004660A3 85C0                    test eax, eax
:004660A5 0F8443010000            je 004661EE
:004660AB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004660AE 2B4DF4                  sub ecx, dword ptr [ebp-0C]
:004660B1 B890010000              mov eax, 00000190
:004660B6 99                      cdq
:004660B7 F7F9                    idiv ecx
:004660B9 894594                  mov dword ptr [ebp-6C], eax
:004660BC 6A00                    push 00000000
:004660BE 6A03                    push 00000003
:004660C0 8B5510                  mov edx, dword ptr [ebp+10]
:004660C3 52                      push edx
:004660C4 FF152C634800            call dword ptr [0048632C]
:004660CA 8B45EC                  mov eax, dword ptr [ebp-14]
:004660CD 3B4594                  cmp eax, dword ptr [ebp-6C]
:004660D0 7E14                    jle 004660E6
:004660D2 8B4D94                  mov ecx, dword ptr [ebp-6C]
:004660D5 894DEC                  mov dword ptr [ebp-14], ecx
:004660D8 6A01                    push 00000001
:004660DA 6A01                    push 00000001
:004660DC 8B5510                  mov edx, dword ptr [ebp+10]
:004660DF 52                      push edx
:004660E0 FF152C634800            call dword ptr [0048632C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004660D0(C)
|
:004660E6 837DEC05                cmp dword ptr [ebp-14], 00000005
:004660EA 7D07                    jge 004660F3
:004660EC C745EC05000000          mov [ebp-14], 00000005

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004660EA(C)
|
:004660F3 8D45C8                  lea eax, dword ptr [ebp-38]
:004660F6 50                      push eax
:004660F7 8B4D10                  mov ecx, dword ptr [ebp+10]
:004660FA 51                      push ecx
:004660FB FF15EC624800            call dword ptr [004862EC]
:00466101 8B55F8                  mov edx, dword ptr [ebp-08]
:00466104 2B55F0                  sub edx, dword ptr [ebp-10]
:00466107 8B45D0                  mov eax, dword ptr [ebp-30]
:0046610A 2B45C8                  sub eax, dword ptr [ebp-38]
:0046610D 2BD0                    sub edx, eax
:0046610F 8955E4                  mov dword ptr [ebp-1C], edx
:00466112 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00466115 2B4DF4                  sub ecx, dword ptr [ebp-0C]
:00466118 8B55EC                  mov edx, dword ptr [ebp-14]
:0046611B 0FAFD1                  imul edx, ecx
:0046611E 0355F4                  add edx, dword ptr [ebp-0C]
:00466121 8B45D4                  mov eax, dword ptr [ebp-2C]
:00466124 2B45CC                  sub eax, dword ptr [ebp-34]
:00466127 2BD0                    sub edx, eax
:00466129 8955E8                  mov dword ptr [ebp-18], edx
:0046612C 8D4DC8                  lea ecx, dword ptr [ebp-38]
:0046612F 51                      push ecx
:00466130 8B550C                  mov edx, dword ptr [ebp+0C]
:00466133 52                      push edx
:00466134 FF1598634800            call dword ptr [00486398]
:0046613A 6A0E                    push 0000000E
:0046613C 8B45D4                  mov eax, dword ptr [ebp-2C]
:0046613F 2B45CC                  sub eax, dword ptr [ebp-34]
:00466142 0345E8                  add eax, dword ptr [ebp-18]
:00466145 50                      push eax
:00466146 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00466149 2B4DC8                  sub ecx, dword ptr [ebp-38]
:0046614C 034DE4                  add ecx, dword ptr [ebp-1C]
:0046614F 51                      push ecx
:00466150 6A00                    push 00000000
:00466152 6A00                    push 00000000
:00466154 6A00                    push 00000000
:00466156 8B550C                  mov edx, dword ptr [ebp+0C]
:00466159 52                      push edx
:0046615A FF1580624800            call dword ptr [00486280]
:00466160 8D45C8                  lea eax, dword ptr [ebp-38]
:00466163 50                      push eax
:00466164 6A02                    push 00000002
:00466166 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00466169 51                      push ecx
:0046616A FF15DC624800            call dword ptr [004862DC]
:00466170 50                      push eax
:00466171 FF1598634800            call dword ptr [00486398]
:00466177 8B55C8                  mov edx, dword ptr [ebp-38]
:0046617A 895598                  mov dword ptr [ebp-68], edx
:0046617D 8B45CC                  mov eax, dword ptr [ebp-34]
:00466180 89459C                  mov dword ptr [ebp-64], eax
:00466183 8D4D98                  lea ecx, dword ptr [ebp-68]
:00466186 51                      push ecx
:00466187 8B550C                  mov edx, dword ptr [ebp+0C]
:0046618A 52                      push edx
:0046618B FF1564624800            call dword ptr [00486264]
:00466191 6A0D                    push 0000000D
:00466193 6A00                    push 00000000
:00466195 6A00                    push 00000000
:00466197 8B459C                  mov eax, dword ptr [ebp-64]
:0046619A 0345E8                  add eax, dword ptr [ebp-18]
:0046619D 50                      push eax
:0046619E 8B4D98                  mov ecx, dword ptr [ebp-68]
:004661A1 034DE4                  add ecx, dword ptr [ebp-1C]
:004661A4 51                      push ecx
:004661A5 6A00                    push 00000000
:004661A7 6A02                    push 00000002
:004661A9 8B550C                  mov edx, dword ptr [ebp+0C]
:004661AC 52                      push edx
:004661AD FF15DC624800            call dword ptr [004862DC]
:004661B3 50                      push eax
:004661B4 FF1580624800            call dword ptr [00486280]
:004661BA 8D45C8                  lea eax, dword ptr [ebp-38]
:004661BD 50                      push eax
:004661BE 8B4D10                  mov ecx, dword ptr [ebp+10]
:004661C1 51                      push ecx
:004661C2 FF1598634800            call dword ptr [00486398]
:004661C8 6A0E                    push 0000000E
:004661CA 8B55D4                  mov edx, dword ptr [ebp-2C]
:004661CD 2B55CC                  sub edx, dword ptr [ebp-34]
:004661D0 0355E8                  add edx, dword ptr [ebp-18]
:004661D3 52                      push edx
:004661D4 8B45D0                  mov eax, dword ptr [ebp-30]
:004661D7 2B45C8                  sub eax, dword ptr [ebp-38]
:004661DA 0345E4                  add eax, dword ptr [ebp-1C]
:004661DD 50                      push eax
:004661DE 6A00                    push 00000000
:004661E0 6A00                    push 00000000
:004661E2 6A00                    push 00000000
:004661E4 8B4D10                  mov ecx, dword ptr [ebp+10]
:004661E7 51                      push ecx
:004661E8 FF1580624800            call dword ptr [00486280]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004660A5(C)
|
:004661EE 837DEC00                cmp dword ptr [ebp-14], 00000000
:004661F2 7513                    jne 00466207
:004661F4 6A00                    push 00000000
:004661F6 6A00                    push 00000000
:004661F8 6808100000              push 00001008
:004661FD 8B5510                  mov edx, dword ptr [ebp+10]
:00466200 52                      push edx
:00466201 FF15F4624800            call dword ptr [004862F4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004661F2(C)
|
:00466207 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046620A E851D1F9FF              call 00403360
:0046620F 668B00                  mov ax, word ptr [eax]
:00466212 668945D8                mov word ptr [ebp-28], ax
:00466216 B950424B00              mov ecx, 004B4250
:0046621B E82FB8FEFF              call 00451A4F
:00466220 8BF0                    mov esi, eax
:00466222 8B7DD8                  mov edi, dword ptr [ebp-28]
:00466225 81E7FF000000            and edi, 000000FF
:0046622B B950424B00              mov ecx, 004B4250
:00466230 E85EB8FEFF              call 00451A93
:00466235 99                      cdq
:00466236 B930000000              mov ecx, 00000030
:0046623B F7F9                    idiv ecx
:0046623D 2BF8                    sub edi, eax
:0046623F 6BFF30                  imul edi, 00000030
:00466242 03F7                    add esi, edi
:00466244 8975DC                  mov dword ptr [ebp-24], esi
:00466247 B950424B00              mov ecx, 004B4250
:0046624C E80FB8FEFF              call 00451A60
:00466251 8BF0                    mov esi, eax
:00466253 8B7DD9                  mov edi, dword ptr [ebp-27]
:00466256 81E7FF000000            and edi, 000000FF
:0046625C B950424B00              mov ecx, 004B4250
:00466261 E83EB8FEFF              call 00451AA4
:00466266 99                      cdq
:00466267 B930000000              mov ecx, 00000030
:0046626C F7F9                    idiv ecx
:0046626E 2BF8                    sub edi, eax
:00466270 6BFF30                  imul edi, 00000030
:00466273 03F7                    add esi, edi
:00466275 8975E0                  mov dword ptr [ebp-20], esi
:00466278 8D55F0                  lea edx, dword ptr [ebp-10]
:0046627B 52                      push edx
:0046627C 8B450C                  mov eax, dword ptr [ebp+0C]
:0046627F 50                      push eax
:00466280 FF1598634800            call dword ptr [00486398]
:00466286 B950424B00              mov ecx, 004B4250
:0046628B E8B4FBFEFF              call 00455E44
:00466290 99                      cdq
:00466291 2BC2                    sub eax, edx
:00466293 D1F8                    sar eax, 1
:00466295 3945DC                  cmp dword ptr [ebp-24], eax
:00466298 7D0B                    jge 004662A5
:0046629A 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0046629D 83C140                  add ecx, 00000040
:004662A0 894DDC                  mov dword ptr [ebp-24], ecx
:004662A3 EB11                    jmp 004662B6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00466298(C)
|
:004662A5 8B55F8                  mov edx, dword ptr [ebp-08]
:004662A8 83C210                  add edx, 00000010
:004662AB 2B55F0                  sub edx, dword ptr [ebp-10]
:004662AE 8B45DC                  mov eax, dword ptr [ebp-24]
:004662B1 2BC2                    sub eax, edx
:004662B3 8945DC                  mov dword ptr [ebp-24], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004662A3(U)
|
:004662B6 8B45FC                  mov eax, dword ptr [ebp-04]
:004662B9 2B45F4                  sub eax, dword ptr [ebp-0C]
:004662BC 83E830                  sub eax, 00000030
:004662BF 99                      cdq
:004662C0 2BC2                    sub eax, edx
:004662C2 D1F8                    sar eax, 1
:004662C4 8B4DE0                  mov ecx, dword ptr [ebp-20]
:004662C7 2BC8                    sub ecx, eax
:004662C9 894DE0                  mov dword ptr [ebp-20], ecx
:004662CC 8B75E0                  mov esi, dword ptr [ebp-20]
:004662CF 0375FC                  add esi, dword ptr [ebp-04]
:004662D2 2B75F4                  sub esi, dword ptr [ebp-0C]
:004662D5 B950424B00              mov ecx, 004B4250
:004662DA E88CFBFEFF              call 00455E6B
:004662DF 3BF0                    cmp esi, eax
:004662E1 7E15                    jle 004662F8
:004662E3 B950424B00              mov ecx, 004B4250
:004662E8 E87EFBFEFF              call 00455E6B
:004662ED 8B55FC                  mov edx, dword ptr [ebp-04]
:004662F0 2B55F4                  sub edx, dword ptr [ebp-0C]
:004662F3 2BC2                    sub eax, edx
:004662F5 8945E0                  mov dword ptr [ebp-20], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004662E1(C)
|
:004662F8 837DE000                cmp dword ptr [ebp-20], 00000000
:004662FC 7D07                    jge 00466305
:004662FE C745E000000000          mov [ebp-20], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004662FC(C)
|
:00466305 8D45DC                  lea eax, dword ptr [ebp-24]
:00466308 50                      push eax
:00466309 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046630C 51                      push ecx
:0046630D FF159C634800            call dword ptr [0048639C]
:00466313 50                      push eax
:00466314 FF1520634800            call dword ptr [00486320]
:0046631A 6A0D                    push 0000000D
:0046631C 6A00                    push 00000000
:0046631E 6A00                    push 00000000
:00466320 8B55E0                  mov edx, dword ptr [ebp-20]
:00466323 52                      push edx
:00466324 8B45DC                  mov eax, dword ptr [ebp-24]
:00466327 50                      push eax
:00466328 6A00                    push 00000000
:0046632A 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046632D 51                      push ecx
:0046632E FF1580624800            call dword ptr [00486280]
:00466334 8B45E4                  mov eax, dword ptr [ebp-1C]
:00466337 8B55E8                  mov edx, dword ptr [ebp-18]
:0046633A 5F                      pop edi
:0046633B 5E                      pop esi
:0046633C 8BE5                    mov esp, ebp
:0046633E 5D                      pop ebp
:0046633F C3                      ret


:00466340 55                      push ebp
:00466341 8BEC                    mov ebp, esp
:00466343 51                      push ecx
:00466344 894DFC                  mov dword ptr [ebp-04], ecx
:00466347 837D0800                cmp dword ptr [ebp+08], 00000000
:0046634B 7C35                    jl 00466382
:0046634D 8B4508                  mov eax, dword ptr [ebp+08]
:00466350 50                      push eax
:00466351 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00466354 8B11                    mov edx, dword ptr [ecx]
:00466356 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00466359 FF5220                  call [edx+20]
:0046635C 85C0                    test eax, eax
:0046635E 7422                    je 00466382
:00466360 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00466363 E82AF0FFFF              call 00465392
:00466368 8B4508                  mov eax, dword ptr [ebp+08]
:0046636B 50                      push eax
:0046636C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046636F E828DCFFFF              call 00463F9C
:00466374 50                      push eax
:00466375 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00466378 8B510C                  mov edx, dword ptr [ecx+0C]
:0046637B 52                      push edx
:0046637C FF15D4624800            call dword ptr [004862D4]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046634B(C), :0046635E(C)
|
:00466382 8BE5                    mov esp, ebp
:00466384 5D                      pop ebp
:00466385 C20400                  ret 0004


:00466388 55                      push ebp
:00466389 8BEC                    mov ebp, esp
:0046638B 83EC08                  sub esp, 00000008
:0046638E 894DF8                  mov dword ptr [ebp-08], ecx
:00466391 C745FC00000000          mov [ebp-04], 00000000
:00466398 837D0800                cmp dword ptr [ebp+08], 00000000
:0046639C 7C22                    jl 004663C0
:0046639E 8B4508                  mov eax, dword ptr [ebp+08]
:004663A1 50                      push eax
:004663A2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004663A5 8B11                    mov edx, dword ptr [ecx]
:004663A7 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004663AA FF5220                  call [edx+20]
:004663AD 85C0                    test eax, eax
:004663AF 740F                    je 004663C0
:004663B1 8B4508                  mov eax, dword ptr [ebp+08]
:004663B4 50                      push eax
:004663B5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004663B8 E889000000              call 00466446
:004663BD 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046639C(C), :004663AF(C)
|
:004663C0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004663C3 8B4950                  mov ecx, dword ptr [ecx+50]
:004663C6 E875C40000              call 00472840
:004663CB 2B45FC                  sub eax, dword ptr [ebp-04]
:004663CE 8B55F8                  mov edx, dword ptr [ebp-08]
:004663D1 894254                  mov dword ptr [edx+54], eax
:004663D4 6A01                    push 00000001
:004663D6 6A00                    push 00000000
:004663D8 6A00                    push 00000000

* Possible Reference to Dialog: DialogID_011A, CONTROL_ID:0564, ""
                                  |
:004663DA 6864050000              push 00000564
:004663DF 8B45F8                  mov eax, dword ptr [ebp-08]
:004663E2 8B480C                  mov ecx, dword ptr [eax+0C]
:004663E5 51                      push ecx
:004663E6 FF15DC624800            call dword ptr [004862DC]
:004663EC 50                      push eax
:004663ED FF15B4624800            call dword ptr [004862B4]
:004663F3 8BE5                    mov esp, ebp
:004663F5 5D                      pop ebp
:004663F6 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0046EAF1   
|
:004663F9 55                      push ebp
:004663FA 8BEC                    mov ebp, esp
:004663FC 83EC14                  sub esp, 00000014
:004663FF 894DEC                  mov dword ptr [ebp-14], ecx

* Possible Reference to Dialog: DialogID_011A, CONTROL_ID:0564, ""
                                  |
:00466402 6864050000              push 00000564
:00466407 8B45EC                  mov eax, dword ptr [ebp-14]
:0046640A 8B480C                  mov ecx, dword ptr [eax+0C]
:0046640D 51                      push ecx
:0046640E FF15DC624800            call dword ptr [004862DC]
:00466414 39450C                  cmp dword ptr [ebp+0C], eax
:00466417 7525                    jne 0046643E
:00466419 8D55F0                  lea edx, dword ptr [ebp-10]
:0046641C 52                      push edx
:0046641D 8B450C                  mov eax, dword ptr [ebp+0C]
:00466420 50                      push eax
:00466421 FF15EC624800            call dword ptr [004862EC]
:00466427 6A09                    push 00000009
:00466429 6A00                    push 00000000
:0046642B 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0046642E 51                      push ecx
:0046642F 8B5508                  mov edx, dword ptr [ebp+08]
:00466432 52                      push edx
:00466433 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00466436 83C154                  add ecx, 00000054
:00466439 E831B0FFFF              call 0046146F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00466417(C)
|
:0046643E 33C0                    xor eax, eax
:00466440 8BE5                    mov esp, ebp
:00466442 5D                      pop ebp
:00466443 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:00465A10   , :004663B8   
|
:00466446 55                      push ebp
:00466447 8BEC                    mov ebp, esp
:00466449 83EC08                  sub esp, 00000008
:0046644C 894DF8                  mov dword ptr [ebp-08], ecx
:0046644F 8B4508                  mov eax, dword ptr [ebp+08]
:00466452 50                      push eax
:00466453 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00466456 E841DBFFFF              call 00463F9C
:0046645B 8BC8                    mov ecx, eax
:0046645D 6BC946                  imul ecx, 00000046
:00466460 81C1C0F44A00            add ecx, 004AF4C0
:00466466 E865F6FBFF              call 00425AD0
:0046646B 25FF000000              and eax, 000000FF
:00466470 8945FC                  mov dword ptr [ebp-04], eax
:00466473 6A31                    push 00000031
:00466475 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00466478 8B4950                  mov ecx, dword ptr [ecx+50]
:0046647B E8F091FFFF              call 0045F670
:00466480 8BC8                    mov ecx, eax
:00466482 6BC948                  imul ecx, 00000048
:00466485 81C1681B4A00            add ecx, 004A1B68
:0046648B E87915FAFF              call 00407A09
:00466490 85C0                    test eax, eax
:00466492 742E                    je 004664C2
:00466494 6A31                    push 00000031
:00466496 8B55F8                  mov edx, dword ptr [ebp-08]
:00466499 8B4A50                  mov ecx, dword ptr [edx+50]
:0046649C E8CF91FFFF              call 0045F670
:004664A1 8BC8                    mov ecx, eax
:004664A3 6BC948                  imul ecx, 00000048
:004664A6 81C1681B4A00            add ecx, 004A1B68
:004664AC E84116FAFF              call 00407AF2
:004664B1 8AC8                    mov cl, al
:004664B3 81E1FF000000            and ecx, 000000FF
:004664B9 8B45FC                  mov eax, dword ptr [ebp-04]
:004664BC 99                      cdq
:004664BD F7F9                    idiv ecx
:004664BF 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00466492(C)
|
:004664C2 8B45FC                  mov eax, dword ptr [ebp-04]
:004664C5 8BE5                    mov esp, ebp
:004664C7 5D                      pop ebp
:004664C8 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0043DC69   
|
:004664CB 55                      push ebp
:004664CC 8BEC                    mov ebp, esp
:004664CE 6AFF                    push FFFFFFFF
:004664D0 6864584800              push 00485864
:004664D5 64A100000000            mov eax, dword ptr fs:[00000000]
:004664DB 50                      push eax
:004664DC 64892500000000          mov dword ptr fs:[00000000], esp
:004664E3 81EC9C000000            sub esp, 0000009C
:004664E9 8D8D5CFFFFFF            lea ecx, dword ptr [ebp+FFFFFF5C]
:004664EF E85CC50000              call 00472A50
:004664F4 C745FC00000000          mov [ebp-04], 00000000
:004664FB 8B4508                  mov eax, dword ptr [ebp+08]
:004664FE 50                      push eax
:004664FF 8D8D5CFFFFFF            lea ecx, dword ptr [ebp+FFFFFF5C]
:00466505 E806C50000              call 00472A10
:0046650A 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:00466510 51                      push ecx
:00466511 8D8D5CFFFFFF            lea ecx, dword ptr [ebp+FFFFFF5C]
:00466517 E8E0850000              call 0046EAFC
:0046651C 888558FFFFFF            mov byte ptr [ebp+FFFFFF58], al
:00466522 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00466529 8D8D5CFFFFFF            lea ecx, dword ptr [ebp+FFFFFF5C]
:0046652F E84CC60000              call 00472B80
:00466534 8A8558FFFFFF            mov al, byte ptr [ebp+FFFFFF58]
:0046653A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046653D 64890D00000000          mov dword ptr fs:[00000000], ecx
:00466544 8BE5                    mov esp, ebp
:00466546 5D                      pop ebp
:00466547 C3                      ret



* Referenced by a CALL at Address:
|:00467718   
|
:00466548 55                      push ebp
:00466549 8BEC                    mov ebp, esp
:0046654B 83EC3C                  sub esp, 0000003C
:0046654E 894DC8                  mov dword ptr [ebp-38], ecx
:00466551 C745CC0F000000          mov [ebp-34], 0000000F
:00466558 8D45F0                  lea eax, dword ptr [ebp-10]
:0046655B 8945D8                  mov dword ptr [ebp-28], eax
:0046655E C745EC00000000          mov [ebp-14], 00000000
:00466565 EB09                    jmp 00466570

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00466740(U)
|
:00466567 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0046656A 83C101                  add ecx, 00000001
:0046656D 894DEC                  mov dword ptr [ebp-14], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00466565(U)
|
:00466570 8B55C8                  mov edx, dword ptr [ebp-38]
:00466573 33C0                    xor eax, eax
:00466575 8A4214                  mov al, byte ptr [edx+14]
:00466578 3945EC                  cmp dword ptr [ebp-14], eax
:0046657B 0F8DC4010000            jnl 00466745
:00466581 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00466584 51                      push ecx
:00466585 8B55C8                  mov edx, dword ptr [ebp-38]
:00466588 8B02                    mov eax, dword ptr [edx]
:0046658A 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0046658D FF5014                  call [eax+14]
:00466590 8945D4                  mov dword ptr [ebp-2C], eax
:00466593 8B4DC8                  mov ecx, dword ptr [ebp-38]
:00466596 8B5118                  mov edx, dword ptr [ecx+18]
:00466599 8B45EC                  mov eax, dword ptr [ebp-14]
:0046659C 8B0C82                  mov ecx, dword ptr [edx+4*eax]
:0046659F 894DC4                  mov dword ptr [ebp-3C], ecx
:004665A2 837DC40C                cmp dword ptr [ebp-3C], 0000000C
:004665A6 0F8772010000            ja 0046671E
:004665AC 8B55C4                  mov edx, dword ptr [ebp-3C]
:004665AF FF249549674600          jmp dword ptr [4*edx+00466749]
:004665B6 68306B4800              push 00486B30
:004665BB 8D45F0                  lea eax, dword ptr [ebp-10]
:004665BE 50                      push eax
:004665BF E8CCAB0100              call 00481190
:004665C4 83C408                  add esp, 00000008
:004665C7 C745D000000000          mov [ebp-30], 00000000
:004665CE E94B010000              jmp 0046671E
:004665D3 68C46A4800              push 00486AC4
:004665D8 8D4DF0                  lea ecx, dword ptr [ebp-10]
:004665DB 51                      push ecx
:004665DC E8AFAB0100              call 00481190
:004665E1 83C408                  add esp, 00000008
:004665E4 C745D001000000          mov [ebp-30], 00000001
:004665EB E92E010000              jmp 0046671E
:004665F0 68D06A4800              push 00486AD0
:004665F5 8D55F0                  lea edx, dword ptr [ebp-10]
:004665F8 52                      push edx
:004665F9 E892AB0100              call 00481190
:004665FE 83C408                  add esp, 00000008
:00466601 C745D001000000          mov [ebp-30], 00000001
:00466608 E911010000              jmp 0046671E
:0046660D 68386B4800              push 00486B38
:00466612 8D45F0                  lea eax, dword ptr [ebp-10]
:00466615 50                      push eax
:00466616 E875AB0100              call 00481190
:0046661B 83C408                  add esp, 00000008
:0046661E C745D002000000          mov [ebp-30], 00000002
:00466625 E9F4000000              jmp 0046671E
:0046662A 68406B4800              push 00486B40
:0046662F 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00466632 51                      push ecx
:00466633 E858AB0100              call 00481190
:00466638 83C408                  add esp, 00000008
:0046663B C745D002000000          mov [ebp-30], 00000002
:00466642 E9D7000000              jmp 0046671E
:00466647 68486B4800              push 00486B48
:0046664C 8D55F0                  lea edx, dword ptr [ebp-10]
:0046664F 52                      push edx
:00466650 E83BAB0100              call 00481190
:00466655 83C408                  add esp, 00000008
:00466658 C745D001000000          mov [ebp-30], 00000001
:0046665F E9BA000000              jmp 0046671E
:00466664 68506B4800              push 00486B50
:00466669 8D45F0                  lea eax, dword ptr [ebp-10]
:0046666C 50                      push eax
:0046666D E81EAB0100              call 00481190
:00466672 83C408                  add esp, 00000008
:00466675 C745D001000000          mov [ebp-30], 00000001
:0046667C E99D000000              jmp 0046671E
:00466681 68586B4800              push 00486B58
:00466686 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00466689 51                      push ecx
:0046668A E801AB0100              call 00481190
:0046668F 83C408                  add esp, 00000008
:00466692 C745D001000000          mov [ebp-30], 00000001
:00466699 E980000000              jmp 0046671E
:0046669E 68606B4800              push 00486B60
:004666A3 8D55F0                  lea edx, dword ptr [ebp-10]
:004666A6 52                      push edx
:004666A7 E8E4AA0100              call 00481190
:004666AC 83C408                  add esp, 00000008
:004666AF C745D001000000          mov [ebp-30], 00000001
:004666B6 EB66                    jmp 0046671E
:004666B8 68686B4800              push 00486B68
:004666BD 8D45F0                  lea eax, dword ptr [ebp-10]
:004666C0 50                      push eax
:004666C1 E8CAAA0100              call 00481190
:004666C6 83C408                  add esp, 00000008
:004666C9 C745D001000000          mov [ebp-30], 00000001
:004666D0 EB4C                    jmp 0046671E
:004666D2 68886B4800              push 00486B88
:004666D7 8D4DF0                  lea ecx, dword ptr [ebp-10]
:004666DA 51                      push ecx
:004666DB E8B0AA0100              call 00481190
:004666E0 83C408                  add esp, 00000008
:004666E3 C745D002000000          mov [ebp-30], 00000002
:004666EA EB32                    jmp 0046671E
:004666EC 68706B4800              push 00486B70
:004666F1 8D55F0                  lea edx, dword ptr [ebp-10]
:004666F4 52                      push edx
:004666F5 E896AA0100              call 00481190
:004666FA 83C408                  add esp, 00000008
:004666FD C745D002000000          mov [ebp-30], 00000002
:00466704 EB18                    jmp 0046671E
:00466706 68806B4800              push 00486B80
:0046670B 8D45F0                  lea eax, dword ptr [ebp-10]
:0046670E 50                      push eax
:0046670F E87CAA0100              call 00481190
:00466714 83C408                  add esp, 00000008
:00466717 C745D002000000          mov [ebp-30], 00000002

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004665A6(C), :004665CE(U), :004665EB(U), :00466608(U), :00466625(U)
|:00466642(U), :0046665F(U), :0046667C(U), :00466699(U), :004666B6(U)
|:004666D0(U), :004666EA(U), :00466704(U)
|
:0046671E 8B4DC8                  mov ecx, dword ptr [ebp-38]
:00466721 E8A7D9FFFF              call 004640CD
:00466726 8D4DCC                  lea ecx, dword ptr [ebp-34]
:00466729 51                      push ecx
:0046672A 8B55EC                  mov edx, dword ptr [ebp-14]
:0046672D 52                      push edx
:0046672E 681B100000              push 0000101B
:00466733 8B45C8                  mov eax, dword ptr [ebp-38]
:00466736 8B4810                  mov ecx, dword ptr [eax+10]
:00466739 51                      push ecx
:0046673A FF15F4624800            call dword ptr [004862F4]
:00466740 E922FEFFFF              jmp 00466567

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046657B(C)
|
:00466745 8BE5                    mov esp, ebp
:00466747 5D                      pop ebp
:00466748 C3                      ret



:00466749 B6654600                DWORD 004665B6
:0046674D D3654600                DWORD 004665D3
:00466751 F0654600                DWORD 004665F0
:00466755 0D664600                DWORD 0046660D
:00466759 2A664600                DWORD 0046662A
:0046675D 47664600                DWORD 00466647
:00466761 64664600                DWORD 00466664
:00466765 B8664600                DWORD 004666B8
:00466769 D2664600                DWORD 004666D2
:0046676D 81664600                DWORD 00466681
:00466771 EC664600                DWORD 004666EC
:00466775 9E664600                DWORD 0046669E
:00466779 06674600                DWORD 00466706



* Referenced by a CALL at Addresses:
|:0046B3B0   , :0046BC66   
|
:0046677D 55                      push ebp
:0046677E 8BEC                    mov ebp, esp
:00466780 83EC10                  sub esp, 00000010
:00466783 894DF0                  mov dword ptr [ebp-10], ecx
:00466786 C745FC00000000          mov [ebp-04], 00000000
:0046678D 837D1400                cmp dword ptr [ebp+14], 00000000
:00466791 0F84AA000000            je 00466841
:00466797 C745F400000000          mov [ebp-0C], 00000000
:0046679E EB09                    jmp 004667A9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046683C(U)
|
:004667A0 8B45F4                  mov eax, dword ptr [ebp-0C]
:004667A3 83C001                  add eax, 00000001
:004667A6 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046679E(U)
|
:004667A9 817DF4C8000000          cmp dword ptr [ebp-0C], 000000C8
:004667B0 0F8D8B000000            jnl 00466841
:004667B6 8A4DF4                  mov cl, byte ptr [ebp-0C]
:004667B9 51                      push ecx
:004667BA B970074B00              mov ecx, 004B0770
:004667BF E80CC40000              call 00472BD0
:004667C4 8B55F4                  mov edx, dword ptr [ebp-0C]
:004667C7 8B4D08                  mov ecx, dword ptr [ebp+08]
:004667CA 8804D1                  mov byte ptr [ecx+8*edx], al
:004667CD 8B55F4                  mov edx, dword ptr [ebp-0C]
:004667D0 8B4508                  mov eax, dword ptr [ebp+08]
:004667D3 8A4DF4                  mov cl, byte ptr [ebp-0C]
:004667D6 884CD001                mov byte ptr [eax+8*edx+01], cl
:004667DA 8A55F4                  mov dl, byte ptr [ebp-0C]
:004667DD 52                      push edx
:004667DE B970074B00              mov ecx, 004B0770
:004667E3 E808C40000              call 00472BF0
:004667E8 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004667EB 8B5508                  mov edx, dword ptr [ebp+08]
:004667EE 8844CA02                mov byte ptr [edx+8*ecx+02], al
:004667F2 8A45F4                  mov al, byte ptr [ebp-0C]
:004667F5 50                      push eax
:004667F6 B970074B00              mov ecx, 004B0770
:004667FB E810C40000              call 00472C10
:00466800 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00466803 8B5508                  mov edx, dword ptr [ebp+08]
:00466806 8844CA03                mov byte ptr [edx+8*ecx+03], al
:0046680A 837D1000                cmp dword ptr [ebp+10], 00000000
:0046680E 7510                    jne 00466820
:00466810 8B45F4                  mov eax, dword ptr [ebp-0C]
:00466813 8B4D08                  mov ecx, dword ptr [ebp+08]
:00466816 C744C10401000000        mov [ecx+8*eax+04], 00000001
:0046681E EB1C                    jmp 0046683C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046680E(C)
|
:00466820 8B55F4                  mov edx, dword ptr [ebp-0C]
:00466823 8B4508                  mov eax, dword ptr [ebp+08]
:00466826 8A0CD0                  mov cl, byte ptr [eax+8*edx]
:00466829 51                      push ecx
:0046682A 8B4D10                  mov ecx, dword ptr [ebp+10]
:0046682D E8D510FAFF              call 00407907
:00466832 8B55F4                  mov edx, dword ptr [ebp-0C]
:00466835 8B4D08                  mov ecx, dword ptr [ebp+08]
:00466838 8944D104                mov dword ptr [ecx+8*edx+04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046681E(U)
|
:0046683C E95FFFFFFF              jmp 004667A0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00466791(C), :004667B0(C)
|
:00466841 C745F800000000          mov [ebp-08], 00000000
:00466848 EB09                    jmp 00466853

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004668AD(U), :004668D3(U)
|
:0046684A 8B55F8                  mov edx, dword ptr [ebp-08]
:0046684D 83C201                  add edx, 00000001
:00466850 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00466848(U)
|
:00466853 817DF8C8000000          cmp dword ptr [ebp-08], 000000C8
:0046685A 7D7C                    jge 004668D8
:0046685C 8B45F8                  mov eax, dword ptr [ebp-08]
:0046685F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00466862 33D2                    xor edx, edx
:00466864 8A14C1                  mov dl, byte ptr [ecx+8*eax]
:00466867 81FAFF000000            cmp edx, 000000FF
:0046686D 743E                    je 004668AD
:0046686F 8B45F8                  mov eax, dword ptr [ebp-08]
:00466872 8B4D08                  mov ecx, dword ptr [ebp+08]
:00466875 33D2                    xor edx, edx
:00466877 8A14C1                  mov dl, byte ptr [ecx+8*eax]
:0046687A 8BCA                    mov ecx, edx
:0046687C 6BC919                  imul ecx, 00000019
:0046687F 81C140114A00            add ecx, 004A1140
:00466885 E8605EFAFF              call 0040C6EA
:0046688A 25FF000000              and eax, 000000FF
:0046688F 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00466892 81E1FF000000            and ecx, 000000FF
:00466898 3BC1                    cmp eax, ecx
:0046689A 7413                    je 004668AF
:0046689C 8B550C                  mov edx, dword ptr [ebp+0C]
:0046689F 81E2FF000000            and edx, 000000FF
:004668A5 81FAFF000000            cmp edx, 000000FF
:004668AB 7402                    je 004668AF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046686D(C)
|
:004668AD EB9B                    jmp 0046684A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046689A(C), :004668AB(C)
|
:004668AF 8B45F8                  mov eax, dword ptr [ebp-08]
:004668B2 8B4D08                  mov ecx, dword ptr [ebp+08]
:004668B5 8D14C1                  lea edx, dword ptr [ecx+8*eax]
:004668B8 52                      push edx
:004668B9 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004668BC E8FF5AFBFF              call 0041C3C0
:004668C1 50                      push eax
:004668C2 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004668C5 E8B9D4FFFF              call 00463D83
:004668CA 8B45FC                  mov eax, dword ptr [ebp-04]
:004668CD 83C001                  add eax, 00000001
:004668D0 8945FC                  mov dword ptr [ebp-04], eax
:004668D3 E972FFFFFF              jmp 0046684A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046685A(C)
|
:004668D8 8B45FC                  mov eax, dword ptr [ebp-04]
:004668DB 8BE5                    mov esp, ebp
:004668DD 5D                      pop ebp
:004668DE C21000                  ret 0010



* Referenced by a CALL at Address:
|:00467FBB   
|
:004668E1 55                      push ebp
:004668E2 8BEC                    mov ebp, esp
:004668E4 83EC10                  sub esp, 00000010
:004668E7 894DF0                  mov dword ptr [ebp-10], ecx
:004668EA C745FC00000000          mov [ebp-04], 00000000
:004668F1 837D1400                cmp dword ptr [ebp+14], 00000000
:004668F5 0F84D0000000            je 004669CB
:004668FB C745F400000000          mov [ebp-0C], 00000000
:00466902 EB09                    jmp 0046690D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004669C6(U)
|
:00466904 8B45F4                  mov eax, dword ptr [ebp-0C]
:00466907 83C001                  add eax, 00000001
:0046690A 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00466902(U)
|
:0046690D 817DF4C8000000          cmp dword ptr [ebp-0C], 000000C8
:00466914 0F8DB1000000            jnl 004669CB
:0046691A 8A4DF4                  mov cl, byte ptr [ebp-0C]
:0046691D 51                      push ecx
:0046691E B970074B00              mov ecx, 004B0770
:00466923 E8A8C20000              call 00472BD0
:00466928 8B55F4                  mov edx, dword ptr [ebp-0C]
:0046692B 6BD20C                  imul edx, 0000000C
:0046692E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00466931 880411                  mov byte ptr [ecx+edx], al
:00466934 8B55F4                  mov edx, dword ptr [ebp-0C]
:00466937 6BD20C                  imul edx, 0000000C
:0046693A 8B4508                  mov eax, dword ptr [ebp+08]
:0046693D 8A4DF4                  mov cl, byte ptr [ebp-0C]
:00466940 884C1001                mov byte ptr [eax+edx+01], cl
:00466944 8A55F4                  mov dl, byte ptr [ebp-0C]
:00466947 52                      push edx
:00466948 B970074B00              mov ecx, 004B0770
:0046694D E89EC20000              call 00472BF0
:00466952 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00466955 6BC90C                  imul ecx, 0000000C
:00466958 8B5508                  mov edx, dword ptr [ebp+08]
:0046695B 88440A02                mov byte ptr [edx+ecx+02], al
:0046695F 8A45F4                  mov al, byte ptr [ebp-0C]
:00466962 50                      push eax
:00466963 B970074B00              mov ecx, 004B0770
:00466968 E8A3C20000              call 00472C10
:0046696D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00466970 6BC90C                  imul ecx, 0000000C
:00466973 8B5508                  mov edx, dword ptr [ebp+08]
:00466976 88440A03                mov byte ptr [edx+ecx+03], al
:0046697A 837D1000                cmp dword ptr [ebp+10], 00000000
:0046697E 7513                    jne 00466993
:00466980 8B45F4                  mov eax, dword ptr [ebp-0C]
:00466983 6BC00C                  imul eax, 0000000C
:00466986 8B4D08                  mov ecx, dword ptr [ebp+08]
:00466989 C744010401000000        mov [ecx+eax+04], 00000001
:00466991 EB22                    jmp 004669B5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046697E(C)
|
:00466993 8B55F4                  mov edx, dword ptr [ebp-0C]
:00466996 6BD20C                  imul edx, 0000000C
:00466999 8B4508                  mov eax, dword ptr [ebp+08]
:0046699C 8A0C10                  mov cl, byte ptr [eax+edx]
:0046699F 51                      push ecx
:004669A0 8B4D10                  mov ecx, dword ptr [ebp+10]
:004669A3 E85F0FFAFF              call 00407907
:004669A8 8B55F4                  mov edx, dword ptr [ebp-0C]
:004669AB 6BD20C                  imul edx, 0000000C
:004669AE 8B4D08                  mov ecx, dword ptr [ebp+08]
:004669B1 89441104                mov dword ptr [ecx+edx+04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00466991(U)
|
:004669B5 8B55F4                  mov edx, dword ptr [ebp-0C]
:004669B8 6BD20C                  imul edx, 0000000C
:004669BB 8B4508                  mov eax, dword ptr [ebp+08]
:004669BE C7441008FFFFFFFF        mov [eax+edx+08], FFFFFFFF
:004669C6 E939FFFFFF              jmp 00466904

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004668F5(C), :00466914(C)
|
:004669CB C745F800000000          mov [ebp-08], 00000000
:004669D2 EB09                    jmp 004669DD

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00466A3D(U), :00466A65(U)
|
:004669D4 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004669D7 83C101                  add ecx, 00000001
:004669DA 894DF8                  mov dword ptr [ebp-08], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004669D2(U)
|
:004669DD 817DF8C8000000          cmp dword ptr [ebp-08], 000000C8
:004669E4 0F8D80000000            jnl 00466A6A
:004669EA 8B55F8                  mov edx, dword ptr [ebp-08]
:004669ED 6BD20C                  imul edx, 0000000C
:004669F0 8B4508                  mov eax, dword ptr [ebp+08]
:004669F3 33C9                    xor ecx, ecx
:004669F5 8A0C10                  mov cl, byte ptr [eax+edx]
:004669F8 81F9FF000000            cmp ecx, 000000FF
:004669FE 743D                    je 00466A3D
:00466A00 8B55F8                  mov edx, dword ptr [ebp-08]
:00466A03 6BD20C                  imul edx, 0000000C
:00466A06 8B4508                  mov eax, dword ptr [ebp+08]
:00466A09 33C9                    xor ecx, ecx
:00466A0B 8A0C10                  mov cl, byte ptr [eax+edx]
:00466A0E 6BC919                  imul ecx, 00000019
:00466A11 81C140114A00            add ecx, 004A1140
:00466A17 E8CE5CFAFF              call 0040C6EA
:00466A1C 25FF000000              and eax, 000000FF
:00466A21 8B550C                  mov edx, dword ptr [ebp+0C]
:00466A24 81E2FF000000            and edx, 000000FF
:00466A2A 3BC2                    cmp eax, edx
:00466A2C 7411                    je 00466A3F
:00466A2E 8B450C                  mov eax, dword ptr [ebp+0C]
:00466A31 25FF000000              and eax, 000000FF
:00466A36 3DFF000000              cmp eax, 000000FF
:00466A3B 7402                    je 00466A3F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004669FE(C)
|
:00466A3D EB95                    jmp 004669D4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00466A2C(C), :00466A3B(C)
|
:00466A3F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00466A42 6BC90C                  imul ecx, 0000000C
:00466A45 8B5508                  mov edx, dword ptr [ebp+08]
:00466A48 03D1                    add edx, ecx
:00466A4A 52                      push edx
:00466A4B 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00466A4E E86D59FBFF              call 0041C3C0
:00466A53 50                      push eax
:00466A54 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00466A57 E827D3FFFF              call 00463D83
:00466A5C 8B45FC                  mov eax, dword ptr [ebp-04]
:00466A5F 83C001                  add eax, 00000001
:00466A62 8945FC                  mov dword ptr [ebp-04], eax
:00466A65 E96AFFFFFF              jmp 004669D4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004669E4(C)
|
:00466A6A 8B45FC                  mov eax, dword ptr [ebp-04]
:00466A6D 8BE5                    mov esp, ebp
:00466A6F 5D                      pop ebp
:00466A70 C21000                  ret 0010



* Referenced by a CALL at Addresses:
|:00467EBF   , :00468097   , :0046B656   
|
:00466A73 55                      push ebp
:00466A74 8BEC                    mov ebp, esp
:00466A76 83EC0C                  sub esp, 0000000C
:00466A79 894DF4                  mov dword ptr [ebp-0C], ecx
:00466A7C C745FC00000000          mov [ebp-04], 00000000
:00466A83 C745F800000000          mov [ebp-08], 00000000
:00466A8A EB09                    jmp 00466A95

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00466AF9(U), :00466B1F(U)
|
:00466A8C 8B45F8                  mov eax, dword ptr [ebp-08]
:00466A8F 83C001                  add eax, 00000001
:00466A92 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00466A8A(U)
|
:00466A95 837DF811                cmp dword ptr [ebp-08], 00000011
:00466A99 0F8D85000000            jnl 00466B24
:00466A9F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00466AA2 83C157                  add ecx, 00000057
:00466AA5 8B55F8                  mov edx, dword ptr [ebp-08]
:00466AA8 8B4508                  mov eax, dword ptr [ebp+08]
:00466AAB 880CD0                  mov byte ptr [eax+8*edx], cl
:00466AAE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00466AB1 8B5508                  mov edx, dword ptr [ebp+08]
:00466AB4 8A45F8                  mov al, byte ptr [ebp-08]
:00466AB7 8844CA01                mov byte ptr [edx+8*ecx+01], al
:00466ABB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00466ABE 8B5508                  mov edx, dword ptr [ebp+08]
:00466AC1 C644CA0200              mov [edx+8*ecx+02], 00
:00466AC6 8B45F8                  mov eax, dword ptr [ebp-08]
:00466AC9 8B4D08                  mov ecx, dword ptr [ebp+08]
:00466ACC C644C10300              mov [ecx+8*eax+03], 00
:00466AD1 8B55F8                  mov edx, dword ptr [ebp-08]
:00466AD4 8B4508                  mov eax, dword ptr [ebp+08]
:00466AD7 C744D00401000000        mov [eax+8*edx+04], 00000001
:00466ADF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00466AE2 83C157                  add ecx, 00000057
:00466AE5 51                      push ecx
:00466AE6 B970074B00              mov ecx, 004B0770
:00466AEB E84E70FAFF              call 0040DB3E
:00466AF0 25FF000000              and eax, 000000FF
:00466AF5 85C0                    test eax, eax
:00466AF7 7502                    jne 00466AFB
:00466AF9 EB91                    jmp 00466A8C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00466AF7(C)
|
:00466AFB 8B55F8                  mov edx, dword ptr [ebp-08]
:00466AFE 8B4508                  mov eax, dword ptr [ebp+08]
:00466B01 8D0CD0                  lea ecx, dword ptr [eax+8*edx]
:00466B04 51                      push ecx
:00466B05 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00466B08 E8B358FBFF              call 0041C3C0
:00466B0D 50                      push eax
:00466B0E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00466B11 E86DD2FFFF              call 00463D83
:00466B16 8B55FC                  mov edx, dword ptr [ebp-04]
:00466B19 83C201                  add edx, 00000001
:00466B1C 8955FC                  mov dword ptr [ebp-04], edx
:00466B1F E968FFFFFF              jmp 00466A8C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00466A99(C)
|
:00466B24 8B45FC                  mov eax, dword ptr [ebp-04]
:00466B27 8BE5                    mov esp, ebp
:00466B29 5D                      pop ebp
:00466B2A C20400                  ret 0004



* Referenced by a CALL at Address:
|:00468817   
|
:00466B2D 55                      push ebp
:00466B2E 8BEC                    mov ebp, esp
:00466B30 83EC14                  sub esp, 00000014
:00466B33 894DEC                  mov dword ptr [ebp-14], ecx
:00466B36 C745FC00000000          mov [ebp-04], 00000000
:00466B3D B970074B00              mov ecx, 004B0770
:00466B42 E84867FAFF              call 0040D28F
:00466B47 8845F8                  mov byte ptr [ebp-08], al
:00466B4A 837D1400                cmp dword ptr [ebp+14], 00000000
:00466B4E 0F8496000000            je 00466BEA
:00466B54 C745F000000000          mov [ebp-10], 00000000
:00466B5B EB09                    jmp 00466B66

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00466BE5(U)
|
:00466B5D 8B45F0                  mov eax, dword ptr [ebp-10]
:00466B60 83C001                  add eax, 00000001
:00466B63 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00466B5B(U)
|
:00466B66 837DF010                cmp dword ptr [ebp-10], 00000010
:00466B6A 7D7E                    jge 00466BEA
:00466B6C 8A4DF0                  mov cl, byte ptr [ebp-10]
:00466B6F 51                      push ecx
:00466B70 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00466B73 81E1FF000000            and ecx, 000000FF
:00466B79 6BC928                  imul ecx, 00000028
:00466B7C 81C168EB4A00            add ecx, 004AEB68
:00466B82 E8A9C00000              call 00472C30
:00466B87 8B55F0                  mov edx, dword ptr [ebp-10]
:00466B8A 8B4D08                  mov ecx, dword ptr [ebp+08]
:00466B8D 8804D1                  mov byte ptr [ecx+8*edx], al
:00466B90 8B55F0                  mov edx, dword ptr [ebp-10]
:00466B93 8B4508                  mov eax, dword ptr [ebp+08]
:00466B96 8A4DF0                  mov cl, byte ptr [ebp-10]
:00466B99 884CD001                mov byte ptr [eax+8*edx+01], cl
:00466B9D 8B55F0                  mov edx, dword ptr [ebp-10]
:00466BA0 8B4508                  mov eax, dword ptr [ebp+08]
:00466BA3 C644D00201              mov [eax+8*edx+02], 01
:00466BA8 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00466BAB 8B5508                  mov edx, dword ptr [ebp+08]
:00466BAE C644CA0300              mov [edx+8*ecx+03], 00
:00466BB3 837D1000                cmp dword ptr [ebp+10], 00000000
:00466BB7 7510                    jne 00466BC9
:00466BB9 8B45F0                  mov eax, dword ptr [ebp-10]
:00466BBC 8B4D08                  mov ecx, dword ptr [ebp+08]
:00466BBF C744C10401000000        mov [ecx+8*eax+04], 00000001
:00466BC7 EB1C                    jmp 00466BE5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00466BB7(C)
|
:00466BC9 8B55F0                  mov edx, dword ptr [ebp-10]
:00466BCC 8B4508                  mov eax, dword ptr [ebp+08]
:00466BCF 8A0CD0                  mov cl, byte ptr [eax+8*edx]
:00466BD2 51                      push ecx
:00466BD3 8B4D10                  mov ecx, dword ptr [ebp+10]
:00466BD6 E82C0DFAFF              call 00407907
:00466BDB 8B55F0                  mov edx, dword ptr [ebp-10]
:00466BDE 8B4D08                  mov ecx, dword ptr [ebp+08]
:00466BE1 8944D104                mov dword ptr [ecx+8*edx+04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00466BC7(U)
|
:00466BE5 E973FFFFFF              jmp 00466B5D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00466B4E(C), :00466B6A(C)
|
:00466BEA C745F400000000          mov [ebp-0C], 00000000
:00466BF1 EB09                    jmp 00466BFC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00466C53(U), :00466C79(U)
|
:00466BF3 8B55F4                  mov edx, dword ptr [ebp-0C]
:00466BF6 83C201                  add edx, 00000001
:00466BF9 8955F4                  mov dword ptr [ebp-0C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00466BF1(U)
|
:00466BFC 837DF410                cmp dword ptr [ebp-0C], 00000010
:00466C00 7D7C                    jge 00466C7E
:00466C02 8B45F4                  mov eax, dword ptr [ebp-0C]
:00466C05 8B4D08                  mov ecx, dword ptr [ebp+08]
:00466C08 33D2                    xor edx, edx
:00466C0A 8A14C1                  mov dl, byte ptr [ecx+8*eax]
:00466C0D 81FAFF000000            cmp edx, 000000FF
:00466C13 743E                    je 00466C53
:00466C15 8B45F4                  mov eax, dword ptr [ebp-0C]
:00466C18 8B4D08                  mov ecx, dword ptr [ebp+08]
:00466C1B 33D2                    xor edx, edx
:00466C1D 8A14C1                  mov dl, byte ptr [ecx+8*eax]
:00466C20 8BCA                    mov ecx, edx
:00466C22 6BC919                  imul ecx, 00000019
:00466C25 81C140114A00            add ecx, 004A1140
:00466C2B E8BA5AFAFF              call 0040C6EA
:00466C30 25FF000000              and eax, 000000FF
:00466C35 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00466C38 81E1FF000000            and ecx, 000000FF
:00466C3E 3BC1                    cmp eax, ecx
:00466C40 7413                    je 00466C55
:00466C42 8B550C                  mov edx, dword ptr [ebp+0C]
:00466C45 81E2FF000000            and edx, 000000FF
:00466C4B 81FAFF000000            cmp edx, 000000FF
:00466C51 7402                    je 00466C55

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00466C13(C)
|
:00466C53 EB9E                    jmp 00466BF3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00466C40(C), :00466C51(C)
|
:00466C55 8B45F4                  mov eax, dword ptr [ebp-0C]
:00466C58 8B4D08                  mov ecx, dword ptr [ebp+08]
:00466C5B 8D14C1                  lea edx, dword ptr [ecx+8*eax]
:00466C5E 52                      push edx
:00466C5F 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00466C62 E85957FBFF              call 0041C3C0
:00466C67 50                      push eax
:00466C68 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00466C6B E813D1FFFF              call 00463D83
:00466C70 8B45FC                  mov eax, dword ptr [ebp-04]
:00466C73 83C001                  add eax, 00000001
:00466C76 8945FC                  mov dword ptr [ebp-04], eax
:00466C79 E975FFFFFF              jmp 00466BF3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00466C00(C)
|
:00466C7E 8B45FC                  mov eax, dword ptr [ebp-04]
:00466C81 8BE5                    mov esp, ebp
:00466C83 5D                      pop ebp
:00466C84 C21000                  ret 0010



* Referenced by a CALL at Address:
|:00468BB4   
|
:00466C87 55                      push ebp
:00466C88 8BEC                    mov ebp, esp
:00466C8A 83EC14                  sub esp, 00000014
:00466C8D 894DEC                  mov dword ptr [ebp-14], ecx
:00466C90 C745F800000000          mov [ebp-08], 00000000
:00466C97 B970074B00              mov ecx, 004B0770
:00466C9C E8EE65FAFF              call 0040D28F
:00466CA1 8845F4                  mov byte ptr [ebp-0C], al
:00466CA4 C745F000000000          mov [ebp-10], 00000000
:00466CAB EB09                    jmp 00466CB6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00466D29(U), :00466D4F(U)
|
:00466CAD 8B45F0                  mov eax, dword ptr [ebp-10]
:00466CB0 83C001                  add eax, 00000001
:00466CB3 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00466CAB(U)
|
:00466CB6 837DF010                cmp dword ptr [ebp-10], 00000010
:00466CBA 0F8D94000000            jnl 00466D54
:00466CC0 8A4DF0                  mov cl, byte ptr [ebp-10]
:00466CC3 51                      push ecx
:00466CC4 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00466CC7 81E1FF000000            and ecx, 000000FF
:00466CCD 6BC928                  imul ecx, 00000028
:00466CD0 81C168EB4A00            add ecx, 004AEB68
:00466CD6 E875BF0000              call 00472C50
:00466CDB 25FF000000              and eax, 000000FF
:00466CE0 8945FC                  mov dword ptr [ebp-04], eax
:00466CE3 8B55F0                  mov edx, dword ptr [ebp-10]
:00466CE6 8B4508                  mov eax, dword ptr [ebp+08]
:00466CE9 8A4DFC                  mov cl, byte ptr [ebp-04]
:00466CEC 880CD0                  mov byte ptr [eax+8*edx], cl
:00466CEF 8B55F0                  mov edx, dword ptr [ebp-10]
:00466CF2 8B4508                  mov eax, dword ptr [ebp+08]
:00466CF5 8A4DF0                  mov cl, byte ptr [ebp-10]
:00466CF8 884CD001                mov byte ptr [eax+8*edx+01], cl
:00466CFC 8B55F0                  mov edx, dword ptr [ebp-10]
:00466CFF 8B4508                  mov eax, dword ptr [ebp+08]
:00466D02 C644D00200              mov [eax+8*edx+02], 00
:00466D07 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00466D0A 8B5508                  mov edx, dword ptr [ebp+08]
:00466D0D C644CA0300              mov [edx+8*ecx+03], 00
:00466D12 8B45F0                  mov eax, dword ptr [ebp-10]
:00466D15 8B4D08                  mov ecx, dword ptr [ebp+08]
:00466D18 C744C10401000000        mov [ecx+8*eax+04], 00000001
:00466D20 817DFCFF000000          cmp dword ptr [ebp-04], 000000FF
:00466D27 7502                    jne 00466D2B
:00466D29 EB82                    jmp 00466CAD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00466D27(C)
|
:00466D2B 8B55F0                  mov edx, dword ptr [ebp-10]
:00466D2E 8B4508                  mov eax, dword ptr [ebp+08]
:00466D31 8D0CD0                  lea ecx, dword ptr [eax+8*edx]
:00466D34 51                      push ecx
:00466D35 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00466D38 E88356FBFF              call 0041C3C0
:00466D3D 50                      push eax
:00466D3E 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00466D41 E83DD0FFFF              call 00463D83
:00466D46 8B55F8                  mov edx, dword ptr [ebp-08]
:00466D49 83C201                  add edx, 00000001
:00466D4C 8955F8                  mov dword ptr [ebp-08], edx
:00466D4F E959FFFFFF              jmp 00466CAD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00466CBA(C)
|
:00466D54 8B45F8                  mov eax, dword ptr [ebp-08]
:00466D57 8BE5                    mov esp, ebp
:00466D59 5D                      pop ebp
:00466D5A C20400                  ret 0004



* Referenced by a CALL at Address:
|:0046800D   
|
:00466D5D 55                      push ebp
:00466D5E 8BEC                    mov ebp, esp
:00466D60 83EC0C                  sub esp, 0000000C
:00466D63 894DF4                  mov dword ptr [ebp-0C], ecx
:00466D66 C745FC00000000          mov [ebp-04], 00000000
:00466D6D C745F800000000          mov [ebp-08], 00000000
:00466D74 EB09                    jmp 00466D7F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00466E76(U), :00466EA1(U)
|
:00466D76 8B45F8                  mov eax, dword ptr [ebp-08]
:00466D79 83C001                  add eax, 00000001
:00466D7C 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00466D74(U)
|
:00466D7F 817DF8AE000000          cmp dword ptr [ebp-08], 000000AE
:00466D86 0F831A010000            jnb 00466EA6
:00466D8C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00466D8F 51                      push ecx
:00466D90 E8FB33FBFF              call 0041A190
:00466D95 83C404                  add esp, 00000004
:00466D98 85C0                    test eax, eax
:00466D9A 0F8401010000            je 00466EA1
:00466DA0 8A550C                  mov dl, byte ptr [ebp+0C]
:00466DA3 52                      push edx
:00466DA4 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00466DA7 6BC948                  imul ecx, 00000048
:00466DAA 81C1681B4A00            add ecx, 004A1B68
:00466DB0 E83BF8F9FF              call 004065F0
:00466DB5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00466DB8 6BC90C                  imul ecx, 0000000C
:00466DBB 8B5508                  mov edx, dword ptr [ebp+08]
:00466DBE 88040A                  mov byte ptr [edx+ecx], al
:00466DC1 8B45FC                  mov eax, dword ptr [ebp-04]
:00466DC4 6BC00C                  imul eax, 0000000C
:00466DC7 8B4D08                  mov ecx, dword ptr [ebp+08]
:00466DCA 8A55FC                  mov dl, byte ptr [ebp-04]
:00466DCD 88540101                mov byte ptr [ecx+eax+01], dl
:00466DD1 8A450C                  mov al, byte ptr [ebp+0C]
:00466DD4 50                      push eax
:00466DD5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00466DD8 6BC948                  imul ecx, 00000048
:00466DDB 81C1681B4A00            add ecx, 004A1B68
:00466DE1 E8FA27FAFF              call 004095E0
:00466DE6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00466DE9 6BC90C                  imul ecx, 0000000C
:00466DEC 8B5508                  mov edx, dword ptr [ebp+08]
:00466DEF 88440A02                mov byte ptr [edx+ecx+02], al
:00466DF3 8A450C                  mov al, byte ptr [ebp+0C]
:00466DF6 50                      push eax
:00466DF7 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00466DFA 6BC948                  imul ecx, 00000048
:00466DFD 81C1681B4A00            add ecx, 004A1B68
:00466E03 E87828FAFF              call 00409680
:00466E08 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00466E0B 6BC90C                  imul ecx, 0000000C
:00466E0E 8B5508                  mov edx, dword ptr [ebp+08]
:00466E11 88440A03                mov byte ptr [edx+ecx+03], al
:00466E15 837D1000                cmp dword ptr [ebp+10], 00000000
:00466E19 7513                    jne 00466E2E
:00466E1B 8B45F8                  mov eax, dword ptr [ebp-08]
:00466E1E 6BC00C                  imul eax, 0000000C
:00466E21 8B4D08                  mov ecx, dword ptr [ebp+08]
:00466E24 C744010401000000        mov [ecx+eax+04], 00000001
:00466E2C EB22                    jmp 00466E50

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00466E19(C)
|
:00466E2E 8B55F8                  mov edx, dword ptr [ebp-08]
:00466E31 6BD20C                  imul edx, 0000000C
:00466E34 8B4508                  mov eax, dword ptr [ebp+08]
:00466E37 8A0C10                  mov cl, byte ptr [eax+edx]
:00466E3A 51                      push ecx
:00466E3B 8B4D10                  mov ecx, dword ptr [ebp+10]
:00466E3E E8C40AFAFF              call 00407907
:00466E43 8B55F8                  mov edx, dword ptr [ebp-08]
:00466E46 6BD20C                  imul edx, 0000000C
:00466E49 8B4D08                  mov ecx, dword ptr [ebp+08]
:00466E4C 89441104                mov dword ptr [ecx+edx+04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00466E2C(U)
|
:00466E50 8B55FC                  mov edx, dword ptr [ebp-04]
:00466E53 6BD20C                  imul edx, 0000000C
:00466E56 8B4508                  mov eax, dword ptr [ebp+08]
:00466E59 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00466E5C 894C1008                mov dword ptr [eax+edx+08], ecx
:00466E60 8B55FC                  mov edx, dword ptr [ebp-04]
:00466E63 6BD20C                  imul edx, 0000000C
:00466E66 8B4508                  mov eax, dword ptr [ebp+08]
:00466E69 33C9                    xor ecx, ecx
:00466E6B 8A0C10                  mov cl, byte ptr [eax+edx]
:00466E6E 81F9FF000000            cmp ecx, 000000FF
:00466E74 7505                    jne 00466E7B
:00466E76 E9FBFEFFFF              jmp 00466D76

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00466E74(C)
|
:00466E7B 8B55FC                  mov edx, dword ptr [ebp-04]
:00466E7E 6BD20C                  imul edx, 0000000C
:00466E81 8B4508                  mov eax, dword ptr [ebp+08]
:00466E84 03C2                    add eax, edx
:00466E86 50                      push eax
:00466E87 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00466E8A E83155FBFF              call 0041C3C0
:00466E8F 50                      push eax
:00466E90 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00466E93 E8EBCEFFFF              call 00463D83
:00466E98 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00466E9B 83C101                  add ecx, 00000001
:00466E9E 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00466D9A(C)
|
:00466EA1 E9D0FEFFFF              jmp 00466D76

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00466D86(C)
|
:00466EA6 8B45FC                  mov eax, dword ptr [ebp-04]
:00466EA9 8BE5                    mov esp, ebp
:00466EAB 5D                      pop ebp
:00466EAC C20C00                  ret 000C


:00466EAF 55                      push ebp
:00466EB0 8BEC                    mov ebp, esp
:00466EB2 83EC08                  sub esp, 00000008
:00466EB5 894DFC                  mov dword ptr [ebp-04], ecx
:00466EB8 8B45FC                  mov eax, dword ptr [ebp-04]
:00466EBB 8B4818                  mov ecx, dword ptr [eax+18]
:00466EBE 8B5508                  mov edx, dword ptr [ebp+08]
:00466EC1 8B0491                  mov eax, dword ptr [ecx+4*edx]
:00466EC4 8945F8                  mov dword ptr [ebp-08], eax
:00466EC7 837DF80C                cmp dword ptr [ebp-08], 0000000C
:00466ECB 0F87A8010000            ja 00467079
:00466ED1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00466ED4 FF248D81704600          jmp dword ptr [4*ecx+00467081]
:00466EDB 68086C4800              push 00486C08
:00466EE0 6A00                    push 00000000
:00466EE2 6811100000              push 00001011
:00466EE7 8B55FC                  mov edx, dword ptr [ebp-04]
:00466EEA 8B4210                  mov eax, dword ptr [edx+10]
:00466EED 50                      push eax
:00466EEE FF15F4624800            call dword ptr [004862F4]
:00466EF4 83C017                  add eax, 00000017
:00466EF7 E97F010000              jmp 0046707B
:00466EFC 68C46A4800              push 00486AC4
:00466F01 6A00                    push 00000000
:00466F03 6811100000              push 00001011
:00466F08 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00466F0B 8B5110                  mov edx, dword ptr [ecx+10]
:00466F0E 52                      push edx
:00466F0F FF15F4624800            call dword ptr [004862F4]
:00466F15 83C00C                  add eax, 0000000C
:00466F18 E95E010000              jmp 0046707B
:00466F1D 68D46A4800              push 00486AD4
:00466F22 6A00                    push 00000000
:00466F24 6811100000              push 00001011
:00466F29 8B45FC                  mov eax, dword ptr [ebp-04]
:00466F2C 8B4810                  mov ecx, dword ptr [eax+10]
:00466F2F 51                      push ecx
:00466F30 FF15F4624800            call dword ptr [004862F4]
:00466F36 83C00A                  add eax, 0000000A
:00466F39 E93D010000              jmp 0046707B
:00466F3E 68386B4800              push 00486B38
:00466F43 6A00                    push 00000000
:00466F45 6811100000              push 00001011
:00466F4A 8B55FC                  mov edx, dword ptr [ebp-04]
:00466F4D 8B4210                  mov eax, dword ptr [edx+10]
:00466F50 50                      push eax
:00466F51 FF15F4624800            call dword ptr [004862F4]
:00466F57 83C00C                  add eax, 0000000C
:00466F5A E91C010000              jmp 0046707B
:00466F5F 68186C4800              push 00486C18
:00466F64 6A00                    push 00000000
:00466F66 6811100000              push 00001011
:00466F6B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00466F6E 8B5110                  mov edx, dword ptr [ecx+10]
:00466F71 52                      push edx
:00466F72 FF15F4624800            call dword ptr [004862F4]
:00466F78 83C00C                  add eax, 0000000C
:00466F7B E9FB000000              jmp 0046707B
:00466F80 68486B4800              push 00486B48
:00466F85 6A00                    push 00000000
:00466F87 6811100000              push 00001011
:00466F8C 8B45FC                  mov eax, dword ptr [ebp-04]
:00466F8F 8B4810                  mov ecx, dword ptr [eax+10]
:00466F92 51                      push ecx
:00466F93 FF15F4624800            call dword ptr [004862F4]
:00466F99 83C00C                  add eax, 0000000C
:00466F9C E9DA000000              jmp 0046707B
:00466FA1 68506B4800              push 00486B50
:00466FA6 6A00                    push 00000000
:00466FA8 6811100000              push 00001011
:00466FAD 8B55FC                  mov edx, dword ptr [ebp-04]
:00466FB0 8B4210                  mov eax, dword ptr [edx+10]
:00466FB3 50                      push eax
:00466FB4 FF15F4624800            call dword ptr [004862F4]
:00466FBA 83C00C                  add eax, 0000000C
:00466FBD E9B9000000              jmp 0046707B
:00466FC2 68506B4800              push 00486B50
:00466FC7 6A00                    push 00000000
:00466FC9 6811100000              push 00001011
:00466FCE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00466FD1 8B5110                  mov edx, dword ptr [ecx+10]
:00466FD4 52                      push edx
:00466FD5 FF15F4624800            call dword ptr [004862F4]
:00466FDB 83C00C                  add eax, 0000000C
:00466FDE E998000000              jmp 0046707B
:00466FE3 68606B4800              push 00486B60
:00466FE8 6A00                    push 00000000
:00466FEA 6811100000              push 00001011
:00466FEF 8B45FC                  mov eax, dword ptr [ebp-04]
:00466FF2 8B4810                  mov ecx, dword ptr [eax+10]
:00466FF5 51                      push ecx
:00466FF6 FF15F4624800            call dword ptr [004862F4]
:00466FFC 83C00C                  add eax, 0000000C
:00466FFF EB7A                    jmp 0046707B
:00467001 68686B4800              push 00486B68
:00467006 6A00                    push 00000000
:00467008 6811100000              push 00001011
:0046700D 8B55FC                  mov edx, dword ptr [ebp-04]
:00467010 8B4210                  mov eax, dword ptr [edx+10]
:00467013 50                      push eax
:00467014 FF15F4624800            call dword ptr [004862F4]
:0046701A 83C00C                  add eax, 0000000C
:0046701D EB5C                    jmp 0046707B
:0046701F 68886B4800              push 00486B88
:00467024 6A00                    push 00000000
:00467026 6811100000              push 00001011
:0046702B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046702E 8B5110                  mov edx, dword ptr [ecx+10]
:00467031 52                      push edx
:00467032 FF15F4624800            call dword ptr [004862F4]
:00467038 83C00C                  add eax, 0000000C
:0046703B EB3E                    jmp 0046707B
:0046703D 68706B4800              push 00486B70
:00467042 6A00                    push 00000000
:00467044 6811100000              push 00001011
:00467049 8B45FC                  mov eax, dword ptr [ebp-04]
:0046704C 8B4810                  mov ecx, dword ptr [eax+10]
:0046704F 51                      push ecx
:00467050 FF15F4624800            call dword ptr [004862F4]
:00467056 83C00C                  add eax, 0000000C
:00467059 EB20                    jmp 0046707B
:0046705B 68806B4800              push 00486B80
:00467060 6A00                    push 00000000
:00467062 6811100000              push 00001011
:00467067 8B55FC                  mov edx, dword ptr [ebp-04]
:0046706A 8B4210                  mov eax, dword ptr [edx+10]
:0046706D 50                      push eax
:0046706E FF15F4624800            call dword ptr [004862F4]
:00467074 83C00C                  add eax, 0000000C
:00467077 EB02                    jmp 0046707B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00466ECB(C)
|
:00467079 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00466EF7(U), :00466F18(U), :00466F39(U), :00466F5A(U), :00466F7B(U)
|:00466F9C(U), :00466FBD(U), :00466FDE(U), :00466FFF(U), :0046701D(U)
|:0046703B(U), :00467059(U), :00467077(U)
|
:0046707B 8BE5                    mov esp, ebp
:0046707D 5D                      pop ebp
:0046707E C20400                  ret 0004



:00467081 DB6E4600                DWORD 00466EDB
:00467085 FC6E4600                DWORD 00466EFC
:00467089 1D6F4600                DWORD 00466F1D
:0046708D 3E6F4600                DWORD 00466F3E
:00467091 5F6F4600                DWORD 00466F5F
:00467095 806F4600                DWORD 00466F80
:00467099 A16F4600                DWORD 00466FA1
:0046709D 01704600                DWORD 00467001
:004670A1 1F704600                DWORD 0046701F
:004670A5 C26F4600                DWORD 00466FC2
:004670A9 3D704600                DWORD 0046703D
:004670AD E36F4600                DWORD 00466FE3
:004670B1 5B704600                DWORD 0046705B


:004670B5 55                      push ebp
:004670B6 8BEC                    mov ebp, esp
:004670B8 83EC0C                  sub esp, 0000000C
:004670BB 894DF4                  mov dword ptr [ebp-0C], ecx
:004670BE 8B4508                  mov eax, dword ptr [ebp+08]
:004670C1 50                      push eax
:004670C2 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004670C5 E8CFD4FFFF              call 00464599
:004670CA 6A02                    push 00000002
:004670CC 8B4D08                  mov ecx, dword ptr [ebp+08]
:004670CF 8B5108                  mov edx, dword ptr [ecx+08]
:004670D2 52                      push edx
:004670D3 682C100000              push 0000102C
:004670D8 8B45F4                  mov eax, dword ptr [ebp-0C]
:004670DB 8B4810                  mov ecx, dword ptr [eax+10]
:004670DE 51                      push ecx
:004670DF FF15F4624800            call dword ptr [004862F4]
:004670E5 33D2                    xor edx, edx
:004670E7 83F802                  cmp eax, 00000002

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004670A2(C)
|
:004670EA 0F94C2                  sete dl
:004670ED 8955FC                  mov dword ptr [ebp-04], edx
:004670F0 8B4508                  mov eax, dword ptr [ebp+08]
:004670F3 8B4808                  mov ecx, dword ptr [eax+08]
:004670F6 51                      push ecx
:004670F7 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004670FA E89DCEFFFF              call 00463F9C
:004670FF 8945F8                  mov dword ptr [ebp-08], eax
:00467102 837DFC00                cmp dword ptr [ebp-04], 00000000
:00467106 7538                    jne 00467140
:00467108 8B5508                  mov edx, dword ptr [ebp+08]
:0046710B 8B4208                  mov eax, dword ptr [edx+08]
:0046710E 50                      push eax
:0046710F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00467112 8B11                    mov edx, dword ptr [ecx]
:00467114 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00467117 FF5220                  call [edx+20]
:0046711A 85C0                    test eax, eax
:0046711C 7422                    je 00467140
:0046711E 8B45F8                  mov eax, dword ptr [ebp-08]
:00467121 33C9                    xor ecx, ecx
:00467123 8A4801                  mov cl, byte ptr [eax+01]
:00467126 81F9C8000000            cmp ecx, 000000C8
:0046712C 7512                    jne 00467140
:0046712E 680000FF00              push 00FF0000
:00467133 8B5508                  mov edx, dword ptr [ebp+08]
:00467136 8B4218                  mov eax, dword ptr [edx+18]
:00467139 50                      push eax
:0046713A FF1584604800            call dword ptr [00486084]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00467106(C), :0046711C(C), :0046712C(C)
|
:00467140 8BE5                    mov esp, ebp
:00467142 5D                      pop ebp
:00467143 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0046889D   , :00468C2F   
|
:00467146 55                      push ebp
:00467147 8BEC                    mov ebp, esp
:00467149 83EC0C                  sub esp, 0000000C
:0046714C 894DF8                  mov dword ptr [ebp-08], ecx
:0046714F 837D0800                cmp dword ptr [ebp+08], 00000000
:00467153 7C48                    jl 0046719D
:00467155 8B4508                  mov eax, dword ptr [ebp+08]
:00467158 50                      push eax
:00467159 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046715C E83BCEFFFF              call 00463F9C
:00467161 8945FC                  mov dword ptr [ebp-04], eax
:00467164 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00467167 83790400                cmp dword ptr [ecx+04], 00000000
:0046716B 7524                    jne 00467191
:0046716D 8B55FC                  mov edx, dword ptr [ebp-04]
:00467170 33C0                    xor eax, eax
:00467172 8A02                    mov al, byte ptr [edx]
:00467174 8BC8                    mov ecx, eax
:00467176 6BC919                  imul ecx, 00000019
:00467179 81C140114A00            add ecx, 004A1140
:0046717F E8A655FAFF              call 0040C72A
:00467184 85C0                    test eax, eax
:00467186 7409                    je 00467191
:00467188 C745F400000000          mov [ebp-0C], 00000000
:0046718F EB07                    jmp 00467198

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046716B(C), :00467186(C)
|
:00467191 C745F401000000          mov [ebp-0C], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046718F(U)
|
:00467198 8B45F4                  mov eax, dword ptr [ebp-0C]
:0046719B EB02                    jmp 0046719F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467153(C)
|
:0046719D 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046719B(U)
|
:0046719F 8BE5                    mov esp, ebp
:004671A1 5D                      pop ebp
:004671A2 C20400                  ret 0004


:004671A5 55                      push ebp
:004671A6 8BEC                    mov ebp, esp
:004671A8 83EC14                  sub esp, 00000014
:004671AB 53                      push ebx
:004671AC 56                      push esi
:004671AD 894DF0                  mov dword ptr [ebp-10], ecx
:004671B0 C745FC00000000          mov [ebp-04], 00000000
:004671B7 8B4508                  mov eax, dword ptr [ebp+08]
:004671BA 8945F8                  mov dword ptr [ebp-08], eax
:004671BD 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004671C0 894DF4                  mov dword ptr [ebp-0C], ecx
:004671C3 8B5510                  mov edx, dword ptr [ebp+10]
:004671C6 8955EC                  mov dword ptr [ebp-14], edx
:004671C9 837DEC0C                cmp dword ptr [ebp-14], 0000000C
:004671CD 0F8764040000            ja 00467637
:004671D3 8B45EC                  mov eax, dword ptr [ebp-14]
:004671D6 FF248542764600          jmp dword ptr [4*eax+00467642]
:004671DD 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004671E0 33D2                    xor edx, edx
:004671E2 8A11                    mov dl, byte ptr [ecx]
:004671E4 8B45F4                  mov eax, dword ptr [ebp-0C]
:004671E7 33C9                    xor ecx, ecx
:004671E9 8A08                    mov cl, byte ptr [eax]
:004671EB 2BD1                    sub edx, ecx
:004671ED 8955FC                  mov dword ptr [ebp-04], edx
:004671F0 E942040000              jmp 00467637
:004671F5 8B55F4                  mov edx, dword ptr [ebp-0C]
:004671F8 33C0                    xor eax, eax
:004671FA 8A02                    mov al, byte ptr [edx]
:004671FC 8BC8                    mov ecx, eax
:004671FE 6BC919                  imul ecx, 00000019
:00467201 81C140114A00            add ecx, 004A1140
:00467207 E8DE54FAFF              call 0040C6EA
:0046720C 25FF000000              and eax, 000000FF
:00467211 83F802                  cmp eax, 00000002
:00467214 7D0D                    jge 00467223
:00467216 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00467219 33D2                    xor edx, edx
:0046721B 8A5102                  mov dl, byte ptr [ecx+02]
:0046721E 8955FC                  mov dword ptr [ebp-04], edx
:00467221 EB07                    jmp 0046722A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467214(C)
|
:00467223 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467221(U)
|
:0046722A 8B45F8                  mov eax, dword ptr [ebp-08]
:0046722D 33C9                    xor ecx, ecx
:0046722F 8A08                    mov cl, byte ptr [eax]
:00467231 6BC919                  imul ecx, 00000019
:00467234 81C140114A00            add ecx, 004A1140
:0046723A E8AB54FAFF              call 0040C6EA
:0046723F 25FF000000              and eax, 000000FF
:00467244 83F802                  cmp eax, 00000002
:00467247 7D12                    jge 0046725B
:00467249 8B55F8                  mov edx, dword ptr [ebp-08]
:0046724C 33C0                    xor eax, eax
:0046724E 8A4202                  mov al, byte ptr [edx+02]
:00467251 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00467254 2BC8                    sub ecx, eax
:00467256 894DFC                  mov dword ptr [ebp-04], ecx
:00467259 EB09                    jmp 00467264

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467247(C)
|
:0046725B 8B55FC                  mov edx, dword ptr [ebp-04]
:0046725E 83C201                  add edx, 00000001
:00467261 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467259(U)
|
:00467264 E9CE030000              jmp 00467637
:00467269 8B45F4                  mov eax, dword ptr [ebp-0C]
:0046726C 33C9                    xor ecx, ecx
:0046726E 8A08                    mov cl, byte ptr [eax]
:00467270 6BC919                  imul ecx, 00000019
:00467273 81C140114A00            add ecx, 004A1140
:00467279 E86C54FAFF              call 0040C6EA
:0046727E 25FF000000              and eax, 000000FF
:00467283 83F802                  cmp eax, 00000002
:00467286 7D0D                    jge 00467295
:00467288 8B55F4                  mov edx, dword ptr [ebp-0C]
:0046728B 33C0                    xor eax, eax
:0046728D 8A4203                  mov al, byte ptr [edx+03]
:00467290 8945FC                  mov dword ptr [ebp-04], eax
:00467293 EB07                    jmp 0046729C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467286(C)
|
:00467295 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467293(U)
|
:0046729C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046729F 33D2                    xor edx, edx
:004672A1 8A11                    mov dl, byte ptr [ecx]
:004672A3 8BCA                    mov ecx, edx
:004672A5 6BC919                  imul ecx, 00000019
:004672A8 81C140114A00            add ecx, 004A1140
:004672AE E83754FAFF              call 0040C6EA
:004672B3 25FF000000              and eax, 000000FF
:004672B8 83F802                  cmp eax, 00000002
:004672BB 7D12                    jge 004672CF
:004672BD 8B45F8                  mov eax, dword ptr [ebp-08]
:004672C0 33C9                    xor ecx, ecx
:004672C2 8A4803                  mov cl, byte ptr [eax+03]
:004672C5 8B55FC                  mov edx, dword ptr [ebp-04]
:004672C8 2BD1                    sub edx, ecx
:004672CA 8955FC                  mov dword ptr [ebp-04], edx
:004672CD EB09                    jmp 004672D8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004672BB(C)
|
:004672CF 8B45FC                  mov eax, dword ptr [ebp-04]
:004672D2 83C001                  add eax, 00000001
:004672D5 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004672CD(U)
|
:004672D8 E95A030000              jmp 00467637
:004672DD 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004672E0 33D2                    xor edx, edx
:004672E2 8A11                    mov dl, byte ptr [ecx]
:004672E4 8BCA                    mov ecx, edx
:004672E6 6BC919                  imul ecx, 00000019
:004672E9 81C140114A00            add ecx, 004A1140
:004672EF E84C22FAFF              call 00409540
:004672F4 8AD8                    mov bl, al
:004672F6 81E3FF000000            and ebx, 000000FF
:004672FC 8B45F4                  mov eax, dword ptr [ebp-0C]
:004672FF 33C9                    xor ecx, ecx
:00467301 8A08                    mov cl, byte ptr [eax]
:00467303 6BC919                  imul ecx, 00000019
:00467306 81C140114A00            add ecx, 004A1140
:0046730C E82F22FAFF              call 00409540
:00467311 25FF000000              and eax, 000000FF
:00467316 2BD8                    sub ebx, eax
:00467318 895DFC                  mov dword ptr [ebp-04], ebx
:0046731B E917030000              jmp 00467637
:00467320 8B55F4                  mov edx, dword ptr [ebp-0C]
:00467323 33C0                    xor eax, eax
:00467325 8A02                    mov al, byte ptr [edx]
:00467327 8BC8                    mov ecx, eax
:00467329 6BC919                  imul ecx, 00000019
:0046732C 81C140114A00            add ecx, 004A1140
:00467332 E81554FAFF              call 0040C74C
:00467337 85C0                    test eax, eax
:00467339 7426                    je 00467361
:0046733B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046733E 8A5102                  mov dl, byte ptr [ecx+02]
:00467341 52                      push edx
:00467342 8B45F4                  mov eax, dword ptr [ebp-0C]
:00467345 33C9                    xor ecx, ecx
:00467347 8A08                    mov cl, byte ptr [eax]
:00467349 6BC919                  imul ecx, 00000019
:0046734C 81C140114A00            add ecx, 004A1140
:00467352 E81D53FAFF              call 0040C674
:00467357 25FF000000              and eax, 000000FF
:0046735C 8945FC                  mov dword ptr [ebp-04], eax
:0046735F EB15                    jmp 00467376

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467339(C)
|
:00467361 6A00                    push 00000000
:00467363 8B55F4                  mov edx, dword ptr [ebp-0C]
:00467366 33C0                    xor eax, eax
:00467368 8A02                    mov al, byte ptr [edx]
:0046736A 50                      push eax
:0046736B E84BAEFFFF              call 004621BB
:00467370 83C408                  add esp, 00000008
:00467373 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046735F(U)
|
:00467376 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00467379 33D2                    xor edx, edx
:0046737B 8A11                    mov dl, byte ptr [ecx]
:0046737D 8BCA                    mov ecx, edx
:0046737F 6BC919                  imul ecx, 00000019
:00467382 81C140114A00            add ecx, 004A1140
:00467388 E8BF53FAFF              call 0040C74C
:0046738D 85C0                    test eax, eax
:0046738F 742D                    je 004673BE
:00467391 8B45F8                  mov eax, dword ptr [ebp-08]
:00467394 8A4802                  mov cl, byte ptr [eax+02]
:00467397 51                      push ecx
:00467398 8B55F8                  mov edx, dword ptr [ebp-08]
:0046739B 33C0                    xor eax, eax
:0046739D 8A02                    mov al, byte ptr [edx]
:0046739F 8BC8                    mov ecx, eax
:004673A1 6BC919                  imul ecx, 00000019
:004673A4 81C140114A00            add ecx, 004A1140
:004673AA E8C552FAFF              call 0040C674
:004673AF 25FF000000              and eax, 000000FF
:004673B4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004673B7 2BC8                    sub ecx, eax
:004673B9 894DFC                  mov dword ptr [ebp-04], ecx
:004673BC EB1A                    jmp 004673D8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046738F(C)
|
:004673BE 6A00                    push 00000000
:004673C0 8B55F8                  mov edx, dword ptr [ebp-08]
:004673C3 33C0                    xor eax, eax
:004673C5 8A02                    mov al, byte ptr [edx]
:004673C7 50                      push eax
:004673C8 E8EEADFFFF              call 004621BB
:004673CD 83C408                  add esp, 00000008
:004673D0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004673D3 2BC8                    sub ecx, eax
:004673D5 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004673BC(U)
|
:004673D8 E95A020000              jmp 00467637
:004673DD 8B55F8                  mov edx, dword ptr [ebp-08]
:004673E0 33C0                    xor eax, eax
:004673E2 8A02                    mov al, byte ptr [edx]
:004673E4 8BC8                    mov ecx, eax
:004673E6 6BC919                  imul ecx, 00000019
:004673E9 81C140114A00            add ecx, 004A1140
:004673EF E87C6CFAFF              call 0040E070
:004673F4 8BF0                    mov esi, eax
:004673F6 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004673F9 33D2                    xor edx, edx
:004673FB 8A11                    mov dl, byte ptr [ecx]
:004673FD 8BCA                    mov ecx, edx
:004673FF 6BC919                  imul ecx, 00000019
:00467402 81C140114A00            add ecx, 004A1140
:00467408 E8636CFAFF              call 0040E070
:0046740D 2BF0                    sub esi, eax
:0046740F 8975FC                  mov dword ptr [ebp-04], esi
:00467412 E920020000              jmp 00467637
:00467417 8B45F8                  mov eax, dword ptr [ebp-08]
:0046741A 8A4802                  mov cl, byte ptr [eax+02]
:0046741D 51                      push ecx
:0046741E 8B55F8                  mov edx, dword ptr [ebp-08]
:00467421 33C0                    xor eax, eax
:00467423 8A02                    mov al, byte ptr [edx]
:00467425 8BC8                    mov ecx, eax
:00467427 6BC919                  imul ecx, 00000019
:0046742A 81C140114A00            add ecx, 004A1140
:00467430 E87453FAFF              call 0040C7A9
:00467435 8BF0                    mov esi, eax
:00467437 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046743A 8A5102                  mov dl, byte ptr [ecx+02]
:0046743D 52                      push edx
:0046743E 8B45F4                  mov eax, dword ptr [ebp-0C]
:00467441 33C9                    xor ecx, ecx
:00467443 8A08                    mov cl, byte ptr [eax]
:00467445 6BC919                  imul ecx, 00000019
:00467448 81C140114A00            add ecx, 004A1140
:0046744E E85653FAFF              call 0040C7A9
:00467453 2BF0                    sub esi, eax
:00467455 8975FC                  mov dword ptr [ebp-04], esi
:00467458 E9DA010000              jmp 00467637
:0046745D 8B55F4                  mov edx, dword ptr [ebp-0C]
:00467460 33C0                    xor eax, eax
:00467462 8A02                    mov al, byte ptr [edx]
:00467464 8BC8                    mov ecx, eax
:00467466 6BC919                  imul ecx, 00000019
:00467469 81C140114A00            add ecx, 004A1140
:0046746F E8B652FAFF              call 0040C72A
:00467474 85C0                    test eax, eax
:00467476 741A                    je 00467492
:00467478 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046747B 8A11                    mov dl, byte ptr [ecx]
:0046747D 52                      push edx
:0046747E B970074B00              mov ecx, 004B0770
:00467483 E8B362FAFF              call 0040D73B
:00467488 25FF000000              and eax, 000000FF
:0046748D 8945FC                  mov dword ptr [ebp-04], eax
:00467490 EB18                    jmp 004674AA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467476(C)
|
:00467492 8B45F4                  mov eax, dword ptr [ebp-0C]
:00467495 8A08                    mov cl, byte ptr [eax]
:00467497 51                      push ecx
:00467498 B970074B00              mov ecx, 004B0770
:0046749D E89C66FAFF              call 0040DB3E
:004674A2 25FF000000              and eax, 000000FF
:004674A7 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467490(U)
|
:004674AA 8B55F8                  mov edx, dword ptr [ebp-08]
:004674AD 33C0                    xor eax, eax
:004674AF 8A02                    mov al, byte ptr [edx]
:004674B1 8BC8                    mov ecx, eax
:004674B3 6BC919                  imul ecx, 00000019
:004674B6 81C140114A00            add ecx, 004A1140
:004674BC E86952FAFF              call 0040C72A
:004674C1 85C0                    test eax, eax
:004674C3 741F                    je 004674E4
:004674C5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004674C8 8A11                    mov dl, byte ptr [ecx]
:004674CA 52                      push edx
:004674CB B970074B00              mov ecx, 004B0770
:004674D0 E86662FAFF              call 0040D73B
:004674D5 25FF000000              and eax, 000000FF
:004674DA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004674DD 2BC8                    sub ecx, eax
:004674DF 894DFC                  mov dword ptr [ebp-04], ecx
:004674E2 EB1D                    jmp 00467501

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004674C3(C)
|
:004674E4 8B55F8                  mov edx, dword ptr [ebp-08]
:004674E7 8A02                    mov al, byte ptr [edx]
:004674E9 50                      push eax
:004674EA B970074B00              mov ecx, 004B0770
:004674EF E84A66FAFF              call 0040DB3E
:004674F4 25FF000000              and eax, 000000FF
:004674F9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004674FC 2BC8                    sub ecx, eax
:004674FE 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004674E2(U)
|
:00467501 E931010000              jmp 00467637
:00467506 8B55F4                  mov edx, dword ptr [ebp-0C]
:00467509 33C0                    xor eax, eax
:0046750B 8A02                    mov al, byte ptr [edx]
:0046750D 8BC8                    mov ecx, eax
:0046750F 6BC919                  imul ecx, 00000019
:00467512 81C140114A00            add ecx, 004A1140
:00467518 E80D52FAFF              call 0040C72A
:0046751D 85C0                    test eax, eax
:0046751F 7434                    je 00467555
:00467521 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00467524 8A11                    mov dl, byte ptr [ecx]
:00467526 52                      push edx
:00467527 B970074B00              mov ecx, 004B0770
:0046752C E80A62FAFF              call 0040D73B
:00467531 8AD8                    mov bl, al
:00467533 81E3FF000000            and ebx, 000000FF
:00467539 8B45F4                  mov eax, dword ptr [ebp-0C]
:0046753C 33C9                    xor ecx, ecx
:0046753E 8A08                    mov cl, byte ptr [eax]
:00467540 51                      push ecx
:00467541 E830010000              call 00467676
:00467546 83C404                  add esp, 00000004
:00467549 25FF000000              and eax, 000000FF
:0046754E 03D8                    add ebx, eax
:00467550 895DFC                  mov dword ptr [ebp-04], ebx
:00467553 EB18                    jmp 0046756D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046751F(C)
|
:00467555 8B55F4                  mov edx, dword ptr [ebp-0C]
:00467558 8A02                    mov al, byte ptr [edx]
:0046755A 50                      push eax
:0046755B B970074B00              mov ecx, 004B0770
:00467560 E8D965FAFF              call 0040DB3E
:00467565 25FF000000              and eax, 000000FF
:0046756A 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467553(U)
|
:0046756D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00467570 33D2                    xor edx, edx
:00467572 8A11                    mov dl, byte ptr [ecx]
:00467574 8BCA                    mov ecx, edx
:00467576 6BC919                  imul ecx, 00000019
:00467579 81C140114A00            add ecx, 004A1140
:0046757F E8A651FAFF              call 0040C72A
:00467584 85C0                    test eax, eax
:00467586 7439                    je 004675C1
:00467588 8B45F8                  mov eax, dword ptr [ebp-08]
:0046758B 8A08                    mov cl, byte ptr [eax]
:0046758D 51                      push ecx
:0046758E B970074B00              mov ecx, 004B0770
:00467593 E8A361FAFF              call 0040D73B
:00467598 8AD8                    mov bl, al
:0046759A 81E3FF000000            and ebx, 000000FF
:004675A0 8B55F8                  mov edx, dword ptr [ebp-08]
:004675A3 33C0                    xor eax, eax
:004675A5 8A02                    mov al, byte ptr [edx]
:004675A7 50                      push eax
:004675A8 E8C9000000              call 00467676
:004675AD 83C404                  add esp, 00000004
:004675B0 25FF000000              and eax, 000000FF
:004675B5 03D8                    add ebx, eax
:004675B7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004675BA 2BCB                    sub ecx, ebx
:004675BC 894DFC                  mov dword ptr [ebp-04], ecx
:004675BF EB1D                    jmp 004675DE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467586(C)
|
:004675C1 8B55F8                  mov edx, dword ptr [ebp-08]
:004675C4 8A02                    mov al, byte ptr [edx]
:004675C6 50                      push eax
:004675C7 B970074B00              mov ecx, 004B0770
:004675CC E86D65FAFF              call 0040DB3E
:004675D1 25FF000000              and eax, 000000FF
:004675D6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004675D9 2BC8                    sub ecx, eax
:004675DB 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004675BF(U)
|
:004675DE EB57                    jmp 00467637
:004675E0 8B55F4                  mov edx, dword ptr [ebp-0C]
:004675E3 8B45F8                  mov eax, dword ptr [ebp-08]
:004675E6 8B4A04                  mov ecx, dword ptr [edx+04]
:004675E9 2B4804                  sub ecx, dword ptr [eax+04]
:004675EC 894DFC                  mov dword ptr [ebp-04], ecx
:004675EF EB46                    jmp 00467637
:004675F1 8B55F4                  mov edx, dword ptr [ebp-0C]
:004675F4 33C0                    xor eax, eax
:004675F6 8A02                    mov al, byte ptr [edx]
:004675F8 8BC8                    mov ecx, eax
:004675FA 6BC919                  imul ecx, 00000019
:004675FD 81C140114A00            add ecx, 004A1140
:00467603 E86651FAFF              call 0040C76E
:00467608 8BF0                    mov esi, eax
:0046760A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046760D 33D2                    xor edx, edx
:0046760F 8A11                    mov dl, byte ptr [ecx]
:00467611 8BCA                    mov ecx, edx
:00467613 6BC919                  imul ecx, 00000019
:00467616 81C140114A00            add ecx, 004A1140
:0046761C E84D51FAFF              call 0040C76E
:00467621 2BF0                    sub esi, eax
:00467623 8975FC                  mov dword ptr [ebp-04], esi
:00467626 EB0F                    jmp 00467637
:00467628 8B45F8                  mov eax, dword ptr [ebp-08]
:0046762B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046762E 8B5008                  mov edx, dword ptr [eax+08]
:00467631 2B5108                  sub edx, dword ptr [ecx+08]
:00467634 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004671CD(C), :004671F0(U), :00467264(U), :004672D8(U), :0046731B(U)
|:004673D8(U), :00467412(U), :00467458(U), :00467501(U), :004675DE(U)
|:004675EF(U), :00467626(U)
|
:00467637 8B45FC                  mov eax, dword ptr [ebp-04]
:0046763A 5E                      pop esi
:0046763B 5B                      pop ebx
:0046763C 8BE5                    mov esp, ebp
:0046763E 5D                      pop ebp
:0046763F C20C00                  ret 000C



:00467642 DD714600                DWORD 004671DD
:00467646 F5714600                DWORD 004671F5
:0046764A 69724600                DWORD 00467269
:0046764E DD724600                DWORD 004672DD
:00467652 DD724600                DWORD 004672DD
:00467656 20734600                DWORD 00467320
:0046765A DD734600                DWORD 004673DD
:0046765E 06754600                DWORD 00467506
:00467662 E0754600                DWORD 004675E0
:00467666 17744600                DWORD 00467417
:0046766A F1754600                DWORD 004675F1
:0046766E 5D744600                DWORD 0046745D
:00467672 28764600                DWORD 00467628



* Referenced by a CALL at Addresses:
|:00467541   , :004675A8   , :00467C71   
|
:00467676 55                      push ebp
:00467677 8BEC                    mov ebp, esp
:00467679 83EC0C                  sub esp, 0000000C
:0046767C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046767F 6BC919                  imul ecx, 00000019
:00467682 81C140114A00            add ecx, 004A1140
:00467688 E85D50FAFF              call 0040C6EA
:0046768D 8845F8                  mov byte ptr [ebp-08], al
:00467690 C645FC00                mov [ebp-04], 00
:00467694 C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467653(C)
|
:0046769B EB09                    jmp 004676A6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004676E6(U)
|
:0046769D 8B45F4                  mov eax, dword ptr [ebp-0C]
:004676A0 83C001                  add eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046765B(C)
|
:004676A3 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046769B(U)
|
:004676A6 817DF4AE000000          cmp dword ptr [ebp-0C], 000000AE
:004676AD 7339                    jnb 004676E8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467667(C)
|
:004676AF 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004676B2 51                      push ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046766B(C)
|
:004676B3 E8D82AFBFF              call 0041A190
:004676B8 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467673(C)
|
:004676BB 85C0                    test eax, eax
:004676BD 7427                    je 004676E6
:004676BF 8A55F8                  mov dl, byte ptr [ebp-08]
:004676C2 52                      push edx
:004676C3 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004676C6 6BC948                  imul ecx, 00000048
:004676C9 81C1681B4A00            add ecx, 004A1B68
:004676CF E81CEFF9FF              call 004065F0
:004676D4 25FF000000              and eax, 000000FF
:004676D9 3B4508                  cmp eax, dword ptr [ebp+08]
:004676DC 7508                    jne 004676E6
:004676DE 8A45FC                  mov al, byte ptr [ebp-04]
:004676E1 0401                    add al, 01
:004676E3 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004676BD(C), :004676DC(C)
|
:004676E6 EBB5                    jmp 0046769D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004676AD(C)
|
:004676E8 8A45FC                  mov al, byte ptr [ebp-04]
:004676EB 8BE5                    mov esp, ebp
:004676ED 5D                      pop ebp
:004676EE C3                      ret



* Referenced by a CALL at Addresses:
|:00467E98   , :00467F8B   , :00468070   , :004687E7   , :00468B8D   
|:0046B380   , :0046B62F   , :0046BC36   
|
:004676EF 55                      push ebp
:004676F0 8BEC                    mov ebp, esp
:004676F2 51                      push ecx
:004676F3 894DFC                  mov dword ptr [ebp-04], ecx
:004676F6 B9182E4900              mov ecx, 00492E18
:004676FB E8707FFFFF              call 0045F670
:00467700 50                      push eax
:00467701 6A01                    push 00000001
:00467703 6803100000              push 00001003
:00467708 8B45FC                  mov eax, dword ptr [ebp-04]
:0046770B 8B4810                  mov ecx, dword ptr [eax+10]
:0046770E 51                      push ecx
:0046770F FF15F4624800            call dword ptr [004862F4]
:00467715 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00467718 E82BEEFFFF              call 00466548
:0046771D 8BE5                    mov esp, ebp
:0046771F 5D                      pop ebp
:00467720 C3                      ret


:00467721 55                      push ebp
:00467722 8BEC                    mov ebp, esp
:00467724 83EC08                  sub esp, 00000008
:00467727 894DF8                  mov dword ptr [ebp-08], ecx
:0046772A 837D0800                cmp dword ptr [ebp+08], 00000000
:0046772E 7C34                    jl 00467764
:00467730 8B4508                  mov eax, dword ptr [ebp+08]
:00467733 50                      push eax
:00467734 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00467737 E860C8FFFF              call 00463F9C
:0046773C 8945FC                  mov dword ptr [ebp-04], eax
:0046773F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00467742 8A5103                  mov dl, byte ptr [ecx+03]
:00467745 52                      push edx
:00467746 8B45FC                  mov eax, dword ptr [ebp-04]
:00467749 8A4802                  mov cl, byte ptr [eax+02]
:0046774C 51                      push ecx
:0046774D 8B55FC                  mov edx, dword ptr [ebp-04]
:00467750 33C0                    xor eax, eax
:00467752 8A02                    mov al, byte ptr [edx]
:00467754 50                      push eax
:00467755 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00467758 8B510C                  mov edx, dword ptr [ecx+0C]
:0046775B 52                      push edx
:0046775C E89647FAFF              call 0040BEF7
:00467761 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046772E(C)
|
:00467764 8BE5                    mov esp, ebp
:00467766 5D                      pop ebp
:00467767 C20400                  ret 0004


:0046776A 55                      push ebp
:0046776B 8BEC                    mov ebp, esp
:0046776D 83EC70                  sub esp, 00000070
:00467770 53                      push ebx
:00467771 56                      push esi
:00467772 894D98                  mov dword ptr [ebp-68], ecx
:00467775 8B4508                  mov eax, dword ptr [ebp+08]
:00467778 8B4808                  mov ecx, dword ptr [eax+08]
:0046777B 51                      push ecx
:0046777C 8B4D98                  mov ecx, dword ptr [ebp-68]
:0046777F E818C8FFFF              call 00463F9C
:00467784 8945FC                  mov dword ptr [ebp-04], eax
:00467787 8B5508                  mov edx, dword ptr [ebp+08]
:0046778A 83C21C                  add edx, 0000001C
:0046778D 8B02                    mov eax, dword ptr [edx]
:0046778F 8945C0                  mov dword ptr [ebp-40], eax
:00467792 8B4A04                  mov ecx, dword ptr [edx+04]
:00467795 894DC4                  mov dword ptr [ebp-3C], ecx
:00467798 8B4208                  mov eax, dword ptr [edx+08]
:0046779B 8945C8                  mov dword ptr [ebp-38], eax
:0046779E 8B4A0C                  mov ecx, dword ptr [edx+0C]
:004677A1 894DCC                  mov dword ptr [ebp-34], ecx
:004677A4 8B5508                  mov edx, dword ptr [ebp+08]
:004677A7 52                      push edx
:004677A8 8B4598                  mov eax, dword ptr [ebp-68]
:004677AB 8B10                    mov edx, dword ptr [eax]
:004677AD 8B4D98                  mov ecx, dword ptr [ebp-68]
:004677B0 FF5218                  call [edx+18]
:004677B3 C745A001000000          mov [ebp-60], 00000001
:004677BA 6A02                    push 00000002
:004677BC 8B4508                  mov eax, dword ptr [ebp+08]
:004677BF 8B4808                  mov ecx, dword ptr [eax+08]
:004677C2 51                      push ecx
:004677C3 682C100000              push 0000102C
:004677C8 8B5598                  mov edx, dword ptr [ebp-68]
:004677CB 8B4210                  mov eax, dword ptr [edx+10]
:004677CE 50                      push eax
:004677CF FF15F4624800            call dword ptr [004862F4]
:004677D5 33C9                    xor ecx, ecx
:004677D7 83F802                  cmp eax, 00000002
:004677DA 0F94C1                  sete cl
:004677DD 894DF8                  mov dword ptr [ebp-08], ecx
:004677E0 C7459CFFFFFFFF          mov [ebp-64], FFFFFFFF
:004677E7 C745F000000000          mov [ebp-10], 00000000
:004677EE EB09                    jmp 004677F9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467E16(U)
|
:004677F0 8B55F0                  mov edx, dword ptr [ebp-10]
:004677F3 83C201                  add edx, 00000001
:004677F6 8955F0                  mov dword ptr [ebp-10], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004677EE(U)
|
:004677F9 8B4598                  mov eax, dword ptr [ebp-68]
:004677FC 33C9                    xor ecx, ecx
:004677FE 8A4814                  mov cl, byte ptr [eax+14]
:00467801 394DF0                  cmp dword ptr [ebp-10], ecx
:00467804 0F8D11060000            jnl 00467E1B
:0046780A 8D55A0                  lea edx, dword ptr [ebp-60]
:0046780D 52                      push edx
:0046780E 8B45F0                  mov eax, dword ptr [ebp-10]
:00467811 50                      push eax
:00467812 6819100000              push 00001019
:00467817 8B4D98                  mov ecx, dword ptr [ebp-68]
:0046781A 8B5110                  mov edx, dword ptr [ecx+10]
:0046781D 52                      push edx
:0046781E FF15F4624800            call dword ptr [004862F4]
:00467824 C745F424800000          mov [ebp-0C], 00008024
:0046782B 8B45A4                  mov eax, dword ptr [ebp-5C]
:0046782E 83E003                  and eax, 00000003
:00467831 894594                  mov dword ptr [ebp-6C], eax
:00467834 837D9400                cmp dword ptr [ebp-6C], 00000000
:00467838 740E                    je 00467848
:0046783A 837D9401                cmp dword ptr [ebp-6C], 00000001
:0046783E 7410                    je 00467850
:00467840 837D9402                cmp dword ptr [ebp-6C], 00000002
:00467844 7415                    je 0046785B
:00467846 EB1D                    jmp 00467865

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467838(C)
|
:00467848 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046784B 894DF4                  mov dword ptr [ebp-0C], ecx
:0046784E EB1B                    jmp 0046786B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046783E(C)
|
:00467850 8B55F4                  mov edx, dword ptr [ebp-0C]
:00467853 83CA02                  or edx, 00000002
:00467856 8955F4                  mov dword ptr [ebp-0C], edx
:00467859 EB10                    jmp 0046786B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467844(C)
|
:0046785B 8B45F4                  mov eax, dword ptr [ebp-0C]
:0046785E 0C01                    or al, 01
:00467860 8945F4                  mov dword ptr [ebp-0C], eax
:00467863 EB06                    jmp 0046786B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467846(U)
|
:00467865 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00467868 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046784E(U), :00467859(U), :00467863(U)
|
:0046786B 6A00                    push 00000000
:0046786D 8B55F0                  mov edx, dword ptr [ebp-10]
:00467870 52                      push edx
:00467871 681D100000              push 0000101D
:00467876 8B4598                  mov eax, dword ptr [ebp-68]
:00467879 8B4810                  mov ecx, dword ptr [eax+10]
:0046787C 51                      push ecx
:0046787D FF15F4624800            call dword ptr [004862F4]
:00467883 8B55C0                  mov edx, dword ptr [ebp-40]
:00467886 8D4402FB                lea eax, dword ptr [edx+eax-05]
:0046788A 8945C8                  mov dword ptr [ebp-38], eax
:0046788D 8B4DC0                  mov ecx, dword ptr [ebp-40]
:00467890 83C105                  add ecx, 00000005
:00467893 894DC0                  mov dword ptr [ebp-40], ecx
:00467896 8B5598                  mov edx, dword ptr [ebp-68]
:00467899 8B4218                  mov eax, dword ptr [edx+18]
:0046789C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046789F 8B1488                  mov edx, dword ptr [eax+4*ecx]
:004678A2 895590                  mov dword ptr [ebp-70], edx
:004678A5 837D900C                cmp dword ptr [ebp-70], 0000000C
:004678A9 0F8728050000            ja 00467DD7
:004678AF 8B4590                  mov eax, dword ptr [ebp-70]
:004678B2 FF2485237E4600          jmp dword ptr [4*eax+00467E23]
:004678B9 8B4DC0                  mov ecx, dword ptr [ebp-40]
:004678BC 83E905                  sub ecx, 00000005
:004678BF 894DC0                  mov dword ptr [ebp-40], ecx
:004678C2 8B55FC                  mov edx, dword ptr [ebp-04]
:004678C5 33C0                    xor eax, eax
:004678C7 8A02                    mov al, byte ptr [edx]
:004678C9 8BC8                    mov ecx, eax
:004678CB 6BC919                  imul ecx, 00000019
:004678CE 81C140114A00            add ecx, 004A1140
:004678D4 E8377EFFFF              call 0045F710
:004678D9 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:004678DA 68CCE64800              push 0048E6CC
:004678DF 8D4DD0                  lea ecx, dword ptr [ebp-30]
:004678E2 51                      push ecx
:004678E3 FF15C0624800            call dword ptr [004862C0]
:004678E9 83C40C                  add esp, 0000000C
:004678EC 6A01                    push 00000001
:004678EE 8B55CC                  mov edx, dword ptr [ebp-34]
:004678F1 8B45C4                  mov eax, dword ptr [ebp-3C]
:004678F4 8D4410F0                lea eax, dword ptr [eax+edx-10]
:004678F8 99                      cdq
:004678F9 2BC2                    sub eax, edx
:004678FB D1F8                    sar eax, 1
:004678FD 50                      push eax
:004678FE 8B4DC0                  mov ecx, dword ptr [ebp-40]
:00467901 83C101                  add ecx, 00000001
:00467904 51                      push ecx
:00467905 8B5508                  mov edx, dword ptr [ebp+08]
:00467908 8B4218                  mov eax, dword ptr [edx+18]
:0046790B 50                      push eax
:0046790C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046790F 33D2                    xor edx, edx
:00467911 8A11                    mov dl, byte ptr [ecx]
:00467913 8BCA                    mov ecx, edx
:00467915 6BC919                  imul ecx, 00000019
:00467918 81C140114A00            add ecx, 004A1140
:0046791E E84DB30000              call 00472C70
:00467923 25FF000000              and eax, 000000FF
:00467928 50                      push eax
:00467929 6A00                    push 00000000
:0046792B 6A01                    push 00000001
:0046792D 6802100000              push 00001002
:00467932 8B4598                  mov eax, dword ptr [ebp-68]
:00467935 8B4810                  mov ecx, dword ptr [eax+10]
:00467938 51                      push ecx
:00467939 FF15F4624800            call dword ptr [004862F4]
:0046793F 50                      push eax
:00467940 FF150C604800            call dword ptr [0048600C]
:00467946 8B55C0                  mov edx, dword ptr [ebp-40]
:00467949 83C211                  add edx, 00000011
:0046794C 8955C0                  mov dword ptr [ebp-40], edx
:0046794F E983040000              jmp 00467DD7
:00467954 8B45FC                  mov eax, dword ptr [ebp-04]
:00467957 33C9                    xor ecx, ecx
:00467959 8A08                    mov cl, byte ptr [eax]
:0046795B 6BC919                  imul ecx, 00000019
:0046795E 81C140114A00            add ecx, 004A1140
:00467964 E8814DFAFF              call 0040C6EA
:00467969 25FF000000              and eax, 000000FF
:0046796E 83F802                  cmp eax, 00000002
:00467971 7514                    jne 00467987

* Possible StringData Ref from Data Obj ->"--"
                                  |
:00467973 68D0E64800              push 0048E6D0
:00467978 8D55D0                  lea edx, dword ptr [ebp-30]
:0046797B 52                      push edx
:0046797C FF15C0624800            call dword ptr [004862C0]
:00467982 83C408                  add esp, 00000008
:00467985 EB1B                    jmp 004679A2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467971(C)
|
:00467987 8B45FC                  mov eax, dword ptr [ebp-04]
:0046798A 33C9                    xor ecx, ecx
:0046798C 8A4802                  mov cl, byte ptr [eax+02]
:0046798F 51                      push ecx

* Possible StringData Ref from Data Obj ->"%u"
                                  |
:00467990 68D4E64800              push 0048E6D4
:00467995 8D55D0                  lea edx, dword ptr [ebp-30]
:00467998 52                      push edx
:00467999 FF15C0624800            call dword ptr [004862C0]
:0046799F 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467985(U)
|
:004679A2 E930040000              jmp 00467DD7
:004679A7 8B45FC                  mov eax, dword ptr [ebp-04]
:004679AA 33C9                    xor ecx, ecx
:004679AC 8A08                    mov cl, byte ptr [eax]
:004679AE 6BC919                  imul ecx, 00000019
:004679B1 81C140114A00            add ecx, 004A1140
:004679B7 E82E4DFAFF              call 0040C6EA
:004679BC 25FF000000              and eax, 000000FF
:004679C1 83F802                  cmp eax, 00000002
:004679C4 7514                    jne 004679DA

* Possible StringData Ref from Data Obj ->"--"
                                  |
:004679C6 68D8E64800              push 0048E6D8
:004679CB 8D55D0                  lea edx, dword ptr [ebp-30]
:004679CE 52                      push edx
:004679CF FF15C0624800            call dword ptr [004862C0]
:004679D5 83C408                  add esp, 00000008
:004679D8 EB3F                    jmp 00467A19

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004679C4(C)
|
:004679DA 8B45FC                  mov eax, dword ptr [ebp-04]
:004679DD 33C9                    xor ecx, ecx
:004679DF 8A4803                  mov cl, byte ptr [eax+03]
:004679E2 81F9FF000000            cmp ecx, 000000FF
:004679E8 7514                    jne 004679FE
:004679EA 68D46A4800              push 00486AD4
:004679EF 8D55D0                  lea edx, dword ptr [ebp-30]
:004679F2 52                      push edx
:004679F3 FF15C0624800            call dword ptr [004862C0]
:004679F9 83C408                  add esp, 00000008
:004679FC EB1B                    jmp 00467A19

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004679E8(C)
|
:004679FE 8B45FC                  mov eax, dword ptr [ebp-04]
:00467A01 33C9                    xor ecx, ecx
:00467A03 8A4803                  mov cl, byte ptr [eax+03]
:00467A06 51                      push ecx

* Possible StringData Ref from Data Obj ->"%u"
                                  |
:00467A07 68DCE64800              push 0048E6DC
:00467A0C 8D55D0                  lea edx, dword ptr [ebp-30]
:00467A0F 52                      push edx
:00467A10 FF15C0624800            call dword ptr [004862C0]
:00467A16 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004679D8(U), :004679FC(U)
|
:00467A19 E9B9030000              jmp 00467DD7
:00467A1E 8B45FC                  mov eax, dword ptr [ebp-04]
:00467A21 33C9                    xor ecx, ecx
:00467A23 8A08                    mov cl, byte ptr [eax]
:00467A25 6BC919                  imul ecx, 00000019
:00467A28 81C140114A00            add ecx, 004A1140
:00467A2E E8074CFAFF              call 0040C63A
:00467A33 25FF000000              and eax, 000000FF
:00467A38 8B148520BC4800          mov edx, dword ptr [4*eax+0048BC20]
:00467A3F 52                      push edx
:00467A40 8D45D0                  lea eax, dword ptr [ebp-30]
:00467A43 50                      push eax
:00467A44 FF15C0624800            call dword ptr [004862C0]
:00467A4A 83C408                  add esp, 00000008
:00467A4D E985030000              jmp 00467DD7
:00467A52 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00467A55 33D2                    xor edx, edx
:00467A57 8A11                    mov dl, byte ptr [ecx]
:00467A59 8BCA                    mov ecx, edx
:00467A5B 6BC919                  imul ecx, 00000019
:00467A5E 81C140114A00            add ecx, 004A1140
:00467A64 E8A94DFAFF              call 0040C812
:00467A69 25FF000000              and eax, 000000FF
:00467A6E 8B048550BC4800          mov eax, dword ptr [4*eax+0048BC50]
:00467A75 50                      push eax
:00467A76 8D4DD0                  lea ecx, dword ptr [ebp-30]
:00467A79 51                      push ecx
:00467A7A FF15C0624800            call dword ptr [004862C0]
:00467A80 83C408                  add esp, 00000008
:00467A83 E94F030000              jmp 00467DD7
:00467A88 8B55FC                  mov edx, dword ptr [ebp-04]
:00467A8B 8A4202                  mov al, byte ptr [edx+02]
:00467A8E 50                      push eax
:00467A8F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00467A92 33D2                    xor edx, edx
:00467A94 8A11                    mov dl, byte ptr [ecx]
:00467A96 52                      push edx
:00467A97 8D45D0                  lea eax, dword ptr [ebp-30]
:00467A9A 50                      push eax
:00467A9B E85FA6FFFF              call 004620FF
:00467AA0 83C40C                  add esp, 0000000C
:00467AA3 E92F030000              jmp 00467DD7
:00467AA8 8B4D08                  mov ecx, dword ptr [ebp+08]
:00467AAB 8B5108                  mov edx, dword ptr [ecx+08]
:00467AAE 52                      push edx
:00467AAF 8B4598                  mov eax, dword ptr [ebp-68]
:00467AB2 8B10                    mov edx, dword ptr [eax]
:00467AB4 8B4D98                  mov ecx, dword ptr [ebp-68]
:00467AB7 FF5220                  call [edx+20]
:00467ABA 85C0                    test eax, eax
:00467ABC 753A                    jne 00467AF8
:00467ABE B970074B00              mov ecx, 004B0770
:00467AC3 E80867FAFF              call 0040E1D0
:00467AC8 8BF0                    mov esi, eax
:00467ACA 8B45FC                  mov eax, dword ptr [ebp-04]
:00467ACD 33C9                    xor ecx, ecx
:00467ACF 8A08                    mov cl, byte ptr [eax]
:00467AD1 6BC919                  imul ecx, 00000019
:00467AD4 81C140114A00            add ecx, 004A1140
:00467ADA E89165FAFF              call 0040E070
:00467ADF 3BF0                    cmp esi, eax
:00467AE1 7315                    jnb 00467AF8
:00467AE3 6880000000              push 00000080
:00467AE8 8B5508                  mov edx, dword ptr [ebp+08]
:00467AEB 8B4218                  mov eax, dword ptr [edx+18]
:00467AEE 50                      push eax
:00467AEF FF1584604800            call dword ptr [00486084]
:00467AF5 89459C                  mov dword ptr [ebp-64], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00467ABC(C), :00467AE1(C)
|
:00467AF8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00467AFB 33D2                    xor edx, edx
:00467AFD 8A11                    mov dl, byte ptr [ecx]
:00467AFF 8BCA                    mov ecx, edx
:00467B01 6BC919                  imul ecx, 00000019
:00467B04 81C140114A00            add ecx, 004A1140
:00467B0A E86165FAFF              call 0040E070
:00467B0F 50                      push eax

* Possible StringData Ref from Data Obj ->"%u"
                                  |
:00467B10 68E0E64800              push 0048E6E0
:00467B15 8D45D0                  lea eax, dword ptr [ebp-30]
:00467B18 50                      push eax
:00467B19 FF15C0624800            call dword ptr [004862C0]
:00467B1F 83C40C                  add esp, 0000000C
:00467B22 E9B0020000              jmp 00467DD7
:00467B27 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00467B2A 8A5102                  mov dl, byte ptr [ecx+02]
:00467B2D 52                      push edx
:00467B2E 8B45FC                  mov eax, dword ptr [ebp-04]
:00467B31 33C9                    xor ecx, ecx
:00467B33 8A08                    mov cl, byte ptr [eax]
:00467B35 6BC919                  imul ecx, 00000019
:00467B38 81C140114A00            add ecx, 004A1140
:00467B3E E8664CFAFF              call 0040C7A9
:00467B43 3DFFFF0000              cmp eax, 0000FFFF
:00467B48 7544                    jne 00467B8E
:00467B4A 8B5508                  mov edx, dword ptr [ebp+08]
:00467B4D 8B4208                  mov eax, dword ptr [edx+08]
:00467B50 50                      push eax
:00467B51 8B4D98                  mov ecx, dword ptr [ebp-68]
:00467B54 8B11                    mov edx, dword ptr [ecx]
:00467B56 8B4D98                  mov ecx, dword ptr [ebp-68]
:00467B59 FF5220                  call [edx+20]
:00467B5C 85C0                    test eax, eax
:00467B5E 7515                    jne 00467B75
:00467B60 6880000000              push 00000080
:00467B65 8B4508                  mov eax, dword ptr [ebp+08]
:00467B68 8B4818                  mov ecx, dword ptr [eax+18]
:00467B6B 51                      push ecx
:00467B6C FF1584604800            call dword ptr [00486084]
:00467B72 89459C                  mov dword ptr [ebp-64], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467B5E(C)
|

* Possible StringData Ref from Data Obj ->"---"
                                  |
:00467B75 68E4E64800              push 0048E6E4

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:00467B7A 68E8E64800              push 0048E6E8
:00467B7F 8D55D0                  lea edx, dword ptr [ebp-30]
:00467B82 52                      push edx
:00467B83 FF15C0624800            call dword ptr [004862C0]
:00467B89 83C40C                  add esp, 0000000C
:00467B8C EB31                    jmp 00467BBF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467B48(C)
|
:00467B8E 8B45FC                  mov eax, dword ptr [ebp-04]
:00467B91 8A4802                  mov cl, byte ptr [eax+02]
:00467B94 51                      push ecx
:00467B95 8B55FC                  mov edx, dword ptr [ebp-04]
:00467B98 33C0                    xor eax, eax
:00467B9A 8A02                    mov al, byte ptr [edx]
:00467B9C 8BC8                    mov ecx, eax
:00467B9E 6BC919                  imul ecx, 00000019
:00467BA1 81C140114A00            add ecx, 004A1140
:00467BA7 E8FD4BFAFF              call 0040C7A9
:00467BAC 50                      push eax

* Possible StringData Ref from Data Obj ->"%u"
                                  |
:00467BAD 68ECE64800              push 0048E6EC
:00467BB2 8D4DD0                  lea ecx, dword ptr [ebp-30]
:00467BB5 51                      push ecx
:00467BB6 FF15C0624800            call dword ptr [004862C0]
:00467BBC 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467B8C(U)
|
:00467BBF E913020000              jmp 00467DD7
:00467BC4 8B55FC                  mov edx, dword ptr [ebp-04]
:00467BC7 33C0                    xor eax, eax
:00467BC9 8A02                    mov al, byte ptr [edx]
:00467BCB 8BC8                    mov ecx, eax
:00467BCD 6BC919                  imul ecx, 00000019
:00467BD0 81C140114A00            add ecx, 004A1140
:00467BD6 E84F4BFAFF              call 0040C72A
:00467BDB 85C0                    test eax, eax
:00467BDD 742A                    je 00467C09
:00467BDF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00467BE2 8A11                    mov dl, byte ptr [ecx]
:00467BE4 52                      push edx
:00467BE5 B970074B00              mov ecx, 004B0770
:00467BEA E84C5BFAFF              call 0040D73B
:00467BEF 25FF000000              and eax, 000000FF
:00467BF4 50                      push eax

* Possible StringData Ref from Data Obj ->"%u"
                                  |
:00467BF5 68F0E64800              push 0048E6F0
:00467BFA 8D45D0                  lea eax, dword ptr [ebp-30]
:00467BFD 50                      push eax
:00467BFE FF15C0624800            call dword ptr [004862C0]
:00467C04 83C40C                  add esp, 0000000C
:00467C07 EB28                    jmp 00467C31

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467BDD(C)
|
:00467C09 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00467C0C 8A11                    mov dl, byte ptr [ecx]
:00467C0E 52                      push edx
:00467C0F B970074B00              mov ecx, 004B0770
:00467C14 E8255FFAFF              call 0040DB3E
:00467C19 25FF000000              and eax, 000000FF
:00467C1E 50                      push eax

* Possible StringData Ref from Data Obj ->"%u"
                                  |
:00467C1F 68F4E64800              push 0048E6F4
:00467C24 8D45D0                  lea eax, dword ptr [ebp-30]
:00467C27 50                      push eax
:00467C28 FF15C0624800            call dword ptr [004862C0]
:00467C2E 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467C07(U)
|
:00467C31 E9A1010000              jmp 00467DD7
:00467C36 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00467C39 33D2                    xor edx, edx
:00467C3B 8A11                    mov dl, byte ptr [ecx]
:00467C3D 8BCA                    mov ecx, edx
:00467C3F 6BC919                  imul ecx, 00000019
:00467C42 81C140114A00            add ecx, 004A1140
:00467C48 E8DD4AFAFF              call 0040C72A
:00467C4D 85C0                    test eax, eax
:00467C4F 7444                    je 00467C95
:00467C51 8B45FC                  mov eax, dword ptr [ebp-04]
:00467C54 8A08                    mov cl, byte ptr [eax]
:00467C56 51                      push ecx
:00467C57 B970074B00              mov ecx, 004B0770
:00467C5C E8DA5AFAFF              call 0040D73B
:00467C61 8AD8                    mov bl, al
:00467C63 81E3FF000000            and ebx, 000000FF
:00467C69 8B55FC                  mov edx, dword ptr [ebp-04]
:00467C6C 33C0                    xor eax, eax
:00467C6E 8A02                    mov al, byte ptr [edx]
:00467C70 50                      push eax
:00467C71 E800FAFFFF              call 00467676
:00467C76 83C404                  add esp, 00000004
:00467C79 25FF000000              and eax, 000000FF
:00467C7E 03D8                    add ebx, eax
:00467C80 53                      push ebx

* Possible StringData Ref from Data Obj ->"%u"
                                  |
:00467C81 68F8E64800              push 0048E6F8
:00467C86 8D4DD0                  lea ecx, dword ptr [ebp-30]
:00467C89 51                      push ecx
:00467C8A FF15C0624800            call dword ptr [004862C0]
:00467C90 83C40C                  add esp, 0000000C
:00467C93 EB28                    jmp 00467CBD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467C4F(C)
|
:00467C95 8B55FC                  mov edx, dword ptr [ebp-04]
:00467C98 8A02                    mov al, byte ptr [edx]
:00467C9A 50                      push eax
:00467C9B B970074B00              mov ecx, 004B0770
:00467CA0 E8995EFAFF              call 0040DB3E
:00467CA5 25FF000000              and eax, 000000FF
:00467CAA 50                      push eax

* Possible StringData Ref from Data Obj ->"%u"
                                  |
:00467CAB 68FCE64800              push 0048E6FC
:00467CB0 8D4DD0                  lea ecx, dword ptr [ebp-30]
:00467CB3 51                      push ecx
:00467CB4 FF15C0624800            call dword ptr [004862C0]
:00467CBA 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467C93(U)
|
:00467CBD E915010000              jmp 00467DD7
:00467CC2 8B55FC                  mov edx, dword ptr [ebp-04]
:00467CC5 837A0400                cmp dword ptr [edx+04], 00000000
:00467CC9 7414                    je 00467CDF

* Possible StringData Ref from Data Obj ->""
                                  |
:00467CCB 6800E74800              push 0048E700
:00467CD0 8D45D0                  lea eax, dword ptr [ebp-30]
:00467CD3 50                      push eax
:00467CD4 FF15C0624800            call dword ptr [004862C0]
:00467CDA 83C408                  add esp, 00000008
:00467CDD EB3D                    jmp 00467D1C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467CC9(C)
|
:00467CDF 8B4D08                  mov ecx, dword ptr [ebp+08]
:00467CE2 8B5108                  mov edx, dword ptr [ecx+08]
:00467CE5 52                      push edx
:00467CE6 8B4598                  mov eax, dword ptr [ebp-68]
:00467CE9 8B10                    mov edx, dword ptr [eax]
:00467CEB 8B4D98                  mov ecx, dword ptr [ebp-68]
:00467CEE FF5220                  call [edx+20]
:00467CF1 85C0                    test eax, eax
:00467CF3 7515                    jne 00467D0A
:00467CF5 6880000000              push 00000080
:00467CFA 8B4508                  mov eax, dword ptr [ebp+08]
:00467CFD 8B4818                  mov ecx, dword ptr [eax+18]
:00467D00 51                      push ecx
:00467D01 FF1584604800            call dword ptr [00486084]
:00467D07 89459C                  mov dword ptr [ebp-64], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467CF3(C)
|

* Possible StringData Ref from Data Obj ->""
                                  |
:00467D0A 6804E74800              push 0048E704
:00467D0F 8D55D0                  lea edx, dword ptr [ebp-30]
:00467D12 52                      push edx
:00467D13 FF15C0624800            call dword ptr [004862C0]
:00467D19 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467CDD(U)
|
:00467D1C E9B6000000              jmp 00467DD7
:00467D21 8B45FC                  mov eax, dword ptr [ebp-04]
:00467D24 837808FF                cmp dword ptr [eax+08], FFFFFFFF
:00467D28 752F                    jne 00467D59
:00467D2A 837DF800                cmp dword ptr [ebp-08], 00000000
:00467D2E 7515                    jne 00467D45
:00467D30 6880000000              push 00000080
:00467D35 8B4D08                  mov ecx, dword ptr [ebp+08]
:00467D38 8B5118                  mov edx, dword ptr [ecx+18]
:00467D3B 52                      push edx
:00467D3C FF1584604800            call dword ptr [00486084]
:00467D42 89459C                  mov dword ptr [ebp-64], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467D2E(C)
|
:00467D45 68B86E4800              push 00486EB8
:00467D4A 8D45D0                  lea eax, dword ptr [ebp-30]
:00467D4D 50                      push eax
:00467D4E FF15C0624800            call dword ptr [004862C0]
:00467D54 83C408                  add esp, 00000008
:00467D57 EB22                    jmp 00467D7B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467D28(C)
|
:00467D59 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00467D5C 8B4908                  mov ecx, dword ptr [ecx+08]
:00467D5F 6BC948                  imul ecx, 00000048
:00467D62 81C1681B4A00            add ecx, 004A1B68
:00467D68 E8EAF9F9FF              call 00407757
:00467D6D 50                      push eax
:00467D6E 8D55D0                  lea edx, dword ptr [ebp-30]
:00467D71 52                      push edx
:00467D72 FF15C0624800            call dword ptr [004862C0]
:00467D78 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467D57(U)
|
:00467D7B EB5A                    jmp 00467DD7
:00467D7D 8B45FC                  mov eax, dword ptr [ebp-04]
:00467D80 33C9                    xor ecx, ecx
:00467D82 8A08                    mov cl, byte ptr [eax]
:00467D84 6BC919                  imul ecx, 00000019
:00467D87 81C140114A00            add ecx, 004A1140
:00467D8D E8DC49FAFF              call 0040C76E
:00467D92 85C0                    test eax, eax
:00467D94 742F                    je 00467DC5
:00467D96 837DF800                cmp dword ptr [ebp-08], 00000000
:00467D9A 7515                    jne 00467DB1
:00467D9C 6880000000              push 00000080
:00467DA1 8B5508                  mov edx, dword ptr [ebp+08]
:00467DA4 8B4218                  mov eax, dword ptr [edx+18]
:00467DA7 50                      push eax
:00467DA8 FF1584604800            call dword ptr [00486084]
:00467DAE 89459C                  mov dword ptr [ebp-64], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467D9A(C)
|
:00467DB1 68C06E4800              push 00486EC0
:00467DB6 8D4DD0                  lea ecx, dword ptr [ebp-30]
:00467DB9 51                      push ecx
:00467DBA FF15C0624800            call dword ptr [004862C0]
:00467DC0 83C408                  add esp, 00000008
:00467DC3 EB12                    jmp 00467DD7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467D94(C)
|
:00467DC5 68C46E4800              push 00486EC4
:00467DCA 8D55D0                  lea edx, dword ptr [ebp-30]
:00467DCD 52                      push edx
:00467DCE FF15C0624800            call dword ptr [004862C0]
:00467DD4 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004678A9(C), :0046794F(U), :004679A2(U), :00467A19(U), :00467A4D(U)
|:00467A83(U), :00467AA3(U), :00467B22(U), :00467BBF(U), :00467C31(U)
|:00467CBD(U), :00467D1C(U), :00467D7B(U), :00467DC3(U)
|
:00467DD7 8B45F4                  mov eax, dword ptr [ebp-0C]
:00467DDA 50                      push eax
:00467DDB 8D4DC0                  lea ecx, dword ptr [ebp-40]
:00467DDE 51                      push ecx
:00467DDF 8D55D0                  lea edx, dword ptr [ebp-30]
:00467DE2 52                      push edx
:00467DE3 8B4508                  mov eax, dword ptr [ebp+08]
:00467DE6 50                      push eax
:00467DE7 8B4D98                  mov ecx, dword ptr [ebp-68]
:00467DEA E873CFFFFF              call 00464D62
:00467DEF 8B4DC8                  mov ecx, dword ptr [ebp-38]
:00467DF2 83C105                  add ecx, 00000005
:00467DF5 894DC0                  mov dword ptr [ebp-40], ecx
:00467DF8 837D9CFF                cmp dword ptr [ebp-64], FFFFFFFF
:00467DFC 7418                    je 00467E16
:00467DFE 8B559C                  mov edx, dword ptr [ebp-64]
:00467E01 52                      push edx
:00467E02 8B4508                  mov eax, dword ptr [ebp+08]
:00467E05 8B4818                  mov ecx, dword ptr [eax+18]
:00467E08 51                      push ecx
:00467E09 FF1584604800            call dword ptr [00486084]
:00467E0F C7459CFFFFFFFF          mov [ebp-64], FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467DFC(C)
|
:00467E16 E9D5F9FFFF              jmp 004677F0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467804(C)
|
:00467E1B 5E                      pop esi
:00467E1C 5B                      pop ebx
:00467E1D 8BE5                    mov esp, ebp
:00467E1F 5D                      pop ebp
:00467E20 C20400                  ret 0004



:00467E23 B9784600                DWORD 004678B9
:00467E27 54794600                DWORD 00467954
:00467E2B A7794600                DWORD 004679A7
:00467E2F 1E7A4600                DWORD 00467A1E
:00467E33 527A4600                DWORD 00467A52
:00467E37 887A4600                DWORD 00467A88
:00467E3B A87A4600                DWORD 00467AA8
:00467E3F 367C4600                DWORD 00467C36
:00467E43 C27C4600                DWORD 00467CC2
:00467E47 277B4600                DWORD 00467B27
:00467E4B 7D7D4600                DWORD 00467D7D
:00467E4F C47B4600                DWORD 00467BC4
:00467E53 217D4600                DWORD 00467D21


:00467E57 55                      push ebp
:00467E58 8BEC                    mov ebp, esp
:00467E5A 83EC1C                  sub esp, 0000001C
:00467E5D 894DE4                  mov dword ptr [ebp-1C], ecx
:00467E60 8B45E4                  mov eax, dword ptr [ebp-1C]
:00467E63 33C9                    xor ecx, ecx
:00467E65 8A4814                  mov cl, byte ptr [eax+14]
:00467E68 85C9                    test ecx, ecx
:00467E6A 7533                    jne 00467E9F
:00467E6C C745F000000000          mov [ebp-10], 00000000
:00467E73 C745F404000000          mov [ebp-0C], 00000004
:00467E7A C745F80B000000          mov [ebp-08], 0000000B
:00467E81 C645FC03                mov [ebp-04], 03
:00467E85 8D55F0                  lea edx, dword ptr [ebp-10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467E40(C)
|
:00467E88 52                      push edx
:00467E89 8A45FC                  mov al, byte ptr [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467E44(C)
|
:00467E8C 50                      push eax
:00467E8D 8B4DE4                  mov ecx, dword ptr [ebp-1C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467E48(C)
|
:00467E90 E866BEFFFF              call 00463CFB
:00467E95 8B4DE4                  mov ecx, dword ptr [ebp-1C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467E50(C)
|
:00467E98 E852F8FFFF              call 004676EF
:00467E9D EB16                    jmp 00467EB5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467E6A(C)
|
:00467E9F 6A00                    push 00000000
:00467EA1 6A00                    push 00000000
:00467EA3 6809100000              push 00001009
:00467EA8 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00467EAB 8B5110                  mov edx, dword ptr [ecx+10]
:00467EAE 52                      push edx
:00467EAF FF15F4624800            call dword ptr [004862F4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467E9D(U)
|
:00467EB5 8B45E4                  mov eax, dword ptr [ebp-1C]
:00467EB8 83C054                  add eax, 00000054
:00467EBB 50                      push eax
:00467EBC 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00467EBF E8AFEBFFFF              call 00466A73
:00467EC4 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00467EC7 C7411C00000000          mov [ecx+1C], 00000000
:00467ECE 8B55E4                  mov edx, dword ptr [ebp-1C]
:00467ED1 8B4210                  mov eax, dword ptr [edx+10]
:00467ED4 50                      push eax
:00467ED5 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00467ED8 8B510C                  mov edx, dword ptr [ecx+0C]
:00467EDB 52                      push edx
:00467EDC 8B45E4                  mov eax, dword ptr [ebp-1C]
:00467EDF 8B4850                  mov ecx, dword ptr [eax+50]
:00467EE2 51                      push ecx
:00467EE3 E811E1FFFF              call 00465FF9
:00467EE8 83C40C                  add esp, 0000000C
:00467EEB 8945E8                  mov dword ptr [ebp-18], eax
:00467EEE 8955EC                  mov dword ptr [ebp-14], edx
:00467EF1 8BE5                    mov esp, ebp
:00467EF3 5D                      pop ebp
:00467EF4 C3                      ret


:00467EF5 55                      push ebp
:00467EF6 8BEC                    mov ebp, esp
:00467EF8 51                      push ecx
:00467EF9 894DFC                  mov dword ptr [ebp-04], ecx
:00467EFC 837D0800                cmp dword ptr [ebp+08], 00000000
:00467F00 7C26                    jl 00467F28
:00467F02 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00467F05 E888D4FFFF              call 00465392
:00467F0A 8B4508                  mov eax, dword ptr [ebp+08]
:00467F0D 50                      push eax
:00467F0E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00467F11 E886C0FFFF              call 00463F9C
:00467F16 33C9                    xor ecx, ecx
:00467F18 8A08                    mov cl, byte ptr [eax]
:00467F1A 51                      push ecx
:00467F1B 8B55FC                  mov edx, dword ptr [ebp-04]
:00467F1E 8B420C                  mov eax, dword ptr [edx+0C]
:00467F21 50                      push eax
:00467F22 FF15D4624800            call dword ptr [004862D4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467F00(C)
|
:00467F28 8BE5                    mov esp, ebp
:00467F2A 5D                      pop ebp
:00467F2B C20400                  ret 0004


:00467F2E 55                      push ebp
:00467F2F 8BEC                    mov ebp, esp
:00467F31 83EC2C                  sub esp, 0000002C
:00467F34 894DD4                  mov dword ptr [ebp-2C], ecx
:00467F37 8B45D4                  mov eax, dword ptr [ebp-2C]
:00467F3A 33C9                    xor ecx, ecx
:00467F3C 8A4814                  mov cl, byte ptr [eax+14]
:00467F3F 85C9                    test ecx, ecx
:00467F41 754F                    jne 00467F92
:00467F43 C745D800000000          mov [ebp-28], 00000000
:00467F4A C745DC0C000000          mov [ebp-24], 0000000C
:00467F51 C745E003000000          mov [ebp-20], 00000003
:00467F58 C745E405000000          mov [ebp-1C], 00000005
:00467F5F C745E801000000          mov [ebp-18], 00000001
:00467F66 C745EC02000000          mov [ebp-14], 00000002
:00467F6D C745F00A000000          mov [ebp-10], 0000000A
:00467F74 C645F407                mov [ebp-0C], 07
:00467F78 8D55D8                  lea edx, dword ptr [ebp-28]
:00467F7B 52                      push edx
:00467F7C 8A45F4                  mov al, byte ptr [ebp-0C]
:00467F7F 50                      push eax
:00467F80 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00467F83 E873BDFFFF              call 00463CFB
:00467F88 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00467F8B E85FF7FFFF              call 004676EF
:00467F90 EB16                    jmp 00467FA8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467F41(C)
|
:00467F92 6A00                    push 00000000
:00467F94 6A00                    push 00000000
:00467F96 6809100000              push 00001009
:00467F9B 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00467F9E 8B5110                  mov edx, dword ptr [ecx+10]
:00467FA1 52                      push edx
:00467FA2 FF15F4624800            call dword ptr [004862F4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467F90(U)
|
:00467FA8 6A01                    push 00000001
:00467FAA 6A00                    push 00000000
:00467FAC 68FF000000              push 000000FF
:00467FB1 8B45D4                  mov eax, dword ptr [ebp-2C]
:00467FB4 83C050                  add eax, 00000050
:00467FB7 50                      push eax
:00467FB8 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00467FBB E821E9FFFF              call 004668E1
:00467FC0 6A00                    push 00000000
:00467FC2 6A00                    push 00000000
:00467FC4 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00467FC7 E85FCDFFFF              call 00464D2B
:00467FCC C745FC00000000          mov [ebp-04], 00000000
:00467FD3 C645F800                mov [ebp-08], 00
:00467FD7 EB09                    jmp 00467FE2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046801A(U)
|
:00467FD9 8A4DF8                  mov cl, byte ptr [ebp-08]
:00467FDC 80C101                  add cl, 01
:00467FDF 884DF8                  mov byte ptr [ebp-08], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467FD7(U)
|
:00467FE2 8B55F8                  mov edx, dword ptr [ebp-08]
:00467FE5 81E2FF000000            and edx, 000000FF
:00467FEB 83FA03                  cmp edx, 00000003
:00467FEE 7D2C                    jge 0046801C
:00467FF0 6A00                    push 00000000
:00467FF2 8A45F8                  mov al, byte ptr [ebp-08]
:00467FF5 50                      push eax
:00467FF6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00467FF9 81C1C8000000            add ecx, 000000C8
:00467FFF 6BC90C                  imul ecx, 0000000C
:00468002 8B55D4                  mov edx, dword ptr [ebp-2C]
:00468005 8D440A50                lea eax, dword ptr [edx+ecx+50]
:00468009 50                      push eax
:0046800A 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0046800D E84BEDFFFF              call 00466D5D
:00468012 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00468015 03C8                    add ecx, eax
:00468017 894DFC                  mov dword ptr [ebp-04], ecx
:0046801A EBBD                    jmp 00467FD9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467FEE(C)
|
:0046801C 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0046801F E8A9C0FFFF              call 004640CD
:00468024 8BE5                    mov esp, ebp
:00468026 5D                      pop ebp
:00468027 C3                      ret


:00468028 55                      push ebp
:00468029 8BEC                    mov ebp, esp
:0046802B 83EC18                  sub esp, 00000018
:0046802E 894DE8                  mov dword ptr [ebp-18], ecx
:00468031 8B45E8                  mov eax, dword ptr [ebp-18]
:00468034 33C9                    xor ecx, ecx
:00468036 8A4814                  mov cl, byte ptr [eax+14]
:00468039 85C9                    test ecx, ecx
:0046803B 753A                    jne 00468077
:0046803D C745EC00000000          mov [ebp-14], 00000000
:00468044 C745F00B000000          mov [ebp-10], 0000000B
:0046804B C745F404000000          mov [ebp-0C], 00000004
:00468052 C745F805000000          mov [ebp-08], 00000005
:00468059 C645FC04                mov [ebp-04], 04
:0046805D 8D55EC                  lea edx, dword ptr [ebp-14]
:00468060 52                      push edx
:00468061 8A45FC                  mov al, byte ptr [ebp-04]
:00468064 50                      push eax
:00468065 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00468068 E88EBCFFFF              call 00463CFB
:0046806D 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00468070 E87AF6FFFF              call 004676EF
:00468075 EB16                    jmp 0046808D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046803B(C)
|
:00468077 6A00                    push 00000000
:00468079 6A00                    push 00000000
:0046807B 6809100000              push 00001009
:00468080 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00468083 8B5110                  mov edx, dword ptr [ecx+10]
:00468086 52                      push edx
:00468087 FF15F4624800            call dword ptr [004862F4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00468075(U)
|
:0046808D 8B45E8                  mov eax, dword ptr [ebp-18]
:00468090 83C050                  add eax, 00000050
:00468093 50                      push eax
:00468094 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00468097 E8D7E9FFFF              call 00466A73
:0046809C 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0046809F C7411C00000000          mov [ecx+1C], 00000000
:004680A6 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004680A9 E81FC0FFFF              call 004640CD
:004680AE 8BE5                    mov esp, ebp
:004680B0 5D                      pop ebp
:004680B1 C3                      ret



* Referenced by a CALL at Address:
|:004683CA   
|
:004680B2 55                      push ebp
:004680B3 8BEC                    mov ebp, esp
:004680B5 51                      push ecx
:004680B6 894DFC                  mov dword ptr [ebp-04], ecx
:004680B9 8B45FC                  mov eax, dword ptr [ebp-04]
:004680BC 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004680BF 894854                  mov dword ptr [eax+54], ecx
:004680C2 8B55FC                  mov edx, dword ptr [ebp-04]
:004680C5 52                      push edx

* Possible StringData Ref from Code Obj ->"U}"
                                  |
:004680C6 680BD04600              push 0046D00B
:004680CB 8B45FC                  mov eax, dword ptr [ebp-04]
:004680CE 8B4854                  mov ecx, dword ptr [eax+54]
:004680D1 51                      push ecx

* Possible Reference to Dialog: DialogID_0145 
                                  |
:004680D2 6845010000              push 00000145
:004680D7 8B5508                  mov edx, dword ptr [ebp+08]
:004680DA 52                      push edx
:004680DB FF15A0624800            call dword ptr [004862A0]
:004680E1 8BE5                    mov esp, ebp
:004680E3 5D                      pop ebp
:004680E4 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0046D04C   , :0046D08B   
|
:004680E7 55                      push ebp
:004680E8 8BEC                    mov ebp, esp
:004680EA 83EC18                  sub esp, 00000018
:004680ED 894DF4                  mov dword ptr [ebp-0C], ecx
:004680F0 817D0C10010000          cmp dword ptr [ebp+0C], 00000110
:004680F7 7562                    jne 0046815B
:004680F9 8B45F4                  mov eax, dword ptr [ebp-0C]
:004680FC 8B10                    mov edx, dword ptr [eax]
:004680FE 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00468101 FF5228                  call [edx+28]
:00468104 68B1050000              push 000005B1
:00468109 8B4510                  mov eax, dword ptr [ebp+10]
:0046810C 50                      push eax
:0046810D 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00468110 51                      push ecx
:00468111 8B5508                  mov edx, dword ptr [ebp+08]
:00468114 52                      push edx
:00468115 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00468118 83C15C                  add ecx, 0000005C
:0046811B 8B45F4                  mov eax, dword ptr [ebp-0C]
:0046811E 8B505C                  mov edx, dword ptr [eax+5C]
:00468121 FF5224                  call [edx+24]
:00468124 68EB030000              push 000003EB
:00468129 8B4510                  mov eax, dword ptr [ebp+10]
:0046812C 50                      push eax
:0046812D 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00468130 51                      push ecx
:00468131 8B5508                  mov edx, dword ptr [ebp+08]
:00468134 52                      push edx
:00468135 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00468138 81C1B40D0000            add ecx, 00000DB4
:0046813E 8B45F4                  mov eax, dword ptr [ebp-0C]
:00468141 8B90B40D0000            mov edx, dword ptr [eax+00000DB4]
:00468147 FF5224                  call [edx+24]
:0046814A 6A00                    push 00000000
:0046814C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046814F E882010000              call 004682D6
:00468154 33C0                    xor eax, eax
:00468156 E9D9000000              jmp 00468234

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004680F7(C)
|
:0046815B 8B4514                  mov eax, dword ptr [ebp+14]
:0046815E 50                      push eax
:0046815F 8B4D10                  mov ecx, dword ptr [ebp+10]
:00468162 51                      push ecx
:00468163 8B550C                  mov edx, dword ptr [ebp+0C]
:00468166 52                      push edx
:00468167 8B4508                  mov eax, dword ptr [ebp+08]
:0046816A 50                      push eax
:0046816B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046816E 83C15C                  add ecx, 0000005C
:00468171 8B55F4                  mov edx, dword ptr [ebp-0C]
:00468174 8B425C                  mov eax, dword ptr [edx+5C]
:00468177 FF5024                  call [eax+24]
:0046817A 85C0                    test eax, eax
:0046817C 740A                    je 00468188
:0046817E B801000000              mov eax, 00000001
:00468183 E9AC000000              jmp 00468234

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046817C(C)
|
:00468188 8B4D14                  mov ecx, dword ptr [ebp+14]
:0046818B 51                      push ecx
:0046818C 8B5510                  mov edx, dword ptr [ebp+10]
:0046818F 52                      push edx
:00468190 8B450C                  mov eax, dword ptr [ebp+0C]
:00468193 50                      push eax
:00468194 8B4D08                  mov ecx, dword ptr [ebp+08]
:00468197 51                      push ecx
:00468198 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046819B 81C1B40D0000            add ecx, 00000DB4
:004681A1 8B55F4                  mov edx, dword ptr [ebp-0C]
:004681A4 8B82B40D0000            mov eax, dword ptr [edx+00000DB4]
:004681AA FF5024                  call [eax+24]
:004681AD 85C0                    test eax, eax
:004681AF 7407                    je 004681B8
:004681B1 B801000000              mov eax, 00000001
:004681B6 EB7C                    jmp 00468234

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004681AF(C)
|
:004681B8 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004681BB 894DF0                  mov dword ptr [ebp-10], ecx
:004681BE 837DF04E                cmp dword ptr [ebp-10], 0000004E
:004681C2 7430                    je 004681F4
:004681C4 817DF011010000          cmp dword ptr [ebp-10], 00000111
:004681CB 7402                    je 004681CF
:004681CD EB63                    jmp 00468232

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004681CB(C)
|
:004681CF 8B5510                  mov edx, dword ptr [ebp+10]
:004681D2 81E2FFFF0000            and edx, 0000FFFF
:004681D8 8955EC                  mov dword ptr [ebp-14], edx
:004681DB 837DEC02                cmp dword ptr [ebp-14], 00000002
:004681DF 7402                    je 004681E3
:004681E1 EB0F                    jmp 004681F2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004681DF(C)
|
:004681E3 6A00                    push 00000000
:004681E5 8B45F4                  mov eax, dword ptr [ebp-0C]
:004681E8 8B4850                  mov ecx, dword ptr [eax+50]
:004681EB 51                      push ecx
:004681EC FF15D4624800            call dword ptr [004862D4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004681E1(U)
|
:004681F2 EB3E                    jmp 00468232

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004681C2(C)
|
:004681F4 8B5514                  mov edx, dword ptr [ebp+14]
:004681F7 8955FC                  mov dword ptr [ebp-04], edx
:004681FA 8B45FC                  mov eax, dword ptr [ebp-04]
:004681FD 8B4808                  mov ecx, dword ptr [eax+08]
:00468200 894DE8                  mov dword ptr [ebp-18], ecx
:00468203 817DE8D9FDFFFF          cmp dword ptr [ebp-18], FFFFFDD9
:0046820A 7402                    je 0046820E
:0046820C EB24                    jmp 00468232

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046820A(C)
|
:0046820E 6A00                    push 00000000
:00468210 6A00                    push 00000000
:00468212 680B130000              push 0000130B
:00468217 8B55FC                  mov edx, dword ptr [ebp-04]
:0046821A 8B02                    mov eax, dword ptr [edx]
:0046821C 50                      push eax
:0046821D FF15F4624800            call dword ptr [004862F4]
:00468223 8845F8                  mov byte ptr [ebp-08], al
:00468226 8A4DF8                  mov cl, byte ptr [ebp-08]
:00468229 51                      push ecx
:0046822A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046822D E8A4000000              call 004682D6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004681CD(U), :004681F2(U), :0046820C(U)
|
:00468232 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00468156(U), :00468183(U), :004681B6(U)
|
:00468234 8BE5                    mov esp, ebp
:00468236 5D                      pop ebp
:00468237 C21000                  ret 0010


:0046823A 55                      push ebp
:0046823B 8BEC                    mov ebp, esp
:0046823D 83EC10                  sub esp, 00000010
:00468240 894DF0                  mov dword ptr [ebp-10], ecx
:00468243 8B45F0                  mov eax, dword ptr [ebp-10]
:00468246 8B4854                  mov ecx, dword ptr [eax+54]
:00468249 51                      push ecx
:0046824A 8B55F0                  mov edx, dword ptr [ebp-10]
:0046824D 8B4250                  mov eax, dword ptr [edx+50]
:00468250 50                      push eax
:00468251 E850A1FFFF              call 004623A6
:00468256 83C408                  add esp, 00000008
:00468259 6805040000              push 00000405
:0046825E 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00468261 8B5150                  mov edx, dword ptr [ecx+50]
:00468264 52                      push edx
:00468265 FF15DC624800            call dword ptr [004862DC]
:0046826B 8945F4                  mov dword ptr [ebp-0C], eax
:0046826E 8B45F4                  mov eax, dword ptr [ebp-0C]
:00468271 50                      push eax
:00468272 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00468275 81C18C0E0000            add ecx, 00000E8C
:0046827B E88AA5FFFF              call 0046280A
:00468280 68B1050000              push 000005B1
:00468285 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00468288 8B5150                  mov edx, dword ptr [ecx+50]
:0046828B 52                      push edx
:0046828C FF15DC624800            call dword ptr [004862DC]
:00468292 8945F8                  mov dword ptr [ebp-08], eax
:00468295 68EB030000              push 000003EB
:0046829A 8B45F0                  mov eax, dword ptr [ebp-10]
:0046829D 8B4850                  mov ecx, dword ptr [eax+50]
:004682A0 51                      push ecx
:004682A1 FF15DC624800            call dword ptr [004862DC]
:004682A7 8945FC                  mov dword ptr [ebp-04], eax
:004682AA 8D55F8                  lea edx, dword ptr [ebp-08]
:004682AD 52                      push edx
:004682AE 68A06C4800              push 00486CA0
:004682B3 8B45F4                  mov eax, dword ptr [ebp-0C]
:004682B6 50                      push eax
:004682B7 E8C59F0000              call 00472281
:004682BC 83C40C                  add esp, 0000000C
:004682BF 6A00                    push 00000000
:004682C1 6A00                    push 00000000
:004682C3 680C130000              push 0000130C
:004682C8 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004682CB 51                      push ecx
:004682CC FF15F4624800            call dword ptr [004862F4]
:004682D2 8BE5                    mov esp, ebp
:004682D4 5D                      pop ebp
:004682D5 C3                      ret



* Referenced by a CALL at Addresses:
|:0046814F   , :0046822D   
|
:004682D6 55                      push ebp
:004682D7 8BEC                    mov ebp, esp
:004682D9 83EC08                  sub esp, 00000008
:004682DC 894DFC                  mov dword ptr [ebp-04], ecx
:004682DF 8B45FC                  mov eax, dword ptr [ebp-04]
:004682E2 33C9                    xor ecx, ecx
:004682E4 8A4858                  mov cl, byte ptr [eax+58]
:004682E7 8B5508                  mov edx, dword ptr [ebp+08]
:004682EA 81E2FF000000            and edx, 000000FF
:004682F0 3BCA                    cmp ecx, edx
:004682F2 741D                    je 00468311
:004682F4 8B45FC                  mov eax, dword ptr [ebp-04]
:004682F7 8B4850                  mov ecx, dword ptr [eax+50]
:004682FA 51                      push ecx
:004682FB FF15C8624800            call dword ptr [004862C8]
:00468301 85C0                    test eax, eax
:00468303 740C                    je 00468311
:00468305 6A00                    push 00000000
:00468307 B9B0694B00              mov ecx, 004B69B0
:0046830C E89CC30000              call 004746AD

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004682F2(C), :00468303(C)
|
:00468311 8A5508                  mov dl, byte ptr [ebp+08]
:00468314 8855F8                  mov byte ptr [ebp-08], dl
:00468317 807DF800                cmp byte ptr [ebp-08], 00
:0046831B 7408                    je 00468325
:0046831D 807DF801                cmp byte ptr [ebp-08], 01
:00468321 742F                    je 00468352
:00468323 EB58                    jmp 0046837D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046831B(C)
|
:00468325 6A00                    push 00000000
:00468327 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046832A 81C1B40D0000            add ecx, 00000DB4
:00468330 E85BA90000              call 00472C90
:00468335 50                      push eax
:00468336 FF15E0624800            call dword ptr [004862E0]
:0046833C 6A05                    push 00000005
:0046833E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00468341 83C15C                  add ecx, 0000005C
:00468344 E847A90000              call 00472C90
:00468349 50                      push eax
:0046834A FF15E0624800            call dword ptr [004862E0]
:00468350 EB2B                    jmp 0046837D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00468321(C)
|
:00468352 6A00                    push 00000000
:00468354 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00468357 83C15C                  add ecx, 0000005C
:0046835A E831A90000              call 00472C90
:0046835F 50                      push eax
:00468360 FF15E0624800            call dword ptr [004862E0]
:00468366 6A05                    push 00000005
:00468368 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046836B 81C1B40D0000            add ecx, 00000DB4
:00468371 E81AA90000              call 00472C90
:00468376 50                      push eax
:00468377 FF15E0624800            call dword ptr [004862E0]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00468323(U), :00468350(U)
|
:0046837D 8B45FC                  mov eax, dword ptr [ebp-04]
:00468380 8A4D08                  mov cl, byte ptr [ebp+08]
:00468383 884858                  mov byte ptr [eax+58], cl
:00468386 8BE5                    mov esp, ebp
:00468388 5D                      pop ebp
:00468389 C20400                  ret 0004



* Referenced by a CALL at Address:
|:00474D79   
|
:0046838C 55                      push ebp
:0046838D 8BEC                    mov ebp, esp
:0046838F 6AFF                    push FFFFFFFF
:00468391 687A584800              push 0048587A
:00468396 64A100000000            mov eax, dword ptr fs:[00000000]
:0046839C 50                      push eax
:0046839D 64892500000000          mov dword ptr fs:[00000000], esp
:004683A4 81EC980E0000            sub esp, 00000E98
:004683AA 8D8D5CF1FFFF            lea ecx, dword ptr [ebp+FFFFF15C]
:004683B0 E8FBA80000              call 00472CB0
:004683B5 C745FC00000000          mov [ebp-04], 00000000
:004683BC 8B450C                  mov eax, dword ptr [ebp+0C]
:004683BF 50                      push eax
:004683C0 8B4D08                  mov ecx, dword ptr [ebp+08]
:004683C3 51                      push ecx
:004683C4 8D8D5CF1FFFF            lea ecx, dword ptr [ebp+FFFFF15C]
:004683CA E8E3FCFFFF              call 004680B2
:004683CF C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:004683D6 8D8D5CF1FFFF            lea ecx, dword ptr [ebp+FFFFF15C]
:004683DC E8FFA90000              call 00472DE0
:004683E1 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004683E4 64890D00000000          mov dword ptr fs:[00000000], ecx
:004683EB 8BE5                    mov esp, ebp
:004683ED 5D                      pop ebp
:004683EE C3                      ret


:004683EF 55                      push ebp
:004683F0 8BEC                    mov ebp, esp
:004683F2 83EC10                  sub esp, 00000010
:004683F5 894DF0                  mov dword ptr [ebp-10], ecx
:004683F8 837D0800                cmp dword ptr [ebp+08], 00000000
:004683FC 7C20                    jl 0046841E
:004683FE 8B4508                  mov eax, dword ptr [ebp+08]
:00468401 50                      push eax
:00468402 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00468405 E892BBFFFF              call 00463F9C
:0046840A 8945FC                  mov dword ptr [ebp-04], eax
:0046840D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00468410 51                      push ecx
:00468411 8B55F0                  mov edx, dword ptr [ebp-10]
:00468414 8B4A50                  mov ecx, dword ptr [edx+50]
:00468417 E8A20A0000              call 00468EBE
:0046841C EB24                    jmp 00468442

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004683FC(C)
|
:0046841E C645F4FF                mov [ebp-0C], FF
:00468422 C645F500                mov [ebp-0B], 00
:00468426 C645F600                mov [ebp-0A], 00
:0046842A C645F701                mov [ebp-09], 01
:0046842E 33C0                    xor eax, eax
:00468430 8945F8                  mov dword ptr [ebp-08], eax
:00468433 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:00468436 51                      push ecx
:00468437 8B55F0                  mov edx, dword ptr [ebp-10]
:0046843A 8B4A50                  mov ecx, dword ptr [edx+50]
:0046843D E87C0A0000              call 00468EBE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046841C(U)
|
:00468442 8BE5                    mov esp, ebp
:00468444 5D                      pop ebp
:00468445 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0046BAA1   
|
:00468448 55                      push ebp
:00468449 8BEC                    mov ebp, esp
:0046844B 83EC08                  sub esp, 00000008
:0046844E 894DF8                  mov dword ptr [ebp-08], ecx
:00468451 B970074B00              mov ecx, 004B0770
:00468456 E88552FAFF              call 0040D6E0
:0046845B 8845FC                  mov byte ptr [ebp-04], al
:0046845E 8B45FC                  mov eax, dword ptr [ebp-04]
:00468461 25FF000000              and eax, 000000FF

* Possible Reference to Dialog: DialogID_00C8 
                                  |
:00468466 3DC8000000              cmp eax, 000000C8
:0046846B 7D20                    jge 0046848D
:0046846D 8B4D08                  mov ecx, dword ptr [ebp+08]
:00468470 8A5103                  mov dl, byte ptr [ecx+03]
:00468473 52                      push edx
:00468474 8B4508                  mov eax, dword ptr [ebp+08]
:00468477 8A4802                  mov cl, byte ptr [eax+02]
:0046847A 51                      push ecx
:0046847B 8B5508                  mov edx, dword ptr [ebp+08]
:0046847E 8A02                    mov al, byte ptr [edx]
:00468480 50                      push eax
:00468481 B970074B00              mov ecx, 004B0770
:00468486 E81153FAFF              call 0040D79C
:0046848B EB39                    jmp 004684C6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046846B(C)
|
:0046848D 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"qɂςłB"
                                  |
:0046848F 6808E74800              push 0048E708
:00468494 B970074B00              mov ecx, 004B0770
:00468499 E8F14DFAFF              call 0040D28F
:0046849E 8AC8                    mov cl, al
:004684A0 81E1FF000000            and ecx, 000000FF
:004684A6 6BC928                  imul ecx, 00000028
:004684A9 81C168EB4A00            add ecx, 004AEB68
:004684AF E8BC71FFFF              call 0045F670
:004684B4 50                      push eax
:004684B5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004684B8 8B510C                  mov edx, dword ptr [ecx+0C]
:004684BB 52                      push edx
:004684BC E8E3540000              call 0046D9A4
:004684C1 83C410                  add esp, 00000010
:004684C4 B0C8                    mov al, C8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046848B(U)
|
:004684C6 8BE5                    mov esp, ebp
:004684C8 5D                      pop ebp
:004684C9 C20400                  ret 0004



* Referenced by a CALL at Address:
|:00468859   
|
:004684CC 55                      push ebp
:004684CD 8BEC                    mov ebp, esp
:004684CF 83EC5C                  sub esp, 0000005C
:004684D2 894DA4                  mov dword ptr [ebp-5C], ecx
:004684D5 8B4508                  mov eax, dword ptr [ebp+08]
:004684D8 83780400                cmp dword ptr [eax+04], 00000000
:004684DC 0F8432020000            je 00468714
:004684E2 8B4DA4                  mov ecx, dword ptr [ebp-5C]
:004684E5 E8A8CEFFFF              call 00465392
:004684EA 8B4D08                  mov ecx, dword ptr [ebp+08]
:004684ED 33D2                    xor edx, edx
:004684EF 8A11                    mov dl, byte ptr [ecx]
:004684F1 8BCA                    mov ecx, edx
:004684F3 6BC919                  imul ecx, 00000019
:004684F6 81C140114A00            add ecx, 004A1140
:004684FC E86F5BFAFF              call 0040E070
:00468501 8945BC                  mov dword ptr [ebp-44], eax
:00468504 B970074B00              mov ecx, 004B0770
:00468509 E8C25CFAFF              call 0040E1D0
:0046850E 8945B8                  mov dword ptr [ebp-48], eax
:00468511 8B4508                  mov eax, dword ptr [ebp+08]
:00468514 33C9                    xor ecx, ecx
:00468516 8A08                    mov cl, byte ptr [eax]
:00468518 6BC919                  imul ecx, 00000019
:0046851B 81C140114A00            add ecx, 004A1140
:00468521 E8C441FAFF              call 0040C6EA
:00468526 50                      push eax
:00468527 8B55A4                  mov edx, dword ptr [ebp-5C]
:0046852A 8B4A50                  mov ecx, dword ptr [edx+50]
:0046852D E8FEA90000              call 00472F30
:00468532 8BC8                    mov ecx, eax
:00468534 E8B7E0F9FF              call 004065F0
:00468539 25FF000000              and eax, 000000FF
:0046853E 3DFF000000              cmp eax, 000000FF
:00468543 7464                    je 004685A9
:00468545 B970074B00              mov ecx, 004B0770
:0046854A E89151FAFF              call 0040D6E0
:0046854F 25FF000000              and eax, 000000FF

* Possible Reference to Dialog: DialogID_00C8 
                                  |
:00468554 3DC8000000              cmp eax, 000000C8
:00468559 7C4E                    jl 004685A9
:0046855B 8B4DA4                  mov ecx, dword ptr [ebp-5C]
:0046855E E804B9FFFF              call 00463E67
:00468563 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"qɂςłB"
                                  |
:00468565 6820E74800              push 0048E720
:0046856A B970074B00              mov ecx, 004B0770
:0046856F E81B4DFAFF              call 0040D28F
:00468574 8AC8                    mov cl, al
:00468576 81E1FF000000            and ecx, 000000FF
:0046857C 6BC928                  imul ecx, 00000028
:0046857F 81C168EB4A00            add ecx, 004AEB68
:00468585 E8E670FFFF              call 0045F670
:0046858A 50                      push eax
:0046858B 8B45A4                  mov eax, dword ptr [ebp-5C]
:0046858E 8B480C                  mov ecx, dword ptr [eax+0C]
:00468591 51                      push ecx
:00468592 E80D540000              call 0046D9A4
:00468597 83C410                  add esp, 00000010
:0046859A 8B4DA4                  mov ecx, dword ptr [ebp-5C]
:0046859D E8F3B8FFFF              call 00463E95
:004685A2 33C0                    xor eax, eax
:004685A4 E96D010000              jmp 00468716

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00468543(C), :00468559(C)
|
:004685A9 8B5508                  mov edx, dword ptr [ebp+08]
:004685AC 33C0                    xor eax, eax
:004685AE 8A02                    mov al, byte ptr [edx]
:004685B0 8BC8                    mov ecx, eax
:004685B2 6BC919                  imul ecx, 00000019
:004685B5 81C140114A00            add ecx, 004A1140
:004685BB E8B05AFAFF              call 0040E070
:004685C0 50                      push eax
:004685C1 8B4D08                  mov ecx, dword ptr [ebp+08]
:004685C4 33D2                    xor edx, edx
:004685C6 8A11                    mov dl, byte ptr [ecx]
:004685C8 8BCA                    mov ecx, edx
:004685CA 6BC919                  imul ecx, 00000019
:004685CD 81C140114A00            add ecx, 004A1140
:004685D3 E83871FFFF              call 0045F710
:004685D8 50                      push eax
:004685D9 68486D4800              push 00486D48
:004685DE 8D45C0                  lea eax, dword ptr [ebp-40]
:004685E1 50                      push eax
:004685E2 FF15C0624800            call dword ptr [004862C0]
:004685E8 83C410                  add esp, 00000010
:004685EB 8B4DA4                  mov ecx, dword ptr [ebp-5C]
:004685EE E874B8FFFF              call 00463E67
:004685F3 6A01                    push 00000001
:004685F5 8D4DC0                  lea ecx, dword ptr [ebp-40]
:004685F8 51                      push ecx
:004685F9 B970074B00              mov ecx, 004B0770
:004685FE E88C4CFAFF              call 0040D28F
:00468603 8AC8                    mov cl, al
:00468605 81E1FF000000            and ecx, 000000FF
:0046860B 6BC928                  imul ecx, 00000028
:0046860E 81C168EB4A00            add ecx, 004AEB68
:00468614 E8571BFBFF              call 0041A170
:00468619 50                      push eax
:0046861A 8B55A4                  mov edx, dword ptr [ebp-5C]
:0046861D 8B420C                  mov eax, dword ptr [edx+0C]
:00468620 50                      push eax
:00468621 E87E530000              call 0046D9A4
:00468626 83C410                  add esp, 00000010
:00468629 85C0                    test eax, eax
:0046862B 0F84DB000000            je 0046870C
:00468631 B970074B00              mov ecx, 004B0770
:00468636 E8955BFAFF              call 0040E1D0
:0046863B 8945A8                  mov dword ptr [ebp-58], eax
:0046863E 8B4DBC                  mov ecx, dword ptr [ebp-44]
:00468641 51                      push ecx
:00468642 B970074B00              mov ecx, 004B0770
:00468647 E8D755FAFF              call 0040DC23
:0046864C B970074B00              mov ecx, 004B0770
:00468651 E87A5BFAFF              call 0040E1D0
:00468656 8945AC                  mov dword ptr [ebp-54], eax
:00468659 6A00                    push 00000000
:0046865B 8B55AC                  mov edx, dword ptr [ebp-54]
:0046865E 52                      push edx
:0046865F 6875040000              push 00000475
:00468664 8B45A4                  mov eax, dword ptr [ebp-5C]
:00468667 8B480C                  mov ecx, dword ptr [eax+0C]
:0046866A 51                      push ecx
:0046866B FF15E4624800            call dword ptr [004862E4]
:00468671 C745B000000000          mov [ebp-50], 00000000
:00468678 EB09                    jmp 00468683

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004686EF(U)
|
:0046867A 8B55B0                  mov edx, dword ptr [ebp-50]
:0046867D 83C201                  add edx, 00000001
:00468680 8955B0                  mov dword ptr [ebp-50], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00468678(U)
|
:00468683 8B4DA4                  mov ecx, dword ptr [ebp-5C]
:00468686 E8353DFBFF              call 0041C3C0
:0046868B 3945B0                  cmp dword ptr [ebp-50], eax
:0046868E 7D61                    jge 004686F1
:00468690 8B45B0                  mov eax, dword ptr [ebp-50]
:00468693 50                      push eax
:00468694 8B4DA4                  mov ecx, dword ptr [ebp-5C]
:00468697 E800B9FFFF              call 00463F9C
:0046869C 8945B4                  mov dword ptr [ebp-4C], eax
:0046869F 8B4DB4                  mov ecx, dword ptr [ebp-4C]
:004686A2 33D2                    xor edx, edx
:004686A4 8A11                    mov dl, byte ptr [ecx]
:004686A6 8BCA                    mov ecx, edx
:004686A8 6BC919                  imul ecx, 00000019
:004686AB 81C140114A00            add ecx, 004A1140
:004686B1 E8BA59FAFF              call 0040E070
:004686B6 3B45A8                  cmp eax, dword ptr [ebp-58]
:004686B9 7734                    ja 004686EF
:004686BB 8B45B4                  mov eax, dword ptr [ebp-4C]
:004686BE 33C9                    xor ecx, ecx
:004686C0 8A08                    mov cl, byte ptr [eax]
:004686C2 6BC919                  imul ecx, 00000019
:004686C5 81C140114A00            add ecx, 004A1140
:004686CB E8A059FAFF              call 0040E070
:004686D0 3945AC                  cmp dword ptr [ebp-54], eax
:004686D3 731A                    jnb 004686EF
:004686D5 8B55B0                  mov edx, dword ptr [ebp-50]
:004686D8 52                      push edx
:004686D9 8B45B0                  mov eax, dword ptr [ebp-50]
:004686DC 50                      push eax
:004686DD 6815100000              push 00001015
:004686E2 8B4DA4                  mov ecx, dword ptr [ebp-5C]
:004686E5 8B5110                  mov edx, dword ptr [ecx+10]
:004686E8 52                      push edx
:004686E9 FF15F4624800            call dword ptr [004862F4]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004686B9(C), :004686D3(C)
|
:004686EF EB89                    jmp 0046867A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046868E(C)
|
:004686F1 8B4508                  mov eax, dword ptr [ebp+08]
:004686F4 50                      push eax
:004686F5 8B4DA4                  mov ecx, dword ptr [ebp-5C]
:004686F8 E863B9FFFF              call 00464060
:004686FD 8B4DA4                  mov ecx, dword ptr [ebp-5C]
:00468700 E890B7FFFF              call 00463E95
:00468705 B801000000              mov eax, 00000001
:0046870A EB0A                    jmp 00468716

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046862B(C)
|
:0046870C 8B4DA4                  mov ecx, dword ptr [ebp-5C]
:0046870F E881B7FFFF              call 00463E95

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004684DC(C)
|
:00468714 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004685A4(U), :0046870A(U)
|
:00468716 8BE5                    mov esp, ebp
:00468718 5D                      pop ebp
:00468719 C20400                  ret 0004


:0046871C 55                      push ebp
:0046871D 8BEC                    mov ebp, esp
:0046871F 83EC0C                  sub esp, 0000000C
:00468722 894DF4                  mov dword ptr [ebp-0C], ecx
:00468725 8B45F4                  mov eax, dword ptr [ebp-0C]
:00468728 8B4850                  mov ecx, dword ptr [eax+50]
:0046872B E800A80000              call 00472F30
:00468730 8945F8                  mov dword ptr [ebp-08], eax
:00468733 C745FC00000000          mov [ebp-04], 00000000
:0046873A EB09                    jmp 00468745

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046877C(U)
|
:0046873C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046873F 83C101                  add ecx, 00000001
:00468742 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046873A(U)
|
:00468745 837DFC10                cmp dword ptr [ebp-04], 00000010
:00468749 7D33                    jge 0046877E
:0046874B 8B55FC                  mov edx, dword ptr [ebp-04]
:0046874E 8B45F4                  mov eax, dword ptr [ebp-0C]
:00468751 33C9                    xor ecx, ecx
:00468753 8A4CD054                mov cl, byte ptr [eax+8*edx+54]
:00468757 81F9FF000000            cmp ecx, 000000FF
:0046875D 741D                    je 0046877C
:0046875F 8B55FC                  mov edx, dword ptr [ebp-04]
:00468762 8B45F4                  mov eax, dword ptr [ebp-0C]
:00468765 8A4CD054                mov cl, byte ptr [eax+8*edx+54]
:00468769 51                      push ecx
:0046876A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046876D E895F1F9FF              call 00407907
:00468772 8B55FC                  mov edx, dword ptr [ebp-04]
:00468775 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00468778 8944D158                mov dword ptr [ecx+8*edx+58], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046875D(C)
|
:0046877C EBBE                    jmp 0046873C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00468749(C)
|
:0046877E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00468781 E8B9B8FFFF              call 0046403F
:00468786 8BE5                    mov esp, ebp
:00468788 5D                      pop ebp
:00468789 C3                      ret


:0046878A 55                      push ebp
:0046878B 8BEC                    mov ebp, esp
:0046878D 83EC24                  sub esp, 00000024
:00468790 894DDC                  mov dword ptr [ebp-24], ecx
:00468793 8B45DC                  mov eax, dword ptr [ebp-24]
:00468796 33C9                    xor ecx, ecx
:00468798 8A4814                  mov cl, byte ptr [eax+14]
:0046879B 85C9                    test ecx, ecx
:0046879D 754F                    jne 004687EE
:0046879F C745E000000000          mov [ebp-20], 00000000
:004687A6 C745E403000000          mov [ebp-1C], 00000003
:004687AD C745E808000000          mov [ebp-18], 00000008
:004687B4 C745EC05000000          mov [ebp-14], 00000005
:004687BB C745F00B000000          mov [ebp-10], 0000000B

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:004687C2 C745F407000000          mov [ebp-0C], 00000007

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:004687C9 C745F806000000          mov [ebp-08], 00000006
:004687D0 C645FC07                mov [ebp-04], 07
:004687D4 8D55E0                  lea edx, dword ptr [ebp-20]
:004687D7 52                      push edx
:004687D8 8A45FC                  mov al, byte ptr [ebp-04]
:004687DB 50                      push eax
:004687DC 8B4DDC                  mov ecx, dword ptr [ebp-24]
:004687DF E817B5FFFF              call 00463CFB
:004687E4 8B4DDC                  mov ecx, dword ptr [ebp-24]
:004687E7 E803EFFFFF              call 004676EF
:004687EC EB16                    jmp 00468804

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046879D(C)
|
:004687EE 6A00                    push 00000000
:004687F0 6A00                    push 00000000
:004687F2 6809100000              push 00001009
:004687F7 8B4DDC                  mov ecx, dword ptr [ebp-24]
:004687FA 8B5110                  mov edx, dword ptr [ecx+10]
:004687FD 52                      push edx
:004687FE FF15F4624800            call dword ptr [004862F4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004687EC(U)
|
:00468804 6A01                    push 00000001
:00468806 6A00                    push 00000000
:00468808 68FF000000              push 000000FF
:0046880D 8B45DC                  mov eax, dword ptr [ebp-24]
:00468810 83C054                  add eax, 00000054
:00468813 50                      push eax
:00468814 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00468817 E811E3FFFF              call 00466B2D
:0046881C 6A00                    push 00000000
:0046881E 6A00                    push 00000000
:00468820 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00468823 E803C5FFFF              call 00464D2B
:00468828 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0046882B E89DB8FFFF              call 004640CD
:00468830 8BE5                    mov esp, ebp
:00468832 5D                      pop ebp
:00468833 C3                      ret


:00468834 55                      push ebp
:00468835 8BEC                    mov ebp, esp
:00468837 83EC08                  sub esp, 00000008
:0046883A 894DF8                  mov dword ptr [ebp-08], ecx
:0046883D 837D0800                cmp dword ptr [ebp+08], 00000000
:00468841 7C2E                    jl 00468871
:00468843 8B4508                  mov eax, dword ptr [ebp+08]
:00468846 50                      push eax
:00468847 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046884A E84DB7FFFF              call 00463F9C
:0046884F 8945FC                  mov dword ptr [ebp-04], eax
:00468852 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00468855 51                      push ecx
:00468856 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00468859 E86EFCFFFF              call 004684CC
:0046885E 85C0                    test eax, eax
:00468860 740F                    je 00468871
:00468862 8B55FC                  mov edx, dword ptr [ebp-04]
:00468865 52                      push edx
:00468866 8B45F8                  mov eax, dword ptr [ebp-08]
:00468869 8B4850                  mov ecx, dword ptr [eax+50]
:0046886C E80D050000              call 00468D7E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00468841(C), :00468860(C)
|
:00468871 8BE5                    mov esp, ebp
:00468873 5D                      pop ebp
:00468874 C20400                  ret 0004


:00468877 55                      push ebp
:00468878 8BEC                    mov ebp, esp
:0046887A 83EC0C                  sub esp, 0000000C
:0046887D 56                      push esi
:0046887E 894DF8                  mov dword ptr [ebp-08], ecx
:00468881 837D0800                cmp dword ptr [ebp+08], 00000000
:00468885 7C5B                    jl 004688E2
:00468887 8B4508                  mov eax, dword ptr [ebp+08]
:0046888A 50                      push eax
:0046888B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046888E E809B7FFFF              call 00463F9C
:00468893 8945FC                  mov dword ptr [ebp-04], eax
:00468896 8B4D08                  mov ecx, dword ptr [ebp+08]
:00468899 51                      push ecx
:0046889A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046889D E8A4E8FFFF              call 00467146
:004688A2 85C0                    test eax, eax
:004688A4 7430                    je 004688D6
:004688A6 8B55FC                  mov edx, dword ptr [ebp-04]
:004688A9 33C0                    xor eax, eax
:004688AB 8A02                    mov al, byte ptr [edx]
:004688AD 8BC8                    mov ecx, eax
:004688AF 6BC919                  imul ecx, 00000019
:004688B2 81C140114A00            add ecx, 004A1140
:004688B8 E8B357FAFF              call 0040E070
:004688BD 8BF0                    mov esi, eax
:004688BF B970074B00              mov ecx, 004B0770
:004688C4 E80759FAFF              call 0040E1D0
:004688C9 3BF0                    cmp esi, eax
:004688CB 7709                    ja 004688D6
:004688CD C745F401000000          mov [ebp-0C], 00000001
:004688D4 EB07                    jmp 004688DD

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004688A4(C), :004688CB(C)
|
:004688D6 C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004688D4(U)
|
:004688DD 8B45F4                  mov eax, dword ptr [ebp-0C]
:004688E0 EB02                    jmp 004688E4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00468885(C)
|
:004688E2 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004688E0(U)
|
:004688E4 5E                      pop esi
:004688E5 8BE5                    mov esp, ebp
:004688E7 5D                      pop ebp
:004688E8 C20400                  ret 0004



* Referenced by a CALL at Address:
|:00468BFE   
|
:004688EB 55                      push ebp
:004688EC 8BEC                    mov ebp, esp
:004688EE 6AFF                    push FFFFFFFF
:004688F0 688D584800              push 0048588D
:004688F5 64A100000000            mov eax, dword ptr fs:[00000000]
:004688FB 50                      push eax
:004688FC 64892500000000          mov dword ptr fs:[00000000], esp
:00468903 81EC84000000            sub esp, 00000084
:00468909 898D70FFFFFF            mov dword ptr [ebp+FFFFFF70], ecx
:0046890F 8B4508                  mov eax, dword ptr [ebp+08]
:00468912 33C9                    xor ecx, ecx
:00468914 8A08                    mov cl, byte ptr [eax]
:00468916 6BC919                  imul ecx, 00000019
:00468919 81C140114A00            add ecx, 004A1140
:0046891F E84C57FAFF              call 0040E070
:00468924 89458C                  mov dword ptr [ebp-74], eax
:00468927 B970074B00              mov ecx, 004B0770
:0046892C E89F58FAFF              call 0040E1D0
:00468931 894584                  mov dword ptr [ebp-7C], eax
:00468934 8B5508                  mov edx, dword ptr [ebp+08]
:00468937 8A02                    mov al, byte ptr [edx]
:00468939 50                      push eax
:0046893A B970074B00              mov ecx, 004B0770
:0046893F E8FA51FAFF              call 0040DB3E
:00468944 25FF000000              and eax, 000000FF
:00468949 B963000000              mov ecx, 00000063
:0046894E 2BC8                    sub ecx, eax
:00468950 884D90                  mov byte ptr [ebp-70], cl
:00468953 8B5590                  mov edx, dword ptr [ebp-70]
:00468956 81E2FF000000            and edx, 000000FF
:0046895C 8B458C                  mov eax, dword ptr [ebp-74]
:0046895F 0FAFC2                  imul eax, edx
:00468962 3B4584                  cmp eax, dword ptr [ebp-7C]
:00468965 770E                    ja 00468975
:00468967 8B4D90                  mov ecx, dword ptr [ebp-70]
:0046896A 81E1FF000000            and ecx, 000000FF
:00468970 894D94                  mov dword ptr [ebp-6C], ecx
:00468973 EB0B                    jmp 00468980

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00468965(C)
|
:00468975 8B4584                  mov eax, dword ptr [ebp-7C]
:00468978 33D2                    xor edx, edx
:0046897A F7758C                  div [ebp-74]
:0046897D 894594                  mov dword ptr [ebp-6C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00468973(U)
|
:00468980 8D4DA0                  lea ecx, dword ptr [ebp-60]
:00468983 E8C8A40000              call 00472E50
:00468988 C745FC00000000          mov [ebp-04], 00000000
:0046898F 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:00468995 E8CDB4FFFF              call 00463E67
:0046899A 6A01                    push 00000001
:0046899C 8A5594                  mov dl, byte ptr [ebp-6C]
:0046899F 52                      push edx
:004689A0 8B4508                  mov eax, dword ptr [ebp+08]
:004689A3 33C9                    xor ecx, ecx
:004689A5 8A08                    mov cl, byte ptr [eax]
:004689A7 51                      push ecx
:004689A8 8B9570FFFFFF            mov edx, dword ptr [ebp+FFFFFF70]
:004689AE 8B420C                  mov eax, dword ptr [edx+0C]
:004689B1 50                      push eax
:004689B2 8D4DA0                  lea ecx, dword ptr [ebp-60]
:004689B5 E89D530000              call 0046DD57
:004689BA 89459C                  mov dword ptr [ebp-64], eax
:004689BD 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:004689C3 E8CDB4FFFF              call 00463E95
:004689C8 837D9C01                cmp dword ptr [ebp-64], 00000001
:004689CC 7D24                    jge 004689F2
:004689CE C78578FFFFFF00000000    mov dword ptr [ebp+FFFFFF78], 00000000
:004689D8 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:004689DF 8D4DA0                  lea ecx, dword ptr [ebp-60]
:004689E2 E809A50000              call 00472EF0
:004689E7 8B8578FFFFFF            mov eax, dword ptr [ebp+FFFFFF78]
:004689ED E93C010000              jmp 00468B2E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004689CC(C)
|
:004689F2 8B4D08                  mov ecx, dword ptr [ebp+08]
:004689F5 8A11                    mov dl, byte ptr [ecx]
:004689F7 52                      push edx
:004689F8 B970074B00              mov ecx, 004B0770
:004689FD E83C51FAFF              call 0040DB3E
:00468A02 884598                  mov byte ptr [ebp-68], al
:00468A05 8B4598                  mov eax, dword ptr [ebp-68]
:00468A08 25FF000000              and eax, 000000FF
:00468A0D 03459C                  add eax, dword ptr [ebp-64]
:00468A10 50                      push eax
:00468A11 8B4D08                  mov ecx, dword ptr [ebp+08]
:00468A14 8A11                    mov dl, byte ptr [ecx]
:00468A16 52                      push edx
:00468A17 B970074B00              mov ecx, 004B0770
:00468A1C E8DA50FAFF              call 0040DAFB
:00468A21 8B458C                  mov eax, dword ptr [ebp-74]
:00468A24 0FAF459C                imul eax, dword ptr [ebp-64]
:00468A28 89458C                  mov dword ptr [ebp-74], eax
:00468A2B B970074B00              mov ecx, 004B0770
:00468A30 E89B57FAFF              call 0040E1D0
:00468A35 89857CFFFFFF            mov dword ptr [ebp+FFFFFF7C], eax
:00468A3B 8B4D8C                  mov ecx, dword ptr [ebp-74]
:00468A3E 51                      push ecx
:00468A3F B970074B00              mov ecx, 004B0770
:00468A44 E8DA51FAFF              call 0040DC23
:00468A49 B970074B00              mov ecx, 004B0770
:00468A4E E87D57FAFF              call 0040E1D0
:00468A53 894580                  mov dword ptr [ebp-80], eax
:00468A56 6A00                    push 00000000
:00468A58 8B5580                  mov edx, dword ptr [ebp-80]
:00468A5B 52                      push edx
:00468A5C 6875040000              push 00000475
:00468A61 8B8570FFFFFF            mov eax, dword ptr [ebp+FFFFFF70]
:00468A67 8B480C                  mov ecx, dword ptr [eax+0C]
:00468A6A 51                      push ecx
:00468A6B FF15E4624800            call dword ptr [004862E4]
:00468A71 C7458800000000          mov [ebp-78], 00000000
:00468A78 EB09                    jmp 00468A83

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00468AFB(U)
|
:00468A7A 8B5588                  mov edx, dword ptr [ebp-78]
:00468A7D 83C201                  add edx, 00000001
:00468A80 895588                  mov dword ptr [ebp-78], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00468A78(U)
|
:00468A83 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:00468A89 E83239FBFF              call 0041C3C0
:00468A8E 394588                  cmp dword ptr [ebp-78], eax
:00468A91 7D6D                    jge 00468B00
:00468A93 8B4588                  mov eax, dword ptr [ebp-78]
:00468A96 50                      push eax
:00468A97 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:00468A9D E8FAB4FFFF              call 00463F9C
:00468AA2 8945F0                  mov dword ptr [ebp-10], eax
:00468AA5 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00468AA8 33D2                    xor edx, edx
:00468AAA 8A11                    mov dl, byte ptr [ecx]
:00468AAC 8BCA                    mov ecx, edx
:00468AAE 6BC919                  imul ecx, 00000019
:00468AB1 81C140114A00            add ecx, 004A1140
:00468AB7 E8B455FAFF              call 0040E070
:00468ABC 3B857CFFFFFF            cmp eax, dword ptr [ebp+FFFFFF7C]
:00468AC2 7737                    ja 00468AFB
:00468AC4 8B45F0                  mov eax, dword ptr [ebp-10]
:00468AC7 33C9                    xor ecx, ecx
:00468AC9 8A08                    mov cl, byte ptr [eax]
:00468ACB 6BC919                  imul ecx, 00000019
:00468ACE 81C140114A00            add ecx, 004A1140
:00468AD4 E89755FAFF              call 0040E070
:00468AD9 394580                  cmp dword ptr [ebp-80], eax
:00468ADC 731D                    jnb 00468AFB
:00468ADE 8B5588                  mov edx, dword ptr [ebp-78]
:00468AE1 52                      push edx
:00468AE2 8B4588                  mov eax, dword ptr [ebp-78]
:00468AE5 50                      push eax
:00468AE6 6815100000              push 00001015
:00468AEB 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:00468AF1 8B5110                  mov edx, dword ptr [ecx+10]
:00468AF4 52                      push edx
:00468AF5 FF15F4624800            call dword ptr [004862F4]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00468AC2(C), :00468ADC(C)
|
:00468AFB E97AFFFFFF              jmp 00468A7A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00468A91(C)
|
:00468B00 8B4508                  mov eax, dword ptr [ebp+08]
:00468B03 50                      push eax
:00468B04 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:00468B0A E851B5FFFF              call 00464060
:00468B0F C78574FFFFFF01000000    mov dword ptr [ebp+FFFFFF74], 00000001
:00468B19 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00468B20 8D4DA0                  lea ecx, dword ptr [ebp-60]
:00468B23 E8C8A30000              call 00472EF0
:00468B28 8B8574FFFFFF            mov eax, dword ptr [ebp+FFFFFF74]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004689ED(U)
|
:00468B2E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00468B31 64890D00000000          mov dword ptr fs:[00000000], ecx
:00468B38 8BE5                    mov esp, ebp
:00468B3A 5D                      pop ebp
:00468B3B C20400                  ret 0004


:00468B3E 55                      push ebp
:00468B3F 8BEC                    mov ebp, esp
:00468B41 83EC1C                  sub esp, 0000001C
:00468B44 894DE4                  mov dword ptr [ebp-1C], ecx
:00468B47 8B45E4                  mov eax, dword ptr [ebp-1C]
:00468B4A 33C9                    xor ecx, ecx
:00468B4C 8A4814                  mov cl, byte ptr [eax+14]
:00468B4F 85C9                    test ecx, ecx
:00468B51 7541                    jne 00468B94
:00468B53 C745E800000000          mov [ebp-18], 00000000
:00468B5A C745EC04000000          mov [ebp-14], 00000004
:00468B61 C745F005000000          mov [ebp-10], 00000005
:00468B68 C745F40B000000          mov [ebp-0C], 0000000B

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:00468B6F C745F806000000          mov [ebp-08], 00000006
:00468B76 C645FC05                mov [ebp-04], 05
:00468B7A 8D55E8                  lea edx, dword ptr [ebp-18]
:00468B7D 52                      push edx
:00468B7E 8A45FC                  mov al, byte ptr [ebp-04]
:00468B81 50                      push eax
:00468B82 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00468B85 E871B1FFFF              call 00463CFB
:00468B8A 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00468B8D E85DEBFFFF              call 004676EF
:00468B92 EB16                    jmp 00468BAA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00468B51(C)
|
:00468B94 6A00                    push 00000000
:00468B96 6A00                    push 00000000
:00468B98 6809100000              push 00001009
:00468B9D 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00468BA0 8B5110                  mov edx, dword ptr [ecx+10]
:00468BA3 52                      push edx
:00468BA4 FF15F4624800            call dword ptr [004862F4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00468B92(U)
|
:00468BAA 8B45E4                  mov eax, dword ptr [ebp-1C]
:00468BAD 83C050                  add eax, 00000050
:00468BB0 50                      push eax
:00468BB1 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00468BB4 E8CEE0FFFF              call 00466C87
:00468BB9 6A00                    push 00000000
:00468BBB 6A00                    push 00000000
:00468BBD 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00468BC0 E866C1FFFF              call 00464D2B
:00468BC5 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00468BC8 E800B5FFFF              call 004640CD
:00468BCD 8BE5                    mov esp, ebp
:00468BCF 5D                      pop ebp
:00468BD0 C3                      ret


:00468BD1 55                      push ebp
:00468BD2 8BEC                    mov ebp, esp
:00468BD4 83EC08                  sub esp, 00000008
:00468BD7 894DF8                  mov dword ptr [ebp-08], ecx
:00468BDA 837D0800                cmp dword ptr [ebp+08], 00000000
:00468BDE 7C23                    jl 00468C03
:00468BE0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00468BE3 E8AAC7FFFF              call 00465392
:00468BE8 8B4508                  mov eax, dword ptr [ebp+08]
:00468BEB 50                      push eax
:00468BEC 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00468BEF E8A8B3FFFF              call 00463F9C
:00468BF4 8945FC                  mov dword ptr [ebp-04], eax
:00468BF7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00468BFA 51                      push ecx
:00468BFB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00468BFE E8E8FCFFFF              call 004688EB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00468BDE(C)
|
:00468C03 8BE5                    mov esp, ebp
:00468C05 5D                      pop ebp
:00468C06 C20400                  ret 0004


:00468C09 55                      push ebp
:00468C0A 8BEC                    mov ebp, esp
:00468C0C 83EC0C                  sub esp, 0000000C
:00468C0F 56                      push esi
:00468C10 894DF8                  mov dword ptr [ebp-08], ecx
:00468C13 837D0800                cmp dword ptr [ebp+08], 00000000
:00468C17 7C5B                    jl 00468C74
:00468C19 8B4508                  mov eax, dword ptr [ebp+08]
:00468C1C 50                      push eax
:00468C1D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00468C20 E877B3FFFF              call 00463F9C
:00468C25 8945FC                  mov dword ptr [ebp-04], eax
:00468C28 8B4D08                  mov ecx, dword ptr [ebp+08]
:00468C2B 51                      push ecx
:00468C2C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00468C2F E812E5FFFF              call 00467146
:00468C34 85C0                    test eax, eax
:00468C36 7430                    je 00468C68
:00468C38 8B55FC                  mov edx, dword ptr [ebp-04]
:00468C3B 33C0                    xor eax, eax
:00468C3D 8A02                    mov al, byte ptr [edx]
:00468C3F 8BC8                    mov ecx, eax
:00468C41 6BC919                  imul ecx, 00000019
:00468C44 81C140114A00            add ecx, 004A1140
:00468C4A E82154FAFF              call 0040E070
:00468C4F 8BF0                    mov esi, eax
:00468C51 B970074B00              mov ecx, 004B0770
:00468C56 E87555FAFF              call 0040E1D0
:00468C5B 3BF0                    cmp esi, eax
:00468C5D 7709                    ja 00468C68
:00468C5F C745F401000000          mov [ebp-0C], 00000001
:00468C66 EB07                    jmp 00468C6F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00468C36(C), :00468C5D(C)
|
:00468C68 C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00468C66(U)
|
:00468C6F 8B45F4                  mov eax, dword ptr [ebp-0C]
:00468C72 EB02                    jmp 00468C76

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00468C17(C)
|
:00468C74 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00468C72(U)
|
:00468C76 5E                      pop esi
:00468C77 8BE5                    mov esp, ebp
:00468C79 5D                      pop ebp
:00468C7A C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0046A636   , :0047A7E4   
|
:00468C7D 55                      push ebp
:00468C7E 8BEC                    mov ebp, esp
:00468C80 51                      push ecx
:00468C81 8B4508                  mov eax, dword ptr [ebp+08]
:00468C84 25FF000000              and eax, 000000FF
:00468C89 83F826                  cmp eax, 00000026
:00468C8C 7F40                    jg 00468CCE
:00468C8E 8B4508                  mov eax, dword ptr [ebp+08]
:00468C91 25FF000000              and eax, 000000FF
:00468C96 99                      cdq
:00468C97 B903000000              mov ecx, 00000003
:00468C9C F7F9                    idiv ecx
:00468C9E 83FA02                  cmp edx, 00000002
:00468CA1 7D2B                    jge 00468CCE
:00468CA3 8B4508                  mov eax, dword ptr [ebp+08]
:00468CA6 25FF000000              and eax, 000000FF
:00468CAB 99                      cdq
:00468CAC B903000000              mov ecx, 00000003
:00468CB1 F7F9                    idiv ecx
:00468CB3 83C201                  add edx, 00000001
:00468CB6 6BD20F                  imul edx, 0000000F
:00468CB9 8B450C                  mov eax, dword ptr [ebp+0C]
:00468CBC 25FF000000              and eax, 000000FF
:00468CC1 3BD0                    cmp edx, eax
:00468CC3 7F09                    jg 00468CCE
:00468CC5 C745FC01000000          mov [ebp-04], 00000001
:00468CCC EB07                    jmp 00468CD5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00468C8C(C), :00468CA1(C), :00468CC3(C)
|
:00468CCE C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00468CCC(U)
|
:00468CD5 8B45FC                  mov eax, dword ptr [ebp-04]
:00468CD8 8BE5                    mov esp, ebp
:00468CDA 5D                      pop ebp
:00468CDB C3                      ret



* Referenced by a CALL at Addresses:
|:00468DBF   , :0046BF57   
|
:00468CDC 55                      push ebp
:00468CDD 8BEC                    mov ebp, esp
:00468CDF 83EC0C                  sub esp, 0000000C
:00468CE2 894DF4                  mov dword ptr [ebp-0C], ecx
:00468CE5 8A4508                  mov al, byte ptr [ebp+08]
:00468CE8 50                      push eax
:00468CE9 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00468CEC 8B4920                  mov ecx, dword ptr [ecx+20]
:00468CEF E8FCD8F9FF              call 004065F0
:00468CF4 25FF000000              and eax, 000000FF
:00468CF9 3DFF000000              cmp eax, 000000FF
:00468CFE 7473                    je 00468D73
:00468D00 8A5508                  mov dl, byte ptr [ebp+08]
:00468D03 52                      push edx
:00468D04 8B45F4                  mov eax, dword ptr [ebp-0C]
:00468D07 8B4820                  mov ecx, dword ptr [eax+20]
:00468D0A E8E1D8F9FF              call 004065F0
:00468D0F 8845F8                  mov byte ptr [ebp-08], al
:00468D12 8A4D08                  mov cl, byte ptr [ebp+08]
:00468D15 51                      push ecx
:00468D16 8B55F4                  mov edx, dword ptr [ebp-0C]
:00468D19 8B4A20                  mov ecx, dword ptr [edx+20]
:00468D1C E8BF08FAFF              call 004095E0
:00468D21 8845FA                  mov byte ptr [ebp-06], al
:00468D24 8A4508                  mov al, byte ptr [ebp+08]
:00468D27 50                      push eax
:00468D28 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00468D2B 8B4920                  mov ecx, dword ptr [ecx+20]
:00468D2E E84D09FAFF              call 00409680
:00468D33 8845FB                  mov byte ptr [ebp-05], al
:00468D36 8D55F8                  lea edx, dword ptr [ebp-08]
:00468D39 52                      push edx
:00468D3A 8B45F4                  mov eax, dword ptr [ebp-0C]
:00468D3D 8B4824                  mov ecx, dword ptr [eax+24]
:00468D40 8B55F4                  mov edx, dword ptr [ebp-0C]
:00468D43 8B4224                  mov eax, dword ptr [edx+24]
:00468D46 8B10                    mov edx, dword ptr [eax]
:00468D48 FF5258                  call [edx+58]
:00468D4B 25FF000000              and eax, 000000FF

* Possible Reference to Dialog: DialogID_00C8 
                                  |
:00468D50 3DC8000000              cmp eax, 000000C8
:00468D55 7C04                    jl 00468D5B
:00468D57 33C0                    xor eax, eax
:00468D59 EB1D                    jmp 00468D78

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00468D55(C)
|
:00468D5B 6A00                    push 00000000
:00468D5D 6A00                    push 00000000
:00468D5F 68FF000000              push 000000FF
:00468D64 8A4508                  mov al, byte ptr [ebp+08]
:00468D67 50                      push eax
:00468D68 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00468D6B 8B4920                  mov ecx, dword ptr [ecx+20]
:00468D6E E805F0F9FF              call 00407D78

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00468CFE(C)
|
:00468D73 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00468D59(U)
|
:00468D78 8BE5                    mov esp, ebp
:00468D7A 5D                      pop ebp
:00468D7B C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0046886C   , :0046BD50   , :0046BD79   
|
:00468D7E 55                      push ebp
:00468D7F 8BEC                    mov ebp, esp
:00468D81 83EC08                  sub esp, 00000008
:00468D84 894DF8                  mov dword ptr [ebp-08], ecx
:00468D87 8B4508                  mov eax, dword ptr [ebp+08]
:00468D8A 8A08                    mov cl, byte ptr [eax]
:00468D8C 51                      push ecx
:00468D8D 8B55F8                  mov edx, dword ptr [ebp-08]
:00468D90 8B4A20                  mov ecx, dword ptr [edx+20]
:00468D93 E86FEBF9FF              call 00407907
:00468D98 85C0                    test eax, eax
:00468D9A 7504                    jne 00468DA0
:00468D9C 33C0                    xor eax, eax
:00468D9E EB74                    jmp 00468E14

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00468D9A(C)
|
:00468DA0 8B4508                  mov eax, dword ptr [ebp+08]
:00468DA3 33C9                    xor ecx, ecx
:00468DA5 8A08                    mov cl, byte ptr [eax]
:00468DA7 6BC919                  imul ecx, 00000019
:00468DAA 81C140114A00            add ecx, 004A1140
:00468DB0 E83539FAFF              call 0040C6EA
:00468DB5 8845FC                  mov byte ptr [ebp-04], al
:00468DB8 8A55FC                  mov dl, byte ptr [ebp-04]
:00468DBB 52                      push edx
:00468DBC 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00468DBF E818FFFFFF              call 00468CDC
:00468DC4 85C0                    test eax, eax
:00468DC6 7504                    jne 00468DCC
:00468DC8 33C0                    xor eax, eax
:00468DCA EB48                    jmp 00468E14

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00468DC6(C)
|
:00468DCC 8B4508                  mov eax, dword ptr [ebp+08]
:00468DCF 8A4803                  mov cl, byte ptr [eax+03]
:00468DD2 51                      push ecx
:00468DD3 8B5508                  mov edx, dword ptr [ebp+08]
:00468DD6 8A4202                  mov al, byte ptr [edx+02]
:00468DD9 50                      push eax
:00468DDA 8B4D08                  mov ecx, dword ptr [ebp+08]
:00468DDD 8A11                    mov dl, byte ptr [ecx]
:00468DDF 52                      push edx
:00468DE0 8A45FC                  mov al, byte ptr [ebp-04]
:00468DE3 50                      push eax
:00468DE4 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00468DE7 8B4920                  mov ecx, dword ptr [ecx+20]
:00468DEA E889EFF9FF              call 00407D78
:00468DEF 8A55FC                  mov dl, byte ptr [ebp-04]
:00468DF2 52                      push edx
:00468DF3 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00468DF6 E82F060000              call 0046942A
:00468DFB 8B45F8                  mov eax, dword ptr [ebp-08]
:00468DFE 8B4820                  mov ecx, dword ptr [eax+20]
:00468E01 E8FA06FAFF              call 00409500
:00468E06 50                      push eax
:00468E07 E8F50B0100              call 00479A01
:00468E0C 83C404                  add esp, 00000004
:00468E0F B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00468D9E(U), :00468DCA(U)
|
:00468E14 8BE5                    mov esp, ebp
:00468E16 5D                      pop ebp
:00468E17 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0046912C   , :00469151   , :00469176   , :0046919B   , :004691C0   
|:004691E5   , :0046920A   , :0046922F   , :00469259   
|
:00468E1A 55                      push ebp
:00468E1B 8BEC                    mov ebp, esp
:00468E1D 51                      push ecx
:00468E1E C745FC00000000          mov [ebp-04], 00000000
:00468E25 8B4514                  mov eax, dword ptr [ebp+14]
:00468E28 50                      push eax
:00468E29 8D4DFC                  lea ecx, dword ptr [ebp-04]
:00468E2C 51                      push ecx
:00468E2D 8B550C                  mov edx, dword ptr [ebp+0C]
:00468E30 52                      push edx
:00468E31 8B4508                  mov eax, dword ptr [ebp+08]
:00468E34 50                      push eax
:00468E35 FF1574624800            call dword ptr [00486274]
:00468E3B 3B4510                  cmp eax, dword ptr [ebp+10]
:00468E3E 7506                    jne 00468E46
:00468E40 837DFC00                cmp dword ptr [ebp-04], 00000000
:00468E44 7518                    jne 00468E5E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00468E3E(C)
|
:00468E46 8B4D14                  mov ecx, dword ptr [ebp+14]
:00468E49 51                      push ecx
:00468E4A 8B5510                  mov edx, dword ptr [ebp+10]
:00468E4D 52                      push edx
:00468E4E 8B450C                  mov eax, dword ptr [ebp+0C]
:00468E51 50                      push eax
:00468E52 8B4D08                  mov ecx, dword ptr [ebp+08]
:00468E55 51                      push ecx
:00468E56 FF15E4624800            call dword ptr [004862E4]
:00468E5C EB05                    jmp 00468E63

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00468E44(C)
|
:00468E5E B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00468E5C(U)
|
:00468E63 8BE5                    mov esp, ebp
:00468E65 5D                      pop ebp
:00468E66 C3                      ret



* Referenced by a CALL at Addresses:
|:00469285   , :004692B1   , :004692DD   , :00469309   , :00469335   
|:00469361   , :0046938D   , :004693B9   
|
:00468E67 55                      push ebp
:00468E68 8BEC                    mov ebp, esp
:00468E6A 83EC44                  sub esp, 00000044
:00468E6D 8B450C                  mov eax, dword ptr [ebp+0C]
:00468E70 50                      push eax
:00468E71 E8E46D0100              call 0047FC5A
:00468E76 83C404                  add esp, 00000004
:00468E79 8945BC                  mov dword ptr [ebp-44], eax
:00468E7C 6A40                    push 00000040
:00468E7E 8D4DC0                  lea ecx, dword ptr [ebp-40]
:00468E81 51                      push ecx
:00468E82 8B5508                  mov edx, dword ptr [ebp+08]
:00468E85 52                      push edx
:00468E86 FF15B4634800            call dword ptr [004863B4]
:00468E8C 3B45BC                  cmp eax, dword ptr [ebp-44]
:00468E8F 7514                    jne 00468EA5
:00468E91 8D45C0                  lea eax, dword ptr [ebp-40]
:00468E94 50                      push eax
:00468E95 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00468E98 51                      push ecx
:00468E99 E8256E0100              call 0047FCC3
:00468E9E 83C408                  add esp, 00000008
:00468EA1 85C0                    test eax, eax
:00468EA3 7410                    je 00468EB5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00468E8F(C)
|
:00468EA5 8B550C                  mov edx, dword ptr [ebp+0C]
:00468EA8 52                      push edx
:00468EA9 8B4508                  mov eax, dword ptr [ebp+08]
:00468EAC 50                      push eax
:00468EAD FF1560634800            call dword ptr [00486360]
:00468EB3 EB05                    jmp 00468EBA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00468EA3(C)
|
:00468EB5 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00468EB3(U)
|
:00468EBA 8BE5                    mov esp, ebp
:00468EBC 5D                      pop ebp
:00468EBD C3                      ret



* Referenced by a CALL at Addresses:
|:00468417   , :0046843D   , :004698D4   , :0046BEF0   
|
:00468EBE 55                      push ebp
:00468EBF 8BEC                    mov ebp, esp
:00468EC1 83EC38                  sub esp, 00000038
:00468EC4 56                      push esi
:00468EC5 894DC8                  mov dword ptr [ebp-38], ecx
:00468EC8 8B4508                  mov eax, dword ptr [ebp+08]
:00468ECB 33C9                    xor ecx, ecx
:00468ECD 8A08                    mov cl, byte ptr [eax]
:00468ECF 894DF8                  mov dword ptr [ebp-08], ecx
:00468ED2 8B5508                  mov edx, dword ptr [ebp+08]
:00468ED5 33C0                    xor eax, eax
:00468ED7 8A02                    mov al, byte ptr [edx]
:00468ED9 3DFF000000              cmp eax, 000000FF
:00468EDE 754B                    jne 00468F2B
:00468EE0 8B4DC8                  mov ecx, dword ptr [ebp-38]
:00468EE3 33D2                    xor edx, edx
:00468EE5 8A5128                  mov dl, byte ptr [ecx+28]
:00468EE8 83FA03                  cmp edx, 00000003
:00468EEB 7D31                    jge 00468F1E
:00468EED 8B45C8                  mov eax, dword ptr [ebp-38]
:00468EF0 8A4828                  mov cl, byte ptr [eax+28]
:00468EF3 51                      push ecx
:00468EF4 8B55C8                  mov edx, dword ptr [ebp-38]
:00468EF7 8B4A20                  mov ecx, dword ptr [edx+20]
:00468EFA E8F1D6F9FF              call 004065F0
:00468EFF 25FF000000              and eax, 000000FF
:00468F04 8945EC                  mov dword ptr [ebp-14], eax
:00468F07 8B45C8                  mov eax, dword ptr [ebp-38]
:00468F0A 8A4828                  mov cl, byte ptr [eax+28]
:00468F0D 51                      push ecx
:00468F0E 8B55C8                  mov edx, dword ptr [ebp-38]
:00468F11 8B4A20                  mov ecx, dword ptr [edx+20]
:00468F14 E8C706FAFF              call 004095E0
:00468F19 8845FC                  mov byte ptr [ebp-04], al
:00468F1C EB0B                    jmp 00468F29

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00468EEB(C)
|
:00468F1E C745ECFF000000          mov [ebp-14], 000000FF
:00468F25 C645FC00                mov [ebp-04], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00468F1C(U)
|
:00468F29 EB72                    jmp 00468F9D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00468EDE(C)
|
:00468F2B 8B4508                  mov eax, dword ptr [ebp+08]
:00468F2E 8A08                    mov cl, byte ptr [eax]
:00468F30 51                      push ecx
:00468F31 8B55C8                  mov edx, dword ptr [ebp-38]
:00468F34 8B4A20                  mov ecx, dword ptr [edx+20]
:00468F37 E8CBE9F9FF              call 00407907
:00468F3C 85C0                    test eax, eax
:00468F3E 744F                    je 00468F8F
:00468F40 8B4508                  mov eax, dword ptr [ebp+08]
:00468F43 33C9                    xor ecx, ecx
:00468F45 8A08                    mov cl, byte ptr [eax]
:00468F47 6BC919                  imul ecx, 00000019
:00468F4A 81C140114A00            add ecx, 004A1140
:00468F50 E89537FAFF              call 0040C6EA
:00468F55 50                      push eax
:00468F56 8B55C8                  mov edx, dword ptr [ebp-38]
:00468F59 8B4A20                  mov ecx, dword ptr [edx+20]
:00468F5C E88FD6F9FF              call 004065F0
:00468F61 25FF000000              and eax, 000000FF
:00468F66 8945EC                  mov dword ptr [ebp-14], eax
:00468F69 8B4508                  mov eax, dword ptr [ebp+08]
:00468F6C 33C9                    xor ecx, ecx
:00468F6E 8A08                    mov cl, byte ptr [eax]
:00468F70 6BC919                  imul ecx, 00000019
:00468F73 81C140114A00            add ecx, 004A1140
:00468F79 E86C37FAFF              call 0040C6EA
:00468F7E 50                      push eax
:00468F7F 8B55C8                  mov edx, dword ptr [ebp-38]
:00468F82 8B4A20                  mov ecx, dword ptr [edx+20]
:00468F85 E85606FAFF              call 004095E0
:00468F8A 8845FC                  mov byte ptr [ebp-04], al
:00468F8D EB0E                    jmp 00468F9D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00468F3E(C)
|
:00468F8F C745ECFF000000          mov [ebp-14], 000000FF
:00468F96 C745F8FF000000          mov [ebp-08], 000000FF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00468F29(U), :00468F8D(U)
|
:00468F9D 6A05                    push 00000005
:00468F9F 8B4508                  mov eax, dword ptr [ebp+08]
:00468FA2 8A4802                  mov cl, byte ptr [eax+02]
:00468FA5 51                      push ecx
:00468FA6 8B55F8                  mov edx, dword ptr [ebp-08]
:00468FA9 52                      push edx
:00468FAA E86C8EFFFF              call 00461E1B
:00468FAF 83C40C                  add esp, 0000000C
:00468FB2 8BF0                    mov esi, eax
:00468FB4 6A05                    push 00000005
:00468FB6 8A45FC                  mov al, byte ptr [ebp-04]
:00468FB9 50                      push eax
:00468FBA 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00468FBD 51                      push ecx
:00468FBE E8588EFFFF              call 00461E1B
:00468FC3 83C40C                  add esp, 0000000C
:00468FC6 2BF0                    sub esi, eax
:00468FC8 8975F0                  mov dword ptr [ebp-10], esi

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:00468FCB 6A06                    push 00000006
:00468FCD 8B5508                  mov edx, dword ptr [ebp+08]
:00468FD0 8A4202                  mov al, byte ptr [edx+02]
:00468FD3 50                      push eax
:00468FD4 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00468FD7 51                      push ecx
:00468FD8 E83E8EFFFF              call 00461E1B
:00468FDD 83C40C                  add esp, 0000000C
:00468FE0 8BF0                    mov esi, eax

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:00468FE2 6A06                    push 00000006
:00468FE4 8A55FC                  mov dl, byte ptr [ebp-04]
:00468FE7 52                      push edx
:00468FE8 8B45EC                  mov eax, dword ptr [ebp-14]
:00468FEB 50                      push eax
:00468FEC E82A8EFFFF              call 00461E1B
:00468FF1 83C40C                  add esp, 0000000C
:00468FF4 2BF0                    sub esi, eax
:00468FF6 8975CC                  mov dword ptr [ebp-34], esi
:00468FF9 6A00                    push 00000000
:00468FFB 8B4D08                  mov ecx, dword ptr [ebp+08]
:00468FFE 8A5102                  mov dl, byte ptr [ecx+02]
:00469001 52                      push edx
:00469002 8B45F8                  mov eax, dword ptr [ebp-08]
:00469005 50                      push eax
:00469006 E8108EFFFF              call 00461E1B
:0046900B 83C40C                  add esp, 0000000C
:0046900E 8BF0                    mov esi, eax
:00469010 6A00                    push 00000000
:00469012 8A4DFC                  mov cl, byte ptr [ebp-04]
:00469015 51                      push ecx
:00469016 8B55EC                  mov edx, dword ptr [ebp-14]
:00469019 52                      push edx
:0046901A E8FC8DFFFF              call 00461E1B
:0046901F 83C40C                  add esp, 0000000C
:00469022 2BF0                    sub esi, eax
:00469024 8975F4                  mov dword ptr [ebp-0C], esi
:00469027 6A02                    push 00000002
:00469029 8B4508                  mov eax, dword ptr [ebp+08]
:0046902C 8A4802                  mov cl, byte ptr [eax+02]
:0046902F 51                      push ecx
:00469030 8B55F8                  mov edx, dword ptr [ebp-08]
:00469033 52                      push edx
:00469034 E8E28DFFFF              call 00461E1B
:00469039 83C40C                  add esp, 0000000C
:0046903C 8BF0                    mov esi, eax
:0046903E 6A02                    push 00000002
:00469040 8A45FC                  mov al, byte ptr [ebp-04]
:00469043 50                      push eax
:00469044 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00469047 51                      push ecx
:00469048 E8CE8DFFFF              call 00461E1B
:0046904D 83C40C                  add esp, 0000000C
:00469050 2BF0                    sub esi, eax
:00469052 8975D4                  mov dword ptr [ebp-2C], esi
:00469055 6A01                    push 00000001
:00469057 8B5508                  mov edx, dword ptr [ebp+08]
:0046905A 8A4202                  mov al, byte ptr [edx+02]
:0046905D 50                      push eax
:0046905E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00469061 51                      push ecx
:00469062 E8B48DFFFF              call 00461E1B
:00469067 83C40C                  add esp, 0000000C
:0046906A 8BF0                    mov esi, eax
:0046906C 6A01                    push 00000001
:0046906E 8A55FC                  mov dl, byte ptr [ebp-04]
:00469071 52                      push edx
:00469072 8B45EC                  mov eax, dword ptr [ebp-14]
:00469075 50                      push eax
:00469076 E8A08DFFFF              call 00461E1B
:0046907B 83C40C                  add esp, 0000000C
:0046907E 2BF0                    sub esi, eax
:00469080 8975DC                  mov dword ptr [ebp-24], esi
:00469083 6A03                    push 00000003
:00469085 8B4D08                  mov ecx, dword ptr [ebp+08]
:00469088 8A5102                  mov dl, byte ptr [ecx+02]
:0046908B 52                      push edx
:0046908C 8B45F8                  mov eax, dword ptr [ebp-08]
:0046908F 50                      push eax
:00469090 E8868DFFFF              call 00461E1B
:00469095 83C40C                  add esp, 0000000C
:00469098 8BF0                    mov esi, eax
:0046909A 6A03                    push 00000003
:0046909C 8A4DFC                  mov cl, byte ptr [ebp-04]
:0046909F 51                      push ecx
:004690A0 8B55EC                  mov edx, dword ptr [ebp-14]
:004690A3 52                      push edx
:004690A4 E8728DFFFF              call 00461E1B
:004690A9 83C40C                  add esp, 0000000C
:004690AC 2BF0                    sub esi, eax
:004690AE 8975D8                  mov dword ptr [ebp-28], esi
:004690B1 6A04                    push 00000004
:004690B3 8B4508                  mov eax, dword ptr [ebp+08]
:004690B6 8A4802                  mov cl, byte ptr [eax+02]
:004690B9 51                      push ecx
:004690BA 8B55F8                  mov edx, dword ptr [ebp-08]
:004690BD 52                      push edx
:004690BE E8588DFFFF              call 00461E1B
:004690C3 83C40C                  add esp, 0000000C
:004690C6 8BF0                    mov esi, eax
:004690C8 6A04                    push 00000004
:004690CA 8A45FC                  mov al, byte ptr [ebp-04]
:004690CD 50                      push eax
:004690CE 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004690D1 51                      push ecx
:004690D2 E8448DFFFF              call 00461E1B
:004690D7 83C40C                  add esp, 0000000C
:004690DA 2BF0                    sub esi, eax
:004690DC 8975E0                  mov dword ptr [ebp-20], esi

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:004690DF 6A07                    push 00000007
:004690E1 8B5508                  mov edx, dword ptr [ebp+08]
:004690E4 8A4202                  mov al, byte ptr [edx+02]
:004690E7 50                      push eax
:004690E8 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004690EB 51                      push ecx
:004690EC E82A8DFFFF              call 00461E1B
:004690F1 83C40C                  add esp, 0000000C
:004690F4 8BF0                    mov esi, eax

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:004690F6 6A07                    push 00000007
:004690F8 8A55FC                  mov dl, byte ptr [ebp-04]
:004690FB 52                      push edx
:004690FC 8B45EC                  mov eax, dword ptr [ebp-14]
:004690FF 50                      push eax
:00469100 E8168DFFFF              call 00461E1B
:00469105 83C40C                  add esp, 0000000C
:00469108 2BF0                    sub esi, eax
:0046910A 8975D0                  mov dword ptr [ebp-30], esi
:0046910D 6A00                    push 00000000
:0046910F 8B4DC8                  mov ecx, dword ptr [ebp-38]
:00469112 8B4920                  mov ecx, dword ptr [ecx+20]
:00469115 E8B6D4F9FF              call 004065D0
:0046911A 25FF000000              and eax, 000000FF
:0046911F 50                      push eax
:00469120 6871040000              push 00000471
:00469125 8B55C8                  mov edx, dword ptr [ebp-38]
:00469128 8B4204                  mov eax, dword ptr [edx+04]
:0046912B 50                      push eax
:0046912C E8E9FCFFFF              call 00468E1A
:00469131 83C410                  add esp, 00000010
:00469134 6A00                    push 00000000
:00469136 8B4DC8                  mov ecx, dword ptr [ebp-38]
:00469139 8B4920                  mov ecx, dword ptr [ecx+20]
:0046913C E8DAE0F9FF              call 0040721B
:00469141 0345F0                  add eax, dword ptr [ebp-10]
:00469144 50                      push eax
:00469145 6895040000              push 00000495
:0046914A 8B55C8                  mov edx, dword ptr [ebp-38]
:0046914D 8B4204                  mov eax, dword ptr [edx+04]
:00469150 50                      push eax
:00469151 E8C4FCFFFF              call 00468E1A
:00469156 83C410                  add esp, 00000010
:00469159 6A00                    push 00000000
:0046915B 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0046915E 8B4920                  mov ecx, dword ptr [ecx+20]
:00469161 E8E4E0F9FF              call 0040724A
:00469166 0345CC                  add eax, dword ptr [ebp-34]
:00469169 50                      push eax
:0046916A 6896040000              push 00000496
:0046916F 8B55C8                  mov edx, dword ptr [ebp-38]
:00469172 8B4204                  mov eax, dword ptr [edx+04]
:00469175 50                      push eax
:00469176 E89FFCFFFF              call 00468E1A
:0046917B 83C410                  add esp, 00000010
:0046917E 6A00                    push 00000000
:00469180 8B4DC8                  mov ecx, dword ptr [ebp-38]
:00469183 8B4920                  mov ecx, dword ptr [ecx+20]
:00469186 E89BDFF9FF              call 00407126
:0046918B 0345F4                  add eax, dword ptr [ebp-0C]
:0046918E 50                      push eax
:0046918F 689B040000              push 0000049B
:00469194 8B55C8                  mov edx, dword ptr [ebp-38]
:00469197 8B4204                  mov eax, dword ptr [edx+04]
:0046919A 50                      push eax
:0046919B E87AFCFFFF              call 00468E1A
:004691A0 83C410                  add esp, 00000010
:004691A3 6A00                    push 00000000
:004691A5 8B4DC8                  mov ecx, dword ptr [ebp-38]
:004691A8 8B4920                  mov ecx, dword ptr [ecx+20]
:004691AB E8D8DFF9FF              call 00407188
:004691B0 0345D4                  add eax, dword ptr [ebp-2C]
:004691B3 50                      push eax
:004691B4 689D040000              push 0000049D
:004691B9 8B55C8                  mov edx, dword ptr [ebp-38]
:004691BC 8B4204                  mov eax, dword ptr [edx+04]
:004691BF 50                      push eax
:004691C0 E855FCFFFF              call 00468E1A
:004691C5 83C410                  add esp, 00000010
:004691C8 6A00                    push 00000000
:004691CA 8B4DC8                  mov ecx, dword ptr [ebp-38]
:004691CD 8B4920                  mov ecx, dword ptr [ecx+20]
:004691D0 E882DFF9FF              call 00407157
:004691D5 0345DC                  add eax, dword ptr [ebp-24]
:004691D8 50                      push eax
:004691D9 689C040000              push 0000049C
:004691DE 8B55C8                  mov edx, dword ptr [ebp-38]
:004691E1 8B4204                  mov eax, dword ptr [edx+04]
:004691E4 50                      push eax
:004691E5 E830FCFFFF              call 00468E1A
:004691EA 83C410                  add esp, 00000010
:004691ED 6A00                    push 00000000
:004691EF 8B4DC8                  mov ecx, dword ptr [ebp-38]
:004691F2 8B4920                  mov ecx, dword ptr [ecx+20]
:004691F5 E8BFDFF9FF              call 004071B9
:004691FA 0345D8                  add eax, dword ptr [ebp-28]
:004691FD 50                      push eax
:004691FE 6887040000              push 00000487
:00469203 8B55C8                  mov edx, dword ptr [ebp-38]
:00469206 8B4204                  mov eax, dword ptr [edx+04]
:00469209 50                      push eax
:0046920A E80BFCFFFF              call 00468E1A
:0046920F 83C410                  add esp, 00000010
:00469212 6A00                    push 00000000
:00469214 8B4DC8                  mov ecx, dword ptr [ebp-38]
:00469217 8B4920                  mov ecx, dword ptr [ecx+20]
:0046921A E8CBDFF9FF              call 004071EA
:0046921F 0345E0                  add eax, dword ptr [ebp-20]
:00469222 50                      push eax
:00469223 689E040000              push 0000049E
:00469228 8B55C8                  mov edx, dword ptr [ebp-38]
:0046922B 8B4204                  mov eax, dword ptr [edx+04]
:0046922E 50                      push eax
:0046922F E8E6FBFFFF              call 00468E1A
:00469234 83C410                  add esp, 00000010
:00469237 6A00                    push 00000000
:00469239 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0046923C 8B4920                  mov ecx, dword ptr [ecx+20]
:0046923F E837E0F9FF              call 0040727B
:00469244 25FF000000              and eax, 000000FF
:00469249 0345D0                  add eax, dword ptr [ebp-30]
:0046924C 50                      push eax
:0046924D 689F040000              push 0000049F
:00469252 8B55C8                  mov edx, dword ptr [ebp-38]
:00469255 8B4204                  mov eax, dword ptr [edx+04]
:00469258 50                      push eax
:00469259 E8BCFBFFFF              call 00468E1A
:0046925E 83C410                  add esp, 00000010
:00469261 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00469264 51                      push ecx
:00469265 8D55E4                  lea edx, dword ptr [ebp-1C]
:00469268 52                      push edx
:00469269 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0046926C E85C010000              call 004693CD
:00469271 50                      push eax

* Possible Reference to Dialog: DialogID_011C, CONTROL_ID:03F8, "Attribute"
                                  |
:00469272 68F8030000              push 000003F8
:00469277 8B45C8                  mov eax, dword ptr [ebp-38]
:0046927A 8B4804                  mov ecx, dword ptr [eax+04]
:0046927D 51                      push ecx
:0046927E FF15DC624800            call dword ptr [004862DC]
:00469284 50                      push eax
:00469285 E8DDFBFFFF              call 00468E67
:0046928A 83C408                  add esp, 00000008
:0046928D 8B55CC                  mov edx, dword ptr [ebp-34]
:00469290 52                      push edx
:00469291 8D45E4                  lea eax, dword ptr [ebp-1C]
:00469294 50                      push eax
:00469295 8B4DC8                  mov ecx, dword ptr [ebp-38]
:00469298 E830010000              call 004693CD
:0046929D 50                      push eax
:0046929E 68F9030000              push 000003F9
:004692A3 8B4DC8                  mov ecx, dword ptr [ebp-38]
:004692A6 8B5104                  mov edx, dword ptr [ecx+04]
:004692A9 52                      push edx
:004692AA FF15DC624800            call dword ptr [004862DC]
:004692B0 50                      push eax
:004692B1 E8B1FBFFFF              call 00468E67
:004692B6 83C408                  add esp, 00000008
:004692B9 8B45F4                  mov eax, dword ptr [ebp-0C]
:004692BC 50                      push eax
:004692BD 8D4DE4                  lea ecx, dword ptr [ebp-1C]
:004692C0 51                      push ecx
:004692C1 8B4DC8                  mov ecx, dword ptr [ebp-38]
:004692C4 E804010000              call 004693CD
:004692C9 50                      push eax
:004692CA 689A040000              push 0000049A
:004692CF 8B55C8                  mov edx, dword ptr [ebp-38]
:004692D2 8B4204                  mov eax, dword ptr [edx+04]
:004692D5 50                      push eax
:004692D6 FF15DC624800            call dword ptr [004862DC]
:004692DC 50                      push eax
:004692DD E885FBFFFF              call 00468E67
:004692E2 83C408                  add esp, 00000008
:004692E5 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:004692E8 51                      push ecx
:004692E9 8D55E4                  lea edx, dword ptr [ebp-1C]
:004692EC 52                      push edx
:004692ED 8B4DC8                  mov ecx, dword ptr [ebp-38]
:004692F0 E8D8000000              call 004693CD
:004692F5 50                      push eax
:004692F6 6898040000              push 00000498
:004692FB 8B45C8                  mov eax, dword ptr [ebp-38]
:004692FE 8B4804                  mov ecx, dword ptr [eax+04]
:00469301 51                      push ecx
:00469302 FF15DC624800            call dword ptr [004862DC]
:00469308 50                      push eax
:00469309 E859FBFFFF              call 00468E67
:0046930E 83C408                  add esp, 00000008
:00469311 8B55DC                  mov edx, dword ptr [ebp-24]
:00469314 52                      push edx
:00469315 8D45E4                  lea eax, dword ptr [ebp-1C]
:00469318 50                      push eax
:00469319 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0046931C E8AC000000              call 004693CD
:00469321 50                      push eax
:00469322 6899040000              push 00000499
:00469327 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0046932A 8B5104                  mov edx, dword ptr [ecx+04]
:0046932D 52                      push edx
:0046932E FF15DC624800            call dword ptr [004862DC]
:00469334 50                      push eax
:00469335 E82DFBFFFF              call 00468E67
:0046933A 83C408                  add esp, 00000008
:0046933D 8B45D8                  mov eax, dword ptr [ebp-28]
:00469340 50                      push eax
:00469341 8D4DE4                  lea ecx, dword ptr [ebp-1C]
:00469344 51                      push ecx
:00469345 8B4DC8                  mov ecx, dword ptr [ebp-38]
:00469348 E880000000              call 004693CD
:0046934D 50                      push eax
:0046934E 68FB030000              push 000003FB
:00469353 8B55C8                  mov edx, dword ptr [ebp-38]
:00469356 8B4204                  mov eax, dword ptr [edx+04]
:00469359 50                      push eax
:0046935A FF15DC624800            call dword ptr [004862DC]
:00469360 50                      push eax
:00469361 E801FBFFFF              call 00468E67
:00469366 83C408                  add esp, 00000008
:00469369 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0046936C 51                      push ecx
:0046936D 8D55E4                  lea edx, dword ptr [ebp-1C]
:00469370 52                      push edx
:00469371 8B4DC8                  mov ecx, dword ptr [ebp-38]
:00469374 E854000000              call 004693CD
:00469379 50                      push eax
:0046937A 68F7030000              push 000003F7
:0046937F 8B45C8                  mov eax, dword ptr [ebp-38]
:00469382 8B4804                  mov ecx, dword ptr [eax+04]
:00469385 51                      push ecx
:00469386 FF15DC624800            call dword ptr [004862DC]
:0046938C 50                      push eax
:0046938D E8D5FAFFFF              call 00468E67
:00469392 83C408                  add esp, 00000008
:00469395 8B55D0                  mov edx, dword ptr [ebp-30]
:00469398 52                      push edx
:00469399 8D45E4                  lea eax, dword ptr [ebp-1C]
:0046939C 50                      push eax
:0046939D 8B4DC8                  mov ecx, dword ptr [ebp-38]
:004693A0 E828000000              call 004693CD
:004693A5 50                      push eax

* Possible Reference to Dialog: DialogID_011A, CONTROL_ID:03FA, ""
                                  |
:004693A6 68FA030000              push 000003FA
:004693AB 8B4DC8                  mov ecx, dword ptr [ebp-38]
:004693AE 8B5104                  mov edx, dword ptr [ecx+04]
:004693B1 52                      push edx
:004693B2 FF15DC624800            call dword ptr [004862DC]
:004693B8 50                      push eax
:004693B9 E8A9FAFFFF              call 00468E67
:004693BE 83C408                  add esp, 00000008
:004693C1 B801000000              mov eax, 00000001
:004693C6 5E                      pop esi
:004693C7 8BE5                    mov esp, ebp
:004693C9 5D                      pop ebp
:004693CA C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0046926C   , :00469298   , :004692C4   , :004692F0   , :0046931C   
|:00469348   , :00469374   , :004693A0   
|
:004693CD 55                      push ebp
:004693CE 8BEC                    mov ebp, esp
:004693D0 51                      push ecx
:004693D1 894DFC                  mov dword ptr [ebp-04], ecx
:004693D4 837D0C00                cmp dword ptr [ebp+0C], 00000000
:004693D8 7513                    jne 004693ED
:004693DA 6810694B00              push 004B6910
:004693DF 8B4508                  mov eax, dword ptr [ebp+08]
:004693E2 50                      push eax
:004693E3 E895680100              call 0047FC7D
:004693E8 83C408                  add esp, 00000008
:004693EB EB34                    jmp 00469421

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004693D8(C)
|
:004693ED 837D0C00                cmp dword ptr [ebp+0C], 00000000
:004693F1 7E18                    jle 0046940B
:004693F3 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004693F6 51                      push ecx

* Possible StringData Ref from Data Obj ->"+%d"
                                  |
:004693F7 6838E74800              push 0048E738
:004693FC 8B5508                  mov edx, dword ptr [ebp+08]
:004693FF 52                      push edx
:00469400 FF15C0624800            call dword ptr [004862C0]
:00469406 83C40C                  add esp, 0000000C
:00469409 EB16                    jmp 00469421

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004693F1(C)
|
:0046940B 8B450C                  mov eax, dword ptr [ebp+0C]
:0046940E 50                      push eax

* Possible StringData Ref from Data Obj ->"%d"
                                  |
:0046940F 683CE74800              push 0048E73C
:00469414 8B4D08                  mov ecx, dword ptr [ebp+08]
:00469417 51                      push ecx
:00469418 FF15C0624800            call dword ptr [004862C0]
:0046941E 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004693EB(U), :00469409(U)
|
:00469421 8B4508                  mov eax, dword ptr [ebp+08]
:00469424 8BE5                    mov esp, ebp
:00469426 5D                      pop ebp
:00469427 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:00468DF6   , :0046A0D3   , :0046BF73   
|
:0046942A 55                      push ebp
:0046942B 8BEC                    mov ebp, esp
:0046942D 81EC94000000            sub esp, 00000094
:00469433 898D70FFFFFF            mov dword ptr [ebp+FFFFFF70], ecx
:00469439 8A4508                  mov al, byte ptr [ebp+08]
:0046943C 50                      push eax
:0046943D 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:00469443 8B4920                  mov ecx, dword ptr [ecx+20]
:00469446 E8A5D1F9FF              call 004065F0
:0046944B 25FF000000              and eax, 000000FF
:00469450 8945EC                  mov dword ptr [ebp-14], eax

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:056F, "Wepon:"
                                  |
:00469453 C7458C6F050000          mov [ebp-74], 0000056F

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:0572, "Armor:"
                                  |
:0046945A C7459072050000          mov [ebp-70], 00000572

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:0575, "Sub Item:"
                                  |
:00469461 C7459475050000          mov [ebp-6C], 00000575

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:0570, "99"
                                  |
:00469468 C745D470050000          mov [ebp-2C], 00000570

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:0573, "99"
                                  |
:0046946F C745D873050000          mov [ebp-28], 00000573

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:058A, "Lv"
                                  |
:00469476 C745F08A050000          mov [ebp-10], 0000058A

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:058C, "Lv"
                                  |
:0046947D C745F48C050000          mov [ebp-0C], 0000058C

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:058B, "Exp"
                                  |
:00469484 C745848B050000          mov [ebp-7C], 0000058B

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:058D, "Exp"
                                  |
:0046948B C745888D050000          mov [ebp-78], 0000058D

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:0579, "Effect"
                                  |
:00469492 C745A479050000          mov [ebp-5C], 00000579

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:0578, "Effect"
                                  |
:00469499 C745A878050000          mov [ebp-58], 00000578

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:057A, "Effect"
                                  |
:004694A0 C745AC7A050000          mov [ebp-54], 0000057A
:004694A7 C745DC88050000          mov [ebp-24], 00000588
:004694AE C745E089050000          mov [ebp-20], 00000589

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:058E, ""
                                  |
:004694B5 C745E48E050000          mov [ebp-1C], 0000058E

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:058F, ""
                                  |
:004694BC C745E88F050000          mov [ebp-18], 0000058F
:004694C3 C74598D06C4800          mov [ebp-68], 00486CD0
:004694CA C7459CE06C4800          mov [ebp-64], 00486CE0
:004694D1 C745A0F06C4800          mov [ebp-60], 00486CF0
:004694D8 C645FC01                mov [ebp-04], 01
:004694DC C645D000                mov [ebp-30], 00
:004694E0 8A5508                  mov dl, byte ptr [ebp+08]
:004694E3 88956CFFFFFF            mov byte ptr [ebp+FFFFFF6C], dl
:004694E9 80BD6CFFFFFF00          cmp byte ptr [ebp+FFFFFF6C], 00
:004694F0 0F8266020000            jb 0046975C
:004694F6 80BD6CFFFFFF01          cmp byte ptr [ebp+FFFFFF6C], 01
:004694FD 7605                    jbe 00469504
:004694FF E958020000              jmp 0046975C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004694FD(C)
|
:00469504 817DECFF000000          cmp dword ptr [ebp-14], 000000FF
:0046950B 0F8475010000            je 00469686
:00469511 8A4508                  mov al, byte ptr [ebp+08]
:00469514 50                      push eax
:00469515 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:0046951B 8B4920                  mov ecx, dword ptr [ecx+20]
:0046951E E8BD00FAFF              call 004095E0
:00469523 8845FC                  mov byte ptr [ebp-04], al
:00469526 8A5508                  mov dl, byte ptr [ebp+08]
:00469529 52                      push edx
:0046952A 8B8570FFFFFF            mov eax, dword ptr [ebp+FFFFFF70]
:00469530 8B4820                  mov ecx, dword ptr [eax+20]
:00469533 E84801FAFF              call 00409680
:00469538 8845D0                  mov byte ptr [ebp-30], al
:0046953B 68C46A4800              push 00486AC4
:00469540 8B4D08                  mov ecx, dword ptr [ebp+08]
:00469543 81E1FF000000            and ecx, 000000FF
:00469549 8B548DF0                mov edx, dword ptr [ebp+4*ecx-10]
:0046954D 52                      push edx
:0046954E 8B8570FFFFFF            mov eax, dword ptr [ebp+FFFFFF70]
:00469554 8B4804                  mov ecx, dword ptr [eax+04]
:00469557 51                      push ecx
:00469558 FF15DC624800            call dword ptr [004862DC]
:0046955E 50                      push eax
:0046955F FF1560634800            call dword ptr [00486360]
:00469565 8B55FC                  mov edx, dword ptr [ebp-04]
:00469568 81E2FF000000            and edx, 000000FF
:0046956E 52                      push edx

* Possible StringData Ref from Data Obj ->"%u"
                                  |
:0046956F 6840E74800              push 0048E740
:00469574 8B4508                  mov eax, dword ptr [ebp+08]
:00469577 25FF000000              and eax, 000000FF
:0046957C 8B4C85D4                mov ecx, dword ptr [ebp+4*eax-2C]
:00469580 51                      push ecx
:00469581 8B9570FFFFFF            mov edx, dword ptr [ebp+FFFFFF70]
:00469587 8B4204                  mov eax, dword ptr [edx+04]
:0046958A 50                      push eax
:0046958B FF15DC624800            call dword ptr [004862DC]
:00469591 50                      push eax
:00469592 E84588FFFF              call 00461DDC
:00469597 83C40C                  add esp, 0000000C
:0046959A 68D06A4800              push 00486AD0
:0046959F 8B4D08                  mov ecx, dword ptr [ebp+08]
:004695A2 81E1FF000000            and ecx, 000000FF
:004695A8 8B548D84                mov edx, dword ptr [ebp+4*ecx-7C]
:004695AC 52                      push edx
:004695AD 8B8570FFFFFF            mov eax, dword ptr [ebp+FFFFFF70]
:004695B3 8B4804                  mov ecx, dword ptr [eax+04]
:004695B6 51                      push ecx
:004695B7 FF15DC624800            call dword ptr [004862DC]
:004695BD 50                      push eax
:004695BE FF1560634800            call dword ptr [00486360]
:004695C4 6A00                    push 00000000
:004695C6 6A64                    push 00000064
:004695C8 8B55D0                  mov edx, dword ptr [ebp-30]
:004695CB 81E2FF000000            and edx, 000000FF
:004695D1 52                      push edx
:004695D2 8B4508                  mov eax, dword ptr [ebp+08]
:004695D5 25FF000000              and eax, 000000FF
:004695DA C1E005                  shl eax, 05
:004695DD 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:004695E3 8D4C0130                lea ecx, dword ptr [ecx+eax+30]
:004695E7 E85C7EFFFF              call 00461448
:004695EC 8D9574FFFFFF            lea edx, dword ptr [ebp+FFFFFF74]
:004695F2 52                      push edx
:004695F3 8B4508                  mov eax, dword ptr [ebp+08]
:004695F6 25FF000000              and eax, 000000FF
:004695FB 8B4C85E4                mov ecx, dword ptr [ebp+4*eax-1C]
:004695FF 51                      push ecx
:00469600 8B9570FFFFFF            mov edx, dword ptr [ebp+FFFFFF70]
:00469606 8B4204                  mov eax, dword ptr [edx+04]
:00469609 50                      push eax
:0046960A FF15DC624800            call dword ptr [004862DC]
:00469610 50                      push eax
:00469611 E85485FFFF              call 00461B6A
:00469616 83C408                  add esp, 00000008
:00469619 6A00                    push 00000000
:0046961B 8D8D74FFFFFF            lea ecx, dword ptr [ebp+FFFFFF74]
:00469621 51                      push ecx
:00469622 8B9570FFFFFF            mov edx, dword ptr [ebp+FFFFFF70]
:00469628 8B4204                  mov eax, dword ptr [edx+04]
:0046962B 50                      push eax
:0046962C FF15A4624800            call dword ptr [004862A4]
:00469632 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:00469638 8B5104                  mov edx, dword ptr [ecx+04]
:0046963B 52                      push edx
:0046963C FF15A8624800            call dword ptr [004862A8]
:00469642 C745F805000000          mov [ebp-08], 00000005
:00469649 8B45EC                  mov eax, dword ptr [ebp-14]
:0046964C 50                      push eax
:0046964D 8D4DB0                  lea ecx, dword ptr [ebp-50]
:00469650 51                      push ecx
:00469651 E81E8BFFFF              call 00462174
:00469656 83C408                  add esp, 00000008
:00469659 8D55B0                  lea edx, dword ptr [ebp-50]
:0046965C 52                      push edx
:0046965D 8B4508                  mov eax, dword ptr [ebp+08]
:00469660 25FF000000              and eax, 000000FF
:00469665 8B4C85DC                mov ecx, dword ptr [ebp+4*eax-24]
:00469669 51                      push ecx
:0046966A 8B9570FFFFFF            mov edx, dword ptr [ebp+FFFFFF70]
:00469670 8B4204                  mov eax, dword ptr [edx+04]
:00469673 50                      push eax
:00469674 FF15DC624800            call dword ptr [004862DC]
:0046967A 50                      push eax
:0046967B FF1560634800            call dword ptr [00486360]
:00469681 E9AE000000              jmp 00469734

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046950B(C)
|
:00469686 6814694B00              push 004B6914
:0046968B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046968E 81E1FF000000            and ecx, 000000FF
:00469694 8B548DF0                mov edx, dword ptr [ebp+4*ecx-10]
:00469698 52                      push edx
:00469699 8B8570FFFFFF            mov eax, dword ptr [ebp+FFFFFF70]
:0046969F 8B4804                  mov ecx, dword ptr [eax+04]
:004696A2 51                      push ecx
:004696A3 FF15DC624800            call dword ptr [004862DC]
:004696A9 50                      push eax
:004696AA FF1560634800            call dword ptr [00486360]
:004696B0 6818694B00              push 004B6918
:004696B5 8B5508                  mov edx, dword ptr [ebp+08]
:004696B8 81E2FF000000            and edx, 000000FF
:004696BE 8B4495D4                mov eax, dword ptr [ebp+4*edx-2C]
:004696C2 50                      push eax
:004696C3 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:004696C9 8B5104                  mov edx, dword ptr [ecx+04]
:004696CC 52                      push edx
:004696CD FF15DC624800            call dword ptr [004862DC]
:004696D3 50                      push eax
:004696D4 FF1560634800            call dword ptr [00486360]
:004696DA 681C694B00              push 004B691C
:004696DF 8B4508                  mov eax, dword ptr [ebp+08]
:004696E2 25FF000000              and eax, 000000FF
:004696E7 8B4C8584                mov ecx, dword ptr [ebp+4*eax-7C]
:004696EB 51                      push ecx
:004696EC 8B9570FFFFFF            mov edx, dword ptr [ebp+FFFFFF70]
:004696F2 8B4204                  mov eax, dword ptr [edx+04]
:004696F5 50                      push eax
:004696F6 FF15DC624800            call dword ptr [004862DC]
:004696FC 50                      push eax
:004696FD FF1560634800            call dword ptr [00486360]
:00469703 C745F800000000          mov [ebp-08], 00000000
:0046970A 6820694B00              push 004B6920
:0046970F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00469712 81E1FF000000            and ecx, 000000FF
:00469718 8B548DDC                mov edx, dword ptr [ebp+4*ecx-24]
:0046971C 52                      push edx
:0046971D 8B8570FFFFFF            mov eax, dword ptr [ebp+FFFFFF70]
:00469723 8B4804                  mov ecx, dword ptr [eax+04]
:00469726 51                      push ecx
:00469727 FF15DC624800            call dword ptr [004862DC]
:0046972D 50                      push eax
:0046972E FF1560634800            call dword ptr [00486360]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00469681(U)
|
:00469734 8B55F8                  mov edx, dword ptr [ebp-08]
:00469737 52                      push edx
:00469738 8B4508                  mov eax, dword ptr [ebp+08]
:0046973B 25FF000000              and eax, 000000FF
:00469740 8B4C85E4                mov ecx, dword ptr [ebp+4*eax-1C]
:00469744 51                      push ecx
:00469745 8B9570FFFFFF            mov edx, dword ptr [ebp+FFFFFF70]
:0046974B 8B4204                  mov eax, dword ptr [edx+04]
:0046974E 50                      push eax
:0046974F FF15DC624800            call dword ptr [004862DC]
:00469755 50                      push eax
:00469756 FF15E0624800            call dword ptr [004862E0]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004694F0(C), :004694FF(U)
|
:0046975C 817DECFF000000          cmp dword ptr [ebp-14], 000000FF
:00469763 0F84BD000000            je 00469826
:00469769 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0046976C 6BC919                  imul ecx, 00000019
:0046976F 81C140114A00            add ecx, 004A1140
:00469775 E8F6940000              call 00472C70
:0046977A 25FF000000              and eax, 000000FF
:0046977F 50                      push eax
:00469780 8B4D08                  mov ecx, dword ptr [ebp+08]
:00469783 81E1FF000000            and ecx, 000000FF
:00469789 6BC914                  imul ecx, 00000014
:0046978C 8B9570FFFFFF            mov edx, dword ptr [ebp+FFFFFF70]
:00469792 8D8C0A90000000          lea ecx, dword ptr [edx+ecx+00000090]
:00469799 E8319CFFFF              call 004633CF
:0046979E 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004697A1 6BC919                  imul ecx, 00000019
:004697A4 81C140114A00            add ecx, 004A1140
:004697AA E8615FFFFF              call 0045F710
:004697AF 50                      push eax
:004697B0 8B4508                  mov eax, dword ptr [ebp+08]
:004697B3 25FF000000              and eax, 000000FF
:004697B8 8B4C8598                mov ecx, dword ptr [ebp+4*eax-68]
:004697BC 51                      push ecx
:004697BD 8B5508                  mov edx, dword ptr [ebp+08]
:004697C0 81E2FF000000            and edx, 000000FF
:004697C6 8B44958C                mov eax, dword ptr [ebp+4*edx-74]
:004697CA 50                      push eax
:004697CB 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:004697D1 8B5104                  mov edx, dword ptr [ecx+04]
:004697D4 52                      push edx
:004697D5 FF15DC624800            call dword ptr [004862DC]
:004697DB 50                      push eax
:004697DC E8FB85FFFF              call 00461DDC
:004697E1 83C40C                  add esp, 0000000C
:004697E4 8A45FC                  mov al, byte ptr [ebp-04]
:004697E7 50                      push eax
:004697E8 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004697EB 51                      push ecx
:004697EC 8D55B0                  lea edx, dword ptr [ebp-50]
:004697EF 52                      push edx
:004697F0 E81088FFFF              call 00462005
:004697F5 83C40C                  add esp, 0000000C
:004697F8 8D45B0                  lea eax, dword ptr [ebp-50]
:004697FB 50                      push eax
:004697FC 8B4D08                  mov ecx, dword ptr [ebp+08]
:004697FF 81E1FF000000            and ecx, 000000FF
:00469805 8B548DA4                mov edx, dword ptr [ebp+4*ecx-5C]
:00469809 52                      push edx
:0046980A 8B8570FFFFFF            mov eax, dword ptr [ebp+FFFFFF70]
:00469810 8B4804                  mov ecx, dword ptr [eax+04]
:00469813 51                      push ecx
:00469814 FF15DC624800            call dword ptr [004862DC]
:0046981A 50                      push eax
:0046981B FF1560634800            call dword ptr [00486360]
:00469821 E983000000              jmp 004698A9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00469763(C)
|

* Possible Ref to Menu: APPMENU, Item: "_8"
                                  |
:00469826 6A68                    push 00000068
:00469828 8B5508                  mov edx, dword ptr [ebp+08]
:0046982B 81E2FF000000            and edx, 000000FF
:00469831 6BD214                  imul edx, 00000014
:00469834 8B8570FFFFFF            mov eax, dword ptr [ebp+FFFFFF70]
:0046983A 8D8C1090000000          lea ecx, dword ptr [eax+edx+00000090]
:00469841 E8899BFFFF              call 004633CF
:00469846 68FC6C4800              push 00486CFC
:0046984B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046984E 81E1FF000000            and ecx, 000000FF
:00469854 8B548D98                mov edx, dword ptr [ebp+4*ecx-68]
:00469858 52                      push edx
:00469859 8B4508                  mov eax, dword ptr [ebp+08]
:0046985C 25FF000000              and eax, 000000FF
:00469861 8B4C858C                mov ecx, dword ptr [ebp+4*eax-74]
:00469865 51                      push ecx
:00469866 8B9570FFFFFF            mov edx, dword ptr [ebp+FFFFFF70]
:0046986C 8B4204                  mov eax, dword ptr [edx+04]
:0046986F 50                      push eax
:00469870 FF15DC624800            call dword ptr [004862DC]
:00469876 50                      push eax
:00469877 E86085FFFF              call 00461DDC
:0046987C 83C40C                  add esp, 0000000C
:0046987F 6824694B00              push 004B6924
:00469884 8B4D08                  mov ecx, dword ptr [ebp+08]
:00469887 81E1FF000000            and ecx, 000000FF
:0046988D 8B548DA4                mov edx, dword ptr [ebp+4*ecx-5C]
:00469891 52                      push edx
:00469892 8B8570FFFFFF            mov eax, dword ptr [ebp+FFFFFF70]
:00469898 8B4804                  mov ecx, dword ptr [eax+04]
:0046989B 51                      push ecx
:0046989C FF15DC624800            call dword ptr [004862DC]
:004698A2 50                      push eax
:004698A3 FF1560634800            call dword ptr [00486360]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00469821(U)
|
:004698A9 8BE5                    mov esp, ebp
:004698AB 5D                      pop ebp
:004698AC C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0046A037   , :0046BF7B   
|
:004698AF 55                      push ebp
:004698B0 8BEC                    mov ebp, esp
:004698B2 83EC0C                  sub esp, 0000000C
:004698B5 894DF4                  mov dword ptr [ebp-0C], ecx
:004698B8 C645F8FF                mov [ebp-08], FF
:004698BC C645F900                mov [ebp-07], 00
:004698C0 C645FA00                mov [ebp-06], 00
:004698C4 C645FB01                mov [ebp-05], 01
:004698C8 33C0                    xor eax, eax
:004698CA 8945FC                  mov dword ptr [ebp-04], eax
:004698CD 8D4DF8                  lea ecx, dword ptr [ebp-08]
:004698D0 51                      push ecx
:004698D1 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004698D4 E8E5F5FFFF              call 00468EBE
:004698D9 8BE5                    mov esp, ebp
:004698DB 5D                      pop ebp
:004698DC C3                      ret



* Referenced by a CALL at Addresses:
|:00469F49   , :0046AFC7   , :0046B004   
|
:004698DD 55                      push ebp
:004698DE 8BEC                    mov ebp, esp
:004698E0 83EC18                  sub esp, 00000018
:004698E3 894DE8                  mov dword ptr [ebp-18], ecx
:004698E6 C645F832                mov [ebp-08], 32
:004698EA C745FC00000000          mov [ebp-04], 00000000
:004698F1 EB09                    jmp 004698FC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046992D(U)
|
:004698F3 8B45FC                  mov eax, dword ptr [ebp-04]
:004698F6 83C001                  add eax, 00000001
:004698F9 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004698F1(U)
|
:004698FC 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004698FF 81E1FF000000            and ecx, 000000FF
:00469905 394DFC                  cmp dword ptr [ebp-04], ecx
:00469908 7D25                    jge 0046992F
:0046990A 8B5508                  mov edx, dword ptr [ebp+08]
:0046990D 52                      push edx
:0046990E 8B45FC                  mov eax, dword ptr [ebp-04]
:00469911 8B0C8598694800          mov ecx, dword ptr [4*eax+00486998]
:00469918 51                      push ecx
:00469919 8B55E8                  mov edx, dword ptr [ebp-18]
:0046991C 8B4204                  mov eax, dword ptr [edx+04]
:0046991F 50                      push eax
:00469920 FF15DC624800            call dword ptr [004862DC]
:00469926 50                      push eax
:00469927 FF15E8624800            call dword ptr [004862E8]
:0046992D EBC4                    jmp 004698F3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00469908(C)
|
:0046992F 837D0800                cmp dword ptr [ebp+08], 00000000
:00469933 0F84DB000000            je 00469A14
:00469939 6A05                    push 00000005
:0046993B 8B0D0C604B00            mov ecx, dword ptr [004B600C]
:00469941 51                      push ecx
:00469942 FF15E0624800            call dword ptr [004862E0]
:00469948 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0046994B E80E010000              call 00469A5E
:00469950 684A040000              push 0000044A
:00469955 8B55E8                  mov edx, dword ptr [ebp-18]
:00469958 8B4204                  mov eax, dword ptr [edx+04]
:0046995B 50                      push eax
:0046995C FF15DC624800            call dword ptr [004862DC]
:00469962 8945F4                  mov dword ptr [ebp-0C], eax
:00469965 6A00                    push 00000000
:00469967 6A00                    push 00000000

* Possible Reference to Dialog: DialogID_0147 
                                  |
:00469969 6847010000              push 00000147
:0046996E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00469971 51                      push ecx
:00469972 FF15F4624800            call dword ptr [004862F4]
:00469978 8945EC                  mov dword ptr [ebp-14], eax
:0046997B 6A00                    push 00000000
:0046997D 6A00                    push 00000000
:0046997F 6846010000              push 00000146
:00469984 8B55F4                  mov edx, dword ptr [ebp-0C]
:00469987 52                      push edx
:00469988 FF15F4624800            call dword ptr [004862F4]
:0046998E 8945F0                  mov dword ptr [ebp-10], eax
:00469991 837DEC00                cmp dword ptr [ebp-14], 00000000
:00469995 7E1D                    jle 004699B4
:00469997 6A01                    push 00000001

* Possible Reference to Dialog: DialogID_00C1, CONTROL_ID:0403, ""
                                  |
:00469999 6803040000              push 00000403
:0046999E 8B45E8                  mov eax, dword ptr [ebp-18]
:004699A1 8B4804                  mov ecx, dword ptr [eax+04]
:004699A4 51                      push ecx
:004699A5 FF15DC624800            call dword ptr [004862DC]
:004699AB 50                      push eax
:004699AC FF15E8624800            call dword ptr [004862E8]
:004699B2 EB1B                    jmp 004699CF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00469995(C)
|
:004699B4 6A00                    push 00000000

* Possible Reference to Dialog: DialogID_00C1, CONTROL_ID:0403, ""
                                  |
:004699B6 6803040000              push 00000403
:004699BB 8B55E8                  mov edx, dword ptr [ebp-18]
:004699BE 8B4204                  mov eax, dword ptr [edx+04]
:004699C1 50                      push eax
:004699C2 FF15DC624800            call dword ptr [004862DC]
:004699C8 50                      push eax
:004699C9 FF15E8624800            call dword ptr [004862E8]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004699B2(U)
|
:004699CF 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004699D2 83E901                  sub ecx, 00000001
:004699D5 394DEC                  cmp dword ptr [ebp-14], ecx
:004699D8 7D1D                    jge 004699F7
:004699DA 6A01                    push 00000001

* Possible Reference to Dialog: DialogID_00C1, CONTROL_ID:0404, ""
                                  |
:004699DC 6804040000              push 00000404
:004699E1 8B55E8                  mov edx, dword ptr [ebp-18]
:004699E4 8B4204                  mov eax, dword ptr [edx+04]
:004699E7 50                      push eax
:004699E8 FF15DC624800            call dword ptr [004862DC]
:004699EE 50                      push eax
:004699EF FF15E8624800            call dword ptr [004862E8]
:004699F5 EB1B                    jmp 00469A12

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004699D8(C)
|
:004699F7 6A00                    push 00000000

* Possible Reference to Dialog: DialogID_00C1, CONTROL_ID:0404, ""
                                  |
:004699F9 6804040000              push 00000404
:004699FE 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00469A01 8B5104                  mov edx, dword ptr [ecx+04]
:00469A04 52                      push edx
:00469A05 FF15DC624800            call dword ptr [004862DC]
:00469A0B 50                      push eax
:00469A0C FF15E8624800            call dword ptr [004862E8]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004699F5(U)
|
:00469A12 EB44                    jmp 00469A58

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00469933(C)
|
:00469A14 6A00                    push 00000000
:00469A16 A10C604B00              mov eax, dword ptr [004B600C]
:00469A1B 50                      push eax
:00469A1C FF15E0624800            call dword ptr [004862E0]
:00469A22 6A00                    push 00000000

* Possible Reference to Dialog: DialogID_00C1, CONTROL_ID:0403, ""
                                  |
:00469A24 6803040000              push 00000403
:00469A29 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00469A2C 8B5104                  mov edx, dword ptr [ecx+04]
:00469A2F 52                      push edx
:00469A30 FF15DC624800            call dword ptr [004862DC]
:00469A36 50                      push eax
:00469A37 FF15E8624800            call dword ptr [004862E8]
:00469A3D 6A00                    push 00000000

* Possible Reference to Dialog: DialogID_00C1, CONTROL_ID:0404, ""
                                  |
:00469A3F 6804040000              push 00000404
:00469A44 8B45E8                  mov eax, dword ptr [ebp-18]
:00469A47 8B4804                  mov ecx, dword ptr [eax+04]
:00469A4A 51                      push ecx
:00469A4B FF15DC624800            call dword ptr [004862DC]
:00469A51 50                      push eax
:00469A52 FF15E8624800            call dword ptr [004862E8]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00469A12(U)
|
:00469A58 8BE5                    mov esp, ebp
:00469A5A 5D                      pop ebp
:00469A5B C20400                  ret 0004



* Referenced by a CALL at Address:
|:0046994B   
|
:00469A5E 55                      push ebp
:00469A5F 8BEC                    mov ebp, esp
:00469A61 83EC14                  sub esp, 00000014
:00469A64 894DEC                  mov dword ptr [ebp-14], ecx
:00469A67 8D45F0                  lea eax, dword ptr [ebp-10]
:00469A6A 50                      push eax

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:058E, ""
                                  |
:00469A6B 688E050000              push 0000058E
:00469A70 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00469A73 8B5104                  mov edx, dword ptr [ecx+04]
:00469A76 52                      push edx
:00469A77 FF15DC624800            call dword ptr [004862DC]
:00469A7D 50                      push eax
:00469A7E E8E780FFFF              call 00461B6A
:00469A83 83C408                  add esp, 00000008
:00469A86 6A00                    push 00000000
:00469A88 8D45F0                  lea eax, dword ptr [ebp-10]
:00469A8B 50                      push eax
:00469A8C 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00469A8F 8B5104                  mov edx, dword ptr [ecx+04]
:00469A92 52                      push edx
:00469A93 FF15A4624800            call dword ptr [004862A4]
:00469A99 8D45F0                  lea eax, dword ptr [ebp-10]
:00469A9C 50                      push eax

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:058F, ""
                                  |
:00469A9D 688F050000              push 0000058F
:00469AA2 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00469AA5 8B5104                  mov edx, dword ptr [ecx+04]
:00469AA8 52                      push edx
:00469AA9 FF15DC624800            call dword ptr [004862DC]
:00469AAF 50                      push eax
:00469AB0 E8B580FFFF              call 00461B6A
:00469AB5 83C408                  add esp, 00000008
:00469AB8 6A00                    push 00000000
:00469ABA 8D45F0                  lea eax, dword ptr [ebp-10]
:00469ABD 50                      push eax
:00469ABE 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00469AC1 8B5104                  mov edx, dword ptr [ecx+04]
:00469AC4 52                      push edx
:00469AC5 FF15A4624800            call dword ptr [004862A4]
:00469ACB 8B45EC                  mov eax, dword ptr [ebp-14]
:00469ACE 8B4804                  mov ecx, dword ptr [eax+04]
:00469AD1 51                      push ecx
:00469AD2 FF15A8624800            call dword ptr [004862A8]
:00469AD8 8BE5                    mov esp, ebp
:00469ADA 5D                      pop ebp
:00469ADB C3                      ret



* Referenced by a CALL at Addresses:
|:0046AD4C   , :0046AD5E   , :0046C339   , :0046C34B   
|
:00469ADC 55                      push ebp
:00469ADD 8BEC                    mov ebp, esp
:00469ADF 83EC14                  sub esp, 00000014
:00469AE2 894DEC                  mov dword ptr [ebp-14], ecx
:00469AE5 684A040000              push 0000044A
:00469AEA 8B45EC                  mov eax, dword ptr [ebp-14]
:00469AED 8B4804                  mov ecx, dword ptr [eax+04]
:00469AF0 51                      push ecx
:00469AF1 FF15DC624800            call dword ptr [004862DC]
:00469AF7 8945F4                  mov dword ptr [ebp-0C], eax
:00469AFA 6A00                    push 00000000
:00469AFC 6A00                    push 00000000

* Possible Reference to Dialog: DialogID_0147 
                                  |
:00469AFE 6847010000              push 00000147
:00469B03 8B55F4                  mov edx, dword ptr [ebp-0C]
:00469B06 52                      push edx
:00469B07 FF15F4624800            call dword ptr [004862F4]
:00469B0D 8945F8                  mov dword ptr [ebp-08], eax
:00469B10 8B45F8                  mov eax, dword ptr [ebp-08]
:00469B13 034508                  add eax, dword ptr [ebp+08]
:00469B16 8945FC                  mov dword ptr [ebp-04], eax
:00469B19 6A00                    push 00000000
:00469B1B 6A00                    push 00000000
:00469B1D 6846010000              push 00000146
:00469B22 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00469B25 51                      push ecx
:00469B26 FF15F4624800            call dword ptr [004862F4]
:00469B2C 8945F0                  mov dword ptr [ebp-10], eax
:00469B2F 837DFC00                cmp dword ptr [ebp-04], 00000000
:00469B33 7D09                    jge 00469B3E
:00469B35 C745FC00000000          mov [ebp-04], 00000000
:00469B3C EB11                    jmp 00469B4F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00469B33(C)
|
:00469B3E 8B55FC                  mov edx, dword ptr [ebp-04]
:00469B41 3B55F0                  cmp edx, dword ptr [ebp-10]
:00469B44 7C09                    jl 00469B4F
:00469B46 8B45F0                  mov eax, dword ptr [ebp-10]
:00469B49 83E801                  sub eax, 00000001
:00469B4C 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00469B3C(U), :00469B44(C)
|
:00469B4F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00469B52 3B4DF8                  cmp ecx, dword ptr [ebp-08]
:00469B55 7421                    je 00469B78
:00469B57 6A00                    push 00000000
:00469B59 8B55FC                  mov edx, dword ptr [ebp-04]
:00469B5C 52                      push edx

* Possible Reference to Dialog: DialogID_014E 
                                  |
:00469B5D 684E010000              push 0000014E
:00469B62 8B45F4                  mov eax, dword ptr [ebp-0C]
:00469B65 50                      push eax
:00469B66 FF15F4624800            call dword ptr [004862F4]
:00469B6C 6A00                    push 00000000
:00469B6E 6A09                    push 00000009
:00469B70 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00469B73 E853030000              call 00469ECB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00469B55(C)
|
:00469B78 8BE5                    mov esp, ebp
:00469B7A 5D                      pop ebp
:00469B7B C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0046A811   , :0046A86C   , :0046AC26   , :0046AC76   , :0046C1EE   
|:0046C23E   
|
:00469B7E 55                      push ebp
:00469B7F 8BEC                    mov ebp, esp
:00469B81 83EC24                  sub esp, 00000024
:00469B84 894DDC                  mov dword ptr [ebp-24], ecx
:00469B87 8D45E4                  lea eax, dword ptr [ebp-1C]
:00469B8A 50                      push eax
:00469B8B FF1568624800            call dword ptr [00486268]
:00469B91 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00469B94 51                      push ecx
:00469B95 8B55E4                  mov edx, dword ptr [ebp-1C]
:00469B98 52                      push edx
:00469B99 FF1528634800            call dword ptr [00486328]
:00469B9F 8945EC                  mov dword ptr [ebp-14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00469BC7(U)
|
:00469BA2 6AF0                    push FFFFFFF0
:00469BA4 8B45EC                  mov eax, dword ptr [ebp-14]
:00469BA7 50                      push eax
:00469BA8 FF15A0634800            call dword ptr [004863A0]
:00469BAE 2500000040              and eax, 40000000
:00469BB3 3D00000040              cmp eax, 40000000
:00469BB8 750F                    jne 00469BC9
:00469BBA 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00469BBD 51                      push ecx
:00469BBE FF159C634800            call dword ptr [0048639C]
:00469BC4 8945EC                  mov dword ptr [ebp-14], eax
:00469BC7 EBD9                    jmp 00469BA2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00469BB8(C)
|
:00469BC9 8B15606A4800            mov edx, dword ptr [00486A60]
:00469BCF 52                      push edx
:00469BD0 8B45DC                  mov eax, dword ptr [ebp-24]
:00469BD3 8B4804                  mov ecx, dword ptr [eax+04]
:00469BD6 51                      push ecx
:00469BD7 FF15DC624800            call dword ptr [004862DC]
:00469BDD 50                      push eax
:00469BDE FF1534634800            call dword ptr [00486334]
:00469BE4 85C0                    test eax, eax
:00469BE6 740B                    je 00469BF3
:00469BE8 8B55DC                  mov edx, dword ptr [ebp-24]
:00469BEB 8B45EC                  mov eax, dword ptr [ebp-14]
:00469BEE 3B4204                  cmp eax, dword ptr [edx+04]
:00469BF1 7406                    je 00469BF9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00469BE6(C)
|
:00469BF3 C645E003                mov [ebp-20], 03
:00469BF7 EB60                    jmp 00469C59

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00469BF1(C)
|
:00469BF9 C645E000                mov [ebp-20], 00
:00469BFD EB09                    jmp 00469C08

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00469C57(U)
|
:00469BFF 8A4DE0                  mov cl, byte ptr [ebp-20]
:00469C02 80C101                  add cl, 01
:00469C05 884DE0                  mov byte ptr [ebp-20], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00469BFD(U)
|
:00469C08 8B55E0                  mov edx, dword ptr [ebp-20]
:00469C0B 81E2FF000000            and edx, 000000FF
:00469C11 83FA03                  cmp edx, 00000003
:00469C14 7D43                    jge 00469C59
:00469C16 8D45F0                  lea eax, dword ptr [ebp-10]
:00469C19 50                      push eax
:00469C1A 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00469C1D 81E1FF000000            and ecx, 000000FF
:00469C23 8B148D606A4800          mov edx, dword ptr [4*ecx+00486A60]
:00469C2A 52                      push edx
:00469C2B 8B45DC                  mov eax, dword ptr [ebp-24]
:00469C2E 8B4804                  mov ecx, dword ptr [eax+04]
:00469C31 51                      push ecx
:00469C32 FF15DC624800            call dword ptr [004862DC]
:00469C38 50                      push eax
:00469C39 FF1598634800            call dword ptr [00486398]
:00469C3F 8B55E8                  mov edx, dword ptr [ebp-18]
:00469C42 52                      push edx
:00469C43 8B45E4                  mov eax, dword ptr [ebp-1C]
:00469C46 50                      push eax
:00469C47 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00469C4A 51                      push ecx
:00469C4B FF158C634800            call dword ptr [0048638C]
:00469C51 85C0                    test eax, eax
:00469C53 7402                    je 00469C57
:00469C55 EB02                    jmp 00469C59

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00469C53(C)
|
:00469C57 EBA6                    jmp 00469BFF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00469BF7(U), :00469C14(C), :00469C55(U)
|
:00469C59 8A45E0                  mov al, byte ptr [ebp-20]
:00469C5C 8BE5                    mov esp, ebp
:00469C5E 5D                      pop ebp
:00469C5F C3                      ret



* Referenced by a CALL at Addresses:
|:0046AA83   , :0046C49B   
|
:00469C60 55                      push ebp
:00469C61 8BEC                    mov ebp, esp
:00469C63 83EC30                  sub esp, 00000030
:00469C66 894DD0                  mov dword ptr [ebp-30], ecx

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:0582, ""
                                  |
:00469C69 C745E482050000          mov [ebp-1C], 00000582

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:0583, ""
                                  |
:00469C70 C745E883050000          mov [ebp-18], 00000583

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:0584, ""
                                  |
:00469C77 C745EC84050000          mov [ebp-14], 00000584
:00469C7E C745DC00000000          mov [ebp-24], 00000000
:00469C85 EB09                    jmp 00469C90

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00469CE1(U)
|
:00469C87 8B45DC                  mov eax, dword ptr [ebp-24]
:00469C8A 83C001                  add eax, 00000001
:00469C8D 8945DC                  mov dword ptr [ebp-24], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00469C85(U)
|
:00469C90 837DDC03                cmp dword ptr [ebp-24], 00000003
:00469C94 7D4D                    jge 00469CE3
:00469C96 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00469C99 8B548DE4                mov edx, dword ptr [ebp+4*ecx-1C]
:00469C9D 52                      push edx
:00469C9E 8B45D0                  mov eax, dword ptr [ebp-30]
:00469CA1 8B4804                  mov ecx, dword ptr [eax+04]
:00469CA4 51                      push ecx
:00469CA5 FF15DC624800            call dword ptr [004862DC]
:00469CAB 50                      push eax
:00469CAC 8B55DC                  mov edx, dword ptr [ebp-24]
:00469CAF 6BD214                  imul edx, 00000014
:00469CB2 8B45D0                  mov eax, dword ptr [ebp-30]
:00469CB5 8D8C1090000000          lea ecx, dword ptr [eax+edx+00000090]
:00469CBC E8498BFFFF              call 0046280A
:00469CC1 B9142E4900              mov ecx, 00492E14
:00469CC6 E8A559FFFF              call 0045F670
:00469CCB 50                      push eax
:00469CCC 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00469CCF 6BC914                  imul ecx, 00000014
:00469CD2 8B55D0                  mov edx, dword ptr [ebp-30]
:00469CD5 8D8C0A90000000          lea ecx, dword ptr [edx+ecx+00000090]
:00469CDC E89C96FFFF              call 0046337D
:00469CE1 EBA4                    jmp 00469C87

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00469C94(C)
|
:00469CE3 6834040000              push 00000434
:00469CE8 8B45D0                  mov eax, dword ptr [ebp-30]
:00469CEB 8B4804                  mov ecx, dword ptr [eax+04]
:00469CEE 51                      push ecx
:00469CEF FF15DC624800            call dword ptr [004862DC]
:00469CF5 50                      push eax
:00469CF6 8B150C604B00            mov edx, dword ptr [004B600C]
:00469CFC 52                      push edx
:00469CFD FF157C634800            call dword ptr [0048637C]
:00469D03 8D45F0                  lea eax, dword ptr [ebp-10]
:00469D06 50                      push eax
:00469D07 6834040000              push 00000434
:00469D0C 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00469D0F 8B5104                  mov edx, dword ptr [ecx+04]
:00469D12 52                      push edx
:00469D13 FF15DC624800            call dword ptr [004862DC]
:00469D19 50                      push eax
:00469D1A E84B7EFFFF              call 00461B6A
:00469D1F 83C408                  add esp, 00000008
:00469D22 6A0C                    push 0000000C
:00469D24 A1EC684800              mov eax, dword ptr [004868EC]
:00469D29 83C002                  add eax, 00000002
:00469D2C 50                      push eax
:00469D2D 8B0DE8684800            mov ecx, dword ptr [004868E8]
:00469D33 83C102                  add ecx, 00000002
:00469D36 51                      push ecx
:00469D37 8B55FC                  mov edx, dword ptr [ebp-04]
:00469D3A 8B45F4                  mov eax, dword ptr [ebp-0C]
:00469D3D 8D4410FE                lea eax, dword ptr [eax+edx-02]
:00469D41 2B05EC684800            sub eax, dword ptr [004868EC]
:00469D47 99                      cdq
:00469D48 2BC2                    sub eax, edx
:00469D4A D1F8                    sar eax, 1
:00469D4C 50                      push eax
:00469D4D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00469D50 8B55F0                  mov edx, dword ptr [ebp-10]
:00469D53 8D440AFE                lea eax, dword ptr [edx+ecx-02]
:00469D57 2B05E8684800            sub eax, dword ptr [004868E8]
:00469D5D 99                      cdq
:00469D5E 2BC2                    sub eax, edx
:00469D60 D1F8                    sar eax, 1
:00469D62 50                      push eax
:00469D63 6A00                    push 00000000
:00469D65 6834040000              push 00000434
:00469D6A 8B45D0                  mov eax, dword ptr [ebp-30]
:00469D6D 8B4804                  mov ecx, dword ptr [eax+04]
:00469D70 51                      push ecx
:00469D71 FF15DC624800            call dword ptr [004862DC]
:00469D77 50                      push eax
:00469D78 FF1580624800            call dword ptr [00486280]
:00469D7E 6A00                    push 00000000
:00469D80 8B15EC684800            mov edx, dword ptr [004868EC]
:00469D86 52                      push edx
:00469D87 A1E8684800              mov eax, dword ptr [004868E8]
:00469D8C 50                      push eax
:00469D8D 6A00                    push 00000000
:00469D8F 6A00                    push 00000000
:00469D91 8B0D0C604B00            mov ecx, dword ptr [004B600C]
:00469D97 51                      push ecx
:00469D98 FF15BC624800            call dword ptr [004862BC]
:00469D9E 6A05                    push 00000005
:00469DA0 8B150C604B00            mov edx, dword ptr [004B600C]
:00469DA6 52                      push edx
:00469DA7 FF15E0624800            call dword ptr [004862E0]
:00469DAD 684A040000              push 0000044A
:00469DB2 8B45D0                  mov eax, dword ptr [ebp-30]
:00469DB5 8B4804                  mov ecx, dword ptr [eax+04]
:00469DB8 51                      push ecx
:00469DB9 FF15DC624800            call dword ptr [004862DC]
:00469DBF 8945E0                  mov dword ptr [ebp-20], eax
:00469DC2 C745D400000000          mov [ebp-2C], 00000000
:00469DC9 EB09                    jmp 00469DD4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00469E0B(U)
|
:00469DCB 8B55D4                  mov edx, dword ptr [ebp-2C]
:00469DCE 83C201                  add edx, 00000001
:00469DD1 8955D4                  mov dword ptr [ebp-2C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00469DC9(U)
|
:00469DD4 817DD4AE000000          cmp dword ptr [ebp-2C], 000000AE
:00469DDB 7330                    jnb 00469E0D
:00469DDD 8B45D4                  mov eax, dword ptr [ebp-2C]
:00469DE0 50                      push eax
:00469DE1 E8AA03FBFF              call 0041A190
:00469DE6 83C404                  add esp, 00000004
:00469DE9 85C0                    test eax, eax
:00469DEB 741E                    je 00469E0B
:00469DED 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00469DF0 6BC948                  imul ecx, 00000048
:00469DF3 81C1681B4A00            add ecx, 004A1B68
:00469DF9 51                      push ecx
:00469DFA 6A00                    push 00000000
:00469DFC 6843010000              push 00000143
:00469E01 8B55E0                  mov edx, dword ptr [ebp-20]
:00469E04 52                      push edx
:00469E05 FF15F4624800            call dword ptr [004862F4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00469DEB(C)
|
:00469E0B EBBE                    jmp 00469DCB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00469DDB(C)
|
:00469E0D 6A00                    push 00000000
:00469E0F 6A00                    push 00000000

* Possible Reference to Dialog: DialogID_014E 
                                  |
:00469E11 684E010000              push 0000014E
:00469E16 8B45E0                  mov eax, dword ptr [ebp-20]
:00469E19 50                      push eax
:00469E1A FF15F4624800            call dword ptr [004862F4]
:00469E20 6A00                    push 00000000
:00469E22 6A09                    push 00000009
:00469E24 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00469E27 E89F000000              call 00469ECB
:00469E2C 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00469E2F 51                      push ecx
:00469E30 FF1598624800            call dword ptr [00486298]
:00469E36 8945D8                  mov dword ptr [ebp-28], eax
:00469E39 6A48                    push 00000048
:00469E3B 6A5A                    push 0000005A
:00469E3D 8B55D8                  mov edx, dword ptr [ebp-28]
:00469E40 52                      push edx
:00469E41 FF153C604800            call dword ptr [0048603C]
:00469E47 50                      push eax
:00469E48 6A09                    push 00000009
:00469E4A FF15E8604800            call dword ptr [004860E8]
:00469E50 83C002                  add eax, 00000002
:00469E53 50                      push eax
:00469E54 6AFF                    push FFFFFFFF

* Possible Reference to Dialog: DialogID_0153 
                                  |
:00469E56 6853010000              push 00000153
:00469E5B 8B45E0                  mov eax, dword ptr [ebp-20]
:00469E5E 50                      push eax
:00469E5F FF15F4624800            call dword ptr [004862F4]
:00469E65 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00469E68 51                      push ecx
:00469E69 8B55E0                  mov edx, dword ptr [ebp-20]
:00469E6C 52                      push edx
:00469E6D FF159C624800            call dword ptr [0048629C]
:00469E73 8BE5                    mov esp, ebp
:00469E75 5D                      pop ebp
:00469E76 C3                      ret



* Referenced by a CALL at Addresses:
|:0046AB77   , :0046C160   
|
:00469E77 55                      push ebp
:00469E78 8BEC                    mov ebp, esp
:00469E7A 51                      push ecx
:00469E7B 894DFC                  mov dword ptr [ebp-04], ecx
:00469E7E 6A00                    push 00000000
:00469E80 A10C604B00              mov eax, dword ptr [004B600C]
:00469E85 50                      push eax
:00469E86 FF15E0624800            call dword ptr [004862E0]
:00469E8C 6A10                    push 00000010
:00469E8E E8502C0100              call 0047CAE3
:00469E93 83C404                  add esp, 00000004
:00469E96 E8A5340100              call 0047D340
:00469E9B 6A00                    push 00000000
:00469E9D 6A1F                    push 0000001F
:00469E9F 6A00                    push 00000000
:00469EA1 E84B330100              call 0047D1F1
:00469EA6 83C40C                  add esp, 0000000C
:00469EA9 6A00                    push 00000000
:00469EAB E8332C0100              call 0047CAE3
:00469EB0 83C404                  add esp, 00000004
:00469EB3 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:00469EB9 51                      push ecx
:00469EBA 8B150C604B00            mov edx, dword ptr [004B600C]
:00469EC0 52                      push edx
:00469EC1 FF157C634800            call dword ptr [0048637C]
:00469EC7 8BE5                    mov esp, ebp
:00469EC9 5D                      pop ebp
:00469ECA C3                      ret



* Referenced by a CALL at Addresses:
|:00469B73   , :00469E27   , :0046AD3A   , :0046C327   
|
:00469ECB 55                      push ebp
:00469ECC 8BEC                    mov ebp, esp
:00469ECE 83EC1C                  sub esp, 0000001C
:00469ED1 894DE8                  mov dword ptr [ebp-18], ecx
:00469ED4 C745FC01000000          mov [ebp-04], 00000001
:00469EDB 837D0C00                cmp dword ptr [ebp+0C], 00000000
:00469EDF 751C                    jne 00469EFD
:00469EE1 684A040000              push 0000044A
:00469EE6 8B45E8                  mov eax, dword ptr [ebp-18]
:00469EE9 8B4804                  mov ecx, dword ptr [eax+04]
:00469EEC 51                      push ecx
:00469EED FF15DC624800            call dword ptr [004862DC]
:00469EF3 89450C                  mov dword ptr [ebp+0C], eax
:00469EF6 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00469EDF(C)
|
:00469EFD 8B5508                  mov edx, dword ptr [ebp+08]
:00469F00 81E2FFFF0000            and edx, 0000FFFF
:00469F06 8955E4                  mov dword ptr [ebp-1C], edx
:00469F09 837DE407                cmp dword ptr [ebp-1C], 00000007
:00469F0D 0F84F3010000            je 0046A106
:00469F13 837DE409                cmp dword ptr [ebp-1C], 00000009
:00469F17 740F                    je 00469F28
:00469F19 837DE40A                cmp dword ptr [ebp-1C], 0000000A
:00469F1D 0F84CA010000            je 0046A0ED
:00469F23 E9EA010000              jmp 0046A112

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00469F17(C)
|
:00469F28 6A00                    push 00000000
:00469F2A 6A00                    push 00000000

* Possible Reference to Dialog: DialogID_0147 
                                  |
:00469F2C 6847010000              push 00000147
:00469F31 8B450C                  mov eax, dword ptr [ebp+0C]
:00469F34 50                      push eax
:00469F35 FF15F4624800            call dword ptr [004862F4]
:00469F3B 8945F0                  mov dword ptr [ebp-10], eax
:00469F3E 837DF0FF                cmp dword ptr [ebp-10], FFFFFFFF
:00469F42 750F                    jne 00469F53
:00469F44 6A00                    push 00000000
:00469F46 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00469F49 E88FF9FFFF              call 004698DD
:00469F4E E9BF010000              jmp 0046A112

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00469F42(C)
|
:00469F53 6A00                    push 00000000
:00469F55 6A00                    push 00000000
:00469F57 6846010000              push 00000146
:00469F5C 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00469F5F 51                      push ecx
:00469F60 FF15F4624800            call dword ptr [004862F4]
:00469F66 8945F8                  mov dword ptr [ebp-08], eax
:00469F69 837DF000                cmp dword ptr [ebp-10], 00000000
:00469F6D 7E1D                    jle 00469F8C
:00469F6F 6A01                    push 00000001

* Possible Reference to Dialog: DialogID_00C1, CONTROL_ID:0403, ""
                                  |
:00469F71 6803040000              push 00000403
:00469F76 8B55E8                  mov edx, dword ptr [ebp-18]
:00469F79 8B4204                  mov eax, dword ptr [edx+04]
:00469F7C 50                      push eax
:00469F7D FF15DC624800            call dword ptr [004862DC]
:00469F83 50                      push eax
:00469F84 FF15E8624800            call dword ptr [004862E8]
:00469F8A EB1B                    jmp 00469FA7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00469F6D(C)
|
:00469F8C 6A00                    push 00000000

* Possible Reference to Dialog: DialogID_00C1, CONTROL_ID:0403, ""
                                  |
:00469F8E 6803040000              push 00000403
:00469F93 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00469F96 8B5104                  mov edx, dword ptr [ecx+04]
:00469F99 52                      push edx
:00469F9A FF15DC624800            call dword ptr [004862DC]
:00469FA0 50                      push eax
:00469FA1 FF15E8624800            call dword ptr [004862E8]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00469F8A(U)
|
:00469FA7 8B45F8                  mov eax, dword ptr [ebp-08]
:00469FAA 83E801                  sub eax, 00000001
:00469FAD 3945F0                  cmp dword ptr [ebp-10], eax
:00469FB0 7D1D                    jge 00469FCF
:00469FB2 6A01                    push 00000001

* Possible Reference to Dialog: DialogID_00C1, CONTROL_ID:0404, ""
                                  |
:00469FB4 6804040000              push 00000404
:00469FB9 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00469FBC 8B5104                  mov edx, dword ptr [ecx+04]
:00469FBF 52                      push edx
:00469FC0 FF15DC624800            call dword ptr [004862DC]
:00469FC6 50                      push eax
:00469FC7 FF15E8624800            call dword ptr [004862E8]
:00469FCD EB1B                    jmp 00469FEA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00469FB0(C)
|
:00469FCF 6A00                    push 00000000

* Possible Reference to Dialog: DialogID_00C1, CONTROL_ID:0404, ""
                                  |
:00469FD1 6804040000              push 00000404
:00469FD6 8B45E8                  mov eax, dword ptr [ebp-18]
:00469FD9 8B4804                  mov ecx, dword ptr [eax+04]
:00469FDC 51                      push ecx
:00469FDD FF15DC624800            call dword ptr [004862DC]
:00469FE3 50                      push eax
:00469FE4 FF15E8624800            call dword ptr [004862E8]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00469FCD(U)
|
:00469FEA 8D55F4                  lea edx, dword ptr [ebp-0C]
:00469FED 52                      push edx
:00469FEE 8B45F0                  mov eax, dword ptr [ebp-10]
:00469FF1 50                      push eax

* Possible Reference to Dialog: DialogID_0148 
                                  |
:00469FF2 6848010000              push 00000148
:00469FF7 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00469FFA 51                      push ecx
:00469FFB FF15F4624800            call dword ptr [004862F4]
:0046A001 83F8FF                  cmp eax, FFFFFFFF
:0046A004 0F84E1000000            je 0046A0EB
:0046A00A 8B55E8                  mov edx, dword ptr [ebp-18]
:0046A00D 8B45F4                  mov eax, dword ptr [ebp-0C]
:0046A010 3B4220                  cmp eax, dword ptr [edx+20]
:0046A013 0F84D2000000            je 0046A0EB
:0046A019 837DFC00                cmp dword ptr [ebp-04], 00000000
:0046A01D 740C                    je 0046A02B
:0046A01F 6A00                    push 00000000
:0046A021 B9B0694B00              mov ecx, 004B69B0
:0046A026 E882A60000              call 004746AD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046A01D(C)
|
:0046A02B 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0046A02E 8B55F4                  mov edx, dword ptr [ebp-0C]
:0046A031 895120                  mov dword ptr [ecx+20], edx
:0046A034 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0046A037 E873F8FFFF              call 004698AF
:0046A03C 6A04                    push 00000004
:0046A03E 6A00                    push 00000000
:0046A040 6A00                    push 00000000
:0046A042 B910114A00              mov ecx, 004A1110
:0046A047 E8F4590100              call 0047FA40
:0046A04C 50                      push eax
:0046A04D 8B45E8                  mov eax, dword ptr [ebp-18]
:0046A050 8B4820                  mov ecx, dword ptr [eax+20]
:0046A053 E84FD5F9FF              call 004075A7
:0046A058 50                      push eax
:0046A059 B938C54A00              mov ecx, 004AC538
:0046A05E E8265CFBFF              call 0041FC89
:0046A063 6A10                    push 00000010
:0046A065 E8792A0100              call 0047CAE3
:0046A06A 83C404                  add esp, 00000004

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0046A06D 6A07                    push 00000007
:0046A06F E856310100              call 0047D1CA
:0046A074 83C404                  add esp, 00000004
:0046A077 6A00                    push 00000000
:0046A079 6A12                    push 00000012
:0046A07B 6A04                    push 00000004
:0046A07D E86F310100              call 0047D1F1
:0046A082 83C40C                  add esp, 0000000C
:0046A085 B910114A00              mov ecx, 004A1110
:0046A08A E80140FAFF              call 0040E090
:0046A08F 50                      push eax
:0046A090 8B0DEC684800            mov ecx, dword ptr [004868EC]
:0046A096 51                      push ecx
:0046A097 8B15E8684800            mov edx, dword ptr [004868E8]
:0046A09D 52                      push edx
:0046A09E 6A00                    push 00000000
:0046A0A0 6A00                    push 00000000
:0046A0A2 E8F43F0100              call 0047E09B
:0046A0A7 83C414                  add esp, 00000014
:0046A0AA 6A00                    push 00000000
:0046A0AC E8322A0100              call 0047CAE3
:0046A0B1 83C404                  add esp, 00000004
:0046A0B4 C745EC00000000          mov [ebp-14], 00000000
:0046A0BB EB09                    jmp 0046A0C6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046A0D8(U)
|
:0046A0BD 8B45EC                  mov eax, dword ptr [ebp-14]
:0046A0C0 83C001                  add eax, 00000001
:0046A0C3 8945EC                  mov dword ptr [ebp-14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046A0BB(U)
|
:0046A0C6 837DEC03                cmp dword ptr [ebp-14], 00000003
:0046A0CA 7D0E                    jge 0046A0DA
:0046A0CC 8A4DEC                  mov cl, byte ptr [ebp-14]
:0046A0CF 51                      push ecx
:0046A0D0 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0046A0D3 E852F3FFFF              call 0046942A
:0046A0D8 EBE3                    jmp 0046A0BD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046A0CA(C)
|
:0046A0DA 8B55E8                  mov edx, dword ptr [ebp-18]
:0046A0DD 8B4A24                  mov ecx, dword ptr [edx+24]
:0046A0E0 8B45E8                  mov eax, dword ptr [ebp-18]
:0046A0E3 8B5024                  mov edx, dword ptr [eax+24]
:0046A0E6 8B02                    mov eax, dword ptr [edx]
:0046A0E8 FF5054                  call [eax+54]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046A004(C), :0046A013(C)
|
:0046A0EB EB25                    jmp 0046A112

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00469F1D(C)
|
:0046A0ED FF15B8634800            call dword ptr [004863B8]
:0046A0F3 3B450C                  cmp eax, dword ptr [ebp+0C]
:0046A0F6 750C                    jne 0046A104
:0046A0F8 6A01                    push 00000001
:0046A0FA B9B0694B00              mov ecx, 004B69B0
:0046A0FF E8A9A50000              call 004746AD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046A0F6(C)
|
:0046A104 EB0C                    jmp 0046A112

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00469F0D(C)
|
:0046A106 6A00                    push 00000000
:0046A108 B9B0694B00              mov ecx, 004B69B0
:0046A10D E89BA50000              call 004746AD

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00469F23(U), :00469F4E(U), :0046A0EB(U), :0046A104(U)
|
:0046A112 8BE5                    mov esp, ebp
:0046A114 5D                      pop ebp
:0046A115 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0046ACB5   , :0046C29E   
|
:0046A118 55                      push ebp
:0046A119 8BEC                    mov ebp, esp
:0046A11B 83EC18                  sub esp, 00000018
:0046A11E 894DE8                  mov dword ptr [ebp-18], ecx
:0046A121 817D084A040000          cmp dword ptr [ebp+08], 0000044A
:0046A128 7571                    jne 0046A19B
:0046A12A 8D45F0                  lea eax, dword ptr [ebp-10]
:0046A12D 50                      push eax
:0046A12E 684A040000              push 0000044A
:0046A133 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0046A136 8B5104                  mov edx, dword ptr [ecx+04]
:0046A139 52                      push edx
:0046A13A FF15DC624800            call dword ptr [004862DC]
:0046A140 50                      push eax
:0046A141 FF15EC624800            call dword ptr [004862EC]
:0046A147 8B45F8                  mov eax, dword ptr [ebp-08]
:0046A14A 2B45F0                  sub eax, dword ptr [ebp-10]
:0046A14D 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046A150 89410C                  mov dword ptr [ecx+0C], eax
:0046A153 8B55E8                  mov edx, dword ptr [ebp-18]
:0046A156 8B4204                  mov eax, dword ptr [edx+04]
:0046A159 50                      push eax
:0046A15A FF1598624800            call dword ptr [00486298]
:0046A160 8945EC                  mov dword ptr [ebp-14], eax
:0046A163 6A48                    push 00000048
:0046A165 6A5A                    push 0000005A
:0046A167 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0046A16A 51                      push ecx
:0046A16B FF153C604800            call dword ptr [0048603C]
:0046A171 50                      push eax
:0046A172 6A09                    push 00000009
:0046A174 FF15E8604800            call dword ptr [004860E8]
:0046A17A 83C002                  add eax, 00000002
:0046A17D 8B550C                  mov edx, dword ptr [ebp+0C]
:0046A180 894210                  mov dword ptr [edx+10], eax
:0046A183 8B45EC                  mov eax, dword ptr [ebp-14]
:0046A186 50                      push eax
:0046A187 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0046A18A 8B5104                  mov edx, dword ptr [ecx+04]
:0046A18D 52                      push edx
:0046A18E FF159C624800            call dword ptr [0048629C]
:0046A194 B801000000              mov eax, 00000001
:0046A199 EB02                    jmp 0046A19D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046A128(C)
|
:0046A19B 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046A199(U)
|
:0046A19D 8BE5                    mov esp, ebp
:0046A19F 5D                      pop ebp
:0046A1A0 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0046ACCC   , :0046C2BA   
|
:0046A1A3 55                      push ebp
:0046A1A4 8BEC                    mov ebp, esp
:0046A1A6 83EC6C                  sub esp, 0000006C
:0046A1A9 894DA0                  mov dword ptr [ebp-60], ecx
:0046A1AC 33C0                    xor eax, eax
:0046A1AE A0C4684B00              mov al, byte ptr [004B68C4]
:0046A1B3 83E001                  and eax, 00000001
:0046A1B6 85C0                    test eax, eax
:0046A1B8 7538                    jne 0046A1F2
:0046A1BA 8A0DC4684B00            mov cl, byte ptr [004B68C4]
:0046A1C0 80C901                  or cl, 01
:0046A1C3 880DC4684B00            mov byte ptr [004B68C4], cl
:0046A1C9 6A05                    push 00000005
:0046A1CB 6A02                    push 00000002
:0046A1CD B9A8664B00              mov ecx, 004B66A8
:0046A1D2 E8AB0AFAFF              call 0040AC82
:0046A1D7 6A05                    push 00000005
:0046A1D9 6A02                    push 00000002
:0046A1DB B9B4674B00              mov ecx, 004B67B4
:0046A1E0 E89D0AFAFF              call 0040AC82

* Possible StringData Ref from Code Obj ->"Uh@"
                                  |
:0046A1E5 6893A64600              push 0046A693
:0046A1EA E8116F0100              call 00481100
:0046A1EF 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046A1B8(C)
|
:0046A1F2 C745D0A8664B00          mov [ebp-30], 004B66A8
:0046A1F9 C745E013000001          mov [ebp-20], 01000013
:0046A200 C745DC1E000001          mov [ebp-24], 0100001E
:0046A207 C745E8FFFFFFFF          mov [ebp-18], FFFFFFFF
:0046A20E B9202E4900              mov ecx, 00492E20
:0046A213 E8A00EFAFF              call 0040B0B8
:0046A218 85C0                    test eax, eax
:0046A21A 7407                    je 0046A223
:0046A21C C745E8FFFFFF00          mov [ebp-18], 00FFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046A21A(C)
|
:0046A223 684A040000              push 0000044A
:0046A228 8B55A0                  mov edx, dword ptr [ebp-60]
:0046A22B 8B4204                  mov eax, dword ptr [edx+04]
:0046A22E 50                      push eax
:0046A22F FF15DC624800            call dword ptr [004862DC]
:0046A235 8945E4                  mov dword ptr [ebp-1C], eax
:0046A238 8D4DEC                  lea ecx, dword ptr [ebp-14]
:0046A23B 51                      push ecx
:0046A23C 6A00                    push 00000000

* Possible Reference to Dialog: DialogID_0152 
                                  |
:0046A23E 6852010000              push 00000152
:0046A243 8B55E4                  mov edx, dword ptr [ebp-1C]
:0046A246 52                      push edx
:0046A247 FF15F4624800            call dword ptr [004862F4]
:0046A24D 8D45D4                  lea eax, dword ptr [ebp-2C]
:0046A250 50                      push eax
:0046A251 FF1568624800            call dword ptr [00486268]
:0046A257 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0046A25A 83C101                  add ecx, 00000001
:0046A25D 8B55D4                  mov edx, dword ptr [ebp-2C]
:0046A260 2BD1                    sub edx, ecx
:0046A262 8955D4                  mov dword ptr [ebp-2C], edx
:0046A265 8B4508                  mov eax, dword ptr [ebp+08]
:0046A268 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046A26B 034828                  add ecx, dword ptr [eax+28]
:0046A26E 8B5508                  mov edx, dword ptr [ebp+08]
:0046A271 2B4A20                  sub ecx, dword ptr [edx+20]
:0046A274 83C107                  add ecx, 00000007
:0046A277 8B45D8                  mov eax, dword ptr [ebp-28]
:0046A27A 2BC1                    sub eax, ecx
:0046A27C 8945D8                  mov dword ptr [ebp-28], eax
:0046A27F 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0046A282 51                      push ecx
:0046A283 8B55D4                  mov edx, dword ptr [ebp-2C]
:0046A286 52                      push edx
:0046A287 8B4508                  mov eax, dword ptr [ebp+08]
:0046A28A 83C01C                  add eax, 0000001C
:0046A28D 50                      push eax
:0046A28E FF158C634800            call dword ptr [0048638C]
:0046A294 85C0                    test eax, eax
:0046A296 7420                    je 0046A2B8
:0046A298 6A00                    push 00000000
:0046A29A 6A00                    push 00000000
:0046A29C 6857010000              push 00000157
:0046A2A1 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0046A2A4 51                      push ecx
:0046A2A5 FF15F4624800            call dword ptr [004862F4]
:0046A2AB 85C0                    test eax, eax
:0046A2AD 7409                    je 0046A2B8
:0046A2AF C7459C01000000          mov [ebp-64], 00000001
:0046A2B6 EB07                    jmp 0046A2BF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046A296(C), :0046A2AD(C)
|
:0046A2B8 C7459C00000000          mov [ebp-64], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046A2B6(U)
|
:0046A2BF 8B559C                  mov edx, dword ptr [ebp-64]
:0046A2C2 8955FC                  mov dword ptr [ebp-04], edx
:0046A2C5 837DFC00                cmp dword ptr [ebp-04], 00000000
:0046A2C9 741C                    je 0046A2E7
:0046A2CB C745D0B4674B00          mov [ebp-30], 004B67B4
:0046A2D2 C745E0AA000001          mov [ebp-20], 010000AA
:0046A2D9 C745DCFFFFFF00          mov [ebp-24], 00FFFFFF
:0046A2E0 C745E8FFFFFFFF          mov [ebp-18], FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046A2C9(C)
|
:0046A2E7 8B45E4                  mov eax, dword ptr [ebp-1C]
:0046A2EA 50                      push eax
:0046A2EB FF1534634800            call dword ptr [00486334]
:0046A2F1 85C0                    test eax, eax
:0046A2F3 750E                    jne 0046A303
:0046A2F5 C745DC18000001          mov [ebp-24], 01000018
:0046A2FC C745E8FFFFFF00          mov [ebp-18], 00FFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046A2F3(C)
|
:0046A303 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046A306 8B5114                  mov edx, dword ptr [ecx+14]
:0046A309 3B55E4                  cmp edx, dword ptr [ebp-1C]
:0046A30C 0F8579030000            jne 0046A68B
:0046A312 6A01                    push 00000001
:0046A314 8B4508                  mov eax, dword ptr [ebp+08]
:0046A317 8B4818                  mov ecx, dword ptr [eax+18]
:0046A31A 51                      push ecx
:0046A31B B9082E4900              mov ecx, 00492E08
:0046A320 E81B12FAFF              call 0040B540
:0046A325 C745D400000000          mov [ebp-2C], 00000000
:0046A32C C745D800000000          mov [ebp-28], 00000000
:0046A333 6A00                    push 00000000
:0046A335 6A00                    push 00000000

* Possible Reference to Dialog: DialogID_015B 
                                  |
:0046A337 685B010000              push 0000015B
:0046A33C 8B55E4                  mov edx, dword ptr [ebp-1C]
:0046A33F 52                      push edx
:0046A340 FF15F4624800            call dword ptr [004862F4]
:0046A346 8945CC                  mov dword ptr [ebp-34], eax
:0046A349 6A00                    push 00000000
:0046A34B 6A00                    push 00000000

* Possible Reference to Dialog: DialogID_0154 
                                  |
:0046A34D 6854010000              push 00000154
:0046A352 8B45E4                  mov eax, dword ptr [ebp-1C]
:0046A355 50                      push eax
:0046A356 FF15F4624800            call dword ptr [004862F4]
:0046A35C 8945C4                  mov dword ptr [ebp-3C], eax
:0046A35F 837DCCFF                cmp dword ptr [ebp-34], FFFFFFFF
:0046A363 7410                    je 0046A375
:0046A365 837DC4FF                cmp dword ptr [ebp-3C], FFFFFFFF
:0046A369 740A                    je 0046A375
:0046A36B 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0046A36E 0FAF4DC4                imul ecx, dword ptr [ebp-3C]
:0046A372 894DD8                  mov dword ptr [ebp-28], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046A363(C), :0046A369(C)
|
:0046A375 8B5508                  mov edx, dword ptr [ebp+08]
:0046A378 837A1C00                cmp dword ptr [edx+1C], 00000000
:0046A37C 7E3C                    jle 0046A3BA
:0046A37E 8B4508                  mov eax, dword ptr [ebp+08]
:0046A381 8B481C                  mov ecx, dword ptr [eax+1C]
:0046A384 83E901                  sub ecx, 00000001
:0046A387 8B5508                  mov edx, dword ptr [ebp+08]
:0046A38A 894A1C                  mov dword ptr [edx+1C], ecx
:0046A38D 8B4508                  mov eax, dword ptr [ebp+08]
:0046A390 8B4824                  mov ecx, dword ptr [eax+24]
:0046A393 83C101                  add ecx, 00000001
:0046A396 8B5508                  mov edx, dword ptr [ebp+08]
:0046A399 894A24                  mov dword ptr [edx+24], ecx
:0046A39C 8B4508                  mov eax, dword ptr [ebp+08]
:0046A39F 8B4820                  mov ecx, dword ptr [eax+20]
:0046A3A2 83E901                  sub ecx, 00000001
:0046A3A5 8B5508                  mov edx, dword ptr [ebp+08]
:0046A3A8 894A20                  mov dword ptr [edx+20], ecx
:0046A3AB 8B4508                  mov eax, dword ptr [ebp+08]
:0046A3AE 8B4828                  mov ecx, dword ptr [eax+28]
:0046A3B1 83C101                  add ecx, 00000001
:0046A3B4 8B5508                  mov edx, dword ptr [ebp+08]
:0046A3B7 894A28                  mov dword ptr [edx+28], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046A37C(C)
|
:0046A3BA 8B4508                  mov eax, dword ptr [ebp+08]
:0046A3BD 83C01C                  add eax, 0000001C
:0046A3C0 50                      push eax
:0046A3C1 FF15C0604800            call dword ptr [004860C0]
:0046A3C7 8945C0                  mov dword ptr [ebp-40], eax
:0046A3CA 8B4DC0                  mov ecx, dword ptr [ebp-40]
:0046A3CD 51                      push ecx
:0046A3CE 8B5508                  mov edx, dword ptr [ebp+08]
:0046A3D1 8B4218                  mov eax, dword ptr [edx+18]
:0046A3D4 50                      push eax
:0046A3D5 FF1598604800            call dword ptr [00486098]
:0046A3DB 6A00                    push 00000000
:0046A3DD 8D4DD4                  lea ecx, dword ptr [ebp-2C]
:0046A3E0 51                      push ecx
:0046A3E1 8B5508                  mov edx, dword ptr [ebp+08]
:0046A3E4 83C21C                  add edx, 0000001C
:0046A3E7 52                      push edx
:0046A3E8 8B45E0                  mov eax, dword ptr [ebp-20]
:0046A3EB 50                      push eax
:0046A3EC 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046A3EF 8B5118                  mov edx, dword ptr [ecx+18]
:0046A3F2 52                      push edx
:0046A3F3 8B4DD0                  mov ecx, dword ptr [ebp-30]
:0046A3F6 E82C09FAFF              call 0040AD27
:0046A3FB 85C0                    test eax, eax
:0046A3FD 752F                    jne 0046A42E
:0046A3FF 8B45E0                  mov eax, dword ptr [ebp-20]
:0046A402 50                      push eax
:0046A403 FF1568604800            call dword ptr [00486068]
:0046A409 8945BC                  mov dword ptr [ebp-44], eax
:0046A40C 8B4DBC                  mov ecx, dword ptr [ebp-44]
:0046A40F 51                      push ecx
:0046A410 8B5508                  mov edx, dword ptr [ebp+08]
:0046A413 83C21C                  add edx, 0000001C
:0046A416 52                      push edx
:0046A417 8B4508                  mov eax, dword ptr [ebp+08]
:0046A41A 8B4818                  mov ecx, dword ptr [eax+18]
:0046A41D 51                      push ecx
:0046A41E FF15F0624800            call dword ptr [004862F0]
:0046A424 8B55BC                  mov edx, dword ptr [ebp-44]
:0046A427 52                      push edx
:0046A428 FF1548604800            call dword ptr [00486048]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046A3FD(C)
|
:0046A42E 8D45C8                  lea eax, dword ptr [ebp-38]
:0046A431 50                      push eax
:0046A432 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046A435 8B5108                  mov edx, dword ptr [ecx+08]
:0046A438 52                      push edx

* Possible Reference to Dialog: DialogID_0148 
                                  |
:0046A439 6848010000              push 00000148
:0046A43E 8B45E4                  mov eax, dword ptr [ebp-1C]
:0046A441 50                      push eax
:0046A442 FF15F4624800            call dword ptr [004862F4]
:0046A448 83F8FF                  cmp eax, FFFFFFFF
:0046A44B 0F8430020000            je 0046A681
:0046A451 C745B025000000          mov [ebp-50], 00000025
:0046A458 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046A45B 83C11C                  add ecx, 0000001C
:0046A45E 8B11                    mov edx, dword ptr [ecx]
:0046A460 8955EC                  mov dword ptr [ebp-14], edx
:0046A463 8B4104                  mov eax, dword ptr [ecx+04]
:0046A466 8945F0                  mov dword ptr [ebp-10], eax
:0046A469 8B5108                  mov edx, dword ptr [ecx+08]
:0046A46C 8955F4                  mov dword ptr [ebp-0C], edx
:0046A46F 8B410C                  mov eax, dword ptr [ecx+0C]
:0046A472 8945F8                  mov dword ptr [ebp-08], eax
:0046A475 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0046A478 83C105                  add ecx, 00000005
:0046A47B 894DEC                  mov dword ptr [ebp-14], ecx
:0046A47E 8B5508                  mov edx, dword ptr [ebp+08]
:0046A481 837A1C00                cmp dword ptr [edx+1C], 00000000
:0046A485 7E09                    jle 0046A490
:0046A487 8B45EC                  mov eax, dword ptr [ebp-14]
:0046A48A 83E801                  sub eax, 00000001
:0046A48D 8945EC                  mov dword ptr [ebp-14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046A485(C)
|
:0046A490 8D4DB4                  lea ecx, dword ptr [ebp-4C]
:0046A493 51                      push ecx
:0046A494 68F06B4800              push 00486BF0
:0046A499 E8226F0100              call 004813C0
:0046A49E 83C404                  add esp, 00000004
:0046A4A1 50                      push eax
:0046A4A2 68F06B4800              push 00486BF0
:0046A4A7 8B5508                  mov edx, dword ptr [ebp+08]
:0046A4AA 8B4218                  mov eax, dword ptr [edx+18]
:0046A4AD 50                      push eax
:0046A4AE FF1590604800            call dword ptr [00486090]
:0046A4B4 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0046A4B7 034DB4                  add ecx, dword ptr [ebp-4C]
:0046A4BA 894DF4                  mov dword ptr [ebp-0C], ecx
:0046A4BD 6A00                    push 00000000
:0046A4BF 8B55E8                  mov edx, dword ptr [ebp-18]
:0046A4C2 52                      push edx
:0046A4C3 8B45DC                  mov eax, dword ptr [ebp-24]
:0046A4C6 50                      push eax
:0046A4C7 8B4DB0                  mov ecx, dword ptr [ebp-50]
:0046A4CA 51                      push ecx
:0046A4CB 8D55EC                  lea edx, dword ptr [ebp-14]
:0046A4CE 52                      push edx
:0046A4CF 6AFF                    push FFFFFFFF
:0046A4D1 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0046A4D4 E87ED2F9FF              call 00407757
:0046A4D9 50                      push eax
:0046A4DA 8B4508                  mov eax, dword ptr [ebp+08]
:0046A4DD 8B4818                  mov ecx, dword ptr [eax+18]
:0046A4E0 51                      push ecx
:0046A4E1 E8266E0000              call 0047130C
:0046A4E6 83C420                  add esp, 00000020
:0046A4E9 8B55F4                  mov edx, dword ptr [ebp-0C]
:0046A4EC 83C205                  add edx, 00000005
:0046A4EF 8955EC                  mov dword ptr [ebp-14], edx
:0046A4F2 8D45B4                  lea eax, dword ptr [ebp-4C]
:0046A4F5 50                      push eax
:0046A4F6 68B86A4800              push 00486AB8
:0046A4FB E8C06E0100              call 004813C0
:0046A500 83C404                  add esp, 00000004
:0046A503 50                      push eax
:0046A504 68B86A4800              push 00486AB8
:0046A509 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046A50C 8B5118                  mov edx, dword ptr [ecx+18]
:0046A50F 52                      push edx
:0046A510 FF1590604800            call dword ptr [00486090]
:0046A516 8B45B4                  mov eax, dword ptr [ebp-4C]
:0046A519 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0046A51C 8D540107                lea edx, dword ptr [ecx+eax+07]
:0046A520 8955F4                  mov dword ptr [ebp-0C], edx
:0046A523 68FFFFFF00              push 00FFFFFF
:0046A528 6A01                    push 00000001
:0046A52A 6A00                    push 00000000
:0046A52C FF15C8604800            call dword ptr [004860C8]
:0046A532 8945AC                  mov dword ptr [ebp-54], eax
:0046A535 68C0C0C000              push 00C0C0C0
:0046A53A 6A01                    push 00000001
:0046A53C 6A00                    push 00000000
:0046A53E FF15C8604800            call dword ptr [004860C8]
:0046A544 8945A8                  mov dword ptr [ebp-58], eax
:0046A547 8B45A8                  mov eax, dword ptr [ebp-58]
:0046A54A 50                      push eax
:0046A54B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046A54E 8B5118                  mov edx, dword ptr [ecx+18]
:0046A551 52                      push edx
:0046A552 FF156C604800            call dword ptr [0048606C]
:0046A558 8945A4                  mov dword ptr [ebp-5C], eax
:0046A55B 6A00                    push 00000000
:0046A55D 8B45F0                  mov eax, dword ptr [ebp-10]
:0046A560 50                      push eax
:0046A561 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0046A564 51                      push ecx
:0046A565 8B5508                  mov edx, dword ptr [ebp+08]
:0046A568 8B4218                  mov eax, dword ptr [edx+18]
:0046A56B 50                      push eax
:0046A56C FF15CC604800            call dword ptr [004860CC]
:0046A572 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046A575 51                      push ecx
:0046A576 8B55EC                  mov edx, dword ptr [ebp-14]
:0046A579 895598                  mov dword ptr [ebp-68], edx
:0046A57C 8B4598                  mov eax, dword ptr [ebp-68]
:0046A57F 50                      push eax
:0046A580 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046A583 8B5118                  mov edx, dword ptr [ecx+18]
:0046A586 52                      push edx
:0046A587 8B45EC                  mov eax, dword ptr [ebp-14]
:0046A58A 83C001                  add eax, 00000001
:0046A58D 8945EC                  mov dword ptr [ebp-14], eax
:0046A590 FF15C4604800            call dword ptr [004860C4]
:0046A596 8B4DAC                  mov ecx, dword ptr [ebp-54]
:0046A599 51                      push ecx
:0046A59A 8B5508                  mov edx, dword ptr [ebp+08]
:0046A59D 8B4218                  mov eax, dword ptr [edx+18]
:0046A5A0 50                      push eax
:0046A5A1 FF156C604800            call dword ptr [0048606C]
:0046A5A7 6A00                    push 00000000
:0046A5A9 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046A5AC 51                      push ecx
:0046A5AD 8B55EC                  mov edx, dword ptr [ebp-14]
:0046A5B0 52                      push edx
:0046A5B1 8B4508                  mov eax, dword ptr [ebp+08]
:0046A5B4 8B4818                  mov ecx, dword ptr [eax+18]
:0046A5B7 51                      push ecx
:0046A5B8 FF15CC604800            call dword ptr [004860CC]
:0046A5BE 8B55F8                  mov edx, dword ptr [ebp-08]
:0046A5C1 52                      push edx
:0046A5C2 8B45EC                  mov eax, dword ptr [ebp-14]
:0046A5C5 894594                  mov dword ptr [ebp-6C], eax
:0046A5C8 8B4D94                  mov ecx, dword ptr [ebp-6C]
:0046A5CB 51                      push ecx
:0046A5CC 8B5508                  mov edx, dword ptr [ebp+08]
:0046A5CF 8B4218                  mov eax, dword ptr [edx+18]
:0046A5D2 50                      push eax
:0046A5D3 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0046A5D6 83C101                  add ecx, 00000001
:0046A5D9 894DEC                  mov dword ptr [ebp-14], ecx
:0046A5DC FF15C4604800            call dword ptr [004860C4]
:0046A5E2 8B55A4                  mov edx, dword ptr [ebp-5C]
:0046A5E5 52                      push edx
:0046A5E6 8B4508                  mov eax, dword ptr [ebp+08]
:0046A5E9 8B4818                  mov ecx, dword ptr [eax+18]
:0046A5EC 51                      push ecx
:0046A5ED FF156C604800            call dword ptr [0048606C]
:0046A5F3 8B55AC                  mov edx, dword ptr [ebp-54]
:0046A5F6 52                      push edx
:0046A5F7 FF1548604800            call dword ptr [00486048]
:0046A5FD 8B45A8                  mov eax, dword ptr [ebp-58]
:0046A600 50                      push eax
:0046A601 FF1548604800            call dword ptr [00486048]
:0046A607 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0046A60A 83C105                  add ecx, 00000005
:0046A60D 894DEC                  mov dword ptr [ebp-14], ecx
:0046A610 837DFC00                cmp dword ptr [ebp-04], 00000000
:0046A614 7533                    jne 0046A649
:0046A616 8B55E4                  mov edx, dword ptr [ebp-1C]
:0046A619 52                      push edx
:0046A61A FF1534634800            call dword ptr [00486334]
:0046A620 85C0                    test eax, eax
:0046A622 7425                    je 0046A649
:0046A624 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0046A627 E8A4BFF9FF              call 004065D0
:0046A62C 50                      push eax
:0046A62D 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0046A630 E8DBBFF9FF              call 00406610
:0046A635 50                      push eax
:0046A636 E842E6FFFF              call 00468C7D
:0046A63B 83C408                  add esp, 00000008
:0046A63E 85C0                    test eax, eax
:0046A640 7407                    je 0046A649
:0046A642 C745DC80000000          mov [ebp-24], 00000080

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046A614(C), :0046A622(C), :0046A640(C)
|
:0046A649 6A00                    push 00000000
:0046A64B 8B45E8                  mov eax, dword ptr [ebp-18]
:0046A64E 50                      push eax
:0046A64F 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0046A652 51                      push ecx
:0046A653 8B55B0                  mov edx, dword ptr [ebp-50]
:0046A656 52                      push edx
:0046A657 8D45EC                  lea eax, dword ptr [ebp-14]
:0046A65A 50                      push eax
:0046A65B 6AFF                    push FFFFFFFF
:0046A65D 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0046A660 E8ABBFF9FF              call 00406610
:0046A665 25FF000000              and eax, 000000FF
:0046A66A 8B0C85A8BE4800          mov ecx, dword ptr [4*eax+0048BEA8]
:0046A671 51                      push ecx
:0046A672 8B5508                  mov edx, dword ptr [ebp+08]
:0046A675 8B4218                  mov eax, dword ptr [edx+18]
:0046A678 50                      push eax
:0046A679 E88E6C0000              call 0047130C
:0046A67E 83C420                  add esp, 00000020

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046A44B(C)
|
:0046A681 8B4DC0                  mov ecx, dword ptr [ebp-40]
:0046A684 51                      push ecx
:0046A685 FF1548604800            call dword ptr [00486048]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046A30C(C)
|
:0046A68B 33C0                    xor eax, eax
:0046A68D 8BE5                    mov esp, ebp
:0046A68F 5D                      pop ebp
:0046A690 C20400                  ret 0004


:0046A693 55                      push ebp
:0046A694 8BEC                    mov ebp, esp

* Possible StringData Ref from Code Obj ->"UjhOH"
                                  |
:0046A696 68BCAC4000              push 0040ACBC
:0046A69B 6A02                    push 00000002
:0046A69D 680C010000              push 0000010C
:0046A6A2 68A8664B00              push 004B66A8
:0046A6A7 E8346E0100              call 004814E0
:0046A6AC 5D                      pop ebp
:0046A6AD C3                      ret



* Referenced by a CALL at Address:
|:0046BE30   
|
:0046A6AE 55                      push ebp
:0046A6AF 8BEC                    mov ebp, esp
:0046A6B1 83EC18                  sub esp, 00000018
:0046A6B4 894DE8                  mov dword ptr [ebp-18], ecx
:0046A6B7 C745EC00000000          mov [ebp-14], 00000000
:0046A6BE EB09                    jmp 0046A6C9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046A726(U)
|
:0046A6C0 8B45EC                  mov eax, dword ptr [ebp-14]
:0046A6C3 83C001                  add eax, 00000001
:0046A6C6 8945EC                  mov dword ptr [ebp-14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046A6BE(U)
|
:0046A6C9 837DEC02                cmp dword ptr [ebp-14], 00000002
:0046A6CD 7D59                    jge 0046A728
:0046A6CF 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0046A6D2 8B148D706A4800          mov edx, dword ptr [4*ecx+00486A70]
:0046A6D9 52                      push edx
:0046A6DA 8B45E8                  mov eax, dword ptr [ebp-18]
:0046A6DD 8B4804                  mov ecx, dword ptr [eax+04]
:0046A6E0 51                      push ecx
:0046A6E1 FF15DC624800            call dword ptr [004862DC]
:0046A6E7 39450C                  cmp dword ptr [ebp+0C], eax
:0046A6EA 753A                    jne 0046A726
:0046A6EC 8B550C                  mov edx, dword ptr [ebp+0C]
:0046A6EF 52                      push edx
:0046A6F0 FF1534634800            call dword ptr [00486334]
:0046A6F6 85C0                    test eax, eax
:0046A6F8 742C                    je 0046A726
:0046A6FA 8D45F0                  lea eax, dword ptr [ebp-10]
:0046A6FD 50                      push eax
:0046A6FE 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046A701 51                      push ecx
:0046A702 FF15EC624800            call dword ptr [004862EC]
:0046A708 6A05                    push 00000005
:0046A70A 6A00                    push 00000000
:0046A70C 8D55F0                  lea edx, dword ptr [ebp-10]
:0046A70F 52                      push edx
:0046A710 8B4508                  mov eax, dword ptr [ebp+08]
:0046A713 50                      push eax
:0046A714 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0046A717 C1E105                  shl ecx, 05
:0046A71A 8B55E8                  mov edx, dword ptr [ebp-18]
:0046A71D 8D4C0A30                lea ecx, dword ptr [edx+ecx+30]
:0046A721 E8496DFFFF              call 0046146F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046A6EA(C), :0046A6F8(C)
|
:0046A726 EB98                    jmp 0046A6C0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046A6CD(C)
|
:0046A728 8BE5                    mov esp, ebp
:0046A72A 5D                      pop ebp
:0046A72B C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0046AC18   , :0046AC68   , :0046C1E0   , :0046C230   
|
:0046A72E 55                      push ebp
:0046A72F 8BEC                    mov ebp, esp
:0046A731 51                      push ecx
:0046A732 894DFC                  mov dword ptr [ebp-04], ecx
:0046A735 8B45FC                  mov eax, dword ptr [ebp-04]
:0046A738 8B482C                  mov ecx, dword ptr [eax+2C]
:0046A73B 83C101                  add ecx, 00000001
:0046A73E 8B55FC                  mov edx, dword ptr [ebp-04]
:0046A741 894A2C                  mov dword ptr [edx+2C], ecx
:0046A744 FF1584634800            call dword ptr [00486384]
:0046A74A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046A74D 3B4104                  cmp eax, dword ptr [ecx+04]
:0046A750 7506                    jne 0046A758
:0046A752 FF1580634800            call dword ptr [00486380]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046A750(C)
|
:0046A758 8BE5                    mov esp, ebp
:0046A75A 5D                      pop ebp
:0046A75B C3                      ret



* Referenced by a CALL at Addresses:
|:0046AC4A   , :0046AC9A   , :0046C212   , :0046C262   
|
:0046A75C 55                      push ebp
:0046A75D 8BEC                    mov ebp, esp
:0046A75F 51                      push ecx
:0046A760 894DFC                  mov dword ptr [ebp-04], ecx
:0046A763 8B45FC                  mov eax, dword ptr [ebp-04]
:0046A766 83782C00                cmp dword ptr [eax+2C], 00000000
:0046A76A 7E0F                    jle 0046A77B
:0046A76C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046A76F 8B512C                  mov edx, dword ptr [ecx+2C]
:0046A772 83EA01                  sub edx, 00000001
:0046A775 8B45FC                  mov eax, dword ptr [ebp-04]
:0046A778 89502C                  mov dword ptr [eax+2C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046A76A(C)
|
:0046A77B 8BE5                    mov esp, ebp
:0046A77D 5D                      pop ebp
:0046A77E C3                      ret



* Referenced by a CALL at Address:
|:0046A801   
|
:0046A77F 55                      push ebp
:0046A780 8BEC                    mov ebp, esp
:0046A782 83EC0C                  sub esp, 0000000C
:0046A785 894DF8                  mov dword ptr [ebp-08], ecx
:0046A788 8B45F8                  mov eax, dword ptr [ebp-08]
:0046A78B 8B4804                  mov ecx, dword ptr [eax+04]
:0046A78E 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046A7B6(U)
|
:0046A791 6AF0                    push FFFFFFF0
:0046A793 8B55FC                  mov edx, dword ptr [ebp-04]
:0046A796 52                      push edx
:0046A797 FF15A0634800            call dword ptr [004863A0]
:0046A79D 2500000040              and eax, 40000000
:0046A7A2 3D00000040              cmp eax, 40000000
:0046A7A7 750F                    jne 0046A7B8
:0046A7A9 8B45FC                  mov eax, dword ptr [ebp-04]
:0046A7AC 50                      push eax
:0046A7AD FF159C634800            call dword ptr [0048639C]
:0046A7B3 8945FC                  mov dword ptr [ebp-04], eax
:0046A7B6 EBD9                    jmp 0046A791

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046A7A7(C)
|
:0046A7B8 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046A7BB 83792C00                cmp dword ptr [ecx+2C], 00000000
:0046A7BF 7519                    jne 0046A7DA
:0046A7C1 8B55FC                  mov edx, dword ptr [ebp-04]
:0046A7C4 52                      push edx
:0046A7C5 E81C400000              call 0046E7E6
:0046A7CA 83C404                  add esp, 00000004
:0046A7CD 85C0                    test eax, eax
:0046A7CF 7509                    jne 0046A7DA
:0046A7D1 C745F401000000          mov [ebp-0C], 00000001
:0046A7D8 EB07                    jmp 0046A7E1

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046A7BF(C), :0046A7CF(C)
|
:0046A7DA C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046A7D8(U)
|
:0046A7E1 8B45F4                  mov eax, dword ptr [ebp-0C]
:0046A7E4 8BE5                    mov esp, ebp
:0046A7E6 5D                      pop ebp
:0046A7E7 C3                      ret



* Referenced by a CALL at Addresses:
|:0046ABD1   , :0046C199   
|
:0046A7E8 55                      push ebp
:0046A7E9 8BEC                    mov ebp, esp
:0046A7EB 83EC08                  sub esp, 00000008
:0046A7EE 894DF8                  mov dword ptr [ebp-08], ecx
:0046A7F1 8B450C                  mov eax, dword ptr [ebp+0C]
:0046A7F4 25FFFF0000              and eax, 0000FFFF
:0046A7F9 83F8FF                  cmp eax, FFFFFFFF
:0046A7FC 740C                    je 0046A80A
:0046A7FE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046A801 E879FFFFFF              call 0046A77F
:0046A806 85C0                    test eax, eax
:0046A808 7504                    jne 0046A80E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046A7FC(C)
|
:0046A80A 33C0                    xor eax, eax
:0046A80C EB3E                    jmp 0046A84C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046A808(C)
|
:0046A80E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046A811 E868F3FFFF              call 00469B7E
:0046A816 8845FC                  mov byte ptr [ebp-04], al
:0046A819 8A4DFC                  mov cl, byte ptr [ebp-04]
:0046A81C 51                      push ecx
:0046A81D 8B55F8                  mov edx, dword ptr [ebp-08]
:0046A820 8B02                    mov eax, dword ptr [edx]
:0046A822 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046A825 FF5004                  call [eax+04]
:0046A828 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046A82B 81E1FF000000            and ecx, 000000FF
:0046A831 83F903                  cmp ecx, 00000003
:0046A834 7D14                    jge 0046A84A
:0046A836 8B55F8                  mov edx, dword ptr [ebp-08]
:0046A839 8B4204                  mov eax, dword ptr [edx+04]
:0046A83C 50                      push eax
:0046A83D FF1588634800            call dword ptr [00486388]
:0046A843 B801000000              mov eax, 00000001
:0046A848 EB02                    jmp 0046A84C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046A834(C)
|
:0046A84A 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046A80C(U), :0046A848(U)
|
:0046A84C 8BE5                    mov esp, ebp
:0046A84E 5D                      pop ebp
:0046A84F C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:0046ABFA   , :0046C1C2   
|
:0046A852 55                      push ebp
:0046A853 8BEC                    mov ebp, esp
:0046A855 83EC08                  sub esp, 00000008
:0046A858 894DF8                  mov dword ptr [ebp-08], ecx
:0046A85B FF1584634800            call dword ptr [00486384]
:0046A861 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046A864 3B4104                  cmp eax, dword ptr [ecx+04]
:0046A867 752D                    jne 0046A896
:0046A869 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046A86C E80DF3FFFF              call 00469B7E
:0046A871 8845FC                  mov byte ptr [ebp-04], al
:0046A874 8A55FC                  mov dl, byte ptr [ebp-04]
:0046A877 52                      push edx
:0046A878 8B45F8                  mov eax, dword ptr [ebp-08]
:0046A87B 8B10                    mov edx, dword ptr [eax]
:0046A87D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046A880 FF5204                  call [edx+04]
:0046A883 8B45FC                  mov eax, dword ptr [ebp-04]
:0046A886 25FF000000              and eax, 000000FF
:0046A88B 83F803                  cmp eax, 00000003
:0046A88E 7C06                    jl 0046A896
:0046A890 FF1580634800            call dword ptr [00486380]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046A867(C), :0046A88E(C)
|
:0046A896 33C0                    xor eax, eax
:0046A898 8BE5                    mov esp, ebp
:0046A89A 5D                      pop ebp
:0046A89B C20C00                  ret 000C


:0046A89E 55                      push ebp
:0046A89F 8BEC                    mov ebp, esp
:0046A8A1 51                      push ecx
:0046A8A2 894DFC                  mov dword ptr [ebp-04], ecx
:0046A8A5 8B4508                  mov eax, dword ptr [ebp+08]
:0046A8A8 25FF000000              and eax, 000000FF
:0046A8AD 83F803                  cmp eax, 00000003
:0046A8B0 7D5F                    jge 0046A911
:0046A8B2 8A4D08                  mov cl, byte ptr [ebp+08]
:0046A8B5 51                      push ecx
:0046A8B6 8B55FC                  mov edx, dword ptr [ebp-04]
:0046A8B9 8B4A20                  mov ecx, dword ptr [edx+20]
:0046A8BC E82FBDF9FF              call 004065F0
:0046A8C1 25FF000000              and eax, 000000FF
:0046A8C6 3DFF000000              cmp eax, 000000FF
:0046A8CB 7444                    je 0046A911
:0046A8CD 8A4508                  mov al, byte ptr [ebp+08]
:0046A8D0 50                      push eax
:0046A8D1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046A8D4 8B4920                  mov ecx, dword ptr [ecx+20]
:0046A8D7 E8A4EDF9FF              call 00409680
:0046A8DC 50                      push eax
:0046A8DD 8A5508                  mov dl, byte ptr [ebp+08]
:0046A8E0 52                      push edx
:0046A8E1 8B45FC                  mov eax, dword ptr [ebp-04]
:0046A8E4 8B4820                  mov ecx, dword ptr [eax+20]
:0046A8E7 E8F4ECF9FF              call 004095E0
:0046A8EC 50                      push eax
:0046A8ED 8A4D08                  mov cl, byte ptr [ebp+08]
:0046A8F0 51                      push ecx
:0046A8F1 8B55FC                  mov edx, dword ptr [ebp-04]
:0046A8F4 8B4A20                  mov ecx, dword ptr [edx+20]
:0046A8F7 E8F4BCF9FF              call 004065F0
:0046A8FC 25FF000000              and eax, 000000FF
:0046A901 50                      push eax
:0046A902 8B45FC                  mov eax, dword ptr [ebp-04]
:0046A905 8B4804                  mov ecx, dword ptr [eax+04]
:0046A908 51                      push ecx
:0046A909 E8E915FAFF              call 0040BEF7
:0046A90E 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046A8B0(C), :0046A8CB(C)
|
:0046A911 8BE5                    mov esp, ebp
:0046A913 5D                      pop ebp
:0046A914 C20400                  ret 0004



* Referenced by a CALL at Address:
|:00461D59   
|
:0046A917 55                      push ebp
:0046A918 8BEC                    mov ebp, esp
:0046A91A 6AFF                    push FFFFFFFF
:0046A91C 68D0584800              push 004858D0
:0046A921 64A100000000            mov eax, dword ptr fs:[00000000]
:0046A927 50                      push eax
:0046A928 64892500000000          mov dword ptr fs:[00000000], esp
:0046A92F 51                      push ecx
:0046A930 894DF0                  mov dword ptr [ebp-10], ecx
:0046A933 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046A936 83C10C                  add ecx, 0000000C
:0046A939 E8D2860000              call 00473010
:0046A93E C745FC00000000          mov [ebp-04], 00000000
:0046A945 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046A948 81C1E0000000            add ecx, 000000E0
:0046A94E E80D870000              call 00473060
:0046A953 C645FC01                mov [ebp-04], 01
:0046A957 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046A95A 81C1B0010000            add ecx, 000001B0
:0046A960 E8EB850000              call 00472F50
:0046A965 C645FC02                mov [ebp-04], 02
:0046A969 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046A96C 81C17C020000            add ecx, 0000027C
:0046A972 E81939FAFF              call 0040E290
:0046A977 C645FC03                mov [ebp-04], 03
:0046A97B 8B45F0                  mov eax, dword ptr [ebp-10]
:0046A97E C70000000000            mov dword ptr [eax], 00000000
:0046A984 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046A987 C6410800                mov [ecx+08], 00
:0046A98B 8B55F0                  mov edx, dword ptr [ebp-10]
:0046A98E 81C2B0010000            add edx, 000001B0
:0046A994 52                      push edx
:0046A995 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046A998 83C10C                  add ecx, 0000000C
:0046A99B E890800000              call 00472A30
:0046A9A0 8B45F0                  mov eax, dword ptr [ebp-10]
:0046A9A3 83C00C                  add eax, 0000000C
:0046A9A6 50                      push eax
:0046A9A7 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046A9AA 81C1B0010000            add ecx, 000001B0
:0046A9B0 E81B860000              call 00472FD0
:0046A9B5 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0046A9BC 8B45F0                  mov eax, dword ptr [ebp-10]
:0046A9BF 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046A9C2 64890D00000000          mov dword ptr fs:[00000000], ecx
:0046A9C9 8BE5                    mov esp, ebp
:0046A9CB 5D                      pop ebp
:0046A9CC C3                      ret



* Referenced by a CALL at Address:
|:00461D79   
|
:0046A9CD 55                      push ebp
:0046A9CE 8BEC                    mov ebp, esp
:0046A9D0 51                      push ecx
:0046A9D1 894DFC                  mov dword ptr [ebp-04], ecx
:0046A9D4 8B45FC                  mov eax, dword ptr [ebp-04]
:0046A9D7 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046A9DA 894804                  mov dword ptr [eax+04], ecx
:0046A9DD 8B55FC                  mov edx, dword ptr [ebp-04]
:0046A9E0 52                      push edx

* Possible StringData Ref from Code Obj ->"U}"
                                  |
:0046A9E1 681CCE4600              push 0046CE1C
:0046A9E6 8B45FC                  mov eax, dword ptr [ebp-04]
:0046A9E9 8B4804                  mov ecx, dword ptr [eax+04]
:0046A9EC 51                      push ecx

* Possible Reference to Dialog: DialogID_0147 
                                  |
:0046A9ED 6847010000              push 00000147
:0046A9F2 8B5508                  mov edx, dword ptr [ebp+08]
:0046A9F5 52                      push edx
:0046A9F6 FF15A0624800            call dword ptr [004862A0]
:0046A9FC 8BE5                    mov esp, ebp
:0046A9FE 5D                      pop ebp
:0046A9FF C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0046CE5D   , :0046CE9C   
|
:0046AA02 55                      push ebp
:0046AA03 8BEC                    mov ebp, esp
:0046AA05 83EC18                  sub esp, 00000018
:0046AA08 894DF4                  mov dword ptr [ebp-0C], ecx
:0046AA0B 817D0C10010000          cmp dword ptr [ebp+0C], 00000110
:0046AA12 0F8581000000            jne 0046AA99
:0046AA18 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046AA1B E898040000              call 0046AEB8
:0046AA20 68EB030000              push 000003EB
:0046AA25 8B4510                  mov eax, dword ptr [ebp+10]
:0046AA28 50                      push eax
:0046AA29 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046AA2C 51                      push ecx
:0046AA2D 8B5508                  mov edx, dword ptr [ebp+08]
:0046AA30 52                      push edx
:0046AA31 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046AA34 81C1E0000000            add ecx, 000000E0
:0046AA3A 8B45F4                  mov eax, dword ptr [ebp-0C]
:0046AA3D 8B90E0000000            mov edx, dword ptr [eax+000000E0]
:0046AA43 FF5224                  call [edx+24]
:0046AA46 68B1050000              push 000005B1
:0046AA4B 8B4510                  mov eax, dword ptr [ebp+10]
:0046AA4E 50                      push eax
:0046AA4F 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046AA52 51                      push ecx
:0046AA53 8B5508                  mov edx, dword ptr [ebp+08]
:0046AA56 52                      push edx
:0046AA57 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046AA5A 83C10C                  add ecx, 0000000C
:0046AA5D 8B45F4                  mov eax, dword ptr [ebp-0C]
:0046AA60 8B500C                  mov edx, dword ptr [eax+0C]
:0046AA63 FF5224                  call [edx+24]
:0046AA66 8B45F4                  mov eax, dword ptr [ebp-0C]
:0046AA69 8B08                    mov ecx, dword ptr [eax]
:0046AA6B 51                      push ecx
:0046AA6C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046AA6F 81C1B0010000            add ecx, 000001B0
:0046AA75 E8E64EFEFF              call 0044F960
:0046AA7A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046AA7D 81C1B0010000            add ecx, 000001B0
:0046AA83 E8D8F1FFFF              call 00469C60
:0046AA88 6A00                    push 00000000
:0046AA8A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046AA8D E8DC040000              call 0046AF6E
:0046AA92 33C0                    xor eax, eax
:0046AA94 E90C030000              jmp 0046ADA5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046AA12(C)
|
:0046AA99 8B5514                  mov edx, dword ptr [ebp+14]
:0046AA9C 52                      push edx
:0046AA9D 8B4510                  mov eax, dword ptr [ebp+10]
:0046AAA0 50                      push eax
:0046AAA1 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046AAA4 51                      push ecx
:0046AAA5 8B5508                  mov edx, dword ptr [ebp+08]
:0046AAA8 52                      push edx
:0046AAA9 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046AAAC 83C10C                  add ecx, 0000000C
:0046AAAF 8B45F4                  mov eax, dword ptr [ebp-0C]
:0046AAB2 8B500C                  mov edx, dword ptr [eax+0C]
:0046AAB5 FF5224                  call [edx+24]
:0046AAB8 85C0                    test eax, eax
:0046AABA 740A                    je 0046AAC6
:0046AABC B801000000              mov eax, 00000001
:0046AAC1 E9DF020000              jmp 0046ADA5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046AABA(C)
|
:0046AAC6 8B4514                  mov eax, dword ptr [ebp+14]
:0046AAC9 50                      push eax
:0046AACA 8B4D10                  mov ecx, dword ptr [ebp+10]
:0046AACD 51                      push ecx
:0046AACE 8B550C                  mov edx, dword ptr [ebp+0C]
:0046AAD1 52                      push edx
:0046AAD2 8B4508                  mov eax, dword ptr [ebp+08]
:0046AAD5 50                      push eax
:0046AAD6 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046AAD9 81C1E0000000            add ecx, 000000E0
:0046AADF 8B55F4                  mov edx, dword ptr [ebp-0C]
:0046AAE2 8B82E0000000            mov eax, dword ptr [edx+000000E0]
:0046AAE8 FF5024                  call [eax+24]
:0046AAEB 85C0                    test eax, eax
:0046AAED 740A                    je 0046AAF9
:0046AAEF B801000000              mov eax, 00000001
:0046AAF4 E9AC020000              jmp 0046ADA5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046AAED(C)
|
:0046AAF9 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046AAFC 894DF0                  mov dword ptr [ebp-10], ecx
:0046AAFF 837DF020                cmp dword ptr [ebp-10], 00000020
:0046AB03 7715                    ja 0046AB1A
:0046AB05 837DF020                cmp dword ptr [ebp-10], 00000020
:0046AB09 0F84A3000000            je 0046ABB2
:0046AB0F 837DF002                cmp dword ptr [ebp-10], 00000002
:0046AB13 7459                    je 0046AB6E
:0046AB15 E989020000              jmp 0046ADA3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046AB03(C)
|
:0046AB1A 837DF04E                cmp dword ptr [ebp-10], 0000004E
:0046AB1E 7723                    ja 0046AB43
:0046AB20 837DF04E                cmp dword ptr [ebp-10], 0000004E
:0046AB24 0F843B020000            je 0046AD65
:0046AB2A 837DF02B                cmp dword ptr [ebp-10], 0000002B
:0046AB2E 0F848B010000            je 0046ACBF
:0046AB34 837DF02C                cmp dword ptr [ebp-10], 0000002C
:0046AB38 0F8466010000            je 0046ACA4
:0046AB3E E960020000              jmp 0046ADA3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046AB1E(C)
|
:0046AB43 8B55F0                  mov edx, dword ptr [ebp-10]
:0046AB46 81EA11010000            sub edx, 00000111
:0046AB4C 8955F0                  mov dword ptr [ebp-10], edx
:0046AB4F 817DF0F4000000          cmp dword ptr [ebp-10], 000000F4
:0046AB56 0F8747020000            ja 0046ADA3
:0046AB5C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046AB5F 33C0                    xor eax, eax
:0046AB61 8A81C3AD4600            mov al, byte ptr [ecx+0046ADC3]
:0046AB67 FF2485ABAD4600          jmp dword ptr [4*eax+0046ADAB]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046AB13(C)
|
:0046AB6E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046AB71 81C1B0010000            add ecx, 000001B0
:0046AB77 E8FBF2FFFF              call 00469E77
:0046AB7C 6A00                    push 00000000
:0046AB7E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046AB81 81C1B0010000            add ecx, 000001B0
:0046AB87 E8D44DFEFF              call 0044F960
:0046AB8C E912020000              jmp 0046ADA3
:0046AB91 8B5514                  mov edx, dword ptr [ebp+14]
:0046AB94 52                      push edx
:0046AB95 8B4510                  mov eax, dword ptr [ebp+10]
:0046AB98 50                      push eax
:0046AB99 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046AB9C 81C1B0010000            add ecx, 000001B0
:0046ABA2 8B55F4                  mov edx, dword ptr [ebp-0C]
:0046ABA5 8B82B0010000            mov eax, dword ptr [edx+000001B0]
:0046ABAB FF10                    call dword ptr [eax]
:0046ABAD E9F1010000              jmp 0046ADA3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046AB09(C)
|
:0046ABB2 8B4D14                  mov ecx, dword ptr [ebp+14]
:0046ABB5 C1E910                  shr ecx, 10
:0046ABB8 81E1FFFF0000            and ecx, 0000FFFF
:0046ABBE 51                      push ecx
:0046ABBF 668B5514                mov dx, word ptr [ebp+14]
:0046ABC3 52                      push edx
:0046ABC4 8B4510                  mov eax, dword ptr [ebp+10]
:0046ABC7 50                      push eax
:0046ABC8 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046ABCB 81C1B0010000            add ecx, 000001B0
:0046ABD1 E812FCFFFF              call 0046A7E8
:0046ABD6 E9CA010000              jmp 0046ADA5
:0046ABDB 8B4D14                  mov ecx, dword ptr [ebp+14]
:0046ABDE C1E910                  shr ecx, 10
:0046ABE1 81E1FFFF0000            and ecx, 0000FFFF
:0046ABE7 51                      push ecx
:0046ABE8 668B5514                mov dx, word ptr [ebp+14]
:0046ABEC 52                      push edx
:0046ABED 8B4510                  mov eax, dword ptr [ebp+10]
:0046ABF0 50                      push eax
:0046ABF1 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046ABF4 81C1B0010000            add ecx, 000001B0
:0046ABFA E853FCFFFF              call 0046A852
:0046ABFF E9A1010000              jmp 0046ADA5
:0046AC04 FF1584634800            call dword ptr [00486384]
:0046AC0A 3B4508                  cmp eax, dword ptr [ebp+08]
:0046AC0D 7540                    jne 0046AC4F
:0046AC0F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046AC12 81C1B0010000            add ecx, 000001B0
:0046AC18 E811FBFFFF              call 0046A72E
:0046AC1D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046AC20 81C1B0010000            add ecx, 000001B0
:0046AC26 E853EFFFFF              call 00469B7E
:0046AC2B 50                      push eax
:0046AC2C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046AC2F 81C1B0010000            add ecx, 000001B0
:0046AC35 8B55F4                  mov edx, dword ptr [ebp-0C]
:0046AC38 8B82B0010000            mov eax, dword ptr [edx+000001B0]
:0046AC3E FF5008                  call [eax+08]
:0046AC41 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046AC44 81C1B0010000            add ecx, 000001B0
:0046AC4A E80DFBFFFF              call 0046A75C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046AC0D(C)
|
:0046AC4F E94F010000              jmp 0046ADA3
:0046AC54 FF1584634800            call dword ptr [00486384]
:0046AC5A 3B4508                  cmp eax, dword ptr [ebp+08]
:0046AC5D 7540                    jne 0046AC9F
:0046AC5F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046AC62 81C1B0010000            add ecx, 000001B0
:0046AC68 E8C1FAFFFF              call 0046A72E
:0046AC6D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046AC70 81C1B0010000            add ecx, 000001B0
:0046AC76 E803EFFFFF              call 00469B7E
:0046AC7B 50                      push eax
:0046AC7C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046AC7F 81C1B0010000            add ecx, 000001B0
:0046AC85 8B55F4                  mov edx, dword ptr [ebp-0C]
:0046AC88 8B82B0010000            mov eax, dword ptr [edx+000001B0]
:0046AC8E FF500C                  call [eax+0C]
:0046AC91 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046AC94 81C1B0010000            add ecx, 000001B0
:0046AC9A E8BDFAFFFF              call 0046A75C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046AC5D(C)
|
:0046AC9F E9FF000000              jmp 0046ADA3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046AB38(C)
|
:0046ACA4 8B4D14                  mov ecx, dword ptr [ebp+14]
:0046ACA7 51                      push ecx
:0046ACA8 8B5510                  mov edx, dword ptr [ebp+10]
:0046ACAB 52                      push edx
:0046ACAC 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046ACAF 81C1B0010000            add ecx, 000001B0
:0046ACB5 E85EF4FFFF              call 0046A118
:0046ACBA E9E6000000              jmp 0046ADA5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046AB2E(C)
|
:0046ACBF 8B4514                  mov eax, dword ptr [ebp+14]
:0046ACC2 50                      push eax
:0046ACC3 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046ACC6 81C1B0010000            add ecx, 000001B0
:0046ACCC E8D2F4FFFF              call 0046A1A3
:0046ACD1 E9CF000000              jmp 0046ADA5
:0046ACD6 8B4D10                  mov ecx, dword ptr [ebp+10]
:0046ACD9 81E1FFFF0000            and ecx, 0000FFFF
:0046ACDF 894DEC                  mov dword ptr [ebp-14], ecx
:0046ACE2 817DEC03040000          cmp dword ptr [ebp-14], 00000403
:0046ACE9 7F11                    jg 0046ACFC
:0046ACEB 817DEC03040000          cmp dword ptr [ebp-14], 00000403
:0046ACF2 744D                    je 0046AD41
:0046ACF4 837DEC02                cmp dword ptr [ebp-14], 00000002
:0046ACF8 7416                    je 0046AD10
:0046ACFA EB67                    jmp 0046AD63

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046ACE9(C)
|
:0046ACFC 817DEC04040000          cmp dword ptr [ebp-14], 00000404
:0046AD03 744E                    je 0046AD53
:0046AD05 817DEC4A040000          cmp dword ptr [ebp-14], 0000044A
:0046AD0C 7412                    je 0046AD20
:0046AD0E EB53                    jmp 0046AD63

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046ACF8(C)
|
:0046AD10 6A00                    push 00000000
:0046AD12 8B55F4                  mov edx, dword ptr [ebp-0C]
:0046AD15 8B02                    mov eax, dword ptr [edx]
:0046AD17 50                      push eax
:0046AD18 FF15D4624800            call dword ptr [004862D4]
:0046AD1E EB43                    jmp 0046AD63

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046AD0C(C)
|
:0046AD20 8B4D14                  mov ecx, dword ptr [ebp+14]
:0046AD23 51                      push ecx
:0046AD24 8B5510                  mov edx, dword ptr [ebp+10]
:0046AD27 C1EA10                  shr edx, 10
:0046AD2A 81E2FFFF0000            and edx, 0000FFFF
:0046AD30 52                      push edx
:0046AD31 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046AD34 81C1B0010000            add ecx, 000001B0
:0046AD3A E88CF1FFFF              call 00469ECB
:0046AD3F EB22                    jmp 0046AD63

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046ACF2(C)
|
:0046AD41 6AFF                    push FFFFFFFF
:0046AD43 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046AD46 81C1B0010000            add ecx, 000001B0
:0046AD4C E88BEDFFFF              call 00469ADC
:0046AD51 EB10                    jmp 0046AD63

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046AD03(C)
|
:0046AD53 6A01                    push 00000001
:0046AD55 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046AD58 81C1B0010000            add ecx, 000001B0
:0046AD5E E879EDFFFF              call 00469ADC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046ACFA(U), :0046AD0E(U), :0046AD1E(U), :0046AD3F(U), :0046AD51(U)
|
:0046AD63 EB3E                    jmp 0046ADA3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046AB24(C)
|
:0046AD65 8B4514                  mov eax, dword ptr [ebp+14]
:0046AD68 8945FC                  mov dword ptr [ebp-04], eax
:0046AD6B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046AD6E 8B5108                  mov edx, dword ptr [ecx+08]
:0046AD71 8955E8                  mov dword ptr [ebp-18], edx
:0046AD74 817DE8D9FDFFFF          cmp dword ptr [ebp-18], FFFFFDD9
:0046AD7B 7402                    je 0046AD7F
:0046AD7D EB24                    jmp 0046ADA3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046AD7B(C)
|
:0046AD7F 6A00                    push 00000000
:0046AD81 6A00                    push 00000000
:0046AD83 680B130000              push 0000130B
:0046AD88 8B45FC                  mov eax, dword ptr [ebp-04]
:0046AD8B 8B08                    mov ecx, dword ptr [eax]
:0046AD8D 51                      push ecx
:0046AD8E FF15F4624800            call dword ptr [004862F4]
:0046AD94 8845F8                  mov byte ptr [ebp-08], al
:0046AD97 8A55F8                  mov dl, byte ptr [ebp-08]
:0046AD9A 52                      push edx
:0046AD9B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046AD9E E8CB010000              call 0046AF6E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046AB15(U), :0046AB3E(U), :0046AB56(C), :0046AB8C(U), :0046ABAD(U)
|:0046AC4F(U), :0046AC9F(U), :0046AD63(U), :0046AD7D(U)
|
:0046ADA3 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046AA94(U), :0046AAC1(U), :0046AAF4(U), :0046ABD6(U), :0046ABFF(U)
|:0046ACBA(U), :0046ACD1(U)
|
:0046ADA5 8BE5                    mov esp, ebp
:0046ADA7 5D                      pop ebp
:0046ADA8 C21000                  ret 0010



:0046ADAB D6AC4600                DWORD 0046ACD6
:0046ADAF 91AB4600                DWORD 0046AB91
:0046ADB3 DBAB4600                DWORD 0046ABDB
:0046ADB7 04AC4600                DWORD 0046AC04
:0046ADBB 54AC4600                DWORD 0046AC54
:0046ADBF A3AD4600                DWORD 0046ADA3


:0046ADC3 000505050505            add byte ptr [05050505], al
:0046ADC9 0505050505              add eax, 05050505
:0046ADCE 0505050505              add eax, 05050505
:0046ADD3 0505050505              add eax, 05050505
:0046ADD8 0505050505              add eax, 05050505
:0046ADDD 0505050505              add eax, 05050505
:0046ADE2 0505050505              add eax, 05050505
:0046ADE7 0505050105              add eax, 05010505
:0046ADEC 0505050505              add eax, 05050505
:0046ADF1 0505050505              add eax, 05050505
:0046ADF6 0505050505              add eax, 05050505
:0046ADFB 0505050505              add eax, 05050505
:0046AE00 0505050505              add eax, 05050505
:0046AE05 0505050505              add eax, 05050505
:0046AE0A 0505050505              add eax, 05050505
:0046AE0F 0505050505              add eax, 05050505
:0046AE14 0505050505              add eax, 05050505
:0046AE19 0505050505              add eax, 05050505
:0046AE1E 0505050505              add eax, 05050505
:0046AE23 0505050505              add eax, 05050505
:0046AE28 0505050505              add eax, 05050505
:0046AE2D 0505050505              add eax, 05050505
:0046AE32 0505050505              add eax, 05050505
:0046AE37 0505050505              add eax, 05050505
:0046AE3C 0505050505              add eax, 05050505
:0046AE41 0505050505              add eax, 05050505
:0046AE46 0505050505              add eax, 05050505
:0046AE4B 0505050505              add eax, 05050505
:0046AE50 0505050505              add eax, 05050505
:0046AE55 0505050505              add eax, 05050505
:0046AE5A 0505050505              add eax, 05050505
:0046AE5F 0505050505              add eax, 05050505
:0046AE64 0505050505              add eax, 05050505
:0046AE69 0505050505              add eax, 05050505
:0046AE6E 0505050505              add eax, 05050505
:0046AE73 0505050505              add eax, 05050505
:0046AE78 0505050505              add eax, 05050505
:0046AE7D 0505050505              add eax, 05050505
:0046AE82 0505050505              add eax, 05050505
:0046AE87 0505050505              add eax, 05050505
:0046AE8C 0505050505              add eax, 05050505
:0046AE91 0505050505              add eax, 05050505
:0046AE96 0505050505              add eax, 05050505
:0046AE9B 0505050505              add eax, 05050505
:0046AEA0 0505050505              add eax, 05050505
:0046AEA5 0505050505              add eax, 05050505
:0046AEAA 0505050505              add eax, 05050505
:0046AEAF 0505050205              add eax, 05020505
:0046AEB4 03                      BYTE 03h
:0046AEB5 05                      BYTE 05h
:0046AEB6 05                      BYTE 05h
:0046AEB7 04                      BYTE 04h


* Referenced by a CALL at Address:
|:0046AA1B   
|
:0046AEB8 55                      push ebp
:0046AEB9 8BEC                    mov ebp, esp
:0046AEBB 83EC10                  sub esp, 00000010
:0046AEBE 894DF0                  mov dword ptr [ebp-10], ecx
:0046AEC1 8B45F0                  mov eax, dword ptr [ebp-10]
:0046AEC4 8B4804                  mov ecx, dword ptr [eax+04]
:0046AEC7 51                      push ecx
:0046AEC8 8B55F0                  mov edx, dword ptr [ebp-10]
:0046AECB 8B02                    mov eax, dword ptr [edx]
:0046AECD 50                      push eax
:0046AECE E8D374FFFF              call 004623A6
:0046AED3 83C408                  add esp, 00000008
:0046AED6 6A00                    push 00000000
:0046AED8 B970074B00              mov ecx, 004B0770
:0046AEDD E8EE32FAFF              call 0040E1D0
:0046AEE2 50                      push eax
:0046AEE3 6875040000              push 00000475
:0046AEE8 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046AEEB 8B11                    mov edx, dword ptr [ecx]
:0046AEED 52                      push edx
:0046AEEE FF15E4624800            call dword ptr [004862E4]
:0046AEF4 686D050000              push 0000056D
:0046AEF9 8B45F0                  mov eax, dword ptr [ebp-10]
:0046AEFC 8B08                    mov ecx, dword ptr [eax]
:0046AEFE 51                      push ecx
:0046AEFF FF15DC624800            call dword ptr [004862DC]
:0046AF05 8945F4                  mov dword ptr [ebp-0C], eax
:0046AF08 8B55F4                  mov edx, dword ptr [ebp-0C]
:0046AF0B 52                      push edx
:0046AF0C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046AF0F 81C17C020000            add ecx, 0000027C
:0046AF15 E8F078FFFF              call 0046280A
:0046AF1A 68B1050000              push 000005B1
:0046AF1F 8B45F0                  mov eax, dword ptr [ebp-10]
:0046AF22 8B08                    mov ecx, dword ptr [eax]
:0046AF24 51                      push ecx
:0046AF25 FF15DC624800            call dword ptr [004862DC]
:0046AF2B 8945F8                  mov dword ptr [ebp-08], eax
:0046AF2E 68EB030000              push 000003EB
:0046AF33 8B55F0                  mov edx, dword ptr [ebp-10]
:0046AF36 8B02                    mov eax, dword ptr [edx]
:0046AF38 50                      push eax
:0046AF39 FF15DC624800            call dword ptr [004862DC]
:0046AF3F 8945FC                  mov dword ptr [ebp-04], eax
:0046AF42 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0046AF45 51                      push ecx
:0046AF46 68606C4800              push 00486C60
:0046AF4B 8B55F4                  mov edx, dword ptr [ebp-0C]
:0046AF4E 52                      push edx
:0046AF4F E82D730000              call 00472281
:0046AF54 83C40C                  add esp, 0000000C
:0046AF57 6A00                    push 00000000
:0046AF59 6A00                    push 00000000
:0046AF5B 680C130000              push 0000130C
:0046AF60 8B45F4                  mov eax, dword ptr [ebp-0C]
:0046AF63 50                      push eax
:0046AF64 FF15F4624800            call dword ptr [004862F4]
:0046AF6A 8BE5                    mov esp, ebp
:0046AF6C 5D                      pop ebp
:0046AF6D C3                      ret



* Referenced by a CALL at Addresses:
|:0046AA8D   , :0046AD9E   
|
:0046AF6E 55                      push ebp
:0046AF6F 8BEC                    mov ebp, esp
:0046AF71 83EC08                  sub esp, 00000008
:0046AF74 894DFC                  mov dword ptr [ebp-04], ecx
:0046AF77 8B45FC                  mov eax, dword ptr [ebp-04]
:0046AF7A 33C9                    xor ecx, ecx
:0046AF7C 8A4808                  mov cl, byte ptr [eax+08]
:0046AF7F 8B5508                  mov edx, dword ptr [ebp+08]
:0046AF82 81E2FF000000            and edx, 000000FF
:0046AF88 3BCA                    cmp ecx, edx
:0046AF8A 741C                    je 0046AFA8
:0046AF8C 8B45FC                  mov eax, dword ptr [ebp-04]
:0046AF8F 8B08                    mov ecx, dword ptr [eax]
:0046AF91 51                      push ecx
:0046AF92 FF15C8624800            call dword ptr [004862C8]
:0046AF98 85C0                    test eax, eax
:0046AF9A 740C                    je 0046AFA8
:0046AF9C 6A00                    push 00000000
:0046AF9E B9B0694B00              mov ecx, 004B69B0
:0046AFA3 E805970000              call 004746AD

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046AF8A(C), :0046AF9A(C)
|
:0046AFA8 8A5508                  mov dl, byte ptr [ebp+08]
:0046AFAB 8855F8                  mov byte ptr [ebp-08], dl
:0046AFAE 807DF800                cmp byte ptr [ebp-08], 00
:0046AFB2 7408                    je 0046AFBC
:0046AFB4 807DF801                cmp byte ptr [ebp-08], 01
:0046AFB8 743F                    je 0046AFF9
:0046AFBA EB78                    jmp 0046B034

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046AFB2(C)
|
:0046AFBC 6A01                    push 00000001
:0046AFBE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046AFC1 81C1B0010000            add ecx, 000001B0
:0046AFC7 E811E9FFFF              call 004698DD
:0046AFCC 6A00                    push 00000000
:0046AFCE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046AFD1 81C1E0000000            add ecx, 000000E0
:0046AFD7 E8B47C0000              call 00472C90
:0046AFDC 50                      push eax
:0046AFDD FF15E0624800            call dword ptr [004862E0]
:0046AFE3 6A05                    push 00000005
:0046AFE5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046AFE8 83C10C                  add ecx, 0000000C
:0046AFEB E8A07C0000              call 00472C90
:0046AFF0 50                      push eax
:0046AFF1 FF15E0624800            call dword ptr [004862E0]
:0046AFF7 EB3B                    jmp 0046B034

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046AFB8(C)
|
:0046AFF9 6A00                    push 00000000
:0046AFFB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046AFFE 81C1B0010000            add ecx, 000001B0
:0046B004 E8D4E8FFFF              call 004698DD
:0046B009 6A00                    push 00000000
:0046B00B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046B00E 83C10C                  add ecx, 0000000C
:0046B011 E87A7C0000              call 00472C90
:0046B016 50                      push eax
:0046B017 FF15E0624800            call dword ptr [004862E0]
:0046B01D 6A05                    push 00000005
:0046B01F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046B022 81C1E0000000            add ecx, 000000E0
:0046B028 E8637C0000              call 00472C90
:0046B02D 50                      push eax
:0046B02E FF15E0624800            call dword ptr [004862E0]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046AFBA(U), :0046AFF7(U)
|
:0046B034 8B45FC                  mov eax, dword ptr [ebp-04]
:0046B037 8A4D08                  mov cl, byte ptr [ebp+08]
:0046B03A 884808                  mov byte ptr [eax+08], cl
:0046B03D 8BE5                    mov esp, ebp
:0046B03F 5D                      pop ebp
:0046B040 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0046B414   
|
:0046B043 55                      push ebp
:0046B044 8BEC                    mov ebp, esp
:0046B046 81EC90000000            sub esp, 00000090
:0046B04C 898D70FFFFFF            mov dword ptr [ebp+FFFFFF70], ecx
:0046B052 8B4508                  mov eax, dword ptr [ebp+08]
:0046B055 8A4802                  mov cl, byte ptr [eax+02]
:0046B058 51                      push ecx
:0046B059 8B5508                  mov edx, dword ptr [ebp+08]
:0046B05C 33C0                    xor eax, eax
:0046B05E 8A02                    mov al, byte ptr [edx]
:0046B060 8BC8                    mov ecx, eax
:0046B062 6BC919                  imul ecx, 00000019
:0046B065 81C140114A00            add ecx, 004A1140
:0046B06B E83917FAFF              call 0040C7A9
:0046B070 89857CFFFFFF            mov dword ptr [ebp+FFFFFF7C], eax
:0046B076 B970074B00              mov ecx, 004B0770
:0046B07B E85031FAFF              call 0040E1D0
:0046B080 898578FFFFFF            mov dword ptr [ebp+FFFFFF78], eax
:0046B086 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046B089 33D2                    xor edx, edx
:0046B08B 8A11                    mov dl, byte ptr [ecx]
:0046B08D 8BCA                    mov ecx, edx
:0046B08F 6BC919                  imul ecx, 00000019
:0046B092 81C140114A00            add ecx, 004A1140
:0046B098 E84D16FAFF              call 0040C6EA
:0046B09D 25FF000000              and eax, 000000FF
:0046B0A2 83F802                  cmp eax, 00000002
:0046B0A5 7533                    jne 0046B0DA
:0046B0A7 8B857CFFFFFF            mov eax, dword ptr [ebp+FFFFFF7C]
:0046B0AD 50                      push eax
:0046B0AE 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046B0B1 33D2                    xor edx, edx
:0046B0B3 8A11                    mov dl, byte ptr [ecx]
:0046B0B5 8BCA                    mov ecx, edx
:0046B0B7 6BC919                  imul ecx, 00000019
:0046B0BA 81C140114A00            add ecx, 004A1140
:0046B0C0 E84B46FFFF              call 0045F710
:0046B0C5 50                      push eax
:0046B0C6 68F86D4800              push 00486DF8
:0046B0CB 8D4580                  lea eax, dword ptr [ebp-80]
:0046B0CE 50                      push eax
:0046B0CF FF15C0624800            call dword ptr [004862C0]
:0046B0D5 83C410                  add esp, 00000010
:0046B0D8 EB3A                    jmp 0046B114

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046B0A5(C)
|
:0046B0DA 8B8D7CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF7C]
:0046B0E0 51                      push ecx
:0046B0E1 8B5508                  mov edx, dword ptr [ebp+08]
:0046B0E4 33C0                    xor eax, eax
:0046B0E6 8A02                    mov al, byte ptr [edx]
:0046B0E8 8BC8                    mov ecx, eax
:0046B0EA 6BC919                  imul ecx, 00000019
:0046B0ED 81C140114A00            add ecx, 004A1140
:0046B0F3 E81846FFFF              call 0045F710
:0046B0F8 50                      push eax
:0046B0F9 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046B0FC 33D2                    xor edx, edx
:0046B0FE 8A5102                  mov dl, byte ptr [ecx+02]
:0046B101 52                      push edx
:0046B102 68D86D4800              push 00486DD8
:0046B107 8D4580                  lea eax, dword ptr [ebp-80]
:0046B10A 50                      push eax
:0046B10B FF15C0624800            call dword ptr [004862C0]
:0046B111 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046B0D8(U)
|
:0046B114 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:0046B11A E8488DFFFF              call 00463E67
:0046B11F 6A02                    push 00000002
:0046B121 8D4D80                  lea ecx, dword ptr [ebp-80]
:0046B124 51                      push ecx
:0046B125 B970074B00              mov ecx, 004B0770
:0046B12A E86021FAFF              call 0040D28F
:0046B12F 8AC8                    mov cl, al
:0046B131 81E1FF000000            and ecx, 000000FF
:0046B137 6BC928                  imul ecx, 00000028
:0046B13A 81C168EB4A00            add ecx, 004AEB68
:0046B140 E82BF0FAFF              call 0041A170
:0046B145 50                      push eax
:0046B146 8B9570FFFFFF            mov edx, dword ptr [ebp+FFFFFF70]
:0046B14C 8B420C                  mov eax, dword ptr [edx+0C]
:0046B14F 50                      push eax
:0046B150 E84F280000              call 0046D9A4
:0046B155 83C410                  add esp, 00000010
:0046B158 85C0                    test eax, eax
:0046B15A 0F84B9010000            je 0046B319
:0046B160 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:0046B166 E8CB8DFFFF              call 00463F36
:0046B16B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046B16E 51                      push ecx
:0046B16F 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:0046B175 E8808CFFFF              call 00463DFA
:0046B17A 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:0046B180 E8488FFFFF              call 004640CD
:0046B185 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:0046B18B E8D78DFFFF              call 00463F67
:0046B190 8B957CFFFFFF            mov edx, dword ptr [ebp+FFFFFF7C]
:0046B196 52                      push edx
:0046B197 B970074B00              mov ecx, 004B0770
:0046B19C E84C2AFAFF              call 0040DBED
:0046B1A1 6A00                    push 00000000
:0046B1A3 B970074B00              mov ecx, 004B0770
:0046B1A8 E82330FAFF              call 0040E1D0
:0046B1AD 50                      push eax
:0046B1AE 6875040000              push 00000475
:0046B1B3 8B8570FFFFFF            mov eax, dword ptr [ebp+FFFFFF70]
:0046B1B9 8B480C                  mov ecx, dword ptr [eax+0C]
:0046B1BC 51                      push ecx
:0046B1BD FF15E4624800            call dword ptr [004862E4]
:0046B1C3 8B5508                  mov edx, dword ptr [ebp+08]
:0046B1C6 33C0                    xor eax, eax
:0046B1C8 8A4201                  mov al, byte ptr [edx+01]

* Possible Reference to Dialog: DialogID_00C8 
                                  |
:0046B1CB 3DC8000000              cmp eax, 000000C8
:0046B1D0 0F8D23010000            jnl 0046B2F9
:0046B1D6 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046B1D9 8A5101                  mov dl, byte ptr [ecx+01]
:0046B1DC 52                      push edx
:0046B1DD B970074B00              mov ecx, 004B0770
:0046B1E2 E83423FAFF              call 0040D51B
:0046B1E7 888574FFFFFF            mov byte ptr [ebp+FFFFFF74], al
:0046B1ED 8B8574FFFFFF            mov eax, dword ptr [ebp+FFFFFF74]
:0046B1F3 25FF000000              and eax, 000000FF
:0046B1F8 3DFF000000              cmp eax, 000000FF
:0046B1FD 0F84BD000000            je 0046B2C0
:0046B203 8B8D74FFFFFF            mov ecx, dword ptr [ebp+FFFFFF74]
:0046B209 81E1FF000000            and ecx, 000000FF
:0046B20F 6BC919                  imul ecx, 00000019
:0046B212 81C140114A00            add ecx, 004A1140
:0046B218 E8F344FFFF              call 0045F710
:0046B21D 50                      push eax
:0046B21E 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046B221 33D2                    xor edx, edx
:0046B223 8A11                    mov dl, byte ptr [ecx]
:0046B225 8BCA                    mov ecx, edx
:0046B227 6BC919                  imul ecx, 00000019
:0046B22A 81C140114A00            add ecx, 004A1140
:0046B230 E8DB44FFFF              call 0045F710
:0046B235 50                      push eax
:0046B236 8B4508                  mov eax, dword ptr [ebp+08]
:0046B239 33C9                    xor ecx, ecx
:0046B23B 8A4802                  mov cl, byte ptr [eax+02]
:0046B23E 51                      push ecx
:0046B23F 68406E4800              push 00486E40
:0046B244 8D5580                  lea edx, dword ptr [ebp-80]
:0046B247 52                      push edx
:0046B248 FF15C0624800            call dword ptr [004862C0]
:0046B24E 83C414                  add esp, 00000014
:0046B251 6A00                    push 00000000
:0046B253 8D4580                  lea eax, dword ptr [ebp-80]
:0046B256 50                      push eax
:0046B257 B970074B00              mov ecx, 004B0770
:0046B25C E82E20FAFF              call 0040D28F
:0046B261 8AC8                    mov cl, al
:0046B263 81E1FF000000            and ecx, 000000FF
:0046B269 6BC928                  imul ecx, 00000028
:0046B26C 81C168EB4A00            add ecx, 004AEB68
:0046B272 E8F9EEFAFF              call 0041A170
:0046B277 50                      push eax
:0046B278 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:0046B27E 8B510C                  mov edx, dword ptr [ecx+0C]
:0046B281 52                      push edx
:0046B282 E81D270000              call 0046D9A4
:0046B287 83C410                  add esp, 00000010
:0046B28A 8A8574FFFFFF            mov al, byte ptr [ebp+FFFFFF74]
:0046B290 50                      push eax
:0046B291 B970074B00              mov ecx, 004B0770
:0046B296 E8AA27FAFF              call 0040DA45
:0046B29B 25FF000000              and eax, 000000FF
:0046B2A0 83F801                  cmp eax, 00000001
:0046B2A3 751B                    jne 0046B2C0
:0046B2A5 8B8D74FFFFFF            mov ecx, dword ptr [ebp+FFFFFF74]
:0046B2AB 81E1FF000000            and ecx, 000000FF
:0046B2B1 51                      push ecx
:0046B2B2 8B9570FFFFFF            mov edx, dword ptr [ebp+FFFFFF70]
:0046B2B8 8B4A50                  mov ecx, dword ptr [edx+50]
:0046B2BB E8F6030000              call 0046B6B6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046B1FD(C), :0046B2A3(C)
|
:0046B2C0 8B4508                  mov eax, dword ptr [ebp+08]
:0046B2C3 33C9                    xor ecx, ecx
:0046B2C5 8A4801                  mov cl, byte ptr [eax+01]
:0046B2C8 8B9570FFFFFF            mov edx, dword ptr [ebp+FFFFFF70]
:0046B2CE C644CA54FF              mov [edx+8*ecx+54], FF
:0046B2D3 8B4508                  mov eax, dword ptr [ebp+08]
:0046B2D6 33C9                    xor ecx, ecx
:0046B2D8 8A4801                  mov cl, byte ptr [eax+01]
:0046B2DB 8B9570FFFFFF            mov edx, dword ptr [ebp+FFFFFF70]
:0046B2E1 C644CA5600              mov [edx+8*ecx+56], 00
:0046B2E6 8B4508                  mov eax, dword ptr [ebp+08]
:0046B2E9 33C9                    xor ecx, ecx
:0046B2EB 8A4801                  mov cl, byte ptr [eax+01]
:0046B2EE 8B9570FFFFFF            mov edx, dword ptr [ebp+FFFFFF70]
:0046B2F4 C644CA5700              mov [edx+8*ecx+57], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046B1D0(C)
|
:0046B2F9 8B4508                  mov eax, dword ptr [ebp+08]
:0046B2FC 33C9                    xor ecx, ecx
:0046B2FE 8A4801                  mov cl, byte ptr [eax+01]
:0046B301 51                      push ecx
:0046B302 6A00                    push 00000000
:0046B304 6805040000              push 00000405
:0046B309 8B9570FFFFFF            mov edx, dword ptr [ebp+FFFFFF70]
:0046B30F 8B420C                  mov eax, dword ptr [edx+0C]
:0046B312 50                      push eax
:0046B313 FF1518634800            call dword ptr [00486318]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046B15A(C)
|
:0046B319 8B8D70FFFFFF            mov ecx, dword ptr [ebp+FFFFFF70]
:0046B31F E8718BFFFF              call 00463E95
:0046B324 8BE5                    mov esp, ebp
:0046B326 5D                      pop ebp
:0046B327 C20400                  ret 0004


:0046B32A 55                      push ebp
:0046B32B 8BEC                    mov ebp, esp
:0046B32D 83EC20                  sub esp, 00000020
:0046B330 894DE0                  mov dword ptr [ebp-20], ecx
:0046B333 8B45E0                  mov eax, dword ptr [ebp-20]
:0046B336 33C9                    xor ecx, ecx
:0046B338 8A4814                  mov cl, byte ptr [eax+14]
:0046B33B 85C9                    test ecx, ecx
:0046B33D 7548                    jne 0046B387
:0046B33F C745E400000000          mov [ebp-1C], 00000000
:0046B346 C745E803000000          mov [ebp-18], 00000003
:0046B34D C745EC01000000          mov [ebp-14], 00000001
:0046B354 C745F002000000          mov [ebp-10], 00000002
:0046B35B C745F405000000          mov [ebp-0C], 00000005
:0046B362 C745F809000000          mov [ebp-08], 00000009
:0046B369 C645FC06                mov [ebp-04], 06
:0046B36D 8D55E4                  lea edx, dword ptr [ebp-1C]
:0046B370 52                      push edx
:0046B371 8A45FC                  mov al, byte ptr [ebp-04]
:0046B374 50                      push eax
:0046B375 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0046B378 E87E89FFFF              call 00463CFB
:0046B37D 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0046B380 E86AC3FFFF              call 004676EF
:0046B385 EB16                    jmp 0046B39D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046B33D(C)
|
:0046B387 6A00                    push 00000000
:0046B389 6A00                    push 00000000
:0046B38B 6809100000              push 00001009
:0046B390 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0046B393 8B5110                  mov edx, dword ptr [ecx+10]
:0046B396 52                      push edx
:0046B397 FF15F4624800            call dword ptr [004862F4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046B385(U)
|
:0046B39D 6A01                    push 00000001
:0046B39F 6A00                    push 00000000
:0046B3A1 68FF000000              push 000000FF
:0046B3A6 8B45E0                  mov eax, dword ptr [ebp-20]
:0046B3A9 83C054                  add eax, 00000054
:0046B3AC 50                      push eax
:0046B3AD 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0046B3B0 E8C8B3FFFF              call 0046677D
:0046B3B5 6A00                    push 00000000
:0046B3B7 6A00                    push 00000000
:0046B3B9 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0046B3BC E86A99FFFF              call 00464D2B
:0046B3C1 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0046B3C4 E8048DFFFF              call 004640CD
:0046B3C9 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0046B3CC 8B5110                  mov edx, dword ptr [ecx+10]
:0046B3CF 52                      push edx
:0046B3D0 FF151C634800            call dword ptr [0048631C]
:0046B3D6 8BE5                    mov esp, ebp
:0046B3D8 5D                      pop ebp
:0046B3D9 C3                      ret


:0046B3DA 55                      push ebp
:0046B3DB 8BEC                    mov ebp, esp
:0046B3DD 83EC08                  sub esp, 00000008
:0046B3E0 894DF8                  mov dword ptr [ebp-08], ecx
:0046B3E3 8B4508                  mov eax, dword ptr [ebp+08]
:0046B3E6 50                      push eax
:0046B3E7 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046B3EA E8AD8BFFFF              call 00463F9C
:0046B3EF 8945FC                  mov dword ptr [ebp-04], eax
:0046B3F2 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046B3F5 51                      push ecx
:0046B3F6 8B55F8                  mov edx, dword ptr [ebp-08]
:0046B3F9 8B02                    mov eax, dword ptr [edx]
:0046B3FB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046B3FE FF5020                  call [eax+20]
:0046B401 85C0                    test eax, eax
:0046B403 7414                    je 0046B419
:0046B405 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046B408 E8859FFFFF              call 00465392
:0046B40D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046B410 51                      push ecx
:0046B411 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046B414 E82AFCFFFF              call 0046B043

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046B403(C)
|
:0046B419 8BE5                    mov esp, ebp
:0046B41B 5D                      pop ebp
:0046B41C C20400                  ret 0004


:0046B41F 55                      push ebp
:0046B420 8BEC                    mov ebp, esp
:0046B422 83EC0C                  sub esp, 0000000C
:0046B425 894DF8                  mov dword ptr [ebp-08], ecx
:0046B428 8B4508                  mov eax, dword ptr [ebp+08]
:0046B42B 50                      push eax
:0046B42C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046B42F E8688BFFFF              call 00463F9C
:0046B434 8945FC                  mov dword ptr [ebp-04], eax
:0046B437 837D0800                cmp dword ptr [ebp+08], 00000000
:0046B43B 7C2C                    jl 0046B469
:0046B43D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046B440 8A5102                  mov dl, byte ptr [ecx+02]
:0046B443 52                      push edx
:0046B444 8B45FC                  mov eax, dword ptr [ebp-04]
:0046B447 33C9                    xor ecx, ecx
:0046B449 8A08                    mov cl, byte ptr [eax]
:0046B44B 6BC919                  imul ecx, 00000019
:0046B44E 81C140114A00            add ecx, 004A1140
:0046B454 E85013FAFF              call 0040C7A9
:0046B459 3DFFFF0000              cmp eax, 0000FFFF
:0046B45E 7409                    je 0046B469
:0046B460 C745F401000000          mov [ebp-0C], 00000001
:0046B467 EB07                    jmp 0046B470

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046B43B(C), :0046B45E(C)
|
:0046B469 C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046B467(U)
|
:0046B470 8B45F4                  mov eax, dword ptr [ebp-0C]
:0046B473 8BE5                    mov esp, ebp
:0046B475 5D                      pop ebp
:0046B476 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0046B6AB   
|
:0046B479 55                      push ebp
:0046B47A 8BEC                    mov ebp, esp
:0046B47C 6AFF                    push FFFFFFFF
:0046B47E 68E3584800              push 004858E3
:0046B483 64A100000000            mov eax, dword ptr fs:[00000000]
:0046B489 50                      push eax
:0046B48A 64892500000000          mov dword ptr fs:[00000000], esp
:0046B491 83EC68                  sub esp, 00000068
:0046B494 894D8C                  mov dword ptr [ebp-74], ecx
:0046B497 6A00                    push 00000000
:0046B499 8B4508                  mov eax, dword ptr [ebp+08]
:0046B49C 33C9                    xor ecx, ecx
:0046B49E 8A08                    mov cl, byte ptr [eax]
:0046B4A0 6BC919                  imul ecx, 00000019
:0046B4A3 81C140114A00            add ecx, 004A1140
:0046B4A9 E8FB12FAFF              call 0040C7A9
:0046B4AE 894598                  mov dword ptr [ebp-68], eax
:0046B4B1 B970074B00              mov ecx, 004B0770
:0046B4B6 E8152DFAFF              call 0040E1D0
:0046B4BB 894594                  mov dword ptr [ebp-6C], eax
:0046B4BE 8B5508                  mov edx, dword ptr [ebp+08]
:0046B4C1 8A02                    mov al, byte ptr [edx]
:0046B4C3 50                      push eax
:0046B4C4 B970074B00              mov ecx, 004B0770
:0046B4C9 E87026FAFF              call 0040DB3E
:0046B4CE 88459C                  mov byte ptr [ebp-64], al
:0046B4D1 8D4DA4                  lea ecx, dword ptr [ebp-5C]
:0046B4D4 E877790000              call 00472E50
:0046B4D9 C745FC00000000          mov [ebp-04], 00000000
:0046B4E0 8B4D8C                  mov ecx, dword ptr [ebp-74]
:0046B4E3 E87F89FFFF              call 00463E67
:0046B4E8 6A00                    push 00000000
:0046B4EA 8A4D9C                  mov cl, byte ptr [ebp-64]
:0046B4ED 51                      push ecx
:0046B4EE 8B5508                  mov edx, dword ptr [ebp+08]
:0046B4F1 33C0                    xor eax, eax
:0046B4F3 8A02                    mov al, byte ptr [edx]
:0046B4F5 50                      push eax
:0046B4F6 8B4D8C                  mov ecx, dword ptr [ebp-74]
:0046B4F9 8B510C                  mov edx, dword ptr [ecx+0C]
:0046B4FC 52                      push edx
:0046B4FD 8D4DA4                  lea ecx, dword ptr [ebp-5C]
:0046B500 E852280000              call 0046DD57
:0046B505 8945A0                  mov dword ptr [ebp-60], eax
:0046B508 8B4D8C                  mov ecx, dword ptr [ebp-74]
:0046B50B E88589FFFF              call 00463E95
:0046B510 837DA000                cmp dword ptr [ebp-60], 00000000
:0046B514 0F8EA7000000            jle 0046B5C1
:0046B51A 8B4508                  mov eax, dword ptr [ebp+08]
:0046B51D 8A08                    mov cl, byte ptr [eax]
:0046B51F 51                      push ecx
:0046B520 B970074B00              mov ecx, 004B0770
:0046B525 E81426FAFF              call 0040DB3E
:0046B52A 884590                  mov byte ptr [ebp-70], al
:0046B52D 8B5590                  mov edx, dword ptr [ebp-70]
:0046B530 81E2FF000000            and edx, 000000FF
:0046B536 2B55A0                  sub edx, dword ptr [ebp-60]
:0046B539 52                      push edx
:0046B53A 8B4508                  mov eax, dword ptr [ebp+08]
:0046B53D 8A08                    mov cl, byte ptr [eax]
:0046B53F 51                      push ecx
:0046B540 B970074B00              mov ecx, 004B0770
:0046B545 E8B125FAFF              call 0040DAFB
:0046B54A 8B5590                  mov edx, dword ptr [ebp-70]
:0046B54D 81E2FF000000            and edx, 000000FF
:0046B553 3B55A0                  cmp edx, dword ptr [ebp-60]
:0046B556 7F26                    jg 0046B57E
:0046B558 8B4D8C                  mov ecx, dword ptr [ebp-74]
:0046B55B E8D689FFFF              call 00463F36
:0046B560 8B4508                  mov eax, dword ptr [ebp+08]
:0046B563 50                      push eax
:0046B564 8B4D8C                  mov ecx, dword ptr [ebp-74]
:0046B567 E88E88FFFF              call 00463DFA
:0046B56C 8B4D8C                  mov ecx, dword ptr [ebp-74]
:0046B56F E8598BFFFF              call 004640CD
:0046B574 8B4D8C                  mov ecx, dword ptr [ebp-74]
:0046B577 E8EB89FFFF              call 00463F67
:0046B57C EB0C                    jmp 0046B58A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046B556(C)
|
:0046B57E 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046B581 51                      push ecx
:0046B582 8B4D8C                  mov ecx, dword ptr [ebp-74]
:0046B585 E8D68AFFFF              call 00464060

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046B57C(U)
|
:0046B58A 8B5598                  mov edx, dword ptr [ebp-68]
:0046B58D 0FAF55A0                imul edx, dword ptr [ebp-60]
:0046B591 895598                  mov dword ptr [ebp-68], edx
:0046B594 8B4598                  mov eax, dword ptr [ebp-68]
:0046B597 50                      push eax
:0046B598 B970074B00              mov ecx, 004B0770
:0046B59D E84B26FAFF              call 0040DBED
:0046B5A2 6A00                    push 00000000
:0046B5A4 B970074B00              mov ecx, 004B0770
:0046B5A9 E8222CFAFF              call 0040E1D0
:0046B5AE 50                      push eax
:0046B5AF 6875040000              push 00000475
:0046B5B4 8B4D8C                  mov ecx, dword ptr [ebp-74]
:0046B5B7 8B510C                  mov edx, dword ptr [ecx+0C]
:0046B5BA 52                      push edx
:0046B5BB FF15E4624800            call dword ptr [004862E4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046B514(C)
|
:0046B5C1 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0046B5C8 8D4DA4                  lea ecx, dword ptr [ebp-5C]
:0046B5CB E820790000              call 00472EF0
:0046B5D0 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046B5D3 64890D00000000          mov dword ptr fs:[00000000], ecx
:0046B5DA 8BE5                    mov esp, ebp
:0046B5DC 5D                      pop ebp
:0046B5DD C20400                  ret 0004


:0046B5E0 55                      push ebp
:0046B5E1 8BEC                    mov ebp, esp
:0046B5E3 83EC1C                  sub esp, 0000001C
:0046B5E6 894DE4                  mov dword ptr [ebp-1C], ecx
:0046B5E9 8B45E4                  mov eax, dword ptr [ebp-1C]
:0046B5EC 33C9                    xor ecx, ecx
:0046B5EE 8A4814                  mov cl, byte ptr [eax+14]
:0046B5F1 85C9                    test ecx, ecx
:0046B5F3 7541                    jne 0046B636
:0046B5F5 C745E800000000          mov [ebp-18], 00000000
:0046B5FC C745EC04000000          mov [ebp-14], 00000004
:0046B603 C745F005000000          mov [ebp-10], 00000005
:0046B60A C745F40B000000          mov [ebp-0C], 0000000B
:0046B611 C745F809000000          mov [ebp-08], 00000009
:0046B618 C645FC05                mov [ebp-04], 05
:0046B61C 8D55E8                  lea edx, dword ptr [ebp-18]
:0046B61F 52                      push edx
:0046B620 8A45FC                  mov al, byte ptr [ebp-04]
:0046B623 50                      push eax
:0046B624 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0046B627 E8CF86FFFF              call 00463CFB
:0046B62C 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0046B62F E8BBC0FFFF              call 004676EF
:0046B634 EB16                    jmp 0046B64C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046B5F3(C)
|
:0046B636 6A00                    push 00000000
:0046B638 6A00                    push 00000000
:0046B63A 6809100000              push 00001009
:0046B63F 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0046B642 8B5110                  mov edx, dword ptr [ecx+10]
:0046B645 52                      push edx
:0046B646 FF15F4624800            call dword ptr [004862F4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046B634(U)
|
:0046B64C 8B45E4                  mov eax, dword ptr [ebp-1C]
:0046B64F 83C050                  add eax, 00000050
:0046B652 50                      push eax
:0046B653 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0046B656 E818B4FFFF              call 00466A73
:0046B65B 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0046B65E C7411C00000000          mov [ecx+1C], 00000000
:0046B665 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0046B668 E8608AFFFF              call 004640CD
:0046B66D 8BE5                    mov esp, ebp
:0046B66F 5D                      pop ebp
:0046B670 C3                      ret


:0046B671 55                      push ebp
:0046B672 8BEC                    mov ebp, esp
:0046B674 83EC08                  sub esp, 00000008
:0046B677 894DF8                  mov dword ptr [ebp-08], ecx
:0046B67A 8B4508                  mov eax, dword ptr [ebp+08]
:0046B67D 50                      push eax
:0046B67E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046B681 E81689FFFF              call 00463F9C
:0046B686 8945FC                  mov dword ptr [ebp-04], eax
:0046B689 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046B68C 51                      push ecx
:0046B68D 8B55F8                  mov edx, dword ptr [ebp-08]
:0046B690 8B02                    mov eax, dword ptr [edx]
:0046B692 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046B695 FF5020                  call [eax+20]
:0046B698 85C0                    test eax, eax
:0046B69A 7414                    je 0046B6B0
:0046B69C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046B69F E8EE9CFFFF              call 00465392
:0046B6A4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046B6A7 51                      push ecx
:0046B6A8 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046B6AB E8C9FDFFFF              call 0046B479

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046B69A(C)
|
:0046B6B0 8BE5                    mov esp, ebp
:0046B6B2 5D                      pop ebp
:0046B6B3 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0046B2BB   
|
:0046B6B6 55                      push ebp
:0046B6B7 8BEC                    mov ebp, esp
:0046B6B9 83EC08                  sub esp, 00000008
:0046B6BC 894DF8                  mov dword ptr [ebp-08], ecx
:0046B6BF 8B4508                  mov eax, dword ptr [ebp+08]
:0046B6C2 83E857                  sub eax, 00000057
:0046B6C5 8845FC                  mov byte ptr [ebp-04], al
:0046B6C8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046B6CB 81E1FF000000            and ecx, 000000FF
:0046B6D1 8B55F8                  mov edx, dword ptr [ebp-08]
:0046B6D4 8A4508                  mov al, byte ptr [ebp+08]
:0046B6D7 8844CA50                mov byte ptr [edx+8*ecx+50], al
:0046B6DB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046B6DE 81E1FF000000            and ecx, 000000FF
:0046B6E4 8B55F8                  mov edx, dword ptr [ebp-08]
:0046B6E7 8A45FC                  mov al, byte ptr [ebp-04]
:0046B6EA 8844CA51                mov byte ptr [edx+8*ecx+51], al
:0046B6EE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046B6F1 81E1FF000000            and ecx, 000000FF
:0046B6F7 8B55F8                  mov edx, dword ptr [ebp-08]
:0046B6FA C644CA5200              mov [edx+8*ecx+52], 00
:0046B6FF 8B45FC                  mov eax, dword ptr [ebp-04]
:0046B702 25FF000000              and eax, 000000FF
:0046B707 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046B70A C644C15300              mov [ecx+8*eax+53], 00
:0046B70F 8B55FC                  mov edx, dword ptr [ebp-04]
:0046B712 81E2FF000000            and edx, 000000FF
:0046B718 8B45F8                  mov eax, dword ptr [ebp-08]
:0046B71B C744D05401000000        mov [eax+8*edx+54], 00000001
:0046B723 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046B726 81E1FF000000            and ecx, 000000FF
:0046B72C 8B55F8                  mov edx, dword ptr [ebp-08]
:0046B72F 8D44CA50                lea eax, dword ptr [edx+8*ecx+50]
:0046B733 50                      push eax
:0046B734 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046B737 E844790000              call 00473080
:0046B73C 8BE5                    mov esp, ebp
:0046B73E 5D                      pop ebp
:0046B73F C20400                  ret 0004


:0046B742 55                      push ebp
:0046B743 8BEC                    mov ebp, esp
:0046B745 83EC0C                  sub esp, 0000000C
:0046B748 894DF8                  mov dword ptr [ebp-08], ecx
:0046B74B 8B4508                  mov eax, dword ptr [ebp+08]
:0046B74E 50                      push eax
:0046B74F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046B752 E84588FFFF              call 00463F9C
:0046B757 8945FC                  mov dword ptr [ebp-04], eax
:0046B75A 837D0800                cmp dword ptr [ebp+08], 00000000
:0046B75E 7C29                    jl 0046B789
:0046B760 6A00                    push 00000000
:0046B762 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046B765 33D2                    xor edx, edx
:0046B767 8A11                    mov dl, byte ptr [ecx]
:0046B769 8BCA                    mov ecx, edx
:0046B76B 6BC919                  imul ecx, 00000019
:0046B76E 81C140114A00            add ecx, 004A1140
:0046B774 E83010FAFF              call 0040C7A9
:0046B779 3DFFFF0000              cmp eax, 0000FFFF
:0046B77E 7409                    je 0046B789
:0046B780 C745F401000000          mov [ebp-0C], 00000001
:0046B787 EB07                    jmp 0046B790

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046B75E(C), :0046B77E(C)
|
:0046B789 C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046B787(U)
|
:0046B790 8B45F4                  mov eax, dword ptr [ebp-0C]
:0046B793 8BE5                    mov esp, ebp
:0046B795 5D                      pop ebp
:0046B796 C20400                  ret 0004



* Referenced by a CALL at Address:
|:00461DB7   
|
:0046B799 55                      push ebp
:0046B79A 8BEC                    mov ebp, esp
:0046B79C 51                      push ecx
:0046B79D 894DFC                  mov dword ptr [ebp-04], ecx
:0046B7A0 8B45FC                  mov eax, dword ptr [ebp-04]
:0046B7A3 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046B7A6 894804                  mov dword ptr [eax+04], ecx
:0046B7A9 8B55FC                  mov edx, dword ptr [ebp-04]
:0046B7AC 52                      push edx

* Possible StringData Ref from Code Obj ->"U}"
                                  |
:0046B7AD 68A9CE4600              push 0046CEA9
:0046B7B2 8B45FC                  mov eax, dword ptr [ebp-04]
:0046B7B5 8B4804                  mov ecx, dword ptr [eax+04]
:0046B7B8 51                      push ecx

* Possible Reference to Dialog: DialogID_0149 
                                  |
:0046B7B9 6849010000              push 00000149
:0046B7BE 8B5508                  mov edx, dword ptr [ebp+08]
:0046B7C1 52                      push edx
:0046B7C2 FF15A0624800            call dword ptr [004862A0]
:0046B7C8 8BE5                    mov esp, ebp
:0046B7CA 5D                      pop ebp
:0046B7CB C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0046CEEA   , :0046CF29   
|
:0046B7CE 55                      push ebp
:0046B7CF 8BEC                    mov ebp, esp
:0046B7D1 83EC18                  sub esp, 00000018
:0046B7D4 894DF4                  mov dword ptr [ebp-0C], ecx
:0046B7D7 817D0C10010000          cmp dword ptr [ebp+0C], 00000110
:0046B7DE 7573                    jne 0046B853
:0046B7E0 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046B7E3 E849010000              call 0046B931
:0046B7E8 68B1050000              push 000005B1
:0046B7ED 8B4510                  mov eax, dword ptr [ebp+10]
:0046B7F0 50                      push eax
:0046B7F1 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046B7F4 51                      push ecx
:0046B7F5 8B5508                  mov edx, dword ptr [ebp+08]
:0046B7F8 52                      push edx
:0046B7F9 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046B7FC 83C10C                  add ecx, 0000000C
:0046B7FF 8B45F4                  mov eax, dword ptr [ebp-0C]
:0046B802 8B500C                  mov edx, dword ptr [eax+0C]
:0046B805 FF5224                  call [edx+24]
:0046B808 68EB030000              push 000003EB
:0046B80D 8B4510                  mov eax, dword ptr [ebp+10]
:0046B810 50                      push eax
:0046B811 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046B814 51                      push ecx
:0046B815 8B5508                  mov edx, dword ptr [ebp+08]
:0046B818 52                      push edx
:0046B819 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046B81C 81C1A0060000            add ecx, 000006A0
:0046B822 8B45F4                  mov eax, dword ptr [ebp-0C]
:0046B825 8B90A0060000            mov edx, dword ptr [eax+000006A0]
:0046B82B FF5224                  call [edx+24]
:0046B82E 8B45F4                  mov eax, dword ptr [ebp-0C]
:0046B831 05A0060000              add eax, 000006A0
:0046B836 50                      push eax
:0046B837 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046B83A 83C10C                  add ecx, 0000000C
:0046B83D E8EE710000              call 00472A30
:0046B842 6A00                    push 00000000
:0046B844 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046B847 E890010000              call 0046B9DC
:0046B84C 33C0                    xor eax, eax
:0046B84E E9D8000000              jmp 0046B92B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046B7DE(C)
|
:0046B853 8B4D14                  mov ecx, dword ptr [ebp+14]
:0046B856 51                      push ecx
:0046B857 8B5510                  mov edx, dword ptr [ebp+10]
:0046B85A 52                      push edx
:0046B85B 8B450C                  mov eax, dword ptr [ebp+0C]
:0046B85E 50                      push eax
:0046B85F 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046B862 51                      push ecx
:0046B863 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046B866 83C10C                  add ecx, 0000000C
:0046B869 8B55F4                  mov edx, dword ptr [ebp-0C]
:0046B86C 8B420C                  mov eax, dword ptr [edx+0C]
:0046B86F FF5024                  call [eax+24]
:0046B872 85C0                    test eax, eax
:0046B874 740A                    je 0046B880
:0046B876 B801000000              mov eax, 00000001
:0046B87B E9AB000000              jmp 0046B92B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046B874(C)
|
:0046B880 8B4D14                  mov ecx, dword ptr [ebp+14]
:0046B883 51                      push ecx
:0046B884 8B5510                  mov edx, dword ptr [ebp+10]
:0046B887 52                      push edx
:0046B888 8B450C                  mov eax, dword ptr [ebp+0C]
:0046B88B 50                      push eax
:0046B88C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046B88F 51                      push ecx
:0046B890 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046B893 81C1A0060000            add ecx, 000006A0
:0046B899 8B55F4                  mov edx, dword ptr [ebp-0C]
:0046B89C 8B82A0060000            mov eax, dword ptr [edx+000006A0]
:0046B8A2 FF5024                  call [eax+24]
:0046B8A5 85C0                    test eax, eax
:0046B8A7 7407                    je 0046B8B0
:0046B8A9 B801000000              mov eax, 00000001
:0046B8AE EB7B                    jmp 0046B92B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046B8A7(C)
|
:0046B8B0 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046B8B3 894DF0                  mov dword ptr [ebp-10], ecx
:0046B8B6 837DF04E                cmp dword ptr [ebp-10], 0000004E
:0046B8BA 742F                    je 0046B8EB
:0046B8BC 817DF011010000          cmp dword ptr [ebp-10], 00000111
:0046B8C3 7402                    je 0046B8C7
:0046B8C5 EB62                    jmp 0046B929

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046B8C3(C)
|
:0046B8C7 8B5510                  mov edx, dword ptr [ebp+10]
:0046B8CA 81E2FFFF0000            and edx, 0000FFFF
:0046B8D0 8955EC                  mov dword ptr [ebp-14], edx
:0046B8D3 837DEC02                cmp dword ptr [ebp-14], 00000002
:0046B8D7 7402                    je 0046B8DB
:0046B8D9 EB0E                    jmp 0046B8E9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046B8D7(C)
|
:0046B8DB 6A00                    push 00000000
:0046B8DD 8B45F4                  mov eax, dword ptr [ebp-0C]
:0046B8E0 8B08                    mov ecx, dword ptr [eax]
:0046B8E2 51                      push ecx
:0046B8E3 FF15D4624800            call dword ptr [004862D4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046B8D9(U)
|
:0046B8E9 EB3E                    jmp 0046B929

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046B8BA(C)
|
:0046B8EB 8B5514                  mov edx, dword ptr [ebp+14]
:0046B8EE 8955FC                  mov dword ptr [ebp-04], edx
:0046B8F1 8B45FC                  mov eax, dword ptr [ebp-04]
:0046B8F4 8B4808                  mov ecx, dword ptr [eax+08]
:0046B8F7 894DE8                  mov dword ptr [ebp-18], ecx
:0046B8FA 817DE8D9FDFFFF          cmp dword ptr [ebp-18], FFFFFDD9
:0046B901 7402                    je 0046B905
:0046B903 EB24                    jmp 0046B929

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046B901(C)
|
:0046B905 6A00                    push 00000000
:0046B907 6A00                    push 00000000
:0046B909 680B130000              push 0000130B
:0046B90E 8B55FC                  mov edx, dword ptr [ebp-04]
:0046B911 8B02                    mov eax, dword ptr [edx]
:0046B913 50                      push eax
:0046B914 FF15F4624800            call dword ptr [004862F4]
:0046B91A 8845F8                  mov byte ptr [ebp-08], al
:0046B91D 8A4DF8                  mov cl, byte ptr [ebp-08]
:0046B920 51                      push ecx
:0046B921 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046B924 E8B3000000              call 0046B9DC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046B8C5(U), :0046B8E9(U), :0046B903(U)
|
:0046B929 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046B84E(U), :0046B87B(U), :0046B8AE(U)
|
:0046B92B 8BE5                    mov esp, ebp
:0046B92D 5D                      pop ebp
:0046B92E C21000                  ret 0010



* Referenced by a CALL at Address:
|:0046B7E3   
|
:0046B931 55                      push ebp
:0046B932 8BEC                    mov ebp, esp
:0046B934 83EC0C                  sub esp, 0000000C
:0046B937 894DF4                  mov dword ptr [ebp-0C], ecx
:0046B93A 8B45F4                  mov eax, dword ptr [ebp-0C]
:0046B93D 8B4804                  mov ecx, dword ptr [eax+04]
:0046B940 51                      push ecx
:0046B941 8B55F4                  mov edx, dword ptr [ebp-0C]
:0046B944 8B02                    mov eax, dword ptr [edx]
:0046B946 50                      push eax
:0046B947 E85A6AFFFF              call 004623A6
:0046B94C 83C408                  add esp, 00000008
:0046B94F 6A00                    push 00000000
:0046B951 B970074B00              mov ecx, 004B0770
:0046B956 E87528FAFF              call 0040E1D0
:0046B95B 50                      push eax
:0046B95C 6875040000              push 00000475
:0046B961 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046B964 8B11                    mov edx, dword ptr [ecx]
:0046B966 52                      push edx
:0046B967 FF15E4624800            call dword ptr [004862E4]
:0046B96D 686E050000              push 0000056E
:0046B972 8B45F4                  mov eax, dword ptr [ebp-0C]
:0046B975 8B08                    mov ecx, dword ptr [eax]
:0046B977 51                      push ecx
:0046B978 FF15DC624800            call dword ptr [004862DC]
:0046B97E 50                      push eax
:0046B97F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046B982 81C178070000            add ecx, 00000778
:0046B988 E87D6EFFFF              call 0046280A
:0046B98D 68B1050000              push 000005B1
:0046B992 8B55F4                  mov edx, dword ptr [ebp-0C]
:0046B995 8B02                    mov eax, dword ptr [edx]
:0046B997 50                      push eax
:0046B998 FF15DC624800            call dword ptr [004862DC]
:0046B99E 8945F8                  mov dword ptr [ebp-08], eax
:0046B9A1 68EB030000              push 000003EB
:0046B9A6 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046B9A9 8B11                    mov edx, dword ptr [ecx]
:0046B9AB 52                      push edx
:0046B9AC FF15DC624800            call dword ptr [004862DC]
:0046B9B2 8945FC                  mov dword ptr [ebp-04], eax
:0046B9B5 8D45F8                  lea eax, dword ptr [ebp-08]
:0046B9B8 50                      push eax
:0046B9B9 68786C4800              push 00486C78
:0046B9BE 686E050000              push 0000056E
:0046B9C3 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046B9C6 8B11                    mov edx, dword ptr [ecx]
:0046B9C8 52                      push edx
:0046B9C9 FF15DC624800            call dword ptr [004862DC]
:0046B9CF 50                      push eax
:0046B9D0 E8AC680000              call 00472281
:0046B9D5 83C40C                  add esp, 0000000C
:0046B9D8 8BE5                    mov esp, ebp
:0046B9DA 5D                      pop ebp
:0046B9DB C3                      ret



* Referenced by a CALL at Addresses:
|:0046B847   , :0046B924   
|
:0046B9DC 55                      push ebp
:0046B9DD 8BEC                    mov ebp, esp
:0046B9DF 83EC08                  sub esp, 00000008
:0046B9E2 894DFC                  mov dword ptr [ebp-04], ecx
:0046B9E5 8B45FC                  mov eax, dword ptr [ebp-04]
:0046B9E8 33C9                    xor ecx, ecx
:0046B9EA 8A4808                  mov cl, byte ptr [eax+08]
:0046B9ED 8B5508                  mov edx, dword ptr [ebp+08]
:0046B9F0 81E2FF000000            and edx, 000000FF
:0046B9F6 3BCA                    cmp ecx, edx
:0046B9F8 741C                    je 0046BA16
:0046B9FA 8B45FC                  mov eax, dword ptr [ebp-04]
:0046B9FD 8B08                    mov ecx, dword ptr [eax]
:0046B9FF 51                      push ecx
:0046BA00 FF15C8624800            call dword ptr [004862C8]
:0046BA06 85C0                    test eax, eax
:0046BA08 740C                    je 0046BA16
:0046BA0A 6A00                    push 00000000
:0046BA0C B9B0694B00              mov ecx, 004B69B0
:0046BA11 E8978C0000              call 004746AD

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046B9F8(C), :0046BA08(C)
|
:0046BA16 8A5508                  mov dl, byte ptr [ebp+08]
:0046BA19 8855F8                  mov byte ptr [ebp-08], dl
:0046BA1C 807DF800                cmp byte ptr [ebp-08], 00
:0046BA20 7408                    je 0046BA2A
:0046BA22 807DF801                cmp byte ptr [ebp-08], 01
:0046BA26 742F                    je 0046BA57
:0046BA28 EB58                    jmp 0046BA82

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046BA20(C)
|
:0046BA2A 6A00                    push 00000000
:0046BA2C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046BA2F 81C1A0060000            add ecx, 000006A0
:0046BA35 E856720000              call 00472C90
:0046BA3A 50                      push eax
:0046BA3B FF15E0624800            call dword ptr [004862E0]
:0046BA41 6A05                    push 00000005
:0046BA43 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046BA46 83C10C                  add ecx, 0000000C
:0046BA49 E842720000              call 00472C90
:0046BA4E 50                      push eax
:0046BA4F FF15E0624800            call dword ptr [004862E0]
:0046BA55 EB2B                    jmp 0046BA82

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046BA26(C)
|
:0046BA57 6A00                    push 00000000
:0046BA59 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046BA5C 83C10C                  add ecx, 0000000C
:0046BA5F E82C720000              call 00472C90
:0046BA64 50                      push eax
:0046BA65 FF15E0624800            call dword ptr [004862E0]
:0046BA6B 6A05                    push 00000005
:0046BA6D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046BA70 81C1A0060000            add ecx, 000006A0
:0046BA76 E815720000              call 00472C90
:0046BA7B 50                      push eax
:0046BA7C FF15E0624800            call dword ptr [004862E0]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046BA28(U), :0046BA55(U)
|
:0046BA82 8B45FC                  mov eax, dword ptr [ebp-04]
:0046BA85 8A4D08                  mov cl, byte ptr [ebp+08]
:0046BA88 884808                  mov byte ptr [eax+08], cl
:0046BA8B 8BE5                    mov esp, ebp
:0046BA8D 5D                      pop ebp
:0046BA8E C20400                  ret 0004


:0046BA91 55                      push ebp
:0046BA92 8BEC                    mov ebp, esp
:0046BA94 83EC08                  sub esp, 00000008
:0046BA97 894DF8                  mov dword ptr [ebp-08], ecx
:0046BA9A 8B4508                  mov eax, dword ptr [ebp+08]
:0046BA9D 50                      push eax
:0046BA9E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046BAA1 E8A2C9FFFF              call 00468448
:0046BAA6 8845FC                  mov byte ptr [ebp-04], al
:0046BAA9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046BAAC 81E1FF000000            and ecx, 000000FF
:0046BAB2 81F9C8000000            cmp ecx, 000000C8
:0046BAB8 0F8DA8000000            jnl 0046BB66
:0046BABE 8B55FC                  mov edx, dword ptr [ebp-04]
:0046BAC1 81E2FF000000            and edx, 000000FF
:0046BAC7 8B45F8                  mov eax, dword ptr [ebp-08]
:0046BACA 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046BACD 8A09                    mov cl, byte ptr [ecx]
:0046BACF 884CD058                mov byte ptr [eax+8*edx+58], cl
:0046BAD3 8B55FC                  mov edx, dword ptr [ebp-04]
:0046BAD6 81E2FF000000            and edx, 000000FF
:0046BADC 8B45F8                  mov eax, dword ptr [ebp-08]
:0046BADF 8A4DFC                  mov cl, byte ptr [ebp-04]
:0046BAE2 884CD059                mov byte ptr [eax+8*edx+59], cl
:0046BAE6 8B55FC                  mov edx, dword ptr [ebp-04]
:0046BAE9 81E2FF000000            and edx, 000000FF
:0046BAEF 8B45F8                  mov eax, dword ptr [ebp-08]
:0046BAF2 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046BAF5 8A4902                  mov cl, byte ptr [ecx+02]
:0046BAF8 884CD05A                mov byte ptr [eax+8*edx+5A], cl
:0046BAFC 8B55FC                  mov edx, dword ptr [ebp-04]
:0046BAFF 81E2FF000000            and edx, 000000FF
:0046BB05 8B45F8                  mov eax, dword ptr [ebp-08]
:0046BB08 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046BB0B 8A4903                  mov cl, byte ptr [ecx+03]
:0046BB0E 884CD05B                mov byte ptr [eax+8*edx+5B], cl
:0046BB12 8B55FC                  mov edx, dword ptr [ebp-04]
:0046BB15 81E2FF000000            and edx, 000000FF
:0046BB1B 8B45F8                  mov eax, dword ptr [ebp-08]
:0046BB1E C744D05C01000000        mov [eax+8*edx+5C], 00000001
:0046BB26 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046BB29 837954FF                cmp dword ptr [ecx+54], FFFFFFFF
:0046BB2D 750E                    jne 0046BB3D
:0046BB2F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046BB32 E88908FBFF              call 0041C3C0
:0046BB37 8B55F8                  mov edx, dword ptr [ebp-08]
:0046BB3A 894254                  mov dword ptr [edx+54], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046BB2D(C)
|
:0046BB3D 8B45FC                  mov eax, dword ptr [ebp-04]
:0046BB40 25FF000000              and eax, 000000FF
:0046BB45 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046BB48 8D54C158                lea edx, dword ptr [ecx+8*eax+58]
:0046BB4C 52                      push edx
:0046BB4D 8B45F8                  mov eax, dword ptr [ebp-08]
:0046BB50 8A4854                  mov cl, byte ptr [eax+54]
:0046BB53 51                      push ecx
:0046BB54 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046BB57 E82782FFFF              call 00463D83
:0046BB5C 8B55F8                  mov edx, dword ptr [ebp-08]
:0046BB5F C74254FFFFFFFF          mov [edx+54], FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046BAB8(C)
|
:0046BB66 8A45FC                  mov al, byte ptr [ebp-04]
:0046BB69 8BE5                    mov esp, ebp
:0046BB6B 5D                      pop ebp
:0046BB6C C20400                  ret 0004


:0046BB6F 55                      push ebp
:0046BB70 8BEC                    mov ebp, esp
:0046BB72 83EC0C                  sub esp, 0000000C
:0046BB75 894DF4                  mov dword ptr [ebp-0C], ecx
:0046BB78 8B45F4                  mov eax, dword ptr [ebp-0C]
:0046BB7B 8B4850                  mov ecx, dword ptr [eax+50]
:0046BB7E E8AD730000              call 00472F30
:0046BB83 8945F8                  mov dword ptr [ebp-08], eax
:0046BB86 C745FC00000000          mov [ebp-04], 00000000
:0046BB8D EB09                    jmp 0046BB98

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046BBD2(U)
|
:0046BB8F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046BB92 83C101                  add ecx, 00000001
:0046BB95 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046BB8D(U)
|
:0046BB98 817DFCC8000000          cmp dword ptr [ebp-04], 000000C8
:0046BB9F 7D33                    jge 0046BBD4
:0046BBA1 8B55FC                  mov edx, dword ptr [ebp-04]
:0046BBA4 8B45F4                  mov eax, dword ptr [ebp-0C]
:0046BBA7 33C9                    xor ecx, ecx
:0046BBA9 8A4CD058                mov cl, byte ptr [eax+8*edx+58]
:0046BBAD 81F9FF000000            cmp ecx, 000000FF
:0046BBB3 741D                    je 0046BBD2
:0046BBB5 8B55FC                  mov edx, dword ptr [ebp-04]
:0046BBB8 8B45F4                  mov eax, dword ptr [ebp-0C]
:0046BBBB 8A4CD058                mov cl, byte ptr [eax+8*edx+58]
:0046BBBF 51                      push ecx
:0046BBC0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046BBC3 E83FBDF9FF              call 00407907
:0046BBC8 8B55FC                  mov edx, dword ptr [ebp-04]
:0046BBCB 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046BBCE 8944D15C                mov dword ptr [ecx+8*edx+5C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046BBB3(C)
|
:0046BBD2 EBBB                    jmp 0046BB8F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046BB9F(C)
|
:0046BBD4 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046BBD7 E86384FFFF              call 0046403F
:0046BBDC 8BE5                    mov esp, ebp
:0046BBDE 5D                      pop ebp
:0046BBDF C3                      ret


:0046BBE0 55                      push ebp
:0046BBE1 8BEC                    mov ebp, esp
:0046BBE3 83EC20                  sub esp, 00000020
:0046BBE6 894DE0                  mov dword ptr [ebp-20], ecx
:0046BBE9 8B45E0                  mov eax, dword ptr [ebp-20]
:0046BBEC 33C9                    xor ecx, ecx
:0046BBEE 8A4814                  mov cl, byte ptr [eax+14]
:0046BBF1 85C9                    test ecx, ecx
:0046BBF3 7548                    jne 0046BC3D
:0046BBF5 C745E400000000          mov [ebp-1C], 00000000
:0046BBFC C745E803000000          mov [ebp-18], 00000003
:0046BC03 C745EC01000000          mov [ebp-14], 00000001
:0046BC0A C745F002000000          mov [ebp-10], 00000002
:0046BC11 C745F405000000          mov [ebp-0C], 00000005
:0046BC18 C745F808000000          mov [ebp-08], 00000008
:0046BC1F C645FC06                mov [ebp-04], 06
:0046BC23 8D55E4                  lea edx, dword ptr [ebp-1C]
:0046BC26 52                      push edx
:0046BC27 8A45FC                  mov al, byte ptr [ebp-04]
:0046BC2A 50                      push eax
:0046BC2B 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0046BC2E E8C880FFFF              call 00463CFB
:0046BC33 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0046BC36 E8B4BAFFFF              call 004676EF
:0046BC3B EB16                    jmp 0046BC53

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046BBF3(C)
|
:0046BC3D 6A00                    push 00000000
:0046BC3F 6A00                    push 00000000
:0046BC41 6809100000              push 00001009
:0046BC46 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0046BC49 8B5110                  mov edx, dword ptr [ecx+10]
:0046BC4C 52                      push edx
:0046BC4D FF15F4624800            call dword ptr [004862F4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046BC3B(U)
|
:0046BC53 6A01                    push 00000001
:0046BC55 6A00                    push 00000000
:0046BC57 68FF000000              push 000000FF
:0046BC5C 8B45E0                  mov eax, dword ptr [ebp-20]
:0046BC5F 83C058                  add eax, 00000058
:0046BC62 50                      push eax
:0046BC63 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0046BC66 E812ABFFFF              call 0046677D
:0046BC6B 6A00                    push 00000000
:0046BC6D 6A00                    push 00000000
:0046BC6F 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0046BC72 E8B490FFFF              call 00464D2B
:0046BC77 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0046BC7A C74154FFFFFFFF          mov [ecx+54], FFFFFFFF
:0046BC81 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0046BC84 E84484FFFF              call 004640CD
:0046BC89 8BE5                    mov esp, ebp
:0046BC8B 5D                      pop ebp
:0046BC8C C3                      ret


:0046BC8D 55                      push ebp
:0046BC8E 8BEC                    mov ebp, esp
:0046BC90 83EC10                  sub esp, 00000010
:0046BC93 56                      push esi
:0046BC94 894DF0                  mov dword ptr [ebp-10], ecx
:0046BC97 837D0800                cmp dword ptr [ebp+08], 00000000
:0046BC9B 0F8C04010000            jl 0046BDA5
:0046BCA1 8B4508                  mov eax, dword ptr [ebp+08]
:0046BCA4 50                      push eax
:0046BCA5 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046BCA8 E8EF82FFFF              call 00463F9C
:0046BCAD 8945FC                  mov dword ptr [ebp-04], eax
:0046BCB0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046BCB3 8A11                    mov dl, byte ptr [ecx]
:0046BCB5 52                      push edx
:0046BCB6 8B45F0                  mov eax, dword ptr [ebp-10]
:0046BCB9 8B4850                  mov ecx, dword ptr [eax+50]
:0046BCBC E86F720000              call 00472F30
:0046BCC1 8BC8                    mov ecx, eax
:0046BCC3 E83FBCF9FF              call 00407907
:0046BCC8 85C0                    test eax, eax
:0046BCCA 0F84D5000000            je 0046BDA5
:0046BCD0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046BCD3 8A5101                  mov dl, byte ptr [ecx+01]
:0046BCD6 52                      push edx
:0046BCD7 B970074B00              mov ecx, 004B0770
:0046BCDC E81218FAFF              call 0040D4F3
:0046BCE1 8B45F0                  mov eax, dword ptr [ebp-10]
:0046BCE4 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046BCE7 894854                  mov dword ptr [eax+54], ecx
:0046BCEA 8B55FC                  mov edx, dword ptr [ebp-04]
:0046BCED 8B02                    mov eax, dword ptr [edx]
:0046BCEF 8B4A04                  mov ecx, dword ptr [edx+04]
:0046BCF2 8945F4                  mov dword ptr [ebp-0C], eax
:0046BCF5 894DF8                  mov dword ptr [ebp-08], ecx
:0046BCF8 8B55FC                  mov edx, dword ptr [ebp-04]
:0046BCFB C602FF                  mov byte ptr [edx], FF
:0046BCFE 8B45FC                  mov eax, dword ptr [ebp-04]
:0046BD01 C6400200                mov [eax+02], 00
:0046BD05 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046BD08 C6410300                mov [ecx+03], 00
:0046BD0C 6A01                    push 00000001
:0046BD0E 6A09                    push 00000009
:0046BD10 B9B0694B00              mov ecx, 004B69B0
:0046BD15 E860890000              call 0047467A
:0046BD1A 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046BD1D E81482FFFF              call 00463F36
:0046BD22 6A00                    push 00000000
:0046BD24 6A00                    push 00000000
:0046BD26 6828100000              push 00001028
:0046BD2B 8B55F0                  mov edx, dword ptr [ebp-10]
:0046BD2E 8B4210                  mov eax, dword ptr [edx+10]
:0046BD31 50                      push eax
:0046BD32 FF15F4624800            call dword ptr [004862F4]
:0046BD38 8BF0                    mov esi, eax
:0046BD3A 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046BD3D E87E06FBFF              call 0041C3C0
:0046BD42 3BF0                    cmp esi, eax
:0046BD44 7D1D                    jge 0046BD63
:0046BD46 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:0046BD49 51                      push ecx
:0046BD4A 8B55F0                  mov edx, dword ptr [ebp-10]
:0046BD4D 8B4A50                  mov ecx, dword ptr [edx+50]
:0046BD50 E829D0FFFF              call 00468D7E
:0046BD55 8B45FC                  mov eax, dword ptr [ebp-04]
:0046BD58 50                      push eax
:0046BD59 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046BD5C E89980FFFF              call 00463DFA
:0046BD61 EB1B                    jmp 0046BD7E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046BD44(C)
|
:0046BD63 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046BD66 51                      push ecx
:0046BD67 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046BD6A E88B80FFFF              call 00463DFA
:0046BD6F 8D55F4                  lea edx, dword ptr [ebp-0C]
:0046BD72 52                      push edx
:0046BD73 8B45F0                  mov eax, dword ptr [ebp-10]
:0046BD76 8B4850                  mov ecx, dword ptr [eax+50]
:0046BD79 E800D0FFFF              call 00468D7E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046BD61(U)
|
:0046BD7E 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046BD81 E8E181FFFF              call 00463F67
:0046BD86 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046BD89 E83F83FFFF              call 004640CD
:0046BD8E 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046BD91 8B11                    mov edx, dword ptr [ecx]
:0046BD93 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046BD96 FF5210                  call [edx+10]
:0046BD99 50                      push eax
:0046BD9A 8B45F0                  mov eax, dword ptr [ebp-10]
:0046BD9D 8B10                    mov edx, dword ptr [eax]
:0046BD9F 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046BDA2 FF5230                  call [edx+30]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046BC9B(C), :0046BCCA(C)
|
:0046BDA5 5E                      pop esi
:0046BDA6 8BE5                    mov esp, ebp
:0046BDA8 5D                      pop ebp
:0046BDA9 C20400                  ret 0004


:0046BDAC 55                      push ebp
:0046BDAD 8BEC                    mov ebp, esp
:0046BDAF 83EC0C                  sub esp, 0000000C
:0046BDB2 894DF4                  mov dword ptr [ebp-0C], ecx
:0046BDB5 6A0F                    push 0000000F
:0046BDB7 FF1564634800            call dword ptr [00486364]
:0046BDBD 8945FC                  mov dword ptr [ebp-04], eax
:0046BDC0 6A08                    push 00000008
:0046BDC2 FF1564634800            call dword ptr [00486364]
:0046BDC8 8945F8                  mov dword ptr [ebp-08], eax
:0046BDCB 8B45F4                  mov eax, dword ptr [ebp-0C]
:0046BDCE 33C9                    xor ecx, ecx
:0046BDD0 8A4828                  mov cl, byte ptr [eax+28]
:0046BDD3 83F903                  cmp ecx, 00000003
:0046BDD6 7D31                    jge 0046BE09
:0046BDD8 8B550C                  mov edx, dword ptr [ebp+0C]
:0046BDDB 52                      push edx
:0046BDDC FF1594634800            call dword ptr [00486394]
:0046BDE2 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046BDE5 33D2                    xor edx, edx
:0046BDE7 8A5128                  mov dl, byte ptr [ecx+28]
:0046BDEA 3B0495786A4800          cmp eax, dword ptr [4*edx+00486A78]
:0046BDF1 7516                    jne 0046BE09
:0046BDF3 6A0D                    push 0000000D
:0046BDF5 FF1564634800            call dword ptr [00486364]
:0046BDFB 8945FC                  mov dword ptr [ebp-04], eax
:0046BDFE 6A0E                    push 0000000E
:0046BE00 FF1564634800            call dword ptr [00486364]
:0046BE06 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046BDD6(C), :0046BDF1(C)
|
:0046BE09 6A00                    push 00000000
:0046BE0B 6A01                    push 00000001
:0046BE0D 8B45F8                  mov eax, dword ptr [ebp-08]
:0046BE10 50                      push eax
:0046BE11 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046BE14 51                      push ecx
:0046BE15 8B550C                  mov edx, dword ptr [ebp+0C]
:0046BE18 52                      push edx
:0046BE19 8B4508                  mov eax, dword ptr [ebp+08]
:0046BE1C 50                      push eax
:0046BE1D E898570000              call 004715BA
:0046BE22 83C418                  add esp, 00000018
:0046BE25 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046BE28 51                      push ecx
:0046BE29 8B5508                  mov edx, dword ptr [ebp+08]
:0046BE2C 52                      push edx
:0046BE2D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046BE30 E879E8FFFF              call 0046A6AE
:0046BE35 8BE5                    mov esp, ebp
:0046BE37 5D                      pop ebp
:0046BE38 C20800                  ret 0008


:0046BE3B 55                      push ebp
:0046BE3C 8BEC                    mov ebp, esp
:0046BE3E 83EC0C                  sub esp, 0000000C
:0046BE41 894DF4                  mov dword ptr [ebp-0C], ecx
:0046BE44 8B4508                  mov eax, dword ptr [ebp+08]
:0046BE47 25FF000000              and eax, 000000FF
:0046BE4C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046BE4F 33D2                    xor edx, edx
:0046BE51 8A5128                  mov dl, byte ptr [ecx+28]
:0046BE54 3BC2                    cmp eax, edx
:0046BE56 7505                    jne 0046BE5D
:0046BE58 E998000000              jmp 0046BEF5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046BE56(C)
|
:0046BE5D 8B45F4                  mov eax, dword ptr [ebp-0C]
:0046BE60 33C9                    xor ecx, ecx
:0046BE62 8A4828                  mov cl, byte ptr [eax+28]
:0046BE65 83F903                  cmp ecx, 00000003
:0046BE68 7D2A                    jge 0046BE94
:0046BE6A 6A05                    push 00000005
:0046BE6C 6A00                    push 00000000
:0046BE6E 6A00                    push 00000000
:0046BE70 8B55F4                  mov edx, dword ptr [ebp-0C]
:0046BE73 33C0                    xor eax, eax
:0046BE75 8A4228                  mov al, byte ptr [edx+28]
:0046BE78 8B0C85886A4800          mov ecx, dword ptr [4*eax+00486A88]
:0046BE7F 51                      push ecx
:0046BE80 8B55F4                  mov edx, dword ptr [ebp-0C]
:0046BE83 8B4204                  mov eax, dword ptr [edx+04]
:0046BE86 50                      push eax
:0046BE87 FF15DC624800            call dword ptr [004862DC]
:0046BE8D 50                      push eax
:0046BE8E FF15B4624800            call dword ptr [004862B4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046BE68(C)
|
:0046BE94 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046BE97 8A5508                  mov dl, byte ptr [ebp+08]
:0046BE9A 885128                  mov byte ptr [ecx+28], dl
:0046BE9D 8B45F4                  mov eax, dword ptr [ebp-0C]
:0046BEA0 33C9                    xor ecx, ecx
:0046BEA2 8A4828                  mov cl, byte ptr [eax+28]
:0046BEA5 83F903                  cmp ecx, 00000003
:0046BEA8 7D2A                    jge 0046BED4
:0046BEAA 6A05                    push 00000005
:0046BEAC 6A00                    push 00000000
:0046BEAE 6A00                    push 00000000
:0046BEB0 8B55F4                  mov edx, dword ptr [ebp-0C]
:0046BEB3 33C0                    xor eax, eax
:0046BEB5 8A4228                  mov al, byte ptr [edx+28]
:0046BEB8 8B0C85886A4800          mov ecx, dword ptr [4*eax+00486A88]
:0046BEBF 51                      push ecx
:0046BEC0 8B55F4                  mov edx, dword ptr [ebp-0C]
:0046BEC3 8B4204                  mov eax, dword ptr [edx+04]
:0046BEC6 50                      push eax
:0046BEC7 FF15DC624800            call dword ptr [004862DC]
:0046BECD 50                      push eax
:0046BECE FF15B4624800            call dword ptr [004862B4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046BEA8(C)
|
:0046BED4 C645F8FF                mov [ebp-08], FF
:0046BED8 C645F900                mov [ebp-07], 00
:0046BEDC C645FA00                mov [ebp-06], 00
:0046BEE0 C645FB00                mov [ebp-05], 00
:0046BEE4 33C9                    xor ecx, ecx
:0046BEE6 894DFC                  mov dword ptr [ebp-04], ecx
:0046BEE9 8D55F8                  lea edx, dword ptr [ebp-08]
:0046BEEC 52                      push edx
:0046BEED 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046BEF0 E8C9CFFFFF              call 00468EBE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046BE58(U)
|
:0046BEF5 8BE5                    mov esp, ebp
:0046BEF7 5D                      pop ebp
:0046BEF8 C20400                  ret 0004


:0046BEFB 55                      push ebp
:0046BEFC 8BEC                    mov ebp, esp
:0046BEFE 51                      push ecx
:0046BEFF 894DFC                  mov dword ptr [ebp-04], ecx
:0046BF02 8B4508                  mov eax, dword ptr [ebp+08]
:0046BF05 25FF000000              and eax, 000000FF
:0046BF0A 83F803                  cmp eax, 00000003
:0046BF0D 0F8D8C000000            jnl 0046BF9F
:0046BF13 8A4D08                  mov cl, byte ptr [ebp+08]
:0046BF16 51                      push ecx
:0046BF17 8B55FC                  mov edx, dword ptr [ebp-04]
:0046BF1A 8B4A20                  mov ecx, dword ptr [edx+20]
:0046BF1D E8CEA6F9FF              call 004065F0
:0046BF22 25FF000000              and eax, 000000FF
:0046BF27 3DFF000000              cmp eax, 000000FF
:0046BF2C 7471                    je 0046BF9F
:0046BF2E B970074B00              mov ecx, 004B0770
:0046BF33 E8A817FAFF              call 0040D6E0
:0046BF38 25FF000000              and eax, 000000FF

* Possible Reference to Dialog: DialogID_00C8 
                                  |
:0046BF3D 3DC8000000              cmp eax, 000000C8
:0046BF42 7C0C                    jl 0046BF50
:0046BF44 6A00                    push 00000000
:0046BF46 B9B0694B00              mov ecx, 004B69B0
:0046BF4B E85D870000              call 004746AD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046BF42(C)
|
:0046BF50 8A4508                  mov al, byte ptr [ebp+08]
:0046BF53 50                      push eax
:0046BF54 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046BF57 E880CDFFFF              call 00468CDC
:0046BF5C 85C0                    test eax, eax
:0046BF5E 743F                    je 0046BF9F
:0046BF60 6A01                    push 00000001
:0046BF62 B9B0694B00              mov ecx, 004B69B0
:0046BF67 E841870000              call 004746AD
:0046BF6C 8A4D08                  mov cl, byte ptr [ebp+08]
:0046BF6F 51                      push ecx
:0046BF70 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046BF73 E8B2D4FFFF              call 0046942A
:0046BF78 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046BF7B E82FD9FFFF              call 004698AF
:0046BF80 8B55FC                  mov edx, dword ptr [ebp-04]
:0046BF83 8B4A20                  mov ecx, dword ptr [edx+20]
:0046BF86 E875D5F9FF              call 00409500
:0046BF8B 50                      push eax
:0046BF8C E870DA0000              call 00479A01
:0046BF91 83C404                  add esp, 00000004
:0046BF94 8B45FC                  mov eax, dword ptr [ebp-04]
:0046BF97 8B4824                  mov ecx, dword ptr [eax+24]
:0046BF9A E82E81FFFF              call 004640CD

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046BF0D(C), :0046BF2C(C), :0046BF5E(C)
|
:0046BF9F 8BE5                    mov esp, ebp
:0046BFA1 5D                      pop ebp
:0046BFA2 C20400                  ret 0004



* Referenced by a CALL at Address:
|:00461CD4   
|
:0046BFA5 55                      push ebp
:0046BFA6 8BEC                    mov ebp, esp
:0046BFA8 6AFF                    push FFFFFFFF
:0046BFAA 6808594800              push 00485908
:0046BFAF 64A100000000            mov eax, dword ptr fs:[00000000]
:0046BFB5 50                      push eax
:0046BFB6 64892500000000          mov dword ptr fs:[00000000], esp
:0046BFBD 51                      push ecx
:0046BFBE 894DF0                  mov dword ptr [ebp-10], ecx
:0046BFC1 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046BFC4 83C108                  add ecx, 00000008
:0046BFC7 E8E4700000              call 004730B0
:0046BFCC C745FC00000000          mov [ebp-04], 00000000
:0046BFD3 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046BFD6 81C1A0060000            add ecx, 000006A0
:0046BFDC E8EF700000              call 004730D0
:0046BFE1 C645FC01                mov [ebp-04], 01
:0046BFE5 8B45F0                  mov eax, dword ptr [ebp-10]
:0046BFE8 C70000000000            mov dword ptr [eax], 00000000
:0046BFEE 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046BFF1 81C1A0060000            add ecx, 000006A0
:0046BFF7 51                      push ecx
:0046BFF8 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046BFFB 83C108                  add ecx, 00000008
:0046BFFE E82D6A0000              call 00472A30
:0046C003 8B55F0                  mov edx, dword ptr [ebp-10]
:0046C006 83C208                  add edx, 00000008
:0046C009 52                      push edx
:0046C00A 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046C00D 81C1A0060000            add ecx, 000006A0
:0046C013 E8B86F0000              call 00472FD0
:0046C018 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0046C01F 8B45F0                  mov eax, dword ptr [ebp-10]
:0046C022 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046C025 64890D00000000          mov dword ptr fs:[00000000], ecx
:0046C02C 8BE5                    mov esp, ebp
:0046C02E 5D                      pop ebp
:0046C02F C3                      ret



* Referenced by a CALL at Address:
|:00461CF3   
|
:0046C030 55                      push ebp
:0046C031 8BEC                    mov ebp, esp
:0046C033 51                      push ecx
:0046C034 894DFC                  mov dword ptr [ebp-04], ecx
:0046C037 8B45FC                  mov eax, dword ptr [ebp-04]
:0046C03A 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046C03D 894804                  mov dword ptr [eax+04], ecx
:0046C040 8B55FC                  mov edx, dword ptr [ebp-04]
:0046C043 52                      push edx

* Possible StringData Ref from Code Obj ->"U}"
                                  |
:0046C044 6836CF4600              push 0046CF36
:0046C049 8B45FC                  mov eax, dword ptr [ebp-04]
:0046C04C 8B4804                  mov ecx, dword ptr [eax+04]
:0046C04F 51                      push ecx

* Possible Reference to Dialog: DialogID_0148 
                                  |
:0046C050 6848010000              push 00000148
:0046C055 8B5508                  mov edx, dword ptr [ebp+08]
:0046C058 52                      push edx
:0046C059 FF15A0624800            call dword ptr [004862A0]
:0046C05F 8BE5                    mov esp, ebp
:0046C061 5D                      pop ebp
:0046C062 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0046CF77   , :0046CFB6   
|
:0046C065 55                      push ebp
:0046C066 8BEC                    mov ebp, esp
:0046C068 83EC0C                  sub esp, 0000000C
:0046C06B 894DFC                  mov dword ptr [ebp-04], ecx
:0046C06E 817D0C10010000          cmp dword ptr [ebp+0C], 00000110
:0046C075 752F                    jne 0046C0A6
:0046C077 68B1050000              push 000005B1
:0046C07C 8B4510                  mov eax, dword ptr [ebp+10]
:0046C07F 50                      push eax
:0046C080 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046C083 51                      push ecx
:0046C084 8B5508                  mov edx, dword ptr [ebp+08]
:0046C087 52                      push edx
:0046C088 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046C08B 83C108                  add ecx, 00000008
:0046C08E 8B45FC                  mov eax, dword ptr [ebp-04]
:0046C091 8B5008                  mov edx, dword ptr [eax+08]
:0046C094 FF5224                  call [edx+24]
:0046C097 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046C09A E89B030000              call 0046C43A
:0046C09F 33C0                    xor eax, eax
:0046C0A1 E9AC020000              jmp 0046C352

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C075(C)
|
:0046C0A6 817D0C38010000          cmp dword ptr [ebp+0C], 00000138
:0046C0AD 742D                    je 0046C0DC
:0046C0AF 8B4514                  mov eax, dword ptr [ebp+14]
:0046C0B2 50                      push eax
:0046C0B3 8B4D10                  mov ecx, dword ptr [ebp+10]
:0046C0B6 51                      push ecx
:0046C0B7 8B550C                  mov edx, dword ptr [ebp+0C]
:0046C0BA 52                      push edx
:0046C0BB 8B4508                  mov eax, dword ptr [ebp+08]
:0046C0BE 50                      push eax
:0046C0BF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046C0C2 83C108                  add ecx, 00000008
:0046C0C5 8B55FC                  mov edx, dword ptr [ebp-04]
:0046C0C8 8B4208                  mov eax, dword ptr [edx+08]
:0046C0CB FF5024                  call [eax+24]
:0046C0CE 85C0                    test eax, eax
:0046C0D0 740A                    je 0046C0DC
:0046C0D2 B801000000              mov eax, 00000001
:0046C0D7 E976020000              jmp 0046C352

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046C0AD(C), :0046C0D0(C)
|
:0046C0DC 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046C0DF 894DF8                  mov dword ptr [ebp-08], ecx
:0046C0E2 837DF820                cmp dword ptr [ebp-08], 00000020
:0046C0E6 7715                    ja 0046C0FD
:0046C0E8 837DF820                cmp dword ptr [ebp-08], 00000020
:0046C0EC 0F8488000000            je 0046C17A
:0046C0F2 837DF802                cmp dword ptr [ebp-08], 00000002
:0046C0F6 745F                    je 0046C157
:0046C0F8 E953020000              jmp 0046C350

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C0E6(C)
|
:0046C0FD 817DF811010000          cmp dword ptr [ebp-08], 00000111
:0046C104 7726                    ja 0046C12C
:0046C106 817DF811010000          cmp dword ptr [ebp-08], 00000111
:0046C10D 0F84B1010000            je 0046C2C4
:0046C113 837DF82B                cmp dword ptr [ebp-08], 0000002B
:0046C117 0F8490010000            je 0046C2AD
:0046C11D 837DF82C                cmp dword ptr [ebp-08], 0000002C
:0046C121 0F8466010000            je 0046C28D
:0046C127 E924020000              jmp 0046C350

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C104(C)
|
:0046C12C 8B55F8                  mov edx, dword ptr [ebp-08]
:0046C12F 81EA38010000            sub edx, 00000138
:0046C135 8955F8                  mov dword ptr [ebp-08], edx
:0046C138 817DF8CD000000          cmp dword ptr [ebp-08], 000000CD
:0046C13F 0F870B020000            ja 0046C350
:0046C145 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046C148 33C0                    xor eax, eax
:0046C14A 8A816CC34600            mov al, byte ptr [ecx+0046C36C]
:0046C150 FF248558C34600          jmp dword ptr [4*eax+0046C358]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C0F6(C)
|
:0046C157 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046C15A 81C1A0060000            add ecx, 000006A0
:0046C160 E812DDFFFF              call 00469E77
:0046C165 6A00                    push 00000000
:0046C167 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046C16A 81C1A0060000            add ecx, 000006A0
:0046C170 E8EB37FEFF              call 0044F960
:0046C175 E9D6010000              jmp 0046C350

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C0EC(C)
|
:0046C17A 8B5514                  mov edx, dword ptr [ebp+14]
:0046C17D C1EA10                  shr edx, 10
:0046C180 81E2FFFF0000            and edx, 0000FFFF
:0046C186 52                      push edx
:0046C187 668B4514                mov ax, word ptr [ebp+14]
:0046C18B 50                      push eax
:0046C18C 8B4D10                  mov ecx, dword ptr [ebp+10]
:0046C18F 51                      push ecx
:0046C190 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046C193 81C1A0060000            add ecx, 000006A0
:0046C199 E84AE6FFFF              call 0046A7E8
:0046C19E E9AF010000              jmp 0046C352
:0046C1A3 8B5514                  mov edx, dword ptr [ebp+14]
:0046C1A6 C1EA10                  shr edx, 10
:0046C1A9 81E2FFFF0000            and edx, 0000FFFF
:0046C1AF 52                      push edx
:0046C1B0 668B4514                mov ax, word ptr [ebp+14]
:0046C1B4 50                      push eax
:0046C1B5 8B4D10                  mov ecx, dword ptr [ebp+10]
:0046C1B8 51                      push ecx
:0046C1B9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046C1BC 81C1A0060000            add ecx, 000006A0
:0046C1C2 E88BE6FFFF              call 0046A852
:0046C1C7 E986010000              jmp 0046C352
:0046C1CC FF1584634800            call dword ptr [00486384]
:0046C1D2 3B4508                  cmp eax, dword ptr [ebp+08]
:0046C1D5 7540                    jne 0046C217
:0046C1D7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046C1DA 81C1A0060000            add ecx, 000006A0
:0046C1E0 E849E5FFFF              call 0046A72E
:0046C1E5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046C1E8 81C1A0060000            add ecx, 000006A0
:0046C1EE E88BD9FFFF              call 00469B7E
:0046C1F3 50                      push eax
:0046C1F4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046C1F7 81C1A0060000            add ecx, 000006A0
:0046C1FD 8B55FC                  mov edx, dword ptr [ebp-04]
:0046C200 8B82A0060000            mov eax, dword ptr [edx+000006A0]
:0046C206 FF5008                  call [eax+08]
:0046C209 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046C20C 81C1A0060000            add ecx, 000006A0
:0046C212 E845E5FFFF              call 0046A75C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C1D5(C)
|
:0046C217 E934010000              jmp 0046C350
:0046C21C FF1584634800            call dword ptr [00486384]
:0046C222 3B4508                  cmp eax, dword ptr [ebp+08]
:0046C225 7540                    jne 0046C267
:0046C227 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046C22A 81C1A0060000            add ecx, 000006A0
:0046C230 E8F9E4FFFF              call 0046A72E
:0046C235 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046C238 81C1A0060000            add ecx, 000006A0
:0046C23E E83BD9FFFF              call 00469B7E
:0046C243 50                      push eax
:0046C244 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046C247 81C1A0060000            add ecx, 000006A0
:0046C24D 8B55FC                  mov edx, dword ptr [ebp-04]
:0046C250 8B82A0060000            mov eax, dword ptr [edx+000006A0]
:0046C256 FF500C                  call [eax+0C]
:0046C259 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046C25C 81C1A0060000            add ecx, 000006A0
:0046C262 E8F5E4FFFF              call 0046A75C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C225(C)
|
:0046C267 E9E4000000              jmp 0046C350
:0046C26C 8B4D14                  mov ecx, dword ptr [ebp+14]
:0046C26F 51                      push ecx
:0046C270 8B5510                  mov edx, dword ptr [ebp+10]
:0046C273 52                      push edx
:0046C274 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046C277 81C1A0060000            add ecx, 000006A0
:0046C27D 8B45FC                  mov eax, dword ptr [ebp-04]
:0046C280 8B90A0060000            mov edx, dword ptr [eax+000006A0]
:0046C286 FF12                    call dword ptr [edx]
:0046C288 E9C3000000              jmp 0046C350

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C121(C)
|
:0046C28D 8B4514                  mov eax, dword ptr [ebp+14]
:0046C290 50                      push eax
:0046C291 8B4D10                  mov ecx, dword ptr [ebp+10]
:0046C294 51                      push ecx
:0046C295 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046C298 81C1A0060000            add ecx, 000006A0
:0046C29E E875DEFFFF              call 0046A118
:0046C2A3 B801000000              mov eax, 00000001
:0046C2A8 E9A5000000              jmp 0046C352

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C117(C)
|
:0046C2AD 8B5514                  mov edx, dword ptr [ebp+14]
:0046C2B0 52                      push edx
:0046C2B1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046C2B4 81C1A0060000            add ecx, 000006A0
:0046C2BA E8E4DEFFFF              call 0046A1A3
:0046C2BF E98E000000              jmp 0046C352

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C10D(C)
|
:0046C2C4 8B4510                  mov eax, dword ptr [ebp+10]
:0046C2C7 25FFFF0000              and eax, 0000FFFF
:0046C2CC 8945F4                  mov dword ptr [ebp-0C], eax
:0046C2CF 817DF403040000          cmp dword ptr [ebp-0C], 00000403
:0046C2D6 7F11                    jg 0046C2E9
:0046C2D8 817DF403040000          cmp dword ptr [ebp-0C], 00000403
:0046C2DF 744D                    je 0046C32E
:0046C2E1 837DF402                cmp dword ptr [ebp-0C], 00000002
:0046C2E5 7416                    je 0046C2FD
:0046C2E7 EB67                    jmp 0046C350

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C2D6(C)
|
:0046C2E9 817DF404040000          cmp dword ptr [ebp-0C], 00000404
:0046C2F0 744E                    je 0046C340
:0046C2F2 817DF44A040000          cmp dword ptr [ebp-0C], 0000044A
:0046C2F9 7412                    je 0046C30D
:0046C2FB EB53                    jmp 0046C350

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C2E5(C)
|
:0046C2FD 6A00                    push 00000000
:0046C2FF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046C302 8B11                    mov edx, dword ptr [ecx]
:0046C304 52                      push edx
:0046C305 FF15D4624800            call dword ptr [004862D4]
:0046C30B EB43                    jmp 0046C350

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C2F9(C)
|
:0046C30D 8B4514                  mov eax, dword ptr [ebp+14]
:0046C310 50                      push eax
:0046C311 8B4D10                  mov ecx, dword ptr [ebp+10]
:0046C314 C1E910                  shr ecx, 10
:0046C317 81E1FFFF0000            and ecx, 0000FFFF
:0046C31D 51                      push ecx
:0046C31E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046C321 81C1A0060000            add ecx, 000006A0
:0046C327 E89FDBFFFF              call 00469ECB
:0046C32C EB22                    jmp 0046C350

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C2DF(C)
|
:0046C32E 6AFF                    push FFFFFFFF
:0046C330 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046C333 81C1A0060000            add ecx, 000006A0
:0046C339 E89ED7FFFF              call 00469ADC
:0046C33E EB10                    jmp 0046C350

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C2F0(C)
|
:0046C340 6A01                    push 00000001
:0046C342 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046C345 81C1A0060000            add ecx, 000006A0
:0046C34B E88CD7FFFF              call 00469ADC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046C0F8(U), :0046C127(U), :0046C13F(C), :0046C175(U), :0046C217(U)
|:0046C267(U), :0046C288(U), :0046C2E7(U), :0046C2FB(U), :0046C30B(U)
|:0046C32C(U), :0046C33E(U)
|
:0046C350 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046C0A1(U), :0046C0D7(U), :0046C19E(U), :0046C1C7(U), :0046C2A8(U)
|:0046C2BF(U)
|
:0046C352 8BE5                    mov esp, ebp
:0046C354 5D                      pop ebp
:0046C355 C21000                  ret 0010



:0046C358 6CC24600                DWORD 0046C26C
:0046C35C A3C14600                DWORD 0046C1A3
:0046C360 CCC14600                DWORD 0046C1CC
:0046C364 1CC24600                DWORD 0046C21C
:0046C368 50C34600                DWORD 0046C350


:0046C36C 000404                  add byte ptr [esp+eax], al
:0046C36F 0404                    add al, 04
:0046C371 0404                    add al, 04
:0046C373 0404                    add al, 04
:0046C375 0404                    add al, 04
:0046C377 0404                    add al, 04
:0046C379 0404                    add al, 04
:0046C37B 0404                    add al, 04
:0046C37D 0404                    add al, 04
:0046C37F 0404                    add al, 04
:0046C381 0404                    add al, 04
:0046C383 0404                    add al, 04
:0046C385 0404                    add al, 04
:0046C387 0404                    add al, 04
:0046C389 0404                    add al, 04
:0046C38B 0404                    add al, 04
:0046C38D 0404                    add al, 04
:0046C38F 0404                    add al, 04
:0046C391 0404                    add al, 04
:0046C393 0404                    add al, 04
:0046C395 0404                    add al, 04
:0046C397 0404                    add al, 04
:0046C399 0404                    add al, 04
:0046C39B 0404                    add al, 04
:0046C39D 0404                    add al, 04
:0046C39F 0404                    add al, 04
:0046C3A1 0404                    add al, 04
:0046C3A3 0404                    add al, 04
:0046C3A5 0404                    add al, 04
:0046C3A7 0404                    add al, 04
:0046C3A9 0404                    add al, 04
:0046C3AB 0404                    add al, 04
:0046C3AD 0404                    add al, 04
:0046C3AF 0404                    add al, 04
:0046C3B1 0404                    add al, 04
:0046C3B3 0404                    add al, 04
:0046C3B5 0404                    add al, 04
:0046C3B7 0404                    add al, 04
:0046C3B9 0404                    add al, 04
:0046C3BB 0404                    add al, 04
:0046C3BD 0404                    add al, 04
:0046C3BF 0404                    add al, 04
:0046C3C1 0404                    add al, 04
:0046C3C3 0404                    add al, 04
:0046C3C5 0404                    add al, 04
:0046C3C7 0404                    add al, 04
:0046C3C9 0404                    add al, 04
:0046C3CB 0404                    add al, 04
:0046C3CD 0404                    add al, 04
:0046C3CF 0404                    add al, 04
:0046C3D1 0404                    add al, 04
:0046C3D3 0404                    add al, 04
:0046C3D5 0404                    add al, 04
:0046C3D7 0404                    add al, 04
:0046C3D9 0404                    add al, 04
:0046C3DB 0404                    add al, 04
:0046C3DD 0404                    add al, 04
:0046C3DF 0404                    add al, 04
:0046C3E1 0404                    add al, 04
:0046C3E3 0404                    add al, 04
:0046C3E5 0404                    add al, 04
:0046C3E7 0404                    add al, 04
:0046C3E9 0404                    add al, 04
:0046C3EB 0404                    add al, 04
:0046C3ED 0404                    add al, 04
:0046C3EF 0404                    add al, 04
:0046C3F1 0404                    add al, 04
:0046C3F3 0404                    add al, 04
:0046C3F5 0404                    add al, 04
:0046C3F7 0404                    add al, 04
:0046C3F9 0404                    add al, 04
:0046C3FB 0404                    add al, 04
:0046C3FD 0404                    add al, 04
:0046C3FF 0404                    add al, 04
:0046C401 0404                    add al, 04
:0046C403 0404                    add al, 04
:0046C405 0404                    add al, 04
:0046C407 0404                    add al, 04
:0046C409 0404                    add al, 04
:0046C40B 0404                    add al, 04
:0046C40D 0404                    add al, 04
:0046C40F 0404                    add al, 04
:0046C411 0404                    add al, 04
:0046C413 0404                    add al, 04
:0046C415 0404                    add al, 04
:0046C417 0404                    add al, 04
:0046C419 0404                    add al, 04
:0046C41B 0404                    add al, 04
:0046C41D 0404                    add al, 04
:0046C41F 0404                    add al, 04
:0046C421 0404                    add al, 04
:0046C423 0404                    add al, 04
:0046C425 0404                    add al, 04
:0046C427 0404                    add al, 04
:0046C429 0404                    add al, 04
:0046C42B 0404                    add al, 04
:0046C42D 0404                    add al, 04
:0046C42F 0404                    add al, 04
:0046C431 0404                    add al, 04
:0046C433 0401                    add al, 01
:0046C435 0402                    add al, 02
:0046C437 0404                    add al, 04
:0046C439 03                      BYTE 03h


* Referenced by a CALL at Address:
|:0046C09A   
|
:0046C43A 55                      push ebp
:0046C43B 8BEC                    mov ebp, esp
:0046C43D 51                      push ecx
:0046C43E 894DFC                  mov dword ptr [ebp-04], ecx
:0046C441 8B45FC                  mov eax, dword ptr [ebp-04]
:0046C444 8B08                    mov ecx, dword ptr [eax]
:0046C446 51                      push ecx
:0046C447 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046C44A 83C108                  add ecx, 00000008
:0046C44D E82E640000              call 00472880
:0046C452 68B1050000              push 000005B1
:0046C457 8B55FC                  mov edx, dword ptr [ebp-04]
:0046C45A 8B02                    mov eax, dword ptr [edx]
:0046C45C 50                      push eax
:0046C45D FF15DC624800            call dword ptr [004862DC]
:0046C463 50                      push eax
:0046C464 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046C467 83C108                  add ecx, 00000008
:0046C46A E831640000              call 004728A0
:0046C46F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046C472 83C108                  add ecx, 00000008
:0046C475 8B55FC                  mov edx, dword ptr [ebp-04]
:0046C478 8B4208                  mov eax, dword ptr [edx+08]
:0046C47B FF5028                  call [eax+28]
:0046C47E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046C481 8B11                    mov edx, dword ptr [ecx]
:0046C483 52                      push edx
:0046C484 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046C487 81C1A0060000            add ecx, 000006A0
:0046C48D E8CE34FEFF              call 0044F960
:0046C492 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046C495 81C1A0060000            add ecx, 000006A0
:0046C49B E8C0D7FFFF              call 00469C60
:0046C4A0 8B45FC                  mov eax, dword ptr [ebp-04]
:0046C4A3 8B4804                  mov ecx, dword ptr [eax+04]
:0046C4A6 51                      push ecx
:0046C4A7 8B55FC                  mov edx, dword ptr [ebp-04]
:0046C4AA 8B02                    mov eax, dword ptr [edx]
:0046C4AC 50                      push eax
:0046C4AD E8F45EFFFF              call 004623A6
:0046C4B2 83C408                  add esp, 00000008
:0046C4B5 8BE5                    mov esp, ebp
:0046C4B7 5D                      pop ebp
:0046C4B8 C3                      ret


:0046C4B9 55                      push ebp
:0046C4BA 8BEC                    mov ebp, esp
:0046C4BC 83EC08                  sub esp, 00000008
:0046C4BF 894DFC                  mov dword ptr [ebp-04], ecx
:0046C4C2 837D0800                cmp dword ptr [ebp+08], 00000000
:0046C4C6 7551                    jne 0046C519
:0046C4C8 68486C4800              push 00486C48
:0046C4CD 6A00                    push 00000000
:0046C4CF 6811100000              push 00001011
:0046C4D4 8B45FC                  mov eax, dword ptr [ebp-04]
:0046C4D7 8B4810                  mov ecx, dword ptr [eax+10]
:0046C4DA 51                      push ecx
:0046C4DB FF15F4624800            call dword ptr [004862F4]
:0046C4E1 83C005                  add eax, 00000005
:0046C4E4 83F833                  cmp eax, 00000033
:0046C4E7 7D09                    jge 0046C4F2
:0046C4E9 C745F833000000          mov [ebp-08], 00000033
:0046C4F0 EB1F                    jmp 0046C511

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C4E7(C)
|
:0046C4F2 68486C4800              push 00486C48
:0046C4F7 6A00                    push 00000000
:0046C4F9 6811100000              push 00001011
:0046C4FE 8B55FC                  mov edx, dword ptr [ebp-04]
:0046C501 8B4210                  mov eax, dword ptr [edx+10]
:0046C504 50                      push eax
:0046C505 FF15F4624800            call dword ptr [004862F4]
:0046C50B 83C005                  add eax, 00000005
:0046C50E 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C4F0(U)
|
:0046C511 8B45F8                  mov eax, dword ptr [ebp-08]
:0046C514 83C036                  add eax, 00000036
:0046C517 EB1C                    jmp 0046C535

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C4C6(C)
|
:0046C519 68AD6B4800              push 00486BAD
:0046C51E 6A00                    push 00000000
:0046C520 6811100000              push 00001011
:0046C525 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046C528 8B5110                  mov edx, dword ptr [ecx+10]
:0046C52B 52                      push edx
:0046C52C FF15F4624800            call dword ptr [004862F4]
:0046C532 83C00A                  add eax, 0000000A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C517(U)
|
:0046C535 8BE5                    mov esp, ebp
:0046C537 5D                      pop ebp
:0046C538 C20400                  ret 0004


:0046C53B 55                      push ebp
:0046C53C 8BEC                    mov ebp, esp
:0046C53E 6AFF                    push FFFFFFFF
:0046C540 681E594800              push 0048591E
:0046C545 64A100000000            mov eax, dword ptr fs:[00000000]
:0046C54B 50                      push eax
:0046C54C 64892500000000          mov dword ptr fs:[00000000], esp
:0046C553 81EC88000000            sub esp, 00000088
:0046C559 898D6CFFFFFF            mov dword ptr [ebp+FFFFFF6C], ecx
:0046C55F C745E800000000          mov [ebp-18], 00000000
:0046C566 EB09                    jmp 0046C571

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C584(U)
|
:0046C568 8B45E8                  mov eax, dword ptr [ebp-18]
:0046C56B 83C001                  add eax, 00000001
:0046C56E 8945E8                  mov dword ptr [ebp-18], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C566(U)
|
:0046C571 837DE80E                cmp dword ptr [ebp-18], 0000000E
:0046C575 7D0F                    jge 0046C586
:0046C577 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0046C57A 83E901                  sub ecx, 00000001
:0046C57D 8B55E8                  mov edx, dword ptr [ebp-18]
:0046C580 894C9590                mov dword ptr [ebp+4*edx-70], ecx
:0046C584 EBE2                    jmp 0046C568

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C575(C)
|
:0046C586 8D4590                  lea eax, dword ptr [ebp-70]
:0046C589 50                      push eax
:0046C58A 6A0E                    push 0000000E
:0046C58C 8B8D6CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF6C]
:0046C592 E86477FFFF              call 00463CFB
:0046C597 C745C80F000000          mov [ebp-38], 0000000F
:0046C59E 8D4DEC                  lea ecx, dword ptr [ebp-14]
:0046C5A1 894DD4                  mov dword ptr [ebp-2C], ecx
:0046C5A4 C745E800000000          mov [ebp-18], 00000000
:0046C5AB EB09                    jmp 0046C5B6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C630(U)
|
:0046C5AD 8B55E8                  mov edx, dword ptr [ebp-18]
:0046C5B0 83C201                  add edx, 00000001
:0046C5B3 8955E8                  mov dword ptr [ebp-18], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C5AB(U)
|
:0046C5B6 8B856CFFFFFF            mov eax, dword ptr [ebp+FFFFFF6C]
:0046C5BC 33C9                    xor ecx, ecx
:0046C5BE 8A4814                  mov cl, byte ptr [eax+14]
:0046C5C1 394DE8                  cmp dword ptr [ebp-18], ecx
:0046C5C4 7D6F                    jge 0046C635
:0046C5C6 8B55E8                  mov edx, dword ptr [ebp-18]
:0046C5C9 6BD205                  imul edx, 00000005
:0046C5CC 81C2A86B4800            add edx, 00486BA8
:0046C5D2 52                      push edx

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:0046C5D3 6844E74800              push 0048E744
:0046C5D8 8D45EC                  lea eax, dword ptr [ebp-14]
:0046C5DB 50                      push eax
:0046C5DC FF15C0624800            call dword ptr [004862C0]
:0046C5E2 83C40C                  add esp, 0000000C
:0046C5E5 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0046C5E8 51                      push ecx
:0046C5E9 8B956CFFFFFF            mov edx, dword ptr [ebp+FFFFFF6C]
:0046C5EF 8B02                    mov eax, dword ptr [edx]
:0046C5F1 8B8D6CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF6C]
:0046C5F7 FF5014                  call [eax+14]
:0046C5FA 8945D0                  mov dword ptr [ebp-30], eax
:0046C5FD 837DE800                cmp dword ptr [ebp-18], 00000000
:0046C601 7509                    jne 0046C60C
:0046C603 C745CC00000000          mov [ebp-34], 00000000
:0046C60A EB07                    jmp 0046C613

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C601(C)
|
:0046C60C C745CC02000000          mov [ebp-34], 00000002

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C60A(U)
|
:0046C613 8D4DC8                  lea ecx, dword ptr [ebp-38]
:0046C616 51                      push ecx
:0046C617 8B55E8                  mov edx, dword ptr [ebp-18]
:0046C61A 52                      push edx
:0046C61B 681B100000              push 0000101B
:0046C620 8B856CFFFFFF            mov eax, dword ptr [ebp+FFFFFF6C]
:0046C626 8B4810                  mov ecx, dword ptr [eax+10]
:0046C629 51                      push ecx
:0046C62A FF15F4624800            call dword ptr [004862F4]
:0046C630 E978FFFFFF              jmp 0046C5AD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C5C4(C)
|
:0046C635 8B956CFFFFFF            mov edx, dword ptr [ebp+FFFFFF6C]
:0046C63B C7421C00000000          mov [edx+1C], 00000000
:0046C642 833DD0684B0000          cmp dword ptr [004B68D0], 00000000
:0046C649 0F85CE000000            jne 0046C71D
:0046C64F 6A00                    push 00000000
:0046C651 6A1C                    push 0000001C
:0046C653 68FE000000              push 000000FE
:0046C658 6A30                    push 00000030
:0046C65A 6A30                    push 00000030
:0046C65C FF1500604800            call dword ptr [00486000]
:0046C662 A3D0684B00              mov dword ptr [004B68D0], eax
:0046C667 833DD0684B0000          cmp dword ptr [004B68D0], 00000000
:0046C66E 0F849C000000            je 0046C710

* Possible StringData Ref from Data Obj ->"MapAtr.dll"
                                  |
:0046C674 6848E74800              push 0048E748
:0046C679 E856C8FAFF              call 00418ED4
:0046C67E 83C404                  add esp, 00000004
:0046C681 50                      push eax
:0046C682 FF1524614800            call dword ptr [00486124]
:0046C688 89458C                  mov dword ptr [ebp-74], eax
:0046C68B 8D8D70FFFFFF            lea ecx, dword ptr [ebp+FFFFFF70]
:0046C691 E89AF1F9FF              call 0040B830
:0046C696 C745FC00000000          mov [ebp-04], 00000000
:0046C69D C745E800000000          mov [ebp-18], 00000000
:0046C6A4 EB09                    jmp 0046C6AF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C6F0(U)
|
:0046C6A6 8B45E8                  mov eax, dword ptr [ebp-18]
:0046C6A9 83C001                  add eax, 00000001
:0046C6AC 8945E8                  mov dword ptr [ebp-18], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C6A4(U)
|
:0046C6AF 837DE81C                cmp dword ptr [ebp-18], 0000001C
:0046C6B3 7D3D                    jge 0046C6F2
:0046C6B5 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0046C6B8 83C164                  add ecx, 00000064
:0046C6BB 51                      push ecx
:0046C6BC 8B558C                  mov edx, dword ptr [ebp-74]
:0046C6BF 52                      push edx
:0046C6C0 8D8D70FFFFFF            lea ecx, dword ptr [ebp+FFFFFF70]
:0046C6C6 E852D0F9FF              call 0040971D
:0046C6CB 6A00                    push 00000000
:0046C6CD 8D8D70FFFFFF            lea ecx, dword ptr [ebp+FFFFFF70]
:0046C6D3 E844DEF9FF              call 0040A51C
:0046C6D8 50                      push eax
:0046C6D9 A1D0684B00              mov eax, dword ptr [004B68D0]
:0046C6DE 50                      push eax
:0046C6DF FF1510604800            call dword ptr [00486010]
:0046C6E5 8D8D70FFFFFF            lea ecx, dword ptr [ebp+FFFFFF70]
:0046C6EB E8BAD5F9FF              call 00409CAA
:0046C6F0 EBB4                    jmp 0046C6A6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C6B3(C)
|
:0046C6F2 8B4D8C                  mov ecx, dword ptr [ebp-74]
:0046C6F5 51                      push ecx
:0046C6F6 FF151C614800            call dword ptr [0048611C]
:0046C6FC C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0046C703 8D8D70FFFFFF            lea ecx, dword ptr [ebp+FFFFFF70]
:0046C709 E882F1F9FF              call 0040B890
:0046C70E EB0D                    jmp 0046C71D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C66E(C)
|
:0046C710 68F06E4800              push 00486EF0
:0046C715 E8BD840000              call 00474BD7
:0046C71A 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046C649(C), :0046C70E(U)
|
:0046C71D 833DD0684B0000          cmp dword ptr [004B68D0], 00000000
:0046C724 742C                    je 0046C752
:0046C726 8B15D4684B00            mov edx, dword ptr [004B68D4]
:0046C72C 83C201                  add edx, 00000001
:0046C72F 8915D4684B00            mov dword ptr [004B68D4], edx
:0046C735 A1D0684B00              mov eax, dword ptr [004B68D0]
:0046C73A 50                      push eax
:0046C73B 6A01                    push 00000001
:0046C73D 6803100000              push 00001003
:0046C742 8B8D6CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF6C]
:0046C748 8B5110                  mov edx, dword ptr [ecx+10]
:0046C74B 52                      push edx
:0046C74C FF15F4624800            call dword ptr [004862F4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C724(C)
|
:0046C752 C745E800000000          mov [ebp-18], 00000000
:0046C759 EB09                    jmp 0046C764

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C785(U)
|
:0046C75B 8B45E8                  mov eax, dword ptr [ebp-18]
:0046C75E 83C001                  add eax, 00000001
:0046C761 8945E8                  mov dword ptr [ebp-18], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C759(U)
|
:0046C764 837DE81C                cmp dword ptr [ebp-18], 0000001C
:0046C768 7D1D                    jge 0046C787
:0046C76A 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0046C76D 51                      push ecx
:0046C76E 8B8D6CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF6C]
:0046C774 E847FCFAFF              call 0041C3C0
:0046C779 50                      push eax
:0046C77A 8B8D6CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF6C]
:0046C780 E8FE75FFFF              call 00463D83
:0046C785 EBD4                    jmp 0046C75B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C768(C)
|
:0046C787 8B8D6CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF6C]
:0046C78D E83B79FFFF              call 004640CD
:0046C792 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046C795 64890D00000000          mov dword ptr fs:[00000000], ecx
:0046C79C 8BE5                    mov esp, ebp
:0046C79E 5D                      pop ebp
:0046C79F C3                      ret


:0046C7A0 55                      push ebp
:0046C7A1 8BEC                    mov ebp, esp
:0046C7A3 83EC70                  sub esp, 00000070
:0046C7A6 894D94                  mov dword ptr [ebp-6C], ecx
:0046C7A9 8B4508                  mov eax, dword ptr [ebp+08]
:0046C7AC 8B4808                  mov ecx, dword ptr [eax+08]
:0046C7AF 51                      push ecx
:0046C7B0 8B4D94                  mov ecx, dword ptr [ebp-6C]
:0046C7B3 E8E477FFFF              call 00463F9C
:0046C7B8 8845A4                  mov byte ptr [ebp-5C], al
:0046C7BB 8B5508                  mov edx, dword ptr [ebp+08]
:0046C7BE 83C21C                  add edx, 0000001C
:0046C7C1 8B02                    mov eax, dword ptr [edx]
:0046C7C3 8945C8                  mov dword ptr [ebp-38], eax
:0046C7C6 8B4A04                  mov ecx, dword ptr [edx+04]
:0046C7C9 894DCC                  mov dword ptr [ebp-34], ecx
:0046C7CC 8B4208                  mov eax, dword ptr [edx+08]
:0046C7CF 8945D0                  mov dword ptr [ebp-30], eax
:0046C7D2 8B4A0C                  mov ecx, dword ptr [edx+0C]
:0046C7D5 894DD4                  mov dword ptr [ebp-2C], ecx
:0046C7D8 8B5508                  mov edx, dword ptr [ebp+08]
:0046C7DB 52                      push edx
:0046C7DC 8B4594                  mov eax, dword ptr [ebp-6C]
:0046C7DF 8B10                    mov edx, dword ptr [eax]
:0046C7E1 8B4D94                  mov ecx, dword ptr [ebp-6C]
:0046C7E4 FF5218                  call [edx+18]
:0046C7E7 C745A801000000          mov [ebp-58], 00000001
:0046C7EE C745A0FFFFFFFF          mov [ebp-60], FFFFFFFF
:0046C7F5 C7459C00000000          mov [ebp-64], 00000000
:0046C7FC C745F800000000          mov [ebp-08], 00000000
:0046C803 EB09                    jmp 0046C80E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046CB5D(U)
|
:0046C805 8B45F8                  mov eax, dword ptr [ebp-08]
:0046C808 83C001                  add eax, 00000001
:0046C80B 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C803(U)
|
:0046C80E 8B4D94                  mov ecx, dword ptr [ebp-6C]
:0046C811 33D2                    xor edx, edx
:0046C813 8A5114                  mov dl, byte ptr [ecx+14]
:0046C816 3955F8                  cmp dword ptr [ebp-08], edx
:0046C819 0F8D43030000            jnl 0046CB62
:0046C81F 8D45A8                  lea eax, dword ptr [ebp-58]
:0046C822 50                      push eax
:0046C823 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046C826 51                      push ecx
:0046C827 6819100000              push 00001019
:0046C82C 8B5594                  mov edx, dword ptr [ebp-6C]
:0046C82F 8B4210                  mov eax, dword ptr [edx+10]
:0046C832 50                      push eax
:0046C833 FF15F4624800            call dword ptr [004862F4]
:0046C839 C745FC24800000          mov [ebp-04], 00008024
:0046C840 8B4DAC                  mov ecx, dword ptr [ebp-54]
:0046C843 83E103                  and ecx, 00000003
:0046C846 894D90                  mov dword ptr [ebp-70], ecx
:0046C849 837D9000                cmp dword ptr [ebp-70], 00000000
:0046C84D 740E                    je 0046C85D
:0046C84F 837D9001                cmp dword ptr [ebp-70], 00000001
:0046C853 7410                    je 0046C865
:0046C855 837D9002                cmp dword ptr [ebp-70], 00000002
:0046C859 7414                    je 0046C86F
:0046C85B EB1D                    jmp 0046C87A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C84D(C)
|
:0046C85D 8B55FC                  mov edx, dword ptr [ebp-04]
:0046C860 8955FC                  mov dword ptr [ebp-04], edx
:0046C863 EB1B                    jmp 0046C880

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C853(C)
|
:0046C865 8B45FC                  mov eax, dword ptr [ebp-04]
:0046C868 0C02                    or al, 02
:0046C86A 8945FC                  mov dword ptr [ebp-04], eax
:0046C86D EB11                    jmp 0046C880

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C859(C)
|
:0046C86F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046C872 83C901                  or ecx, 00000001
:0046C875 894DFC                  mov dword ptr [ebp-04], ecx
:0046C878 EB06                    jmp 0046C880

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C85B(U)
|
:0046C87A 8B55FC                  mov edx, dword ptr [ebp-04]
:0046C87D 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046C863(U), :0046C86D(U), :0046C878(U)
|
:0046C880 6A00                    push 00000000
:0046C882 8B45F8                  mov eax, dword ptr [ebp-08]
:0046C885 50                      push eax
:0046C886 681D100000              push 0000101D
:0046C88B 8B4D94                  mov ecx, dword ptr [ebp-6C]
:0046C88E 8B5110                  mov edx, dword ptr [ecx+10]
:0046C891 52                      push edx
:0046C892 FF15F4624800            call dword ptr [004862F4]
:0046C898 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0046C89B 8D5401FB                lea edx, dword ptr [ecx+eax-05]
:0046C89F 8955D0                  mov dword ptr [ebp-30], edx
:0046C8A2 8B45C8                  mov eax, dword ptr [ebp-38]
:0046C8A5 83C005                  add eax, 00000005
:0046C8A8 8945C8                  mov dword ptr [ebp-38], eax
:0046C8AB 837DF800                cmp dword ptr [ebp-08], 00000000
:0046C8AF 0F85B5010000            jne 0046CA6A
:0046C8B5 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0046C8B8 83E905                  sub ecx, 00000005
:0046C8BB 894DC8                  mov dword ptr [ebp-38], ecx
:0046C8BE 6A00                    push 00000000
:0046C8C0 8B55CC                  mov edx, dword ptr [ebp-34]
:0046C8C3 52                      push edx
:0046C8C4 8B45C8                  mov eax, dword ptr [ebp-38]
:0046C8C7 83C001                  add eax, 00000001
:0046C8CA 50                      push eax
:0046C8CB 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046C8CE 8B5118                  mov edx, dword ptr [ecx+18]
:0046C8D1 52                      push edx
:0046C8D2 8B45A4                  mov eax, dword ptr [ebp-5C]
:0046C8D5 25FF000000              and eax, 000000FF
:0046C8DA 50                      push eax
:0046C8DB 6A00                    push 00000000
:0046C8DD 6A01                    push 00000001
:0046C8DF 6802100000              push 00001002
:0046C8E4 8B4D94                  mov ecx, dword ptr [ebp-6C]
:0046C8E7 8B5110                  mov edx, dword ptr [ecx+10]
:0046C8EA 52                      push edx
:0046C8EB FF15F4624800            call dword ptr [004862F4]
:0046C8F1 50                      push eax
:0046C8F2 FF150C604800            call dword ptr [0048600C]
:0046C8F8 8B45C8                  mov eax, dword ptr [ebp-38]
:0046C8FB 83C032                  add eax, 00000032
:0046C8FE 894598                  mov dword ptr [ebp-68], eax
:0046C901 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0046C904 83C135                  add ecx, 00000035
:0046C907 894DC8                  mov dword ptr [ebp-38], ecx
:0046C90A 8A55A4                  mov dl, byte ptr [ebp-5C]
:0046C90D 52                      push edx
:0046C90E E8A341FBFF              call 00420AB6
:0046C913 83C404                  add esp, 00000004
:0046C916 85C0                    test eax, eax
:0046C918 743E                    je 0046C958
:0046C91A 6A00                    push 00000000
:0046C91C 8B45CC                  mov eax, dword ptr [ebp-34]
:0046C91F 83C020                  add eax, 00000020
:0046C922 50                      push eax
:0046C923 8B4D98                  mov ecx, dword ptr [ebp-68]
:0046C926 51                      push ecx
:0046C927 8B5508                  mov edx, dword ptr [ebp+08]
:0046C92A 8B4218                  mov eax, dword ptr [edx+18]
:0046C92D 50                      push eax
:0046C92E B9C0F44A00              mov ecx, 004AF4C0
:0046C933 E8F8F9FAFF              call 0041C330
:0046C938 25FF000000              and eax, 000000FF
:0046C93D 50                      push eax
:0046C93E B90C2E4900              mov ecx, 00492E0C
:0046C943 E8282DFFFF              call 0045F670
:0046C948 50                      push eax
:0046C949 FF150C604800            call dword ptr [0048600C]
:0046C94F 8B4D98                  mov ecx, dword ptr [ebp-68]
:0046C952 83C111                  add ecx, 00000011
:0046C955 894D98                  mov dword ptr [ebp-68], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C918(C)
|
:0046C958 8A55A4                  mov dl, byte ptr [ebp-5C]
:0046C95B 52                      push edx
:0046C95C E8B641FBFF              call 00420B17
:0046C961 83C404                  add esp, 00000004
:0046C964 85C0                    test eax, eax
:0046C966 743E                    je 0046C9A6
:0046C968 6A00                    push 00000000
:0046C96A 8B45CC                  mov eax, dword ptr [ebp-34]
:0046C96D 83C020                  add eax, 00000020
:0046C970 50                      push eax
:0046C971 8B4D98                  mov ecx, dword ptr [ebp-68]
:0046C974 51                      push ecx
:0046C975 8B5508                  mov edx, dword ptr [ebp+08]
:0046C978 8B4218                  mov eax, dword ptr [edx+18]
:0046C97B 50                      push eax
:0046C97C B91EF64A00              mov ecx, 004AF61E
:0046C981 E8AAF9FAFF              call 0041C330
:0046C986 25FF000000              and eax, 000000FF
:0046C98B 50                      push eax
:0046C98C B90C2E4900              mov ecx, 00492E0C
:0046C991 E8DA2CFFFF              call 0045F670
:0046C996 50                      push eax
:0046C997 FF150C604800            call dword ptr [0048600C]
:0046C99D 8B4D98                  mov ecx, dword ptr [ebp-68]
:0046C9A0 83C111                  add ecx, 00000011
:0046C9A3 894D98                  mov dword ptr [ebp-68], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C966(C)
|
:0046C9A6 8A55A4                  mov dl, byte ptr [ebp-5C]
:0046C9A9 52                      push edx
:0046C9AA E8E941FBFF              call 00420B98
:0046C9AF 83C404                  add esp, 00000004
:0046C9B2 85C0                    test eax, eax
:0046C9B4 743E                    je 0046C9F4
:0046C9B6 6A00                    push 00000000
:0046C9B8 8B45CC                  mov eax, dword ptr [ebp-34]
:0046C9BB 83C020                  add eax, 00000020
:0046C9BE 50                      push eax
:0046C9BF 8B4D98                  mov ecx, dword ptr [ebp-68]
:0046C9C2 51                      push ecx
:0046C9C3 8B5508                  mov edx, dword ptr [ebp+08]
:0046C9C6 8B4218                  mov eax, dword ptr [edx+18]
:0046C9C9 50                      push eax
:0046C9CA B9DAF84A00              mov ecx, 004AF8DA
:0046C9CF E85CF9FAFF              call 0041C330
:0046C9D4 25FF000000              and eax, 000000FF
:0046C9D9 50                      push eax
:0046C9DA B90C2E4900              mov ecx, 00492E0C
:0046C9DF E88C2CFFFF              call 0045F670
:0046C9E4 50                      push eax
:0046C9E5 FF150C604800            call dword ptr [0048600C]
:0046C9EB 8B4D98                  mov ecx, dword ptr [ebp-68]
:0046C9EE 83C111                  add ecx, 00000011
:0046C9F1 894D98                  mov dword ptr [ebp-68], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C9B4(C)
|
:0046C9F4 8A55A4                  mov dl, byte ptr [ebp-5C]
:0046C9F7 52                      push edx
:0046C9F8 E84541FBFF              call 00420B42
:0046C9FD 83C404                  add esp, 00000004
:0046CA00 85C0                    test eax, eax
:0046CA02 743E                    je 0046CA42
:0046CA04 6A00                    push 00000000
:0046CA06 8B45CC                  mov eax, dword ptr [ebp-34]
:0046CA09 83C020                  add eax, 00000020
:0046CA0C 50                      push eax
:0046CA0D 8B4D98                  mov ecx, dword ptr [ebp-68]
:0046CA10 51                      push ecx
:0046CA11 8B5508                  mov edx, dword ptr [ebp+08]
:0046CA14 8B4218                  mov eax, dword ptr [edx+18]
:0046CA17 50                      push eax
:0046CA18 B97CF74A00              mov ecx, 004AF77C
:0046CA1D E80EF9FAFF              call 0041C330
:0046CA22 25FF000000              and eax, 000000FF
:0046CA27 50                      push eax
:0046CA28 B90C2E4900              mov ecx, 00492E0C
:0046CA2D E83E2CFFFF              call 0045F670
:0046CA32 50                      push eax
:0046CA33 FF150C604800            call dword ptr [0048600C]
:0046CA39 8B4D98                  mov ecx, dword ptr [ebp-68]
:0046CA3C 83C111                  add ecx, 00000011
:0046CA3F 894D98                  mov dword ptr [ebp-68], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046CA02(C)
|
:0046CA42 8B55A4                  mov edx, dword ptr [ebp-5C]
:0046CA45 81E2FF000000            and edx, 000000FF
:0046CA4B 8B0495B0BD4800          mov eax, dword ptr [4*edx+0048BDB0]
:0046CA52 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:0046CA53 6854E74800              push 0048E754
:0046CA58 8D4DD8                  lea ecx, dword ptr [ebp-28]
:0046CA5B 51                      push ecx
:0046CA5C FF15C0624800            call dword ptr [004862C0]
:0046CA62 83C40C                  add esp, 0000000C
:0046CA65 E989000000              jmp 0046CAF3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C8AF(C)
|
:0046CA6A 8A55A4                  mov dl, byte ptr [ebp-5C]
:0046CA6D 52                      push edx
:0046CA6E 8B4594                  mov eax, dword ptr [ebp-6C]
:0046CA71 8B4818                  mov ecx, dword ptr [eax+18]
:0046CA74 8B55F8                  mov edx, dword ptr [ebp-08]
:0046CA77 8A0491                  mov al, byte ptr [ecx+4*edx]
:0046CA7A 50                      push eax
:0046CA7B 8D4DD8                  lea ecx, dword ptr [ebp-28]
:0046CA7E 51                      push ecx
:0046CA7F 8B5594                  mov edx, dword ptr [ebp-6C]
:0046CA82 8B02                    mov eax, dword ptr [edx]
:0046CA84 8B4D94                  mov ecx, dword ptr [ebp-6C]
:0046CA87 FF5058                  call [eax+58]
:0046CA8A 50                      push eax
:0046CA8B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046CA8E 8B5118                  mov edx, dword ptr [ecx+18]
:0046CA91 52                      push edx
:0046CA92 FF1584604800            call dword ptr [00486084]
:0046CA98 8945A0                  mov dword ptr [ebp-60], eax

* Possible StringData Ref from Data Obj ->""
                                  |
:0046CA9B 6858E74800              push 0048E758
:0046CAA0 6A00                    push 00000000
:0046CAA2 6A00                    push 00000000
:0046CAA4 6A00                    push 00000000
:0046CAA6 6A04                    push 00000004
:0046CAA8 6886000000              push 00000086
:0046CAAD 6A00                    push 00000000
:0046CAAF 6A00                    push 00000000
:0046CAB1 6A00                    push 00000000
:0046CAB3 68BC020000              push 000002BC
:0046CAB8 6A00                    push 00000000
:0046CABA 6A00                    push 00000000
:0046CABC 6A00                    push 00000000
:0046CABE 6A3C                    push 0000003C
:0046CAC0 6A5A                    push 0000005A
:0046CAC2 8B4508                  mov eax, dword ptr [ebp+08]
:0046CAC5 8B4818                  mov ecx, dword ptr [eax+18]
:0046CAC8 51                      push ecx
:0046CAC9 FF153C604800            call dword ptr [0048603C]
:0046CACF 50                      push eax
:0046CAD0 6A09                    push 00000009
:0046CAD2 FF15E8604800            call dword ptr [004860E8]
:0046CAD8 6BC0FF                  imul eax, FFFFFFFF
:0046CADB 50                      push eax
:0046CADC FF1588604800            call dword ptr [00486088]
:0046CAE2 50                      push eax
:0046CAE3 8B5508                  mov edx, dword ptr [ebp+08]
:0046CAE6 8B4218                  mov eax, dword ptr [edx+18]
:0046CAE9 50                      push eax
:0046CAEA FF156C604800            call dword ptr [0048606C]
:0046CAF0 89459C                  mov dword ptr [ebp-64], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046CA65(U)
|
:0046CAF3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046CAF6 51                      push ecx
:0046CAF7 8D55C8                  lea edx, dword ptr [ebp-38]
:0046CAFA 52                      push edx
:0046CAFB 8D45D8                  lea eax, dword ptr [ebp-28]
:0046CAFE 50                      push eax
:0046CAFF 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046CB02 51                      push ecx
:0046CB03 8B4D94                  mov ecx, dword ptr [ebp-6C]
:0046CB06 E85782FFFF              call 00464D62
:0046CB0B 8B55D0                  mov edx, dword ptr [ebp-30]
:0046CB0E 83C205                  add edx, 00000005
:0046CB11 8955C8                  mov dword ptr [ebp-38], edx
:0046CB14 837DA0FF                cmp dword ptr [ebp-60], FFFFFFFF
:0046CB18 7418                    je 0046CB32
:0046CB1A 8B45A0                  mov eax, dword ptr [ebp-60]
:0046CB1D 50                      push eax
:0046CB1E 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046CB21 8B5118                  mov edx, dword ptr [ecx+18]
:0046CB24 52                      push edx
:0046CB25 FF1584604800            call dword ptr [00486084]
:0046CB2B C745A0FFFFFFFF          mov [ebp-60], FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046CB18(C)
|
:0046CB32 837D9C00                cmp dword ptr [ebp-64], 00000000
:0046CB36 7425                    je 0046CB5D
:0046CB38 8B459C                  mov eax, dword ptr [ebp-64]
:0046CB3B 50                      push eax
:0046CB3C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046CB3F 8B5118                  mov edx, dword ptr [ecx+18]
:0046CB42 52                      push edx
:0046CB43 FF156C604800            call dword ptr [0048606C]
:0046CB49 89459C                  mov dword ptr [ebp-64], eax
:0046CB4C 8B459C                  mov eax, dword ptr [ebp-64]
:0046CB4F 50                      push eax
:0046CB50 FF1548604800            call dword ptr [00486048]
:0046CB56 C7459C00000000          mov [ebp-64], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046CB36(C)
|
:0046CB5D E9A3FCFFFF              jmp 0046C805

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046C819(C)
|
:0046CB62 8BE5                    mov esp, ebp
:0046CB64 5D                      pop ebp
:0046CB65 C20400                  ret 0004


:0046CB68 55                      push ebp
:0046CB69 8BEC                    mov ebp, esp
:0046CB6B 83EC0C                  sub esp, 0000000C
:0046CB6E 56                      push esi
:0046CB6F 894DF8                  mov dword ptr [ebp-08], ecx
:0046CB72 C745FC00000000          mov [ebp-04], 00000000
:0046CB79 8B4510                  mov eax, dword ptr [ebp+10]
:0046CB7C 8945F4                  mov dword ptr [ebp-0C], eax
:0046CB7F 837DF4FF                cmp dword ptr [ebp-0C], FFFFFFFF
:0046CB83 7402                    je 0046CB87
:0046CB85 EB0B                    jmp 0046CB92

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046CB83(C)
|
:0046CB87 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046CB8A 2B4D0C                  sub ecx, dword ptr [ebp+0C]
:0046CB8D 894DFC                  mov dword ptr [ebp-04], ecx
:0046CB90 EB2D                    jmp 0046CBBF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046CB85(U)
|
:0046CB92 8A550C                  mov dl, byte ptr [ebp+0C]
:0046CB95 52                      push edx
:0046CB96 8A4510                  mov al, byte ptr [ebp+10]
:0046CB99 50                      push eax
:0046CB9A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046CB9D 8B11                    mov edx, dword ptr [ecx]
:0046CB9F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046CBA2 FF5254                  call [edx+54]
:0046CBA5 8BF0                    mov esi, eax
:0046CBA7 8A4508                  mov al, byte ptr [ebp+08]
:0046CBAA 50                      push eax
:0046CBAB 8A4D10                  mov cl, byte ptr [ebp+10]
:0046CBAE 51                      push ecx
:0046CBAF 8B55F8                  mov edx, dword ptr [ebp-08]
:0046CBB2 8B02                    mov eax, dword ptr [edx]
:0046CBB4 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046CBB7 FF5054                  call [eax+54]
:0046CBBA 2BF0                    sub esi, eax
:0046CBBC 8975FC                  mov dword ptr [ebp-04], esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046CB90(U)
|
:0046CBBF 8B45FC                  mov eax, dword ptr [ebp-04]
:0046CBC2 5E                      pop esi
:0046CBC3 8BE5                    mov esp, ebp
:0046CBC5 5D                      pop ebp
:0046CBC6 C20C00                  ret 000C


:0046CBC9 55                      push ebp
:0046CBCA 8BEC                    mov ebp, esp
:0046CBCC 51                      push ecx
:0046CBCD 894DFC                  mov dword ptr [ebp-04], ecx
:0046CBD0 833DD4684B0000          cmp dword ptr [004B68D4], 00000000
:0046CBD7 7E2D                    jle 0046CC06
:0046CBD9 A1D4684B00              mov eax, dword ptr [004B68D4]
:0046CBDE 83E801                  sub eax, 00000001
:0046CBE1 A3D4684B00              mov dword ptr [004B68D4], eax
:0046CBE6 833DD4684B0000          cmp dword ptr [004B68D4], 00000000
:0046CBED 7517                    jne 0046CC06
:0046CBEF 8B0DD0684B00            mov ecx, dword ptr [004B68D0]
:0046CBF5 51                      push ecx
:0046CBF6 FF1508604800            call dword ptr [00486008]
:0046CBFC C705D0684B0000000000    mov dword ptr [004B68D0], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046CBD7(C), :0046CBED(C)
|
:0046CC06 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046CC09 E8E183FFFF              call 00464FEF
:0046CC0E 8BE5                    mov esp, ebp
:0046CC10 5D                      pop ebp
:0046CC11 C3                      ret


:0046CC12 55                      push ebp
:0046CC13 8BEC                    mov ebp, esp
:0046CC15 51                      push ecx
:0046CC16 894DFC                  mov dword ptr [ebp-04], ecx
:0046CC19 8B450C                  mov eax, dword ptr [ebp+0C]
:0046CC1C 25FF000000              and eax, 000000FF
:0046CC21 50                      push eax
:0046CC22 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046CC25 81E1FF000000            and ecx, 000000FF
:0046CC2B 6BC93C                  imul ecx, 0000003C
:0046CC2E 81C1E0E44A00            add ecx, 004AE4E0
:0046CC34 E83764FDFF              call 00443070
:0046CC39 25FF000000              and eax, 000000FF
:0046CC3E 3DFF000000              cmp eax, 000000FF
:0046CC43 7428                    je 0046CC6D
:0046CC45 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046CC48 81E1FF000000            and ecx, 000000FF
:0046CC4E 51                      push ecx
:0046CC4F 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046CC52 81E1FF000000            and ecx, 000000FF
:0046CC58 6BC93C                  imul ecx, 0000003C
:0046CC5B 81C1E0E44A00            add ecx, 004AE4E0
:0046CC61 E82A64FDFF              call 00443090
:0046CC66 25FF000000              and eax, 000000FF
:0046CC6B EB02                    jmp 0046CC6F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046CC43(C)
|
:0046CC6D 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046CC6B(U)
|
:0046CC6F 8BE5                    mov esp, ebp
:0046CC71 5D                      pop ebp
:0046CC72 C20800                  ret 0008


:0046CC75 55                      push ebp
:0046CC76 8BEC                    mov ebp, esp
:0046CC78 83EC0C                  sub esp, 0000000C
:0046CC7B 894DF4                  mov dword ptr [ebp-0C], ecx
:0046CC7E 8A4510                  mov al, byte ptr [ebp+10]
:0046CC81 50                      push eax
:0046CC82 8A4D0C                  mov cl, byte ptr [ebp+0C]
:0046CC85 51                      push ecx
:0046CC86 8B55F4                  mov edx, dword ptr [ebp-0C]
:0046CC89 8B02                    mov eax, dword ptr [edx]
:0046CC8B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046CC8E FF5054                  call [eax+54]
:0046CC91 8945FC                  mov dword ptr [ebp-04], eax
:0046CC94 837DFC00                cmp dword ptr [ebp-04], 00000000
:0046CC98 7F1E                    jg 0046CCB8

* Possible StringData Ref from Data Obj ->"--"
                                  |
:0046CC9A 6860E74800              push 0048E760
:0046CC9F 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046CCA2 51                      push ecx
:0046CCA3 FF15C0624800            call dword ptr [004862C0]
:0046CCA9 83C408                  add esp, 00000008
:0046CCAC C745F81E000001          mov [ebp-08], 0100001E
:0046CCB3 E99D000000              jmp 0046CD55

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046CC98(C)
|
:0046CCB8 837DFC0C                cmp dword ptr [ebp-04], 0000000C
:0046CCBC 7C1B                    jl 0046CCD9

* Possible StringData Ref from Data Obj ->""
                                  |
:0046CCBE 6864E74800              push 0048E764
:0046CCC3 8B5508                  mov edx, dword ptr [ebp+08]
:0046CCC6 52                      push edx
:0046CCC7 FF15C0624800            call dword ptr [004862C0]
:0046CCCD 83C408                  add esp, 00000008
:0046CCD0 C745F824000001          mov [ebp-08], 01000024
:0046CCD7 EB7C                    jmp 0046CD55

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046CCBC(C)
|
:0046CCD9 837DFC0B                cmp dword ptr [ebp-04], 0000000B
:0046CCDD 7C1B                    jl 0046CCFA

* Possible StringData Ref from Data Obj ->""
                                  |
:0046CCDF 6868E74800              push 0048E768
:0046CCE4 8B4508                  mov eax, dword ptr [ebp+08]
:0046CCE7 50                      push eax
:0046CCE8 FF15C0624800            call dword ptr [004862C0]
:0046CCEE 83C408                  add esp, 00000008
:0046CCF1 C745F826000001          mov [ebp-08], 01000026
:0046CCF8 EB5B                    jmp 0046CD55

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046CCDD(C)
|
:0046CCFA 837DFC0A                cmp dword ptr [ebp-04], 0000000A
:0046CCFE 7C1B                    jl 0046CD1B

* Possible StringData Ref from Data Obj ->""
                                  |
:0046CD00 686CE74800              push 0048E76C
:0046CD05 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046CD08 51                      push ecx
:0046CD09 FF15C0624800            call dword ptr [004862C0]
:0046CD0F 83C408                  add esp, 00000008
:0046CD12 C745F85B000001          mov [ebp-08], 0100005B
:0046CD19 EB3A                    jmp 0046CD55

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046CCFE(C)
|
:0046CD1B 837DFC09                cmp dword ptr [ebp-04], 00000009
:0046CD1F 7C1B                    jl 0046CD3C

* Possible StringData Ref from Data Obj ->""
                                  |
:0046CD21 6870E74800              push 0048E770
:0046CD26 8B5508                  mov edx, dword ptr [ebp+08]
:0046CD29 52                      push edx
:0046CD2A FF15C0624800            call dword ptr [004862C0]
:0046CD30 83C408                  add esp, 00000008
:0046CD33 C745F83D000001          mov [ebp-08], 0100003D
:0046CD3A EB19                    jmp 0046CD55

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046CD1F(C)
|

* Possible StringData Ref from Data Obj ->""
                                  |
:0046CD3C 6874E74800              push 0048E774
:0046CD41 8B4508                  mov eax, dword ptr [ebp+08]
:0046CD44 50                      push eax
:0046CD45 FF15C0624800            call dword ptr [004862C0]
:0046CD4B 83C408                  add esp, 00000008
:0046CD4E C745F875000001          mov [ebp-08], 01000075

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046CCB3(U), :0046CCD7(U), :0046CCF8(U), :0046CD19(U), :0046CD3A(U)
|
:0046CD55 8B45F8                  mov eax, dword ptr [ebp-08]
:0046CD58 8BE5                    mov esp, ebp
:0046CD5A 5D                      pop ebp
:0046CD5B C20C00                  ret 000C


:0046CD5E 55                      push ebp
:0046CD5F 8BEC                    mov ebp, esp
:0046CD61 51                      push ecx
:0046CD62 894DFC                  mov dword ptr [ebp-04], ecx
:0046CD65 8B450C                  mov eax, dword ptr [ebp+0C]
:0046CD68 25FF000000              and eax, 000000FF
:0046CD6D 50                      push eax
:0046CD6E 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046CD71 81E1FF000000            and ecx, 000000FF
:0046CD77 6BC93C                  imul ecx, 0000003C
:0046CD7A 81C1E0E44A00            add ecx, 004AE4E0
:0046CD80 E8EB62FDFF              call 00443070
:0046CD85 25FF000000              and eax, 000000FF
:0046CD8A 8BE5                    mov esp, ebp
:0046CD8C 5D                      pop ebp
:0046CD8D C20800                  ret 0008


:0046CD90 55                      push ebp
:0046CD91 8BEC                    mov ebp, esp
:0046CD93 83EC0C                  sub esp, 0000000C
:0046CD96 894DF8                  mov dword ptr [ebp-08], ecx
:0046CD99 8A4510                  mov al, byte ptr [ebp+10]
:0046CD9C 50                      push eax
:0046CD9D 8A4D0C                  mov cl, byte ptr [ebp+0C]
:0046CDA0 51                      push ecx
:0046CDA1 8B55F8                  mov edx, dword ptr [ebp-08]
:0046CDA4 8B02                    mov eax, dword ptr [edx]
:0046CDA6 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046CDA9 FF5054                  call [eax+54]
:0046CDAC 8945FC                  mov dword ptr [ebp-04], eax
:0046CDAF 817DFCFF000000          cmp dword ptr [ebp-04], 000000FF
:0046CDB6 7418                    je 0046CDD0
:0046CDB8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046CDBB 51                      push ecx

* Possible StringData Ref from Data Obj ->"%d"
                                  |
:0046CDBC 6878E74800              push 0048E778
:0046CDC1 8B5508                  mov edx, dword ptr [ebp+08]
:0046CDC4 52                      push edx
:0046CDC5 FF15C0624800            call dword ptr [004862C0]
:0046CDCB 83C40C                  add esp, 0000000C
:0046CDCE EB12                    jmp 0046CDE2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046CDB6(C)
|

* Possible StringData Ref from Data Obj ->"--"
                                  |
:0046CDD0 687CE74800              push 0048E77C
:0046CDD5 8B4508                  mov eax, dword ptr [ebp+08]
:0046CDD8 50                      push eax
:0046CDD9 FF15C0624800            call dword ptr [004862C0]
:0046CDDF 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046CDCE(U)
|
:0046CDE2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046CDE5 894DF4                  mov dword ptr [ebp-0C], ecx
:0046CDE8 837DF401                cmp dword ptr [ebp-0C], 00000001
:0046CDEC 740E                    je 0046CDFC
:0046CDEE 837DF402                cmp dword ptr [ebp-0C], 00000002
:0046CDF2 740F                    je 0046CE03
:0046CDF4 837DF403                cmp dword ptr [ebp-0C], 00000003
:0046CDF8 7410                    je 0046CE0A
:0046CDFA EB15                    jmp 0046CE11

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046CDEC(C)
|
:0046CDFC B83D000001              mov eax, 0100003D
:0046CE01 EB13                    jmp 0046CE16

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046CDF2(C)
|
:0046CE03 B85B000001              mov eax, 0100005B
:0046CE08 EB0C                    jmp 0046CE16

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046CDF8(C)
|
:0046CE0A B826000001              mov eax, 01000026
:0046CE0F EB05                    jmp 0046CE16

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046CDFA(U)
|
:0046CE11 B81E000001              mov eax, 0100001E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046CE01(U), :0046CE08(U), :0046CE0F(U)
|
:0046CE16 8BE5                    mov esp, ebp
:0046CE18 5D                      pop ebp
:0046CE19 C20C00                  ret 000C


:0046CE1C 55                      push ebp
:0046CE1D 8BEC                    mov ebp, esp
:0046CE1F 817D0C10010000          cmp dword ptr [ebp+0C], 00000110
:0046CE26 7519                    jne 0046CE41
:0046CE28 8B4514                  mov eax, dword ptr [ebp+14]
:0046CE2B A3D8684B00              mov dword ptr [004B68D8], eax
:0046CE30 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046CE33 51                      push ecx
:0046CE34 8B0DD8684B00            mov ecx, dword ptr [004B68D8]
:0046CE3A E81128FFFF              call 0045F650
:0046CE3F EB3C                    jmp 0046CE7D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046CE26(C)
|
:0046CE41 837D0C02                cmp dword ptr [ebp+0C], 00000002
:0046CE45 7536                    jne 0046CE7D
:0046CE47 8B5514                  mov edx, dword ptr [ebp+14]
:0046CE4A 52                      push edx
:0046CE4B 8B4510                  mov eax, dword ptr [ebp+10]
:0046CE4E 50                      push eax
:0046CE4F 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046CE52 51                      push ecx
:0046CE53 8B5508                  mov edx, dword ptr [ebp+08]
:0046CE56 52                      push edx
:0046CE57 8B0DD8684B00            mov ecx, dword ptr [004B68D8]
:0046CE5D E8A0DBFFFF              call 0046AA02
:0046CE62 6A00                    push 00000000
:0046CE64 8B0DD8684B00            mov ecx, dword ptr [004B68D8]
:0046CE6A E8E127FFFF              call 0045F650
:0046CE6F C705D8684B0000000000    mov dword ptr [004B68D8], 00000000
:0046CE79 33C0                    xor eax, eax
:0046CE7B EB28                    jmp 0046CEA5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046CE3F(U), :0046CE45(C)
|
:0046CE7D 833DD8684B0000          cmp dword ptr [004B68D8], 00000000
:0046CE84 741D                    je 0046CEA3
:0046CE86 8B4514                  mov eax, dword ptr [ebp+14]
:0046CE89 50                      push eax
:0046CE8A 8B4D10                  mov ecx, dword ptr [ebp+10]
:0046CE8D 51                      push ecx
:0046CE8E 8B550C                  mov edx, dword ptr [ebp+0C]
:0046CE91 52                      push edx
:0046CE92 8B4508                  mov eax, dword ptr [ebp+08]
:0046CE95 50                      push eax
:0046CE96 8B0DD8684B00            mov ecx, dword ptr [004B68D8]
:0046CE9C E861DBFFFF              call 0046AA02
:0046CEA1 EB02                    jmp 0046CEA5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046CE84(C)
|
:0046CEA3 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046CE7B(U), :0046CEA1(U)
|
:0046CEA5 5D                      pop ebp
:0046CEA6 C21000                  ret 0010


:0046CEA9 55                      push ebp
:0046CEAA 8BEC                    mov ebp, esp
:0046CEAC 817D0C10010000          cmp dword ptr [ebp+0C], 00000110
:0046CEB3 7519                    jne 0046CECE
:0046CEB5 8B4514                  mov eax, dword ptr [ebp+14]
:0046CEB8 A3DC684B00              mov dword ptr [004B68DC], eax
:0046CEBD 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046CEC0 51                      push ecx
:0046CEC1 8B0DDC684B00            mov ecx, dword ptr [004B68DC]
:0046CEC7 E88427FFFF              call 0045F650
:0046CECC EB3C                    jmp 0046CF0A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046CEB3(C)
|
:0046CECE 837D0C02                cmp dword ptr [ebp+0C], 00000002
:0046CED2 7536                    jne 0046CF0A
:0046CED4 8B5514                  mov edx, dword ptr [ebp+14]
:0046CED7 52                      push edx
:0046CED8 8B4510                  mov eax, dword ptr [ebp+10]
:0046CEDB 50                      push eax
:0046CEDC 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046CEDF 51                      push ecx
:0046CEE0 8B5508                  mov edx, dword ptr [ebp+08]
:0046CEE3 52                      push edx
:0046CEE4 8B0DDC684B00            mov ecx, dword ptr [004B68DC]
:0046CEEA E8DFE8FFFF              call 0046B7CE
:0046CEEF 6A00                    push 00000000
:0046CEF1 8B0DDC684B00            mov ecx, dword ptr [004B68DC]
:0046CEF7 E85427FFFF              call 0045F650
:0046CEFC C705DC684B0000000000    mov dword ptr [004B68DC], 00000000
:0046CF06 33C0                    xor eax, eax
:0046CF08 EB28                    jmp 0046CF32

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046CECC(U), :0046CED2(C)
|
:0046CF0A 833DDC684B0000          cmp dword ptr [004B68DC], 00000000
:0046CF11 741D                    je 0046CF30
:0046CF13 8B4514                  mov eax, dword ptr [ebp+14]
:0046CF16 50                      push eax
:0046CF17 8B4D10                  mov ecx, dword ptr [ebp+10]
:0046CF1A 51                      push ecx
:0046CF1B 8B550C                  mov edx, dword ptr [ebp+0C]
:0046CF1E 52                      push edx
:0046CF1F 8B4508                  mov eax, dword ptr [ebp+08]
:0046CF22 50                      push eax
:0046CF23 8B0DDC684B00            mov ecx, dword ptr [004B68DC]
:0046CF29 E8A0E8FFFF              call 0046B7CE
:0046CF2E EB02                    jmp 0046CF32

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046CF11(C)
|
:0046CF30 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046CF08(U), :0046CF2E(U)
|
:0046CF32 5D                      pop ebp
:0046CF33 C21000                  ret 0010


:0046CF36 55                      push ebp
:0046CF37 8BEC                    mov ebp, esp
:0046CF39 817D0C10010000          cmp dword ptr [ebp+0C], 00000110
:0046CF40 7519                    jne 0046CF5B
:0046CF42 8B4514                  mov eax, dword ptr [ebp+14]
:0046CF45 A3E0684B00              mov dword ptr [004B68E0], eax
:0046CF4A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046CF4D 51                      push ecx
:0046CF4E 8B0DE0684B00            mov ecx, dword ptr [004B68E0]
:0046CF54 E8F726FFFF              call 0045F650
:0046CF59 EB3C                    jmp 0046CF97

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046CF40(C)
|
:0046CF5B 837D0C02                cmp dword ptr [ebp+0C], 00000002
:0046CF5F 7536                    jne 0046CF97
:0046CF61 8B5514                  mov edx, dword ptr [ebp+14]
:0046CF64 52                      push edx
:0046CF65 8B4510                  mov eax, dword ptr [ebp+10]
:0046CF68 50                      push eax
:0046CF69 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046CF6C 51                      push ecx
:0046CF6D 8B5508                  mov edx, dword ptr [ebp+08]
:0046CF70 52                      push edx
:0046CF71 8B0DE0684B00            mov ecx, dword ptr [004B68E0]
:0046CF77 E8E9F0FFFF              call 0046C065
:0046CF7C 6A00                    push 00000000
:0046CF7E 8B0DE0684B00            mov ecx, dword ptr [004B68E0]
:0046CF84 E8C726FFFF              call 0045F650
:0046CF89 C705E0684B0000000000    mov dword ptr [004B68E0], 00000000
:0046CF93 33C0                    xor eax, eax
:0046CF95 EB28                    jmp 0046CFBF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046CF59(U), :0046CF5F(C)
|
:0046CF97 833DE0684B0000          cmp dword ptr [004B68E0], 00000000
:0046CF9E 741D                    je 0046CFBD
:0046CFA0 8B4514                  mov eax, dword ptr [ebp+14]
:0046CFA3 50                      push eax
:0046CFA4 8B4D10                  mov ecx, dword ptr [ebp+10]
:0046CFA7 51                      push ecx
:0046CFA8 8B550C                  mov edx, dword ptr [ebp+0C]
:0046CFAB 52                      push edx
:0046CFAC 8B4508                  mov eax, dword ptr [ebp+08]
:0046CFAF 50                      push eax
:0046CFB0 8B0DE0684B00            mov ecx, dword ptr [004B68E0]
:0046CFB6 E8AAF0FFFF              call 0046C065
:0046CFBB EB02                    jmp 0046CFBF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046CF9E(C)
|
:0046CFBD 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046CF95(U), :0046CFBB(U)
|
:0046CFBF 5D                      pop ebp
:0046CFC0 C21000                  ret 0010


:0046CFC3 55                      push ebp
:0046CFC4 8BEC                    mov ebp, esp
:0046CFC6 83EC08                  sub esp, 00000008
:0046CFC9 8B4510                  mov eax, dword ptr [ebp+10]
:0046CFCC 8945F8                  mov dword ptr [ebp-08], eax
:0046CFCF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046CFD2 8B5108                  mov edx, dword ptr [ecx+08]
:0046CFD5 52                      push edx
:0046CFD6 8B450C                  mov eax, dword ptr [ebp+0C]
:0046CFD9 50                      push eax
:0046CFDA 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046CFDD 51                      push ecx
:0046CFDE 8B55F8                  mov edx, dword ptr [ebp-08]
:0046CFE1 8B0A                    mov ecx, dword ptr [edx]
:0046CFE3 8B45F8                  mov eax, dword ptr [ebp-08]
:0046CFE6 8B10                    mov edx, dword ptr [eax]
:0046CFE8 8B02                    mov eax, dword ptr [edx]
:0046CFEA FF501C                  call [eax+1C]
:0046CFED 8945FC                  mov dword ptr [ebp-04], eax
:0046CFF0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046CFF3 83790400                cmp dword ptr [ecx+04], 00000000
:0046CFF7 7409                    je 0046D002
:0046CFF9 8B55FC                  mov edx, dword ptr [ebp-04]
:0046CFFC 6BD2FF                  imul edx, FFFFFFFF
:0046CFFF 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046CFF7(C)
|
:0046D002 8B45FC                  mov eax, dword ptr [ebp-04]
:0046D005 8BE5                    mov esp, ebp
:0046D007 5D                      pop ebp
:0046D008 C20C00                  ret 000C


:0046D00B 55                      push ebp
:0046D00C 8BEC                    mov ebp, esp
:0046D00E 817D0C10010000          cmp dword ptr [ebp+0C], 00000110
:0046D015 7519                    jne 0046D030
:0046D017 8B4514                  mov eax, dword ptr [ebp+14]
:0046D01A A3E4684B00              mov dword ptr [004B68E4], eax
:0046D01F 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046D022 51                      push ecx
:0046D023 8B0DE4684B00            mov ecx, dword ptr [004B68E4]
:0046D029 E8025A0000              call 00472A30
:0046D02E EB3C                    jmp 0046D06C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046D015(C)
|
:0046D030 837D0C02                cmp dword ptr [ebp+0C], 00000002
:0046D034 7536                    jne 0046D06C
:0046D036 8B5514                  mov edx, dword ptr [ebp+14]
:0046D039 52                      push edx
:0046D03A 8B4510                  mov eax, dword ptr [ebp+10]
:0046D03D 50                      push eax
:0046D03E 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046D041 51                      push ecx
:0046D042 8B5508                  mov edx, dword ptr [ebp+08]
:0046D045 52                      push edx
:0046D046 8B0DE4684B00            mov ecx, dword ptr [004B68E4]
:0046D04C E896B0FFFF              call 004680E7
:0046D051 6A00                    push 00000000
:0046D053 8B0DE4684B00            mov ecx, dword ptr [004B68E4]
:0046D059 E8D2590000              call 00472A30
:0046D05E C705E4684B0000000000    mov dword ptr [004B68E4], 00000000
:0046D068 33C0                    xor eax, eax
:0046D06A EB28                    jmp 0046D094

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046D02E(U), :0046D034(C)
|
:0046D06C 833DE4684B0000          cmp dword ptr [004B68E4], 00000000
:0046D073 741D                    je 0046D092
:0046D075 8B4514                  mov eax, dword ptr [ebp+14]
:0046D078 50                      push eax
:0046D079 8B4D10                  mov ecx, dword ptr [ebp+10]
:0046D07C 51                      push ecx
:0046D07D 8B550C                  mov edx, dword ptr [ebp+0C]
:0046D080 52                      push edx
:0046D081 8B4508                  mov eax, dword ptr [ebp+08]
:0046D084 50                      push eax
:0046D085 8B0DE4684B00            mov ecx, dword ptr [004B68E4]
:0046D08B E857B0FFFF              call 004680E7
:0046D090 EB02                    jmp 0046D094

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046D073(C)
|
:0046D092 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046D06A(U), :0046D090(U)
|
:0046D094 5D                      pop ebp
:0046D095 C21000                  ret 0010



* Referenced by a CALL at Addresses:
|:0045BC1A   , :0046DC81   , :0046EB0F   , :0046EBBC   , :0046EE8B   
|:0046F013   , :0046F029   , :0046F0A1   , :0046F9AF   , :004700B9   
|:004700F8   , :00471095   , :00474E1E   
|
:0046D098 55                      push ebp
:0046D099 8BEC                    mov ebp, esp
:0046D09B 51                      push ecx
:0046D09C 894DFC                  mov dword ptr [ebp-04], ecx
:0046D09F 8B45FC                  mov eax, dword ptr [ebp-04]
:0046D0A2 50                      push eax

* Possible StringData Ref from Code Obj ->"Ujh3YH"
                                  |
:0046D0A3 68F8D04600              push 0046D0F8
:0046D0A8 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046D0AB 51                      push ecx
:0046D0AC 8B5508                  mov edx, dword ptr [ebp+08]
:0046D0AF 81E2FFFF0000            and edx, 0000FFFF
:0046D0B5 52                      push edx
:0046D0B6 A1606A4B00              mov eax, dword ptr [004B6A60]
:0046D0BB 50                      push eax
:0046D0BC FF15A0624800            call dword ptr [004862A0]
:0046D0C2 8BE5                    mov esp, ebp
:0046D0C4 5D                      pop ebp
:0046D0C5 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0046D3EE   , :00470234   , :00470EAF   
|
:0046D0C8 55                      push ebp
:0046D0C9 8BEC                    mov ebp, esp
:0046D0CB 51                      push ecx
:0046D0CC 894DFC                  mov dword ptr [ebp-04], ecx
:0046D0CF 8B45FC                  mov eax, dword ptr [ebp-04]
:0046D0D2 50                      push eax

* Possible StringData Ref from Code Obj ->"Ujh3YH"
                                  |
:0046D0D3 68F8D04600              push 0046D0F8
:0046D0D8 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046D0DB 51                      push ecx
:0046D0DC 8B5508                  mov edx, dword ptr [ebp+08]
:0046D0DF 81E2FFFF0000            and edx, 0000FFFF
:0046D0E5 52                      push edx
:0046D0E6 A1606A4B00              mov eax, dword ptr [004B6A60]
:0046D0EB 50                      push eax
:0046D0EC FF15B0624800            call dword ptr [004862B0]
:0046D0F2 8BE5                    mov esp, ebp
:0046D0F4 5D                      pop ebp
:0046D0F5 C20800                  ret 0008


:0046D0F8 55                      push ebp
:0046D0F9 8BEC                    mov ebp, esp
:0046D0FB 6AFF                    push FFFFFFFF
:0046D0FD 6833594800              push 00485933
:0046D102 64A100000000            mov eax, dword ptr fs:[00000000]
:0046D108 50                      push eax
:0046D109 64892500000000          mov dword ptr fs:[00000000], esp
:0046D110 83EC14                  sub esp, 00000014
:0046D113 8B450C                  mov eax, dword ptr [ebp+0C]
:0046D116 8945E4                  mov dword ptr [ebp-1C], eax
:0046D119 817DE410010000          cmp dword ptr [ebp-1C], 00000110
:0046D120 7402                    je 0046D124
:0046D122 EB69                    jmp 0046D18D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046D120(C)
|
:0046D124 833DE8684B0000          cmp dword ptr [004B68E8], 00000000
:0046D12B 7544                    jne 0046D171
:0046D12D 6A04                    push 00000004
:0046D12F E8AC3E0100              call 00480FE0
:0046D134 83C404                  add esp, 00000004
:0046D137 8945EC                  mov dword ptr [ebp-14], eax
:0046D13A C745FC00000000          mov [ebp-04], 00000000
:0046D141 837DEC00                cmp dword ptr [ebp-14], 00000000
:0046D145 740D                    je 0046D154
:0046D147 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0046D14A E871E7F9FF              call 0040B8C0
:0046D14F 8945E0                  mov dword ptr [ebp-20], eax
:0046D152 EB07                    jmp 0046D15B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046D145(C)
|
:0046D154 C745E000000000          mov [ebp-20], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046D152(U)
|
:0046D15B 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0046D15E 894DE8                  mov dword ptr [ebp-18], ecx
:0046D161 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0046D168 8B55E8                  mov edx, dword ptr [ebp-18]
:0046D16B 8915E8684B00            mov dword ptr [004B68E8], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046D12B(C)
|
:0046D171 8B4514                  mov eax, dword ptr [ebp+14]
:0046D174 50                      push eax
:0046D175 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046D178 51                      push ecx
:0046D179 8B0DE8684B00            mov ecx, dword ptr [004B68E8]
:0046D17F E8C953FFFF              call 0046254D
:0046D184 8B5514                  mov edx, dword ptr [ebp+14]
:0046D187 8B4508                  mov eax, dword ptr [ebp+08]
:0046D18A 894204                  mov dword ptr [edx+04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046D122(U)
|
:0046D18D 833DE8684B0000          cmp dword ptr [004B68E8], 00000000
:0046D194 742D                    je 0046D1C3
:0046D196 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0046D199 51                      push ecx
:0046D19A 8B5508                  mov edx, dword ptr [ebp+08]
:0046D19D 52                      push edx
:0046D19E 8B0DE8684B00            mov ecx, dword ptr [004B68E8]
:0046D1A4 E8A754FFFF              call 00462650
:0046D1A9 85C0                    test eax, eax
:0046D1AB 7416                    je 0046D1C3
:0046D1AD 8B4514                  mov eax, dword ptr [ebp+14]
:0046D1B0 50                      push eax
:0046D1B1 8B4D10                  mov ecx, dword ptr [ebp+10]
:0046D1B4 51                      push ecx
:0046D1B5 8B550C                  mov edx, dword ptr [ebp+0C]
:0046D1B8 52                      push edx
:0046D1B9 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046D1BC E86D000000              call 0046D22E
:0046D1C1 EB02                    jmp 0046D1C5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046D194(C), :0046D1AB(C)
|
:0046D1C3 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046D1C1(U)
|
:0046D1C5 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046D1C8 64890D00000000          mov dword ptr fs:[00000000], ecx
:0046D1CF 8BE5                    mov esp, ebp
:0046D1D1 5D                      pop ebp
:0046D1D2 C21000                  ret 0010



* Referenced by a CALL at Address:
|:0046EA0F   
|
:0046D1D5 55                      push ebp
:0046D1D6 8BEC                    mov ebp, esp
:0046D1D8 51                      push ecx
:0046D1D9 833DE8684B0000          cmp dword ptr [004B68E8], 00000000
:0046D1E0 7417                    je 0046D1F9
:0046D1E2 8D45FC                  lea eax, dword ptr [ebp-04]
:0046D1E5 50                      push eax
:0046D1E6 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046D1E9 51                      push ecx
:0046D1EA 8B0DE8684B00            mov ecx, dword ptr [004B68E8]
:0046D1F0 E85B54FFFF              call 00462650
:0046D1F5 85C0                    test eax, eax
:0046D1F7 7507                    jne 0046D200

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046D1E0(C)
|
:0046D1F9 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046D1F7(C)
|
:0046D200 8B45FC                  mov eax, dword ptr [ebp-04]
:0046D203 8BE5                    mov esp, ebp
:0046D205 5D                      pop ebp
:0046D206 C3                      ret



* Referenced by a CALL at Address:
|:0046E9F0   
|
:0046D207 55                      push ebp
:0046D208 8BEC                    mov ebp, esp
:0046D20A 51                      push ecx
:0046D20B 894DFC                  mov dword ptr [ebp-04], ecx
:0046D20E 8B45FC                  mov eax, dword ptr [ebp-04]
:0046D211 8B4804                  mov ecx, dword ptr [eax+04]
:0046D214 51                      push ecx
:0046D215 8B0DE8684B00            mov ecx, dword ptr [004B68E8]
:0046D21B E87654FFFF              call 00462696
:0046D220 8B55FC                  mov edx, dword ptr [ebp-04]
:0046D223 C7420400000000          mov [edx+04], 00000000
:0046D22A 8BE5                    mov esp, ebp
:0046D22C 5D                      pop ebp
:0046D22D C3                      ret



* Referenced by a CALL at Address:
|:0046D1BC   
|
:0046D22E 55                      push ebp
:0046D22F 8BEC                    mov ebp, esp
:0046D231 83EC0C                  sub esp, 0000000C
:0046D234 894DFC                  mov dword ptr [ebp-04], ecx
:0046D237 8B4508                  mov eax, dword ptr [ebp+08]
:0046D23A 8945F8                  mov dword ptr [ebp-08], eax
:0046D23D 817DF810010000          cmp dword ptr [ebp-08], 00000110
:0046D244 7718                    ja 0046D25E
:0046D246 817DF810010000          cmp dword ptr [ebp-08], 00000110
:0046D24D 7476                    je 0046D2C5
:0046D24F 837DF802                cmp dword ptr [ebp-08], 00000002
:0046D253 0F8487000000            je 0046D2E0
:0046D259 E954010000              jmp 0046D3B2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046D244(C)
|
:0046D25E 817DF835010000          cmp dword ptr [ebp-08], 00000135
:0046D265 771F                    ja 0046D286
:0046D267 817DF835010000          cmp dword ptr [ebp-08], 00000135
:0046D26E 0F8494000000            je 0046D308
:0046D274 817DF811010000          cmp dword ptr [ebp-08], 00000111
:0046D27B 0F84B7000000            je 0046D338
:0046D281 E92C010000              jmp 0046D3B2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046D265(C)
|
:0046D286 817DF80F030000          cmp dword ptr [ebp-08], 0000030F
:0046D28D 7724                    ja 0046D2B3
:0046D28F 817DF80F030000          cmp dword ptr [ebp-08], 0000030F
:0046D296 0F84DA000000            je 0046D376
:0046D29C 817DF836010000          cmp dword ptr [ebp-08], 00000136
:0046D2A3 747B                    je 0046D320
:0046D2A5 817DF838010000          cmp dword ptr [ebp-08], 00000138
:0046D2AC 7442                    je 0046D2F0
:0046D2AE E9FF000000              jmp 0046D3B2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046D28D(C)
|
:0046D2B3 817DF811030000          cmp dword ptr [ebp-08], 00000311
:0046D2BA 0F84DD000000            je 0046D39D
:0046D2C0 E9ED000000              jmp 0046D3B2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046D24D(C)
|
:0046D2C5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046D2C8 8B11                    mov edx, dword ptr [ecx]
:0046D2CA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046D2CD FF5208                  call [edx+08]
:0046D2D0 8B45FC                  mov eax, dword ptr [ebp-04]
:0046D2D3 8B10                    mov edx, dword ptr [eax]
:0046D2D5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046D2D8 FF520C                  call [edx+0C]
:0046D2DB E9EA000000              jmp 0046D3CA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046D253(C)
|
:0046D2E0 8B45FC                  mov eax, dword ptr [ebp-04]
:0046D2E3 8B10                    mov edx, dword ptr [eax]
:0046D2E5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046D2E8 FF5214                  call [edx+14]
:0046D2EB E9DA000000              jmp 0046D3CA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046D2AC(C)
|
:0046D2F0 8B4510                  mov eax, dword ptr [ebp+10]
:0046D2F3 50                      push eax
:0046D2F4 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046D2F7 51                      push ecx
:0046D2F8 8B55FC                  mov edx, dword ptr [ebp-04]
:0046D2FB 8B02                    mov eax, dword ptr [edx]
:0046D2FD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046D300 FF501C                  call [eax+1C]
:0046D303 E9C2000000              jmp 0046D3CA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046D26E(C)
|
:0046D308 8B4D10                  mov ecx, dword ptr [ebp+10]
:0046D30B 51                      push ecx
:0046D30C 8B550C                  mov edx, dword ptr [ebp+0C]
:0046D30F 52                      push edx
:0046D310 8B45FC                  mov eax, dword ptr [ebp-04]
:0046D313 8B10                    mov edx, dword ptr [eax]
:0046D315 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046D318 FF5220                  call [edx+20]
:0046D31B E9AA000000              jmp 0046D3CA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046D2A3(C)
|
:0046D320 8B4510                  mov eax, dword ptr [ebp+10]
:0046D323 50                      push eax
:0046D324 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046D327 51                      push ecx
:0046D328 8B55FC                  mov edx, dword ptr [ebp-04]
:0046D32B 8B02                    mov eax, dword ptr [edx]
:0046D32D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046D330 FF5018                  call [eax+18]
:0046D333 E992000000              jmp 0046D3CA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046D27B(C)
|
:0046D338 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046D33B 81E1FFFF0000            and ecx, 0000FFFF
:0046D341 894DF4                  mov dword ptr [ebp-0C], ecx
:0046D344 837DF402                cmp dword ptr [ebp-0C], 00000002
:0046D348 7402                    je 0046D34C
:0046D34A EB2A                    jmp 0046D376

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046D348(C)
|
:0046D34C 837D1000                cmp dword ptr [ebp+10], 00000000
:0046D350 7515                    jne 0046D367
:0046D352 8B55FC                  mov edx, dword ptr [ebp-04]
:0046D355 837A0800                cmp dword ptr [edx+08], 00000000
:0046D359 740C                    je 0046D367
:0046D35B 6A01                    push 00000001
:0046D35D B9B0694B00              mov ecx, 004B69B0
:0046D362 E846730000              call 004746AD

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046D350(C), :0046D359(C)
|
:0046D367 8B45FC                  mov eax, dword ptr [ebp-04]
:0046D36A 8B10                    mov edx, dword ptr [eax]
:0046D36C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046D36F FF5210                  call [edx+10]
:0046D372 33C0                    xor eax, eax
:0046D374 EB56                    jmp 0046D3CC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046D296(C), :0046D34A(U)
|
:0046D376 8B45FC                  mov eax, dword ptr [ebp-04]
:0046D379 8B4804                  mov ecx, dword ptr [eax+04]
:0046D37C 51                      push ecx
:0046D37D E8A9510000              call 0047252B
:0046D382 83C404                  add esp, 00000004
:0046D385 8B5510                  mov edx, dword ptr [ebp+10]
:0046D388 52                      push edx
:0046D389 8B450C                  mov eax, dword ptr [ebp+0C]
:0046D38C 50                      push eax
:0046D38D 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046D390 51                      push ecx
:0046D391 8B55FC                  mov edx, dword ptr [ebp-04]
:0046D394 8B02                    mov eax, dword ptr [edx]
:0046D396 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046D399 FF10                    call dword ptr [eax]
:0046D39B EB2F                    jmp 0046D3CC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046D2BA(C)
|
:0046D39D 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046D3A0 51                      push ecx
:0046D3A1 8B55FC                  mov edx, dword ptr [ebp-04]
:0046D3A4 8B4204                  mov eax, dword ptr [edx+04]
:0046D3A7 50                      push eax
:0046D3A8 E8D1510000              call 0047257E
:0046D3AD 83C408                  add esp, 00000008
:0046D3B0 EB18                    jmp 0046D3CA

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046D259(U), :0046D281(U), :0046D2AE(U), :0046D2C0(U)
|
:0046D3B2 8B4D10                  mov ecx, dword ptr [ebp+10]
:0046D3B5 51                      push ecx
:0046D3B6 8B550C                  mov edx, dword ptr [ebp+0C]
:0046D3B9 52                      push edx
:0046D3BA 8B4508                  mov eax, dword ptr [ebp+08]
:0046D3BD 50                      push eax
:0046D3BE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046D3C1 8B11                    mov edx, dword ptr [ecx]
:0046D3C3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046D3C6 FF12                    call dword ptr [edx]
:0046D3C8 EB02                    jmp 0046D3CC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046D2DB(U), :0046D2EB(U), :0046D303(U), :0046D31B(U), :0046D333(U)
|:0046D3B0(U)
|
:0046D3CA 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046D374(U), :0046D39B(U), :0046D3C8(U)
|
:0046D3CC 8BE5                    mov esp, ebp
:0046D3CE 5D                      pop ebp
:0046D3CF C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:0046DA64   , :0046DC59   
|
:0046D3D2 55                      push ebp
:0046D3D3 8BEC                    mov ebp, esp
:0046D3D5 51                      push ecx
:0046D3D6 894DFC                  mov dword ptr [ebp-04], ecx
:0046D3D9 8B45FC                  mov eax, dword ptr [ebp-04]
:0046D3DC 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046D3DF 894824                  mov dword ptr [eax+24], ecx
:0046D3E2 8B5508                  mov edx, dword ptr [ebp+08]
:0046D3E5 52                      push edx

* Possible Reference to Dialog: DialogID_0159 
                                  |
:0046D3E6 6859010000              push 00000159
:0046D3EB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046D3EE E8D5FCFFFF              call 0046D0C8
:0046D3F3 8BE5                    mov esp, ebp
:0046D3F5 5D                      pop ebp
:0046D3F6 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0046DA80   , :0046DCAD   
|
:0046D3F9 55                      push ebp
:0046D3FA 8BEC                    mov ebp, esp
:0046D3FC 51                      push ecx
:0046D3FD 894DFC                  mov dword ptr [ebp-04], ecx
:0046D400 8B45FC                  mov eax, dword ptr [ebp-04]
:0046D403 C7402800000000          mov [eax+28], 00000000
:0046D40A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046D40D 8B5104                  mov edx, dword ptr [ecx+04]
:0046D410 52                      push edx
:0046D411 FF159C634800            call dword ptr [0048639C]
:0046D417 50                      push eax
:0046D418 FF15CC624800            call dword ptr [004862CC]
:0046D41E 8B45FC                  mov eax, dword ptr [ebp-04]
:0046D421 8B4804                  mov ecx, dword ptr [eax+04]
:0046D424 51                      push ecx
:0046D425 FF1554624800            call dword ptr [00486254]
:0046D42B 8BE5                    mov esp, ebp
:0046D42D 5D                      pop ebp
:0046D42E C3                      ret


:0046D42F 55                      push ebp
:0046D430 8BEC                    mov ebp, esp
:0046D432 51                      push ecx
:0046D433 894DFC                  mov dword ptr [ebp-04], ecx
:0046D436 8BE5                    mov esp, ebp
:0046D438 5D                      pop ebp
:0046D439 C3                      ret



* Referenced by a CALL at Addresses:
|:0046DA70   , :0046DC71   , :0046DCFC   
|
:0046D43A 55                      push ebp
:0046D43B 8BEC                    mov ebp, esp
:0046D43D 83EC0C                  sub esp, 0000000C
:0046D440 894DF4                  mov dword ptr [ebp-0C], ecx
:0046D443 6A14                    push 00000014
:0046D445 E899F60000              call 0047CAE3
:0046D44A 83C404                  add esp, 00000004
:0046D44D E88911FBFF              call 0041E5DB
:0046D452 6A12                    push 00000012
:0046D454 6A00                    push 00000000
:0046D456 6A40                    push 00000040
:0046D458 A128694800              mov eax, dword ptr [00486928]
:0046D45D 2D94000000              sub eax, 00000094
:0046D462 50                      push eax
:0046D463 6A1B                    push 0000001B
:0046D465 6A71                    push 00000071
:0046D467 E83712FBFF              call 0041E6A3
:0046D46C 83C418                  add esp, 00000018
:0046D46F 6A1F                    push 0000001F
:0046D471 B9382F4900              mov ecx, 00492F38
:0046D476 E80918FAFF              call 0040EC84
:0046D47B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046D47E 894DFC                  mov dword ptr [ebp-04], ecx
:0046D481 C745F81F000000          mov [ebp-08], 0000001F
:0046D488 EB09                    jmp 0046D493

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046D4C0(U)
|
:0046D48A 8B55F8                  mov edx, dword ptr [ebp-08]
:0046D48D 83C214                  add edx, 00000014
:0046D490 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046D488(U)
|
:0046D493 8B45FC                  mov eax, dword ptr [ebp-04]
:0046D496 33C9                    xor ecx, ecx
:0046D498 8A08                    mov cl, byte ptr [eax]
:0046D49A 85C9                    test ecx, ecx
:0046D49C 7424                    je 0046D4C2
:0046D49E 837DF85B                cmp dword ptr [ebp-08], 0000005B
:0046D4A2 7D1E                    jge 0046D4C2
:0046D4A4 6A00                    push 00000000
:0046D4A6 8B55FC                  mov edx, dword ptr [ebp-04]
:0046D4A9 52                      push edx
:0046D4AA 8B45F8                  mov eax, dword ptr [ebp-08]
:0046D4AD 50                      push eax
:0046D4AE 6A0E                    push 0000000E
:0046D4B0 E8FBF3FBFF              call 0042C8B0
:0046D4B5 83C410                  add esp, 00000010
:0046D4B8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046D4BB 03C8                    add ecx, eax
:0046D4BD 894DFC                  mov dword ptr [ebp-04], ecx
:0046D4C0 EBC8                    jmp 0046D48A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046D49C(C), :0046D4A2(C)
|
:0046D4C2 E82F11FBFF              call 0041E5F6
:0046D4C7 6A00                    push 00000000
:0046D4C9 E815F60000              call 0047CAE3
:0046D4CE 83C404                  add esp, 00000004
:0046D4D1 8BE5                    mov esp, ebp
:0046D4D3 5D                      pop ebp
:0046D4D4 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0046DA78   , :0046DC98   
|
:0046D4D7 55                      push ebp
:0046D4D8 8BEC                    mov ebp, esp
:0046D4DA 83EC34                  sub esp, 00000034
:0046D4DD 894DD0                  mov dword ptr [ebp-30], ecx
:0046D4E0 6A00                    push 00000000
:0046D4E2 682C010000              push 0000012C
:0046D4E7 6A00                    push 00000000
:0046D4E9 8B45D0                  mov eax, dword ptr [ebp-30]
:0046D4EC 8B4804                  mov ecx, dword ptr [eax+04]
:0046D4EF 51                      push ecx
:0046D4F0 FF15A8634800            call dword ptr [004863A8]
:0046D4F6 8945D8                  mov dword ptr [ebp-28], eax
:0046D4F9 8B55D0                  mov edx, dword ptr [ebp-30]
:0046D4FC C7422801000000          mov [edx+28], 00000001
:0046D503 C745DC00000000          mov [ebp-24], 00000000
:0046D50A C745FC0A000000          mov [ebp-04], 0000000A
:0046D511 8B45FC                  mov eax, dword ptr [ebp-04]
:0046D514 8B0C85F07F4900          mov ecx, dword ptr [4*eax+00497FF0]
:0046D51B 51                      push ecx
:0046D51C FF1594624800            call dword ptr [00486294]
:0046D522 8945D4                  mov dword ptr [ebp-2C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046D60C(U), :0046D636(U), :0046D660(U), :0046D6B3(U), :0046D70D(U)
|
:0046D525 8B55D0                  mov edx, dword ptr [ebp-30]
:0046D528 837A2800                cmp dword ptr [edx+28], 00000000
:0046D52C 0F84E0010000            je 0046D712
:0046D532 6A00                    push 00000000
:0046D534 6A00                    push 00000000
:0046D536 6A00                    push 00000000
:0046D538 8D45E0                  lea eax, dword ptr [ebp-20]
:0046D53B 50                      push eax
:0046D53C FF150C634800            call dword ptr [0048630C]
:0046D542 85C0                    test eax, eax
:0046D544 0F84C8010000            je 0046D712
:0046D54A 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0046D54D 894DCC                  mov dword ptr [ebp-34], ecx
:0046D550 817DCCA2000000          cmp dword ptr [ebp-34], 000000A2
:0046D557 7714                    ja 0046D56D
:0046D559 817DCCA2000000          cmp dword ptr [ebp-34], 000000A2
:0046D560 744F                    je 0046D5B1
:0046D562 837DCC20                cmp dword ptr [ebp-34], 00000020
:0046D566 7458                    je 0046D5C0
:0046D568 E983010000              jmp 0046D6F0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046D557(C)
|
:0046D56D 817DCC13010000          cmp dword ptr [ebp-34], 00000113
:0046D574 771B                    ja 0046D591
:0046D576 817DCC13010000          cmp dword ptr [ebp-34], 00000113
:0046D57D 0F8435010000            je 0046D6B8
:0046D583 817DCCA5000000          cmp dword ptr [ebp-34], 000000A5
:0046D58A 7425                    je 0046D5B1
:0046D58C E95F010000              jmp 0046D6F0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046D574(C)
|
:0046D591 8B55CC                  mov edx, dword ptr [ebp-34]
:0046D594 81EA00020000            sub edx, 00000200
:0046D59A 8955CC                  mov dword ptr [ebp-34], edx
:0046D59D 837DCC05                cmp dword ptr [ebp-34], 00000005
:0046D5A1 0F8749010000            ja 0046D6F0
:0046D5A7 8B45CC                  mov eax, dword ptr [ebp-34]
:0046D5AA FF248531D74600          jmp dword ptr [4*eax+0046D731]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046D560(C), :0046D58A(C)
|
:0046D5B1 8B4DD0                  mov ecx, dword ptr [ebp-30]
:0046D5B4 C7412800000000          mov [ecx+28], 00000000
:0046D5BB E930010000              jmp 0046D6F0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046D566(C)
|
:0046D5C0 8B55EC                  mov edx, dword ptr [ebp-14]
:0046D5C3 C1EA10                  shr edx, 10
:0046D5C6 81E2FFFF0000            and edx, 0000FFFF
:0046D5CC 81E2FFFF0000            and edx, 0000FFFF
:0046D5D2 81FA05020000            cmp edx, 00000205
:0046D5D8 7417                    je 0046D5F1
:0046D5DA 8B45EC                  mov eax, dword ptr [ebp-14]
:0046D5DD C1E810                  shr eax, 10
:0046D5E0 25FFFF0000              and eax, 0000FFFF
:0046D5E5 25FFFF0000              and eax, 0000FFFF
:0046D5EA 3D02020000              cmp eax, 00000202
:0046D5EF 750A                    jne 0046D5FB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046D5D8(C)
|
:0046D5F1 8B4DD0                  mov ecx, dword ptr [ebp-30]
:0046D5F4 C7412800000000          mov [ecx+28], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046D5EF(C)
|
:0046D5FB 8B55FC                  mov edx, dword ptr [ebp-04]
:0046D5FE 8B0495F07F4900          mov eax, dword ptr [4*edx+00497FF0]
:0046D605 50                      push eax
:0046D606 FF1594624800            call dword ptr [00486294]
:0046D60C E914FFFFFF              jmp 0046D525
:0046D611 837DDC00                cmp dword ptr [ebp-24], 00000000
:0046D615 751F                    jne 0046D636
:0046D617 C745DC01000000          mov [ebp-24], 00000001
:0046D61E C745FC0B000000          mov [ebp-04], 0000000B
:0046D625 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046D628 8B148DF07F4900          mov edx, dword ptr [4*ecx+00497FF0]
:0046D62F 52                      push edx
:0046D630 FF1594624800            call dword ptr [00486294]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046D615(C)
|
:0046D636 E9EAFEFFFF              jmp 0046D525
:0046D63B 837DDC00                cmp dword ptr [ebp-24], 00000000
:0046D63F 751F                    jne 0046D660
:0046D641 C745DC01000000          mov [ebp-24], 00000001
:0046D648 C745FC0A000000          mov [ebp-04], 0000000A
:0046D64F 8B45FC                  mov eax, dword ptr [ebp-04]
:0046D652 8B0C85F07F4900          mov ecx, dword ptr [4*eax+00497FF0]
:0046D659 51                      push ecx
:0046D65A FF1594624800            call dword ptr [00486294]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046D63F(C)
|
:0046D660 E9C0FEFFFF              jmp 0046D525
:0046D665 8B55E8                  mov edx, dword ptr [ebp-18]
:0046D668 83E201                  and edx, 00000001
:0046D66B 83FA01                  cmp edx, 00000001
:0046D66E 7510                    jne 0046D680
:0046D670 C745DC01000000          mov [ebp-24], 00000001
:0046D677 C745FC0B000000          mov [ebp-04], 0000000B
:0046D67E EB22                    jmp 0046D6A2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046D66E(C)
|
:0046D680 8B45E8                  mov eax, dword ptr [ebp-18]
:0046D683 83E002                  and eax, 00000002
:0046D686 83F802                  cmp eax, 00000002
:0046D689 7510                    jne 0046D69B
:0046D68B C745DC01000000          mov [ebp-24], 00000001
:0046D692 C745FC0A000000          mov [ebp-04], 0000000A
:0046D699 EB07                    jmp 0046D6A2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046D689(C)
|
:0046D69B C745DC00000000          mov [ebp-24], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046D67E(U), :0046D699(U)
|
:0046D6A2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046D6A5 8B148DF07F4900          mov edx, dword ptr [4*ecx+00497FF0]
:0046D6AC 52                      push edx
:0046D6AD FF1594624800            call dword ptr [00486294]
:0046D6B3 E96DFEFFFF              jmp 0046D525

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046D57D(C)
|
:0046D6B8 8B45D0                  mov eax, dword ptr [ebp-30]
:0046D6BB 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0046D6BE 3B4804                  cmp ecx, dword ptr [eax+04]
:0046D6C1 752D                    jne 0046D6F0
:0046D6C3 837DDC00                cmp dword ptr [ebp-24], 00000000
:0046D6C7 7527                    jne 0046D6F0
:0046D6C9 837DFC0A                cmp dword ptr [ebp-04], 0000000A
:0046D6CD 7509                    jne 0046D6D8
:0046D6CF C745FC0B000000          mov [ebp-04], 0000000B
:0046D6D6 EB07                    jmp 0046D6DF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046D6CD(C)
|
:0046D6D8 C745FC0A000000          mov [ebp-04], 0000000A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046D6D6(U)
|
:0046D6DF 8B55FC                  mov edx, dword ptr [ebp-04]
:0046D6E2 8B0495F07F4900          mov eax, dword ptr [4*edx+00497FF0]
:0046D6E9 50                      push eax
:0046D6EA FF1594624800            call dword ptr [00486294]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046D568(U), :0046D58C(U), :0046D5A1(C), :0046D5BB(U), :0046D6C1(C)
|:0046D6C7(C)
|
:0046D6F0 8B4DD0                  mov ecx, dword ptr [ebp-30]
:0046D6F3 83792800                cmp dword ptr [ecx+28], 00000000
:0046D6F7 7414                    je 0046D70D
:0046D6F9 8D55E0                  lea edx, dword ptr [ebp-20]
:0046D6FC 52                      push edx
:0046D6FD FF1510634800            call dword ptr [00486310]
:0046D703 8D45E0                  lea eax, dword ptr [ebp-20]
:0046D706 50                      push eax
:0046D707 FF1514634800            call dword ptr [00486314]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046D6F7(C)
|
:0046D70D E913FEFFFF              jmp 0046D525

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046D52C(C), :0046D544(C)
|
:0046D712 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0046D715 51                      push ecx
:0046D716 FF1594624800            call dword ptr [00486294]
:0046D71C 8B55D8                  mov edx, dword ptr [ebp-28]
:0046D71F 52                      push edx
:0046D720 8B45D0                  mov eax, dword ptr [ebp-30]
:0046D723 8B4804                  mov ecx, dword ptr [eax+04]
:0046D726 51                      push ecx
:0046D727 FF1550624800            call dword ptr [00486250]
:0046D72D 8BE5                    mov esp, ebp
:0046D72F 5D                      pop ebp
:0046D730 C3                      ret



:0046D731 65D64600                DWORD 0046D665
:0046D735 11D64600                DWORD 0046D611
:0046D739 B1D54600                DWORD 0046D5B1
:0046D73D F0D64600                DWORD 0046D6F0
:0046D741 3BD64600                DWORD 0046D63B
:0046D745 B1D54600                DWORD 0046D5B1


:0046D749 55                      push ebp
:0046D74A 8BEC                    mov ebp, esp
:0046D74C 83EC0C                  sub esp, 0000000C
:0046D74F 894DF4                  mov dword ptr [ebp-0C], ecx
:0046D752 6A00                    push 00000000
:0046D754 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046D757 E894590000              call 004730F0
:0046D75C 6A14                    push 00000014
:0046D75E 6A00                    push 00000000
:0046D760 A12C694800              mov eax, dword ptr [0048692C]
:0046D765 83E804                  sub eax, 00000004
:0046D768 50                      push eax
:0046D769 8B0D28694800            mov ecx, dword ptr [00486928]
:0046D76F 83E904                  sub ecx, 00000004
:0046D772 51                      push ecx
:0046D773 6A01                    push 00000001
:0046D775 6A01                    push 00000001
:0046D777 B930694B00              mov ecx, 004B6930
:0046D77C E8815A0000              call 00473202
:0046D781 6A14                    push 00000014
:0046D783 E85BF30000              call 0047CAE3
:0046D788 83C404                  add esp, 00000004
:0046D78B E84B0EFBFF              call 0041E5DB
:0046D790 6A04                    push 00000004
:0046D792 6A00                    push 00000000
:0046D794 6A00                    push 00000000
:0046D796 B910114A00              mov ecx, 004A1110
:0046D79B E8A0220100              call 0047FA40
:0046D7A0 50                      push eax
:0046D7A1 8B55F4                  mov edx, dword ptr [ebp-0C]
:0046D7A4 8B4A24                  mov ecx, dword ptr [edx+24]
:0046D7A7 6BC948                  imul ecx, 00000048
:0046D7AA 81C1681B4A00            add ecx, 004A1B68
:0046D7B0 E8F29DF9FF              call 004075A7
:0046D7B5 50                      push eax
:0046D7B6 B938C54A00              mov ecx, 004AC538
:0046D7BB E8C924FBFF              call 0041FC89
:0046D7C0 B910114A00              mov ecx, 004A1110
:0046D7C5 E8C608FAFF              call 0040E090
:0046D7CA 50                      push eax
:0046D7CB 6A50                    push 00000050
:0046D7CD 6A40                    push 00000040
:0046D7CF 6A09                    push 00000009
:0046D7D1 6A09                    push 00000009
:0046D7D3 E8C3080100              call 0047E09B
:0046D7D8 83C414                  add esp, 00000014
:0046D7DB 6A3A                    push 0000003A
:0046D7DD B9382F4900              mov ecx, 00492F38
:0046D7E2 E89D14FAFF              call 0040EC84
:0046D7E7 6A00                    push 00000000
:0046D7E9 B9382F4900              mov ecx, 00492F38
:0046D7EE E8C914FAFF              call 0040ECBC

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0046D7F3 6A07                    push 00000007
:0046D7F5 6A0C                    push 0000000C
:0046D7F7 B9382F4900              mov ecx, 00492F38
:0046D7FC E8D613FAFF              call 0040EBD7
:0046D801 8B45F4                  mov eax, dword ptr [ebp-0C]
:0046D804 8B4824                  mov ecx, dword ptr [eax+24]
:0046D807 6BC948                  imul ecx, 00000048
:0046D80A 81C1681B4A00            add ecx, 004A1B68
:0046D810 E8429FF9FF              call 00407757
:0046D815 50                      push eax

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:0046D816 6880E74800              push 0048E780
:0046D81B 68382F4900              push 00492F38
:0046D820 E87B22FAFF              call 0040FAA0
:0046D825 83C40C                  add esp, 0000000C
:0046D828 6A00                    push 00000000
:0046D82A 6A1F                    push 0000001F
:0046D82C 6A04                    push 00000004
:0046D82E E8BEF90000              call 0047D1F1
:0046D833 83C40C                  add esp, 0000000C
:0046D836 6A04                    push 00000004
:0046D838 6A00                    push 00000000
:0046D83A 68C0980100              push 000198C0
:0046D83F B950EB4A00              mov ecx, 004AEB50
:0046D844 E8F7210100              call 0047FA40
:0046D849 50                      push eax
:0046D84A 6A10                    push 00000010
:0046D84C 6A10                    push 00000010
:0046D84E 6A3D                    push 0000003D
:0046D850 6A51                    push 00000051
:0046D852 E844080100              call 0047E09B
:0046D857 83C414                  add esp, 00000014
:0046D85A 6A04                    push 00000004
:0046D85C 6A00                    push 00000000
:0046D85E 68C09A0100              push 00019AC0
:0046D863 B950EB4A00              mov ecx, 004AEB50
:0046D868 E8D3210100              call 0047FA40
:0046D86D 50                      push eax
:0046D86E 6A40                    push 00000040
:0046D870 6A10                    push 00000010
:0046D872 6A1B                    push 0000001B
:0046D874 6A61                    push 00000061
:0046D876 E820080100              call 0047E09B
:0046D87B 83C414                  add esp, 00000014
:0046D87E 6A04                    push 00000004
:0046D880 6A00                    push 00000000
:0046D882 68C09E0100              push 00019EC0
:0046D887 B950EB4A00              mov ecx, 004AEB50
:0046D88C E8AF210100              call 0047FA40
:0046D891 50                      push eax
:0046D892 6A40                    push 00000040
:0046D894 6A10                    push 00000010
:0046D896 6A1B                    push 0000001B
:0046D898 8B0D28694800            mov ecx, dword ptr [00486928]
:0046D89E 83E923                  sub ecx, 00000023
:0046D8A1 51                      push ecx
:0046D8A2 E8F4070100              call 0047E09B
:0046D8A7 83C414                  add esp, 00000014
:0046D8AA 6A12                    push 00000012
:0046D8AC 6A00                    push 00000000
:0046D8AE 6A40                    push 00000040
:0046D8B0 8B1528694800            mov edx, dword ptr [00486928]
:0046D8B6 81EA94000000            sub edx, 00000094
:0046D8BC 52                      push edx
:0046D8BD 6A1B                    push 0000001B
:0046D8BF 6A71                    push 00000071
:0046D8C1 E8DD0DFBFF              call 0041E6A3
:0046D8C6 83C418                  add esp, 00000018
:0046D8C9 6A1F                    push 0000001F
:0046D8CB B9382F4900              mov ecx, 00492F38
:0046D8D0 E8AF13FAFF              call 0040EC84
:0046D8D5 E81C0DFBFF              call 0041E5F6
:0046D8DA 6A00                    push 00000000
:0046D8DC E802F20000              call 0047CAE3
:0046D8E1 83C404                  add esp, 00000004
:0046D8E4 8B45F4                  mov eax, dword ptr [ebp-0C]
:0046D8E7 8B4804                  mov ecx, dword ptr [eax+04]
:0046D8EA 51                      push ecx
:0046D8EB 8B151C604B00            mov edx, dword ptr [004B601C]
:0046D8F1 52                      push edx
:0046D8F2 FF157C634800            call dword ptr [0048637C]
:0046D8F8 6A00                    push 00000000
:0046D8FA A12C694800              mov eax, dword ptr [0048692C]
:0046D8FF 50                      push eax
:0046D900 8B0D28694800            mov ecx, dword ptr [00486928]
:0046D906 51                      push ecx
:0046D907 6A00                    push 00000000
:0046D909 6A00                    push 00000000
:0046D90B 8B151C604B00            mov edx, dword ptr [004B601C]
:0046D911 52                      push edx
:0046D912 FF15BC624800            call dword ptr [004862BC]
:0046D918 6A05                    push 00000005
:0046D91A A11C604B00              mov eax, dword ptr [004B601C]
:0046D91F 50                      push eax
:0046D920 FF15E0624800            call dword ptr [004862E0]
:0046D926 C745F810000000          mov [ebp-08], 00000010
:0046D92D C745FC38000000          mov [ebp-04], 00000038
:0046D934 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0046D937 51                      push ecx
:0046D938 8B15686A4B00            mov edx, dword ptr [004B6A68]
:0046D93E 52                      push edx
:0046D93F FF1520634800            call dword ptr [00486320]
:0046D945 6A04                    push 00000004
:0046D947 A12C694800              mov eax, dword ptr [0048692C]
:0046D94C 50                      push eax
:0046D94D 8B0D28694800            mov ecx, dword ptr [00486928]
:0046D953 51                      push ecx
:0046D954 8B55FC                  mov edx, dword ptr [ebp-04]
:0046D957 52                      push edx
:0046D958 8B45F8                  mov eax, dword ptr [ebp-08]
:0046D95B 50                      push eax
:0046D95C 6A00                    push 00000000
:0046D95E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046D961 8B5104                  mov edx, dword ptr [ecx+04]
:0046D964 52                      push edx
:0046D965 FF1580624800            call dword ptr [00486280]
:0046D96B 8BE5                    mov esp, ebp
:0046D96D 5D                      pop ebp
:0046D96E C3                      ret


:0046D96F 55                      push ebp
:0046D970 8BEC                    mov ebp, esp
:0046D972 51                      push ecx
:0046D973 894DFC                  mov dword ptr [ebp-04], ecx
:0046D976 6A00                    push 00000000
:0046D978 A11C604B00              mov eax, dword ptr [004B601C]
:0046D97D 50                      push eax
:0046D97E FF15E0624800            call dword ptr [004862E0]
:0046D984 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:0046D98A 51                      push ecx
:0046D98B 8B151C604B00            mov edx, dword ptr [004B601C]
:0046D991 52                      push edx
:0046D992 FF157C634800            call dword ptr [0048637C]
:0046D998 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046D99B E83B100000              call 0046E9DB
:0046D9A0 8BE5                    mov esp, ebp
:0046D9A2 5D                      pop ebp
:0046D9A3 C3                      ret



* Referenced by a CALL at Addresses:
|:004684BC   , :00468592   , :00468621   , :0046B150   , :0046B282   
|
:0046D9A4 55                      push ebp
:0046D9A5 8BEC                    mov ebp, esp
:0046D9A7 6AFF                    push FFFFFFFF
:0046D9A9 6852594800              push 00485952
:0046D9AE 64A100000000            mov eax, dword ptr fs:[00000000]
:0046D9B4 50                      push eax
:0046D9B5 64892500000000          mov dword ptr fs:[00000000], esp
:0046D9BC 81EC84000000            sub esp, 00000084
:0046D9C2 C745F000000000          mov [ebp-10], 00000000
:0046D9C9 E854DFF9FF              call 0040B922
:0046D9CE 85C0                    test eax, eax
:0046D9D0 750E                    jne 0046D9E0
:0046D9D2 B9386F4900              mov ecx, 00496F38
:0046D9D7 E8C8C6FAFF              call 0041A0A4
:0046D9DC 85C0                    test eax, eax
:0046D9DE 7456                    je 0046DA36

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046D9D0(C)
|
:0046D9E0 837D1400                cmp dword ptr [ebp+14], 00000000
:0046D9E4 7516                    jne 0046D9FC
:0046D9E6 6A01                    push 00000001
:0046D9E8 6A00                    push 00000000
:0046D9EA 8B4510                  mov eax, dword ptr [ebp+10]
:0046D9ED 50                      push eax
:0046D9EE 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046D9F1 51                      push ecx
:0046D9F2 E881710000              call 00474B78
:0046D9F7 83C410                  add esp, 00000010
:0046D9FA EB35                    jmp 0046DA31

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046D9E4(C)
|
:0046D9FC 837D1401                cmp dword ptr [ebp+14], 00000001
:0046DA00 7509                    jne 0046DA0B
:0046DA02 C745EC786E4800          mov [ebp-14], 00486E78
:0046DA09 EB0D                    jmp 0046DA18

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046DA00(C)
|
:0046DA0B 837D1402                cmp dword ptr [ebp+14], 00000002
:0046DA0F 7507                    jne 0046DA18
:0046DA11 C745EC806E4800          mov [ebp-14], 00486E80

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046DA09(U), :0046DA0F(C)
|
:0046DA18 6A01                    push 00000001
:0046DA1A 8B55EC                  mov edx, dword ptr [ebp-14]
:0046DA1D 52                      push edx
:0046DA1E 8B4510                  mov eax, dword ptr [ebp+10]
:0046DA21 50                      push eax
:0046DA22 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046DA25 51                      push ecx
:0046DA26 E8E4700000              call 00474B0F
:0046DA2B 83C410                  add esp, 00000010
:0046DA2E 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046D9FA(U)
|
:0046DA31 E9CC000000              jmp 0046DB02

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046D9DE(C)
|
:0046DA36 837D1400                cmp dword ptr [ebp+14], 00000000
:0046DA3A 755A                    jne 0046DA96
:0046DA3C 8D4DB0                  lea ecx, dword ptr [ebp-50]
:0046DA3F E88C540000              call 00472ED0
:0046DA44 C745FC00000000          mov [ebp-04], 00000000
:0046DA4B 8D55DC                  lea edx, dword ptr [ebp-24]
:0046DA4E 52                      push edx
:0046DA4F 8B4508                  mov eax, dword ptr [ebp+08]
:0046DA52 50                      push eax
:0046DA53 FF1598634800            call dword ptr [00486398]
:0046DA59 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046DA5C 51                      push ecx
:0046DA5D 8B5508                  mov edx, dword ptr [ebp+08]
:0046DA60 52                      push edx
:0046DA61 8D4DB0                  lea ecx, dword ptr [ebp-50]
:0046DA64 E869F9FFFF              call 0046D3D2
:0046DA69 8B4510                  mov eax, dword ptr [ebp+10]
:0046DA6C 50                      push eax
:0046DA6D 8D4DB0                  lea ecx, dword ptr [ebp-50]
:0046DA70 E8C5F9FFFF              call 0046D43A
:0046DA75 8D4DB0                  lea ecx, dword ptr [ebp-50]
:0046DA78 E85AFAFFFF              call 0046D4D7
:0046DA7D 8D4DB0                  lea ecx, dword ptr [ebp-50]
:0046DA80 E874F9FFFF              call 0046D3F9
:0046DA85 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0046DA8C 8D4DB0                  lea ecx, dword ptr [ebp-50]
:0046DA8F E8FC04FAFF              call 0040DF90
:0046DA94 EB6C                    jmp 0046DB02

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046DA3A(C)
|
:0046DA96 8D8D70FFFFFF            lea ecx, dword ptr [ebp+FFFFFF70]
:0046DA9C E8EF530000              call 00472E90
:0046DAA1 C745FC01000000          mov [ebp-04], 00000001
:0046DAA8 837D1401                cmp dword ptr [ebp+14], 00000001
:0046DAAC 751F                    jne 0046DACD
:0046DAAE 6A01                    push 00000001
:0046DAB0 8B4D10                  mov ecx, dword ptr [ebp+10]
:0046DAB3 51                      push ecx
:0046DAB4 8B5508                  mov edx, dword ptr [ebp+08]
:0046DAB7 52                      push edx

* Possible Reference to Dialog: DialogID_015A 
                                  |
:0046DAB8 685A010000              push 0000015A
:0046DABD 8D8D70FFFFFF            lea ecx, dword ptr [ebp+FFFFFF70]
:0046DAC3 E854010000              call 0046DC1C
:0046DAC8 8945F0                  mov dword ptr [ebp-10], eax
:0046DACB EB23                    jmp 0046DAF0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046DAAC(C)
|
:0046DACD 837D1402                cmp dword ptr [ebp+14], 00000002
:0046DAD1 751D                    jne 0046DAF0
:0046DAD3 6A00                    push 00000000
:0046DAD5 8B4510                  mov eax, dword ptr [ebp+10]
:0046DAD8 50                      push eax
:0046DAD9 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046DADC 51                      push ecx

* Possible Reference to Dialog: DialogID_015A 
                                  |
:0046DADD 685A010000              push 0000015A
:0046DAE2 8D8D70FFFFFF            lea ecx, dword ptr [ebp+FFFFFF70]
:0046DAE8 E82F010000              call 0046DC1C
:0046DAED 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046DACB(U), :0046DAD1(C)
|
:0046DAF0 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0046DAF7 8D8D70FFFFFF            lea ecx, dword ptr [ebp+FFFFFF70]
:0046DAFD E80E540000              call 00472F10

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046DA31(U), :0046DA94(U)
|
:0046DB02 8B45F0                  mov eax, dword ptr [ebp-10]
:0046DB05 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046DB08 64890D00000000          mov dword ptr fs:[00000000], ecx
:0046DB0F 8BE5                    mov esp, ebp
:0046DB11 5D                      pop ebp
:0046DB12 C3                      ret


:0046DB13 55                      push ebp
:0046DB14 8BEC                    mov ebp, esp
:0046DB16 83EC08                  sub esp, 00000008
:0046DB19 894DFC                  mov dword ptr [ebp-04], ecx
:0046DB1C 8B4508                  mov eax, dword ptr [ebp+08]
:0046DB1F 8945F8                  mov dword ptr [ebp-08], eax
:0046DB22 817DF811010000          cmp dword ptr [ebp-08], 00000111
:0046DB29 7402                    je 0046DB2D
:0046DB2B EB19                    jmp 0046DB46

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046DB29(C)
|
:0046DB2D 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046DB30 81E1FFFF0000            and ecx, 0000FFFF
:0046DB36 83F901                  cmp ecx, 00000001
:0046DB39 750B                    jne 0046DB46
:0046DB3B 8B55FC                  mov edx, dword ptr [ebp-04]
:0046DB3E 8B02                    mov eax, dword ptr [edx]
:0046DB40 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046DB43 FF5028                  call [eax+28]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046DB2B(U), :0046DB39(C)
|
:0046DB46 8B4D10                  mov ecx, dword ptr [ebp+10]
:0046DB49 51                      push ecx
:0046DB4A 8B550C                  mov edx, dword ptr [ebp+0C]
:0046DB4D 52                      push edx
:0046DB4E 8B4508                  mov eax, dword ptr [ebp+08]
:0046DB51 50                      push eax
:0046DB52 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046DB55 E8467D0000              call 004758A0
:0046DB5A 8BE5                    mov esp, ebp
:0046DB5C 5D                      pop ebp
:0046DB5D C20C00                  ret 000C


:0046DB60 55                      push ebp
:0046DB61 8BEC                    mov ebp, esp
:0046DB63 83EC2C                  sub esp, 0000002C
:0046DB66 894DD4                  mov dword ptr [ebp-2C], ecx
:0046DB69 8D45F0                  lea eax, dword ptr [ebp-10]
:0046DB6C 50                      push eax
:0046DB6D 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:0046DB73 51                      push ecx
:0046DB74 FF1598634800            call dword ptr [00486398]
:0046DB7A 8D55D8                  lea edx, dword ptr [ebp-28]
:0046DB7D 52                      push edx
:0046DB7E 8B45D4                  mov eax, dword ptr [ebp-2C]
:0046DB81 8B4804                  mov ecx, dword ptr [eax+04]
:0046DB84 51                      push ecx
:0046DB85 FF1598634800            call dword ptr [00486398]
:0046DB8B 8B45F8                  mov eax, dword ptr [ebp-08]
:0046DB8E 0345F0                  add eax, dword ptr [ebp-10]
:0046DB91 8B55E0                  mov edx, dword ptr [ebp-20]
:0046DB94 2B55D8                  sub edx, dword ptr [ebp-28]
:0046DB97 2BC2                    sub eax, edx
:0046DB99 99                      cdq
:0046DB9A 2BC2                    sub eax, edx
:0046DB9C D1F8                    sar eax, 1
:0046DB9E 8945EC                  mov dword ptr [ebp-14], eax
:0046DBA1 8B45FC                  mov eax, dword ptr [ebp-04]
:0046DBA4 0345F4                  add eax, dword ptr [ebp-0C]
:0046DBA7 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0046DBAA 2B4DDC                  sub ecx, dword ptr [ebp-24]
:0046DBAD 2BC1                    sub eax, ecx
:0046DBAF 99                      cdq
:0046DBB0 2BC2                    sub eax, edx
:0046DBB2 D1F8                    sar eax, 1
:0046DBB4 8945E8                  mov dword ptr [ebp-18], eax
:0046DBB7 8D55D8                  lea edx, dword ptr [ebp-28]
:0046DBBA 52                      push edx
:0046DBBB 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0046DBBE 83C10C                  add ecx, 0000000C
:0046DBC1 E8AAC5FAFF              call 0041A170
:0046DBC6 50                      push eax
:0046DBC7 FF1598634800            call dword ptr [00486398]
:0046DBCD 8B45E8                  mov eax, dword ptr [ebp-18]
:0046DBD0 3B45E4                  cmp eax, dword ptr [ebp-1C]
:0046DBD3 7D06                    jge 0046DBDB
:0046DBD5 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0046DBD8 894DE8                  mov dword ptr [ebp-18], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046DBD3(C)
|
:0046DBDB 6A05                    push 00000005
:0046DBDD 6A00                    push 00000000
:0046DBDF 6A00                    push 00000000
:0046DBE1 8B55E8                  mov edx, dword ptr [ebp-18]
:0046DBE4 52                      push edx
:0046DBE5 8B45EC                  mov eax, dword ptr [ebp-14]
:0046DBE8 50                      push eax
:0046DBE9 6A00                    push 00000000
:0046DBEB 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:0046DBEE 8B5104                  mov edx, dword ptr [ecx+04]
:0046DBF1 52                      push edx
:0046DBF2 FF1580624800            call dword ptr [00486280]
:0046DBF8 8BE5                    mov esp, ebp
:0046DBFA 5D                      pop ebp
:0046DBFB C3                      ret



* Referenced by a CALL at Address:
|:0046E13F   
|
:0046DBFC 55                      push ebp
:0046DBFD 8BEC                    mov ebp, esp
:0046DBFF 51                      push ecx
:0046DC00 894DFC                  mov dword ptr [ebp-04], ecx
:0046DC03 8B45FC                  mov eax, dword ptr [ebp-04]
:0046DC06 C7403801000000          mov [eax+38], 00000001
:0046DC0D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046DC10 8B11                    mov edx, dword ptr [ecx]
:0046DC12 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046DC15 FF5210                  call [edx+10]
:0046DC18 8BE5                    mov esp, ebp
:0046DC1A 5D                      pop ebp
:0046DC1B C3                      ret



* Referenced by a CALL at Addresses:
|:0046DAC3   , :0046DAE8   , :0046DDD5   
|
:0046DC1C 55                      push ebp
:0046DC1D 8BEC                    mov ebp, esp
:0046DC1F 83EC0C                  sub esp, 0000000C
:0046DC22 894DF4                  mov dword ptr [ebp-0C], ecx
:0046DC25 8B45F4                  mov eax, dword ptr [ebp-0C]
:0046DC28 8B4D14                  mov ecx, dword ptr [ebp+14]
:0046DC2B 89483C                  mov dword ptr [eax+3C], ecx
:0046DC2E B970074B00              mov ecx, 004B0770
:0046DC33 E857F6F9FF              call 0040D28F
:0046DC38 8AC8                    mov cl, al
:0046DC3A 81E1FF000000            and ecx, 000000FF
:0046DC40 6BC928                  imul ecx, 00000028
:0046DC43 81C168EB4A00            add ecx, 004AEB68
:0046DC49 E822C5FAFF              call 0041A170
:0046DC4E 50                      push eax
:0046DC4F 8B550C                  mov edx, dword ptr [ebp+0C]
:0046DC52 52                      push edx
:0046DC53 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046DC56 83C10C                  add ecx, 0000000C
:0046DC59 E874F7FFFF              call 0046D3D2
:0046DC5E 8945FC                  mov dword ptr [ebp-04], eax
:0046DC61 837D1000                cmp dword ptr [ebp+10], 00000000
:0046DC65 740F                    je 0046DC76
:0046DC67 8B4510                  mov eax, dword ptr [ebp+10]
:0046DC6A 50                      push eax
:0046DC6B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046DC6E 83C10C                  add ecx, 0000000C
:0046DC71 E8C4F7FFFF              call 0046D43A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046DC65(C)
|
:0046DC76 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046DC79 51                      push ecx
:0046DC7A 8B5508                  mov edx, dword ptr [ebp+08]
:0046DC7D 52                      push edx
:0046DC7E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046DC81 E812F4FFFF              call 0046D098
:0046DC86 8945F8                  mov dword ptr [ebp-08], eax
:0046DC89 8B45F4                  mov eax, dword ptr [ebp-0C]
:0046DC8C 83783800                cmp dword ptr [eax+38], 00000000
:0046DC90 7415                    je 0046DCA7
:0046DC92 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046DC95 83C10C                  add ecx, 0000000C
:0046DC98 E83AF8FFFF              call 0046D4D7
:0046DC9D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046DCA0 C7413800000000          mov [ecx+38], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046DC90(C)
|
:0046DCA7 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046DCAA 83C10C                  add ecx, 0000000C
:0046DCAD E847F7FFFF              call 0046D3F9
:0046DCB2 8B45F8                  mov eax, dword ptr [ebp-08]
:0046DCB5 8BE5                    mov esp, ebp
:0046DCB7 5D                      pop ebp
:0046DCB8 C21000                  ret 0010



* Referenced by a CALL at Addresses:
|:0046DE3A   , :0046DE8F   , :0046E0F7   , :0046E2E1   , :0046E320   
|
:0046DCBB 55                      push ebp
:0046DCBC 8BEC                    mov ebp, esp
:0046DCBE 81EC84000000            sub esp, 00000084
:0046DCC4 6A40                    push 00000040
:0046DCC6 6A00                    push 00000000
:0046DCC8 8D4580                  lea eax, dword ptr [ebp-80]
:0046DCCB 50                      push eax
:0046DCCC E85F2E0100              call 00480B30
:0046DCD1 83C40C                  add esp, 0000000C
:0046DCD4 8D4D10                  lea ecx, dword ptr [ebp+10]
:0046DCD7 898D7CFFFFFF            mov dword ptr [ebp+FFFFFF7C], ecx
:0046DCDD 8B957CFFFFFF            mov edx, dword ptr [ebp+FFFFFF7C]
:0046DCE3 52                      push edx
:0046DCE4 8B450C                  mov eax, dword ptr [ebp+0C]
:0046DCE7 50                      push eax
:0046DCE8 8D4D80                  lea ecx, dword ptr [ebp-80]
:0046DCEB 51                      push ecx
:0046DCEC FF155C634800            call dword ptr [0048635C]
:0046DCF2 8D5580                  lea edx, dword ptr [ebp-80]
:0046DCF5 52                      push edx
:0046DCF6 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046DCF9 83C10C                  add ecx, 0000000C
:0046DCFC E839F7FFFF              call 0046D43A
:0046DD01 8BE5                    mov esp, ebp
:0046DD03 5D                      pop ebp
:0046DD04 C3                      ret


:0046DD05 55                      push ebp
:0046DD06 8BEC                    mov ebp, esp
:0046DD08 51                      push ecx
:0046DD09 894DFC                  mov dword ptr [ebp-04], ecx
:0046DD0C 6A02                    push 00000002
:0046DD0E B9181B4B00              mov ecx, 004B1B18
:0046DD13 E82856F9FF              call 00403340
:0046DD18 E8C3E7FBFF              call 0042C4E0
:0046DD1D 8B45FC                  mov eax, dword ptr [ebp-04]
:0046DD20 83783C00                cmp dword ptr [eax+3C], 00000000
:0046DD24 7410                    je 0046DD36
:0046DD26 6A01                    push 00000001
:0046DD28 6A09                    push 00000009
:0046DD2A B9B0694B00              mov ecx, 004B69B0
:0046DD2F E846690000              call 0047467A
:0046DD34 EB0E                    jmp 0046DD44

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046DD24(C)
|
:0046DD36 6A01                    push 00000001
:0046DD38 6A0A                    push 0000000A
:0046DD3A B9B0694B00              mov ecx, 004B69B0
:0046DD3F E836690000              call 0047467A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046DD34(U)
|
:0046DD44 6A01                    push 00000001
:0046DD46 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046DD49 8B5104                  mov edx, dword ptr [ecx+04]
:0046DD4C 52                      push edx
:0046DD4D FF15D4624800            call dword ptr [004862D4]
:0046DD53 8BE5                    mov esp, ebp
:0046DD55 5D                      pop ebp
:0046DD56 C3                      ret



* Referenced by a CALL at Addresses:
|:004689B5   , :0046B500   
|
:0046DD57 55                      push ebp
:0046DD58 8BEC                    mov ebp, esp
:0046DD5A 51                      push ecx
:0046DD5B 894DFC                  mov dword ptr [ebp-04], ecx
:0046DD5E 8B45FC                  mov eax, dword ptr [ebp-04]
:0046DD61 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046DD64 894844                  mov dword ptr [eax+44], ecx
:0046DD67 8B55FC                  mov edx, dword ptr [ebp-04]
:0046DD6A C6424001                mov [edx+40], 01
:0046DD6E 8B45FC                  mov eax, dword ptr [ebp-04]
:0046DD71 8B4D14                  mov ecx, dword ptr [ebp+14]
:0046DD74 89483C                  mov dword ptr [eax+3C], ecx
:0046DD77 8B55FC                  mov edx, dword ptr [ebp-04]
:0046DD7A 8A4510                  mov al, byte ptr [ebp+10]
:0046DD7D 884241                  mov byte ptr [edx+41], al
:0046DD80 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046DD83 C741480A000000          mov [ecx+48], 0000000A
:0046DD8A 8B55FC                  mov edx, dword ptr [ebp-04]
:0046DD8D C6424C01                mov [edx+4C], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046DDBE(U)
|
:0046DD91 8B4510                  mov eax, dword ptr [ebp+10]
:0046DD94 25FF000000              and eax, 000000FF
:0046DD99 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046DD9C 394148                  cmp dword ptr [ecx+48], eax
:0046DD9F 771F                    ja 0046DDC0
:0046DDA1 8B55FC                  mov edx, dword ptr [ebp-04]
:0046DDA4 8B4248                  mov eax, dword ptr [edx+48]
:0046DDA7 6BC00A                  imul eax, 0000000A
:0046DDAA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046DDAD 894148                  mov dword ptr [ecx+48], eax
:0046DDB0 8B55FC                  mov edx, dword ptr [ebp-04]
:0046DDB3 8A424C                  mov al, byte ptr [edx+4C]
:0046DDB6 0401                    add al, 01
:0046DDB8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046DDBB 88414C                  mov byte ptr [ecx+4C], al
:0046DDBE EBD1                    jmp 0046DD91

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046DD9F(C)
|
:0046DDC0 8B55FC                  mov edx, dword ptr [ebp-04]
:0046DDC3 8B423C                  mov eax, dword ptr [edx+3C]
:0046DDC6 50                      push eax
:0046DDC7 6A00                    push 00000000
:0046DDC9 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046DDCC 51                      push ecx

* Possible Reference to Dialog: DialogID_0140 
                                  |
:0046DDCD 6840010000              push 00000140
:0046DDD2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046DDD5 E842FEFFFF              call 0046DC1C
:0046DDDA 8BE5                    mov esp, ebp
:0046DDDC 5D                      pop ebp
:0046DDDD C21000                  ret 0010



* Referenced by a CALL at Address:
|:0046E24D   
|
:0046DDE0 55                      push ebp
:0046DDE1 8BEC                    mov ebp, esp
:0046DDE3 51                      push ecx
:0046DDE4 56                      push esi
:0046DDE5 894DFC                  mov dword ptr [ebp-04], ecx
:0046DDE8 8B45FC                  mov eax, dword ptr [ebp-04]
:0046DDEB 83783C00                cmp dword ptr [eax+3C], 00000000
:0046DDEF 7453                    je 0046DE44
:0046DDF1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046DDF4 33D2                    xor edx, edx
:0046DDF6 8A5140                  mov dl, byte ptr [ecx+40]
:0046DDF9 8BF2                    mov esi, edx
:0046DDFB 8B45FC                  mov eax, dword ptr [ebp-04]
:0046DDFE 8B4844                  mov ecx, dword ptr [eax+44]
:0046DE01 6BC919                  imul ecx, 00000019
:0046DE04 81C140114A00            add ecx, 004A1140
:0046DE0A E86102FAFF              call 0040E070
:0046DE0F 0FAFF0                  imul esi, eax
:0046DE12 56                      push esi
:0046DE13 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046DE16 8B4944                  mov ecx, dword ptr [ecx+44]
:0046DE19 6BC919                  imul ecx, 00000019
:0046DE1C 81C140114A00            add ecx, 004A1140
:0046DE22 E8E918FFFF              call 0045F710
:0046DE27 50                      push eax
:0046DE28 8B55FC                  mov edx, dword ptr [ebp-04]
:0046DE2B 33C0                    xor eax, eax
:0046DE2D 8A4240                  mov al, byte ptr [edx+40]
:0046DE30 50                      push eax
:0046DE31 68686D4800              push 00486D68
:0046DE36 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046DE39 51                      push ecx
:0046DE3A E87CFEFFFF              call 0046DCBB
:0046DE3F 83C414                  add esp, 00000014
:0046DE42 EB53                    jmp 0046DE97

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046DDEF(C)
|
:0046DE44 8B55FC                  mov edx, dword ptr [ebp-04]
:0046DE47 33C0                    xor eax, eax
:0046DE49 8A4240                  mov al, byte ptr [edx+40]
:0046DE4C 8BF0                    mov esi, eax
:0046DE4E 6A00                    push 00000000
:0046DE50 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046DE53 8B4944                  mov ecx, dword ptr [ecx+44]
:0046DE56 6BC919                  imul ecx, 00000019
:0046DE59 81C140114A00            add ecx, 004A1140
:0046DE5F E845E9F9FF              call 0040C7A9
:0046DE64 0FAFF0                  imul esi, eax
:0046DE67 56                      push esi
:0046DE68 8B55FC                  mov edx, dword ptr [ebp-04]
:0046DE6B 8B4A44                  mov ecx, dword ptr [edx+44]
:0046DE6E 6BC919                  imul ecx, 00000019
:0046DE71 81C140114A00            add ecx, 004A1140
:0046DE77 E89418FFFF              call 0045F710
:0046DE7C 50                      push eax
:0046DE7D 8B45FC                  mov eax, dword ptr [ebp-04]
:0046DE80 33C9                    xor ecx, ecx
:0046DE82 8A4840                  mov cl, byte ptr [eax+40]
:0046DE85 51                      push ecx
:0046DE86 68886D4800              push 00486D88
:0046DE8B 8B55FC                  mov edx, dword ptr [ebp-04]
:0046DE8E 52                      push edx
:0046DE8F E827FEFFFF              call 0046DCBB
:0046DE94 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046DE42(U)
|
:0046DE97 5E                      pop esi
:0046DE98 8BE5                    mov esp, ebp
:0046DE9A 5D                      pop ebp
:0046DE9B C3                      ret


:0046DE9C 55                      push ebp
:0046DE9D 8BEC                    mov ebp, esp
:0046DE9F 83EC28                  sub esp, 00000028
:0046DEA2 894DE8                  mov dword ptr [ebp-18], ecx
:0046DEA5 8B4508                  mov eax, dword ptr [ebp+08]
:0046DEA8 8945E4                  mov dword ptr [ebp-1C], eax
:0046DEAB 837DE44E                cmp dword ptr [ebp-1C], 0000004E
:0046DEAF 0F84A8000000            je 0046DF5D
:0046DEB5 817DE411010000          cmp dword ptr [ebp-1C], 00000111
:0046DEBC 740E                    je 0046DECC
:0046DEBE 817DE415010000          cmp dword ptr [ebp-1C], 00000115
:0046DEC5 7469                    je 0046DF30
:0046DEC7 E9B7000000              jmp 0046DF83

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046DEBC(C)
|
:0046DECC 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046DECF 81E1FFFF0000            and ecx, 0000FFFF
:0046DED5 894DE0                  mov dword ptr [ebp-20], ecx
:0046DED8 817DE09D050000          cmp dword ptr [ebp-20], 0000059D
:0046DEDF 7402                    je 0046DEE3
:0046DEE1 EB4B                    jmp 0046DF2E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046DEDF(C)
|
:0046DEE3 8B550C                  mov edx, dword ptr [ebp+0C]
:0046DEE6 C1EA10                  shr edx, 10
:0046DEE9 81E2FFFF0000            and edx, 0000FFFF
:0046DEEF 81E2FFFF0000            and edx, 0000FFFF
:0046DEF5 8955DC                  mov dword ptr [ebp-24], edx
:0046DEF8 817DDC00030000          cmp dword ptr [ebp-24], 00000300
:0046DEFF 7402                    je 0046DF03
:0046DF01 EB2B                    jmp 0046DF2E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046DEFF(C)
|
:0046DF03 6A01                    push 00000001
:0046DF05 8D45F8                  lea eax, dword ptr [ebp-08]
:0046DF08 50                      push eax

* Possible Reference to Dialog: DialogID_014D, CONTROL_ID:059D, "Find: 50 / 50"
                                  |
:0046DF09 689D050000              push 0000059D
:0046DF0E 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0046DF11 8B5104                  mov edx, dword ptr [ecx+04]
:0046DF14 52                      push edx
:0046DF15 FF1574624800            call dword ptr [00486274]
:0046DF1B 8945F4                  mov dword ptr [ebp-0C], eax
:0046DF1E 8B45F8                  mov eax, dword ptr [ebp-08]
:0046DF21 50                      push eax
:0046DF22 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046DF25 51                      push ecx
:0046DF26 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0046DF29 E87E020000              call 0046E1AC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046DEE1(U), :0046DF01(U)
|
:0046DF2E EB53                    jmp 0046DF83

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046DEC5(C)
|
:0046DF30 6A01                    push 00000001
:0046DF32 8D55F0                  lea edx, dword ptr [ebp-10]
:0046DF35 52                      push edx

* Possible Reference to Dialog: DialogID_014D, CONTROL_ID:059D, "Find: 50 / 50"
                                  |
:0046DF36 689D050000              push 0000059D
:0046DF3B 8B45E8                  mov eax, dword ptr [ebp-18]
:0046DF3E 8B4804                  mov ecx, dword ptr [eax+04]
:0046DF41 51                      push ecx
:0046DF42 FF1574624800            call dword ptr [00486274]
:0046DF48 8945EC                  mov dword ptr [ebp-14], eax
:0046DF4B 8B55F0                  mov edx, dword ptr [ebp-10]
:0046DF4E 52                      push edx
:0046DF4F 8B45EC                  mov eax, dword ptr [ebp-14]
:0046DF52 50                      push eax
:0046DF53 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0046DF56 E851020000              call 0046E1AC
:0046DF5B EB26                    jmp 0046DF83

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046DEAF(C)
|
:0046DF5D 8B4D10                  mov ecx, dword ptr [ebp+10]
:0046DF60 894DFC                  mov dword ptr [ebp-04], ecx
:0046DF63 8B55FC                  mov edx, dword ptr [ebp-04]
:0046DF66 8B4208                  mov eax, dword ptr [edx+08]
:0046DF69 8945D8                  mov dword ptr [ebp-28], eax
:0046DF6C 817DD800010000          cmp dword ptr [ebp-28], 00000100
:0046DF73 7402                    je 0046DF77
:0046DF75 EB0C                    jmp 0046DF83

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046DF73(C)
|
:0046DF77 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046DF7A 8B11                    mov edx, dword ptr [ecx]
:0046DF7C 52                      push edx
:0046DF7D FF1508634800            call dword ptr [00486308]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046DEC7(U), :0046DF2E(U), :0046DF5B(U), :0046DF75(U)
|
:0046DF83 8B4510                  mov eax, dword ptr [ebp+10]
:0046DF86 50                      push eax
:0046DF87 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046DF8A 51                      push ecx
:0046DF8B 8B5508                  mov edx, dword ptr [ebp+08]
:0046DF8E 52                      push edx
:0046DF8F 8B45E8                  mov eax, dword ptr [ebp-18]
:0046DF92 8B10                    mov edx, dword ptr [eax]
:0046DF94 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0046DF97 FF5204                  call [edx+04]
:0046DF9A 8BE5                    mov esp, ebp
:0046DF9C 5D                      pop ebp
:0046DF9D C20C00                  ret 000C


:0046DFA0 55                      push ebp
:0046DFA1 8BEC                    mov ebp, esp
:0046DFA3 83EC10                  sub esp, 00000010
:0046DFA6 894DFC                  mov dword ptr [ebp-04], ecx
:0046DFA9 8B45FC                  mov eax, dword ptr [ebp-04]
:0046DFAC 33C9                    xor ecx, ecx
:0046DFAE 8A4841                  mov cl, byte ptr [eax+41]
:0046DFB1 51                      push ecx
:0046DFB2 6A00                    push 00000000
:0046DFB4 6865040000              push 00000465
:0046DFB9 689E050000              push 0000059E
:0046DFBE 8B55FC                  mov edx, dword ptr [ebp-04]
:0046DFC1 8B4204                  mov eax, dword ptr [edx+04]
:0046DFC4 50                      push eax
:0046DFC5 FF1590634800            call dword ptr [00486390]
:0046DFCB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046DFCE 33D2                    xor edx, edx
:0046DFD0 8A5141                  mov dl, byte ptr [ecx+41]
:0046DFD3 83FA01                  cmp edx, 00000001
:0046DFD6 7E09                    jle 0046DFE1
:0046DFD8 C745F801000000          mov [ebp-08], 00000001
:0046DFDF EB0B                    jmp 0046DFEC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046DFD6(C)
|
:0046DFE1 8B45FC                  mov eax, dword ptr [ebp-04]
:0046DFE4 33C9                    xor ecx, ecx
:0046DFE6 8A4841                  mov cl, byte ptr [eax+41]
:0046DFE9 894DF8                  mov dword ptr [ebp-08], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046DFDF(U)
|
:0046DFEC 8B55F8                  mov edx, dword ptr [ebp-08]
:0046DFEF 81E2FFFF0000            and edx, 0000FFFF
:0046DFF5 52                      push edx
:0046DFF6 6A00                    push 00000000
:0046DFF8 6867040000              push 00000467
:0046DFFD 689E050000              push 0000059E
:0046E002 8B45FC                  mov eax, dword ptr [ebp-04]
:0046E005 8B4804                  mov ecx, dword ptr [eax+04]
:0046E008 51                      push ecx
:0046E009 FF1590634800            call dword ptr [00486390]

* Possible Reference to Dialog: DialogID_014D, CONTROL_ID:059D, "Find: 50 / 50"
                                  |
:0046E00F 689D050000              push 0000059D
:0046E014 8B55FC                  mov edx, dword ptr [ebp-04]
:0046E017 8B4204                  mov eax, dword ptr [edx+04]
:0046E01A 50                      push eax
:0046E01B FF15DC624800            call dword ptr [004862DC]
:0046E021 50                      push eax
:0046E022 FF151C634800            call dword ptr [0048631C]
:0046E028 6A02                    push 00000002
:0046E02A 6A02                    push 00000002
:0046E02C 68B1000000              push 000000B1

* Possible Reference to Dialog: DialogID_014D, CONTROL_ID:059D, "Find: 50 / 50"
                                  |
:0046E031 689D050000              push 0000059D
:0046E036 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046E039 8B5104                  mov edx, dword ptr [ecx+04]
:0046E03C 52                      push edx
:0046E03D FF1590634800            call dword ptr [00486390]
:0046E043 6A01                    push 00000001
:0046E045 6A01                    push 00000001
:0046E047 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046E04A E85D010000              call 0046E1AC
:0046E04F 8B45FC                  mov eax, dword ptr [ebp-04]
:0046E052 83783C00                cmp dword ptr [eax+3C], 00000000
:0046E056 0F84EA000000            je 0046E146
:0046E05C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046E05F 33D2                    xor edx, edx
:0046E061 8A5141                  mov dl, byte ptr [ecx+41]
:0046E064 83FA01                  cmp edx, 00000001
:0046E067 7E09                    jle 0046E072
:0046E069 C745F401000000          mov [ebp-0C], 00000001
:0046E070 EB0B                    jmp 0046E07D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E067(C)
|
:0046E072 8B45FC                  mov eax, dword ptr [ebp-04]
:0046E075 33C9                    xor ecx, ecx
:0046E077 8A4841                  mov cl, byte ptr [eax+41]
:0046E07A 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E070(U)
|
:0046E07D 8B55FC                  mov edx, dword ptr [ebp-04]
:0046E080 33C0                    xor eax, eax
:0046E082 8A4241                  mov al, byte ptr [edx+41]
:0046E085 50                      push eax
:0046E086 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046E089 51                      push ecx
:0046E08A 68886E4800              push 00486E88
:0046E08F 689C050000              push 0000059C
:0046E094 8B55FC                  mov edx, dword ptr [ebp-04]
:0046E097 8B4204                  mov eax, dword ptr [edx+04]
:0046E09A 50                      push eax
:0046E09B FF15DC624800            call dword ptr [004862DC]
:0046E0A1 50                      push eax
:0046E0A2 E8353DFFFF              call 00461DDC
:0046E0A7 83C410                  add esp, 00000010
:0046E0AA 68786E4800              push 00486E78
:0046E0AF 6A01                    push 00000001
:0046E0B1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046E0B4 8B5104                  mov edx, dword ptr [ecx+04]
:0046E0B7 52                      push edx
:0046E0B8 FF15D8624800            call dword ptr [004862D8]
:0046E0BE 8B45FC                  mov eax, dword ptr [ebp-04]
:0046E0C1 8A4844                  mov cl, byte ptr [eax+44]
:0046E0C4 51                      push ecx
:0046E0C5 B970074B00              mov ecx, 004B0770
:0046E0CA E86FFAF9FF              call 0040DB3E
:0046E0CF 25FF000000              and eax, 000000FF
:0046E0D4 83F863                  cmp eax, 00000063
:0046E0D7 7C6B                    jl 0046E144
:0046E0D9 8B55FC                  mov edx, dword ptr [ebp-04]
:0046E0DC 8B4A44                  mov ecx, dword ptr [edx+44]
:0046E0DF 6BC919                  imul ecx, 00000019
:0046E0E2 81C140114A00            add ecx, 004A1140
:0046E0E8 E82316FFFF              call 0045F710
:0046E0ED 50                      push eax
:0046E0EE 68186E4800              push 00486E18
:0046E0F3 8B45FC                  mov eax, dword ptr [ebp-04]
:0046E0F6 50                      push eax
:0046E0F7 E8BFFBFFFF              call 0046DCBB
:0046E0FC 83C40C                  add esp, 0000000C
:0046E0FF 6A00                    push 00000000

* Possible Reference to Dialog: DialogID_014D, CONTROL_ID:059D, "Find: 50 / 50"
                                  |
:0046E101 689D050000              push 0000059D
:0046E106 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046E109 8B5104                  mov edx, dword ptr [ecx+04]
:0046E10C 52                      push edx
:0046E10D FF15DC624800            call dword ptr [004862DC]
:0046E113 50                      push eax
:0046E114 FF15E8624800            call dword ptr [004862E8]
:0046E11A 6A00                    push 00000000
:0046E11C 689C050000              push 0000059C
:0046E121 8B45FC                  mov eax, dword ptr [ebp-04]
:0046E124 8B4804                  mov ecx, dword ptr [eax+04]
:0046E127 51                      push ecx
:0046E128 FF15DC624800            call dword ptr [004862DC]
:0046E12E 50                      push eax
:0046E12F FF15E8624800            call dword ptr [004862E8]
:0046E135 8B55FC                  mov edx, dword ptr [ebp-04]
:0046E138 C6424000                mov [edx+40], 00
:0046E13C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046E13F E8B8FAFFFF              call 0046DBFC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E0D7(C)
|
:0046E144 EB62                    jmp 0046E1A8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E056(C)
|
:0046E146 8B45FC                  mov eax, dword ptr [ebp-04]
:0046E149 33C9                    xor ecx, ecx
:0046E14B 8A4841                  mov cl, byte ptr [eax+41]
:0046E14E 83F901                  cmp ecx, 00000001
:0046E151 7E09                    jle 0046E15C
:0046E153 C745F001000000          mov [ebp-10], 00000001
:0046E15A EB0B                    jmp 0046E167

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E151(C)
|
:0046E15C 8B55FC                  mov edx, dword ptr [ebp-04]
:0046E15F 33C0                    xor eax, eax
:0046E161 8A4241                  mov al, byte ptr [edx+41]
:0046E164 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E15A(U)
|
:0046E167 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046E16A 33D2                    xor edx, edx
:0046E16C 8A5141                  mov dl, byte ptr [ecx+41]
:0046E16F 52                      push edx
:0046E170 8B45F0                  mov eax, dword ptr [ebp-10]
:0046E173 50                      push eax
:0046E174 68A06E4800              push 00486EA0
:0046E179 689C050000              push 0000059C
:0046E17E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046E181 8B5104                  mov edx, dword ptr [ecx+04]
:0046E184 52                      push edx
:0046E185 FF15DC624800            call dword ptr [004862DC]
:0046E18B 50                      push eax
:0046E18C E84B3CFFFF              call 00461DDC
:0046E191 83C410                  add esp, 00000010
:0046E194 68806E4800              push 00486E80
:0046E199 6A01                    push 00000001
:0046E19B 8B45FC                  mov eax, dword ptr [ebp-04]
:0046E19E 8B4804                  mov ecx, dword ptr [eax+04]
:0046E1A1 51                      push ecx
:0046E1A2 FF15D8624800            call dword ptr [004862D8]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E144(U)
|
:0046E1A8 8BE5                    mov esp, ebp
:0046E1AA 5D                      pop ebp
:0046E1AB C3                      ret



* Referenced by a CALL at Addresses:
|:0046DF29   , :0046DF56   , :0046E04A   
|
:0046E1AC 55                      push ebp
:0046E1AD 8BEC                    mov ebp, esp
:0046E1AF 51                      push ecx
:0046E1B0 894DFC                  mov dword ptr [ebp-04], ecx
:0046E1B3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046E1B6 8B4508                  mov eax, dword ptr [ebp+08]
:0046E1B9 33D2                    xor edx, edx
:0046E1BB F77148                  div [ecx+48]
:0046E1BE 895508                  mov dword ptr [ebp+08], edx
:0046E1C1 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0046E1C5 0F84A4000000            je 0046E26F
:0046E1CB 837D0800                cmp dword ptr [ebp+08], 00000000
:0046E1CF 0F8E9A000000            jle 0046E26F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E1F9(U)
|
:0046E1D5 8B55FC                  mov edx, dword ptr [ebp-04]
:0046E1D8 33C0                    xor eax, eax
:0046E1DA 8A4241                  mov al, byte ptr [edx+41]
:0046E1DD 3B4508                  cmp eax, dword ptr [ebp+08]
:0046E1E0 7D19                    jge 0046E1FB
:0046E1E2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046E1E5 8B4148                  mov eax, dword ptr [ecx+48]
:0046E1E8 33D2                    xor edx, edx
:0046E1EA B90A000000              mov ecx, 0000000A
:0046E1EF F7F1                    div ecx
:0046E1F1 8B5508                  mov edx, dword ptr [ebp+08]
:0046E1F4 2BD0                    sub edx, eax
:0046E1F6 895508                  mov dword ptr [ebp+08], edx
:0046E1F9 EBDA                    jmp 0046E1D5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E1E0(C)
|
:0046E1FB 8B45FC                  mov eax, dword ptr [ebp-04]
:0046E1FE 8A4D08                  mov cl, byte ptr [ebp+08]
:0046E201 884840                  mov byte ptr [eax+40], cl
:0046E204 6A00                    push 00000000
:0046E206 8B55FC                  mov edx, dword ptr [ebp-04]
:0046E209 33C0                    xor eax, eax
:0046E20B 8A4240                  mov al, byte ptr [edx+40]
:0046E20E 50                      push eax

* Possible Reference to Dialog: DialogID_014D, CONTROL_ID:059D, "Find: 50 / 50"
                                  |
:0046E20F 689D050000              push 0000059D
:0046E214 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046E217 8B5104                  mov edx, dword ptr [ecx+04]
:0046E21A 52                      push edx
:0046E21B FF15E4624800            call dword ptr [004862E4]
:0046E221 8B45FC                  mov eax, dword ptr [ebp-04]
:0046E224 33C9                    xor ecx, ecx
:0046E226 8A484C                  mov cl, byte ptr [eax+4C]
:0046E229 51                      push ecx
:0046E22A 8B55FC                  mov edx, dword ptr [ebp-04]
:0046E22D 33C0                    xor eax, eax
:0046E22F 8A424C                  mov al, byte ptr [edx+4C]
:0046E232 50                      push eax
:0046E233 68B1000000              push 000000B1

* Possible Reference to Dialog: DialogID_014D, CONTROL_ID:059D, "Find: 50 / 50"
                                  |
:0046E238 689D050000              push 0000059D
:0046E23D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046E240 8B5104                  mov edx, dword ptr [ecx+04]
:0046E243 52                      push edx
:0046E244 FF1590634800            call dword ptr [00486390]
:0046E24A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046E24D E88EFBFFFF              call 0046DDE0
:0046E252 6A01                    push 00000001
:0046E254 6A01                    push 00000001
:0046E256 8B45FC                  mov eax, dword ptr [ebp-04]
:0046E259 8B4804                  mov ecx, dword ptr [eax+04]
:0046E25C 51                      push ecx
:0046E25D FF15DC624800            call dword ptr [004862DC]
:0046E263 50                      push eax
:0046E264 FF15E8624800            call dword ptr [004862E8]
:0046E26A E9B9000000              jmp 0046E328

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046E1C5(C), :0046E1CF(C)
|
:0046E26F 6828694B00              push 004B6928

* Possible Reference to Dialog: DialogID_014D, CONTROL_ID:059D, "Find: 50 / 50"
                                  |
:0046E274 689D050000              push 0000059D
:0046E279 8B55FC                  mov edx, dword ptr [ebp-04]
:0046E27C 8B4204                  mov eax, dword ptr [edx+04]
:0046E27F 50                      push eax
:0046E280 FF15D8624800            call dword ptr [004862D8]
:0046E286 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046E289 C6414000                mov [ecx+40], 00
:0046E28D 6A00                    push 00000000
:0046E28F 6A01                    push 00000001
:0046E291 8B55FC                  mov edx, dword ptr [ebp-04]
:0046E294 8B4204                  mov eax, dword ptr [edx+04]
:0046E297 50                      push eax
:0046E298 FF15DC624800            call dword ptr [004862DC]
:0046E29E 50                      push eax
:0046E29F FF15E8624800            call dword ptr [004862E8]
:0046E2A5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046E2A8 83793C00                cmp dword ptr [ecx+3C], 00000000
:0046E2AC 743D                    je 0046E2EB
:0046E2AE 8B55FC                  mov edx, dword ptr [ebp-04]
:0046E2B1 8B4A44                  mov ecx, dword ptr [edx+44]
:0046E2B4 6BC919                  imul ecx, 00000019
:0046E2B7 81C140114A00            add ecx, 004A1140
:0046E2BD E8AEFDF9FF              call 0040E070
:0046E2C2 50                      push eax
:0046E2C3 8B45FC                  mov eax, dword ptr [ebp-04]
:0046E2C6 8B4844                  mov ecx, dword ptr [eax+44]
:0046E2C9 6BC919                  imul ecx, 00000019
:0046E2CC 81C140114A00            add ecx, 004A1140
:0046E2D2 E83914FFFF              call 0045F710
:0046E2D7 50                      push eax
:0046E2D8 68A86D4800              push 00486DA8
:0046E2DD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046E2E0 51                      push ecx
:0046E2E1 E8D5F9FFFF              call 0046DCBB
:0046E2E6 83C410                  add esp, 00000010
:0046E2E9 EB3D                    jmp 0046E328

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E2AC(C)
|
:0046E2EB 6A00                    push 00000000
:0046E2ED 8B55FC                  mov edx, dword ptr [ebp-04]
:0046E2F0 8B4A44                  mov ecx, dword ptr [edx+44]
:0046E2F3 6BC919                  imul ecx, 00000019
:0046E2F6 81C140114A00            add ecx, 004A1140
:0046E2FC E8A8E4F9FF              call 0040C7A9
:0046E301 50                      push eax
:0046E302 8B45FC                  mov eax, dword ptr [ebp-04]
:0046E305 8B4844                  mov ecx, dword ptr [eax+44]
:0046E308 6BC919                  imul ecx, 00000019
:0046E30B 81C140114A00            add ecx, 004A1140
:0046E311 E8FA13FFFF              call 0045F710
:0046E316 50                      push eax
:0046E317 68C06D4800              push 00486DC0
:0046E31C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046E31F 51                      push ecx
:0046E320 E896F9FFFF              call 0046DCBB
:0046E325 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046E26A(U), :0046E2E9(U)
|
:0046E328 8BE5                    mov esp, ebp
:0046E32A 5D                      pop ebp
:0046E32B C20800                  ret 0008


:0046E32E 55                      push ebp
:0046E32F 8BEC                    mov ebp, esp
:0046E331 51                      push ecx
:0046E332 894DFC                  mov dword ptr [ebp-04], ecx
:0046E335 8B45FC                  mov eax, dword ptr [ebp-04]
:0046E338 83783C00                cmp dword ptr [eax+3C], 00000000
:0046E33C 751F                    jne 0046E35D
:0046E33E 6A02                    push 00000002
:0046E340 B9181B4B00              mov ecx, 004B1B18
:0046E345 E8F64FF9FF              call 00403340
:0046E34A E891E1FBFF              call 0042C4E0
:0046E34F 6A01                    push 00000001
:0046E351 6A0A                    push 0000000A
:0046E353 B9B0694B00              mov ecx, 004B69B0
:0046E358 E81D630000              call 0047467A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E33C(C)
|
:0046E35D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046E360 33D2                    xor edx, edx
:0046E362 8A5140                  mov dl, byte ptr [ecx+40]
:0046E365 52                      push edx
:0046E366 8B45FC                  mov eax, dword ptr [ebp-04]
:0046E369 8B4804                  mov ecx, dword ptr [eax+04]
:0046E36C 51                      push ecx
:0046E36D FF15D4624800            call dword ptr [004862D4]
:0046E373 8BE5                    mov esp, ebp
:0046E375 5D                      pop ebp
:0046E376 C3                      ret



* Referenced by a CALL at Addresses:
|:0040E46D   , :0047311A   
|
:0046E377 55                      push ebp
:0046E378 8BEC                    mov ebp, esp
:0046E37A 6AFF                    push FFFFFFFF
:0046E37C 6865594800              push 00485965
:0046E381 64A100000000            mov eax, dword ptr fs:[00000000]
:0046E387 50                      push eax
:0046E388 64892500000000          mov dword ptr fs:[00000000], esp
:0046E38F 51                      push ecx
:0046E390 894DF0                  mov dword ptr [ebp-10], ecx
:0046E393 8B45F0                  mov eax, dword ptr [ebp-10]
:0046E396 C700E0654800            mov dword ptr [eax], 004865E0
:0046E39C C745FC00000000          mov [ebp-04], 00000000
:0046E3A3 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046E3A6 E8D3030000              call 0046E77E
:0046E3AB C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0046E3B2 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046E3B5 E8E543FFFF              call 0046279F
:0046E3BA 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046E3BD 64890D00000000          mov dword ptr fs:[00000000], ecx
:0046E3C4 8BE5                    mov esp, ebp
:0046E3C6 5D                      pop ebp
:0046E3C7 C3                      ret


:0046E3C8 55                      push ebp
:0046E3C9 8BEC                    mov ebp, esp
:0046E3CB 83EC14                  sub esp, 00000014
:0046E3CE 894DF4                  mov dword ptr [ebp-0C], ecx
:0046E3D1 8B4508                  mov eax, dword ptr [ebp+08]
:0046E3D4 8945F0                  mov dword ptr [ebp-10], eax
:0046E3D7 817DF0A5000000          cmp dword ptr [ebp-10], 000000A5
:0046E3DE 771E                    ja 0046E3FE
:0046E3E0 817DF0A5000000          cmp dword ptr [ebp-10], 000000A5
:0046E3E7 745A                    je 0046E443
:0046E3E9 837DF020                cmp dword ptr [ebp-10], 00000020
:0046E3ED 7472                    je 0046E461
:0046E3EF 837DF021                cmp dword ptr [ebp-10], 00000021
:0046E3F3 0F84C6000000            je 0046E4BF
:0046E3F9 E908010000              jmp 0046E506

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E3DE(C)
|
:0046E3FE 817DF011010000          cmp dword ptr [ebp-10], 00000111
:0046E405 740E                    je 0046E415
:0046E407 817DF005020000          cmp dword ptr [ebp-10], 00000205
:0046E40E 7433                    je 0046E443
:0046E410 E9F1000000              jmp 0046E506

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E405(C)
|
:0046E415 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046E418 81E1FFFF0000            and ecx, 0000FFFF
:0046E41E 83F902                  cmp ecx, 00000002
:0046E421 751B                    jne 0046E43E
:0046E423 6A00                    push 00000000
:0046E425 6A02                    push 00000002
:0046E427 6811010000              push 00000111
:0046E42C 8B55F4                  mov edx, dword ptr [ebp-0C]
:0046E42F 8B4210                  mov eax, dword ptr [edx+10]
:0046E432 50                      push eax
:0046E433 FF15F4624800            call dword ptr [004862F4]
:0046E439 E9DF000000              jmp 0046E51D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E421(C)
|
:0046E43E E9C3000000              jmp 0046E506

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046E3E7(C), :0046E40E(C)
|
:0046E443 8B4D10                  mov ecx, dword ptr [ebp+10]
:0046E446 51                      push ecx
:0046E447 8B550C                  mov edx, dword ptr [ebp+0C]
:0046E44A 52                      push edx
:0046E44B 8B4508                  mov eax, dword ptr [ebp+08]
:0046E44E 50                      push eax
:0046E44F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046E452 8B5110                  mov edx, dword ptr [ecx+10]
:0046E455 52                      push edx
:0046E456 FF15F4624800            call dword ptr [004862F4]
:0046E45C E9A5000000              jmp 0046E506

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E3ED(C)
|
:0046E461 8B4510                  mov eax, dword ptr [ebp+10]
:0046E464 C1E810                  shr eax, 10
:0046E467 25FFFF0000              and eax, 0000FFFF
:0046E46C 25FFFF0000              and eax, 0000FFFF
:0046E471 8945EC                  mov dword ptr [ebp-14], eax
:0046E474 817DEC04020000          cmp dword ptr [ebp-14], 00000204
:0046E47B 7423                    je 0046E4A0
:0046E47D 817DEC05020000          cmp dword ptr [ebp-14], 00000205
:0046E484 7402                    je 0046E488
:0046E486 EB35                    jmp 0046E4BD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E484(C)
|
:0046E488 6A00                    push 00000000
:0046E48A 6A02                    push 00000002
:0046E48C 6811010000              push 00000111
:0046E491 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046E494 8B5110                  mov edx, dword ptr [ecx+10]
:0046E497 52                      push edx
:0046E498 FF15F4624800            call dword ptr [004862F4]
:0046E49E EB7D                    jmp 0046E51D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E47B(C)
|
:0046E4A0 8B4510                  mov eax, dword ptr [ebp+10]
:0046E4A3 50                      push eax
:0046E4A4 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046E4A7 51                      push ecx
:0046E4A8 8B5508                  mov edx, dword ptr [ebp+08]
:0046E4AB 52                      push edx
:0046E4AC 8B45F4                  mov eax, dword ptr [ebp-0C]
:0046E4AF 8B4810                  mov ecx, dword ptr [eax+10]
:0046E4B2 51                      push ecx
:0046E4B3 FF15F4624800            call dword ptr [004862F4]
:0046E4B9 33C0                    xor eax, eax
:0046E4BB EB60                    jmp 0046E51D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E486(U)
|
:0046E4BD EB47                    jmp 0046E506

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E3F3(C)
|
:0046E4BF 8B55F4                  mov edx, dword ptr [ebp-0C]
:0046E4C2 8B4210                  mov eax, dword ptr [edx+10]
:0046E4C5 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E4E8(U)
|
:0046E4C8 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046E4CB 51                      push ecx
:0046E4CC E815030000              call 0046E7E6
:0046E4D1 83C404                  add esp, 00000004
:0046E4D4 8945FC                  mov dword ptr [ebp-04], eax
:0046E4D7 837DFC00                cmp dword ptr [ebp-04], 00000000
:0046E4DB 740D                    je 0046E4EA
:0046E4DD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046E4E0 E8AB470000              call 00472C90
:0046E4E5 8945F8                  mov dword ptr [ebp-08], eax
:0046E4E8 EBDE                    jmp 0046E4C8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E4DB(C)
|
:0046E4EA FF1560624800            call dword ptr [00486260]
:0046E4F0 3945F8                  cmp dword ptr [ebp-08], eax
:0046E4F3 740A                    je 0046E4FF
:0046E4F5 8B55F8                  mov edx, dword ptr [ebp-08]
:0046E4F8 52                      push edx
:0046E4F9 FF15CC624800            call dword ptr [004862CC]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E4F3(C)
|
:0046E4FF B804000000              mov eax, 00000004
:0046E504 EB17                    jmp 0046E51D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046E3F9(U), :0046E410(U), :0046E43E(U), :0046E45C(U), :0046E4BD(U)
|
:0046E506 8B4510                  mov eax, dword ptr [ebp+10]
:0046E509 50                      push eax
:0046E50A 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046E50D 51                      push ecx
:0046E50E 8B5508                  mov edx, dword ptr [ebp+08]
:0046E511 52                      push edx
:0046E512 8B45F4                  mov eax, dword ptr [ebp-0C]
:0046E515 8B10                    mov edx, dword ptr [eax]
:0046E517 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046E51A FF5204                  call [edx+04]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046E439(U), :0046E49E(U), :0046E4BB(U), :0046E504(U)
|
:0046E51D 8BE5                    mov esp, ebp
:0046E51F 5D                      pop ebp
:0046E520 C20C00                  ret 000C



* Referenced by a CALL at Address:
|:0046E9BE   
|
:0046E523 55                      push ebp
:0046E524 8BEC                    mov ebp, esp
:0046E526 83EC10                  sub esp, 00000010
:0046E529 894DF0                  mov dword ptr [ebp-10], ecx
:0046E52C 837D0800                cmp dword ptr [ebp+08], 00000000
:0046E530 0F84C3000000            je 0046E5F9
:0046E536 8B45F0                  mov eax, dword ptr [ebp-10]
:0046E539 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046E53C 894810                  mov dword ptr [eax+10], ecx
:0046E53F 8B550C                  mov edx, dword ptr [ebp+0C]
:0046E542 52                      push edx
:0046E543 E89E020000              call 0046E7E6
:0046E548 83C404                  add esp, 00000004
:0046E54B 8945FC                  mov dword ptr [ebp-04], eax
:0046E54E 837DFC00                cmp dword ptr [ebp-04], 00000000
:0046E552 742E                    je 0046E582

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E572(C)
|
:0046E554 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046E557 E834470000              call 00472C90
:0046E55C 89450C                  mov dword ptr [ebp+0C], eax
:0046E55F 8B450C                  mov eax, dword ptr [ebp+0C]
:0046E562 50                      push eax
:0046E563 E87E020000              call 0046E7E6
:0046E568 83C404                  add esp, 00000004
:0046E56B 8945FC                  mov dword ptr [ebp-04], eax
:0046E56E 837DFC00                cmp dword ptr [ebp-04], 00000000
:0046E572 75E0                    jne 0046E554
:0046E574 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046E577 51                      push ecx
:0046E578 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046E57B E88C010000              call 0046E70C
:0046E580 EB77                    jmp 0046E5F9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E552(C)
|
:0046E582 8B550C                  mov edx, dword ptr [ebp+0C]
:0046E585 52                      push edx
:0046E586 E86E040000              call 0046E9F9
:0046E58B 83C404                  add esp, 00000004
:0046E58E 85C0                    test eax, eax
:0046E590 740E                    je 0046E5A0
:0046E592 8B450C                  mov eax, dword ptr [ebp+0C]
:0046E595 50                      push eax
:0046E596 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046E599 E86E010000              call 0046E70C
:0046E59E EB59                    jmp 0046E5F9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E590(C)
|
:0046E5A0 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046E5A3 894DFC                  mov dword ptr [ebp-04], ecx
:0046E5A6 8D55FC                  lea edx, dword ptr [ebp-04]
:0046E5A9 8955F8                  mov dword ptr [ebp-08], edx
:0046E5AC 8B45F8                  mov eax, dword ptr [ebp-08]
:0046E5AF 50                      push eax

* Possible StringData Ref from Code Obj ->"UjhzYH"
                                  |
:0046E5B0 68FFE54600              push 0046E5FF
:0046E5B5 6A00                    push 00000000
:0046E5B7 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046E5BA 51                      push ecx
:0046E5BB FF1584624800            call dword ptr [00486284]
:0046E5C1 50                      push eax
:0046E5C2 FF1504634800            call dword ptr [00486304]
:0046E5C8 8B550C                  mov edx, dword ptr [ebp+0C]
:0046E5CB 8955F4                  mov dword ptr [ebp-0C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E5E9(U)
|
:0046E5CE 8B45F4                  mov eax, dword ptr [ebp-0C]
:0046E5D1 50                      push eax
:0046E5D2 FF159C634800            call dword ptr [0048639C]
:0046E5D8 85C0                    test eax, eax
:0046E5DA 740F                    je 0046E5EB
:0046E5DC 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046E5DF 51                      push ecx
:0046E5E0 FF159C634800            call dword ptr [0048639C]
:0046E5E6 8945F4                  mov dword ptr [ebp-0C], eax
:0046E5E9 EBE3                    jmp 0046E5CE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E5DA(C)
|
:0046E5EB 8B55F4                  mov edx, dword ptr [ebp-0C]
:0046E5EE 52                      push edx
:0046E5EF 8B45F8                  mov eax, dword ptr [ebp-08]
:0046E5F2 8B08                    mov ecx, dword ptr [eax]
:0046E5F4 E813010000              call 0046E70C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046E530(C), :0046E580(U), :0046E59E(U)
|
:0046E5F9 8BE5                    mov esp, ebp
:0046E5FB 5D                      pop ebp
:0046E5FC C20800                  ret 0008


:0046E5FF 55                      push ebp
:0046E600 8BEC                    mov ebp, esp
:0046E602 6AFF                    push FFFFFFFF
:0046E604 687A594800              push 0048597A
:0046E609 64A100000000            mov eax, dword ptr fs:[00000000]
:0046E60F 50                      push eax
:0046E610 64892500000000          mov dword ptr fs:[00000000], esp
:0046E617 83EC10                  sub esp, 00000010
:0046E61A 6AF0                    push FFFFFFF0
:0046E61C 8B4508                  mov eax, dword ptr [ebp+08]
:0046E61F 50                      push eax
:0046E620 FF15A0634800            call dword ptr [004863A0]
:0046E626 2500000080              and eax, 80000000
:0046E62B 3D00000080              cmp eax, 80000000
:0046E630 0F85C1000000            jne 0046E6F7
:0046E636 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046E639 51                      push ecx
:0046E63A FF15C8624800            call dword ptr [004862C8]
:0046E640 85C0                    test eax, eax
:0046E642 0F84AF000000            je 0046E6F7
:0046E648 8B5508                  mov edx, dword ptr [ebp+08]
:0046E64B 52                      push edx
:0046E64C E895010000              call 0046E7E6
:0046E651 83C404                  add esp, 00000004
:0046E654 85C0                    test eax, eax
:0046E656 0F859B000000            jne 0046E6F7
:0046E65C 8B4508                  mov eax, dword ptr [ebp+08]
:0046E65F 50                      push eax
:0046E660 E894030000              call 0046E9F9
:0046E665 83C404                  add esp, 00000004
:0046E668 85C0                    test eax, eax
:0046E66A 0F8587000000            jne 0046E6F7
:0046E670 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046E673 894DF0                  mov dword ptr [ebp-10], ecx
:0046E676 8B55F0                  mov edx, dword ptr [ebp-10]
:0046E679 8B02                    mov eax, dword ptr [edx]
:0046E67B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046E67E 3B4810                  cmp ecx, dword ptr [eax+10]
:0046E681 7474                    je 0046E6F7
:0046E683 8B5508                  mov edx, dword ptr [ebp+08]
:0046E686 52                      push edx
:0046E687 8B45F0                  mov eax, dword ptr [ebp-10]
:0046E68A 8B08                    mov ecx, dword ptr [eax]
:0046E68C E87B000000              call 0046E70C
:0046E691 6A18                    push 00000018
:0046E693 E848290100              call 00480FE0
:0046E698 83C404                  add esp, 00000004
:0046E69B 8945EC                  mov dword ptr [ebp-14], eax
:0046E69E C745FC00000000          mov [ebp-04], 00000000
:0046E6A5 837DEC00                cmp dword ptr [ebp-14], 00000000
:0046E6A9 740D                    je 0046E6B8
:0046E6AB 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0046E6AE E85DFDF9FF              call 0040E410
:0046E6B3 8945E4                  mov dword ptr [ebp-1C], eax
:0046E6B6 EB07                    jmp 0046E6BF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E6A9(C)
|
:0046E6B8 C745E400000000          mov [ebp-1C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E6B6(U)
|
:0046E6BF 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0046E6C2 894DE8                  mov dword ptr [ebp-18], ecx
:0046E6C5 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0046E6CC 8B55F0                  mov edx, dword ptr [ebp-10]
:0046E6CF 8B02                    mov eax, dword ptr [edx]
:0046E6D1 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0046E6D4 89480C                  mov dword ptr [eax+0C], ecx
:0046E6D7 8B55F0                  mov edx, dword ptr [ebp-10]
:0046E6DA 8B02                    mov eax, dword ptr [edx]
:0046E6DC 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046E6DF 8B11                    mov edx, dword ptr [ecx]
:0046E6E1 8B4A0C                  mov ecx, dword ptr [edx+0C]
:0046E6E4 8B5010                  mov edx, dword ptr [eax+10]
:0046E6E7 895110                  mov dword ptr [ecx+10], edx
:0046E6EA 8B45F0                  mov eax, dword ptr [ebp-10]
:0046E6ED 8B08                    mov ecx, dword ptr [eax]
:0046E6EF 8B55F0                  mov edx, dword ptr [ebp-10]
:0046E6F2 8B410C                  mov eax, dword ptr [ecx+0C]
:0046E6F5 8902                    mov dword ptr [edx], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046E630(C), :0046E642(C), :0046E656(C), :0046E66A(C), :0046E681(C)
|
:0046E6F7 B801000000              mov eax, 00000001
:0046E6FC 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046E6FF 64890D00000000          mov dword ptr fs:[00000000], ecx
:0046E706 8BE5                    mov esp, ebp
:0046E708 5D                      pop ebp
:0046E709 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0046E57B   , :0046E599   , :0046E5F4   , :0046E68C   
|
:0046E70C 55                      push ebp
:0046E70D 8BEC                    mov ebp, esp
:0046E70F 51                      push ecx
:0046E710 894DFC                  mov dword ptr [ebp-04], ecx
:0046E713 8B4508                  mov eax, dword ptr [ebp+08]
:0046E716 50                      push eax
:0046E717 FF1534634800            call dword ptr [00486334]
:0046E71D 85C0                    test eax, eax
:0046E71F 7516                    jne 0046E737
:0046E721 6A01                    push 00000001
:0046E723 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046E726 51                      push ecx
:0046E727 FF15E8624800            call dword ptr [004862E8]
:0046E72D 8B55FC                  mov edx, dword ptr [ebp-04]
:0046E730 C7421401000000          mov [edx+14], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E71F(C)
|
:0046E737 8B4508                  mov eax, dword ptr [ebp+08]
:0046E73A 50                      push eax
:0046E73B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046E73E E8C740FFFF              call 0046280A
:0046E743 8BE5                    mov esp, ebp
:0046E745 5D                      pop ebp
:0046E746 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0046E7D3   
|
:0046E749 55                      push ebp
:0046E74A 8BEC                    mov ebp, esp
:0046E74C 51                      push ecx
:0046E74D 894DFC                  mov dword ptr [ebp-04], ecx
:0046E750 8B45FC                  mov eax, dword ptr [ebp-04]
:0046E753 83781400                cmp dword ptr [eax+14], 00000000
:0046E757 7419                    je 0046E772
:0046E759 6A00                    push 00000000
:0046E75B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046E75E 8B5108                  mov edx, dword ptr [ecx+08]
:0046E761 52                      push edx
:0046E762 FF15E8624800            call dword ptr [004862E8]
:0046E768 8B45FC                  mov eax, dword ptr [ebp-04]
:0046E76B C7401400000000          mov [eax+14], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E757(C)
|
:0046E772 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046E775 E84441FFFF              call 004628BE
:0046E77A 8BE5                    mov esp, ebp
:0046E77C 5D                      pop ebp
:0046E77D C3                      ret



* Referenced by a CALL at Addresses:
|:0046E3A6   , :0046E796   , :0046E9E8   
|
:0046E77E 55                      push ebp
:0046E77F 8BEC                    mov ebp, esp
:0046E781 83EC10                  sub esp, 00000010
:0046E784 894DF4                  mov dword ptr [ebp-0C], ecx
:0046E787 8B45F4                  mov eax, dword ptr [ebp-0C]
:0046E78A 83780C00                cmp dword ptr [eax+0C], 00000000
:0046E78E 7440                    je 0046E7D0
:0046E790 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046E793 8B490C                  mov ecx, dword ptr [ecx+0C]
:0046E796 E8E3FFFFFF              call 0046E77E
:0046E79B 8B55F4                  mov edx, dword ptr [ebp-0C]
:0046E79E 8B420C                  mov eax, dword ptr [edx+0C]
:0046E7A1 8945F8                  mov dword ptr [ebp-08], eax
:0046E7A4 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046E7A7 894DFC                  mov dword ptr [ebp-04], ecx
:0046E7AA 837DFC00                cmp dword ptr [ebp-04], 00000000
:0046E7AE 740F                    je 0046E7BF
:0046E7B0 6A01                    push 00000001
:0046E7B2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046E7B5 E856490000              call 00473110
:0046E7BA 8945F0                  mov dword ptr [ebp-10], eax
:0046E7BD EB07                    jmp 0046E7C6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E7AE(C)
|
:0046E7BF C745F000000000          mov [ebp-10], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E7BD(U)
|
:0046E7C6 8B55F4                  mov edx, dword ptr [ebp-0C]
:0046E7C9 C7420C00000000          mov [edx+0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E78E(C)
|
:0046E7D0 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046E7D3 E871FFFFFF              call 0046E749
:0046E7D8 8B45F4                  mov eax, dword ptr [ebp-0C]
:0046E7DB C7401000000000          mov [eax+10], 00000000
:0046E7E2 8BE5                    mov esp, ebp
:0046E7E4 5D                      pop ebp
:0046E7E5 C3                      ret



* Referenced by a CALL at Addresses:
|:00463F13   , :0046A7C5   , :0046E4CC   , :0046E543   , :0046E563   
|:0046E64C   , :00477783   
|
:0046E7E6 55                      push ebp
:0046E7E7 8BEC                    mov ebp, esp
:0046E7E9 51                      push ecx
:0046E7EA 8B4508                  mov eax, dword ptr [ebp+08]
:0046E7ED 50                      push eax
:0046E7EE E81141FFFF              call 00462904
:0046E7F3 83C404                  add esp, 00000004
:0046E7F6 8945FC                  mov dword ptr [ebp-04], eax
:0046E7F9 837DFC00                cmp dword ptr [ebp-04], 00000000
:0046E7FD 7419                    je 0046E818
:0046E7FF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046E802 8B11                    mov edx, dword ptr [ecx]
:0046E804 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046E807 FF520C                  call [edx+0C]
:0046E80A 3D986A4800              cmp eax, 00486A98
:0046E80F 7407                    je 0046E818
:0046E811 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046E7FD(C), :0046E80F(C)
|
:0046E818 8B45FC                  mov eax, dword ptr [ebp-04]
:0046E81B 8BE5                    mov esp, ebp
:0046E81D 5D                      pop ebp
:0046E81E C3                      ret


:0046E81F 55                      push ebp
:0046E820 8BEC                    mov ebp, esp
:0046E822 83EC10                  sub esp, 00000010
:0046E825 894DF4                  mov dword ptr [ebp-0C], ecx
:0046E828 8B4508                  mov eax, dword ptr [ebp+08]
:0046E82B 8945F0                  mov dword ptr [ebp-10], eax
:0046E82E 817DF000020000          cmp dword ptr [ebp-10], 00000200
:0046E835 7718                    ja 0046E84F
:0046E837 817DF000020000          cmp dword ptr [ebp-10], 00000200
:0046E83E 0F84B2000000            je 0046E8F6
:0046E844 837DF020                cmp dword ptr [ebp-10], 00000020
:0046E848 7420                    je 0046E86A
:0046E84A E92B010000              jmp 0046E97A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E835(C)
|
:0046E84F 817DF001020000          cmp dword ptr [ebp-10], 00000201
:0046E856 744E                    je 0046E8A6
:0046E858 817DF002020000          cmp dword ptr [ebp-10], 00000202
:0046E85F 0F84F4000000            je 0046E959
:0046E865 E910010000              jmp 0046E97A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E848(C)
|
:0046E86A 8B4D10                  mov ecx, dword ptr [ebp+10]
:0046E86D C1E910                  shr ecx, 10
:0046E870 81E1FFFF0000            and ecx, 0000FFFF
:0046E876 81E1FFFF0000            and ecx, 0000FFFF
:0046E87C 81F905020000            cmp ecx, 00000205
:0046E882 751D                    jne 0046E8A1
:0046E884 6A00                    push 00000000
:0046E886 6A02                    push 00000002
:0046E888 6811010000              push 00000111
:0046E88D 8B55F4                  mov edx, dword ptr [ebp-0C]
:0046E890 8B4204                  mov eax, dword ptr [edx+04]
:0046E893 50                      push eax
:0046E894 FF15F4624800            call dword ptr [004862F4]
:0046E89A 33C0                    xor eax, eax
:0046E89C E9DB000000              jmp 0046E97C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E882(C)
|
:0046E8A1 E9D4000000              jmp 0046E97A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E856(C)
|
:0046E8A6 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046E8A9 8B5104                  mov edx, dword ptr [ecx+04]
:0046E8AC 52                      push edx
:0046E8AD FF1588634800            call dword ptr [00486388]
:0046E8B3 68867F0000              push 00007F86
:0046E8B8 6A00                    push 00000000
:0046E8BA FF15B0634800            call dword ptr [004863B0]
:0046E8C0 50                      push eax
:0046E8C1 FF1594624800            call dword ptr [00486294]
:0046E8C7 A3C0684B00              mov dword ptr [004B68C0], eax
:0046E8CC 8B4510                  mov eax, dword ptr [ebp+10]
:0046E8CF 25FFFF0000              and eax, 0000FFFF
:0046E8D4 A3F0684B00              mov dword ptr [004B68F0], eax
:0046E8D9 8B4D10                  mov ecx, dword ptr [ebp+10]
:0046E8DC C1E910                  shr ecx, 10
:0046E8DF 81E1FFFF0000            and ecx, 0000FFFF
:0046E8E5 81E1FFFF0000            and ecx, 0000FFFF
:0046E8EB 890DF4684B00            mov dword ptr [004B68F4], ecx
:0046E8F1 E984000000              jmp 0046E97A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E83E(C)
|
:0046E8F6 FF1584634800            call dword ptr [00486384]
:0046E8FC 8B55F4                  mov edx, dword ptr [ebp-0C]
:0046E8FF 3B4204                  cmp eax, dword ptr [edx+04]
:0046E902 7553                    jne 0046E957
:0046E904 0FBF4510                movsx eax, word ptr [ebp+10]
:0046E908 8945F8                  mov dword ptr [ebp-08], eax
:0046E90B 8B4D10                  mov ecx, dword ptr [ebp+10]
:0046E90E C1E910                  shr ecx, 10
:0046E911 81E1FFFF0000            and ecx, 0000FFFF
:0046E917 0FBFD1                  movsx edx, cx
:0046E91A 8955FC                  mov dword ptr [ebp-04], edx
:0046E91D 8D45F8                  lea eax, dword ptr [ebp-08]
:0046E920 50                      push eax
:0046E921 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046E924 8B5104                  mov edx, dword ptr [ecx+04]
:0046E927 52                      push edx
:0046E928 FF1520634800            call dword ptr [00486320]
:0046E92E 6A05                    push 00000005
:0046E930 6A00                    push 00000000
:0046E932 6A00                    push 00000000
:0046E934 8B45FC                  mov eax, dword ptr [ebp-04]
:0046E937 2B05F4684B00            sub eax, dword ptr [004B68F4]
:0046E93D 50                      push eax
:0046E93E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046E941 2B0DF0684B00            sub ecx, dword ptr [004B68F0]
:0046E947 51                      push ecx
:0046E948 6A00                    push 00000000
:0046E94A 8B55F4                  mov edx, dword ptr [ebp-0C]
:0046E94D 8B4204                  mov eax, dword ptr [edx+04]
:0046E950 50                      push eax
:0046E951 FF1580624800            call dword ptr [00486280]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E902(C)
|
:0046E957 EB21                    jmp 0046E97A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E85F(C)
|
:0046E959 FF1584634800            call dword ptr [00486384]
:0046E95F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046E962 3B4104                  cmp eax, dword ptr [ecx+04]
:0046E965 7513                    jne 0046E97A
:0046E967 8B15C0684B00            mov edx, dword ptr [004B68C0]
:0046E96D 52                      push edx
:0046E96E FF1594624800            call dword ptr [00486294]
:0046E974 FF1580634800            call dword ptr [00486380]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046E84A(U), :0046E865(U), :0046E8A1(U), :0046E8F1(U), :0046E957(U)
|:0046E965(C)
|
:0046E97A 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E89C(U)
|
:0046E97C 8BE5                    mov esp, ebp
:0046E97E 5D                      pop ebp
:0046E97F C20C00                  ret 000C



* Referenced by a CALL at Address:
|:0046F9D2   
|
:0046E982 55                      push ebp
:0046E983 8BEC                    mov ebp, esp
:0046E985 83EC08                  sub esp, 00000008
:0046E988 894DF8                  mov dword ptr [ebp-08], ecx
:0046E98B 8B45F8                  mov eax, dword ptr [ebp-08]
:0046E98E 8B4804                  mov ecx, dword ptr [eax+04]
:0046E991 51                      push ecx
:0046E992 FF159C634800            call dword ptr [0048639C]
:0046E998 8945FC                  mov dword ptr [ebp-04], eax
:0046E99B 6A01                    push 00000001
:0046E99D 8B55FC                  mov edx, dword ptr [ebp-04]
:0046E9A0 52                      push edx
:0046E9A1 FF15E8624800            call dword ptr [004862E8]
:0046E9A7 837DFC00                cmp dword ptr [ebp-04], 00000000
:0046E9AB 7416                    je 0046E9C3
:0046E9AD 8B45FC                  mov eax, dword ptr [ebp-04]
:0046E9B0 50                      push eax
:0046E9B1 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046E9B4 8B5104                  mov edx, dword ptr [ecx+04]
:0046E9B7 52                      push edx
:0046E9B8 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046E9BB 83C10C                  add ecx, 0000000C
:0046E9BE E860FBFFFF              call 0046E523

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046E9AB(C)
|
:0046E9C3 68007F0000              push 00007F00
:0046E9C8 6A00                    push 00000000
:0046E9CA FF15B0634800            call dword ptr [004863B0]
:0046E9D0 50                      push eax
:0046E9D1 FF1594624800            call dword ptr [00486294]
:0046E9D7 8BE5                    mov esp, ebp
:0046E9D9 5D                      pop ebp
:0046E9DA C3                      ret



* Referenced by a CALL at Addresses:
|:0046D99B   , :00470084   
|
:0046E9DB 55                      push ebp
:0046E9DC 8BEC                    mov ebp, esp
:0046E9DE 51                      push ecx
:0046E9DF 894DFC                  mov dword ptr [ebp-04], ecx
:0046E9E2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046E9E5 83C10C                  add ecx, 0000000C
:0046E9E8 E891FDFFFF              call 0046E77E
:0046E9ED 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046E9F0 E812E8FFFF              call 0046D207
:0046E9F5 8BE5                    mov esp, ebp
:0046E9F7 5D                      pop ebp
:0046E9F8 C3                      ret



* Referenced by a CALL at Addresses:
|:0046E586   , :0046E660   
|
:0046E9F9 55                      push ebp
:0046E9FA 8BEC                    mov ebp, esp
:0046E9FC 51                      push ecx
:0046E9FD 8B4508                  mov eax, dword ptr [ebp+08]
:0046EA00 50                      push eax
:0046EA01 FF1548634800            call dword ptr [00486348]
:0046EA07 85C0                    test eax, eax
:0046EA09 742C                    je 0046EA37
:0046EA0B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046EA0E 51                      push ecx
:0046EA0F E8C1E7FFFF              call 0046D1D5
:0046EA14 83C404                  add esp, 00000004
:0046EA17 8945FC                  mov dword ptr [ebp-04], eax
:0046EA1A 837DFC00                cmp dword ptr [ebp-04], 00000000
:0046EA1E 7417                    je 0046EA37
:0046EA20 8B55FC                  mov edx, dword ptr [ebp-04]
:0046EA23 8B02                    mov eax, dword ptr [edx]
:0046EA25 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046EA28 FF5024                  call [eax+24]
:0046EA2B 83F801                  cmp eax, 00000001
:0046EA2E 7507                    jne 0046EA37
:0046EA30 B801000000              mov eax, 00000001
:0046EA35 EB02                    jmp 0046EA39

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046EA09(C), :0046EA1E(C), :0046EA2E(C)
|
:0046EA37 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046EA35(U)
|
:0046EA39 8BE5                    mov esp, ebp
:0046EA3B 5D                      pop ebp
:0046EA3C C3                      ret


:0046EA3D 55                      push ebp
:0046EA3E 8BEC                    mov ebp, esp
:0046EA40 51                      push ecx
:0046EA41 894DFC                  mov dword ptr [ebp-04], ecx
:0046EA44 8B4510                  mov eax, dword ptr [ebp+10]
:0046EA47 50                      push eax
:0046EA48 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046EA4B 51                      push ecx
:0046EA4C 8B5508                  mov edx, dword ptr [ebp+08]
:0046EA4F 52                      push edx
:0046EA50 8B45FC                  mov eax, dword ptr [ebp-04]
:0046EA53 8B4804                  mov ecx, dword ptr [eax+04]
:0046EA56 51                      push ecx
:0046EA57 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046EA5A 83C124                  add ecx, 00000024
:0046EA5D 8B55FC                  mov edx, dword ptr [ebp-04]
:0046EA60 8B4224                  mov eax, dword ptr [edx+24]
:0046EA63 FF5024                  call [eax+24]
:0046EA66 85C0                    test eax, eax
:0046EA68 7407                    je 0046EA71
:0046EA6A B801000000              mov eax, 00000001
:0046EA6F EB17                    jmp 0046EA88

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046EA68(C)
|
:0046EA71 8B4D10                  mov ecx, dword ptr [ebp+10]
:0046EA74 51                      push ecx
:0046EA75 8B550C                  mov edx, dword ptr [ebp+0C]
:0046EA78 52                      push edx
:0046EA79 8B4508                  mov eax, dword ptr [ebp+08]
:0046EA7C 50                      push eax
:0046EA7D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046EA80 8B11                    mov edx, dword ptr [ecx]
:0046EA82 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046EA85 FF5204                  call [edx+04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046EA6F(U)
|
:0046EA88 8BE5                    mov esp, ebp
:0046EA8A 5D                      pop ebp
:0046EA8B C20C00                  ret 000C


:0046EA8E 55                      push ebp
:0046EA8F 8BEC                    mov ebp, esp
:0046EA91 51                      push ecx
:0046EA92 894DFC                  mov dword ptr [ebp-04], ecx
:0046EA95 6821050000              push 00000521
:0046EA9A 6821050000              push 00000521
:0046EA9F 8B45FC                  mov eax, dword ptr [ebp-04]
:0046EAA2 8B4804                  mov ecx, dword ptr [eax+04]
:0046EAA5 51                      push ecx
:0046EAA6 FF15DC624800            call dword ptr [004862DC]
:0046EAAC 50                      push eax
:0046EAAD 6810010000              push 00000110
:0046EAB2 8B55FC                  mov edx, dword ptr [ebp-04]
:0046EAB5 8B4204                  mov eax, dword ptr [edx+04]
:0046EAB8 50                      push eax
:0046EAB9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046EABC 83C124                  add ecx, 00000024
:0046EABF 8B55FC                  mov edx, dword ptr [ebp-04]
:0046EAC2 8B4224                  mov eax, dword ptr [edx+24]
:0046EAC5 FF5024                  call [eax+24]
:0046EAC8 8BE5                    mov esp, ebp
:0046EACA 5D                      pop ebp
:0046EACB C3                      ret


:0046EACC 55                      push ebp
:0046EACD 8BEC                    mov ebp, esp
:0046EACF 51                      push ecx
:0046EAD0 894DFC                  mov dword ptr [ebp-04], ecx
:0046EAD3 8B450C                  mov eax, dword ptr [ebp+0C]
:0046EAD6 50                      push eax
:0046EAD7 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046EADA 51                      push ecx
:0046EADB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046EADE E85DF8F9FF              call 0040E340
:0046EAE3 8B550C                  mov edx, dword ptr [ebp+0C]
:0046EAE6 52                      push edx
:0046EAE7 8B4508                  mov eax, dword ptr [ebp+08]
:0046EAEA 50                      push eax
:0046EAEB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046EAEE 83C124                  add ecx, 00000024
:0046EAF1 E80379FFFF              call 004663F9
:0046EAF6 8BE5                    mov esp, ebp
:0046EAF8 5D                      pop ebp
:0046EAF9 C20800                  ret 0008



* Referenced by a CALL at Address:
|:00466517   
|
:0046EAFC 55                      push ebp
:0046EAFD 8BEC                    mov ebp, esp
:0046EAFF 51                      push ecx
:0046EB00 894DFC                  mov dword ptr [ebp-04], ecx
:0046EB03 8B4508                  mov eax, dword ptr [ebp+08]
:0046EB06 50                      push eax

* Possible Reference to Dialog: DialogID_011A 
                                  |
:0046EB07 681A010000              push 0000011A
:0046EB0C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046EB0F E884E5FFFF              call 0046D098
:0046EB14 8BE5                    mov esp, ebp
:0046EB16 5D                      pop ebp
:0046EB17 C20400                  ret 0004


:0046EB1A 55                      push ebp
:0046EB1B 8BEC                    mov ebp, esp
:0046EB1D 51                      push ecx
:0046EB1E 894DFC                  mov dword ptr [ebp-04], ecx
:0046EB21 8B4510                  mov eax, dword ptr [ebp+10]
:0046EB24 50                      push eax
:0046EB25 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046EB28 51                      push ecx
:0046EB29 8B5508                  mov edx, dword ptr [ebp+08]
:0046EB2C 52                      push edx
:0046EB2D 8B45FC                  mov eax, dword ptr [ebp-04]
:0046EB30 8B4804                  mov ecx, dword ptr [eax+04]
:0046EB33 51                      push ecx
:0046EB34 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046EB37 83C124                  add ecx, 00000024
:0046EB3A 8B55FC                  mov edx, dword ptr [ebp-04]
:0046EB3D 8B4224                  mov eax, dword ptr [edx+24]
:0046EB40 FF5024                  call [eax+24]
:0046EB43 85C0                    test eax, eax
:0046EB45 7407                    je 0046EB4E
:0046EB47 B801000000              mov eax, 00000001
:0046EB4C EB17                    jmp 0046EB65

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046EB45(C)
|
:0046EB4E 8B4D10                  mov ecx, dword ptr [ebp+10]
:0046EB51 51                      push ecx
:0046EB52 8B550C                  mov edx, dword ptr [ebp+0C]
:0046EB55 52                      push edx
:0046EB56 8B4508                  mov eax, dword ptr [ebp+08]
:0046EB59 50                      push eax
:0046EB5A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046EB5D 8B11                    mov edx, dword ptr [ecx]
:0046EB5F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046EB62 FF5204                  call [edx+04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046EB4C(U)
|
:0046EB65 8BE5                    mov esp, ebp
:0046EB67 5D                      pop ebp
:0046EB68 C20C00                  ret 000C


:0046EB6B 55                      push ebp
:0046EB6C 8BEC                    mov ebp, esp
:0046EB6E 51                      push ecx
:0046EB6F 894DFC                  mov dword ptr [ebp-04], ecx
:0046EB72 6821050000              push 00000521
:0046EB77 6821050000              push 00000521
:0046EB7C 8B45FC                  mov eax, dword ptr [ebp-04]
:0046EB7F 8B4804                  mov ecx, dword ptr [eax+04]
:0046EB82 51                      push ecx
:0046EB83 FF15DC624800            call dword ptr [004862DC]
:0046EB89 50                      push eax
:0046EB8A 6810010000              push 00000110
:0046EB8F 8B55FC                  mov edx, dword ptr [ebp-04]
:0046EB92 8B4204                  mov eax, dword ptr [edx+04]
:0046EB95 50                      push eax
:0046EB96 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046EB99 83C124                  add ecx, 00000024
:0046EB9C 8B55FC                  mov edx, dword ptr [ebp-04]
:0046EB9F 8B4224                  mov eax, dword ptr [edx+24]
:0046EBA2 FF5024                  call [eax+24]
:0046EBA5 8BE5                    mov esp, ebp
:0046EBA7 5D                      pop ebp
:0046EBA8 C3                      ret



* Referenced by a CALL at Address:
|:0043DD77   
|
:0046EBA9 55                      push ebp
:0046EBAA 8BEC                    mov ebp, esp
:0046EBAC 51                      push ecx
:0046EBAD 894DFC                  mov dword ptr [ebp-04], ecx
:0046EBB0 8B4508                  mov eax, dword ptr [ebp+08]
:0046EBB3 50                      push eax

* Possible Reference to Dialog: DialogID_00F2 
                                  |
:0046EBB4 68F2000000              push 000000F2
:0046EBB9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046EBBC E8D7E4FFFF              call 0046D098
:0046EBC1 8BE5                    mov esp, ebp
:0046EBC3 5D                      pop ebp
:0046EBC4 C20400                  ret 0004


:0046EBC7 55                      push ebp
:0046EBC8 8BEC                    mov ebp, esp
:0046EBCA 83EC14                  sub esp, 00000014
:0046EBCD 894DF4                  mov dword ptr [ebp-0C], ecx
:0046EBD0 8B4510                  mov eax, dword ptr [ebp+10]
:0046EBD3 50                      push eax
:0046EBD4 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046EBD7 51                      push ecx
:0046EBD8 8B5508                  mov edx, dword ptr [ebp+08]
:0046EBDB 52                      push edx
:0046EBDC 8B45F4                  mov eax, dword ptr [ebp-0C]
:0046EBDF 8B4804                  mov ecx, dword ptr [eax+04]
:0046EBE2 51                      push ecx
:0046EBE3 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046EBE6 83C118                  add ecx, 00000018
:0046EBE9 8B55F4                  mov edx, dword ptr [ebp-0C]
:0046EBEC 8B4218                  mov eax, dword ptr [edx+18]
:0046EBEF FF5024                  call [eax+24]
:0046EBF2 85C0                    test eax, eax
:0046EBF4 740A                    je 0046EC00
:0046EBF6 B801000000              mov eax, 00000001
:0046EBFB E990000000              jmp 0046EC90

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046EBF4(C)
|
:0046EC00 8B4D10                  mov ecx, dword ptr [ebp+10]
:0046EC03 51                      push ecx
:0046EC04 8B550C                  mov edx, dword ptr [ebp+0C]
:0046EC07 52                      push edx
:0046EC08 8B4508                  mov eax, dword ptr [ebp+08]
:0046EC0B 50                      push eax
:0046EC0C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046EC0F 8B5104                  mov edx, dword ptr [ecx+04]
:0046EC12 52                      push edx
:0046EC13 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046EC16 83C168                  add ecx, 00000068
:0046EC19 8B45F4                  mov eax, dword ptr [ebp-0C]
:0046EC1C 8B5068                  mov edx, dword ptr [eax+68]
:0046EC1F FF5224                  call [edx+24]
:0046EC22 85C0                    test eax, eax
:0046EC24 7407                    je 0046EC2D
:0046EC26 B801000000              mov eax, 00000001
:0046EC2B EB63                    jmp 0046EC90

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046EC24(C)
|
:0046EC2D 8B4508                  mov eax, dword ptr [ebp+08]
:0046EC30 8945F0                  mov dword ptr [ebp-10], eax
:0046EC33 837DF04E                cmp dword ptr [ebp-10], 0000004E
:0046EC37 7402                    je 0046EC3B
:0046EC39 EB3E                    jmp 0046EC79

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046EC37(C)
|
:0046EC3B 8B4D10                  mov ecx, dword ptr [ebp+10]
:0046EC3E 894DFC                  mov dword ptr [ebp-04], ecx
:0046EC41 8B55FC                  mov edx, dword ptr [ebp-04]
:0046EC44 8B4208                  mov eax, dword ptr [edx+08]
:0046EC47 8945EC                  mov dword ptr [ebp-14], eax
:0046EC4A 817DECD9FDFFFF          cmp dword ptr [ebp-14], FFFFFDD9
:0046EC51 7402                    je 0046EC55
:0046EC53 EB24                    jmp 0046EC79

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046EC51(C)
|
:0046EC55 6A00                    push 00000000
:0046EC57 6A00                    push 00000000
:0046EC59 680B130000              push 0000130B
:0046EC5E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046EC61 8B11                    mov edx, dword ptr [ecx]
:0046EC63 52                      push edx
:0046EC64 FF15F4624800            call dword ptr [004862F4]
:0046EC6A 8845F8                  mov byte ptr [ebp-08], al
:0046EC6D 8A45F8                  mov al, byte ptr [ebp-08]
:0046EC70 50                      push eax
:0046EC71 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046EC74 E841010000              call 0046EDBA

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046EC39(U), :0046EC53(U)
|
:0046EC79 8B4D10                  mov ecx, dword ptr [ebp+10]
:0046EC7C 51                      push ecx
:0046EC7D 8B550C                  mov edx, dword ptr [ebp+0C]
:0046EC80 52                      push edx
:0046EC81 8B4508                  mov eax, dword ptr [ebp+08]
:0046EC84 50                      push eax
:0046EC85 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046EC88 8B11                    mov edx, dword ptr [ecx]
:0046EC8A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046EC8D FF5204                  call [edx+04]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046EBFB(U), :0046EC2B(U)
|
:0046EC90 8BE5                    mov esp, ebp
:0046EC92 5D                      pop ebp
:0046EC93 C20C00                  ret 000C


:0046EC96 55                      push ebp
:0046EC97 8BEC                    mov ebp, esp
:0046EC99 83EC38                  sub esp, 00000038
:0046EC9C 894DC8                  mov dword ptr [ebp-38], ecx
:0046EC9F A1686A4B00              mov eax, dword ptr [004B6A68]
:0046ECA4 50                      push eax
:0046ECA5 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0046ECA8 8B5104                  mov edx, dword ptr [ecx+04]
:0046ECAB 52                      push edx
:0046ECAC E8F536FFFF              call 004623A6
:0046ECB1 83C408                  add esp, 00000008
:0046ECB4 6802040000              push 00000402
:0046ECB9 6802040000              push 00000402
:0046ECBE 8B45C8                  mov eax, dword ptr [ebp-38]
:0046ECC1 8B4804                  mov ecx, dword ptr [eax+04]
:0046ECC4 51                      push ecx
:0046ECC5 FF15DC624800            call dword ptr [004862DC]
:0046ECCB 50                      push eax
:0046ECCC 6810010000              push 00000110
:0046ECD1 8B55C8                  mov edx, dword ptr [ebp-38]
:0046ECD4 8B4204                  mov eax, dword ptr [edx+04]
:0046ECD7 50                      push eax
:0046ECD8 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0046ECDB 83C118                  add ecx, 00000018
:0046ECDE 8B55C8                  mov edx, dword ptr [ebp-38]
:0046ECE1 8B4218                  mov eax, dword ptr [edx+18]
:0046ECE4 FF5024                  call [eax+24]

* Possible Reference to Dialog: DialogID_00C1, CONTROL_ID:0403, ""
                                  |
:0046ECE7 6803040000              push 00000403

* Possible Reference to Dialog: DialogID_00C1, CONTROL_ID:0403, ""
                                  |
:0046ECEC 6803040000              push 00000403
:0046ECF1 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0046ECF4 8B5104                  mov edx, dword ptr [ecx+04]
:0046ECF7 52                      push edx
:0046ECF8 FF15DC624800            call dword ptr [004862DC]
:0046ECFE 50                      push eax
:0046ECFF 6810010000              push 00000110
:0046ED04 8B45C8                  mov eax, dword ptr [ebp-38]
:0046ED07 8B4804                  mov ecx, dword ptr [eax+04]
:0046ED0A 51                      push ecx
:0046ED0B 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0046ED0E 83C168                  add ecx, 00000068
:0046ED11 8B55C8                  mov edx, dword ptr [ebp-38]
:0046ED14 8B4268                  mov eax, dword ptr [edx+68]
:0046ED17 FF5024                  call [eax+24]
:0046ED1A 6805040000              push 00000405
:0046ED1F 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0046ED22 8B5104                  mov edx, dword ptr [ecx+04]
:0046ED25 52                      push edx
:0046ED26 FF15DC624800            call dword ptr [004862DC]
:0046ED2C 8945D0                  mov dword ptr [ebp-30], eax
:0046ED2F 8B45D0                  mov eax, dword ptr [ebp-30]
:0046ED32 50                      push eax
:0046ED33 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0046ED36 83C10C                  add ecx, 0000000C
:0046ED39 E8CC3AFFFF              call 0046280A
:0046ED3E C745D401000000          mov [ebp-2C], 00000001
:0046ED45 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0046ED48 894DE0                  mov dword ptr [ebp-20], ecx
:0046ED4B C745CC00000000          mov [ebp-34], 00000000
:0046ED52 EB09                    jmp 0046ED5D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046ED97(U)
|
:0046ED54 8B55CC                  mov edx, dword ptr [ebp-34]
:0046ED57 83C201                  add edx, 00000001
:0046ED5A 8955CC                  mov dword ptr [ebp-34], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046ED52(U)
|
:0046ED5D 837DCC02                cmp dword ptr [ebp-34], 00000002
:0046ED61 7D36                    jge 0046ED99
:0046ED63 8B45CC                  mov eax, dword ptr [ebp-34]
:0046ED66 8B0C85C86C4800          mov ecx, dword ptr [4*eax+00486CC8]
:0046ED6D 51                      push ecx

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:0046ED6E 6884E74800              push 0048E784
:0046ED73 8D55F0                  lea edx, dword ptr [ebp-10]
:0046ED76 52                      push edx
:0046ED77 FF15C0624800            call dword ptr [004862C0]
:0046ED7D 83C40C                  add esp, 0000000C
:0046ED80 8D45D4                  lea eax, dword ptr [ebp-2C]
:0046ED83 50                      push eax
:0046ED84 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0046ED87 51                      push ecx
:0046ED88 6807130000              push 00001307
:0046ED8D 8B55D0                  mov edx, dword ptr [ebp-30]
:0046ED90 52                      push edx
:0046ED91 FF15F4624800            call dword ptr [004862F4]
:0046ED97 EBBB                    jmp 0046ED54

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046ED61(C)
|
:0046ED99 6A00                    push 00000000
:0046ED9B 6A00                    push 00000000
:0046ED9D 680C130000              push 0000130C
:0046EDA2 8B45D0                  mov eax, dword ptr [ebp-30]
:0046EDA5 50                      push eax
:0046EDA6 FF15F4624800            call dword ptr [004862F4]
:0046EDAC 6A00                    push 00000000
:0046EDAE 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0046EDB1 E804000000              call 0046EDBA
:0046EDB6 8BE5                    mov esp, ebp
:0046EDB8 5D                      pop ebp
:0046EDB9 C3                      ret



* Referenced by a CALL at Addresses:
|:0046EC74   , :0046EDB1   
|
:0046EDBA 55                      push ebp
:0046EDBB 8BEC                    mov ebp, esp
:0046EDBD 83EC08                  sub esp, 00000008
:0046EDC0 894DFC                  mov dword ptr [ebp-04], ecx
:0046EDC3 8A4508                  mov al, byte ptr [ebp+08]
:0046EDC6 8845F8                  mov byte ptr [ebp-08], al
:0046EDC9 807DF800                cmp byte ptr [ebp-08], 00
:0046EDCD 740B                    je 0046EDDA
:0046EDCF 807DF801                cmp byte ptr [ebp-08], 01
:0046EDD3 7451                    je 0046EE26
:0046EDD5 E996000000              jmp 0046EE70

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046EDCD(C)
|
:0046EDDA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046EDDD 83C168                  add ecx, 00000068
:0046EDE0 E8AB3E0000              call 00472C90
:0046EDE5 50                      push eax
:0046EDE6 FF15C8624800            call dword ptr [004862C8]
:0046EDEC 85C0                    test eax, eax
:0046EDEE 740C                    je 0046EDFC
:0046EDF0 6A00                    push 00000000
:0046EDF2 B9B0694B00              mov ecx, 004B69B0
:0046EDF7 E8B1580000              call 004746AD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046EDEE(C)
|
:0046EDFC 6A00                    push 00000000
:0046EDFE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046EE01 83C168                  add ecx, 00000068
:0046EE04 E8873E0000              call 00472C90
:0046EE09 50                      push eax
:0046EE0A FF15E0624800            call dword ptr [004862E0]
:0046EE10 6A05                    push 00000005
:0046EE12 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046EE15 83C118                  add ecx, 00000018
:0046EE18 E8733E0000              call 00472C90
:0046EE1D 50                      push eax
:0046EE1E FF15E0624800            call dword ptr [004862E0]
:0046EE24 EB4A                    jmp 0046EE70

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046EDD3(C)
|
:0046EE26 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046EE29 83C118                  add ecx, 00000018
:0046EE2C E85F3E0000              call 00472C90
:0046EE31 50                      push eax
:0046EE32 FF15C8624800            call dword ptr [004862C8]
:0046EE38 85C0                    test eax, eax
:0046EE3A 740C                    je 0046EE48
:0046EE3C 6A00                    push 00000000
:0046EE3E B9B0694B00              mov ecx, 004B69B0
:0046EE43 E865580000              call 004746AD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046EE3A(C)
|
:0046EE48 6A00                    push 00000000
:0046EE4A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046EE4D 83C118                  add ecx, 00000018
:0046EE50 E83B3E0000              call 00472C90
:0046EE55 50                      push eax
:0046EE56 FF15E0624800            call dword ptr [004862E0]
:0046EE5C 6A05                    push 00000005
:0046EE5E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046EE61 83C168                  add ecx, 00000068
:0046EE64 E8273E0000              call 00472C90
:0046EE69 50                      push eax
:0046EE6A FF15E0624800            call dword ptr [004862E0]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046EDD5(U), :0046EE24(U)
|
:0046EE70 8BE5                    mov esp, ebp
:0046EE72 5D                      pop ebp
:0046EE73 C20400                  ret 0004



* Referenced by a CALL at Address:
|:00474D9E   
|
:0046EE76 55                      push ebp
:0046EE77 8BEC                    mov ebp, esp
:0046EE79 51                      push ecx
:0046EE7A 894DFC                  mov dword ptr [ebp-04], ecx
:0046EE7D A1686A4B00              mov eax, dword ptr [004B6A68]
:0046EE82 50                      push eax

* Possible Reference to Dialog: DialogID_014F 
                                  |
:0046EE83 684F010000              push 0000014F
:0046EE88 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046EE8B E808E2FFFF              call 0046D098
:0046EE90 8BE5                    mov esp, ebp
:0046EE92 5D                      pop ebp
:0046EE93 C3                      ret


:0046EE94 55                      push ebp
:0046EE95 8BEC                    mov ebp, esp
:0046EE97 51                      push ecx
:0046EE98 894DFC                  mov dword ptr [ebp-04], ecx
:0046EE9B 8B4510                  mov eax, dword ptr [ebp+10]
:0046EE9E 50                      push eax
:0046EE9F 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046EEA2 51                      push ecx
:0046EEA3 8B5508                  mov edx, dword ptr [ebp+08]
:0046EEA6 52                      push edx
:0046EEA7 8B45FC                  mov eax, dword ptr [ebp-04]
:0046EEAA 8B4804                  mov ecx, dword ptr [eax+04]
:0046EEAD 51                      push ecx
:0046EEAE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046EEB1 83C10C                  add ecx, 0000000C
:0046EEB4 8B55FC                  mov edx, dword ptr [ebp-04]
:0046EEB7 8B420C                  mov eax, dword ptr [edx+0C]
:0046EEBA FF5024                  call [eax+24]
:0046EEBD 85C0                    test eax, eax
:0046EEBF 7407                    je 0046EEC8
:0046EEC1 B801000000              mov eax, 00000001
:0046EEC6 EB17                    jmp 0046EEDF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046EEBF(C)
|
:0046EEC8 8B4D10                  mov ecx, dword ptr [ebp+10]
:0046EECB 51                      push ecx
:0046EECC 8B550C                  mov edx, dword ptr [ebp+0C]
:0046EECF 52                      push edx
:0046EED0 8B4508                  mov eax, dword ptr [ebp+08]
:0046EED3 50                      push eax
:0046EED4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046EED7 8B11                    mov edx, dword ptr [ecx]
:0046EED9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046EEDC FF5204                  call [edx+04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046EEC6(U)
|
:0046EEDF 8BE5                    mov esp, ebp
:0046EEE1 5D                      pop ebp
:0046EEE2 C20C00                  ret 000C


:0046EEE5 55                      push ebp
:0046EEE6 8BEC                    mov ebp, esp
:0046EEE8 83EC24                  sub esp, 00000024
:0046EEEB 894DDC                  mov dword ptr [ebp-24], ecx
:0046EEEE 68CF050000              push 000005CF
:0046EEF3 68CF050000              push 000005CF
:0046EEF8 8B45DC                  mov eax, dword ptr [ebp-24]
:0046EEFB 8B4804                  mov ecx, dword ptr [eax+04]
:0046EEFE 51                      push ecx
:0046EEFF FF15DC624800            call dword ptr [004862DC]
:0046EF05 50                      push eax
:0046EF06 6810010000              push 00000110
:0046EF0B 8B55DC                  mov edx, dword ptr [ebp-24]
:0046EF0E 8B4204                  mov eax, dword ptr [edx+04]
:0046EF11 50                      push eax
:0046EF12 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0046EF15 83C10C                  add ecx, 0000000C
:0046EF18 8B55DC                  mov edx, dword ptr [ebp-24]
:0046EF1B 8B420C                  mov eax, dword ptr [edx+0C]
:0046EF1E FF5024                  call [eax+24]
:0046EF21 6A0A                    push 0000000A
:0046EF23 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0046EF26 83C10C                  add ecx, 0000000C
:0046EF29 E8B154FFFF              call 004643DF
:0046EF2E 8945E0                  mov dword ptr [ebp-20], eax
:0046EF31 6A02                    push 00000002
:0046EF33 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0046EF36 8B5104                  mov edx, dword ptr [ecx+04]
:0046EF39 52                      push edx
:0046EF3A FF15DC624800            call dword ptr [004862DC]
:0046EF40 8945FC                  mov dword ptr [ebp-04], eax
:0046EF43 8D45EC                  lea eax, dword ptr [ebp-14]
:0046EF46 50                      push eax
:0046EF47 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046EF4A 51                      push ecx
:0046EF4B FF1598634800            call dword ptr [00486398]
:0046EF51 8B55EC                  mov edx, dword ptr [ebp-14]
:0046EF54 8955E4                  mov dword ptr [ebp-1C], edx
:0046EF57 8B45F0                  mov eax, dword ptr [ebp-10]
:0046EF5A 8945E8                  mov dword ptr [ebp-18], eax
:0046EF5D 8D4DE4                  lea ecx, dword ptr [ebp-1C]
:0046EF60 51                      push ecx
:0046EF61 8B55DC                  mov edx, dword ptr [ebp-24]
:0046EF64 8B4204                  mov eax, dword ptr [edx+04]
:0046EF67 50                      push eax
:0046EF68 FF1564624800            call dword ptr [00486264]
:0046EF6E 6A0D                    push 0000000D
:0046EF70 6A00                    push 00000000
:0046EF72 6A00                    push 00000000
:0046EF74 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0046EF77 034DE0                  add ecx, dword ptr [ebp-20]
:0046EF7A 51                      push ecx
:0046EF7B 8B55E4                  mov edx, dword ptr [ebp-1C]
:0046EF7E 52                      push edx
:0046EF7F 6A00                    push 00000000
:0046EF81 8B45FC                  mov eax, dword ptr [ebp-04]
:0046EF84 50                      push eax
:0046EF85 FF1580624800            call dword ptr [00486280]
:0046EF8B 8D4DEC                  lea ecx, dword ptr [ebp-14]
:0046EF8E 51                      push ecx
:0046EF8F 8B55DC                  mov edx, dword ptr [ebp-24]
:0046EF92 8B4204                  mov eax, dword ptr [edx+04]
:0046EF95 50                      push eax
:0046EF96 FF1598634800            call dword ptr [00486398]
:0046EF9C 6A0E                    push 0000000E
:0046EF9E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046EFA1 2B4DF0                  sub ecx, dword ptr [ebp-10]
:0046EFA4 034DE0                  add ecx, dword ptr [ebp-20]
:0046EFA7 51                      push ecx
:0046EFA8 8B55F4                  mov edx, dword ptr [ebp-0C]
:0046EFAB 2B55EC                  sub edx, dword ptr [ebp-14]
:0046EFAE 52                      push edx
:0046EFAF 6A00                    push 00000000
:0046EFB1 6A00                    push 00000000
:0046EFB3 6A00                    push 00000000
:0046EFB5 8B45DC                  mov eax, dword ptr [ebp-24]
:0046EFB8 8B4804                  mov ecx, dword ptr [eax+04]
:0046EFBB 51                      push ecx
:0046EFBC FF1580624800            call dword ptr [00486280]
:0046EFC2 8B15686A4B00            mov edx, dword ptr [004B6A68]
:0046EFC8 52                      push edx
:0046EFC9 8B45DC                  mov eax, dword ptr [ebp-24]
:0046EFCC 8B4804                  mov ecx, dword ptr [eax+04]
:0046EFCF 51                      push ecx
:0046EFD0 E8D133FFFF              call 004623A6
:0046EFD5 83C408                  add esp, 00000008
:0046EFD8 8BE5                    mov esp, ebp
:0046EFDA 5D                      pop ebp
:0046EFDB C3                      ret



* Referenced by a CALL at Addresses:
|:0041A391   , :0041A4B0   
|
:0046EFDC 55                      push ebp
:0046EFDD 8BEC                    mov ebp, esp
:0046EFDF 51                      push ecx
:0046EFE0 894DFC                  mov dword ptr [ebp-04], ecx
:0046EFE3 8B45FC                  mov eax, dword ptr [ebp-04]
:0046EFE6 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046EFE9 898878020000            mov dword ptr [eax+00000278], ecx
:0046EFEF 837D0800                cmp dword ptr [ebp+08], 00000000
:0046EFF3 740A                    je 0046EFFF
:0046EFF5 8B55FC                  mov edx, dword ptr [ebp-04]
:0046EFF8 C742440D000001          mov [edx+44], 0100000D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046EFF3(C)
|
:0046EFFF 837D0800                cmp dword ptr [ebp+08], 00000000
:0046F003 7415                    je 0046F01A
:0046F005 A1686A4B00              mov eax, dword ptr [004B6A68]
:0046F00A 50                      push eax

* Possible Reference to Dialog: DialogID_0152 
                                  |
:0046F00B 6852010000              push 00000152
:0046F010 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046F013 E880E0FFFF              call 0046D098
:0046F018 EB14                    jmp 0046F02E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046F003(C)
|
:0046F01A 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:0046F020 51                      push ecx

* Possible Reference to Dialog: DialogID_0151 
                                  |
:0046F021 6851010000              push 00000151
:0046F026 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046F029 E86AE0FFFF              call 0046D098

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046F018(U)
|
:0046F02E 8BE5                    mov esp, ebp
:0046F030 5D                      pop ebp
:0046F031 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0040D8D7   
|
:0046F034 55                      push ebp
:0046F035 8BEC                    mov ebp, esp
:0046F037 51                      push ecx
:0046F038 894DFC                  mov dword ptr [ebp-04], ecx
:0046F03B 8B45FC                  mov eax, dword ptr [ebp-04]
:0046F03E 8A4D08                  mov cl, byte ptr [ebp+08]
:0046F041 88480C                  mov byte ptr [eax+0C], cl
:0046F044 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046F047 6BC919                  imul ecx, 00000019
:0046F04A 81C140114A00            add ecx, 004A1140
:0046F050 E895D6F9FF              call 0040C6EA
:0046F055 25FF000000              and eax, 000000FF
:0046F05A 83F802                  cmp eax, 00000002
:0046F05D 7D14                    jge 0046F073
:0046F05F 8B55FC                  mov edx, dword ptr [ebp-04]
:0046F062 8A450C                  mov al, byte ptr [ebp+0C]
:0046F065 88420E                  mov byte ptr [edx+0E], al
:0046F068 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046F06B 8A5510                  mov dl, byte ptr [ebp+10]
:0046F06E 88510F                  mov byte ptr [ecx+0F], dl
:0046F071 EB0E                    jmp 0046F081

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046F05D(C)
|
:0046F073 8B45FC                  mov eax, dword ptr [ebp-04]
:0046F076 C6400EFF                mov [eax+0E], FF
:0046F07A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046F07D C6410FFF                mov [ecx+0F], FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046F071(U)
|
:0046F081 8B55FC                  mov edx, dword ptr [ebp-04]
:0046F084 C6420DC8                mov [edx+0D], C8
:0046F088 8B45FC                  mov eax, dword ptr [ebp-04]
:0046F08B C7401001000000          mov [eax+10], 00000001
:0046F092 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:0046F098 51                      push ecx

* Possible Reference to Dialog: DialogID_0149 
                                  |
:0046F099 6849010000              push 00000149
:0046F09E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046F0A1 E8F2DFFFFF              call 0046D098
:0046F0A6 8BE5                    mov esp, ebp
:0046F0A8 5D                      pop ebp
:0046F0A9 C20C00                  ret 000C


:0046F0AC 55                      push ebp
:0046F0AD 8BEC                    mov ebp, esp
:0046F0AF 83EC08                  sub esp, 00000008
:0046F0B2 894DFC                  mov dword ptr [ebp-04], ecx
:0046F0B5 8B4510                  mov eax, dword ptr [ebp+10]
:0046F0B8 50                      push eax
:0046F0B9 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046F0BC 51                      push ecx
:0046F0BD 8B5508                  mov edx, dword ptr [ebp+08]
:0046F0C0 52                      push edx
:0046F0C1 8B45FC                  mov eax, dword ptr [ebp-04]
:0046F0C4 8B4804                  mov ecx, dword ptr [eax+04]
:0046F0C7 51                      push ecx
:0046F0C8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046F0CB 83C114                  add ecx, 00000014
:0046F0CE 8B55FC                  mov edx, dword ptr [ebp-04]
:0046F0D1 8B4214                  mov eax, dword ptr [edx+14]
:0046F0D4 FF5024                  call [eax+24]
:0046F0D7 85C0                    test eax, eax
:0046F0D9 7407                    je 0046F0E2
:0046F0DB B801000000              mov eax, 00000001
:0046F0E0 EB79                    jmp 0046F15B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046F0D9(C)
|
:0046F0E2 8B4D08                  mov ecx, dword ptr [ebp+08]
:0046F0E5 894DF8                  mov dword ptr [ebp-08], ecx
:0046F0E8 837DF82B                cmp dword ptr [ebp-08], 0000002B
:0046F0EC 740B                    je 0046F0F9
:0046F0EE 817DF805040000          cmp dword ptr [ebp-08], 00000405
:0046F0F5 7414                    je 0046F10B
:0046F0F7 EB4B                    jmp 0046F144

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046F0EC(C)
|
:0046F0F9 6A00                    push 00000000
:0046F0FB 6A01                    push 00000001
:0046F0FD 8B5510                  mov edx, dword ptr [ebp+10]
:0046F100 52                      push edx
:0046F101 E8D82E0000              call 00471FDE
:0046F106 83C40C                  add esp, 0000000C
:0046F109 EB39                    jmp 0046F144

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046F0F5(C)
|
:0046F10B 817D10C8000000          cmp dword ptr [ebp+10], 000000C8
:0046F112 7D1F                    jge 0046F133
:0046F114 8B45FC                  mov eax, dword ptr [ebp-04]
:0046F117 8A480F                  mov cl, byte ptr [eax+0F]
:0046F11A 51                      push ecx
:0046F11B 8B55FC                  mov edx, dword ptr [ebp-04]
:0046F11E 8A420E                  mov al, byte ptr [edx+0E]
:0046F121 50                      push eax
:0046F122 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046F125 8A510C                  mov dl, byte ptr [ecx+0C]
:0046F128 52                      push edx
:0046F129 B970074B00              mov ecx, 004B0770
:0046F12E E869E6F9FF              call 0040D79C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046F112(C)
|
:0046F133 8B4510                  mov eax, dword ptr [ebp+10]
:0046F136 50                      push eax
:0046F137 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046F13A 8B5104                  mov edx, dword ptr [ecx+04]
:0046F13D 52                      push edx
:0046F13E FF15D4624800            call dword ptr [004862D4]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046F0F7(U), :0046F109(U)
|
:0046F144 8B4510                  mov eax, dword ptr [ebp+10]
:0046F147 50                      push eax
:0046F148 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046F14B 51                      push ecx
:0046F14C 8B5508                  mov edx, dword ptr [ebp+08]
:0046F14F 52                      push edx
:0046F150 8B45FC                  mov eax, dword ptr [ebp-04]
:0046F153 8B10                    mov edx, dword ptr [eax]
:0046F155 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046F158 FF5204                  call [edx+04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046F0E0(U)
|
:0046F15B 8BE5                    mov esp, ebp
:0046F15D 5D                      pop ebp
:0046F15E C20C00                  ret 000C


:0046F161 55                      push ebp
:0046F162 8BEC                    mov ebp, esp
:0046F164 83EC14                  sub esp, 00000014
:0046F167 894DEC                  mov dword ptr [ebp-14], ecx
:0046F16A 6A00                    push 00000000
:0046F16C B970074B00              mov ecx, 004B0770
:0046F171 E85AF0F9FF              call 0040E1D0
:0046F176 50                      push eax
:0046F177 6875040000              push 00000475
:0046F17C 8B45EC                  mov eax, dword ptr [ebp-14]
:0046F17F 8B4804                  mov ecx, dword ptr [eax+04]
:0046F182 51                      push ecx
:0046F183 FF15E4624800            call dword ptr [004862E4]
:0046F189 686E050000              push 0000056E
:0046F18E 8B55EC                  mov edx, dword ptr [ebp-14]
:0046F191 8B4204                  mov eax, dword ptr [edx+04]
:0046F194 50                      push eax
:0046F195 FF15DC624800            call dword ptr [004862DC]
:0046F19B 8945F0                  mov dword ptr [ebp-10], eax
:0046F19E 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046F1A1 51                      push ecx
:0046F1A2 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0046F1A5 81C1A8060000            add ecx, 000006A8
:0046F1AB E85A36FFFF              call 0046280A
:0046F1B0 68B1050000              push 000005B1
:0046F1B5 8B55EC                  mov edx, dword ptr [ebp-14]
:0046F1B8 8B4204                  mov eax, dword ptr [edx+04]
:0046F1BB 50                      push eax
:0046F1BC FF15DC624800            call dword ptr [004862DC]
:0046F1C2 8945F8                  mov dword ptr [ebp-08], eax
:0046F1C5 68EB030000              push 000003EB
:0046F1CA 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0046F1CD 8B5104                  mov edx, dword ptr [ecx+04]
:0046F1D0 52                      push edx
:0046F1D1 FF15DC624800            call dword ptr [004862DC]
:0046F1D7 8945FC                  mov dword ptr [ebp-04], eax
:0046F1DA 8D45F8                  lea eax, dword ptr [ebp-08]
:0046F1DD 50                      push eax
:0046F1DE 68786C4800              push 00486C78
:0046F1E3 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046F1E6 51                      push ecx
:0046F1E7 E895300000              call 00472281
:0046F1EC 83C40C                  add esp, 0000000C
:0046F1EF 6A00                    push 00000000
:0046F1F1 6A00                    push 00000000
:0046F1F3 680C130000              push 0000130C
:0046F1F8 8B55F0                  mov edx, dword ptr [ebp-10]
:0046F1FB 52                      push edx
:0046F1FC FF15F4624800            call dword ptr [004862F4]
:0046F202 6A00                    push 00000000
:0046F204 8B45F0                  mov eax, dword ptr [ebp-10]
:0046F207 50                      push eax
:0046F208 FF15E8624800            call dword ptr [004862E8]
:0046F20E 6A00                    push 00000000
:0046F210 68EB030000              push 000003EB
:0046F215 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0046F218 8B5104                  mov edx, dword ptr [ecx+04]
:0046F21B 52                      push edx
:0046F21C FF15DC624800            call dword ptr [004862DC]
:0046F222 50                      push eax
:0046F223 FF15E0624800            call dword ptr [004862E0]
:0046F229 6A05                    push 00000005
:0046F22B 68B1050000              push 000005B1
:0046F230 8B45EC                  mov eax, dword ptr [ebp-14]
:0046F233 8B4804                  mov ecx, dword ptr [eax+04]
:0046F236 51                      push ecx
:0046F237 FF15DC624800            call dword ptr [004862DC]
:0046F23D 50                      push eax
:0046F23E FF15E0624800            call dword ptr [004862E0]
:0046F244 68B1050000              push 000005B1
:0046F249 68B1050000              push 000005B1
:0046F24E 8B55EC                  mov edx, dword ptr [ebp-14]
:0046F251 8B4204                  mov eax, dword ptr [edx+04]
:0046F254 50                      push eax
:0046F255 FF15DC624800            call dword ptr [004862DC]
:0046F25B 50                      push eax
:0046F25C 6810010000              push 00000110
:0046F261 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0046F264 8B5104                  mov edx, dword ptr [ecx+04]
:0046F267 52                      push edx
:0046F268 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0046F26B 83C114                  add ecx, 00000014
:0046F26E 8B45EC                  mov eax, dword ptr [ebp-14]
:0046F271 8B5014                  mov edx, dword ptr [eax+14]
:0046F274 FF5224                  call [edx+24]
:0046F277 8B45EC                  mov eax, dword ptr [ebp-14]
:0046F27A 83C00C                  add eax, 0000000C
:0046F27D 50                      push eax
:0046F27E 6A00                    push 00000000
:0046F280 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0046F283 83C114                  add ecx, 00000014
:0046F286 E8F84AFFFF              call 00463D83
:0046F28B 6A00                    push 00000000
:0046F28D 6A02                    push 00000002
:0046F28F 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0046F292 8B5104                  mov edx, dword ptr [ecx+04]
:0046F295 52                      push edx
:0046F296 FF15DC624800            call dword ptr [004862DC]
:0046F29C 50                      push eax
:0046F29D FF15E8624800            call dword ptr [004862E8]
:0046F2A3 6A00                    push 00000000
:0046F2A5 8B45EC                  mov eax, dword ptr [ebp-14]
:0046F2A8 8B4804                  mov ecx, dword ptr [eax+04]
:0046F2AB 51                      push ecx
:0046F2AC FF15FC624800            call dword ptr [004862FC]
:0046F2B2 8945F4                  mov dword ptr [ebp-0C], eax
:0046F2B5 6A01                    push 00000001
:0046F2B7 6860F00000              push 0000F060
:0046F2BC 8B55F4                  mov edx, dword ptr [ebp-0C]
:0046F2BF 52                      push edx
:0046F2C0 FF1500634800            call dword ptr [00486300]
:0046F2C6 8B45EC                  mov eax, dword ptr [ebp-14]
:0046F2C9 8B4804                  mov ecx, dword ptr [eax+04]
:0046F2CC 51                      push ecx
:0046F2CD FF159C634800            call dword ptr [0048639C]
:0046F2D3 50                      push eax
:0046F2D4 8B55EC                  mov edx, dword ptr [ebp-14]
:0046F2D7 8B4204                  mov eax, dword ptr [edx+04]
:0046F2DA 50                      push eax
:0046F2DB E8C630FFFF              call 004623A6
:0046F2E0 83C408                  add esp, 00000008
:0046F2E3 8BE5                    mov esp, ebp
:0046F2E5 5D                      pop ebp
:0046F2E6 C3                      ret


:0046F2E7 55                      push ebp
:0046F2E8 8BEC                    mov ebp, esp
:0046F2EA 83EC08                  sub esp, 00000008
:0046F2ED 894DFC                  mov dword ptr [ebp-04], ecx
:0046F2F0 8B4508                  mov eax, dword ptr [ebp+08]
:0046F2F3 8945F8                  mov dword ptr [ebp-08], eax
:0046F2F6 817DF811010000          cmp dword ptr [ebp-08], 00000111
:0046F2FD 7402                    je 0046F301
:0046F2FF EB17                    jmp 0046F318

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046F2FD(C)
|
:0046F301 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0046F304 81E1FFFF0000            and ecx, 0000FFFF
:0046F30A 51                      push ecx
:0046F30B 8B55FC                  mov edx, dword ptr [ebp-04]
:0046F30E 8B4204                  mov eax, dword ptr [edx+04]
:0046F311 50                      push eax
:0046F312 FF15D4624800            call dword ptr [004862D4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046F2FF(U)
|
:0046F318 8B4D10                  mov ecx, dword ptr [ebp+10]
:0046F31B 51                      push ecx
:0046F31C 8B550C                  mov edx, dword ptr [ebp+0C]
:0046F31F 52                      push edx
:0046F320 8B4508                  mov eax, dword ptr [ebp+08]
:0046F323 50                      push eax
:0046F324 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046F327 8B11                    mov edx, dword ptr [ecx]
:0046F329 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046F32C FF5204                  call [edx+04]
:0046F32F 8BE5                    mov esp, ebp
:0046F331 5D                      pop ebp
:0046F332 C20C00                  ret 000C


:0046F335 55                      push ebp
:0046F336 8BEC                    mov ebp, esp
:0046F338 81ECC8000000            sub esp, 000000C8
:0046F33E 56                      push esi
:0046F33F 898D3CFFFFFF            mov dword ptr [ebp+FFFFFF3C], ecx
:0046F345 C7856CFFFFFF00000000    mov dword ptr [ebp+FFFFFF6C], 00000000
:0046F34F C78554FFFFFF00000000    mov dword ptr [ebp+FFFFFF54], 00000000
:0046F359 8B853CFFFFFF            mov eax, dword ptr [ebp+FFFFFF3C]
:0046F35F 8B4810                  mov ecx, dword ptr [eax+10]
:0046F362 898D50FFFFFF            mov dword ptr [ebp+FFFFFF50], ecx
:0046F368 8D5590                  lea edx, dword ptr [ebp-70]
:0046F36B 8955F4                  mov dword ptr [ebp-0C], edx
:0046F36E 8B853CFFFFFF            mov eax, dword ptr [ebp+FFFFFF3C]
:0046F374 8B4804                  mov ecx, dword ptr [eax+04]
:0046F377 51                      push ecx
:0046F378 FF1598624800            call dword ptr [00486298]
:0046F37E 89855CFFFFFF            mov dword ptr [ebp+FFFFFF5C], eax

* Possible StringData Ref from Data Obj ->""
                                  |
:0046F384 6888E74800              push 0048E788
:0046F389 6A00                    push 00000000
:0046F38B 6A00                    push 00000000
:0046F38D 6A00                    push 00000000
:0046F38F 6A04                    push 00000004
:0046F391 6886000000              push 00000086
:0046F396 6A00                    push 00000000
:0046F398 6A00                    push 00000000
:0046F39A 6A00                    push 00000000
:0046F39C 6890010000              push 00000190
:0046F3A1 6A00                    push 00000000
:0046F3A3 6A00                    push 00000000
:0046F3A5 6A00                    push 00000000
:0046F3A7 6A48                    push 00000048
:0046F3A9 6A5A                    push 0000005A
:0046F3AB 8B955CFFFFFF            mov edx, dword ptr [ebp+FFFFFF5C]
:0046F3B1 52                      push edx
:0046F3B2 FF153C604800            call dword ptr [0048603C]
:0046F3B8 50                      push eax
:0046F3B9 6A09                    push 00000009
:0046F3BB FF15E8604800            call dword ptr [004860E8]
:0046F3C1 6BC0FF                  imul eax, FFFFFFFF
:0046F3C4 50                      push eax
:0046F3C5 FF1588604800            call dword ptr [00486088]
:0046F3CB 894588                  mov dword ptr [ebp-78], eax
:0046F3CE 8B4588                  mov eax, dword ptr [ebp-78]
:0046F3D1 50                      push eax
:0046F3D2 8B8D5CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF5C]
:0046F3D8 51                      push ecx
:0046F3D9 FF156C604800            call dword ptr [0048606C]
:0046F3DF 898570FFFFFF            mov dword ptr [ebp+FFFFFF70], eax
:0046F3E5 EB0F                    jmp 0046F3F6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046F4D7(U)
|
:0046F3E7 8B9550FFFFFF            mov edx, dword ptr [ebp+FFFFFF50]
:0046F3ED 83C201                  add edx, 00000001
:0046F3F0 899550FFFFFF            mov dword ptr [ebp+FFFFFF50], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046F3E5(U)
|
:0046F3F6 8B8550FFFFFF            mov eax, dword ptr [ebp+FFFFFF50]
:0046F3FC 0FBE08                  movsx ecx, byte ptr [eax]
:0046F3FF 85C9                    test ecx, ecx
:0046F401 7412                    je 0046F415
:0046F403 8B9550FFFFFF            mov edx, dword ptr [ebp+FFFFFF50]
:0046F409 0FBE02                  movsx eax, byte ptr [edx]
:0046F40C 83F80A                  cmp eax, 0000000A
:0046F40F 0F85AC000000            jne 0046F4C1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046F401(C)
|
:0046F415 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046F418 C60100                  mov byte ptr [ecx], 00
:0046F41B 8D5590                  lea edx, dword ptr [ebp-70]
:0046F41E 52                      push edx
:0046F41F E836080100              call 0047FC5A
:0046F424 83C404                  add esp, 00000004
:0046F427 898558FFFFFF            mov dword ptr [ebp+FFFFFF58], eax
:0046F42D 83BD58FFFFFF00          cmp dword ptr [ebp+FFFFFF58], 00000000
:0046F434 751B                    jne 0046F451

* Possible StringData Ref from Data Obj ->"I"
                                  |
:0046F436 6890E74800              push 0048E790
:0046F43B 8D4590                  lea eax, dword ptr [ebp-70]
:0046F43E 50                      push eax
:0046F43F E839080100              call 0047FC7D
:0046F444 83C408                  add esp, 00000008
:0046F447 C78558FFFFFF01000000    mov dword ptr [ebp+FFFFFF58], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046F434(C)
|
:0046F451 8D4DD0                  lea ecx, dword ptr [ebp-30]
:0046F454 51                      push ecx
:0046F455 8B9558FFFFFF            mov edx, dword ptr [ebp+FFFFFF58]
:0046F45B 52                      push edx
:0046F45C 8D4590                  lea eax, dword ptr [ebp-70]
:0046F45F 50                      push eax
:0046F460 8B8D5CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF5C]
:0046F466 51                      push ecx
:0046F467 FF1590604800            call dword ptr [00486090]
:0046F46D 8B9554FFFFFF            mov edx, dword ptr [ebp+FFFFFF54]
:0046F473 0355D4                  add edx, dword ptr [ebp-2C]
:0046F476 899554FFFFFF            mov dword ptr [ebp+FFFFFF54], edx
:0046F47C 8B856CFFFFFF            mov eax, dword ptr [ebp+FFFFFF6C]
:0046F482 3B45D0                  cmp eax, dword ptr [ebp-30]
:0046F485 7E0E                    jle 0046F495
:0046F487 8B8D6CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF6C]
:0046F48D 898D38FFFFFF            mov dword ptr [ebp+FFFFFF38], ecx
:0046F493 EB09                    jmp 0046F49E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046F485(C)
|
:0046F495 8B55D0                  mov edx, dword ptr [ebp-30]
:0046F498 899538FFFFFF            mov dword ptr [ebp+FFFFFF38], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046F493(U)
|
:0046F49E 8B8538FFFFFF            mov eax, dword ptr [ebp+FFFFFF38]
:0046F4A4 89856CFFFFFF            mov dword ptr [ebp+FFFFFF6C], eax
:0046F4AA 8B8D50FFFFFF            mov ecx, dword ptr [ebp+FFFFFF50]
:0046F4B0 0FBE11                  movsx edx, byte ptr [ecx]
:0046F4B3 85D2                    test edx, edx
:0046F4B5 7502                    jne 0046F4B9
:0046F4B7 EB23                    jmp 0046F4DC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046F4B5(C)
|
:0046F4B9 8D4590                  lea eax, dword ptr [ebp-70]
:0046F4BC 8945F4                  mov dword ptr [ebp-0C], eax
:0046F4BF EB16                    jmp 0046F4D7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046F40F(C)
|
:0046F4C1 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046F4C4 8B9550FFFFFF            mov edx, dword ptr [ebp+FFFFFF50]
:0046F4CA 8A02                    mov al, byte ptr [edx]
:0046F4CC 8801                    mov byte ptr [ecx], al
:0046F4CE 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046F4D1 83C101                  add ecx, 00000001
:0046F4D4 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046F4BF(U)
|
:0046F4D7 E90BFFFFFF              jmp 0046F3E7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046F4B7(U)
|
:0046F4DC 8B9570FFFFFF            mov edx, dword ptr [ebp+FFFFFF70]
:0046F4E2 52                      push edx
:0046F4E3 8B855CFFFFFF            mov eax, dword ptr [ebp+FFFFFF5C]
:0046F4E9 50                      push eax
:0046F4EA FF156C604800            call dword ptr [0048606C]
:0046F4F0 8B4D88                  mov ecx, dword ptr [ebp-78]
:0046F4F3 51                      push ecx
:0046F4F4 FF1548604800            call dword ptr [00486048]
:0046F4FA 8B955CFFFFFF            mov edx, dword ptr [ebp+FFFFFF5C]
:0046F500 52                      push edx
:0046F501 8B853CFFFFFF            mov eax, dword ptr [ebp+FFFFFF3C]
:0046F507 8B4804                  mov ecx, dword ptr [eax+04]
:0046F50A 51                      push ecx
:0046F50B FF159C624800            call dword ptr [0048629C]

* Possible Reference to Dialog: DialogID_0153, CONTROL_ID:0534, ""
                                  |
:0046F511 6834050000              push 00000534
:0046F516 8B953CFFFFFF            mov edx, dword ptr [ebp+FFFFFF3C]
:0046F51C 8B4204                  mov eax, dword ptr [edx+04]
:0046F51F 50                      push eax
:0046F520 FF15DC624800            call dword ptr [004862DC]
:0046F526 8945F8                  mov dword ptr [ebp-08], eax
:0046F529 8D4DD8                  lea ecx, dword ptr [ebp-28]
:0046F52C 51                      push ecx
:0046F52D 8B55F8                  mov edx, dword ptr [ebp-08]
:0046F530 52                      push edx
:0046F531 FF1598634800            call dword ptr [00486398]
:0046F537 8B45E0                  mov eax, dword ptr [ebp-20]
:0046F53A 2B45D8                  sub eax, dword ptr [ebp-28]
:0046F53D 39856CFFFFFF            cmp dword ptr [ebp+FFFFFF6C], eax
:0046F543 7D0C                    jge 0046F551
:0046F545 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0046F548 2B4DD8                  sub ecx, dword ptr [ebp-28]
:0046F54B 898D6CFFFFFF            mov dword ptr [ebp+FFFFFF6C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046F543(C)
|
:0046F551 C78540FFFFFF00000000    mov dword ptr [ebp+FFFFFF40], 00000000
:0046F55B 8B55E4                  mov edx, dword ptr [ebp-1C]
:0046F55E 2B55DC                  sub edx, dword ptr [ebp-24]
:0046F561 399554FFFFFF            cmp dword ptr [ebp+FFFFFF54], edx
:0046F567 7D17                    jge 0046F580
:0046F569 8B45E4                  mov eax, dword ptr [ebp-1C]
:0046F56C 2B45DC                  sub eax, dword ptr [ebp-24]
:0046F56F 2B8554FFFFFF            sub eax, dword ptr [ebp+FFFFFF54]
:0046F575 99                      cdq
:0046F576 2BC2                    sub eax, edx
:0046F578 D1F8                    sar eax, 1
:0046F57A 898540FFFFFF            mov dword ptr [ebp+FFFFFF40], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046F567(C)
|
:0046F580 8B45D8                  mov eax, dword ptr [ebp-28]
:0046F583 898560FFFFFF            mov dword ptr [ebp+FFFFFF60], eax
:0046F589 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0046F58C 898D64FFFFFF            mov dword ptr [ebp+FFFFFF64], ecx
:0046F592 8D9560FFFFFF            lea edx, dword ptr [ebp+FFFFFF60]
:0046F598 52                      push edx
:0046F599 8B853CFFFFFF            mov eax, dword ptr [ebp+FFFFFF3C]
:0046F59F 8B4804                  mov ecx, dword ptr [eax+04]
:0046F5A2 51                      push ecx
:0046F5A3 FF1564624800            call dword ptr [00486264]
:0046F5A9 6A0C                    push 0000000C
:0046F5AB 8B9554FFFFFF            mov edx, dword ptr [ebp+FFFFFF54]
:0046F5B1 52                      push edx
:0046F5B2 8B856CFFFFFF            mov eax, dword ptr [ebp+FFFFFF6C]
:0046F5B8 50                      push eax
:0046F5B9 8B8D64FFFFFF            mov ecx, dword ptr [ebp+FFFFFF64]
:0046F5BF 038D40FFFFFF            add ecx, dword ptr [ebp+FFFFFF40]
:0046F5C5 51                      push ecx
:0046F5C6 8B9560FFFFFF            mov edx, dword ptr [ebp+FFFFFF60]
:0046F5CC 52                      push edx
:0046F5CD 6A00                    push 00000000
:0046F5CF 8B45F8                  mov eax, dword ptr [ebp-08]
:0046F5D2 50                      push eax
:0046F5D3 FF1580624800            call dword ptr [00486280]
:0046F5D9 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0046F5DC 2B4DD8                  sub ecx, dword ptr [ebp-28]
:0046F5DF 8B956CFFFFFF            mov edx, dword ptr [ebp+FFFFFF6C]
:0046F5E5 2BD1                    sub edx, ecx
:0046F5E7 89956CFFFFFF            mov dword ptr [ebp+FFFFFF6C], edx
:0046F5ED 8B45E4                  mov eax, dword ptr [ebp-1C]
:0046F5F0 2B45DC                  sub eax, dword ptr [ebp-24]
:0046F5F3 8B8D54FFFFFF            mov ecx, dword ptr [ebp+FFFFFF54]
:0046F5F9 2BC8                    sub ecx, eax
:0046F5FB 898D54FFFFFF            mov dword ptr [ebp+FFFFFF54], ecx
:0046F601 83BD54FFFFFF00          cmp dword ptr [ebp+FFFFFF54], 00000000
:0046F608 7D0A                    jge 0046F614
:0046F60A C78554FFFFFF00000000    mov dword ptr [ebp+FFFFFF54], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046F608(C)
|
:0046F614 6AF0                    push FFFFFFF0
:0046F616 8B55F8                  mov edx, dword ptr [ebp-08]
:0046F619 52                      push edx
:0046F61A FF15A0634800            call dword ptr [004863A0]
:0046F620 8945FC                  mov dword ptr [ebp-04], eax
:0046F623 8B45FC                  mov eax, dword ptr [ebp-04]
:0046F626 24FE                    and al, FE
:0046F628 8945FC                  mov dword ptr [ebp-04], eax
:0046F62B 8B8D3CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF3C]
:0046F631 8B55FC                  mov edx, dword ptr [ebp-04]
:0046F634 0B510C                  or edx, dword ptr [ecx+0C]
:0046F637 8955FC                  mov dword ptr [ebp-04], edx
:0046F63A 8B45FC                  mov eax, dword ptr [ebp-04]
:0046F63D 50                      push eax
:0046F63E 6AF0                    push FFFFFFF0
:0046F640 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046F643 51                      push ecx
:0046F644 FF1550634800            call dword ptr [00486350]
:0046F64A 8B953CFFFFFF            mov edx, dword ptr [ebp+FFFFFF3C]
:0046F650 8B4210                  mov eax, dword ptr [edx+10]
:0046F653 50                      push eax
:0046F654 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046F657 51                      push ecx
:0046F658 FF1560634800            call dword ptr [00486360]
:0046F65E 8B953CFFFFFF            mov edx, dword ptr [ebp+FFFFFF3C]
:0046F664 837A1400                cmp dword ptr [edx+14], 00000000
:0046F668 741A                    je 0046F684
:0046F66A 8B853CFFFFFF            mov eax, dword ptr [ebp+FFFFFF3C]
:0046F670 8B4814                  mov ecx, dword ptr [eax+14]
:0046F673 51                      push ecx
:0046F674 8B953CFFFFFF            mov edx, dword ptr [ebp+FFFFFF3C]
:0046F67A 8B4204                  mov eax, dword ptr [edx+04]
:0046F67D 50                      push eax
:0046F67E FF1560634800            call dword ptr [00486360]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046F668(C)
|
:0046F684 8D4DD8                  lea ecx, dword ptr [ebp-28]
:0046F687 51                      push ecx
:0046F688 8B953CFFFFFF            mov edx, dword ptr [ebp+FFFFFF3C]
:0046F68E 8B4204                  mov eax, dword ptr [edx+04]
:0046F691 50                      push eax
:0046F692 FF1598634800            call dword ptr [00486398]
:0046F698 6A0E                    push 0000000E
:0046F69A 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0046F69D 2B4DDC                  sub ecx, dword ptr [ebp-24]
:0046F6A0 038D54FFFFFF            add ecx, dword ptr [ebp+FFFFFF54]
:0046F6A6 51                      push ecx
:0046F6A7 8B55E0                  mov edx, dword ptr [ebp-20]
:0046F6AA 2B55D8                  sub edx, dword ptr [ebp-28]
:0046F6AD 03956CFFFFFF            add edx, dword ptr [ebp+FFFFFF6C]
:0046F6B3 52                      push edx
:0046F6B4 6A00                    push 00000000
:0046F6B6 6A00                    push 00000000
:0046F6B8 6A00                    push 00000000
:0046F6BA 8B853CFFFFFF            mov eax, dword ptr [ebp+FFFFFF3C]
:0046F6C0 8B4804                  mov ecx, dword ptr [eax+04]
:0046F6C3 51                      push ecx
:0046F6C4 FF1580624800            call dword ptr [00486280]
:0046F6CA C7458C00000000          mov [ebp-74], 00000000
:0046F6D1 8D55D8                  lea edx, dword ptr [ebp-28]
:0046F6D4 52                      push edx
:0046F6D5 8B853CFFFFFF            mov eax, dword ptr [ebp+FFFFFF3C]
:0046F6DB 8B4804                  mov ecx, dword ptr [eax+04]
:0046F6DE 51                      push ecx
:0046F6DF FF15EC624800            call dword ptr [004862EC]
:0046F6E5 8B55E0                  mov edx, dword ptr [ebp-20]
:0046F6E8 2B55D8                  sub edx, dword ptr [ebp-28]
:0046F6EB 899568FFFFFF            mov dword ptr [ebp+FFFFFF68], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046F710(U)
|
:0046F6F1 6A02                    push 00000002
:0046F6F3 8B45F8                  mov eax, dword ptr [ebp-08]
:0046F6F6 50                      push eax
:0046F6F7 FF1578624800            call dword ptr [00486278]
:0046F6FD 85C0                    test eax, eax
:0046F6FF 7411                    je 0046F712
:0046F701 6A02                    push 00000002
:0046F703 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046F706 51                      push ecx
:0046F707 FF1578624800            call dword ptr [00486278]
:0046F70D 8945F8                  mov dword ptr [ebp-08], eax
:0046F710 EBDF                    jmp 0046F6F1

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046F6FF(C), :0046F85E(U)
|
:0046F712 837DF800                cmp dword ptr [ebp-08], 00000000
:0046F716 0F8447010000            je 0046F863
:0046F71C 6A08                    push 00000008
:0046F71E 8D9574FFFFFF            lea edx, dword ptr [ebp+FFFFFF74]
:0046F724 52                      push edx
:0046F725 8B45F8                  mov eax, dword ptr [ebp-08]
:0046F728 50                      push eax
:0046F729 FF15BC634800            call dword ptr [004863BC]

* Possible StringData Ref from Data Obj ->"BUTTON"
                                  |
:0046F72F 6894E74800              push 0048E794
:0046F734 8D8D74FFFFFF            lea ecx, dword ptr [ebp+FFFFFF74]
:0046F73A 51                      push ecx
:0046F73B E810200100              call 00481750
:0046F740 83C408                  add esp, 00000008
:0046F743 85C0                    test eax, eax
:0046F745 0F8504010000            jne 0046F84F
:0046F74B 837D8C03                cmp dword ptr [ebp-74], 00000003
:0046F74F 0F8DF2000000            jnl 0046F847
:0046F755 8D55D8                  lea edx, dword ptr [ebp-28]
:0046F758 52                      push edx
:0046F759 8B45F8                  mov eax, dword ptr [ebp-08]
:0046F75C 50                      push eax
:0046F75D FF1598634800            call dword ptr [00486398]
:0046F763 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0046F766 2B4DD8                  sub ecx, dword ptr [ebp-28]
:0046F769 8B9568FFFFFF            mov edx, dword ptr [ebp+FFFFFF68]
:0046F76F 2BD1                    sub edx, ecx
:0046F771 899568FFFFFF            mov dword ptr [ebp+FFFFFF68], edx
:0046F777 8B458C                  mov eax, dword ptr [ebp-74]
:0046F77A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046F77D 894C85E8                mov dword ptr [ebp+4*eax-18], ecx
:0046F781 8B558C                  mov edx, dword ptr [ebp-74]
:0046F784 8B45D8                  mov eax, dword ptr [ebp-28]
:0046F787 89849544FFFFFF          mov dword ptr [ebp+4*edx-000000BC], eax
:0046F78E 8B4D8C                  mov ecx, dword ptr [ebp-74]
:0046F791 898D7CFFFFFF            mov dword ptr [ebp+FFFFFF7C], ecx
:0046F797 EB0F                    jmp 0046F7A8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046F839(U)
|
:0046F799 8B957CFFFFFF            mov edx, dword ptr [ebp+FFFFFF7C]
:0046F79F 83EA01                  sub edx, 00000001
:0046F7A2 89957CFFFFFF            mov dword ptr [ebp+FFFFFF7C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046F797(U)
|
:0046F7A8 83BD7CFFFFFF00          cmp dword ptr [ebp+FFFFFF7C], 00000000
:0046F7AF 0F8E89000000            jle 0046F83E
:0046F7B5 8B857CFFFFFF            mov eax, dword ptr [ebp+FFFFFF7C]
:0046F7BB 8B8D7CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF7C]
:0046F7C1 8B948544FFFFFF          mov edx, dword ptr [ebp+4*eax-000000BC]
:0046F7C8 3B948D40FFFFFF          cmp edx, dword ptr [ebp+4*ecx-000000C0]
:0046F7CF 7D68                    jge 0046F839
:0046F7D1 8B857CFFFFFF            mov eax, dword ptr [ebp+FFFFFF7C]
:0046F7D7 8B8C8540FFFFFF          mov ecx, dword ptr [ebp+4*eax-000000C0]
:0046F7DE 894D80                  mov dword ptr [ebp-80], ecx
:0046F7E1 8B957CFFFFFF            mov edx, dword ptr [ebp+FFFFFF7C]
:0046F7E7 8B857CFFFFFF            mov eax, dword ptr [ebp+FFFFFF7C]
:0046F7ED 8B8C8544FFFFFF          mov ecx, dword ptr [ebp+4*eax-000000BC]
:0046F7F4 898C9540FFFFFF          mov dword ptr [ebp+4*edx-000000C0], ecx
:0046F7FB 8B957CFFFFFF            mov edx, dword ptr [ebp+FFFFFF7C]
:0046F801 8B4580                  mov eax, dword ptr [ebp-80]
:0046F804 89849544FFFFFF          mov dword ptr [ebp+4*edx-000000BC], eax
:0046F80B 8B8D7CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF7C]
:0046F811 8B548DE4                mov edx, dword ptr [ebp+4*ecx-1C]
:0046F815 895580                  mov dword ptr [ebp-80], edx
:0046F818 8B857CFFFFFF            mov eax, dword ptr [ebp+FFFFFF7C]
:0046F81E 8B8D7CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF7C]
:0046F824 8B548DE8                mov edx, dword ptr [ebp+4*ecx-18]
:0046F828 895485E4                mov dword ptr [ebp+4*eax-1C], edx
:0046F82C 8B857CFFFFFF            mov eax, dword ptr [ebp+FFFFFF7C]
:0046F832 8B4D80                  mov ecx, dword ptr [ebp-80]
:0046F835 894C85E8                mov dword ptr [ebp+4*eax-18], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046F7CF(C)
|
:0046F839 E95BFFFFFF              jmp 0046F799

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046F7AF(C)
|
:0046F83E 8B558C                  mov edx, dword ptr [ebp-74]
:0046F841 83C201                  add edx, 00000001
:0046F844 89558C                  mov dword ptr [ebp-74], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046F74F(C)
|
:0046F847 837D8C03                cmp dword ptr [ebp-74], 00000003
:0046F84B 7C02                    jl 0046F84F
:0046F84D EB14                    jmp 0046F863

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046F745(C), :0046F84B(C)
|
:0046F84F 6A03                    push 00000003
:0046F851 8B45F8                  mov eax, dword ptr [ebp-08]
:0046F854 50                      push eax
:0046F855 FF1578624800            call dword ptr [00486278]
:0046F85B 8945F8                  mov dword ptr [ebp-08], eax
:0046F85E E9AFFEFFFF              jmp 0046F712

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046F716(C), :0046F84D(U)
|
:0046F863 C7458400000000          mov [ebp-7C], 00000000
:0046F86A C7857CFFFFFF00000000    mov dword ptr [ebp+FFFFFF7C], 00000000
:0046F874 EB0F                    jmp 0046F885

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046F955(U)
|
:0046F876 8B8D7CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF7C]
:0046F87C 83C101                  add ecx, 00000001
:0046F87F 898D7CFFFFFF            mov dword ptr [ebp+FFFFFF7C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046F874(U)
|
:0046F885 8B957CFFFFFF            mov edx, dword ptr [ebp+FFFFFF7C]
:0046F88B 3B558C                  cmp edx, dword ptr [ebp-74]
:0046F88E 0F8DC6000000            jnl 0046F95A
:0046F894 8D45D8                  lea eax, dword ptr [ebp-28]
:0046F897 50                      push eax
:0046F898 8B8D7CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF7C]
:0046F89E 8B548DE8                mov edx, dword ptr [ebp+4*ecx-18]
:0046F8A2 52                      push edx
:0046F8A3 FF1598634800            call dword ptr [00486398]
:0046F8A9 8B45D8                  mov eax, dword ptr [ebp-28]
:0046F8AC 898560FFFFFF            mov dword ptr [ebp+FFFFFF60], eax
:0046F8B2 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0046F8B5 898D64FFFFFF            mov dword ptr [ebp+FFFFFF64], ecx
:0046F8BB 8D9560FFFFFF            lea edx, dword ptr [ebp+FFFFFF60]
:0046F8C1 52                      push edx
:0046F8C2 8B853CFFFFFF            mov eax, dword ptr [ebp+FFFFFF3C]
:0046F8C8 8B4804                  mov ecx, dword ptr [eax+04]
:0046F8CB 51                      push ecx
:0046F8CC FF1564624800            call dword ptr [00486264]
:0046F8D2 6A0D                    push 0000000D
:0046F8D4 6A00                    push 00000000
:0046F8D6 6A00                    push 00000000
:0046F8D8 8B9564FFFFFF            mov edx, dword ptr [ebp+FFFFFF64]
:0046F8DE 039554FFFFFF            add edx, dword ptr [ebp+FFFFFF54]
:0046F8E4 52                      push edx
:0046F8E5 8B857CFFFFFF            mov eax, dword ptr [ebp+FFFFFF7C]
:0046F8EB 83C001                  add eax, 00000001
:0046F8EE 8B8D68FFFFFF            mov ecx, dword ptr [ebp+FFFFFF68]
:0046F8F4 0FAFC8                  imul ecx, eax
:0046F8F7 8B758C                  mov esi, dword ptr [ebp-74]
:0046F8FA 83C601                  add esi, 00000001
:0046F8FD 8BC1                    mov eax, ecx
:0046F8FF 99                      cdq
:0046F900 F7FE                    idiv esi
:0046F902 8B5584                  mov edx, dword ptr [ebp-7C]
:0046F905 03D0                    add edx, eax
:0046F907 52                      push edx
:0046F908 6A00                    push 00000000
:0046F90A 8B857CFFFFFF            mov eax, dword ptr [ebp+FFFFFF7C]
:0046F910 8B4C85E8                mov ecx, dword ptr [ebp+4*eax-18]
:0046F914 51                      push ecx
:0046F915 FF1580624800            call dword ptr [00486280]
:0046F91B 8B55E0                  mov edx, dword ptr [ebp-20]
:0046F91E 2B55D8                  sub edx, dword ptr [ebp-28]
:0046F921 8B4584                  mov eax, dword ptr [ebp-7C]
:0046F924 03C2                    add eax, edx
:0046F926 894584                  mov dword ptr [ebp-7C], eax
:0046F929 6AF0                    push FFFFFFF0
:0046F92B 8B8D7CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF7C]
:0046F931 8B548DE8                mov edx, dword ptr [ebp+4*ecx-18]
:0046F935 52                      push edx
:0046F936 FF15A0634800            call dword ptr [004863A0]
:0046F93C 83E001                  and eax, 00000001
:0046F93F 83F801                  cmp eax, 00000001
:0046F942 7511                    jne 0046F955
:0046F944 8B857CFFFFFF            mov eax, dword ptr [ebp+FFFFFF7C]
:0046F94A 8B4C85E8                mov ecx, dword ptr [ebp+4*eax-18]
:0046F94E 51                      push ecx
:0046F94F FF151C634800            call dword ptr [0048631C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046F942(C)
|
:0046F955 E91CFFFFFF              jmp 0046F876

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046F88E(C)
|
:0046F95A 8B953CFFFFFF            mov edx, dword ptr [ebp+FFFFFF3C]
:0046F960 8B4204                  mov eax, dword ptr [edx+04]
:0046F963 50                      push eax
:0046F964 FF159C634800            call dword ptr [0048639C]
:0046F96A 50                      push eax
:0046F96B 8B8D3CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF3C]
:0046F971 8B5104                  mov edx, dword ptr [ecx+04]
:0046F974 52                      push edx
:0046F975 E82C2AFFFF              call 004623A6
:0046F97A 83C408                  add esp, 00000008
:0046F97D 5E                      pop esi
:0046F97E 8BE5                    mov esp, ebp
:0046F980 5D                      pop ebp
:0046F981 C3                      ret



* Referenced by a CALL at Addresses:
|:00474B42   , :00474B9E   
|
:0046F982 55                      push ebp
:0046F983 8BEC                    mov ebp, esp
:0046F985 51                      push ecx
:0046F986 894DFC                  mov dword ptr [ebp-04], ecx
:0046F989 8B45FC                  mov eax, dword ptr [ebp-04]
:0046F98C 8B4D18                  mov ecx, dword ptr [ebp+18]
:0046F98F 89480C                  mov dword ptr [eax+0C], ecx
:0046F992 8B55FC                  mov edx, dword ptr [ebp-04]
:0046F995 8B450C                  mov eax, dword ptr [ebp+0C]
:0046F998 894210                  mov dword ptr [edx+10], eax
:0046F99B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046F99E 8B5510                  mov edx, dword ptr [ebp+10]
:0046F9A1 895114                  mov dword ptr [ecx+14], edx
:0046F9A4 8B4508                  mov eax, dword ptr [ebp+08]
:0046F9A7 50                      push eax
:0046F9A8 8B4D14                  mov ecx, dword ptr [ebp+14]
:0046F9AB 51                      push ecx
:0046F9AC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046F9AF E8E4D6FFFF              call 0046D098
:0046F9B4 8BE5                    mov esp, ebp
:0046F9B6 5D                      pop ebp
:0046F9B7 C21400                  ret 0014


:0046F9BA 55                      push ebp
:0046F9BB 8BEC                    mov ebp, esp
:0046F9BD 83EC20                  sub esp, 00000020
:0046F9C0 894DE0                  mov dword ptr [ebp-20], ecx
:0046F9C3 6A00                    push 00000000
:0046F9C5 B9B0694B00              mov ecx, 004B69B0
:0046F9CA E8DE4C0000              call 004746AD
:0046F9CF 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0046F9D2 E8ABEFFFFF              call 0046E982
:0046F9D7 8D45E8                  lea eax, dword ptr [ebp-18]
:0046F9DA 50                      push eax
:0046F9DB FF1568624800            call dword ptr [00486268]
:0046F9E1 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0046F9E4 51                      push ecx
:0046F9E5 8B55E0                  mov edx, dword ptr [ebp-20]
:0046F9E8 8B4204                  mov eax, dword ptr [edx+04]
:0046F9EB 50                      push eax
:0046F9EC FF1598634800            call dword ptr [00486398]
:0046F9F2 6A00                    push 00000000
:0046F9F4 FF157C624800            call dword ptr [0048627C]
:0046F9FA 99                      cdq
:0046F9FB 2BC2                    sub eax, edx
:0046F9FD D1F8                    sar eax, 1
:0046F9FF 3945E8                  cmp dword ptr [ebp-18], eax
:0046FA02 7E0E                    jle 0046FA12
:0046FA04 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046FA07 2B4DF0                  sub ecx, dword ptr [ebp-10]
:0046FA0A 8B55E8                  mov edx, dword ptr [ebp-18]
:0046FA0D 2BD1                    sub edx, ecx
:0046FA0F 8955E8                  mov dword ptr [ebp-18], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046FA02(C)
|
:0046FA12 6A01                    push 00000001
:0046FA14 FF157C624800            call dword ptr [0048627C]
:0046FA1A 50                      push eax
:0046FA1B 8B45FC                  mov eax, dword ptr [ebp-04]
:0046FA1E 2B45F4                  sub eax, dword ptr [ebp-0C]
:0046FA21 50                      push eax
:0046FA22 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0046FA25 51                      push ecx
:0046FA26 FF15E8604800            call dword ptr [004860E8]
:0046FA2C 8B55EC                  mov edx, dword ptr [ebp-14]
:0046FA2F 2BD0                    sub edx, eax
:0046FA31 8955EC                  mov dword ptr [ebp-14], edx
:0046FA34 6A01                    push 00000001
:0046FA36 FF157C624800            call dword ptr [0048627C]
:0046FA3C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046FA3F 2B4DF4                  sub ecx, dword ptr [ebp-0C]
:0046FA42 2BC1                    sub eax, ecx
:0046FA44 8945E4                  mov dword ptr [ebp-1C], eax
:0046FA47 837DEC00                cmp dword ptr [ebp-14], 00000000
:0046FA4B 7D09                    jge 0046FA56
:0046FA4D C745EC00000000          mov [ebp-14], 00000000
:0046FA54 EB0E                    jmp 0046FA64

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046FA4B(C)
|
:0046FA56 8B55EC                  mov edx, dword ptr [ebp-14]
:0046FA59 3B55E4                  cmp edx, dword ptr [ebp-1C]
:0046FA5C 7E06                    jle 0046FA64
:0046FA5E 8B45E4                  mov eax, dword ptr [ebp-1C]
:0046FA61 8945EC                  mov dword ptr [ebp-14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046FA54(U), :0046FA5C(C)
|
:0046FA64 6A0D                    push 0000000D
:0046FA66 6A00                    push 00000000
:0046FA68 6A00                    push 00000000
:0046FA6A 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0046FA6D 51                      push ecx
:0046FA6E 8B55E8                  mov edx, dword ptr [ebp-18]
:0046FA71 52                      push edx
:0046FA72 6A00                    push 00000000
:0046FA74 8B45E0                  mov eax, dword ptr [ebp-20]
:0046FA77 8B4804                  mov ecx, dword ptr [eax+04]
:0046FA7A 51                      push ecx
:0046FA7B FF1580624800            call dword ptr [00486280]
:0046FA81 8BE5                    mov esp, ebp
:0046FA83 5D                      pop ebp
:0046FA84 C3                      ret


:0046FA85 55                      push ebp
:0046FA86 8BEC                    mov ebp, esp
:0046FA88 81ECD0000000            sub esp, 000000D0
:0046FA8E 898D30FFFFFF            mov dword ptr [ebp+FFFFFF30], ecx
:0046FA94 682C694B00              push 004B692C
:0046FA99 6823050000              push 00000523
:0046FA9E 8B8530FFFFFF            mov eax, dword ptr [ebp+FFFFFF30]
:0046FAA4 8B4804                  mov ecx, dword ptr [eax+04]
:0046FAA7 51                      push ecx
:0046FAA8 FF15DC624800            call dword ptr [004862DC]
:0046FAAE 50                      push eax
:0046FAAF FF1560634800            call dword ptr [00486360]
:0046FAB5 8B9530FFFFFF            mov edx, dword ptr [ebp+FFFFFF30]
:0046FABB 33C0                    xor eax, eax
:0046FABD 8A8224200000            mov al, byte ptr [edx+00002024]
:0046FAC3 8BC8                    mov ecx, eax
:0046FAC5 6BC946                  imul ecx, 00000046
:0046FAC8 81C1C0F44A00            add ecx, 004AF4C0
:0046FACE E83DFCFEFF              call 0045F710
:0046FAD3 50                      push eax
:0046FAD4 6822050000              push 00000522
:0046FAD9 8B8D30FFFFFF            mov ecx, dword ptr [ebp+FFFFFF30]
:0046FADF 8B5104                  mov edx, dword ptr [ecx+04]
:0046FAE2 52                      push edx
:0046FAE3 FF15DC624800            call dword ptr [004862DC]
:0046FAE9 50                      push eax
:0046FAEA FF1560634800            call dword ptr [00486360]
:0046FAF0 6826050000              push 00000526
:0046FAF5 8B8530FFFFFF            mov eax, dword ptr [ebp+FFFFFF30]
:0046FAFB 8B4804                  mov ecx, dword ptr [eax+04]
:0046FAFE 51                      push ecx
:0046FAFF FF15DC624800            call dword ptr [004862DC]
:0046FB05 50                      push eax
:0046FB06 8B8D30FFFFFF            mov ecx, dword ptr [ebp+FFFFFF30]
:0046FB0C 81C128200000            add ecx, 00002028
:0046FB12 E8F32CFFFF              call 0046280A
:0046FB17 8B9530FFFFFF            mov edx, dword ptr [ebp+FFFFFF30]
:0046FB1D 33C0                    xor eax, eax
:0046FB1F 8A8224200000            mov al, byte ptr [edx+00002024]
:0046FB25 8BC8                    mov ecx, eax
:0046FB27 6BC946                  imul ecx, 00000046
:0046FB2A 81C1C0F44A00            add ecx, 004AF4C0
:0046FB30 E8FBC7FAFF              call 0041C330
:0046FB35 25FF000000              and eax, 000000FF
:0046FB3A 50                      push eax
:0046FB3B B9102E4900              mov ecx, 00492E10
:0046FB40 E82BFBFEFF              call 0045F670
:0046FB45 50                      push eax
:0046FB46 8B8D30FFFFFF            mov ecx, dword ptr [ebp+FFFFFF30]
:0046FB4C 81C128200000            add ecx, 00002028
:0046FB52 E8C638FFFF              call 0046341D
:0046FB57 8B8D30FFFFFF            mov ecx, dword ptr [ebp+FFFFFF30]
:0046FB5D 33D2                    xor edx, edx
:0046FB5F 8A9124200000            mov dl, byte ptr [ecx+00002024]
:0046FB65 8BCA                    mov ecx, edx
:0046FB67 6BC946                  imul ecx, 00000046
:0046FB6A 81C1C0F44A00            add ecx, 004AF4C0
:0046FB70 E8ABE7FCFF              call 0043E320
:0046FB75 25FF000000              and eax, 000000FF
:0046FB7A 8B048540BD4800          mov eax, dword ptr [4*eax+0048BD40]
:0046FB81 50                      push eax
:0046FB82 68FF030000              push 000003FF
:0046FB87 8B8D30FFFFFF            mov ecx, dword ptr [ebp+FFFFFF30]
:0046FB8D 8B5104                  mov edx, dword ptr [ecx+04]
:0046FB90 52                      push edx
:0046FB91 FF15D8624800            call dword ptr [004862D8]
:0046FB97 6A00                    push 00000000
:0046FB99 8B8530FFFFFF            mov eax, dword ptr [ebp+FFFFFF30]
:0046FB9F 33C9                    xor ecx, ecx
:0046FBA1 8A8824200000            mov cl, byte ptr [eax+00002024]
:0046FBA7 6BC946                  imul ecx, 00000046
:0046FBAA 81C1C0F44A00            add ecx, 004AF4C0
:0046FBB0 E81B5FFBFF              call 00425AD0
:0046FBB5 25FF000000              and eax, 000000FF
:0046FBBA 50                      push eax
:0046FBBB 68F2030000              push 000003F2
:0046FBC0 8B9530FFFFFF            mov edx, dword ptr [ebp+FFFFFF30]
:0046FBC6 8B4204                  mov eax, dword ptr [edx+04]
:0046FBC9 50                      push eax
:0046FBCA FF15E4624800            call dword ptr [004862E4]
:0046FBD0 8B8D30FFFFFF            mov ecx, dword ptr [ebp+FFFFFF30]
:0046FBD6 33D2                    xor edx, edx
:0046FBD8 8A9124200000            mov dl, byte ptr [ecx+00002024]
:0046FBDE 52                      push edx
:0046FBDF 8D8534FFFFFF            lea eax, dword ptr [ebp+FFFFFF34]
:0046FBE5 50                      push eax
:0046FBE6 E897C3F9FF              call 0040BF82
:0046FBEB 83C408                  add esp, 00000008
:0046FBEE 8D8D34FFFFFF            lea ecx, dword ptr [ebp+FFFFFF34]
:0046FBF4 51                      push ecx
:0046FBF5 6825050000              push 00000525
:0046FBFA 8B9530FFFFFF            mov edx, dword ptr [ebp+FFFFFF30]
:0046FC00 8B4204                  mov eax, dword ptr [edx+04]
:0046FC03 50                      push eax
:0046FC04 FF15DC624800            call dword ptr [004862DC]
:0046FC0A 50                      push eax
:0046FC0B FF1560634800            call dword ptr [00486360]
:0046FC11 8B8D30FFFFFF            mov ecx, dword ptr [ebp+FFFFFF30]
:0046FC17 E824000000              call 0046FC40
:0046FC1C 8B8D30FFFFFF            mov ecx, dword ptr [ebp+FFFFFF30]
:0046FC22 E848010000              call 0046FD6F
:0046FC27 8B8D30FFFFFF            mov ecx, dword ptr [ebp+FFFFFF30]
:0046FC2D E864020000              call 0046FE96
:0046FC32 6A00                    push 00000000
:0046FC34 E8AACE0000              call 0047CAE3
:0046FC39 83C404                  add esp, 00000004
:0046FC3C 8BE5                    mov esp, ebp
:0046FC3E 5D                      pop ebp
:0046FC3F C3                      ret



* Referenced by a CALL at Address:
|:0046FC17   
|
:0046FC40 55                      push ebp
:0046FC41 8BEC                    mov ebp, esp
:0046FC43 6AFF                    push FFFFFFFF
:0046FC45 6890594800              push 00485990
:0046FC4A 64A100000000            mov eax, dword ptr fs:[00000000]
:0046FC50 50                      push eax
:0046FC51 64892500000000          mov dword ptr fs:[00000000], esp
:0046FC58 81EC0C010000            sub esp, 0000010C
:0046FC5E 898DE8FEFFFF            mov dword ptr [ebp+FFFFFEE8], ecx
:0046FC64 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0046FC6A E84136F9FF              call 004032B0
:0046FC6F C745FC00000000          mov [ebp-04], 00000000
:0046FC76 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:0046FC7C 33C9                    xor ecx, ecx
:0046FC7E 8A8824200000            mov cl, byte ptr [eax+00002024]
:0046FC84 6BC946                  imul ecx, 00000046
:0046FC87 81C1C0F44A00            add ecx, 004AF4C0
:0046FC8D E8FE8FFAFF              call 00418C90
:0046FC92 8885ECFEFFFF            mov byte ptr [ebp+FFFFFEEC], al
:0046FC98 8B95ECFEFFFF            mov edx, dword ptr [ebp+FFFFFEEC]
:0046FC9E 81E2FF000000            and edx, 000000FF
:0046FCA4 81FAFF000000            cmp edx, 000000FF
:0046FCAA 7507                    jne 0046FCB3
:0046FCAC C685ECFEFFFF10          mov byte ptr [ebp+FFFFFEEC], 10

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046FCAA(C)
|

* Possible StringData Ref from Data Obj ->"HITAREA.E5"
                                  |
:0046FCB3 6840BB4800              push 0048BB40
:0046FCB8 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0046FCBE E872FEFAFF              call 0041FB35
:0046FCC3 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:0046FCC9 83C024                  add eax, 00000024
:0046FCCC 50                      push eax
:0046FCCD 8B8DECFEFFFF            mov ecx, dword ptr [ebp+FFFFFEEC]
:0046FCD3 81E1FF000000            and ecx, 000000FF
:0046FCD9 51                      push ecx
:0046FCDA 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0046FCE0 E8A4FFFAFF              call 0041FC89
:0046FCE5 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0046FCEB E8D595FAFF              call 004192C5
:0046FCF0 6A00                    push 00000000
:0046FCF2 8B15F85F4B00            mov edx, dword ptr [004B5FF8]
:0046FCF8 52                      push edx
:0046FCF9 FF15E0624800            call dword ptr [004862E0]
:0046FCFF 6A0B                    push 0000000B
:0046FD01 E8DDCD0000              call 0047CAE3
:0046FD06 83C404                  add esp, 00000004

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0046FD09 6A07                    push 00000007
:0046FD0B E8BAD40000              call 0047D1CA
:0046FD10 83C404                  add esp, 00000004
:0046FD13 6A00                    push 00000000
:0046FD15 6A00                    push 00000000
:0046FD17 6A00                    push 00000000
:0046FD19 E8D3D40000              call 0047D1F1
:0046FD1E 83C40C                  add esp, 0000000C
:0046FD21 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:0046FD27 83C024                  add eax, 00000024
:0046FD2A 50                      push eax
:0046FD2B 8B0D9C684800            mov ecx, dword ptr [0048689C]
:0046FD31 51                      push ecx
:0046FD32 8B1598684800            mov edx, dword ptr [00486898]
:0046FD38 52                      push edx
:0046FD39 6A00                    push 00000000
:0046FD3B 6A00                    push 00000000
:0046FD3D E859E30000              call 0047E09B
:0046FD42 83C414                  add esp, 00000014
:0046FD45 6A00                    push 00000000
:0046FD47 E897CD0000              call 0047CAE3
:0046FD4C 83C404                  add esp, 00000004
:0046FD4F C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0046FD56 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0046FD5C E86F35F9FF              call 004032D0
:0046FD61 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046FD64 64890D00000000          mov dword ptr fs:[00000000], ecx
:0046FD6B 8BE5                    mov esp, ebp
:0046FD6D 5D                      pop ebp
:0046FD6E C3                      ret



* Referenced by a CALL at Address:
|:0046FC22   
|
:0046FD6F 55                      push ebp
:0046FD70 8BEC                    mov ebp, esp
:0046FD72 6AFF                    push FFFFFFFF
:0046FD74 68A6594800              push 004859A6
:0046FD79 64A100000000            mov eax, dword ptr fs:[00000000]
:0046FD7F 50                      push eax
:0046FD80 64892500000000          mov dword ptr fs:[00000000], esp
:0046FD87 81EC0C010000            sub esp, 0000010C
:0046FD8D 898DE8FEFFFF            mov dword ptr [ebp+FFFFFEE8], ecx
:0046FD93 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0046FD99 E81235F9FF              call 004032B0
:0046FD9E C745FC00000000          mov [ebp-04], 00000000
:0046FDA5 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:0046FDAB 33C9                    xor ecx, ecx
:0046FDAD 8A8824200000            mov cl, byte ptr [eax+00002024]
:0046FDB3 6BC946                  imul ecx, 00000046
:0046FDB6 81C1C0F44A00            add ecx, 004AF4C0
:0046FDBC E88F5DFBFF              call 00425B50
:0046FDC1 8845F0                  mov byte ptr [ebp-10], al
:0046FDC4 8B55F0                  mov edx, dword ptr [ebp-10]
:0046FDC7 81E2FF000000            and edx, 000000FF
:0046FDCD 81FAFF000000            cmp edx, 000000FF
:0046FDD3 7504                    jne 0046FDD9
:0046FDD5 C645F001                mov [ebp-10], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046FDD3(C)
|

* Possible StringData Ref from Data Obj ->"EFFAREA.E5"
                                  |
:0046FDD9 6850BB4800              push 0048BB50
:0046FDDE 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0046FDE4 E84CFDFAFF              call 0041FB35
:0046FDE9 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:0046FDEF 0524100000              add eax, 00001024
:0046FDF4 50                      push eax
:0046FDF5 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046FDF8 81E1FF000000            and ecx, 000000FF
:0046FDFE 51                      push ecx
:0046FDFF 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0046FE05 E87FFEFAFF              call 0041FC89
:0046FE0A 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0046FE10 E8B094FAFF              call 004192C5
:0046FE15 6A00                    push 00000000
:0046FE17 8B15FC5F4B00            mov edx, dword ptr [004B5FFC]
:0046FE1D 52                      push edx
:0046FE1E FF15E0624800            call dword ptr [004862E0]
:0046FE24 6A0C                    push 0000000C
:0046FE26 E8B8CC0000              call 0047CAE3
:0046FE2B 83C404                  add esp, 00000004

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0046FE2E 6A07                    push 00000007
:0046FE30 E895D30000              call 0047D1CA
:0046FE35 83C404                  add esp, 00000004
:0046FE38 6A00                    push 00000000
:0046FE3A 6A00                    push 00000000
:0046FE3C 6A00                    push 00000000
:0046FE3E E8AED30000              call 0047D1F1
:0046FE43 83C40C                  add esp, 0000000C
:0046FE46 8B85E8FEFFFF            mov eax, dword ptr [ebp+FFFFFEE8]
:0046FE4C 0524100000              add eax, 00001024
:0046FE51 50                      push eax
:0046FE52 8B0DAC684800            mov ecx, dword ptr [004868AC]
:0046FE58 51                      push ecx
:0046FE59 8B15A8684800            mov edx, dword ptr [004868A8]
:0046FE5F 52                      push edx
:0046FE60 6A00                    push 00000000
:0046FE62 6A00                    push 00000000
:0046FE64 E832E20000              call 0047E09B
:0046FE69 83C414                  add esp, 00000014
:0046FE6C 6A00                    push 00000000
:0046FE6E E870CC0000              call 0047CAE3
:0046FE73 83C404                  add esp, 00000004
:0046FE76 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0046FE7D 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0046FE83 E84834F9FF              call 004032D0
:0046FE88 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0046FE8B 64890D00000000          mov dword ptr fs:[00000000], ecx
:0046FE92 8BE5                    mov esp, ebp
:0046FE94 5D                      pop ebp
:0046FE95 C3                      ret



* Referenced by a CALL at Address:
|:0046FC2D   
|
:0046FE96 55                      push ebp
:0046FE97 8BEC                    mov ebp, esp
:0046FE99 83EC14                  sub esp, 00000014
:0046FE9C 894DEC                  mov dword ptr [ebp-14], ecx
:0046FE9F 8D45F0                  lea eax, dword ptr [ebp-10]
:0046FEA2 50                      push eax
:0046FEA3 6827050000              push 00000527
:0046FEA8 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0046FEAB 8B5104                  mov edx, dword ptr [ecx+04]
:0046FEAE 52                      push edx
:0046FEAF FF15DC624800            call dword ptr [004862DC]
:0046FEB5 50                      push eax
:0046FEB6 E8AF1CFFFF              call 00461B6A
:0046FEBB 83C408                  add esp, 00000008
:0046FEBE 6A0C                    push 0000000C
:0046FEC0 A19C684800              mov eax, dword ptr [0048689C]
:0046FEC5 83C002                  add eax, 00000002
:0046FEC8 50                      push eax
:0046FEC9 8B0D98684800            mov ecx, dword ptr [00486898]
:0046FECF 83C102                  add ecx, 00000002
:0046FED2 51                      push ecx
:0046FED3 8B55FC                  mov edx, dword ptr [ebp-04]
:0046FED6 8B45F4                  mov eax, dword ptr [ebp-0C]
:0046FED9 8D4410FE                lea eax, dword ptr [eax+edx-02]
:0046FEDD 2B059C684800            sub eax, dword ptr [0048689C]
:0046FEE3 99                      cdq
:0046FEE4 2BC2                    sub eax, edx
:0046FEE6 D1F8                    sar eax, 1
:0046FEE8 50                      push eax
:0046FEE9 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0046FEEC 8B55F0                  mov edx, dword ptr [ebp-10]
:0046FEEF 8D440AFE                lea eax, dword ptr [edx+ecx-02]
:0046FEF3 2B0598684800            sub eax, dword ptr [00486898]
:0046FEF9 99                      cdq
:0046FEFA 2BC2                    sub eax, edx
:0046FEFC D1F8                    sar eax, 1
:0046FEFE 50                      push eax
:0046FEFF 6A00                    push 00000000
:0046FF01 6827050000              push 00000527
:0046FF06 8B45EC                  mov eax, dword ptr [ebp-14]
:0046FF09 8B4804                  mov ecx, dword ptr [eax+04]
:0046FF0C 51                      push ecx
:0046FF0D FF15DC624800            call dword ptr [004862DC]
:0046FF13 50                      push eax
:0046FF14 FF1580624800            call dword ptr [00486280]
:0046FF1A 6827050000              push 00000527
:0046FF1F 8B55EC                  mov edx, dword ptr [ebp-14]
:0046FF22 8B4204                  mov eax, dword ptr [edx+04]
:0046FF25 50                      push eax
:0046FF26 FF15DC624800            call dword ptr [004862DC]
:0046FF2C 50                      push eax
:0046FF2D 8B0DF85F4B00            mov ecx, dword ptr [004B5FF8]
:0046FF33 51                      push ecx
:0046FF34 FF157C634800            call dword ptr [0048637C]
:0046FF3A 6A00                    push 00000000
:0046FF3C 8B159C684800            mov edx, dword ptr [0048689C]
:0046FF42 52                      push edx
:0046FF43 A198684800              mov eax, dword ptr [00486898]
:0046FF48 50                      push eax
:0046FF49 6A00                    push 00000000
:0046FF4B 6A00                    push 00000000
:0046FF4D 8B0DF85F4B00            mov ecx, dword ptr [004B5FF8]
:0046FF53 51                      push ecx
:0046FF54 FF15BC624800            call dword ptr [004862BC]
:0046FF5A 8D55F0                  lea edx, dword ptr [ebp-10]
:0046FF5D 52                      push edx
:0046FF5E 6828050000              push 00000528
:0046FF63 8B45EC                  mov eax, dword ptr [ebp-14]
:0046FF66 8B4804                  mov ecx, dword ptr [eax+04]
:0046FF69 51                      push ecx
:0046FF6A FF15DC624800            call dword ptr [004862DC]
:0046FF70 50                      push eax
:0046FF71 E8F41BFFFF              call 00461B6A
:0046FF76 83C408                  add esp, 00000008
:0046FF79 6A0C                    push 0000000C
:0046FF7B 8B15AC684800            mov edx, dword ptr [004868AC]
:0046FF81 83C202                  add edx, 00000002
:0046FF84 52                      push edx
:0046FF85 A1A8684800              mov eax, dword ptr [004868A8]
:0046FF8A 83C002                  add eax, 00000002
:0046FF8D 50                      push eax
:0046FF8E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0046FF91 8B55F4                  mov edx, dword ptr [ebp-0C]
:0046FF94 8D440AFE                lea eax, dword ptr [edx+ecx-02]
:0046FF98 2B05AC684800            sub eax, dword ptr [004868AC]
:0046FF9E 99                      cdq
:0046FF9F 2BC2                    sub eax, edx
:0046FFA1 D1F8                    sar eax, 1
:0046FFA3 50                      push eax
:0046FFA4 8B45F8                  mov eax, dword ptr [ebp-08]
:0046FFA7 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0046FFAA 8D4401FE                lea eax, dword ptr [ecx+eax-02]
:0046FFAE 2B05A8684800            sub eax, dword ptr [004868A8]
:0046FFB4 99                      cdq
:0046FFB5 2BC2                    sub eax, edx
:0046FFB7 D1F8                    sar eax, 1
:0046FFB9 50                      push eax
:0046FFBA 6A00                    push 00000000
:0046FFBC 6828050000              push 00000528
:0046FFC1 8B55EC                  mov edx, dword ptr [ebp-14]
:0046FFC4 8B4204                  mov eax, dword ptr [edx+04]
:0046FFC7 50                      push eax
:0046FFC8 FF15DC624800            call dword ptr [004862DC]
:0046FFCE 50                      push eax
:0046FFCF FF1580624800            call dword ptr [00486280]
:0046FFD5 6828050000              push 00000528
:0046FFDA 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0046FFDD 8B5104                  mov edx, dword ptr [ecx+04]
:0046FFE0 52                      push edx
:0046FFE1 FF15DC624800            call dword ptr [004862DC]
:0046FFE7 50                      push eax
:0046FFE8 A1FC5F4B00              mov eax, dword ptr [004B5FFC]
:0046FFED 50                      push eax
:0046FFEE FF157C634800            call dword ptr [0048637C]
:0046FFF4 6A00                    push 00000000
:0046FFF6 8B0DAC684800            mov ecx, dword ptr [004868AC]
:0046FFFC 51                      push ecx
:0046FFFD 8B15A8684800            mov edx, dword ptr [004868A8]
:00470003 52                      push edx
:00470004 6A00                    push 00000000
:00470006 6A00                    push 00000000
:00470008 A1FC5F4B00              mov eax, dword ptr [004B5FFC]
:0047000D 50                      push eax
:0047000E FF15BC624800            call dword ptr [004862BC]
:00470014 6A05                    push 00000005
:00470016 8B0DF85F4B00            mov ecx, dword ptr [004B5FF8]
:0047001C 51                      push ecx
:0047001D FF15E0624800            call dword ptr [004862E0]
:00470023 6A05                    push 00000005
:00470025 8B15FC5F4B00            mov edx, dword ptr [004B5FFC]
:0047002B 52                      push edx
:0047002C FF15E0624800            call dword ptr [004862E0]
:00470032 8BE5                    mov esp, ebp
:00470034 5D                      pop ebp
:00470035 C3                      ret


:00470036 55                      push ebp
:00470037 8BEC                    mov ebp, esp
:00470039 51                      push ecx
:0047003A 894DFC                  mov dword ptr [ebp-04], ecx
:0047003D 6A00                    push 00000000
:0047003F A1F85F4B00              mov eax, dword ptr [004B5FF8]
:00470044 50                      push eax
:00470045 FF15E0624800            call dword ptr [004862E0]
:0047004B 6A00                    push 00000000
:0047004D 8B0DFC5F4B00            mov ecx, dword ptr [004B5FFC]
:00470053 51                      push ecx
:00470054 FF15E0624800            call dword ptr [004862E0]
:0047005A 8B15686A4B00            mov edx, dword ptr [004B6A68]
:00470060 52                      push edx
:00470061 A1F85F4B00              mov eax, dword ptr [004B5FF8]
:00470066 50                      push eax
:00470067 FF157C634800            call dword ptr [0048637C]
:0047006D 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:00470073 51                      push ecx
:00470074 8B15FC5F4B00            mov edx, dword ptr [004B5FFC]
:0047007A 52                      push edx
:0047007B FF157C634800            call dword ptr [0048637C]
:00470081 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00470084 E852E9FFFF              call 0046E9DB
:00470089 8BE5                    mov esp, ebp
:0047008B 5D                      pop ebp
:0047008C C3                      ret



* Referenced by a CALL at Address:
|:00465899   
|
:0047008D 55                      push ebp
:0047008E 8BEC                    mov ebp, esp
:00470090 51                      push ecx
:00470091 894DFC                  mov dword ptr [ebp-04], ecx
:00470094 8B450C                  mov eax, dword ptr [ebp+0C]
:00470097 25FF000000              and eax, 000000FF
:0047009C 83F844                  cmp eax, 00000044
:0047009F 7D1D                    jge 004700BE
:004700A1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004700A4 8A550C                  mov dl, byte ptr [ebp+0C]
:004700A7 889124200000            mov byte ptr [ecx+00002024], dl
:004700AD 8B4508                  mov eax, dword ptr [ebp+08]
:004700B0 50                      push eax

* Possible Reference to Dialog: DialogID_011D 
                                  |
:004700B1 681D010000              push 0000011D
:004700B6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004700B9 E8DACFFFFF              call 0046D098

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047009F(C)
|
:004700BE 8BE5                    mov esp, ebp
:004700C0 5D                      pop ebp
:004700C1 C20800                  ret 0008



* Referenced by a CALL at Address:
|:0040BF34   
|
:004700C4 55                      push ebp
:004700C5 8BEC                    mov ebp, esp
:004700C7 51                      push ecx
:004700C8 894DFC                  mov dword ptr [ebp-04], ecx
:004700CB 837D0C68                cmp dword ptr [ebp+0C], 00000068
:004700CF 732C                    jnb 004700FD
:004700D1 8B45FC                  mov eax, dword ptr [ebp-04]
:004700D4 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004700D7 894824                  mov dword ptr [eax+24], ecx
:004700DA 8B55FC                  mov edx, dword ptr [ebp-04]
:004700DD 8A4510                  mov al, byte ptr [ebp+10]
:004700E0 884228                  mov byte ptr [edx+28], al
:004700E3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004700E6 8A5514                  mov dl, byte ptr [ebp+14]
:004700E9 885129                  mov byte ptr [ecx+29], dl
:004700EC 8B4508                  mov eax, dword ptr [ebp+08]
:004700EF 50                      push eax

* Possible Reference to Dialog: DialogID_00A7 
                                  |
:004700F0 68A7000000              push 000000A7
:004700F5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004700F8 E89BCFFFFF              call 0046D098

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004700CF(C)
|
:004700FD 8BE5                    mov esp, ebp
:004700FF 5D                      pop ebp
:00470100 C21000                  ret 0010


:00470103 55                      push ebp
:00470104 8BEC                    mov ebp, esp
:00470106 51                      push ecx
:00470107 894DFC                  mov dword ptr [ebp-04], ecx

* Possible Reference to Dialog: DialogID_014E, CONTROL_ID:0415, ""
                                  |
:0047010A 6815040000              push 00000415
:0047010F 8B45FC                  mov eax, dword ptr [ebp-04]
:00470112 8B4804                  mov ecx, dword ptr [eax+04]
:00470115 51                      push ecx
:00470116 FF15DC624800            call dword ptr [004862DC]
:0047011C 50                      push eax
:0047011D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00470120 83C12C                  add ecx, 0000002C
:00470123 E8E226FFFF              call 0046280A
:00470128 8B55FC                  mov edx, dword ptr [ebp-04]
:0047012B 8B4A24                  mov ecx, dword ptr [edx+24]
:0047012E 6BC919                  imul ecx, 00000019
:00470131 81C140114A00            add ecx, 004A1140
:00470137 E8342B0000              call 00472C70
:0047013C 25FF000000              and eax, 000000FF
:00470141 50                      push eax
:00470142 B9142E4900              mov ecx, 00492E14
:00470147 E824F5FEFF              call 0045F670
:0047014C 50                      push eax
:0047014D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00470150 83C12C                  add ecx, 0000002C
:00470153 E8C532FFFF              call 0046341D
:00470158 8B45FC                  mov eax, dword ptr [ebp-04]
:0047015B 8A4829                  mov cl, byte ptr [eax+29]
:0047015E 51                      push ecx
:0047015F 8B55FC                  mov edx, dword ptr [ebp-04]
:00470162 8A4228                  mov al, byte ptr [edx+28]
:00470165 50                      push eax
:00470166 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00470169 8B5124                  mov edx, dword ptr [ecx+24]
:0047016C 52                      push edx
:0047016D 8B45FC                  mov eax, dword ptr [ebp-04]
:00470170 8B4804                  mov ecx, dword ptr [eax+04]
:00470173 51                      push ecx
:00470174 8B55FC                  mov edx, dword ptr [ebp-04]
:00470177 8B4A24                  mov ecx, dword ptr [edx+24]
:0047017A 6BC919                  imul ecx, 00000019
:0047017D 81C140114A00            add ecx, 004A1140
:00470183 E8BBC6F9FF              call 0040C843
:00470188 8BE5                    mov esp, ebp
:0047018A 5D                      pop ebp
:0047018B C3                      ret


:0047018C 55                      push ebp
:0047018D 8BEC                    mov ebp, esp
:0047018F 83EC34                  sub esp, 00000034
:00470192 894DCC                  mov dword ptr [ebp-34], ecx
:00470195 8B450C                  mov eax, dword ptr [ebp+0C]
:00470198 50                      push eax
:00470199 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047019C 51                      push ecx
:0047019D 8B4DCC                  mov ecx, dword ptr [ebp-34]
:004701A0 E89BE1F9FF              call 0040E340
:004701A5 6865050000              push 00000565
:004701AA 8B55CC                  mov edx, dword ptr [ebp-34]
:004701AD 8B4204                  mov eax, dword ptr [edx+04]
:004701B0 50                      push eax
:004701B1 FF15DC624800            call dword ptr [004862DC]
:004701B7 39450C                  cmp dword ptr [ebp+0C], eax
:004701BA 7539                    jne 004701F5
:004701BC 6A26                    push 00000026
:004701BE 6A64                    push 00000064
:004701C0 6A64                    push 00000064
:004701C2 8B4DCC                  mov ecx, dword ptr [ebp-34]
:004701C5 33D2                    xor edx, edx
:004701C7 8A5129                  mov dl, byte ptr [ecx+29]
:004701CA 52                      push edx
:004701CB 8D4DD0                  lea ecx, dword ptr [ebp-30]
:004701CE E82012FFFF              call 004613F3
:004701D3 8D45F0                  lea eax, dword ptr [ebp-10]
:004701D6 50                      push eax
:004701D7 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004701DA 51                      push ecx
:004701DB FF15EC624800            call dword ptr [004862EC]
:004701E1 6A05                    push 00000005
:004701E3 6A00                    push 00000000
:004701E5 8D55F0                  lea edx, dword ptr [ebp-10]
:004701E8 52                      push edx
:004701E9 8B4508                  mov eax, dword ptr [ebp+08]
:004701EC 50                      push eax
:004701ED 8D4DD0                  lea ecx, dword ptr [ebp-30]
:004701F0 E87A12FFFF              call 0046146F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004701BA(C)
|
:004701F5 8BE5                    mov esp, ebp
:004701F7 5D                      pop ebp
:004701F8 C20800                  ret 0008



* Referenced by a CALL at Address:
|:004707B0   
|
:004701FB 55                      push ebp
:004701FC 8BEC                    mov ebp, esp
:004701FE 51                      push ecx
:004701FF 894DFC                  mov dword ptr [ebp-04], ecx
:00470202 8B45FC                  mov eax, dword ptr [ebp-04]
:00470205 8B4D08                  mov ecx, dword ptr [ebp+08]
:00470208 89480C                  mov dword ptr [eax+0C], ecx
:0047020B 8B55FC                  mov edx, dword ptr [ebp-04]
:0047020E 8B450C                  mov eax, dword ptr [ebp+0C]
:00470211 894210                  mov dword ptr [edx+10], eax
:00470214 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00470217 C7411400000000          mov [ecx+14], 00000000
:0047021E 6A00                    push 00000000
:00470220 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00470223 E8C82E0000              call 004730F0
:00470228 8B5510                  mov edx, dword ptr [ebp+10]
:0047022B 52                      push edx

* Possible Reference to Dialog: DialogID_014E 
                                  |
:0047022C 684E010000              push 0000014E
:00470231 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00470234 E88FCEFFFF              call 0046D0C8
:00470239 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047023C 894104                  mov dword ptr [ecx+04], eax
:0047023F 8B55FC                  mov edx, dword ptr [ebp-04]
:00470242 8B4204                  mov eax, dword ptr [edx+04]
:00470245 8BE5                    mov esp, ebp
:00470247 5D                      pop ebp
:00470248 C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:004702C4   , :00470338   , :00470344   , :0047036A   , :004703A1   
|
:0047024B 55                      push ebp
:0047024C 8BEC                    mov ebp, esp
:0047024E 51                      push ecx
:0047024F 894DFC                  mov dword ptr [ebp-04], ecx
:00470252 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00470255 E80A040000              call 00470664
:0047025A 85C0                    test eax, eax
:0047025C 7409                    je 00470267
:0047025E 8B45FC                  mov eax, dword ptr [ebp-04]
:00470261 8B4D08                  mov ecx, dword ptr [ebp+08]
:00470264 894814                  mov dword ptr [eax+14], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047025C(C)
|
:00470267 8BE5                    mov esp, ebp
:00470269 5D                      pop ebp
:0047026A C20400                  ret 0004


:0047026D 55                      push ebp
:0047026E 8BEC                    mov ebp, esp
:00470270 83EC20                  sub esp, 00000020
:00470273 894DE4                  mov dword ptr [ebp-1C], ecx
:00470276 8B4508                  mov eax, dword ptr [ebp+08]
:00470279 8945E0                  mov dword ptr [ebp-20], eax
:0047027C 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0047027F 81E900020000            sub ecx, 00000200
:00470285 894DE0                  mov dword ptr [ebp-20], ecx
:00470288 837DE015                cmp dword ptr [ebp-20], 00000015
:0047028C 0F8714010000            ja 004703A6
:00470292 8B45E0                  mov eax, dword ptr [ebp-20]
:00470295 33D2                    xor edx, edx
:00470297 8A90DF034700            mov dl, byte ptr [eax+004703DF]
:0047029D FF2495C3034700          jmp dword ptr [4*edx+004703C3]
:004702A4 FF1584634800            call dword ptr [00486384]
:004702AA 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004702AD 3B4104                  cmp eax, dword ptr [ecx+04]
:004702B0 7417                    je 004702C9
:004702B2 8B55E4                  mov edx, dword ptr [ebp-1C]
:004702B5 8B4204                  mov eax, dword ptr [edx+04]
:004702B8 50                      push eax
:004702B9 FF1588634800            call dword ptr [00486388]
:004702BF 6A01                    push 00000001
:004702C1 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004702C4 E882FFFFFF              call 0047024B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004702B0(C)
|
:004702C9 E9D8000000              jmp 004703A6
:004702CE FF1584634800            call dword ptr [00486384]
:004702D4 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004702D7 3B4104                  cmp eax, dword ptr [ecx+04]
:004702DA 756D                    jne 00470349
:004702DC 8B5510                  mov edx, dword ptr [ebp+10]
:004702DF 81E2FFFF0000            and edx, 0000FFFF
:004702E5 8955E8                  mov dword ptr [ebp-18], edx
:004702E8 8B4510                  mov eax, dword ptr [ebp+10]
:004702EB C1E810                  shr eax, 10
:004702EE 25FFFF0000              and eax, 0000FFFF
:004702F3 25FFFF0000              and eax, 0000FFFF
:004702F8 8945EC                  mov dword ptr [ebp-14], eax
:004702FB 8D4DE8                  lea ecx, dword ptr [ebp-18]
:004702FE 51                      push ecx
:004702FF 8B55E4                  mov edx, dword ptr [ebp-1C]
:00470302 8B4204                  mov eax, dword ptr [edx+04]
:00470305 50                      push eax
:00470306 FF1520634800            call dword ptr [00486320]
:0047030C 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0047030F 51                      push ecx
:00470310 8B55E4                  mov edx, dword ptr [ebp-1C]
:00470313 8B4204                  mov eax, dword ptr [edx+04]
:00470316 50                      push eax
:00470317 FF1598634800            call dword ptr [00486398]
:0047031D 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00470320 51                      push ecx
:00470321 8B55E8                  mov edx, dword ptr [ebp-18]
:00470324 52                      push edx
:00470325 8D45F0                  lea eax, dword ptr [ebp-10]
:00470328 50                      push eax
:00470329 FF158C634800            call dword ptr [0048638C]
:0047032F 85C0                    test eax, eax
:00470331 740C                    je 0047033F
:00470333 6A01                    push 00000001
:00470335 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00470338 E80EFFFFFF              call 0047024B
:0047033D EB0A                    jmp 00470349

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00470331(C)
|
:0047033F 6A00                    push 00000000
:00470341 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00470344 E802FFFFFF              call 0047024B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004702DA(C), :0047033D(U)
|
:00470349 EB5B                    jmp 004703A6
:0047034B FF1584634800            call dword ptr [00486384]
:00470351 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00470354 3B4104                  cmp eax, dword ptr [ecx+04]
:00470357 7536                    jne 0047038F
:00470359 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0047035C E8DF240000              call 00472840
:00470361 85C0                    test eax, eax
:00470363 7424                    je 00470389
:00470365 6A00                    push 00000000
:00470367 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0047036A E8DCFEFFFF              call 0047024B
:0047036F 6A00                    push 00000000
:00470371 6A01                    push 00000001
:00470373 8B55E4                  mov edx, dword ptr [ebp-1C]
:00470376 8B4210                  mov eax, dword ptr [edx+10]
:00470379 50                      push eax
:0047037A 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0047037D 8B5104                  mov edx, dword ptr [ecx+04]
:00470380 52                      push edx
:00470381 E871BBF9FF              call 0040BEF7
:00470386 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00470363(C)
|
:00470389 FF1580634800            call dword ptr [00486380]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00470357(C)
|
:0047038F EB15                    jmp 004703A6
:00470391 8B45E4                  mov eax, dword ptr [ebp-1C]
:00470394 8B4804                  mov ecx, dword ptr [eax+04]
:00470397 3B4D10                  cmp ecx, dword ptr [ebp+10]
:0047039A 740A                    je 004703A6
:0047039C 6A00                    push 00000000
:0047039E 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004703A1 E8A5FEFFFF              call 0047024B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047028C(C), :004702C9(U), :00470349(U), :0047038F(U), :0047039A(C)
|
:004703A6 8B5510                  mov edx, dword ptr [ebp+10]
:004703A9 52                      push edx
:004703AA 8B450C                  mov eax, dword ptr [ebp+0C]
:004703AD 50                      push eax
:004703AE 8B4D08                  mov ecx, dword ptr [ebp+08]
:004703B1 51                      push ecx
:004703B2 8B55E4                  mov edx, dword ptr [ebp-1C]
:004703B5 8B02                    mov eax, dword ptr [edx]
:004703B7 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004703BA FF5004                  call [eax+04]
:004703BD 8BE5                    mov esp, ebp
:004703BF 5D                      pop ebp
:004703C0 C20C00                  ret 000C



:004703C3 CE024700                DWORD 004702CE
:004703C7 A4024700                DWORD 004702A4
:004703CB 4B034700                DWORD 0047034B
:004703CF A4024700                DWORD 004702A4
:004703D3 4B034700                DWORD 0047034B
:004703D7 91034700                DWORD 00470391
:004703DB A6034700                DWORD 004703A6


:004703DF 0001                    add byte ptr [ecx], al
:004703E1 0206                    add al, byte ptr [esi]
:004703E3 030406                  add eax, dword ptr [esi+eax]
:004703E6 06                      push es
:004703E7 06                      push es
:004703E8 06                      push es
:004703E9 06                      push es
:004703EA 06                      push es
:004703EB 06                      push es
:004703EC 06                      push es
:004703ED 06                      push es
:004703EE 06                      push es
:004703EF 06                      push es
:004703F0 06                      push es
:004703F1 06                      push es
:004703F2 06                      push es
:004703F3 06                      push es
:004703F4 05                      BYTE 05h


* Referenced by a CALL at Address:
|:00470C0E   
|
:004703F5 55                      push ebp
:004703F6 8BEC                    mov ebp, esp
:004703F8 51                      push ecx
:004703F9 894DFC                  mov dword ptr [ebp-04], ecx
:004703FC 8B45FC                  mov eax, dword ptr [ebp-04]
:004703FF 8B4D08                  mov ecx, dword ptr [ebp+08]
:00470402 894818                  mov dword ptr [eax+18], ecx
:00470405 8B55FC                  mov edx, dword ptr [ebp-04]
:00470408 8B450C                  mov eax, dword ptr [ebp+0C]
:0047040B 89421C                  mov dword ptr [edx+1C], eax
:0047040E 6A05                    push 00000005
:00470410 6A00                    push 00000000
:00470412 6A00                    push 00000000
:00470414 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00470417 51                      push ecx
:00470418 8B5508                  mov edx, dword ptr [ebp+08]
:0047041B 52                      push edx
:0047041C 6A00                    push 00000000
:0047041E 8B45FC                  mov eax, dword ptr [ebp-04]
:00470421 8B4804                  mov ecx, dword ptr [eax+04]
:00470424 51                      push ecx
:00470425 FF1580624800            call dword ptr [00486280]
:0047042B 8BE5                    mov esp, ebp
:0047042D 5D                      pop ebp
:0047042E C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:00470860   , :00470954   , :00470B13   , :00470CBC   
|
:00470431 55                      push ebp
:00470432 8BEC                    mov ebp, esp
:00470434 83EC1C                  sub esp, 0000001C
:00470437 894DE4                  mov dword ptr [ebp-1C], ecx
:0047043A C745F800000000          mov [ebp-08], 00000000
:00470441 C745FC00000000          mov [ebp-04], 00000000
:00470448 8B45E4                  mov eax, dword ptr [ebp-1C]
:0047044B 8B4804                  mov ecx, dword ptr [eax+04]
:0047044E 51                      push ecx
:0047044F FF1548634800            call dword ptr [00486348]
:00470455 85C0                    test eax, eax
:00470457 7423                    je 0047047C
:00470459 8D55E8                  lea edx, dword ptr [ebp-18]
:0047045C 52                      push edx
:0047045D 8B45E4                  mov eax, dword ptr [ebp-1C]
:00470460 8B4804                  mov ecx, dword ptr [eax+04]
:00470463 51                      push ecx
:00470464 FF1598634800            call dword ptr [00486398]
:0047046A 8B55F0                  mov edx, dword ptr [ebp-10]
:0047046D 2B55E8                  sub edx, dword ptr [ebp-18]
:00470470 8955F8                  mov dword ptr [ebp-08], edx
:00470473 8B45F4                  mov eax, dword ptr [ebp-0C]
:00470476 2B45EC                  sub eax, dword ptr [ebp-14]
:00470479 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00470457(C)
|
:0047047C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047047F 8B55F8                  mov edx, dword ptr [ebp-08]
:00470482 8911                    mov dword ptr [ecx], edx
:00470484 8B45FC                  mov eax, dword ptr [ebp-04]
:00470487 894104                  mov dword ptr [ecx+04], eax
:0047048A 8B4508                  mov eax, dword ptr [ebp+08]
:0047048D 8BE5                    mov esp, ebp
:0047048F 5D                      pop ebp
:00470490 C20400                  ret 0004


:00470493 55                      push ebp
:00470494 8BEC                    mov ebp, esp
:00470496 83EC24                  sub esp, 00000024
:00470499 894DDC                  mov dword ptr [ebp-24], ecx

* Possible Reference to Dialog: DialogID_014E, CONTROL_ID:0415, ""
                                  |
:0047049C 6815040000              push 00000415
:004704A1 8B45DC                  mov eax, dword ptr [ebp-24]
:004704A4 8B4804                  mov ecx, dword ptr [eax+04]
:004704A7 51                      push ecx
:004704A8 FF15DC624800            call dword ptr [004862DC]
:004704AE 50                      push eax
:004704AF 8B4DDC                  mov ecx, dword ptr [ebp-24]
:004704B2 83C120                  add ecx, 00000020
:004704B5 E85023FFFF              call 0046280A
:004704BA 8B4DDC                  mov ecx, dword ptr [ebp-24]
:004704BD E8A2010000              call 00470664
:004704C2 85C0                    test eax, eax
:004704C4 0F849F000000            je 00470569
:004704CA 8B55DC                  mov edx, dword ptr [ebp-24]
:004704CD 8B4A10                  mov ecx, dword ptr [edx+10]
:004704D0 6BC919                  imul ecx, 00000019
:004704D3 81C140114A00            add ecx, 004A1140
:004704D9 E832F2FEFF              call 0045F710
:004704DE 50                      push eax
:004704DF 8B45DC                  mov eax, dword ptr [ebp-24]
:004704E2 8B480C                  mov ecx, dword ptr [eax+0C]
:004704E5 51                      push ecx

* Possible StringData Ref from Data Obj ->"No.%2d: %s"
                                  |
:004704E6 689CE74800              push 0048E79C
:004704EB 8D55E0                  lea edx, dword ptr [ebp-20]
:004704EE 52                      push edx
:004704EF FF15C0624800            call dword ptr [004862C0]
:004704F5 83C410                  add esp, 00000010
:004704F8 8D45E0                  lea eax, dword ptr [ebp-20]
:004704FB 50                      push eax

* Possible Reference to Dialog: DialogID_011C, CONTROL_ID:03F8, "Attribute"
                                  |
:004704FC 68F8030000              push 000003F8
:00470501 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00470504 8B5104                  mov edx, dword ptr [ecx+04]
:00470507 52                      push edx
:00470508 FF15D8624800            call dword ptr [004862D8]
:0047050E 8B45DC                  mov eax, dword ptr [ebp-24]
:00470511 8B4810                  mov ecx, dword ptr [eax+10]
:00470514 51                      push ecx
:00470515 8D55E0                  lea edx, dword ptr [ebp-20]
:00470518 52                      push edx
:00470519 E8D519FFFF              call 00461EF3
:0047051E 83C408                  add esp, 00000008
:00470521 8D45E0                  lea eax, dword ptr [ebp-20]
:00470524 50                      push eax

* Possible Reference to Dialog: DialogID_014E, CONTROL_ID:05AF, ""
                                  |
:00470525 68AF050000              push 000005AF
:0047052A 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0047052D 8B5104                  mov edx, dword ptr [ecx+04]
:00470530 52                      push edx
:00470531 FF15D8624800            call dword ptr [004862D8]
:00470537 8B45DC                  mov eax, dword ptr [ebp-24]
:0047053A 8B4810                  mov ecx, dword ptr [eax+10]
:0047053D 6BC919                  imul ecx, 00000019
:00470540 81C140114A00            add ecx, 004A1140
:00470546 E825270000              call 00472C70
:0047054B 25FF000000              and eax, 000000FF
:00470550 50                      push eax
:00470551 B9142E4900              mov ecx, 00492E14
:00470556 E815F1FEFF              call 0045F670
:0047055B 50                      push eax
:0047055C 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0047055F 83C120                  add ecx, 00000020
:00470562 E8B62EFFFF              call 0046341D
:00470567 EB67                    jmp 004705D0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004704C4(C)
|
:00470569 68E86E4800              push 00486EE8
:0047056E 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00470571 8B510C                  mov edx, dword ptr [ecx+0C]
:00470574 52                      push edx

* Possible StringData Ref from Data Obj ->"No.%2d: %s"
                                  |
:00470575 68A8E74800              push 0048E7A8
:0047057A 8D45E0                  lea eax, dword ptr [ebp-20]
:0047057D 50                      push eax
:0047057E FF15C0624800            call dword ptr [004862C0]
:00470584 83C410                  add esp, 00000010
:00470587 8D4DE0                  lea ecx, dword ptr [ebp-20]
:0047058A 51                      push ecx

* Possible Reference to Dialog: DialogID_011C, CONTROL_ID:03F8, "Attribute"
                                  |
:0047058B 68F8030000              push 000003F8
:00470590 8B55DC                  mov edx, dword ptr [ebp-24]
:00470593 8B4204                  mov eax, dword ptr [edx+04]
:00470596 50                      push eax
:00470597 FF15D8624800            call dword ptr [004862D8]
:0047059D 6A00                    push 00000000

* Possible Reference to Dialog: DialogID_011C, CONTROL_ID:03F8, "Attribute"
                                  |
:0047059F 68F8030000              push 000003F8
:004705A4 8B4DDC                  mov ecx, dword ptr [ebp-24]
:004705A7 8B5104                  mov edx, dword ptr [ecx+04]
:004705AA 52                      push edx
:004705AB FF15DC624800            call dword ptr [004862DC]
:004705B1 50                      push eax
:004705B2 FF15E8624800            call dword ptr [004862E8]

* Possible Ref to Menu: APPMENU, Item: "_8"
                                  |
:004705B8 6A68                    push 00000068
:004705BA B9142E4900              mov ecx, 00492E14
:004705BF E8ACF0FEFF              call 0045F670
:004705C4 50                      push eax
:004705C5 8B4DDC                  mov ecx, dword ptr [ebp-24]
:004705C8 83C120                  add ecx, 00000020
:004705CB E84D2EFFFF              call 0046341D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00470567(U)
|
:004705D0 8BE5                    mov esp, ebp
:004705D2 5D                      pop ebp
:004705D3 C3                      ret


:004705D4 55                      push ebp
:004705D5 8BEC                    mov ebp, esp
:004705D7 51                      push ecx
:004705D8 894DFC                  mov dword ptr [ebp-04], ecx
:004705DB 8B45FC                  mov eax, dword ptr [ebp-04]
:004705DE 83C018                  add eax, 00000018
:004705E1 50                      push eax
:004705E2 6A01                    push 00000001
:004705E4 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004705E7 51                      push ecx
:004705E8 8B5508                  mov edx, dword ptr [ebp+08]
:004705EB 52                      push edx
:004705EC E89A0C0000              call 0047128B
:004705F1 83C410                  add esp, 00000010
:004705F4 8BE5                    mov esp, ebp
:004705F6 5D                      pop ebp
:004705F7 C20800                  ret 0008


:004705FA 55                      push ebp
:004705FB 8BEC                    mov ebp, esp
:004705FD 83EC0C                  sub esp, 0000000C
:00470600 894DF4                  mov dword ptr [ebp-0C], ecx
:00470603 C745F800000000          mov [ebp-08], 00000000
:0047060A C745FC00000000          mov [ebp-04], 00000000
:00470611 8D45F8                  lea eax, dword ptr [ebp-08]
:00470614 50                      push eax
:00470615 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00470618 51                      push ecx
:00470619 FF1520634800            call dword ptr [00486320]
:0047061F 8D55F8                  lea edx, dword ptr [ebp-08]
:00470622 52                      push edx
:00470623 8B45F4                  mov eax, dword ptr [ebp-0C]
:00470626 8B4804                  mov ecx, dword ptr [eax+04]
:00470629 51                      push ecx
:0047062A FF1564624800            call dword ptr [00486264]
:00470630 8B55F4                  mov edx, dword ptr [ebp-0C]
:00470633 8B45F8                  mov eax, dword ptr [ebp-08]
:00470636 034218                  add eax, dword ptr [edx+18]
:00470639 8945F8                  mov dword ptr [ebp-08], eax
:0047063C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047063F 8B55FC                  mov edx, dword ptr [ebp-04]
:00470642 03511C                  add edx, dword ptr [ecx+1C]
:00470645 8955FC                  mov dword ptr [ebp-04], edx
:00470648 8D45F8                  lea eax, dword ptr [ebp-08]
:0047064B 50                      push eax
:0047064C 6A01                    push 00000001
:0047064E 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00470651 51                      push ecx
:00470652 8B5508                  mov edx, dword ptr [ebp+08]
:00470655 52                      push edx
:00470656 E8300F0000              call 0047158B
:0047065B 83C410                  add esp, 00000010
:0047065E 8BE5                    mov esp, ebp
:00470660 5D                      pop ebp
:00470661 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:00470255   , :004704BD   , :004707C5   
|
:00470664 55                      push ebp
:00470665 8BEC                    mov ebp, esp
:00470667 51                      push ecx
:00470668 894DFC                  mov dword ptr [ebp-04], ecx
:0047066B 8B45FC                  mov eax, dword ptr [ebp-04]
:0047066E 8B4810                  mov ecx, dword ptr [eax+10]
:00470671 83C103                  add ecx, 00000003
:00470674 51                      push ecx
:00470675 E80A9CFAFF              call 0041A284
:0047067A 83C404                  add esp, 00000004
:0047067D 25FF000000              and eax, 000000FF
:00470682 8BE5                    mov esp, ebp
:00470684 5D                      pop ebp
:00470685 C3                      ret


:00470686 55                      push ebp
:00470687 8BEC                    mov ebp, esp
:00470689 83EC08                  sub esp, 00000008
:0047068C 894DFC                  mov dword ptr [ebp-04], ecx
:0047068F 8B4508                  mov eax, dword ptr [ebp+08]
:00470692 8945F8                  mov dword ptr [ebp-08], eax
:00470695 837DF805                cmp dword ptr [ebp-08], 00000005
:00470699 7429                    je 004706C4
:0047069B 817DF815010000          cmp dword ptr [ebp-08], 00000115
:004706A2 744A                    je 004706EE
:004706A4 817DF814020000          cmp dword ptr [ebp-08], 00000214
:004706AB 7402                    je 004706AF
:004706AD EB61                    jmp 00470710

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004706AB(C)
|
:004706AF 8B4D10                  mov ecx, dword ptr [ebp+10]
:004706B2 51                      push ecx
:004706B3 8B550C                  mov edx, dword ptr [ebp+0C]
:004706B6 52                      push edx
:004706B7 8B45FC                  mov eax, dword ptr [ebp-04]
:004706BA 8B10                    mov edx, dword ptr [eax]
:004706BC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004706BF FF5228                  call [edx+28]
:004706C2 EB63                    jmp 00470727

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00470699(C)
|
:004706C4 837D0C02                cmp dword ptr [ebp+0C], 00000002
:004706C8 7406                    je 004706D0
:004706CA 837D0C00                cmp dword ptr [ebp+0C], 00000000
:004706CE 751C                    jne 004706EC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004706C8(C)
|
:004706D0 8B4510                  mov eax, dword ptr [ebp+10]
:004706D3 C1E810                  shr eax, 10
:004706D6 25FFFF0000              and eax, 0000FFFF
:004706DB 50                      push eax
:004706DC 668B4D10                mov cx, word ptr [ebp+10]
:004706E0 51                      push ecx
:004706E1 8B55FC                  mov edx, dword ptr [ebp-04]
:004706E4 8B02                    mov eax, dword ptr [edx]
:004706E6 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004706E9 FF502C                  call [eax+2C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004706CE(C)
|
:004706EC EB22                    jmp 00470710

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004706A2(C)
|
:004706EE 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004706F1 C1E910                  shr ecx, 10
:004706F4 81E1FFFF0000            and ecx, 0000FFFF
:004706FA 51                      push ecx
:004706FB 8B550C                  mov edx, dword ptr [ebp+0C]
:004706FE 81E2FFFF0000            and edx, 0000FFFF
:00470704 52                      push edx
:00470705 8B45FC                  mov eax, dword ptr [ebp-04]
:00470708 8B10                    mov edx, dword ptr [eax]
:0047070A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047070D FF5230                  call [edx+30]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004706AD(U), :004706EC(U)
|
:00470710 8B4510                  mov eax, dword ptr [ebp+10]
:00470713 50                      push eax
:00470714 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00470717 51                      push ecx
:00470718 8B5508                  mov edx, dword ptr [ebp+08]
:0047071B 52                      push edx
:0047071C 8B45FC                  mov eax, dword ptr [ebp-04]
:0047071F 8B10                    mov edx, dword ptr [eax]
:00470721 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00470724 FF5204                  call [edx+04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004706C2(U)
|
:00470727 8BE5                    mov esp, ebp
:00470729 5D                      pop ebp
:0047072A C20C00                  ret 000C


:0047072D 55                      push ebp
:0047072E 8BEC                    mov ebp, esp
:00470730 83EC38                  sub esp, 00000038
:00470733 894DC8                  mov dword ptr [ebp-38], ecx
:00470736 8B45C8                  mov eax, dword ptr [ebp-38]
:00470739 C7400C03000000          mov [eax+0C], 00000003
:00470740 8B4DC8                  mov ecx, dword ptr [ebp-38]

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:00470743 C7411006000000          mov [ecx+10], 00000006
:0047074A 8B55C8                  mov edx, dword ptr [ebp-38]
:0047074D C7421400000000          mov [edx+14], 00000000
:00470754 8B45C8                  mov eax, dword ptr [ebp-38]
:00470757 C7401800000000          mov [eax+18], 00000000
:0047075E C745E400000000          mov [ebp-1C], 00000000
:00470765 EB09                    jmp 00470770

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004707EC(U)
|
:00470767 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0047076A 83C101                  add ecx, 00000001
:0047076D 894DE4                  mov dword ptr [ebp-1C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00470765(U)
|
:00470770 837DE468                cmp dword ptr [ebp-1C], 00000068
:00470774 7D7B                    jge 004707F1
:00470776 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00470779 6BC919                  imul ecx, 00000019
:0047077C 81C140114A00            add ecx, 004A1140
:00470782 E8798EF9FF              call 00409600
:00470787 85C0                    test eax, eax
:00470789 7461                    je 004707EC
:0047078B 8B55C8                  mov edx, dword ptr [ebp-38]
:0047078E 8B4204                  mov eax, dword ptr [edx+04]
:00470791 50                      push eax
:00470792 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00470795 51                      push ecx
:00470796 8B55C8                  mov edx, dword ptr [ebp-38]
:00470799 8B4218                  mov eax, dword ptr [edx+18]
:0047079C 83C001                  add eax, 00000001
:0047079F 50                      push eax
:004707A0 8B4DC8                  mov ecx, dword ptr [ebp-38]
:004707A3 8B5118                  mov edx, dword ptr [ecx+18]
:004707A6 6BD234                  imul edx, 00000034
:004707A9 8B45C8                  mov eax, dword ptr [ebp-38]
:004707AC 8D4C101C                lea ecx, dword ptr [eax+edx+1C]
:004707B0 E846FAFFFF              call 004701FB
:004707B5 8B4DC8                  mov ecx, dword ptr [ebp-38]
:004707B8 8B5118                  mov edx, dword ptr [ecx+18]
:004707BB 6BD234                  imul edx, 00000034
:004707BE 8B45C8                  mov eax, dword ptr [ebp-38]
:004707C1 8D4C101C                lea ecx, dword ptr [eax+edx+1C]
:004707C5 E89AFEFFFF              call 00470664
:004707CA 85C0                    test eax, eax
:004707CC 740F                    je 004707DD
:004707CE 8B4DC8                  mov ecx, dword ptr [ebp-38]
:004707D1 8B5114                  mov edx, dword ptr [ecx+14]
:004707D4 83C201                  add edx, 00000001
:004707D7 8B45C8                  mov eax, dword ptr [ebp-38]
:004707DA 895014                  mov dword ptr [eax+14], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004707CC(C)
|
:004707DD 8B4DC8                  mov ecx, dword ptr [ebp-38]
:004707E0 8B5118                  mov edx, dword ptr [ecx+18]
:004707E3 83C201                  add edx, 00000001
:004707E6 8B45C8                  mov eax, dword ptr [ebp-38]
:004707E9 895018                  mov dword ptr [eax+18], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00470789(C)
|
:004707EC E976FFFFFF              jmp 00470767

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00470774(C)
|
:004707F1 6A00                    push 00000000
:004707F3 6A00                    push 00000000
:004707F5 6A01                    push 00000001
:004707F7 8B4DC8                  mov ecx, dword ptr [ebp-38]
:004707FA 8B5104                  mov edx, dword ptr [ecx+04]
:004707FD 52                      push edx
:004707FE FF1518624800            call dword ptr [00486218]
:00470804 8D45E8                  lea eax, dword ptr [ebp-18]
:00470807 50                      push eax
:00470808 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0047080B 8B5104                  mov edx, dword ptr [ecx+04]
:0047080E 52                      push edx
:0047080F FF1598634800            call dword ptr [00486398]
:00470815 8B45F0                  mov eax, dword ptr [ebp-10]
:00470818 2B45E8                  sub eax, dword ptr [ebp-18]
:0047081B 8945D4                  mov dword ptr [ebp-2C], eax
:0047081E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00470821 2B4DEC                  sub ecx, dword ptr [ebp-14]
:00470824 894DD8                  mov dword ptr [ebp-28], ecx
:00470827 8D55E8                  lea edx, dword ptr [ebp-18]
:0047082A 52                      push edx
:0047082B 8B45C8                  mov eax, dword ptr [ebp-38]
:0047082E 8B4804                  mov ecx, dword ptr [eax+04]
:00470831 51                      push ecx
:00470832 E83313FFFF              call 00461B6A
:00470837 83C408                  add esp, 00000008
:0047083A 8B55F0                  mov edx, dword ptr [ebp-10]
:0047083D 2B55E8                  sub edx, dword ptr [ebp-18]
:00470840 8B45D4                  mov eax, dword ptr [ebp-2C]
:00470843 2BC2                    sub eax, edx
:00470845 8945D4                  mov dword ptr [ebp-2C], eax
:00470848 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047084B 2B4DEC                  sub ecx, dword ptr [ebp-14]
:0047084E 8B55D8                  mov edx, dword ptr [ebp-28]
:00470851 2BD1                    sub edx, ecx
:00470853 8955D8                  mov dword ptr [ebp-28], edx
:00470856 8D45CC                  lea eax, dword ptr [ebp-34]
:00470859 50                      push eax
:0047085A 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0047085D 83C11C                  add ecx, 0000001C
:00470860 E8CCFBFFFF              call 00470431
:00470865 8B08                    mov ecx, dword ptr [eax]
:00470867 8B5004                  mov edx, dword ptr [eax+04]
:0047086A 894DF8                  mov dword ptr [ebp-08], ecx
:0047086D 8955FC                  mov dword ptr [ebp-04], edx
:00470870 8B45C8                  mov eax, dword ptr [ebp-38]
:00470873 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00470876 0FAF480C                imul ecx, dword ptr [eax+0C]
:0047087A 8B55D4                  mov edx, dword ptr [ebp-2C]
:0047087D 03D1                    add edx, ecx
:0047087F 8955D4                  mov dword ptr [ebp-2C], edx
:00470882 8B45C8                  mov eax, dword ptr [ebp-38]
:00470885 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00470888 0FAF4810                imul ecx, dword ptr [eax+10]
:0047088C 8B55D8                  mov edx, dword ptr [ebp-28]
:0047088F 03D1                    add edx, ecx
:00470891 8955D8                  mov dword ptr [ebp-28], edx
:00470894 8D45E8                  lea eax, dword ptr [ebp-18]
:00470897 50                      push eax
:00470898 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0047089B 8B5104                  mov edx, dword ptr [ecx+04]
:0047089E 52                      push edx
:0047089F FF159C634800            call dword ptr [0048639C]
:004708A5 50                      push eax
:004708A6 FF1598634800            call dword ptr [00486398]
:004708AC 8B45E8                  mov eax, dword ptr [ebp-18]
:004708AF 0345F0                  add eax, dword ptr [ebp-10]
:004708B2 2B45D4                  sub eax, dword ptr [ebp-2C]
:004708B5 99                      cdq
:004708B6 2BC2                    sub eax, edx
:004708B8 D1F8                    sar eax, 1
:004708BA 8945E0                  mov dword ptr [ebp-20], eax
:004708BD 8B45EC                  mov eax, dword ptr [ebp-14]
:004708C0 0345F4                  add eax, dword ptr [ebp-0C]
:004708C3 2B45D8                  sub eax, dword ptr [ebp-28]
:004708C6 99                      cdq
:004708C7 2BC2                    sub eax, edx
:004708C9 D1F8                    sar eax, 1
:004708CB 8945DC                  mov dword ptr [ebp-24], eax
:004708CE 6A00                    push 00000000
:004708D0 8B45D8                  mov eax, dword ptr [ebp-28]
:004708D3 50                      push eax
:004708D4 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:004708D7 51                      push ecx
:004708D8 8B55DC                  mov edx, dword ptr [ebp-24]
:004708DB 52                      push edx
:004708DC 8B45E0                  mov eax, dword ptr [ebp-20]
:004708DF 50                      push eax
:004708E0 8B4DC8                  mov ecx, dword ptr [ebp-38]
:004708E3 8B5104                  mov edx, dword ptr [ecx+04]
:004708E6 52                      push edx
:004708E7 FF15BC624800            call dword ptr [004862BC]
:004708ED 8BE5                    mov esp, ebp
:004708EF 5D                      pop ebp
:004708F0 C3                      ret


:004708F1 55                      push ebp
:004708F2 8BEC                    mov ebp, esp
:004708F4 83EC38                  sub esp, 00000038
:004708F7 894DCC                  mov dword ptr [ebp-34], ecx
:004708FA 8D45F0                  lea eax, dword ptr [ebp-10]
:004708FD 50                      push eax
:004708FE 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00470901 8B5104                  mov edx, dword ptr [ecx+04]
:00470904 52                      push edx
:00470905 FF1598634800            call dword ptr [00486398]
:0047090B 8B45F8                  mov eax, dword ptr [ebp-08]
:0047090E 2B45F0                  sub eax, dword ptr [ebp-10]
:00470911 8945E0                  mov dword ptr [ebp-20], eax
:00470914 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00470917 2B4DF4                  sub ecx, dword ptr [ebp-0C]
:0047091A 894DE4                  mov dword ptr [ebp-1C], ecx
:0047091D 8D55F0                  lea edx, dword ptr [ebp-10]
:00470920 52                      push edx
:00470921 8B45CC                  mov eax, dword ptr [ebp-34]
:00470924 8B4804                  mov ecx, dword ptr [eax+04]
:00470927 51                      push ecx
:00470928 FF15EC624800            call dword ptr [004862EC]
:0047092E 8B55F8                  mov edx, dword ptr [ebp-08]
:00470931 2B55F0                  sub edx, dword ptr [ebp-10]
:00470934 8B45E0                  mov eax, dword ptr [ebp-20]
:00470937 2BC2                    sub eax, edx
:00470939 8945E0                  mov dword ptr [ebp-20], eax
:0047093C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047093F 2B4DF4                  sub ecx, dword ptr [ebp-0C]
:00470942 8B55E4                  mov edx, dword ptr [ebp-1C]
:00470945 2BD1                    sub edx, ecx
:00470947 8955E4                  mov dword ptr [ebp-1C], edx
:0047094A 8D45D0                  lea eax, dword ptr [ebp-30]
:0047094D 50                      push eax
:0047094E 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00470951 83C11C                  add ecx, 0000001C
:00470954 E8D8FAFFFF              call 00470431
:00470959 8B08                    mov ecx, dword ptr [eax]
:0047095B 8B5004                  mov edx, dword ptr [eax+04]
:0047095E 894DE8                  mov dword ptr [ebp-18], ecx
:00470961 8955EC                  mov dword ptr [ebp-14], edx
:00470964 837DE800                cmp dword ptr [ebp-18], 00000000
:00470968 0F846A010000            je 00470AD8
:0047096E 837DEC00                cmp dword ptr [ebp-14], 00000000
:00470972 0F8460010000            je 00470AD8
:00470978 8B450C                  mov eax, dword ptr [ebp+0C]
:0047097B 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0047097E 8B4008                  mov eax, dword ptr [eax+08]
:00470981 2B01                    sub eax, dword ptr [ecx]
:00470983 2B45E0                  sub eax, dword ptr [ebp-20]
:00470986 99                      cdq
:00470987 F77DE8                  idiv [ebp-18]
:0047098A 8955DC                  mov dword ptr [ebp-24], edx
:0047098D 8B550C                  mov edx, dword ptr [ebp+0C]
:00470990 8B450C                  mov eax, dword ptr [ebp+0C]
:00470993 8B4A0C                  mov ecx, dword ptr [edx+0C]
:00470996 2B4804                  sub ecx, dword ptr [eax+04]
:00470999 2B4DE4                  sub ecx, dword ptr [ebp-1C]
:0047099C 8BC1                    mov eax, ecx
:0047099E 99                      cdq
:0047099F F77DEC                  idiv [ebp-14]
:004709A2 8955D8                  mov dword ptr [ebp-28], edx
:004709A5 8B550C                  mov edx, dword ptr [ebp+0C]
:004709A8 8B450C                  mov eax, dword ptr [ebp+0C]
:004709AB 8B4A08                  mov ecx, dword ptr [edx+08]
:004709AE 2B08                    sub ecx, dword ptr [eax]
:004709B0 2B4DE0                  sub ecx, dword ptr [ebp-20]
:004709B3 8BC1                    mov eax, ecx
:004709B5 99                      cdq
:004709B6 F77DE8                  idiv [ebp-18]
:004709B9 85C0                    test eax, eax
:004709BB 7509                    jne 004709C6
:004709BD 8B55DC                  mov edx, dword ptr [ebp-24]
:004709C0 2B55E8                  sub edx, dword ptr [ebp-18]
:004709C3 8955DC                  mov dword ptr [ebp-24], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004709BB(C)
|
:004709C6 8B450C                  mov eax, dword ptr [ebp+0C]
:004709C9 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004709CC 8B400C                  mov eax, dword ptr [eax+0C]
:004709CF 2B4104                  sub eax, dword ptr [ecx+04]
:004709D2 2B45E4                  sub eax, dword ptr [ebp-1C]
:004709D5 99                      cdq
:004709D6 F77DEC                  idiv [ebp-14]
:004709D9 85C0                    test eax, eax
:004709DB 7509                    jne 004709E6
:004709DD 8B55D8                  mov edx, dword ptr [ebp-28]
:004709E0 2B55EC                  sub edx, dword ptr [ebp-14]
:004709E3 8955D8                  mov dword ptr [ebp-28], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004709DB(C)
|
:004709E6 8B4508                  mov eax, dword ptr [ebp+08]
:004709E9 8945C8                  mov dword ptr [ebp-38], eax
:004709EC 8B4DC8                  mov ecx, dword ptr [ebp-38]
:004709EF 83E901                  sub ecx, 00000001
:004709F2 894DC8                  mov dword ptr [ebp-38], ecx
:004709F5 837DC807                cmp dword ptr [ebp-38], 00000007
:004709F9 0F87CE000000            ja 00470ACD
:004709FF 8B55C8                  mov edx, dword ptr [ebp-38]
:00470A02 FF2495E00A4700          jmp dword ptr [4*edx+00470AE0]
:00470A09 8B450C                  mov eax, dword ptr [ebp+0C]
:00470A0C 8B480C                  mov ecx, dword ptr [eax+0C]
:00470A0F 2B4DD8                  sub ecx, dword ptr [ebp-28]
:00470A12 8B550C                  mov edx, dword ptr [ebp+0C]
:00470A15 894A0C                  mov dword ptr [edx+0C], ecx
:00470A18 E9B4000000              jmp 00470AD1
:00470A1D 8B450C                  mov eax, dword ptr [ebp+0C]
:00470A20 8B08                    mov ecx, dword ptr [eax]
:00470A22 034DDC                  add ecx, dword ptr [ebp-24]
:00470A25 8B550C                  mov edx, dword ptr [ebp+0C]
:00470A28 890A                    mov dword ptr [edx], ecx
:00470A2A 8B450C                  mov eax, dword ptr [ebp+0C]
:00470A2D 8B480C                  mov ecx, dword ptr [eax+0C]
:00470A30 2B4DD8                  sub ecx, dword ptr [ebp-28]
:00470A33 8B550C                  mov edx, dword ptr [ebp+0C]
:00470A36 894A0C                  mov dword ptr [edx+0C], ecx
:00470A39 E993000000              jmp 00470AD1
:00470A3E 8B450C                  mov eax, dword ptr [ebp+0C]
:00470A41 8B4808                  mov ecx, dword ptr [eax+08]
:00470A44 2B4DDC                  sub ecx, dword ptr [ebp-24]
:00470A47 8B550C                  mov edx, dword ptr [ebp+0C]
:00470A4A 894A08                  mov dword ptr [edx+08], ecx
:00470A4D 8B450C                  mov eax, dword ptr [ebp+0C]
:00470A50 8B480C                  mov ecx, dword ptr [eax+0C]
:00470A53 2B4DD8                  sub ecx, dword ptr [ebp-28]
:00470A56 8B550C                  mov edx, dword ptr [ebp+0C]
:00470A59 894A0C                  mov dword ptr [edx+0C], ecx
:00470A5C EB73                    jmp 00470AD1
:00470A5E 8B450C                  mov eax, dword ptr [ebp+0C]
:00470A61 8B08                    mov ecx, dword ptr [eax]
:00470A63 034DDC                  add ecx, dword ptr [ebp-24]
:00470A66 8B550C                  mov edx, dword ptr [ebp+0C]
:00470A69 890A                    mov dword ptr [edx], ecx
:00470A6B EB64                    jmp 00470AD1
:00470A6D 8B450C                  mov eax, dword ptr [ebp+0C]
:00470A70 8B4808                  mov ecx, dword ptr [eax+08]
:00470A73 2B4DDC                  sub ecx, dword ptr [ebp-24]
:00470A76 8B550C                  mov edx, dword ptr [ebp+0C]
:00470A79 894A08                  mov dword ptr [edx+08], ecx
:00470A7C EB53                    jmp 00470AD1
:00470A7E 8B450C                  mov eax, dword ptr [ebp+0C]
:00470A81 8B4804                  mov ecx, dword ptr [eax+04]
:00470A84 034DD8                  add ecx, dword ptr [ebp-28]
:00470A87 8B550C                  mov edx, dword ptr [ebp+0C]
:00470A8A 894A04                  mov dword ptr [edx+04], ecx
:00470A8D EB42                    jmp 00470AD1
:00470A8F 8B450C                  mov eax, dword ptr [ebp+0C]
:00470A92 8B4804                  mov ecx, dword ptr [eax+04]
:00470A95 034DD8                  add ecx, dword ptr [ebp-28]
:00470A98 8B550C                  mov edx, dword ptr [ebp+0C]
:00470A9B 894A04                  mov dword ptr [edx+04], ecx
:00470A9E 8B450C                  mov eax, dword ptr [ebp+0C]
:00470AA1 8B08                    mov ecx, dword ptr [eax]
:00470AA3 034DDC                  add ecx, dword ptr [ebp-24]
:00470AA6 8B550C                  mov edx, dword ptr [ebp+0C]
:00470AA9 890A                    mov dword ptr [edx], ecx
:00470AAB EB24                    jmp 00470AD1
:00470AAD 8B450C                  mov eax, dword ptr [ebp+0C]
:00470AB0 8B4804                  mov ecx, dword ptr [eax+04]
:00470AB3 034DD8                  add ecx, dword ptr [ebp-28]
:00470AB6 8B550C                  mov edx, dword ptr [ebp+0C]
:00470AB9 894A04                  mov dword ptr [edx+04], ecx
:00470ABC 8B450C                  mov eax, dword ptr [ebp+0C]
:00470ABF 8B4808                  mov ecx, dword ptr [eax+08]
:00470AC2 2B4DDC                  sub ecx, dword ptr [ebp-24]
:00470AC5 8B550C                  mov edx, dword ptr [ebp+0C]
:00470AC8 894A08                  mov dword ptr [edx+08], ecx
:00470ACB EB04                    jmp 00470AD1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004709F9(C)
|
:00470ACD 33C0                    xor eax, eax
:00470ACF EB09                    jmp 00470ADA

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00470A18(U), :00470A39(U), :00470A5C(U), :00470A6B(U), :00470A7C(U)
|:00470A8D(U), :00470AAB(U), :00470ACB(U)
|
:00470AD1 B801000000              mov eax, 00000001
:00470AD6 EB02                    jmp 00470ADA

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00470968(C), :00470972(C)
|
:00470AD8 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00470ACF(U), :00470AD6(U)
|
:00470ADA 8BE5                    mov esp, ebp
:00470ADC 5D                      pop ebp
:00470ADD C20800                  ret 0008



:00470AE0 5E0A4700                DWORD 00470A5E
:00470AE4 6D0A4700                DWORD 00470A6D
:00470AE8 7E0A4700                DWORD 00470A7E
:00470AEC 8F0A4700                DWORD 00470A8F
:00470AF0 AD0A4700                DWORD 00470AAD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00470AE8(C)
|
:00470AF4 090A4700                DWORD 00470A09
:00470AF8 1D0A4700                DWORD 00470A1D
:00470AFC 3E0A4700                DWORD 00470A3E


:00470B00 55                      push ebp
:00470B01 8BEC                    mov ebp, esp
:00470B03 83EC38                  sub esp, 00000038
:00470B06 894DC8                  mov dword ptr [ebp-38], ecx
:00470B09 8D45F8                  lea eax, dword ptr [ebp-08]
:00470B0C 50                      push eax
:00470B0D 8B4DC8                  mov ecx, dword ptr [ebp-38]
:00470B10 83C11C                  add ecx, 0000001C
:00470B13 E819F9FFFF              call 00470431
:00470B18 837DF800                cmp dword ptr [ebp-08], 00000000
:00470B1C 0F843A010000            je 00470C5C
:00470B22 837DFC00                cmp dword ptr [ebp-04], 00000000
:00470B26 0F8430010000            je 00470C5C
:00470B2C 8B4508                  mov eax, dword ptr [ebp+08]
:00470B2F 25FFFF0000              and eax, 0000FFFF
:00470B34 99                      cdq
:00470B35 F77DF8                  idiv [ebp-08]
:00470B38 8945F0                  mov dword ptr [ebp-10], eax
:00470B3B 837DF001                cmp dword ptr [ebp-10], 00000001
:00470B3F 7D07                    jge 00470B48
:00470B41 C745F001000000          mov [ebp-10], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00470B3F(C)
|
:00470B48 6A01                    push 00000001
:00470B4A 8B4DC8                  mov ecx, dword ptr [ebp-38]
:00470B4D 8B5104                  mov edx, dword ptr [ecx+04]
:00470B50 52                      push edx
:00470B51 FF1508624800            call dword ptr [00486208]
:00470B57 8945CC                  mov dword ptr [ebp-34], eax
:00470B5A 8B45C8                  mov eax, dword ptr [ebp-38]
:00470B5D 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00470B60 0FAF480C                imul ecx, dword ptr [eax+0C]
:00470B64 8BC1                    mov eax, ecx
:00470B66 99                      cdq
:00470B67 F77DF0                  idiv [ebp-10]
:00470B6A 8945CC                  mov dword ptr [ebp-34], eax
:00470B6D 8B55C8                  mov edx, dword ptr [ebp-38]
:00470B70 8B45F0                  mov eax, dword ptr [ebp-10]
:00470B73 89420C                  mov dword ptr [edx+0C], eax
:00470B76 8B450C                  mov eax, dword ptr [ebp+0C]
:00470B79 25FFFF0000              and eax, 0000FFFF
:00470B7E 99                      cdq
:00470B7F F77DFC                  idiv [ebp-04]
:00470B82 8B4DC8                  mov ecx, dword ptr [ebp-38]
:00470B85 894110                  mov dword ptr [ecx+10], eax
:00470B88 8B4DC8                  mov ecx, dword ptr [ebp-38]
:00470B8B B831000000              mov eax, 00000031
:00470B90 99                      cdq
:00470B91 F7790C                  idiv [ecx+0C]
:00470B94 8945F4                  mov dword ptr [ebp-0C], eax
:00470B97 8B55C8                  mov edx, dword ptr [ebp-38]
:00470B9A 8B45F4                  mov eax, dword ptr [ebp-0C]
:00470B9D 2B4210                  sub eax, dword ptr [edx+10]
:00470BA0 83C001                  add eax, 00000001
:00470BA3 3B45CC                  cmp eax, dword ptr [ebp-34]
:00470BA6 7D0F                    jge 00470BB7
:00470BA8 8B4DC8                  mov ecx, dword ptr [ebp-38]
:00470BAB 8B55F4                  mov edx, dword ptr [ebp-0C]
:00470BAE 2B5110                  sub edx, dword ptr [ecx+10]
:00470BB1 83C201                  add edx, 00000001
:00470BB4 8955CC                  mov dword ptr [ebp-34], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00470BA6(C)
|
:00470BB7 8B45C8                  mov eax, dword ptr [ebp-38]
:00470BBA 8B4804                  mov ecx, dword ptr [eax+04]
:00470BBD 51                      push ecx
:00470BBE FF1530634800            call dword ptr [00486330]
:00470BC4 C745EC00000000          mov [ebp-14], 00000000
:00470BCB EB09                    jmp 00470BD6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00470C13(U)
|
:00470BCD 8B55EC                  mov edx, dword ptr [ebp-14]
:00470BD0 83C201                  add edx, 00000001
:00470BD3 8955EC                  mov dword ptr [ebp-14], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00470BCB(U)
|
:00470BD6 837DEC32                cmp dword ptr [ebp-14], 00000032
:00470BDA 7D39                    jge 00470C15
:00470BDC 8B4DC8                  mov ecx, dword ptr [ebp-38]
:00470BDF 8B45EC                  mov eax, dword ptr [ebp-14]
:00470BE2 99                      cdq
:00470BE3 F7790C                  idiv [ecx+0C]
:00470BE6 2B45CC                  sub eax, dword ptr [ebp-34]
:00470BE9 8B55FC                  mov edx, dword ptr [ebp-04]
:00470BEC 0FAFD0                  imul edx, eax
:00470BEF 52                      push edx
:00470BF0 8B4DC8                  mov ecx, dword ptr [ebp-38]
:00470BF3 8B45EC                  mov eax, dword ptr [ebp-14]
:00470BF6 99                      cdq
:00470BF7 F7790C                  idiv [ecx+0C]
:00470BFA 8B45F8                  mov eax, dword ptr [ebp-08]
:00470BFD 0FAFC2                  imul eax, edx
:00470C00 50                      push eax
:00470C01 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00470C04 6BC934                  imul ecx, 00000034
:00470C07 8B55C8                  mov edx, dword ptr [ebp-38]
:00470C0A 8D4C0A1C                lea ecx, dword ptr [edx+ecx+1C]
:00470C0E E8E2F7FFFF              call 004703F5
:00470C13 EBB8                    jmp 00470BCD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00470BDA(C)
|
:00470C15 6A00                    push 00000000
:00470C17 FF1530634800            call dword ptr [00486330]
:00470C1D C745D01C000000          mov [ebp-30], 0000001C

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:00470C24 C745D407000000          mov [ebp-2C], 00000007
:00470C2B C745D800000000          mov [ebp-28], 00000000
:00470C32 8B45F4                  mov eax, dword ptr [ebp-0C]
:00470C35 8945DC                  mov dword ptr [ebp-24], eax
:00470C38 8B4DC8                  mov ecx, dword ptr [ebp-38]
:00470C3B 8B5110                  mov edx, dword ptr [ecx+10]
:00470C3E 8955E0                  mov dword ptr [ebp-20], edx
:00470C41 8B45CC                  mov eax, dword ptr [ebp-34]
:00470C44 8945E4                  mov dword ptr [ebp-1C], eax
:00470C47 6A01                    push 00000001
:00470C49 8D4DD0                  lea ecx, dword ptr [ebp-30]
:00470C4C 51                      push ecx
:00470C4D 6A01                    push 00000001
:00470C4F 8B55C8                  mov edx, dword ptr [ebp-38]
:00470C52 8B4204                  mov eax, dword ptr [edx+04]
:00470C55 50                      push eax
:00470C56 FF1504624800            call dword ptr [00486204]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00470B1C(C), :00470B26(C)
|
:00470C5C 8BE5                    mov esp, ebp
:00470C5E 5D                      pop ebp
:00470C5F C20800                  ret 0008



* Referenced by a CALL at Address:
|:00470E68   
|
:00470C62 55                      push ebp
:00470C63 8BEC                    mov ebp, esp
:00470C65 83EC38                  sub esp, 00000038
:00470C68 894DC8                  mov dword ptr [ebp-38], ecx
:00470C6B 8D45F4                  lea eax, dword ptr [ebp-0C]
:00470C6E 50                      push eax
:00470C6F 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00470C72 51                      push ecx
:00470C73 6A01                    push 00000001
:00470C75 8B55C8                  mov edx, dword ptr [ebp-38]
:00470C78 8B4204                  mov eax, dword ptr [edx+04]
:00470C7B 50                      push eax
:00470C7C FF1510624800            call dword ptr [00486210]
:00470C82 8B4D08                  mov ecx, dword ptr [ebp+08]
:00470C85 3B4DF0                  cmp ecx, dword ptr [ebp-10]
:00470C88 7D08                    jge 00470C92
:00470C8A 8B55F0                  mov edx, dword ptr [ebp-10]
:00470C8D 895508                  mov dword ptr [ebp+08], edx
:00470C90 EB20                    jmp 00470CB2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00470C88(C)
|
:00470C92 8B45C8                  mov eax, dword ptr [ebp-38]
:00470C95 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00470C98 2B4810                  sub ecx, dword ptr [eax+10]
:00470C9B 83C101                  add ecx, 00000001
:00470C9E 3B4D08                  cmp ecx, dword ptr [ebp+08]
:00470CA1 7D0F                    jge 00470CB2
:00470CA3 8B55C8                  mov edx, dword ptr [ebp-38]
:00470CA6 8B45F4                  mov eax, dword ptr [ebp-0C]
:00470CA9 2B4210                  sub eax, dword ptr [edx+10]
:00470CAC 83C001                  add eax, 00000001
:00470CAF 894508                  mov dword ptr [ebp+08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00470C90(U), :00470CA1(C)
|
:00470CB2 8D4DF8                  lea ecx, dword ptr [ebp-08]
:00470CB5 51                      push ecx
:00470CB6 8B4DC8                  mov ecx, dword ptr [ebp-38]
:00470CB9 83C11C                  add ecx, 0000001C
:00470CBC E870F7FFFF              call 00470431
:00470CC1 837DF800                cmp dword ptr [ebp-08], 00000000
:00470CC5 0F8422010000            je 00470DED
:00470CCB 837DFC00                cmp dword ptr [ebp-04], 00000000
:00470CCF 0F8418010000            je 00470DED
:00470CD5 6A01                    push 00000001
:00470CD7 8B55C8                  mov edx, dword ptr [ebp-38]
:00470CDA 8B4204                  mov eax, dword ptr [edx+04]
:00470CDD 50                      push eax
:00470CDE FF1508624800            call dword ptr [00486208]
:00470CE4 8945EC                  mov dword ptr [ebp-14], eax
:00470CE7 C745DC00000000          mov [ebp-24], 00000000
:00470CEE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00470CF1 F7D9                    neg ecx
:00470CF3 0FAF4DEC                imul ecx, dword ptr [ebp-14]
:00470CF7 894DE0                  mov dword ptr [ebp-20], ecx
:00470CFA 8B55C8                  mov edx, dword ptr [ebp-38]
:00470CFD 8B45F8                  mov eax, dword ptr [ebp-08]
:00470D00 0FAF420C                imul eax, dword ptr [edx+0C]
:00470D04 8945E4                  mov dword ptr [ebp-1C], eax
:00470D07 8B4DC8                  mov ecx, dword ptr [ebp-38]
:00470D0A B832000000              mov eax, 00000032
:00470D0F 99                      cdq
:00470D10 F7790C                  idiv [ecx+0C]
:00470D13 2B45EC                  sub eax, dword ptr [ebp-14]
:00470D16 83C001                  add eax, 00000001
:00470D19 8B55FC                  mov edx, dword ptr [ebp-04]
:00470D1C 0FAFD0                  imul edx, eax
:00470D1F 8955E8                  mov dword ptr [ebp-18], edx
:00470D22 8D45CC                  lea eax, dword ptr [ebp-34]
:00470D25 50                      push eax
:00470D26 8B4DC8                  mov ecx, dword ptr [ebp-38]
:00470D29 8B5104                  mov edx, dword ptr [ecx+04]
:00470D2C 52                      push edx
:00470D2D FF15EC624800            call dword ptr [004862EC]
:00470D33 6A03                    push 00000003
:00470D35 6A00                    push 00000000
:00470D37 6A00                    push 00000000
:00470D39 8D45CC                  lea eax, dword ptr [ebp-34]
:00470D3C 50                      push eax
:00470D3D 8D4DDC                  lea ecx, dword ptr [ebp-24]
:00470D40 51                      push ecx
:00470D41 8B55EC                  mov edx, dword ptr [ebp-14]
:00470D44 2B5508                  sub edx, dword ptr [ebp+08]
:00470D47 8B45FC                  mov eax, dword ptr [ebp-04]
:00470D4A 0FAFC2                  imul eax, edx
:00470D4D 50                      push eax
:00470D4E 6A00                    push 00000000
:00470D50 8B4DC8                  mov ecx, dword ptr [ebp-38]
:00470D53 8B5104                  mov edx, dword ptr [ecx+04]
:00470D56 52                      push edx
:00470D57 FF150C624800            call dword ptr [0048620C]
:00470D5D 8B45C8                  mov eax, dword ptr [ebp-38]
:00470D60 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00470D63 2B4810                  sub ecx, dword ptr [eax+10]
:00470D66 83C101                  add ecx, 00000001
:00470D69 3B4D08                  cmp ecx, dword ptr [ebp+08]
:00470D6C 756A                    jne 00470DD8
:00470D6E 8B4DC8                  mov ecx, dword ptr [ebp-38]
:00470D71 B832000000              mov eax, 00000032
:00470D76 99                      cdq
:00470D77 F7790C                  idiv [ecx+0C]
:00470D7A 85D2                    test edx, edx
:00470D7C 743A                    je 00470DB8
:00470D7E 8B55C8                  mov edx, dword ptr [ebp-38]
:00470D81 8B4210                  mov eax, dword ptr [edx+10]
:00470D84 83E801                  sub eax, 00000001
:00470D87 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00470D8A 0FAFC8                  imul ecx, eax
:00470D8D 894DE0                  mov dword ptr [ebp-20], ecx
:00470D90 8B4DC8                  mov ecx, dword ptr [ebp-38]
:00470D93 B832000000              mov eax, 00000032
:00470D98 99                      cdq
:00470D99 F7790C                  idiv [ecx+0C]
:00470D9C 8B45F8                  mov eax, dword ptr [ebp-08]
:00470D9F 0FAFC2                  imul eax, edx
:00470DA2 8945DC                  mov dword ptr [ebp-24], eax
:00470DA5 6A01                    push 00000001
:00470DA7 8D4DDC                  lea ecx, dword ptr [ebp-24]
:00470DAA 51                      push ecx
:00470DAB 8B55C8                  mov edx, dword ptr [ebp-38]
:00470DAE 8B4204                  mov eax, dword ptr [edx+04]
:00470DB1 50                      push eax
:00470DB2 FF15A4624800            call dword ptr [004862A4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00470D7C(C)
|
:00470DB8 8B4DC8                  mov ecx, dword ptr [ebp-38]
:00470DBB 8B55FC                  mov edx, dword ptr [ebp-04]
:00470DBE 0FAF5110                imul edx, dword ptr [ecx+10]
:00470DC2 8955D0                  mov dword ptr [ebp-30], edx
:00470DC5 6A01                    push 00000001
:00470DC7 8D45CC                  lea eax, dword ptr [ebp-34]
:00470DCA 50                      push eax
:00470DCB 8B4DC8                  mov ecx, dword ptr [ebp-38]
:00470DCE 8B5104                  mov edx, dword ptr [ecx+04]
:00470DD1 52                      push edx
:00470DD2 FF15A4624800            call dword ptr [004862A4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00470D6C(C)
|
:00470DD8 6A01                    push 00000001
:00470DDA 8B4508                  mov eax, dword ptr [ebp+08]
:00470DDD 50                      push eax
:00470DDE 6A01                    push 00000001
:00470DE0 8B4DC8                  mov ecx, dword ptr [ebp-38]
:00470DE3 8B5104                  mov edx, dword ptr [ecx+04]
:00470DE6 52                      push edx
:00470DE7 FF1518624800            call dword ptr [00486218]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00470CC5(C), :00470CCF(C)
|
:00470DED 8BE5                    mov esp, ebp
:00470DEF 5D                      pop ebp
:00470DF0 C20400                  ret 0004


:00470DF3 55                      push ebp
:00470DF4 8BEC                    mov ebp, esp
:00470DF6 83EC0C                  sub esp, 0000000C
:00470DF9 894DF8                  mov dword ptr [ebp-08], ecx
:00470DFC 6A01                    push 00000001
:00470DFE 8B45F8                  mov eax, dword ptr [ebp-08]
:00470E01 8B4804                  mov ecx, dword ptr [eax+04]
:00470E04 51                      push ecx
:00470E05 FF1508624800            call dword ptr [00486208]
:00470E0B 8945FC                  mov dword ptr [ebp-04], eax
:00470E0E 8B5508                  mov edx, dword ptr [ebp+08]
:00470E11 8955F4                  mov dword ptr [ebp-0C], edx
:00470E14 837DF407                cmp dword ptr [ebp-0C], 00000007
:00470E18 7745                    ja 00470E5F
:00470E1A 8B45F4                  mov eax, dword ptr [ebp-0C]
:00470E1D FF2485730E4700          jmp dword ptr [4*eax+00470E73]
:00470E24 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00470E27 83C101                  add ecx, 00000001
:00470E2A 894DFC                  mov dword ptr [ebp-04], ecx
:00470E2D EB32                    jmp 00470E61
:00470E2F 8B55FC                  mov edx, dword ptr [ebp-04]
:00470E32 83EA01                  sub edx, 00000001
:00470E35 8955FC                  mov dword ptr [ebp-04], edx
:00470E38 EB27                    jmp 00470E61
:00470E3A 8B45F8                  mov eax, dword ptr [ebp-08]
:00470E3D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00470E40 034810                  add ecx, dword ptr [eax+10]
:00470E43 894DFC                  mov dword ptr [ebp-04], ecx
:00470E46 EB19                    jmp 00470E61
:00470E48 8B55F8                  mov edx, dword ptr [ebp-08]
:00470E4B 8B45FC                  mov eax, dword ptr [ebp-04]
:00470E4E 2B4210                  sub eax, dword ptr [edx+10]
:00470E51 8945FC                  mov dword ptr [ebp-04], eax
:00470E54 EB0B                    jmp 00470E61
:00470E56 0FBF4D0C                movsx ecx, word ptr [ebp+0C]
:00470E5A 894DFC                  mov dword ptr [ebp-04], ecx
:00470E5D EB02                    jmp 00470E61

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00470E18(C)
|
:00470E5F EB0C                    jmp 00470E6D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00470E2D(U), :00470E38(U), :00470E46(U), :00470E54(U), :00470E5D(U)
|
:00470E61 8B55FC                  mov edx, dword ptr [ebp-04]
:00470E64 52                      push edx
:00470E65 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00470E68 E8F5FDFFFF              call 00470C62

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00470E5F(U)
|
:00470E6D 8BE5                    mov esp, ebp
:00470E6F 5D                      pop ebp
:00470E70 C20800                  ret 0008



:00470E73 2F0E4700                DWORD 00470E2F
:00470E77 240E4700                DWORD 00470E24
:00470E7B 480E4700                DWORD 00470E48
:00470E7F 3A0E4700                DWORD 00470E3A
:00470E83 5F0E4700                DWORD 00470E5F
:00470E87 560E4700                DWORD 00470E56
:00470E8B 2F0E4700                DWORD 00470E2F
:00470E8F 240E4700                DWORD 00470E24


:00470E93 55                      push ebp
:00470E94 8BEC                    mov ebp, esp
:00470E96 83EC3C                  sub esp, 0000003C
:00470E99 56                      push esi
:00470E9A 894DC4                  mov dword ptr [ebp-3C], ecx
:00470E9D 8B45C4                  mov eax, dword ptr [ebp-3C]
:00470EA0 8B4804                  mov ecx, dword ptr [eax+04]
:00470EA3 51                      push ecx

* Possible Reference to Dialog: DialogID_015B 
                                  |
:00470EA4 685B010000              push 0000015B
:00470EA9 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:00470EAC 83C10C                  add ecx, 0000000C
:00470EAF E814C2FFFF              call 0046D0C8
:00470EB4 6A05                    push 00000005
:00470EB6 6A00                    push 00000000
:00470EB8 6A00                    push 00000000
:00470EBA 6A00                    push 00000000
:00470EBC 6A00                    push 00000000
:00470EBE 6A00                    push 00000000
:00470EC0 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:00470EC3 83C10C                  add ecx, 0000000C
:00470EC6 E8A592FAFF              call 0041A170
:00470ECB 50                      push eax
:00470ECC FF1580624800            call dword ptr [00486280]
:00470ED2 8D55F0                  lea edx, dword ptr [ebp-10]
:00470ED5 52                      push edx
:00470ED6 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:00470ED9 83C10C                  add ecx, 0000000C
:00470EDC E88F92FAFF              call 0041A170
:00470EE1 50                      push eax
:00470EE2 FF1598634800            call dword ptr [00486398]
:00470EE8 8D45CC                  lea eax, dword ptr [ebp-34]
:00470EEB 50                      push eax
:00470EEC 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:00470EEF 8B5104                  mov edx, dword ptr [ecx+04]
:00470EF2 52                      push edx
:00470EF3 FF15EC624800            call dword ptr [004862EC]
:00470EF9 8D45E0                  lea eax, dword ptr [ebp-20]
:00470EFC 50                      push eax
:00470EFD 6A02                    push 00000002
:00470EFF 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:00470F02 8B5104                  mov edx, dword ptr [ecx+04]
:00470F05 52                      push edx
:00470F06 FF15DC624800            call dword ptr [004862DC]
:00470F0C 50                      push eax
:00470F0D E8580CFFFF              call 00461B6A
:00470F12 83C408                  add esp, 00000008
:00470F15 8B45F8                  mov eax, dword ptr [ebp-08]
:00470F18 2B45F0                  sub eax, dword ptr [ebp-10]
:00470F1B 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00470F1E 2B4DCC                  sub ecx, dword ptr [ebp-34]
:00470F21 2BC1                    sub eax, ecx
:00470F23 8945DC                  mov dword ptr [ebp-24], eax
:00470F26 8B75FC                  mov esi, dword ptr [ebp-04]
:00470F29 2B75F4                  sub esi, dword ptr [ebp-0C]
:00470F2C FF1514624800            call dword ptr [00486214]
:00470F32 C1E810                  shr eax, 10
:00470F35 25FFFF0000              and eax, 0000FFFF
:00470F3A 25FFFF0000              and eax, 0000FFFF
:00470F3F 99                      cdq
:00470F40 2BC2                    sub eax, edx
:00470F42 D1F8                    sar eax, 1
:00470F44 8B55E4                  mov edx, dword ptr [ebp-1C]
:00470F47 2BD0                    sub edx, eax
:00470F49 2BF2                    sub esi, edx
:00470F4B 8975C8                  mov dword ptr [ebp-38], esi
:00470F4E 6A05                    push 00000005
:00470F50 6A00                    push 00000000
:00470F52 6A00                    push 00000000
:00470F54 8B45E4                  mov eax, dword ptr [ebp-1C]
:00470F57 0345C8                  add eax, dword ptr [ebp-38]
:00470F5A 50                      push eax
:00470F5B 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00470F5E 034DDC                  add ecx, dword ptr [ebp-24]
:00470F61 51                      push ecx
:00470F62 6A00                    push 00000000
:00470F64 6A02                    push 00000002
:00470F66 8B55C4                  mov edx, dword ptr [ebp-3C]
:00470F69 8B4204                  mov eax, dword ptr [edx+04]
:00470F6C 50                      push eax
:00470F6D FF15DC624800            call dword ptr [004862DC]
:00470F73 50                      push eax
:00470F74 FF1580624800            call dword ptr [00486280]
:00470F7A 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00470F7D 51                      push ecx

* Possible Reference to Dialog: DialogID_014D, CONTROL_ID:059D, "Find: 50 / 50"
                                  |
:00470F7E 689D050000              push 0000059D
:00470F83 8B55C4                  mov edx, dword ptr [ebp-3C]
:00470F86 8B4204                  mov eax, dword ptr [edx+04]
:00470F89 50                      push eax
:00470F8A FF15DC624800            call dword ptr [004862DC]
:00470F90 50                      push eax
:00470F91 E8D40BFFFF              call 00461B6A
:00470F96 83C408                  add esp, 00000008
:00470F99 6A05                    push 00000005
:00470F9B 6A00                    push 00000000
:00470F9D 6A00                    push 00000000
:00470F9F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00470FA2 034DC8                  add ecx, dword ptr [ebp-38]
:00470FA5 51                      push ecx
:00470FA6 8B55F0                  mov edx, dword ptr [ebp-10]
:00470FA9 52                      push edx
:00470FAA 6A00                    push 00000000

* Possible Reference to Dialog: DialogID_014D, CONTROL_ID:059D, "Find: 50 / 50"
                                  |
:00470FAC 689D050000              push 0000059D
:00470FB1 8B45C4                  mov eax, dword ptr [ebp-3C]
:00470FB4 8B4804                  mov ecx, dword ptr [eax+04]
:00470FB7 51                      push ecx
:00470FB8 FF15DC624800            call dword ptr [004862DC]
:00470FBE 50                      push eax
:00470FBF FF1580624800            call dword ptr [00486280]
:00470FC5 8D55F0                  lea edx, dword ptr [ebp-10]
:00470FC8 52                      push edx
:00470FC9 8B45C4                  mov eax, dword ptr [ebp-3C]
:00470FCC 8B4804                  mov ecx, dword ptr [eax+04]
:00470FCF 51                      push ecx
:00470FD0 FF1598634800            call dword ptr [00486398]
:00470FD6 8B55F8                  mov edx, dword ptr [ebp-08]
:00470FD9 2B55F0                  sub edx, dword ptr [ebp-10]
:00470FDC 0355DC                  add edx, dword ptr [ebp-24]
:00470FDF 8955F8                  mov dword ptr [ebp-08], edx
:00470FE2 C745F000000000          mov [ebp-10], 00000000
:00470FE9 8B45FC                  mov eax, dword ptr [ebp-04]
:00470FEC 2B45F4                  sub eax, dword ptr [ebp-0C]
:00470FEF 0345C8                  add eax, dword ptr [ebp-38]
:00470FF2 8945FC                  mov dword ptr [ebp-04], eax
:00470FF5 C745F400000000          mov [ebp-0C], 00000000

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:00470FFC 6A06                    push 00000006
:00470FFE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00471001 51                      push ecx
:00471002 8B55F8                  mov edx, dword ptr [ebp-08]
:00471005 52                      push edx
:00471006 6A00                    push 00000000
:00471008 6A00                    push 00000000
:0047100A 6A00                    push 00000000
:0047100C 8B45C4                  mov eax, dword ptr [ebp-3C]
:0047100F 8B4804                  mov ecx, dword ptr [eax+04]
:00471012 51                      push ecx
:00471013 FF1580624800            call dword ptr [00486280]
:00471019 8B15686A4B00            mov edx, dword ptr [004B6A68]
:0047101F 52                      push edx
:00471020 8B45C4                  mov eax, dword ptr [ebp-3C]
:00471023 8B4804                  mov ecx, dword ptr [eax+04]
:00471026 51                      push ecx
:00471027 E87A13FFFF              call 004623A6
:0047102C 83C408                  add esp, 00000008
:0047102F 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:00471032 83C10C                  add ecx, 0000000C
:00471035 E806210000              call 00473140
:0047103A 50                      push eax
:0047103B 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:0047103E 83C10C                  add ecx, 0000000C
:00471041 E8FA170000              call 00472840
:00471046 50                      push eax
:00471047 68C86E4800              push 00486EC8

* Possible Reference to Dialog: DialogID_014D, CONTROL_ID:059D, "Find: 50 / 50"
                                  |
:0047104C 689D050000              push 0000059D
:00471051 8B55C4                  mov edx, dword ptr [ebp-3C]
:00471054 8B4204                  mov eax, dword ptr [edx+04]
:00471057 50                      push eax
:00471058 FF15DC624800            call dword ptr [004862DC]
:0047105E 50                      push eax
:0047105F E8780DFFFF              call 00461DDC
:00471064 83C410                  add esp, 00000010
:00471067 6A05                    push 00000005
:00471069 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:0047106C 83C10C                  add ecx, 0000000C
:0047106F E8FC90FAFF              call 0041A170
:00471074 50                      push eax
:00471075 FF15E0624800            call dword ptr [004862E0]
:0047107B 5E                      pop esi
:0047107C 8BE5                    mov esp, ebp
:0047107E 5D                      pop ebp
:0047107F C3                      ret



* Referenced by a CALL at Address:
|:00474DCF   
|
:00471080 55                      push ebp
:00471081 8BEC                    mov ebp, esp
:00471083 51                      push ecx
:00471084 894DFC                  mov dword ptr [ebp-04], ecx
:00471087 A1686A4B00              mov eax, dword ptr [004B6A68]
:0047108C 50                      push eax

* Possible Reference to Dialog: DialogID_014D 
                                  |
:0047108D 684D010000              push 0000014D
:00471092 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00471095 E8FEBFFFFF              call 0046D098
:0047109A 8BE5                    mov esp, ebp
:0047109C 5D                      pop ebp
:0047109D C3                      ret



* Referenced by a CALL at Addresses:
|:00462A24   , :00463532   , :00463B28   
|
:0047109E 55                      push ebp
:0047109F 8BEC                    mov ebp, esp
:004710A1 8B4518                  mov eax, dword ptr [ebp+18]
:004710A4 50                      push eax
:004710A5 8B4D14                  mov ecx, dword ptr [ebp+14]
:004710A8 51                      push ecx
:004710A9 8B5510                  mov edx, dword ptr [ebp+10]
:004710AC 52                      push edx
:004710AD 6A0F                    push 0000000F
:004710AF FF1564634800            call dword ptr [00486364]
:004710B5 50                      push eax
:004710B6 8B450C                  mov eax, dword ptr [ebp+0C]
:004710B9 50                      push eax
:004710BA 8B4D08                  mov ecx, dword ptr [ebp+08]
:004710BD 51                      push ecx
:004710BE E805000000              call 004710C8
:004710C3 83C418                  add esp, 00000018
:004710C6 5D                      pop ebp
:004710C7 C3                      ret



* Referenced by a CALL at Addresses:
|:004710BE   , :004712D3   , :004716EC   , :00471D65   , :00472063   
|
:004710C8 55                      push ebp
:004710C9 8BEC                    mov ebp, esp
:004710CB 83EC20                  sub esp, 00000020
:004710CE 6A01                    push 00000001
:004710D0 8B4508                  mov eax, dword ptr [ebp+08]
:004710D3 50                      push eax
:004710D4 B9082E4900              mov ecx, 00492E08
:004710D9 E862A4F9FF              call 0040B540
:004710DE 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004710E1 894DEC                  mov dword ptr [ebp-14], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00471109(U)
|
:004710E4 6AF0                    push FFFFFFF0
:004710E6 8B55EC                  mov edx, dword ptr [ebp-14]
:004710E9 52                      push edx
:004710EA FF15A0634800            call dword ptr [004863A0]
:004710F0 2500000040              and eax, 40000000
:004710F5 3D00000040              cmp eax, 40000000
:004710FA 750F                    jne 0047110B
:004710FC 8B45EC                  mov eax, dword ptr [ebp-14]
:004710FF 50                      push eax
:00471100 FF159C634800            call dword ptr [0048639C]
:00471106 8945EC                  mov dword ptr [ebp-14], eax
:00471109 EBD9                    jmp 004710E4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004710FA(C)
|
:0047110B C745E400000000          mov [ebp-1C], 00000000
:00471112 C745E800000000          mov [ebp-18], 00000000
:00471119 837D1C00                cmp dword ptr [ebp+1C], 00000000
:0047111D 751E                    jne 0047113D
:0047111F 8D4DE4                  lea ecx, dword ptr [ebp-1C]
:00471122 51                      push ecx
:00471123 8B550C                  mov edx, dword ptr [ebp+0C]
:00471126 52                      push edx
:00471127 FF1520634800            call dword ptr [00486320]
:0047112D 8D45E4                  lea eax, dword ptr [ebp-1C]
:00471130 50                      push eax
:00471131 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00471134 51                      push ecx
:00471135 FF1564624800            call dword ptr [00486264]
:0047113B EB0E                    jmp 0047114B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047111D(C)
|
:0047113D 8B551C                  mov edx, dword ptr [ebp+1C]
:00471140 8B02                    mov eax, dword ptr [edx]
:00471142 8B4A04                  mov ecx, dword ptr [edx+04]
:00471145 8945E4                  mov dword ptr [ebp-1C], eax
:00471148 894DE8                  mov dword ptr [ebp-18], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047113B(U)
|
:0047114B 837D1400                cmp dword ptr [ebp+14], 00000000
:0047114F 7510                    jne 00471161
:00471151 8D55F0                  lea edx, dword ptr [ebp-10]
:00471154 52                      push edx
:00471155 8B450C                  mov eax, dword ptr [ebp+0C]
:00471158 50                      push eax
:00471159 FF15EC624800            call dword ptr [004862EC]
:0047115F EB1A                    jmp 0047117B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047114F(C)
|
:00471161 8B4D14                  mov ecx, dword ptr [ebp+14]
:00471164 8B11                    mov edx, dword ptr [ecx]
:00471166 8955F0                  mov dword ptr [ebp-10], edx
:00471169 8B4104                  mov eax, dword ptr [ecx+04]
:0047116C 8945F4                  mov dword ptr [ebp-0C], eax
:0047116F 8B5108                  mov edx, dword ptr [ecx+08]
:00471172 8955F8                  mov dword ptr [ebp-08], edx
:00471175 8B410C                  mov eax, dword ptr [ecx+0C]
:00471178 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047115F(U)
|
:0047117B 33C9                    xor ecx, ecx
:0047117D 8A0DA4664B00            mov cl, byte ptr [004B66A4]
:00471183 83E101                  and ecx, 00000001
:00471186 85C9                    test ecx, ecx
:00471188 752A                    jne 004711B4
:0047118A 8A15A4664B00            mov dl, byte ptr [004B66A4]
:00471190 80CA01                  or dl, 01
:00471193 8815A4664B00            mov byte ptr [004B66A4], dl
:00471199 6A05                    push 00000005
:0047119B 6A08                    push 00000008
:0047119D B958604B00              mov ecx, 004B6058
:004711A2 E8DB9AF9FF              call 0040AC82
:004711A7 687C124700              push 0047127C
:004711AC E84FFF0000              call 00481100
:004711B1 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00471188(C)
|
:004711B4 33C0                    xor eax, eax
:004711B6 A0A4664B00              mov al, byte ptr [004B66A4]
:004711BB 83E002                  and eax, 00000002
:004711BE 85C0                    test eax, eax
:004711C0 752A                    jne 004711EC
:004711C2 8A0DA4664B00            mov cl, byte ptr [004B66A4]
:004711C8 80C902                  or cl, 02
:004711CB 880DA4664B00            mov byte ptr [004B66A4], cl
:004711D1 6A01                    push 00000001
:004711D3 6A01                    push 00000001
:004711D5 B998654B00              mov ecx, 004B6598
:004711DA E8A39AF9FF              call 0040AC82
:004711DF 686D124700              push 0047126D
:004711E4 E817FF0000              call 00481100
:004711E9 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004711C0(C)
|
:004711EC 6A0F                    push 0000000F
:004711EE FF1564634800            call dword ptr [00486364]
:004711F4 394510                  cmp dword ptr [ebp+10], eax
:004711F7 7520                    jne 00471219
:004711F9 8B5518                  mov edx, dword ptr [ebp+18]
:004711FC 52                      push edx
:004711FD 8D45E4                  lea eax, dword ptr [ebp-1C]
:00471200 50                      push eax
:00471201 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00471204 51                      push ecx
:00471205 8B5510                  mov edx, dword ptr [ebp+10]
:00471208 52                      push edx
:00471209 8B4508                  mov eax, dword ptr [ebp+08]
:0047120C 50                      push eax
:0047120D B958604B00              mov ecx, 004B6058
:00471212 E8109BF9FF              call 0040AD27
:00471217 EB50                    jmp 00471269

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004711F7(C)
|
:00471219 8B4D18                  mov ecx, dword ptr [ebp+18]
:0047121C 51                      push ecx
:0047121D 8D55E4                  lea edx, dword ptr [ebp-1C]
:00471220 52                      push edx
:00471221 8D45F0                  lea eax, dword ptr [ebp-10]
:00471224 50                      push eax
:00471225 8B4D10                  mov ecx, dword ptr [ebp+10]
:00471228 51                      push ecx
:00471229 8B5508                  mov edx, dword ptr [ebp+08]
:0047122C 52                      push edx
:0047122D B998654B00              mov ecx, 004B6598
:00471232 E8F09AF9FF              call 0040AD27
:00471237 85C0                    test eax, eax
:00471239 7529                    jne 00471264
:0047123B 8B4510                  mov eax, dword ptr [ebp+10]
:0047123E 50                      push eax
:0047123F FF1568604800            call dword ptr [00486068]
:00471245 8945E0                  mov dword ptr [ebp-20], eax
:00471248 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0047124B 51                      push ecx
:0047124C 8D55F0                  lea edx, dword ptr [ebp-10]
:0047124F 52                      push edx
:00471250 8B4508                  mov eax, dword ptr [ebp+08]
:00471253 50                      push eax
:00471254 FF15F0624800            call dword ptr [004862F0]
:0047125A 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0047125D 51                      push ecx
:0047125E FF1548604800            call dword ptr [00486048]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00471239(C)
|
:00471264 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00471217(U)
|
:00471269 8BE5                    mov esp, ebp
:0047126B 5D                      pop ebp
:0047126C C3                      ret


:0047126D 55                      push ebp
:0047126E 8BEC                    mov ebp, esp
:00471270 B998654B00              mov ecx, 004B6598
:00471275 E8429AF9FF              call 0040ACBC
:0047127A 5D                      pop ebp
:0047127B C3                      ret


:0047127C 55                      push ebp
:0047127D 8BEC                    mov ebp, esp
:0047127F B958604B00              mov ecx, 004B6058
:00471284 E8339AF9FF              call 0040ACBC
:00471289 5D                      pop ebp
:0047128A C3                      ret



* Referenced by a CALL at Addresses:
|:0040E323   , :0041BC8A   , :0041C160   , :0045EA5D   , :00464C87   
|:004705EC   , :00476B6F   , :004778A5   , :004783B1   , :004785BD   
|:00479420   
|
:0047128B 55                      push ebp
:0047128C 8BEC                    mov ebp, esp
:0047128E 8B4514                  mov eax, dword ptr [ebp+14]
:00471291 50                      push eax
:00471292 8B4D10                  mov ecx, dword ptr [ebp+10]
:00471295 51                      push ecx
:00471296 6A0F                    push 0000000F
:00471298 FF1564634800            call dword ptr [00486364]
:0047129E 50                      push eax
:0047129F 8B550C                  mov edx, dword ptr [ebp+0C]
:004712A2 52                      push edx
:004712A3 8B4508                  mov eax, dword ptr [ebp+08]
:004712A6 50                      push eax
:004712A7 E805000000              call 004712B1
:004712AC 83C414                  add esp, 00000014
:004712AF 5D                      pop ebp
:004712B0 C3                      ret



* Referenced by a CALL at Address:
|:004712A7   
|
:004712B1 55                      push ebp
:004712B2 8BEC                    mov ebp, esp
:004712B4 83EC08                  sub esp, 00000008
:004712B7 8B450C                  mov eax, dword ptr [ebp+0C]
:004712BA 8945FC                  mov dword ptr [ebp-04], eax
:004712BD 8B4D18                  mov ecx, dword ptr [ebp+18]
:004712C0 51                      push ecx
:004712C1 8B5514                  mov edx, dword ptr [ebp+14]
:004712C4 52                      push edx
:004712C5 6A00                    push 00000000
:004712C7 8B4510                  mov eax, dword ptr [ebp+10]
:004712CA 50                      push eax
:004712CB 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004712CE 51                      push ecx
:004712CF 8B5508                  mov edx, dword ptr [ebp+08]
:004712D2 52                      push edx
:004712D3 E8F0FDFFFF              call 004710C8
:004712D8 83C418                  add esp, 00000018
:004712DB 85C0                    test eax, eax
:004712DD 7429                    je 00471308
:004712DF 6A00                    push 00000000
:004712E1 6A00                    push 00000000
:004712E3 6A00                    push 00000000
:004712E5 6A00                    push 00000000
:004712E7 FF15D0604800            call dword ptr [004860D0]
:004712ED 8945F8                  mov dword ptr [ebp-08], eax
:004712F0 8B45F8                  mov eax, dword ptr [ebp-08]
:004712F3 50                      push eax
:004712F4 8B4D08                  mov ecx, dword ptr [ebp+08]
:004712F7 51                      push ecx
:004712F8 FF1598604800            call dword ptr [00486098]
:004712FE 8B55F8                  mov edx, dword ptr [ebp-08]
:00471301 52                      push edx
:00471302 FF1548604800            call dword ptr [00486048]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004712DD(C)
|
:00471308 8BE5                    mov esp, ebp
:0047130A 5D                      pop ebp
:0047130B C3                      ret



* Referenced by a CALL at Addresses:
|:00464E11   , :0046A4E1   , :0046A679   , :004714A7   
|
:0047130C 55                      push ebp
:0047130D 8BEC                    mov ebp, esp
:0047130F 51                      push ecx
:00471310 6A01                    push 00000001
:00471312 8B4508                  mov eax, dword ptr [ebp+08]
:00471315 50                      push eax
:00471316 FF1594604800            call dword ptr [00486094]
:0047131C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047131F 51                      push ecx
:00471320 FF15B8604800            call dword ptr [004860B8]
:00471326 8945FC                  mov dword ptr [ebp-04], eax
:00471329 837D20FF                cmp dword ptr [ebp+20], FFFFFFFF
:0047132D 0F84A0000000            je 004713D3
:00471333 8B5514                  mov edx, dword ptr [ebp+14]
:00471336 8B4204                  mov eax, dword ptr [edx+04]
:00471339 83C001                  add eax, 00000001
:0047133C 8B4D14                  mov ecx, dword ptr [ebp+14]
:0047133F 894104                  mov dword ptr [ecx+04], eax
:00471342 8B5514                  mov edx, dword ptr [ebp+14]
:00471345 8B420C                  mov eax, dword ptr [edx+0C]
:00471348 83C001                  add eax, 00000001
:0047134B 8B4D14                  mov ecx, dword ptr [ebp+14]
:0047134E 89410C                  mov dword ptr [ecx+0C], eax
:00471351 8B5514                  mov edx, dword ptr [ebp+14]
:00471354 8B4208                  mov eax, dword ptr [edx+08]
:00471357 83C001                  add eax, 00000001
:0047135A 8B4D14                  mov ecx, dword ptr [ebp+14]
:0047135D 894108                  mov dword ptr [ecx+08], eax
:00471360 8B5514                  mov edx, dword ptr [ebp+14]
:00471363 8B02                    mov eax, dword ptr [edx]
:00471365 83C001                  add eax, 00000001
:00471368 8B4D14                  mov ecx, dword ptr [ebp+14]
:0047136B 8901                    mov dword ptr [ecx], eax
:0047136D 8B5520                  mov edx, dword ptr [ebp+20]
:00471370 52                      push edx
:00471371 8B4508                  mov eax, dword ptr [ebp+08]
:00471374 50                      push eax
:00471375 FF1584604800            call dword ptr [00486084]
:0047137B 8B4D24                  mov ecx, dword ptr [ebp+24]
:0047137E 51                      push ecx
:0047137F 8B5518                  mov edx, dword ptr [ebp+18]
:00471382 52                      push edx
:00471383 8B4514                  mov eax, dword ptr [ebp+14]
:00471386 50                      push eax
:00471387 8B4D10                  mov ecx, dword ptr [ebp+10]
:0047138A 51                      push ecx
:0047138B 8B550C                  mov edx, dword ptr [ebp+0C]
:0047138E 52                      push edx
:0047138F 8B4508                  mov eax, dword ptr [ebp+08]
:00471392 50                      push eax
:00471393 FF151C624800            call dword ptr [0048621C]
:00471399 8B4D14                  mov ecx, dword ptr [ebp+14]
:0047139C 8B5104                  mov edx, dword ptr [ecx+04]
:0047139F 83EA01                  sub edx, 00000001
:004713A2 8B4514                  mov eax, dword ptr [ebp+14]
:004713A5 895004                  mov dword ptr [eax+04], edx
:004713A8 8B4D14                  mov ecx, dword ptr [ebp+14]
:004713AB 8B510C                  mov edx, dword ptr [ecx+0C]
:004713AE 83EA01                  sub edx, 00000001
:004713B1 8B4514                  mov eax, dword ptr [ebp+14]
:004713B4 89500C                  mov dword ptr [eax+0C], edx
:004713B7 8B4D14                  mov ecx, dword ptr [ebp+14]
:004713BA 8B5108                  mov edx, dword ptr [ecx+08]
:004713BD 83EA01                  sub edx, 00000001
:004713C0 8B4514                  mov eax, dword ptr [ebp+14]
:004713C3 895008                  mov dword ptr [eax+08], edx
:004713C6 8B4D14                  mov ecx, dword ptr [ebp+14]
:004713C9 8B11                    mov edx, dword ptr [ecx]
:004713CB 83EA01                  sub edx, 00000001
:004713CE 8B4514                  mov eax, dword ptr [ebp+14]
:004713D1 8910                    mov dword ptr [eax], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047132D(C)
|
:004713D3 8B4D1C                  mov ecx, dword ptr [ebp+1C]
:004713D6 51                      push ecx
:004713D7 8B5508                  mov edx, dword ptr [ebp+08]
:004713DA 52                      push edx
:004713DB FF1584604800            call dword ptr [00486084]
:004713E1 8B4524                  mov eax, dword ptr [ebp+24]
:004713E4 50                      push eax
:004713E5 8B4D18                  mov ecx, dword ptr [ebp+18]
:004713E8 51                      push ecx
:004713E9 8B5514                  mov edx, dword ptr [ebp+14]
:004713EC 52                      push edx
:004713ED 8B4510                  mov eax, dword ptr [ebp+10]
:004713F0 50                      push eax
:004713F1 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004713F4 51                      push ecx
:004713F5 8B5508                  mov edx, dword ptr [ebp+08]
:004713F8 52                      push edx
:004713F9 FF151C624800            call dword ptr [0048621C]
:004713FF 8B45FC                  mov eax, dword ptr [ebp-04]
:00471402 50                      push eax
:00471403 8B4D08                  mov ecx, dword ptr [ebp+08]
:00471406 51                      push ecx
:00471407 FF1584604800            call dword ptr [00486084]
:0047140D 8BE5                    mov esp, ebp
:0047140F 5D                      pop ebp
:00471410 C3                      ret



* Referenced by a CALL at Addresses:
|:00463B65   , :00463B96   , :0047157F   , :00472236   , :0047226C   
|
:00471411 55                      push ebp
:00471412 8BEC                    mov ebp, esp
:00471414 83EC14                  sub esp, 00000014

* Possible StringData Ref from Data Obj ->""
                                  |
:00471417 68B4E74800              push 0048E7B4
:0047141C 6A00                    push 00000000
:0047141E 6A00                    push 00000000
:00471420 6A00                    push 00000000
:00471422 6A04                    push 00000004
:00471424 6886000000              push 00000086
:00471429 6A00                    push 00000000
:0047142B 6A00                    push 00000000
:0047142D 6A00                    push 00000000
:0047142F 6890010000              push 00000190
:00471434 6A00                    push 00000000
:00471436 6A00                    push 00000000
:00471438 6A00                    push 00000000
:0047143A 6A48                    push 00000048
:0047143C 6A5A                    push 0000005A
:0047143E 8B4508                  mov eax, dword ptr [ebp+08]
:00471441 50                      push eax
:00471442 FF153C604800            call dword ptr [0048603C]
:00471448 50                      push eax
:00471449 6A09                    push 00000009
:0047144B FF15E8604800            call dword ptr [004860E8]
:00471451 6BC0FF                  imul eax, FFFFFFFF
:00471454 50                      push eax
:00471455 FF1588604800            call dword ptr [00486088]
:0047145B 8945F8                  mov dword ptr [ebp-08], eax
:0047145E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00471461 51                      push ecx
:00471462 8B5508                  mov edx, dword ptr [ebp+08]
:00471465 52                      push edx
:00471466 FF156C604800            call dword ptr [0048606C]
:0047146C 8945EC                  mov dword ptr [ebp-14], eax
:0047146F C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00471476 837D2400                cmp dword ptr [ebp+24], 00000000
:0047147A 740B                    je 00471487
:0047147C 6A14                    push 00000014
:0047147E FF1564634800            call dword ptr [00486364]
:00471484 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047147A(C)
|
:00471487 8B4520                  mov eax, dword ptr [ebp+20]
:0047148A 50                      push eax
:0047148B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047148E 51                      push ecx
:0047148F 8B5518                  mov edx, dword ptr [ebp+18]
:00471492 52                      push edx
:00471493 8B4514                  mov eax, dword ptr [ebp+14]
:00471496 50                      push eax
:00471497 8B4D1C                  mov ecx, dword ptr [ebp+1C]
:0047149A 51                      push ecx
:0047149B 8B5510                  mov edx, dword ptr [ebp+10]
:0047149E 52                      push edx
:0047149F 8B450C                  mov eax, dword ptr [ebp+0C]
:004714A2 50                      push eax
:004714A3 8B4D08                  mov ecx, dword ptr [ebp+08]
:004714A6 51                      push ecx
:004714A7 E860FEFFFF              call 0047130C
:004714AC 83C420                  add esp, 00000020
:004714AF 8D55F0                  lea edx, dword ptr [ebp-10]
:004714B2 52                      push edx
:004714B3 8B4510                  mov eax, dword ptr [ebp+10]
:004714B6 50                      push eax
:004714B7 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004714BA 51                      push ecx
:004714BB 8B5508                  mov edx, dword ptr [ebp+08]
:004714BE 52                      push edx
:004714BF FF1590604800            call dword ptr [00486090]
:004714C5 8B45EC                  mov eax, dword ptr [ebp-14]
:004714C8 50                      push eax
:004714C9 8B4D08                  mov ecx, dword ptr [ebp+08]
:004714CC 51                      push ecx
:004714CD FF156C604800            call dword ptr [0048606C]
:004714D3 8B55F8                  mov edx, dword ptr [ebp-08]
:004714D6 52                      push edx
:004714D7 FF1548604800            call dword ptr [00486048]
:004714DD 8B45F0                  mov eax, dword ptr [ebp-10]
:004714E0 8BE5                    mov esp, ebp
:004714E2 5D                      pop ebp
:004714E3 C3                      ret



* Referenced by a CALL at Addresses:
|:004718CE   , :004718EE   , :00471EAB   , :00471ED0   
|
:004714E4 55                      push ebp
:004714E5 8BEC                    mov ebp, esp
:004714E7 81EC14010000            sub esp, 00000114
:004714ED 837D1800                cmp dword ptr [ebp+18], 00000000
:004714F1 7510                    jne 00471503
:004714F3 8D45F0                  lea eax, dword ptr [ebp-10]
:004714F6 50                      push eax
:004714F7 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004714FA 51                      push ecx
:004714FB FF15EC624800            call dword ptr [004862EC]
:00471501 EB1A                    jmp 0047151D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004714F1(C)
|
:00471503 8B5518                  mov edx, dword ptr [ebp+18]
:00471506 8B02                    mov eax, dword ptr [edx]
:00471508 8945F0                  mov dword ptr [ebp-10], eax
:0047150B 8B4A04                  mov ecx, dword ptr [edx+04]
:0047150E 894DF4                  mov dword ptr [ebp-0C], ecx
:00471511 8B4208                  mov eax, dword ptr [edx+08]
:00471514 8945F8                  mov dword ptr [ebp-08], eax
:00471517 8B4A0C                  mov ecx, dword ptr [edx+0C]
:0047151A 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00471501(U)
|
:0047151D 6800010000              push 00000100
:00471522 8D95F0FEFFFF            lea edx, dword ptr [ebp+FFFFFEF0]
:00471528 52                      push edx
:00471529 8B450C                  mov eax, dword ptr [ebp+0C]
:0047152C 50                      push eax
:0047152D FF15B4634800            call dword ptr [004863B4]
:00471533 8985ECFEFFFF            mov dword ptr [ebp+FFFFFEEC], eax
:00471539 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0047153C 51                      push ecx
:0047153D FF1534634800            call dword ptr [00486334]
:00471543 85C0                    test eax, eax
:00471545 7512                    jne 00471559
:00471547 6A10                    push 00000010
:00471549 FF1564634800            call dword ptr [00486364]
:0047154F 894514                  mov dword ptr [ebp+14], eax
:00471552 C7452001000000          mov [ebp+20], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00471545(C)
|
:00471559 8B5520                  mov edx, dword ptr [ebp+20]
:0047155C 52                      push edx
:0047155D 8B451C                  mov eax, dword ptr [ebp+1C]
:00471560 50                      push eax
:00471561 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00471564 51                      push ecx
:00471565 8B5514                  mov edx, dword ptr [ebp+14]
:00471568 52                      push edx
:00471569 8B4510                  mov eax, dword ptr [ebp+10]
:0047156C 50                      push eax
:0047156D 8B8DECFEFFFF            mov ecx, dword ptr [ebp+FFFFFEEC]
:00471573 51                      push ecx
:00471574 8D95F0FEFFFF            lea edx, dword ptr [ebp+FFFFFEF0]
:0047157A 52                      push edx
:0047157B 8B4508                  mov eax, dword ptr [ebp+08]
:0047157E 50                      push eax
:0047157F E88DFEFFFF              call 00471411
:00471584 83C420                  add esp, 00000020
:00471587 8BE5                    mov esp, ebp
:00471589 5D                      pop ebp
:0047158A C3                      ret



* Referenced by a CALL at Addresses:
|:0040E353   , :0041BBCC   , :0041C12C   , :0045EA1C   , :00464C53   
|:00470656   , :00476B33   , :00477665   , :0047839B   , :004785A7   
|:004793C6   
|
:0047158B 55                      push ebp
:0047158C 8BEC                    mov ebp, esp
:0047158E 8B4514                  mov eax, dword ptr [ebp+14]
:00471591 50                      push eax
:00471592 8B4D10                  mov ecx, dword ptr [ebp+10]
:00471595 51                      push ecx
:00471596 6A08                    push 00000008
:00471598 FF1564634800            call dword ptr [00486364]
:0047159E 50                      push eax
:0047159F 6A0F                    push 0000000F
:004715A1 FF1564634800            call dword ptr [00486364]
:004715A7 50                      push eax
:004715A8 8B550C                  mov edx, dword ptr [ebp+0C]
:004715AB 52                      push edx
:004715AC 8B4508                  mov eax, dword ptr [ebp+08]
:004715AF 50                      push eax
:004715B0 E805000000              call 004715BA
:004715B5 83C418                  add esp, 00000018
:004715B8 5D                      pop ebp
:004715B9 C3                      ret



* Referenced by a CALL at Addresses:
|:0046BE1D   , :004715B0   , :0047764F   
|
:004715BA 55                      push ebp
:004715BB 8BEC                    mov ebp, esp
:004715BD 83EC70                  sub esp, 00000070
:004715C0 6AF0                    push FFFFFFF0
:004715C2 8B450C                  mov eax, dword ptr [ebp+0C]
:004715C5 50                      push eax
:004715C6 FF15A0634800            call dword ptr [004863A0]
:004715CC 8945FC                  mov dword ptr [ebp-04], eax
:004715CF 6A08                    push 00000008
:004715D1 8D4DF0                  lea ecx, dword ptr [ebp-10]
:004715D4 51                      push ecx
:004715D5 8B550C                  mov edx, dword ptr [ebp+0C]
:004715D8 52                      push edx
:004715D9 FF15BC634800            call dword ptr [004863BC]

* Possible StringData Ref from Data Obj ->"BUTTON"
                                  |
:004715DF 68BCE74800              push 0048E7BC
:004715E4 8D45F0                  lea eax, dword ptr [ebp-10]
:004715E7 50                      push eax
:004715E8 E863010100              call 00481750
:004715ED 83C408                  add esp, 00000008
:004715F0 85C0                    test eax, eax
:004715F2 7527                    jne 0047161B
:004715F4 8B4D1C                  mov ecx, dword ptr [ebp+1C]
:004715F7 51                      push ecx
:004715F8 6A00                    push 00000000
:004715FA 8B5518                  mov edx, dword ptr [ebp+18]
:004715FD 52                      push edx
:004715FE 8B4514                  mov eax, dword ptr [ebp+14]
:00471601 50                      push eax
:00471602 8B4D10                  mov ecx, dword ptr [ebp+10]
:00471605 51                      push ecx
:00471606 8B550C                  mov edx, dword ptr [ebp+0C]
:00471609 52                      push edx
:0047160A 8B4508                  mov eax, dword ptr [ebp+08]
:0047160D 50                      push eax
:0047160E E8A1030000              call 004719B4
:00471613 83C41C                  add esp, 0000001C
:00471616 E904030000              jmp 0047191F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004715F2(C)
|

* Possible StringData Ref from Data Obj ->"STATIC"
                                  |
:0047161B 68C4E74800              push 0048E7C4
:00471620 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00471623 51                      push ecx
:00471624 E827010100              call 00481750
:00471629 83C408                  add esp, 00000008
:0047162C 85C0                    test eax, eax
:0047162E 7405                    je 00471635
:00471630 E9EA020000              jmp 0047191F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047162E(C)
|
:00471635 C745F800000000          mov [ebp-08], 00000000
:0047163C 8B550C                  mov edx, dword ptr [ebp+0C]
:0047163F 52                      push edx
:00471640 FF1534634800            call dword ptr [00486334]
:00471646 85C0                    test eax, eax
:00471648 7507                    jne 00471651
:0047164A C745F801000000          mov [ebp-08], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00471648(C)
|
:00471651 8B45FC                  mov eax, dword ptr [ebp-04]
:00471654 83E01F                  and eax, 0000001F
:00471657 89459C                  mov dword ptr [ebp-64], eax
:0047165A 8B4D9C                  mov ecx, dword ptr [ebp-64]
:0047165D 83E907                  sub ecx, 00000007
:00471660 894D9C                  mov dword ptr [ebp-64], ecx
:00471663 837D9C0B                cmp dword ptr [ebp-64], 0000000B
:00471667 775B                    ja 004716C4
:00471669 8B459C                  mov eax, dword ptr [ebp-64]
:0047166C 33D2                    xor edx, edx
:0047166E 8A9037194700            mov dl, byte ptr [eax+00471937]
:00471674 FF249523194700          jmp dword ptr [4*edx+00471923]
:0047167B C745F800000000          mov [ebp-08], 00000000
:00471682 EB47                    jmp 004716CB
:00471684 6A00                    push 00000000
:00471686 6A00                    push 00000000
:00471688 6873010000              push 00000173
:0047168D 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00471690 51                      push ecx
:00471691 FF15F4624800            call dword ptr [004862F4]
:00471697 85C0                    test eax, eax
:00471699 7507                    jne 004716A2
:0047169B C745F801000000          mov [ebp-08], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00471699(C)
|
:004716A2 EB27                    jmp 004716CB
:004716A4 6A00                    push 00000000
:004716A6 6A03                    push 00000003
:004716A8 6873010000              push 00000173
:004716AD 8B550C                  mov edx, dword ptr [ebp+0C]
:004716B0 52                      push edx
:004716B1 FF15F4624800            call dword ptr [004862F4]
:004716B7 85C0                    test eax, eax
:004716B9 7507                    jne 004716C2
:004716BB C745F801000000          mov [ebp-08], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004716B9(C)
|
:004716C2 EB07                    jmp 004716CB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00471667(C)
|
:004716C4 C745F801000000          mov [ebp-08], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00471682(U), :004716A2(U), :004716C2(U)
|
:004716CB 837DF800                cmp dword ptr [ebp-08], 00000000
:004716CF 7505                    jne 004716D6
:004716D1 E949020000              jmp 0047191F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004716CF(C)
|
:004716D6 8B451C                  mov eax, dword ptr [ebp+1C]
:004716D9 50                      push eax
:004716DA 8B4D18                  mov ecx, dword ptr [ebp+18]
:004716DD 51                      push ecx
:004716DE 6A00                    push 00000000
:004716E0 8B5510                  mov edx, dword ptr [ebp+10]
:004716E3 52                      push edx
:004716E4 8B450C                  mov eax, dword ptr [ebp+0C]
:004716E7 50                      push eax
:004716E8 8B4D08                  mov ecx, dword ptr [ebp+08]
:004716EB 51                      push ecx
:004716EC E8D7F9FFFF              call 004710C8
:004716F1 83C418                  add esp, 00000018
:004716F4 85C0                    test eax, eax
:004716F6 7505                    jne 004716FD
:004716F8 E922020000              jmp 0047191F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004716F6(C)
|
:004716FD 8B55FC                  mov edx, dword ptr [ebp-04]
:00471700 83E21F                  and edx, 0000001F
:00471703 895598                  mov dword ptr [ebp-68], edx
:00471706 8B4598                  mov eax, dword ptr [ebp-68]
:00471709 83E803                  sub eax, 00000003
:0047170C 894598                  mov dword ptr [ebp-68], eax
:0047170F 837D980C                cmp dword ptr [ebp-68], 0000000C
:00471713 0F8738010000            ja 00471851
:00471719 8B5598                  mov edx, dword ptr [ebp-68]
:0047171C 33C9                    xor ecx, ecx
:0047171E 8A8A53194700            mov cl, byte ptr [edx+00471953]
:00471724 FF248D43194700          jmp dword ptr [4*ecx+00471943]
:0047172B 6A00                    push 00000000
:0047172D 6A01                    push 00000001
:0047172F 6873010000              push 00000173
:00471734 8B450C                  mov eax, dword ptr [ebp+0C]
:00471737 50                      push eax
:00471738 FF15F4624800            call dword ptr [004862F4]
:0047173E 8945D8                  mov dword ptr [ebp-28], eax
:00471741 8D4DDC                  lea ecx, dword ptr [ebp-24]
:00471744 51                      push ecx
:00471745 8B550C                  mov edx, dword ptr [ebp+0C]
:00471748 52                      push edx
:00471749 FF15EC624800            call dword ptr [004862EC]
:0047174F 8D45A4                  lea eax, dword ptr [ebp-5C]
:00471752 50                      push eax
:00471753 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00471756 51                      push ecx
:00471757 FF1524624800            call dword ptr [00486224]
:0047175D 8D55B8                  lea edx, dword ptr [ebp-48]
:00471760 52                      push edx
:00471761 6A18                    push 00000018
:00471763 8B45B4                  mov eax, dword ptr [ebp-4C]
:00471766 50                      push eax
:00471767 FF15BC604800            call dword ptr [004860BC]
:0047176D 8B4DB0                  mov ecx, dword ptr [ebp-50]
:00471770 51                      push ecx
:00471771 FF1548604800            call dword ptr [00486048]
:00471777 8B55B4                  mov edx, dword ptr [ebp-4C]
:0047177A 52                      push edx
:0047177B FF1548604800            call dword ptr [00486048]
:00471781 C745D400000000          mov [ebp-2C], 00000000
:00471788 C745D000000000          mov [ebp-30], 00000000
:0047178F 8B45FC                  mov eax, dword ptr [ebp-04]
:00471792 2500060000              and eax, 00000600
:00471797 894594                  mov dword ptr [ebp-6C], eax
:0047179A 817D9400020000          cmp dword ptr [ebp-6C], 00000200
:004717A1 740B                    je 004717AE
:004717A3 817D9400040000          cmp dword ptr [ebp-6C], 00000400
:004717AA 7426                    je 004717D2
:004717AC EB36                    jmp 004717E4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004717A1(C)
|
:004717AE 8B45E4                  mov eax, dword ptr [ebp-1C]
:004717B1 2B45DC                  sub eax, dword ptr [ebp-24]
:004717B4 2B45BC                  sub eax, dword ptr [ebp-44]
:004717B7 99                      cdq
:004717B8 2BC2                    sub eax, edx
:004717BA D1F8                    sar eax, 1
:004717BC 8945D4                  mov dword ptr [ebp-2C], eax
:004717BF 8B45E8                  mov eax, dword ptr [ebp-18]
:004717C2 2B45E0                  sub eax, dword ptr [ebp-20]
:004717C5 2B45C0                  sub eax, dword ptr [ebp-40]
:004717C8 99                      cdq
:004717C9 2BC2                    sub eax, edx
:004717CB D1F8                    sar eax, 1
:004717CD 8945D0                  mov dword ptr [ebp-30], eax
:004717D0 EB12                    jmp 004717E4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004717AA(C)
|
:004717D2 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004717D5 2B4DBC                  sub ecx, dword ptr [ebp-44]
:004717D8 894DD4                  mov dword ptr [ebp-2C], ecx
:004717DB 8B55E8                  mov edx, dword ptr [ebp-18]
:004717DE 2B55C0                  sub edx, dword ptr [ebp-40]
:004717E1 8955D0                  mov dword ptr [ebp-30], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004717AC(U), :004717D0(U)
|
:004717E4 8B450C                  mov eax, dword ptr [ebp+0C]
:004717E7 50                      push eax
:004717E8 FF1534634800            call dword ptr [00486334]
:004717EE 85C0                    test eax, eax
:004717F0 753F                    jne 00471831
:004717F2 8B4DB0                  mov ecx, dword ptr [ebp-50]
:004717F5 51                      push ecx
:004717F6 FF1548604800            call dword ptr [00486048]
:004717FC 8B55B4                  mov edx, dword ptr [ebp-4C]
:004717FF 52                      push edx
:00471800 FF1548604800            call dword ptr [00486048]
:00471806 6A23                    push 00000023
:00471808 8B45C0                  mov eax, dword ptr [ebp-40]
:0047180B 50                      push eax
:0047180C 8B4DBC                  mov ecx, dword ptr [ebp-44]
:0047180F 51                      push ecx
:00471810 8B55D0                  mov edx, dword ptr [ebp-30]
:00471813 52                      push edx
:00471814 8B45D4                  mov eax, dword ptr [ebp-2C]
:00471817 50                      push eax
:00471818 6A00                    push 00000000
:0047181A 8B4DD8                  mov ecx, dword ptr [ebp-28]
:0047181D 51                      push ecx
:0047181E 6A00                    push 00000000
:00471820 6A00                    push 00000000
:00471822 8B5508                  mov edx, dword ptr [ebp+08]
:00471825 52                      push edx
:00471826 FF1538634800            call dword ptr [00486338]
:0047182C E9C5000000              jmp 004718F6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004717F0(C)
|
:00471831 8B45D8                  mov eax, dword ptr [ebp-28]
:00471834 50                      push eax
:00471835 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00471838 51                      push ecx
:00471839 8B55D4                  mov edx, dword ptr [ebp-2C]
:0047183C 52                      push edx
:0047183D 8B4508                  mov eax, dword ptr [ebp+08]
:00471840 50                      push eax
:00471841 FF1520624800            call dword ptr [00486220]
:00471847 E9AA000000              jmp 004718F6
:0047184C E9A5000000              jmp 004718F6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00471713(C)
|
:00471851 C745A000000000          mov [ebp-60], 00000000
:00471858 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047185B 83E10F                  and ecx, 0000000F
:0047185E 894D90                  mov dword ptr [ebp-70], ecx
:00471861 837D900C                cmp dword ptr [ebp-70], 0000000C
:00471865 7734                    ja 0047189B
:00471867 8B4590                  mov eax, dword ptr [ebp-70]
:0047186A 33D2                    xor edx, edx
:0047186C 8A9074194700            mov dl, byte ptr [eax+00471974]
:00471872 FF249560194700          jmp dword ptr [4*edx+00471960]
:00471879 C745A011000000          mov [ebp-60], 00000011
:00471880 EB19                    jmp 0047189B
:00471882 C745A010000000          mov [ebp-60], 00000010
:00471889 EB10                    jmp 0047189B
:0047188B C745A000000000          mov [ebp-60], 00000000
:00471892 EB07                    jmp 0047189B
:00471894 C745A012000000          mov [ebp-60], 00000012

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00471865(C), :00471880(U), :00471889(U), :00471892(U)
|
:0047189B B9202E4900              mov ecx, 00492E20
:004718A0 E81398F9FF              call 0040B0B8
:004718A5 85C0                    test eax, eax
:004718A7 742F                    je 004718D8
:004718A9 6A0F                    push 0000000F
:004718AB FF1564634800            call dword ptr [00486364]
:004718B1 33C9                    xor ecx, ecx
:004718B3 394510                  cmp dword ptr [ebp+10], eax
:004718B6 0F94C1                  sete cl
:004718B9 51                      push ecx
:004718BA 6A00                    push 00000000
:004718BC 6A00                    push 00000000
:004718BE 8B5514                  mov edx, dword ptr [ebp+14]
:004718C1 52                      push edx
:004718C2 8B45A0                  mov eax, dword ptr [ebp-60]
:004718C5 50                      push eax
:004718C6 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004718C9 51                      push ecx
:004718CA 8B5508                  mov edx, dword ptr [ebp+08]
:004718CD 52                      push edx
:004718CE E811FCFFFF              call 004714E4
:004718D3 83C41C                  add esp, 0000001C
:004718D6 EB1E                    jmp 004718F6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004718A7(C)
|
:004718D8 6A00                    push 00000000
:004718DA 6A00                    push 00000000
:004718DC 6A00                    push 00000000
:004718DE 8B4514                  mov eax, dword ptr [ebp+14]
:004718E1 50                      push eax
:004718E2 8B4DA0                  mov ecx, dword ptr [ebp-60]
:004718E5 51                      push ecx
:004718E6 8B550C                  mov edx, dword ptr [ebp+0C]
:004718E9 52                      push edx
:004718EA 8B4508                  mov eax, dword ptr [ebp+08]
:004718ED 50                      push eax
:004718EE E8F1FBFFFF              call 004714E4
:004718F3 83C41C                  add esp, 0000001C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047182C(U), :00471847(U), :0047184C(U), :004718D6(U)
|
:004718F6 6A00                    push 00000000
:004718F8 6A00                    push 00000000
:004718FA 6A00                    push 00000000
:004718FC 6A00                    push 00000000
:004718FE FF15D0604800            call dword ptr [004860D0]
:00471904 8945EC                  mov dword ptr [ebp-14], eax
:00471907 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0047190A 51                      push ecx
:0047190B 8B5508                  mov edx, dword ptr [ebp+08]
:0047190E 52                      push edx
:0047190F FF1598604800            call dword ptr [00486098]
:00471915 8B45EC                  mov eax, dword ptr [ebp-14]
:00471918 50                      push eax
:00471919 FF1548604800            call dword ptr [00486048]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00471616(U), :00471630(U), :004716D1(U), :004716F8(U)
|
:0047191F 8BE5                    mov esp, ebp
:00471921 5D                      pop ebp
:00471922 C3                      ret



:00471923 7B164700                DWORD 0047167B
:00471927 84164700                DWORD 00471684
:0047192B A4164700                DWORD 004716A4
:0047192F 7B164700                DWORD 0047167B
:00471933 C4164700                DWORD 004716C4


:00471937 000000                  BYTE  3 DUP(0)


:0047193A 0404                    add al, 04
:0047193C 0404                    add al, 04
:0047193E 0102                    add dword ptr [edx], eax
:00471940 0404                    add al, 04
:00471942 032B                    add ebp, dword ptr [ebx]
:00471944 17                      pop ss
:00471945 47                      inc edi
:00471946 004C1847                add byte ptr [eax+ebx+47], cl
:0047194A 004C1847                add byte ptr [eax+ebx+47], cl
:0047194E 005118                  add byte ptr [ecx+18], dl
:00471951 47                      inc edi
:00471952 0000                    add byte ptr [eax], al
:00471954 0101                    add dword ptr [ecx], eax
:00471956 0103                    add dword ptr [ebx], eax
:00471958 0303                    add eax, dword ptr [ebx]
:0047195A 0303                    add eax, dword ptr [ebx]
:0047195C 0303                    add eax, dword ptr [ebx]
:0047195E 0202                    add al, byte ptr [edx]

:00471960 82184700                DWORD 00471882
:00471964 79184700                DWORD 00471879
:00471968 94184700                DWORD 00471894
:0047196C 8B184700                DWORD 0047188B
:00471970 9B184700                DWORD 0047189B


:00471974 0001                    add byte ptr [ecx], al
:00471976 020404                  add al, byte ptr [esp+eax]
:00471979 0404                    add al, 04
:0047197B 0404                    add al, 04
:0047197D 0404                    add al, 04
:0047197F 0403                    add al, 03

* Referenced by a CALL at Addresses:
|:0040E385   , :004196A5   , :00419AC1   , :00419BDE   , :00419CFB   
|:0041BC2C   , :0041C147   , :0045BD84   , :0045BDB5   , :0045EA47   
|:00464C6E   , :00479407   
|
:00471981 55                      push ebp
:00471982 8BEC                    mov ebp, esp
:00471984 8B4518                  mov eax, dword ptr [ebp+18]
:00471987 50                      push eax
:00471988 8B4D14                  mov ecx, dword ptr [ebp+14]
:0047198B 51                      push ecx
:0047198C 8B5510                  mov edx, dword ptr [ebp+10]
:0047198F 52                      push edx
:00471990 6A08                    push 00000008
:00471992 FF1564634800            call dword ptr [00486364]
:00471998 50                      push eax
:00471999 6A0F                    push 0000000F
:0047199B FF1564634800            call dword ptr [00486364]
:004719A1 50                      push eax
:004719A2 8B450C                  mov eax, dword ptr [ebp+0C]
:004719A5 50                      push eax
:004719A6 8B4D08                  mov ecx, dword ptr [ebp+08]
:004719A9 51                      push ecx
:004719AA E805000000              call 004719B4
:004719AF 83C41C                  add esp, 0000001C
:004719B2 5D                      pop ebp
:004719B3 C3                      ret



* Referenced by a CALL at Addresses:
|:0047160E   , :004719AA   
|
:004719B4 55                      push ebp
:004719B5 8BEC                    mov ebp, esp
:004719B7 83EC68                  sub esp, 00000068
:004719BA 6AF0                    push FFFFFFF0
:004719BC 8B450C                  mov eax, dword ptr [ebp+0C]
:004719BF 50                      push eax
:004719C0 FF15A0634800            call dword ptr [004863A0]
:004719C6 8945F8                  mov dword ptr [ebp-08], eax
:004719C9 C745B400000000          mov [ebp-4C], 00000000
:004719D0 C745B800000000          mov [ebp-48], 00000000
:004719D7 C745BC00000000          mov [ebp-44], 00000000
:004719DE C745C000000000          mov [ebp-40], 00000000
:004719E5 C745C400000000          mov [ebp-3C], 00000000
:004719EC C745C800000000          mov [ebp-38], 00000000
:004719F3 C745CC00000000          mov [ebp-34], 00000000
:004719FA C745D000000000          mov [ebp-30], 00000000
:00471A01 8D4DE4                  lea ecx, dword ptr [ebp-1C]
:00471A04 51                      push ecx
:00471A05 8B550C                  mov edx, dword ptr [ebp+0C]
:00471A08 52                      push edx
:00471A09 FF15EC624800            call dword ptr [004862EC]
:00471A0F 8B45E4                  mov eax, dword ptr [ebp-1C]
:00471A12 8945D4                  mov dword ptr [ebp-2C], eax
:00471A15 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00471A18 894DD8                  mov dword ptr [ebp-28], ecx
:00471A1B 8B55EC                  mov edx, dword ptr [ebp-14]
:00471A1E 8955DC                  mov dword ptr [ebp-24], edx
:00471A21 8B45F0                  mov eax, dword ptr [ebp-10]
:00471A24 8945E0                  mov dword ptr [ebp-20], eax
:00471A27 C745F400000000          mov [ebp-0C], 00000000
:00471A2E 6A00                    push 00000000
:00471A30 6A00                    push 00000000

* Possible Reference to Dialog: DialogID_00F2 
                                  |
:00471A32 68F2000000              push 000000F2
:00471A37 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00471A3A 51                      push ecx
:00471A3B FF15F4624800            call dword ptr [004862F4]
:00471A41 83E004                  and eax, 00000004
:00471A44 33D2                    xor edx, edx
:00471A46 83F804                  cmp eax, 00000004
:00471A49 0F94C2                  sete dl
:00471A4C 8955AC                  mov dword ptr [ebp-54], edx
:00471A4F 8B45F8                  mov eax, dword ptr [ebp-08]
:00471A52 83E00F                  and eax, 0000000F
:00471A55 8945A4                  mov dword ptr [ebp-5C], eax
:00471A58 837DA409                cmp dword ptr [ebp-5C], 00000009
:00471A5C 0F87D0020000            ja 00471D32
:00471A62 8B4DA4                  mov ecx, dword ptr [ebp-5C]
:00471A65 FF248DB61F4700          jmp dword ptr [4*ecx+00471FB6]
:00471A6C 8B55F8                  mov edx, dword ptr [ebp-08]
:00471A6F 83E220                  and edx, 00000020
:00471A72 83FA20                  cmp edx, 00000020
:00471A75 751A                    jne 00471A91
:00471A77 8B45DC                  mov eax, dword ptr [ebp-24]
:00471A7A 83E80D                  sub eax, 0000000D
:00471A7D 8945B4                  mov dword ptr [ebp-4C], eax
:00471A80 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00471A83 894DBC                  mov dword ptr [ebp-44], ecx
:00471A86 8B55B4                  mov edx, dword ptr [ebp-4C]
:00471A89 83EA05                  sub edx, 00000005
:00471A8C 8955DC                  mov dword ptr [ebp-24], edx
:00471A8F EB18                    jmp 00471AA9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00471A75(C)
|
:00471A91 8B45D4                  mov eax, dword ptr [ebp-2C]
:00471A94 8945B4                  mov dword ptr [ebp-4C], eax
:00471A97 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00471A9A 83C10D                  add ecx, 0000000D
:00471A9D 894DBC                  mov dword ptr [ebp-44], ecx
:00471AA0 8B55BC                  mov edx, dword ptr [ebp-44]
:00471AA3 83C205                  add edx, 00000005
:00471AA6 8955D4                  mov dword ptr [ebp-2C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00471A8F(U)
|
:00471AA9 8B45E0                  mov eax, dword ptr [ebp-20]
:00471AAC 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00471AAF 8D4401F3                lea eax, dword ptr [ecx+eax-0D]
:00471AB3 99                      cdq
:00471AB4 2BC2                    sub eax, edx
:00471AB6 D1F8                    sar eax, 1
:00471AB8 8945B8                  mov dword ptr [ebp-48], eax
:00471ABB 8B55E0                  mov edx, dword ptr [ebp-20]
:00471ABE 8B45D8                  mov eax, dword ptr [ebp-28]
:00471AC1 8D44100D                lea eax, dword ptr [eax+edx+0D]
:00471AC5 99                      cdq
:00471AC6 2BC2                    sub eax, edx
:00471AC8 D1F8                    sar eax, 1
:00471ACA 8945C0                  mov dword ptr [ebp-40], eax
:00471ACD C745F400000000          mov [ebp-0C], 00000000
:00471AD4 8D4DE4                  lea ecx, dword ptr [ebp-1C]
:00471AD7 51                      push ecx
:00471AD8 FF15C0604800            call dword ptr [004860C0]
:00471ADE 8945B0                  mov dword ptr [ebp-50], eax
:00471AE1 8B55B0                  mov edx, dword ptr [ebp-50]
:00471AE4 52                      push edx
:00471AE5 8B4508                  mov eax, dword ptr [ebp+08]
:00471AE8 50                      push eax
:00471AE9 FF1598604800            call dword ptr [00486098]
:00471AEF 8B4DC0                  mov ecx, dword ptr [ebp-40]
:00471AF2 51                      push ecx
:00471AF3 8B55BC                  mov edx, dword ptr [ebp-44]
:00471AF6 52                      push edx
:00471AF7 8B45B8                  mov eax, dword ptr [ebp-48]
:00471AFA 50                      push eax
:00471AFB 8B4DB4                  mov ecx, dword ptr [ebp-4C]
:00471AFE 51                      push ecx
:00471AFF 8B5508                  mov edx, dword ptr [ebp+08]
:00471B02 52                      push edx
:00471B03 FF1530604800            call dword ptr [00486030]
:00471B09 E929020000              jmp 00471D37
:00471B0E 8B45E4                  mov eax, dword ptr [ebp-1C]
:00471B11 8945B4                  mov dword ptr [ebp-4C], eax
:00471B14 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00471B17 894DB8                  mov dword ptr [ebp-48], ecx
:00471B1A 8B55EC                  mov edx, dword ptr [ebp-14]
:00471B1D 8955BC                  mov dword ptr [ebp-44], edx
:00471B20 8B45F0                  mov eax, dword ptr [ebp-10]
:00471B23 8945C0                  mov dword ptr [ebp-40], eax
:00471B26 6A48                    push 00000048
:00471B28 6A5A                    push 0000005A
:00471B2A 8B4D08                  mov ecx, dword ptr [ebp+08]
:00471B2D 51                      push ecx
:00471B2E FF153C604800            call dword ptr [0048603C]
:00471B34 50                      push eax
:00471B35 6A09                    push 00000009
:00471B37 FF15E8604800            call dword ptr [004860E8]
:00471B3D 8B55D8                  mov edx, dword ptr [ebp-28]
:00471B40 8D440202                lea eax, dword ptr [edx+eax+02]
:00471B44 8945E0                  mov dword ptr [ebp-20], eax
:00471B47 FF1514624800            call dword ptr [00486214]
:00471B4D 25FFFF0000              and eax, 0000FFFF
:00471B52 83F808                  cmp eax, 00000008
:00471B55 7E14                    jle 00471B6B
:00471B57 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00471B5A 83C10B                  add ecx, 0000000B
:00471B5D 894DD4                  mov dword ptr [ebp-2C], ecx
:00471B60 8B55DC                  mov edx, dword ptr [ebp-24]
:00471B63 83EA0B                  sub edx, 0000000B
:00471B66 8955DC                  mov dword ptr [ebp-24], edx
:00471B69 EB12                    jmp 00471B7D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00471B55(C)
|
:00471B6B 8B45D4                  mov eax, dword ptr [ebp-2C]
:00471B6E 83C009                  add eax, 00000009
:00471B71 8945D4                  mov dword ptr [ebp-2C], eax
:00471B74 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00471B77 83E909                  sub ecx, 00000009
:00471B7A 894DDC                  mov dword ptr [ebp-24], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00471B69(U)
|
:00471B7D 8B55D4                  mov edx, dword ptr [ebp-2C]
:00471B80 8955E4                  mov dword ptr [ebp-1C], edx
:00471B83 8B45D8                  mov eax, dword ptr [ebp-28]
:00471B86 8945E8                  mov dword ptr [ebp-18], eax
:00471B89 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00471B8C 894DEC                  mov dword ptr [ebp-14], ecx
:00471B8F 8B55E0                  mov edx, dword ptr [ebp-20]
:00471B92 8955F0                  mov dword ptr [ebp-10], edx
:00471B95 8B45E4                  mov eax, dword ptr [ebp-1C]
:00471B98 8945C4                  mov dword ptr [ebp-3C], eax
:00471B9B 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00471B9E 894DC8                  mov dword ptr [ebp-38], ecx
:00471BA1 8B55EC                  mov edx, dword ptr [ebp-14]
:00471BA4 8955CC                  mov dword ptr [ebp-34], edx
:00471BA7 8B45F0                  mov eax, dword ptr [ebp-10]
:00471BAA 8945D0                  mov dword ptr [ebp-30], eax
:00471BAD C745F400000000          mov [ebp-0C], 00000000
:00471BB4 E97E010000              jmp 00471D37
:00471BB9 837DAC00                cmp dword ptr [ebp-54], 00000000
:00471BBD 7575                    jne 00471C34
:00471BBF 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00471BC2 894DB4                  mov dword ptr [ebp-4C], ecx
:00471BC5 8B55E8                  mov edx, dword ptr [ebp-18]
:00471BC8 8955B8                  mov dword ptr [ebp-48], edx
:00471BCB 8B45EC                  mov eax, dword ptr [ebp-14]
:00471BCE 8945BC                  mov dword ptr [ebp-44], eax
:00471BD1 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00471BD4 894DC0                  mov dword ptr [ebp-40], ecx
:00471BD7 8B55E4                  mov edx, dword ptr [ebp-1C]
:00471BDA 83C202                  add edx, 00000002
:00471BDD 8955E4                  mov dword ptr [ebp-1C], edx
:00471BE0 8B45E8                  mov eax, dword ptr [ebp-18]
:00471BE3 83C002                  add eax, 00000002
:00471BE6 8945E8                  mov dword ptr [ebp-18], eax
:00471BE9 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00471BEC 83E903                  sub ecx, 00000003
:00471BEF 894DEC                  mov dword ptr [ebp-14], ecx
:00471BF2 8B55F0                  mov edx, dword ptr [ebp-10]
:00471BF5 83EA03                  sub edx, 00000003
:00471BF8 8955F0                  mov dword ptr [ebp-10], edx
:00471BFB 8B45E4                  mov eax, dword ptr [ebp-1C]
:00471BFE 8945C4                  mov dword ptr [ebp-3C], eax
:00471C01 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00471C04 894DC8                  mov dword ptr [ebp-38], ecx
:00471C07 8B55EC                  mov edx, dword ptr [ebp-14]
:00471C0A 8955CC                  mov dword ptr [ebp-34], edx
:00471C0D 8B45F0                  mov eax, dword ptr [ebp-10]
:00471C10 8945D0                  mov dword ptr [ebp-30], eax
:00471C13 C745F401000000          mov [ebp-0C], 00000001
:00471C1A 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00471C1D 3B0DF8684B00            cmp ecx, dword ptr [004B68F8]
:00471C23 750A                    jne 00471C2F
:00471C25 C705F8684B0000000000    mov dword ptr [004B68F8], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00471C23(C)
|
:00471C2F E903010000              jmp 00471D37

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00471BBD(C)
|
:00471C34 8B55E4                  mov edx, dword ptr [ebp-1C]
:00471C37 8955B4                  mov dword ptr [ebp-4C], edx
:00471C3A 8B45E8                  mov eax, dword ptr [ebp-18]
:00471C3D 8945B8                  mov dword ptr [ebp-48], eax
:00471C40 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00471C43 894DBC                  mov dword ptr [ebp-44], ecx
:00471C46 8B55F0                  mov edx, dword ptr [ebp-10]
:00471C49 8955C0                  mov dword ptr [ebp-40], edx
:00471C4C 837DAC00                cmp dword ptr [ebp-54], 00000000
:00471C50 0F8482000000            je 00471CD8
:00471C56 8B45D4                  mov eax, dword ptr [ebp-2C]
:00471C59 83C001                  add eax, 00000001
:00471C5C 8945D4                  mov dword ptr [ebp-2C], eax
:00471C5F 8B4DD8                  mov ecx, dword ptr [ebp-28]
:00471C62 83C101                  add ecx, 00000001
:00471C65 894DD8                  mov dword ptr [ebp-28], ecx
:00471C68 8B55DC                  mov edx, dword ptr [ebp-24]
:00471C6B 83C201                  add edx, 00000001
:00471C6E 8955DC                  mov dword ptr [ebp-24], edx
:00471C71 8B45E0                  mov eax, dword ptr [ebp-20]
:00471C74 83C001                  add eax, 00000001
:00471C77 8945E0                  mov dword ptr [ebp-20], eax
:00471C7A 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00471C7D 83C102                  add ecx, 00000002
:00471C80 894DE4                  mov dword ptr [ebp-1C], ecx
:00471C83 8B55E8                  mov edx, dword ptr [ebp-18]
:00471C86 83C202                  add edx, 00000002
:00471C89 8955E8                  mov dword ptr [ebp-18], edx
:00471C8C 8B45EC                  mov eax, dword ptr [ebp-14]
:00471C8F 83E802                  sub eax, 00000002
:00471C92 8945EC                  mov dword ptr [ebp-14], eax
:00471C95 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00471C98 83E902                  sub ecx, 00000002
:00471C9B 894DF0                  mov dword ptr [ebp-10], ecx
:00471C9E 8B55E4                  mov edx, dword ptr [ebp-1C]
:00471CA1 8955C4                  mov dword ptr [ebp-3C], edx
:00471CA4 8B45E8                  mov eax, dword ptr [ebp-18]
:00471CA7 8945C8                  mov dword ptr [ebp-38], eax
:00471CAA 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00471CAD 894DCC                  mov dword ptr [ebp-34], ecx
:00471CB0 8B55F0                  mov edx, dword ptr [ebp-10]
:00471CB3 8955D0                  mov dword ptr [ebp-30], edx
:00471CB6 8B450C                  mov eax, dword ptr [ebp+0C]
:00471CB9 3B05F8684B00            cmp eax, dword ptr [004B68F8]
:00471CBF 7415                    je 00471CD6
:00471CC1 6A00                    push 00000000
:00471CC3 B9B0694B00              mov ecx, 004B69B0
:00471CC8 E8E0290000              call 004746AD
:00471CCD 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00471CD0 890DF8684B00            mov dword ptr [004B68F8], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00471CBF(C)
|
:00471CD6 EB51                    jmp 00471D29

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00471C50(C)
|
:00471CD8 8B55E4                  mov edx, dword ptr [ebp-1C]
:00471CDB 83C201                  add edx, 00000001
:00471CDE 8955E4                  mov dword ptr [ebp-1C], edx
:00471CE1 8B45E8                  mov eax, dword ptr [ebp-18]
:00471CE4 83C001                  add eax, 00000001
:00471CE7 8945E8                  mov dword ptr [ebp-18], eax
:00471CEA 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00471CED 83E902                  sub ecx, 00000002
:00471CF0 894DEC                  mov dword ptr [ebp-14], ecx
:00471CF3 8B55F0                  mov edx, dword ptr [ebp-10]
:00471CF6 83EA02                  sub edx, 00000002
:00471CF9 8955F0                  mov dword ptr [ebp-10], edx
:00471CFC 8B45E4                  mov eax, dword ptr [ebp-1C]
:00471CFF 8945C4                  mov dword ptr [ebp-3C], eax
:00471D02 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00471D05 894DC8                  mov dword ptr [ebp-38], ecx
:00471D08 8B55EC                  mov edx, dword ptr [ebp-14]
:00471D0B 8955CC                  mov dword ptr [ebp-34], edx
:00471D0E 8B45F0                  mov eax, dword ptr [ebp-10]
:00471D11 8945D0                  mov dword ptr [ebp-30], eax
:00471D14 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00471D17 3B0DF8684B00            cmp ecx, dword ptr [004B68F8]
:00471D1D 750A                    jne 00471D29
:00471D1F C705F8684B0000000000    mov dword ptr [004B68F8], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00471CD6(U), :00471D1D(C)
|
:00471D29 C745F401000000          mov [ebp-0C], 00000001
:00471D30 EB05                    jmp 00471D37

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00471A5C(C)
|
:00471D32 E97B020000              jmp 00471FB2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00471B09(U), :00471BB4(U), :00471C2F(U), :00471D30(U)
|
:00471D37 8B55F8                  mov edx, dword ptr [ebp-08]
:00471D3A 81E280000000            and edx, 00000080
:00471D40 81FA80000000            cmp edx, 00000080
:00471D46 7505                    jne 00471D4D
:00471D48 E965020000              jmp 00471FB2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00471D46(C)
|
:00471D4D 8B4520                  mov eax, dword ptr [ebp+20]
:00471D50 50                      push eax
:00471D51 8B4D18                  mov ecx, dword ptr [ebp+18]
:00471D54 51                      push ecx
:00471D55 8D55E4                  lea edx, dword ptr [ebp-1C]
:00471D58 52                      push edx
:00471D59 8B4510                  mov eax, dword ptr [ebp+10]
:00471D5C 50                      push eax
:00471D5D 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00471D60 51                      push ecx
:00471D61 8B5508                  mov edx, dword ptr [ebp+08]
:00471D64 52                      push edx
:00471D65 E85EF3FFFF              call 004710C8
:00471D6A 83C418                  add esp, 00000018
:00471D6D 85C0                    test eax, eax
:00471D6F 7529                    jne 00471D9A
:00471D71 8B4510                  mov eax, dword ptr [ebp+10]
:00471D74 50                      push eax
:00471D75 FF1568604800            call dword ptr [00486068]
:00471D7B 8945A8                  mov dword ptr [ebp-58], eax
:00471D7E 8B4DA8                  mov ecx, dword ptr [ebp-58]
:00471D81 51                      push ecx
:00471D82 8D55E4                  lea edx, dword ptr [ebp-1C]
:00471D85 52                      push edx
:00471D86 8B4508                  mov eax, dword ptr [ebp+08]
:00471D89 50                      push eax
:00471D8A FF15F0624800            call dword ptr [004862F0]
:00471D90 8B4DA8                  mov ecx, dword ptr [ebp-58]
:00471D93 51                      push ecx
:00471D94 FF1548604800            call dword ptr [00486048]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00471D6F(C)
|
:00471D9A 8B55F8                  mov edx, dword ptr [ebp-08]
:00471D9D 81E2002F0000            and edx, 00002F00
:00471DA3 8955A0                  mov dword ptr [ebp-60], edx
:00471DA6 817DA000010000          cmp dword ptr [ebp-60], 00000100
:00471DAD 7446                    je 00471DF5
:00471DAF 817DA000020000          cmp dword ptr [ebp-60], 00000200
:00471DB6 7432                    je 00471DEA
:00471DB8 817DA000030000          cmp dword ptr [ebp-60], 00000300
:00471DBF 7402                    je 00471DC3
:00471DC1 EB38                    jmp 00471DFB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00471DBF(C)
|
:00471DC3 8B45F4                  mov eax, dword ptr [ebp-0C]
:00471DC6 0C01                    or al, 01
:00471DC8 8945F4                  mov dword ptr [ebp-0C], eax
:00471DCB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00471DCE 83E10F                  and ecx, 0000000F
:00471DD1 83F907                  cmp ecx, 00000007
:00471DD4 7512                    jne 00471DE8
:00471DD6 8B55D4                  mov edx, dword ptr [ebp-2C]
:00471DD9 83EA05                  sub edx, 00000005
:00471DDC 8955D4                  mov dword ptr [ebp-2C], edx
:00471DDF 8B45DC                  mov eax, dword ptr [ebp-24]
:00471DE2 83C005                  add eax, 00000005
:00471DE5 8945DC                  mov dword ptr [ebp-24], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00471DD4(C)
|
:00471DE8 EB11                    jmp 00471DFB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00471DB6(C)
|
:00471DEA 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00471DED 83C902                  or ecx, 00000002
:00471DF0 894DF4                  mov dword ptr [ebp-0C], ecx
:00471DF3 EB06                    jmp 00471DFB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00471DAD(C)
|
:00471DF5 8B55F4                  mov edx, dword ptr [ebp-0C]
:00471DF8 8955F4                  mov dword ptr [ebp-0C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00471DC1(U), :00471DE8(U), :00471DF3(U)
|
:00471DFB 8B45F8                  mov eax, dword ptr [ebp-08]
:00471DFE 25002F0000              and eax, 00002F00
:00471E03 89459C                  mov dword ptr [ebp-64], eax
:00471E06 817D9C00040000          cmp dword ptr [ebp-64], 00000400
:00471E0D 7416                    je 00471E25
:00471E0F 817D9C00080000          cmp dword ptr [ebp-64], 00000800
:00471E16 7402                    je 00471E1A
:00471E18 EB16                    jmp 00471E30

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00471E16(C)
|
:00471E1A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00471E1D 83C928                  or ecx, 00000028
:00471E20 894DF4                  mov dword ptr [ebp-0C], ecx
:00471E23 EB2A                    jmp 00471E4F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00471E0D(C)
|
:00471E25 8B55F4                  mov edx, dword ptr [ebp-0C]
:00471E28 83CA20                  or edx, 00000020
:00471E2B 8955F4                  mov dword ptr [ebp-0C], edx
:00471E2E EB1F                    jmp 00471E4F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00471E18(U)
|
:00471E30 8B45F8                  mov eax, dword ptr [ebp-08]
:00471E33 83E00F                  and eax, 0000000F
:00471E36 83F807                  cmp eax, 00000007
:00471E39 750B                    jne 00471E46
:00471E3B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00471E3E 83C920                  or ecx, 00000020
:00471E41 894DF4                  mov dword ptr [ebp-0C], ecx
:00471E44 EB09                    jmp 00471E4F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00471E39(C)
|
:00471E46 8B55F4                  mov edx, dword ptr [ebp-0C]
:00471E49 83CA24                  or edx, 00000024
:00471E4C 8955F4                  mov dword ptr [ebp-0C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00471E23(U), :00471E2E(U), :00471E44(U)
|
:00471E4F 33C0                    xor eax, eax
:00471E51 85C0                    test eax, eax
:00471E53 7409                    je 00471E5E
:00471E55 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00471E58 83E1DF                  and ecx, FFFFFFDF
:00471E5B 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00471E53(C)
|
:00471E5E 837D1C00                cmp dword ptr [ebp+1C], 00000000
:00471E62 7421                    je 00471E85
:00471E64 6A03                    push 00000003
:00471E66 8B550C                  mov edx, dword ptr [ebp+0C]
:00471E69 52                      push edx
:00471E6A FF1534634800            call dword ptr [00486334]
:00471E70 50                      push eax
:00471E71 8D45D4                  lea eax, dword ptr [ebp-2C]
:00471E74 50                      push eax
:00471E75 8B4D1C                  mov ecx, dword ptr [ebp+1C]
:00471E78 51                      push ecx
:00471E79 8B5508                  mov edx, dword ptr [ebp+08]
:00471E7C 52                      push edx
:00471E7D E881050000              call 00472403
:00471E82 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00471E62(C)
|
:00471E85 B9202E4900              mov ecx, 00492E20
:00471E8A E82992F9FF              call 0040B0B8
:00471E8F 85C0                    test eax, eax
:00471E91 7425                    je 00471EB8
:00471E93 6A01                    push 00000001
:00471E95 6A00                    push 00000000
:00471E97 8D45D4                  lea eax, dword ptr [ebp-2C]
:00471E9A 50                      push eax
:00471E9B 8B4D14                  mov ecx, dword ptr [ebp+14]
:00471E9E 51                      push ecx
:00471E9F 8B55F4                  mov edx, dword ptr [ebp-0C]
:00471EA2 52                      push edx
:00471EA3 8B450C                  mov eax, dword ptr [ebp+0C]
:00471EA6 50                      push eax
:00471EA7 8B4D08                  mov ecx, dword ptr [ebp+08]
:00471EAA 51                      push ecx
:00471EAB E834F6FFFF              call 004714E4
:00471EB0 83C41C                  add esp, 0000001C
:00471EB3 8945FC                  mov dword ptr [ebp-04], eax
:00471EB6 EB23                    jmp 00471EDB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00471E91(C)
|
:00471EB8 6A00                    push 00000000
:00471EBA 6A00                    push 00000000
:00471EBC 8D55D4                  lea edx, dword ptr [ebp-2C]
:00471EBF 52                      push edx
:00471EC0 8B4514                  mov eax, dword ptr [ebp+14]
:00471EC3 50                      push eax
:00471EC4 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00471EC7 51                      push ecx
:00471EC8 8B550C                  mov edx, dword ptr [ebp+0C]
:00471ECB 52                      push edx
:00471ECC 8B4508                  mov eax, dword ptr [ebp+08]
:00471ECF 50                      push eax
:00471ED0 E80FF6FFFF              call 004714E4
:00471ED5 83C41C                  add esp, 0000001C
:00471ED8 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00471EB6(U)
|
:00471EDB 8D4DB4                  lea ecx, dword ptr [ebp-4C]
:00471EDE 51                      push ecx
:00471EDF FF15C0604800            call dword ptr [004860C0]
:00471EE5 8945B0                  mov dword ptr [ebp-50], eax
:00471EE8 8B55B0                  mov edx, dword ptr [ebp-50]
:00471EEB 52                      push edx
:00471EEC 8B4508                  mov eax, dword ptr [ebp+08]
:00471EEF 50                      push eax
:00471EF0 FF1598604800            call dword ptr [00486098]
:00471EF6 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00471EF9 83E10F                  and ecx, 0000000F
:00471EFC 83F907                  cmp ecx, 00000007
:00471EFF 0F8589000000            jne 00471F8E
:00471F05 8B55F8                  mov edx, dword ptr [ebp-08]
:00471F08 81E2002F0000            and edx, 00002F00
:00471F0E 895598                  mov dword ptr [ebp-68], edx
:00471F11 817D9800020000          cmp dword ptr [ebp-68], 00000200
:00471F18 7435                    je 00471F4F
:00471F1A 817D9800030000          cmp dword ptr [ebp-68], 00000300
:00471F21 7402                    je 00471F25
:00471F23 EB41                    jmp 00471F66

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00471F21(C)
|
:00471F25 8B45D4                  mov eax, dword ptr [ebp-2C]
:00471F28 0345DC                  add eax, dword ptr [ebp-24]
:00471F2B 2B45FC                  sub eax, dword ptr [ebp-04]
:00471F2E 99                      cdq
:00471F2F 2BC2                    sub eax, edx
:00471F31 D1F8                    sar eax, 1
:00471F33 83E802                  sub eax, 00000002
:00471F36 8945C4                  mov dword ptr [ebp-3C], eax
:00471F39 8B45D4                  mov eax, dword ptr [ebp-2C]
:00471F3C 0345DC                  add eax, dword ptr [ebp-24]
:00471F3F 0345FC                  add eax, dword ptr [ebp-04]
:00471F42 99                      cdq
:00471F43 2BC2                    sub eax, edx
:00471F45 D1F8                    sar eax, 1
:00471F47 83C002                  add eax, 00000002
:00471F4A 8945CC                  mov dword ptr [ebp-34], eax
:00471F4D EB2D                    jmp 00471F7C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00471F18(C)
|
:00471F4F 8B45DC                  mov eax, dword ptr [ebp-24]
:00471F52 2B45FC                  sub eax, dword ptr [ebp-04]
:00471F55 83E802                  sub eax, 00000002
:00471F58 8945C4                  mov dword ptr [ebp-3C], eax
:00471F5B 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00471F5E 83C102                  add ecx, 00000002
:00471F61 894DCC                  mov dword ptr [ebp-34], ecx
:00471F64 EB16                    jmp 00471F7C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00471F23(U)
|
:00471F66 8B55C4                  mov edx, dword ptr [ebp-3C]
:00471F69 83EA02                  sub edx, 00000002
:00471F6C 8955C4                  mov dword ptr [ebp-3C], edx
:00471F6F 8B45FC                  mov eax, dword ptr [ebp-04]
:00471F72 8B4DD4                  mov ecx, dword ptr [ebp-2C]
:00471F75 8D540102                lea edx, dword ptr [ecx+eax+02]
:00471F79 8955CC                  mov dword ptr [ebp-34], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00471F4D(U), :00471F64(U)
|
:00471F7C 8B45D4                  mov eax, dword ptr [ebp-2C]
:00471F7F 83E802                  sub eax, 00000002
:00471F82 8945D4                  mov dword ptr [ebp-2C], eax
:00471F85 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00471F88 83C102                  add ecx, 00000002
:00471F8B 894DDC                  mov dword ptr [ebp-24], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00471EFF(C)
|
:00471F8E 8B55D0                  mov edx, dword ptr [ebp-30]
:00471F91 52                      push edx
:00471F92 8B45CC                  mov eax, dword ptr [ebp-34]
:00471F95 50                      push eax
:00471F96 8B4DC8                  mov ecx, dword ptr [ebp-38]
:00471F99 51                      push ecx
:00471F9A 8B55C4                  mov edx, dword ptr [ebp-3C]
:00471F9D 52                      push edx
:00471F9E 8B4508                  mov eax, dword ptr [ebp+08]
:00471FA1 50                      push eax
:00471FA2 FF1530604800            call dword ptr [00486030]
:00471FA8 8B4DB0                  mov ecx, dword ptr [ebp-50]
:00471FAB 51                      push ecx
:00471FAC FF1548604800            call dword ptr [00486048]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00471D32(U), :00471D48(U)
|
:00471FB2 8BE5                    mov esp, ebp
:00471FB4 5D                      pop ebp
:00471FB5 C3                      ret



:00471FB6 341C4700                DWORD 00471C34
:00471FBA B91B4700                DWORD 00471BB9
:00471FBE 6C1A4700                DWORD 00471A6C
:00471FC2 6C1A4700                DWORD 00471A6C
:00471FC6 6C1A4700                DWORD 00471A6C
:00471FCA 6C1A4700                DWORD 00471A6C
:00471FCE 6C1A4700                DWORD 00471A6C
:00471FD2 0E1B4700                DWORD 00471B0E
:00471FD6 321D4700                DWORD 00471D32
:00471FDA 6C1A4700                DWORD 00471A6C



* Referenced by a CALL at Addresses:
|:0041BD0A   , :0041C175   , :0045EA8F   , :00464C0E   , :0046F101   
|:00479432   
|
:00471FDE 55                      push ebp
:00471FDF 8BEC                    mov ebp, esp
:00471FE1 8B4510                  mov eax, dword ptr [ebp+10]
:00471FE4 50                      push eax
:00471FE5 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00471FE8 51                      push ecx
:00471FE9 6A0F                    push 0000000F
:00471FEB FF1564634800            call dword ptr [00486364]
:00471FF1 50                      push eax
:00471FF2 8B5508                  mov edx, dword ptr [ebp+08]
:00471FF5 52                      push edx
:00471FF6 E805000000              call 00472000
:00471FFB 83C410                  add esp, 00000010
:00471FFE 5D                      pop ebp
:00471FFF C3                      ret



* Referenced by a CALL at Address:
|:00471FF6   
|
:00472000 55                      push ebp
:00472001 8BEC                    mov ebp, esp
:00472003 83EC7C                  sub esp, 0000007C
:00472006 6A08                    push 00000008
:00472008 FF1564634800            call dword ptr [00486364]
:0047200E 8945FC                  mov dword ptr [ebp-04], eax
:00472011 8B4508                  mov eax, dword ptr [ebp+08]
:00472014 8B08                    mov ecx, dword ptr [eax]
:00472016 894D88                  mov dword ptr [ebp-78], ecx
:00472019 837D8865                cmp dword ptr [ebp-78], 00000065
:0047201D 7405                    je 00472024
:0047201F E957020000              jmp 0047227B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047201D(C)
|
:00472024 C745F800000000          mov [ebp-08], 00000000
:0047202B 6A10                    push 00000010
:0047202D 6A00                    push 00000000
:0047202F 8D55E8                  lea edx, dword ptr [ebp-18]
:00472032 52                      push edx
:00472033 E8F8EA0000              call 00480B30
:00472038 83C40C                  add esp, 0000000C
:0047203B C745F825000000          mov [ebp-08], 00000025
:00472042 8B4514                  mov eax, dword ptr [ebp+14]
:00472045 50                      push eax
:00472046 8B4D10                  mov ecx, dword ptr [ebp+10]
:00472049 51                      push ecx
:0047204A 8B5508                  mov edx, dword ptr [ebp+08]
:0047204D 83C21C                  add edx, 0000001C
:00472050 52                      push edx
:00472051 8B450C                  mov eax, dword ptr [ebp+0C]
:00472054 50                      push eax
:00472055 8B4D08                  mov ecx, dword ptr [ebp+08]
:00472058 8B5114                  mov edx, dword ptr [ecx+14]
:0047205B 52                      push edx
:0047205C 8B4508                  mov eax, dword ptr [ebp+08]
:0047205F 8B4818                  mov ecx, dword ptr [eax+18]
:00472062 51                      push ecx
:00472063 E860F0FFFF              call 004710C8
:00472068 83C418                  add esp, 00000018
:0047206B 85C0                    test eax, eax
:0047206D 752F                    jne 0047209E
:0047206F 8B550C                  mov edx, dword ptr [ebp+0C]
:00472072 52                      push edx
:00472073 FF1568604800            call dword ptr [00486068]
:00472079 8945C8                  mov dword ptr [ebp-38], eax
:0047207C 8B45C8                  mov eax, dword ptr [ebp-38]
:0047207F 50                      push eax
:00472080 8B4D08                  mov ecx, dword ptr [ebp+08]
:00472083 83C11C                  add ecx, 0000001C
:00472086 51                      push ecx
:00472087 8B5508                  mov edx, dword ptr [ebp+08]
:0047208A 8B4218                  mov eax, dword ptr [edx+18]
:0047208D 50                      push eax
:0047208E FF15F0624800            call dword ptr [004862F0]
:00472094 8B4DC8                  mov ecx, dword ptr [ebp-38]
:00472097 51                      push ecx
:00472098 FF1548604800            call dword ptr [00486048]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047206D(C)
|
:0047209E C745CC03000000          mov [ebp-34], 00000003
:004720A5 8D55E8                  lea edx, dword ptr [ebp-18]
:004720A8 8955D8                  mov dword ptr [ebp-28], edx
:004720AB C745DC10000000          mov [ebp-24], 00000010
:004720B2 8D45CC                  lea eax, dword ptr [ebp-34]
:004720B5 50                      push eax
:004720B6 8B4D08                  mov ecx, dword ptr [ebp+08]
:004720B9 8B5108                  mov edx, dword ptr [ecx+08]
:004720BC 52                      push edx
:004720BD 6805130000              push 00001305
:004720C2 8B4508                  mov eax, dword ptr [ebp+08]
:004720C5 8B4814                  mov ecx, dword ptr [eax+14]
:004720C8 51                      push ecx
:004720C9 FF15F4624800            call dword ptr [004862F4]
:004720CF 85C0                    test eax, eax
:004720D1 0F849D010000            je 00472274
:004720D7 8D55AC                  lea edx, dword ptr [ebp-54]
:004720DA 52                      push edx
:004720DB 8D45E8                  lea eax, dword ptr [ebp-18]
:004720DE 50                      push eax
:004720DF E876DB0000              call 0047FC5A
:004720E4 83C404                  add esp, 00000004
:004720E7 50                      push eax
:004720E8 8D4DE8                  lea ecx, dword ptr [ebp-18]
:004720EB 51                      push ecx
:004720EC 8B5508                  mov edx, dword ptr [ebp+08]
:004720EF 8B4218                  mov eax, dword ptr [edx+18]
:004720F2 50                      push eax
:004720F3 FF1590604800            call dword ptr [00486090]
:004720F9 837DB010                cmp dword ptr [ebp-50], 00000010
:004720FD 7E08                    jle 00472107
:004720FF 8B4DB0                  mov ecx, dword ptr [ebp-50]
:00472102 894D84                  mov dword ptr [ebp-7C], ecx
:00472105 EB07                    jmp 0047210E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004720FD(C)
|
:00472107 C7458410000000          mov [ebp-7C], 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00472105(U)
|
:0047210E 8B5584                  mov edx, dword ptr [ebp-7C]
:00472111 83C202                  add edx, 00000002
:00472114 895598                  mov dword ptr [ebp-68], edx
:00472117 8B4598                  mov eax, dword ptr [ebp-68]
:0047211A 2B45B0                  sub eax, dword ptr [ebp-50]
:0047211D 99                      cdq
:0047211E 2BC2                    sub eax, edx
:00472120 D1F8                    sar eax, 1
:00472122 8B4DAC                  mov ecx, dword ptr [ebp-54]
:00472125 8D540112                lea edx, dword ptr [ecx+eax+12]
:00472129 8955C4                  mov dword ptr [ebp-3C], edx
:0047212C 8D45B4                  lea eax, dword ptr [ebp-4C]
:0047212F 50                      push eax
:00472130 6A00                    push 00000000
:00472132 680A130000              push 0000130A
:00472137 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047213A 8B5114                  mov edx, dword ptr [ecx+14]
:0047213D 52                      push edx
:0047213E FF15F4624800            call dword ptr [004862F4]
:00472144 8B4508                  mov eax, dword ptr [ebp+08]
:00472147 8B401C                  mov eax, dword ptr [eax+1C]
:0047214A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047214D 034124                  add eax, dword ptr [ecx+24]
:00472150 2B45C4                  sub eax, dword ptr [ebp-3C]
:00472153 99                      cdq
:00472154 2BC2                    sub eax, edx
:00472156 D1F8                    sar eax, 1
:00472158 89459C                  mov dword ptr [ebp-64], eax
:0047215B 8B45C0                  mov eax, dword ptr [ebp-40]
:0047215E 2B45B8                  sub eax, dword ptr [ebp-48]
:00472161 2B4598                  sub eax, dword ptr [ebp-68]
:00472164 83C001                  add eax, 00000001
:00472167 99                      cdq
:00472168 2BC2                    sub eax, edx
:0047216A D1F8                    sar eax, 1
:0047216C 8B5508                  mov edx, dword ptr [ebp+08]
:0047216F 8B4A20                  mov ecx, dword ptr [edx+20]
:00472172 03C8                    add ecx, eax
:00472174 894DA0                  mov dword ptr [ebp-60], ecx
:00472177 8B5508                  mov edx, dword ptr [ebp+08]
:0047217A 8B421C                  mov eax, dword ptr [edx+1C]
:0047217D 8B4D08                  mov ecx, dword ptr [ebp+08]
:00472180 034124                  add eax, dword ptr [ecx+24]
:00472183 8B55C4                  mov edx, dword ptr [ebp-3C]
:00472186 8D441001                lea eax, dword ptr [eax+edx+01]
:0047218A 99                      cdq
:0047218B 2BC2                    sub eax, edx
:0047218D D1F8                    sar eax, 1
:0047218F 8945A4                  mov dword ptr [ebp-5C], eax
:00472192 8B4508                  mov eax, dword ptr [ebp+08]
:00472195 8B4820                  mov ecx, dword ptr [eax+20]
:00472198 034D98                  add ecx, dword ptr [ebp-68]
:0047219B 8B45C0                  mov eax, dword ptr [ebp-40]
:0047219E 2B45B8                  sub eax, dword ptr [ebp-48]
:004721A1 2B4598                  sub eax, dword ptr [ebp-68]
:004721A4 99                      cdq
:004721A5 2BC2                    sub eax, edx
:004721A7 D1F8                    sar eax, 1
:004721A9 03C8                    add ecx, eax
:004721AB 894DA8                  mov dword ptr [ebp-58], ecx
:004721AE 837DE000                cmp dword ptr [ebp-20], 00000000
:004721B2 7C57                    jl 0047220B
:004721B4 6A00                    push 00000000
:004721B6 6A00                    push 00000000
:004721B8 6802130000              push 00001302
:004721BD 8B5508                  mov edx, dword ptr [ebp+08]
:004721C0 8B4214                  mov eax, dword ptr [edx+14]
:004721C3 50                      push eax
:004721C4 FF15F4624800            call dword ptr [004862F4]
:004721CA 89458C                  mov dword ptr [ebp-74], eax
:004721CD 8B4DE0                  mov ecx, dword ptr [ebp-20]
:004721D0 51                      push ecx
:004721D1 8B558C                  mov edx, dword ptr [ebp-74]
:004721D4 52                      push edx
:004721D5 8D4D90                  lea ecx, dword ptr [ebp-70]
:004721D8 E86195F9FF              call 0040B73E
:004721DD 6A01                    push 00000001
:004721DF 8B4508                  mov eax, dword ptr [ebp+08]
:004721E2 8B4814                  mov ecx, dword ptr [eax+14]
:004721E5 51                      push ecx
:004721E6 FF1534634800            call dword ptr [00486334]
:004721EC 50                      push eax
:004721ED 8D559C                  lea edx, dword ptr [ebp-64]
:004721F0 52                      push edx
:004721F1 8D4590                  lea eax, dword ptr [ebp-70]
:004721F4 50                      push eax
:004721F5 8B4D08                  mov ecx, dword ptr [ebp+08]
:004721F8 8B5118                  mov edx, dword ptr [ecx+18]
:004721FB 52                      push edx
:004721FC E802020000              call 00472403
:00472201 83C414                  add esp, 00000014
:00472204 C745F826000000          mov [ebp-08], 00000026

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004721B2(C)
|
:0047220B B9202E4900              mov ecx, 00492E20
:00472210 E8A38EF9FF              call 0040B0B8
:00472215 85C0                    test eax, eax
:00472217 7427                    je 00472240
:00472219 6A01                    push 00000001
:0047221B 6A00                    push 00000000
:0047221D 8D459C                  lea eax, dword ptr [ebp-64]
:00472220 50                      push eax
:00472221 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00472224 51                      push ecx
:00472225 8B55F8                  mov edx, dword ptr [ebp-08]
:00472228 52                      push edx
:00472229 6AFF                    push FFFFFFFF
:0047222B 8D45E8                  lea eax, dword ptr [ebp-18]
:0047222E 50                      push eax
:0047222F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00472232 8B5118                  mov edx, dword ptr [ecx+18]
:00472235 52                      push edx
:00472236 E8D6F1FFFF              call 00471411
:0047223B 83C420                  add esp, 00000020
:0047223E EB34                    jmp 00472274

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00472217(C)
|
:00472240 6A10                    push 00000010
:00472242 FF1564634800            call dword ptr [00486364]
:00472248 33C9                    xor ecx, ecx
:0047224A 3945FC                  cmp dword ptr [ebp-04], eax
:0047224D 0F94C1                  sete cl
:00472250 51                      push ecx
:00472251 6A00                    push 00000000
:00472253 8D559C                  lea edx, dword ptr [ebp-64]
:00472256 52                      push edx
:00472257 8B45FC                  mov eax, dword ptr [ebp-04]
:0047225A 50                      push eax
:0047225B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047225E 51                      push ecx
:0047225F 6AFF                    push FFFFFFFF
:00472261 8D55E8                  lea edx, dword ptr [ebp-18]
:00472264 52                      push edx
:00472265 8B4508                  mov eax, dword ptr [ebp+08]
:00472268 8B4818                  mov ecx, dword ptr [eax+18]
:0047226B 51                      push ecx
:0047226C E8A0F1FFFF              call 00471411
:00472271 83C420                  add esp, 00000020

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004720D1(C), :0047223E(U)
|
:00472274 B801000000              mov eax, 00000001
:00472279 EB02                    jmp 0047227D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047201F(U)
|
:0047227B 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00472279(U)
|
:0047227D 8BE5                    mov esp, ebp
:0047227F 5D                      pop ebp
:00472280 C3                      ret



* Referenced by a CALL at Addresses:
|:004682B7   , :0046AF4F   , :0046B9D0   , :0046F1E7   
|
:00472281 55                      push ebp
:00472282 8BEC                    mov ebp, esp
:00472284 83EC54                  sub esp, 00000054
:00472287 6806000400              push 00040006
:0047228C 6A00                    push 00000000
:0047228E 682B130000              push 0000132B
:00472293 8B4508                  mov eax, dword ptr [ebp+08]
:00472296 50                      push eax
:00472297 FF15F4624800            call dword ptr [004862F4]
:0047229D B91C2E4900              mov ecx, 00492E1C
:004722A2 E8C9D3FEFF              call 0045F670
:004722A7 50                      push eax
:004722A8 6A00                    push 00000000
:004722AA 6803130000              push 00001303
:004722AF 8B4D08                  mov ecx, dword ptr [ebp+08]
:004722B2 51                      push ecx
:004722B3 FF15F4624800            call dword ptr [004862F4]
:004722B9 C745C403000000          mov [ebp-3C], 00000003
:004722C0 C745BC00000000          mov [ebp-44], 00000000
:004722C7 C745C002000000          mov [ebp-40], 00000002
:004722CE 8D55E0                  lea edx, dword ptr [ebp-20]
:004722D1 8955D0                  mov dword ptr [ebp-30], edx
:004722D4 C745AC00000000          mov [ebp-54], 00000000
:004722DB EB09                    jmp 004722E6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00472323(U)
|
:004722DD 8B45AC                  mov eax, dword ptr [ebp-54]
:004722E0 83C001                  add eax, 00000001
:004722E3 8945AC                  mov dword ptr [ebp-54], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004722DB(U)
|
:004722E6 837DAC02                cmp dword ptr [ebp-54], 00000002
:004722EA 7D39                    jge 00472325
:004722EC 8B4DAC                  mov ecx, dword ptr [ebp-54]
:004722EF 8B550C                  mov edx, dword ptr [ebp+0C]
:004722F2 8B048A                  mov eax, dword ptr [edx+4*ecx]
:004722F5 50                      push eax
:004722F6 8D4DE0                  lea ecx, dword ptr [ebp-20]
:004722F9 51                      push ecx
:004722FA E891EE0000              call 00481190
:004722FF 83C408                  add esp, 00000008
:00472302 8B55AC                  mov edx, dword ptr [ebp-54]
:00472305 8B4495BC                mov eax, dword ptr [ebp+4*edx-44]
:00472309 8945D8                  mov dword ptr [ebp-28], eax
:0047230C 8D4DC4                  lea ecx, dword ptr [ebp-3C]
:0047230F 51                      push ecx
:00472310 8B55AC                  mov edx, dword ptr [ebp-54]
:00472313 52                      push edx
:00472314 6807130000              push 00001307
:00472319 8B4508                  mov eax, dword ptr [ebp+08]
:0047231C 50                      push eax
:0047231D FF15F4624800            call dword ptr [004862F4]
:00472323 EBB8                    jmp 004722DD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004722EA(C)
|
:00472325 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00472328 51                      push ecx
:00472329 8B5508                  mov edx, dword ptr [ebp+08]
:0047232C 52                      push edx
:0047232D E838F8FEFF              call 00461B6A
:00472332 83C408                  add esp, 00000008
:00472335 8D45F0                  lea eax, dword ptr [ebp-10]
:00472338 50                      push eax
:00472339 6A00                    push 00000000
:0047233B 6828130000              push 00001328
:00472340 8B4D08                  mov ecx, dword ptr [ebp+08]
:00472343 51                      push ecx
:00472344 FF15F4624800            call dword ptr [004862F4]
:0047234A FF1514624800            call dword ptr [00486214]
:00472350 8945B0                  mov dword ptr [ebp-50], eax
:00472353 8B45B0                  mov eax, dword ptr [ebp-50]
:00472356 25FFFF0000              and eax, 0000FFFF
:0047235B 99                      cdq
:0047235C 83E203                  and edx, 00000003
:0047235F 03C2                    add eax, edx
:00472361 C1F802                  sar eax, 02
:00472364 83E802                  sub eax, 00000002
:00472367 8945B8                  mov dword ptr [ebp-48], eax
:0047236A 8B45B0                  mov eax, dword ptr [ebp-50]
:0047236D C1E810                  shr eax, 10
:00472370 25FFFF0000              and eax, 0000FFFF
:00472375 25FFFF0000              and eax, 0000FFFF
:0047237A 99                      cdq
:0047237B 83E207                  and edx, 00000007
:0047237E 03C2                    add eax, edx
:00472380 C1F803                  sar eax, 03
:00472383 83E801                  sub eax, 00000001
:00472386 8945B4                  mov dword ptr [ebp-4C], eax
:00472389 C745AC00000000          mov [ebp-54], 00000000
:00472390 EB09                    jmp 0047239B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004723FD(U)
|
:00472392 8B55AC                  mov edx, dword ptr [ebp-54]
:00472395 83C201                  add edx, 00000001
:00472398 8955AC                  mov dword ptr [ebp-54], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00472390(U)
|
:0047239B 837DAC02                cmp dword ptr [ebp-54], 00000002
:0047239F 7D5E                    jge 004723FF
:004723A1 8B45AC                  mov eax, dword ptr [ebp-54]
:004723A4 8B4D10                  mov ecx, dword ptr [ebp+10]
:004723A7 8B1481                  mov edx, dword ptr [ecx+4*eax]
:004723AA 52                      push edx
:004723AB FF1548634800            call dword ptr [00486348]
:004723B1 85C0                    test eax, eax
:004723B3 7448                    je 004723FD
:004723B5 6A0C                    push 0000000C
:004723B7 8B45FC                  mov eax, dword ptr [ebp-04]
:004723BA 2B45F4                  sub eax, dword ptr [ebp-0C]
:004723BD 8B4DB4                  mov ecx, dword ptr [ebp-4C]
:004723C0 D1E1                    shl ecx, 1
:004723C2 2BC1                    sub eax, ecx
:004723C4 83C001                  add eax, 00000001
:004723C7 50                      push eax
:004723C8 8B55F8                  mov edx, dword ptr [ebp-08]
:004723CB 2B55F0                  sub edx, dword ptr [ebp-10]
:004723CE 8B45B8                  mov eax, dword ptr [ebp-48]
:004723D1 D1E0                    shl eax, 1
:004723D3 2BD0                    sub edx, eax
:004723D5 83C201                  add edx, 00000001
:004723D8 52                      push edx
:004723D9 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004723DC 034DB4                  add ecx, dword ptr [ebp-4C]
:004723DF 51                      push ecx
:004723E0 8B55B8                  mov edx, dword ptr [ebp-48]
:004723E3 8B45F0                  mov eax, dword ptr [ebp-10]
:004723E6 8D4C10FF                lea ecx, dword ptr [eax+edx-01]
:004723EA 51                      push ecx
:004723EB 6A00                    push 00000000
:004723ED 8B55AC                  mov edx, dword ptr [ebp-54]
:004723F0 8B4510                  mov eax, dword ptr [ebp+10]
:004723F3 8B0C90                  mov ecx, dword ptr [eax+4*edx]
:004723F6 51                      push ecx
:004723F7 FF1580624800            call dword ptr [00486280]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004723B3(C)
|
:004723FD EB93                    jmp 00472392

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047239F(C)
|
:004723FF 8BE5                    mov esp, ebp
:00472401 5D                      pop ebp
:00472402 C3                      ret



* Referenced by a CALL at Addresses:
|:00471E7D   , :004721FC   
|
:00472403 55                      push ebp
:00472404 8BEC                    mov ebp, esp
:00472406 83EC18                  sub esp, 00000018
:00472409 8D45EC                  lea eax, dword ptr [ebp-14]
:0047240C 50                      push eax
:0047240D 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00472410 51                      push ecx
:00472411 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00472414 E8D293F9FF              call 0040B7EB
:00472419 8B5510                  mov edx, dword ptr [ebp+10]
:0047241C 8B420C                  mov eax, dword ptr [edx+0C]
:0047241F 8B4D10                  mov ecx, dword ptr [ebp+10]
:00472422 034104                  add eax, dword ptr [ecx+04]
:00472425 2B45EC                  sub eax, dword ptr [ebp-14]
:00472428 99                      cdq
:00472429 2BC2                    sub eax, edx
:0047242B D1F8                    sar eax, 1
:0047242D 8945F4                  mov dword ptr [ebp-0C], eax
:00472430 8B5510                  mov edx, dword ptr [ebp+10]
:00472433 8B4510                  mov eax, dword ptr [ebp+10]
:00472436 8B4A0C                  mov ecx, dword ptr [edx+0C]
:00472439 2B4804                  sub ecx, dword ptr [eax+04]
:0047243C 2B4DEC                  sub ecx, dword ptr [ebp-14]
:0047243F 8BC1                    mov eax, ecx
:00472441 99                      cdq
:00472442 2BC2                    sub eax, edx
:00472444 D1F8                    sar eax, 1
:00472446 8B5510                  mov edx, dword ptr [ebp+10]
:00472449 8B0A                    mov ecx, dword ptr [edx]
:0047244B 8D540101                lea edx, dword ptr [ecx+eax+01]
:0047244F 8955FC                  mov dword ptr [ebp-04], edx
:00472452 8B4510                  mov eax, dword ptr [ebp+10]
:00472455 8B4D10                  mov ecx, dword ptr [ebp+10]
:00472458 8B400C                  mov eax, dword ptr [eax+0C]
:0047245B 2B4104                  sub eax, dword ptr [ecx+04]
:0047245E 2B45EC                  sub eax, dword ptr [ebp-14]
:00472461 99                      cdq
:00472462 2BC2                    sub eax, edx
:00472464 D1F8                    sar eax, 1
:00472466 8B5510                  mov edx, dword ptr [ebp+10]
:00472469 8B4A08                  mov ecx, dword ptr [edx+08]
:0047246C 2BC8                    sub ecx, eax
:0047246E 2B4DF0                  sub ecx, dword ptr [ebp-10]
:00472471 83E901                  sub ecx, 00000001
:00472474 894DF8                  mov dword ptr [ebp-08], ecx
:00472477 837D1400                cmp dword ptr [ebp+14], 00000000
:0047247B 743A                    je 004724B7
:0047247D 8B55F4                  mov edx, dword ptr [ebp-0C]
:00472480 52                      push edx
:00472481 8B45FC                  mov eax, dword ptr [ebp-04]
:00472484 50                      push eax
:00472485 8B4D08                  mov ecx, dword ptr [ebp+08]
:00472488 51                      push ecx
:00472489 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0047248C E8CE92F9FF              call 0040B75F
:00472491 8B5518                  mov edx, dword ptr [ebp+18]
:00472494 81E2FF000000            and edx, 000000FF
:0047249A 83E202                  and edx, 00000002
:0047249D 85D2                    test edx, edx
:0047249F 7414                    je 004724B5
:004724A1 8B45F4                  mov eax, dword ptr [ebp-0C]
:004724A4 50                      push eax
:004724A5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004724A8 51                      push ecx
:004724A9 8B5508                  mov edx, dword ptr [ebp+08]
:004724AC 52                      push edx
:004724AD 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004724B0 E8AA92F9FF              call 0040B75F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047249F(C)
|
:004724B5 EB70                    jmp 00472527

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047247B(C)
|
:004724B7 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004724BA E84D93F9FF              call 0040B80C
:004724BF 8945E8                  mov dword ptr [ebp-18], eax
:004724C2 6A23                    push 00000023
:004724C4 8B45F0                  mov eax, dword ptr [ebp-10]
:004724C7 50                      push eax
:004724C8 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004724CB 51                      push ecx
:004724CC 8B55F4                  mov edx, dword ptr [ebp-0C]
:004724CF 52                      push edx
:004724D0 8B45FC                  mov eax, dword ptr [ebp-04]
:004724D3 50                      push eax
:004724D4 6A00                    push 00000000
:004724D6 8B4DE8                  mov ecx, dword ptr [ebp-18]
:004724D9 51                      push ecx
:004724DA 6A00                    push 00000000
:004724DC 6A00                    push 00000000
:004724DE 8B5508                  mov edx, dword ptr [ebp+08]
:004724E1 52                      push edx
:004724E2 FF1538634800            call dword ptr [00486338]
:004724E8 8B4518                  mov eax, dword ptr [ebp+18]
:004724EB 25FF000000              and eax, 000000FF
:004724F0 83E002                  and eax, 00000002
:004724F3 85C0                    test eax, eax
:004724F5 7426                    je 0047251D
:004724F7 6A23                    push 00000023
:004724F9 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004724FC 51                      push ecx
:004724FD 8B55EC                  mov edx, dword ptr [ebp-14]
:00472500 52                      push edx
:00472501 8B45F4                  mov eax, dword ptr [ebp-0C]
:00472504 50                      push eax
:00472505 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00472508 51                      push ecx
:00472509 6A00                    push 00000000
:0047250B 8B55E8                  mov edx, dword ptr [ebp-18]
:0047250E 52                      push edx
:0047250F 6A00                    push 00000000
:00472511 6A00                    push 00000000
:00472513 8B4508                  mov eax, dword ptr [ebp+08]
:00472516 50                      push eax
:00472517 FF1538634800            call dword ptr [00486338]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004724F5(C)
|
:0047251D 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00472520 51                      push ecx
:00472521 FF153C634800            call dword ptr [0048633C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004724B5(U)
|
:00472527 8BE5                    mov esp, ebp
:00472529 5D                      pop ebp
:0047252A C3                      ret



* Referenced by a CALL at Addresses:
|:0041BCAB   , :0041C0FE   , :0045EA6B   , :00464C22   , :0046D37D   
|:00479440   
|
:0047252B 55                      push ebp
:0047252C 8BEC                    mov ebp, esp
:0047252E 8B4508                  mov eax, dword ptr [ebp+08]
:00472531 50                      push eax
:00472532 8B0D20604B00            mov ecx, dword ptr [004B6020]
:00472538 51                      push ecx
:00472539 FF157C634800            call dword ptr [0048637C]
:0047253F 6A15                    push 00000015
:00472541 E89DA50000              call 0047CAE3
:00472546 83C404                  add esp, 00000004

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:00472549 6A07                    push 00000007
:0047254B E87AAC0000              call 0047D1CA
:00472550 83C404                  add esp, 00000004
:00472553 6A00                    push 00000000
:00472555 6A00                    push 00000000
:00472557 E88FAE0000              call 0047D3EB
:0047255C 83C408                  add esp, 00000008
:0047255F 8B15686A4B00            mov edx, dword ptr [004B6A68]
:00472565 52                      push edx
:00472566 A120604B00              mov eax, dword ptr [004B6020]
:0047256B 50                      push eax
:0047256C FF157C634800            call dword ptr [0048637C]
:00472572 6A00                    push 00000000
:00472574 E86AA50000              call 0047CAE3
:00472579 83C404                  add esp, 00000004
:0047257C 5D                      pop ebp
:0047257D C3                      ret



* Referenced by a CALL at Addresses:
|:0041BCC0   , :0041C113   , :0045EA7D   , :00460438   , :004637EC   
|:00464C3A   , :0046D3A8   , :00475044   , :00479452   
|
:0047257E 55                      push ebp
:0047257F 8BEC                    mov ebp, esp
:00472581 6A01                    push 00000001
:00472583 6A00                    push 00000000
:00472585 8B4508                  mov eax, dword ptr [ebp+08]
:00472588 50                      push eax
:00472589 FF15A4624800            call dword ptr [004862A4]
:0047258F 8B4D08                  mov ecx, dword ptr [ebp+08]
:00472592 51                      push ecx
:00472593 FF15A8624800            call dword ptr [004862A8]
:00472599 8B5508                  mov edx, dword ptr [ebp+08]
:0047259C 3B15686A4B00            cmp edx, dword ptr [004B6A68]
:004725A2 7558                    jne 004725FC
:004725A4 6A01                    push 00000001
:004725A6 6A00                    push 00000000
:004725A8 A114604B00              mov eax, dword ptr [004B6014]
:004725AD 50                      push eax
:004725AE FF15A4624800            call dword ptr [004862A4]
:004725B4 8B0D14604B00            mov ecx, dword ptr [004B6014]
:004725BA 51                      push ecx
:004725BB FF15A8624800            call dword ptr [004862A8]
:004725C1 6A01                    push 00000001
:004725C3 6A00                    push 00000000
:004725C5 8B1518604B00            mov edx, dword ptr [004B6018]
:004725CB 52                      push edx
:004725CC FF15A4624800            call dword ptr [004862A4]
:004725D2 A118604B00              mov eax, dword ptr [004B6018]
:004725D7 50                      push eax
:004725D8 FF15A8624800            call dword ptr [004862A8]
:004725DE 6A01                    push 00000001
:004725E0 6A00                    push 00000000
:004725E2 8B0DDC5F4B00            mov ecx, dword ptr [004B5FDC]
:004725E8 51                      push ecx
:004725E9 FF15A4624800            call dword ptr [004862A4]
:004725EF 8B15DC5F4B00            mov edx, dword ptr [004B5FDC]
:004725F5 52                      push edx
:004725F6 FF15A8624800            call dword ptr [004862A8]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004725A2(C)
|
:004725FC 5D                      pop ebp
:004725FD C3                      ret


:004725FE CC                      int 03
:004725FF CC                      int 03

* Referenced by a CALL at Addresses:
|:00461D05   , :00485796   
|
:00472600 55                      push ebp
:00472601 8BEC                    mov ebp, esp
:00472603 6AFF                    push FFFFFFFF
:00472605 68BC594800              push 004859BC
:0047260A 64A100000000            mov eax, dword ptr fs:[00000000]
:00472610 50                      push eax
:00472611 64892500000000          mov dword ptr fs:[00000000], esp
:00472618 51                      push ecx
:00472619 894DF0                  mov dword ptr [ebp-10], ecx
:0047261C C745FC00000000          mov [ebp-04], 00000000
:00472623 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00472626 81C1A0060000            add ecx, 000006A0
:0047262C E84F000000              call 00472680
:00472631 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00472638 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047263B 83C108                  add ecx, 00000008
:0047263E E81D000000              call 00472660
:00472643 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00472646 64890D00000000          mov dword ptr fs:[00000000], ecx
:0047264D 8BE5                    mov esp, ebp
:0047264F 5D                      pop ebp
:00472650 C3                      ret


:00472651 CC                      int 03
:00472652 CC                      int 03
:00472653 CC                      int 03
:00472654 CC                      int 03
:00472655 CC                      int 03
:00472656 CC                      int 03
:00472657 CC                      int 03
:00472658 CC                      int 03
:00472659 CC                      int 03
:0047265A CC                      int 03
:0047265B CC                      int 03
:0047265C CC                      int 03
:0047265D CC                      int 03
:0047265E CC                      int 03
:0047265F CC                      int 03

* Referenced by a CALL at Addresses:
|:0047263E   , :00472732   , :0048589D   , :004858F3   , :004859B6   
|:004859D6   
|
:00472660 55                      push ebp
:00472661 8BEC                    mov ebp, esp
:00472663 51                      push ecx
:00472664 894DFC                  mov dword ptr [ebp-04], ecx
:00472667 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047266A E821310000              call 00475790
:0047266F 8BE5                    mov esp, ebp
:00472671 5D                      pop ebp
:00472672 C3                      ret


:00472673 CC                      int 03
:00472674 CC                      int 03
:00472675 CC                      int 03
:00472676 CC                      int 03
:00472677 CC                      int 03
:00472678 CC                      int 03
:00472679 CC                      int 03
:0047267A CC                      int 03
:0047267B CC                      int 03
:0047267C CC                      int 03
:0047267D CC                      int 03
:0047267E CC                      int 03
:0047267F CC                      int 03

* Referenced by a CALL at Addresses:
|:0047262C   , :00485902   
|
:00472680 55                      push ebp
:00472681 8BEC                    mov ebp, esp
:00472683 51                      push ecx
:00472684 894DFC                  mov dword ptr [ebp-04], ecx
:00472687 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047268A E811000000              call 004726A0
:0047268F 8BE5                    mov esp, ebp
:00472691 5D                      pop ebp
:00472692 C3                      ret


:00472693 CC                      int 03
:00472694 CC                      int 03
:00472695 CC                      int 03
:00472696 CC                      int 03
:00472697 CC                      int 03
:00472698 CC                      int 03
:00472699 CC                      int 03
:0047269A CC                      int 03
:0047269B CC                      int 03
:0047269C CC                      int 03
:0047269D CC                      int 03
:0047269E CC                      int 03
:0047269F CC                      int 03

* Referenced by a CALL at Addresses:
|:0047268A   , :0047270E   , :004858BB   , :004859F4   
|
:004726A0 55                      push ebp
:004726A1 8BEC                    mov ebp, esp
:004726A3 51                      push ecx
:004726A4 894DFC                  mov dword ptr [ebp-04], ecx
:004726A7 68F0E14000              push 0040E1F0
:004726AC 6A03                    push 00000003
:004726AE 6A14                    push 00000014
:004726B0 8B45FC                  mov eax, dword ptr [ebp-04]
:004726B3 0590000000              add eax, 00000090
:004726B8 50                      push eax
:004726B9 E822EE0000              call 004814E0
:004726BE 8BE5                    mov esp, ebp
:004726C0 5D                      pop ebp
:004726C1 C3                      ret


:004726C2 CC                      int 03
:004726C3 CC                      int 03
:004726C4 CC                      int 03
:004726C5 CC                      int 03
:004726C6 CC                      int 03
:004726C7 CC                      int 03
:004726C8 CC                      int 03
:004726C9 CC                      int 03
:004726CA CC                      int 03
:004726CB CC                      int 03
:004726CC CC                      int 03
:004726CD CC                      int 03
:004726CE CC                      int 03
:004726CF CC                      int 03

* Referenced by a CALL at Addresses:
|:00461D8B   , :004857AC   
|
:004726D0 55                      push ebp
:004726D1 8BEC                    mov ebp, esp
:004726D3 6AFF                    push FFFFFFFF
:004726D5 68FA594800              push 004859FA
:004726DA 64A100000000            mov eax, dword ptr fs:[00000000]
:004726E0 50                      push eax
:004726E1 64892500000000          mov dword ptr fs:[00000000], esp
:004726E8 51                      push ecx
:004726E9 894DF0                  mov dword ptr [ebp-10], ecx
:004726EC C745FC02000000          mov [ebp-04], 00000002
:004726F3 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004726F6 81C17C020000            add ecx, 0000027C
:004726FC E8EFBAF9FF              call 0040E1F0
:00472701 C645FC01                mov [ebp-04], 01
:00472705 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00472708 81C1B0010000            add ecx, 000001B0
:0047270E E88DFFFFFF              call 004726A0
:00472713 C645FC00                mov [ebp-04], 00
:00472717 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047271A 81C1E0000000            add ecx, 000000E0
:00472720 E86B300000              call 00475790
:00472725 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0047272C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047272F 83C10C                  add ecx, 0000000C
:00472732 E829FFFFFF              call 00472660
:00472737 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047273A 64890D00000000          mov dword ptr fs:[00000000], ecx
:00472741 8BE5                    mov esp, ebp
:00472743 5D                      pop ebp
:00472744 C3                      ret


:00472745 CC                      int 03
:00472746 CC                      int 03
:00472747 CC                      int 03
:00472748 CC                      int 03
:00472749 CC                      int 03
:0047274A CC                      int 03
:0047274B CC                      int 03
:0047274C CC                      int 03
:0047274D CC                      int 03
:0047274E CC                      int 03
:0047274F CC                      int 03

* Referenced by a CALL at Addresses:
|:00461DC9   , :004857B8   
|
:00472750 55                      push ebp
:00472751 8BEC                    mov ebp, esp
:00472753 6AFF                    push FFFFFFFF
:00472755 682B5A4800              push 00485A2B
:0047275A 64A100000000            mov eax, dword ptr fs:[00000000]
:00472760 50                      push eax
:00472761 64892500000000          mov dword ptr fs:[00000000], esp
:00472768 51                      push ecx
:00472769 894DF0                  mov dword ptr [ebp-10], ecx
:0047276C C745FC01000000          mov [ebp-04], 00000001
:00472773 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00472776 81C178070000            add ecx, 00000778
:0047277C E86FBAF9FF              call 0040E1F0
:00472781 C645FC00                mov [ebp-04], 00
:00472785 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00472788 81C1A0060000            add ecx, 000006A0
:0047278E E8FD2F0000              call 00475790
:00472793 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0047279A 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047279D 83C10C                  add ecx, 0000000C
:004727A0 E8EB2F0000              call 00475790
:004727A5 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004727A8 64890D00000000          mov dword ptr fs:[00000000], ecx
:004727AF 8BE5                    mov esp, ebp
:004727B1 5D                      pop ebp
:004727B2 C3                      ret


:004727B3 CC                      int 03
:004727B4 CC                      int 03
:004727B5 CC                      int 03
:004727B6 CC                      int 03
:004727B7 CC                      int 03
:004727B8 CC                      int 03
:004727B9 CC                      int 03
:004727BA CC                      int 03
:004727BB CC                      int 03
:004727BC CC                      int 03
:004727BD CC                      int 03
:004727BE CC                      int 03
:004727BF CC                      int 03

* Referenced by a CALL at Addresses:
|:004624F9   , :00462538   , :004626DC   , :0046273B   
|
:004727C0 55                      push ebp
:004727C1 8BEC                    mov ebp, esp
:004727C3 51                      push ecx
:004727C4 894DFC                  mov dword ptr [ebp-04], ecx
:004727C7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004727CA E800FDFEFF              call 004624CF
:004727CF 8B4508                  mov eax, dword ptr [ebp+08]
:004727D2 83E001                  and eax, 00000001
:004727D5 85C0                    test eax, eax
:004727D7 740C                    je 004727E5
:004727D9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004727DC 51                      push ecx
:004727DD E83EE80000              call 00481020
:004727E2 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004727D7(C)
|
:004727E5 8B45FC                  mov eax, dword ptr [ebp-04]
:004727E8 8BE5                    mov esp, ebp
:004727EA 5D                      pop ebp
:004727EB C20400                  ret 0004


:004727EE CC                      int 03
:004727EF CC                      int 03

* Referenced by a CALL at Address:
|:004627EB   
|
:004727F0 55                      push ebp
:004727F1 8BEC                    mov ebp, esp
:004727F3 51                      push ecx
:004727F4 894DFC                  mov dword ptr [ebp-04], ecx
:004727F7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004727FA E80FFDFEFF              call 0046250E
:004727FF 8B4508                  mov eax, dword ptr [ebp+08]
:00472802 83E001                  and eax, 00000001
:00472805 85C0                    test eax, eax
:00472807 740C                    je 00472815
:00472809 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047280C 51                      push ecx
:0047280D E80EE80000              call 00481020
:00472812 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00472807(C)
|
:00472815 8B45FC                  mov eax, dword ptr [ebp-04]
:00472818 8BE5                    mov esp, ebp
:0047281A 5D                      pop ebp
:0047281B C20400                  ret 0004


:0047281E CC                      int 03
:0047281F CC                      int 03

* Referenced by a CALL at Address:
|:00463BDE   
|
:00472820 55                      push ebp
:00472821 8BEC                    mov ebp, esp
:00472823 51                      push ecx
:00472824 894DFC                  mov dword ptr [ebp-04], ecx
:00472827 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047282A E836FFFEFF              call 00462765
:0047282F 8B45FC                  mov eax, dword ptr [ebp-04]
:00472832 C700786F4800            mov dword ptr [eax], 00486F78
:00472838 8B45FC                  mov eax, dword ptr [ebp-04]
:0047283B 8BE5                    mov esp, ebp
:0047283D 5D                      pop ebp
:0047283E C3                      ret


:0047283F CC                      int 03

* Referenced by a CALL at Addresses:
|:00405B15   , :00405FCB   , :00405FEB   , :00406016   , :0041CF41   
|:0042060F   , :00420784   , :00422C42   , :00422F7F   , :00423E4C   
|:00423E83   , :00439D65   , :00439D96   , :00439EC3   , :00439EFC   
|:0043C324   , :0043C331   , :0045050E   , :0045072D   , :00450D3B   
|:00450E51   , :0045ACDE   , :0045AD02   , :0045AD30   , :0045AD4F   
|:004631CE   , :00465A1D   , :00465E85   , :00465E94   , :004663C6   
|:0047035C   , :00471041   , :004795A3   , :0047A110   , :0047A129   
|:0047A93D   
|
:00472840 55                      push ebp
:00472841 8BEC                    mov ebp, esp
:00472843 51                      push ecx
:00472844 894DFC                  mov dword ptr [ebp-04], ecx
:00472847 8B45FC                  mov eax, dword ptr [ebp-04]
:0047284A 8B4014                  mov eax, dword ptr [eax+14]
:0047284D 8BE5                    mov esp, ebp
:0047284F 5D                      pop ebp
:00472850 C3                      ret


:00472851 CC                      int 03
:00472852 CC                      int 03
:00472853 CC                      int 03
:00472854 CC                      int 03
:00472855 CC                      int 03
:00472856 CC                      int 03
:00472857 CC                      int 03
:00472858 CC                      int 03
:00472859 CC                      int 03
:0047285A CC                      int 03
:0047285B CC                      int 03
:0047285C CC                      int 03
:0047285D CC                      int 03
:0047285E CC                      int 03
:0047285F CC                      int 03
:00472860 55                      push ebp
:00472861 8BEC                    mov ebp, esp
:00472863 51                      push ecx
:00472864 894DFC                  mov dword ptr [ebp-04], ecx
:00472867 B840694800              mov eax, 00486940
:0047286C 8BE5                    mov esp, ebp
:0047286E 5D                      pop ebp
:0047286F C3                      ret


:00472870 55                      push ebp
:00472871 8BEC                    mov ebp, esp
:00472873 51                      push ecx
:00472874 894DFC                  mov dword ptr [ebp-04], ecx
:00472877 B868694800              mov eax, 00486968
:0047287C 8BE5                    mov esp, ebp
:0047287E 5D                      pop ebp
:0047287F C3                      ret



* Referenced by a CALL at Addresses:
|:00464B41   , :0046C44D   
|
:00472880 55                      push ebp
:00472881 8BEC                    mov ebp, esp
:00472883 51                      push ecx
:00472884 894DFC                  mov dword ptr [ebp-04], ecx
:00472887 8B45FC                  mov eax, dword ptr [ebp-04]
:0047288A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047288D 89480C                  mov dword ptr [eax+0C], ecx
:00472890 8BE5                    mov esp, ebp
:00472892 5D                      pop ebp
:00472893 C20400                  ret 0004


:00472896 CC                      int 03
:00472897 CC                      int 03
:00472898 CC                      int 03
:00472899 CC                      int 03
:0047289A CC                      int 03
:0047289B CC                      int 03
:0047289C CC                      int 03
:0047289D CC                      int 03
:0047289E CC                      int 03
:0047289F CC                      int 03

* Referenced by a CALL at Addresses:
|:00426C27   , :00426EF2   , :00464B58   , :0046C46A   
|
:004728A0 55                      push ebp
:004728A1 8BEC                    mov ebp, esp
:004728A3 51                      push ecx
:004728A4 894DFC                  mov dword ptr [ebp-04], ecx
:004728A7 8B45FC                  mov eax, dword ptr [ebp-04]
:004728AA 8B4D08                  mov ecx, dword ptr [ebp+08]
:004728AD 894810                  mov dword ptr [eax+10], ecx
:004728B0 8BE5                    mov esp, ebp
:004728B2 5D                      pop ebp
:004728B3 C20400                  ret 0004


:004728B6 CC                      int 03
:004728B7 CC                      int 03
:004728B8 CC                      int 03
:004728B9 CC                      int 03
:004728BA CC                      int 03
:004728BB CC                      int 03
:004728BC CC                      int 03
:004728BD CC                      int 03
:004728BE CC                      int 03
:004728BF CC                      int 03

* Referenced by a CALL at Address:
|:00461D98   
|
:004728C0 55                      push ebp
:004728C1 8BEC                    mov ebp, esp
:004728C3 6AFF                    push FFFFFFFF
:004728C5 685B5A4800              push 00485A5B
:004728CA 64A100000000            mov eax, dword ptr fs:[00000000]
:004728D0 50                      push eax
:004728D1 64892500000000          mov dword ptr fs:[00000000], esp
:004728D8 51                      push ecx
:004728D9 894DF0                  mov dword ptr [ebp-10], ecx
:004728DC 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004728DF 83C10C                  add ecx, 0000000C
:004728E2 E829B9F9FF              call 0040E210
:004728E7 C745FC00000000          mov [ebp-04], 00000000
:004728EE 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004728F1 81C1A0060000            add ecx, 000006A0
:004728F7 E844000000              call 00472940
:004728FC C645FC01                mov [ebp-04], 01
:00472900 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00472903 81C178070000            add ecx, 00000778
:00472909 E882B9F9FF              call 0040E290
:0047290E 8B45F0                  mov eax, dword ptr [ebp-10]
:00472911 C70000000000            mov dword ptr [eax], 00000000
:00472917 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047291A C6410800                mov [ecx+08], 00
:0047291E C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00472925 8B45F0                  mov eax, dword ptr [ebp-10]
:00472928 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047292B 64890D00000000          mov dword ptr fs:[00000000], ecx
:00472932 8BE5                    mov esp, ebp
:00472934 5D                      pop ebp
:00472935 C3                      ret


:00472936 CC                      int 03
:00472937 CC                      int 03
:00472938 CC                      int 03
:00472939 CC                      int 03
:0047293A CC                      int 03
:0047293B CC                      int 03
:0047293C CC                      int 03
:0047293D CC                      int 03
:0047293E CC                      int 03
:0047293F CC                      int 03

* Referenced by a CALL at Address:
|:004728F7   
|
:00472940 55                      push ebp
:00472941 8BEC                    mov ebp, esp
:00472943 51                      push ecx
:00472944 894DFC                  mov dword ptr [ebp-04], ecx
:00472947 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047294A E801B9F9FF              call 0040E250
:0047294F 8B45FC                  mov eax, dword ptr [ebp-04]
:00472952 C700906F4800            mov dword ptr [eax], 00486F90
:00472958 8B45FC                  mov eax, dword ptr [ebp-04]
:0047295B 8BE5                    mov esp, ebp
:0047295D 5D                      pop ebp
:0047295E C3                      ret


:0047295F CC                      int 03

* Referenced by a CALL at Address:
|:0046586D   
|
:00472960 55                      push ebp
:00472961 8BEC                    mov ebp, esp
:00472963 6AFF                    push FFFFFFFF
:00472965 68795A4800              push 00485A79
:0047296A 64A100000000            mov eax, dword ptr fs:[00000000]
:00472970 50                      push eax
:00472971 64892500000000          mov dword ptr fs:[00000000], esp
:00472978 51                      push ecx
:00472979 894DF0                  mov dword ptr [ebp-10], ecx
:0047297C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047297F E8ECB5F9FF              call 0040DF70
:00472984 C745FC00000000          mov [ebp-04], 00000000
:0047298B 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047298E 81C128200000            add ecx, 00002028
:00472994 E88909FFFF              call 00463322
:00472999 8B45F0                  mov eax, dword ptr [ebp-10]
:0047299C C700E86F4800            mov dword ptr [eax], 00486FE8
:004729A2 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:004729A9 8B45F0                  mov eax, dword ptr [ebp-10]
:004729AC 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004729AF 64890D00000000          mov dword ptr fs:[00000000], ecx
:004729B6 8BE5                    mov esp, ebp
:004729B8 5D                      pop ebp
:004729B9 C3                      ret


:004729BA CC                      int 03
:004729BB CC                      int 03
:004729BC CC                      int 03
:004729BD CC                      int 03
:004729BE CC                      int 03
:004729BF CC                      int 03

* Referenced by a CALL at Addresses:
|:004658AB   , :00485848   
|
:004729C0 55                      push ebp
:004729C1 8BEC                    mov ebp, esp
:004729C3 6AFF                    push FFFFFFFF
:004729C5 68995A4800              push 00485A99
:004729CA 64A100000000            mov eax, dword ptr fs:[00000000]
:004729D0 50                      push eax
:004729D1 64892500000000          mov dword ptr fs:[00000000], esp
:004729D8 51                      push ecx
:004729D9 894DF0                  mov dword ptr [ebp-10], ecx
:004729DC C745FC00000000          mov [ebp-04], 00000000
:004729E3 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004729E6 81C128200000            add ecx, 00002028
:004729EC E8FFB7F9FF              call 0040E1F0
:004729F1 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:004729F8 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004729FB E890B5F9FF              call 0040DF90
:00472A00 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00472A03 64890D00000000          mov dword ptr fs:[00000000], ecx
:00472A0A 8BE5                    mov esp, ebp
:00472A0C 5D                      pop ebp
:00472A0D C3                      ret


:00472A0E CC                      int 03
:00472A0F CC                      int 03

* Referenced by a CALL at Addresses:
|:0043DD65   , :00466505   
|
:00472A10 55                      push ebp
:00472A11 8BEC                    mov ebp, esp
:00472A13 51                      push ecx
:00472A14 894DFC                  mov dword ptr [ebp-04], ecx
:00472A17 8B4508                  mov eax, dword ptr [ebp+08]
:00472A1A 50                      push eax
:00472A1B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00472A1E 83C124                  add ecx, 00000024
:00472A21 E80A000000              call 00472A30
:00472A26 8BE5                    mov esp, ebp
:00472A28 5D                      pop ebp
:00472A29 C20400                  ret 0004


:00472A2C CC                      int 03
:00472A2D CC                      int 03
:00472A2E CC                      int 03
:00472A2F CC                      int 03

* Referenced by a CALL at Addresses:
|:0046A99B   , :0046B83D   , :0046BFFE   , :0046D029   , :0046D059   
|:00472A21   
|
:00472A30 55                      push ebp
:00472A31 8BEC                    mov ebp, esp
:00472A33 51                      push ecx
:00472A34 894DFC                  mov dword ptr [ebp-04], ecx
:00472A37 8B45FC                  mov eax, dword ptr [ebp-04]
:00472A3A 8B4D08                  mov ecx, dword ptr [ebp+08]
:00472A3D 894850                  mov dword ptr [eax+50], ecx
:00472A40 8BE5                    mov esp, ebp
:00472A42 5D                      pop ebp
:00472A43 C20400                  ret 0004


:00472A46 CC                      int 03
:00472A47 CC                      int 03
:00472A48 CC                      int 03
:00472A49 CC                      int 03
:00472A4A CC                      int 03
:00472A4B CC                      int 03
:00472A4C CC                      int 03
:00472A4D CC                      int 03
:00472A4E CC                      int 03
:00472A4F CC                      int 03

* Referenced by a CALL at Address:
|:004664EF   
|
:00472A50 55                      push ebp
:00472A51 8BEC                    mov ebp, esp
:00472A53 6AFF                    push FFFFFFFF
:00472A55 68B95A4800              push 00485AB9
:00472A5A 64A100000000            mov eax, dword ptr fs:[00000000]
:00472A60 50                      push eax
:00472A61 64892500000000          mov dword ptr fs:[00000000], esp
:00472A68 51                      push ecx
:00472A69 894DF0                  mov dword ptr [ebp-10], ecx
:00472A6C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00472A6F E86CB9F9FF              call 0040E3E0
:00472A74 C745FC00000000          mov [ebp-04], 00000000
:00472A7B 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00472A7E 83C124                  add ecx, 00000024
:00472A81 E82A000000              call 00472AB0
:00472A86 8B45F0                  mov eax, dword ptr [ebp-10]
:00472A89 C70010704800            mov dword ptr [eax], 00487010
:00472A8F C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00472A96 8B45F0                  mov eax, dword ptr [ebp-10]
:00472A99 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00472A9C 64890D00000000          mov dword ptr fs:[00000000], ecx
:00472AA3 8BE5                    mov esp, ebp
:00472AA5 5D                      pop ebp
:00472AA6 C3                      ret


:00472AA7 CC                      int 03
:00472AA8 CC                      int 03
:00472AA9 CC                      int 03
:00472AAA CC                      int 03
:00472AAB CC                      int 03
:00472AAC CC                      int 03
:00472AAD CC                      int 03
:00472AAE CC                      int 03
:00472AAF CC                      int 03

* Referenced by a CALL at Address:
|:00472A81   
|
:00472AB0 55                      push ebp
:00472AB1 8BEC                    mov ebp, esp
:00472AB3 6AFF                    push FFFFFFFF
:00472AB5 68D95A4800              push 00485AD9
:00472ABA 64A100000000            mov eax, dword ptr fs:[00000000]
:00472AC0 50                      push eax
:00472AC1 64892500000000          mov dword ptr fs:[00000000], esp
:00472AC8 51                      push ecx
:00472AC9 894DF0                  mov dword ptr [ebp-10], ecx
:00472ACC 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00472ACF E86C000000              call 00472B40
:00472AD4 C745FC00000000          mov [ebp-04], 00000000
:00472ADB 6A26                    push 00000026
:00472ADD 6A00                    push 00000000
:00472ADF 6A00                    push 00000000
:00472AE1 6A00                    push 00000000
:00472AE3 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00472AE6 83C154                  add ecx, 00000054
:00472AE9 E805E9FEFF              call 004613F3
:00472AEE 8B45F0                  mov eax, dword ptr [ebp-10]
:00472AF1 C70038704800            mov dword ptr [eax], 00487038
:00472AF7 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00472AFA C7415000000000          mov [ecx+50], 00000000
:00472B01 8B55F0                  mov edx, dword ptr [ebp-10]
:00472B04 8B45F0                  mov eax, dword ptr [ebp-10]
:00472B07 8B4828                  mov ecx, dword ptr [eax+28]
:00472B0A 894A2C                  mov dword ptr [edx+2C], ecx
:00472B0D 8B55F0                  mov edx, dword ptr [ebp-10]
:00472B10 8B45F0                  mov eax, dword ptr [ebp-10]
:00472B13 8B4830                  mov ecx, dword ptr [eax+30]
:00472B16 894A34                  mov dword ptr [edx+34], ecx
:00472B19 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00472B20 8B45F0                  mov eax, dword ptr [ebp-10]
:00472B23 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00472B26 64890D00000000          mov dword ptr fs:[00000000], ecx
:00472B2D 8BE5                    mov esp, ebp
:00472B2F 5D                      pop ebp
:00472B30 C3                      ret


:00472B31 CC                      int 03
:00472B32 CC                      int 03
:00472B33 CC                      int 03
:00472B34 CC                      int 03
:00472B35 CC                      int 03
:00472B36 CC                      int 03
:00472B37 CC                      int 03
:00472B38 CC                      int 03
:00472B39 CC                      int 03
:00472B3A CC                      int 03
:00472B3B CC                      int 03
:00472B3C CC                      int 03
:00472B3D CC                      int 03
:00472B3E CC                      int 03
:00472B3F CC                      int 03

* Referenced by a CALL at Addresses:
|:00472ACF   , :0047B2BA   
|
:00472B40 55                      push ebp
:00472B41 8BEC                    mov ebp, esp
:00472B43 51                      push ecx
:00472B44 894DFC                  mov dword ptr [ebp-04], ecx
:00472B47 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00472B4A E85E10FFFF              call 00463BAD
:00472B4F 8B45FC                  mov eax, dword ptr [ebp-04]
:00472B52 C70090704800            mov dword ptr [eax], 00487090
:00472B58 8B45FC                  mov eax, dword ptr [ebp-04]
:00472B5B 8BE5                    mov esp, ebp
:00472B5D 5D                      pop ebp
:00472B5E C3                      ret


:00472B5F CC                      int 03
:00472B60 55                      push ebp
:00472B61 8BEC                    mov ebp, esp
:00472B63 51                      push ecx
:00472B64 894DFC                  mov dword ptr [ebp-04], ecx
:00472B67 8B4508                  mov eax, dword ptr [ebp+08]
:00472B6A 50                      push eax
:00472B6B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00472B6E 8B11                    mov edx, dword ptr [ecx]
:00472B70 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00472B73 FF5238                  call [edx+38]
:00472B76 8BE5                    mov esp, ebp
:00472B78 5D                      pop ebp
:00472B79 C20400                  ret 0004


:00472B7C CC                      int 03
:00472B7D CC                      int 03
:00472B7E CC                      int 03
:00472B7F CC                      int 03

* Referenced by a CALL at Addresses:
|:0046652F   , :0048585E   
|
:00472B80 55                      push ebp
:00472B81 8BEC                    mov ebp, esp
:00472B83 6AFF                    push FFFFFFFF
:00472B85 68F95A4800              push 00485AF9
:00472B8A 64A100000000            mov eax, dword ptr fs:[00000000]
:00472B90 50                      push eax
:00472B91 64892500000000          mov dword ptr fs:[00000000], esp
:00472B98 51                      push ecx
:00472B99 894DF0                  mov dword ptr [ebp-10], ecx
:00472B9C C745FC00000000          mov [ebp-04], 00000000
:00472BA3 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00472BA6 83C124                  add ecx, 00000024
:00472BA9 E8E22B0000              call 00475790
:00472BAE C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00472BB5 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00472BB8 E8A3B8F9FF              call 0040E460
:00472BBD 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00472BC0 64890D00000000          mov dword ptr fs:[00000000], ecx
:00472BC7 8BE5                    mov esp, ebp
:00472BC9 5D                      pop ebp
:00472BCA C3                      ret


:00472BCB CC                      int 03
:00472BCC CC                      int 03
:00472BCD CC                      int 03
:00472BCE CC                      int 03
:00472BCF CC                      int 03

* Referenced by a CALL at Addresses:
|:004667BF   , :00466923   
|
:00472BD0 55                      push ebp
:00472BD1 8BEC                    mov ebp, esp
:00472BD3 51                      push ecx
:00472BD4 894DFC                  mov dword ptr [ebp-04], ecx
:00472BD7 8B4508                  mov eax, dword ptr [ebp+08]
:00472BDA 25FF000000              and eax, 000000FF
:00472BDF 6BC003                  imul eax, 00000003
:00472BE2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00472BE5 8A440113                mov al, byte ptr [ecx+eax+13]
:00472BE9 8BE5                    mov esp, ebp
:00472BEB 5D                      pop ebp
:00472BEC C20400                  ret 0004


:00472BEF CC                      int 03

* Referenced by a CALL at Addresses:
|:004667E3   , :0046694D   
|
:00472BF0 55                      push ebp
:00472BF1 8BEC                    mov ebp, esp
:00472BF3 51                      push ecx
:00472BF4 894DFC                  mov dword ptr [ebp-04], ecx
:00472BF7 8B4508                  mov eax, dword ptr [ebp+08]
:00472BFA 25FF000000              and eax, 000000FF
:00472BFF 6BC003                  imul eax, 00000003
:00472C02 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00472C05 8A440114                mov al, byte ptr [ecx+eax+14]
:00472C09 8BE5                    mov esp, ebp
:00472C0B 5D                      pop ebp
:00472C0C C20400                  ret 0004


:00472C0F CC                      int 03

* Referenced by a CALL at Addresses:
|:004667FB   , :00466968   
|
:00472C10 55                      push ebp
:00472C11 8BEC                    mov ebp, esp
:00472C13 51                      push ecx
:00472C14 894DFC                  mov dword ptr [ebp-04], ecx
:00472C17 8B4508                  mov eax, dword ptr [ebp+08]
:00472C1A 25FF000000              and eax, 000000FF
:00472C1F 6BC003                  imul eax, 00000003
:00472C22 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00472C25 8A440115                mov al, byte ptr [ecx+eax+15]
:00472C29 8BE5                    mov esp, ebp
:00472C2B 5D                      pop ebp
:00472C2C C20400                  ret 0004


:00472C2F CC                      int 03

* Referenced by a CALL at Address:
|:00466B82   
|
:00472C30 55                      push ebp
:00472C31 8BEC                    mov ebp, esp
:00472C33 51                      push ecx
:00472C34 894DFC                  mov dword ptr [ebp-04], ecx
:00472C37 8B4508                  mov eax, dword ptr [ebp+08]
:00472C3A 25FF000000              and eax, 000000FF
:00472C3F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00472C42 8A440108                mov al, byte ptr [ecx+eax+08]
:00472C46 8BE5                    mov esp, ebp
:00472C48 5D                      pop ebp
:00472C49 C20400                  ret 0004


:00472C4C CC                      int 03
:00472C4D CC                      int 03
:00472C4E CC                      int 03
:00472C4F CC                      int 03

* Referenced by a CALL at Address:
|:00466CD6   
|
:00472C50 55                      push ebp
:00472C51 8BEC                    mov ebp, esp
:00472C53 51                      push ecx
:00472C54 894DFC                  mov dword ptr [ebp-04], ecx
:00472C57 8B4508                  mov eax, dword ptr [ebp+08]
:00472C5A 25FF000000              and eax, 000000FF
:00472C5F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00472C62 8A440118                mov al, byte ptr [ecx+eax+18]
:00472C66 8BE5                    mov esp, ebp
:00472C68 5D                      pop ebp
:00472C69 C20400                  ret 0004


:00472C6C CC                      int 03
:00472C6D CC                      int 03
:00472C6E CC                      int 03
:00472C6F CC                      int 03

* Referenced by a CALL at Addresses:
|:0046791E   , :00469775   , :00470137   , :00470546   , :00476FCE   
|:00477180   , :004772DD   
|
:00472C70 55                      push ebp
:00472C71 8BEC                    mov ebp, esp
:00472C73 51                      push ecx
:00472C74 894DFC                  mov dword ptr [ebp-04], ecx
:00472C77 8B45FC                  mov eax, dword ptr [ebp-04]
:00472C7A 8A4013                  mov al, byte ptr [eax+13]
:00472C7D 8BE5                    mov esp, ebp
:00472C7F 5D                      pop ebp
:00472C80 C3                      ret


:00472C81 CC                      int 03
:00472C82 CC                      int 03
:00472C83 CC                      int 03
:00472C84 CC                      int 03
:00472C85 CC                      int 03
:00472C86 CC                      int 03
:00472C87 CC                      int 03
:00472C88 CC                      int 03
:00472C89 CC                      int 03
:00472C8A CC                      int 03
:00472C8B CC                      int 03
:00472C8C CC                      int 03
:00472C8D CC                      int 03
:00472C8E CC                      int 03
:00472C8F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040381F   , :004042B3   , :00404430   , :00404E1B   , :0040507F   
|:004052B3   , :004053E6   , :0040556D   , :00405AD3   , :00405BAD   
|:00405EEF   , :00406078   , :004060A3   , :00406439   , :0041144F   
|:00414C38   , :0041CE23   , :0041FF5C   , :004205E7   , :0042072E   
|:00420FE2   , :00422836   , :00422895   , :004228F4   , :00422953   
|:00422BA1   , :00422BBC   , :00422C0E   , :00422C7E   , :00422CF0   
|:00422FCA   , :00422FFD   , :004230C4   , :00423DD3   , :00423DFF   
|:004247A1   , :00424CB8   , :00425070   , :00437B95   , :00437BD4   
|:00438AD9   , :00438B25   , :00438ED2   , :00438F3C   , :004396A5   
|:00439837   , :0043995A   , :0043AC56   , :0043BF78   , :0043BF85   
|:0043C04A   , :0043C33E   , :0043C34B   , :0043DB65   , :0043EB95   
|:0044CC5B   , :0044E022   , :0044E038   , :0044E09A   , :004504D6   
|:004506E9   , :00450D03   , :00450E0D   , :00456060   , :00456126   
|:004599F6   , :0045AC22   , :0045AC46   , :0045AC73   , :0045AC92   
|:0045B05B   , :0045B1A7   , :0045B1C2   , :0045B429   , :0045B57B   
|:00468330   , :00468344   , :0046835A   , :00468371   , :0046AFD7   
|:0046AFEB   , :0046B011   , :0046B028   , :0046BA35   , :0046BA49   
|:0046BA5F   , :0046BA76   , :0046E4E0   , :0046E557   , :0046EDE0   
|:0046EE04   , :0046EE18   , :0046EE2C   , :0046EE50   , :0046EE64   
|:00479589   , :0047A09D   , :0047A0B6   , :0047A8A6   
|
:00472C90 55                      push ebp
:00472C91 8BEC                    mov ebp, esp
:00472C93 51                      push ecx
:00472C94 894DFC                  mov dword ptr [ebp-04], ecx
:00472C97 8B45FC                  mov eax, dword ptr [ebp-04]
:00472C9A 8B4010                  mov eax, dword ptr [eax+10]
:00472C9D 8BE5                    mov esp, ebp
:00472C9F 5D                      pop ebp
:00472CA0 C3                      ret


:00472CA1 CC                      int 03
:00472CA2 CC                      int 03
:00472CA3 CC                      int 03
:00472CA4 CC                      int 03
:00472CA5 CC                      int 03
:00472CA6 CC                      int 03
:00472CA7 CC                      int 03
:00472CA8 CC                      int 03
:00472CA9 CC                      int 03
:00472CAA CC                      int 03
:00472CAB CC                      int 03
:00472CAC CC                      int 03
:00472CAD CC                      int 03
:00472CAE CC                      int 03
:00472CAF CC                      int 03

* Referenced by a CALL at Address:
|:004683B0   
|
:00472CB0 55                      push ebp
:00472CB1 8BEC                    mov ebp, esp
:00472CB3 6AFF                    push FFFFFFFF
:00472CB5 68345B4800              push 00485B34
:00472CBA 64A100000000            mov eax, dword ptr fs:[00000000]
:00472CC0 50                      push eax
:00472CC1 64892500000000          mov dword ptr fs:[00000000], esp
:00472CC8 51                      push ecx
:00472CC9 894DF0                  mov dword ptr [ebp-10], ecx
:00472CCC 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00472CCF E87CB5F9FF              call 0040E250
:00472CD4 C745FC00000000          mov [ebp-04], 00000000
:00472CDB 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00472CDE 83C15C                  add ecx, 0000005C
:00472CE1 E85A000000              call 00472D40
:00472CE6 C645FC01                mov [ebp-04], 01
:00472CEA 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00472CED 81C1B40D0000            add ecx, 00000DB4
:00472CF3 E888000000              call 00472D80
:00472CF8 C645FC02                mov [ebp-04], 02
:00472CFC 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00472CFF 81C18C0E0000            add ecx, 00000E8C
:00472D05 E886B5F9FF              call 0040E290
:00472D0A 8B45F0                  mov eax, dword ptr [ebp-10]
:00472D0D C700E8704800            mov dword ptr [eax], 004870E8
:00472D13 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00472D16 C7415000000000          mov [ecx+50], 00000000
:00472D1D 8B55F0                  mov edx, dword ptr [ebp-10]
:00472D20 C7425400000000          mov [edx+54], 00000000
:00472D27 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00472D2E 8B45F0                  mov eax, dword ptr [ebp-10]
:00472D31 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00472D34 64890D00000000          mov dword ptr fs:[00000000], ecx
:00472D3B 8BE5                    mov esp, ebp
:00472D3D 5D                      pop ebp
:00472D3E C3                      ret


:00472D3F CC                      int 03

* Referenced by a CALL at Address:
|:00472CE1   
|
:00472D40 55                      push ebp
:00472D41 8BEC                    mov ebp, esp
:00472D43 51                      push ecx
:00472D44 894DFC                  mov dword ptr [ebp-04], ecx
:00472D47 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00472D4A E801B5F9FF              call 0040E250
:00472D4F 8B45FC                  mov eax, dword ptr [ebp-04]
:00472D52 C70040714800            mov dword ptr [eax], 00487140
:00472D58 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00472D5B C7412C15000001          mov [ecx+2C], 01000015
:00472D62 8B55FC                  mov edx, dword ptr [ebp-04]
:00472D65 C7423400000000          mov [edx+34], 00000000
:00472D6C 8B45FC                  mov eax, dword ptr [ebp-04]
:00472D6F 8BE5                    mov esp, ebp
:00472D71 5D                      pop ebp
:00472D72 C3                      ret


:00472D73 CC                      int 03
:00472D74 CC                      int 03
:00472D75 CC                      int 03
:00472D76 CC                      int 03
:00472D77 CC                      int 03
:00472D78 CC                      int 03
:00472D79 CC                      int 03
:00472D7A CC                      int 03
:00472D7B CC                      int 03
:00472D7C CC                      int 03
:00472D7D CC                      int 03
:00472D7E CC                      int 03
:00472D7F CC                      int 03

* Referenced by a CALL at Address:
|:00472CF3   
|
:00472D80 55                      push ebp
:00472D81 8BEC                    mov ebp, esp
:00472D83 51                      push ecx
:00472D84 894DFC                  mov dword ptr [ebp-04], ecx
:00472D87 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00472D8A E8C1B4F9FF              call 0040E250
:00472D8F 8B45FC                  mov eax, dword ptr [ebp-04]
:00472D92 C70098714800            mov dword ptr [eax], 00487198
:00472D98 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00472D9B C7412C15000001          mov [ecx+2C], 01000015
:00472DA2 8B55FC                  mov edx, dword ptr [ebp-04]
:00472DA5 C7423400000000          mov [edx+34], 00000000
:00472DAC 8B45FC                  mov eax, dword ptr [ebp-04]
:00472DAF 8BE5                    mov esp, ebp
:00472DB1 5D                      pop ebp
:00472DB2 C3                      ret


:00472DB3 CC                      int 03
:00472DB4 CC                      int 03
:00472DB5 CC                      int 03
:00472DB6 CC                      int 03
:00472DB7 CC                      int 03
:00472DB8 CC                      int 03
:00472DB9 CC                      int 03
:00472DBA CC                      int 03
:00472DBB CC                      int 03
:00472DBC CC                      int 03
:00472DBD CC                      int 03
:00472DBE CC                      int 03
:00472DBF CC                      int 03
:00472DC0 55                      push ebp
:00472DC1 8BEC                    mov ebp, esp
:00472DC3 51                      push ecx
:00472DC4 894DFC                  mov dword ptr [ebp-04], ecx
:00472DC7 33C0                    xor eax, eax
:00472DC9 837D0800                cmp dword ptr [ebp+08], 00000000
:00472DCD 0F9DC0                  setnl al
:00472DD0 8BE5                    mov esp, ebp
:00472DD2 5D                      pop ebp
:00472DD3 C20400                  ret 0004


:00472DD6 CC                      int 03
:00472DD7 CC                      int 03
:00472DD8 CC                      int 03
:00472DD9 CC                      int 03
:00472DDA CC                      int 03
:00472DDB CC                      int 03
:00472DDC CC                      int 03
:00472DDD CC                      int 03
:00472DDE CC                      int 03
:00472DDF CC                      int 03

* Referenced by a CALL at Addresses:
|:004683DC   , :00485874   
|
:00472DE0 55                      push ebp
:00472DE1 8BEC                    mov ebp, esp
:00472DE3 6AFF                    push FFFFFFFF
:00472DE5 68645B4800              push 00485B64
:00472DEA 64A100000000            mov eax, dword ptr fs:[00000000]
:00472DF0 50                      push eax
:00472DF1 64892500000000          mov dword ptr fs:[00000000], esp
:00472DF8 51                      push ecx
:00472DF9 894DF0                  mov dword ptr [ebp-10], ecx
:00472DFC C745FC02000000          mov [ebp-04], 00000002
:00472E03 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00472E06 81C18C0E0000            add ecx, 00000E8C
:00472E0C E8DFB3F9FF              call 0040E1F0
:00472E11 C645FC01                mov [ebp-04], 01
:00472E15 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00472E18 81C1B40D0000            add ecx, 00000DB4
:00472E1E E86D290000              call 00475790
:00472E23 C645FC00                mov [ebp-04], 00
:00472E27 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00472E2A 83C15C                  add ecx, 0000005C
:00472E2D E85E290000              call 00475790
:00472E32 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00472E39 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00472E3C E8EF290000              call 00475830
:00472E41 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00472E44 64890D00000000          mov dword ptr fs:[00000000], ecx
:00472E4B 8BE5                    mov esp, ebp
:00472E4D 5D                      pop ebp
:00472E4E C3                      ret


:00472E4F CC                      int 03

* Referenced by a CALL at Addresses:
|:00468983   , :0046B4D4   
|
:00472E50 55                      push ebp
:00472E51 8BEC                    mov ebp, esp
:00472E53 51                      push ecx
:00472E54 894DFC                  mov dword ptr [ebp-04], ecx
:00472E57 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00472E5A E831000000              call 00472E90
:00472E5F 8B45FC                  mov eax, dword ptr [ebp-04]
:00472E62 C700F0714800            mov dword ptr [eax], 004871F0
:00472E68 8B45FC                  mov eax, dword ptr [ebp-04]
:00472E6B 8BE5                    mov esp, ebp
:00472E6D 5D                      pop ebp
:00472E6E C3                      ret


:00472E6F CC                      int 03
:00472E70 55                      push ebp
:00472E71 8BEC                    mov ebp, esp
:00472E73 51                      push ecx
:00472E74 894DFC                  mov dword ptr [ebp-04], ecx
:00472E77 6A00                    push 00000000
:00472E79 8B45FC                  mov eax, dword ptr [ebp-04]
:00472E7C 8B4804                  mov ecx, dword ptr [eax+04]
:00472E7F 51                      push ecx
:00472E80 FF15D4624800            call dword ptr [004862D4]
:00472E86 8BE5                    mov esp, ebp
:00472E88 5D                      pop ebp
:00472E89 C3                      ret


:00472E8A CC                      int 03
:00472E8B CC                      int 03
:00472E8C CC                      int 03
:00472E8D CC                      int 03
:00472E8E CC                      int 03
:00472E8F CC                      int 03

* Referenced by a CALL at Addresses:
|:0046DA9C   , :00472E5A   
|
:00472E90 55                      push ebp
:00472E91 8BEC                    mov ebp, esp
:00472E93 51                      push ecx
:00472E94 894DFC                  mov dword ptr [ebp-04], ecx
:00472E97 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00472E9A E801B5F9FF              call 0040E3A0
:00472E9F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00472EA2 83C10C                  add ecx, 0000000C
:00472EA5 E826000000              call 00472ED0
:00472EAA 8B45FC                  mov eax, dword ptr [ebp-04]
:00472EAD C7403800000000          mov [eax+38], 00000000
:00472EB4 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00472EB7 C70120724800            mov dword ptr [ecx], 00487220
:00472EBD 8B45FC                  mov eax, dword ptr [ebp-04]
:00472EC0 8BE5                    mov esp, ebp
:00472EC2 5D                      pop ebp
:00472EC3 C3                      ret


:00472EC4 CC                      int 03
:00472EC5 CC                      int 03
:00472EC6 CC                      int 03
:00472EC7 CC                      int 03
:00472EC8 CC                      int 03
:00472EC9 CC                      int 03
:00472ECA CC                      int 03
:00472ECB CC                      int 03
:00472ECC CC                      int 03
:00472ECD CC                      int 03
:00472ECE CC                      int 03
:00472ECF CC                      int 03

* Referenced by a CALL at Addresses:
|:0046DA3F   , :00472EA5   
|
:00472ED0 55                      push ebp
:00472ED1 8BEC                    mov ebp, esp
:00472ED3 51                      push ecx
:00472ED4 894DFC                  mov dword ptr [ebp-04], ecx
:00472ED7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00472EDA E801B5F9FF              call 0040E3E0
:00472EDF 8B45FC                  mov eax, dword ptr [ebp-04]
:00472EE2 C70050724800            mov dword ptr [eax], 00487250
:00472EE8 8B45FC                  mov eax, dword ptr [ebp-04]
:00472EEB 8BE5                    mov esp, ebp
:00472EED 5D                      pop ebp
:00472EEE C3                      ret


:00472EEF CC                      int 03

* Referenced by a CALL at Addresses:
|:004689E2   , :00468B23   , :0046B5CB   , :00485887   , :004858DD   
|
:00472EF0 55                      push ebp
:00472EF1 8BEC                    mov ebp, esp
:00472EF3 51                      push ecx
:00472EF4 894DFC                  mov dword ptr [ebp-04], ecx
:00472EF7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00472EFA E811000000              call 00472F10
:00472EFF 8BE5                    mov esp, ebp
:00472F01 5D                      pop ebp
:00472F02 C3                      ret


:00472F03 CC                      int 03
:00472F04 CC                      int 03
:00472F05 CC                      int 03
:00472F06 CC                      int 03
:00472F07 CC                      int 03
:00472F08 CC                      int 03
:00472F09 CC                      int 03
:00472F0A CC                      int 03
:00472F0B CC                      int 03
:00472F0C CC                      int 03
:00472F0D CC                      int 03
:00472F0E CC                      int 03
:00472F0F CC                      int 03

* Referenced by a CALL at Addresses:
|:0046DAFD   , :00472EFA   , :0048594C   
|
:00472F10 55                      push ebp
:00472F11 8BEC                    mov ebp, esp
:00472F13 51                      push ecx
:00472F14 894DFC                  mov dword ptr [ebp-04], ecx
:00472F17 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00472F1A 83C10C                  add ecx, 0000000C
:00472F1D E86EB0F9FF              call 0040DF90
:00472F22 8BE5                    mov esp, ebp
:00472F24 5D                      pop ebp
:00472F25 C3                      ret


:00472F26 CC                      int 03
:00472F27 CC                      int 03
:00472F28 CC                      int 03
:00472F29 CC                      int 03
:00472F2A CC                      int 03
:00472F2B CC                      int 03
:00472F2C CC                      int 03
:00472F2D CC                      int 03
:00472F2E CC                      int 03
:00472F2F CC                      int 03

* Referenced by a CALL at Addresses:
|:0044179F   , :0046852D   , :0046872B   , :0046BB7E   , :0046BCBC   
|
:00472F30 55                      push ebp
:00472F31 8BEC                    mov ebp, esp
:00472F33 51                      push ecx
:00472F34 894DFC                  mov dword ptr [ebp-04], ecx
:00472F37 8B45FC                  mov eax, dword ptr [ebp-04]
:00472F3A 8B4020                  mov eax, dword ptr [eax+20]
:00472F3D 8BE5                    mov esp, ebp
:00472F3F 5D                      pop ebp
:00472F40 C3                      ret


:00472F41 CC                      int 03
:00472F42 CC                      int 03
:00472F43 CC                      int 03
:00472F44 CC                      int 03
:00472F45 CC                      int 03
:00472F46 CC                      int 03
:00472F47 CC                      int 03
:00472F48 CC                      int 03
:00472F49 CC                      int 03
:00472F4A CC                      int 03
:00472F4B CC                      int 03
:00472F4C CC                      int 03
:00472F4D CC                      int 03
:00472F4E CC                      int 03
:00472F4F CC                      int 03

* Referenced by a CALL at Addresses:
|:0046A960   , :004730DA   
|
:00472F50 55                      push ebp
:00472F51 8BEC                    mov ebp, esp
:00472F53 51                      push ecx
:00472F54 894DFC                  mov dword ptr [ebp-04], ecx
:00472F57 68F02F4700              push 00472FF0
:00472F5C 6A03                    push 00000003
:00472F5E 6A20                    push 00000020
:00472F60 8B45FC                  mov eax, dword ptr [ebp-04]
:00472F63 83C030                  add eax, 00000030
:00472F66 50                      push eax
:00472F67 E81404F9FF              call 00403380
:00472F6C 68F0E14000              push 0040E1F0

* Possible StringData Ref from Code Obj ->"UjhXH"
                                  |
:00472F71 6822334600              push 00463322
:00472F76 6A03                    push 00000003
:00472F78 6A14                    push 00000014
:00472F7A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00472F7D 81C190000000            add ecx, 00000090
:00472F83 51                      push ecx
:00472F84 E8B7E40000              call 00481440
:00472F89 8B55FC                  mov edx, dword ptr [ebp-04]
:00472F8C C70278724800            mov dword ptr [edx], 00487278
:00472F92 8B45FC                  mov eax, dword ptr [ebp-04]
:00472F95 C7400400000000          mov [eax+04], 00000000
:00472F9C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00472F9F C7412000000000          mov [ecx+20], 00000000
:00472FA6 8B55FC                  mov edx, dword ptr [ebp-04]
:00472FA9 C7422400000000          mov [edx+24], 00000000
:00472FB0 8B45FC                  mov eax, dword ptr [ebp-04]
:00472FB3 C6402803                mov [eax+28], 03
:00472FB7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00472FBA C7412C00000000          mov [ecx+2C], 00000000
:00472FC1 8B45FC                  mov eax, dword ptr [ebp-04]
:00472FC4 8BE5                    mov esp, ebp
:00472FC6 5D                      pop ebp
:00472FC7 C3                      ret


:00472FC8 CC                      int 03
:00472FC9 CC                      int 03
:00472FCA CC                      int 03
:00472FCB CC                      int 03
:00472FCC CC                      int 03
:00472FCD CC                      int 03
:00472FCE CC                      int 03
:00472FCF CC                      int 03

* Referenced by a CALL at Addresses:
|:0046A9B0   , :0046C013   
|
:00472FD0 55                      push ebp
:00472FD1 8BEC                    mov ebp, esp
:00472FD3 51                      push ecx
:00472FD4 894DFC                  mov dword ptr [ebp-04], ecx
:00472FD7 8B45FC                  mov eax, dword ptr [ebp-04]
:00472FDA 8B4D08                  mov ecx, dword ptr [ebp+08]
:00472FDD 894824                  mov dword ptr [eax+24], ecx
:00472FE0 8BE5                    mov esp, ebp
:00472FE2 5D                      pop ebp
:00472FE3 C20400                  ret 0004


:00472FE6 CC                      int 03
:00472FE7 CC                      int 03
:00472FE8 CC                      int 03
:00472FE9 CC                      int 03
:00472FEA CC                      int 03
:00472FEB CC                      int 03
:00472FEC CC                      int 03
:00472FED CC                      int 03
:00472FEE CC                      int 03
:00472FEF CC                      int 03
:00472FF0 55                      push ebp
:00472FF1 8BEC                    mov ebp, esp
:00472FF3 51                      push ecx
:00472FF4 894DFC                  mov dword ptr [ebp-04], ecx
:00472FF7 6A26                    push 00000026
:00472FF9 6A00                    push 00000000
:00472FFB 6A00                    push 00000000
:00472FFD 6A00                    push 00000000
:00472FFF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00473002 E8ECE3FEFF              call 004613F3
:00473007 8BE5                    mov esp, ebp
:00473009 5D                      pop ebp
:0047300A C3                      ret


:0047300B CC                      int 03
:0047300C CC                      int 03
:0047300D CC                      int 03
:0047300E CC                      int 03
:0047300F CC                      int 03

* Referenced by a CALL at Address:
|:0046A939   
|
:00473010 55                      push ebp
:00473011 8BEC                    mov ebp, esp
:00473013 51                      push ecx
:00473014 894DFC                  mov dword ptr [ebp-04], ecx
:00473017 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047301A E811000000              call 00473030
:0047301F 8B45FC                  mov eax, dword ptr [ebp-04]
:00473022 C70088724800            mov dword ptr [eax], 00487288
:00473028 8B45FC                  mov eax, dword ptr [ebp-04]
:0047302B 8BE5                    mov esp, ebp
:0047302D 5D                      pop ebp
:0047302E C3                      ret


:0047302F CC                      int 03

* Referenced by a CALL at Addresses:
|:0047301A   , :004730BA   
|
:00473030 55                      push ebp
:00473031 8BEC                    mov ebp, esp
:00473033 51                      push ecx
:00473034 894DFC                  mov dword ptr [ebp-04], ecx
:00473037 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047303A E811B2F9FF              call 0040E250
:0047303F 8B45FC                  mov eax, dword ptr [ebp-04]
:00473042 C700E8724800            mov dword ptr [eax], 004872E8
:00473048 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047304B C7415000000000          mov [ecx+50], 00000000
:00473052 8B45FC                  mov eax, dword ptr [ebp-04]
:00473055 8BE5                    mov esp, ebp
:00473057 5D                      pop ebp
:00473058 C3                      ret


:00473059 CC                      int 03
:0047305A CC                      int 03
:0047305B CC                      int 03
:0047305C CC                      int 03
:0047305D CC                      int 03
:0047305E CC                      int 03
:0047305F CC                      int 03

* Referenced by a CALL at Address:
|:0046A94E   
|
:00473060 55                      push ebp
:00473061 8BEC                    mov ebp, esp
:00473063 51                      push ecx
:00473064 894DFC                  mov dword ptr [ebp-04], ecx
:00473067 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047306A E8E1B1F9FF              call 0040E250
:0047306F 8B45FC                  mov eax, dword ptr [ebp-04]
:00473072 C70048734800            mov dword ptr [eax], 00487348
:00473078 8B45FC                  mov eax, dword ptr [ebp-04]
:0047307B 8BE5                    mov esp, ebp
:0047307D 5D                      pop ebp
:0047307E C3                      ret


:0047307F CC                      int 03

* Referenced by a CALL at Address:
|:0046B737   
|
:00473080 55                      push ebp
:00473081 8BEC                    mov ebp, esp
:00473083 51                      push ecx
:00473084 894DFC                  mov dword ptr [ebp-04], ecx
:00473087 8B4508                  mov eax, dword ptr [ebp+08]
:0047308A 50                      push eax
:0047308B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047308E E82D93FAFF              call 0041C3C0
:00473093 50                      push eax
:00473094 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00473097 E8E70CFFFF              call 00463D83
:0047309C 8BE5                    mov esp, ebp
:0047309E 5D                      pop ebp
:0047309F C20400                  ret 0004


:004730A2 CC                      int 03
:004730A3 CC                      int 03
:004730A4 CC                      int 03
:004730A5 CC                      int 03
:004730A6 CC                      int 03
:004730A7 CC                      int 03
:004730A8 CC                      int 03
:004730A9 CC                      int 03
:004730AA CC                      int 03
:004730AB CC                      int 03
:004730AC CC                      int 03
:004730AD CC                      int 03
:004730AE CC                      int 03
:004730AF CC                      int 03

* Referenced by a CALL at Address:
|:0046BFC7   
|
:004730B0 55                      push ebp
:004730B1 8BEC                    mov ebp, esp
:004730B3 51                      push ecx
:004730B4 894DFC                  mov dword ptr [ebp-04], ecx
:004730B7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004730BA E871FFFFFF              call 00473030
:004730BF 8B45FC                  mov eax, dword ptr [ebp-04]
:004730C2 C700A0734800            mov dword ptr [eax], 004873A0
:004730C8 8B45FC                  mov eax, dword ptr [ebp-04]
:004730CB 8BE5                    mov esp, ebp
:004730CD 5D                      pop ebp
:004730CE C3                      ret


:004730CF CC                      int 03

* Referenced by a CALL at Address:
|:0046BFDC   
|
:004730D0 55                      push ebp
:004730D1 8BEC                    mov ebp, esp
:004730D3 51                      push ecx
:004730D4 894DFC                  mov dword ptr [ebp-04], ecx
:004730D7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004730DA E871FEFFFF              call 00472F50
:004730DF 8B45FC                  mov eax, dword ptr [ebp-04]
:004730E2 C70000744800            mov dword ptr [eax], 00487400
:004730E8 8B45FC                  mov eax, dword ptr [ebp-04]
:004730EB 8BE5                    mov esp, ebp
:004730ED 5D                      pop ebp
:004730EE C3                      ret


:004730EF CC                      int 03

* Referenced by a CALL at Addresses:
|:0046D757   , :00470223   
|
:004730F0 55                      push ebp
:004730F1 8BEC                    mov ebp, esp
:004730F3 51                      push ecx
:004730F4 894DFC                  mov dword ptr [ebp-04], ecx
:004730F7 8B45FC                  mov eax, dword ptr [ebp-04]
:004730FA 8B4D08                  mov ecx, dword ptr [ebp+08]
:004730FD 894808                  mov dword ptr [eax+08], ecx
:00473100 8BE5                    mov esp, ebp
:00473102 5D                      pop ebp
:00473103 C20400                  ret 0004


:00473106 CC                      int 03
:00473107 CC                      int 03
:00473108 CC                      int 03
:00473109 CC                      int 03
:0047310A CC                      int 03
:0047310B CC                      int 03
:0047310C CC                      int 03
:0047310D CC                      int 03
:0047310E CC                      int 03
:0047310F CC                      int 03

* Referenced by a CALL at Address:
|:0046E7B5   
|
:00473110 55                      push ebp
:00473111 8BEC                    mov ebp, esp
:00473113 51                      push ecx
:00473114 894DFC                  mov dword ptr [ebp-04], ecx
:00473117 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047311A E858B2FFFF              call 0046E377
:0047311F 8B4508                  mov eax, dword ptr [ebp+08]
:00473122 83E001                  and eax, 00000001
:00473125 85C0                    test eax, eax
:00473127 740C                    je 00473135
:00473129 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047312C 51                      push ecx
:0047312D E8EEDE0000              call 00481020
:00473132 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00473127(C)
|
:00473135 8B45FC                  mov eax, dword ptr [ebp-04]
:00473138 8BE5                    mov esp, ebp
:0047313A 5D                      pop ebp
:0047313B C20400                  ret 0004


:0047313E CC                      int 03
:0047313F CC                      int 03

* Referenced by a CALL at Address:
|:00471035   
|
:00473140 55                      push ebp
:00473141 8BEC                    mov ebp, esp
:00473143 51                      push ecx
:00473144 894DFC                  mov dword ptr [ebp-04], ecx
:00473147 8B45FC                  mov eax, dword ptr [ebp-04]
:0047314A 8B4018                  mov eax, dword ptr [eax+18]
:0047314D 8BE5                    mov esp, ebp
:0047314F 5D                      pop ebp
:00473150 C3                      ret


:00473151 CC                      int 03
:00473152 CC                      int 03
:00473153 CC                      int 03
:00473154 CC                      int 03
:00473155 CC                      int 03
:00473156 CC                      int 03
:00473157 CC                      int 03
:00473158 CC                      int 03
:00473159 CC                      int 03
:0047315A CC                      int 03
:0047315B CC                      int 03
:0047315C CC                      int 03
:0047315D CC                      int 03
:0047315E CC                      int 03
:0047315F CC                      int 03
:00473160 55                      push ebp
:00473161 8BEC                    mov ebp, esp
:00473163 E802000000              call 0047316A
:00473168 5D                      pop ebp
:00473169 C3                      ret



* Referenced by a CALL at Address:
|:00473163   
|
:0047316A 55                      push ebp
:0047316B 8BEC                    mov ebp, esp
:0047316D B930694B00              mov ecx, 004B6930
:00473172 E875000000              call 004731EC
:00473177 5D                      pop ebp
:00473178 C3                      ret



* Referenced by a CALL at Addresses:
|:0042C066   , :004731F6   
|
:00473179 55                      push ebp
:0047317A 8BEC                    mov ebp, esp
:0047317C 83EC08                  sub esp, 00000008
:0047317F 894DF8                  mov dword ptr [ebp-08], ecx
:00473182 C745FC00000000          mov [ebp-04], 00000000
:00473189 EB09                    jmp 00473194

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004731DF(U)
|
:0047318B 8B45FC                  mov eax, dword ptr [ebp-04]
:0047318E 83C001                  add eax, 00000001
:00473191 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00473189(U)
|
:00473194 837DFC06                cmp dword ptr [ebp-04], 00000006
:00473198 7347                    jnb 004731E1
:0047319A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047319D 8B55F8                  mov edx, dword ptr [ebp-08]
:004731A0 C7048A00000000          mov dword ptr [edx+4*ecx], 00000000
:004731A7 8B45FC                  mov eax, dword ptr [ebp-04]
:004731AA 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004731AD C744811800000000        mov [ecx+4*eax+18], 00000000
:004731B5 8B55FC                  mov edx, dword ptr [ebp-04]
:004731B8 8B45F8                  mov eax, dword ptr [ebp-08]
:004731BB C744903000000000        mov [eax+4*edx+30], 00000000
:004731C3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004731C6 8B55F8                  mov edx, dword ptr [ebp-08]
:004731C9 C7448A4800000000        mov [edx+4*ecx+48], 00000000
:004731D1 8B45FC                  mov eax, dword ptr [ebp-04]
:004731D4 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004731D7 C744816000000000        mov [ecx+4*eax+60], 00000000
:004731DF EBAA                    jmp 0047318B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00473198(C)
|
:004731E1 8B55F8                  mov edx, dword ptr [ebp-08]
:004731E4 C6427800                mov [edx+78], 00
:004731E8 8BE5                    mov esp, ebp
:004731EA 5D                      pop ebp
:004731EB C3                      ret



* Referenced by a CALL at Address:
|:00473172   
|
:004731EC 55                      push ebp
:004731ED 8BEC                    mov ebp, esp
:004731EF 51                      push ecx
:004731F0 894DFC                  mov dword ptr [ebp-04], ecx
:004731F3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004731F6 E87EFFFFFF              call 00473179
:004731FB 8B45FC                  mov eax, dword ptr [ebp-04]
:004731FE 8BE5                    mov esp, ebp
:00473200 5D                      pop ebp
:00473201 C3                      ret



* Referenced by a CALL at Addresses:
|:0042DBE0   , :0042E7CE   , :00448756   , :0046D77C   , :004735F3   
|
:00473202 55                      push ebp
:00473203 8BEC                    mov ebp, esp
:00473205 83EC18                  sub esp, 00000018
:00473208 894DE8                  mov dword ptr [ebp-18], ecx
:0047320B 8B4518                  mov eax, dword ptr [ebp+18]
:0047320E F7D8                    neg eax
:00473210 1BC0                    sbb eax, eax
:00473212 25001E0000              and eax, 00001E00
:00473217 05C08D0100              add eax, 00018DC0
:0047321C 8945F0                  mov dword ptr [ebp-10], eax
:0047321F 8B4D18                  mov ecx, dword ptr [ebp+18]
:00473222 F7D9                    neg ecx
:00473224 1BC9                    sbb ecx, ecx
:00473226 83E195                  and ecx, FFFFFF95
:00473229 81C183000000            add ecx, 00000083
:0047322F 884DFC                  mov byte ptr [ebp-04], cl
:00473232 8B5518                  mov edx, dword ptr [ebp+18]
:00473235 F7DA                    neg edx
:00473237 1BD2                    sbb edx, edx
:00473239 83E293                  and edx, FFFFFF93
:0047323C 81C280000000            add edx, 00000080
:00473242 8855EC                  mov byte ptr [ebp-14], dl
:00473245 E891B3FAFF              call 0041E5DB
:0047324A 8B451C                  mov eax, dword ptr [ebp+1C]
:0047324D 50                      push eax
:0047324E E890980000              call 0047CAE3
:00473253 83C404                  add esp, 00000004

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:00473256 6A07                    push 00000007
:00473258 E86D9F0000              call 0047D1CA
:0047325D 83C404                  add esp, 00000004
:00473260 6A00                    push 00000000
:00473262 6A1F                    push 0000001F
:00473264 6A04                    push 00000004
:00473266 E8869F0000              call 0047D1F1
:0047326B 83C40C                  add esp, 0000000C
:0047326E 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00473271 894DF4                  mov dword ptr [ebp-0C], ecx
:00473274 EB09                    jmp 0047327F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004732CF(U)
|
:00473276 8B55F4                  mov edx, dword ptr [ebp-0C]
:00473279 83C230                  add edx, 00000030
:0047327C 8955F4                  mov dword ptr [ebp-0C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00473274(U)
|
:0047327F 8B450C                  mov eax, dword ptr [ebp+0C]
:00473282 034514                  add eax, dword ptr [ebp+14]
:00473285 3945F4                  cmp dword ptr [ebp-0C], eax
:00473288 7347                    jnb 004732D1
:0047328A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047328D 894DF8                  mov dword ptr [ebp-08], ecx
:00473290 EB09                    jmp 0047329B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004732CD(U)
|
:00473292 8B55F8                  mov edx, dword ptr [ebp-08]
:00473295 83C230                  add edx, 00000030
:00473298 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00473290(U)
|
:0047329B 8B4508                  mov eax, dword ptr [ebp+08]
:0047329E 034510                  add eax, dword ptr [ebp+10]
:004732A1 3945F8                  cmp dword ptr [ebp-08], eax
:004732A4 7329                    jnb 004732CF
:004732A6 6A04                    push 00000004
:004732A8 6A00                    push 00000000
:004732AA 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004732AD 51                      push ecx
:004732AE B950EB4A00              mov ecx, 004AEB50
:004732B3 E888C70000              call 0047FA40
:004732B8 50                      push eax
:004732B9 6A30                    push 00000030
:004732BB 6A30                    push 00000030
:004732BD 8B55F4                  mov edx, dword ptr [ebp-0C]
:004732C0 52                      push edx
:004732C1 8B45F8                  mov eax, dword ptr [ebp-08]
:004732C4 50                      push eax
:004732C5 E8D1AD0000              call 0047E09B
:004732CA 83C414                  add esp, 00000014
:004732CD EBC3                    jmp 00473292

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004732A4(C)
|
:004732CF EBA5                    jmp 00473276

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00473288(C)
|
:004732D1 837D1C00                cmp dword ptr [ebp+1C], 00000000
:004732D5 0F85A4000000            jne 0047337F
:004732DB C745F400000000          mov [ebp-0C], 00000000
:004732E2 EB09                    jmp 004732ED

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00473375(U)
|
:004732E4 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004732E7 83C101                  add ecx, 00000001
:004732EA 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004732E2(U)
|
:004732ED 837DF403                cmp dword ptr [ebp-0C], 00000003
:004732F1 0F8383000000            jnb 0047337A
:004732F7 6A00                    push 00000000
:004732F9 8B55FC                  mov edx, dword ptr [ebp-04]
:004732FC 81E2FF000000            and edx, 000000FF
:00473302 8B45F4                  mov eax, dword ptr [ebp-0C]
:00473305 8D0C42                  lea ecx, dword ptr [edx+2*eax]
:00473308 51                      push ecx
:00473309 6A04                    push 00000004
:0047330B E8E19E0000              call 0047D1F1
:00473310 83C40C                  add esp, 0000000C
:00473313 68FFFF0000              push 0000FFFF
:00473318 8B550C                  mov edx, dword ptr [ebp+0C]
:0047331B 035514                  add edx, dword ptr [ebp+14]
:0047331E 0355F4                  add edx, dword ptr [ebp-0C]
:00473321 52                      push edx
:00473322 8B4508                  mov eax, dword ptr [ebp+08]
:00473325 034510                  add eax, dword ptr [ebp+10]
:00473328 50                      push eax
:00473329 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0047332C 034D14                  add ecx, dword ptr [ebp+14]
:0047332F 034DF4                  add ecx, dword ptr [ebp-0C]
:00473332 51                      push ecx
:00473333 8B5508                  mov edx, dword ptr [ebp+08]
:00473336 0355F4                  add edx, dword ptr [ebp-0C]
:00473339 52                      push edx
:0047333A E87FA10000              call 0047D4BE
:0047333F 83C414                  add esp, 00000014
:00473342 68FFFF0000              push 0000FFFF
:00473347 8B4514                  mov eax, dword ptr [ebp+14]
:0047334A 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0047334D 8D540102                lea edx, dword ptr [ecx+eax+02]
:00473351 52                      push edx
:00473352 8B4508                  mov eax, dword ptr [ebp+08]
:00473355 034510                  add eax, dword ptr [ebp+10]
:00473358 0345F4                  add eax, dword ptr [ebp-0C]
:0047335B 50                      push eax
:0047335C 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0047335F 034DF4                  add ecx, dword ptr [ebp-0C]
:00473362 51                      push ecx
:00473363 8B5508                  mov edx, dword ptr [ebp+08]
:00473366 035510                  add edx, dword ptr [ebp+10]
:00473369 0355F4                  add edx, dword ptr [ebp-0C]
:0047336C 52                      push edx
:0047336D E84CA10000              call 0047D4BE
:00473372 83C414                  add esp, 00000014
:00473375 E96AFFFFFF              jmp 004732E4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004732F1(C)
|
:0047337A E995000000              jmp 00473414

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004732D5(C)
|
:0047337F C745F400000000          mov [ebp-0C], 00000000
:00473386 EB09                    jmp 00473391

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047340F(U)
|
:00473388 8B45F4                  mov eax, dword ptr [ebp-0C]
:0047338B 83C001                  add eax, 00000001
:0047338E 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00473386(U)
|
:00473391 837DF403                cmp dword ptr [ebp-0C], 00000003
:00473395 737D                    jnb 00473414
:00473397 6A00                    push 00000000
:00473399 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047339C 81E1FF000000            and ecx, 000000FF
:004733A2 8B55F4                  mov edx, dword ptr [ebp-0C]
:004733A5 8D0451                  lea eax, dword ptr [ecx+2*edx]
:004733A8 50                      push eax
:004733A9 6A04                    push 00000004
:004733AB E8419E0000              call 0047D1F1
:004733B0 83C40C                  add esp, 0000000C
:004733B3 68FFFF0000              push 0000FFFF
:004733B8 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004733BB 034D14                  add ecx, dword ptr [ebp+14]
:004733BE 034DF4                  add ecx, dword ptr [ebp-0C]
:004733C1 51                      push ecx
:004733C2 8B5508                  mov edx, dword ptr [ebp+08]
:004733C5 035510                  add edx, dword ptr [ebp+10]
:004733C8 52                      push edx
:004733C9 8B450C                  mov eax, dword ptr [ebp+0C]
:004733CC 034514                  add eax, dword ptr [ebp+14]
:004733CF 0345F4                  add eax, dword ptr [ebp-0C]
:004733D2 50                      push eax
:004733D3 8B4D08                  mov ecx, dword ptr [ebp+08]
:004733D6 51                      push ecx
:004733D7 E8E2A00000              call 0047D4BE
:004733DC 83C414                  add esp, 00000014
:004733DF 68FFFF0000              push 0000FFFF
:004733E4 8B5514                  mov edx, dword ptr [ebp+14]
:004733E7 8B450C                  mov eax, dword ptr [ebp+0C]
:004733EA 8D4C1002                lea ecx, dword ptr [eax+edx+02]
:004733EE 51                      push ecx
:004733EF 8B5508                  mov edx, dword ptr [ebp+08]
:004733F2 035510                  add edx, dword ptr [ebp+10]
:004733F5 0355F4                  add edx, dword ptr [ebp-0C]
:004733F8 52                      push edx
:004733F9 8B450C                  mov eax, dword ptr [ebp+0C]
:004733FC 50                      push eax
:004733FD 8B4D08                  mov ecx, dword ptr [ebp+08]
:00473400 034D10                  add ecx, dword ptr [ebp+10]
:00473403 034DF4                  add ecx, dword ptr [ebp-0C]
:00473406 51                      push ecx
:00473407 E8B2A00000              call 0047D4BE
:0047340C 83C414                  add esp, 00000014
:0047340F E974FFFFFF              jmp 00473388

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047337A(U), :00473395(C)
|
:00473414 6A00                    push 00000000
:00473416 8B55EC                  mov edx, dword ptr [ebp-14]
:00473419 81E2FF000000            and edx, 000000FF
:0047341F 52                      push edx
:00473420 6A04                    push 00000004
:00473422 E8CA9D0000              call 0047D1F1
:00473427 83C40C                  add esp, 0000000C
:0047342A 68FFFF0000              push 0000FFFF
:0047342F 8B450C                  mov eax, dword ptr [ebp+0C]
:00473432 83E801                  sub eax, 00000001
:00473435 50                      push eax
:00473436 8B4D08                  mov ecx, dword ptr [ebp+08]
:00473439 034D10                  add ecx, dword ptr [ebp+10]
:0047343C 51                      push ecx
:0047343D 8B550C                  mov edx, dword ptr [ebp+0C]
:00473440 83EA01                  sub edx, 00000001
:00473443 52                      push edx
:00473444 8B4508                  mov eax, dword ptr [ebp+08]
:00473447 50                      push eax
:00473448 E871A00000              call 0047D4BE
:0047344D 83C414                  add esp, 00000014
:00473450 68FFFF0000              push 0000FFFF
:00473455 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00473458 034D14                  add ecx, dword ptr [ebp+14]
:0047345B 51                      push ecx
:0047345C 8B5508                  mov edx, dword ptr [ebp+08]
:0047345F 83EA01                  sub edx, 00000001
:00473462 52                      push edx
:00473463 8B450C                  mov eax, dword ptr [ebp+0C]
:00473466 83E801                  sub eax, 00000001
:00473469 50                      push eax
:0047346A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047346D 83E901                  sub ecx, 00000001
:00473470 51                      push ecx
:00473471 E848A00000              call 0047D4BE
:00473476 83C414                  add esp, 00000014
:00473479 6A00                    push 00000000
:0047347B 6A1F                    push 0000001F
:0047347D 6A04                    push 00000004
:0047347F E86D9D0000              call 0047D1F1
:00473484 83C40C                  add esp, 0000000C
:00473487 6A00                    push 00000000
:00473489 E855960000              call 0047CAE3
:0047348E 83C404                  add esp, 00000004
:00473491 E860B1FAFF              call 0041E5F6
:00473496 8BE5                    mov esp, ebp
:00473498 5D                      pop ebp
:00473499 C21800                  ret 0018



* Referenced by a CALL at Address:
|:004735D5   
|
:0047349C 55                      push ebp
:0047349D 8BEC                    mov ebp, esp
:0047349F 83EC0C                  sub esp, 0000000C
:004734A2 894DF4                  mov dword ptr [ebp-0C], ecx
:004734A5 6A01                    push 00000001
:004734A7 8B4508                  mov eax, dword ptr [ebp+08]
:004734AA 50                      push eax
:004734AB E8EEC50000              call 0047FA9E
:004734B0 83C408                  add esp, 00000008
:004734B3 894508                  mov dword ptr [ebp+08], eax
:004734B6 6A01                    push 00000001
:004734B8 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004734BB 51                      push ecx
:004734BC E8DDC50000              call 0047FA9E
:004734C1 83C408                  add esp, 00000008
:004734C4 89450C                  mov dword ptr [ebp+0C], eax
:004734C7 8B5510                  mov edx, dword ptr [ebp+10]
:004734CA 83C204                  add edx, 00000004
:004734CD 895510                  mov dword ptr [ebp+10], edx
:004734D0 8B4514                  mov eax, dword ptr [ebp+14]
:004734D3 83C004                  add eax, 00000004
:004734D6 894514                  mov dword ptr [ebp+14], eax
:004734D9 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004734DC 33D2                    xor edx, edx
:004734DE 8A5178                  mov dl, byte ptr [ecx+78]
:004734E1 8B45F4                  mov eax, dword ptr [ebp-0C]
:004734E4 8B4D08                  mov ecx, dword ptr [ebp+08]
:004734E7 890C90                  mov dword ptr [eax+4*edx], ecx
:004734EA 8B55F4                  mov edx, dword ptr [ebp-0C]
:004734ED 33C0                    xor eax, eax
:004734EF 8A4278                  mov al, byte ptr [edx+78]
:004734F2 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004734F5 8B550C                  mov edx, dword ptr [ebp+0C]
:004734F8 89548118                mov dword ptr [ecx+4*eax+18], edx
:004734FC 8B45F4                  mov eax, dword ptr [ebp-0C]
:004734FF 33C9                    xor ecx, ecx
:00473501 8A4878                  mov cl, byte ptr [eax+78]
:00473504 8B55F4                  mov edx, dword ptr [ebp-0C]
:00473507 8B4510                  mov eax, dword ptr [ebp+10]
:0047350A 89448A30                mov dword ptr [edx+4*ecx+30], eax
:0047350E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00473511 33D2                    xor edx, edx
:00473513 8A5178                  mov dl, byte ptr [ecx+78]
:00473516 8B45F4                  mov eax, dword ptr [ebp-0C]
:00473519 8B4D14                  mov ecx, dword ptr [ebp+14]
:0047351C 894C9048                mov dword ptr [eax+4*edx+48], ecx
:00473520 8B5510                  mov edx, dword ptr [ebp+10]
:00473523 0FAF5514                imul edx, dword ptr [ebp+14]
:00473527 8B45F4                  mov eax, dword ptr [ebp-0C]
:0047352A 33C9                    xor ecx, ecx
:0047352C 8A4878                  mov cl, byte ptr [eax+78]
:0047352F 8B45F4                  mov eax, dword ptr [ebp-0C]
:00473532 89548860                mov dword ptr [eax+4*ecx+60], edx
:00473536 C745F800000000          mov [ebp-08], 00000000
:0047353D C745FC00000000          mov [ebp-04], 00000000
:00473544 EB09                    jmp 0047354F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047356C(U)
|
:00473546 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00473549 83C101                  add ecx, 00000001
:0047354C 894DF8                  mov dword ptr [ebp-08], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00473544(U)
|
:0047354F 8B55F4                  mov edx, dword ptr [ebp-0C]
:00473552 33C0                    xor eax, eax
:00473554 8A4278                  mov al, byte ptr [edx+78]
:00473557 3945F8                  cmp dword ptr [ebp-08], eax
:0047355A 7312                    jnb 0047356E
:0047355C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047355F 8B55F4                  mov edx, dword ptr [ebp-0C]
:00473562 8B45FC                  mov eax, dword ptr [ebp-04]
:00473565 03448A60                add eax, dword ptr [edx+4*ecx+60]
:00473569 8945FC                  mov dword ptr [ebp-04], eax
:0047356C EBD8                    jmp 00473546

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047355A(C)
|
:0047356E 8B55F4                  mov edx, dword ptr [ebp-0C]
:00473571 33C0                    xor eax, eax
:00473573 8A4278                  mov al, byte ptr [edx+78]
:00473576 83F806                  cmp eax, 00000006
:00473579 7D0F                    jge 0047358A
:0047357B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047357E 8A5178                  mov dl, byte ptr [ecx+78]
:00473581 80C201                  add dl, 01
:00473584 8B45F4                  mov eax, dword ptr [ebp-0C]
:00473587 885078                  mov byte ptr [eax+78], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00473579(C)
|
:0047358A 6A04                    push 00000004
:0047358C 6A00                    push 00000000
:0047358E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00473591 51                      push ecx
:00473592 B968AB4A00              mov ecx, 004AAB68
:00473597 E8A4C40000              call 0047FA40
:0047359C 50                      push eax
:0047359D 8B5514                  mov edx, dword ptr [ebp+14]
:004735A0 52                      push edx
:004735A1 8B4510                  mov eax, dword ptr [ebp+10]
:004735A4 50                      push eax
:004735A5 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004735A8 51                      push ecx
:004735A9 8B5508                  mov edx, dword ptr [ebp+08]
:004735AC 52                      push edx
:004735AD E86DB0FAFF              call 0041E61F
:004735B2 83C414                  add esp, 00000014
:004735B5 8BE5                    mov esp, ebp
:004735B7 5D                      pop ebp
:004735B8 C21000                  ret 0010



* Referenced by a CALL at Addresses:
|:0040862D   , :0042D07F   , :0042D83A   , :0042D930   , :0042DE8D   
|:0042E7F2   , :0042F605   
|
:004735BB 55                      push ebp
:004735BC 8BEC                    mov ebp, esp
:004735BE 51                      push ecx
:004735BF 894DFC                  mov dword ptr [ebp-04], ecx
:004735C2 8B4514                  mov eax, dword ptr [ebp+14]
:004735C5 50                      push eax
:004735C6 8B4D10                  mov ecx, dword ptr [ebp+10]
:004735C9 51                      push ecx
:004735CA 8B550C                  mov edx, dword ptr [ebp+0C]
:004735CD 52                      push edx
:004735CE 8B4508                  mov eax, dword ptr [ebp+08]
:004735D1 50                      push eax
:004735D2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004735D5 E8C2FEFFFF              call 0047349C
:004735DA 6A00                    push 00000000
:004735DC 8B4D18                  mov ecx, dword ptr [ebp+18]
:004735DF 51                      push ecx
:004735E0 8B5514                  mov edx, dword ptr [ebp+14]
:004735E3 52                      push edx
:004735E4 8B4510                  mov eax, dword ptr [ebp+10]
:004735E7 50                      push eax
:004735E8 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004735EB 51                      push ecx
:004735EC 8B5508                  mov edx, dword ptr [ebp+08]
:004735EF 52                      push edx
:004735F0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004735F3 E80AFCFFFF              call 00473202
:004735F8 8BE5                    mov esp, ebp
:004735FA 5D                      pop ebp
:004735FB C21400                  ret 0014



* Referenced by a CALL at Address:
|:0047362F   
|
:004735FE 55                      push ebp
:004735FF 8BEC                    mov ebp, esp
:00473601 51                      push ecx
:00473602 894DFC                  mov dword ptr [ebp-04], ecx
:00473605 8B45FC                  mov eax, dword ptr [ebp-04]
:00473608 33C9                    xor ecx, ecx
:0047360A 8A4878                  mov cl, byte ptr [eax+78]
:0047360D 85C9                    test ecx, ecx
:0047360F 7E0E                    jle 0047361F
:00473611 8B55FC                  mov edx, dword ptr [ebp-04]
:00473614 8A4278                  mov al, byte ptr [edx+78]
:00473617 2C01                    sub al, 01
:00473619 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047361C 884178                  mov byte ptr [ecx+78], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047360F(C)
|
:0047361F 8BE5                    mov esp, ebp
:00473621 5D                      pop ebp
:00473622 C3                      ret



* Referenced by a CALL at Addresses:
|:0040892A   , :0042D55B   , :0042DD90   , :0042E41F   , :0042F00B   
|:0042F68B   
|
:00473623 55                      push ebp
:00473624 8BEC                    mov ebp, esp
:00473626 83EC0C                  sub esp, 0000000C
:00473629 894DF4                  mov dword ptr [ebp-0C], ecx
:0047362C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047362F E8CAFFFFFF              call 004735FE
:00473634 C745F800000000          mov [ebp-08], 00000000
:0047363B C745FC00000000          mov [ebp-04], 00000000
:00473642 EB09                    jmp 0047364D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047366A(U)
|
:00473644 8B45F8                  mov eax, dword ptr [ebp-08]
:00473647 83C001                  add eax, 00000001
:0047364A 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00473642(U)
|
:0047364D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00473650 33D2                    xor edx, edx
:00473652 8A5178                  mov dl, byte ptr [ecx+78]
:00473655 3955F8                  cmp dword ptr [ebp-08], edx
:00473658 7312                    jnb 0047366C
:0047365A 8B45F8                  mov eax, dword ptr [ebp-08]
:0047365D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00473660 8B55FC                  mov edx, dword ptr [ebp-04]
:00473663 03548160                add edx, dword ptr [ecx+4*eax+60]
:00473667 8955FC                  mov dword ptr [ebp-04], edx
:0047366A EBD8                    jmp 00473644

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00473658(C)
|
:0047366C 6A00                    push 00000000
:0047366E E870940000              call 0047CAE3
:00473673 83C404                  add esp, 00000004
:00473676 6A00                    push 00000000
:00473678 6A1F                    push 0000001F
:0047367A 6A04                    push 00000004
:0047367C E8709B0000              call 0047D1F1
:00473681 83C40C                  add esp, 0000000C
:00473684 E852AFFAFF              call 0041E5DB
:00473689 6A04                    push 00000004
:0047368B 6A00                    push 00000000
:0047368D 8B45FC                  mov eax, dword ptr [ebp-04]
:00473690 50                      push eax
:00473691 B968AB4A00              mov ecx, 004AAB68
:00473696 E8A5C30000              call 0047FA40
:0047369B 50                      push eax
:0047369C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047369F 33D2                    xor edx, edx
:004736A1 8A5178                  mov dl, byte ptr [ecx+78]
:004736A4 8B45F4                  mov eax, dword ptr [ebp-0C]
:004736A7 8B4C9048                mov ecx, dword ptr [eax+4*edx+48]
:004736AB 51                      push ecx
:004736AC 8B55F4                  mov edx, dword ptr [ebp-0C]
:004736AF 33C0                    xor eax, eax
:004736B1 8A4278                  mov al, byte ptr [edx+78]
:004736B4 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004736B7 8B548130                mov edx, dword ptr [ecx+4*eax+30]
:004736BB 52                      push edx
:004736BC 8B45F4                  mov eax, dword ptr [ebp-0C]
:004736BF 33C9                    xor ecx, ecx
:004736C1 8A4878                  mov cl, byte ptr [eax+78]
:004736C4 8B55F4                  mov edx, dword ptr [ebp-0C]
:004736C7 8B448A18                mov eax, dword ptr [edx+4*ecx+18]
:004736CB 50                      push eax
:004736CC 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004736CF 33D2                    xor edx, edx
:004736D1 8A5178                  mov dl, byte ptr [ecx+78]
:004736D4 8B45F4                  mov eax, dword ptr [ebp-0C]
:004736D7 8B0C90                  mov ecx, dword ptr [eax+4*edx]
:004736DA 51                      push ecx
:004736DB E8BBA90000              call 0047E09B
:004736E0 83C414                  add esp, 00000014
:004736E3 E80EAFFAFF              call 0041E5F6
:004736E8 8BE5                    mov esp, ebp
:004736EA 5D                      pop ebp
:004736EB C3                      ret



* Referenced by a CALL at Address:
|:0042E8FE   
|
:004736EC 55                      push ebp
:004736ED 8BEC                    mov ebp, esp
:004736EF 51                      push ecx
:004736F0 894DFC                  mov dword ptr [ebp-04], ecx
:004736F3 6A01                    push 00000001
:004736F5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004736F8 E8E8030000              call 00473AE5
:004736FD 6A03                    push 00000003
:004736FF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00473702 E8DE030000              call 00473AE5
:00473707 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047370A E8E0040000              call 00473BEF
:0047370F 6A00                    push 00000000
:00473711 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00473714 E8CC030000              call 00473AE5
:00473719 8BE5                    mov esp, ebp
:0047371B 5D                      pop ebp
:0047371C C3                      ret



* Referenced by a CALL at Address:
|:0042ED6B   
|
:0047371D 55                      push ebp
:0047371E 8BEC                    mov ebp, esp
:00473720 83EC1C                  sub esp, 0000001C
:00473723 894DE4                  mov dword ptr [ebp-1C], ecx
:00473726 B9B07F4900              mov ecx, 00497FB0
:0047372B E89224FBFF              call 00425BC2
:00473730 B9B07F4900              mov ecx, 00497FB0
:00473735 E8EC24FBFF              call 00425C26
:0047373A 8945FC                  mov dword ptr [ebp-04], eax
:0047373D B9B07F4900              mov ecx, 00497FB0
:00473742 E8F024FBFF              call 00425C37
:00473747 8945F8                  mov dword ptr [ebp-08], eax
:0047374A 8B45E4                  mov eax, dword ptr [ebp-1C]
:0047374D 8B4814                  mov ecx, dword ptr [eax+14]
:00473750 894DF4                  mov dword ptr [ebp-0C], ecx
:00473753 8B55E4                  mov edx, dword ptr [ebp-1C]
:00473756 8B45FC                  mov eax, dword ptr [ebp-04]
:00473759 3B02                    cmp eax, dword ptr [edx]
:0047375B 0F8CB9020000            jl 00473A1A
:00473761 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00473764 8B55F8                  mov edx, dword ptr [ebp-08]
:00473767 3B5104                  cmp edx, dword ptr [ecx+04]
:0047376A 0F8CAA020000            jl 00473A1A
:00473770 8B45E4                  mov eax, dword ptr [ebp-1C]
:00473773 8B08                    mov ecx, dword ptr [eax]
:00473775 83C110                  add ecx, 00000010
:00473778 394DFC                  cmp dword ptr [ebp-04], ecx
:0047377B 0F8D99020000            jnl 00473A1A
:00473781 8B55E4                  mov edx, dword ptr [ebp-1C]
:00473784 8B4204                  mov eax, dword ptr [edx+04]
:00473787 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0047378A 034108                  add eax, dword ptr [ecx+08]
:0047378D 3945F8                  cmp dword ptr [ebp-08], eax
:00473790 0F8D84020000            jnl 00473A1A
:00473796 B9B07F4900              mov ecx, 00497FB0
:0047379B E86D24FBFF              call 00425C0D
:004737A0 83F801                  cmp eax, 00000001
:004737A3 0F8571020000            jne 00473A1A
:004737A9 8B55E4                  mov edx, dword ptr [ebp-1C]
:004737AC 8B45F8                  mov eax, dword ptr [ebp-08]
:004737AF 3B4204                  cmp eax, dword ptr [edx+04]
:004737B2 7C48                    jl 004737FC
:004737B4 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004737B7 8B5104                  mov edx, dword ptr [ecx+04]
:004737BA 83C210                  add edx, 00000010
:004737BD 3955F8                  cmp dword ptr [ebp-08], edx
:004737C0 7D3A                    jge 004737FC
:004737C2 8B45E4                  mov eax, dword ptr [ebp-1C]
:004737C5 83781400                cmp dword ptr [eax+14], 00000000
:004737C9 762C                    jbe 004737F7
:004737CB 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004737CE 83E901                  sub ecx, 00000001
:004737D1 894DF4                  mov dword ptr [ebp-0C], ecx
:004737D4 6A02                    push 00000002
:004737D6 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004737D9 E807030000              call 00473AE5
:004737DE B9B07F4900              mov ecx, 00497FB0
:004737E3 E87E28FBFF              call 00426066
:004737E8 E8138EFBFF              call 0042C600
:004737ED 6A01                    push 00000001
:004737EF 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004737F2 E8EE020000              call 00473AE5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004737C9(C)
|
:004737F7 E91E020000              jmp 00473A1A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004737B2(C), :004737C0(C)
|
:004737FC 8B55E4                  mov edx, dword ptr [ebp-1C]
:004737FF 8B4204                  mov eax, dword ptr [edx+04]
:00473802 83C010                  add eax, 00000010
:00473805 3945F8                  cmp dword ptr [ebp-08], eax
:00473808 7C42                    jl 0047384C
:0047380A 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0047380D E87E0A0000              call 00474290
:00473812 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00473815 8B5104                  mov edx, dword ptr [ecx+04]
:00473818 03D0                    add edx, eax
:0047381A 3955F8                  cmp dword ptr [ebp-08], edx
:0047381D 7D2D                    jge 0047384C
:0047381F 8B45E4                  mov eax, dword ptr [ebp-1C]
:00473822 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00473825 8B5014                  mov edx, dword ptr [eax+14]
:00473828 3B510C                  cmp edx, dword ptr [ecx+0C]
:0047382B 7709                    ja 00473836
:0047382D C745F400000000          mov [ebp-0C], 00000000
:00473834 EB0C                    jmp 00473842

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047382B(C)
|
:00473836 8B45E4                  mov eax, dword ptr [ebp-1C]
:00473839 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047383C 2B480C                  sub ecx, dword ptr [eax+0C]
:0047383F 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00473834(U)
|
:00473842 E8B98DFBFF              call 0042C600
:00473847 E9CE010000              jmp 00473A1A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00473808(C), :0047381D(C)
|
:0047384C 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0047384F E83C0A0000              call 00474290
:00473854 8B55E4                  mov edx, dword ptr [ebp-1C]
:00473857 8B4A04                  mov ecx, dword ptr [edx+04]
:0047385A 03C8                    add ecx, eax
:0047385C 394DF8                  cmp dword ptr [ebp-08], ecx
:0047385F 0F8CE3000000            jl 00473948
:00473865 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00473868 E8230A0000              call 00474290
:0047386D 8B55E4                  mov edx, dword ptr [ebp-1C]
:00473870 8B4A04                  mov ecx, dword ptr [edx+04]
:00473873 8D540110                lea edx, dword ptr [ecx+eax+10]
:00473877 3955F8                  cmp dword ptr [ebp-08], edx
:0047387A 0F8DC8000000            jnl 00473948
:00473880 C745E800000000          mov [ebp-18], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047393E(U)
|
:00473887 B9B07F4900              mov ecx, 00497FB0
:0047388C E87C23FBFF              call 00425C0D
:00473891 83F801                  cmp eax, 00000001
:00473894 0F85A9000000            jne 00473943
:0047389A B9B07F4900              mov ecx, 00497FB0
:0047389F E81E23FBFF              call 00425BC2
:004738A4 B9B07F4900              mov ecx, 00497FB0
:004738A9 E87823FBFF              call 00425C26
:004738AE 8945F0                  mov dword ptr [ebp-10], eax
:004738B1 B9B07F4900              mov ecx, 00497FB0
:004738B6 E87C23FBFF              call 00425C37
:004738BB 8945EC                  mov dword ptr [ebp-14], eax
:004738BE 8B45E4                  mov eax, dword ptr [ebp-1C]
:004738C1 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004738C4 3B08                    cmp ecx, dword ptr [eax]
:004738C6 7C30                    jl 004738F8
:004738C8 8B55E4                  mov edx, dword ptr [ebp-1C]
:004738CB 8B4204                  mov eax, dword ptr [edx+04]
:004738CE 83C010                  add eax, 00000010
:004738D1 3945EC                  cmp dword ptr [ebp-14], eax
:004738D4 7C22                    jl 004738F8
:004738D6 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004738D9 8B11                    mov edx, dword ptr [ecx]
:004738DB 83C210                  add edx, 00000010
:004738DE 3955F0                  cmp dword ptr [ebp-10], edx
:004738E1 7D15                    jge 004738F8
:004738E3 8B45E4                  mov eax, dword ptr [ebp-1C]
:004738E6 8B4804                  mov ecx, dword ptr [eax+04]
:004738E9 8B55E4                  mov edx, dword ptr [ebp-1C]
:004738EC 8B4208                  mov eax, dword ptr [edx+08]
:004738EF 8D4C01F0                lea ecx, dword ptr [ecx+eax-10]
:004738F3 394DEC                  cmp dword ptr [ebp-14], ecx
:004738F6 7C02                    jl 004738FA

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004738C6(C), :004738D4(C), :004738E1(C)
|
:004738F8 EB49                    jmp 00473943

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004738F6(C)
|
:004738FA 8B55EC                  mov edx, dword ptr [ebp-14]
:004738FD 52                      push edx
:004738FE 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00473901 E8BA090000              call 004742C0
:00473906 8945F4                  mov dword ptr [ebp-0C], eax
:00473909 8B45E4                  mov eax, dword ptr [ebp-1C]
:0047390C 8B4814                  mov ecx, dword ptr [eax+14]
:0047390F 3B4DF4                  cmp ecx, dword ptr [ebp-0C]
:00473912 7407                    je 0047391B
:00473914 C745E801000000          mov [ebp-18], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00473912(C)
|
:0047391B 8B55F4                  mov edx, dword ptr [ebp-0C]
:0047391E 52                      push edx
:0047391F 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00473922 E834010000              call 00473A5B
:00473927 837DE800                cmp dword ptr [ebp-18], 00000000
:0047392B 7411                    je 0047393E
:0047392D B9B07F4900              mov ecx, 00497FB0
:00473932 E82F27FBFF              call 00426066
:00473937 C745E800000000          mov [ebp-18], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047392B(C)
|
:0047393E E944FFFFFF              jmp 00473887

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00473894(C), :004738F8(U)
|
:00473943 E9D2000000              jmp 00473A1A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047385F(C), :0047387A(C)
|
:00473948 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0047394B E840090000              call 00474290
:00473950 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00473953 8B5104                  mov edx, dword ptr [ecx+04]
:00473956 8D440210                lea eax, dword ptr [edx+eax+10]
:0047395A 3945F8                  cmp dword ptr [ebp-08], eax
:0047395D 7C55                    jl 004739B4
:0047395F 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00473962 8B5104                  mov edx, dword ptr [ecx+04]
:00473965 8B45E4                  mov eax, dword ptr [ebp-1C]
:00473968 8B4808                  mov ecx, dword ptr [eax+08]
:0047396B 8D540AF0                lea edx, dword ptr [edx+ecx-10]
:0047396F 3955F8                  cmp dword ptr [ebp-08], edx
:00473972 7D40                    jge 004739B4
:00473974 8B45E4                  mov eax, dword ptr [ebp-1C]
:00473977 8B4814                  mov ecx, dword ptr [eax+14]
:0047397A 8B55E4                  mov edx, dword ptr [ebp-1C]
:0047397D 034A0C                  add ecx, dword ptr [edx+0C]
:00473980 8B45E4                  mov eax, dword ptr [ebp-1C]
:00473983 8B55E4                  mov edx, dword ptr [ebp-1C]
:00473986 8B4010                  mov eax, dword ptr [eax+10]
:00473989 2B420C                  sub eax, dword ptr [edx+0C]
:0047398C 3BC8                    cmp ecx, eax
:0047398E 7211                    jb 004739A1
:00473990 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00473993 8B55E4                  mov edx, dword ptr [ebp-1C]
:00473996 8B4110                  mov eax, dword ptr [ecx+10]
:00473999 2B420C                  sub eax, dword ptr [edx+0C]
:0047399C 8945F4                  mov dword ptr [ebp-0C], eax
:0047399F EB0C                    jmp 004739AD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047398E(C)
|
:004739A1 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004739A4 8B55F4                  mov edx, dword ptr [ebp-0C]
:004739A7 03510C                  add edx, dword ptr [ecx+0C]
:004739AA 8955F4                  mov dword ptr [ebp-0C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047399F(U)
|
:004739AD E84E8CFBFF              call 0042C600
:004739B2 EB66                    jmp 00473A1A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047395D(C), :00473972(C)
|
:004739B4 8B45E4                  mov eax, dword ptr [ebp-1C]
:004739B7 8B4804                  mov ecx, dword ptr [eax+04]
:004739BA 8B55E4                  mov edx, dword ptr [ebp-1C]
:004739BD 8B4208                  mov eax, dword ptr [edx+08]
:004739C0 8D4C01F0                lea ecx, dword ptr [ecx+eax-10]
:004739C4 394DF8                  cmp dword ptr [ebp-08], ecx
:004739C7 7C51                    jl 00473A1A
:004739C9 8B55E4                  mov edx, dword ptr [ebp-1C]
:004739CC 8B4204                  mov eax, dword ptr [edx+04]
:004739CF 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004739D2 034108                  add eax, dword ptr [ecx+08]
:004739D5 3945F8                  cmp dword ptr [ebp-08], eax
:004739D8 7D40                    jge 00473A1A
:004739DA 8B55E4                  mov edx, dword ptr [ebp-1C]
:004739DD 8B45E4                  mov eax, dword ptr [ebp-1C]
:004739E0 8B4A10                  mov ecx, dword ptr [edx+10]
:004739E3 2B480C                  sub ecx, dword ptr [eax+0C]
:004739E6 8B55E4                  mov edx, dword ptr [ebp-1C]
:004739E9 394A14                  cmp dword ptr [edx+14], ecx
:004739EC 732C                    jnb 00473A1A
:004739EE 8B45F4                  mov eax, dword ptr [ebp-0C]
:004739F1 83C001                  add eax, 00000001
:004739F4 8945F4                  mov dword ptr [ebp-0C], eax
:004739F7 6A04                    push 00000004
:004739F9 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004739FC E8E4000000              call 00473AE5
:00473A01 B9B07F4900              mov ecx, 00497FB0
:00473A06 E85B26FBFF              call 00426066
:00473A0B E8F08BFBFF              call 0042C600
:00473A10 6A03                    push 00000003
:00473A12 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00473A15 E8CB000000              call 00473AE5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047375B(C), :0047376A(C), :0047377B(C), :00473790(C), :004737A3(C)
|:004737F7(U), :00473847(U), :00473943(U), :004739B2(U), :004739C7(C)
|:004739D8(C), :004739EC(C)
|
:00473A1A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00473A1D 51                      push ecx
:00473A1E 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:00473A21 E835000000              call 00473A5B
:00473A26 8B55E4                  mov edx, dword ptr [ebp-1C]
:00473A29 8B4214                  mov eax, dword ptr [edx+14]
:00473A2C 8BE5                    mov esp, ebp
:00473A2E 5D                      pop ebp
:00473A2F C3                      ret


:00473A30 55                      push ebp
:00473A31 8BEC                    mov ebp, esp
:00473A33 51                      push ecx
:00473A34 894DFC                  mov dword ptr [ebp-04], ecx
:00473A37 8B45FC                  mov eax, dword ptr [ebp-04]
:00473A3A 8B4810                  mov ecx, dword ptr [eax+10]
:00473A3D 3B4D08                  cmp ecx, dword ptr [ebp+08]
:00473A40 7413                    je 00473A55
:00473A42 6A00                    push 00000000
:00473A44 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00473A47 E80F000000              call 00473A5B
:00473A4C 8B55FC                  mov edx, dword ptr [ebp-04]
:00473A4F 8B4508                  mov eax, dword ptr [ebp+08]
:00473A52 894210                  mov dword ptr [edx+10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00473A40(C)
|
:00473A55 8BE5                    mov esp, ebp
:00473A57 5D                      pop ebp
:00473A58 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0042E8F6   , :00473922   , :00473A21   , :00473A47   
|
:00473A5B 55                      push ebp
:00473A5C 8BEC                    mov ebp, esp
:00473A5E 51                      push ecx
:00473A5F 894DFC                  mov dword ptr [ebp-04], ecx
:00473A62 8B45FC                  mov eax, dword ptr [ebp-04]
:00473A65 8B4814                  mov ecx, dword ptr [eax+14]
:00473A68 3B4D08                  cmp ecx, dword ptr [ebp+08]
:00473A6B 7472                    je 00473ADF
:00473A6D 6A00                    push 00000000
:00473A6F E86F900000              call 0047CAE3
:00473A74 83C404                  add esp, 00000004
:00473A77 E85FABFAFF              call 0041E5DB
:00473A7C 6A00                    push 00000000
:00473A7E 6A15                    push 00000015
:00473A80 6A04                    push 00000004
:00473A82 E86A970000              call 0047D1F1
:00473A87 83C40C                  add esp, 0000000C
:00473A8A 6A00                    push 00000000
:00473A8C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00473A8F E8FC070000              call 00474290
:00473A94 8B55FC                  mov edx, dword ptr [ebp-04]
:00473A97 8B4A04                  mov ecx, dword ptr [edx+04]
:00473A9A 8D540110                lea edx, dword ptr [ecx+eax+10]
:00473A9E 52                      push edx
:00473A9F 8B45FC                  mov eax, dword ptr [ebp-04]
:00473AA2 8B08                    mov ecx, dword ptr [eax]
:00473AA4 83C110                  add ecx, 00000010
:00473AA7 51                      push ecx
:00473AA8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00473AAB E8E0070000              call 00474290
:00473AB0 8B55FC                  mov edx, dword ptr [ebp-04]
:00473AB3 8B4A04                  mov ecx, dword ptr [edx+04]
:00473AB6 03C8                    add ecx, eax
:00473AB8 51                      push ecx
:00473AB9 8B55FC                  mov edx, dword ptr [ebp-04]
:00473ABC 8B02                    mov eax, dword ptr [edx]
:00473ABE 50                      push eax
:00473ABF E8FFA00000              call 0047DBC3
:00473AC4 83C414                  add esp, 00000014
:00473AC7 E82AABFAFF              call 0041E5F6
:00473ACC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00473ACF 8B5508                  mov edx, dword ptr [ebp+08]
:00473AD2 895114                  mov dword ptr [ecx+14], edx
:00473AD5 6A00                    push 00000000
:00473AD7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00473ADA E806000000              call 00473AE5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00473A6B(C)
|
:00473ADF 8BE5                    mov esp, ebp
:00473AE1 5D                      pop ebp
:00473AE2 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:004736F8   , :00473702   , :00473714   , :004737D9   , :004737F2   
|:004739FC   , :00473A15   , :00473ADA   
|
:00473AE5 55                      push ebp
:00473AE6 8BEC                    mov ebp, esp
:00473AE8 83EC0C                  sub esp, 0000000C
:00473AEB 894DF8                  mov dword ptr [ebp-08], ecx
:00473AEE 8B45F8                  mov eax, dword ptr [ebp-08]
:00473AF1 8B4804                  mov ecx, dword ptr [eax+04]
:00473AF4 894DFC                  mov dword ptr [ebp-04], ecx
:00473AF7 8A5508                  mov dl, byte ptr [ebp+08]
:00473AFA 8855F4                  mov byte ptr [ebp-0C], dl
:00473AFD 807DF400                cmp byte ptr [ebp-0C], 00
:00473B01 740E                    je 00473B11
:00473B03 807DF402                cmp byte ptr [ebp-0C], 02
:00473B07 762A                    jbe 00473B33
:00473B09 807DF404                cmp byte ptr [ebp-0C], 04
:00473B0D 7614                    jbe 00473B23
:00473B0F EB22                    jmp 00473B33

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00473B01(C)
|
:00473B11 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00473B14 E877070000              call 00474290
:00473B19 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00473B1C 03C8                    add ecx, eax
:00473B1E 894DFC                  mov dword ptr [ebp-04], ecx
:00473B21 EB10                    jmp 00473B33

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00473B0D(C)
|
:00473B23 8B55F8                  mov edx, dword ptr [ebp-08]
:00473B26 8B4208                  mov eax, dword ptr [edx+08]
:00473B29 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00473B2C 8D5401F0                lea edx, dword ptr [ecx+eax-10]
:00473B30 8955FC                  mov dword ptr [ebp-04], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00473B07(C), :00473B0F(U), :00473B21(U)
|
:00473B33 6A00                    push 00000000
:00473B35 E8A98F0000              call 0047CAE3
:00473B3A 83C404                  add esp, 00000004
:00473B3D E899AAFAFF              call 0041E5DB
:00473B42 6A00                    push 00000000
:00473B44 6A12                    push 00000012
:00473B46 6A04                    push 00000004
:00473B48 E8A4960000              call 0047D1F1
:00473B4D 83C40C                  add esp, 0000000C
:00473B50 6A00                    push 00000000
:00473B52 8B45FC                  mov eax, dword ptr [ebp-04]
:00473B55 83C010                  add eax, 00000010
:00473B58 50                      push eax
:00473B59 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00473B5C 8B11                    mov edx, dword ptr [ecx]
:00473B5E 83C210                  add edx, 00000010
:00473B61 52                      push edx
:00473B62 8B45FC                  mov eax, dword ptr [ebp-04]
:00473B65 50                      push eax
:00473B66 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00473B69 8B11                    mov edx, dword ptr [ecx]
:00473B6B 52                      push edx
:00473B6C E852A00000              call 0047DBC3
:00473B71 83C414                  add esp, 00000014
:00473B74 6A00                    push 00000000
:00473B76 6A1F                    push 0000001F
:00473B78 6A04                    push 00000004
:00473B7A E872960000              call 0047D1F1
:00473B7F 83C40C                  add esp, 0000000C
:00473B82 6A00                    push 00000000
:00473B84 8B45FC                  mov eax, dword ptr [ebp-04]
:00473B87 83C010                  add eax, 00000010
:00473B8A 50                      push eax
:00473B8B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00473B8E 8B11                    mov edx, dword ptr [ecx]
:00473B90 83C210                  add edx, 00000010
:00473B93 52                      push edx
:00473B94 8B45FC                  mov eax, dword ptr [ebp-04]
:00473B97 83C002                  add eax, 00000002
:00473B9A 50                      push eax
:00473B9B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00473B9E 8B11                    mov edx, dword ptr [ecx]
:00473BA0 83C202                  add edx, 00000002
:00473BA3 52                      push edx
:00473BA4 E81AA00000              call 0047DBC3
:00473BA9 83C414                  add esp, 00000014
:00473BAC 6A00                    push 00000000
:00473BAE 6A18                    push 00000018
:00473BB0 6A04                    push 00000004
:00473BB2 E83A960000              call 0047D1F1
:00473BB7 83C40C                  add esp, 0000000C
:00473BBA 6A00                    push 00000000
:00473BBC 8B45FC                  mov eax, dword ptr [ebp-04]
:00473BBF 83C00E                  add eax, 0000000E
:00473BC2 50                      push eax
:00473BC3 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00473BC6 8B11                    mov edx, dword ptr [ecx]
:00473BC8 83C20E                  add edx, 0000000E
:00473BCB 52                      push edx
:00473BCC 8B45FC                  mov eax, dword ptr [ebp-04]
:00473BCF 83C002                  add eax, 00000002
:00473BD2 50                      push eax
:00473BD3 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00473BD6 8B11                    mov edx, dword ptr [ecx]
:00473BD8 83C202                  add edx, 00000002
:00473BDB 52                      push edx
:00473BDC E8E29F0000              call 0047DBC3
:00473BE1 83C414                  add esp, 00000014
:00473BE4 E80DAAFAFF              call 0041E5F6
:00473BE9 8BE5                    mov esp, ebp
:00473BEB 5D                      pop ebp
:00473BEC C20400                  ret 0004



* Referenced by a CALL at Address:
|:0047370A   
|
:00473BEF 55                      push ebp
:00473BF0 8BEC                    mov ebp, esp
:00473BF2 83EC08                  sub esp, 00000008
:00473BF5 894DF8                  mov dword ptr [ebp-08], ecx
:00473BF8 8B45F8                  mov eax, dword ptr [ebp-08]
:00473BFB 8B4808                  mov ecx, dword ptr [eax+08]
:00473BFE 83E920                  sub ecx, 00000020
:00473C01 C1E904                  shr ecx, 04
:00473C04 894DFC                  mov dword ptr [ebp-04], ecx
:00473C07 6A00                    push 00000000
:00473C09 E8D58E0000              call 0047CAE3
:00473C0E 83C404                  add esp, 00000004
:00473C11 E8C5A9FAFF              call 0041E5DB
:00473C16 6A00                    push 00000000
:00473C18 6A15                    push 00000015
:00473C1A 6A04                    push 00000004
:00473C1C E8D0950000              call 0047D1F1
:00473C21 83C40C                  add esp, 0000000C
:00473C24 6A00                    push 00000000
:00473C26 8B55F8                  mov edx, dword ptr [ebp-08]
:00473C29 8B4204                  mov eax, dword ptr [edx+04]
:00473C2C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00473C2F 8B5108                  mov edx, dword ptr [ecx+08]
:00473C32 8D4410F0                lea eax, dword ptr [eax+edx-10]
:00473C36 50                      push eax
:00473C37 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00473C3A 8B11                    mov edx, dword ptr [ecx]
:00473C3C 83C210                  add edx, 00000010
:00473C3F 52                      push edx
:00473C40 8B45F8                  mov eax, dword ptr [ebp-08]
:00473C43 8B4804                  mov ecx, dword ptr [eax+04]
:00473C46 83C110                  add ecx, 00000010
:00473C49 51                      push ecx
:00473C4A 8B55F8                  mov edx, dword ptr [ebp-08]
:00473C4D 8B02                    mov eax, dword ptr [edx]
:00473C4F 50                      push eax
:00473C50 E86E9F0000              call 0047DBC3
:00473C55 83C414                  add esp, 00000014
:00473C58 E899A9FAFF              call 0041E5F6
:00473C5D 8BE5                    mov esp, ebp
:00473C5F 5D                      pop ebp
:00473C60 C3                      ret



* Referenced by a CALL at Addresses:
|:00474087   , :004741CA   
|
:00473C61 55                      push ebp
:00473C62 8BEC                    mov ebp, esp
:00473C64 83EC10                  sub esp, 00000010
:00473C67 894DF4                  mov dword ptr [ebp-0C], ecx
:00473C6A 8B45F4                  mov eax, dword ptr [ebp-0C]
:00473C6D 8B4810                  mov ecx, dword ptr [eax+10]
:00473C70 51                      push ecx
:00473C71 E8E4BF0000              call 0047FC5A
:00473C76 83C404                  add esp, 00000004
:00473C79 8945F8                  mov dword ptr [ebp-08], eax
:00473C7C 6A04                    push 00000004
:00473C7E B9382F4900              mov ecx, 00492F38
:00473C83 E8AEB0F9FF              call 0040ED36
:00473C88 8B55F4                  mov edx, dword ptr [ebp-0C]
:00473C8B 33C0                    xor eax, eax
:00473C8D 8A4215                  mov al, byte ptr [edx+15]
:00473C90 83E040                  and eax, 00000040
:00473C93 85C0                    test eax, eax
:00473C95 740E                    je 00473CA5
:00473C97 6A55                    push 00000055
:00473C99 B9382F4900              mov ecx, 00492F38
:00473C9E E8E1AFF9FF              call 0040EC84
:00473CA3 EB0C                    jmp 00473CB1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00473C95(C)
|
:00473CA5 6A3A                    push 0000003A
:00473CA7 B9382F4900              mov ecx, 00492F38
:00473CAC E8D3AFF9FF              call 0040EC84

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00473CA3(U)
|
:00473CB1 6A00                    push 00000000
:00473CB3 B9382F4900              mov ecx, 00492F38
:00473CB8 E8FFAFF9FF              call 0040ECBC
:00473CBD 6A00                    push 00000000
:00473CBF E81F8E0000              call 0047CAE3
:00473CC4 83C404                  add esp, 00000004
:00473CC7 E80FA9FAFF              call 0041E5DB
:00473CCC 6A00                    push 00000000
:00473CCE 6A12                    push 00000012
:00473CD0 6A04                    push 00000004
:00473CD2 E81A950000              call 0047D1F1
:00473CD7 83C40C                  add esp, 0000000C
:00473CDA 6A00                    push 00000000
:00473CDC 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00473CDF 8B5104                  mov edx, dword ptr [ecx+04]
:00473CE2 83C213                  add edx, 00000013
:00473CE5 52                      push edx
:00473CE6 8B45F4                  mov eax, dword ptr [ebp-0C]
:00473CE9 8B08                    mov ecx, dword ptr [eax]
:00473CEB 8B55F4                  mov edx, dword ptr [ebp-0C]
:00473CEE 034A08                  add ecx, dword ptr [edx+08]
:00473CF1 51                      push ecx
:00473CF2 8B45F4                  mov eax, dword ptr [ebp-0C]
:00473CF5 8B4804                  mov ecx, dword ptr [eax+04]
:00473CF8 51                      push ecx
:00473CF9 8B55F4                  mov edx, dword ptr [ebp-0C]
:00473CFC 8B02                    mov eax, dword ptr [edx]
:00473CFE 50                      push eax
:00473CFF E8BF9E0000              call 0047DBC3
:00473D04 83C414                  add esp, 00000014
:00473D07 6A00                    push 00000000
:00473D09 6A18                    push 00000018
:00473D0B 6A00                    push 00000000
:00473D0D E8DF940000              call 0047D1F1
:00473D12 83C40C                  add esp, 0000000C
:00473D15 6A00                    push 00000000
:00473D17 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00473D1A 8B5104                  mov edx, dword ptr [ecx+04]
:00473D1D 83C213                  add edx, 00000013
:00473D20 52                      push edx
:00473D21 8B45F4                  mov eax, dword ptr [ebp-0C]
:00473D24 8B08                    mov ecx, dword ptr [eax]
:00473D26 8B55F4                  mov edx, dword ptr [ebp-0C]
:00473D29 034A08                  add ecx, dword ptr [edx+08]
:00473D2C 51                      push ecx
:00473D2D 8B45F4                  mov eax, dword ptr [ebp-0C]
:00473D30 8B4804                  mov ecx, dword ptr [eax+04]
:00473D33 83C102                  add ecx, 00000002
:00473D36 51                      push ecx
:00473D37 8B55F4                  mov edx, dword ptr [ebp-0C]
:00473D3A 8B02                    mov eax, dword ptr [edx]
:00473D3C 83C002                  add eax, 00000002
:00473D3F 50                      push eax
:00473D40 E87E9E0000              call 0047DBC3
:00473D45 83C414                  add esp, 00000014
:00473D48 6A00                    push 00000000
:00473D4A 6A15                    push 00000015
:00473D4C 6A04                    push 00000004
:00473D4E E89E940000              call 0047D1F1
:00473D53 83C40C                  add esp, 0000000C
:00473D56 6A00                    push 00000000
:00473D58 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00473D5B 8B5104                  mov edx, dword ptr [ecx+04]
:00473D5E 83C211                  add edx, 00000011
:00473D61 52                      push edx
:00473D62 8B45F4                  mov eax, dword ptr [ebp-0C]
:00473D65 8B08                    mov ecx, dword ptr [eax]
:00473D67 8B55F4                  mov edx, dword ptr [ebp-0C]
:00473D6A 8B4208                  mov eax, dword ptr [edx+08]
:00473D6D 8D4C01FE                lea ecx, dword ptr [ecx+eax-02]
:00473D71 51                      push ecx
:00473D72 8B55F4                  mov edx, dword ptr [ebp-0C]
:00473D75 8B4204                  mov eax, dword ptr [edx+04]
:00473D78 83C002                  add eax, 00000002
:00473D7B 50                      push eax
:00473D7C 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00473D7F 8B11                    mov edx, dword ptr [ecx]
:00473D81 83C202                  add edx, 00000002
:00473D84 52                      push edx
:00473D85 E8399E0000              call 0047DBC3
:00473D8A 83C414                  add esp, 00000014
:00473D8D 6A00                    push 00000000
:00473D8F 6A1F                    push 0000001F
:00473D91 6A04                    push 00000004
:00473D93 E859940000              call 0047D1F1
:00473D98 83C40C                  add esp, 0000000C
:00473D9B 8B45F4                  mov eax, dword ptr [ebp-0C]
:00473D9E 8B4804                  mov ecx, dword ptr [eax+04]
:00473DA1 83C102                  add ecx, 00000002
:00473DA4 51                      push ecx
:00473DA5 8B55F4                  mov edx, dword ptr [ebp-0C]
:00473DA8 8B02                    mov eax, dword ptr [edx]
:00473DAA C1E803                  shr eax, 03
:00473DAD 83C001                  add eax, 00000001
:00473DB0 50                      push eax
:00473DB1 B9382F4900              mov ecx, 00492F38
:00473DB6 E81CAEF9FF              call 0040EBD7
:00473DBB 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00473DBE 33D2                    xor edx, edx
:00473DC0 8A5115                  mov dl, byte ptr [ecx+15]
:00473DC3 83E203                  and edx, 00000003
:00473DC6 8955F0                  mov dword ptr [ebp-10], edx
:00473DC9 837DF000                cmp dword ptr [ebp-10], 00000000
:00473DCD 7C5B                    jl 00473E2A
:00473DCF 837DF001                cmp dword ptr [ebp-10], 00000001
:00473DD3 7E02                    jle 00473DD7
:00473DD5 EB53                    jmp 00473E2A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00473DD3(C)
|
:00473DD7 8B45F4                  mov eax, dword ptr [ebp-0C]
:00473DDA 83781000                cmp dword ptr [eax+10], 00000000
:00473DDE 744A                    je 00473E2A
:00473DE0 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00473DE3 8B5108                  mov edx, dword ptr [ecx+08]
:00473DE6 C1EA03                  shr edx, 03
:00473DE9 2B55F8                  sub edx, dword ptr [ebp-08]
:00473DEC D1EA                    shr edx, 1
:00473DEE 8955FC                  mov dword ptr [ebp-04], edx
:00473DF1 8B45F4                  mov eax, dword ptr [ebp-0C]
:00473DF4 8B4804                  mov ecx, dword ptr [eax+04]
:00473DF7 83C102                  add ecx, 00000002
:00473DFA 51                      push ecx
:00473DFB 8B55F4                  mov edx, dword ptr [ebp-0C]
:00473DFE 8B02                    mov eax, dword ptr [edx]
:00473E00 C1E803                  shr eax, 03
:00473E03 0345FC                  add eax, dword ptr [ebp-04]
:00473E06 50                      push eax
:00473E07 B9382F4900              mov ecx, 00492F38
:00473E0C E8C6ADF9FF              call 0040EBD7
:00473E11 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00473E14 8B5110                  mov edx, dword ptr [ecx+10]
:00473E17 52                      push edx

* Possible StringData Ref from Data Obj ->"%s"
                                  |
:00473E18 68CCE74800              push 0048E7CC
:00473E1D 68382F4900              push 00492F38
:00473E22 E879BCF9FF              call 0040FAA0
:00473E27 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00473DCD(C), :00473DD5(U), :00473DDE(C)
|
:00473E2A E8C7A7FAFF              call 0041E5F6
:00473E2F 8BE5                    mov esp, ebp
:00473E31 5D                      pop ebp
:00473E32 C3                      ret



* Referenced by a CALL at Address:
|:00474226   
|
:00473E33 55                      push ebp
:00473E34 8BEC                    mov ebp, esp
:00473E36 83EC14                  sub esp, 00000014
:00473E39 894DF0                  mov dword ptr [ebp-10], ecx
:00473E3C B9B07F4900              mov ecx, 00497FB0
:00473E41 E87C1DFBFF              call 00425BC2
:00473E46 B9B07F4900              mov ecx, 00497FB0
:00473E4B E8D61DFBFF              call 00425C26
:00473E50 8945FC                  mov dword ptr [ebp-04], eax
:00473E53 B9B07F4900              mov ecx, 00497FB0
:00473E58 E8DA1DFBFF              call 00425C37
:00473E5D 8945F8                  mov dword ptr [ebp-08], eax
:00473E60 C645F4FF                mov [ebp-0C], FF
:00473E64 8B45F0                  mov eax, dword ptr [ebp-10]
:00473E67 C6401600                mov [eax+16], 00
:00473E6B B9B07F4900              mov ecx, 00497FB0
:00473E70 E8981DFBFF              call 00425C0D
:00473E75 83F801                  cmp eax, 00000001
:00473E78 0F8560020000            jne 004740DE
:00473E7E 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00473E81 33D2                    xor edx, edx
:00473E83 8A5115                  mov dl, byte ptr [ecx+15]
:00473E86 83E240                  and edx, 00000040
:00473E89 85D2                    test edx, edx
:00473E8B 0F854D020000            jne 004740DE
:00473E91 8B45F0                  mov eax, dword ptr [ebp-10]
:00473E94 33C9                    xor ecx, ecx
:00473E96 8A4815                  mov cl, byte ptr [eax+15]
:00473E99 81E180000000            and ecx, 00000080
:00473E9F 85C9                    test ecx, ecx
:00473EA1 7546                    jne 00473EE9
:00473EA3 8B55F0                  mov edx, dword ptr [ebp-10]
:00473EA6 8B45FC                  mov eax, dword ptr [ebp-04]
:00473EA9 3B02                    cmp eax, dword ptr [edx]
:00473EAB 0F8C2D020000            jl 004740DE
:00473EB1 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00473EB4 8B55F8                  mov edx, dword ptr [ebp-08]
:00473EB7 3B5104                  cmp edx, dword ptr [ecx+04]
:00473EBA 0F8C1E020000            jl 004740DE
:00473EC0 8B45F0                  mov eax, dword ptr [ebp-10]
:00473EC3 8B08                    mov ecx, dword ptr [eax]
:00473EC5 8B55F0                  mov edx, dword ptr [ebp-10]
:00473EC8 034A08                  add ecx, dword ptr [edx+08]
:00473ECB 394DFC                  cmp dword ptr [ebp-04], ecx
:00473ECE 0F8D0A020000            jnl 004740DE
:00473ED4 8B45F0                  mov eax, dword ptr [ebp-10]
:00473ED7 8B4804                  mov ecx, dword ptr [eax+04]
:00473EDA 8B55F0                  mov edx, dword ptr [ebp-10]
:00473EDD 034A0C                  add ecx, dword ptr [edx+0C]
:00473EE0 394DF8                  cmp dword ptr [ebp-08], ecx
:00473EE3 0F8DF5010000            jnl 004740DE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00473EA1(C)
|
:00473EE9 B9B07F4900              mov ecx, 00497FB0
:00473EEE E87321FBFF              call 00426066
:00473EF3 8B45F0                  mov eax, dword ptr [ebp-10]
:00473EF6 33C9                    xor ecx, ecx
:00473EF8 8A4815                  mov cl, byte ptr [eax+15]
:00473EFB 83E103                  and ecx, 00000003
:00473EFE 894DEC                  mov dword ptr [ebp-14], ecx
:00473F01 6A01                    push 00000001
:00473F03 6A00                    push 00000000
:00473F05 B9B0694B00              mov ecx, 004B69B0
:00473F0A E86B070000              call 0047467A
:00473F0F E8C7A6FAFF              call 0041E5DB
:00473F14 B990F44A00              mov ecx, 004AF490
:00473F19 E872A1F9FF              call 0040E090
:00473F1E 50                      push eax
:00473F1F 6A10                    push 00000010
:00473F21 8B55F0                  mov edx, dword ptr [ebp-10]
:00473F24 8B4208                  mov eax, dword ptr [edx+08]
:00473F27 83E810                  sub eax, 00000010
:00473F2A 50                      push eax
:00473F2B 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00473F2E 8B5104                  mov edx, dword ptr [ecx+04]
:00473F31 83C202                  add edx, 00000002
:00473F34 52                      push edx
:00473F35 8B45F0                  mov eax, dword ptr [ebp-10]
:00473F38 8B08                    mov ecx, dword ptr [eax]
:00473F3A 83C108                  add ecx, 00000008
:00473F3D 51                      push ecx
:00473F3E E80EA30000              call 0047E251
:00473F43 83C414                  add esp, 00000014
:00473F46 6A00                    push 00000000
:00473F48 6A18                    push 00000018
:00473F4A 6A04                    push 00000004
:00473F4C E8A0920000              call 0047D1F1
:00473F51 83C40C                  add esp, 0000000C
:00473F54 6A00                    push 00000000
:00473F56 8B55F0                  mov edx, dword ptr [ebp-10]
:00473F59 8B4204                  mov eax, dword ptr [edx+04]
:00473F5C 83C013                  add eax, 00000013
:00473F5F 50                      push eax
:00473F60 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00473F63 8B11                    mov edx, dword ptr [ecx]
:00473F65 8B45F0                  mov eax, dword ptr [ebp-10]
:00473F68 035008                  add edx, dword ptr [eax+08]
:00473F6B 52                      push edx
:00473F6C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00473F6F 8B5104                  mov edx, dword ptr [ecx+04]
:00473F72 52                      push edx
:00473F73 8B45F0                  mov eax, dword ptr [ebp-10]
:00473F76 8B08                    mov ecx, dword ptr [eax]
:00473F78 51                      push ecx
:00473F79 E8459C0000              call 0047DBC3
:00473F7E 83C414                  add esp, 00000014
:00473F81 6A00                    push 00000000
:00473F83 6A12                    push 00000012
:00473F85 6A00                    push 00000000
:00473F87 E865920000              call 0047D1F1
:00473F8C 83C40C                  add esp, 0000000C
:00473F8F 6A00                    push 00000000
:00473F91 8B55F0                  mov edx, dword ptr [ebp-10]
:00473F94 8B4204                  mov eax, dword ptr [edx+04]
:00473F97 83C013                  add eax, 00000013
:00473F9A 50                      push eax
:00473F9B 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00473F9E 8B11                    mov edx, dword ptr [ecx]
:00473FA0 8B45F0                  mov eax, dword ptr [ebp-10]
:00473FA3 035008                  add edx, dword ptr [eax+08]
:00473FA6 52                      push edx
:00473FA7 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00473FAA 8B5104                  mov edx, dword ptr [ecx+04]
:00473FAD 83C202                  add edx, 00000002
:00473FB0 52                      push edx
:00473FB1 8B45F0                  mov eax, dword ptr [ebp-10]
:00473FB4 8B08                    mov ecx, dword ptr [eax]
:00473FB6 83C102                  add ecx, 00000002
:00473FB9 51                      push ecx
:00473FBA E8049C0000              call 0047DBC3
:00473FBF 83C414                  add esp, 00000014
:00473FC2 6A00                    push 00000000
:00473FC4 6A15                    push 00000015
:00473FC6 6A04                    push 00000004
:00473FC8 E824920000              call 0047D1F1
:00473FCD 83C40C                  add esp, 0000000C
:00473FD0 6A00                    push 00000000
:00473FD2 8B55F0                  mov edx, dword ptr [ebp-10]
:00473FD5 8B4204                  mov eax, dword ptr [edx+04]
:00473FD8 83C011                  add eax, 00000011
:00473FDB 50                      push eax
:00473FDC 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00473FDF 8B11                    mov edx, dword ptr [ecx]
:00473FE1 8B45F0                  mov eax, dword ptr [ebp-10]
:00473FE4 8B4808                  mov ecx, dword ptr [eax+08]
:00473FE7 8D540AFE                lea edx, dword ptr [edx+ecx-02]
:00473FEB 52                      push edx
:00473FEC 8B45F0                  mov eax, dword ptr [ebp-10]
:00473FEF 8B4804                  mov ecx, dword ptr [eax+04]
:00473FF2 83C102                  add ecx, 00000002
:00473FF5 51                      push ecx
:00473FF6 8B55F0                  mov edx, dword ptr [ebp-10]
:00473FF9 8B02                    mov eax, dword ptr [edx]
:00473FFB 83C002                  add eax, 00000002
:00473FFE 50                      push eax
:00473FFF E8BF9B0000              call 0047DBC3
:00474004 83C414                  add esp, 00000014
:00474007 6A00                    push 00000000
:00474009 6A1F                    push 0000001F
:0047400B 6A04                    push 00000004
:0047400D E8DF910000              call 0047D1F1
:00474012 83C40C                  add esp, 0000000C
:00474015 B990F44A00              mov ecx, 004AF490
:0047401A E871A0F9FF              call 0040E090
:0047401F 50                      push eax
:00474020 6A10                    push 00000010
:00474022 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00474025 8B5108                  mov edx, dword ptr [ecx+08]
:00474028 83EA10                  sub edx, 00000010
:0047402B 52                      push edx
:0047402C 8B45F0                  mov eax, dword ptr [ebp-10]
:0047402F 8B4804                  mov ecx, dword ptr [eax+04]
:00474032 83C102                  add ecx, 00000002
:00474035 51                      push ecx
:00474036 8B55F0                  mov edx, dword ptr [ebp-10]
:00474039 8B02                    mov eax, dword ptr [edx]
:0047403B 83C008                  add eax, 00000008
:0047403E 50                      push eax
:0047403F E857A00000              call 0047E09B
:00474044 83C414                  add esp, 00000014
:00474047 E8AAA5FAFF              call 0041E5F6
:0047404C E8AF85FBFF              call 0042C600
:00474051 B9B07F4900              mov ecx, 00497FB0
:00474056 E8671BFBFF              call 00425BC2
:0047405B B9B07F4900              mov ecx, 00497FB0
:00474060 E8C11BFBFF              call 00425C26
:00474065 8945FC                  mov dword ptr [ebp-04], eax
:00474068 B9B07F4900              mov ecx, 00497FB0
:0047406D E8C51BFBFF              call 00425C37
:00474072 8945F8                  mov dword ptr [ebp-08], eax
:00474075 6A02                    push 00000002
:00474077 E84F84FBFF              call 0042C4CB
:0047407C 83C404                  add esp, 00000004
:0047407F E85C84FBFF              call 0042C4E0
:00474084 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00474087 E8D5FBFFFF              call 00473C61
:0047408C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047408F 8B55FC                  mov edx, dword ptr [ebp-04]
:00474092 3B11                    cmp edx, dword ptr [ecx]
:00474094 7C37                    jl 004740CD
:00474096 8B45F0                  mov eax, dword ptr [ebp-10]
:00474099 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047409C 3B4804                  cmp ecx, dword ptr [eax+04]
:0047409F 7C2C                    jl 004740CD
:004740A1 8B55F0                  mov edx, dword ptr [ebp-10]
:004740A4 8B02                    mov eax, dword ptr [edx]
:004740A6 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004740A9 034108                  add eax, dword ptr [ecx+08]
:004740AC 3945FC                  cmp dword ptr [ebp-04], eax
:004740AF 7D1C                    jge 004740CD
:004740B1 8B55F0                  mov edx, dword ptr [ebp-10]
:004740B4 8B4204                  mov eax, dword ptr [edx+04]
:004740B7 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004740BA 03410C                  add eax, dword ptr [ecx+0C]
:004740BD 3945F8                  cmp dword ptr [ebp-08], eax
:004740C0 7D0B                    jge 004740CD
:004740C2 8B55F0                  mov edx, dword ptr [ebp-10]
:004740C5 8A4214                  mov al, byte ptr [edx+14]
:004740C8 8845F4                  mov byte ptr [ebp-0C], al
:004740CB EB11                    jmp 004740DE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00474094(C), :0047409F(C), :004740AF(C), :004740C0(C)
|
:004740CD B9B07F4900              mov ecx, 00497FB0
:004740D2 E88F1FFBFF              call 00426066
:004740D7 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004740DA C6411601                mov [ecx+16], 01

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00473E78(C), :00473E8B(C), :00473EAB(C), :00473EBA(C), :00473ECE(C)
|:00473EE3(C), :004740CB(U)
|
:004740DE 8A45F4                  mov al, byte ptr [ebp-0C]
:004740E1 8BE5                    mov esp, ebp
:004740E3 5D                      pop ebp
:004740E4 C3                      ret



* Referenced by a CALL at Address:
|:0042EA3D   
|
:004740E5 55                      push ebp
:004740E6 8BEC                    mov ebp, esp
:004740E8 83EC14                  sub esp, 00000014
:004740EB 894DF0                  mov dword ptr [ebp-10], ecx
:004740EE 8B45F0                  mov eax, dword ptr [ebp-10]
:004740F1 8A4801                  mov cl, byte ptr [eax+01]
:004740F4 884DF8                  mov byte ptr [ebp-08], cl
:004740F7 C645F400                mov [ebp-0C], 00
:004740FB E8DBA4FAFF              call 0041E5DB
:00474100 C645FC00                mov [ebp-04], 00
:00474104 EB08                    jmp 0047410E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004741CF(U)
|
:00474106 8A45FC                  mov al, byte ptr [ebp-04]
:00474109 0401                    add al, 01
:0047410B 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474104(U)
|
:0047410E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00474111 81E1FF000000            and ecx, 000000FF
:00474117 8B55F0                  mov edx, dword ptr [ebp-10]
:0047411A 33C0                    xor eax, eax
:0047411C 8A02                    mov al, byte ptr [edx]
:0047411E 3BC8                    cmp ecx, eax
:00474120 0F8DAE000000            jnl 004741D4
:00474126 8B4D14                  mov ecx, dword ptr [ebp+14]
:00474129 81E1FF000000            and ecx, 000000FF
:0047412F 85C9                    test ecx, ecx
:00474131 7512                    jne 00474145
:00474133 8B55FC                  mov edx, dword ptr [ebp-04]
:00474136 81E2FF000000            and edx, 000000FF
:0047413C 0FAF5510                imul edx, dword ptr [ebp+10]
:00474140 8955EC                  mov dword ptr [ebp-14], edx
:00474143 EB07                    jmp 0047414C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474131(C)
|
:00474145 C745EC00000000          mov [ebp-14], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474143(U)
|
:0047414C 8B45FC                  mov eax, dword ptr [ebp-04]
:0047414F 25FF000000              and eax, 000000FF
:00474154 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00474157 33D2                    xor edx, edx
:00474159 8A940128010000          mov dl, byte ptr [ecx+eax+00000128]
:00474160 83EA01                  sub edx, 00000001
:00474163 F7DA                    neg edx
:00474165 1BD2                    sbb edx, edx
:00474167 83E2C0                  and edx, FFFFFFC0
:0047416A 83C240                  add edx, 00000040
:0047416D 52                      push edx
:0047416E 8A45FC                  mov al, byte ptr [ebp-04]
:00474171 50                      push eax
:00474172 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00474175 81E1FF000000            and ecx, 000000FF
:0047417B 8B55F0                  mov edx, dword ptr [ebp-10]
:0047417E 8B4204                  mov eax, dword ptr [edx+04]
:00474181 8B0C88                  mov ecx, dword ptr [eax+4*ecx]
:00474184 51                      push ecx
:00474185 6A14                    push 00000014
:00474187 8B55F8                  mov edx, dword ptr [ebp-08]
:0047418A 81E2FF000000            and edx, 000000FF
:00474190 83C202                  add edx, 00000002
:00474193 52                      push edx
:00474194 8B45EC                  mov eax, dword ptr [ebp-14]
:00474197 03450C                  add eax, dword ptr [ebp+0C]
:0047419A 50                      push eax
:0047419B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047419E 51                      push ecx
:0047419F 8B55FC                  mov edx, dword ptr [ebp-04]
:004741A2 81E2FF000000            and edx, 000000FF
:004741A8 6BD218                  imul edx, 00000018
:004741AB 8B45F0                  mov eax, dword ptr [ebp-10]
:004741AE 8D4C1008                lea ecx, dword ptr [eax+edx+08]
:004741B2 E8F9B8FBFF              call 0042FAB0
:004741B7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004741BA 81E1FF000000            and ecx, 000000FF
:004741C0 6BC918                  imul ecx, 00000018
:004741C3 8B55F0                  mov edx, dword ptr [ebp-10]
:004741C6 8D4C0A08                lea ecx, dword ptr [edx+ecx+08]
:004741CA E892FAFFFF              call 00473C61
:004741CF E932FFFFFF              jmp 00474106

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474120(C)
|
:004741D4 E81DA4FAFF              call 0041E5F6
:004741D9 8BE5                    mov esp, ebp
:004741DB 5D                      pop ebp
:004741DC C21000                  ret 0010



* Referenced by a CALL at Address:
|:0042EAB6   
|
:004741DF 55                      push ebp
:004741E0 8BEC                    mov ebp, esp
:004741E2 83EC0C                  sub esp, 0000000C
:004741E5 894DF4                  mov dword ptr [ebp-0C], ecx
:004741E8 C645FCFF                mov [ebp-04], FF
:004741EC C745F800000000          mov [ebp-08], 00000000
:004741F3 EB09                    jmp 004741FE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047422E(U)
|
:004741F5 8B45F8                  mov eax, dword ptr [ebp-08]
:004741F8 83C001                  add eax, 00000001
:004741FB 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004741F3(U)
|
:004741FE 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00474201 33D2                    xor edx, edx
:00474203 8A11                    mov dl, byte ptr [ecx]
:00474205 3955F8                  cmp dword ptr [ebp-08], edx
:00474208 7326                    jnb 00474230
:0047420A 8B45FC                  mov eax, dword ptr [ebp-04]
:0047420D 25FF000000              and eax, 000000FF
:00474212 3DFF000000              cmp eax, 000000FF
:00474217 7517                    jne 00474230
:00474219 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047421C 6BC918                  imul ecx, 00000018
:0047421F 8B55F4                  mov edx, dword ptr [ebp-0C]
:00474222 8D4C0A08                lea ecx, dword ptr [edx+ecx+08]
:00474226 E808FCFFFF              call 00473E33
:0047422B 8845FC                  mov byte ptr [ebp-04], al
:0047422E EBC5                    jmp 004741F5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00474208(C), :00474217(C)
|
:00474230 8A45FC                  mov al, byte ptr [ebp-04]
:00474233 8BE5                    mov esp, ebp
:00474235 5D                      pop ebp
:00474236 C3                      ret



* Referenced by a CALL at Address:
|:0042EADD   
|
:00474237 55                      push ebp
:00474238 8BEC                    mov ebp, esp
:0047423A 83EC08                  sub esp, 00000008
:0047423D 894DF8                  mov dword ptr [ebp-08], ecx
:00474240 C745FC00000000          mov [ebp-04], 00000000
:00474247 EB09                    jmp 00474252

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047427B(U)
|
:00474249 8B45FC                  mov eax, dword ptr [ebp-04]
:0047424C 83C001                  add eax, 00000001
:0047424F 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474247(U)
|
:00474252 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00474255 33D2                    xor edx, edx
:00474257 8A11                    mov dl, byte ptr [ecx]
:00474259 3955FC                  cmp dword ptr [ebp-04], edx
:0047425C 731F                    jnb 0047427D
:0047425E 8B45FC                  mov eax, dword ptr [ebp-04]
:00474261 6BC018                  imul eax, 00000018
:00474264 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00474267 8D4C0108                lea ecx, dword ptr [ecx+eax+08]
:0047426B E8C0000000              call 00474330
:00474270 85C0                    test eax, eax
:00474272 7407                    je 0047427B
:00474274 B801000000              mov eax, 00000001
:00474279 EB04                    jmp 0047427F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474272(C)
|
:0047427B EBCC                    jmp 00474249

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047425C(C)
|
:0047427D 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474279(U)
|
:0047427F 8BE5                    mov esp, ebp
:00474281 5D                      pop ebp
:00474282 C3                      ret


:00474283 CC                      int 03
:00474284 CC                      int 03
:00474285 CC                      int 03
:00474286 CC                      int 03
:00474287 CC                      int 03
:00474288 CC                      int 03
:00474289 CC                      int 03
:0047428A CC                      int 03
:0047428B CC                      int 03
:0047428C CC                      int 03
:0047428D CC                      int 03
:0047428E CC                      int 03
:0047428F CC                      int 03

* Referenced by a CALL at Addresses:
|:0047380D   , :0047384F   , :00473868   , :0047394B   , :00473A8F   
|:00473AAB   , :00473B14   
|
:00474290 55                      push ebp
:00474291 8BEC                    mov ebp, esp
:00474293 51                      push ecx
:00474294 56                      push esi
:00474295 894DFC                  mov dword ptr [ebp-04], ecx
:00474298 8B45FC                  mov eax, dword ptr [ebp-04]
:0047429B 8B4008                  mov eax, dword ptr [eax+08]
:0047429E 83E830                  sub eax, 00000030
:004742A1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004742A4 0FAF4114                imul eax, dword ptr [ecx+14]
:004742A8 8B55FC                  mov edx, dword ptr [ebp-04]
:004742AB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004742AE 8B7210                  mov esi, dword ptr [edx+10]
:004742B1 2B710C                  sub esi, dword ptr [ecx+0C]
:004742B4 33D2                    xor edx, edx
:004742B6 F7F6                    div esi
:004742B8 83C010                  add eax, 00000010
:004742BB 5E                      pop esi
:004742BC 8BE5                    mov esp, ebp
:004742BE 5D                      pop ebp
:004742BF C3                      ret



* Referenced by a CALL at Address:
|:00473901   
|
:004742C0 55                      push ebp
:004742C1 8BEC                    mov ebp, esp
:004742C3 83EC0C                  sub esp, 0000000C
:004742C6 56                      push esi
:004742C7 894DF8                  mov dword ptr [ebp-08], ecx
:004742CA 8B45F8                  mov eax, dword ptr [ebp-08]
:004742CD 8B4D08                  mov ecx, dword ptr [ebp+08]
:004742D0 2B4804                  sub ecx, dword ptr [eax+04]
:004742D3 83E910                  sub ecx, 00000010
:004742D6 8B55F8                  mov edx, dword ptr [ebp-08]
:004742D9 8B45F8                  mov eax, dword ptr [ebp-08]
:004742DC 8B5210                  mov edx, dword ptr [edx+10]
:004742DF 2B500C                  sub edx, dword ptr [eax+0C]
:004742E2 0FAFCA                  imul ecx, edx
:004742E5 8B45F8                  mov eax, dword ptr [ebp-08]
:004742E8 8B7008                  mov esi, dword ptr [eax+08]
:004742EB 83EE30                  sub esi, 00000030
:004742EE 8BC1                    mov eax, ecx
:004742F0 33D2                    xor edx, edx
:004742F2 F7F6                    div esi
:004742F4 8945FC                  mov dword ptr [ebp-04], eax
:004742F7 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004742FA 8B55F8                  mov edx, dword ptr [ebp-08]
:004742FD 8B4110                  mov eax, dword ptr [ecx+10]
:00474300 2B420C                  sub eax, dword ptr [edx+0C]
:00474303 3945FC                  cmp dword ptr [ebp-04], eax
:00474306 7D08                    jge 00474310
:00474308 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047430B 894DF4                  mov dword ptr [ebp-0C], ecx
:0047430E EB0F                    jmp 0047431F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474306(C)
|
:00474310 8B55F8                  mov edx, dword ptr [ebp-08]
:00474313 8B45F8                  mov eax, dword ptr [ebp-08]
:00474316 8B4A10                  mov ecx, dword ptr [edx+10]
:00474319 2B480C                  sub ecx, dword ptr [eax+0C]
:0047431C 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047430E(U)
|
:0047431F 8B55F4                  mov edx, dword ptr [ebp-0C]
:00474322 8955FC                  mov dword ptr [ebp-04], edx
:00474325 8B45FC                  mov eax, dword ptr [ebp-04]
:00474328 5E                      pop esi
:00474329 8BE5                    mov esp, ebp
:0047432B 5D                      pop ebp
:0047432C C20400                  ret 0004


:0047432F CC                      int 03

* Referenced by a CALL at Address:
|:0047426B   
|
:00474330 55                      push ebp
:00474331 8BEC                    mov ebp, esp
:00474333 51                      push ecx
:00474334 894DFC                  mov dword ptr [ebp-04], ecx
:00474337 8B45FC                  mov eax, dword ptr [ebp-04]
:0047433A 33C9                    xor ecx, ecx
:0047433C 8A4816                  mov cl, byte ptr [eax+16]
:0047433F 8BC1                    mov eax, ecx
:00474341 F7D8                    neg eax
:00474343 1BC0                    sbb eax, eax
:00474345 F7D8                    neg eax
:00474347 8BE5                    mov esp, ebp
:00474349 5D                      pop ebp
:0047434A C3                      ret


:0047434B CC                      int 03
:0047434C CC                      int 03
:0047434D CC                      int 03
:0047434E CC                      int 03
:0047434F CC                      int 03
:00474350 55                      push ebp
:00474351 8BEC                    mov ebp, esp
:00474353 E807000000              call 0047435F
:00474358 E811000000              call 0047436E
:0047435D 5D                      pop ebp
:0047435E C3                      ret



* Referenced by a CALL at Address:
|:00474353   
|
:0047435F 55                      push ebp
:00474360 8BEC                    mov ebp, esp
:00474362 B9B8694B00              mov ecx, 004B69B8
:00474367 E804070000              call 00474A70
:0047436C 5D                      pop ebp
:0047436D C3                      ret



* Referenced by a CALL at Address:
|:00474358   
|
:0047436E 55                      push ebp
:0047436F 8BEC                    mov ebp, esp
:00474371 6880434700              push 00474380
:00474376 E885CD0000              call 00481100
:0047437B 83C404                  add esp, 00000004
:0047437E 5D                      pop ebp
:0047437F C3                      ret


:00474380 55                      push ebp
:00474381 8BEC                    mov ebp, esp
:00474383 B9B8694B00              mov ecx, 004B69B8
:00474388 E841000000              call 004743CE
:0047438D 5D                      pop ebp
:0047438E C3                      ret


:0047438F 55                      push ebp
:00474390 8BEC                    mov ebp, esp
:00474392 E807000000              call 0047439E
:00474397 E811000000              call 004743AD
:0047439C 5D                      pop ebp
:0047439D C3                      ret



* Referenced by a CALL at Address:
|:00474392   
|
:0047439E 55                      push ebp
:0047439F 8BEC                    mov ebp, esp
:004743A1 B9B0694B00              mov ecx, 004B69B0
:004743A6 E815070000              call 00474AC0
:004743AB 5D                      pop ebp
:004743AC C3                      ret



* Referenced by a CALL at Address:
|:00474397   
|
:004743AD 55                      push ebp
:004743AE 8BEC                    mov ebp, esp
:004743B0 68BF434700              push 004743BF
:004743B5 E846CD0000              call 00481100
:004743BA 83C404                  add esp, 00000004
:004743BD 5D                      pop ebp
:004743BE C3                      ret


:004743BF 55                      push ebp
:004743C0 8BEC                    mov ebp, esp
:004743C2 B9B0694B00              mov ecx, 004B69B0
:004743C7 E873020000              call 0047463F
:004743CC 5D                      pop ebp
:004743CD C3                      ret



* Referenced by a CALL at Address:
|:00474388   
|
:004743CE 55                      push ebp
:004743CF 8BEC                    mov ebp, esp
:004743D1 51                      push ecx
:004743D2 894DFC                  mov dword ptr [ebp-04], ecx
:004743D5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004743D8 E862000000              call 0047443F
:004743DD 8BE5                    mov esp, ebp
:004743DF 5D                      pop ebp
:004743E0 C3                      ret


:004743E1 55                      push ebp
:004743E2 8BEC                    mov ebp, esp
:004743E4 51                      push ecx
:004743E5 894DFC                  mov dword ptr [ebp-04], ecx
:004743E8 FF15F0634800            call dword ptr [004863F0]
:004743EE 85C0                    test eax, eax
:004743F0 7504                    jne 004743F6
:004743F2 33C0                    xor eax, eax
:004743F4 EB45                    jmp 0047443B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004743F0(C)
|
:004743F6 FF15F4634800            call dword ptr [004863F4]
:004743FC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004743FF 8901                    mov dword ptr [ecx], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474430(U)
|

* Possible StringData Ref from Data Obj ->"SOUSOU"
                                  |
:00474401 68F4B34800              push 0048B3F4
:00474406 FF15F8634800            call dword ptr [004863F8]
:0047440C 83C404                  add esp, 00000004
:0047440F 8B55FC                  mov edx, dword ptr [ebp-04]
:00474412 894204                  mov dword ptr [edx+04], eax
:00474415 8B45FC                  mov eax, dword ptr [ebp-04]
:00474418 837804FF                cmp dword ptr [eax+04], FFFFFFFF
:0047441C 7518                    jne 00474436

* Possible StringData Ref from Data Obj ->"ѡ־ܲٴϷ̷
"
                                        ->"Ѿ룬˳ãĲų"
                                  |
:0047441E 68D4E74800              push 0048E7D4
:00474423 E8E9070000              call 00474C11
:00474428 83C404                  add esp, 00000004
:0047442B 83F801                  cmp eax, 00000001
:0047442E 7502                    jne 00474432
:00474430 EBCF                    jmp 00474401

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047442E(C)
|
:00474432 33C0                    xor eax, eax
:00474434 EB05                    jmp 0047443B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047441C(C)
|
:00474436 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004743F4(U), :00474434(U)
|
:0047443B 8BE5                    mov esp, ebp
:0047443D 5D                      pop ebp
:0047443E C3                      ret



* Referenced by a CALL at Addresses:
|:0042B655   , :004743D8   
|
:0047443F 55                      push ebp
:00474440 8BEC                    mov ebp, esp
:00474442 51                      push ecx
:00474443 894DFC                  mov dword ptr [ebp-04], ecx
:00474446 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00474449 E886000000              call 004744D4
:0047444E FF15EC634800            call dword ptr [004863EC]
:00474454 8BE5                    mov esp, ebp
:00474456 5D                      pop ebp
:00474457 C3                      ret



* Referenced by a CALL at Address:
|:004745F3   
|
:00474458 55                      push ebp
:00474459 8BEC                    mov ebp, esp
:0047445B 51                      push ecx
:0047445C 894DFC                  mov dword ptr [ebp-04], ecx
:0047445F 8B45FC                  mov eax, dword ptr [ebp-04]
:00474462 8B4804                  mov ecx, dword ptr [eax+04]
:00474465 51                      push ecx
:00474466 FF15DC634800            call dword ptr [004863DC]
:0047446C 83C404                  add esp, 00000004
:0047446F 0FBED0                  movsx edx, al
:00474472 85D2                    test edx, edx
:00474474 7504                    jne 0047447A
:00474476 33C0                    xor eax, eax
:00474478 EB54                    jmp 004744CE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474474(C)
|
:0047447A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047447D E8AF000000              call 00474531
:00474482 85C0                    test eax, eax
:00474484 741A                    je 004744A0
:00474486 8B45FC                  mov eax, dword ptr [ebp-04]
:00474489 8B480C                  mov ecx, dword ptr [eax+0C]
:0047448C 3B4D08                  cmp ecx, dword ptr [ebp+08]
:0047448F 7507                    jne 00474498
:00474491 B801000000              mov eax, 00000001
:00474496 EB36                    jmp 004744CE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047448F(C)
|
:00474498 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047449B E834000000              call 004744D4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474484(C)
|
:004744A0 8B550C                  mov edx, dword ptr [ebp+0C]
:004744A3 52                      push edx
:004744A4 8B4508                  mov eax, dword ptr [ebp+08]
:004744A7 50                      push eax
:004744A8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004744AB 8B5104                  mov edx, dword ptr [ecx+04]
:004744AE 52                      push edx
:004744AF FF1500644800            call dword ptr [00486400]
:004744B5 83C40C                  add esp, 0000000C
:004744B8 85C0                    test eax, eax
:004744BA 7504                    jne 004744C0
:004744BC 33C0                    xor eax, eax
:004744BE EB0E                    jmp 004744CE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004744BA(C)
|
:004744C0 8B45FC                  mov eax, dword ptr [ebp-04]
:004744C3 8B4D08                  mov ecx, dword ptr [ebp+08]
:004744C6 89480C                  mov dword ptr [eax+0C], ecx
:004744C9 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00474478(U), :00474496(U), :004744BE(U)
|
:004744CE 8BE5                    mov esp, ebp
:004744D0 5D                      pop ebp
:004744D1 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:00474449   , :0047449B   , :00474623   
|
:004744D4 55                      push ebp
:004744D5 8BEC                    mov ebp, esp
:004744D7 51                      push ecx
:004744D8 894DFC                  mov dword ptr [ebp-04], ecx
:004744DB 6A00                    push 00000000
:004744DD 8B45FC                  mov eax, dword ptr [ebp-04]
:004744E0 8B4804                  mov ecx, dword ptr [eax+04]
:004744E3 51                      push ecx
:004744E4 FF15D8634800            call dword ptr [004863D8]
:004744EA 83C408                  add esp, 00000008
:004744ED 8B55FC                  mov edx, dword ptr [ebp-04]
:004744F0 C7420C00000000          mov [edx+0C], 00000000
:004744F7 8BE5                    mov esp, ebp
:004744F9 5D                      pop ebp
:004744FA C3                      ret



* Referenced by a CALL at Address:
|:0047BD33   
|
:004744FB 55                      push ebp
:004744FC 8BEC                    mov ebp, esp
:004744FE 51                      push ecx
:004744FF 894DFC                  mov dword ptr [ebp-04], ecx
:00474502 8B45FC                  mov eax, dword ptr [ebp-04]
:00474505 8B4804                  mov ecx, dword ptr [eax+04]
:00474508 51                      push ecx
:00474509 FF15D4634800            call dword ptr [004863D4]
:0047450F 83C404                  add esp, 00000004
:00474512 8BE5                    mov esp, ebp
:00474514 5D                      pop ebp
:00474515 C3                      ret



* Referenced by a CALL at Address:
|:0047BDD9   
|
:00474516 55                      push ebp
:00474517 8BEC                    mov ebp, esp
:00474519 51                      push ecx
:0047451A 894DFC                  mov dword ptr [ebp-04], ecx
:0047451D 8B45FC                  mov eax, dword ptr [ebp-04]
:00474520 8B4804                  mov ecx, dword ptr [eax+04]
:00474523 51                      push ecx
:00474524 FF15E0634800            call dword ptr [004863E0]
:0047452A 83C404                  add esp, 00000004
:0047452D 8BE5                    mov esp, ebp
:0047452F 5D                      pop ebp
:00474530 C3                      ret



* Referenced by a CALL at Addresses:
|:0047447D   , :00474636   
|
:00474531 55                      push ebp
:00474532 8BEC                    mov ebp, esp
:00474534 51                      push ecx
:00474535 894DFC                  mov dword ptr [ebp-04], ecx
:00474538 8B45FC                  mov eax, dword ptr [ebp-04]
:0047453B 8B4804                  mov ecx, dword ptr [eax+04]
:0047453E 51                      push ecx
:0047453F FF15E8634800            call dword ptr [004863E8]
:00474545 83C404                  add esp, 00000004
:00474548 8BE5                    mov esp, ebp
:0047454A 5D                      pop ebp
:0047454B C3                      ret


:0047454C 55                      push ebp
:0047454D 8BEC                    mov ebp, esp
:0047454F 51                      push ecx
:00474550 894DFC                  mov dword ptr [ebp-04], ecx
:00474553 8B45FC                  mov eax, dword ptr [ebp-04]
:00474556 83C01F                  add eax, 0000001F
:00474559 50                      push eax
:0047455A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047455D 83C11E                  add ecx, 0000001E
:00474560 51                      push ecx
:00474561 8B55FC                  mov edx, dword ptr [ebp-04]
:00474564 83C21D                  add edx, 0000001D
:00474567 52                      push edx
:00474568 8B45FC                  mov eax, dword ptr [ebp-04]
:0047456B 83C01C                  add eax, 0000001C
:0047456E 50                      push eax
:0047456F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00474572 8B5104                  mov edx, dword ptr [ecx+04]
:00474575 52                      push edx
:00474576 FF15E4634800            call dword ptr [004863E4]
:0047457C 83C414                  add esp, 00000014
:0047457F 85C0                    test eax, eax
:00474581 7505                    jne 00474588
:00474583 83C8FF                  or eax, FFFFFFFF
:00474586 EB0A                    jmp 00474592

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474581(C)
|
:00474588 8B45FC                  mov eax, dword ptr [ebp-04]
:0047458B 33C9                    xor ecx, ecx
:0047458D 8A481C                  mov cl, byte ptr [eax+1C]
:00474590 8BC1                    mov eax, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474586(U)
|
:00474592 8BE5                    mov esp, ebp
:00474594 5D                      pop ebp
:00474595 C3                      ret


:00474596 55                      push ebp
:00474597 8BEC                    mov ebp, esp
:00474599 51                      push ecx
:0047459A 894DFC                  mov dword ptr [ebp-04], ecx
:0047459D 8B45FC                  mov eax, dword ptr [ebp-04]
:004745A0 8B4804                  mov ecx, dword ptr [eax+04]
:004745A3 51                      push ecx
:004745A4 FF15FC634800            call dword ptr [004863FC]
:004745AA 83C404                  add esp, 00000004
:004745AD 8BE5                    mov esp, ebp
:004745AF 5D                      pop ebp
:004745B0 C3                      ret



* Referenced by a CALL at Address:
|:0047460E   
|
:004745B1 55                      push ebp
:004745B2 8BEC                    mov ebp, esp
:004745B4 51                      push ecx
:004745B5 894DFC                  mov dword ptr [ebp-04], ecx
:004745B8 837D0816                cmp dword ptr [ebp+08], 00000016
:004745BC 7202                    jb 004745C0
:004745BE EB38                    jmp 004745F8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004745BC(C)
|
:004745C0 8B4508                  mov eax, dword ptr [ebp+08]
:004745C3 25FF000000              and eax, 000000FF
:004745C8 50                      push eax
:004745C9 B970074B00              mov ecx, 004B0770
:004745CE E84D47FAFF              call 00418D20
:004745D3 B970074B00              mov ecx, 004B0770
:004745D8 E83363FBFF              call 0042A910
:004745DD 2500200000              and eax, 00002000
:004745E2 85C0                    test eax, eax
:004745E4 7502                    jne 004745E8
:004745E6 EB10                    jmp 004745F8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004745E4(C)
|
:004745E8 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004745EB 51                      push ecx
:004745EC 8B5508                  mov edx, dword ptr [ebp+08]
:004745EF 52                      push edx
:004745F0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004745F3 E860FEFFFF              call 00474458

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004745BE(U), :004745E6(U)
|
:004745F8 8BE5                    mov esp, ebp
:004745FA 5D                      pop ebp
:004745FB C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:00415867   , :0041B11F   , :0041BA57   , :0041BFB1   , :004312E7   
|:00444FC9   , :00445953   , :00448ABE   , :00449936   , :0044B6BA   
|:0044D3C1   
|
:004745FE 55                      push ebp
:004745FF 8BEC                    mov ebp, esp
:00474601 51                      push ecx
:00474602 894DFC                  mov dword ptr [ebp-04], ecx
:00474605 6A01                    push 00000001
:00474607 8B4508                  mov eax, dword ptr [ebp+08]
:0047460A 50                      push eax
:0047460B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047460E E89EFFFFFF              call 004745B1
:00474613 8BE5                    mov esp, ebp
:00474615 5D                      pop ebp
:00474616 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00415882   , :0041B105   , :0041BA3D   , :0042B64B   , :0042B6DA   
|:0042B7E2   , :0042C00C   , :0042C0F9   , :0042F779   , :004312DB   
|:004314D3   , :0044D0EB   , :0044D476   
|
:00474619 55                      push ebp
:0047461A 8BEC                    mov ebp, esp
:0047461C 51                      push ecx
:0047461D 894DFC                  mov dword ptr [ebp-04], ecx
:00474620 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00474623 E8ACFEFFFF              call 004744D4
:00474628 8BE5                    mov esp, ebp
:0047462A 5D                      pop ebp
:0047462B C3                      ret


:0047462C 55                      push ebp
:0047462D 8BEC                    mov ebp, esp
:0047462F 51                      push ecx
:00474630 894DFC                  mov dword ptr [ebp-04], ecx
:00474633 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00474636 E8F6FEFFFF              call 00474531
:0047463B 8BE5                    mov esp, ebp
:0047463D 5D                      pop ebp
:0047463E C3                      ret



* Referenced by a CALL at Address:
|:004743C7   
|
:0047463F 55                      push ebp
:00474640 8BEC                    mov ebp, esp
:00474642 51                      push ecx
:00474643 894DFC                  mov dword ptr [ebp-04], ecx
:00474646 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00474649 E804000000              call 00474652
:0047464E 8BE5                    mov esp, ebp
:00474650 5D                      pop ebp
:00474651 C3                      ret



* Referenced by a CALL at Addresses:
|:0040206A   , :0041BA20   , :0042B65F   , :0042B7D8   , :0042C103   
|:0042F783   , :004312D1   , :0044D0F5   , :0044D3A7   , :0044D480   
|:0044DA00   , :00474649   , :0047494A   , :00474976   , :00474996   
|:00474A17   , :00474A36   
|
:00474652 55                      push ebp
:00474653 8BEC                    mov ebp, esp
:00474655 51                      push ecx
:00474656 894DFC                  mov dword ptr [ebp-04], ecx
:00474659 6A00                    push 00000000
:0047465B 6A00                    push 00000000
:0047465D FF15C8634800            call dword ptr [004863C8]
:00474663 8B45FC                  mov eax, dword ptr [ebp-04]
:00474666 C700FFFFFFFF            mov dword ptr [eax], FFFFFFFF
:0047466C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047466F C7410400000000          mov [ecx+04], 00000000
:00474676 8BE5                    mov esp, ebp
:00474678 5D                      pop ebp
:00474679 C3                      ret



* Referenced by a CALL at Addresses:
|:00402082   , :00403161   , :0040437B   , :004043D9   , :004043FA   
|:004048F5   , :00404917   , :00404927   , :00404A5D   , :00404BD2   
|:00404E4F   , :00404F07   , :00404FAE   , :00407501   , :004084DB   
|:00408572   , :00415096   , :0041C9C2   , :0041D870   , :0041D945   
|:0042198C   , :00421C34   , :00423C0B   , :00424D1C   , :0042C111   
|:004339E2   , :00433AFE   , :00433CC7   , :00433EE6   , :00433FA0   
|:00434059   , :0043439F   , :00434503   , :004348DA   , :00434981   
|:00434A7F   , :00434B26   , :00434C3F   , :00434CF8   , :00434E71   
|:00434F19   , :00434F5D   , :0043D77F   , :0043D84E   , :0043D85E   
|:0043D8A4   , :0043D8B4   , :0043D8D6   , :0043D90B   , :0043D91B   
|:0043D95E   , :0043D96E   , :0043D9D4   , :0043DC41   , :0043F473   
|:00441814   , :00441B52   , :00441BE8   , :00441DF8   , :00443D45   
|:00443EE1   , :00444081   , :004441D3   , :004442A2   , :0044441A   
|:00444610   , :00444873   , :00444C4B   , :00444D65   , :00444E39   
|:00445EB1   , :00445EF2   , :0044605F   , :004463FD   , :0044644E   
|:00446829   , :00446BA3   , :00446F94   , :00447351   , :004473F9   
|:00447A43   , :00447A94   , :00448268   , :0044E3DE   , :0044E4A9   
|:00455602   , :00455662   , :0045568E   , :004556E7   , :00456490   
|:004566EC   , :00456720   , :00456730   , :00456C7E   , :0045723E   
|:00457365   , :00457532   , :00457699   , :00457A70   , :00457C2C   
|:00457D17   , :00457E02   , :00457FBA   , :0045817B   , :00458435   
|:00458685   , :004587CC   , :0045893B   , :00458A8B   , :0045931C   
|:00459420   , :00459B5B   , :0045D883   , :0045D954   , :0045E9A8   
|:0046BD15   , :0046DD2F   , :0046DD3F   , :0046E358   , :00473F0A   
|:00474A4C   , :0047974F   
|
:0047467A 55                      push ebp
:0047467B 8BEC                    mov ebp, esp
:0047467D 83EC08                  sub esp, 00000008
:00474680 894DF8                  mov dword ptr [ebp-08], ecx
:00474683 8B450C                  mov eax, dword ptr [ebp+0C]
:00474686 F7D8                    neg eax
:00474688 1BC0                    sbb eax, eax
:0047468A 25FEFF0000              and eax, 0000FFFE
:0047468F 83C001                  add eax, 00000001
:00474692 8945FC                  mov dword ptr [ebp-04], eax
:00474695 6A00                    push 00000000
:00474697 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047469A 51                      push ecx
:0047469B 8B5508                  mov edx, dword ptr [ebp+08]
:0047469E 52                      push edx
:0047469F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004746A2 E8D0000000              call 00474777
:004746A7 8BE5                    mov esp, ebp
:004746A9 5D                      pop ebp
:004746AA C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0045DFEC   , :004637D3   , :004638B2   , :004653A0   , :0046830C   
|:0046A026   , :0046A0FF   , :0046A10D   , :0046AFA3   , :0046BA11   
|:0046BF4B   , :0046BF67   , :0046D362   , :0046EDF7   , :0046EE43   
|:0046F9CA   , :00471CC8   , :00479110   , :0047AE6A   
|
:004746AD 55                      push ebp
:004746AE 8BEC                    mov ebp, esp
:004746B0 51                      push ecx
:004746B1 894DFC                  mov dword ptr [ebp-04], ecx
:004746B4 6A01                    push 00000001
:004746B6 6A01                    push 00000001
:004746B8 8B4508                  mov eax, dword ptr [ebp+08]
:004746BB 50                      push eax
:004746BC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004746BF E8B3000000              call 00474777
:004746C4 8BE5                    mov esp, ebp
:004746C6 5D                      pop ebp
:004746C7 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0044D101   , :0044D48C   , :00474767   , :00474A23   
|
:004746CA 55                      push ebp
:004746CB 8BEC                    mov ebp, esp
:004746CD 83EC08                  sub esp, 00000008
:004746D0 894DF8                  mov dword ptr [ebp-08], ecx
:004746D3 6A00                    push 00000000
:004746D5 6A00                    push 00000000
:004746D7 8B4508                  mov eax, dword ptr [ebp+08]
:004746DA 50                      push eax
:004746DB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004746DE E894000000              call 00474777
:004746E3 8945FC                  mov dword ptr [ebp-04], eax
:004746E6 837DFC00                cmp dword ptr [ebp-04], 00000000
:004746EA 740A                    je 004746F6
:004746EC 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004746EF C7410401000000          mov [ecx+04], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004746EA(C)
|
:004746F6 8B45FC                  mov eax, dword ptr [ebp-04]
:004746F9 8BE5                    mov esp, ebp
:004746FB 5D                      pop ebp
:004746FC C20400                  ret 0004



* Referenced by a CALL at Address:
|:00474A5E   
|
:004746FF 55                      push ebp
:00474700 8BEC                    mov ebp, esp
:00474702 51                      push ecx
:00474703 894DFC                  mov dword ptr [ebp-04], ecx
:00474706 6A00                    push 00000000
:00474708 8B450C                  mov eax, dword ptr [ebp+0C]
:0047470B 50                      push eax
:0047470C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047470F 51                      push ecx
:00474710 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00474713 E85F000000              call 00474777
:00474718 8BE5                    mov esp, ebp
:0047471A 5D                      pop ebp
:0047471B C20800                  ret 0008



* Referenced by a CALL at Address:
|:0047BD3D   
|
:0047471E 55                      push ebp
:0047471F 8BEC                    mov ebp, esp
:00474721 51                      push ecx
:00474722 894DFC                  mov dword ptr [ebp-04], ecx
:00474725 8B45FC                  mov eax, dword ptr [ebp-04]
:00474728 83780400                cmp dword ptr [eax+04], 00000000
:0047472C 740A                    je 00474738
:0047472E 6A00                    push 00000000
:00474730 6A00                    push 00000000
:00474732 FF15C8634800            call dword ptr [004863C8]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047472C(C)
|
:00474738 8BE5                    mov esp, ebp
:0047473A 5D                      pop ebp
:0047473B C3                      ret



* Referenced by a CALL at Address:
|:0047BDCF   
|
:0047473C 55                      push ebp
:0047473D 8BEC                    mov ebp, esp
:0047473F 51                      push ecx
:00474740 894DFC                  mov dword ptr [ebp-04], ecx
:00474743 8B45FC                  mov eax, dword ptr [ebp-04]
:00474746 83780400                cmp dword ptr [eax+04], 00000000
:0047474A 7422                    je 0047476E
:0047474C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047474F 8339FF                  cmp dword ptr [ecx], FFFFFFFF
:00474752 741A                    je 0047476E
:00474754 8B55FC                  mov edx, dword ptr [ebp-04]
:00474757 C7420400000000          mov [edx+04], 00000000
:0047475E 8B45FC                  mov eax, dword ptr [ebp-04]
:00474761 8B08                    mov ecx, dword ptr [eax]
:00474763 51                      push ecx
:00474764 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00474767 E85EFFFFFF              call 004746CA
:0047476C EB05                    jmp 00474773

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047474A(C), :00474752(C)
|
:0047476E B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047476C(U)
|
:00474773 8BE5                    mov esp, ebp
:00474775 5D                      pop ebp
:00474776 C3                      ret



* Referenced by a CALL at Addresses:
|:004746A2   , :004746BF   , :004746DE   , :00474713   
|
:00474777 55                      push ebp
:00474778 8BEC                    mov ebp, esp
:0047477A 83EC50                  sub esp, 00000050
:0047477D 894DB0                  mov dword ptr [ebp-50], ecx
:00474780 B970074B00              mov ecx, 004B0770
:00474785 E88661FBFF              call 0042A910
:0047478A 2500100000              and eax, 00001000
:0047478F 85C0                    test eax, eax
:00474791 7507                    jne 0047479A
:00474793 33C0                    xor eax, eax
:00474795 E967020000              jmp 00474A01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474791(C)
|
:0047479A 8B45B0                  mov eax, dword ptr [ebp-50]
:0047479D 83780400                cmp dword ptr [eax+04], 00000000
:004747A1 7407                    je 004747AA
:004747A3 33C0                    xor eax, eax
:004747A5 E957020000              jmp 00474A01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004747A1(C)
|
:004747AA C745E803000000          mov [ebp-18], 00000003
:004747B1 C745D000000000          mov [ebp-30], 00000000
:004747B8 8B0D24E84800            mov ecx, dword ptr [0048E824]
:004747BE 894DEC                  mov dword ptr [ebp-14], ecx
:004747C1 8B1528E84800            mov edx, dword ptr [0048E828]
:004747C7 8955F0                  mov dword ptr [ebp-10], edx
:004747CA A02CE84800              mov al, byte ptr [0048E82C]
:004747CF 8845F4                  mov byte ptr [ebp-0C], al
:004747D2 33C9                    xor ecx, ecx
:004747D4 894DF5                  mov dword ptr [ebp-0B], ecx
:004747D7 894DF9                  mov dword ptr [ebp-07], ecx
:004747DA 66894DFD                mov word ptr [ebp-03], cx
:004747DE 884DFF                  mov byte ptr [ebp-01], cl
:004747E1 8B1530E84800            mov edx, dword ptr [0048E830]
:004747E7 8955B8                  mov dword ptr [ebp-48], edx
:004747EA A134E84800              mov eax, dword ptr [0048E834]
:004747EF 8945BC                  mov dword ptr [ebp-44], eax
:004747F2 8B0D38E84800            mov ecx, dword ptr [0048E838]
:004747F8 894DC0                  mov dword ptr [ebp-40], ecx
:004747FB 33D2                    xor edx, edx
:004747FD 8955C4                  mov dword ptr [ebp-3C], edx
:00474800 8955C8                  mov dword ptr [ebp-38], edx
:00474803 A13CE84800              mov eax, dword ptr [0048E83C]
:00474808 8945D4                  mov dword ptr [ebp-2C], eax
:0047480B 8B0D40E84800            mov ecx, dword ptr [0048E840]
:00474811 894DD8                  mov dword ptr [ebp-28], ecx
:00474814 8B1544E84800            mov edx, dword ptr [0048E844]
:0047481A 8955DC                  mov dword ptr [ebp-24], edx
:0047481D 33C0                    xor eax, eax
:0047481F 8945E0                  mov dword ptr [ebp-20], eax
:00474822 8945E4                  mov dword ptr [ebp-1C], eax
:00474825 8B4D08                  mov ecx, dword ptr [ebp+08]
:00474828 894DB4                  mov dword ptr [ebp-4C], ecx
:0047482B 817D08C8000000          cmp dword ptr [ebp+08], 000000C8
:00474832 7C52                    jl 00474886
:00474834 817D08D1000000          cmp dword ptr [ebp+08], 000000D1
:0047483B 7C07                    jl 00474844
:0047483D 33C0                    xor eax, eax
:0047483F E9BD010000              jmp 00474A01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047483B(C)
|
:00474844 8B55B4                  mov edx, dword ptr [ebp-4C]
:00474847 81EAC8000000            sub edx, 000000C8
:0047484D 8955B4                  mov dword ptr [ebp-4C], edx
:00474850 8B45B4                  mov eax, dword ptr [ebp-4C]
:00474853 99                      cdq
:00474854 B90A000000              mov ecx, 0000000A
:00474859 F7F9                    idiv ecx
:0047485B 83C030                  add eax, 00000030
:0047485E 8845D9                  mov byte ptr [ebp-27], al
:00474861 8B45B4                  mov eax, dword ptr [ebp-4C]
:00474864 99                      cdq
:00474865 B90A000000              mov ecx, 0000000A
:0047486A F7F9                    idiv ecx
:0047486C 83C230                  add edx, 00000030
:0047486F 8855DA                  mov byte ptr [ebp-26], dl
:00474872 8D55D4                  lea edx, dword ptr [ebp-2C]
:00474875 52                      push edx
:00474876 E85946FAFF              call 00418ED4
:0047487B 83C404                  add esp, 00000004
:0047487E 8945CC                  mov dword ptr [ebp-34], eax
:00474881 E990000000              jmp 00474916

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474832(C)
|
:00474886 837D0864                cmp dword ptr [ebp+08], 00000064
:0047488A 7C4C                    jl 004748D8
:0047488C 817D0889000000          cmp dword ptr [ebp+08], 00000089
:00474893 7C07                    jl 0047489C
:00474895 33C0                    xor eax, eax
:00474897 E965010000              jmp 00474A01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474893(C)
|
:0047489C 8B45B4                  mov eax, dword ptr [ebp-4C]
:0047489F 83E864                  sub eax, 00000064
:004748A2 8945B4                  mov dword ptr [ebp-4C], eax
:004748A5 8B45B4                  mov eax, dword ptr [ebp-4C]
:004748A8 99                      cdq
:004748A9 B90A000000              mov ecx, 0000000A
:004748AE F7F9                    idiv ecx
:004748B0 83C030                  add eax, 00000030
:004748B3 8845BD                  mov byte ptr [ebp-43], al
:004748B6 8B45B4                  mov eax, dword ptr [ebp-4C]
:004748B9 99                      cdq
:004748BA B90A000000              mov ecx, 0000000A
:004748BF F7F9                    idiv ecx
:004748C1 83C230                  add edx, 00000030
:004748C4 8855BE                  mov byte ptr [ebp-42], dl
:004748C7 8D55B8                  lea edx, dword ptr [ebp-48]
:004748CA 52                      push edx
:004748CB E80446FAFF              call 00418ED4
:004748D0 83C404                  add esp, 00000004
:004748D3 8945CC                  mov dword ptr [ebp-34], eax
:004748D6 EB3E                    jmp 00474916

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047488A(C)
|
:004748D8 837D082B                cmp dword ptr [ebp+08], 0000002B
:004748DC 7C07                    jl 004748E5
:004748DE 33C0                    xor eax, eax
:004748E0 E91C010000              jmp 00474A01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004748DC(C)
|
:004748E5 8B45B4                  mov eax, dword ptr [ebp-4C]
:004748E8 99                      cdq
:004748E9 B90A000000              mov ecx, 0000000A
:004748EE F7F9                    idiv ecx
:004748F0 83C030                  add eax, 00000030
:004748F3 8845EE                  mov byte ptr [ebp-12], al
:004748F6 8B45B4                  mov eax, dword ptr [ebp-4C]
:004748F9 99                      cdq
:004748FA B90A000000              mov ecx, 0000000A
:004748FF F7F9                    idiv ecx
:00474901 83C230                  add edx, 00000030
:00474904 8855EF                  mov byte ptr [ebp-11], dl
:00474907 8D55EC                  lea edx, dword ptr [ebp-14]
:0047490A 52                      push edx
:0047490B E8C445FAFF              call 00418ED4
:00474910 83C404                  add esp, 00000004
:00474913 8945CC                  mov dword ptr [ebp-34], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00474881(U), :004748D6(U)
|
:00474916 837D0C01                cmp dword ptr [ebp+0C], 00000001
:0047491A 754E                    jne 0047496A
:0047491C 8B45B0                  mov eax, dword ptr [ebp-50]
:0047491F 8B08                    mov ecx, dword ptr [eax]
:00474921 3B4D08                  cmp ecx, dword ptr [ebp+08]
:00474924 7406                    je 0047492C
:00474926 837D1000                cmp dword ptr [ebp+10], 00000000
:0047492A 741B                    je 00474947

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474924(C)
|
:0047492C 8B55E8                  mov edx, dword ptr [ebp-18]
:0047492F 83CA10                  or edx, 00000010
:00474932 52                      push edx
:00474933 8B45CC                  mov eax, dword ptr [ebp-34]
:00474936 50                      push eax
:00474937 FF15C8634800            call dword ptr [004863C8]
:0047493D B801000000              mov eax, 00000001
:00474942 E9BA000000              jmp 00474A01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047492A(C)
|
:00474947 8B4DB0                  mov ecx, dword ptr [ebp-50]
:0047494A E803FDFFFF              call 00474652
:0047494F 8B4DB0                  mov ecx, dword ptr [ebp-50]
:00474952 8B5508                  mov edx, dword ptr [ebp+08]
:00474955 8911                    mov dword ptr [ecx], edx
:00474957 8B45E8                  mov eax, dword ptr [ebp-18]
:0047495A 50                      push eax
:0047495B 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0047495E 51                      push ecx
:0047495F FF15C8634800            call dword ptr [004863C8]
:00474965 E997000000              jmp 00474A01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047491A(C)
|
:0047496A 817D0CFFFF0000          cmp dword ptr [ebp+0C], 0000FFFF
:00474971 7520                    jne 00474993
:00474973 8B4DB0                  mov ecx, dword ptr [ebp-50]
:00474976 E8D7FCFFFF              call 00474652
:0047497B 8B55B0                  mov edx, dword ptr [ebp-50]
:0047497E 8B4508                  mov eax, dword ptr [ebp+08]
:00474981 8902                    mov dword ptr [edx], eax
:00474983 8B4DE8                  mov ecx, dword ptr [ebp-18]
:00474986 51                      push ecx
:00474987 8B55CC                  mov edx, dword ptr [ebp-34]
:0047498A 52                      push edx
:0047498B FF15C8634800            call dword ptr [004863C8]
:00474991 EB6E                    jmp 00474A01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474971(C)
|
:00474993 8B4DB0                  mov ecx, dword ptr [ebp-50]
:00474996 E8B7FCFFFF              call 00474652
:0047499B 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0047499F 751B                    jne 004749BC
:004749A1 8B45B0                  mov eax, dword ptr [ebp-50]
:004749A4 8B4D08                  mov ecx, dword ptr [ebp+08]
:004749A7 8908                    mov dword ptr [eax], ecx
:004749A9 8B55E8                  mov edx, dword ptr [ebp-18]
:004749AC 83CA08                  or edx, 00000008
:004749AF 52                      push edx
:004749B0 8B45CC                  mov eax, dword ptr [ebp-34]
:004749B3 50                      push eax
:004749B4 FF15C8634800            call dword ptr [004863C8]
:004749BA EB45                    jmp 00474A01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047499F(C)
|
:004749BC 8B4DB0                  mov ecx, dword ptr [ebp-50]
:004749BF 8B5508                  mov edx, dword ptr [ebp+08]
:004749C2 8911                    mov dword ptr [ecx], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004749F1(C)
|
:004749C4 8B45E8                  mov eax, dword ptr [ebp-18]
:004749C7 0C10                    or al, 10
:004749C9 50                      push eax
:004749CA 8B4DCC                  mov ecx, dword ptr [ebp-34]
:004749CD 51                      push ecx
:004749CE FF15C8634800            call dword ptr [004863C8]
:004749D4 85C0                    test eax, eax
:004749D6 7409                    je 004749E1
:004749D8 8B55D0                  mov edx, dword ptr [ebp-30]
:004749DB 83C201                  add edx, 00000001
:004749DE 8955D0                  mov dword ptr [ebp-30], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004749D6(C)
|

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:004749E1 6A06                    push 00000006
:004749E3 E83A7BFBFF              call 0042C522
:004749E8 83C404                  add esp, 00000004
:004749EB 8B45D0                  mov eax, dword ptr [ebp-30]
:004749EE 3B450C                  cmp eax, dword ptr [ebp+0C]
:004749F1 7CD1                    jl 004749C4
:004749F3 8B4DB0                  mov ecx, dword ptr [ebp-50]
:004749F6 C701FFFFFFFF            mov dword ptr [ecx], FFFFFFFF
:004749FC B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00474795(U), :004747A5(U), :0047483F(U), :00474897(U), :004748E0(U)
|:00474942(U), :00474965(U), :00474991(U), :004749BA(U)
|
:00474A01 8BE5                    mov esp, ebp
:00474A03 5D                      pop ebp
:00474A04 C20C00                  ret 000C



* Referenced by a CALL at Address:
|:0041580E   
|
:00474A07 55                      push ebp
:00474A08 8BEC                    mov ebp, esp
:00474A0A 51                      push ecx
:00474A0B 894DFC                  mov dword ptr [ebp-04], ecx
:00474A0E 837D0C00                cmp dword ptr [ebp+0C], 00000000
:00474A12 7516                    jne 00474A2A
:00474A14 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00474A17 E836FCFFFF              call 00474652
:00474A1C 8B4508                  mov eax, dword ptr [ebp+08]
:00474A1F 50                      push eax
:00474A20 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00474A23 E8A2FCFFFF              call 004746CA
:00474A28 EB39                    jmp 00474A63

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474A12(C)
|
:00474A2A 817D0CFF000000          cmp dword ptr [ebp+0C], 000000FF
:00474A31 750A                    jne 00474A3D
:00474A33 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00474A36 E817FCFFFF              call 00474652
:00474A3B EB26                    jmp 00474A63

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474A31(C)
|
:00474A3D 837D0C01                cmp dword ptr [ebp+0C], 00000001
:00474A41 7510                    jne 00474A53
:00474A43 6A01                    push 00000001
:00474A45 8B4D08                  mov ecx, dword ptr [ebp+08]
:00474A48 51                      push ecx
:00474A49 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00474A4C E829FCFFFF              call 0047467A
:00474A51 EB10                    jmp 00474A63

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474A41(C)
|
:00474A53 8B550C                  mov edx, dword ptr [ebp+0C]
:00474A56 52                      push edx
:00474A57 8B4508                  mov eax, dword ptr [ebp+08]
:00474A5A 50                      push eax
:00474A5B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00474A5E E89CFCFFFF              call 004746FF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00474A28(U), :00474A3B(U), :00474A51(U)
|
:00474A63 8BE5                    mov esp, ebp
:00474A65 5D                      pop ebp
:00474A66 C20800                  ret 0008


:00474A69 CC                      int 03
:00474A6A CC                      int 03
:00474A6B CC                      int 03
:00474A6C CC                      int 03
:00474A6D CC                      int 03
:00474A6E CC                      int 03
:00474A6F CC                      int 03

* Referenced by a CALL at Address:
|:00474367   
|
:00474A70 55                      push ebp
:00474A71 8BEC                    mov ebp, esp
:00474A73 51                      push ecx
:00474A74 894DFC                  mov dword ptr [ebp-04], ecx
:00474A77 8B45FC                  mov eax, dword ptr [ebp-04]
:00474A7A C70001000000            mov dword ptr [eax], 00000001
:00474A80 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00474A83 C74104FFFFFFFF          mov [ecx+04], FFFFFFFF
:00474A8A 8B55FC                  mov edx, dword ptr [ebp-04]
:00474A8D C6420844                mov [edx+08], 44
:00474A91 8B45FC                  mov eax, dword ptr [ebp-04]
:00474A94 C7400C00000000          mov [eax+0C], 00000000
:00474A9B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00474A9E C7411000000000          mov [ecx+10], 00000000
:00474AA5 8B55FC                  mov edx, dword ptr [ebp-04]
:00474AA8 C74220FFFF0000          mov [edx+20], 0000FFFF
:00474AAF 8B45FC                  mov eax, dword ptr [ebp-04]
:00474AB2 8BE5                    mov esp, ebp
:00474AB4 5D                      pop ebp
:00474AB5 C3                      ret


:00474AB6 CC                      int 03
:00474AB7 CC                      int 03
:00474AB8 CC                      int 03
:00474AB9 CC                      int 03
:00474ABA CC                      int 03
:00474ABB CC                      int 03
:00474ABC CC                      int 03
:00474ABD CC                      int 03
:00474ABE CC                      int 03
:00474ABF CC                      int 03

* Referenced by a CALL at Address:
|:004743A6   
|
:00474AC0 55                      push ebp
:00474AC1 8BEC                    mov ebp, esp
:00474AC3 51                      push ecx
:00474AC4 894DFC                  mov dword ptr [ebp-04], ecx
:00474AC7 8B45FC                  mov eax, dword ptr [ebp-04]
:00474ACA C700FFFFFFFF            mov dword ptr [eax], FFFFFFFF
:00474AD0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00474AD3 C7410400000000          mov [ecx+04], 00000000
:00474ADA 8B45FC                  mov eax, dword ptr [ebp-04]
:00474ADD 8BE5                    mov esp, ebp
:00474ADF 5D                      pop ebp
:00474AE0 C3                      ret


:00474AE1 CC                      int 03
:00474AE2 CC                      int 03
:00474AE3 CC                      int 03
:00474AE4 CC                      int 03
:00474AE5 CC                      int 03
:00474AE6 CC                      int 03
:00474AE7 CC                      int 03
:00474AE8 CC                      int 03
:00474AE9 CC                      int 03
:00474AEA CC                      int 03
:00474AEB CC                      int 03
:00474AEC CC                      int 03
:00474AED CC                      int 03
:00474AEE CC                      int 03
:00474AEF CC                      int 03

* Referenced by a CALL at Addresses:
|:0042F708   , :00474BBF   
|
:00474AF0 55                      push ebp
:00474AF1 8BEC                    mov ebp, esp
:00474AF3 8B4510                  mov eax, dword ptr [ebp+10]
:00474AF6 50                      push eax
:00474AF7 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00474AFA 51                      push ecx
:00474AFB 8B5508                  mov edx, dword ptr [ebp+08]
:00474AFE 52                      push edx
:00474AFF A1686A4B00              mov eax, dword ptr [004B6A68]
:00474B04 50                      push eax
:00474B05 E805000000              call 00474B0F
:00474B0A 83C410                  add esp, 00000010
:00474B0D 5D                      pop ebp
:00474B0E C3                      ret



* Referenced by a CALL at Addresses:
|:0041AD91   , :0041B1F4   , :0046DA26   , :00474B05   
|
:00474B0F 55                      push ebp
:00474B10 8BEC                    mov ebp, esp
:00474B12 83EC18                  sub esp, 00000018
:00474B15 837D1000                cmp dword ptr [ebp+10], 00000000
:00474B19 7507                    jne 00474B22

* Possible StringData Ref from Data Obj ->"־ܲٴ"
                                  |
:00474B1B C7451048E84800          mov [ebp+10], 0048E848

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474B19(C)
|
:00474B22 8D4DE8                  lea ecx, dword ptr [ebp-18]
:00474B25 E8D60A0000              call 00475600
:00474B2A 8B4514                  mov eax, dword ptr [ebp+14]
:00474B2D 50                      push eax

* Possible Reference to Dialog: DialogID_0154 
                                  |
:00474B2E 6854010000              push 00000154
:00474B33 8B4D10                  mov ecx, dword ptr [ebp+10]
:00474B36 51                      push ecx
:00474B37 8B550C                  mov edx, dword ptr [ebp+0C]
:00474B3A 52                      push edx
:00474B3B 8B4508                  mov eax, dword ptr [ebp+08]
:00474B3E 50                      push eax
:00474B3F 8D4DE8                  lea ecx, dword ptr [ebp-18]
:00474B42 E83BAEFFFF              call 0046F982
:00474B47 83F806                  cmp eax, 00000006
:00474B4A 7507                    jne 00474B53
:00474B4C B801000000              mov eax, 00000001
:00474B51 EB02                    jmp 00474B55

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474B4A(C)
|
:00474B53 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474B51(U)
|
:00474B55 8BE5                    mov esp, ebp
:00474B57 5D                      pop ebp
:00474B58 C3                      ret



* Referenced by a CALL at Addresses:
|:0042F6DF   , :00449D62   
|
:00474B59 55                      push ebp
:00474B5A 8BEC                    mov ebp, esp
:00474B5C 8B4510                  mov eax, dword ptr [ebp+10]
:00474B5F 50                      push eax
:00474B60 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00474B63 51                      push ecx
:00474B64 8B5508                  mov edx, dword ptr [ebp+08]
:00474B67 52                      push edx
:00474B68 A1686A4B00              mov eax, dword ptr [004B6A68]
:00474B6D 50                      push eax
:00474B6E E805000000              call 00474B78
:00474B73 83C410                  add esp, 00000010
:00474B76 5D                      pop ebp
:00474B77 C3                      ret



* Referenced by a CALL at Addresses:
|:0041AE7B   , :0041B4E7   , :0046D9F2   , :00474B6E   
|
:00474B78 55                      push ebp
:00474B79 8BEC                    mov ebp, esp
:00474B7B 83EC18                  sub esp, 00000018
:00474B7E 8D4DE8                  lea ecx, dword ptr [ebp-18]
:00474B81 E87A0A0000              call 00475600
:00474B86 8B4514                  mov eax, dword ptr [ebp+14]
:00474B89 50                      push eax

* Possible Reference to Dialog: DialogID_0153 
                                  |
:00474B8A 6853010000              push 00000153
:00474B8F 8B4D10                  mov ecx, dword ptr [ebp+10]
:00474B92 51                      push ecx
:00474B93 8B550C                  mov edx, dword ptr [ebp+0C]
:00474B96 52                      push edx
:00474B97 8B4508                  mov eax, dword ptr [ebp+08]
:00474B9A 50                      push eax
:00474B9B 8D4DE8                  lea ecx, dword ptr [ebp-18]
:00474B9E E8DFADFFFF              call 0046F982
:00474BA3 8BE5                    mov esp, ebp
:00474BA5 5D                      pop ebp
:00474BA6 C3                      ret



* Referenced by a CALL at Addresses:
|:00419463   , :00419562   
|
:00474BA7 55                      push ebp
:00474BA8 8BEC                    mov ebp, esp
:00474BAA 833D6C6A4B0000          cmp dword ptr [004B6A6C], 00000000
:00474BB1 7522                    jne 00474BD5
:00474BB3 6A01                    push 00000001

* Possible StringData Ref from Data Obj ->"־ܲٴ"
                                  |
:00474BB5 6860E84800              push 0048E860

* Possible StringData Ref from Data Obj ->"־ܲٴ"
                                  |
:00474BBA 6878E84800              push 0048E878
:00474BBF E82CFFFFFF              call 00474AF0
:00474BC4 83C40C                  add esp, 0000000C
:00474BC7 85C0                    test eax, eax
:00474BC9 740A                    je 00474BD5
:00474BCB E819750000              call 0047C0E9
:00474BD0 E8E26BFBFF              call 0042B7B7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00474BB1(C), :00474BC9(C)
|
:00474BD5 5D                      pop ebp
:00474BD6 C3                      ret



* Referenced by a CALL at Addresses:
|:00409913   , :0040A1FA   , :0040A2C3   , :0040A48F   , :0040A642   
|:0040B267   , :00417FCC   , :00418083   , :00418092   , :0041C02D   
|:0041EB11   , :0042B54C   , :0046C715   , :004752D2   , :00475320   
|:004753C6   
|
:00474BD7 55                      push ebp
:00474BD8 8BEC                    mov ebp, esp
:00474BDA 81EC80000000            sub esp, 00000080
:00474BE0 8D450C                  lea eax, dword ptr [ebp+0C]
:00474BE3 50                      push eax
:00474BE4 8B4D08                  mov ecx, dword ptr [ebp+08]
:00474BE7 51                      push ecx
:00474BE8 8D5580                  lea edx, dword ptr [ebp-80]
:00474BEB 52                      push edx
:00474BEC FF155C634800            call dword ptr [0048635C]
:00474BF2 6830200000              push 00002030

* Possible StringData Ref from Data Obj ->"־ܲٴ ִд"
                                  |
:00474BF7 6894E84800              push 0048E894
:00474BFC 8D4580                  lea eax, dword ptr [ebp-80]
:00474BFF 50                      push eax
:00474C00 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:00474C06 51                      push ecx
:00474C07 FF15C4624800            call dword ptr [004862C4]
:00474C0D 8BE5                    mov esp, ebp
:00474C0F 5D                      pop ebp
:00474C10 C3                      ret



* Referenced by a CALL at Addresses:
|:00419455   , :0041F563   , :00474423   
|
:00474C11 55                      push ebp
:00474C12 8BEC                    mov ebp, esp
:00474C14 81EC80000000            sub esp, 00000080
:00474C1A 8D450C                  lea eax, dword ptr [ebp+0C]
:00474C1D 50                      push eax
:00474C1E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00474C21 51                      push ecx
:00474C22 8D5580                  lea edx, dword ptr [ebp-80]
:00474C25 52                      push edx
:00474C26 FF155C634800            call dword ptr [0048635C]
:00474C2C 6835200000              push 00002035

* Possible StringData Ref from Data Obj ->"־ܲٴ ִд"
                                  |
:00474C31 68ACE84800              push 0048E8AC
:00474C36 8D4580                  lea eax, dword ptr [ebp-80]
:00474C39 50                      push eax
:00474C3A 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:00474C40 51                      push ecx
:00474C41 FF15C4624800            call dword ptr [004862C4]
:00474C47 83F804                  cmp eax, 00000004
:00474C4A 7507                    jne 00474C53
:00474C4C B801000000              mov eax, 00000001
:00474C51 EB02                    jmp 00474C55

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474C4A(C)
|
:00474C53 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474C51(U)
|
:00474C55 8BE5                    mov esp, ebp
:00474C57 5D                      pop ebp
:00474C58 C3                      ret



* Referenced by a CALL at Address:
|:0047502F   
|
:00474C59 55                      push ebp
:00474C5A 8BEC                    mov ebp, esp
:00474C5C 6AFF                    push FFFFFFFF
:00474C5E 68885B4800              push 00485B88
:00474C63 64A100000000            mov eax, dword ptr fs:[00000000]
:00474C69 50                      push eax
:00474C6A 64892500000000          mov dword ptr fs:[00000000], esp
:00474C71 81EC180B0000            sub esp, 00000B18
:00474C77 8B4510                  mov eax, dword ptr [ebp+10]
:00474C7A 8985DCF4FFFF            mov dword ptr [ebp+FFFFF4DC], eax
:00474C80 83BDDCF4FFFF65          cmp dword ptr [ebp+FFFFF4DC], 00000065
:00474C87 771B                    ja 00474CA4
:00474C89 83BDDCF4FFFF65          cmp dword ptr [ebp+FFFFF4DC], 00000065
:00474C90 0F848B000000            je 00474D21
:00474C96 83BDDCF4FFFF14          cmp dword ptr [ebp+FFFFF4DC], 00000014
:00474C9D 747B                    je 00474D1A
:00474C9F E97F010000              jmp 00474E23

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474C87(C)
|
:00474CA4 81BDDCF4FFFF899C0000    cmp dword ptr [ebp+FFFFF4DC], 00009C89
:00474CAE 7739                    ja 00474CE9
:00474CB0 81BDDCF4FFFF899C0000    cmp dword ptr [ebp+FFFFF4DC], 00009C89
:00474CBA 0F8444010000            je 00474E04
:00474CC0 8B8DDCF4FFFF            mov ecx, dword ptr [ebp+FFFFF4DC]
:00474CC6 83E966                  sub ecx, 00000066
:00474CC9 898DDCF4FFFF            mov dword ptr [ebp+FFFFF4DC], ecx
:00474CCF 83BDDCF4FFFF08          cmp dword ptr [ebp+FFFFF4DC], 00000008
:00474CD6 0F8747010000            ja 00474E23
:00474CDC 8B95DCF4FFFF            mov edx, dword ptr [ebp+FFFFF4DC]
:00474CE2 FF2495334E4700          jmp dword ptr [4*edx+00474E33]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474CAE(C)
|
:00474CE9 81BDDCF4FFFFD39C0000    cmp dword ptr [ebp+FFFFF4DC], 00009CD3
:00474CF3 7479                    je 00474D6E
:00474CF5 81BDDCF4FFFFD69C0000    cmp dword ptr [ebp+FFFFF4DC], 00009CD6
:00474CFF 0F8481000000            je 00474D86
:00474D05 81BDDCF4FFFFD79C0000    cmp dword ptr [ebp+FFFFF4DC], 00009CD7
:00474D0F 0F84A2000000            je 00474DB7
:00474D15 E909010000              jmp 00474E23

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474C9D(C)
|
:00474D1A 33C0                    xor eax, eax
:00474D1C E904010000              jmp 00474E25

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474C90(C)
|
:00474D21 E84057FAFF              call 0041A466
:00474D26 E9F8000000              jmp 00474E23
:00474D2B E8C956FAFF              call 0041A3F9
:00474D30 E9EE000000              jmp 00474E23
:00474D35 6A00                    push 00000000
:00474D37 6A00                    push 00000000
:00474D39 6A10                    push 00000010
:00474D3B A1686A4B00              mov eax, dword ptr [004B6A68]
:00474D40 50                      push eax
:00474D41 FF1518634800            call dword ptr [00486318]
:00474D47 E9D7000000              jmp 00474E23
:00474D4C 8B4D08                  mov ecx, dword ptr [ebp+08]
:00474D4F 51                      push ecx
:00474D50 8B15606A4B00            mov edx, dword ptr [004B6A60]
:00474D56 52                      push edx
:00474D57 E82E620000              call 0047AF8A
:00474D5C 83C408                  add esp, 00000008
:00474D5F E9BF000000              jmp 00474E23
:00474D64 E8834FFDFF              call 00449CEC
:00474D69 E9B5000000              jmp 00474E23

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474CF3(C)
|
:00474D6E 8B4508                  mov eax, dword ptr [ebp+08]
:00474D71 50                      push eax
:00474D72 8B0D606A4B00            mov ecx, dword ptr [004B6A60]
:00474D78 51                      push ecx
:00474D79 E80E36FFFF              call 0046838C
:00474D7E 83C408                  add esp, 00000008
:00474D81 E99D000000              jmp 00474E23

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474CFF(C)
|
:00474D86 8D8D3CFFFFFF            lea ecx, dword ptr [ebp+FFFFFF3C]
:00474D8C E88F080000              call 00475620
:00474D91 C745FC00000000          mov [ebp-04], 00000000
:00474D98 8D8D3CFFFFFF            lea ecx, dword ptr [ebp+FFFFFF3C]
:00474D9E E8D3A0FFFF              call 0046EE76
:00474DA3 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00474DAA 8D8D3CFFFFFF            lea ecx, dword ptr [ebp+FFFFFF3C]
:00474DB0 E8EB080000              call 004756A0
:00474DB5 EB6C                    jmp 00474E23

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474D0F(C)
|
:00474DB7 8D8DECF4FFFF            lea ecx, dword ptr [ebp+FFFFF4EC]
:00474DBD E83E090000              call 00475700
:00474DC2 C745FC01000000          mov [ebp-04], 00000001
:00474DC9 8D8DECF4FFFF            lea ecx, dword ptr [ebp+FFFFF4EC]
:00474DCF E8ACC2FFFF              call 00471080
:00474DD4 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00474DDB 8D8DECF4FFFF            lea ecx, dword ptr [ebp+FFFFF4EC]
:00474DE1 E84A090000              call 00475730
:00474DE6 EB3B                    jmp 00474E23
:00474DE8 E85671FAFF              call 0041BF43
:00474DED EB34                    jmp 00474E23
:00474DEF E8A24FFDFF              call 00449D96
:00474DF4 EB2D                    jmp 00474E23
:00474DF6 E8B34EFDFF              call 00449CAE
:00474DFB EB26                    jmp 00474E23
:00474DFD E8D04EFDFF              call 00449CD2
:00474E02 EB1F                    jmp 00474E23

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474CBA(C)
|
:00474E04 8D8DE0F4FFFF            lea ecx, dword ptr [ebp+FFFFF4E0]
:00474E0A E89195F9FF              call 0040E3A0
:00474E0F 8B5508                  mov edx, dword ptr [ebp+08]
:00474E12 52                      push edx

* Possible Reference to Dialog: DialogID_015C 
                                  |
:00474E13 685C010000              push 0000015C
:00474E18 8D8DE0F4FFFF            lea ecx, dword ptr [ebp+FFFFF4E0]
:00474E1E E87582FFFF              call 0046D098

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00474C9F(U), :00474CD6(C), :00474D15(U), :00474D26(U), :00474D30(U)
|:00474D47(U), :00474D5F(U), :00474D69(U), :00474D81(U), :00474DB5(U)
|:00474DE6(U), :00474DED(U), :00474DF4(U), :00474DFB(U), :00474E02(U)
|
:00474E23 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474D1C(U)
|
:00474E25 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00474E28 64890D00000000          mov dword ptr fs:[00000000], ecx
:00474E2F 8BE5                    mov esp, ebp
:00474E31 5D                      pop ebp
:00474E32 C3                      ret



:00474E33 2B4D4700                DWORD 00474D2B
:00474E37 234E4700                DWORD 00474E23
:00474E3B 354D4700                DWORD 00474D35
:00474E3F 4C4D4700                DWORD 00474D4C
:00474E43 644D4700                DWORD 00474D64
:00474E47 E84D4700                DWORD 00474DE8
:00474E4B EF4D4700                DWORD 00474DEF
:00474E4F F64D4700                DWORD 00474DF6
:00474E53 FD4D4700                DWORD 00474DFD


:00474E57 55                      push ebp
:00474E58 8BEC                    mov ebp, esp
:00474E5A 83EC14                  sub esp, 00000014
:00474E5D 8B450C                  mov eax, dword ptr [ebp+0C]
:00474E60 8945F4                  mov dword ptr [ebp-0C], eax
:00474E63 837DF405                cmp dword ptr [ebp-0C], 00000005
:00474E67 7719                    ja 00474E82
:00474E69 837DF405                cmp dword ptr [ebp-0C], 00000005
:00474E6D 0F84F9010000            je 0047506C
:00474E73 837DF401                cmp dword ptr [ebp-0C], 00000001
:00474E77 0F84D2000000            je 00474F4F
:00474E7D E99C030000              jmp 0047521E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474E67(C)
|
:00474E82 837DF421                cmp dword ptr [ebp-0C], 00000021
:00474E86 7719                    ja 00474EA1
:00474E88 837DF421                cmp dword ptr [ebp-0C], 00000021
:00474E8C 0F845D020000            je 004750EF
:00474E92 837DF414                cmp dword ptr [ebp-0C], 00000014
:00474E96 0F84FF010000            je 0047509B
:00474E9C E97D030000              jmp 0047521E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474E86(C)
|
:00474EA1 837DF447                cmp dword ptr [ebp-0C], 00000047
:00474EA5 7719                    ja 00474EC0
:00474EA7 837DF447                cmp dword ptr [ebp-0C], 00000047
:00474EAB 0F8408020000            je 004750B9
:00474EB1 837DF424                cmp dword ptr [ebp-0C], 00000024
:00474EB5 0F84E7010000            je 004750A2
:00474EBB E95E030000              jmp 0047521E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474EA5(C)
|
:00474EC0 817DF4A3000000          cmp dword ptr [ebp-0C], 000000A3
:00474EC7 771C                    ja 00474EE5
:00474EC9 817DF4A3000000          cmp dword ptr [ebp-0C], 000000A3
:00474ED0 0F8419010000            je 00474FEF
:00474ED6 837DF44E                cmp dword ptr [ebp-0C], 0000004E
:00474EDA 0F8436020000            je 00475116
:00474EE0 E939030000              jmp 0047521E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474EC7(C)
|
:00474EE5 817DF406020000          cmp dword ptr [ebp-0C], 00000206
:00474EEC 7735                    ja 00474F23
:00474EEE 817DF400020000          cmp dword ptr [ebp-0C], 00000200
:00474EF5 0F83CF010000            jnb 004750CA
:00474EFB 817DF411010000          cmp dword ptr [ebp-0C], 00000111
:00474F02 0F8417010000            je 0047501F
:00474F08 817DF412010000          cmp dword ptr [ebp-0C], 00000112
:00474F0F 7443                    je 00474F54
:00474F11 817DF413010000          cmp dword ptr [ebp-0C], 00000113
:00474F18 0F84C7010000            je 004750E5
:00474F1E E9FB020000              jmp 0047521E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474EEC(C)
|
:00474F23 817DF411030000          cmp dword ptr [ebp-0C], 00000311
:00474F2A 0F840C010000            je 0047503C
:00474F30 817DF4B9030000          cmp dword ptr [ebp-0C], 000003B9
:00474F37 0F84D1020000            je 0047520E
:00474F3D 817DF401040000          cmp dword ptr [ebp-0C], 00000401
:00474F44 0F8407010000            je 00475051
:00474F4A E9CF020000              jmp 0047521E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474E77(C)
|
:00474F4F E9CA020000              jmp 0047521E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474F0F(C)
|
:00474F54 8B4D10                  mov ecx, dword ptr [ebp+10]
:00474F57 894DF0                  mov dword ptr [ebp-10], ecx
:00474F5A 817DF020F00000          cmp dword ptr [ebp-10], 0000F020
:00474F61 7414                    je 00474F77
:00474F63 817DF030F00000          cmp dword ptr [ebp-10], 0000F030
:00474F6A 7442                    je 00474FAE
:00474F6C 817DF020F10000          cmp dword ptr [ebp-10], 0000F120
:00474F73 7447                    je 00474FBC
:00474F75 EB73                    jmp 00474FEA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474F61(C)
|
:00474F77 8B5508                  mov edx, dword ptr [ebp+08]
:00474F7A 52                      push edx
:00474F7B E8A66D0000              call 0047BD26
:00474F80 83C404                  add esp, 00000004
:00474F83 A1D85F4B00              mov eax, dword ptr [004B5FD8]
:00474F88 50                      push eax
:00474F89 FF15C8624800            call dword ptr [004862C8]
:00474F8F 85C0                    test eax, eax
:00474F91 7419                    je 00474FAC
:00474F93 C705746A4B0001000000    mov dword ptr [004B6A74], 00000001
:00474F9D 6A00                    push 00000000
:00474F9F 8B0DD85F4B00            mov ecx, dword ptr [004B5FD8]
:00474FA5 51                      push ecx
:00474FA6 FF15E0624800            call dword ptr [004862E0]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474F91(C)
|
:00474FAC EB3C                    jmp 00474FEA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474F6A(C)
|
:00474FAE 8B5508                  mov edx, dword ptr [ebp+08]
:00474FB1 52                      push edx
:00474FB2 E8B76D0000              call 0047BD6E
:00474FB7 83C404                  add esp, 00000004
:00474FBA EB2E                    jmp 00474FEA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474F73(C)
|
:00474FBC 8B4508                  mov eax, dword ptr [ebp+08]
:00474FBF 50                      push eax
:00474FC0 E8D86D0000              call 0047BD9D
:00474FC5 83C404                  add esp, 00000004
:00474FC8 833D746A4B0000          cmp dword ptr [004B6A74], 00000000
:00474FCF 7419                    je 00474FEA
:00474FD1 C705746A4B0000000000    mov dword ptr [004B6A74], 00000000
:00474FDB 6A05                    push 00000005
:00474FDD 8B0DD85F4B00            mov ecx, dword ptr [004B5FD8]
:00474FE3 51                      push ecx
:00474FE4 FF15E0624800            call dword ptr [004862E0]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00474F75(U), :00474FAC(U), :00474FBA(U), :00474FCF(C)
|
:00474FEA E92F020000              jmp 0047521E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474ED0(C)
|
:00474FEF 837D1002                cmp dword ptr [ebp+10], 00000002
:00474FF3 7525                    jne 0047501A
:00474FF5 6AF0                    push FFFFFFF0
:00474FF7 8B5508                  mov edx, dword ptr [ebp+08]
:00474FFA 52                      push edx
:00474FFB FF15A0634800            call dword ptr [004863A0]
:00475001 8945F8                  mov dword ptr [ebp-08], eax
:00475004 8B45F8                  mov eax, dword ptr [ebp-08]
:00475007 2500000100              and eax, 00010000
:0047500C 3D00000100              cmp eax, 00010000
:00475011 7407                    je 0047501A
:00475013 33C0                    xor eax, eax
:00475015 E91C020000              jmp 00475236

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00474FF3(C), :00475011(C)
|
:0047501A E9FF010000              jmp 0047521E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474F02(C)
|
:0047501F 8B4D14                  mov ecx, dword ptr [ebp+14]
:00475022 51                      push ecx
:00475023 8B5510                  mov edx, dword ptr [ebp+10]
:00475026 52                      push edx
:00475027 8B450C                  mov eax, dword ptr [ebp+0C]
:0047502A 50                      push eax
:0047502B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047502E 51                      push ecx
:0047502F E825FCFFFF              call 00474C59
:00475034 83C410                  add esp, 00000010
:00475037 E9FA010000              jmp 00475236

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474F2A(C)
|
:0047503C 8B5510                  mov edx, dword ptr [ebp+10]
:0047503F 52                      push edx
:00475040 8B4508                  mov eax, dword ptr [ebp+08]
:00475043 50                      push eax
:00475044 E835D5FFFF              call 0047257E
:00475049 83C408                  add esp, 00000008
:0047504C E9CD010000              jmp 0047521E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474F44(C)
|
:00475051 8B4D14                  mov ecx, dword ptr [ebp+14]
:00475054 51                      push ecx
:00475055 8B5510                  mov edx, dword ptr [ebp+10]
:00475058 52                      push edx
:00475059 6A05                    push 00000005
:0047505B A18C6A4B00              mov eax, dword ptr [004B6A8C]
:00475060 50                      push eax
:00475061 FF15F4624800            call dword ptr [004862F4]
:00475067 E9B2010000              jmp 0047521E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474E6D(C)
|
:0047506C 8B4D14                  mov ecx, dword ptr [ebp+14]
:0047506F 51                      push ecx
:00475070 8B5510                  mov edx, dword ptr [ebp+10]
:00475073 52                      push edx
:00475074 8B4508                  mov eax, dword ptr [ebp+08]
:00475077 50                      push eax
:00475078 E8066F0000              call 0047BF83
:0047507D 83C40C                  add esp, 0000000C
:00475080 8B4D14                  mov ecx, dword ptr [ebp+14]
:00475083 51                      push ecx
:00475084 8B5510                  mov edx, dword ptr [ebp+10]
:00475087 52                      push edx
:00475088 8B450C                  mov eax, dword ptr [ebp+0C]
:0047508B 50                      push eax
:0047508C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047508F 51                      push ecx
:00475090 FF1578634800            call dword ptr [00486378]
:00475096 E99B010000              jmp 00475236

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474E96(C)
|
:0047509B 33C0                    xor eax, eax
:0047509D E994010000              jmp 00475236

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474EB5(C)
|
:004750A2 8B5514                  mov edx, dword ptr [ebp+14]
:004750A5 52                      push edx
:004750A6 8B4508                  mov eax, dword ptr [ebp+08]
:004750A9 50                      push eax
:004750AA E8366D0000              call 0047BDE5
:004750AF 83C408                  add esp, 00000008
:004750B2 33C0                    xor eax, eax
:004750B4 E97D010000              jmp 00475236

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474EAB(C)
|
:004750B9 8B4D08                  mov ecx, dword ptr [ebp+08]
:004750BC 51                      push ecx
:004750BD E88DA7FAFF              call 0041F84F
:004750C2 83C404                  add esp, 00000004
:004750C5 E954010000              jmp 0047521E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474EF5(C)
|
:004750CA 8B5514                  mov edx, dword ptr [ebp+14]
:004750CD 52                      push edx
:004750CE 8B450C                  mov eax, dword ptr [ebp+0C]
:004750D1 50                      push eax
:004750D2 8B4D08                  mov ecx, dword ptr [ebp+08]
:004750D5 51                      push ecx
:004750D6 B9B07F4900              mov ecx, 00497FB0
:004750DB E8D20FFBFF              call 004260B2
:004750E0 E939010000              jmp 0047521E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474F18(C)
|
:004750E5 E8B54BFDFF              call 00449C9F
:004750EA E92F010000              jmp 0047521E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474E8C(C)
|
:004750EF E82E68F9FF              call 0040B922
:004750F4 85C0                    test eax, eax
:004750F6 7419                    je 00475111
:004750F8 B9B07F4900              mov ecx, 00497FB0
:004750FD E8350BFBFF              call 00425C37
:00475102 83F838                  cmp eax, 00000038
:00475105 760A                    jbe 00475111
:00475107 B802000000              mov eax, 00000002
:0047510C E925010000              jmp 00475236

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004750F6(C), :00475105(C)
|
:00475111 E908010000              jmp 0047521E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474EDA(C)
|
:00475116 8B5514                  mov edx, dword ptr [ebp+14]
:00475119 8955FC                  mov dword ptr [ebp-04], edx
:0047511C 8B45FC                  mov eax, dword ptr [ebp-04]
:0047511F 817808F8FDFFFF          cmp dword ptr [eax+08], FFFFFDF8
:00475126 0F85E0000000            jne 0047520C
:0047512C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047512F 8B5104                  mov edx, dword ptr [ecx+04]
:00475132 8955EC                  mov dword ptr [ebp-14], edx
:00475135 817DECD39C0000          cmp dword ptr [ebp-14], 00009CD3
:0047513C 7726                    ja 00475164
:0047513E 817DECD39C0000          cmp dword ptr [ebp-14], 00009CD3
:00475145 7473                    je 004751BA
:00475147 8B45EC                  mov eax, dword ptr [ebp-14]
:0047514A 83E865                  sub eax, 00000065
:0047514D 8945EC                  mov dword ptr [ebp-14], eax
:00475150 837DEC09                cmp dword ptr [ebp-14], 00000009
:00475154 0F87B2000000            ja 0047520C
:0047515A 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0047515D FF248D3C524700          jmp dword ptr [4*ecx+0047523C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047513C(C)
|
:00475164 817DECD69C0000          cmp dword ptr [ebp-14], 00009CD6
:0047516B 7459                    je 004751C6
:0047516D 817DECD79C0000          cmp dword ptr [ebp-14], 00009CD7
:00475174 745C                    je 004751D2
:00475176 E991000000              jmp 0047520C
:0047517B 8B55FC                  mov edx, dword ptr [ebp-04]

* Possible StringData Ref from Data Obj ->"Ϸ"
                                  |
:0047517E C7420CC4E84800          mov [edx+0C], 0048E8C4
:00475185 E982000000              jmp 0047520C
:0047518A 8B45FC                  mov eax, dword ptr [ebp-04]

* Possible StringData Ref from Data Obj ->""
                                  |
:0047518D C7400CD0E84800          mov [eax+0C], 0048E8D0
:00475194 EB76                    jmp 0047520C
:00475196 8B4DFC                  mov ecx, dword ptr [ebp-04]

* Possible StringData Ref from Data Obj ->"ȡ"
                                  |
:00475199 C7410CD8E84800          mov [ecx+0C], 0048E8D8
:004751A0 EB6A                    jmp 0047520C
:004751A2 8B55FC                  mov edx, dword ptr [ebp-04]

* Possible StringData Ref from Data Obj ->"趨"
                                  |
:004751A5 C7420CE0E84800          mov [edx+0C], 0048E8E0
:004751AC EB5E                    jmp 0047520C
:004751AE 8B45FC                  mov eax, dword ptr [ebp-04]

* Possible StringData Ref from Data Obj ->"佫һ"
                                  |
:004751B1 C7400CECE84800          mov [eax+0C], 0048E8EC
:004751B8 EB52                    jmp 0047520C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00475145(C)
|
:004751BA 8B4DFC                  mov ecx, dword ptr [ebp-04]

* Possible StringData Ref from Data Obj ->"еһ"
                                  |
:004751BD C7410CF8E84800          mov [ecx+0C], 0048E8F8
:004751C4 EB46                    jmp 0047520C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047516B(C)
|
:004751C6 8B55FC                  mov edx, dword ptr [ebp-04]

* Possible StringData Ref from Data Obj ->"鱨һ"
                                  |
:004751C9 C7420C08E94800          mov [edx+0C], 0048E908
:004751D0 EB3A                    jmp 0047520C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00475174(C)
|
:004751D2 8B45FC                  mov eax, dword ptr [ebp-04]

* Possible StringData Ref from Data Obj ->"ͼ"
                                  |
:004751D5 C7400C18E94800          mov [eax+0C], 0048E918
:004751DC EB2E                    jmp 0047520C
:004751DE 8B4DFC                  mov ecx, dword ptr [ebp-04]

* Possible StringData Ref from Data Obj ->"ʤ"
                                  |
:004751E1 C7410C24E94800          mov [ecx+0C], 0048E924
:004751E8 EB22                    jmp 0047520C
:004751EA 8B55FC                  mov edx, dword ptr [ebp-04]

* Possible StringData Ref from Data Obj ->"δִв"
                                  |
:004751ED C7420C30E94800          mov [edx+0C], 0048E930
:004751F4 EB16                    jmp 0047520C
:004751F6 8B45FC                  mov eax, dword ptr [ebp-04]

* Possible StringData Ref from Data Obj ->"սСͼ"
                                  |
:004751F9 C7400C40E94800          mov [eax+0C], 0048E940
:00475200 EB0A                    jmp 0047520C
:00475202 8B4DFC                  mov ecx, dword ptr [ebp-04]

* Possible StringData Ref from Data Obj ->"غ"
                                  |
:00475205 C7410C4CE94800          mov [ecx+0C], 0048E94C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00475126(C), :00475154(C), :00475176(U), :00475185(U), :00475194(U)
|:004751A0(U), :004751AC(U), :004751B8(U), :004751C4(U), :004751D0(U)
|:004751DC(U), :004751E8(U), :004751F4(U), :00475200(U)
|
:0047520C EB10                    jmp 0047521E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00474F37(C)
|
:0047520E 8B5514                  mov edx, dword ptr [ebp+14]
:00475211 52                      push edx
:00475212 8B4510                  mov eax, dword ptr [ebp+10]
:00475215 50                      push eax
:00475216 E81DA6FAFF              call 0041F838
:0047521B 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00474E7D(U), :00474E9C(U), :00474EBB(U), :00474EE0(U), :00474F1E(U)
|:00474F4A(U), :00474F4F(U), :00474FEA(U), :0047501A(U), :0047504C(U)
|:00475067(U), :004750C5(U), :004750E0(U), :004750EA(U), :00475111(U)
|:0047520C(U)
|
:0047521E 8B4D14                  mov ecx, dword ptr [ebp+14]
:00475221 51                      push ecx
:00475222 8B5510                  mov edx, dword ptr [ebp+10]
:00475225 52                      push edx
:00475226 8B450C                  mov eax, dword ptr [ebp+0C]
:00475229 50                      push eax
:0047522A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047522D 51                      push ecx
:0047522E E82C9D0000              call 0047EF5F
:00475233 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00475015(U), :00475037(U), :00475096(U), :0047509D(U), :004750B4(U)
|:0047510C(U)
|
:00475236 8BE5                    mov esp, ebp
:00475238 5D                      pop ebp
:00475239 C21000                  ret 0010



:0047523C 8A514700                DWORD 0047518A
:00475240 96514700                DWORD 00475196
:00475244 0C524700                DWORD 0047520C
:00475248 7B514700                DWORD 0047517B
:0047524C AE514700                DWORD 004751AE
:00475250 DE514700                DWORD 004751DE
:00475254 A2514700                DWORD 004751A2
:00475258 F6514700                DWORD 004751F6
:0047525C 02524700                DWORD 00475202
:00475260 EA514700                DWORD 004751EA



* Referenced by a CALL at Address:
|:004755C2   
|
:00475264 55                      push ebp
:00475265 8BEC                    mov ebp, esp
:00475267 83EC6C                  sub esp, 0000006C
:0047526A 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"־ܲٴ"
                                  |
:0047526C 6848E84800              push 0048E848
:00475271 FF152C624800            call dword ptr [0048622C]
:00475277 8945F0                  mov dword ptr [ebp-10], eax
:0047527A 837DF000                cmp dword ptr [ebp-10], 00000000
:0047527E 7461                    je 004752E1
:00475280 8B45F0                  mov eax, dword ptr [ebp-10]
:00475283 50                      push eax
:00475284 FF1554634800            call dword ptr [00486354]
:0047528A 85C0                    test eax, eax
:0047528C 7416                    je 004752A4
:0047528E 6A00                    push 00000000
:00475290 6820F10000              push 0000F120
:00475295 6812010000              push 00000112
:0047529A 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047529D 51                      push ecx
:0047529E FF15F4624800            call dword ptr [004862F4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047528C(C)
|
:004752A4 8B55F0                  mov edx, dword ptr [ebp-10]
:004752A7 52                      push edx
:004752A8 FF1528624800            call dword ptr [00486228]
:004752AE 8945C0                  mov dword ptr [ebp-40], eax
:004752B1 8B45F0                  mov eax, dword ptr [ebp-10]
:004752B4 50                      push eax
:004752B5 FF15F8624800            call dword ptr [004862F8]
:004752BB 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004752BE 3B4DC0                  cmp ecx, dword ptr [ebp-40]
:004752C1 740A                    je 004752CD
:004752C3 8B55C0                  mov edx, dword ptr [ebp-40]
:004752C6 52                      push edx
:004752C7 FF15F8624800            call dword ptr [004862F8]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004752C1(C)
|

* Possible StringData Ref from Data Obj ->"ִ"
                                  |
:004752CD 6858E94800              push 0048E958
:004752D2 E800F9FFFF              call 00474BD7
:004752D7 83C404                  add esp, 00000004
:004752DA 33C0                    xor eax, eax
:004752DC E9CD020000              jmp 004755AE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047527E(C)
|
:004752E1 8B4508                  mov eax, dword ptr [ebp+08]
:004752E4 A3606A4B00              mov dword ptr [004B6A60], eax
:004752E9 6A00                    push 00000000
:004752EB FF1598624800            call dword ptr [00486298]
:004752F1 8945C4                  mov dword ptr [ebp-3C], eax
:004752F4 837DC400                cmp dword ptr [ebp-3C], 00000000
:004752F8 7435                    je 0047532F
:004752FA 6A0C                    push 0000000C
:004752FC 8B4DC4                  mov ecx, dword ptr [ebp-3C]
:004752FF 51                      push ecx
:00475300 FF153C604800            call dword ptr [0048603C]
:00475306 8945B8                  mov dword ptr [ebp-48], eax
:00475309 8B55C4                  mov edx, dword ptr [ebp-3C]
:0047530C 52                      push edx
:0047530D 6A00                    push 00000000
:0047530F FF159C624800            call dword ptr [0048629C]
:00475315 837DB808                cmp dword ptr [ebp-48], 00000008
:00475319 7D14                    jge 0047532F

* Possible StringData Ref from Data Obj ->"ʹ256ɫϵĵɫ塣"
                                  |
:0047531B 6864E94800              push 0048E964
:00475320 E8B2F8FFFF              call 00474BD7
:00475325 83C404                  add esp, 00000004
:00475328 33C0                    xor eax, eax
:0047532A E97F020000              jmp 004755AE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004752F8(C), :00475319(C)
|
:0047532F 837D0C00                cmp dword ptr [ebp+0C], 00000000
:00475333 756A                    jne 0047539F
:00475335 C745C80B100000          mov [ebp-38], 0000100B

* Possible StringData Ref from Code Obj ->"UEE}w}"
                                  |
:0047533C C745CC574E4700          mov [ebp-34], 00474E57
:00475343 C745D400000000          mov [ebp-2C], 00000000
:0047534A C745D000000000          mov [ebp-30], 00000000
:00475351 8B4508                  mov eax, dword ptr [ebp+08]
:00475354 8945D8                  mov dword ptr [ebp-28], eax
:00475357 6889000000              push 00000089
:0047535C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047535F 51                      push ecx
:00475360 FF156C634800            call dword ptr [0048636C]
:00475366 8945DC                  mov dword ptr [ebp-24], eax
:00475369 C745E000000000          mov [ebp-20], 00000000

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:00475370 C745E406000000          mov [ebp-1C], 00000006

* Possible StringData Ref from Data Obj ->"APPMENU"
                                  |
:00475377 C745E880E94800          mov [ebp-18], 0048E980

* Possible StringData Ref from Data Obj ->"־ܲٴ"
                                  |
:0047537E C745EC48E84800          mov [ebp-14], 0048E848
:00475385 8D55C8                  lea edx, dword ptr [ebp-38]
:00475388 52                      push edx
:00475389 FF1570634800            call dword ptr [00486370]
:0047538F 25FFFF0000              and eax, 0000FFFF
:00475394 85C0                    test eax, eax
:00475396 7507                    jne 0047539F
:00475398 33C0                    xor eax, eax
:0047539A E90F020000              jmp 004755AE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00475333(C), :00475396(C)
|
:0047539F 8D45FC                  lea eax, dword ptr [ebp-04]
:004753A2 50                      push eax
:004753A3 8D4DF8                  lea ecx, dword ptr [ebp-08]
:004753A6 51                      push ecx
:004753A7 E87F980000              call 0047EC2B
:004753AC 83C408                  add esp, 00000008
:004753AF 817DF880020000          cmp dword ptr [ebp-08], 00000280
:004753B6 7C09                    jl 004753C1
:004753B8 817DFC88010000          cmp dword ptr [ebp-04], 00000188
:004753BF 7D14                    jge 004753D5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004753B6(C)
|

* Possible StringData Ref from Data Obj ->"Ҫ640480ϵʾģʽ"
                                  |
:004753C1 6888E94800              push 0048E988
:004753C6 E80CF8FFFF              call 00474BD7
:004753CB 83C404                  add esp, 00000004
:004753CE 33C0                    xor eax, eax
:004753D0 E9D9010000              jmp 004755AE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004753BF(C)
|
:004753D5 8B45F8                  mov eax, dword ptr [ebp-08]
:004753D8 99                      cdq
:004753D9 83E20F                  and edx, 0000000F
:004753DC 03C2                    add eax, edx
:004753DE C1F804                  sar eax, 04
:004753E1 83C001                  add eax, 00000001
:004753E4 C1E004                  shl eax, 04
:004753E7 8945BC                  mov dword ptr [ebp-44], eax
:004753EA 8B45FC                  mov eax, dword ptr [ebp-04]
:004753ED 99                      cdq
:004753EE 83E20F                  and edx, 0000000F
:004753F1 03C2                    add eax, edx
:004753F3 C1F804                  sar eax, 04
:004753F6 83C001                  add eax, 00000001
:004753F9 C1E004                  shl eax, 04
:004753FC 8945F4                  mov dword ptr [ebp-0C], eax
:004753FF 817DF4E0010000          cmp dword ptr [ebp-0C], 000001E0
:00475406 7D07                    jge 0047540F
:00475408 C745F4E0010000          mov [ebp-0C], 000001E0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00475406(C)
|
:0047540F 8B55F4                  mov edx, dword ptr [ebp-0C]
:00475412 52                      push edx
:00475413 8B45BC                  mov eax, dword ptr [ebp-44]
:00475416 50                      push eax
:00475417 E8F45F0000              call 0047B410
:0047541C 83C408                  add esp, 00000008
:0047541F 6A00                    push 00000000
:00475421 8B4D08                  mov ecx, dword ptr [ebp+08]
:00475424 51                      push ecx
:00475425 6A00                    push 00000000
:00475427 6A00                    push 00000000
:00475429 6800000080              push 80000000
:0047542E 6800000080              push 80000000
:00475433 6800000080              push 80000000
:00475438 6800000080              push 80000000
:0047543D 6800003F02              push 023F0000

* Possible StringData Ref from Data Obj ->"־ܲٴ"
                                  |
:00475442 6848E84800              push 0048E848

* Possible StringData Ref from Data Obj ->"־ܲٴ"
                                  |
:00475447 6848E84800              push 0048E848
:0047544C 6A00                    push 00000000
:0047544E FF1574634800            call dword ptr [00486374]
:00475454 A3686A4B00              mov dword ptr [004B6A68], eax
:00475459 833D686A4B0000          cmp dword ptr [004B6A68], 00000000
:00475460 0F8446010000            je 004755AC
:00475466 6A00                    push 00000000
:00475468 8D55A8                  lea edx, dword ptr [ebp-58]
:0047546B 52                      push edx
:0047546C 6A00                    push 00000000
:0047546E 6A30                    push 00000030
:00475470 FF1558634800            call dword ptr [00486358]
:00475476 8B45B0                  mov eax, dword ptr [ebp-50]
:00475479 2B45A8                  sub eax, dword ptr [ebp-58]
:0047547C 99                      cdq
:0047547D 83E20F                  and edx, 0000000F
:00475480 03C2                    add eax, edx
:00475482 C1F804                  sar eax, 04
:00475485 83C001                  add eax, 00000001
:00475488 C1E004                  shl eax, 04
:0047548B 8945A4                  mov dword ptr [ebp-5C], eax
:0047548E 8B45B4                  mov eax, dword ptr [ebp-4C]
:00475491 2B45AC                  sub eax, dword ptr [ebp-54]
:00475494 99                      cdq
:00475495 83E20F                  and edx, 0000000F
:00475498 03C2                    add eax, edx
:0047549A C1F804                  sar eax, 04
:0047549D 83C001                  add eax, 00000001
:004754A0 C1E004                  shl eax, 04
:004754A3 8945A0                  mov dword ptr [ebp-60], eax
:004754A6 817DA480020000          cmp dword ptr [ebp-5C], 00000280
:004754AD 7D09                    jge 004754B8
:004754AF C7459C80020000          mov [ebp-64], 00000280
:004754B6 EB06                    jmp 004754BE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004754AD(C)
|
:004754B8 8B45A4                  mov eax, dword ptr [ebp-5C]
:004754BB 89459C                  mov dword ptr [ebp-64], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004754B6(U)
|
:004754BE 8B4D9C                  mov ecx, dword ptr [ebp-64]
:004754C1 894DA4                  mov dword ptr [ebp-5C], ecx
:004754C4 817DA0E0010000          cmp dword ptr [ebp-60], 000001E0
:004754CB 7D09                    jge 004754D6
:004754CD C74598E0010000          mov [ebp-68], 000001E0
:004754D4 EB06                    jmp 004754DC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004754CB(C)
|
:004754D6 8B55A0                  mov edx, dword ptr [ebp-60]
:004754D9 895598                  mov dword ptr [ebp-68], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004754D4(U)
|
:004754DC 8B4598                  mov eax, dword ptr [ebp-68]
:004754DF 8945A0                  mov dword ptr [ebp-60], eax
:004754E2 6A01                    push 00000001
:004754E4 8B4DA0                  mov ecx, dword ptr [ebp-60]
:004754E7 51                      push ecx
:004754E8 8B55A4                  mov edx, dword ptr [ebp-5C]
:004754EB 52                      push edx
:004754EC A1686A4B00              mov eax, dword ptr [004B6A68]
:004754F1 50                      push eax
:004754F2 E891750000              call 0047CA88
:004754F7 83C410                  add esp, 00000010
:004754FA 8B4DB4                  mov ecx, dword ptr [ebp-4C]
:004754FD 2B4DAC                  sub ecx, dword ptr [ebp-54]
:00475500 51                      push ecx
:00475501 8B55B0                  mov edx, dword ptr [ebp-50]
:00475504 2B55A8                  sub edx, dword ptr [ebp-58]
:00475507 52                      push edx
:00475508 E82C620000              call 0047B739
:0047550D 83C408                  add esp, 00000008
:00475510 6A00                    push 00000000
:00475512 E8CC750000              call 0047CAE3
:00475517 83C404                  add esp, 00000004
:0047551A A15CE84800              mov eax, dword ptr [0048E85C]
:0047551F 3B45F4                  cmp eax, dword ptr [ebp-0C]
:00475522 7D0B                    jge 0047552F
:00475524 8B0D5CE84800            mov ecx, dword ptr [0048E85C]
:0047552A 894D94                  mov dword ptr [ebp-6C], ecx
:0047552D EB06                    jmp 00475535

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00475522(C)
|
:0047552F 8B55F4                  mov edx, dword ptr [ebp-0C]
:00475532 895594                  mov dword ptr [ebp-6C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047552D(U)
|
:00475535 6A00                    push 00000000
:00475537 8B4594                  mov eax, dword ptr [ebp-6C]
:0047553A 83E828                  sub eax, 00000028
:0047553D 50                      push eax
:0047553E 8B0D58E84800            mov ecx, dword ptr [0048E858]
:00475544 51                      push ecx
:00475545 E838970000              call 0047EC82
:0047554A 83C40C                  add esp, 0000000C
:0047554D B9B07F4900              mov ecx, 00497FB0
:00475552 E80907FBFF              call 00425C60
:00475557 85C0                    test eax, eax
:00475559 7504                    jne 0047555F
:0047555B 33C0                    xor eax, eax
:0047555D EB4F                    jmp 004755AE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00475559(C)
|
:0047555F 8B15606A4B00            mov edx, dword ptr [004B6A60]
:00475565 52                      push edx
:00475566 E863A3FEFF              call 0045F8CE
:0047556B 83C404                  add esp, 00000004
:0047556E 85C0                    test eax, eax
:00475570 7504                    jne 00475576
:00475572 33C0                    xor eax, eax
:00475574 EB38                    jmp 004755AE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00475570(C)
|
:00475576 A1686A4B00              mov eax, dword ptr [004B6A68]
:0047557B 50                      push eax
:0047557C E813130000              call 00476894
:00475581 83C404                  add esp, 00000004
:00475584 85C0                    test eax, eax
:00475586 7404                    je 0047558C
:00475588 33C0                    xor eax, eax
:0047558A EB22                    jmp 004755AE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00475586(C)
|
:0047558C 6A00                    push 00000000
:0047558E 68F4010000              push 000001F4
:00475593 68E7030000              push 000003E7
:00475598 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:0047559E 51                      push ecx
:0047559F FF15A8634800            call dword ptr [004863A8]
:004755A5 B801000000              mov eax, 00000001
:004755AA EB02                    jmp 004755AE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00475460(C)
|
:004755AC 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004752DC(U), :0047532A(U), :0047539A(U), :004753D0(U), :0047555D(U)
|:00475574(U), :0047558A(U), :004755AA(U)
|
:004755AE 8BE5                    mov esp, ebp
:004755B0 5D                      pop ebp
:004755B1 C20800                  ret 0008



* Referenced by a CALL at Address:
|:0048191A   
|
:004755B4 55                      push ebp
:004755B5 8BEC                    mov ebp, esp
:004755B7 83EC1C                  sub esp, 0000001C
:004755BA 8B450C                  mov eax, dword ptr [ebp+0C]
:004755BD 50                      push eax
:004755BE 8B4D08                  mov ecx, dword ptr [ebp+08]
:004755C1 51                      push ecx
:004755C2 E89DFCFFFF              call 00475264
:004755C7 85C0                    test eax, eax
:004755C9 7504                    jne 004755CF
:004755CB 33C0                    xor eax, eax
:004755CD EB1F                    jmp 004755EE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004755C9(C)
|
:004755CF 68A74B4700              push 00474BA7
:004755D4 E8E1940000              call 0047EABA
:004755D9 83C404                  add esp, 00000004
:004755DC E86063FBFF              call 0042B941
:004755E1 B9B07F4900              mov ecx, 00497FB0
:004755E6 E8BD09FBFF              call 00425FA8
:004755EB 8B45EC                  mov eax, dword ptr [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004755CD(U)
|
:004755EE 8BE5                    mov esp, ebp
:004755F0 5D                      pop ebp
:004755F1 C21000                  ret 0010


:004755F4 CC                      int 03
:004755F5 CC                      int 03
:004755F6 CC                      int 03
:004755F7 CC                      int 03
:004755F8 CC                      int 03
:004755F9 CC                      int 03
:004755FA CC                      int 03
:004755FB CC                      int 03
:004755FC CC                      int 03
:004755FD CC                      int 03
:004755FE CC                      int 03
:004755FF CC                      int 03

* Referenced by a CALL at Addresses:
|:00474B25   , :00474B81   
|
:00475600 55                      push ebp
:00475601 8BEC                    mov ebp, esp
:00475603 51                      push ecx
:00475604 894DFC                  mov dword ptr [ebp-04], ecx
:00475607 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047560A E8918DF9FF              call 0040E3A0
:0047560F 8B45FC                  mov eax, dword ptr [ebp-04]
:00475612 C70010744800            mov dword ptr [eax], 00487410
:00475618 8B45FC                  mov eax, dword ptr [ebp-04]
:0047561B 8BE5                    mov esp, ebp
:0047561D 5D                      pop ebp
:0047561E C3                      ret


:0047561F CC                      int 03

* Referenced by a CALL at Address:
|:00474D8C   
|
:00475620 55                      push ebp
:00475621 8BEC                    mov ebp, esp
:00475623 6AFF                    push FFFFFFFF
:00475625 68B85B4800              push 00485BB8
:0047562A 64A100000000            mov eax, dword ptr fs:[00000000]
:00475630 50                      push eax
:00475631 64892500000000          mov dword ptr fs:[00000000], esp
:00475638 51                      push ecx
:00475639 894DF0                  mov dword ptr [ebp-10], ecx
:0047563C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047563F E85C8DF9FF              call 0040E3A0
:00475644 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00475647 83C10C                  add ecx, 0000000C
:0047564A E8418CF9FF              call 0040E290
:0047564F C745FC00000000          mov [ebp-04], 00000000
:00475656 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00475659 83C118                  add ecx, 00000018
:0047565C E8EF000000              call 00475750
:00475661 C645FC01                mov [ebp-04], 01
:00475665 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00475668 83C168                  add ecx, 00000068
:0047566B E800010000              call 00475770
:00475670 8B45F0                  mov eax, dword ptr [ebp-10]
:00475673 C70038744800            mov dword ptr [eax], 00487438
:00475679 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00475680 8B45F0                  mov eax, dword ptr [ebp-10]
:00475683 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00475686 64890D00000000          mov dword ptr fs:[00000000], ecx
:0047568D 8BE5                    mov esp, ebp
:0047568F 5D                      pop ebp
:00475690 C3                      ret


:00475691 CC                      int 03
:00475692 CC                      int 03
:00475693 CC                      int 03
:00475694 CC                      int 03
:00475695 CC                      int 03
:00475696 CC                      int 03
:00475697 CC                      int 03
:00475698 CC                      int 03
:00475699 CC                      int 03
:0047569A CC                      int 03
:0047569B CC                      int 03
:0047569C CC                      int 03
:0047569D CC                      int 03
:0047569E CC                      int 03
:0047569F CC                      int 03

* Referenced by a CALL at Addresses:
|:00474DB0   , :00485B76   
|
:004756A0 55                      push ebp
:004756A1 8BEC                    mov ebp, esp
:004756A3 6AFF                    push FFFFFFFF
:004756A5 68E85B4800              push 00485BE8
:004756AA 64A100000000            mov eax, dword ptr fs:[00000000]
:004756B0 50                      push eax
:004756B1 64892500000000          mov dword ptr fs:[00000000], esp
:004756B8 51                      push ecx
:004756B9 894DF0                  mov dword ptr [ebp-10], ecx
:004756BC C745FC01000000          mov [ebp-04], 00000001
:004756C3 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004756C6 83C168                  add ecx, 00000068
:004756C9 E8C2000000              call 00475790
:004756CE C645FC00                mov [ebp-04], 00
:004756D2 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004756D5 83C118                  add ecx, 00000018
:004756D8 E8B3000000              call 00475790
:004756DD C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:004756E4 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004756E7 83C10C                  add ecx, 0000000C
:004756EA E8018BF9FF              call 0040E1F0
:004756EF 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004756F2 64890D00000000          mov dword ptr fs:[00000000], ecx
:004756F9 8BE5                    mov esp, ebp
:004756FB 5D                      pop ebp
:004756FC C3                      ret


:004756FD CC                      int 03
:004756FE CC                      int 03
:004756FF CC                      int 03

* Referenced by a CALL at Address:
|:00474DBD   
|
:00475700 55                      push ebp
:00475701 8BEC                    mov ebp, esp
:00475703 51                      push ecx
:00475704 894DFC                  mov dword ptr [ebp-04], ecx
:00475707 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047570A E8918CF9FF              call 0040E3A0
:0047570F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00475712 83C10C                  add ecx, 0000000C
:00475715 E896000000              call 004757B0
:0047571A 8B45FC                  mov eax, dword ptr [ebp-04]
:0047571D C70060744800            mov dword ptr [eax], 00487460
:00475723 8B45FC                  mov eax, dword ptr [ebp-04]
:00475726 8BE5                    mov esp, ebp
:00475728 5D                      pop ebp
:00475729 C3                      ret


:0047572A CC                      int 03
:0047572B CC                      int 03
:0047572C CC                      int 03
:0047572D CC                      int 03
:0047572E CC                      int 03
:0047572F CC                      int 03

* Referenced by a CALL at Addresses:
|:00474DE1   , :00485B82   
|
:00475730 55                      push ebp
:00475731 8BEC                    mov ebp, esp
:00475733 51                      push ecx
:00475734 894DFC                  mov dword ptr [ebp-04], ecx
:00475737 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047573A 83C10C                  add ecx, 0000000C
:0047573D E8AE000000              call 004757F0
:00475742 8BE5                    mov esp, ebp
:00475744 5D                      pop ebp
:00475745 C3                      ret


:00475746 CC                      int 03
:00475747 CC                      int 03
:00475748 CC                      int 03
:00475749 CC                      int 03
:0047574A CC                      int 03
:0047574B CC                      int 03
:0047574C CC                      int 03
:0047574D CC                      int 03
:0047574E CC                      int 03
:0047574F CC                      int 03

* Referenced by a CALL at Address:
|:0047565C   
|
:00475750 55                      push ebp
:00475751 8BEC                    mov ebp, esp
:00475753 51                      push ecx
:00475754 894DFC                  mov dword ptr [ebp-04], ecx
:00475757 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047575A E8B1000000              call 00475810
:0047575F 8B45FC                  mov eax, dword ptr [ebp-04]
:00475762 C70088744800            mov dword ptr [eax], 00487488
:00475768 8B45FC                  mov eax, dword ptr [ebp-04]
:0047576B 8BE5                    mov esp, ebp
:0047576D 5D                      pop ebp
:0047576E C3                      ret


:0047576F CC                      int 03

* Referenced by a CALL at Address:
|:0047566B   
|
:00475770 55                      push ebp
:00475771 8BEC                    mov ebp, esp
:00475773 51                      push ecx
:00475774 894DFC                  mov dword ptr [ebp-04], ecx
:00475777 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047577A E891000000              call 00475810
:0047577F 8B45FC                  mov eax, dword ptr [ebp-04]
:00475782 C700E8744800            mov dword ptr [eax], 004874E8
:00475788 8B45FC                  mov eax, dword ptr [ebp-04]
:0047578B 8BE5                    mov esp, ebp
:0047578D 5D                      pop ebp
:0047578E C3                      ret


:0047578F CC                      int 03

* Referenced by a CALL at Addresses:
|:0040E15E   , :0043E3C9   , :0047266A   , :00472720   , :0047278E   
|:004727A0   , :00472BA9   , :00472E1E   , :00472E2D   , :004756C9   
|:004756D8   , :0047860E   , :00485086   , :004850A6   , :004858AC   
|:004859E5   , :00485A16   , :00485A25   , :00485A46   , :00485A55   
|:00485B1F   , :00485B2E   , :00485B4F   , :00485B5E   , :00485BB2   
|:00485BE2   
|
:00475790 55                      push ebp
:00475791 8BEC                    mov ebp, esp
:00475793 51                      push ecx
:00475794 894DFC                  mov dword ptr [ebp-04], ecx
:00475797 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047579A E891000000              call 00475830
:0047579F 8BE5                    mov esp, ebp
:004757A1 5D                      pop ebp
:004757A2 C3                      ret


:004757A3 CC                      int 03
:004757A4 CC                      int 03
:004757A5 CC                      int 03
:004757A6 CC                      int 03
:004757A7 CC                      int 03
:004757A8 CC                      int 03
:004757A9 CC                      int 03
:004757AA CC                      int 03
:004757AB CC                      int 03
:004757AC CC                      int 03
:004757AD CC                      int 03
:004757AE CC                      int 03
:004757AF CC                      int 03

* Referenced by a CALL at Address:
|:00475715   
|
:004757B0 55                      push ebp
:004757B1 8BEC                    mov ebp, esp
:004757B3 51                      push ecx
:004757B4 894DFC                  mov dword ptr [ebp-04], ecx
:004757B7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004757BA E8E18BF9FF              call 0040E3A0
:004757BF 6880584700              push 00475880
:004757C4 6850584700              push 00475850
:004757C9 6A32                    push 00000032
:004757CB 6A34                    push 00000034
:004757CD 8B45FC                  mov eax, dword ptr [ebp-04]
:004757D0 83C01C                  add eax, 0000001C
:004757D3 50                      push eax
:004757D4 E867BC0000              call 00481440
:004757D9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004757DC C70148754800            mov dword ptr [ecx], 00487548
:004757E2 8B45FC                  mov eax, dword ptr [ebp-04]
:004757E5 8BE5                    mov esp, ebp
:004757E7 5D                      pop ebp
:004757E8 C3                      ret


:004757E9 CC                      int 03
:004757EA CC                      int 03
:004757EB CC                      int 03
:004757EC CC                      int 03
:004757ED CC                      int 03
:004757EE CC                      int 03
:004757EF CC                      int 03

* Referenced by a CALL at Address:
|:0047573D   
|
:004757F0 55                      push ebp
:004757F1 8BEC                    mov ebp, esp
:004757F3 51                      push ecx
:004757F4 894DFC                  mov dword ptr [ebp-04], ecx
:004757F7 6880584700              push 00475880
:004757FC 6A32                    push 00000032
:004757FE 6A34                    push 00000034
:00475800 8B45FC                  mov eax, dword ptr [ebp-04]
:00475803 83C01C                  add eax, 0000001C
:00475806 50                      push eax
:00475807 E8D4BC0000              call 004814E0
:0047580C 8BE5                    mov esp, ebp
:0047580E 5D                      pop ebp
:0047580F C3                      ret



* Referenced by a CALL at Addresses:
|:0047575A   , :0047577A   
|
:00475810 55                      push ebp
:00475811 8BEC                    mov ebp, esp
:00475813 51                      push ecx
:00475814 894DFC                  mov dword ptr [ebp-04], ecx
:00475817 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047581A E88EE3FEFF              call 00463BAD
:0047581F 8B45FC                  mov eax, dword ptr [ebp-04]
:00475822 C70080754800            mov dword ptr [eax], 00487580
:00475828 8B45FC                  mov eax, dword ptr [ebp-04]
:0047582B 8BE5                    mov esp, ebp
:0047582D 5D                      pop ebp
:0047582E C3                      ret


:0047582F CC                      int 03

* Referenced by a CALL at Addresses:
|:0041C29D   , :00472E3C   , :0047579A   , :0047AFCE   , :00485AD3   
|:00485B13   , :00485B43   , :00485D6C   
|
:00475830 55                      push ebp
:00475831 8BEC                    mov ebp, esp
:00475833 51                      push ecx
:00475834 894DFC                  mov dword ptr [ebp-04], ecx
:00475837 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047583A E844E4FEFF              call 00463C83
:0047583F 8BE5                    mov esp, ebp
:00475841 5D                      pop ebp
:00475842 C3                      ret


:00475843 CC                      int 03
:00475844 CC                      int 03
:00475845 CC                      int 03
:00475846 CC                      int 03
:00475847 CC                      int 03
:00475848 CC                      int 03
:00475849 CC                      int 03
:0047584A CC                      int 03
:0047584B CC                      int 03
:0047584C CC                      int 03
:0047584D CC                      int 03
:0047584E CC                      int 03
:0047584F CC                      int 03
:00475850 55                      push ebp
:00475851 8BEC                    mov ebp, esp
:00475853 51                      push ecx
:00475854 894DFC                  mov dword ptr [ebp-04], ecx
:00475857 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047585A E8418BF9FF              call 0040E3A0
:0047585F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00475862 83C120                  add ecx, 00000020
:00475865 E8B8DAFEFF              call 00463322
:0047586A 8B45FC                  mov eax, dword ptr [ebp-04]
:0047586D C700E0754800            mov dword ptr [eax], 004875E0
:00475873 8B45FC                  mov eax, dword ptr [ebp-04]
:00475876 8BE5                    mov esp, ebp
:00475878 5D                      pop ebp
:00475879 C3                      ret


:0047587A CC                      int 03
:0047587B CC                      int 03
:0047587C CC                      int 03
:0047587D CC                      int 03
:0047587E CC                      int 03
:0047587F CC                      int 03
:00475880 55                      push ebp
:00475881 8BEC                    mov ebp, esp
:00475883 51                      push ecx
:00475884 894DFC                  mov dword ptr [ebp-04], ecx
:00475887 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047588A 83C120                  add ecx, 00000020
:0047588D E85E89F9FF              call 0040E1F0
:00475892 8BE5                    mov esp, ebp
:00475894 5D                      pop ebp
:00475895 C3                      ret


:00475896 CC                      int 03
:00475897 CC                      int 03
:00475898 CC                      int 03
:00475899 CC                      int 03
:0047589A CC                      int 03
:0047589B CC                      int 03
:0047589C CC                      int 03
:0047589D CC                      int 03
:0047589E CC                      int 03
:0047589F CC                      int 03

* Referenced by a CALL at Address:
|:0046DB55   
|
:004758A0 55                      push ebp
:004758A1 8BEC                    mov ebp, esp
:004758A3 51                      push ecx
:004758A4 894DFC                  mov dword ptr [ebp-04], ecx
:004758A7 33C0                    xor eax, eax
:004758A9 8BE5                    mov esp, ebp
:004758AB 5D                      pop ebp
:004758AC C20C00                  ret 000C


:004758AF CC                      int 03
:004758B0 55                      push ebp
:004758B1 8BEC                    mov ebp, esp
:004758B3 51                      push ecx
:004758B4 894DFC                  mov dword ptr [ebp-04], ecx
:004758B7 6A02                    push 00000002
:004758B9 8B45FC                  mov eax, dword ptr [ebp-04]
:004758BC 8B4804                  mov ecx, dword ptr [eax+04]
:004758BF 51                      push ecx
:004758C0 FF15D4624800            call dword ptr [004862D4]
:004758C6 8BE5                    mov esp, ebp
:004758C8 5D                      pop ebp
:004758C9 C3                      ret


:004758CA CC                      int 03
:004758CB CC                      int 03
:004758CC CC                      int 03
:004758CD CC                      int 03
:004758CE CC                      int 03
:004758CF CC                      int 03

* Referenced by a CALL at Address:
|:0047886C   
|
:004758D0 55                      push ebp
:004758D1 8BEC                    mov ebp, esp
:004758D3 8B4510                  mov eax, dword ptr [ebp+10]
:004758D6 50                      push eax
:004758D7 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004758DA 51                      push ecx
:004758DB 8B5508                  mov edx, dword ptr [ebp+08]
:004758DE 52                      push edx
:004758DF E8DFA20000              call 0047FBC3
:004758E4 83C40C                  add esp, 0000000C
:004758E7 5D                      pop ebp
:004758E8 C3                      ret


:004758E9 55                      push ebp
:004758EA 8BEC                    mov ebp, esp
:004758EC E807000000              call 004758F8
:004758F1 E811000000              call 00475907
:004758F6 5D                      pop ebp
:004758F7 C3                      ret



* Referenced by a CALL at Address:
|:004758EC   
|
:004758F8 55                      push ebp
:004758F9 8BEC                    mov ebp, esp
:004758FB B9986A4B00              mov ecx, 004B6A98
:00475900 E87B570000              call 0047B080
:00475905 5D                      pop ebp
:00475906 C3                      ret



* Referenced by a CALL at Address:
|:004758F1   
|
:00475907 55                      push ebp
:00475908 8BEC                    mov ebp, esp
:0047590A 6819594700              push 00475919
:0047590F E8ECB70000              call 00481100
:00475914 83C404                  add esp, 00000004
:00475917 5D                      pop ebp
:00475918 C3                      ret


:00475919 55                      push ebp
:0047591A 8BEC                    mov ebp, esp
:0047591C B9986A4B00              mov ecx, 004B6A98
:00475921 E8CA560000              call 0047AFF0
:00475926 5D                      pop ebp
:00475927 C3                      ret


:00475928 55                      push ebp
:00475929 8BEC                    mov ebp, esp
:0047592B E807000000              call 00475937
:00475930 E811000000              call 00475946
:00475935 5D                      pop ebp
:00475936 C3                      ret



* Referenced by a CALL at Address:
|:0047592B   
|
:00475937 55                      push ebp
:00475938 8BEC                    mov ebp, esp
:0047593A B9C06B4B00              mov ecx, 004B6BC0
:0047593F E8EC580000              call 0047B230
:00475944 5D                      pop ebp
:00475945 C3                      ret



* Referenced by a CALL at Address:
|:00475930   
|
:00475946 55                      push ebp
:00475947 8BEC                    mov ebp, esp
:00475949 6858594700              push 00475958
:0047594E E8ADB70000              call 00481100
:00475953 83C404                  add esp, 00000004
:00475956 5D                      pop ebp
:00475957 C3                      ret


:00475958 55                      push ebp
:00475959 8BEC                    mov ebp, esp
:0047595B B9C06B4B00              mov ecx, 004B6BC0
:00475960 E85B580000              call 0047B1C0
:00475965 5D                      pop ebp
:00475966 C3                      ret



* Referenced by a CALL at Address:
|:0042B9FF   
|
:00475967 55                      push ebp
:00475968 8BEC                    mov ebp, esp
:0047596A 83EC08                  sub esp, 00000008
:0047596D A1686A4B00              mov eax, dword ptr [004B6A68]
:00475972 50                      push eax
:00475973 FF1558624800            call dword ptr [00486258]
:00475979 8945F8                  mov dword ptr [ebp-08], eax

* Possible StringData Ref from Data Obj ->"APPMENU"
                                  |
:0047597C 68A8EB4800              push 0048EBA8
:00475981 8B0D606A4B00            mov ecx, dword ptr [004B6A60]
:00475987 51                      push ecx
:00475988 FF153C624800            call dword ptr [0048623C]
:0047598E 8945FC                  mov dword ptr [ebp-04], eax
:00475991 8B55FC                  mov edx, dword ptr [ebp-04]
:00475994 52                      push edx
:00475995 A1686A4B00              mov eax, dword ptr [004B6A68]
:0047599A 50                      push eax
:0047599B FF1538624800            call dword ptr [00486238]
:004759A1 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:004759A7 51                      push ecx
:004759A8 FF1534624800            call dword ptr [00486234]
:004759AE 8B55F8                  mov edx, dword ptr [ebp-08]
:004759B1 52                      push edx
:004759B2 FF1530624800            call dword ptr [00486230]
:004759B8 8BE5                    mov esp, ebp
:004759BA 5D                      pop ebp
:004759BB C3                      ret



* Referenced by a CALL at Addresses:
|:00419796   , :004199AF   , :0041A41C   , :0041F50C   , :00426B6F   
|:0042B60D   , :0042B963   , :0042BA06   , :0042BF38   , :0042BF6E   
|:0042C08C   , :0042C253   , :0042C380   , :0042F76C   , :00449E0F   
|:00449E3C   , :0044D354   , :0044D88D   , :0044E1B7   , :0044EC14   
|:004764AE   , :00476505   , :004768B4   
|
:004759BC 55                      push ebp
:004759BD 8BEC                    mov ebp, esp
:004759BF 83EC14                  sub esp, 00000014
:004759C2 A1686A4B00              mov eax, dword ptr [004B6A68]
:004759C7 50                      push eax
:004759C8 FF1558624800            call dword ptr [00486258]
:004759CE 8945FC                  mov dword ptr [ebp-04], eax
:004759D1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004759D4 51                      push ecx
:004759D5 FF1544624800            call dword ptr [00486244]
:004759DB 8945EC                  mov dword ptr [ebp-14], eax
:004759DE 8B5508                  mov edx, dword ptr [ebp+08]
:004759E1 52                      push edx
:004759E2 E830010000              call 00475B17
:004759E7 83C404                  add esp, 00000004
:004759EA 33C0                    xor eax, eax
:004759EC 837D0800                cmp dword ptr [ebp+08], 00000000
:004759F0 0F94C0                  sete al
:004759F3 8945F4                  mov dword ptr [ebp-0C], eax
:004759F6 C745F000000000          mov [ebp-10], 00000000
:004759FD EB09                    jmp 00475A08

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00475A23(U)
|
:004759FF 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00475A02 83C101                  add ecx, 00000001
:00475A05 894DF0                  mov dword ptr [ebp-10], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004759FD(U)
|
:00475A08 837DF003                cmp dword ptr [ebp-10], 00000003
:00475A0C 7317                    jnb 00475A25
:00475A0E 8B55F4                  mov edx, dword ptr [ebp-0C]
:00475A11 80CE04                  or dh, 04
:00475A14 52                      push edx
:00475A15 8B45F0                  mov eax, dword ptr [ebp-10]
:00475A18 50                      push eax
:00475A19 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00475A1C 51                      push ecx
:00475A1D FF1500634800            call dword ptr [00486300]
:00475A23 EBDA                    jmp 004759FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00475A0C(C)
|
:00475A25 6A01                    push 00000001
:00475A27 8B55FC                  mov edx, dword ptr [ebp-04]
:00475A2A 52                      push edx
:00475A2B FF1540624800            call dword ptr [00486240]
:00475A31 8945F8                  mov dword ptr [ebp-08], eax
:00475A34 8B45F4                  mov eax, dword ptr [ebp-0C]
:00475A37 50                      push eax

* Possible Ref to Menu: APPMENU, Item: ""
                                  |
:00475A38 6A6B                    push 0000006B
:00475A3A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00475A3D 51                      push ecx
:00475A3E FF1500634800            call dword ptr [00486300]
:00475A44 837D0800                cmp dword ptr [ebp+08], 00000000
:00475A48 7427                    je 00475A71
:00475A4A E8D35EF9FF              call 0040B922
:00475A4F 85C0                    test eax, eax
:00475A51 751E                    jne 00475A71
:00475A53 6A01                    push 00000001

* Possible Ref to Menu: APPMENU, Item: ""*gL"
                                  |
:00475A55 6A6E                    push 0000006E
:00475A57 8B55F8                  mov edx, dword ptr [ebp-08]
:00475A5A 52                      push edx
:00475A5B FF1500634800            call dword ptr [00486300]
:00475A61 6A01                    push 00000001

* Possible Ref to Menu: APPMENU, Item: "_   "
                                  |
:00475A63 6A6D                    push 0000006D
:00475A65 8B45F8                  mov eax, dword ptr [ebp-08]
:00475A68 50                      push eax
:00475A69 FF1500634800            call dword ptr [00486300]
:00475A6F EB20                    jmp 00475A91

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00475A48(C), :00475A51(C)
|
:00475A71 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00475A74 51                      push ecx

* Possible Ref to Menu: APPMENU, Item: ""*gL"
                                  |
:00475A75 6A6E                    push 0000006E
:00475A77 8B55F8                  mov edx, dword ptr [ebp-08]
:00475A7A 52                      push edx
:00475A7B FF1500634800            call dword ptr [00486300]
:00475A81 8B45F4                  mov eax, dword ptr [ebp-0C]
:00475A84 50                      push eax

* Possible Ref to Menu: APPMENU, Item: "_   "
                                  |
:00475A85 6A6D                    push 0000006D
:00475A87 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00475A8A 51                      push ecx
:00475A8B FF1500634800            call dword ptr [00486300]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00475A6F(U)
|
:00475A91 6A02                    push 00000002
:00475A93 8B55FC                  mov edx, dword ptr [ebp-04]
:00475A96 52                      push edx
:00475A97 FF1540624800            call dword ptr [00486240]
:00475A9D 8945F8                  mov dword ptr [ebp-08], eax
:00475AA0 C745F000000000          mov [ebp-10], 00000000
:00475AA7 EB09                    jmp 00475AB2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00475ACD(U)
|
:00475AA9 8B45F0                  mov eax, dword ptr [ebp-10]
:00475AAC 83C001                  add eax, 00000001
:00475AAF 8945F0                  mov dword ptr [ebp-10], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00475AA7(U)
|
:00475AB2 837DF006                cmp dword ptr [ebp-10], 00000006
:00475AB6 7317                    jnb 00475ACF
:00475AB8 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00475ABB 80CD04                  or ch, 04
:00475ABE 51                      push ecx
:00475ABF 8B55F0                  mov edx, dword ptr [ebp-10]
:00475AC2 52                      push edx
:00475AC3 8B45F8                  mov eax, dword ptr [ebp-08]
:00475AC6 50                      push eax
:00475AC7 FF1500634800            call dword ptr [00486300]
:00475ACD EBDA                    jmp 00475AA9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00475AB6(C)
|
:00475ACF E84E5EF9FF              call 0040B922
:00475AD4 85C0                    test eax, eax
:00475AD6 7522                    jne 00475AFA
:00475AD8 837D0800                cmp dword ptr [ebp+08], 00000000
:00475ADC 741C                    je 00475AFA
:00475ADE 6A01                    push 00000001

* Possible Ref to Menu: APPMENU, Item: ")a"
                                  |
:00475AE0 6A6A                    push 0000006A
:00475AE2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00475AE5 51                      push ecx
:00475AE6 FF1500634800            call dword ptr [00486300]
:00475AEC 6A01                    push 00000001

* Possible Ref to Menu: APPMENU, Item: ":)"
                                  |
:00475AEE 6A6C                    push 0000006C
:00475AF0 8B55F8                  mov edx, dword ptr [ebp-08]
:00475AF3 52                      push edx
:00475AF4 FF1500634800            call dword ptr [00486300]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00475AD6(C), :00475ADC(C)
|
:00475AFA A1686A4B00              mov eax, dword ptr [004B6A68]
:00475AFF 50                      push eax
:00475B00 FF1534624800            call dword ptr [00486234]
:00475B06 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:00475B0C 51                      push ecx
:00475B0D FF15A8624800            call dword ptr [004862A8]
:00475B13 8BE5                    mov esp, ebp
:00475B15 5D                      pop ebp
:00475B16 C3                      ret



* Referenced by a CALL at Address:
|:004759E2   
|
:00475B17 55                      push ebp
:00475B18 8BEC                    mov ebp, esp
:00475B1A 8B4508                  mov eax, dword ptr [ebp+08]
:00475B1D 25FFFF0000              and eax, 0000FFFF
:00475B22 50                      push eax

* Possible Ref to Menu: APPMENU, Item: "X"
                                  |
:00475B23 6A65                    push 00000065
:00475B25 6801040000              push 00000401
:00475B2A 8B0D8C6A4B00            mov ecx, dword ptr [004B6A8C]
:00475B30 51                      push ecx
:00475B31 FF15F4624800            call dword ptr [004862F4]
:00475B37 8B5508                  mov edx, dword ptr [ebp+08]
:00475B3A 81E2FFFF0000            and edx, 0000FFFF
:00475B40 52                      push edx

* Possible Ref to Menu: APPMENU, Item: ""
                                  |
:00475B41 6A66                    push 00000066
:00475B43 6801040000              push 00000401
:00475B48 A18C6A4B00              mov eax, dword ptr [004B6A8C]
:00475B4D 50                      push eax
:00475B4E FF15F4624800            call dword ptr [004862F4]
:00475B54 8B4D08                  mov ecx, dword ptr [ebp+08]
:00475B57 81E1FFFF0000            and ecx, 0000FFFF
:00475B5D 51                      push ecx

* Possible Ref to Menu: APPMENU, Item: ""
                                  |
:00475B5E 6A6B                    push 0000006B
:00475B60 6801040000              push 00000401
:00475B65 8B158C6A4B00            mov edx, dword ptr [004B6A8C]
:00475B6B 52                      push edx
:00475B6C FF15F4624800            call dword ptr [004862F4]
:00475B72 8B4508                  mov eax, dword ptr [ebp+08]
:00475B75 25FFFF0000              and eax, 0000FFFF
:00475B7A 50                      push eax

* Possible Ref to Menu: APPMENU, Item: "f"
                                  |
:00475B7B 6A69                    push 00000069
:00475B7D 6801040000              push 00000401
:00475B82 8B0D8C6A4B00            mov ecx, dword ptr [004B6A8C]
:00475B88 51                      push ecx
:00475B89 FF15F4624800            call dword ptr [004862F4]
:00475B8F 8B5508                  mov edx, dword ptr [ebp+08]
:00475B92 81E2FFFF0000            and edx, 0000FFFF
:00475B98 52                      push edx

* Possible Ref to Menu: APPMENU, Item: "   Sw"
                                  |
:00475B99 68D39C0000              push 00009CD3
:00475B9E 6801040000              push 00000401
:00475BA3 A18C6A4B00              mov eax, dword ptr [004B6A8C]
:00475BA8 50                      push eax
:00475BA9 FF15F4624800            call dword ptr [004862F4]
:00475BAF 8B4D08                  mov ecx, dword ptr [ebp+08]
:00475BB2 81E1FFFF0000            and ecx, 0000FFFF
:00475BB8 51                      push ecx

* Possible Ref to Menu: APPMENU, Item: "0bť"
                                  |
:00475BB9 68D69C0000              push 00009CD6
:00475BBE 6801040000              push 00000401
:00475BC3 8B158C6A4B00            mov edx, dword ptr [004B6A8C]
:00475BC9 52                      push edx
:00475BCA FF15F4624800            call dword ptr [004862F4]
:00475BD0 8B4508                  mov eax, dword ptr [ebp+08]
:00475BD3 25FFFF0000              and eax, 0000FFFF
:00475BD8 50                      push eax

* Possible Ref to Menu: APPMENU, Item: "it"
                                  |
:00475BD9 68D79C0000              push 00009CD7
:00475BDE 6801040000              push 00000401
:00475BE3 8B0D8C6A4B00            mov ecx, dword ptr [004B6A8C]
:00475BE9 51                      push ecx
:00475BEA FF15F4624800            call dword ptr [004862F4]
:00475BF0 8B5508                  mov edx, dword ptr [ebp+08]
:00475BF3 81E2FFFF0000            and edx, 0000FFFF
:00475BF9 52                      push edx

* Possible Ref to Menu: APPMENU, Item: ")a"
                                  |
:00475BFA 6A6A                    push 0000006A
:00475BFC 6801040000              push 00000401
:00475C01 A18C6A4B00              mov eax, dword ptr [004B6A8C]
:00475C06 50                      push eax
:00475C07 FF15F4624800            call dword ptr [004862F4]
:00475C0D 8B4D08                  mov ecx, dword ptr [ebp+08]
:00475C10 81E1FFFF0000            and ecx, 0000FFFF
:00475C16 51                      push ecx

* Possible Ref to Menu: APPMENU, Item: ":)"
                                  |
:00475C17 6A6C                    push 0000006C
:00475C19 6801040000              push 00000401
:00475C1E 8B158C6A4B00            mov edx, dword ptr [004B6A8C]
:00475C24 52                      push edx
:00475C25 FF15F4624800            call dword ptr [004862F4]
:00475C2B 8B4508                  mov eax, dword ptr [ebp+08]
:00475C2E 25FFFF0000              and eax, 0000FFFF
:00475C33 50                      push eax

* Possible Ref to Menu: APPMENU, Item: "_   "
                                  |
:00475C34 6A6D                    push 0000006D
:00475C36 6801040000              push 00000401
:00475C3B 8B0D8C6A4B00            mov ecx, dword ptr [004B6A8C]
:00475C41 51                      push ecx
:00475C42 FF15F4624800            call dword ptr [004862F4]
:00475C48 8B5508                  mov edx, dword ptr [ebp+08]
:00475C4B 81E2FFFF0000            and edx, 0000FFFF
:00475C51 52                      push edx

* Possible Ref to Menu: APPMENU, Item: ""*gL"
                                  |
:00475C52 6A6E                    push 0000006E
:00475C54 6801040000              push 00000401
:00475C59 A18C6A4B00              mov eax, dword ptr [004B6A8C]
:00475C5E 50                      push eax
:00475C5F FF15F4624800            call dword ptr [004862F4]
:00475C65 8B4D08                  mov ecx, dword ptr [ebp+08]
:00475C68 81E1FFFF0000            and ecx, 0000FFFF
:00475C6E 51                      push ecx
:00475C6F 6A6F                    push 0000006F
:00475C71 6801040000              push 00000401
:00475C76 8B158C6A4B00            mov edx, dword ptr [004B6A8C]
:00475C7C 52                      push edx
:00475C7D FF15F4624800            call dword ptr [004862F4]
:00475C83 837D0800                cmp dword ptr [ebp+08], 00000000
:00475C87 745F                    je 00475CE8
:00475C89 E8945CF9FF              call 0040B922
:00475C8E 85C0                    test eax, eax
:00475C90 7556                    jne 00475CE8
:00475C92 6A00                    push 00000000

* Possible Ref to Menu: APPMENU, Item: ":)"
                                  |
:00475C94 6A6C                    push 0000006C
:00475C96 6801040000              push 00000401
:00475C9B A18C6A4B00              mov eax, dword ptr [004B6A8C]
:00475CA0 50                      push eax
:00475CA1 FF15F4624800            call dword ptr [004862F4]
:00475CA7 6A00                    push 00000000

* Possible Ref to Menu: APPMENU, Item: "_   "
                                  |
:00475CA9 6A6D                    push 0000006D
:00475CAB 6801040000              push 00000401
:00475CB0 8B0D8C6A4B00            mov ecx, dword ptr [004B6A8C]
:00475CB6 51                      push ecx
:00475CB7 FF15F4624800            call dword ptr [004862F4]
:00475CBD 6A00                    push 00000000

* Possible Ref to Menu: APPMENU, Item: ""*gL"
                                  |
:00475CBF 6A6E                    push 0000006E
:00475CC1 6801040000              push 00000401
:00475CC6 8B158C6A4B00            mov edx, dword ptr [004B6A8C]
:00475CCC 52                      push edx
:00475CCD FF15F4624800            call dword ptr [004862F4]
:00475CD3 6A00                    push 00000000
:00475CD5 6A6F                    push 0000006F
:00475CD7 6801040000              push 00000401
:00475CDC A18C6A4B00              mov eax, dword ptr [004B6A8C]
:00475CE1 50                      push eax
:00475CE2 FF15F4624800            call dword ptr [004862F4]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00475C87(C), :00475C90(C)
|
:00475CE8 5D                      pop ebp
:00475CE9 C3                      ret


:00475CEA 55                      push ebp
:00475CEB 8BEC                    mov ebp, esp
:00475CED 51                      push ecx
:00475CEE C745FC00000000          mov [ebp-04], 00000000
:00475CF5 EB09                    jmp 00475D00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00475D1B(U)
|
:00475CF7 8B45FC                  mov eax, dword ptr [ebp-04]
:00475CFA 83C001                  add eax, 00000001
:00475CFD 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00475CF5(U)
|
:00475D00 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00475D03 3B4D0C                  cmp ecx, dword ptr [ebp+0C]
:00475D06 7315                    jnb 00475D1D
:00475D08 6800040000              push 00000400
:00475D0D 8B55FC                  mov edx, dword ptr [ebp-04]
:00475D10 52                      push edx
:00475D11 8B4508                  mov eax, dword ptr [ebp+08]
:00475D14 50                      push eax
:00475D15 FF1548624800            call dword ptr [00486248]
:00475D1B EBDA                    jmp 00475CF7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00475D06(C)
|
:00475D1D 8BE5                    mov esp, ebp
:00475D1F 5D                      pop ebp
:00475D20 C3                      ret



* Referenced by a CALL at Address:
|:0047620F   
|
:00475D21 55                      push ebp
:00475D22 8BEC                    mov ebp, esp
:00475D24 51                      push ecx
:00475D25 894DFC                  mov dword ptr [ebp-04], ecx
:00475D28 8B45FC                  mov eax, dword ptr [ebp-04]
:00475D2B 8B4808                  mov ecx, dword ptr [eax+08]
:00475D2E 51                      push ecx
:00475D2F FF1548634800            call dword ptr [00486348]
:00475D35 85C0                    test eax, eax
:00475D37 0F851E010000            jne 00475E5B
:00475D3D 6A14                    push 00000014
:00475D3F 6A00                    push 00000000
:00475D41 6A00                    push 00000000
:00475D43 6A1C                    push 0000001C
:00475D45 6A18                    push 00000018
:00475D47 6A0A                    push 0000000A
:00475D49 68B0E94800              push 0048E9B0

* Possible Ref to Menu: APPMENU, Item: ")a"
                                  |
:00475D4E 6A6A                    push 0000006A
:00475D50 8B15606A4B00            mov edx, dword ptr [004B6A60]
:00475D56 52                      push edx
:00475D57 6A0D                    push 0000000D
:00475D59 6A71                    push 00000071
:00475D5B 6800010050              push 50000100
:00475D60 8B4508                  mov eax, dword ptr [ebp+08]
:00475D63 50                      push eax
:00475D64 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00475D67 E832D8FEFF              call 0046359E
:00475D6C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00475D6F 83790800                cmp dword ptr [ecx+08], 00000000
:00475D73 0F84D5000000            je 00475E4E
:00475D79 6A00                    push 00000000
:00475D7B 8B150C694800            mov edx, dword ptr [0048690C]
:00475D81 52                      push edx
:00475D82 A108694800              mov eax, dword ptr [00486908]
:00475D87 50                      push eax
:00475D88 6A02                    push 00000002
:00475D8A 680E010000              push 0000010E
:00475D8F 6A12                    push 00000012
:00475D91 8B0D14604B00            mov ecx, dword ptr [004B6014]
:00475D97 51                      push ecx
:00475D98 8B55FC                  mov edx, dword ptr [ebp-04]
:00475D9B 8B4208                  mov eax, dword ptr [edx+08]
:00475D9E 50                      push eax
:00475D9F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00475DA2 83C118                  add ecx, 00000018
:00475DA5 E888CCFEFF              call 00462A32
:00475DAA 6A00                    push 00000000
:00475DAC 8B0D1C694800            mov ecx, dword ptr [0048691C]
:00475DB2 51                      push ecx
:00475DB3 8B1518694800            mov edx, dword ptr [00486918]
:00475DB9 52                      push edx
:00475DBA 6A02                    push 00000002
:00475DBC 68BF010000              push 000001BF
:00475DC1 6A13                    push 00000013
:00475DC3 A118604B00              mov eax, dword ptr [004B6018]
:00475DC8 50                      push eax
:00475DC9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00475DCC 8B5108                  mov edx, dword ptr [ecx+08]
:00475DCF 52                      push edx
:00475DD0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00475DD3 83C14C                  add ecx, 0000004C
:00475DD6 E857CCFEFF              call 00462A32
:00475DDB 6A00                    push 00000000
:00475DDD 6A08                    push 00000008

* Possible Reference to Dialog: DialogID_00C8 
                                  |
:00475DDF 68C8000000              push 000000C8
:00475DE4 6A19                    push 00000019
:00475DE6 6856010000              push 00000156
:00475DEB 6A04                    push 00000004
:00475DED A1DC5F4B00              mov eax, dword ptr [004B5FDC]
:00475DF2 50                      push eax
:00475DF3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00475DF6 8B5108                  mov edx, dword ptr [ecx+08]
:00475DF9 52                      push edx
:00475DFA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00475DFD 81C180000000            add ecx, 00000080
:00475E03 E82ACCFEFF              call 00462A32
:00475E08 6A00                    push 00000000
:00475E0A 6A16                    push 00000016
:00475E0C 6842010000              push 00000142
:00475E11 685E010000              push 0000015E
:00475E16 8B45FC                  mov eax, dword ptr [ebp-04]
:00475E19 8B4808                  mov ecx, dword ptr [eax+08]
:00475E1C 51                      push ecx
:00475E1D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00475E20 81C1B4000000            add ecx, 000000B4
:00475E26 E84ED1FEFF              call 00462F79
:00475E2B 6A00                    push 00000000
:00475E2D 6A16                    push 00000016
:00475E2F 6822020000              push 00000222
:00475E34 685F010000              push 0000015F
:00475E39 8B55FC                  mov edx, dword ptr [ebp-04]
:00475E3C 8B4208                  mov eax, dword ptr [edx+08]
:00475E3F 50                      push eax
:00475E40 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00475E43 81C1E0000000            add ecx, 000000E0
:00475E49 E82BD1FEFF              call 00462F79

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00475D73(C)
|
:00475E4E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00475E51 C7810C01000000000000    mov dword ptr [ebx+0000010C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00475D37(C)
|
:00475E5B 8B55FC                  mov edx, dword ptr [ebp-04]
:00475E5E 8B4208                  mov eax, dword ptr [edx+08]
:00475E61 8BE5                    mov esp, ebp
:00475E63 5D                      pop ebp
:00475E64 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0041F505   , :0042B5FA   , :0042C27D   , :0042C3D1   
|
:00475E67 55                      push ebp
:00475E68 8BEC                    mov ebp, esp
:00475E6A 51                      push ecx
:00475E6B 894DFC                  mov dword ptr [ebp-04], ecx
:00475E6E 8B45FC                  mov eax, dword ptr [ebp-04]
:00475E71 8B4808                  mov ecx, dword ptr [eax+08]
:00475E74 51                      push ecx
:00475E75 FF1548634800            call dword ptr [00486348]
:00475E7B 85C0                    test eax, eax
:00475E7D 7469                    je 00475EE8
:00475E7F 8B55FC                  mov edx, dword ptr [ebp-04]
:00475E82 8B4208                  mov eax, dword ptr [edx+08]
:00475E85 50                      push eax
:00475E86 FF1530634800            call dword ptr [00486330]
:00475E8C 8B4D08                  mov ecx, dword ptr [ebp+08]
:00475E8F 51                      push ecx
:00475E90 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00475E93 83C118                  add ecx, 00000018
:00475E96 E891CCFEFF              call 00462B2C
:00475E9B 8B5508                  mov edx, dword ptr [ebp+08]
:00475E9E 52                      push edx
:00475E9F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00475EA2 83C14C                  add ecx, 0000004C
:00475EA5 E882CCFEFF              call 00462B2C
:00475EAA 8B4508                  mov eax, dword ptr [ebp+08]
:00475EAD 50                      push eax
:00475EAE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00475EB1 81C180000000            add ecx, 00000080
:00475EB7 E870CCFEFF              call 00462B2C
:00475EBC 8B4D08                  mov ecx, dword ptr [ebp+08]
:00475EBF 51                      push ecx
:00475EC0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00475EC3 81C1B4000000            add ecx, 000000B4
:00475EC9 E88CD1FEFF              call 0046305A
:00475ECE 8B5508                  mov edx, dword ptr [ebp+08]
:00475ED1 52                      push edx
:00475ED2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00475ED5 81C1E0000000            add ecx, 000000E0
:00475EDB E87AD1FEFF              call 0046305A
:00475EE0 6A00                    push 00000000
:00475EE2 FF1530634800            call dword ptr [00486330]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00475E7D(C)
|
:00475EE8 8B45FC                  mov eax, dword ptr [ebp-04]
:00475EEB 8B4D08                  mov ecx, dword ptr [ebp+08]
:00475EEE 89880C010000            mov dword ptr [eax+0000010C], ecx
:00475EF4 8BE5                    mov esp, ebp
:00475EF6 5D                      pop ebp
:00475EF7 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0041E5CA   
|
:00475EFA 55                      push ebp
:00475EFB 8BEC                    mov ebp, esp
:00475EFD 51                      push ecx
:00475EFE 894DFC                  mov dword ptr [ebp-04], ecx
:00475F01 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00475F04 83C118                  add ecx, 00000018
:00475F07 E870CEFEFF              call 00462D7C
:00475F0C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00475F0F 83C14C                  add ecx, 0000004C
:00475F12 E865CEFEFF              call 00462D7C
:00475F17 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00475F1A 81C180000000            add ecx, 00000080
:00475F20 E857CEFEFF              call 00462D7C
:00475F25 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00475F28 81C1B4000000            add ecx, 000000B4
:00475F2E E85AD1FEFF              call 0046308D
:00475F33 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00475F36 81C1E0000000            add ecx, 000000E0
:00475F3C E84CD1FEFF              call 0046308D
:00475F41 8BE5                    mov esp, ebp
:00475F43 5D                      pop ebp
:00475F44 C3                      ret



* Referenced by a CALL at Address:
|:0041E5B9   
|
:00475F45 55                      push ebp
:00475F46 8BEC                    mov ebp, esp
:00475F48 51                      push ecx
:00475F49 894DFC                  mov dword ptr [ebp-04], ecx
:00475F4C 8B45FC                  mov eax, dword ptr [ebp-04]
:00475F4F 8B4808                  mov ecx, dword ptr [eax+08]
:00475F52 51                      push ecx
:00475F53 FF1548634800            call dword ptr [00486348]
:00475F59 85C0                    test eax, eax
:00475F5B 740D                    je 00475F6A
:00475F5D 8B55FC                  mov edx, dword ptr [ebp-04]
:00475F60 8B4208                  mov eax, dword ptr [edx+08]
:00475F63 50                      push eax
:00475F64 FF1530634800            call dword ptr [00486330]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00475F5B(C)
|
:00475F6A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00475F6D 83C118                  add ecx, 00000018
:00475F70 E854CEFEFF              call 00462DC9
:00475F75 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00475F78 83C14C                  add ecx, 0000004C
:00475F7B E849CEFEFF              call 00462DC9
:00475F80 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00475F83 81C180000000            add ecx, 00000080
:00475F89 E83BCEFEFF              call 00462DC9
:00475F8E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00475F91 8B5108                  mov edx, dword ptr [ecx+08]
:00475F94 52                      push edx
:00475F95 FF1548634800            call dword ptr [00486348]
:00475F9B 85C0                    test eax, eax
:00475F9D 7408                    je 00475FA7
:00475F9F 6A00                    push 00000000
:00475FA1 FF1530634800            call dword ptr [00486330]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00475F9D(C)
|
:00475FA7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00475FAA 81C1B4000000            add ecx, 000000B4
:00475FB0 E85CD1FEFF              call 00463111
:00475FB5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00475FB8 81C1E0000000            add ecx, 000000E0
:00475FBE E84ED1FEFF              call 00463111
:00475FC3 8BE5                    mov esp, ebp
:00475FC5 5D                      pop ebp
:00475FC6 C3                      ret



* Referenced by a CALL at Addresses:
|:00476608   , :0047670B   , :00476867   
|
:00475FC7 55                      push ebp
:00475FC8 8BEC                    mov ebp, esp
:00475FCA 83EC08                  sub esp, 00000008
:00475FCD 894DFC                  mov dword ptr [ebp-04], ecx
:00475FD0 8B45FC                  mov eax, dword ptr [ebp-04]
:00475FD3 8B4808                  mov ecx, dword ptr [eax+08]
:00475FD6 51                      push ecx
:00475FD7 FF1548634800            call dword ptr [00486348]
:00475FDD 85C0                    test eax, eax
:00475FDF 7442                    je 00476023
:00475FE1 8B5508                  mov edx, dword ptr [ebp+08]
:00475FE4 8955F8                  mov dword ptr [ebp-08], edx
:00475FE7 837DF800                cmp dword ptr [ebp-08], 00000000
:00475FEB 740E                    je 00475FFB
:00475FED 837DF801                cmp dword ptr [ebp-08], 00000001
:00475FF1 7415                    je 00476008
:00475FF3 837DF802                cmp dword ptr [ebp-08], 00000002
:00475FF7 741C                    je 00476015
:00475FF9 EB28                    jmp 00476023

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00475FEB(C)
|
:00475FFB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00475FFE 83C118                  add ecx, 00000018
:00476001 E814CEFEFF              call 00462E1A
:00476006 EB1B                    jmp 00476023

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00475FF1(C)
|
:00476008 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047600B 83C14C                  add ecx, 0000004C
:0047600E E807CEFEFF              call 00462E1A
:00476013 EB0E                    jmp 00476023

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00475FF7(C)
|
:00476015 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00476018 81C180000000            add ecx, 00000080
:0047601E E8F7CDFEFF              call 00462E1A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00475FDF(C), :00475FF9(U), :00476006(U), :00476013(U)
|
:00476023 8BE5                    mov esp, ebp
:00476025 5D                      pop ebp
:00476026 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0040D35F   , :0040D392   , :0040D458   , :0040D48B   
|
:00476029 55                      push ebp
:0047602A 8BEC                    mov ebp, esp
:0047602C 83EC08                  sub esp, 00000008
:0047602F 894DF8                  mov dword ptr [ebp-08], ecx
:00476032 837D0800                cmp dword ptr [ebp+08], 00000000
:00476036 750D                    jne 00476045
:00476038 8B45F8                  mov eax, dword ptr [ebp-08]
:0047603B 05B4000000              add eax, 000000B4
:00476040 8945FC                  mov dword ptr [ebp-04], eax
:00476043 EB0C                    jmp 00476051

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00476036(C)
|
:00476045 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00476048 81C1E0000000            add ecx, 000000E0
:0047604E 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00476043(U)
|
:00476051 8B550C                  mov edx, dword ptr [ebp+0C]
:00476054 52                      push edx
:00476055 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00476058 E826D1FEFF              call 00463183
:0047605D 8BE5                    mov esp, ebp
:0047605F 5D                      pop ebp
:00476060 C20800                  ret 0008



* Referenced by a CALL at Address:
|:004761E5   
|
:00476063 55                      push ebp
:00476064 8BEC                    mov ebp, esp
:00476066 51                      push ecx
:00476067 894DFC                  mov dword ptr [ebp-04], ecx
:0047606A 8B45FC                  mov eax, dword ptr [ebp-04]
:0047606D 8B4808                  mov ecx, dword ptr [eax+08]
:00476070 51                      push ecx
:00476071 FF1548634800            call dword ptr [00486348]
:00476077 85C0                    test eax, eax
:00476079 0F85EB000000            jne 0047616A
:0047607F 6A14                    push 00000014
:00476081 6A00                    push 00000000
:00476083 6A00                    push 00000000
:00476085 6A18                    push 00000018
:00476087 6A18                    push 00000018
:00476089 6A0F                    push 0000000F
:0047608B 6878EA4800              push 0048EA78
:00476090 682E010000              push 0000012E
:00476095 8B15606A4B00            mov edx, dword ptr [004B6A60]
:0047609B 52                      push edx
:0047609C 6A0D                    push 0000000D
:0047609E 6A71                    push 00000071
:004760A0 6800010050              push 50000100
:004760A5 8B4508                  mov eax, dword ptr [ebp+08]
:004760A8 50                      push eax
:004760A9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004760AC E8EDD4FEFF              call 0046359E
:004760B1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004760B4 83790800                cmp dword ptr [ecx+08], 00000000
:004760B8 0F84AC000000            je 0047616A
:004760BE 6A38                    push 00000038
:004760C0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004760C3 E8B3D5FEFF              call 0046367B
:004760C8 6A00                    push 00000000
:004760CA 8B152C684800            mov edx, dword ptr [0048682C]
:004760D0 52                      push edx
:004760D1 A128684800              mov eax, dword ptr [00486828]
:004760D6 50                      push eax
:004760D7 6A01                    push 00000001
:004760D9 6896010000              push 00000196
:004760DE 6A04                    push 00000004
:004760E0 8B0DDC5F4B00            mov ecx, dword ptr [004B5FDC]
:004760E6 51                      push ecx
:004760E7 8B55FC                  mov edx, dword ptr [ebp-04]
:004760EA 8B4208                  mov eax, dword ptr [edx+08]
:004760ED 50                      push eax
:004760EE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004760F1 83C118                  add ecx, 00000018
:004760F4 E839C9FEFF              call 00462A32
:004760F9 6A00                    push 00000000
:004760FB 8B0D0C694800            mov ecx, dword ptr [0048690C]
:00476101 51                      push ecx
:00476102 8B1508694800            mov edx, dword ptr [00486908]
:00476108 52                      push edx
:00476109 A104694800              mov eax, dword ptr [00486904]
:0047610E 50                      push eax
:0047610F 8B0D00694800            mov ecx, dword ptr [00486900]
:00476115 51                      push ecx
:00476116 6A12                    push 00000012
:00476118 8B1514604B00            mov edx, dword ptr [004B6014]
:0047611E 52                      push edx
:0047611F 8B45FC                  mov eax, dword ptr [ebp-04]
:00476122 8B4808                  mov ecx, dword ptr [eax+08]
:00476125 51                      push ecx
:00476126 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00476129 83C14C                  add ecx, 0000004C
:0047612C E801C9FEFF              call 00462A32
:00476131 6A00                    push 00000000
:00476133 8B151C694800            mov edx, dword ptr [0048691C]
:00476139 52                      push edx
:0047613A 6880000000              push 00000080
:0047613F A114694800              mov eax, dword ptr [00486914]
:00476144 50                      push eax
:00476145 8B0D10694800            mov ecx, dword ptr [00486910]
:0047614B 51                      push ecx
:0047614C 6A13                    push 00000013
:0047614E 8B1518604B00            mov edx, dword ptr [004B6018]
:00476154 52                      push edx
:00476155 8B45FC                  mov eax, dword ptr [ebp-04]
:00476158 8B4808                  mov ecx, dword ptr [eax+08]
:0047615B 51                      push ecx
:0047615C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047615F 81C180000000            add ecx, 00000080
:00476165 E8C8C8FEFF              call 00462A32

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00476079(C), :004760B8(C)
|
:0047616A 8B55FC                  mov edx, dword ptr [ebp-04]
:0047616D 8B4208                  mov eax, dword ptr [edx+08]
:00476170 8BE5                    mov esp, ebp
:00476172 5D                      pop ebp
:00476173 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0042B606   , :0044EC0D   , :0044F01E   , :0044F0FA   
|
:00476176 55                      push ebp
:00476177 8BEC                    mov ebp, esp
:00476179 51                      push ecx
:0047617A 894DFC                  mov dword ptr [ebp-04], ecx
:0047617D 8B45FC                  mov eax, dword ptr [ebp-04]
:00476180 8B4808                  mov ecx, dword ptr [eax+08]
:00476183 51                      push ecx
:00476184 FF1548634800            call dword ptr [00486348]
:0047618A 85C0                    test eax, eax
:0047618C 7445                    je 004761D3
:0047618E 8B55FC                  mov edx, dword ptr [ebp-04]
:00476191 8B4208                  mov eax, dword ptr [edx+08]
:00476194 50                      push eax
:00476195 FF1530634800            call dword ptr [00486330]
:0047619B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047619E 51                      push ecx
:0047619F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004761A2 83C118                  add ecx, 00000018
:004761A5 E882C9FEFF              call 00462B2C
:004761AA 8B5508                  mov edx, dword ptr [ebp+08]
:004761AD 52                      push edx
:004761AE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004761B1 83C14C                  add ecx, 0000004C
:004761B4 E873C9FEFF              call 00462B2C
:004761B9 8B4508                  mov eax, dword ptr [ebp+08]
:004761BC 50                      push eax
:004761BD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004761C0 81C180000000            add ecx, 00000080
:004761C6 E861C9FEFF              call 00462B2C
:004761CB 6A00                    push 00000000
:004761CD FF1530634800            call dword ptr [00486330]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047618C(C)
|
:004761D3 8BE5                    mov esp, ebp
:004761D5 5D                      pop ebp
:004761D6 C20400                  ret 0004



* Referenced by a CALL at Address:
|:00476483   
|
:004761D9 55                      push ebp
:004761DA 8BEC                    mov ebp, esp
:004761DC 8B4508                  mov eax, dword ptr [ebp+08]
:004761DF 50                      push eax
:004761E0 B9C06B4B00              mov ecx, 004B6BC0
:004761E5 E879FEFFFF              call 00476063
:004761EA A38C6A4B00              mov dword ptr [004B6A8C], eax
:004761EF 833D8C6A4B0000          cmp dword ptr [004B6A8C], 00000000
:004761F6 7504                    jne 004761FC
:004761F8 33C0                    xor eax, eax
:004761FA EB05                    jmp 00476201

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004761F6(C)
|
:004761FC B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004761FA(U)
|
:00476201 5D                      pop ebp
:00476202 C3                      ret



* Referenced by a CALL at Addresses:
|:004764DA   , :004768A1   
|
:00476203 55                      push ebp
:00476204 8BEC                    mov ebp, esp
:00476206 8B4508                  mov eax, dword ptr [ebp+08]
:00476209 50                      push eax
:0047620A B9986A4B00              mov ecx, 004B6A98
:0047620F E80DFBFFFF              call 00475D21
:00476214 A38C6A4B00              mov dword ptr [004B6A8C], eax
:00476219 833D8C6A4B0000          cmp dword ptr [004B6A8C], 00000000
:00476220 7504                    jne 00476226
:00476222 33C0                    xor eax, eax
:00476224 EB05                    jmp 0047622B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00476220(C)
|
:00476226 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00476224(U)
|
:0047622B 5D                      pop ebp
:0047622C C3                      ret



* Referenced by a CALL at Address:
|:00449EB9   
|
:0047622D 55                      push ebp
:0047622E 8BEC                    mov ebp, esp
:00476230 51                      push ecx
:00476231 A108694800              mov eax, dword ptr [00486908]
:00476236 99                      cdq
:00476237 2BC2                    sub eax, edx
:00476239 D1F8                    sar eax, 1
:0047623B 99                      cdq
:0047623C 83E207                  and edx, 00000007
:0047623F 03C2                    add eax, edx
:00476241 C1F803                  sar eax, 03
:00476244 8945FC                  mov dword ptr [ebp-04], eax
:00476247 6A12                    push 00000012
:00476249 E895680000              call 0047CAE3
:0047624E 83C404                  add esp, 00000004
:00476251 E88583FAFF              call 0041E5DB

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:00476256 6A07                    push 00000007
:00476258 E86D6F0000              call 0047D1CA
:0047625D 83C404                  add esp, 00000004
:00476260 6A04                    push 00000004
:00476262 6A00                    push 00000000
:00476264 68C0B40100              push 0001B4C0
:00476269 B950EB4A00              mov ecx, 004AEB50
:0047626E E8CD970000              call 0047FA40
:00476273 50                      push eax
:00476274 6A12                    push 00000012
:00476276 6A08                    push 00000008
:00476278 E810710000              call 0047D38D
:0047627D 83C40C                  add esp, 0000000C
:00476280 6A02                    push 00000002
:00476282 A10C694800              mov eax, dword ptr [0048690C]
:00476287 83E801                  sub eax, 00000001
:0047628A 50                      push eax
:0047628B 8B0D08694800            mov ecx, dword ptr [00486908]
:00476291 83E901                  sub ecx, 00000001
:00476294 51                      push ecx
:00476295 6A00                    push 00000000
:00476297 6A00                    push 00000000
:00476299 E825790000              call 0047DBC3
:0047629E 83C414                  add esp, 00000014
:004762A1 6A00                    push 00000000
:004762A3 6A1F                    push 0000001F
:004762A5 6A04                    push 00000004
:004762A7 E8456F0000              call 0047D1F1
:004762AC 83C40C                  add esp, 0000000C
:004762AF 8B5508                  mov edx, dword ptr [ebp+08]
:004762B2 52                      push edx
:004762B3 E8A2990000              call 0047FC5A
:004762B8 83C404                  add esp, 00000004
:004762BB D1E8                    shr eax, 1
:004762BD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004762C0 2BC8                    sub ecx, eax
:004762C2 894DFC                  mov dword ptr [ebp-04], ecx
:004762C5 6A04                    push 00000004
:004762C7 B9382F4900              mov ecx, 00492F38
:004762CC E8658AF9FF              call 0040ED36
:004762D1 6A01                    push 00000001
:004762D3 8B55FC                  mov edx, dword ptr [ebp-04]
:004762D6 52                      push edx
:004762D7 B9382F4900              mov ecx, 00492F38
:004762DC E8F688F9FF              call 0040EBD7
:004762E1 6A12                    push 00000012
:004762E3 B9382F4900              mov ecx, 00492F38
:004762E8 E89789F9FF              call 0040EC84
:004762ED 6A00                    push 00000000
:004762EF B9382F4900              mov ecx, 00492F38
:004762F4 E8C389F9FF              call 0040ECBC
:004762F9 8B4508                  mov eax, dword ptr [ebp+08]
:004762FC 50                      push eax
:004762FD 68382F4900              push 00492F38
:00476302 E89997F9FF              call 0040FAA0
:00476307 83C408                  add esp, 00000008
:0047630A E8E782FAFF              call 0041E5F6
:0047630F 6A00                    push 00000000
:00476311 E8CD670000              call 0047CAE3
:00476316 83C404                  add esp, 00000004
:00476319 8BE5                    mov esp, ebp
:0047631B 5D                      pop ebp
:0047631C C3                      ret



* Referenced by a CALL at Address:
|:00449EE4   
|
:0047631D 55                      push ebp
:0047631E 8BEC                    mov ebp, esp
:00476320 83EC24                  sub esp, 00000024
:00476323 8B450C                  mov eax, dword ptr [ebp+0C]
:00476326 25FF000000              and eax, 000000FF
:0047632B 50                      push eax
:0047632C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047632F 81E1FF000000            and ecx, 000000FF
:00476335 51                      push ecx

* Possible StringData Ref from Data Obj ->"غ  %3d/%2d"
                                  |
:00476336 68B0EB4800              push 0048EBB0
:0047633B 8D55E0                  lea edx, dword ptr [ebp-20]
:0047633E 52                      push edx
:0047633F FF15C0624800            call dword ptr [004862C0]
:00476345 83C410                  add esp, 00000010
:00476348 8B450C                  mov eax, dword ptr [ebp+0C]
:0047634B 25FF000000              and eax, 000000FF
:00476350 50                      push eax
:00476351 6880000000              push 00000080
:00476356 8B4D08                  mov ecx, dword ptr [ebp+08]
:00476359 81E1FF000000            and ecx, 000000FF
:0047635F 51                      push ecx
:00476360 FF15E8604800            call dword ptr [004860E8]
:00476366 8945DC                  mov dword ptr [ebp-24], eax
:00476369 6A13                    push 00000013
:0047636B E873670000              call 0047CAE3
:00476370 83C404                  add esp, 00000004
:00476373 E86382FAFF              call 0041E5DB

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:00476378 6A07                    push 00000007
:0047637A E84B6E0000              call 0047D1CA
:0047637F 83C404                  add esp, 00000004
:00476382 6A04                    push 00000004
:00476384 6A00                    push 00000000
:00476386 68C0B40100              push 0001B4C0
:0047638B B950EB4A00              mov ecx, 004AEB50
:00476390 E8AB960000              call 0047FA40
:00476395 50                      push eax
:00476396 6A12                    push 00000012
:00476398 6A08                    push 00000008
:0047639A E8EE6F0000              call 0047D38D
:0047639F 83C40C                  add esp, 0000000C
:004763A2 6A02                    push 00000002
:004763A4 8B151C694800            mov edx, dword ptr [0048691C]
:004763AA 83EA01                  sub edx, 00000001
:004763AD 52                      push edx
:004763AE 6A7F                    push 0000007F
:004763B0 6A00                    push 00000000
:004763B2 6A00                    push 00000000
:004763B4 E80A780000              call 0047DBC3
:004763B9 83C414                  add esp, 00000014
:004763BC 6A04                    push 00000004
:004763BE 6A00                    push 00000000
:004763C0 6850B50100              push 0001B550
:004763C5 B950EB4A00              mov ecx, 004AEB50
:004763CA E871960000              call 0047FA40
:004763CF 50                      push eax
:004763D0 6A12                    push 00000012
:004763D2 6A08                    push 00000008
:004763D4 E8B46F0000              call 0047D38D
:004763D9 83C40C                  add esp, 0000000C
:004763DC 6A02                    push 00000002
:004763DE A11C694800              mov eax, dword ptr [0048691C]
:004763E3 83E801                  sub eax, 00000001
:004763E6 50                      push eax
:004763E7 8B4DDC                  mov ecx, dword ptr [ebp-24]
:004763EA 83E901                  sub ecx, 00000001
:004763ED 51                      push ecx
:004763EE 6A00                    push 00000000
:004763F0 6A00                    push 00000000
:004763F2 E8CC770000              call 0047DBC3
:004763F7 83C414                  add esp, 00000014
:004763FA 6A00                    push 00000000
:004763FC 6A1F                    push 0000001F
:004763FE 6A04                    push 00000004
:00476400 E8EC6D0000              call 0047D1F1
:00476405 83C40C                  add esp, 0000000C
:00476408 6A04                    push 00000004
:0047640A B9382F4900              mov ecx, 00492F38
:0047640F E82289F9FF              call 0040ED36
:00476414 6A01                    push 00000001
:00476416 6A01                    push 00000001
:00476418 B9382F4900              mov ecx, 00492F38
:0047641D E8B587F9FF              call 0040EBD7
:00476422 6A12                    push 00000012
:00476424 B9382F4900              mov ecx, 00492F38
:00476429 E85688F9FF              call 0040EC84
:0047642E 6A00                    push 00000000
:00476430 B9382F4900              mov ecx, 00492F38
:00476435 E88288F9FF              call 0040ECBC
:0047643A 8D55E0                  lea edx, dword ptr [ebp-20]
:0047643D 52                      push edx
:0047643E 68382F4900              push 00492F38
:00476443 E85896F9FF              call 0040FAA0
:00476448 83C408                  add esp, 00000008
:0047644B E8A681FAFF              call 0041E5F6
:00476450 6A00                    push 00000000
:00476452 E88C660000              call 0047CAE3
:00476457 83C404                  add esp, 00000004
:0047645A 8BE5                    mov esp, ebp
:0047645C 5D                      pop ebp
:0047645D C3                      ret



* Referenced by a CALL at Address:
|:00479BEA   
|
:0047645E 55                      push ebp
:0047645F 8BEC                    mov ebp, esp
:00476461 6A00                    push 00000000
:00476463 A18C6A4B00              mov eax, dword ptr [004B6A8C]
:00476468 50                      push eax
:00476469 FF15E0624800            call dword ptr [004862E0]
:0047646F 8B0D8C6A4B00            mov ecx, dword ptr [004B6A8C]
:00476475 51                      push ecx
:00476476 FF1554624800            call dword ptr [00486254]
:0047647C 8B15686A4B00            mov edx, dword ptr [004B6A68]
:00476482 52                      push edx
:00476483 E851FDFFFF              call 004761D9
:00476488 83C404                  add esp, 00000004
:0047648B 6A00                    push 00000000
:0047648D 6A00                    push 00000000
:0047648F 6A05                    push 00000005
:00476491 A18C6A4B00              mov eax, dword ptr [004B6A8C]
:00476496 50                      push eax
:00476497 FF15F4624800            call dword ptr [004862F4]
:0047649D 6A05                    push 00000005
:0047649F 8B0D8C6A4B00            mov ecx, dword ptr [004B6A8C]
:004764A5 51                      push ecx
:004764A6 FF15E0624800            call dword ptr [004862E0]
:004764AC 6A00                    push 00000000
:004764AE E809F5FFFF              call 004759BC
:004764B3 83C404                  add esp, 00000004
:004764B6 5D                      pop ebp
:004764B7 C3                      ret



* Referenced by a CALL at Addresses:
|:0042B62D   , :0042C125   , :0044ED3C   , :0044F02D   
|
:004764B8 55                      push ebp
:004764B9 8BEC                    mov ebp, esp
:004764BB 6A00                    push 00000000
:004764BD A18C6A4B00              mov eax, dword ptr [004B6A8C]
:004764C2 50                      push eax
:004764C3 FF15E0624800            call dword ptr [004862E0]
:004764C9 B9C06B4B00              mov ecx, 004B6BC0
:004764CE E87CD1FEFF              call 0046364F
:004764D3 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:004764D9 51                      push ecx
:004764DA E824FDFFFF              call 00476203
:004764DF 83C404                  add esp, 00000004
:004764E2 6A00                    push 00000000
:004764E4 6A00                    push 00000000
:004764E6 6A05                    push 00000005
:004764E8 8B158C6A4B00            mov edx, dword ptr [004B6A8C]
:004764EE 52                      push edx
:004764EF FF15F4624800            call dword ptr [004862F4]
:004764F5 6A05                    push 00000005
:004764F7 A18C6A4B00              mov eax, dword ptr [004B6A8C]
:004764FC 50                      push eax
:004764FD FF15E0624800            call dword ptr [004862E0]
:00476503 6A00                    push 00000000
:00476505 E8B2F4FFFF              call 004759BC
:0047650A 83C404                  add esp, 00000004
:0047650D 5D                      pop ebp
:0047650E C3                      ret



* Referenced by a CALL at Addresses:
|:0040BB60   , :0041B133   , :0042A27F   , :00476878   
|
:0047650F 55                      push ebp
:00476510 8BEC                    mov ebp, esp
:00476512 51                      push ecx
:00476513 56                      push esi
:00476514 E80954F9FF              call 0040B922
:00476519 85C0                    test eax, eax
:0047651B 0F85EC000000            jne 0047660D
:00476521 A108694800              mov eax, dword ptr [00486908]
:00476526 99                      cdq
:00476527 83E207                  and edx, 00000007
:0047652A 03C2                    add eax, edx
:0047652C 8BF0                    mov esi, eax
:0047652E C1FE03                  sar esi, 03
:00476531 8B4508                  mov eax, dword ptr [ebp+08]
:00476534 50                      push eax
:00476535 E820970000              call 0047FC5A
:0047653A 83C404                  add esp, 00000004
:0047653D 2BF0                    sub esi, eax
:0047653F D1EE                    shr esi, 1
:00476541 8975FC                  mov dword ptr [ebp-04], esi
:00476544 6A12                    push 00000012
:00476546 E898650000              call 0047CAE3
:0047654B 83C404                  add esp, 00000004
:0047654E E88880FAFF              call 0041E5DB

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:00476553 6A07                    push 00000007
:00476555 E8706C0000              call 0047D1CA
:0047655A 83C404                  add esp, 00000004
:0047655D 6A04                    push 00000004
:0047655F 6A00                    push 00000000
:00476561 68C0B40100              push 0001B4C0
:00476566 B950EB4A00              mov ecx, 004AEB50
:0047656B E8D0940000              call 0047FA40
:00476570 50                      push eax
:00476571 6A12                    push 00000012
:00476573 6A08                    push 00000008
:00476575 E8136E0000              call 0047D38D
:0047657A 83C40C                  add esp, 0000000C
:0047657D 6A02                    push 00000002
:0047657F 8B0D0C694800            mov ecx, dword ptr [0048690C]
:00476585 83E901                  sub ecx, 00000001
:00476588 51                      push ecx
:00476589 8B1508694800            mov edx, dword ptr [00486908]
:0047658F 83EA01                  sub edx, 00000001
:00476592 52                      push edx
:00476593 6A00                    push 00000000
:00476595 6A00                    push 00000000
:00476597 E827760000              call 0047DBC3
:0047659C 83C414                  add esp, 00000014
:0047659F 6A00                    push 00000000
:004765A1 6A1F                    push 0000001F
:004765A3 6A04                    push 00000004
:004765A5 E8476C0000              call 0047D1F1
:004765AA 83C40C                  add esp, 0000000C
:004765AD 6A04                    push 00000004
:004765AF B9382F4900              mov ecx, 00492F38
:004765B4 E87D87F9FF              call 0040ED36
:004765B9 6A01                    push 00000001
:004765BB 8B45FC                  mov eax, dword ptr [ebp-04]
:004765BE 50                      push eax
:004765BF B9382F4900              mov ecx, 00492F38
:004765C4 E80E86F9FF              call 0040EBD7
:004765C9 6A12                    push 00000012
:004765CB B9382F4900              mov ecx, 00492F38
:004765D0 E8AF86F9FF              call 0040EC84
:004765D5 6A00                    push 00000000
:004765D7 B9382F4900              mov ecx, 00492F38
:004765DC E8DB86F9FF              call 0040ECBC
:004765E1 8B4D08                  mov ecx, dword ptr [ebp+08]
:004765E4 51                      push ecx
:004765E5 68382F4900              push 00492F38
:004765EA E8B194F9FF              call 0040FAA0
:004765EF 83C408                  add esp, 00000008
:004765F2 E8FF7FFAFF              call 0041E5F6
:004765F7 6A00                    push 00000000
:004765F9 E8E5640000              call 0047CAE3
:004765FE 83C404                  add esp, 00000004
:00476601 6A00                    push 00000000
:00476603 B9986A4B00              mov ecx, 004B6A98
:00476608 E8BAF9FFFF              call 00475FC7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047651B(C)
|
:0047660D 5E                      pop esi
:0047660E 8BE5                    mov esp, ebp
:00476610 5D                      pop ebp
:00476611 C3                      ret



* Referenced by a CALL at Addresses:
|:0040BB90   , :0042A28C   , :0047688A   
|
:00476612 55                      push ebp
:00476613 8BEC                    mov ebp, esp
:00476615 51                      push ecx
:00476616 56                      push esi
:00476617 E80653F9FF              call 0040B922
:0047661C 85C0                    test eax, eax
:0047661E 0F85EC000000            jne 00476710
:00476624 A118694800              mov eax, dword ptr [00486918]
:00476629 99                      cdq
:0047662A 83E207                  and edx, 00000007
:0047662D 03C2                    add eax, edx
:0047662F 8BF0                    mov esi, eax
:00476631 C1FE03                  sar esi, 03
:00476634 8B4508                  mov eax, dword ptr [ebp+08]
:00476637 50                      push eax
:00476638 E81D960000              call 0047FC5A
:0047663D 83C404                  add esp, 00000004
:00476640 2BF0                    sub esi, eax
:00476642 D1EE                    shr esi, 1
:00476644 8975FC                  mov dword ptr [ebp-04], esi
:00476647 6A13                    push 00000013
:00476649 E895640000              call 0047CAE3
:0047664E 83C404                  add esp, 00000004
:00476651 E8857FFAFF              call 0041E5DB

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:00476656 6A07                    push 00000007
:00476658 E86D6B0000              call 0047D1CA
:0047665D 83C404                  add esp, 00000004
:00476660 6A04                    push 00000004
:00476662 6A00                    push 00000000
:00476664 68C0B40100              push 0001B4C0
:00476669 B950EB4A00              mov ecx, 004AEB50
:0047666E E8CD930000              call 0047FA40
:00476673 50                      push eax
:00476674 6A12                    push 00000012
:00476676 6A08                    push 00000008
:00476678 E8106D0000              call 0047D38D
:0047667D 83C40C                  add esp, 0000000C
:00476680 6A02                    push 00000002
:00476682 8B0D0C694800            mov ecx, dword ptr [0048690C]
:00476688 83E901                  sub ecx, 00000001
:0047668B 51                      push ecx
:0047668C 8B1518694800            mov edx, dword ptr [00486918]
:00476692 83EA01                  sub edx, 00000001
:00476695 52                      push edx
:00476696 6A00                    push 00000000
:00476698 6A00                    push 00000000
:0047669A E824750000              call 0047DBC3
:0047669F 83C414                  add esp, 00000014
:004766A2 6A00                    push 00000000
:004766A4 6A1F                    push 0000001F
:004766A6 6A04                    push 00000004
:004766A8 E8446B0000              call 0047D1F1
:004766AD 83C40C                  add esp, 0000000C
:004766B0 6A04                    push 00000004
:004766B2 B9382F4900              mov ecx, 00492F38
:004766B7 E87A86F9FF              call 0040ED36
:004766BC 6A01                    push 00000001
:004766BE 8B45FC                  mov eax, dword ptr [ebp-04]
:004766C1 50                      push eax
:004766C2 B9382F4900              mov ecx, 00492F38
:004766C7 E80B85F9FF              call 0040EBD7
:004766CC 6A12                    push 00000012
:004766CE B9382F4900              mov ecx, 00492F38
:004766D3 E8AC85F9FF              call 0040EC84
:004766D8 6A00                    push 00000000
:004766DA B9382F4900              mov ecx, 00492F38
:004766DF E8D885F9FF              call 0040ECBC
:004766E4 8B4D08                  mov ecx, dword ptr [ebp+08]
:004766E7 51                      push ecx
:004766E8 68382F4900              push 00492F38
:004766ED E8AE93F9FF              call 0040FAA0
:004766F2 83C408                  add esp, 00000008
:004766F5 E8FC7EFAFF              call 0041E5F6
:004766FA 6A00                    push 00000000
:004766FC E8E2630000              call 0047CAE3
:00476701 83C404                  add esp, 00000004
:00476704 6A01                    push 00000001
:00476706 B9986A4B00              mov ecx, 004B6A98
:0047670B E8B7F8FFFF              call 00475FC7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047661E(C)
|
:00476710 5E                      pop esi
:00476711 8BE5                    mov esp, ebp
:00476713 5D                      pop ebp
:00476714 C3                      ret



* Referenced by a CALL at Addresses:
|:0040D32C   , :0040D381   , :0040D425   , :0040D47A   , :0042C292   
|
:00476715 55                      push ebp
:00476716 8BEC                    mov ebp, esp
:00476718 51                      push ecx
:00476719 E80452F9FF              call 0040B922
:0047671E 85C0                    test eax, eax
:00476720 0F8546010000            jne 0047686C
:00476726 8B4508                  mov eax, dword ptr [ebp+08]
:00476729 25FF000000              and eax, 000000FF
:0047672E 6BC064                  imul eax, 00000064
:00476731 99                      cdq
:00476732 B964000000              mov ecx, 00000064
:00476737 F7F9                    idiv ecx
:00476739 69C0C8000000            imul eax, 000000C8
:0047673F 99                      cdq
:00476740 B964000000              mov ecx, 00000064
:00476745 F7F9                    idiv ecx
:00476747 8945FC                  mov dword ptr [ebp-04], eax
:0047674A 837DFC01                cmp dword ptr [ebp-04], 00000001
:0047674E 7307                    jnb 00476757
:00476750 C745FC01000000          mov [ebp-04], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047674E(C)
|
:00476757 6A04                    push 00000004
:00476759 E885630000              call 0047CAE3
:0047675E 83C404                  add esp, 00000004
:00476761 E8757EFAFF              call 0041E5DB

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:00476766 6A07                    push 00000007
:00476768 E85D6A0000              call 0047D1CA
:0047676D 83C404                  add esp, 00000004
:00476770 6A00                    push 00000000
:00476772 6A1F                    push 0000001F
:00476774 6A04                    push 00000004
:00476776 E8766A0000              call 0047D1F1
:0047677B 83C40C                  add esp, 0000000C
:0047677E 8B5508                  mov edx, dword ptr [ebp+08]
:00476781 81E2FF000000            and edx, 000000FF
:00476787 83FA0F                  cmp edx, 0000000F
:0047678A 7F1F                    jg 004767AB
:0047678C 6A04                    push 00000004
:0047678E 6A00                    push 00000000
:00476790 6A40                    push 00000040
:00476792 B950EB4A00              mov ecx, 004AEB50
:00476797 E8A4920000              call 0047FA40
:0047679C 50                      push eax
:0047679D 6A08                    push 00000008
:0047679F 6A08                    push 00000008
:004767A1 E8E76B0000              call 0047D38D
:004767A6 83C40C                  add esp, 0000000C
:004767A9 EB1D                    jmp 004767C8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047678A(C)
|
:004767AB 6A04                    push 00000004
:004767AD 6A00                    push 00000000
:004767AF 6A00                    push 00000000
:004767B1 B950EB4A00              mov ecx, 004AEB50
:004767B6 E885920000              call 0047FA40
:004767BB 50                      push eax
:004767BC 6A08                    push 00000008
:004767BE 6A08                    push 00000008
:004767C0 E8C86B0000              call 0047D38D
:004767C5 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004767A9(U)
|
:004767C8 6A02                    push 00000002

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:004767CA 6A07                    push 00000007
:004767CC 8B45FC                  mov eax, dword ptr [ebp-04]
:004767CF 83E801                  sub eax, 00000001
:004767D2 50                      push eax
:004767D3 6A00                    push 00000000
:004767D5 6A00                    push 00000000
:004767D7 E8E7730000              call 0047DBC3
:004767DC 83C414                  add esp, 00000014
:004767DF 8B4D08                  mov ecx, dword ptr [ebp+08]
:004767E2 81E1FF000000            and ecx, 000000FF
:004767E8 83F955                  cmp ecx, 00000055
:004767EB 7C1F                    jl 0047680C
:004767ED 6A04                    push 00000004
:004767EF 6A00                    push 00000000
:004767F1 6A40                    push 00000040
:004767F3 B950EB4A00              mov ecx, 004AEB50
:004767F8 E843920000              call 0047FA40
:004767FD 50                      push eax
:004767FE 6A08                    push 00000008
:00476800 6A08                    push 00000008
:00476802 E8866B0000              call 0047D38D
:00476807 83C40C                  add esp, 0000000C
:0047680A EB20                    jmp 0047682C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004767EB(C)
|
:0047680C 6A04                    push 00000004
:0047680E 6A00                    push 00000000
:00476810 68C0000000              push 000000C0
:00476815 B950EB4A00              mov ecx, 004AEB50
:0047681A E821920000              call 0047FA40
:0047681F 50                      push eax
:00476820 6A08                    push 00000008
:00476822 6A08                    push 00000008
:00476824 E8646B0000              call 0047D38D
:00476829 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047680A(U)
|
:0047682C 6A02                    push 00000002

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0047682E 6A07                    push 00000007
:00476830 68C7000000              push 000000C7
:00476835 6A00                    push 00000000
:00476837 8B55FC                  mov edx, dword ptr [ebp-04]
:0047683A 52                      push edx
:0047683B E883730000              call 0047DBC3
:00476840 83C414                  add esp, 00000014
:00476843 6A00                    push 00000000
:00476845 6A1F                    push 0000001F
:00476847 6A04                    push 00000004
:00476849 E8A3690000              call 0047D1F1
:0047684E 83C40C                  add esp, 0000000C
:00476851 E8A07DFAFF              call 0041E5F6
:00476856 6A00                    push 00000000
:00476858 E886620000              call 0047CAE3
:0047685D 83C404                  add esp, 00000004
:00476860 6A02                    push 00000002
:00476862 B9986A4B00              mov ecx, 004B6A98
:00476867 E85BF7FFFF              call 00475FC7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00476720(C)
|
:0047686C 8BE5                    mov esp, ebp
:0047686E 5D                      pop ebp
:0047686F C3                      ret



* Referenced by a CALL at Addresses:
|:0040B989   , :0042B7C9   , :0042C282   
|
:00476870 55                      push ebp
:00476871 8BEC                    mov ebp, esp
:00476873 6814754B00              push 004B7514
:00476878 E892FCFFFF              call 0047650F
:0047687D 83C404                  add esp, 00000004
:00476880 5D                      pop ebp
:00476881 C3                      ret



* Referenced by a CALL at Addresses:
|:0040B98E   , :0042B7CE   , :0042C29A   , :00454700   
|
:00476882 55                      push ebp
:00476883 8BEC                    mov ebp, esp
:00476885 6818754B00              push 004B7518
:0047688A E883FDFFFF              call 00476612
:0047688F 83C404                  add esp, 00000004
:00476892 5D                      pop ebp
:00476893 C3                      ret



* Referenced by a CALL at Address:
|:0047557C   
|
:00476894 55                      push ebp
:00476895 8BEC                    mov ebp, esp
:00476897 FF1520604800            call dword ptr [00486020]
:0047689D 8B4508                  mov eax, dword ptr [ebp+08]
:004768A0 50                      push eax
:004768A1 E85DF9FFFF              call 00476203
:004768A6 83C404                  add esp, 00000004
:004768A9 85C0                    test eax, eax
:004768AB 7505                    jne 004768B2
:004768AD 83C8FF                  or eax, FFFFFFFF
:004768B0 EB0C                    jmp 004768BE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004768AB(C)
|
:004768B2 6A00                    push 00000000
:004768B4 E803F1FFFF              call 004759BC
:004768B9 83C404                  add esp, 00000004
:004768BC 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004768B0(U)
|
:004768BE 5D                      pop ebp
:004768BF C3                      ret



* Referenced by a CALL at Addresses:
|:00419EB2   , :0045E9FA   , :00479D38   
|
:004768C0 55                      push ebp
:004768C1 8BEC                    mov ebp, esp
:004768C3 83EC08                  sub esp, 00000008
:004768C6 C745FC00000000          mov [ebp-04], 00000000
:004768CD 6800080000              push 00000800
:004768D2 68FFFF0000              push 0000FFFF
:004768D7 68F06C4B00              push 004B6CF0
:004768DC E84FA20000              call 00480B30
:004768E1 83C40C                  add esp, 0000000C
:004768E4 C745F800000000          mov [ebp-08], 00000000
:004768EB EB09                    jmp 004768F6

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047690F(U), :00476927(U)
|
:004768ED 8B45F8                  mov eax, dword ptr [ebp-08]
:004768F0 83C001                  add eax, 00000001
:004768F3 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004768EB(U)
|
:004768F6 817DF8AE000000          cmp dword ptr [ebp-08], 000000AE
:004768FD 732A                    jnb 00476929
:004768FF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00476902 51                      push ecx
:00476903 E88838FAFF              call 0041A190
:00476908 83C404                  add esp, 00000004
:0047690B 85C0                    test eax, eax
:0047690D 7502                    jne 00476911
:0047690F EBDC                    jmp 004768ED

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047690D(C)
|
:00476911 8B55FC                  mov edx, dword ptr [ebp-04]
:00476914 8B45F8                  mov eax, dword ptr [ebp-08]
:00476917 890495F06C4B00          mov dword ptr [4*edx+004B6CF0], eax
:0047691E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00476921 83C101                  add ecx, 00000001
:00476924 894DFC                  mov dword ptr [ebp-04], ecx
:00476927 EBC4                    jmp 004768ED

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004768FD(C)
|
:00476929 8B45FC                  mov eax, dword ptr [ebp-04]
:0047692C 8BE5                    mov esp, ebp
:0047692E 5D                      pop ebp
:0047692F C3                      ret


:00476930 55                      push ebp
:00476931 8BEC                    mov ebp, esp
:00476933 51                      push ecx
:00476934 8B450C                  mov eax, dword ptr [ebp+0C]
:00476937 25FFFF0000              and eax, 0000FFFF
:0047693C 50                      push eax
:0047693D 8B4D08                  mov ecx, dword ptr [ebp+08]
:00476940 51                      push ecx
:00476941 FF15DC624800            call dword ptr [004862DC]
:00476947 8945FC                  mov dword ptr [ebp-04], eax
:0047694A 8B5514                  mov edx, dword ptr [ebp+14]
:0047694D 81E2FFFF0000            and edx, 0000FFFF
:00476953 C1E210                  shl edx, 10
:00476956 52                      push edx
:00476957 6A00                    push 00000000
:00476959 6801040000              push 00000401
:0047695E 8B45FC                  mov eax, dword ptr [ebp-04]
:00476961 50                      push eax
:00476962 FF15F4624800            call dword ptr [004862F4]
:00476968 6A00                    push 00000000
:0047696A 8B4D10                  mov ecx, dword ptr [ebp+10]
:0047696D 81E1FFFF0000            and ecx, 0000FFFF
:00476973 51                      push ecx
:00476974 6802040000              push 00000402
:00476979 8B55FC                  mov edx, dword ptr [ebp-04]
:0047697C 52                      push edx
:0047697D FF15F4624800            call dword ptr [004862F4]
:00476983 8BE5                    mov esp, ebp
:00476985 5D                      pop ebp
:00476986 C3                      ret



* Referenced by a CALL at Addresses:
|:00476B20   , :0047892F   
|
:00476987 55                      push ebp
:00476988 8BEC                    mov ebp, esp
:0047698A 83EC14                  sub esp, 00000014
:0047698D 894DEC                  mov dword ptr [ebp-14], ecx

* Possible Reference to Dialog: DialogID_00B2, CONTROL_ID:0566, ""
                                  |
:00476990 6866050000              push 00000566
:00476995 8B4508                  mov eax, dword ptr [ebp+08]
:00476998 50                      push eax
:00476999 FF15DC624800            call dword ptr [004862DC]
:0047699F 85C0                    test eax, eax
:004769A1 7505                    jne 004769A8
:004769A3 E9CB000000              jmp 00476A73

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004769A1(C)
|
:004769A8 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004769AB E82C110000              call 00477ADC
:004769B0 8845FC                  mov byte ptr [ebp-04], al
:004769B3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004769B6 81E1FF000000            and ecx, 000000FF
:004769BC 81F9FF000000            cmp ecx, 000000FF
:004769C2 7521                    jne 004769E5
:004769C4 6A00                    push 00000000
:004769C6 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004769C9 E8AD08F9FF              call 0040727B
:004769CE 25FF000000              and eax, 000000FF
:004769D3 50                      push eax

* Possible Reference to Dialog: DialogID_00B2, CONTROL_ID:03F0, "99"
                                  |
:004769D4 68F0030000              push 000003F0
:004769D9 8B5508                  mov edx, dword ptr [ebp+08]
:004769DC 52                      push edx
:004769DD FF15E4624800            call dword ptr [004862E4]
:004769E3 EB79                    jmp 00476A5E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004769C2(C)
|
:004769E5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004769E8 81E1FF000000            and ecx, 000000FF
:004769EE 6BC924                  imul ecx, 00000024
:004769F1 81C1502C4B00            add ecx, 004B2C50
:004769F7 E834F1FAFF              call 00425B30
:004769FC 25FF000000              and eax, 000000FF
:00476A01 83F804                  cmp eax, 00000004
:00476A04 7C39                    jl 00476A3F
:00476A06 6A02                    push 00000002
:00476A08 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00476A0B E86B08F9FF              call 0040727B
:00476A10 25FF000000              and eax, 000000FF
:00476A15 83C002                  add eax, 00000002
:00476A18 50                      push eax

* Possible StringData Ref from Data Obj ->"%u ( +%d )"
                                  |
:00476A19 68C0EB4800              push 0048EBC0
:00476A1E 8D45F0                  lea eax, dword ptr [ebp-10]
:00476A21 50                      push eax
:00476A22 E8FB990000              call 00480422
:00476A27 83C410                  add esp, 00000010
:00476A2A 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00476A2D 51                      push ecx

* Possible Reference to Dialog: DialogID_00B2, CONTROL_ID:03F0, "99"
                                  |
:00476A2E 68F0030000              push 000003F0
:00476A33 8B5508                  mov edx, dword ptr [ebp+08]
:00476A36 52                      push edx
:00476A37 FF15D8624800            call dword ptr [004862D8]
:00476A3D EB1F                    jmp 00476A5E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00476A04(C)
|
:00476A3F 6A00                    push 00000000
:00476A41 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00476A44 E83208F9FF              call 0040727B
:00476A49 25FF000000              and eax, 000000FF
:00476A4E 50                      push eax

* Possible Reference to Dialog: DialogID_00B2, CONTROL_ID:03F0, "99"
                                  |
:00476A4F 68F0030000              push 000003F0
:00476A54 8B4508                  mov eax, dword ptr [ebp+08]
:00476A57 50                      push eax
:00476A58 FF15E4624800            call dword ptr [004862E4]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004769E3(U), :00476A3D(U)
|
:00476A5E 833DA8E9480000          cmp dword ptr [0048E9A8], 00000000
:00476A65 750C                    jne 00476A73
:00476A67 8B4D08                  mov ecx, dword ptr [ebp+08]
:00476A6A 51                      push ecx
:00476A6B E809000000              call 00476A79
:00476A70 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004769A3(U), :00476A65(C)
|
:00476A73 8BE5                    mov esp, ebp
:00476A75 5D                      pop ebp
:00476A76 C20400                  ret 0004



* Referenced by a CALL at Address:
|:00476A6B   
|
:00476A79 55                      push ebp
:00476A7A 8BEC                    mov ebp, esp
:00476A7C 83EC18                  sub esp, 00000018

* Possible Reference to Dialog: DialogID_00B2, CONTROL_ID:0566, ""
                                  |
:00476A7F C745E866050000          mov [ebp-18], 00000566

* Possible Reference to Dialog: DialogID_00B2, CONTROL_ID:0567, ""
                                  |
:00476A86 C745EC67050000          mov [ebp-14], 00000567

* Possible Reference to Dialog: DialogID_00B2, CONTROL_ID:0568, ""
                                  |
:00476A8D C745F068050000          mov [ebp-10], 00000568

* Possible Reference to Dialog: DialogID_00B2, CONTROL_ID:0569, ""
                                  |
:00476A94 C745F469050000          mov [ebp-0C], 00000569

* Possible Reference to Dialog: DialogID_00B2, CONTROL_ID:056A, ""
                                  |
:00476A9B C745F86A050000          mov [ebp-08], 0000056A
:00476AA2 C745FC00000000          mov [ebp-04], 00000000
:00476AA9 EB09                    jmp 00476AB4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00476AD9(U)
|
:00476AAB 8B45FC                  mov eax, dword ptr [ebp-04]
:00476AAE 83C001                  add eax, 00000001
:00476AB1 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00476AA9(U)
|
:00476AB4 837DFC05                cmp dword ptr [ebp-04], 00000005
:00476AB8 7D21                    jge 00476ADB
:00476ABA 6A01                    push 00000001
:00476ABC 6A00                    push 00000000
:00476ABE 6A00                    push 00000000
:00476AC0 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00476AC3 8B548DE8                mov edx, dword ptr [ebp+4*ecx-18]
:00476AC7 52                      push edx
:00476AC8 8B4508                  mov eax, dword ptr [ebp+08]
:00476ACB 50                      push eax
:00476ACC FF15DC624800            call dword ptr [004862DC]
:00476AD2 50                      push eax
:00476AD3 FF15B4624800            call dword ptr [004862B4]
:00476AD9 EBD0                    jmp 00476AAB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00476AB8(C)
|
:00476ADB 8BE5                    mov esp, ebp
:00476ADD 5D                      pop ebp
:00476ADE C3                      ret


:00476ADF 55                      push ebp
:00476AE0 8BEC                    mov ebp, esp
:00476AE2 51                      push ecx
:00476AE3 8B450C                  mov eax, dword ptr [ebp+0C]
:00476AE6 8945FC                  mov dword ptr [ebp-04], eax
:00476AE9 817DFC10010000          cmp dword ptr [ebp-04], 00000110
:00476AF0 7414                    je 00476B06
:00476AF2 817DFC36010000          cmp dword ptr [ebp-04], 00000136
:00476AF9 7468                    je 00476B63
:00476AFB 817DFC38010000          cmp dword ptr [ebp-04], 00000138
:00476B02 7423                    je 00476B27
:00476B04 EB73                    jmp 00476B79

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00476AF0(C)
|
:00476B06 8B4D08                  mov ecx, dword ptr [ebp+08]
:00476B09 51                      push ecx
:00476B0A 8B1504754B00            mov edx, dword ptr [004B7504]
:00476B10 8B0C95F06C4B00          mov ecx, dword ptr [4*edx+004B6CF0]
:00476B17 6BC948                  imul ecx, 00000048
:00476B1A 81C1681B4A00            add ecx, 004A1B68
:00476B20 E862FEFFFF              call 00476987
:00476B25 EB56                    jmp 00476B7D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00476B02(C)
|
:00476B27 6A00                    push 00000000
:00476B29 6A01                    push 00000001
:00476B2B 8B4514                  mov eax, dword ptr [ebp+14]
:00476B2E 50                      push eax
:00476B2F 8B4D10                  mov ecx, dword ptr [ebp+10]
:00476B32 51                      push ecx
:00476B33 E853AAFFFF              call 0047158B
:00476B38 83C410                  add esp, 00000010
:00476B3B 8B1504754B00            mov edx, dword ptr [004B7504]
:00476B41 8B0495F06C4B00          mov eax, dword ptr [4*edx+004B6CF0]
:00476B48 6BC048                  imul eax, 00000048
:00476B4B 05681B4A00              add eax, 004A1B68
:00476B50 50                      push eax
:00476B51 8B4D14                  mov ecx, dword ptr [ebp+14]
:00476B54 51                      push ecx
:00476B55 8B5510                  mov edx, dword ptr [ebp+10]
:00476B58 52                      push edx
:00476B59 E827000000              call 00476B85
:00476B5E 83C40C                  add esp, 0000000C
:00476B61 EB1A                    jmp 00476B7D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00476AF9(C)
|
:00476B63 6A00                    push 00000000
:00476B65 6A01                    push 00000001
:00476B67 8B4514                  mov eax, dword ptr [ebp+14]
:00476B6A 50                      push eax
:00476B6B 8B4D10                  mov ecx, dword ptr [ebp+10]
:00476B6E 51                      push ecx
:00476B6F E817A7FFFF              call 0047128B
:00476B74 83C410                  add esp, 00000010
:00476B77 EB04                    jmp 00476B7D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00476B04(U)
|
:00476B79 33C0                    xor eax, eax
:00476B7B EB02                    jmp 00476B7F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00476B25(U), :00476B61(U), :00476B77(U)
|
:00476B7D 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00476B7B(U)
|
:00476B7F 8BE5                    mov esp, ebp
:00476B81 5D                      pop ebp
:00476B82 C21000                  ret 0010



* Referenced by a CALL at Address:
|:00476B59   
|
:00476B85 55                      push ebp
:00476B86 8BEC                    mov ebp, esp
:00476B88 81EC88000000            sub esp, 00000088
:00476B8E 8B4D10                  mov ecx, dword ptr [ebp+10]
:00476B91 E8460F0000              call 00477ADC
:00476B96 8845C0                  mov byte ptr [ebp-40], al

* Possible Reference to Dialog: DialogID_00B2, CONTROL_ID:0566, ""
                                  |
:00476B99 C745C466050000          mov [ebp-3C], 00000566

* Possible Reference to Dialog: DialogID_00B2, CONTROL_ID:0567, ""
                                  |
:00476BA0 C745C867050000          mov [ebp-38], 00000567

* Possible Reference to Dialog: DialogID_00B2, CONTROL_ID:0568, ""
                                  |
:00476BA7 C745CC68050000          mov [ebp-34], 00000568

* Possible Reference to Dialog: DialogID_00B2, CONTROL_ID:0569, ""
                                  |
:00476BAE C745D069050000          mov [ebp-30], 00000569

* Possible Reference to Dialog: DialogID_00B2, CONTROL_ID:056A, ""
                                  |
:00476BB5 C745D46A050000          mov [ebp-2C], 0000056A
:00476BBC C645F003                mov [ebp-10], 03
:00476BC0 C645F103                mov [ebp-0F], 03
:00476BC4 C645F203                mov [ebp-0E], 03
:00476BC8 C645F303                mov [ebp-0D], 03
:00476BCC C645F403                mov [ebp-0C], 03
:00476BD0 C745D800000000          mov [ebp-28], 00000000
:00476BD7 C745DC00000000          mov [ebp-24], 00000000
:00476BDE C745E000000000          mov [ebp-20], 00000000
:00476BE5 C745E400000000          mov [ebp-1C], 00000000
:00476BEC C745E800000000          mov [ebp-18], 00000000
:00476BF3 8B4D10                  mov ecx, dword ptr [ebp+10]
:00476BF6 E82B05F9FF              call 00407126
:00476BFB 8945AC                  mov dword ptr [ebp-54], eax
:00476BFE 8B4D10                  mov ecx, dword ptr [ebp+10]
:00476C01 E88205F9FF              call 00407188
:00476C06 8945B0                  mov dword ptr [ebp-50], eax
:00476C09 8B4D10                  mov ecx, dword ptr [ebp+10]
:00476C0C E84605F9FF              call 00407157
:00476C11 8945B4                  mov dword ptr [ebp-4C], eax
:00476C14 8B4D10                  mov ecx, dword ptr [ebp+10]
:00476C17 E89D05F9FF              call 004071B9
:00476C1C 8945B8                  mov dword ptr [ebp-48], eax
:00476C1F 8B4D10                  mov ecx, dword ptr [ebp+10]
:00476C22 E8C305F9FF              call 004071EA
:00476C27 8945BC                  mov dword ptr [ebp-44], eax
:00476C2A 8B45C0                  mov eax, dword ptr [ebp-40]
:00476C2D 25FF000000              and eax, 000000FF
:00476C32 3DFF000000              cmp eax, 000000FF
:00476C37 0F8404010000            je 00476D41
:00476C3D 8B4DC0                  mov ecx, dword ptr [ebp-40]
:00476C40 81E1FF000000            and ecx, 000000FF
:00476C46 6BC924                  imul ecx, 00000024
:00476C49 81C1502C4B00            add ecx, 004B2C50
:00476C4F E83C73FAFF              call 0041DF90
:00476C54 8845F0                  mov byte ptr [ebp-10], al
:00476C57 8B4DC0                  mov ecx, dword ptr [ebp-40]
:00476C5A 81E1FF000000            and ecx, 000000FF
:00476C60 6BC924                  imul ecx, 00000024
:00476C63 81C1502C4B00            add ecx, 004B2C50
:00476C69 E86273FAFF              call 0041DFD0
:00476C6E 8845F1                  mov byte ptr [ebp-0F], al
:00476C71 8B4DC0                  mov ecx, dword ptr [ebp-40]
:00476C74 81E1FF000000            and ecx, 000000FF
:00476C7A 6BC924                  imul ecx, 00000024
:00476C7D 81C1502C4B00            add ecx, 004B2C50
:00476C83 E82873FAFF              call 0041DFB0
:00476C88 8845F2                  mov byte ptr [ebp-0E], al
:00476C8B 8B4DC0                  mov ecx, dword ptr [ebp-40]
:00476C8E 81E1FF000000            and ecx, 000000FF
:00476C94 6BC924                  imul ecx, 00000024
:00476C97 81C1502C4B00            add ecx, 004B2C50
:00476C9D E84E73FAFF              call 0041DFF0
:00476CA2 8845F3                  mov byte ptr [ebp-0D], al
:00476CA5 8B4DC0                  mov ecx, dword ptr [ebp-40]
:00476CA8 81E1FF000000            and ecx, 000000FF
:00476CAE 6BC924                  imul ecx, 00000024
:00476CB1 81C1502C4B00            add ecx, 004B2C50
:00476CB7 E85473FAFF              call 0041E010
:00476CBC 8845F4                  mov byte ptr [ebp-0C], al
:00476CBF 8B4DC0                  mov ecx, dword ptr [ebp-40]
:00476CC2 81E1FF000000            and ecx, 000000FF
:00476CC8 6BC924                  imul ecx, 00000024
:00476CCB 81C1502C4B00            add ecx, 004B2C50
:00476CD1 E82888FCFF              call 0043F4FE
:00476CD6 8945D8                  mov dword ptr [ebp-28], eax
:00476CD9 8B4DC0                  mov ecx, dword ptr [ebp-40]
:00476CDC 81E1FF000000            and ecx, 000000FF
:00476CE2 6BC924                  imul ecx, 00000024
:00476CE5 81C1502C4B00            add ecx, 004B2C50
:00476CEB E8F388FCFF              call 0043F5E3
:00476CF0 8945DC                  mov dword ptr [ebp-24], eax
:00476CF3 8B4DC0                  mov ecx, dword ptr [ebp-40]
:00476CF6 81E1FF000000            and ecx, 000000FF
:00476CFC 6BC924                  imul ecx, 00000024
:00476CFF 81C1502C4B00            add ecx, 004B2C50
:00476D05 E88B88FCFF              call 0043F595
:00476D0A 8945E0                  mov dword ptr [ebp-20], eax
:00476D0D 8B4DC0                  mov ecx, dword ptr [ebp-40]
:00476D10 81E1FF000000            and ecx, 000000FF
:00476D16 6BC924                  imul ecx, 00000024
:00476D19 81C1502C4B00            add ecx, 004B2C50
:00476D1F E80D89FCFF              call 0043F631
:00476D24 8945E4                  mov dword ptr [ebp-1C], eax
:00476D27 8B4DC0                  mov ecx, dword ptr [ebp-40]
:00476D2A 81E1FF000000            and ecx, 000000FF
:00476D30 6BC924                  imul ecx, 00000024
:00476D33 81C1502C4B00            add ecx, 004B2C50
:00476D39 E84189FCFF              call 0043F67F
:00476D3E 8945E8                  mov dword ptr [ebp-18], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00476C37(C)
|
:00476D41 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00476D44 51                      push ecx
:00476D45 FF1594634800            call dword ptr [00486394]
:00476D4B 8945FC                  mov dword ptr [ebp-04], eax
:00476D4E C745EC00000000          mov [ebp-14], 00000000
:00476D55 EB09                    jmp 00476D60

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00476E3B(U)
|
:00476D57 8B55EC                  mov edx, dword ptr [ebp-14]
:00476D5A 83C201                  add edx, 00000001
:00476D5D 8955EC                  mov dword ptr [ebp-14], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00476D55(U)
|
:00476D60 837DEC05                cmp dword ptr [ebp-14], 00000005
:00476D64 0F8DD6000000            jnl 00476E40
:00476D6A 8B45EC                  mov eax, dword ptr [ebp-14]
:00476D6D 8B4C85C4                mov ecx, dword ptr [ebp+4*eax-3C]
:00476D71 3B4DFC                  cmp ecx, dword ptr [ebp-04]
:00476D74 0F85C1000000            jne 00476E3B
:00476D7A 8B55EC                  mov edx, dword ptr [ebp-14]
:00476D7D 33C0                    xor eax, eax
:00476D7F 8A4415F0                mov al, byte ptr [ebp+edx-10]
:00476D83 83F804                  cmp eax, 00000004
:00476D86 7C09                    jl 00476D91
:00476D88 C745F808000000          mov [ebp-08], 00000008
:00476D8F EB51                    jmp 00476DE2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00476D86(C)
|
:00476D91 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00476D94 33D2                    xor edx, edx
:00476D96 8A540DF0                mov dl, byte ptr [ebp+ecx-10]
:00476D9A 83FA02                  cmp edx, 00000002
:00476D9D 7F31                    jg 00476DD0
:00476D9F 8B45EC                  mov eax, dword ptr [ebp-14]
:00476DA2 8B4C85D8                mov ecx, dword ptr [ebp+4*eax-28]
:00476DA6 898D78FFFFFF            mov dword ptr [ebp+FFFFFF78], ecx
:00476DAC 8B55EC                  mov edx, dword ptr [ebp-14]
:00476DAF 8B45EC                  mov eax, dword ptr [ebp-14]
:00476DB2 8B4C85AC                mov ecx, dword ptr [ebp+4*eax-54]
:00476DB6 894C95D8                mov dword ptr [ebp+4*edx-28], ecx
:00476DBA 8B55EC                  mov edx, dword ptr [ebp-14]
:00476DBD 8B8578FFFFFF            mov eax, dword ptr [ebp+FFFFFF78]
:00476DC3 894495AC                mov dword ptr [ebp+4*edx-54], eax

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:00476DC7 C745F807000000          mov [ebp-08], 00000007
:00476DCE EB12                    jmp 00476DE2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00476D9D(C)
|

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:00476DD0 C745F806000000          mov [ebp-08], 00000006
:00476DD7 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00476DDA C7448DD800000000        mov [ebp+4*ecx-28], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00476D8F(U), :00476DCE(U)
|
:00476DE2 6A26                    push 00000026
:00476DE4 6A00                    push 00000000
:00476DE6 6A00                    push 00000000
:00476DE8 6A00                    push 00000000
:00476DEA 8D4D8C                  lea ecx, dword ptr [ebp-74]
:00476DED E801A6FEFF              call 004613F3
:00476DF2 8D957CFFFFFF            lea edx, dword ptr [ebp+FFFFFF7C]
:00476DF8 52                      push edx
:00476DF9 8B450C                  mov eax, dword ptr [ebp+0C]
:00476DFC 50                      push eax
:00476DFD FF15EC624800            call dword ptr [004862EC]
:00476E03 6890010000              push 00000190
:00476E08 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00476E0B 8B548DD8                mov edx, dword ptr [ebp+4*ecx-28]
:00476E0F 52                      push edx
:00476E10 8B45EC                  mov eax, dword ptr [ebp-14]
:00476E13 8B4C85AC                mov ecx, dword ptr [ebp+4*eax-54]
:00476E17 51                      push ecx
:00476E18 8D4D8C                  lea ecx, dword ptr [ebp-74]
:00476E1B E828A6FEFF              call 00461448
:00476E20 8B55F8                  mov edx, dword ptr [ebp-08]
:00476E23 52                      push edx
:00476E24 6A00                    push 00000000
:00476E26 8D857CFFFFFF            lea eax, dword ptr [ebp+FFFFFF7C]
:00476E2C 50                      push eax
:00476E2D 8B4D08                  mov ecx, dword ptr [ebp+08]
:00476E30 51                      push ecx
:00476E31 8D4D8C                  lea ecx, dword ptr [ebp-74]
:00476E34 E836A6FEFF              call 0046146F
:00476E39 EB05                    jmp 00476E40

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00476D74(C)
|
:00476E3B E917FFFFFF              jmp 00476D57

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00476D64(C), :00476E39(U)
|
:00476E40 8BE5                    mov esp, ebp
:00476E42 5D                      pop ebp
:00476E43 C3                      ret


:00476E44 55                      push ebp
:00476E45 8BEC                    mov ebp, esp
:00476E47 E807000000              call 00476E53
:00476E4C E825000000              call 00476E76
:00476E51 5D                      pop ebp
:00476E52 C3                      ret



* Referenced by a CALL at Address:
|:00476E47   
|
:00476E53 55                      push ebp
:00476E54 8BEC                    mov ebp, esp
:00476E56 B9D86C4B00              mov ecx, 004B6CD8
:00476E5B E8C2C4FEFF              call 00463322
:00476E60 B9786A4B00              mov ecx, 004B6A78
:00476E65 E8B8C4FEFF              call 00463322
:00476E6A B9F0744B00              mov ecx, 004B74F0
:00476E6F E8AEC4FEFF              call 00463322
:00476E74 5D                      pop ebp
:00476E75 C3                      ret



* Referenced by a CALL at Address:
|:00476E4C   
|
:00476E76 55                      push ebp
:00476E77 8BEC                    mov ebp, esp
:00476E79 68886E4700              push 00476E88
:00476E7E E87DA20000              call 00481100
:00476E83 83C404                  add esp, 00000004
:00476E86 5D                      pop ebp
:00476E87 C3                      ret


:00476E88 55                      push ebp
:00476E89 8BEC                    mov ebp, esp
:00476E8B B9F0744B00              mov ecx, 004B74F0
:00476E90 E85B73F9FF              call 0040E1F0
:00476E95 B9786A4B00              mov ecx, 004B6A78
:00476E9A E85173F9FF              call 0040E1F0
:00476E9F B9D86C4B00              mov ecx, 004B6CD8
:00476EA4 E84773F9FF              call 0040E1F0
:00476EA9 5D                      pop ebp
:00476EAA C3                      ret



* Referenced by a CALL at Addresses:
|:0047788F   , :0047893E   
|
:00476EAB 55                      push ebp
:00476EAC 8BEC                    mov ebp, esp
:00476EAE 83EC24                  sub esp, 00000024
:00476EB1 894DDC                  mov dword ptr [ebp-24], ecx

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:056F, "Wepon:"
                                  |
:00476EB4 686F050000              push 0000056F
:00476EB9 8B4508                  mov eax, dword ptr [ebp+08]
:00476EBC 50                      push eax
:00476EBD FF15DC624800            call dword ptr [004862DC]
:00476EC3 85C0                    test eax, eax
:00476EC5 7505                    jne 00476ECC
:00476EC7 E96A040000              jmp 00477336

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00476EC5(C)
|
:00476ECC 6A00                    push 00000000
:00476ECE 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00476ED1 E81AF7F8FF              call 004065F0
:00476ED6 25FF000000              and eax, 000000FF
:00476EDB 3DFF000000              cmp eax, 000000FF
:00476EE0 0F8402010000            je 00476FE8
:00476EE6 6A00                    push 00000000
:00476EE8 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00476EEB E800F7F8FF              call 004065F0
:00476EF0 8AC8                    mov cl, al
:00476EF2 81E1FF000000            and ecx, 000000FF
:00476EF8 6BC919                  imul ecx, 00000019
:00476EFB 81C140114A00            add ecx, 004A1140
:00476F01 E80A88FEFF              call 0045F710
:00476F06 50                      push eax
:00476F07 68D06C4800              push 00486CD0

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:056F, "Wepon:"
                                  |
:00476F0C 686F050000              push 0000056F
:00476F11 8B4D08                  mov ecx, dword ptr [ebp+08]
:00476F14 51                      push ecx
:00476F15 FF15DC624800            call dword ptr [004862DC]
:00476F1B 50                      push eax
:00476F1C E8BBAEFEFF              call 00461DDC
:00476F21 83C40C                  add esp, 0000000C
:00476F24 6A00                    push 00000000
:00476F26 6A00                    push 00000000
:00476F28 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00476F2B E8B026F9FF              call 004095E0
:00476F30 25FF000000              and eax, 000000FF
:00476F35 50                      push eax

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:0570, "99"
                                  |
:00476F36 6870050000              push 00000570
:00476F3B 8B5508                  mov edx, dword ptr [ebp+08]
:00476F3E 52                      push edx
:00476F3F FF15E4624800            call dword ptr [004862E4]
:00476F45 6A01                    push 00000001
:00476F47 6A00                    push 00000000
:00476F49 6A00                    push 00000000

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:058E, ""
                                  |
:00476F4B 688E050000              push 0000058E
:00476F50 8B4508                  mov eax, dword ptr [ebp+08]
:00476F53 50                      push eax
:00476F54 FF15DC624800            call dword ptr [004862DC]
:00476F5A 50                      push eax
:00476F5B FF15B4624800            call dword ptr [004862B4]
:00476F61 6A05                    push 00000005

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:058E, ""
                                  |
:00476F63 688E050000              push 0000058E
:00476F68 8B4D08                  mov ecx, dword ptr [ebp+08]
:00476F6B 51                      push ecx
:00476F6C FF15DC624800            call dword ptr [004862DC]
:00476F72 50                      push eax
:00476F73 FF15E0624800            call dword ptr [004862E0]
:00476F79 6A00                    push 00000000
:00476F7B 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00476F7E E85D26F9FF              call 004095E0
:00476F83 50                      push eax
:00476F84 6A00                    push 00000000
:00476F86 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00476F89 E862F6F8FF              call 004065F0
:00476F8E 25FF000000              and eax, 000000FF
:00476F93 50                      push eax
:00476F94 8D55E0                  lea edx, dword ptr [ebp-20]
:00476F97 52                      push edx
:00476F98 E868B0FEFF              call 00462005
:00476F9D 83C40C                  add esp, 0000000C
:00476FA0 8D45E0                  lea eax, dword ptr [ebp-20]
:00476FA3 50                      push eax

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:0579, "Effect"
                                  |
:00476FA4 6879050000              push 00000579
:00476FA9 8B4D08                  mov ecx, dword ptr [ebp+08]
:00476FAC 51                      push ecx
:00476FAD FF15D8624800            call dword ptr [004862D8]
:00476FB3 6A00                    push 00000000
:00476FB5 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00476FB8 E833F6F8FF              call 004065F0
:00476FBD 8AC8                    mov cl, al
:00476FBF 81E1FF000000            and ecx, 000000FF
:00476FC5 6BC919                  imul ecx, 00000019
:00476FC8 81C140114A00            add ecx, 004A1140
:00476FCE E89DBCFFFF              call 00472C70
:00476FD3 25FF000000              and eax, 000000FF
:00476FD8 50                      push eax
:00476FD9 B9D86C4B00              mov ecx, 004B6CD8
:00476FDE E8ECC3FEFF              call 004633CF
:00476FE3 E996000000              jmp 0047707E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00476EE0(C)
|
:00476FE8 68FC6C4800              push 00486CFC
:00476FED 68D06C4800              push 00486CD0

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:056F, "Wepon:"
                                  |
:00476FF2 686F050000              push 0000056F
:00476FF7 8B5508                  mov edx, dword ptr [ebp+08]
:00476FFA 52                      push edx
:00476FFB FF15DC624800            call dword ptr [004862DC]
:00477001 50                      push eax
:00477002 E8D5ADFEFF              call 00461DDC
:00477007 83C40C                  add esp, 0000000C
:0047700A 681C754B00              push 004B751C

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:0570, "99"
                                  |
:0047700F 6870050000              push 00000570
:00477014 8B4508                  mov eax, dword ptr [ebp+08]
:00477017 50                      push eax
:00477018 FF15D8624800            call dword ptr [004862D8]
:0047701E 6820754B00              push 004B7520

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:058A, "Lv"
                                  |
:00477023 688A050000              push 0000058A
:00477028 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047702B 51                      push ecx
:0047702C FF15D8624800            call dword ptr [004862D8]
:00477032 6824754B00              push 004B7524

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:058B, "Exp"
                                  |
:00477037 688B050000              push 0000058B
:0047703C 8B5508                  mov edx, dword ptr [ebp+08]
:0047703F 52                      push edx
:00477040 FF15D8624800            call dword ptr [004862D8]
:00477046 6A00                    push 00000000

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:058E, ""
                                  |
:00477048 688E050000              push 0000058E
:0047704D 8B4508                  mov eax, dword ptr [ebp+08]
:00477050 50                      push eax
:00477051 FF15DC624800            call dword ptr [004862DC]
:00477057 50                      push eax
:00477058 FF15E0624800            call dword ptr [004862E0]
:0047705E 6828754B00              push 004B7528

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:0579, "Effect"
                                  |
:00477063 6879050000              push 00000579
:00477068 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047706B 51                      push ecx
:0047706C FF15D8624800            call dword ptr [004862D8]

* Possible Ref to Menu: APPMENU, Item: "_8"
                                  |
:00477072 6A68                    push 00000068
:00477074 B9D86C4B00              mov ecx, 004B6CD8
:00477079 E851C3FEFF              call 004633CF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00476FE3(U)
|
:0047707E 6A01                    push 00000001
:00477080 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00477083 E868F5F8FF              call 004065F0
:00477088 25FF000000              and eax, 000000FF
:0047708D 3DFF000000              cmp eax, 000000FF
:00477092 0F8402010000            je 0047719A
:00477098 6A01                    push 00000001
:0047709A 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0047709D E84EF5F8FF              call 004065F0
:004770A2 8AC8                    mov cl, al
:004770A4 81E1FF000000            and ecx, 000000FF
:004770AA 6BC919                  imul ecx, 00000019
:004770AD 81C140114A00            add ecx, 004A1140
:004770B3 E85886FEFF              call 0045F710
:004770B8 50                      push eax
:004770B9 68E06C4800              push 00486CE0

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:0572, "Armor:"
                                  |
:004770BE 6872050000              push 00000572
:004770C3 8B5508                  mov edx, dword ptr [ebp+08]
:004770C6 52                      push edx
:004770C7 FF15DC624800            call dword ptr [004862DC]
:004770CD 50                      push eax
:004770CE E809ADFEFF              call 00461DDC
:004770D3 83C40C                  add esp, 0000000C
:004770D6 6A00                    push 00000000
:004770D8 6A01                    push 00000001
:004770DA 8B4DDC                  mov ecx, dword ptr [ebp-24]
:004770DD E8FE24F9FF              call 004095E0
:004770E2 25FF000000              and eax, 000000FF
:004770E7 50                      push eax

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:0573, "99"
                                  |
:004770E8 6873050000              push 00000573
:004770ED 8B4508                  mov eax, dword ptr [ebp+08]
:004770F0 50                      push eax
:004770F1 FF15E4624800            call dword ptr [004862E4]
:004770F7 6A01                    push 00000001
:004770F9 6A00                    push 00000000
:004770FB 6A00                    push 00000000

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:058F, ""
                                  |
:004770FD 688F050000              push 0000058F
:00477102 8B4D08                  mov ecx, dword ptr [ebp+08]
:00477105 51                      push ecx
:00477106 FF15DC624800            call dword ptr [004862DC]
:0047710C 50                      push eax
:0047710D FF15B4624800            call dword ptr [004862B4]
:00477113 6A05                    push 00000005

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:058F, ""
                                  |
:00477115 688F050000              push 0000058F
:0047711A 8B5508                  mov edx, dword ptr [ebp+08]
:0047711D 52                      push edx
:0047711E FF15DC624800            call dword ptr [004862DC]
:00477124 50                      push eax
:00477125 FF15E0624800            call dword ptr [004862E0]
:0047712B 6A01                    push 00000001
:0047712D 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00477130 E8AB24F9FF              call 004095E0
:00477135 50                      push eax
:00477136 6A01                    push 00000001
:00477138 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0047713B E8B0F4F8FF              call 004065F0
:00477140 25FF000000              and eax, 000000FF
:00477145 50                      push eax
:00477146 8D45E0                  lea eax, dword ptr [ebp-20]
:00477149 50                      push eax
:0047714A E8B6AEFEFF              call 00462005
:0047714F 83C40C                  add esp, 0000000C
:00477152 8D4DE0                  lea ecx, dword ptr [ebp-20]
:00477155 51                      push ecx

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:0578, "Effect"
                                  |
:00477156 6878050000              push 00000578
:0047715B 8B5508                  mov edx, dword ptr [ebp+08]
:0047715E 52                      push edx
:0047715F FF15D8624800            call dword ptr [004862D8]
:00477165 6A01                    push 00000001
:00477167 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0047716A E881F4F8FF              call 004065F0
:0047716F 8AC8                    mov cl, al
:00477171 81E1FF000000            and ecx, 000000FF
:00477177 6BC919                  imul ecx, 00000019
:0047717A 81C140114A00            add ecx, 004A1140
:00477180 E8EBBAFFFF              call 00472C70
:00477185 25FF000000              and eax, 000000FF
:0047718A 50                      push eax
:0047718B B9786A4B00              mov ecx, 004B6A78
:00477190 E83AC2FEFF              call 004633CF
:00477195 E996000000              jmp 00477230

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00477092(C)
|
:0047719A 68FC6C4800              push 00486CFC
:0047719F 68E06C4800              push 00486CE0

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:0572, "Armor:"
                                  |
:004771A4 6872050000              push 00000572
:004771A9 8B4508                  mov eax, dword ptr [ebp+08]
:004771AC 50                      push eax
:004771AD FF15DC624800            call dword ptr [004862DC]
:004771B3 50                      push eax
:004771B4 E823ACFEFF              call 00461DDC
:004771B9 83C40C                  add esp, 0000000C
:004771BC 682C754B00              push 004B752C

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:0573, "99"
                                  |
:004771C1 6873050000              push 00000573
:004771C6 8B4D08                  mov ecx, dword ptr [ebp+08]
:004771C9 51                      push ecx
:004771CA FF15D8624800            call dword ptr [004862D8]
:004771D0 6830754B00              push 004B7530

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:058C, "Lv"
                                  |
:004771D5 688C050000              push 0000058C
:004771DA 8B5508                  mov edx, dword ptr [ebp+08]
:004771DD 52                      push edx
:004771DE FF15D8624800            call dword ptr [004862D8]
:004771E4 6834754B00              push 004B7534

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:058D, "Exp"
                                  |
:004771E9 688D050000              push 0000058D
:004771EE 8B4508                  mov eax, dword ptr [ebp+08]
:004771F1 50                      push eax
:004771F2 FF15D8624800            call dword ptr [004862D8]
:004771F8 6A00                    push 00000000

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:058F, ""
                                  |
:004771FA 688F050000              push 0000058F
:004771FF 8B4D08                  mov ecx, dword ptr [ebp+08]
:00477202 51                      push ecx
:00477203 FF15DC624800            call dword ptr [004862DC]
:00477209 50                      push eax
:0047720A FF15E0624800            call dword ptr [004862E0]
:00477210 6838754B00              push 004B7538

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:0578, "Effect"
                                  |
:00477215 6878050000              push 00000578
:0047721A 8B5508                  mov edx, dword ptr [ebp+08]
:0047721D 52                      push edx
:0047721E FF15D8624800            call dword ptr [004862D8]

* Possible Ref to Menu: APPMENU, Item: "_8"
                                  |
:00477224 6A68                    push 00000068
:00477226 B9786A4B00              mov ecx, 004B6A78
:0047722B E89FC1FEFF              call 004633CF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00477195(U)
|
:00477230 6A02                    push 00000002
:00477232 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00477235 E8B6F3F8FF              call 004065F0
:0047723A 25FF000000              and eax, 000000FF
:0047723F 3DFF000000              cmp eax, 000000FF
:00477244 0F84AA000000            je 004772F4
:0047724A 6A02                    push 00000002
:0047724C 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0047724F E89CF3F8FF              call 004065F0
:00477254 8AC8                    mov cl, al
:00477256 81E1FF000000            and ecx, 000000FF
:0047725C 6BC919                  imul ecx, 00000019
:0047725F 81C140114A00            add ecx, 004A1140
:00477265 E8A684FEFF              call 0045F710
:0047726A 50                      push eax
:0047726B 68F06C4800              push 00486CF0

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:0575, "Sub Item:"
                                  |
:00477270 6875050000              push 00000575
:00477275 8B4508                  mov eax, dword ptr [ebp+08]
:00477278 50                      push eax
:00477279 FF15DC624800            call dword ptr [004862DC]
:0047727F 50                      push eax
:00477280 E857ABFEFF              call 00461DDC
:00477285 83C40C                  add esp, 0000000C
:00477288 6A02                    push 00000002
:0047728A 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0047728D E84E23F9FF              call 004095E0
:00477292 50                      push eax
:00477293 6A02                    push 00000002
:00477295 8B4DDC                  mov ecx, dword ptr [ebp-24]
:00477298 E853F3F8FF              call 004065F0
:0047729D 25FF000000              and eax, 000000FF
:004772A2 50                      push eax
:004772A3 8D4DE0                  lea ecx, dword ptr [ebp-20]
:004772A6 51                      push ecx
:004772A7 E859ADFEFF              call 00462005
:004772AC 83C40C                  add esp, 0000000C
:004772AF 8D55E0                  lea edx, dword ptr [ebp-20]
:004772B2 52                      push edx

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:057A, "Effect"
                                  |
:004772B3 687A050000              push 0000057A
:004772B8 8B4508                  mov eax, dword ptr [ebp+08]
:004772BB 50                      push eax
:004772BC FF15D8624800            call dword ptr [004862D8]
:004772C2 6A02                    push 00000002
:004772C4 8B4DDC                  mov ecx, dword ptr [ebp-24]
:004772C7 E824F3F8FF              call 004065F0
:004772CC 8AC8                    mov cl, al
:004772CE 81E1FF000000            and ecx, 000000FF
:004772D4 6BC919                  imul ecx, 00000019
:004772D7 81C140114A00            add ecx, 004A1140
:004772DD E88EB9FFFF              call 00472C70
:004772E2 25FF000000              and eax, 000000FF
:004772E7 50                      push eax
:004772E8 B9F0744B00              mov ecx, 004B74F0
:004772ED E8DDC0FEFF              call 004633CF
:004772F2 EB42                    jmp 00477336

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00477244(C)
|
:004772F4 68FC6C4800              push 00486CFC
:004772F9 68F06C4800              push 00486CF0

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:0575, "Sub Item:"
                                  |
:004772FE 6875050000              push 00000575
:00477303 8B4D08                  mov ecx, dword ptr [ebp+08]
:00477306 51                      push ecx
:00477307 FF15DC624800            call dword ptr [004862DC]
:0047730D 50                      push eax
:0047730E E8C9AAFEFF              call 00461DDC
:00477313 83C40C                  add esp, 0000000C
:00477316 683C754B00              push 004B753C

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:057A, "Effect"
                                  |
:0047731B 687A050000              push 0000057A
:00477320 8B5508                  mov edx, dword ptr [ebp+08]
:00477323 52                      push edx
:00477324 FF15D8624800            call dword ptr [004862D8]

* Possible Ref to Menu: APPMENU, Item: "_8"
                                  |
:0047732A 6A68                    push 00000068
:0047732C B9F0744B00              mov ecx, 004B74F0
:00477331 E899C0FEFF              call 004633CF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00476EC7(U), :004772F2(U)
|
:00477336 8BE5                    mov esp, ebp
:00477338 5D                      pop ebp
:00477339 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0047745B   , :00477493   
|
:0047733C 55                      push ebp
:0047733D 8BEC                    mov ebp, esp
:0047733F 83EC48                  sub esp, 00000048
:00477342 8D45C8                  lea eax, dword ptr [ebp-38]
:00477345 50                      push eax
:00477346 FF1568624800            call dword ptr [00486268]

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:056F, "Wepon:"
                                  |
:0047734C C745BC6F050000          mov [ebp-44], 0000056F

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:0572, "Armor:"
                                  |
:00477353 C745C072050000          mov [ebp-40], 00000572

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:0575, "Sub Item:"
                                  |
:0047735A C745C475050000          mov [ebp-3C], 00000575

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:0579, "Effect"
                                  |
:00477361 C745F079050000          mov [ebp-10], 00000579

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:0578, "Effect"
                                  |
:00477368 C745F478050000          mov [ebp-0C], 00000578

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:057A, "Effect"
                                  |
:0047736F C745F87A050000          mov [ebp-08], 0000057A
:00477376 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00477379 51                      push ecx
:0047737A 8B55C8                  mov edx, dword ptr [ebp-38]
:0047737D 52                      push edx
:0047737E FF1528634800            call dword ptr [00486328]
:00477384 8945FC                  mov dword ptr [ebp-04], eax
:00477387 8B45FC                  mov eax, dword ptr [ebp-04]
:0047738A 3B4508                  cmp eax, dword ptr [ebp+08]
:0047738D 7413                    je 004773A2
:0047738F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00477392 51                      push ecx
:00477393 FF159C634800            call dword ptr [0048639C]
:00477399 3B4508                  cmp eax, dword ptr [ebp+08]
:0047739C 0F859A000000            jne 0047743C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047738D(C)
|
:004773A2 C645B800                mov [ebp-48], 00
:004773A6 EB09                    jmp 004773B1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00477437(U)
|
:004773A8 8A55B8                  mov dl, byte ptr [ebp-48]
:004773AB 80C201                  add dl, 01
:004773AE 8855B8                  mov byte ptr [ebp-48], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004773A6(U)
|
:004773B1 8B45B8                  mov eax, dword ptr [ebp-48]
:004773B4 25FF000000              and eax, 000000FF
:004773B9 83F803                  cmp eax, 00000003
:004773BC 7D7E                    jge 0047743C
:004773BE 8D4DD0                  lea ecx, dword ptr [ebp-30]
:004773C1 51                      push ecx
:004773C2 8B55B8                  mov edx, dword ptr [ebp-48]
:004773C5 81E2FF000000            and edx, 000000FF
:004773CB 8B4495BC                mov eax, dword ptr [ebp+4*edx-44]
:004773CF 50                      push eax
:004773D0 8B4D08                  mov ecx, dword ptr [ebp+08]
:004773D3 51                      push ecx
:004773D4 FF15DC624800            call dword ptr [004862DC]
:004773DA 50                      push eax
:004773DB FF1598634800            call dword ptr [00486398]
:004773E1 8B55D0                  mov edx, dword ptr [ebp-30]
:004773E4 8955E0                  mov dword ptr [ebp-20], edx
:004773E7 8B45D4                  mov eax, dword ptr [ebp-2C]
:004773EA 8945E4                  mov dword ptr [ebp-1C], eax
:004773ED 8D4DD0                  lea ecx, dword ptr [ebp-30]
:004773F0 51                      push ecx
:004773F1 8B55B8                  mov edx, dword ptr [ebp-48]
:004773F4 81E2FF000000            and edx, 000000FF
:004773FA 8B4495F0                mov eax, dword ptr [ebp+4*edx-10]
:004773FE 50                      push eax
:004773FF 8B4D08                  mov ecx, dword ptr [ebp+08]
:00477402 51                      push ecx
:00477403 FF15DC624800            call dword ptr [004862DC]
:00477409 50                      push eax
:0047740A FF1598634800            call dword ptr [00486398]
:00477410 8B55D8                  mov edx, dword ptr [ebp-28]
:00477413 8955E8                  mov dword ptr [ebp-18], edx
:00477416 8B45DC                  mov eax, dword ptr [ebp-24]
:00477419 8945EC                  mov dword ptr [ebp-14], eax
:0047741C 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0047741F 51                      push ecx
:00477420 8B55C8                  mov edx, dword ptr [ebp-38]
:00477423 52                      push edx
:00477424 8D45E0                  lea eax, dword ptr [ebp-20]
:00477427 50                      push eax
:00477428 FF158C634800            call dword ptr [0048638C]
:0047742E 85C0                    test eax, eax
:00477430 7405                    je 00477437
:00477432 8A45B8                  mov al, byte ptr [ebp-48]
:00477435 EB07                    jmp 0047743E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00477430(C)
|
:00477437 E96CFFFFFF              jmp 004773A8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047739C(C), :004773BC(C)
|
:0047743C 0CFF                    or al, FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00477435(U)
|
:0047743E 8BE5                    mov esp, ebp
:00477440 5D                      pop ebp
:00477441 C3                      ret



* Referenced by a CALL at Address:
|:00477901   
|
:00477442 55                      push ebp
:00477443 8BEC                    mov ebp, esp
:00477445 51                      push ecx
:00477446 8B450C                  mov eax, dword ptr [ebp+0C]
:00477449 25FFFF0000              and eax, 0000FFFF
:0047744E 83F8FF                  cmp eax, FFFFFFFF
:00477451 7504                    jne 00477457
:00477453 33C0                    xor eax, eax
:00477455 EB30                    jmp 00477487

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00477451(C)
|
:00477457 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047745A 51                      push ecx
:0047745B E8DCFEFFFF              call 0047733C
:00477460 83C404                  add esp, 00000004
:00477463 8845FC                  mov byte ptr [ebp-04], al
:00477466 8B55FC                  mov edx, dword ptr [ebp-04]
:00477469 81E2FF000000            and edx, 000000FF
:0047746F 83FA03                  cmp edx, 00000003
:00477472 7D11                    jge 00477485
:00477474 8B4508                  mov eax, dword ptr [ebp+08]
:00477477 50                      push eax
:00477478 FF1588634800            call dword ptr [00486388]
:0047747E B801000000              mov eax, 00000001
:00477483 EB02                    jmp 00477487

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00477472(C)
|
:00477485 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00477455(U), :00477483(U)
|
:00477487 8BE5                    mov esp, ebp
:00477489 5D                      pop ebp
:0047748A C3                      ret



* Referenced by a CALL at Addresses:
|:00477940   , :0047799F   
|
:0047748B 55                      push ebp
:0047748C 8BEC                    mov ebp, esp
:0047748E 51                      push ecx
:0047748F 8B4508                  mov eax, dword ptr [ebp+08]
:00477492 50                      push eax
:00477493 E8A4FEFFFF              call 0047733C
:00477498 83C404                  add esp, 00000004
:0047749B 8845FC                  mov byte ptr [ebp-04], al
:0047749E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004774A1 81E1FF000000            and ecx, 000000FF
:004774A7 8B550C                  mov edx, dword ptr [ebp+0C]
:004774AA 33C0                    xor eax, eax
:004774AC 8A02                    mov al, byte ptr [edx]
:004774AE 3BC8                    cmp ecx, eax
:004774B0 0F8483000000            je 00477539
:004774B6 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004774B9 33D2                    xor edx, edx
:004774BB 8A11                    mov dl, byte ptr [ecx]
:004774BD 83FA03                  cmp edx, 00000003
:004774C0 7D26                    jge 004774E8
:004774C2 6A05                    push 00000005
:004774C4 6A00                    push 00000000
:004774C6 6A00                    push 00000000
:004774C8 8B450C                  mov eax, dword ptr [ebp+0C]
:004774CB 33C9                    xor ecx, ecx
:004774CD 8A08                    mov cl, byte ptr [eax]
:004774CF 8B148D08764800          mov edx, dword ptr [4*ecx+00487608]
:004774D6 52                      push edx
:004774D7 8B4508                  mov eax, dword ptr [ebp+08]
:004774DA 50                      push eax
:004774DB FF15DC624800            call dword ptr [004862DC]
:004774E1 50                      push eax
:004774E2 FF15B4624800            call dword ptr [004862B4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004774C0(C)
|
:004774E8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004774EB 81E1FF000000            and ecx, 000000FF
:004774F1 83F903                  cmp ecx, 00000003
:004774F4 7D2A                    jge 00477520
:004774F6 6A05                    push 00000005
:004774F8 6A00                    push 00000000
:004774FA 6A00                    push 00000000
:004774FC 8B55FC                  mov edx, dword ptr [ebp-04]
:004774FF 81E2FF000000            and edx, 000000FF
:00477505 8B049508764800          mov eax, dword ptr [4*edx+00487608]
:0047750C 50                      push eax
:0047750D 8B4D08                  mov ecx, dword ptr [ebp+08]
:00477510 51                      push ecx
:00477511 FF15DC624800            call dword ptr [004862DC]
:00477517 50                      push eax
:00477518 FF15B4624800            call dword ptr [004862B4]
:0047751E EB11                    jmp 00477531

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004774F4(C)
|
:00477520 FF1584634800            call dword ptr [00486384]
:00477526 3B4508                  cmp eax, dword ptr [ebp+08]
:00477529 7506                    jne 00477531
:0047752B FF1580634800            call dword ptr [00486380]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047751E(U), :00477529(C)
|
:00477531 8B550C                  mov edx, dword ptr [ebp+0C]
:00477534 8A45FC                  mov al, byte ptr [ebp-04]
:00477537 8802                    mov byte ptr [edx], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004774B0(C)
|
:00477539 8BE5                    mov esp, ebp
:0047753B 5D                      pop ebp
:0047753C C3                      ret



* Referenced by a CALL at Address:
|:0047798E   
|
:0047753D 55                      push ebp
:0047753E 8BEC                    mov ebp, esp
:00477540 8B450C                  mov eax, dword ptr [ebp+0C]
:00477543 25FF000000              and eax, 000000FF
:00477548 83F803                  cmp eax, 00000003
:0047754B 7D77                    jge 004775C4
:0047754D 8A4D0C                  mov cl, byte ptr [ebp+0C]
:00477550 51                      push ecx
:00477551 8B1504754B00            mov edx, dword ptr [004B7504]
:00477557 8B0C95F06C4B00          mov ecx, dword ptr [4*edx+004B6CF0]
:0047755E 6BC948                  imul ecx, 00000048
:00477561 81C1681B4A00            add ecx, 004A1B68
:00477567 E81421F9FF              call 00409680
:0047756C 50                      push eax
:0047756D 8A450C                  mov al, byte ptr [ebp+0C]
:00477570 50                      push eax
:00477571 8B0D04754B00            mov ecx, dword ptr [004B7504]
:00477577 8B0C8DF06C4B00          mov ecx, dword ptr [4*ecx+004B6CF0]
:0047757E 6BC948                  imul ecx, 00000048
:00477581 81C1681B4A00            add ecx, 004A1B68
:00477587 E85420F9FF              call 004095E0
:0047758C 50                      push eax
:0047758D 8A550C                  mov dl, byte ptr [ebp+0C]
:00477590 52                      push edx
:00477591 A104754B00              mov eax, dword ptr [004B7504]
:00477596 8B0C85F06C4B00          mov ecx, dword ptr [4*eax+004B6CF0]
:0047759D 6BC948                  imul ecx, 00000048
:004775A0 81C1681B4A00            add ecx, 004A1B68
:004775A6 E845F0F8FF              call 004065F0
:004775AB 25FF000000              and eax, 000000FF
:004775B0 50                      push eax
:004775B1 8B4D08                  mov ecx, dword ptr [ebp+08]
:004775B4 51                      push ecx
:004775B5 FF159C634800            call dword ptr [0048639C]
:004775BB 50                      push eax
:004775BC E83649F9FF              call 0040BEF7
:004775C1 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047754B(C)
|
:004775C4 5D                      pop ebp
:004775C5 C3                      ret



* Referenced by a CALL at Address:
|:004778C5   
|
:004775C6 55                      push ebp
:004775C7 8BEC                    mov ebp, esp
:004775C9 83EC08                  sub esp, 00000008
:004775CC 8B4510                  mov eax, dword ptr [ebp+10]
:004775CF 50                      push eax
:004775D0 FF1594634800            call dword ptr [00486394]
:004775D6 8945FC                  mov dword ptr [ebp-04], eax
:004775D9 C645F800                mov [ebp-08], 00
:004775DD EB09                    jmp 004775E8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047760C(U)
|
:004775DF 8A4DF8                  mov cl, byte ptr [ebp-08]
:004775E2 80C101                  add cl, 01
:004775E5 884DF8                  mov byte ptr [ebp-08], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004775DD(U)
|
:004775E8 8B55F8                  mov edx, dword ptr [ebp-08]
:004775EB 81E2FF000000            and edx, 000000FF
:004775F1 83FA03                  cmp edx, 00000003
:004775F4 7D18                    jge 0047760E
:004775F6 8B45F8                  mov eax, dword ptr [ebp-08]
:004775F9 25FF000000              and eax, 000000FF
:004775FE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00477601 3B0C8518764800          cmp ecx, dword ptr [4*eax+00487618]
:00477608 7502                    jne 0047760C
:0047760A EB02                    jmp 0047760E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00477608(C)
|
:0047760C EBD1                    jmp 004775DF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004775F4(C), :0047760A(U)
|
:0047760E 8B55F8                  mov edx, dword ptr [ebp-08]
:00477611 81E2FF000000            and edx, 000000FF
:00477617 83FA03                  cmp edx, 00000003
:0047761A 7D3D                    jge 00477659
:0047761C 8B4514                  mov eax, dword ptr [ebp+14]
:0047761F 25FF000000              and eax, 000000FF
:00477624 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00477627 81E1FF000000            and ecx, 000000FF
:0047762D 3BC1                    cmp eax, ecx
:0047762F 7528                    jne 00477659
:00477631 6A00                    push 00000000
:00477633 6A00                    push 00000000
:00477635 6A0E                    push 0000000E
:00477637 FF1564634800            call dword ptr [00486364]
:0047763D 50                      push eax
:0047763E 6A0D                    push 0000000D
:00477640 FF1564634800            call dword ptr [00486364]
:00477646 50                      push eax
:00477647 8B5510                  mov edx, dword ptr [ebp+10]
:0047764A 52                      push edx
:0047764B 8B450C                  mov eax, dword ptr [ebp+0C]
:0047764E 50                      push eax
:0047764F E8669FFFFF              call 004715BA
:00477654 83C418                  add esp, 00000018
:00477657 EB3A                    jmp 00477693

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047761A(C), :0047762F(C)
|
:00477659 6A00                    push 00000000
:0047765B 6A01                    push 00000001
:0047765D 8B4D10                  mov ecx, dword ptr [ebp+10]
:00477660 51                      push ecx
:00477661 8B550C                  mov edx, dword ptr [ebp+0C]
:00477664 52                      push edx
:00477665 E8219FFFFF              call 0047158B
:0047766A 83C410                  add esp, 00000010
:0047766D A104754B00              mov eax, dword ptr [004B7504]
:00477672 8B0C85F06C4B00          mov ecx, dword ptr [4*eax+004B6CF0]
:00477679 6BC948                  imul ecx, 00000048
:0047767C 81C1681B4A00            add ecx, 004A1B68
:00477682 51                      push ecx
:00477683 8B5510                  mov edx, dword ptr [ebp+10]
:00477686 52                      push edx
:00477687 8B450C                  mov eax, dword ptr [ebp+0C]
:0047768A 50                      push eax
:0047768B E807000000              call 00477697
:00477690 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00477657(U)
|
:00477693 8BE5                    mov esp, ebp
:00477695 5D                      pop ebp
:00477696 C3                      ret



* Referenced by a CALL at Address:
|:0047768B   
|
:00477697 55                      push ebp
:00477698 8BEC                    mov ebp, esp
:0047769A 83EC48                  sub esp, 00000048

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:058E, ""
                                  |
:0047769D C745F08E050000          mov [ebp-10], 0000058E

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:058F, ""
                                  |
:004776A4 C745F48F050000          mov [ebp-0C], 0000058F
:004776AB 6A00                    push 00000000
:004776AD 8B4D10                  mov ecx, dword ptr [ebp+10]
:004776B0 E8CB1FF9FF              call 00409680
:004776B5 25FF000000              and eax, 000000FF
:004776BA 8945E8                  mov dword ptr [ebp-18], eax
:004776BD 6A01                    push 00000001
:004776BF 8B4D10                  mov ecx, dword ptr [ebp+10]
:004776C2 E8B91FF9FF              call 00409680
:004776C7 25FF000000              and eax, 000000FF
:004776CC 8945EC                  mov dword ptr [ebp-14], eax
:004776CF 8B450C                  mov eax, dword ptr [ebp+0C]
:004776D2 50                      push eax
:004776D3 FF1594634800            call dword ptr [00486394]
:004776D9 8945FC                  mov dword ptr [ebp-04], eax
:004776DC C745F800000000          mov [ebp-08], 00000000
:004776E3 EB09                    jmp 004776EE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00477748(U)
|
:004776E5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:004776E8 83C101                  add ecx, 00000001
:004776EB 894DF8                  mov dword ptr [ebp-08], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004776E3(U)
|
:004776EE 837DF802                cmp dword ptr [ebp-08], 00000002
:004776F2 7D56                    jge 0047774A
:004776F4 8B55F8                  mov edx, dword ptr [ebp-08]
:004776F7 8B4495F0                mov eax, dword ptr [ebp+4*edx-10]
:004776FB 3B45FC                  cmp eax, dword ptr [ebp-04]
:004776FE 7548                    jne 00477748
:00477700 6A26                    push 00000026
:00477702 6A00                    push 00000000
:00477704 6A00                    push 00000000
:00477706 6A00                    push 00000000
:00477708 8D4DC8                  lea ecx, dword ptr [ebp-38]
:0047770B E8E39CFEFF              call 004613F3
:00477710 8D4DB8                  lea ecx, dword ptr [ebp-48]
:00477713 51                      push ecx
:00477714 8B550C                  mov edx, dword ptr [ebp+0C]
:00477717 52                      push edx
:00477718 FF15EC624800            call dword ptr [004862EC]
:0047771E 6A64                    push 00000064
:00477720 6A64                    push 00000064
:00477722 8B45F8                  mov eax, dword ptr [ebp-08]
:00477725 8B4C85E8                mov ecx, dword ptr [ebp+4*eax-18]
:00477729 51                      push ecx
:0047772A 8D4DC8                  lea ecx, dword ptr [ebp-38]
:0047772D E8169DFEFF              call 00461448
:00477732 6A05                    push 00000005
:00477734 6A00                    push 00000000
:00477736 8D55B8                  lea edx, dword ptr [ebp-48]
:00477739 52                      push edx
:0047773A 8B4508                  mov eax, dword ptr [ebp+08]
:0047773D 50                      push eax
:0047773E 8D4DC8                  lea ecx, dword ptr [ebp-38]
:00477741 E8299DFEFF              call 0046146F
:00477746 EB02                    jmp 0047774A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004776FE(C)
|
:00477748 EB9B                    jmp 004776E5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004776F2(C), :00477746(U)
|
:0047774A 8BE5                    mov esp, ebp
:0047774C 5D                      pop ebp
:0047774D C3                      ret



* Referenced by a CALL at Addresses:
|:004778DF   , :0047792B   , :00477957   
|
:0047774E 55                      push ebp
:0047774F 8BEC                    mov ebp, esp
:00477751 51                      push ecx
:00477752 8B4508                  mov eax, dword ptr [ebp+08]
:00477755 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047777D(U)
|
:00477758 6AF0                    push FFFFFFF0
:0047775A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047775D 51                      push ecx
:0047775E FF15A0634800            call dword ptr [004863A0]
:00477764 2500000040              and eax, 40000000
:00477769 3D00000040              cmp eax, 40000000
:0047776E 750F                    jne 0047777F
:00477770 8B55FC                  mov edx, dword ptr [ebp-04]
:00477773 52                      push edx
:00477774 FF159C634800            call dword ptr [0048639C]
:0047777A 8945FC                  mov dword ptr [ebp-04], eax
:0047777D EBD9                    jmp 00477758

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047776E(C)
|
:0047777F 8B45FC                  mov eax, dword ptr [ebp-04]
:00477782 50                      push eax
:00477783 E85E70FFFF              call 0046E7E6
:00477788 83C404                  add esp, 00000004
:0047778B F7D8                    neg eax
:0047778D 1BC0                    sbb eax, eax
:0047778F 40                      inc eax
:00477790 8BE5                    mov esp, ebp
:00477792 5D                      pop ebp
:00477793 C3                      ret


:00477794 55                      push ebp
:00477795 8BEC                    mov ebp, esp
:00477797 51                      push ecx
:00477798 8B450C                  mov eax, dword ptr [ebp+0C]
:0047779B 8945FC                  mov dword ptr [ebp-04], eax
:0047779E 837DFC20                cmp dword ptr [ebp-04], 00000020
:004777A2 7719                    ja 004777BD
:004777A4 837DFC20                cmp dword ptr [ebp-04], 00000020
:004777A8 0F8424010000            je 004778D2
:004777AE 837DFC02                cmp dword ptr [ebp-04], 00000002
:004777B2 0F8400020000            je 004779B8
:004777B8 E905020000              jmp 004779C2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004777A2(C)
|
:004777BD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004777C0 81E910010000            sub ecx, 00000110
:004777C6 894DFC                  mov dword ptr [ebp-04], ecx
:004777C9 817DFCF5000000          cmp dword ptr [ebp-04], 000000F5
:004777D0 0F87EC010000            ja 004779C2
:004777D6 8B45FC                  mov eax, dword ptr [ebp-04]
:004777D9 33D2                    xor edx, edx
:004777DB 8A90E6794700            mov dl, byte ptr [eax+004779E6]
:004777E1 FF2495CA794700          jmp dword ptr [4*edx+004779CA]

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:0582, ""
                                  |
:004777E8 6882050000              push 00000582
:004777ED 8B4D08                  mov ecx, dword ptr [ebp+08]
:004777F0 51                      push ecx
:004777F1 FF15DC624800            call dword ptr [004862DC]
:004777F7 50                      push eax
:004777F8 B9D86C4B00              mov ecx, 004B6CD8
:004777FD E808B0FEFF              call 0046280A
:00477802 B9142E4900              mov ecx, 00492E14
:00477807 E8647EFEFF              call 0045F670
:0047780C 50                      push eax
:0047780D B9D86C4B00              mov ecx, 004B6CD8
:00477812 E866BBFEFF              call 0046337D

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:0583, ""
                                  |
:00477817 6883050000              push 00000583
:0047781C 8B5508                  mov edx, dword ptr [ebp+08]
:0047781F 52                      push edx
:00477820 FF15DC624800            call dword ptr [004862DC]
:00477826 50                      push eax
:00477827 B9786A4B00              mov ecx, 004B6A78
:0047782C E8D9AFFEFF              call 0046280A
:00477831 B9142E4900              mov ecx, 00492E14
:00477836 E8357EFEFF              call 0045F670
:0047783B 50                      push eax
:0047783C B9786A4B00              mov ecx, 004B6A78
:00477841 E837BBFEFF              call 0046337D

* Possible Reference to Dialog: DialogID_00B3, CONTROL_ID:0584, ""
                                  |
:00477846 6884050000              push 00000584
:0047784B 8B4508                  mov eax, dword ptr [ebp+08]
:0047784E 50                      push eax
:0047784F FF15DC624800            call dword ptr [004862DC]
:00477855 50                      push eax
:00477856 B9F0744B00              mov ecx, 004B74F0
:0047785B E8AAAFFEFF              call 0046280A
:00477860 B9142E4900              mov ecx, 00492E14
:00477865 E8067EFEFF              call 0045F670
:0047786A 50                      push eax
:0047786B B9F0744B00              mov ecx, 004B74F0
:00477870 E808BBFEFF              call 0046337D
:00477875 8B4D08                  mov ecx, dword ptr [ebp+08]
:00477878 51                      push ecx
:00477879 8B1504754B00            mov edx, dword ptr [004B7504]
:0047787F 8B0C95F06C4B00          mov ecx, dword ptr [4*edx+004B6CF0]
:00477886 6BC948                  imul ecx, 00000048
:00477889 81C1681B4A00            add ecx, 004A1B68
:0047788F E817F6FFFF              call 00476EAB
:00477894 E929010000              jmp 004779C2
:00477899 6A00                    push 00000000
:0047789B 6A01                    push 00000001
:0047789D 8B4514                  mov eax, dword ptr [ebp+14]
:004778A0 50                      push eax
:004778A1 8B4D10                  mov ecx, dword ptr [ebp+10]
:004778A4 51                      push ecx
:004778A5 E8E199FFFF              call 0047128B
:004778AA 83C410                  add esp, 00000010
:004778AD E910010000              jmp 004779C2
:004778B2 8A15A4EB4800            mov dl, byte ptr [0048EBA4]
:004778B8 52                      push edx
:004778B9 8B4514                  mov eax, dword ptr [ebp+14]
:004778BC 50                      push eax
:004778BD 8B4D10                  mov ecx, dword ptr [ebp+10]
:004778C0 51                      push ecx
:004778C1 8B5508                  mov edx, dword ptr [ebp+08]
:004778C4 52                      push edx
:004778C5 E8FCFCFFFF              call 004775C6
:004778CA 83C410                  add esp, 00000010
:004778CD E9F0000000              jmp 004779C2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004777A8(C)
|
:004778D2 833D0C754B0000          cmp dword ptr [004B750C], 00000000
:004778D9 7533                    jne 0047790E
:004778DB 8B4508                  mov eax, dword ptr [ebp+08]
:004778DE 50                      push eax
:004778DF E86AFEFFFF              call 0047774E
:004778E4 83C404                  add esp, 00000004
:004778E7 85C0                    test eax, eax
:004778E9 7423                    je 0047790E
:004778EB 8B4D14                  mov ecx, dword ptr [ebp+14]
:004778EE C1E910                  shr ecx, 10
:004778F1 81E1FFFF0000            and ecx, 0000FFFF
:004778F7 51                      push ecx
:004778F8 668B5514                mov dx, word ptr [ebp+14]
:004778FC 52                      push edx
:004778FD 8B4508                  mov eax, dword ptr [ebp+08]
:00477900 50                      push eax
:00477901 E83CFBFFFF              call 00477442
:00477906 83C40C                  add esp, 0000000C
:00477909 E9B6000000              jmp 004779C4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004778D9(C), :004778E9(C)
|
:0047790E E9AF000000              jmp 004779C2
:00477913 FF1584634800            call dword ptr [00486384]
:00477919 3B4508                  cmp eax, dword ptr [ebp+08]
:0047791C 752A                    jne 00477948
:0047791E 833D0C754B0000          cmp dword ptr [004B750C], 00000000
:00477925 7521                    jne 00477948
:00477927 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047792A 51                      push ecx
:0047792B E81EFEFFFF              call 0047774E
:00477930 83C404                  add esp, 00000004
:00477933 85C0                    test eax, eax
:00477935 7411                    je 00477948

* Possible StringData Ref from Data Obj ->""
                                  |
:00477937 68A4EB4800              push 0048EBA4
:0047793C 8B5508                  mov edx, dword ptr [ebp+08]
:0047793F 52                      push edx
:00477940 E846FBFFFF              call 0047748B
:00477945 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047791C(C), :00477925(C), :00477935(C)
|
:00477948 EB78                    jmp 004779C2
:0047794A 833D0C754B0000          cmp dword ptr [004B750C], 00000000
:00477951 7563                    jne 004779B6
:00477953 8B4508                  mov eax, dword ptr [ebp+08]
:00477956 50                      push eax
:00477957 E8F2FDFFFF              call 0047774E
:0047795C 83C404                  add esp, 00000004
:0047795F 85C0                    test eax, eax
:00477961 7453                    je 004779B6
:00477963 8B0D0C754B00            mov ecx, dword ptr [004B750C]
:00477969 83C101                  add ecx, 00000001
:0047796C 890D0C754B00            mov dword ptr [004B750C], ecx
:00477972 FF1584634800            call dword ptr [00486384]
:00477978 3B4508                  cmp eax, dword ptr [ebp+08]
:0047797B 7506                    jne 00477983
:0047797D FF1580634800            call dword ptr [00486380]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047797B(C)
|
:00477983 8A15A4EB4800            mov dl, byte ptr [0048EBA4]
:00477989 52                      push edx
:0047798A 8B4508                  mov eax, dword ptr [ebp+08]
:0047798D 50                      push eax
:0047798E E8AAFBFFFF              call 0047753D
:00477993 83C408                  add esp, 00000008

* Possible StringData Ref from Data Obj ->""
                                  |
:00477996 68A4EB4800              push 0048EBA4
:0047799B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047799E 51                      push ecx
:0047799F E8E7FAFFFF              call 0047748B
:004779A4 83C408                  add esp, 00000008
:004779A7 8B150C754B00            mov edx, dword ptr [004B750C]
:004779AD 83EA01                  sub edx, 00000001
:004779B0 89150C754B00            mov dword ptr [004B750C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00477951(C), :00477961(C)
|
:004779B6 EB0A                    jmp 004779C2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004777B2(C)
|
:004779B8 C7050C754B0000000000    mov dword ptr [004B750C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004777B8(U), :004777D0(C), :00477894(U), :004778AD(U), :004778CD(U)
|:0047790E(U), :00477948(U), :004779B6(U)
|
:004779C2 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00477909(U)
|
:004779C4 8BE5                    mov esp, ebp
:004779C6 5D                      pop ebp
:004779C7 C21000                  ret 0010



:004779CA E8774700                DWORD 004777E8
:004779CE 99784700                DWORD 00477899
:004779D2 B2784700                DWORD 004778B2
:004779D6 13794700                DWORD 00477913
:004779DA 4A794700                DWORD 0047794A
:004779DE 4A794700                DWORD 0047794A
:004779E2 C2794700                DWORD 004779C2


:004779E6 0006                    add byte ptr [esi], al
:004779E8 06                      push es
:004779E9 06                      push es
:004779EA 06                      push es
:004779EB 06                      push es
:004779EC 06                      push es
:004779ED 06                      push es
:004779EE 06                      push es
:004779EF 06                      push es
:004779F0 06                      push es
:004779F1 06                      push es
:004779F2 06                      push es
:004779F3 06                      push es
:004779F4 06                      push es
:004779F5 06                      push es
:004779F6 06                      push es
:004779F7 06                      push es
:004779F8 06                      push es
:004779F9 06                      push es
:004779FA 06                      push es
:004779FB 06                      push es
:004779FC 06                      push es
:004779FD 06                      push es
:004779FE 06                      push es
:004779FF 06                      push es
:00477A00 06                      push es
:00477A01 06                      push es
:00477A02 06                      push es
:00477A03 06                      push es
:00477A04 06                      push es
:00477A05 06                      push es
:00477A06 06                      push es
:00477A07 06                      push es
:00477A08 06                      push es
:00477A09 06                      push es
:00477A0A 06                      push es
:00477A0B 06                      push es
:00477A0C 0106                    add dword ptr [esi], eax
:00477A0E 0206                    add al, byte ptr [esi]
:00477A10 06                      push es
:00477A11 06                      push es
:00477A12 06                      push es
:00477A13 06                      push es
:00477A14 06                      push es
:00477A15 06                      push es
:00477A16 06                      push es
:00477A17 06                      push es

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004779CF(C)
|
:00477A18 06                      push es
:00477A19 06                      push es
:00477A1A 06                      push es
:00477A1B 06                      push es
:00477A1C 06                      push es
:00477A1D 06                      push es
:00477A1E 06                      push es
:00477A1F 06                      push es

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004779D7(C)
|
:00477A20 06                      push es
:00477A21 06                      push es
:00477A22 06                      push es
:00477A23 06                      push es
:00477A24 06                      push es
:00477A25 06                      push es
:00477A26 06                      push es
:00477A27 06                      push es
:00477A28 06                      push es
:00477A29 06                      push es
:00477A2A 06                      push es
:00477A2B 06                      push es

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004779E3(C)
|
:00477A2C 06                      push es
:00477A2D 06                      push es
:00477A2E 06                      push es
:00477A2F 06                      push es
:00477A30 06                      push es
:00477A31 06                      push es
:00477A32 06                      push es
:00477A33 06                      push es
:00477A34 06                      push es
:00477A35 06                      push es
:00477A36 06                      push es
:00477A37 06                      push es
:00477A38 06                      push es
:00477A39 06                      push es
:00477A3A 06                      push es
:00477A3B 06                      push es
:00477A3C 06                      push es
:00477A3D 06                      push es
:00477A3E 06                      push es
:00477A3F 06                      push es
:00477A40 06                      push es
:00477A41 06                      push es
:00477A42 06                      push es
:00477A43 06                      push es
:00477A44 06                      push es
:00477A45 06                      push es
:00477A46 06                      push es
:00477A47 06                      push es
:00477A48 06                      push es
:00477A49 06                      push es
:00477A4A 06                      push es
:00477A4B 06                      push es
:00477A4C 06                      push es
:00477A4D 06                      push es
:00477A4E 06                      push es
:00477A4F 06                      push es
:00477A50 06                      push es
:00477A51 06                      push es
:00477A52 06                      push es
:00477A53 06                      push es
:00477A54 06                      push es
:00477A55 06                      push es
:00477A56 06                      push es
:00477A57 06                      push es
:00477A58 06                      push es
:00477A59 06                      push es
:00477A5A 06                      push es
:00477A5B 06                      push es
:00477A5C 06                      push es
:00477A5D 06                      push es
:00477A5E 06                      push es
:00477A5F 06                      push es
:00477A60 06                      push es
:00477A61 06                      push es
:00477A62 06                      push es
:00477A63 06                      push es
:00477A64 06                      push es
:00477A65 06                      push es
:00477A66 06                      push es
:00477A67 06                      push es
:00477A68 06                      push es
:00477A69 06                      push es
:00477A6A 06                      push es
:00477A6B 06                      push es
:00477A6C 06                      push es
:00477A6D 06                      push es
:00477A6E 06                      push es
:00477A6F 06                      push es
:00477A70 06                      push es
:00477A71 06                      push es
:00477A72 06                      push es
:00477A73 06                      push es
:00477A74 06                      push es
:00477A75 06                      push es
:00477A76 06                      push es
:00477A77 06                      push es
:00477A78 06                      push es
:00477A79 06                      push es
:00477A7A 06                      push es
:00477A7B 06                      push es
:00477A7C 06                      push es
:00477A7D 06                      push es
:00477A7E 06                      push es
:00477A7F 06                      push es
:00477A80 06                      push es
:00477A81 06                      push es
:00477A82 06                      push es
:00477A83 06                      push es
:00477A84 06                      push es
:00477A85 06                      push es
:00477A86 06                      push es
:00477A87 06                      push es
:00477A88 06                      push es
:00477A89 06                      push es
:00477A8A 06                      push es
:00477A8B 06                      push es
:00477A8C 06                      push es
:00477A8D 06                      push es
:00477A8E 06                      push es
:00477A8F 06                      push es
:00477A90 06                      push es
:00477A91 06                      push es
:00477A92 06                      push es
:00477A93 06                      push es
:00477A94 06                      push es
:00477A95 06                      push es
:00477A96 06                      push es
:00477A97 06                      push es
:00477A98 06                      push es
:00477A99 06                      push es
:00477A9A 06                      push es
:00477A9B 06                      push es
:00477A9C 06                      push es
:00477A9D 06                      push es
:00477A9E 06                      push es
:00477A9F 06                      push es
:00477AA0 06                      push es
:00477AA1 06                      push es
:00477AA2 06                      push es
:00477AA3 06                      push es
:00477AA4 06                      push es
:00477AA5 06                      push es
:00477AA6 06                      push es
:00477AA7 06                      push es
:00477AA8 06                      push es
:00477AA9 06                      push es
:00477AAA 06                      push es
:00477AAB 06                      push es
:00477AAC 06                      push es
:00477AAD 06                      push es
:00477AAE 06                      push es
:00477AAF 06                      push es
:00477AB0 06                      push es
:00477AB1 06                      push es
:00477AB2 06                      push es
:00477AB3 06                      push es
:00477AB4 06                      push es
:00477AB5 06                      push es
:00477AB6 06                      push es
:00477AB7 06                      push es
:00477AB8 06                      push es
:00477AB9 06                      push es
:00477ABA 06                      push es
:00477ABB 06                      push es
:00477ABC 06                      push es
:00477ABD 06                      push es
:00477ABE 06                      push es
:00477ABF 06                      push es
:00477AC0 06                      push es
:00477AC1 06                      push es
:00477AC2 06                      push es
:00477AC3 06                      push es
:00477AC4 06                      push es
:00477AC5 06                      push es
:00477AC6 06                      push es
:00477AC7 06                      push es
:00477AC8 06                      push es
:00477AC9 06                      push es
:00477ACA 06                      push es
:00477ACB 06                      push es
:00477ACC 06                      push es
:00477ACD 06                      push es
:00477ACE 06                      push es
:00477ACF 06                      push es
:00477AD0 06                      push es
:00477AD1 06                      push es
:00477AD2 06                      push es
:00477AD3 06                      push es
:00477AD4 06                      push es
:00477AD5 06                      push es
:00477AD6 0306                    add eax, dword ptr [esi]
:00477AD8 0406                    add al, 06
:00477ADA 06                      push es
:00477ADB 05                      BYTE 05h


* Referenced by a CALL at Addresses:
|:00411426   , :00413CCB   , :00414C0F   , :00414E64   , :0042CC4D   
|:00434FA2   , :00434FBC   , :00434FD6   , :0044963B   , :0044964C   
|:004499FA   , :00459A9E   , :00459D4E   , :0045B011   , :0045B107   
|:0045B11B   , :004769AB   , :00476B91   , :00477E85   , :0047872A   
|:0047888E   , :004794AB   , :00479A3F   , :00479FAB   , :00479FB6   
|:0047A68A   , :0047AE1F   
|
:00477ADC 55                      push ebp
:00477ADD 8BEC                    mov ebp, esp
:00477ADF 83EC08                  sub esp, 00000008
:00477AE2 56                      push esi
:00477AE3 894DF8                  mov dword ptr [ebp-08], ecx
:00477AE6 E8373EF9FF              call 0040B922
:00477AEB 85C0                    test eax, eax
:00477AED 7504                    jne 00477AF3
:00477AEF 0CFF                    or al, FF
:00477AF1 EB6A                    jmp 00477B5D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00477AED(C)
|
:00477AF3 C645FC00                mov [ebp-04], 00
:00477AF7 EB08                    jmp 00477B01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00477B59(U)
|
:00477AF9 8A45FC                  mov al, byte ptr [ebp-04]
:00477AFC 0401                    add al, 01
:00477AFE 8845FC                  mov byte ptr [ebp-04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00477AF7(U)
|
:00477B01 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00477B04 81E1FF000000            and ecx, 000000FF
:00477B0A 83F973                  cmp ecx, 00000073
:00477B0D 7D4C                    jge 00477B5B
:00477B0F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00477B12 81E1FF000000            and ecx, 000000FF
:00477B18 6BC924                  imul ecx, 00000024
:00477B1B 81C1502C4B00            add ecx, 004B2C50
:00477B21 E86A11FAFF              call 00418C90
:00477B26 25FF000000              and eax, 000000FF
:00477B2B 85C0                    test eax, eax
:00477B2D 742A                    je 00477B59
:00477B2F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00477B32 81E1FF000000            and ecx, 000000FF
:00477B38 6BC924                  imul ecx, 00000024
:00477B3B 81C1502C4B00            add ecx, 004B2C50
:00477B41 E82A7BFEFF              call 0045F670
:00477B46 8BF0                    mov esi, eax
:00477B48 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00477B4B E8B019F9FF              call 00409500
:00477B50 3BF0                    cmp esi, eax
:00477B52 7505                    jne 00477B59
:00477B54 8A45FC                  mov al, byte ptr [ebp-04]
:00477B57 EB04                    jmp 00477B5D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00477B2D(C), :00477B52(C)
|
:00477B59 EB9E                    jmp 00477AF9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00477B0D(C)
|
:00477B5B 0CFF                    or al, FF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00477AF1(U), :00477B57(U)
|
:00477B5D 5E                      pop esi
:00477B5E 8BE5                    mov esp, ebp
:00477B60 5D                      pop ebp
:00477B61 C3                      ret



* Referenced by a CALL at Addresses:
|:00478342   , :0047896A   
|
:00477B62 55                      push ebp
:00477B63 8BEC                    mov ebp, esp
:00477B65 6AFF                    push FFFFFFFF
:00477B67 684C5D4800              push 00485D4C
:00477B6C 64A100000000            mov eax, dword ptr fs:[00000000]
:00477B72 50                      push eax
:00477B73 64892500000000          mov dword ptr fs:[00000000], esp
:00477B7A 81EC04020000            sub esp, 00000204
:00477B80 898DF4FDFFFF            mov dword ptr [ebp+FFFFFDF4], ecx

* Possible Reference to Dialog: DialogID_011C, CONTROL_ID:05A6, ""
                                  |
:00477B86 68A6050000              push 000005A6
:00477B8B 8B4508                  mov eax, dword ptr [ebp+08]
:00477B8E 50                      push eax
:00477B8F FF15DC624800            call dword ptr [004862DC]
:00477B95 85C0                    test eax, eax
:00477B97 7505                    jne 00477B9E
:00477B99 E938070000              jmp 004782D6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00477B97(C)
|
:00477B9E 8B8DF4FDFFFF            mov ecx, dword ptr [ebp+FFFFFDF4]
:00477BA4 33D2                    xor edx, edx
:00477BA6 8A512B                  mov dl, byte ptr [ecx+2B]
:00477BA9 8B0495A8BE4800          mov eax, dword ptr [4*edx+0048BEA8]
:00477BB0 50                      push eax

* Possible Reference to Dialog: DialogID_011C, CONTROL_ID:03F8, "Attribute"
                                  |
:00477BB1 68F8030000              push 000003F8
:00477BB6 8B4D08                  mov ecx, dword ptr [ebp+08]
:00477BB9 51                      push ecx
:00477BBA FF15D8624800            call dword ptr [004862D8]
:00477BC0 C785D0FEFFFF00000000    mov dword ptr [ebp+FFFFFED0], 00000000
:00477BCA EB0F                    jmp 00477BDB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00477C30(U)
|
:00477BCC 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:00477BD2 83C201                  add edx, 00000001
:00477BD5 8995D0FEFFFF            mov dword ptr [ebp+FFFFFED0], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00477BCA(U)
|
:00477BDB 83BDD0FEFFFF07          cmp dword ptr [ebp+FFFFFED0], 00000007
:00477BE2 734E                    jnb 00477C32
:00477BE4 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:00477BEA D1E0                    shl eax, 1
:00477BEC 50                      push eax
:00477BED 8B8DF4FDFFFF            mov ecx, dword ptr [ebp+FFFFFDF4]
:00477BF3 33D2                    xor edx, edx
:00477BF5 8A512B                  mov dl, byte ptr [ecx+2B]
:00477BF8 8BCA                    mov ecx, edx
:00477BFA 6BC91B                  imul ecx, 0000001B
:00477BFD 81C1A0BF4A00            add ecx, 004ABFA0
:00477C03 E8B819F9FF              call 004095C0
:00477C08 25FF000000              and eax, 000000FF
:00477C0D 85C0                    test eax, eax
:00477C0F 741F                    je 00477C30
:00477C11 8B85D0FEFFFF            mov eax, dword ptr [ebp+FFFFFED0]
:00477C17 8B0C8520BC4800          mov ecx, dword ptr [4*eax+0048BC20]
:00477C1E 51                      push ecx

* Possible Reference to Dialog: DialogID_011C, CONTROL_ID:05A8, "Sword"
                                  |
:00477C1F 68A8050000              push 000005A8
:00477C24 8B5508                  mov edx, dword ptr [ebp+08]
:00477C27 52                      push edx
:00477C28 FF15D8624800            call dword ptr [004862D8]
:00477C2E EB02                    jmp 00477C32

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00477C0F(C)
|
:00477C30 EB9A                    jmp 00477BCC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00477BE2(C), :00477C2E(U)
|
:00477C32 83BDD0FEFFFF07          cmp dword ptr [ebp+FFFFFED0], 00000007
:00477C39 7514                    jne 00477C4F

* Possible StringData Ref from Data Obj ->"--"
                                  |
:00477C3B 68CCEB4800              push 0048EBCC

* Possible Reference to Dialog: DialogID_011C, CONTROL_ID:05A8, "Sword"
                                  |
:00477C40 68A8050000              push 000005A8
:00477C45 8B4508                  mov eax, dword ptr [ebp+08]
:00477C48 50                      push eax
:00477C49 FF15D8624800            call dword ptr [004862D8]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00477C39(C)
|

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:00477C4F C785D0FEFFFF07000000    mov dword ptr [ebp+FFFFFED0], 00000007
:00477C59 EB0F                    jmp 00477C6A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00477CBD(U)
|
:00477C5B 8B8DD0FEFFFF            mov ecx, dword ptr [ebp+FFFFFED0]
:00477C61 83C101                  add ecx, 00000001
:00477C64 898DD0FEFFFF            mov dword ptr [ebp+FFFFFED0], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00477C59(U)
|
:00477C6A 83BDD0FEFFFF09          cmp dword ptr [ebp+FFFFFED0], 00000009
:00477C71 734C                    jnb 00477CBF
:00477C73 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:00477C79 D1E2                    shl edx, 1
:00477C7B 52                      push edx
:00477C7C 8B85F4FDFFFF            mov eax, dword ptr [ebp+FFFFFDF4]
:00477C82 33C9                    xor ecx, ecx
:00477C84 8A482B                  mov cl, byte ptr [eax+2B]
:00477C87 6BC91B                  imul ecx, 0000001B
:00477C8A 81C1A0BF4A00            add ecx, 004ABFA0
:00477C90 E82B19F9FF              call 004095C0
:00477C95 25FF000000              and eax, 000000FF
:00477C9A 85C0                    test eax, eax
:00477C9C 741F                    je 00477CBD
:00477C9E 8B95D0FEFFFF            mov edx, dword ptr [ebp+FFFFFED0]
:00477CA4 8B049520BC4800          mov eax, dword ptr [4*edx+0048BC20]
:00477CAB 50                      push eax

* Possible Reference to Dialog: DialogID_011C, CONTROL_ID:05A7, "Armor"
                                  |
:00477CAC 68A7050000              push 000005A7
:00477CB1 8B4D08                  mov ecx, dword ptr [ebp+08]
:00477CB4 51                      push ecx
:00477CB5 FF15D8624800            call dword ptr [004862D8]
:00477CBB EB02                    jmp 00477CBF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00477C9C(C)
|
:00477CBD EB9C                    jmp 00477C5B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00477C71(C), :00477CBB(U)
|
:00477CBF 83BDD0FEFFFF09          cmp dword ptr [ebp+FFFFFED0], 00000009
:00477CC6 7514                    jne 00477CDC

* Possible StringData Ref from Data Obj ->"--"
                                  |
:00477CC8 68D0EB4800              push 0048EBD0

* Possible Reference to Dialog: DialogID_011C, CONTROL_ID:05A7, "Armor"
                                  |
:00477CCD 68A7050000              push 000005A7
:00477CD2 8B5508                  mov edx, dword ptr [ebp+08]
:00477CD5 52                      push edx
:00477CD6 FF15D8624800            call dword ptr [004862D8]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00477CC6(C)
|
:00477CDC 6A00                    push 00000000
:00477CDE 8B85F4FDFFFF            mov eax, dword ptr [ebp+FFFFFDF4]
:00477CE4 33C9                    xor ecx, ecx
:00477CE6 8A482B                  mov cl, byte ptr [eax+2B]
:00477CE9 6BC91B                  imul ecx, 0000001B
:00477CEC 81C1A0BF4A00            add ecx, 004ABFA0
:00477CF2 E8A918F9FF              call 004095A0
:00477CF7 25FF000000              and eax, 000000FF
:00477CFC 8B148524BE4800          mov edx, dword ptr [4*eax+0048BE24]
:00477D03 52                      push edx

* Possible Reference to Dialog: DialogID_011C, CONTROL_ID:0474, "A"
                                  |
:00477D04 6874040000              push 00000474
:00477D09 8B4508                  mov eax, dword ptr [ebp+08]
:00477D0C 50                      push eax
:00477D0D FF15D8624800            call dword ptr [004862D8]
:00477D13 6A02                    push 00000002
:00477D15 8B8DF4FDFFFF            mov ecx, dword ptr [ebp+FFFFFDF4]
:00477D1B 33D2                    xor edx, edx
:00477D1D 8A512B                  mov dl, byte ptr [ecx+2B]
:00477D20 8BCA                    mov ecx, edx
:00477D22 6BC91B                  imul ecx, 0000001B
:00477D25 81C1A0BF4A00            add ecx, 004ABFA0
:00477D2B E87018F9FF              call 004095A0
:00477D30 25FF000000              and eax, 000000FF
:00477D35 8B048524BE4800          mov eax, dword ptr [4*eax+0048BE24]
:00477D3C 50                      push eax

* Possible Reference to Dialog: DialogID_011C, CONTROL_ID:0561, "A"
                                  |
:00477D3D 6861050000              push 00000561
:00477D42 8B4D08                  mov ecx, dword ptr [ebp+08]
:00477D45 51                      push ecx
:00477D46 FF15D8624800            call dword ptr [004862D8]
:00477D4C 6A01                    push 00000001
:00477D4E 8B95F4FDFFFF            mov edx, dword ptr [ebp+FFFFFDF4]
:00477D54 33C0                    xor eax, eax
:00477D56 8A422B                  mov al, byte ptr [edx+2B]
:00477D59 8BC8                    mov ecx, eax
:00477D5B 6BC91B                  imul ecx, 0000001B
:00477D5E 81C1A0BF4A00            add ecx, 004ABFA0
:00477D64 E83718F9FF              call 004095A0
:00477D69 25FF000000              and eax, 000000FF
:00477D6E 8B0C8524BE4800          mov ecx, dword ptr [4*eax+0048BE24]
:00477D75 51                      push ecx

* Possible Reference to Dialog: DialogID_011C, CONTROL_ID:03F1, "A"
                                  |
:00477D76 68F1030000              push 000003F1
:00477D7B 8B5508                  mov edx, dword ptr [ebp+08]
:00477D7E 52                      push edx
:00477D7F FF15D8624800            call dword ptr [004862D8]
:00477D85 6A03                    push 00000003
:00477D87 8B85F4FDFFFF            mov eax, dword ptr [ebp+FFFFFDF4]
:00477D8D 33C9                    xor ecx, ecx
:00477D8F 8A482B                  mov cl, byte ptr [eax+2B]
:00477D92 6BC91B                  imul ecx, 0000001B
:00477D95 81C1A0BF4A00            add ecx, 004ABFA0
:00477D9B E80018F9FF              call 004095A0
:00477DA0 25FF000000              and eax, 000000FF
:00477DA5 8B148524BE4800          mov edx, dword ptr [4*eax+0048BE24]
:00477DAC 52                      push edx

* Possible Reference to Dialog: DialogID_011C, CONTROL_ID:0562, "A"
                                  |
:00477DAD 6862050000              push 00000562
:00477DB2 8B4508                  mov eax, dword ptr [ebp+08]
:00477DB5 50                      push eax
:00477DB6 FF15D8624800            call dword ptr [004862D8]
:00477DBC 6A04                    push 00000004
:00477DBE 8B8DF4FDFFFF            mov ecx, dword ptr [ebp+FFFFFDF4]
:00477DC4 33D2                    xor edx, edx
:00477DC6 8A512B                  mov dl, byte ptr [ecx+2B]
:00477DC9 8BCA                    mov ecx, edx
:00477DCB 6BC91B                  imul ecx, 0000001B
:00477DCE 81C1A0BF4A00            add ecx, 004ABFA0
:00477DD4 E8C717F9FF              call 004095A0
:00477DD9 25FF000000              and eax, 000000FF
:00477DDE 8B048524BE4800          mov eax, dword ptr [4*eax+0048BE24]
:00477DE5 50                      push eax

* Possible Reference to Dialog: DialogID_011C, CONTROL_ID:0563, "A"
                                  |
:00477DE6 6863050000              push 00000563
:00477DEB 8B4D08                  mov ecx, dword ptr [ebp+08]
:00477DEE 51                      push ecx
:00477DEF FF15D8624800            call dword ptr [004862D8]
:00477DF5 6A00                    push 00000000
:00477DF7 8B95F4FDFFFF            mov edx, dword ptr [ebp+FFFFFDF4]
:00477DFD 33C0                    xor eax, eax
:00477DFF 8A422B                  mov al, byte ptr [edx+2B]
:00477E02 8BC8                    mov ecx, eax
:00477E04 6BC91B                  imul ecx, 0000001B
:00477E07 81C1A0BF4A00            add ecx, 004ABFA0
:00477E0D E89E3AF9FF              call 0040B8B0
:00477E12 25FF000000              and eax, 000000FF
:00477E17 50                      push eax

* Possible Reference to Dialog: DialogID_011A, CONTROL_ID:0564, ""
                                  |
:00477E18 6864050000              push 00000564
:00477E1D 8B4D08                  mov ecx, dword ptr [ebp+08]
:00477E20 51                      push ecx
:00477E21 FF15E4624800            call dword ptr [004862E4]
:00477E27 8B95F4FDFFFF            mov edx, dword ptr [ebp+FFFFFDF4]
:00477E2D 33C0                    xor eax, eax
:00477E2F 8A422B                  mov al, byte ptr [edx+2B]
:00477E32 50                      push eax
:00477E33 8D8D04FEFFFF            lea ecx, dword ptr [ebp+FFFFFE04]
:00477E39 51                      push ecx
:00477E3A E88741F9FF              call 0040BFC6
:00477E3F 83C408                  add esp, 00000008
:00477E42 8D9504FEFFFF            lea edx, dword ptr [ebp+FFFFFE04]
:00477E48 52                      push edx

* Possible Reference to Dialog: DialogID_011C, CONTROL_ID:05A6, ""
                                  |
:00477E49 68A6050000              push 000005A6
:00477E4E 8B4508                  mov eax, dword ptr [ebp+08]
:00477E51 50                      push eax
:00477E52 FF15D8624800            call dword ptr [004862D8]
:00477E58 8B8DF4FDFFFF            mov ecx, dword ptr [ebp+FFFFFDF4]
:00477E5E E89D16F9FF              call 00409500
:00477E63 8985FCFDFFFF            mov dword ptr [ebp+FFFFFDFC], eax
:00477E69 8B8DF4FDFFFF            mov ecx, dword ptr [ebp+FFFFFDF4]
:00477E6F E8D3EAF8FF              call 00406947
:00477E74 25FF000000              and eax, 000000FF
:00477E79 8985ECFEFFFF            mov dword ptr [ebp+FFFFFEEC], eax
:00477E7F 8B8DF4FDFFFF            mov ecx, dword ptr [ebp+FFFFFDF4]
:00477E85 E852FCFFFF              call 00477ADC
:00477E8A 888500FEFFFF            mov byte ptr [ebp+FFFFFE00], al
:00477E90 83BDECFEFFFF22          cmp dword ptr [ebp+FFFFFEEC], 00000022
:00477E97 0F83B3000000            jnb 00477F50
:00477E9D E8803AF9FF              call 0040B922
:00477EA2 85C0                    test eax, eax
:00477EA4 0F8495000000            je 00477F3F
:00477EAA 8B8D00FEFFFF            mov ecx, dword ptr [ebp+FFFFFE00]
:00477EB0 81E1FF000000            and ecx, 000000FF
:00477EB6 83F973                  cmp ecx, 00000073
:00477EB9 0F8D80000000            jnl 00477F3F
:00477EBF 8B8D00FEFFFF            mov ecx, dword ptr [ebp+FFFFFE00]
:00477EC5 81E1FF000000            and ecx, 000000FF
:00477ECB 6BC924                  imul ecx, 00000024
:00477ECE 81C1502C4B00            add ecx, 004B2C50
:00477ED4 E8417DFCFF              call 0043FC1A
:00477ED9 25FF000000              and eax, 000000FF
:00477EDE 83F802                  cmp eax, 00000002
:00477EE1 7F27                    jg 00477F0A
:00477EE3 8B8D00FEFFFF            mov ecx, dword ptr [ebp+FFFFFE00]
:00477EE9 81E1FF000000            and ecx, 000000FF
:00477EEF 6BC924                  imul ecx, 00000024
:00477EF2 81C1502C4B00            add ecx, 004B2C50
:00477EF8 E81D7DFCFF              call 0043FC1A
:00477EFD 25FF000000              and eax, 000000FF
:00477F02 8985F0FDFFFF            mov dword ptr [ebp+FFFFFDF0], eax
:00477F08 EB0A                    jmp 00477F14

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00477EE1(C)
|
:00477F0A C785F0FDFFFF02000000    mov dword ptr [ebp+FFFFFDF0], 00000002

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00477F08(U)
|
:00477F14 8A95F0FDFFFF            mov dl, byte ptr [ebp+FFFFFDF0]
:00477F1A 8895F8FDFFFF            mov byte ptr [ebp+FFFFFDF8], dl
:00477F20 8B85ECFEFFFF            mov eax, dword ptr [ebp+FFFFFEEC]
:00477F26 6BC003                  imul eax, 00000003
:00477F29 8B8DF8FDFFFF            mov ecx, dword ptr [ebp+FFFFFDF8]
:00477F2F 81E1FF000000            and ecx, 000000FF
:00477F35 03C1                    add eax, ecx
:00477F37 8985ECFEFFFF            mov dword ptr [ebp+FFFFFEEC], eax
:00477F3D EB0F                    jmp 00477F4E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00477EA4(C), :00477EB9(C)
|
:00477F3F 8B95ECFEFFFF            mov edx, dword ptr [ebp+FFFFFEEC]
:00477F45 6BD203                  imul edx, 00000003
:00477F48 8995ECFEFFFF            mov dword ptr [ebp+FFFFFEEC], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00477F3D(U)
|
:00477F4E EB0F                    jmp 00477F5F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00477E97(C)
|
:00477F50 8B85ECFEFFFF            mov eax, dword ptr [ebp+FFFFFEEC]
:00477F56 83C044                  add eax, 00000044
:00477F59 8985ECFEFFFF            mov dword ptr [ebp+FFFFFEEC], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00477F4E(U)
|
:00477F5F 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:00477F65 E846B3F8FF              call 004032B0
:00477F6A C745FC00000000          mov [ebp-04], 00000000
:00477F71 E8AC39F9FF              call 0040B922
:00477F76 85C0                    test eax, eax
:00477F78 742E                    je 00477FA8
:00477F7A 8B8D00FEFFFF            mov ecx, dword ptr [ebp+FFFFFE00]
:00477F80 81E1FF000000            and ecx, 000000FF
:00477F86 83F973                  cmp ecx, 00000073
:00477F89 7D1D                    jge 00477FA8
:00477F8B 8B9500FEFFFF            mov edx, dword ptr [ebp+FFFFFE00]
:00477F91 81E2FF000000            and edx, 000000FF
:00477F97 52                      push edx
:00477F98 E8D565FCFF              call 0043E572
:00477F9D 83C404                  add esp, 00000004
:00477FA0 8985D4FEFFFF            mov dword ptr [ebp+FFFFFED4], eax
:00477FA6 EB5A                    jmp 00478002

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00477F78(C), :00477F89(C)
|

* Possible StringData Ref from Data Obj ->"UNIT_MOV.E5"
                                  |
:00477FA8 68E0BB4800              push 0048BBE0
:00477FAD 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:00477FB3 E87D7BFAFF              call 0041FB35
:00477FB8 6A04                    push 00000004
:00477FBA 6A00                    push 00000000
:00477FBC 6800690000              push 00006900
:00477FC1 B9C8E44A00              mov ecx, 004AE4C8
:00477FC6 E8757A0000              call 0047FA40
:00477FCB 50                      push eax
:00477FCC 8B85ECFEFFFF            mov eax, dword ptr [ebp+FFFFFEEC]
:00477FD2 50                      push eax
:00477FD3 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:00477FD9 E8AB7CFAFF              call 0041FC89
:00477FDE 6A04                    push 00000004
:00477FE0 6A00                    push 00000000
:00477FE2 68009F0000              push 00009F00
:00477FE7 B9C8E44A00              mov ecx, 004AE4C8
:00477FEC E84F7A0000              call 0047FA40
:00477FF1 8985D4FEFFFF            mov dword ptr [ebp+FFFFFED4], eax
:00477FF7 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:00477FFD E8C312FAFF              call 004192C5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00477FA6(U)
|
:00478002 6A02                    push 00000002
:00478004 E8DA4A0000              call 0047CAE3
:00478009 83C404                  add esp, 00000004

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:0047800C 6A07                    push 00000007
:0047800E E8B7510000              call 0047D1CA
:00478013 83C404                  add esp, 00000004
:00478016 6A00                    push 00000000
:00478018 6A12                    push 00000012
:0047801A 6A04                    push 00000004
:0047801C E8D0510000              call 0047D1F1
:00478021 83C40C                  add esp, 0000000C
:00478024 6A04                    push 00000004
:00478026 6A00                    push 00000000
:00478028 68C08D0100              push 00018DC0
:0047802D B950EB4A00              mov ecx, 004AEB50
:00478032 E8097A0000              call 0047FA40
:00478037 50                      push eax
:00478038 8B0D0C684800            mov ecx, dword ptr [0048680C]
:0047803E 51                      push ecx
:0047803F 8B1508684800            mov edx, dword ptr [00486808]
:00478045 52                      push edx
:00478046 6A00                    push 00000000
:00478048 6A00                    push 00000000
:0047804A E84C600000              call 0047E09B
:0047804F 83C414                  add esp, 00000014
:00478052 8B85D4FEFFFF            mov eax, dword ptr [ebp+FFFFFED4]
:00478058 50                      push eax
:00478059 8B0D0C684800            mov ecx, dword ptr [0048680C]
:0047805F 51                      push ecx
:00478060 8B1508684800            mov edx, dword ptr [00486808]
:00478066 52                      push edx
:00478067 6A00                    push 00000000
:00478069 6A00                    push 00000000
:0047806B E82B600000              call 0047E09B
:00478070 83C414                  add esp, 00000014

* Possible Reference to Dialog: DialogID_011A, CONTROL_ID:03FA, ""
                                  |
:00478073 68FA030000              push 000003FA
:00478078 8B4508                  mov eax, dword ptr [ebp+08]
:0047807B 50                      push eax
:0047807C FF15DC624800            call dword ptr [004862DC]
:00478082 50                      push eax
:00478083 8B0DD45F4B00            mov ecx, dword ptr [004B5FD4]
:00478089 51                      push ecx
:0047808A FF157C634800            call dword ptr [0048637C]
:00478090 8D95D8FEFFFF            lea edx, dword ptr [ebp+FFFFFED8]
:00478096 52                      push edx

* Possible Reference to Dialog: DialogID_011A, CONTROL_ID:03FA, ""
                                  |
:00478097 68FA030000              push 000003FA
:0047809C 8B4508                  mov eax, dword ptr [ebp+08]
:0047809F 50                      push eax
:004780A0 FF15DC624800            call dword ptr [004862DC]
:004780A6 50                      push eax
:004780A7 E8BE9AFEFF              call 00461B6A
:004780AC 83C408                  add esp, 00000008
:004780AF 6A0C                    push 0000000C
:004780B1 8B0D0C684800            mov ecx, dword ptr [0048680C]
:004780B7 83C102                  add ecx, 00000002
:004780BA 51                      push ecx
:004780BB 8B1508684800            mov edx, dword ptr [00486808]
:004780C1 83C202                  add edx, 00000002
:004780C4 52                      push edx
:004780C5 8B85E4FEFFFF            mov eax, dword ptr [ebp+FFFFFEE4]
:004780CB 8B8DDCFEFFFF            mov ecx, dword ptr [ebp+FFFFFEDC]
:004780D1 8D4401FE                lea eax, dword ptr [ecx+eax-02]
:004780D5 2B050C684800            sub eax, dword ptr [0048680C]
:004780DB 99                      cdq
:004780DC 2BC2                    sub eax, edx
:004780DE D1F8                    sar eax, 1
:004780E0 50                      push eax
:004780E1 8B95E0FEFFFF            mov edx, dword ptr [ebp+FFFFFEE0]
:004780E7 8B85D8FEFFFF            mov eax, dword ptr [ebp+FFFFFED8]
:004780ED 8D4410FE                lea eax, dword ptr [eax+edx-02]
:004780F1 2B0508684800            sub eax, dword ptr [00486808]
:004780F7 99                      cdq
:004780F8 2BC2                    sub eax, edx
:004780FA D1F8                    sar eax, 1
:004780FC 50                      push eax
:004780FD 6A00                    push 00000000

* Possible Reference to Dialog: DialogID_011A, CONTROL_ID:03FA, ""
                                  |
:004780FF 68FA030000              push 000003FA
:00478104 8B4D08                  mov ecx, dword ptr [ebp+08]
:00478107 51                      push ecx
:00478108 FF15DC624800            call dword ptr [004862DC]
:0047810E 50                      push eax
:0047810F FF1580624800            call dword ptr [00486280]
:00478115 6A00                    push 00000000
:00478117 8B150C684800            mov edx, dword ptr [0048680C]
:0047811D 52                      push edx
:0047811E A108684800              mov eax, dword ptr [00486808]
:00478123 50                      push eax
:00478124 6A00                    push 00000000
:00478126 6A00                    push 00000000
:00478128 8B0DD45F4B00            mov ecx, dword ptr [004B5FD4]
:0047812E 51                      push ecx
:0047812F FF15BC624800            call dword ptr [004862BC]
:00478135 6A05                    push 00000005
:00478137 8B15D45F4B00            mov edx, dword ptr [004B5FD4]
:0047813D 52                      push edx
:0047813E FF15E0624800            call dword ptr [004862E0]
:00478144 8B85F4FDFFFF            mov eax, dword ptr [ebp+FFFFFDF4]
:0047814A 33C9                    xor ecx, ecx
:0047814C 8A482B                  mov cl, byte ptr [eax+2B]
:0047814F 6BC91B                  imul ecx, 0000001B
:00478152 81C1A0BF4A00            add ecx, 004ABFA0
:00478158 E84378FDFF              call 0044F9A0
:0047815D 8885E8FEFFFF            mov byte ptr [ebp+FFFFFEE8], al

* Possible StringData Ref from Data Obj ->"HITAREA.E5"
                                  |
:00478163 6840BB4800              push 0048BB40
:00478168 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0047816E E8C279FAFF              call 0041FB35
:00478173 68180A4B00              push 004B0A18
:00478178 8B95E8FEFFFF            mov edx, dword ptr [ebp+FFFFFEE8]
:0047817E 81E2FF000000            and edx, 000000FF
:00478184 52                      push edx
:00478185 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0047818B E8F97AFAFF              call 0041FC89
:00478190 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:00478196 E82A11FAFF              call 004192C5
:0047819B 6A00                    push 00000000
:0047819D A110604B00              mov eax, dword ptr [004B6010]
:004781A2 50                      push eax
:004781A3 FF15E0624800            call dword ptr [004862E0]
:004781A9 6A11                    push 00000011
:004781AB E833490000              call 0047CAE3
:004781B0 83C404                  add esp, 00000004

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:004781B3 6A07                    push 00000007
:004781B5 E810500000              call 0047D1CA
:004781BA 83C404                  add esp, 00000004
:004781BD 6A00                    push 00000000
:004781BF 6A00                    push 00000000
:004781C1 6A00                    push 00000000
:004781C3 E829500000              call 0047D1F1
:004781C8 83C40C                  add esp, 0000000C
:004781CB 68180A4B00              push 004B0A18
:004781D0 8B0DFC684800            mov ecx, dword ptr [004868FC]
:004781D6 51                      push ecx
:004781D7 8B15F8684800            mov edx, dword ptr [004868F8]
:004781DD 52                      push edx
:004781DE 6A00                    push 00000000
:004781E0 6A00                    push 00000000
:004781E2 E8B45E0000              call 0047E09B
:004781E7 83C414                  add esp, 00000014
:004781EA 8D85D8FEFFFF            lea eax, dword ptr [ebp+FFFFFED8]
:004781F0 50                      push eax

* Possible Reference to Dialog: DialogID_011C, CONTROL_ID:05A9, ""
                                  |
:004781F1 68A9050000              push 000005A9
:004781F6 8B4D08                  mov ecx, dword ptr [ebp+08]
:004781F9 51                      push ecx
:004781FA FF15DC624800            call dword ptr [004862DC]
:00478200 50                      push eax
:00478201 E86499FEFF              call 00461B6A
:00478206 83C408                  add esp, 00000008
:00478209 6A0C                    push 0000000C
:0047820B 8B15FC684800            mov edx, dword ptr [004868FC]
:00478211 83C202                  add edx, 00000002
:00478214 52                      push edx
:00478215 A1F8684800              mov eax, dword ptr [004868F8]
:0047821A 83C002                  add eax, 00000002
:0047821D 50                      push eax
:0047821E 8B8DE4FEFFFF            mov ecx, dword ptr [ebp+FFFFFEE4]
:00478224 8B95DCFEFFFF            mov edx, dword ptr [ebp+FFFFFEDC]
:0047822A 8D440AFE                lea eax, dword ptr [edx+ecx-02]
:0047822E 2B05FC684800            sub eax, dword ptr [004868FC]
:00478234 99                      cdq
:00478235 2BC2                    sub eax, edx
:00478237 D1F8                    sar eax, 1
:00478239 50                      push eax
:0047823A 8B85E0FEFFFF            mov eax, dword ptr [ebp+FFFFFEE0]
:00478240 8B8DD8FEFFFF            mov ecx, dword ptr [ebp+FFFFFED8]
:00478246 8D4401FE                lea eax, dword ptr [ecx+eax-02]
:0047824A 2B05F8684800            sub eax, dword ptr [004868F8]
:00478250 99                      cdq
:00478251 2BC2                    sub eax, edx
:00478253 D1F8                    sar eax, 1
:00478255 50                      push eax
:00478256 6A00                    push 00000000

* Possible Reference to Dialog: DialogID_011C, CONTROL_ID:05A9, ""
                                  |
:00478258 68A9050000              push 000005A9
:0047825D 8B5508                  mov edx, dword ptr [ebp+08]
:00478260 52                      push edx
:00478261 FF15DC624800            call dword ptr [004862DC]
:00478267 50                      push eax
:00478268 FF1580624800            call dword ptr [00486280]

* Possible Reference to Dialog: DialogID_011C, CONTROL_ID:05A9, ""
                                  |
:0047826E 68A9050000              push 000005A9
:00478273 8B4508                  mov eax, dword ptr [ebp+08]
:00478276 50                      push eax
:00478277 FF15DC624800            call dword ptr [004862DC]
:0047827D 50                      push eax
:0047827E 8B0D10604B00            mov ecx, dword ptr [004B6010]
:00478284 51                      push ecx
:00478285 FF157C634800            call dword ptr [0048637C]
:0047828B 6A00                    push 00000000
:0047828D 8B15FC684800            mov edx, dword ptr [004868FC]
:00478293 52                      push edx
:00478294 A1F8684800              mov eax, dword ptr [004868F8]
:00478299 50                      push eax
:0047829A 6A00                    push 00000000
:0047829C 6A00                    push 00000000
:0047829E 8B0D10604B00            mov ecx, dword ptr [004B6010]
:004782A4 51                      push ecx
:004782A5 FF15BC624800            call dword ptr [004862BC]
:004782AB 6A05                    push 00000005
:004782AD 8B1510604B00            mov edx, dword ptr [004B6010]
:004782B3 52                      push edx
:004782B4 FF15E0624800            call dword ptr [004862E0]
:004782BA 6A00                    push 00000000
:004782BC E822480000              call 0047CAE3
:004782C1 83C404                  add esp, 00000004
:004782C4 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:004782CB 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:004782D1 E8FAAFF8FF              call 004032D0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00477B99(U)
|
:004782D6 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004782D9 64890D00000000          mov dword ptr fs:[00000000], ecx
:004782E0 8BE5                    mov esp, ebp
:004782E2 5D                      pop ebp
:004782E3 C20400                  ret 0004


:004782E6 55                      push ebp
:004782E7 8BEC                    mov ebp, esp
:004782E9 51                      push ecx
:004782EA 8B450C                  mov eax, dword ptr [ebp+0C]
:004782ED 8945FC                  mov dword ptr [ebp-04], eax
:004782F0 817DFC10010000          cmp dword ptr [ebp-04], 00000110
:004782F7 7714                    ja 0047830D
:004782F9 817DFC10010000          cmp dword ptr [ebp-04], 00000110
:00478300 7426                    je 00478328
:00478302 837DFC02                cmp dword ptr [ebp-04], 00000002
:00478306 7441                    je 00478349
:00478308 E9AC000000              jmp 004783B9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004782F7(C)
|
:0047830D 817DFC36010000          cmp dword ptr [ebp-04], 00000136
:00478314 0F848B000000            je 004783A5
:0047831A 817DFC38010000          cmp dword ptr [ebp-04], 00000138
:00478321 746C                    je 0047838F
:00478323 E991000000              jmp 004783B9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00478300(C)
|
:00478328 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047832B 51                      push ecx
:0047832C 8B1504754B00            mov edx, dword ptr [004B7504]
:00478332 8B0C95F06C4B00          mov ecx, dword ptr [4*edx+004B6CF0]
:00478339 6BC948                  imul ecx, 00000048
:0047833C 81C1681B4A00            add ecx, 004A1B68
:00478342 E81BF8FFFF              call 00477B62
:00478347 EB70                    jmp 004783B9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00478306(C)
|
:00478349 6A00                    push 00000000
:0047834B A1D45F4B00              mov eax, dword ptr [004B5FD4]
:00478350 50                      push eax
:00478351 FF15E0624800            call dword ptr [004862E0]
:00478357 6A00                    push 00000000
:00478359 8B0D10604B00            mov ecx, dword ptr [004B6010]
:0047835F 51                      push ecx
:00478360 FF15E0624800            call dword ptr [004862E0]
:00478366 8B15686A4B00            mov edx, dword ptr [004B6A68]
:0047836C 52                      push edx
:0047836D A1D45F4B00              mov eax, dword ptr [004B5FD4]
:00478372 50                      push eax
:00478373 FF157C634800            call dword ptr [0048637C]
:00478379 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:0047837F 51                      push ecx
:00478380 8B1510604B00            mov edx, dword ptr [004B6010]
:00478386 52                      push edx
:00478387 FF157C634800            call dword ptr [0048637C]
:0047838D EB2A                    jmp 004783B9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00478321(C)
|
:0047838F 6A00                    push 00000000
:00478391 6A01                    push 00000001
:00478393 8B4514                  mov eax, dword ptr [ebp+14]
:00478396 50                      push eax
:00478397 8B4D10                  mov ecx, dword ptr [ebp+10]
:0047839A 51                      push ecx
:0047839B E8EB91FFFF              call 0047158B
:004783A0 83C410                  add esp, 00000010
:004783A3 EB14                    jmp 004783B9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00478314(C)
|
:004783A5 6A00                    push 00000000
:004783A7 6A01                    push 00000001
:004783A9 8B5514                  mov edx, dword ptr [ebp+14]
:004783AC 52                      push edx
:004783AD 8B4510                  mov eax, dword ptr [ebp+10]
:004783B0 50                      push eax
:004783B1 E8D58EFFFF              call 0047128B
:004783B6 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00478308(U), :00478323(U), :00478347(U), :0047838D(U), :004783A3(U)
|
:004783B9 33C0                    xor eax, eax
:004783BB 8BE5                    mov esp, ebp
:004783BD 5D                      pop ebp
:004783BE C21000                  ret 0010



* Referenced by a CALL at Addresses:
|:00478594   , :0047895B   
|
:004783C1 55                      push ebp
:004783C2 8BEC                    mov ebp, esp
:004783C4 81ECD4000000            sub esp, 000000D4
:004783CA 898D2CFFFFFF            mov dword ptr [ebp+FFFFFF2C], ecx

* Possible Reference to Dialog: DialogID_011C, CONTROL_ID:05A6, ""
                                  |
:004783D0 68A6050000              push 000005A6
:004783D5 8B4508                  mov eax, dword ptr [ebp+08]
:004783D8 50                      push eax
:004783D9 FF15DC624800            call dword ptr [004862DC]
:004783DF 85C0                    test eax, eax
:004783E1 7505                    jne 004783E8
:004783E3 E965010000              jmp 0047854D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004783E1(C)
|
:004783E8 6A00                    push 00000000
:004783EA 6A01                    push 00000001
:004783EC 8B8D2CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF2C]
:004783F2 E8395AFAFF              call 0041DE30
:004783F7 25FF000000              and eax, 000000FF
:004783FC 50                      push eax

* Possible Reference to Dialog: DialogID_011A, CONTROL_ID:03FA, ""
                                  |
:004783FD 68FA030000              push 000003FA
:00478402 8B4D08                  mov ecx, dword ptr [ebp+08]
:00478405 51                      push ecx
:00478406 FF15E4624800            call dword ptr [004862E4]
:0047840C 6A00                    push 00000000
:0047840E 6A01                    push 00000001
:00478410 8B8D2CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF2C]
:00478416 E8955AFAFF              call 0041DEB0
:0047841B 25FF000000              and eax, 000000FF
:00478420 50                      push eax

* Possible Reference to Dialog: DialogID_011C, CONTROL_ID:0561, "A"
                                  |
:00478421 6861050000              push 00000561
:00478426 8B5508                  mov edx, dword ptr [ebp+08]
:00478429 52                      push edx
:0047842A FF15E4624800            call dword ptr [004862E4]
:00478430 6A00                    push 00000000
:00478432 6A01                    push 00000001
:00478434 8B8D2CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF2C]
:0047843A E8315AFAFF              call 0041DE70
:0047843F 25FF000000              and eax, 000000FF
:00478444 50                      push eax

* Possible Reference to Dialog: DialogID_011C, CONTROL_ID:03F1, "A"
                                  |
:00478445 68F1030000              push 000003F1
:0047844A 8B4508                  mov eax, dword ptr [ebp+08]
:0047844D 50                      push eax
:0047844E FF15E4624800            call dword ptr [004862E4]
:00478454 6A00                    push 00000000
:00478456 6A01                    push 00000001
:00478458 8B8D2CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF2C]
:0047845E E8CD5AFAFF              call 0041DF30
:00478463 25FF000000              and eax, 000000FF
:00478468 50                      push eax

* Possible Reference to Dialog: DialogID_011C, CONTROL_ID:0562, "A"
                                  |
:00478469 6862050000              push 00000562
:0047846E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00478471 51                      push ecx
:00478472 FF15E4624800            call dword ptr [004862E4]
:00478478 6A00                    push 00000000
:0047847A 6A01                    push 00000001
:0047847C 8B8D2CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF2C]
:00478482 E8695AFAFF              call 0041DEF0
:00478487 25FF000000              and eax, 000000FF
:0047848C 50                      push eax

* Possible Reference to Dialog: DialogID_011C, CONTROL_ID:0563, "A"
                                  |
:0047848D 6863050000              push 00000563
:00478492 8B5508                  mov edx, dword ptr [ebp+08]
:00478495 52                      push edx
:00478496 FF15E4624800            call dword ptr [004862E4]
:0047849C 8B8D2CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF2C]
:004784A2 E85910F9FF              call 00409500
:004784A7 898530FFFFFF            mov dword ptr [ebp+FFFFFF30], eax
:004784AD 81BD30FFFFFFAE000000    cmp dword ptr [ebp+FFFFFF30], 000000AE
:004784B7 7318                    jnb 004784D1
:004784B9 8B8530FFFFFF            mov eax, dword ptr [ebp+FFFFFF30]
:004784BF 50                      push eax
:004784C0 8D8D34FFFFFF            lea ecx, dword ptr [ebp+FFFFFF34]
:004784C6 51                      push ecx
:004784C7 E81C3BF9FF              call 0040BFE8
:004784CC 83C408                  add esp, 00000008
:004784CF EB07                    jmp 004784D8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004784B7(C)
|
:004784D1 C68534FFFFFF00          mov byte ptr [ebp+FFFFFF34], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004784CF(U)
|
:004784D8 8D9534FFFFFF            lea edx, dword ptr [ebp+FFFFFF34]
:004784DE 52                      push edx

* Possible Reference to Dialog: DialogID_011C, CONTROL_ID:05A6, ""
                                  |
:004784DF 68A6050000              push 000005A6
:004784E4 8B4508                  mov eax, dword ptr [ebp+08]
:004784E7 50                      push eax
:004784E8 FF15D8624800            call dword ptr [004862D8]
:004784EE 8B8D30FFFFFF            mov ecx, dword ptr [ebp+FFFFFF30]
:004784F4 51                      push ecx
:004784F5 E8961CFAFF              call 0041A190
:004784FA 83C404                  add esp, 00000004
:004784FD 85C0                    test eax, eax
:004784FF 742F                    je 00478530
:00478501 8B952CFFFFFF            mov edx, dword ptr [ebp+FFFFFF2C]
:00478507 33C0                    xor eax, eax
:00478509 8A4229                  mov al, byte ptr [edx+29]
:0047850C 50                      push eax
:0047850D 8B8D2CFFFFFF            mov ecx, dword ptr [ebp+FFFFFF2C]
:00478513 33D2                    xor edx, edx
:00478515 8A5127                  mov dl, byte ptr [ecx+27]
:00478518 52                      push edx

* Possible StringData Ref from Data Obj ->" %2d   %2d"
                                  |
:00478519 68D4EB4800              push 0048EBD4
:0047851E 8D8534FFFFFF            lea eax, dword ptr [ebp+FFFFFF34]
:00478524 50                      push eax
:00478525 FF15C0624800            call dword ptr [004862C0]
:0047852B 83C410                  add esp, 00000010
:0047852E EB07                    jmp 00478537

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004784FF(C)
|
:00478530 C68534FFFFFF00          mov byte ptr [ebp+FFFFFF34], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047852E(U)
|
:00478537 8D8D34FFFFFF            lea ecx, dword ptr [ebp+FFFFFF34]
:0047853D 51                      push ecx
:0047853E 68CE050000              push 000005CE
:00478543 8B5508                  mov edx, dword ptr [ebp+08]
:00478546 52                      push edx
:00478547 FF15D8624800            call dword ptr [004862D8]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004783E3(U)
|
:0047854D 8BE5                    mov esp, ebp
:0047854F 5D                      pop ebp
:00478550 C20400                  ret 0004


:00478553 55                      push ebp
:00478554 8BEC                    mov ebp, esp
:00478556 51                      push ecx
:00478557 8B450C                  mov eax, dword ptr [ebp+0C]
:0047855A 8945FC                  mov dword ptr [ebp-04], eax
:0047855D 817DFC10010000          cmp dword ptr [ebp-04], 00000110
:00478564 7414                    je 0047857A
:00478566 817DFC36010000          cmp dword ptr [ebp-04], 00000136
:0047856D 7442                    je 004785B1
:0047856F 817DFC38010000          cmp dword ptr [ebp-04], 00000138
:00478576 7423                    je 0047859B
:00478578 EB4D                    jmp 004785C7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00478564(C)
|
:0047857A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047857D 51                      push ecx
:0047857E 8B1504754B00            mov edx, dword ptr [004B7504]
:00478584 8B0C95F06C4B00          mov ecx, dword ptr [4*edx+004B6CF0]
:0047858B 6BC948                  imul ecx, 00000048
:0047858E 81C1681B4A00            add ecx, 004A1B68
:00478594 E828FEFFFF              call 004783C1
:00478599 EB30                    jmp 004785CB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00478576(C)
|
:0047859B 6A00                    push 00000000
:0047859D 6A01                    push 00000001
:0047859F 8B4514                  mov eax, dword ptr [ebp+14]
:004785A2 50                      push eax
:004785A3 8B4D10                  mov ecx, dword ptr [ebp+10]
:004785A6 51                      push ecx
:004785A7 E8DF8FFFFF              call 0047158B
:004785AC 83C410                  add esp, 00000010
:004785AF EB1A                    jmp 004785CB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047856D(C)
|
:004785B1 6A00                    push 00000000
:004785B3 6A01                    push 00000001
:004785B5 8B5514                  mov edx, dword ptr [ebp+14]
:004785B8 52                      push edx
:004785B9 8B4510                  mov eax, dword ptr [ebp+10]
:004785BC 50                      push eax
:004785BD E8C98CFFFF              call 0047128B
:004785C2 83C410                  add esp, 00000010
:004785C5 EB04                    jmp 004785CB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00478578(U)
|
:004785C7 33C0                    xor eax, eax
:004785C9 EB05                    jmp 004785D0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00478599(U), :004785AF(U), :004785C5(U)
|
:004785CB B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004785C9(U)
|
:004785D0 8BE5                    mov esp, ebp
:004785D2 5D                      pop ebp
:004785D3 C21000                  ret 0010


:004785D6 55                      push ebp
:004785D7 8BEC                    mov ebp, esp
:004785D9 E807000000              call 004785E5
:004785DE E811000000              call 004785F4
:004785E3 5D                      pop ebp
:004785E4 C3                      ret



* Referenced by a CALL at Address:
|:004785D9   
|
:004785E5 55                      push ebp
:004785E6 8BEC                    mov ebp, esp
:004785E8 B9786C4B00              mov ecx, 004B6C78
:004785ED E8BE2C0000              call 0047B2B0
:004785F2 5D                      pop ebp
:004785F3 C3                      ret



* Referenced by a CALL at Address:
|:004785DE   
|
:004785F4 55                      push ebp
:004785F5 8BEC                    mov ebp, esp
:004785F7 6806864700              push 00478606
:004785FC E8FF8A0000              call 00481100
:00478601 83C404                  add esp, 00000004
:00478604 5D                      pop ebp
:00478605 C3                      ret


:00478606 55                      push ebp
:00478607 8BEC                    mov ebp, esp
:00478609 B9786C4B00              mov ecx, 004B6C78
:0047860E E87DD1FFFF              call 00475790
:00478613 5D                      pop ebp
:00478614 C3                      ret



* Referenced by a CALL at Address:
|:0047894D   
|
:00478615 55                      push ebp
:00478616 8BEC                    mov ebp, esp
:00478618 51                      push ecx
:00478619 894DFC                  mov dword ptr [ebp-04], ecx
:0047861C 6821050000              push 00000521
:00478621 8B4508                  mov eax, dword ptr [ebp+08]
:00478624 50                      push eax
:00478625 FF15DC624800            call dword ptr [004862DC]
:0047862B 85C0                    test eax, eax
:0047862D 7502                    jne 00478631
:0047862F EB0A                    jmp 0047863B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047862D(C)
|
:00478631 B9786C4B00              mov ecx, 004B6C78
:00478636 E885D2FEFF              call 004658C0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047862F(U)
|
:0047863B 8BE5                    mov esp, ebp
:0047863D 5D                      pop ebp
:0047863E C20400                  ret 0004


:00478641 55                      push ebp
:00478642 8BEC                    mov ebp, esp
:00478644 817D0C10010000          cmp dword ptr [ebp+0C], 00000110
:0047864B 751D                    jne 0047866A
:0047864D 6821050000              push 00000521
:00478652 8B4510                  mov eax, dword ptr [ebp+10]
:00478655 50                      push eax
:00478656 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00478659 51                      push ecx
:0047865A 8B5508                  mov edx, dword ptr [ebp+08]
:0047865D 52                      push edx
:0047865E B9786C4B00              mov ecx, 004B6C78
:00478663 E82FC4FEFF              call 00464A97
:00478668 EB1A                    jmp 00478684

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047864B(C)
|
:0047866A 8B4514                  mov eax, dword ptr [ebp+14]
:0047866D 50                      push eax
:0047866E 8B4D10                  mov ecx, dword ptr [ebp+10]
:00478671 51                      push ecx
:00478672 8B550C                  mov edx, dword ptr [ebp+0C]
:00478675 52                      push edx
:00478676 8B4508                  mov eax, dword ptr [ebp+08]
:00478679 50                      push eax
:0047867A B9786C4B00              mov ecx, 004B6C78
:0047867F E813C4FEFF              call 00464A97

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00478668(U)
|
:00478684 5D                      pop ebp
:00478685 C21000                  ret 0010



* Referenced by a CALL at Addresses:
|:004790CF   , :00479344   , :004793A4   , :00479767   
|
:00478688 55                      push ebp
:00478689 8BEC                    mov ebp, esp
:0047868B 83EC74                  sub esp, 00000074
:0047868E 894D90                  mov dword ptr [ebp-70], ecx
:00478691 833D04754B0000          cmp dword ptr [004B7504], 00000000
:00478698 761A                    jbe 004786B4
:0047869A 6A01                    push 00000001

* Possible Reference to Dialog: DialogID_00C1, CONTROL_ID:0403, ""
                                  |
:0047869C 6803040000              push 00000403
:004786A1 8B4508                  mov eax, dword ptr [ebp+08]
:004786A4 50                      push eax
:004786A5 FF15DC624800            call dword ptr [004862DC]
:004786AB 50                      push eax
:004786AC FF15E8624800            call dword ptr [004862E8]
:004786B2 EB18                    jmp 004786CC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00478698(C)
|
:004786B4 6A00                    push 00000000

* Possible Reference to Dialog: DialogID_00C1, CONTROL_ID:0403, ""
                                  |
:004786B6 6803040000              push 00000403
:004786BB 8B4D08                  mov ecx, dword ptr [ebp+08]
:004786BE 51                      push ecx
:004786BF FF15DC624800            call dword ptr [004862DC]
:004786C5 50                      push eax
:004786C6 FF15E8624800            call dword ptr [004862E8]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004786B2(U)
|
:004786CC 6800020000              push 00000200
:004786D1 6A01                    push 00000001
:004786D3 8B1504754B00            mov edx, dword ptr [004B7504]
:004786D9 52                      push edx
:004786DA E8AA730000              call 0047FA89
:004786DF 83C40C                  add esp, 0000000C
:004786E2 894598                  mov dword ptr [ebp-68], eax
:004786E5 8B4598                  mov eax, dword ptr [ebp-68]
:004786E8 813C85F06C4B0000020000  cmp dword ptr [4*eax+004B6CF0], 00000200
:004786F3 731A                    jnb 0047870F
:004786F5 6A01                    push 00000001

* Possible Reference to Dialog: DialogID_00C1, CONTROL_ID:0404, ""
                                  |
:004786F7 6804040000              push 00000404
:004786FC 8B4D08                  mov ecx, dword ptr [ebp+08]
:004786FF 51                      push ecx
:00478700 FF15DC624800            call dword ptr [004862DC]
:00478706 50                      push eax
:00478707 FF15E8624800            call dword ptr [004862E8]
:0047870D EB18                    jmp 00478727

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004786F3(C)
|
:0047870F 6A00                    push 00000000

* Possible Reference to Dialog: DialogID_00C1, CONTROL_ID:0404, ""
                                  |
:00478711 6804040000              push 00000404
:00478716 8B5508                  mov edx, dword ptr [ebp+08]
:00478719 52                      push edx
:0047871A FF15DC624800            call dword ptr [004862DC]
:00478720 50                      push eax
:00478721 FF15E8624800            call dword ptr [004862E8]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047870D(U)
|
:00478727 8B4D90                  mov ecx, dword ptr [ebp-70]
:0047872A E8ADF3FFFF              call 00477ADC
:0047872F 884594                  mov byte ptr [ebp-6C], al
:00478732 6840754B00              push 004B7540
:00478737 68EB030000              push 000003EB
:0047873C 8B4508                  mov eax, dword ptr [ebp+08]
:0047873F 50                      push eax
:00478740 FF15DC624800            call dword ptr [004862DC]
:00478746 50                      push eax
:00478747 FF1560634800            call dword ptr [00486360]
:0047874D 8B4D90                  mov ecx, dword ptr [ebp-70]
:00478750 E802F0F8FF              call 00407757
:00478755 50                      push eax

* Possible Reference to Dialog: DialogID_011A, CONTROL_ID:03EA, "Name"
                                  |
:00478756 68EA030000              push 000003EA
:0047875B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047875E 51                      push ecx
:0047875F FF15DC624800            call dword ptr [004862DC]
:00478765 50                      push eax
:00478766 FF1560634800            call dword ptr [00486360]
:0047876C 8B5594                  mov edx, dword ptr [ebp-6C]
:0047876F 81E2FF000000            and edx, 000000FF
:00478775 81FAFF000000            cmp edx, 000000FF
:0047877B 751D                    jne 0047879A
:0047877D 6A00                    push 00000000
:0047877F 68F7030000              push 000003F7
:00478784 8B4508                  mov eax, dword ptr [ebp+08]
:00478787 50                      push eax
:00478788 FF15DC624800            call dword ptr [004862DC]
:0047878E 50                      push eax
:0047878F FF15E0624800            call dword ptr [004862E0]
:00478795 E99D000000              jmp 00478837

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047877B(C)
|
:0047879A 8B4D94                  mov ecx, dword ptr [ebp-6C]
:0047879D 81E1FF000000            and ecx, 000000FF
:004787A3 6BC924                  imul ecx, 00000024
:004787A6 81C1502C4B00            add ecx, 004B2C50
:004787AC E86974FCFF              call 0043FC1A
:004787B1 25FF000000              and eax, 000000FF
:004787B6 89458C                  mov dword ptr [ebp-74], eax
:004787B9 837D8C03                cmp dword ptr [ebp-74], 00000003
:004787BD 774C                    ja 0047880B
:004787BF 8B4D8C                  mov ecx, dword ptr [ebp-74]
:004787C2 FF248DFF894700          jmp dword ptr [4*ecx+004789FF]

* Possible StringData Ref from Data Obj ->"[ Ҿ ]"
                                  |
:004787C9 68ECEB4800              push 0048EBEC
:004787CE 68F7030000              push 000003F7
:004787D3 8B5508                  mov edx, dword ptr [ebp+08]
:004787D6 52                      push edx
:004787D7 FF15D8624800            call dword ptr [004862D8]
:004787DD EB40                    jmp 0047881F

* Possible StringData Ref from Data Obj ->"[ Ѿ ]"
                                  |
:004787DF 68F8EB4800              push 0048EBF8
:004787E4 68F7030000              push 000003F7
:004787E9 8B4508                  mov eax, dword ptr [ebp+08]
:004787EC 50                      push eax
:004787ED FF15D8624800            call dword ptr [004862D8]
:004787F3 EB2A                    jmp 0047881F

* Possible StringData Ref from Data Obj ->"[ о ]"
                                  |
:004787F5 6804EC4800              push 0048EC04
:004787FA 68F7030000              push 000003F7
:004787FF 8B4D08                  mov ecx, dword ptr [ebp+08]
:00478802 51                      push ecx
:00478803 FF15D8624800            call dword ptr [004862D8]
:00478809 EB14                    jmp 0047881F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004787BD(C)
|
:0047880B 6844754B00              push 004B7544
:00478810 68F7030000              push 000003F7
:00478815 8B5508                  mov edx, dword ptr [ebp+08]
:00478818 52                      push edx
:00478819 FF15D8624800            call dword ptr [004862D8]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004787DD(U), :004787F3(U), :00478809(U)
|
:0047881F 6A05                    push 00000005
:00478821 68F7030000              push 000003F7
:00478826 8B4508                  mov eax, dword ptr [ebp+08]
:00478829 50                      push eax
:0047882A FF15DC624800            call dword ptr [004862DC]
:00478830 50                      push eax
:00478831 FF15E0624800            call dword ptr [004862E0]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00478795(U)
|
:00478837 8B4D90                  mov ecx, dword ptr [ebp-70]
:0047883A 33D2                    xor edx, edx
:0047883C 8A512B                  mov dl, byte ptr [ecx+2B]
:0047883F 8B0495A8BE4800          mov eax, dword ptr [4*edx+0048BEA8]
:00478846 50                      push eax

* Possible Reference to Dialog: DialogID_011C, CONTROL_ID:03F8, "Attribute"
                                  |
:00478847 68F8030000              push 000003F8
:0047884C 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047884F 51                      push ecx
:00478850 FF15DC624800            call dword ptr [004862DC]
:00478856 50                      push eax
:00478857 FF1560634800            call dword ptr [00486360]
:0047885D 6A0A                    push 0000000A
:0047885F 8D559C                  lea edx, dword ptr [ebp-64]
:00478862 52                      push edx
:00478863 8B4590                  mov eax, dword ptr [ebp-70]
:00478866 33C9                    xor ecx, ecx
:00478868 8A482C                  mov cl, byte ptr [eax+2C]
:0047886B 51                      push ecx
:0047886C E85FD0FFFF              call 004758D0
:00478871 83C40C                  add esp, 0000000C
:00478874 50                      push eax
:00478875 68F9030000              push 000003F9
:0047887A 8B5508                  mov edx, dword ptr [ebp+08]
:0047887D 52                      push edx
:0047887E FF15DC624800            call dword ptr [004862DC]
:00478884 50                      push eax
:00478885 FF1560634800            call dword ptr [00486360]
:0047888B 8B4D90                  mov ecx, dword ptr [ebp-70]
:0047888E E849F2FFFF              call 00477ADC
:00478893 50                      push eax
:00478894 68A3050000              push 000005A3
:00478899 8B4508                  mov eax, dword ptr [ebp+08]
:0047889C 50                      push eax
:0047889D FF15DC624800            call dword ptr [004862DC]
:004788A3 50                      push eax
:004788A4 E866010000              call 00478A0F
:004788A9 83C408                  add esp, 00000008
:004788AC 6A04                    push 00000004
:004788AE 6A00                    push 00000000
:004788B0 6A00                    push 00000000
:004788B2 B910114A00              mov ecx, 004A1110
:004788B7 E884710000              call 0047FA40
:004788BC 50                      push eax
:004788BD 8B4D90                  mov ecx, dword ptr [ebp-70]
:004788C0 E8E2ECF8FF              call 004075A7
:004788C5 50                      push eax
:004788C6 B938C54A00              mov ecx, 004AC538
:004788CB E8B973FAFF              call 0041FC89
:004788D0 6A01                    push 00000001
:004788D2 E80C420000              call 0047CAE3
:004788D7 83C404                  add esp, 00000004

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:004788DA 6A07                    push 00000007
:004788DC E8E9480000              call 0047D1CA
:004788E1 83C404                  add esp, 00000004
:004788E4 6A00                    push 00000000
:004788E6 6A12                    push 00000012
:004788E8 6A04                    push 00000004
:004788EA E802490000              call 0047D1F1
:004788EF 83C40C                  add esp, 0000000C
:004788F2 B910114A00              mov ecx, 004A1110
:004788F7 E89457F9FF              call 0040E090
:004788FC 50                      push eax
:004788FD 8B0DFC674800            mov ecx, dword ptr [004867FC]
:00478903 51                      push ecx
:00478904 8B15F8674800            mov edx, dword ptr [004867F8]
:0047890A 52                      push edx
:0047890B 6A00                    push 00000000
:0047890D 6A00                    push 00000000
:0047890F E887570000              call 0047E09B
:00478914 83C414                  add esp, 00000014
:00478917 6A00                    push 00000000
:00478919 E8C5410000              call 0047CAE3
:0047891E 83C404                  add esp, 00000004
:00478921 E83D7FFEFF              call 00460863
:00478926 A1A86B4B00              mov eax, dword ptr [004B6BA8]
:0047892B 50                      push eax
:0047892C 8B4D90                  mov ecx, dword ptr [ebp-70]
:0047892F E853E0FFFF              call 00476987
:00478934 8B0DAC6B4B00            mov ecx, dword ptr [004B6BAC]
:0047893A 51                      push ecx
:0047893B 8B4D90                  mov ecx, dword ptr [ebp-70]
:0047893E E868E5FFFF              call 00476EAB
:00478943 8B15B06B4B00            mov edx, dword ptr [004B6BB0]
:00478949 52                      push edx
:0047894A 8B4D90                  mov ecx, dword ptr [ebp-70]
:0047894D E8C3FCFFFF              call 00478615
:00478952 A1B46B4B00              mov eax, dword ptr [004B6BB4]
:00478957 50                      push eax
:00478958 8B4D90                  mov ecx, dword ptr [ebp-70]
:0047895B E861FAFFFF              call 004783C1
:00478960 8B0DB86B4B00            mov ecx, dword ptr [004B6BB8]
:00478966 51                      push ecx
:00478967 8B4D90                  mov ecx, dword ptr [ebp-70]
:0047896A E8F3F1FFFF              call 00477B62
:0047896F 8B4D90                  mov ecx, dword ptr [ebp-70]
:00478972 E8890BF9FF              call 00409500
:00478977 85C0                    test eax, eax
:00478979 754E                    jne 004789C9
:0047897B 6A05                    push 00000005
:0047897D 682B050000              push 0000052B
:00478982 8B5508                  mov edx, dword ptr [ebp+08]
:00478985 52                      push edx
:00478986 FF15DC624800            call dword ptr [004862DC]
:0047898C 50                      push eax
:0047898D FF15E0624800            call dword ptr [004862E0]
:00478993 6A05                    push 00000005
:00478995 6832040000              push 00000432
:0047899A 8B4508                  mov eax, dword ptr [ebp+08]
:0047899D 50                      push eax
:0047899E FF15DC624800            call dword ptr [004862DC]
:004789A4 50                      push eax
:004789A5 FF15E0624800            call dword ptr [004862E0]
:004789AB 6A00                    push 00000000
:004789AD B970074B00              mov ecx, 004B0770
:004789B2 E81958F9FF              call 0040E1D0
:004789B7 50                      push eax
:004789B8 6832040000              push 00000432
:004789BD 8B4D08                  mov ecx, dword ptr [ebp+08]
:004789C0 51                      push ecx
:004789C1 FF15E4624800            call dword ptr [004862E4]
:004789C7 EB30                    jmp 004789F9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00478979(C)
|
:004789C9 6A00                    push 00000000
:004789CB 682B050000              push 0000052B
:004789D0 8B5508                  mov edx, dword ptr [ebp+08]
:004789D3 52                      push edx
:004789D4 FF15DC624800            call dword ptr [004862DC]
:004789DA 50                      push eax
:004789DB FF15E0624800            call dword ptr [004862E0]
:004789E1 6A00                    push 00000000
:004789E3 6832040000              push 00000432
:004789E8 8B4508                  mov eax, dword ptr [ebp+08]
:004789EB 50                      push eax
:004789EC FF15DC624800            call dword ptr [004862DC]
:004789F2 50                      push eax
:004789F3 FF15E0624800            call dword ptr [004862E0]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004789C7(U)
|
:004789F9 8BE5                    mov esp, ebp
:004789FB 5D                      pop ebp
:004789FC C20400                  ret 0004



:004789FF C9874700                DWORD 004787C9
:00478A03 DF874700                DWORD 004787DF
:00478A07 F5874700                DWORD 004787F5
:00478A0B F5874700                DWORD 004787F5



* Referenced by a CALL at Address:
|:004788A4   
|
:00478A0F 55                      push ebp
:00478A10 8BEC                    mov ebp, esp
:00478A12 81EC00010000            sub esp, 00000100
:00478A18 8B450C                  mov eax, dword ptr [ebp+0C]
:00478A1B 25FF000000              and eax, 000000FF
:00478A20 3DFF000000              cmp eax, 000000FF
:00478A25 7514                    jne 00478A3B
:00478A27 68006D4800              push 00486D00
:00478A2C 8B4D08                  mov ecx, dword ptr [ebp+08]
:00478A2F 51                      push ecx
:00478A30 FF1560634800            call dword ptr [00486360]
:00478A36 E93C050000              jmp 00478F77

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00478A25(C)
|
:00478A3B C68500FFFFFF00          mov byte ptr [ebp+FFFFFF00], 00
:00478A42 6A08                    push 00000008
:00478A44 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00478A47 81E1FF000000            and ecx, 000000FF
:00478A4D 6BC924                  imul ecx, 00000024
:00478A50 81C1502C4B00            add ecx, 004B2C50
:00478A56 E885DCF8FF              call 004066E0
:00478A5B 85C0                    test eax, eax
:00478A5D 7428                    je 00478A87
:00478A5F 68086D4800              push 00486D08
:00478A64 8D9500FFFFFF            lea edx, dword ptr [ebp+FFFFFF00]
:00478A6A 52                      push edx
:00478A6B E830870000              call 004811A0
:00478A70 83C408                  add esp, 00000008

* Possible StringData Ref from Data Obj ->" "
                                  |
:00478A73 6810EC4800              push 0048EC10
:00478A78 8D8500FFFFFF            lea eax, dword ptr [ebp+FFFFFF00]
:00478A7E 50                      push eax
:00478A7F E81C720000              call 0047FCA0
:00478A84 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00478A5D(C)
|
:00478A87 6A02                    push 00000002
:00478A89 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00478A8C 81E1FF000000            and ecx, 000000FF
:00478A92 6BC924                  imul ecx, 00000024
:00478A95 81C1502C4B00            add ecx, 004B2C50
:00478A9B E840DCF8FF              call 004066E0
:00478AA0 85C0                    test eax, eax
:00478AA2 7428                    je 00478ACC
:00478AA4 68106D4800              push 00486D10
:00478AA9 8D8D00FFFFFF            lea ecx, dword ptr [ebp+FFFFFF00]
:00478AAF 51                      push ecx
:00478AB0 E8EB860000              call 004811A0
:00478AB5 83C408                  add esp, 00000008

* Possible StringData Ref from Data Obj ->" "
                                  |
:00478AB8 6814EC4800              push 0048EC14
:00478ABD 8D9500FFFFFF            lea edx, dword ptr [ebp+FFFFFF00]
:00478AC3 52                      push edx
:00478AC4 E8D7710000              call 0047FCA0
:00478AC9 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00478AA2(C)
|
:00478ACC 6A10                    push 00000010
:00478ACE 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00478AD1 81E1FF000000            and ecx, 000000FF
:00478AD7 6BC924                  imul ecx, 00000024
:00478ADA 81C1502C4B00            add ecx, 004B2C50
:00478AE0 E8FBDBF8FF              call 004066E0
:00478AE5 85C0                    test eax, eax
:00478AE7 7428                    je 00478B11
:00478AE9 68186D4800              push 00486D18
:00478AEE 8D8500FFFFFF            lea eax, dword ptr [ebp+FFFFFF00]
:00478AF4 50                      push eax
:00478AF5 E8A6860000              call 004811A0
:00478AFA 83C408                  add esp, 00000008

* Possible StringData Ref from Data Obj ->" "
                                  |
:00478AFD 6818EC4800              push 0048EC18
:00478B02 8D8D00FFFFFF            lea ecx, dword ptr [ebp+FFFFFF00]
:00478B08 51                      push ecx
:00478B09 E892710000              call 0047FCA0
:00478B0E 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00478AE7(C)
|
:00478B11 6A04                    push 00000004
:00478B13 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00478B16 81E1FF000000            and ecx, 000000FF
:00478B1C 6BC924                  imul ecx, 00000024
:00478B1F 81C1502C4B00            add ecx, 004B2C50
:00478B25 E8B6DBF8FF              call 004066E0
:00478B2A 85C0                    test eax, eax
:00478B2C 7428                    je 00478B56
:00478B2E 68206D4800              push 00486D20
:00478B33 8D9500FFFFFF            lea edx, dword ptr [ebp+FFFFFF00]
:00478B39 52                      push edx
:00478B3A E861860000              call 004811A0
:00478B3F 83C408                  add esp, 00000008

* Possible StringData Ref from Data Obj ->" "
                                  |
:00478B42 681CEC4800              push 0048EC1C
:00478B47 8D8500FFFFFF            lea eax, dword ptr [ebp+FFFFFF00]
:00478B4D 50                      push eax
:00478B4E E84D710000              call 0047FCA0
:00478B53 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00478B2C(C)
|
:00478B56 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00478B59 81E1FF000000            and ecx, 000000FF
:00478B5F 6BC924                  imul ecx, 00000024
:00478B62 81C1502C4B00            add ecx, 004B2C50
:00478B68 E82354FAFF              call 0041DF90
:00478B6D 25FF000000              and eax, 000000FF
:00478B72 83F804                  cmp eax, 00000004
:00478B75 7C3E                    jl 00478BB5
:00478B77 68E06A4800              push 00486AE0
:00478B7C 8D8D00FFFFFF            lea ecx, dword ptr [ebp+FFFFFF00]
:00478B82 51                      push ecx
:00478B83 E818860000              call 004811A0
:00478B88 83C408                  add esp, 00000008
:00478B8B 68286D4800              push 00486D28
:00478B90 8D9500FFFFFF            lea edx, dword ptr [ebp+FFFFFF00]
:00478B96 52                      push edx
:00478B97 E804860000              call 004811A0
:00478B9C 83C408                  add esp, 00000008

* Possible StringData Ref from Data Obj ->" "
                                  |
:00478B9F 6820EC4800              push 0048EC20
:00478BA4 8D8500FFFFFF            lea eax, dword ptr [ebp+FFFFFF00]
:00478BAA 50                      push eax
:00478BAB E8F0700000              call 0047FCA0
:00478BB0 83C408                  add esp, 00000008
:00478BB3 EB5D                    jmp 00478C12

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00478B75(C)
|
:00478BB5 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00478BB8 81E1FF000000            and ecx, 000000FF
:00478BBE 6BC924                  imul ecx, 00000024
:00478BC1 81C1502C4B00            add ecx, 004B2C50
:00478BC7 E8C453FAFF              call 0041DF90
:00478BCC 25FF000000              and eax, 000000FF
:00478BD1 83F802                  cmp eax, 00000002
:00478BD4 7F3C                    jg 00478C12
:00478BD6 68E06A4800              push 00486AE0
:00478BDB 8D8D00FFFFFF            lea ecx, dword ptr [ebp+FFFFFF00]
:00478BE1 51                      push ecx
:00478BE2 E8B9850000              call 004811A0
:00478BE7 83C408                  add esp, 00000008
:00478BEA 68306D4800              push 00486D30
:00478BEF 8D9500FFFFFF            lea edx, dword ptr [ebp+FFFFFF00]
:00478BF5 52                      push edx
:00478BF6 E8A5850000              call 004811A0
:00478BFB 83C408                  add esp, 00000008

* Possible StringData Ref from Data Obj ->" "
                                  |
:00478BFE 6824EC4800              push 0048EC24
:00478C03 8D8500FFFFFF            lea eax, dword ptr [ebp+FFFFFF00]
:00478C09 50                      push eax
:00478C0A E891700000              call 0047FCA0
:00478C0F 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00478BB3(U), :00478BD4(C)
|
:00478C12 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00478C15 81E1FF000000            and ecx, 000000FF
:00478C1B 6BC924                  imul ecx, 00000024
:00478C1E 81C1502C4B00            add ecx, 004B2C50
:00478C24 E8A753FAFF              call 0041DFD0
:00478C29 25FF000000              and eax, 000000FF
:00478C2E 83F804                  cmp eax, 00000004
:00478C31 7C3E                    jl 00478C71
:00478C33 68F06A4800              push 00486AF0
:00478C38 8D8D00FFFFFF            lea ecx, dword ptr [ebp+FFFFFF00]
:00478C3E 51                      push ecx
:00478C3F E85C850000              call 004811A0
:00478C44 83C408                  add esp, 00000008
:00478C47 68286D4800              push 00486D28
:00478C4C 8D9500FFFFFF            lea edx, dword ptr [ebp+FFFFFF00]
:00478C52 52                      push edx
:00478C53 E848850000              call 004811A0
:00478C58 83C408                  add esp, 00000008

* Possible StringData Ref from Data Obj ->" "
                                  |
:00478C5B 6828EC4800              push 0048EC28
:00478C60 8D8500FFFFFF            lea eax, dword ptr [ebp+FFFFFF00]
:00478C66 50                      push eax
:00478C67 E834700000              call 0047FCA0
:00478C6C 83C408                  add esp, 00000008
:00478C6F EB5D                    jmp 00478CCE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00478C31(C)
|
:00478C71 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00478C74 81E1FF000000            and ecx, 000000FF
:00478C7A 6BC924                  imul ecx, 00000024
:00478C7D 81C1502C4B00            add ecx, 004B2C50
:00478C83 E84853FAFF              call 0041DFD0
:00478C88 25FF000000              and eax, 000000FF
:00478C8D 83F802                  cmp eax, 00000002
:00478C90 7F3C                    jg 00478CCE
:00478C92 68F06A4800              push 00486AF0
:00478C97 8D8D00FFFFFF            lea ecx, dword ptr [ebp+FFFFFF00]
:00478C9D 51                      push ecx
:00478C9E E8FD840000              call 004811A0
:00478CA3 83C408                  add esp, 00000008
:00478CA6 68306D4800              push 00486D30
:00478CAB 8D9500FFFFFF            lea edx, dword ptr [ebp+FFFFFF00]
:00478CB1 52                      push edx
:00478CB2 E8E9840000              call 004811A0
:00478CB7 83C408                  add esp, 00000008

* Possible StringData Ref from Data Obj ->" "
                                  |
:00478CBA 682CEC4800              push 0048EC2C
:00478CBF 8D8500FFFFFF            lea eax, dword ptr [ebp+FFFFFF00]
:00478CC5 50                      push eax
:00478CC6 E8D56F0000              call 0047FCA0
:00478CCB 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00478C6F(U), :00478C90(C)
|
:00478CCE 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00478CD1 81E1FF000000            and ecx, 000000FF
:00478CD7 6BC924                  imul ecx, 00000024
:00478CDA 81C1502C4B00            add ecx, 004B2C50
:00478CE0 E8CB52FAFF              call 0041DFB0
:00478CE5 25FF000000              and eax, 000000FF
:00478CEA 83F804                  cmp eax, 00000004
:00478CED 7C3E                    jl 00478D2D
:00478CEF 68006B4800              push 00486B00
:00478CF4 8D8D00FFFFFF            lea ecx, dword ptr [ebp+FFFFFF00]
:00478CFA 51                      push ecx
:00478CFB E8A0840000              call 004811A0
:00478D00 83C408                  add esp, 00000008
:00478D03 68286D4800              push 00486D28
:00478D08 8D9500FFFFFF            lea edx, dword ptr [ebp+FFFFFF00]
:00478D0E 52                      push edx
:00478D0F E88C840000              call 004811A0
:00478D14 83C408                  add esp, 00000008

* Possible StringData Ref from Data Obj ->" "
                                  |
:00478D17 6830EC4800              push 0048EC30
:00478D1C 8D8500FFFFFF            lea eax, dword ptr [ebp+FFFFFF00]
:00478D22 50                      push eax
:00478D23 E8786F0000              call 0047FCA0
:00478D28 83C408                  add esp, 00000008
:00478D2B EB5D                    jmp 00478D8A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00478CED(C)
|
:00478D2D 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00478D30 81E1FF000000            and ecx, 000000FF
:00478D36 6BC924                  imul ecx, 00000024
:00478D39 81C1502C4B00            add ecx, 004B2C50
:00478D3F E86C52FAFF              call 0041DFB0
:00478D44 25FF000000              and eax, 000000FF
:00478D49 83F802                  cmp eax, 00000002
:00478D4C 7F3C                    jg 00478D8A
:00478D4E 68006B4800              push 00486B00
:00478D53 8D8D00FFFFFF            lea ecx, dword ptr [ebp+FFFFFF00]
:00478D59 51                      push ecx
:00478D5A E841840000              call 004811A0
:00478D5F 83C408                  add esp, 00000008
:00478D62 68306D4800              push 00486D30
:00478D67 8D9500FFFFFF            lea edx, dword ptr [ebp+FFFFFF00]
:00478D6D 52                      push edx
:00478D6E E82D840000              call 004811A0
:00478D73 83C408                  add esp, 00000008

* Possible StringData Ref from Data Obj ->" "
                                  |
:00478D76 6834EC4800              push 0048EC34
:00478D7B 8D8500FFFFFF            lea eax, dword ptr [ebp+FFFFFF00]
:00478D81 50                      push eax
:00478D82 E8196F0000              call 0047FCA0
:00478D87 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00478D2B(U), :00478D4C(C)
|
:00478D8A 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00478D8D 81E1FF000000            and ecx, 000000FF
:00478D93 6BC924                  imul ecx, 00000024
:00478D96 81C1502C4B00            add ecx, 004B2C50
:00478D9C E84F52FAFF              call 0041DFF0
:00478DA1 25FF000000              and eax, 000000FF
:00478DA6 83F804                  cmp eax, 00000004
:00478DA9 7C3E                    jl 00478DE9
:00478DAB 68106B4800              push 00486B10
:00478DB0 8D8D00FFFFFF            lea ecx, dword ptr [ebp+FFFFFF00]
:00478DB6 51                      push ecx
:00478DB7 E8E4830000              call 004811A0
:00478DBC 83C408                  add esp, 00000008
:00478DBF 68286D4800              push 00486D28
:00478DC4 8D9500FFFFFF            lea edx, dword ptr [ebp+FFFFFF00]
:00478DCA 52                      push edx
:00478DCB E8D0830000              call 004811A0
:00478DD0 83C408                  add esp, 00000008

* Possible StringData Ref from Data Obj ->" "
                                  |
:00478DD3 6838EC4800              push 0048EC38
:00478DD8 8D8500FFFFFF            lea eax, dword ptr [ebp+FFFFFF00]
:00478DDE 50                      push eax
:00478DDF E8BC6E0000              call 0047FCA0
:00478DE4 83C408                  add esp, 00000008
:00478DE7 EB5D                    jmp 00478E46

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00478DA9(C)
|
:00478DE9 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00478DEC 81E1FF000000            and ecx, 000000FF
:00478DF2 6BC924                  imul ecx, 00000024
:00478DF5 81C1502C4B00            add ecx, 004B2C50
:00478DFB E8F051FAFF              call 0041DFF0
:00478E00 25FF000000              and eax, 000000FF
:00478E05 83F802                  cmp eax, 00000002
:00478E08 7F3C                    jg 00478E46
:00478E0A 68106B4800              push 00486B10
:00478E0F 8D8D00FFFFFF            lea ecx, dword ptr [ebp+FFFFFF00]
:00478E15 51                      push ecx
:00478E16 E885830000              call 004811A0
:00478E1B 83C408                  add esp, 00000008
:00478E1E 68306D4800              push 00486D30
:00478E23 8D9500FFFFFF            lea edx, dword ptr [ebp+FFFFFF00]
:00478E29 52                      push edx
:00478E2A E871830000              call 004811A0
:00478E2F 83C408                  add esp, 00000008

* Possible StringData Ref from Data Obj ->" "
                                  |
:00478E32 683CEC4800              push 0048EC3C
:00478E37 8D8500FFFFFF            lea eax, dword ptr [ebp+FFFFFF00]
:00478E3D 50                      push eax
:00478E3E E85D6E0000              call 0047FCA0
:00478E43 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00478DE7(U), :00478E08(C)
|
:00478E46 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00478E49 81E1FF000000            and ecx, 000000FF
:00478E4F 6BC924                  imul ecx, 00000024
:00478E52 81C1502C4B00            add ecx, 004B2C50
:00478E58 E8B351FAFF              call 0041E010
:00478E5D 25FF000000              and eax, 000000FF
:00478E62 83F804                  cmp eax, 00000004
:00478E65 7C3E                    jl 00478EA5
:00478E67 68206B4800              push 00486B20
:00478E6C 8D8D00FFFFFF            lea ecx, dword ptr [ebp+FFFFFF00]
:00478E72 51                      push ecx
:00478E73 E828830000              call 004811A0
:00478E78 83C408                  add esp, 00000008
:00478E7B 68286D4800              push 00486D28
:00478E80 8D9500FFFFFF            lea edx, dword ptr [ebp+FFFFFF00]
:00478E86 52                      push edx
:00478E87 E814830000              call 004811A0
:00478E8C 83C408                  add esp, 00000008

* Possible StringData Ref from Data Obj ->" "
                                  |
:00478E8F 6840EC4800              push 0048EC40
:00478E94 8D8500FFFFFF            lea eax, dword ptr [ebp+FFFFFF00]
:00478E9A 50                      push eax
:00478E9B E8006E0000              call 0047FCA0
:00478EA0 83C408                  add esp, 00000008
:00478EA3 EB5D                    jmp 00478F02

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00478E65(C)
|
:00478EA5 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00478EA8 81E1FF000000            and ecx, 000000FF
:00478EAE 6BC924                  imul ecx, 00000024
:00478EB1 81C1502C4B00            add ecx, 004B2C50
:00478EB7 E85451FAFF              call 0041E010
:00478EBC 25FF000000              and eax, 000000FF
:00478EC1 83F802                  cmp eax, 00000002
:00478EC4 7F3C                    jg 00478F02
:00478EC6 68206B4800              push 00486B20
:00478ECB 8D8D00FFFFFF            lea ecx, dword ptr [ebp+FFFFFF00]
:00478ED1 51                      push ecx
:00478ED2 E8C9820000              call 004811A0
:00478ED7 83C408                  add esp, 00000008
:00478EDA 68306D4800              push 00486D30
:00478EDF 8D9500FFFFFF            lea edx, dword ptr [ebp+FFFFFF00]
:00478EE5 52                      push edx
:00478EE6 E8B5820000              call 004811A0
:00478EEB 83C408                  add esp, 00000008

* Possible StringData Ref from Data Obj ->" "
                                  |
:00478EEE 6844EC4800              push 0048EC44
:00478EF3 8D8500FFFFFF            lea eax, dword ptr [ebp+FFFFFF00]
:00478EF9 50                      push eax
:00478EFA E8A16D0000              call 0047FCA0
:00478EFF 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00478EA3(U), :00478EC4(C)
|
:00478F02 0FBE8D00FFFFFF          movsx ecx, byte ptr [ebp+FFFFFF00]
:00478F09 85C9                    test ecx, ecx
:00478F0B 7514                    jne 00478F21
:00478F0D 68006D4800              push 00486D00
:00478F12 8D9500FFFFFF            lea edx, dword ptr [ebp+FFFFFF00]
:00478F18 52                      push edx
:00478F19 E882820000              call 004811A0
:00478F1E 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00478F0B(C)
|
:00478F21 6A02                    push 00000002
:00478F23 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00478F26 81E1FF000000            and ecx, 000000FF
:00478F2C 6BC924                  imul ecx, 00000024
:00478F2F 81C1502C4B00            add ecx, 004B2C50
:00478F35 E8B6CBFAFF              call 00425AF0
:00478F3A 85C0                    test eax, eax
:00478F3C 7428                    je 00478F66

* Possible StringData Ref from Data Obj ->" "
                                  |
:00478F3E 6848EC4800              push 0048EC48
:00478F43 8D8500FFFFFF            lea eax, dword ptr [ebp+FFFFFF00]
:00478F49 50                      push eax
:00478F4A E8516D0000              call 0047FCA0
:00478F4F 83C408                  add esp, 00000008
:00478F52 68386D4800              push 00486D38
:00478F57 8D8D00FFFFFF            lea ecx, dword ptr [ebp+FFFFFF00]
:00478F5D 51                      push ecx
:00478F5E E83D820000              call 004811A0
:00478F63 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00478F3C(C)
|
:00478F66 8D9500FFFFFF            lea edx, dword ptr [ebp+FFFFFF00]
:00478F6C 52                      push edx
:00478F6D 8B4508                  mov eax, dword ptr [ebp+08]
:00478F70 50                      push eax
:00478F71 FF1560634800            call dword ptr [00486360]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00478A36(U)
|
:00478F77 8BE5                    mov esp, ebp
:00478F79 5D                      pop ebp
:00478F7A C3                      ret



* Referenced by a CALL at Address:
|:0047924A   
|
:00478F7B 55                      push ebp
:00478F7C 8BEC                    mov ebp, esp
:00478F7E 83EC4C                  sub esp, 0000004C
:00478F81 894DB4                  mov dword ptr [ebp-4C], ecx

* Possible StringData Ref from Data Obj ->""
                                  |
:00478F84 C745B84CEC4800          mov [ebp-48], 0048EC4C

* Possible StringData Ref from Data Obj ->"װ"
                                  |
:00478F8B C745BC54EC4800          mov [ebp-44], 0048EC54

* Possible StringData Ref from Data Obj ->""
                                  |
:00478F92 C745C05CEC4800          mov [ebp-40], 0048EC5C

* Possible StringData Ref from Data Obj ->"佫д"
                                  |
:00478F99 C745C464EC4800          mov [ebp-3C], 0048EC64

* Possible StringData Ref from Data Obj ->""
                                  |
:00478FA0 C745C870EC4800          mov [ebp-38], 0048EC70
:00478FA7 33C0                    xor eax, eax
:00478FA9 A0BC6B4B00              mov al, byte ptr [004B6BBC]
:00478FAE 83E001                  and eax, 00000001
:00478FB1 85C0                    test eax, eax
:00478FB3 7526                    jne 00478FDB
:00478FB5 8A0DBC6B4B00            mov cl, byte ptr [004B6BBC]
:00478FBB 80C901                  or cl, 01
:00478FBE 880DBC6B4B00            mov byte ptr [004B6BBC], cl
:00478FC4 B9C86C4B00              mov ecx, 004B6CC8
:00478FC9 E8C252F9FF              call 0040E290
:00478FCE 6855914700              push 00479155
:00478FD3 E828810000              call 00481100
:00478FD8 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00478FB3(C)
|
:00478FDB 6805040000              push 00000405
:00478FE0 8B5508                  mov edx, dword ptr [ebp+08]
:00478FE3 52                      push edx
:00478FE4 FF15DC624800            call dword ptr [004862DC]
:00478FEA 50                      push eax
:00478FEB B9C86C4B00              mov ecx, 004B6CC8
:00478FF0 E81598FEFF              call 0046280A
:00478FF5 6AFA                    push FFFFFFFA
:00478FF7 8B4508                  mov eax, dword ptr [ebp+08]
:00478FFA 50                      push eax
:00478FFB FF15A0634800            call dword ptr [004863A0]
:00479001 8945EC                  mov dword ptr [ebp-14], eax
:00479004 C745D001000000          mov [ebp-30], 00000001
:0047900B 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0047900E 894DDC                  mov dword ptr [ebp-24], ecx
:00479011 C745CC00000000          mov [ebp-34], 00000000
:00479018 EB09                    jmp 00479023

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00479098(U)
|
:0047901A 8B55CC                  mov edx, dword ptr [ebp-34]
:0047901D 83C201                  add edx, 00000001
:00479020 8955CC                  mov dword ptr [ebp-34], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00479018(U)
|
:00479023 837DCC05                cmp dword ptr [ebp-34], 00000005
:00479027 7D71                    jge 0047909A
:00479029 8B45CC                  mov eax, dword ptr [ebp-34]
:0047902C 8B4C85B8                mov ecx, dword ptr [ebp+4*eax-48]
:00479030 51                      push ecx
:00479031 8D55F0                  lea edx, dword ptr [ebp-10]
:00479034 52                      push edx
:00479035 E856810000              call 00481190
:0047903A 83C408                  add esp, 00000008
:0047903D 8D45D0                  lea eax, dword ptr [ebp-30]
:00479040 50                      push eax
:00479041 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00479044 51                      push ecx
:00479045 6807130000              push 00001307
:0047904A 6805040000              push 00000405
:0047904F 8B5508                  mov edx, dword ptr [ebp+08]
:00479052 52                      push edx
:00479053 FF1590634800            call dword ptr [00486390]
:00479059 6A00                    push 00000000
:0047905B 8B45CC                  mov eax, dword ptr [ebp-34]
:0047905E 8B0C8540764800          mov ecx, dword ptr [4*eax+00487640]
:00479065 51                      push ecx
:00479066 6805040000              push 00000405
:0047906B 8B5508                  mov edx, dword ptr [ebp+08]
:0047906E 52                      push edx
:0047906F FF15DC624800            call dword ptr [004862DC]
:00479075 50                      push eax
:00479076 8B45CC                  mov eax, dword ptr [ebp-34]
:00479079 33C9                    xor ecx, ecx
:0047907B 668B0C8528764800        mov cx, word ptr [4*eax+00487628]
:00479083 51                      push ecx
:00479084 8B55EC                  mov edx, dword ptr [ebp-14]
:00479087 52                      push edx
:00479088 FF15B0624800            call dword ptr [004862B0]
:0047908E 8B4DCC                  mov ecx, dword ptr [ebp-34]
:00479091 89048DA86B4B00          mov dword ptr [4*ecx+004B6BA8], eax
:00479098 EB80                    jmp 0047901A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00479027(C)
|
:0047909A 8B15A8E94800            mov edx, dword ptr [0048E9A8]
:004790A0 52                      push edx
:004790A1 E834000000              call 004790DA
:004790A6 83C404                  add esp, 00000004
:004790A9 6A00                    push 00000000
:004790AB A1A8E94800              mov eax, dword ptr [0048E9A8]
:004790B0 50                      push eax
:004790B1 680C130000              push 0000130C
:004790B6 6805040000              push 00000405
:004790BB 8B0D906A4B00            mov ecx, dword ptr [004B6A90]
:004790C1 51                      push ecx
:004790C2 FF1590634800            call dword ptr [00486390]
:004790C8 8B5508                  mov edx, dword ptr [ebp+08]
:004790CB 52                      push edx
:004790CC 8B4DB4                  mov ecx, dword ptr [ebp-4C]
:004790CF E8B4F5FFFF              call 00478688
:004790D4 8BE5                    mov esp, ebp
:004790D6 5D                      pop ebp
:004790D7 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:004790A1   , :00479492   
|
:004790DA 55                      push ebp
:004790DB 8BEC                    mov ebp, esp
:004790DD 833DA8E94800FF          cmp dword ptr [0048E9A8], FFFFFFFF
:004790E4 7444                    je 0047912A
:004790E6 8B4508                  mov eax, dword ptr [ebp+08]
:004790E9 3B05A8E94800            cmp eax, dword ptr [0048E9A8]
:004790EF 7424                    je 00479115
:004790F1 8B0DA8E94800            mov ecx, dword ptr [0048E9A8]
:004790F7 8B148DA86B4B00          mov edx, dword ptr [4*ecx+004B6BA8]
:004790FE 52                      push edx
:004790FF FF15C8624800            call dword ptr [004862C8]
:00479105 85C0                    test eax, eax
:00479107 740C                    je 00479115
:00479109 6A00                    push 00000000
:0047910B B9B0694B00              mov ecx, 004B69B0
:00479110 E898B5FFFF              call 004746AD

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004790EF(C), :00479107(C)
|
:00479115 6A00                    push 00000000
:00479117 A1A8E94800              mov eax, dword ptr [0048E9A8]
:0047911C 8B0C85A86B4B00          mov ecx, dword ptr [4*eax+004B6BA8]
:00479123 51                      push ecx
:00479124 FF15E0624800            call dword ptr [004862E0]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004790E4(C)
|
:0047912A 837D08FF                cmp dword ptr [ebp+08], FFFFFFFF
:0047912E 7507                    jne 00479137
:00479130 C7450800000000          mov [ebp+08], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047912E(C)
|
:00479137 6A05                    push 00000005
:00479139 8B5508                  mov edx, dword ptr [ebp+08]
:0047913C 8B0495A86B4B00          mov eax, dword ptr [4*edx+004B6BA8]
:00479143 50                      push eax
:00479144 FF15E0624800            call dword ptr [004862E0]
:0047914A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047914D 890DA8E94800            mov dword ptr [0048E9A8], ecx
:00479153 5D                      pop ebp
:00479154 C3                      ret


:00479155 55                      push ebp
:00479156 8BEC                    mov ebp, esp
:00479158 B9C86C4B00              mov ecx, 004B6CC8
:0047915D E88E50F9FF              call 0040E1F0
:00479162 5D                      pop ebp
:00479163 C3                      ret


:00479164 55                      push ebp
:00479165 8BEC                    mov ebp, esp
:00479167 83EC20                  sub esp, 00000020
:0047916A 8B450C                  mov eax, dword ptr [ebp+0C]
:0047916D 8945EC                  mov dword ptr [ebp-14], eax
:00479170 837DEC2B                cmp dword ptr [ebp-14], 0000002B
:00479174 7719                    ja 0047918F
:00479176 837DEC2B                cmp dword ptr [ebp-14], 0000002B
:0047917A 0F84AA020000            je 0047942A
:00479180 837DEC02                cmp dword ptr [ebp-14], 00000002
:00479184 0F84CA000000            je 00479254
:0047918A E90B030000              jmp 0047949A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00479174(C)
|
:0047918F 817DEC10010000          cmp dword ptr [ebp-14], 00000110
:00479196 771C                    ja 004791B4
:00479198 817DEC10010000          cmp dword ptr [ebp-14], 00000110
:0047919F 0F848B000000            je 00479230
:004791A5 837DEC4E                cmp dword ptr [ebp-14], 0000004E
:004791A9 0F84AD020000            je 0047945C
:004791AF E9E6020000              jmp 0047949A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00479196(C)
|
:004791B4 817DEC35010000          cmp dword ptr [ebp-14], 00000135
:004791BB 772C                    ja 004791E9
:004791BD 817DEC35010000          cmp dword ptr [ebp-14], 00000135
:004791C4 0F842F020000            je 004793F9
:004791CA 817DEC11010000          cmp dword ptr [ebp-14], 00000111
:004791D1 0F84E5000000            je 004792BC
:004791D7 817DEC12010000          cmp dword ptr [ebp-14], 00000112
:004791DE 0F8492000000            je 00479276
:004791E4 E9B1020000              jmp 0047949A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004791BB(C)
|
:004791E9 817DEC0F030000          cmp dword ptr [ebp-14], 0000030F
:004791F0 772C                    ja 0047921E
:004791F2 817DEC0F030000          cmp dword ptr [ebp-14], 0000030F
:004791F9 0F843D020000            je 0047943C
:004791FF 817DEC36010000          cmp dword ptr [ebp-14], 00000136
:00479206 0F8408020000            je 00479414
:0047920C 817DEC38010000          cmp dword ptr [ebp-14], 00000138
:00479213 0F84A1010000            je 004793BA
:00479219 E97C020000              jmp 0047949A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004791F0(C)
|
:0047921E 817DEC11030000          cmp dword ptr [ebp-14], 00000311
:00479225 0F841F020000            je 0047944A
:0047922B E96A020000              jmp 0047949A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047919F(C)
|
:00479230 8B4D08                  mov ecx, dword ptr [ebp+08]
:00479233 51                      push ecx
:00479234 8B1504754B00            mov edx, dword ptr [004B7504]
:0047923A 8B0C95F06C4B00          mov ecx, dword ptr [4*edx+004B6CF0]
:00479241 6BC948                  imul ecx, 00000048
:00479244 81C1681B4A00            add ecx, 004A1B68
:0047924A E82CFDFFFF              call 00478F7B
:0047924F E946020000              jmp 0047949A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00479184(C)
|
:00479254 6A00                    push 00000000
:00479256 A1D05F4B00              mov eax, dword ptr [004B5FD0]
:0047925B 50                      push eax
:0047925C FF15E0624800            call dword ptr [004862E0]
:00479262 6A00                    push 00000000
:00479264 8B0DD05F4B00            mov ecx, dword ptr [004B5FD0]
:0047926A 51                      push ecx
:0047926B FF157C634800            call dword ptr [0048637C]
:00479271 E924020000              jmp 0047949A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004791DE(C)
|
:00479276 8B5510                  mov edx, dword ptr [ebp+10]
:00479279 8955E8                  mov dword ptr [ebp-18], edx
:0047927C 817DE820F00000          cmp dword ptr [ebp-18], 0000F020
:00479283 740B                    je 00479290
:00479285 817DE820F10000          cmp dword ptr [ebp-18], 0000F120
:0047928C 7404                    je 00479292
:0047928E EB27                    jmp 004792B7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00479283(C)
|
:00479290 EB25                    jmp 004792B7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047928C(C)
|
:00479292 6A00                    push 00000000
:00479294 6A01                    push 00000001

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:00479296 6A06                    push 00000006
:00479298 A1D85F4B00              mov eax, dword ptr [004B5FD8]
:0047929D 50                      push eax
:0047929E FF15F4624800            call dword ptr [004862F4]
:004792A4 6A00                    push 00000000
:004792A6 6A01                    push 00000001

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:004792A8 6A06                    push 00000006
:004792AA 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:004792B0 51                      push ecx
:004792B1 FF15F4624800            call dword ptr [004862F4]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047928E(U), :00479290(U)
|
:004792B7 E9DE010000              jmp 0047949A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004791D1(C)
|
:004792BC 8B5510                  mov edx, dword ptr [ebp+10]
:004792BF 81E2FFFF0000            and edx, 0000FFFF
:004792C5 8955F8                  mov dword ptr [ebp-08], edx
:004792C8 8B45F8                  mov eax, dword ptr [ebp-08]
:004792CB 8945E4                  mov dword ptr [ebp-1C], eax
:004792CE 817DE403040000          cmp dword ptr [ebp-1C], 00000403
:004792D5 7F1E                    jg 004792F5
:004792D7 817DE403040000          cmp dword ptr [ebp-1C], 00000403
:004792DE 7434                    je 00479314
:004792E0 837DE400                cmp dword ptr [ebp-1C], 00000000
:004792E4 0F8ECB000000            jle 004793B5
:004792EA 837DE402                cmp dword ptr [ebp-1C], 00000002
:004792EE 7E13                    jle 00479303
:004792F0 E9C0000000              jmp 004793B5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004792D5(C)
|
:004792F5 817DE404040000          cmp dword ptr [ebp-1C], 00000404
:004792FC 7459                    je 00479357
:004792FE E9B2000000              jmp 004793B5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004792EE(C)
|
:00479303 6A00                    push 00000000
:00479305 8B4D08                  mov ecx, dword ptr [ebp+08]
:00479308 51                      push ecx
:00479309 FF15E0624800            call dword ptr [004862E0]
:0047930F E9A1000000              jmp 004793B5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004792DE(C)
|
:00479314 6A01                    push 00000001
:00479316 8B1504754B00            mov edx, dword ptr [004B7504]
:0047931C 52                      push edx
:0047931D E87C670000              call 0047FA9E
:00479322 83C408                  add esp, 00000008
:00479325 A304754B00              mov dword ptr [004B7504], eax
:0047932A 8B4508                  mov eax, dword ptr [ebp+08]
:0047932D 50                      push eax
:0047932E 8B0D04754B00            mov ecx, dword ptr [004B7504]
:00479334 8B0C8DF06C4B00          mov ecx, dword ptr [4*ecx+004B6CF0]
:0047933B 6BC948                  imul ecx, 00000048
:0047933E 81C1681B4A00            add ecx, 004A1B68
:00479344 E83FF3FFFF              call 00478688
:00479349 8B5508                  mov edx, dword ptr [ebp+08]
:0047934C 52                      push edx
:0047934D E8EA020000              call 0047963C
:00479352 83C404                  add esp, 00000004
:00479355 EB5E                    jmp 004793B5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004792FC(C)
|
:00479357 6800020000              push 00000200
:0047935C 6A01                    push 00000001
:0047935E A104754B00              mov eax, dword ptr [004B7504]
:00479363 50                      push eax
:00479364 E820670000              call 0047FA89
:00479369 83C40C                  add esp, 0000000C
:0047936C 8945FC                  mov dword ptr [ebp-04], eax
:0047936F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00479372 813C8DF06C4B0000020000  cmp dword ptr [4*ecx+004B6CF0], 00000200
:0047937D 7336                    jnb 004793B5
:0047937F 8B55FC                  mov edx, dword ptr [ebp-04]
:00479382 891504754B00            mov dword ptr [004B7504], edx
:00479388 A108754B00              mov eax, dword ptr [004B7508]
:0047938D 50                      push eax
:0047938E 8B0D04754B00            mov ecx, dword ptr [004B7504]
:00479394 8B0C8DF06C4B00          mov ecx, dword ptr [4*ecx+004B6CF0]
:0047939B 6BC948                  imul ecx, 00000048
:0047939E 81C1681B4A00            add ecx, 004A1B68
:004793A4 E8DFF2FFFF              call 00478688
:004793A9 8B5508                  mov edx, dword ptr [ebp+08]
:004793AC 52                      push edx
:004793AD E88A020000              call 0047963C
:004793B2 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004792E4(C), :004792F0(U), :004792FE(U), :0047930F(U), :00479355(U)
|:0047937D(C)
|
:004793B5 E9E0000000              jmp 0047949A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00479213(C)
|
:004793BA 6A00                    push 00000000
:004793BC 6A01                    push 00000001
:004793BE 8B4514                  mov eax, dword ptr [ebp+14]
:004793C1 50                      push eax
:004793C2 8B4D10                  mov ecx, dword ptr [ebp+10]
:004793C5 51                      push ecx
:004793C6 E8C081FFFF              call 0047158B
:004793CB 83C410                  add esp, 00000010
:004793CE 8B1504754B00            mov edx, dword ptr [004B7504]
:004793D4 8B0495F06C4B00          mov eax, dword ptr [4*edx+004B6CF0]
:004793DB 6BC048                  imul eax, 00000048
:004793DE 05681B4A00              add eax, 004A1B68
:004793E3 50                      push eax
:004793E4 8B4D14                  mov ecx, dword ptr [ebp+14]
:004793E7 51                      push ecx
:004793E8 8B5510                  mov edx, dword ptr [ebp+10]
:004793EB 52                      push edx
:004793EC E8B1000000              call 004794A2
:004793F1 83C40C                  add esp, 0000000C
:004793F4 E9A1000000              jmp 0047949A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004791C4(C)
|
:004793F9 6A00                    push 00000000
:004793FB 6A00                    push 00000000
:004793FD 6A01                    push 00000001
:004793FF 8B4514                  mov eax, dword ptr [ebp+14]
:00479402 50                      push eax
:00479403 8B4D10                  mov ecx, dword ptr [ebp+10]
:00479406 51                      push ecx
:00479407 E87585FFFF              call 00471981
:0047940C 83C414                  add esp, 00000014
:0047940F E986000000              jmp 0047949A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00479206(C)
|
:00479414 6A00                    push 00000000
:00479416 6A01                    push 00000001
:00479418 8B5514                  mov edx, dword ptr [ebp+14]
:0047941B 52                      push edx
:0047941C 8B4510                  mov eax, dword ptr [ebp+10]
:0047941F 50                      push eax
:00479420 E8667EFFFF              call 0047128B
:00479425 83C410                  add esp, 00000010
:00479428 EB70                    jmp 0047949A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047917A(C)
|
:0047942A 6A00                    push 00000000
:0047942C 6A01                    push 00000001
:0047942E 8B4D14                  mov ecx, dword ptr [ebp+14]
:00479431 51                      push ecx
:00479432 E8A78BFFFF              call 00471FDE
:00479437 83C40C                  add esp, 0000000C
:0047943A EB5E                    jmp 0047949A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004791F9(C)
|
:0047943C 8B5508                  mov edx, dword ptr [ebp+08]
:0047943F 52                      push edx
:00479440 E8E690FFFF              call 0047252B
:00479445 83C404                  add esp, 00000004
:00479448 EB50                    jmp 0047949A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00479225(C)
|
:0047944A 8B4510                  mov eax, dword ptr [ebp+10]
:0047944D 50                      push eax
:0047944E 8B4D08                  mov ecx, dword ptr [ebp+08]
:00479451 51                      push ecx
:00479452 E82791FFFF              call 0047257E
:00479457 83C408                  add esp, 00000008
:0047945A EB3E                    jmp 0047949A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004791A9(C)
|
:0047945C 8B5514                  mov edx, dword ptr [ebp+14]
:0047945F 8955F4                  mov dword ptr [ebp-0C], edx
:00479462 8B45F4                  mov eax, dword ptr [ebp-0C]
:00479465 8B4808                  mov ecx, dword ptr [eax+08]
:00479468 894DE0                  mov dword ptr [ebp-20], ecx
:0047946B 817DE0D9FDFFFF          cmp dword ptr [ebp-20], FFFFFDD9
:00479472 7402                    je 00479476
:00479474 EB24                    jmp 0047949A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00479472(C)
|
:00479476 6A00                    push 00000000
:00479478 6A00                    push 00000000
:0047947A 680B130000              push 0000130B
:0047947F 8B55F4                  mov edx, dword ptr [ebp-0C]
:00479482 8B02                    mov eax, dword ptr [edx]
:00479484 50                      push eax
:00479485 FF15F4624800            call dword ptr [004862F4]
:0047948B 8945F0                  mov dword ptr [ebp-10], eax
:0047948E 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00479491 51                      push ecx
:00479492 E843FCFFFF              call 004790DA
:00479497 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047918A(U), :004791AF(U), :004791E4(U), :00479219(U), :0047922B(U)
|:0047924F(U), :00479271(U), :004792B7(U), :004793B5(U), :004793F4(U)
|:0047940F(U), :00479428(U), :0047943A(U), :00479448(U), :0047945A(U)
|:00479474(U)
|
:0047949A 33C0                    xor eax, eax
:0047949C 8BE5                    mov esp, ebp
:0047949E 5D                      pop ebp
:0047949F C21000                  ret 0010



* Referenced by a CALL at Address:
|:004793EC   
|
:004794A2 55                      push ebp
:004794A3 8BEC                    mov ebp, esp
:004794A5 83EC6C                  sub esp, 0000006C
:004794A8 8B4D10                  mov ecx, dword ptr [ebp+10]
:004794AB E82CE6FFFF              call 00477ADC
:004794B0 8845D0                  mov byte ptr [ebp-30], al
:004794B3 C745D460050000          mov [ebp-2C], 00000560

* Possible Reference to Dialog: DialogID_011A, CONTROL_ID:0564, ""
                                  |
:004794BA C745D864050000          mov [ebp-28], 00000564
:004794C1 C745DC65050000          mov [ebp-24], 00000565
:004794C8 C745F001000000          mov [ebp-10], 00000001
:004794CF C745F403000000          mov [ebp-0C], 00000003
:004794D6 C745F805000000          mov [ebp-08], 00000005
:004794DD 8B4D10                  mov ecx, dword ptr [ebp+10]
:004794E0 E836DDF8FF              call 0040721B
:004794E5 8945C4                  mov dword ptr [ebp-3C], eax
:004794E8 8B4D10                  mov ecx, dword ptr [ebp+10]
:004794EB E85ADDF8FF              call 0040724A
:004794F0 8945C8                  mov dword ptr [ebp-38], eax
:004794F3 8B4D10                  mov ecx, dword ptr [ebp+10]
:004794F6 E855D1F8FF              call 00406650
:004794FB 25FF000000              and eax, 000000FF
:00479500 8945CC                  mov dword ptr [ebp-34], eax
:00479503 8B4D10                  mov ecx, dword ptr [ebp+10]
:00479506 E810DDF8FF              call 0040721B
:0047950B 8945E4                  mov dword ptr [ebp-1C], eax
:0047950E 8B4D10                  mov ecx, dword ptr [ebp+10]
:00479511 E834DDF8FF              call 0040724A
:00479516 8945E8                  mov dword ptr [ebp-18], eax
:00479519 C745EC7D000000          mov [ebp-14], 0000007D
:00479520 8B45D0                  mov eax, dword ptr [ebp-30]
:00479523 25FF000000              and eax, 000000FF
:00479528 3DFF000000              cmp eax, 000000FF
:0047952D 747C                    je 004795AB
:0047952F 6A10                    push 00000010
:00479531 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00479534 81E1FF000000            and ecx, 000000FF
:0047953A 6BC924                  imul ecx, 00000024
:0047953D 81C1502C4B00            add ecx, 004B2C50
:00479543 E898D1F8FF              call 004066E0
:00479548 85C0                    test eax, eax
:0047954A 7407                    je 00479553
:0047954C C745F002000000          mov [ebp-10], 00000002

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047954A(C)
|
:00479553 6A04                    push 00000004
:00479555 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00479558 81E1FF000000            and ecx, 000000FF
:0047955E 6BC924                  imul ecx, 00000024
:00479561 81C1502C4B00            add ecx, 004B2C50
:00479567 E874D1F8FF              call 004066E0
:0047956C 85C0                    test eax, eax
:0047956E 7407                    je 00479577
:00479570 C745F404000000          mov [ebp-0C], 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047956E(C)
|
:00479577 8B4DD0                  mov ecx, dword ptr [ebp-30]
:0047957A 81E1FF000000            and ecx, 000000FF
:00479580 6BC924                  imul ecx, 00000024
:00479583 81C1502C4B00            add ecx, 004B2C50
:00479589 E80297FFFF              call 00472C90
:0047958E 8945C4                  mov dword ptr [ebp-3C], eax
:00479591 8B4DD0                  mov ecx, dword ptr [ebp-30]
:00479594 81E1FF000000            and ecx, 000000FF
:0047959A 6BC924                  imul ecx, 00000024
:0047959D 81C1502C4B00            add ecx, 004B2C50
:004795A3 E89892FFFF              call 00472840
:004795A8 8945C8                  mov dword ptr [ebp-38], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047952D(C)
|
:004795AB 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004795AE 51                      push ecx
:004795AF FF1594634800            call dword ptr [00486394]
:004795B5 8945FC                  mov dword ptr [ebp-04], eax
:004795B8 C745E000000000          mov [ebp-20], 00000000
:004795BF EB09                    jmp 004795CA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00479636(U)
|
:004795C1 8B55E0                  mov edx, dword ptr [ebp-20]
:004795C4 83C201                  add edx, 00000001
:004795C7 8955E0                  mov dword ptr [ebp-20], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004795BF(U)
|
:004795CA 837DE003                cmp dword ptr [ebp-20], 00000003
:004795CE 7D68                    jge 00479638
:004795D0 8B45E0                  mov eax, dword ptr [ebp-20]
:004795D3 8B4C85D4                mov ecx, dword ptr [ebp+4*eax-2C]
:004795D7 3B4DFC                  cmp ecx, dword ptr [ebp-04]
:004795DA 755A                    jne 00479636
:004795DC 6A26                    push 00000026
:004795DE 6A00                    push 00000000
:004795E0 6A00                    push 00000000
:004795E2 6A00                    push 00000000
:004795E4 8D4DA4                  lea ecx, dword ptr [ebp-5C]
:004795E7 E8077EFEFF              call 004613F3
:004795EC 8D5594                  lea edx, dword ptr [ebp-6C]
:004795EF 52                      push edx
:004795F0 8B450C                  mov eax, dword ptr [ebp+0C]
:004795F3 50                      push eax
:004795F4 FF15EC624800            call dword ptr [004862EC]
:004795FA 8B4DE0                  mov ecx, dword ptr [ebp-20]
:004795FD 8B548DE4                mov edx, dword ptr [ebp+4*ecx-1C]
:00479601 52                      push edx
:00479602 8B45E0                  mov eax, dword ptr [ebp-20]
:00479605 8B4C85E4                mov ecx, dword ptr [ebp+4*eax-1C]
:00479609 51                      push ecx
:0047960A 8B55E0                  mov edx, dword ptr [ebp-20]
:0047960D 8B4495C4                mov eax, dword ptr [ebp+4*edx-3C]
:00479611 50                      push eax
:00479612 8D4DA4                  lea ecx, dword ptr [ebp-5C]
:00479615 E82E7EFEFF              call 00461448
:0047961A 8B4DE0                  mov ecx, dword ptr [ebp-20]
:0047961D 8B548DF0                mov edx, dword ptr [ebp+4*ecx-10]
:00479621 52                      push edx
:00479622 6A00                    push 00000000
:00479624 8D4594                  lea eax, dword ptr [ebp-6C]
:00479627 50                      push eax
:00479628 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047962B 51                      push ecx
:0047962C 8D4DA4                  lea ecx, dword ptr [ebp-5C]
:0047962F E83B7EFEFF              call 0046146F
:00479634 EB02                    jmp 00479638

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004795DA(C)
|
:00479636 EB89                    jmp 004795C1

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004795CE(C), :00479634(U)
|
:00479638 8BE5                    mov esp, ebp
:0047963A 5D                      pop ebp
:0047963B C3                      ret



* Referenced by a CALL at Addresses:
|:0047934D   , :004793AD   , :00479773   
|
:0047963C 55                      push ebp
:0047963D 8BEC                    mov ebp, esp
:0047963F 83EC10                  sub esp, 00000010
:00479642 C745F060050000          mov [ebp-10], 00000560

* Possible Reference to Dialog: DialogID_011A, CONTROL_ID:0564, ""
                                  |
:00479649 C745F464050000          mov [ebp-0C], 00000564
:00479650 C745F865050000          mov [ebp-08], 00000565
:00479657 C745FC00000000          mov [ebp-04], 00000000
:0047965E EB09                    jmp 00479669

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047968E(U)
|
:00479660 8B45FC                  mov eax, dword ptr [ebp-04]
:00479663 83C001                  add eax, 00000001
:00479666 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047965E(U)
|
:00479669 837DFC03                cmp dword ptr [ebp-04], 00000003
:0047966D 7D21                    jge 00479690
:0047966F 6A01                    push 00000001
:00479671 6A00                    push 00000000
:00479673 6A00                    push 00000000
:00479675 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00479678 8B548DF0                mov edx, dword ptr [ebp+4*ecx-10]
:0047967C 52                      push edx
:0047967D 8B4508                  mov eax, dword ptr [ebp+08]
:00479680 50                      push eax
:00479681 FF15DC624800            call dword ptr [004862DC]
:00479687 50                      push eax
:00479688 FF15B4624800            call dword ptr [004862B4]
:0047968E EBD0                    jmp 00479660

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047966D(C)
|
:00479690 8BE5                    mov esp, ebp
:00479692 5D                      pop ebp
:00479693 C3                      ret



* Referenced by a CALL at Addresses:
|:004797AF   , :004797D6   , :004797E9   , :004799C2   , :00479AF9   
|
:00479694 55                      push ebp
:00479695 8BEC                    mov ebp, esp
:00479697 83EC08                  sub esp, 00000008
:0047969A C745F8FFFF0000          mov [ebp-08], 0000FFFF
:004796A1 C745FC00000000          mov [ebp-04], 00000000
:004796A8 EB09                    jmp 004796B3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004796D3(U)
|
:004796AA 8B45FC                  mov eax, dword ptr [ebp-04]
:004796AD 83C001                  add eax, 00000001
:004796B0 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004796A8(U)
|
:004796B3 817DFC00020000          cmp dword ptr [ebp-04], 00000200
:004796BA 7319                    jnb 004796D5
:004796BC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004796BF 8B148DF06C4B00          mov edx, dword ptr [4*ecx+004B6CF0]
:004796C6 3B5508                  cmp edx, dword ptr [ebp+08]
:004796C9 7508                    jne 004796D3
:004796CB 8B45FC                  mov eax, dword ptr [ebp-04]
:004796CE 8945F8                  mov dword ptr [ebp-08], eax
:004796D1 EB02                    jmp 004796D5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004796C9(C)
|
:004796D3 EBD5                    jmp 004796AA

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004796BA(C), :004796D1(U)
|
:004796D5 8B45F8                  mov eax, dword ptr [ebp-08]
:004796D8 8BE5                    mov esp, ebp
:004796DA 5D                      pop ebp
:004796DB C3                      ret


:004796DC 55                      push ebp
:004796DD 8BEC                    mov ebp, esp
:004796DF 83EC08                  sub esp, 00000008
:004796E2 C745F8FFFF0000          mov [ebp-08], 0000FFFF
:004796E9 C745FC00000000          mov [ebp-04], 00000000
:004796F0 EB09                    jmp 004796FB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047971F(U)
|
:004796F2 8B45FC                  mov eax, dword ptr [ebp-04]
:004796F5 83C001                  add eax, 00000001
:004796F8 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004796F0(U)
|
:004796FB 837DFC73                cmp dword ptr [ebp-04], 00000073
:004796FF 7320                    jnb 00479721
:00479701 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00479704 6BC924                  imul ecx, 00000024
:00479707 81C1502C4B00            add ecx, 004B2C50
:0047970D E85E5FFEFF              call 0045F670
:00479712 3B4508                  cmp eax, dword ptr [ebp+08]
:00479715 7508                    jne 0047971F
:00479717 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047971A 894DF8                  mov dword ptr [ebp-08], ecx
:0047971D EB02                    jmp 00479721

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00479715(C)
|
:0047971F EBD1                    jmp 004796F2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004796FF(C), :0047971D(U)
|
:00479721 8B45F8                  mov eax, dword ptr [ebp-08]
:00479724 8BE5                    mov esp, ebp
:00479726 5D                      pop ebp
:00479727 C3                      ret



* Referenced by a CALL at Addresses:
|:00479803   , :004799A4   , :004799F7   
|
:00479728 55                      push ebp
:00479729 8BEC                    mov ebp, esp
:0047972B 817D0800020000          cmp dword ptr [ebp+08], 00000200
:00479732 7202                    jb 00479736
:00479734 EB5D                    jmp 00479793

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00479732(C)
|
:00479736 A108754B00              mov eax, dword ptr [004B7508]
:0047973B 50                      push eax
:0047973C FF15C8624800            call dword ptr [004862C8]
:00479742 85C0                    test eax, eax
:00479744 750E                    jne 00479754
:00479746 6A01                    push 00000001
:00479748 6A00                    push 00000000
:0047974A B9B0694B00              mov ecx, 004B69B0
:0047974F E826AFFFFF              call 0047467A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00479744(C)
|
:00479754 8B0D08754B00            mov ecx, dword ptr [004B7508]
:0047975A 51                      push ecx
:0047975B 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047975E 6BC948                  imul ecx, 00000048
:00479761 81C1681B4A00            add ecx, 004A1B68
:00479767 E81CEFFFFF              call 00478688
:0047976C 8B1508754B00            mov edx, dword ptr [004B7508]
:00479772 52                      push edx
:00479773 E8C4FEFFFF              call 0047963C
:00479778 83C404                  add esp, 00000004
:0047977B 6A09                    push 00000009
:0047977D A108754B00              mov eax, dword ptr [004B7508]
:00479782 50                      push eax
:00479783 FF15E0624800            call dword ptr [004862E0]
:00479789 6A00                    push 00000000
:0047978B E853330000              call 0047CAE3
:00479790 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00479734(U)
|
:00479793 5D                      pop ebp
:00479794 C3                      ret



* Referenced by a CALL at Addresses:
|:0043DE41   , :0044E33C   , :0044E53E   , :00454487   , :0045D7DC   
|:00479B4D   , :0047AE0B   
|
:00479795 55                      push ebp
:00479796 8BEC                    mov ebp, esp
:00479798 E88521F9FF              call 0040B922
:0047979D 85C0                    test eax, eax
:0047979F 7444                    je 004797E5
:004797A1 6A01                    push 00000001
:004797A3 E865000000              call 0047980D
:004797A8 83C404                  add esp, 00000004
:004797AB 8B4508                  mov eax, dword ptr [ebp+08]
:004797AE 50                      push eax
:004797AF E8E0FEFFFF              call 00479694
:004797B4 83C404                  add esp, 00000004
:004797B7 A304754B00              mov dword ptr [004B7504], eax
:004797BC 813D04754B00FFFF0000    cmp dword ptr [004B7504], 0000FFFF
:004797C6 751B                    jne 004797E3
:004797C8 6A00                    push 00000000
:004797CA E83E000000              call 0047980D
:004797CF 83C404                  add esp, 00000004
:004797D2 8B4D08                  mov ecx, dword ptr [ebp+08]
:004797D5 51                      push ecx
:004797D6 E8B9FEFFFF              call 00479694
:004797DB 83C404                  add esp, 00000004
:004797DE A304754B00              mov dword ptr [004B7504], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004797C6(C)
|
:004797E3 EB11                    jmp 004797F6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047979F(C)
|
:004797E5 8B5508                  mov edx, dword ptr [ebp+08]
:004797E8 52                      push edx
:004797E9 E8A6FEFFFF              call 00479694
:004797EE 83C404                  add esp, 00000004
:004797F1 A304754B00              mov dword ptr [004B7504], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004797E3(U)
|
:004797F6 A104754B00              mov eax, dword ptr [004B7504]
:004797FB 8B0C85F06C4B00          mov ecx, dword ptr [4*eax+004B6CF0]
:00479802 51                      push ecx
:00479803 E820FFFFFF              call 00479728
:00479808 83C404                  add esp, 00000004
:0047980B 5D                      pop ebp
:0047980C C3                      ret



* Referenced by a CALL at Addresses:
|:004797A3   , :004797CA   , :00479AC1   , :00479B21   , :00479D2B   
|
:0047980D 55                      push ebp
:0047980E 8BEC                    mov ebp, esp
:00479810 83EC10                  sub esp, 00000010
:00479813 C745FC00000000          mov [ebp-04], 00000000
:0047981A 6800080000              push 00000800
:0047981F 68FFFF0000              push 0000FFFF
:00479824 68F06C4B00              push 004B6CF0
:00479829 E802730000              call 00480B30
:0047982E 83C40C                  add esp, 0000000C
:00479831 C745F400000000          mov [ebp-0C], 00000000
:00479838 EB09                    jmp 00479843

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00479887(U), :004798A4(U), :0047992E(U)
|
:0047983A 8B45F4                  mov eax, dword ptr [ebp-0C]
:0047983D 83C001                  add eax, 00000001
:00479840 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00479838(U)
|
:00479843 837DF473                cmp dword ptr [ebp-0C], 00000073
:00479847 0F8DE6000000            jnl 00479933
:0047984D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00479850 6BC924                  imul ecx, 00000024
:00479853 81C1502C4B00            add ecx, 004B2C50
:00479859 E832F4F9FF              call 00418C90
:0047985E 25FF000000              and eax, 000000FF
:00479863 83F802                  cmp eax, 00000002
:00479866 0F85C2000000            jne 0047992E
:0047986C 837D0800                cmp dword ptr [ebp+08], 00000000
:00479870 7417                    je 00479889
:00479872 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00479875 6BC924                  imul ecx, 00000024
:00479878 81C1502C4B00            add ecx, 004B2C50
:0047987E E88DCEF8FF              call 00406710
:00479883 85C0                    test eax, eax
:00479885 7502                    jne 00479889
:00479887 EBB1                    jmp 0047983A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00479870(C), :00479885(C)
|
:00479889 837D0800                cmp dword ptr [ebp+08], 00000000
:0047988D 7517                    jne 004798A6
:0047988F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00479892 6BC924                  imul ecx, 00000024
:00479895 81C1502C4B00            add ecx, 004B2C50
:0047989B E870CEF8FF              call 00406710
:004798A0 85C0                    test eax, eax
:004798A2 7402                    je 004798A6
:004798A4 EB94                    jmp 0047983A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047988D(C), :004798A2(C)
|
:004798A6 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:004798A9 6BC924                  imul ecx, 00000024
:004798AC 81C1502C4B00            add ecx, 004B2C50
:004798B2 E8B95DFEFF              call 0045F670
:004798B7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:004798BA 89048DF06C4B00          mov dword ptr [4*ecx+004B6CF0], eax
:004798C1 8B55FC                  mov edx, dword ptr [ebp-04]
:004798C4 83C201                  add edx, 00000001
:004798C7 8955FC                  mov dword ptr [ebp-04], edx
:004798CA 8B45FC                  mov eax, dword ptr [ebp-04]
:004798CD 83E801                  sub eax, 00000001
:004798D0 8945F0                  mov dword ptr [ebp-10], eax
:004798D3 EB09                    jmp 004798DE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047992C(U)
|
:004798D5 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004798D8 83E901                  sub ecx, 00000001
:004798DB 894DF0                  mov dword ptr [ebp-10], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004798D3(U)
|
:004798DE 837DF000                cmp dword ptr [ebp-10], 00000000
:004798E2 7E4A                    jle 0047992E
:004798E4 8B55F0                  mov edx, dword ptr [ebp-10]
:004798E7 8B45F0                  mov eax, dword ptr [ebp-10]
:004798EA 8B0C95F06C4B00          mov ecx, dword ptr [4*edx+004B6CF0]
:004798F1 3B0C85EC6C4B00          cmp ecx, dword ptr [4*eax+004B6CEC]
:004798F8 7330                    jnb 0047992A
:004798FA 8B55F0                  mov edx, dword ptr [ebp-10]
:004798FD 8B0495EC6C4B00          mov eax, dword ptr [4*edx+004B6CEC]
:00479904 8945F8                  mov dword ptr [ebp-08], eax
:00479907 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047990A 8B55F0                  mov edx, dword ptr [ebp-10]
:0047990D 8B0495F06C4B00          mov eax, dword ptr [4*edx+004B6CF0]
:00479914 89048DEC6C4B00          mov dword ptr [4*ecx+004B6CEC], eax
:0047991B 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047991E 8B55F8                  mov edx, dword ptr [ebp-08]
:00479921 89148DF06C4B00          mov dword ptr [4*ecx+004B6CF0], edx
:00479928 EB02                    jmp 0047992C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004798F8(C)
|
:0047992A EB02                    jmp 0047992E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00479928(U)
|
:0047992C EBA7                    jmp 004798D5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00479866(C), :004798E2(C), :0047992A(U)
|
:0047992E E907FFFFFF              jmp 0047983A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00479847(C)
|
:00479933 8B45FC                  mov eax, dword ptr [ebp-04]
:00479936 8BE5                    mov esp, ebp
:00479938 5D                      pop ebp
:00479939 C3                      ret



* Referenced by a CALL at Address:
|:00479AEC   
|
:0047993A 55                      push ebp
:0047993B 8BEC                    mov ebp, esp
:0047993D 6A00                    push 00000000
:0047993F 6A01                    push 00000001
:00479941 6811010000              push 00000111
:00479946 A108754B00              mov eax, dword ptr [004B7508]
:0047994B 50                      push eax
:0047994C FF15F4624800            call dword ptr [004862F4]
:00479952 5D                      pop ebp
:00479953 C3                      ret



* Referenced by a CALL at Address:
|:004799DF   
|
:00479954 55                      push ebp
:00479955 8BEC                    mov ebp, esp
:00479957 51                      push ecx
:00479958 C745FC00000000          mov [ebp-04], 00000000
:0047995F EB09                    jmp 0047996A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00479981(U)
|
:00479961 8B45FC                  mov eax, dword ptr [ebp-04]
:00479964 83C001                  add eax, 00000001
:00479967 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047995F(U)
|
:0047996A 817DFC00020000          cmp dword ptr [ebp-04], 00000200
:00479971 7310                    jnb 00479983
:00479973 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00479976 C7048DF06C4B00FFFF0000  mov dword ptr [4*ecx+004B6CF0], 0000FFFF
:00479981 EBDE                    jmp 00479961

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00479971(C)
|
:00479983 C70504754B0000000000    mov dword ptr [004B7504], 00000000
:0047998D 8B5508                  mov edx, dword ptr [ebp+08]
:00479990 8915F06C4B00            mov dword ptr [004B6CF0], edx
:00479996 C705F46C4B00FFFF0000    mov dword ptr [004B6CF4], 0000FFFF
:004799A0 8B4508                  mov eax, dword ptr [ebp+08]
:004799A3 50                      push eax
:004799A4 E87FFDFFFF              call 00479728
:004799A9 83C404                  add esp, 00000004
:004799AC 8BE5                    mov esp, ebp
:004799AE 5D                      pop ebp
:004799AF C3                      ret



* Referenced by a CALL at Address:
|:00429C86   
|
:004799B0 55                      push ebp
:004799B1 8BEC                    mov ebp, esp
:004799B3 817D0800020000          cmp dword ptr [ebp+08], 00000200
:004799BA 7202                    jb 004799BE
:004799BC EB41                    jmp 004799FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004799BA(C)
|
:004799BE 8B4508                  mov eax, dword ptr [ebp+08]
:004799C1 50                      push eax
:004799C2 E8CDFCFFFF              call 00479694
:004799C7 83C404                  add esp, 00000004
:004799CA A304754B00              mov dword ptr [004B7504], eax
:004799CF 813D04754B00FFFF0000    cmp dword ptr [004B7504], 0000FFFF
:004799D9 750E                    jne 004799E9
:004799DB 8B4D08                  mov ecx, dword ptr [ebp+08]
:004799DE 51                      push ecx
:004799DF E870FFFFFF              call 00479954
:004799E4 83C404                  add esp, 00000004
:004799E7 EB16                    jmp 004799FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004799D9(C)
|
:004799E9 8B1504754B00            mov edx, dword ptr [004B7504]
:004799EF 8B0495F06C4B00          mov eax, dword ptr [4*edx+004B6CF0]
:004799F6 50                      push eax
:004799F7 E82CFDFFFF              call 00479728
:004799FC 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004799BC(U), :004799E7(U)
|
:004799FF 5D                      pop ebp
:00479A00 C3                      ret



* Referenced by a CALL at Addresses:
|:004089BD   , :004121DC   , :00414D03   , :00414EB3   , :00415402   
|:00415475   , :004154DC   , :00415544   , :0041DCF1   , :0041DD05   
|:00420DCF   , :00420EAE   , :00422DB6   , :00423131   , :0043EAF7   
|:004418A0   , :00442AA8   , :0044E0C6   , :00459476   , :0045ADB3   
|:00468E07   , :0046BF8C   
|
:00479A01 55                      push ebp
:00479A02 8BEC                    mov ebp, esp
:00479A04 51                      push ecx
:00479A05 A108754B00              mov eax, dword ptr [004B7508]
:00479A0A 50                      push eax
:00479A0B FF15C8624800            call dword ptr [004862C8]
:00479A11 85C0                    test eax, eax
:00479A13 740C                    je 00479A21
:00479A15 813D04754B0000020000    cmp dword ptr [004B7504], 00000200
:00479A1F 7205                    jb 00479A26

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00479A13(C)
|
:00479A21 E92F010000              jmp 00479B55

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00479A1F(C)
|
:00479A26 E8F71EF9FF              call 0040B922
:00479A2B 85C0                    test eax, eax
:00479A2D 0F8405010000            je 00479B38
:00479A33 8B4D08                  mov ecx, dword ptr [ebp+08]
:00479A36 6BC948                  imul ecx, 00000048
:00479A39 81C1681B4A00            add ecx, 004A1B68
:00479A3F E898E0FFFF              call 00477ADC
:00479A44 8845FC                  mov byte ptr [ebp-04], al
:00479A47 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00479A4A 81E1FF000000            and ecx, 000000FF
:00479A50 83F973                  cmp ecx, 00000073
:00479A53 7C05                    jl 00479A5A
:00479A55 E9FB000000              jmp 00479B55

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00479A53(C)
|
:00479A5A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00479A5D 81E1FF000000            and ecx, 000000FF
:00479A63 6BC924                  imul ecx, 00000024
:00479A66 81C1502C4B00            add ecx, 004B2C50
:00479A6C E81FF2F9FF              call 00418C90
:00479A71 25FF000000              and eax, 000000FF
:00479A76 83F803                  cmp eax, 00000003
:00479A79 0F85B9000000            jne 00479B38
:00479A7F 8B1504754B00            mov edx, dword ptr [004B7504]
:00479A85 8B0495F06C4B00          mov eax, dword ptr [4*edx+004B6CF0]
:00479A8C 3B4508                  cmp eax, dword ptr [ebp+08]
:00479A8F 7564                    jne 00479AF5
:00479A91 833D04754B0000          cmp dword ptr [004B7504], 00000000
:00479A98 740F                    je 00479AA9
:00479A9A 8B0D04754B00            mov ecx, dword ptr [004B7504]
:00479AA0 83E901                  sub ecx, 00000001
:00479AA3 890D04754B00            mov dword ptr [004B7504], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00479A98(C)
|
:00479AA9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00479AAC 81E1FF000000            and ecx, 000000FF
:00479AB2 6BC924                  imul ecx, 00000024
:00479AB5 81C1502C4B00            add ecx, 004B2C50
:00479ABB E850CCF8FF              call 00406710
:00479AC0 50                      push eax
:00479AC1 E847FDFFFF              call 0047980D
:00479AC6 83C404                  add esp, 00000004
:00479AC9 8B1504754B00            mov edx, dword ptr [004B7504]
:00479ACF 8B0495F06C4B00          mov eax, dword ptr [4*edx+004B6CF0]
:00479AD6 894508                  mov dword ptr [ebp+08], eax
:00479AD9 817D0800020000          cmp dword ptr [ebp+08], 00000200
:00479AE0 7211                    jb 00479AF3
:00479AE2 C70504754B00FFFF0000    mov dword ptr [004B7504], 0000FFFF
:00479AEC E849FEFFFF              call 0047993A
:00479AF1 EB62                    jmp 00479B55

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00479AE0(C)
|
:00479AF3 EB43                    jmp 00479B38

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00479A8F(C)
|
:00479AF5 8B4D08                  mov ecx, dword ptr [ebp+08]
:00479AF8 51                      push ecx
:00479AF9 E896FBFFFF              call 00479694
:00479AFE 83C404                  add esp, 00000004
:00479B01 390504754B00            cmp dword ptr [004B7504], eax
:00479B07 762F                    jbe 00479B38
:00479B09 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00479B0C 81E1FF000000            and ecx, 000000FF
:00479B12 6BC924                  imul ecx, 00000024
:00479B15 81C1502C4B00            add ecx, 004B2C50
:00479B1B E8F0CBF8FF              call 00406710
:00479B20 50                      push eax
:00479B21 E8E7FCFFFF              call 0047980D
:00479B26 83C404                  add esp, 00000004
:00479B29 8B1504754B00            mov edx, dword ptr [004B7504]
:00479B2F 83EA01                  sub edx, 00000001
:00479B32 891504754B00            mov dword ptr [004B7504], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00479A2D(C), :00479A79(C), :00479AF3(U), :00479B07(C)
|
:00479B38 A104754B00              mov eax, dword ptr [004B7504]
:00479B3D 8B0C85F06C4B00          mov ecx, dword ptr [4*eax+004B6CF0]
:00479B44 3B4D08                  cmp ecx, dword ptr [ebp+08]
:00479B47 750C                    jne 00479B55
:00479B49 8B5508                  mov edx, dword ptr [ebp+08]
:00479B4C 52                      push edx
:00479B4D E843FCFFFF              call 00479795
:00479B52 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00479A21(U), :00479A55(U), :00479AF1(U), :00479B47(C)
|
:00479B55 8BE5                    mov esp, ebp
:00479B57 5D                      pop ebp
:00479B58 C3                      ret



* Referenced by a CALL at Address:
|:00479BC0   
|
:00479B59 55                      push ebp
:00479B5A 8BEC                    mov ebp, esp
:00479B5C C70504754B0000000000    mov dword ptr [004B7504], 00000000
:00479B66 A108754B00              mov eax, dword ptr [004B7508]
:00479B6B 50                      push eax
:00479B6C FF1548634800            call dword ptr [00486348]
:00479B72 85C0                    test eax, eax
:00479B74 7532                    jne 00479BA8
:00479B76 6A00                    push 00000000
:00479B78 6864914700              push 00479164
:00479B7D 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:00479B83 51                      push ecx

* Possible Reference to Dialog: DialogID_00A6 
                                  |
:00479B84 68A6000000              push 000000A6
:00479B89 8B15606A4B00            mov edx, dword ptr [004B6A60]
:00479B8F 52                      push edx
:00479B90 FF15B0624800            call dword ptr [004862B0]
:00479B96 A308754B00              mov dword ptr [004B7508], eax
:00479B9B 833D08754B0000          cmp dword ptr [004B7508], 00000000
:00479BA2 7504                    jne 00479BA8
:00479BA4 33C0                    xor eax, eax
:00479BA6 EB13                    jmp 00479BBB

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00479B74(C), :00479BA2(C)
|
:00479BA8 6A00                    push 00000000
:00479BAA A108754B00              mov eax, dword ptr [004B7508]
:00479BAF 50                      push eax
:00479BB0 FF15E0624800            call dword ptr [004862E0]
:00479BB6 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00479BA6(U)
|
:00479BBB 5D                      pop ebp
:00479BBC C3                      ret



* Referenced by a CALL at Address:
|:0041C01F   
|
:00479BBD 55                      push ebp
:00479BBE 8BEC                    mov ebp, esp
:00479BC0 E894FFFFFF              call 00479B59
:00479BC5 85C0                    test eax, eax
:00479BC7 7504                    jne 00479BCD
:00479BC9 33C0                    xor eax, eax
:00479BCB EB0A                    jmp 00479BD7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00479BC7(C)
|
:00479BCD E82D6CFEFF              call 004607FF
:00479BD2 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00479BCB(U)
|
:00479BD7 5D                      pop ebp
:00479BD8 C3                      ret



* Referenced by a CALL at Addresses:
|:0044D106   , :0044D4AB   
|
:00479BD9 55                      push ebp
:00479BDA 8BEC                    mov ebp, esp
:00479BDC 6A00                    push 00000000
:00479BDE A108754B00              mov eax, dword ptr [004B7508]
:00479BE3 50                      push eax
:00479BE4 FF15E0624800            call dword ptr [004862E0]
:00479BEA E86FC8FFFF              call 0047645E
:00479BEF 5D                      pop ebp
:00479BF0 C3                      ret



* Referenced by a CALL at Addresses:
|:0044EC24   , :0044F012   
|
:00479BF1 55                      push ebp
:00479BF2 8BEC                    mov ebp, esp
:00479BF4 6A00                    push 00000000
:00479BF6 A1D85F4B00              mov eax, dword ptr [004B5FD8]
:00479BFB 50                      push eax
:00479BFC FF15E0624800            call dword ptr [004862E0]
:00479C02 6A00                    push 00000000
:00479C04 8B0DDC5F4B00            mov ecx, dword ptr [004B5FDC]
:00479C0A 51                      push ecx
:00479C0B FF15E0624800            call dword ptr [004862E0]
:00479C11 6A00                    push 00000000
:00479C13 8B1508754B00            mov edx, dword ptr [004B7508]
:00479C19 52                      push edx
:00479C1A FF15E0624800            call dword ptr [004862E0]
:00479C20 C705E8BA4800FFFF0000    mov dword ptr [0048BAE8], 0000FFFF
:00479C2A C705E4BA4800FFFF0000    mov dword ptr [0048BAE4], 0000FFFF
:00479C34 C705E0BA4800FFFF0000    mov dword ptr [0048BAE0], 0000FFFF
:00479C3E E8EFCFFAFF              call 00426C32
:00479C43 5D                      pop ebp
:00479C44 C3                      ret



* Referenced by a CALL at Address:
|:0047AFA8   
|
:00479C45 55                      push ebp
:00479C46 8BEC                    mov ebp, esp
:00479C48 6AFF                    push FFFFFFFF
:00479C4A 685F5D4800              push 00485D5F
:00479C4F 64A100000000            mov eax, dword ptr fs:[00000000]
:00479C55 50                      push eax
:00479C56 64892500000000          mov dword ptr fs:[00000000], esp
:00479C5D 83EC34                  sub esp, 00000034
:00479C60 894DC0                  mov dword ptr [ebp-40], ecx
:00479C63 8B4DC0                  mov ecx, dword ptr [ebp-40]
:00479C66 E8429FFEFF              call 00463BAD
:00479C6B C745FC00000000          mov [ebp-04], 00000000
:00479C72 8B45C0                  mov eax, dword ptr [ebp-40]
:00479C75 C70000774800            mov dword ptr [eax], 00487700
:00479C7B 8B4DC0                  mov ecx, dword ptr [ebp-40]
:00479C7E C7415400000000          mov [ecx+54], 00000000
:00479C85 8B55C0                  mov edx, dword ptr [ebp-40]
:00479C88 C7425801000000          mov [edx+58], 00000001
:00479C8F C745C400000000          mov [ebp-3C], 00000000
:00479C96 C745C801000000          mov [ebp-38], 00000001
:00479C9D C745CC02000000          mov [ebp-34], 00000002
:00479CA4 C745D003000000          mov [ebp-30], 00000003
:00479CAB C745D404000000          mov [ebp-2C], 00000004
:00479CB2 C745D805000000          mov [ebp-28], 00000005

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:00479CB9 C745DC06000000          mov [ebp-24], 00000006

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0007, "&"
                                  |
:00479CC0 C745E007000000          mov [ebp-20], 00000007
:00479CC7 C745E408000000          mov [ebp-1C], 00000008
:00479CCE C745E809000000          mov [ebp-18], 00000009
:00479CD5 C745EC0A000000          mov [ebp-14], 0000000A
:00479CDC C645F00B                mov [ebp-10], 0B
:00479CE0 8D45C4                  lea eax, dword ptr [ebp-3C]
:00479CE3 50                      push eax
:00479CE4 8A4DF0                  mov cl, byte ptr [ebp-10]
:00479CE7 51                      push ecx
:00479CE8 8B4DC0                  mov ecx, dword ptr [ebp-40]
:00479CEB E80BA0FEFF              call 00463CFB
:00479CF0 8B55C0                  mov edx, dword ptr [ebp-40]
:00479CF3 C7421C00000000          mov [edx+1C], 00000000
:00479CFA C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00479D01 8B45C0                  mov eax, dword ptr [ebp-40]
:00479D04 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00479D07 64890D00000000          mov dword ptr fs:[00000000], ecx
:00479D0E 8BE5                    mov esp, ebp
:00479D10 5D                      pop ebp
:00479D11 C3                      ret



* Referenced by a CALL at Addresses:
|:0047A61A   , :0047AE91   
|
:00479D12 55                      push ebp
:00479D13 8BEC                    mov ebp, esp
:00479D15 83EC0C                  sub esp, 0000000C
:00479D18 894DF4                  mov dword ptr [ebp-0C], ecx
:00479D1B 8B45F4                  mov eax, dword ptr [ebp-0C]
:00479D1E 83785400                cmp dword ptr [eax+54], 00000000
:00479D22 7414                    je 00479D38
:00479D24 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00479D27 8B5158                  mov edx, dword ptr [ecx+58]
:00479D2A 52                      push edx
:00479D2B E8DDFAFFFF              call 0047980D
:00479D30 83C404                  add esp, 00000004
:00479D33 8945F8                  mov dword ptr [ebp-08], eax
:00479D36 EB08                    jmp 00479D40

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00479D22(C)
|
:00479D38 E883CBFFFF              call 004768C0
:00479D3D 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00479D36(U)
|
:00479D40 C745FC00000000          mov [ebp-04], 00000000
:00479D47 EB09                    jmp 00479D52

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00479D79(U)
|
:00479D49 8B45FC                  mov eax, dword ptr [ebp-04]
:00479D4C 83C001                  add eax, 00000001
:00479D4F 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00479D47(U)
|
:00479D52 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00479D55 3B4DF8                  cmp ecx, dword ptr [ebp-08]
:00479D58 7321                    jnb 00479D7B
:00479D5A 8B55FC                  mov edx, dword ptr [ebp-04]
:00479D5D 8B0495F06C4B00          mov eax, dword ptr [4*edx+004B6CF0]
:00479D64 6BC048                  imul eax, 00000048
:00479D67 05681B4A00              add eax, 004A1B68
:00479D6C 50                      push eax
:00479D6D 8A4DFC                  mov cl, byte ptr [ebp-04]
:00479D70 51                      push ecx
:00479D71 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00479D74 E80AA0FEFF              call 00463D83
:00479D79 EBCE                    jmp 00479D49

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00479D58(C)
|
:00479D7B 8B55F4                  mov edx, dword ptr [ebp-0C]
:00479D7E 837A1C00                cmp dword ptr [edx+1C], 00000000
:00479D82 7C11                    jl 00479D95
:00479D84 6A00                    push 00000000
:00479D86 8B45F4                  mov eax, dword ptr [ebp-0C]
:00479D89 8B481C                  mov ecx, dword ptr [eax+1C]
:00479D8C 51                      push ecx
:00479D8D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00479D90 E896AFFEFF              call 00464D2B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00479D82(C)
|
:00479D95 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00479D98 E830A3FEFF              call 004640CD
:00479D9D 8BE5                    mov esp, ebp
:00479D9F 5D                      pop ebp
:00479DA0 C3                      ret


:00479DA1 55                      push ebp
:00479DA2 8BEC                    mov ebp, esp
:00479DA4 83EC08                  sub esp, 00000008
:00479DA7 894DFC                  mov dword ptr [ebp-04], ecx
:00479DAA 8B45FC                  mov eax, dword ptr [ebp-04]
:00479DAD 8B4818                  mov ecx, dword ptr [eax+18]
:00479DB0 8B5508                  mov edx, dword ptr [ebp+08]
:00479DB3 8B0491                  mov eax, dword ptr [ecx+4*edx]
:00479DB6 8945F8                  mov dword ptr [ebp-08], eax
:00479DB9 837DF80A                cmp dword ptr [ebp-08], 0000000A
:00479DBD 0F8768010000            ja 00479F2B
:00479DC3 8B4DF8                  mov ecx, dword ptr [ebp-08]
:00479DC6 FF248D339F4700          jmp dword ptr [4*ecx+00479F33]
:00479DCD 68F06B4800              push 00486BF0
:00479DD2 6A00                    push 00000000
:00479DD4 6811100000              push 00001011
:00479DD9 8B55FC                  mov edx, dword ptr [ebp-04]
:00479DDC 8B4210                  mov eax, dword ptr [edx+10]
:00479DDF 50                      push eax
:00479DE0 FF15F4624800            call dword ptr [004862F4]
:00479DE6 83C00C                  add eax, 0000000C
:00479DE9 E93F010000              jmp 00479F2D
:00479DEE 68B86A4800              push 00486AB8
:00479DF3 6A00                    push 00000000
:00479DF5 6811100000              push 00001011
:00479DFA 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00479DFD 8B5110                  mov edx, dword ptr [ecx+10]
:00479E00 52                      push edx
:00479E01 FF15F4624800            call dword ptr [004862F4]
:00479E07 83C00C                  add eax, 0000000C
:00479E0A E91E010000              jmp 00479F2D
:00479E0F 68C46A4800              push 00486AC4
:00479E14 6A00                    push 00000000
:00479E16 6811100000              push 00001011
:00479E1B 8B45FC                  mov eax, dword ptr [ebp-04]
:00479E1E 8B4810                  mov ecx, dword ptr [eax+10]
:00479E21 51                      push ecx
:00479E22 FF15F4624800            call dword ptr [004862F4]
:00479E28 83C00C                  add eax, 0000000C
:00479E2B E9FD000000              jmp 00479F2D
:00479E30 68006C4800              push 00486C00
:00479E35 6A00                    push 00000000
:00479E37 6811100000              push 00001011
:00479E3C 8B55FC                  mov edx, dword ptr [ebp-04]
:00479E3F 8B4210                  mov eax, dword ptr [edx+10]
:00479E42 50                      push eax
:00479E43 FF15F4624800            call dword ptr [004862F4]
:00479E49 83C00A                  add eax, 0000000A
:00479E4C E9DC000000              jmp 00479F2D
:00479E51 68006C4800              push 00486C00
:00479E56 6A00                    push 00000000
:00479E58 6811100000              push 00001011
:00479E5D 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00479E60 8B5110                  mov edx, dword ptr [ecx+10]
:00479E63 52                      push edx
:00479E64 FF15F4624800            call dword ptr [004862F4]
:00479E6A 83C00A                  add eax, 0000000A
:00479E6D E9BB000000              jmp 00479F2D
:00479E72 68E86A4800              push 00486AE8
:00479E77 6A00                    push 00000000
:00479E79 6811100000              push 00001011
:00479E7E 8B45FC                  mov eax, dword ptr [ebp-04]
:00479E81 8B4810                  mov ecx, dword ptr [eax+10]
:00479E84 51                      push ecx
:00479E85 FF15F4624800            call dword ptr [004862F4]
:00479E8B 83C00C                  add eax, 0000000C
:00479E8E E99A000000              jmp 00479F2D
:00479E93 68F86A4800              push 00486AF8
:00479E98 6A00                    push 00000000
:00479E9A 6811100000              push 00001011
:00479E9F 8B55FC                  mov edx, dword ptr [ebp-04]
:00479EA2 8B4210                  mov eax, dword ptr [edx+10]
:00479EA5 50                      push eax
:00479EA6 FF15F4624800            call dword ptr [004862F4]
:00479EAC 83C00C                  add eax, 0000000C
:00479EAF EB7C                    jmp 00479F2D
:00479EB1 68086B4800              push 00486B08
:00479EB6 6A00                    push 00000000
:00479EB8 6811100000              push 00001011
:00479EBD 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00479EC0 8B5110                  mov edx, dword ptr [ecx+10]
:00479EC3 52                      push edx
:00479EC4 FF15F4624800            call dword ptr [004862F4]
:00479ECA 83C00C                  add eax, 0000000C
:00479ECD EB5E                    jmp 00479F2D
:00479ECF 68186B4800              push 00486B18
:00479ED4 6A00                    push 00000000
:00479ED6 6811100000              push 00001011
:00479EDB 8B45FC                  mov eax, dword ptr [ebp-04]
:00479EDE 8B4810                  mov ecx, dword ptr [eax+10]
:00479EE1 51                      push ecx
:00479EE2 FF15F4624800            call dword ptr [004862F4]
:00479EE8 83C00C                  add eax, 0000000C
:00479EEB EB40                    jmp 00479F2D
:00479EED 8B15286B4800            mov edx, dword ptr [00486B28]
:00479EF3 52                      push edx
:00479EF4 6A00                    push 00000000
:00479EF6 6811100000              push 00001011
:00479EFB 8B45FC                  mov eax, dword ptr [ebp-04]
:00479EFE 8B4810                  mov ecx, dword ptr [eax+10]
:00479F01 51                      push ecx
:00479F02 FF15F4624800            call dword ptr [004862F4]
:00479F08 83C00C                  add eax, 0000000C
:00479F0B EB20                    jmp 00479F2D
:00479F0D 68D46A4800              push 00486AD4
:00479F12 6A00                    push 00000000
:00479F14 6811100000              push 00001011
:00479F19 8B55FC                  mov edx, dword ptr [ebp-04]
:00479F1C 8B4210                  mov eax, dword ptr [edx+10]
:00479F1F 50                      push eax
:00479F20 FF15F4624800            call dword ptr [004862F4]
:00479F26 83C00A                  add eax, 0000000A
:00479F29 EB02                    jmp 00479F2D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00479DBD(C)
|
:00479F2B 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00479DE9(U), :00479E0A(U), :00479E2B(U), :00479E4C(U), :00479E6D(U)
|:00479E8E(U), :00479EAF(U), :00479ECD(U), :00479EEB(U), :00479F0B(U)
|:00479F29(U)
|
:00479F2D 8BE5                    mov esp, ebp
:00479F2F 5D                      pop ebp
:00479F30 C20400                  ret 0004



:00479F33 CD9D4700                DWORD 00479DCD
:00479F37 EE9D4700                DWORD 00479DEE
:00479F3B 0F9E4700                DWORD 00479E0F
:00479F3F 0D9F4700                DWORD 00479F0D
:00479F43 309E4700                DWORD 00479E30
:00479F47 519E4700                DWORD 00479E51
:00479F4B 729E4700                DWORD 00479E72
:00479F4F 939E4700                DWORD 00479E93
:00479F53 B19E4700                DWORD 00479EB1
:00479F57 CF9E4700                DWORD 00479ECF
:00479F5B ED9E4700                DWORD 00479EED



* Referenced by a CALL at Address:
|:0047AFBF   
|
:00479F5F 55                      push ebp
:00479F60 8BEC                    mov ebp, esp
:00479F62 51                      push ecx
:00479F63 894DFC                  mov dword ptr [ebp-04], ecx
:00479F66 8B45FC                  mov eax, dword ptr [ebp-04]
:00479F69 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00479F6C 894850                  mov dword ptr [eax+50], ecx
:00479F6F 8B55FC                  mov edx, dword ptr [ebp-04]
:00479F72 52                      push edx

* Possible StringData Ref from Code Obj ->"U}"
                                  |
:00479F73 689CAE4700              push 0047AE9C
:00479F78 8B450C                  mov eax, dword ptr [ebp+0C]
:00479F7B 50                      push eax

* Possible Reference to Dialog: DialogID_00BA 
                                  |
:00479F7C 68BA000000              push 000000BA
:00479F81 8B4D08                  mov ecx, dword ptr [ebp+08]
:00479F84 51                      push ecx
:00479F85 FF15A0624800            call dword ptr [004862A0]
:00479F8B 8BE5                    mov esp, ebp
:00479F8D 5D                      pop ebp
:00479F8E C20800                  ret 0008


:00479F91 55                      push ebp
:00479F92 8BEC                    mov ebp, esp
:00479F94 83EC1C                  sub esp, 0000001C
:00479F97 53                      push ebx
:00479F98 56                      push esi
:00479F99 894DE8                  mov dword ptr [ebp-18], ecx
:00479F9C 8B4508                  mov eax, dword ptr [ebp+08]
:00479F9F 8945F4                  mov dword ptr [ebp-0C], eax
:00479FA2 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00479FA5 894DF0                  mov dword ptr [ebp-10], ecx
:00479FA8 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00479FAB E82CDBFFFF              call 00477ADC
:00479FB0 8845F8                  mov byte ptr [ebp-08], al
:00479FB3 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00479FB6 E821DBFFFF              call 00477ADC
:00479FBB 8845EC                  mov byte ptr [ebp-14], al
:00479FBE 8B5510                  mov edx, dword ptr [ebp+10]
:00479FC1 8955E4                  mov dword ptr [ebp-1C], edx
:00479FC4 837DE40A                cmp dword ptr [ebp-1C], 0000000A
:00479FC8 0F87C0030000            ja 0047A38E
:00479FCE 8B45E4                  mov eax, dword ptr [ebp-1C]
:00479FD1 FF2485A0A34700          jmp dword ptr [4*eax+0047A3A0]
:00479FD8 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:00479FDB E820F5F8FF              call 00409500
:00479FE0 8BF0                    mov esi, eax
:00479FE2 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00479FE5 E816F5F8FF              call 00409500
:00479FEA 2BF0                    sub esi, eax
:00479FEC 8975FC                  mov dword ptr [ebp-04], esi
:00479FEF E9A1030000              jmp 0047A395
:00479FF4 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00479FF7 E876D8F8FF              call 00407872
:00479FFC 8AD8                    mov bl, al
:00479FFE 81E3FF000000            and ebx, 000000FF
:0047A004 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047A007 E866D8F8FF              call 00407872
:0047A00C 25FF000000              and eax, 000000FF
:0047A011 2BD8                    sub ebx, eax
:0047A013 895DFC                  mov dword ptr [ebp-04], ebx
:0047A016 E97A030000              jmp 0047A395
:0047A01B 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047A01E E8ADC5F8FF              call 004065D0
:0047A023 8AD8                    mov bl, al
:0047A025 81E3FF000000            and ebx, 000000FF
:0047A02B 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047A02E E89DC5F8FF              call 004065D0
:0047A033 25FF000000              and eax, 000000FF
:0047A038 2BD8                    sub ebx, eax
:0047A03A 895DFC                  mov dword ptr [ebp-04], ebx
:0047A03D E953030000              jmp 0047A395
:0047A042 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047A045 E806C6F8FF              call 00406650
:0047A04A 8AD8                    mov bl, al
:0047A04C 81E3FF000000            and ebx, 000000FF
:0047A052 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047A055 E8F6C5F8FF              call 00406650
:0047A05A 25FF000000              and eax, 000000FF
:0047A05F 2BD8                    sub ebx, eax
:0047A061 895DFC                  mov dword ptr [ebp-04], ebx
:0047A064 E92C030000              jmp 0047A395
:0047A069 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047A06C 81E1FF000000            and ecx, 000000FF
:0047A072 81F9FF000000            cmp ecx, 000000FF
:0047A078 7448                    je 0047A0C2
:0047A07A 8B55EC                  mov edx, dword ptr [ebp-14]
:0047A07D 81E2FF000000            and edx, 000000FF
:0047A083 81FAFF000000            cmp edx, 000000FF
:0047A089 7437                    je 0047A0C2
:0047A08B 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0047A08E 81E1FF000000            and ecx, 000000FF
:0047A094 6BC924                  imul ecx, 00000024
:0047A097 81C1502C4B00            add ecx, 004B2C50
:0047A09D E8EE8BFFFF              call 00472C90
:0047A0A2 8BF0                    mov esi, eax
:0047A0A4 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047A0A7 81E1FF000000            and ecx, 000000FF
:0047A0AD 6BC924                  imul ecx, 00000024
:0047A0B0 81C1502C4B00            add ecx, 004B2C50
:0047A0B6 E8D58BFFFF              call 00472C90
:0047A0BB 2BF0                    sub esi, eax
:0047A0BD 8975FC                  mov dword ptr [ebp-04], esi
:0047A0C0 EB17                    jmp 0047A0D9

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047A078(C), :0047A089(C)
|
:0047A0C2 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047A0C5 E851D1F8FF              call 0040721B
:0047A0CA 8BF0                    mov esi, eax
:0047A0CC 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047A0CF E847D1F8FF              call 0040721B
:0047A0D4 2BF0                    sub esi, eax
:0047A0D6 8975FC                  mov dword ptr [ebp-04], esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047A0C0(U)
|
:0047A0D9 E9B7020000              jmp 0047A395
:0047A0DE 8B45F8                  mov eax, dword ptr [ebp-08]
:0047A0E1 25FF000000              and eax, 000000FF
:0047A0E6 3DFF000000              cmp eax, 000000FF
:0047A0EB 7448                    je 0047A135
:0047A0ED 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0047A0F0 81E1FF000000            and ecx, 000000FF
:0047A0F6 81F9FF000000            cmp ecx, 000000FF
:0047A0FC 7437                    je 0047A135
:0047A0FE 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0047A101 81E1FF000000            and ecx, 000000FF
:0047A107 6BC924                  imul ecx, 00000024
:0047A10A 81C1502C4B00            add ecx, 004B2C50
:0047A110 E82B87FFFF              call 00472840
:0047A115 8BF0                    mov esi, eax
:0047A117 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047A11A 81E1FF000000            and ecx, 000000FF
:0047A120 6BC924                  imul ecx, 00000024
:0047A123 81C1502C4B00            add ecx, 004B2C50
:0047A129 E81287FFFF              call 00472840
:0047A12E 2BF0                    sub esi, eax
:0047A130 8975FC                  mov dword ptr [ebp-04], esi
:0047A133 EB17                    jmp 0047A14C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047A0EB(C), :0047A0FC(C)
|
:0047A135 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047A138 E80DD1F8FF              call 0040724A
:0047A13D 8BF0                    mov esi, eax
:0047A13F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047A142 E803D1F8FF              call 0040724A
:0047A147 2BF0                    sub esi, eax
:0047A149 8975FC                  mov dword ptr [ebp-04], esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047A133(U)
|
:0047A14C E944020000              jmp 0047A395
:0047A151 8B55F8                  mov edx, dword ptr [ebp-08]
:0047A154 81E2FF000000            and edx, 000000FF
:0047A15A 81FAFF000000            cmp edx, 000000FF
:0047A160 7446                    je 0047A1A8
:0047A162 8B45EC                  mov eax, dword ptr [ebp-14]
:0047A165 25FF000000              and eax, 000000FF
:0047A16A 3DFF000000              cmp eax, 000000FF
:0047A16F 7437                    je 0047A1A8
:0047A171 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0047A174 81E1FF000000            and ecx, 000000FF
:0047A17A 6BC924                  imul ecx, 00000024
:0047A17D 81C1502C4B00            add ecx, 004B2C50
:0047A183 E87653FCFF              call 0043F4FE
:0047A188 8BF0                    mov esi, eax
:0047A18A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047A18D 81E1FF000000            and ecx, 000000FF
:0047A193 6BC924                  imul ecx, 00000024
:0047A196 81C1502C4B00            add ecx, 004B2C50
:0047A19C E85D53FCFF              call 0043F4FE
:0047A1A1 2BF0                    sub esi, eax
:0047A1A3 8975FC                  mov dword ptr [ebp-04], esi
:0047A1A6 EB17                    jmp 0047A1BF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047A160(C), :0047A16F(C)
|
:0047A1A8 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047A1AB E876CFF8FF              call 00407126
:0047A1B0 8BF0                    mov esi, eax
:0047A1B2 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047A1B5 E86CCFF8FF              call 00407126
:0047A1BA 2BF0                    sub esi, eax
:0047A1BC 8975FC                  mov dword ptr [ebp-04], esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047A1A6(U)
|
:0047A1BF E9D1010000              jmp 0047A395
:0047A1C4 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047A1C7 81E1FF000000            and ecx, 000000FF
:0047A1CD 81F9FF000000            cmp ecx, 000000FF
:0047A1D3 7448                    je 0047A21D
:0047A1D5 8B55EC                  mov edx, dword ptr [ebp-14]
:0047A1D8 81E2FF000000            and edx, 000000FF
:0047A1DE 81FAFF000000            cmp edx, 000000FF
:0047A1E4 7437                    je 0047A21D
:0047A1E6 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0047A1E9 81E1FF000000            and ecx, 000000FF
:0047A1EF 6BC924                  imul ecx, 00000024
:0047A1F2 81C1502C4B00            add ecx, 004B2C50
:0047A1F8 E89853FCFF              call 0043F595
:0047A1FD 8BF0                    mov esi, eax
:0047A1FF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047A202 81E1FF000000            and ecx, 000000FF
:0047A208 6BC924                  imul ecx, 00000024
:0047A20B 81C1502C4B00            add ecx, 004B2C50
:0047A211 E87F53FCFF              call 0043F595
:0047A216 2BF0                    sub esi, eax
:0047A218 8975FC                  mov dword ptr [ebp-04], esi
:0047A21B EB17                    jmp 0047A234

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047A1D3(C), :0047A1E4(C)
|
:0047A21D 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047A220 E832CFF8FF              call 00407157
:0047A225 8BF0                    mov esi, eax
:0047A227 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047A22A E828CFF8FF              call 00407157
:0047A22F 2BF0                    sub esi, eax
:0047A231 8975FC                  mov dword ptr [ebp-04], esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047A21B(U)
|
:0047A234 E95C010000              jmp 0047A395
:0047A239 8B45F8                  mov eax, dword ptr [ebp-08]
:0047A23C 25FF000000              and eax, 000000FF
:0047A241 3DFF000000              cmp eax, 000000FF
:0047A246 7448                    je 0047A290
:0047A248 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0047A24B 81E1FF000000            and ecx, 000000FF
:0047A251 81F9FF000000            cmp ecx, 000000FF
:0047A257 7437                    je 0047A290
:0047A259 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0047A25C 81E1FF000000            and ecx, 000000FF
:0047A262 6BC924                  imul ecx, 00000024
:0047A265 81C1502C4B00            add ecx, 004B2C50
:0047A26B E87353FCFF              call 0043F5E3
:0047A270 8BF0                    mov esi, eax
:0047A272 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047A275 81E1FF000000            and ecx, 000000FF
:0047A27B 6BC924                  imul ecx, 00000024
:0047A27E 81C1502C4B00            add ecx, 004B2C50
:0047A284 E85A53FCFF              call 0043F5E3
:0047A289 2BF0                    sub esi, eax
:0047A28B 8975FC                  mov dword ptr [ebp-04], esi
:0047A28E EB17                    jmp 0047A2A7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047A246(C), :0047A257(C)
|
:0047A290 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047A293 E8F0CEF8FF              call 00407188
:0047A298 8BF0                    mov esi, eax
:0047A29A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047A29D E8E6CEF8FF              call 00407188
:0047A2A2 2BF0                    sub esi, eax
:0047A2A4 8975FC                  mov dword ptr [ebp-04], esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047A28E(U)
|
:0047A2A7 E9E9000000              jmp 0047A395
:0047A2AC 8B55F8                  mov edx, dword ptr [ebp-08]
:0047A2AF 81E2FF000000            and edx, 000000FF
:0047A2B5 81FAFF000000            cmp edx, 000000FF
:0047A2BB 7446                    je 0047A303
:0047A2BD 8B45EC                  mov eax, dword ptr [ebp-14]
:0047A2C0 25FF000000              and eax, 000000FF
:0047A2C5 3DFF000000              cmp eax, 000000FF
:0047A2CA 7437                    je 0047A303
:0047A2CC 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0047A2CF 81E1FF000000            and ecx, 000000FF
:0047A2D5 6BC924                  imul ecx, 00000024
:0047A2D8 81C1502C4B00            add ecx, 004B2C50
:0047A2DE E84E53FCFF              call 0043F631
:0047A2E3 8BF0                    mov esi, eax
:0047A2E5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047A2E8 81E1FF000000            and ecx, 000000FF
:0047A2EE 6BC924                  imul ecx, 00000024
:0047A2F1 81C1502C4B00            add ecx, 004B2C50
:0047A2F7 E83553FCFF              call 0043F631
:0047A2FC 2BF0                    sub esi, eax
:0047A2FE 8975FC                  mov dword ptr [ebp-04], esi
:0047A301 EB17                    jmp 0047A31A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047A2BB(C), :0047A2CA(C)
|
:0047A303 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047A306 E8AECEF8FF              call 004071B9
:0047A30B 8BF0                    mov esi, eax
:0047A30D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047A310 E8A4CEF8FF              call 004071B9
:0047A315 2BF0                    sub esi, eax
:0047A317 8975FC                  mov dword ptr [ebp-04], esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047A301(U)
|
:0047A31A EB79                    jmp 0047A395
:0047A31C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047A31F 81E1FF000000            and ecx, 000000FF
:0047A325 81F9FF000000            cmp ecx, 000000FF
:0047A32B 7448                    je 0047A375
:0047A32D 8B55EC                  mov edx, dword ptr [ebp-14]
:0047A330 81E2FF000000            and edx, 000000FF
:0047A336 81FAFF000000            cmp edx, 000000FF
:0047A33C 7437                    je 0047A375
:0047A33E 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0047A341 81E1FF000000            and ecx, 000000FF
:0047A347 6BC924                  imul ecx, 00000024
:0047A34A 81C1502C4B00            add ecx, 004B2C50
:0047A350 E82A53FCFF              call 0043F67F
:0047A355 8BF0                    mov esi, eax
:0047A357 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047A35A 81E1FF000000            and ecx, 000000FF
:0047A360 6BC924                  imul ecx, 00000024
:0047A363 81C1502C4B00            add ecx, 004B2C50
:0047A369 E81153FCFF              call 0043F67F
:0047A36E 2BF0                    sub esi, eax
:0047A370 8975FC                  mov dword ptr [ebp-04], esi
:0047A373 EB17                    jmp 0047A38C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047A32B(C), :0047A33C(C)
|
:0047A375 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047A378 E86DCEF8FF              call 004071EA
:0047A37D 8BF0                    mov esi, eax
:0047A37F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047A382 E863CEF8FF              call 004071EA
:0047A387 2BF0                    sub esi, eax
:0047A389 8975FC                  mov dword ptr [ebp-04], esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047A373(U)
|
:0047A38C EB07                    jmp 0047A395

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00479FC8(C)
|
:0047A38E C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00479FEF(U), :0047A016(U), :0047A03D(U), :0047A064(U), :0047A0D9(U)
|:0047A14C(U), :0047A1BF(U), :0047A234(U), :0047A2A7(U), :0047A31A(U)
|:0047A38C(U)
|
:0047A395 8B45FC                  mov eax, dword ptr [ebp-04]
:0047A398 5E                      pop esi
:0047A399 5B                      pop ebx
:0047A39A 8BE5                    mov esp, ebp
:0047A39C 5D                      pop ebp
:0047A39D C20C00                  ret 000C



:0047A3A0 D89F4700                DWORD 00479FD8
:0047A3A4 F49F4700                DWORD 00479FF4
:0047A3A8 1BA04700                DWORD 0047A01B
:0047A3AC 42A04700                DWORD 0047A042
:0047A3B0 69A04700                DWORD 0047A069
:0047A3B4 DEA04700                DWORD 0047A0DE
:0047A3B8 51A14700                DWORD 0047A151
:0047A3BC 39A24700                DWORD 0047A239
:0047A3C0 C4A14700                DWORD 0047A1C4
:0047A3C4 ACA24700                DWORD 0047A2AC
:0047A3C8 1CA34700                DWORD 0047A31C


:0047A3CC 55                      push ebp
:0047A3CD 8BEC                    mov ebp, esp
:0047A3CF 83EC3C                  sub esp, 0000003C
:0047A3D2 894DC8                  mov dword ptr [ebp-38], ecx
:0047A3D5 E84815F9FF              call 0040B922
:0047A3DA 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0047A3DD 894154                  mov dword ptr [ecx+54], eax
:0047A3E0 6A01                    push 00000001
:0047A3E2 6809040000              push 00000409
:0047A3E7 8B55C8                  mov edx, dword ptr [ebp-38]
:0047A3EA 8B420C                  mov eax, dword ptr [edx+0C]
:0047A3ED 50                      push eax
:0047A3EE FF15DC624800            call dword ptr [004862DC]
:0047A3F4 50                      push eax
:0047A3F5 E8D514FAFF              call 0041B8CF
:0047A3FA 83C408                  add esp, 00000008
:0047A3FD 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0047A400 C7415801000000          mov [ecx+58], 00000001
:0047A407 8B55C8                  mov edx, dword ptr [ebp-38]
:0047A40A 8B4250                  mov eax, dword ptr [edx+50]
:0047A40D 50                      push eax
:0047A40E 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0047A411 8B510C                  mov edx, dword ptr [ecx+0C]
:0047A414 52                      push edx
:0047A415 E88C7FFEFF              call 004623A6
:0047A41A 83C408                  add esp, 00000008
:0047A41D C745CC0F000000          mov [ebp-34], 0000000F
:0047A424 8D45F0                  lea eax, dword ptr [ebp-10]
:0047A427 8945D8                  mov dword ptr [ebp-28], eax
:0047A42A C745EC00000000          mov [ebp-14], 00000000
:0047A431 EB09                    jmp 0047A43C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047A5CB(U)
|
:0047A433 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0047A436 83C101                  add ecx, 00000001
:0047A439 894DEC                  mov dword ptr [ebp-14], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047A431(U)
|
:0047A43C 8B55C8                  mov edx, dword ptr [ebp-38]
:0047A43F 33C0                    xor eax, eax
:0047A441 8A4214                  mov al, byte ptr [edx+14]
:0047A444 3945EC                  cmp dword ptr [ebp-14], eax
:0047A447 0F8D83010000            jnl 0047A5D0
:0047A44D 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0047A450 51                      push ecx
:0047A451 8B55C8                  mov edx, dword ptr [ebp-38]
:0047A454 8B02                    mov eax, dword ptr [edx]
:0047A456 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0047A459 FF5014                  call [eax+14]
:0047A45C 8945D4                  mov dword ptr [ebp-2C], eax
:0047A45F 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0047A462 8B5118                  mov edx, dword ptr [ecx+18]
:0047A465 8B45EC                  mov eax, dword ptr [ebp-14]
:0047A468 8B0C82                  mov ecx, dword ptr [edx+4*eax]
:0047A46B 894DC4                  mov dword ptr [ebp-3C], ecx
:0047A46E 837DC40A                cmp dword ptr [ebp-3C], 0000000A
:0047A472 0F8739010000            ja 0047A5B1
:0047A478 8B55C4                  mov edx, dword ptr [ebp-3C]
:0047A47B FF249523A64700          jmp dword ptr [4*edx+0047A623]
:0047A482 68B06A4800              push 00486AB0
:0047A487 8D45F0                  lea eax, dword ptr [ebp-10]
:0047A48A 50                      push eax
:0047A48B E8006D0000              call 00481190
:0047A490 83C408                  add esp, 00000008
:0047A493 C745D000000000          mov [ebp-30], 00000000
:0047A49A E912010000              jmp 0047A5B1
:0047A49F 68B86A4800              push 00486AB8
:0047A4A4 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0047A4A7 51                      push ecx
:0047A4A8 E8E36C0000              call 00481190
:0047A4AD 83C408                  add esp, 00000008
:0047A4B0 C745D002000000          mov [ebp-30], 00000002
:0047A4B7 E9F5000000              jmp 0047A5B1
:0047A4BC 68C46A4800              push 00486AC4
:0047A4C1 8D55F0                  lea edx, dword ptr [ebp-10]
:0047A4C4 52                      push edx
:0047A4C5 E8C66C0000              call 00481190
:0047A4CA 83C408                  add esp, 00000008
:0047A4CD C745D001000000          mov [ebp-30], 00000001
:0047A4D4 E9D8000000              jmp 0047A5B1
:0047A4D9 68D86A4800              push 00486AD8
:0047A4DE 8D45F0                  lea eax, dword ptr [ebp-10]
:0047A4E1 50                      push eax
:0047A4E2 E8A96C0000              call 00481190
:0047A4E7 83C408                  add esp, 00000008
:0047A4EA C745D002000000          mov [ebp-30], 00000002
:0047A4F1 E9BB000000              jmp 0047A5B1
:0047A4F6 68DC6A4800              push 00486ADC
:0047A4FB 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0047A4FE 51                      push ecx
:0047A4FF E88C6C0000              call 00481190
:0047A504 83C408                  add esp, 00000008
:0047A507 C745D002000000          mov [ebp-30], 00000002
:0047A50E E99E000000              jmp 0047A5B1
:0047A513 68E86A4800              push 00486AE8
:0047A518 8D55F0                  lea edx, dword ptr [ebp-10]
:0047A51B 52                      push edx
:0047A51C E86F6C0000              call 00481190
:0047A521 83C408                  add esp, 00000008
:0047A524 C745D001000000          mov [ebp-30], 00000001
:0047A52B E981000000              jmp 0047A5B1
:0047A530 68F86A4800              push 00486AF8
:0047A535 8D45F0                  lea eax, dword ptr [ebp-10]
:0047A538 50                      push eax
:0047A539 E8526C0000              call 00481190
:0047A53E 83C408                  add esp, 00000008
:0047A541 C745D001000000          mov [ebp-30], 00000001
:0047A548 EB67                    jmp 0047A5B1
:0047A54A 68086B4800              push 00486B08
:0047A54F 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0047A552 51                      push ecx
:0047A553 E8386C0000              call 00481190
:0047A558 83C408                  add esp, 00000008
:0047A55B C745D001000000          mov [ebp-30], 00000001
:0047A562 EB4D                    jmp 0047A5B1
:0047A564 68186B4800              push 00486B18
:0047A569 8D55F0                  lea edx, dword ptr [ebp-10]
:0047A56C 52                      push edx
:0047A56D E81E6C0000              call 00481190
:0047A572 83C408                  add esp, 00000008
:0047A575 C745D001000000          mov [ebp-30], 00000001
:0047A57C EB33                    jmp 0047A5B1
:0047A57E A1286B4800              mov eax, dword ptr [00486B28]
:0047A583 50                      push eax
:0047A584 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0047A587 51                      push ecx
:0047A588 E8036C0000              call 00481190
:0047A58D 83C408                  add esp, 00000008
:0047A590 C745D001000000          mov [ebp-30], 00000001
:0047A597 EB18                    jmp 0047A5B1
:0047A599 68D06A4800              push 00486AD0
:0047A59E 8D55F0                  lea edx, dword ptr [ebp-10]
:0047A5A1 52                      push edx
:0047A5A2 E8E96B0000              call 00481190
:0047A5A7 83C408                  add esp, 00000008
:0047A5AA C745D001000000          mov [ebp-30], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047A472(C), :0047A49A(U), :0047A4B7(U), :0047A4D4(U), :0047A4F1(U)
|:0047A50E(U), :0047A52B(U), :0047A548(U), :0047A562(U), :0047A57C(U)
|:0047A597(U)
|
:0047A5B1 8D45CC                  lea eax, dword ptr [ebp-34]
:0047A5B4 50                      push eax
:0047A5B5 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0047A5B8 51                      push ecx
:0047A5B9 681B100000              push 0000101B
:0047A5BE 8B55C8                  mov edx, dword ptr [ebp-38]
:0047A5C1 8B4210                  mov eax, dword ptr [edx+10]
:0047A5C4 50                      push eax
:0047A5C5 FF15F4624800            call dword ptr [004862F4]
:0047A5CB E963FEFFFF              jmp 0047A433

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047A447(C)
|
:0047A5D0 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0047A5D3 83795400                cmp dword ptr [ecx+54], 00000000
:0047A5D7 7536                    jne 0047A60F
:0047A5D9 6A00                    push 00000000
:0047A5DB 6809040000              push 00000409
:0047A5E0 8B55C8                  mov edx, dword ptr [ebp-38]
:0047A5E3 8B420C                  mov eax, dword ptr [edx+0C]
:0047A5E6 50                      push eax
:0047A5E7 FF15DC624800            call dword ptr [004862DC]
:0047A5ED 50                      push eax
:0047A5EE FF15E0624800            call dword ptr [004862E0]
:0047A5F4 6A00                    push 00000000
:0047A5F6 6813040000              push 00000413
:0047A5FB 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0047A5FE 8B510C                  mov edx, dword ptr [ecx+0C]
:0047A601 52                      push edx
:0047A602 FF15DC624800            call dword ptr [004862DC]
:0047A608 50                      push eax
:0047A609 FF15E0624800            call dword ptr [004862E0]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047A5D7(C)
|
:0047A60F 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0047A612 E8569DFEFF              call 0046436D
:0047A617 8B4DC8                  mov ecx, dword ptr [ebp-38]
:0047A61A E8F3F6FFFF              call 00479D12
:0047A61F 8BE5                    mov esp, ebp
:0047A621 5D                      pop ebp
:0047A622 C3                      ret



:0047A623 82A44700                DWORD 0047A482
:0047A627 9FA44700                DWORD 0047A49F
:0047A62B BCA44700                DWORD 0047A4BC
:0047A62F 99A54700                DWORD 0047A599
:0047A633 D9A44700                DWORD 0047A4D9
:0047A637 F6A44700                DWORD 0047A4F6
:0047A63B 13A54700                DWORD 0047A513
:0047A63F 30A54700                DWORD 0047A530
:0047A643 4AA54700                DWORD 0047A54A
:0047A647 64A54700                DWORD 0047A564
:0047A64B 7EA54700                DWORD 0047A57E


:0047A64F 55                      push ebp
:0047A650 8BEC                    mov ebp, esp
:0047A652 83EC68                  sub esp, 00000068
:0047A655 894DA0                  mov dword ptr [ebp-60], ecx
:0047A658 8B4508                  mov eax, dword ptr [ebp+08]
:0047A65B 8B4808                  mov ecx, dword ptr [eax+08]
:0047A65E 51                      push ecx
:0047A65F 8B4DA0                  mov ecx, dword ptr [ebp-60]
:0047A662 E83599FEFF              call 00463F9C
:0047A667 8945F8                  mov dword ptr [ebp-08], eax
:0047A66A 8B5508                  mov edx, dword ptr [ebp+08]
:0047A66D 83C21C                  add edx, 0000001C
:0047A670 8B02                    mov eax, dword ptr [edx]
:0047A672 8945D0                  mov dword ptr [ebp-30], eax
:0047A675 8B4A04                  mov ecx, dword ptr [edx+04]
:0047A678 894DD4                  mov dword ptr [ebp-2C], ecx
:0047A67B 8B4208                  mov eax, dword ptr [edx+08]
:0047A67E 8945D8                  mov dword ptr [ebp-28], eax
:0047A681 8B4A0C                  mov ecx, dword ptr [edx+0C]
:0047A684 894DDC                  mov dword ptr [ebp-24], ecx
:0047A687 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047A68A E84DD4FFFF              call 00477ADC
:0047A68F 8845A8                  mov byte ptr [ebp-58], al
:0047A692 8B5508                  mov edx, dword ptr [ebp+08]
:0047A695 52                      push edx
:0047A696 8B45A0                  mov eax, dword ptr [ebp-60]
:0047A699 8B10                    mov edx, dword ptr [eax]
:0047A69B 8B4DA0                  mov ecx, dword ptr [ebp-60]
:0047A69E FF5218                  call [edx+18]
:0047A6A1 C745B001000000          mov [ebp-50], 00000001
:0047A6A8 6A02                    push 00000002
:0047A6AA 8B4508                  mov eax, dword ptr [ebp+08]
:0047A6AD 8B4808                  mov ecx, dword ptr [eax+08]
:0047A6B0 51                      push ecx
:0047A6B1 682C100000              push 0000102C
:0047A6B6 8B55A0                  mov edx, dword ptr [ebp-60]
:0047A6B9 8B4210                  mov eax, dword ptr [edx+10]
:0047A6BC 50                      push eax
:0047A6BD FF15F4624800            call dword ptr [004862F4]
:0047A6C3 33C9                    xor ecx, ecx
:0047A6C5 83F802                  cmp eax, 00000002
:0047A6C8 0F94C1                  sete cl
:0047A6CB 894DFC                  mov dword ptr [ebp-04], ecx
:0047A6CE C745ACFFFFFFFF          mov [ebp-54], FFFFFFFF
:0047A6D5 C745F000000000          mov [ebp-10], 00000000
:0047A6DC EB09                    jmp 0047A6E7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047ADAD(U)
|
:0047A6DE 8B55F0                  mov edx, dword ptr [ebp-10]
:0047A6E1 83C201                  add edx, 00000001
:0047A6E4 8955F0                  mov dword ptr [ebp-10], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047A6DC(U)
|
:0047A6E7 8B45A0                  mov eax, dword ptr [ebp-60]
:0047A6EA 33C9                    xor ecx, ecx
:0047A6EC 8A4814                  mov cl, byte ptr [eax+14]
:0047A6EF 394DF0                  cmp dword ptr [ebp-10], ecx
:0047A6F2 0F8DBA060000            jnl 0047ADB2
:0047A6F8 8D55B0                  lea edx, dword ptr [ebp-50]
:0047A6FB 52                      push edx
:0047A6FC 8B45F0                  mov eax, dword ptr [ebp-10]
:0047A6FF 50                      push eax
:0047A700 6819100000              push 00001019
:0047A705 8B4DA0                  mov ecx, dword ptr [ebp-60]
:0047A708 8B5110                  mov edx, dword ptr [ecx+10]
:0047A70B 52                      push edx
:0047A70C FF15F4624800            call dword ptr [004862F4]
:0047A712 C745F424800000          mov [ebp-0C], 00008024
:0047A719 8B45B4                  mov eax, dword ptr [ebp-4C]
:0047A71C 83E003                  and eax, 00000003
:0047A71F 89459C                  mov dword ptr [ebp-64], eax
:0047A722 837D9C00                cmp dword ptr [ebp-64], 00000000
:0047A726 740E                    je 0047A736
:0047A728 837D9C01                cmp dword ptr [ebp-64], 00000001
:0047A72C 7410                    je 0047A73E
:0047A72E 837D9C02                cmp dword ptr [ebp-64], 00000002
:0047A732 7415                    je 0047A749
:0047A734 EB1D                    jmp 0047A753

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047A726(C)
|
:0047A736 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047A739 894DF4                  mov dword ptr [ebp-0C], ecx
:0047A73C EB1B                    jmp 0047A759

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047A72C(C)
|
:0047A73E 8B55F4                  mov edx, dword ptr [ebp-0C]
:0047A741 83CA02                  or edx, 00000002
:0047A744 8955F4                  mov dword ptr [ebp-0C], edx
:0047A747 EB10                    jmp 0047A759

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047A732(C)
|
:0047A749 8B45F4                  mov eax, dword ptr [ebp-0C]
:0047A74C 0C01                    or al, 01
:0047A74E 8945F4                  mov dword ptr [ebp-0C], eax
:0047A751 EB06                    jmp 0047A759

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047A734(U)
|
:0047A753 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047A756 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047A73C(U), :0047A747(U), :0047A751(U)
|
:0047A759 6A00                    push 00000000
:0047A75B 8B55F0                  mov edx, dword ptr [ebp-10]
:0047A75E 52                      push edx
:0047A75F 681D100000              push 0000101D
:0047A764 8B45A0                  mov eax, dword ptr [ebp-60]
:0047A767 8B4810                  mov ecx, dword ptr [eax+10]
:0047A76A 51                      push ecx
:0047A76B FF15F4624800            call dword ptr [004862F4]
:0047A771 8B55D0                  mov edx, dword ptr [ebp-30]
:0047A774 8D4402FB                lea eax, dword ptr [edx+eax-05]
:0047A778 8945D8                  mov dword ptr [ebp-28], eax
:0047A77B 8B4DD0                  mov ecx, dword ptr [ebp-30]
:0047A77E 83C105                  add ecx, 00000005
:0047A781 894DD0                  mov dword ptr [ebp-30], ecx
:0047A784 8B55A0                  mov edx, dword ptr [ebp-60]
:0047A787 8B4218                  mov eax, dword ptr [edx+18]
:0047A78A 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047A78D 8B1488                  mov edx, dword ptr [eax+4*ecx]
:0047A790 895598                  mov dword ptr [ebp-68], edx
:0047A793 837D980A                cmp dword ptr [ebp-68], 0000000A
:0047A797 0F87B7050000            ja 0047AD54
:0047A79D 8B4598                  mov eax, dword ptr [ebp-68]
:0047A7A0 FF2485B8AD4700          jmp dword ptr [4*eax+0047ADB8]
:0047A7A7 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047A7AA E8A8CFF8FF              call 00407757
:0047A7AF 50                      push eax
:0047A7B0 8D4DE0                  lea ecx, dword ptr [ebp-20]
:0047A7B3 51                      push ecx
:0047A7B4 E8C4540000              call 0047FC7D
:0047A7B9 83C408                  add esp, 00000008
:0047A7BC E993050000              jmp 0047AD54
:0047A7C1 837DFC00                cmp dword ptr [ebp-04], 00000000
:0047A7C5 753F                    jne 0047A806
:0047A7C7 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047A7CA E841BEF8FF              call 00406610
:0047A7CF 8845A4                  mov byte ptr [ebp-5C], al
:0047A7D2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047A7D5 E8F6BDF8FF              call 004065D0
:0047A7DA 50                      push eax
:0047A7DB 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047A7DE E82DBEF8FF              call 00406610
:0047A7E3 50                      push eax
:0047A7E4 E894E4FEFF              call 00468C7D
:0047A7E9 83C408                  add esp, 00000008
:0047A7EC 85C0                    test eax, eax
:0047A7EE 7416                    je 0047A806
:0047A7F0 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047A7F3 E808EDF8FF              call 00409500
:0047A7F8 3DAE000000              cmp eax, 000000AE
:0047A7FD 7307                    jnb 0047A806
:0047A7FF C745AC80000000          mov [ebp-54], 00000080

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047A7C5(C), :0047A7EE(C), :0047A7FD(C)
|
:0047A806 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047A809 E802BEF8FF              call 00406610
:0047A80E 25FF000000              and eax, 000000FF
:0047A813 8B1485A8BE4800          mov edx, dword ptr [4*eax+0048BEA8]
:0047A81A 52                      push edx
:0047A81B 8D45E0                  lea eax, dword ptr [ebp-20]
:0047A81E 50                      push eax
:0047A81F E859540000              call 0047FC7D
:0047A824 83C408                  add esp, 00000008
:0047A827 E928050000              jmp 0047AD54
:0047A82C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047A82F E89CBDF8FF              call 004065D0
:0047A834 25FF000000              and eax, 000000FF
:0047A839 50                      push eax

* Possible StringData Ref from Data Obj ->"%u"
                                  |
:0047A83A 687CEC4800              push 0048EC7C
:0047A83F 8D4DE0                  lea ecx, dword ptr [ebp-20]
:0047A842 51                      push ecx
:0047A843 E8DA5B0000              call 00480422
:0047A848 83C40C                  add esp, 0000000C
:0047A84B E904050000              jmp 0047AD54
:0047A850 8B55A8                  mov edx, dword ptr [ebp-58]
:0047A853 81E2FF000000            and edx, 000000FF
:0047A859 81FAFF000000            cmp edx, 000000FF
:0047A85F 745E                    je 0047A8BF
:0047A861 837DFC00                cmp dword ptr [ebp-04], 00000000
:0047A865 7524                    jne 0047A88B
:0047A867 6A10                    push 00000010
:0047A869 8B4DA8                  mov ecx, dword ptr [ebp-58]
:0047A86C 81E1FF000000            and ecx, 000000FF
:0047A872 6BC924                  imul ecx, 00000024
:0047A875 81C1502C4B00            add ecx, 004B2C50
:0047A87B E860BEF8FF              call 004066E0
:0047A880 85C0                    test eax, eax
:0047A882 7407                    je 0047A88B
:0047A884 C745AC80000000          mov [ebp-54], 00000080

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047A865(C), :0047A882(C)
|
:0047A88B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047A88E E888C9F8FF              call 0040721B
:0047A893 50                      push eax
:0047A894 8B4DA8                  mov ecx, dword ptr [ebp-58]
:0047A897 81E1FF000000            and ecx, 000000FF
:0047A89D 6BC924                  imul ecx, 00000024
:0047A8A0 81C1502C4B00            add ecx, 004B2C50
:0047A8A6 E8E583FFFF              call 00472C90
:0047A8AB 50                      push eax

* Possible StringData Ref from Data Obj ->"%3u/%3u"
                                  |
:0047A8AC 6880EC4800              push 0048EC80
:0047A8B1 8D45E0                  lea eax, dword ptr [ebp-20]
:0047A8B4 50                      push eax
:0047A8B5 E8685B0000              call 00480422
:0047A8BA 83C410                  add esp, 00000010
:0047A8BD EB23                    jmp 0047A8E2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047A85F(C)
|
:0047A8BF 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047A8C2 E854C9F8FF              call 0040721B
:0047A8C7 50                      push eax
:0047A8C8 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047A8CB E84BC9F8FF              call 0040721B
:0047A8D0 50                      push eax

* Possible StringData Ref from Data Obj ->"%3u/%3u"
                                  |
:0047A8D1 6888EC4800              push 0048EC88
:0047A8D6 8D4DE0                  lea ecx, dword ptr [ebp-20]
:0047A8D9 51                      push ecx
:0047A8DA E8435B0000              call 00480422
:0047A8DF 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047A8BD(U)
|
:0047A8E2 E96D040000              jmp 0047AD54
:0047A8E7 8B55A8                  mov edx, dword ptr [ebp-58]
:0047A8EA 81E2FF000000            and edx, 000000FF
:0047A8F0 81FAFF000000            cmp edx, 000000FF
:0047A8F6 745E                    je 0047A956
:0047A8F8 837DFC00                cmp dword ptr [ebp-04], 00000000
:0047A8FC 7524                    jne 0047A922
:0047A8FE 6A04                    push 00000004
:0047A900 8B4DA8                  mov ecx, dword ptr [ebp-58]
:0047A903 81E1FF000000            and ecx, 000000FF
:0047A909 6BC924                  imul ecx, 00000024
:0047A90C 81C1502C4B00            add ecx, 004B2C50
:0047A912 E8C9BDF8FF              call 004066E0
:0047A917 85C0                    test eax, eax
:0047A919 7407                    je 0047A922
:0047A91B C745AC80000000          mov [ebp-54], 00000080

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047A8FC(C), :0047A919(C)
|
:0047A922 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047A925 E820C9F8FF              call 0040724A
:0047A92A 50                      push eax
:0047A92B 8B4DA8                  mov ecx, dword ptr [ebp-58]
:0047A92E 81E1FF000000            and ecx, 000000FF
:0047A934 6BC924                  imul ecx, 00000024
:0047A937 81C1502C4B00            add ecx, 004B2C50
:0047A93D E8FE7EFFFF              call 00472840
:0047A942 50                      push eax

* Possible StringData Ref from Data Obj ->"%3u/%3u"
                                  |
:0047A943 6890EC4800              push 0048EC90
:0047A948 8D45E0                  lea eax, dword ptr [ebp-20]
:0047A94B 50                      push eax
:0047A94C E8D15A0000              call 00480422
:0047A951 83C410                  add esp, 00000010
:0047A954 EB23                    jmp 0047A979

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047A8F6(C)
|
:0047A956 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047A959 E8ECC8F8FF              call 0040724A
:0047A95E 50                      push eax
:0047A95F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047A962 E8E3C8F8FF              call 0040724A
:0047A967 50                      push eax

* Possible StringData Ref from Data Obj ->"%3u/%3u"
                                  |
:0047A968 6898EC4800              push 0048EC98
:0047A96D 8D4DE0                  lea ecx, dword ptr [ebp-20]
:0047A970 51                      push ecx
:0047A971 E8AC5A0000              call 00480422
:0047A976 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047A954(U)
|
:0047A979 E9D6030000              jmp 0047AD54
:0047A97E 8B55A8                  mov edx, dword ptr [ebp-58]
:0047A981 81E2FF000000            and edx, 000000FF
:0047A987 81FAFF000000            cmp edx, 000000FF
:0047A98D 0F8483000000            je 0047AA16
:0047A993 837DFC00                cmp dword ptr [ebp-04], 00000000
:0047A997 7552                    jne 0047A9EB
:0047A999 8B4DA8                  mov ecx, dword ptr [ebp-58]
:0047A99C 81E1FF000000            and ecx, 000000FF
:0047A9A2 6BC924                  imul ecx, 00000024
:0047A9A5 81C1502C4B00            add ecx, 004B2C50
:0047A9AB E8E035FAFF              call 0041DF90
:0047A9B0 25FF000000              and eax, 000000FF
:0047A9B5 83F802                  cmp eax, 00000002
:0047A9B8 7F09                    jg 0047A9C3
:0047A9BA C745AC80000000          mov [ebp-54], 00000080
:0047A9C1 EB28                    jmp 0047A9EB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047A9B8(C)
|
:0047A9C3 8B4DA8                  mov ecx, dword ptr [ebp-58]
:0047A9C6 81E1FF000000            and ecx, 000000FF
:0047A9CC 6BC924                  imul ecx, 00000024
:0047A9CF 81C1502C4B00            add ecx, 004B2C50
:0047A9D5 E8B635FAFF              call 0041DF90
:0047A9DA 25FF000000              and eax, 000000FF
:0047A9DF 83F804                  cmp eax, 00000004
:0047A9E2 7C07                    jl 0047A9EB
:0047A9E4 C745AC0000FF00          mov [ebp-54], 00FF0000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047A997(C), :0047A9C1(U), :0047A9E2(C)
|
:0047A9EB 8B4DA8                  mov ecx, dword ptr [ebp-58]
:0047A9EE 81E1FF000000            and ecx, 000000FF
:0047A9F4 6BC924                  imul ecx, 00000024
:0047A9F7 81C1502C4B00            add ecx, 004B2C50
:0047A9FD E8FC4AFCFF              call 0043F4FE
:0047AA02 50                      push eax

* Possible StringData Ref from Data Obj ->"%u"
                                  |
:0047AA03 68A0EC4800              push 0048ECA0
:0047AA08 8D45E0                  lea eax, dword ptr [ebp-20]
:0047AA0B 50                      push eax
:0047AA0C E8115A0000              call 00480422
:0047AA11 83C40C                  add esp, 0000000C
:0047AA14 EB1A                    jmp 0047AA30

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047A98D(C)
|
:0047AA16 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047AA19 E808C7F8FF              call 00407126
:0047AA1E 50                      push eax

* Possible StringData Ref from Data Obj ->"%u"
                                  |
:0047AA1F 68A4EC4800              push 0048ECA4
:0047AA24 8D4DE0                  lea ecx, dword ptr [ebp-20]
:0047AA27 51                      push ecx
:0047AA28 E8F5590000              call 00480422
:0047AA2D 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047AA14(U)
|
:0047AA30 E91F030000              jmp 0047AD54
:0047AA35 8B55A8                  mov edx, dword ptr [ebp-58]
:0047AA38 81E2FF000000            and edx, 000000FF
:0047AA3E 81FAFF000000            cmp edx, 000000FF
:0047AA44 0F8483000000            je 0047AACD
:0047AA4A 837DFC00                cmp dword ptr [ebp-04], 00000000
:0047AA4E 7552                    jne 0047AAA2
:0047AA50 8B4DA8                  mov ecx, dword ptr [ebp-58]
:0047AA53 81E1FF000000            and ecx, 000000FF
:0047AA59 6BC924                  imul ecx, 00000024
:0047AA5C 81C1502C4B00            add ecx, 004B2C50
:0047AA62 E86935FAFF              call 0041DFD0
:0047AA67 25FF000000              and eax, 000000FF
:0047AA6C 83F802                  cmp eax, 00000002
:0047AA6F 7F09                    jg 0047AA7A
:0047AA71 C745AC80000000          mov [ebp-54], 00000080
:0047AA78 EB28                    jmp 0047AAA2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047AA6F(C)
|
:0047AA7A 8B4DA8                  mov ecx, dword ptr [ebp-58]
:0047AA7D 81E1FF000000            and ecx, 000000FF
:0047AA83 6BC924                  imul ecx, 00000024
:0047AA86 81C1502C4B00            add ecx, 004B2C50
:0047AA8C E83F35FAFF              call 0041DFD0
:0047AA91 25FF000000              and eax, 000000FF
:0047AA96 83F804                  cmp eax, 00000004
:0047AA99 7C07                    jl 0047AAA2
:0047AA9B C745AC0000FF00          mov [ebp-54], 00FF0000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047AA4E(C), :0047AA78(U), :0047AA99(C)
|
:0047AAA2 8B4DA8                  mov ecx, dword ptr [ebp-58]
:0047AAA5 81E1FF000000            and ecx, 000000FF
:0047AAAB 6BC924                  imul ecx, 00000024
:0047AAAE 81C1502C4B00            add ecx, 004B2C50
:0047AAB4 E82A4BFCFF              call 0043F5E3
:0047AAB9 50                      push eax

* Possible StringData Ref from Data Obj ->"%u"
                                  |
:0047AABA 68A8EC4800              push 0048ECA8
:0047AABF 8D45E0                  lea eax, dword ptr [ebp-20]
:0047AAC2 50                      push eax
:0047AAC3 E85A590000              call 00480422
:0047AAC8 83C40C                  add esp, 0000000C
:0047AACB EB1A                    jmp 0047AAE7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047AA44(C)
|
:0047AACD 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047AAD0 E8B3C6F8FF              call 00407188
:0047AAD5 50                      push eax

* Possible StringData Ref from Data Obj ->"%u"
                                  |
:0047AAD6 68ACEC4800              push 0048ECAC
:0047AADB 8D4DE0                  lea ecx, dword ptr [ebp-20]
:0047AADE 51                      push ecx
:0047AADF E83E590000              call 00480422
:0047AAE4 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047AACB(U)
|
:0047AAE7 E968020000              jmp 0047AD54
:0047AAEC 8B55A8                  mov edx, dword ptr [ebp-58]
:0047AAEF 81E2FF000000            and edx, 000000FF
:0047AAF5 81FAFF000000            cmp edx, 000000FF
:0047AAFB 0F8483000000            je 0047AB84
:0047AB01 837DFC00                cmp dword ptr [ebp-04], 00000000
:0047AB05 7552                    jne 0047AB59
:0047AB07 8B4DA8                  mov ecx, dword ptr [ebp-58]
:0047AB0A 81E1FF000000            and ecx, 000000FF
:0047AB10 6BC924                  imul ecx, 00000024
:0047AB13 81C1502C4B00            add ecx, 004B2C50
:0047AB19 E89234FAFF              call 0041DFB0
:0047AB1E 25FF000000              and eax, 000000FF
:0047AB23 83F802                  cmp eax, 00000002
:0047AB26 7F09                    jg 0047AB31
:0047AB28 C745AC80000000          mov [ebp-54], 00000080
:0047AB2F EB28                    jmp 0047AB59

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047AB26(C)
|
:0047AB31 8B4DA8                  mov ecx, dword ptr [ebp-58]
:0047AB34 81E1FF000000            and ecx, 000000FF
:0047AB3A 6BC924                  imul ecx, 00000024
:0047AB3D 81C1502C4B00            add ecx, 004B2C50
:0047AB43 E86834FAFF              call 0041DFB0
:0047AB48 25FF000000              and eax, 000000FF
:0047AB4D 83F804                  cmp eax, 00000004
:0047AB50 7C07                    jl 0047AB59
:0047AB52 C745AC0000FF00          mov [ebp-54], 00FF0000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047AB05(C), :0047AB2F(U), :0047AB50(C)
|
:0047AB59 8B4DA8                  mov ecx, dword ptr [ebp-58]
:0047AB5C 81E1FF000000            and ecx, 000000FF
:0047AB62 6BC924                  imul ecx, 00000024
:0047AB65 81C1502C4B00            add ecx, 004B2C50
:0047AB6B E8254AFCFF              call 0043F595
:0047AB70 50                      push eax

* Possible StringData Ref from Data Obj ->"%u"
                                  |
:0047AB71 68B0EC4800              push 0048ECB0
:0047AB76 8D45E0                  lea eax, dword ptr [ebp-20]
:0047AB79 50                      push eax
:0047AB7A E8A3580000              call 00480422
:0047AB7F 83C40C                  add esp, 0000000C
:0047AB82 EB1A                    jmp 0047AB9E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047AAFB(C)
|
:0047AB84 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047AB87 E8CBC5F8FF              call 00407157
:0047AB8C 50                      push eax

* Possible StringData Ref from Data Obj ->"%u"
                                  |
:0047AB8D 68B4EC4800              push 0048ECB4
:0047AB92 8D4DE0                  lea ecx, dword ptr [ebp-20]
:0047AB95 51                      push ecx
:0047AB96 E887580000              call 00480422
:0047AB9B 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047AB82(U)
|
:0047AB9E E9B1010000              jmp 0047AD54
:0047ABA3 8B55A8                  mov edx, dword ptr [ebp-58]
:0047ABA6 81E2FF000000            and edx, 000000FF
:0047ABAC 81FAFF000000            cmp edx, 000000FF
:0047ABB2 0F8483000000            je 0047AC3B
:0047ABB8 837DFC00                cmp dword ptr [ebp-04], 00000000
:0047ABBC 7552                    jne 0047AC10
:0047ABBE 8B4DA8                  mov ecx, dword ptr [ebp-58]
:0047ABC1 81E1FF000000            and ecx, 000000FF
:0047ABC7 6BC924                  imul ecx, 00000024
:0047ABCA 81C1502C4B00            add ecx, 004B2C50
:0047ABD0 E81B34FAFF              call 0041DFF0
:0047ABD5 25FF000000              and eax, 000000FF
:0047ABDA 83F802                  cmp eax, 00000002
:0047ABDD 7F09                    jg 0047ABE8
:0047ABDF C745AC80000000          mov [ebp-54], 00000080
:0047ABE6 EB28                    jmp 0047AC10

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047ABDD(C)
|
:0047ABE8 8B4DA8                  mov ecx, dword ptr [ebp-58]
:0047ABEB 81E1FF000000            and ecx, 000000FF
:0047ABF1 6BC924                  imul ecx, 00000024
:0047ABF4 81C1502C4B00            add ecx, 004B2C50
:0047ABFA E8F133FAFF              call 0041DFF0
:0047ABFF 25FF000000              and eax, 000000FF
:0047AC04 83F804                  cmp eax, 00000004
:0047AC07 7C07                    jl 0047AC10
:0047AC09 C745AC0000FF00          mov [ebp-54], 00FF0000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047ABBC(C), :0047ABE6(U), :0047AC07(C)
|
:0047AC10 8B4DA8                  mov ecx, dword ptr [ebp-58]
:0047AC13 81E1FF000000            and ecx, 000000FF
:0047AC19 6BC924                  imul ecx, 00000024
:0047AC1C 81C1502C4B00            add ecx, 004B2C50
:0047AC22 E80A4AFCFF              call 0043F631
:0047AC27 50                      push eax

* Possible StringData Ref from Data Obj ->"%u"
                                  |
:0047AC28 68B8EC4800              push 0048ECB8
:0047AC2D 8D45E0                  lea eax, dword ptr [ebp-20]
:0047AC30 50                      push eax
:0047AC31 E8EC570000              call 00480422
:0047AC36 83C40C                  add esp, 0000000C
:0047AC39 EB1A                    jmp 0047AC55

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047ABB2(C)
|
:0047AC3B 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047AC3E E876C5F8FF              call 004071B9
:0047AC43 50                      push eax

* Possible StringData Ref from Data Obj ->"%u"
                                  |
:0047AC44 68BCEC4800              push 0048ECBC
:0047AC49 8D4DE0                  lea ecx, dword ptr [ebp-20]
:0047AC4C 51                      push ecx
:0047AC4D E8D0570000              call 00480422
:0047AC52 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047AC39(U)
|
:0047AC55 E9FA000000              jmp 0047AD54
:0047AC5A 8B55A8                  mov edx, dword ptr [ebp-58]
:0047AC5D 81E2FF000000            and edx, 000000FF
:0047AC63 81FAFF000000            cmp edx, 000000FF
:0047AC69 0F8483000000            je 0047ACF2
:0047AC6F 837DFC00                cmp dword ptr [ebp-04], 00000000
:0047AC73 7552                    jne 0047ACC7
:0047AC75 8B4DA8                  mov ecx, dword ptr [ebp-58]
:0047AC78 81E1FF000000            and ecx, 000000FF
:0047AC7E 6BC924                  imul ecx, 00000024
:0047AC81 81C1502C4B00            add ecx, 004B2C50
:0047AC87 E88433FAFF              call 0041E010
:0047AC8C 25FF000000              and eax, 000000FF
:0047AC91 83F802                  cmp eax, 00000002
:0047AC94 7F09                    jg 0047AC9F
:0047AC96 C745AC80000000          mov [ebp-54], 00000080
:0047AC9D EB28                    jmp 0047ACC7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047AC94(C)
|
:0047AC9F 8B4DA8                  mov ecx, dword ptr [ebp-58]
:0047ACA2 81E1FF000000            and ecx, 000000FF
:0047ACA8 6BC924                  imul ecx, 00000024
:0047ACAB 81C1502C4B00            add ecx, 004B2C50
:0047ACB1 E85A33FAFF              call 0041E010
:0047ACB6 25FF000000              and eax, 000000FF
:0047ACBB 83F804                  cmp eax, 00000004
:0047ACBE 7C07                    jl 0047ACC7
:0047ACC0 C745AC0000FF00          mov [ebp-54], 00FF0000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047AC73(C), :0047AC9D(U), :0047ACBE(C)
|
:0047ACC7 8B4DA8                  mov ecx, dword ptr [ebp-58]
:0047ACCA 81E1FF000000            and ecx, 000000FF
:0047ACD0 6BC924                  imul ecx, 00000024
:0047ACD3 81C1502C4B00            add ecx, 004B2C50
:0047ACD9 E8A149FCFF              call 0043F67F
:0047ACDE 50                      push eax

* Possible StringData Ref from Data Obj ->"%u"
                                  |
:0047ACDF 68C0EC4800              push 0048ECC0
:0047ACE4 8D45E0                  lea eax, dword ptr [ebp-20]
:0047ACE7 50                      push eax
:0047ACE8 E835570000              call 00480422
:0047ACED 83C40C                  add esp, 0000000C
:0047ACF0 EB1A                    jmp 0047AD0C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047AC69(C)
|
:0047ACF2 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047ACF5 E8F0C4F8FF              call 004071EA
:0047ACFA 50                      push eax

* Possible StringData Ref from Data Obj ->"%u"
                                  |
:0047ACFB 68C4EC4800              push 0048ECC4
:0047AD00 8D4DE0                  lea ecx, dword ptr [ebp-20]
:0047AD03 51                      push ecx
:0047AD04 E819570000              call 00480422
:0047AD09 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047ACF0(U)
|
:0047AD0C EB46                    jmp 0047AD54
:0047AD0E 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047AD11 E83AB9F8FF              call 00406650
:0047AD16 25FF000000              and eax, 000000FF
:0047AD1B 3DFF000000              cmp eax, 000000FF
:0047AD20 7513                    jne 0047AD35
:0047AD22 68D46A4800              push 00486AD4
:0047AD27 8D55E0                  lea edx, dword ptr [ebp-20]
:0047AD2A 52                      push edx
:0047AD2B E860640000              call 00481190
:0047AD30 83C408                  add esp, 00000008
:0047AD33 EB1F                    jmp 0047AD54

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047AD20(C)
|
:0047AD35 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047AD38 E813B9F8FF              call 00406650
:0047AD3D 25FF000000              and eax, 000000FF
:0047AD42 50                      push eax

* Possible StringData Ref from Data Obj ->"%u"
                                  |
:0047AD43 68C8EC4800              push 0048ECC8
:0047AD48 8D45E0                  lea eax, dword ptr [ebp-20]
:0047AD4B 50                      push eax
:0047AD4C E8D1560000              call 00480422
:0047AD51 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047A797(C), :0047A7BC(U), :0047A827(U), :0047A84B(U), :0047A8E2(U)
|:0047A979(U), :0047AA30(U), :0047AAE7(U), :0047AB9E(U), :0047AC55(U)
|:0047AD0C(U), :0047AD33(U)
|
:0047AD54 837DACFF                cmp dword ptr [ebp-54], FFFFFFFF
:0047AD58 7414                    je 0047AD6E
:0047AD5A 8B4DAC                  mov ecx, dword ptr [ebp-54]
:0047AD5D 51                      push ecx
:0047AD5E 8B5508                  mov edx, dword ptr [ebp+08]
:0047AD61 8B4218                  mov eax, dword ptr [edx+18]
:0047AD64 50                      push eax
:0047AD65 FF1584604800            call dword ptr [00486084]
:0047AD6B 8945AC                  mov dword ptr [ebp-54], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047AD58(C)
|
:0047AD6E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047AD71 51                      push ecx
:0047AD72 8D55D0                  lea edx, dword ptr [ebp-30]
:0047AD75 52                      push edx
:0047AD76 8D45E0                  lea eax, dword ptr [ebp-20]
:0047AD79 50                      push eax
:0047AD7A 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047AD7D 51                      push ecx
:0047AD7E 8B4DA0                  mov ecx, dword ptr [ebp-60]
:0047AD81 E8DC9FFEFF              call 00464D62
:0047AD86 8B55D8                  mov edx, dword ptr [ebp-28]
:0047AD89 83C205                  add edx, 00000005
:0047AD8C 8955D0                  mov dword ptr [ebp-30], edx
:0047AD8F 837DACFF                cmp dword ptr [ebp-54], FFFFFFFF
:0047AD93 7418                    je 0047ADAD
:0047AD95 8B45AC                  mov eax, dword ptr [ebp-54]
:0047AD98 50                      push eax
:0047AD99 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047AD9C 8B5118                  mov edx, dword ptr [ecx+18]
:0047AD9F 52                      push edx
:0047ADA0 FF1584604800            call dword ptr [00486084]
:0047ADA6 C745ACFFFFFFFF          mov [ebp-54], FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047AD93(C)
|
:0047ADAD E92CF9FFFF              jmp 0047A6DE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047A6F2(C)
|
:0047ADB2 8BE5                    mov esp, ebp
:0047ADB4 5D                      pop ebp
:0047ADB5 C20400                  ret 0004



:0047ADB8 A7A74700                DWORD 0047A7A7
:0047ADBC C1A74700                DWORD 0047A7C1
:0047ADC0 2CA84700                DWORD 0047A82C
:0047ADC4 0EAD4700                DWORD 0047AD0E
:0047ADC8 50A84700                DWORD 0047A850
:0047ADCC E7A84700                DWORD 0047A8E7
:0047ADD0 7EA94700                DWORD 0047A97E
:0047ADD4 35AA4700                DWORD 0047AA35
:0047ADD8 ECAA4700                DWORD 0047AAEC
:0047ADDC A3AB4700                DWORD 0047ABA3
:0047ADE0 5AAC4700                DWORD 0047AC5A


:0047ADE4 55                      push ebp
:0047ADE5 8BEC                    mov ebp, esp
:0047ADE7 83EC0C                  sub esp, 0000000C
:0047ADEA 894DF4                  mov dword ptr [ebp-0C], ecx
:0047ADED 837D0800                cmp dword ptr [ebp+08], 00000000
:0047ADF1 7C58                    jl 0047AE4B
:0047ADF3 8B4508                  mov eax, dword ptr [ebp+08]
:0047ADF6 50                      push eax
:0047ADF7 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047ADFA E89D91FEFF              call 00463F9C
:0047ADFF 8945FC                  mov dword ptr [ebp-04], eax
:0047AE02 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047AE05 E8F6E6F8FF              call 00409500
:0047AE0A 50                      push eax
:0047AE0B E885E9FFFF              call 00479795
:0047AE10 83C404                  add esp, 00000004
:0047AE13 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047AE16 83795400                cmp dword ptr [ecx+54], 00000000
:0047AE1A 7423                    je 0047AE3F
:0047AE1C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047AE1F E8B8CCFFFF              call 00477ADC
:0047AE24 8845F8                  mov byte ptr [ebp-08], al
:0047AE27 B950424B00              mov ecx, 004B4250
:0047AE2C E80190FDFF              call 00453E32
:0047AE31 8A55F8                  mov dl, byte ptr [ebp-08]
:0047AE34 52                      push edx
:0047AE35 B950424B00              mov ecx, 004B4250
:0047AE3A E859A4FDFF              call 00455298

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047AE1A(C)
|
:0047AE3F A108754B00              mov eax, dword ptr [004B7508]
:0047AE44 50                      push eax
:0047AE45 FF15CC624800            call dword ptr [004862CC]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047ADF1(C)
|
:0047AE4B 8BE5                    mov esp, ebp
:0047AE4D 5D                      pop ebp
:0047AE4E C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0047AF6E   , :0047AF7D   
|
:0047AE51 55                      push ebp
:0047AE52 8BEC                    mov ebp, esp
:0047AE54 51                      push ecx
:0047AE55 894DFC                  mov dword ptr [ebp-04], ecx
:0047AE58 8B45FC                  mov eax, dword ptr [ebp-04]
:0047AE5B 8B4858                  mov ecx, dword ptr [eax+58]
:0047AE5E 3B4D08                  cmp ecx, dword ptr [ebp+08]
:0047AE61 7433                    je 0047AE96
:0047AE63 6A00                    push 00000000
:0047AE65 B9B0694B00              mov ecx, 004B69B0
:0047AE6A E83E98FFFF              call 004746AD
:0047AE6F 8B55FC                  mov edx, dword ptr [ebp-04]
:0047AE72 8B4508                  mov eax, dword ptr [ebp+08]
:0047AE75 894258                  mov dword ptr [edx+58], eax
:0047AE78 6A00                    push 00000000
:0047AE7A 6A00                    push 00000000
:0047AE7C 6809100000              push 00001009
:0047AE81 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047AE84 8B5110                  mov edx, dword ptr [ecx+10]
:0047AE87 52                      push edx
:0047AE88 FF15F4624800            call dword ptr [004862F4]
:0047AE8E 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047AE91 E87CEEFFFF              call 00479D12

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047AE61(C)
|
:0047AE96 8BE5                    mov esp, ebp
:0047AE98 5D                      pop ebp
:0047AE99 C20400                  ret 0004


:0047AE9C 55                      push ebp
:0047AE9D 8BEC                    mov ebp, esp
:0047AE9F 83EC08                  sub esp, 00000008
:0047AEA2 817D0C10010000          cmp dword ptr [ebp+0C], 00000110
:0047AEA9 752F                    jne 0047AEDA
:0047AEAB 8B4514                  mov eax, dword ptr [ebp+14]
:0047AEAE A310754B00              mov dword ptr [004B7510], eax
:0047AEB3 6802040000              push 00000402
:0047AEB8 8B4D10                  mov ecx, dword ptr [ebp+10]
:0047AEBB 51                      push ecx
:0047AEBC 8B550C                  mov edx, dword ptr [ebp+0C]
:0047AEBF 52                      push edx
:0047AEC0 8B4508                  mov eax, dword ptr [ebp+08]
:0047AEC3 50                      push eax
:0047AEC4 8B0D10754B00            mov ecx, dword ptr [004B7510]
:0047AECA 8B11                    mov edx, dword ptr [ecx]
:0047AECC 8B0D10754B00            mov ecx, dword ptr [004B7510]
:0047AED2 FF5224                  call [edx+24]
:0047AED5 E9AA000000              jmp 0047AF84

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047AEA9(C)
|
:0047AEDA 833D10754B0000          cmp dword ptr [004B7510], 00000000
:0047AEE1 742C                    je 0047AF0F
:0047AEE3 8B4514                  mov eax, dword ptr [ebp+14]
:0047AEE6 50                      push eax
:0047AEE7 8B4D10                  mov ecx, dword ptr [ebp+10]
:0047AEEA 51                      push ecx
:0047AEEB 8B550C                  mov edx, dword ptr [ebp+0C]
:0047AEEE 52                      push edx
:0047AEEF 8B4508                  mov eax, dword ptr [ebp+08]
:0047AEF2 50                      push eax
:0047AEF3 8B0D10754B00            mov ecx, dword ptr [004B7510]
:0047AEF9 8B11                    mov edx, dword ptr [ecx]
:0047AEFB 8B0D10754B00            mov ecx, dword ptr [004B7510]
:0047AF01 FF5224                  call [edx+24]
:0047AF04 85C0                    test eax, eax
:0047AF06 7407                    je 0047AF0F
:0047AF08 B801000000              mov eax, 00000001
:0047AF0D EB75                    jmp 0047AF84

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047AEE1(C), :0047AF06(C)
|
:0047AF0F 8B450C                  mov eax, dword ptr [ebp+0C]
:0047AF12 8945FC                  mov dword ptr [ebp-04], eax
:0047AF15 837DFC02                cmp dword ptr [ebp-04], 00000002
:0047AF19 740B                    je 0047AF26
:0047AF1B 817DFC11010000          cmp dword ptr [ebp-04], 00000111
:0047AF22 740E                    je 0047AF32
:0047AF24 EB5C                    jmp 0047AF82

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047AF19(C)
|
:0047AF26 C70510754B0000000000    mov dword ptr [004B7510], 00000000
:0047AF30 EB50                    jmp 0047AF82

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047AF22(C)
|
:0047AF32 8B4D10                  mov ecx, dword ptr [ebp+10]
:0047AF35 81E1FFFF0000            and ecx, 0000FFFF
:0047AF3B 894DF8                  mov dword ptr [ebp-08], ecx
:0047AF3E 837DF802                cmp dword ptr [ebp-08], 00000002
:0047AF42 7414                    je 0047AF58
:0047AF44 817DF809040000          cmp dword ptr [ebp-08], 00000409
:0047AF4B 7419                    je 0047AF66
:0047AF4D 817DF813040000          cmp dword ptr [ebp-08], 00000413
:0047AF54 741F                    je 0047AF75
:0047AF56 EB2A                    jmp 0047AF82

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047AF42(C)
|
:0047AF58 6A00                    push 00000000
:0047AF5A 8B5508                  mov edx, dword ptr [ebp+08]
:0047AF5D 52                      push edx
:0047AF5E FF15D4624800            call dword ptr [004862D4]
:0047AF64 EB1C                    jmp 0047AF82

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047AF4B(C)
|
:0047AF66 6A01                    push 00000001
:0047AF68 8B0D10754B00            mov ecx, dword ptr [004B7510]
:0047AF6E E8DEFEFFFF              call 0047AE51
:0047AF73 EB0D                    jmp 0047AF82

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047AF54(C)
|
:0047AF75 6A00                    push 00000000
:0047AF77 8B0D10754B00            mov ecx, dword ptr [004B7510]
:0047AF7D E8CFFEFFFF              call 0047AE51

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047AF24(U), :0047AF30(U), :0047AF56(U), :0047AF64(U), :0047AF73(U)
|
:0047AF82 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047AED5(U), :0047AF0D(U)
|
:0047AF84 8BE5                    mov esp, ebp
:0047AF86 5D                      pop ebp
:0047AF87 C21000                  ret 0010



* Referenced by a CALL at Address:
|:00474D57   
|
:0047AF8A 55                      push ebp
:0047AF8B 8BEC                    mov ebp, esp
:0047AF8D 6AFF                    push FFFFFFFF
:0047AF8F 68725D4800              push 00485D72
:0047AF94 64A100000000            mov eax, dword ptr fs:[00000000]
:0047AF9A 50                      push eax
:0047AF9B 64892500000000          mov dword ptr fs:[00000000], esp
:0047AFA2 83EC5C                  sub esp, 0000005C
:0047AFA5 8D4D98                  lea ecx, dword ptr [ebp-68]
:0047AFA8 E898ECFFFF              call 00479C45
:0047AFAD C745FC00000000          mov [ebp-04], 00000000
:0047AFB4 8B450C                  mov eax, dword ptr [ebp+0C]
:0047AFB7 50                      push eax
:0047AFB8 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047AFBB 51                      push ecx
:0047AFBC 8D4D98                  lea ecx, dword ptr [ebp-68]
:0047AFBF E89BEFFFFF              call 00479F5F
:0047AFC4 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0047AFCB 8D4D98                  lea ecx, dword ptr [ebp-68]
:0047AFCE E85DA8FFFF              call 00475830
:0047AFD3 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047AFD6 64890D00000000          mov dword ptr fs:[00000000], ecx
:0047AFDD 8BE5                    mov esp, ebp
:0047AFDF 5D                      pop ebp
:0047AFE0 C3                      ret


:0047AFE1 CC                      int 03
:0047AFE2 CC                      int 03
:0047AFE3 CC                      int 03
:0047AFE4 CC                      int 03
:0047AFE5 CC                      int 03
:0047AFE6 CC                      int 03
:0047AFE7 CC                      int 03
:0047AFE8 CC                      int 03
:0047AFE9 CC                      int 03
:0047AFEA CC                      int 03
:0047AFEB CC                      int 03
:0047AFEC CC                      int 03
:0047AFED CC                      int 03
:0047AFEE CC                      int 03
:0047AFEF CC                      int 03

* Referenced by a CALL at Address:
|:00475921   
|
:0047AFF0 55                      push ebp
:0047AFF1 8BEC                    mov ebp, esp
:0047AFF3 6AFF                    push FFFFFFFF
:0047AFF5 683F5C4800              push 00485C3F
:0047AFFA 64A100000000            mov eax, dword ptr fs:[00000000]
:0047B000 50                      push eax
:0047B001 64892500000000          mov dword ptr fs:[00000000], esp
:0047B008 51                      push ecx
:0047B009 894DF0                  mov dword ptr [ebp-10], ecx
:0047B00C C745FC04000000          mov [ebp-04], 00000004
:0047B013 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047B016 81C1E0000000            add ecx, 000000E0
:0047B01C E84F010000              call 0047B170
:0047B021 C645FC03                mov [ebp-04], 03
:0047B025 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047B028 81C1B4000000            add ecx, 000000B4
:0047B02E E83D010000              call 0047B170
:0047B033 C645FC02                mov [ebp-04], 02
:0047B037 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047B03A 81C180000000            add ecx, 00000080
:0047B040 E8DB000000              call 0047B120
:0047B045 C645FC01                mov [ebp-04], 01
:0047B049 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047B04C 83C14C                  add ecx, 0000004C
:0047B04F E8CC000000              call 0047B120
:0047B054 C645FC00                mov [ebp-04], 00
:0047B058 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047B05B 83C118                  add ecx, 00000018
:0047B05E E8BD000000              call 0047B120
:0047B063 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0047B06A 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047B06D E87E31F9FF              call 0040E1F0
:0047B072 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047B075 64890D00000000          mov dword ptr fs:[00000000], ecx
:0047B07C 8BE5                    mov esp, ebp
:0047B07E 5D                      pop ebp
:0047B07F C3                      ret



* Referenced by a CALL at Address:
|:00475900   
|
:0047B080 55                      push ebp
:0047B081 8BEC                    mov ebp, esp
:0047B083 6AFF                    push FFFFFFFF
:0047B085 688F5C4800              push 00485C8F
:0047B08A 64A100000000            mov eax, dword ptr fs:[00000000]
:0047B090 50                      push eax
:0047B091 64892500000000          mov dword ptr fs:[00000000], esp
:0047B098 51                      push ecx
:0047B099 894DF0                  mov dword ptr [ebp-10], ecx
:0047B09C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047B09F E81C030000              call 0047B3C0
:0047B0A4 C745FC00000000          mov [ebp-04], 00000000
:0047B0AB 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047B0AE 83C118                  add ecx, 00000018
:0047B0B1 E81A020000              call 0047B2D0
:0047B0B6 C645FC01                mov [ebp-04], 01
:0047B0BA 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047B0BD 83C14C                  add ecx, 0000004C
:0047B0C0 E80B020000              call 0047B2D0
:0047B0C5 C645FC02                mov [ebp-04], 02
:0047B0C9 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047B0CC 81C180000000            add ecx, 00000080
:0047B0D2 E8F9010000              call 0047B2D0
:0047B0D7 C645FC03                mov [ebp-04], 03
:0047B0DB 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047B0DE 81C1B4000000            add ecx, 000000B4
:0047B0E4 E867020000              call 0047B350
:0047B0E9 C645FC04                mov [ebp-04], 04
:0047B0ED 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047B0F0 81C1E0000000            add ecx, 000000E0
:0047B0F6 E855020000              call 0047B350
:0047B0FB 8B45F0                  mov eax, dword ptr [ebp-10]
:0047B0FE C70058764800            mov dword ptr [eax], 00487658
:0047B104 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0047B10B 8B45F0                  mov eax, dword ptr [ebp-10]
:0047B10E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047B111 64890D00000000          mov dword ptr fs:[00000000], ecx
:0047B118 8BE5                    mov esp, ebp
:0047B11A 5D                      pop ebp
:0047B11B C3                      ret


:0047B11C CC                      int 03
:0047B11D CC                      int 03
:0047B11E CC                      int 03
:0047B11F CC                      int 03

* Referenced by a CALL at Addresses:
|:0047B040   , :0047B04F   , :0047B05E   , :0047B1EC   , :0047B1FB   
|:0047B20A   , :00485C0F   , :00485C1B   , :00485C2A   , :00485C5F   
|:00485C6B   , :00485C7A   , :00485CEF   , :00485CFB   , :00485D1F   
|:00485D2B   
|
:0047B120 55                      push ebp
:0047B121 8BEC                    mov ebp, esp
:0047B123 6AFF                    push FFFFFFFF
:0047B125 68A95C4800              push 00485CA9
:0047B12A 64A100000000            mov eax, dword ptr fs:[00000000]
:0047B130 50                      push eax
:0047B131 64892500000000          mov dword ptr fs:[00000000], esp
:0047B138 51                      push ecx
:0047B139 894DF0                  mov dword ptr [ebp-10], ecx
:0047B13C C745FC00000000          mov [ebp-04], 00000000
:0047B143 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047B146 83C118                  add ecx, 00000018
:0047B149 E84207F9FF              call 0040B890
:0047B14E C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0047B155 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047B158 E84276FEFF              call 0046279F
:0047B15D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047B160 64890D00000000          mov dword ptr fs:[00000000], ecx
:0047B167 8BE5                    mov esp, ebp
:0047B169 5D                      pop ebp
:0047B16A C3                      ret


:0047B16B CC                      int 03
:0047B16C CC                      int 03
:0047B16D CC                      int 03
:0047B16E CC                      int 03
:0047B16F CC                      int 03

* Referenced by a CALL at Addresses:
|:0047B01C   , :0047B02E   , :00485C39   , :00485C89   
|
:0047B170 55                      push ebp
:0047B171 8BEC                    mov ebp, esp
:0047B173 6AFF                    push FFFFFFFF
:0047B175 68C95C4800              push 00485CC9
:0047B17A 64A100000000            mov eax, dword ptr fs:[00000000]
:0047B180 50                      push eax
:0047B181 64892500000000          mov dword ptr fs:[00000000], esp
:0047B188 51                      push ecx
:0047B189 894DF0                  mov dword ptr [ebp-10], ecx
:0047B18C C745FC00000000          mov [ebp-04], 00000000
:0047B193 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047B196 83C110                  add ecx, 00000010
:0047B199 E8F206F9FF              call 0040B890
:0047B19E C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0047B1A5 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047B1A8 E8F275FEFF              call 0046279F
:0047B1AD 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047B1B0 64890D00000000          mov dword ptr fs:[00000000], ecx
:0047B1B7 8BE5                    mov esp, ebp
:0047B1B9 5D                      pop ebp
:0047B1BA C3                      ret


:0047B1BB CC                      int 03
:0047B1BC CC                      int 03
:0047B1BD CC                      int 03
:0047B1BE CC                      int 03
:0047B1BF CC                      int 03

* Referenced by a CALL at Address:
|:00475960   
|
:0047B1C0 55                      push ebp
:0047B1C1 8BEC                    mov ebp, esp
:0047B1C3 6AFF                    push FFFFFFFF
:0047B1C5 68015D4800              push 00485D01
:0047B1CA 64A100000000            mov eax, dword ptr fs:[00000000]
:0047B1D0 50                      push eax
:0047B1D1 64892500000000          mov dword ptr fs:[00000000], esp
:0047B1D8 51                      push ecx
:0047B1D9 894DF0                  mov dword ptr [ebp-10], ecx
:0047B1DC C745FC02000000          mov [ebp-04], 00000002
:0047B1E3 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047B1E6 81C180000000            add ecx, 00000080
:0047B1EC E82FFFFFFF              call 0047B120
:0047B1F1 C645FC01                mov [ebp-04], 01
:0047B1F5 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047B1F8 83C14C                  add ecx, 0000004C
:0047B1FB E820FFFFFF              call 0047B120
:0047B200 C645FC00                mov [ebp-04], 00
:0047B204 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047B207 83C118                  add ecx, 00000018
:0047B20A E811FFFFFF              call 0047B120
:0047B20F C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0047B216 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047B219 E8D22FF9FF              call 0040E1F0
:0047B21E 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047B221 64890D00000000          mov dword ptr fs:[00000000], ecx
:0047B228 8BE5                    mov esp, ebp
:0047B22A 5D                      pop ebp
:0047B22B C3                      ret


:0047B22C CC                      int 03
:0047B22D CC                      int 03
:0047B22E CC                      int 03
:0047B22F CC                      int 03

* Referenced by a CALL at Address:
|:0047593F   
|
:0047B230 55                      push ebp
:0047B231 8BEC                    mov ebp, esp
:0047B233 6AFF                    push FFFFFFFF
:0047B235 68315D4800              push 00485D31
:0047B23A 64A100000000            mov eax, dword ptr fs:[00000000]
:0047B240 50                      push eax
:0047B241 64892500000000          mov dword ptr fs:[00000000], esp
:0047B248 51                      push ecx
:0047B249 894DF0                  mov dword ptr [ebp-10], ecx
:0047B24C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047B24F E86C010000              call 0047B3C0
:0047B254 C745FC00000000          mov [ebp-04], 00000000
:0047B25B 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047B25E 83C118                  add ecx, 00000018
:0047B261 E86A000000              call 0047B2D0
:0047B266 C645FC01                mov [ebp-04], 01
:0047B26A 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047B26D 83C14C                  add ecx, 0000004C
:0047B270 E85B000000              call 0047B2D0
:0047B275 C645FC02                mov [ebp-04], 02
:0047B279 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047B27C 81C180000000            add ecx, 00000080
:0047B282 E849000000              call 0047B2D0
:0047B287 8B45F0                  mov eax, dword ptr [ebp-10]
:0047B28A C70068764800            mov dword ptr [eax], 00487668
:0047B290 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0047B297 8B45F0                  mov eax, dword ptr [ebp-10]
:0047B29A 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047B29D 64890D00000000          mov dword ptr fs:[00000000], ecx
:0047B2A4 8BE5                    mov esp, ebp
:0047B2A6 5D                      pop ebp
:0047B2A7 C3                      ret


:0047B2A8 CC                      int 03
:0047B2A9 CC                      int 03
:0047B2AA CC                      int 03
:0047B2AB CC                      int 03
:0047B2AC CC                      int 03
:0047B2AD CC                      int 03
:0047B2AE CC                      int 03
:0047B2AF CC                      int 03

* Referenced by a CALL at Address:
|:004785ED   
|
:0047B2B0 55                      push ebp
:0047B2B1 8BEC                    mov ebp, esp
:0047B2B3 51                      push ecx
:0047B2B4 894DFC                  mov dword ptr [ebp-04], ecx
:0047B2B7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047B2BA E88178FFFF              call 00472B40
:0047B2BF 8B45FC                  mov eax, dword ptr [ebp-04]
:0047B2C2 C70078764800            mov dword ptr [eax], 00487678
:0047B2C8 8B45FC                  mov eax, dword ptr [ebp-04]
:0047B2CB 8BE5                    mov esp, ebp
:0047B2CD 5D                      pop ebp
:0047B2CE C3                      ret


:0047B2CF CC                      int 03

* Referenced by a CALL at Addresses:
|:0047B0B1   , :0047B0C0   , :0047B0D2   , :0047B261   , :0047B270   
|:0047B282   
|
:0047B2D0 55                      push ebp
:0047B2D1 8BEC                    mov ebp, esp
:0047B2D3 6AFF                    push FFFFFFFF
:0047B2D5 68895D4800              push 00485D89
:0047B2DA 64A100000000            mov eax, dword ptr fs:[00000000]
:0047B2E0 50                      push eax
:0047B2E1 64892500000000          mov dword ptr fs:[00000000], esp
:0047B2E8 51                      push ecx
:0047B2E9 894DF0                  mov dword ptr [ebp-10], ecx
:0047B2EC 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047B2EF E87174FEFF              call 00462765
:0047B2F4 C745FC00000000          mov [ebp-04], 00000000
:0047B2FB 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047B2FE 83C118                  add ecx, 00000018
:0047B301 E82A05F9FF              call 0040B830
:0047B306 8B45F0                  mov eax, dword ptr [ebp-10]
:0047B309 C700D0764800            mov dword ptr [eax], 004876D0
:0047B30F 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047B312 C7410C00000000          mov [ecx+0C], 00000000
:0047B319 8B55F0                  mov edx, dword ptr [ebp-10]
:0047B31C C7421400000000          mov [edx+14], 00000000
:0047B323 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0047B32A 8B45F0                  mov eax, dword ptr [ebp-10]
:0047B32D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047B330 64890D00000000          mov dword ptr fs:[00000000], ecx
:0047B337 8BE5                    mov esp, ebp
:0047B339 5D                      pop ebp
:0047B33A C3                      ret


:0047B33B CC                      int 03
:0047B33C CC                      int 03
:0047B33D CC                      int 03
:0047B33E CC                      int 03
:0047B33F CC                      int 03
:0047B340 55                      push ebp
:0047B341 8BEC                    mov ebp, esp
:0047B343 51                      push ecx
:0047B344 894DFC                  mov dword ptr [ebp-04], ecx
:0047B347 B850694800              mov eax, 00486950
:0047B34C 8BE5                    mov esp, ebp
:0047B34E 5D                      pop ebp
:0047B34F C3                      ret



* Referenced by a CALL at Addresses:
|:0047B0E4   , :0047B0F6   
|
:0047B350 55                      push ebp
:0047B351 8BEC                    mov ebp, esp
:0047B353 6AFF                    push FFFFFFFF
:0047B355 68A95D4800              push 00485DA9
:0047B35A 64A100000000            mov eax, dword ptr fs:[00000000]
:0047B360 50                      push eax
:0047B361 64892500000000          mov dword ptr fs:[00000000], esp
:0047B368 51                      push ecx
:0047B369 894DF0                  mov dword ptr [ebp-10], ecx
:0047B36C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047B36F E8F173FEFF              call 00462765
:0047B374 C745FC00000000          mov [ebp-04], 00000000
:0047B37B 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047B37E 83C110                  add ecx, 00000010
:0047B381 E8AA04F9FF              call 0040B830
:0047B386 8B45F0                  mov eax, dword ptr [ebp-10]
:0047B389 C700E0764800            mov dword ptr [eax], 004876E0
:0047B38F 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047B392 C7410C00000000          mov [ecx+0C], 00000000
:0047B399 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0047B3A0 8B45F0                  mov eax, dword ptr [ebp-10]
:0047B3A3 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047B3A6 64890D00000000          mov dword ptr fs:[00000000], ecx
:0047B3AD 8BE5                    mov esp, ebp
:0047B3AF 5D                      pop ebp
:0047B3B0 C3                      ret


:0047B3B1 CC                      int 03
:0047B3B2 CC                      int 03
:0047B3B3 CC                      int 03
:0047B3B4 CC                      int 03
:0047B3B5 CC                      int 03
:0047B3B6 CC                      int 03
:0047B3B7 CC                      int 03
:0047B3B8 CC                      int 03
:0047B3B9 CC                      int 03
:0047B3BA CC                      int 03
:0047B3BB CC                      int 03
:0047B3BC CC                      int 03
:0047B3BD CC                      int 03
:0047B3BE CC                      int 03
:0047B3BF CC                      int 03

* Referenced by a CALL at Addresses:
|:0047B09F   , :0047B24F   
|
:0047B3C0 55                      push ebp
:0047B3C1 8BEC                    mov ebp, esp
:0047B3C3 51                      push ecx
:0047B3C4 894DFC                  mov dword ptr [ebp-04], ecx
:0047B3C7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047B3CA E89673FEFF              call 00462765
:0047B3CF 8B45FC                  mov eax, dword ptr [ebp-04]
:0047B3D2 C700F0764800            mov dword ptr [eax], 004876F0
:0047B3D8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047B3DB C7410C00000000          mov [ecx+0C], 00000000
:0047B3E2 8B55FC                  mov edx, dword ptr [ebp-04]
:0047B3E5 C7421000000000          mov [edx+10], 00000000
:0047B3EC 8B45FC                  mov eax, dword ptr [ebp-04]
:0047B3EF 8BE5                    mov esp, ebp
:0047B3F1 5D                      pop ebp
:0047B3F2 C3                      ret


:0047B3F3 CC                      int 03
:0047B3F4 CC                      int 03
:0047B3F5 CC                      int 03
:0047B3F6 CC                      int 03
:0047B3F7 CC                      int 03
:0047B3F8 CC                      int 03
:0047B3F9 CC                      int 03
:0047B3FA CC                      int 03
:0047B3FB CC                      int 03
:0047B3FC CC                      int 03
:0047B3FD CC                      int 03
:0047B3FE CC                      int 03
:0047B3FF CC                      int 03
:0047B400 55                      push ebp
:0047B401 8BEC                    mov ebp, esp
:0047B403 51                      push ecx
:0047B404 894DFC                  mov dword ptr [ebp-04], ecx
:0047B407 B860694800              mov eax, 00486960
:0047B40C 8BE5                    mov esp, ebp
:0047B40E 5D                      pop ebp
:0047B40F C3                      ret



* Referenced by a CALL at Address:
|:00475417   
|
:0047B410 55                      push ebp
:0047B411 8BEC                    mov ebp, esp
:0047B413 83EC0C                  sub esp, 0000000C
:0047B416 8B4508                  mov eax, dword ptr [ebp+08]
:0047B419 99                      cdq
:0047B41A B930000000              mov ecx, 00000030
:0047B41F F7F9                    idiv ecx
:0047B421 6BC030                  imul eax, 00000030
:0047B424 8945F8                  mov dword ptr [ebp-08], eax
:0047B427 8B450C                  mov eax, dword ptr [ebp+0C]
:0047B42A 83E828                  sub eax, 00000028
:0047B42D 99                      cdq
:0047B42E B930000000              mov ecx, 00000030
:0047B433 F7F9                    idiv ecx
:0047B435 6BC030                  imul eax, 00000030
:0047B438 83C028                  add eax, 00000028
:0047B43B 8945FC                  mov dword ptr [ebp-04], eax
:0047B43E 8B55F8                  mov edx, dword ptr [ebp-08]
:0047B441 52                      push edx
:0047B442 B950424B00              mov ecx, 004B4250
:0047B447 E8F3AAFDFF              call 00455F3F
:0047B44C 8B45F8                  mov eax, dword ptr [ebp-08]
:0047B44F 50                      push eax
:0047B450 B950424B00              mov ecx, 004B4250
:0047B455 E897AAFDFF              call 00455EF1
:0047B45A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047B45D 51                      push ecx
:0047B45E B950424B00              mov ecx, 004B4250
:0047B463 E825ABFDFF              call 00455F8D
:0047B468 8B55FC                  mov edx, dword ptr [ebp-04]
:0047B46B 52                      push edx
:0047B46C B950424B00              mov ecx, 004B4250
:0047B471 E8F0AAFDFF              call 00455F66
:0047B476 8B45FC                  mov eax, dword ptr [ebp-04]
:0047B479 50                      push eax
:0047B47A B950424B00              mov ecx, 004B4250
:0047B47F E894AAFDFF              call 00455F18
:0047B484 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047B487 51                      push ecx
:0047B488 B950424B00              mov ecx, 004B4250
:0047B48D E822ABFDFF              call 00455FB4
:0047B492 6A00                    push 00000000
:0047B494 B950424B00              mov ecx, 004B4250
:0047B499 E869A9FDFF              call 00455E07
:0047B49E 6A00                    push 00000000
:0047B4A0 B950424B00              mov ecx, 004B4250
:0047B4A5 E884A9FDFF              call 00455E2E
:0047B4AA 6A00                    push 00000000
:0047B4AC B950424B00              mov ecx, 004B4250
:0047B4B1 E8DDA8FDFF              call 00455D93
:0047B4B6 8B1558E84800            mov edx, dword ptr [0048E858]
:0047B4BC 52                      push edx
:0047B4BD B950424B00              mov ecx, 004B4250
:0047B4C2 E88EA9FDFF              call 00455E55
:0047B4C7 A15CE84800              mov eax, dword ptr [0048E85C]
:0047B4CC 3B450C                  cmp eax, dword ptr [ebp+0C]
:0047B4CF 7D0B                    jge 0047B4DC
:0047B4D1 8B0D5CE84800            mov ecx, dword ptr [0048E85C]
:0047B4D7 894DF4                  mov dword ptr [ebp-0C], ecx
:0047B4DA EB06                    jmp 0047B4E2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047B4CF(C)
|
:0047B4DC 8B550C                  mov edx, dword ptr [ebp+0C]
:0047B4DF 8955F4                  mov dword ptr [ebp-0C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047B4DA(U)
|
:0047B4E2 8B45F4                  mov eax, dword ptr [ebp-0C]
:0047B4E5 83E828                  sub eax, 00000028
:0047B4E8 50                      push eax
:0047B4E9 B950424B00              mov ecx, 004B4250
:0047B4EE E889A9FDFF              call 00455E7C
:0047B4F3 8BE5                    mov esp, ebp
:0047B4F5 5D                      pop ebp
:0047B4F6 C3                      ret



* Referenced by a CALL at Addresses:
|:0040BD81   , :0042B63C   , :0042B6D0   , :0042B991   , :0042C120   
|:0042C36F   , :0044ED41   , :0044F028   
|
:0047B4F7 55                      push ebp
:0047B4F8 8BEC                    mov ebp, esp
:0047B4FA 83EC1C                  sub esp, 0000001C
:0047B4FD A1686A4B00              mov eax, dword ptr [004B6A68]
:0047B502 50                      push eax
:0047B503 FF1554634800            call dword ptr [00486354]
:0047B509 85C0                    test eax, eax
:0047B50B 740F                    je 0047B51C
:0047B50D 6A09                    push 00000009
:0047B50F 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:0047B515 51                      push ecx
:0047B516 FF15E0624800            call dword ptr [004862E0]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047B50B(C)
|
:0047B51C 8B15686A4B00            mov edx, dword ptr [004B6A68]
:0047B522 52                      push edx
:0047B523 FF154C624800            call dword ptr [0048624C]
:0047B529 85C0                    test eax, eax
:0047B52B 7418                    je 0047B545
:0047B52D 6A00                    push 00000000
:0047B52F 6820F10000              push 0000F120
:0047B534 6812010000              push 00000112
:0047B539 A1686A4B00              mov eax, dword ptr [004B6A68]
:0047B53E 50                      push eax
:0047B53F FF15F4624800            call dword ptr [004862F4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047B52B(C)
|
:0047B545 6A00                    push 00000000
:0047B547 B950424B00              mov ecx, 004B4250
:0047B54C E868A8FDFF              call 00455DB9
:0047B551 6A00                    push 00000000
:0047B553 B950424B00              mov ecx, 004B4250
:0047B558 E883A8FDFF              call 00455DE0
:0047B55D B950424B00              mov ecx, 004B4250
:0047B562 E8C7A9FDFF              call 00455F2E
:0047B567 390558E84800            cmp dword ptr [0048E858], eax
:0047B56D 7D0B                    jge 0047B57A
:0047B56F 8B0D58E84800            mov ecx, dword ptr [0048E858]
:0047B575 894DE8                  mov dword ptr [ebp-18], ecx
:0047B578 EB0D                    jmp 0047B587

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047B56D(C)
|
:0047B57A B950424B00              mov ecx, 004B4250
:0047B57F E8AAA9FDFF              call 00455F2E
:0047B584 8945E8                  mov dword ptr [ebp-18], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047B578(U)
|
:0047B587 8B55E8                  mov edx, dword ptr [ebp-18]
:0047B58A 52                      push edx
:0047B58B B950424B00              mov ecx, 004B4250
:0047B590 E85CA9FDFF              call 00455EF1
:0047B595 B950424B00              mov ecx, 004B4250
:0047B59A E8B6A9FDFF              call 00455F55
:0047B59F 39055CE84800            cmp dword ptr [0048E85C], eax
:0047B5A5 7D0A                    jge 0047B5B1
:0047B5A7 A15CE84800              mov eax, dword ptr [0048E85C]
:0047B5AC 8945E4                  mov dword ptr [ebp-1C], eax
:0047B5AF EB0D                    jmp 0047B5BE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047B5A5(C)
|
:0047B5B1 B950424B00              mov ecx, 004B4250
:0047B5B6 E89AA9FDFF              call 00455F55
:0047B5BB 8945E4                  mov dword ptr [ebp-1C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047B5AF(U)
|
:0047B5BE 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0047B5C1 51                      push ecx
:0047B5C2 B950424B00              mov ecx, 004B4250
:0047B5C7 E84CA9FDFF              call 00455F18
:0047B5CC 8B1558E84800            mov edx, dword ptr [0048E858]
:0047B5D2 52                      push edx
:0047B5D3 B950424B00              mov ecx, 004B4250
:0047B5D8 E8B0A9FDFF              call 00455F8D
:0047B5DD A15CE84800              mov eax, dword ptr [0048E85C]
:0047B5E2 50                      push eax
:0047B5E3 B950424B00              mov ecx, 004B4250
:0047B5E8 E8C7A9FDFF              call 00455FB4
:0047B5ED 8B0D58E84800            mov ecx, dword ptr [0048E858]
:0047B5F3 51                      push ecx
:0047B5F4 B950424B00              mov ecx, 004B4250
:0047B5F9 E857A8FDFF              call 00455E55
:0047B5FE 8B155CE84800            mov edx, dword ptr [0048E85C]
:0047B604 83EA28                  sub edx, 00000028
:0047B607 52                      push edx
:0047B608 B950424B00              mov ecx, 004B4250
:0047B60D E86AA8FDFF              call 00455E7C
:0047B612 6A00                    push 00000000
:0047B614 B950424B00              mov ecx, 004B4250
:0047B619 E875A7FDFF              call 00455D93
:0047B61E 6AF0                    push FFFFFFF0
:0047B620 A1686A4B00              mov eax, dword ptr [004B6A68]
:0047B625 50                      push eax
:0047B626 FF15A0634800            call dword ptr [004863A0]
:0047B62C 8945EC                  mov dword ptr [ebp-14], eax
:0047B62F 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0047B632 81C900000200            or ecx, 00020000
:0047B638 81E1FFFFFBFF            and ecx, FFFBFFFF
:0047B63E 81E1FFFFFEFF            and ecx, FFFEFFFF
:0047B644 81E1FFFFEFFF            and ecx, FFEFFFFF
:0047B64A 81E1FFFFDFFF            and ecx, FFDFFFFF
:0047B650 894DEC                  mov dword ptr [ebp-14], ecx
:0047B653 8B55EC                  mov edx, dword ptr [ebp-14]
:0047B656 52                      push edx
:0047B657 6AF0                    push FFFFFFF0
:0047B659 A1686A4B00              mov eax, dword ptr [004B6A68]
:0047B65E 50                      push eax
:0047B65F FF1550634800            call dword ptr [00486350]
:0047B665 C745F000000000          mov [ebp-10], 00000000
:0047B66C C745F400000000          mov [ebp-0C], 00000000
:0047B673 B950424B00              mov ecx, 004B4250
:0047B678 E863A8FDFF              call 00455EE0
:0047B67D 83E801                  sub eax, 00000001
:0047B680 8945F8                  mov dword ptr [ebp-08], eax
:0047B683 B950424B00              mov ecx, 004B4250
:0047B688 E87AA8FDFF              call 00455F07
:0047B68D 83E829                  sub eax, 00000029
:0047B690 8945FC                  mov dword ptr [ebp-04], eax
:0047B693 6A00                    push 00000000
:0047B695 6800003F02              push 023F0000
:0047B69A 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0047B69D 51                      push ecx
:0047B69E FF15A4634800            call dword ptr [004863A4]
:0047B6A4 6A00                    push 00000000
:0047B6A6 E838140000              call 0047CAE3
:0047B6AB 83C404                  add esp, 00000004
:0047B6AE 6A00                    push 00000000
:0047B6B0 8B55FC                  mov edx, dword ptr [ebp-04]
:0047B6B3 2B55F4                  sub edx, dword ptr [ebp-0C]
:0047B6B6 83C201                  add edx, 00000001
:0047B6B9 52                      push edx
:0047B6BA 8B45F8                  mov eax, dword ptr [ebp-08]
:0047B6BD 2B45F0                  sub eax, dword ptr [ebp-10]
:0047B6C0 83C001                  add eax, 00000001
:0047B6C3 50                      push eax
:0047B6C4 E8B9350000              call 0047EC82
:0047B6C9 83C40C                  add esp, 0000000C
:0047B6CC B950424B00              mov ecx, 004B4250
:0047B6D1 E895A7FDFF              call 00455E6B
:0047B6D6 50                      push eax
:0047B6D7 B950424B00              mov ecx, 004B4250
:0047B6DC E863A7FDFF              call 00455E44
:0047B6E1 50                      push eax
:0047B6E2 6A00                    push 00000000
:0047B6E4 6A00                    push 00000000
:0047B6E6 E8961B0000              call 0047D281
:0047B6EB 83C410                  add esp, 00000010
:0047B6EE 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047B6F1 2B4DF0                  sub ecx, dword ptr [ebp-10]
:0047B6F4 83C101                  add ecx, 00000001
:0047B6F7 8B55FC                  mov edx, dword ptr [ebp-04]
:0047B6FA 2B55F4                  sub edx, dword ptr [ebp-0C]
:0047B6FD 83C201                  add edx, 00000001
:0047B700 C1E208                  shl edx, 08
:0047B703 0BCA                    or ecx, edx
:0047B705 51                      push ecx
:0047B706 6A00                    push 00000000
:0047B708 6A05                    push 00000005
:0047B70A A18C6A4B00              mov eax, dword ptr [004B6A8C]
:0047B70F 50                      push eax
:0047B710 FF15F4624800            call dword ptr [004862F4]

* Possible StringData Ref from Data Obj ->"־ܲٴ"
                                  |
:0047B716 6848E84800              push 0048E848
:0047B71B 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:0047B721 51                      push ecx
:0047B722 FF1560634800            call dword ptr [00486360]
:0047B728 8B15686A4B00            mov edx, dword ptr [004B6A68]
:0047B72E 52                      push edx
:0047B72F FF15A8624800            call dword ptr [004862A8]
:0047B735 8BE5                    mov esp, ebp
:0047B737 5D                      pop ebp
:0047B738 C3                      ret



* Referenced by a CALL at Address:
|:00475508   
|
:0047B739 55                      push ebp
:0047B73A 8BEC                    mov ebp, esp
:0047B73C 8B4508                  mov eax, dword ptr [ebp+08]
:0047B73F 50                      push eax
:0047B740 B950424B00              mov ecx, 004B4250
:0047B745 E8F5A7FDFF              call 00455F3F
:0047B74A 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0047B74D 51                      push ecx
:0047B74E B950424B00              mov ecx, 004B4250
:0047B753 E80EA8FDFF              call 00455F66
:0047B758 5D                      pop ebp
:0047B759 C3                      ret



* Referenced by a CALL at Address:
|:0047BEA7   
|
:0047B75A 55                      push ebp
:0047B75B 8BEC                    mov ebp, esp
:0047B75D 83EC74                  sub esp, 00000074
:0047B760 56                      push esi
:0047B761 6A37                    push 00000037
:0047B763 FF157C624800            call dword ptr [0048627C]
:0047B769 8BF0                    mov esi, eax
:0047B76B 6A04                    push 00000004
:0047B76D FF157C624800            call dword ptr [0048627C]
:0047B773 03F0                    add esi, eax
:0047B775 B950424B00              mov ecx, 004B4250
:0047B77A E8E162FDFF              call 00451A60
:0047B77F 03F0                    add esi, eax
:0047B781 8975DC                  mov dword ptr [ebp-24], esi
:0047B784 6A00                    push 00000000
:0047B786 8D45EC                  lea eax, dword ptr [ebp-14]
:0047B789 50                      push eax
:0047B78A 6A00                    push 00000000
:0047B78C 6A30                    push 00000030
:0047B78E FF1558634800            call dword ptr [00486358]
:0047B794 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047B797 2B4DEC                  sub ecx, dword ptr [ebp-14]
:0047B79A 81F980020000            cmp ecx, 00000280
:0047B7A0 7D09                    jge 0047B7AB
:0047B7A2 C745C880020000          mov [ebp-38], 00000280
:0047B7A9 EB09                    jmp 0047B7B4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047B7A0(C)
|
:0047B7AB 8B55F4                  mov edx, dword ptr [ebp-0C]
:0047B7AE 2B55EC                  sub edx, dword ptr [ebp-14]
:0047B7B1 8955C8                  mov dword ptr [ebp-38], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047B7A9(U)
|
:0047B7B4 B950424B00              mov ecx, 004B4250
:0047B7B9 E870A7FDFF              call 00455F2E
:0047B7BE 3B45C8                  cmp eax, dword ptr [ebp-38]
:0047B7C1 7D0F                    jge 0047B7D2
:0047B7C3 B950424B00              mov ecx, 004B4250
:0047B7C8 E861A7FDFF              call 00455F2E
:0047B7CD 8945C4                  mov dword ptr [ebp-3C], eax
:0047B7D0 EB25                    jmp 0047B7F7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047B7C1(C)
|
:0047B7D2 8B45F4                  mov eax, dword ptr [ebp-0C]
:0047B7D5 2B45EC                  sub eax, dword ptr [ebp-14]
:0047B7D8 3D80020000              cmp eax, 00000280
:0047B7DD 7D09                    jge 0047B7E8
:0047B7DF C745C080020000          mov [ebp-40], 00000280
:0047B7E6 EB09                    jmp 0047B7F1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047B7DD(C)
|
:0047B7E8 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047B7EB 2B4DEC                  sub ecx, dword ptr [ebp-14]
:0047B7EE 894DC0                  mov dword ptr [ebp-40], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047B7E6(U)
|
:0047B7F1 8B55C0                  mov edx, dword ptr [ebp-40]
:0047B7F4 8955C4                  mov dword ptr [ebp-3C], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047B7D0(U)
|
:0047B7F7 817DC400050000          cmp dword ptr [ebp-3C], 00000500
:0047B7FE 7E09                    jle 0047B809
:0047B800 C745BC00050000          mov [ebp-44], 00000500
:0047B807 EB69                    jmp 0047B872

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047B7FE(C)
|
:0047B809 8B45F4                  mov eax, dword ptr [ebp-0C]
:0047B80C 2B45EC                  sub eax, dword ptr [ebp-14]
:0047B80F 3D80020000              cmp eax, 00000280
:0047B814 7D09                    jge 0047B81F
:0047B816 C745B880020000          mov [ebp-48], 00000280
:0047B81D EB09                    jmp 0047B828

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047B814(C)
|
:0047B81F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047B822 2B4DEC                  sub ecx, dword ptr [ebp-14]
:0047B825 894DB8                  mov dword ptr [ebp-48], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047B81D(U)
|
:0047B828 B950424B00              mov ecx, 004B4250
:0047B82D E8FCA6FDFF              call 00455F2E
:0047B832 3B45B8                  cmp eax, dword ptr [ebp-48]
:0047B835 7D0F                    jge 0047B846
:0047B837 B950424B00              mov ecx, 004B4250
:0047B83C E8EDA6FDFF              call 00455F2E
:0047B841 8945B4                  mov dword ptr [ebp-4C], eax
:0047B844 EB26                    jmp 0047B86C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047B835(C)
|
:0047B846 8B55F4                  mov edx, dword ptr [ebp-0C]
:0047B849 2B55EC                  sub edx, dword ptr [ebp-14]
:0047B84C 81FA80020000            cmp edx, 00000280
:0047B852 7D09                    jge 0047B85D
:0047B854 C745B080020000          mov [ebp-50], 00000280
:0047B85B EB09                    jmp 0047B866

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047B852(C)
|
:0047B85D 8B45F4                  mov eax, dword ptr [ebp-0C]
:0047B860 2B45EC                  sub eax, dword ptr [ebp-14]
:0047B863 8945B0                  mov dword ptr [ebp-50], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047B85B(U)
|
:0047B866 8B4DB0                  mov ecx, dword ptr [ebp-50]
:0047B869 894DB4                  mov dword ptr [ebp-4C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047B844(U)
|
:0047B86C 8B55B4                  mov edx, dword ptr [ebp-4C]
:0047B86F 8955BC                  mov dword ptr [ebp-44], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047B807(U)
|
:0047B872 8B45BC                  mov eax, dword ptr [ebp-44]
:0047B875 8945D8                  mov dword ptr [ebp-28], eax
:0047B878 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047B87B 2B4DF0                  sub ecx, dword ptr [ebp-10]
:0047B87E 81F9E0010000            cmp ecx, 000001E0
:0047B884 7D09                    jge 0047B88F
:0047B886 C745ACE0010000          mov [ebp-54], 000001E0
:0047B88D EB09                    jmp 0047B898

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047B884(C)
|
:0047B88F 8B55F8                  mov edx, dword ptr [ebp-08]
:0047B892 2B55F0                  sub edx, dword ptr [ebp-10]
:0047B895 8955AC                  mov dword ptr [ebp-54], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047B88D(U)
|
:0047B898 B950424B00              mov ecx, 004B4250
:0047B89D E8B3A6FDFF              call 00455F55
:0047B8A2 3B45AC                  cmp eax, dword ptr [ebp-54]
:0047B8A5 7D0F                    jge 0047B8B6
:0047B8A7 B950424B00              mov ecx, 004B4250
:0047B8AC E8A4A6FDFF              call 00455F55
:0047B8B1 8945A8                  mov dword ptr [ebp-58], eax
:0047B8B4 EB25                    jmp 0047B8DB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047B8A5(C)
|
:0047B8B6 8B45F8                  mov eax, dword ptr [ebp-08]
:0047B8B9 2B45F0                  sub eax, dword ptr [ebp-10]
:0047B8BC 3DE0010000              cmp eax, 000001E0
:0047B8C1 7D09                    jge 0047B8CC
:0047B8C3 C745A4E0010000          mov [ebp-5C], 000001E0
:0047B8CA EB09                    jmp 0047B8D5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047B8C1(C)
|
:0047B8CC 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047B8CF 2B4DF0                  sub ecx, dword ptr [ebp-10]
:0047B8D2 894DA4                  mov dword ptr [ebp-5C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047B8CA(U)
|
:0047B8D5 8B55A4                  mov edx, dword ptr [ebp-5C]
:0047B8D8 8955A8                  mov dword ptr [ebp-58], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047B8B4(U)
|
:0047B8DB 817DA800040000          cmp dword ptr [ebp-58], 00000400
:0047B8E2 7E09                    jle 0047B8ED
:0047B8E4 C745A000040000          mov [ebp-60], 00000400
:0047B8EB EB69                    jmp 0047B956

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047B8E2(C)
|
:0047B8ED 8B45F8                  mov eax, dword ptr [ebp-08]
:0047B8F0 2B45F0                  sub eax, dword ptr [ebp-10]
:0047B8F3 3DE0010000              cmp eax, 000001E0
:0047B8F8 7D09                    jge 0047B903
:0047B8FA C7459CE0010000          mov [ebp-64], 000001E0
:0047B901 EB09                    jmp 0047B90C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047B8F8(C)
|
:0047B903 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047B906 2B4DF0                  sub ecx, dword ptr [ebp-10]
:0047B909 894D9C                  mov dword ptr [ebp-64], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047B901(U)
|
:0047B90C B950424B00              mov ecx, 004B4250
:0047B911 E83FA6FDFF              call 00455F55
:0047B916 3B459C                  cmp eax, dword ptr [ebp-64]
:0047B919 7D0F                    jge 0047B92A
:0047B91B B950424B00              mov ecx, 004B4250
:0047B920 E830A6FDFF              call 00455F55
:0047B925 894598                  mov dword ptr [ebp-68], eax
:0047B928 EB26                    jmp 0047B950

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047B919(C)
|
:0047B92A 8B55F8                  mov edx, dword ptr [ebp-08]
:0047B92D 2B55F0                  sub edx, dword ptr [ebp-10]
:0047B930 81FAE0010000            cmp edx, 000001E0
:0047B936 7D09                    jge 0047B941
:0047B938 C74594E0010000          mov [ebp-6C], 000001E0
:0047B93F EB09                    jmp 0047B94A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047B936(C)
|
:0047B941 8B45F8                  mov eax, dword ptr [ebp-08]
:0047B944 2B45F0                  sub eax, dword ptr [ebp-10]
:0047B947 894594                  mov dword ptr [ebp-6C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047B93F(U)
|
:0047B94A 8B4D94                  mov ecx, dword ptr [ebp-6C]
:0047B94D 894D98                  mov dword ptr [ebp-68], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047B928(U)
|
:0047B950 8B5598                  mov edx, dword ptr [ebp-68]
:0047B953 8955A0                  mov dword ptr [ebp-60], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047B8EB(U)
|
:0047B956 8B45A0                  mov eax, dword ptr [ebp-60]
:0047B959 8945D4                  mov dword ptr [ebp-2C], eax
:0047B95C 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0047B95F 894DE4                  mov dword ptr [ebp-1C], ecx
:0047B962 8B55F0                  mov edx, dword ptr [ebp-10]
:0047B965 8955FC                  mov dword ptr [ebp-04], edx
:0047B968 B950424B00              mov ecx, 004B4250
:0047B96D E80AA6FDFF              call 00455F7C
:0047B972 8BC8                    mov ecx, eax
:0047B974 8B45D8                  mov eax, dword ptr [ebp-28]
:0047B977 99                      cdq
:0047B978 BE30000000              mov esi, 00000030
:0047B97D F7FE                    idiv esi
:0047B97F 6BC030                  imul eax, 00000030
:0047B982 3BC8                    cmp ecx, eax
:0047B984 7D0F                    jge 0047B995
:0047B986 B950424B00              mov ecx, 004B4250
:0047B98B E8ECA5FDFF              call 00455F7C
:0047B990 894590                  mov dword ptr [ebp-70], eax
:0047B993 EB11                    jmp 0047B9A6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047B984(C)
|
:0047B995 8B45D8                  mov eax, dword ptr [ebp-28]
:0047B998 99                      cdq
:0047B999 B930000000              mov ecx, 00000030
:0047B99E F7F9                    idiv ecx
:0047B9A0 6BC030                  imul eax, 00000030
:0047B9A3 894590                  mov dword ptr [ebp-70], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047B993(U)
|
:0047B9A6 8B5590                  mov edx, dword ptr [ebp-70]
:0047B9A9 8955E8                  mov dword ptr [ebp-18], edx
:0047B9AC B950424B00              mov ecx, 004B4250
:0047B9B1 E8EDA5FDFF              call 00455FA3
:0047B9B6 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0047B9B9 03C8                    add ecx, eax
:0047B9BB 8B45D4                  mov eax, dword ptr [ebp-2C]
:0047B9BE 2B45DC                  sub eax, dword ptr [ebp-24]
:0047B9C1 99                      cdq
:0047B9C2 BE30000000              mov esi, 00000030
:0047B9C7 F7FE                    idiv esi
:0047B9C9 6BC030                  imul eax, 00000030
:0047B9CC 8B55DC                  mov edx, dword ptr [ebp-24]
:0047B9CF 03D0                    add edx, eax
:0047B9D1 3BCA                    cmp ecx, edx
:0047B9D3 7D14                    jge 0047B9E9
:0047B9D5 B950424B00              mov ecx, 004B4250
:0047B9DA E8C4A5FDFF              call 00455FA3
:0047B9DF 8B4DDC                  mov ecx, dword ptr [ebp-24]
:0047B9E2 03C8                    add ecx, eax
:0047B9E4 894D8C                  mov dword ptr [ebp-74], ecx
:0047B9E7 EB19                    jmp 0047BA02

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047B9D3(C)
|
:0047B9E9 8B45D4                  mov eax, dword ptr [ebp-2C]
:0047B9EC 2B45DC                  sub eax, dword ptr [ebp-24]
:0047B9EF 99                      cdq
:0047B9F0 B930000000              mov ecx, 00000030
:0047B9F5 F7F9                    idiv ecx
:0047B9F7 6BC030                  imul eax, 00000030
:0047B9FA 8B55DC                  mov edx, dword ptr [ebp-24]
:0047B9FD 03D0                    add edx, eax
:0047B9FF 89558C                  mov dword ptr [ebp-74], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047B9E7(U)
|
:0047BA02 8B458C                  mov eax, dword ptr [ebp-74]
:0047BA05 8945E0                  mov dword ptr [ebp-20], eax
:0047BA08 C745EC00000000          mov [ebp-14], 00000000
:0047BA0F C745F000000000          mov [ebp-10], 00000000
:0047BA16 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0047BA19 894DF4                  mov dword ptr [ebp-0C], ecx
:0047BA1C 8B55E0                  mov edx, dword ptr [ebp-20]
:0047BA1F 8955F8                  mov dword ptr [ebp-08], edx
:0047BA22 6A00                    push 00000000
:0047BA24 6800003F02              push 023F0000
:0047BA29 8D45EC                  lea eax, dword ptr [ebp-14]
:0047BA2C 50                      push eax
:0047BA2D FF15A4634800            call dword ptr [004863A4]
:0047BA33 8B45D8                  mov eax, dword ptr [ebp-28]
:0047BA36 2B45F4                  sub eax, dword ptr [ebp-0C]
:0047BA39 0345EC                  add eax, dword ptr [ebp-14]
:0047BA3C 99                      cdq
:0047BA3D 2BC2                    sub eax, edx
:0047BA3F D1F8                    sar eax, 1
:0047BA41 8945D0                  mov dword ptr [ebp-30], eax
:0047BA44 8B45D4                  mov eax, dword ptr [ebp-2C]
:0047BA47 2B45F8                  sub eax, dword ptr [ebp-08]
:0047BA4A 0345F0                  add eax, dword ptr [ebp-10]
:0047BA4D 99                      cdq
:0047BA4E 2BC2                    sub eax, edx
:0047BA50 D1F8                    sar eax, 1
:0047BA52 8945CC                  mov dword ptr [ebp-34], eax
:0047BA55 837DD000                cmp dword ptr [ebp-30], 00000000
:0047BA59 7D07                    jge 0047BA62
:0047BA5B C745D000000000          mov [ebp-30], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047BA59(C)
|
:0047BA62 837DCC00                cmp dword ptr [ebp-34], 00000000
:0047BA66 7D07                    jge 0047BA6F
:0047BA68 C745CC00000000          mov [ebp-34], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047BA66(C)
|
:0047BA6F 8B4DD0                  mov ecx, dword ptr [ebp-30]
:0047BA72 034DE4                  add ecx, dword ptr [ebp-1C]
:0047BA75 8B55EC                  mov edx, dword ptr [ebp-14]
:0047BA78 03D1                    add edx, ecx
:0047BA7A 8955EC                  mov dword ptr [ebp-14], edx
:0047BA7D 8B45D0                  mov eax, dword ptr [ebp-30]
:0047BA80 0345E4                  add eax, dword ptr [ebp-1C]
:0047BA83 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047BA86 03C8                    add ecx, eax
:0047BA88 894DF4                  mov dword ptr [ebp-0C], ecx
:0047BA8B 8B55CC                  mov edx, dword ptr [ebp-34]
:0047BA8E 0355FC                  add edx, dword ptr [ebp-04]
:0047BA91 2B55F0                  sub edx, dword ptr [ebp-10]
:0047BA94 8B45F8                  mov eax, dword ptr [ebp-08]
:0047BA97 03C2                    add eax, edx
:0047BA99 8945F8                  mov dword ptr [ebp-08], eax
:0047BA9C 8B4DCC                  mov ecx, dword ptr [ebp-34]
:0047BA9F 034DFC                  add ecx, dword ptr [ebp-04]
:0047BAA2 894DF0                  mov dword ptr [ebp-10], ecx
:0047BAA5 8B5508                  mov edx, dword ptr [ebp+08]
:0047BAA8 8B45EC                  mov eax, dword ptr [ebp-14]
:0047BAAB 8902                    mov dword ptr [edx], eax
:0047BAAD 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047BAB0 894A04                  mov dword ptr [edx+04], ecx
:0047BAB3 8B45F4                  mov eax, dword ptr [ebp-0C]
:0047BAB6 894208                  mov dword ptr [edx+08], eax
:0047BAB9 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047BABC 894A0C                  mov dword ptr [edx+0C], ecx
:0047BABF 8B4508                  mov eax, dword ptr [ebp+08]
:0047BAC2 5E                      pop esi
:0047BAC3 8BE5                    mov esp, ebp
:0047BAC5 5D                      pop ebp
:0047BAC6 C3                      ret



* Referenced by a CALL at Addresses:
|:0047BBA9   , :0047BEE2   
|
:0047BAC7 55                      push ebp
:0047BAC8 8BEC                    mov ebp, esp
:0047BACA 83EC24                  sub esp, 00000024
:0047BACD 56                      push esi
:0047BACE 6A37                    push 00000037
:0047BAD0 FF157C624800            call dword ptr [0048627C]
:0047BAD6 8BF0                    mov esi, eax
:0047BAD8 6A04                    push 00000004
:0047BADA FF157C624800            call dword ptr [0048627C]
:0047BAE0 03F0                    add esi, eax
:0047BAE2 B950424B00              mov ecx, 004B4250
:0047BAE7 E8745FFDFF              call 00451A60
:0047BAEC 03F0                    add esi, eax
:0047BAEE 8975EC                  mov dword ptr [ebp-14], esi
:0047BAF1 6A01                    push 00000001
:0047BAF3 FF157C624800            call dword ptr [0048627C]
:0047BAF9 8945E8                  mov dword ptr [ebp-18], eax
:0047BAFC C745E470020000          mov [ebp-1C], 00000270
:0047BB03 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0047BB06 81C180010000            add ecx, 00000180
:0047BB0C 8B45E8                  mov eax, dword ptr [ebp-18]
:0047BB0F 2B45EC                  sub eax, dword ptr [ebp-14]
:0047BB12 99                      cdq
:0047BB13 BE30000000              mov esi, 00000030
:0047BB18 F7FE                    idiv esi
:0047BB1A 6BC030                  imul eax, 00000030
:0047BB1D 8B55EC                  mov edx, dword ptr [ebp-14]
:0047BB20 03D0                    add edx, eax
:0047BB22 3BCA                    cmp ecx, edx
:0047BB24 7D0D                    jge 0047BB33
:0047BB26 8B45EC                  mov eax, dword ptr [ebp-14]
:0047BB29 0580010000              add eax, 00000180
:0047BB2E 8945DC                  mov dword ptr [ebp-24], eax
:0047BB31 EB19                    jmp 0047BB4C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047BB24(C)
|
:0047BB33 8B45E8                  mov eax, dword ptr [ebp-18]
:0047BB36 2B45EC                  sub eax, dword ptr [ebp-14]
:0047BB39 99                      cdq
:0047BB3A B930000000              mov ecx, 00000030
:0047BB3F F7F9                    idiv ecx
:0047BB41 6BC030                  imul eax, 00000030
:0047BB44 8B55EC                  mov edx, dword ptr [ebp-14]
:0047BB47 03D0                    add edx, eax
:0047BB49 8955DC                  mov dword ptr [ebp-24], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047BB31(U)
|
:0047BB4C 8B45DC                  mov eax, dword ptr [ebp-24]
:0047BB4F 8945E0                  mov dword ptr [ebp-20], eax
:0047BB52 C745F000000000          mov [ebp-10], 00000000
:0047BB59 C745F400000000          mov [ebp-0C], 00000000
:0047BB60 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0047BB63 894DF8                  mov dword ptr [ebp-08], ecx
:0047BB66 8B55E0                  mov edx, dword ptr [ebp-20]
:0047BB69 8955FC                  mov dword ptr [ebp-04], edx
:0047BB6C 6A00                    push 00000000
:0047BB6E 6800003F02              push 023F0000
:0047BB73 8D45F0                  lea eax, dword ptr [ebp-10]
:0047BB76 50                      push eax
:0047BB77 FF15A4634800            call dword ptr [004863A4]
:0047BB7D 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047BB80 8B55F0                  mov edx, dword ptr [ebp-10]
:0047BB83 8911                    mov dword ptr [ecx], edx
:0047BB85 8B45F4                  mov eax, dword ptr [ebp-0C]
:0047BB88 894104                  mov dword ptr [ecx+04], eax
:0047BB8B 8B55F8                  mov edx, dword ptr [ebp-08]
:0047BB8E 895108                  mov dword ptr [ecx+08], edx
:0047BB91 8B45FC                  mov eax, dword ptr [ebp-04]
:0047BB94 89410C                  mov dword ptr [ecx+0C], eax
:0047BB97 8B4508                  mov eax, dword ptr [ebp+08]
:0047BB9A 5E                      pop esi
:0047BB9B 8BE5                    mov esp, ebp
:0047BB9D 5D                      pop ebp
:0047BB9E C3                      ret



* Referenced by a CALL at Addresses:
|:0044D2D2   , :0044D862   
|
:0047BB9F 55                      push ebp
:0047BBA0 8BEC                    mov ebp, esp
:0047BBA2 83EC30                  sub esp, 00000030
:0047BBA5 8D45D0                  lea eax, dword ptr [ebp-30]
:0047BBA8 50                      push eax
:0047BBA9 E819FFFFFF              call 0047BAC7
:0047BBAE 83C404                  add esp, 00000004
:0047BBB1 8B08                    mov ecx, dword ptr [eax]
:0047BBB3 894DE0                  mov dword ptr [ebp-20], ecx
:0047BBB6 8B5004                  mov edx, dword ptr [eax+04]
:0047BBB9 8955E4                  mov dword ptr [ebp-1C], edx
:0047BBBC 8B4808                  mov ecx, dword ptr [eax+08]
:0047BBBF 894DE8                  mov dword ptr [ebp-18], ecx
:0047BBC2 8B500C                  mov edx, dword ptr [eax+0C]
:0047BBC5 8955EC                  mov dword ptr [ebp-14], edx
:0047BBC8 8B45E0                  mov eax, dword ptr [ebp-20]
:0047BBCB 8945F0                  mov dword ptr [ebp-10], eax
:0047BBCE 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:0047BBD1 894DF4                  mov dword ptr [ebp-0C], ecx
:0047BBD4 8B55E8                  mov edx, dword ptr [ebp-18]
:0047BBD7 8955F8                  mov dword ptr [ebp-08], edx
:0047BBDA 8B45EC                  mov eax, dword ptr [ebp-14]
:0047BBDD 8945FC                  mov dword ptr [ebp-04], eax
:0047BBE0 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:0047BBE6 51                      push ecx
:0047BBE7 FF1554634800            call dword ptr [00486354]
:0047BBED 85C0                    test eax, eax
:0047BBEF 740F                    je 0047BC00
:0047BBF1 6A09                    push 00000009
:0047BBF3 8B15686A4B00            mov edx, dword ptr [004B6A68]
:0047BBF9 52                      push edx
:0047BBFA FF15E0624800            call dword ptr [004862E0]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047BBEF(C)
|
:0047BC00 6A62                    push 00000062
:0047BC02 8B45FC                  mov eax, dword ptr [ebp-04]
:0047BC05 2B45F4                  sub eax, dword ptr [ebp-0C]
:0047BC08 83C001                  add eax, 00000001
:0047BC0B 50                      push eax
:0047BC0C 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047BC0F 2B4DF0                  sub ecx, dword ptr [ebp-10]
:0047BC12 51                      push ecx
:0047BC13 6A00                    push 00000000
:0047BC15 6A00                    push 00000000
:0047BC17 6A00                    push 00000000
:0047BC19 8B15686A4B00            mov edx, dword ptr [004B6A68]
:0047BC1F 52                      push edx
:0047BC20 FF1580624800            call dword ptr [00486280]
:0047BC26 8B45F8                  mov eax, dword ptr [ebp-08]
:0047BC29 2B45F0                  sub eax, dword ptr [ebp-10]
:0047BC2C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047BC2F 2B4DF4                  sub ecx, dword ptr [ebp-0C]
:0047BC32 C1E108                  shl ecx, 08
:0047BC35 0BC1                    or eax, ecx
:0047BC37 50                      push eax
:0047BC38 6A00                    push 00000000
:0047BC3A 6A05                    push 00000005
:0047BC3C 8B158C6A4B00            mov edx, dword ptr [004B6A8C]
:0047BC42 52                      push edx
:0047BC43 FF15F4624800            call dword ptr [004862F4]

* Possible StringData Ref from Data Obj ->"־ܲٴ"
                                  |
:0047BC49 6848E84800              push 0048E848
:0047BC4E A1686A4B00              mov eax, dword ptr [004B6A68]
:0047BC53 50                      push eax
:0047BC54 FF1560634800            call dword ptr [00486360]
:0047BC5A 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:0047BC60 51                      push ecx
:0047BC61 FF15A8624800            call dword ptr [004862A8]
:0047BC67 8BE5                    mov esp, ebp
:0047BC69 5D                      pop ebp
:0047BC6A C3                      ret



* Referenced by a CALL at Addresses:
|:0044D2EA   , :0044D87A   
|
:0047BC6B 55                      push ebp
:0047BC6C 8BEC                    mov ebp, esp
:0047BC6E B801000000              mov eax, 00000001
:0047BC73 85C0                    test eax, eax
:0047BC75 740F                    je 0047BC86
:0047BC77 6A03                    push 00000003
:0047BC79 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:0047BC7F 51                      push ecx
:0047BC80 FF15E0624800            call dword ptr [004862E0]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047BC75(C)
|
:0047BC86 5D                      pop ebp
:0047BC87 C3                      ret



* Referenced by a CALL at Addresses:
|:00449DFC   , :00449E32   
|
:0047BC88 55                      push ebp
:0047BC89 8BEC                    mov ebp, esp
:0047BC8B 83EC08                  sub esp, 00000008
:0047BC8E 6AF0                    push FFFFFFF0
:0047BC90 A1686A4B00              mov eax, dword ptr [004B6A68]
:0047BC95 50                      push eax
:0047BC96 FF15A0634800            call dword ptr [004863A0]
:0047BC9C 8945F8                  mov dword ptr [ebp-08], eax
:0047BC9F 837D0800                cmp dword ptr [ebp+08], 00000000
:0047BCA3 7414                    je 0047BCB9
:0047BCA5 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047BCA8 81C900000100            or ecx, 00010000
:0047BCAE 81C900000200            or ecx, 00020000
:0047BCB4 894DF8                  mov dword ptr [ebp-08], ecx
:0047BCB7 EB12                    jmp 0047BCCB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047BCA3(C)
|
:0047BCB9 8B55F8                  mov edx, dword ptr [ebp-08]
:0047BCBC 81E2FFFFFEFF            and edx, FFFEFFFF
:0047BCC2 81E2FFFFFDFF            and edx, FFFDFFFF
:0047BCC8 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047BCB7(U)
|
:0047BCCB 8B45F8                  mov eax, dword ptr [ebp-08]
:0047BCCE 50                      push eax
:0047BCCF 6AF0                    push FFFFFFF0
:0047BCD1 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:0047BCD7 51                      push ecx
:0047BCD8 FF1550634800            call dword ptr [00486350]
:0047BCDE 8945FC                  mov dword ptr [ebp-04], eax
:0047BCE1 8B15686A4B00            mov edx, dword ptr [004B6A68]
:0047BCE7 52                      push edx
:0047BCE8 FF1554634800            call dword ptr [00486354]
:0047BCEE 85C0                    test eax, eax
:0047BCF0 7511                    jne 0047BD03
:0047BCF2 6848754B00              push 004B7548
:0047BCF7 A1686A4B00              mov eax, dword ptr [004B6A68]
:0047BCFC 50                      push eax
:0047BCFD FF1598634800            call dword ptr [00486398]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047BCF0(C)
|

* Possible StringData Ref from Data Obj ->"־ܲٴ"
                                  |
:0047BD03 6848E84800              push 0048E848
:0047BD08 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:0047BD0E 51                      push ecx
:0047BD0F FF1560634800            call dword ptr [00486360]
:0047BD15 8B15686A4B00            mov edx, dword ptr [004B6A68]
:0047BD1B 52                      push edx
:0047BD1C FF15A8624800            call dword ptr [004862A8]
:0047BD22 8BE5                    mov esp, ebp
:0047BD24 5D                      pop ebp
:0047BD25 C3                      ret



* Referenced by a CALL at Address:
|:00474F7B   
|
:0047BD26 55                      push ebp
:0047BD27 8BEC                    mov ebp, esp
:0047BD29 E88C3BFAFF              call 0041F8BA
:0047BD2E B9B8694B00              mov ecx, 004B69B8
:0047BD33 E8C387FFFF              call 004744FB
:0047BD38 B9B0694B00              mov ecx, 004B69B0
:0047BD3D E8DC89FFFF              call 0047471E
:0047BD42 B950424B00              mov ecx, 004B4250
:0047BD47 E8F8A0FDFF              call 00455E44
:0047BD4C 50                      push eax
:0047BD4D B950424B00              mov ecx, 004B4250
:0047BD52 E84CA1FDFF              call 00455EA3
:0047BD57 B950424B00              mov ecx, 004B4250
:0047BD5C E80AA1FDFF              call 00455E6B
:0047BD61 50                      push eax
:0047BD62 B950424B00              mov ecx, 004B4250
:0047BD67 E85EA1FDFF              call 00455ECA
:0047BD6C 5D                      pop ebp
:0047BD6D C3                      ret



* Referenced by a CALL at Address:
|:00474FB2   
|
:0047BD6E 55                      push ebp
:0047BD6F 8BEC                    mov ebp, esp
:0047BD71 B950424B00              mov ecx, 004B4250
:0047BD76 E8C9A0FDFF              call 00455E44
:0047BD7B 50                      push eax
:0047BD7C B950424B00              mov ecx, 004B4250
:0047BD81 E81DA1FDFF              call 00455EA3
:0047BD86 B950424B00              mov ecx, 004B4250
:0047BD8B E8DBA0FDFF              call 00455E6B
:0047BD90 50                      push eax
:0047BD91 B950424B00              mov ecx, 004B4250
:0047BD96 E82FA1FDFF              call 00455ECA
:0047BD9B 5D                      pop ebp
:0047BD9C C3                      ret



* Referenced by a CALL at Address:
|:00474FC0   
|
:0047BD9D 55                      push ebp
:0047BD9E 8BEC                    mov ebp, esp
:0047BDA0 B950424B00              mov ecx, 004B4250
:0047BDA5 E8E8A0FDFF              call 00455E92
:0047BDAA 50                      push eax
:0047BDAB B950424B00              mov ecx, 004B4250
:0047BDB0 E8A0A0FDFF              call 00455E55
:0047BDB5 B950424B00              mov ecx, 004B4250
:0047BDBA E8FAA0FDFF              call 00455EB9
:0047BDBF 50                      push eax
:0047BDC0 B950424B00              mov ecx, 004B4250
:0047BDC5 E8B2A0FDFF              call 00455E7C
:0047BDCA B9B0694B00              mov ecx, 004B69B0
:0047BDCF E86889FFFF              call 0047473C
:0047BDD4 B9B8694B00              mov ecx, 004B69B8
:0047BDD9 E83887FFFF              call 00474516
:0047BDDE E8E63AFAFF              call 0041F8C9
:0047BDE3 5D                      pop ebp
:0047BDE4 C3                      ret



* Referenced by a CALL at Address:
|:004750AA   
|
:0047BDE5 55                      push ebp
:0047BDE6 8BEC                    mov ebp, esp
:0047BDE8 83EC64                  sub esp, 00000064
:0047BDEB C745F000000000          mov [ebp-10], 00000000
:0047BDF2 C745F400000000          mov [ebp-0C], 00000000
:0047BDF9 B950424B00              mov ecx, 004B4250
:0047BDFE E8809FFDFF              call 00455D83
:0047BE03 85C0                    test eax, eax
:0047BE05 0F8598000000            jne 0047BEA3
:0047BE0B B950424B00              mov ecx, 004B4250
:0047BE10 E82FA0FDFF              call 00455E44
:0047BE15 83E801                  sub eax, 00000001
:0047BE18 8945F8                  mov dword ptr [ebp-08], eax
:0047BE1B B950424B00              mov ecx, 004B4250
:0047BE20 E846A0FDFF              call 00455E6B
:0047BE25 83E801                  sub eax, 00000001
:0047BE28 8945FC                  mov dword ptr [ebp-04], eax
:0047BE2B 6A01                    push 00000001
:0047BE2D 6AF0                    push FFFFFFF0
:0047BE2F 8B4508                  mov eax, dword ptr [ebp+08]
:0047BE32 50                      push eax
:0047BE33 FF15A0634800            call dword ptr [004863A0]
:0047BE39 50                      push eax
:0047BE3A 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0047BE3D 51                      push ecx
:0047BE3E FF15A4634800            call dword ptr [004863A4]
:0047BE44 8B550C                  mov edx, dword ptr [ebp+0C]
:0047BE47 8955EC                  mov dword ptr [ebp-14], edx
:0047BE4A 8B45F8                  mov eax, dword ptr [ebp-08]
:0047BE4D 2B45F0                  sub eax, dword ptr [ebp-10]
:0047BE50 83C001                  add eax, 00000001
:0047BE53 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0047BE56 894118                  mov dword ptr [ecx+18], eax
:0047BE59 8B55FC                  mov edx, dword ptr [ebp-04]
:0047BE5C 2B55F4                  sub edx, dword ptr [ebp-0C]
:0047BE5F 83C201                  add edx, 00000001
:0047BE62 8B45EC                  mov eax, dword ptr [ebp-14]
:0047BE65 89501C                  mov dword ptr [eax+1C], edx
:0047BE68 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047BE6B 2B4DF0                  sub ecx, dword ptr [ebp-10]
:0047BE6E 83C101                  add ecx, 00000001
:0047BE71 8B55EC                  mov edx, dword ptr [ebp-14]
:0047BE74 894A08                  mov dword ptr [edx+08], ecx
:0047BE77 8B45FC                  mov eax, dword ptr [ebp-04]
:0047BE7A 2B45F4                  sub eax, dword ptr [ebp-0C]
:0047BE7D 83C001                  add eax, 00000001
:0047BE80 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0047BE83 89410C                  mov dword ptr [ecx+0C], eax
:0047BE86 8B55EC                  mov edx, dword ptr [ebp-14]
:0047BE89 8B45EC                  mov eax, dword ptr [ebp-14]
:0047BE8C 8B4808                  mov ecx, dword ptr [eax+08]
:0047BE8F 894A20                  mov dword ptr [edx+20], ecx
:0047BE92 8B55EC                  mov edx, dword ptr [ebp-14]
:0047BE95 8B45EC                  mov eax, dword ptr [ebp-14]
:0047BE98 8B480C                  mov ecx, dword ptr [eax+0C]
:0047BE9B 894A24                  mov dword ptr [edx+24], ecx
:0047BE9E E9DC000000              jmp 0047BF7F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047BE05(C)
|
:0047BEA3 8D55BC                  lea edx, dword ptr [ebp-44]
:0047BEA6 52                      push edx
:0047BEA7 E8AEF8FFFF              call 0047B75A
:0047BEAC 83C404                  add esp, 00000004
:0047BEAF 8B08                    mov ecx, dword ptr [eax]
:0047BEB1 894DCC                  mov dword ptr [ebp-34], ecx
:0047BEB4 8B5004                  mov edx, dword ptr [eax+04]
:0047BEB7 8955D0                  mov dword ptr [ebp-30], edx
:0047BEBA 8B4808                  mov ecx, dword ptr [eax+08]
:0047BEBD 894DD4                  mov dword ptr [ebp-2C], ecx
:0047BEC0 8B500C                  mov edx, dword ptr [eax+0C]
:0047BEC3 8955D8                  mov dword ptr [ebp-28], edx
:0047BEC6 8B45CC                  mov eax, dword ptr [ebp-34]
:0047BEC9 8945F0                  mov dword ptr [ebp-10], eax
:0047BECC 8B4DD0                  mov ecx, dword ptr [ebp-30]
:0047BECF 894DF4                  mov dword ptr [ebp-0C], ecx
:0047BED2 8B55D4                  mov edx, dword ptr [ebp-2C]
:0047BED5 8955F8                  mov dword ptr [ebp-08], edx
:0047BED8 8B45D8                  mov eax, dword ptr [ebp-28]
:0047BEDB 8945FC                  mov dword ptr [ebp-04], eax
:0047BEDE 8D4D9C                  lea ecx, dword ptr [ebp-64]
:0047BEE1 51                      push ecx
:0047BEE2 E8E0FBFFFF              call 0047BAC7
:0047BEE7 83C404                  add esp, 00000004
:0047BEEA 8B10                    mov edx, dword ptr [eax]
:0047BEEC 8955AC                  mov dword ptr [ebp-54], edx
:0047BEEF 8B4804                  mov ecx, dword ptr [eax+04]
:0047BEF2 894DB0                  mov dword ptr [ebp-50], ecx
:0047BEF5 8B5008                  mov edx, dword ptr [eax+08]
:0047BEF8 8955B4                  mov dword ptr [ebp-4C], edx
:0047BEFB 8B400C                  mov eax, dword ptr [eax+0C]
:0047BEFE 8945B8                  mov dword ptr [ebp-48], eax
:0047BF01 8B4DAC                  mov ecx, dword ptr [ebp-54]
:0047BF04 894DDC                  mov dword ptr [ebp-24], ecx
:0047BF07 8B55B0                  mov edx, dword ptr [ebp-50]
:0047BF0A 8955E0                  mov dword ptr [ebp-20], edx
:0047BF0D 8B45B4                  mov eax, dword ptr [ebp-4C]
:0047BF10 8945E4                  mov dword ptr [ebp-1C], eax
:0047BF13 8B4DB8                  mov ecx, dword ptr [ebp-48]
:0047BF16 894DE8                  mov dword ptr [ebp-18], ecx
:0047BF19 8B550C                  mov edx, dword ptr [ebp+0C]
:0047BF1C 8955EC                  mov dword ptr [ebp-14], edx
:0047BF1F 8B45E4                  mov eax, dword ptr [ebp-1C]
:0047BF22 2B45DC                  sub eax, dword ptr [ebp-24]
:0047BF25 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0047BF28 894118                  mov dword ptr [ecx+18], eax
:0047BF2B 8B55E8                  mov edx, dword ptr [ebp-18]
:0047BF2E 2B55E0                  sub edx, dword ptr [ebp-20]
:0047BF31 83C201                  add edx, 00000001
:0047BF34 8B45EC                  mov eax, dword ptr [ebp-14]
:0047BF37 89501C                  mov dword ptr [eax+1C], edx
:0047BF3A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047BF3D 2B4DF0                  sub ecx, dword ptr [ebp-10]
:0047BF40 8B55EC                  mov edx, dword ptr [ebp-14]
:0047BF43 894A08                  mov dword ptr [edx+08], ecx
:0047BF46 8B45FC                  mov eax, dword ptr [ebp-04]
:0047BF49 2B45F4                  sub eax, dword ptr [ebp-0C]
:0047BF4C 83C001                  add eax, 00000001
:0047BF4F 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0047BF52 89410C                  mov dword ptr [ecx+0C], eax
:0047BF55 8B55EC                  mov edx, dword ptr [ebp-14]
:0047BF58 8B45F0                  mov eax, dword ptr [ebp-10]
:0047BF5B 894210                  mov dword ptr [edx+10], eax
:0047BF5E 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0047BF61 8B55F4                  mov edx, dword ptr [ebp-0C]
:0047BF64 895114                  mov dword ptr [ecx+14], edx
:0047BF67 8B45EC                  mov eax, dword ptr [ebp-14]
:0047BF6A 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0047BF6D 8B5108                  mov edx, dword ptr [ecx+08]
:0047BF70 895020                  mov dword ptr [eax+20], edx
:0047BF73 8B45EC                  mov eax, dword ptr [ebp-14]
:0047BF76 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0047BF79 8B510C                  mov edx, dword ptr [ecx+0C]
:0047BF7C 895024                  mov dword ptr [eax+24], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047BE9E(U)
|
:0047BF7F 8BE5                    mov esp, ebp
:0047BF81 5D                      pop ebp
:0047BF82 C3                      ret



* Referenced by a CALL at Address:
|:00475078   
|
:0047BF83 55                      push ebp
:0047BF84 8BEC                    mov ebp, esp
:0047BF86 83EC18                  sub esp, 00000018
:0047BF89 8B4510                  mov eax, dword ptr [ebp+10]
:0047BF8C 50                      push eax
:0047BF8D 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0047BF90 51                      push ecx
:0047BF91 6A05                    push 00000005
:0047BF93 8B158C6A4B00            mov edx, dword ptr [004B6A8C]
:0047BF99 52                      push edx
:0047BF9A FF15F4624800            call dword ptr [004862F4]
:0047BFA0 B950424B00              mov ecx, 004B4250
:0047BFA5 E8D99DFDFF              call 00455D83
:0047BFAA 85C0                    test eax, eax
:0047BFAC 0F8433010000            je 0047C0E5
:0047BFB2 B950424B00              mov ecx, 004B4250
:0047BFB7 E8DB7EFDFF              call 00453E97
:0047BFBC 85C0                    test eax, eax
:0047BFBE 740A                    je 0047BFCA
:0047BFC0 B950424B00              mov ecx, 004B4250
:0047BFC5 E8687EFDFF              call 00453E32

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047BFBE(C)
|
:0047BFCA 8B4510                  mov eax, dword ptr [ebp+10]
:0047BFCD 25FFFF0000              and eax, 0000FFFF
:0047BFD2 8945EC                  mov dword ptr [ebp-14], eax
:0047BFD5 8B4D10                  mov ecx, dword ptr [ebp+10]
:0047BFD8 C1E910                  shr ecx, 10
:0047BFDB 81E1FFFF0000            and ecx, 0000FFFF
:0047BFE1 81E1FFFF0000            and ecx, 0000FFFF
:0047BFE7 894DE8                  mov dword ptr [ebp-18], ecx
:0047BFEA 8B55EC                  mov edx, dword ptr [ebp-14]
:0047BFED 52                      push edx
:0047BFEE B950424B00              mov ecx, 004B4250
:0047BFF3 E85D9EFDFF              call 00455E55
:0047BFF8 B950424B00              mov ecx, 004B4250
:0047BFFD E85E5AFDFF              call 00451A60
:0047C002 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0047C005 2BC8                    sub ecx, eax
:0047C007 51                      push ecx
:0047C008 B950424B00              mov ecx, 004B4250
:0047C00D E86A9EFDFF              call 00455E7C
:0047C012 B950424B00              mov ecx, 004B4250
:0047C017 E8609FFDFF              call 00455F7C
:0047C01C 8945F8                  mov dword ptr [ebp-08], eax
:0047C01F B950424B00              mov ecx, 004B4250
:0047C024 E87A9FFDFF              call 00455FA3
:0047C029 8945FC                  mov dword ptr [ebp-04], eax
:0047C02C B950424B00              mov ecx, 004B4250
:0047C031 E8729DFDFF              call 00455DA8
:0047C036 8945F4                  mov dword ptr [ebp-0C], eax
:0047C039 8B55F4                  mov edx, dword ptr [ebp-0C]
:0047C03C 0355EC                  add edx, dword ptr [ebp-14]
:0047C03F 3B55F8                  cmp edx, dword ptr [ebp-08]
:0047C042 7E1F                    jle 0047C063
:0047C044 8B45F4                  mov eax, dword ptr [ebp-0C]
:0047C047 0345EC                  add eax, dword ptr [ebp-14]
:0047C04A 2B45F8                  sub eax, dword ptr [ebp-08]
:0047C04D 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047C050 2BC8                    sub ecx, eax
:0047C052 894DF4                  mov dword ptr [ebp-0C], ecx
:0047C055 8B55F4                  mov edx, dword ptr [ebp-0C]
:0047C058 52                      push edx
:0047C059 B950424B00              mov ecx, 004B4250
:0047C05E E8569DFDFF              call 00455DB9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047C042(C)
|
:0047C063 B950424B00              mov ecx, 004B4250
:0047C068 E8629DFDFF              call 00455DCF
:0047C06D 8945F0                  mov dword ptr [ebp-10], eax
:0047C070 8B45E8                  mov eax, dword ptr [ebp-18]
:0047C073 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047C076 8D5401C8                lea edx, dword ptr [ecx+eax-38]
:0047C07A 3B55FC                  cmp edx, dword ptr [ebp-04]
:0047C07D 7E1C                    jle 0047C09B
:0047C07F 8B45E8                  mov eax, dword ptr [ebp-18]
:0047C082 83E838                  sub eax, 00000038
:0047C085 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047C088 2BC8                    sub ecx, eax
:0047C08A 894DF0                  mov dword ptr [ebp-10], ecx
:0047C08D 8B55F0                  mov edx, dword ptr [ebp-10]
:0047C090 52                      push edx
:0047C091 B950424B00              mov ecx, 004B4250
:0047C096 E8459DFDFF              call 00455DE0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047C07D(C)
|
:0047C09B 6A00                    push 00000000
:0047C09D B950424B00              mov ecx, 004B4250
:0047C0A2 E8289DFDFF              call 00455DCF
:0047C0A7 99                      cdq
:0047C0A8 B930000000              mov ecx, 00000030
:0047C0AD F7F9                    idiv ecx
:0047C0AF 50                      push eax
:0047C0B0 B950424B00              mov ecx, 004B4250
:0047C0B5 E8EE9CFDFF              call 00455DA8
:0047C0BA 99                      cdq
:0047C0BB B930000000              mov ecx, 00000030
:0047C0C0 F7F9                    idiv ecx
:0047C0C2 50                      push eax
:0047C0C3 B950424B00              mov ecx, 004B4250
:0047C0C8 E8B18AFDFF              call 00454B7E
:0047C0CD 6A01                    push 00000001
:0047C0CF 6A00                    push 00000000
:0047C0D1 8B5508                  mov edx, dword ptr [ebp+08]
:0047C0D4 52                      push edx
:0047C0D5 FF15A4624800            call dword ptr [004862A4]
:0047C0DB 8B4508                  mov eax, dword ptr [ebp+08]
:0047C0DE 50                      push eax
:0047C0DF FF15A8624800            call dword ptr [004862A8]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047BFAC(C)
|
:0047C0E5 8BE5                    mov esp, ebp
:0047C0E7 5D                      pop ebp
:0047C0E8 C3                      ret



* Referenced by a CALL at Addresses:
|:0041C035   , :00474BCB   
|
:0047C0E9 55                      push ebp
:0047C0EA 8BEC                    mov ebp, esp
:0047C0EC A1DC5F4B00              mov eax, dword ptr [004B5FDC]
:0047C0F1 50                      push eax
:0047C0F2 FF15C8624800            call dword ptr [004862C8]
:0047C0F8 85C0                    test eax, eax
:0047C0FA 740F                    je 0047C10B
:0047C0FC 6A00                    push 00000000
:0047C0FE 8B0DDC5F4B00            mov ecx, dword ptr [004B5FDC]
:0047C104 51                      push ecx
:0047C105 FF15E0624800            call dword ptr [004862E0]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047C0FA(C)
|
:0047C10B 8B15D85F4B00            mov edx, dword ptr [004B5FD8]
:0047C111 52                      push edx
:0047C112 FF15C8624800            call dword ptr [004862C8]
:0047C118 85C0                    test eax, eax
:0047C11A 7418                    je 0047C134
:0047C11C 6A00                    push 00000000
:0047C11E 68BD9C0000              push 00009CBD
:0047C123 6811010000              push 00000111
:0047C128 A1D85F4B00              mov eax, dword ptr [004B5FD8]
:0047C12D 50                      push eax
:0047C12E FF15F4624800            call dword ptr [004862F4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047C11A(C)
|
:0047C134 8B0D08754B00            mov ecx, dword ptr [004B7508]
:0047C13A 51                      push ecx
:0047C13B FF15C8624800            call dword ptr [004862C8]
:0047C141 85C0                    test eax, eax
:0047C143 740F                    je 0047C154
:0047C145 6A00                    push 00000000
:0047C147 8B1508754B00            mov edx, dword ptr [004B7508]
:0047C14D 52                      push edx
:0047C14E FF15E0624800            call dword ptr [004862E0]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047C143(C)
|
:0047C154 5D                      pop ebp
:0047C155 C3                      ret



* Referenced by a CALL at Addresses:
|:0042B869   , :00454750   
|
:0047C156 55                      push ebp
:0047C157 8BEC                    mov ebp, esp
:0047C159 83EC1C                  sub esp, 0000001C
:0047C15C C745FC00000000          mov [ebp-04], 00000000
:0047C163 A1686A4B00              mov eax, dword ptr [004B6A68]
:0047C168 50                      push eax
:0047C169 B9B07F4900              mov ecx, 00497FB0
:0047C16E E86AA0FAFF              call 004261DD
:0047C173 8B08                    mov ecx, dword ptr [eax]
:0047C175 8B5004                  mov edx, dword ptr [eax+04]
:0047C178 894DF4                  mov dword ptr [ebp-0C], ecx
:0047C17B 8955F8                  mov dword ptr [ebp-08], edx
:0047C17E 8D45F4                  lea eax, dword ptr [ebp-0C]
:0047C181 50                      push eax
:0047C182 8B0D686A4B00            mov ecx, dword ptr [004B6A68]
:0047C188 51                      push ecx
:0047C189 FF1520634800            call dword ptr [00486320]
:0047C18F 8D55E4                  lea edx, dword ptr [ebp-1C]
:0047C192 52                      push edx
:0047C193 A1686A4B00              mov eax, dword ptr [004B6A68]
:0047C198 50                      push eax
:0047C199 FF1598634800            call dword ptr [00486398]
:0047C19F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047C1A2 3B4DE4                  cmp ecx, dword ptr [ebp-1C]
:0047C1A5 7C18                    jl 0047C1BF
:0047C1A7 8B55F4                  mov edx, dword ptr [ebp-0C]
:0047C1AA 3B55EC                  cmp edx, dword ptr [ebp-14]
:0047C1AD 7F10                    jg 0047C1BF
:0047C1AF 8B45F8                  mov eax, dword ptr [ebp-08]
:0047C1B2 3B45E8                  cmp eax, dword ptr [ebp-18]
:0047C1B5 7C08                    jl 0047C1BF
:0047C1B7 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047C1BA 3B4DF0                  cmp ecx, dword ptr [ebp-10]
:0047C1BD 7E08                    jle 0047C1C7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047C1A5(C), :0047C1AD(C), :0047C1B5(C)
|
:0047C1BF 8B45FC                  mov eax, dword ptr [ebp-04]
:0047C1C2 E994000000              jmp 0047C25B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047C1BD(C)
|
:0047C1C7 8B15D85F4B00            mov edx, dword ptr [004B5FD8]
:0047C1CD 52                      push edx
:0047C1CE FF15C8624800            call dword ptr [004862C8]
:0047C1D4 85C0                    test eax, eax
:0047C1D6 7438                    je 0047C210
:0047C1D8 8D45E4                  lea eax, dword ptr [ebp-1C]
:0047C1DB 50                      push eax
:0047C1DC 8B0DD85F4B00            mov ecx, dword ptr [004B5FD8]
:0047C1E2 51                      push ecx
:0047C1E3 FF1598634800            call dword ptr [00486398]
:0047C1E9 8B55F4                  mov edx, dword ptr [ebp-0C]
:0047C1EC 3B55E4                  cmp edx, dword ptr [ebp-1C]
:0047C1EF 7C1F                    jl 0047C210
:0047C1F1 8B45F4                  mov eax, dword ptr [ebp-0C]
:0047C1F4 3B45EC                  cmp eax, dword ptr [ebp-14]
:0047C1F7 7F17                    jg 0047C210
:0047C1F9 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047C1FC 3B4DE8                  cmp ecx, dword ptr [ebp-18]
:0047C1FF 7C0F                    jl 0047C210
:0047C201 8B55F8                  mov edx, dword ptr [ebp-08]
:0047C204 3B55F0                  cmp edx, dword ptr [ebp-10]
:0047C207 7F07                    jg 0047C210
:0047C209 C745FC01000000          mov [ebp-04], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047C1D6(C), :0047C1EF(C), :0047C1F7(C), :0047C1FF(C), :0047C207(C)
|
:0047C210 A108754B00              mov eax, dword ptr [004B7508]
:0047C215 50                      push eax
:0047C216 FF15C8624800            call dword ptr [004862C8]
:0047C21C 85C0                    test eax, eax
:0047C21E 7438                    je 0047C258
:0047C220 8D4DE4                  lea ecx, dword ptr [ebp-1C]
:0047C223 51                      push ecx
:0047C224 8B1508754B00            mov edx, dword ptr [004B7508]
:0047C22A 52                      push edx
:0047C22B FF1598634800            call dword ptr [00486398]
:0047C231 8B45F4                  mov eax, dword ptr [ebp-0C]
:0047C234 3B45E4                  cmp eax, dword ptr [ebp-1C]
:0047C237 7C1F                    jl 0047C258
:0047C239 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047C23C 3B4DEC                  cmp ecx, dword ptr [ebp-14]
:0047C23F 7F17                    jg 0047C258
:0047C241 8B55F8                  mov edx, dword ptr [ebp-08]
:0047C244 3B55E8                  cmp edx, dword ptr [ebp-18]
:0047C247 7C0F                    jl 0047C258
:0047C249 8B45F8                  mov eax, dword ptr [ebp-08]
:0047C24C 3B45F0                  cmp eax, dword ptr [ebp-10]
:0047C24F 7F07                    jg 0047C258
:0047C251 C745FC01000000          mov [ebp-04], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047C21E(C), :0047C237(C), :0047C23F(C), :0047C247(C), :0047C24F(C)
|
:0047C258 8B45FC                  mov eax, dword ptr [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047C1C2(U)
|
:0047C25B 8BE5                    mov esp, ebp
:0047C25D 5D                      pop ebp
:0047C25E C3                      ret


:0047C25F CC                      int 03

* Referenced by a CALL at Address:
|:0047C4E4   
|
:0047C260 55                      push ebp
:0047C261 8BEC                    mov ebp, esp
:0047C263 51                      push ecx
:0047C264 894DFC                  mov dword ptr [ebp-04], ecx
:0047C267 8B45FC                  mov eax, dword ptr [ebp-04]
:0047C26A C7401400000000          mov [eax+14], 00000000
:0047C271 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047C274 C7411000000000          mov [ecx+10], 00000000
:0047C27B 8B55FC                  mov edx, dword ptr [ebp-04]
:0047C27E C7420C00000000          mov [edx+0C], 00000000
:0047C285 8B45FC                  mov eax, dword ptr [ebp-04]
:0047C288 C7400800000000          mov [eax+08], 00000000
:0047C28F 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047C292 C70100000000            mov dword ptr [ecx], 00000000
:0047C298 8B45FC                  mov eax, dword ptr [ebp-04]
:0047C29B 8BE5                    mov esp, ebp
:0047C29D 5D                      pop ebp
:0047C29E C3                      ret



* Referenced by a CALL at Address:
|:0047C518   
|
:0047C29F 55                      push ebp
:0047C2A0 8BEC                    mov ebp, esp
:0047C2A2 51                      push ecx
:0047C2A3 894DFC                  mov dword ptr [ebp-04], ecx
:0047C2A6 8BE5                    mov esp, ebp
:0047C2A8 5D                      pop ebp
:0047C2A9 C3                      ret



* Referenced by a CALL at Address:
|:0047C5F0   
|
:0047C2AA 55                      push ebp
:0047C2AB 8BEC                    mov ebp, esp
:0047C2AD 51                      push ecx
:0047C2AE 894DFC                  mov dword ptr [ebp-04], ecx
:0047C2B1 8B45FC                  mov eax, dword ptr [ebp-04]
:0047C2B4 83C004                  add eax, 00000004
:0047C2B7 50                      push eax
:0047C2B8 6A04                    push 00000004
:0047C2BA 6A00                    push 00000000
:0047C2BC 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047C2BF 51                      push ecx
:0047C2C0 6A00                    push 00000000
:0047C2C2 6A00                    push 00000000
:0047C2C4 FF153C614800            call dword ptr [0048613C]
:0047C2CA 8B55FC                  mov edx, dword ptr [ebp-04]
:0047C2CD 8902                    mov dword ptr [edx], eax
:0047C2CF 8B45FC                  mov eax, dword ptr [ebp-04]
:0047C2D2 833800                  cmp dword ptr [eax], 00000000
:0047C2D5 750C                    jne 0047C2E3
:0047C2D7 6A01                    push 00000001
:0047C2D9 E812F3FAFF              call 0042B5F0
:0047C2DE 83C404                  add esp, 00000004
:0047C2E1 EB16                    jmp 0047C2F9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047C2D5(C)
|
:0047C2E3 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0047C2E6 51                      push ecx
:0047C2E7 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047C2EA E810000000              call 0047C2FF
:0047C2EF 8B55FC                  mov edx, dword ptr [ebp-04]
:0047C2F2 C7420800000000          mov [edx+08], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047C2E1(U)
|
:0047C2F9 8BE5                    mov esp, ebp
:0047C2FB 5D                      pop ebp
:0047C2FC C20800                  ret 0008



* Referenced by a CALL at Address:
|:0047C2EA   
|
:0047C2FF 55                      push ebp
:0047C300 8BEC                    mov ebp, esp
:0047C302 51                      push ecx
:0047C303 894DFC                  mov dword ptr [ebp-04], ecx
:0047C306 8B4508                  mov eax, dword ptr [ebp+08]
:0047C309 50                      push eax
:0047C30A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047C30D 8B11                    mov edx, dword ptr [ecx]
:0047C30F 52                      push edx
:0047C310 FF1534614800            call dword ptr [00486134]
:0047C316 85C0                    test eax, eax
:0047C318 750A                    jne 0047C324
:0047C31A 6A01                    push 00000001
:0047C31C E8CFF2FAFF              call 0042B5F0
:0047C321 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047C318(C)
|
:0047C324 8BE5                    mov esp, ebp
:0047C326 5D                      pop ebp
:0047C327 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:0047C52B   , :0047C5BE   
|
:0047C32A 55                      push ebp
:0047C32B 8BEC                    mov ebp, esp
:0047C32D 83EC08                  sub esp, 00000008
:0047C330 894DF8                  mov dword ptr [ebp-08], ecx
:0047C333 8B45F8                  mov eax, dword ptr [ebp-08]
:0047C336 833800                  cmp dword ptr [eax], 00000000
:0047C339 7507                    jne 0047C342
:0047C33B B801000000              mov eax, 00000001
:0047C340 EB22                    jmp 0047C364

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047C339(C)
|
:0047C342 8D4DFC                  lea ecx, dword ptr [ebp-04]
:0047C345 51                      push ecx
:0047C346 8B55F8                  mov edx, dword ptr [ebp-08]
:0047C349 8B02                    mov eax, dword ptr [edx]
:0047C34B 50                      push eax
:0047C34C FF1548614800            call dword ptr [00486148]
:0047C352 817DFC03010000          cmp dword ptr [ebp-04], 00000103
:0047C359 7504                    jne 0047C35F
:0047C35B 33C0                    xor eax, eax
:0047C35D EB05                    jmp 0047C364

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047C359(C)
|
:0047C35F B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047C340(U), :0047C35D(U)
|
:0047C364 8BE5                    mov esp, ebp
:0047C366 5D                      pop ebp
:0047C367 C3                      ret


:0047C368 55                      push ebp
:0047C369 8BEC                    mov ebp, esp
:0047C36B 51                      push ecx
:0047C36C 894DFC                  mov dword ptr [ebp-04], ecx
:0047C36F 8B45FC                  mov eax, dword ptr [ebp-04]
:0047C372 833800                  cmp dword ptr [eax], 00000000
:0047C375 741F                    je 0047C396
:0047C377 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047C37A 83790800                cmp dword ptr [ecx+08], 00000000
:0047C37E 7416                    je 0047C396
:0047C380 8B55FC                  mov edx, dword ptr [ebp-04]
:0047C383 8B02                    mov eax, dword ptr [edx]
:0047C385 50                      push eax
:0047C386 FF15E4604800            call dword ptr [004860E4]
:0047C38C 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047C38F C7410800000000          mov [ecx+08], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047C375(C), :0047C37E(C)
|
:0047C396 8BE5                    mov esp, ebp
:0047C398 5D                      pop ebp
:0047C399 C3                      ret



* Referenced by a CALL at Address:
|:0047C5F8   
|
:0047C39A 55                      push ebp
:0047C39B 8BEC                    mov ebp, esp
:0047C39D 51                      push ecx
:0047C39E 894DFC                  mov dword ptr [ebp-04], ecx
:0047C3A1 8B45FC                  mov eax, dword ptr [ebp-04]
:0047C3A4 833800                  cmp dword ptr [eax], 00000000
:0047C3A7 741F                    je 0047C3C8
:0047C3A9 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047C3AC 83790800                cmp dword ptr [ecx+08], 00000000
:0047C3B0 7516                    jne 0047C3C8
:0047C3B2 8B55FC                  mov edx, dword ptr [ebp-04]
:0047C3B5 8B02                    mov eax, dword ptr [edx]
:0047C3B7 50                      push eax
:0047C3B8 FF15D8604800            call dword ptr [004860D8]
:0047C3BE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047C3C1 C7410801000000          mov [ecx+08], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047C3A7(C), :0047C3B0(C)
|
:0047C3C8 8BE5                    mov esp, ebp
:0047C3CA 5D                      pop ebp
:0047C3CB C3                      ret


:0047C3CC 55                      push ebp
:0047C3CD 8BEC                    mov ebp, esp
:0047C3CF 51                      push ecx
:0047C3D0 894DFC                  mov dword ptr [ebp-04], ecx
:0047C3D3 8B45FC                  mov eax, dword ptr [ebp-04]
:0047C3D6 83780C00                cmp dword ptr [eax+0C], 00000000
:0047C3DA 7427                    je 0047C403
:0047C3DC 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047C3DF C7410800000000          mov [ecx+08], 00000000
:0047C3E6 8B55FC                  mov edx, dword ptr [ebp-04]
:0047C3E9 C7420C00000000          mov [edx+0C], 00000000
:0047C3F0 8B45FC                  mov eax, dword ptr [ebp-04]
:0047C3F3 C70000000000            mov dword ptr [eax], 00000000
:0047C3F9 6A00                    push 00000000
:0047C3FB FF1540614800            call dword ptr [00486140]
:0047C401 EB2D                    jmp 0047C430

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047C3DA(C)
|
:0047C403 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047C406 83791000                cmp dword ptr [ecx+10], 00000000
:0047C40A 7424                    je 0047C430
:0047C40C 8B55FC                  mov edx, dword ptr [ebp-04]
:0047C40F C7421401000000          mov [edx+14], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047C424(U)
|
:0047C416 8B45FC                  mov eax, dword ptr [ebp-04]
:0047C419 83781000                cmp dword ptr [eax+10], 00000000
:0047C41D 7407                    je 0047C426
:0047C41F E8A0260000              call 0047EAC4
:0047C424 EBF0                    jmp 0047C416

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047C41D(C)
|
:0047C426 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047C429 C7411400000000          mov [ecx+14], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047C401(U), :0047C40A(C)
|
:0047C430 8BE5                    mov esp, ebp
:0047C432 5D                      pop ebp
:0047C433 C3                      ret



* Referenced by a CALL at Address:
|:0047C48D   
|
:0047C434 55                      push ebp
:0047C435 8BEC                    mov ebp, esp
:0047C437 51                      push ecx
:0047C438 894DFC                  mov dword ptr [ebp-04], ecx
:0047C43B 8B45FC                  mov eax, dword ptr [ebp-04]
:0047C43E 833800                  cmp dword ptr [eax], 00000000
:0047C441 7421                    je 0047C464
:0047C443 6A00                    push 00000000
:0047C445 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047C448 8B11                    mov edx, dword ptr [ecx]
:0047C44A 52                      push edx
:0047C44B FF15DC604800            call dword ptr [004860DC]
:0047C451 8B45FC                  mov eax, dword ptr [ebp-04]
:0047C454 C70000000000            mov dword ptr [eax], 00000000
:0047C45A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047C45D C7410800000000          mov [ecx+08], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047C441(C)
|
:0047C464 8BE5                    mov esp, ebp
:0047C466 5D                      pop ebp
:0047C467 C3                      ret


:0047C468 55                      push ebp
:0047C469 8BEC                    mov ebp, esp
:0047C46B 51                      push ecx
:0047C46C 894DFC                  mov dword ptr [ebp-04], ecx
:0047C46F 8B45FC                  mov eax, dword ptr [ebp-04]
:0047C472 833800                  cmp dword ptr [eax], 00000000
:0047C475 742A                    je 0047C4A1
:0047C477 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047C47A C7410C01000000          mov [ecx+0C], 00000001
:0047C481 8B55FC                  mov edx, dword ptr [ebp-04]
:0047C484 837A0800                cmp dword ptr [edx+08], 00000000
:0047C488 7508                    jne 0047C492
:0047C48A 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047C48D E8A2FFFFFF              call 0047C434

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047C488(C), :0047C49F(U)
|
:0047C492 8B45FC                  mov eax, dword ptr [ebp-04]
:0047C495 833800                  cmp dword ptr [eax], 00000000
:0047C498 7407                    je 0047C4A1
:0047C49A E825260000              call 0047EAC4
:0047C49F EBF1                    jmp 0047C492

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047C475(C), :0047C498(C)
|
:0047C4A1 8BE5                    mov esp, ebp
:0047C4A3 5D                      pop ebp
:0047C4A4 C3                      ret


:0047C4A5 55                      push ebp
:0047C4A6 8BEC                    mov ebp, esp
:0047C4A8 51                      push ecx
:0047C4A9 894DFC                  mov dword ptr [ebp-04], ecx
:0047C4AC 8B45FC                  mov eax, dword ptr [ebp-04]
:0047C4AF 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047C4B2 894810                  mov dword ptr [eax+10], ecx
:0047C4B5 8B55FC                  mov edx, dword ptr [ebp-04]
:0047C4B8 837A0800                cmp dword ptr [edx+08], 00000000
:0047C4BC 7416                    je 0047C4D4
:0047C4BE 837D0800                cmp dword ptr [ebp+08], 00000000
:0047C4C2 7410                    je 0047C4D4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047C4D2(U)
|
:0047C4C4 8B45FC                  mov eax, dword ptr [ebp-04]
:0047C4C7 83781400                cmp dword ptr [eax+14], 00000000
:0047C4CB 7507                    jne 0047C4D4
:0047C4CD E8F2250000              call 0047EAC4
:0047C4D2 EBF0                    jmp 0047C4C4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047C4BC(C), :0047C4C2(C), :0047C4CB(C)
|
:0047C4D4 8BE5                    mov esp, ebp
:0047C4D6 5D                      pop ebp
:0047C4D7 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0047C61F   
|
:0047C4DA 55                      push ebp
:0047C4DB 8BEC                    mov ebp, esp
:0047C4DD 51                      push ecx
:0047C4DE 894DFC                  mov dword ptr [ebp-04], ecx
:0047C4E1 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047C4E4 E877FDFFFF              call 0047C260
:0047C4E9 8B45FC                  mov eax, dword ptr [ebp-04]
:0047C4EC C7401800000000          mov [eax+18], 00000000
:0047C4F3 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047C4F6 C7411C00000000          mov [ecx+1C], 00000000
:0047C4FD 8B55FC                  mov edx, dword ptr [ebp-04]
:0047C500 C7422000000000          mov [edx+20], 00000000
:0047C507 8B45FC                  mov eax, dword ptr [ebp-04]
:0047C50A 8BE5                    mov esp, ebp
:0047C50C 5D                      pop ebp
:0047C50D C3                      ret



* Referenced by a CALL at Address:
|:0047C640   
|
:0047C50E 55                      push ebp
:0047C50F 8BEC                    mov ebp, esp
:0047C511 51                      push ecx
:0047C512 894DFC                  mov dword ptr [ebp-04], ecx
:0047C515 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047C518 E882FDFFFF              call 0047C29F
:0047C51D 8BE5                    mov esp, ebp
:0047C51F 5D                      pop ebp
:0047C520 C3                      ret



* Referenced by a CALL at Address:
|:0044C377   
|
:0047C521 55                      push ebp
:0047C522 8BEC                    mov ebp, esp
:0047C524 51                      push ecx
:0047C525 894DFC                  mov dword ptr [ebp-04], ecx
:0047C528 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047C52B E8FAFDFFFF              call 0047C32A
:0047C530 8BE5                    mov esp, ebp
:0047C532 5D                      pop ebp
:0047C533 C3                      ret



* Referenced by a CALL at Address:
|:0047C69A   
|
:0047C534 55                      push ebp
:0047C535 8BEC                    mov ebp, esp
:0047C537 51                      push ecx
:0047C538 894DFC                  mov dword ptr [ebp-04], ecx
:0047C53B 8B45FC                  mov eax, dword ptr [ebp-04]
:0047C53E 8B4018                  mov eax, dword ptr [eax+18]
:0047C541 8BE5                    mov esp, ebp
:0047C543 5D                      pop ebp
:0047C544 C3                      ret


:0047C545 55                      push ebp
:0047C546 8BEC                    mov ebp, esp
:0047C548 51                      push ecx
:0047C549 894DFC                  mov dword ptr [ebp-04], ecx
:0047C54C 8B45FC                  mov eax, dword ptr [ebp-04]
:0047C54F 8B401C                  mov eax, dword ptr [eax+1C]
:0047C552 8BE5                    mov esp, ebp
:0047C554 5D                      pop ebp
:0047C555 C3                      ret



* Referenced by a CALL at Address:
|:0047C6A7   
|
:0047C556 55                      push ebp
:0047C557 8BEC                    mov ebp, esp
:0047C559 51                      push ecx
:0047C55A 894DFC                  mov dword ptr [ebp-04], ecx
:0047C55D 8B45FC                  mov eax, dword ptr [ebp-04]
:0047C560 8B4020                  mov eax, dword ptr [eax+20]
:0047C563 8BE5                    mov esp, ebp
:0047C565 5D                      pop ebp
:0047C566 C3                      ret



* Referenced by a CALL at Address:
|:0047C5D5   
|
:0047C567 55                      push ebp
:0047C568 8BEC                    mov ebp, esp
:0047C56A 51                      push ecx
:0047C56B 894DFC                  mov dword ptr [ebp-04], ecx
:0047C56E 8B45FC                  mov eax, dword ptr [ebp-04]
:0047C571 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047C574 894818                  mov dword ptr [eax+18], ecx
:0047C577 8BE5                    mov esp, ebp
:0047C579 5D                      pop ebp
:0047C57A C20400                  ret 0004


:0047C57D 55                      push ebp
:0047C57E 8BEC                    mov ebp, esp
:0047C580 51                      push ecx
:0047C581 894DFC                  mov dword ptr [ebp-04], ecx
:0047C584 8B45FC                  mov eax, dword ptr [ebp-04]
:0047C587 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047C58A 89481C                  mov dword ptr [eax+1C], ecx
:0047C58D 8BE5                    mov esp, ebp
:0047C58F 5D                      pop ebp
:0047C590 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0047C5E1   
|
:0047C593 55                      push ebp
:0047C594 8BEC                    mov ebp, esp
:0047C596 51                      push ecx
:0047C597 894DFC                  mov dword ptr [ebp-04], ecx
:0047C59A 8B45FC                  mov eax, dword ptr [ebp-04]
:0047C59D 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047C5A0 894820                  mov dword ptr [eax+20], ecx
:0047C5A3 8BE5                    mov esp, ebp
:0047C5A5 5D                      pop ebp
:0047C5A6 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0047C721   
|
:0047C5A9 55                      push ebp
:0047C5AA 8BEC                    mov ebp, esp
:0047C5AC 51                      push ecx
:0047C5AD 894DFC                  mov dword ptr [ebp-04], ecx
:0047C5B0 8BE5                    mov esp, ebp
:0047C5B2 5D                      pop ebp
:0047C5B3 C3                      ret



* Referenced by a CALL at Address:
|:0044C351   
|
:0047C5B4 55                      push ebp
:0047C5B5 8BEC                    mov ebp, esp
:0047C5B7 51                      push ecx
:0047C5B8 894DFC                  mov dword ptr [ebp-04], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047C5CC(U)
|
:0047C5BB 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047C5BE E867FDFFFF              call 0047C32A
:0047C5C3 85C0                    test eax, eax
:0047C5C5 7507                    jne 0047C5CE
:0047C5C7 E8F8240000              call 0047EAC4
:0047C5CC EBED                    jmp 0047C5BB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047C5C5(C)
|
:0047C5CE 8B4508                  mov eax, dword ptr [ebp+08]
:0047C5D1 50                      push eax
:0047C5D2 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047C5D5 E88DFFFFFF              call 0047C567
:0047C5DA 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0047C5DD 51                      push ecx
:0047C5DE 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047C5E1 E8ADFFFFFF              call 0047C593
:0047C5E6 6A01                    push 00000001
:0047C5E8 6847C64700              push 0047C647
:0047C5ED 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047C5F0 E8B5FCFFFF              call 0047C2AA
:0047C5F5 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047C5F8 E89DFDFFFF              call 0047C39A
:0047C5FD B801000000              mov eax, 00000001
:0047C602 8BE5                    mov esp, ebp
:0047C604 5D                      pop ebp
:0047C605 C20800                  ret 0008


:0047C608 55                      push ebp
:0047C609 8BEC                    mov ebp, esp
:0047C60B E807000000              call 0047C617
:0047C610 E811000000              call 0047C626
:0047C615 5D                      pop ebp
:0047C616 C3                      ret



* Referenced by a CALL at Address:
|:0047C60B   
|
:0047C617 55                      push ebp
:0047C618 8BEC                    mov ebp, esp
:0047C61A B958754B00              mov ecx, 004B7558
:0047C61F E8B6FEFFFF              call 0047C4DA
:0047C624 5D                      pop ebp
:0047C625 C3                      ret



* Referenced by a CALL at Address:
|:0047C610   
|
:0047C626 55                      push ebp
:0047C627 8BEC                    mov ebp, esp
:0047C629 6838C64700              push 0047C638
:0047C62E E8CD4A0000              call 00481100
:0047C633 83C404                  add esp, 00000004
:0047C636 5D                      pop ebp
:0047C637 C3                      ret


:0047C638 55                      push ebp
:0047C639 8BEC                    mov ebp, esp
:0047C63B B958754B00              mov ecx, 004B7558
:0047C640 E8C9FEFFFF              call 0047C50E
:0047C645 5D                      pop ebp
:0047C646 C3                      ret


:0047C647 55                      push ebp
:0047C648 8BEC                    mov ebp, esp
:0047C64A 51                      push ecx
:0047C64B C745FC00000000          mov [ebp-04], 00000000
:0047C652 E814000000              call 0047C66B
:0047C657 85C0                    test eax, eax
:0047C659 7507                    jne 0047C662
:0047C65B C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047C659(C)
|
:0047C662 8B45FC                  mov eax, dword ptr [ebp-04]
:0047C665 8BE5                    mov esp, ebp
:0047C667 5D                      pop ebp
:0047C668 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0047C652   
|
:0047C66B 55                      push ebp
:0047C66C 8BEC                    mov ebp, esp
:0047C66E 6AFF                    push FFFFFFFF
:0047C670 68C95D4800              push 00485DC9
:0047C675 64A100000000            mov eax, dword ptr fs:[00000000]
:0047C67B 50                      push eax
:0047C67C 64892500000000          mov dword ptr fs:[00000000], esp
:0047C683 83EC18                  sub esp, 00000018
:0047C686 8D4DE8                  lea ecx, dword ptr [ebp-18]
:0047C689 E8926CF8FF              call 00403320
:0047C68E C745FC00000000          mov [ebp-04], 00000000
:0047C695 B958754B00              mov ecx, 004B7558
:0047C69A E895FEFFFF              call 0047C534
:0047C69F 8945EC                  mov dword ptr [ebp-14], eax
:0047C6A2 B958754B00              mov ecx, 004B7558
:0047C6A7 E8AAFEFFFF              call 0047C556
:0047C6AC 8945F0                  mov dword ptr [ebp-10], eax
:0047C6AF 6A00                    push 00000000
:0047C6B1 8B45EC                  mov eax, dword ptr [ebp-14]
:0047C6B4 50                      push eax
:0047C6B5 8D4DE8                  lea ecx, dword ptr [ebp-18]
:0047C6B8 E89FC8F9FF              call 00418F5C
:0047C6BD 85C0                    test eax, eax
:0047C6BF 751B                    jne 0047C6DC
:0047C6C1 C745E400000000          mov [ebp-1C], 00000000
:0047C6C8 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0047C6CF 8D4DE8                  lea ecx, dword ptr [ebp-18]
:0047C6D2 E872C8F9FF              call 00418F49
:0047C6D7 8B45E4                  mov eax, dword ptr [ebp-1C]
:0047C6DA EB63                    jmp 0047C73F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047C6BF(C)
|
:0047C6DC 6800403800              push 00384000
:0047C6E1 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047C6E4 51                      push ecx
:0047C6E5 8D4DE8                  lea ecx, dword ptr [ebp-18]
:0047C6E8 E87ACAF9FF              call 00419167
:0047C6ED 85C0                    test eax, eax
:0047C6EF 7523                    jne 0047C714
:0047C6F1 8D4DE8                  lea ecx, dword ptr [ebp-18]
:0047C6F4 E8CCCBF9FF              call 004192C5
:0047C6F9 C745E000000000          mov [ebp-20], 00000000
:0047C700 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0047C707 8D4DE8                  lea ecx, dword ptr [ebp-18]
:0047C70A E83AC8F9FF              call 00418F49
:0047C70F 8B45E0                  mov eax, dword ptr [ebp-20]
:0047C712 EB2B                    jmp 0047C73F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047C6EF(C)
|
:0047C714 8D4DE8                  lea ecx, dword ptr [ebp-18]
:0047C717 E8A9CBF9FF              call 004192C5
:0047C71C B958754B00              mov ecx, 004B7558
:0047C721 E883FEFFFF              call 0047C5A9
:0047C726 C745DC01000000          mov [ebp-24], 00000001
:0047C72D C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0047C734 8D4DE8                  lea ecx, dword ptr [ebp-18]
:0047C737 E80DC8F9FF              call 00418F49
:0047C73C 8B45DC                  mov eax, dword ptr [ebp-24]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047C6DA(U), :0047C712(U)
|
:0047C73F 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047C742 64890D00000000          mov dword ptr fs:[00000000], ecx
:0047C749 8BE5                    mov esp, ebp
:0047C74B 5D                      pop ebp
:0047C74C C3                      ret


:0047C74D CC                      int 03

* Referenced by a CALL at Address:
|:00410404   
|
:0047C74E FF25D0624800            jmp dword ptr [004862D0]

* Referenced by a CALL at Addresses:
|:0041F539   , :0041F576   , :0041F67F   , :0041F829   , :0047F0F0   
|
:0047C754 55                      push ebp
:0047C755 8BEC                    mov ebp, esp
:0047C757 51                      push ecx
:0047C758 A1DC8B4B00              mov eax, dword ptr [004B8BDC]
:0047C75D 53                      push ebx
:0047C75E 33DB                    xor ebx, ebx
:0047C760 3BC3                    cmp eax, ebx
:0047C762 0F8418010000            je 0047C880
:0047C768 57                      push edi
:0047C769 56                      push esi
:0047C76A 50                      push eax
:0047C76B FF1548604800            call dword ptr [00486048]
:0047C771 E8F62D0000              call 0047F56C
:0047C776 BF48954B00              mov edi, 004B9548
:0047C77B 57                      push edi
:0047C77C FF750C                  push [ebp+0C]
:0047C77F FF7508                  push [ebp+08]
:0047C782 E8BE2C0000              call 0047F445
:0047C787 83C40C                  add esp, 0000000C
:0047C78A BE00010000              mov esi, 00000100
:0047C78F A3DC8B4B00              mov dword ptr [004B8BDC], eax
:0047C794 68109E4B00              push 004B9E10
:0047C799 56                      push esi
:0047C79A 53                      push ebx
:0047C79B 50                      push eax
:0047C79C FF15A4604800            call dword ptr [004860A4]
:0047C7A2 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047C7D0(C)
|
:0047C7A4 8A88129E4B00            mov cl, byte ptr [eax+004B9E12]
:0047C7AA 888848954B00            mov byte ptr [eax+004B9548], cl
:0047C7B0 8A88109E4B00            mov cl, byte ptr [eax+004B9E10]
:0047C7B6 88884A954B00            mov byte ptr [eax+004B954A], cl
:0047C7BC 8A88119E4B00            mov cl, byte ptr [eax+004B9E11]
:0047C7C2 888849954B00            mov byte ptr [eax+004B9549], cl
:0047C7C8 83C004                  add eax, 00000004
:0047C7CB 3D00040000              cmp eax, 00000400
:0047C7D0 7CD2                    jl 0047C7A4
:0047C7D2 391DB07D4B00            cmp dword ptr [004B7DB0], ebx
:0047C7D8 742B                    je 0047C805
:0047C7DA 833D28C04B0000          cmp dword ptr [004BC028], 00000000
:0047C7E1 7E22                    jle 0047C805
:0047C7E3 C745FC48994B00          mov [ebp-04], 004B9948

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047C803(C)
|
:0047C7EA 8B45FC                  mov eax, dword ptr [ebp-04]
:0047C7ED 57                      push edi
:0047C7EE 56                      push esi
:0047C7EF 6A00                    push 00000000
:0047C7F1 FF30                    push dword ptr [eax]
:0047C7F3 E80A2C0000              call 0047F402
:0047C7F8 8345FC04                add dword ptr [ebp-04], 00000004
:0047C7FC 43                      inc ebx
:0047C7FD 3B1D28C04B00            cmp ebx, dword ptr [004BC028]
:0047C803 7CE5                    jl 0047C7EA

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047C7D8(C), :0047C7E1(C)
|
:0047C805 A144D04B00              mov eax, dword ptr [004BD044]
:0047C80A FF348580BE4B00          push dword ptr [4*eax+004BBE80]
:0047C811 FF1598624800            call dword ptr [00486298]
:0047C817 6A00                    push 00000000
:0047C819 8BF0                    mov esi, eax
:0047C81B FF35DC8B4B00            push dword ptr [004B8BDC]
:0047C821 56                      push esi
:0047C822 FF1550604800            call dword ptr [00486050]
:0047C828 56                      push esi
:0047C829 FF154C604800            call dword ptr [0048604C]
:0047C82F 85C0                    test eax, eax
:0047C831 7428                    je 0047C85B
:0047C833 A144D04B00              mov eax, dword ptr [004BD044]
:0047C838 6A01                    push 00000001
:0047C83A 6A00                    push 00000000
:0047C83C FF348580BE4B00          push dword ptr [4*eax+004BBE80]
:0047C843 FF15A4624800            call dword ptr [004862A4]
:0047C849 A144D04B00              mov eax, dword ptr [004BD044]
:0047C84E FF348580BE4B00          push dword ptr [4*eax+004BBE80]
:0047C855 FF15A8624800            call dword ptr [004862A8]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047C831(C)
|
:0047C85B A144D04B00              mov eax, dword ptr [004BD044]
:0047C860 56                      push esi
:0047C861 FF348580BE4B00          push dword ptr [4*eax+004BBE80]
:0047C868 FF159C624800            call dword ptr [0048629C]
:0047C86E 8B4508                  mov eax, dword ptr [ebp+08]
:0047C871 5E                      pop esi
:0047C872 A3D88B4B00              mov dword ptr [004B8BD8], eax
:0047C877 8B450C                  mov eax, dword ptr [ebp+0C]
:0047C87A A3D89A4B00              mov dword ptr [004B9AD8], eax
:0047C87F 5F                      pop edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047C762(C)
|
:0047C880 5B                      pop ebx
:0047C881 C9                      leave
:0047C882 C3                      ret



* Referenced by a CALL at Addresses:
|:0047D384   , :0047D4B3   , :0047D67C   , :0047DD82   , :0047DE25   
|:0047DFE2   , :0047E017   , :0047E052   , :0047E08E   , :0047E244   
|:0047E5DB   
|
:0047C883 55                      push ebp
:0047C884 8BEC                    mov ebp, esp
:0047C886 53                      push ebx
:0047C887 56                      push esi
:0047C888 57                      push edi
:0047C889 8B7D10                  mov edi, dword ptr [ebp+10]
:0047C88C 85FF                    test edi, edi
:0047C88E 0F84CD000000            je 0047C961
:0047C894 8B5D14                  mov ebx, dword ptr [ebp+14]
:0047C897 85DB                    test ebx, ebx
:0047C899 0F84C2000000            je 0047C961
:0047C89F 833D18C04B0000          cmp dword ptr [004BC018], 00000000
:0047C8A6 751B                    jne 0047C8C3
:0047C8A8 53                      push ebx
:0047C8A9 57                      push edi
:0047C8AA FF750C                  push [ebp+0C]
:0047C8AD FF7508                  push [ebp+08]
:0047C8B0 FF3544D04B00            push dword ptr [004BD044]
:0047C8B6 E8AB000000              call 0047C966
:0047C8BB 83C414                  add esp, 00000014
:0047C8BE E99E000000              jmp 0047C961

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047C8A6(C)
|
:0047C8C3 A144D04B00              mov eax, dword ptr [004BD044]
:0047C8C8 C1E002                  shl eax, 02
:0047C8CB 8BB0907A4B00            mov esi, dword ptr [eax+004B7A90]
:0047C8D1 85F6                    test esi, esi
:0047C8D3 7511                    jne 0047C8E6
:0047C8D5 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047C8D8 89B8907A4B00            mov dword ptr [eax+004B7A90], edi
:0047C8DE 8988C87D4B00            mov dword ptr [eax+004B7DC8], ecx
:0047C8E4 EB31                    jmp 0047C917

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047C8D3(C)
|
:0047C8E6 8B5508                  mov edx, dword ptr [ebp+08]
:0047C8E9 8B88C87D4B00            mov ecx, dword ptr [eax+004B7DC8]
:0047C8EF 03F1                    add esi, ecx
:0047C8F1 8D1C17                  lea ebx, dword ptr [edi+edx]
:0047C8F4 3BDE                    cmp ebx, esi
:0047C8F6 7E0A                    jle 0047C902
:0047C8F8 03FA                    add edi, edx
:0047C8FA 2BF9                    sub edi, ecx
:0047C8FC 89B8907A4B00            mov dword ptr [eax+004B7A90], edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047C8F6(C)
|
:0047C902 3BD1                    cmp edx, ecx
:0047C904 7D0E                    jge 0047C914
:0047C906 2BCA                    sub ecx, edx
:0047C908 8990C87D4B00            mov dword ptr [eax+004B7DC8], edx
:0047C90E 0188907A4B00            add dword ptr [eax+004B7A90], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047C904(C)
|
:0047C914 8B5D14                  mov ebx, dword ptr [ebp+14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047C8E4(U)
|
:0047C917 8B90207C4B00            mov edx, dword ptr [eax+004B7C20]
:0047C91D 85D2                    test edx, edx
:0047C91F 7511                    jne 0047C932
:0047C921 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0047C924 8998207C4B00            mov dword ptr [eax+004B7C20], ebx
:0047C92A 8988587F4B00            mov dword ptr [eax+004B7F58], ecx
:0047C930 EB2F                    jmp 0047C961

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047C91F(C)
|
:0047C932 8B88587F4B00            mov ecx, dword ptr [eax+004B7F58]
:0047C938 8D3411                  lea esi, dword ptr [ecx+edx]
:0047C93B 8B550C                  mov edx, dword ptr [ebp+0C]
:0047C93E 8D3C13                  lea edi, dword ptr [ebx+edx]
:0047C941 3BFE                    cmp edi, esi
:0047C943 7E0A                    jle 0047C94F
:0047C945 03DA                    add ebx, edx
:0047C947 2BD9                    sub ebx, ecx
:0047C949 8998207C4B00            mov dword ptr [eax+004B7C20], ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047C943(C)
|
:0047C94F 3BD1                    cmp edx, ecx
:0047C951 7D0E                    jge 0047C961
:0047C953 2BCA                    sub ecx, edx
:0047C955 8990587F4B00            mov dword ptr [eax+004B7F58], edx
:0047C95B 0188207C4B00            add dword ptr [eax+004B7C20], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047C88E(C), :0047C899(C), :0047C8BE(U), :0047C930(U), :0047C951(C)
|
:0047C961 5F                      pop edi
:0047C962 5E                      pop esi
:0047C963 5B                      pop ebx
:0047C964 5D                      pop ebp
:0047C965 C3                      ret



* Referenced by a CALL at Addresses:
|:0047C8B6   , :0047E9DC   , :0047EBE1   , :0047F081   
|
:0047C966 55                      push ebp
:0047C967 8BEC                    mov ebp, esp
:0047C969 81EC00080000            sub esp, 00000800
:0047C96F 53                      push ebx
:0047C970 33DB                    xor ebx, ebx
:0047C972 391D2CC04B00            cmp dword ptr [004BC02C], ebx
:0047C978 56                      push esi
:0047C979 0F8505010000            jne 0047CA84
:0047C97F 395D14                  cmp dword ptr [ebp+14], ebx
:0047C982 0F84FC000000            je 0047CA84
:0047C988 395D18                  cmp dword ptr [ebp+18], ebx
:0047C98B 0F84F3000000            je 0047CA84
:0047C991 8B4508                  mov eax, dword ptr [ebp+08]
:0047C994 8BF0                    mov esi, eax
:0047C996 C1E602                  shl esi, 02
:0047C999 399E48994B00            cmp dword ptr [esi+004B9948], ebx
:0047C99F 0F84DF000000            je 0047CA84
:0047C9A5 391DB07D4B00            cmp dword ptr [004B7DB0], ebx
:0047C9AB 57                      push edi
:0047C9AC 756B                    jne 0047CA19
:0047C9AE 8D8500F8FFFF            lea eax, dword ptr [ebp+FFFFF800]
:0047C9B4 BF00010000              mov edi, 00000100
:0047C9B9 50                      push eax
:0047C9BA 57                      push edi
:0047C9BB 53                      push ebx
:0047C9BC FF35DC8B4B00            push dword ptr [004B8BDC]
:0047C9C2 FF15A4604800            call dword ptr [004860A4]
:0047C9C8 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047CA03(C)
|
:0047C9CA 8A8C0502F8FFFF          mov cl, byte ptr [ebp+eax-000007FE]
:0047C9D1 888C0500FCFFFF          mov byte ptr [ebp+eax-00000400], cl
:0047C9D8 8A8C0500F8FFFF          mov cl, byte ptr [ebp+eax-00000800]
:0047C9DF 888C0502FCFFFF          mov byte ptr [ebp+eax-000003FE], cl
:0047C9E6 8A8C0501F8FFFF          mov cl, byte ptr [ebp+eax-000007FF]
:0047C9ED 888C0501FCFFFF          mov byte ptr [ebp+eax-000003FF], cl
:0047C9F4 889C0503FCFFFF          mov byte ptr [ebp+eax-000003FD], bl
:0047C9FB 83C004                  add eax, 00000004
:0047C9FE 3D00040000              cmp eax, 00000400
:0047CA03 7CC5                    jl 0047C9CA
:0047CA05 8D8500FCFFFF            lea eax, dword ptr [ebp+FFFFFC00]
:0047CA0B 50                      push eax
:0047CA0C 57                      push edi
:0047CA0D 53                      push ebx
:0047CA0E FFB648994B00            push dword ptr [esi+004B9948]
:0047CA14 E8E9290000              call 0047F402

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047C9AC(C)
|
:0047CA19 8B8620924B00            mov eax, dword ptr [esi+004B9220]
:0047CA1F 394514                  cmp dword ptr [ebp+14], eax
:0047CA22 7E03                    jle 0047CA27
:0047CA24 894514                  mov dword ptr [ebp+14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047CA22(C)
|
:0047CA27 8B86E09A4B00            mov eax, dword ptr [esi+004B9AE0]
:0047CA2D 394518                  cmp dword ptr [ebp+18], eax
:0047CA30 7E03                    jle 0047CA35
:0047CA32 894518                  mov dword ptr [ebp+18], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047CA30(C)
|
:0047CA35 FFB680BE4B00            push dword ptr [esi+004BBE80]
:0047CA3B FF1598624800            call dword ptr [00486298]
:0047CA41 53                      push ebx
:0047CA42 8BF8                    mov edi, eax
:0047CA44 FF35DC8B4B00            push dword ptr [004B8BDC]
:0047CA4A 57                      push edi
:0047CA4B FF1550604800            call dword ptr [00486050]
:0047CA51 57                      push edi
:0047CA52 FF154C604800            call dword ptr [0048604C]
:0047CA58 FF7510                  push [ebp+10]
:0047CA5B FF750C                  push [ebp+0C]
:0047CA5E FFB648994B00            push dword ptr [esi+004B9948]
:0047CA64 FF7518                  push [ebp+18]
:0047CA67 FF7514                  push [ebp+14]
:0047CA6A FF7510                  push [ebp+10]
:0047CA6D FF750C                  push [ebp+0C]
:0047CA70 57                      push edi
:0047CA71 E8A5290000              call 0047F41B
:0047CA76 57                      push edi
:0047CA77 FFB680BE4B00            push dword ptr [esi+004BBE80]
:0047CA7D FF159C624800            call dword ptr [0048629C]
:0047CA83 5F                      pop edi

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047C979(C), :0047C982(C), :0047C98B(C), :0047C99F(C)
|
:0047CA84 5E                      pop esi
:0047CA85 5B                      pop ebx
:0047CA86 C9                      leave
:0047CA87 C3                      ret



* Referenced by a CALL at Addresses:
|:0045FB9E   , :004754F2   
|
:0047CA88 55                      push ebp
:0047CA89 8BEC                    mov ebp, esp
:0047CA8B A128C04B00              mov eax, dword ptr [004BC028]
:0047CA90 FF7510                  push [ebp+10]
:0047CA93 8B5508                  mov edx, dword ptr [ebp+08]
:0047CA96 8BC8                    mov ecx, eax
:0047CA98 FF750C                  push [ebp+0C]
:0047CA9B A344D04B00              mov dword ptr [004BD044], eax
:0047CAA0 C1E102                  shl ecx, 02
:0047CAA3 838920924B00FF          or dword ptr [ecx+004B9220], FFFFFFFF
:0047CAAA 899180BE4B00            mov dword ptr [ecx+004BBE80], edx
:0047CAB0 E858230000              call 0047EE0D
:0047CAB5 8B4514                  mov eax, dword ptr [ebp+14]
:0047CAB8 59                      pop ecx
:0047CAB9 F7D8                    neg eax
:0047CABB 1BC0                    sbb eax, eax
:0047CABD 59                      pop ecx
:0047CABE 66250180                and ax, 8001
:0047CAC2 0500800000              add eax, 00008000
:0047CAC7 50                      push eax
:0047CAC8 FF7510                  push [ebp+10]
:0047CACB FF750C                  push [ebp+0C]
:0047CACE E8AF210000              call 0047EC82
:0047CAD3 A128C04B00              mov eax, dword ptr [004BC028]
:0047CAD8 83C40C                  add esp, 0000000C
:0047CADB FF0528C04B00            inc dword ptr [004BC028]
:0047CAE1 5D                      pop ebp
:0047CAE2 C3                      ret



* Referenced by a CALL at Addresses:
|:0040BD79   , :0041E64F   , :0041E694   , :0041E8BF   , :00427A9C   
|:0042803A   , :0042B742   , :0042BCE0   , :0042BE38   , :0042C176   
|:0042EC38   , :00431342   , :00431472   , :0044A164   , :0044A17C   
|:0044A349   , :0044A3AB   , :0044A441   , :0044A6BF   , :0044A6E4   
|:0044A836   , :0044A8C5   , :0044A93C   , :0044A94B   , :0045C6FF   
|:0045C745   , :0045CBC3   , :0045CC6B   , :0045CCAB   , :0045CD26   
|:0045CD3F   , :0045CE12   , :0045CEA3   , :0045D208   , :0045D252   
|:0045D261   , :0045DB15   , :0045DC6C   , :0045DCE2   , :0045E405   
|:0045E64E   , :0045EBF8   , :0045EDAC   , :0045EFCC   , :0045F0F3   
|:0045F110   , :0045F13C   , :0045F159   , :0045F185   , :0045F1A2   
|:0045FB6B   , :0045FBAD   , :00460857   , :00460BD6   , :00460C5B   
|:00460C75   , :00460CA5   , :00460F1E   , :00461149   , :004611EE   
|:00462C3D   , :00462CD6   , :00462E86   , :00462F1F   , :00469E8E   
|:00469EAB   , :0046A065   , :0046A0AC   , :0046D445   , :0046D4C9   
|:0046D783   , :0046D8DC   , :0046FC34   , :0046FD01   , :0046FD47   
|:0046FE26   , :0046FE6E   , :00472541   , :00472574   , :0047324E   
|:00473489   , :0047366E   , :00473A6F   , :00473B35   , :00473C09   
|:00473CBF   , :00475512   , :00476249   , :00476311   , :0047636B   
|:00476452   , :00476546   , :004765F9   , :00476649   , :004766FC   
|:00476759   , :00476858   , :00478004   , :004781AB   , :004782BC   
|:004788D2   , :00478919   , :0047978B   , :0047B6A6   , :0047D0D9   
|:0047D0EE   , :0047EE58   
|
:0047CAE3 55                      push ebp
:0047CAE4 8BEC                    mov ebp, esp
:0047CAE6 81EC28040000            sub esp, 00000428
:0047CAEC 8B4508                  mov eax, dword ptr [ebp+08]
:0047CAEF 3B0528C04B00            cmp eax, dword ptr [004BC028]
:0047CAF5 7D1D                    jge 0047CB14
:0047CAF7 8D8DD8FBFFFF            lea ecx, dword ptr [ebp+FFFFFBD8]
:0047CAFD A344D04B00              mov dword ptr [004BD044], eax
:0047CB02 51                      push ecx
:0047CB03 FF348550774B00          push dword ptr [4*eax+004B7750]
:0047CB0A E8D7280000              call 0047F3E6
:0047CB0F A31CA24B00              mov dword ptr [004BA21C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047CAF5(C)
|
:0047CB14 C9                      leave
:0047CB15 C3                      ret



* Referenced by a CALL at Addresses:
|:0047EE41   , :00480459   , :00480483   
|
:0047CB16 55                      push ebp
:0047CB17 8BEC                    mov ebp, esp
:0047CB19 81EC04050000            sub esp, 00000504
:0047CB1F 53                      push ebx
:0047CB20 33DB                    xor ebx, ebx
:0047CB22 391D48994B00            cmp dword ptr [004B9948], ebx
:0047CB28 56                      push esi
:0047CB29 57                      push edi
:0047CB2A 0F8513020000            jne 0047CD43
:0047CB30 391D28C04B00            cmp dword ptr [004BC028], ebx
:0047CB36 8B3D6C604800            mov edi, dword ptr [0048606C]
:0047CB3C 895DF8                  mov dword ptr [ebp-08], ebx
:0047CB3F 7E52                    jle 0047CB93
:0047CB41 C745FC20924B00          mov [ebp-04], 004B9220

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047CB91(C)
|
:0047CB48 8B45F8                  mov eax, dword ptr [ebp-08]
:0047CB4B 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047CB4E 8BF0                    mov esi, eax
:0047CB50 C1E602                  shl esi, 02
:0047CB53 FFB6E09A4B00            push dword ptr [esi+004B9AE0]
:0047CB59 899EF8784B00            mov dword ptr [esi+004B78F8], ebx
:0047CB5F FF31                    push dword ptr [ecx]
:0047CB61 50                      push eax
:0047CB62 E8FC220000              call 0047EE63
:0047CB67 83C40C                  add esp, 0000000C
:0047CB6A 3BC3                    cmp eax, ebx
:0047CB6C 898648994B00            mov dword ptr [esi+004B9948], eax
:0047CB72 0F84D2010000            je 0047CD4A
:0047CB78 FFB650774B00            push dword ptr [esi+004B7750]
:0047CB7E 50                      push eax
:0047CB7F FFD7                    call edi
:0047CB81 FF45F8                  inc [ebp-08]
:0047CB84 8345FC04                add dword ptr [ebp-04], 00000004
:0047CB88 8B45F8                  mov eax, dword ptr [ebp-08]
:0047CB8B 3B0528C04B00            cmp eax, dword ptr [004BC028]
:0047CB91 7CB5                    jl 0047CB48

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047CB3F(C)
|
:0047CB93 8D85FCFAFFFF            lea eax, dword ptr [ebp+FFFFFAFC]
:0047CB99 50                      push eax
:0047CB9A FF3550774B00            push dword ptr [004B7750]
:0047CBA0 E841280000              call 0047F3E6
:0047CBA5 A31CA24B00              mov dword ptr [004BA21C], eax
:0047CBAA E8A0010000              call 0047CD4F
:0047CBAF 33F6                    xor esi, esi
:0047CBB1 391D28C04B00            cmp dword ptr [004BC028], ebx
:0047CBB7 7E29                    jle 0047CBE2
:0047CBB9 C745FC48994B00          mov [ebp-04], 004B9948

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047CBE0(C)
|
:0047CBC0 8B45FC                  mov eax, dword ptr [ebp-04]
:0047CBC3 6848954B00              push 004B9548
:0047CBC8 6800010000              push 00000100
:0047CBCD 53                      push ebx
:0047CBCE FF30                    push dword ptr [eax]
:0047CBD0 E82D280000              call 0047F402
:0047CBD5 8345FC04                add dword ptr [ebp-04], 00000004
:0047CBD9 46                      inc esi
:0047CBDA 3B3528C04B00            cmp esi, dword ptr [004BC028]
:0047CBE0 7CDE                    jl 0047CBC0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047CBB7(C)
|

* Possible StringData Ref from Data Obj ->""
                                  |
:0047CBE2 68CCEC4800              push 0048ECCC
:0047CBE7 53                      push ebx
:0047CBE8 53                      push ebx
:0047CBE9 53                      push ebx
:0047CBEA 53                      push ebx
:0047CBEB 6886000000              push 00000086
:0047CBF0 53                      push ebx
:0047CBF1 53                      push ebx
:0047CBF2 53                      push ebx
:0047CBF3 53                      push ebx
:0047CBF4 53                      push ebx
:0047CBF5 53                      push ebx
:0047CBF6 6A08                    push 00000008
:0047CBF8 6AF0                    push FFFFFFF0
:0047CBFA FF1588604800            call dword ptr [00486088]
:0047CC00 800DAE754B00FF          or byte ptr [004B75AE], FF
:0047CC07 800DAC754B00FF          or byte ptr [004B75AC], FF
:0047CC0E 800DAD754B00FF          or byte ptr [004B75AD], FF
:0047CC15 A3049E4B00              mov dword ptr [004B9E04], eax
:0047CC1A 6A40                    push 00000040
:0047CC1C 8D45B8                  lea eax, dword ptr [ebp-48]
:0047CC1F 53                      push ebx
:0047CC20 50                      push eax
:0047CC21 C70580754B0028000000    mov dword ptr [004B7580], 00000028
:0047CC2B C70584754B0020000000    mov dword ptr [004B7584], 00000020
:0047CC35 C70588754B0010000000    mov dword ptr [004B7588], 00000010
:0047CC3F 66C7058C754B000100      mov word ptr [004B758C], 0001
:0047CC48 66C7058E754B000100      mov word ptr [004B758E], 0001
:0047CC51 891D90754B00            mov dword ptr [004B7590], ebx
:0047CC57 891D94754B00            mov dword ptr [004B7594], ebx
:0047CC5D 891D98754B00            mov dword ptr [004B7598], ebx
:0047CC63 891D9C754B00            mov dword ptr [004B759C], ebx
:0047CC69 891DA0754B00            mov dword ptr [004B75A0], ebx
:0047CC6F 891DA4754B00            mov dword ptr [004B75A4], ebx
:0047CC75 881DAA754B00            mov byte ptr [004B75AA], bl
:0047CC7B 881DA8754B00            mov byte ptr [004B75A8], bl
:0047CC81 881DA9754B00            mov byte ptr [004B75A9], bl
:0047CC87 E8A43E0000              call 00480B30
:0047CC8C 83C40C                  add esp, 0000000C
:0047CC8F FF3580BE4B00            push dword ptr [004BBE80]
:0047CC95 FF1598624800            call dword ptr [00486298]
:0047CC9B 8BF0                    mov esi, eax
:0047CC9D 56                      push esi
:0047CC9E FF1564604800            call dword ptr [00486064]
:0047CCA4 A3E0784B00              mov dword ptr [004B78E0], eax
:0047CCA9 B880754B00              mov eax, 004B7580
:0047CCAE 53                      push ebx
:0047CCAF 8D4DB8                  lea ecx, dword ptr [ebp-48]
:0047CCB2 50                      push eax
:0047CCB3 51                      push ecx
:0047CCB4 6A04                    push 00000004
:0047CCB6 50                      push eax
:0047CCB7 56                      push esi
:0047CCB8 FF1538604800            call dword ptr [00486038]
:0047CCBE 50                      push eax
:0047CCBF A3009E4B00              mov dword ptr [004B9E00], eax
:0047CCC4 FF35E0784B00            push dword ptr [004B78E0]
:0047CCCA FFD7                    call edi
:0047CCCC 6A01                    push 00000001
:0047CCCE A3887A4B00              mov dword ptr [004B7A88], eax
:0047CCD3 FF35E0784B00            push dword ptr [004B78E0]
:0047CCD9 FF15A8604800            call dword ptr [004860A8]
:0047CCDF FF35049E4B00            push dword ptr [004B9E04]
:0047CCE5 A3BCA34B00              mov dword ptr [004BA3BC], eax
:0047CCEA FF35E0784B00            push dword ptr [004B78E0]
:0047CCF0 FFD7                    call edi
:0047CCF2 68E0D04B00              push 004BD0E0
:0047CCF7 A318A24B00              mov dword ptr [004BA218], eax
:0047CCFC FF35E0784B00            push dword ptr [004B78E0]
:0047CD02 FF158C604800            call dword ptr [0048608C]
:0047CD08 56                      push esi
:0047CD09 FF3580BE4B00            push dword ptr [004BBE80]
:0047CD0F FF159C624800            call dword ptr [0048629C]
:0047CD15 8D8524FFFFFF            lea eax, dword ptr [ebp+FFFFFF24]
:0047CD1B C78524FFFFFF94000000    mov dword ptr [ebp+FFFFFF24], 00000094
:0047CD25 50                      push eax
:0047CD26 FF15DC614800            call dword ptr [004861DC]
:0047CD2C 33C0                    xor eax, eax
:0047CD2E 83BD34FFFFFF01          cmp dword ptr [ebp+FFFFFF34], 00000001
:0047CD35 0F94C0                  sete al
:0047CD38 A3B07D4B00              mov dword ptr [004B7DB0], eax
:0047CD3D 891D44D04B00            mov dword ptr [004BD044], ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047CB2A(C)
|
:0047CD43 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047CD4D(U)
|
:0047CD45 5F                      pop edi
:0047CD46 5E                      pop esi
:0047CD47 5B                      pop ebx
:0047CD48 C9                      leave
:0047CD49 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047CB72(C)
|
:0047CD4A 83C8FF                  or eax, FFFFFFFF
:0047CD4D EBF6                    jmp 0047CD45

* Referenced by a CALL at Address:
|:0047CBAA   
|
:0047CD4F 53                      push ebx
:0047CD50 33DB                    xor ebx, ebx
:0047CD52 56                      push esi
:0047CD53 33D2                    xor edx, edx
:0047CD55 B84A954B00              mov eax, 004B954A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047CDB1(C)
|
:0047CD5A 8ACA                    mov cl, dl
:0047CD5C 8850FE                  mov byte ptr [eax-02], dl
:0047CD5F 8810                    mov byte ptr [eax], dl
:0047CD61 80C107                  add cl, 07
:0047CD64 8850FF                  mov byte ptr [eax-01], dl
:0047CD67 884802                  mov byte ptr [eax+02], cl
:0047CD6A 885804                  mov byte ptr [eax+04], bl
:0047CD6D 885803                  mov byte ptr [eax+03], bl
:0047CD70 885806                  mov byte ptr [eax+06], bl
:0047CD73 884808                  mov byte ptr [eax+08], cl
:0047CD76 885807                  mov byte ptr [eax+07], bl
:0047CD79 88480A                  mov byte ptr [eax+0A], cl
:0047CD7C 88480C                  mov byte ptr [eax+0C], cl
:0047CD7F 88580B                  mov byte ptr [eax+0B], bl
:0047CD82 88580E                  mov byte ptr [eax+0E], bl
:0047CD85 885810                  mov byte ptr [eax+10], bl
:0047CD88 88480F                  mov byte ptr [eax+0F], cl
:0047CD8B 884812                  mov byte ptr [eax+12], cl
:0047CD8E 885814                  mov byte ptr [eax+14], bl
:0047CD91 884813                  mov byte ptr [eax+13], cl
:0047CD94 885816                  mov byte ptr [eax+16], bl
:0047CD97 884818                  mov byte ptr [eax+18], cl
:0047CD9A 884817                  mov byte ptr [eax+17], cl
:0047CD9D 88481A                  mov byte ptr [eax+1A], cl
:0047CDA0 88481C                  mov byte ptr [eax+1C], cl
:0047CDA3 88481B                  mov byte ptr [eax+1B], cl
:0047CDA6 83C020                  add eax, 00000020
:0047CDA9 83C208                  add edx, 00000008
:0047CDAC 3D4A994B00              cmp eax, 004B994A
:0047CDB1 7CA7                    jl 0047CD5A
:0047CDB3 B0FF                    mov al, FF
:0047CDB5 881D88954B00            mov byte ptr [004B9588], bl
:0047CDBB 881D8A954B00            mov byte ptr [004B958A], bl
:0047CDC1 881D89954B00            mov byte ptr [004B9589], bl
:0047CDC7 C6058C954B00A0          mov byte ptr [004B958C], A0
:0047CDCE 881D8E954B00            mov byte ptr [004B958E], bl
:0047CDD4 881D8D954B00            mov byte ptr [004B958D], bl
:0047CDDA 881D90954B00            mov byte ptr [004B9590], bl
:0047CDE0 C60592954B00A0          mov byte ptr [004B9592], A0
:0047CDE7 881D91954B00            mov byte ptr [004B9591], bl
:0047CDED C60594954B00A0          mov byte ptr [004B9594], A0
:0047CDF4 C60596954B00A0          mov byte ptr [004B9596], A0
:0047CDFB 881D95954B00            mov byte ptr [004B9595], bl
:0047CE01 881D98954B00            mov byte ptr [004B9598], bl
:0047CE07 881D9A954B00            mov byte ptr [004B959A], bl
:0047CE0D C60599954B00A0          mov byte ptr [004B9599], A0
:0047CE14 C6059C954B00A0          mov byte ptr [004B959C], A0
:0047CE1B 881D9E954B00            mov byte ptr [004B959E], bl
:0047CE21 C6059D954B00A0          mov byte ptr [004B959D], A0
:0047CE28 881DA0954B00            mov byte ptr [004B95A0], bl
:0047CE2E C605A2954B00A0          mov byte ptr [004B95A2], A0
:0047CE35 C605A1954B00A0          mov byte ptr [004B95A1], A0
:0047CE3C C605A4954B00A0          mov byte ptr [004B95A4], A0
:0047CE43 C605A6954B00A0          mov byte ptr [004B95A6], A0
:0047CE4A C605A5954B00A0          mov byte ptr [004B95A5], A0
:0047CE51 C605A8954B0080          mov byte ptr [004B95A8], 80
:0047CE58 C605AA954B0080          mov byte ptr [004B95AA], 80
:0047CE5F C605A9954B0080          mov byte ptr [004B95A9], 80
:0047CE66 A2AC954B00              mov byte ptr [004B95AC], al
:0047CE6B 881DAE954B00            mov byte ptr [004B95AE], bl
:0047CE71 881DAD954B00            mov byte ptr [004B95AD], bl
:0047CE77 881DB0954B00            mov byte ptr [004B95B0], bl
:0047CE7D A2B2954B00              mov byte ptr [004B95B2], al
:0047CE82 881DB1954B00            mov byte ptr [004B95B1], bl
:0047CE88 A2B4954B00              mov byte ptr [004B95B4], al
:0047CE8D A2B6954B00              mov byte ptr [004B95B6], al
:0047CE92 881DB5954B00            mov byte ptr [004B95B5], bl
:0047CE98 881DB8954B00            mov byte ptr [004B95B8], bl
:0047CE9E 881DBA954B00            mov byte ptr [004B95BA], bl
:0047CEA4 A2B9954B00              mov byte ptr [004B95B9], al
:0047CEA9 A2BC954B00              mov byte ptr [004B95BC], al
:0047CEAE 881DBE954B00            mov byte ptr [004B95BE], bl
:0047CEB4 A2BD954B00              mov byte ptr [004B95BD], al
:0047CEB9 881DC0954B00            mov byte ptr [004B95C0], bl
:0047CEBF A2C2954B00              mov byte ptr [004B95C2], al
:0047CEC4 A2C1954B00              mov byte ptr [004B95C1], al
:0047CEC9 A2C4954B00              mov byte ptr [004B95C4], al
:0047CECE A2C6954B00              mov byte ptr [004B95C6], al
:0047CED3 A2C5954B00              mov byte ptr [004B95C5], al
:0047CED8 E88F260000              call 0047F56C
:0047CEDD BE00010000              mov esi, 00000100
:0047CEE2 6848954B00              push 004B9548
:0047CEE7 56                      push esi
:0047CEE8 53                      push ebx
:0047CEE9 E857250000              call 0047F445
:0047CEEE 83C40C                  add esp, 0000000C
:0047CEF1 A3DC8B4B00              mov dword ptr [004B8BDC], eax
:0047CEF6 68109E4B00              push 004B9E10
:0047CEFB 56                      push esi
:0047CEFC 53                      push ebx
:0047CEFD 50                      push eax
:0047CEFE FF15A4604800            call dword ptr [004860A4]
:0047CF04 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047CF38(C)
|
:0047CF06 8A88129E4B00            mov cl, byte ptr [eax+004B9E12]
:0047CF0C 888848954B00            mov byte ptr [eax+004B9548], cl
:0047CF12 8A88109E4B00            mov cl, byte ptr [eax+004B9E10]
:0047CF18 88884A954B00            mov byte ptr [eax+004B954A], cl
:0047CF1E 8A88119E4B00            mov cl, byte ptr [eax+004B9E11]
:0047CF24 888849954B00            mov byte ptr [eax+004B9549], cl
:0047CF2A 88984B954B00            mov byte ptr [eax+004B954B], bl
:0047CF30 83C004                  add eax, 00000004
:0047CF33 3D00040000              cmp eax, 00000400
:0047CF38 7CCC                    jl 0047CF06
:0047CF3A 8935D89A4B00            mov dword ptr [004B9AD8], esi
:0047CF40 891DD88B4B00            mov dword ptr [004B8BD8], ebx
:0047CF46 5E                      pop esi
:0047CF47 5B                      pop ebx
:0047CF48 C3                      ret



* Referenced by a CALL at Address:
|:00480639   
|
:0047CF49 55                      push ebp
:0047CF4A 8BEC                    mov ebp, esp
:0047CF4C 83EC18                  sub esp, 00000018
:0047CF4F 8B1528C04B00            mov edx, dword ptr [004BC028]
:0047CF55 53                      push ebx
:0047CF56 33DB                    xor ebx, ebx
:0047CF58 56                      push esi
:0047CF59 3BD3                    cmp edx, ebx
:0047CF5B 57                      push edi
:0047CF5C 895DF0                  mov dword ptr [ebp-10], ebx
:0047CF5F 0F8E49010000            jle 0047D0AE
:0047CF65 8BF2                    mov esi, edx
:0047CF67 6A0F                    push 0000000F
:0047CF69 C1E602                  shl esi, 02
:0047CF6C 8BCE                    mov ecx, esi
:0047CF6E 58                      pop eax
:0047CF6F C1E902                  shr ecx, 02
:0047CF72 BF78824B00              mov edi, 004B8278
:0047CF77 6A10                    push 00000010
:0047CF79 F3                      repz
:0047CF7A AB                      stosd
:0047CF7B 8BCE                    mov ecx, esi
:0047CF7D 58                      pop eax
:0047CF7E C1E902                  shr ecx, 02
:0047CF81 BF08844B00              mov edi, 004B8408
:0047CF86 6A1F                    push 0000001F
:0047CF88 F3                      repz
:0047CF89 AB                      stosd
:0047CF8A 8BCE                    mov ecx, esi
:0047CF8C 58                      pop eax
:0047CF8D C1E902                  shr ecx, 02
:0047CF90 BFE8804B00              mov edi, 004B80E8
:0047CF95 6A10                    push 00000010
:0047CF97 F3                      repz
:0047CF98 AB                      stosd
:0047CF99 8BCE                    mov ecx, esi
:0047CF9B 58                      pop eax
:0047CF9C C1E902                  shr ecx, 02
:0047CF9F BFB8934B00              mov edi, 004B93B8
:0047CFA4 6A1F                    push 0000001F
:0047CFA6 F3                      repz
:0047CFA7 AB                      stosd
:0047CFA8 8BCE                    mov ecx, esi
:0047CFAA 58                      pop eax
:0047CFAB C1E902                  shr ecx, 02
:0047CFAE BF709C4B00              mov edi, 004B9C70
:0047CFB3 6A04                    push 00000004
:0047CFB5 F3                      repz
:0047CFB6 AB                      stosd
:0047CFB7 8BCE                    mov ecx, esi
:0047CFB9 33C0                    xor eax, eax
:0047CFBB C1E902                  shr ecx, 02
:0047CFBE BFC0754B00              mov edi, 004B75C0
:0047CFC3 C745E89C854B00          mov [ebp-18], 004B859C
:0047CFCA F3                      repz
:0047CFCB AB                      stosd
:0047CFCC 8BCE                    mov ecx, esi
:0047CFCE BFE0A34B00              mov edi, 004BA3E0
:0047CFD3 C1E902                  shr ecx, 02
:0047CFD6 F3                      repz
:0047CFD7 AB                      stosd
:0047CFD8 8BCE                    mov ecx, esi
:0047CFDA 58                      pop eax
:0047CFDB C1E902                  shr ecx, 02
:0047CFDE BF28A24B00              mov edi, 004BA228
:0047CFE3 6A03                    push 00000003
:0047CFE5 F3                      repz
:0047CFE6 AB                      stosd
:0047CFE7 8BCE                    mov ecx, esi
:0047CFE9 58                      pop eax
:0047CFEA C1E902                  shr ecx, 02
:0047CFED BFB8884B00              mov edi, 004B88B8
:0047CFF2 C745F4E09A4B00          mov [ebp-0C], 004B9AE0
:0047CFF9 F3                      repz
:0047CFFA AB                      stosd
:0047CFFB 8BCE                    mov ecx, esi
:0047CFFD 33C0                    xor eax, eax
:0047CFFF C1E902                  shr ecx, 02
:0047D002 BF907A4B00              mov edi, 004B7A90
:0047D007 C745EC28D14B00          mov [ebp-14], 004BD128
:0047D00E F3                      repz
:0047D00F AB                      stosd
:0047D010 8BCE                    mov ecx, esi
:0047D012 BF207C4B00              mov edi, 004B7C20
:0047D017 C1E902                  shr ecx, 02
:0047D01A 2145FC                  and dword ptr [ebp-04], eax
:0047D01D C745F820D14B00          mov [ebp-08], 004BD120
:0047D024 F3                      repz
:0047D025 AB                      stosd

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D0A6(C)
|
:0047D026 8B45FC                  mov eax, dword ptr [ebp-04]
:0047D029 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047D02C 8B3C9D20924B00          mov edi, dword ptr [4*ebx+004B9220]
:0047D033 8345F404                add dword ptr [ebp-0C], 00000004
:0047D037 8B09                    mov ecx, dword ptr [ecx]
:0047D039 83A0E48B4B0000          and dword ptr [eax+004B8BE4], 00000000
:0047D040 83A0E08B4B0000          and dword ptr [eax+004B8BE0], 00000000
:0047D047 8D80E08B4B00            lea eax, dword ptr [eax+004B8BE0]
:0047D04D 8D71FF                  lea esi, dword ptr [ecx-01]
:0047D050 8D5FFF                  lea ebx, dword ptr [edi-01]
:0047D053 89700C                  mov dword ptr [eax+0C], esi
:0047D056 895808                  mov dword ptr [eax+08], ebx
:0047D059 8B45FC                  mov eax, dword ptr [ebp-04]
:0047D05C 8345FC10                add dword ptr [ebp-04], 00000010
:0047D060 83A024D14B0000          and dword ptr [eax+004BD124], 00000000
:0047D067 8B45F8                  mov eax, dword ptr [ebp-08]
:0047D06A 8345F810                add dword ptr [ebp-08], 00000010
:0047D06E 832000                  and dword ptr [eax], 00000000
:0047D071 8B45EC                  mov eax, dword ptr [ebp-14]
:0047D074 897004                  mov dword ptr [eax+04], esi
:0047D077 8918                    mov dword ptr [eax], ebx
:0047D079 8B5DF0                  mov ebx, dword ptr [ebp-10]
:0047D07C 83C010                  add eax, 00000010
:0047D07F 8945EC                  mov dword ptr [ebp-14], eax
:0047D082 890C9D587F4B00          mov dword ptr [4*ebx+004B7F58], ecx
:0047D089 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0047D08C 893C9DC87D4B00          mov dword ptr [4*ebx+004B7DC8], edi
:0047D093 8361FC00                and dword ptr [ecx-04], 00000000
:0047D097 832100                  and dword ptr [ecx], 00000000
:0047D09A 43                      inc ebx
:0047D09B 83C108                  add ecx, 00000008
:0047D09E 3BDA                    cmp ebx, edx
:0047D0A0 895DF0                  mov dword ptr [ebp-10], ebx
:0047D0A3 894DE8                  mov dword ptr [ebp-18], ecx
:0047D0A6 0F8C7AFFFFFF            jl 0047D026
:0047D0AC 33DB                    xor ebx, ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047CF5F(C)
|
:0047D0AE 8B3544D04B00            mov esi, dword ptr [004BD044]
:0047D0B4 33FF                    xor edi, edi
:0047D0B6 3BD3                    cmp edx, ebx
:0047D0B8 891DB8A34B00            mov dword ptr [004BA3B8], ebx
:0047D0BE 891D10A24B00            mov dword ptr [004BA210], ebx
:0047D0C4 891D1CC04B00            mov dword ptr [004BC01C], ebx
:0047D0CA 891D20C04B00            mov dword ptr [004BC020], ebx
:0047D0D0 891D24C04B00            mov dword ptr [004BC024], ebx
:0047D0D6 7E15                    jle 0047D0ED

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D0EB(C)
|
:0047D0D8 57                      push edi
:0047D0D9 E805FAFFFF              call 0047CAE3
:0047D0DE 59                      pop ecx
:0047D0DF E85C020000              call 0047D340
:0047D0E4 47                      inc edi
:0047D0E5 3B3D28C04B00            cmp edi, dword ptr [004BC028]
:0047D0EB 7CEB                    jl 0047D0D8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D0D6(C)
|
:0047D0ED 56                      push esi
:0047D0EE E8F0F9FFFF              call 0047CAE3
:0047D0F3 59                      pop ecx
:0047D0F4 6A05                    push 00000005
:0047D0F6 FF3580BE4B00            push dword ptr [004BBE80]
:0047D0FC FF15E0624800            call dword ptr [004862E0]
:0047D102 5F                      pop edi
:0047D103 5E                      pop esi
:0047D104 5B                      pop ebx
:0047D105 C9                      leave
:0047D106 C3                      ret



* Referenced by a CALL at Addresses:
|:0042B56C   , :0042B694   , :0047EE3C   , :0047EF82   , :0048056E   
|
:0047D107 833D48994B0000          cmp dword ptr [004B9948], 00000000
:0047D10E 53                      push ebx
:0047D10F 8B1D48604800            mov ebx, dword ptr [00486048]
:0047D115 56                      push esi
:0047D116 57                      push edi
:0047D117 7475                    je 0047D18E
:0047D119 33F6                    xor esi, esi
:0047D11B 393528C04B00            cmp dword ptr [004BC028], esi
:0047D121 7E1B                    jle 0047D13E
:0047D123 BF48994B00              mov edi, 004B9948

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D13C(C)
|
:0047D128 56                      push esi
:0047D129 E8F11D0000              call 0047EF1F
:0047D12E 832700                  and dword ptr [edi], 00000000
:0047D131 46                      inc esi
:0047D132 83C704                  add edi, 00000004
:0047D135 3B3528C04B00            cmp esi, dword ptr [004BC028]
:0047D13B 59                      pop ecx
:0047D13C 7CEA                    jl 0047D128

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D121(C)
|
:0047D13E FF35BCA34B00            push dword ptr [004BA3BC]
:0047D144 FF35E0784B00            push dword ptr [004B78E0]
:0047D14A FF15A8604800            call dword ptr [004860A8]
:0047D150 FF3518A24B00            push dword ptr [004BA218]
:0047D156 8B356C604800            mov esi, dword ptr [0048606C]
:0047D15C FF35E0784B00            push dword ptr [004B78E0]
:0047D162 FFD6                    call esi
:0047D164 FF35887A4B00            push dword ptr [004B7A88]
:0047D16A FF35E0784B00            push dword ptr [004B78E0]
:0047D170 FFD6                    call esi
:0047D172 FF35009E4B00            push dword ptr [004B9E00]
:0047D178 FFD3                    call ebx
:0047D17A FF35E0784B00            push dword ptr [004B78E0]
:0047D180 FF15A0604800            call dword ptr [004860A0]
:0047D186 FF35049E4B00            push dword ptr [004B9E04]
:0047D18C FFD3                    call ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D117(C)
|
:0047D18E A1DC8B4B00              mov eax, dword ptr [004B8BDC]
:0047D193 85C0                    test eax, eax
:0047D195 740A                    je 0047D1A1
:0047D197 50                      push eax
:0047D198 FFD3                    call ebx
:0047D19A 8325DC8B4B0000          and dword ptr [004B8BDC], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D195(C)
|
:0047D1A1 5F                      pop edi
:0047D1A2 5E                      pop esi
:0047D1A3 5B                      pop ebx
:0047D1A4 C3                      ret



* Referenced by a CALL at Address:
|:00480648   
|
:0047D1A5 A144D04B00              mov eax, dword ptr [004BD044]
:0047D1AA 8B4C2404                mov ecx, dword ptr [esp+04]
:0047D1AE 8B048520924B00          mov eax, dword ptr [4*eax+004B9220]
:0047D1B5 8901                    mov dword ptr [ecx], eax
:0047D1B7 A144D04B00              mov eax, dword ptr [004BD044]
:0047D1BC 8B4C2408                mov ecx, dword ptr [esp+08]
:0047D1C0 8B0485E09A4B00          mov eax, dword ptr [4*eax+004B9AE0]
:0047D1C7 8901                    mov dword ptr [ecx], eax
:0047D1C9 C3                      ret



* Referenced by a CALL at Addresses:
|:0040BDA2   , :0041E082   , :0041E1F9   , :0041E44E   , :0041E624   
|:0041E659   , :0044A353   , :0044A44B   , :0044A6EE   , :0044A8CF   
|:0045C709   , :0045EC02   , :0045EDB6   , :00460BE0   , :0046A06F   
|:0046FD0B   , :0046FE30   , :0047254B   , :00473258   , :00476258   
|:0047637A   , :00476555   , :00476658   , :00476768   , :0047800E   
|:004781B5   , :004788DC   , :004806A3   
|
:0047D1CA A144D04B00              mov eax, dword ptr [004BD044]
:0047D1CF 8B542404                mov edx, dword ptr [esp+04]
:0047D1D3 6A03                    push 00000003
:0047D1D5 C1E002                  shl eax, 02
:0047D1D8 59                      pop ecx
:0047D1D9 3BD1                    cmp edx, ecx
:0047D1DB 8990B8884B00            mov dword ptr [eax+004B88B8], edx
:0047D1E1 7F0D                    jg 0047D1F0
:0047D1E3 6A0F                    push 0000000F
:0047D1E5 2BCA                    sub ecx, edx
:0047D1E7 5A                      pop edx
:0047D1E8 D3FA                    sar edx, cl
:0047D1EA 899078824B00            mov dword ptr [eax+004B8278], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D1E1(C)
|
:0047D1F0 C3                      ret

* Referenced by a CALL at Addresses:
|:004020A1   , :00402476   , :004024D6   , :00402CEA   , :00402EDE   
|:00408638   , :0041E669   , :0041E6AE   , :0041E72D   , :00427AAA   
|:00427B50   , :00428048   , :0042BCEE   , :0042BE46   , :0042D08A   
|:0042D27C   , :0042D86F   , :0042D93B   , :0042DA1B   , :0042DE9D   
|:0042DFDE   , :0042E012   , :0042E280   , :00430343   , :0043039A   
|:00431350   , :0043280B   , :00440521   , :004432E4   , :00443402   
|:00443A32   , :00443AFC   , :00443CBC   , :00448797   , :00448877   
|:00448933   , :004489E2   , :00448C0F   , :00448CEF   , :00448DAB   
|:00448E60   , :0044902C   , :00449524   , :0044A361   , :0044A4E1   
|:0044A5F0   , :0044A6B5   , :0044A8DD   , :0044A959   , :0044B326   
|:0044B3DA   , :00451951   , :0045197B   , :004519B2   , :004519DC   
|:00451E73   , :00453C95   , :00453D42   , :00453DC6   , :0045C717   
|:0045CCE3   , :0045CD77   , :0045CDB9   , :0045CE03   , :0045CEE8   
|:0045CF5D   , :0045D1FE   , :0045E272   , :0045EC10   , :0045EDC4   
|:0045EE21   , :0045F106   , :0045F14F   , :0045F198   , :0046121D   
|:004613E4   , :00469EA1   , :0046A07D   , :0046D82E   , :0046FD19   
|:0046FE3E   , :00473266   , :0047330B   , :004733AB   , :00473422   
|:0047347F   , :0047367C   , :00473A82   , :00473B48   , :00473B7A   
|:00473BB2   , :00473C1C   , :00473CD2   , :00473D0D   , :00473D4E   
|:00473D93   , :00473F4C   , :00473F87   , :00473FC8   , :0047400D   
|:004762A7   , :00476400   , :004765A5   , :004766A8   , :00476776   
|:00476849   , :0047801C   , :004781C3   , :004788EA   
|
:0047D1F1 55                      push ebp
:0047D1F2 8BEC                    mov ebp, esp
:0047D1F4 A144D04B00              mov eax, dword ptr [004BD044]
:0047D1F9 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047D1FC C1E002                  shl eax, 02
:0047D1FF 83B8B8884B0003          cmp dword ptr [eax+004B88B8], 00000003
:0047D206 8988E0A34B00            mov dword ptr [eax+004BA3E0], ecx
:0047D20C 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0047D20F 7F17                    jg 0047D228
:0047D211 83E10F                  and ecx, 0000000F
:0047D214 83C110                  add ecx, 00000010
:0047D217 8988709C4B00            mov dword ptr [eax+004B9C70], ecx
:0047D21D 8B4D10                  mov ecx, dword ptr [ebp+10]
:0047D220 83E10F                  and ecx, 0000000F
:0047D223 83C110                  add ecx, 00000010
:0047D226 EB09                    jmp 0047D231

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D20F(C)
|
:0047D228 8988709C4B00            mov dword ptr [eax+004B9C70], ecx
:0047D22E 8B4D10                  mov ecx, dword ptr [ebp+10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D226(U)
|
:0047D231 8988B8934B00            mov dword ptr [eax+004B93B8], ecx
:0047D237 5D                      pop ebp
:0047D238 C3                      ret



* Referenced by a CALL at Addresses:
|:0040ECAE   , :0040ECE6   , :0040ED5F   , :0040F51C   , :0040F657   
|:0040F808   , :0040F849   , :0040F892   , :0040F8DE   , :0040F931   
|:0041ED2D   , :00431843   , :00431871   , :0043195E   , :004319CE   
|:004319FC   , :00431BDB   , :00431C09   , :00431CB3   , :00431D23   
|:00431D51   , :0043241D   , :0043251B   , :004325B5   , :0043261B   
|:00432670   , :00443627   , :00443748   , :004439D9   , :0044AE10   
|:0044AF25   , :0044B1A0   , :0044B79D   , :0044B863   , :0044B932   
|:0044BA07   , :0044BC8D   , :0044BE96   , :0044BFF8   , :0044C0E2   
|:00480763   
|
:0047D239 55                      push ebp
:0047D23A 8BEC                    mov ebp, esp
:0047D23C A144D04B00              mov eax, dword ptr [004BD044]
:0047D241 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047D244 C1E002                  shl eax, 02
:0047D247 83B8B8884B0003          cmp dword ptr [eax+004B88B8], 00000003
:0047D24E 8988C0754B00            mov dword ptr [eax+004B75C0], ecx
:0047D254 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0047D257 7F17                    jg 0047D270
:0047D259 83E10F                  and ecx, 0000000F
:0047D25C 83C110                  add ecx, 00000010
:0047D25F 8988E8804B00            mov dword ptr [eax+004B80E8], ecx
:0047D265 8B4D10                  mov ecx, dword ptr [ebp+10]
:0047D268 83E10F                  and ecx, 0000000F
:0047D26B 83C110                  add ecx, 00000010
:0047D26E EB09                    jmp 0047D279

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D257(C)
|
:0047D270 8988E8804B00            mov dword ptr [eax+004B80E8], ecx
:0047D276 8B4D10                  mov ecx, dword ptr [ebp+10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D26E(U)
|
:0047D279 898808844B00            mov dword ptr [eax+004B8408], ecx
:0047D27F 5D                      pop ebp
:0047D280 C3                      ret



* Referenced by a CALL at Addresses:
|:00428010   , :00428154   , :00451941   , :004519A2   , :0045F1F7   
|:0047B6E6   
|
:0047D281 8B0D44D04B00            mov ecx, dword ptr [004BD044]
:0047D287 53                      push ebx
:0047D288 8B442408                mov eax, dword ptr [esp+08]
:0047D28C 56                      push esi
:0047D28D 57                      push edi
:0047D28E 8BF9                    mov edi, ecx
:0047D290 C1E703                  shl edi, 03
:0047D293 8B9798854B00            mov edx, dword ptr [edi+004B8598]
:0047D299 8D3410                  lea esi, dword ptr [eax+edx]
:0047D29C 8BC1                    mov eax, ecx
:0047D29E C1E004                  shl eax, 04
:0047D2A1 85F6                    test esi, esi
:0047D2A3 8D9820D14B00            lea ebx, dword ptr [eax+004BD120]
:0047D2A9 8933                    mov dword ptr [ebx], esi
:0047D2AB 7D03                    jge 0047D2B0
:0047D2AD 832300                  and dword ptr [ebx], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D2AB(C)
|
:0047D2B0 8B742418                mov esi, dword ptr [esp+18]
:0047D2B4 C1E102                  shl ecx, 02
:0047D2B7 03D6                    add edx, esi
:0047D2B9 8DB028D14B00            lea esi, dword ptr [eax+004BD128]
:0047D2BF 8B9920924B00            mov ebx, dword ptr [ecx+004B9220]
:0047D2C5 4B                      dec ebx
:0047D2C6 8916                    mov dword ptr [esi], edx
:0047D2C8 3BD3                    cmp edx, ebx
:0047D2CA 7E02                    jle 0047D2CE
:0047D2CC 891E                    mov dword ptr [esi], ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D2CA(C)
|
:0047D2CE 8B979C854B00            mov edx, dword ptr [edi+004B859C]
:0047D2D4 8B742414                mov esi, dword ptr [esp+14]
:0047D2D8 03F2                    add esi, edx
:0047D2DA 8DB824D14B00            lea edi, dword ptr [eax+004BD124]
:0047D2E0 85F6                    test esi, esi
:0047D2E2 8937                    mov dword ptr [edi], esi
:0047D2E4 7D03                    jge 0047D2E9
:0047D2E6 832700                  and dword ptr [edi], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D2E4(C)
|
:0047D2E9 8B74241C                mov esi, dword ptr [esp+1C]
:0047D2ED 8B89E09A4B00            mov ecx, dword ptr [ecx+004B9AE0]
:0047D2F3 03D6                    add edx, esi
:0047D2F5 8D802CD14B00            lea eax, dword ptr [eax+004BD12C]
:0047D2FB 49                      dec ecx
:0047D2FC 3BD1                    cmp edx, ecx
:0047D2FE 8910                    mov dword ptr [eax], edx
:0047D300 7E02                    jle 0047D304
:0047D302 8908                    mov dword ptr [eax], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D300(C)
|
:0047D304 5F                      pop edi
:0047D305 5E                      pop esi
:0047D306 5B                      pop ebx
:0047D307 C3                      ret



* Referenced by a CALL at Addresses:
|:0047D43D   , :0047D786   , :0047D8A6   , :0047DB5C   , :0047DC92   
|:0047DDD3   , :0047E149   , :0047E2BE   , :0047E442   
|
:0047D308 A144D04B00              mov eax, dword ptr [004BD044]
:0047D30D C1E002                  shl eax, 02
:0047D310 83B8488A4B0000          cmp dword ptr [eax+004B8A48], 00000000
:0047D317 7D06                    jge 0047D31F
:0047D319 8B4C2408                mov ecx, dword ptr [esp+08]
:0047D31D EB0D                    jmp 0047D32C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D317(C)
|
:0047D31F 8B88E09A4B00            mov ecx, dword ptr [eax+004B9AE0]
:0047D325 2B4C2408                sub ecx, dword ptr [esp+08]
:0047D329 83C10F                  add ecx, 0000000F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D31D(U)
|
:0047D32C 8B8020924B00            mov eax, dword ptr [eax+004B9220]
:0047D332 0FAFC1                  imul eax, ecx
:0047D335 03442404                add eax, dword ptr [esp+04]
:0047D339 03051CA24B00            add eax, dword ptr [004BA21C]
:0047D33F C3                      ret



* Referenced by a CALL at Addresses:
|:0040B9D1   , :0040BA99   , :0041E69C   , :0044D137   , :0044D597   
|:0045F0FB   , :0045F144   , :0045F18D   , :00469E96   , :0047D0DF   
|:00480563   
|
:0047D340 A144D04B00              mov eax, dword ptr [004BD044]
:0047D345 C1E002                  shl eax, 02
:0047D348 FFB0B8884B00            push dword ptr [eax+004B88B8]
:0047D34E 8B88E09A4B00            mov ecx, dword ptr [eax+004B9AE0]
:0047D354 83C110                  add ecx, 00000010
:0047D357 FF351CA24B00            push dword ptr [004BA21C]
:0047D35D 51                      push ecx
:0047D35E FFB020924B00            push dword ptr [eax+004B9220]
:0047D364 E890220000              call 0047F5F9
:0047D369 A144D04B00              mov eax, dword ptr [004BD044]
:0047D36E 83C410                  add esp, 00000010
:0047D371 C1E002                  shl eax, 02
:0047D374 FFB0E09A4B00            push dword ptr [eax+004B9AE0]
:0047D37A FFB020924B00            push dword ptr [eax+004B9220]
:0047D380 6A00                    push 00000000
:0047D382 6A00                    push 00000000
:0047D384 E8FAF4FFFF              call 0047C883
:0047D389 83C410                  add esp, 00000010
:0047D38C C3                      ret



* Referenced by a CALL at Addresses:
|:00450F63   , :00450FEA   , :004511F9   , :00476278   , :0047639A   
|:004763D4   , :00476575   , :00476678   , :004767A1   , :004767C0   
|:00476802   , :00476824   
|
:0047D38D A144D04B00              mov eax, dword ptr [004BD044]
:0047D392 8B542408                mov edx, dword ptr [esp+08]
:0047D396 8B4C240C                mov ecx, dword ptr [esp+0C]
:0047D39A 56                      push esi
:0047D39B 833C85B8884B0007        cmp dword ptr [4*eax+004B88B8], 00000007
:0047D3A3 891560D74B00            mov dword ptr [004BD760], edx
:0047D3A9 7516                    jne 0047D3C1
:0047D3AB 8BC2                    mov eax, edx
:0047D3AD C1E003                  shl eax, 03
:0047D3B0 50                      push eax
:0047D3B1 51                      push ecx
:0047D3B2 6860D04B00              push 004BD060
:0047D3B7 E834340000              call 004807F0
:0047D3BC 83C40C                  add esp, 0000000C
:0047D3BF 5E                      pop esi
:0047D3C0 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D3A9(C)
|
:0047D3C1 C1E202                  shl edx, 02
:0047D3C4 85D2                    test edx, edx
:0047D3C6 B860D04B00              mov eax, 004BD060
:0047D3CB 7E1C                    jle 0047D3E9
:0047D3CD 8BF2                    mov esi, edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D3E7(C)
|
:0047D3CF 8A11                    mov dl, byte ptr [ecx]
:0047D3D1 C0EA04                  shr dl, 04
:0047D3D4 80C210                  add dl, 10
:0047D3D7 8810                    mov byte ptr [eax], dl
:0047D3D9 8A11                    mov dl, byte ptr [ecx]
:0047D3DB 80E20F                  and dl, 0F
:0047D3DE 40                      inc eax
:0047D3DF 80C210                  add dl, 10
:0047D3E2 8810                    mov byte ptr [eax], dl
:0047D3E4 40                      inc eax
:0047D3E5 41                      inc ecx
:0047D3E6 4E                      dec esi
:0047D3E7 75E6                    jne 0047D3CF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D3CB(C)
|
:0047D3E9 5E                      pop esi
:0047D3EA C3                      ret



* Referenced by a CALL at Address:
|:00472557   
|
:0047D3EB A144D04B00              mov eax, dword ptr [004BD044]
:0047D3F0 56                      push esi
:0047D3F1 8B742408                mov esi, dword ptr [esp+08]
:0047D3F5 57                      push edi
:0047D3F6 8B7C2410                mov edi, dword ptr [esp+10]
:0047D3FA 0334C598854B00          add esi, dword ptr [8*eax+004B8598]
:0047D401 033CC59C854B00          add edi, dword ptr [8*eax+004B859C]
:0047D408 C1E004                  shl eax, 04
:0047D40B 3BB020D14B00            cmp esi, dword ptr [eax+004BD120]
:0047D411 0F8CA4000000            jl 0047D4BB
:0047D417 3BB028D14B00            cmp esi, dword ptr [eax+004BD128]
:0047D41D 0F8F98000000            jg 0047D4BB
:0047D423 3BB824D14B00            cmp edi, dword ptr [eax+004BD124]
:0047D429 0F8C8C000000            jl 0047D4BB
:0047D42F 3BB82CD14B00            cmp edi, dword ptr [eax+004BD12C]
:0047D435 0F8F80000000            jg 0047D4BB
:0047D43B 57                      push edi
:0047D43C 56                      push esi
:0047D43D E8C6FEFFFF              call 0047D308
:0047D442 59                      pop ecx
:0047D443 59                      pop ecx
:0047D444 8B0D44D04B00            mov ecx, dword ptr [004BD044]
:0047D44A C1E102                  shl ecx, 02
:0047D44D 8B91E0A34B00            mov edx, dword ptr [ecx+004BA3E0]
:0047D453 83EA00                  sub edx, 00000000
:0047D456 744D                    je 0047D4A5
:0047D458 4A                      dec edx
:0047D459 7428                    je 0047D483
:0047D45B 4A                      dec edx
:0047D45C 741B                    je 0047D479
:0047D45E 4A                      dec edx
:0047D45F 740E                    je 0047D46F
:0047D461 4A                      dec edx
:0047D462 7441                    je 0047D4A5
:0047D464 4A                      dec edx
:0047D465 7546                    jne 0047D4AD
:0047D467 8A89B8934B00            mov cl, byte ptr [ecx+004B93B8]
:0047D46D EB3C                    jmp 0047D4AB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D45F(C)
|
:0047D46F 8A89709C4B00            mov cl, byte ptr [ecx+004B9C70]
:0047D475 0808                    or byte ptr [eax], cl
:0047D477 EB34                    jmp 0047D4AD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D45C(C)
|
:0047D479 8A89709C4B00            mov cl, byte ptr [ecx+004B9C70]
:0047D47F 2008                    and byte ptr [eax], cl
:0047D481 EB2A                    jmp 0047D4AD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D459(C)
|
:0047D483 8A89709C4B00            mov cl, byte ptr [ecx+004B9C70]
:0047D489 3008                    xor byte ptr [eax], cl
:0047D48B 8B1544D04B00            mov edx, dword ptr [004BD044]
:0047D491 8A08                    mov cl, byte ptr [eax]
:0047D493 833C95B8884B0007        cmp dword ptr [4*edx+004B88B8], 00000007
:0047D49B 7410                    je 0047D4AD
:0047D49D 80E10F                  and cl, 0F
:0047D4A0 80C910                  or cl, 10
:0047D4A3 EB06                    jmp 0047D4AB

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047D456(C), :0047D462(C)
|
:0047D4A5 8A89709C4B00            mov cl, byte ptr [ecx+004B9C70]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047D46D(U), :0047D4A3(U)
|
:0047D4AB 8808                    mov byte ptr [eax], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047D465(C), :0047D477(U), :0047D481(U), :0047D49B(C)
|
:0047D4AD 6A01                    push 00000001
:0047D4AF 6A01                    push 00000001
:0047D4B1 57                      push edi
:0047D4B2 56                      push esi
:0047D4B3 E8CBF3FFFF              call 0047C883
:0047D4B8 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047D411(C), :0047D41D(C), :0047D429(C), :0047D435(C)
|
:0047D4BB 5F                      pop edi
:0047D4BC 5E                      pop esi
:0047D4BD C3                      ret



* Referenced by a CALL at Addresses:
|:004487E3   , :0044882F   , :004488C1   , :0044890B   , :0044897D   
|:004489C7   , :00448A3A   , :00448A92   , :00448C5B   , :00448CA7   
|:00448D39   , :00448D83   , :00448DF5   , :00448E3F   , :00448EB8   
|:00448F10   , :0044B373   , :0044B3C4   , :0044B40F   , :0044B447   
|:00453D7A   , :00453DB2   , :00453DF0   , :00453E1A   , :0047333A   
|:0047336D   , :004733D7   , :00473407   , :00473448   , :00473471   
|
:0047D4BE 55                      push ebp
:0047D4BF 8BEC                    mov ebp, esp
:0047D4C1 83EC20                  sub esp, 00000020
:0047D4C4 A144D04B00              mov eax, dword ptr [004BD044]
:0047D4C9 53                      push ebx
:0047D4CA 8B5D10                  mov ebx, dword ptr [ebp+10]
:0047D4CD 56                      push esi
:0047D4CE C1E003                  shl eax, 03
:0047D4D1 8B750C                  mov esi, dword ptr [ebp+0C]
:0047D4D4 57                      push edi
:0047D4D5 8B8898854B00            mov ecx, dword ptr [eax+004B8598]
:0047D4DB 8B7D08                  mov edi, dword ptr [ebp+08]
:0047D4DE 8B809C854B00            mov eax, dword ptr [eax+004B859C]
:0047D4E4 FF7518                  push [ebp+18]
:0047D4E7 8D140F                  lea edx, dword ptr [edi+ecx]
:0047D4EA 03CB                    add ecx, ebx
:0047D4EC 894DF8                  mov dword ptr [ebp-08], ecx
:0047D4EF 8B4D14                  mov ecx, dword ptr [ebp+14]
:0047D4F2 8955F0                  mov dword ptr [ebp-10], edx
:0047D4F5 8D1406                  lea edx, dword ptr [esi+eax]
:0047D4F8 03C8                    add ecx, eax
:0047D4FA 8955F4                  mov dword ptr [ebp-0C], edx
:0047D4FD 894DFC                  mov dword ptr [ebp-04], ecx
:0047D500 E81E020000              call 0047D723
:0047D505 3BFB                    cmp edi, ebx
:0047D507 59                      pop ecx
:0047D508 757E                    jne 0047D588
:0047D50A 8B1544D04B00            mov edx, dword ptr [004BD044]
:0047D510 8B7DF0                  mov edi, dword ptr [ebp-10]
:0047D513 8BF2                    mov esi, edx
:0047D515 C1E604                  shl esi, 04
:0047D518 3BBE20D14B00            cmp edi, dword ptr [esi+004BD120]
:0047D51E 0F8C60010000            jl 0047D684
:0047D524 3BBE28D14B00            cmp edi, dword ptr [esi+004BD128]
:0047D52A 0F8F54010000            jg 0047D684
:0047D530 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047D533 8B45FC                  mov eax, dword ptr [ebp-04]
:0047D536 3BC8                    cmp ecx, eax
:0047D538 7E17                    jle 0047D551
:0047D53A 8B04D59C854B00          mov eax, dword ptr [8*edx+004B859C]
:0047D541 8B4D14                  mov ecx, dword ptr [ebp+14]
:0047D544 8B550C                  mov edx, dword ptr [ebp+0C]
:0047D547 03C8                    add ecx, eax
:0047D549 03C2                    add eax, edx
:0047D54B 894DF4                  mov dword ptr [ebp-0C], ecx
:0047D54E 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D538(C)
|
:0047D551 8B9624D14B00            mov edx, dword ptr [esi+004BD124]
:0047D557 3BCA                    cmp ecx, edx
:0047D559 7D05                    jge 0047D560
:0047D55B 8BCA                    mov ecx, edx
:0047D55D 894DF4                  mov dword ptr [ebp-0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D559(C)
|
:0047D560 8BB62CD14B00            mov esi, dword ptr [esi+004BD12C]
:0047D566 3BC6                    cmp eax, esi
:0047D568 7E05                    jle 0047D56F
:0047D56A 8BC6                    mov eax, esi
:0047D56C 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D568(C)
|
:0047D56F 2BC1                    sub eax, ecx
:0047D571 897DE0                  mov dword ptr [ebp-20], edi
:0047D574 40                      inc eax
:0047D575 6A01                    push 00000001
:0047D577 8BF8                    mov edi, eax
:0047D579 5E                      pop esi
:0047D57A 8D45F0                  lea eax, dword ptr [ebp-10]
:0047D57D 894DE4                  mov dword ptr [ebp-1C], ecx
:0047D580 50                      push eax
:0047D581 E815030000              call 0047D89B
:0047D586 EB7F                    jmp 0047D607

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D508(C)
|
:0047D588 3B7514                  cmp esi, dword ptr [ebp+14]
:0047D58B 757D                    jne 0047D60A
:0047D58D 8B1544D04B00            mov edx, dword ptr [004BD044]
:0047D593 8B45F4                  mov eax, dword ptr [ebp-0C]
:0047D596 8BF2                    mov esi, edx
:0047D598 C1E604                  shl esi, 04
:0047D59B 3B8624D14B00            cmp eax, dword ptr [esi+004BD124]
:0047D5A1 0F8CDD000000            jl 0047D684
:0047D5A7 3B862CD14B00            cmp eax, dword ptr [esi+004BD12C]
:0047D5AD 0F8FD1000000            jg 0047D684
:0047D5B3 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0047D5B6 8B45F8                  mov eax, dword ptr [ebp-08]
:0047D5B9 3BC8                    cmp ecx, eax
:0047D5BB 7E12                    jle 0047D5CF
:0047D5BD 8B04D598854B00          mov eax, dword ptr [8*edx+004B8598]
:0047D5C4 8D0C03                  lea ecx, dword ptr [ebx+eax]
:0047D5C7 03C7                    add eax, edi
:0047D5C9 894DF0                  mov dword ptr [ebp-10], ecx
:0047D5CC 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D5BB(C)
|
:0047D5CF 8B9620D14B00            mov edx, dword ptr [esi+004BD120]
:0047D5D5 3BCA                    cmp ecx, edx
:0047D5D7 7D05                    jge 0047D5DE
:0047D5D9 8BCA                    mov ecx, edx
:0047D5DB 894DF0                  mov dword ptr [ebp-10], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D5D7(C)
|
:0047D5DE 8BB628D14B00            mov esi, dword ptr [esi+004BD128]
:0047D5E4 3BC6                    cmp eax, esi
:0047D5E6 7E05                    jle 0047D5ED
:0047D5E8 8BC6                    mov eax, esi
:0047D5EA 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D5E6(C)
|
:0047D5ED 8B55F4                  mov edx, dword ptr [ebp-0C]
:0047D5F0 2BC1                    sub eax, ecx
:0047D5F2 40                      inc eax
:0047D5F3 6A01                    push 00000001
:0047D5F5 8BF0                    mov esi, eax
:0047D5F7 5F                      pop edi
:0047D5F8 8D45F0                  lea eax, dword ptr [ebp-10]
:0047D5FB 8955E4                  mov dword ptr [ebp-1C], edx
:0047D5FE 50                      push eax
:0047D5FF 894DE0                  mov dword ptr [ebp-20], ecx
:0047D602 E874010000              call 0047D77B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D586(U)
|
:0047D607 59                      pop ecx
:0047D608 EB6A                    jmp 0047D674

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D58B(C)
|
:0047D60A 8B45F0                  mov eax, dword ptr [ebp-10]
:0047D60D 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047D610 3BC1                    cmp eax, ecx
:0047D612 7D08                    jge 0047D61C
:0047D614 8945E0                  mov dword ptr [ebp-20], eax
:0047D617 894DE8                  mov dword ptr [ebp-18], ecx
:0047D61A EB06                    jmp 0047D622

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D612(C)
|
:0047D61C 894DE0                  mov dword ptr [ebp-20], ecx
:0047D61F 8945E8                  mov dword ptr [ebp-18], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D61A(U)
|
:0047D622 8B45F4                  mov eax, dword ptr [ebp-0C]
:0047D625 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047D628 3BC1                    cmp eax, ecx
:0047D62A 7D08                    jge 0047D634
:0047D62C 8945E4                  mov dword ptr [ebp-1C], eax
:0047D62F 894DEC                  mov dword ptr [ebp-14], ecx
:0047D632 EB06                    jmp 0047D63A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D62A(C)
|
:0047D634 894DE4                  mov dword ptr [ebp-1C], ecx
:0047D637 8945EC                  mov dword ptr [ebp-14], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D632(U)
|
:0047D63A A144D04B00              mov eax, dword ptr [004BD044]
:0047D63F C1E004                  shl eax, 04
:0047D642 0520D14B00              add eax, 004BD120
:0047D647 50                      push eax
:0047D648 8D45E0                  lea eax, dword ptr [ebp-20]
:0047D64B 50                      push eax
:0047D64C 8D45E0                  lea eax, dword ptr [ebp-20]
:0047D64F 50                      push eax
:0047D650 E834000000              call 0047D689
:0047D655 83C40C                  add esp, 0000000C
:0047D658 85C0                    test eax, eax
:0047D65A 7428                    je 0047D684
:0047D65C 8D45F0                  lea eax, dword ptr [ebp-10]
:0047D65F 50                      push eax
:0047D660 E8A4030000              call 0047DA09
:0047D665 8B75E8                  mov esi, dword ptr [ebp-18]
:0047D668 8B7DEC                  mov edi, dword ptr [ebp-14]
:0047D66B 2B75E0                  sub esi, dword ptr [ebp-20]
:0047D66E 2B7DE4                  sub edi, dword ptr [ebp-1C]
:0047D671 59                      pop ecx
:0047D672 46                      inc esi
:0047D673 47                      inc edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D608(U)
|
:0047D674 57                      push edi
:0047D675 56                      push esi
:0047D676 FF75E4                  push [ebp-1C]
:0047D679 FF75E0                  push [ebp-20]
:0047D67C E802F2FFFF              call 0047C883
:0047D681 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047D51E(C), :0047D52A(C), :0047D5A1(C), :0047D5AD(C), :0047D65A(C)
|
:0047D684 5F                      pop edi
:0047D685 5E                      pop esi
:0047D686 5B                      pop ebx
:0047D687 C9                      leave
:0047D688 C3                      ret



* Referenced by a CALL at Addresses:
|:0047D650   , :0047DC6B   , :0047DDAA   , :0047DF9A   , :0047E0F3   
|:0047E2A8   , :0047E3D9   
|
:0047D689 55                      push ebp
:0047D68A 8BEC                    mov ebp, esp
:0047D68C 53                      push ebx
:0047D68D 56                      push esi
:0047D68E 8B750C                  mov esi, dword ptr [ebp+0C]
:0047D691 57                      push edi
:0047D692 8B7D10                  mov edi, dword ptr [ebp+10]
:0047D695 8B4604                  mov eax, dword ptr [esi+04]
:0047D698 8B4F04                  mov ecx, dword ptr [edi+04]
:0047D69B 89450C                  mov dword ptr [ebp+0C], eax
:0047D69E 3BC1                    cmp eax, ecx
:0047D6A0 7F03                    jg 0047D6A5
:0047D6A2 894D0C                  mov dword ptr [ebp+0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D6A0(C)
|
:0047D6A5 8B4508                  mov eax, dword ptr [ebp+08]
:0047D6A8 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0047D6AB 894804                  mov dword ptr [eax+04], ecx
:0047D6AE 8B0E                    mov ecx, dword ptr [esi]
:0047D6B0 8B17                    mov edx, dword ptr [edi]
:0047D6B2 3BCA                    cmp ecx, edx
:0047D6B4 7E02                    jle 0047D6B8
:0047D6B6 8BD1                    mov edx, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D6B4(C)
|
:0047D6B8 895510                  mov dword ptr [ebp+10], edx
:0047D6BB 8910                    mov dword ptr [eax], edx
:0047D6BD 8B4E08                  mov ecx, dword ptr [esi+08]
:0047D6C0 8B5708                  mov edx, dword ptr [edi+08]
:0047D6C3 3BCA                    cmp ecx, edx
:0047D6C5 7C02                    jl 0047D6C9
:0047D6C7 8BCA                    mov ecx, edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D6C5(C)
|
:0047D6C9 894808                  mov dword ptr [eax+08], ecx
:0047D6CC 8B560C                  mov edx, dword ptr [esi+0C]
:0047D6CF 8B5F0C                  mov ebx, dword ptr [edi+0C]
:0047D6D2 3BD3                    cmp edx, ebx
:0047D6D4 7D02                    jge 0047D6D8
:0047D6D6 8BDA                    mov ebx, edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D6D4(C)
|
:0047D6D8 89580C                  mov dword ptr [eax+0C], ebx
:0047D6DB 8B4510                  mov eax, dword ptr [ebp+10]
:0047D6DE 03C1                    add eax, ecx
:0047D6E0 99                      cdq
:0047D6E1 2BC2                    sub eax, edx
:0047D6E3 8BC8                    mov ecx, eax
:0047D6E5 8B450C                  mov eax, dword ptr [ebp+0C]
:0047D6E8 03C3                    add eax, ebx
:0047D6EA 99                      cdq
:0047D6EB 2BC2                    sub eax, edx
:0047D6ED D1F9                    sar ecx, 1
:0047D6EF D1F8                    sar eax, 1
:0047D6F1 390E                    cmp dword ptr [esi], ecx
:0047D6F3 7F27                    jg 0047D71C
:0047D6F5 3B4E08                  cmp ecx, dword ptr [esi+08]
:0047D6F8 7F22                    jg 0047D71C
:0047D6FA 394604                  cmp dword ptr [esi+04], eax
:0047D6FD 7F1D                    jg 0047D71C
:0047D6FF 3B460C                  cmp eax, dword ptr [esi+0C]
:0047D702 7F18                    jg 0047D71C
:0047D704 390F                    cmp dword ptr [edi], ecx
:0047D706 7F14                    jg 0047D71C
:0047D708 3B4F08                  cmp ecx, dword ptr [edi+08]
:0047D70B 7F0F                    jg 0047D71C
:0047D70D 394704                  cmp dword ptr [edi+04], eax
:0047D710 7F0A                    jg 0047D71C
:0047D712 3B470C                  cmp eax, dword ptr [edi+0C]
:0047D715 7F05                    jg 0047D71C
:0047D717 6A01                    push 00000001
:0047D719 58                      pop eax
:0047D71A EB02                    jmp 0047D71E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047D6F3(C), :0047D6F8(C), :0047D6FD(C), :0047D702(C), :0047D706(C)
|:0047D70B(C), :0047D710(C), :0047D715(C)
|
:0047D71C 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D71A(U)
|
:0047D71E 5F                      pop edi
:0047D71F 5E                      pop esi
:0047D720 5B                      pop ebx
:0047D721 5D                      pop ebp
:0047D722 C3                      ret



* Referenced by a CALL at Addresses:
|:0047D500   , :0047DC31   
|
:0047D723 A144D04B00              mov eax, dword ptr [004BD044]
:0047D728 C1E002                  shl eax, 02
:0047D72B 8B88E0A34B00            mov ecx, dword ptr [eax+004BA3E0]
:0047D731 83F905                  cmp ecx, 00000005
:0047D734 7417                    je 0047D74D
:0047D736 8B90709C4B00            mov edx, dword ptr [eax+004B9C70]
:0047D73C 83F904                  cmp ecx, 00000004
:0047D73F 7504                    jne 0047D745
:0047D741 33C0                    xor eax, eax
:0047D743 EB14                    jmp 0047D759

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D73F(C)
|
:0047D745 8B80B8934B00            mov eax, dword ptr [eax+004B93B8]
:0047D74B EB0C                    jmp 0047D759

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D734(C)
|
:0047D74D 8B90B8934B00            mov edx, dword ptr [eax+004B93B8]
:0047D753 8B80709C4B00            mov eax, dword ptr [eax+004B9C70]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047D743(U), :0047D74B(U)
|
:0047D759 33C9                    xor ecx, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D778(C)
|
:0047D75B F644240580              test [esp+05], 80
:0047D760 7408                    je 0047D76A
:0047D762 8891E8784B00            mov byte ptr [ecx+004B78E8], dl
:0047D768 EB06                    jmp 0047D770

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D760(C)
|
:0047D76A 8881E8784B00            mov byte ptr [ecx+004B78E8], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D768(U)
|
:0047D770 D1642404                shl dword ptr [esp+04], 1
:0047D774 41                      inc ecx
:0047D775 83F910                  cmp ecx, 00000010
:0047D778 7CE1                    jl 0047D75B
:0047D77A C3                      ret



* Referenced by a CALL at Addresses:
|:0047D602   , :0047DFD3   , :0047E043   
|
:0047D77B 56                      push esi
:0047D77C 8B742408                mov esi, dword ptr [esp+08]
:0047D780 57                      push edi
:0047D781 FF7604                  push [esi+04]
:0047D784 FF36                    push dword ptr [esi]
:0047D786 E87DFBFFFF              call 0047D308
:0047D78B 59                      pop ecx
:0047D78C 59                      pop ecx
:0047D78D 8B0D44D04B00            mov ecx, dword ptr [004BD044]
:0047D793 8B0C8DE0A34B00          mov ecx, dword ptr [4*ecx+004BA3E0]
:0047D79A 83E900                  sub ecx, 00000000
:0047D79D 0F84D4000000            je 0047D877
:0047D7A3 49                      dec ecx
:0047D7A4 0F8490000000            je 0047D83A
:0047D7AA 49                      dec ecx
:0047D7AB 746A                    je 0047D817
:0047D7AD 49                      dec ecx
:0047D7AE 743D                    je 0047D7ED
:0047D7B0 49                      dec ecx
:0047D7B1 740C                    je 0047D7BF
:0047D7B3 49                      dec ecx
:0047D7B4 0F84BD000000            je 0047D877
:0047D7BA E9D9000000              jmp 0047D898

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D7B1(C)
|
:0047D7BF 8B4E08                  mov ecx, dword ptr [esi+08]
:0047D7C2 33D2                    xor edx, edx
:0047D7C4 2B0E                    sub ecx, dword ptr [esi]
:0047D7C6 0F88CC000000            js 0047D898

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D7E6(C)
|
:0047D7CC 8BCA                    mov ecx, edx
:0047D7CE 83E10F                  and ecx, 0000000F
:0047D7D1 8A89E8784B00            mov cl, byte ptr [ecx+004B78E8]
:0047D7D7 84C9                    test cl, cl
:0047D7D9 7402                    je 0047D7DD
:0047D7DB 8808                    mov byte ptr [eax], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D7D9(C)
|
:0047D7DD 8B4E08                  mov ecx, dword ptr [esi+08]
:0047D7E0 40                      inc eax
:0047D7E1 2B0E                    sub ecx, dword ptr [esi]
:0047D7E3 42                      inc edx
:0047D7E4 3BD1                    cmp edx, ecx
:0047D7E6 7EE4                    jle 0047D7CC
:0047D7E8 E9AB000000              jmp 0047D898

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D7AE(C)
|
:0047D7ED 8B5608                  mov edx, dword ptr [esi+08]
:0047D7F0 33C9                    xor ecx, ecx
:0047D7F2 2B16                    sub edx, dword ptr [esi]
:0047D7F4 0F889E000000            js 0047D898

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D810(C)
|
:0047D7FA 8BD1                    mov edx, ecx
:0047D7FC 83E20F                  and edx, 0000000F
:0047D7FF 8A92E8784B00            mov dl, byte ptr [edx+004B78E8]
:0047D805 0810                    or byte ptr [eax], dl
:0047D807 8B5608                  mov edx, dword ptr [esi+08]
:0047D80A 2B16                    sub edx, dword ptr [esi]
:0047D80C 40                      inc eax
:0047D80D 41                      inc ecx
:0047D80E 3BCA                    cmp ecx, edx
:0047D810 7EE8                    jle 0047D7FA
:0047D812 E981000000              jmp 0047D898

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D7AB(C)
|
:0047D817 8B5608                  mov edx, dword ptr [esi+08]
:0047D81A 33C9                    xor ecx, ecx
:0047D81C 2B16                    sub edx, dword ptr [esi]
:0047D81E 7878                    js 0047D898

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D836(C)
|
:0047D820 8BD1                    mov edx, ecx
:0047D822 83E20F                  and edx, 0000000F
:0047D825 8A92E8784B00            mov dl, byte ptr [edx+004B78E8]
:0047D82B 2010                    and byte ptr [eax], dl
:0047D82D 8B5608                  mov edx, dword ptr [esi+08]
:0047D830 2B16                    sub edx, dword ptr [esi]
:0047D832 40                      inc eax
:0047D833 41                      inc ecx
:0047D834 3BCA                    cmp ecx, edx
:0047D836 7EE8                    jle 0047D820
:0047D838 EB5E                    jmp 0047D898

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D7A4(C)
|
:0047D83A 8B4E08                  mov ecx, dword ptr [esi+08]
:0047D83D 33D2                    xor edx, edx
:0047D83F 2B0E                    sub ecx, dword ptr [esi]
:0047D841 7855                    js 0047D898

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D873(C)
|
:0047D843 8BCA                    mov ecx, edx
:0047D845 83E10F                  and ecx, 0000000F
:0047D848 8A89E8784B00            mov cl, byte ptr [ecx+004B78E8]
:0047D84E 3008                    xor byte ptr [eax], cl
:0047D850 8B3D44D04B00            mov edi, dword ptr [004BD044]
:0047D856 8A08                    mov cl, byte ptr [eax]
:0047D858 833CBDB8884B0007        cmp dword ptr [4*edi+004B88B8], 00000007
:0047D860 7408                    je 0047D86A
:0047D862 80E10F                  and cl, 0F
:0047D865 80C910                  or cl, 10
:0047D868 8808                    mov byte ptr [eax], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D860(C)
|
:0047D86A 8B4E08                  mov ecx, dword ptr [esi+08]
:0047D86D 40                      inc eax
:0047D86E 2B0E                    sub ecx, dword ptr [esi]
:0047D870 42                      inc edx
:0047D871 3BD1                    cmp edx, ecx
:0047D873 7ECE                    jle 0047D843
:0047D875 EB21                    jmp 0047D898

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047D79D(C), :0047D7B4(C)
|
:0047D877 8B5608                  mov edx, dword ptr [esi+08]
:0047D87A 33C9                    xor ecx, ecx
:0047D87C 2B16                    sub edx, dword ptr [esi]
:0047D87E 7818                    js 0047D898

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D896(C)
|
:0047D880 8BD1                    mov edx, ecx
:0047D882 83E20F                  and edx, 0000000F
:0047D885 8A92E8784B00            mov dl, byte ptr [edx+004B78E8]
:0047D88B 8810                    mov byte ptr [eax], dl
:0047D88D 8B5608                  mov edx, dword ptr [esi+08]
:0047D890 2B16                    sub edx, dword ptr [esi]
:0047D892 40                      inc eax
:0047D893 41                      inc ecx
:0047D894 3BCA                    cmp ecx, edx
:0047D896 7EE8                    jle 0047D880

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047D7BA(U), :0047D7C6(C), :0047D7E8(U), :0047D7F4(C), :0047D812(U)
|:0047D81E(C), :0047D838(U), :0047D841(C), :0047D875(U), :0047D87E(C)
|
:0047D898 5F                      pop edi
:0047D899 5E                      pop esi
:0047D89A C3                      ret



* Referenced by a CALL at Addresses:
|:0047D581   , :0047E008   , :0047E07F   
|
:0047D89B 56                      push esi
:0047D89C 8B742408                mov esi, dword ptr [esp+08]
:0047D8A0 57                      push edi
:0047D8A1 FF7604                  push [esi+04]
:0047D8A4 FF36                    push dword ptr [esi]
:0047D8A6 E85DFAFFFF              call 0047D308
:0047D8AB 59                      pop ecx
:0047D8AC 59                      pop ecx
:0047D8AD 8B0D44D04B00            mov ecx, dword ptr [004BD044]
:0047D8B3 8B0C8DE0A34B00          mov ecx, dword ptr [4*ecx+004BA3E0]
:0047D8BA 83E900                  sub ecx, 00000000
:0047D8BD 0F8414010000            je 0047D9D7
:0047D8C3 49                      dec ecx
:0047D8C4 0F84C2000000            je 0047D98C
:0047D8CA 49                      dec ecx
:0047D8CB 0F8486000000            je 0047D957
:0047D8D1 49                      dec ecx
:0047D8D2 744B                    je 0047D91F
:0047D8D4 49                      dec ecx
:0047D8D5 740C                    je 0047D8E3
:0047D8D7 49                      dec ecx
:0047D8D8 0F84F9000000            je 0047D9D7
:0047D8DE E923010000              jmp 0047DA06

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D8D5(C)
|
:0047D8E3 8B4E0C                  mov ecx, dword ptr [esi+0C]
:0047D8E6 33D2                    xor edx, edx
:0047D8E8 2B4E04                  sub ecx, dword ptr [esi+04]
:0047D8EB 0F8815010000            js 0047DA06

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D918(C)
|
:0047D8F1 8BCA                    mov ecx, edx
:0047D8F3 83E10F                  and ecx, 0000000F
:0047D8F6 8A89E8784B00            mov cl, byte ptr [ecx+004B78E8]
:0047D8FC 84C9                    test cl, cl
:0047D8FE 7402                    je 0047D902
:0047D900 8808                    mov byte ptr [eax], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D8FE(C)
|
:0047D902 8B0D44D04B00            mov ecx, dword ptr [004BD044]
:0047D908 03048D70A54B00          add eax, dword ptr [4*ecx+004BA570]
:0047D90F 8B4E0C                  mov ecx, dword ptr [esi+0C]
:0047D912 2B4E04                  sub ecx, dword ptr [esi+04]
:0047D915 42                      inc edx
:0047D916 3BD1                    cmp edx, ecx
:0047D918 7ED7                    jle 0047D8F1
:0047D91A E9E7000000              jmp 0047DA06

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D8D2(C)
|
:0047D91F 8B560C                  mov edx, dword ptr [esi+0C]
:0047D922 33C9                    xor ecx, ecx
:0047D924 2B5604                  sub edx, dword ptr [esi+04]
:0047D927 0F88D9000000            js 0047DA06

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D950(C)
|
:0047D92D 8BD1                    mov edx, ecx
:0047D92F 83E20F                  and edx, 0000000F
:0047D932 8A92E8784B00            mov dl, byte ptr [edx+004B78E8]
:0047D938 0810                    or byte ptr [eax], dl
:0047D93A 8B1544D04B00            mov edx, dword ptr [004BD044]
:0047D940 03049570A54B00          add eax, dword ptr [4*edx+004BA570]
:0047D947 8B560C                  mov edx, dword ptr [esi+0C]
:0047D94A 2B5604                  sub edx, dword ptr [esi+04]
:0047D94D 41                      inc ecx
:0047D94E 3BCA                    cmp ecx, edx
:0047D950 7EDB                    jle 0047D92D
:0047D952 E9AF000000              jmp 0047DA06

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D8CB(C)
|
:0047D957 8B560C                  mov edx, dword ptr [esi+0C]
:0047D95A 33C9                    xor ecx, ecx
:0047D95C 2B5604                  sub edx, dword ptr [esi+04]
:0047D95F 0F88A1000000            js 0047DA06

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D988(C)
|
:0047D965 8BD1                    mov edx, ecx
:0047D967 83E20F                  and edx, 0000000F
:0047D96A 8A92E8784B00            mov dl, byte ptr [edx+004B78E8]
:0047D970 2010                    and byte ptr [eax], dl
:0047D972 8B1544D04B00            mov edx, dword ptr [004BD044]
:0047D978 03049570A54B00          add eax, dword ptr [4*edx+004BA570]
:0047D97F 8B560C                  mov edx, dword ptr [esi+0C]
:0047D982 2B5604                  sub edx, dword ptr [esi+04]
:0047D985 41                      inc ecx
:0047D986 3BCA                    cmp ecx, edx
:0047D988 7EDB                    jle 0047D965
:0047D98A EB7A                    jmp 0047DA06

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D8C4(C)
|
:0047D98C 8B4E0C                  mov ecx, dword ptr [esi+0C]
:0047D98F 33D2                    xor edx, edx
:0047D991 2B4E04                  sub ecx, dword ptr [esi+04]
:0047D994 7870                    js 0047DA06

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D9D3(C)
|
:0047D996 8BCA                    mov ecx, edx
:0047D998 83E10F                  and ecx, 0000000F
:0047D99B 8A89E8784B00            mov cl, byte ptr [ecx+004B78E8]
:0047D9A1 3008                    xor byte ptr [eax], cl
:0047D9A3 8B3D44D04B00            mov edi, dword ptr [004BD044]
:0047D9A9 8A08                    mov cl, byte ptr [eax]
:0047D9AB 833CBDB8884B0007        cmp dword ptr [4*edi+004B88B8], 00000007
:0047D9B3 7408                    je 0047D9BD
:0047D9B5 80E10F                  and cl, 0F
:0047D9B8 80C910                  or cl, 10
:0047D9BB 8808                    mov byte ptr [eax], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047D9B3(C)
|
:0047D9BD 8B0D44D04B00            mov ecx, dword ptr [004BD044]
:0047D9C3 03048D70A54B00          add eax, dword ptr [4*ecx+004BA570]
:0047D9CA 8B4E0C                  mov ecx, dword ptr [esi+0C]
:0047D9CD 2B4E04                  sub ecx, dword ptr [esi+04]
:0047D9D0 42                      inc edx
:0047D9D1 3BD1                    cmp edx, ecx
:0047D9D3 7EC1                    jle 0047D996
:0047D9D5 EB2F                    jmp 0047DA06

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047D8BD(C), :0047D8D8(C)
|
:0047D9D7 8B560C                  mov edx, dword ptr [esi+0C]
:0047D9DA 33C9                    xor ecx, ecx
:0047D9DC 2B5604                  sub edx, dword ptr [esi+04]
:0047D9DF 7825                    js 0047DA06

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DA04(C)
|
:0047D9E1 8BD1                    mov edx, ecx
:0047D9E3 83E20F                  and edx, 0000000F
:0047D9E6 8A92E8784B00            mov dl, byte ptr [edx+004B78E8]
:0047D9EC 8810                    mov byte ptr [eax], dl
:0047D9EE 8B1544D04B00            mov edx, dword ptr [004BD044]
:0047D9F4 03049570A54B00          add eax, dword ptr [4*edx+004BA570]
:0047D9FB 8B560C                  mov edx, dword ptr [esi+0C]
:0047D9FE 2B5604                  sub edx, dword ptr [esi+04]
:0047DA01 41                      inc ecx
:0047DA02 3BCA                    cmp ecx, edx
:0047DA04 7EDB                    jle 0047D9E1

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047D8DE(U), :0047D8EB(C), :0047D91A(U), :0047D927(C), :0047D952(U)
|:0047D95F(C), :0047D98A(U), :0047D994(C), :0047D9D5(U), :0047D9DF(C)
|
:0047DA06 5F                      pop edi
:0047DA07 5E                      pop esi
:0047DA08 C3                      ret



* Referenced by a CALL at Address:
|:0047D660   
|
:0047DA09 55                      push ebp
:0047DA0A 8BEC                    mov ebp, esp
:0047DA0C 51                      push ecx
:0047DA0D 51                      push ecx
:0047DA0E 53                      push ebx
:0047DA0F 56                      push esi
:0047DA10 8B7508                  mov esi, dword ptr [ebp+08]
:0047DA13 57                      push edi
:0047DA14 8B7E08                  mov edi, dword ptr [esi+08]
:0047DA17 8B16                    mov edx, dword ptr [esi]
:0047DA19 8BC7                    mov eax, edi
:0047DA1B 2BC2                    sub eax, edx
:0047DA1D 8945FC                  mov dword ptr [ebp-04], eax
:0047DA20 7905                    jns 0047DA27
:0047DA22 F7D8                    neg eax
:0047DA24 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DA20(C)
|
:0047DA27 8B460C                  mov eax, dword ptr [esi+0C]
:0047DA2A 8B4E04                  mov ecx, dword ptr [esi+04]
:0047DA2D 8BD8                    mov ebx, eax
:0047DA2F 2BD9                    sub ebx, ecx
:0047DA31 895DF8                  mov dword ptr [ebp-08], ebx
:0047DA34 7905                    jns 0047DA3B
:0047DA36 F7DB                    neg ebx
:0047DA38 895DF8                  mov dword ptr [ebp-08], ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DA34(C)
|
:0047DA3B 395DFC                  cmp dword ptr [ebp-04], ebx
:0047DA3E 7E72                    jle 0047DAB2
:0047DA40 33DB                    xor ebx, ebx
:0047DA42 3BC8                    cmp ecx, eax
:0047DA44 0F9DC3                  setnl bl
:0047DA47 4B                      dec ebx
:0047DA48 83E302                  and ebx, 00000002
:0047DA4B 4B                      dec ebx
:0047DA4C 3BD7                    cmp edx, edi
:0047DA4E 7E0D                    jle 0047DA5D
:0047DA50 893E                    mov dword ptr [esi], edi
:0047DA52 895608                  mov dword ptr [esi+08], edx
:0047DA55 894604                  mov dword ptr [esi+04], eax
:0047DA58 894E0C                  mov dword ptr [esi+0C], ecx
:0047DA5B F7DB                    neg ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DA4E(C)
|
:0047DA5D A0E8784B00              mov al, byte ptr [004B78E8]
:0047DA62 50                      push eax
:0047DA63 FF7604                  push [esi+04]
:0047DA66 FF36                    push dword ptr [esi]
:0047DA68 E8B8000000              call 0047DB25
:0047DA6D 8B7DFC                  mov edi, dword ptr [ebp-04]
:0047DA70 83C40C                  add esp, 0000000C
:0047DA73 C7450801000000          mov [ebp+08], 00000001
:0047DA7A D1FF                    sar edi, 1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DAB0(U)
|
:0047DA7C FF06                    inc dword ptr [esi]
:0047DA7E 8B06                    mov eax, dword ptr [esi]
:0047DA80 3B4608                  cmp eax, dword ptr [esi+08]
:0047DA83 0F8F97000000            jg 0047DB20
:0047DA89 2B7DF8                  sub edi, dword ptr [ebp-08]
:0047DA8C 7906                    jns 0047DA94
:0047DA8E 037DFC                  add edi, dword ptr [ebp-04]
:0047DA91 015E04                  add dword ptr [esi+04], ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DA8C(C)
|
:0047DA94 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047DA97 83E10F                  and ecx, 0000000F
:0047DA9A 8A89E8784B00            mov cl, byte ptr [ecx+004B78E8]
:0047DAA0 51                      push ecx
:0047DAA1 FF7604                  push [esi+04]
:0047DAA4 50                      push eax
:0047DAA5 E87B000000              call 0047DB25
:0047DAAA 83C40C                  add esp, 0000000C
:0047DAAD FF4508                  inc [ebp+08]
:0047DAB0 EBCA                    jmp 0047DA7C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DA3E(C)
|
:0047DAB2 33DB                    xor ebx, ebx
:0047DAB4 3BD7                    cmp edx, edi
:0047DAB6 0F9DC3                  setnl bl
:0047DAB9 4B                      dec ebx
:0047DABA 83E302                  and ebx, 00000002
:0047DABD 4B                      dec ebx
:0047DABE 3BC8                    cmp ecx, eax
:0047DAC0 7E0D                    jle 0047DACF
:0047DAC2 894604                  mov dword ptr [esi+04], eax
:0047DAC5 894E0C                  mov dword ptr [esi+0C], ecx
:0047DAC8 893E                    mov dword ptr [esi], edi
:0047DACA 895608                  mov dword ptr [esi+08], edx
:0047DACD F7DB                    neg ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DAC0(C)
|
:0047DACF A0E8784B00              mov al, byte ptr [004B78E8]
:0047DAD4 50                      push eax
:0047DAD5 FF7604                  push [esi+04]
:0047DAD8 FF36                    push dword ptr [esi]
:0047DADA E846000000              call 0047DB25
:0047DADF 8B7DF8                  mov edi, dword ptr [ebp-08]
:0047DAE2 83C40C                  add esp, 0000000C
:0047DAE5 C7450801000000          mov [ebp+08], 00000001
:0047DAEC D1FF                    sar edi, 1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DB1E(U)
|
:0047DAEE FF4604                  inc [esi+04]
:0047DAF1 8B4604                  mov eax, dword ptr [esi+04]
:0047DAF4 3B460C                  cmp eax, dword ptr [esi+0C]
:0047DAF7 7F27                    jg 0047DB20
:0047DAF9 2B7DFC                  sub edi, dword ptr [ebp-04]
:0047DAFC 7905                    jns 0047DB03
:0047DAFE 037DF8                  add edi, dword ptr [ebp-08]
:0047DB01 011E                    add dword ptr [esi], ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DAFC(C)
|
:0047DB03 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047DB06 83E10F                  and ecx, 0000000F
:0047DB09 8A89E8784B00            mov cl, byte ptr [ecx+004B78E8]
:0047DB0F 51                      push ecx
:0047DB10 50                      push eax
:0047DB11 FF36                    push dword ptr [esi]
:0047DB13 E80D000000              call 0047DB25
:0047DB18 83C40C                  add esp, 0000000C
:0047DB1B FF4508                  inc [ebp+08]
:0047DB1E EBCE                    jmp 0047DAEE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047DA83(C), :0047DAF7(C)
|
:0047DB20 5F                      pop edi
:0047DB21 5E                      pop esi
:0047DB22 5B                      pop ebx
:0047DB23 C9                      leave
:0047DB24 C3                      ret



* Referenced by a CALL at Addresses:
|:0047DA68   , :0047DAA5   , :0047DADA   , :0047DB13   
|
:0047DB25 55                      push ebp
:0047DB26 8BEC                    mov ebp, esp
:0047DB28 A144D04B00              mov eax, dword ptr [004BD044]
:0047DB2D 8B5508                  mov edx, dword ptr [ebp+08]
:0047DB30 C1E004                  shl eax, 04
:0047DB33 3B9020D14B00            cmp edx, dword ptr [eax+004BD120]
:0047DB39 0F8C82000000            jl 0047DBC1
:0047DB3F 3B9028D14B00            cmp edx, dword ptr [eax+004BD128]
:0047DB45 7F7A                    jg 0047DBC1
:0047DB47 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0047DB4A 3B8824D14B00            cmp ecx, dword ptr [eax+004BD124]
:0047DB50 7C6F                    jl 0047DBC1
:0047DB52 3B882CD14B00            cmp ecx, dword ptr [eax+004BD12C]
:0047DB58 7F67                    jg 0047DBC1
:0047DB5A 51                      push ecx
:0047DB5B 52                      push edx
:0047DB5C E8A7F7FFFF              call 0047D308
:0047DB61 59                      pop ecx
:0047DB62 59                      pop ecx
:0047DB63 8B0D44D04B00            mov ecx, dword ptr [004BD044]
:0047DB69 8B0C8DE0A34B00          mov ecx, dword ptr [4*ecx+004BA3E0]
:0047DB70 83E900                  sub ecx, 00000000
:0047DB73 7447                    je 0047DBBC
:0047DB75 49                      dec ecx
:0047DB76 7425                    je 0047DB9D
:0047DB78 49                      dec ecx
:0047DB79 741B                    je 0047DB96
:0047DB7B 49                      dec ecx
:0047DB7C 7411                    je 0047DB8F
:0047DB7E 49                      dec ecx
:0047DB7F 7405                    je 0047DB86
:0047DB81 49                      dec ecx
:0047DB82 7438                    je 0047DBBC
:0047DB84 5D                      pop ebp
:0047DB85 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DB7F(C)
|
:0047DB86 8A4D10                  mov cl, byte ptr [ebp+10]
:0047DB89 84C9                    test cl, cl
:0047DB8B 7434                    je 0047DBC1
:0047DB8D EB30                    jmp 0047DBBF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DB7C(C)
|
:0047DB8F 8A4D10                  mov cl, byte ptr [ebp+10]
:0047DB92 0808                    or byte ptr [eax], cl
:0047DB94 5D                      pop ebp
:0047DB95 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DB79(C)
|
:0047DB96 8A4D10                  mov cl, byte ptr [ebp+10]
:0047DB99 2008                    and byte ptr [eax], cl
:0047DB9B 5D                      pop ebp
:0047DB9C C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DB76(C)
|
:0047DB9D 8A4D10                  mov cl, byte ptr [ebp+10]
:0047DBA0 3008                    xor byte ptr [eax], cl
:0047DBA2 8B1544D04B00            mov edx, dword ptr [004BD044]
:0047DBA8 8A08                    mov cl, byte ptr [eax]
:0047DBAA 833C95B8884B0007        cmp dword ptr [4*edx+004B88B8], 00000007
:0047DBB2 740D                    je 0047DBC1
:0047DBB4 80E10F                  and cl, 0F
:0047DBB7 80C910                  or cl, 10
:0047DBBA EB03                    jmp 0047DBBF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047DB73(C), :0047DB82(C)
|
:0047DBBC 8A4D10                  mov cl, byte ptr [ebp+10]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047DB8D(U), :0047DBBA(U)
|
:0047DBBF 8808                    mov byte ptr [eax], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047DB39(C), :0047DB45(C), :0047DB50(C), :0047DB58(C), :0047DB8B(C)
|:0047DBB2(C)
|
:0047DBC1 5D                      pop ebp
:0047DBC2 C3                      ret



* Referenced by a CALL at Addresses:
|:0041E6D8   , :00443396   , :00443424   , :0044A58F   , :0044A6A2   
|:00450FB8   , :0045103F   , :0045123A   , :004613D6   , :00473ABF   
|:00473B6C   , :00473BA4   , :00473BDC   , :00473C50   , :00473CFF   
|:00473D40   , :00473D85   , :00473F79   , :00473FBA   , :00473FFF   
|:00476299   , :004763B4   , :004763F2   , :00476597   , :0047669A   
|:004767D7   , :0047683B   
|
:0047DBC3 55                      push ebp
:0047DBC4 8BEC                    mov ebp, esp
:0047DBC6 83EC10                  sub esp, 00000010
:0047DBC9 A144D04B00              mov eax, dword ptr [004BD044]
:0047DBCE 8B5508                  mov edx, dword ptr [ebp+08]
:0047DBD1 C1E003                  shl eax, 03
:0047DBD4 56                      push esi
:0047DBD5 8B750C                  mov esi, dword ptr [ebp+0C]
:0047DBD8 8B8898854B00            mov ecx, dword ptr [eax+004B8598]
:0047DBDE 8B809C854B00            mov eax, dword ptr [eax+004B859C]
:0047DBE4 57                      push edi
:0047DBE5 8B7D10                  mov edi, dword ptr [ebp+10]
:0047DBE8 03D1                    add edx, ecx
:0047DBEA 03CF                    add ecx, edi
:0047DBEC 8B7D14                  mov edi, dword ptr [ebp+14]
:0047DBEF 03F0                    add esi, eax
:0047DBF1 03C7                    add eax, edi
:0047DBF3 3BD1                    cmp edx, ecx
:0047DBF5 8955F0                  mov dword ptr [ebp-10], edx
:0047DBF8 8975F4                  mov dword ptr [ebp-0C], esi
:0047DBFB 894DF8                  mov dword ptr [ebp-08], ecx
:0047DBFE 8945FC                  mov dword ptr [ebp-04], eax
:0047DC01 7E06                    jle 0047DC09
:0047DC03 894DF0                  mov dword ptr [ebp-10], ecx
:0047DC06 8955F8                  mov dword ptr [ebp-08], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DC01(C)
|
:0047DC09 3BF0                    cmp esi, eax
:0047DC0B 7E06                    jle 0047DC13
:0047DC0D 8945F4                  mov dword ptr [ebp-0C], eax
:0047DC10 8975FC                  mov dword ptr [ebp-04], esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DC0B(C)
|
:0047DC13 8B4518                  mov eax, dword ptr [ebp+18]
:0047DC16 83E800                  sub eax, 00000000
:0047DC19 7427                    je 0047DC42
:0047DC1B 48                      dec eax
:0047DC1C 740E                    je 0047DC2C
:0047DC1E 48                      dec eax
:0047DC1F 752B                    jne 0047DC4C
:0047DC21 8D45F0                  lea eax, dword ptr [ebp-10]
:0047DC24 50                      push eax
:0047DC25 E865010000              call 0047DD8F
:0047DC2A EB1F                    jmp 0047DC4B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DC1C(C)
|
:0047DC2C 68FFFF0000              push 0000FFFF
:0047DC31 E8EDFAFFFF              call 0047D723
:0047DC36 59                      pop ecx
:0047DC37 8D45F0                  lea eax, dword ptr [ebp-10]
:0047DC3A 50                      push eax
:0047DC3B E83B030000              call 0047DF7B
:0047DC40 EB09                    jmp 0047DC4B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DC19(C)
|
:0047DC42 8D45F0                  lea eax, dword ptr [ebp-10]
:0047DC45 50                      push eax
:0047DC46 E805000000              call 0047DC50

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047DC2A(U), :0047DC40(U)
|
:0047DC4B 59                      pop ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DC1F(C)
|
:0047DC4C 5F                      pop edi
:0047DC4D 5E                      pop esi
:0047DC4E C9                      leave
:0047DC4F C3                      ret



* Referenced by a CALL at Address:
|:0047DC46   
|
:0047DC50 55                      push ebp
:0047DC51 8BEC                    mov ebp, esp
:0047DC53 83EC18                  sub esp, 00000018
:0047DC56 A144D04B00              mov eax, dword ptr [004BD044]
:0047DC5B C1E004                  shl eax, 04
:0047DC5E 0520D14B00              add eax, 004BD120
:0047DC63 50                      push eax
:0047DC64 8D45E8                  lea eax, dword ptr [ebp-18]
:0047DC67 FF7508                  push [ebp+08]
:0047DC6A 50                      push eax
:0047DC6B E819FAFFFF              call 0047D689
:0047DC70 83C40C                  add esp, 0000000C
:0047DC73 85C0                    test eax, eax
:0047DC75 0F8412010000            je 0047DD8D
:0047DC7B 57                      push edi
:0047DC7C 8B7DF4                  mov edi, dword ptr [ebp-0C]
:0047DC7F 2B7DEC                  sub edi, dword ptr [ebp-14]
:0047DC82 56                      push esi
:0047DC83 8B75F0                  mov esi, dword ptr [ebp-10]
:0047DC86 53                      push ebx
:0047DC87 FF75EC                  push [ebp-14]
:0047DC8A 2B75E8                  sub esi, dword ptr [ebp-18]
:0047DC8D FF75E8                  push [ebp-18]
:0047DC90 46                      inc esi
:0047DC91 47                      inc edi
:0047DC92 E871F6FFFF              call 0047D308
:0047DC97 59                      pop ecx
:0047DC98 59                      pop ecx
:0047DC99 8B0D44D04B00            mov ecx, dword ptr [004BD044]
:0047DC9F C1E102                  shl ecx, 02
:0047DCA2 8A91709C4B00            mov dl, byte ptr [ecx+004B9C70]
:0047DCA8 8B9970A54B00            mov ebx, dword ptr [ecx+004BA570]
:0047DCAE 885508                  mov byte ptr [ebp+08], dl
:0047DCB1 8B91E0A34B00            mov edx, dword ptr [ecx+004BA3E0]
:0047DCB7 895DF8                  mov dword ptr [ebp-08], ebx
:0047DCBA 2BDE                    sub ebx, esi
:0047DCBC 83EA00                  sub edx, 00000000
:0047DCBF 0F84A0000000            je 0047DD65
:0047DCC5 4A                      dec edx
:0047DCC6 7461                    je 0047DD29
:0047DCC8 4A                      dec edx
:0047DCC9 743F                    je 0047DD0A
:0047DCCB 4A                      dec edx
:0047DCCC 7419                    je 0047DCE7
:0047DCCE 4A                      dec edx
:0047DCCF 0F8490000000            je 0047DD65
:0047DCD5 4A                      dec edx
:0047DCD6 0F859E000000            jne 0047DD7A
:0047DCDC 8A89B8934B00            mov cl, byte ptr [ecx+004B93B8]
:0047DCE2 E981000000              jmp 0047DD68

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DCCC(C)
|
:0047DCE7 85FF                    test edi, edi
:0047DCE9 0F8E8B000000            jle 0047DD7A
:0047DCEF 897DFC                  mov dword ptr [ebp-04], edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DD06(C)
|
:0047DCF2 85F6                    test esi, esi
:0047DCF4 7E0B                    jle 0047DD01
:0047DCF6 8BCE                    mov ecx, esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DCFF(C)
|
:0047DCF8 8A5508                  mov dl, byte ptr [ebp+08]
:0047DCFB 0810                    or byte ptr [eax], dl
:0047DCFD 40                      inc eax
:0047DCFE 49                      dec ecx
:0047DCFF 75F7                    jne 0047DCF8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DCF4(C)
|
:0047DD01 03C3                    add eax, ebx
:0047DD03 FF4DFC                  dec [ebp-04]
:0047DD06 75EA                    jne 0047DCF2
:0047DD08 EB70                    jmp 0047DD7A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DCC9(C)
|
:0047DD0A 85FF                    test edi, edi
:0047DD0C 7E6C                    jle 0047DD7A
:0047DD0E 897DFC                  mov dword ptr [ebp-04], edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DD25(C)
|
:0047DD11 85F6                    test esi, esi
:0047DD13 7E0B                    jle 0047DD20
:0047DD15 8BCE                    mov ecx, esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DD1E(C)
|
:0047DD17 8A5508                  mov dl, byte ptr [ebp+08]
:0047DD1A 2010                    and byte ptr [eax], dl
:0047DD1C 40                      inc eax
:0047DD1D 49                      dec ecx
:0047DD1E 75F7                    jne 0047DD17

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DD13(C)
|
:0047DD20 03C3                    add eax, ebx
:0047DD22 FF4DFC                  dec [ebp-04]
:0047DD25 75EA                    jne 0047DD11
:0047DD27 EB51                    jmp 0047DD7A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DCC6(C)
|
:0047DD29 85FF                    test edi, edi
:0047DD2B 7E4D                    jle 0047DD7A
:0047DD2D 897DF8                  mov dword ptr [ebp-08], edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DD61(C)
|
:0047DD30 85F6                    test esi, esi
:0047DD32 7E28                    jle 0047DD5C
:0047DD34 8975FC                  mov dword ptr [ebp-04], esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DD5A(C)
|
:0047DD37 8A4D08                  mov cl, byte ptr [ebp+08]
:0047DD3A 3008                    xor byte ptr [eax], cl
:0047DD3C 8B1544D04B00            mov edx, dword ptr [004BD044]
:0047DD42 8A08                    mov cl, byte ptr [eax]
:0047DD44 833C95B8884B0007        cmp dword ptr [4*edx+004B88B8], 00000007
:0047DD4C 7408                    je 0047DD56
:0047DD4E 80E10F                  and cl, 0F
:0047DD51 80C910                  or cl, 10
:0047DD54 8808                    mov byte ptr [eax], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DD4C(C)
|
:0047DD56 40                      inc eax
:0047DD57 FF4DFC                  dec [ebp-04]
:0047DD5A 75DB                    jne 0047DD37

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DD32(C)
|
:0047DD5C 03C3                    add eax, ebx
:0047DD5E FF4DF8                  dec [ebp-08]
:0047DD61 75CD                    jne 0047DD30
:0047DD63 EB15                    jmp 0047DD7A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047DCBF(C), :0047DCCF(C)
|
:0047DD65 8A4D08                  mov cl, byte ptr [ebp+08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DCE2(U)
|
:0047DD68 50                      push eax
:0047DD69 0FB6C1                  movzx eax, cl
:0047DD6C 50                      push eax
:0047DD6D FF75F8                  push [ebp-08]
:0047DD70 57                      push edi
:0047DD71 56                      push esi
:0047DD72 E8A6180000              call 0047F61D
:0047DD77 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047DCD6(C), :0047DCE9(C), :0047DD08(U), :0047DD0C(C), :0047DD27(U)
|:0047DD2B(C), :0047DD63(U)
|
:0047DD7A 57                      push edi
:0047DD7B 56                      push esi
:0047DD7C FF75EC                  push [ebp-14]
:0047DD7F FF75E8                  push [ebp-18]
:0047DD82 E8FCEAFFFF              call 0047C883
:0047DD87 83C410                  add esp, 00000010
:0047DD8A 5B                      pop ebx
:0047DD8B 5E                      pop esi
:0047DD8C 5F                      pop edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DC75(C)
|
:0047DD8D C9                      leave
:0047DD8E C3                      ret



* Referenced by a CALL at Address:
|:0047DC25   
|
:0047DD8F 55                      push ebp
:0047DD90 8BEC                    mov ebp, esp
:0047DD92 83EC18                  sub esp, 00000018
:0047DD95 A144D04B00              mov eax, dword ptr [004BD044]
:0047DD9A C1E004                  shl eax, 04
:0047DD9D 0520D14B00              add eax, 004BD120
:0047DDA2 50                      push eax
:0047DDA3 8D45E8                  lea eax, dword ptr [ebp-18]
:0047DDA6 FF7508                  push [ebp+08]
:0047DDA9 50                      push eax
:0047DDAA E8DAF8FFFF              call 0047D689
:0047DDAF 83C40C                  add esp, 0000000C
:0047DDB2 85C0                    test eax, eax
:0047DDB4 747A                    je 0047DE30
:0047DDB6 8B45F4                  mov eax, dword ptr [ebp-0C]
:0047DDB9 57                      push edi
:0047DDBA 2B45EC                  sub eax, dword ptr [ebp-14]
:0047DDBD 56                      push esi
:0047DDBE 8B75F0                  mov esi, dword ptr [ebp-10]
:0047DDC1 53                      push ebx
:0047DDC2 2B75E8                  sub esi, dword ptr [ebp-18]
:0047DDC5 FF75EC                  push [ebp-14]
:0047DDC8 FF75E8                  push [ebp-18]
:0047DDCB 46                      inc esi
:0047DDCC 40                      inc eax
:0047DDCD 8975F8                  mov dword ptr [ebp-08], esi
:0047DDD0 8945FC                  mov dword ptr [ebp-04], eax
:0047DDD3 E830F5FFFF              call 0047D308
:0047DDD8 59                      pop ecx
:0047DDD9 59                      pop ecx
:0047DDDA 8BC8                    mov ecx, eax
:0047DDDC A144D04B00              mov eax, dword ptr [004BD044]
:0047DDE1 C1E002                  shl eax, 02
:0047DDE4 8B9870A54B00            mov ebx, dword ptr [eax+004BA570]
:0047DDEA 8B80E0A34B00            mov eax, dword ptr [eax+004BA3E0]
:0047DDF0 2BDE                    sub ebx, esi
:0047DDF2 83E800                  sub eax, 00000000
:0047DDF5 895D08                  mov dword ptr [ebp+08], ebx
:0047DDF8 0F843F010000            je 0047DF3D
:0047DDFE 48                      dec eax
:0047DDFF 0F84E1000000            je 0047DEE6
:0047DE05 48                      dec eax
:0047DE06 0F849C000000            je 0047DEA8
:0047DE0C 48                      dec eax
:0047DE0D 745F                    je 0047DE6E
:0047DE0F 48                      dec eax
:0047DE10 7420                    je 0047DE32
:0047DE12 48                      dec eax
:0047DE13 0F8424010000            je 0047DF3D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047DE38(C), :0047DE74(C), :0047DEAE(C), :0047DEEC(C), :0047DF43(C)
|
:0047DE19 FF75FC                  push [ebp-04]
:0047DE1C FF75F8                  push [ebp-08]
:0047DE1F FF75EC                  push [ebp-14]
:0047DE22 FF75E8                  push [ebp-18]
:0047DE25 E859EAFFFF              call 0047C883
:0047DE2A 83C410                  add esp, 00000010
:0047DE2D 5B                      pop ebx
:0047DE2E 5E                      pop esi
:0047DE2F 5F                      pop edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DDB4(C)
|
:0047DE30 C9                      leave
:0047DE31 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DE10(C)
|
:0047DE32 8B7DEC                  mov edi, dword ptr [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DE6C(U)
|
:0047DE35 3B7DF4                  cmp edi, dword ptr [ebp-0C]
:0047DE38 7FDF                    jg 0047DE19
:0047DE3A 8B75E8                  mov esi, dword ptr [ebp-18]
:0047DE3D 8BC7                    mov eax, edi
:0047DE3F 99                      cdq
:0047DE40 F73D60D74B00            idiv dword ptr [004BD760]
:0047DE46 8B45F0                  mov eax, dword ptr [ebp-10]
:0047DE49 3BF0                    cmp esi, eax
:0047DE4B 7F1C                    jg 0047DE69
:0047DE4D C1E203                  shl edx, 03

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DE67(C)
|
:0047DE50 8BC6                    mov eax, esi
:0047DE52 83E007                  and eax, 00000007
:0047DE55 8A841060D04B00          mov al, byte ptr [eax+edx+004BD060]
:0047DE5C 84C0                    test al, al
:0047DE5E 7402                    je 0047DE62
:0047DE60 8801                    mov byte ptr [ecx], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DE5E(C)
|
:0047DE62 41                      inc ecx
:0047DE63 46                      inc esi
:0047DE64 3B75F0                  cmp esi, dword ptr [ebp-10]
:0047DE67 7EE7                    jle 0047DE50

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DE4B(C)
|
:0047DE69 03CB                    add ecx, ebx
:0047DE6B 47                      inc edi
:0047DE6C EBC7                    jmp 0047DE35

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DE0D(C)
|
:0047DE6E 8B7DEC                  mov edi, dword ptr [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DEA6(U)
|
:0047DE71 3B7DF4                  cmp edi, dword ptr [ebp-0C]
:0047DE74 7FA3                    jg 0047DE19
:0047DE76 8B75E8                  mov esi, dword ptr [ebp-18]
:0047DE79 8BC7                    mov eax, edi
:0047DE7B 99                      cdq
:0047DE7C F73D60D74B00            idiv dword ptr [004BD760]
:0047DE82 8B45F0                  mov eax, dword ptr [ebp-10]
:0047DE85 3BF0                    cmp esi, eax
:0047DE87 7F1A                    jg 0047DEA3
:0047DE89 8BC2                    mov eax, edx
:0047DE8B C1E003                  shl eax, 03

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DEA1(C)
|
:0047DE8E 8BD6                    mov edx, esi
:0047DE90 83E207                  and edx, 00000007
:0047DE93 8A940260D04B00          mov dl, byte ptr [edx+eax+004BD060]
:0047DE9A 0811                    or byte ptr [ecx], dl
:0047DE9C 41                      inc ecx
:0047DE9D 46                      inc esi
:0047DE9E 3B75F0                  cmp esi, dword ptr [ebp-10]
:0047DEA1 7EEB                    jle 0047DE8E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DE87(C)
|
:0047DEA3 03CB                    add ecx, ebx
:0047DEA5 47                      inc edi
:0047DEA6 EBC9                    jmp 0047DE71

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DE06(C)
|
:0047DEA8 8B7DEC                  mov edi, dword ptr [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DEE4(U)
|
:0047DEAB 3B7DF4                  cmp edi, dword ptr [ebp-0C]
:0047DEAE 0F8F65FFFFFF            jg 0047DE19
:0047DEB4 8B75E8                  mov esi, dword ptr [ebp-18]
:0047DEB7 8BC7                    mov eax, edi
:0047DEB9 99                      cdq
:0047DEBA F73D60D74B00            idiv dword ptr [004BD760]
:0047DEC0 8B45F0                  mov eax, dword ptr [ebp-10]
:0047DEC3 3BF0                    cmp esi, eax
:0047DEC5 7F1A                    jg 0047DEE1
:0047DEC7 8BC2                    mov eax, edx
:0047DEC9 C1E003                  shl eax, 03

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DEDF(C)
|
:0047DECC 8BD6                    mov edx, esi
:0047DECE 83E207                  and edx, 00000007
:0047DED1 8A940260D04B00          mov dl, byte ptr [edx+eax+004BD060]
:0047DED8 2011                    and byte ptr [ecx], dl
:0047DEDA 41                      inc ecx
:0047DEDB 46                      inc esi
:0047DEDC 3B75F0                  cmp esi, dword ptr [ebp-10]
:0047DEDF 7EEB                    jle 0047DECC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DEC5(C)
|
:0047DEE1 03CB                    add ecx, ebx
:0047DEE3 47                      inc edi
:0047DEE4 EBC5                    jmp 0047DEAB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DDFF(C)
|
:0047DEE6 8B7DEC                  mov edi, dword ptr [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DF3B(U)
|
:0047DEE9 3B7DF4                  cmp edi, dword ptr [ebp-0C]
:0047DEEC 0F8F27FFFFFF            jg 0047DE19
:0047DEF2 8B75E8                  mov esi, dword ptr [ebp-18]
:0047DEF5 8BC7                    mov eax, edi
:0047DEF7 99                      cdq
:0047DEF8 F73D60D74B00            idiv dword ptr [004BD760]
:0047DEFE 8B45F0                  mov eax, dword ptr [ebp-10]
:0047DF01 3BF0                    cmp esi, eax
:0047DF03 7F33                    jg 0047DF38
:0047DF05 C1E203                  shl edx, 03

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DF33(C)
|
:0047DF08 8BC6                    mov eax, esi
:0047DF0A 83E007                  and eax, 00000007
:0047DF0D 8A841060D04B00          mov al, byte ptr [eax+edx+004BD060]
:0047DF14 3001                    xor byte ptr [ecx], al
:0047DF16 8B1D44D04B00            mov ebx, dword ptr [004BD044]
:0047DF1C 8A01                    mov al, byte ptr [ecx]
:0047DF1E 833C9DB8884B0007        cmp dword ptr [4*ebx+004B88B8], 00000007
:0047DF26 7406                    je 0047DF2E
:0047DF28 240F                    and al, 0F
:0047DF2A 0C10                    or al, 10
:0047DF2C 8801                    mov byte ptr [ecx], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DF26(C)
|
:0047DF2E 41                      inc ecx
:0047DF2F 46                      inc esi
:0047DF30 3B75F0                  cmp esi, dword ptr [ebp-10]
:0047DF33 7ED3                    jle 0047DF08
:0047DF35 8B5D08                  mov ebx, dword ptr [ebp+08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DF03(C)
|
:0047DF38 03CB                    add ecx, ebx
:0047DF3A 47                      inc edi
:0047DF3B EBAC                    jmp 0047DEE9

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047DDF8(C), :0047DE13(C)
|
:0047DF3D 8B7DEC                  mov edi, dword ptr [ebp-14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DF79(U)
|
:0047DF40 3B7DF4                  cmp edi, dword ptr [ebp-0C]
:0047DF43 0F8FD0FEFFFF            jg 0047DE19
:0047DF49 8B75E8                  mov esi, dword ptr [ebp-18]
:0047DF4C 8BC7                    mov eax, edi
:0047DF4E 99                      cdq
:0047DF4F F73D60D74B00            idiv dword ptr [004BD760]
:0047DF55 8B45F0                  mov eax, dword ptr [ebp-10]
:0047DF58 3BF0                    cmp esi, eax
:0047DF5A 7F1A                    jg 0047DF76
:0047DF5C 8BC2                    mov eax, edx
:0047DF5E C1E003                  shl eax, 03

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DF74(C)
|
:0047DF61 8BD6                    mov edx, esi
:0047DF63 83E207                  and edx, 00000007
:0047DF66 8A940260D04B00          mov dl, byte ptr [edx+eax+004BD060]
:0047DF6D 8811                    mov byte ptr [ecx], dl
:0047DF6F 41                      inc ecx
:0047DF70 46                      inc esi
:0047DF71 3B75F0                  cmp esi, dword ptr [ebp-10]
:0047DF74 7EEB                    jle 0047DF61

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047DF5A(C)
|
:0047DF76 03CB                    add ecx, ebx
:0047DF78 47                      inc edi
:0047DF79 EBC5                    jmp 0047DF40

* Referenced by a CALL at Address:
|:0047DC3B   
|
:0047DF7B 55                      push ebp
:0047DF7C 8BEC                    mov ebp, esp
:0047DF7E 83EC10                  sub esp, 00000010
:0047DF81 A144D04B00              mov eax, dword ptr [004BD044]
:0047DF86 53                      push ebx
:0047DF87 C1E004                  shl eax, 04
:0047DF8A 56                      push esi
:0047DF8B 8B7508                  mov esi, dword ptr [ebp+08]
:0047DF8E 0520D14B00              add eax, 004BD120
:0047DF93 57                      push edi
:0047DF94 50                      push eax
:0047DF95 8D45F0                  lea eax, dword ptr [ebp-10]
:0047DF98 56                      push esi
:0047DF99 50                      push eax
:0047DF9A E8EAF6FFFF              call 0047D689
:0047DF9F 83C40C                  add esp, 0000000C
:0047DFA2 85C0                    test eax, eax
:0047DFA4 0F84EC000000            je 0047E096
:0047DFAA 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047DFAD 8B45FC                  mov eax, dword ptr [ebp-04]
:0047DFB0 8B55F4                  mov edx, dword ptr [ebp-0C]
:0047DFB3 8BF9                    mov edi, ecx
:0047DFB5 2B7DF0                  sub edi, dword ptr [ebp-10]
:0047DFB8 8BD8                    mov ebx, eax
:0047DFBA 2BDA                    sub ebx, edx
:0047DFBC 47                      inc edi
:0047DFBD 43                      inc ebx
:0047DFBE 395604                  cmp dword ptr [esi+04], edx
:0047DFC1 752D                    jne 0047DFF0
:0047DFC3 8B16                    mov edx, dword ptr [esi]
:0047DFC5 3B55F0                  cmp edx, dword ptr [ebp-10]
:0047DFC8 7F26                    jg 0047DFF0
:0047DFCA 394E08                  cmp dword ptr [esi+08], ecx
:0047DFCD 7C21                    jl 0047DFF0
:0047DFCF 8D45F0                  lea eax, dword ptr [ebp-10]
:0047DFD2 50                      push eax
:0047DFD3 E8A3F7FFFF              call 0047D77B
:0047DFD8 59                      pop ecx
:0047DFD9 6A01                    push 00000001
:0047DFDB 57                      push edi
:0047DFDC FF75F4                  push [ebp-0C]
:0047DFDF FF75F0                  push [ebp-10]
:0047DFE2 E89CE8FFFF              call 0047C883
:0047DFE7 8B45FC                  mov eax, dword ptr [ebp-04]
:0047DFEA 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047DFED 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047DFC1(C), :0047DFC8(C), :0047DFCD(C)
|
:0047DFF0 8B55F0                  mov edx, dword ptr [ebp-10]
:0047DFF3 3916                    cmp dword ptr [esi], edx
:0047DFF5 752E                    jne 0047E025
:0047DFF7 8B5604                  mov edx, dword ptr [esi+04]
:0047DFFA 3B55F4                  cmp edx, dword ptr [ebp-0C]
:0047DFFD 7F26                    jg 0047E025
:0047DFFF 39460C                  cmp dword ptr [esi+0C], eax
:0047E002 7C62                    jl 0047E066
:0047E004 8D45F0                  lea eax, dword ptr [ebp-10]
:0047E007 50                      push eax
:0047E008 E88EF8FFFF              call 0047D89B
:0047E00D 59                      pop ecx
:0047E00E 53                      push ebx
:0047E00F 6A01                    push 00000001
:0047E011 FF75F4                  push [ebp-0C]
:0047E014 FF75F0                  push [ebp-10]
:0047E017 E867E8FFFF              call 0047C883
:0047E01C 8B45FC                  mov eax, dword ptr [ebp-04]
:0047E01F 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047E022 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047DFF5(C), :0047DFFD(C)
|
:0047E025 39460C                  cmp dword ptr [esi+0C], eax
:0047E028 753C                    jne 0047E066
:0047E02A 8B55F0                  mov edx, dword ptr [ebp-10]
:0047E02D 3916                    cmp dword ptr [esi], edx
:0047E02F 7F35                    jg 0047E066
:0047E031 394E08                  cmp dword ptr [esi+08], ecx
:0047E034 7C60                    jl 0047E096
:0047E036 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047E039 8945F4                  mov dword ptr [ebp-0C], eax
:0047E03C 8D45F0                  lea eax, dword ptr [ebp-10]
:0047E03F 894D08                  mov dword ptr [ebp+08], ecx
:0047E042 50                      push eax
:0047E043 E833F7FFFF              call 0047D77B
:0047E048 59                      pop ecx
:0047E049 6A01                    push 00000001
:0047E04B 57                      push edi
:0047E04C FF75F4                  push [ebp-0C]
:0047E04F FF75F0                  push [ebp-10]
:0047E052 E82CE8FFFF              call 0047C883
:0047E057 8B4508                  mov eax, dword ptr [ebp+08]
:0047E05A 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047E05D 8945F4                  mov dword ptr [ebp-0C], eax
:0047E060 8B45FC                  mov eax, dword ptr [ebp-04]
:0047E063 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047E002(C), :0047E028(C), :0047E02F(C)
|
:0047E066 394E08                  cmp dword ptr [esi+08], ecx
:0047E069 752B                    jne 0047E096
:0047E06B 8B55F4                  mov edx, dword ptr [ebp-0C]
:0047E06E 395604                  cmp dword ptr [esi+04], edx
:0047E071 7F23                    jg 0047E096
:0047E073 39460C                  cmp dword ptr [esi+0C], eax
:0047E076 7C1E                    jl 0047E096
:0047E078 8D45F0                  lea eax, dword ptr [ebp-10]
:0047E07B 894DF0                  mov dword ptr [ebp-10], ecx
:0047E07E 50                      push eax
:0047E07F E817F8FFFF              call 0047D89B
:0047E084 59                      pop ecx
:0047E085 53                      push ebx
:0047E086 6A01                    push 00000001
:0047E088 FF75F4                  push [ebp-0C]
:0047E08B FF75F0                  push [ebp-10]
:0047E08E E8F0E7FFFF              call 0047C883
:0047E093 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047DFA4(C), :0047E034(C), :0047E069(C), :0047E071(C), :0047E076(C)
|
:0047E096 5F                      pop edi
:0047E097 5E                      pop esi
:0047E098 5B                      pop ebx
:0047E099 C9                      leave
:0047E09A C3                      ret



* Referenced by a CALL at Addresses:
|:004021A8   , :004024C8   , :00402531   , :00402D4A   , :00402ED0   
|:00402F09   , :00403100   , :00408669   , :0040BDBC   , :0041E685   
|:0041E8D7   , :00428106   , :0042A33D   , :0042B76E   , :0042BD1A   
|:0042BE72   , :0042BEEA   , :0042C1A2   , :0042D19B   , :0042D2CE   
|:0042D311   , :0042D357   , :0042D582   , :0042D902   , :0042DA70   
|:0042DAB3   , :0042DAF9   , :0042DDB7   , :0042DFB5   , :0042E040   
|:0042E06E   , :0042E09F   , :0042E2D3   , :0042E359   , :0042E3F0   
|:0042EC7B   , :0042EE82   , :0043035F   , :004303B6   , :0043149E   
|:00431686   , :00431DA6   , :00431F15   , :00431F2C   , :00432266   
|:00432290   , :00432325   , :00432349   , :00432379   , :004323BD   
|:00432585   , :004328D1   , :0043298A   , :00432E6F   , :00433003   
|:0043305D   , :00433162   , :0044329E   , :004432D1   , :00443323   
|:0044334B   , :00443373   , :00443ADA   , :00443B3C   , :00443C0F   
|:00443CD8   , :00448BCF   , :0044905D   , :004491EF   , :0044940C   
|:0044A3A1   , :0044A915   , :0044B2E2   , :0044D1A9   , :0044D609   
|:004506CF   , :0045085E   , :00450DF3   , :0045196D   , :004519CE   
|:00451E91   , :00453D13   , :0045C73B   , :0045CD17   , :0045CDAB   
|:0045CDF5   , :0045CF2B   , :0045CFF4   , :0045DC43   , :0045E264   
|:0045E37F   , :0045E3BB   , :0045E432   , :0045E586   , :0045EC80   
|:0045EE13   , :0045EF65   , :00461259   , :0046128B   , :004612BD   
|:004612EF   , :0046A0A2   , :0046D7D3   , :0046D852   , :0046D876   
|:0046D8A2   , :0046FD3D   , :0046FE64   , :004732C5   , :004736DB   
|:0047403F   , :0047804A   , :0047806B   , :004781E2   , :0047890F   
|
:0047E09B 55                      push ebp
:0047E09C 8BEC                    mov ebp, esp
:0047E09E 83EC20                  sub esp, 00000020
:0047E0A1 A144D04B00              mov eax, dword ptr [004BD044]
:0047E0A6 53                      push ebx
:0047E0A7 56                      push esi
:0047E0A8 8B7508                  mov esi, dword ptr [ebp+08]
:0047E0AB 8B0CC598854B00          mov ecx, dword ptr [8*eax+004B8598]
:0047E0B2 57                      push edi
:0047E0B3 8B7D0C                  mov edi, dword ptr [ebp+0C]
:0047E0B6 8D140E                  lea edx, dword ptr [esi+ecx]
:0047E0B9 8955E0                  mov dword ptr [ebp-20], edx
:0047E0BC 8B14C59C854B00          mov edx, dword ptr [8*eax+004B859C]
:0047E0C3 C1E004                  shl eax, 04
:0047E0C6 8D1C17                  lea ebx, dword ptr [edi+edx]
:0047E0C9 0520D14B00              add eax, 004BD120
:0047E0CE 895DE4                  mov dword ptr [ebp-1C], ebx
:0047E0D1 8B5D10                  mov ebx, dword ptr [ebp+10]
:0047E0D4 03F3                    add esi, ebx
:0047E0D6 50                      push eax
:0047E0D7 8D45E0                  lea eax, dword ptr [ebp-20]
:0047E0DA 8D4C0EFF                lea ecx, dword ptr [esi+ecx-01]
:0047E0DE 8B7514                  mov esi, dword ptr [ebp+14]
:0047E0E1 894DE8                  mov dword ptr [ebp-18], ecx
:0047E0E4 50                      push eax
:0047E0E5 8D0C3E                  lea ecx, dword ptr [esi+edi]
:0047E0E8 8D45F0                  lea eax, dword ptr [ebp-10]
:0047E0EB 50                      push eax
:0047E0EC 8D4C11FF                lea ecx, dword ptr [ecx+edx-01]
:0047E0F0 894DEC                  mov dword ptr [ebp-14], ecx
:0047E0F3 E891F5FFFF              call 0047D689
:0047E0F8 83C40C                  add esp, 0000000C
:0047E0FB 85C0                    test eax, eax
:0047E0FD 0F8449010000            je 0047E24C
:0047E103 A144D04B00              mov eax, dword ptr [004BD044]
:0047E108 833C85B8884B0007        cmp dword ptr [4*eax+004B88B8], 00000007
:0047E110 7508                    jne 0047E11A
:0047E112 8B4518                  mov eax, dword ptr [ebp+18]
:0047E115 894508                  mov dword ptr [ebp+08], eax
:0047E118 EB29                    jmp 0047E143

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E110(C)
|
:0047E11A 8BC6                    mov eax, esi
:0047E11C 0FAFC3                  imul eax, ebx
:0047E11F 50                      push eax
:0047E120 6A00                    push 00000000
:0047E122 FF15C4614800            call dword ptr [004861C4]
:0047E128 50                      push eax
:0047E129 89450C                  mov dword ptr [ebp+0C], eax
:0047E12C FF15C8614800            call dword ptr [004861C8]
:0047E132 50                      push eax
:0047E133 894508                  mov dword ptr [ebp+08], eax
:0047E136 FF7518                  push [ebp+18]
:0047E139 56                      push esi
:0047E13A 53                      push ebx
:0047E13B E8C5170000              call 0047F905
:0047E140 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E118(U)
|
:0047E143 FF75F4                  push [ebp-0C]
:0047E146 FF75F0                  push [ebp-10]
:0047E149 E8BAF1FFFF              call 0047D308
:0047E14E 59                      pop ecx
:0047E14F 8B75F8                  mov esi, dword ptr [ebp-08]
:0047E152 59                      pop ecx
:0047E153 8B7DFC                  mov edi, dword ptr [ebp-04]
:0047E156 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047E159 2B75F0                  sub esi, dword ptr [ebp-10]
:0047E15C 2B4DE4                  sub ecx, dword ptr [ebp-1C]
:0047E15F 2B7DF4                  sub edi, dword ptr [ebp-0C]
:0047E162 0FAFCB                  imul ecx, ebx
:0047E165 034DF0                  add ecx, dword ptr [ebp-10]
:0047E168 2B4DE0                  sub ecx, dword ptr [ebp-20]
:0047E16B 014D08                  add dword ptr [ebp+08], ecx
:0047E16E 8B0D44D04B00            mov ecx, dword ptr [004BD044]
:0047E174 C1E102                  shl ecx, 02
:0047E177 46                      inc esi
:0047E178 47                      inc edi
:0047E179 8B91E0A34B00            mov edx, dword ptr [ecx+004BA3E0]
:0047E17F 83EA00                  sub edx, 00000000
:0047E182 747C                    je 0047E200
:0047E184 4A                      dec edx
:0047E185 745F                    je 0047E1E6
:0047E187 4A                      dec edx
:0047E188 7442                    je 0047E1CC
:0047E18A 4A                      dec edx
:0047E18B 7425                    je 0047E1B2
:0047E18D 4A                      dec edx
:0047E18E 7408                    je 0047E198
:0047E190 4A                      dec edx
:0047E191 746D                    je 0047E200
:0047E193 E983000000              jmp 0047E21B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E18E(C)
|
:0047E198 FFB1B8884B00            push dword ptr [ecx+004B88B8]
:0047E19E 50                      push eax
:0047E19F FF7508                  push [ebp+08]
:0047E1A2 53                      push ebx
:0047E1A3 FFB170A54B00            push dword ptr [ecx+004BA570]
:0047E1A9 57                      push edi
:0047E1AA 56                      push esi
:0047E1AB E890150000              call 0047F740
:0047E1B0 EB66                    jmp 0047E218

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E18B(C)
|
:0047E1B2 FFB1B8884B00            push dword ptr [ecx+004B88B8]
:0047E1B8 50                      push eax
:0047E1B9 FF7508                  push [ebp+08]
:0047E1BC 53                      push ebx
:0047E1BD FFB170A54B00            push dword ptr [ecx+004BA570]
:0047E1C3 57                      push edi
:0047E1C4 56                      push esi
:0047E1C5 E8ED140000              call 0047F6B7
:0047E1CA EB4C                    jmp 0047E218

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E188(C)
|
:0047E1CC FFB1B8884B00            push dword ptr [ecx+004B88B8]
:0047E1D2 50                      push eax
:0047E1D3 FF7508                  push [ebp+08]
:0047E1D6 53                      push ebx
:0047E1D7 FFB170A54B00            push dword ptr [ecx+004BA570]
:0047E1DD 57                      push edi
:0047E1DE 56                      push esi
:0047E1DF E893140000              call 0047F677
:0047E1E4 EB32                    jmp 0047E218

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E185(C)
|
:0047E1E6 FFB1B8884B00            push dword ptr [ecx+004B88B8]
:0047E1EC 50                      push eax
:0047E1ED FF7508                  push [ebp+08]
:0047E1F0 53                      push ebx
:0047E1F1 FFB170A54B00            push dword ptr [ecx+004BA570]
:0047E1F7 57                      push edi
:0047E1F8 56                      push esi
:0047E1F9 E8F9140000              call 0047F6F7
:0047E1FE EB18                    jmp 0047E218

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047E182(C), :0047E191(C)
|
:0047E200 FFB1B8884B00            push dword ptr [ecx+004B88B8]
:0047E206 50                      push eax
:0047E207 FF7508                  push [ebp+08]
:0047E20A 53                      push ebx
:0047E20B FFB170A54B00            push dword ptr [ecx+004BA570]
:0047E211 57                      push edi
:0047E212 56                      push esi
:0047E213 E831140000              call 0047F649

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047E1B0(U), :0047E1CA(U), :0047E1E4(U), :0047E1FE(U)
|
:0047E218 83C41C                  add esp, 0000001C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E193(U)
|
:0047E21B A144D04B00              mov eax, dword ptr [004BD044]
:0047E220 833C85B8884B0007        cmp dword ptr [4*eax+004B88B8], 00000007
:0047E228 7412                    je 0047E23C
:0047E22A FF750C                  push [ebp+0C]
:0047E22D FF15CC614800            call dword ptr [004861CC]
:0047E233 FF750C                  push [ebp+0C]
:0047E236 FF15D8614800            call dword ptr [004861D8]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E228(C)
|
:0047E23C 57                      push edi
:0047E23D 56                      push esi
:0047E23E FF75F4                  push [ebp-0C]
:0047E241 FF75F0                  push [ebp-10]
:0047E244 E83AE6FFFF              call 0047C883
:0047E249 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E0FD(C)
|
:0047E24C 5F                      pop edi
:0047E24D 5E                      pop esi
:0047E24E 5B                      pop ebx
:0047E24F C9                      leave
:0047E250 C3                      ret



* Referenced by a CALL at Addresses:
|:00402271   , :00402D93   , :0041CB9B   , :0041E640   , :0042D05B   
|:0042D8BF   , :0042DF18   , :0042E1F7   , :0042E248   , :0042E83B   
|:0042ECDE   , :00431E67   , :0043227B   , :00432832   , :0043290E   
|:00432ECB   , :00441F4C   , :0044242D   , :00443A8C   , :00448F8D   
|:00448FCD   , :004504BC   , :00450CE9   , :004519FD   , :00453CC1   
|:0045588F   , :00459B0C   , :0045CFAA   , :0045DB94   , :0045DBF6   
|:0045DC62   , :0045DCD6   , :0045E1F4   , :0045E22F   , :0045E34A   
|:00461326   , :00461358   , :0046138A   , :004613BC   , :00462C5B   
|:00462EA4   , :00473F3E   
|
:0047E251 55                      push ebp
:0047E252 8BEC                    mov ebp, esp
:0047E254 83EC20                  sub esp, 00000020
:0047E257 A144D04B00              mov eax, dword ptr [004BD044]
:0047E25C 53                      push ebx
:0047E25D 56                      push esi
:0047E25E 8B7508                  mov esi, dword ptr [ebp+08]
:0047E261 8B0CC598854B00          mov ecx, dword ptr [8*eax+004B8598]
:0047E268 57                      push edi
:0047E269 8B7D0C                  mov edi, dword ptr [ebp+0C]
:0047E26C 8D140E                  lea edx, dword ptr [esi+ecx]
:0047E26F 8955E0                  mov dword ptr [ebp-20], edx
:0047E272 8B14C59C854B00          mov edx, dword ptr [8*eax+004B859C]
:0047E279 C1E004                  shl eax, 04
:0047E27C 8D1C17                  lea ebx, dword ptr [edi+edx]
:0047E27F 05E08B4B00              add eax, 004B8BE0
:0047E284 895DE4                  mov dword ptr [ebp-1C], ebx
:0047E287 8B5D10                  mov ebx, dword ptr [ebp+10]
:0047E28A 03F3                    add esi, ebx
:0047E28C 50                      push eax
:0047E28D 8D45E0                  lea eax, dword ptr [ebp-20]
:0047E290 8D4C0EFF                lea ecx, dword ptr [esi+ecx-01]
:0047E294 50                      push eax
:0047E295 894DE8                  mov dword ptr [ebp-18], ecx
:0047E298 8B4D14                  mov ecx, dword ptr [ebp+14]
:0047E29B 03CF                    add ecx, edi
:0047E29D 8D45F0                  lea eax, dword ptr [ebp-10]
:0047E2A0 50                      push eax
:0047E2A1 8D4C11FF                lea ecx, dword ptr [ecx+edx-01]
:0047E2A5 894DEC                  mov dword ptr [ebp-14], ecx
:0047E2A8 E8DCF3FFFF              call 0047D689
:0047E2AD 83C40C                  add esp, 0000000C
:0047E2B0 85C0                    test eax, eax
:0047E2B2 0F84C5000000            je 0047E37D
:0047E2B8 FF75F4                  push [ebp-0C]
:0047E2BB FF75F0                  push [ebp-10]
:0047E2BE E845F0FFFF              call 0047D308
:0047E2C3 8B75F8                  mov esi, dword ptr [ebp-08]
:0047E2C6 8B7DFC                  mov edi, dword ptr [ebp-04]
:0047E2C9 2B75F0                  sub esi, dword ptr [ebp-10]
:0047E2CC 59                      pop ecx
:0047E2CD 59                      pop ecx
:0047E2CE 89450C                  mov dword ptr [ebp+0C], eax
:0047E2D1 8B45F4                  mov eax, dword ptr [ebp-0C]
:0047E2D4 8B0D44D04B00            mov ecx, dword ptr [004BD044]
:0047E2DA 2BF8                    sub edi, eax
:0047E2DC 46                      inc esi
:0047E2DD C1E102                  shl ecx, 02
:0047E2E0 47                      inc edi
:0047E2E1 83B9B8884B0003          cmp dword ptr [ecx+004B88B8], 00000003
:0047E2E8 7F6F                    jg 0047E359
:0047E2EA 8B4514                  mov eax, dword ptr [ebp+14]
:0047E2ED 0FAFC3                  imul eax, ebx
:0047E2F0 40                      inc eax
:0047E2F1 50                      push eax
:0047E2F2 6A00                    push 00000000
:0047E2F4 FF15C4614800            call dword ptr [004861C4]
:0047E2FA 50                      push eax
:0047E2FB 894508                  mov dword ptr [ebp+08], eax
:0047E2FE FF15C8614800            call dword ptr [004861C8]
:0047E304 8B4DF4                  mov ecx, dword ptr [ebp-0C]
:0047E307 894510                  mov dword ptr [ebp+10], eax
:0047E30A 2B4DE4                  sub ecx, dword ptr [ebp-1C]
:0047E30D 0FAFCB                  imul ecx, ebx
:0047E310 03C8                    add ecx, eax
:0047E312 A144D04B00              mov eax, dword ptr [004BD044]
:0047E317 034DF0                  add ecx, dword ptr [ebp-10]
:0047E31A 2B4DE0                  sub ecx, dword ptr [ebp-20]
:0047E31D 51                      push ecx
:0047E31E FF750C                  push [ebp+0C]
:0047E321 53                      push ebx
:0047E322 FF348570A54B00          push dword ptr [4*eax+004BA570]
:0047E329 57                      push edi
:0047E32A 56                      push esi
:0047E32B E864140000              call 0047F794
:0047E330 83C418                  add esp, 00000018
:0047E333 FF7518                  push [ebp+18]
:0047E336 FF7510                  push [ebp+10]
:0047E339 FF7514                  push [ebp+14]
:0047E33C 53                      push ebx
:0047E33D E86A150000              call 0047F8AC
:0047E342 83C410                  add esp, 00000010
:0047E345 FF7508                  push [ebp+08]
:0047E348 FF15CC614800            call dword ptr [004861CC]
:0047E34E FF7508                  push [ebp+08]
:0047E351 FF15D8614800            call dword ptr [004861D8]
:0047E357 EB24                    jmp 0047E37D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E2E8(C)
|
:0047E359 2B45E4                  sub eax, dword ptr [ebp-1C]
:0047E35C 0FAFC3                  imul eax, ebx
:0047E35F 0345F0                  add eax, dword ptr [ebp-10]
:0047E362 034518                  add eax, dword ptr [ebp+18]
:0047E365 2B45E0                  sub eax, dword ptr [ebp-20]
:0047E368 50                      push eax
:0047E369 FF750C                  push [ebp+0C]
:0047E36C 53                      push ebx
:0047E36D FFB170A54B00            push dword ptr [ecx+004BA570]
:0047E373 57                      push edi
:0047E374 56                      push esi
:0047E375 E81A140000              call 0047F794
:0047E37A 83C418                  add esp, 00000018

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047E2B2(C), :0047E357(U)
|
:0047E37D 5F                      pop edi
:0047E37E 5E                      pop esi
:0047E37F 5B                      pop ebx
:0047E380 C9                      leave
:0047E381 C3                      ret



* Referenced by a CALL at Addresses:
|:0040F53E   , :0040F682   , :0040F826   , :0040F871   , :0040F8BA   
|:0040F906   , :0041EC26   , :0041EC6B   , :0041EC9C   , :004806D8   
|
:0047E382 55                      push ebp
:0047E383 8BEC                    mov ebp, esp
:0047E385 83EC28                  sub esp, 00000028
:0047E388 A144D04B00              mov eax, dword ptr [004BD044]
:0047E38D 53                      push ebx
:0047E38E 56                      push esi
:0047E38F 8B5D0C                  mov ebx, dword ptr [ebp+0C]
:0047E392 8B0CC598854B00          mov ecx, dword ptr [8*eax+004B8598]
:0047E399 57                      push edi
:0047E39A 8B7D08                  mov edi, dword ptr [ebp+08]
:0047E39D 8D140F                  lea edx, dword ptr [edi+ecx]
:0047E3A0 8955D8                  mov dword ptr [ebp-28], edx
:0047E3A3 8B14C59C854B00          mov edx, dword ptr [8*eax+004B859C]
:0047E3AA C1E004                  shl eax, 04
:0047E3AD 8D3413                  lea esi, dword ptr [ebx+edx]
:0047E3B0 0520D14B00              add eax, 004BD120
:0047E3B5 8975DC                  mov dword ptr [ebp-24], esi
:0047E3B8 8B7510                  mov esi, dword ptr [ebp+10]
:0047E3BB 03FE                    add edi, esi
:0047E3BD 50                      push eax
:0047E3BE 8D45D8                  lea eax, dword ptr [ebp-28]
:0047E3C1 8D4C0FFF                lea ecx, dword ptr [edi+ecx-01]
:0047E3C5 50                      push eax
:0047E3C6 894DE0                  mov dword ptr [ebp-20], ecx
:0047E3C9 8B4D14                  mov ecx, dword ptr [ebp+14]
:0047E3CC 03CB                    add ecx, ebx
:0047E3CE 8D45E8                  lea eax, dword ptr [ebp-18]
:0047E3D1 50                      push eax
:0047E3D2 8D4C11FF                lea ecx, dword ptr [ecx+edx-01]
:0047E3D6 894DE4                  mov dword ptr [ebp-1C], ecx
:0047E3D9 E8ABF2FFFF              call 0047D689
:0047E3DE 83C40C                  add esp, 0000000C
:0047E3E1 85C0                    test eax, eax
:0047E3E3 0F84FA010000            je 0047E5E3
:0047E3E9 A144D04B00              mov eax, dword ptr [004BD044]
:0047E3EE C1E002                  shl eax, 02
:0047E3F1 8B88C0754B00            mov ecx, dword ptr [eax+004B75C0]
:0047E3F7 85C9                    test ecx, ecx
:0047E3F9 7C41                    jl 0047E43C
:0047E3FB 83F903                  cmp ecx, 00000003
:0047E3FE 7E2A                    jle 0047E42A
:0047E400 83F904                  cmp ecx, 00000004
:0047E403 7416                    je 0047E41B
:0047E405 83F905                  cmp ecx, 00000005
:0047E408 7532                    jne 0047E43C
:0047E40A 8B8808844B00            mov ecx, dword ptr [eax+004B8408]
:0047E410 8B80E8804B00            mov eax, dword ptr [eax+004B80E8]
:0047E416 894D10                  mov dword ptr [ebp+10], ecx
:0047E419 EB1E                    jmp 0047E439

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E403(C)
|
:0047E41B 8B80E8804B00            mov eax, dword ptr [eax+004B80E8]
:0047E421 83650C00                and dword ptr [ebp+0C], 00000000
:0047E425 894510                  mov dword ptr [ebp+10], eax
:0047E428 EB12                    jmp 0047E43C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E3FE(C)
|
:0047E42A 8B88E8804B00            mov ecx, dword ptr [eax+004B80E8]
:0047E430 8B8008844B00            mov eax, dword ptr [eax+004B8408]
:0047E436 894D10                  mov dword ptr [ebp+10], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E419(U)
|
:0047E439 89450C                  mov dword ptr [ebp+0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047E3F9(C), :0047E408(C), :0047E428(U)
|
:0047E43C FF75EC                  push [ebp-14]
:0047E43F FF75E8                  push [ebp-18]
:0047E442 E8C1EEFFFF              call 0047D308
:0047E447 8B55F4                  mov edx, dword ptr [ebp-0C]
:0047E44A 8B7DF0                  mov edi, dword ptr [ebp-10]
:0047E44D 59                      pop ecx
:0047E44E 894508                  mov dword ptr [ebp+08], eax
:0047E451 8B45EC                  mov eax, dword ptr [ebp-14]
:0047E454 59                      pop ecx
:0047E455 8B4DE8                  mov ecx, dword ptr [ebp-18]
:0047E458 8BDA                    mov ebx, edx
:0047E45A 2BF9                    sub edi, ecx
:0047E45C 2BD8                    sub ebx, eax
:0047E45E 47                      inc edi
:0047E45F 43                      inc ebx
:0047E460 3B45DC                  cmp eax, dword ptr [ebp-24]
:0047E463 7539                    jne 0047E49E
:0047E465 3B4DD8                  cmp ecx, dword ptr [ebp-28]
:0047E468 7534                    jne 0047E49E
:0047E46A 3B55E4                  cmp edx, dword ptr [ebp-1C]
:0047E46D 752F                    jne 0047E49E
:0047E46F 8B45F0                  mov eax, dword ptr [ebp-10]
:0047E472 3B45E0                  cmp eax, dword ptr [ebp-20]
:0047E475 7527                    jne 0047E49E
:0047E477 A144D04B00              mov eax, dword ptr [004BD044]
:0047E47C C1E002                  shl eax, 02
:0047E47F 8B88C0754B00            mov ecx, dword ptr [eax+004B75C0]
:0047E485 83E900                  sub ecx, 00000000
:0047E488 0F8475010000            je 0047E603
:0047E48E 83E904                  sub ecx, 00000004
:0047E491 0F8451010000            je 0047E5E8
:0047E497 49                      dec ecx
:0047E498 0F8465010000            je 0047E603

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047E463(C), :0047E468(C), :0047E46D(C), :0047E475(C)
|
:0047E49E 8D4607                  lea eax, dword ptr [esi+07]
:0047E4A1 0FAF4514                imul eax, dword ptr [ebp+14]
:0047E4A5 50                      push eax
:0047E4A6 6A00                    push 00000000
:0047E4A8 FF15C4614800            call dword ptr [004861C4]
:0047E4AE 50                      push eax
:0047E4AF 8945FC                  mov dword ptr [ebp-04], eax
:0047E4B2 FF15C8614800            call dword ptr [004861C8]
:0047E4B8 FF750C                  push [ebp+0C]
:0047E4BB 8945F8                  mov dword ptr [ebp-08], eax
:0047E4BE FF7510                  push [ebp+10]
:0047E4C1 50                      push eax
:0047E4C2 FF7518                  push [ebp+18]
:0047E4C5 FF7514                  push [ebp+14]
:0047E4C8 56                      push esi
:0047E4C9 E853010000              call 0047E621
:0047E4CE 8B45EC                  mov eax, dword ptr [ebp-14]
:0047E4D1 8B55F8                  mov edx, dword ptr [ebp-08]
:0047E4D4 2B45DC                  sub eax, dword ptr [ebp-24]
:0047E4D7 83C418                  add esp, 00000018
:0047E4DA 0FAFC6                  imul eax, esi
:0047E4DD 0345E8                  add eax, dword ptr [ebp-18]
:0047E4E0 2B45D8                  sub eax, dword ptr [ebp-28]
:0047E4E3 03D0                    add edx, eax
:0047E4E5 A144D04B00              mov eax, dword ptr [004BD044]
:0047E4EA C1E002                  shl eax, 02
:0047E4ED 8B88C0754B00            mov ecx, dword ptr [eax+004B75C0]
:0047E4F3 83E900                  sub ecx, 00000000
:0047E4F6 0F84AA000000            je 0047E5A6
:0047E4FC 49                      dec ecx
:0047E4FD 0F8489000000            je 0047E58C
:0047E503 49                      dec ecx
:0047E504 746C                    je 0047E572
:0047E506 49                      dec ecx
:0047E507 744F                    je 0047E558
:0047E509 49                      dec ecx
:0047E50A 740C                    je 0047E518
:0047E50C 49                      dec ecx
:0047E50D 0F8493000000            je 0047E5A6
:0047E513 E9A9000000              jmp 0047E5C1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E50A(C)
|
:0047E518 8B8070A54B00            mov eax, dword ptr [eax+004BA570]
:0047E51E 2BF7                    sub esi, edi
:0047E520 2BC7                    sub eax, edi
:0047E522 89750C                  mov dword ptr [ebp+0C], esi
:0047E525 85DB                    test ebx, ebx
:0047E527 0F8E94000000            jle 0047E5C1
:0047E52D 895D14                  mov dword ptr [ebp+14], ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E554(C)
|
:0047E530 85FF                    test edi, edi
:0047E532 7E17                    jle 0047E54B
:0047E534 897D18                  mov dword ptr [ebp+18], edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E549(C)
|
:0047E537 8A0A                    mov cl, byte ptr [edx]
:0047E539 84C9                    test cl, cl
:0047E53B 7405                    je 0047E542
:0047E53D 8B7508                  mov esi, dword ptr [ebp+08]
:0047E540 880E                    mov byte ptr [esi], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E53B(C)
|
:0047E542 FF4508                  inc [ebp+08]
:0047E545 42                      inc edx
:0047E546 FF4D18                  dec [ebp+18]
:0047E549 75EC                    jne 0047E537

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E532(C)
|
:0047E54B 014508                  add dword ptr [ebp+08], eax
:0047E54E 03550C                  add edx, dword ptr [ebp+0C]
:0047E551 FF4D14                  dec [ebp+14]
:0047E554 75DA                    jne 0047E530
:0047E556 EB69                    jmp 0047E5C1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E507(C)
|
:0047E558 FFB0B8884B00            push dword ptr [eax+004B88B8]
:0047E55E FF7508                  push [ebp+08]
:0047E561 52                      push edx
:0047E562 56                      push esi
:0047E563 FFB070A54B00            push dword ptr [eax+004BA570]
:0047E569 53                      push ebx
:0047E56A 57                      push edi
:0047E56B E847110000              call 0047F6B7
:0047E570 EB4C                    jmp 0047E5BE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E504(C)
|
:0047E572 FFB0B8884B00            push dword ptr [eax+004B88B8]
:0047E578 FF7508                  push [ebp+08]
:0047E57B 52                      push edx
:0047E57C 56                      push esi
:0047E57D FFB070A54B00            push dword ptr [eax+004BA570]
:0047E583 53                      push ebx
:0047E584 57                      push edi
:0047E585 E8ED100000              call 0047F677
:0047E58A EB32                    jmp 0047E5BE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E4FD(C)
|
:0047E58C FFB0B8884B00            push dword ptr [eax+004B88B8]
:0047E592 FF7508                  push [ebp+08]
:0047E595 52                      push edx
:0047E596 56                      push esi
:0047E597 FFB070A54B00            push dword ptr [eax+004BA570]
:0047E59D 53                      push ebx
:0047E59E 57                      push edi
:0047E59F E853110000              call 0047F6F7
:0047E5A4 EB18                    jmp 0047E5BE

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047E4F6(C), :0047E50D(C)
|
:0047E5A6 FFB0B8884B00            push dword ptr [eax+004B88B8]
:0047E5AC FF7508                  push [ebp+08]
:0047E5AF 52                      push edx
:0047E5B0 56                      push esi
:0047E5B1 FFB070A54B00            push dword ptr [eax+004BA570]
:0047E5B7 53                      push ebx
:0047E5B8 57                      push edi
:0047E5B9 E88B100000              call 0047F649

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047E570(U), :0047E58A(U), :0047E5A4(U)
|
:0047E5BE 83C41C                  add esp, 0000001C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047E513(U), :0047E527(C), :0047E556(U)
|
:0047E5C1 FF75FC                  push [ebp-04]
:0047E5C4 FF15CC614800            call dword ptr [004861CC]
:0047E5CA FF75FC                  push [ebp-04]
:0047E5CD FF15D8614800            call dword ptr [004861D8]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E61F(U)
|
:0047E5D3 53                      push ebx
:0047E5D4 57                      push edi
:0047E5D5 FF75EC                  push [ebp-14]
:0047E5D8 FF75E8                  push [ebp-18]
:0047E5DB E8A3E2FFFF              call 0047C883
:0047E5E0 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E3E3(C)
|
:0047E5E3 5F                      pop edi
:0047E5E4 5E                      pop esi
:0047E5E5 5B                      pop ebx
:0047E5E6 C9                      leave
:0047E5E7 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E491(C)
|
:0047E5E8 FF7508                  push [ebp+08]
:0047E5EB FF7518                  push [ebp+18]
:0047E5EE FF750C                  push [ebp+0C]
:0047E5F1 FF7510                  push [ebp+10]
:0047E5F4 FFB070A54B00            push dword ptr [eax+004BA570]
:0047E5FA 53                      push ebx
:0047E5FB 57                      push edi
:0047E5FC E83A120000              call 0047F83B
:0047E601 EB19                    jmp 0047E61C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047E488(C), :0047E498(C)
|
:0047E603 FF7508                  push [ebp+08]
:0047E606 FF7518                  push [ebp+18]
:0047E609 FF750C                  push [ebp+0C]
:0047E60C FF7510                  push [ebp+10]
:0047E60F FFB070A54B00            push dword ptr [eax+004BA570]
:0047E615 53                      push ebx
:0047E616 57                      push edi
:0047E617 E8A6110000              call 0047F7C2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E601(U)
|
:0047E61C 83C41C                  add esp, 0000001C
:0047E61F EBB2                    jmp 0047E5D3

* Referenced by a CALL at Address:
|:0047E4C9   
|
:0047E621 55                      push ebp
:0047E622 8BEC                    mov ebp, esp
:0047E624 51                      push ecx
:0047E625 8B4508                  mov eax, dword ptr [ebp+08]
:0047E628 56                      push esi
:0047E629 8BF0                    mov esi, eax
:0047E62B 83E007                  and eax, 00000007
:0047E62E 8945FC                  mov dword ptr [ebp-04], eax
:0047E631 8B450C                  mov eax, dword ptr [ebp+0C]
:0047E634 C1FE03                  sar esi, 03
:0047E637 85C0                    test eax, eax
:0047E639 7E5A                    jle 0047E695
:0047E63B 8B5514                  mov edx, dword ptr [ebp+14]
:0047E63E 57                      push edi
:0047E63F 8B7D10                  mov edi, dword ptr [ebp+10]
:0047E642 53                      push ebx
:0047E643 89450C                  mov dword ptr [ebp+0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E691(C)
|
:0047E646 85F6                    test esi, esi
:0047E648 7423                    je 0047E66D
:0047E64A 8D06                    lea eax, dword ptr [esi]
:0047E64C 894508                  mov dword ptr [ebp+08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E66B(C)
|
:0047E64F 8A0F                    mov cl, byte ptr [edi]
:0047E651 6A08                    push 00000008
:0047E653 47                      inc edi
:0047E654 5B                      pop ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E666(C)
|
:0047E655 8A4518                  mov al, byte ptr [ebp+18]
:0047E658 F6C180                  test cl, 80
:0047E65B 7503                    jne 0047E660
:0047E65D 8A451C                  mov al, byte ptr [ebp+1C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E65B(C)
|
:0047E660 8802                    mov byte ptr [edx], al
:0047E662 42                      inc edx
:0047E663 D0E1                    shl cl, 1
:0047E665 4B                      dec ebx
:0047E666 75ED                    jne 0047E655
:0047E668 FF4D08                  dec [ebp+08]
:0047E66B 75E2                    jne 0047E64F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E648(C)
|
:0047E66D 8B45FC                  mov eax, dword ptr [ebp-04]
:0047E670 85C0                    test eax, eax
:0047E672 741A                    je 0047E68E
:0047E674 8A0F                    mov cl, byte ptr [edi]
:0047E676 47                      inc edi
:0047E677 85C0                    test eax, eax
:0047E679 7E13                    jle 0047E68E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E68C(C)
|
:0047E67B 8A5D18                  mov bl, byte ptr [ebp+18]
:0047E67E F6C180                  test cl, 80
:0047E681 7503                    jne 0047E686
:0047E683 8A5D1C                  mov bl, byte ptr [ebp+1C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E681(C)
|
:0047E686 881A                    mov byte ptr [edx], bl
:0047E688 42                      inc edx
:0047E689 D0E1                    shl cl, 1
:0047E68B 48                      dec eax
:0047E68C 75ED                    jne 0047E67B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047E672(C), :0047E679(C)
|
:0047E68E FF4D0C                  dec [ebp+0C]
:0047E691 75B3                    jne 0047E646
:0047E693 5B                      pop ebx
:0047E694 5F                      pop edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E639(C)
|
:0047E695 5E                      pop esi
:0047E696 C9                      leave
:0047E697 C3                      ret



* Referenced by a CALL at Addresses:
|:0040F5F5   , :00480707   
|
:0047E698 8B442404                mov eax, dword ptr [esp+04]
:0047E69C FF742408                push [esp+08]
:0047E6A0 0FB64C2408              movzx ecx, byte ptr [esp+08]
:0047E6A5 C1F808                  sar eax, 08
:0047E6A8 0FB6C0                  movzx eax, al
:0047E6AB C1E008                  shl eax, 08
:0047E6AE 03C1                    add eax, ecx
:0047E6B0 50                      push eax
:0047E6B1 E803000000              call 0047E6B9
:0047E6B6 59                      pop ecx
:0047E6B7 59                      pop ecx
:0047E6B8 C3                      ret



* Referenced by a CALL at Address:
|:0047E6B1   
|
:0047E6B9 55                      push ebp
:0047E6BA 8BEC                    mov ebp, esp
:0047E6BC 83EC44                  sub esp, 00000044
:0047E6BF 53                      push ebx
:0047E6C0 56                      push esi
:0047E6C1 57                      push edi
:0047E6C2 33F6                    xor esi, esi
:0047E6C4 6A20                    push 00000020
:0047E6C6 56                      push esi
:0047E6C7 FF750C                  push [ebp+0C]
:0047E6CA E861240000              call 00480B30
:0047E6CF 8B4508                  mov eax, dword ptr [ebp+08]
:0047E6D2 83C40C                  add esp, 0000000C
:0047E6D5 3DA1A10000              cmp eax, 0000A1A1
:0047E6DA 0F84B6000000            je 0047E796
:0047E6E0 6A42                    push 00000042
:0047E6E2 6A10                    push 00000010
:0047E6E4 5F                      pop edi
:0047E6E5 8BC8                    mov ecx, eax
:0047E6E7 57                      push edi
:0047E6E8 57                      push edi
:0047E6E9 56                      push esi
:0047E6EA 56                      push esi
:0047E6EB FF35E0784B00            push dword ptr [004B78E0]
:0047E6F1 8845FF                  mov byte ptr [ebp-01], al
:0047E6F4 C1F908                  sar ecx, 08
:0047E6F7 884DFE                  mov byte ptr [ebp-02], cl
:0047E6FA FF15B0604800            call dword ptr [004860B0]
:0047E700 6A01                    push 00000001
:0047E702 FF35E0784B00            push dword ptr [004B78E0]
:0047E708 FF1594604800            call dword ptr [00486094]
:0047E70E 68FFFFFF00              push 00FFFFFF
:0047E713 FF35E0784B00            push dword ptr [004B78E0]
:0047E719 FF1584604800            call dword ptr [00486084]
:0047E71F 8D45FE                  lea eax, dword ptr [ebp-02]
:0047E722 6A02                    push 00000002
:0047E724 50                      push eax
:0047E725 56                      push esi
:0047E726 56                      push esi
:0047E727 FF35E0784B00            push dword ptr [004B78E0]
:0047E72D FF1574604800            call dword ptr [00486074]
:0047E733 56                      push esi
:0047E734 8D45BC                  lea eax, dword ptr [ebp-44]
:0047E737 6880754B00              push 004B7580
:0047E73C 50                      push eax
:0047E73D 57                      push edi
:0047E73E 56                      push esi
:0047E73F FF35009E4B00            push dword ptr [004B9E00]
:0047E745 FF35E0784B00            push dword ptr [004B78E0]
:0047E74B FF15AC604800            call dword ptr [004860AC]
:0047E751 A1E8D04B00              mov eax, dword ptr [004BD0E8]
:0047E756 8B0DF0D04B00            mov ecx, dword ptr [004BD0F0]
:0047E75C 3BC1                    cmp eax, ecx
:0047E75E 7C02                    jl 0047E762
:0047E760 8BC1                    mov eax, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E75E(C)
|
:0047E762 2B05E0D04B00            sub eax, dword ptr [004BD0E0]
:0047E768 03C7                    add eax, edi
:0047E76A 8BD8                    mov ebx, eax
:0047E76C 7902                    jns 0047E770
:0047E76E 33DB                    xor ebx, ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E76C(C)
|
:0047E770 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0047E773 8BC3                    mov eax, ebx
:0047E775 99                      cdq
:0047E776 2BC2                    sub eax, edx
:0047E778 D1F8                    sar eax, 1
:0047E77A 3BDF                    cmp ebx, edi
:0047E77C 8D1441                  lea edx, dword ptr [ecx+2*eax]
:0047E77F 7D15                    jge 0047E796
:0047E781 8BC7                    mov eax, edi
:0047E783 8D4DF8                  lea ecx, dword ptr [ebp-08]
:0047E786 2BC3                    sub eax, ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E794(C)
|
:0047E788 668B31                  mov si, word ptr [ecx]
:0047E78B 83E904                  sub ecx, 00000004
:0047E78E 668932                  mov word ptr [edx], si
:0047E791 42                      inc edx
:0047E792 42                      inc edx
:0047E793 48                      dec eax
:0047E794 75F2                    jne 0047E788

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047E6DA(C), :0047E77F(C)
|
:0047E796 5F                      pop edi
:0047E797 5E                      pop esi
:0047E798 5B                      pop ebx
:0047E799 C9                      leave
:0047E79A C3                      ret



* Referenced by a CALL at Address:
|:0040F5D9   
|
:0047E79B 55                      push ebp
:0047E79C 8BEC                    mov ebp, esp
:0047E79E 83EC40                  sub esp, 00000040
:0047E7A1 53                      push ebx
:0047E7A2 56                      push esi
:0047E7A3 57                      push edi
:0047E7A4 6A10                    push 00000010
:0047E7A6 5F                      pop edi
:0047E7A7 33F6                    xor esi, esi
:0047E7A9 57                      push edi
:0047E7AA 56                      push esi
:0047E7AB FF750C                  push [ebp+0C]
:0047E7AE E87D230000              call 00480B30
:0047E7B3 83C40C                  add esp, 0000000C
:0047E7B6 837D0820                cmp dword ptr [ebp+08], 00000020
:0047E7BA 0F84A2000000            je 0047E862
:0047E7C0 6A42                    push 00000042
:0047E7C2 57                      push edi
:0047E7C3 57                      push edi
:0047E7C4 56                      push esi
:0047E7C5 56                      push esi
:0047E7C6 FF35E0784B00            push dword ptr [004B78E0]
:0047E7CC FF15B0604800            call dword ptr [004860B0]
:0047E7D2 6A01                    push 00000001
:0047E7D4 FF35E0784B00            push dword ptr [004B78E0]
:0047E7DA FF1594604800            call dword ptr [00486094]
:0047E7E0 68FFFFFF00              push 00FFFFFF
:0047E7E5 FF35E0784B00            push dword ptr [004B78E0]
:0047E7EB FF1584604800            call dword ptr [00486084]
:0047E7F1 8D4508                  lea eax, dword ptr [ebp+08]
:0047E7F4 6A01                    push 00000001
:0047E7F6 50                      push eax
:0047E7F7 56                      push esi
:0047E7F8 56                      push esi
:0047E7F9 FF35E0784B00            push dword ptr [004B78E0]
:0047E7FF FF1574604800            call dword ptr [00486074]
:0047E805 56                      push esi
:0047E806 8D45C0                  lea eax, dword ptr [ebp-40]
:0047E809 6880754B00              push 004B7580
:0047E80E 50                      push eax
:0047E80F 57                      push edi
:0047E810 56                      push esi
:0047E811 FF35009E4B00            push dword ptr [004B9E00]
:0047E817 FF35E0784B00            push dword ptr [004B78E0]
:0047E81D FF15AC604800            call dword ptr [004860AC]
:0047E823 A1E8D04B00              mov eax, dword ptr [004BD0E8]
:0047E828 8B0DF0D04B00            mov ecx, dword ptr [004BD0F0]
:0047E82E 3BC1                    cmp eax, ecx
:0047E830 7C02                    jl 0047E834
:0047E832 8BC1                    mov eax, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E830(C)
|
:0047E834 2B05E0D04B00            sub eax, dword ptr [004BD0E0]
:0047E83A 03C7                    add eax, edi
:0047E83C 8BD8                    mov ebx, eax
:0047E83E 7902                    jns 0047E842
:0047E840 33DB                    xor ebx, ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E83E(C)
|
:0047E842 8BC3                    mov eax, ebx
:0047E844 99                      cdq
:0047E845 2BC2                    sub eax, edx
:0047E847 D1F8                    sar eax, 1
:0047E849 03450C                  add eax, dword ptr [ebp+0C]
:0047E84C 3BDF                    cmp ebx, edi
:0047E84E 7D12                    jge 0047E862
:0047E850 8BCF                    mov ecx, edi
:0047E852 8D75FC                  lea esi, dword ptr [ebp-04]
:0047E855 2BCB                    sub ecx, ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E860(C)
|
:0047E857 8A16                    mov dl, byte ptr [esi]
:0047E859 83EE04                  sub esi, 00000004
:0047E85C 8810                    mov byte ptr [eax], dl
:0047E85E 40                      inc eax
:0047E85F 49                      dec ecx
:0047E860 75F5                    jne 0047E857

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047E7BA(C), :0047E84E(C)
|
:0047E862 5F                      pop edi
:0047E863 5E                      pop esi
:0047E864 5B                      pop ebx
:0047E865 C9                      leave
:0047E866 C3                      ret



* Referenced by a CALL at Addresses:
|:0041E216   , :0041E3C2   , :0041E3F9   , :0041E569   , :0041E59B   
|
:0047E867 55                      push ebp
:0047E868 8BEC                    mov ebp, esp
:0047E86A 51                      push ecx
:0047E86B 51                      push ecx
:0047E86C A144D04B00              mov eax, dword ptr [004BD044]
:0047E871 53                      push ebx
:0047E872 C1E002                  shl eax, 02
:0047E875 56                      push esi
:0047E876 8B7510                  mov esi, dword ptr [ebp+10]
:0047E879 83B8B8884B0007          cmp dword ptr [eax+004B88B8], 00000007
:0047E880 57                      push edi
:0047E881 8B7D08                  mov edi, dword ptr [ebp+08]
:0047E884 8945FC                  mov dword ptr [ebp-04], eax
:0047E887 7403                    je 0047E88C
:0047E889 83C710                  add edi, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E887(C)
|
:0047E88C 83FF0A                  cmp edi, 0000000A
:0047E88F 7D12                    jge 0047E8A3
:0047E891 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0047E894 2BF7                    sub esi, edi
:0047E896 6A0A                    push 0000000A
:0047E898 83C60A                  add esi, 0000000A
:0047E89B 8D4C39F6                lea ecx, dword ptr [ecx+edi-0A]
:0047E89F 5F                      pop edi
:0047E8A0 894D0C                  mov dword ptr [ebp+0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E88F(C)
|
:0047E8A3 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0047E8A6 8D1439                  lea edx, dword ptr [ecx+edi]
:0047E8A9 B9F6000000              mov ecx, 000000F6
:0047E8AE 3BD1                    cmp edx, ecx
:0047E8B0 7C05                    jl 0047E8B7
:0047E8B2 2BCF                    sub ecx, edi
:0047E8B4 894D0C                  mov dword ptr [ebp+0C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E8B0(C)
|
:0047E8B7 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0047E8BA 897D08                  mov dword ptr [ebp+08], edi
:0047E8BD 03CF                    add ecx, edi
:0047E8BF 3BF9                    cmp edi, ecx
:0047E8C1 894DF8                  mov dword ptr [ebp-08], ecx
:0047E8C4 7D69                    jge 0047E92F
:0047E8C6 8D0CBD119E4B00          lea ecx, dword ptr [4*edi+004B9E11]
:0047E8CD 8D1CBD4A954B00          lea ebx, dword ptr [4*edi+004B954A]
:0047E8D4 894D10                  mov dword ptr [ebp+10], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E92D(C)
|
:0047E8D7 8A16                    mov dl, byte ptr [esi]
:0047E8D9 8B8828A24B00            mov ecx, dword ptr [eax+004BA228]
:0047E8DF 8B4508                  mov eax, dword ptr [ebp+08]
:0047E8E2 D2E2                    shl dl, cl
:0047E8E4 C1E002                  shl eax, 02
:0047E8E7 46                      inc esi
:0047E8E8 889048954B00            mov byte ptr [eax+004B9548], dl
:0047E8EE 8890129E4B00            mov byte ptr [eax+004B9E12], dl
:0047E8F4 8A16                    mov dl, byte ptr [esi]
:0047E8F6 D2E2                    shl dl, cl
:0047E8F8 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047E8FB 46                      inc esi
:0047E8FC 8B8928A24B00            mov ecx, dword ptr [ecx+004BA228]
:0047E902 8813                    mov byte ptr [ebx], dl
:0047E904 8890109E4B00            mov byte ptr [eax+004B9E10], dl
:0047E90A 8A16                    mov dl, byte ptr [esi]
:0047E90C 83C304                  add ebx, 00000004
:0047E90F D2E2                    shl dl, cl
:0047E911 46                      inc esi
:0047E912 FF4508                  inc [ebp+08]
:0047E915 889049954B00            mov byte ptr [eax+004B9549], dl
:0047E91B 8B4510                  mov eax, dword ptr [ebp+10]
:0047E91E 83451004                add dword ptr [ebp+10], 00000004
:0047E922 8810                    mov byte ptr [eax], dl
:0047E924 8B4508                  mov eax, dword ptr [ebp+08]
:0047E927 3B45F8                  cmp eax, dword ptr [ebp-08]
:0047E92A 8B45FC                  mov eax, dword ptr [ebp-04]
:0047E92D 7CA8                    jl 0047E8D7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E8C4(C)
|
:0047E92F 33F6                    xor esi, esi
:0047E931 3935B07D4B00            cmp dword ptr [004B7DB0], esi
:0047E937 7435                    je 0047E96E
:0047E939 33DB                    xor ebx, ebx
:0047E93B 393528C04B00            cmp dword ptr [004BC028], esi
:0047E941 7E50                    jle 0047E993
:0047E943 C7450848994B00          mov [ebp+08], 004B9948

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E96A(C)
|
:0047E94A 8B4508                  mov eax, dword ptr [ebp+08]
:0047E94D 6848954B00              push 004B9548
:0047E952 6800010000              push 00000100
:0047E957 56                      push esi
:0047E958 FF30                    push dword ptr [eax]
:0047E95A E8A30A0000              call 0047F402
:0047E95F 83450804                add dword ptr [ebp+08], 00000004
:0047E963 43                      inc ebx
:0047E964 3B1D28C04B00            cmp ebx, dword ptr [004BC028]
:0047E96A 7CDE                    jl 0047E94A
:0047E96C EB25                    jmp 0047E993

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E937(C)
|
:0047E96E 56                      push esi
:0047E96F FF35DC8B4B00            push dword ptr [004B8BDC]
:0047E975 FFB048994B00            push dword ptr [eax+004B9948]
:0047E97B FF1550604800            call dword ptr [00486050]
:0047E981 A144D04B00              mov eax, dword ptr [004BD044]
:0047E986 FF348548994B00          push dword ptr [4*eax+004B9948]
:0047E98D FF154C604800            call dword ptr [0048604C]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047E941(C), :0047E96C(U)
|
:0047E993 8D04BD109E4B00          lea eax, dword ptr [4*edi+004B9E10]
:0047E99A 50                      push eax
:0047E99B FF750C                  push [ebp+0C]
:0047E99E 57                      push edi
:0047E99F FF35DC8B4B00            push dword ptr [004B8BDC]
:0047E9A5 FF15B4604800            call dword ptr [004860B4]
:0047E9AB 56                      push esi
:0047E9AC FF1598624800            call dword ptr [00486298]
:0047E9B2 8BF8                    mov edi, eax
:0047E9B4 3BFE                    cmp edi, esi
:0047E9B6 7434                    je 0047E9EC
:0047E9B8 6A0C                    push 0000000C
:0047E9BA 57                      push edi
:0047E9BB FF153C604800            call dword ptr [0048603C]
:0047E9C1 83F808                  cmp eax, 00000008
:0047E9C4 7E1E                    jle 0047E9E4
:0047E9C6 A144D04B00              mov eax, dword ptr [004BD044]
:0047E9CB FF3485E09A4B00          push dword ptr [4*eax+004B9AE0]
:0047E9D2 FF348520924B00          push dword ptr [4*eax+004B9220]
:0047E9D9 56                      push esi
:0047E9DA 56                      push esi
:0047E9DB 50                      push eax
:0047E9DC E885DFFFFF              call 0047C966
:0047E9E1 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E9C4(C)
|
:0047E9E4 57                      push edi
:0047E9E5 56                      push esi
:0047E9E6 FF159C624800            call dword ptr [0048629C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047E9B6(C)
|
:0047E9EC 5F                      pop edi
:0047E9ED 5E                      pop esi
:0047E9EE 5B                      pop ebx
:0047E9EF C9                      leave
:0047E9F0 C3                      ret



* Referenced by a CALL at Addresses:
|:0040A7CE   , :0040A926   , :0040AA4A   , :00433224   
|
:0047E9F1 A144D04B00              mov eax, dword ptr [004BD044]
:0047E9F6 8B542404                mov edx, dword ptr [esp+04]
:0047E9FA 56                      push esi
:0047E9FB 8B742410                mov esi, dword ptr [esp+10]
:0047E9FF 833C85B8884B0007        cmp dword ptr [4*eax+004B88B8], 00000007
:0047EA07 57                      push edi
:0047EA08 7403                    je 0047EA0D
:0047EA0A 83C210                  add edx, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047EA08(C)
|
:0047EA0D 8B442410                mov eax, dword ptr [esp+10]
:0047EA11 8D0C10                  lea ecx, dword ptr [eax+edx]
:0047EA14 3BD1                    cmp edx, ecx
:0047EA16 7D4F                    jge 0047EA67
:0047EA18 2BCA                    sub ecx, edx
:0047EA1A 8D04954A954B00          lea eax, dword ptr [4*edx+004B954A]
:0047EA21 8BF9                    mov edi, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047EA65(C)
|
:0047EA23 8B0D44D04B00            mov ecx, dword ptr [004BD044]
:0047EA29 8A50FE                  mov dl, byte ptr [eax-02]
:0047EA2C 8A0C8D28A24B00          mov cl, byte ptr [4*ecx+004BA228]
:0047EA33 D2EA                    shr dl, cl
:0047EA35 8816                    mov byte ptr [esi], dl
:0047EA37 8B0D44D04B00            mov ecx, dword ptr [004BD044]
:0047EA3D 8A10                    mov dl, byte ptr [eax]
:0047EA3F 46                      inc esi
:0047EA40 8A0C8D28A24B00          mov cl, byte ptr [4*ecx+004BA228]
:0047EA47 83C004                  add eax, 00000004
:0047EA4A D2EA                    shr dl, cl
:0047EA4C 8816                    mov byte ptr [esi], dl
:0047EA4E 8B0D44D04B00            mov ecx, dword ptr [004BD044]
:0047EA54 8A50FB                  mov dl, byte ptr [eax-05]
:0047EA57 46                      inc esi
:0047EA58 8A0C8D28A24B00          mov cl, byte ptr [4*ecx+004BA228]
:0047EA5F D2EA                    shr dl, cl
:0047EA61 8816                    mov byte ptr [esi], dl
:0047EA63 46                      inc esi
:0047EA64 4F                      dec edi
:0047EA65 75BC                    jne 0047EA23

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047EA16(C)
|
:0047EA67 5F                      pop edi
:0047EA68 5E                      pop esi
:0047EA69 C3                      ret



* Referenced by a CALL at Address:
|:0047EB79   
|
:0047EA6A E855000000              call 0047EAC4
:0047EA6F 33C0                    xor eax, eax
:0047EA71 39051CC04B00            cmp dword ptr [004BC01C], eax
:0047EA77 0F95C0                  setne al
:0047EA7A C3                      ret



* Referenced by a CALL at Address:
|:0047EB8A   
|

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047EA89(U)
|
:0047EA7B 833D1CC04B0000          cmp dword ptr [004BC01C], 00000000
:0047EA82 7507                    jne 0047EA8B
:0047EA84 E83B000000              call 0047EAC4
:0047EA89 EBF0                    jmp 0047EA7B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047EA82(C)
|
:0047EA8B A124C04B00              mov eax, dword ptr [004BC024]
:0047EA90 8B4C2404                mov ecx, dword ptr [esp+04]
:0047EA94 0FB70445C0A34B00        movzx eax, word ptr [2*eax+004BA3C0]
:0047EA9C 8901                    mov dword ptr [ecx], eax
:0047EA9E 8B442408                mov eax, dword ptr [esp+08]
:0047EAA2 832000                  and dword ptr [eax], 00000000
:0047EAA5 A124C04B00              mov eax, dword ptr [004BC024]
:0047EAAA 40                      inc eax
:0047EAAB 83E00F                  and eax, 0000000F
:0047EAAE FF0D1CC04B00            dec dword ptr [004BC01C]
:0047EAB4 A324C04B00              mov dword ptr [004BC024], eax
:0047EAB9 C3                      ret



* Referenced by a CALL at Address:
|:004755D4   
|
:0047EABA 8B442404                mov eax, dword ptr [esp+04]
:0047EABE A314C04B00              mov dword ptr [004BC014], eax
:0047EAC3 C3                      ret



* Referenced by a CALL at Addresses:
|:00402871   , :0041E2CE   , :0041E476   , :0041F5B1   , :00425BC9   
|:004263CE   , :004264CB   , :00426550   , :0042B821   , :0042C4F1   
|:0042C519   , :0042C564   , :0042C56F   , :0042C60C   , :0042C633   
|:0042C689   , :0042C780   , :0042C8A9   , :0042E288   , :0042EA83   
|:0044A342   , :0044ACA5   , :0044ACF1   , :0044AFD8   , :0044B023   
|:0044B62B   , :0044B646   , :0044B68E   , :0044BA8D   , :0044BB31   
|:0044BB4C   , :0044BB94   , :0044BCFC   , :0044BD91   , :0044C15B   
|:0044C380   , :0044C63D   , :0044E1D3   , :0044E1F4   , :0044E3A9   
|:0044E898   , :0044E9EB   , :0044EC68   , :0044F0CC   , :0045235C   
|:0045237E   , :00454298   , :00455535   , :0045C2BD   , :0047C41F   
|:0047C49A   , :0047C4CD   , :0047C5C7   , :0047EA6A   , :0047EA84   
|
:0047EAC4 55                      push ebp
:0047EAC5 8BEC                    mov ebp, esp
:0047EAC7 83EC1C                  sub esp, 0000001C
:0047EACA 33C0                    xor eax, eax
:0047EACC 6A01                    push 00000001
:0047EACE 50                      push eax
:0047EACF 50                      push eax
:0047EAD0 50                      push eax
:0047EAD1 8D45E4                  lea eax, dword ptr [ebp-1C]
:0047EAD4 50                      push eax
:0047EAD5 FF15AC624800            call dword ptr [004862AC]
:0047EADB 85C0                    test eax, eax
:0047EADD 7414                    je 0047EAF3
:0047EADF 8D45E4                  lea eax, dword ptr [ebp-1C]
:0047EAE2 50                      push eax
:0047EAE3 FF1510634800            call dword ptr [00486310]
:0047EAE9 8D45E4                  lea eax, dword ptr [ebp-1C]
:0047EAEC 50                      push eax
:0047EAED FF1514634800            call dword ptr [00486314]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047EADD(C)
|
:0047EAF3 C9                      leave
:0047EAF4 C3                      ret



* Referenced by a CALL at Addresses:
|:0042C55C   , :0042C8A1   
|
:0047EAF5 55                      push ebp
:0047EAF6 8BEC                    mov ebp, esp
:0047EAF8 83EC20                  sub esp, 00000020
:0047EAFB 8B4508                  mov eax, dword ptr [ebp+08]
:0047EAFE 56                      push esi
:0047EAFF 48                      dec eax
:0047EB00 57                      push edi
:0047EB01 7476                    je 0047EB79
:0047EB03 48                      dec eax
:0047EB04 0F8589000000            jne 0047EB93
:0047EB0A 8B35AC624800            mov esi, dword ptr [004862AC]
:0047EB10 33FF                    xor edi, edi
:0047EB12 6A01                    push 00000001
:0047EB14 57                      push edi
:0047EB15 57                      push edi
:0047EB16 8D45E0                  lea eax, dword ptr [ebp-20]
:0047EB19 57                      push edi
:0047EB1A 50                      push eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047EB77(U)
|
:0047EB1B FFD6                    call esi
:0047EB1D 85C0                    test eax, eax
:0047EB1F 7472                    je 0047EB93
:0047EB21 8B45E4                  mov eax, dword ptr [ebp-1C]
:0047EB24 2D01020000              sub eax, 00000201
:0047EB29 7425                    je 0047EB50
:0047EB2B 48                      dec eax
:0047EB2C 7419                    je 0047EB47
:0047EB2E 48                      dec eax
:0047EB2F 48                      dec eax
:0047EB30 740C                    je 0047EB3E
:0047EB32 48                      dec eax
:0047EB33 7525                    jne 0047EB5A
:0047EB35 8325B8A34B00FD          and dword ptr [004BA3B8], FFFFFFFD
:0047EB3C EB19                    jmp 0047EB57

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047EB30(C)
|
:0047EB3E 830DB8A34B0002          or dword ptr [004BA3B8], 00000002
:0047EB45 EB10                    jmp 0047EB57

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047EB2C(C)
|
:0047EB47 8325B8A34B00FE          and dword ptr [004BA3B8], FFFFFFFE
:0047EB4E EB07                    jmp 0047EB57

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047EB29(C)
|
:0047EB50 830DB8A34B0001          or dword ptr [004BA3B8], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047EB3C(U), :0047EB45(U), :0047EB4E(U)
|
:0047EB57 897DE4                  mov dword ptr [ebp-1C], edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047EB33(C)
|
:0047EB5A 8D45E0                  lea eax, dword ptr [ebp-20]
:0047EB5D 50                      push eax
:0047EB5E FF1510634800            call dword ptr [00486310]
:0047EB64 8D45E0                  lea eax, dword ptr [ebp-20]
:0047EB67 50                      push eax
:0047EB68 FF1514634800            call dword ptr [00486314]
:0047EB6E 6A01                    push 00000001
:0047EB70 57                      push edi
:0047EB71 57                      push edi
:0047EB72 8D45E0                  lea eax, dword ptr [ebp-20]
:0047EB75 57                      push edi
:0047EB76 50                      push eax
:0047EB77 EBA2                    jmp 0047EB1B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047EB01(C), :0047EB91(U)
|
:0047EB79 E8ECFEFFFF              call 0047EA6A
:0047EB7E 85C0                    test eax, eax
:0047EB80 7411                    je 0047EB93
:0047EB82 8D4508                  lea eax, dword ptr [ebp+08]
:0047EB85 50                      push eax
:0047EB86 8D45FC                  lea eax, dword ptr [ebp-04]
:0047EB89 50                      push eax
:0047EB8A E8ECFEFFFF              call 0047EA7B
:0047EB8F 59                      pop ecx
:0047EB90 59                      pop ecx
:0047EB91 EBE6                    jmp 0047EB79

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047EB04(C), :0047EB1F(C), :0047EB80(C)
|
:0047EB93 5F                      pop edi
:0047EB94 5E                      pop esi
:0047EB95 C9                      leave
:0047EB96 C3                      ret



* Referenced by a CALL at Addresses:
|:00421C23   , :00421C63   , :00429D77   , :0042C466   , :0042C482   
|:0042C48E   , :0042C4AF   , :0042C4BE   
|
:0047EB97 FF15E0604800            call dword ptr [004860E0]
:0047EB9D 6A32                    push 00000032
:0047EB9F 33D2                    xor edx, edx
:0047EBA1 59                      pop ecx
:0047EBA2 F7F1                    div ecx
:0047EBA4 C3                      ret



* Referenced by a CALL at Addresses:
|:00402CF4   , :00402F13   , :0041E5EC   , :0041E606   
|
:0047EBA5 837C240401              cmp dword ptr [esp+04], 00000001
:0047EBAA 756D                    jne 0047EC19
:0047EBAC 833D18C04B0000          cmp dword ptr [004BC018], 00000000
:0047EBB3 7E6A                    jle 0047EC1F
:0047EBB5 FF0D18C04B00            dec dword ptr [004BC018]
:0047EBBB 7562                    jne 0047EC1F
:0047EBBD 8B0D44D04B00            mov ecx, dword ptr [004BD044]
:0047EBC3 8BC1                    mov eax, ecx
:0047EBC5 C1E002                  shl eax, 02
:0047EBC8 FFB0207C4B00            push dword ptr [eax+004B7C20]
:0047EBCE FFB0907A4B00            push dword ptr [eax+004B7A90]
:0047EBD4 FFB0587F4B00            push dword ptr [eax+004B7F58]
:0047EBDA FFB0C87D4B00            push dword ptr [eax+004B7DC8]
:0047EBE0 51                      push ecx
:0047EBE1 E880DDFFFF              call 0047C966
:0047EBE6 A144D04B00              mov eax, dword ptr [004BD044]
:0047EBEB 83C414                  add esp, 00000014
:0047EBEE C1E002                  shl eax, 02
:0047EBF1 8B8820924B00            mov ecx, dword ptr [eax+004B9220]
:0047EBF7 83A0207C4B0000          and dword ptr [eax+004B7C20], 00000000
:0047EBFE 83A0907A4B0000          and dword ptr [eax+004B7A90], 00000000
:0047EC05 8988C87D4B00            mov dword ptr [eax+004B7DC8], ecx
:0047EC0B 8B88E09A4B00            mov ecx, dword ptr [eax+004B9AE0]
:0047EC11 8988587F4B00            mov dword ptr [eax+004B7F58], ecx
:0047EC17 EB06                    jmp 0047EC1F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047EBAA(C)
|
:0047EC19 FF0518C04B00            inc dword ptr [004BC018]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047EBB3(C), :0047EBBB(C), :0047EC17(U)
|
:0047EC1F 33C0                    xor eax, eax
:0047EC21 390518C04B00            cmp dword ptr [004BC018], eax
:0047EC27 0F9FC0                  setg al
:0047EC2A C3                      ret



* Referenced by a CALL at Addresses:
|:0044A9B6   , :004753A7   
|
:0047EC2B 55                      push ebp
:0047EC2C 8BEC                    mov ebp, esp
:0047EC2E 83EC10                  sub esp, 00000010
:0047EC31 53                      push ebx
:0047EC32 56                      push esi
:0047EC33 57                      push edi
:0047EC34 33FF                    xor edi, edi
:0047EC36 8D45F0                  lea eax, dword ptr [ebp-10]
:0047EC39 57                      push edi
:0047EC3A 50                      push eax
:0047EC3B 57                      push edi
:0047EC3C 6A30                    push 00000030
:0047EC3E FF1558634800            call dword ptr [00486358]
:0047EC44 8B357C624800            mov esi, dword ptr [0048627C]
:0047EC4A 85C0                    test eax, eax
:0047EC4C 7410                    je 0047EC5E
:0047EC4E 8B4508                  mov eax, dword ptr [ebp+08]
:0047EC51 8B4DF8                  mov ecx, dword ptr [ebp-08]
:0047EC54 8B7D0C                  mov edi, dword ptr [ebp+0C]
:0047EC57 8908                    mov dword ptr [eax], ecx
:0047EC59 8B45FC                  mov eax, dword ptr [ebp-04]
:0047EC5C EB0F                    jmp 0047EC6D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047EC4C(C)
|
:0047EC5E 57                      push edi
:0047EC5F FFD6                    call esi
:0047EC61 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047EC64 6A01                    push 00000001
:0047EC66 8901                    mov dword ptr [ecx], eax
:0047EC68 FFD6                    call esi
:0047EC6A 8B7D0C                  mov edi, dword ptr [ebp+0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047EC5C(U)
|
:0047EC6D 6A0F                    push 0000000F
:0047EC6F 8907                    mov dword ptr [edi], eax
:0047EC71 FFD6                    call esi
:0047EC73 6A04                    push 00000004
:0047EC75 8BD8                    mov ebx, eax
:0047EC77 FFD6                    call esi
:0047EC79 03D8                    add ebx, eax
:0047EC7B 291F                    sub dword ptr [edi], ebx
:0047EC7D 5F                      pop edi
:0047EC7E 5E                      pop esi
:0047EC7F 5B                      pop ebx
:0047EC80 C9                      leave
:0047EC81 C3                      ret



* Referenced by a CALL at Addresses:
|:0042B989   , :00475545   , :0047B6C4   , :0047CACE   , :0047EFD5   
|
:0047EC82 55                      push ebp
:0047EC83 8BEC                    mov ebp, esp
:0047EC85 83EC1C                  sub esp, 0000001C
:0047EC88 8B450C                  mov eax, dword ptr [ebp+0C]
:0047EC8B 834DF8FF                or dword ptr [ebp-08], FFFFFFFF
:0047EC8F 834DF4FF                or dword ptr [ebp-0C], FFFFFFFF
:0047EC93 53                      push ebx
:0047EC94 57                      push edi
:0047EC95 8B7D08                  mov edi, dword ptr [ebp+08]
:0047EC98 A320A24B00              mov dword ptr [004BA220], eax
:0047EC9D 8B4510                  mov eax, dword ptr [ebp+10]
:0047ECA0 33DB                    xor ebx, ebx
:0047ECA2 893DB8754B00            mov dword ptr [004B75B8], edi
:0047ECA8 391D2CC04B00            cmp dword ptr [004BC02C], ebx
:0047ECAE A3089E4B00              mov dword ptr [004B9E08], eax
:0047ECB3 0F8550010000            jne 0047EE09
:0047ECB9 56                      push esi
:0047ECBA 8D45E4                  lea eax, dword ptr [ebp-1C]
:0047ECBD 53                      push ebx
:0047ECBE 50                      push eax
:0047ECBF 53                      push ebx
:0047ECC0 6A30                    push 00000030
:0047ECC2 FF1558634800            call dword ptr [00486358]
:0047ECC8 85C0                    test eax, eax
:0047ECCA 740B                    je 0047ECD7
:0047ECCC 8B45EC                  mov eax, dword ptr [ebp-14]
:0047ECCF 894508                  mov dword ptr [ebp+08], eax
:0047ECD2 8B45F0                  mov eax, dword ptr [ebp-10]
:0047ECD5 EB10                    jmp 0047ECE7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047ECCA(C)
|
:0047ECD7 8B357C624800            mov esi, dword ptr [0048627C]
:0047ECDD 53                      push ebx
:0047ECDE FFD6                    call esi
:0047ECE0 6A01                    push 00000001
:0047ECE2 894508                  mov dword ptr [ebp+08], eax
:0047ECE5 FFD6                    call esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047ECD5(U)
|
:0047ECE7 8945FC                  mov dword ptr [ebp-04], eax
:0047ECEA A144D04B00              mov eax, dword ptr [004BD044]
:0047ECEF 8BC8                    mov ecx, eax
:0047ECF1 C1E102                  shl ecx, 02
:0047ECF4 8B8120924B00            mov eax, dword ptr [ecx+004B9220]
:0047ECFA 3BF8                    cmp edi, eax
:0047ECFC 7E02                    jle 0047ED00
:0047ECFE 8BF8                    mov edi, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047ECFC(C)
|
:0047ED00 8B81E09A4B00            mov eax, dword ptr [ecx+004B9AE0]
:0047ED06 39450C                  cmp dword ptr [ebp+0C], eax
:0047ED09 7E03                    jle 0047ED0E
:0047ED0B 89450C                  mov dword ptr [ebp+0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047ED09(C), :0047ED7E(C), :0047ED83(C)
|
:0047ED0E A144D04B00              mov eax, dword ptr [004BD044]

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0047ED13 6A06                    push 00000006
:0047ED15 FF750C                  push [ebp+0C]
:0047ED18 57                      push edi
:0047ED19 53                      push ebx
:0047ED1A 53                      push ebx
:0047ED1B 53                      push ebx
:0047ED1C FF348580BE4B00          push dword ptr [4*eax+004BBE80]
:0047ED23 FF1580624800            call dword ptr [00486280]
:0047ED29 8D45E4                  lea eax, dword ptr [ebp-1C]
:0047ED2C 50                      push eax
:0047ED2D A144D04B00              mov eax, dword ptr [004BD044]
:0047ED32 FF348580BE4B00          push dword ptr [4*eax+004BBE80]
:0047ED39 FF15EC624800            call dword ptr [004862EC]
:0047ED3F 8B55EC                  mov edx, dword ptr [ebp-14]
:0047ED42 A1B8754B00              mov eax, dword ptr [004B75B8]
:0047ED47 8B0D20A24B00            mov ecx, dword ptr [004BA220]
:0047ED4D 3BD0                    cmp edx, eax
:0047ED4F 7505                    jne 0047ED56
:0047ED51 394DF0                  cmp dword ptr [ebp-10], ecx
:0047ED54 7426                    je 0047ED7C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047ED4F(C)
|
:0047ED56 3B55F8                  cmp edx, dword ptr [ebp-08]
:0047ED59 7508                    jne 0047ED63
:0047ED5B 8B75F0                  mov esi, dword ptr [ebp-10]
:0047ED5E 3B75F4                  cmp esi, dword ptr [ebp-0C]
:0047ED61 7422                    je 0047ED85

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047ED59(C)
|
:0047ED63 8BF0                    mov esi, eax
:0047ED65 8955F8                  mov dword ptr [ebp-08], edx
:0047ED68 2BF2                    sub esi, edx
:0047ED6A 03FE                    add edi, esi
:0047ED6C 8BF1                    mov esi, ecx
:0047ED6E 2B75F0                  sub esi, dword ptr [ebp-10]
:0047ED71 01750C                  add dword ptr [ebp+0C], esi
:0047ED74 8B75F0                  mov esi, dword ptr [ebp-10]
:0047ED77 8975F4                  mov dword ptr [ebp-0C], esi
:0047ED7A 33DB                    xor ebx, ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047ED54(C)
|
:0047ED7C 3BD0                    cmp edx, eax
:0047ED7E 758E                    jne 0047ED0E
:0047ED80 394DF0                  cmp dword ptr [ebp-10], ecx
:0047ED83 7589                    jne 0047ED0E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047ED61(C)
|
:0047ED85 8D45E4                  lea eax, dword ptr [ebp-1C]
:0047ED88 50                      push eax
:0047ED89 A144D04B00              mov eax, dword ptr [004BD044]
:0047ED8E FF348580BE4B00          push dword ptr [4*eax+004BBE80]
:0047ED95 FF1598634800            call dword ptr [00486398]
:0047ED9B 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0047ED9E 8B7DE4                  mov edi, dword ptr [ebp-1C]
:0047EDA1 8B75F0                  mov esi, dword ptr [ebp-10]
:0047EDA4 8B45E8                  mov eax, dword ptr [ebp-18]
:0047EDA7 2BCF                    sub ecx, edi
:0047EDA9 2BF0                    sub esi, eax
:0047EDAB F6451001                test [ebp+10], 01
:0047EDAF 741B                    je 0047EDCC
:0047EDB1 8B4508                  mov eax, dword ptr [ebp+08]
:0047EDB4 2BC1                    sub eax, ecx
:0047EDB6 99                      cdq
:0047EDB7 2BC2                    sub eax, edx
:0047EDB9 8BF8                    mov edi, eax
:0047EDBB 8B45FC                  mov eax, dword ptr [ebp-04]
:0047EDBE 2BC6                    sub eax, esi
:0047EDC0 99                      cdq
:0047EDC1 D1FF                    sar edi, 1
:0047EDC3 2BC2                    sub eax, edx
:0047EDC5 897DE4                  mov dword ptr [ebp-1C], edi
:0047EDC8 D1F8                    sar eax, 1
:0047EDCA EB21                    jmp 0047EDED

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047EDAF(C)
|
:0047EDCC F6451180                test [ebp+11], 80
:0047EDD0 741E                    je 0047EDF0
:0047EDD2 8B5508                  mov edx, dword ptr [ebp+08]
:0047EDD5 3955EC                  cmp dword ptr [ebp-14], edx
:0047EDD8 7E07                    jle 0047EDE1
:0047EDDA 2BD1                    sub edx, ecx
:0047EDDC 8BFA                    mov edi, edx
:0047EDDE 897DE4                  mov dword ptr [ebp-1C], edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047EDD8(C)
|
:0047EDE1 8B55FC                  mov edx, dword ptr [ebp-04]
:0047EDE4 3955F0                  cmp dword ptr [ebp-10], edx
:0047EDE7 7E07                    jle 0047EDF0
:0047EDE9 2BD6                    sub edx, esi
:0047EDEB 8BC2                    mov eax, edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047EDCA(U)
|
:0047EDED 8945E8                  mov dword ptr [ebp-18], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047EDD0(C), :0047EDE7(C)
|
:0047EDF0 6A01                    push 00000001
:0047EDF2 56                      push esi
:0047EDF3 51                      push ecx
:0047EDF4 50                      push eax
:0047EDF5 A144D04B00              mov eax, dword ptr [004BD044]
:0047EDFA 57                      push edi
:0047EDFB FF348580BE4B00          push dword ptr [4*eax+004BBE80]
:0047EE02 FF15BC624800            call dword ptr [004862BC]
:0047EE08 5E                      pop esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047ECB3(C)
|
:0047EE09 5F                      pop edi
:0047EE0A 5B                      pop ebx
:0047EE0B C9                      leave
:0047EE0C C3                      ret



* Referenced by a CALL at Address:
|:0047CAB0   
|
:0047EE0D A144D04B00              mov eax, dword ptr [004BD044]
:0047EE12 33D2                    xor edx, edx
:0047EE14 C1E002                  shl eax, 02
:0047EE17 83B820924B00FF          cmp dword ptr [eax+004B9220], FFFFFFFF
:0047EE1E 56                      push esi
:0047EE1F 8B742408                mov esi, dword ptr [esp+08]
:0047EE23 8D8820924B00            lea ecx, dword ptr [eax+004B9220]
:0047EE29 0F94C2                  sete dl
:0047EE2C 8931                    mov dword ptr [ecx], esi
:0047EE2E 8B4C240C                mov ecx, dword ptr [esp+0C]
:0047EE32 85D2                    test edx, edx
:0047EE34 8988E09A4B00            mov dword ptr [eax+004B9AE0], ecx
:0047EE3A 7522                    jne 0047EE5E
:0047EE3C E8C6E2FFFF              call 0047D107
:0047EE41 E8D0DCFFFF              call 0047CB16
:0047EE46 85C0                    test eax, eax
:0047EE48 7404                    je 0047EE4E
:0047EE4A 33C0                    xor eax, eax
:0047EE4C 5E                      pop esi
:0047EE4D C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047EE48(C)
|
:0047EE4E A144D04B00              mov eax, dword ptr [004BD044]
:0047EE53 85C0                    test eax, eax
:0047EE55 7407                    je 0047EE5E
:0047EE57 50                      push eax
:0047EE58 E886DCFFFF              call 0047CAE3
:0047EE5D 59                      pop ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047EE3A(C), :0047EE55(C)
|
:0047EE5E 6A01                    push 00000001
:0047EE60 58                      pop eax
:0047EE61 5E                      pop esi
:0047EE62 C3                      ret



* Referenced by a CALL at Address:
|:0047CB62   
|
:0047EE63 55                      push ebp
:0047EE64 8BEC                    mov ebp, esp
:0047EE66 81EC2C040000            sub esp, 0000042C
:0047EE6C 8D85D4FBFFFF            lea eax, dword ptr [ebp+FFFFFBD4]
:0047EE72 50                      push eax
:0047EE73 E8F6040000              call 0047F36E
:0047EE78 85C0                    test eax, eax
:0047EE7A 7502                    jne 0047EE7E
:0047EE7C C9                      leave
:0047EE7D C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047EE7A(C)
|
:0047EE7E 8B4508                  mov eax, dword ptr [ebp+08]
:0047EE81 83BDDCFBFFFF00          cmp dword ptr [ebp+FFFFFBDC], 00000000
:0047EE88 57                      push edi
:0047EE89 56                      push esi
:0047EE8A 53                      push ebx
:0047EE8B 8BF0                    mov esi, eax
:0047EE8D 7D15                    jge 0047EEA4
:0047EE8F 8B450C                  mov eax, dword ptr [ebp+0C]
:0047EE92 C1E602                  shl esi, 02
:0047EE95 838E488A4B00FF          or dword ptr [esi+004B8A48], FFFFFFFF
:0047EE9C 898670A54B00            mov dword ptr [esi+004BA570], eax
:0047EEA2 EB1A                    jmp 0047EEBE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047EE8D(C)
|
:0047EEA4 8B450C                  mov eax, dword ptr [ebp+0C]
:0047EEA7 8BC8                    mov ecx, eax
:0047EEA9 C1E602                  shl esi, 02
:0047EEAC F7D9                    neg ecx
:0047EEAE C786488A4B0001000000    mov dword ptr [esi+004B8A48], 00000001
:0047EEB8 898E70A54B00            mov dword ptr [esi+004BA570], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047EEA2(U)
|
:0047EEBE 8B4D10                  mov ecx, dword ptr [ebp+10]
:0047EEC1 8985D8FBFFFF            mov dword ptr [ebp+FFFFFBD8], eax
:0047EEC7 83C110                  add ecx, 00000010
:0047EECA 0FAF8DDCFBFFFF          imul ecx, dword ptr [ebp+FFFFFBDC]
:0047EED1 898DDCFBFFFF            mov dword ptr [ebp+FFFFFBDC], ecx
:0047EED7 E862040000              call 0047F33E
:0047EEDC 8BF8                    mov edi, eax
:0047EEDE 85FF                    test edi, edi
:0047EEE0 7436                    je 0047EF18
:0047EEE2 8D45FC                  lea eax, dword ptr [ebp-04]
:0047EEE5 50                      push eax
:0047EEE6 8D85D4FBFFFF            lea eax, dword ptr [ebp+FFFFFBD4]
:0047EEEC 50                      push eax
:0047EEED 57                      push edi
:0047EEEE E8D9040000              call 0047F3CC
:0047EEF3 8BD8                    mov ebx, eax
:0047EEF5 85DB                    test ebx, ebx
:0047EEF7 7416                    je 0047EF0F
:0047EEF9 53                      push ebx
:0047EEFA 57                      push edi
:0047EEFB FF156C604800            call dword ptr [0048606C]
:0047EF01 8986F8784B00            mov dword ptr [esi+004B78F8], eax
:0047EF07 899E50774B00            mov dword ptr [esi+004B7750], ebx
:0047EF0D EB09                    jmp 0047EF18

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047EEF7(C)
|
:0047EF0F 57                      push edi
:0047EF10 FF15A0604800            call dword ptr [004860A0]
:0047EF16 33FF                    xor edi, edi

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047EEE0(C), :0047EF0D(U)
|
:0047EF18 5B                      pop ebx
:0047EF19 8BC7                    mov eax, edi
:0047EF1B 5E                      pop esi
:0047EF1C 5F                      pop edi
:0047EF1D C9                      leave
:0047EF1E C3                      ret



* Referenced by a CALL at Address:
|:0047D129   
|
:0047EF1F 8B442404                mov eax, dword ptr [esp+04]
:0047EF23 56                      push esi
:0047EF24 8BF0                    mov esi, eax
:0047EF26 C1E602                  shl esi, 02
:0047EF29 8B8648994B00            mov eax, dword ptr [esi+004B9948]
:0047EF2F 85C0                    test eax, eax
:0047EF31 742A                    je 0047EF5D
:0047EF33 8B8EF8784B00            mov ecx, dword ptr [esi+004B78F8]
:0047EF39 85C9                    test ecx, ecx
:0047EF3B 7420                    je 0047EF5D
:0047EF3D 51                      push ecx
:0047EF3E 50                      push eax
:0047EF3F FF156C604800            call dword ptr [0048606C]
:0047EF45 FFB650774B00            push dword ptr [esi+004B7750]
:0047EF4B FF1548604800            call dword ptr [00486048]
:0047EF51 FFB648994B00            push dword ptr [esi+004B9948]
:0047EF57 FF15A0604800            call dword ptr [004860A0]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047EF31(C), :0047EF3B(C)
|
:0047EF5D 5E                      pop esi
:0047EF5E C3                      ret



* Referenced by a CALL at Addresses:
|:0045F3F0   , :0045F52A   , :004602D2   , :0046031D   , :00460368   
|:004603B3   , :00460503   , :0046054E   , :00460599   , :004605E4   
|:0046062F   , :0046067A   , :004606C5   , :00460710   , :0046075B   
|:004607A6   , :004607F1   , :0047522E   
|
:0047EF5F 55                      push ebp
:0047EF60 8BEC                    mov ebp, esp
:0047EF62 83EC40                  sub esp, 00000040
:0047EF65 53                      push ebx
:0047EF66 56                      push esi
:0047EF67 8B750C                  mov esi, dword ptr [ebp+0C]
:0047EF6A 57                      push edi
:0047EF6B 8B7D10                  mov edi, dword ptr [ebp+10]
:0047EF6E 83FE05                  cmp esi, 00000005
:0047EF71 776F                    ja 0047EFE2
:0047EF73 83FE05                  cmp esi, 00000005
:0047EF76 7420                    je 0047EF98
:0047EF78 8BC6                    mov eax, esi
:0047EF7A 48                      dec eax
:0047EF7B 48                      dec eax
:0047EF7C 0F856A020000            jne 0047F1EC
:0047EF82 E880E1FFFF              call 0047D107
:0047EF87 FF35B4934B00            push dword ptr [004B93B4]
:0047EF8D FF15C0634800            call dword ptr [004863C0]
:0047EF93 E971020000              jmp 0047F209

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047EF76(C)
|
:0047EF98 6A01                    push 00000001
:0047EF9A 58                      pop eax
:0047EF9B 3BF8                    cmp edi, eax
:0047EF9D 750A                    jne 0047EFA9
:0047EF9F A32CC04B00              mov dword ptr [004BC02C], eax
:0047EFA4 E943020000              jmp 0047F1EC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047EF9D(C)
|
:0047EFA9 85FF                    test edi, edi
:0047EFAB 0F853B020000            jne 0047F1EC
:0047EFB1 393D2CC04B00            cmp dword ptr [004BC02C], edi
:0047EFB7 0F842F020000            je 0047F1EC
:0047EFBD FF35089E4B00            push dword ptr [004B9E08]
:0047EFC3 213D2CC04B00            and dword ptr [004BC02C], edi
:0047EFC9 FF3520A24B00            push dword ptr [004BA220]
:0047EFCF FF35B8754B00            push dword ptr [004B75B8]
:0047EFD5 E8A8FCFFFF              call 0047EC82
:0047EFDA 83C40C                  add esp, 0000000C
:0047EFDD E90A020000              jmp 0047F1EC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047EF71(C)
|
:0047EFE2 83FE0F                  cmp esi, 0000000F
:0047EFE5 0F87AE000000            ja 0047F099
:0047EFEB 743C                    je 0047F029
:0047EFED 8BC6                    mov eax, esi
:0047EFEF 83E806                  sub eax, 00000006
:0047EFF2 7419                    je 0047F00D
:0047EFF4 48                      dec eax
:0047EFF5 0F85F1010000            jne 0047F1EC
:0047EFFB 6A01                    push 00000001
:0047EFFD 6A00                    push 00000000
:0047EFFF FF7508                  push [ebp+08]
:0047F002 FF15A4624800            call dword ptr [004862A4]
:0047F008 E9FC010000              jmp 0047F209

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047EFF2(C)
|
:0047F00D A110C04B00              mov eax, dword ptr [004BC010]
:0047F012 85C0                    test eax, eax
:0047F014 0F84D2010000            je 0047F1EC
:0047F01A 33C9                    xor ecx, ecx
:0047F01C 85FF                    test edi, edi
:0047F01E 0F95C1                  setne cl
:0047F021 51                      push ecx
:0047F022 FFD0                    call eax
:0047F024 E9CD000000              jmp 0047F0F6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047EFEB(C)
|
:0047F029 8B5D08                  mov ebx, dword ptr [ebp+08]
:0047F02C 8D45C0                  lea eax, dword ptr [ebp-40]
:0047F02F 50                      push eax
:0047F030 53                      push ebx
:0047F031 FF1540634800            call dword ptr [00486340]
:0047F037 8BF0                    mov esi, eax
:0047F039 A1DC8B4B00              mov eax, dword ptr [004B8BDC]
:0047F03E 33FF                    xor edi, edi
:0047F040 3BC7                    cmp eax, edi
:0047F042 7410                    je 0047F054
:0047F044 57                      push edi
:0047F045 50                      push eax
:0047F046 56                      push esi
:0047F047 FF1550604800            call dword ptr [00486050]
:0047F04D 56                      push esi
:0047F04E FF154C604800            call dword ptr [0048604C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F042(C)
|
:0047F054 A128C04B00              mov eax, dword ptr [004BC028]
:0047F059 33C9                    xor ecx, ecx
:0047F05B 3BC7                    cmp eax, edi
:0047F05D 7E11                    jle 0047F070
:0047F05F BA80BE4B00              mov edx, 004BBE80

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F06E(C)
|
:0047F064 391A                    cmp dword ptr [edx], ebx
:0047F066 7408                    je 0047F070
:0047F068 41                      inc ecx
:0047F069 83C204                  add edx, 00000004
:0047F06C 3BC8                    cmp ecx, eax
:0047F06E 7CF4                    jl 0047F064

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047F05D(C), :0047F066(C)
|
:0047F070 FF348DE09A4B00          push dword ptr [4*ecx+004B9AE0]
:0047F077 FF348D20924B00          push dword ptr [4*ecx+004B9220]
:0047F07E 57                      push edi
:0047F07F 57                      push edi
:0047F080 51                      push ecx
:0047F081 E8E0D8FFFF              call 0047C966
:0047F086 83C414                  add esp, 00000014
:0047F089 8D45C0                  lea eax, dword ptr [ebp-40]
:0047F08C 50                      push eax
:0047F08D 53                      push ebx
:0047F08E FF1544634800            call dword ptr [00486344]
:0047F094 E970010000              jmp 0047F209

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047EFE5(C)
|
:0047F099 83FE14                  cmp esi, 00000014
:0047F09C 7732                    ja 0047F0D0
:0047F09E 0F8465010000            je 0047F209
:0047F0A4 83FE10                  cmp esi, 00000010
:0047F0A7 0F853F010000            jne 0047F1EC
:0047F0AD A114C04B00              mov eax, dword ptr [004BC014]
:0047F0B2 85C0                    test eax, eax
:0047F0B4 0F844F010000            je 0047F209
:0047F0BA 832514C04B0000          and dword ptr [004BC014], 00000000
:0047F0C1 8BF0                    mov esi, eax
:0047F0C3 FFD6                    call esi
:0047F0C5 893514C04B00            mov dword ptr [004BC014], esi
:0047F0CB E939010000              jmp 0047F209

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F09C(C)
|
:0047F0D0 BB00010000              mov ebx, 00000100
:0047F0D5 3BF3                    cmp esi, ebx
:0047F0D7 7733                    ja 0047F10C
:0047F0D9 7421                    je 0047F0FC
:0047F0DB 83FE7E                  cmp esi, 0000007E
:0047F0DE 0F8508010000            jne 0047F1EC
:0047F0E4 FF35D89A4B00            push dword ptr [004B9AD8]
:0047F0EA FF35D88B4B00            push dword ptr [004B8BD8]
:0047F0F0 E85FD6FFFF              call 0047C754
:0047F0F5 59                      pop ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F024(U)
|
:0047F0F6 59                      pop ecx
:0047F0F7 E9F0000000              jmp 0047F1EC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F0D9(C)
|
:0047F0FC FF7514                  push [ebp+14]
:0047F0FF FF7510                  push [ebp+10]
:0047F102 E844010000              call 0047F24B
:0047F107 E9FB000000              jmp 0047F207

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F0D7(C)
|
:0047F10C 8BC6                    mov eax, esi
:0047F10E 2D02010000              sub eax, 00000102
:0047F113 0F84E3000000            je 0047F1FC
:0047F119 2DFF000000              sub eax, 000000FF
:0047F11E 0F84C1000000            je 0047F1E5
:0047F124 48                      dec eax
:0047F125 0F84B1000000            je 0047F1DC
:0047F12B 48                      dec eax
:0047F12C 48                      dec eax
:0047F12D 0F84A0000000            je 0047F1D3
:0047F133 48                      dec eax
:0047F134 0F8490000000            je 0047F1CA
:0047F13A 2D0A010000              sub eax, 0000010A
:0047F13F 7411                    je 0047F152
:0047F141 48                      dec eax
:0047F142 48                      dec eax
:0047F143 0F85A3000000            jne 0047F1EC
:0047F149 3B7D08                  cmp edi, dword ptr [ebp+08]
:0047F14C 0F849A000000            je 0047F1EC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F13F(C)
|
:0047F152 33F6                    xor esi, esi
:0047F154 3935B07D4B00            cmp dword ptr [004B7DB0], esi
:0047F15A 7428                    je 0047F184
:0047F15C 393528C04B00            cmp dword ptr [004BC028], esi
:0047F162 7E20                    jle 0047F184
:0047F164 BF48994B00              mov edi, 004B9948

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F182(C)
|
:0047F169 6848954B00              push 004B9548
:0047F16E 53                      push ebx
:0047F16F 6A00                    push 00000000
:0047F171 FF37                    push dword ptr [edi]
:0047F173 E88A020000              call 0047F402
:0047F178 46                      inc esi
:0047F179 83C704                  add edi, 00000004
:0047F17C 3B3528C04B00            cmp esi, dword ptr [004BC028]
:0047F182 7CE5                    jl 0047F169

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047F15A(C), :0047F162(C)
|
:0047F184 FF7508                  push [ebp+08]
:0047F187 FF1598624800            call dword ptr [00486298]
:0047F18D 8BF0                    mov esi, eax
:0047F18F A1DC8B4B00              mov eax, dword ptr [004B8BDC]
:0047F194 85C0                    test eax, eax
:0047F196 740A                    je 0047F1A2
:0047F198 6A00                    push 00000000
:0047F19A 50                      push eax
:0047F19B 56                      push esi
:0047F19C FF1550604800            call dword ptr [00486050]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F196(C)
|
:0047F1A2 56                      push esi
:0047F1A3 FF154C604800            call dword ptr [0048604C]
:0047F1A9 56                      push esi
:0047F1AA 8BF8                    mov edi, eax
:0047F1AC FF7508                  push [ebp+08]
:0047F1AF FF159C624800            call dword ptr [0048629C]
:0047F1B5 85FF                    test edi, edi
:0047F1B7 740D                    je 0047F1C6
:0047F1B9 6A01                    push 00000001
:0047F1BB 6A00                    push 00000000
:0047F1BD FF7508                  push [ebp+08]
:0047F1C0 FF15A4624800            call dword ptr [004862A4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F1B7(C)
|
:0047F1C6 8BC7                    mov eax, edi
:0047F1C8 EB41                    jmp 0047F20B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F134(C)
|
:0047F1CA 8325B8A34B00FD          and dword ptr [004BA3B8], FFFFFFFD
:0047F1D1 EB19                    jmp 0047F1EC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F12D(C)
|
:0047F1D3 830DB8A34B0002          or dword ptr [004BA3B8], 00000002
:0047F1DA EB10                    jmp 0047F1EC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F125(C)
|
:0047F1DC 8325B8A34B00FE          and dword ptr [004BA3B8], FFFFFFFE
:0047F1E3 EB07                    jmp 0047F1EC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F11E(C)
|
:0047F1E5 830DB8A34B0001          or dword ptr [004BA3B8], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047EF7C(C), :0047EFA4(U), :0047EFAB(C), :0047EFB7(C), :0047EFDD(U)
|:0047EFF5(C), :0047F014(C), :0047F0A7(C), :0047F0DE(C), :0047F0F7(U)
|:0047F143(C), :0047F14C(C), :0047F1D1(U), :0047F1DA(U), :0047F1E3(U)
|
:0047F1EC FF7514                  push [ebp+14]
:0047F1EF 57                      push edi
:0047F1F0 56                      push esi
:0047F1F1 FF7508                  push [ebp+08]
:0047F1F4 FF1578634800            call dword ptr [00486378]
:0047F1FA EB0F                    jmp 0047F20B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F113(C)
|
:0047F1FC FF7514                  push [ebp+14]
:0047F1FF FF7510                  push [ebp+10]
:0047F202 E809000000              call 0047F210

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F107(U)
|
:0047F207 59                      pop ecx
:0047F208 59                      pop ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047EF93(U), :0047F008(U), :0047F094(U), :0047F09E(C), :0047F0B4(C)
|:0047F0CB(U)
|
:0047F209 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047F1C8(U), :0047F1FA(U)
|
:0047F20B 5F                      pop edi
:0047F20C 5E                      pop esi
:0047F20D 5B                      pop ebx
:0047F20E C9                      leave
:0047F20F C3                      ret



* Referenced by a CALL at Address:
|:0047F202   
|
:0047F210 8A442404                mov al, byte ptr [esp+04]
:0047F214 6625FF00                and ax, 00FF
:0047F218 50                      push eax
:0047F219 E802000000              call 0047F220
:0047F21E 59                      pop ecx
:0047F21F C3                      ret



* Referenced by a CALL at Addresses:
|:0047F219   , :0047F2C5   
|
:0047F220 833D1CC04B0010          cmp dword ptr [004BC01C], 00000010
:0047F227 7D21                    jge 0047F24A
:0047F229 A120C04B00              mov eax, dword ptr [004BC020]
:0047F22E 668B4C2404              mov cx, word ptr [esp+04]
:0047F233 66890C45C0A34B00        mov word ptr [2*eax+004BA3C0], cx
:0047F23B 40                      inc eax
:0047F23C 83E00F                  and eax, 0000000F
:0047F23F FF051CC04B00            inc dword ptr [004BC01C]
:0047F245 A320C04B00              mov dword ptr [004BC020], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F227(C)
|
:0047F24A C3                      ret

* Referenced by a CALL at Address:
|:0047F102   
|
:0047F24B 8B442404                mov eax, dword ptr [esp+04]
:0047F24F 33C9                    xor ecx, ecx
:0047F251 663D7000                cmp ax, 0070
:0047F255 7212                    jb 0047F269
:0047F257 663D7900                cmp ax, 0079
:0047F25B 770C                    ja 0047F269
:0047F25D 83E00F                  and eax, 0000000F
:0047F260 05003B0000              add eax, 00003B00
:0047F265 8BC8                    mov ecx, eax
:0047F267 EB56                    jmp 0047F2BF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047F255(C), :0047F25B(C)
|
:0047F269 0FB7C0                  movzx eax, ax
:0047F26C 83C0DF                  add eax, FFFFFFDF
:0047F26F 83F80D                  cmp eax, 0000000D
:0047F272 774B                    ja 0047F2BF
:0047F274 FF2485CCF24700          jmp dword ptr [4*eax+0047F2CC]
:0047F27B B900490000              mov ecx, 00004900
:0047F280 EB3D                    jmp 0047F2BF
:0047F282 B900510000              mov ecx, 00005100
:0047F287 EB36                    jmp 0047F2BF
:0047F289 B9004F0000              mov ecx, 00004F00
:0047F28E EB2F                    jmp 0047F2BF
:0047F290 B900470000              mov ecx, 00004700
:0047F295 EB28                    jmp 0047F2BF
:0047F297 B9004B0000              mov ecx, 00004B00
:0047F29C EB21                    jmp 0047F2BF
:0047F29E B900480000              mov ecx, 00004800
:0047F2A3 EB1A                    jmp 0047F2BF
:0047F2A5 B9004D0000              mov ecx, 00004D00
:0047F2AA EB13                    jmp 0047F2BF
:0047F2AC B900500000              mov ecx, 00005000
:0047F2B1 EB0C                    jmp 0047F2BF
:0047F2B3 B900520000              mov ecx, 00005200
:0047F2B8 EB05                    jmp 0047F2BF
:0047F2BA B900530000              mov ecx, 00005300

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047F267(U), :0047F272(C), :0047F280(U), :0047F287(U), :0047F28E(U)
|:0047F295(U), :0047F29C(U), :0047F2A3(U), :0047F2AA(U), :0047F2B1(U)
|:0047F2B8(U)
|
:0047F2BF 6685C9                  test cx, cx
:0047F2C2 7407                    je 0047F2CB
:0047F2C4 51                      push ecx
:0047F2C5 E856FFFFFF              call 0047F220
:0047F2CA 59                      pop ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F2C2(C)
|
:0047F2CB C3                      ret

:0047F2CC 7BF24700                DWORD 0047F27B
:0047F2D0 82F24700                DWORD 0047F282
:0047F2D4 89F24700                DWORD 0047F289
:0047F2D8 90F24700                DWORD 0047F290
:0047F2DC 97F24700                DWORD 0047F297
:0047F2E0 9EF24700                DWORD 0047F29E
:0047F2E4 A5F24700                DWORD 0047F2A5
:0047F2E8 ACF24700                DWORD 0047F2AC
:0047F2EC BFF24700                DWORD 0047F2BF
:0047F2F0 BFF24700                DWORD 0047F2BF
:0047F2F4 BFF24700                DWORD 0047F2BF
:0047F2F8 BFF24700                DWORD 0047F2BF
:0047F2FC B3F24700                DWORD 0047F2B3
:0047F300 BAF24700                DWORD 0047F2BA



* Referenced by a CALL at Addresses:
|:0042B573   , :00480576   
|
:0047F304 833D30C04B0000          cmp dword ptr [004BC030], 00000000
:0047F30B 7530                    jne 0047F33D
:0047F30D 832514C04B0000          and dword ptr [004BC014], 00000000
:0047F314 56                      push esi
:0047F315 8B742408                mov esi, dword ptr [esp+08]
:0047F319 FF3580BE4B00            push dword ptr [004BBE80]
:0047F31F C70530C04B0001000000    mov dword ptr [004BC030], 00000001
:0047F329 8935B4934B00            mov dword ptr [004B93B4], esi
:0047F32F FF1554624800            call dword ptr [00486254]
:0047F335 56                      push esi
:0047F336 FF15C0614800            call dword ptr [004861C0]
:0047F33C 5E                      pop esi
:0047F33D C3                      ret



* Referenced by a CALL at Address:
|:0047EED7   
|
:0047F33E 56                      push esi
:0047F33F 57                      push edi
:0047F340 6A00                    push 00000000
:0047F342 FF1598624800            call dword ptr [00486298]
:0047F348 8BF8                    mov edi, eax
:0047F34A 57                      push edi
:0047F34B FF1564604800            call dword ptr [00486064]
:0047F351 8BF0                    mov esi, eax
:0047F353 85F6                    test esi, esi
:0047F355 7409                    je 0047F360
:0047F357 6A03                    push 00000003
:0047F359 56                      push esi
:0047F35A FF1558604800            call dword ptr [00486058]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F355(C)
|
:0047F360 57                      push edi
:0047F361 6A00                    push 00000000
:0047F363 FF159C624800            call dword ptr [0048629C]
:0047F369 8BC6                    mov eax, esi
:0047F36B 5F                      pop edi
:0047F36C 5E                      pop esi
:0047F36D C3                      ret



* Referenced by a CALL at Address:
|:0047EE73   
|
:0047F36E 53                      push ebx
:0047F36F 33DB                    xor ebx, ebx
:0047F371 56                      push esi
:0047F372 53                      push ebx
:0047F373 FF1598624800            call dword ptr [00486298]
:0047F379 8BF0                    mov esi, eax
:0047F37B 6A0C                    push 0000000C
:0047F37D 56                      push esi
:0047F37E FF153C604800            call dword ptr [0048603C]
:0047F384 56                      push esi
:0047F385 53                      push ebx
:0047F386 FF159C624800            call dword ptr [0048629C]
:0047F38C 6A01                    push 00000001
:0047F38E 8B4C2410                mov ecx, dword ptr [esp+10]
:0047F392 58                      pop eax
:0047F393 5E                      pop esi
:0047F394 895910                  mov dword ptr [ecx+10], ebx
:0047F397 895914                  mov dword ptr [ecx+14], ebx
:0047F39A 895918                  mov dword ptr [ecx+18], ebx
:0047F39D 89591C                  mov dword ptr [ecx+1C], ebx
:0047F3A0 895920                  mov dword ptr [ecx+20], ebx
:0047F3A3 895924                  mov dword ptr [ecx+24], ebx
:0047F3A6 885928                  mov byte ptr [ecx+28], bl
:0047F3A9 88592A                  mov byte ptr [ecx+2A], bl
:0047F3AC 885929                  mov byte ptr [ecx+29], bl
:0047F3AF 88592B                  mov byte ptr [ecx+2B], bl
:0047F3B2 C70128000000            mov dword ptr [ecx], 00000028
:0047F3B8 894104                  mov dword ptr [ecx+04], eax
:0047F3BB 894108                  mov dword ptr [ecx+08], eax
:0047F3BE 6689410C                mov word ptr [ecx+0C], ax
:0047F3C2 66C7410E0800            mov [ecx+0E], 0008
:0047F3C8 5B                      pop ebx
:0047F3C9 C20400                  ret 0004



* Referenced by a CALL at Address:
|:0047EEEE   
|
:0047F3CC 33C0                    xor eax, eax
:0047F3CE 50                      push eax
:0047F3CF 50                      push eax
:0047F3D0 FF742414                push [esp+14]
:0047F3D4 50                      push eax
:0047F3D5 FF742418                push [esp+18]
:0047F3D9 FF742418                push [esp+18]
:0047F3DD FF1580604800            call dword ptr [00486080]
:0047F3E3 C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:0047CB0A   , :0047CBA0   
|
:0047F3E6 55                      push ebp
:0047F3E7 8BEC                    mov ebp, esp
:0047F3E9 83EC18                  sub esp, 00000018
:0047F3EC 8D45E8                  lea eax, dword ptr [ebp-18]
:0047F3EF 50                      push eax
:0047F3F0 6A18                    push 00000018
:0047F3F2 FF7508                  push [ebp+08]
:0047F3F5 FF15BC604800            call dword ptr [004860BC]
:0047F3FB 8B45FC                  mov eax, dword ptr [ebp-04]
:0047F3FE C9                      leave
:0047F3FF C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0047C7F3   , :0047CA14   , :0047CBD0   , :0047E95A   , :0047F173   
|
:0047F402 FF742410                push [esp+10]
:0047F406 FF742410                push [esp+10]
:0047F40A FF742410                push [esp+10]
:0047F40E FF742410                push [esp+10]
:0047F412 FF1528604800            call dword ptr [00486028]
:0047F418 C21000                  ret 0010



* Referenced by a CALL at Address:
|:0047CA71   
|
:0047F41B 55                      push ebp
:0047F41C 8BEC                    mov ebp, esp
:0047F41E 682000CC00              push 00CC0020
:0047F423 FF7524                  push [ebp+24]
:0047F426 FF7520                  push [ebp+20]
:0047F429 FF751C                  push [ebp+1C]
:0047F42C FF7518                  push [ebp+18]
:0047F42F FF7514                  push [ebp+14]
:0047F432 FF7510                  push [ebp+10]
:0047F435 FF750C                  push [ebp+0C]
:0047F438 FF7508                  push [ebp+08]
:0047F43B FF1570604800            call dword ptr [00486070]
:0047F441 5D                      pop ebp
:0047F442 C22000                  ret 0020



* Referenced by a CALL at Addresses:
|:0047C782   , :0047CEE9   
|
:0047F445 55                      push ebp
:0047F446 8BEC                    mov ebp, esp
:0047F448 81EC08040000            sub esp, 00000408
:0047F44E 53                      push ebx
:0047F44F 56                      push esi
:0047F450 BB00010000              mov ebx, 00000100
:0047F455 57                      push edi
:0047F456 8BCB                    mov ecx, ebx
:0047F458 33C0                    xor eax, eax
:0047F45A 8DBDFCFBFFFF            lea edi, dword ptr [ebp+FFFFFBFC]
:0047F460 66C785F8FBFFFF0003      mov word ptr [ebp+FFFFFBF8], 0300
:0047F469 66899DFAFBFFFF          mov word ptr [ebp+FFFFFBFA], bx
:0047F470 50                      push eax
:0047F471 F3                      repz
:0047F472 AB                      stosd
:0047F473 FF1598624800            call dword ptr [00486298]
:0047F479 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0047F47C 8B5508                  mov edx, dword ptr [ebp+08]
:0047F47F 6A18                    push 00000018
:0047F481 50                      push eax
:0047F482 8945FC                  mov dword ptr [ebp-04], eax
:0047F485 8D7411FF                lea esi, dword ptr [ecx+edx-01]
:0047F489 FF153C604800            call dword ptr [0048603C]
:0047F48F 99                      cdq
:0047F490 2BC2                    sub eax, edx
:0047F492 8BF8                    mov edi, eax
:0047F494 8D85FCFBFFFF            lea eax, dword ptr [ebp+FFFFFBFC]
:0047F49A 50                      push eax
:0047F49B 53                      push ebx
:0047F49C 6A00                    push 00000000
:0047F49E FF75FC                  push [ebp-04]
:0047F4A1 D1FF                    sar edi, 1
:0047F4A3 FF152C604800            call dword ptr [0048602C]
:0047F4A9 397D08                  cmp dword ptr [ebp+08], edi
:0047F4AC 7D03                    jge 0047F4B1
:0047F4AE 897D08                  mov dword ptr [ebp+08], edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F4AC(C)
|
:0047F4B1 B8FF000000              mov eax, 000000FF
:0047F4B6 2BC7                    sub eax, edi
:0047F4B8 3BF0                    cmp esi, eax
:0047F4BA 7E02                    jle 0047F4BE
:0047F4BC 8BF0                    mov esi, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F4BA(C)
|
:0047F4BE 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047F4C1 33D2                    xor edx, edx
:0047F4C3 85C9                    test ecx, ecx
:0047F4C5 7E11                    jle 0047F4D8
:0047F4C7 8D85FFFBFFFF            lea eax, dword ptr [ebp+FFFFFBFF]
:0047F4CD 8BD1                    mov edx, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F4D6(C)
|
:0047F4CF 802000                  and byte ptr [eax], 00
:0047F4D2 83C004                  add eax, 00000004
:0047F4D5 49                      dec ecx
:0047F4D6 75F7                    jne 0047F4CF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F4C5(C)
|
:0047F4D8 3BD6                    cmp edx, esi
:0047F4DA 7F5D                    jg 0047F539
:0047F4DC 8B4D10                  mov ecx, dword ptr [ebp+10]
:0047F4DF 8D9DFCFBFFFF            lea ebx, dword ptr [ebp+FFFFFBFC]
:0047F4E5 2BD9                    sub ebx, ecx
:0047F4E7 8DBDFBFBFFFF            lea edi, dword ptr [ebp+FFFFFBFB]
:0047F4ED 895D0C                  mov dword ptr [ebp+0C], ebx
:0047F4F0 8D9DFDFBFFFF            lea ebx, dword ptr [ebp+FFFFFBFD]
:0047F4F6 2BD9                    sub ebx, ecx
:0047F4F8 2BF2                    sub esi, edx
:0047F4FA 895D10                  mov dword ptr [ebp+10], ebx
:0047F4FD 8D9DFEFBFFFF            lea ebx, dword ptr [ebp+FFFFFBFE]
:0047F503 2BF9                    sub edi, ecx
:0047F505 2BD9                    sub ebx, ecx
:0047F507 46                      inc esi
:0047F508 8D449101                lea eax, dword ptr [ecx+4*edx+01]
:0047F50C 897508                  mov dword ptr [ebp+08], esi
:0047F50F 03D6                    add edx, esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F532(C)
|
:0047F511 8A4801                  mov cl, byte ptr [eax+01]
:0047F514 8B750C                  mov esi, dword ptr [ebp+0C]
:0047F517 880C07                  mov byte ptr [edi+eax], cl
:0047F51A 8A08                    mov cl, byte ptr [eax]
:0047F51C 880C06                  mov byte ptr [esi+eax], cl
:0047F51F 8B7510                  mov esi, dword ptr [ebp+10]
:0047F522 8A48FF                  mov cl, byte ptr [eax-01]
:0047F525 880C06                  mov byte ptr [esi+eax], cl
:0047F528 C6040301                mov byte ptr [ebx+eax], 01
:0047F52C 83C004                  add eax, 00000004
:0047F52F FF4D08                  dec [ebp+08]
:0047F532 75DD                    jne 0047F511
:0047F534 BB00010000              mov ebx, 00000100

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F4DA(C)
|
:0047F539 3BD3                    cmp edx, ebx
:0047F53B 7D12                    jge 0047F54F
:0047F53D 8D8495FFFBFFFF          lea eax, dword ptr [ebp+4*edx-00000401]
:0047F544 2BDA                    sub ebx, edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F54D(C)
|
:0047F546 802000                  and byte ptr [eax], 00
:0047F549 83C004                  add eax, 00000004
:0047F54C 4B                      dec ebx
:0047F54D 75F7                    jne 0047F546

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F53B(C)
|
:0047F54F FF75FC                  push [ebp-04]
:0047F552 6A00                    push 00000000
:0047F554 FF159C624800            call dword ptr [0048629C]
:0047F55A 8D85F8FBFFFF            lea eax, dword ptr [ebp+FFFFFBF8]
:0047F560 50                      push eax
:0047F561 FF1554604800            call dword ptr [00486054]
:0047F567 5F                      pop edi
:0047F568 5E                      pop esi
:0047F569 5B                      pop ebx
:0047F56A C9                      leave
:0047F56B C3                      ret



* Referenced by a CALL at Addresses:
|:0047C771   , :0047CED8   
|
:0047F56C 55                      push ebp
:0047F56D 8BEC                    mov ebp, esp
:0047F56F 81EC08040000            sub esp, 00000408
:0047F575 53                      push ebx
:0047F576 56                      push esi
:0047F577 BA00010000              mov edx, 00000100
:0047F57C 57                      push edi
:0047F57D 8BCA                    mov ecx, edx
:0047F57F 33C0                    xor eax, eax
:0047F581 8DBDFCFBFFFF            lea edi, dword ptr [ebp+FFFFFBFC]
:0047F587 66C785F8FBFFFF0003      mov word ptr [ebp+FFFFFBF8], 0300
:0047F590 668995FAFBFFFF          mov word ptr [ebp+FFFFFBFA], dx
:0047F597 33DB                    xor ebx, ebx
:0047F599 F3                      repz
:0047F59A AB                      stosd
:0047F59B 8D85FDFBFFFF            lea eax, dword ptr [ebp+FFFFFBFD]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F5B1(C)
|
:0047F5A1 8858FF                  mov byte ptr [eax-01], bl
:0047F5A4 8818                    mov byte ptr [eax], bl
:0047F5A6 885801                  mov byte ptr [eax+01], bl
:0047F5A9 C6400204                mov [eax+02], 04
:0047F5AD 83C004                  add eax, 00000004
:0047F5B0 4A                      dec edx
:0047F5B1 75EE                    jne 0047F5A1
:0047F5B3 53                      push ebx
:0047F5B4 FF1598624800            call dword ptr [00486298]
:0047F5BA 8BF8                    mov edi, eax
:0047F5BC 8D85F8FBFFFF            lea eax, dword ptr [ebp+FFFFFBF8]
:0047F5C2 50                      push eax
:0047F5C3 FF1554604800            call dword ptr [00486054]
:0047F5C9 8B3550604800            mov esi, dword ptr [00486050]
:0047F5CF 53                      push ebx
:0047F5D0 50                      push eax
:0047F5D1 57                      push edi
:0047F5D2 FFD6                    call esi
:0047F5D4 57                      push edi
:0047F5D5 8945FC                  mov dword ptr [ebp-04], eax
:0047F5D8 FF154C604800            call dword ptr [0048604C]
:0047F5DE 53                      push ebx
:0047F5DF FF75FC                  push [ebp-04]
:0047F5E2 57                      push edi
:0047F5E3 FFD6                    call esi
:0047F5E5 50                      push eax
:0047F5E6 FF1548604800            call dword ptr [00486048]
:0047F5EC 57                      push edi
:0047F5ED 53                      push ebx
:0047F5EE FF159C624800            call dword ptr [0048629C]
:0047F5F4 5F                      pop edi
:0047F5F5 5E                      pop esi
:0047F5F6 5B                      pop ebx
:0047F5F7 C9                      leave
:0047F5F8 C3                      ret



* Referenced by a CALL at Address:
|:0047D364   
|
:0047F5F9 55                      push ebp
:0047F5FA 8BEC                    mov ebp, esp
:0047F5FC 8B450C                  mov eax, dword ptr [ebp+0C]
:0047F5FF 0FAF4508                imul eax, dword ptr [ebp+08]
:0047F603 837D1407                cmp dword ptr [ebp+14], 00000007
:0047F607 50                      push eax
:0047F608 7504                    jne 0047F60E
:0047F60A 6A00                    push 00000000
:0047F60C EB02                    jmp 0047F610

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F608(C)
|
:0047F60E 6A10                    push 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F60C(U)
|
:0047F610 FF7510                  push [ebp+10]
:0047F613 E818150000              call 00480B30
:0047F618 83C40C                  add esp, 0000000C
:0047F61B 5D                      pop ebp
:0047F61C C3                      ret



* Referenced by a CALL at Address:
|:0047DD72   
|
:0047F61D 55                      push ebp
:0047F61E 8BEC                    mov ebp, esp
:0047F620 53                      push ebx
:0047F621 8B5D0C                  mov ebx, dword ptr [ebp+0C]
:0047F624 85DB                    test ebx, ebx
:0047F626 7E1E                    jle 0047F646
:0047F628 57                      push edi
:0047F629 8B7D18                  mov edi, dword ptr [ebp+18]
:0047F62C 56                      push esi
:0047F62D 0FB67514                movzx esi, byte ptr [ebp+14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F642(C)
|
:0047F631 FF7508                  push [ebp+08]
:0047F634 56                      push esi
:0047F635 57                      push edi
:0047F636 E8F5140000              call 00480B30
:0047F63B 037D10                  add edi, dword ptr [ebp+10]
:0047F63E 83C40C                  add esp, 0000000C
:0047F641 4B                      dec ebx
:0047F642 75ED                    jne 0047F631
:0047F644 5E                      pop esi
:0047F645 5F                      pop edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F626(C)
|
:0047F646 5B                      pop ebx
:0047F647 5D                      pop ebp
:0047F648 C3                      ret



* Referenced by a CALL at Addresses:
|:0047E213   , :0047E5B9   
|
:0047F649 55                      push ebp
:0047F64A 8BEC                    mov ebp, esp
:0047F64C 53                      push ebx
:0047F64D 8B5D0C                  mov ebx, dword ptr [ebp+0C]
:0047F650 85DB                    test ebx, ebx
:0047F652 7E20                    jle 0047F674
:0047F654 57                      push edi
:0047F655 8B7D18                  mov edi, dword ptr [ebp+18]
:0047F658 56                      push esi
:0047F659 8B751C                  mov esi, dword ptr [ebp+1C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F670(C)
|
:0047F65C FF7508                  push [ebp+08]
:0047F65F 57                      push edi
:0047F660 56                      push esi
:0047F661 E88A110000              call 004807F0
:0047F666 037510                  add esi, dword ptr [ebp+10]
:0047F669 037D14                  add edi, dword ptr [ebp+14]
:0047F66C 83C40C                  add esp, 0000000C
:0047F66F 4B                      dec ebx
:0047F670 75EA                    jne 0047F65C
:0047F672 5E                      pop esi
:0047F673 5F                      pop edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F652(C)
|
:0047F674 5B                      pop ebx
:0047F675 5D                      pop ebp
:0047F676 C3                      ret



* Referenced by a CALL at Addresses:
|:0047E1DF   , :0047E585   
|
:0047F677 55                      push ebp
:0047F678 8BEC                    mov ebp, esp
:0047F67A 8B4510                  mov eax, dword ptr [ebp+10]
:0047F67D 8B4D14                  mov ecx, dword ptr [ebp+14]
:0047F680 8B550C                  mov edx, dword ptr [ebp+0C]
:0047F683 2B4508                  sub eax, dword ptr [ebp+08]
:0047F686 2B4D08                  sub ecx, dword ptr [ebp+08]
:0047F689 85D2                    test edx, edx
:0047F68B 7E28                    jle 0047F6B5
:0047F68D 57                      push edi
:0047F68E 8B7D18                  mov edi, dword ptr [ebp+18]
:0047F691 56                      push esi
:0047F692 8B751C                  mov esi, dword ptr [ebp+1C]
:0047F695 53                      push ebx
:0047F696 895510                  mov dword ptr [ebp+10], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F6B0(C)
|
:0047F699 8B5508                  mov edx, dword ptr [ebp+08]
:0047F69C 85D2                    test edx, edx
:0047F69E 7E09                    jle 0047F6A9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F6A7(C)
|
:0047F6A0 8A1F                    mov bl, byte ptr [edi]
:0047F6A2 201E                    and byte ptr [esi], bl
:0047F6A4 47                      inc edi
:0047F6A5 46                      inc esi
:0047F6A6 4A                      dec edx
:0047F6A7 75F7                    jne 0047F6A0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F69E(C)
|
:0047F6A9 03F0                    add esi, eax
:0047F6AB 03F9                    add edi, ecx
:0047F6AD FF4D10                  dec [ebp+10]
:0047F6B0 75E7                    jne 0047F699
:0047F6B2 5B                      pop ebx
:0047F6B3 5E                      pop esi
:0047F6B4 5F                      pop edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F68B(C)
|
:0047F6B5 5D                      pop ebp
:0047F6B6 C3                      ret



* Referenced by a CALL at Addresses:
|:0047E1C5   , :0047E56B   
|
:0047F6B7 55                      push ebp
:0047F6B8 8BEC                    mov ebp, esp
:0047F6BA 8B4510                  mov eax, dword ptr [ebp+10]
:0047F6BD 8B4D14                  mov ecx, dword ptr [ebp+14]
:0047F6C0 8B550C                  mov edx, dword ptr [ebp+0C]
:0047F6C3 2B4508                  sub eax, dword ptr [ebp+08]
:0047F6C6 2B4D08                  sub ecx, dword ptr [ebp+08]
:0047F6C9 85D2                    test edx, edx
:0047F6CB 7E28                    jle 0047F6F5
:0047F6CD 57                      push edi
:0047F6CE 8B7D18                  mov edi, dword ptr [ebp+18]
:0047F6D1 56                      push esi
:0047F6D2 8B751C                  mov esi, dword ptr [ebp+1C]
:0047F6D5 53                      push ebx
:0047F6D6 895510                  mov dword ptr [ebp+10], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F6F0(C)
|
:0047F6D9 8B5508                  mov edx, dword ptr [ebp+08]
:0047F6DC 85D2                    test edx, edx
:0047F6DE 7E09                    jle 0047F6E9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F6E7(C)
|
:0047F6E0 8A1F                    mov bl, byte ptr [edi]
:0047F6E2 081E                    or byte ptr [esi], bl
:0047F6E4 47                      inc edi
:0047F6E5 46                      inc esi
:0047F6E6 4A                      dec edx
:0047F6E7 75F7                    jne 0047F6E0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F6DE(C)
|
:0047F6E9 03F0                    add esi, eax
:0047F6EB 03F9                    add edi, ecx
:0047F6ED FF4D10                  dec [ebp+10]
:0047F6F0 75E7                    jne 0047F6D9
:0047F6F2 5B                      pop ebx
:0047F6F3 5E                      pop esi
:0047F6F4 5F                      pop edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F6CB(C)
|
:0047F6F5 5D                      pop ebp
:0047F6F6 C3                      ret



* Referenced by a CALL at Addresses:
|:0047E1F9   , :0047E59F   
|
:0047F6F7 55                      push ebp
:0047F6F8 8BEC                    mov ebp, esp
:0047F6FA 8B4510                  mov eax, dword ptr [ebp+10]
:0047F6FD 8B4D14                  mov ecx, dword ptr [ebp+14]
:0047F700 8B550C                  mov edx, dword ptr [ebp+0C]
:0047F703 2B4508                  sub eax, dword ptr [ebp+08]
:0047F706 2B4D08                  sub ecx, dword ptr [ebp+08]
:0047F709 85D2                    test edx, edx
:0047F70B 7E31                    jle 0047F73E
:0047F70D 57                      push edi
:0047F70E 8B7D18                  mov edi, dword ptr [ebp+18]
:0047F711 56                      push esi
:0047F712 8B751C                  mov esi, dword ptr [ebp+1C]
:0047F715 53                      push ebx
:0047F716 895510                  mov dword ptr [ebp+10], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F739(C)
|
:0047F719 8B5508                  mov edx, dword ptr [ebp+08]
:0047F71C 85D2                    test edx, edx
:0047F71E 7E12                    jle 0047F732

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F730(C)
|
:0047F720 837D2007                cmp dword ptr [ebp+20], 00000007
:0047F724 7403                    je 0047F729
:0047F726 80260F                  and byte ptr [esi], 0F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F724(C)
|
:0047F729 8A1F                    mov bl, byte ptr [edi]
:0047F72B 301E                    xor byte ptr [esi], bl
:0047F72D 47                      inc edi
:0047F72E 46                      inc esi
:0047F72F 4A                      dec edx
:0047F730 75EE                    jne 0047F720

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F71E(C)
|
:0047F732 03F0                    add esi, eax
:0047F734 03F9                    add edi, ecx
:0047F736 FF4D10                  dec [ebp+10]
:0047F739 75DE                    jne 0047F719
:0047F73B 5B                      pop ebx
:0047F73C 5E                      pop esi
:0047F73D 5F                      pop edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F70B(C)
|
:0047F73E 5D                      pop ebp
:0047F73F C3                      ret



* Referenced by a CALL at Address:
|:0047E1AB   
|
:0047F740 55                      push ebp
:0047F741 8BEC                    mov ebp, esp
:0047F743 8B4510                  mov eax, dword ptr [ebp+10]
:0047F746 8B4D14                  mov ecx, dword ptr [ebp+14]
:0047F749 8B550C                  mov edx, dword ptr [ebp+0C]
:0047F74C 2B4508                  sub eax, dword ptr [ebp+08]
:0047F74F 2B4D08                  sub ecx, dword ptr [ebp+08]
:0047F752 85D2                    test edx, edx
:0047F754 7E3C                    jle 0047F792
:0047F756 57                      push edi
:0047F757 8B7D1C                  mov edi, dword ptr [ebp+1C]
:0047F75A 56                      push esi
:0047F75B 8B7518                  mov esi, dword ptr [ebp+18]
:0047F75E 53                      push ebx
:0047F75F 895514                  mov dword ptr [ebp+14], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F78D(C)
|
:0047F762 8B5508                  mov edx, dword ptr [ebp+08]
:0047F765 85D2                    test edx, edx
:0047F767 7E1D                    jle 0047F786
:0047F769 895510                  mov dword ptr [ebp+10], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F784(C)
|
:0047F76C 8A16                    mov dl, byte ptr [esi]
:0047F76E 837D2007                cmp dword ptr [ebp+20], 00000007
:0047F772 8ADA                    mov bl, dl
:0047F774 7403                    je 0047F779
:0047F776 80E30F                  and bl, 0F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F774(C)
|
:0047F779 84DB                    test bl, bl
:0047F77B 7402                    je 0047F77F
:0047F77D 8817                    mov byte ptr [edi], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F77B(C)
|
:0047F77F 47                      inc edi
:0047F780 46                      inc esi
:0047F781 FF4D10                  dec [ebp+10]
:0047F784 75E6                    jne 0047F76C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F767(C)
|
:0047F786 03F8                    add edi, eax
:0047F788 03F1                    add esi, ecx
:0047F78A FF4D14                  dec [ebp+14]
:0047F78D 75D3                    jne 0047F762
:0047F78F 5B                      pop ebx
:0047F790 5E                      pop esi
:0047F791 5F                      pop edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F754(C)
|
:0047F792 5D                      pop ebp
:0047F793 C3                      ret



* Referenced by a CALL at Addresses:
|:0047E32B   , :0047E375   
|
:0047F794 55                      push ebp
:0047F795 8BEC                    mov ebp, esp
:0047F797 53                      push ebx
:0047F798 8B5D0C                  mov ebx, dword ptr [ebp+0C]
:0047F79B 85DB                    test ebx, ebx
:0047F79D 7E20                    jle 0047F7BF
:0047F79F 57                      push edi
:0047F7A0 8B7D18                  mov edi, dword ptr [ebp+18]
:0047F7A3 56                      push esi
:0047F7A4 8B751C                  mov esi, dword ptr [ebp+1C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F7BB(C)
|
:0047F7A7 FF7508                  push [ebp+08]
:0047F7AA 57                      push edi
:0047F7AB 56                      push esi
:0047F7AC E83F100000              call 004807F0
:0047F7B1 037514                  add esi, dword ptr [ebp+14]
:0047F7B4 037D10                  add edi, dword ptr [ebp+10]
:0047F7B7 83C40C                  add esp, 0000000C
:0047F7BA 4B                      dec ebx
:0047F7BB 75EA                    jne 0047F7A7
:0047F7BD 5E                      pop esi
:0047F7BE 5F                      pop edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F79D(C)
|
:0047F7BF 5B                      pop ebx
:0047F7C0 5D                      pop ebp
:0047F7C1 C3                      ret



* Referenced by a CALL at Address:
|:0047E617   
|
:0047F7C2 55                      push ebp
:0047F7C3 8BEC                    mov ebp, esp
:0047F7C5 51                      push ecx
:0047F7C6 8B450C                  mov eax, dword ptr [ebp+0C]
:0047F7C9 85C0                    test eax, eax
:0047F7CB 7E6C                    jle 0047F839
:0047F7CD 57                      push edi
:0047F7CE 8B7D1C                  mov edi, dword ptr [ebp+1C]
:0047F7D1 56                      push esi
:0047F7D2 53                      push ebx
:0047F7D3 8B5D08                  mov ebx, dword ptr [ebp+08]
:0047F7D6 89450C                  mov dword ptr [ebp+0C], eax
:0047F7D9 C1FB03                  sar ebx, 03
:0047F7DC 895DFC                  mov dword ptr [ebp-04], ebx
:0047F7DF EB03                    jmp 0047F7E4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F834(C)
|
:0047F7E1 8B5DFC                  mov ebx, dword ptr [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F7DF(U)
|
:0047F7E4 8B7520                  mov esi, dword ptr [ebp+20]
:0047F7E7 85DB                    test ebx, ebx
:0047F7E9 741E                    je 0047F809
:0047F7EB 7E1C                    jle 0047F809

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F807(C)
|
:0047F7ED 8A0F                    mov cl, byte ptr [edi]
:0047F7EF 6A08                    push 00000008
:0047F7F1 47                      inc edi
:0047F7F2 5A                      pop edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F804(C)
|
:0047F7F3 8B4514                  mov eax, dword ptr [ebp+14]
:0047F7F6 F6C180                  test cl, 80
:0047F7F9 7503                    jne 0047F7FE
:0047F7FB 8B4518                  mov eax, dword ptr [ebp+18]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F7F9(C)
|
:0047F7FE 8806                    mov byte ptr [esi], al
:0047F800 46                      inc esi
:0047F801 D0E1                    shl cl, 1
:0047F803 4A                      dec edx
:0047F804 75ED                    jne 0047F7F3
:0047F806 4B                      dec ebx
:0047F807 75E4                    jne 0047F7ED

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047F7E9(C), :0047F7EB(C)
|
:0047F809 8B4508                  mov eax, dword ptr [ebp+08]
:0047F80C 83E007                  and eax, 00000007
:0047F80F 741A                    je 0047F82B
:0047F811 8A17                    mov dl, byte ptr [edi]
:0047F813 47                      inc edi
:0047F814 85C0                    test eax, eax
:0047F816 7E13                    jle 0047F82B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F829(C)
|
:0047F818 8B4D14                  mov ecx, dword ptr [ebp+14]
:0047F81B F6C280                  test dl, 80
:0047F81E 7503                    jne 0047F823
:0047F820 8B4D18                  mov ecx, dword ptr [ebp+18]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F81E(C)
|
:0047F823 880E                    mov byte ptr [esi], cl
:0047F825 46                      inc esi
:0047F826 D0E2                    shl dl, 1
:0047F828 48                      dec eax
:0047F829 75ED                    jne 0047F818

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047F80F(C), :0047F816(C)
|
:0047F82B 8B4510                  mov eax, dword ptr [ebp+10]
:0047F82E 014520                  add dword ptr [ebp+20], eax
:0047F831 FF4D0C                  dec [ebp+0C]
:0047F834 75AB                    jne 0047F7E1
:0047F836 5B                      pop ebx
:0047F837 5E                      pop esi
:0047F838 5F                      pop edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F7CB(C)
|
:0047F839 C9                      leave
:0047F83A C3                      ret



* Referenced by a CALL at Address:
|:0047E5FC   
|
:0047F83B 55                      push ebp
:0047F83C 8BEC                    mov ebp, esp
:0047F83E 51                      push ecx
:0047F83F 8B450C                  mov eax, dword ptr [ebp+0C]
:0047F842 85C0                    test eax, eax
:0047F844 7E64                    jle 0047F8AA
:0047F846 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047F849 57                      push edi
:0047F84A 8B7D1C                  mov edi, dword ptr [ebp+1C]
:0047F84D 56                      push esi
:0047F84E C1F903                  sar ecx, 03
:0047F851 53                      push ebx
:0047F852 8A5D14                  mov bl, byte ptr [ebp+14]
:0047F855 894DFC                  mov dword ptr [ebp-04], ecx
:0047F858 89450C                  mov dword ptr [ebp+0C], eax
:0047F85B EB03                    jmp 0047F860

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F8A5(C)
|
:0047F85D 8B4DFC                  mov ecx, dword ptr [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F85B(U)
|
:0047F860 8B5520                  mov edx, dword ptr [ebp+20]
:0047F863 85C9                    test ecx, ecx
:0047F865 7417                    je 0047F87E
:0047F867 7E15                    jle 0047F87E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F87C(C)
|
:0047F869 8A07                    mov al, byte ptr [edi]
:0047F86B 6A08                    push 00000008
:0047F86D 47                      inc edi
:0047F86E 5E                      pop esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F879(C)
|
:0047F86F A880                    test al, 80
:0047F871 7402                    je 0047F875
:0047F873 881A                    mov byte ptr [edx], bl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F871(C)
|
:0047F875 42                      inc edx
:0047F876 D0E0                    shl al, 1
:0047F878 4E                      dec esi
:0047F879 75F4                    jne 0047F86F
:0047F87B 49                      dec ecx
:0047F87C 75EB                    jne 0047F869

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047F865(C), :0047F867(C)
|
:0047F87E 8B4508                  mov eax, dword ptr [ebp+08]
:0047F881 83E007                  and eax, 00000007
:0047F884 7416                    je 0047F89C
:0047F886 8A0F                    mov cl, byte ptr [edi]
:0047F888 47                      inc edi
:0047F889 85C0                    test eax, eax
:0047F88B 7E0F                    jle 0047F89C
:0047F88D 8BF0                    mov esi, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F89A(C)
|
:0047F88F F6C180                  test cl, 80
:0047F892 7402                    je 0047F896
:0047F894 881A                    mov byte ptr [edx], bl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F892(C)
|
:0047F896 42                      inc edx
:0047F897 D0E1                    shl cl, 1
:0047F899 4E                      dec esi
:0047F89A 75F3                    jne 0047F88F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047F884(C), :0047F88B(C)
|
:0047F89C 8B4510                  mov eax, dword ptr [ebp+10]
:0047F89F 014520                  add dword ptr [ebp+20], eax
:0047F8A2 FF4D0C                  dec [ebp+0C]
:0047F8A5 75B6                    jne 0047F85D
:0047F8A7 5B                      pop ebx
:0047F8A8 5E                      pop esi
:0047F8A9 5F                      pop edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F844(C)
|
:0047F8AA C9                      leave
:0047F8AB C3                      ret



* Referenced by a CALL at Address:
|:0047E33D   
|
:0047F8AC 55                      push ebp
:0047F8AD 8BEC                    mov ebp, esp
:0047F8AF 51                      push ecx
:0047F8B0 8B4508                  mov eax, dword ptr [ebp+08]
:0047F8B3 56                      push esi
:0047F8B4 8BF0                    mov esi, eax
:0047F8B6 83E001                  and eax, 00000001
:0047F8B9 8945FC                  mov dword ptr [ebp-04], eax
:0047F8BC 8B450C                  mov eax, dword ptr [ebp+0C]
:0047F8BF D1FE                    sar esi, 1
:0047F8C1 85C0                    test eax, eax
:0047F8C3 7E3D                    jle 0047F902
:0047F8C5 8B5510                  mov edx, dword ptr [ebp+10]
:0047F8C8 57                      push edi
:0047F8C9 8B7D14                  mov edi, dword ptr [ebp+14]
:0047F8CC 53                      push ebx
:0047F8CD 894508                  mov dword ptr [ebp+08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F8FE(C)
|
:0047F8D0 85F6                    test esi, esi
:0047F8D2 7418                    je 0047F8EC
:0047F8D4 7E16                    jle 0047F8EC
:0047F8D6 8BDE                    mov ebx, esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F8EA(C)
|
:0047F8D8 8A0A                    mov cl, byte ptr [edx]
:0047F8DA 8A4201                  mov al, byte ptr [edx+01]
:0047F8DD 42                      inc edx
:0047F8DE 240F                    and al, 0F
:0047F8E0 C0E104                  shl cl, 04
:0047F8E3 02C1                    add al, cl
:0047F8E5 42                      inc edx
:0047F8E6 8807                    mov byte ptr [edi], al
:0047F8E8 47                      inc edi
:0047F8E9 4B                      dec ebx
:0047F8EA 75EC                    jne 0047F8D8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047F8D2(C), :0047F8D4(C)
|
:0047F8EC 837DFC00                cmp dword ptr [ebp-04], 00000000
:0047F8F0 7409                    je 0047F8FB
:0047F8F2 8A02                    mov al, byte ptr [edx]
:0047F8F4 42                      inc edx
:0047F8F5 C0E004                  shl al, 04
:0047F8F8 8807                    mov byte ptr [edi], al
:0047F8FA 47                      inc edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F8F0(C)
|
:0047F8FB FF4D08                  dec [ebp+08]
:0047F8FE 75D0                    jne 0047F8D0
:0047F900 5B                      pop ebx
:0047F901 5F                      pop edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F8C3(C)
|
:0047F902 5E                      pop esi
:0047F903 C9                      leave
:0047F904 C3                      ret



* Referenced by a CALL at Address:
|:0047E13B   
|
:0047F905 55                      push ebp
:0047F906 8BEC                    mov ebp, esp
:0047F908 8B4508                  mov eax, dword ptr [ebp+08]
:0047F90B 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0047F90E 56                      push esi
:0047F90F 8BF0                    mov esi, eax
:0047F911 D1FE                    sar esi, 1
:0047F913 83E001                  and eax, 00000001
:0047F916 85C9                    test ecx, ecx
:0047F918 7E44                    jle 0047F95E
:0047F91A 8B5510                  mov edx, dword ptr [ebp+10]
:0047F91D 57                      push edi
:0047F91E 894D08                  mov dword ptr [ebp+08], ecx
:0047F921 8B4D14                  mov ecx, dword ptr [ebp+14]
:0047F924 53                      push ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F95A(C)
|
:0047F925 85F6                    test esi, esi
:0047F927 741E                    je 0047F947
:0047F929 7E1C                    jle 0047F947
:0047F92B 8BFE                    mov edi, esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F945(C)
|
:0047F92D 8A1A                    mov bl, byte ptr [edx]
:0047F92F C0EB04                  shr bl, 04
:0047F932 80CB10                  or bl, 10
:0047F935 8819                    mov byte ptr [ecx], bl
:0047F937 8A1A                    mov bl, byte ptr [edx]
:0047F939 80E30F                  and bl, 0F
:0047F93C 41                      inc ecx
:0047F93D 80CB10                  or bl, 10
:0047F940 8819                    mov byte ptr [ecx], bl
:0047F942 41                      inc ecx
:0047F943 42                      inc edx
:0047F944 4F                      dec edi
:0047F945 75E6                    jne 0047F92D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047F927(C), :0047F929(C)
|
:0047F947 85C0                    test eax, eax
:0047F949 740C                    je 0047F957
:0047F94B 8A1A                    mov bl, byte ptr [edx]
:0047F94D C0EB04                  shr bl, 04
:0047F950 80CB10                  or bl, 10
:0047F953 8819                    mov byte ptr [ecx], bl
:0047F955 41                      inc ecx
:0047F956 42                      inc edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F949(C)
|
:0047F957 FF4D08                  dec [ebp+08]
:0047F95A 75C9                    jne 0047F925
:0047F95C 5B                      pop ebx
:0047F95D 5F                      pop edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F918(C)
|
:0047F95E 5E                      pop esi
:0047F95F 5D                      pop ebp
:0047F960 C3                      ret



* Referenced by a CALL at Address:
|:00480493   
|
:0047F961 832588CB4B0000          and dword ptr [004BCB88], 00000000
:0047F968 33C0                    xor eax, eax
:0047F96A C3                      ret



* Referenced by a CALL at Addresses:
|:0047F9C3   , :0048053B   
|
:0047F96B C3                      ret

* Referenced by a CALL at Address:
|:0047FA26   
|
:0047F96C 55                      push ebp
:0047F96D 8BEC                    mov ebp, esp
:0047F96F 33C0                    xor eax, eax
:0047F971 5D                      pop ebp
:0047F972 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0042BAD7   , :0042BAF9   , :0042BB1B   , :0042BB3D   , :0042BB5F   
|:0042BB81   , :0042BBA3   , :0042BBCF   , :0042BBF1   , :0042BC13   
|:0045BF95   , :0045BFB8   , :0045BFDB   , :0045BFFE   
|
:0047F975 55                      push ebp
:0047F976 8BEC                    mov ebp, esp
:0047F978 56                      push esi
:0047F979 8BF1                    mov esi, ecx
:0047F97B 807E1000                cmp byte ptr [esi+10], 00
:0047F97F 752E                    jne 0047F9AF
:0047F981 8B4508                  mov eax, dword ptr [ebp+08]
:0047F984 F6450C07                test [ebp+0C], 07
:0047F988 894604                  mov dword ptr [esi+04], eax
:0047F98B 7422                    je 0047F9AF
:0047F98D 50                      push eax
:0047F98E 6A00                    push 00000000
:0047F990 FF15C4614800            call dword ptr [004861C4]
:0047F996 85C0                    test eax, eax
:0047F998 894608                  mov dword ptr [esi+08], eax
:0047F99B 7412                    je 0047F9AF
:0047F99D 50                      push eax
:0047F99E FF15C8614800            call dword ptr [004861C8]
:0047F9A4 6A01                    push 00000001
:0047F9A6 89460C                  mov dword ptr [esi+0C], eax
:0047F9A9 58                      pop eax
:0047F9AA 884610                  mov byte ptr [esi+10], al
:0047F9AD EB02                    jmp 0047F9B1

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047F97F(C), :0047F98B(C), :0047F99B(C)
|
:0047F9AF 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F9AD(U)
|
:0047F9B1 5E                      pop esi
:0047F9B2 5D                      pop ebp
:0047F9B3 C20800                  ret 0008



* Referenced by a CALL at Addresses:
|:0042B585   , :0042B58F   , :0042B599   , :0042B5A3   , :0042B5AD   
|:0042B5B7   , :0042B5C1   , :0042B5D5   , :0042B5DF   , :0042B5E9   
|:0045C028   , :0045C033   , :0045C03E   , :0045C049   
|
:0047F9B6 56                      push esi
:0047F9B7 8BF1                    mov esi, ecx
:0047F9B9 0FB64610                movzx eax, byte ptr [esi+10]
:0047F9BD 48                      dec eax
:0047F9BE 740A                    je 0047F9CA
:0047F9C0 48                      dec eax
:0047F9C1 7519                    jne 0047F9DC
:0047F9C3 E8A3FFFFFF              call 0047F96B
:0047F9C8 EB12                    jmp 0047F9DC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F9BE(C)
|
:0047F9CA FF7608                  push [esi+08]
:0047F9CD FF15CC614800            call dword ptr [004861CC]
:0047F9D3 FF7608                  push [esi+08]
:0047F9D6 FF15D8614800            call dword ptr [004861D8]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047F9C1(C), :0047F9C8(U)
|
:0047F9DC 80661000                and byte ptr [esi+10], 00
:0047F9E0 5E                      pop esi
:0047F9E1 C3                      ret



* Referenced by a CALL at Address:
|:0047FA68   
|
:0047F9E2 55                      push ebp
:0047F9E3 8BEC                    mov ebp, esp
:0047F9E5 51                      push ecx
:0047F9E6 53                      push ebx
:0047F9E7 8B5D0C                  mov ebx, dword ptr [ebp+0C]
:0047F9EA 56                      push esi
:0047F9EB B800400000              mov eax, 00004000
:0047F9F0 33F6                    xor esi, esi
:0047F9F2 394508                  cmp dword ptr [ebp+08], eax
:0047F9F5 57                      push edi
:0047F9F6 894DFC                  mov dword ptr [ebp-04], ecx
:0047F9F9 895D0C                  mov dword ptr [ebp+0C], ebx
:0047F9FC 720E                    jb 0047FA0C
:0047F9FE 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047FA01 C1E90E                  shr ecx, 0E
:0047FA04 8BF1                    mov esi, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FA0A(C)
|
:0047FA06 294508                  sub dword ptr [ebp+08], eax
:0047FA09 49                      dec ecx
:0047FA0A 75FA                    jne 0047FA06

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047F9FC(C)
|
:0047FA0C 8B7D10                  mov edi, dword ptr [ebp+10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FA2B(U)
|
:0047FA0F 8BC7                    mov eax, edi
:0047FA11 4F                      dec edi
:0047FA12 85C0                    test eax, eax
:0047FA14 7417                    je 0047FA2D
:0047FA16 83FB04                  cmp ebx, 00000004
:0047FA19 7D12                    jge 0047FA2D
:0047FA1B 8BC3                    mov eax, ebx
:0047FA1D 8BCE                    mov ecx, esi
:0047FA1F 50                      push eax
:0047FA20 51                      push ecx
:0047FA21 8B4DFC                  mov ecx, dword ptr [ebp-04]
:0047FA24 46                      inc esi
:0047FA25 43                      inc ebx
:0047FA26 E841FFFFFF              call 0047F96C
:0047FA2B EBE2                    jmp 0047FA0F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047FA14(C), :0047FA19(C)
|
:0047FA2D FF750C                  push [ebp+0C]
:0047FA30 E8DD0B0000              call 00480612
:0047FA35 034508                  add eax, dword ptr [ebp+08]
:0047FA38 59                      pop ecx
:0047FA39 5F                      pop edi
:0047FA3A 5E                      pop esi
:0047FA3B 5B                      pop ebx
:0047FA3C C9                      leave
:0047FA3D C20C00                  ret 000C



* Referenced by a CALL at Addresses:
|:00403778   , :00403BF3   , :00403C2E   , :00403C88   , :00403CC1   
|:00403CF9   , :00403D2F   , :00403E07   , :00403E42   , :00403EDE   
|:00403F39   , :00403F95   , :00403FED   , :00404066   , :004042E8   
|:004046A9   , :004046DD   , :0040471D   , :00404753   , :004047D5   
|:0040481D   , :00404853   , :004048A6   , :00404950   , :00404986   
|:00404A11   , :00404B12   , :00404B86   , :00404C83   , :00404CD1   
|:00404D07   , :00404D5D   , :00404DAB   , :00404DE1   , :00404E8D   
|:00404F2B   , :00404FC1   , :0040500F   , :00405045   , :004050DB   
|:00405157   , :004051F3   , :00405241   , :00405277   , :004052EE   
|:00405326   , :00405374   , :004053AA   , :0040541F   , :00405461   
|:00405499   , :004055FB   , :00405631   , :00405667   , :004085E3   
|:0040864B   , :0040A8CA   , :0040B00A   , :0040BC90   , :0040BCDD   
|:0040BD32   , :0040E0A0   , :00414204   , :0041BF80   , :0041C7B6   
|:0041C802   , :0041C816   , :0041C842   , :0041C87C   , :0041C890   
|:0041C943   , :0041C97D   , :0041C9F9   , :0041CA33   , :0041CA9D   
|:0041CB80   , :0041CBBE   , :0041CBD2   , :0041CBE6   , :0041CC08   
|:0041CC67   , :0041D708   , :0041D749   , :0041D75D   , :0041D797   
|:0041D7DB   , :0041D7EF   , :0041D8DE   , :0041D8F7   , :0041D982   
|:0041D996   , :0041D9E7   , :0041DA00   , :004216A8   , :0042185F   
|:00421930   , :00421AEB   , :00421AFE   , :00421BB3   , :00421BF5   
|:00421C9B   , :00421D99   , :004229D6   , :00423C47   , :004265CC   
|:00426603   , :004266DC   , :0042670C   , :00426742   , :00426BCB   
|:00426CD5   , :00426EE3   , :004271B4   , :004280E9   , :0042837F   
|:00428718   , :00428931   , :00429278   , :0042980D   , :0042A0D8   
|:0042A140   , :0042A3D1   , :0042B71D   , :0042B75A   , :0042BCC0   
|:0042BD06   , :0042BDC1   , :0042BE0E   , :0042BE5E   , :0042BECC   
|:0042C156   , :0042C18E   , :0042D0E4   , :0042D121   , :0042D14B   
|:0042D170   , :0042D29E   , :0042D2E4   , :0042D327   , :0042D8D5   
|:0042DA40   , :0042DA86   , :0042DAC9   , :0042DED1   , :0042DF00   
|:0042DF58   , :0042DF6B   , :0042DF7E   , :0042DF9D   , :0042E028   
|:0042E056   , :0042E084   , :0042E1E2   , :0042E22F   , :0042E26A   
|:0042E2BE   , :0042E340   , :0042E3AD   , :0042E3D2   , :0042E802   
|:0042EE49   , :00431322   , :0043144D   , :0043148A   , :00431672   
|:00431B00   , :00431D92   , :00431E53   , :00431F04   , :00432252   
|:004322D1   , :004322FC   , :0043233B   , :004323A9   , :00432571   
|:0043281E   , :00432869   , :0043287A   , :004328A1   , :004328BD   
|:004328FA   , :00432976   , :00432E57   , :00432EB3   , :00432F24   
|:00432F8B   , :00432FAB   , :00432FCB   , :00432FEB   , :00433045   
|:004330EB   , :0043310A   , :0043312A   , :0043314A   , :00433746   
|:004337AD   , :004358BD   , :00435963   , :004359C6   , :00437A58   
|:00437A92   , :00437AD7   , :00437E74   , :00437EE1   , :00437F9B   
|:004381A5   , :0043831E   , :004383C4   , :004386F6   , :00438713   
|:00438860   , :00438880   , :004388B2   , :00438D07   , :00438D4F   
|:0043A39E   , :0043A459   , :0043A53D   , :0043A5D9   , :0043AB19   
|:0043AC94   , :0043D27F   , :0043D2C2   , :0043D2DB   , :0043D30F   
|:0043D328   , :0043D35C   , :0043D375   , :0043D3A9   , :0043D3C2   
|:0043D4B4   , :0043D6CE   , :0043D7A7   , :0043DBA3   , :0043E696   
|:0043EA9C   , :0043EC99   , :0043ECC8   , :0043ED4F   , :0043ED7E   
|:0043EE05   , :0043EE34   , :0043EEBB   , :0043EEEA   , :0043EF33   
|:0043EF9B   , :0043F000   , :0043FD6E   , :0043FDCB   , :0043FEAE   
|:0043FEE9   , :004401DC   , :0044098E   , :00440C13   , :00441B24   
|:00441B9F   , :00441C4D   , :00441CBE   , :00441CE5   , :00441E76   
|:00441E92   , :00441F34   , :00441F6F   , :00441F80   , :00441F94   
|:00441FB4   , :004423F9   , :0044327A   , :004432B3   , :0044330E   
|:00443339   , :00443361   , :00443A74   , :00443AA6   , :00443AC2   
|:00443B18   , :00443BCF   , :00443BE7   , :00443C7B   , :00443C93   
|:00443CFA   , :00443D20   , :00443DA1   , :00443E6A   , :00443E9A   
|:00443EB3   , :00443FBC   , :00443FEC   , :00444005   , :0044401E   
|:0044415C   , :0044418C   , :004441A5   , :00444257   , :0044427D   
|:00444355   , :00444385   , :0044439E   , :004443B7   , :00444501   
|:00444531   , :0044454A   , :00444563   , :0044473C   , :0044476C   
|:00444785   , :0044479E   , :0044494D   , :00444973   , :00444A90   
|:00444AB6   , :00444BD3   , :00444BF9   , :00444D1A   , :00444D40   
|:00444DC1   , :00444DE7   , :00444F55   , :00444F85   , :00444F9E   
|:00444FB7   , :0044541D   , :0044568C   , :004456C0   , :00445963   
|:0044598E   , :00445AE8   , :00445CEC   , :00445D1C   , :00445D35   
|:00445D4E   , :00445E74   , :00445F26   , :00445F37   , :00445F61   
|:00445F81   , :00445FDC   , :00446093   , :004460A7   , :004460D1   
|:004460F1   , :0044614F   , :004461BB   , :00446291   , :004462C8   
|:004462E7   , :00446300   , :00446350   , :00446414   , :00446466   
|:0044647A   , :0044649C   , :004464BC   , :00446502   , :0044654E   
|:00446589   , :00446699   , :004466D0   , :004466E9   , :00446702   
|:00446841   , :00446855   , :00446877   , :00446897   , :004468DA   
|:00446926   , :00446961   , :00446A88   , :00446AA1   , :00446AE3   
|:00446AFC   , :00446BC9   , :00446C0F   , :00446C6A   , :00446CA5   
|:00446CF1   , :00446D2C   , :00446E41   , :00446E5A   , :00446ED4   
|:00446EED   , :00446FB3   , :00446FFF   , :0044705A   , :004470A1   
|:004471BF   , :004471F6   , :00447215   , :0044722E   , :0044727E   
|:00447369   , :0044737D   , :0044739F   , :004473BF   , :00447411   
|:00447425   , :00447447   , :00447467   , :004474AD   , :004474F9   
|:00447534   , :0044765E   , :00447695   , :004476B4   , :004476CD   
|:0044771D   , :004477C4   , :00447808   , :00447862   , :004478BC   
|:00447906   , :00447956   , :0044799D   , :004479FA   , :00447A5A   
|:00447AAC   , :00447AC0   , :00447AE2   , :00447B02   , :00447B3D   
|:00447B8D   , :00447BE3   , :00447C30   , :00447C80   , :00447CC7   
|:00447D24   , :00447D76   , :00447DBA   , :00447DCE   , :00447DF0   
|:00447E10   , :00447E4E   , :00447E9B   , :00447EEB   , :00447F37   
|:00447F72   , :00448047   , :0044806D   , :004480C9   , :004480DD   
|:004480FF   , :0044811B   , :00448140   , :0044819C   , :004481B0   
|:004481D2   , :0044827F   , :004482B4   , :004482F9   , :0044833F   
|:00448B82   , :00448BAB   , :00448F69   , :00448FA3   , :0044903F   
|:0044917A   , :0044918E   , :004491B8   , :004491D1   , :00449223   
|:00449397   , :004493AB   , :004493D5   , :004493EE   , :00449440   
|:004494D9   , :004494EF   , :00449502   , :00449F44   , :0044A106   
|:0044A38A   , :0044ABE0   , :0044B2BF   , :0044B46D   , :0044B4A7   
|:0044C1AF   , :0044C248   , :0044C26B   , :0044C2A4   , :0044C2B5   
|:0044D16C   , :0044D195   , :0044D5CC   , :0044D5F5   , :0044D7D0   
|:0044F5DC   , :0044F6A1   , :0044F704   , :0044F782   , :0045038F   
|:004503C3   , :004503F7   , :00450431   , :0045046B   , :0045049D   
|:004506B0   , :0045083A   , :00450C64   , :00450C98   , :00450CCA   
|:00450DD4   , :00450F59   , :00450FE0   , :004511EF   , :0045140D   
|:0045145C   , :004514AE   , :004514FD   , :004515B5   , :0045161E   
|:00451687   , :004516E5   , :004517C6   , :00451815   , :00451864   
|:004518AB   , :004521E7   , :00452221   , :0045225A   , :00452293   
|:004522CC   , :0045243F   , :0045258C   , :004525C4   , :00452799   
|:004527ED   , :0045283E   , :0045286A   , :00453895   , :00453B05   
|:00453CAB   , :00453CE1   , :00453CFD   , :00454384   , :004553FD   
|:00455588   , :00455A9C   , :00455B0F   , :00455B52   , :00455B95   
|:00455BD8   , :0045623A   , :0045628C   , :0045631B   , :004563B1   
|:004564A0   , :0045652E   , :00456563   , :0045666F   , :004568FD   
|:00456971   , :004569A6   , :00456AB2   , :00456B77   , :00456C26   
|:00456D3F   , :00456E9D   , :00456EFD   , :00456F32   , :0045703E   
|:004570A9   , :00457295   , :004572D2   , :004579F4   , :00457A28   
|:00457A41   , :00457AE0   , :00457B14   , :00457B59   , :00457B92   
|:00457BC7   , :00457BFD   , :00457C9C   , :00457CCF   , :00457CE8   
|:00457D87   , :00457DBA   , :00457DD3   , :00457E72   , :00457EA2   
|:00457EE7   , :00457F20   , :00457F55   , :00457F8B   , :00458030   
|:00458061   , :004580A5   , :004580DE   , :00458116   , :0045814C   
|:004581E5   , :0045821B   , :004582BE   , :004582EE   , :00458333   
|:0045836C   , :004583A4   , :004583DA   , :004584AF   , :004584E5   
|:0045857F   , :004585D5   , :00458605   , :0045861E   , :00458651   
|:00458763   , :00458797   , :004588BF   , :004588F3   , :0045890C   
|:00458A0F   , :00458A43   , :00458A5C   , :00458BC1   , :00458BF1   
|:00458C0A   , :00458C3E   , :00458C57   , :00458C8B   , :00458CA4   
|:00458CD8   , :00458CF1   , :00458D34   , :00458D67   , :00458D80   
|:00458DF8   , :00458E81   , :00458ED0   , :00458F01   , :00458F1A   
|:00458F4E   , :00458F67   , :00458F9B   , :00458FB4   , :00458FE8   
|:00459001   , :00459079   , :00459373   , :004593B1   , :00459B32   
|:00459BBC   , :0045C24A   , :0045C25E   , :0045C297   , :0045C6E4   
|:0045CCFF   , :0045CD93   , :0045CDDD   , :0045CF13   , :0045CF7C   
|:0045DB4E   , :0045DBAA   , :0045DCBE   , :0045E41E   , :0045E572   
|:0045EC48   , :0045EC69   , :0045EDDA   , :0045EDFB   , :0045EE69   
|:0045EED7   , :0045EF11   , :0045EF2C   , :0046123A   , :0046126C   
|:0046129E   , :004612D0   , :00461307   , :00461339   , :0046136B   
|:0046139D   , :004617CA   , :004618B7   , :0046A047   , :0046D79B   
|:0046D844   , :0046D868   , :0046D88C   , :004732B3   , :00473597   
|:00473696   , :0047626E   , :00476390   , :004763CA   , :0047656B   
|:0047666E   , :00476797   , :004767B6   , :004767F8   , :0047681A   
|:00477FC6   , :00477FEC   , :00478032   , :004788B7   
|
:0047FA40 55                      push ebp
:0047FA41 8BEC                    mov ebp, esp
:0047FA43 8B4104                  mov eax, dword ptr [ecx+04]
:0047FA46 8B5508                  mov edx, dword ptr [ebp+08]
:0047FA49 3BD0                    cmp edx, eax
:0047FA4B 7602                    jbe 0047FA4F
:0047FA4D 8BD0                    mov edx, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FA4B(C)
|
:0047FA4F 0FB64110                movzx eax, byte ptr [ecx+10]
:0047FA53 48                      dec eax
:0047FA54 7419                    je 0047FA6F
:0047FA56 48                      dec eax
:0047FA57 7408                    je 0047FA61
:0047FA59 48                      dec eax
:0047FA5A 48                      dec eax
:0047FA5B 7412                    je 0047FA6F
:0047FA5D 33C0                    xor eax, eax
:0047FA5F EB13                    jmp 0047FA74

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FA57(C)
|
:0047FA61 FF7510                  push [ebp+10]
:0047FA64 FF750C                  push [ebp+0C]
:0047FA67 52                      push edx
:0047FA68 E875FFFFFF              call 0047F9E2
:0047FA6D EB05                    jmp 0047FA74

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047FA54(C), :0047FA5B(C)
|
:0047FA6F 8B410C                  mov eax, dword ptr [ecx+0C]
:0047FA72 03C2                    add eax, edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047FA5F(U), :0047FA6D(U)
|
:0047FA74 5D                      pop ebp
:0047FA75 C20C00                  ret 000C



* Referenced by a CALL at Address:
|:00480661   
|
:0047FA78 55                      push ebp
:0047FA79 8BEC                    mov ebp, esp
:0047FA7B 8BC1                    mov eax, ecx
:0047FA7D 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047FA80 8908                    mov dword ptr [eax], ecx
:0047FA82 894804                  mov dword ptr [eax+04], ecx
:0047FA85 5D                      pop ebp
:0047FA86 C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:00406E51   , :00406E76   , :00406E9B   , :00406EC0   , :00406EE2   
|:00406F02   , :00406F24   , :0040714B   , :0040717C   , :004071AD   
|:004071DE   , :0040720F   , :0040723E   , :0040726F   , :0040C3FA   
|:0040DC06   , :0043B6D0   , :0043B94F   , :004786DA   , :00479364   
|
:0047FA89 55                      push ebp
:0047FA8A 8B4C240C                mov ecx, dword ptr [esp+0C]
:0047FA8E 8BEC                    mov ebp, esp
:0047FA90 034D08                  add ecx, dword ptr [ebp+08]
:0047FA93 8B4510                  mov eax, dword ptr [ebp+10]
:0047FA96 3BC8                    cmp ecx, eax
:0047FA98 7F02                    jg 0047FA9C
:0047FA9A 8BC1                    mov eax, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FA98(C)
|
:0047FA9C 5D                      pop ebp
:0047FA9D C3                      ret



* Referenced by a CALL at Addresses:
|:0040387E   , :004038A0   , :00403921   , :00403940   , :00404436   
|:00405573   , :00408AAA   , :00408B26   , :0040C418   , :004121A3   
|:00421041   , :00421063   , :004210EC   , :0042110D   , :00421166   
|:00421187   , :00421224   , :00421245   , :00422F85   , :0043B62C   
|:0043B658   , :0043B685   , :0043B6FD   , :0043B72A   , :0043B8AB   
|:0043B8D7   , :0043B904   , :0043B97C   , :0043B9A9   , :0043BD66   
|:0043BF4F   , :0043C125   , :0043C2FB   , :004492CE   , :004492F0   
|:004579AC   , :004579BE   , :00458B52   , :00458B64   , :0045D901   
|:004734AB   , :004734BC   , :0047931D   
|
:0047FA9E 55                      push ebp
:0047FA9F 8B4C240C                mov ecx, dword ptr [esp+0C]
:0047FAA3 8BEC                    mov ebp, esp
:0047FAA5 8B442408                mov eax, dword ptr [esp+08]
:0047FAA9 3BC8                    cmp ecx, eax
:0047FAAB 7304                    jnb 0047FAB1
:0047FAAD 2BC1                    sub eax, ecx
:0047FAAF EB02                    jmp 0047FAB3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FAAB(C)
|
:0047FAB1 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FAAF(U)
|
:0047FAB3 5D                      pop ebp
:0047FAB4 C3                      ret



* Referenced by a CALL at Addresses:
|:004072B1   , :0040C6D4   , :0041283E   , :00412C5C   , :0041D26A   
|:0041D27F   , :00430437   , :00430604   , :0043F79D   , :00441860   
|:00442835   , :0044ED07   
|
:0047FAB5 55                      push ebp
:0047FAB6 0FB644240C              movzx eax, byte ptr [esp+0C]
:0047FABB 0FB64C2408              movzx ecx, byte ptr [esp+08]
:0047FAC0 8BEC                    mov ebp, esp
:0047FAC2 03C1                    add eax, ecx
:0047FAC4 0FB64D10                movzx ecx, byte ptr [ebp+10]
:0047FAC8 3BC1                    cmp eax, ecx
:0047FACA 7202                    jb 0047FACE
:0047FACC 8BC1                    mov eax, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FACA(C)
|
:0047FACE 5D                      pop ebp
:0047FACF C3                      ret



* Referenced by a CALL at Addresses:
|:004080D1   , :0040810B   , :0040D2D3   , :00412864   , :00412C83   
|:00413BA2   , :004304F5   , :0043065E   , :0043C7C8   , :0043C8DA   
|:0043C8FB   , :0043F7BD   , :00454589   , :0045459F   , :004545C1   
|:004545D7   , :00454668   , :00454679   , :00454696   , :004546A7   
|:0045507C   , :00455099   , :0045517E   , :0045519B   , :0045673F   
|:0045674E   , :00456CB1   , :00456CC0   , :0045A318   , :0045A33A   
|:0045A35C   , :0045A37E   
|
:0047FAD0 55                      push ebp
:0047FAD1 8A4C240C                mov cl, byte ptr [esp+0C]
:0047FAD5 8BEC                    mov ebp, esp
:0047FAD7 8A442408                mov al, byte ptr [esp+08]
:0047FADB 3AC8                    cmp cl, al
:0047FADD 7304                    jnb 0047FAE3
:0047FADF 2AC1                    sub al, cl
:0047FAE1 EB02                    jmp 0047FAE5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FADD(C)
|
:0047FAE3 32C0                    xor al, al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FAE1(U)
|
:0047FAE5 5D                      pop ebp
:0047FAE6 C3                      ret



* Referenced by a CALL at Address:
|:0047FB24   
|
:0047FAE7 A1D4EC4800              mov eax, dword ptr [0048ECD4]
:0047FAEC 69C06D4EC641            imul eax, 41C64E6D
:0047FAF2 0539300000              add eax, 00003039
:0047FAF7 A3D4EC4800              mov dword ptr [0048ECD4], eax
:0047FAFC 250000FF7F              and eax, 7FFF0000
:0047FB01 C1E810                  shr eax, 10
:0047FB04 C3                      ret



* Referenced by a CALL at Addresses:
|:00429D7D   , :0042B9F7   , :0042C311   
|
:0047FB05 55                      push ebp
:0047FB06 8B442408                mov eax, dword ptr [esp+08]
:0047FB0A 8BEC                    mov ebp, esp
:0047FB0C A3D4EC4800              mov dword ptr [0048ECD4], eax
:0047FB11 5D                      pop ebp
:0047FB12 C3                      ret



* Referenced by a CALL at Addresses:
|:0040C096   , :00423F9E   , :004248D6   , :00425039   , :00428DB4   
|:00428DC4   , :0043A0EB   , :0043A12D   , :0043BF27   , :0043C2D3   
|:0043C5D6   , :0043C5E4   , :0043C62F   , :0043C63D   , :00449FC9   
|:0047FB37   
|
:0047FB13 55                      push ebp
:0047FB14 B800000000              mov eax, 00000000
:0047FB19 8BEC                    mov ebp, esp
:0047FB1B 56                      push esi
:0047FB1C 8B7508                  mov esi, dword ptr [ebp+08]
:0047FB1F 83FE02                  cmp esi, 00000002
:0047FB22 720B                    jb 0047FB2F
:0047FB24 E8BEFFFFFF              call 0047FAE7
:0047FB29 2BD2                    sub edx, edx
:0047FB2B F7F6                    div esi
:0047FB2D 8BC2                    mov eax, edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FB22(C)
|
:0047FB2F 5E                      pop esi
:0047FB30 5D                      pop ebp
:0047FB31 C3                      ret



* Referenced by a CALL at Addresses:
|:0040582C   , :00405955   , :004059B9   , :00405A1D   , :00405F06   
|:004061D5   , :0043B4D9   , :0043B4F9   , :0043C856   , :0043C893   
|:0043C90F   , :0043C94C   , :0043CA03   , :0043CA3E   , :0043CAB6   
|:0043CAF1   , :0043CB68   , :0043CBA2   , :0043CC18   , :0043CC53   
|:0043CCCB   , :0043CD06   , :0043CD7D   , :0043CDB7   
|
:0047FB32 55                      push ebp
:0047FB33 8BEC                    mov ebp, esp
:0047FB35 6A64                    push 00000064
:0047FB37 E8D7FFFFFF              call 0047FB13
:0047FB3C 83C404                  add esp, 00000004
:0047FB3F 3B4508                  cmp eax, dword ptr [ebp+08]
:0047FB42 B801000000              mov eax, 00000001
:0047FB47 5D                      pop ebp
:0047FB48 83D0FF                  adc eax, FFFFFFFF
:0047FB4B C3                      ret



* Referenced by a CALL at Address:
|:00413783   
|
:0047FB4C 55                      push ebp
:0047FB4D 8B542408                mov edx, dword ptr [esp+08]
:0047FB51 0FB602                  movzx eax, byte ptr [edx]
:0047FB54 8BEC                    mov ebp, esp
:0047FB56 53                      push ebx
:0047FB57 56                      push esi
:0047FB58 57                      push edi
:0047FB59 33F6                    xor esi, esi
:0047FB5B BF0A000000              mov edi, 0000000A
:0047FB60 83F82B                  cmp eax, 0000002B
:0047FB63 7411                    je 0047FB76
:0047FB65 83F82D                  cmp eax, 0000002D
:0047FB68 7407                    je 0047FB71
:0047FB6A 83F830                  cmp eax, 00000030
:0047FB6D 743D                    je 0047FBAC
:0047FB6F EB06                    jmp 0047FB77

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FB68(C)
|
:0047FB71 BE01000000              mov esi, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047FB63(C), :0047FBC1(U)
|
:0047FB76 42                      inc edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047FB6F(U), :0047FBBA(C)
|
:0047FB77 33C0                    xor eax, eax
:0047FB79 3802                    cmp byte ptr [edx], al
:0047FB7B 7424                    je 0047FBA1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FB9F(C)
|
:0047FB7D 0FB60A                  movzx ecx, byte ptr [edx]
:0047FB80 83E930                  sub ecx, 00000030
:0047FB83 83F909                  cmp ecx, 00000009
:0047FB86 7E0B                    jle 0047FB93
:0047FB88 83E907                  sub ecx, 00000007
:0047FB8B 83F90F                  cmp ecx, 0000000F
:0047FB8E 7E03                    jle 0047FB93
:0047FB90 83E920                  sub ecx, 00000020

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047FB86(C), :0047FB8E(C)
|
:0047FB93 8BDF                    mov ebx, edi
:0047FB95 42                      inc edx
:0047FB96 0FAFD8                  imul ebx, eax
:0047FB99 803A00                  cmp byte ptr [edx], 00
:0047FB9C 8D040B                  lea eax, dword ptr [ebx+ecx]
:0047FB9F 75DC                    jne 0047FB7D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FB7B(C)
|
:0047FBA1 85F6                    test esi, esi
:0047FBA3 7402                    je 0047FBA7
:0047FBA5 F7D8                    neg eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FBA3(C)
|
:0047FBA7 5F                      pop edi
:0047FBA8 5E                      pop esi
:0047FBA9 5B                      pop ebx
:0047FBAA 5D                      pop ebp
:0047FBAB C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FB6D(C)
|
:0047FBAC BF08000000              mov edi, 00000008
:0047FBB1 42                      inc edx
:0047FBB2 8A02                    mov al, byte ptr [edx]
:0047FBB4 3C78                    cmp al, 78
:0047FBB6 7404                    je 0047FBBC
:0047FBB8 3C58                    cmp al, 58
:0047FBBA 75BB                    jne 0047FB77

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FBB6(C)
|
:0047FBBC BF10000000              mov edi, 00000010
:0047FBC1 EBB3                    jmp 0047FB76

* Referenced by a CALL at Address:
|:004758DF   
|
:0047FBC3 55                      push ebp
:0047FBC4 8B442408                mov eax, dword ptr [esp+08]
:0047FBC8 8BEC                    mov ebp, esp
:0047FBCA 85C0                    test eax, eax
:0047FBCC 56                      push esi
:0047FBCD 8B750C                  mov esi, dword ptr [ebp+0C]
:0047FBD0 8BD6                    mov edx, esi
:0047FBD2 8B4D10                  mov ecx, dword ptr [ebp+10]
:0047FBD5 7D0D                    jge 0047FBE4
:0047FBD7 83F90A                  cmp ecx, 0000000A
:0047FBDA 7508                    jne 0047FBE4
:0047FBDC 8D5601                  lea edx, dword ptr [esi+01]
:0047FBDF C6062D                  mov byte ptr [esi], 2D
:0047FBE2 F7D8                    neg eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047FBD5(C), :0047FBDA(C)
|
:0047FBE4 51                      push ecx
:0047FBE5 52                      push edx
:0047FBE6 50                      push eax
:0047FBE7 E808000000              call 0047FBF4
:0047FBEC 83C40C                  add esp, 0000000C
:0047FBEF 8BC6                    mov eax, esi
:0047FBF1 5E                      pop esi
:0047FBF2 5D                      pop ebp
:0047FBF3 C3                      ret



* Referenced by a CALL at Addresses:
|:0047FBE7   , :0047FC0E   , :0047FF30   
|
:0047FBF4 55                      push ebp
:0047FBF5 8BEC                    mov ebp, esp
:0047FBF7 56                      push esi
:0047FBF8 57                      push edi
:0047FBF9 8B7D10                  mov edi, dword ptr [ebp+10]
:0047FBFC 8B7508                  mov esi, dword ptr [ebp+08]
:0047FBFF 3BF7                    cmp esi, edi
:0047FC01 7217                    jb 0047FC1A
:0047FC03 57                      push edi
:0047FC04 8BC6                    mov eax, esi
:0047FC06 FF750C                  push [ebp+0C]
:0047FC09 2BD2                    sub edx, edx
:0047FC0B F7F7                    div edi
:0047FC0D 50                      push eax
:0047FC0E E8E1FFFFFF              call 0047FBF4
:0047FC13 83C40C                  add esp, 0000000C
:0047FC16 8BC8                    mov ecx, eax
:0047FC18 EB03                    jmp 0047FC1D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FC01(C)
|
:0047FC1A 8B4D0C                  mov ecx, dword ptr [ebp+0C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FC18(U)
|
:0047FC1D 8BC6                    mov eax, esi
:0047FC1F 2BD2                    sub edx, edx
:0047FC21 F7F7                    div edi
:0047FC23 80C230                  add dl, 30
:0047FC26 8811                    mov byte ptr [ecx], dl
:0047FC28 80FA39                  cmp dl, 39
:0047FC2B 7605                    jbe 0047FC32
:0047FC2D 80C227                  add dl, 27
:0047FC30 8811                    mov byte ptr [ecx], dl

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FC2B(C)
|
:0047FC32 41                      inc ecx
:0047FC33 5F                      pop edi
:0047FC34 8BC1                    mov eax, ecx
:0047FC36 5E                      pop esi
:0047FC37 5D                      pop ebp
:0047FC38 C60100                  mov byte ptr [ecx], 00
:0047FC3B C3                      ret



* Referenced by a CALL at Addresses:
|:0042C928   , :004806F8   
|
:0047FC3C 55                      push ebp
:0047FC3D 8B442408                mov eax, dword ptr [esp+08]
:0047FC41 8BEC                    mov ebp, esp
:0047FC43 3D80000000              cmp eax, 00000080
:0047FC48 720C                    jb 0047FC56
:0047FC4A 3DFE000000              cmp eax, 000000FE
:0047FC4F B801000000              mov eax, 00000001
:0047FC54 7602                    jbe 0047FC58

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FC48(C)
|
:0047FC56 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FC54(C)
|
:0047FC58 5D                      pop ebp
:0047FC59 C3                      ret



* Referenced by a CALL at Addresses:
|:004086EE   , :00408792   , :0040E7F3   , :0040FA43   , :0042E987   
|:0042EEE3   , :0042F275   , :0042F335   , :0042F3A2   , :0042F43D   
|:004317A5   , :004318DE   , :00431B3F   , :00431C35   , :00431F9D   
|:00431FE1   , :0044119C   , :00441329   , :00441385   , :004413E6   
|:004437B6   , :0044385F   , :0044388E   , :00449D2A   , :0044FB1A   
|:0045CBE1   , :0045D113   , :004619F9   , :00461A5B   , :00461ABD   
|:00468E71   , :0046F41F   , :004720DF   , :00473C71   , :004762B3   
|:00476535   , :00476638   , :0047FCAB   , :0047FF52   , :0048007C   
|:00480089   
|
:0047FC5A 55                      push ebp
:0047FC5B 8B542408                mov edx, dword ptr [esp+08]
:0047FC5F 8BEC                    mov ebp, esp
:0047FC61 85D2                    test edx, edx
:0047FC63 7504                    jne 0047FC69
:0047FC65 33C0                    xor eax, eax
:0047FC67 EB12                    jmp 0047FC7B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FC63(C)
|
:0047FC69 33C0                    xor eax, eax
:0047FC6B 8BCA                    mov ecx, edx
:0047FC6D 42                      inc edx
:0047FC6E 3801                    cmp byte ptr [ecx], al
:0047FC70 7409                    je 0047FC7B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FC79(C)
|
:0047FC72 40                      inc eax
:0047FC73 8BCA                    mov ecx, edx
:0047FC75 42                      inc edx
:0047FC76 803900                  cmp byte ptr [ecx], 00
:0047FC79 75F7                    jne 0047FC72

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047FC67(U), :0047FC70(C)
|
:0047FC7B 5D                      pop ebp
:0047FC7C C3                      ret



* Referenced by a CALL at Addresses:
|:0040BB54   , :0040BB84   , :0041AA40   , :0041AF09   , :0041AF20   
|:0041B2B5   , :0041B2CC   , :0042F396   , :0044F632   , :004609FD   
|:00460B70   , :00460B83   , :00461F3B   , :00462114   , :00462261   
|:004622C5   , :004622FC   , :004693E3   , :0046F43F   , :0047A7B4   
|:0047A81F   , :0047FCB6   
|
:0047FC7D 55                      push ebp
:0047FC7E 8B4C2408                mov ecx, dword ptr [esp+08]
:0047FC82 8BEC                    mov ebp, esp
:0047FC84 8BC1                    mov eax, ecx
:0047FC86 53                      push ebx
:0047FC87 8B550C                  mov edx, dword ptr [ebp+0C]
:0047FC8A 803A00                  cmp byte ptr [edx], 00
:0047FC8D 740B                    je 0047FC9A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FC98(C)
|
:0047FC8F 8A1A                    mov bl, byte ptr [edx]
:0047FC91 42                      inc edx
:0047FC92 8819                    mov byte ptr [ecx], bl
:0047FC94 41                      inc ecx
:0047FC95 803A00                  cmp byte ptr [edx], 00
:0047FC98 75F5                    jne 0047FC8F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FC8D(C)
|
:0047FC9A 5B                      pop ebx
:0047FC9B C60100                  mov byte ptr [ecx], 00
:0047FC9E 5D                      pop ebp
:0047FC9F C3                      ret



* Referenced by a CALL at Addresses:
|:0042F267   , :00478A7F   , :00478AC4   , :00478B09   , :00478B4E   
|:00478BAB   , :00478C0A   , :00478C67   , :00478CC6   , :00478D23   
|:00478D82   , :00478DDF   , :00478E3E   , :00478E9B   , :00478EFA   
|:00478F4A   
|
:0047FCA0 55                      push ebp
:0047FCA1 8BEC                    mov ebp, esp
:0047FCA3 56                      push esi
:0047FCA4 FF750C                  push [ebp+0C]
:0047FCA7 8B7508                  mov esi, dword ptr [ebp+08]
:0047FCAA 56                      push esi
:0047FCAB E8AAFFFFFF              call 0047FC5A
:0047FCB0 83C404                  add esp, 00000004
:0047FCB3 03C6                    add eax, esi
:0047FCB5 50                      push eax
:0047FCB6 E8C2FFFFFF              call 0047FC7D
:0047FCBB 83C408                  add esp, 00000008
:0047FCBE 8BC6                    mov eax, esi
:0047FCC0 5E                      pop esi
:0047FCC1 5D                      pop ebp
:0047FCC2 C3                      ret



* Referenced by a CALL at Addresses:
|:0041EEF5   , :00460A99   , :00468E99   
|
:0047FCC3 55                      push ebp
:0047FCC4 8B442408                mov eax, dword ptr [esp+08]
:0047FCC8 8BEC                    mov ebp, esp
:0047FCCA 53                      push ebx
:0047FCCB 803800                  cmp byte ptr [eax], 00
:0047FCCE 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:0047FCD1 7421                    je 0047FCF4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FCE2(C)
|
:0047FCD3 8A19                    mov bl, byte ptr [ecx]
:0047FCD5 8A10                    mov dl, byte ptr [eax]
:0047FCD7 3ADA                    cmp bl, dl
:0047FCD9 770B                    ja 0047FCE6
:0047FCDB 7210                    jb 0047FCED
:0047FCDD 40                      inc eax
:0047FCDE 41                      inc ecx
:0047FCDF 803800                  cmp byte ptr [eax], 00
:0047FCE2 75EF                    jne 0047FCD3
:0047FCE4 EB0E                    jmp 0047FCF4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FCD9(C)
|
:0047FCE6 B8FFFFFFFF              mov eax, FFFFFFFF
:0047FCEB EB0D                    jmp 0047FCFA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FCDB(C)
|
:0047FCED B801000000              mov eax, 00000001
:0047FCF2 EB06                    jmp 0047FCFA

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047FCD1(C), :0047FCE4(U)
|
:0047FCF4 803901                  cmp byte ptr [ecx], 01
:0047FCF7 1BC0                    sbb eax, eax
:0047FCF9 40                      inc eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047FCEB(U), :0047FCF2(U)
|
:0047FCFA 5B                      pop ebx
:0047FCFB 5D                      pop ebp
:0047FCFC C3                      ret



* Referenced by a CALL at Addresses:
|:00403CA6   , :00403D17   , :00403D4D   , :00403EFC   , :00403FB3   
|:0040400B   , :00404084   , :00404A17   , :00404B8C   , :00404F31   
|:0040515D   , :0040F28E   , :0040F583   , :0041AEF3   , :0041C81C   
|:0041C896   , :0041D763   , :0041D7F5   , :0041D99C   , :00426712   
|:0042674D   , :0042D0EA   , :0042D127   , :0042D151   , :004322DC   
|:00432880   , :0043D2F9   , :0043D346   , :0043D393   , :0043EB5C   
|:0043FDA5   , :0043FE02   , :0043FEFA   , :00441CEB   , :00443CAE   
|:00445F3D   , :004460AD   , :00446480   , :0044685B   , :00447383   
|:0044742B   , :00447AC6   , :00447DD4   , :004480E3   , :004481B6   
|:00449194   , :004493B1   , :00449555   , :0044C2BB   , :0044F6A7   
|:0044F78C   , :0045139D   , :004515BB   , :00451624   , :0045168D   
|:004517CC   , :0045181B   , :0045186A   , :00455AA2   , :0045668D   
|:00456AD0   , :0045705C   , :0045729F   , :00457A5F   , :00457B77   
|:00457BE5   , :00457C1B   , :00457D06   , :00457DF1   , :00457F05   
|:00457F73   , :00457FA9   , :004580C3   , :00458134   , :0045816A   
|:00458351   , :004583C2   , :004583F8   , :00458674   , :00458781   
|:004587BB   , :0045892A   , :00458A7A   , :00458C28   , :00458C75   
|:00458CC2   , :00458D9E   , :00458F38   , :00458F85   , :00458FD2   
|:0045937D   , :0045C264   
|
:0047FCFD 55                      push ebp
:0047FCFE 8BEC                    mov ebp, esp
:0047FD00 FF742410                push [esp+10]
:0047FD04 FF7508                  push [ebp+08]
:0047FD07 FF750C                  push [ebp+0C]
:0047FD0A E8D11C0000              call 004819E0
:0047FD0F 8BE5                    mov esp, ebp
:0047FD11 5D                      pop ebp
:0047FD12 C3                      ret



* Referenced by a CALL at Addresses:
|:00405E19   , :00405E2F   , :0040629A   , :004062B0   , :004062C6   
|:00406331   , :0040EB31   , :0041BF93   , :0041E248   , :004252E3   
|:004252F9   , :0042530F   , :00425325   , :004265D2   , :0042F317   
|:00431EB7   , :004383B1   , :00438D0D   , :0043A2C9   , :0043A3A9   
|:0043AB24   , :0043AC9A   , :0043DBA9   , :0044C1B5   , :0044D7D6   
|:00453A13   , :00453A63   , :00455403   , :00457271   , :0045934F   
|
:0047FD13 55                      push ebp
:0047FD14 8B54240C                mov edx, dword ptr [esp+0C]
:0047FD18 0FB6442410              movzx eax, byte ptr [esp+10]
:0047FD1D 8BEC                    mov ebp, esp
:0047FD1F 8AE8                    mov ch, al
:0047FD21 57                      push edi
:0047FD22 8AC8                    mov cl, al
:0047FD24 8BC1                    mov eax, ecx
:0047FD26 8B7D08                  mov edi, dword ptr [ebp+08]
:0047FD29 C1E010                  shl eax, 10
:0047FD2C 668BC1                  mov ax, cx
:0047FD2F 8BCA                    mov ecx, edx
:0047FD31 C1E902                  shr ecx, 02
:0047FD34 F3                      repz
:0047FD35 AB                      stosd
:0047FD36 8BCA                    mov ecx, edx
:0047FD38 83E103                  and ecx, 00000003
:0047FD3B F3                      repz
:0047FD3C AA                      stosb
:0047FD3D 5F                      pop edi
:0047FD3E 5D                      pop ebp
:0047FD3F C3                      ret



* Referenced by a CALL at Address:
|:00480198   
|
:0047FD40 55                      push ebp
:0047FD41 33C9                    xor ecx, ecx
:0047FD43 8BEC                    mov ebp, esp
:0047FD45 33C0                    xor eax, eax
:0047FD47 56                      push esi
:0047FD48 57                      push edi
:0047FD49 8B7D08                  mov edi, dword ptr [ebp+08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FD91(C)
|
:0047FD4C 8B37                    mov esi, dword ptr [edi]
:0047FD4E 0FB616                  movzx edx, byte ptr [esi]
:0047FD51 83FA20                  cmp edx, 00000020
:0047FD54 7420                    je 0047FD76
:0047FD56 83FA23                  cmp edx, 00000023
:0047FD59 741F                    je 0047FD7A
:0047FD5B 83FA2B                  cmp edx, 0000002B
:0047FD5E 741E                    je 0047FD7E
:0047FD60 83FA2D                  cmp edx, 0000002D
:0047FD63 741D                    je 0047FD82
:0047FD65 83FA30                  cmp edx, 00000030
:0047FD68 741C                    je 0047FD86
:0047FD6A 83FA3D                  cmp edx, 0000003D
:0047FD6D 741B                    je 0047FD8A
:0047FD6F B901000000              mov ecx, 00000001
:0047FD74 EB19                    jmp 0047FD8F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FD54(C)
|
:0047FD76 0C08                    or al, 08
:0047FD78 EB12                    jmp 0047FD8C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FD59(C)
|
:0047FD7A 0C10                    or al, 10
:0047FD7C EB0E                    jmp 0047FD8C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FD5E(C)
|
:0047FD7E 0C02                    or al, 02
:0047FD80 EB0A                    jmp 0047FD8C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FD63(C)
|
:0047FD82 0C01                    or al, 01
:0047FD84 EB06                    jmp 0047FD8C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FD68(C)
|
:0047FD86 0C04                    or al, 04
:0047FD88 EB02                    jmp 0047FD8C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FD6D(C)
|
:0047FD8A 0C80                    or al, 80

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047FD78(U), :0047FD7C(U), :0047FD80(U), :0047FD84(U), :0047FD88(U)
|
:0047FD8C 46                      inc esi
:0047FD8D 8937                    mov dword ptr [edi], esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FD74(U)
|
:0047FD8F 85C9                    test ecx, ecx
:0047FD91 74B9                    je 0047FD4C
:0047FD93 A881                    test al, 81
:0047FD95 7402                    je 0047FD99
:0047FD97 24FB                    and al, FB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FD95(C)
|
:0047FD99 A802                    test al, 02
:0047FD9B 7402                    je 0047FD9F
:0047FD9D 24F7                    and al, F7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FD9B(C)
|
:0047FD9F 5F                      pop edi
:0047FDA0 5E                      pop esi
:0047FDA1 5D                      pop ebp
:0047FDA2 C3                      ret



* Referenced by a CALL at Addresses:
|:0047FDF6   , :004801A6   
|
:0047FDA3 55                      push ebp
:0047FDA4 33C0                    xor eax, eax
:0047FDA6 8BEC                    mov ebp, esp
:0047FDA8 56                      push esi
:0047FDA9 8B7508                  mov esi, dword ptr [ebp+08]
:0047FDAC 8B0E                    mov ecx, dword ptr [esi]
:0047FDAE 8A11                    mov dl, byte ptr [ecx]
:0047FDB0 80FA2A                  cmp dl, 2A
:0047FDB3 750A                    jne 0047FDBF
:0047FDB5 41                      inc ecx
:0047FDB6 B8FFFFFFFF              mov eax, FFFFFFFF
:0047FDBB 890E                    mov dword ptr [esi], ecx
:0047FDBD EB20                    jmp 0047FDDF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FDB3(C)
|
:0047FDBF 80FA30                  cmp dl, 30
:0047FDC2 721B                    jb 0047FDDF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FDDD(C)
|
:0047FDC4 8B0E                    mov ecx, dword ptr [esi]
:0047FDC6 8A11                    mov dl, byte ptr [ecx]
:0047FDC8 80FA39                  cmp dl, 39
:0047FDCB 7712                    ja 0047FDDF
:0047FDCD 6BC00A                  imul eax, 0000000A
:0047FDD0 0FB6D2                  movzx edx, dl
:0047FDD3 41                      inc ecx
:0047FDD4 8D4402D0                lea eax, dword ptr [edx+eax-30]
:0047FDD8 890E                    mov dword ptr [esi], ecx
:0047FDDA 803930                  cmp byte ptr [ecx], 30
:0047FDDD 73E5                    jnb 0047FDC4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047FDBD(U), :0047FDC2(C), :0047FDCB(C)
|
:0047FDDF 5E                      pop esi
:0047FDE0 5D                      pop ebp
:0047FDE1 C3                      ret



* Referenced by a CALL at Address:
|:004801BE   
|
:0047FDE2 55                      push ebp
:0047FDE3 33C0                    xor eax, eax
:0047FDE5 8BEC                    mov ebp, esp
:0047FDE7 8B542408                mov edx, dword ptr [esp+08]
:0047FDEB 8B0A                    mov ecx, dword ptr [edx]
:0047FDED 80392E                  cmp byte ptr [ecx], 2E
:0047FDF0 7509                    jne 0047FDFB
:0047FDF2 41                      inc ecx
:0047FDF3 52                      push edx
:0047FDF4 890A                    mov dword ptr [edx], ecx
:0047FDF6 E8A8FFFFFF              call 0047FDA3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FDF0(C)
|
:0047FDFB 8BE5                    mov esp, ebp
:0047FDFD 5D                      pop ebp
:0047FDFE C3                      ret



* Referenced by a CALL at Address:
|:004801DA   
|
:0047FDFF 55                      push ebp
:0047FE00 33C0                    xor eax, eax
:0047FE02 8BEC                    mov ebp, esp
:0047FE04 56                      push esi
:0047FE05 8B4D08                  mov ecx, dword ptr [ebp+08]
:0047FE08 8B31                    mov esi, dword ptr [ecx]
:0047FE0A 0FB616                  movzx edx, byte ptr [esi]
:0047FE0D 83FA46                  cmp edx, 00000046
:0047FE10 7411                    je 0047FE23
:0047FE12 83FA4E                  cmp edx, 0000004E
:0047FE15 7413                    je 0047FE2A
:0047FE17 83FA68                  cmp edx, 00000068
:0047FE1A 741A                    je 0047FE36
:0047FE1C 83FA6C                  cmp edx, 0000006C
:0047FE1F 7410                    je 0047FE31
:0047FE21 EB16                    jmp 0047FE39

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FE10(C)
|
:0047FE23 B802000000              mov eax, 00000002
:0047FE28 EB0C                    jmp 0047FE36

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FE15(C)
|
:0047FE2A B803000000              mov eax, 00000003
:0047FE2F EB05                    jmp 0047FE36

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FE1F(C)
|
:0047FE31 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047FE1A(C), :0047FE28(U), :0047FE2F(U)
|
:0047FE36 46                      inc esi
:0047FE37 8931                    mov dword ptr [ecx], esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FE21(U)
|
:0047FE39 5E                      pop esi
:0047FE3A 5D                      pop ebp
:0047FE3B C3                      ret



* Referenced by a CALL at Addresses:
|:0047FFA1   , :00480031   
|
:0047FE3C 55                      push ebp
:0047FE3D 8BEC                    mov ebp, esp
:0047FE3F 53                      push ebx
:0047FE40 56                      push esi
:0047FE41 57                      push edi
:0047FE42 8B7D10                  mov edi, dword ptr [ebp+10]
:0047FE45 8B7508                  mov esi, dword ptr [ebp+08]
:0047FE48 8BDF                    mov ebx, edi
:0047FE4A 85FF                    test edi, edi
:0047FE4C 7E0A                    jle 0047FE58

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FE56(C)
|
:0047FE4E 6A30                    push 00000030
:0047FE50 FFD6                    call esi
:0047FE52 83C404                  add esp, 00000004
:0047FE55 4F                      dec edi
:0047FE56 75F6                    jne 0047FE4E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FE4C(C)
|
:0047FE58 8B7D0C                  mov edi, dword ptr [ebp+0C]
:0047FE5B 803F00                  cmp byte ptr [edi], 00
:0047FE5E 7410                    je 0047FE70

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FE6E(C)
|
:0047FE60 0FB607                  movzx eax, byte ptr [edi]
:0047FE63 50                      push eax
:0047FE64 47                      inc edi
:0047FE65 43                      inc ebx
:0047FE66 FFD6                    call esi
:0047FE68 83C404                  add esp, 00000004
:0047FE6B 803F00                  cmp byte ptr [edi], 00
:0047FE6E 75F0                    jne 0047FE60

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FE5E(C)
|
:0047FE70 8BC3                    mov eax, ebx
:0047FE72 5F                      pop edi
:0047FE73 5E                      pop esi
:0047FE74 5B                      pop ebx
:0047FE75 5D                      pop ebp
:0047FE76 C3                      ret



* Referenced by a CALL at Addresses:
|:0047FF90   , :0047FFCB   , :00480020   
|
:0047FE77 55                      push ebp
:0047FE78 8A44240C                mov al, byte ptr [esp+0C]
:0047FE7C 8BEC                    mov ebp, esp
:0047FE7E 56                      push esi
:0047FE7F 57                      push edi
:0047FE80 33F6                    xor esi, esi
:0047FE82 84C0                    test al, al
:0047FE84 7413                    je 0047FE99
:0047FE86 8B7D08                  mov edi, dword ptr [ebp+08]
:0047FE89 BE01000000              mov esi, 00000001
:0047FE8E 0FB6C0                  movzx eax, al
:0047FE91 50                      push eax
:0047FE92 FFD7                    call edi
:0047FE94 83C404                  add esp, 00000004
:0047FE97 EB03                    jmp 0047FE9C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FE84(C)
|
:0047FE99 8B7D08                  mov edi, dword ptr [ebp+08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FE97(U)
|
:0047FE9C F6451020                test [ebp+10], 20
:0047FEA0 740D                    je 0047FEAF
:0047FEA2 8B4514                  mov eax, dword ptr [ebp+14]
:0047FEA5 46                      inc esi
:0047FEA6 83C058                  add eax, 00000058
:0047FEA9 50                      push eax
:0047FEAA FFD7                    call edi
:0047FEAC 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FEA0(C)
|
:0047FEAF 8BC6                    mov eax, esi
:0047FEB1 5F                      pop edi
:0047FEB2 5E                      pop esi
:0047FEB3 5D                      pop ebp
:0047FEB4 C3                      ret



* Referenced by a CALL at Addresses:
|:00480007   , :0048004C   , :004800F5   , :00480123   
|
:0047FEB5 55                      push ebp
:0047FEB6 8BEC                    mov ebp, esp
:0047FEB8 83EC04                  sub esp, 00000004
:0047FEBB 53                      push ebx
:0047FEBC 56                      push esi
:0047FEBD 57                      push edi
:0047FEBE 8B7D0C                  mov edi, dword ptr [ebp+0C]
:0047FEC1 897DFC                  mov dword ptr [ebp-04], edi
:0047FEC4 85FF                    test edi, edi
:0047FEC6 7E10                    jle 0047FED8
:0047FEC8 0FB65D10                movzx ebx, byte ptr [ebp+10]
:0047FECC 8B7508                  mov esi, dword ptr [ebp+08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FED6(C)
|
:0047FECF 53                      push ebx
:0047FED0 FFD6                    call esi
:0047FED2 83C404                  add esp, 00000004
:0047FED5 4F                      dec edi
:0047FED6 75F7                    jne 0047FECF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FEC6(C)
|
:0047FED8 8B45FC                  mov eax, dword ptr [ebp-04]
:0047FEDB 5F                      pop edi
:0047FEDC 5E                      pop esi
:0047FEDD 5B                      pop ebx
:0047FEDE 8BE5                    mov esp, ebp
:0047FEE0 5D                      pop ebp
:0047FEE1 C3                      ret



* Referenced by a CALL at Addresses:
|:00480240   , :0048026E   , :00480298   , :004802BA   , :00480348   
|:00480367   , :0048039F   
|
:0047FEE2 55                      push ebp
:0047FEE3 33C0                    xor eax, eax
:0047FEE5 8BEC                    mov ebp, esp
:0047FEE7 83EC20                  sub esp, 00000020
:0047FEEA 53                      push ebx
:0047FEEB 8845FF                  mov byte ptr [ebp-01], al
:0047FEEE 56                      push esi
:0047FEEF 8945F8                  mov dword ptr [ebp-08], eax
:0047FEF2 57                      push edi
:0047FEF3 8B7510                  mov esi, dword ptr [ebp+10]
:0047FEF6 F7C602000000            test esi, 00000002
:0047FEFC 7404                    je 0047FF02
:0047FEFE C645FF2B                mov [ebp-01], 2B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FEFC(C)
|
:0047FF02 F7C608000000            test esi, 00000008
:0047FF08 7404                    je 0047FF0E
:0047FF0A C645FF20                mov [ebp-01], 20

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FF08(C)
|
:0047FF0E F7C610000000            test esi, 00000010
:0047FF14 7404                    je 0047FF1A
:0047FF16 C645FF30                mov [ebp-01], 30

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FF14(C)
|
:0047FF1A F7C640000000            test esi, 00000040
:0047FF20 7404                    je 0047FF26
:0047FF22 C645FF2D                mov [ebp-01], 2D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FF20(C)
|
:0047FF26 FF751C                  push [ebp+1C]
:0047FF29 8D4DE0                  lea ecx, dword ptr [ebp-20]
:0047FF2C 51                      push ecx
:0047FF2D FF750C                  push [ebp+0C]
:0047FF30 E8BFFCFFFF              call 0047FBF4
:0047FF35 83C40C                  add esp, 0000000C
:0047FF38 807DE061                cmp byte ptr [ebp-20], 61
:0047FF3C 7210                    jb 0047FF4E
:0047FF3E 807DE066                cmp byte ptr [ebp-20], 66
:0047FF42 770A                    ja 0047FF4E
:0047FF44 837D2000                cmp dword ptr [ebp+20], 00000000
:0047FF48 7504                    jne 0047FF4E
:0047FF4A 806DE020                sub byte ptr [ebp-20], 20

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047FF3C(C), :0047FF42(C), :0047FF48(C)
|
:0047FF4E 8D45E0                  lea eax, dword ptr [ebp-20]
:0047FF51 50                      push eax
:0047FF52 E803FDFFFF              call 0047FC5A
:0047FF57 83C404                  add esp, 00000004
:0047FF5A 8BD6                    mov edx, esi
:0047FF5C 83E220                  and edx, 00000020
:0047FF5F 8B5D18                  mov ebx, dword ptr [ebp+18]
:0047FF62 C1EA05                  shr edx, 05
:0047FF65 807DFF01                cmp byte ptr [ebp-01], 01
:0047FF69 1BC9                    sbb ecx, ecx
:0047FF6B 41                      inc ecx
:0047FF6C 03D1                    add edx, ecx
:0047FF6E 3BC3                    cmp eax, ebx
:0047FF70 8BC8                    mov ecx, eax
:0047FF72 7F02                    jg 0047FF76
:0047FF74 8BCB                    mov ecx, ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FF72(C)
|
:0047FF76 03D1                    add edx, ecx
:0047FF78 2BD8                    sub ebx, eax
:0047FF7A 295514                  sub dword ptr [ebp+14], edx
:0047FF7D F7C601000000            test esi, 00000001
:0047FF83 7431                    je 0047FFB6
:0047FF85 FF7520                  push [ebp+20]
:0047FF88 56                      push esi
:0047FF89 FF75FF                  push [ebp-01]
:0047FF8C 8B7D08                  mov edi, dword ptr [ebp+08]
:0047FF8F 57                      push edi
:0047FF90 E8E2FEFFFF              call 0047FE77
:0047FF95 83C410                  add esp, 00000010
:0047FF98 8945F8                  mov dword ptr [ebp-08], eax
:0047FF9B 8D45E0                  lea eax, dword ptr [ebp-20]
:0047FF9E 53                      push ebx
:0047FF9F 50                      push eax
:0047FFA0 57                      push edi
:0047FFA1 E896FEFFFF              call 0047FE3C
:0047FFA6 83C40C                  add esp, 0000000C
:0047FFA9 0145F8                  add dword ptr [ebp-08], eax
:0047FFAC 6A20                    push 00000020
:0047FFAE FF7514                  push [ebp+14]
:0047FFB1 E995000000              jmp 0048004B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FF83(C)
|
:0047FFB6 8BC6                    mov eax, esi
:0047FFB8 83E004                  and eax, 00000004
:0047FFBB 8945F0                  mov dword ptr [ebp-10], eax
:0047FFBE 7418                    je 0047FFD8
:0047FFC0 FF7520                  push [ebp+20]
:0047FFC3 56                      push esi
:0047FFC4 FF75FF                  push [ebp-01]
:0047FFC7 8B7D08                  mov edi, dword ptr [ebp+08]
:0047FFCA 57                      push edi
:0047FFCB E8A7FEFFFF              call 0047FE77
:0047FFD0 83C410                  add esp, 00000010
:0047FFD3 8945F8                  mov dword ptr [ebp-08], eax
:0047FFD6 EB03                    jmp 0047FFDB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FFBE(C)
|
:0047FFD8 8B7D08                  mov edi, dword ptr [ebp+08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FFD6(U)
|
:0047FFDB 8B4514                  mov eax, dword ptr [ebp+14]
:0047FFDE 8945F4                  mov dword ptr [ebp-0C], eax
:0047FFE1 8BC6                    mov eax, esi
:0047FFE3 2580000000              and eax, 00000080
:0047FFE8 8945EC                  mov dword ptr [ebp-14], eax
:0047FFEB 740B                    je 0047FFF8
:0047FFED 8B4514                  mov eax, dword ptr [ebp+14]
:0047FFF0 99                      cdq
:0047FFF1 2BC2                    sub eax, edx
:0047FFF3 D1F8                    sar eax, 1
:0047FFF5 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FFEB(C)
|
:0047FFF8 837DF001                cmp dword ptr [ebp-10], 00000001
:0047FFFC 1AC0                    sbb al, al
:0047FFFE 24F0                    and al, F0
:00480000 0430                    add al, 30
:00480002 50                      push eax
:00480003 FF75F4                  push [ebp-0C]
:00480006 57                      push edi
:00480007 E8A9FEFFFF              call 0047FEB5
:0048000C 83C40C                  add esp, 0000000C
:0048000F 0145F8                  add dword ptr [ebp-08], eax
:00480012 837DF000                cmp dword ptr [ebp-10], 00000000
:00480016 7513                    jne 0048002B
:00480018 FF7520                  push [ebp+20]
:0048001B 56                      push esi
:0048001C FF75FF                  push [ebp-01]
:0048001F 57                      push edi
:00480020 E852FEFFFF              call 0047FE77
:00480025 83C410                  add esp, 00000010
:00480028 0145F8                  add dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480016(C)
|
:0048002B 53                      push ebx
:0048002C 8D45E0                  lea eax, dword ptr [ebp-20]
:0048002F 50                      push eax
:00480030 57                      push edi
:00480031 E806FEFFFF              call 0047FE3C
:00480036 83C40C                  add esp, 0000000C
:00480039 0145F8                  add dword ptr [ebp-08], eax
:0048003C 837DEC00                cmp dword ptr [ebp-14], 00000000
:00480040 7415                    je 00480057
:00480042 6A20                    push 00000020
:00480044 8B4514                  mov eax, dword ptr [ebp+14]
:00480047 2B45F4                  sub eax, dword ptr [ebp-0C]
:0048004A 50                      push eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047FFB1(U)
|
:0048004B 57                      push edi
:0048004C E864FEFFFF              call 0047FEB5
:00480051 83C40C                  add esp, 0000000C
:00480054 0145F8                  add dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480040(C)
|
:00480057 8B45F8                  mov eax, dword ptr [ebp-08]
:0048005A 5F                      pop edi
:0048005B 5E                      pop esi
:0048005C 5B                      pop ebx
:0048005D 8BE5                    mov esp, ebp
:0048005F 5D                      pop ebp
:00480060 C3                      ret



* Referenced by a CALL at Addresses:
|:004802DD   , :00480300   , :0048031E   
|
:00480061 55                      push ebp
:00480062 8BEC                    mov ebp, esp
:00480064 83EC0C                  sub esp, 0000000C
:00480067 C745FC00000000          mov [ebp-04], 00000000
:0048006E 53                      push ebx
:0048006F 56                      push esi
:00480070 57                      push edi
:00480071 8B5D18                  mov ebx, dword ptr [ebp+18]
:00480074 8B7D0C                  mov edi, dword ptr [ebp+0C]
:00480077 85DB                    test ebx, ebx
:00480079 740D                    je 00480088
:0048007B 57                      push edi
:0048007C E8D9FBFFFF              call 0047FC5A
:00480081 83C404                  add esp, 00000004
:00480084 3BC3                    cmp eax, ebx
:00480086 730B                    jnb 00480093

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480079(C)
|
:00480088 57                      push edi
:00480089 E8CCFBFFFF              call 0047FC5A
:0048008E 83C404                  add esp, 00000004
:00480091 8BD8                    mov ebx, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480086(C)
|
:00480093 295D14                  sub dword ptr [ebp+14], ebx
:00480096 7907                    jns 0048009F
:00480098 C7451400000000          mov [ebp+14], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480096(C)
|
:0048009F 8B4D10                  mov ecx, dword ptr [ebp+10]
:004800A2 F6C101                  test cl, 01
:004800A5 7423                    je 004800CA
:004800A7 85DB                    test ebx, ebx
:004800A9 7E15                    jle 004800C0
:004800AB 8B7508                  mov esi, dword ptr [ebp+08]
:004800AE 895DFC                  mov dword ptr [ebp-04], ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004800BC(C)
|
:004800B1 0FB607                  movzx eax, byte ptr [edi]
:004800B4 50                      push eax
:004800B5 47                      inc edi
:004800B6 FFD6                    call esi
:004800B8 83C404                  add esp, 00000004
:004800BB 4B                      dec ebx
:004800BC 75F3                    jne 004800B1
:004800BE EB03                    jmp 004800C3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004800A9(C)
|
:004800C0 8B7508                  mov esi, dword ptr [ebp+08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004800BE(U)
|
:004800C3 6A20                    push 00000020
:004800C5 FF7514                  push [ebp+14]
:004800C8 EB58                    jmp 00480122

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004800A5(C)
|
:004800CA 8BC1                    mov eax, ecx
:004800CC 2580000000              and eax, 00000080
:004800D1 8945F4                  mov dword ptr [ebp-0C], eax
:004800D4 8B4514                  mov eax, dword ptr [ebp+14]
:004800D7 7405                    je 004800DE
:004800D9 99                      cdq
:004800DA 2BC2                    sub eax, edx
:004800DC D1F8                    sar eax, 1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004800D7(C)
|
:004800DE 83E104                  and ecx, 00000004
:004800E1 8945F8                  mov dword ptr [ebp-08], eax
:004800E4 8B7508                  mov esi, dword ptr [ebp+08]
:004800E7 83F901                  cmp ecx, 00000001
:004800EA 1AC0                    sbb al, al
:004800EC 24F0                    and al, F0
:004800EE 0430                    add al, 30
:004800F0 50                      push eax
:004800F1 FF75F8                  push [ebp-08]
:004800F4 56                      push esi
:004800F5 E8BBFDFFFF              call 0047FEB5
:004800FA 83C40C                  add esp, 0000000C
:004800FD 03C3                    add eax, ebx
:004800FF 8945FC                  mov dword ptr [ebp-04], eax
:00480102 85DB                    test ebx, ebx
:00480104 7E0D                    jle 00480113

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480111(C)
|
:00480106 0FB607                  movzx eax, byte ptr [edi]
:00480109 50                      push eax
:0048010A 47                      inc edi
:0048010B FFD6                    call esi
:0048010D 83C404                  add esp, 00000004
:00480110 4B                      dec ebx
:00480111 75F3                    jne 00480106

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480104(C)
|
:00480113 837DF400                cmp dword ptr [ebp-0C], 00000000
:00480117 7415                    je 0048012E
:00480119 6A20                    push 00000020
:0048011B 8B4514                  mov eax, dword ptr [ebp+14]
:0048011E 2B45F8                  sub eax, dword ptr [ebp-08]
:00480121 50                      push eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004800C8(U)
|
:00480122 56                      push esi
:00480123 E88DFDFFFF              call 0047FEB5
:00480128 83C40C                  add esp, 0000000C
:0048012B 0145FC                  add dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480117(C)
|
:0048012E 8B45FC                  mov eax, dword ptr [ebp-04]
:00480131 5F                      pop edi
:00480132 5E                      pop esi
:00480133 5B                      pop ebx
:00480134 8BE5                    mov esp, ebp
:00480136 5D                      pop ebp
:00480137 C3                      ret



* Referenced by a CALL at Address:
|:0048043A   
|
:00480138 55                      push ebp
:00480139 33C9                    xor ecx, ecx
:0048013B 8BEC                    mov ebp, esp
:0048013D 83EC0C                  sub esp, 0000000C
:00480140 53                      push ebx
:00480141 8B450C                  mov eax, dword ptr [ebp+0C]
:00480144 56                      push esi
:00480145 894DF4                  mov dword ptr [ebp-0C], ecx
:00480148 57                      push edi
:00480149 894DFC                  mov dword ptr [ebp-04], ecx
:0048014C 3808                    cmp byte ptr [eax], cl
:0048014E 0F8469020000            je 004803BD
:00480154 8B7510                  mov esi, dword ptr [ebp+10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004803B7(C)
|
:00480157 8B450C                  mov eax, dword ptr [ebp+0C]
:0048015A 803825                  cmp byte ptr [eax], 25
:0048015D 7415                    je 00480174
:0048015F FF450C                  inc [ebp+0C]
:00480162 0FB608                  movzx ecx, byte ptr [eax]
:00480165 51                      push ecx
:00480166 FF5508                  call [ebp+08]
:00480169 83C404                  add esp, 00000004
:0048016C FF45FC                  inc [ebp-04]
:0048016F E93D020000              jmp 004803B1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048015D(C)
|
:00480174 FF450C                  inc [ebp+0C]
:00480177 8B450C                  mov eax, dword ptr [ebp+0C]
:0048017A 803825                  cmp byte ptr [eax], 25
:0048017D 7515                    jne 00480194
:0048017F FF450C                  inc [ebp+0C]
:00480182 0FB608                  movzx ecx, byte ptr [eax]
:00480185 51                      push ecx
:00480186 FF5508                  call [ebp+08]
:00480189 83C404                  add esp, 00000004
:0048018C FF45FC                  inc [ebp-04]
:0048018F E91D020000              jmp 004803B1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048017D(C)
|
:00480194 8D450C                  lea eax, dword ptr [ebp+0C]
:00480197 50                      push eax
:00480198 E8A3FBFFFF              call 0047FD40
:0048019D 83C404                  add esp, 00000004
:004801A0 8BF8                    mov edi, eax
:004801A2 8D450C                  lea eax, dword ptr [ebp+0C]
:004801A5 50                      push eax
:004801A6 E8F8FBFFFF              call 0047FDA3
:004801AB 83C404                  add esp, 00000004
:004801AE 8BD8                    mov ebx, eax
:004801B0 83FBFF                  cmp ebx, FFFFFFFF
:004801B3 7505                    jne 004801BA
:004801B5 8B1E                    mov ebx, dword ptr [esi]
:004801B7 83C604                  add esi, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004801B3(C)
|
:004801BA 8D450C                  lea eax, dword ptr [ebp+0C]
:004801BD 50                      push eax
:004801BE E81FFCFFFF              call 0047FDE2
:004801C3 83C404                  add esp, 00000004
:004801C6 8945F8                  mov dword ptr [ebp-08], eax
:004801C9 83F8FF                  cmp eax, FFFFFFFF
:004801CC 7508                    jne 004801D6
:004801CE 8B06                    mov eax, dword ptr [esi]
:004801D0 83C604                  add esi, 00000004
:004801D3 8945F8                  mov dword ptr [ebp-08], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004801CC(C)
|
:004801D6 8D450C                  lea eax, dword ptr [ebp+0C]
:004801D9 50                      push eax
:004801DA E820FCFFFF              call 0047FDFF
:004801DF 83C404                  add esp, 00000004
:004801E2 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:004801E5 FF450C                  inc [ebp+0C]
:004801E8 0FB609                  movzx ecx, byte ptr [ecx]
:004801EB 83E958                  sub ecx, 00000058
:004801EE 83F920                  cmp ecx, 00000020
:004801F1 0F87BA010000            ja 004803B1
:004801F7 0FB691EB034800          movzx edx, byte ptr [ecx+004803EB]
:004801FE FF2495C7034800          jmp dword ptr [4*edx+004803C7]
:00480205 0FB606                  movzx eax, byte ptr [esi]
:00480208 83C604                  add esi, 00000004
:0048020B 50                      push eax
:0048020C FF5508                  call [ebp+08]
:0048020F 83C404                  add esp, 00000004
:00480212 FF45FC                  inc [ebp-04]
:00480215 E997010000              jmp 004803B1
:0048021A 83E7EF                  and edi, FFFFFFEF
:0048021D 83F801                  cmp eax, 00000001
:00480220 752E                    jne 00480250
:00480222 8B06                    mov eax, dword ptr [esi]
:00480224 83C604                  add esi, 00000004
:00480227 85C0                    test eax, eax
:00480229 7D08                    jge 00480233
:0048022B F7D8                    neg eax
:0048022D 83CF40                  or edi, 00000040
:00480230 83E7FD                  and edi, FFFFFFFD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480229(C)
|
:00480233 6A00                    push 00000000
:00480235 6A0A                    push 0000000A
:00480237 FF75F8                  push [ebp-08]
:0048023A 53                      push ebx
:0048023B 57                      push edi
:0048023C 50                      push eax
:0048023D FF7508                  push [ebp+08]
:00480240 E89DFCFFFF              call 0047FEE2
:00480245 83C41C                  add esp, 0000001C
:00480248 0145FC                  add dword ptr [ebp-04], eax
:0048024B E961010000              jmp 004803B1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480220(C)
|
:00480250 8B06                    mov eax, dword ptr [esi]
:00480252 83C604                  add esi, 00000004
:00480255 85C0                    test eax, eax
:00480257 7D08                    jge 00480261
:00480259 F7D8                    neg eax
:0048025B 83CF40                  or edi, 00000040
:0048025E 83E7FD                  and edi, FFFFFFFD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480257(C)
|
:00480261 6A00                    push 00000000
:00480263 6A0A                    push 0000000A
:00480265 FF75F8                  push [ebp-08]
:00480268 53                      push ebx
:00480269 57                      push edi
:0048026A 50                      push eax
:0048026B FF7508                  push [ebp+08]
:0048026E E86FFCFFFF              call 0047FEE2
:00480273 83C41C                  add esp, 0000001C
:00480276 0145FC                  add dword ptr [ebp-04], eax
:00480279 E933010000              jmp 004803B1
:0048027E 83E7F5                  and edi, FFFFFFF5
:00480281 83F801                  cmp eax, 00000001
:00480284 7522                    jne 004802A8
:00480286 83C604                  add esi, 00000004
:00480289 6A00                    push 00000000
:0048028B 6A08                    push 00000008
:0048028D FF75F8                  push [ebp-08]
:00480290 53                      push ebx
:00480291 57                      push edi
:00480292 FF76FC                  push [esi-04]
:00480295 FF7508                  push [ebp+08]
:00480298 E845FCFFFF              call 0047FEE2
:0048029D 83C41C                  add esp, 0000001C
:004802A0 0145FC                  add dword ptr [ebp-04], eax
:004802A3 E909010000              jmp 004803B1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480284(C)
|
:004802A8 83C604                  add esi, 00000004
:004802AB 6A00                    push 00000000
:004802AD 6A08                    push 00000008
:004802AF FF75F8                  push [ebp-08]
:004802B2 53                      push ebx
:004802B3 57                      push edi
:004802B4 FF76FC                  push [esi-04]
:004802B7 FF7508                  push [ebp+08]
:004802BA E823FCFFFF              call 0047FEE2
:004802BF 83C41C                  add esp, 0000001C
:004802C2 0145FC                  add dword ptr [ebp-04], eax
:004802C5 E9E7000000              jmp 004803B1
:004802CA 83F802                  cmp eax, 00000002
:004802CD 751E                    jne 004802ED
:004802CF FF75F8                  push [ebp-08]
:004802D2 53                      push ebx
:004802D3 83C604                  add esi, 00000004
:004802D6 57                      push edi
:004802D7 FF76FC                  push [esi-04]
:004802DA FF7508                  push [ebp+08]
:004802DD E87FFDFFFF              call 00480061
:004802E2 83C414                  add esp, 00000014
:004802E5 0145FC                  add dword ptr [ebp-04], eax
:004802E8 E9C4000000              jmp 004803B1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004802CD(C)
|
:004802ED 83F803                  cmp eax, 00000003
:004802F0 751E                    jne 00480310
:004802F2 FF75F8                  push [ebp-08]
:004802F5 53                      push ebx
:004802F6 83C604                  add esi, 00000004
:004802F9 57                      push edi
:004802FA FF76FC                  push [esi-04]
:004802FD FF7508                  push [ebp+08]
:00480300 E85CFDFFFF              call 00480061
:00480305 83C414                  add esp, 00000014
:00480308 0145FC                  add dword ptr [ebp-04], eax
:0048030B E9A1000000              jmp 004803B1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004802F0(C)
|
:00480310 FF75F8                  push [ebp-08]
:00480313 53                      push ebx
:00480314 83C604                  add esi, 00000004
:00480317 57                      push edi
:00480318 FF76FC                  push [esi-04]
:0048031B FF7508                  push [ebp+08]
:0048031E E83EFDFFFF              call 00480061
:00480323 83C414                  add esp, 00000014
:00480326 0145FC                  add dword ptr [ebp-04], eax
:00480329 E983000000              jmp 004803B1
:0048032E 83E7EF                  and edi, FFFFFFEF
:00480331 83F801                  cmp eax, 00000001
:00480334 751F                    jne 00480355
:00480336 83C604                  add esi, 00000004
:00480339 6A00                    push 00000000
:0048033B 6A0A                    push 0000000A
:0048033D FF75F8                  push [ebp-08]
:00480340 53                      push ebx
:00480341 57                      push edi
:00480342 FF76FC                  push [esi-04]
:00480345 FF7508                  push [ebp+08]
:00480348 E895FBFFFF              call 0047FEE2
:0048034D 83C41C                  add esp, 0000001C
:00480350 0145FC                  add dword ptr [ebp-04], eax
:00480353 EB5C                    jmp 004803B1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480334(C)
|
:00480355 83C604                  add esi, 00000004
:00480358 6A00                    push 00000000
:0048035A 6A0A                    push 0000000A
:0048035C FF75F8                  push [ebp-08]
:0048035F 53                      push ebx
:00480360 57                      push edi
:00480361 FF76FC                  push [esi-04]
:00480364 FF7508                  push [ebp+08]
:00480367 E876FBFFFF              call 0047FEE2
:0048036C 83C41C                  add esp, 0000001C
:0048036F 0145FC                  add dword ptr [ebp-04], eax
:00480372 EB3D                    jmp 004803B1
:00480374 C745F420000000          mov [ebp-0C], 00000020
:0048037B 83E7F5                  and edi, FFFFFFF5
:0048037E F7C710000000            test edi, 00000010
:00480384 7403                    je 00480389
:00480386 83CF20                  or edi, 00000020

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480384(C)
|
:00480389 83F801                  cmp eax, 00000001
:0048038C FF75F4                  push [ebp-0C]
:0048038F 6A10                    push 00000010
:00480391 FF75F8                  push [ebp-08]
:00480394 53                      push ebx
:00480395 83C604                  add esi, 00000004
:00480398 57                      push edi
:00480399 FF76FC                  push [esi-04]
:0048039C FF7508                  push [ebp+08]
:0048039F E83EFBFFFF              call 0047FEE2
:004803A4 83C41C                  add esp, 0000001C
:004803A7 0145FC                  add dword ptr [ebp-04], eax
:004803AA C745F400000000          mov [ebp-0C], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0048016F(U), :0048018F(U), :004801F1(C), :00480215(U), :0048024B(U)
|:00480279(U), :004802A3(U), :004802C5(U), :004802E8(U), :0048030B(U)
|:00480329(U), :00480353(U), :00480372(U)
|
:004803B1 8B450C                  mov eax, dword ptr [ebp+0C]
:004803B4 803800                  cmp byte ptr [eax], 00
:004803B7 0F859AFDFFFF            jne 00480157

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048014E(C)
|
:004803BD 8B45FC                  mov eax, dword ptr [ebp-04]
:004803C0 5F                      pop edi
:004803C1 5E                      pop esi
:004803C2 5B                      pop ebx
:004803C3 8BE5                    mov esp, ebp
:004803C5 5D                      pop ebp
:004803C6 C3                      ret



:004803C7 7B034800                DWORD 0048037B
:004803CB 05024800                DWORD 00480205
:004803CF 1A024800                DWORD 0048021A
:004803D3 1A024800                DWORD 0048021A
:004803D7 7E024800                DWORD 0048027E
:004803DB CA024800                DWORD 004802CA
:004803DF 2E034800                DWORD 0048032E
:004803E3 74034800                DWORD 00480374
:004803E7 B1034800                DWORD 004803B1


:004803EB 0008                    add byte ptr [eax], cl
:004803ED 0808                    or byte ptr [eax], cl
:004803EF 0808                    or byte ptr [eax], cl
:004803F1 0808                    or byte ptr [eax], cl
:004803F3 0808                    or byte ptr [eax], cl
:004803F5 0801                    or byte ptr [ecx], al
:004803F7 0208                    add cl, byte ptr [eax]
:004803F9 0808                    or byte ptr [eax], cl
:004803FB 0803                    or byte ptr [ebx], al
:004803FD 0808                    or byte ptr [eax], cl
:004803FF 0808                    or byte ptr [eax], cl
:00480401 080408                  or byte ptr [eax+ecx], al
:00480404 0808                    or byte ptr [eax], cl
:00480406 0508060808              add eax, 08080608
:0048040B 07                      pop es
:0048040C 55                      push ebp
:0048040D A1B8CB4B00              mov eax, dword ptr [004BCBB8]
:00480412 8BEC                    mov ebp, esp
:00480414 8A4C2408                mov cl, byte ptr [esp+08]
:00480418 5D                      pop ebp
:00480419 8808                    mov byte ptr [eax], cl
:0048041B FF05B8CB4B00            inc dword ptr [004BCBB8]
:00480421 C3                      ret



* Referenced by a CALL at Addresses:
|:0045E443   , :0045E45E   , :0045E559   , :004615A0   , :0046164E   
|:004616A9   , :00461915   , :00461931   , :00476A22   , :0047A843   
|:0047A8B5   , :0047A8DA   , :0047A94C   , :0047A971   , :0047AA0C   
|:0047AA28   , :0047AAC3   , :0047AADF   , :0047AB7A   , :0047AB96   
|:0047AC31   , :0047AC4D   , :0047ACE8   , :0047AD04   , :0047AD4C   
|
:00480422 55                      push ebp
:00480423 8B442408                mov eax, dword ptr [esp+08]
:00480427 8BEC                    mov ebp, esp
:00480429 A3B8CB4B00              mov dword ptr [004BCBB8], eax
:0048042E 8D4D10                  lea ecx, dword ptr [ebp+10]
:00480431 51                      push ecx
:00480432 FF750C                  push [ebp+0C]
:00480435 680C044800              push 0048040C
:0048043A E8F9FCFFFF              call 00480138
:0048043F 83C40C                  add esp, 0000000C
:00480442 8B0DB8CB4B00            mov ecx, dword ptr [004BCBB8]
:00480448 5D                      pop ebp
:00480449 C60100                  mov byte ptr [ecx], 00
:0048044C C3                      ret



* Referenced by a CALL at Address:
|:0042B99B   
|
:0048044D 56                      push esi
:0048044E 57                      push edi

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:0048044F C705F8CB4B0006000000    mov dword ptr [004BCBF8], 00000006
:00480459 E8B8C6FFFF              call 0047CB16
:0048045E 85C0                    test eax, eax
:00480460 7511                    jne 00480473
:00480462 B900CC4B00              mov ecx, 004BCC00
:00480467 E8CC010000              call 00480638
:0048046C 800DF9CB4B0008          or byte ptr [004BCBF9], 08

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480460(C)
|
:00480473 E8A1010000              call 00480619
:00480478 85C0                    test eax, eax
:0048047A 7407                    je 00480483
:0048047C 800DF9CB4B0004          or byte ptr [004BCBF9], 04

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048047A(C)
|
:00480483 E88EC6FFFF              call 0047CB16
:00480488 85C0                    test eax, eax
:0048048A 7507                    jne 00480493
:0048048C 800DF9CB4B0002          or byte ptr [004BCBF9], 02

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048048A(C)
|
:00480493 E8C9F4FFFF              call 0047F961
:00480498 85C0                    test eax, eax
:0048049A 7407                    je 004804A3
:0048049C 800DF9CB4B0010          or byte ptr [004BCBF9], 10

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048049A(C)
|
:004804A3 830DF8CB4B0010          or dword ptr [004BCBF8], 00000010
:004804AA 33FF                    xor edi, edi
:004804AC 6A01                    push 00000001
:004804AE 893DC0CB4B00            mov dword ptr [004BCBC0], edi
:004804B4 5E                      pop esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004804D8(C)
|
:004804B5 56                      push esi
:004804B6 E80E010000              call 004805C9
:004804BB 393DC0CB4B00            cmp dword ptr [004BCBC0], edi
:004804C1 59                      pop ecx
:004804C2 750A                    jne 004804CE
:004804C4 3BC7                    cmp eax, edi
:004804C6 7506                    jne 004804CE
:004804C8 8935C0CB4B00            mov dword ptr [004BCBC0], esi

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004804C2(C), :004804C6(C)
|
:004804CE 8886D0CB4B00            mov byte ptr [esi+004BCBD0], al
:004804D4 46                      inc esi
:004804D5 83FE1A                  cmp esi, 0000001A
:004804D8 7EDB                    jle 004804B5
:004804DA E8C1000000              call 004805A0
:004804DF 8A80D0CB4B00            mov al, byte ptr [eax+004BCBD0]

* Possible StringData Ref from Code Obj ->"UK"
                                  |
:004804E5 6880054800              push 00480580
:004804EA A2D0CB4B00              mov byte ptr [004BCBD0], al
:004804EF 893DF0CB4B00            mov dword ptr [004BCBF0], edi
:004804F5 E8F60A0000              call 00480FF0
:004804FA 59                      pop ecx
:004804FB A3C8CB4B00              mov dword ptr [004BCBC8], eax
:00480500 6893054800              push 00480593
:00480505 893DECCB4B00            mov dword ptr [004BCBEC], edi
:0048050B 893DF4CB4B00            mov dword ptr [004BCBF4], edi
:00480511 E8FC000000              call 00480612
:00480516 85C0                    test eax, eax
:00480518 59                      pop ecx
:00480519 7407                    je 00480522
:0048051B 800DF9CB4B0020          or byte ptr [004BCBF9], 20

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480519(C)
|
:00480522 A1F8CB4B00              mov eax, dword ptr [004BCBF8]
:00480527 B9000E0000              mov ecx, 00000E00
:0048052C 23C1                    and eax, ecx
:0048052E 5F                      pop edi
:0048052F 2BC1                    sub eax, ecx
:00480531 5E                      pop esi
:00480532 F7D8                    neg eax
:00480534 1BC0                    sbb eax, eax
:00480536 40                      inc eax
:00480537 C3                      ret



* Referenced by a CALL at Address:
|:0042B567   
|
:00480538 55                      push ebp
:00480539 8BEC                    mov ebp, esp
:0048053B E82BF4FFFF              call 0047F96B
:00480540 FF35C8CB4B00            push dword ptr [004BCBC8]
:00480546 E8A50A0000              call 00480FF0
:0048054B F605F9CB4B0004          test byte ptr [004BCBF9], 04
:00480552 59                      pop ecx
:00480553 7405                    je 0048055A
:00480555 E8C3000000              call 0048061D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480553(C)
|
:0048055A F605F9CB4B0008          test byte ptr [004BCBF9], 08
:00480561 7410                    je 00480573
:00480563 E8D8CDFFFF              call 0047D340
:00480568 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0048056C 7405                    je 00480573
:0048056E E894CBFFFF              call 0047D107

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00480561(C), :0048056C(C)
|
:00480573 FF7508                  push [ebp+08]
:00480576 E889EDFFFF              call 0047F304
:0048057B 59                      pop ecx
:0048057C 5D                      pop ebp
:0048057D C20800                  ret 0008


:00480580 55                      push ebp
:00480581 8BEC                    mov ebp, esp
:00480583 A1F0CB4B00              mov eax, dword ptr [004BCBF0]
:00480588 85C0                    test eax, eax
:0048058A 7402                    je 0048058E
:0048058C FFD0                    call eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048058A(C)
|
:0048058E 6A01                    push 00000001
:00480590 58                      pop eax
:00480591 5D                      pop ebp
:00480592 C3                      ret


:00480593 FF05F4CB4B00            inc dword ptr [004BCBF4]
:00480599 C3                      ret


:0048059A E900000000              jmp 0048059F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048059A(U)
|
:0048059F C3                      ret

* Referenced by a CALL at Address:
|:004804DA   
|
:004805A0 55                      push ebp
:004805A1 8BEC                    mov ebp, esp
:004805A3 81EC00010000            sub esp, 00000100
:004805A9 8D8500FFFFFF            lea eax, dword ptr [ebp+FFFFFF00]
:004805AF 50                      push eax
:004805B0 6800010000              push 00000100
:004805B5 FF1510614800            call dword ptr [00486110]
:004805BB 0FB68500FFFFFF          movzx eax, byte ptr [ebp+FFFFFF00]
:004805C2 0C20                    or al, 20
:004805C4 83E860                  sub eax, 00000060
:004805C7 C9                      leave
:004805C8 C3                      ret



* Referenced by a CALL at Address:
|:004804B6   
|
:004805C9 B801000000              mov eax, 00000001
:004805CE C3                      ret


:004805CF EC                      in al, dx
:004805D0 48                      dec eax
:004805D1 008945FC8B45            add byte ptr [ecx+458BFC45], cl
:004805D7 088AC880C140            or byte ptr [edx+40C180C8], cl
:004805DD F7D8                    neg eax
:004805DF 884DFC                  mov byte ptr [ebp-04], cl
:004805E2 8D4DFC                  lea ecx, dword ptr [ebp-04]
:004805E5 1BC0                    sbb eax, eax
:004805E7 23C1                    and eax, ecx
:004805E9 50                      push eax
:004805EA FF15F4604800            call dword ptr [004860F4]
:004805F0 83F802                  cmp eax, 00000002
:004805F3 7419                    je 0048060E
:004805F5 83F803                  cmp eax, 00000003
:004805F8 740F                    je 00480609
:004805FA 83F804                  cmp eax, 00000004
:004805FD 7605                    jbe 00480604
:004805FF 83F806                  cmp eax, 00000006
:00480602 7605                    jbe 00480609

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004805FD(C)
|
:00480604 83C8FF                  or eax, FFFFFFFF
:00480607 C9                      leave
:00480608 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004805F8(C), :00480602(C)
|
:00480609 6A01                    push 00000001
:0048060B 58                      pop eax
:0048060C C9                      leave
:0048060D C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004805F3(C)
|
:0048060E 33C0                    xor eax, eax
:00480610 C9                      leave
:00480611 C3                      ret



* Referenced by a CALL at Addresses:
|:0047FA30   , :00480511   
|
:00480612 55                      push ebp
:00480613 8BEC                    mov ebp, esp
:00480615 33C0                    xor eax, eax
:00480617 5D                      pop ebp
:00480618 C3                      ret



* Referenced by a CALL at Address:
|:00480473   
|
:00480619 83C8FF                  or eax, FFFFFFFF
:0048061C C3                      ret



* Referenced by a CALL at Address:
|:00480555   
|
:0048061D 33C0                    xor eax, eax
:0048061F C3                      ret


:00480620 E900000000              jmp 00480625

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480620(U)
|
:00480625 C3                      ret
:00480626 E900000000              jmp 0048062B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480626(U)
|
:0048062B C3                      ret
:0048062C E900000000              jmp 00480631

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048062C(U)
|
:00480631 C3                      ret
:00480632 E900000000              jmp 00480637

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480632(U)
|
:00480637 C3                      ret

* Referenced by a CALL at Address:
|:00480467   
|
:00480638 56                      push esi
:00480639 E80BC9FFFF              call 0047CF49
:0048063E 6814CC4B00              push 004BCC14
:00480643 6810CC4B00              push 004BCC10
:00480648 E858CBFFFF              call 0047D1A5
:0048064D 59                      pop ecx
:0048064E 33F6                    xor esi, esi
:00480650 59                      pop ecx
:00480651 C70538CC4B0008000000    mov dword ptr [004BCC38], 00000008
:0048065B 56                      push esi
:0048065C B908CC4B00              mov ecx, 004BCC08
:00480661 E812F4FFFF              call 0047FA78
:00480666 A108CC4B00              mov eax, dword ptr [004BCC08]
:0048066B 6A03                    push 00000003
:0048066D A320CC4B00              mov dword ptr [004BCC20], eax
:00480672 A10CCC4B00              mov eax, dword ptr [004BCC0C]
:00480677 A324CC4B00              mov dword ptr [004BCC24], eax
:0048067C A110CC4B00              mov eax, dword ptr [004BCC10]
:00480681 A328CC4B00              mov dword ptr [004BCC28], eax
:00480686 A114CC4B00              mov eax, dword ptr [004BCC14]
:0048068B A32CCC4B00              mov dword ptr [004BCC2C], eax
:00480690 58                      pop eax
:00480691 50                      push eax
:00480692 89351CCC4B00            mov dword ptr [004BCC1C], esi
:00480698 893518CC4B00            mov dword ptr [004BCC18], esi
:0048069E A3E0EC4800              mov dword ptr [0048ECE0], eax
:004806A3 E822CBFFFF              call 0047D1CA
:004806A8 59                      pop ecx
:004806A9 89353CCC4B00            mov dword ptr [004BCC3C], esi
:004806AF 893534CC4B00            mov dword ptr [004BCC34], esi
:004806B5 893530CC4B00            mov dword ptr [004BCC30], esi
:004806BB 5E                      pop esi
:004806BC C3                      ret



* Referenced by a CALL at Address:
|:0048077C   
|
:004806BD 55                      push ebp
:004806BE 8BEC                    mov ebp, esp
:004806C0 833DF4EC480000          cmp dword ptr [0048ECF4], 00000000
:004806C7 7417                    je 004806E0
:004806C9 FF7518                  push [ebp+18]
:004806CC FF7514                  push [ebp+14]
:004806CF FF7510                  push [ebp+10]
:004806D2 FF750C                  push [ebp+0C]
:004806D5 FF7508                  push [ebp+08]
:004806D8 E8A5DCFFFF              call 0047E382
:004806DD 83C414                  add esp, 00000014

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004806C7(C)
|
:004806E0 5D                      pop ebp
:004806E1 C21400                  ret 0014


:004806E4 55                      push ebp
:004806E5 8BEC                    mov ebp, esp
:004806E7 83EC20                  sub esp, 00000020
:004806EA 53                      push ebx
:004806EB 56                      push esi
:004806EC 8B7510                  mov esi, dword ptr [ebp+10]
:004806EF 57                      push edi
:004806F0 8BC6                    mov eax, esi
:004806F2 8BD9                    mov ebx, ecx
:004806F4 C1E808                  shr eax, 08
:004806F7 50                      push eax
:004806F8 E83FF5FFFF              call 0047FC3C
:004806FD 85C0                    test eax, eax
:004806FF 59                      pop ecx
:00480700 7422                    je 00480724
:00480702 8D45E0                  lea eax, dword ptr [ebp-20]
:00480705 50                      push eax
:00480706 56                      push esi
:00480707 E88CDFFFFF              call 0047E698
:0048070C 59                      pop ecx
:0048070D 8D45E0                  lea eax, dword ptr [ebp-20]
:00480710 59                      pop ecx
:00480711 6A00                    push 00000000
:00480713 50                      push eax
:00480714 8BCB                    mov ecx, ebx
:00480716 E86D000000              call 00480788
:0048071B C7451010000000          mov [ebp+10], 00000010
:00480722 EB2B                    jmp 0048074F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480700(C)
|
:00480724 8BC6                    mov eax, esi
:00480726 25FF000000              and eax, 000000FF
:0048072B 83F820                  cmp eax, 00000020
:0048072E 721F                    jb 0048074F
:00480730 83F87F                  cmp eax, 0000007F
:00480733 771A                    ja 0048074F
:00480735 83C6E0                  add esi, FFFFFFE0
:00480738 8D7DE0                  lea edi, dword ptr [ebp-20]
:0048073B C1E604                  shl esi, 04
:0048073E 81C6F8EC4800            add esi, 0048ECF8
:00480744 C7451008000000          mov [ebp+10], 00000008
:0048074B A5                      movsd
:0048074C A5                      movsd
:0048074D A5                      movsd
:0048074E A5                      movsd

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00480722(U), :0048072E(C), :00480733(C)
|
:0048074F A1ECEC4800              mov eax, dword ptr [0048ECEC]
:00480754 8B0DE8EC4800            mov ecx, dword ptr [0048ECE8]
:0048075A 8B15F0EC4800            mov edx, dword ptr [0048ECF0]
:00480760 50                      push eax
:00480761 51                      push ecx
:00480762 52                      push edx
:00480763 E8D1CAFFFF              call 0047D239
:00480768 83C40C                  add esp, 0000000C
:0048076B 8D45E0                  lea eax, dword ptr [ebp-20]
:0048076E 8BCB                    mov ecx, ebx
:00480770 50                      push eax
:00480771 6A10                    push 00000010
:00480773 FF7510                  push [ebp+10]
:00480776 FF750C                  push [ebp+0C]
:00480779 FF7508                  push [ebp+08]
:0048077C E83CFFFFFF              call 004806BD
:00480781 5F                      pop edi
:00480782 5E                      pop esi
:00480783 5B                      pop ebx
:00480784 C9                      leave
:00480785 C20C00                  ret 000C



* Referenced by a CALL at Address:
|:00480716   
|
:00480788 55                      push ebp
:00480789 8BEC                    mov ebp, esp
:0048078B 833D3CCC4B0001          cmp dword ptr [004BCC3C], 00000001
:00480792 53                      push ebx
:00480793 56                      push esi
:00480794 57                      push edi
:00480795 7541                    jne 004807D8
:00480797 837D0C00                cmp dword ptr [ebp+0C], 00000000
:0048079B 8B4508                  mov eax, dword ptr [ebp+08]
:0048079E 6A10                    push 00000010
:004807A0 7411                    je 004807B3
:004807A2 5E                      pop esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004807AF(C)
|
:004807A3 8A08                    mov cl, byte ptr [eax]
:004807A5 8AD1                    mov dl, cl
:004807A7 D0E2                    shl dl, 1
:004807A9 0AD1                    or dl, cl
:004807AB 8810                    mov byte ptr [eax], dl
:004807AD 40                      inc eax
:004807AE 4E                      dec esi
:004807AF 75F2                    jne 004807A3
:004807B1 EB25                    jmp 004807D8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004807A0(C)
|
:004807B3 5F                      pop edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004807D6(C)
|
:004807B4 8A10                    mov dl, byte ptr [eax]
:004807B6 8D7001                  lea esi, dword ptr [eax+01]
:004807B9 660FB6CA                movzx cx, dl
:004807BD 660FB61E                movzx bx, byte ptr [esi]
:004807C1 C1E108                  shl ecx, 08
:004807C4 03CB                    add ecx, ebx
:004807C6 33DB                    xor ebx, ebx
:004807C8 D1E1                    shl ecx, 1
:004807CA 8ADD                    mov bl, ch
:004807CC 0ADA                    or bl, dl
:004807CE 8818                    mov byte ptr [eax], bl
:004807D0 8BC6                    mov eax, esi
:004807D2 0808                    or byte ptr [eax], cl
:004807D4 40                      inc eax
:004807D5 4F                      dec edi
:004807D6 75DC                    jne 004807B4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00480795(C), :004807B1(U)
|
:004807D8 5F                      pop edi
:004807D9 5E                      pop esi
:004807DA 5B                      pop ebx
:004807DB 5D                      pop ebp
:004807DC C20800                  ret 0008


:004807DF E900000000              jmp 004807E4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004807DF(U)
|
:004807E4 C70500CC4B0054774800    mov dword ptr [004BCC00], 00487754
:004807EE C3                      ret


:004807EF CC                      int 03

* Referenced by a CALL at Addresses:
|:00401026   , :00409AF2   , :00410069   , :00410093   , :00449E98   
|:0047D3B7   , :0047F661   , :0047F7AC   
|
:004807F0 55                      push ebp
:004807F1 8BEC                    mov ebp, esp
:004807F3 57                      push edi
:004807F4 56                      push esi
:004807F5 8B750C                  mov esi, dword ptr [ebp+0C]
:004807F8 8B4D10                  mov ecx, dword ptr [ebp+10]
:004807FB 8B7D08                  mov edi, dword ptr [ebp+08]
:004807FE 8BC1                    mov eax, ecx
:00480800 8BD1                    mov edx, ecx
:00480802 03C6                    add eax, esi
:00480804 3BFE                    cmp edi, esi
:00480806 7608                    jbe 00480810
:00480808 3BF8                    cmp edi, eax
:0048080A 0F8278010000            jb 00480988

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480806(C)
|
:00480810 F7C703000000            test edi, 00000003
:00480816 7514                    jne 0048082C
:00480818 C1E902                  shr ecx, 02
:0048081B 83E203                  and edx, 00000003
:0048081E 83F908                  cmp ecx, 00000008
:00480821 7229                    jb 0048084C
:00480823 F3                      repz
:00480824 A5                      movsd
:00480825 FF249538094800          jmp dword ptr [4*edx+00480938]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480816(C)
|
:0048082C 8BC7                    mov eax, edi
:0048082E BA03000000              mov edx, 00000003
:00480833 83E904                  sub ecx, 00000004
:00480836 720C                    jb 00480844
:00480838 83E003                  and eax, 00000003
:0048083B 03C8                    add ecx, eax
:0048083D FF248550084800          jmp dword ptr [4*eax+00480850]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480836(C)
|
:00480844 FF248D48094800          jmp dword ptr [4*ecx+00480948]
:0048084B 90                      nop

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00480821(C), :0048087E(C), :004808A4(C), :004808BE(C)
|
:0048084C FF248DCC084800          jmp dword ptr [4*ecx+004808CC]
:00480853 90                      nop

:00480854 60084800                DWORD 00480860
:00480858 8C084800                DWORD 0048088C
:0048085C B0084800                DWORD 004808B0


:00480860 23D1                    and edx, ecx
:00480862 8A06                    mov al, byte ptr [esi]
:00480864 8807                    mov byte ptr [edi], al
:00480866 8A4601                  mov al, byte ptr [esi+01]
:00480869 884701                  mov byte ptr [edi+01], al
:0048086C 8A4602                  mov al, byte ptr [esi+02]
:0048086F C1E902                  shr ecx, 02
:00480872 884702                  mov byte ptr [edi+02], al
:00480875 83C603                  add esi, 00000003
:00480878 83C703                  add edi, 00000003
:0048087B 83F908                  cmp ecx, 00000008
:0048087E 72CC                    jb 0048084C
:00480880 F3                      repz
:00480881 A5                      movsd
:00480882 FF249538094800          jmp dword ptr [4*edx+00480938]
:00480889 2E8BC0                  mov eax, eax
:0048088C 23D1                    and edx, ecx
:0048088E 8A06                    mov al, byte ptr [esi]
:00480890 8807                    mov byte ptr [edi], al
:00480892 8A4601                  mov al, byte ptr [esi+01]
:00480895 C1E902                  shr ecx, 02
:00480898 884701                  mov byte ptr [edi+01], al
:0048089B 83C602                  add esi, 00000002
:0048089E 83C702                  add edi, 00000002
:004808A1 83F908                  cmp ecx, 00000008
:004808A4 72A6                    jb 0048084C
:004808A6 F3                      repz
:004808A7 A5                      movsd
:004808A8 FF249538094800          jmp dword ptr [4*edx+00480938]
:004808AF 90                      nop
:004808B0 23D1                    and edx, ecx
:004808B2 8A06                    mov al, byte ptr [esi]
:004808B4 8807                    mov byte ptr [edi], al
:004808B6 46                      inc esi
:004808B7 C1E902                  shr ecx, 02
:004808BA 47                      inc edi
:004808BB 83F908                  cmp ecx, 00000008
:004808BE 728C                    jb 0048084C
:004808C0 F3                      repz
:004808C1 A5                      movsd
:004808C2 FF249538094800          jmp dword ptr [4*edx+00480938]
:004808C9 2E8BC0                  mov eax, eax

:004808CC 2F094800                DWORD 0048092F
:004808D0 1C094800                DWORD 0048091C
:004808D4 14094800                DWORD 00480914
:004808D8 0C094800                DWORD 0048090C
:004808DC 04094800                DWORD 00480904
:004808E0 FC084800                DWORD 004808FC
:004808E4 F4084800                DWORD 004808F4
:004808E8 EC084800                DWORD 004808EC


:004808EC 8B448EE4                mov eax, dword ptr [esi+4*ecx-1C]
:004808F0 89448FE4                mov dword ptr [edi+4*ecx-1C], eax
:004808F4 8B448EE8                mov eax, dword ptr [esi+4*ecx-18]
:004808F8 89448FE8                mov dword ptr [edi+4*ecx-18], eax
:004808FC 8B448EEC                mov eax, dword ptr [esi+4*ecx-14]
:00480900 89448FEC                mov dword ptr [edi+4*ecx-14], eax
:00480904 8B448EF0                mov eax, dword ptr [esi+4*ecx-10]
:00480908 89448FF0                mov dword ptr [edi+4*ecx-10], eax
:0048090C 8B448EF4                mov eax, dword ptr [esi+4*ecx-0C]
:00480910 89448FF4                mov dword ptr [edi+4*ecx-0C], eax
:00480914 8B448EF8                mov eax, dword ptr [esi+4*ecx-08]
:00480918 89448FF8                mov dword ptr [edi+4*ecx-08], eax
:0048091C 8B448EFC                mov eax, dword ptr [esi+4*ecx-04]
:00480920 89448FFC                mov dword ptr [edi+4*ecx-04], eax
:00480924 8D048D00000000          lea eax, dword ptr [4*ecx+00000000]
:0048092B 03F0                    add esi, eax
:0048092D 03F8                    add edi, eax
:0048092F FF249538094800          jmp dword ptr [4*edx+00480938]
:00480936 8BC0                    mov eax, eax

:00480938 48094800                DWORD 00480948
:0048093C 50094800                DWORD 00480950
:00480940 5C094800                DWORD 0048095C
:00480944 70094800                DWORD 00480970


:00480948 8B4508                  mov eax, dword ptr [ebp+08]
:0048094B 5E                      pop esi
:0048094C 5F                      pop edi
:0048094D C9                      leave
:0048094E C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480944(C)
|
:0048094F 90                      nop
:00480950 8A06                    mov al, byte ptr [esi]
:00480952 8807                    mov byte ptr [edi], al
:00480954 8B4508                  mov eax, dword ptr [ebp+08]
:00480957 5E                      pop esi
:00480958 5F                      pop edi
:00480959 C9                      leave
:0048095A C3                      ret


:0048095B 90                      nop
:0048095C 8A06                    mov al, byte ptr [esi]
:0048095E 8807                    mov byte ptr [edi], al
:00480960 8A4601                  mov al, byte ptr [esi+01]
:00480963 884701                  mov byte ptr [edi+01], al
:00480966 8B4508                  mov eax, dword ptr [ebp+08]
:00480969 5E                      pop esi
:0048096A 5F                      pop edi
:0048096B C9                      leave
:0048096C C3                      ret


:0048096D 2E8BC0                  mov eax, eax
:00480970 8A06                    mov al, byte ptr [esi]
:00480972 8807                    mov byte ptr [edi], al
:00480974 8A4601                  mov al, byte ptr [esi+01]
:00480977 884701                  mov byte ptr [edi+01], al
:0048097A 8A4602                  mov al, byte ptr [esi+02]
:0048097D 884702                  mov byte ptr [edi+02], al
:00480980 8B4508                  mov eax, dword ptr [ebp+08]
:00480983 5E                      pop esi
:00480984 5F                      pop edi
:00480985 C9                      leave
:00480986 C3                      ret


:00480987 90                      nop

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048080A(C)
|
:00480988 8D7431FC                lea esi, dword ptr [ecx+esi-04]
:0048098C 8D7C39FC                lea edi, dword ptr [ecx+edi-04]
:00480990 F7C703000000            test edi, 00000003
:00480996 7524                    jne 004809BC
:00480998 C1E902                  shr ecx, 02
:0048099B 83E203                  and edx, 00000003
:0048099E 83F908                  cmp ecx, 00000008
:004809A1 720D                    jb 004809B0
:004809A3 FD                      std
:004809A4 F3                      repz
:004809A5 A5                      movsd
:004809A6 FC                      cld
:004809A7 FF2495D00A4800          jmp dword ptr [4*edx+00480AD0]
:004809AE 8BC0                    mov eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004809A1(C), :004809F8(C), :00480A22(C), :00480A50(C)
|
:004809B0 F7D9                    neg ecx
:004809B2 FF248D800A4800          jmp dword ptr [4*ecx+00480A80]
:004809B9 2E8BC0                  mov eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480996(C)
|
:004809BC 8BC7                    mov eax, edi
:004809BE BA03000000              mov edx, 00000003
:004809C3 83F904                  cmp ecx, 00000004
:004809C6 720C                    jb 004809D4
:004809C8 83E003                  and eax, 00000003
:004809CB 2BC8                    sub ecx, eax
:004809CD FF2485D8094800          jmp dword ptr [4*eax+004809D8]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004809C6(C)
|
:004809D4 FF248DD00A4800          jmp dword ptr [4*ecx+00480AD0]
:004809DB 90                      nop

:004809DC E8094800                DWORD 004809E8
:004809E0 080A4800                DWORD 00480A08
:004809E4 300A4800                DWORD 00480A30


:004809E8 8A4603                  mov al, byte ptr [esi+03]
:004809EB 23D1                    and edx, ecx
:004809ED 884703                  mov byte ptr [edi+03], al
:004809F0 4E                      dec esi
:004809F1 C1E902                  shr ecx, 02
:004809F4 4F                      dec edi
:004809F5 83F908                  cmp ecx, 00000008
:004809F8 72B6                    jb 004809B0
:004809FA FD                      std
:004809FB F3                      repz
:004809FC A5                      movsd
:004809FD FC                      cld
:004809FE FF2495D00A4800          jmp dword ptr [4*edx+00480AD0]
:00480A05 2E8BC0                  mov eax, eax
:00480A08 8A4603                  mov al, byte ptr [esi+03]
:00480A0B 23D1                    and edx, ecx
:00480A0D 884703                  mov byte ptr [edi+03], al
:00480A10 8A4602                  mov al, byte ptr [esi+02]
:00480A13 C1E902                  shr ecx, 02
:00480A16 884702                  mov byte ptr [edi+02], al
:00480A19 83EE02                  sub esi, 00000002
:00480A1C 83EF02                  sub edi, 00000002
:00480A1F 83F908                  cmp ecx, 00000008
:00480A22 728C                    jb 004809B0
:00480A24 FD                      std
:00480A25 F3                      repz
:00480A26 A5                      movsd
:00480A27 FC                      cld
:00480A28 FF2495D00A4800          jmp dword ptr [4*edx+00480AD0]
:00480A2F 90                      nop
:00480A30 8A4603                  mov al, byte ptr [esi+03]
:00480A33 23D1                    and edx, ecx
:00480A35 884703                  mov byte ptr [edi+03], al
:00480A38 8A4602                  mov al, byte ptr [esi+02]
:00480A3B 884702                  mov byte ptr [edi+02], al
:00480A3E 8A4601                  mov al, byte ptr [esi+01]
:00480A41 C1E902                  shr ecx, 02
:00480A44 884701                  mov byte ptr [edi+01], al
:00480A47 83EE03                  sub esi, 00000003
:00480A4A 83EF03                  sub edi, 00000003
:00480A4D 83F908                  cmp ecx, 00000008
:00480A50 0F825AFFFFFF            jb 004809B0
:00480A56 FD                      std
:00480A57 F3                      repz
:00480A58 A5                      movsd
:00480A59 FC                      cld
:00480A5A FF2495D00A4800          jmp dword ptr [4*edx+00480AD0]
:00480A61 2E8BC0                  mov eax, eax

:00480A64 840A4800                DWORD 00480A84
:00480A68 8C0A4800                DWORD 00480A8C
:00480A6C 940A4800                DWORD 00480A94
:00480A70 9C0A4800                DWORD 00480A9C
:00480A74 A40A4800                DWORD 00480AA4
:00480A78 AC0A4800                DWORD 00480AAC
:00480A7C B40A4800                DWORD 00480AB4
:00480A80 C70A4800                DWORD 00480AC7


:00480A84 8B448E1C                mov eax, dword ptr [esi+4*ecx+1C]
:00480A88 89448F1C                mov dword ptr [edi+4*ecx+1C], eax
:00480A8C 8B448E18                mov eax, dword ptr [esi+4*ecx+18]
:00480A90 89448F18                mov dword ptr [edi+4*ecx+18], eax
:00480A94 8B448E14                mov eax, dword ptr [esi+4*ecx+14]
:00480A98 89448F14                mov dword ptr [edi+4*ecx+14], eax
:00480A9C 8B448E10                mov eax, dword ptr [esi+4*ecx+10]
:00480AA0 89448F10                mov dword ptr [edi+4*ecx+10], eax
:00480AA4 8B448E0C                mov eax, dword ptr [esi+4*ecx+0C]
:00480AA8 89448F0C                mov dword ptr [edi+4*ecx+0C], eax
:00480AAC 8B448E08                mov eax, dword ptr [esi+4*ecx+08]
:00480AB0 89448F08                mov dword ptr [edi+4*ecx+08], eax
:00480AB4 8B448E04                mov eax, dword ptr [esi+4*ecx+04]
:00480AB8 89448F04                mov dword ptr [edi+4*ecx+04], eax
:00480ABC 8D048D00000000          lea eax, dword ptr [4*ecx+00000000]
:00480AC3 03F0                    add esi, eax
:00480AC5 03F8                    add edi, eax
:00480AC7 FF2495D00A4800          jmp dword ptr [4*edx+00480AD0]
:00480ACE 8BC0                    mov eax, eax

:00480AD0 E00A4800                DWORD 00480AE0
:00480AD4 E80A4800                DWORD 00480AE8
:00480AD8 F80A4800                DWORD 00480AF8
:00480ADC 0C0B4800                DWORD 00480B0C


:00480AE0 8B4508                  mov eax, dword ptr [ebp+08]
:00480AE3 5E                      pop esi
:00480AE4 5F                      pop edi
:00480AE5 C9                      leave
:00480AE6 C3                      ret


:00480AE7 90                      nop
:00480AE8 8A4603                  mov al, byte ptr [esi+03]
:00480AEB 884703                  mov byte ptr [edi+03], al
:00480AEE 8B4508                  mov eax, dword ptr [ebp+08]
:00480AF1 5E                      pop esi
:00480AF2 5F                      pop edi
:00480AF3 C9                      leave
:00480AF4 C3                      ret


:00480AF5 2E8BC0                  mov eax, eax
:00480AF8 8A4603                  mov al, byte ptr [esi+03]
:00480AFB 884703                  mov byte ptr [edi+03], al
:00480AFE 8A4602                  mov al, byte ptr [esi+02]
:00480B01 884702                  mov byte ptr [edi+02], al
:00480B04 8B4508                  mov eax, dword ptr [ebp+08]
:00480B07 5E                      pop esi
:00480B08 5F                      pop edi
:00480B09 C9                      leave
:00480B0A C3                      ret


:00480B0B 90                      nop
:00480B0C 8A4603                  mov al, byte ptr [esi+03]
:00480B0F 884703                  mov byte ptr [edi+03], al
:00480B12 8A4602                  mov al, byte ptr [esi+02]
:00480B15 884702                  mov byte ptr [edi+02], al
:00480B18 8A4601                  mov al, byte ptr [esi+01]
:00480B1B 884701                  mov byte ptr [edi+01], al
:00480B1E 8B4508                  mov eax, dword ptr [ebp+08]
:00480B21 5E                      pop esi
:00480B22 5F                      pop edi
:00480B23 C9                      leave
:00480B24 C3                      ret


:00480B25 CC                      int 03
:00480B26 CC                      int 03
:00480B27 CC                      int 03
:00480B28 CC                      int 03
:00480B29 CC                      int 03
:00480B2A CC                      int 03
:00480B2B CC                      int 03
:00480B2C CC                      int 03
:00480B2D CC                      int 03
:00480B2E CC                      int 03
:00480B2F CC                      int 03

* Referenced by a CALL at Addresses:
|:00401218   , :00401230   , :00401249   , :004012C0   , :004012D8   
|:004012F1   , :0040130A   , :00401322   , :004016FE   , :00401717   
|:0040172F   , :00401748   , :004025D0   , :004025E3   , :004033CF   
|:004033E8   , :00403401   , :00403482   , :0040349B   , :0040A676   
|:0040CC40   , :0040CC59   , :0041A210   , :0041A2E4   , :0042E0CA   
|:00443DB4   , :00451DFA   , :0045E512   , :0046DCCC   , :00472033   
|:004768DC   , :00479829   , :0047CC87   , :0047E6CA   , :0047E7AE   
|:0047F613   , :0047F636   
|
:00480B30 8B54240C                mov edx, dword ptr [esp+0C]
:00480B34 8B4C2404                mov ecx, dword ptr [esp+04]
:00480B38 85D2                    test edx, edx
:00480B3A 7447                    je 00480B83
:00480B3C 33C0                    xor eax, eax
:00480B3E 8A442408                mov al, byte ptr [esp+08]
:00480B42 57                      push edi
:00480B43 8BF9                    mov edi, ecx
:00480B45 83FA04                  cmp edx, 00000004
:00480B48 722D                    jb 00480B77
:00480B4A F7D9                    neg ecx
:00480B4C 83E103                  and ecx, 00000003
:00480B4F 7408                    je 00480B59
:00480B51 2BD1                    sub edx, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480B57(C)
|
:00480B53 8807                    mov byte ptr [edi], al
:00480B55 47                      inc edi
:00480B56 49                      dec ecx
:00480B57 75FA                    jne 00480B53

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480B4F(C)
|
:00480B59 8BC8                    mov ecx, eax
:00480B5B C1E008                  shl eax, 08
:00480B5E 03C1                    add eax, ecx
:00480B60 8BC8                    mov ecx, eax
:00480B62 C1E010                  shl eax, 10
:00480B65 03C1                    add eax, ecx
:00480B67 8BCA                    mov ecx, edx
:00480B69 83E203                  and edx, 00000003
:00480B6C C1E902                  shr ecx, 02
:00480B6F 7406                    je 00480B77
:00480B71 F3                      repz
:00480B72 AB                      stosd
:00480B73 85D2                    test edx, edx
:00480B75 7406                    je 00480B7D

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00480B48(C), :00480B6F(C), :00480B7B(C)
|
:00480B77 8807                    mov byte ptr [edi], al
:00480B79 47                      inc edi
:00480B7A 4A                      dec edx
:00480B7B 75FA                    jne 00480B77

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480B75(C)
|
:00480B7D 8B442408                mov eax, dword ptr [esp+08]
:00480B81 5F                      pop edi
:00480B82 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480B3A(C)
|
:00480B83 8B442404                mov eax, dword ptr [esp+04]
:00480B87 C3                      ret


:00480B88 CC                      int 03
:00480B89 CC                      int 03
:00480B8A CC                      int 03
:00480B8B CC                      int 03
:00480B8C CC                      int 03
:00480B8D CC                      int 03
:00480B8E CC                      int 03
:00480B8F CC                      int 03

* Referenced by a CALL at Address:
|:004822CF   
|
:00480B90 55                      push ebp
:00480B91 8BEC                    mov ebp, esp
:00480B93 51                      push ecx
:00480B94 53                      push ebx
:00480B95 56                      push esi
:00480B96 57                      push edi
:00480B97 8B450C                  mov eax, dword ptr [ebp+0C]
:00480B9A 83C00C                  add eax, 0000000C
:00480B9D 8945FC                  mov dword ptr [ebp-04], eax
:00480BA0 648B1D00000000          mov ebx, dword ptr fs:[00000000]
:00480BA7 8B03                    mov eax, dword ptr [ebx]
:00480BA9 64A300000000            mov dword ptr fs:[00000000], eax
:00480BAF 8B4508                  mov eax, dword ptr [ebp+08]
:00480BB2 8B5D0C                  mov ebx, dword ptr [ebp+0C]
:00480BB5 8B63FC                  mov esp, dword ptr [ebx-04]
:00480BB8 8B6DFC                  mov ebp, dword ptr [ebp-04]
:00480BBB FFE0                    jmp eax
:00480BBD 5F                      pop edi
:00480BBE 5E                      pop esi
:00480BBF 5B                      pop ebx
:00480BC0 8BE5                    mov esp, ebp
:00480BC2 5D                      pop ebp
:00480BC3 C20800                  ret 0008


:00480BC6 CC                      int 03
:00480BC7 CC                      int 03
:00480BC8 CC                      int 03
:00480BC9 CC                      int 03
:00480BCA CC                      int 03
:00480BCB CC                      int 03
:00480BCC CC                      int 03
:00480BCD CC                      int 03
:00480BCE CC                      int 03
:00480BCF CC                      int 03

* Referenced by a CALL at Addresses:
|:00482610   , :0048262D   , :004826B3   
|
:00480BD0 58                      pop eax
:00480BD1 59                      pop ecx
:00480BD2 870424                  xchg dword ptr [esp], eax
:00480BD5 FFE0                    jmp eax
:00480BD7 CC                      int 03
:00480BD8 CC                      int 03
:00480BD9 CC                      int 03
:00480BDA CC                      int 03
:00480BDB CC                      int 03
:00480BDC CC                      int 03
:00480BDD CC                      int 03
:00480BDE CC                      int 03
:00480BDF CC                      int 03

* Referenced by a CALL at Addresses:
|:00480E46   , :00482281   
|
:00480BE0 55                      push ebp
:00480BE1 8BEC                    mov ebp, esp
:00480BE3 83EC08                  sub esp, 00000008
:00480BE6 53                      push ebx
:00480BE7 56                      push esi
:00480BE8 57                      push edi
:00480BE9 64A100000000            mov eax, dword ptr fs:[00000000]
:00480BEF 8945F8                  mov dword ptr [ebp-08], eax

* Possible StringData Ref from Code Obj ->"EHUJd"
                                  |
:00480BF2 C745FC0C0C4800          mov [ebp-04], 00480C0C
:00480BF9 6A00                    push 00000000
:00480BFB 8B450C                  mov eax, dword ptr [ebp+0C]
:00480BFE 50                      push eax
:00480BFF 8B4DFC                  mov ecx, dword ptr [ebp-04]
:00480C02 51                      push ecx
:00480C03 8B5508                  mov edx, dword ptr [ebp+08]
:00480C06 52                      push edx
:00480C07 E8C4420000              call 00484ED0
:00480C0C 8B450C                  mov eax, dword ptr [ebp+0C]
:00480C0F 8B4804                  mov ecx, dword ptr [eax+04]
:00480C12 83E1FD                  and ecx, FFFFFFFD
:00480C15 8B550C                  mov edx, dword ptr [ebp+0C]
:00480C18 894A04                  mov dword ptr [edx+04], ecx
:00480C1B 64A100000000            mov eax, dword ptr fs:[00000000]
:00480C21 8B5DF8                  mov ebx, dword ptr [ebp-08]
:00480C24 8903                    mov dword ptr [ebx], eax
:00480C26 64891D00000000          mov dword ptr fs:[00000000], ebx
:00480C2D 5F                      pop edi
:00480C2E 5E                      pop esi
:00480C2F 5B                      pop ebx
:00480C30 8BE5                    mov esp, ebp
:00480C32 5D                      pop ebp
:00480C33 C20800                  ret 0008


:00480C36 CC                      int 03
:00480C37 CC                      int 03
:00480C38 CC                      int 03
:00480C39 CC                      int 03
:00480C3A CC                      int 03
:00480C3B CC                      int 03
:00480C3C CC                      int 03
:00480C3D CC                      int 03
:00480C3E CC                      int 03
:00480C3F CC                      int 03

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00484EEE(U), :00484F04(U), :00484F0E(U), :00484F23(U), :00484F2D(U)
|:00484F51(U), :00484F71(U), :00484F91(U), :00484FA7(U), :00484FC1(U)
|:00484FDE(U), :00484FF4(U), :00485007(U), :0048501E(U), :00485034(U)
|:0048504E(U), :0048506E(U), :00485091(U), :004850B1(U), :004850CE(U)
|:004850EE(U), :00485111(U), :0048512E(U), :00485141(U), :00485154(U)
|:0048516E(U), :0048518E(U), :004851A1(U), :004851B7(U), :004851CD(U)
|:004851E0(U), :004851F3(U), :00485206(U), :0048521C(U), :00485241(U)
|:00485257(U), :00485271(U), :00485291(U), :004852A7(U), :004852C1(U)
|:004852D7(U), :004852F1(U), :00485310(U), :00485326(U), :0048533C(U)
|:00485352(U), :0048537A(U), :0048539A(U), :004853B0(U), :004853D1(U)
|:004853E7(U), :004853FE(U), :0048541E(U), :00485441(U), :00485457(U)
|:00485471(U), :00485487(U), :0048549D(U), :004854B3(U), :004854C9(U)
|:004854DF(U), :004854F5(U), :0048550B(U), :00485521(U), :00485537(U)
|:0048554D(U), :00485563(U), :00485579(U), :0048558F(U), :004855A5(U)
|:004855C1(U), :004855D7(U), :004855ED(U), :00485603(U), :00485619(U)
|:0048562F(U), :00485645(U), :0048565B(U), :00485671(U), :00485687(U)
|:0048569D(U), :004856B3(U), :004856C9(U), :004856E1(U), :004856F6(U)
|:0048570C(U), :00485731(U), :00485766(U), :0048577E(U), :004857A1(U)
|:004857C3(U), :004857E3(U), :004857F8(U), :0048580B(U), :0048581E(U)
|:0048583D(U), :00485853(U), :00485869(U), :0048587F(U), :00485892(U)
|:004858D5(U), :004858E8(U), :0048590D(U), :00485923(U), :00485938(U)
|:00485957(U), :0048596A(U), :0048597F(U), :00485995(U), :004859AB(U)
|:004859C1(U), :004859FF(U), :00485A30(U), :00485A60(U), :00485A7E(U)
|:00485A9E(U), :00485ABE(U), :00485ADE(U), :00485AFE(U), :00485B39(U)
|:00485B69(U), :00485B8D(U), :00485BBD(U), :00485BED(U), :00485C44(U)
|:00485C94(U), :00485CAE(U), :00485CCE(U), :00485D06(U), :00485D36(U)
|:00485D51(U), :00485D64(U), :00485D77(U), :00485D8E(U), :00485DAE(U)
|:00485DCE(U)
|
:00480C40 55                      push ebp
:00480C41 8BEC                    mov ebp, esp
:00480C43 83EC04                  sub esp, 00000004
:00480C46 53                      push ebx
:00480C47 56                      push esi
:00480C48 57                      push edi
:00480C49 FC                      cld
:00480C4A 8945FC                  mov dword ptr [ebp-04], eax
:00480C4D 8B45FC                  mov eax, dword ptr [ebp-04]
:00480C50 8B4D14                  mov ecx, dword ptr [ebp+14]
:00480C53 8B5510                  mov edx, dword ptr [ebp+10]
:00480C56 6A00                    push 00000000
:00480C58 6A00                    push 00000000
:00480C5A 6A00                    push 00000000
:00480C5C 50                      push eax
:00480C5D 8B450C                  mov eax, dword ptr [ebp+0C]
:00480C60 51                      push ecx
:00480C61 8B4D08                  mov ecx, dword ptr [ebp+08]
:00480C64 52                      push edx
:00480C65 50                      push eax
:00480C66 51                      push ecx
:00480C67 E8B4100000              call 00481D20
:00480C6C 83C420                  add esp, 00000020
:00480C6F 894514                  mov dword ptr [ebp+14], eax
:00480C72 5F                      pop edi
:00480C73 5E                      pop esi
:00480C74 5B                      pop ebx
:00480C75 8B4514                  mov eax, dword ptr [ebp+14]
:00480C78 8BE5                    mov esp, ebp
:00480C7A 5D                      pop ebp
:00480C7B C3                      ret


:00480C7C 90                      nop
:00480C7D 90                      nop
:00480C7E 90                      nop
:00480C7F 90                      nop

* Referenced by a CALL at Address:
|:00482356   
|
:00480C80 55                      push ebp
:00480C81 8BEC                    mov ebp, esp
:00480C83 83EC14                  sub esp, 00000014
:00480C86 8B5514                  mov edx, dword ptr [ebp+14]
:00480C89 8B450C                  mov eax, dword ptr [ebp+0C]
:00480C8C 8B4D08                  mov ecx, dword ptr [ebp+08]
:00480C8F 42                      inc edx
:00480C90 C745EC00000000          mov [ebp-14], 00000000
:00480C97 C745F0E00C4800          mov [ebp-10], 00480CE0
:00480C9E 8945F4                  mov dword ptr [ebp-0C], eax
:00480CA1 894DF8                  mov dword ptr [ebp-08], ecx
:00480CA4 8955FC                  mov dword ptr [ebp-04], edx
:00480CA7 64A100000000            mov eax, dword ptr fs:[00000000]
:00480CAD 8945EC                  mov dword ptr [ebp-14], eax
:00480CB0 8D85ECFFFFFF            lea eax, dword ptr [ebp+FFFFFFEC]
:00480CB6 64A300000000            mov dword ptr fs:[00000000], eax
:00480CBC 8B4518                  mov eax, dword ptr [ebp+18]
:00480CBF 50                      push eax
:00480CC0 51                      push ecx
:00480CC1 8B4D10                  mov ecx, dword ptr [ebp+10]
:00480CC4 51                      push ecx
:00480CC5 E8561A0000              call 00482720
:00480CCA 8BC8                    mov ecx, eax
:00480CCC 8B45EC                  mov eax, dword ptr [ebp-14]
:00480CCF 64A300000000            mov dword ptr fs:[00000000], eax
:00480CD5 8BC1                    mov eax, ecx
:00480CD7 8BE5                    mov esp, ebp
:00480CD9 5D                      pop ebp
:00480CDA C3                      ret


:00480CDB 90                      nop
:00480CDC 90                      nop
:00480CDD 90                      nop
:00480CDE 90                      nop
:00480CDF 90                      nop
:00480CE0 55                      push ebp
:00480CE1 8BEC                    mov ebp, esp
:00480CE3 FC                      cld
:00480CE4 8B450C                  mov eax, dword ptr [ebp+0C]
:00480CE7 6A00                    push 00000000
:00480CE9 50                      push eax
:00480CEA 8B4810                  mov ecx, dword ptr [eax+10]
:00480CED 8B5008                  mov edx, dword ptr [eax+08]
:00480CF0 51                      push ecx
:00480CF1 8B4D10                  mov ecx, dword ptr [ebp+10]
:00480CF4 52                      push edx
:00480CF5 8B500C                  mov edx, dword ptr [eax+0C]
:00480CF8 8B4508                  mov eax, dword ptr [ebp+08]
:00480CFB 6A00                    push 00000000
:00480CFD 51                      push ecx
:00480CFE 52                      push edx
:00480CFF 50                      push eax
:00480D00 E81B100000              call 00481D20
:00480D05 83C420                  add esp, 00000020
:00480D08 5D                      pop ebp
:00480D09 C3                      ret


:00480D0A 90                      nop
:00480D0B 90                      nop
:00480D0C 90                      nop
:00480D0D 90                      nop
:00480D0E 90                      nop
:00480D0F 90                      nop

* Referenced by a CALL at Address:
|:004820D0   
|
:00480D10 55                      push ebp
:00480D11 8BEC                    mov ebp, esp
:00480D13 83EC34                  sub esp, 00000034
:00480D16 53                      push ebx
:00480D17 56                      push esi
:00480D18 57                      push edi
:00480D19 C745D800000000          mov [ebp-28], 00000000
:00480D20 C745DCE00D4800          mov [ebp-24], 00480DE0
:00480D27 8B4518                  mov eax, dword ptr [ebp+18]
:00480D2A 8945E0                  mov dword ptr [ebp-20], eax
:00480D2D 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00480D30 894DE4                  mov dword ptr [ebp-1C], ecx
:00480D33 8B551C                  mov edx, dword ptr [ebp+1C]
:00480D36 8955E8                  mov dword ptr [ebp-18], edx
:00480D39 8B4520                  mov eax, dword ptr [ebp+20]
:00480D3C 8945EC                  mov dword ptr [ebp-14], eax
:00480D3F C745F000000000          mov [ebp-10], 00000000
:00480D46 C745F400000000          mov [ebp-0C], 00000000
:00480D4D C745F800000000          mov [ebp-08], 00000000
:00480D54 C745FC00000000          mov [ebp-04], 00000000

* Possible StringData Ref from Code Obj ->"}"
                                  |
:00480D5B C745F0AA0D4800          mov [ebp-10], 00480DAA
:00480D62 8965F4                  mov dword ptr [ebp-0C], esp
:00480D65 896DF8                  mov dword ptr [ebp-08], ebp
:00480D68 64A100000000            mov eax, dword ptr fs:[00000000]
:00480D6E 8945D8                  mov dword ptr [ebp-28], eax
:00480D71 8D85D8FFFFFF            lea eax, dword ptr [ebp+FFFFFFD8]
:00480D77 64A300000000            mov dword ptr fs:[00000000], eax
:00480D7D C745CC01000000          mov [ebp-34], 00000001
:00480D84 8B4D08                  mov ecx, dword ptr [ebp+08]
:00480D87 894DD0                  mov dword ptr [ebp-30], ecx
:00480D8A 8B5510                  mov edx, dword ptr [ebp+10]
:00480D8D 8955D4                  mov dword ptr [ebp-2C], edx
:00480D90 8D45D0                  lea eax, dword ptr [ebp-30]
:00480D93 50                      push eax
:00480D94 8B4D08                  mov ecx, dword ptr [ebp+08]
:00480D97 8B11                    mov edx, dword ptr [ecx]
:00480D99 52                      push edx
:00480D9A FF15ACCC4B00            call dword ptr [004BCCAC]
:00480DA0 83C408                  add esp, 00000008
:00480DA3 C745CC00000000          mov [ebp-34], 00000000
:00480DAA 837DFC00                cmp dword ptr [ebp-04], 00000000
:00480DAE 7417                    je 00480DC7
:00480DB0 648B1D00000000          mov ebx, dword ptr fs:[00000000]
:00480DB7 8B03                    mov eax, dword ptr [ebx]
:00480DB9 8B5DD8                  mov ebx, dword ptr [ebp-28]
:00480DBC 8903                    mov dword ptr [ebx], eax
:00480DBE 64891D00000000          mov dword ptr fs:[00000000], ebx
:00480DC5 EB09                    jmp 00480DD0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480DAE(C)
|
:00480DC7 8B45D8                  mov eax, dword ptr [ebp-28]
:00480DCA 64A300000000            mov dword ptr fs:[00000000], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480DC5(U)
|
:00480DD0 8B45CC                  mov eax, dword ptr [ebp-34]
:00480DD3 5F                      pop edi
:00480DD4 5E                      pop esi
:00480DD5 5B                      pop ebx
:00480DD6 8BE5                    mov esp, ebp
:00480DD8 5D                      pop ebp
:00480DD9 C3                      ret


:00480DDA CC                      int 03
:00480DDB CC                      int 03
:00480DDC CC                      int 03
:00480DDD CC                      int 03
:00480DDE CC                      int 03
:00480DDF CC                      int 03
:00480DE0 55                      push ebp
:00480DE1 8BEC                    mov ebp, esp
:00480DE3 53                      push ebx
:00480DE4 56                      push esi
:00480DE5 57                      push edi
:00480DE6 FC                      cld
:00480DE7 8B4508                  mov eax, dword ptr [ebp+08]
:00480DEA 8B4804                  mov ecx, dword ptr [eax+04]
:00480DED 83E166                  and ecx, 00000066
:00480DF0 85C9                    test ecx, ecx
:00480DF2 7411                    je 00480E05
:00480DF4 8B550C                  mov edx, dword ptr [ebp+0C]
:00480DF7 C7422401000000          mov [edx+24], 00000001
:00480DFE B801000000              mov eax, 00000001
:00480E03 EB57                    jmp 00480E5C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480DF2(C)
|
:00480E05 6A01                    push 00000001
:00480E07 8B450C                  mov eax, dword ptr [ebp+0C]
:00480E0A 8B4814                  mov ecx, dword ptr [eax+14]
:00480E0D 51                      push ecx
:00480E0E 8B550C                  mov edx, dword ptr [ebp+0C]
:00480E11 8B4210                  mov eax, dword ptr [edx+10]
:00480E14 50                      push eax
:00480E15 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00480E18 8B5108                  mov edx, dword ptr [ecx+08]
:00480E1B 52                      push edx
:00480E1C 6A00                    push 00000000
:00480E1E 8B4510                  mov eax, dword ptr [ebp+10]
:00480E21 50                      push eax
:00480E22 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00480E25 8B510C                  mov edx, dword ptr [ecx+0C]
:00480E28 52                      push edx
:00480E29 8B4508                  mov eax, dword ptr [ebp+08]
:00480E2C 50                      push eax
:00480E2D E8EE0E0000              call 00481D20
:00480E32 83C420                  add esp, 00000020
:00480E35 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:00480E38 83792400                cmp dword ptr [ecx+24], 00000000
:00480E3C 750D                    jne 00480E4B
:00480E3E 8B5508                  mov edx, dword ptr [ebp+08]
:00480E41 52                      push edx
:00480E42 8B450C                  mov eax, dword ptr [ebp+0C]
:00480E45 50                      push eax
:00480E46 E895FDFFFF              call 00480BE0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480E3C(C)
|
:00480E4B 8B5D0C                  mov ebx, dword ptr [ebp+0C]
:00480E4E 8B631C                  mov esp, dword ptr [ebx+1C]
:00480E51 8B6B20                  mov ebp, dword ptr [ebx+20]
:00480E54 FF6318                  jmp [ebx+18]
:00480E57 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480E03(U)
|
:00480E5C 5F                      pop edi
:00480E5D 5E                      pop esi
:00480E5E 5B                      pop ebx
:00480E5F 5D                      pop ebp
:00480E60 C3                      ret


:00480E61 CC                      int 03
:00480E62 CC                      int 03
:00480E63 CC                      int 03
:00480E64 CC                      int 03
:00480E65 CC                      int 03
:00480E66 CC                      int 03
:00480E67 CC                      int 03
:00480E68 CC                      int 03
:00480E69 CC                      int 03
:00480E6A CC                      int 03
:00480E6B CC                      int 03
:00480E6C CC                      int 03
:00480E6D CC                      int 03
:00480E6E CC                      int 03
:00480E6F CC                      int 03

* Referenced by a CALL at Addresses:
|:00481EC6   , :004820F1   
|
:00480E70 51                      push ecx
:00480E71 8B442408                mov eax, dword ptr [esp+08]
:00480E75 53                      push ebx
:00480E76 8B5C2410                mov ebx, dword ptr [esp+10]
:00480E7A 55                      push ebp
:00480E7B 8B4810                  mov ecx, dword ptr [eax+10]
:00480E7E 56                      push esi
:00480E7F 8B700C                  mov esi, dword ptr [eax+0C]
:00480E82 57                      push edi
:00480E83 85DB                    test ebx, ebx
:00480E85 894C2410                mov dword ptr [esp+10], ecx
:00480E89 8BEE                    mov ebp, esi
:00480E8B 8BFE                    mov edi, esi
:00480E8D 7C35                    jl 00480EC4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480EBE(C)
|
:00480E8F 83FEFF                  cmp esi, FFFFFFFF
:00480E92 7505                    jne 00480E99
:00480E94 E867190000              call 00482800

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480E92(C)
|
:00480E99 8B442410                mov eax, dword ptr [esp+10]
:00480E9D 4E                      dec esi
:00480E9E 8B4C2420                mov ecx, dword ptr [esp+20]
:00480EA2 8D14B6                  lea edx, dword ptr [esi+4*esi]
:00480EA5 8D0490                  lea eax, dword ptr [eax+4*edx]
:00480EA8 394804                  cmp dword ptr [eax+04], ecx
:00480EAB 7D05                    jge 00480EB2
:00480EAD 3B4808                  cmp ecx, dword ptr [eax+08]
:00480EB0 7E05                    jle 00480EB7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480EAB(C)
|
:00480EB2 83FEFF                  cmp esi, FFFFFFFF
:00480EB5 7505                    jne 00480EBC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480EB0(C)
|
:00480EB7 8BEF                    mov ebp, edi
:00480EB9 4B                      dec ebx
:00480EBA 8BFE                    mov edi, esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480EB5(C)
|
:00480EBC 85DB                    test ebx, ebx
:00480EBE 7DCF                    jge 00480E8F
:00480EC0 8B442418                mov eax, dword ptr [esp+18]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480E8D(C)
|
:00480EC4 8B4C2424                mov ecx, dword ptr [esp+24]
:00480EC8 8B542428                mov edx, dword ptr [esp+28]
:00480ECC 46                      inc esi
:00480ECD 8931                    mov dword ptr [ecx], esi
:00480ECF 892A                    mov dword ptr [edx], ebp
:00480ED1 3B680C                  cmp ebp, dword ptr [eax+0C]
:00480ED4 7704                    ja 00480EDA
:00480ED6 3BF5                    cmp esi, ebp
:00480ED8 7605                    jbe 00480EDF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480ED4(C)
|
:00480EDA E821190000              call 00482800

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480ED8(C)
|
:00480EDF 8B4C2410                mov ecx, dword ptr [esp+10]
:00480EE3 8D04B6                  lea eax, dword ptr [esi+4*esi]
:00480EE6 5F                      pop edi
:00480EE7 5E                      pop esi
:00480EE8 5D                      pop ebp
:00480EE9 8D0481                  lea eax, dword ptr [ecx+4*eax]
:00480EEC 5B                      pop ebx
:00480EED 59                      pop ecx
:00480EEE C3                      ret


:00480EEF 90                      nop

* Referenced by a CALL at Address:
|:00482C62   
|
:00480EF0 55                      push ebp
:00480EF1 8BEC                    mov ebp, esp
:00480EF3 53                      push ebx
:00480EF4 56                      push esi
:00480EF5 57                      push edi
:00480EF6 55                      push ebp
:00480EF7 6A00                    push 00000000
:00480EF9 6A00                    push 00000000

* Possible StringData Ref from Code Obj ->"]_^[]ËL$A"
                                  |
:00480EFB 68080F4800              push 00480F08
:00480F00 FF7508                  push [ebp+08]
:00480F03 E8C83F0000              call 00484ED0
:00480F08 5D                      pop ebp
:00480F09 5F                      pop edi
:00480F0A 5E                      pop esi
:00480F0B 5B                      pop ebx
:00480F0C 8BE5                    mov esp, ebp
:00480F0E 5D                      pop ebp
:00480F0F C3                      ret


:00480F10 8B4C2404                mov ecx, dword ptr [esp+04]

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:00480F14 F7410406000000          test [ecx+04], 00000006
:00480F1B B801000000              mov eax, 00000001
:00480F20 740F                    je 00480F31
:00480F22 8B442408                mov eax, dword ptr [esp+08]
:00480F26 8B542410                mov edx, dword ptr [esp+10]
:00480F2A 8902                    mov dword ptr [edx], eax
:00480F2C B803000000              mov eax, 00000003

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480F20(C)
|
:00480F31 C3                      ret

* Referenced by a CALL at Addresses:
|:004823A6   , :00482C6F   , :00482CAF   , :00482CD4   
|
:00480F32 53                      push ebx
:00480F33 56                      push esi
:00480F34 57                      push edi
:00480F35 8B442410                mov eax, dword ptr [esp+10]
:00480F39 50                      push eax
:00480F3A 6AFE                    push FFFFFFFE
:00480F3C 68100F4800              push 00480F10
:00480F41 64FF3500000000          push dword ptr fs:[00000000]
:00480F48 64892500000000          mov dword ptr fs:[00000000], esp

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480F8A(U)
|
:00480F4F 8B442420                mov eax, dword ptr [esp+20]
:00480F53 8B5808                  mov ebx, dword ptr [eax+08]
:00480F56 8B700C                  mov esi, dword ptr [eax+0C]
:00480F59 83FEFF                  cmp esi, FFFFFFFF
:00480F5C 742E                    je 00480F8C
:00480F5E 3B742424                cmp esi, dword ptr [esp+24]
:00480F62 7428                    je 00480F8C
:00480F64 8D3476                  lea esi, dword ptr [esi+2*esi]
:00480F67 8B0CB3                  mov ecx, dword ptr [ebx+4*esi]
:00480F6A 894C2408                mov dword ptr [esp+08], ecx
:00480F6E 89480C                  mov dword ptr [eax+0C], ecx
:00480F71 837CB30400              cmp dword ptr [ebx+4*esi+04], 00000000
:00480F76 7512                    jne 00480F8A
:00480F78 6801010000              push 00000101
:00480F7D 8B44B308                mov eax, dword ptr [ebx+4*esi+08]
:00480F81 E840000000              call 00480FC6
:00480F86 FF54B308                call [ebx+4*esi+08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480F76(C)
|
:00480F8A EBC3                    jmp 00480F4F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00480F5C(C), :00480F62(C)
|
:00480F8C 648F0500000000          pop dword ptr fs:[00000000]
:00480F93 83C40C                  add esp, 0000000C
:00480F96 5F                      pop edi
:00480F97 5E                      pop esi
:00480F98 5B                      pop ebx
:00480F99 C3                      ret



* Referenced by a CALL at Address:
|:00482404   
|
:00480F9A 33C0                    xor eax, eax
:00480F9C 648B0D00000000          mov ecx, dword ptr fs:[00000000]
:00480FA3 817904100F4800          cmp dword ptr [ecx+04], 00480F10
:00480FAA 7510                    jne 00480FBC
:00480FAC 8B510C                  mov edx, dword ptr [ecx+0C]
:00480FAF 8B520C                  mov edx, dword ptr [edx+0C]
:00480FB2 395108                  cmp dword ptr [ecx+08], edx
:00480FB5 7505                    jne 00480FBC
:00480FB7 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00480FAA(C), :00480FB5(C)
|
:00480FBC C3                      ret

* Referenced by a CALL at Addresses:
|:0048273E   , :00482760   
|
:00480FBD 53                      push ebx
:00480FBE 51                      push ecx

* Possible StringData Ref from Data Obj ->" "
                                  |
:00480FBF BB00F34800              mov ebx, 0048F300
:00480FC4 EB0A                    jmp 00480FD0

* Referenced by a CALL at Addresses:
|:00480F81   , :00482C80   
|
:00480FC6 53                      push ebx
:00480FC7 51                      push ecx

* Possible StringData Ref from Data Obj ->" "
                                  |
:00480FC8 BB00F34800              mov ebx, 0048F300
:00480FCD 8B4D08                  mov ecx, dword ptr [ebp+08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00480FC4(U)
|
:00480FD0 894B08                  mov dword ptr [ebx+08], ecx
:00480FD3 894304                  mov dword ptr [ebx+04], eax
:00480FD6 896B0C                  mov dword ptr [ebx+0C], ebp
:00480FD9 59                      pop ecx
:00480FDA 5B                      pop ebx
:00480FDB C20400                  ret 0004


:00480FDE CC                      int 03
:00480FDF CC                      int 03

* Referenced by a CALL at Addresses:
|:004013B0   , :0040274F   , :00402919   , :004029BC   , :004097C0   
|:00409A89   , :00409DB2   , :0040A3AF   , :0040A620   , :0040B3D7   
|:0040FEA0   , :0040FEF5   , :00417FF5   , :0041EABD   , :0045E18B   
|:0045E19B   , :0045E6E7   , :00462575   , :004625F2   , :00462833   
|:00462C15   , :00462E5E   , :00463D38   , :0046D12F   , :0046E693   
|
:00480FE0 8B442404                mov eax, dword ptr [esp+04]
:00480FE4 6A01                    push 00000001
:00480FE6 50                      push eax
:00480FE7 E8C4180000              call 004828B0
:00480FEC 83C408                  add esp, 00000008
:00480FEF C3                      ret



* Referenced by a CALL at Addresses:
|:004013A1   , :004013D1   , :0040273F   , :00402795   , :0040290A   
|:00402931   , :004029AD   , :004029D8   , :004097B0   , :004097D1   
|:00409A77   , :00409A9B   , :00409D96   , :00409DC1   , :0040A39B   
|:0040A3C1   , :0040A60D   , :0040A62F   , :0040B3C7   , :0040B3E6   
|:0040FE2A   , :0040FEBB   , :0040FF68   , :0040FF7D   , :00417FE6   
|:00418004   , :0041EAB0   , :0041EACC   , :0045E17B   , :0045E1AA   
|:0045E6D7   , :0045E72D   , :00462BFA   , :00462C24   , :00462E43   
|:00462E6D   , :004804F5   , :00480546   
|
:00480FF0 8B4C2404                mov ecx, dword ptr [esp+04]
:00480FF4 A148CC4B00              mov eax, dword ptr [004BCC48]
:00480FF9 890D48CC4B00            mov dword ptr [004BCC48], ecx
:00480FFF C3                      ret



* Referenced by a CALL at Addresses:
|:004828E3   , :00482B98   , :00484EB0   
|
:00481000 A148CC4B00              mov eax, dword ptr [004BCC48]
:00481005 85C0                    test eax, eax
:00481007 7414                    je 0048101D
:00481009 8B4C2404                mov ecx, dword ptr [esp+04]
:0048100D 51                      push ecx
:0048100E FFD0                    call eax
:00481010 83C404                  add esp, 00000004
:00481013 85C0                    test eax, eax
:00481015 7406                    je 0048101D
:00481017 B801000000              mov eax, 00000001
:0048101C C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00481007(C), :00481015(C)
|
:0048101D 33C0                    xor eax, eax
:0048101F C3                      ret



* Referenced by a CALL at Addresses:
|:00401485   , :0040330D   , :004034E1   , :004034FD   , :00409927   
|:0040993C   , :00409A6D   , :00409CC9   , :00409CDD   , :00409EA3   
|:0040A506   , :0040A75A   , :0040B507   , :0040FE6E   , :0040FE85   
|:0040FF45   , :0040FF5C   , :0040FFF4   , :00410292   , :00418072   
|:00418B9E   , :00418BB5   , :00418BCA   , :0041ECAE   , :0045E3D3   
|:0045E3EB   , :0045F69D   , :00462CE8   , :00462F31   , :00463CC7   
|:00463D1B   , :00465029   , :004727DD   , :0047280D   , :0047312D   
|:00484F17   , :004856EA   , :004857CC   , :004857D7   , :004857EC   
|:0048592C   , :00485973   
|
:00481020 8B442404                mov eax, dword ptr [esp+04]
:00481024 50                      push eax
:00481025 E816190000              call 00482940
:0048102A 83C404                  add esp, 00000004
:0048102D C3                      ret


:0048102E 90                      nop
:0048102F 90                      nop

* Referenced by a CALL at Addresses:
|:00402022   , :00403118   
|
:00481030 83EC20                  sub esp, 00000020
:00481033 8B442424                mov eax, dword ptr [esp+24]
:00481037 56                      push esi
:00481038 57                      push edi
:00481039 B908000000              mov ecx, 00000008
:0048103E BE58774800              mov esi, 00487758
:00481043 8D7C2408                lea edi, dword ptr [esp+08]
:00481047 F3                      repz
:00481048 A5                      movsd
:00481049 8B4C2430                mov ecx, dword ptr [esp+30]
:0048104D 89442420                mov dword ptr [esp+20], eax
:00481051 8B442418                mov eax, dword ptr [esp+18]
:00481055 8D54241C                lea edx, dword ptr [esp+1C]
:00481059 894C2424                mov dword ptr [esp+24], ecx
:0048105D 8B4C240C                mov ecx, dword ptr [esp+0C]
:00481061 52                      push edx
:00481062 8B54240C                mov edx, dword ptr [esp+0C]
:00481066 50                      push eax
:00481067 51                      push ecx
:00481068 52                      push edx
:00481069 FF15B8614800            call dword ptr [004861B8]
:0048106F 5F                      pop edi
:00481070 5E                      pop esi
:00481071 83C420                  add esp, 00000020
:00481074 C20800                  ret 0008


:00481077 90                      nop
:00481078 90                      nop
:00481079 90                      nop
:0048107A 90                      nop
:0048107B 90                      nop
:0048107C 90                      nop
:0048107D 90                      nop
:0048107E 90                      nop
:0048107F 90                      nop

* Referenced by a CALL at Address:
|:00481105   
|
:00481080 A190D84B00              mov eax, dword ptr [004BD890]
:00481085 56                      push esi
:00481086 50                      push eax
:00481087 E8341B0000              call 00482BC0
:0048108C 8B0D8CD84B00            mov ecx, dword ptr [004BD88C]
:00481092 8B1590D84B00            mov edx, dword ptr [004BD890]
:00481098 8BF1                    mov esi, ecx
:0048109A 83C404                  add esp, 00000004
:0048109D 2BF2                    sub esi, edx
:0048109F 83C604                  add esi, 00000004
:004810A2 3BC6                    cmp eax, esi
:004810A4 7341                    jnb 004810E7
:004810A6 52                      push edx
:004810A7 E8141B0000              call 00482BC0
:004810AC 8B0D90D84B00            mov ecx, dword ptr [004BD890]
:004810B2 83C404                  add esp, 00000004
:004810B5 83C010                  add eax, 00000010
:004810B8 50                      push eax
:004810B9 51                      push ecx
:004810BA E861190000              call 00482A20
:004810BF 83C408                  add esp, 00000008
:004810C2 85C0                    test eax, eax
:004810C4 7502                    jne 004810C8
:004810C6 5E                      pop esi
:004810C7 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004810C4(C)
|
:004810C8 8B158CD84B00            mov edx, dword ptr [004BD88C]
:004810CE 8B3590D84B00            mov esi, dword ptr [004BD890]
:004810D4 2BD6                    sub edx, esi
:004810D6 A390D84B00              mov dword ptr [004BD890], eax
:004810DB C1FA02                  sar edx, 02
:004810DE 8D0C90                  lea ecx, dword ptr [eax+4*edx]
:004810E1 890D8CD84B00            mov dword ptr [004BD88C], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004810A4(C)
|
:004810E7 8B442408                mov eax, dword ptr [esp+08]
:004810EB 5E                      pop esi
:004810EC 8901                    mov dword ptr [ecx], eax
:004810EE 8B0D8CD84B00            mov ecx, dword ptr [004BD88C]
:004810F4 83C104                  add ecx, 00000004
:004810F7 890D8CD84B00            mov dword ptr [004BD88C], ecx
:004810FD C3                      ret


:004810FE 90                      nop
:004810FF 90                      nop

* Referenced by a CALL at Addresses:
|:00403190   , :004031CF   , :0040B5A9   , :0040B5F5   , :0040B641   
|:0040B68D   , :0040B6D9   , :0040B725   , :004109D6   , :00419596   
|:0041EF66   , :0041EFA5   , :00425B96   , :004267B4   , :004267FC   
|:0042684C   , :0042B096   , :0042B0E6   , :0042B13F   , :0042B195   
|:0042B1EB   , :0042B241   , :0042B297   , :0042B2DF   , :0042B418   
|:0042B457   , :0042B496   , :00435A24   , :0043E4B4   , :00449AB6   
|:0044FA06   , :00453F18   , :00454038   , :004541DF   , :0045E681   
|:0045F876   , :0045F8B5   , :00464712   , :0046A1EA   , :004711AC   
|:004711E4   , :00474376   , :004743B5   , :0047590F   , :0047594E   
|:00476E7E   , :004785FC   , :00478FD3   , :0047C62E   
|
:00481100 8B442404                mov eax, dword ptr [esp+04]
:00481104 50                      push eax
:00481105 E876FFFFFF              call 00481080
:0048110A 83C404                  add esp, 00000004
:0048110D F7D8                    neg eax
:0048110F 1BC0                    sbb eax, eax
:00481111 F7D8                    neg eax
:00481113 48                      dec eax
:00481114 C3                      ret


:00481115 90                      nop
:00481116 90                      nop
:00481117 90                      nop
:00481118 90                      nop
:00481119 90                      nop
:0048111A 90                      nop
:0048111B 90                      nop
:0048111C 90                      nop
:0048111D 90                      nop
:0048111E 90                      nop
:0048111F 90                      nop
:00481120 6880000000              push 00000080
:00481125 E866170000              call 00482890
:0048112A 83C404                  add esp, 00000004
:0048112D A390D84B00              mov dword ptr [004BD890], eax
:00481132 85C0                    test eax, eax
:00481134 750F                    jne 00481145
:00481136 6A18                    push 00000018
:00481138 E843080000              call 00481980
:0048113D A190D84B00              mov eax, dword ptr [004BD890]
:00481142 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481134(C)
|
:00481145 C70000000000            mov dword ptr [eax], 00000000
:0048114B A190D84B00              mov eax, dword ptr [004BD890]
:00481150 A38CD84B00              mov dword ptr [004BD88C], eax
:00481155 C3                      ret


:00481156 90                      nop
:00481157 90                      nop
:00481158 90                      nop
:00481159 90                      nop
:0048115A 90                      nop
:0048115B 90                      nop
:0048115C 90                      nop
:0048115D 90                      nop
:0048115E 90                      nop
:0048115F 90                      nop

* Referenced by a CALL at Addresses:
|:004044F1   , :00451384   , :00465856   
|
:00481160 51                      push ecx
:00481161 3D00100000              cmp eax, 00001000
:00481166 8D4C2408                lea ecx, dword ptr [esp+08]
:0048116A 7214                    jb 00481180

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048117E(C)
|
:0048116C 81E900100000            sub ecx, 00001000
:00481172 2D00100000              sub eax, 00001000
:00481177 8501                    test dword ptr [ecx], eax
:00481179 3D00100000              cmp eax, 00001000
:0048117E 73EC                    jnb 0048116C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048116A(C)
|
:00481180 2BC8                    sub ecx, eax
:00481182 8BC4                    mov eax, esp
:00481184 8501                    test dword ptr [ecx], eax
:00481186 8BE1                    mov esp, ecx
:00481188 8B08                    mov ecx, dword ptr [eax]
:0048118A 8B4004                  mov eax, dword ptr [eax+04]
:0048118D 50                      push eax
:0048118E C3                      ret


:0048118F CC                      int 03

* Referenced by a CALL at Addresses:
|:004087F2   , :00408834   , :00408847   , :00418EA2   , :00418F1B   
|:00465558   , :00465572   , :0046558C   , :004665BF   , :004665DC   
|:004665F9   , :00466616   , :00466633   , :00466650   , :0046666D   
|:0046668A   , :004666A7   , :004666C1   , :004666DB   , :004666F5   
|:0046670F   , :004722FA   , :00479035   , :0047A48B   , :0047A4A8   
|:0047A4C5   , :0047A4E2   , :0047A4FF   , :0047A51C   , :0047A539   
|:0047A553   , :0047A56D   , :0047A588   , :0047A5A2   , :0047AD2B   
|
:00481190 57                      push edi
:00481191 8B7C2408                mov edi, dword ptr [esp+08]
:00481195 EB6A                    jmp 00481201
:00481197 2E8BC0                  mov eax, eax
:0048119A 2E8BC0                  mov eax, eax
:0048119D 2E8BC0                  mov eax, eax

* Referenced by a CALL at Addresses:
|:00418EB4   , :00418EC5   , :00478A6B   , :00478AB0   , :00478AF5   
|:00478B3A   , :00478B83   , :00478B97   , :00478BE2   , :00478BF6   
|:00478C3F   , :00478C53   , :00478C9E   , :00478CB2   , :00478CFB   
|:00478D0F   , :00478D5A   , :00478D6E   , :00478DB7   , :00478DCB   
|:00478E16   , :00478E2A   , :00478E73   , :00478E87   , :00478ED2   
|:00478EE6   , :00478F19   , :00478F5E   
|
:004811A0 8B4C2404                mov ecx, dword ptr [esp+04]
:004811A4 57                      push edi
:004811A5 F7C103000000            test ecx, 00000003
:004811AB 740F                    je 004811BC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004811BA(C)
|
:004811AD 8A01                    mov al, byte ptr [ecx]
:004811AF 41                      inc ecx
:004811B0 84C0                    test al, al
:004811B2 743B                    je 004811EF
:004811B4 F7C103000000            test ecx, 00000003
:004811BA 75F1                    jne 004811AD

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004811AB(C), :004811D2(C), :004811ED(U)
|
:004811BC 8B01                    mov eax, dword ptr [ecx]
:004811BE BAFFFEFE7E              mov edx, 7EFEFEFF
:004811C3 03D0                    add edx, eax
:004811C5 83F0FF                  xor eax, FFFFFFFF
:004811C8 33C2                    xor eax, edx
:004811CA 83C104                  add ecx, 00000004
:004811CD A900010181              test eax, 81010100
:004811D2 74E8                    je 004811BC
:004811D4 8B41FC                  mov eax, dword ptr [ecx-04]
:004811D7 84C0                    test al, al
:004811D9 7423                    je 004811FE
:004811DB 84E4                    test ah, ah
:004811DD 741A                    je 004811F9
:004811DF A90000FF00              test eax, 00FF0000
:004811E4 740E                    je 004811F4
:004811E6 A9000000FF              test eax, FF000000
:004811EB 7402                    je 004811EF
:004811ED EBCD                    jmp 004811BC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004811B2(C), :004811EB(C)
|
:004811EF 8D79FF                  lea edi, dword ptr [ecx-01]
:004811F2 EB0D                    jmp 00481201

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004811E4(C)
|
:004811F4 8D79FE                  lea edi, dword ptr [ecx-02]
:004811F7 EB08                    jmp 00481201

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004811DD(C)
|
:004811F9 8D79FD                  lea edi, dword ptr [ecx-03]
:004811FC EB03                    jmp 00481201

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004811D9(C)
|
:004811FE 8D79FC                  lea edi, dword ptr [ecx-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00481195(U), :004811F2(U), :004811F7(U), :004811FC(U)
|
:00481201 8B4C240C                mov ecx, dword ptr [esp+0C]
:00481205 F7C103000000            test ecx, 00000003
:0048120B 7419                    je 00481226

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048121D(C)
|
:0048120D 8A11                    mov dl, byte ptr [ecx]
:0048120F 41                      inc ecx
:00481210 84D2                    test dl, dl
:00481212 7464                    je 00481278
:00481214 8817                    mov byte ptr [edi], dl
:00481216 47                      inc edi
:00481217 F7C103000000            test ecx, 00000003
:0048121D 75EE                    jne 0048120D
:0048121F EB05                    jmp 00481226

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0048123E(C), :00481258(U)
|
:00481221 8917                    mov dword ptr [edi], edx
:00481223 83C704                  add edi, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0048120B(C), :0048121F(U)
|
:00481226 BAFFFEFE7E              mov edx, 7EFEFEFF
:0048122B 8B01                    mov eax, dword ptr [ecx]
:0048122D 03D0                    add edx, eax
:0048122F 83F0FF                  xor eax, FFFFFFFF
:00481232 33C2                    xor eax, edx
:00481234 8B11                    mov edx, dword ptr [ecx]
:00481236 83C104                  add ecx, 00000004
:00481239 A900010181              test eax, 81010100
:0048123E 74E1                    je 00481221
:00481240 84D2                    test dl, dl
:00481242 7434                    je 00481278
:00481244 84F6                    test dh, dh
:00481246 7427                    je 0048126F
:00481248 F7C20000FF00            test edx, 00FF0000
:0048124E 7412                    je 00481262
:00481250 F7C2000000FF            test edx, FF000000
:00481256 7402                    je 0048125A
:00481258 EBC7                    jmp 00481221

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481256(C)
|
:0048125A 8917                    mov dword ptr [edi], edx
:0048125C 8B442408                mov eax, dword ptr [esp+08]
:00481260 5F                      pop edi
:00481261 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048124E(C)
|
:00481262 668917                  mov word ptr [edi], dx
:00481265 8B442408                mov eax, dword ptr [esp+08]
:00481269 C6470200                mov [edi+02], 00
:0048126D 5F                      pop edi
:0048126E C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481246(C)
|
:0048126F 668917                  mov word ptr [edi], dx
:00481272 8B442408                mov eax, dword ptr [esp+08]
:00481276 5F                      pop edi
:00481277 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00481212(C), :00481242(C)
|
:00481278 8817                    mov byte ptr [edi], dl
:0048127A 8B442408                mov eax, dword ptr [esp+08]
:0048127E 5F                      pop edi
:0048127F C3                      ret



* Referenced by a CALL at Address:
|:004102B5   
|
:00481280 8B44240C                mov eax, dword ptr [esp+0C]
:00481284 85C0                    test eax, eax
:00481286 7444                    je 004812CC
:00481288 8B542404                mov edx, dword ptr [esp+04]
:0048128C 56                      push esi
:0048128D 57                      push edi
:0048128E 8BF2                    mov esi, edx
:00481290 8B7C2410                mov edi, dword ptr [esp+10]
:00481294 0BD7                    or edx, edi
:00481296 83E203                  and edx, 00000003
:00481299 7432                    je 004812CD
:0048129B A901000000              test eax, 00000001
:004812A0 740B                    je 004812AD
:004812A2 8A0E                    mov cl, byte ptr [esi]
:004812A4 3A0F                    cmp cl, byte ptr [edi]
:004812A6 7552                    jne 004812FA
:004812A8 46                      inc esi
:004812A9 47                      inc edi
:004812AA 48                      dec eax
:004812AB 741D                    je 004812CA

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004812A0(C), :004812C8(C)
|
:004812AD 8A0E                    mov cl, byte ptr [esi]
:004812AF 8A17                    mov dl, byte ptr [edi]
:004812B1 38D1                    cmp cl, dl
:004812B3 7545                    jne 004812FA
:004812B5 8A4E01                  mov cl, byte ptr [esi+01]
:004812B8 8A5701                  mov dl, byte ptr [edi+01]
:004812BB 38D1                    cmp cl, dl
:004812BD 753B                    jne 004812FA
:004812BF 83C702                  add edi, 00000002
:004812C2 83C602                  add esi, 00000002
:004812C5 83E802                  sub eax, 00000002
:004812C8 75E3                    jne 004812AD

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004812AB(C), :00481304(C)
|
:004812CA 5F                      pop edi
:004812CB 5E                      pop esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481286(C)
|
:004812CC C3                      ret

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481299(C)
|
:004812CD 8BC8                    mov ecx, eax
:004812CF 83E003                  and eax, 00000003
:004812D2 C1E902                  shr ecx, 02
:004812D5 742B                    je 00481302
:004812D7 F3                      repz
:004812D8 A7                      cmpsd
:004812D9 7427                    je 00481302
:004812DB 8B4EFC                  mov ecx, dword ptr [esi-04]
:004812DE 8B57FC                  mov edx, dword ptr [edi-04]
:004812E1 38D1                    cmp cl, dl
:004812E3 7510                    jne 004812F5
:004812E5 38F5                    cmp ch, dh
:004812E7 750C                    jne 004812F5
:004812E9 C1E910                  shr ecx, 10
:004812EC C1EA10                  shr edx, 10
:004812EF 38D1                    cmp cl, dl
:004812F1 7502                    jne 004812F5
:004812F3 38F5                    cmp ch, dh

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004812E3(C), :004812E7(C), :004812F1(C), :0048130C(C), :00481313(C)
|:00481326(C)
|
:004812F5 B800000000              mov eax, 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004812A6(C), :004812B3(C), :004812BD(C)
|
:004812FA 1BC0                    sbb eax, eax
:004812FC 5F                      pop edi
:004812FD 83D8FF                  sbb eax, FFFFFFFF
:00481300 5E                      pop esi
:00481301 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004812D5(C), :004812D9(C)
|
:00481302 85C0                    test eax, eax
:00481304 74C4                    je 004812CA
:00481306 8B16                    mov edx, dword ptr [esi]
:00481308 8B0F                    mov ecx, dword ptr [edi]
:0048130A 38CA                    cmp dl, cl
:0048130C 75E7                    jne 004812F5
:0048130E 48                      dec eax
:0048130F 7418                    je 00481329
:00481311 38EE                    cmp dh, ch
:00481313 75E0                    jne 004812F5
:00481315 48                      dec eax
:00481316 7411                    je 00481329
:00481318 81E10000FF00            and ecx, 00FF0000
:0048131E 81E20000FF00            and edx, 00FF0000
:00481324 3BD1                    cmp edx, ecx
:00481326 75CD                    jne 004812F5
:00481328 48                      dec eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0048130F(C), :00481316(C)
|
:00481329 5F                      pop edi
:0048132A 5E                      pop esi
:0048132B C3                      ret


:0048132C CC                      int 03
:0048132D CC                      int 03
:0048132E CC                      int 03
:0048132F CC                      int 03

* Referenced by a CALL at Address:
|:0041950B   
|
:00481330 8B542404                mov edx, dword ptr [esp+04]
:00481334 8B4C2408                mov ecx, dword ptr [esp+08]
:00481338 F7C203000000            test edx, 00000003
:0048133E 753C                    jne 0048137C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0048136C(C), :00481396(C), :004813B2(U)
|
:00481340 8B02                    mov eax, dword ptr [edx]
:00481342 3A01                    cmp al, byte ptr [ecx]
:00481344 752E                    jne 00481374
:00481346 0AC0                    or al, al
:00481348 7426                    je 00481370
:0048134A 3A6101                  cmp ah, byte ptr [ecx+01]
:0048134D 7525                    jne 00481374
:0048134F 0AE4                    or ah, ah
:00481351 741D                    je 00481370
:00481353 C1E810                  shr eax, 10
:00481356 3A4102                  cmp al, byte ptr [ecx+02]
:00481359 7519                    jne 00481374
:0048135B 0AC0                    or al, al
:0048135D 7411                    je 00481370
:0048135F 3A6103                  cmp ah, byte ptr [ecx+03]
:00481362 7510                    jne 00481374
:00481364 83C104                  add ecx, 00000004
:00481367 83C204                  add edx, 00000004
:0048136A 0AE4                    or ah, ah
:0048136C 75D2                    jne 00481340
:0048136E 8BC0                    mov eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00481348(C), :00481351(C), :0048135D(C), :0048138E(C), :004813A4(C)
|:004813AD(C)
|
:00481370 33C0                    xor eax, eax
:00481372 C3                      ret


:00481373 90                      nop

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00481344(C), :0048134D(C), :00481359(C), :00481362(C), :00481389(C)
|:004813A0(C), :004813A9(C)
|
:00481374 1BC0                    sbb eax, eax
:00481376 D1E0                    shl eax, 1
:00481378 40                      inc eax
:00481379 C3                      ret


:0048137A 8BC0                    mov eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048133E(C)
|
:0048137C F7C201000000            test edx, 00000001
:00481382 7414                    je 00481398
:00481384 8A02                    mov al, byte ptr [edx]
:00481386 42                      inc edx
:00481387 3A01                    cmp al, byte ptr [ecx]
:00481389 75E9                    jne 00481374
:0048138B 41                      inc ecx
:0048138C 0AC0                    or al, al
:0048138E 74E0                    je 00481370
:00481390 F7C202000000            test edx, 00000002
:00481396 74A8                    je 00481340

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481382(C)
|
:00481398 668B02                  mov ax, word ptr [edx]
:0048139B 83C202                  add edx, 00000002
:0048139E 3A01                    cmp al, byte ptr [ecx]
:004813A0 75D2                    jne 00481374
:004813A2 0AC0                    or al, al
:004813A4 74CA                    je 00481370
:004813A6 3A6101                  cmp ah, byte ptr [ecx+01]
:004813A9 75C9                    jne 00481374
:004813AB 0AE4                    or ah, ah
:004813AD 74C1                    je 00481370
:004813AF 83C102                  add ecx, 00000002
:004813B2 EB8C                    jmp 00481340
:004813B4 CC                      int 03
:004813B5 CC                      int 03
:004813B6 CC                      int 03
:004813B7 CC                      int 03
:004813B8 CC                      int 03
:004813B9 CC                      int 03
:004813BA CC                      int 03
:004813BB CC                      int 03
:004813BC CC                      int 03
:004813BD CC                      int 03
:004813BE CC                      int 03
:004813BF CC                      int 03

* Referenced by a CALL at Addresses:
|:0041E9C6   , :0045E487   , :0045E4A1   , :0045E4B8   , :0045E4D2   
|:0046A499   , :0046A4FB   
|
:004813C0 8B4C2404                mov ecx, dword ptr [esp+04]
:004813C4 F7C103000000            test ecx, 00000003
:004813CA 7414                    je 004813E0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004813D9(C)
|
:004813CC 8A01                    mov al, byte ptr [ecx]
:004813CE 41                      inc ecx
:004813CF 84C0                    test al, al
:004813D1 7440                    je 00481413
:004813D3 F7C103000000            test ecx, 00000003
:004813D9 75F1                    jne 004813CC
:004813DB 0500000000              add eax, 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004813CA(C), :004813F6(C), :00481411(U)
|
:004813E0 8B01                    mov eax, dword ptr [ecx]
:004813E2 BAFFFEFE7E              mov edx, 7EFEFEFF
:004813E7 03D0                    add edx, eax
:004813E9 83F0FF                  xor eax, FFFFFFFF
:004813EC 33C2                    xor eax, edx
:004813EE 83C104                  add ecx, 00000004
:004813F1 A900010181              test eax, 81010100
:004813F6 74E8                    je 004813E0
:004813F8 8B41FC                  mov eax, dword ptr [ecx-04]
:004813FB 84C0                    test al, al
:004813FD 7432                    je 00481431
:004813FF 84E4                    test ah, ah
:00481401 7424                    je 00481427
:00481403 A90000FF00              test eax, 00FF0000
:00481408 7413                    je 0048141D
:0048140A A9000000FF              test eax, FF000000
:0048140F 7402                    je 00481413
:00481411 EBCD                    jmp 004813E0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004813D1(C), :0048140F(C)
|
:00481413 8D41FF                  lea eax, dword ptr [ecx-01]
:00481416 8B4C2404                mov ecx, dword ptr [esp+04]
:0048141A 2BC1                    sub eax, ecx
:0048141C C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481408(C)
|
:0048141D 8D41FE                  lea eax, dword ptr [ecx-02]
:00481420 8B4C2404                mov ecx, dword ptr [esp+04]
:00481424 2BC1                    sub eax, ecx
:00481426 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481401(C)
|
:00481427 8D41FD                  lea eax, dword ptr [ecx-03]
:0048142A 8B4C2404                mov ecx, dword ptr [esp+04]
:0048142E 2BC1                    sub eax, ecx
:00481430 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004813FD(C)
|
:00481431 8D41FC                  lea eax, dword ptr [ecx-04]
:00481434 8B4C2404                mov ecx, dword ptr [esp+04]
:00481438 2BC1                    sub eax, ecx
:0048143A C3                      ret


:0048143B CC                      int 03
:0048143C CC                      int 03
:0048143D CC                      int 03
:0048143E CC                      int 03
:0048143F CC                      int 03

* Referenced by a CALL at Addresses:
|:004267A5   , :0042683D   , :0042B0D7   , :0042B130   , :0042B186   
|:0042B1DC   , :0042B232   , :0042B288   , :0042F8AF   , :0043E4A5   
|:00472F84   , :004757D4   
|
:00481440 55                      push ebp
:00481441 8BEC                    mov ebp, esp
:00481443 6AFF                    push FFFFFFFF
:00481445 6878774800              push 00487778
:0048144A 68082C4800              push 00482C08
:0048144F 64A100000000            mov eax, dword ptr fs:[00000000]
:00481455 50                      push eax
:00481456 64892500000000          mov dword ptr fs:[00000000], esp
:0048145D 83C4F0                  add esp, FFFFFFF0
:00481460 53                      push ebx
:00481461 56                      push esi
:00481462 57                      push edi
:00481463 33F6                    xor esi, esi
:00481465 8975E0                  mov dword ptr [ebp-20], esi
:00481468 8975FC                  mov dword ptr [ebp-04], esi
:0048146B 8975E4                  mov dword ptr [ebp-1C], esi
:0048146E 8B5D0C                  mov ebx, dword ptr [ebp+0C]
:00481471 8B7D08                  mov edi, dword ptr [ebp+08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481487(U)
|
:00481474 3B7510                  cmp esi, dword ptr [ebp+10]
:00481477 7D10                    jge 00481489
:00481479 8BCF                    mov ecx, edi
:0048147B FF5514                  call [ebp+14]
:0048147E 03FB                    add edi, ebx
:00481480 897D08                  mov dword ptr [ebp+08], edi
:00481483 46                      inc esi
:00481484 8975E4                  mov dword ptr [ebp-1C], esi
:00481487 EBEB                    jmp 00481474

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481477(C)
|
:00481489 C745E001000000          mov [ebp-20], 00000001
:00481490 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00481497 E81C000000              call 004814B8
:0048149C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0048149F 64890D00000000          mov dword ptr fs:[00000000], ecx
:004814A6 5F                      pop edi
:004814A7 5E                      pop esi
:004814A8 5B                      pop ebx
:004814A9 8BE5                    mov esp, ebp
:004814AB 5D                      pop ebp
:004814AC C21400                  ret 0014


:004814AF 8B5D0C                  mov ebx, dword ptr [ebp+0C]
:004814B2 8B7D08                  mov edi, dword ptr [ebp+08]
:004814B5 8B75E4                  mov esi, dword ptr [ebp-1C]

* Referenced by a CALL at Address:
|:00481497   
|
:004814B8 8B45E0                  mov eax, dword ptr [ebp-20]
:004814BB 85C0                    test eax, eax
:004814BD 750C                    jne 004814CB
:004814BF 8B4518                  mov eax, dword ptr [ebp+18]
:004814C2 50                      push eax
:004814C3 56                      push esi
:004814C4 53                      push ebx
:004814C5 57                      push edi
:004814C6 E8C5000000              call 00481590

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004814BD(C)
|
:004814CB C3                      ret
:004814CC 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004814CF 64890D00000000          mov dword ptr fs:[00000000], ecx
:004814D6 5F                      pop edi
:004814D7 5E                      pop esi
:004814D8 5B                      pop ebx
:004814D9 8BE5                    mov esp, ebp
:004814DB 5D                      pop ebp
:004814DC C21400                  ret 0014


:004814DF 90                      nop

* Referenced by a CALL at Addresses:
|:004267CF   , :0042686A   , :0042B104   , :0042B15A   , :0042B1B0   
|:0042B206   , :0042B25C   , :0042B2B2   , :0042FA37   , :0043E4CF   
|:004649A8   , :0046A6A7   , :004726B9   , :00475807   
|
:004814E0 55                      push ebp
:004814E1 8BEC                    mov ebp, esp
:004814E3 6AFF                    push FFFFFFFF
:004814E5 6888774800              push 00487788
:004814EA 68082C4800              push 00482C08
:004814EF 64A100000000            mov eax, dword ptr fs:[00000000]
:004814F5 50                      push eax
:004814F6 64892500000000          mov dword ptr fs:[00000000], esp
:004814FD 83C4F4                  add esp, FFFFFFF4
:00481500 53                      push ebx
:00481501 56                      push esi
:00481502 57                      push edi
:00481503 33C0                    xor eax, eax
:00481505 8945E4                  mov dword ptr [ebp-1C], eax
:00481508 8B4D10                  mov ecx, dword ptr [ebp+10]
:0048150B 8B7D0C                  mov edi, dword ptr [ebp+0C]
:0048150E 0FAFCF                  imul ecx, edi
:00481511 8B7508                  mov esi, dword ptr [ebp+08]
:00481514 03F1                    add esi, ecx
:00481516 897508                  mov dword ptr [ebp+08], esi
:00481519 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048152B(U)
|
:0048151C FF4D10                  dec [ebp+10]
:0048151F 780C                    js 0048152D
:00481521 2BF7                    sub esi, edi
:00481523 897508                  mov dword ptr [ebp+08], esi
:00481526 8BCE                    mov ecx, esi
:00481528 FF5514                  call [ebp+14]
:0048152B EBEF                    jmp 0048151C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048151F(C)
|
:0048152D C745E401000000          mov [ebp-1C], 00000001
:00481534 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:0048153B E819000000              call 00481559
:00481540 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00481543 64890D00000000          mov dword ptr fs:[00000000], ecx
:0048154A 5F                      pop edi
:0048154B 5E                      pop esi
:0048154C 5B                      pop ebx
:0048154D 8BE5                    mov esp, ebp
:0048154F 5D                      pop ebp
:00481550 C21000                  ret 0010


:00481553 8B7D0C                  mov edi, dword ptr [ebp+0C]
:00481556 8B7508                  mov esi, dword ptr [ebp+08]

* Referenced by a CALL at Address:
|:0048153B   
|
:00481559 8B45E4                  mov eax, dword ptr [ebp-1C]
:0048155C 85C0                    test eax, eax
:0048155E 750F                    jne 0048156F
:00481560 8B5514                  mov edx, dword ptr [ebp+14]
:00481563 52                      push edx
:00481564 8B4510                  mov eax, dword ptr [ebp+10]
:00481567 50                      push eax
:00481568 57                      push edi
:00481569 56                      push esi
:0048156A E821000000              call 00481590

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048155E(C)
|
:0048156F C3                      ret
:00481570 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00481573 64890D00000000          mov dword ptr fs:[00000000], ecx
:0048157A 5F                      pop edi
:0048157B 5E                      pop esi
:0048157C 5B                      pop ebx
:0048157D 8BE5                    mov esp, ebp
:0048157F 5D                      pop ebp
:00481580 C21000                  ret 0010


:00481583 90                      nop
:00481584 90                      nop
:00481585 90                      nop
:00481586 90                      nop
:00481587 90                      nop
:00481588 90                      nop
:00481589 90                      nop
:0048158A 90                      nop
:0048158B 90                      nop
:0048158C 90                      nop
:0048158D 90                      nop
:0048158E 90                      nop
:0048158F 90                      nop

* Referenced by a CALL at Addresses:
|:004814C6   , :0048156A   
|
:00481590 55                      push ebp
:00481591 8BEC                    mov ebp, esp
:00481593 6AFF                    push FFFFFFFF
:00481595 6898774800              push 00487798
:0048159A 68082C4800              push 00482C08
:0048159F 64A100000000            mov eax, dword ptr fs:[00000000]
:004815A5 50                      push eax
:004815A6 64892500000000          mov dword ptr fs:[00000000], esp
:004815AD 83EC08                  sub esp, 00000008
:004815B0 53                      push ebx
:004815B1 56                      push esi
:004815B2 57                      push edi
:004815B3 8965E8                  mov dword ptr [ebp-18], esp
:004815B6 C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004815CE(U)
|
:004815BD FF4D10                  dec [ebp+10]
:004815C0 781E                    js 004815E0
:004815C2 8B4D08                  mov ecx, dword ptr [ebp+08]
:004815C5 2B4D0C                  sub ecx, dword ptr [ebp+0C]
:004815C8 894D08                  mov dword ptr [ebp+08], ecx
:004815CB FF5514                  call [ebp+14]
:004815CE EBED                    jmp 004815BD
:004815D0 8B45EC                  mov eax, dword ptr [ebp-14]
:004815D3 50                      push eax
:004815D4 E8570C0000              call 00482230
:004815D9 83C404                  add esp, 00000004
:004815DC C3                      ret


:004815DD 8B65E8                  mov esp, dword ptr [ebp-18]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004815C0(C)
|
:004815E0 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:004815E7 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004815EA 64890D00000000          mov dword ptr fs:[00000000], ecx
:004815F1 5F                      pop edi
:004815F2 5E                      pop esi
:004815F3 5B                      pop ebx
:004815F4 8BE5                    mov esp, ebp
:004815F6 5D                      pop ebp
:004815F7 C21000                  ret 0010


:004815FA 90                      nop
:004815FB 90                      nop
:004815FC 90                      nop
:004815FD 90                      nop
:004815FE 90                      nop
:004815FF 90                      nop

* Referenced by a CALL at Address:
|:00481891   
|
:00481600 A194D84B00              mov eax, dword ptr [004BD894]
:00481605 85C0                    test eax, eax
:00481607 7402                    je 0048160B
:00481609 FFD0                    call eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481607(C)
|
:0048160B 682CB14800              push 0048B12C
:00481610 6820B14800              push 0048B120
:00481615 E806010000              call 00481720
:0048161A 83C408                  add esp, 00000008
:0048161D 681CB14800              push 0048B11C
:00481622 6800B04800              push 0048B000
:00481627 E8F4000000              call 00481720
:0048162C 83C408                  add esp, 00000008
:0048162F C3                      ret



* Referenced by a CALL at Addresses:
|:0042B6A8   , :0048187F   , :00481923   
|
:00481630 8B442404                mov eax, dword ptr [esp+04]
:00481634 6A00                    push 00000000
:00481636 6A00                    push 00000000
:00481638 50                      push eax
:00481639 E832000000              call 00481670
:0048163E 83C40C                  add esp, 0000000C
:00481641 C3                      ret


:00481642 90                      nop
:00481643 90                      nop
:00481644 90                      nop
:00481645 90                      nop
:00481646 90                      nop
:00481647 90                      nop
:00481648 90                      nop
:00481649 90                      nop
:0048164A 90                      nop
:0048164B 90                      nop
:0048164C 90                      nop
:0048164D 90                      nop
:0048164E 90                      nop
:0048164F 90                      nop

* Referenced by a CALL at Addresses:
|:00481946   , :00483E96   , :00484CD9   
|
:00481650 8B442404                mov eax, dword ptr [esp+04]
:00481654 6A00                    push 00000000
:00481656 6A01                    push 00000001
:00481658 50                      push eax
:00481659 E812000000              call 00481670
:0048165E 83C40C                  add esp, 0000000C
:00481661 C3                      ret


:00481662 90                      nop
:00481663 90                      nop
:00481664 90                      nop
:00481665 90                      nop
:00481666 90                      nop
:00481667 90                      nop
:00481668 90                      nop
:00481669 90                      nop
:0048166A 90                      nop
:0048166B 90                      nop
:0048166C 90                      nop
:0048166D 90                      nop
:0048166E 90                      nop
:0048166F 90                      nop

* Referenced by a CALL at Addresses:
|:00481639   , :00481659   
|
:00481670 A194CC4B00              mov eax, dword ptr [004BCC94]
:00481675 53                      push ebx
:00481676 55                      push ebp
:00481677 8B6C240C                mov ebp, dword ptr [esp+0C]
:0048167B 83F801                  cmp eax, 00000001
:0048167E 56                      push esi
:0048167F 750E                    jne 0048168F
:00481681 55                      push ebp
:00481682 FF15B0614800            call dword ptr [004861B0]
:00481688 50                      push eax
:00481689 FF15B4614800            call dword ptr [004861B4]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048167F(C)
|
:0048168F 8B442414                mov eax, dword ptr [esp+14]
:00481693 8B5C2418                mov ebx, dword ptr [esp+18]
:00481697 85C0                    test eax, eax
:00481699 C70590CC4B0001000000    mov dword ptr [004BCC90], 00000001
:004816A3 881D8CCC4B00            mov byte ptr [004BCC8C], bl
:004816A9 753E                    jne 004816E9
:004816AB 8B0D90D84B00            mov ecx, dword ptr [004BD890]
:004816B1 85C9                    test ecx, ecx
:004816B3 7422                    je 004816D7
:004816B5 8B358CD84B00            mov esi, dword ptr [004BD88C]
:004816BB 83EE04                  sub esi, 00000004
:004816BE 3BF1                    cmp esi, ecx
:004816C0 7215                    jb 004816D7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004816D5(C)
|
:004816C2 8B06                    mov eax, dword ptr [esi]
:004816C4 85C0                    test eax, eax
:004816C6 7408                    je 004816D0
:004816C8 FFD0                    call eax
:004816CA 8B0D90D84B00            mov ecx, dword ptr [004BD890]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004816C6(C)
|
:004816D0 83EE04                  sub esi, 00000004
:004816D3 3BF1                    cmp esi, ecx
:004816D5 73EB                    jnb 004816C2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004816B3(C), :004816C0(C)
|
:004816D7 6834B14800              push 0048B134
:004816DC 6830B14800              push 0048B130
:004816E1 E83A000000              call 00481720
:004816E6 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004816A9(C)
|
:004816E9 6840B14800              push 0048B140
:004816EE 6838B14800              push 0048B138
:004816F3 E828000000              call 00481720
:004816F8 83C408                  add esp, 00000008
:004816FB 85DB                    test ebx, ebx
:004816FD 7511                    jne 00481710
:004816FF 55                      push ebp
:00481700 C70594CC4B0001000000    mov dword ptr [004BCC94], 00000001
:0048170A FF15C0614800            call dword ptr [004861C0]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004816FD(C)
|
:00481710 5E                      pop esi
:00481711 5D                      pop ebp
:00481712 5B                      pop ebx
:00481713 C3                      ret


:00481714 90                      nop
:00481715 90                      nop
:00481716 90                      nop
:00481717 90                      nop
:00481718 90                      nop
:00481719 90                      nop
:0048171A 90                      nop
:0048171B 90                      nop
:0048171C 90                      nop
:0048171D 90                      nop
:0048171E 90                      nop
:0048171F 90                      nop

* Referenced by a CALL at Addresses:
|:00481615   , :00481627   , :004816E1   , :004816F3   
|
:00481720 56                      push esi
:00481721 8B742408                mov esi, dword ptr [esp+08]
:00481725 57                      push edi
:00481726 8B7C2410                mov edi, dword ptr [esp+10]
:0048172A 3BF7                    cmp esi, edi
:0048172C 730F                    jnb 0048173D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048173B(C)
|
:0048172E 8B06                    mov eax, dword ptr [esi]
:00481730 85C0                    test eax, eax
:00481732 7402                    je 00481736
:00481734 FFD0                    call eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481732(C)
|
:00481736 83C604                  add esi, 00000004
:00481739 3BF7                    cmp esi, edi
:0048173B 72F1                    jb 0048172E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048172C(C)
|
:0048173D 5F                      pop edi
:0048173E 5E                      pop esi
:0048173F C3                      ret


:00481740 6A19                    push 00000019
:00481742 E839020000              call 00481980
:00481747 83C404                  add esp, 00000004
:0048174A C3                      ret


:0048174B 90                      nop
:0048174C 90                      nop
:0048174D 90                      nop
:0048174E 90                      nop
:0048174F 90                      nop

* Referenced by a CALL at Addresses:
|:0046F73B   , :004715E8   , :00471624   
|
:00481750 55                      push ebp
:00481751 8BEC                    mov ebp, esp
:00481753 57                      push edi
:00481754 56                      push esi
:00481755 53                      push ebx
:00481756 8B750C                  mov esi, dword ptr [ebp+0C]
:00481759 8B7D08                  mov edi, dword ptr [ebp+08]
:0048175C 8D05B8CC4B00            lea eax, dword ptr [004BCCB8]
:00481762 83780800                cmp dword ptr [eax+08], 00000000
:00481766 753B                    jne 004817A3
:00481768 B0FF                    mov al, FF
:0048176A 8BC0                    mov eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00481778(C), :00481798(C)
|
:0048176C 0AC0                    or al, al
:0048176E 742E                    je 0048179E
:00481770 8A06                    mov al, byte ptr [esi]
:00481772 46                      inc esi
:00481773 8A27                    mov ah, byte ptr [edi]
:00481775 47                      inc edi
:00481776 38C4                    cmp ah, al
:00481778 74F2                    je 0048176C
:0048177A 2C41                    sub al, 41
:0048177C 3C1A                    cmp al, 1A
:0048177E 1AC9                    sbb cl, cl
:00481780 80E120                  and cl, 20
:00481783 02C1                    add al, cl
:00481785 0441                    add al, 41
:00481787 86E0                    xchg al, ah
:00481789 2C41                    sub al, 41
:0048178B 3C1A                    cmp al, 1A
:0048178D 1AC9                    sbb cl, cl
:0048178F 80E120                  and cl, 20
:00481792 02C1                    add al, cl
:00481794 0441                    add al, 41
:00481796 38E0                    cmp al, ah
:00481798 74D2                    je 0048176C
:0048179A 1AC0                    sbb al, al
:0048179C 1CFF                    sbb al, FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048176E(C)
|
:0048179E 0FBEC0                  movsx eax, al
:004817A1 EB34                    jmp 004817D7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481766(C)
|
:004817A3 B8FF000000              mov eax, 000000FF
:004817A8 33DB                    xor ebx, ebx
:004817AA 8BC0                    mov eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004817B8(C), :004817D0(C)
|
:004817AC 0AC0                    or al, al
:004817AE 7427                    je 004817D7
:004817B0 8A06                    mov al, byte ptr [esi]
:004817B2 46                      inc esi
:004817B3 8A1F                    mov bl, byte ptr [edi]
:004817B5 47                      inc edi
:004817B6 38D8                    cmp al, bl
:004817B8 74F2                    je 004817AC
:004817BA 50                      push eax
:004817BB 53                      push ebx
:004817BC E81F150000              call 00482CE0
:004817C1 8BD8                    mov ebx, eax
:004817C3 83C404                  add esp, 00000004
:004817C6 E815150000              call 00482CE0
:004817CB 83C404                  add esp, 00000004
:004817CE 38C3                    cmp bl, al
:004817D0 74DA                    je 004817AC
:004817D2 1BC0                    sbb eax, eax
:004817D4 83D8FF                  sbb eax, FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004817A1(U), :004817AE(C)
|
:004817D7 5B                      pop ebx
:004817D8 5E                      pop esi
:004817D9 5F                      pop edi
:004817DA C9                      leave
:004817DB C3                      ret


:004817DC CC                      int 03
:004817DD CC                      int 03
:004817DE CC                      int 03
:004817DF CC                      int 03

//******************** Program Entry Point ********
:004817E0 55                      push ebp
:004817E1 8BEC                    mov ebp, esp
:004817E3 6AFF                    push FFFFFFFF
:004817E5 68A8774800              push 004877A8
:004817EA 68082C4800              push 00482C08
:004817EF 64A100000000            mov eax, dword ptr fs:[00000000]
:004817F5 50                      push eax
:004817F6 64892500000000          mov dword ptr fs:[00000000], esp
:004817FD 83C4A8                  add esp, FFFFFFA8
:00481800 53                      push ebx
:00481801 56                      push esi
:00481802 57                      push edi
:00481803 8965E8                  mov dword ptr [ebp-18], esp
:00481806 FF15A0614800            call dword ptr [004861A0]
:0048180C 33D2                    xor edx, edx
:0048180E 8AD4                    mov dl, ah
:00481810 891564CC4B00            mov dword ptr [004BCC64], edx
:00481816 8BC8                    mov ecx, eax
:00481818 81E1FF000000            and ecx, 000000FF
:0048181E 890D60CC4B00            mov dword ptr [004BCC60], ecx
:00481824 C1E108                  shl ecx, 08
:00481827 03CA                    add ecx, edx
:00481829 890D5CCC4B00            mov dword ptr [004BCC5C], ecx
:0048182F C1E810                  shr eax, 10
:00481832 A358CC4B00              mov dword ptr [004BCC58], eax
:00481837 E884230000              call 00483BC0
:0048183C 85C0                    test eax, eax
:0048183E 750A                    jne 0048184A
:00481840 6A1C                    push 0000001C
:00481842 E869010000              call 004819B0
:00481847 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048183E(C)
|
:0048184A C745FC00000000          mov [ebp-04], 00000000
:00481851 E86A210000              call 004839C0
:00481856 E855210000              call 004839B0
:0048185B FF15A4614800            call dword ptr [004861A4]
:00481861 A388D84B00              mov dword ptr [004BD888], eax
:00481866 E8051B0000              call 00483370
:0048186B A398CC4B00              mov dword ptr [004BCC98], eax
:00481870 85C0                    test eax, eax
:00481872 7409                    je 0048187D
:00481874 A188D84B00              mov eax, dword ptr [004BD888]
:00481879 85C0                    test eax, eax
:0048187B 750A                    jne 00481887

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481872(C)
|
:0048187D 6AFF                    push FFFFFFFF
:0048187F E8ACFDFFFF              call 00481630
:00481884 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048187B(C)
|
:00481887 E834180000              call 004830C0
:0048188C E83F170000              call 00482FD0
:00481891 E86AFDFFFF              call 00481600
:00481896 8B3588D84B00            mov esi, dword ptr [004BD888]
:0048189C 89759C                  mov dword ptr [ebp-64], esi
:0048189F 803E22                  cmp byte ptr [esi], 22
:004818A2 0F85BE000000            jne 00481966

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004818C6(C), :004818CC(U)
|
:004818A8 46                      inc esi
:004818A9 89759C                  mov dword ptr [ebp-64], esi
:004818AC 8A06                    mov al, byte ptr [esi]
:004818AE 3C22                    cmp al, 22
:004818B0 741C                    je 004818CE
:004818B2 84C0                    test al, al
:004818B4 7418                    je 004818CE
:004818B6 25FF000000              and eax, 000000FF
:004818BB 50                      push eax
:004818BC E8AF160000              call 00482F70
:004818C1 83C404                  add esp, 00000004
:004818C4 85C0                    test eax, eax
:004818C6 74E0                    je 004818A8
:004818C8 46                      inc esi
:004818C9 89759C                  mov dword ptr [ebp-64], esi
:004818CC EBDA                    jmp 004818A8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004818B0(C), :004818B4(C)
|
:004818CE 803E22                  cmp byte ptr [esi], 22
:004818D1 7504                    jne 004818D7
:004818D3 46                      inc esi
:004818D4 89759C                  mov dword ptr [ebp-64], esi

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004818D1(C), :004818E5(U), :00481969(C)
|
:004818D7 8A06                    mov al, byte ptr [esi]
:004818D9 84C0                    test al, al
:004818DB 740A                    je 004818E7
:004818DD 3C20                    cmp al, 20
:004818DF 7706                    ja 004818E7
:004818E1 46                      inc esi
:004818E2 89759C                  mov dword ptr [ebp-64], esi
:004818E5 EBF0                    jmp 004818D7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004818DB(C), :004818DF(C)
|
:004818E7 C745D000000000          mov [ebp-30], 00000000
:004818EE 8D45A4                  lea eax, dword ptr [ebp-5C]
:004818F1 50                      push eax
:004818F2 FF15A8614800            call dword ptr [004861A8]
:004818F8 F645D001                test [ebp-30], 01
:004818FC 740A                    je 00481908
:004818FE 8B45D4                  mov eax, dword ptr [ebp-2C]
:00481901 25FFFF0000              and eax, 0000FFFF
:00481906 EB05                    jmp 0048190D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004818FC(C)
|
:00481908 B80A000000              mov eax, 0000000A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481906(U)
|
:0048190D 50                      push eax
:0048190E 56                      push esi
:0048190F 6A00                    push 00000000
:00481911 6A00                    push 00000000
:00481913 FF15AC614800            call dword ptr [004861AC]
:00481919 50                      push eax
:0048191A E8953CFFFF              call 004755B4
:0048191F 8945A0                  mov dword ptr [ebp-60], eax
:00481922 50                      push eax
:00481923 E808FDFFFF              call 00481630
:00481928 EB21                    jmp 0048194B
:0048192A 8B45EC                  mov eax, dword ptr [ebp-14]
:0048192D 8B08                    mov ecx, dword ptr [eax]
:0048192F 8B09                    mov ecx, dword ptr [ecx]
:00481931 894D98                  mov dword ptr [ebp-68], ecx
:00481934 50                      push eax
:00481935 51                      push ecx
:00481936 E8A5140000              call 00482DE0
:0048193B 83C408                  add esp, 00000008
:0048193E C3                      ret


:0048193F 8B65E8                  mov esp, dword ptr [ebp-18]
:00481942 8B5598                  mov edx, dword ptr [ebp-68]
:00481945 52                      push edx
:00481946 E805FDFFFF              call 00481650

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481928(U)
|
:0048194B 83C404                  add esp, 00000004
:0048194E C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00481955 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00481958 64890D00000000          mov dword ptr fs:[00000000], ecx
:0048195F 5F                      pop edi
:00481960 5E                      pop esi
:00481961 5B                      pop ebx
:00481962 8BE5                    mov esp, ebp
:00481964 5D                      pop ebp
:00481965 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004818A2(C), :00481973(U)
|
:00481966 803E20                  cmp byte ptr [esi], 20
:00481969 0F8668FFFFFF            jbe 004818D7
:0048196F 46                      inc esi
:00481970 89759C                  mov dword ptr [ebp-64], esi
:00481973 EBF1                    jmp 00481966
:00481975 90                      nop
:00481976 90                      nop
:00481977 90                      nop
:00481978 90                      nop
:00481979 90                      nop
:0048197A 90                      nop
:0048197B 90                      nop
:0048197C 90                      nop
:0048197D 90                      nop
:0048197E 90                      nop
:0048197F 90                      nop

* Referenced by a CALL at Addresses:
|:00481138   , :00481742   , :00483022   , :0048305C   , :00483124   
|:004839DC   
|
:00481980 833DA0CC4B0001          cmp dword ptr [004BCCA0], 00000001
:00481987 7505                    jne 0048198E
:00481989 E872220000              call 00483C00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481987(C)
|
:0048198E 8B442404                mov eax, dword ptr [esp+04]
:00481992 50                      push eax
:00481993 E8A8220000              call 00483C40
:00481998 83C404                  add esp, 00000004
:0048199B 68FF000000              push 000000FF
:004819A0 FF1520F34800            call dword ptr [0048F320]
:004819A6 83C404                  add esp, 00000004
:004819A9 C3                      ret


:004819AA 90                      nop
:004819AB 90                      nop
:004819AC 90                      nop
:004819AD 90                      nop
:004819AE 90                      nop
:004819AF 90                      nop

* Referenced by a CALL at Address:
|:00481842   
|
:004819B0 833DA0CC4B0001          cmp dword ptr [004BCCA0], 00000001
:004819B7 7505                    jne 004819BE
:004819B9 E842220000              call 00483C00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004819B7(C)
|
:004819BE 8B442404                mov eax, dword ptr [esp+04]
:004819C2 50                      push eax
:004819C3 E878220000              call 00483C40
:004819C8 83C404                  add esp, 00000004
:004819CB 68FF000000              push 000000FF
:004819D0 FF15C0614800            call dword ptr [004861C0]
:004819D6 C3                      ret


:004819D7 90                      nop
:004819D8 90                      nop
:004819D9 90                      nop
:004819DA 90                      nop
:004819DB 90                      nop
:004819DC 90                      nop
:004819DD 90                      nop
:004819DE 90                      nop
:004819DF 90                      nop

* Referenced by a CALL at Addresses:
|:0047FD0A   , :00482542   , :004825BB   
|
:004819E0 55                      push ebp
:004819E1 8BEC                    mov ebp, esp
:004819E3 57                      push edi
:004819E4 56                      push esi
:004819E5 8B750C                  mov esi, dword ptr [ebp+0C]
:004819E8 8B4D10                  mov ecx, dword ptr [ebp+10]
:004819EB 8B7D08                  mov edi, dword ptr [ebp+08]
:004819EE 8BC1                    mov eax, ecx
:004819F0 8BD1                    mov edx, ecx
:004819F2 03C6                    add eax, esi
:004819F4 3BFE                    cmp edi, esi
:004819F6 7608                    jbe 00481A00
:004819F8 3BF8                    cmp edi, eax
:004819FA 0F8278010000            jb 00481B78

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004819F6(C)
|
:00481A00 F7C703000000            test edi, 00000003
:00481A06 7514                    jne 00481A1C
:00481A08 C1E902                  shr ecx, 02
:00481A0B 83E203                  and edx, 00000003
:00481A0E 83F908                  cmp ecx, 00000008
:00481A11 7229                    jb 00481A3C
:00481A13 F3                      repz
:00481A14 A5                      movsd
:00481A15 FF2495281B4800          jmp dword ptr [4*edx+00481B28]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481A06(C)
|
:00481A1C 8BC7                    mov eax, edi
:00481A1E BA03000000              mov edx, 00000003
:00481A23 83E904                  sub ecx, 00000004
:00481A26 720C                    jb 00481A34
:00481A28 83E003                  and eax, 00000003
:00481A2B 03C8                    add ecx, eax
:00481A2D FF2485401A4800          jmp dword ptr [4*eax+00481A40]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481A26(C)
|
:00481A34 FF248D381B4800          jmp dword ptr [4*ecx+00481B38]
:00481A3B 90                      nop

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00481A11(C), :00481A6E(C), :00481A94(C), :00481AAE(C)
|
:00481A3C FF248DBC1A4800          jmp dword ptr [4*ecx+00481ABC]
:00481A43 90                      nop

:00481A44 501A4800                DWORD 00481A50
:00481A48 7C1A4800                DWORD 00481A7C
:00481A4C A01A4800                DWORD 00481AA0


:00481A50 23D1                    and edx, ecx
:00481A52 8A06                    mov al, byte ptr [esi]
:00481A54 8807                    mov byte ptr [edi], al
:00481A56 8A4601                  mov al, byte ptr [esi+01]
:00481A59 884701                  mov byte ptr [edi+01], al
:00481A5C 8A4602                  mov al, byte ptr [esi+02]
:00481A5F C1E902                  shr ecx, 02
:00481A62 884702                  mov byte ptr [edi+02], al
:00481A65 83C603                  add esi, 00000003
:00481A68 83C703                  add edi, 00000003
:00481A6B 83F908                  cmp ecx, 00000008
:00481A6E 72CC                    jb 00481A3C
:00481A70 F3                      repz
:00481A71 A5                      movsd
:00481A72 FF2495281B4800          jmp dword ptr [4*edx+00481B28]
:00481A79 2E8BC0                  mov eax, eax
:00481A7C 23D1                    and edx, ecx
:00481A7E 8A06                    mov al, byte ptr [esi]
:00481A80 8807                    mov byte ptr [edi], al
:00481A82 8A4601                  mov al, byte ptr [esi+01]
:00481A85 C1E902                  shr ecx, 02
:00481A88 884701                  mov byte ptr [edi+01], al
:00481A8B 83C602                  add esi, 00000002
:00481A8E 83C702                  add edi, 00000002
:00481A91 83F908                  cmp ecx, 00000008
:00481A94 72A6                    jb 00481A3C
:00481A96 F3                      repz
:00481A97 A5                      movsd
:00481A98 FF2495281B4800          jmp dword ptr [4*edx+00481B28]
:00481A9F 90                      nop
:00481AA0 23D1                    and edx, ecx
:00481AA2 8A06                    mov al, byte ptr [esi]
:00481AA4 8807                    mov byte ptr [edi], al
:00481AA6 46                      inc esi
:00481AA7 C1E902                  shr ecx, 02
:00481AAA 47                      inc edi
:00481AAB 83F908                  cmp ecx, 00000008
:00481AAE 728C                    jb 00481A3C
:00481AB0 F3                      repz
:00481AB1 A5                      movsd
:00481AB2 FF2495281B4800          jmp dword ptr [4*edx+00481B28]
:00481AB9 2E8BC0                  mov eax, eax

:00481ABC 1F1B4800                DWORD 00481B1F
:00481AC0 0C1B4800                DWORD 00481B0C
:00481AC4 041B4800                DWORD 00481B04
:00481AC8 FC1A4800                DWORD 00481AFC
:00481ACC F41A4800                DWORD 00481AF4
:00481AD0 EC1A4800                DWORD 00481AEC
:00481AD4 E41A4800                DWORD 00481AE4
:00481AD8 DC1A4800                DWORD 00481ADC


:00481ADC 8B448EE4                mov eax, dword ptr [esi+4*ecx-1C]
:00481AE0 89448FE4                mov dword ptr [edi+4*ecx-1C], eax
:00481AE4 8B448EE8                mov eax, dword ptr [esi+4*ecx-18]
:00481AE8 89448FE8                mov dword ptr [edi+4*ecx-18], eax
:00481AEC 8B448EEC                mov eax, dword ptr [esi+4*ecx-14]
:00481AF0 89448FEC                mov dword ptr [edi+4*ecx-14], eax
:00481AF4 8B448EF0                mov eax, dword ptr [esi+4*ecx-10]
:00481AF8 89448FF0                mov dword ptr [edi+4*ecx-10], eax
:00481AFC 8B448EF4                mov eax, dword ptr [esi+4*ecx-0C]
:00481B00 89448FF4                mov dword ptr [edi+4*ecx-0C], eax
:00481B04 8B448EF8                mov eax, dword ptr [esi+4*ecx-08]
:00481B08 89448FF8                mov dword ptr [edi+4*ecx-08], eax
:00481B0C 8B448EFC                mov eax, dword ptr [esi+4*ecx-04]
:00481B10 89448FFC                mov dword ptr [edi+4*ecx-04], eax
:00481B14 8D048D00000000          lea eax, dword ptr [4*ecx+00000000]
:00481B1B 03F0                    add esi, eax
:00481B1D 03F8                    add edi, eax
:00481B1F FF2495281B4800          jmp dword ptr [4*edx+00481B28]
:00481B26 8BC0                    mov eax, eax

:00481B28 381B4800                DWORD 00481B38
:00481B2C 401B4800                DWORD 00481B40
:00481B30 4C1B4800                DWORD 00481B4C
:00481B34 601B4800                DWORD 00481B60


:00481B38 8B4508                  mov eax, dword ptr [ebp+08]
:00481B3B 5E                      pop esi
:00481B3C 5F                      pop edi
:00481B3D C9                      leave
:00481B3E C3                      ret


:00481B3F 90                      nop
:00481B40 8A06                    mov al, byte ptr [esi]
:00481B42 8807                    mov byte ptr [edi], al
:00481B44 8B4508                  mov eax, dword ptr [ebp+08]
:00481B47 5E                      pop esi
:00481B48 5F                      pop edi
:00481B49 C9                      leave
:00481B4A C3                      ret


:00481B4B 90                      nop
:00481B4C 8A06                    mov al, byte ptr [esi]
:00481B4E 8807                    mov byte ptr [edi], al
:00481B50 8A4601                  mov al, byte ptr [esi+01]
:00481B53 884701                  mov byte ptr [edi+01], al
:00481B56 8B4508                  mov eax, dword ptr [ebp+08]
:00481B59 5E                      pop esi
:00481B5A 5F                      pop edi
:00481B5B C9                      leave
:00481B5C C3                      ret


:00481B5D 2E8BC0                  mov eax, eax
:00481B60 8A06                    mov al, byte ptr [esi]
:00481B62 8807                    mov byte ptr [edi], al
:00481B64 8A4601                  mov al, byte ptr [esi+01]
:00481B67 884701                  mov byte ptr [edi+01], al
:00481B6A 8A4602                  mov al, byte ptr [esi+02]
:00481B6D 884702                  mov byte ptr [edi+02], al
:00481B70 8B4508                  mov eax, dword ptr [ebp+08]
:00481B73 5E                      pop esi
:00481B74 5F                      pop edi
:00481B75 C9                      leave
:00481B76 C3                      ret


:00481B77 90                      nop

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004819FA(C)
|
:00481B78 8D7431FC                lea esi, dword ptr [ecx+esi-04]
:00481B7C 8D7C39FC                lea edi, dword ptr [ecx+edi-04]
:00481B80 F7C703000000            test edi, 00000003
:00481B86 7524                    jne 00481BAC
:00481B88 C1E902                  shr ecx, 02
:00481B8B 83E203                  and edx, 00000003
:00481B8E 83F908                  cmp ecx, 00000008
:00481B91 720D                    jb 00481BA0
:00481B93 FD                      std
:00481B94 F3                      repz
:00481B95 A5                      movsd
:00481B96 FC                      cld
:00481B97 FF2495C01C4800          jmp dword ptr [4*edx+00481CC0]
:00481B9E 8BC0                    mov eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00481B91(C), :00481BE8(C), :00481C12(C), :00481C40(C)
|
:00481BA0 F7D9                    neg ecx
:00481BA2 FF248D701C4800          jmp dword ptr [4*ecx+00481C70]
:00481BA9 2E8BC0                  mov eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481B86(C)
|
:00481BAC 8BC7                    mov eax, edi
:00481BAE BA03000000              mov edx, 00000003
:00481BB3 83F904                  cmp ecx, 00000004
:00481BB6 720C                    jb 00481BC4
:00481BB8 83E003                  and eax, 00000003
:00481BBB 2BC8                    sub ecx, eax
:00481BBD FF2485C81B4800          jmp dword ptr [4*eax+00481BC8]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481BB6(C)
|
:00481BC4 FF248DC01C4800          jmp dword ptr [4*ecx+00481CC0]
:00481BCB 90                      nop

:00481BCC D81B4800                DWORD 00481BD8
:00481BD0 F81B4800                DWORD 00481BF8
:00481BD4 201C4800                DWORD 00481C20


:00481BD8 8A4603                  mov al, byte ptr [esi+03]
:00481BDB 23D1                    and edx, ecx
:00481BDD 884703                  mov byte ptr [edi+03], al
:00481BE0 4E                      dec esi
:00481BE1 C1E902                  shr ecx, 02
:00481BE4 4F                      dec edi
:00481BE5 83F908                  cmp ecx, 00000008
:00481BE8 72B6                    jb 00481BA0
:00481BEA FD                      std
:00481BEB F3                      repz
:00481BEC A5                      movsd
:00481BED FC                      cld
:00481BEE FF2495C01C4800          jmp dword ptr [4*edx+00481CC0]
:00481BF5 2E8BC0                  mov eax, eax
:00481BF8 8A4603                  mov al, byte ptr [esi+03]
:00481BFB 23D1                    and edx, ecx
:00481BFD 884703                  mov byte ptr [edi+03], al
:00481C00 8A4602                  mov al, byte ptr [esi+02]
:00481C03 C1E902                  shr ecx, 02
:00481C06 884702                  mov byte ptr [edi+02], al
:00481C09 83EE02                  sub esi, 00000002
:00481C0C 83EF02                  sub edi, 00000002
:00481C0F 83F908                  cmp ecx, 00000008
:00481C12 728C                    jb 00481BA0
:00481C14 FD                      std
:00481C15 F3                      repz
:00481C16 A5                      movsd
:00481C17 FC                      cld
:00481C18 FF2495C01C4800          jmp dword ptr [4*edx+00481CC0]
:00481C1F 90                      nop
:00481C20 8A4603                  mov al, byte ptr [esi+03]
:00481C23 23D1                    and edx, ecx
:00481C25 884703                  mov byte ptr [edi+03], al
:00481C28 8A4602                  mov al, byte ptr [esi+02]
:00481C2B 884702                  mov byte ptr [edi+02], al
:00481C2E 8A4601                  mov al, byte ptr [esi+01]
:00481C31 C1E902                  shr ecx, 02
:00481C34 884701                  mov byte ptr [edi+01], al
:00481C37 83EE03                  sub esi, 00000003
:00481C3A 83EF03                  sub edi, 00000003
:00481C3D 83F908                  cmp ecx, 00000008
:00481C40 0F825AFFFFFF            jb 00481BA0
:00481C46 FD                      std
:00481C47 F3                      repz
:00481C48 A5                      movsd
:00481C49 FC                      cld
:00481C4A FF2495C01C4800          jmp dword ptr [4*edx+00481CC0]
:00481C51 2E8BC0                  mov eax, eax

:00481C54 741C4800                DWORD 00481C74
:00481C58 7C1C4800                DWORD 00481C7C
:00481C5C 841C4800                DWORD 00481C84
:00481C60 8C1C4800                DWORD 00481C8C
:00481C64 941C4800                DWORD 00481C94
:00481C68 9C1C4800                DWORD 00481C9C
:00481C6C A41C4800                DWORD 00481CA4
:00481C70 B71C4800                DWORD 00481CB7


:00481C74 8B448E1C                mov eax, dword ptr [esi+4*ecx+1C]
:00481C78 89448F1C                mov dword ptr [edi+4*ecx+1C], eax
:00481C7C 8B448E18                mov eax, dword ptr [esi+4*ecx+18]
:00481C80 89448F18                mov dword ptr [edi+4*ecx+18], eax
:00481C84 8B448E14                mov eax, dword ptr [esi+4*ecx+14]
:00481C88 89448F14                mov dword ptr [edi+4*ecx+14], eax
:00481C8C 8B448E10                mov eax, dword ptr [esi+4*ecx+10]
:00481C90 89448F10                mov dword ptr [edi+4*ecx+10], eax
:00481C94 8B448E0C                mov eax, dword ptr [esi+4*ecx+0C]
:00481C98 89448F0C                mov dword ptr [edi+4*ecx+0C], eax
:00481C9C 8B448E08                mov eax, dword ptr [esi+4*ecx+08]
:00481CA0 89448F08                mov dword ptr [edi+4*ecx+08], eax
:00481CA4 8B448E04                mov eax, dword ptr [esi+4*ecx+04]
:00481CA8 89448F04                mov dword ptr [edi+4*ecx+04], eax
:00481CAC 8D048D00000000          lea eax, dword ptr [4*ecx+00000000]
:00481CB3 03F0                    add esi, eax
:00481CB5 03F8                    add edi, eax
:00481CB7 FF2495C01C4800          jmp dword ptr [4*edx+00481CC0]
:00481CBE 8BC0                    mov eax, eax

:00481CC0 D01C4800                DWORD 00481CD0
:00481CC4 D81C4800                DWORD 00481CD8
:00481CC8 E81C4800                DWORD 00481CE8
:00481CCC FC1C4800                DWORD 00481CFC


:00481CD0 8B4508                  mov eax, dword ptr [ebp+08]
:00481CD3 5E                      pop esi
:00481CD4 5F                      pop edi
:00481CD5 C9                      leave
:00481CD6 C3                      ret


:00481CD7 90                      nop
:00481CD8 8A4603                  mov al, byte ptr [esi+03]
:00481CDB 884703                  mov byte ptr [edi+03], al
:00481CDE 8B4508                  mov eax, dword ptr [ebp+08]
:00481CE1 5E                      pop esi
:00481CE2 5F                      pop edi
:00481CE3 C9                      leave
:00481CE4 C3                      ret


:00481CE5 2E8BC0                  mov eax, eax
:00481CE8 8A4603                  mov al, byte ptr [esi+03]
:00481CEB 884703                  mov byte ptr [edi+03], al
:00481CEE 8A4602                  mov al, byte ptr [esi+02]
:00481CF1 884702                  mov byte ptr [edi+02], al
:00481CF4 8B4508                  mov eax, dword ptr [ebp+08]
:00481CF7 5E                      pop esi
:00481CF8 5F                      pop edi
:00481CF9 C9                      leave
:00481CFA C3                      ret


:00481CFB 90                      nop
:00481CFC 8A4603                  mov al, byte ptr [esi+03]
:00481CFF 884703                  mov byte ptr [edi+03], al
:00481D02 8A4602                  mov al, byte ptr [esi+02]
:00481D05 884702                  mov byte ptr [edi+02], al
:00481D08 8A4601                  mov al, byte ptr [esi+01]
:00481D0B 884701                  mov byte ptr [edi+01], al
:00481D0E 8B4508                  mov eax, dword ptr [ebp+08]
:00481D11 5E                      pop esi
:00481D12 5F                      pop edi
:00481D13 C9                      leave
:00481D14 C3                      ret


:00481D15 CC                      int 03
:00481D16 CC                      int 03
:00481D17 CC                      int 03
:00481D18 CC                      int 03
:00481D19 CC                      int 03
:00481D1A CC                      int 03
:00481D1B CC                      int 03
:00481D1C CC                      int 03
:00481D1D CC                      int 03
:00481D1E CC                      int 03
:00481D1F CC                      int 03

* Referenced by a CALL at Addresses:
|:00480C67   , :00480D00   , :00480E2D   
|
:00481D20 56                      push esi
:00481D21 8B742418                mov esi, dword ptr [esp+18]
:00481D25 813E20059319            cmp dword ptr [esi], 19930520
:00481D2B 7405                    je 00481D32
:00481D2D E8CE0A0000              call 00482800

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481D2B(C)
|
:00481D32 8B442408                mov eax, dword ptr [esp+08]
:00481D36 F6400466                test [eax+04], 66
:00481D3A 7433                    je 00481D6F
:00481D3C 8B4604                  mov eax, dword ptr [esi+04]
:00481D3F 85C0                    test eax, eax
:00481D41 0F849F000000            je 00481DE6
:00481D47 8B44241C                mov eax, dword ptr [esp+1C]
:00481D4B 85C0                    test eax, eax
:00481D4D 0F8593000000            jne 00481DE6
:00481D53 8B442414                mov eax, dword ptr [esp+14]
:00481D57 8B4C240C                mov ecx, dword ptr [esp+0C]
:00481D5B 6AFF                    push FFFFFFFF
:00481D5D 56                      push esi
:00481D5E 50                      push eax
:00481D5F 51                      push ecx
:00481D60 E80B040000              call 00482170
:00481D65 83C410                  add esp, 00000010
:00481D68 B801000000              mov eax, 00000001
:00481D6D 5E                      pop esi
:00481D6E C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481D3A(C)
|
:00481D6F 8B4E0C                  mov ecx, dword ptr [esi+0C]
:00481D72 85C9                    test ecx, ecx
:00481D74 7470                    je 00481DE6
:00481D76 813863736DE0            cmp dword ptr [eax], E06D7363
:00481D7C 7540                    jne 00481DBE
:00481D7E 81781420059319          cmp dword ptr [eax+14], 19930520
:00481D85 7637                    jbe 00481DBE
:00481D87 8B501C                  mov edx, dword ptr [eax+1C]
:00481D8A 8B4A08                  mov ecx, dword ptr [edx+08]
:00481D8D 85C9                    test ecx, ecx
:00481D8F 742D                    je 00481DBE
:00481D91 8B542424                mov edx, dword ptr [esp+24]
:00481D95 81E2FF000000            and edx, 000000FF
:00481D9B 52                      push edx
:00481D9C 8B542424                mov edx, dword ptr [esp+24]
:00481DA0 52                      push edx
:00481DA1 8B542424                mov edx, dword ptr [esp+24]
:00481DA5 52                      push edx
:00481DA6 8B542420                mov edx, dword ptr [esp+20]
:00481DAA 56                      push esi
:00481DAB 52                      push edx
:00481DAC 8B542424                mov edx, dword ptr [esp+24]
:00481DB0 52                      push edx
:00481DB1 8B542424                mov edx, dword ptr [esp+24]
:00481DB5 52                      push edx
:00481DB6 50                      push eax
:00481DB7 FFD1                    call ecx
:00481DB9 83C420                  add esp, 00000020
:00481DBC 5E                      pop esi
:00481DBD C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00481D7C(C), :00481D85(C), :00481D8F(C)
|
:00481DBE 8B4C2420                mov ecx, dword ptr [esp+20]
:00481DC2 8B54241C                mov edx, dword ptr [esp+1C]
:00481DC6 51                      push ecx
:00481DC7 8B4C2428                mov ecx, dword ptr [esp+28]
:00481DCB 52                      push edx
:00481DCC 8B54241C                mov edx, dword ptr [esp+1C]
:00481DD0 51                      push ecx
:00481DD1 8B4C241C                mov ecx, dword ptr [esp+1C]
:00481DD5 56                      push esi
:00481DD6 52                      push edx
:00481DD7 8B542420                mov edx, dword ptr [esp+20]
:00481DDB 51                      push ecx
:00481DDC 52                      push edx
:00481DDD 50                      push eax
:00481DDE E80D000000              call 00481DF0
:00481DE3 83C420                  add esp, 00000020

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00481D41(C), :00481D4D(C), :00481D74(C)
|
:00481DE6 B801000000              mov eax, 00000001
:00481DEB 5E                      pop esi
:00481DEC C3                      ret


:00481DED 90                      nop
:00481DEE 90                      nop
:00481DEF 90                      nop

* Referenced by a CALL at Address:
|:00481DDE   
|
:00481DF0 83EC24                  sub esp, 00000024
:00481DF3 8B44242C                mov eax, dword ptr [esp+2C]
:00481DF7 53                      push ebx
:00481DF8 55                      push ebp
:00481DF9 56                      push esi
:00481DFA 8B6808                  mov ebp, dword ptr [eax+08]
:00481DFD 57                      push edi
:00481DFE 83FDFF                  cmp ebp, FFFFFFFF
:00481E01 896C2424                mov dword ptr [esp+24], ebp
:00481E05 7C09                    jl 00481E10
:00481E07 8B4C2448                mov ecx, dword ptr [esp+48]
:00481E0B 3B6904                  cmp ebp, dword ptr [ecx+04]
:00481E0E 7C05                    jl 00481E15

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481E05(C)
|
:00481E10 E8EB090000              call 00482800

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481E0E(C)
|
:00481E15 8B5C2438                mov ebx, dword ptr [esp+38]
:00481E19 BE03000000              mov esi, 00000003
:00481E1E BF20059319              mov edi, 19930520
:00481E23 813B63736DE0            cmp dword ptr [ebx], E06D7363
:00481E29 0F852C020000            jne 0048205B
:00481E2F 397310                  cmp dword ptr [ebx+10], esi
:00481E32 755F                    jne 00481E93
:00481E34 397B14                  cmp dword ptr [ebx+14], edi
:00481E37 755A                    jne 00481E93
:00481E39 8B431C                  mov eax, dword ptr [ebx+1C]
:00481E3C 85C0                    test eax, eax
:00481E3E 7553                    jne 00481E93
:00481E40 A1A4CC4B00              mov eax, dword ptr [004BCCA4]
:00481E45 85C0                    test eax, eax
:00481E47 0F844B020000            je 00482098
:00481E4D 8B15A8CC4B00            mov edx, dword ptr [004BCCA8]
:00481E53 8BD8                    mov ebx, eax
:00481E55 6A01                    push 00000001
:00481E57 53                      push ebx
:00481E58 895C2440                mov dword ptr [esp+40], ebx
:00481E5C 89542448                mov dword ptr [esp+48], edx
:00481E60 E8BB1F0000              call 00483E20
:00481E65 83C408                  add esp, 00000008
:00481E68 85C0                    test eax, eax
:00481E6A 7505                    jne 00481E71
:00481E6C E88F090000              call 00482800

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481E6A(C)
|
:00481E71 813B63736DE0            cmp dword ptr [ebx], E06D7363
:00481E77 0F85DE010000            jne 0048205B
:00481E7D 397310                  cmp dword ptr [ebx+10], esi
:00481E80 7511                    jne 00481E93
:00481E82 397B14                  cmp dword ptr [ebx+14], edi
:00481E85 750C                    jne 00481E93
:00481E87 8B431C                  mov eax, dword ptr [ebx+1C]
:00481E8A 85C0                    test eax, eax
:00481E8C 7505                    jne 00481E93
:00481E8E E86D090000              call 00482800

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00481E32(C), :00481E37(C), :00481E3E(C), :00481E80(C), :00481E85(C)
|:00481E8C(C)
|
:00481E93 813B63736DE0            cmp dword ptr [ebx], E06D7363
:00481E99 0F85BC010000            jne 0048205B
:00481E9F 397310                  cmp dword ptr [ebx+10], esi
:00481EA2 0F85B3010000            jne 0048205B
:00481EA8 397B14                  cmp dword ptr [ebx+14], edi
:00481EAB 0F85AA010000            jne 0048205B
:00481EB1 8B542450                mov edx, dword ptr [esp+50]
:00481EB5 8D442428                lea eax, dword ptr [esp+28]
:00481EB9 8D4C2414                lea ecx, dword ptr [esp+14]
:00481EBD 50                      push eax
:00481EBE 8B44244C                mov eax, dword ptr [esp+4C]
:00481EC2 51                      push ecx
:00481EC3 55                      push ebp
:00481EC4 52                      push edx
:00481EC5 50                      push eax
:00481EC6 E8A5EFFFFF              call 00480E70
:00481ECB 8B4C2428                mov ecx, dword ptr [esp+28]
:00481ECF 8B54243C                mov edx, dword ptr [esp+3C]
:00481ED3 83C414                  add esp, 00000014
:00481ED6 3BCA                    cmp ecx, edx
:00481ED8 89442418                mov dword ptr [esp+18], eax
:00481EDC 0F835E010000            jnb 00482040

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048203A(C)
|
:00481EE2 3928                    cmp dword ptr [eax], ebp
:00481EE4 0F8F3A010000            jg 00482024
:00481EEA 3B6804                  cmp ebp, dword ptr [eax+04]
:00481EED 0F8F31010000            jg 00482024
:00481EF3 8B480C                  mov ecx, dword ptr [eax+0C]
:00481EF6 8B7010                  mov esi, dword ptr [eax+10]
:00481EF9 85C9                    test ecx, ecx
:00481EFB 89742410                mov dword ptr [esp+10], esi
:00481EFF 894C2420                mov dword ptr [esp+20], ecx
:00481F03 0F8E17010000            jle 00482020
:00481F09 8B431C                  mov eax, dword ptr [ebx+1C]
:00481F0C 8B400C                  mov eax, dword ptr [eax+0C]
:00481F0F 8D5004                  lea edx, dword ptr [eax+04]
:00481F12 8B00                    mov eax, dword ptr [eax]
:00481F14 8954242C                mov dword ptr [esp+2C], edx
:00481F18 89442430                mov dword ptr [esp+30], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481FE3(C)
|
:00481F1C 8B442430                mov eax, dword ptr [esp+30]
:00481F20 8B6C242C                mov ebp, dword ptr [esp+2C]
:00481F24 85C0                    test eax, eax
:00481F26 8944241C                mov dword ptr [esp+1C], eax
:00481F2A 0F8EA5000000            jle 00481FD5
:00481F30 8B5604                  mov edx, dword ptr [esi+04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481FCB(C)
|
:00481F33 8B7D00                  mov edi, dword ptr [ebp+00]
:00481F36 85D2                    test edx, edx
:00481F38 747A                    je 00481FB4
:00481F3A 8A4A08                  mov cl, byte ptr [edx+08]
:00481F3D 8D4208                  lea eax, dword ptr [edx+08]
:00481F40 84C9                    test cl, cl
:00481F42 7470                    je 00481FB4
:00481F44 8B4F04                  mov ecx, dword ptr [edi+04]
:00481F47 3BD1                    cmp edx, ecx
:00481F49 7444                    je 00481F8F
:00481F4B 8D7108                  lea esi, dword ptr [ecx+08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481F6C(C)
|
:00481F4E 8A18                    mov bl, byte ptr [eax]
:00481F50 8ACB                    mov cl, bl
:00481F52 3A1E                    cmp bl, byte ptr [esi]
:00481F54 751C                    jne 00481F72
:00481F56 84C9                    test cl, cl
:00481F58 7414                    je 00481F6E
:00481F5A 8A5801                  mov bl, byte ptr [eax+01]
:00481F5D 8ACB                    mov cl, bl
:00481F5F 3A5E01                  cmp bl, byte ptr [esi+01]
:00481F62 750E                    jne 00481F72
:00481F64 83C002                  add eax, 00000002
:00481F67 83C602                  add esi, 00000002
:00481F6A 84C9                    test cl, cl
:00481F6C 75E0                    jne 00481F4E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481F58(C)
|
:00481F6E 33C0                    xor eax, eax
:00481F70 EB05                    jmp 00481F77

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00481F54(C), :00481F62(C)
|
:00481F72 1BC0                    sbb eax, eax
:00481F74 83D8FF                  sbb eax, FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481F70(U)
|
:00481F77 85C0                    test eax, eax
:00481F79 740C                    je 00481F87
:00481F7B 8B5C2438                mov ebx, dword ptr [esp+38]
:00481F7F 8B742410                mov esi, dword ptr [esp+10]
:00481F83 33C0                    xor eax, eax
:00481F85 EB32                    jmp 00481FB9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481F79(C)
|
:00481F87 8B5C2438                mov ebx, dword ptr [esp+38]
:00481F8B 8B742410                mov esi, dword ptr [esp+10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481F49(C)
|
:00481F8F F60702                  test byte ptr [edi], 02
:00481F92 7405                    je 00481F99
:00481F94 F60608                  test byte ptr [esi], 08
:00481F97 7417                    je 00481FB0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481F92(C)
|
:00481F99 8B431C                  mov eax, dword ptr [ebx+1C]
:00481F9C 8B00                    mov eax, dword ptr [eax]
:00481F9E A801                    test al, 01
:00481FA0 7405                    je 00481FA7
:00481FA2 F60601                  test byte ptr [esi], 01
:00481FA5 7409                    je 00481FB0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481FA0(C)
|
:00481FA7 A802                    test al, 02
:00481FA9 7409                    je 00481FB4
:00481FAB F60602                  test byte ptr [esi], 02
:00481FAE 7504                    jne 00481FB4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00481F97(C), :00481FA5(C)
|
:00481FB0 33C0                    xor eax, eax
:00481FB2 EB05                    jmp 00481FB9

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00481F38(C), :00481F42(C), :00481FA9(C), :00481FAE(C)
|
:00481FB4 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00481F85(U), :00481FB2(U)
|
:00481FB9 85C0                    test eax, eax
:00481FBB 752E                    jne 00481FEB
:00481FBD 8B44241C                mov eax, dword ptr [esp+1C]
:00481FC1 83C504                  add ebp, 00000004
:00481FC4 48                      dec eax
:00481FC5 85C0                    test eax, eax
:00481FC7 8944241C                mov dword ptr [esp+1C], eax
:00481FCB 0F8F62FFFFFF            jg 00481F33
:00481FD1 8B4C2420                mov ecx, dword ptr [esp+20]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481F2A(C)
|
:00481FD5 49                      dec ecx
:00481FD6 83C610                  add esi, 00000010
:00481FD9 85C9                    test ecx, ecx
:00481FDB 894C2420                mov dword ptr [esp+20], ecx
:00481FDF 89742410                mov dword ptr [esp+10], esi
:00481FE3 0F8F33FFFFFF            jg 00481F1C
:00481FE9 EB31                    jmp 0048201C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481FBB(C)
|
:00481FEB 8B4C2454                mov ecx, dword ptr [esp+54]
:00481FEF 8B542450                mov edx, dword ptr [esp+50]
:00481FF3 8B442418                mov eax, dword ptr [esp+18]
:00481FF7 51                      push ecx
:00481FF8 8B4D00                  mov ecx, dword ptr [ebp+00]
:00481FFB 52                      push edx
:00481FFC 8B542450                mov edx, dword ptr [esp+50]
:00482000 50                      push eax
:00482001 8B442450                mov eax, dword ptr [esp+50]
:00482005 51                      push ecx
:00482006 8B4C2450                mov ecx, dword ptr [esp+50]
:0048200A 56                      push esi
:0048200B 52                      push edx
:0048200C 8B542454                mov edx, dword ptr [esp+54]
:00482010 50                      push eax
:00482011 51                      push ecx
:00482012 52                      push edx
:00482013 53                      push ebx
:00482014 E837020000              call 00482250
:00482019 83C428                  add esp, 00000028

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481FE9(U)
|
:0048201C 8B6C2424                mov ebp, dword ptr [esp+24]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481F03(C)
|
:00482020 8B442418                mov eax, dword ptr [esp+18]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00481EE4(C), :00481EED(C)
|
:00482024 8B4C2414                mov ecx, dword ptr [esp+14]
:00482028 8B542428                mov edx, dword ptr [esp+28]
:0048202C 41                      inc ecx
:0048202D 83C014                  add eax, 00000014
:00482030 3BCA                    cmp ecx, edx
:00482032 894C2414                mov dword ptr [esp+14], ecx
:00482036 89442418                mov dword ptr [esp+18], eax
:0048203A 0F82A2FEFFFF            jb 00481EE2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00481EDC(C)
|
:00482040 8A44244C                mov al, byte ptr [esp+4C]
:00482044 84C0                    test al, al
:00482046 7450                    je 00482098
:00482048 6A01                    push 00000001
:0048204A 53                      push ebx
:0048204B E820060000              call 00482670
:00482050 83C408                  add esp, 00000008
:00482053 5F                      pop edi
:00482054 5E                      pop esi
:00482055 5D                      pop ebp
:00482056 5B                      pop ebx
:00482057 83C424                  add esp, 00000024
:0048205A C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00481E29(C), :00481E77(C), :00481E99(C), :00481EA2(C), :00481EAB(C)
|
:0048205B 8A44244C                mov al, byte ptr [esp+4C]
:0048205F 84C0                    test al, al
:00482061 7530                    jne 00482093
:00482063 8B442454                mov eax, dword ptr [esp+54]
:00482067 8B4C2450                mov ecx, dword ptr [esp+50]
:0048206B 8B542448                mov edx, dword ptr [esp+48]
:0048206F 50                      push eax
:00482070 8B442448                mov eax, dword ptr [esp+48]
:00482074 51                      push ecx
:00482075 8B4C2448                mov ecx, dword ptr [esp+48]
:00482079 55                      push ebp
:0048207A 52                      push edx
:0048207B 8B54244C                mov edx, dword ptr [esp+4C]
:0048207F 50                      push eax
:00482080 51                      push ecx
:00482081 52                      push edx
:00482082 53                      push ebx
:00482083 E818000000              call 004820A0
:00482088 83C420                  add esp, 00000020
:0048208B 5F                      pop edi
:0048208C 5E                      pop esi
:0048208D 5D                      pop ebp
:0048208E 5B                      pop ebx
:0048208F 83C424                  add esp, 00000024
:00482092 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482061(C)
|
:00482093 E8D8060000              call 00482770

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00481E47(C), :00482046(C)
|
:00482098 5F                      pop edi
:00482099 5E                      pop esi
:0048209A 5D                      pop ebp
:0048209B 5B                      pop ebx
:0048209C 83C424                  add esp, 00000024
:0048209F C3                      ret



* Referenced by a CALL at Address:
|:00482083   
|
:004820A0 A1ACCC4B00              mov eax, dword ptr [004BCCAC]
:004820A5 53                      push ebx
:004820A6 8B5C2418                mov ebx, dword ptr [esp+18]
:004820AA 55                      push ebp
:004820AB 8B6C2428                mov ebp, dword ptr [esp+28]
:004820AF 56                      push esi
:004820B0 57                      push edi
:004820B1 8B7C242C                mov edi, dword ptr [esp+2C]
:004820B5 85C0                    test eax, eax
:004820B7 7427                    je 004820E0
:004820B9 8B442420                mov eax, dword ptr [esp+20]
:004820BD 8B4C241C                mov ecx, dword ptr [esp+1C]
:004820C1 8B542418                mov edx, dword ptr [esp+18]
:004820C5 55                      push ebp
:004820C6 57                      push edi
:004820C7 53                      push ebx
:004820C8 50                      push eax
:004820C9 8B442424                mov eax, dword ptr [esp+24]
:004820CD 51                      push ecx
:004820CE 52                      push edx
:004820CF 50                      push eax
:004820D0 E83BECFFFF              call 00480D10
:004820D5 83C41C                  add esp, 0000001C
:004820D8 85C0                    test eax, eax
:004820DA 0F8589000000            jne 00482169

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004820B7(C)
|
:004820E0 8B442428                mov eax, dword ptr [esp+28]
:004820E4 8D4C242C                lea ecx, dword ptr [esp+2C]
:004820E8 8D542430                lea edx, dword ptr [esp+30]
:004820EC 51                      push ecx
:004820ED 52                      push edx
:004820EE 50                      push eax
:004820EF 57                      push edi
:004820F0 53                      push ebx
:004820F1 E87AEDFFFF              call 00480E70
:004820F6 8B4C2444                mov ecx, dword ptr [esp+44]
:004820FA 8BF0                    mov esi, eax
:004820FC 8B442440                mov eax, dword ptr [esp+40]
:00482100 83C414                  add esp, 00000014
:00482103 3BC8                    cmp ecx, eax
:00482105 7362                    jnb 00482169

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482167(C)
|
:00482107 8B442428                mov eax, dword ptr [esp+28]
:0048210B 8B0E                    mov ecx, dword ptr [esi]
:0048210D 3BC1                    cmp eax, ecx
:0048210F 7C44                    jl 00482155
:00482111 3B4604                  cmp eax, dword ptr [esi+04]
:00482114 7F3F                    jg 00482155
:00482116 8B560C                  mov edx, dword ptr [esi+0C]
:00482119 8B4610                  mov eax, dword ptr [esi+10]
:0048211C C1E204                  shl edx, 04
:0048211F 03C2                    add eax, edx
:00482121 8B48F4                  mov ecx, dword ptr [eax-0C]
:00482124 85C9                    test ecx, ecx
:00482126 7407                    je 0048212F
:00482128 8A5108                  mov dl, byte ptr [ecx+08]
:0048212B 84D2                    test dl, dl
:0048212D 7526                    jne 00482155

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482126(C)
|
:0048212F 8B4C2420                mov ecx, dword ptr [esp+20]
:00482133 8B54241C                mov edx, dword ptr [esp+1C]
:00482137 55                      push ebp
:00482138 57                      push edi
:00482139 56                      push esi
:0048213A 83C0F0                  add eax, FFFFFFF0
:0048213D 6A00                    push 00000000
:0048213F 50                      push eax
:00482140 8B44242C                mov eax, dword ptr [esp+2C]
:00482144 53                      push ebx
:00482145 51                      push ecx
:00482146 8B4C2430                mov ecx, dword ptr [esp+30]
:0048214A 52                      push edx
:0048214B 50                      push eax
:0048214C 51                      push ecx
:0048214D E8FE000000              call 00482250
:00482152 83C428                  add esp, 00000028

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0048210F(C), :00482114(C), :0048212D(C)
|
:00482155 8B442430                mov eax, dword ptr [esp+30]
:00482159 8B4C242C                mov ecx, dword ptr [esp+2C]
:0048215D 40                      inc eax
:0048215E 83C614                  add esi, 00000014
:00482161 3BC1                    cmp eax, ecx
:00482163 89442430                mov dword ptr [esp+30], eax
:00482167 729E                    jb 00482107

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004820DA(C), :00482105(C)
|
:00482169 5F                      pop edi
:0048216A 5E                      pop esi
:0048216B 5D                      pop ebp
:0048216C 5B                      pop ebx
:0048216D C3                      ret


:0048216E 90                      nop
:0048216F 90                      nop

* Referenced by a CALL at Addresses:
|:00481D60   , :00482298   
|
:00482170 55                      push ebp
:00482171 8BEC                    mov ebp, esp
:00482173 6AFF                    push FFFFFFFF
:00482175 68B8774800              push 004877B8
:0048217A 68082C4800              push 00482C08
:0048217F 64A100000000            mov eax, dword ptr fs:[00000000]
:00482185 50                      push eax
:00482186 64892500000000          mov dword ptr fs:[00000000], esp
:0048218D 83C4F4                  add esp, FFFFFFF4
:00482190 53                      push ebx
:00482191 56                      push esi
:00482192 57                      push edi
:00482193 8965E8                  mov dword ptr [ebp-18], esp
:00482196 8B5D08                  mov ebx, dword ptr [ebp+08]
:00482199 8B7308                  mov esi, dword ptr [ebx+08]
:0048219C 8975E4                  mov dword ptr [ebp-1C], esi
:0048219F 8B7D10                  mov edi, dword ptr [ebp+10]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004821E4(U), :0048220F(U)
|
:004821A2 3B7514                  cmp esi, dword ptr [ebp+14]
:004821A5 746A                    je 00482211
:004821A7 83FEFF                  cmp esi, FFFFFFFF
:004821AA 7E05                    jle 004821B1
:004821AC 3B7704                  cmp esi, dword ptr [edi+04]
:004821AF 7C05                    jl 004821B6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004821AA(C)
|
:004821B1 E84A060000              call 00482800

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004821AF(C)
|
:004821B6 C745FC00000000          mov [ebp-04], 00000000
:004821BD 8B4708                  mov eax, dword ptr [edi+08]
:004821C0 8B44F004                mov eax, dword ptr [eax+8*esi+04]
:004821C4 85C0                    test eax, eax
:004821C6 740C                    je 004821D4
:004821C8 6803010000              push 00000103
:004821CD 53                      push ebx
:004821CE 50                      push eax
:004821CF E84C050000              call 00482720

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004821C6(C)
|
:004821D4 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:004821DB 8B5708                  mov edx, dword ptr [edi+08]
:004821DE 8B34F2                  mov esi, dword ptr [edx+8*esi]
:004821E1 8975E4                  mov dword ptr [ebp-1C], esi
:004821E4 EBBC                    jmp 004821A2
:004821E6 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004821E9 51                      push ecx
:004821EA E841000000              call 00482230
:004821EF 83C404                  add esp, 00000004
:004821F2 C3                      ret


:004821F3 8B65E8                  mov esp, dword ptr [ebp-18]
:004821F6 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:004821FD 8B7D10                  mov edi, dword ptr [ebp+10]
:00482200 8B5D08                  mov ebx, dword ptr [ebp+08]
:00482203 8B75E4                  mov esi, dword ptr [ebp-1C]
:00482206 8B5708                  mov edx, dword ptr [edi+08]
:00482209 8B34F2                  mov esi, dword ptr [edx+8*esi]
:0048220C 8975E4                  mov dword ptr [ebp-1C], esi
:0048220F EB91                    jmp 004821A2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004821A5(C)
|
:00482211 897308                  mov dword ptr [ebx+08], esi
:00482214 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00482217 64890D00000000          mov dword ptr fs:[00000000], ecx
:0048221E 5F                      pop edi
:0048221F 5E                      pop esi
:00482220 5B                      pop ebx
:00482221 8BE5                    mov esp, ebp
:00482223 5D                      pop ebp
:00482224 C3                      ret


:00482225 90                      nop
:00482226 90                      nop
:00482227 90                      nop
:00482228 90                      nop
:00482229 90                      nop
:0048222A 90                      nop
:0048222B 90                      nop
:0048222C 90                      nop
:0048222D 90                      nop
:0048222E 90                      nop
:0048222F 90                      nop

* Referenced by a CALL at Addresses:
|:004815D4   , :004821EA   
|
:00482230 8B442404                mov eax, dword ptr [esp+04]
:00482234 8B08                    mov ecx, dword ptr [eax]
:00482236 813963736DE0            cmp dword ptr [ecx], E06D7363
:0048223C 7505                    jne 00482243
:0048223E E82D050000              call 00482770

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048223C(C)
|
:00482243 33C0                    xor eax, eax
:00482245 C3                      ret


:00482246 90                      nop
:00482247 90                      nop
:00482248 90                      nop
:00482249 90                      nop
:0048224A 90                      nop
:0048224B 90                      nop
:0048224C 90                      nop
:0048224D 90                      nop
:0048224E 90                      nop
:0048224F 90                      nop

* Referenced by a CALL at Addresses:
|:00482014   , :0048214D   
|
:00482250 8B44241C                mov eax, dword ptr [esp+1C]
:00482254 53                      push ebx
:00482255 55                      push ebp
:00482256 8B6C240C                mov ebp, dword ptr [esp+0C]
:0048225A 56                      push esi
:0048225B 8B742414                mov esi, dword ptr [esp+14]
:0048225F 85C0                    test eax, eax
:00482261 57                      push edi
:00482262 7410                    je 00482274
:00482264 50                      push eax
:00482265 8B44242C                mov eax, dword ptr [esp+2C]
:00482269 50                      push eax
:0048226A 56                      push esi
:0048226B 55                      push ebp
:0048226C E8EF010000              call 00482460
:00482271 83C410                  add esp, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482262(C)
|
:00482274 8B442438                mov eax, dword ptr [esp+38]
:00482278 55                      push ebp
:00482279 85C0                    test eax, eax
:0048227B 7503                    jne 00482280
:0048227D 56                      push esi
:0048227E EB01                    jmp 00482281

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048227B(C)
|
:00482280 50                      push eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048227E(U)
|
:00482281 E85AE9FFFF              call 00480BE0
:00482286 8B7C2430                mov edi, dword ptr [esp+30]
:0048228A 8B5C2424                mov ebx, dword ptr [esp+24]
:0048228E 8B542420                mov edx, dword ptr [esp+20]
:00482292 8B0F                    mov ecx, dword ptr [edi]
:00482294 51                      push ecx
:00482295 53                      push ebx
:00482296 52                      push edx
:00482297 56                      push esi
:00482298 E8D3FEFFFF              call 00482170
:0048229D 8B4704                  mov eax, dword ptr [edi+04]
:004822A0 8B542438                mov edx, dword ptr [esp+38]
:004822A4 8B4C2444                mov ecx, dword ptr [esp+44]
:004822A8 83C410                  add esp, 00000010
:004822AB 40                      inc eax
:004822AC 894608                  mov dword ptr [esi+08], eax
:004822AF 8B420C                  mov eax, dword ptr [edx+0C]
:004822B2 6800010000              push 00000100
:004822B7 51                      push ecx
:004822B8 8B4C2424                mov ecx, dword ptr [esp+24]
:004822BC 50                      push eax
:004822BD 53                      push ebx
:004822BE 51                      push ecx
:004822BF 56                      push esi
:004822C0 55                      push ebp
:004822C1 E81A000000              call 004822E0
:004822C6 83C41C                  add esp, 0000001C
:004822C9 85C0                    test eax, eax
:004822CB 7407                    je 004822D4
:004822CD 56                      push esi
:004822CE 50                      push eax
:004822CF E8BCE8FFFF              call 00480B90

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004822CB(C)
|
:004822D4 5F                      pop edi
:004822D5 5E                      pop esi
:004822D6 5D                      pop ebp
:004822D7 5B                      pop ebx
:004822D8 C3                      ret


:004822D9 90                      nop
:004822DA 90                      nop
:004822DB 90                      nop
:004822DC 90                      nop
:004822DD 90                      nop
:004822DE 90                      nop
:004822DF 90                      nop

* Referenced by a CALL at Address:
|:004822C1   
|
:004822E0 55                      push ebp
:004822E1 8BEC                    mov ebp, esp
:004822E3 6AFF                    push FFFFFFFF
:004822E5 68C8774800              push 004877C8
:004822EA 68082C4800              push 00482C08
:004822EF 64A100000000            mov eax, dword ptr fs:[00000000]
:004822F5 50                      push eax
:004822F6 64892500000000          mov dword ptr fs:[00000000], esp
:004822FD 83C4E4                  add esp, FFFFFFE4
:00482300 53                      push ebx
:00482301 56                      push esi
:00482302 57                      push edi
:00482303 8965E8                  mov dword ptr [ebp-18], esp
:00482306 8B4518                  mov eax, dword ptr [ebp+18]
:00482309 8945D4                  mov dword ptr [ebp-2C], eax
:0048230C 33C9                    xor ecx, ecx
:0048230E 894DDC                  mov dword ptr [ebp-24], ecx
:00482311 8B750C                  mov esi, dword ptr [ebp+0C]
:00482314 8B56FC                  mov edx, dword ptr [esi-04]
:00482317 8955D8                  mov dword ptr [ebp-28], edx
:0048231A 8B15A4CC4B00            mov edx, dword ptr [004BCCA4]
:00482320 8955E4                  mov dword ptr [ebp-1C], edx
:00482323 8B15A8CC4B00            mov edx, dword ptr [004BCCA8]
:00482329 8955E0                  mov dword ptr [ebp-20], edx
:0048232C 8B7D08                  mov edi, dword ptr [ebp+08]
:0048232F 893DA4CC4B00            mov dword ptr [004BCCA4], edi
:00482335 8B5510                  mov edx, dword ptr [ebp+10]
:00482338 8915A8CC4B00            mov dword ptr [004BCCA8], edx
:0048233E 894DFC                  mov dword ptr [ebp-04], ecx
:00482341 C745FC01000000          mov [ebp-04], 00000001
:00482348 8B4D20                  mov ecx, dword ptr [ebp+20]
:0048234B 51                      push ecx
:0048234C 8B551C                  mov edx, dword ptr [ebp+1C]
:0048234F 52                      push edx
:00482350 50                      push eax
:00482351 8B4514                  mov eax, dword ptr [ebp+14]
:00482354 50                      push eax
:00482355 56                      push esi
:00482356 E825E9FFFF              call 00480C80
:0048235B 83C414                  add esp, 00000014
:0048235E 8BD8                    mov ebx, eax
:00482360 895DD4                  mov dword ptr [ebp-2C], ebx
:00482363 C745FC00000000          mov [ebp-04], 00000000
:0048236A C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00482371 E854000000              call 004823CA
:00482376 8BC3                    mov eax, ebx
:00482378 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0048237B 64890D00000000          mov dword ptr fs:[00000000], ecx
:00482382 5F                      pop edi
:00482383 5E                      pop esi
:00482384 5B                      pop ebx
:00482385 8BE5                    mov esp, ebp
:00482387 5D                      pop ebp
:00482388 C3                      ret


:00482389 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0048238C 51                      push ecx
:0048238D E89E000000              call 00482430
:00482392 83C404                  add esp, 00000004
:00482395 C3                      ret


:00482396 8B65E8                  mov esp, dword ptr [ebp-18]
:00482399 C745D400000000          mov [ebp-2C], 00000000
:004823A0 6AFF                    push FFFFFFFF
:004823A2 8D55F0                  lea edx, dword ptr [ebp-10]
:004823A5 52                      push edx
:004823A6 E887EBFFFF              call 00480F32
:004823AB 83C408                  add esp, 00000008
:004823AE 33C0                    xor eax, eax
:004823B0 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004823B3 64890D00000000          mov dword ptr fs:[00000000], ecx
:004823BA 5F                      pop edi
:004823BB 5E                      pop esi
:004823BC 5B                      pop ebx
:004823BD 8BE5                    mov esp, ebp
:004823BF 5D                      pop ebp
:004823C0 C3                      ret


:004823C1 8B750C                  mov esi, dword ptr [ebp+0C]
:004823C4 8B7D08                  mov edi, dword ptr [ebp+08]
:004823C7 8B5DD4                  mov ebx, dword ptr [ebp-2C]

* Referenced by a CALL at Address:
|:00482371   
|
:004823CA 8B45D8                  mov eax, dword ptr [ebp-28]
:004823CD 8946FC                  mov dword ptr [esi-04], eax
:004823D0 8B4DE4                  mov ecx, dword ptr [ebp-1C]
:004823D3 890DA4CC4B00            mov dword ptr [004BCCA4], ecx
:004823D9 8B55E0                  mov edx, dword ptr [ebp-20]
:004823DC 8915A8CC4B00            mov dword ptr [004BCCA8], edx
:004823E2 813F63736DE0            cmp dword ptr [edi], E06D7363
:004823E8 7529                    jne 00482413
:004823EA 837F1003                cmp dword ptr [edi+10], 00000003
:004823EE 7523                    jne 00482413
:004823F0 817F1420059319          cmp dword ptr [edi+14], 19930520
:004823F7 751A                    jne 00482413
:004823F9 8B45DC                  mov eax, dword ptr [ebp-24]
:004823FC 85C0                    test eax, eax
:004823FE 7513                    jne 00482413
:00482400 85DB                    test ebx, ebx
:00482402 740F                    je 00482413
:00482404 E891EBFFFF              call 00480F9A
:00482409 50                      push eax
:0048240A 57                      push edi
:0048240B E860020000              call 00482670
:00482410 83C408                  add esp, 00000008

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004823E8(C), :004823EE(C), :004823F7(C), :004823FE(C), :00482402(C)
|
:00482413 C3                      ret
:00482414 8BC3                    mov eax, ebx
:00482416 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00482419 64890D00000000          mov dword ptr fs:[00000000], ecx
:00482420 5F                      pop edi
:00482421 5E                      pop esi
:00482422 5B                      pop ebx
:00482423 8BE5                    mov esp, ebp
:00482425 5D                      pop ebp
:00482426 C3                      ret


:00482427 90                      nop
:00482428 90                      nop
:00482429 90                      nop
:0048242A 90                      nop
:0048242B 90                      nop
:0048242C 90                      nop
:0048242D 90                      nop
:0048242E 90                      nop
:0048242F 90                      nop

* Referenced by a CALL at Address:
|:0048238D   
|
:00482430 8B442404                mov eax, dword ptr [esp+04]
:00482434 8B00                    mov eax, dword ptr [eax]
:00482436 813863736DE0            cmp dword ptr [eax], E06D7363
:0048243C 751C                    jne 0048245A
:0048243E 83781003                cmp dword ptr [eax+10], 00000003
:00482442 7516                    jne 0048245A
:00482444 81781420059319          cmp dword ptr [eax+14], 19930520
:0048244B 750D                    jne 0048245A
:0048244D 8B481C                  mov ecx, dword ptr [eax+1C]
:00482450 85C9                    test ecx, ecx
:00482452 7506                    jne 0048245A
:00482454 B801000000              mov eax, 00000001
:00482459 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0048243C(C), :00482442(C), :0048244B(C), :00482452(C)
|
:0048245A 33C0                    xor eax, eax
:0048245C C3                      ret


:0048245D 90                      nop
:0048245E 90                      nop
:0048245F 90                      nop

* Referenced by a CALL at Address:
|:0048226C   
|
:00482460 55                      push ebp
:00482461 8BEC                    mov ebp, esp
:00482463 6AFF                    push FFFFFFFF
:00482465 68E0774800              push 004877E0
:0048246A 68082C4800              push 00482C08
:0048246F 64A100000000            mov eax, dword ptr fs:[00000000]
:00482475 50                      push eax
:00482476 64892500000000          mov dword ptr fs:[00000000], esp
:0048247D 83C4F4                  add esp, FFFFFFF4
:00482480 53                      push ebx
:00482481 56                      push esi
:00482482 57                      push edi
:00482483 8965E8                  mov dword ptr [ebp-18], esp
:00482486 8B4D10                  mov ecx, dword ptr [ebp+10]
:00482489 8B4104                  mov eax, dword ptr [ecx+04]
:0048248C 85C0                    test eax, eax
:0048248E 0F84BC010000            je 00482650
:00482494 8A5008                  mov dl, byte ptr [eax+08]
:00482497 84D2                    test dl, dl
:00482499 0F84B1010000            je 00482650
:0048249F 8B4108                  mov eax, dword ptr [ecx+08]
:004824A2 85C0                    test eax, eax
:004824A4 0F84A6010000            je 00482650
:004824AA 8B550C                  mov edx, dword ptr [ebp+0C]
:004824AD 8D74020C                lea esi, dword ptr [edx+eax+0C]
:004824B1 C745FC00000000          mov [ebp-04], 00000000
:004824B8 F60108                  test byte ptr [ecx], 08
:004824BB 7448                    je 00482505
:004824BD 8B7D08                  mov edi, dword ptr [ebp+08]
:004824C0 6A01                    push 00000001
:004824C2 8B4718                  mov eax, dword ptr [edi+18]
:004824C5 50                      push eax
:004824C6 E855190000              call 00483E20
:004824CB 83C408                  add esp, 00000008
:004824CE 85C0                    test eax, eax
:004824D0 0F845E010000            je 00482634
:004824D6 6A01                    push 00000001
:004824D8 56                      push esi
:004824D9 E862190000              call 00483E40
:004824DE 83C408                  add esp, 00000008
:004824E1 85C0                    test eax, eax
:004824E3 0F844B010000            je 00482634
:004824E9 8B4718                  mov eax, dword ptr [edi+18]
:004824EC 8906                    mov dword ptr [esi], eax
:004824EE 8B4D14                  mov ecx, dword ptr [ebp+14]
:004824F1 83C108                  add ecx, 00000008
:004824F4 51                      push ecx
:004824F5 50                      push eax
:004824F6 E8F5010000              call 004826F0
:004824FB 83C408                  add esp, 00000008
:004824FE 8906                    mov dword ptr [esi], eax
:00482500 E944010000              jmp 00482649

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004824BB(C)
|
:00482505 8B7D14                  mov edi, dword ptr [ebp+14]
:00482508 F60701                  test byte ptr [edi], 01
:0048250B 7465                    je 00482572
:0048250D 8B5D08                  mov ebx, dword ptr [ebp+08]
:00482510 6A01                    push 00000001
:00482512 8B5318                  mov edx, dword ptr [ebx+18]
:00482515 52                      push edx
:00482516 E805190000              call 00483E20
:0048251B 83C408                  add esp, 00000008
:0048251E 85C0                    test eax, eax
:00482520 0F840E010000            je 00482634
:00482526 6A01                    push 00000001
:00482528 56                      push esi
:00482529 E812190000              call 00483E40
:0048252E 83C408                  add esp, 00000008
:00482531 85C0                    test eax, eax
:00482533 0F84FB000000            je 00482634
:00482539 8B4714                  mov eax, dword ptr [edi+14]
:0048253C 50                      push eax
:0048253D 8B4B18                  mov ecx, dword ptr [ebx+18]
:00482540 51                      push ecx
:00482541 56                      push esi
:00482542 E899F4FFFF              call 004819E0
:00482547 83C40C                  add esp, 0000000C
:0048254A 837F1404                cmp dword ptr [edi+14], 00000004
:0048254E 0F85F5000000            jne 00482649
:00482554 8B06                    mov eax, dword ptr [esi]
:00482556 85C0                    test eax, eax
:00482558 0F84EB000000            je 00482649
:0048255E 83C708                  add edi, 00000008
:00482561 57                      push edi
:00482562 50                      push eax
:00482563 E888010000              call 004826F0
:00482568 83C408                  add esp, 00000008
:0048256B 8906                    mov dword ptr [esi], eax
:0048256D E9D7000000              jmp 00482649

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048250B(C)
|
:00482572 8B4718                  mov eax, dword ptr [edi+18]
:00482575 85C0                    test eax, eax
:00482577 8B5D08                  mov ebx, dword ptr [ebp+08]
:0048257A 6A01                    push 00000001
:0048257C 8B5318                  mov edx, dword ptr [ebx+18]
:0048257F 52                      push edx
:00482580 7546                    jne 004825C8
:00482582 E899180000              call 00483E20
:00482587 83C408                  add esp, 00000008
:0048258A 85C0                    test eax, eax
:0048258C 0F84A2000000            je 00482634
:00482592 6A01                    push 00000001
:00482594 56                      push esi
:00482595 E8A6180000              call 00483E40
:0048259A 83C408                  add esp, 00000008
:0048259D 85C0                    test eax, eax
:0048259F 0F848F000000            je 00482634
:004825A5 8B4714                  mov eax, dword ptr [edi+14]
:004825A8 50                      push eax
:004825A9 83C708                  add edi, 00000008
:004825AC 57                      push edi
:004825AD 8B4B18                  mov ecx, dword ptr [ebx+18]
:004825B0 51                      push ecx
:004825B1 E83A010000              call 004826F0
:004825B6 83C408                  add esp, 00000008
:004825B9 50                      push eax
:004825BA 56                      push esi
:004825BB E820F4FFFF              call 004819E0
:004825C0 83C40C                  add esp, 0000000C
:004825C3 E981000000              jmp 00482649

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482580(C)
|
:004825C8 E853180000              call 00483E20
:004825CD 83C408                  add esp, 00000008
:004825D0 85C0                    test eax, eax
:004825D2 7460                    je 00482634
:004825D4 6A01                    push 00000001
:004825D6 56                      push esi
:004825D7 E864180000              call 00483E40
:004825DC 83C408                  add esp, 00000008
:004825DF 85C0                    test eax, eax
:004825E1 7451                    je 00482634
:004825E3 8B4718                  mov eax, dword ptr [edi+18]
:004825E6 50                      push eax
:004825E7 E874180000              call 00483E60
:004825EC 83C404                  add esp, 00000004
:004825EF 85C0                    test eax, eax
:004825F1 7441                    je 00482634
:004825F3 F60704                  test byte ptr [edi], 04
:004825F6 741F                    je 00482617
:004825F8 6A01                    push 00000001
:004825FA 8D4F08                  lea ecx, dword ptr [edi+08]
:004825FD 51                      push ecx
:004825FE 8B5318                  mov edx, dword ptr [ebx+18]
:00482601 52                      push edx
:00482602 E8E9000000              call 004826F0
:00482607 83C408                  add esp, 00000008
:0048260A 50                      push eax
:0048260B 8B4718                  mov eax, dword ptr [edi+18]
:0048260E 50                      push eax
:0048260F 56                      push esi
:00482610 E8BBE5FFFF              call 00480BD0
:00482615 EB32                    jmp 00482649

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004825F6(C)
|
:00482617 8D4F08                  lea ecx, dword ptr [edi+08]
:0048261A 51                      push ecx
:0048261B 8B5318                  mov edx, dword ptr [ebx+18]
:0048261E 52                      push edx
:0048261F E8CC000000              call 004826F0
:00482624 83C408                  add esp, 00000008
:00482627 50                      push eax
:00482628 8B4718                  mov eax, dword ptr [edi+18]
:0048262B 50                      push eax
:0048262C 56                      push esi
:0048262D E89EE5FFFF              call 00480BD0
:00482632 EB15                    jmp 00482649

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004824D0(C), :004824E3(C), :00482520(C), :00482533(C), :0048258C(C)
|:0048259F(C), :004825D2(C), :004825E1(C), :004825F1(C)
|
:00482634 E8C7010000              call 00482800
:00482639 EB0E                    jmp 00482649
:0048263B B801000000              mov eax, 00000001
:00482640 C3                      ret


:00482641 8B65E8                  mov esp, dword ptr [ebp-18]
:00482644 E827010000              call 00482770

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00482500(U), :0048254E(C), :00482558(C), :0048256D(U), :004825C3(U)
|:00482615(U), :00482632(U), :00482639(U)
|
:00482649 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0048248E(C), :00482499(C), :004824A4(C)
|
:00482650 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00482653 64890D00000000          mov dword ptr fs:[00000000], ecx
:0048265A 5F                      pop edi
:0048265B 5E                      pop esi
:0048265C 5B                      pop ebx
:0048265D 8BE5                    mov esp, ebp
:0048265F 5D                      pop ebp
:00482660 C3                      ret


:00482661 90                      nop
:00482662 90                      nop
:00482663 90                      nop
:00482664 90                      nop
:00482665 90                      nop
:00482666 90                      nop
:00482667 90                      nop
:00482668 90                      nop
:00482669 90                      nop
:0048266A 90                      nop
:0048266B 90                      nop
:0048266C 90                      nop
:0048266D 90                      nop
:0048266E 90                      nop
:0048266F 90                      nop

* Referenced by a CALL at Addresses:
|:0048204B   , :0048240B   
|
:00482670 55                      push ebp
:00482671 8BEC                    mov ebp, esp
:00482673 6AFF                    push FFFFFFFF
:00482675 68F0774800              push 004877F0
:0048267A 68082C4800              push 00482C08
:0048267F 64A100000000            mov eax, dword ptr fs:[00000000]
:00482685 50                      push eax
:00482686 64892500000000          mov dword ptr fs:[00000000], esp
:0048268D 83EC08                  sub esp, 00000008
:00482690 53                      push ebx
:00482691 56                      push esi
:00482692 57                      push edi
:00482693 8965E8                  mov dword ptr [ebp-18], esp
:00482696 8B4D08                  mov ecx, dword ptr [ebp+08]
:00482699 85C9                    test ecx, ecx
:0048269B 7437                    je 004826D4
:0048269D 8B411C                  mov eax, dword ptr [ecx+1C]
:004826A0 8B4004                  mov eax, dword ptr [eax+04]
:004826A3 85C0                    test eax, eax
:004826A5 742D                    je 004826D4
:004826A7 C745FC00000000          mov [ebp-04], 00000000
:004826AE 50                      push eax
:004826AF 8B4918                  mov ecx, dword ptr [ecx+18]
:004826B2 51                      push ecx
:004826B3 E818E5FFFF              call 00480BD0
:004826B8 EB13                    jmp 004826CD
:004826BA 33C0                    xor eax, eax
:004826BC 8A4D0C                  mov cl, byte ptr [ebp+0C]
:004826BF 84C9                    test cl, cl
:004826C1 0F95C0                  setne al
:004826C4 C3                      ret


:004826C5 8B65E8                  mov esp, dword ptr [ebp-18]
:004826C8 E8A3000000              call 00482770

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004826B8(U)
|
:004826CD C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0048269B(C), :004826A5(C)
|
:004826D4 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004826D7 64890D00000000          mov dword ptr fs:[00000000], ecx
:004826DE 5F                      pop edi
:004826DF 5E                      pop esi
:004826E0 5B                      pop ebx
:004826E1 8BE5                    mov esp, ebp
:004826E3 5D                      pop ebp
:004826E4 C3                      ret


:004826E5 90                      nop
:004826E6 90                      nop
:004826E7 90                      nop
:004826E8 90                      nop
:004826E9 90                      nop
:004826EA 90                      nop
:004826EB 90                      nop
:004826EC 90                      nop
:004826ED 90                      nop
:004826EE 90                      nop
:004826EF 90                      nop

* Referenced by a CALL at Addresses:
|:004824F6   , :00482563   , :004825B1   , :00482602   , :0048261F   
|
:004826F0 8B542408                mov edx, dword ptr [esp+08]
:004826F4 56                      push esi
:004826F5 8B742408                mov esi, dword ptr [esp+08]
:004826F9 8B0A                    mov ecx, dword ptr [edx]
:004826FB 8BC6                    mov eax, esi
:004826FD 03C1                    add eax, ecx
:004826FF 8B4A04                  mov ecx, dword ptr [edx+04]
:00482702 85C9                    test ecx, ecx
:00482704 7C0D                    jl 00482713
:00482706 8B340E                  mov esi, dword ptr [esi+ecx]
:00482709 8B5208                  mov edx, dword ptr [edx+08]
:0048270C 8B1416                  mov edx, dword ptr [esi+edx]
:0048270F 03D1                    add edx, ecx
:00482711 03C2                    add eax, edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482704(C)
|
:00482713 5E                      pop esi
:00482714 C3                      ret


:00482715 90                      nop
:00482716 90                      nop
:00482717 90                      nop
:00482718 90                      nop
:00482719 90                      nop
:0048271A 90                      nop
:0048271B 90                      nop
:0048271C 90                      nop
:0048271D 90                      nop
:0048271E 90                      nop
:0048271F 90                      nop

* Referenced by a CALL at Addresses:
|:00480CC5   , :004821CF   
|
:00482720 55                      push ebp
:00482721 8BEC                    mov ebp, esp
:00482723 83EC04                  sub esp, 00000004
:00482726 53                      push ebx
:00482727 51                      push ecx
:00482728 8B450C                  mov eax, dword ptr [ebp+0C]
:0048272B 83C00C                  add eax, 0000000C
:0048272E 8945FC                  mov dword ptr [ebp-04], eax
:00482731 8B4508                  mov eax, dword ptr [ebp+08]
:00482734 55                      push ebp
:00482735 FF7510                  push [ebp+10]
:00482738 8B4D10                  mov ecx, dword ptr [ebp+10]
:0048273B 8B6DFC                  mov ebp, dword ptr [ebp-04]
:0048273E E87AE8FFFF              call 00480FBD
:00482743 56                      push esi
:00482744 57                      push edi
:00482745 FFD0                    call eax
:00482747 5F                      pop edi
:00482748 5E                      pop esi
:00482749 8BDD                    mov ebx, ebp
:0048274B 5D                      pop ebp
:0048274C 8B4D10                  mov ecx, dword ptr [ebp+10]
:0048274F 55                      push ebp
:00482750 8BEB                    mov ebp, ebx
:00482752 81F900010000            cmp ecx, 00000100
:00482758 7505                    jne 0048275F
:0048275A B902000000              mov ecx, 00000002

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482758(C)
|
:0048275F 51                      push ecx
:00482760 E858E8FFFF              call 00480FBD
:00482765 5D                      pop ebp
:00482766 59                      pop ecx
:00482767 5B                      pop ebx
:00482768 C9                      leave
:00482769 C20C00                  ret 000C


:0048276C CC                      int 03
:0048276D CC                      int 03
:0048276E CC                      int 03
:0048276F CC                      int 03

* Referenced by a CALL at Addresses:
|:00482093   , :0048223E   , :00482644   , :004826C8   , :0048286E   
|:004829AE   
|
:00482770 55                      push ebp
:00482771 8BEC                    mov ebp, esp
:00482773 6AFF                    push FFFFFFFF
:00482775 6800784800              push 00487800
:0048277A 68082C4800              push 00482C08
:0048277F 64A100000000            mov eax, dword ptr fs:[00000000]
:00482785 50                      push eax
:00482786 64892500000000          mov dword ptr fs:[00000000], esp
:0048278D 83EC08                  sub esp, 00000008
:00482790 53                      push ebx
:00482791 56                      push esi
:00482792 57                      push edi
:00482793 8965E8                  mov dword ptr [ebp-18], esp
:00482796 C745FC00000000          mov [ebp-04], 00000000
:0048279D A1B0CC4B00              mov eax, dword ptr [004BCCB0]
:004827A2 85C0                    test eax, eax
:004827A4 741B                    je 004827C1
:004827A6 C745FC01000000          mov [ebp-04], 00000001
:004827AD FFD0                    call eax
:004827AF EB09                    jmp 004827BA
:004827B1 B801000000              mov eax, 00000001
:004827B6 C3                      ret


:004827B7 8B65E8                  mov esp, dword ptr [ebp-18]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004827AF(U)
|
:004827BA C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004827A4(C)
|
:004827C1 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:004827C8 E811000000              call 004827DE
:004827CD 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004827D0 64890D00000000          mov dword ptr fs:[00000000], ecx
:004827D7 5F                      pop edi
:004827D8 5E                      pop esi
:004827D9 5B                      pop ebx
:004827DA 8BE5                    mov esp, ebp
:004827DC 5D                      pop ebp
:004827DD C3                      ret



* Referenced by a CALL at Address:
|:004827C8   
|
:004827DE E89D160000              call 00483E80
:004827E3 C3                      ret


:004827E4 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004827E7 64890D00000000          mov dword ptr fs:[00000000], ecx
:004827EE 5F                      pop edi
:004827EF 5E                      pop esi
:004827F0 5B                      pop ebx
:004827F1 8BE5                    mov esp, ebp
:004827F3 5D                      pop ebp
:004827F4 C3                      ret


:004827F5 90                      nop
:004827F6 90                      nop
:004827F7 90                      nop
:004827F8 90                      nop
:004827F9 90                      nop
:004827FA 90                      nop
:004827FB 90                      nop
:004827FC 90                      nop
:004827FD 90                      nop
:004827FE 90                      nop
:004827FF 90                      nop

* Referenced by a CALL at Addresses:
|:00480E94   , :00480EDA   , :00481D2D   , :00481E10   , :00481E6C   
|:00481E8E   , :004821B1   , :00482634   
|
:00482800 55                      push ebp
:00482801 8BEC                    mov ebp, esp
:00482803 6AFF                    push FFFFFFFF
:00482805 6818784800              push 00487818
:0048280A 68082C4800              push 00482C08
:0048280F 64A100000000            mov eax, dword ptr fs:[00000000]
:00482815 50                      push eax
:00482816 64892500000000          mov dword ptr fs:[00000000], esp
:0048281D 83EC08                  sub esp, 00000008
:00482820 53                      push ebx
:00482821 56                      push esi
:00482822 57                      push edi
:00482823 8965E8                  mov dword ptr [ebp-18], esp
:00482826 C745FC00000000          mov [ebp-04], 00000000
:0048282D A144F34800              mov eax, dword ptr [0048F344]
:00482832 85C0                    test eax, eax
:00482834 741B                    je 00482851
:00482836 C745FC01000000          mov [ebp-04], 00000001
:0048283D FFD0                    call eax
:0048283F EB09                    jmp 0048284A
:00482841 B801000000              mov eax, 00000001
:00482846 C3                      ret


:00482847 8B65E8                  mov esp, dword ptr [ebp-18]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048283F(U)
|
:0048284A C745FC00000000          mov [ebp-04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482834(C)
|
:00482851 C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
:00482858 E811000000              call 0048286E
:0048285D 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00482860 64890D00000000          mov dword ptr fs:[00000000], ecx
:00482867 5F                      pop edi
:00482868 5E                      pop esi
:00482869 5B                      pop ebx
:0048286A 8BE5                    mov esp, ebp
:0048286C 5D                      pop ebp
:0048286D C3                      ret



* Referenced by a CALL at Address:
|:00482858   
|
:0048286E E8FDFEFFFF              call 00482770
:00482873 C3                      ret


:00482874 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00482877 64890D00000000          mov dword ptr fs:[00000000], ecx
:0048287E 5F                      pop edi
:0048287F 5E                      pop esi
:00482880 5B                      pop ebx
:00482881 8BE5                    mov esp, ebp
:00482883 5D                      pop ebp
:00482884 C3                      ret


:00482885 90                      nop
:00482886 90                      nop
:00482887 90                      nop
:00482888 90                      nop
:00482889 90                      nop
:0048288A 90                      nop
:0048288B 90                      nop
:0048288C 90                      nop
:0048288D 90                      nop
:0048288E 90                      nop
:0048288F 90                      nop

* Referenced by a CALL at Addresses:
|:00481125   , :00482A34   , :00483008   , :0048304C   , :00483114   
|:00483407   , :00483481   , :004839CC   , :00483A77   , :0048477F   
|:00484820   
|
:00482890 A10CD04B00              mov eax, dword ptr [004BD00C]
:00482895 8B4C2404                mov ecx, dword ptr [esp+04]
:00482899 50                      push eax
:0048289A 51                      push ecx
:0048289B E810000000              call 004828B0
:004828A0 83C408                  add esp, 00000008
:004828A3 C3                      ret


:004828A4 90                      nop
:004828A5 90                      nop
:004828A6 90                      nop
:004828A7 90                      nop
:004828A8 90                      nop
:004828A9 90                      nop
:004828AA 90                      nop
:004828AB 90                      nop
:004828AC 90                      nop
:004828AD 90                      nop
:004828AE 90                      nop
:004828AF 90                      nop

* Referenced by a CALL at Addresses:
|:00480FE7   , :0048289B   
|
:004828B0 56                      push esi
:004828B1 8B742408                mov esi, dword ptr [esp+08]
:004828B5 83FEE0                  cmp esi, FFFFFFE0
:004828B8 57                      push edi
:004828B9 7734                    ja 004828EF
:004828BB 85F6                    test esi, esi
:004828BD 7505                    jne 004828C4
:004828BF BE01000000              mov esi, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004828BD(C)
|
:004828C4 8B7C2410                mov edi, dword ptr [esp+10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004828ED(C)
|
:004828C8 83FEE0                  cmp esi, FFFFFFE0
:004828CB 770B                    ja 004828D8
:004828CD 56                      push esi
:004828CE E82D000000              call 00482900
:004828D3 83C404                  add esp, 00000004
:004828D6 EB02                    jmp 004828DA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004828CB(C)
|
:004828D8 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004828D6(U)
|
:004828DA 85C0                    test eax, eax
:004828DC 7513                    jne 004828F1
:004828DE 85FF                    test edi, edi
:004828E0 740F                    je 004828F1
:004828E2 56                      push esi
:004828E3 E818E7FFFF              call 00481000
:004828E8 83C404                  add esp, 00000004
:004828EB 85C0                    test eax, eax
:004828ED 75D9                    jne 004828C8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004828B9(C)
|
:004828EF 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004828DC(C), :004828E0(C)
|
:004828F1 5F                      pop edi
:004828F2 5E                      pop esi
:004828F3 C3                      ret


:004828F4 90                      nop
:004828F5 90                      nop
:004828F6 90                      nop
:004828F7 90                      nop
:004828F8 90                      nop
:004828F9 90                      nop
:004828FA 90                      nop
:004828FB 90                      nop
:004828FC 90                      nop
:004828FD 90                      nop
:004828FE 90                      nop
:004828FF 90                      nop

* Referenced by a CALL at Address:
|:004828CE   
|
:00482900 8B442404                mov eax, dword ptr [esp+04]
:00482904 56                      push esi
:00482905 8D700F                  lea esi, dword ptr [eax+0F]
:00482908 A18C154900              mov eax, dword ptr [0049158C]
:0048290D 83E6F0                  and esi, FFFFFFF0
:00482910 3BF0                    cmp esi, eax
:00482912 7712                    ja 00482926
:00482914 8BCE                    mov ecx, esi
:00482916 C1E904                  shr ecx, 04
:00482919 51                      push ecx
:0048291A E8E1180000              call 00484200
:0048291F 83C404                  add esp, 00000004
:00482922 85C0                    test eax, eax
:00482924 7510                    jne 00482936

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482912(C)
|
:00482926 8B1564D74B00            mov edx, dword ptr [004BD764]
:0048292C 56                      push esi
:0048292D 6A00                    push 00000000
:0048292F 52                      push edx
:00482930 FF159C614800            call dword ptr [0048619C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482924(C)
|
:00482936 5E                      pop esi
:00482937 C3                      ret


:00482938 90                      nop
:00482939 90                      nop
:0048293A 90                      nop
:0048293B 90                      nop
:0048293C 90                      nop
:0048293D 90                      nop
:0048293E 90                      nop
:0048293F 90                      nop

* Referenced by a CALL at Addresses:
|:00481025   , :00482A4D   , :004830A0   , :0048342C   , :00484800   
|:0048480D   , :00484899   , :004848A6   , :00484A77   , :00484A8C   
|
:00482940 51                      push ecx
:00482941 56                      push esi
:00482942 8B74240C                mov esi, dword ptr [esp+0C]
:00482946 85F6                    test esi, esi
:00482948 743D                    je 00482987
:0048294A 8D44240C                lea eax, dword ptr [esp+0C]
:0048294E 8D4C2404                lea ecx, dword ptr [esp+04]
:00482952 50                      push eax
:00482953 51                      push ecx
:00482954 56                      push esi
:00482955 E8E6170000              call 00484140
:0048295A 83C40C                  add esp, 0000000C
:0048295D 85C0                    test eax, eax
:0048295F 7416                    je 00482977
:00482961 8B54240C                mov edx, dword ptr [esp+0C]
:00482965 50                      push eax
:00482966 8B442408                mov eax, dword ptr [esp+08]
:0048296A 52                      push edx
:0048296B 50                      push eax
:0048296C E82F180000              call 004841A0
:00482971 83C40C                  add esp, 0000000C
:00482974 5E                      pop esi
:00482975 59                      pop ecx
:00482976 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048295F(C)
|
:00482977 8B0D64D74B00            mov ecx, dword ptr [004BD764]
:0048297D 56                      push esi
:0048297E 6A00                    push 00000000
:00482980 51                      push ecx
:00482981 FF1598614800            call dword ptr [00486198]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482948(C)
|
:00482987 5E                      pop esi
:00482988 59                      pop ecx
:00482989 C3                      ret


:0048298A 90                      nop
:0048298B 90                      nop
:0048298C 90                      nop
:0048298D 90                      nop
:0048298E 90                      nop
:0048298F 90                      nop
:00482990 56                      push esi
:00482991 8B742408                mov esi, dword ptr [esp+08]
:00482995 8B06                    mov eax, dword ptr [esi]
:00482997 813863736DE0            cmp dword ptr [eax], E06D7363
:0048299D 751D                    jne 004829BC
:0048299F 83781003                cmp dword ptr [eax+10], 00000003
:004829A3 7517                    jne 004829BC
:004829A5 81781420059319          cmp dword ptr [eax+14], 19930520
:004829AC 750E                    jne 004829BC
:004829AE E8BDFDFFFF              call 00482770
:004829B3 B801000000              mov eax, 00000001
:004829B8 5E                      pop esi
:004829B9 C20400                  ret 0004



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0048299D(C), :004829A3(C), :004829AC(C)
|
:004829BC A1B4CC4B00              mov eax, dword ptr [004BCCB4]
:004829C1 85C0                    test eax, eax
:004829C3 7418                    je 004829DD
:004829C5 50                      push eax
:004829C6 E895140000              call 00483E60
:004829CB 83C404                  add esp, 00000004
:004829CE 85C0                    test eax, eax
:004829D0 740B                    je 004829DD
:004829D2 56                      push esi
:004829D3 FF15B4CC4B00            call dword ptr [004BCCB4]
:004829D9 5E                      pop esi
:004829DA C20400                  ret 0004



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004829C3(C), :004829D0(C)
|
:004829DD 33C0                    xor eax, eax
:004829DF 5E                      pop esi
:004829E0 C20400                  ret 0004


:004829E3 90                      nop
:004829E4 90                      nop
:004829E5 90                      nop
:004829E6 90                      nop
:004829E7 90                      nop
:004829E8 90                      nop
:004829E9 90                      nop
:004829EA 90                      nop
:004829EB 90                      nop
:004829EC 90                      nop
:004829ED 90                      nop
:004829EE 90                      nop
:004829EF 90                      nop
:004829F0 6890294800              push 00482990
:004829F5 FF1594614800            call dword ptr [00486194]
:004829FB A3B4CC4B00              mov dword ptr [004BCCB4], eax
:00482A00 C3                      ret


:00482A01 90                      nop
:00482A02 90                      nop
:00482A03 90                      nop
:00482A04 90                      nop
:00482A05 90                      nop
:00482A06 90                      nop
:00482A07 90                      nop
:00482A08 90                      nop
:00482A09 90                      nop
:00482A0A 90                      nop
:00482A0B 90                      nop
:00482A0C 90                      nop
:00482A0D 90                      nop
:00482A0E 90                      nop
:00482A0F 90                      nop
:00482A10 A1B4CC4B00              mov eax, dword ptr [004BCCB4]
:00482A15 50                      push eax
:00482A16 FF1594614800            call dword ptr [00486194]
:00482A1C C3                      ret


:00482A1D 90                      nop
:00482A1E 90                      nop
:00482A1F 90                      nop

* Referenced by a CALL at Address:
|:004810BA   
|
:00482A20 83EC08                  sub esp, 00000008
:00482A23 53                      push ebx
:00482A24 55                      push ebp
:00482A25 56                      push esi
:00482A26 57                      push edi
:00482A27 8B7C241C                mov edi, dword ptr [esp+1C]
:00482A2B 85FF                    test edi, edi
:00482A2D 7515                    jne 00482A44
:00482A2F 8B442420                mov eax, dword ptr [esp+20]
:00482A33 50                      push eax
:00482A34 E857FEFFFF              call 00482890
:00482A39 83C404                  add esp, 00000004
:00482A3C 5F                      pop edi
:00482A3D 5E                      pop esi
:00482A3E 5D                      pop ebp
:00482A3F 5B                      pop ebx
:00482A40 83C408                  add esp, 00000008
:00482A43 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482A2D(C)
|
:00482A44 8B6C2420                mov ebp, dword ptr [esp+20]
:00482A48 85ED                    test ebp, ebp
:00482A4A 7513                    jne 00482A5F
:00482A4C 57                      push edi
:00482A4D E8EEFEFFFF              call 00482940
:00482A52 83C404                  add esp, 00000004
:00482A55 33C0                    xor eax, eax
:00482A57 5F                      pop edi
:00482A58 5E                      pop esi
:00482A59 5D                      pop ebp
:00482A5A 5B                      pop ebx
:00482A5B 83C408                  add esp, 00000008
:00482A5E C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482A4A(C)
|
:00482A5F 83FDE0                  cmp ebp, FFFFFFE0
:00482A62 7717                    ja 00482A7B
:00482A64 85ED                    test ebp, ebp
:00482A66 7608                    jbe 00482A70
:00482A68 83C50F                  add ebp, 0000000F
:00482A6B 83E5F0                  and ebp, FFFFFFF0
:00482A6E EB0B                    jmp 00482A7B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482A66(C)
|
:00482A70 BD10000000              mov ebp, 00000010
:00482A75 EB04                    jmp 00482A7B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482BA2(C)
|
:00482A77 8B7C241C                mov edi, dword ptr [esp+1C]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00482A62(C), :00482A6E(U), :00482A75(U)
|
:00482A7B 33DB                    xor ebx, ebx
:00482A7D 83FDE0                  cmp ebp, FFFFFFE0
:00482A80 0F8704010000            ja 00482B8A
:00482A86 8D4C2410                lea ecx, dword ptr [esp+10]
:00482A8A 8D542414                lea edx, dword ptr [esp+14]
:00482A8E 51                      push ecx
:00482A8F 52                      push edx
:00482A90 57                      push edi
:00482A91 E8AA160000              call 00484140
:00482A96 8BF0                    mov esi, eax
:00482A98 83C40C                  add esp, 0000000C
:00482A9B 85F6                    test esi, esi
:00482A9D 89742420                mov dword ptr [esp+20], esi
:00482AA1 0F84D1000000            je 00482B78
:00482AA7 3B2D8C154900            cmp ebp, dword ptr [0049158C]
:00482AAD 7370                    jnb 00482B1F
:00482AAF 8B442410                mov eax, dword ptr [esp+10]
:00482AB3 8B4C2414                mov ecx, dword ptr [esp+14]
:00482AB7 8BFD                    mov edi, ebp
:00482AB9 C1EF04                  shr edi, 04
:00482ABC 57                      push edi
:00482ABD 56                      push esi
:00482ABE 50                      push eax
:00482ABF 51                      push ecx
:00482AC0 E8FB1A0000              call 004845C0
:00482AC5 83C410                  add esp, 00000010
:00482AC8 85C0                    test eax, eax
:00482ACA 7406                    je 00482AD2
:00482ACC 8B5C241C                mov ebx, dword ptr [esp+1C]
:00482AD0 EB4D                    jmp 00482B1F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482ACA(C)
|
:00482AD2 57                      push edi
:00482AD3 E828170000              call 00484200
:00482AD8 8BD8                    mov ebx, eax
:00482ADA 83C404                  add esp, 00000004
:00482ADD 85DB                    test ebx, ebx
:00482ADF 7446                    je 00482B27
:00482AE1 33C0                    xor eax, eax
:00482AE3 8A06                    mov al, byte ptr [esi]
:00482AE5 C1E004                  shl eax, 04
:00482AE8 3BC5                    cmp eax, ebp
:00482AEA 7202                    jb 00482AEE
:00482AEC 8BC5                    mov eax, ebp

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482AEA(C)
|
:00482AEE 8B74241C                mov esi, dword ptr [esp+1C]
:00482AF2 8BC8                    mov ecx, eax
:00482AF4 8BD1                    mov edx, ecx
:00482AF6 8BFB                    mov edi, ebx
:00482AF8 C1E902                  shr ecx, 02
:00482AFB F3                      repz
:00482AFC A5                      movsd
:00482AFD 8B442420                mov eax, dword ptr [esp+20]
:00482B01 8BCA                    mov ecx, edx
:00482B03 83E103                  and ecx, 00000003
:00482B06 50                      push eax
:00482B07 F3                      repz
:00482B08 A4                      movsb
:00482B09 8B4C2414                mov ecx, dword ptr [esp+14]
:00482B0D 8B542418                mov edx, dword ptr [esp+18]
:00482B11 51                      push ecx
:00482B12 52                      push edx
:00482B13 E888160000              call 004841A0
:00482B18 8B74242C                mov esi, dword ptr [esp+2C]
:00482B1C 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00482AAD(C), :00482AD0(U)
|
:00482B1F 85DB                    test ebx, ebx
:00482B21 0F8589000000            jne 00482BB0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482ADF(C)
|
:00482B27 A164D74B00              mov eax, dword ptr [004BD764]
:00482B2C 55                      push ebp
:00482B2D 6A00                    push 00000000
:00482B2F 50                      push eax
:00482B30 FF159C614800            call dword ptr [0048619C]
:00482B36 8BD8                    mov ebx, eax
:00482B38 85DB                    test ebx, ebx
:00482B3A 7452                    je 00482B8E
:00482B3C 33C0                    xor eax, eax
:00482B3E 8A06                    mov al, byte ptr [esi]
:00482B40 C1E004                  shl eax, 04
:00482B43 3BC5                    cmp eax, ebp
:00482B45 7202                    jb 00482B49
:00482B47 8BC5                    mov eax, ebp

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482B45(C)
|
:00482B49 8B74241C                mov esi, dword ptr [esp+1C]
:00482B4D 8BC8                    mov ecx, eax
:00482B4F 8BD1                    mov edx, ecx
:00482B51 8BFB                    mov edi, ebx
:00482B53 C1E902                  shr ecx, 02
:00482B56 F3                      repz
:00482B57 A5                      movsd
:00482B58 8B442420                mov eax, dword ptr [esp+20]
:00482B5C 8BCA                    mov ecx, edx
:00482B5E 83E103                  and ecx, 00000003
:00482B61 50                      push eax
:00482B62 F3                      repz
:00482B63 A4                      movsb
:00482B64 8B4C2414                mov ecx, dword ptr [esp+14]
:00482B68 8B542418                mov edx, dword ptr [esp+18]
:00482B6C 51                      push ecx
:00482B6D 52                      push edx
:00482B6E E82D160000              call 004841A0
:00482B73 83C40C                  add esp, 0000000C
:00482B76 EB12                    jmp 00482B8A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482AA1(C)
|
:00482B78 A164D74B00              mov eax, dword ptr [004BD764]
:00482B7D 55                      push ebp
:00482B7E 57                      push edi
:00482B7F 6A00                    push 00000000
:00482B81 50                      push eax
:00482B82 FF1590614800            call dword ptr [00486190]
:00482B88 8BD8                    mov ebx, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00482A80(C), :00482B76(U)
|
:00482B8A 85DB                    test ebx, ebx
:00482B8C 7522                    jne 00482BB0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482B3A(C)
|
:00482B8E A10CD04B00              mov eax, dword ptr [004BD00C]
:00482B93 85C0                    test eax, eax
:00482B95 7419                    je 00482BB0
:00482B97 55                      push ebp
:00482B98 E863E4FFFF              call 00481000
:00482B9D 83C404                  add esp, 00000004
:00482BA0 85C0                    test eax, eax
:00482BA2 0F85CFFEFFFF            jne 00482A77
:00482BA8 5F                      pop edi
:00482BA9 5E                      pop esi
:00482BAA 5D                      pop ebp
:00482BAB 5B                      pop ebx
:00482BAC 83C408                  add esp, 00000008
:00482BAF C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00482B21(C), :00482B8C(C), :00482B95(C)
|
:00482BB0 5F                      pop edi
:00482BB1 5E                      pop esi
:00482BB2 8BC3                    mov eax, ebx
:00482BB4 5D                      pop ebp
:00482BB5 5B                      pop ebx
:00482BB6 83C408                  add esp, 00000008
:00482BB9 C3                      ret


:00482BBA 90                      nop
:00482BBB 90                      nop
:00482BBC 90                      nop
:00482BBD 90                      nop
:00482BBE 90                      nop
:00482BBF 90                      nop

* Referenced by a CALL at Addresses:
|:00481087   , :004810A7   
|
:00482BC0 51                      push ecx
:00482BC1 8D442408                lea eax, dword ptr [esp+08]
:00482BC5 56                      push esi
:00482BC6 8B74240C                mov esi, dword ptr [esp+0C]
:00482BCA 8D4C2404                lea ecx, dword ptr [esp+04]
:00482BCE 50                      push eax
:00482BCF 51                      push ecx
:00482BD0 56                      push esi
:00482BD1 E86A150000              call 00484140
:00482BD6 83C40C                  add esp, 0000000C
:00482BD9 85C0                    test eax, eax
:00482BDB 740C                    je 00482BE9
:00482BDD 33D2                    xor edx, edx
:00482BDF 8A10                    mov dl, byte ptr [eax]
:00482BE1 8BC2                    mov eax, edx
:00482BE3 C1E004                  shl eax, 04
:00482BE6 5E                      pop esi
:00482BE7 59                      pop ecx
:00482BE8 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482BDB(C)
|
:00482BE9 A164D74B00              mov eax, dword ptr [004BD764]
:00482BEE 56                      push esi
:00482BEF 6A00                    push 00000000
:00482BF1 50                      push eax
:00482BF2 FF158C614800            call dword ptr [0048618C]
:00482BF8 5E                      pop esi
:00482BF9 59                      pop ecx
:00482BFA C3                      ret


:00482BFB 90                      nop
:00482BFC 90                      nop
:00482BFD 90                      nop
:00482BFE 90                      nop
:00482BFF 90                      nop
:00482C00 56                      push esi
:00482C01 43                      inc ebx
:00482C02 3230                    xor dh, byte ptr [eax]
:00482C04 58                      pop eax
:00482C05 43                      inc ebx
:00482C06 3030                    xor byte ptr [eax], dh
:00482C08 55                      push ebp
:00482C09 8BEC                    mov ebp, esp
:00482C0B 83EC08                  sub esp, 00000008
:00482C0E 53                      push ebx
:00482C0F 56                      push esi
:00482C10 57                      push edi
:00482C11 55                      push ebp
:00482C12 FC                      cld
:00482C13 8B5D0C                  mov ebx, dword ptr [ebp+0C]
:00482C16 8B4508                  mov eax, dword ptr [ebp+08]

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:00482C19 F7400406000000          test [eax+04], 00000006
:00482C20 0F8582000000            jne 00482CA8
:00482C26 8945F8                  mov dword ptr [ebp-08], eax
:00482C29 8B4510                  mov eax, dword ptr [ebp+10]
:00482C2C 8945FC                  mov dword ptr [ebp-04], eax
:00482C2F 8D45F8                  lea eax, dword ptr [ebp-08]
:00482C32 8943FC                  mov dword ptr [ebx-04], eax
:00482C35 8B730C                  mov esi, dword ptr [ebx+0C]
:00482C38 8B7B08                  mov edi, dword ptr [ebx+08]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482C98(U)
|
:00482C3B 83FEFF                  cmp esi, FFFFFFFF
:00482C3E 7461                    je 00482CA1
:00482C40 8D0C76                  lea ecx, dword ptr [esi+2*esi]
:00482C43 837C8F0400              cmp dword ptr [edi+4*ecx+04], 00000000
:00482C48 7445                    je 00482C8F
:00482C4A 56                      push esi
:00482C4B 55                      push ebp
:00482C4C 8D6B10                  lea ebp, dword ptr [ebx+10]
:00482C4F FF548F04                call [edi+4*ecx+04]
:00482C53 5D                      pop ebp
:00482C54 5E                      pop esi
:00482C55 8B5D0C                  mov ebx, dword ptr [ebp+0C]
:00482C58 0BC0                    or eax, eax
:00482C5A 7433                    je 00482C8F
:00482C5C 783C                    js 00482C9A
:00482C5E 8B7B08                  mov edi, dword ptr [ebx+08]
:00482C61 53                      push ebx
:00482C62 E889E2FFFF              call 00480EF0
:00482C67 83C404                  add esp, 00000004
:00482C6A 8D6B10                  lea ebp, dword ptr [ebx+10]
:00482C6D 56                      push esi
:00482C6E 53                      push ebx
:00482C6F E8BEE2FFFF              call 00480F32
:00482C74 83C408                  add esp, 00000008
:00482C77 8D0C76                  lea ecx, dword ptr [esi+2*esi]
:00482C7A 6A01                    push 00000001
:00482C7C 8B448F08                mov eax, dword ptr [edi+4*ecx+08]
:00482C80 E841E3FFFF              call 00480FC6
:00482C85 8B048F                  mov eax, dword ptr [edi+4*ecx]
:00482C88 89430C                  mov dword ptr [ebx+0C], eax
:00482C8B FF548F08                call [edi+4*ecx+08]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00482C48(C), :00482C5A(C)
|
:00482C8F 8B7B08                  mov edi, dword ptr [ebx+08]
:00482C92 8D0C76                  lea ecx, dword ptr [esi+2*esi]
:00482C95 8B348F                  mov esi, dword ptr [edi+4*ecx]
:00482C98 EBA1                    jmp 00482C3B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482C5C(C)
|
:00482C9A B800000000              mov eax, 00000000
:00482C9F EB1C                    jmp 00482CBD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482C3E(C)
|
:00482CA1 B801000000              mov eax, 00000001
:00482CA6 EB15                    jmp 00482CBD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482C20(C)
|
:00482CA8 55                      push ebp
:00482CA9 8D6B10                  lea ebp, dword ptr [ebx+10]
:00482CAC 6AFF                    push FFFFFFFF
:00482CAE 53                      push ebx
:00482CAF E87EE2FFFF              call 00480F32
:00482CB4 83C408                  add esp, 00000008
:00482CB7 5D                      pop ebp
:00482CB8 B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00482C9F(U), :00482CA6(U)
|
:00482CBD 5D                      pop ebp
:00482CBE 5F                      pop edi
:00482CBF 5E                      pop esi
:00482CC0 5B                      pop ebx
:00482CC1 8BE5                    mov esp, ebp
:00482CC3 5D                      pop ebp
:00482CC4 C3                      ret


:00482CC5 55                      push ebp
:00482CC6 8B4C2408                mov ecx, dword ptr [esp+08]
:00482CCA 8B29                    mov ebp, dword ptr [ecx]
:00482CCC 8B411C                  mov eax, dword ptr [ecx+1C]
:00482CCF 50                      push eax
:00482CD0 8B4118                  mov eax, dword ptr [ecx+18]
:00482CD3 50                      push eax
:00482CD4 E859E2FFFF              call 00480F32
:00482CD9 83C408                  add esp, 00000008
:00482CDC 5D                      pop ebp
:00482CDD C20400                  ret 0004



* Referenced by a CALL at Addresses:
|:004817BC   , :004817C6   
|
:00482CE0 A1C0CC4B00              mov eax, dword ptr [004BCCC0]
:00482CE5 83EC08                  sub esp, 00000008
:00482CE8 85C0                    test eax, eax
:00482CEA 53                      push ebx
:00482CEB 751E                    jne 00482D0B
:00482CED 8B442410                mov eax, dword ptr [esp+10]
:00482CF1 83F841                  cmp eax, 00000041
:00482CF4 0F8CDF000000            jl 00482DD9
:00482CFA 83F85A                  cmp eax, 0000005A
:00482CFD 0F8FD6000000            jg 00482DD9
:00482D03 83C020                  add eax, 00000020
:00482D06 5B                      pop ebx
:00482D07 83C408                  add esp, 00000008
:00482D0A C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482CEB(C)
|
:00482D0B 8B5C2410                mov ebx, dword ptr [esp+10]
:00482D0F 81FB00010000            cmp ebx, 00000100
:00482D15 7D2C                    jge 00482D43
:00482D17 833D9C17490001          cmp dword ptr [0049179C], 00000001
:00482D1E 7E0D                    jle 00482D2D
:00482D20 6A01                    push 00000001
:00482D22 53                      push ebx
:00482D23 E8C81B0000              call 004848F0
:00482D28 83C408                  add esp, 00000008
:00482D2B EB0B                    jmp 00482D38

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482D1E(C)
|

* Possible StringData Ref from Data Obj ->"         (((((                "
                                        ->"  H"
                                  |
:00482D2D A190154900              mov eax, dword ptr [00491590]
:00482D32 8A0458                  mov al, byte ptr [eax+2*ebx]
:00482D35 83E001                  and eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482D2B(U)
|
:00482D38 85C0                    test eax, eax
:00482D3A 7507                    jne 00482D43
:00482D3C 8BC3                    mov eax, ebx
:00482D3E 5B                      pop ebx
:00482D3F 83C408                  add esp, 00000008
:00482D42 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00482D15(C), :00482D3A(C)
|

* Possible StringData Ref from Data Obj ->"         (((((                "
                                        ->"  H"
                                  |
:00482D43 8B1590154900            mov edx, dword ptr [00491590]
:00482D49 8BC3                    mov eax, ebx
:00482D4B C1F808                  sar eax, 08
:00482D4E 8BC8                    mov ecx, eax
:00482D50 81E1FF000000            and ecx, 000000FF
:00482D56 F6444A0180              test [edx+2*ecx+01], 80
:00482D5B 7414                    je 00482D71
:00482D5D 88442410                mov byte ptr [esp+10], al
:00482D61 885C2411                mov byte ptr [esp+11], bl
:00482D65 C644241200              mov [esp+12], 00
:00482D6A B802000000              mov eax, 00000002
:00482D6F EB0E                    jmp 00482D7F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482D5B(C)
|
:00482D71 885C2410                mov byte ptr [esp+10], bl
:00482D75 C644241100              mov [esp+11], 00
:00482D7A B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482D6F(U)
|
:00482D7F 6A01                    push 00000001
:00482D81 6A00                    push 00000000
:00482D83 8D4C240C                lea ecx, dword ptr [esp+0C]
:00482D87 6A03                    push 00000003
:00482D89 51                      push ecx
:00482D8A 8D542420                lea edx, dword ptr [esp+20]
:00482D8E 50                      push eax
:00482D8F A1C0CC4B00              mov eax, dword ptr [004BCCC0]
:00482D94 52                      push edx
:00482D95 6800010000              push 00000100
:00482D9A 50                      push eax
:00482D9B E8F0180000              call 00484690
:00482DA0 83C420                  add esp, 00000020
:00482DA3 85C0                    test eax, eax
:00482DA5 7507                    jne 00482DAE
:00482DA7 8BC3                    mov eax, ebx
:00482DA9 5B                      pop ebx
:00482DAA 83C408                  add esp, 00000008
:00482DAD C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482DA5(C)
|
:00482DAE 83F801                  cmp eax, 00000001
:00482DB1 750E                    jne 00482DC1
:00482DB3 8B442404                mov eax, dword ptr [esp+04]
:00482DB7 25FF000000              and eax, 000000FF
:00482DBC 5B                      pop ebx
:00482DBD 83C408                  add esp, 00000008
:00482DC0 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482DB1(C)
|
:00482DC1 8B442405                mov eax, dword ptr [esp+05]
:00482DC5 8B4C2404                mov ecx, dword ptr [esp+04]
:00482DC9 25FF000000              and eax, 000000FF
:00482DCE 81E1FF000000            and ecx, 000000FF
:00482DD4 C1E008                  shl eax, 08
:00482DD7 0BC1                    or eax, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00482CF4(C), :00482CFD(C)
|
:00482DD9 5B                      pop ebx
:00482DDA 83C408                  add esp, 00000008
:00482DDD C3                      ret


:00482DDE 90                      nop
:00482DDF 90                      nop

* Referenced by a CALL at Address:
|:00481936   
|
:00482DE0 8B442404                mov eax, dword ptr [esp+04]
:00482DE4 53                      push ebx
:00482DE5 55                      push ebp
:00482DE6 56                      push esi
:00482DE7 50                      push eax
:00482DE8 E833010000              call 00482F20
:00482DED 83C404                  add esp, 00000004
:00482DF0 85C0                    test eax, eax
:00482DF2 0F8417010000            je 00482F0F
:00482DF8 8B5808                  mov ebx, dword ptr [eax+08]
:00482DFB 85DB                    test ebx, ebx
:00482DFD 0F840C010000            je 00482F0F
:00482E03 83FB05                  cmp ebx, 00000005
:00482E06 7510                    jne 00482E18
:00482E08 C7400800000000          mov [eax+08], 00000000
:00482E0F B801000000              mov eax, 00000001
:00482E14 5E                      pop esi
:00482E15 5D                      pop ebp
:00482E16 5B                      pop ebx
:00482E17 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482E06(C)
|
:00482E18 83FB01                  cmp ebx, 00000001
:00482E1B 7507                    jne 00482E24
:00482E1D 83C8FF                  or eax, FFFFFFFF
:00482E20 5E                      pop esi
:00482E21 5D                      pop ebp
:00482E22 5B                      pop ebx
:00482E23 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482E1B(C)
|
:00482E24 8B4C2414                mov ecx, dword ptr [esp+14]
:00482E28 8B2DD4CC4B00            mov ebp, dword ptr [004BCCD4]
:00482E2E 890DD4CC4B00            mov dword ptr [004BCCD4], ecx
:00482E34 8B4804                  mov ecx, dword ptr [eax+04]
:00482E37 83F908                  cmp ecx, 00000008
:00482E3A 0F85B5000000            jne 00482EF5
:00482E40 8B35C0F34800            mov esi, dword ptr [0048F3C0]
:00482E46 8B15C4F34800            mov edx, dword ptr [0048F3C4]
:00482E4C 03D6                    add edx, esi
:00482E4E 3BF2                    cmp esi, edx
:00482E50 7D18                    jge 00482E6A
:00482E52 8D0C76                  lea ecx, dword ptr [esi+2*esi]
:00482E55 2BD6                    sub edx, esi
:00482E57 8D0C8D50F34800          lea ecx, dword ptr [4*ecx+0048F350]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482E68(C)
|
:00482E5E C70100000000            mov dword ptr [ecx], 00000000
:00482E64 83C10C                  add ecx, 0000000C
:00482E67 4A                      dec edx
:00482E68 75F4                    jne 00482E5E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482E50(C)
|
:00482E6A 8B00                    mov eax, dword ptr [eax]
:00482E6C 8B0DCCF34800            mov ecx, dword ptr [0048F3CC]
:00482E72 3D8E0000C0              cmp eax, C000008E
:00482E77 8BF1                    mov esi, ecx
:00482E79 7507                    jne 00482E82
:00482E7B B983000000              mov ecx, 00000083
:00482E80 EB52                    jmp 00482ED4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482E79(C)
|
:00482E82 3D900000C0              cmp eax, C0000090
:00482E87 7507                    jne 00482E90
:00482E89 B981000000              mov ecx, 00000081
:00482E8E EB44                    jmp 00482ED4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482E87(C)
|
:00482E90 3D910000C0              cmp eax, C0000091
:00482E95 7507                    jne 00482E9E
:00482E97 B984000000              mov ecx, 00000084
:00482E9C EB36                    jmp 00482ED4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482E95(C)
|
:00482E9E 3D930000C0              cmp eax, C0000093
:00482EA3 7507                    jne 00482EAC
:00482EA5 B985000000              mov ecx, 00000085
:00482EAA EB28                    jmp 00482ED4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482EA3(C)
|
:00482EAC 3D8D0000C0              cmp eax, C000008D
:00482EB1 7507                    jne 00482EBA
:00482EB3 B982000000              mov ecx, 00000082
:00482EB8 EB1A                    jmp 00482ED4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482EB1(C)
|
:00482EBA 3D8F0000C0              cmp eax, C000008F
:00482EBF 7507                    jne 00482EC8
:00482EC1 B986000000              mov ecx, 00000086
:00482EC6 EB0C                    jmp 00482ED4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482EBF(C)
|
:00482EC8 3D920000C0              cmp eax, C0000092
:00482ECD 750B                    jne 00482EDA
:00482ECF B98A000000              mov ecx, 0000008A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00482E80(U), :00482E8E(U), :00482E9C(U), :00482EAA(U), :00482EB8(U)
|:00482EC6(U)
|
:00482ED4 890DCCF34800            mov dword ptr [0048F3CC], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482ECD(C)
|
:00482EDA 51                      push ecx
:00482EDB 6A08                    push 00000008
:00482EDD FFD3                    call ebx
:00482EDF 83C408                  add esp, 00000008
:00482EE2 8935CCF34800            mov dword ptr [0048F3CC], esi
:00482EE8 892DD4CC4B00            mov dword ptr [004BCCD4], ebp
:00482EEE 83C8FF                  or eax, FFFFFFFF
:00482EF1 5E                      pop esi
:00482EF2 5D                      pop ebp
:00482EF3 5B                      pop ebx
:00482EF4 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482E3A(C)
|
:00482EF5 51                      push ecx
:00482EF6 C7400800000000          mov [eax+08], 00000000
:00482EFD FFD3                    call ebx
:00482EFF 83C404                  add esp, 00000004
:00482F02 892DD4CC4B00            mov dword ptr [004BCCD4], ebp
:00482F08 83C8FF                  or eax, FFFFFFFF
:00482F0B 5E                      pop esi
:00482F0C 5D                      pop ebp
:00482F0D 5B                      pop ebx
:00482F0E C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00482DF2(C), :00482DFD(C)
|
:00482F0F 8B542414                mov edx, dword ptr [esp+14]
:00482F13 52                      push edx
:00482F14 FF1588614800            call dword ptr [00486188]
:00482F1A 5E                      pop esi
:00482F1B 5D                      pop ebp
:00482F1C 5B                      pop ebx
:00482F1D C3                      ret


:00482F1E 90                      nop
:00482F1F 90                      nop

* Referenced by a CALL at Address:
|:00482DE8   
|
:00482F20 8B542404                mov edx, dword ptr [esp+04]
:00482F24 8B0D48F34800            mov ecx, dword ptr [0048F348]
:00482F2A 56                      push esi
:00482F2B 8B35C8F34800            mov esi, dword ptr [0048F3C8]
:00482F31 3BCA                    cmp ecx, edx

* Possible StringData Ref from Data Obj ->""
                                  |
:00482F33 B848F34800              mov eax, 0048F348
:00482F38 7415                    je 00482F4F
:00482F3A 8D0C76                  lea ecx, dword ptr [esi+2*esi]
:00482F3D 8D0C8D48F34800          lea ecx, dword ptr [4*ecx+0048F348]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482F4D(C)
|
:00482F44 83C00C                  add eax, 0000000C
:00482F47 3BC1                    cmp eax, ecx
:00482F49 7304                    jnb 00482F4F
:00482F4B 3910                    cmp dword ptr [eax], edx
:00482F4D 75F5                    jne 00482F44

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00482F38(C), :00482F49(C)
|
:00482F4F 8D0C76                  lea ecx, dword ptr [esi+2*esi]
:00482F52 8D0C8D48F34800          lea ecx, dword ptr [4*ecx+0048F348]
:00482F59 3BC1                    cmp eax, ecx
:00482F5B 7304                    jnb 00482F61
:00482F5D 3910                    cmp dword ptr [eax], edx
:00482F5F 7402                    je 00482F63

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482F5B(C)
|
:00482F61 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482F5F(C)
|
:00482F63 5E                      pop esi
:00482F64 C3                      ret


:00482F65 90                      nop
:00482F66 90                      nop
:00482F67 90                      nop
:00482F68 90                      nop
:00482F69 90                      nop
:00482F6A 90                      nop
:00482F6B 90                      nop
:00482F6C 90                      nop
:00482F6D 90                      nop
:00482F6E 90                      nop
:00482F6F 90                      nop

* Referenced by a CALL at Address:
|:004818BC   
|
:00482F70 8B442404                mov eax, dword ptr [esp+04]
:00482F74 6A04                    push 00000004
:00482F76 6A00                    push 00000000
:00482F78 50                      push eax
:00482F79 E812000000              call 00482F90
:00482F7E 83C40C                  add esp, 0000000C
:00482F81 C3                      ret


:00482F82 90                      nop
:00482F83 90                      nop
:00482F84 90                      nop
:00482F85 90                      nop
:00482F86 90                      nop
:00482F87 90                      nop
:00482F88 90                      nop
:00482F89 90                      nop
:00482F8A 90                      nop
:00482F8B 90                      nop
:00482F8C 90                      nop
:00482F8D 90                      nop
:00482F8E 90                      nop
:00482F8F 90                      nop

* Referenced by a CALL at Address:
|:00482F79   
|
:00482F90 8B442404                mov eax, dword ptr [esp+04]
:00482F94 8A4C240C                mov cl, byte ptr [esp+0C]
:00482F98 25FF000000              and eax, 000000FF
:00482F9D 8488E9CD4B00            test byte ptr [eax+004BCDE9], cl
:00482FA3 751F                    jne 00482FC4
:00482FA5 8B4C2408                mov ecx, dword ptr [esp+08]
:00482FA9 85C9                    test ecx, ecx
:00482FAB 7410                    je 00482FBD
:00482FAD 33D2                    xor edx, edx
:00482FAF 668B14459A154900        mov dx, word ptr [2*eax+0049159A]
:00482FB7 8BC2                    mov eax, edx
:00482FB9 23C1                    and eax, ecx
:00482FBB EB02                    jmp 00482FBF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482FAB(C)
|
:00482FBD 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482FBB(U)
|
:00482FBF 85C0                    test eax, eax
:00482FC1 7501                    jne 00482FC4
:00482FC3 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00482FA3(C), :00482FC1(C)
|
:00482FC4 B801000000              mov eax, 00000001
:00482FC9 C3                      ret


:00482FCA 90                      nop
:00482FCB 90                      nop
:00482FCC 90                      nop
:00482FCD 90                      nop
:00482FCE 90                      nop
:00482FCF 90                      nop

* Referenced by a CALL at Address:
|:0048188C   
|
:00482FD0 51                      push ecx
:00482FD1 8B1598CC4B00            mov edx, dword ptr [004BCC98]
:00482FD7 53                      push ebx
:00482FD8 55                      push ebp
:00482FD9 56                      push esi
:00482FDA 8A02                    mov al, byte ptr [edx]
:00482FDC 33F6                    xor esi, esi
:00482FDE 84C0                    test al, al
:00482FE0 57                      push edi
:00482FE1 741D                    je 00483000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482FFE(C)
|
:00482FE3 3C3D                    cmp al, 3D
:00482FE5 7401                    je 00482FE8
:00482FE7 46                      inc esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482FE5(C)
|
:00482FE8 8BFA                    mov edi, edx
:00482FEA 83C9FF                  or ecx, FFFFFFFF
:00482FED 33C0                    xor eax, eax
:00482FEF F2                      repnz
:00482FF0 AE                      scasb
:00482FF1 F7D1                    not ecx
:00482FF3 49                      dec ecx
:00482FF4 8A440A01                mov al, byte ptr [edx+ecx+01]
:00482FF8 8D540A01                lea edx, dword ptr [edx+ecx+01]
:00482FFC 84C0                    test al, al
:00482FFE 75E3                    jne 00482FE3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00482FE1(C)
|
:00483000 8D04B504000000          lea eax, dword ptr [4*esi+00000004]
:00483007 50                      push eax
:00483008 E883F8FFFF              call 00482890
:0048300D 8BF0                    mov esi, eax
:0048300F 83C404                  add esp, 00000004
:00483012 85F6                    test esi, esi
:00483014 89742410                mov dword ptr [esp+10], esi
:00483018 893574CC4B00            mov dword ptr [004BCC74], esi
:0048301E 750A                    jne 0048302A
:00483020 6A09                    push 00000009
:00483022 E859E9FFFF              call 00481980
:00483027 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048301E(C)
|
:0048302A 8B2D98CC4B00            mov ebp, dword ptr [004BCC98]
:00483030 8A5500                  mov dl, byte ptr [ebp+00]
:00483033 84D2                    test dl, dl
:00483035 7463                    je 0048309A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483098(C)
|
:00483037 8BFD                    mov edi, ebp
:00483039 83C9FF                  or ecx, FFFFFFFF
:0048303C 33C0                    xor eax, eax
:0048303E F2                      repnz
:0048303F AE                      scasb
:00483040 F7D1                    not ecx
:00483042 49                      dec ecx
:00483043 8BD9                    mov ebx, ecx
:00483045 43                      inc ebx
:00483046 80FA3D                  cmp dl, 3D
:00483049 7445                    je 00483090
:0048304B 53                      push ebx
:0048304C E83FF8FFFF              call 00482890
:00483051 83C404                  add esp, 00000004
:00483054 8906                    mov dword ptr [esi], eax
:00483056 85C0                    test eax, eax
:00483058 750A                    jne 00483064
:0048305A 6A09                    push 00000009
:0048305C E81FE9FFFF              call 00481980
:00483061 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483058(C)
|
:00483064 8BFD                    mov edi, ebp
:00483066 83C9FF                  or ecx, FFFFFFFF
:00483069 33C0                    xor eax, eax
:0048306B F2                      repnz
:0048306C AE                      scasb
:0048306D 8B442410                mov eax, dword ptr [esp+10]
:00483071 F7D1                    not ecx
:00483073 2BF9                    sub edi, ecx
:00483075 8BD1                    mov edx, ecx
:00483077 8BF7                    mov esi, edi
:00483079 8B38                    mov edi, dword ptr [eax]
:0048307B C1E902                  shr ecx, 02
:0048307E F3                      repz
:0048307F A5                      movsd
:00483080 8BCA                    mov ecx, edx
:00483082 83E103                  and ecx, 00000003
:00483085 83C004                  add eax, 00000004
:00483088 F3                      repz
:00483089 A4                      movsb
:0048308A 89442410                mov dword ptr [esp+10], eax
:0048308E 8BF0                    mov esi, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483049(C)
|
:00483090 8A541D00                mov dl, byte ptr [ebp+ebx]
:00483094 03EB                    add ebp, ebx
:00483096 84D2                    test dl, dl
:00483098 759D                    jne 00483037

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483035(C)
|
:0048309A A198CC4B00              mov eax, dword ptr [004BCC98]
:0048309F 50                      push eax
:004830A0 E89BF8FFFF              call 00482940
:004830A5 83C404                  add esp, 00000004
:004830A8 C70598CC4B0000000000    mov dword ptr [004BCC98], 00000000
:004830B2 C70600000000            mov dword ptr [esi], 00000000
:004830B8 5F                      pop edi
:004830B9 5E                      pop esi
:004830BA 5D                      pop ebp
:004830BB 5B                      pop ebx
:004830BC 59                      pop ecx
:004830BD C3                      ret


:004830BE 90                      nop
:004830BF 90                      nop

* Referenced by a CALL at Address:
|:00481887   
|
:004830C0 83EC08                  sub esp, 00000008
:004830C3 56                      push esi
:004830C4 57                      push edi
:004830C5 6804010000              push 00000104
:004830CA 68D8CC4B00              push 004BCCD8
:004830CF 6A00                    push 00000000
:004830D1 FF1584614800            call dword ptr [00486184]
:004830D7 8B3D88D84B00            mov edi, dword ptr [004BD888]
:004830DD C70584CC4B00D8CC4B00    mov dword ptr [004BCC84], 004BCCD8
:004830E7 803F00                  cmp byte ptr [edi], 00
:004830EA 7505                    jne 004830F1
:004830EC BFD8CC4B00              mov edi, 004BCCD8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004830EA(C)
|
:004830F1 8D44240C                lea eax, dword ptr [esp+0C]
:004830F5 8D4C2408                lea ecx, dword ptr [esp+08]
:004830F9 50                      push eax
:004830FA 51                      push ecx
:004830FB 6A00                    push 00000000
:004830FD 6A00                    push 00000000
:004830FF 57                      push edi
:00483100 E85B000000              call 00483160
:00483105 8B542420                mov edx, dword ptr [esp+20]
:00483109 8B44241C                mov eax, dword ptr [esp+1C]
:0048310D 83C414                  add esp, 00000014
:00483110 8D0C82                  lea ecx, dword ptr [edx+4*eax]
:00483113 51                      push ecx
:00483114 E877F7FFFF              call 00482890
:00483119 8BF0                    mov esi, eax
:0048311B 83C404                  add esp, 00000004
:0048311E 85F6                    test esi, esi
:00483120 750A                    jne 0048312C
:00483122 6A08                    push 00000008
:00483124 E857E8FFFF              call 00481980
:00483129 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483120(C)
|
:0048312C 8B4C2408                mov ecx, dword ptr [esp+08]
:00483130 8D54240C                lea edx, dword ptr [esp+0C]
:00483134 52                      push edx
:00483135 8D44240C                lea eax, dword ptr [esp+0C]
:00483139 8D148E                  lea edx, dword ptr [esi+4*ecx]
:0048313C 50                      push eax
:0048313D 52                      push edx
:0048313E 56                      push esi
:0048313F 57                      push edi
:00483140 E81B000000              call 00483160
:00483145 8B44241C                mov eax, dword ptr [esp+1C]
:00483149 83C414                  add esp, 00000014
:0048314C 48                      dec eax
:0048314D 89356CCC4B00            mov dword ptr [004BCC6C], esi
:00483153 5F                      pop edi
:00483154 A368CC4B00              mov dword ptr [004BCC68], eax
:00483159 5E                      pop esi
:0048315A 83C408                  add esp, 00000008
:0048315D C3                      ret


:0048315E 90                      nop
:0048315F 90                      nop

* Referenced by a CALL at Addresses:
|:00483100   , :00483140   
|
:00483160 8B442410                mov eax, dword ptr [esp+10]
:00483164 53                      push ebx
:00483165 55                      push ebp
:00483166 8B6C2410                mov ebp, dword ptr [esp+10]
:0048316A 56                      push esi
:0048316B 8B742418                mov esi, dword ptr [esp+18]
:0048316F 57                      push edi
:00483170 8B7C2424                mov edi, dword ptr [esp+24]
:00483174 85ED                    test ebp, ebp
:00483176 C70700000000            mov dword ptr [edi], 00000000
:0048317C C70001000000            mov dword ptr [eax], 00000001
:00483182 8B442414                mov eax, dword ptr [esp+14]
:00483186 BB04000000              mov ebx, 00000004
:0048318B 7409                    je 00483196
:0048318D 897500                  mov dword ptr [ebp+00], esi
:00483190 03EB                    add ebp, ebx
:00483192 896C2418                mov dword ptr [esp+18], ebp

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048318B(C)
|
:00483196 803822                  cmp byte ptr [eax], 22
:00483199 7556                    jne 004831F1
:0048319B 8A4801                  mov cl, byte ptr [eax+01]
:0048319E 40                      inc eax
:0048319F 80F922                  cmp cl, 22
:004831A2 7438                    je 004831DC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004831DA(C)
|
:004831A4 84C9                    test cl, cl
:004831A6 7434                    je 004831DC
:004831A8 81E1FF000000            and ecx, 000000FF
:004831AE 8499E9CD4B00            test byte ptr [ecx+004BCDE9], bl
:004831B4 740F                    je 004831C5
:004831B6 8B17                    mov edx, dword ptr [edi]
:004831B8 42                      inc edx
:004831B9 85F6                    test esi, esi
:004831BB 8917                    mov dword ptr [edi], edx
:004831BD 7406                    je 004831C5
:004831BF 8A08                    mov cl, byte ptr [eax]
:004831C1 880E                    mov byte ptr [esi], cl
:004831C3 46                      inc esi
:004831C4 40                      inc eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004831B4(C), :004831BD(C)
|
:004831C5 8B17                    mov edx, dword ptr [edi]
:004831C7 42                      inc edx
:004831C8 85F6                    test esi, esi
:004831CA 8917                    mov dword ptr [edi], edx
:004831CC 7405                    je 004831D3
:004831CE 8A10                    mov dl, byte ptr [eax]
:004831D0 8816                    mov byte ptr [esi], dl
:004831D2 46                      inc esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004831CC(C)
|
:004831D3 8A4801                  mov cl, byte ptr [eax+01]
:004831D6 40                      inc eax
:004831D7 80F922                  cmp cl, 22
:004831DA 75C8                    jne 004831A4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004831A2(C), :004831A6(C)
|
:004831DC 8B17                    mov edx, dword ptr [edi]
:004831DE 42                      inc edx
:004831DF 85F6                    test esi, esi
:004831E1 8917                    mov dword ptr [edi], edx
:004831E3 7404                    je 004831E9
:004831E5 C60600                  mov byte ptr [esi], 00
:004831E8 46                      inc esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004831E3(C)
|
:004831E9 803822                  cmp byte ptr [eax], 22
:004831EC 7556                    jne 00483244
:004831EE 40                      inc eax
:004831EF EB53                    jmp 00483244

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00483199(C), :00483233(C)
|
:004831F1 8B17                    mov edx, dword ptr [edi]
:004831F3 42                      inc edx
:004831F4 85F6                    test esi, esi
:004831F6 8917                    mov dword ptr [edi], edx
:004831F8 7405                    je 004831FF
:004831FA 8A08                    mov cl, byte ptr [eax]
:004831FC 880E                    mov byte ptr [esi], cl
:004831FE 46                      inc esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004831F8(C)
|
:004831FF 8A08                    mov cl, byte ptr [eax]
:00483201 40                      inc eax
:00483202 884C2424                mov byte ptr [esp+24], cl
:00483206 8B542424                mov edx, dword ptr [esp+24]
:0048320A 81E2FF000000            and edx, 000000FF
:00483210 849AE9CD4B00            test byte ptr [edx+004BCDE9], bl
:00483216 740F                    je 00483227
:00483218 8B17                    mov edx, dword ptr [edi]
:0048321A 42                      inc edx
:0048321B 85F6                    test esi, esi
:0048321D 8917                    mov dword ptr [edi], edx
:0048321F 7405                    je 00483226
:00483221 8A10                    mov dl, byte ptr [eax]
:00483223 8816                    mov byte ptr [esi], dl
:00483225 46                      inc esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048321F(C)
|
:00483226 40                      inc eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483216(C)
|
:00483227 80F920                  cmp cl, 20
:0048322A 7409                    je 00483235
:0048322C 84C9                    test cl, cl
:0048322E 7409                    je 00483239
:00483230 80F909                  cmp cl, 09
:00483233 75BC                    jne 004831F1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048322A(C)
|
:00483235 84C9                    test cl, cl
:00483237 7503                    jne 0048323C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048322E(C)
|
:00483239 48                      dec eax
:0048323A EB08                    jmp 00483244

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483237(C)
|
:0048323C 85F6                    test esi, esi
:0048323E 7404                    je 00483244
:00483240 C646FF00                mov [esi-01], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004831EC(C), :004831EF(U), :0048323A(U), :0048323E(C)
|
:00483244 33D2                    xor edx, edx
:00483246 89542424                mov dword ptr [esp+24], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483351(U)
|
:0048324A 803800                  cmp byte ptr [eax], 00
:0048324D 0F8403010000            je 00483356

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483260(U)
|
:00483253 8A08                    mov cl, byte ptr [eax]
:00483255 80F920                  cmp cl, 20
:00483258 7405                    je 0048325F
:0048325A 80F909                  cmp cl, 09
:0048325D 7503                    jne 00483262

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483258(C)
|
:0048325F 40                      inc eax
:00483260 EBF1                    jmp 00483253

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048325D(C)
|
:00483262 803800                  cmp byte ptr [eax], 00
:00483265 0F84EB000000            je 00483356
:0048326B 85ED                    test ebp, ebp
:0048326D 7409                    je 00483278
:0048326F 897500                  mov dword ptr [ebp+00], esi
:00483272 03EB                    add ebp, ebx
:00483274 896C2418                mov dword ptr [esp+18], ebp

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048326D(C)
|
:00483278 8B4C2420                mov ecx, dword ptr [esp+20]
:0048327C FF01                    inc dword ptr [ecx]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00483319(U), :00483336(U)
|
:0048327E 8A18                    mov bl, byte ptr [eax]
:00483280 33C9                    xor ecx, ecx
:00483282 80FB5C                  cmp bl, 5C
:00483285 BD01000000              mov ebp, 00000001
:0048328A 750A                    jne 00483296

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483294(C)
|
:0048328C 8A5801                  mov bl, byte ptr [eax+01]
:0048328F 40                      inc eax
:00483290 41                      inc ecx
:00483291 80FB5C                  cmp bl, 5C
:00483294 74F6                    je 0048328C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048328A(C)
|
:00483296 803822                  cmp byte ptr [eax], 22
:00483299 7525                    jne 004832C0
:0048329B F6C101                  test cl, 01
:0048329E 751E                    jne 004832BE
:004832A0 85D2                    test edx, edx
:004832A2 7409                    je 004832AD
:004832A4 80780122                cmp byte ptr [eax+01], 22
:004832A8 7503                    jne 004832AD
:004832AA 40                      inc eax
:004832AB EB02                    jmp 004832AF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004832A2(C), :004832A8(C)
|
:004832AD 33ED                    xor ebp, ebp

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004832AB(U)
|
:004832AF 8B5C2424                mov ebx, dword ptr [esp+24]
:004832B3 33D2                    xor edx, edx
:004832B5 85DB                    test ebx, ebx
:004832B7 0F94C2                  sete dl
:004832BA 89542424                mov dword ptr [esp+24], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048329E(C)
|
:004832BE D1E9                    shr ecx, 1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483299(C)
|
:004832C0 8BD9                    mov ebx, ecx
:004832C2 49                      dec ecx
:004832C3 85DB                    test ebx, ebx
:004832C5 7411                    je 004832D8
:004832C7 41                      inc ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004832D6(C)
|
:004832C8 85F6                    test esi, esi
:004832CA 7404                    je 004832D0
:004832CC C6065C                  mov byte ptr [esi], 5C
:004832CF 46                      inc esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004832CA(C)
|
:004832D0 8B1F                    mov ebx, dword ptr [edi]
:004832D2 43                      inc ebx
:004832D3 49                      dec ecx
:004832D4 891F                    mov dword ptr [edi], ebx
:004832D6 75F0                    jne 004832C8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004832C5(C)
|
:004832D8 8A08                    mov cl, byte ptr [eax]
:004832DA 84C9                    test cl, cl
:004832DC 745D                    je 0048333B
:004832DE 85D2                    test edx, edx
:004832E0 750A                    jne 004832EC
:004832E2 80F920                  cmp cl, 20
:004832E5 7454                    je 0048333B
:004832E7 80F909                  cmp cl, 09
:004832EA 744F                    je 0048333B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004832E0(C)
|
:004832EC 85ED                    test ebp, ebp
:004832EE 7445                    je 00483335
:004832F0 85F6                    test esi, esi
:004832F2 742A                    je 0048331E
:004832F4 8BD9                    mov ebx, ecx
:004832F6 81E3FF000000            and ebx, 000000FF
:004832FC F683E9CD4B0004          test byte ptr [ebx+004BCDE9], 04
:00483303 7409                    je 0048330E
:00483305 880E                    mov byte ptr [esi], cl
:00483307 8B0F                    mov ecx, dword ptr [edi]
:00483309 46                      inc esi
:0048330A 40                      inc eax
:0048330B 41                      inc ecx
:0048330C 890F                    mov dword ptr [edi], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483303(C)
|
:0048330E 8A08                    mov cl, byte ptr [eax]
:00483310 880E                    mov byte ptr [esi], cl
:00483312 8B0F                    mov ecx, dword ptr [edi]
:00483314 46                      inc esi
:00483315 41                      inc ecx
:00483316 890F                    mov dword ptr [edi], ecx
:00483318 40                      inc eax
:00483319 E960FFFFFF              jmp 0048327E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004832F2(C)
|
:0048331E 81E1FF000000            and ecx, 000000FF
:00483324 F681E9CD4B0004          test byte ptr [ecx+004BCDE9], 04
:0048332B 7406                    je 00483333
:0048332D 8B0F                    mov ecx, dword ptr [edi]
:0048332F 40                      inc eax
:00483330 41                      inc ecx
:00483331 890F                    mov dword ptr [edi], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048332B(C)
|
:00483333 FF07                    inc dword ptr [edi]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004832EE(C)
|
:00483335 40                      inc eax
:00483336 E943FFFFFF              jmp 0048327E

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004832DC(C), :004832E5(C), :004832EA(C)
|
:0048333B 85F6                    test esi, esi
:0048333D 7404                    je 00483343
:0048333F C60600                  mov byte ptr [esi], 00
:00483342 46                      inc esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048333D(C)
|
:00483343 8B0F                    mov ecx, dword ptr [edi]
:00483345 8B6C2418                mov ebp, dword ptr [esp+18]
:00483349 41                      inc ecx
:0048334A BB04000000              mov ebx, 00000004
:0048334F 890F                    mov dword ptr [edi], ecx
:00483351 E9F4FEFFFF              jmp 0048324A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0048324D(C), :00483265(C)
|
:00483356 85ED                    test ebp, ebp
:00483358 7407                    je 00483361
:0048335A C7450000000000          mov [ebp+00], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483358(C)
|
:00483361 8B442420                mov eax, dword ptr [esp+20]
:00483365 5F                      pop edi
:00483366 5E                      pop esi
:00483367 5D                      pop ebp
:00483368 8B08                    mov ecx, dword ptr [eax]
:0048336A 5B                      pop ebx
:0048336B 41                      inc ecx
:0048336C 8908                    mov dword ptr [eax], ecx
:0048336E C3                      ret


:0048336F 90                      nop

* Referenced by a CALL at Address:
|:00481866   
|
:00483370 A1E0CD4B00              mov eax, dword ptr [004BCDE0]
:00483375 53                      push ebx
:00483376 55                      push ebp
:00483377 8B2D74614800            mov ebp, dword ptr [00486174]
:0048337D 56                      push esi
:0048337E 33F6                    xor esi, esi
:00483380 33DB                    xor ebx, ebx
:00483382 57                      push edi
:00483383 8B3D70614800            mov edi, dword ptr [00486170]
:00483389 85C0                    test eax, eax
:0048338B 7525                    jne 004833B2
:0048338D FFD7                    call edi
:0048338F 8BF0                    mov esi, eax
:00483391 85F6                    test esi, esi
:00483393 7407                    je 0048339C
:00483395 B801000000              mov eax, 00000001
:0048339A EB11                    jmp 004833AD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483393(C)
|
:0048339C FFD5                    call ebp
:0048339E 8BD8                    mov ebx, eax
:004833A0 85DB                    test ebx, ebx
:004833A2 0F8417010000            je 004834BF
:004833A8 B802000000              mov eax, 00000002

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048339A(U)
|
:004833AD A3E0CD4B00              mov dword ptr [004BCDE0], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048338B(C)
|
:004833B2 83F801                  cmp eax, 00000001
:004833B5 0F8597000000            jne 00483452
:004833BB 85F6                    test esi, esi
:004833BD 750C                    jne 004833CB
:004833BF FFD7                    call edi
:004833C1 8BF0                    mov esi, eax
:004833C3 85F6                    test esi, esi
:004833C5 0F84F4000000            je 004834BF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004833BD(C)
|
:004833CB 66833E00                cmp word ptr [esi], 0000
:004833CF 8BC6                    mov eax, esi
:004833D1 7412                    je 004833E5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004833DA(C), :004833E3(C)
|
:004833D3 83C002                  add eax, 00000002
:004833D6 66833800                cmp word ptr [eax], 0000
:004833DA 75F7                    jne 004833D3
:004833DC 83C002                  add eax, 00000002
:004833DF 66833800                cmp word ptr [eax], 0000
:004833E3 75EE                    jne 004833D3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004833D1(C)
|
:004833E5 2BC6                    sub eax, esi
:004833E7 6A00                    push 00000000
:004833E9 D1F8                    sar eax, 1
:004833EB 40                      inc eax
:004833EC 6A00                    push 00000000
:004833EE 8BE8                    mov ebp, eax
:004833F0 6A00                    push 00000000
:004833F2 6A00                    push 00000000
:004833F4 55                      push ebp
:004833F5 56                      push esi
:004833F6 6A00                    push 00000000
:004833F8 6A00                    push 00000000
:004833FA FF156C614800            call dword ptr [0048616C]
:00483400 8BF8                    mov edi, eax
:00483402 85FF                    test edi, edi
:00483404 743E                    je 00483444
:00483406 57                      push edi
:00483407 E884F4FFFF              call 00482890
:0048340C 8BD8                    mov ebx, eax
:0048340E 83C404                  add esp, 00000004
:00483411 85DB                    test ebx, ebx
:00483413 742F                    je 00483444
:00483415 6A00                    push 00000000
:00483417 6A00                    push 00000000
:00483419 57                      push edi
:0048341A 53                      push ebx
:0048341B 55                      push ebp
:0048341C 56                      push esi
:0048341D 6A00                    push 00000000
:0048341F 6A00                    push 00000000
:00483421 FF156C614800            call dword ptr [0048616C]
:00483427 85C0                    test eax, eax
:00483429 750B                    jne 00483436
:0048342B 53                      push ebx
:0048342C E80FF5FFFF              call 00482940
:00483431 83C404                  add esp, 00000004
:00483434 33DB                    xor ebx, ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483429(C)
|
:00483436 56                      push esi
:00483437 FF1578614800            call dword ptr [00486178]
:0048343D 8BC3                    mov eax, ebx
:0048343F 5F                      pop edi
:00483440 5E                      pop esi
:00483441 5D                      pop ebp
:00483442 5B                      pop ebx
:00483443 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00483404(C), :00483413(C)
|
:00483444 56                      push esi
:00483445 FF1578614800            call dword ptr [00486178]
:0048344B 33C0                    xor eax, eax
:0048344D 5F                      pop edi
:0048344E 5E                      pop esi
:0048344F 5D                      pop ebp
:00483450 5B                      pop ebx
:00483451 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004833B5(C)
|
:00483452 83F802                  cmp eax, 00000002
:00483455 7568                    jne 004834BF
:00483457 85DB                    test ebx, ebx
:00483459 7508                    jne 00483463
:0048345B FFD5                    call ebp
:0048345D 8BD8                    mov ebx, eax
:0048345F 85DB                    test ebx, ebx
:00483461 745C                    je 004834BF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483459(C)
|
:00483463 8A0B                    mov cl, byte ptr [ebx]
:00483465 8BC3                    mov eax, ebx
:00483467 84C9                    test cl, cl
:00483469 7410                    je 0048347B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00483471(C), :00483479(C)
|
:0048346B 8A4801                  mov cl, byte ptr [eax+01]
:0048346E 40                      inc eax
:0048346F 84C9                    test cl, cl
:00483471 75F8                    jne 0048346B
:00483473 8A4801                  mov cl, byte ptr [eax+01]
:00483476 40                      inc eax
:00483477 84C9                    test cl, cl
:00483479 75F0                    jne 0048346B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483469(C)
|
:0048347B 2BC3                    sub eax, ebx
:0048347D 40                      inc eax
:0048347E 8BF0                    mov esi, eax
:00483480 56                      push esi
:00483481 E80AF4FFFF              call 00482890
:00483486 8BE8                    mov ebp, eax
:00483488 83C404                  add esp, 00000004
:0048348B 85ED                    test ebp, ebp
:0048348D 750E                    jne 0048349D
:0048348F 53                      push ebx
:00483490 FF1580614800            call dword ptr [00486180]
:00483496 33C0                    xor eax, eax
:00483498 5F                      pop edi
:00483499 5E                      pop esi
:0048349A 5D                      pop ebp
:0048349B 5B                      pop ebx
:0048349C C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048348D(C)
|
:0048349D 8BCE                    mov ecx, esi
:0048349F 8BF3                    mov esi, ebx
:004834A1 8BC1                    mov eax, ecx
:004834A3 8BFD                    mov edi, ebp
:004834A5 C1E902                  shr ecx, 02
:004834A8 F3                      repz
:004834A9 A5                      movsd
:004834AA 8BC8                    mov ecx, eax
:004834AC 53                      push ebx
:004834AD 83E103                  and ecx, 00000003
:004834B0 F3                      repz
:004834B1 A4                      movsb
:004834B2 FF1580614800            call dword ptr [00486180]
:004834B8 8BC5                    mov eax, ebp
:004834BA 5F                      pop edi
:004834BB 5E                      pop esi
:004834BC 5D                      pop ebp
:004834BD 5B                      pop ebx
:004834BE C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004833A2(C), :004833C5(C), :00483455(C), :00483461(C)
|
:004834BF 5F                      pop edi
:004834C0 5E                      pop esi
:004834C1 5D                      pop ebp
:004834C2 33C0                    xor eax, eax
:004834C4 5B                      pop ebx
:004834C5 C3                      ret


:004834C6 90                      nop
:004834C7 90                      nop
:004834C8 90                      nop
:004834C9 90                      nop
:004834CA 90                      nop
:004834CB 90                      nop
:004834CC 90                      nop
:004834CD 90                      nop
:004834CE 90                      nop
:004834CF 90                      nop

* Referenced by a CALL at Address:
|:004839B2   
|
:004834D0 8B442404                mov eax, dword ptr [esp+04]
:004834D4 83EC14                  sub esp, 00000014
:004834D7 53                      push ebx
:004834D8 55                      push ebp
:004834D9 56                      push esi
:004834DA 57                      push edi
:004834DB 50                      push eax
:004834DC E8FF010000              call 004836E0
:004834E1 8BC8                    mov ecx, eax
:004834E3 A1F0CF4B00              mov eax, dword ptr [004BCFF0]
:004834E8 83C404                  add esp, 00000004
:004834EB 3BC8                    cmp ecx, eax
:004834ED 894C2428                mov dword ptr [esp+28], ecx
:004834F1 750A                    jne 004834FD
:004834F3 33C0                    xor eax, eax
:004834F5 5F                      pop edi
:004834F6 5E                      pop esi
:004834F7 5D                      pop ebp
:004834F8 5B                      pop ebx
:004834F9 83C414                  add esp, 00000014
:004834FC C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004834F1(C)
|
:004834FD 85C9                    test ecx, ecx
:004834FF 7514                    jne 00483515
:00483501 E88A020000              call 00483790
:00483506 E8C5020000              call 004837D0
:0048350B 33C0                    xor eax, eax
:0048350D 5F                      pop edi
:0048350E 5E                      pop esi
:0048350F 5D                      pop ebp
:00483510 5B                      pop ebx
:00483511 83C414                  add esp, 00000014
:00483514 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004834FF(C)
|
:00483515 33D2                    xor edx, edx

* Possible StringData Ref from Data Obj ->""
                                  |
:00483517 B8D8F34800              mov eax, 0048F3D8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048352D(C)
|
:0048351C 3908                    cmp dword ptr [eax], ecx
:0048351E 0F8407010000            je 0048362B
:00483524 83C030                  add eax, 00000030
:00483527 42                      inc edx
:00483528 3DC8F44800              cmp eax, 0048F4C8
:0048352D 72ED                    jb 0048351C
:0048352F 8D542410                lea edx, dword ptr [esp+10]
:00483533 52                      push edx
:00483534 51                      push ecx
:00483535 FF1568614800            call dword ptr [00486168]
:0048353B BE01000000              mov esi, 00000001
:00483540 3BC6                    cmp eax, esi
:00483542 0F85BB000000            jne 00483603
:00483548 B940000000              mov ecx, 00000040
:0048354D 33C0                    xor eax, eax
:0048354F BFE8CD4B00              mov edi, 004BCDE8
:00483554 F3                      repz
:00483555 AB                      stosd
:00483556 8B4C2410                mov ecx, dword ptr [esp+10]
:0048355A AA                      stosb
:0048355B 8B7C2428                mov edi, dword ptr [esp+28]
:0048355F 33C0                    xor eax, eax
:00483561 3BCE                    cmp ecx, esi
:00483563 893DF0CF4B00            mov dword ptr [004BCFF0], edi
:00483569 A3F4CF4B00              mov dword ptr [004BCFF4], eax
:0048356E 766E                    jbe 004835DE
:00483570 8A442416                mov al, byte ptr [esp+16]
:00483574 84C0                    test al, al
:00483576 7437                    je 004835AF
:00483578 8D542417                lea edx, dword ptr [esp+17]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004835AD(C)
|
:0048357C 8A0A                    mov cl, byte ptr [edx]
:0048357E 84C9                    test cl, cl
:00483580 742D                    je 004835AF
:00483582 33C0                    xor eax, eax
:00483584 81E1FF000000            and ecx, 000000FF
:0048358A 8A42FF                  mov al, byte ptr [edx-01]
:0048358D 3BC1                    cmp eax, ecx
:0048358F 7714                    ja 004835A5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004835A3(C)
|
:00483591 8A98E9CD4B00            mov bl, byte ptr [eax+004BCDE9]
:00483597 80CB04                  or bl, 04
:0048359A 8898E9CD4B00            mov byte ptr [eax+004BCDE9], bl
:004835A0 40                      inc eax
:004835A1 3BC1                    cmp eax, ecx
:004835A3 76EC                    jbe 00483591

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048358F(C)
|
:004835A5 8A4201                  mov al, byte ptr [edx+01]
:004835A8 83C202                  add edx, 00000002
:004835AB 84C0                    test al, al
:004835AD 75CD                    jne 0048357C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00483576(C), :00483580(C)
|
:004835AF 8BC6                    mov eax, esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004835C6(C)
|
:004835B1 8A98E9CD4B00            mov bl, byte ptr [eax+004BCDE9]
:004835B7 80CB08                  or bl, 08
:004835BA 8898E9CD4B00            mov byte ptr [eax+004BCDE9], bl
:004835C0 40                      inc eax
:004835C1 3DFF000000              cmp eax, 000000FF
:004835C6 72E9                    jb 004835B1
:004835C8 57                      push edi
:004835C9 E862010000              call 00483730
:004835CE 83C404                  add esp, 00000004
:004835D1 A3F4CF4B00              mov dword ptr [004BCFF4], eax
:004835D6 893584D84B00            mov dword ptr [004BD884], esi
:004835DC EB05                    jmp 004835E3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048356E(C)
|
:004835DE A384D84B00              mov dword ptr [004BD884], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004835DC(U)
|
:004835E3 33C0                    xor eax, eax
:004835E5 A3F8CF4B00              mov dword ptr [004BCFF8], eax
:004835EA A3FCCF4B00              mov dword ptr [004BCFFC], eax
:004835EF A300D04B00              mov dword ptr [004BD000], eax
:004835F4 E8D7010000              call 004837D0
:004835F9 33C0                    xor eax, eax
:004835FB 5F                      pop edi
:004835FC 5E                      pop esi
:004835FD 5D                      pop ebp
:004835FE 5B                      pop ebx
:004835FF 83C414                  add esp, 00000014
:00483602 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483542(C)
|
:00483603 A104D04B00              mov eax, dword ptr [004BD004]
:00483608 85C0                    test eax, eax
:0048360A 7414                    je 00483620
:0048360C E87F010000              call 00483790
:00483611 E8BA010000              call 004837D0
:00483616 33C0                    xor eax, eax
:00483618 5F                      pop edi
:00483619 5E                      pop esi
:0048361A 5D                      pop ebp
:0048361B 5B                      pop ebx
:0048361C 83C414                  add esp, 00000014
:0048361F C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048360A(C)
|
:00483620 83C8FF                  or eax, FFFFFFFF
:00483623 5F                      pop edi
:00483624 5E                      pop esi
:00483625 5D                      pop ebp
:00483626 5B                      pop ebx
:00483627 83C414                  add esp, 00000014
:0048362A C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048351E(C)
|
:0048362B B940000000              mov ecx, 00000040
:00483630 33C0                    xor eax, eax
:00483632 BFE8CD4B00              mov edi, 004BCDE8
:00483637 8D1C52                  lea ebx, dword ptr [edx+2*edx]
:0048363A F3                      repz
:0048363B AB                      stosd
:0048363C AA                      stosb
:0048363D 33FF                    xor edi, edi
:0048363F C1E304                  shl ebx, 04
:00483642 8DABE8F34800            lea ebp, dword ptr [ebx+0048F3E8]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483688(C)
|
:00483648 8A4500                  mov al, byte ptr [ebp+00]
:0048364B 8BF5                    mov esi, ebp
:0048364D 84C0                    test al, al
:0048364F 7430                    je 00483681

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048367F(C)
|
:00483651 8A4E01                  mov cl, byte ptr [esi+01]
:00483654 84C9                    test cl, cl
:00483656 7429                    je 00483681
:00483658 33C0                    xor eax, eax
:0048365A 81E1FF000000            and ecx, 000000FF
:00483660 8A06                    mov al, byte ptr [esi]
:00483662 3BC1                    cmp eax, ecx
:00483664 7711                    ja 00483677
:00483666 8A97D0F34800            mov dl, byte ptr [edi+0048F3D0]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483675(C)
|
:0048366C 0890E9CD4B00            or byte ptr [eax+004BCDE9], dl
:00483672 40                      inc eax
:00483673 3BC1                    cmp eax, ecx
:00483675 76F5                    jbe 0048366C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483664(C)
|
:00483677 8A4602                  mov al, byte ptr [esi+02]
:0048367A 83C602                  add esi, 00000002
:0048367D 84C0                    test al, al
:0048367F 75D0                    jne 00483651

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0048364F(C), :00483656(C)
|
:00483681 47                      inc edi
:00483682 83C508                  add ebp, 00000008
:00483685 83FF04                  cmp edi, 00000004
:00483688 72BE                    jb 00483648
:0048368A 8B442428                mov eax, dword ptr [esp+28]
:0048368E C70584D84B0001000000    mov dword ptr [004BD884], 00000001
:00483698 50                      push eax
:00483699 A3F0CF4B00              mov dword ptr [004BCFF0], eax
:0048369E E88D000000              call 00483730
:004836A3 8B8BDCF34800            mov ecx, dword ptr [ebx+0048F3DC]
:004836A9 8B93E0F34800            mov edx, dword ptr [ebx+0048F3E0]
:004836AF A3F4CF4B00              mov dword ptr [004BCFF4], eax
:004836B4 8D83DCF34800            lea eax, dword ptr [ebx+0048F3DC]
:004836BA 83C404                  add esp, 00000004
:004836BD 890DF8CF4B00            mov dword ptr [004BCFF8], ecx
:004836C3 8B4008                  mov eax, dword ptr [eax+08]
:004836C6 8915FCCF4B00            mov dword ptr [004BCFFC], edx
:004836CC A300D04B00              mov dword ptr [004BD000], eax
:004836D1 E8FA000000              call 004837D0
:004836D6 5F                      pop edi
:004836D7 5E                      pop esi
:004836D8 5D                      pop ebp
:004836D9 33C0                    xor eax, eax
:004836DB 5B                      pop ebx
:004836DC 83C414                  add esp, 00000014
:004836DF C3                      ret



* Referenced by a CALL at Address:
|:004834DC   
|
:004836E0 8B442404                mov eax, dword ptr [esp+04]
:004836E4 C70504D04B0000000000    mov dword ptr [004BD004], 00000000
:004836EE 83F8FE                  cmp eax, FFFFFFFE
:004836F1 7510                    jne 00483703
:004836F3 C70504D04B0001000000    mov dword ptr [004BD004], 00000001
:004836FD FF2560614800            jmp dword ptr [00486160]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004836F1(C)
|
:00483703 83F8FD                  cmp eax, FFFFFFFD
:00483706 7510                    jne 00483718
:00483708 C70504D04B0001000000    mov dword ptr [004BD004], 00000001
:00483712 FF2564614800            jmp dword ptr [00486164]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483706(C)
|
:00483718 83F8FC                  cmp eax, FFFFFFFC
:0048371B 750F                    jne 0048372C
:0048371D A1D0CC4B00              mov eax, dword ptr [004BCCD0]
:00483722 C70504D04B0001000000    mov dword ptr [004BD004], 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048371B(C)
|
:0048372C C3                      ret
:0048372D 90                      nop
:0048372E 90                      nop
:0048372F 90                      nop

* Referenced by a CALL at Addresses:
|:004835C9   , :0048369E   
|
:00483730 8B442404                mov eax, dword ptr [esp+04]
:00483734 055CFCFFFF              add eax, FFFFFC5C
:00483739 83F812                  cmp eax, 00000012
:0048373C 7727                    ja 00483765
:0048373E 33C9                    xor ecx, ecx
:00483740 8A887C374800            mov cl, byte ptr [eax+0048377C]
:00483746 FF248D68374800          jmp dword ptr [4*ecx+00483768]
:0048374D B811040000              mov eax, 00000411
:00483752 C3                      ret


:00483753 B804080000              mov eax, 00000804
:00483758 C3                      ret


:00483759 B812040000              mov eax, 00000412
:0048375E C3                      ret



* Possible Reference to Dialog: DialogID_00C1, CONTROL_ID:0404, ""
                                  |
:0048375F B804040000              mov eax, 00000404
:00483764 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048373C(C)
|
:00483765 33C0                    xor eax, eax
:00483767 C3                      ret



:00483768 4D374800                DWORD 0048374D
:0048376C 53374800                DWORD 00483753
:00483770 59374800                DWORD 00483759
:00483774 5F374800                DWORD 0048375F
:00483778 65374800                DWORD 00483765


:0048377C 000404                  add byte ptr [esp+eax], al
:0048377F 0401                    add al, 01
:00483781 0404                    add al, 04
:00483783 0404                    add al, 04
:00483785 0404                    add al, 04
:00483787 0404                    add al, 04
:00483789 0404                    add al, 04
:0048378B 0404                    add al, 04
:0048378D 0203                    add al, byte ptr [ebx]
:0048378F 90                      nop

* Referenced by a CALL at Addresses:
|:00483501   , :0048360C   
|
:00483790 57                      push edi
:00483791 B940000000              mov ecx, 00000040
:00483796 33C0                    xor eax, eax
:00483798 BFE8CD4B00              mov edi, 004BCDE8
:0048379D F3                      repz
:0048379E AB                      stosd
:0048379F AA                      stosb
:004837A0 33C0                    xor eax, eax
:004837A2 5F                      pop edi
:004837A3 A3F0CF4B00              mov dword ptr [004BCFF0], eax
:004837A8 A384D84B00              mov dword ptr [004BD884], eax
:004837AD A3F4CF4B00              mov dword ptr [004BCFF4], eax
:004837B2 A3F8CF4B00              mov dword ptr [004BCFF8], eax
:004837B7 A3FCCF4B00              mov dword ptr [004BCFFC], eax
:004837BC A300D04B00              mov dword ptr [004BD000], eax
:004837C1 C3                      ret


:004837C2 90                      nop
:004837C3 90                      nop
:004837C4 90                      nop
:004837C5 90                      nop
:004837C6 90                      nop
:004837C7 90                      nop
:004837C8 90                      nop
:004837C9 90                      nop
:004837CA 90                      nop
:004837CB 90                      nop
:004837CC 90                      nop
:004837CD 90                      nop
:004837CE 90                      nop
:004837CF 90                      nop

* Referenced by a CALL at Addresses:
|:00483506   , :004835F4   , :00483611   , :004836D1   
|
:004837D0 8B0DF0CF4B00            mov ecx, dword ptr [004BCFF0]
:004837D6 81EC14050000            sub esp, 00000514
:004837DC 8D442400                lea eax, dword ptr [esp]
:004837E0 53                      push ebx
:004837E1 50                      push eax
:004837E2 51                      push ecx
:004837E3 FF1568614800            call dword ptr [00486168]
:004837E9 83F801                  cmp eax, 00000001
:004837EC 0F8552010000            jne 00483944
:004837F2 57                      push edi
:004837F3 56                      push esi
:004837F4 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483800(C)
|
:004837F6 88440420                mov byte ptr [esp+eax+20], al
:004837FA 40                      inc eax
:004837FB 3D00010000              cmp eax, 00000100
:00483800 72F4                    jb 004837F6
:00483802 8A442412                mov al, byte ptr [esp+12]
:00483806 C644242020              mov [esp+20], 20
:0048380B 84C0                    test al, al
:0048380D 7435                    je 00483844
:0048380F 8D542413                lea edx, dword ptr [esp+13]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483842(C)
|
:00483813 33C9                    xor ecx, ecx
:00483815 25FF000000              and eax, 000000FF
:0048381A 8A0A                    mov cl, byte ptr [edx]
:0048381C 3BC1                    cmp eax, ecx
:0048381E 771A                    ja 0048383A
:00483820 2BC8                    sub ecx, eax
:00483822 8D7C0420                lea edi, dword ptr [esp+eax+20]
:00483826 41                      inc ecx
:00483827 B820202020              mov eax, 20202020
:0048382C 8BF1                    mov esi, ecx
:0048382E C1E902                  shr ecx, 02
:00483831 F3                      repz
:00483832 AB                      stosd
:00483833 8BCE                    mov ecx, esi
:00483835 83E103                  and ecx, 00000003
:00483838 F3                      repz
:00483839 AA                      stosb

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048381E(C)
|
:0048383A 8A4201                  mov al, byte ptr [edx+01]
:0048383D 83C202                  add edx, 00000002
:00483840 84C0                    test al, al
:00483842 75CF                    jne 00483813

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048380D(C)
|
:00483844 8B15F4CF4B00            mov edx, dword ptr [004BCFF4]
:0048384A A1F0CF4B00              mov eax, dword ptr [004BCFF0]
:0048384F 6A00                    push 00000000
:00483851 52                      push edx
:00483852 8D8C2428030000          lea ecx, dword ptr [esp+00000328]
:00483859 50                      push eax
:0048385A 51                      push ecx
:0048385B 8D542430                lea edx, dword ptr [esp+30]
:0048385F 6800010000              push 00000100
:00483864 52                      push edx
:00483865 6A01                    push 00000001
:00483867 E824110000              call 00484990
:0048386C A1F0CF4B00              mov eax, dword ptr [004BCFF0]
:00483871 83C41C                  add esp, 0000001C
:00483874 8D8C2420010000          lea ecx, dword ptr [esp+00000120]
:0048387B 8D542420                lea edx, dword ptr [esp+20]
:0048387F 6A00                    push 00000000
:00483881 50                      push eax
:00483882 A1F4CF4B00              mov eax, dword ptr [004BCFF4]
:00483887 6800010000              push 00000100
:0048388C 51                      push ecx
:0048388D 6800010000              push 00000100
:00483892 52                      push edx
:00483893 6800010000              push 00000100
:00483898 50                      push eax
:00483899 E8F20D0000              call 00484690
:0048389E 8B0DF0CF4B00            mov ecx, dword ptr [004BCFF0]
:004838A4 83C420                  add esp, 00000020
:004838A7 8D942420020000          lea edx, dword ptr [esp+00000220]
:004838AE 8D442420                lea eax, dword ptr [esp+20]
:004838B2 6A00                    push 00000000
:004838B4 51                      push ecx
:004838B5 8B0DF4CF4B00            mov ecx, dword ptr [004BCFF4]
:004838BB 6800010000              push 00000100
:004838C0 52                      push edx
:004838C1 6800010000              push 00000100
:004838C6 50                      push eax
:004838C7 6800020000              push 00000200
:004838CC 51                      push ecx
:004838CD E8BE0D0000              call 00484690
:004838D2 83C420                  add esp, 00000020
:004838D5 33C0                    xor eax, eax
:004838D7 8D942420030000          lea edx, dword ptr [esp+00000320]
:004838DE B310                    mov bl, 10

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483938(C)
|
:004838E0 668B0A                  mov cx, word ptr [edx]
:004838E3 F6C101                  test cl, 01
:004838E6 741D                    je 00483905
:004838E8 8A88E9CD4B00            mov cl, byte ptr [eax+004BCDE9]
:004838EE 0ACB                    or cl, bl
:004838F0 8888E9CD4B00            mov byte ptr [eax+004BCDE9], cl
:004838F6 8A8C0420010000          mov cl, byte ptr [esp+eax+00000120]
:004838FD 8888F0CE4B00            mov byte ptr [eax+004BCEF0], cl
:00483903 EB2A                    jmp 0048392F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004838E6(C)
|
:00483905 F6C102                  test cl, 02
:00483908 741E                    je 00483928
:0048390A 8A88E9CD4B00            mov cl, byte ptr [eax+004BCDE9]
:00483910 80C920                  or cl, 20
:00483913 8888E9CD4B00            mov byte ptr [eax+004BCDE9], cl
:00483919 8A8C0420020000          mov cl, byte ptr [esp+eax+00000220]
:00483920 8888F0CE4B00            mov byte ptr [eax+004BCEF0], cl
:00483926 EB07                    jmp 0048392F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483908(C)
|
:00483928 C680F0CE4B0000          mov byte ptr [eax+004BCEF0], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00483903(U), :00483926(U)
|
:0048392F 40                      inc eax
:00483930 83C202                  add edx, 00000002
:00483933 3D00010000              cmp eax, 00000100
:00483938 72A6                    jb 004838E0
:0048393A 5E                      pop esi
:0048393B 5F                      pop edi
:0048393C 5B                      pop ebx
:0048393D 81C414050000            add esp, 00000514
:00483943 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004837EC(C)
|
:00483944 33C0                    xor eax, eax
:00483946 B310                    mov bl, 10

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004839A0(C)
|
:00483948 83F841                  cmp eax, 00000041
:0048394B 7220                    jb 0048396D
:0048394D 83F85A                  cmp eax, 0000005A
:00483950 771B                    ja 0048396D
:00483952 8A90E9CD4B00            mov dl, byte ptr [eax+004BCDE9]
:00483958 0AD3                    or dl, bl
:0048395A 8890E9CD4B00            mov byte ptr [eax+004BCDE9], dl
:00483960 8AD0                    mov dl, al
:00483962 80C220                  add dl, 20
:00483965 8890F0CE4B00            mov byte ptr [eax+004BCEF0], dl
:0048396B EB2D                    jmp 0048399A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0048394B(C), :00483950(C)
|
:0048396D 83F861                  cmp eax, 00000061
:00483970 7221                    jb 00483993
:00483972 83F87A                  cmp eax, 0000007A
:00483975 771C                    ja 00483993
:00483977 8A88E9CD4B00            mov cl, byte ptr [eax+004BCDE9]
:0048397D 80C920                  or cl, 20
:00483980 8888E9CD4B00            mov byte ptr [eax+004BCDE9], cl
:00483986 8AC8                    mov cl, al
:00483988 80E920                  sub cl, 20
:0048398B 8888F0CE4B00            mov byte ptr [eax+004BCEF0], cl
:00483991 EB07                    jmp 0048399A

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00483970(C), :00483975(C)
|
:00483993 C680F0CE4B0000          mov byte ptr [eax+004BCEF0], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0048396B(U), :00483991(U)
|
:0048399A 40                      inc eax
:0048399B 3D00010000              cmp eax, 00000100
:004839A0 72A6                    jb 00483948
:004839A2 5B                      pop ebx
:004839A3 81C414050000            add esp, 00000514
:004839A9 C3                      ret


:004839AA 90                      nop
:004839AB 90                      nop
:004839AC 90                      nop
:004839AD 90                      nop
:004839AE 90                      nop
:004839AF 90                      nop

* Referenced by a CALL at Address:
|:00481856   
|
:004839B0 6AFD                    push FFFFFFFD
:004839B2 E819FBFFFF              call 004834D0
:004839B7 83C404                  add esp, 00000004
:004839BA C3                      ret


:004839BB 90                      nop
:004839BC 90                      nop
:004839BD 90                      nop
:004839BE 90                      nop
:004839BF 90                      nop

* Referenced by a CALL at Address:
|:00481851   
|
:004839C0 83EC48                  sub esp, 00000048
:004839C3 53                      push ebx
:004839C4 55                      push ebp
:004839C5 56                      push esi
:004839C6 57                      push edi
:004839C7 6800010000              push 00000100
:004839CC E8BFEEFFFF              call 00482890
:004839D1 8BF0                    mov esi, eax
:004839D3 83C404                  add esp, 00000004
:004839D6 85F6                    test esi, esi
:004839D8 750A                    jne 004839E4
:004839DA 6A1B                    push 0000001B
:004839DC E89FDFFFFF              call 00481980
:004839E1 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004839D8(C)
|
:004839E4 8D8600010000            lea eax, dword ptr [esi+00000100]
:004839EA 893580D74B00            mov dword ptr [004BD780], esi
:004839F0 3BF0                    cmp esi, eax
:004839F2 C70580D84B0020000000    mov dword ptr [004BD880], 00000020
:004839FC B30A                    mov bl, 0A
:004839FE 7320                    jnb 00483A20

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483A1E(C)
|
:00483A00 C6460400                mov [esi+04], 00
:00483A04 C706FFFFFFFF            mov dword ptr [esi], FFFFFFFF
:00483A0A 885E05                  mov byte ptr [esi+05], bl
:00483A0D 8B0D80D74B00            mov ecx, dword ptr [004BD780]
:00483A13 83C608                  add esi, 00000008
:00483A16 81C100010000            add ecx, 00000100
:00483A1C 3BF1                    cmp esi, ecx
:00483A1E 72E0                    jb 00483A00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004839FE(C)
|
:00483A20 8D542414                lea edx, dword ptr [esp+14]
:00483A24 52                      push edx
:00483A25 FF15A8614800            call dword ptr [004861A8]
:00483A2B 66837C244600            cmp word ptr [esp+46], 0000
:00483A31 0F84F2000000            je 00483B29
:00483A37 8B442448                mov eax, dword ptr [esp+48]
:00483A3B 85C0                    test eax, eax
:00483A3D 0F84E6000000            je 00483B29
:00483A43 8B08                    mov ecx, dword ptr [eax]
:00483A45 8D7804                  lea edi, dword ptr [eax+04]
:00483A48 81F900080000            cmp ecx, 00000800
:00483A4E 894C2410                mov dword ptr [esp+10], ecx
:00483A52 8D2C0F                  lea ebp, dword ptr [edi+ecx]
:00483A55 7C08                    jl 00483A5F
:00483A57 C744241000080000        mov [esp+10], 00000800

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483A55(C)
|
:00483A5F 8B442410                mov eax, dword ptr [esp+10]
:00483A63 8B0D80D84B00            mov ecx, dword ptr [004BD880]
:00483A69 3BC8                    cmp ecx, eax
:00483A6B 7D69                    jge 00483AD6
:00483A6D BE84D74B00              mov esi, 004BD784

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483AC8(C)
|
:00483A72 6800010000              push 00000100
:00483A77 E814EEFFFF              call 00482890
:00483A7C 83C404                  add esp, 00000004
:00483A7F 85C0                    test eax, eax
:00483A81 7449                    je 00483ACC
:00483A83 8B0D80D84B00            mov ecx, dword ptr [004BD880]
:00483A89 8906                    mov dword ptr [esi], eax
:00483A8B 83C120                  add ecx, 00000020
:00483A8E 890D80D84B00            mov dword ptr [004BD880], ecx
:00483A94 8D8800010000            lea ecx, dword ptr [eax+00000100]
:00483A9A 3BC1                    cmp eax, ecx
:00483A9C 731C                    jnb 00483ABA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483AB8(C)
|
:00483A9E C6400400                mov [eax+04], 00
:00483AA2 C700FFFFFFFF            mov dword ptr [eax], FFFFFFFF
:00483AA8 885805                  mov byte ptr [eax+05], bl
:00483AAB 8B16                    mov edx, dword ptr [esi]
:00483AAD 83C008                  add eax, 00000008
:00483AB0 81C200010000            add edx, 00000100
:00483AB6 3BC2                    cmp eax, edx
:00483AB8 72E4                    jb 00483A9E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483A9C(C)
|
:00483ABA A180D84B00              mov eax, dword ptr [004BD880]
:00483ABF 8B4C2410                mov ecx, dword ptr [esp+10]
:00483AC3 83C604                  add esi, 00000004
:00483AC6 3BC1                    cmp eax, ecx
:00483AC8 7CA8                    jl 00483A72
:00483ACA EB0A                    jmp 00483AD6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483A81(C)
|
:00483ACC 8B0D80D84B00            mov ecx, dword ptr [004BD880]
:00483AD2 894C2410                mov dword ptr [esp+10], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00483A6B(C), :00483ACA(U)
|
:00483AD6 8B442410                mov eax, dword ptr [esp+10]
:00483ADA 33F6                    xor esi, esi
:00483ADC 85C0                    test eax, eax
:00483ADE 7E49                    jle 00483B29

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483B27(C)
|
:00483AE0 8B4D00                  mov ecx, dword ptr [ebp+00]
:00483AE3 83F9FF                  cmp ecx, FFFFFFFF
:00483AE6 7434                    je 00483B1C
:00483AE8 8A07                    mov al, byte ptr [edi]
:00483AEA A801                    test al, 01
:00483AEC 742E                    je 00483B1C
:00483AEE A808                    test al, 08
:00483AF0 750B                    jne 00483AFD
:00483AF2 51                      push ecx
:00483AF3 FF1554614800            call dword ptr [00486154]
:00483AF9 85C0                    test eax, eax
:00483AFB 741F                    je 00483B1C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483AF0(C)
|
:00483AFD 8BD6                    mov edx, esi
:00483AFF 8BC6                    mov eax, esi
:00483B01 C1FA05                  sar edx, 05
:00483B04 83E01F                  and eax, 0000001F
:00483B07 8B0C9580D74B00          mov ecx, dword ptr [4*edx+004BD780]
:00483B0E 8B5500                  mov edx, dword ptr [ebp+00]
:00483B11 8914C1                  mov dword ptr [ecx+8*eax], edx
:00483B14 8D04C1                  lea eax, dword ptr [ecx+8*eax]
:00483B17 8A0F                    mov cl, byte ptr [edi]
:00483B19 884804                  mov byte ptr [eax+04], cl

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00483AE6(C), :00483AEC(C), :00483AFB(C)
|
:00483B1C 8B442410                mov eax, dword ptr [esp+10]
:00483B20 46                      inc esi
:00483B21 47                      inc edi
:00483B22 83C504                  add ebp, 00000004
:00483B25 3BF0                    cmp esi, eax
:00483B27 7CB7                    jl 00483AE0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00483A31(C), :00483A3D(C), :00483ADE(C)
|
:00483B29 8B2D58614800            mov ebp, dword ptr [00486158]
:00483B2F 33DB                    xor ebx, ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483BA2(C)
|
:00483B31 8B1580D74B00            mov edx, dword ptr [004BD780]
:00483B37 8B04DA                  mov eax, dword ptr [edx+8*ebx]
:00483B3A 8D34DA                  lea esi, dword ptr [edx+8*ebx]
:00483B3D 83F8FF                  cmp eax, FFFFFFFF
:00483B40 7554                    jne 00483B96
:00483B42 85DB                    test ebx, ebx
:00483B44 C6460481                mov [esi+04], 81
:00483B48 7507                    jne 00483B51
:00483B4A B8F6FFFFFF              mov eax, FFFFFFF6
:00483B4F EB0A                    jmp 00483B5B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483B48(C)
|
:00483B51 8BC3                    mov eax, ebx
:00483B53 48                      dec eax
:00483B54 F7D8                    neg eax
:00483B56 1BC0                    sbb eax, eax
:00483B58 83C0F5                  add eax, FFFFFFF5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483B4F(U)
|
:00483B5B 50                      push eax
:00483B5C FFD5                    call ebp
:00483B5E 8BF8                    mov edi, eax
:00483B60 83FFFF                  cmp edi, FFFFFFFF
:00483B63 742A                    je 00483B8F
:00483B65 57                      push edi
:00483B66 FF1554614800            call dword ptr [00486154]
:00483B6C 85C0                    test eax, eax
:00483B6E 741F                    je 00483B8F
:00483B70 25FF000000              and eax, 000000FF
:00483B75 893E                    mov dword ptr [esi], edi
:00483B77 83F802                  cmp eax, 00000002
:00483B7A 7507                    jne 00483B83
:00483B7C 8A4604                  mov al, byte ptr [esi+04]
:00483B7F 0C40                    or al, 40
:00483B81 EB18                    jmp 00483B9B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483B7A(C)
|
:00483B83 83F803                  cmp eax, 00000003
:00483B86 7516                    jne 00483B9E
:00483B88 8A4604                  mov al, byte ptr [esi+04]
:00483B8B 0C08                    or al, 08
:00483B8D EB0C                    jmp 00483B9B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00483B63(C), :00483B6E(C)
|
:00483B8F 8A4604                  mov al, byte ptr [esi+04]
:00483B92 0C40                    or al, 40
:00483B94 EB05                    jmp 00483B9B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483B40(C)
|
:00483B96 8A4604                  mov al, byte ptr [esi+04]
:00483B99 0C80                    or al, 80

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00483B81(U), :00483B8D(U), :00483B94(U)
|
:00483B9B 884604                  mov byte ptr [esi+04], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483B86(C)
|
:00483B9E 43                      inc ebx
:00483B9F 83FB03                  cmp ebx, 00000003
:00483BA2 7C8D                    jl 00483B31
:00483BA4 A180D84B00              mov eax, dword ptr [004BD880]
:00483BA9 50                      push eax
:00483BAA FF155C614800            call dword ptr [0048615C]
:00483BB0 5F                      pop edi
:00483BB1 5E                      pop esi
:00483BB2 5D                      pop ebp
:00483BB3 5B                      pop ebx
:00483BB4 83C448                  add esp, 00000048
:00483BB7 C3                      ret


:00483BB8 90                      nop
:00483BB9 90                      nop
:00483BBA 90                      nop
:00483BBB 90                      nop
:00483BBC 90                      nop
:00483BBD 90                      nop
:00483BBE 90                      nop
:00483BBF 90                      nop

* Referenced by a CALL at Address:
|:00481837   
|
:00483BC0 6A00                    push 00000000
:00483BC2 6800100000              push 00001000
:00483BC7 6A01                    push 00000001
:00483BC9 FF15D0614800            call dword ptr [004861D0]
:00483BCF 85C0                    test eax, eax
:00483BD1 A364D74B00              mov dword ptr [004BD764], eax
:00483BD6 7501                    jne 00483BD9
:00483BD8 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483BD6(C)
|
:00483BD9 E8C2020000              call 00483EA0
:00483BDE 85C0                    test eax, eax
:00483BE0 750F                    jne 00483BF1
:00483BE2 A164D74B00              mov eax, dword ptr [004BD764]
:00483BE7 50                      push eax
:00483BE8 FF1550614800            call dword ptr [00486150]
:00483BEE 33C0                    xor eax, eax
:00483BF0 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483BE0(C)
|
:00483BF1 B801000000              mov eax, 00000001
:00483BF6 C3                      ret


:00483BF7 90                      nop
:00483BF8 90                      nop
:00483BF9 90                      nop
:00483BFA 90                      nop
:00483BFB 90                      nop
:00483BFC 90                      nop
:00483BFD 90                      nop
:00483BFE 90                      nop
:00483BFF 90                      nop

* Referenced by a CALL at Addresses:
|:00481989   , :004819B9   
|
:00483C00 A1A0CC4B00              mov eax, dword ptr [004BCCA0]
:00483C05 83F801                  cmp eax, 00000001
:00483C08 740D                    je 00483C17
:00483C0A 85C0                    test eax, eax
:00483C0C 752E                    jne 00483C3C
:00483C0E 833D24F3480001          cmp dword ptr [0048F324], 00000001
:00483C15 7525                    jne 00483C3C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483C08(C)
|
:00483C17 68FC000000              push 000000FC
:00483C1C E81F000000              call 00483C40
:00483C21 A108D04B00              mov eax, dword ptr [004BD008]
:00483C26 83C404                  add esp, 00000004
:00483C29 85C0                    test eax, eax
:00483C2B 7402                    je 00483C2F
:00483C2D FFD0                    call eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483C2B(C)
|
:00483C2F 68FF000000              push 000000FF
:00483C34 E807000000              call 00483C40
:00483C39 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00483C0C(C), :00483C15(C)
|
:00483C3C C3                      ret
:00483C3D 90                      nop
:00483C3E 90                      nop
:00483C3F 90                      nop

* Referenced by a CALL at Addresses:
|:00481993   , :004819C3   , :00483C1C   , :00483C34   , :00483E82   
|
:00483C40 8B4C2404                mov ecx, dword ptr [esp+04]
:00483C44 81ECA8010000            sub esp, 000001A8

* Possible StringData Ref from Data Obj ->""
                                  |
:00483C4A B8D8F44800              mov eax, 0048F4D8
:00483C4F 53                      push ebx
:00483C50 55                      push ebp
:00483C51 56                      push esi
:00483C52 57                      push edi
:00483C53 33ED                    xor ebp, ebp

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483C62(C)
|
:00483C55 3B08                    cmp ecx, dword ptr [eax]
:00483C57 740B                    je 00483C64
:00483C59 83C008                  add eax, 00000008
:00483C5C 45                      inc ebp
:00483C5D 3D68F54800              cmp eax, 0048F568
:00483C62 72F1                    jb 00483C55

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483C57(C)
|
:00483C64 3B0CEDD8F44800          cmp ecx, dword ptr [8*ebp+0048F4D8]
:00483C6B 0F859A010000            jne 00483E0B
:00483C71 A1A0CC4B00              mov eax, dword ptr [004BCCA0]
:00483C76 83F801                  cmp eax, 00000001
:00483C79 0F844E010000            je 00483DCD
:00483C7F 85C0                    test eax, eax
:00483C81 750D                    jne 00483C90
:00483C83 833D24F3480001          cmp dword ptr [0048F324], 00000001
:00483C8A 0F843D010000            je 00483DCD

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483C81(C)
|
:00483C90 81F9FC000000            cmp ecx, 000000FC
:00483C96 0F846F010000            je 00483E0B
:00483C9C 8D8424B4000000          lea eax, dword ptr [esp+000000B4]
:00483CA3 6804010000              push 00000104
:00483CA8 50                      push eax
:00483CA9 6A00                    push 00000000
:00483CAB FF1584614800            call dword ptr [00486184]
:00483CB1 85C0                    test eax, eax
:00483CB3 7516                    jne 00483CCB
:00483CB5 B905000000              mov ecx, 00000005
:00483CBA BE087B4800              mov esi, 00487B08
:00483CBF 8DBC24B4000000          lea edi, dword ptr [esp+000000B4]
:00483CC6 F3                      repz
:00483CC7 A5                      movsd
:00483CC8 66A5                    movsw
:00483CCA A4                      movsb

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483CB3(C)
|
:00483CCB 8DBC24B4000000          lea edi, dword ptr [esp+000000B4]
:00483CD2 83C9FF                  or ecx, FFFFFFFF
:00483CD5 33C0                    xor eax, eax
:00483CD7 8D9C24B4000000          lea ebx, dword ptr [esp+000000B4]
:00483CDE F2                      repnz
:00483CDF AE                      scasb
:00483CE0 F7D1                    not ecx
:00483CE2 83F93C                  cmp ecx, 0000003C
:00483CE5 762D                    jbe 00483D14
:00483CE7 8DBC24B4000000          lea edi, dword ptr [esp+000000B4]
:00483CEE 83C9FF                  or ecx, FFFFFFFF
:00483CF1 F2                      repnz
:00483CF2 AE                      scasb
:00483CF3 F7D1                    not ecx
:00483CF5 49                      dec ecx
:00483CF6 6A03                    push 00000003
:00483CF8 8BD9                    mov ebx, ecx
:00483CFA 8D8C24B8000000          lea ecx, dword ptr [esp+000000B8]
:00483D01 83E93B                  sub ecx, 0000003B
:00483D04 68047B4800              push 00487B04
:00483D09 03D9                    add ebx, ecx
:00483D0B 53                      push ebx
:00483D0C E84F0E0000              call 00484B60
:00483D11 83C40C                  add esp, 0000000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483CE5(C)
|

* Possible Reference to Dialog: DialogID_0154, CONTROL_ID:0006, "/"
                                  |
:00483D14 B906000000              mov ecx, 00000006
:00483D19 BEE87A4800              mov esi, 00487AE8
:00483D1E 8D7C2414                lea edi, dword ptr [esp+14]
:00483D22 33C0                    xor eax, eax
:00483D24 F3                      repz
:00483D25 A5                      movsd
:00483D26 66A5                    movsw
:00483D28 83C9FF                  or ecx, FFFFFFFF
:00483D2B 8BFB                    mov edi, ebx
:00483D2D F2                      repnz
:00483D2E AE                      scasb
:00483D2F F7D1                    not ecx
:00483D31 2BF9                    sub edi, ecx
:00483D33 8D542414                lea edx, dword ptr [esp+14]
:00483D37 8BD9                    mov ebx, ecx
:00483D39 8BF7                    mov esi, edi
:00483D3B 83C9FF                  or ecx, FFFFFFFF
:00483D3E 8BFA                    mov edi, edx
:00483D40 F2                      repnz
:00483D41 AE                      scasb
:00483D42 8BCB                    mov ecx, ebx
:00483D44 4F                      dec edi
:00483D45 C1E902                  shr ecx, 02
:00483D48 F3                      repz
:00483D49 A5                      movsd
:00483D4A 8BCB                    mov ecx, ebx
:00483D4C 8D542414                lea edx, dword ptr [esp+14]
:00483D50 83E103                  and ecx, 00000003
:00483D53 6810200100              push 00012010
:00483D58 F3                      repz
:00483D59 A4                      movsb
:00483D5A BFE47A4800              mov edi, 00487AE4
:00483D5F 83C9FF                  or ecx, FFFFFFFF
:00483D62 F2                      repnz
:00483D63 AE                      scasb
:00483D64 F7D1                    not ecx
:00483D66 2BF9                    sub edi, ecx
:00483D68 68BC7A4800              push 00487ABC
:00483D6D 8BF7                    mov esi, edi
:00483D6F 8BD9                    mov ebx, ecx
:00483D71 8BFA                    mov edi, edx
:00483D73 83C9FF                  or ecx, FFFFFFFF
:00483D76 F2                      repnz
:00483D77 AE                      scasb
:00483D78 8BCB                    mov ecx, ebx
:00483D7A 4F                      dec edi
:00483D7B C1E902                  shr ecx, 02
:00483D7E F3                      repz
:00483D7F A5                      movsd
:00483D80 8BCB                    mov ecx, ebx
:00483D82 8D54241C                lea edx, dword ptr [esp+1C]
:00483D86 83E103                  and ecx, 00000003
:00483D89 F3                      repz
:00483D8A A4                      movsb
:00483D8B 8B3CEDDCF44800          mov edi, dword ptr [8*ebp+0048F4DC]
:00483D92 83C9FF                  or ecx, FFFFFFFF
:00483D95 F2                      repnz
:00483D96 AE                      scasb
:00483D97 F7D1                    not ecx
:00483D99 2BF9                    sub edi, ecx
:00483D9B 8BF7                    mov esi, edi
:00483D9D 8BD9                    mov ebx, ecx
:00483D9F 8BFA                    mov edi, edx
:00483DA1 83C9FF                  or ecx, FFFFFFFF
:00483DA4 F2                      repnz
:00483DA5 AE                      scasb
:00483DA6 8BCB                    mov ecx, ebx
:00483DA8 4F                      dec edi
:00483DA9 C1E902                  shr ecx, 02
:00483DAC F3                      repz
:00483DAD A5                      movsd
:00483DAE 8BCB                    mov ecx, ebx
:00483DB0 8D44241C                lea eax, dword ptr [esp+1C]
:00483DB4 83E103                  and ecx, 00000003
:00483DB7 50                      push eax
:00483DB8 F3                      repz
:00483DB9 A4                      movsb
:00483DBA E8110D0000              call 00484AD0
:00483DBF 83C40C                  add esp, 0000000C
:00483DC2 5F                      pop edi
:00483DC3 5E                      pop esi
:00483DC4 5D                      pop ebp
:00483DC5 5B                      pop ebx
:00483DC6 81C4A8010000            add esp, 000001A8
:00483DCC C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00483C79(C), :00483C8A(C)
|
:00483DCD A180D74B00              mov eax, dword ptr [004BD780]
:00483DD2 85C0                    test eax, eax
:00483DD4 7408                    je 00483DDE
:00483DD6 8B7010                  mov esi, dword ptr [eax+10]
:00483DD9 83FEFF                  cmp esi, FFFFFFFF
:00483DDC 750A                    jne 00483DE8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483DD4(C)
|
:00483DDE 6AF4                    push FFFFFFF4
:00483DE0 FF1558614800            call dword ptr [00486158]
:00483DE6 8BF0                    mov esi, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483DDC(C)
|
:00483DE8 8B14EDDCF44800          mov edx, dword ptr [8*ebp+0048F4DC]
:00483DEF 8D4C2410                lea ecx, dword ptr [esp+10]
:00483DF3 6A00                    push 00000000
:00483DF5 51                      push ecx
:00483DF6 8BFA                    mov edi, edx
:00483DF8 83C9FF                  or ecx, FFFFFFFF
:00483DFB 33C0                    xor eax, eax
:00483DFD F2                      repnz
:00483DFE AE                      scasb
:00483DFF F7D1                    not ecx
:00483E01 49                      dec ecx
:00483E02 51                      push ecx
:00483E03 52                      push edx
:00483E04 56                      push esi
:00483E05 FF150C614800            call dword ptr [0048610C]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00483C6B(C), :00483C96(C)
|
:00483E0B 5F                      pop edi
:00483E0C 5E                      pop esi
:00483E0D 5D                      pop ebp
:00483E0E 5B                      pop ebx
:00483E0F 81C4A8010000            add esp, 000001A8
:00483E15 C3                      ret


:00483E16 90                      nop
:00483E17 90                      nop
:00483E18 90                      nop
:00483E19 90                      nop
:00483E1A 90                      nop
:00483E1B 90                      nop
:00483E1C 90                      nop
:00483E1D 90                      nop
:00483E1E 90                      nop
:00483E1F 90                      nop

* Referenced by a CALL at Addresses:
|:00481E60   , :004824C6   , :00482516   , :00482582   , :004825C8   
|
:00483E20 8B442408                mov eax, dword ptr [esp+08]
:00483E24 8B4C2404                mov ecx, dword ptr [esp+04]
:00483E28 56                      push esi
:00483E29 50                      push eax
:00483E2A 51                      push ecx
:00483E2B BE01000000              mov esi, 00000001
:00483E30 FF15D4614800            call dword ptr [004861D4]
:00483E36 85C0                    test eax, eax
:00483E38 7402                    je 00483E3C
:00483E3A 33F6                    xor esi, esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483E38(C)
|
:00483E3C 8BC6                    mov eax, esi
:00483E3E 5E                      pop esi
:00483E3F C3                      ret



* Referenced by a CALL at Addresses:
|:004824D9   , :00482529   , :00482595   , :004825D7   
|
:00483E40 8B442408                mov eax, dword ptr [esp+08]
:00483E44 8B4C2404                mov ecx, dword ptr [esp+04]
:00483E48 56                      push esi
:00483E49 50                      push eax
:00483E4A 51                      push ecx
:00483E4B BE01000000              mov esi, 00000001
:00483E50 FF15E0614800            call dword ptr [004861E0]
:00483E56 85C0                    test eax, eax
:00483E58 7402                    je 00483E5C
:00483E5A 33F6                    xor esi, esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483E58(C)
|
:00483E5C 8BC6                    mov eax, esi
:00483E5E 5E                      pop esi
:00483E5F C3                      ret



* Referenced by a CALL at Addresses:
|:004825E7   , :004829C6   
|
:00483E60 8B442404                mov eax, dword ptr [esp+04]
:00483E64 56                      push esi
:00483E65 50                      push eax
:00483E66 BE01000000              mov esi, 00000001
:00483E6B FF15E4614800            call dword ptr [004861E4]
:00483E71 85C0                    test eax, eax
:00483E73 7402                    je 00483E77
:00483E75 33F6                    xor esi, esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483E73(C)
|
:00483E77 8BC6                    mov eax, esi
:00483E79 5E                      pop esi
:00483E7A C3                      ret


:00483E7B 90                      nop
:00483E7C 90                      nop
:00483E7D 90                      nop
:00483E7E 90                      nop
:00483E7F 90                      nop

* Referenced by a CALL at Address:
|:004827DE   
|
:00483E80 6A0A                    push 0000000A
:00483E82 E8B9FDFFFF              call 00483C40
:00483E87 83C404                  add esp, 00000004
:00483E8A 6A16                    push 00000016
:00483E8C E8CF0D0000              call 00484C60
:00483E91 83C404                  add esp, 00000004
:00483E94 6A03                    push 00000003
:00483E96 E8B5D7FFFF              call 00481650
:00483E9B 83C404                  add esp, 00000004
:00483E9E C3                      ret


:00483E9F 90                      nop

* Referenced by a CALL at Addresses:
|:00483BD9   , :004843ED   
|
:00483EA0 A178F54800              mov eax, dword ptr [0048F578]
:00483EA5 55                      push ebp
:00483EA6 56                      push esi
:00483EA7 83F8FF                  cmp eax, FFFFFFFF
:00483EAA 57                      push edi
:00483EAB 7507                    jne 00483EB4

* Possible Indirect StringData Ref from Data Obj ->"hH"
                                  |
:00483EAD BD68F54800              mov ebp, 0048F568
:00483EB2 EB1D                    jmp 00483ED1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483EAB(C)
|
:00483EB4 A164D74B00              mov eax, dword ptr [004BD764]
:00483EB9 6820200000              push 00002020
:00483EBE 6A00                    push 00000000
:00483EC0 50                      push eax
:00483EC1 FF159C614800            call dword ptr [0048619C]
:00483EC7 8BE8                    mov ebp, eax
:00483EC9 85ED                    test ebp, ebp
:00483ECB 0F842B010000            je 00483FFC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483EB2(U)
|
:00483ED1 8B3DE8614800            mov edi, dword ptr [004861E8]
:00483ED7 6A04                    push 00000004
:00483ED9 6800200000              push 00002000
:00483EDE 6800004000              push 00400000
:00483EE3 6A00                    push 00000000
:00483EE5 FFD7                    call edi
:00483EE7 8BF0                    mov esi, eax
:00483EE9 85F6                    test esi, esi
:00483EEB 0F84F4000000            je 00483FE5
:00483EF1 6A04                    push 00000004
:00483EF3 6800100000              push 00001000
:00483EF8 6800000100              push 00010000
:00483EFD 56                      push esi
:00483EFE FFD7                    call edi
:00483F00 85C0                    test eax, eax
:00483F02 0F84CF000000            je 00483FD7
:00483F08 81FD68F54800            cmp ebp, 0048F568
:00483F0E 7528                    jne 00483F38

* Possible StringData Ref from Data Obj ->"hH"
                                  |
:00483F10 A168F54800              mov eax, dword ptr [0048F568]
:00483F15 85C0                    test eax, eax
:00483F17 750A                    jne 00483F23

* Possible Indirect StringData Ref from Data Obj ->"hH"
                                  |
:00483F19 C70568F5480068F54800    mov dword ptr [0048F568], 0048F568

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483F17(C)
|

* Possible StringData Ref from Data Obj ->"hH"
                                  |
:00483F23 A16CF54800              mov eax, dword ptr [0048F56C]
:00483F28 85C0                    test eax, eax
:00483F2A 7527                    jne 00483F53

* Possible Indirect StringData Ref from Data Obj ->"hH"
                                  |
:00483F2C C7056CF5480068F54800    mov dword ptr [0048F56C], 0048F568
:00483F36 EB1B                    jmp 00483F53

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483F0E(C)
|

* Possible Indirect StringData Ref from Data Obj ->"hH"
                                  |
:00483F38 C7450068F54800          mov [ebp+00], 0048F568

* Possible StringData Ref from Data Obj ->"hH"
                                  |
:00483F3F 8B0D6CF54800            mov ecx, dword ptr [0048F56C]
:00483F45 894D04                  mov dword ptr [ebp+04], ecx
:00483F48 892D6CF54800            mov dword ptr [0048F56C], ebp
:00483F4E 8B5504                  mov edx, dword ptr [ebp+04]
:00483F51 892A                    mov dword ptr [edx], ebp

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00483F2A(C), :00483F36(U)
|
:00483F53 8D8600004000            lea eax, dword ptr [esi+00400000]
:00483F59 8D4D18                  lea ecx, dword ptr [ebp+18]
:00483F5C 8D9598000000            lea edx, dword ptr [ebp+00000098]
:00483F62 894514                  mov dword ptr [ebp+14], eax
:00483F65 897510                  mov dword ptr [ebp+10], esi
:00483F68 894D08                  mov dword ptr [ebp+08], ecx
:00483F6B 89550C                  mov dword ptr [ebp+0C], edx
:00483F6E 33C0                    xor eax, eax
:00483F70 BFF1000000              mov edi, 000000F1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483F90(C)
|
:00483F75 33D2                    xor edx, edx
:00483F77 83F810                  cmp eax, 00000010
:00483F7A 0F9DC2                  setnl dl
:00483F7D 4A                      dec edx
:00483F7E 83C108                  add ecx, 00000008
:00483F81 23D7                    and edx, edi
:00483F83 4A                      dec edx
:00483F84 40                      inc eax
:00483F85 8951F8                  mov dword ptr [ecx-08], edx
:00483F88 8979FC                  mov dword ptr [ecx-04], edi
:00483F8B 3D00040000              cmp eax, 00000400
:00483F90 7CE3                    jl 00483F75
:00483F92 B900400000              mov ecx, 00004000
:00483F97 33C0                    xor eax, eax
:00483F99 8BFE                    mov edi, esi
:00483F9B F3                      repz
:00483F9C AB                      stosd
:00483F9D 8B4510                  mov eax, dword ptr [ebp+10]
:00483FA0 0500000100              add eax, 00010000
:00483FA5 3BF0                    cmp esi, eax
:00483FA7 7328                    jnb 00483FD1
:00483FA9 B9F0000000              mov ecx, 000000F0
:00483FAE B0FF                    mov al, FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483FCF(C)
|
:00483FB0 8D5608                  lea edx, dword ptr [esi+08]
:00483FB3 894E04                  mov dword ptr [esi+04], ecx
:00483FB6 8916                    mov dword ptr [esi], edx
:00483FB8 8886F8000000            mov byte ptr [esi+000000F8], al
:00483FBE 8B5510                  mov edx, dword ptr [ebp+10]
:00483FC1 81C600100000            add esi, 00001000
:00483FC7 81C200000100            add edx, 00010000
:00483FCD 3BF2                    cmp esi, edx
:00483FCF 72DF                    jb 00483FB0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483FA7(C)
|
:00483FD1 8BC5                    mov eax, ebp
:00483FD3 5F                      pop edi
:00483FD4 5E                      pop esi
:00483FD5 5D                      pop ebp
:00483FD6 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483F02(C)
|
:00483FD7 6800800000              push 00008000
:00483FDC 6A00                    push 00000000
:00483FDE 56                      push esi
:00483FDF FF154C614800            call dword ptr [0048614C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483EEB(C)
|
:00483FE5 81FD68F54800            cmp ebp, 0048F568
:00483FEB 740F                    je 00483FFC
:00483FED A164D74B00              mov eax, dword ptr [004BD764]
:00483FF2 55                      push ebp
:00483FF3 6A00                    push 00000000
:00483FF5 50                      push eax
:00483FF6 FF1598614800            call dword ptr [00486198]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00483ECB(C), :00483FEB(C)
|
:00483FFC 5F                      pop edi
:00483FFD 5E                      pop esi
:00483FFE 33C0                    xor eax, eax
:00484000 5D                      pop ebp
:00484001 C3                      ret


:00484002 90                      nop
:00484003 90                      nop
:00484004 90                      nop
:00484005 90                      nop
:00484006 90                      nop
:00484007 90                      nop
:00484008 90                      nop
:00484009 90                      nop
:0048400A 90                      nop
:0048400B 90                      nop
:0048400C 90                      nop
:0048400D 90                      nop
:0048400E 90                      nop
:0048400F 90                      nop

* Referenced by a CALL at Address:
|:0048411C   
|
:00484010 56                      push esi
:00484011 8B742408                mov esi, dword ptr [esp+08]
:00484015 6800800000              push 00008000
:0048401A 6A00                    push 00000000
:0048401C 8B4610                  mov eax, dword ptr [esi+10]
:0048401F 50                      push eax
:00484020 FF154C614800            call dword ptr [0048614C]
:00484026 393588154900            cmp dword ptr [00491588], esi
:0048402C 7509                    jne 00484037
:0048402E 8B4E04                  mov ecx, dword ptr [esi+04]
:00484031 890D88154900            mov dword ptr [00491588], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048402C(C)
|
:00484037 81FE68F54800            cmp esi, 0048F568
:0048403D 7420                    je 0048405F
:0048403F 8B5604                  mov edx, dword ptr [esi+04]
:00484042 8B06                    mov eax, dword ptr [esi]
:00484044 56                      push esi
:00484045 6A00                    push 00000000
:00484047 8902                    mov dword ptr [edx], eax
:00484049 8B0E                    mov ecx, dword ptr [esi]
:0048404B 8B5604                  mov edx, dword ptr [esi+04]
:0048404E 895104                  mov dword ptr [ecx+04], edx
:00484051 A164D74B00              mov eax, dword ptr [004BD764]
:00484056 50                      push eax
:00484057 FF1598614800            call dword ptr [00486198]
:0048405D 5E                      pop esi
:0048405E C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048403D(C)
|
:0048405F C70578F54800FFFFFFFF    mov dword ptr [0048F578], FFFFFFFF
:00484069 5E                      pop esi
:0048406A C3                      ret


:0048406B 90                      nop
:0048406C 90                      nop
:0048406D 90                      nop
:0048406E 90                      nop
:0048406F 90                      nop

* Referenced by a CALL at Address:
|:004841E9   
|
:00484070 53                      push ebx
:00484071 55                      push ebp
:00484072 56                      push esi
:00484073 57                      push edi

* Possible StringData Ref from Data Obj ->"hH"
                                  |
:00484074 8B3D6CF54800            mov edi, dword ptr [0048F56C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484132(C)
|
:0048407A 837F10FF                cmp dword ptr [edi+10], FFFFFFFF
:0048407E 0F84A0000000            je 00484124
:00484084 33ED                    xor ebp, ebp
:00484086 8DB710200000            lea esi, dword ptr [edi+00002010]
:0048408C BB00F03F00              mov ebx, 003FF000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004840EB(C)
|
:00484091 813EF0000000            cmp dword ptr [esi], 000000F0
:00484097 7547                    jne 004840E0
:00484099 8B4710                  mov eax, dword ptr [edi+10]
:0048409C 6800400000              push 00004000
:004840A1 03C3                    add eax, ebx
:004840A3 6800100000              push 00001000
:004840A8 50                      push eax
:004840A9 FF154C614800            call dword ptr [0048614C]
:004840AF 85C0                    test eax, eax
:004840B1 742D                    je 004840E0
:004840B3 C706FFFFFFFF            mov dword ptr [esi], FFFFFFFF
:004840B9 8B1510D04B00            mov edx, dword ptr [004BD010]
:004840BF 4A                      dec edx
:004840C0 891510D04B00            mov dword ptr [004BD010], edx
:004840C6 8B470C                  mov eax, dword ptr [edi+0C]
:004840C9 85C0                    test eax, eax
:004840CB 7404                    je 004840D1
:004840CD 3BC6                    cmp eax, esi
:004840CF 7603                    jbe 004840D4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004840CB(C)
|
:004840D1 89770C                  mov dword ptr [edi+0C], esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004840CF(C)
|
:004840D4 8B442414                mov eax, dword ptr [esp+14]
:004840D8 45                      inc ebp
:004840D9 48                      dec eax
:004840DA 89442414                mov dword ptr [esp+14], eax
:004840DE 740D                    je 004840ED

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00484097(C), :004840B1(C)
|
:004840E0 81EB00100000            sub ebx, 00001000
:004840E6 83EE08                  sub esi, 00000008
:004840E9 85DB                    test ebx, ebx
:004840EB 7DA4                    jge 00484091

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004840DE(C)
|
:004840ED 8BD7                    mov edx, edi
:004840EF 8B7F04                  mov edi, dword ptr [edi+04]
:004840F2 85ED                    test ebp, ebp
:004840F4 742E                    je 00484124
:004840F6 837A18FF                cmp dword ptr [edx+18], FFFFFFFF
:004840FA 7528                    jne 00484124
:004840FC B801000000              mov eax, 00000001
:00484101 8D4A20                  lea ecx, dword ptr [edx+20]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484112(C)
|
:00484104 8339FF                  cmp dword ptr [ecx], FFFFFFFF
:00484107 750B                    jne 00484114
:00484109 40                      inc eax
:0048410A 83C108                  add ecx, 00000008
:0048410D 3D00040000              cmp eax, 00000400
:00484112 7CF0                    jl 00484104

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484107(C)
|
:00484114 3D00040000              cmp eax, 00000400
:00484119 7509                    jne 00484124
:0048411B 52                      push edx
:0048411C E8EFFEFFFF              call 00484010
:00484121 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0048407E(C), :004840F4(C), :004840FA(C), :00484119(C)
|
:00484124 3B3D6CF54800            cmp edi, dword ptr [0048F56C]
:0048412A 740C                    je 00484138
:0048412C 8B442414                mov eax, dword ptr [esp+14]
:00484130 85C0                    test eax, eax
:00484132 0F8F42FFFFFF            jg 0048407A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048412A(C)
|
:00484138 5F                      pop edi
:00484139 5E                      pop esi
:0048413A 5D                      pop ebp
:0048413B 5B                      pop ebx
:0048413C C3                      ret


:0048413D 90                      nop
:0048413E 90                      nop
:0048413F 90                      nop

* Referenced by a CALL at Addresses:
|:00482955   , :00482A91   , :00482BD1   
|
:00484140 8B4C2404                mov ecx, dword ptr [esp+04]

* Possible Indirect StringData Ref from Data Obj ->"hH"
                                  |
:00484144 B868F54800              mov eax, 0048F568

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048415C(U)
|
:00484149 3B4810                  cmp ecx, dword ptr [eax+10]
:0048414C 7605                    jbe 00484153
:0048414E 3B4814                  cmp ecx, dword ptr [eax+14]
:00484151 720B                    jb 0048415E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048414C(C)
|
:00484153 8B00                    mov eax, dword ptr [eax]
:00484155 3D68F54800              cmp eax, 0048F568
:0048415A 743A                    je 00484196
:0048415C EBEB                    jmp 00484149

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484151(C)
|
:0048415E F6C10F                  test cl, 0F
:00484161 7533                    jne 00484196
:00484163 8BD1                    mov edx, ecx
:00484165 81E2FF0F0000            and edx, 00000FFF
:0048416B 81FA00010000            cmp edx, 00000100
:00484171 7223                    jb 00484196
:00484173 8B542408                mov edx, dword ptr [esp+08]
:00484177 8902                    mov dword ptr [edx], eax
:00484179 8B54240C                mov edx, dword ptr [esp+0C]
:0048417D 8BC1                    mov eax, ecx
:0048417F 2500F0FFFF              and eax, FFFFF000
:00484184 2BC8                    sub ecx, eax
:00484186 8902                    mov dword ptr [edx], eax
:00484188 81E900010000            sub ecx, 00000100
:0048418E C1F904                  sar ecx, 04
:00484191 8D440108                lea eax, dword ptr [ecx+eax+08]
:00484195 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0048415A(C), :00484161(C), :00484171(C)
|
:00484196 33C0                    xor eax, eax
:00484198 C3                      ret


:00484199 90                      nop
:0048419A 90                      nop
:0048419B 90                      nop
:0048419C 90                      nop
:0048419D 90                      nop
:0048419E 90                      nop
:0048419F 90                      nop

* Referenced by a CALL at Addresses:
|:0048296C   , :00482B13   , :00482B6E   
|
:004841A0 8B442404                mov eax, dword ptr [esp+04]
:004841A4 8B4C2408                mov ecx, dword ptr [esp+08]
:004841A8 56                      push esi
:004841A9 33D2                    xor edx, edx
:004841AB 2B4810                  sub ecx, dword ptr [eax+10]
:004841AE C1F90C                  sar ecx, 0C
:004841B1 8B74C818                mov esi, dword ptr [eax+8*ecx+18]
:004841B5 8D44C818                lea eax, dword ptr [eax+8*ecx+18]
:004841B9 8B4C2410                mov ecx, dword ptr [esp+10]
:004841BD 8A11                    mov dl, byte ptr [ecx]
:004841BF 03F2                    add esi, edx
:004841C1 8930                    mov dword ptr [eax], esi
:004841C3 C60100                  mov byte ptr [ecx], 00
:004841C6 8B08                    mov ecx, dword ptr [eax]
:004841C8 C74004F1000000          mov [eax+04], 000000F1
:004841CF 81F9F0000000            cmp ecx, 000000F0
:004841D5 751A                    jne 004841F1
:004841D7 A110D04B00              mov eax, dword ptr [004BD010]
:004841DC 40                      inc eax
:004841DD 83F820                  cmp eax, 00000020
:004841E0 A310D04B00              mov dword ptr [004BD010], eax
:004841E5 750A                    jne 004841F1
:004841E7 6A10                    push 00000010
:004841E9 E882FEFFFF              call 00484070
:004841EE 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004841D5(C), :004841E5(C)
|
:004841F1 5E                      pop esi
:004841F2 C3                      ret


:004841F3 90                      nop
:004841F4 90                      nop
:004841F5 90                      nop
:004841F6 90                      nop
:004841F7 90                      nop
:004841F8 90                      nop
:004841F9 90                      nop
:004841FA 90                      nop
:004841FB 90                      nop
:004841FC 90                      nop
:004841FD 90                      nop
:004841FE 90                      nop
:004841FF 90                      nop

* Referenced by a CALL at Addresses:
|:0048291A   , :00482AD3   , :00484E6E   
|
:00484200 51                      push ecx

* Possible StringData Ref from Data Obj ->"hH"
                                  |
:00484201 8B0D88154900            mov ecx, dword ptr [00491588]
:00484207 53                      push ebx
:00484208 8B5C240C                mov ebx, dword ptr [esp+0C]
:0048420C 55                      push ebp
:0048420D 56                      push esi
:0048420E 57                      push edi
:0048420F 894C2410                mov dword ptr [esp+10], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004842B3(U)
|
:00484213 8B4110                  mov eax, dword ptr [ecx+10]
:00484216 83F8FF                  cmp eax, FFFFFFFF
:00484219 0F8485000000            je 004842A4
:0048421F 8B7908                  mov edi, dword ptr [ecx+08]
:00484222 8DA918200000            lea ebp, dword ptr [ecx+00002018]
:00484228 8BF7                    mov esi, edi
:0048422A 2BF1                    sub esi, ecx
:0048422C 83EE18                  sub esi, 00000018
:0048422F C1FE03                  sar esi, 03
:00484232 C1E60C                  shl esi, 0C
:00484235 03F0                    add esi, eax
:00484237 3BFD                    cmp edi, ebp
:00484239 732E                    jnb 00484269

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484267(C)
|
:0048423B 8B07                    mov eax, dword ptr [edi]
:0048423D 3BC3                    cmp eax, ebx
:0048423F 7C1B                    jl 0048425C
:00484241 395F04                  cmp dword ptr [edi+04], ebx
:00484244 7616                    jbe 0048425C
:00484246 53                      push ebx
:00484247 50                      push eax
:00484248 56                      push esi
:00484249 E8F2010000              call 00484440
:0048424E 83C40C                  add esp, 0000000C
:00484251 85C0                    test eax, eax
:00484253 7563                    jne 004842B8
:00484255 8B4C2410                mov ecx, dword ptr [esp+10]
:00484259 895F04                  mov dword ptr [edi+04], ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0048423F(C), :00484244(C)
|
:0048425C 83C708                  add edi, 00000008
:0048425F 81C600100000            add esi, 00001000
:00484265 3BFD                    cmp edi, ebp
:00484267 72D2                    jb 0048423B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484239(C)
|
:00484269 8B6908                  mov ebp, dword ptr [ecx+08]
:0048426C 8B7910                  mov edi, dword ptr [ecx+10]
:0048426F 8D7118                  lea esi, dword ptr [ecx+18]
:00484272 3BF5                    cmp esi, ebp
:00484274 732E                    jnb 004842A4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004842A2(C)
|
:00484276 8B06                    mov eax, dword ptr [esi]
:00484278 3BC3                    cmp eax, ebx
:0048427A 7C1B                    jl 00484297
:0048427C 395E04                  cmp dword ptr [esi+04], ebx
:0048427F 7616                    jbe 00484297
:00484281 53                      push ebx
:00484282 50                      push eax
:00484283 57                      push edi
:00484284 E8B7010000              call 00484440
:00484289 83C40C                  add esp, 0000000C
:0048428C 85C0                    test eax, eax
:0048428E 7541                    jne 004842D1
:00484290 8B4C2410                mov ecx, dword ptr [esp+10]
:00484294 895E04                  mov dword ptr [esi+04], ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0048427A(C), :0048427F(C)
|
:00484297 83C608                  add esi, 00000008
:0048429A 81C700100000            add edi, 00001000
:004842A0 3BF5                    cmp esi, ebp
:004842A2 72D2                    jb 00484276

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00484219(C), :00484274(C)
|
:004842A4 8B09                    mov ecx, dword ptr [ecx]

* Possible StringData Ref from Data Obj ->"hH"
                                  |
:004842A6 A188154900              mov eax, dword ptr [00491588]
:004842AB 3BC8                    cmp ecx, eax
:004842AD 894C2410                mov dword ptr [esp+10], ecx
:004842B1 7437                    je 004842EA
:004842B3 E95BFFFFFF              jmp 00484213

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484253(C)
|
:004842B8 8B4C2410                mov ecx, dword ptr [esp+10]
:004842BC 890D88154900            mov dword ptr [00491588], ecx
:004842C2 8B17                    mov edx, dword ptr [edi]
:004842C4 2BD3                    sub edx, ebx
:004842C6 8917                    mov dword ptr [edi], edx
:004842C8 897908                  mov dword ptr [ecx+08], edi
:004842CB 5F                      pop edi
:004842CC 5E                      pop esi
:004842CD 5D                      pop ebp
:004842CE 5B                      pop ebx
:004842CF 59                      pop ecx
:004842D0 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048428E(C)
|
:004842D1 8B4C2410                mov ecx, dword ptr [esp+10]
:004842D5 890D88154900            mov dword ptr [00491588], ecx
:004842DB 8B16                    mov edx, dword ptr [esi]
:004842DD 2BD3                    sub edx, ebx
:004842DF 8916                    mov dword ptr [esi], edx
:004842E1 897108                  mov dword ptr [ecx+08], esi
:004842E4 5F                      pop edi
:004842E5 5E                      pop esi
:004842E6 5D                      pop ebp
:004842E7 5B                      pop ebx
:004842E8 59                      pop ecx
:004842E9 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004842B1(C)
|

* Possible Indirect StringData Ref from Data Obj ->"hH"
                                  |
:004842EA BD68F54800              mov ebp, 0048F568
:004842EF 83C9FF                  or ecx, FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048430D(U)
|
:004842F2 394D10                  cmp dword ptr [ebp+10], ecx
:004842F5 7407                    je 004842FE
:004842F7 8B450C                  mov eax, dword ptr [ebp+0C]
:004842FA 85C0                    test eax, eax
:004842FC 7511                    jne 0048430F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004842F5(C)
|
:004842FE 8B6D00                  mov ebp, dword ptr [ebp+00]
:00484301 81FD68F54800            cmp ebp, 0048F568
:00484307 0F84E0000000            je 004843ED
:0048430D EBE3                    jmp 004842F2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004842FC(C)
|
:0048430F 8B450C                  mov eax, dword ptr [ebp+0C]
:00484312 8B7510                  mov esi, dword ptr [ebp+10]
:00484315 8BF8                    mov edi, eax
:00484317 89442418                mov dword ptr [esp+18], eax
:0048431B 2BFD                    sub edi, ebp
:0048431D 8B10                    mov edx, dword ptr [eax]
:0048431F 83EF18                  sub edi, 00000018
:00484322 C1FF03                  sar edi, 03
:00484325 C1E70C                  shl edi, 0C
:00484328 03FE                    add edi, esi
:0048432A 33F6                    xor esi, esi
:0048432C 3BD1                    cmp edx, ecx
:0048432E 7510                    jne 00484340

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048433E(C)
|
:00484330 83FE10                  cmp esi, 00000010
:00484333 7D0B                    jge 00484340
:00484335 8B5008                  mov edx, dword ptr [eax+08]
:00484338 83C008                  add eax, 00000008
:0048433B 46                      inc esi
:0048433C 3BD1                    cmp edx, ecx
:0048433E 74F0                    je 00484330

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0048432E(C), :00484333(C)
|
:00484340 8BC6                    mov eax, esi
:00484342 6A04                    push 00000004
:00484344 C1E00C                  shl eax, 0C
:00484347 6800100000              push 00001000
:0048434C 50                      push eax
:0048434D 57                      push edi
:0048434E 89442420                mov dword ptr [esp+20], eax
:00484352 FF15E8614800            call dword ptr [004861E8]
:00484358 3BC7                    cmp eax, edi
:0048435A 0F85CB000000            jne 0048442B
:00484360 8B542418                mov edx, dword ptr [esp+18]
:00484364 8B442410                mov eax, dword ptr [esp+10]
:00484368 33C9                    xor ecx, ecx
:0048436A 85F6                    test esi, esi
:0048436C 8BCA                    mov ecx, edx
:0048436E 7E32                    jle 004843A2
:00484370 8D4704                  lea eax, dword ptr [edi+04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048439C(C)
|
:00484373 8D5004                  lea edx, dword ptr [eax+04]
:00484376 C700F0000000            mov dword ptr [eax], 000000F0
:0048437C 8950FC                  mov dword ptr [eax-04], edx
:0048437F C680F4000000FF          mov byte ptr [eax+000000F4], FF
:00484386 C701F0000000            mov dword ptr [ecx], 000000F0
:0048438C C74104F1000000          mov [ecx+04], 000000F1
:00484393 0500100000              add eax, 00001000
:00484398 83C108                  add ecx, 00000008
:0048439B 4E                      dec esi
:0048439C 75D5                    jne 00484373
:0048439E 8B542418                mov edx, dword ptr [esp+18]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048436E(C)
|
:004843A2 8D8518200000            lea eax, dword ptr [ebp+00002018]
:004843A8 892D88154900            mov dword ptr [00491588], ebp
:004843AE 3BC8                    cmp ecx, eax
:004843B0 730E                    jnb 004843C0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004843BC(C)
|
:004843B2 8339FF                  cmp dword ptr [ecx], FFFFFFFF
:004843B5 7407                    je 004843BE
:004843B7 83C108                  add ecx, 00000008
:004843BA 3BC8                    cmp ecx, eax
:004843BC 72F4                    jb 004843B2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004843B5(C)
|
:004843BE 3BC8                    cmp ecx, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004843B0(C)
|
:004843C0 1BC0                    sbb eax, eax
:004843C2 23C1                    and eax, ecx
:004843C4 89450C                  mov dword ptr [ebp+0C], eax
:004843C7 885F08                  mov byte ptr [edi+08], bl
:004843CA 895508                  mov dword ptr [ebp+08], edx
:004843CD 8B0A                    mov ecx, dword ptr [edx]
:004843CF 2BCB                    sub ecx, ebx
:004843D1 890A                    mov dword ptr [edx], ecx
:004843D3 8B4704                  mov eax, dword ptr [edi+04]
:004843D6 2BC3                    sub eax, ebx
:004843D8 8D4C1F08                lea ecx, dword ptr [edi+ebx+08]
:004843DC 894704                  mov dword ptr [edi+04], eax
:004843DF 890F                    mov dword ptr [edi], ecx
:004843E1 8D8700010000            lea eax, dword ptr [edi+00000100]
:004843E7 5F                      pop edi
:004843E8 5E                      pop esi
:004843E9 5D                      pop ebp
:004843EA 5B                      pop ebx
:004843EB 59                      pop ecx
:004843EC C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484307(C)
|
:004843ED E8AEFAFFFF              call 00483EA0
:004843F2 85C0                    test eax, eax
:004843F4 7435                    je 0048442B
:004843F6 8B4810                  mov ecx, dword ptr [eax+10]
:004843F9 885908                  mov byte ptr [ecx+08], bl
:004843FC 8D541908                lea edx, dword ptr [ecx+ebx+08]
:00484400 A388154900              mov dword ptr [00491588], eax
:00484405 8911                    mov dword ptr [ecx], edx
:00484407 BAF0000000              mov edx, 000000F0
:0048440C 2BD3                    sub edx, ebx
:0048440E 81E3FF000000            and ebx, 000000FF
:00484414 895104                  mov dword ptr [ecx+04], edx
:00484417 8B5018                  mov edx, dword ptr [eax+18]
:0048441A 2BD3                    sub edx, ebx
:0048441C 895018                  mov dword ptr [eax+18], edx
:0048441F 8D8100010000            lea eax, dword ptr [ecx+00000100]
:00484425 5F                      pop edi
:00484426 5E                      pop esi
:00484427 5D                      pop ebp
:00484428 5B                      pop ebx
:00484429 59                      pop ecx
:0048442A C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0048435A(C), :004843F4(C)
|
:0048442B 5F                      pop edi
:0048442C 5E                      pop esi
:0048442D 5D                      pop ebp
:0048442E 33C0                    xor eax, eax
:00484430 5B                      pop ebx
:00484431 59                      pop ecx
:00484432 C3                      ret


:00484433 90                      nop
:00484434 90                      nop
:00484435 90                      nop
:00484436 90                      nop
:00484437 90                      nop
:00484438 90                      nop
:00484439 90                      nop
:0048443A 90                      nop
:0048443B 90                      nop
:0048443C 90                      nop
:0048443D 90                      nop
:0048443E 90                      nop
:0048443F 90                      nop

* Referenced by a CALL at Addresses:
|:00484249   , :00484284   
|
:00484440 8B54240C                mov edx, dword ptr [esp+0C]
:00484444 53                      push ebx
:00484445 55                      push ebp
:00484446 56                      push esi
:00484447 57                      push edi
:00484448 8B7C2414                mov edi, dword ptr [esp+14]
:0048444C 8B4704                  mov eax, dword ptr [edi+04]
:0048444F 8B0F                    mov ecx, dword ptr [edi]
:00484451 3BC2                    cmp eax, edx
:00484453 894C2414                mov dword ptr [esp+14], ecx
:00484457 8BF1                    mov esi, ecx
:00484459 8D9FF8000000            lea ebx, dword ptr [edi+000000F8]
:0048445F 723A                    jb 0048449B
:00484461 8D0411                  lea eax, dword ptr [ecx+edx]
:00484464 8811                    mov byte ptr [ecx], dl
:00484466 3BC3                    cmp eax, ebx
:00484468 7310                    jnb 0048447A
:0048446A 8B37                    mov esi, dword ptr [edi]
:0048446C 8B4704                  mov eax, dword ptr [edi+04]
:0048446F 03F2                    add esi, edx
:00484471 2BC2                    sub eax, edx
:00484473 8937                    mov dword ptr [edi], esi
:00484475 894704                  mov dword ptr [edi+04], eax
:00484478 EB0C                    jmp 00484486

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484468(C)
|
:0048447A 8D5708                  lea edx, dword ptr [edi+08]
:0048447D C7470400000000          mov [edi+04], 00000000
:00484484 8917                    mov dword ptr [edi], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484478(U)
|
:00484486 8D047F                  lea eax, dword ptr [edi+2*edi]
:00484489 8D0480                  lea eax, dword ptr [eax+4*eax]
:0048448C 8BD0                    mov edx, eax
:0048448E 8D4108                  lea eax, dword ptr [ecx+08]
:00484491 C1E004                  shl eax, 04
:00484494 2BC2                    sub eax, edx
:00484496 5F                      pop edi
:00484497 5E                      pop esi
:00484498 5D                      pop ebp
:00484499 5B                      pop ebx
:0048449A C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048445F(C)
|
:0048449B 03C1                    add eax, ecx
:0048449D 803800                  cmp byte ptr [eax], 00
:004844A0 7402                    je 004844A4
:004844A2 8BF0                    mov esi, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004844A0(C)
|
:004844A4 8D0416                  lea eax, dword ptr [esi+edx]
:004844A7 3BC3                    cmp eax, ebx
:004844A9 8B5C2418                mov ebx, dword ptr [esp+18]
:004844AD 7375                    jnb 00484524

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484503(C)
|
:004844AF 8A06                    mov al, byte ptr [esi]
:004844B1 84C0                    test al, al
:004844B3 753C                    jne 004844F1
:004844B5 807E0100                cmp byte ptr [esi+01], 00
:004844B9 8D4601                  lea eax, dword ptr [esi+01]
:004844BC B901000000              mov ecx, 00000001
:004844C1 7507                    jne 004844CA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004844C8(C)
|
:004844C3 40                      inc eax
:004844C4 41                      inc ecx
:004844C5 803800                  cmp byte ptr [eax], 00
:004844C8 74F9                    je 004844C3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004844C1(C)
|
:004844CA 3BCA                    cmp ecx, edx
:004844CC 7339                    jnb 00484507
:004844CE 8B6C2414                mov ebp, dword ptr [esp+14]
:004844D2 3BF5                    cmp esi, ebp
:004844D4 7509                    jne 004844DF
:004844D6 894F04                  mov dword ptr [edi+04], ecx
:004844D9 8BF0                    mov esi, eax
:004844DB 8BCD                    mov ecx, ebp
:004844DD EB19                    jmp 004844F8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004844D4(C)
|
:004844DF 2BD9                    sub ebx, ecx
:004844E1 3BDA                    cmp ebx, edx
:004844E3 0F82C2000000            jb 004845AB
:004844E9 8B4C2414                mov ecx, dword ptr [esp+14]
:004844ED 8BF0                    mov esi, eax
:004844EF EB07                    jmp 004844F8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004844B3(C)
|
:004844F1 25FF000000              and eax, 000000FF
:004844F6 03F0                    add esi, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004844DD(U), :004844EF(U)
|
:004844F8 8D2C16                  lea ebp, dword ptr [esi+edx]
:004844FB 8D87F8000000            lea eax, dword ptr [edi+000000F8]
:00484501 3BE8                    cmp ebp, eax
:00484503 72AA                    jb 004844AF
:00484505 EB1D                    jmp 00484524

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004844CC(C)
|
:00484507 8D0416                  lea eax, dword ptr [esi+edx]
:0048450A 8D9FF8000000            lea ebx, dword ptr [edi+000000F8]
:00484510 3BC3                    cmp eax, ebx
:00484512 7309                    jnb 0048451D
:00484514 2BCA                    sub ecx, edx
:00484516 8907                    mov dword ptr [edi], eax
:00484518 894F04                  mov dword ptr [edi+04], ecx
:0048451B EB79                    jmp 00484596

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484512(C)
|
:0048451D 8D4F08                  lea ecx, dword ptr [edi+08]
:00484520 890F                    mov dword ptr [edi], ecx
:00484522 EB6B                    jmp 0048458F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004844AD(C), :00484505(U)
|
:00484524 8D6F08                  lea ebp, dword ptr [edi+08]
:00484527 8BF5                    mov esi, ebp
:00484529 3BF1                    cmp esi, ecx
:0048452B 737E                    jnb 004845AB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048456E(C)
|
:0048452D 8D0C16                  lea ecx, dword ptr [esi+edx]
:00484530 8D87F8000000            lea eax, dword ptr [edi+000000F8]
:00484536 3BC8                    cmp ecx, eax
:00484538 7371                    jnb 004845AB
:0048453A 8A06                    mov al, byte ptr [esi]
:0048453C 84C0                    test al, al
:0048453E 7523                    jne 00484563
:00484540 807E0100                cmp byte ptr [esi+01], 00
:00484544 8D4601                  lea eax, dword ptr [esi+01]
:00484547 B901000000              mov ecx, 00000001
:0048454C 7507                    jne 00484555

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484553(C)
|
:0048454E 40                      inc eax
:0048454F 41                      inc ecx
:00484550 803800                  cmp byte ptr [eax], 00
:00484553 74F9                    je 0048454E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048454C(C)
|
:00484555 3BCA                    cmp ecx, edx
:00484557 731E                    jnb 00484577
:00484559 2BD9                    sub ebx, ecx
:0048455B 3BDA                    cmp ebx, edx
:0048455D 724C                    jb 004845AB
:0048455F 8BF0                    mov esi, eax
:00484561 EB07                    jmp 0048456A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048453E(C)
|
:00484563 25FF000000              and eax, 000000FF
:00484568 03F0                    add esi, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484561(U)
|
:0048456A 3B742414                cmp esi, dword ptr [esp+14]
:0048456E 72BD                    jb 0048452D
:00484570 33C0                    xor eax, eax
:00484572 5F                      pop edi
:00484573 5E                      pop esi
:00484574 5D                      pop ebp
:00484575 5B                      pop ebx
:00484576 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484557(C)
|
:00484577 8D0416                  lea eax, dword ptr [esi+edx]
:0048457A 8D9FF8000000            lea ebx, dword ptr [edi+000000F8]
:00484580 3BC3                    cmp eax, ebx
:00484582 7309                    jnb 0048458D
:00484584 2BCA                    sub ecx, edx
:00484586 8907                    mov dword ptr [edi], eax
:00484588 894F04                  mov dword ptr [edi+04], ecx
:0048458B EB09                    jmp 00484596

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484582(C)
|
:0048458D 892F                    mov dword ptr [edi], ebp

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484522(U)
|
:0048458F C7470400000000          mov [edi+04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0048451B(U), :0048458B(U)
|
:00484596 8D047F                  lea eax, dword ptr [edi+2*edi]
:00484599 8816                    mov byte ptr [esi], dl
:0048459B 8D1480                  lea edx, dword ptr [eax+4*eax]
:0048459E 8D4608                  lea eax, dword ptr [esi+08]
:004845A1 C1E004                  shl eax, 04
:004845A4 2BC2                    sub eax, edx
:004845A6 5F                      pop edi
:004845A7 5E                      pop esi
:004845A8 5D                      pop ebp
:004845A9 5B                      pop ebx
:004845AA C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004844E3(C), :0048452B(C), :00484538(C), :0048455D(C)
|
:004845AB 5F                      pop edi
:004845AC 5E                      pop esi
:004845AD 5D                      pop ebp
:004845AE 33C0                    xor eax, eax
:004845B0 5B                      pop ebx
:004845B1 C3                      ret


:004845B2 90                      nop
:004845B3 90                      nop
:004845B4 90                      nop
:004845B5 90                      nop
:004845B6 90                      nop
:004845B7 90                      nop
:004845B8 90                      nop
:004845B9 90                      nop
:004845BA 90                      nop
:004845BB 90                      nop
:004845BC 90                      nop
:004845BD 90                      nop
:004845BE 90                      nop
:004845BF 90                      nop

* Referenced by a CALL at Address:
|:00482AC0   
|
:004845C0 8B4C2404                mov ecx, dword ptr [esp+04]
:004845C4 53                      push ebx
:004845C5 55                      push ebp
:004845C6 8B6C2410                mov ebp, dword ptr [esp+10]
:004845CA 56                      push esi
:004845CB 57                      push edi
:004845CC 8B7910                  mov edi, dword ptr [ecx+10]
:004845CF 8BD5                    mov edx, ebp
:004845D1 2BD7                    sub edx, edi
:004845D3 8B7C241C                mov edi, dword ptr [esp+1C]
:004845D7 C1FA0C                  sar edx, 0C
:004845DA 8B5C2420                mov ebx, dword ptr [esp+20]
:004845DE 33C0                    xor eax, eax
:004845E0 8D4CD118                lea ecx, dword ptr [ecx+8*edx+18]
:004845E4 33D2                    xor edx, edx
:004845E6 8A17                    mov dl, byte ptr [edi]
:004845E8 894C2418                mov dword ptr [esp+18], ecx
:004845EC 8BF2                    mov esi, edx
:004845EE 3BF3                    cmp esi, ebx
:004845F0 761B                    jbe 0048460D
:004845F2 881F                    mov byte ptr [edi], bl
:004845F4 8B01                    mov eax, dword ptr [ecx]
:004845F6 2BF3                    sub esi, ebx
:004845F8 C74104F1000000          mov [ecx+04], 000000F1
:004845FF 03C6                    add eax, esi
:00484601 8901                    mov dword ptr [ecx], eax
:00484603 B801000000              mov eax, 00000001
:00484608 5F                      pop edi
:00484609 5E                      pop esi
:0048460A 5D                      pop ebp
:0048460B 5B                      pop ebx
:0048460C C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004845F0(C)
|
:0048460D 7370                    jnb 0048467F
:0048460F 8D0C3B                  lea ecx, dword ptr [ebx+edi]
:00484612 8D95F8000000            lea edx, dword ptr [ebp+000000F8]
:00484618 3BCA                    cmp ecx, edx
:0048461A 7763                    ja 0048467F
:0048461C 8D143E                  lea edx, dword ptr [esi+edi]
:0048461F 3BD1                    cmp edx, ecx
:00484621 730C                    jnb 0048462F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048462B(C)
|
:00484623 803A00                  cmp byte ptr [edx], 00
:00484626 7505                    jne 0048462D
:00484628 42                      inc edx
:00484629 3BD1                    cmp edx, ecx
:0048462B 72F6                    jb 00484623

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484626(C)
|
:0048462D 3BD1                    cmp edx, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484621(C)
|
:0048462F 754E                    jne 0048467F
:00484631 881F                    mov byte ptr [edi], bl
:00484633 8B4500                  mov eax, dword ptr [ebp+00]
:00484636 3BF8                    cmp edi, eax
:00484638 7734                    ja 0048466E
:0048463A 3BC8                    cmp ecx, eax
:0048463C 7630                    jbe 0048466E
:0048463E 8D85F8000000            lea eax, dword ptr [ebp+000000F8]
:00484644 3BC8                    cmp ecx, eax
:00484646 7319                    jnb 00484661
:00484648 894D00                  mov dword ptr [ebp+00], ecx
:0048464B 8A11                    mov dl, byte ptr [ecx]
:0048464D 33C0                    xor eax, eax
:0048464F 84D2                    test dl, dl
:00484651 7509                    jne 0048465C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048465A(C)
|
:00484653 8A540801                mov dl, byte ptr [eax+ecx+01]
:00484657 40                      inc eax
:00484658 84D2                    test dl, dl
:0048465A 74F7                    je 00484653

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484651(C)
|
:0048465C 894504                  mov dword ptr [ebp+04], eax
:0048465F EB0D                    jmp 0048466E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484646(C)
|
:00484661 8D4508                  lea eax, dword ptr [ebp+08]
:00484664 C7450400000000          mov [ebp+04], 00000000
:0048466B 894500                  mov dword ptr [ebp+00], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00484638(C), :0048463C(C), :0048465F(U)
|
:0048466E 8B442418                mov eax, dword ptr [esp+18]
:00484672 2BF3                    sub esi, ebx
:00484674 8B08                    mov ecx, dword ptr [eax]
:00484676 03CE                    add ecx, esi
:00484678 8908                    mov dword ptr [eax], ecx
:0048467A B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0048460D(C), :0048461A(C), :0048462F(C)
|
:0048467F 5F                      pop edi
:00484680 5E                      pop esi
:00484681 5D                      pop ebp
:00484682 5B                      pop ebx
:00484683 C3                      ret


:00484684 90                      nop
:00484685 90                      nop
:00484686 90                      nop
:00484687 90                      nop
:00484688 90                      nop
:00484689 90                      nop
:0048468A 90                      nop
:0048468B 90                      nop
:0048468C 90                      nop
:0048468D 90                      nop
:0048468E 90                      nop
:0048468F 90                      nop

* Referenced by a CALL at Addresses:
|:00482D9B   , :00483899   , :004838CD   
|
:00484690 A118D04B00              mov eax, dword ptr [004BD018]
:00484695 53                      push ebx
:00484696 8B1DEC614800            mov ebx, dword ptr [004861EC]
:0048469C 55                      push ebp
:0048469D 56                      push esi
:0048469E 57                      push edi
:0048469F 85C0                    test eax, eax
:004846A1 7549                    jne 004846EC
:004846A3 6A00                    push 00000000
:004846A5 6A00                    push 00000000
:004846A7 6A01                    push 00000001
:004846A9 68247B4800              push 00487B24
:004846AE 6800010000              push 00000100
:004846B3 6A00                    push 00000000
:004846B5 FF15F0614800            call dword ptr [004861F0]
:004846BB 85C0                    test eax, eax
:004846BD 7407                    je 004846C6
:004846BF B801000000              mov eax, 00000001
:004846C4 EB21                    jmp 004846E7

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004846BD(C)
|
:004846C6 6A00                    push 00000000
:004846C8 6A00                    push 00000000
:004846CA 6A01                    push 00000001
:004846CC 68207B4800              push 00487B20
:004846D1 6800010000              push 00000100
:004846D6 6A00                    push 00000000
:004846D8 FFD3                    call ebx
:004846DA 85C0                    test eax, eax
:004846DC 0F84CC010000            je 004848AE
:004846E2 B802000000              mov eax, 00000002

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004846C4(U)
|
:004846E7 A318D04B00              mov dword ptr [004BD018], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004846A1(C)
|
:004846EC 8B742420                mov esi, dword ptr [esp+20]
:004846F0 85F6                    test esi, esi
:004846F2 7E17                    jle 0048470B
:004846F4 8B7C241C                mov edi, dword ptr [esp+1C]
:004846F8 56                      push esi
:004846F9 57                      push edi
:004846FA E8C1010000              call 004848C0
:004846FF 8BF0                    mov esi, eax
:00484701 A118D04B00              mov eax, dword ptr [004BD018]
:00484706 83C408                  add esp, 00000008
:00484709 EB04                    jmp 0048470F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004846F2(C)
|
:0048470B 8B7C241C                mov edi, dword ptr [esp+1C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484709(U)
|
:0048470F 83F802                  cmp eax, 00000002
:00484712 751D                    jne 00484731
:00484714 8B442428                mov eax, dword ptr [esp+28]
:00484718 8B4C2424                mov ecx, dword ptr [esp+24]
:0048471C 8B542418                mov edx, dword ptr [esp+18]
:00484720 50                      push eax
:00484721 8B442418                mov eax, dword ptr [esp+18]
:00484725 51                      push ecx
:00484726 56                      push esi
:00484727 57                      push edi
:00484728 52                      push edx
:00484729 50                      push eax
:0048472A FFD3                    call ebx
:0048472C 5F                      pop edi
:0048472D 5E                      pop esi
:0048472E 5D                      pop ebp
:0048472F 5B                      pop ebx
:00484730 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484712(C)
|
:00484731 83F801                  cmp eax, 00000001
:00484734 0F85DD000000            jne 00484817
:0048473A 8B6C242C                mov ebp, dword ptr [esp+2C]
:0048473E C744242000000000        mov [esp+20], 00000000
:00484746 85ED                    test ebp, ebp
:00484748 750C                    jne 00484756
:0048474A 8B0DD0CC4B00            mov ecx, dword ptr [004BCCD0]
:00484750 894C242C                mov dword ptr [esp+2C], ecx
:00484754 8BE9                    mov ebp, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484748(C)
|
:00484756 8B542430                mov edx, dword ptr [esp+30]
:0048475A 6A00                    push 00000000
:0048475C F7DA                    neg edx
:0048475E 1BD2                    sbb edx, edx
:00484760 6A00                    push 00000000
:00484762 83E208                  and edx, 00000008
:00484765 56                      push esi
:00484766 42                      inc edx
:00484767 57                      push edi
:00484768 52                      push edx
:00484769 55                      push ebp
:0048476A FF157C614800            call dword ptr [0048617C]
:00484770 8BF8                    mov edi, eax
:00484772 85FF                    test edi, edi
:00484774 7505                    jne 0048477B
:00484776 5F                      pop edi
:00484777 5E                      pop esi
:00484778 5D                      pop ebp
:00484779 5B                      pop ebx
:0048477A C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484774(C)
|
:0048477B 8D043F                  lea eax, dword ptr [edi+edi]
:0048477E 50                      push eax
:0048477F E80CE1FFFF              call 00482890
:00484784 8BD8                    mov ebx, eax
:00484786 83C404                  add esp, 00000004
:00484789 85DB                    test ebx, ebx
:0048478B 7505                    jne 00484792
:0048478D 5F                      pop edi
:0048478E 5E                      pop esi
:0048478F 5D                      pop ebp
:00484790 5B                      pop ebx
:00484791 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048478B(C)
|
:00484792 8B4C241C                mov ecx, dword ptr [esp+1C]
:00484796 57                      push edi
:00484797 53                      push ebx
:00484798 56                      push esi
:00484799 51                      push ecx
:0048479A 6A01                    push 00000001
:0048479C 55                      push ebp
:0048479D FF157C614800            call dword ptr [0048617C]
:004847A3 85C0                    test eax, eax
:004847A5 0F84ED000000            je 00484898
:004847AB 8B6C2418                mov ebp, dword ptr [esp+18]
:004847AF 8B542414                mov edx, dword ptr [esp+14]
:004847B3 6A00                    push 00000000
:004847B5 6A00                    push 00000000
:004847B7 57                      push edi
:004847B8 53                      push ebx
:004847B9 55                      push ebp
:004847BA 52                      push edx
:004847BB FF15F0614800            call dword ptr [004861F0]
:004847C1 8BF0                    mov esi, eax
:004847C3 85F6                    test esi, esi
:004847C5 0F84CD000000            je 00484898
:004847CB F7C500040000            test ebp, 00000400
:004847D1 7449                    je 0048481C
:004847D3 8B442428                mov eax, dword ptr [esp+28]
:004847D7 85C0                    test eax, eax
:004847D9 7424                    je 004847FF
:004847DB 3BF0                    cmp esi, eax
:004847DD 0F8FB5000000            jg 00484898
:004847E3 8B4C2414                mov ecx, dword ptr [esp+14]
:004847E7 50                      push eax
:004847E8 8B442428                mov eax, dword ptr [esp+28]
:004847EC 50                      push eax
:004847ED 57                      push edi
:004847EE 53                      push ebx
:004847EF 55                      push ebp
:004847F0 51                      push ecx
:004847F1 FF15F0614800            call dword ptr [004861F0]
:004847F7 85C0                    test eax, eax
:004847F9 0F8499000000            je 00484898

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004847D9(C), :00484870(U), :00484892(C)
|
:004847FF 53                      push ebx
:00484800 E83BE1FFFF              call 00482940
:00484805 8B542424                mov edx, dword ptr [esp+24]
:00484809 83C404                  add esp, 00000004
:0048480C 52                      push edx
:0048480D E82EE1FFFF              call 00482940
:00484812 83C404                  add esp, 00000004
:00484815 8BC6                    mov eax, esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484734(C)
|
:00484817 5F                      pop edi
:00484818 5E                      pop esi
:00484819 5D                      pop ebp
:0048481A 5B                      pop ebx
:0048481B C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004847D1(C)
|
:0048481C 8D1436                  lea edx, dword ptr [esi+esi]
:0048481F 52                      push edx
:00484820 E86BE0FFFF              call 00482890
:00484825 83C404                  add esp, 00000004
:00484828 89442420                mov dword ptr [esp+20], eax
:0048482C 85C0                    test eax, eax
:0048482E 7468                    je 00484898
:00484830 8B4C2414                mov ecx, dword ptr [esp+14]
:00484834 56                      push esi
:00484835 50                      push eax
:00484836 57                      push edi
:00484837 53                      push ebx
:00484838 55                      push ebp
:00484839 51                      push ecx
:0048483A FF15F0614800            call dword ptr [004861F0]
:00484840 85C0                    test eax, eax
:00484842 7454                    je 00484898
:00484844 8B442428                mov eax, dword ptr [esp+28]
:00484848 6A00                    push 00000000
:0048484A 85C0                    test eax, eax
:0048484C 6A00                    push 00000000
:0048484E 7522                    jne 00484872
:00484850 8B542428                mov edx, dword ptr [esp+28]
:00484854 8B442434                mov eax, dword ptr [esp+34]
:00484858 6A00                    push 00000000
:0048485A 6A00                    push 00000000
:0048485C 56                      push esi
:0048485D 52                      push edx
:0048485E 6820020000              push 00000220
:00484863 50                      push eax
:00484864 FF156C614800            call dword ptr [0048616C]
:0048486A 8BF0                    mov esi, eax
:0048486C 85F6                    test esi, esi
:0048486E 7428                    je 00484898
:00484870 EB8D                    jmp 004847FF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048484E(C)
|
:00484872 8B4C242C                mov ecx, dword ptr [esp+2C]
:00484876 8B542428                mov edx, dword ptr [esp+28]
:0048487A 50                      push eax
:0048487B 8B442438                mov eax, dword ptr [esp+38]
:0048487F 51                      push ecx
:00484880 56                      push esi
:00484881 52                      push edx
:00484882 6820020000              push 00000220
:00484887 50                      push eax
:00484888 FF156C614800            call dword ptr [0048616C]
:0048488E 8BF0                    mov esi, eax
:00484890 85F6                    test esi, esi
:00484892 0F8567FFFFFF            jne 004847FF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004847A5(C), :004847C5(C), :004847DD(C), :004847F9(C), :0048482E(C)
|:00484842(C), :0048486E(C)
|
:00484898 53                      push ebx
:00484899 E8A2E0FFFF              call 00482940
:0048489E 8B4C2424                mov ecx, dword ptr [esp+24]
:004848A2 83C404                  add esp, 00000004
:004848A5 51                      push ecx
:004848A6 E895E0FFFF              call 00482940
:004848AB 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004846DC(C)
|
:004848AE 5F                      pop edi
:004848AF 5E                      pop esi
:004848B0 5D                      pop ebp
:004848B1 33C0                    xor eax, eax
:004848B3 5B                      pop ebx
:004848B4 C3                      ret


:004848B5 90                      nop
:004848B6 90                      nop
:004848B7 90                      nop
:004848B8 90                      nop
:004848B9 90                      nop
:004848BA 90                      nop
:004848BB 90                      nop
:004848BC 90                      nop
:004848BD 90                      nop
:004848BE 90                      nop
:004848BF 90                      nop

* Referenced by a CALL at Address:
|:004846FA   
|
:004848C0 8B542408                mov edx, dword ptr [esp+08]
:004848C4 56                      push esi
:004848C5 8B742408                mov esi, dword ptr [esp+08]
:004848C9 85D2                    test edx, edx
:004848CB 57                      push edi
:004848CC 8BC6                    mov eax, esi
:004848CE 8D4AFF                  lea ecx, dword ptr [edx-01]
:004848D1 740D                    je 004848E0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004848DE(C)
|
:004848D3 803800                  cmp byte ptr [eax], 00
:004848D6 7408                    je 004848E0
:004848D8 40                      inc eax
:004848D9 8BF9                    mov edi, ecx
:004848DB 49                      dec ecx
:004848DC 85FF                    test edi, edi
:004848DE 75F3                    jne 004848D3

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004848D1(C), :004848D6(C)
|
:004848E0 803800                  cmp byte ptr [eax], 00
:004848E3 7505                    jne 004848EA
:004848E5 2BC6                    sub eax, esi
:004848E7 5F                      pop edi
:004848E8 5E                      pop esi
:004848E9 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004848E3(C)
|
:004848EA 5F                      pop edi
:004848EB 5E                      pop esi
:004848EC 8BC2                    mov eax, edx
:004848EE C3                      ret


:004848EF 90                      nop

* Referenced by a CALL at Address:
|:00482D23   
|
:004848F0 51                      push ecx
:004848F1 8B4C2408                mov ecx, dword ptr [esp+08]
:004848F5 56                      push esi
:004848F6 8D4101                  lea eax, dword ptr [ecx+01]
:004848F9 3D00010000              cmp eax, 00000100
:004848FE 7715                    ja 00484915

* Possible StringData Ref from Data Obj ->"         (((((                "
                                        ->"  H"
                                  |
:00484900 8B1590154900            mov edx, dword ptr [00491590]
:00484906 33C0                    xor eax, eax
:00484908 668B044A                mov ax, word ptr [edx+2*ecx]
:0048490C 8B4C2410                mov ecx, dword ptr [esp+10]
:00484910 23C1                    and eax, ecx
:00484912 5E                      pop esi
:00484913 59                      pop ecx
:00484914 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004848FE(C)
|

* Possible StringData Ref from Data Obj ->"         (((((                "
                                        ->"  H"
                                  |
:00484915 8B3590154900            mov esi, dword ptr [00491590]
:0048491B 8BC1                    mov eax, ecx
:0048491D C1F808                  sar eax, 08
:00484920 8BD0                    mov edx, eax
:00484922 81E2FF000000            and edx, 000000FF
:00484928 F644560180              test [esi+2*edx+01], 80
:0048492D 7414                    je 00484943
:0048492F 8844240C                mov byte ptr [esp+0C], al
:00484933 884C240D                mov byte ptr [esp+0D], cl
:00484937 C644240E00              mov [esp+0E], 00
:0048493C B802000000              mov eax, 00000002
:00484941 EB0E                    jmp 00484951

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048492D(C)
|
:00484943 884C240C                mov byte ptr [esp+0C], cl
:00484947 C644240D00              mov [esp+0D], 00
:0048494C B801000000              mov eax, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484941(U)
|
:00484951 6A01                    push 00000001
:00484953 6A00                    push 00000000
:00484955 8D4C240C                lea ecx, dword ptr [esp+0C]
:00484959 6A00                    push 00000000
:0048495B 51                      push ecx
:0048495C 8D54241C                lea edx, dword ptr [esp+1C]
:00484960 50                      push eax
:00484961 52                      push edx
:00484962 6A01                    push 00000001
:00484964 E827000000              call 00484990
:00484969 83C41C                  add esp, 0000001C
:0048496C 85C0                    test eax, eax
:0048496E 7503                    jne 00484973
:00484970 5E                      pop esi
:00484971 59                      pop ecx
:00484972 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048496E(C)
|
:00484973 8B442404                mov eax, dword ptr [esp+04]
:00484977 8B4C2410                mov ecx, dword ptr [esp+10]
:0048497B 25FFFF0000              and eax, 0000FFFF
:00484980 5E                      pop esi
:00484981 23C1                    and eax, ecx
:00484983 59                      pop ecx
:00484984 C3                      ret


:00484985 90                      nop
:00484986 90                      nop
:00484987 90                      nop
:00484988 90                      nop
:00484989 90                      nop
:0048498A 90                      nop
:0048498B 90                      nop
:0048498C 90                      nop
:0048498D 90                      nop
:0048498E 90                      nop
:0048498F 90                      nop

* Referenced by a CALL at Addresses:
|:00483867   , :00484964   
|
:00484990 51                      push ecx
:00484991 A120D04B00              mov eax, dword ptr [004BD020]
:00484996 53                      push ebx
:00484997 55                      push ebp
:00484998 56                      push esi
:00484999 8B35F4614800            mov esi, dword ptr [004861F4]
:0048499F 57                      push edi
:004849A0 33FF                    xor edi, edi
:004849A2 3BC7                    cmp eax, edi
:004849A4 7526                    jne 004849CC
:004849A6 8D442412                lea eax, dword ptr [esp+12]
:004849AA 50                      push eax
:004849AB 6A01                    push 00000001
:004849AD 68247B4800              push 00487B24
:004849B2 6A01                    push 00000001
:004849B4 FF15F8614800            call dword ptr [004861F8]
:004849BA 85C0                    test eax, eax
:004849BC 0F84DA000000            je 00484A9C
:004849C2 B801000000              mov eax, 00000001
:004849C7 A320D04B00              mov dword ptr [004BD020], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004849A4(C), :00484ABB(U)
|
:004849CC 83F802                  cmp eax, 00000002
:004849CF 752A                    jne 004849FB
:004849D1 8B44242C                mov eax, dword ptr [esp+2C]
:004849D5 3BC7                    cmp eax, edi
:004849D7 7505                    jne 004849DE
:004849D9 A1C0CC4B00              mov eax, dword ptr [004BCCC0]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004849D7(C)
|
:004849DE 8B542424                mov edx, dword ptr [esp+24]
:004849E2 8B4C2420                mov ecx, dword ptr [esp+20]
:004849E6 52                      push edx
:004849E7 8B542420                mov edx, dword ptr [esp+20]
:004849EB 51                      push ecx
:004849EC 8B4C2420                mov ecx, dword ptr [esp+20]
:004849F0 52                      push edx
:004849F1 51                      push ecx
:004849F2 50                      push eax
:004849F3 FFD6                    call esi
:004849F5 5F                      pop edi
:004849F6 5E                      pop esi
:004849F7 5D                      pop ebp
:004849F8 5B                      pop ebx
:004849F9 59                      pop ecx
:004849FA C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004849CF(C)
|
:004849FB 83F801                  cmp eax, 00000001
:004849FE 0F8592000000            jne 00484A96
:00484A04 8B5C2428                mov ebx, dword ptr [esp+28]
:00484A08 897C242C                mov dword ptr [esp+2C], edi
:00484A0C 3BDF                    cmp ebx, edi
:00484A0E 7506                    jne 00484A16
:00484A10 8B1DD0CC4B00            mov ebx, dword ptr [004BCCD0]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484A0E(C)
|
:00484A16 8B442430                mov eax, dword ptr [esp+30]
:00484A1A 8B6C2420                mov ebp, dword ptr [esp+20]
:00484A1E 8B54241C                mov edx, dword ptr [esp+1C]
:00484A22 57                      push edi
:00484A23 F7D8                    neg eax
:00484A25 1BC0                    sbb eax, eax
:00484A27 57                      push edi
:00484A28 83E008                  and eax, 00000008
:00484A2B 55                      push ebp
:00484A2C 40                      inc eax
:00484A2D 52                      push edx
:00484A2E 50                      push eax
:00484A2F 53                      push ebx
:00484A30 FF157C614800            call dword ptr [0048617C]
:00484A36 8BF0                    mov esi, eax
:00484A38 85F6                    test esi, esi
:00484A3A 744B                    je 00484A87
:00484A3C 56                      push esi
:00484A3D 6A02                    push 00000002
:00484A3F E8EC030000              call 00484E30
:00484A44 8BF8                    mov edi, eax
:00484A46 83C408                  add esp, 00000008
:00484A49 85FF                    test edi, edi
:00484A4B 743A                    je 00484A87
:00484A4D 8B4C241C                mov ecx, dword ptr [esp+1C]
:00484A51 56                      push esi
:00484A52 57                      push edi
:00484A53 55                      push ebp
:00484A54 51                      push ecx
:00484A55 6A01                    push 00000001
:00484A57 53                      push ebx
:00484A58 FF157C614800            call dword ptr [0048617C]
:00484A5E 85C0                    test eax, eax
:00484A60 7425                    je 00484A87
:00484A62 8B542424                mov edx, dword ptr [esp+24]
:00484A66 52                      push edx
:00484A67 50                      push eax
:00484A68 8B442420                mov eax, dword ptr [esp+20]
:00484A6C 57                      push edi
:00484A6D 50                      push eax
:00484A6E FF15F8614800            call dword ptr [004861F8]
:00484A74 57                      push edi
:00484A75 8BF0                    mov esi, eax
:00484A77 E8C4DEFFFF              call 00482940
:00484A7C 83C404                  add esp, 00000004
:00484A7F 8BC6                    mov eax, esi
:00484A81 5F                      pop edi
:00484A82 5E                      pop esi
:00484A83 5D                      pop ebp
:00484A84 5B                      pop ebx
:00484A85 59                      pop ecx
:00484A86 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00484A3A(C), :00484A4B(C), :00484A60(C)
|
:00484A87 8B74242C                mov esi, dword ptr [esp+2C]
:00484A8B 57                      push edi
:00484A8C E8AFDEFFFF              call 00482940
:00484A91 83C404                  add esp, 00000004
:00484A94 8BC6                    mov eax, esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004849FE(C)
|
:00484A96 5F                      pop edi
:00484A97 5E                      pop esi
:00484A98 5D                      pop ebp
:00484A99 5B                      pop ebx
:00484A9A 59                      pop ecx
:00484A9B C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004849BC(C)
|
:00484A9C 8D4C2412                lea ecx, dword ptr [esp+12]
:00484AA0 51                      push ecx
:00484AA1 6A01                    push 00000001
:00484AA3 68207B4800              push 00487B20
:00484AA8 6A01                    push 00000001
:00484AAA 57                      push edi
:00484AAB FFD6                    call esi
:00484AAD 85C0                    test eax, eax
:00484AAF 740F                    je 00484AC0
:00484AB1 B802000000              mov eax, 00000002
:00484AB6 A320D04B00              mov dword ptr [004BD020], eax
:00484ABB E90CFFFFFF              jmp 004849CC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484AAF(C)
|
:00484AC0 5F                      pop edi
:00484AC1 5E                      pop esi
:00484AC2 5D                      pop ebp
:00484AC3 33C0                    xor eax, eax
:00484AC5 5B                      pop ebx
:00484AC6 59                      pop ecx
:00484AC7 C3                      ret


:00484AC8 90                      nop
:00484AC9 90                      nop
:00484ACA 90                      nop
:00484ACB 90                      nop
:00484ACC 90                      nop
:00484ACD 90                      nop
:00484ACE 90                      nop
:00484ACF 90                      nop

* Referenced by a CALL at Address:
|:00483DBA   
|
:00484AD0 A124D04B00              mov eax, dword ptr [004BD024]
:00484AD5 53                      push ebx
:00484AD6 33DB                    xor ebx, ebx
:00484AD8 56                      push esi
:00484AD9 85C0                    test eax, eax
:00484ADB 57                      push edi
:00484ADC 7542                    jne 00484B20
:00484ADE 68587B4800              push 00487B58
:00484AE3 FF1524614800            call dword ptr [00486124]
:00484AE9 8BF0                    mov esi, eax
:00484AEB 85F6                    test esi, esi
:00484AED 746A                    je 00484B59
:00484AEF 8B3DFC614800            mov edi, dword ptr [004861FC]
:00484AF5 684C7B4800              push 00487B4C
:00484AFA 56                      push esi
:00484AFB FFD7                    call edi
:00484AFD 85C0                    test eax, eax
:00484AFF A324D04B00              mov dword ptr [004BD024], eax
:00484B04 7453                    je 00484B59
:00484B06 683C7B4800              push 00487B3C
:00484B0B 56                      push esi
:00484B0C FFD7                    call edi
:00484B0E 68287B4800              push 00487B28
:00484B13 56                      push esi
:00484B14 A328D04B00              mov dword ptr [004BD028], eax
:00484B19 FFD7                    call edi
:00484B1B A32CD04B00              mov dword ptr [004BD02C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484ADC(C)
|
:00484B20 A128D04B00              mov eax, dword ptr [004BD028]
:00484B25 85C0                    test eax, eax
:00484B27 7404                    je 00484B2D
:00484B29 FFD0                    call eax
:00484B2B 8BD8                    mov ebx, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484B27(C)
|
:00484B2D 85DB                    test ebx, ebx
:00484B2F 740E                    je 00484B3F
:00484B31 A12CD04B00              mov eax, dword ptr [004BD02C]
:00484B36 85C0                    test eax, eax
:00484B38 7405                    je 00484B3F
:00484B3A 53                      push ebx
:00484B3B FFD0                    call eax
:00484B3D 8BD8                    mov ebx, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00484B2F(C), :00484B38(C)
|
:00484B3F 8B442418                mov eax, dword ptr [esp+18]
:00484B43 8B4C2414                mov ecx, dword ptr [esp+14]
:00484B47 8B542410                mov edx, dword ptr [esp+10]
:00484B4B 50                      push eax
:00484B4C 51                      push ecx
:00484B4D 52                      push edx
:00484B4E 53                      push ebx
:00484B4F FF1524D04B00            call dword ptr [004BD024]
:00484B55 5F                      pop edi
:00484B56 5E                      pop esi
:00484B57 5B                      pop ebx
:00484B58 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00484AED(C), :00484B04(C)
|
:00484B59 5F                      pop edi
:00484B5A 5E                      pop esi
:00484B5B 33C0                    xor eax, eax
:00484B5D 5B                      pop ebx
:00484B5E C3                      ret


:00484B5F 90                      nop

* Referenced by a CALL at Address:
|:00483D0C   
|
:00484B60 8B4C240C                mov ecx, dword ptr [esp+0C]
:00484B64 57                      push edi
:00484B65 85C9                    test ecx, ecx
:00484B67 747A                    je 00484BE3
:00484B69 56                      push esi
:00484B6A 53                      push ebx
:00484B6B 8BD9                    mov ebx, ecx
:00484B6D 8B742414                mov esi, dword ptr [esp+14]
:00484B71 F7C603000000            test esi, 00000003
:00484B77 8B7C2410                mov edi, dword ptr [esp+10]
:00484B7B 7507                    jne 00484B84
:00484B7D C1E902                  shr ecx, 02
:00484B80 756F                    jne 00484BF1
:00484B82 EB21                    jmp 00484BA5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00484B7B(C), :00484B97(C)
|
:00484B84 8A06                    mov al, byte ptr [esi]
:00484B86 46                      inc esi
:00484B87 8807                    mov byte ptr [edi], al
:00484B89 47                      inc edi
:00484B8A 49                      dec ecx
:00484B8B 7425                    je 00484BB2
:00484B8D 84C0                    test al, al
:00484B8F 7429                    je 00484BBA
:00484B91 F7C603000000            test esi, 00000003
:00484B97 75EB                    jne 00484B84
:00484B99 8BD9                    mov ebx, ecx
:00484B9B C1E902                  shr ecx, 02
:00484B9E 7551                    jne 00484BF1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484BEF(C)
|
:00484BA0 83E303                  and ebx, 00000003
:00484BA3 740D                    je 00484BB2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00484B82(U), :00484BB0(C)
|
:00484BA5 8A06                    mov al, byte ptr [esi]
:00484BA7 46                      inc esi
:00484BA8 8807                    mov byte ptr [edi], al
:00484BAA 47                      inc edi
:00484BAB 84C0                    test al, al
:00484BAD 742F                    je 00484BDE
:00484BAF 4B                      dec ebx
:00484BB0 75F3                    jne 00484BA5

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00484B8B(C), :00484BA3(C)
|
:00484BB2 8B442410                mov eax, dword ptr [esp+10]
:00484BB6 5B                      pop ebx
:00484BB7 5E                      pop esi
:00484BB8 5F                      pop edi
:00484BB9 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484B8F(C)
|
:00484BBA F7C703000000            test edi, 00000003
:00484BC0 7412                    je 00484BD4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484BD2(C)
|
:00484BC2 8807                    mov byte ptr [edi], al
:00484BC4 47                      inc edi
:00484BC5 49                      dec ecx
:00484BC6 0F848A000000            je 00484C56
:00484BCC F7C703000000            test edi, 00000003
:00484BD2 75EE                    jne 00484BC2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484BC0(C)
|
:00484BD4 8BD9                    mov ebx, ecx
:00484BD6 C1E902                  shr ecx, 02
:00484BD9 756C                    jne 00484C47

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00484BDF(C), :00484C54(C)
|
:00484BDB 8807                    mov byte ptr [edi], al
:00484BDD 47                      inc edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484BAD(C)
|
:00484BDE 4B                      dec ebx
:00484BDF 75FA                    jne 00484BDB
:00484BE1 5B                      pop ebx
:00484BE2 5E                      pop esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484B67(C)
|
:00484BE3 8B442408                mov eax, dword ptr [esp+08]
:00484BE7 5F                      pop edi
:00484BE8 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00484C09(C), :00484C21(C)
|
:00484BE9 8917                    mov dword ptr [edi], edx
:00484BEB 83C704                  add edi, 00000004
:00484BEE 49                      dec ecx
:00484BEF 74AF                    je 00484BA0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00484B80(C), :00484B9E(C)
|
:00484BF1 BAFFFEFE7E              mov edx, 7EFEFEFF
:00484BF6 8B06                    mov eax, dword ptr [esi]
:00484BF8 03D0                    add edx, eax
:00484BFA 83F0FF                  xor eax, FFFFFFFF
:00484BFD 33C2                    xor eax, edx
:00484BFF 8B16                    mov edx, dword ptr [esi]
:00484C01 83C604                  add esi, 00000004
:00484C04 A900010181              test eax, 81010100
:00484C09 74DE                    je 00484BE9
:00484C0B 84D2                    test dl, dl
:00484C0D 742C                    je 00484C3B
:00484C0F 84F6                    test dh, dh
:00484C11 741E                    je 00484C31
:00484C13 F7C20000FF00            test edx, 00FF0000
:00484C19 740C                    je 00484C27
:00484C1B F7C2000000FF            test edx, FF000000
:00484C21 75C6                    jne 00484BE9
:00484C23 8917                    mov dword ptr [edi], edx
:00484C25 EB18                    jmp 00484C3F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484C19(C)
|
:00484C27 81E2FFFF0000            and edx, 0000FFFF
:00484C2D 8917                    mov dword ptr [edi], edx
:00484C2F EB0E                    jmp 00484C3F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484C11(C)
|
:00484C31 81E2FF000000            and edx, 000000FF
:00484C37 8917                    mov dword ptr [edi], edx
:00484C39 EB04                    jmp 00484C3F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484C0D(C)
|
:00484C3B 33D2                    xor edx, edx
:00484C3D 8917                    mov dword ptr [edi], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00484C25(U), :00484C2F(U), :00484C39(U)
|
:00484C3F 83C704                  add edi, 00000004
:00484C42 33C0                    xor eax, eax
:00484C44 49                      dec ecx
:00484C45 740A                    je 00484C51

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484BD9(C)
|
:00484C47 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484C4F(C)
|
:00484C49 8907                    mov dword ptr [edi], eax
:00484C4B 83C704                  add edi, 00000004
:00484C4E 49                      dec ecx
:00484C4F 75F8                    jne 00484C49

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484C45(C)
|
:00484C51 83E303                  and ebx, 00000003
:00484C54 7585                    jne 00484BDB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484BC6(C)
|
:00484C56 8B442410                mov eax, dword ptr [esp+10]
:00484C5A 5B                      pop ebx
:00484C5B 5E                      pop esi
:00484C5C 5F                      pop edi
:00484C5D C3                      ret


:00484C5E CC                      int 03
:00484C5F CC                      int 03

* Referenced by a CALL at Address:
|:00483E8C   
|
:00484C60 53                      push ebx
:00484C61 55                      push ebp
:00484C62 56                      push esi
:00484C63 57                      push edi
:00484C64 8B7C2414                mov edi, dword ptr [esp+14]
:00484C68 8D47FE                  lea eax, dword ptr [edi-02]
:00484C6B 83F814                  cmp eax, 00000014
:00484C6E 0F8727010000            ja 00484D9B
:00484C74 33C9                    xor ecx, ecx
:00484C76 8A88C44D4800            mov cl, byte ptr [eax+00484DC4]
:00484C7C FF248DA44D4800          jmp dword ptr [4*ecx+00484DA4]
:00484C83 8B1D30D04B00            mov ebx, dword ptr [004BD030]
:00484C89 BE30D04B00              mov esi, 004BD030
:00484C8E EB37                    jmp 00484CC7
:00484C90 8B1D34D04B00            mov ebx, dword ptr [004BD034]
:00484C96 BE34D04B00              mov esi, 004BD034
:00484C9B EB2A                    jmp 00484CC7
:00484C9D 8B1D38D04B00            mov ebx, dword ptr [004BD038]
:00484CA3 BE38D04B00              mov esi, 004BD038
:00484CA8 EB1D                    jmp 00484CC7
:00484CAA 8B1D3CD04B00            mov ebx, dword ptr [004BD03C]
:00484CB0 BE3CD04B00              mov esi, 004BD03C
:00484CB5 EB10                    jmp 00484CC7
:00484CB7 57                      push edi
:00484CB8 E823010000              call 00484DE0
:00484CBD 8BF0                    mov esi, eax
:00484CBF 83C404                  add esp, 00000004
:00484CC2 83C608                  add esi, 00000008
:00484CC5 8B1E                    mov ebx, dword ptr [esi]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00484C8E(U), :00484C9B(U), :00484CA8(U), :00484CB5(U)
|
:00484CC7 83FB01                  cmp ebx, 00000001
:00484CCA 7507                    jne 00484CD3
:00484CCC 33C0                    xor eax, eax
:00484CCE 5F                      pop edi
:00484CCF 5E                      pop esi
:00484CD0 5D                      pop ebp
:00484CD1 5B                      pop ebx
:00484CD2 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484CCA(C)
|
:00484CD3 85DB                    test ebx, ebx
:00484CD5 750A                    jne 00484CE1
:00484CD7 6A03                    push 00000003
:00484CD9 E872C9FFFF              call 00481650
:00484CDE 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484CD5(C)
|
:00484CE1 83FF08                  cmp edi, 00000008
:00484CE4 740A                    je 00484CF0
:00484CE6 83FF0B                  cmp edi, 0000000B
:00484CE9 7405                    je 00484CF0
:00484CEB 83FF04                  cmp edi, 00000004
:00484CEE 752B                    jne 00484D1B

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00484CE4(C), :00484CE9(C)
|
:00484CF0 8B2DD4CC4B00            mov ebp, dword ptr [004BCCD4]
:00484CF6 83FF08                  cmp edi, 00000008
:00484CF9 C705D4CC4B0000000000    mov dword ptr [004BCCD4], 00000000
:00484D03 754B                    jne 00484D50
:00484D05 8B15CCF34800            mov edx, dword ptr [0048F3CC]
:00484D0B C705CCF348008C000000    mov dword ptr [0048F3CC], 0000008C
:00484D15 89542414                mov dword ptr [esp+14], edx
:00484D19 EB04                    jmp 00484D1F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484CEE(C)
|
:00484D1B 8B6C2414                mov ebp, dword ptr [esp+14]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484D19(U)
|
:00484D1F 83FF08                  cmp edi, 00000008
:00484D22 752C                    jne 00484D50
:00484D24 8B15C0F34800            mov edx, dword ptr [0048F3C0]
:00484D2A A1C4F34800              mov eax, dword ptr [0048F3C4]
:00484D2F 8D0C10                  lea ecx, dword ptr [eax+edx]
:00484D32 3BD1                    cmp edx, ecx
:00484D34 7D20                    jge 00484D56
:00484D36 8D0452                  lea eax, dword ptr [edx+2*edx]
:00484D39 2BCA                    sub ecx, edx
:00484D3B 8D048550F34800          lea eax, dword ptr [4*eax+0048F350]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484D4C(C)
|
:00484D42 C70000000000            mov dword ptr [eax], 00000000
:00484D48 83C00C                  add eax, 0000000C
:00484D4B 49                      dec ecx
:00484D4C 75F4                    jne 00484D42
:00484D4E EB06                    jmp 00484D56

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00484D03(C), :00484D22(C)
|
:00484D50 C70600000000            mov dword ptr [esi], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00484D34(C), :00484D4E(U)
|
:00484D56 83FF08                  cmp edi, 00000008
:00484D59 750F                    jne 00484D6A
:00484D5B 8B0DCCF34800            mov ecx, dword ptr [0048F3CC]
:00484D61 51                      push ecx
:00484D62 57                      push edi
:00484D63 FFD3                    call ebx
:00484D65 83C408                  add esp, 00000008
:00484D68 EB06                    jmp 00484D70

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484D59(C)
|
:00484D6A 57                      push edi
:00484D6B FFD3                    call ebx
:00484D6D 83C404                  add esp, 00000004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484D68(U)
|
:00484D70 83FF08                  cmp edi, 00000008
:00484D73 740A                    je 00484D7F
:00484D75 83FF0B                  cmp edi, 0000000B
:00484D78 7405                    je 00484D7F
:00484D7A 83FF04                  cmp edi, 00000004
:00484D7D 7515                    jne 00484D94

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00484D73(C), :00484D78(C)
|
:00484D7F 83FF08                  cmp edi, 00000008
:00484D82 892DD4CC4B00            mov dword ptr [004BCCD4], ebp
:00484D88 750A                    jne 00484D94
:00484D8A 8B542414                mov edx, dword ptr [esp+14]
:00484D8E 8915CCF34800            mov dword ptr [0048F3CC], edx

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00484D7D(C), :00484D88(C)
|
:00484D94 33C0                    xor eax, eax
:00484D96 5F                      pop edi
:00484D97 5E                      pop esi
:00484D98 5D                      pop ebp
:00484D99 5B                      pop ebx
:00484D9A C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484C6E(C)
|
:00484D9B 5F                      pop edi
:00484D9C 5E                      pop esi
:00484D9D 5D                      pop ebp
:00484D9E 83C8FF                  or eax, FFFFFFFF
:00484DA1 5B                      pop ebx
:00484DA2 C3                      ret


:00484DA3 90                      nop

:00484DA4 834C4800                DWORD 00484C83
:00484DA8 B74C4800                DWORD 00484CB7
:00484DAC B74C4800                DWORD 00484CB7
:00484DB0 B74C4800                DWORD 00484CB7
:00484DB4 AA4C4800                DWORD 00484CAA
:00484DB8 904C4800                DWORD 00484C90
:00484DBC 9D4C4800                DWORD 00484C9D
:00484DC0 9B4D4800                DWORD 00484D9B


:00484DC4 0007                    add byte ptr [edi], al
:00484DC6 0107                    add dword ptr [edi], eax
:00484DC8 07                      pop es
:00484DC9 07                      pop es
:00484DCA 0207                    add al, byte ptr [edi]
:00484DCC 07                      pop es
:00484DCD 0307                    add eax, dword ptr [edi]
:00484DCF 07                      pop es
:00484DD0 07                      pop es
:00484DD1 0407                    add al, 07
:00484DD3 07                      pop es
:00484DD4 07                      pop es
:00484DD5 07                      pop es
:00484DD6 07                      pop es
:00484DD7 0506909090              add eax, 90909006
:00484DDC 90                      nop
:00484DDD 90                      nop
:00484DDE 90                      nop
:00484DDF 90                      nop

* Referenced by a CALL at Address:
|:00484CB8   
|
:00484DE0 8B542404                mov edx, dword ptr [esp+04]
:00484DE4 8B0D4CF34800            mov ecx, dword ptr [0048F34C]
:00484DEA 56                      push esi
:00484DEB 8B35C8F34800            mov esi, dword ptr [0048F3C8]
:00484DF1 3BCA                    cmp ecx, edx

* Possible StringData Ref from Data Obj ->""
                                  |
:00484DF3 B848F34800              mov eax, 0048F348
:00484DF8 7416                    je 00484E10
:00484DFA 8D0C76                  lea ecx, dword ptr [esi+2*esi]
:00484DFD 8D0C8D48F34800          lea ecx, dword ptr [4*ecx+0048F348]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484E0E(C)
|
:00484E04 83C00C                  add eax, 0000000C
:00484E07 3BC1                    cmp eax, ecx
:00484E09 7305                    jnb 00484E10
:00484E0B 395004                  cmp dword ptr [eax+04], edx
:00484E0E 75F4                    jne 00484E04

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00484DF8(C), :00484E09(C)
|
:00484E10 8D0C76                  lea ecx, dword ptr [esi+2*esi]
:00484E13 8D0C8D48F34800          lea ecx, dword ptr [4*ecx+0048F348]
:00484E1A 3BC1                    cmp eax, ecx
:00484E1C 7305                    jnb 00484E23
:00484E1E 395004                  cmp dword ptr [eax+04], edx
:00484E21 7402                    je 00484E25

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484E1C(C)
|
:00484E23 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484E21(C)
|
:00484E25 5E                      pop esi
:00484E26 C3                      ret


:00484E27 90                      nop
:00484E28 90                      nop
:00484E29 90                      nop
:00484E2A 90                      nop
:00484E2B 90                      nop
:00484E2C 90                      nop
:00484E2D 90                      nop
:00484E2E 90                      nop
:00484E2F 90                      nop

* Referenced by a CALL at Address:
|:00484A3F   
|
:00484E30 53                      push ebx
:00484E31 55                      push ebp
:00484E32 56                      push esi
:00484E33 8B742414                mov esi, dword ptr [esp+14]
:00484E37 0FAF742410              imul esi, dword ptr [esp+10]
:00484E3C 83FEE0                  cmp esi, FFFFFFE0
:00484E3F 57                      push edi
:00484E40 7711                    ja 00484E53
:00484E42 85F6                    test esi, esi
:00484E44 7608                    jbe 00484E4E
:00484E46 83C60F                  add esi, 0000000F
:00484E49 83E6F0                  and esi, FFFFFFF0
:00484E4C EB05                    jmp 00484E53

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484E44(C)
|
:00484E4E BE10000000              mov esi, 00000010

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00484E40(C), :00484E4C(U)
|
:00484E53 8B1D9C614800            mov ebx, dword ptr [0048619C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484EBA(C)
|
:00484E59 33D2                    xor edx, edx
:00484E5B 83FEE0                  cmp esi, FFFFFFE0
:00484E5E 7742                    ja 00484EA2
:00484E60 3B358C154900            cmp esi, dword ptr [0049158C]
:00484E66 7728                    ja 00484E90
:00484E68 8BC6                    mov eax, esi
:00484E6A C1E804                  shr eax, 04
:00484E6D 50                      push eax
:00484E6E E88DF3FFFF              call 00484200
:00484E73 8BD0                    mov edx, eax
:00484E75 83C404                  add esp, 00000004
:00484E78 85D2                    test edx, edx
:00484E7A 7418                    je 00484E94
:00484E7C 8BCE                    mov ecx, esi
:00484E7E 33C0                    xor eax, eax
:00484E80 8BE9                    mov ebp, ecx
:00484E82 8BFA                    mov edi, edx
:00484E84 C1E902                  shr ecx, 02
:00484E87 F3                      repz
:00484E88 AB                      stosd
:00484E89 8BCD                    mov ecx, ebp
:00484E8B 83E103                  and ecx, 00000003
:00484E8E F3                      repz
:00484E8F AA                      stosb

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484E66(C)
|
:00484E90 85D2                    test edx, edx
:00484E92 752D                    jne 00484EC1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484E7A(C)
|
:00484E94 8B0D64D74B00            mov ecx, dword ptr [004BD764]
:00484E9A 56                      push esi
:00484E9B 6A08                    push 00000008
:00484E9D 51                      push ecx
:00484E9E FFD3                    call ebx
:00484EA0 8BD0                    mov edx, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484E5E(C)
|
:00484EA2 85D2                    test edx, edx
:00484EA4 751B                    jne 00484EC1
:00484EA6 A10CD04B00              mov eax, dword ptr [004BD00C]
:00484EAB 85C0                    test eax, eax
:00484EAD 7412                    je 00484EC1
:00484EAF 56                      push esi
:00484EB0 E84BC1FFFF              call 00481000
:00484EB5 83C404                  add esp, 00000004
:00484EB8 85C0                    test eax, eax
:00484EBA 759D                    jne 00484E59
:00484EBC 5F                      pop edi
:00484EBD 5E                      pop esi
:00484EBE 5D                      pop ebp
:00484EBF 5B                      pop ebx
:00484EC0 C3                      ret



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00484E92(C), :00484EA4(C), :00484EAD(C)
|
:00484EC1 5F                      pop edi
:00484EC2 5E                      pop esi
:00484EC3 5D                      pop ebp
:00484EC4 8BC2                    mov eax, edx
:00484EC6 5B                      pop ebx
:00484EC7 C3                      ret


:00484EC8 90                      nop
:00484EC9 90                      nop
:00484ECA 90                      nop
:00484ECB 90                      nop
:00484ECC 90                      nop
:00484ECD 90                      nop
:00484ECE 90                      nop
:00484ECF 90                      nop

* Referenced by a CALL at Addresses:
|:00480C07   , :00480F03   
|
:00484ED0 FF25BC614800            jmp dword ptr [004861BC]
:00484ED6 CC                      int 03
:00484ED7 CC                      int 03
:00484ED8 CC                      int 03
:00484ED9 CC                      int 03
:00484EDA CC                      int 03
:00484EDB CC                      int 03
:00484EDC CC                      int 03
:00484EDD CC                      int 03
:00484EDE CC                      int 03
:00484EDF CC                      int 03
:00484EE0 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00484EE3 E82866FAFF              call 0042B510
:00484EE8 C3                      ret


:00484EE9 B8687B4800              mov eax, 00487B68
:00484EEE E94DBDFFFF              jmp 00480C40
:00484EF3 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:00484EF9 E8D2E3F7FF              call 004032D0
:00484EFE C3                      ret


:00484EFF B8907B4800              mov eax, 00487B90
:00484F04 E937BDFFFF              jmp 00480C40
:00484F09 B8B87B4800              mov eax, 00487BB8
:00484F0E E92DBDFFFF              jmp 00480C40
:00484F13 8B45E4                  mov eax, dword ptr [ebp-1C]
:00484F16 50                      push eax
:00484F17 E804C1FFFF              call 00481020
:00484F1C 59                      pop ecx
:00484F1D C3                      ret


:00484F1E B8107C4800              mov eax, 00487C10
:00484F23 E918BDFFFF              jmp 00480C40
:00484F28 B8387C4800              mov eax, 00487C38
:00484F2D E90EBDFFFF              jmp 00480C40
:00484F32 CC                      int 03
:00484F33 CC                      int 03
:00484F34 CC                      int 03
:00484F35 CC                      int 03
:00484F36 CC                      int 03
:00484F37 CC                      int 03
:00484F38 CC                      int 03
:00484F39 CC                      int 03
:00484F3A CC                      int 03
:00484F3B CC                      int 03
:00484F3C CC                      int 03
:00484F3D CC                      int 03
:00484F3E CC                      int 03
:00484F3F CC                      int 03
:00484F40 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00484F43 83C108                  add ecx, 00000008
:00484F46 E8FE3FF9FF              call 00418F49
:00484F4B C3                      ret


:00484F4C B8907C4800              mov eax, 00487C90
:00484F51 E9EABCFFFF              jmp 00480C40
:00484F56 CC                      int 03
:00484F57 CC                      int 03
:00484F58 CC                      int 03
:00484F59 CC                      int 03
:00484F5A CC                      int 03
:00484F5B CC                      int 03
:00484F5C CC                      int 03
:00484F5D CC                      int 03
:00484F5E CC                      int 03
:00484F5F CC                      int 03
:00484F60 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00484F63 83C108                  add ecx, 00000008
:00484F66 E8DE3FF9FF              call 00418F49
:00484F6B C3                      ret


:00484F6C B8B87C4800              mov eax, 00487CB8
:00484F71 E9CABCFFFF              jmp 00480C40
:00484F76 CC                      int 03
:00484F77 CC                      int 03
:00484F78 CC                      int 03
:00484F79 CC                      int 03
:00484F7A CC                      int 03
:00484F7B CC                      int 03
:00484F7C CC                      int 03
:00484F7D CC                      int 03
:00484F7E CC                      int 03
:00484F7F CC                      int 03
:00484F80 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00484F86 E845E3F7FF              call 004032D0
:00484F8B C3                      ret


:00484F8C B8E07C4800              mov eax, 00487CE0
:00484F91 E9AABCFFFF              jmp 00480C40
:00484F96 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00484F9C E82FE3F7FF              call 004032D0
:00484FA1 C3                      ret


:00484FA2 B8087D4800              mov eax, 00487D08
:00484FA7 E994BCFFFF              jmp 00480C40
:00484FAC CC                      int 03
:00484FAD CC                      int 03
:00484FAE CC                      int 03
:00484FAF CC                      int 03
:00484FB0 8D8DDCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEDC]
:00484FB6 E815E3F7FF              call 004032D0
:00484FBB C3                      ret


:00484FBC B8307D4800              mov eax, 00487D30
:00484FC1 E97ABCFFFF              jmp 00480C40
:00484FC6 CC                      int 03
:00484FC7 CC                      int 03
:00484FC8 CC                      int 03
:00484FC9 CC                      int 03
:00484FCA CC                      int 03
:00484FCB CC                      int 03
:00484FCC CC                      int 03
:00484FCD CC                      int 03
:00484FCE CC                      int 03
:00484FCF CC                      int 03
:00484FD0 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00484FD3 E8B868F8FF              call 0040B890
:00484FD8 C3                      ret


:00484FD9 B8587D4800              mov eax, 00487D58
:00484FDE E95DBCFFFF              jmp 00480C40
:00484FE3 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00484FE9 E8E2E2F7FF              call 004032D0
:00484FEE C3                      ret


:00484FEF B8807D4800              mov eax, 00487D80
:00484FF4 E947BCFFFF              jmp 00480C40
:00484FF9 8D4DC4                  lea ecx, dword ptr [ebp-3C]
:00484FFC E88F68F8FF              call 0040B890
:00485001 C3                      ret


:00485002 B8A87D4800              mov eax, 00487DA8
:00485007 E934BCFFFF              jmp 00480C40
:0048500C CC                      int 03
:0048500D CC                      int 03
:0048500E CC                      int 03
:0048500F CC                      int 03
:00485010 8D4DB4                  lea ecx, dword ptr [ebp-4C]
:00485013 E8088FF8FF              call 0040DF20
:00485018 C3                      ret


:00485019 B8D07D4800              mov eax, 00487DD0
:0048501E E91DBCFFFF              jmp 00480C40
:00485023 8D8D40F9FFFF            lea ecx, dword ptr [ebp+FFFFF940]
:00485029 E8F290F8FF              call 0040E120
:0048502E C3                      ret


:0048502F B8F87D4800              mov eax, 00487DF8
:00485034 E907BCFFFF              jmp 00480C40
:00485039 CC                      int 03
:0048503A CC                      int 03
:0048503B CC                      int 03
:0048503C CC                      int 03
:0048503D CC                      int 03
:0048503E CC                      int 03
:0048503F CC                      int 03
:00485040 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485043 E8488FF8FF              call 0040DF90
:00485048 C3                      ret


:00485049 B8207E4800              mov eax, 00487E20
:0048504E E9EDBBFFFF              jmp 00480C40
:00485053 CC                      int 03
:00485054 CC                      int 03
:00485055 CC                      int 03
:00485056 CC                      int 03
:00485057 CC                      int 03
:00485058 CC                      int 03
:00485059 CC                      int 03
:0048505A CC                      int 03
:0048505B CC                      int 03
:0048505C CC                      int 03
:0048505D CC                      int 03
:0048505E CC                      int 03
:0048505F CC                      int 03
:00485060 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485063 E8288FF8FF              call 0040DF90
:00485068 C3                      ret


:00485069 B8487E4800              mov eax, 00487E48
:0048506E E9CDBBFFFF              jmp 00480C40
:00485073 CC                      int 03
:00485074 CC                      int 03
:00485075 CC                      int 03
:00485076 CC                      int 03
:00485077 CC                      int 03
:00485078 CC                      int 03
:00485079 CC                      int 03
:0048507A CC                      int 03
:0048507B CC                      int 03
:0048507C CC                      int 03
:0048507D CC                      int 03
:0048507E CC                      int 03
:0048507F CC                      int 03
:00485080 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485083 83C114                  add ecx, 00000014
:00485086 E80507FFFF              call 00475790
:0048508B C3                      ret


:0048508C B8707E4800              mov eax, 00487E70
:00485091 E9AABBFFFF              jmp 00480C40
:00485096 CC                      int 03
:00485097 CC                      int 03
:00485098 CC                      int 03
:00485099 CC                      int 03
:0048509A CC                      int 03
:0048509B CC                      int 03
:0048509C CC                      int 03
:0048509D CC                      int 03
:0048509E CC                      int 03
:0048509F CC                      int 03
:004850A0 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004850A3 83C114                  add ecx, 00000014
:004850A6 E8E506FFFF              call 00475790
:004850AB C3                      ret


:004850AC B8987E4800              mov eax, 00487E98
:004850B1 E98ABBFFFF              jmp 00480C40
:004850B6 CC                      int 03
:004850B7 CC                      int 03
:004850B8 CC                      int 03
:004850B9 CC                      int 03
:004850BA CC                      int 03
:004850BB CC                      int 03
:004850BC CC                      int 03
:004850BD CC                      int 03
:004850BE CC                      int 03
:004850BF CC                      int 03
:004850C0 8D4DE0                  lea ecx, dword ptr [ebp-20]
:004850C3 E84864FAFF              call 0042B510
:004850C8 C3                      ret


:004850C9 B8C07E4800              mov eax, 00487EC0
:004850CE E96DBBFFFF              jmp 00480C40
:004850D3 CC                      int 03
:004850D4 CC                      int 03
:004850D5 CC                      int 03
:004850D6 CC                      int 03
:004850D7 CC                      int 03
:004850D8 CC                      int 03
:004850D9 CC                      int 03
:004850DA CC                      int 03
:004850DB CC                      int 03
:004850DC CC                      int 03
:004850DD CC                      int 03
:004850DE CC                      int 03
:004850DF CC                      int 03
:004850E0 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004850E3 E8583AF9FF              call 00418B40
:004850E8 C3                      ret


:004850E9 B8E87E4800              mov eax, 00487EE8
:004850EE E94DBBFFFF              jmp 00480C40
:004850F3 CC                      int 03
:004850F4 CC                      int 03
:004850F5 CC                      int 03
:004850F6 CC                      int 03
:004850F7 CC                      int 03
:004850F8 CC                      int 03
:004850F9 CC                      int 03
:004850FA CC                      int 03
:004850FB CC                      int 03
:004850FC CC                      int 03
:004850FD CC                      int 03
:004850FE CC                      int 03
:004850FF CC                      int 03
:00485100 8B4DE0                  mov ecx, dword ptr [ebp-20]
:00485103 83C104                  add ecx, 00000004
:00485106 E80564FAFF              call 0042B510
:0048510B C3                      ret


:0048510C B8107F4800              mov eax, 00487F10
:00485111 E92ABBFFFF              jmp 00480C40
:00485116 CC                      int 03
:00485117 CC                      int 03
:00485118 CC                      int 03
:00485119 CC                      int 03
:0048511A CC                      int 03
:0048511B CC                      int 03
:0048511C CC                      int 03
:0048511D CC                      int 03
:0048511E CC                      int 03
:0048511F CC                      int 03
:00485120 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00485123 E8213EF9FF              call 00418F49
:00485128 C3                      ret


:00485129 B8387F4800              mov eax, 00487F38
:0048512E E90DBBFFFF              jmp 00480C40
:00485133 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00485136 E80E3EF9FF              call 00418F49
:0048513B C3                      ret


:0048513C B8607F4800              mov eax, 00487F60
:00485141 E9FABAFFFF              jmp 00480C40
:00485146 8D4DEC                  lea ecx, dword ptr [ebp-14]
:00485149 E8FB3DF9FF              call 00418F49
:0048514E C3                      ret


:0048514F B8887F4800              mov eax, 00487F88
:00485154 E9E7BAFFFF              jmp 00480C40
:00485159 CC                      int 03
:0048515A CC                      int 03
:0048515B CC                      int 03
:0048515C CC                      int 03
:0048515D CC                      int 03
:0048515E CC                      int 03
:0048515F CC                      int 03
:00485160 8D4DD8                  lea ecx, dword ptr [ebp-28]
:00485163 E82867F8FF              call 0040B890
:00485168 C3                      ret


:00485169 B8B07F4800              mov eax, 00487FB0
:0048516E E9CDBAFFFF              jmp 00480C40
:00485173 CC                      int 03
:00485174 CC                      int 03
:00485175 CC                      int 03
:00485176 CC                      int 03
:00485177 CC                      int 03
:00485178 CC                      int 03
:00485179 CC                      int 03
:0048517A CC                      int 03
:0048517B CC                      int 03
:0048517C CC                      int 03
:0048517D CC                      int 03
:0048517E CC                      int 03
:0048517F CC                      int 03
:00485180 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00485183 E8C13DF9FF              call 00418F49
:00485188 C3                      ret


:00485189 B8D87F4800              mov eax, 00487FD8
:0048518E E9ADBAFFFF              jmp 00480C40
:00485193 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00485196 E8AE3DF9FF              call 00418F49
:0048519B C3                      ret


:0048519C B800804800              mov eax, 00488000
:004851A1 E99ABAFFFF              jmp 00480C40
:004851A6 8D8D74FDFFFF            lea ecx, dword ptr [ebp+FFFFFD74]
:004851AC E8DF70F9FF              call 0041C290
:004851B1 C3                      ret


:004851B2 B828804800              mov eax, 00488028
:004851B7 E984BAFFFF              jmp 00480C40
:004851BC 8D8D74FDFFFF            lea ecx, dword ptr [ebp+FFFFFD74]
:004851C2 E8C970F9FF              call 0041C290
:004851C7 C3                      ret


:004851C8 B850804800              mov eax, 00488050
:004851CD E96EBAFFFF              jmp 00480C40
:004851D2 8D4DD0                  lea ecx, dword ptr [ebp-30]
:004851D5 E86F3DF9FF              call 00418F49
:004851DA C3                      ret


:004851DB B878804800              mov eax, 00488078
:004851E0 E95BBAFFFF              jmp 00480C40
:004851E5 8D4DF0                  lea ecx, dword ptr [ebp-10]
:004851E8 E85C3DF9FF              call 00418F49
:004851ED C3                      ret


:004851EE B8A0804800              mov eax, 004880A0
:004851F3 E948BAFFFF              jmp 00480C40
:004851F8 8D4DF0                  lea ecx, dword ptr [ebp-10]
:004851FB E8493DF9FF              call 00418F49
:00485200 C3                      ret


:00485201 B8C8804800              mov eax, 004880C8
:00485206 E935BAFFFF              jmp 00480C40
:0048520B 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:00485211 E8BAE0F7FF              call 004032D0
:00485216 C3                      ret


:00485217 B8F0804800              mov eax, 004880F0
:0048521C E91FBAFFFF              jmp 00480C40
:00485221 CC                      int 03
:00485222 CC                      int 03
:00485223 CC                      int 03
:00485224 CC                      int 03
:00485225 CC                      int 03
:00485226 CC                      int 03
:00485227 CC                      int 03
:00485228 CC                      int 03
:00485229 CC                      int 03
:0048522A CC                      int 03
:0048522B CC                      int 03
:0048522C CC                      int 03
:0048522D CC                      int 03
:0048522E CC                      int 03
:0048522F CC                      int 03
:00485230 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:00485236 E895E0F7FF              call 004032D0
:0048523B C3                      ret


:0048523C B818814800              mov eax, 00488118
:00485241 E9FAB9FFFF              jmp 00480C40
:00485246 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0048524C E87FE0F7FF              call 004032D0
:00485251 C3                      ret


:00485252 B840814800              mov eax, 00488140
:00485257 E9E4B9FFFF              jmp 00480C40
:0048525C CC                      int 03
:0048525D CC                      int 03
:0048525E CC                      int 03
:0048525F CC                      int 03
:00485260 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00485266 E865E0F7FF              call 004032D0
:0048526B C3                      ret


:0048526C B868814800              mov eax, 00488168
:00485271 E9CAB9FFFF              jmp 00480C40
:00485276 CC                      int 03
:00485277 CC                      int 03
:00485278 CC                      int 03
:00485279 CC                      int 03
:0048527A CC                      int 03
:0048527B CC                      int 03
:0048527C CC                      int 03
:0048527D CC                      int 03
:0048527E CC                      int 03
:0048527F CC                      int 03
:00485280 8D8DD4FEFFFF            lea ecx, dword ptr [ebp+FFFFFED4]
:00485286 E845E0F7FF              call 004032D0
:0048528B C3                      ret


:0048528C B890814800              mov eax, 00488190
:00485291 E9AAB9FFFF              jmp 00480C40
:00485296 8D8DE4FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE4]
:0048529C E82FE0F7FF              call 004032D0
:004852A1 C3                      ret


:004852A2 B8B8814800              mov eax, 004881B8
:004852A7 E994B9FFFF              jmp 00480C40
:004852AC CC                      int 03
:004852AD CC                      int 03
:004852AE CC                      int 03
:004852AF CC                      int 03
:004852B0 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:004852B6 E815E0F7FF              call 004032D0
:004852BB C3                      ret


:004852BC B8E0814800              mov eax, 004881E0
:004852C1 E97AB9FFFF              jmp 00480C40
:004852C6 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:004852CC E8FFDFF7FF              call 004032D0
:004852D1 C3                      ret


:004852D2 B808824800              mov eax, 00488208
:004852D7 E964B9FFFF              jmp 00480C40
:004852DC CC                      int 03
:004852DD CC                      int 03
:004852DE CC                      int 03
:004852DF CC                      int 03
:004852E0 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:004852E6 E8E5DFF7FF              call 004032D0
:004852EB C3                      ret


:004852EC B830824800              mov eax, 00488230
:004852F1 E94AB9FFFF              jmp 00480C40
:004852F6 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:004852FC E8CFDFF7FF              call 004032D0
:00485301 C3                      ret


:00485302 8D4DF0                  lea ecx, dword ptr [ebp-10]
:00485305 E83F3CF9FF              call 00418F49
:0048530A C3                      ret


:0048530B B858824800              mov eax, 00488258
:00485310 E92BB9FFFF              jmp 00480C40
:00485315 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0048531B E8B0DFF7FF              call 004032D0
:00485320 C3                      ret


:00485321 B888824800              mov eax, 00488288
:00485326 E915B9FFFF              jmp 00480C40
:0048532B 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:00485331 E89ADFF7FF              call 004032D0
:00485336 C3                      ret


:00485337 B8B0824800              mov eax, 004882B0
:0048533C E9FFB8FFFF              jmp 00480C40
:00485341 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:00485347 E884DFF7FF              call 004032D0
:0048534C C3                      ret


:0048534D B8D8824800              mov eax, 004882D8
:00485352 E9E9B8FFFF              jmp 00480C40
:00485357 CC                      int 03
:00485358 CC                      int 03
:00485359 CC                      int 03
:0048535A CC                      int 03
:0048535B CC                      int 03
:0048535C CC                      int 03
:0048535D CC                      int 03
:0048535E CC                      int 03
:0048535F CC                      int 03
:00485360 8D8D8CFEFFFF            lea ecx, dword ptr [ebp+FFFFFE8C]
:00485366 E8B5A6FAFF              call 0042FA20
:0048536B C3                      ret


:0048536C 8D4DC0                  lea ecx, dword ptr [ebp-40]
:0048536F E89C61FAFF              call 0042B510
:00485374 C3                      ret


:00485375 B800834800              mov eax, 00488300
:0048537A E9C1B8FFFF              jmp 00480C40
:0048537F CC                      int 03
:00485380 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00485386 E845DFF7FF              call 004032D0
:0048538B C3                      ret


:0048538C 8D4DF0                  lea ecx, dword ptr [ebp-10]
:0048538F E8B53BF9FF              call 00418F49
:00485394 C3                      ret


:00485395 B830834800              mov eax, 00488330
:0048539A E9A1B8FFFF              jmp 00480C40
:0048539F 8D8DE0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE0]
:004853A5 E826DFF7FF              call 004032D0
:004853AA C3                      ret


:004853AB B860834800              mov eax, 00488360
:004853B0 E98BB8FFFF              jmp 00480C40
:004853B5 CC                      int 03
:004853B6 CC                      int 03
:004853B7 CC                      int 03
:004853B8 CC                      int 03
:004853B9 CC                      int 03
:004853BA CC                      int 03
:004853BB CC                      int 03
:004853BC CC                      int 03
:004853BD CC                      int 03
:004853BE CC                      int 03
:004853BF CC                      int 03
:004853C0 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:004853C6 E805DFF7FF              call 004032D0
:004853CB C3                      ret


:004853CC B888834800              mov eax, 00488388
:004853D1 E96AB8FFFF              jmp 00480C40
:004853D6 8D8DF4FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF4]
:004853DC E8BF8FFBFF              call 0043E3A0
:004853E1 C3                      ret


:004853E2 B8B0834800              mov eax, 004883B0
:004853E7 E954B8FFFF              jmp 00480C40
:004853EC CC                      int 03
:004853ED CC                      int 03
:004853EE CC                      int 03
:004853EF CC                      int 03
:004853F0 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004853F3 E86890F8FF              call 0040E460
:004853F8 C3                      ret


:004853F9 B8D8834800              mov eax, 004883D8
:004853FE E93DB8FFFF              jmp 00480C40
:00485403 CC                      int 03
:00485404 CC                      int 03
:00485405 CC                      int 03
:00485406 CC                      int 03
:00485407 CC                      int 03
:00485408 CC                      int 03
:00485409 CC                      int 03
:0048540A CC                      int 03
:0048540B CC                      int 03
:0048540C CC                      int 03
:0048540D CC                      int 03
:0048540E CC                      int 03
:0048540F CC                      int 03
:00485410 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485413 E84890F8FF              call 0040E460
:00485418 C3                      ret


:00485419 B800844800              mov eax, 00488400
:0048541E E91DB8FFFF              jmp 00480C40
:00485423 CC                      int 03
:00485424 CC                      int 03
:00485425 CC                      int 03
:00485426 CC                      int 03
:00485427 CC                      int 03
:00485428 CC                      int 03
:00485429 CC                      int 03
:0048542A CC                      int 03
:0048542B CC                      int 03
:0048542C CC                      int 03
:0048542D CC                      int 03
:0048542E CC                      int 03
:0048542F CC                      int 03
:00485430 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00485436 E895DEF7FF              call 004032D0
:0048543B C3                      ret


:0048543C B828844800              mov eax, 00488428
:00485441 E9FAB7FFFF              jmp 00480C40
:00485446 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0048544C E87FDEF7FF              call 004032D0
:00485451 C3                      ret


:00485452 B850844800              mov eax, 00488450
:00485457 E9E4B7FFFF              jmp 00480C40
:0048545C CC                      int 03
:0048545D CC                      int 03
:0048545E CC                      int 03
:0048545F CC                      int 03
:00485460 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00485466 E865DEF7FF              call 004032D0
:0048546B C3                      ret


:0048546C B878844800              mov eax, 00488478
:00485471 E9CAB7FFFF              jmp 00480C40
:00485476 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0048547C E84FDEF7FF              call 004032D0
:00485481 C3                      ret


:00485482 B8A0844800              mov eax, 004884A0
:00485487 E9B4B7FFFF              jmp 00480C40
:0048548C 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00485492 E839DEF7FF              call 004032D0
:00485497 C3                      ret


:00485498 B8C8844800              mov eax, 004884C8
:0048549D E99EB7FFFF              jmp 00480C40
:004854A2 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:004854A8 E823DEF7FF              call 004032D0
:004854AD C3                      ret


:004854AE B8F0844800              mov eax, 004884F0
:004854B3 E988B7FFFF              jmp 00480C40
:004854B8 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:004854BE E80DDEF7FF              call 004032D0
:004854C3 C3                      ret


:004854C4 B818854800              mov eax, 00488518
:004854C9 E972B7FFFF              jmp 00480C40
:004854CE 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:004854D4 E8F7DDF7FF              call 004032D0
:004854D9 C3                      ret


:004854DA B840854800              mov eax, 00488540
:004854DF E95CB7FFFF              jmp 00480C40
:004854E4 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:004854EA E8E1DDF7FF              call 004032D0
:004854EF C3                      ret


:004854F0 B868854800              mov eax, 00488568
:004854F5 E946B7FFFF              jmp 00480C40
:004854FA 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00485500 E8CBDDF7FF              call 004032D0
:00485505 C3                      ret


:00485506 B890854800              mov eax, 00488590
:0048550B E930B7FFFF              jmp 00480C40
:00485510 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00485516 E8B5DDF7FF              call 004032D0
:0048551B C3                      ret


:0048551C B8B8854800              mov eax, 004885B8
:00485521 E91AB7FFFF              jmp 00480C40
:00485526 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0048552C E89FDDF7FF              call 004032D0
:00485531 C3                      ret


:00485532 B8E0854800              mov eax, 004885E0
:00485537 E904B7FFFF              jmp 00480C40
:0048553C 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:00485542 E889DDF7FF              call 004032D0
:00485547 C3                      ret


:00485548 B808864800              mov eax, 00488608
:0048554D E9EEB6FFFF              jmp 00480C40
:00485552 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00485558 E873DDF7FF              call 004032D0
:0048555D C3                      ret


:0048555E B830864800              mov eax, 00488630
:00485563 E9D8B6FFFF              jmp 00480C40
:00485568 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0048556E E85DDDF7FF              call 004032D0
:00485573 C3                      ret


:00485574 B858864800              mov eax, 00488658
:00485579 E9C2B6FFFF              jmp 00480C40
:0048557E 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00485584 E847DDF7FF              call 004032D0
:00485589 C3                      ret


:0048558A B880864800              mov eax, 00488680
:0048558F E9ACB6FFFF              jmp 00480C40
:00485594 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0048559A E831DDF7FF              call 004032D0
:0048559F C3                      ret


:004855A0 B8A8864800              mov eax, 004886A8
:004855A5 E996B6FFFF              jmp 00480C40
:004855AA CC                      int 03
:004855AB CC                      int 03
:004855AC CC                      int 03
:004855AD CC                      int 03
:004855AE CC                      int 03
:004855AF CC                      int 03
:004855B0 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:004855B6 E815DDF7FF              call 004032D0
:004855BB C3                      ret


:004855BC B8D0864800              mov eax, 004886D0
:004855C1 E97AB6FFFF              jmp 00480C40
:004855C6 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:004855CC E8FFDCF7FF              call 004032D0
:004855D1 C3                      ret


:004855D2 B8F8864800              mov eax, 004886F8
:004855D7 E964B6FFFF              jmp 00480C40
:004855DC 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:004855E2 E8E9DCF7FF              call 004032D0
:004855E7 C3                      ret


:004855E8 B820874800              mov eax, 00488720
:004855ED E94EB6FFFF              jmp 00480C40
:004855F2 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:004855F8 E8D3DCF7FF              call 004032D0
:004855FD C3                      ret


:004855FE B848874800              mov eax, 00488748
:00485603 E938B6FFFF              jmp 00480C40
:00485608 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:0048560E E8BDDCF7FF              call 004032D0
:00485613 C3                      ret


:00485614 B870874800              mov eax, 00488770
:00485619 E922B6FFFF              jmp 00480C40
:0048561E 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:00485624 E8A7DCF7FF              call 004032D0
:00485629 C3                      ret


:0048562A B898874800              mov eax, 00488798
:0048562F E90CB6FFFF              jmp 00480C40
:00485634 8D8DDCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEDC]
:0048563A E891DCF7FF              call 004032D0
:0048563F C3                      ret


:00485640 B8C0874800              mov eax, 004887C0
:00485645 E9F6B5FFFF              jmp 00480C40
:0048564A 8D8DE0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE0]
:00485650 E87BDCF7FF              call 004032D0
:00485655 C3                      ret


:00485656 B8E8874800              mov eax, 004887E8
:0048565B E9E0B5FFFF              jmp 00480C40
:00485660 8D8DD8FEFFFF            lea ecx, dword ptr [ebp+FFFFFED8]
:00485666 E865DCF7FF              call 004032D0
:0048566B C3                      ret


:0048566C B810884800              mov eax, 00488810
:00485671 E9CAB5FFFF              jmp 00480C40
:00485676 8D8DDCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEDC]
:0048567C E84FDCF7FF              call 004032D0
:00485681 C3                      ret


:00485682 B838884800              mov eax, 00488838
:00485687 E9B4B5FFFF              jmp 00480C40
:0048568C 8D8DE4FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE4]
:00485692 E839DCF7FF              call 004032D0
:00485697 C3                      ret


:00485698 B860884800              mov eax, 00488860
:0048569D E99EB5FFFF              jmp 00480C40
:004856A2 8D8DE8FEFFFF            lea ecx, dword ptr [ebp+FFFFFEE8]
:004856A8 E823DCF7FF              call 004032D0
:004856AD C3                      ret


:004856AE B888884800              mov eax, 00488888
:004856B3 E988B5FFFF              jmp 00480C40
:004856B8 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:004856BE E80DDCF7FF              call 004032D0
:004856C3 C3                      ret


:004856C4 B8B0884800              mov eax, 004888B0
:004856C9 E972B5FFFF              jmp 00480C40
:004856CE CC                      int 03
:004856CF CC                      int 03
:004856D0 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:004856D6 E8F5DBF7FF              call 004032D0
:004856DB C3                      ret


:004856DC B8D8884800              mov eax, 004888D8
:004856E1 E95AB5FFFF              jmp 00480C40
:004856E6 8B45E0                  mov eax, dword ptr [ebp-20]
:004856E9 50                      push eax
:004856EA E831B9FFFF              call 00481020
:004856EF 59                      pop ecx
:004856F0 C3                      ret


:004856F1 B800894800              mov eax, 00488900
:004856F6 E945B5FFFF              jmp 00480C40
:004856FB 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:00485701 E8CADBF7FF              call 004032D0
:00485706 C3                      ret


:00485707 B828894800              mov eax, 00488928
:0048570C E92FB5FFFF              jmp 00480C40
:00485711 CC                      int 03
:00485712 CC                      int 03
:00485713 CC                      int 03
:00485714 CC                      int 03
:00485715 CC                      int 03
:00485716 CC                      int 03
:00485717 CC                      int 03
:00485718 CC                      int 03
:00485719 CC                      int 03
:0048571A CC                      int 03
:0048571B CC                      int 03
:0048571C CC                      int 03
:0048571D CC                      int 03
:0048571E CC                      int 03
:0048571F CC                      int 03
:00485720 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485723 83C124                  add ecx, 00000024
:00485726 E8E55DFAFF              call 0042B510
:0048572B C3                      ret


:0048572C B850894800              mov eax, 00488950
:00485731 E90AB5FFFF              jmp 00480C40
:00485736 CC                      int 03
:00485737 CC                      int 03
:00485738 CC                      int 03
:00485739 CC                      int 03
:0048573A CC                      int 03
:0048573B CC                      int 03
:0048573C CC                      int 03
:0048573D CC                      int 03
:0048573E CC                      int 03
:0048573F CC                      int 03
:00485740 837DF000                cmp dword ptr [ebp-10], 00000000
:00485744 740B                    je 00485751
:00485746 8B45F0                  mov eax, dword ptr [ebp-10]
:00485749 83C024                  add eax, 00000024
:0048574C 8945EC                  mov dword ptr [ebp-14], eax
:0048574F EB07                    jmp 00485758

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00485744(C)
|
:00485751 C745EC00000000          mov [ebp-14], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048574F(U)
|
:00485758 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0048575B E8B05DFAFF              call 0042B510
:00485760 C3                      ret


:00485761 B878894800              mov eax, 00488978
:00485766 E9D5B4FFFF              jmp 00480C40
:0048576B CC                      int 03
:0048576C CC                      int 03
:0048576D CC                      int 03
:0048576E CC                      int 03
:0048576F CC                      int 03
:00485770 8D4D88                  lea ecx, dword ptr [ebp-78]
:00485773 E81861F8FF              call 0040B890
:00485778 C3                      ret


:00485779 B8A0894800              mov eax, 004889A0
:0048577E E9BDB4FFFF              jmp 00480C40
:00485783 CC                      int 03
:00485784 CC                      int 03
:00485785 CC                      int 03
:00485786 CC                      int 03
:00485787 CC                      int 03
:00485788 CC                      int 03
:00485789 CC                      int 03
:0048578A CC                      int 03
:0048578B CC                      int 03
:0048578C CC                      int 03
:0048578D CC                      int 03
:0048578E CC                      int 03
:0048578F CC                      int 03
:00485790 8D8D88F8FFFF            lea ecx, dword ptr [ebp+FFFFF888]
:00485796 E865CEFEFF              call 00472600
:0048579B C3                      ret


:0048579C B8C8894800              mov eax, 004889C8
:004857A1 E99AB4FFFF              jmp 00480C40
:004857A6 8D8D6CFDFFFF            lea ecx, dword ptr [ebp+FFFFFD6C]
:004857AC E81FCFFEFF              call 004726D0
:004857B1 C3                      ret


:004857B2 8D8DE8F5FFFF            lea ecx, dword ptr [ebp+FFFFF5E8]
:004857B8 E893CFFEFF              call 00472750
:004857BD C3                      ret


:004857BE B8F0894800              mov eax, 004889F0
:004857C3 E978B4FFFF              jmp 00480C40
:004857C8 8B45EC                  mov eax, dword ptr [ebp-14]
:004857CB 50                      push eax
:004857CC E84FB8FFFF              call 00481020
:004857D1 59                      pop ecx
:004857D2 C3                      ret


:004857D3 8B45E4                  mov eax, dword ptr [ebp-1C]
:004857D6 50                      push eax
:004857D7 E844B8FFFF              call 00481020
:004857DC 59                      pop ecx
:004857DD C3                      ret


:004857DE B8208A4800              mov eax, 00488A20
:004857E3 E958B4FFFF              jmp 00480C40
:004857E8 8B45F0                  mov eax, dword ptr [ebp-10]
:004857EB 50                      push eax
:004857EC E82FB8FFFF              call 00481020
:004857F1 59                      pop ecx
:004857F2 C3                      ret


:004857F3 B8508A4800              mov eax, 00488A50
:004857F8 E943B4FFFF              jmp 00480C40
:004857FD 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485800 E89ACFFDFF              call 0046279F
:00485805 C3                      ret


:00485806 B8788A4800              mov eax, 00488A78
:0048580B E930B4FFFF              jmp 00480C40
:00485810 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485813 E887CFFDFF              call 0046279F
:00485818 C3                      ret


:00485819 B8A08A4800              mov eax, 00488AA0
:0048581E E91DB4FFFF              jmp 00480C40
:00485823 8B4DEC                  mov ecx, dword ptr [ebp-14]
:00485826 E874CFFDFF              call 0046279F
:0048582B C3                      ret


:0048582C 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0048582F 83C140                  add ecx, 00000040
:00485832 E8B989F8FF              call 0040E1F0
:00485837 C3                      ret


:00485838 B8C88A4800              mov eax, 00488AC8
:0048583D E9FEB3FFFF              jmp 00480C40
:00485842 8D8DB8DFFFFF            lea ecx, dword ptr [ebp+FFFFDFB8]
:00485848 E873D1FEFF              call 004729C0
:0048584D C3                      ret


:0048584E B8F88A4800              mov eax, 00488AF8
:00485853 E9E8B3FFFF              jmp 00480C40
:00485858 8D8D5CFFFFFF            lea ecx, dword ptr [ebp+FFFFFF5C]
:0048585E E81DD3FEFF              call 00472B80
:00485863 C3                      ret


:00485864 B8208B4800              mov eax, 00488B20
:00485869 E9D2B3FFFF              jmp 00480C40
:0048586E 8D8D5CF1FFFF            lea ecx, dword ptr [ebp+FFFFF15C]
:00485874 E867D5FEFF              call 00472DE0
:00485879 C3                      ret


:0048587A B8488B4800              mov eax, 00488B48
:0048587F E9BCB3FFFF              jmp 00480C40
:00485884 8D4DA0                  lea ecx, dword ptr [ebp-60]
:00485887 E864D6FEFF              call 00472EF0
:0048588C C3                      ret


:0048588D B8708B4800              mov eax, 00488B70
:00485892 E9A9B3FFFF              jmp 00480C40
:00485897 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0048589A 83C10C                  add ecx, 0000000C
:0048589D E8BECDFEFF              call 00472660
:004858A2 C3                      ret


:004858A3 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004858A6 81C1E0000000            add ecx, 000000E0
:004858AC E8DFFEFEFF              call 00475790
:004858B1 C3                      ret


:004858B2 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004858B5 81C1B0010000            add ecx, 000001B0
:004858BB E8E0CDFEFF              call 004726A0
:004858C0 C3                      ret


:004858C1 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004858C4 81C17C020000            add ecx, 0000027C
:004858CA E82189F8FF              call 0040E1F0
:004858CF C3                      ret


:004858D0 B8988B4800              mov eax, 00488B98
:004858D5 E966B3FFFF              jmp 00480C40
:004858DA 8D4DA4                  lea ecx, dword ptr [ebp-5C]
:004858DD E80ED6FEFF              call 00472EF0
:004858E2 C3                      ret


:004858E3 B8D88B4800              mov eax, 00488BD8
:004858E8 E953B3FFFF              jmp 00480C40
:004858ED 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004858F0 83C108                  add ecx, 00000008
:004858F3 E868CDFEFF              call 00472660
:004858F8 C3                      ret


:004858F9 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004858FC 81C1A0060000            add ecx, 000006A0
:00485902 E879CDFEFF              call 00472680
:00485907 C3                      ret


:00485908 B8008C4800              mov eax, 00488C00
:0048590D E92EB3FFFF              jmp 00480C40
:00485912 8D8D70FFFFFF            lea ecx, dword ptr [ebp+FFFFFF70]
:00485918 E8735FF8FF              call 0040B890
:0048591D C3                      ret


:0048591E B8308C4800              mov eax, 00488C30
:00485923 E918B3FFFF              jmp 00480C40
:00485928 8B45EC                  mov eax, dword ptr [ebp-14]
:0048592B 50                      push eax
:0048592C E8EFB6FFFF              call 00481020
:00485931 59                      pop ecx
:00485932 C3                      ret


:00485933 B8588C4800              mov eax, 00488C58
:00485938 E903B3FFFF              jmp 00480C40
:0048593D 8D4DB0                  lea ecx, dword ptr [ebp-50]
:00485940 E84B86F8FF              call 0040DF90
:00485945 C3                      ret


:00485946 8D8D70FFFFFF            lea ecx, dword ptr [ebp+FFFFFF70]
:0048594C E8BFD5FEFF              call 00472F10
:00485951 C3                      ret


:00485952 B8808C4800              mov eax, 00488C80
:00485957 E9E4B2FFFF              jmp 00480C40
:0048595C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:0048595F E83BCEFDFF              call 0046279F
:00485964 C3                      ret


:00485965 B8B08C4800              mov eax, 00488CB0
:0048596A E9D1B2FFFF              jmp 00480C40
:0048596F 8B45EC                  mov eax, dword ptr [ebp-14]
:00485972 50                      push eax
:00485973 E8A8B6FFFF              call 00481020
:00485978 59                      pop ecx
:00485979 C3                      ret


:0048597A B8D88C4800              mov eax, 00488CD8
:0048597F E9BCB2FFFF              jmp 00480C40
:00485984 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:0048598A E841D9F7FF              call 004032D0
:0048598F C3                      ret


:00485990 B8008D4800              mov eax, 00488D00
:00485995 E9A6B2FFFF              jmp 00480C40
:0048599A 8D8DECFEFFFF            lea ecx, dword ptr [ebp+FFFFFEEC]
:004859A0 E82BD9F7FF              call 004032D0
:004859A5 C3                      ret


:004859A6 B8288D4800              mov eax, 00488D28
:004859AB E990B2FFFF              jmp 00480C40
:004859B0 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004859B3 83C108                  add ecx, 00000008
:004859B6 E8A5CCFEFF              call 00472660
:004859BB C3                      ret


:004859BC B8508D4800              mov eax, 00488D50
:004859C1 E97AB2FFFF              jmp 00480C40
:004859C6 CC                      int 03
:004859C7 CC                      int 03
:004859C8 CC                      int 03
:004859C9 CC                      int 03
:004859CA CC                      int 03
:004859CB CC                      int 03
:004859CC CC                      int 03
:004859CD CC                      int 03
:004859CE CC                      int 03
:004859CF CC                      int 03
:004859D0 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004859D3 83C10C                  add ecx, 0000000C
:004859D6 E885CCFEFF              call 00472660
:004859DB C3                      ret


:004859DC 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004859DF 81C1E0000000            add ecx, 000000E0
:004859E5 E8A6FDFEFF              call 00475790
:004859EA C3                      ret


:004859EB 8B4DF0                  mov ecx, dword ptr [ebp-10]
:004859EE 81C1B0010000            add ecx, 000001B0
:004859F4 E8A7CCFEFF              call 004726A0
:004859F9 C3                      ret


:004859FA B8788D4800              mov eax, 00488D78
:004859FF E93CB2FFFF              jmp 00480C40
:00485A04 CC                      int 03
:00485A05 CC                      int 03
:00485A06 CC                      int 03
:00485A07 CC                      int 03
:00485A08 CC                      int 03
:00485A09 CC                      int 03
:00485A0A CC                      int 03
:00485A0B CC                      int 03
:00485A0C CC                      int 03
:00485A0D CC                      int 03
:00485A0E CC                      int 03
:00485A0F CC                      int 03
:00485A10 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485A13 83C10C                  add ecx, 0000000C
:00485A16 E875FDFEFF              call 00475790
:00485A1B C3                      ret


:00485A1C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485A1F 81C1A0060000            add ecx, 000006A0
:00485A25 E866FDFEFF              call 00475790
:00485A2A C3                      ret


:00485A2B B8B08D4800              mov eax, 00488DB0
:00485A30 E90BB2FFFF              jmp 00480C40
:00485A35 CC                      int 03
:00485A36 CC                      int 03
:00485A37 CC                      int 03
:00485A38 CC                      int 03
:00485A39 CC                      int 03
:00485A3A CC                      int 03
:00485A3B CC                      int 03
:00485A3C CC                      int 03
:00485A3D CC                      int 03
:00485A3E CC                      int 03
:00485A3F CC                      int 03
:00485A40 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485A43 83C10C                  add ecx, 0000000C
:00485A46 E845FDFEFF              call 00475790
:00485A4B C3                      ret


:00485A4C 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485A4F 81C1A0060000            add ecx, 000006A0
:00485A55 E836FDFEFF              call 00475790
:00485A5A C3                      ret


:00485A5B B8E08D4800              mov eax, 00488DE0
:00485A60 E9DBB1FFFF              jmp 00480C40
:00485A65 CC                      int 03
:00485A66 CC                      int 03
:00485A67 CC                      int 03
:00485A68 CC                      int 03
:00485A69 CC                      int 03
:00485A6A CC                      int 03
:00485A6B CC                      int 03
:00485A6C CC                      int 03
:00485A6D CC                      int 03
:00485A6E CC                      int 03
:00485A6F CC                      int 03
:00485A70 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485A73 E81885F8FF              call 0040DF90
:00485A78 C3                      ret


:00485A79 B8108E4800              mov eax, 00488E10
:00485A7E E9BDB1FFFF              jmp 00480C40
:00485A83 CC                      int 03
:00485A84 CC                      int 03
:00485A85 CC                      int 03
:00485A86 CC                      int 03
:00485A87 CC                      int 03
:00485A88 CC                      int 03
:00485A89 CC                      int 03
:00485A8A CC                      int 03
:00485A8B CC                      int 03
:00485A8C CC                      int 03
:00485A8D CC                      int 03
:00485A8E CC                      int 03
:00485A8F CC                      int 03
:00485A90 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485A93 E8F884F8FF              call 0040DF90
:00485A98 C3                      ret


:00485A99 B8388E4800              mov eax, 00488E38
:00485A9E E99DB1FFFF              jmp 00480C40
:00485AA3 CC                      int 03
:00485AA4 CC                      int 03
:00485AA5 CC                      int 03
:00485AA6 CC                      int 03
:00485AA7 CC                      int 03
:00485AA8 CC                      int 03
:00485AA9 CC                      int 03
:00485AAA CC                      int 03
:00485AAB CC                      int 03
:00485AAC CC                      int 03
:00485AAD CC                      int 03
:00485AAE CC                      int 03
:00485AAF CC                      int 03
:00485AB0 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485AB3 E8A889F8FF              call 0040E460
:00485AB8 C3                      ret


:00485AB9 B8608E4800              mov eax, 00488E60
:00485ABE E97DB1FFFF              jmp 00480C40
:00485AC3 CC                      int 03
:00485AC4 CC                      int 03
:00485AC5 CC                      int 03
:00485AC6 CC                      int 03
:00485AC7 CC                      int 03
:00485AC8 CC                      int 03
:00485AC9 CC                      int 03
:00485ACA CC                      int 03
:00485ACB CC                      int 03
:00485ACC CC                      int 03
:00485ACD CC                      int 03
:00485ACE CC                      int 03
:00485ACF CC                      int 03
:00485AD0 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485AD3 E858FDFEFF              call 00475830
:00485AD8 C3                      ret


:00485AD9 B8888E4800              mov eax, 00488E88
:00485ADE E95DB1FFFF              jmp 00480C40
:00485AE3 CC                      int 03
:00485AE4 CC                      int 03
:00485AE5 CC                      int 03
:00485AE6 CC                      int 03
:00485AE7 CC                      int 03
:00485AE8 CC                      int 03
:00485AE9 CC                      int 03
:00485AEA CC                      int 03
:00485AEB CC                      int 03
:00485AEC CC                      int 03
:00485AED CC                      int 03
:00485AEE CC                      int 03
:00485AEF CC                      int 03
:00485AF0 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485AF3 E86889F8FF              call 0040E460
:00485AF8 C3                      ret


:00485AF9 B8B08E4800              mov eax, 00488EB0
:00485AFE E93DB1FFFF              jmp 00480C40
:00485B03 CC                      int 03
:00485B04 CC                      int 03
:00485B05 CC                      int 03
:00485B06 CC                      int 03
:00485B07 CC                      int 03
:00485B08 CC                      int 03
:00485B09 CC                      int 03
:00485B0A CC                      int 03
:00485B0B CC                      int 03
:00485B0C CC                      int 03
:00485B0D CC                      int 03
:00485B0E CC                      int 03
:00485B0F CC                      int 03
:00485B10 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485B13 E818FDFEFF              call 00475830
:00485B18 C3                      ret


:00485B19 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485B1C 83C15C                  add ecx, 0000005C
:00485B1F E86CFCFEFF              call 00475790
:00485B24 C3                      ret


:00485B25 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485B28 81C1B40D0000            add ecx, 00000DB4
:00485B2E E85DFCFEFF              call 00475790
:00485B33 C3                      ret


:00485B34 B8D88E4800              mov eax, 00488ED8
:00485B39 E902B1FFFF              jmp 00480C40
:00485B3E CC                      int 03
:00485B3F CC                      int 03
:00485B40 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485B43 E8E8FCFEFF              call 00475830
:00485B48 C3                      ret


:00485B49 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485B4C 83C15C                  add ecx, 0000005C
:00485B4F E83CFCFEFF              call 00475790
:00485B54 C3                      ret


:00485B55 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485B58 81C1B40D0000            add ecx, 00000DB4
:00485B5E E82DFCFEFF              call 00475790
:00485B63 C3                      ret


:00485B64 B8108F4800              mov eax, 00488F10
:00485B69 E9D2B0FFFF              jmp 00480C40
:00485B6E CC                      int 03
:00485B6F CC                      int 03
:00485B70 8D8D3CFFFFFF            lea ecx, dword ptr [ebp+FFFFFF3C]
:00485B76 E825FBFEFF              call 004756A0
:00485B7B C3                      ret


:00485B7C 8D8DECF4FFFF            lea ecx, dword ptr [ebp+FFFFF4EC]
:00485B82 E8A9FBFEFF              call 00475730
:00485B87 C3                      ret


:00485B88 B8488F4800              mov eax, 00488F48
:00485B8D E9AEB0FFFF              jmp 00480C40
:00485B92 CC                      int 03
:00485B93 CC                      int 03
:00485B94 CC                      int 03
:00485B95 CC                      int 03
:00485B96 CC                      int 03
:00485B97 CC                      int 03
:00485B98 CC                      int 03
:00485B99 CC                      int 03
:00485B9A CC                      int 03
:00485B9B CC                      int 03
:00485B9C CC                      int 03
:00485B9D CC                      int 03
:00485B9E CC                      int 03
:00485B9F CC                      int 03
:00485BA0 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485BA3 83C10C                  add ecx, 0000000C
:00485BA6 E84586F8FF              call 0040E1F0
:00485BAB C3                      ret


:00485BAC 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485BAF 83C118                  add ecx, 00000018
:00485BB2 E8D9FBFEFF              call 00475790
:00485BB7 C3                      ret


:00485BB8 B8788F4800              mov eax, 00488F78
:00485BBD E97EB0FFFF              jmp 00480C40
:00485BC2 CC                      int 03
:00485BC3 CC                      int 03
:00485BC4 CC                      int 03
:00485BC5 CC                      int 03
:00485BC6 CC                      int 03
:00485BC7 CC                      int 03
:00485BC8 CC                      int 03
:00485BC9 CC                      int 03
:00485BCA CC                      int 03
:00485BCB CC                      int 03
:00485BCC CC                      int 03
:00485BCD CC                      int 03
:00485BCE CC                      int 03
:00485BCF CC                      int 03
:00485BD0 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485BD3 83C10C                  add ecx, 0000000C
:00485BD6 E81586F8FF              call 0040E1F0
:00485BDB C3                      ret


:00485BDC 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485BDF 83C118                  add ecx, 00000018
:00485BE2 E8A9FBFEFF              call 00475790
:00485BE7 C3                      ret


:00485BE8 B8A88F4800              mov eax, 00488FA8
:00485BED E94EB0FFFF              jmp 00480C40
:00485BF2 CC                      int 03
:00485BF3 CC                      int 03
:00485BF4 CC                      int 03
:00485BF5 CC                      int 03
:00485BF6 CC                      int 03
:00485BF7 CC                      int 03
:00485BF8 CC                      int 03
:00485BF9 CC                      int 03
:00485BFA CC                      int 03
:00485BFB CC                      int 03
:00485BFC CC                      int 03
:00485BFD CC                      int 03
:00485BFE CC                      int 03
:00485BFF CC                      int 03
:00485C00 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485C03 E8E885F8FF              call 0040E1F0
:00485C08 C3                      ret


:00485C09 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485C0C 83C118                  add ecx, 00000018
:00485C0F E80C55FFFF              call 0047B120
:00485C14 C3                      ret


:00485C15 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485C18 83C14C                  add ecx, 0000004C
:00485C1B E80055FFFF              call 0047B120
:00485C20 C3                      ret


:00485C21 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485C24 81C180000000            add ecx, 00000080
:00485C2A E8F154FFFF              call 0047B120
:00485C2F C3                      ret


:00485C30 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485C33 81C1B4000000            add ecx, 000000B4
:00485C39 E83255FFFF              call 0047B170
:00485C3E C3                      ret


:00485C3F B8D88F4800              mov eax, 00488FD8
:00485C44 E9F7AFFFFF              jmp 00480C40
:00485C49 CC                      int 03
:00485C4A CC                      int 03
:00485C4B CC                      int 03
:00485C4C CC                      int 03
:00485C4D CC                      int 03
:00485C4E CC                      int 03
:00485C4F CC                      int 03
:00485C50 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485C53 E89885F8FF              call 0040E1F0
:00485C58 C3                      ret


:00485C59 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485C5C 83C118                  add ecx, 00000018
:00485C5F E8BC54FFFF              call 0047B120
:00485C64 C3                      ret


:00485C65 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485C68 83C14C                  add ecx, 0000004C
:00485C6B E8B054FFFF              call 0047B120
:00485C70 C3                      ret


:00485C71 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485C74 81C180000000            add ecx, 00000080
:00485C7A E8A154FFFF              call 0047B120
:00485C7F C3                      ret


:00485C80 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485C83 81C1B4000000            add ecx, 000000B4
:00485C89 E8E254FFFF              call 0047B170
:00485C8E C3                      ret


:00485C8F B820904800              mov eax, 00489020
:00485C94 E9A7AFFFFF              jmp 00480C40
:00485C99 CC                      int 03
:00485C9A CC                      int 03
:00485C9B CC                      int 03
:00485C9C CC                      int 03
:00485C9D CC                      int 03
:00485C9E CC                      int 03
:00485C9F CC                      int 03
:00485CA0 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485CA3 E8F7CAFDFF              call 0046279F
:00485CA8 C3                      ret


:00485CA9 B868904800              mov eax, 00489068
:00485CAE E98DAFFFFF              jmp 00480C40
:00485CB3 CC                      int 03
:00485CB4 CC                      int 03
:00485CB5 CC                      int 03
:00485CB6 CC                      int 03
:00485CB7 CC                      int 03
:00485CB8 CC                      int 03
:00485CB9 CC                      int 03
:00485CBA CC                      int 03
:00485CBB CC                      int 03
:00485CBC CC                      int 03
:00485CBD CC                      int 03
:00485CBE CC                      int 03
:00485CBF CC                      int 03
:00485CC0 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485CC3 E8D7CAFDFF              call 0046279F
:00485CC8 C3                      ret


:00485CC9 B890904800              mov eax, 00489090
:00485CCE E96DAFFFFF              jmp 00480C40
:00485CD3 CC                      int 03
:00485CD4 CC                      int 03
:00485CD5 CC                      int 03
:00485CD6 CC                      int 03
:00485CD7 CC                      int 03
:00485CD8 CC                      int 03
:00485CD9 CC                      int 03
:00485CDA CC                      int 03
:00485CDB CC                      int 03
:00485CDC CC                      int 03
:00485CDD CC                      int 03
:00485CDE CC                      int 03
:00485CDF CC                      int 03
:00485CE0 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485CE3 E80885F8FF              call 0040E1F0
:00485CE8 C3                      ret


:00485CE9 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485CEC 83C118                  add ecx, 00000018
:00485CEF E82C54FFFF              call 0047B120
:00485CF4 C3                      ret


:00485CF5 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485CF8 83C14C                  add ecx, 0000004C
:00485CFB E82054FFFF              call 0047B120
:00485D00 C3                      ret


:00485D01 B8B8904800              mov eax, 004890B8
:00485D06 E935AFFFFF              jmp 00480C40
:00485D0B CC                      int 03
:00485D0C CC                      int 03
:00485D0D CC                      int 03
:00485D0E CC                      int 03
:00485D0F CC                      int 03
:00485D10 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485D13 E8D884F8FF              call 0040E1F0
:00485D18 C3                      ret


:00485D19 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485D1C 83C118                  add ecx, 00000018
:00485D1F E8FC53FFFF              call 0047B120
:00485D24 C3                      ret


:00485D25 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485D28 83C14C                  add ecx, 0000004C
:00485D2B E8F053FFFF              call 0047B120
:00485D30 C3                      ret


:00485D31 B8F0904800              mov eax, 004890F0
:00485D36 E905AFFFFF              jmp 00480C40
:00485D3B CC                      int 03
:00485D3C CC                      int 03
:00485D3D CC                      int 03
:00485D3E CC                      int 03
:00485D3F CC                      int 03
:00485D40 8D8DF0FEFFFF            lea ecx, dword ptr [ebp+FFFFFEF0]
:00485D46 E885D5F7FF              call 004032D0
:00485D4B C3                      ret


:00485D4C B828914800              mov eax, 00489128
:00485D51 E9EAAEFFFF              jmp 00480C40
:00485D56 8B4DC0                  mov ecx, dword ptr [ebp-40]
:00485D59 E825DFFDFF              call 00463C83
:00485D5E C3                      ret


:00485D5F B850914800              mov eax, 00489150
:00485D64 E9D7AEFFFF              jmp 00480C40
:00485D69 8D4D98                  lea ecx, dword ptr [ebp-68]
:00485D6C E8BFFAFEFF              call 00475830
:00485D71 C3                      ret


:00485D72 B878914800              mov eax, 00489178
:00485D77 E9C4AEFFFF              jmp 00480C40
:00485D7C CC                      int 03
:00485D7D CC                      int 03
:00485D7E CC                      int 03
:00485D7F CC                      int 03
:00485D80 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485D83 E817CAFDFF              call 0046279F
:00485D88 C3                      ret


:00485D89 B8A0914800              mov eax, 004891A0
:00485D8E E9ADAEFFFF              jmp 00480C40
:00485D93 CC                      int 03
:00485D94 CC                      int 03
:00485D95 CC                      int 03
:00485D96 CC                      int 03
:00485D97 CC                      int 03
:00485D98 CC                      int 03
:00485D99 CC                      int 03
:00485D9A CC                      int 03
:00485D9B CC                      int 03
:00485D9C CC                      int 03
:00485D9D CC                      int 03
:00485D9E CC                      int 03
:00485D9F CC                      int 03
:00485DA0 8B4DF0                  mov ecx, dword ptr [ebp-10]
:00485DA3 E8F7C9FDFF              call 0046279F
:00485DA8 C3                      ret


:00485DA9 B8C8914800              mov eax, 004891C8
:00485DAE E98DAEFFFF              jmp 00480C40
:00485DB3 CC                      int 03
:00485DB4 CC                      int 03
:00485DB5 CC                      int 03
:00485DB6 CC                      int 03
:00485DB7 CC                      int 03
:00485DB8 CC                      int 03
:00485DB9 CC                      int 03
:00485DBA CC                      int 03
:00485DBB CC                      int 03
:00485DBC CC                      int 03
:00485DBD CC                      int 03
:00485DBE CC                      int 03
:00485DBF CC                      int 03
:00485DC0 8D4DE8                  lea ecx, dword ptr [ebp-18]
:00485DC3 E88131F9FF              call 00418F49
:00485DC8 C3                      ret


:00485DC9 B8F0914800              mov eax, 004891F0
:00485DCE E96DAEFFFF              jmp 00480C40
:00485DD3 00000000000000000000    BYTE 10 DUP(0)
:00485DDD 00000000000000000000    BYTE 10 DUP(0)
:00485DE7 00000000000000000000    BYTE 10 DUP(0)
:00485DF1 00000000000000000000    BYTE 10 DUP(0)
:00485DFB 00000000000E97080022    BYTE 10 DUP(0)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
:FFFFFFFF    End Of Listing
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
